diff --git a/.editorconfig b/.editorconfig
new file mode 100644
index 00000000..630c92d7
--- /dev/null
+++ b/.editorconfig
@@ -0,0 +1,24 @@
+# EditorConfig — whitespace/EOL baseline across every file surface (Wave 7 tooling, #280).
+# https://editorconfig.org  ·  Mirrors the formatters: ruff (Python), and the per-surface
+# tools landing in #281 (shfmt -i 4 for shell, Biome 2-space for JS/CSS/JSON).
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+trim_trailing_whitespace = true
+indent_style = space
+indent_size = 4
+
+# Web/config surfaces conventionally use 2-space indent.
+[*.{js,mjs,cjs,css,json,jsonc,yml,yaml,toml,proto}]
+indent_size = 2
+
+# Markdown uses two trailing spaces for a hard line break — don't strip them.
+[*.md]
+trim_trailing_whitespace = false
+
+# Makefiles require real tabs.
+[Makefile]
+indent_style = tab
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..c5484ae4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,49 @@
+# Dependabot (Wave 7 tooling, #282): automated dependency + CVE update PRs across every
+# supply-chain surface. Grouped + weekly to keep PR volume sane.
+version: 2
+updates:
+  # GitHub Actions — keep the SHA-pinned actions (#282) fresh. Dependabot rewrites the SHA and the
+  # `# vX.Y.Z` comment together.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      actions:
+        patterns: ["*"]
+
+  # Dashboard Python deps — bumps the hashed uv.lock + pyproject floors (#283).
+  - package-ecosystem: "uv"
+    directory: "/build/dashboard"
+    schedule:
+      interval: "weekly"
+    groups:
+      python:
+        patterns: ["*"]
+    ignore:
+      # protobuf/grpcio are pinned to what the vendored Tari gRPC stubs assert at import time
+      # (see build/dashboard/pyproject.toml); a major bump needs the stubs regenerated first.
+      - dependency-name: "protobuf"
+        update-types: ["version-update:semver-major"]
+      - dependency-name: "grpcio"
+        update-types: ["version-update:semver-major"]
+
+  # Base-image digests across every build/* Dockerfile (incl. the uv build image). This is the
+  # mechanism that clears base-distro CVEs — e.g. the openssl point-release accepted in .trivyignore.
+  - package-ecosystem: "docker"
+    directories:
+      - "/build/dashboard"
+      - "/build/monero"
+      - "/build/p2pool"
+      - "/build/tor"
+      - "/build/xmrig-proxy"
+    schedule:
+      interval: "weekly"
+    groups:
+      docker:
+        patterns: ["*"]
+    ignore:
+      # Major/minor base bumps (e.g. python 3.11->3.14, ubuntu 24.04->26.04) are deliberate
+      # migrations, not security updates — keep Dependabot to digest + patch within the pinned tag.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major", "version-update:semver-minor"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a46996f3..9e4e0023 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,34 +2,53 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, develop]
   pull_request:
 
+# Least privilege (#282): every job here only reads the repo — none push commits, comment, or
+# publish packages. Narrowing the default GITHUB_TOKEN limits the blast radius of a compromised step.
+permissions:
+  contents: read
+
 jobs:
   dashboard:
     name: Dashboard tests (pytest + coverage)
     runs-on: ubuntu-latest
+    env:
+      UV_PYTHON_DOWNLOADS: never  # use the setup-python 3.11; don't fetch another interpreter
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0  # full history so diff-cover can diff the PR against origin/develop (#286)
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.11"
-      - name: Install dashboard with test extras
-        run: pip install -e "build/dashboard[test]"
-      - name: Run pytest with coverage gate
-        working-directory: build/dashboard
-        run: python -m pytest --cov=mining_dashboard --cov-report=term-missing --cov-fail-under=80
+      - name: "Install uv (pinned — reproducible, hash-locked installs, #283)"
+        # Curl the pinned installer (same posture as hadolint below); avoids a mutable-tag action.
+        run: |
+          export UV_INSTALL_DIR="$HOME/.local/bin"   # deterministic install dir (runners may set CARGO_HOME)
+          curl -LsSf https://astral.sh/uv/0.10.10/install.sh | sh
+          echo "$UV_INSTALL_DIR" >> "$GITHUB_PATH"
+      - name: Dashboard tests + coverage gate (emits coverage.xml)
+        run: make test-dashboard
+      - name: "Patch-coverage gate — changed lines >=90% (diff-cover vs origin/develop, #286)"
+        run: |
+          git fetch --no-tags origin develop
+          make test-patch-coverage
       - name: Fake-daemon contract test (real clients vs controllable fakes)
         # Points the real Monero/Tari clients at the integration fakes and asserts they parse
         # every state (synced/syncing/down). Docker-free, so it runs on every PR (issue #54).
-        run: PYTHONPATH=build/dashboard python -m pytest tests/integration/fakes -q
+        run: make test-fakes
 
   frontend:
     name: Frontend logic tests (node --test)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: "20"
       # Pure client logic (worker sort, tooltip formatting) lives in static/logic.mjs and is
@@ -42,7 +61,9 @@ jobs:
     name: Dashboard image (Docker test stage)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Build the dashboard test stage (installs package + runs the suite in-container)
         run: docker build --target test ./build/dashboard
 
@@ -59,38 +80,125 @@ jobs:
       matrix:
         service: [monero, p2pool, tor, xmrig-proxy, dashboard]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: docker build ./build/${{ matrix.service }}
         run: docker build -t "pithead-${{ matrix.service }}:ci" "./build/${{ matrix.service }}"
+      - name: Scan image for CVEs (Trivy)
+        # Gate on actionable (fixable) HIGH/CRITICAL only; accepted findings live in .trivyignore.
+        # Must stay green before v1.1 images publish (#282).
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: pithead-${{ matrix.service }}:ci
+          scanners: vuln
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: "1"
+          trivyignores: .trivyignore
 
   hadolint:
     name: Dockerfile lint (hadolint)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - name: Install hadolint
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: "Install hadolint (pinned + sha256-verified, #286)"
         run: |
-          sudo curl -fsSL -o /usr/local/bin/hadolint \
+          curl -fsSL -o /tmp/hadolint \
             https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64
-          sudo chmod +x /usr/local/bin/hadolint
+          echo "56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010  /tmp/hadolint" | sha256sum -c -
+          sudo install -m 0755 /tmp/hadolint /usr/local/bin/hadolint
       - name: Lint all build/* Dockerfiles (config in .hadolint.yaml)
         run: hadolint build/*/Dockerfile
 
+  python-lint:
+    name: Python lint + format (ruff)
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON_DOWNLOADS: never
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Install uv (pinned)
+        run: |
+          export UV_INSTALL_DIR="$HOME/.local/bin"   # deterministic install dir (runners may set CARGO_HOME)
+          curl -LsSf https://astral.sh/uv/0.10.10/install.sh | sh
+          echo "$UV_INSTALL_DIR" >> "$GITHUB_PATH"
+      - name: ruff check + format --check (config in build/dashboard/pyproject.toml + root ruff.toml)
+        # Single source of truth: the Makefile `lint-py` target, which runs ruff via uv from the
+        # locked `dev` extra — one pinned ruff for CI, pre-commit, and local devs.
+        run: make lint-py
+
+  gitleaks:
+    name: Secret scan (gitleaks)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          fetch-depth: 0  # full history so the scan covers every commit, not just the tip
+      - name: Scan git history for secrets (gitleaks, pinned by digest)
+        # Run the binary via its pinned image (the gitleaks-action requires a license for org repos).
+        # Accepted false positives live in .gitleaks.toml.
+        run: |
+          docker run --rm -v "$PWD":/repo \
+            ghcr.io/gitleaks/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
+            git /repo --no-banner --redact --config /repo/.gitleaks.toml
+
+  zizmor:
+    name: Workflow audit (zizmor)
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON_DOWNLOADS: never
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Install uv (pinned)
+        run: |
+          export UV_INSTALL_DIR="$HOME/.local/bin"
+          curl -LsSf https://astral.sh/uv/0.10.10/install.sh | sh
+          echo "$UV_INSTALL_DIR" >> "$GITHUB_PATH"
+      - name: Audit workflows (injection, token scope, self-hosted-runner risks)
+        run: uvx zizmor@1.25.2 --offline .github/workflows/
+
   shell:
     name: Shell tests (shellcheck + pithead suite)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      # shellcheck is preinstalled on ubuntu-* runners, so we invoke it directly.
-      # Avoid `apt-get update`, which refreshes every configured source (incl.
-      # unrelated third-party mirrors like dl.google.com) and intermittently fails
-      # the job when one is briefly out of sync — see issue #64.
-      - name: Lint pithead, build/* container scripts, and test scripts
-        # Single source of truth: the Makefile `lint` target (so the file list can't drift between
-        # here and `make lint`). Now also covers build/*/*.sh — the entrypoints + healthchecks that
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: "Install shellcheck + shfmt (pinned + sha256-verified, #286)"
+        # Direct upstream-release downloads with a sha256 check (RigForge convention) instead of the
+        # runner's preinstalled shellcheck / apt — reproducible, and immune to the apt-mirror
+        # flakiness of #64. Keep these pins in sync with the local-dev tooling.
+        run: |
+          curl -fsSL -o /tmp/shfmt \
+            https://github.com/mvdan/sh/releases/download/v3.13.1/shfmt_v3.13.1_linux_amd64
+          echo "fb096c5d1ac6beabbdbaa2874d025badb03ee07929f0c9ff67563ce8c75398b1  /tmp/shfmt" | sha256sum -c -
+          sudo install -m 0755 /tmp/shfmt /usr/local/bin/shfmt
+          curl -fsSL -o /tmp/sc.tar.xz \
+            https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.linux.x86_64.tar.xz
+          echo "8c3be12b05d5c177a04c29e3c78ce89ac86f1595681cab149b65b97c4e227198  /tmp/sc.tar.xz" | sha256sum -c -
+          tar -xJf /tmp/sc.tar.xz -C /tmp
+          sudo install -m 0755 /tmp/shellcheck-v0.11.0/shellcheck /usr/local/bin/shellcheck
+      - name: Lint pithead, build/* container scripts, and test scripts (shellcheck + shfmt)
+        # Single source of truth: the Makefile `lint-sh` target (so the file list can't drift
+        # between here and the Makefile). Covers build/*/*.sh — the entrypoints + healthchecks that
         # run in every container (#124). Gate on warnings+errors; info-level style nits vary by
-        # shellcheck version.
-        run: make lint
+        # shellcheck version. Python lint runs in its own `python-lint` job (ruff isn't on this
+        # runner; `make lint` runs both for local devs).
+        run: make lint-sh
       - name: Run pithead test suite
         run: bash tests/stack/run.sh
       - name: Run integration harness self-test
@@ -107,6 +215,32 @@ jobs:
     name: Compose config + security hardening
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Validate docker-compose.yml interpolation + hardening invariants (#90)
         run: bash tests/stack/test_compose.sh
+
+  lint-surfaces:
+    name: Lint per-surface (biome, yaml, markdown, proto, toml)
+    runs-on: ubuntu-latest
+    env:
+      UV_PYTHON_DOWNLOADS: never
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: "20"
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.11"
+      - name: Install uv (pinned)
+        run: |
+          export UV_INSTALL_DIR="$HOME/.local/bin"
+          curl -LsSf https://astral.sh/uv/0.10.10/install.sh | sh
+          echo "$UV_INSTALL_DIR" >> "$GITHUB_PATH"
+      - name: Lint JS/CSS (Biome), YAML, Markdown, proto (buf), TOML (taplo)
+        # Single source of truth: the Makefile targets. Tools run via npx/uvx/docker (preinstalled).
+        run: make lint-js lint-yaml lint-md lint-proto lint-toml
diff --git a/.github/workflows/integration-mini-stack.yml b/.github/workflows/integration-mini-stack.yml
index 958a41c3..ed5f8aef 100644
--- a/.github/workflows/integration-mini-stack.yml
+++ b/.github/workflows/integration-mini-stack.yml
@@ -13,12 +13,17 @@ on:
       - "build/dashboard/**"
       - ".github/workflows/integration-mini-stack.yml"
 
+permissions:
+  contents: read
+
 jobs:
   mini-stack:
     name: Fake-daemon mini-stack (docker)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       # ubuntu-latest ships Docker with the Compose v2 plugin — no setup needed.
       - name: Run the fake-daemon mini-stack
         run: bash tests/integration/mini-stack/run-mini-stack.sh
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
new file mode 100644
index 00000000..e8adeada
--- /dev/null
+++ b/.github/workflows/lychee.yml
@@ -0,0 +1,27 @@
+name: Link check (lychee)
+
+# Scheduled (not per-PR) so flaky external links never redden a PR (#281). The run goes red in the
+# Actions tab if a link breaks; trigger on demand with workflow_dispatch. Ignored URLs: .lycheeignore.
+on:
+  schedule:
+    - cron: "0 6 * * 1" # Mondays 06:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  lychee:
+    name: Check Markdown links
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - name: Check links in Markdown
+        uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2.8.0
+        with:
+          args: "--no-progress './**/*.md'"
+          fail: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # higher github.com rate limit for repo links
diff --git a/.github/workflows/release-gate.yml b/.github/workflows/release-gate.yml
index 421a2e76..40282ebd 100644
--- a/.github/workflows/release-gate.yml
+++ b/.github/workflows/release-gate.yml
@@ -32,14 +32,26 @@ concurrency:
   group: release-gate
   cancel-in-progress: false
 
+# Least privilege (#282): this runs on a self-hosted box holding real keys — keep the token read-only.
+permissions:
+  contents: read
+
 jobs:
   release-gate:
     name: Tier-4 live matrix (real nodes)
+    # Only run automatically once a self-hosted runner is actually wired up — set the repo variable
+    # ENABLE_RELEASE_GATE=true when one is registered. Without this guard, every push to main queues
+    # a job no runner can claim, and GitHub auto-cancels it after a 24h timeout — a permanent red ✗
+    # on main. A skipped job is green/neutral instead. A manual workflow_dispatch ALWAYS runs, so a
+    # maintainer can still validate a reviewed ref on a registered runner on demand.
+    if: ${{ github.event_name == 'workflow_dispatch' || vars.ENABLE_RELEASE_GATE == 'true' }}
     # Register the server with these labels: `pithead-release` scopes the gate to the dedicated
     # box; prefer an ephemeral / just-in-time runner in its own runner group.
     runs-on: [self-hosted, pithead-release]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Validate against the real synced nodes
         # Inputs go through env (not interpolated into the script) to avoid shell injection.
@@ -64,7 +76,7 @@ jobs:
 
       - name: Upload artifacts (redacted)
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-gate-results
           path: tests/integration/results/
diff --git a/.gitignore b/.gitignore
index 9c1ee478..8fa12d95 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,12 +18,15 @@ __pycache__/
 *.pyc
 .pytest_cache/
 .coverage
+coverage.xml
 htmlcov/
 *.egg-info/
 .eggs/
+.venv/
+.ruff_cache/
 
 # Integration test artifacts (manifest, per-scenario logs, captured state)
 /tests/integration/results/
 
 # OS
-.DS_Store
\ No newline at end of file
+.DS_Store
diff --git a/.gitleaks.toml b/.gitleaks.toml
new file mode 100644
index 00000000..f4bab3ea
--- /dev/null
+++ b/.gitleaks.toml
@@ -0,0 +1,13 @@
+# gitleaks secret-scan config (Wave 7 tooling, #282). Extends the upstream default ruleset.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Accepted false positives"
+regexTarget = "line"
+# curl auth assembled from shell ENV VARS (e.g. `-u "${USER:-}:${PASS:-}"`) is not a hardcoded
+# secret — the upstream `curl-auth-user` rule can't distinguish `${VAR}` from a literal credential.
+# This pattern only matches env-var expansions, so a real `-u "admin:hunter2"` is still caught.
+regexes = [
+  '''-u "\$\{[A-Z_]+:-\}:\$\{[A-Z_]+:-\}"''',
+]
diff --git a/.lycheeignore b/.lycheeignore
new file mode 100644
index 00000000..4a4910b9
--- /dev/null
+++ b/.lycheeignore
@@ -0,0 +1,7 @@
+# Links lychee should skip (Wave 7 tooling, #281). One URL regex per line.
+# Local/example/non-resolvable addresses that appear in docs as illustrations.
+https?://127\.0\.0\.1.*
+https?://localhost.*
+https?://0\.0\.0\.0.*
+https?://example\.(com|org).*
+.*\.onion.*
diff --git a/.markdownlint-cli2.jsonc b/.markdownlint-cli2.jsonc
new file mode 100644
index 00000000..2f90b554
--- /dev/null
+++ b/.markdownlint-cli2.jsonc
@@ -0,0 +1,21 @@
+// markdownlint-cli2 config (Wave 7 tooling, #281). Lints the repo's Markdown; the remaining
+// rules (blanks around headings/lists/fences/tables, emphasis style, bare URLs, etc.) are mostly
+// auto-fixable with `--fix`.
+{
+  "config": {
+    "MD013": false, // line-length: prose/tables/URLs run long — not worth gating
+    "MD033": false, // inline HTML: intentional in docs (<details>, <img>, <br>, badges)
+    "MD041": false, // first-line h1: some docs open with badges/intro before the heading
+    "MD040": false, // fenced-code-language: some blocks are plain console output
+    "MD028": false, // we place consecutive `>` admonition callouts intentionally
+    "MD001": false, // the README opens `# title` then an `###` tagline by design
+    "MD024": { "siblings_only": true } // Keep-a-Changelog repeats "Fixed"/"Added" under each version
+  },
+  "globs": ["**/*.md"],
+  "ignores": [
+    "**/node_modules/**",
+    "**/.venv/**",
+    "build/dashboard/mining_dashboard/client/tari/generated/**",
+    "docs/test-inventory.md" // generated by `make test-inventory`; not hand-edited
+  ]
+}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
new file mode 100644
index 00000000..34e95778
--- /dev/null
+++ b/.pre-commit-config.yaml
@@ -0,0 +1,84 @@
+# Pre-commit hooks (Wave 7 tooling, #280). Local == CI: these mirror `make lint` + the CI lint
+# jobs, so issues are caught before they reach a PR. Set up once with:
+#   uv sync --project build/dashboard --extra dev && uv run --project build/dashboard pre-commit install
+# Later Wave 7 children add more hooks here (#281 shfmt/Biome/yamllint/markdownlint). Keep the
+# ruff `rev` in lockstep with the `dev` extra's ruff pin in build/dashboard/pyproject.toml.
+repos:
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.17
+    hooks:
+      # Lints all repo Python; ruff discovers the right config per file (the dashboard package's
+      # pyproject.toml, or the root ruff.toml for the integration-test fakes).
+      - id: ruff-check
+        args: [--fix]
+      - id: ruff-format
+
+  # Secret scanning (#282) — stop a key reaching history in the first place. Uses .gitleaks.toml.
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      # Cheap, high-value guards across every surface.
+      - id: detect-private-key  # never commit an onion/wallet/SSH private key
+      - id: check-added-large-files
+      # Skip generated gRPC stubs and vendored/minified third-party assets — not ours to reformat.
+      - id: end-of-file-fixer
+        exclude: '^build/dashboard/mining_dashboard/(client/tari/generated/|web/static/vendor/)'
+      - id: trailing-whitespace
+        # Also skip Markdown — two trailing spaces are a hard line break (see .editorconfig).
+        exclude: '(^build/dashboard/mining_dashboard/(client/tari/generated/|web/static/vendor/)|\.md$)'
+
+  # Per-surface lint/format (#281). These delegate to the Makefile targets so tool versions and file
+  # lists stay single-sourced (no drift between local, pre-commit, and CI). They need the relevant
+  # tools available (shellcheck, shfmt, node/npx, uv, docker) — see CONTRIBUTING.md.
+  - repo: local
+    hooks:
+      - id: lint-sh
+        name: shellcheck + shfmt
+        entry: make lint-sh
+        language: system
+        types_or: [shell]
+        pass_filenames: false
+      - id: lint-js
+        name: biome (static frontend)
+        entry: make lint-js
+        language: system
+        files: ^build/dashboard/mining_dashboard/web/static/.*\.(js|mjs|css)$
+        pass_filenames: false
+      - id: lint-yaml
+        name: yamllint
+        entry: make lint-yaml
+        language: system
+        types: [yaml]
+        pass_filenames: false
+      - id: lint-md
+        name: markdownlint
+        entry: make lint-md
+        language: system
+        types: [markdown]
+        pass_filenames: false
+      - id: lint-proto
+        name: buf (proto)
+        entry: make lint-proto
+        language: system
+        types: [proto]
+        pass_filenames: false
+      - id: lint-toml
+        name: taplo (toml)
+        entry: make lint-toml
+        language: system
+        types: [toml]
+        pass_filenames: false
+      # Keep docs/test-inventory.md in lockstep with the suites (#54). The CI shell job already
+      # FAILS on drift (test-inventory-check); this hook regenerates it locally so a test add/remove
+      # never reaches CI stale — same auto-fix UX as ruff-format. Static grep, no test run, so cheap.
+      - id: test-inventory
+        name: test inventory (regenerate docs/test-inventory.md)
+        entry: make test-inventory
+        language: system
+        files: '^(build/dashboard/tests/|tests/(stack|integration)/|tests/inventory\.sh)'
+        pass_filenames: false
diff --git a/.taplo.toml b/.taplo.toml
new file mode 100644
index 00000000..3bb24e96
--- /dev/null
+++ b/.taplo.toml
@@ -0,0 +1,2 @@
+# taplo (TOML formatter) config (Wave 7 tooling, #281).
+exclude = ["**/uv.lock", "**/.venv/**", "**/node_modules/**"]
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 00000000..cd3c7dc8
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,14 @@
+# Trivy ignore file (Wave 7 tooling, #282). One finding ID per line.
+#
+# The image scan gates on ACTIONABLE (fixable) HIGH/CRITICAL only (`--ignore-unfixed`) — unfixed
+# distro CVEs are reported but don't block. The entries below are the currently-accepted *fixable*
+# findings, each with a rationale and how it clears. Revisit whenever Dependabot bumps a base image.
+
+# openssl: the fix is a base-distro point release (Debian deb13u2 / Ubuntu 3.0.13-0ubuntu3.11) not
+# yet in our digest-pinned bases. Cleared when Dependabot (docker) bumps the base image digests.
+CVE-2026-45447
+
+# Base-image build tooling living in the python:3.11-slim *system* site-packages — NOT in the app's
+# /app/.venv and never invoked at runtime (the entrypoint runs the venv's python). Cleared by a base bump.
+CVE-2026-23949
+CVE-2026-24049
diff --git a/.yamllint b/.yamllint
new file mode 100644
index 00000000..bdcce788
--- /dev/null
+++ b/.yamllint
@@ -0,0 +1,11 @@
+# yamllint config (Wave 7 tooling, #281). Extends the default ruleset; relaxes the rules that
+# fight our house style while keeping the hygiene ones (trailing space, tabs, final newline, etc.).
+extends: default
+rules:
+  line-length: disable          # config/comments/URLs run long — not worth gating or wrapping
+  document-start: disable       # we don't use a leading `---`
+  truthy:
+    check-keys: false           # allow GitHub Actions' `on:` key (otherwise flagged truthy)
+  comments:
+    min-spaces-from-content: 1   # we use `value  # comment` with a single space in places
+  comments-indentation: disable
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3f8b1e6f..a7907fe9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,92 @@ Pithead ships as **one product, one version** — the version lives in the top-l
 [`VERSION`](VERSION) file and every released image is tagged with it. Releases are cut
 per the process in [`docs/releasing.md`](docs/releasing.md).
 
+## [1.1.0] - 2026-07-01
+
+**Privacy release — the stack is now Tor-first by default and fail-closed.** Outbound P2Pool sidechain
+peers (#165) and XvB donation mining (#166) route over Tor out of the box, a host firewall enforces
+**Tor-only egress fail-closed** (#270) so a misconfiguration can't silently leak your IP, and every
+container now runs **non-root** (#255/#91). Plus XvB raffle auto-registration, a Stack Topology panel,
+and a large supply-chain / CI hardening wave. This is the first minor release on top of the 1.0.x line;
+upgrade in place with `./pithead upgrade` (or re-download the bundle).
+
+**Upgrade note:** the Tor-by-default routing and the fail-closed egress firewall are picked up
+automatically on `upgrade`. The two config example files were renamed for clarity —
+**`config.minimal.json`** (the quick-start: just the two wallet addresses) and
+**`config.reference.json`** (all options); your own `config.json` and preserved secrets (Tor onions,
+RPC credentials, proxy token) are untouched.
+
+### Added
+
+- **Tor-by-default outbound routing.** P2Pool's outbound sidechain P2P (#165) and XvB donation mining
+  (#166) now ride Tor by default, closing the two clearnet yield paths that were left open in v1.0.
+  The local monerod RPC/ZMQ path stays **direct** via a loopback bridge so mining is unaffected (see
+  Fixed, #278).
+- **Tor-only egress enforced fail-closed by a host firewall (#270).** A `DOCKER-USER` firewall installed
+  before the containers start (#276) blocks any non-Tor egress, so a bad flag or a stale image can't
+  leak your IP — it fails closed instead of leaking. The integration harness carries a **standing
+  no-clearnet-leak egress gate** (#274) so a regression is caught in CI.
+- **XvB raffle auto-registration (#263).** Miners are registered with the XMRvsBeast raffle
+  automatically — no manual signup — so donations count toward the raffle without an extra step.
+- **Stack Topology panel on the dashboard (#170).** A full wiring map of the stack: every ingress,
+  egress, and internal hop, labelled Tor vs clearnet, so you can see at a glance what talks to what
+  and over which transport.
+- **One config-driven worker-API probe, default no-auth (#171, #172).** The dashboard's per-worker
+  stats probe is now a single, config-driven request that defaults to no authentication (matching
+  RigForge's open-by-default worker API), eliminating the spurious `401` log noise; auth is opt-in via
+  `workers.api_auth` / an access token.
+- **Autonomous Tor-vs-clearnet benchmark harness (#256).** A self-driving benchmark that measures the
+  yield cost of running over Tor; the finalized methodology and results ship in `docs/privacy.md`
+  (Tor costs ~10% P2Pool yield on a mini node, with zero extra rejects — so Tor stays the default).
+- **Third-party attribution + GPLv3 source pointers (#259).** The bundled upstream components
+  (P2Pool, Monero, XMRig-proxy, Tari, Caddy, …) are now attributed with license and source pointers.
+
+### Changed
+
+- **All containers run non-root (uid 1000) (#255, #91).** Every first-party image declares a non-root
+  `USER`; data moved from `/root` to the user's home, and `pithead` chowns the data dirs to match on
+  `apply`/`upgrade`/`restore`. The dashboard now owns its volume, so it can finally `cap_drop: [ALL]`.
+  The migration handles an install upgraded from the root-container era (root-owned files under a
+  user-owned dir are chowned to the container uid).
+- **Config example files renamed** to `config.minimal.json` and `config.reference.json` (#326) — clearer
+  than the old names; the quick start and `setup` guidance point at the minimal one.
+- **Reproducible Python builds** with `uv` + a committed `uv.lock` (#283).
+
+### Fixed
+
+- **Tari merge-mining works under Tor (#313).** The Tor default silently killed Tari merge-mining —
+  p2pool dialled the merge-mine gRPC at a private Docker IP through Tor, which rejects RFC1918, so the
+  channel stuck at `TRANSIENT_FAILURE`. Fixed with a loopback bridge (mirroring #278), and the
+  dashboard "✔" is now gated on the channel actually being `READY`, not just configured.
+- **P2Pool ↔ monerod stays direct under Tor (#278).** #165's `--socks5` also proxied p2pool's *local*
+  monerod RPC/ZMQ, which p2pool only exempts for loopback — so with Tor on, p2pool couldn't fetch block
+  templates and mining stopped. The entrypoint now bridges `127.0.0.1` → the real node with `socat`, so
+  the node stays direct while the sidechain still rides Tor.
+- **Fail loud when a stale p2pool image drops the Tor flags (#273).** A compose↔image mismatch that
+  would have silently disabled Tor routing now fails the start instead of running clearnet unnoticed.
+- **Tor-egress firewall installed before compose on `upgrade` (#291)** and before containers start on
+  first bring-up (#276) — closing the startup window where a container could reach clearnet before the
+  firewall was in place.
+- **Tari clearnet peer dials now route through Tor SOCKS (#271).**
+- **XvB controller guarded against a stale/frozen stats fetch (#311).** A frozen XvB stats response no
+  longer steers the donation controller off stale data; the stale state is surfaced instead.
+- **Snapshot persistence-health bug (#330).**
+
+### Security
+
+- **Supply-chain & secrets hardening (#282).** gitleaks secret-scanning, Trivy image/filesystem
+  scanning, Dependabot scoped to safe updates, all GitHub Actions SHA-pinned, and zizmor for workflow
+  auditing — with `develop` branch protection wiring the checks in as required gates.
+- Non-root containers (#255) and Tor-only fail-closed egress (#270) are themselves the release's two
+  biggest security wins (see Changed / Added).
+
+### Internal
+
+- Repo-wide **ruff** lint + format (#280), per-surface linters (shfmt, Biome, yamllint, markdownlint,
+  buf, taplo) (#281), Hypothesis property tests over the money/numeric logic (#284), diff-cover patch
+  coverage adopted from RigForge (#286), and expanded live-validation coverage for the security
+  features (#206, #295, #170). Dev-facing only; no runtime change.
+
 ## [1.0.3] - 2026-06-14
 
 Hotfix — **validate the Monero payout address is a primary address**, so nobody silently mines to an
@@ -465,7 +551,7 @@ cd pithead && cp config.json.template config.json   # set your Monero + Tari pay
   node reports `target_height: 0` (no target), so the panel's `done` check — which compared
   `percent >= 100` against a target, and derived the state string from `has_target` first — never
   fired, leaving the *normal steady state* stuck at "loading" indefinitely (surfaced in the #180
-  gouda validation; mining and worker-gating were unaffected — those use monerod's RPC flag
+  live validation; mining and worker-gating were unaffected — those use monerod's RPC flag
   directly). The sync state now trusts monerod's authoritative caught-up signal (`reachable &&
   not is_syncing`), and the live integration harness asserts the panel reads "done" — closing the
   test gap that let this escape both the unit suite and the e2e matrix.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index b801517a..c8badb72 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -1,20 +1,36 @@
 # Contributing to Pithead
 
-Thanks for taking the time to contribute! Whether it's a bug fix, a docs tweak, or a
-whole new feature, contributions are very welcome. This guide covers the workflow.
+This guide covers the workflow for contributing bug fixes, docs changes, and features.
 
 ## Before you start
 
 - **Found a bug or have an idea?** Open an issue first. For anything beyond a small fix,
-  please discuss it in an issue before writing code — it saves everyone time and avoids
+  discuss it in an issue before writing code. It saves time and avoids
   surprises at review.
 - Check the [open issues](https://github.com/p2pool-starter-stack/pithead/issues) to see
   if someone's already on it.
 
+## Dev environment
+
+The dashboard uses [uv](https://docs.astral.sh/uv/) for dependency management; a hashed
+`uv.lock` pins every transitive dependency so installs are reproducible build-to-build. Its
+Python tooling ([`ruff`](https://docs.astral.sh/ruff/) lint + format,
+[`pre-commit`](https://pre-commit.com/)) lives in the `dev` extra. Install uv, then from the
+repo root:
+
+```bash
+uv sync --project build/dashboard --extra dev    # deps + tooling into build/dashboard/.venv, from the lock
+uv run --project build/dashboard pre-commit install
+```
+
+`make test` and `make lint-py` run through uv automatically (no venv to activate); `pre-commit`
+then runs `ruff` (plus a few hygiene hooks) on your changed files. If you change dependencies in
+`build/dashboard/pyproject.toml`, run `uv lock` and commit the updated `uv.lock`.
+
 ## Development workflow
 
 1. Fork the repo and create a branch off `main`.
-2. Make your change. Keep it focused — one logical change per PR.
+2. Make your change. Keep it focused: one logical change per PR.
 3. Run the full test suite locally:
 
    ```bash
@@ -23,9 +39,15 @@ whole new feature, contributions are very welcome. This guide covers the workflo
 
    This runs everything CI does without a server or Docker:
 
-   - **lint** — `shellcheck` over `pithead` and the test scripts (keep them
-     `--severity=warning` clean).
-   - **test-dashboard** — the dashboard `pytest` suite (must stay ≥ the **80% coverage gate**).
+   - **lint** — every file surface gets a linter/formatter check (`make lint` runs them all; run one
+     with `make lint-<surface>`): `lint-sh` (shellcheck + shfmt), `lint-py` (ruff), `lint-js` (Biome),
+     `lint-yaml` (yamllint), `lint-md` (markdownlint), `lint-proto` (buf), `lint-toml` (taplo). The
+     non-Python tools run via `npx`/`uvx`/`docker`, so a contributor needs **Node, uv, and Docker**
+     on PATH (plus `shfmt`); `pre-commit` runs the same checks on changed files. Link-checking
+     (`lychee`) runs on a weekly schedule, not per-PR.
+   - **test-dashboard** — the dashboard `pytest` suite (must stay ≥ the **80% total coverage gate**).
+     CI also runs **`make test-patch-coverage`** (`diff-cover`): new/changed lines must be **≥ 90%**
+     covered vs `origin/develop`, the ratchet that stops coverage rotting at the margin.
    - **test-stack** — the `pithead` shell test suite.
    - **test-compose** — `docker-compose.yml` interpolation validation.
    - **test-integration-selftest** — the integration harness's own pure logic.
@@ -34,9 +56,9 @@ whole new feature, contributions are very welcome. This guide covers the workflo
      regenerating [`docs/test-inventory.md`](docs/test-inventory.md) (`make test-inventory`).
 
    Bigger, infra-dependent suites run separately: `make test-mini-stack` (tier-3 docker) and
-   `make test-integration` (tier-4 live, against a real box — start with `--check`).
+   `make test-integration` (tier-4 live, against a real box; start with `--check`).
 
-4. **Add or update tests** for your change — cover the *intent* (a behavior/contract), not just
+4. **Add or update tests** for your change. Cover the *intent* (a behavior/contract), not just
    the line. The [Testing Guide](docs/testing-guide.md) has per-change recipes; the
    [Testing Strategy](docs/testing-strategy.md) explains the tiers.
 5. Update the docs in [`docs/`](docs/) (and the README, if relevant) for any
@@ -46,14 +68,16 @@ whole new feature, contributions are very welcome. This guide covers the workflo
 
 - Target the `main` branch and fill out the PR template.
 - Link the issue your PR addresses (e.g. `Closes #123`).
-- Make sure `make test` passes — CI will run the same checks.
+- Make sure `make test` passes; CI runs the same checks.
 - PRs require review before merging; the right reviewers are requested automatically via
   [CODEOWNERS](.github/CODEOWNERS).
 
 ## Style
 
-- Match the surrounding code. Shell scripts should pass `shellcheck --severity=warning`.
+- Match the surrounding code. Shell scripts should pass `shellcheck --severity=warning`;
+  Python is linted and formatted by `ruff` (config in `build/dashboard/pyproject.toml`).
+  Run `make lint-py`, or `cd build/dashboard && ruff format` to apply it.
 - Keep commits tidy and messages descriptive.
 
 By contributing, you agree that your contributions are licensed under the project's
-[MIT License](LICENSE). Thanks again! 🙌
+[MIT License](LICENSE).
diff --git a/LICENSE b/LICENSE
index 90bb9303..cb5cd778 100644
--- a/LICENSE
+++ b/LICENSE
@@ -19,3 +19,9 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+-------------------------------------------------------------------------------
+
+The MIT license above applies to this project's own code. Bundled third-party
+components — including the GPLv3 `p2pool` and `xmrig-proxy` binaries in the
+published images — retain their own licenses. See THIRD_PARTY_LICENSES.md.
diff --git a/Makefile b/Makefile
index 705cc487..1259a7b2 100644
--- a/Makefile
+++ b/Makefile
@@ -1,11 +1,15 @@
 # Local test entry points (mirror the GitHub Actions CI jobs).
-.PHONY: test test-dashboard test-stack test-compose test-integration test-integration-selftest test-fakes test-mini-stack lint release
+.PHONY: test test-dashboard test-patch-coverage test-stack test-compose test-integration test-integration-selftest test-fakes test-mini-stack lint lint-sh lint-py lint-js lint-yaml lint-md lint-proto lint-toml release
 
 test: lint test-dashboard test-stack test-compose test-integration-selftest test-fakes ## Run everything that doesn't need a server/docker
 
-test-dashboard: ## Dashboard unit/component tests with coverage gate
-	cd build/dashboard && PYTHONPATH=. python3 -m pytest \
-		--cov=mining_dashboard --cov-report=term-missing --cov-fail-under=80
+test-dashboard: ## Dashboard unit/component tests with coverage gate (deps from uv.lock); emits coverage.xml
+	cd build/dashboard && uv run --locked --extra test python -m pytest \
+		--cov=mining_dashboard --cov-report=term-missing --cov-report=xml --cov-fail-under=80
+
+test-patch-coverage: ## diff-cover (#286): new/changed lines must be >=90% covered (run after test-dashboard)
+	cd build/dashboard && uv run --locked --extra test \
+		diff-cover coverage.xml --compare-branch=origin/develop --fail-under=90
 
 test-stack: ## pithead shell test suite
 	bash tests/stack/run.sh
@@ -17,7 +21,7 @@ test-integration-selftest: ## Integration harness pure-logic self-test (no serve
 	bash tests/integration/selftest.sh
 
 test-fakes: ## Fake-daemon contract test — real dashboard clients vs controllable fakes (no docker)
-	PYTHONPATH=build/dashboard python3 -m pytest tests/integration/fakes -q
+	uv run --locked --project build/dashboard --extra test python -m pytest tests/integration/fakes -q
 
 test-mini-stack: ## Fake-daemon docker mini-stack end-to-end (needs docker; CI)
 	bash tests/integration/mini-stack/run-mini-stack.sh
@@ -37,11 +41,35 @@ test-inventory-check: ## Fail if docs/test-inventory.md is stale (CI drift guard
 test-integration: ## Run the live config-matrix integration suite (requires a test box; pass ARGS=...)
 	bash tests/integration/run.sh $(ARGS)
 
-lint: ## shellcheck the CLI, the build/* container scripts, the release script, and the test scripts
+lint: lint-sh lint-py lint-js lint-yaml lint-md lint-proto lint-toml ## Lint/format-check every surface
+
+lint-sh: ## shellcheck + shfmt over the CLI, build/* container scripts, release + test scripts
 	shellcheck --severity=warning pithead scripts/*.sh build/*/*.sh tests/stack/run.sh tests/stack/test_compose.sh \
 		tests/inventory.sh tests/integration/*.sh tests/integration/mini-stack/*.sh
+	shfmt -i 4 -d pithead $(shell git ls-files '*.sh')
+
+lint-py: ## ruff lint + format check on all repo Python (ruff runs via uv from the locked dev extra)
+	uv run --locked --project build/dashboard --extra dev ruff check .
+	uv run --locked --project build/dashboard --extra dev ruff format --check .
+
+lint-js: ## Biome lint + format check on the static frontend (config: biome.json)
+	npx --yes @biomejs/biome@2.5.0 check .
+
+lint-yaml: ## yamllint over all tracked YAML (config: .yamllint)
+	uvx yamllint $(shell git ls-files '*.yml' '*.yaml')
+
+lint-md: ## markdownlint over all Markdown (config: .markdownlint-cli2.jsonc)
+	npx --yes markdownlint-cli2@0.18.1
+
+lint-proto: ## buf lint + build on the vendored Tari protos (config: .../tari/proto/buf.yaml)
+	cd build/dashboard/mining_dashboard/client/tari/proto && \
+		docker run --rm -v "$$PWD":/workspace --workdir /workspace bufbuild/buf:1.71.0 lint && \
+		docker run --rm -v "$$PWD":/workspace --workdir /workspace bufbuild/buf:1.71.0 build
+
+lint-toml: ## taplo TOML format check (config: .taplo.toml)
+	npx --yes @taplo/cli@0.7.0 fmt --check
 
-# Cut a release from the private build/test server (gouda) — GHCR publish, gated on the test suite +
+# Cut a release from the private build/test server — GHCR publish, gated on the test suite +
 # the #54 integration matrix (issue #44). Pass options through ARGS, e.g. a safe plan-only preview:
 #   make release ARGS="--dry-run"
 # See docs/releasing.md.
diff --git a/README.md b/README.md
index 5177b27b..0f662d9f 100644
--- a/README.md
+++ b/README.md
@@ -4,17 +4,16 @@
 
 # Pithead
 
-### Private Monero + Tari merge mining, the whole stack, in one command.
+### Private Monero + Tari merge mining stack
 
 [![CI](https://github.com/p2pool-starter-stack/pithead/actions/workflows/ci.yml/badge.svg)](https://github.com/p2pool-starter-stack/pithead/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](./LICENSE)
 ![Platform: Ubuntu 24.04](https://img.shields.io/badge/Platform-Ubuntu%2024.04-E95420?logo=ubuntu&logoColor=white)
 ![Tor](https://img.shields.io/badge/Networking-Tor--first-7D4698?logo=torproject&logoColor=white)
 
-A professional-grade, containerized stack for running a private [Monero](https://www.getmonero.org/)
-full node, [P2Pool](https://github.com/SChernykh/p2pool), and [Tari](https://www.tari.com/) merge
-mining — engineered for **privacy**, **performance**, and **a setup you can finish before your
-coffee gets cold**.
+Pithead is a containerized stack for running a private [Monero](https://www.getmonero.org/) full
+node, [P2Pool](https://github.com/SChernykh/p2pool), and [Tari](https://www.tari.com/) merge mining.
+An interactive setup script takes you from clone to mining in a few minutes.
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="./images/launch/hero.png">
@@ -25,28 +24,27 @@ coffee gets cold**.
 
 ---
 
-## ✨ Why this stack?
-
-- ⛏️ **Zero-fee, decentralized payouts.** Mine Monero on [P2Pool](https://p2pool.io/) — no pool
-  operator, no fees, rewards paid straight to your own wallet — and every hash **merge-mines Tari
-  for free**: a second payout for zero extra power or config.
-- 🧠 **Set-and-forget yield optimizer.** An algorithmic engine watches the XMRvsBeast raffle and
-  automatically shifts hashrate to grab bonus rounds — donating only the **minimum** needed to hold
-  your tier, then handing every spare cycle back to your own P2Pool payouts. No manual tuning, no
-  over-donating.
-- 🧅 **Tor-first, no port forwarding.** A built-in Tor daemon gives Monero, Tari, and P2Pool
-  hidden-service (onion) addresses, so **your router stays closed and your home IP is never
-  advertised to an inbound peer**. (Two outbound yield paths still touch clearnet in v1.0 — the
-  [privacy guide](docs/privacy.md) maps every connection and how to harden it today.)
-- 🔌 **One endpoint for every rig.** Point all your workers at a single address — no wallet in the
-  miner, no per-rig pool config, ever. The stack routes the hashrate for you.
-- 📊 **A dashboard worth leaving open.** Watch live hashrate, your P2Pool/XvB split shading in real
-  time, the PPLNS window, and every worker update — served over HTTPS on your LAN.
-- 🚀 **One-command setup.** An interactive script handles dependencies, config, Tor, and — on Linux —
-  RandomX kernel tuning (it asks before touching GRUB), then offers to start everything for you.
-- 🔒 **Hardened out of the box.** Least-privilege containers, SHA256-verified binaries, pinned
-  versions, localhost-only RPC, and least-privilege Docker socket proxies (a read-only one for
-  stats, plus a separate start/stop-only one for node-down worker failover).
+## What it does
+
+- ⛏️ **Zero-fee, decentralized payouts.** Mines Monero on [P2Pool](https://p2pool.io/): no pool
+  operator, no fees, rewards paid straight to your own wallet. Every hash also merge-mines Tari at
+  no extra power or config cost.
+- 🧠 **XvB yield optimizer.** An algorithmic engine watches the XMRvsBeast raffle and shifts
+  hashrate to catch bonus rounds. It donates only the minimum needed to hold your tier and returns
+  every spare cycle to your own P2Pool payouts.
+- 🧅 **Tor-first networking.** A built-in Tor daemon gives Monero, Tari, and P2Pool onion addresses,
+  so your router stays closed and your home IP is never advertised to an inbound peer. Two outbound
+  yield paths still touch clearnet in v1.0; the [privacy guide](docs/privacy.md) maps every
+  connection and how to harden it.
+- 🔌 **One endpoint for every rig.** Point all your workers at a single address. Wallets and per-rig
+  pool config stay out of the miner; the stack routes the hashrate.
+- 📊 **Live dashboard.** Shows hashrate, your P2Pool/XvB split, the PPLNS window, and every worker
+  update, served over HTTPS on your LAN.
+- 🚀 **Interactive setup.** A script handles dependencies, config, Tor, and (on Linux) RandomX
+  kernel tuning. It asks before touching GRUB, then offers to start the stack.
+- 🔒 **Hardened defaults.** Least-privilege containers, SHA256-verified binaries, pinned versions,
+  localhost-only RPC, and least-privilege Docker socket proxies (a read-only one for stats, plus a
+  separate start/stop-only one for node-down worker failover).
 
 ---
 
@@ -56,25 +54,25 @@ coffee gets cold**.
 # Grab the latest release — pulls the published, tested images (no local build)
 curl -fsSL https://github.com/p2pool-starter-stack/pithead/releases/latest/download/pithead.tar.gz | tar xz
 cd pithead
-cp config.json.template config.json   # then set your Monero + Tari payout addresses
+cp config.minimal.json config.json   # then set your Monero + Tari payout addresses
 ./pithead setup
 ```
 
-> Want every tunable? Copy `config.advanced.example.json` instead. Prefer to build from source (a
-> `dev` build) — e.g. to contribute? See [Install from source](docs/getting-started.md#alternative-build-from-source).
+> For every tunable, copy `config.reference.json` instead. To build from source (a `dev`
+> build), e.g. to contribute, see [Install from source](docs/getting-started.md#alternative-build-from-source).
 
-> **Prereqs:** Ubuntu Server **24.04 LTS**, **16 GB+ RAM**, an **SSD** (~300 GB pruned / ~500 GB
-> full minimum — the chains grow ~100+ GB/year, so 2–4 TB is the set-and-forget choice), and your
-> **Monero + Tari payout addresses** handy — full sizing in [Hardware Requirements](docs/hardware.md).
+> NOTE: Prereqs are Ubuntu Server 24.04 LTS, 16 GB+ RAM, an SSD (~300 GB pruned / ~500 GB full
+> minimum; the chains grow ~100+ GB/year, so 2–4 TB avoids a later resize), and your Monero + Tari
+> payout addresses. Full sizing in [Hardware Requirements](docs/hardware.md).
 
 `setup` checks dependencies (and offers to install them on Ubuntu), asks for your wallet
 addresses, provisions Tor, tunes the kernel for RandomX, and offers to start the stack. Then:
 
-1. **Open the dashboard** at `https://<your-hostname>` (the script prints the exact URL).
-2. **Let it sync.** On first boot the dashboard shows **Sync Mode** while your Monero and Tari
-   nodes catch up to the network — it switches to the live view automatically once synced. p2pool
-   and the proxy stay parked until then, so the sync logs stay clean.
-3. **Connect your miners** by pointing any [XMRig](https://github.com/xmrig/xmrig) rig at
+1. Open the dashboard at `https://<your-hostname>` (the script prints the exact URL).
+2. Let it sync. On first boot the dashboard shows Sync Mode while your Monero and Tari nodes catch
+   up to the network, then switches to the live view automatically once synced. p2pool and the
+   proxy stay parked until then, so the sync logs stay clean.
+3. Connect your miners by pointing any [XMRig](https://github.com/xmrig/xmrig) rig at
    `YOUR_STACK_IP:3333` (no wallet address needed). New to mining?
    [RigForge](https://github.com/p2pool-starter-stack/rigforge) provisions a tuned worker in one
    command.
@@ -83,10 +81,10 @@ addresses, provisions Tor, tunes the kernel for RandomX, and offers to start the
   <img src="./images/launch/demo.gif" alt="Pithead — live mining dashboard tour" width="85%">
 </div>
 
-📖 **Full walkthrough:** [docs/getting-started.md](docs/getting-started.md)
+Full walkthrough: [docs/getting-started.md](docs/getting-started.md)
 
-> **Already have a synced Monero node?** Skip the wait by pointing the stack at your existing
-> blockchain — see [Reusing an existing node](docs/configuration.md#reusing-an-existing-node).
+> NOTE: Already have a synced Monero node? Point the stack at your existing blockchain to skip the
+> wait. See [Reusing an existing node](docs/configuration.md#reusing-an-existing-node).
 
 ---
 
@@ -95,12 +93,12 @@ addresses, provisions Tor, tunes the kernel for RandomX, and offers to start the
 | Guide | What's inside |
 |---|---|
 | **[Getting Started](docs/getting-started.md)** | Prerequisites, install, first-run setup, and what to expect while the node syncs. |
-| **[Hardware Requirements](docs/hardware.md)** | Minimum vs. recommended specs for the **stack host** — CPU, RAM, disk, network — and how to run leaner. (Miner specs live in [RigForge](https://github.com/p2pool-starter-stack/rigforge).) |
+| **[Hardware Requirements](docs/hardware.md)** | Minimum vs. recommended specs for the stack host (CPU, RAM, disk, network), and how to run leaner. (Miner specs live in [RigForge](https://github.com/p2pool-starter-stack/rigforge).) |
 | **[Configuration](docs/configuration.md)** | Every `config.json` key, applying changes safely, reusing an existing node, and remote Monero nodes. |
 | **[The Dashboard](docs/dashboard.md)** | Sync Mode and a tour of the live operational view. |
 | **[Connecting Miners](docs/workers.md)** | Point any existing rig at the stack, or spin up a tuned miner with [RigForge](https://github.com/p2pool-starter-stack/rigforge). |
 | **[Architecture](docs/architecture.md)** | The nine services, the privacy model, and the algorithmic XvB switching engine. |
-| **[Privacy & Network Egress](docs/privacy.md)** | Every off-box connection — what's Tor-routed, what's clearnet today, and how to harden it. |
+| **[Privacy & Network Egress](docs/privacy.md)** | Every off-box connection: what's Tor-routed, what's clearnet today, and how to harden it. |
 | **[Operations & Maintenance](docs/operations.md)** | Full command reference, upgrades, backups, and troubleshooting. |
 
 Browse the full index at **[docs/](docs/README.md)**.
@@ -109,10 +107,10 @@ Browse the full index at **[docs/](docs/README.md)**.
 
 ## 🏗️ How it works
 
-The stack orchestrates nine services via Docker Compose: a Monero **full node**, **P2Pool**, a
-**Tari** base node, an **XMRig proxy** (your single worker endpoint), **Tor** for anonymity, the
-**dashboard** + switching engine, a read-only **Docker socket proxy** (plus a tiny start/stop-only
-control proxy), and **Caddy** for HTTPS.
+The stack orchestrates nine services via Docker Compose: a Monero full node, P2Pool, a Tari base
+node, an XMRig proxy (your single worker endpoint), Tor for anonymity, the dashboard plus switching
+engine, a read-only Docker socket proxy (plus a tiny start/stop-only control proxy), and Caddy for
+HTTPS.
 
 ```mermaid
 flowchart TB
@@ -172,8 +170,8 @@ flowchart TB
     style core stroke:#10b981,stroke-width:1px,stroke-dasharray:5 4;
 ```
 
-Read the full breakdown — including the privacy model and the algorithmic switching engine — in
-**[Architecture](docs/architecture.md)**.
+Read the full breakdown, including the privacy model and the algorithmic switching engine, in
+[Architecture](docs/architecture.md).
 
 ---
 
@@ -199,8 +197,7 @@ Full reference: **[Operations & Maintenance](docs/operations.md)**.
 
 ## 🤝 Donate
 
-If this stack saved you time and you'd like to support it, donations to this XMR wallet are
-appreciated:
+If this stack saved you time, donations to this XMR wallet are appreciated:
 
 ```
 486aGn4qhH1MkaASjnEWMDN7stD1SVtPF5fvihmjffeBE5ACL1u1jU95KxiqmoiaPZMexi4R4W11MLXut66XWVVF8wjAE5R
@@ -208,4 +205,7 @@ appreciated:
 
 ## 📄 License
 
-Provided "as-is" under the [MIT License](./LICENSE).
+Pithead's own code is provided "as-is" under the [MIT License](./LICENSE). Bundled
+third-party components keep their own licenses (two, `p2pool` and `xmrig-proxy`, are GPLv3,
+shipped unmodified as separate containers). See
+[`THIRD_PARTY_LICENSES.md`](./THIRD_PARTY_LICENSES.md).
diff --git a/SECURITY.md b/SECURITY.md
index 31e08ff4..dbaf8db5 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,13 +1,16 @@
 # Security Policy
 
+This is the security policy for Pithead: supported versions, how to report a vulnerability,
+and the stack's default security posture.
+
 Pithead runs a Monero full node, P2Pool, Tari merge mining, and a dashboard on your
-hardware, and it handles wallet payout addresses. We take security seriously and
-appreciate reports that help keep operators safe.
+hardware, and it handles wallet payout addresses. We appreciate reports that help keep
+operators safe.
 
 ## Supported versions
 
-Security fixes land on the latest `main`. There are no long-lived release branches —
-please make sure you're running an up-to-date checkout before reporting an issue.
+Security fixes land on the latest `main`. There are no long-lived release branches.
+Make sure you're running an up-to-date checkout before reporting an issue.
 
 | Version       | Supported          |
 |---------------|--------------------|
@@ -33,10 +36,10 @@ We aim to acknowledge reports promptly and will keep you posted as we work on a
 
 ## Security posture
 
-The stack is hardened by default: least-privilege containers (leaf services run with
-`no-new-privileges` and — except the dashboard, which writes its history DB as root into a
-user-owned volume — drop all Linux capabilities; the internet-facing and Docker-socket-facing
-ones also use a read-only root filesystem), SHA256-verified and version-pinned binaries,
+The stack is hardened by default: least-privilege containers (every service runs as a **non-root
+user**, not uid 0; leaf services run with `no-new-privileges` and drop all Linux capabilities; the
+internet-facing and Docker-socket-facing ones also use a read-only root filesystem),
+SHA256-verified and version-pinned binaries,
 localhost-only RPC, a LAN-scoped (and narrowable) stratum port, scoped Docker socket proxies,
-and Tor for all node networking. If you find a gap in any of these, that's exactly the kind of
+and Tor for all node networking. If you find a gap in any of these, that's the kind of
 report we want.
diff --git a/THIRD_PARTY_LICENSES.md b/THIRD_PARTY_LICENSES.md
new file mode 100644
index 00000000..eb98be92
--- /dev/null
+++ b/THIRD_PARTY_LICENSES.md
@@ -0,0 +1,32 @@
+# Third-Party Licenses
+
+Pithead's own code is [MIT](./LICENSE). The images it builds and the files it
+vendors also **redistribute** third-party components, which keep their own licenses:
+
+## Bundled binaries (in the published `pithead-*` images)
+
+Version-pinned, sha256-verified, **unmodified** upstream binaries (pin + hash in each
+`build/<name>/Dockerfile`):
+
+| Binary | Version | License | Source |
+|--------|---------|---------|--------|
+| monerod | v0.18.5.0 | BSD-3-Clause | <https://github.com/monero-project/monero> |
+| p2pool | v4.16 | **GPL-3.0-or-later** | <https://github.com/SChernykh/p2pool/releases/tag/v4.16> |
+| xmrig-proxy | 6.26.0 | **GPL-3.0-or-later** | <https://github.com/xmrig/xmrig-proxy/releases/tag/v6.26.0> |
+| tor | distro | BSD-3-Clause | <https://gitlab.torproject.org/tpo/core/tor> |
+
+`p2pool` and `xmrig-proxy` are GPL-3.0, shipped **unmodified** as **separate
+containers** (mere aggregation — no linking into Pithead's code). The GPLv3 text is at
+<https://www.gnu.org/licenses/gpl-3.0.txt>; the **corresponding source** is the exact
+upstream release linked above (matching the pinned version + sha256 in the Dockerfile).
+
+## Vendored / generated (in `pithead-dashboard`)
+
+- Frontend JS under `build/dashboard/mining_dashboard/web/static/`: **preact** 10.24.3 (MIT),
+  **htm** 3.1.1 (Apache-2.0), **chart.js** 4.4.6 (MIT), **chartjs-plugin-zoom** 2.2.0 (MIT),
+  **hammerjs** 2.0.8 (MIT) — see that dir's `vendor/README.md`.
+- Tari gRPC `.proto` files + generated stubs under
+  `build/dashboard/mining_dashboard/client/tari/`: **BSD-3-Clause**, © The Tari Project.
+
+Base images (`ubuntu`/`alpine`/`python-slim`) and the dashboard's Python dependencies
+(`build/dashboard/pyproject.toml`) carry their own, permissive licenses.
diff --git a/VERSION b/VERSION
index 21e8796a..9084fa2f 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.0.3
+1.1.0
diff --git a/biome.json b/biome.json
new file mode 100644
index 00000000..352bee01
--- /dev/null
+++ b/biome.json
@@ -0,0 +1,28 @@
+{
+  "$schema": "https://biomejs.dev/schemas/2.5.0/schema.json",
+  "vcs": { "enabled": true, "clientKind": "git", "useIgnoreFile": true },
+  "files": {
+    "includes": [
+      "build/dashboard/mining_dashboard/web/static/**/*.{js,mjs,css}",
+      "!build/dashboard/mining_dashboard/web/static/vendor",
+      "!build/dashboard/mining_dashboard/web/static/chart.umd.min.js"
+    ]
+  },
+  "formatter": {
+    "enabled": true,
+    "indentStyle": "space",
+    "indentWidth": 2,
+    "lineWidth": 100
+  },
+  "linter": {
+    "enabled": true,
+    "rules": {
+      "recommended": true,
+      "style": { "useTemplate": "off" },
+      "complexity": { "useOptionalChain": "off", "noImportantStyles": "off" }
+    }
+  },
+  "javascript": {
+    "formatter": { "quoteStyle": "double", "semicolons": "always" }
+  }
+}
diff --git a/build/dashboard/.python-version b/build/dashboard/.python-version
new file mode 100644
index 00000000..2c073331
--- /dev/null
+++ b/build/dashboard/.python-version
@@ -0,0 +1 @@
+3.11
diff --git a/build/dashboard/Dockerfile b/build/dashboard/Dockerfile
index b58a5971..2e3739f0 100644
--- a/build/dashboard/Dockerfile
+++ b/build/dashboard/Dockerfile
@@ -1,8 +1,19 @@
 # ==========================================================================
-# Shared base: system deps + package metadata + source.
+# Shared base: system deps + package metadata + source. Deliberately has NO uv —
+# the production image must not ship the build tool (a runtime image with uv pulls
+# uv's own CVEs into image scans, #282). uv lives only in the build/test stages.
 # ==========================================================================
 # Pinned by digest (#135) so the python:3.11-slim tag can't be silently re-pointed.
-FROM python:3.11-slim@sha256:a3ab0b966bc4e91546a033e22093cb840908979487a9fc0e6e38295747e49ac0 AS base
+FROM python:3.11-slim@sha256:b27df5841f3355e9473f9a516d38a6783b6c8dfeacaf2d14a240f443b368ddb6 AS base
+
+# Run from a project venv on PATH (so entrypoint.sh's `python3` resolves to it); use the
+# digest-pinned base interpreter (never let uv download a different Python); compile bytecode and
+# copy (not hardlink) from the BuildKit cache mount used on the sync steps below.
+ENV UV_PYTHON_DOWNLOADS=never \
+    UV_PROJECT_ENVIRONMENT=/app/.venv \
+    UV_COMPILE_BYTECODE=1 \
+    UV_LINK_MODE=copy \
+    PATH="/app/.venv/bin:$PATH"
 
 # System dependencies.
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -12,25 +23,33 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 
 WORKDIR /app
 
-# Package metadata first (better layer caching), then the source.
-COPY pyproject.toml ./
+# Lock + metadata first (better layer caching), then the source.
+COPY pyproject.toml uv.lock ./
 COPY mining_dashboard/ ./mining_dashboard/
 
 # ==========================================================================
-# Test stage: install with test extras and run the suite with coverage.
+# Build stage: uv resolves the locked runtime deps into /app/.venv. uv is COPYed in
+# here (and in test) but never into production.
+# ==========================================================================
+FROM base AS build
+COPY --from=ghcr.io/astral-sh/uv:0.10.10@sha256:cbe0a44ba994e327b8fe7ed72beef1aaa7d2c4c795fd406d1dbf328bacb2f1c5 /uv /bin/
+RUN --mount=type=cache,target=/root/.cache/uv uv sync --locked
+
+# ==========================================================================
+# Test stage: add the test extras to the venv and run the suite with coverage.
 # Build explicitly with `docker build --target test .` (CI does this);
 # a normal `docker compose build` targets the production stage and skips it.
 # ==========================================================================
-FROM base AS test
-RUN pip install --no-cache-dir -e ".[test]"
+FROM build AS test
+RUN --mount=type=cache,target=/root/.cache/uv uv sync --locked --extra test
 COPY tests/ ./tests/
 RUN python -m pytest --cov=mining_dashboard --cov-report=term-missing --cov-fail-under=80
 
 # ==========================================================================
-# Production stage: install the package (runtime deps only) and run it.
+# Production stage: copy ONLY the resolved venv from `build` (no uv binary) and run it.
 # ==========================================================================
 FROM base AS production
-RUN pip install --no-cache-dir -e .
+COPY --from=build /app/.venv /app/.venv
 COPY entrypoint.sh .
 RUN chmod +x entrypoint.sh
 
@@ -51,4 +70,16 @@ LABEL org.opencontainers.image.title="Pithead Dashboard" \
       org.opencontainers.image.version=$PITHEAD_VERSION \
       org.opencontainers.image.revision=$PITHEAD_GIT_COMMIT
 
+# Run non-root (#255). debian-slim has no stock uid-1000 user, so create 'pithead' (uid:gid
+# 1000:1000) to match the uid pithead chowns ${DASHBOARD_DATA_DIR} (/data) to. /app + the venv stay
+# root-owned and are only read/executed at runtime; the SQLite history is written to /data and the
+# clearnet-state marker to /clearnet-state. Create both in-image owned by pithead: with a host
+# bind-mount (the real stack) the mount masks them and pithead's chown governs ownership; with a
+# NAMED volume (the integration mini-stack) Docker seeds the empty volume from the image dir's
+# ownership, so this is what makes /data writable there. This lets compose finally cap_drop:[ALL]
+# the dashboard — it no longer needs root's CAP_DAC_OVERRIDE to write the host-user-owned data dir.
+RUN groupadd -g 1000 pithead && useradd -u 1000 -g 1000 -m -s /usr/sbin/nologin pithead \
+    && install -d -o pithead -g pithead /data /clearnet-state
+USER pithead
+
 ENTRYPOINT ["/bin/bash", "/app/entrypoint.sh"]
diff --git a/build/dashboard/README.md b/build/dashboard/README.md
index f74d5d32..665ac13a 100644
--- a/build/dashboard/README.md
+++ b/build/dashboard/README.md
@@ -1,35 +1,36 @@
 # Mining Dashboard
 
-The monitoring web UI and XvB switching engine for Pithead. It aggregates
-stats from the local collectors, the XMRig proxy, and the Tari node, and serves a single-page
-dashboard (behind Caddy) on `127.0.0.1:8000`.
+The monitoring web UI and XvB switching engine for Pithead. It aggregates stats from the local
+collectors, the XMRig proxy, and the Tari node, and serves a single-page dashboard (behind Caddy)
+on `127.0.0.1:8000`.
 
 ## Architecture
 
-The server is a **data API**; the browser renders the UI. There is no server-side templating:
-
-- **`GET /`** serves a tiny static HTML shell.
-- **`GET /api/state?range=…`** returns the whole dashboard as JSON — the contract built by
-  `views.build_state`. Computed domain values (effective hashrate, P2Pool/XvB averages, XvB
-  tier qualification, shares-in-window, sync/down state) live in one typed place,
-  `service/metrics.py` → `build_metrics() -> Metrics`; the view layer **formats** those into
-  display strings + semantic tokens (`variant: "ok"`, `level: "high"`) and emits no HTML. The
-  same `Metrics` is meant to back future consumers (Telegram #45, calculator #12) without
-  re-deriving from the raw dict.
-- The client (`static/dashboard.js` + `components.mjs`) is a small **Preact** app (rendered with
-  `htm` tagged templates — no JSX, no build step). It polls `/api/state` every 30s and renders
+The server is a data API; the browser renders the UI. There is no server-side templating.
+
+- `GET /` serves a tiny static HTML shell.
+- `GET /api/state?range=…` returns the whole dashboard as JSON, the contract built by
+  `views.build_state`. Computed domain values (effective hashrate, P2Pool/XvB averages, XvB tier
+  qualification, shares-in-window, sync/down state) live in one typed place,
+  `service/metrics.py` → `build_metrics() -> Metrics`. The view layer formats those into display
+  strings and semantic tokens (`variant: "ok"`, `level: "high"`) and emits no HTML. The same
+  `Metrics` is meant to back future consumers (Telegram #45, calculator #12) without re-deriving
+  from the raw dict.
+- The client (`static/dashboard.js` + `components.mjs`) is a small Preact app, rendered with `htm`
+  tagged templates (no JSX, no build step). It polls `/api/state` every 30s and renders
   declaratively, so the chart instance, table sort, selected range, and the simple/advanced view
   all survive each refresh. UI state lives on the client; data lives on the server.
 
-Everything is served from `/static` — the vendored Preact, htm and Chart.js (`static/vendor/`),
-plus the app modules and `dashboard.css`. Nothing is inlined and the libraries are eval-free, so
-the page runs under a strict Content-Security-Policy with no `'unsafe-inline'`/`'unsafe-eval'`.
+Everything is served from `/static`: the vendored Preact, htm and Chart.js (`static/vendor/`), plus
+the app modules and `dashboard.css`. Nothing is inlined and the libraries are eval-free, so the
+page runs under a strict Content-Security-Policy with no `'unsafe-inline'`/`'unsafe-eval'`.
 
-Testing: the Python API — where all the logic and formatting live — is fully unit-tested. The
-pure client logic (worker sort, tooltip formatting, hero-KPI selection in `static/logic.mjs`) is unit-tested with
-**Node's built-in runner** (`node --test build/dashboard/tests/frontend/*.test.mjs`) — no
-`package.json`/`node_modules`/build step, so the repo stays Node-free. Component *rendering* has
-no unit tests by design; it's covered by a manual browser smoke test.
+Testing: the Python API, where all the logic and formatting live, is fully unit-tested. The pure
+client logic (worker sort, tooltip formatting, hero-KPI selection in `static/logic.mjs`) is
+unit-tested with Node's built-in runner
+(`node --test build/dashboard/tests/frontend/*.test.mjs`) — no
+`package.json`/`node_modules`/build step, so the repo stays Node-free. Component rendering has no
+unit tests by design; it's covered by a manual browser smoke test.
 
 ## Layout
 
@@ -47,15 +48,14 @@ mining_dashboard/
 └── helper/            # formatting utilities
 ```
 
-It is a proper installable package (`pyproject.toml`): all internal imports are absolute
-(`mining_dashboard.*`), and it runs as a module — no `PYTHONPATH` gymnastics.
+It is an installable package (`pyproject.toml`): all internal imports are absolute
+(`mining_dashboard.*`), and it runs as a module, with no `PYTHONPATH` gymnastics.
 
 ## Development
 
 ```bash
-# from build/dashboard/
-python3 -m venv .venv && source .venv/bin/activate     # Python 3.11+
-pip install -e ".[test]"
+# from build/dashboard/ — uv creates .venv and installs from the hashed uv.lock (Python 3.11+)
+uv sync --extra test
 ```
 
 ## Tests
@@ -74,13 +74,24 @@ Or from the repo root: `make test-dashboard`. The same Python suite runs in the
 docker build --target test ./build/dashboard
 ```
 
-Tests are hermetic — no network, no containers, no real database (an in-memory SQLite is used
-via the `state_manager` fixture and the auto-applied DB-isolation fixture in `tests/conftest.py`).
+Tests are hermetic: no network, no containers, no real database (an in-memory SQLite is used via
+the `state_manager` fixture and the auto-applied DB-isolation fixture in `tests/conftest.py`).
+
+Two coverage ratchets back the suite: a total floor (`--cov-fail-under=80`) and a patch gate
+(`make test-patch-coverage` → `diff-cover` ≥ 90% on changed lines, #286). The money/numeric logic
+(earnings, the XvB controller, the donation simulator) also has property-based tests (`hypothesis`, #284)
+asserting invariants — non-negativity, conservation, monotonicity, clamp bounds — across a
+wide input range, the class of bug example tests miss (cf. the #70 overshoot).
+
+Typing roadmap (deferred): the app is lightly annotated today, so a static type-checker gate is
+premature (and `ty` is still pre-1.0). The on-ramp — turning on ruff's `ANN` ruleset as a
+non-blocking annotation ratchet, then adopting `ty`/`pyright` once coverage is meaningful and `ty`
+reaches 1.0 — is a post-1.0 follow-up (#284), not a v1.1 blocker.
 
 ## Image
 
 The `Dockerfile` is multi-stage:
 
-- `base` — system deps + package metadata + source.
-- `test` — `pip install -e .[test]` then `pytest --cov-fail-under=80` (build with `--target test`).
-- `production` — runtime install + entrypoint (the default `docker compose build` target).
+- `base`: uv (digest-pinned) + system deps + lock/metadata + source.
+- `test`: `uv sync --locked --extra test` then `pytest --cov-fail-under=80` (build with `--target test`).
+- `production`: `uv sync --locked` (runtime deps only) + entrypoint (the default `docker compose build` target).
diff --git a/build/dashboard/entrypoint.sh b/build/dashboard/entrypoint.sh
index 9c37403b..8fb1003d 100644
--- a/build/dashboard/entrypoint.sh
+++ b/build/dashboard/entrypoint.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 
-# We no longer dynamically fetch the LAN IP here because the dashboard 
+# We no longer dynamically fetch the LAN IP here because the dashboard
 # MUST be bound to localhost (127.0.0.1) to remain secure behind Caddy.
 # The HOST_IP variable is now injected directly via docker-compose.yml.
 
@@ -12,4 +12,4 @@ export HOST_IP="${HOST_IP:-127.0.0.1}"
 # 'exec' replaces the shell process so SIGTERM is handled correctly;
 # '-u' forces unbuffered stdout/stderr for real-time Docker logging.
 cd /app
-exec python3 -u -m mining_dashboard.main
\ No newline at end of file
+exec python3 -u -m mining_dashboard.main
diff --git a/build/dashboard/mining_dashboard/client/docker/docker_control.py b/build/dashboard/mining_dashboard/client/docker/docker_control.py
index 693ecce5..28e95139 100644
--- a/build/dashboard/mining_dashboard/client/docker/docker_control.py
+++ b/build/dashboard/mining_dashboard/client/docker/docker_control.py
@@ -1,6 +1,7 @@
-import aiohttp
 import logging
 
+import aiohttp
+
 from mining_dashboard.config.config import DOCKER_CONTROL_URL, DOCKER_TIMEOUT
 
 logger = logging.getLogger("DockerControl")
@@ -39,22 +40,33 @@ async def stop(self, container, stop_timeout=10, quiet=False, request_timeout=No
         daemon needs an HTTP timeout that OUTLASTS `stop_timeout` or the call gives up early and
         wrongly reports failure (#234: Tari took >5s to stop, so the default timeout aborted it).
         """
-        return await self._post(f"/containers/{container}/stop", params={"t": stop_timeout},
-                                action="stop", container=container, quiet=quiet,
-                                request_timeout=request_timeout)
+        return await self._post(
+            f"/containers/{container}/stop",
+            params={"t": stop_timeout},
+            action="stop",
+            container=container,
+            quiet=quiet,
+            request_timeout=request_timeout,
+        )
 
     async def start(self, container, quiet=False, request_timeout=None):
         """Start a container. Returns True on success (incl. already-running)."""
-        return await self._post(f"/containers/{container}/start", params=None,
-                                action="start", container=container, quiet=quiet,
-                                request_timeout=request_timeout)
+        return await self._post(
+            f"/containers/{container}/start",
+            params=None,
+            action="start",
+            container=container,
+            quiet=quiet,
+            request_timeout=request_timeout,
+        )
 
     async def _post(self, path, params, action, container, quiet=False, request_timeout=None):
         url = f"{self.base_url}{path}"
         try:
             async with aiohttp.ClientSession() as session:
-                async with session.post(url, params=params,
-                                        timeout=request_timeout or self.timeout) as resp:
+                async with session.post(
+                    url, params=params, timeout=request_timeout or self.timeout
+                ) as resp:
                     # 204 No Content = done; 304 Not Modified = already in that state
                     # (Docker's idempotent response) — both are success for us.
                     if resp.status in (204, 304):
@@ -62,7 +74,9 @@ async def _post(self, path, params, action, container, quiet=False, request_time
                         log(f"Container {container} {action}: ok (HTTP {resp.status})")
                         return True
                     body = await resp.text()
-                    logger.error(f"Container {container} {action} failed: HTTP {resp.status} {body[:200]}")
+                    logger.error(
+                        f"Container {container} {action} failed: HTTP {resp.status} {body[:200]}"
+                    )
                     return False
         except Exception as e:
             logger.error(f"Container {container} {action} error via {self.base_url}: {e}")
diff --git a/build/dashboard/mining_dashboard/client/monero/monero_client.py b/build/dashboard/mining_dashboard/client/monero/monero_client.py
index 3c05f79b..c4ead287 100644
--- a/build/dashboard/mining_dashboard/client/monero/monero_client.py
+++ b/build/dashboard/mining_dashboard/client/monero/monero_client.py
@@ -1,11 +1,12 @@
 import logging
+
 import requests
 from requests.auth import HTTPDigestAuth
 
 from mining_dashboard.config.config import (
-    MONERO_RPC_URL,
-    MONERO_NODE_USERNAME,
     MONERO_NODE_PASSWORD,
+    MONERO_NODE_USERNAME,
+    MONERO_RPC_URL,
 )
 
 logger = logging.getLogger("MoneroClient")
@@ -25,8 +26,13 @@ class MoneroClient:
     via `asyncio.to_thread`, mirroring how XvbClient / proxy_client are used.
     """
 
-    def __init__(self, url=MONERO_RPC_URL, username=MONERO_NODE_USERNAME,
-                 password=MONERO_NODE_PASSWORD, timeout=5):
+    def __init__(
+        self,
+        url=MONERO_RPC_URL,
+        username=MONERO_NODE_USERNAME,
+        password=MONERO_NODE_PASSWORD,
+        timeout=5,
+    ):
         self.url = url.rstrip("/") + "/get_info"
         # No creds (e.g. a remote node deployment) → send unauthenticated; the request
         # will simply fail and the caller falls back to log scraping.
@@ -88,5 +94,10 @@ def get_sync_status(self):
             return {"is_syncing": False, "db_size": db_size}
 
         percent = int((height / target) * 100)
-        return {"is_syncing": True, "current": height, "target": target,
-                "percent": percent, "db_size": db_size}
+        return {
+            "is_syncing": True,
+            "current": height,
+            "target": target,
+            "percent": percent,
+            "db_size": db_size,
+        }
diff --git a/build/dashboard/mining_dashboard/client/tari/Readme.md b/build/dashboard/mining_dashboard/client/tari/Readme.md
index c50a06ac..218beb8c 100644
--- a/build/dashboard/mining_dashboard/client/tari/Readme.md
+++ b/build/dashboard/mining_dashboard/client/tari/Readme.md
@@ -1,9 +1,12 @@
 # Tari gRPC Collector
 
+The Tari gRPC client and its generated protobuf stubs.
+
 ## Generate Protobuf Files
+
 Ensure `base_node.proto` and `types.proto` are in the `proto/` subdirectory, then run:
 
 ```bash
-docker run --rm -v "$PWD":/work -w /work python:3.11-slim \
-  /bin/bash -c "pip install grpcio-tools && python -m grpc_tools.protoc -Iproto --python_out=generated --grpc_python_out=generated proto/*.proto && sed -i 's/^import.*_pb2/from . \0/' generated/*_pb2*.py"
-```
\ No newline at end of file
+docker run --rm -v "$PWD":/work -w /work ghcr.io/astral-sh/uv:0.10.10-python3.11-trixie-slim \
+  /bin/bash -c "uvx --from grpcio-tools python -m grpc_tools.protoc -Iproto --python_out=generated --grpc_python_out=generated proto/*.proto && sed -i 's/^import.*_pb2/from . \0/' generated/*_pb2*.py"
+```
diff --git a/build/dashboard/mining_dashboard/client/tari/proto/buf.yaml b/build/dashboard/mining_dashboard/client/tari/proto/buf.yaml
new file mode 100644
index 00000000..71d29986
--- /dev/null
+++ b/build/dashboard/mining_dashboard/client/tari/proto/buf.yaml
@@ -0,0 +1,13 @@
+# buf config (Wave 7 tooling, #281). These are vendored upstream Tari protos, so we lint with the
+# MINIMAL ruleset (structural only — not the opinionated style rules we don't own) and except
+# PACKAGE_DIRECTORY_MATCH (the protos declare `package tari.rpc` but are vendored flat into proto/).
+# `buf build` still verifies they compile; `breaking: FILE` enables `buf breaking --against <ref>`.
+version: v2
+lint:
+  use:
+    - MINIMAL
+  except:
+    - PACKAGE_DIRECTORY_MATCH
+breaking:
+  use:
+    - FILE
diff --git a/build/dashboard/mining_dashboard/client/tari/tari_client.py b/build/dashboard/mining_dashboard/client/tari/tari_client.py
index 04316dc5..f34e5006 100644
--- a/build/dashboard/mining_dashboard/client/tari/tari_client.py
+++ b/build/dashboard/mining_dashboard/client/tari/tari_client.py
@@ -1,19 +1,19 @@
-import aiohttp
 import logging
-import grpc
-import os
 import time
 
+import grpc
+
 from mining_dashboard.config.config import TARI_GRPC_ADDRESS
 
 logger = logging.getLogger("TariClient")
 
 # Attempt to import generated protobuf modules
 # See README.md for generation instructions (requires grpcio-tools)
-from .generated import base_node_pb2
-from .generated import base_node_pb2_grpc
 from google.protobuf import empty_pb2
 
+from .generated import base_node_pb2_grpc
+
+
 class TariClient:
     # When the base node is briefly overloaded mid-sync (it logs "BaseNodeService failed
     # to send reply ... ChainMetadata" and its own `status` command times out), gRPC calls
@@ -22,8 +22,7 @@ class TariClient:
     # the proper "node is down" indicator is tracked separately in the TODO.
     _MAX_STALE_SECONDS = 300
 
-    def __init__(self, session: aiohttp.ClientSession):
-        self.session = session
+    def __init__(self):
         self.grpc_address = TARI_GRPC_ADDRESS
         self._channel = None
         self._stub = None
@@ -63,7 +62,10 @@ async def get_sync_status(self):
 
         # gRPC unreachable this cycle. Serve the last good state briefly (node is likely
         # just busy), but stop once it's clearly stale so a down node isn't masked forever.
-        if self._last_sync_status and (time.monotonic() - self._last_sync_ts) <= self._MAX_STALE_SECONDS:
+        if (
+            self._last_sync_status
+            and (time.monotonic() - self._last_sync_ts) <= self._MAX_STALE_SECONDS
+        ):
             return {**self._last_sync_status, "reachable": False}
         return {"is_syncing": False, "reachable": False}
 
@@ -88,8 +90,12 @@ async def _fetch_sync_status(self):
 
         # The node reports initial sync complete — trust it over any height heuristic.
         if tip.initial_sync_achieved:
-            return {"is_syncing": False, "current": local_height,
-                    "target": local_height, "percent": 100}
+            return {
+                "is_syncing": False,
+                "current": local_height,
+                "target": local_height,
+                "percent": 100,
+            }
 
         # Still syncing: ask the node what height it is syncing toward.
         target = 0
@@ -111,6 +117,10 @@ async def _fetch_sync_status(self):
         return {"is_syncing": True, "current": local_height, "target": target, "percent": percent}
 
     async def close(self):
+        # ponytail: intentionally NOT wired into DataService.run()'s shutdown. Doing so means a
+        # try/finally around the whole poll loop, which drags the (partly untested) loop body into
+        # the diff-cover patch gate — a lot of churn to close a channel the OS reclaims on process
+        # exit anyway. Kept as a tested lifecycle method for whenever a real graceful path needs it.
         if self._channel:
             await self._channel.close()
-            self._channel = None
\ No newline at end of file
+            self._channel = None
diff --git a/build/dashboard/mining_dashboard/client/xmrig_client.py b/build/dashboard/mining_dashboard/client/xmrig_client.py
index 0f8f9645..0613dadb 100644
--- a/build/dashboard/mining_dashboard/client/xmrig_client.py
+++ b/build/dashboard/mining_dashboard/client/xmrig_client.py
@@ -1,18 +1,23 @@
 import ipaddress
 import logging
+import time
 
 from mining_dashboard.config.config import (
-    XMRIG_API_PORT,
-    PROXY_API_PORT,
-    PROXY_AUTH_TOKEN,
     API_TIMEOUT,
     MINING_NET_CIDR,
+    XMRIG_API_AUTH,
+    XMRIG_API_PORT,
+    XMRIG_API_TOKEN,
 )
 
 # Longest worker-name we'll ever echo back as a Bearer token (#122). xmrig names/tokens are short;
 # this just bounds a pathological miner-supplied value before it goes into a header.
 _MAX_NAME_TOKEN = 128
 
+# Re-warn about a worker whose API keeps failing at most this often, so a misconfigured fleet logs
+# one line per worker per interval — not one per poll (the data loop runs every ~30s).
+_WARN_INTERVAL_S = 300
+
 try:
     _INTERNAL_NET = ipaddress.ip_network(MINING_NET_CIDR, strict=False)
 except ValueError:
@@ -42,8 +47,13 @@ def _safe_probe_host(ip):
         addr = ipaddress.ip_address(host)
     except ValueError:
         return None  # not a bare IP — never treat a worker name/hostname as a request host
-    if (addr.is_loopback or addr.is_link_local or addr.is_multicast
-            or addr.is_unspecified or addr.is_reserved):
+    if (
+        addr.is_loopback
+        or addr.is_link_local
+        or addr.is_multicast
+        or addr.is_unspecified
+        or addr.is_reserved
+    ):
         return None
     if addr.version == _INTERNAL_NET.version and addr in _INTERNAL_NET:
         return None
@@ -58,54 +68,92 @@ def __init__(self, session):
         """
         self.session = session
         self.logger = logging.getLogger("WorkerClient")
+        # host -> monotonic timestamp of the last failure we logged, so a persistently-broken
+        # worker doesn't spam a WARNING every poll. The client outlives the poll loop, so this
+        # state survives across iterations.
+        self._warned = {}
+
+    def _auth_header(self, name_token):
+        """Build the single Authorization header for the configured auth mode (or no header)."""
+        mode = XMRIG_API_AUTH
+        if mode == "name":
+            return {"Authorization": f"Bearer {name_token}"} if name_token else {}
+        if mode == "token":
+            return {"Authorization": f"Bearer {XMRIG_API_TOKEN}"} if XMRIG_API_TOKEN else {}
+        # "none" (default) and any unrecognized value -> open, unauthenticated API
+        return {}
+
+    def _fix_hint(self):
+        """A short, actionable remedy tailored to the configured auth mode."""
+        mode = XMRIG_API_AUTH
+        if mode == "name":
+            return (
+                "expected the miner's xmrig access-token to equal its stratum name; verify that, "
+                f"or that the API is on XMRIG_API_PORT ({XMRIG_API_PORT})"
+            )
+        if mode == "token":
+            return (
+                "expected XMRIG_API_TOKEN to match the miner's xmrig access-token; verify that, "
+                f"or that the API is on XMRIG_API_PORT ({XMRIG_API_PORT})"
+            )
+        return (
+            "expected an open (http.restricted, no access-token) miner API; if this miner sets an "
+            "access-token, set XMRIG_API_AUTH=name (or =token with XMRIG_API_TOKEN), or check "
+            f"XMRIG_API_PORT ({XMRIG_API_PORT})"
+        )
+
+    def _warn(self, host, name, url, detail):
+        now = time.monotonic()
+        if now - self._warned.get(host, float("-inf")) < _WARN_INTERVAL_S:
+            return
+        self._warned[host] = now
+        self.logger.warning(
+            "Worker %r (%s): xmrig API probe failed at %s — %s. %s.",
+            name,
+            host,
+            url,
+            detail,
+            self._fix_hint(),
+        )
 
     async def get_stats(self, ip, name):
         """
-        Fetch /1/summary from a worker. Works for both XMRig miners and upstream
-        XMRig Proxy instances, trying the most likely credential first:
-
-          1. No auth on XMRIG_API_PORT      — open xmrig-proxy (restricted=true, no token)
-          2. PROXY_AUTH_TOKEN on PROXY_API_PORT — secured proxy on a non-standard port
-          3. Name-derived token on XMRIG_API_PORT — direct XMRig miner (name = access token)
+        Fetch /1/summary from a worker's xmrig API — exactly ONE way, derived from config.
 
-        Callers use the returned 'kind' field ('proxy' vs 'miner') to handle any
-        unit differences (xmrig-proxy reports hashrate in kH/s; miner reports H/s).
+        The auth method is chosen by ``XMRIG_API_AUTH`` (``none`` default / ``name`` / ``token``);
+        the port by ``XMRIG_API_PORT``. There is no auto-detection fallback: if the configured probe
+        fails, we return ``{"api_ok": False}`` and log a single (rate-limited) WARNING with a fix
+        hint, rather than silently trying alternatives or swallowing the error. On success the parsed
+        summary is returned with ``api_ok`` set to ``True``.
 
         Only the worker's validated IP is ever used as the request host (SSRF guard, #122): a
-        miner-controlled worker *name* is never a host, it's only offered back to that same IP as
-        the "name = access token" Bearer for direct XMRig miners.
+        miner-controlled worker *name* is never a host — in ``name`` auth it is only offered back to
+        that same IP as the Bearer token.
         """
         host = _safe_probe_host(ip)
         if host is None:
-            # No safe target: ip is missing/internal/not a bare address. Never fall back to the
-            # miner-controlled name as a host — that is the SSRF this guard exists to prevent (#122).
+            # No safe target: ip is missing/internal/not a bare address. This isn't a misconfigured
+            # miner — it's a worker we deliberately won't probe — so stay quiet and leave api_ok
+            # unset (unknown) rather than flagging a failure. Never fall back to the
+            # miner-controlled name as a host: that is the SSRF this guard exists to prevent (#122).
             return {}
 
-        name_token = name.split('+')[0].strip()[:_MAX_NAME_TOKEN] if name else ""
-
-        attempts = [
-            # 1. Open proxy — no auth header at all
-            (f"http://{host}:{XMRIG_API_PORT}/1/summary", {}),
-        ]
-        # 2. Secured proxy on a custom port (only if distinct from XMRIG_API_PORT)
-        if PROXY_AUTH_TOKEN and PROXY_API_PORT != XMRIG_API_PORT:
-            attempts.append((
-                f"http://{host}:{PROXY_API_PORT}/1/summary",
-                {"Authorization": f"Bearer {PROXY_AUTH_TOKEN}"},
-            ))
-        # 3. Direct XMRig miner: the name doubles as the access token, sent only to its own IP.
-        if name_token:
-            attempts.append((
-                f"http://{host}:{XMRIG_API_PORT}/1/summary",
-                {"Authorization": f"Bearer {name_token}"},
-            ))
-
-        for url, headers in attempts:
-            try:
-                async with self.session.get(url, headers=headers, timeout=API_TIMEOUT) as response:
-                    if response.status == 200:
-                        return await response.json()
-            except Exception as e:
-                self.logger.debug(f"Worker API Error ({url}): {e}")
-
-        return {}
+        name_token = name.split("+")[0].strip()[:_MAX_NAME_TOKEN] if name else ""
+        url = f"http://{host}:{XMRIG_API_PORT}/1/summary"
+        headers = self._auth_header(name_token)
+
+        try:
+            async with self.session.get(url, headers=headers, timeout=API_TIMEOUT) as response:
+                if response.status == 200:
+                    payload = await response.json()
+                    if isinstance(payload, dict):
+                        self._warned.pop(host, None)  # recovered — allow the next failure to log
+                        payload["api_ok"] = True
+                        return payload
+                    self._warn(host, name, url, f"HTTP 200 but body was {type(payload).__name__}")
+                    return {"api_ok": False}
+                self._warn(host, name, url, f"HTTP {response.status}")
+                return {"api_ok": False}
+        except Exception as e:
+            self._warn(host, name, url, f"{type(e).__name__}: {e}")
+            return {"api_ok": False}
diff --git a/build/dashboard/mining_dashboard/client/xmrig_proxy_client.py b/build/dashboard/mining_dashboard/client/xmrig_proxy_client.py
index 7c4e4df0..2da5923e 100644
--- a/build/dashboard/mining_dashboard/client/xmrig_proxy_client.py
+++ b/build/dashboard/mining_dashboard/client/xmrig_proxy_client.py
@@ -1,32 +1,34 @@
-import requests
 import json
 import logging
+
+import requests
 from requests.adapters import HTTPAdapter
 from urllib3.util.retry import Retry
 
+
 class XMRigProxyClient:
     def __init__(self, host="127.0.0.1", port=8080, access_token=None):
         """
         Initialize the XMRig Proxy Client.
-        
+
         :param host: The hostname or IP address of the xmrig-proxy.
         :param port: The HTTP API port (configured via --http-port).
         :param access_token: The access token (configured via --http-access-token).
         """
         self.logger = logging.getLogger("ProxyClient")
         self.base_url = f"http://{host}:{port}"
-        
+
         # Configure Session with Retries
         self.session = requests.Session()
         retry_strategy = Retry(
             total=3,
-            backoff_factor=1, # Wait 1s, 2s, 4s between retries
+            backoff_factor=1,  # Wait 1s, 2s, 4s between retries
             status_forcelist=[429, 500, 502, 503, 504],
-            allowed_methods=["HEAD", "GET", "PUT", "OPTIONS"]
+            allowed_methods=["HEAD", "GET", "PUT", "OPTIONS"],
         )
         adapter = HTTPAdapter(max_retries=retry_strategy)
         self.session.mount("http://", adapter)
-        
+
         if access_token:
             self.session.headers.update({"Authorization": f"Bearer {access_token}"})
 
@@ -165,14 +167,15 @@ def update_config(self, config_data):
             return {}
         return response.json()
 
+
 if __name__ == "__main__":
     # Configuration
     # Ensure xmrig-proxy is running with API enabled:
     # ./xmrig-proxy --http-port=8080 --http-access-token=SECRET
-    
+
     HOST = "127.0.0.1"
-    PORT = 8080 
-    TOKEN = "SECRET" 
+    PORT = 8080
+    TOKEN = "SECRET"  # noqa: S105 — placeholder for this __main__ usage example, not a real secret
 
     client = XMRigProxyClient(HOST, PORT, TOKEN)
 
@@ -200,4 +203,4 @@ def update_config(self, config_data):
     except requests.exceptions.RequestException as e:
         print(f"HTTP Request failed: {e}")
     except Exception as e:
-        print(f"An error occurred: {e}")
\ No newline at end of file
+        print(f"An error occurred: {e}")
diff --git a/build/dashboard/mining_dashboard/client/xvb_client.py b/build/dashboard/mining_dashboard/client/xvb_client.py
index 5fafb354..4302d023 100644
--- a/build/dashboard/mining_dashboard/client/xvb_client.py
+++ b/build/dashboard/mining_dashboard/client/xvb_client.py
@@ -1,23 +1,39 @@
-import requests
 import logging
 import re
+
+import requests
+
+from mining_dashboard.config.config import XVB_SUBMIT_URL, XVB_TOR_PROXY
 from mining_dashboard.helper.utils import parse_hashrate
-from mining_dashboard.config.config import XVB_TOR_PROXY
+
+# register() outcomes (#263). The endpoint returns plaintext "ERROR: ..." with a 422 for the error
+# cases (not a 200/JSON contract), so success/failure is classified from status + body, not status
+# alone. The caller maps these to dashboard state + retry behaviour.
+REG_OK = "registered"  # 2xx (fresh) OR "already registered" (idempotent) — wallet is in the raffle
+REG_INVALID = "invalid_wallet"  # endpoint rejected the address — permanent, stop retrying
+REG_NOT_ELIGIBLE = "not_eligible"  # no PPLNS share server-side yet — retry quietly, don't alarm
+REG_ERROR = "error"  # 5xx / network / unknown shape — transient, retry
+REG_DISABLED = "disabled"  # no endpoint configured (XVB_SUBMIT_URL disabled) — caller skips
+
 
 class XvbClient:
-    def __init__(self, wallet_address, tor_proxy=None):
+    def __init__(self, wallet_address, tor_proxy=None, submit_url=None):
         """
         Initialize the XvB Client.
 
         :param wallet_address: The Monero wallet address to query stats for.
         :param tor_proxy: SOCKS proxy URL to route the stats fetch through (defaults to the bridge
             Tor SOCKS, so the request can't correlate the operator's IP with the wallet, #163).
+        :param submit_url: Raffle-registration endpoint (#263). Deliberately UNPUBLISHED by the XvB
+            operator, so it is never hard-coded here — it's injected via XVB_SUBMIT_URL at deploy
+            time. Empty => register() is a no-op (we still mine to XvB and read stats).
         """
         self.logger = logging.getLogger("XvbClient")
         self.wallet_address = wallet_address
         self.url = "https://xmrvsbeast.com/cgi-bin/p2pool_bonus_history.cgi"
         self.tor_proxy = tor_proxy if tor_proxy is not None else XVB_TOR_PROXY
-        
+        self.submit_url = submit_url if submit_url is not None else XVB_SUBMIT_URL
+
         # Pre-compile regex patterns
         self.REGEX_FAIL_COUNT = re.compile(r"Fail Count:\s*(\d+)", re.IGNORECASE)
         self.REGEX_HR_1H = re.compile(r"1hr avg:\s*([\d\.]+)\s*([kKmMgG]?H/s)?", re.IGNORECASE)
@@ -26,9 +42,9 @@ def __init__(self, wallet_address, tor_proxy=None):
     def get_stats(self):
         """
         Retrieves bonus history statistics from the XMRvsBeast service.
-        
+
         Returns:
-            dict or None: A dictionary containing 'fail_count', 'avg_1h', and 'avg_24h' 
+            dict or None: A dictionary containing 'fail_count', 'avg_1h', and 'avg_24h'
                           if successful, otherwise None.
         """
         if not self.wallet_address or self.wallet_address == "placeholder":
@@ -45,7 +61,9 @@ def get_stats(self):
             if response.status_code == 200:
                 return self._parse_html(response.text)
             else:
-                self.logger.error(f"XvB API request failed with status code: {response.status_code}")
+                self.logger.error(
+                    f"XvB API request failed with status code: {response.status_code}"
+                )
                 return None
         except requests.RequestException as e:
             self.logger.error(f"Network error while fetching XvB stats: {e}")
@@ -54,16 +72,87 @@ def get_stats(self):
             self.logger.error(f"Unexpected error in XvB client: {e}")
             return None
 
+    def register(self):
+        """
+        Enter the wallet into the XMRvsBeast raffle (#263).
+
+        Mining to the XvB pool isn't enough to be entered — the wallet must be registered against
+        the operator's submit endpoint. That endpoint registers the wallet ONLY if it already has a
+        share in the P2Pool PPLNS window, so callers should gate this on PPLNS-share eligibility;
+        before a share lands server-side the call is a harmless no-op and we just retry next poll.
+
+        ALWAYS routes over the SAME Tor SOCKS5 proxy as get_stats (XVB_TOR_PROXY) — the call carries
+        the FULL wallet address, so a clearnet request would correlate the operator's IP with the
+        wallet (#163). Like the stats fetch, this is NOT subject to the xvb.tor donation opt-out.
+
+        The endpoint does NOT use a 200/JSON contract — it returns a plaintext ``ERROR: ...`` body
+        with HTTP 422 for the error cases — so the outcome is classified from status AND body
+        (verified live, see config). Returns one of the module ``REG_*`` strings:
+            REG_OK         — 2xx, or "already registered" (idempotent; the wallet is in the raffle)
+            REG_INVALID    — endpoint rejected the address (permanent; caller stops retrying)
+            REG_NOT_ELIGIBLE — no PPLNS share server-side yet (retry quietly)
+            REG_ERROR      — 5xx / network / unrecognised shape (transient; retry)
+            REG_DISABLED   — no endpoint configured (XVB_SUBMIT_URL disabled)
+        """
+        if not self.submit_url:
+            # Endpoint disabled (XVB_SUBMIT_URL set to a disable sentinel): we never reach out.
+            self.logger.debug("XvB registration skipped: endpoint disabled.")
+            return REG_DISABLED
+
+        if not self.wallet_address or self.wallet_address == "placeholder":
+            self.logger.warning(
+                "XvB registration skipped: MONERO_WALLET_ADDRESS is missing or invalid."
+            )
+            return REG_INVALID
+
+        params = {"address": self.wallet_address}
+
+        # Same Tor routing as the stats fetch: socks5h so xmrvsbeast sees a Tor exit (not the
+        # operator's home IP) and the host is resolved over Tor too. The request carries the full
+        # wallet, so a clearnet call would correlate IP <-> wallet (#163).
+        proxies = {"http": self.tor_proxy, "https": self.tor_proxy} if self.tor_proxy else None
+        try:
+            response = requests.get(self.submit_url, params=params, timeout=20, proxies=proxies)
+            body = (response.text or "").strip()
+            low = body.lower()
+
+            # Fresh registration: the endpoint answers 2xx.
+            if 200 <= response.status_code < 300:
+                return REG_OK
+            # Idempotent: re-registering an entered wallet returns 422 "Already Registered". That's
+            # the steady state once we're in — treat it as success so the daily re-register is a
+            # no-op rather than a "failure".
+            if "already registered" in low:
+                return REG_OK
+            # Permanent: a wallet the endpoint won't accept (e.g. wrong address type). Don't hammer.
+            if "invalid wallet" in low:
+                self.logger.warning("XvB registration: endpoint rejected the wallet as invalid.")
+                return REG_INVALID
+            # Best-effort: the share hasn't propagated to XvB yet. We can't pin the exact wording
+            # (we only have the already-registered/invalid samples), so match the obvious tokens and
+            # otherwise fall through to a retryable error.
+            if "pplns" in low or "share" in low or "window" in low:
+                return REG_NOT_ELIGIBLE
+            # Anything else (5xx, an unrecognised body) — log it so a contract change surfaces.
+            self.logger.warning(
+                "XvB registration: unexpected response (HTTP %s): %s",
+                response.status_code,
+                body[:200],
+            )
+            return REG_ERROR
+        except requests.RequestException as e:
+            self.logger.error(f"Network error while registering with XvB: {e}")
+            return REG_ERROR
+        except Exception as e:
+            self.logger.error(f"Unexpected error during XvB registration: {e}")
+            return REG_ERROR
+
     def _parse_html(self, html_text):
         """
         Parses raw HTML content to extract mining statistics.
         """
         try:
-            stats = {
-                "fail_count": 0,
-                "avg_1h": 0.0,
-                "avg_24h": 0.0
-            }
+            stats = {"fail_count": 0, "avg_1h": 0.0, "avg_24h": 0.0}
 
             # Extract Fail Count
             fail_match = self.REGEX_FAIL_COUNT.search(html_text)
@@ -76,16 +165,18 @@ def _parse_html(self, html_text):
 
             if hr1_match:
                 stats["avg_1h"] = parse_hashrate(hr1_match.group(1), hr1_match.group(2))
-            
+
             if hr24_match:
                 stats["avg_24h"] = parse_hashrate(hr24_match.group(1), hr24_match.group(2))
 
             if not fail_match and not hr1_match:
-                self.logger.warning("Parsing Warning: Critical stats not found in XvB response. HTML structure may have changed.")
+                self.logger.warning(
+                    "Parsing Warning: Critical stats not found in XvB response. HTML structure may have changed."
+                )
                 return None
 
             return stats
 
         except Exception as e:
             self.logger.error(f"Parsing Error: Failed to process XvB HTML: {e}")
-            return None
\ No newline at end of file
+            return None
diff --git a/build/dashboard/mining_dashboard/collector/logs.py b/build/dashboard/mining_dashboard/collector/logs.py
index 1720538f..141dbb0f 100644
--- a/build/dashboard/mining_dashboard/collector/logs.py
+++ b/build/dashboard/mining_dashboard/collector/logs.py
@@ -1,19 +1,28 @@
-import aiohttp
 import asyncio
+import json
 import logging
 import re
 import struct
-import json
+
 import aiofiles
+import aiohttp
 
-from mining_dashboard.config.config import DOCKER_PROXY_URL, LOG_TAIL_LINES, DOCKER_TIMEOUT, NETWORK_STATS_PATH, MONERO_NODE_HOST, LOCAL_MONERO_HOST
 from mining_dashboard.client.monero.monero_client import MoneroClient
+from mining_dashboard.config.config import (
+    DOCKER_PROXY_URL,
+    DOCKER_TIMEOUT,
+    LOCAL_MONERO_HOST,
+    LOG_TAIL_LINES,
+    MONERO_NODE_HOST,
+    NETWORK_STATS_PATH,
+)
 
 logger = logging.getLogger("LogCollector")
 
 # Stateless client reused across cycles; reads monerod's get_info RPC (Issue #29).
 _monero_client = MoneroClient()
 
+
 async def fetch_docker_logs(container_name, tail=None):
     """
     Fetches logs from a container via the Docker Socket Proxy.
@@ -26,14 +35,10 @@ async def fetch_docker_logs(container_name, tail=None):
     base_url = DOCKER_PROXY_URL
     if base_url.startswith("tcp://"):
         base_url = base_url.replace("tcp://", "http://")
-    
+
     # Docker Engine API: /containers/{id}/logs
     url = f"{base_url}/containers/{container_name}/logs"
-    params = {
-        "stdout": 1,
-        "stderr": 1,
-        "tail": tail
-    }
+    params = {"stdout": 1, "stderr": 1, "tail": tail}
 
     try:
         async with aiohttp.ClientSession() as session:
@@ -42,11 +47,14 @@ async def fetch_docker_logs(container_name, tail=None):
                     raw_data = await response.read()
                     return _parse_docker_stream(raw_data)
                 else:
-                    logger.error(f"Failed to fetch logs for {container_name}. Status: {response.status}")
+                    logger.error(
+                        f"Failed to fetch logs for {container_name}. Status: {response.status}"
+                    )
                     return [f"Error: Could not retrieve logs (Status {response.status})"]
     except Exception as e:
         logger.error(f"Error connecting to Docker Proxy at {base_url}: {e}")
-        return [f"Error: Connection to Docker Proxy failed."]
+        return ["Error: Connection to Docker Proxy failed."]
+
 
 def _parse_docker_stream(data):
     """
@@ -56,54 +64,56 @@ def _parse_docker_stream(data):
     logs = []
     i = 0
     n = len(data)
-    
+
     while i < n:
         if i + 8 > n:
             break
-        
-        payload_size = struct.unpack('>I', data[i+4:i+8])[0]
-        
+
+        payload_size = struct.unpack(">I", data[i + 4 : i + 8])[0]
+
         i += 8
         if i + payload_size > n:
             break
-            
-        line = data[i:i+payload_size].decode('utf-8', errors='replace').strip()
+
+        line = data[i : i + payload_size].decode("utf-8", errors="replace").strip()
         if line:
             logs.append(line)
-        
+
         i += payload_size
-        
+
     return logs
 
+
 async def get_monero_logs(tail=None):
     return await fetch_docker_logs("monerod", tail=tail)
 
+
 async def _get_remote_monero_sync_status():
     """
     Reads monerod sync status from the local stats file generated by p2pool.
     """
     try:
-        async with aiofiles.open(NETWORK_STATS_PATH, mode='r') as f:
+        async with aiofiles.open(NETWORK_STATS_PATH) as f:
             contents = await f.read()
             if not contents:
-                 return {"is_syncing": False}
-                 
+                return {"is_syncing": False}
+
             stats = json.loads(contents)
-            
+
             current_height = stats.get("height", 0)
             target_height = stats.get("target_height", 0)
-            
+
             if target_height > 0 and current_height < target_height:
                 percent = int((current_height / target_height) * 100)
                 return {
                     "is_syncing": True,
                     "current": current_height,
                     "target": target_height,
-                    "percent": percent
+                    "percent": percent,
                 }
             else:
-                 return {"is_syncing": False}
-                 
+                return {"is_syncing": False}
+
     except FileNotFoundError:
         logger.warning(f"Network stats file not found at {NETWORK_STATS_PATH}")
         return {"is_syncing": False}
@@ -114,6 +124,7 @@ async def _get_remote_monero_sync_status():
         logger.error(f"Error reading monero sync status: {e}")
         return {"is_syncing": False}
 
+
 async def _get_local_monero_sync_status():
     """
     Sync status for a local monerod.
@@ -174,15 +185,11 @@ async def _get_monero_sync_status_from_logs():
             elif target > 0:
                 percent = int((current / target) * 100)
 
-            return {
-                "is_syncing": True,
-                "current": current,
-                "target": target,
-                "percent": percent
-            }
+            return {"is_syncing": True, "current": current, "target": target, "percent": percent}
 
     return {"is_syncing": False}
 
+
 async def get_monero_sync_status():
     """
     Determines whether to check local docker logs or P2Pool's network stats
@@ -194,4 +201,4 @@ async def get_monero_sync_status():
     # feature (Issue #31) deliberately no-ops for remote nodes (p2pool manages those).
     status = await _get_remote_monero_sync_status()
     status.setdefault("reachable", True)
-    return status
\ No newline at end of file
+    return status
diff --git a/build/dashboard/mining_dashboard/collector/pools.py b/build/dashboard/mining_dashboard/collector/pools.py
index 23c71da3..708bfb62 100644
--- a/build/dashboard/mining_dashboard/collector/pools.py
+++ b/build/dashboard/mining_dashboard/collector/pools.py
@@ -1,13 +1,16 @@
 import json
 import os
-import time
+
 from mining_dashboard.config.config import (
-    P2P_STATS_PATH, POOL_STATS_PATH, NETWORK_STATS_PATH, 
-    STRATUM_STATS_PATH, TARI_STATS_PATH, SECOND_PER_BLOCK_MAIN,
-    BLOCK_PPLNS_WINDOW_MAIN, BLOCK_PPLNS_WINDOW_MINI, BLOCK_PPLNS_WINDOW_NANO,
-    SECOND_PER_BLOCK_P2POOL_MAIN, SECOND_PER_BLOCK_P2POOL_MINI, SECOND_PER_BLOCK_P2POOL_NANO
+    NETWORK_STATS_PATH,
+    P2P_STATS_PATH,
+    POOL_STATS_PATH,
+    SECOND_PER_BLOCK_MAIN,
+    STRATUM_STATS_PATH,
+    TARI_STATS_PATH,
 )
 
+
 def _read_json(path):
     """
     Safely loads a JSON file, returning an empty dictionary on failure.
@@ -15,7 +18,7 @@ def _read_json(path):
     """
     if os.path.exists(path):
         try:
-            with open(path, 'r') as f:
+            with open(path) as f:
                 return json.load(f)
         except (json.JSONDecodeError, OSError):
             # Fail silently to allow the dashboard to continue running
@@ -23,17 +26,18 @@ def _read_json(path):
             pass
     return {}
 
+
 def detect_pool_type(peers):
     """
     Heuristically detects the P2Pool network type (Main, Mini, Nano) based on peer ports.
-    
+
     Args:
         peers (list): List of peer connection strings (e.g., "1.2.3.4:37889").
     """
     counts = {"Main": 0, "Mini": 0, "Nano": 0}
-    if not peers: 
+    if not peers:
         return "Unknown"
-        
+
     # Match the port exactly (the last colon-segment), not as a substring of the whole peer
     # string — an IP that merely contains the port digits (e.g. "37.88.9.1:18080") would
     # otherwise be miscounted, and pool type drives block_time / the PPLNS-window duration the
@@ -47,13 +51,14 @@ def detect_pool_type(peers):
     winner = max(counts, key=counts.get)
     return winner if counts[winner] > 0 else "Unknown"
 
+
 def get_p2pool_stats():
     """Aggregates P2Pool local statistics and P2P network health data."""
     raw_p2p = _read_json(P2P_STATS_PATH)
     raw_pool = _read_json(POOL_STATS_PATH)
     raw_stratum = _read_json(STRATUM_STATS_PATH)
     pool_stats = raw_pool.get("pool_statistics", {})
-    
+
     pool_type = detect_pool_type(raw_p2p.get("peers", []))
 
     last_share_time = raw_stratum.get("last_share_found_time", 0)
@@ -66,7 +71,7 @@ def get_p2pool_stats():
             "in_peers": raw_p2p.get("incoming_connections", 0),
             "peers_count": raw_p2p.get("peer_list_size", 0),
             "uptime": raw_p2p.get("uptime", 0),
-            "zmq_active": raw_p2p.get("zmq_last_active", 0)
+            "zmq_active": raw_p2p.get("zmq_last_active", 0),
         },
         "pool": {
             "hashrate": pool_stats.get("hashRate", 0),
@@ -81,50 +86,35 @@ def get_p2pool_stats():
             "total_hashes": pool_stats.get("totalHashes", 0),
             "shares_found": shares_total,
             "last_share_time": last_share_time,
-        }
+        },
     }
     return stats
 
+
 def get_network_stats():
     """Retrieves Monero network statistics (Difficulty, Height, Reward)."""
     raw = _read_json(NETWORK_STATS_PATH)
-    
-    diff = raw.get('difficulty', 0)
-    hashrate = raw.get('hash', 'N/A')
-    
+
+    diff = raw.get("difficulty", 0)
+    hashrate = raw.get("hash", "N/A")
+
     # Calculate hashrate if missing (Difficulty / Target Time)
-    if (hashrate == 'N/A' or hashrate == 0) and diff > 0:
+    if (hashrate == "N/A" or hashrate == 0) and diff > 0:
         hashrate = diff / SECOND_PER_BLOCK_MAIN
-        
+
     return {
         "difficulty": diff,
-        "height": raw.get('height', 0),
-        "reward": raw.get('reward', 0),
+        "height": raw.get("height", 0),
+        "reward": raw.get("reward", 0),
         "hash": hashrate,
-        "timestamp": raw.get('timestamp', 0)
+        "timestamp": raw.get("timestamp", 0),
     }
 
+
 def get_stratum_stats():
-    """
-    Parses local stratum statistics to extract worker configurations.
-    
-    Returns:
-        tuple: (Raw JSON dict, List of worker config dicts)
-    """
-    raw = _read_json(STRATUM_STATS_PATH)
-    
-    worker_configs = []
-    # Iterate through worker entries (Format: "IP, ..., ..., ..., Name, ...")
-    for w_entry in raw.get("workers", []):
-        if isinstance(w_entry, str):
-            parts = w_entry.split(',')
-            if len(parts) >= 1:
-                ip = parts[0].split(':')[0].strip()
-                # Default to "miner" if name field (index 4) is missing
-                name = parts[4].strip() if len(parts) >= 5 else "miner"
-                worker_configs.append({"ip": ip, "name": name, "parts": parts})
-
-    return raw, worker_configs
+    """Returns the raw local stratum statistics JSON dict."""
+    return _read_json(STRATUM_STATS_PATH)
+
 
 def get_tari_stats():
     """Retrieves Tari merge mining status and rewards."""
@@ -132,12 +122,18 @@ def get_tari_stats():
     chains = raw.get("chains", [])
     if chains:
         t = chains[0]
+        # `channel_state` is p2pool's gRPC connectivity state to the Tari node (IDLE/CONNECTING/READY/
+        # TRANSIENT_FAILURE/SHUTDOWN). `active` only means a chain is configured; `connected` means the
+        # channel is actually up — the dashboard must gate the "✔" on the latter, never on `active`,
+        # so a broken channel can't render as "TRANSIENT_FAILURE ✔".
+        state = t.get("channel_state", "UNKNOWN")
         return {
             "active": True,
-            "status": t.get('channel_state', 'UNKNOWN'),
-            "address": t.get('wallet', 'Unknown'),
-            "height": t.get('height', 0),
-            "reward": t.get('reward', 0) / 1_000_000, # Convert uTari to Tari
-            "difficulty": t.get('difficulty', 0)
+            "status": state,
+            "connected": state == "READY",
+            "address": t.get("wallet", "Unknown"),
+            "height": t.get("height", 0),
+            "reward": t.get("reward", 0) / 1_000_000,  # Convert uTari to Tari
+            "difficulty": t.get("difficulty", 0),
         }
-    return {"active": False}
\ No newline at end of file
+    return {"active": False}
diff --git a/build/dashboard/mining_dashboard/collector/system.py b/build/dashboard/mining_dashboard/collector/system.py
index e5276458..ef5947da 100644
--- a/build/dashboard/mining_dashboard/collector/system.py
+++ b/build/dashboard/mining_dashboard/collector/system.py
@@ -1,11 +1,13 @@
-import shutil
 import os
+import shutil
+
 from mining_dashboard.config.config import DISK_PATH
 
-BYTES_IN_GB = 1024 ** 3
+BYTES_IN_GB = 1024**3
 
 _last_cpu_times = None
 
+
 def get_disk_usage():
     """
     Calculates storage utilization for the configured data directory.
@@ -21,14 +23,12 @@ def get_disk_usage():
             "total_gb": usage.total / BYTES_IN_GB,
             "used_gb": usage.used / BYTES_IN_GB,
             "percent": percent,
-            "percent_str": f"{percent:.1f}%"
+            "percent_str": f"{percent:.1f}%",
         }
     except Exception:
         # Return zeroed metrics if the path is inaccessible
-        return {
-            "total_gb": 0, "used_gb": 0, 
-            "percent": 0, "percent_str": "0%"
-        }
+        return {"total_gb": 0, "used_gb": 0, "percent": 0, "percent_str": "0%"}
+
 
 def get_memory_usage():
     """
@@ -38,13 +38,13 @@ def get_memory_usage():
     try:
         mem_total = 0
         mem_available = 0
-        with open('/proc/meminfo', 'r') as f:
+        with open("/proc/meminfo") as f:
             for line in f:
-                if line.startswith('MemTotal:'):
-                    mem_total = int(line.split()[1]) * 1024 # kB to bytes
-                elif line.startswith('MemAvailable:'):
-                    mem_available = int(line.split()[1]) * 1024 # kB to bytes
-        
+                if line.startswith("MemTotal:"):
+                    mem_total = int(line.split()[1]) * 1024  # kB to bytes
+                elif line.startswith("MemAvailable:"):
+                    mem_available = int(line.split()[1]) * 1024  # kB to bytes
+
         if mem_total > 0:
             used = mem_total - mem_available
             percent = (used / mem_total) * 100
@@ -52,12 +52,13 @@ def get_memory_usage():
                 "total_gb": mem_total / BYTES_IN_GB,
                 "used_gb": used / BYTES_IN_GB,
                 "percent": percent,
-                "percent_str": f"{percent:.1f}%"
+                "percent_str": f"{percent:.1f}%",
             }
-    except Exception:
+    except Exception:  # noqa: S110 — best-effort memory stat; any failure falls through to the zeroed default below
         pass
     return {"total_gb": 0, "used_gb": 0, "percent": 0, "percent_str": "0%"}
 
+
 def get_load_average():
     """
     Returns system load average (1m, 5m, 15m) as a string.
@@ -68,6 +69,7 @@ def get_load_average():
     except Exception:
         return "0.00 0.00 0.00"
 
+
 def get_cpu_usage():
     """
     Calculates CPU usage percentage using /proc/stat.
@@ -75,19 +77,20 @@ def get_cpu_usage():
     """
     global _last_cpu_times
     try:
-        with open('/proc/stat', 'r') as f:
+        with open("/proc/stat") as f:
             line = f.readline()
-        
+
         parts = line.split()
         # cpu user nice system idle iowait irq softirq steal
-        if len(parts) < 5: return "0.0%"
-        
+        if len(parts) < 5:
+            return "0.0%"
+
         # Sum all fields for total time
         values = [int(x) for x in parts[1:]]
         total = sum(values)
         # Idle is idle + iowait
         idle = values[3] + (values[4] if len(values) > 4 else 0)
-        
+
         usage = 0.0
         if _last_cpu_times:
             prev_total, prev_idle = _last_cpu_times
@@ -95,16 +98,17 @@ def get_cpu_usage():
             delta_idle = idle - prev_idle
             if delta_total > 0:
                 usage = ((delta_total - delta_idle) / delta_total) * 100
-        
+
         _last_cpu_times = (total, idle)
         return f"{usage:.1f}%"
     except Exception:
         return "0.0%"
 
+
 def get_hugepages_status():
     """
     Analyzes system memory configuration to determine HugePage availability.
-    
+
     Parses /proc/meminfo to check if HugePages are allocated and actively used
     by the mining process (RandomX optimization).
 
@@ -113,7 +117,7 @@ def get_hugepages_status():
     """
     try:
         mem_stats = {}
-        with open("/proc/meminfo", "r") as f:
+        with open("/proc/meminfo") as f:
             for line in f:
                 if line.startswith("HugePages_Total"):
                     mem_stats["total"] = int(line.split()[1])
@@ -125,27 +129,27 @@ def get_hugepages_status():
             hp_total = mem_stats["total"]
             hp_free = mem_stats["free"]
             hp_used = hp_total - hp_free
-            
+
             val_str = f"{hp_used} / {hp_total}"
-            
+
             # Status Logic:
             # 1. Total == 0: Feature not enabled in kernel/GRUB.
             if hp_total == 0:
                 return "Disabled", "status-bad", val_str
-            
+
             # 2. Used > 0: Feature enabled and actively utilized by miner.
             elif hp_used > 0:
                 return "Enabled", "status-ok", val_str
-            
+
             # 3. Total > 0 but Used == 0: reserved but the miner isn't consuming them yet — the
             # normal startup / sync-hold state, NOT an error, so render it green (#175). Keep the
             # "Allocated" label (distinct from actively-"Enabled") but with the ok class. (The
             # genuinely-bad case is hp_total == 0 / "Disabled"; "Unknown" below stays warn.)
             else:
                 return "Allocated", "status-ok", val_str
-                
+
     except (FileNotFoundError, ValueError, IndexError):
         # Gracefully handle non-Linux systems or parsing errors
         pass
-        
-    return "Unknown", "status-warn", "0/0"
\ No newline at end of file
+
+    return "Unknown", "status-warn", "0/0"
diff --git a/build/dashboard/mining_dashboard/config/config.py b/build/dashboard/mining_dashboard/config/config.py
index ef7063c3..3797c8ce 100644
--- a/build/dashboard/mining_dashboard/config/config.py
+++ b/build/dashboard/mining_dashboard/config/config.py
@@ -1,12 +1,12 @@
-import os
 import json
+import os
 
 # --- System Configuration & Paths ---
 # Base directory for shared statistics generated by the P2Pool sidecar
 BASE_STATS_DIR = "/app/stats"
 
 # Persistent storage path for application state database
-DISK_PATH = '/data'
+DISK_PATH = "/data"
 DB_FILE_PATH = os.path.join(DISK_PATH, "mining_data.db")
 
 # Low-disk warning thresholds (% used of the data filesystem), surfaced as a top-bar badge (#138):
@@ -29,8 +29,26 @@
 HOST_IP = os.environ.get("HOST_IP", "Unknown Host")
 
 # XMRig Worker API Configuration
-XMRIG_API_PORT = 8080
-API_TIMEOUT = 1         # Connection timeout (seconds) for worker API calls
+#
+# The dashboard enriches each proxy-reported worker by probing that miner's own xmrig HTTP API
+# (/1/summary) for uptime + per-miner hashrate. There is exactly ONE way it does this, derived from
+# config — no auto-detection fallback. A failed probe is surfaced (api_ok=false + a logged warning),
+# never silently swallowed.
+#
+#   XMRIG_API_AUTH  how to authenticate to the worker API:
+#                     none  (default) — open, read-only API (xmrig http.restricted, no access-token).
+#                                       This is the stock RigForge worker.
+#                     name           — Bearer = the worker's stratum name (xmrig access-token = name).
+#                     token          — Bearer = a single shared XMRIG_API_TOKEN for every worker.
+#   XMRIG_API_TOKEN the shared bearer used when XMRIG_API_AUTH=token.
+#   XMRIG_API_PORT  the port the worker API listens on.
+#
+# Upgrade note: stacks whose miners still set an xmrig access-token (the pre-open default) should set
+# XMRIG_API_AUTH=name — otherwise the no-auth default probe 401s and those workers read api_ok=false.
+XMRIG_API_PORT = int(os.environ.get("XMRIG_API_PORT", 8080))
+XMRIG_API_AUTH = os.environ.get("XMRIG_API_AUTH", "none").strip().lower()
+XMRIG_API_TOKEN = os.environ.get("XMRIG_API_TOKEN", "")
+API_TIMEOUT = 1  # Connection timeout (seconds) for worker API calls
 
 # The stack's internal docker bridge subnet. The dashboard runs network_mode: host and a connecting
 # miner fully controls its worker name/ip via stratum, yet per-worker stats are fetched at a host
@@ -51,10 +69,10 @@
 XVB_TIME_ALGO_MS = 600000
 
 # Minimum dwell time on a pool to ensure valid share submission (15 seconds)
-XVB_MIN_TIME_SEND_MS = 15000    
+XVB_MIN_TIME_SEND_MS = 15000
 
 # Wallet address used for fetching XvB bonus history and pool identification
-MONERO_WALLET_ADDRESS = os.environ.get("MONERO_WALLET_ADDRESS", "") 
+MONERO_WALLET_ADDRESS = os.environ.get("MONERO_WALLET_ADDRESS", "")
 
 # Unique Donor ID for the XMRvsBeast pool
 XVB_DONOR_ID = os.environ.get("XVB_DONOR_ID", "")
@@ -67,6 +85,52 @@
 # host-networked dashboard reaches the bridge container's Tor SOCKS at 172.28.0.25:9050.
 XVB_TOR_PROXY = os.environ.get("XVB_TOR_PROXY", "socks5h://172.28.0.25:9050")
 
+# Route XvB DONATION MINING through Tor by default too (#166), not just the stats fetch (#163): while
+# donating, the proxy connects to na.xmrvsbeast.com, which would otherwise expose the host IP. The
+# algo controller sets this host:port as the XvB pool's per-pool `socks5` field (xmrig-proxy resolves
+# that pool's DNS proxy-side). `xvb.tor: false` opts out (direct, for max yield). The host:port is
+# derived from XVB_TOR_PROXY (so a custom subnet, #180, carries through) with the scheme stripped —
+# xmrig wants a bare host:port.
+XVB_TOR_ENABLED = os.environ.get("XVB_TOR_ENABLED", "true").lower() == "true"
+XVB_TOR_SOCKS5 = XVB_TOR_PROXY.split("://", 1)[-1]
+
+# XvB raffle-registration endpoint (#263). Mining to the XvB pool isn't enough to enter the raffle —
+# a wallet is only entered once it's registered against this endpoint (and only if it already has a
+# share in the P2Pool PPLNS window). Same host as the XvB stats fetch above. The operator asked us
+# not to *advertise* this API ("to mitigate abuse"), so don't surface the bare URL in user-facing
+# docs/README — but it ships here as the working default. Override with XVB_SUBMIT_URL (e.g. a test
+# server); set it to a disable sentinel (off/none/false/disabled/0) to turn auto-registration off
+# while keeping XvB on. The call ALWAYS rides Tor (XVB_TOR_PROXY) like the stats fetch (#163) since it
+# carries the full wallet — it is NOT subject to the xvb.tor donation opt-out.
+#
+# Contract — GET ?address=<full wallet>, verified live 2026-06-28:
+#   2xx                                              => freshly registered
+#   422 "ERROR: Wallet Address Already Registered"   => already in (idempotent success)
+#   422 "ERROR: Invalid Wallet Address"              => bad wallet (permanent — stop retrying)
+#   no-share / 5xx / other                           => transient, retry on the next poll
+_XVB_SUBMIT_DEFAULT = "https://xmrvsbeast.com/cgi-bin/p2pool_bonus_submit_api.cgi"
+_XVB_SUBMIT_DISABLE_SENTINELS = {"off", "none", "false", "disabled", "0"}
+_xvb_submit_env = os.environ.get("XVB_SUBMIT_URL", "").strip()
+if _xvb_submit_env.lower() in _XVB_SUBMIT_DISABLE_SENTINELS:
+    XVB_SUBMIT_URL = ""  # auto-registration explicitly disabled (XvB itself still runs)
+else:
+    XVB_SUBMIT_URL = _xvb_submit_env or _XVB_SUBMIT_DEFAULT
+
+# How often to re-register with XvB once eligible (#263), seconds. Registration is idempotent, so we
+# re-run on a daily cadence: it picks up the operator's newer security-token behaviour and re-enters
+# a long-offline miner cleanly.
+XVB_REGISTER_INTERVAL_S = 24 * 3600
+
+# --- Egress posture knobs (#170 Component Health panel) ---
+# Surfaced so the dashboard can show each component's outbound egress route + a privacy roll-up.
+# Defaults are the privacy-safe resting state (firewall fail-closed; p2pool peers over Tor); pithead
+# renders the real values into the dashboard env (docker-compose.yml) so the panel reflects actual
+# config rather than a hardcoded guess. TOR_EGRESS_FIREWALL is the #270 network-layer backstop: when
+# on, any non-Tor egress from the container subnet is DROPPED (fail-closed), so the whole stack is
+# Tor-only regardless of per-app config.
+TOR_EGRESS_FIREWALL = os.environ.get("TOR_EGRESS_FIREWALL", "true").strip().lower() == "true"
+P2POOL_CLEARNET = os.environ.get("P2POOL_CLEARNET", "false").strip().lower() == "true"
+
 # New-release check (#224, config.json: dashboard.check_for_updates). Default ON — the dashboard asks
 # GitHub for the latest release and shows a header badge linking to it if it's newer than the running
 # version. Notify-only (no upgrade — that's #59). The check is routed over the same bridge Tor SOCKS
@@ -74,7 +138,9 @@
 # GitHub — which is why it's safe to default on; it fails silently offline. Opt out with `false`.
 CHECK_FOR_UPDATES = os.environ.get("DASHBOARD_CHECK_UPDATES", "true").strip().lower() == "true"
 GITHUB_RELEASES_API = os.environ.get(
-    "GITHUB_RELEASES_API", "https://api.github.com/repos/p2pool-starter-stack/pithead/releases/latest")
+    "GITHUB_RELEASES_API",
+    "https://api.github.com/repos/p2pool-starter-stack/pithead/releases/latest",
+)
 UPDATE_CHECK_INTERVAL = int(float(os.environ.get("UPDATE_CHECK_INTERVAL", "3600")))
 
 # Donation tier to target (config.json: xvb.donation_level). The XvB raffle picks
@@ -131,7 +197,9 @@
 # #31's job — it stops only xmrig-proxy so p2pool keeps its sidechain position), and the latch
 # is persisted across dashboard restarts so a restart mid-sync doesn't prematurely release.
 SYNC_GATE_CONTAINERS = [
-    c.strip() for c in os.environ.get("SYNC_GATE_CONTAINERS", "p2pool,xmrig-proxy").split(",") if c.strip()
+    c.strip()
+    for c in os.environ.get("SYNC_GATE_CONTAINERS", "p2pool,xmrig-proxy").split(",")
+    if c.strip()
 ]
 
 # Debounce: a node must be unreachable this long before it's declared DOWN, and reachable
@@ -170,8 +238,18 @@
 # signal the data loop already computes and, the first time a clearnet node reports synced, drops a
 # persistent marker in CLEARNET_STATE_DIR and restarts the container — whose entrypoint, seeing the
 # marker, comes back up Tor-only. Default off. Truthy parsing matches MONERO_PRUNE.
-MONERO_CLEARNET_SYNC = os.environ.get("MONERO_CLEARNET_SYNC", "false").strip().lower() in ("true", "1", "yes", "on")
-TARI_CLEARNET_SYNC = os.environ.get("TARI_CLEARNET_SYNC", "false").strip().lower() in ("true", "1", "yes", "on")
+MONERO_CLEARNET_SYNC = os.environ.get("MONERO_CLEARNET_SYNC", "false").strip().lower() in (
+    "true",
+    "1",
+    "yes",
+    "on",
+)
+TARI_CLEARNET_SYNC = os.environ.get("TARI_CLEARNET_SYNC", "false").strip().lower() in (
+    "true",
+    "1",
+    "yes",
+    "on",
+)
 # Shared, dashboard-writable dir holding the per-chain "<name>.synced" transition markers. Mounted
 # read-only into monerod/tari at the same path. Container default matches the compose mount.
 CLEARNET_STATE_DIR = os.environ.get("CLEARNET_STATE_DIR", "/clearnet-state")
@@ -207,6 +285,14 @@
 # especially if XvB over-credits). 0.03 converges in a few hours and stays stable.
 XVB_CONTROL_GAIN = float(os.environ.get("XVB_CONTROL_GAIN", 0.03))
 
+# Age past which a frozen XvB stats read is treated as stale (#311). A successful
+# fetch lands every ~10 poll cycles (data_service throttle) and only a real fetch
+# bumps `last_update` (#136), so its age IS the fetch age. When the fetch goes quiet
+# (e.g. a stuck Tor circuit) `avg_1h` freezes; steering off that frozen number
+# over-donates against a target we can't refresh. Past this age the controller holds
+# the last split instead of chasing it. Default ~3 fetch intervals.
+XVB_STATS_STALE_AFTER_S = float(os.environ.get("XVB_STATS_STALE_AFTER_S", 3 * 10 * UPDATE_INTERVAL))
+
 # VIP / PPLNS reserve. To stay "VIP" we must keep finding p2pool shares, so we
 # reserve enough hashrate for p2pool to hold a share in the PPLNS window. The bare
 # minimum (one expected share per window) is sidechain_difficulty / window_seconds;
@@ -220,11 +306,14 @@
 
 # --- Data Retention Policies ---
 HISTORY_RETENTION_SEC = 30 * 24 * 3600  # 30 Days
-WORKER_RETENTION_SEC = 7 * 24 * 3600    # 7 Days
+# Retention for the known_workers persistence layer removed in #144. No live consumer in the current
+# tree; kept for the deferred Telegram worker-presence monitor (#121), which reuses it as its
+# retention default — consult that work before removing.
+WORKER_RETENTION_SEC = 7 * 24 * 3600  # 7 Days
 # How long an offline worker lingers in the live "Workers Alive" table before it falls off (#182).
-# Operates on the live proxy-sourced list (NOT the dead known_workers path, #144). A reconnect
-# re-adds the worker. 1h keeps a just-disconnected rig visible (shown as DOWN) but clears ghosts.
-WORKER_FALLOFF_SEC = 3600               # 1 Hour
+# Operates on the live proxy-sourced list. A reconnect re-adds the worker. 1h keeps a
+# just-disconnected rig visible (shown as DOWN) but clears ghosts.
+WORKER_FALLOFF_SEC = 3600  # 1 Hour
 
 # --- Hashrate averaging windows (#168) ---
 # xmrig-proxy's /workers rows expose five native per-worker averaging windows. The chart lets the
@@ -240,9 +329,9 @@
 # window -> (p2pool column, xvb column) in the history table. 10m maps to the original pair so the
 # default view and all existing rows stay intact; the rest are additive columns (see _migrate_db).
 HASHRATE_WINDOW_COLUMNS = {
-    "1m":  ("v_p2pool_1m",  "v_xvb_1m"),
-    "10m": ("v_p2pool",     "v_xvb"),
-    "1h":  ("v_p2pool_1h",  "v_xvb_1h"),
+    "1m": ("v_p2pool_1m", "v_xvb_1m"),
+    "10m": ("v_p2pool", "v_xvb"),
+    "1h": ("v_p2pool_1h", "v_xvb_1h"),
     "12h": ("v_p2pool_12h", "v_xvb_12h"),
     "24h": ("v_p2pool_24h", "v_xvb_24h"),
 }
@@ -251,10 +340,10 @@
 # Hashrate thresholds (H/s) for XMRvsBeast donation tiers.
 # Reference: Official XvB rules (Mega=1M, Whale=100k, VIP=10k, Donor=1k)
 TIER_DEFAULTS = {
-    "donor_mega": 1_000_000, 
-    "donor_whale": 100_000, 
-    "donor_vip": 10_000,    
-    "donor": 1_000          
+    "donor_mega": 1_000_000,
+    "donor_whale": 100_000,
+    "donor_vip": 10_000,
+    "donor": 1_000,
 }
 
 # Allow runtime configuration override via environment variable (injected via .env)
@@ -268,12 +357,4 @@
         pass
 
 # --- P2Pool Protocol Constants ---
-# Constants for PPLNS (Pay Per Last N Shares) window calculation
-BLOCK_PPLNS_WINDOW_MAIN = 2160  # Window size in blocks
-BLOCK_PPLNS_WINDOW_MINI = 2160
-BLOCK_PPLNS_WINDOW_NANO = 2160
-
-SECOND_PER_BLOCK_MAIN = 120          # Monero Target block time in seconds
-SECOND_PER_BLOCK_P2POOL_MAIN = 10    # P2Pool Main Block Time
-SECOND_PER_BLOCK_P2POOL_MINI = 10    # P2Pool Mini Block Time
-SECOND_PER_BLOCK_P2POOL_NANO = 30    # P2Pool Nano Block Time
\ No newline at end of file
+SECOND_PER_BLOCK_MAIN = 120  # Monero Target block time in seconds
diff --git a/build/dashboard/mining_dashboard/helper/utils.py b/build/dashboard/mining_dashboard/helper/utils.py
index 64b8f041..45f251e7 100644
--- a/build/dashboard/mining_dashboard/helper/utils.py
+++ b/build/dashboard/mining_dashboard/helper/utils.py
@@ -1,16 +1,18 @@
-import time
-import socket
 import ipaddress
-from mining_dashboard.config.config import TIER_DEFAULTS
+import socket
+import time
+
+from mining_dashboard.config.config import TIER_DEFAULTS, XVB_STATS_STALE_AFTER_S
+
 
 def parse_hashrate(val_str, unit_str=None):
     """
     Converts a numeric string and an optional unit suffix into raw hashes per second (H/s).
-    
+
     Args:
         val_str (str|float): The numeric value (e.g., "1.5").
         unit_str (str, optional): The unit suffix (e.g., "MH/s", "kH/s").
-        
+
     Returns:
         float: The standardized hashrate in H/s. Returns 0.0 on parsing failure.
     """
@@ -18,31 +20,35 @@ def parse_hashrate(val_str, unit_str=None):
         val = float(val_str)
         if not unit_str:
             return val
-        
+
         # Normalize unit string for case-insensitive comparison
         unit = unit_str.lower()
-        
-        if "gh" in unit: return val * 1_000_000_000
-        if "mh" in unit: return val * 1_000_000
-        if "kh" in unit: return val * 1_000
-        
+
+        if "gh" in unit:
+            return val * 1_000_000_000
+        if "mh" in unit:
+            return val * 1_000_000
+        if "kh" in unit:
+            return val * 1_000
+
         return val
     except (ValueError, TypeError):
         return 0.0
 
+
 def format_hashrate(hashrate):
     """
     Formats a raw hashrate value into a human-readable string with appropriate units.
-    
+
     Args:
         hashrate (float): The raw hashrate in H/s.
-        
+
     Returns:
         str: Formatted string (e.g., "1.25 MH/s").
     """
     try:
         val = float(hashrate)
-        
+
         if val >= 1_000_000_000:
             return f"{val / 1_000_000_000:.2f} GH/s"
         elif val >= 1_000_000:
@@ -51,22 +57,23 @@ def format_hashrate(hashrate):
             return f"{val / 1_000:.2f} kH/s"
         else:
             return f"{val:.2f} H/s"
-            
+
     except (ValueError, TypeError):
         return "0 H/s"
 
+
 def format_duration(seconds):
     """
     Formats a duration in seconds into a concise human-readable string.
-    
+
     Format logic:
     - > 1 day: "Xd Xh Xm"
     - > 1 hour: "Xh Xm"
     - < 1 hour: "Xm Xs"
-    
+
     Args:
         seconds (int|float): Duration in seconds.
-        
+
     Returns:
         str: Formatted duration string.
     """
@@ -76,35 +83,76 @@ def format_duration(seconds):
         hours = (seconds // 3600) % 24
         minutes = (seconds // 60) % 60
         secs = seconds % 60
-        
+
         if days > 0:
             return f"{days}d {hours}h {minutes}m"
         if hours > 0:
             return f"{hours}h {minutes}m"
-            
+
         return f"{minutes}m {secs}s"
-        
+
     except (ValueError, TypeError):
         return "0s"
 
+
 def format_time_abs(timestamp):
     """
     Converts a Unix timestamp into a localized time string (HH:MM:SS).
-    
+
     Args:
         timestamp (float): Unix timestamp.
-        
+
     Returns:
         str: Formatted time string or error placeholder.
     """
     if not timestamp:
         return "Never"
-        
+
     try:
-        return time.strftime('%H:%M:%S', time.localtime(timestamp))
+        return time.strftime("%H:%M:%S", time.localtime(timestamp))
     except (ValueError, OSError, TypeError):
         return "Invalid Time"
 
+
+def xvb_stats_are_stale(xvb_stats):
+    """True when the XvB stats fetch has gone quiet long enough that ``avg_1h`` /
+    ``avg_24h`` are no longer trustworthy live readings (#311).
+
+    ``last_update`` bumps ONLY on a genuine xmrvsbeast.com fetch (#136), so its age
+    is the fetch age. A zero ``last_update`` means we've never fetched (cold start) —
+    NOT stale. Shared by the donation controller (which holds its split rather than
+    steering off a frozen number) and the dashboard (which greys the credited figures)
+    so the two never disagree about what "stale" means."""
+    last_update = (xvb_stats or {}).get("last_update", 0) or 0
+    return last_update > 0 and (time.time() - last_update) > XVB_STATS_STALE_AFTER_S
+
+
+# PPLNS window math, shared by metrics (display), the donation controller (routing
+# decisions), and XvB auto-register (eligibility) so the three never drift (#263). Nano
+# sidechain blocks are 30s; Main/Mini are 10s. P2Pool's default window is 2160 blocks.
+PPLNS_BLOCK_TIME_NANO = 30
+PPLNS_BLOCK_TIME_DEFAULT = 10
+DEFAULT_PPLNS_WINDOW = 2160
+
+
+def pplns_block_time(pool_type):
+    """Seconds per sidechain block for the given pool type ("Nano" else Main/Mini)."""
+    return PPLNS_BLOCK_TIME_NANO if pool_type == "Nano" else PPLNS_BLOCK_TIME_DEFAULT
+
+
+def shares_in_pplns_window(shares, pplns_window, block_time, now=None):
+    """Count shares whose timestamp falls within the PPLNS window.
+
+    The window spans ``pplns_window`` blocks of ``block_time`` seconds each; a share with
+    ``ts >= now - pplns_window * block_time`` counts. ``now`` defaults to ``time.time()``
+    and is injectable for tests.
+    """
+    if now is None:
+        now = time.time()
+    cutoff = now - pplns_window * block_time
+    return sum(1 for s in shares if s.get("ts", 0) >= cutoff)
+
+
 def get_tier_info(hashrate, tiers=None):
     """
     Determines the donation tier based on hashrate.
@@ -124,6 +172,7 @@ def get_tier_info(hashrate, tiers=None):
 
     return "None", 0.0
 
+
 def _configured_tier_threshold(tiers, donation_level):
     """
     Maps a configured donation level to a tier threshold (H/s).
@@ -154,6 +203,7 @@ def _configured_tier_threshold(tiers, donation_level):
     except (ValueError, TypeError):
         return float(positive[0])
 
+
 def resolve_target_threshold(tiers, stable_hr, donation_level, max_fraction):
     """
     Resolves the donation tier to aim for. Returns ``(threshold_hs, sustainable)``.
diff --git a/build/dashboard/mining_dashboard/main.py b/build/dashboard/mining_dashboard/main.py
index 7d4b4033..e1956a4c 100644
--- a/build/dashboard/mining_dashboard/main.py
+++ b/build/dashboard/mining_dashboard/main.py
@@ -3,20 +3,20 @@
 
 from aiohttp import web
 
+from mining_dashboard.client.xmrig_proxy_client import XMRigProxyClient
+from mining_dashboard.client.xvb_client import XvbClient
 from mining_dashboard.config.config import (
+    MONERO_WALLET_ADDRESS,
+    PROXY_API_PORT,
     PROXY_AUTH_TOKEN,
     PROXY_HOST,
-    PROXY_API_PORT,
-    MONERO_WALLET_ADDRESS,
 )
+from mining_dashboard.service.algo_service import AlgoService
+from mining_dashboard.service.data_service import DataService
 from mining_dashboard.service.storage_service import StateManager
 from mining_dashboard.web.server import create_app
-from mining_dashboard.client.xmrig_proxy_client import XMRigProxyClient
-from mining_dashboard.client.xvb_client import XvbClient
-from mining_dashboard.service.data_service import DataService
-from mining_dashboard.service.algo_service import AlgoService
 
-logging.basicConfig(level=logging.INFO, format='%(asctime)s [%(levelname)s] %(message)s')
+logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
 logger = logging.getLogger("Main")
 
 
@@ -27,26 +27,28 @@ def build_app() -> web.Application:
     side effects — nothing opens the database or a network client until the app is built.
     """
     state_manager = StateManager()
-    proxy_client = XMRigProxyClient(host=PROXY_HOST, port=PROXY_API_PORT, access_token=PROXY_AUTH_TOKEN)
+    proxy_client = XMRigProxyClient(
+        host=PROXY_HOST, port=PROXY_API_PORT, access_token=PROXY_AUTH_TOKEN
+    )
     xvb_client = XvbClient(wallet_address=MONERO_WALLET_ADDRESS)
     data_service = DataService(state_manager, proxy_client, xvb_client)
     algo_service = AlgoService(state_manager, proxy_client, data_service)
 
     async def start_background_tasks(app):
         """Initializes background services upon web application startup."""
-        app['data_task'] = asyncio.create_task(data_service.run())
-        app['algo_task'] = asyncio.create_task(algo_service.run())
+        app["data_task"] = asyncio.create_task(data_service.run())
+        app["algo_task"] = asyncio.create_task(algo_service.run())
 
     async def cleanup_background_tasks(app):
         """Stops background tasks and closes resources on shutdown."""
-        app['data_task'].cancel()
-        app['algo_task'].cancel()
-        await asyncio.gather(app['data_task'], app['algo_task'], return_exceptions=True)
-        if 'state_manager' in app:
-            app['state_manager'].close()
+        app["data_task"].cancel()
+        app["algo_task"].cancel()
+        await asyncio.gather(app["data_task"], app["algo_task"], return_exceptions=True)
+        if "state_manager" in app:
+            app["state_manager"].close()
 
     app = create_app(state_manager, data_service.latest_data)
-    app['state_manager'] = state_manager
+    app["state_manager"] = state_manager
     app.on_startup.append(start_background_tasks)
     app.on_cleanup.append(cleanup_background_tasks)
     return app
@@ -57,7 +59,7 @@ def main() -> None:
     logger.info("Initializing Dashboard Web Server securely on 127.0.0.1:8000")
     # Bound to localhost (127.0.0.1) so it is inaccessible from the local network directly;
     # traffic is securely routed through the Caddy proxy.
-    web.run_app(app, host='127.0.0.1', port=8000, print=None)
+    web.run_app(app, host="127.0.0.1", port=8000, print=None)
 
 
 if __name__ == "__main__":
diff --git a/build/dashboard/mining_dashboard/service/algo_service.py b/build/dashboard/mining_dashboard/service/algo_service.py
index 15640e69..930180b7 100644
--- a/build/dashboard/mining_dashboard/service/algo_service.py
+++ b/build/dashboard/mining_dashboard/service/algo_service.py
@@ -1,28 +1,38 @@
 import asyncio
 import logging
-import time
 import math
+
 from mining_dashboard.config.config import (
-    XVB_TIME_ALGO_MS,
+    ENABLE_XVB,
     MONERO_WALLET_ADDRESS,
-    XVB_DONOR_ID,
     P2POOL_URL,
-    XVB_POOL_URL,
-    XVB_MIN_TIME_SEND_MS,
-    ENABLE_XVB,
+    UPDATE_INTERVAL,
+    XVB_CONTROL_GAIN,
     XVB_DONATION_LEVEL,
-    XVB_MAX_DONATION_FRACTION,
-    XVB_MAINT_MARGIN_PCT,
+    XVB_DONOR_ID,
     XVB_MAINT_MARGIN_ABS_CAP,
-    XVB_CONTROL_GAIN,
+    XVB_MAINT_MARGIN_PCT,
+    XVB_MAX_DONATION_FRACTION,
+    XVB_MIN_TIME_SEND_MS,
     XVB_P2POOL_RESERVE_FACTOR,
+    XVB_POOL_URL,
+    XVB_STATS_STALE_AFTER_S,
     XVB_SWITCH_OVERHEAD_MS,
-    UPDATE_INTERVAL
+    XVB_TIME_ALGO_MS,
+    XVB_TOR_ENABLED,
+    XVB_TOR_SOCKS5,
+)
+from mining_dashboard.helper.utils import (
+    DEFAULT_PPLNS_WINDOW,
+    pplns_block_time,
+    resolve_target_threshold,
+    shares_in_pplns_window,
+    xvb_stats_are_stale,
 )
-from mining_dashboard.helper.utils import resolve_target_threshold
 
 logger = logging.getLogger("AlgoService")
 
+
 class AlgoService:
     def __init__(self, state_manager, proxy_client, data_service):
         self.state_manager = state_manager
@@ -44,16 +54,24 @@ async def switch_miners(self, mode, state_label=None):
         """
         Configures the upstream pool priority for the XMRig Proxy.
         """
+        # The local p2pool pool dials direct (it's on the bridge). The XvB pool routes through Tor by
+        # default (#166) — its per-pool `socks5` makes the proxy reach na.xmrvsbeast.com via Tor
+        # (DNS resolved proxy-side), so donation mining doesn't expose the home IP. `xvb.tor: false`
+        # opts out. Only the XvB pool gets `socks5`; the local pool never does.
+        p2pool_pool = {
+            "url": P2POOL_URL,
+            "user": MONERO_WALLET_ADDRESS,
+            "pass": "x",
+            "coin": "monero",
+        }
+        xvb_pool = {"url": XVB_POOL_URL, "user": XVB_DONOR_ID, "pass": "x", "coin": "monero"}
+        if XVB_TOR_ENABLED:
+            xvb_pool["socks5"] = XVB_TOR_SOCKS5
+
         if mode == "P2POOL":
-            pools = [
-                {"url": P2POOL_URL, "user": MONERO_WALLET_ADDRESS, "pass": "x", "enabled": True, "coin": "monero"},
-                {"url": XVB_POOL_URL, "user": XVB_DONOR_ID, "pass": "x", "enabled": False, "coin": "monero"}
-            ]
+            pools = [{**p2pool_pool, "enabled": True}, {**xvb_pool, "enabled": False}]
         else:
-            pools = [
-                {"url": XVB_POOL_URL, "user": XVB_DONOR_ID, "pass": "x", "enabled": True, "coin": "monero"},
-                {"url": P2POOL_URL, "user": MONERO_WALLET_ADDRESS, "pass": "x", "enabled": False, "coin": "monero"}
-            ]
+            pools = [{**xvb_pool, "enabled": True}, {**p2pool_pool, "enabled": False}]
 
         try:
             # Fetch current full configuration to preserve other settings
@@ -66,7 +84,7 @@ async def switch_miners(self, mode, state_label=None):
 
             # Execute update via Proxy Client with the full configuration
             await asyncio.to_thread(self.proxy_client.update_config, current_config)
-            
+
             # Update state manager with the new active mode
             final_label = state_label if state_label else mode
             await asyncio.to_thread(self.state_manager.update_xvb_stats, mode=final_label)
@@ -74,8 +92,9 @@ async def switch_miners(self, mode, state_label=None):
         except Exception as e:
             logger.error(f"Failed to switch proxy mode: {e}")
 
-    def get_decision(self, current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats,
-                     shares, advance=True):
+    def get_decision(
+        self, current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats, shares, advance=True
+    ):
         """
         Evaluates the current mining state to determine the next operation mode.
 
@@ -103,25 +122,24 @@ def get_decision(self, current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats
 
         # Constraint: Enforce P2Pool mode if no shares have been found recently.
         # This uses the same logic as the dashboard UI to count shares within the PPLNS window.
-        pool_type = p2p_stats.get('type', 'Main')
-        pplns_window = p2pool_stats.get('pplns_window', 2160)
-
-        block_time = 10  # Default for Main/Mini
-        if pool_type == "Nano":
-            block_time = 30
-
+        pool_type = p2p_stats.get("type", "Main")
+        pplns_window = p2pool_stats.get("pplns_window", DEFAULT_PPLNS_WINDOW)
+        block_time = pplns_block_time(pool_type)
         window_duration = pplns_window * block_time
-        cutoff = time.time() - window_duration
-        shares_in_window_count = sum(1 for s in shares if s.get('ts', 0) >= cutoff)
+        shares_in_window_count = shares_in_pplns_window(shares, pplns_window, block_time)
 
         if shares_in_window_count == 0:
-            logger.info(f"Decision Strategy: Force P2POOL (Zero shares in PPLNS window of {window_duration}s)")
+            logger.info(
+                f"Decision Strategy: Force P2POOL (Zero shares in PPLNS window of {window_duration}s)"
+            )
             return "P2POOL", 0
 
         # Constraint: Fallback to P2Pool if XvB endpoint failures exceed threshold.
-        fail_count = xvb_stats.get('fail_count', 0)
+        fail_count = xvb_stats.get("fail_count", 0)
         if fail_count >= 3:
-            logger.warning(f"Decision Strategy: Force P2POOL (Excessive XvB failures: {fail_count})")
+            logger.warning(
+                f"Decision Strategy: Force P2POOL (Excessive XvB failures: {fail_count})"
+            )
             return "P2POOL", 0
 
         # Highest tier we can sustain, capped by the configured donation level.
@@ -134,12 +152,24 @@ def get_decision(self, current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats
 
         # Cap the donated fraction so p2pool keeps finding shares (VIP status).
         max_fraction = self._max_donation_fraction(current_hr, window_duration, p2pool_stats)
-        avg_1h = xvb_stats.get('avg_1h', 0)
-        avg_24h = xvb_stats.get('avg_24h', 0)
+        avg_1h = xvb_stats.get("avg_1h", 0)
+        avg_24h = xvb_stats.get("avg_24h", 0)
 
         # Advance the calibration loop once per real cycle (not during _smart_sleep).
+        # But never steer off a stale read (#311): if the xmrvsbeast.com fetch has gone
+        # quiet, avg_1h is frozen and stepping the loop would wind the fraction up
+        # against a target we can't refresh. Hold the last split until a fresh read lands.
         if advance:
-            self._advance_controller(current_hr, target_hr, avg_1h, max_fraction)
+            if self._stats_are_stale(xvb_stats):
+                logger.warning(
+                    "XvB stats stale (no fetch in >%.0fs): holding donation fraction at %.3f "
+                    "(frozen 1h %.0f)",
+                    XVB_STATS_STALE_AFTER_S,
+                    self.donation_fraction or 0.0,
+                    avg_1h,
+                )
+            else:
+                self._advance_controller(current_hr, target_hr, avg_1h, max_fraction)
 
         fraction = min(self.donation_fraction or 0.0, max_fraction)
         needed_time_ms = self._fraction_to_ms(fraction)
@@ -156,11 +186,15 @@ def get_decision(self, current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats
             needed_time_ms = XVB_TIME_ALGO_MS
 
         if needed_time_ms >= XVB_TIME_ALGO_MS:
-            logger.info(f"Decision: Full XVB cycle (target {target_hr:.0f}; 1h {avg_1h:.0f} / 24h {avg_24h:.0f})")
+            logger.info(
+                f"Decision: Full XVB cycle (target {target_hr:.0f}; 1h {avg_1h:.0f} / 24h {avg_24h:.0f})"
+            )
             return "XVB", XVB_TIME_ALGO_MS
 
-        logger.info(f"Decision: Split ({needed_time_ms}ms to XvB; frac {fraction:.3f}; "
-                    f"target {target_hr:.0f}; 1h {avg_1h:.0f} / 24h {avg_24h:.0f})")
+        logger.info(
+            f"Decision: Split ({needed_time_ms}ms to XvB; frac {fraction:.3f}; "
+            f"target {target_hr:.0f}; 1h {avg_1h:.0f} / 24h {avg_24h:.0f})"
+        )
         return "SPLIT", int(needed_time_ms)
 
     def _get_target_donation_hr(self, stable_hr):
@@ -175,6 +209,13 @@ def _get_target_donation_hr(self, stable_hr):
         )
         return target
 
+    def _stats_are_stale(self, xvb_stats):
+        """A stale XvB read freezes ``avg_1h`` (#311); holding the split beats steering
+        off a frozen number. Shared with the dashboard via ``xvb_stats_are_stale`` so
+        the controller and the UI agree on staleness. Cold start (no fetch yet) is NOT
+        stale — the feedforward ramp must be left to seed and climb to tier."""
+        return xvb_stats_are_stale(xvb_stats)
+
     def _reference_hr(self, target_hr):
         """Hashrate the controller holds XvB's 1h average at: the tier threshold
         plus a small, noise-covering cushion (capped in absolute H/s). The raffle
@@ -194,7 +235,7 @@ def _max_donation_fraction(self, current_hr, window_duration, p2pool_stats):
         headroom against variance. When difficulty is unknown (stats not ready),
         fall back to the flat hard cap.
         """
-        difficulty = p2pool_stats.get('difficulty', 0) or 0
+        difficulty = p2pool_stats.get("difficulty", 0) or 0
         if current_hr <= 0 or difficulty <= 0 or window_duration <= 0:
             return self.max_donation_fraction
 
@@ -275,13 +316,29 @@ async def _smart_sleep(self, duration_sec, check_interval_sec=None):
                 # XvB's 1h average has slipped below the tier and we need to catch
                 # up — so the next cycle reacts in seconds, not after the full dwell.
                 decision, _ = self.get_decision(
-                    current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats, shares,
+                    current_hr,
+                    stable_hr,
+                    p2pool_stats,
+                    p2p_stats,
+                    xvb_stats,
+                    shares,
                     advance=False,
                 )
+                # The "under tier -> catch up early" override acts directly on avg_1h,
+                # so suppress it when the read is stale (#311): a frozen below-tier
+                # number would otherwise cut every p2pool dwell short and drift the
+                # effective split far past the computed fraction. The held decision
+                # (XVB/SPLIT) still ends the dwell — only the avg-driven override pauses.
                 target_hr = self._get_target_donation_hr(stable_hr)
-                under_tier = target_hr > 0 and xvb_stats.get('avg_1h', 0) < target_hr
+                under_tier = (
+                    not self._stats_are_stale(xvb_stats)
+                    and target_hr > 0
+                    and xvb_stats.get("avg_1h", 0) < target_hr
+                )
                 if decision in ("XVB", "SPLIT") or under_tier:
-                    logger.info("Smart-sleep: donation target needs attention — ending P2Pool dwell early.")
+                    logger.info(
+                        "Smart-sleep: donation target needs attention — ending P2Pool dwell early."
+                    )
                     return
             except Exception as e:
                 logger.debug(f"Smart-sleep check error: {e}")
@@ -292,8 +349,8 @@ async def run(self):
         Determines the optimal mining mode and manages worker switching cycles.
         """
         logger.info("Service Started: Algorithm Control Loop")
-        await asyncio.sleep(5) 
-        
+        await asyncio.sleep(5)
+
         while True:
             try:
                 # While workers are rejected (a node is down, Issue #31) the proxy is
@@ -320,9 +377,11 @@ async def run(self):
                 p2p_stats = p2pool_data.get("p2p", {})
                 xvb_stats = self.state_manager.get_xvb_stats()
                 shares = latest_data.get("shares", [])
-                
+
                 # Execute decision logic
-                decision, xvb_duration = self.get_decision(current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats, shares)
+                decision, xvb_duration = self.get_decision(
+                    current_hr, stable_hr, p2pool_stats, p2p_stats, xvb_stats, shares
+                )
 
                 # Record the fraction of this cycle actually routed to XvB so the
                 # dashboard can show routed-vs-credited (the live credit factor).
@@ -353,4 +412,4 @@ async def run(self):
 
             except Exception as e:
                 logger.error(f"Algorithm Error: {e}")
-                await asyncio.sleep(10)
\ No newline at end of file
+                await asyncio.sleep(10)
diff --git a/build/dashboard/mining_dashboard/service/clearnet_sync.py b/build/dashboard/mining_dashboard/service/clearnet_sync.py
index c887dc1e..fc666b15 100644
--- a/build/dashboard/mining_dashboard/service/clearnet_sync.py
+++ b/build/dashboard/mining_dashboard/service/clearnet_sync.py
@@ -7,8 +7,10 @@
 # and was SIGKILL'd), and Docker holds the stop request open until the container is down — so the
 # HTTP timeout MUST exceed the stop deadline, or the stop call aborts early, reports failure, and
 # (with the old `stop and start`) skipped the start entirely, leaving the daemon down.
-_RESTART_STOP_TIMEOUT = 30   # seconds Docker waits (SIGTERM → SIGKILL) for the daemon to stop
-_RESTART_HTTP_TIMEOUT = 60   # HTTP timeout for the stop/start calls; must exceed _RESTART_STOP_TIMEOUT
+_RESTART_STOP_TIMEOUT = 30  # seconds Docker waits (SIGTERM → SIGKILL) for the daemon to stop
+_RESTART_HTTP_TIMEOUT = (
+    60  # HTTP timeout for the stop/start calls; must exceed _RESTART_STOP_TIMEOUT
+)
 
 
 class ClearnetSyncSupervisor:
@@ -60,8 +62,9 @@ def _write_marker(self, name):
                 fh.write("clearnet initial sync complete; node returned to Tor (#234)\n")
             return True
         except OSError as exc:
-            logger.error("%s: could not write Tor-resync marker at %s: %s",
-                         name, self.marker_path(name), exc)
+            logger.error(
+                "%s: could not write Tor-resync marker at %s: %s", name, self.marker_path(name), exc
+            )
             return False
 
     async def maybe_transition(self, name, container, flag_on, synced):
@@ -84,15 +87,17 @@ async def maybe_transition(self, name, container, flag_on, synced):
         # and a reboot would re-expose the node. Stay exposed and retry next cycle instead.
         if not self._write_marker(name):
             return True
-        logger.warning("%s: CLEARNET initial sync complete — switching %s back to Tor (#234).",
-                       name, container)
+        logger.warning(
+            "%s: CLEARNET initial sync complete — switching %s back to Tor (#234).", name, container
+        )
         # Stop with a generous window + an HTTP timeout that OUTLASTS it, then ALWAYS start. The old
         # `stop and start` left a slow-stopping daemon down: when stop's HTTP call timed out before
         # the container finished stopping, `and` short-circuited and start was never called (#234:
         # Tari took >5s to stop and never came back). `ok` is now the START result — the container
         # must end up running; a stop hiccup can no longer skip the start.
-        await self.docker_control.stop(container, stop_timeout=_RESTART_STOP_TIMEOUT,
-                                       request_timeout=_RESTART_HTTP_TIMEOUT)
+        await self.docker_control.stop(
+            container, stop_timeout=_RESTART_STOP_TIMEOUT, request_timeout=_RESTART_HTTP_TIMEOUT
+        )
         ok = await self.docker_control.start(container, request_timeout=_RESTART_HTTP_TIMEOUT)
         if ok:
             self._flipped.add(name)
@@ -100,8 +105,12 @@ async def maybe_transition(self, name, container, flag_on, synced):
         else:
             # Restart failed: do NOT mark flipped, so we retry next cycle. The marker is already on
             # disk, so any start (this retry, a manual restart, a reboot) brings the node up on Tor.
-            logger.error("%s: restart of %s onto Tor failed — will retry next cycle (the marker is "
-                         "set, so any restart comes up Tor-only).", name, container)
+            logger.error(
+                "%s: restart of %s onto Tor failed — will retry next cycle (the marker is "
+                "set, so any restart comes up Tor-only).",
+                name,
+                container,
+            )
         if self.on_transition is not None:
             try:
                 self.on_transition(name, ok)
diff --git a/build/dashboard/mining_dashboard/service/data_service.py b/build/dashboard/mining_dashboard/service/data_service.py
index 159a4d4e..3c6366db 100644
--- a/build/dashboard/mining_dashboard/service/data_service.py
+++ b/build/dashboard/mining_dashboard/service/data_service.py
@@ -2,32 +2,55 @@
 import logging
 import os
 import time
+
 from aiohttp import ClientSession
 
+from mining_dashboard.client.docker.docker_control import DockerControl
+from mining_dashboard.client.tari.tari_client import TariClient
+from mining_dashboard.client.xmrig_client import XMRigWorkerClient
+from mining_dashboard.client.xvb_client import (
+    REG_INVALID,
+    REG_NOT_ELIGIBLE,
+    REG_OK,
+)
+from mining_dashboard.collector.logs import get_monero_sync_status
+from mining_dashboard.collector.pools import (
+    get_network_stats,
+    get_p2pool_stats,
+    get_stratum_stats,
+    get_tari_stats,
+)
+from mining_dashboard.collector.system import (
+    get_cpu_usage,
+    get_disk_usage,
+    get_hugepages_status,
+    get_load_average,
+    get_memory_usage,
+)
 from mining_dashboard.config.config import (
-    UPDATE_INTERVAL,
-    TARI_REQUIRED,
-    REJECT_WORKERS_CONTAINER,
-    SYNC_GATE_CONTAINERS,
-    ENABLE_XVB,
-    WORKER_FALLOFF_SEC,
     CHECK_FOR_UPDATES,
+    CLEARNET_STATE_DIR,
+    ENABLE_XVB,
     GITHUB_RELEASES_API,
-    UPDATE_CHECK_INTERVAL,
-    XVB_TOR_PROXY,
     MONERO_CLEARNET_SYNC,
+    REJECT_WORKERS_CONTAINER,
+    SYNC_GATE_CONTAINERS,
     TARI_CLEARNET_SYNC,
-    CLEARNET_STATE_DIR,
+    TARI_REQUIRED,
+    UPDATE_CHECK_INTERVAL,
+    UPDATE_INTERVAL,
+    WORKER_FALLOFF_SEC,
+    XVB_REGISTER_INTERVAL_S,
+    XVB_TOR_PROXY,
+)
+from mining_dashboard.helper.utils import (
+    DEFAULT_PPLNS_WINDOW,
+    pplns_block_time,
+    shares_in_pplns_window,
 )
-from mining_dashboard.service.update_checker import GitHubReleaseClient, UpdateChecker
-from mining_dashboard.client.xmrig_client import XMRigWorkerClient
-from mining_dashboard.client.tari.tari_client import TariClient
-from mining_dashboard.client.docker.docker_control import DockerControl
 from mining_dashboard.service.clearnet_sync import ClearnetSyncSupervisor
-from mining_dashboard.collector.pools import get_p2pool_stats, get_network_stats, get_stratum_stats, get_tari_stats
-from mining_dashboard.collector.logs import get_monero_sync_status
-from mining_dashboard.collector.system import get_disk_usage, get_hugepages_status, get_memory_usage, get_load_average, get_cpu_usage
 from mining_dashboard.service.node_health import NodeHealthMonitor
+from mining_dashboard.service.update_checker import GitHubReleaseClient, UpdateChecker
 
 logger = logging.getLogger("DataService")
 
@@ -35,21 +58,27 @@
 # normalization below isn't a wall of magic indices. A row has >= _PX_MIN_FIELDS entries.
 _PX_NAME = 0
 _PX_IP = 1
-_PX_CONNECTIONS = 2     # active connections; 0 means a stale/disconnected worker
-_PX_ACCEPTED = 3        # accepted shares (cumulative)
-_PX_REJECTED = 4        # rejected shares (cumulative)
-_PX_INVALID = 5         # invalid shares (cumulative)
-_PX_LAST_SHARE_MS = 7   # epoch ms of the last accepted share
-_PX_HR_1M = 8           # 1-minute hashrate, kH/s
-_PX_HR_10M = 9          # 10-minute hashrate, kH/s
-_PX_HR_1H = 10          # 1-hour hashrate, kH/s   (#168)
-_PX_HR_12H = 11         # 12-hour hashrate, kH/s  (#168)
-_PX_HR_24H = 12         # 24-hour hashrate, kH/s  (#168)
+_PX_CONNECTIONS = 2  # active connections; 0 means a stale/disconnected worker
+_PX_ACCEPTED = 3  # accepted shares (cumulative)
+_PX_REJECTED = 4  # rejected shares (cumulative)
+_PX_INVALID = 5  # invalid shares (cumulative)
+_PX_LAST_SHARE_MS = 7  # epoch ms of the last accepted share
+_PX_HR_1M = 8  # 1-minute hashrate, kH/s
+_PX_HR_10M = 9  # 10-minute hashrate, kH/s
+_PX_HR_1H = 10  # 1-hour hashrate, kH/s   (#168)
+_PX_HR_12H = 11  # 12-hour hashrate, kH/s  (#168)
+_PX_HR_24H = 12  # 24-hour hashrate, kH/s  (#168)
 _PX_MIN_FIELDS = 13
 
 # xmrig-proxy reports hashrate in kH/s; the dashboard works in H/s.
 _KHS_TO_HS = 1000
 
+# Consecutive XvB-registration failures (while never yet registered) before we raise the dashboard
+# "registration failing" warning (#263). A couple of transient blips during the normal first-share
+# window shouldn't alarm; a configured-but-refusing endpoint should. At one attempt per 10th poll
+# (~5 min) this is ~15 min of sustained failure.
+_XVB_REGISTER_FAIL_ALERT = 3
+
 
 def _parse_proxy_list_worker(w):
     """Parse one xmrig-proxy 6.x positional row into a worker dict.
@@ -171,23 +200,31 @@ def _merge_direct_stats(workers, results, active_pool_port):
     unreachable (falsy ``extra_stats``) the worker keeps its proxy-derived hashrate/uptime
     and stays online — the proxy already confirmed it's connected and submitting shares —
     rather than dropping out of the hashrate total and reading zero (Fixes #28). Each
-    worker is tagged with ``active_pool`` for the UI badge.
+    worker is tagged with ``active_pool`` for the UI badge, and with ``api_ok`` (True/False) when
+    the worker API was probed so the UI can flag a worker whose direct API is misconfigured /
+    unreachable — distinct from a worker that's simply offline.
     """
     final_workers = []
-    for w, extra_stats in zip(workers, results):
-        if extra_stats:
-            w['uptime'] = extra_stats.get('uptime', w['uptime'])
+    for w, extra_stats in zip(workers, results, strict=False):
+        # api_ok: True (probe succeeded), False (probe failed — surfaced, not swallowed), or unset
+        # (worker we deliberately didn't probe, e.g. an internal/invalid IP per the SSRF guard).
+        api_ok = extra_stats.get("api_ok") if extra_stats else None
+        if api_ok is not None:
+            w["api_ok"] = api_ok
 
-            is_proxy = extra_stats.get('kind') == 'proxy'
+        if api_ok:  # only a successful probe carries uptime + per-miner hashrate
+            w["uptime"] = extra_stats.get("uptime", w["uptime"])
+
+            is_proxy = extra_stats.get("kind") == "proxy"
             hr_scale = _KHS_TO_HS if is_proxy else 1
 
-            hr_total = extra_stats.get('hashrate', {}).get('total', [])
+            hr_total = extra_stats.get("hashrate", {}).get("total", [])
             if isinstance(hr_total, list) and len(hr_total) >= 3:
-                w['h10'] = (hr_total[0] or 0) * hr_scale
-                w['h60'] = (hr_total[1] or 0) * hr_scale
-                w['h15'] = (hr_total[2] or 0) * hr_scale
+                w["h10"] = (hr_total[0] or 0) * hr_scale
+                w["h60"] = (hr_total[1] or 0) * hr_scale
+                w["h15"] = (hr_total[2] or 0) * hr_scale
 
-        w['active_pool'] = active_pool_port
+        w["active_pool"] = active_pool_port
         final_workers.append(w)
     return final_workers
 
@@ -202,14 +239,14 @@ def _aggregate_hashrate(workers):
     total_hr = 0
     total_h10 = 0
     for w in workers:
-        if w.get('status') == 'online':
-            w_hr = w.get('h15', 0)
+        if w.get("status") == "online":
+            w_hr = w.get("h15", 0)
             if w_hr == 0:
-                w_hr = w.get('h60', 0)
+                w_hr = w.get("h60", 0)
             if w_hr == 0:
-                w_hr = w.get('h10', 0)
+                w_hr = w.get("h10", 0)
             total_hr += w_hr
-            total_h10 += w.get('h10', 0)
+            total_h10 += w.get("h10", 0)
     return total_hr, total_h10
 
 
@@ -227,7 +264,7 @@ def _aggregate_window_hashrates(workers):
     """
     totals = {win: 0 for win in _WINDOW_WORKER_KEYS}
     for w in workers:
-        if w.get('status') == 'online':
+        if w.get("status") == "online":
             for win, src in _WINDOW_WORKER_KEYS.items():
                 totals[win] += w.get(src, 0) or 0
     return totals
@@ -260,7 +297,7 @@ class WorkerLifecycle:
       (any positive value is left untouched).
     - ``last_active`` — the last time it was seen online. An offline worker falls off the table once
       it's been inactive longer than ``falloff_sec`` (#182); a reconnect re-adds it. Operates purely
-      on the live proxy-sourced list, never the dead ``known_workers`` path (#144).
+      on the live proxy-sourced worker list.
 
     Pure given (workers, now) plus its accumulated state, so it unit-tests without the data loop.
     Mutates each surviving online worker's ``uptime`` in place and returns the filtered list.
@@ -268,7 +305,7 @@ class WorkerLifecycle:
 
     def __init__(self, falloff_sec):
         self.falloff_sec = falloff_sec
-        self._state = {}   # name -> {"connected_since": float | None, "last_active": float}
+        self._state = {}  # name -> {"connected_since": float | None, "last_active": float}
 
     def update(self, workers, now):
         live = []
@@ -278,18 +315,18 @@ def update(self, workers, now):
             seen.add(name)
             st = self._state.setdefault(name, {"connected_since": None, "last_active": 0.0})
             if w.get("status") == "online":
-                if st["connected_since"] is None:        # new connection or a reconnect
+                if st["connected_since"] is None:  # new connection or a reconnect
                     st["connected_since"] = now
                 st["last_active"] = now
-                if not w.get("uptime"):                  # no real (direct-API) uptime → track it
+                if not w.get("uptime"):  # no real (direct-API) uptime → track it
                     w["uptime"] = int(now - st["connected_since"])
                 live.append(w)
             else:
-                st["connected_since"] = None             # disconnected — uptime restarts on reconnect
+                st["connected_since"] = None  # disconnected — uptime restarts on reconnect
                 if st["last_active"] == 0.0:
-                    st["last_active"] = now              # first seen already offline
+                    st["last_active"] = now  # first seen already offline
                 if now - st["last_active"] <= self.falloff_sec:
-                    live.append(w)                       # recently-offline rows stay (shown as DOWN)
+                    live.append(w)  # recently-offline rows stay (shown as DOWN)
                 # else: fall off — drop the ghost row
         # Forget ONLY workers the proxy no longer reports at all. A worker that has aged out of the
         # live table but is STILL reported (offline) must be KEPT in state so its `last_active`
@@ -307,6 +344,7 @@ class DataService:
     Core service responsible for aggregating mining statistics from various sources
     (Local collectors, XMRig Proxy, Tari Node, etc.) and maintaining the application state.
     """
+
     def __init__(self, state_manager, proxy_client, xvb_client):
         self.state_manager = state_manager
         self.proxy_client = proxy_client
@@ -321,6 +359,14 @@ def __init__(self, state_manager, proxy_client, xvb_client):
             enabled=CHECK_FOR_UPDATES,
             interval=UPDATE_CHECK_INTERVAL,
         )
+        # XvB raffle auto-registration (#263): wall-clock of the last successful register() call,
+        # None until the wallet is first entered. Drives the daily re-register cadence below.
+        self._xvb_last_registered = None
+        # Consecutive transient register() failures while never-yet-registered (drives the "failing"
+        # badge), and a latch that stops retrying once the endpoint calls the wallet invalid — a
+        # permanent error that won't fix itself on retry (#263).
+        self._xvb_register_failures = 0
+        self._xvb_invalid_wallet = False
 
         self.latest_data = {
             "workers": [],
@@ -339,7 +385,7 @@ def __init__(self, state_manager, proxy_client, xvb_client):
             "workers_rejected": False,
             "miner_released": False,
             "miner_held": False,
-            "timestamp": 0
+            "timestamp": 0,
         }
 
         # Node-down detection + optional worker rejection (Issue #31).
@@ -350,7 +396,8 @@ def __init__(self, state_manager, proxy_client, xvb_client):
         # the same docker control proxy as the #31 failover (start/stop only). on_transition surfaces
         # the event into the snapshot so the UI/status can reflect "switched back to Tor".
         self.clearnet_supervisor = ClearnetSyncSupervisor(
-            CLEARNET_STATE_DIR, self.docker_control,
+            CLEARNET_STATE_DIR,
+            self.docker_control,
             on_transition=self._on_clearnet_transition,
         )
         # Per-chain "currently exposed on clearnet" flags, surfaced in the snapshot for the UI/banner.
@@ -401,8 +448,7 @@ async def _apply_worker_rejection(self, monero_down, tari_down):
         # Readmit only once every node we reject on is confirmed healthy (not merely 'not
         # down'), so a dashboard restart mid-outage doesn't bring workers back to a still-down
         # stack. Tari's health is ignored when it's non-blocking.
-        recovered = self.monero_health.healthy and \
-                    ((not TARI_REQUIRED) or self.tari_health.healthy)
+        recovered = self.monero_health.healthy and ((not TARI_REQUIRED) or self.tari_health.healthy)
         if self.workers_rejected and recovered:
             logger.info(
                 f"Required nodes recovered — starting {REJECT_WORKERS_CONTAINER} to readmit workers."
@@ -457,12 +503,110 @@ async def _apply_sync_gate(self, gate_satisfied):
                 f"until synced."
             )
 
+    async def _sync_xvb_stats(self):
+        """
+        Fetch XvB's reported averages (avg_1h/avg_24h/fail_count) over Tor and persist them.
+
+        A failed fetch (Tor timeout, 5xx) returns None — we write NOTHING in that case, leaving the
+        last-good values AND ``last_update`` frozen. That frozen ``last_update`` is exactly what the
+        controller and dashboard read to detect a stale feed and stop steering off a dead number
+        (#311). So "no write on failure" is a correctness precondition, not just an optimisation —
+        if this ever started stamping on failure, the staleness guard would silently never trigger.
+
+        The caller already gated on ENABLE_XVB + the 10th-iteration throttle.
+        """
+        real_xvb_stats = await asyncio.to_thread(self.xvb_client.get_stats)
+        if not real_xvb_stats:
+            return  # fetch failed — keep the last reading + last_update frozen so #311 can detect it
+        await asyncio.to_thread(self.state_manager.update_xvb_stats, **real_xvb_stats)
+        logger.info(f"External Sync: XvB Stats Updated (1h={real_xvb_stats['avg_1h']:.0f} H/s)")
+
+    async def _maybe_register_xvb(self, shares, p2pool_stats):
+        """
+        Auto-enter the wallet into the XvB raffle once it's eligible (#263).
+
+        Mining to the XvB pool doesn't enter a wallet — it must be registered against the operator's
+        endpoint, which only takes effect once the wallet has a share in the P2Pool PPLNS window. So
+        we gate on a PPLNS share existing (same window math as the dashboard/algo) and skip silently
+        until then, retrying on the next poll. After the first success we re-register on a daily
+        cadence (XVB_REGISTER_INTERVAL_S): registration is idempotent, and re-running picks up the
+        operator's newer security-token behaviour and re-enters a long-offline miner cleanly.
+
+        The caller already gated on ENABLE_XVB + the 10th-iteration throttle. Edge cases are handled
+        from the endpoint's real contract (see XvbClient.register): "already registered" is the
+        idempotent steady state (success); an invalid wallet is permanent (latch + warn, stop
+        retrying); transient errors escalate to a "failing" badge only after a few attempts.
+        register() routes over Tor.
+        """
+        # Nothing to do if registration is disabled (XVB_SUBMIT_URL off) or the wallet was already
+        # rejected as permanently invalid — both are terminal for this process, skip quietly.
+        if not self.xvb_client.submit_url or self._xvb_invalid_wallet:
+            return
+
+        # PPLNS-share check — mirrors metrics/algo: a share counts if it's within pplns_window
+        # blocks (30s/block on Nano, else 10s) of now.
+        pool_type = p2pool_stats.get("p2p", {}).get("type", "Main")
+        pplns_window = p2pool_stats.get("pool", {}).get("pplns_window", DEFAULT_PPLNS_WINDOW)
+        block_time = pplns_block_time(pool_type)
+        if shares_in_pplns_window(shares, pplns_window, block_time) == 0:
+            return  # no eligible share yet — the endpoint would no-op, so don't call it
+
+        now = time.time()
+        if self._xvb_last_registered is not None and (
+            now - self._xvb_last_registered < XVB_REGISTER_INTERVAL_S
+        ):
+            return  # already registered recently; next re-register isn't due yet
+
+        status = await asyncio.to_thread(self.xvb_client.register)
+
+        if status == REG_OK:
+            # Fresh registration OR the idempotent "already registered" steady state — either way the
+            # wallet is in the raffle. Stamp it and clear the transient-failure counter.
+            self._xvb_last_registered = now
+            self._xvb_register_failures = 0
+            await asyncio.to_thread(
+                self.state_manager.update_xvb_stats,
+                registered_at=now,
+                registration_state="registered",
+            )
+            logger.info("External Sync: Registered wallet with XvB raffle ✓")
+        elif status == REG_INVALID:
+            # Permanent: the endpoint won't accept this wallet, and it won't change on retry. Latch
+            # off, warn once, and surface it — don't hammer the endpoint every poll.
+            self._xvb_invalid_wallet = True
+            logger.warning(
+                "XvB registration rejected MONERO_WALLET_ADDRESS as invalid — auto-registration "
+                "disabled. The XvB raffle needs a standard primary Monero address (4…). (#263)"
+            )
+            await asyncio.to_thread(
+                self.state_manager.update_xvb_stats, registration_state="invalid"
+            )
+        elif status == REG_NOT_ELIGIBLE:
+            # The share we see locally hasn't propagated to XvB yet — not a failure, just retry next
+            # poll. Don't count it toward the "failing" escalation.
+            return
+        else:
+            # Transient (network / 5xx / unrecognised). register() already logged specifics. Only
+            # escalate to a dashboard warning once it's *persistently* failing AND we've never
+            # succeeded — a blip while the first share propagates shouldn't alarm. (A failed daily
+            # re-register after a prior success keeps the "registered ✓"; we're still entered.)
+            self._xvb_register_failures += 1
+            if (
+                self._xvb_last_registered is None
+                and self._xvb_register_failures >= _XVB_REGISTER_FAIL_ALERT
+            ):
+                await asyncio.to_thread(
+                    self.state_manager.update_xvb_stats, registration_state="failing"
+                )
+
     def _on_clearnet_transition(self, name, ok):
         """Called by the supervisor after a clearnet→Tor flip attempt (#234)."""
         if ok:
             logger.info("%s returned to Tor after its clearnet initial sync (#234).", name)
         else:
-            logger.warning("%s clearnet→Tor switch did not complete this cycle — will retry (#234).", name)
+            logger.warning(
+                "%s clearnet→Tor switch did not complete this cycle — will retry (#234).", name
+            )
 
     async def run(self):
         """
@@ -470,13 +614,13 @@ async def run(self):
         Updates the `latest_data` state and persists historical metrics to the database.
         """
         logger.info("Service Started: Data Collection Loop")
-        
-        iteration_count = 0 
-        
+
+        iteration_count = 0
+
         async with ClientSession() as session:
             worker_client = XMRigWorkerClient(session)
-            tari_client = TariClient(session)
-            
+            tari_client = TariClient()
+
             # P2Pool shares are recorded from the cumulative shares_found counter (#129); None until
             # the first poll baselines it, so we never backfill the whole historical count on startup
             # or re-record what the DB already loaded.
@@ -485,8 +629,8 @@ async def run(self):
             while True:
                 try:
                     # 1. Collect Local Statistics (High Frequency Polling)
-                    stratum_raw, worker_configs = get_stratum_stats()
-                    
+                    stratum_raw = get_stratum_stats()
+
                     # 2. Fetch Worker Statistics from XMRig Proxy + normalize the payload.
                     proxy_workers = []
                     try:
@@ -507,13 +651,15 @@ async def run(self):
                         logger.error(f"Proxy Summary Fetch Error: {e}")
 
                     # 3. Augment with Direct Worker Stats (Uptime, Hashrate) via Local API
-                    tasks = [worker_client.get_stats(w['ip'], w['name']) for w in proxy_workers]
+                    tasks = [worker_client.get_stats(w["ip"], w["name"]) for w in proxy_workers]
                     worker_results = await asyncio.gather(*tasks)
 
                     current_mode = self.state_manager.get_xvb_stats().get("current_mode", "P2POOL")
                     # Determine active pool port for UI badges based on current Algo mode
                     active_pool_port = "3344" if "XVB" in current_mode else "3333"
-                    final_workers = _merge_direct_stats(proxy_workers, worker_results, active_pool_port)
+                    final_workers = _merge_direct_stats(
+                        proxy_workers, worker_results, active_pool_port
+                    )
                     # 3b. Track per-worker connection lifecycle: fill true uptime for online workers
                     # (#169) and drop stale offline rows past the fall-off window (#182).
                     final_workers = self._lifecycle.update(final_workers, time.time())
@@ -532,10 +678,13 @@ async def run(self):
                     current_share_ts = p2pool_stats["pool"].get("last_share_time", 0)
                     current_shares_total = p2pool_stats["pool"].get("shares_found", 0)
                     new_shares, last_known_shares_total = _shares_to_record(
-                        last_known_shares_total, current_shares_total)
+                        last_known_shares_total, current_shares_total
+                    )
                     if new_shares > 0 and current_share_ts > 0:
                         difficulty = p2pool_stats["pool"].get("difficulty", 0)
-                        await asyncio.to_thread(self.state_manager.add_shares, new_shares, current_share_ts, difficulty)
+                        await asyncio.to_thread(
+                            self.state_manager.add_shares, new_shares, current_share_ts, difficulty
+                        )
 
                     monero_sync = await get_monero_sync_status()
                     tari_sync = await tari_client.get_sync_status()
@@ -547,101 +696,107 @@ async def run(self):
                     # (that's what #31's node-down handling is for). Reading the raw signal
                     # also avoids a deadlock: the height override is fed by p2pool's stats
                     # file, which reads 0 while p2pool is held — falsely "syncing" forever.
-                    monero_synced = monero_sync.get('reachable', True) and not monero_sync.get('is_syncing', False)
-                    tari_synced = tari_sync.get('reachable', True) and not tari_sync.get('is_syncing', False)
+                    monero_synced = monero_sync.get("reachable", True) and not monero_sync.get(
+                        "is_syncing", False
+                    )
+                    tari_synced = tari_sync.get("reachable", True) and not tari_sync.get(
+                        "is_syncing", False
+                    )
 
                     # Auto-transition a clearnet initial-sync node back to Tor once it's synced
                     # (#234). Reuses the synced signals above; the supervisor writes a persistent
                     # marker + restarts the daemon (which then comes up Tor-only). Returns whether
                     # each chain is still EXPOSED on clearnet, for the UI banner.
                     monero_clearnet_exposed = await self.clearnet_supervisor.maybe_transition(
-                        "monero", "monerod", MONERO_CLEARNET_SYNC, monero_synced)
+                        "monero", "monerod", MONERO_CLEARNET_SYNC, monero_synced
+                    )
                     tari_clearnet_exposed = await self.clearnet_supervisor.maybe_transition(
-                        "tari", "tari", TARI_CLEARNET_SYNC, tari_synced)
+                        "tari", "tari", TARI_CLEARNET_SYNC, tari_synced
+                    )
                     self.clearnet_sync_state = {
                         "monero": monero_clearnet_exposed,
                         "tari": tari_clearnet_exposed,
                         "active": monero_clearnet_exposed or tari_clearnet_exposed,
                     }
 
-                    # Determine effective Tari status for UI display
-                    tari_active = tari_stats.get('active', False)
-                    tari_status_str = tari_stats.get('status', 'Waiting...') if tari_active else 'Waiting...'
-
                     # Apply Sync Logic Overrides
                     # 1. Monero Sync Check
-                    if network_stats.get('height', 0) == 0:
-                        monero_sync['is_syncing'] = True
-                        if 'percent' not in monero_sync:
-                            monero_sync.update({'percent': 0, 'current': 0, 'target': 1})
-                    
+                    if network_stats.get("height", 0) == 0:
+                        monero_sync["is_syncing"] = True
+                        if "percent" not in monero_sync:
+                            monero_sync.update({"percent": 0, "current": 0, "target": 1})
+
                     # 2. Global Sync Logic. monerod always drives the full-screen Sync Mode;
                     # Tari does so only when it's required (Issue #51). A non-blocking Tari
                     # (dashboard.tari_required:false) keeps the operational view and surfaces
                     # its progress in the Tari panel instead of hijacking the whole dashboard.
-                    is_monero_syncing = monero_sync.get('is_syncing', False)
-                    is_tari_syncing = tari_sync.get('is_syncing', False)
+                    is_monero_syncing = monero_sync.get("is_syncing", False)
+                    is_tari_syncing = tari_sync.get("is_syncing", False)
                     global_sync = is_monero_syncing or (is_tari_syncing and TARI_REQUIRED)
                     # True when Tari is syncing but we're staying in the operational view — the
                     # UI shows a "Tari syncing" indicator rather than the takeover screen.
                     tari_syncing_passive = is_tari_syncing and not global_sync
 
                     if global_sync:
-                        if not is_monero_syncing and 'percent' not in monero_sync:
-                            h = network_stats.get('height', 1)
-                            monero_sync.update({'percent': 100, 'current': h, 'target': h})
-                        if not is_tari_syncing and 'percent' not in tari_sync:
-                            h = tari_stats.get('height', 0)
-                            tari_sync.update({'percent': 100, 'current': h, 'target': h})
+                        if not is_monero_syncing and "percent" not in monero_sync:
+                            h = network_stats.get("height", 1)
+                            monero_sync.update({"percent": 100, "current": h, "target": h})
+                        if not is_tari_syncing and "percent" not in tari_sync:
+                            h = tari_stats.get("height", 0)
+                            tari_sync.update({"percent": 100, "current": h, "target": h})
 
                     # 3. Node-down detection + worker rejection (Issue #31). Debounce each
                     # node's live reachability into a stable DOWN flag; monerod-down always
                     # rejects, Tari-down rejects only when required (handled in the helper).
-                    monero_down = self.monero_health.update(monero_sync.get('reachable', True))
-                    tari_down = self.tari_health.update(tari_sync.get('reachable', True))
-                    monero_sync['down'] = monero_down
-                    tari_sync['down'] = tari_down
+                    monero_down = self.monero_health.update(monero_sync.get("reachable", True))
+                    tari_down = self.tari_health.update(tari_sync.get("reachable", True))
+                    monero_sync["down"] = monero_down
+                    tari_sync["down"] = tari_down
 
                     # 4. Sync gate (Issue #35): hold p2pool + xmrig-proxy until the required
                     # chain(s) first sync, then release. monerod must be synced; Tari must be
                     # synced too unless it's non-blocking. #31's runtime failover only applies
                     # once released — before that there are no workers to fail over, and it
                     # keeps the two features from both driving xmrig-proxy.
-                    await self._apply_sync_gate(monero_synced and (tari_synced or not TARI_REQUIRED))
+                    await self._apply_sync_gate(
+                        monero_synced and (tari_synced or not TARI_REQUIRED)
+                    )
                     if self.miner_released:
                         await self._apply_worker_rejection(monero_down, tari_down)
 
                     # Fetch fresh shares list to populate UI
                     shares_list = await asyncio.to_thread(self.state_manager.get_shares)
 
-                    self.latest_data.update({
-                        "workers": final_workers,
-                        "proxy_summary": proxy_summary,
-                        "shares": shares_list,
-                        "total_live_h15": total_hr,
-                        "total_live_h10": total_h10,
-                        "pool": p2pool_stats,
-                        "network": network_stats,
-                        "tari": tari_stats,
-                        "monero_sync": monero_sync,
-                        "tari_sync": tari_sync,
-                        "global_sync": global_sync,
-                        "tari_syncing_passive": tari_syncing_passive,
-                        "workers_rejected": self.workers_rejected,
-                        "miner_released": self.miner_released,
-                        "miner_held": self.miner_held,
-                        "clearnet_sync": self.clearnet_sync_state,
-                        "system": {
-                            "disk": get_disk_usage(),
-                            "hugepages": get_hugepages_status(),
-                            "memory": get_memory_usage(),
-                            "load": get_load_average(),
-                            "cpu_percent": get_cpu_usage()
-                        },
-                        "stratum": stratum_raw,
-                        "timestamp": time.time()
-                    })
-                    
+                    self.latest_data.update(
+                        {
+                            "workers": final_workers,
+                            "proxy_summary": proxy_summary,
+                            "shares": shares_list,
+                            "total_live_h15": total_hr,
+                            "total_live_h10": total_h10,
+                            "pool": p2pool_stats,
+                            "network": network_stats,
+                            "tari": tari_stats,
+                            "monero_sync": monero_sync,
+                            "tari_sync": tari_sync,
+                            "global_sync": global_sync,
+                            "tari_syncing_passive": tari_syncing_passive,
+                            "workers_rejected": self.workers_rejected,
+                            "miner_released": self.miner_released,
+                            "miner_held": self.miner_held,
+                            "clearnet_sync": self.clearnet_sync_state,
+                            "system": {
+                                "disk": get_disk_usage(),
+                                "hugepages": get_hugepages_status(),
+                                "memory": get_memory_usage(),
+                                "load": get_load_average(),
+                                "cpu_percent": get_cpu_usage(),
+                            },
+                            "stratum": stratum_raw,
+                            "timestamp": time.time(),
+                        }
+                    )
+
                     # 6. Persist Historical Data
                     is_xvb = "XVB" in current_mode
                     p2pool_hr = 0 if is_xvb else total_hr
@@ -657,9 +812,13 @@ async def run(self):
                     }
 
                     await asyncio.to_thread(
-                        self.state_manager.update_history, total_hr, p2pool_hr, xvb_hr, window_splits
+                        self.state_manager.update_history,
+                        total_hr,
+                        p2pool_hr,
+                        xvb_hr,
+                        window_splits,
                     )
-                    
+
                     # Create a lightweight snapshot (exclude shares entirely as they are safely in DB)
                     snapshot_data = self.latest_data.copy()
                     snapshot_data.pop("shares", None)
@@ -668,19 +827,22 @@ async def run(self):
                     # 7. External XvB stats sync over Tor (#163), throttled to every 10th iteration,
                     # and ONLY when XvB is enabled — disabling XvB must stop the egress entirely.
                     if ENABLE_XVB and iteration_count % 10 == 0:
-                        real_xvb_stats = await asyncio.to_thread(self.xvb_client.get_stats)
-                        if real_xvb_stats:
-                            await asyncio.to_thread(self.state_manager.update_xvb_stats, **real_xvb_stats)
-                            logger.info(f"External Sync: XvB Stats Updated (1h={real_xvb_stats['avg_1h']:.0f} H/s)")
+                        await self._sync_xvb_stats()
+
+                        # 7b. XvB raffle auto-registration (#263). Rides the same throttle/egress as
+                        # the stats sync (Tor, every 10th poll, XvB-enabled only). Gated on a PPLNS
+                        # share existing — before then the endpoint is a no-op, so we just retry.
+                        await self._maybe_register_xvb(shares_list, p2pool_stats)
 
                     # 8. New-release check over Tor (#224) — ONLY when explicitly enabled (default off,
                     # so the appliance never phones GitHub unbidden). The checker self-throttles to
                     # hourly and returns the cached result; surfaced as state.update for the header badge.
                     if self.update_checker.enabled:
                         self.latest_data["update"] = await asyncio.to_thread(
-                            self.update_checker.maybe_check, time.time())
+                            self.update_checker.maybe_check, time.time()
+                        )
 
                     iteration_count += 1
                 except Exception as e:
                     logger.error(f"Data Collection Error: {e}")
-                await asyncio.sleep(UPDATE_INTERVAL)
\ No newline at end of file
+                await asyncio.sleep(UPDATE_INTERVAL)
diff --git a/build/dashboard/mining_dashboard/service/egress.py b/build/dashboard/mining_dashboard/service/egress.py
new file mode 100644
index 00000000..99581164
--- /dev/null
+++ b/build/dashboard/mining_dashboard/service/egress.py
@@ -0,0 +1,272 @@
+"""Egress posture (#170) — for each stack component, its outbound connections and their network
+route (Tor / clearnet / local / inactive), plus a privacy roll-up.
+
+Routes are *derived from the live config*, never hardcoded, so the panel can't drift from reality or
+lie after a regression — the #160 audit's lesson (``--onion-address`` *looked* like Tor but wasn't).
+
+Two backstops matter for whether a clearnet route is actually an IP leak:
+
+* The **#270 egress firewall** (``DOCKER-USER``, fail-closed) DROPs non-Tor egress from the *container*
+  subnet — so a container's clearnet route can't actually leave while it's on.
+* It does **not** cover the **host-networked dashboard** (``network_mode: host``), whose own egress
+  (XvB stats fetch, update check) bypasses ``DOCKER-USER`` entirely. Those rely solely on their
+  SOCKS config — a clearnet route there is a real leak regardless of the firewall.
+
+So a connection is a *leak* only when its route is clearnet AND it isn't neutralised by a backstop.
+"""
+
+from mining_dashboard.config import config
+
+TOR = "tor"
+CLEARNET = "clearnet"
+LOCAL = "local"
+INACTIVE = "inactive"
+
+
+def _xvb_route(xvb_enabled, xvb_tor):
+    if not xvb_enabled:
+        return INACTIVE
+    return TOR if xvb_tor else CLEARNET
+
+
+def compute_egress_posture(
+    *,
+    firewall,
+    p2pool_clearnet,
+    xvb_enabled,
+    xvb_tor,
+    monero_clearnet_sync,
+    tari_clearnet_sync,
+    remote_monero,
+):
+    """Pure derivation of the egress posture from config knobs. Returns ``{components, summary}``."""
+    xvb = _xvb_route(xvb_enabled, xvb_tor)
+
+    # ``firewalled``: is this component's egress on the container subnet the #270 firewall guards?
+    # The dashboard is host-networked, so its own outbound traffic is NOT covered.
+    components = [
+        {
+            "name": "monerod",
+            "firewalled": True,
+            "conns": [
+                {"to": "Monero P2P / tx relay", "route": TOR},
+                *(
+                    [{"to": "initial block download (clearnet sync)", "route": CLEARNET}]
+                    if monero_clearnet_sync
+                    else []
+                ),
+            ],
+        },
+        {
+            "name": "p2pool",
+            "firewalled": True,
+            "conns": [
+                {"to": "sidechain P2P peers", "route": CLEARNET if p2pool_clearnet else TOR},
+                {"to": "monerod RPC/ZMQ", "route": CLEARNET if remote_monero else LOCAL},
+            ],
+        },
+        {
+            "name": "tari",
+            "firewalled": True,
+            "conns": [
+                {"to": "Tari P2P transport", "route": TOR},
+                # dns_seeds=[] (#162); onion peer seeds resolve via Tor — no clearnet DNS.
+                {"to": "DNS resolution", "route": LOCAL},
+                *(
+                    [{"to": "initial sync (clearnet)", "route": CLEARNET}]
+                    if tari_clearnet_sync
+                    else []
+                ),
+            ],
+        },
+        {
+            "name": "xmrig-proxy",
+            "firewalled": True,
+            "conns": [
+                {"to": "upstream pool (local p2pool stratum)", "route": LOCAL},
+                # XvB donation mining dials na.xmrvsbeast.com via the proxy's per-pool socks5 (#166).
+                {"to": "XvB donation pool", "route": xvb},
+                {"to": "dev donation", "route": INACTIVE},  # --donate-level 0 (#166)
+            ],
+        },
+        {
+            "name": "dashboard",
+            "firewalled": False,  # host-networked — bypasses the #270 DOCKER-USER firewall
+            "conns": [
+                {"to": "XvB stats (xmrvsbeast.com)", "route": xvb},  # socks5h when on (#163)
+                {"to": "update check (github)", "route": TOR},  # socks5h, #224
+            ],
+        },
+        {
+            "name": "caddy",
+            "firewalled": True,
+            "conns": [{"to": "TLS (internal CA, no ACME)", "route": LOCAL}],
+        },
+    ]
+
+    leaks = 0  # clearnet egress that actually exposes the host IP
+    blocked = 0  # clearnet route a container is configured for, but the firewall DROPs it
+    for comp in components:
+        for conn in comp["conns"]:
+            if conn["route"] != CLEARNET:
+                continue
+            if comp["firewalled"] and firewall:
+                conn["blocked_by_firewall"] = True
+                blocked += 1
+            else:
+                leaks += 1
+
+    if leaks:
+        label = f"{leaks} clearnet egress path(s) exposing your IP"
+    elif blocked:
+        label = f"All egress via Tor ({blocked} clearnet path(s) blocked by the egress firewall)"
+    else:
+        label = "All egress via Tor"
+
+    return {
+        "components": components,
+        "summary": {
+            "firewall": firewall,
+            "leaks": leaks,
+            "blocked_by_firewall": blocked,
+            "all_tor": leaks == 0,
+            "level": "ok" if leaks == 0 else "warn",
+            "label": label,
+        },
+    }
+
+
+def egress_posture_from_config():
+    """Build the posture from the live dashboard config (values pithead rendered into the env)."""
+    return compute_egress_posture(
+        firewall=config.TOR_EGRESS_FIREWALL,
+        p2pool_clearnet=config.P2POOL_CLEARNET,
+        xvb_enabled=config.ENABLE_XVB,
+        xvb_tor=config.XVB_TOR_ENABLED,
+        monero_clearnet_sync=config.MONERO_CLEARNET_SYNC,
+        tari_clearnet_sync=config.TARI_CLEARNET_SYNC,
+        remote_monero=config.MONERO_NODE_HOST != config.LOCAL_MONERO_HOST,
+    )
+
+
+# --- Stack topology (#170, trust-boundary view) ----------------------------------------
+# The egress list above answers "is anything leaking?"; the topology answers "how is the whole
+# stack wired?" — every component and the route of each link (ingress, egress, internal). Same
+# config-derived routes, so the two views can never disagree (the summary is shared verbatim).
+
+# Zones, left-to-right by trust: your LAN, the host's container bridge, the Tor hub, the Internet.
+ZONE_LAN = "lan"
+ZONE_HOST = "host"
+ZONE_TOR = "tor"
+ZONE_NET = "internet"
+
+# Nodes bracket the host components with the external actors they actually talk to. ``internal``
+# nodes (the socket proxies) only appear when the operator expands the internal mesh.
+TOPOLOGY_NODES = [
+    {"id": "rigs", "label": "Mining rigs", "zone": ZONE_LAN},
+    {"id": "browser", "label": "Browser", "zone": ZONE_LAN},
+    {"id": "xmrig-proxy", "label": "xmrig-proxy", "zone": ZONE_HOST},
+    {"id": "caddy", "label": "caddy", "zone": ZONE_HOST},
+    {"id": "dashboard", "label": "dashboard", "zone": ZONE_HOST},
+    {"id": "p2pool", "label": "p2pool", "zone": ZONE_HOST},
+    {"id": "monerod", "label": "monerod", "zone": ZONE_HOST},
+    {"id": "tari", "label": "tari", "zone": ZONE_HOST},
+    {"id": "docker", "label": "docker-proxy", "zone": ZONE_HOST, "internal": True},
+    {"id": "tor", "label": "tor", "zone": ZONE_TOR},
+    {"id": "internet", "label": "Tor network", "zone": ZONE_NET},
+]
+
+
+def _edge(src, dst, route, label, kind):
+    return {"from": src, "to": dst, "route": route, "label": label, "kind": kind}
+
+
+def _ext(route):
+    # Where a component's external link lands in the diagram: a Tor-routed link terminates at the
+    # `tor` hub; a clearnet link goes STRAIGHT to the internet node, so a leak visibly bypasses Tor.
+    return "internet" if route == CLEARNET else "tor"
+
+
+def compute_topology(
+    *,
+    firewall,
+    p2pool_clearnet,
+    xvb_enabled,
+    xvb_tor,
+    monero_clearnet_sync,
+    tari_clearnet_sync,
+    remote_monero,
+):
+    """Pure derivation of the stack topology. Returns ``{nodes, edges, summary}``.
+
+    ``kind`` is one of ``ingress`` (inbound from your LAN), ``egress`` (outbound), ``p2p``
+    (bidirectional — egress *and* onion ingress for the P2P daemons), or ``internal`` (host-only
+    plumbing, hidden until expanded). The summary is shared verbatim with the egress list.
+    """
+    posture = compute_egress_posture(
+        firewall=firewall,
+        p2pool_clearnet=p2pool_clearnet,
+        xvb_enabled=xvb_enabled,
+        xvb_tor=xvb_tor,
+        monero_clearnet_sync=monero_clearnet_sync,
+        tari_clearnet_sync=tari_clearnet_sync,
+        remote_monero=remote_monero,
+    )
+    xvb = _xvb_route(xvb_enabled, xvb_tor)
+    sidechain = CLEARNET if p2pool_clearnet else TOR
+    rpc = CLEARNET if remote_monero else LOCAL
+
+    edges = [
+        # Ingress from your LAN — the only listeners actually exposed to the network.
+        _edge("rigs", "xmrig-proxy", LOCAL, "stratum :3333", "ingress"),
+        _edge("browser", "caddy", LOCAL, "https :443", "ingress"),
+        # Daemon P2P: bidirectional (outbound peers + inbound via Tor onion services).
+        _edge("p2pool", _ext(sidechain), sidechain, "sidechain P2P", "p2p"),
+        _edge("monerod", "tor", TOR, "Monero P2P + tx", "p2p"),
+        _edge("tari", "tor", TOR, "Tari P2P", "p2p"),
+        # App-level egress.
+        _edge("xmrig-proxy", _ext(xvb), xvb, "XvB donation", "egress"),
+        _edge("dashboard", "tor", TOR, "update check", "egress"),
+        _edge("dashboard", _ext(xvb), xvb, "XvB stats", "egress"),
+        # The Tor hub to the network: SOCKS egress for every daemon + onion-service ingress.
+        _edge("tor", "internet", TOR, "SOCKS + onion circuits", "p2p"),
+        # Internal mesh (hidden until expanded).
+        _edge("xmrig-proxy", "p2pool", LOCAL, "upstream pool", "internal"),
+        _edge("p2pool", "monerod", rpc, "RPC / ZMQ", "internal"),
+        _edge("p2pool", "tari", LOCAL, "gRPC merge-mine", "internal"),
+        _edge("caddy", "dashboard", LOCAL, "reverse-proxy :8000", "internal"),
+        _edge("dashboard", "monerod", LOCAL, "get_info RPC", "internal"),
+        _edge("dashboard", "xmrig-proxy", LOCAL, "proxy API", "internal"),
+        _edge("dashboard", "tari", LOCAL, "gRPC", "internal"),
+        _edge("dashboard", "docker", LOCAL, "container API", "internal"),
+    ]
+    # Optional clearnet initial-sync paths (#183) bypass the Tor hub straight to the internet.
+    if monero_clearnet_sync:
+        edges.append(_edge("monerod", "internet", CLEARNET, "clearnet IBD", "egress"))
+    if tari_clearnet_sync:
+        edges.append(_edge("tari", "internet", CLEARNET, "clearnet IBD", "egress"))
+
+    # Tag clearnet links as a real leak vs firewall-blocked — same rule as the egress list. Only the
+    # host-networked dashboard escapes the #270 container firewall, so its clearnet links truly leak.
+    for edge in edges:
+        if edge["route"] != CLEARNET:
+            continue
+        if edge["from"] != "dashboard" and firewall:
+            edge["blocked_by_firewall"] = True
+        else:
+            edge["leak"] = True
+
+    return {"nodes": TOPOLOGY_NODES, "edges": edges, "summary": posture["summary"]}
+
+
+def topology_from_config():
+    """Build the topology from the live dashboard config (values pithead rendered into the env)."""
+    return compute_topology(
+        firewall=config.TOR_EGRESS_FIREWALL,
+        p2pool_clearnet=config.P2POOL_CLEARNET,
+        xvb_enabled=config.ENABLE_XVB,
+        xvb_tor=config.XVB_TOR_ENABLED,
+        monero_clearnet_sync=config.MONERO_CLEARNET_SYNC,
+        tari_clearnet_sync=config.TARI_CLEARNET_SYNC,
+        remote_monero=config.MONERO_NODE_HOST != config.LOCAL_MONERO_HOST,
+    )
diff --git a/build/dashboard/mining_dashboard/service/metrics.py b/build/dashboard/mining_dashboard/service/metrics.py
index c293bb9c..cdf1bc26 100644
--- a/build/dashboard/mining_dashboard/service/metrics.py
+++ b/build/dashboard/mining_dashboard/service/metrics.py
@@ -10,47 +10,53 @@
 (#45) and XvB/P2Pool calculator (#12) — read the same ``Metrics`` instead of re-deriving from
 the raw dict or scraping rendered HTML. Nothing here formats or emits markup.
 """
+
 import time
 from dataclasses import dataclass
 
 from mining_dashboard.config.config import (
-    ENABLE_XVB, XVB_DONATION_LEVEL, XVB_MAX_DONATION_FRACTION,
-    MONERO_PRUNE, MONERO_NODE_HOST, LOCAL_MONERO_HOST,
+    ENABLE_XVB,
+    LOCAL_MONERO_HOST,
+    MONERO_NODE_HOST,
+    MONERO_PRUNE,
+    XVB_DONATION_LEVEL,
+    XVB_MAX_DONATION_FRACTION,
+)
+from mining_dashboard.helper.utils import (
+    DEFAULT_PPLNS_WINDOW,
+    get_tier_info,
+    pplns_block_time,
+    resolve_target_threshold,
+    shares_in_pplns_window,
+    xvb_stats_are_stale,
 )
-from mining_dashboard.helper.utils import get_tier_info, resolve_target_threshold
-
-# Nano sidechain blocks are 30s; Main/Mini are 10s. Drives the PPLNS-window duration.
-_BLOCK_TIME_NANO = 30
-_BLOCK_TIME_DEFAULT = 10
-
-# Only a local monerod's pruning state is knowable to us; a remote node isn't probed. The local
-# bridge IP tracks the configurable subnet prefix (#180).
-_LOCAL_MONERO_HOST = LOCAL_MONERO_HOST
 
 
 @dataclass(frozen=True)
 class SyncMetric:
     """One chain's sync/health state (Issues #31, #51)."""
+
     percent: int
     current: int
     target: int
     remaining: int
-    has_target: bool   # a real target height is known (vs. still discovering it)
-    done: bool         # fully synced
-    down: bool         # debounced unreachable (node-health monitor)
+    has_target: bool  # a real target height is known (vs. still discovering it)
+    done: bool  # fully synced
+    down: bool  # debounced unreachable (node-health monitor)
 
 
 @dataclass(frozen=True)
 class Metrics:
     """Computed dashboard domain values. All hashrates are raw H/s; no display formatting."""
+
     # Effective hashrate (H/s).
     total_h15: float
     p2pool_1h: float
     p2pool_24h: float
-    xvb_1h: float              # credited (XvB API avg_1h) — controller input + Advanced card only
-    xvb_24h: float             # credited (XvB API avg_24h)
-    xvb_routed_1h: float       # routed (proxy v_xvb, time-weighted 1h) — header / Simple / chart (#156)
-    xvb_routed_24h: float      # routed (proxy v_xvb, time-weighted 24h)
+    xvb_1h: float  # credited (XvB API avg_1h) — controller input + Advanced card only
+    xvb_24h: float  # credited (XvB API avg_24h)
+    xvb_routed_1h: float  # routed (proxy v_xvb, time-weighted 1h) — header / Simple / chart (#156)
+    xvb_routed_24h: float  # routed (proxy v_xvb, time-weighted 24h)
     stratum_h15: float
     stratum_h1h: float
     stratum_h24h: float
@@ -61,16 +67,16 @@ class Metrics:
     target_tier: str
     target_threshold: float
     target_sustainable: bool
-    low_hr_warning: bool       # an explicit tier was chosen that the hashrate can't sustain
+    low_hr_warning: bool  # an explicit tier was chosen that the hashrate can't sustain
     xvb_fail_count: int
-    xvb_last_update: float     # epoch seconds of the last XvB stats fetch
+    xvb_last_update: float  # epoch seconds of the last XvB stats fetch
     # Workers.
     workers_online: int
     workers_total: int
     # Shares / PPLNS.
     shares_in_window: int
-    pplns_window: int          # blocks
-    block_time: int            # seconds per sidechain block
+    pplns_window: int  # blocks
+    block_time: int  # seconds per sidechain block
     # Pool / network (raw figures; e.g. payout-calculator inputs, #12).
     pool_type: str
     pool_hashrate: float
@@ -81,8 +87,14 @@ class Metrics:
     global_syncing: bool
     monero: SyncMetric
     tari: SyncMetric
-    monero_mode: str           # "Pruned" / "Full" / "Unknown"
-    tari_mining: bool          # Tari merge-mining active
+    monero_mode: str  # "Pruned" / "Full" / "Unknown"
+    tari_mining: bool  # Tari merge-mining active
+    # XvB raffle registration (#263). Defaulted so direct Metrics(...) constructors needn't set them.
+    xvb_registered_at: float = 0.0  # epoch secs of last successful registration; 0.0 = never
+    xvb_registration_state: str = ""  # ""|registered|invalid|failing — drives the badge
+    # True when the xmrvsbeast.com fetch has gone quiet (#311) — credited 1h/24h are frozen,
+    # so the UI greys them and the controller holds its split. Same predicate as the controller.
+    xvb_stale: bool = False
 
 
 def build_metrics(latest_data, state_mgr, history=None):
@@ -98,15 +110,15 @@ def build_metrics(latest_data, state_mgr, history=None):
     xvb_stats = state_mgr.get_xvb_stats() or {}
     tiers = state_mgr.get_tiers()
 
-    mode = xvb_stats.get('current_mode', 'P2POOL')
+    mode = xvb_stats.get("current_mode", "P2POOL")
     if not ENABLE_XVB:
         mode = "P2POOL (XvB Disabled)"
 
-    total_h15 = data.get('total_live_h15', 0) or 0
+    total_h15 = data.get("total_live_h15", 0) or 0
     # Credited — XvB's own verdict (avg_1h/24h). The controller steers off this (#9/#70) and the
     # Advanced card shows it next to routed so the credit factor is visible; nowhere else (#156).
-    xvb_1h = xvb_stats.get('avg_1h', 0) or 0
-    xvb_24h = xvb_stats.get('avg_24h', 0) or 0
+    xvb_1h = xvb_stats.get("avg_1h", 0) or 0
+    xvb_24h = xvb_stats.get("avg_24h", 0) or 0
     # Routed — what the proxy ACTUALLY sent to XvB, time-weighted from our own DB history (v_xvb),
     # mirroring P2Pool's v_p2pool averaging so the two sum to total. This is the at-a-glance display
     # figure (header / Simple / chart), NOT the controller's intended donation_fraction (#156).
@@ -129,28 +141,29 @@ def build_metrics(latest_data, state_mgr, history=None):
     )
     target_tier, _ = get_tier_info(target_threshold, tiers)
     low_hr_warning = bool(
-        ENABLE_XVB and XVB_DONATION_LEVEL not in ("auto", "highest")
-        and target_threshold > 0 and not sustainable
+        ENABLE_XVB
+        and XVB_DONATION_LEVEL not in ("auto", "highest")
+        and target_threshold > 0
+        and not sustainable
     )
     if not ENABLE_XVB:
         current_tier = "Disabled"
         target_tier = "Disabled"
         low_hr_warning = False
 
-    stratum = data.get('stratum', {})
-    pool_stats = data.get('pool', {})
-    p2p = pool_stats.get('p2p', {})
-    local_pool = pool_stats.get('pool', {})
-    network = data.get('network', {})
+    stratum = data.get("stratum", {})
+    pool_stats = data.get("pool", {})
+    p2p = pool_stats.get("p2p", {})
+    local_pool = pool_stats.get("pool", {})
+    network = data.get("network", {})
 
-    pool_type = p2p.get('type', 'Main')
-    block_time = _BLOCK_TIME_NANO if pool_type == 'Nano' else _BLOCK_TIME_DEFAULT
-    pplns_window = local_pool.get('pplns_window', 2160)
-    cutoff = time.time() - pplns_window * block_time
-    shares_in_window = sum(1 for s in data.get('shares', []) if s.get('ts', 0) >= cutoff)
+    pool_type = p2p.get("type", "Main")
+    block_time = pplns_block_time(pool_type)
+    pplns_window = local_pool.get("pplns_window", DEFAULT_PPLNS_WINDOW)
+    shares_in_window = shares_in_pplns_window(data.get("shares", []), pplns_window, block_time)
 
-    workers = data.get('workers', [])
-    workers_online = sum(1 for w in workers if w.get('status') == 'online')
+    workers = data.get("workers", [])
+    workers_online = sum(1 for w in workers if w.get("status") == "online")
 
     return Metrics(
         total_h15=total_h15,
@@ -160,9 +173,9 @@ def build_metrics(latest_data, state_mgr, history=None):
         xvb_24h=xvb_24h,
         xvb_routed_1h=xvb_routed_1h,
         xvb_routed_24h=xvb_routed_24h,
-        stratum_h15=stratum.get('hashrate_15m', 0) or 0,
-        stratum_h1h=stratum.get('hashrate_1h', 0) or 0,
-        stratum_h24h=stratum.get('hashrate_24h', 0) or 0,
+        stratum_h15=stratum.get("hashrate_15m", 0) or 0,
+        stratum_h1h=stratum.get("hashrate_1h", 0) or 0,
+        stratum_h24h=stratum.get("hashrate_24h", 0) or 0,
         mode=mode,
         xvb_enabled=bool(ENABLE_XVB),
         current_tier=current_tier,
@@ -170,23 +183,26 @@ def build_metrics(latest_data, state_mgr, history=None):
         target_threshold=target_threshold,
         target_sustainable=sustainable,
         low_hr_warning=low_hr_warning,
-        xvb_fail_count=xvb_stats.get('fail_count', 0) or 0,
-        xvb_last_update=xvb_stats.get('last_update', 0) or 0,
+        xvb_fail_count=xvb_stats.get("fail_count", 0) or 0,
+        xvb_last_update=xvb_stats.get("last_update", 0) or 0,
         workers_online=workers_online,
         workers_total=len(workers),
         shares_in_window=shares_in_window,
         pplns_window=pplns_window,
         block_time=block_time,
         pool_type=pool_type,
-        pool_hashrate=local_pool.get('hashrate', 0) or 0,
-        pool_difficulty=local_pool.get('difficulty', 0) or 0,
-        network_difficulty=network.get('difficulty', 0) or 0,
-        network_height=network.get('height', 0) or 0,
-        global_syncing=bool(data.get('global_sync', False)),
-        monero=_sync_metric(data.get('monero_sync', {})),
-        tari=_sync_metric(data.get('tari_sync', {})),
+        pool_hashrate=local_pool.get("hashrate", 0) or 0,
+        pool_difficulty=local_pool.get("difficulty", 0) or 0,
+        network_difficulty=network.get("difficulty", 0) or 0,
+        network_height=network.get("height", 0) or 0,
+        global_syncing=bool(data.get("global_sync", False)),
+        monero=_sync_metric(data.get("monero_sync", {})),
+        tari=_sync_metric(data.get("tari_sync", {})),
         monero_mode=_monero_mode(),
-        tari_mining=bool(data.get('tari', {}).get('active', False)),
+        tari_mining=bool(data.get("tari", {}).get("active", False)),
+        xvb_registered_at=xvb_stats.get("registered_at", 0) or 0,
+        xvb_registration_state=xvb_stats.get("registration_state", "") or "",
+        xvb_stale=bool(ENABLE_XVB and xvb_stats_are_stale(xvb_stats)),
     )
 
 
@@ -205,11 +221,11 @@ def _avg_p2pool_over_window(history, window_seconds):
     total = 0.0
     count = 0
     for x in history:
-        if x.get('timestamp', 0) < cutoff:
+        if x.get("timestamp", 0) < cutoff:
             continue
-        vp = x.get('v_p2pool', 0) or 0
-        vx = x.get('v_xvb', 0) or 0
-        v = x.get('v', 0) or 0
+        vp = x.get("v_p2pool", 0) or 0
+        vx = x.get("v_xvb", 0) or 0
+        v = x.get("v", 0) or 0
         if vp == 0 and vx == 0 and v > 0:
             vp = v
         total += vp
@@ -233,9 +249,9 @@ def _avg_xvb_over_window(history, window_seconds):
     total = 0.0
     count = 0
     for x in history:
-        if x.get('timestamp', 0) < cutoff:
+        if x.get("timestamp", 0) < cutoff:
             continue
-        total += x.get('v_xvb', 0) or 0
+        total += x.get("v_xvb", 0) or 0
         count += 1
 
     return total / count if count else 0.0
@@ -243,9 +259,9 @@ def _avg_xvb_over_window(history, window_seconds):
 
 def _sync_metric(sync):
     """Build a :class:`SyncMetric` from a chain's raw ``*_sync`` dict."""
-    percent = sync.get('percent', 0) or 0
-    current = sync.get('current', 0) or 0
-    target = sync.get('target', 0) or 0
+    percent = sync.get("percent", 0) or 0
+    current = sync.get("current", 0) or 0
+    target = sync.get("target", 0) or 0
     has_target = target > 0
     return SyncMetric(
         percent=percent,
@@ -255,16 +271,20 @@ def _sync_metric(sync):
         has_target=has_target,
         # "done" = the chain reports itself caught up. A synced monerod returns target_height: 0, so
         # the percent>=100 path never fires for it — which left a fully-synced node stuck at "loading"
-        # (found in the #180 gouda validation). Trust the authoritative reachable + not-is_syncing
+        # (found in the #180 live validation). Trust the authoritative reachable + not-is_syncing
         # signal too; Tari already reports current==target/percent=100, so it's unaffected.
-        done=(sync.get('reachable', False) and not sync.get('is_syncing', True)) or (has_target and percent >= 100),
-        down=bool(sync.get('down', False)),
+        done=(sync.get("reachable", False) and not sync.get("is_syncing", True))
+        or (has_target and percent >= 100),
+        down=bool(sync.get("down", False)),
     )
 
 
 def _monero_mode():
     """Monero node pruning mode (Issue #32). Only meaningful for a local node — a remote
-    node's pruning state isn't something we probe, so it reads 'Unknown'."""
-    if MONERO_NODE_HOST == _LOCAL_MONERO_HOST:
+    node's pruning state isn't something we probe, so it reads 'Unknown'.
+
+    Only a local monerod's pruning state is knowable; the local bridge IP tracks the
+    configurable subnet prefix (#180)."""
+    if MONERO_NODE_HOST == LOCAL_MONERO_HOST:
         return "Pruned" if MONERO_PRUNE else "Full"
     return "Unknown"
diff --git a/build/dashboard/mining_dashboard/service/node_health.py b/build/dashboard/mining_dashboard/service/node_health.py
index 8027e3ad..c658f10a 100644
--- a/build/dashboard/mining_dashboard/service/node_health.py
+++ b/build/dashboard/mining_dashboard/service/node_health.py
@@ -29,8 +29,12 @@ class NodeHealthMonitor:
     Clock is injectable for tests; defaults to `time.monotonic`.
     """
 
-    def __init__(self, down_after=NODE_DOWN_AFTER_SEC, recovery_after=NODE_RECOVERY_AFTER_SEC,
-                 clock=time.monotonic):
+    def __init__(
+        self,
+        down_after=NODE_DOWN_AFTER_SEC,
+        recovery_after=NODE_RECOVERY_AFTER_SEC,
+        clock=time.monotonic,
+    ):
         self.down_after = down_after
         self.recovery_after = recovery_after
         self._clock = clock
@@ -60,7 +64,11 @@ def update(self, reachable):
             if self._unreachable_since is None:
                 self._unreachable_since = now
             # Only a node that has actually been up can fall DOWN.
-            if self.ever_up and not self.down and (now - self._unreachable_since) >= self.down_after:
+            if (
+                self.ever_up
+                and not self.down
+                and (now - self._unreachable_since) >= self.down_after
+            ):
                 self.down = True
 
         return self.down
diff --git a/build/dashboard/mining_dashboard/service/storage_service.py b/build/dashboard/mining_dashboard/service/storage_service.py
index 1f0209a3..c5e65995 100644
--- a/build/dashboard/mining_dashboard/service/storage_service.py
+++ b/build/dashboard/mining_dashboard/service/storage_service.py
@@ -1,15 +1,17 @@
+import json
+import logging
+import random
 import sqlite3
 import threading
-import logging
-import json
-import os
 import time
-import random
 from collections import deque
-from typing import Dict, List, Optional, Any
+from typing import Any
+
 from mining_dashboard.config.config import (
-    DB_FILE_PATH, TIER_DEFAULTS, HISTORY_RETENTION_SEC, WORKER_RETENTION_SEC,
+    DB_FILE_PATH,
     HASHRATE_WINDOW_COLUMNS,
+    HISTORY_RETENTION_SEC,
+    TIER_DEFAULTS,
 )
 
 # The 10m window reuses the original v_p2pool/v_xvb pair; every other window in
@@ -27,10 +29,11 @@
 class StateManager:
     """
     Manages persistent application state including hashrate history and mining mode statistics.
-    
+
     Handles atomic file I/O to prevent data corruption and ensures state consistency
     across application restarts.
     """
+
     def __init__(self, db_path: str = None):
         self.logger = logging.getLogger("StateManager")
         # Default to the configured path; tests inject a temp file or ":memory:".
@@ -40,7 +43,6 @@ def __init__(self, db_path: str = None):
         self.state = {
             "hashrate_history": deque(),
             "shares": [],
-            "known_workers": {}, # Persist worker IPs by name to prevent loss during XvB switching
             "xvb": {
                 "total_donated_time": 0.0,
                 "current_mode": "P2POOL",
@@ -48,16 +50,22 @@ def __init__(self, db_path: str = None):
                 "avg_1h": 0.0,
                 "fail_count": 0,
                 "last_update": 0.0,
+                # Unix ts of the last successful XvB raffle registration (#263); 0.0 until the
+                # wallet is first auto-registered. Lets the UI show "Registered with XvB ✓".
+                "registered_at": 0.0,
+                # Registration status for the dashboard badge (#263): "" (pending), "registered",
+                # "invalid" (endpoint rejected the wallet), or "failing" (endpoint erroring).
+                "registration_state": "",
                 # Fraction of the current cycle routed to XvB, written by the
                 # controller each cycle. Lets the dashboard show what we *send*
                 # (routed) next to what XvB *credits* (avg_1h/24h) — the live
                 # credit-factor signal (Issue #70).
-                "donation_fraction": 0.0
+                "donation_fraction": 0.0,
             },
             # Initialize state with default values from configuration
-            "tiers": TIER_DEFAULTS.copy()
+            "tiers": TIER_DEFAULTS.copy(),
         }
-        
+
         # Initialize persistent DB connection
         # check_same_thread=False allows the connection to be used by multiple threads
         # (serialized via self._db_lock)
@@ -78,7 +86,7 @@ def _init_db(self):
                 # Enable WAL mode for better concurrency
                 self._conn.execute("PRAGMA journal_mode=WAL")
                 self._conn.execute("PRAGMA synchronous=NORMAL")
-                
+
                 with self._conn:
                     self._create_tables()
                     self._migrate_db()
@@ -104,10 +112,13 @@ def _create_tables(self):
         # Per-window hashrate columns (#168) are appended so a fresh DB starts with them; existing
         # DBs get them via _migrate_db. Same source list (_WINDOW_EXTRA_COLUMNS) for both paths.
         extra = "".join(f", {c} REAL DEFAULT 0" for c in _WINDOW_EXTRA_COLUMNS)
-        self._conn.execute(f"CREATE TABLE IF NOT EXISTS history (t TEXT, v REAL, v_p2pool REAL, v_xvb REAL, timestamp REAL{extra})")
-        self._conn.execute("CREATE TABLE IF NOT EXISTS workers (name TEXT PRIMARY KEY, ip TEXT, last_seen REAL)")
+        self._conn.execute(
+            f"CREATE TABLE IF NOT EXISTS history (t TEXT, v REAL, v_p2pool REAL, v_xvb REAL, timestamp REAL{extra})"
+        )
         self._conn.execute("CREATE TABLE IF NOT EXISTS kv_store (key TEXT PRIMARY KEY, value TEXT)")
-        self._conn.execute("CREATE TABLE IF NOT EXISTS shares (ts REAL PRIMARY KEY, difficulty REAL)")
+        self._conn.execute(
+            "CREATE TABLE IF NOT EXISTS shares (ts REAL PRIMARY KEY, difficulty REAL)"
+        )
 
     def _create_indexes(self):
         """Creates indexes. Called after migrations so the indexed columns are guaranteed to
@@ -118,23 +129,25 @@ def _create_indexes(self):
     def _migrate_db(self):
         """Handles schema migrations for existing databases."""
         cursor = self._conn.cursor()
-        
+
         # History Table Migrations
         cursor.execute("PRAGMA table_info(history)")
         columns = {info[1] for info in cursor.fetchall()}
-        
-        if 'v_p2pool' not in columns:
+
+        if "v_p2pool" not in columns:
             self.logger.info("Migrating DB: Adding v_p2pool column to history")
             self._conn.execute("ALTER TABLE history ADD COLUMN v_p2pool REAL DEFAULT 0")
 
-        if 'v_xvb' not in columns:
+        if "v_xvb" not in columns:
             self.logger.info("Migrating DB: Adding v_xvb column to history")
             self._conn.execute("ALTER TABLE history ADD COLUMN v_xvb REAL DEFAULT 0")
 
-        if 'timestamp' not in columns:
+        if "timestamp" not in columns:
             self.logger.info("Migrating DB: Adding timestamp column to history")
             self._conn.execute("ALTER TABLE history ADD COLUMN timestamp REAL")
-            self._conn.execute("UPDATE history SET timestamp = CAST(strftime('%s', t) AS REAL) WHERE timestamp IS NULL")
+            self._conn.execute(
+                "UPDATE history SET timestamp = CAST(strftime('%s', t) AS REAL) WHERE timestamp IS NULL"
+            )
             self._conn.execute("UPDATE history SET timestamp = 0 WHERE timestamp IS NULL")
 
         # Per-window hashrate columns (#168) — additive, forward-only. Pre-existing rows keep DEFAULT
@@ -144,13 +157,10 @@ def _migrate_db(self):
                 self.logger.info(f"Migrating DB: Adding {col} column to history")
                 self._conn.execute(f"ALTER TABLE history ADD COLUMN {col} REAL DEFAULT 0")
 
-        # Workers Table Migrations
-        cursor.execute("PRAGMA table_info(workers)")
-        w_columns = {info[1] for info in cursor.fetchall()}
-        if 'last_seen' not in w_columns:
-            self.logger.info("Migrating DB: Adding last_seen column to workers")
-            self._conn.execute("ALTER TABLE workers ADD COLUMN last_seen REAL")
-            self._conn.execute("UPDATE workers SET last_seen = ?", (time.time(),))
+        # Drop the orphaned `workers` table (#144). It backed the known_workers persistence layer,
+        # which was dead code — the worker list is sourced live from the xmrig-proxy. Tidies old
+        # DBs; harmless no-op on fresh ones.
+        self._conn.execute("DROP TABLE IF EXISTS workers")
 
     def load(self):
         """
@@ -158,15 +168,22 @@ def load(self):
         """
         try:
             with self._db_lock:
-                if not self._conn: return
+                if not self._conn:
+                    return
                 cursor = self._conn.cursor()
-                
+
                 with self._lock:
                     # 1. Load History
                     # Limit to retention period to prevent memory bloat
                     history_cutoff = time.time() - HISTORY_RETENTION_SEC
-                    hist_cols = ", ".join(["t", "v", "v_p2pool", "v_xvb", "timestamp"] + _WINDOW_EXTRA_COLUMNS)
-                    cursor.execute(f"SELECT {hist_cols} FROM history WHERE timestamp > ? ORDER BY timestamp ASC", (history_cutoff,))
+                    hist_cols = ", ".join(
+                        ["t", "v", "v_p2pool", "v_xvb", "timestamp"] + _WINDOW_EXTRA_COLUMNS
+                    )
+                    cursor.execute(
+                        # Column list is literals + a module constant, never user input; value is ?-bound.
+                        f"SELECT {hist_cols} FROM history WHERE timestamp > ? ORDER BY timestamp ASC",  # noqa: S608
+                        (history_cutoff,),
+                    )
                     history = []
                     for row in cursor.fetchall():
                         item = dict(row)
@@ -179,29 +196,19 @@ def load(self):
                         history.append(item)
                     self.state["hashrate_history"] = deque(history)
 
-                    # 2. Load Workers
-                    # Only load workers seen recently
-                    worker_cutoff = time.time() - WORKER_RETENTION_SEC
-                    cursor.execute("SELECT name, ip, last_seen FROM workers WHERE last_seen > ? OR last_seen IS NULL", (worker_cutoff,))
-                    self.state["known_workers"] = {}
-                    for row in cursor.fetchall():
-                        self.state["known_workers"][row["name"]] = {
-                            "ip": row["ip"],
-                            "last_seen": row["last_seen"] if row["last_seen"] is not None else time.time()
-                        }
-
-                    # 3. Load XVB Stats (KV Store)
+                    # 2. Load XVB Stats (KV Store)
                     cursor.execute("SELECT key, value FROM kv_store WHERE key LIKE 'xvb_%'")
                     for row in cursor.fetchall():
-                        key = row["key"]
-                        if key.startswith("xvb_"):
-                            key = key[4:]
-                        
+                        # The query filters to 'xvb_%', so every key carries the prefix; strip it.
+                        key = row["key"][4:]
+
                         val = row["value"]
-                        
+
                         # Migration: Handle legacy keys from previous versions
-                        if key == "1h_avg": key = "avg_1h"
-                        if key == "24h_avg": key = "avg_24h"
+                        if key == "1h_avg":
+                            key = "avg_1h"
+                        if key == "24h_avg":
+                            key = "avg_24h"
 
                         # Enforce schema: Ignore keys not present in the default state
                         if key not in self.state["xvb"]:
@@ -220,15 +227,20 @@ def load(self):
                         except (ValueError, TypeError):
                             self.logger.warning(f"Skipping corrupted KV pair: {key}={val}")
 
-                    # 4. Load Shares
-                    cursor.execute("SELECT ts, difficulty FROM shares WHERE ts > ? ORDER BY ts ASC", (history_cutoff,))
+                    # 3. Load Shares
+                    cursor.execute(
+                        "SELECT ts, difficulty FROM shares WHERE ts > ? ORDER BY ts ASC",
+                        (history_cutoff,),
+                    )
                     self.state["shares"] = [dict(row) for row in cursor.fetchall()]
-                    
+
                 self.logger.info(f"State successfully loaded from {self.db_path}")
         except sqlite3.Error as e:
             self.logger.error(f"DB Load Error: {e}")
 
-    def update_history(self, hashrate: float, p2pool_hr: float = 0, xvb_hr: float = 0, windows=None):
+    def update_history(
+        self, hashrate: float, p2pool_hr: float = 0, xvb_hr: float = 0, windows=None
+    ):
         """Appends a new hashrate data point to the history buffer.
 
         ``windows`` (Issue #168) is an optional ``{window: (p2pool_hr, xvb_hr)}`` mapping of the
@@ -236,7 +248,7 @@ def update_history(self, hashrate: float, p2pool_hr: float = 0, xvb_hr: float =
         ``p2pool_hr``/``xvb_hr`` pair above). Each is stored in its own column so the chart's window
         toggle can plot a true average per window; an omitted/unknown window defaults to 0.
         """
-        t_str = time.strftime('%Y-%m-%d %H:%M:%S')
+        t_str = time.strftime("%Y-%m-%d %H:%M:%S")
         ts = time.time()
 
         try:
@@ -264,18 +276,23 @@ def update_history(self, hashrate: float, p2pool_hr: float = 0, xvb_hr: float =
 
         with self._lock:
             # 1. Update In-Memory State
-            self.state["hashrate_history"].append({
-                "t": t_str,
-                "v": v_val,
-                "v_p2pool": v_p2p,
-                "v_xvb": v_xvb,
-                "timestamp": ts,
-                **extra,
-            })
+            self.state["hashrate_history"].append(
+                {
+                    "t": t_str,
+                    "v": v_val,
+                    "v_p2pool": v_p2p,
+                    "v_xvb": v_xvb,
+                    "timestamp": ts,
+                    **extra,
+                }
+            )
 
             # Prune in-memory history to enforce retention policy
             cutoff = ts - HISTORY_RETENTION_SEC
-            while self.state["hashrate_history"] and self.state["hashrate_history"][0]["timestamp"] < cutoff:
+            while (
+                self.state["hashrate_history"]
+                and self.state["hashrate_history"][0]["timestamp"] < cutoff
+            ):
                 self.state["hashrate_history"].popleft()
 
         # 2. Persist to DB
@@ -286,14 +303,19 @@ def update_history(self, hashrate: float, p2pool_hr: float = 0, xvb_hr: float =
                 with self._conn:
                     cols = ["t", "v", "v_p2pool", "v_xvb", "timestamp"] + _WINDOW_EXTRA_COLUMNS
                     placeholders = ", ".join("?" * len(cols))
-                    values = (t_str, v_val, v_p2p, v_xvb, ts) + tuple(extra[c] for c in _WINDOW_EXTRA_COLUMNS)
+                    values = (t_str, v_val, v_p2p, v_xvb, ts) + tuple(
+                        extra[c] for c in _WINDOW_EXTRA_COLUMNS
+                    )
                     self._conn.execute(
-                        f"INSERT INTO history ({', '.join(cols)}) VALUES ({placeholders})",
-                        values
+                        # Column/placeholder lists are literals + a module constant, not user input.
+                        f"INSERT INTO history ({', '.join(cols)}) VALUES ({placeholders})",  # noqa: S608
+                        values,
                     )
                     # Prune old history from DB to prevent unbounded growth (Probabilistic pruning to save I/O)
-                    if random.random() < 0.05:
-                        self._conn.execute("DELETE FROM history WHERE timestamp < ?", (ts - HISTORY_RETENTION_SEC,))
+                    if random.random() < 0.05:  # noqa: S311 — pruning sampler, not a security context
+                        self._conn.execute(
+                            "DELETE FROM history WHERE timestamp < ?", (ts - HISTORY_RETENTION_SEC,)
+                        )
         except sqlite3.Error as e:
             self._db_error("History Update Error", e)
 
@@ -301,9 +323,9 @@ def add_share(self, ts: float, difficulty: float):
         """Appends a new share to history and persists it to the DB."""
         with self._lock:
             # Check if share already exists to prevent duplicate in-memory appends
-            if not any(s['ts'] == ts for s in self.state.get("shares", [])):
+            if not any(s["ts"] == ts for s in self.state.get("shares", [])):
                 self.state["shares"].append({"ts": ts, "difficulty": difficulty})
-            
+
             # Prune in-memory state based on the 30-day config
             cutoff = time.time() - HISTORY_RETENTION_SEC
             self.state["shares"] = [s for s in self.state["shares"] if s["ts"] >= cutoff]
@@ -311,12 +333,19 @@ def add_share(self, ts: float, difficulty: float):
         # Persist to DB
         try:
             with self._db_lock:
-                if not self._conn: return
+                if not self._conn:
+                    return
                 with self._conn:
-                    self._conn.execute("INSERT OR IGNORE INTO shares (ts, difficulty) VALUES (?, ?)", (ts, difficulty))
-                    
-                    if random.random() < 0.05:
-                        self._conn.execute("DELETE FROM shares WHERE ts < ?", (time.time() - HISTORY_RETENTION_SEC,))
+                    self._conn.execute(
+                        "INSERT OR IGNORE INTO shares (ts, difficulty) VALUES (?, ?)",
+                        (ts, difficulty),
+                    )
+
+                    if random.random() < 0.05:  # noqa: S311 — pruning sampler, not a security context
+                        self._conn.execute(
+                            "DELETE FROM shares WHERE ts < ?",
+                            (time.time() - HISTORY_RETENTION_SEC,),
+                        )
         except sqlite3.Error as e:
             self._db_error("Share Insert Error", e)
 
@@ -332,22 +361,29 @@ def add_shares(self, count: int, latest_ts: float, difficulty: float):
             # Distinct timestamps ending at latest_ts (1 ms steps back) so the ts PRIMARY KEY keeps all.
             self.add_share(round(latest_ts - 0.001 * (count - 1 - i), 3), difficulty)
 
-    def get_shares(self) -> List[Dict[str, Any]]:
+    def get_shares(self) -> list[dict[str, Any]]:
         """Returns a copy of the shares history."""
         with self._lock:
             return list(self.state.get("shares", []))
 
-    def get_xvb_stats(self) -> Dict[str, Any]:
+    def get_xvb_stats(self) -> dict[str, Any]:
         """Returns the current XvB mining statistics dictionary."""
         with self._lock:
             return self.state["xvb"].copy()
 
-    def update_xvb_stats(self, mode: Optional[str] = None, avg_24h: Optional[float] = None, avg_1h: Optional[float] = None, fail_count: Optional[int] = None, **kwargs):
+    def update_xvb_stats(
+        self,
+        mode: str | None = None,
+        avg_24h: float | None = None,
+        avg_1h: float | None = None,
+        fail_count: int | None = None,
+        **kwargs,
+    ):
         """
         Updates specific fields within the XvB statistics state.
-        
+
         Allows partial updates to decouple mode switching from statistical updates.
-        
+
         Args:
             mode (str, optional): The current mining mode (e.g., "P2POOL", "XVB").
             avg_24h (float, optional): 24-hour average hashrate on XvB.
@@ -407,7 +443,7 @@ def update_xvb_stats(self, mode: Optional[str] = None, avg_24h: Optional[float]
                 ts = time.time()
                 self.state["xvb"]["last_update"] = ts
                 updates["xvb_last_update"] = ts
-            
+
         # Persist to DB
         if updates:
             try:
@@ -415,53 +451,14 @@ def update_xvb_stats(self, mode: Optional[str] = None, avg_24h: Optional[float]
                     if not self._conn:
                         return
                     with self._conn:
-                        self._conn.executemany("INSERT OR REPLACE INTO kv_store (key, value) VALUES (?, ?)", 
-                                         [(k, str(v)) for k, v in updates.items()])
+                        self._conn.executemany(
+                            "INSERT OR REPLACE INTO kv_store (key, value) VALUES (?, ?)",
+                            [(k, str(v)) for k, v in updates.items()],
+                        )
             except sqlite3.Error as e:
                 self._db_error("XVB Update Error", e)
 
-    def update_known_workers(self, workers_list: List[Dict[str, str]]):
-        """
-        Updates the list of known workers.
-        
-        Args:
-            workers_list (list): List of dicts [{'name': '...', 'ip': '...'}, ...]
-        """
-        if workers_list is None:
-            workers_list = []
-        ts = time.time()
-        to_upsert = []
-        
-        with self._lock:
-            for w in workers_list:
-                name = w.get('name')
-                ip = w.get('ip')
-                if name and ip:
-                    # Update memory
-                    self.state["known_workers"][name] = {"ip": ip, "last_seen": ts}
-                    
-                    # Always update DB timestamp for active workers
-                    to_upsert.append((name, ip, ts))
-            
-            # Prune old workers from memory
-            cutoff = ts - WORKER_RETENTION_SEC
-            to_remove = [k for k, v in self.state["known_workers"].items() if v["last_seen"] < cutoff]
-            for k in to_remove:
-                del self.state["known_workers"][k]
-        
-        if to_upsert:
-            try:
-                with self._db_lock:
-                    if not self._conn:
-                        return
-                    with self._conn:
-                        self._conn.executemany("INSERT OR REPLACE INTO workers (name, ip, last_seen) VALUES (?, ?, ?)", to_upsert)
-                        # Prune old workers from DB
-                        self._conn.execute("DELETE FROM workers WHERE last_seen < ?", (ts - WORKER_RETENTION_SEC,))
-            except sqlite3.Error as e:
-                self._db_error("Worker Update Error", e)
-
-    def save_snapshot(self, data: Dict[str, Any]):
+    def save_snapshot(self, data: dict[str, Any]):
         """Persists the full application state snapshot to the KV store."""
         if not data:
             return
@@ -471,14 +468,19 @@ def save_snapshot(self, data: Dict[str, Any]):
                 if not self._conn:
                     return
                 with self._conn:
-                    self._conn.execute("INSERT OR REPLACE INTO kv_store (key, value) VALUES (?, ?)", 
-                                     ("snapshot_latest_data", json_str))
+                    self._conn.execute(
+                        "INSERT OR REPLACE INTO kv_store (key, value) VALUES (?, ?)",
+                        ("snapshot_latest_data", json_str),
+                    )
         except sqlite3.Error as e:
             self._db_error("Snapshot Save Error", e)
         except TypeError as e:
-            self.logger.error(f"Snapshot serialization error: {e}")
+            # A non-serializable snapshot is a persistent write failure (data lost on restart),
+            # so flag persistence unhealthy like every other write path — otherwise the #131
+            # badge stays green while snapshots silently never persist.
+            self._db_error("Snapshot Serialization Error", e)
 
-    def load_snapshot(self) -> Optional[Dict[str, Any]]:
+    def load_snapshot(self) -> dict[str, Any] | None:
         """Loads the last persisted application state snapshot."""
         try:
             with self._db_lock:
@@ -493,17 +495,12 @@ def load_snapshot(self) -> Optional[Dict[str, Any]]:
             self.logger.error(f"Snapshot Load Error: {e}")
         return None
 
-    def get_known_workers(self) -> List[Dict[str, str]]:
-        """Returns a list of worker dicts for the collector."""
-        with self._lock:
-            return [{"name": k, "ip": v["ip"]} for k, v in self.state["known_workers"].items()]
-
-    def get_history(self) -> List[Dict[str, Any]]:
+    def get_history(self) -> list[dict[str, Any]]:
         """Returns a copy of the hashrate history."""
         with self._lock:
             return list(self.state["hashrate_history"])
 
-    def get_tiers(self) -> Dict[str, Any]:
+    def get_tiers(self) -> dict[str, Any]:
         """Returns a copy of the donation tiers configuration."""
         with self._lock:
             return self.state["tiers"].copy()
@@ -518,4 +515,4 @@ def close(self):
                 except sqlite3.Error as e:
                     self.logger.error(f"Error closing database: {e}")
                 finally:
-                    self._conn = None
\ No newline at end of file
+                    self._conn = None
diff --git a/build/dashboard/mining_dashboard/service/update_checker.py b/build/dashboard/mining_dashboard/service/update_checker.py
index 61b95e24..111a342b 100644
--- a/build/dashboard/mining_dashboard/service/update_checker.py
+++ b/build/dashboard/mining_dashboard/service/update_checker.py
@@ -9,6 +9,7 @@
 `XVB_TOR_PROXY`, like the XvB stats fetch #163), so enabling it doesn't reveal the host IP to GitHub.
 Every failure path is silent (returns ``None``) so an offline / Tor-only stack just shows no badge.
 """
+
 import logging
 
 import requests
@@ -53,8 +54,13 @@ def latest_release(self):
         proxies = {"http": self.tor_proxy, "https": self.tor_proxy} if self.tor_proxy else None
         try:
             resp = requests.get(
-                self.api_url, timeout=20, proxies=proxies,
-                headers={"Accept": "application/vnd.github+json", "User-Agent": "pithead-dashboard"},
+                self.api_url,
+                timeout=20,
+                proxies=proxies,
+                headers={
+                    "Accept": "application/vnd.github+json",
+                    "User-Agent": "pithead-dashboard",
+                },
             )
             if resp.status_code != 200:
                 return None
diff --git a/build/dashboard/mining_dashboard/sim/donation_model.py b/build/dashboard/mining_dashboard/sim/donation_model.py
index 6e65c8cd..fd02c1e3 100644
--- a/build/dashboard/mining_dashboard/sim/donation_model.py
+++ b/build/dashboard/mining_dashboard/sim/donation_model.py
@@ -28,14 +28,14 @@
 Run ``python -m mining_dashboard.sim.donation_model`` for a before/after report.
 """
 
-from dataclasses import dataclass, field, replace
-from typing import Callable, Optional
 import math
+from collections.abc import Callable
+from dataclasses import dataclass, field, replace
 
 from mining_dashboard.config.config import (
-    XVB_TIME_ALGO_MS,
-    XVB_SWITCH_OVERHEAD_MS,
     TIER_DEFAULTS,
+    XVB_SWITCH_OVERHEAD_MS,
+    XVB_TIME_ALGO_MS,
 )
 
 # A 10-minute switching cycle is the simulation's time step.
@@ -44,7 +44,7 @@
 
 # Constraint inputs that keep AlgoService.get_decision past its guard clauses so we
 # exercise the donation math (a recent share, a healthy endpoint, a Main pool).
-_RECENT_SHARES = [{"ts": 10 ** 12}]  # far-future ts -> always inside the PPLNS window
+_RECENT_SHARES = [{"ts": 10**12}]  # far-future ts -> always inside the PPLNS window
 _P2P_MAIN = {"type": "Main"}
 _PPLNS_WINDOW = 2160
 
@@ -113,7 +113,7 @@ def __init__(self, span_cycles: int, semantics: str = "fixed"):
     def push(self, credited_hr: float) -> None:
         self._samples.append(credited_hr)
         if len(self._samples) > self.span:
-            self._samples = self._samples[-self.span:]
+            self._samples = self._samples[-self.span :]
 
     def average(self) -> float:
         if not self._samples:
@@ -129,12 +129,12 @@ class Scenario:
     """A simulation setup. Times are in 10-minute cycles."""
 
     name: str
-    target_hr: float           # tier threshold to hold (H/s)
-    current_hr: float          # steady rig hashrate (H/s)
+    target_hr: float  # tier threshold to hold (H/s)
+    current_hr: float  # steady rig hashrate (H/s)
     cycles: int = 3 * CYCLES_PER_DAY
     measurement: str = "fixed"  # "fixed" | "connected" (see _Window)
-    warm_avg: float = 0.0      # initial avg_1h/avg_24h (0 = cold start; >0 = warm)
-    hr_noise: float = 0.0      # deterministic +/- fractional jitter on current_hr
+    warm_avg: float = 0.0  # initial avg_1h/avg_24h (0 = cold start; >0 = warm)
+    hr_noise: float = 0.0  # deterministic +/- fractional jitter on current_hr
     # Per-switch reconnect ramp: XvB credits ~0 for this long at the start of each
     # donation slice while miners reconnect to the new pool. This is exactly what
     # the controller's XVB_SWITCH_OVERHEAD_MS compensates for, so modelling it lets
@@ -159,19 +159,19 @@ class Scenario:
     # actually keeps a share each cycle (VIP status) in `vip_held`.
     p2pool_difficulty: float = 0.0
     # Optional sustained hashrate drop (worker disconnect) to test tier recovery.
-    drop_at: Optional[int] = None
-    drop_until: Optional[int] = None
-    drop_factor: float = 1.0   # current_hr multiplier while dropped
+    drop_at: int | None = None
+    drop_until: int | None = None
+    drop_factor: float = 1.0  # current_hr multiplier while dropped
 
 
 @dataclass
 class SimResult:
     scenario: Scenario
-    credited: list[float] = field(default_factory=list)      # XvB-credited rate/cycle
-    credited_1h: list[float] = field(default_factory=list)   # XvB-reported 1h avg
+    credited: list[float] = field(default_factory=list)  # XvB-credited rate/cycle
+    credited_1h: list[float] = field(default_factory=list)  # XvB-reported 1h avg
     credited_24h: list[float] = field(default_factory=list)  # XvB-reported 24h avg
-    fraction: list[float] = field(default_factory=list)      # donated fraction/cycle
-    current_hr: list[float] = field(default_factory=list)    # rig hashrate seen
+    fraction: list[float] = field(default_factory=list)  # donated fraction/cycle
+    current_hr: list[float] = field(default_factory=list)  # rig hashrate seen
 
     # --- metrics ------------------------------------------------------------
     @property
@@ -223,10 +223,12 @@ def tier_held(self, tol: float = 0.02) -> bool:
         noise around the threshold.
         """
         t = self.scenario.target_hr * (1 - tol)
-        return (min(self.credited_1h[self._tail], default=0.0) >= t
-                and min(self.credited_24h[self._tail], default=0.0) >= t)
+        return (
+            min(self.credited_1h[self._tail], default=0.0) >= t
+            and min(self.credited_24h[self._tail], default=0.0) >= t
+        )
 
-    def cycles_to_tier_24h(self) -> Optional[int]:
+    def cycles_to_tier_24h(self) -> int | None:
         """First cycle at which the 24h average reaches the threshold (or None)."""
         for i, v in enumerate(self.credited_24h):
             if v >= self.scenario.target_hr:
@@ -247,7 +249,9 @@ def min_expected_shares(self, window_seconds: float = _PPLNS_WINDOW * 10) -> flo
         tail_hr = self.current_hr[self._tail]
         if not tail_frac:
             return float("inf")
-        return min((1 - f) * hr * window_seconds / diff for f, hr in zip(tail_frac, tail_hr))
+        return min(
+            (1 - f) * hr * window_seconds / diff for f, hr in zip(tail_frac, tail_hr, strict=False)
+        )
 
     def vip_held(self, min_shares: float = 1.0) -> bool:
         """True if p2pool keeps at least ``min_shares`` expected shares in the window
@@ -284,8 +288,10 @@ def run_simulation(controller: Controller, scenario: Scenario) -> SimResult:
 
         # Effective rig hashrate this cycle: deterministic jitter + optional drop.
         base = scenario.current_hr
-        if scenario.drop_at is not None and scenario.drop_at <= cycle and (
-            scenario.drop_until is None or cycle < scenario.drop_until
+        if (
+            scenario.drop_at is not None
+            and scenario.drop_at <= cycle
+            and (scenario.drop_until is None or cycle < scenario.drop_until)
         ):
             base *= scenario.drop_factor
         # Deterministic pseudo-jitter (no RNG: reproducible across runs/resumes).
@@ -345,31 +351,55 @@ def run_algo(scenario: Scenario, donation_level="vip", **tuning) -> SimResult:
 # VIP reserve is exercised rather than the flat fallback.
 _DIFFICULTY = 120_000_000
 DEFAULT_SCENARIOS = [
-    Scenario(name="field (VIP 10k on 46k rig, cold start)",
-             target_hr=10_000, current_hr=46_300, p2pool_difficulty=_DIFFICULTY),
-    Scenario(name="high headroom (VIP 10k on 200k rig)",
-             target_hr=10_000, current_hr=200_000, p2pool_difficulty=_DIFFICULTY),
-    Scenario(name="stale/laggy API reads (~2h reporting lag)",
-             target_hr=10_000, current_hr=46_300, report_lag_cycles=12,
-             p2pool_difficulty=_DIFFICULTY),
-    Scenario(name="XvB over-credits 3x (calibration must back off)",
-             target_hr=10_000, current_hr=46_300, credit_factor=3.0,
-             p2pool_difficulty=_DIFFICULTY),
-    Scenario(name="worker drop below tier mid-run, then recovery",
-             target_hr=10_000, current_hr=46_300, warm_avg=10_300,
-             drop_at=CYCLES_PER_DAY, drop_until=CYCLES_PER_DAY + 18, drop_factor=0.2,
-             p2pool_difficulty=_DIFFICULTY),
+    Scenario(
+        name="field (VIP 10k on 46k rig, cold start)",
+        target_hr=10_000,
+        current_hr=46_300,
+        p2pool_difficulty=_DIFFICULTY,
+    ),
+    Scenario(
+        name="high headroom (VIP 10k on 200k rig)",
+        target_hr=10_000,
+        current_hr=200_000,
+        p2pool_difficulty=_DIFFICULTY,
+    ),
+    Scenario(
+        name="stale/laggy API reads (~2h reporting lag)",
+        target_hr=10_000,
+        current_hr=46_300,
+        report_lag_cycles=12,
+        p2pool_difficulty=_DIFFICULTY,
+    ),
+    Scenario(
+        name="XvB over-credits 3x (calibration must back off)",
+        target_hr=10_000,
+        current_hr=46_300,
+        credit_factor=3.0,
+        p2pool_difficulty=_DIFFICULTY,
+    ),
+    Scenario(
+        name="worker drop below tier mid-run, then recovery",
+        target_hr=10_000,
+        current_hr=46_300,
+        warm_avg=10_300,
+        drop_at=CYCLES_PER_DAY,
+        drop_until=CYCLES_PER_DAY + 18,
+        drop_factor=0.2,
+        p2pool_difficulty=_DIFFICULTY,
+    ),
 ]
 
 
 def _fmt(r: SimResult) -> str:
     shares = r.min_expected_shares()
     vip = "inf" if shares == float("inf") else f"{shares:.1f}"
-    return (f"day1 {r.first_day_overshoot:4.2f}x  "
-            f"peak {r.peak_overshoot:4.2f}x  "
-            f"steady {r.steady_overshoot_1h:4.2f}x  "
-            f"p2pool {r.p2pool_efficiency*100:5.1f}%  "
-            f"tier {str(r.tier_held()):5}  vip_shares {vip}")
+    return (
+        f"day1 {r.first_day_overshoot:4.2f}x  "
+        f"peak {r.peak_overshoot:4.2f}x  "
+        f"steady {r.steady_overshoot_1h:4.2f}x  "
+        f"p2pool {r.p2pool_efficiency * 100:5.1f}%  "
+        f"tier {str(r.tier_held()):5}  vip_shares {vip}"
+    )
 
 
 def main():  # pragma: no cover - human-facing report, not a test path
diff --git a/build/dashboard/mining_dashboard/version.py b/build/dashboard/mining_dashboard/version.py
index bf3ad5ae..af61afcf 100644
--- a/build/dashboard/mining_dashboard/version.py
+++ b/build/dashboard/mining_dashboard/version.py
@@ -9,6 +9,7 @@
 — the single source of truth — and ``git``). Reading only the environment keeps the
 container self-describing and this resolver a pure, unit-testable function of its inputs.
 """
+
 import os
 
 
@@ -50,7 +51,8 @@ def resolve_version(env=None):
     else:
         text = "dev build"
 
-    detail = ", ".join(p for p in (f"branch {branch}" if branch else "",
-                                   f"commit {commit}" if commit else "") if p)
+    detail = ", ".join(
+        p for p in (f"branch {branch}" if branch else "", f"commit {commit}" if commit else "") if p
+    )
     title = f"Development build ({detail})" if detail else "Development build"
     return {"text": text, "title": title, "dev": True}
diff --git a/build/dashboard/mining_dashboard/web/server.py b/build/dashboard/mining_dashboard/web/server.py
index 8e3e0747..793b9053 100644
--- a/build/dashboard/mining_dashboard/web/server.py
+++ b/build/dashboard/mining_dashboard/web/server.py
@@ -1,9 +1,10 @@
-import os
 import logging
 import mimetypes
+import os
+
 from aiohttp import web
 
-from mining_dashboard.web.views import build_state, get_shell_html, parse_window, canonical_window
+from mining_dashboard.web.views import build_state, canonical_window, get_shell_html, parse_window
 
 logger = logging.getLogger("WebServer")
 
@@ -18,20 +19,20 @@
 async def handle_index(request):
     """Serve the static HTML shell. It carries no data — the client fetches ``/api/state``
     and renders the dashboard. Pure transport."""
-    return web.Response(text=get_shell_html(), content_type='text/html')
+    return web.Response(text=get_shell_html(), content_type="text/html")
 
 
 async def handle_state(request):
     """The dashboard's data API. Pull shared state, delegate to the view layer, and return
     the assembled state object as JSON (or a sanitized 500 on failure)."""
     app = request.app
-    data = app['latest_data']
-    state_mgr = app['state_manager']
-    range_arg = request.query.get('range', 'all')
+    data = app["latest_data"]
+    state_mgr = app["state_manager"]
+    range_arg = request.query.get("range", "all")
     # Optional manual-zoom window (Issue #47); malformed from/to falls back to the preset range.
-    window = parse_window(request.query.get('from'), request.query.get('to'))
+    window = parse_window(request.query.get("from"), request.query.get("to"))
     # Hashrate-averaging window for the chart (#168); unknown/missing falls back to the default.
-    avg_window = canonical_window(request.query.get('avg'))
+    avg_window = canonical_window(request.query.get("avg"))
 
     try:
         return web.json_response(build_state(data, state_mgr, range_arg, window, avg_window))
@@ -47,10 +48,10 @@ def _apply_security_headers(response):
     so no 'unsafe-inline' or 'unsafe-eval' is needed (Issue #60). The frontend libraries are
     eval-free ES modules; dynamic styling is applied via the CSSOM, which style-src doesn't
     govern."""
-    response.headers['X-Content-Type-Options'] = 'nosniff'
-    response.headers['X-Frame-Options'] = 'DENY'
-    response.headers['Referrer-Policy'] = 'no-referrer'
-    response.headers['Content-Security-Policy'] = (
+    response.headers["X-Content-Type-Options"] = "nosniff"
+    response.headers["X-Frame-Options"] = "DENY"
+    response.headers["Referrer-Policy"] = "no-referrer"
+    response.headers["Content-Security-Policy"] = (
         "default-src 'self'; img-src 'self' data:; style-src 'self'; "
         "script-src 'self'; connect-src 'self'; frame-ancestors 'none'; "
         "base-uri 'self'; form-action 'self'"
@@ -60,7 +61,7 @@ def _apply_security_headers(response):
     # without this, a browser (notably iOS Safari) can keep serving the pre-upgrade dashboard.css
     # for an unpredictable while (Issue #83). 'no-cache' still allows a conditional request, so an
     # unchanged asset costs only a 304 — no re-download of the vendored libs on each page load.
-    response.headers['Cache-Control'] = 'no-cache'
+    response.headers["Cache-Control"] = "no-cache"
     return response
 
 
@@ -70,22 +71,24 @@ async def security_headers_middleware(request, handler):
     try:
         return _apply_security_headers(await handler(request))
     except web.HTTPException as exc:
-        raise _apply_security_headers(exc)
+        raise _apply_security_headers(exc) from exc
 
 
 def create_app(state_manager, latest_data_ref):
     """Factory to create the web app instance."""
     app = web.Application(middlewares=[security_headers_middleware])
     # Pass shared state objects to the app context
-    app['state_manager'] = state_manager
-    app['latest_data'] = latest_data_ref
-
-    app.add_routes([
-        web.get('/', handle_index),
-        web.get('/api/state', handle_state),
-    ])
+    app["state_manager"] = state_manager
+    app["latest_data"] = latest_data_ref
+
+    app.add_routes(
+        [
+            web.get("/", handle_index),
+            web.get("/api/state", handle_state),
+        ]
+    )
 
     static_path = os.path.join(os.path.dirname(__file__), "static")
-    app.router.add_static('/static', static_path)
+    app.router.add_static("/static", static_path)
 
     return app
diff --git a/build/dashboard/mining_dashboard/web/static/chart.mjs b/build/dashboard/mining_dashboard/web/static/chart.mjs
index 820dee43..e0302430 100644
--- a/build/dashboard/mining_dashboard/web/static/chart.mjs
+++ b/build/dashboard/mining_dashboard/web/static/chart.mjs
@@ -15,27 +15,39 @@
 // scatter is kept on its own stack group so its y stays absolute. Zoom/pan (chartjs-plugin-zoom)
 // gestures hand the visible window up via onZoom, which refetches that window from the server at
 // duration-adaptive resolution — so zooming in reveals finer data.
-import { Component, createRef, html } from './preact.mjs';
-import { fmtTimestamp, clampZoomWindow, bandBorderWidth } from './logic.mjs';
 
-const RANGES = [['1h', '1 Hr'], ['24h', '24 Hr'], ['1w', '1 Wk'], ['1m', '1 Mo']];
+import { bandBorderWidth, clampZoomWindow, fmtTimestamp } from "./logic.mjs";
+import { Component, createRef, html } from "./preact.mjs";
+
+const RANGES = [
+  ["1h", "1 Hr"],
+  ["24h", "24 Hr"],
+  ["1w", "1 Wk"],
+  ["1m", "1 Mo"],
+];
 
 // Hashrate-averaging windows for the chart toggle (#168): [param key, button label]. The keys match
 // the server's `avg` param; labels are spelled out so the "1m" window (1 MINUTE) isn't mistaken for
 // the "1 Mo" RANGE above. Persisted in dashboard.js ui.avg (localStorage), default 10m. 12h/24h read
 // low until a rig has been online that long — flagged via the button title so it doesn't look broken.
-const WINDOWS = [['1m', '1 Min'], ['10m', '10 Min'], ['1h', '1 Hr'], ['12h', '12 Hr'], ['24h', '24 Hr']];
+const WINDOWS = [
+  ["1m", "1 Min"],
+  ["10m", "10 Min"],
+  ["1h", "1 Hr"],
+  ["12h", "12 Hr"],
+  ["24h", "24 Hr"],
+];
 const WINDOW_HINT = {
-    '12h': 'Average over the last 12 hours — needs ~12h of rig uptime to fully fill',
-    '24h': 'Average over the last 24 hours — needs ~24h of rig uptime to fully fill',
+  "12h": "Average over the last 12 hours — needs ~12h of rig uptime to fully fill",
+  "24h": "Average over the last 24 hours — needs ~24h of rig uptime to fully fill",
 };
 
 // Series the user can show/hide (Issue #47): dataset index, label and swatch colour class.
 // Visibility lives in dashboard.js ui.series (persisted); applied to the chart in applyVisibility.
 const SERIES = [
-    { key: 'p2pool', label: 'P2Pool (routed)', idx: 0, dot: 'dot-p2pool' },
-    { key: 'xvb', label: 'XvB (routed)', idx: 1, dot: 'dot-xvb' },
-    { key: 'shares', label: 'Shares', idx: 2, dot: 'dot-shares' },
+  { key: "p2pool", label: "P2Pool (routed)", idx: 0, dot: "dot-p2pool" },
+  { key: "xvb", label: "XvB (routed)", idx: 1, dot: "dot-xvb" },
+  { key: "shares", label: "Shares", idx: 2, dot: "dot-shares" },
 ];
 
 // Smallest zoom window (ms) — guards against requesting a sub-sample slice (30s native cadence).
@@ -45,239 +57,319 @@ const ZOOM_DEBOUNCE_MS = 300;
 
 // Register the zoom/pan plugin once (UMD global from chartjs-plugin-zoom.min.js; see index.html).
 // Guarded so the module is harmless if the global is absent (e.g. outside the browser).
-if (typeof Chart !== 'undefined' && typeof window !== 'undefined' && window.ChartZoom) {
-    Chart.register(window.ChartZoom);
+if (typeof Chart !== "undefined" && typeof window !== "undefined" && window.ChartZoom) {
+  Chart.register(window.ChartZoom);
 }
 
 // Append an 8-bit alpha to a #rrggbb hex (Chart.js accepts #rrggbbaa). Non-hex values pass
 // through opaque, so a future palette change can't break the fills.
-const withAlpha = (hex, aa) => (/^#[0-9a-fA-F]{6}$/.test(hex) ? hex + aa : hex);
+export const withAlpha = (hex, aa) => (/^#[0-9a-fA-F]{6}$/.test(hex) ? hex + aa : hex);
 
 // The chart's colours, read from the active theme's CSS variables (Issue #43) so the chart
 // matches light/dark/auto. Re-read on every sync() so a theme switch recolours it in place.
 function paletteColors() {
-    const cs = getComputedStyle(document.documentElement);
-    const v = (name, fallback) => cs.getPropertyValue(name).trim() || fallback;
-    const accent = v('--accent', '#58a6ff');
-    const purple = v('--purple', '#a371f7');
-    return {
-        accent, purple,
-        shares: v('--bad', '#da3633'),
-        grid: v('--border', '#30363d'),
-        ticks: v('--text-muted', '#8b949e'),
-        band: withAlpha(accent, '26'),         // drag-to-zoom selection band (≈ 0.15 alpha)
-    };
+  const cs = getComputedStyle(document.documentElement);
+  const v = (name, fallback) => cs.getPropertyValue(name).trim() || fallback;
+  const accent = v("--accent", "#58a6ff");
+  const purple = v("--purple", "#a371f7");
+  return {
+    accent,
+    purple,
+    shares: v("--bad", "#da3633"),
+    grid: v("--border", "#30363d"),
+    ticks: v("--text-muted", "#8b949e"),
+    band: withAlpha(accent, "26"), // drag-to-zoom selection band (≈ 0.15 alpha)
+  };
 }
 
 // Area-fill gradient stops (Issue #145): strong near the line, fading toward the axis, so a flat
 // series reads as a solid mass instead of a thin strip. Line a touch thicker than the default so
 // the top edge pops against the fill.
-const FILL_TOP = '59';   // ≈ 0.35 alpha at the line
-const FILL_BOTTOM = '0d';  // ≈ 0.05 alpha at the axis
+const FILL_TOP = "59"; // ≈ 0.35 alpha at the line
+const FILL_BOTTOM = "0d"; // ≈ 0.05 alpha at the axis
 const AREA_BORDER_WIDTH = 3.5;
 
 // A vertical gradient fill for a stacked area, keyed to the live chart area (pixels, not data) so
 // it spans the visible card regardless of the y-range. Scriptable: re-evaluated on resize/zoom.
 // Before the first layout `chartArea` is undefined, so fall back to the flat top tint.
 function areaFill(baseHex) {
-    return (ctx) => {
-        const area = ctx.chart.chartArea;
-        if (!area) return withAlpha(baseHex, FILL_TOP);
-        const g = ctx.chart.ctx.createLinearGradient(0, area.top, 0, area.bottom);
-        g.addColorStop(0, withAlpha(baseHex, FILL_TOP));
-        g.addColorStop(1, withAlpha(baseHex, FILL_BOTTOM));
-        return g;
-    };
+  return (ctx) => {
+    const area = ctx.chart.chartArea;
+    if (!area) return withAlpha(baseHex, FILL_TOP);
+    const g = ctx.chart.ctx.createLinearGradient(0, area.top, 0, area.bottom);
+    g.addColorStop(0, withAlpha(baseHex, FILL_TOP));
+    g.addColorStop(1, withAlpha(baseHex, FILL_BOTTOM));
+    return g;
+  };
 }
 
 // Pad the auto-fitted y-range so a near-flat line fills the card instead of hugging the bottom
 // (Issue #145). Pads by a fraction of the visible span, with a floor tied to the magnitude so a
 // dead-flat series isn't magnified into pure noise; never drops below zero.
-function padYAxis(scale) {
-    const { min, max } = scale;
-    if (!isFinite(min) || !isFinite(max)) return;   // all series hidden / no data
-    const pad = Math.max((max - min) * 0.2, max * 0.03);
-    scale.min = Math.max(0, min - pad);
-    scale.max = max + pad;
+export function padYAxis(scale) {
+  const { min, max } = scale;
+  if (!Number.isFinite(min) || !Number.isFinite(max)) return; // all series hidden / no data
+  const pad = Math.max((max - min) * 0.2, max * 0.03);
+  scale.min = Math.max(0, min - pad);
+  scale.max = max + pad;
 }
 
 export class ChartCard extends Component {
-    constructor(props) {
-        super(props);
-        this.canvasRef = createRef();
-        this.shareCounts = [];
-        this.applyingServerData = false;   // suppress the gesture handler during programmatic resetZoom
-        this._zoomDebounce = null;
-        this._prevWindow = props.window;   // track window prop to detect the zoomed -> preset transition
-    }
+  constructor(props) {
+    super(props);
+    this.canvasRef = createRef();
+    this.shareCounts = [];
+    this.applyingServerData = false; // suppress the gesture handler during programmatic resetZoom
+    this._zoomDebounce = null;
+    this._prevWindow = props.window; // track window prop to detect the zoomed -> preset transition
+  }
 
-    componentDidMount() { this.create(); }
-    componentDidUpdate() { this.sync(); }
-    componentWillUnmount() {
-        clearTimeout(this._zoomDebounce);
-        if (this.chart) { this.chart.destroy(); this.chart = null; }
+  componentDidMount() {
+    this.create();
+  }
+  componentDidUpdate() {
+    this.sync();
+  }
+  componentWillUnmount() {
+    clearTimeout(this._zoomDebounce);
+    if (this.chart) {
+      this.chart.destroy();
+      this.chart = null;
     }
+  }
 
-    // Debounced: a gesture (wheel/drag-zoom/pan) settled — hand the visible window up to refetch
-    // it from the server at the right resolution. Ignored while we're programmatically resetting.
-    onGesture() {
-        if (this.applyingServerData) return;
-        clearTimeout(this._zoomDebounce);
-        this._zoomDebounce = setTimeout(() => {
-            if (!this.chart) return;
-            const x = this.chart.scales.x;
-            const w = clampZoomWindow(x.min, x.max, MIN_ZOOM_MS);
-            if (w) this.props.onZoom(w.from / 1000, w.to / 1000);   // epoch ms -> seconds
-        }, ZOOM_DEBOUNCE_MS);
-    }
+  // Debounced: a gesture (wheel/drag-zoom/pan) settled — hand the visible window up to refetch
+  // it from the server at the right resolution. Ignored while we're programmatically resetting.
+  onGesture() {
+    if (this.applyingServerData) return;
+    clearTimeout(this._zoomDebounce);
+    this._zoomDebounce = setTimeout(() => {
+      if (!this.chart) return;
+      const x = this.chart.scales.x;
+      const w = clampZoomWindow(x.min, x.max, MIN_ZOOM_MS);
+      if (w) this.props.onZoom(w.from / 1000, w.to / 1000); // epoch ms -> seconds
+    }, ZOOM_DEBOUNCE_MS);
+  }
 
-    create() {
-        const canvas = this.canvasRef.current;
-        if (!canvas || typeof Chart === 'undefined') return;
-        const d = this.props.chart;
-        this.shareCounts = d.shares.map((s) => s.c);
-        const c = paletteColors();
-        const tension = d.tension ?? 0.3;
-        const vis = this.props.series || {};   // persisted show/hide state (Issue #47)
-        const self = this;
-        this.chart = new Chart(canvas, {
-            type: 'line',
-            data: {
-                datasets: [
-                    // segment.borderWidth hides each band's top border-line where the band is flat-zero,
-                    // so an all-to-one-pool window reads as a single solid color instead of the empty
-                    // series painting its edge line over the other's (#184). The upper (XvB) band fills
-                    // down to the series below it (fill: '-1'), NOT to origin — otherwise its
-                    // semi-transparent purple is painted all the way to zero over the blue P2Pool fill,
-                    // tinting an all-P2Pool window (XvB ≈ 0) lavender instead of leaving it blue.
-                    { label: 'P2Pool (routed)', data: d.p2pool, borderColor: c.accent, borderWidth: AREA_BORDER_WIDTH,
-                      segment: { borderWidth: (ctx) => bandBorderWidth(d.p2pool, ctx, AREA_BORDER_WIDTH) },
-                      tension, fill: true, hidden: vis.p2pool === false,
-                      stack: 'hr', backgroundColor: areaFill(c.accent), pointRadius: 0, pointHitRadius: 20 },
-                    { label: 'XvB (routed)', data: d.xvb, borderColor: c.purple, borderWidth: AREA_BORDER_WIDTH,
-                      segment: { borderWidth: (ctx) => bandBorderWidth(d.xvb, ctx, AREA_BORDER_WIDTH) },
-                      tension, fill: '-1', hidden: vis.xvb === false,
-                      stack: 'hr', backgroundColor: areaFill(c.purple), pointRadius: 0, pointHitRadius: 20 },
-                    // On its own hidden 0–1 axis (yAxisID) so the markers ride near the top edge and
-                    // never inflate the hashrate y-range (Issue #145).
-                    { label: 'Shares', data: d.shares, borderColor: c.shares, backgroundColor: c.shares,
-                      hidden: vis.shares === false, yAxisID: 'shares',
-                      pointStyle: 'triangle', rotation: 180, pointRadius: d.shares.map((s) => s.r),
-                      pointHoverRadius: 15, pointHitRadius: 100, showLine: false },
-                ],
+  create() {
+    const canvas = this.canvasRef.current;
+    if (!canvas || typeof Chart === "undefined") return;
+    const d = this.props.chart;
+    this.shareCounts = d.shares.map((s) => s.c);
+    const c = paletteColors();
+    const tension = d.tension ?? 0.3;
+    const vis = this.props.series || {}; // persisted show/hide state (Issue #47)
+    const self = this;
+    this.chart = new Chart(canvas, {
+      type: "line",
+      data: {
+        datasets: [
+          // segment.borderWidth hides each band's top border-line where the band is flat-zero,
+          // so an all-to-one-pool window reads as a single solid color instead of the empty
+          // series painting its edge line over the other's (#184). The upper (XvB) band fills
+          // down to the series below it (fill: '-1'), NOT to origin — otherwise its
+          // semi-transparent purple is painted all the way to zero over the blue P2Pool fill,
+          // tinting an all-P2Pool window (XvB ≈ 0) lavender instead of leaving it blue.
+          {
+            label: "P2Pool (routed)",
+            data: d.p2pool,
+            borderColor: c.accent,
+            borderWidth: AREA_BORDER_WIDTH,
+            segment: { borderWidth: (ctx) => bandBorderWidth(d.p2pool, ctx, AREA_BORDER_WIDTH) },
+            tension,
+            fill: true,
+            hidden: vis.p2pool === false,
+            stack: "hr",
+            backgroundColor: areaFill(c.accent),
+            pointRadius: 0,
+            pointHitRadius: 20,
+          },
+          {
+            label: "XvB (routed)",
+            data: d.xvb,
+            borderColor: c.purple,
+            borderWidth: AREA_BORDER_WIDTH,
+            segment: { borderWidth: (ctx) => bandBorderWidth(d.xvb, ctx, AREA_BORDER_WIDTH) },
+            tension,
+            fill: "-1",
+            hidden: vis.xvb === false,
+            stack: "hr",
+            backgroundColor: areaFill(c.purple),
+            pointRadius: 0,
+            pointHitRadius: 20,
+          },
+          // On its own hidden 0–1 axis (yAxisID) so the markers ride near the top edge and
+          // never inflate the hashrate y-range (Issue #145).
+          {
+            label: "Shares",
+            data: d.shares,
+            borderColor: c.shares,
+            backgroundColor: c.shares,
+            hidden: vis.shares === false,
+            yAxisID: "shares",
+            pointStyle: "triangle",
+            rotation: 180,
+            pointRadius: d.shares.map((s) => s.r),
+            pointHoverRadius: 15,
+            pointHitRadius: 100,
+            showLine: false,
+          },
+        ],
+      },
+      options: {
+        responsive: true,
+        maintainAspectRatio: false,
+        animation: false,
+        spanGaps: false, // {x, y: null} break markers split the line across outages
+        interaction: { mode: "nearest", axis: "x", intersect: false },
+        plugins: {
+          legend: { display: false },
+          tooltip: {
+            callbacks: {
+              title(items) {
+                return items.length ? fmtTimestamp(items[0].parsed.x) : "";
+              },
+              label(context) {
+                if (context.dataset.label === "Shares")
+                  return self.shareCounts[context.dataIndex] + " Shares";
+                let label = context.dataset.label || "";
+                if (label) label += ": ";
+                if (context.parsed.y !== null) label += context.parsed.y + " H/s";
+                return label;
+              },
             },
-            options: {
-                responsive: true, maintainAspectRatio: false, animation: false,
-                spanGaps: false,   // {x, y: null} break markers split the line across outages
-                interaction: { mode: 'nearest', axis: 'x', intersect: false },
-                plugins: {
-                    legend: { display: false },
-                    tooltip: { callbacks: {
-                        title(items) { return items.length ? fmtTimestamp(items[0].parsed.x) : ''; },
-                        label(context) {
-                            if (context.dataset.label === 'Shares') return self.shareCounts[context.dataIndex] + ' Shares';
-                            let label = context.dataset.label || '';
-                            if (label) label += ': ';
-                            if (context.parsed.y !== null) label += context.parsed.y + ' H/s';
-                            return label;
-                        },
-                    } },
-                    // Drag = box-zoom, wheel = zoom, Shift-drag = pan (Issue #47). Each settled
-                    // gesture triggers a server refetch of the visible window (onGesture).
-                    zoom: {
-                        zoom: {
-                            wheel: { enabled: true },
-                            drag: { enabled: true, backgroundColor: c.band, borderColor: c.accent, borderWidth: 1 },
-                            mode: 'x',
-                            onZoomComplete: () => self.onGesture(),
-                        },
-                        pan: { enabled: true, mode: 'x', modifierKey: 'shift', onPanComplete: () => self.onGesture() },
-                        limits: { x: { minRange: MIN_ZOOM_MS } },
-                    },
-                },
-                scales: {
-                    // Linear x positions points by real elapsed time (gaps occupy proportional
-                    // space); axis hidden as before. y is stacked (P2Pool+XvB = total) and
-                    // grid/ticks follow the theme; padYAxis keeps a flat line off the floor.
-                    x: { type: 'linear', display: false },
-                    y: { stacked: true, grid: { color: c.grid }, ticks: { color: c.ticks }, afterDataLimits: padYAxis },
-                    // Hidden 0–1 axis the Shares scatter rides on; markers pin near the top (0.93,
-                    // set server-side) so they never affect the hashrate y-range (Issue #145).
-                    shares: { type: 'linear', display: false, min: 0, max: 1 },
-                },
+          },
+          // Drag = box-zoom, wheel = zoom, Shift-drag = pan (Issue #47). Each settled
+          // gesture triggers a server refetch of the visible window (onGesture).
+          zoom: {
+            zoom: {
+              wheel: { enabled: true },
+              drag: {
+                enabled: true,
+                backgroundColor: c.band,
+                borderColor: c.accent,
+                borderWidth: 1,
+              },
+              mode: "x",
+              onZoomComplete: () => self.onGesture(),
             },
-        });
-    }
+            pan: {
+              enabled: true,
+              mode: "x",
+              modifierKey: "shift",
+              onPanComplete: () => self.onGesture(),
+            },
+            limits: { x: { minRange: MIN_ZOOM_MS } },
+          },
+        },
+        scales: {
+          // Linear x positions points by real elapsed time (gaps occupy proportional
+          // space); axis hidden as before. y is stacked (P2Pool+XvB = total) and
+          // grid/ticks follow the theme; padYAxis keeps a flat line off the floor.
+          x: { type: "linear", display: false },
+          y: {
+            stacked: true,
+            grid: { color: c.grid },
+            ticks: { color: c.ticks },
+            afterDataLimits: padYAxis,
+          },
+          // Hidden 0–1 axis the Shares scatter rides on; markers pin near the top (0.93,
+          // set server-side) so they never affect the hashrate y-range (Issue #145).
+          shares: { type: "linear", display: false, min: 0, max: 1 },
+        },
+      },
+    });
+  }
 
-    // Apply the persisted show/hide state to the datasets (Issue #47); each defaults to visible.
-    // Hiding a stacked series re-stacks the rest (Chart.js excludes hidden datasets from the sum).
-    applyVisibility() {
-        const vis = this.props.series || {};
-        for (const s of SERIES) this.chart.setDatasetVisibility(s.idx, vis[s.key] !== false);
-    }
+  // Apply the persisted show/hide state to the datasets (Issue #47); each defaults to visible.
+  // Hiding a stacked series re-stacks the rest (Chart.js excludes hidden datasets from the sum).
+  applyVisibility() {
+    const vis = this.props.series || {};
+    for (const s of SERIES) this.chart.setDatasetVisibility(s.idx, vis[s.key] !== false);
+  }
 
-    sync() {
-        if (!this.chart) { this.create(); return; }
-        const d = this.props.chart;
-        const c = paletteColors();   // re-read so a theme switch recolours in place
-        const tension = d.tension ?? 0.3;
-        this.shareCounts = d.shares.map((s) => s.c);
-        const ds = this.chart.data.datasets;
-        ds[0].data = d.p2pool; ds[0].borderColor = c.accent; ds[0].backgroundColor = areaFill(c.accent); ds[0].tension = tension;
-        ds[1].data = d.xvb;    ds[1].borderColor = c.purple; ds[1].backgroundColor = areaFill(c.purple); ds[1].tension = tension;
-        ds[2].data = d.shares; ds[2].borderColor = c.shares; ds[2].backgroundColor = c.shares;
-        ds[2].pointRadius = d.shares.map((s) => s.r);
-        this.chart.options.scales.y.grid.color = c.grid;
-        this.chart.options.scales.y.ticks.color = c.ticks;
-        this.applyVisibility();
+  sync() {
+    if (!this.chart) {
+      this.create();
+      return;
+    }
+    const d = this.props.chart;
+    const c = paletteColors(); // re-read so a theme switch recolours in place
+    const tension = d.tension ?? 0.3;
+    this.shareCounts = d.shares.map((s) => s.c);
+    const ds = this.chart.data.datasets;
+    ds[0].data = d.p2pool;
+    ds[0].borderColor = c.accent;
+    ds[0].backgroundColor = areaFill(c.accent);
+    ds[0].tension = tension;
+    ds[1].data = d.xvb;
+    ds[1].borderColor = c.purple;
+    ds[1].backgroundColor = areaFill(c.purple);
+    ds[1].tension = tension;
+    ds[2].data = d.shares;
+    ds[2].borderColor = c.shares;
+    ds[2].backgroundColor = c.shares;
+    ds[2].pointRadius = d.shares.map((s) => s.r);
+    this.chart.options.scales.y.grid.color = c.grid;
+    this.chart.options.scales.y.ticks.color = c.ticks;
+    this.applyVisibility();
 
-        // On the zoomed -> preset transition (Reset or picking a preset clears the window), drop
-        // any stale plugin zoom transform so the axis re-fits the new preset data. Keyed to the
-        // transition (not merely "window is null") so a refresh mid-gesture can't clobber an
-        // in-progress zoom before its debounce fires.
-        const justCleared = this._prevWindow && !this.props.window;
-        this._prevWindow = this.props.window;
-        if (justCleared && this.chart.isZoomedOrPanned && this.chart.isZoomedOrPanned()) {
-            this.applyingServerData = true;
-            this.chart.resetZoom('none');
-            this.applyingServerData = false;
-        }
-        this.chart.update();
-        this.chart.resize();
+    // On the zoomed -> preset transition (Reset or picking a preset clears the window), drop
+    // any stale plugin zoom transform so the axis re-fits the new preset data. Keyed to the
+    // transition (not merely "window is null") so a refresh mid-gesture can't clobber an
+    // in-progress zoom before its debounce fires.
+    const justCleared = this._prevWindow && !this.props.window;
+    this._prevWindow = this.props.window;
+    if (justCleared && this.chart.isZoomedOrPanned && this.chart.isZoomedOrPanned()) {
+      this.applyingServerData = true;
+      this.chart.resetZoom("none");
+      this.applyingServerData = false;
     }
+    this.chart.update();
+    this.chart.resize();
+  }
 
-    render(props) {
-        const zoomed = !!props.window;
-        return html`
+  render(props) {
+    const zoomed = !!props.window;
+    return html`
         <div class="card">
             <div class="chart-controls">
                 <span class="text-muted text-small mr-1">Range:</span>
-                ${RANGES.map(([r, label]) => html`<a href=${'?range=' + r}
-                    class=${'btn-range' + (!zoomed && props.range === r ? ' active' : '')}
-                    onClick=${(e) => { e.preventDefault(); props.onRange(r); }}>${label}</a>`)}
-                ${zoomed
+                ${RANGES.map(
+                  ([r, label]) => html`<a href=${"?range=" + r}
+                    class=${"btn-range" + (!zoomed && props.range === r ? " active" : "")}
+                    onClick=${(e) => {
+                      e.preventDefault();
+                      props.onRange(r);
+                    }}>${label}</a>`,
+                )}
+                ${
+                  zoomed
                     ? html`<button class="btn-range btn-reset" onClick=${() => props.onResetZoom()}>↺ Reset zoom</button>`
-                    : html`<span class="text-muted text-xs ml-2">Drag to zoom · Shift-drag to pan · Scroll to zoom</span>`}
+                    : html`<span class="text-muted text-xs ml-2">Drag to zoom · Shift-drag to pan · Scroll to zoom</span>`
+                }
             </div>
             <div class="chart-controls" role="group" aria-label="Hashrate averaging window">
                 <span class="text-muted text-small mr-1" title="Which hashrate-averaging window the chart plots (#168)">Avg:</span>
-                ${WINDOWS.map(([w, label]) => html`<button type="button"
-                    class=${'btn-range' + (props.avgWindow === w ? ' active' : '')}
+                ${WINDOWS.map(
+                  ([w, label]) => html`<button type="button"
+                    class=${"btn-range" + (props.avgWindow === w ? " active" : "")}
                     aria-pressed=${props.avgWindow === w}
-                    title=${WINDOW_HINT[w] || (label + ' average')}
-                    onClick=${() => props.onAvgWindow && props.onAvgWindow(w)}>${label}</button>`)}
+                    title=${WINDOW_HINT[w] || label + " average"}
+                    onClick=${() => props.onAvgWindow && props.onAvgWindow(w)}>${label}</button>`,
+                )}
             </div>
             <div class="chart-legend" role="group" aria-label="Toggle series">
                 ${SERIES.map((s) => {
-                    const on = (props.series || {})[s.key] !== false;
-                    return html`<button type="button" class=${'legend-item' + (on ? '' : ' off')}
-                        aria-pressed=${on} title=${(on ? 'Hide ' : 'Show ') + s.label}
+                  const on = (props.series || {})[s.key] !== false;
+                  return html`<button type="button" class=${"legend-item" + (on ? "" : " off")}
+                        aria-pressed=${on} title=${(on ? "Hide " : "Show ") + s.label}
                         onClick=${() => props.onToggleSeries(s.key)}>
-                        <span class=${'legend-dot ' + s.dot}></span>${s.label}
+                        <span class=${"legend-dot " + s.dot}></span>${s.label}
                     </button>`;
                 })}
             </div>
             <div class="chart-wrap"><canvas ref=${this.canvasRef}></canvas></div>
         </div>`;
-    }
+  }
 }
diff --git a/build/dashboard/mining_dashboard/web/static/components.mjs b/build/dashboard/mining_dashboard/web/static/components.mjs
index 533f337c..1e846e18 100644
--- a/build/dashboard/mining_dashboard/web/static/components.mjs
+++ b/build/dashboard/mining_dashboard/web/static/components.mjs
@@ -2,40 +2,57 @@
 // on the server). The server sends formatted display strings and semantic tokens
 // (variant: "ok"/"purple"/"accent"/"muted", level: "high"/"ok"); the client maps those to
 // classes — it does no number formatting or business logic of its own.
-import { Component, Fragment, html } from './preact.mjs';
-import { ChartCard } from './chart.mjs';
+
+import { ChartCard } from "./chart.mjs";
 import {
-    WORKER_COLUMNS, sortWorkers, THEME_ORDER, THEME_LABELS, heroKpis, raffleCls,
-    computeEarnings, formatXmr, formatTimeToShare, parseHashrate, uptimeCell,
-} from './logic.mjs';
+  computeEarnings,
+  egressRoute,
+  formatTimeToShare,
+  formatXmr,
+  heroKpis,
+  parseHashrate,
+  raffleCls,
+  sortWorkers,
+  THEME_LABELS,
+  THEME_ORDER,
+  uptimeCell,
+  WORKER_COLUMNS,
+} from "./logic.mjs";
+import { Component, Fragment, html } from "./preact.mjs";
+import { StackTopology } from "./topology.mjs";
 
 // Palette token -> text-colour class (defined in dashboard.css).
-const cVar = (v) => 'c-' + v;
+const cVar = (v) => "c-" + v;
 
 // --- Small shared pieces -------------------------------------------------------------
 
-const StatCard = ({ label, value, cls, span }) => html`
-    <div class=${'stat-card' + (span ? ' col-span-2' : '')}>
+const StatCard = ({ label, value, cls, span, title }) => html`
+    <div class=${"stat-card" + (span ? " col-span-2" : "")} title=${title || ""}>
         <h5>${label}</h5>
-        <p class=${cls || ''}>${value}</p>
+        <p class=${cls || ""}>${value}</p>
     </div>`;
 
-const SharesStat = ({ sw, label = 'Share In Window' }) => html`
+const SharesStat = ({ sw, label = "Share In Window" }) => html`
     <div class="stat-card">
         <h5>${label}</h5>
-        <p><span class=${sw.ok ? 'status-ok' : 'status-bad'}>${sw.count}</span></p>
+        <p><span class=${sw.ok ? "status-ok" : "status-bad"}>${sw.count}</span></p>
     </div>`;
 
-// Tari status with the ✔ the server signals via `active`.
+// Tari merge-mine status. The ✔ means the gRPC channel is actually up, so it's gated on `connected`
+// (channel_state READY) — NOT on `active` (a chain is merely configured). When configured but the
+// channel is down (e.g. TRANSIENT_FAILURE) we show the raw state in a warn style and no ✔, so a dead
+// channel can never read as "TRANSIENT_FAILURE ✔".
 const TariStatus = ({ tari }) => html`
-    <p class=${tari.active ? 'status-ok' : ''}>
-        ${tari.status}${tari.active ? html` <span class="check-inline">✔</span>` : null}
+    <p class=${tari.connected ? "status-ok" : tari.active ? "status-warn" : ""}>
+        ${tari.status}${tari.connected ? html` <span class="check-inline">✔</span>` : null}
     </p>`;
 
 const Badges = ({ badges }) => html`
     <div class="badge-row">
-        ${badges.map((b) => html`
-            <span class=${'badge badge-' + b.variant} title=${b.title || ''}>${b.text}</span>`)}
+        ${badges.map(
+          (b) => html`
+            <span class=${"badge badge-" + b.variant} title=${b.title || ""}>${b.text}</span>`,
+        )}
     </div>`;
 
 // Build-version badge (Issue #58). Muted badge-outline so it reads as informative, not loud;
@@ -43,24 +60,24 @@ const Badges = ({ badges }) => html`
 // release to `vX.Y.Z` and any other build to `dev · branch @ hash`, so a dev build is
 // unmistakable. `dev` adds a marker class purely as a class hook (text already distinguishes it).
 const VersionBadge = ({ version }) =>
-    version && version.text
-        ? html`<span class=${'badge badge-outline version-badge ml-2' + (version.dev ? ' version-dev' : '')}
-                     title=${version.title || ''}>${version.text}</span>`
-        : null;
+  version && version.text
+    ? html`<span class=${"badge badge-outline version-badge ml-2" + (version.dev ? " version-dev" : "")}
+                     title=${version.title || ""}>${version.text}</span>`
+    : null;
 
 // New-release callout (#224). Shown only when the server reports a newer GitHub release is available
 // (opt-in `dashboard.check_for_updates`, off by default). Notify-only — it's a link to the release,
 // not an upgrade button (#59). Accent so it's noticeable; opens the release page in a new tab.
 const UpdateBadge = ({ update }) =>
-    update && update.available && update.url
-        ? html`<a class="badge badge-accent version-badge ml-2" href=${update.url}
+  update && update.available && update.url
+    ? html`<a class="badge badge-accent version-badge ml-2" href=${update.url}
                   target="_blank" rel="noopener noreferrer"
-                  title=${'A newer Pithead release is available: ' + update.latest}
+                  title=${"A newer Pithead release is available: " + update.latest}
                >New release ${update.latest} available ↗</a>`
-        : null;
+    : null;
 
 const HighUsage = ({ level }) =>
-    level === 'high' ? html`<span class="badge badge-bad mx-1">High Usage</span>` : null;
+  level === "high" ? html`<span class="badge badge-bad mx-1">High Usage</span>` : null;
 
 // Theme icons (Issue #43) — minimal Lucide-style line glyphs drawn with currentColor, so they
 // pick up the segment's text colour (muted → full on hover/active). Inline SVG keeps them crisp
@@ -69,9 +86,13 @@ const svgIcon = (body) => html`
     <svg viewBox="0 0 24 24" width="16" height="16" fill="none" stroke="currentColor"
          stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">${body}</svg>`;
 const THEME_ICON = {
-    light: () => svgIcon(html`<circle cx="12" cy="12" r="4" /><path d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41" />`),
-    auto: () => svgIcon(html`<rect x="2" y="3" width="20" height="14" rx="2" /><path d="M8 21h8M12 17v4" />`),
-    dark: () => svgIcon(html`<path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z" />`),
+  light: () =>
+    svgIcon(
+      html`<circle cx="12" cy="12" r="4" /><path d="M12 2v2M12 20v2M4.93 4.93l1.41 1.41M17.66 17.66l1.41 1.41M2 12h2M20 12h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41" />`,
+    ),
+  auto: () =>
+    svgIcon(html`<rect x="2" y="3" width="20" height="14" rx="2" /><path d="M8 21h8M12 17v4" />`),
+  dark: () => svgIcon(html`<path d="M21 12.79A9 9 0 1 1 11.21 3 7 7 0 0 0 21 12.79z" />`),
 };
 
 // Fixed bottom-right segmented control to pick light / auto / dark (Issue #43). Icon-only and
@@ -79,25 +100,28 @@ const THEME_ICON = {
 // in every app state (loading / sync / dashboard) so it's always reachable; the choice is
 // persisted by the onTheme handler in dashboard.js.
 const ThemeSwitcher = ({ theme, onTheme }) => {
-    const current = theme || 'auto';
-    return html`
+  const current = theme || "auto";
+  return html`
     <div class="theme-switcher" role="group" aria-label="Theme">
-        ${THEME_ORDER.map((id) => html`
-            <button type="button" class=${'theme-seg' + (id === current ? ' active' : '')}
-                    title=${'Theme: ' + THEME_LABELS[id]} aria-label=${THEME_LABELS[id]}
+        ${THEME_ORDER.map(
+          (id) => html`
+            <button type="button" class=${"theme-seg" + (id === current ? " active" : "")}
+                    title=${"Theme: " + THEME_LABELS[id]} aria-label=${THEME_LABELS[id]}
                     aria-pressed=${id === current} onClick=${() => onTheme(id)}>
                 ${THEME_ICON[id]()}
-            </button>`)}
+            </button>`,
+        )}
     </div>`;
 };
 
 // --- Top bar -------------------------------------------------------------------------
 
 function Header({ state }) {
-    const s = state.system, hr = state.hashrate;
-    const labelCls = (level) => (level === 'high' ? 'status-bad' : 'text-muted');
-    const valCls = (level) => (level === 'high' ? 'status-bad' : '');
-    return html`
+  const s = state.system,
+    hr = state.hashrate;
+  const labelCls = (level) => (level === "high" ? "status-bad" : "text-muted");
+  const valCls = (level) => (level === "high" ? "status-bad" : "");
+  return html`
     <div class="header" id="top-header">
         <div>
             <div class="brand">
@@ -121,13 +145,13 @@ function Header({ state }) {
                 <div class="mb-1">
                     <span class=${labelCls(s.mem.level)}>RAM:</span>
                     <span class=${valCls(s.mem.level)}>${s.mem.used} / ${s.mem.total} GB (${s.mem.percent})</span> <${HighUsage} level=${s.mem.level} />
-                    <span class=${s.hugepages.variant === 'ok' ? 'status-ok' : 'status-bad'}>Huge Pages: ${s.hugepages.status} (${s.hugepages.value})</span>
+                    <span class=${s.hugepages.variant === "ok" ? "status-ok" : "status-bad"}>Huge Pages: ${s.hugepages.status} (${s.hugepages.value})</span>
                 </div>
                 <div class="flex items-center">
-                    <span class=${(s.disk.level === 'high' ? 'status-bad' : 'text-muted') + ' mr-2'}>Disk: ${s.disk.used} / ${s.disk.total} GB (${s.disk.percent})</span> <${HighUsage} level=${s.disk.level} />
+                    <span class=${(s.disk.level === "high" ? "status-bad" : "text-muted") + " mr-2"}>Disk: ${s.disk.used} / ${s.disk.total} GB (${s.disk.percent})</span> <${HighUsage} level=${s.disk.level} />
                     <div class="disk-bar">
                         <div class="progress-bg">
-                            <div class=${'progress-fill ' + s.disk.fill} style=${{ width: s.disk.width }}></div>
+                            <div class=${"progress-fill " + s.disk.fill} style=${{ width: s.disk.width }}></div>
                         </div>
                     </div>
                 </div>
@@ -135,8 +159,8 @@ function Header({ state }) {
         </div>
         <div class="text-right">
             <div class="text-muted text-xs">Last Update: ${state.last_update}</div>
-            <div class=${'text-xs mt-1 ' + cVar(hr.p2p_variant)}>P2Pool (routed): ${hr.p2p_1h} (1h) / ${hr.p2p_24h} (24h)</div>
-            <div class=${'text-xs mt-xs ' + cVar(hr.xvb_variant)}>XvB (routed): ${hr.xvb_routed_1h} (1h) / ${hr.xvb_routed_24h} (24h)</div>
+            <div class=${"text-xs mt-1 " + cVar(hr.p2p_variant)}>P2Pool (routed): ${hr.p2p_1h} (1h) / ${hr.p2p_24h} (24h)</div>
+            <div class=${"text-xs mt-xs " + cVar(hr.xvb_variant)}>XvB (routed): ${hr.xvb_routed_1h} (1h) / ${hr.xvb_routed_24h} (24h)</div>
         </div>
     </div>`;
 }
@@ -149,28 +173,33 @@ function Header({ state }) {
 // when operational — during sync the numbers aren't meaningful yet.
 const HeroBand = ({ state }) => html`
     <div class="hero-band" id="hero-band">
-        ${heroKpis(state).map((k) => html`
+        ${heroKpis(state).map(
+          (k) => html`
             <div class="hero-kpi">
-                <div class=${'hero-value ' + (k.cls || '')}>${k.value}</div>
+                <div class=${"hero-value " + (k.cls || "")}>${k.value}</div>
                 <div class="hero-label">${k.label}</div>
-            </div>`)}
+            </div>`,
+        )}
     </div>`;
 
 // --- Sync Mode -----------------------------------------------------------------------
 
 function Gauge({ percent, state }) {
-    const inner = state === 'done'
-        ? html`<span class="status-ok check-big">✔</span>`
-        : state === 'loading' ? '…' : percent + '%';
-    return html`
+  const inner =
+    state === "done"
+      ? html`<span class="status-ok check-big">✔</span>`
+      : state === "loading"
+        ? "…"
+        : percent + "%";
+  return html`
     <div class="loader-container">
-        <div class="progress-wheel" style=${{ '--p': percent + '%' }}></div>
+        <div class="progress-wheel" style=${{ "--p": percent + "%" }}></div>
         <div class="progress-text">${inner}</div>
     </div>`;
 }
 
 function SyncView({ sync }) {
-    return html`
+  return html`
     <div id="sync-view">
         <div class="header-placeholder"><p>System is currently synchronizing with the network.</p></div>
         <div class="grid">
@@ -198,10 +227,12 @@ function SyncView({ sync }) {
 // --- Operational cards ---------------------------------------------------------------
 
 function Overview({ state }) {
-    const hr = state.hashrate, st = state.stratum, t = state.tari;
-    // Stat order (#159): fleet headline (total / mode / workers) → raffle status (tier / VIP /
-    // shares / target) → routed split → reference (last share / Tari / wallets).
-    return html`
+  const hr = state.hashrate,
+    st = state.stratum,
+    t = state.tari;
+  // Stat order (#159): fleet headline (total / mode / workers) → raffle status (tier / VIP /
+  // shares / target) → routed split → reference (last share / Tari / wallets).
+  return html`
     <div class="card card-simple" id="card-overview">
         <h3>Overview</h3>
         <div class="stat-grid">
@@ -225,8 +256,9 @@ function Overview({ state }) {
 }
 
 function NodeStats({ state }) {
-    const hr = state.hashrate, st = state.stratum;
-    return html`
+  const hr = state.hashrate,
+    st = state.stratum;
+  return html`
     <div class="card card-advanced" id="card-mynode">
         <h3>My P2Pool Node Stats</h3>
         <div class="stat-grid">
@@ -251,8 +283,8 @@ function NodeStats({ state }) {
 }
 
 function GlobalStats({ state }) {
-    const p = state.pool;
-    return html`
+  const p = state.pool;
+  return html`
     <div class="card card-advanced" id="card-global">
         <h3>Global P2Pool Stats</h3>
         <div class="stat-grid">
@@ -273,26 +305,38 @@ function GlobalStats({ state }) {
 }
 
 function XvBStats({ state }) {
-    const hr = state.hashrate;
-    return html`
+  const hr = state.hashrate;
+  // When the xmrvsbeast.com fetch is stale (#311) the CREDITED figures are frozen —
+  // grey them and tag the label so they don't read as live. Routed (our own proxy
+  // history) is unaffected. Tooltip explains why.
+  const staleTitle =
+    "Stale: no successful fetch from xmrvsbeast.com since the time below. The credited " +
+    "figures are frozen at the last reading; the controller holds its split until a fresh read lands.";
+  const credLabel = (base) => (hr.xvb_stale ? base + " ⚠" : base);
+  const credCls = hr.xvb_stale ? "status-warn" : cVar(hr.xvb_variant);
+  const credTitle = hr.xvb_stale ? staleTitle : "";
+  return html`
     <div class="card card-advanced" id="card-xvb">
         <h3>XvB Donation Stats</h3>
         <div class="stat-grid">
             <${StatCard} label="Current Tier" value=${hr.tier} />
             <${StatCard} label="Target Tier" value=${hr.target_tier} />
             <${StatCard} label="1h Avg (Routed)" value=${hr.xvb_routed_1h} cls=${cVar(hr.xvb_variant)} />
-            <${StatCard} label="1h Avg (Credited)" value=${hr.xvb_1h} cls=${cVar(hr.xvb_variant)} />
+            <${StatCard} label=${credLabel("1h Avg (Credited)")} value=${hr.xvb_1h} cls=${credCls} title=${credTitle} />
             <${StatCard} label="24h Avg (Routed)" value=${hr.xvb_routed_24h} cls=${cVar(hr.xvb_variant)} />
-            <${StatCard} label="24h Avg (Credited)" value=${hr.xvb_24h} cls=${cVar(hr.xvb_variant)} />
+            <${StatCard} label=${credLabel("24h Avg (Credited)")} value=${hr.xvb_24h} cls=${credCls} title=${credTitle} />
             <${StatCard} label="Fail Count" value=${hr.xvb_fail_count} />
         </div>
-        <div class="text-xs text-muted mt-2">Stats fetched from xmrvsbeast.com (Updated: ${hr.xvb_updated})</div>
+        <div class=${"text-xs mt-2 " + (hr.xvb_stale ? "status-warn" : "text-muted")} title=${credTitle}>
+            ${hr.xvb_stale ? "⚠ Stale — last successful fetch from xmrvsbeast.com: " : "Stats fetched from xmrvsbeast.com (Updated: "}${hr.xvb_updated}${hr.xvb_stale ? "" : ")"}
+        </div>
     </div>`;
 }
 
 function NetworkCard({ state }) {
-    const n = state.network, m = state.monero;
-    return html`
+  const n = state.network,
+    m = state.monero;
+  return html`
     <div class="card card-advanced" id="card-network">
         <h3>XMR Network</h3>
         <div class="stat-grid">
@@ -314,28 +358,28 @@ function NetworkCard({ state }) {
 // live P2Pool 1h-average hashrate (the same `p2pool_hr` figure the header / Overview show, which
 // already excludes the XvB-donated slice) until they take control, then holds their raw text.
 class EarningsCard extends Component {
-    constructor(props) {
-        super(props);
-        this.state = { input: null };
-        this.onInput = (e) => this.setState({ input: e.target.value });
-    }
-
-    render() {
-        const e = this.props.earnings;
-        if (!e || !e.available) {
-            return html`
+  constructor(props) {
+    super(props);
+    this.state = { input: null };
+    this.onInput = (e) => this.setState({ input: e.target.value });
+  }
+
+  render() {
+    const e = this.props.earnings;
+    if (!e || !e.available) {
+      return html`
             <div class="card card-advanced" id="card-earnings">
                 <h3>P2Pool Earnings (estimated)</h3>
                 <p class="text-muted text-small">Network stats unavailable — the estimate can't be computed right now.</p>
             </div>`;
-        }
-        const { input } = this.state;
-        const useDefault = input === null;
-        // Default to your P2Pool 1h-average hashrate (the figure shown in the header / Overview,
-        // already excluding the XvB-donated slice); once edited, use the parsed what-if value.
-        const hr = useDefault ? e.p2pool_hr : parseHashrate(input);
-        const est = computeEarnings(hr, e);
-        return html`
+    }
+    const { input } = this.state;
+    const useDefault = input === null;
+    // Default to your P2Pool 1h-average hashrate (the figure shown in the header / Overview,
+    // already excluding the XvB-donated slice); once edited, use the parsed what-if value.
+    const hr = useDefault ? e.p2pool_hr : parseHashrate(input);
+    const est = computeEarnings(hr, e);
+    return html`
         <div class="card card-advanced" id="card-earnings">
             <h3>P2Pool Earnings (estimated)</h3>
             <p class="text-muted text-xs earnings-subtitle">Estimated XMR from P2Pool mining only — excludes XvB donations and Tari merge-mining.</p>
@@ -354,11 +398,11 @@ class EarningsCard extends Component {
             </div>
             <p class="earnings-disclaimer text-muted text-xs mt-2">${e.disclaimer}</p>
         </div>`;
-    }
+  }
 }
 
 function TariCard({ tari }) {
-    return html`
+  return html`
     <div class="card card-advanced" id="card-tari">
         <h3>Tari Merge Mining</h3>
         <div class="stat-grid">
@@ -374,29 +418,29 @@ function TariCard({ tari }) {
 // --- Workers table (WORKER_COLUMNS + sortWorkers live in logic.mjs, unit-tested) -----
 
 function PoolBadge({ pool }) {
-    if (pool === 'p2pool') return html`<span class="badge badge-ok">P2Pool</span>`;
-    if (pool === 'xvb') return html`<span class="badge badge-purple">XvB</span>`;
-    return html`<span class="badge badge-bad">Unknown</span>`;
+  if (pool === "p2pool") return html`<span class="badge badge-ok">P2Pool</span>`;
+  if (pool === "xvb") return html`<span class="badge badge-purple">XvB</span>`;
+  return html`<span class="badge badge-bad">Unknown</span>`;
 }
 
 // Pool-wide proxy share totals (Issue #82) — a footer under the table. Hidden until the proxy
 // has reported any shares so it isn't an all-zero line on a fresh start.
 const ProxyTotals = ({ summary }) => {
-    if (!summary || !summary.has_data) return null;
-    // htm trims whitespace that wraps across a newline at an element boundary, so the spaces
-    // around the rejected <span> are added explicitly via ${' '} rather than left to indentation.
-    const rejCls = summary.reject_level === 'high' ? 'status-bad' : '';
-    return html`
+  if (!summary || !summary.has_data) return null;
+  // htm trims whitespace that wraps across a newline at an element boundary, so the spaces
+  // around the rejected <span> are added explicitly via ${' '} rather than left to indentation.
+  const rejCls = summary.reject_level === "high" ? "status-bad" : "";
+  return html`
     <div class="proxy-totals text-small text-muted">
-        Proxy totals: <span class="status-ok">${summary.accepted}</span> accepted ·${' '}
-        <span class=${rejCls}>${summary.rejected}</span> rejected (${summary.reject_pct}) ·${' '}
+        Proxy totals: <span class="status-ok">${summary.accepted}</span> accepted ·${" "}
+        <span class=${rejCls}>${summary.rejected}</span> rejected (${summary.reject_pct}) ·${" "}
         ${summary.invalid} invalid · Best diff ${summary.best}
     </div>`;
 };
 
 function WorkersTable({ workers, summary, ui, onSort }) {
-    const rows = sortWorkers(workers, ui.sortIndex, ui.sortAsc);
-    return html`
+  const rows = sortWorkers(workers, ui.sortIndex, ui.sortAsc);
+  return html`
     <div class="card">
         <h3>Workers Alive</h3>
         <div class="table-scroll">
@@ -405,19 +449,27 @@ function WorkersTable({ workers, summary, ui, onSort }) {
                     <tr>${WORKER_COLUMNS.map((c, i) => html`<th onClick=${() => onSort(i)}>${c.label}</th>`)}</tr>
                 </thead>
                 <tbody id="workers-tbody">
-                    ${rows.map((w) => html`
-                        <tr class=${w.status === 'online' ? 'status-ok' : 'status-bad'}>
-                            <td>${w.name} <${PoolBadge} pool=${w.pool} /></td>
+                    ${rows.map(
+                      (w) => html`
+                        <tr class=${w.status === "online" ? "status-ok" : "status-bad"}>
+                            <td>${w.name} <${PoolBadge} pool=${w.pool} />${
+                              w.api_ok === false
+                                ? html` <span class="badge badge-bad" title="The dashboard couldn't read this worker's xmrig API, so uptime and per-miner hashrate are unavailable (it still mines — figures come from the proxy). Check workers.api_auth / api_port, or the miner's xmrig http settings.">api ⚠</span>`
+                                : null
+                            }</td>
                             <td>${w.ip}</td>
                             <td>${uptimeCell(w)}</td>
                             <td>${w.h10_str}</td>
                             <td>${w.h60_str}</td>
                             <td>${w.h15_str}</td>
                             <td>${w.accepted_str}</td>
-                            <td>${w.rejected_str}${w.reject_flag
+                            <td>${w.rejected_str}${
+                              w.reject_flag
                                 ? html` <span class="badge badge-bad" title=${w.reject_flag.title}>${w.reject_flag.text}</span>`
-                                : null}</td>
-                        </tr>`)}
+                                : null
+                            }</td>
+                        </tr>`,
+                    )}
                 </tbody>
             </table>
         </div>
@@ -427,17 +479,75 @@ function WorkersTable({ workers, summary, ui, onSort }) {
 
 // --- Operational view ----------------------------------------------------------------
 
-function DashboardView({ state, ui, onRange, onSort, onView, onZoom, onResetZoom, onToggleSeries, onAvgWindow }) {
-    const advanced = ui.view === 'advanced';
-    // Layout by operator relevance (#159): the at-a-glance chart and the rigs themselves lead (this
-    // stack may drive many machines), then this stack's own detail cards, then pool-wide and network
-    // context as reference at the bottom — "mine" first, "the world" last.
-    return html`
-    <div id="dashboard-view" class=${advanced ? 'mode-advanced' : ''}>
+// Component Health & egress posture (#170). The topology map (StackTopology) is the panel: every
+// component and the route of each link, derived from live config (service/egress.py), so it can't
+// drift from reality. The glanceable summary rides in the header badges + the line below; the older
+// per-component egress list lives on as an expandable drawer for the full text detail / a11y.
+function ComponentHealth({ topology, egress }) {
+  if (!topology) return null;
+  const ok = topology.summary.level === "ok";
+  return html`
+    <div class="card card-advanced" id="card-egress">
+        <h3>Stack Topology & Egress</h3>
+        <div class=${"egress-summary c-" + (ok ? "ok" : "bad")}>
+            ${ok ? "🛡️" : "⚠️"} ${topology.summary.label}
+        </div>
+        <${StackTopology} topology=${topology} />
+        ${
+          egress
+            ? html`<details class="egress-details">
+                <summary>All connections (per component)</summary>
+                <div class="egress-list">
+                    ${egress.components.map(
+                      (comp) => html`
+                        <div class="egress-component">
+                            <div class="egress-name">${comp.name}</div>
+                            <ul class="egress-conns">
+                                ${comp.conns.map((conn) => {
+                                  const r = egressRoute(conn.route);
+                                  return html`
+                                    <li class="egress-conn">
+                                        <span class=${"egress-route c-" + r.cls}>${r.icon} ${r.label}</span>
+                                        <span class="egress-to"
+                                            >${conn.to}${
+                                              conn.blocked_by_firewall
+                                                ? html` <span class="egress-note">(firewall-blocked)</span>`
+                                                : ""
+                                            }</span
+                                        >
+                                    </li>`;
+                                })}
+                            </ul>
+                        </div>`,
+                    )}
+                </div>
+              </details>`
+            : ""
+        }
+    </div>`;
+}
+
+function DashboardView({
+  state,
+  ui,
+  onRange,
+  onSort,
+  onView,
+  onZoom,
+  onResetZoom,
+  onToggleSeries,
+  onAvgWindow,
+}) {
+  const advanced = ui.view === "advanced";
+  // Layout by operator relevance (#159): the at-a-glance chart and the rigs themselves lead (this
+  // stack may drive many machines), then this stack's own detail cards, then pool-wide and network
+  // context as reference at the bottom — "mine" first, "the world" last.
+  return html`
+    <div id="dashboard-view" class=${advanced ? "mode-advanced" : ""}>
         <div class="view-controls">
             <div class="toggle-group">
-                <button class=${'btn-toggle' + (!advanced ? ' active' : '')} onClick=${() => onView('simple')}>Simple</button>
-                <button class=${'btn-toggle' + (advanced ? ' active' : '')} onClick=${() => onView('advanced')}>Advanced</button>
+                <button class=${"btn-toggle" + (!advanced ? " active" : "")} onClick=${() => onView("simple")}>Simple</button>
+                <button class=${"btn-toggle" + (advanced ? " active" : "")} onClick=${() => onView("advanced")}>Advanced</button>
             </div>
         </div>
         <div class="grid">
@@ -457,32 +567,47 @@ function DashboardView({ state, ui, onRange, onSort, onView, onZoom, onResetZoom
             <${TariCard} tari=${state.tari} />
             <${GlobalStats} state=${state} />
             <${NetworkCard} state=${state} />
+            <${ComponentHealth} topology=${state.topology} egress=${state.egress} />
         </div>
     </div>`;
 }
 
 // --- Root ----------------------------------------------------------------------------
 
-export function App({ state, connected, ui, onRange, onSort, onView, onTheme, onZoom, onResetZoom, onToggleSeries, onAvgWindow }) {
-    // The theme toggle is fixed-position and always available, even before the first data load.
-    const switcher = html`<${ThemeSwitcher} theme=${ui.theme} onTheme=${onTheme} />`;
-    if (!state) {
-        return html`<${Fragment}>
-            <div class="loading">${connected ? 'Connecting to the dashboard…' : 'Cannot reach the dashboard.'}</div>
+export function App({
+  state,
+  connected,
+  ui,
+  onRange,
+  onSort,
+  onView,
+  onTheme,
+  onZoom,
+  onResetZoom,
+  onToggleSeries,
+  onAvgWindow,
+}) {
+  // The theme toggle is fixed-position and always available, even before the first data load.
+  const switcher = html`<${ThemeSwitcher} theme=${ui.theme} onTheme=${onTheme} />`;
+  if (!state) {
+    return html`<${Fragment}>
+            <div class="loading">${connected ? "Connecting to the dashboard…" : "Cannot reach the dashboard."}</div>
             ${switcher}
         <//>`;
-    }
-    return html`<${Fragment}>
+  }
+  return html`<${Fragment}>
         <${Header} state=${state} />
         ${!connected ? html`<div class="disconnected-banner">Disconnected — showing last known data. Retrying…</div>` : null}
-        ${state.syncing
+        ${
+          state.syncing
             ? html`<${SyncView} sync=${state.sync} />`
             : html`<${Fragment}>
                 <${HeroBand} state=${state} />
                 <${DashboardView} state=${state} ui=${ui} onRange=${onRange} onSort=${onSort}
                                   onView=${onView} onZoom=${onZoom} onResetZoom=${onResetZoom}
                                   onToggleSeries=${onToggleSeries} onAvgWindow=${onAvgWindow} />
-              <//>`}
+              <//>`
+        }
         ${switcher}
     <//>`;
 }
diff --git a/build/dashboard/mining_dashboard/web/static/dashboard.css b/build/dashboard/mining_dashboard/web/static/dashboard.css
index a76bc85a..fedcb816 100644
--- a/build/dashboard/mining_dashboard/web/static/dashboard.css
+++ b/build/dashboard/mining_dashboard/web/static/dashboard.css
@@ -18,239 +18,723 @@
  * Chart.js chart (which reads them via getComputedStyle) all follow the active theme. */
 :root,
 :root[data-theme="dark"] {
-    --bg: #0d1117; --card: #161b22; --border: #30363d;
-    --text: #c9d1d9; --text-muted: #8b949e;
-    --accent: #58a6ff; --ok: #238636; --bad: #da3633; --warn: #d29922; --purple: #a371f7;
-    --elevated: #2d333b;   /* raised surface (e.g. the active theme segment): lighter than --card */
+  --bg: #0d1117;
+  --card: #161b22;
+  --border: #30363d;
+  --text: #c9d1d9;
+  --text-muted: #8b949e;
+  --accent: #58a6ff;
+  --ok: #238636;
+  --bad: #da3633;
+  --warn: #d29922;
+  --purple: #a371f7;
+  --elevated: #2d333b; /* raised surface (e.g. the active theme segment): lighter than --card */
 }
 
 /* Light palette — GitHub Primer light, mirroring the dark set's GitHub-dark origin. Kept in
  * sync with the auto block below (plain CSS has no way to share one declaration list across a
  * selector and a media query). */
 :root[data-theme="light"] {
-    --bg: #ffffff; --card: #f6f8fa; --border: #d0d7de;
-    --text: #1f2328; --text-muted: #656d76;
-    --accent: #0969da; --ok: #1a7f37; --bad: #cf222e; --warn: #9a6700; --purple: #8250df;
-    --elevated: #ffffff;   /* white raised thumb on the off-white --card track */
+  --bg: #ffffff;
+  --card: #f6f8fa;
+  --border: #d0d7de;
+  --text: #1f2328;
+  --text-muted: #656d76;
+  --accent: #0969da;
+  --ok: #1a7f37;
+  --bad: #cf222e;
+  --warn: #9a6700;
+  --purple: #8250df;
+  --elevated: #ffffff; /* white raised thumb on the off-white --card track */
 }
 
 /* Auto: follow the system, but only when the user hasn't pinned dark or light. */
 @media (prefers-color-scheme: light) {
-    :root:not([data-theme="dark"]):not([data-theme="light"]) {
-        --bg: #ffffff; --card: #f6f8fa; --border: #d0d7de;
-        --text: #1f2328; --text-muted: #656d76;
-        --accent: #0969da; --ok: #1a7f37; --bad: #cf222e; --warn: #9a6700; --purple: #8250df;
-        --elevated: #ffffff;
-    }
+  :root:not([data-theme="dark"]):not([data-theme="light"]) {
+    --bg: #ffffff;
+    --card: #f6f8fa;
+    --border: #d0d7de;
+    --text: #1f2328;
+    --text-muted: #656d76;
+    --accent: #0969da;
+    --ok: #1a7f37;
+    --bad: #cf222e;
+    --warn: #9a6700;
+    --purple: #8250df;
+    --elevated: #ffffff;
+  }
 }
 
-body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif; background: var(--bg); color: var(--text); padding: 20px; margin: 0; transition: background-color 0.2s ease, color 0.2s ease; }
+body {
+  font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+  background: var(--bg);
+  color: var(--text);
+  padding: 20px;
+  margin: 0;
+  transition:
+    background-color 0.2s ease,
+    color 0.2s ease;
+}
 
-.container { max-width: 1400px; margin: 0 auto; }
+.container {
+  max-width: 1400px;
+  margin: 0 auto;
+}
 
 /* Layout & Grid */
-.header { display: flex; justify-content: space-between; align-items: flex-start; border-bottom: 1px solid var(--border); padding-bottom: 20px; margin-bottom: 20px; }
-.grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(350px, 1fr)); gap: 20px; margin-bottom: 20px; }
-.card { background: var(--card); border: 1px solid var(--border); border-radius: 6px; padding: 20px; display: flex; flex-direction: column; min-width: 0; }
+.header {
+  display: flex;
+  justify-content: space-between;
+  align-items: flex-start;
+  border-bottom: 1px solid var(--border);
+  padding-bottom: 20px;
+  margin-bottom: 20px;
+}
+.grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(350px, 1fr));
+  gap: 20px;
+  margin-bottom: 20px;
+}
+.card {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  padding: 20px;
+  display: flex;
+  flex-direction: column;
+  min-width: 0;
+}
 
 /* Brand block (Issue #81): the Pithead mark + wordmark in the header, with the host IP demoted
  * to a subtitle beneath the name. The host IP (HOST_IP) is arbitrary user input; a long unbroken
  * value (no hyphens/dots to break at) would otherwise push the header — and the page — wider than
  * a phone (Issue #83), so overflow-wrap:anywhere lets it break mid-token and wrap instead. */
-.brand { display: flex; align-items: center; gap: 12px; min-width: 0; }
-.brand-logo { width: 40px; height: 40px; flex: none; }
-.brand-name { margin: 0; font-size: 1.5rem; font-weight: 700; letter-spacing: 0.5px; }
-.brand-host { font-size: 0.8rem; margin-top: 3px; line-height: 1.35; overflow-wrap: anywhere; }
+.brand {
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  min-width: 0;
+}
+.brand-logo {
+  width: 40px;
+  height: 40px;
+  flex: none;
+}
+.brand-name {
+  margin: 0;
+  font-size: 1.5rem;
+  font-weight: 700;
+  letter-spacing: 0.5px;
+}
+.brand-host {
+  font-size: 0.8rem;
+  margin-top: 3px;
+  line-height: 1.35;
+  overflow-wrap: anywhere;
+}
 /* Host subtitle is "hostname @ ip" (Issue #119): the @ is a faint connector, not a value, so
    dim it and give it even breathing room. Hostname and ip stay at the one muted subtitle weight. */
-.brand-host-at { margin: 0 0.4em; opacity: 0.5; }
+.brand-host-at {
+  margin: 0 0.4em;
+  opacity: 0.5;
+}
 
 /* Hero KPI band (Issue #81): a prominent strip of the headline numbers under the header. A
  * responsive auto-fit grid so the cards sit in one row on a wide screen and reflow when narrow;
  * long tier/mode text wraps inside its card rather than overflowing. */
-.hero-band { display: grid; grid-template-columns: repeat(auto-fit, minmax(150px, 1fr)); gap: 16px; margin-bottom: 20px; }
-.hero-kpi { background: var(--card); border: 1px solid var(--border); border-radius: 8px; padding: 16px 18px; text-align: center; }
-.hero-value { font-size: 1.6rem; font-weight: 700; line-height: 1.2; overflow-wrap: anywhere; }
-.hero-label { margin-top: 6px; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 0.5px; color: var(--text-muted); }
+.hero-band {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(150px, 1fr));
+  gap: 16px;
+  margin-bottom: 20px;
+}
+.hero-kpi {
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 8px;
+  padding: 16px 18px;
+  text-align: center;
+}
+.hero-value {
+  font-size: 1.6rem;
+  font-weight: 700;
+  line-height: 1.2;
+  overflow-wrap: anywhere;
+}
+.hero-label {
+  margin-top: 6px;
+  font-size: 0.7rem;
+  text-transform: uppercase;
+  letter-spacing: 0.5px;
+  color: var(--text-muted);
+}
 
 /* Typography */
-h2 { margin: 0; font-size: 1.5rem; font-weight: 600; }
-h3 { margin: 0 0 15px 0; font-size: 0.85rem; text-transform: uppercase; color: var(--text-muted); letter-spacing: 0.5px; border-bottom: 1px solid var(--border); padding-bottom: 10px; }
-.text-muted { color: var(--text-muted); }
-.text-accent { color: var(--accent); }
-.text-small { font-size: 0.85rem; }
-.text-xs { font-size: 0.75rem; }
-.font-mono { font-family: monospace; }
+h2 {
+  margin: 0;
+  font-size: 1.5rem;
+  font-weight: 600;
+}
+h3 {
+  margin: 0 0 15px 0;
+  font-size: 0.85rem;
+  text-transform: uppercase;
+  color: var(--text-muted);
+  letter-spacing: 0.5px;
+  border-bottom: 1px solid var(--border);
+  padding-bottom: 10px;
+}
+.text-muted {
+  color: var(--text-muted);
+}
+.text-accent {
+  color: var(--accent);
+}
+.text-small {
+  font-size: 0.85rem;
+}
+.text-xs {
+  font-size: 0.75rem;
+}
+.font-mono {
+  font-family: monospace;
+}
 
 /* Stats */
-.stat-grid { display: grid; grid-template-columns: 1fr 1fr; gap: 12px; }
+.stat-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 12px;
+}
 /* min-width:0 lets the 1fr tracks shrink below their content's intrinsic width — without it a
  * long unbroken value (a shortened wallet like "48edf…aZ1", a hash, "Donor (1.00 kH/s+)") keeps
  * the grid wider than the card and overflows it on narrow screens (Issue #83). The values then
  * wrap via overflow-wrap on the <p> below rather than spilling out. */
-.stat-card { background: var(--bg); padding: 10px 12px; border-radius: 4px; border: 1px solid var(--border); min-width: 0; }
-.stat-card h5 { margin: 0 0 4px 0; font-size: 0.7rem; color: var(--text-muted); text-transform: uppercase; }
-.stat-card p { margin: 0; font-weight: 600; font-size: 0.95rem; overflow-wrap: anywhere; }
-.col-span-2 { grid-column: span 2; }
+.stat-card {
+  background: var(--bg);
+  padding: 10px 12px;
+  border-radius: 4px;
+  border: 1px solid var(--border);
+  min-width: 0;
+}
+.stat-card h5 {
+  margin: 0 0 4px 0;
+  font-size: 0.7rem;
+  color: var(--text-muted);
+  text-transform: uppercase;
+}
+.stat-card p {
+  margin: 0;
+  font-weight: 600;
+  font-size: 0.95rem;
+  overflow-wrap: anywhere;
+}
+.col-span-2 {
+  grid-column: span 2;
+}
 
 /* Earnings calculator what-if input (Issue #12) */
-.earnings-subtitle { margin: -4px 0 12px 0; line-height: 1.4; }
-.earnings-input { display: flex; align-items: center; gap: 10px; margin-bottom: 12px; }
-.earnings-input label { font-size: 0.7rem; color: var(--text-muted); text-transform: uppercase; }
-.earnings-input input { flex: 1; min-width: 0; background: var(--bg); border: 1px solid var(--border); color: var(--text); border-radius: 4px; padding: 6px 10px; font-family: inherit; font-size: 0.9rem; }
-.earnings-input input:focus { outline: none; border-color: var(--accent); }
-.earnings-disclaimer { line-height: 1.4; }
+.earnings-subtitle {
+  margin: -4px 0 12px 0;
+  line-height: 1.4;
+}
+.earnings-input {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 12px;
+}
+.earnings-input label {
+  font-size: 0.7rem;
+  color: var(--text-muted);
+  text-transform: uppercase;
+}
+.earnings-input input {
+  flex: 1;
+  min-width: 0;
+  background: var(--bg);
+  border: 1px solid var(--border);
+  color: var(--text);
+  border-radius: 4px;
+  padding: 6px 10px;
+  font-family: inherit;
+  font-size: 0.9rem;
+}
+.earnings-input input:focus {
+  outline: none;
+  border-color: var(--accent);
+}
+.earnings-disclaimer {
+  line-height: 1.4;
+}
 
 /* Table */
-table { width: 100%; border-collapse: collapse; font-size: 0.9rem; }
-th { text-align: left; font-size: 0.75rem; color: var(--text-muted); padding: 10px; border-bottom: 1px solid var(--border); text-transform: uppercase; cursor: pointer; }
-td { padding: 10px; border-bottom: 1px solid var(--border); }
-tr:last-child td { border-bottom: none; }
+table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.9rem;
+}
+th {
+  text-align: left;
+  font-size: 0.75rem;
+  color: var(--text-muted);
+  padding: 10px;
+  border-bottom: 1px solid var(--border);
+  text-transform: uppercase;
+  cursor: pointer;
+}
+td {
+  padding: 10px;
+  border-bottom: 1px solid var(--border);
+}
+tr:last-child td {
+  border-bottom: none;
+}
 /* Pool-wide proxy share totals under the Workers table (Issue #82). */
-.proxy-totals { margin-top: 12px; }
+.proxy-totals {
+  margin-top: 12px;
+}
 
 /* Horizontal-scroll wrapper for the workers table (Issue #83): the table can be wider than a
  * phone viewport (eight columns, incl. accepted/rejected per #82), so it lives in this wrapper
  * that scrolls sideways within its card instead of stretching the whole page. Cells stay on one
  * line so columns don't collapse; harmless on desktop, where the table fits and no scrollbar
  * appears. */
-.table-scroll { overflow-x: auto; }
-.table-scroll th, .table-scroll td { white-space: nowrap; }
+.table-scroll {
+  overflow-x: auto;
+}
+.table-scroll th,
+.table-scroll td {
+  white-space: nowrap;
+}
 
 /* Components */
-.status-ok { color: var(--ok); }
-.status-bad { color: var(--bad); }
-.status-warn { color: var(--warn); }
-
-.progress-bg { background: var(--border); border-radius: 4px; height: 6px; width: 100%; margin-top: 6px; overflow: hidden; }
-.progress-fill { background: var(--accent); height: 100%; border-radius: 4px; }
-.progress-fill.warning { background: var(--warn); }
-.progress-fill.critical { background: var(--bad); }
-
-.badge { padding: 2px 6px; border-radius: 4px; font-size: 0.75rem; font-weight: 600; vertical-align: middle; display: inline-block; }
-.badge-outline { border: 1px solid var(--border); color: var(--text-muted); }
-.badge-ok { background: var(--ok); color: white; }
-.badge-purple { background: var(--purple); color: white; }
-.badge-accent { background: var(--accent); color: white; }
-.badge-bad { background: var(--bad); color: white; }
-.badge-warn { background: var(--warn); color: white; }
+.status-ok {
+  color: var(--ok);
+}
+.status-bad {
+  color: var(--bad);
+}
+.status-warn {
+  color: var(--warn);
+}
+
+.progress-bg {
+  background: var(--border);
+  border-radius: 4px;
+  height: 6px;
+  width: 100%;
+  margin-top: 6px;
+  overflow: hidden;
+}
+.progress-fill {
+  background: var(--accent);
+  height: 100%;
+  border-radius: 4px;
+}
+.progress-fill.warning {
+  background: var(--warn);
+}
+.progress-fill.critical {
+  background: var(--bad);
+}
+
+.badge {
+  padding: 2px 6px;
+  border-radius: 4px;
+  font-size: 0.75rem;
+  font-weight: 600;
+  vertical-align: middle;
+  display: inline-block;
+}
+.badge-outline {
+  border: 1px solid var(--border);
+  color: var(--text-muted);
+}
+.badge-ok {
+  background: var(--ok);
+  color: white;
+}
+.badge-purple {
+  background: var(--purple);
+  color: white;
+}
+.badge-accent {
+  background: var(--accent);
+  color: white;
+}
+.badge-bad {
+  background: var(--bad);
+  color: white;
+}
+.badge-warn {
+  background: var(--warn);
+  color: white;
+}
 /* Header status badges sit in a gapped row, so individual badges need no margins. */
-.badge-row { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 8px; margin-left: 10px; }
+.badge-row {
+  display: inline-flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 8px;
+  margin-left: 10px;
+}
 /* Build-version badge (Issue #58): monospace for the version/hash; a dev build keeps the muted
    palette but swaps to a dashed border so it's quietly, unmistakably not a release. */
-.version-badge { font-family: monospace; font-weight: 500; }
-.version-badge.version-dev { border-style: dashed; }
+.version-badge {
+  font-family: monospace;
+  font-weight: 500;
+}
+.version-badge.version-dev {
+  border-style: dashed;
+}
 
-.wallet-text { font-size: 0.7rem; color: var(--text-muted); margin-top: auto; padding-top: 15px; word-break: break-all; font-family: monospace; }
+.wallet-text {
+  font-size: 0.7rem;
+  color: var(--text-muted);
+  margin-top: auto;
+  padding-top: 15px;
+  word-break: break-all;
+  font-family: monospace;
+}
 
 /* Chart Controls */
-.chart-controls { display: flex; justify-content: center; align-items: center; flex-wrap: wrap; gap: 5px; margin-bottom: 15px; }
-.btn-range { display: inline-block; padding: 4px 12px; border-radius: 4px; text-decoration: none; font-size: 0.8rem; border: 1px solid var(--border); background-color: var(--card); color: var(--text-muted); transition: all 0.2s; }
-.btn-range:hover { border-color: var(--text-muted); color: var(--text); }
-.btn-range.active { background-color: var(--ok); color: #fff; border-color: var(--ok); }
+.chart-controls {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 5px;
+  margin-bottom: 15px;
+}
+.btn-range {
+  display: inline-block;
+  padding: 4px 12px;
+  border-radius: 4px;
+  text-decoration: none;
+  font-size: 0.8rem;
+  border: 1px solid var(--border);
+  background-color: var(--card);
+  color: var(--text-muted);
+  transition: all 0.2s;
+}
+.btn-range:hover {
+  border-color: var(--text-muted);
+  color: var(--text);
+}
+.btn-range.active {
+  background-color: var(--ok);
+  color: #fff;
+  border-color: var(--ok);
+}
 /* Reset-zoom button reuses the range-button look but needs the <button> resets (Issue #47). */
-.btn-reset { cursor: pointer; font-family: inherit; line-height: 1.4; margin-left: 8px; }
+.btn-reset {
+  cursor: pointer;
+  font-family: inherit;
+  line-height: 1.4;
+  margin-left: 8px;
+}
 
 /* Series show/hide toggles (Issue #47): a quiet legend; click a chip to toggle that series.
  * A hidden series is dimmed + struck through. Swatch colours track the theme palette. */
-.chart-legend { display: flex; justify-content: center; align-items: center; flex-wrap: wrap; gap: 6px; margin-bottom: 12px; }
-.legend-item { display: inline-flex; align-items: center; gap: 6px; padding: 3px 10px; border-radius: 999px;
-    border: 1px solid var(--border); background: var(--card); color: var(--text-muted);
-    font: inherit; font-size: 0.78rem; cursor: pointer; transition: color 0.15s, opacity 0.15s; }
-.legend-item:hover { color: var(--text); }
-.legend-item.off { opacity: 0.45; text-decoration: line-through; }
-.legend-dot { width: 10px; height: 10px; border-radius: 2px; display: inline-block; flex: none; }
-.dot-p2pool { background: var(--accent); }
-.dot-xvb { background: var(--purple); }
-.dot-shares { background: var(--bad); }
+.chart-legend {
+  display: flex;
+  justify-content: center;
+  align-items: center;
+  flex-wrap: wrap;
+  gap: 6px;
+  margin-bottom: 12px;
+}
+.legend-item {
+  display: inline-flex;
+  align-items: center;
+  gap: 6px;
+  padding: 3px 10px;
+  border-radius: 999px;
+  border: 1px solid var(--border);
+  background: var(--card);
+  color: var(--text-muted);
+  font: inherit;
+  font-size: 0.78rem;
+  cursor: pointer;
+  transition:
+    color 0.15s,
+    opacity 0.15s;
+}
+.legend-item:hover {
+  color: var(--text);
+}
+.legend-item.off {
+  opacity: 0.45;
+  text-decoration: line-through;
+}
+.legend-dot {
+  width: 10px;
+  height: 10px;
+  border-radius: 2px;
+  display: inline-block;
+  flex: none;
+}
+.dot-p2pool {
+  background: var(--accent);
+}
+.dot-xvb {
+  background: var(--purple);
+}
+.dot-shares {
+  background: var(--bad);
+}
 
 /* View Toggle */
-.view-controls { display: flex; justify-content: flex-end; margin-bottom: 15px; }
-.toggle-group { display: inline-flex; background: var(--card); border: 1px solid var(--border); border-radius: 6px; overflow: hidden; }
-.btn-toggle { background: transparent; border: none; color: var(--text-muted); padding: 6px 16px; cursor: pointer; font-size: 0.85rem; transition: all 0.2s; }
-.btn-toggle:hover { color: var(--text); background: rgba(128,128,128,0.15); }
-.btn-toggle.active { background: var(--accent); color: #fff; font-weight: 600; }
+.view-controls {
+  display: flex;
+  justify-content: flex-end;
+  margin-bottom: 15px;
+}
+.toggle-group {
+  display: inline-flex;
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 6px;
+  overflow: hidden;
+}
+.btn-toggle {
+  background: transparent;
+  border: none;
+  color: var(--text-muted);
+  padding: 6px 16px;
+  cursor: pointer;
+  font-size: 0.85rem;
+  transition: all 0.2s;
+}
+.btn-toggle:hover {
+  color: var(--text);
+  background: rgba(128, 128, 128, 0.15);
+}
+.btn-toggle.active {
+  background: var(--accent);
+  color: #fff;
+  font-weight: 600;
+}
 
 /* Theme switcher (Issue #43): a small fixed segmented control in the bottom-right that picks
  * light / auto / dark. Kept visually quiet — muted icons on a subtle pill — with the active
  * segment raised. The chosen mode is persisted in localStorage and re-applied before the first
  * paint (see dashboard.js / theme-init.js), so it survives reloads and stack restarts. */
 .theme-switcher {
-    position: fixed; bottom: 16px; right: 16px; z-index: 50;
-    display: inline-flex; gap: 2px; padding: 3px;
-    background: var(--card); border: 1px solid var(--border); border-radius: 999px;
-    box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12);
+  position: fixed;
+  bottom: 16px;
+  right: 16px;
+  z-index: 50;
+  display: inline-flex;
+  gap: 2px;
+  padding: 3px;
+  background: var(--card);
+  border: 1px solid var(--border);
+  border-radius: 999px;
+  box-shadow: 0 1px 3px rgba(0, 0, 0, 0.12);
 }
 .theme-seg {
-    display: inline-flex; align-items: center; justify-content: center;
-    width: 30px; height: 28px; padding: 0; border: 0; border-radius: 999px;
-    background: transparent; color: var(--text-muted); cursor: pointer;
-    transition: color 0.15s ease, background-color 0.15s ease, box-shadow 0.15s ease;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 30px;
+  height: 28px;
+  padding: 0;
+  border: 0;
+  border-radius: 999px;
+  background: transparent;
+  color: var(--text-muted);
+  cursor: pointer;
+  transition:
+    color 0.15s ease,
+    background-color 0.15s ease,
+    box-shadow 0.15s ease;
+}
+.theme-seg:hover {
+  color: var(--text);
+}
+.theme-seg.active {
+  background: var(--elevated);
+  color: var(--text);
+  box-shadow: 0 1px 2px rgba(0, 0, 0, 0.22);
+}
+.theme-seg svg {
+  display: block;
 }
-.theme-seg:hover { color: var(--text); }
-.theme-seg.active { background: var(--elevated); color: var(--text); box-shadow: 0 1px 2px rgba(0, 0, 0, 0.22); }
-.theme-seg svg { display: block; }
 
 /* View Modes */
-.card-advanced { display: none !important; }
-.card-simple { display: flex !important; }
+.card-advanced {
+  display: none !important;
+}
+.card-simple {
+  display: flex !important;
+}
 
-.mode-advanced .card-advanced { display: flex !important; }
-.mode-advanced .card-simple { display: none !important; }
+.mode-advanced .card-advanced {
+  display: flex !important;
+}
+.mode-advanced .card-simple {
+  display: none !important;
+}
 
 /* Utilities */
-.flex { display: flex; }
-.items-center { align-items: center; }
-.justify-end { justify-content: flex-end; }
-.text-center { text-align: center; }
-.text-right { text-align: right; }
-.mb-1 { margin-bottom: 0.25rem; }
-.mt-xs { margin-top: 2px; }
-.mt-1 { margin-top: 5px; }
-.mt-2 { margin-top: 10px; }
-.mr-1 { margin-right: 5px; }
-.mr-2 { margin-right: 0.5rem; }
-.ml-1 { margin-left: 8px; }
-.ml-2 { margin-left: 10px; }
-.mx-1 { margin-left: 5px; margin-right: 5px; }
+.flex {
+  display: flex;
+}
+.items-center {
+  align-items: center;
+}
+.justify-end {
+  justify-content: flex-end;
+}
+.text-center {
+  text-align: center;
+}
+.text-right {
+  text-align: right;
+}
+.mb-1 {
+  margin-bottom: 0.25rem;
+}
+.mt-xs {
+  margin-top: 2px;
+}
+.mt-1 {
+  margin-top: 5px;
+}
+.mt-2 {
+  margin-top: 10px;
+}
+.mr-1 {
+  margin-right: 5px;
+}
+.mr-2 {
+  margin-right: 0.5rem;
+}
+.ml-1 {
+  margin-left: 8px;
+}
+.ml-2 {
+  margin-left: 10px;
+}
+.mx-1 {
+  margin-left: 5px;
+  margin-right: 5px;
+}
 
 /* Pool/mode palette. The server picks one of these classes (see views._mode_palette)
  * instead of emitting an inline style="color:#..." — keeps the CSP free of
  * style-src 'unsafe-inline' and makes #43 (theming) a stylesheet change. The hexes match
  * the --ok/--purple/--accent/--text-muted variables they replace. */
-.c-ok { color: var(--ok); }
-.c-purple { color: var(--purple); }
-.c-accent { color: var(--accent); }
-.c-muted { color: var(--text-muted); }
-.bg-ok { background-color: var(--ok); }
-.bg-purple { background-color: var(--purple); }
-.bg-accent { background-color: var(--accent); }
+.c-ok {
+  color: var(--ok);
+}
+.c-purple {
+  color: var(--purple);
+}
+.c-accent {
+  color: var(--accent);
+}
+.c-muted {
+  color: var(--text-muted);
+}
+.bg-ok {
+  background-color: var(--ok);
+}
+.bg-purple {
+  background-color: var(--purple);
+}
+.bg-accent {
+  background-color: var(--accent);
+}
 
 /* Misc component sizing previously carried as inline styles. */
-.disk-bar { width: 150px; }
-.chart-wrap { position: relative; flex-grow: 1; min-height: 300px; width: 100%; overflow: hidden; }
-.check-inline { font-size: 1.2em; }
-.check-big { font-size: 3.5em; line-height: 1; }
+.disk-bar {
+  width: 150px;
+}
+.chart-wrap {
+  position: relative;
+  flex-grow: 1;
+  min-height: 300px;
+  width: 100%;
+  overflow: hidden;
+}
+.check-inline {
+  font-size: 1.2em;
+}
+.check-big {
+  font-size: 3.5em;
+  line-height: 1;
+}
 
 /* --- App states --- */
 /* The Preact app renders SyncView or DashboardView itself, so neither needs a default
  * display rule. These cover the pre-data shell and a lost connection. */
-.loading { color: var(--text-muted); text-align: center; padding: 60px 20px; font-size: 1.1rem; }
-.disconnected-banner { background: var(--bad); color: #fff; padding: 8px 12px; border-radius: 6px;
-    margin-bottom: 16px; text-align: center; font-size: 0.85rem; }
+.loading {
+  color: var(--text-muted);
+  text-align: center;
+  padding: 60px 20px;
+  font-size: 1.1rem;
+}
+.disconnected-banner {
+  background: var(--bad);
+  color: #fff;
+  padding: 8px 12px;
+  border-radius: 6px;
+  margin-bottom: 16px;
+  text-align: center;
+  font-size: 0.85rem;
+}
 
 /* --- Sync View Styles --- */
-.loader-container { position: relative; width: 150px; height: 150px; margin: 20px auto; }
+.loader-container {
+  position: relative;
+  width: 150px;
+  height: 150px;
+  margin: 20px auto;
+}
 .progress-wheel {
-  width: 100%; height: 100%; border-radius: 50%;
+  width: 100%;
+  height: 100%;
+  border-radius: 50%;
   /* --p is set at runtime by dashboard.js from the data-percent attribute. */
   background: conic-gradient(var(--ok) var(--p), var(--border) 0deg);
-  display: flex; align-items: center; justify-content: center;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+}
+.progress-wheel::before {
+  content: "";
+  position: absolute;
+  width: 120px;
+  height: 120px;
+  border-radius: 50%;
+  background: var(--card);
+}
+.progress-text {
+  position: absolute;
+  top: 50%;
+  left: 50%;
+  transform: translate(-50%, -50%);
+  font-size: 24px;
+  font-weight: bold;
+  color: var(--text);
+  z-index: 10;
+}
+.status-text {
+  font-size: 1.1em;
+  margin-top: 15px;
+  color: var(--text-muted);
+  text-align: center;
+}
+.header-placeholder {
+  text-align: center;
+  margin: 40px 0;
+  border-bottom: 1px solid var(--border);
+  padding-bottom: 20px;
 }
-.progress-wheel::before { content: ""; position: absolute; width: 120px; height: 120px; border-radius: 50%; background: var(--card); }
-.progress-text { position: absolute; top: 50%; left: 50%; transform: translate(-50%, -50%); font-size: 24px; font-weight: bold; color: var(--text); z-index: 10; }
-.status-text { font-size: 1.1em; margin-top: 15px; color: var(--text-muted); text-align: center; }
-.header-placeholder { text-align: center; margin: 40px 0; border-bottom: 1px solid var(--border); padding-bottom: 20px; }
 
 /* ---- Responsive / mobile (Issue #83) --------------------------------------------------
  * The desktop layout above is fluid down to tablet widths via the card grid's auto-fit, but a
@@ -261,20 +745,149 @@ tr:last-child td { border-bottom: none; }
  * table is handled separately by .table-scroll above. One breakpoint is enough: above it the
  * grid's auto-fit already reflows cleanly. */
 @media (max-width: 640px) {
-    body { padding: 12px; }
+  body {
+    padding: 12px;
+  }
 
-    /* Stack the header: the host/telemetry block sits above the hashrate readout, both
+  /* Stack the header: the host/telemetry block sits above the hashrate readout, both
        left-aligned, and each inner row may wrap rather than overflow. */
-    .header { flex-direction: column; gap: 12px; }
-    .header .text-right { text-align: left; }
-    .header .items-center { flex-wrap: wrap; }
-
-    /* One card per row — the 350px minmax floor overflows a phone, so collapse to a single
+  .header {
+    flex-direction: column;
+    gap: 12px;
+  }
+  .header .text-right {
+    text-align: left;
+  }
+  .header .items-center {
+    flex-wrap: wrap;
+  }
+
+  /* One card per row — the 350px minmax floor overflows a phone, so collapse to a single
        fluid column. */
-    .grid { grid-template-columns: 1fr; gap: 12px; }
-    .card { padding: 16px; }
-
-    /* Let the disk bar fill the row (dropping to its own line when the label wraps) instead of
+  .grid {
+    grid-template-columns: 1fr;
+    gap: 12px;
+  }
+  .card {
+    padding: 16px;
+  }
+
+  /* Let the disk bar fill the row (dropping to its own line when the label wraps) instead of
        holding a fixed 150px next to the disk label. */
-    .disk-bar { width: 100%; }
+  .disk-bar {
+    width: 100%;
+  }
+}
+
+/* Component Health & egress-posture panel (#170). */
+.c-bad {
+  color: var(--bad);
+}
+.egress-summary {
+  font-weight: 600;
+  margin-bottom: 0.75rem;
+}
+.egress-component {
+  margin-bottom: 0.5rem;
+}
+.egress-name {
+  font-weight: 600;
+  text-transform: capitalize;
+}
+.egress-conns {
+  list-style: none;
+  margin: 0.15rem 0 0;
+  padding: 0;
+}
+.egress-conn {
+  display: flex;
+  gap: 0.5rem;
+  font-size: 0.85em;
+  padding: 0.1rem 0;
+}
+.egress-route {
+  flex: 0 0 7.5em;
+  font-weight: 600;
+}
+.egress-to {
+  color: var(--text-muted);
+}
+.egress-note {
+  font-style: italic;
+}
+
+/* Stack topology panel (#170). */
+.topo-controls {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+  font-size: 0.8em;
+  margin-bottom: 0.4rem;
+}
+.topo-legend {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.3rem;
+  color: var(--text-muted);
+}
+.topo-sw {
+  width: 0.8em;
+  height: 0.8em;
+  border-radius: 2px;
+  display: inline-block;
+}
+.topo-toggle {
+  margin-left: auto;
+  background: transparent;
+  color: var(--accent);
+  border: 1px solid var(--border);
+  border-radius: 4px;
+  padding: 0.15rem 0.5rem;
+  font-size: inherit;
+  cursor: pointer;
+}
+.topo-toggle:hover {
+  border-color: var(--accent);
+}
+.topo-svg {
+  width: 100%;
+  height: auto;
+}
+.topo-zone {
+  fill: var(--text-muted);
+  font-size: 10px;
+  text-anchor: middle;
+  text-transform: uppercase;
+  letter-spacing: 0.04em;
+}
+.topo-node rect {
+  fill: var(--bg);
+  stroke: var(--border);
+  stroke-width: 1;
+}
+.topo-node text {
+  fill: var(--text);
+  font-size: 11px;
+}
+.topo-hub rect {
+  stroke: var(--ok);
+  stroke-width: 1.5;
+}
+.topo-ext rect {
+  fill: transparent;
+  stroke-dasharray: 3 2;
+}
+.topo-ext text {
+  fill: var(--text-muted);
+}
+/* The per-component egress list, demoted to an expandable drawer under the topology map. */
+.egress-details {
+  margin-top: 0.6rem;
+  font-size: 0.9em;
+}
+.egress-details > summary {
+  cursor: pointer;
+  color: var(--text-muted);
+  margin-bottom: 0.4rem;
 }
diff --git a/build/dashboard/mining_dashboard/web/static/dashboard.js b/build/dashboard/mining_dashboard/web/static/dashboard.js
index 07c820be..87ace054 100644
--- a/build/dashboard/mining_dashboard/web/static/dashboard.js
+++ b/build/dashboard/mining_dashboard/web/static/dashboard.js
@@ -4,143 +4,148 @@
 // Data comes from GET /api/state (the server builds it; see views.build_state); the client
 // holds only *UI* state that must survive data refreshes — selected range, table sort, and
 // the simple/advanced view — plus the latest data snapshot and connection status.
-import { render, html } from './preact.mjs';
-import { App } from './components.mjs';
-import { normalizeTheme, normalizeSeries, normalizeAvgWindow } from './logic.mjs';
 
-const root = document.getElementById('app');
+import { App } from "./components.mjs";
+import { normalizeAvgWindow, normalizeSeries, normalizeTheme } from "./logic.mjs";
+import { html, render } from "./preact.mjs";
+
+const root = document.getElementById("app");
 const REFRESH_MS = 30000;
 
 // A manual-zoom window {from, to} (epoch seconds) read from ?from=&to= so a zoomed URL is
 // shareable and survives reload (Issue #47); null/garbage falls back to the preset range.
 function windowFromUrl() {
-    const p = new URL(location.href).searchParams;
-    const from = parseFloat(p.get('from'));
-    const to = parseFloat(p.get('to'));
-    return (Number.isFinite(from) && Number.isFinite(to) && from > 0 && to > from)
-        ? { from, to } : null;
+  const p = new URL(location.href).searchParams;
+  const from = parseFloat(p.get("from"));
+  const to = parseFloat(p.get("to"));
+  return Number.isFinite(from) && Number.isFinite(to) && from > 0 && to > from
+    ? { from, to }
+    : null;
 }
 
 // Which chart series are shown — persisted so a hidden series stays hidden across reloads.
 function loadSeries() {
-    try { return normalizeSeries(JSON.parse(localStorage.getItem('dashboardSeries'))); }
-    catch (e) { return normalizeSeries(null); }
+  try {
+    return normalizeSeries(JSON.parse(localStorage.getItem("dashboardSeries")));
+  } catch {
+    return normalizeSeries(null);
+  }
 }
 
 const ui = {
-    range: new URL(location.href).searchParams.get('range') || 'all',
-    window: windowFromUrl(),   // {from,to} epoch-s when zoomed, else null
-    series: loadSeries(),      // {p2pool, xvb, shares} booleans (Issue #47)
-    // Hashrate-averaging window the chart plots (#168); persisted, default 10m (today's series).
-    avg: normalizeAvgWindow(localStorage.getItem('dashboardAvgWindow')),
-    sortIndex: null,
-    sortAsc: true,
-    view: localStorage.getItem('dashboardView') === 'advanced' ? 'advanced' : 'simple',
-    // Theme is persisted in localStorage so it survives reloads and stack restarts (Issue #43).
-    // theme-init.js already applied it to <html> before first paint; we mirror it into the UI
-    // state and re-apply on toggle.
-    theme: normalizeTheme(localStorage.getItem('dashboardTheme')),
+  range: new URL(location.href).searchParams.get("range") || "all",
+  window: windowFromUrl(), // {from,to} epoch-s when zoomed, else null
+  series: loadSeries(), // {p2pool, xvb, shares} booleans (Issue #47)
+  // Hashrate-averaging window the chart plots (#168); persisted, default 10m (today's series).
+  avg: normalizeAvgWindow(localStorage.getItem("dashboardAvgWindow")),
+  sortIndex: null,
+  sortAsc: true,
+  view: localStorage.getItem("dashboardView") === "advanced" ? "advanced" : "simple",
+  // Theme is persisted in localStorage so it survives reloads and stack restarts (Issue #43).
+  // theme-init.js already applied it to <html> before first paint; we mirror it into the UI
+  // state and re-apply on toggle.
+  theme: normalizeTheme(localStorage.getItem("dashboardTheme")),
 };
 
 // Reflect the current theme onto <html data-theme>; the CSS palette (and the chart, which reads
 // the resolved CSS variables) follow from there.
 function applyTheme(theme) {
-    document.documentElement.setAttribute('data-theme', theme);
+  document.documentElement.setAttribute("data-theme", theme);
 }
 
-let state = null;        // latest /api/state payload, or null before the first response
-let connected = true;    // false after a failed fetch (we keep showing the last snapshot)
-let inflight = false;    // guard against overlapping fetches if one is slow
+let state = null; // latest /api/state payload, or null before the first response
+let connected = true; // false after a failed fetch (we keep showing the last snapshot)
+let inflight = false; // guard against overlapping fetches if one is slow
 
 function rerender() {
-    render(
-        html`<${App} state=${state} connected=${connected} ui=${ui}
+  render(
+    html`<${App} state=${state} connected=${connected} ui=${ui}
                      onRange=${setRange} onSort=${onSort} onView=${setView} onTheme=${setTheme}
                      onZoom=${setZoom} onResetZoom=${resetZoom} onToggleSeries=${toggleSeries}
                      onAvgWindow=${setAvgWindow} />`,
-        root,
-    );
+    root,
+  );
 }
 
 async function tick() {
-    if (inflight) return;
-    inflight = true;
-    try {
-        // A custom zoom window overrides the preset range; the server adapts resolution to it. The
-        // averaging window (#168) applies to both — the server selects which window's columns to plot.
-        const base = ui.window
-            ? ('from=' + ui.window.from + '&to=' + ui.window.to)
-            : ('range=' + encodeURIComponent(ui.range));
-        const qs = base + '&avg=' + encodeURIComponent(ui.avg);
-        const res = await fetch('/api/state?' + qs, { headers: { 'X-Requested-With': 'fetch' } });
-        if (!res.ok) throw new Error('HTTP ' + res.status);
-        state = await res.json();
-        connected = true;
-        if (state.page_title) document.title = state.page_title;
-    } catch (e) {
-        connected = false;
-        console.warn('dashboard refresh failed', e);
-    } finally {
-        inflight = false;
-        rerender();
-    }
+  if (inflight) return;
+  inflight = true;
+  try {
+    // A custom zoom window overrides the preset range; the server adapts resolution to it. The
+    // averaging window (#168) applies to both — the server selects which window's columns to plot.
+    const base = ui.window
+      ? "from=" + ui.window.from + "&to=" + ui.window.to
+      : "range=" + encodeURIComponent(ui.range);
+    const qs = base + "&avg=" + encodeURIComponent(ui.avg);
+    const res = await fetch("/api/state?" + qs, { headers: { "X-Requested-With": "fetch" } });
+    if (!res.ok) throw new Error("HTTP " + res.status);
+    state = await res.json();
+    connected = true;
+    if (state.page_title) document.title = state.page_title;
+  } catch (e) {
+    connected = false;
+    console.warn("dashboard refresh failed", e);
+  } finally {
+    inflight = false;
+    rerender();
+  }
 }
 
 function setRange(r) {
-    ui.range = r;
-    ui.window = null;   // picking a preset exits any manual zoom
-    history.replaceState(null, '', r === 'all' ? location.pathname : ('?range=' + r));
-    tick();   // re-fetch immediately; the chart/series depend on the range
+  ui.range = r;
+  ui.window = null; // picking a preset exits any manual zoom
+  history.replaceState(null, "", r === "all" ? location.pathname : "?range=" + r);
+  tick(); // re-fetch immediately; the chart/series depend on the range
 }
 
 // Called (debounced) by the chart when a zoom/pan gesture settles: pin the visible window and
 // refetch it from the server at duration-adaptive resolution (Issue #47).
 function setZoom(fromS, toS) {
-    ui.window = { from: fromS, to: toS };
-    history.replaceState(null, '', '?from=' + Math.round(fromS) + '&to=' + Math.round(toS));
-    tick();
+  ui.window = { from: fromS, to: toS };
+  history.replaceState(null, "", "?from=" + Math.round(fromS) + "&to=" + Math.round(toS));
+  tick();
 }
 
 function resetZoom() {
-    ui.window = null;
-    history.replaceState(null, '', ui.range === 'all' ? location.pathname : ('?range=' + ui.range));
-    tick();
+  ui.window = null;
+  history.replaceState(null, "", ui.range === "all" ? location.pathname : "?range=" + ui.range);
+  tick();
 }
 
 function onSort(idx) {
-    ui.sortAsc = (ui.sortIndex === idx) ? !ui.sortAsc : true;
-    ui.sortIndex = idx;
-    rerender();   // client-side sort only, no fetch
+  ui.sortAsc = ui.sortIndex === idx ? !ui.sortAsc : true;
+  ui.sortIndex = idx;
+  rerender(); // client-side sort only, no fetch
 }
 
 function setView(mode) {
-    ui.view = mode;
-    localStorage.setItem('dashboardView', mode);
-    rerender();
+  ui.view = mode;
+  localStorage.setItem("dashboardView", mode);
+  rerender();
 }
 
 function setTheme(theme) {
-    ui.theme = theme;
-    localStorage.setItem('dashboardTheme', theme);
-    applyTheme(theme);   // updates <html data-theme>; the chart recolours on the next render
-    rerender();
+  ui.theme = theme;
+  localStorage.setItem("dashboardTheme", theme);
+  applyTheme(theme); // updates <html data-theme>; the chart recolours on the next render
+  rerender();
 }
 
 function toggleSeries(key) {
-    ui.series = { ...ui.series, [key]: !ui.series[key] };
-    localStorage.setItem('dashboardSeries', JSON.stringify(ui.series));
-    rerender();   // visibility-only; the chart hides/shows the dataset, no refetch needed
+  ui.series = { ...ui.series, [key]: !ui.series[key] };
+  localStorage.setItem("dashboardSeries", JSON.stringify(ui.series));
+  rerender(); // visibility-only; the chart hides/shows the dataset, no refetch needed
 }
 
 // Pick the chart's hashrate-averaging window (#168). Persist it and refetch — the server returns a
 // different per-window series, so (unlike series visibility) this needs a round-trip.
 function setAvgWindow(w) {
-    ui.avg = normalizeAvgWindow(w);
-    localStorage.setItem('dashboardAvgWindow', ui.avg);
-    tick();
+  ui.avg = normalizeAvgWindow(w);
+  localStorage.setItem("dashboardAvgWindow", ui.avg);
+  tick();
 }
 
-applyTheme(ui.theme);            // re-assert the (normalized) theme before the first paint
-rerender();                      // paint the loading shell immediately
-tick();                          // first data load
-setInterval(tick, REFRESH_MS);   // then live updates
+applyTheme(ui.theme); // re-assert the (normalized) theme before the first paint
+rerender(); // paint the loading shell immediately
+tick(); // first data load
+setInterval(tick, REFRESH_MS); // then live updates
diff --git a/build/dashboard/mining_dashboard/web/static/logic.mjs b/build/dashboard/mining_dashboard/web/static/logic.mjs
index 940ad434..8dd644e1 100644
--- a/build/dashboard/mining_dashboard/web/static/logic.mjs
+++ b/build/dashboard/mining_dashboard/web/static/logic.mjs
@@ -7,28 +7,29 @@
 // accepted/rejected share counts sort numerically (raw values the server includes alongside the
 // formatted strings); name sorts as text. The order matches the rendered <th>s.
 export const WORKER_COLUMNS = [
-    { label: 'Worker', key: 'name' },
-    { label: 'IP', key: 'ip_sort' },
-    { label: 'Uptime', key: 'uptime' },
-    { label: '10s', key: 'h10' },
-    { label: '60s', key: 'h60' },
-    { label: '15m', key: 'h15' },
-    { label: 'Accepted', key: 'accepted' },
-    { label: 'Rejected', key: 'rejected' },
+  { label: "Worker", key: "name" },
+  { label: "IP", key: "ip_sort" },
+  { label: "Uptime", key: "uptime" },
+  { label: "10s", key: "h10" },
+  { label: "60s", key: "h60" },
+  { label: "15m", key: "h15" },
+  { label: "Accepted", key: "accepted" },
+  { label: "Rejected", key: "rejected" },
 ];
 
 // Return a new array of workers sorted by the given column index. ``idx == null`` keeps the
 // server's order (online first, then name). Numeric columns compare numerically (so 1000 sorts
 // after 9, not before it); everything else compares as a locale string. Never mutates input.
 export function sortWorkers(workers, idx, asc) {
-    if (idx === null || idx === undefined) return workers;
-    const key = WORKER_COLUMNS[idx].key;
-    const sorted = [...workers].sort((a, b) => {
-        const va = a[key], vb = b[key];
-        if (typeof va === 'number' && typeof vb === 'number') return va - vb;
-        return String(va).localeCompare(String(vb));
-    });
-    return asc ? sorted : sorted.reverse();
+  if (idx === null || idx === undefined) return workers;
+  const key = WORKER_COLUMNS[idx].key;
+  const sorted = [...workers].sort((a, b) => {
+    const va = a[key],
+      vb = b[key];
+    if (typeof va === "number" && typeof vb === "number") return va - vb;
+    return String(va).localeCompare(String(vb));
+  });
+  return asc ? sorted : sorted.reverse();
 }
 
 // Hero KPI band (Issue #81). The headline numbers surfaced as a prominent top strip: each entry
@@ -40,30 +41,36 @@ export function sortWorkers(workers, idx, asc) {
 // raffle to be eligible for), green when fully eligible (donor tier on credited 1h+24h AND a PPLNS
 // share), red otherwise. Kept here (not inline) so both the Hero KPI and the Simple card share it.
 export function raffleCls(raffle) {
-    if (!raffle || !raffle.applies) return '';
-    return raffle.eligible ? 'status-ok' : 'status-bad';
+  if (!raffle || !raffle.applies) return "";
+  return raffle.eligible ? "status-ok" : "status-bad";
 }
 
 export function heroKpis(state) {
-    const hr = state.hashrate, sw = state.shares_window, p = state.pool, raffle = state.raffle_eligible || {};
-    return [
-        { label: 'Total Hashrate', value: hr.total, cls: 'text-accent' },
-        { label: 'Shares in Window', value: sw.count, cls: sw.ok ? 'status-ok' : 'status-bad' },
-        // Raffle Eligible (#158): Yes only when you'd WIN and COLLECT — in a donor tier AND holding a
-        // PPLNS share. Muted "N/A" when XvB is off; red "No" when donating but a gate is unmet.
-        { label: 'Raffle Eligible', value: raffle.label, cls: raffleCls(raffle) },
-        { label: 'Blocks Found', value: p.blocks, cls: '' },
-        { label: 'XvB Tier', value: hr.tier, cls: '' },
-        { label: 'Mining Mode', value: hr.mode_name, cls: 'c-' + hr.mode_variant },
-    ];
+  const hr = state.hashrate,
+    sw = state.shares_window,
+    p = state.pool,
+    raffle = state.raffle_eligible || {};
+  return [
+    { label: "Total Hashrate", value: hr.total, cls: "text-accent" },
+    { label: "Shares in Window", value: sw.count, cls: sw.ok ? "status-ok" : "status-bad" },
+    // Raffle Eligible (#158): Yes only when you'd WIN and COLLECT — in a donor tier AND holding a
+    // PPLNS share. Muted "N/A" when XvB is off; red "No" when donating but a gate is unmet.
+    { label: "Raffle Eligible", value: raffle.label, cls: raffleCls(raffle) },
+    { label: "Blocks Found", value: p.blocks, cls: "" },
+    { label: "XvB Tier", value: hr.tier, cls: "" },
+    { label: "Mining Mode", value: hr.mode_name, cls: "c-" + hr.mode_variant },
+  ];
 }
 
 // Format an epoch-ms x value for the chart tooltip title (Issue #65). Day + time so long ranges
 // read clearly; browser locale (≈ the server's, for a localhost dashboard).
 export function fmtTimestamp(ms) {
-    return new Date(ms).toLocaleString([], {
-        month: 'short', day: 'numeric', hour: '2-digit', minute: '2-digit',
-    });
+  return new Date(ms).toLocaleString([], {
+    month: "short",
+    day: "numeric",
+    hour: "2-digit",
+    minute: "2-digit",
+  });
 }
 
 // Manual chart zoom (Issue #47). Pure window math, kept here (no DOM/Chart) so it's unit-tested;
@@ -75,73 +82,81 @@ export function fmtTimestamp(ms) {
 // degenerate gesture is treated as "no zoom". A too-narrow but valid window is widened around
 // its centre to `minSpanMs` (so you can't request a sub-sample window).
 export function clampZoomWindow(aMs, bMs, minSpanMs = 60000) {
-    if (!Number.isFinite(aMs) || !Number.isFinite(bMs) || aMs === bMs) return null;
-    let from = Math.min(aMs, bMs);
-    let to = Math.max(aMs, bMs);
-    if (to - from < minSpanMs) {
-        const mid = (from + to) / 2;
-        from = mid - minSpanMs / 2;
-        to = mid + minSpanMs / 2;
-    }
-    return { from, to };
+  if (!Number.isFinite(aMs) || !Number.isFinite(bMs) || aMs === bMs) return null;
+  let from = Math.min(aMs, bMs);
+  let to = Math.max(aMs, bMs);
+  if (to - from < minSpanMs) {
+    const mid = (from + to) / 2;
+    from = mid - minSpanMs / 2;
+    to = mid + minSpanMs / 2;
+  }
+  return { from, to };
 }
 
 // Chart series the user can show/hide, and a normalizer for the persisted state (Issue #47).
 // Kept pure so the default-visible logic is unit-tested; dashboard.js persists it in localStorage
 // and chart.mjs applies it. Anything not explicitly false defaults to visible.
-export const SERIES_KEYS = ['p2pool', 'xvb', 'shares'];
+export const SERIES_KEYS = ["p2pool", "xvb", "shares"];
 export function normalizeSeries(obj) {
-    const o = (obj && typeof obj === 'object') ? obj : {};
-    const out = {};
-    for (const k of SERIES_KEYS) out[k] = o[k] !== false;
-    return out;
+  const o = obj && typeof obj === "object" ? obj : {};
+  const out = {};
+  for (const k of SERIES_KEYS) out[k] = o[k] !== false;
+  return out;
 }
 
 // Human-readable span for the "Zoomed: …" label — the two coarsest units from the first
 // non-zero one (e.g. "3d 4h", "1h 20m", "45s"), trailing zero units dropped. Pure and
 // locale-independent, unlike fmtTimestamp.
 export function fmtWindowDuration(ms) {
-    const totalSec = Math.max(0, Math.round(ms / 1000));
-    if (totalSec === 0) return '0s';
-    const units = [['d', 86400], ['h', 3600], ['m', 60], ['s', 1]];
-    const counts = [];
-    let rem = totalSec;
-    for (const [label, size] of units) { counts.push([Math.floor(rem / size), label]); rem %= size; }
-    const first = counts.findIndex(([n]) => n > 0);
-    const parts = [];
-    for (let i = first; i < counts.length && parts.length < 2; i++) {
-        if (counts[i][0] > 0) parts.push(counts[i][0] + counts[i][1]);
-        else if (parts.length > 0) break;   // stop at a trailing zero unit
-    }
-    return parts.join(' ');
+  const totalSec = Math.max(0, Math.round(ms / 1000));
+  if (totalSec === 0) return "0s";
+  const units = [
+    ["d", 86400],
+    ["h", 3600],
+    ["m", 60],
+    ["s", 1],
+  ];
+  const counts = [];
+  let rem = totalSec;
+  for (const [label, size] of units) {
+    counts.push([Math.floor(rem / size), label]);
+    rem %= size;
+  }
+  const first = counts.findIndex(([n]) => n > 0);
+  const parts = [];
+  for (let i = first; i < counts.length && parts.length < 2; i++) {
+    if (counts[i][0] > 0) parts.push(counts[i][0] + counts[i][1]);
+    else if (parts.length > 0) break; // stop at a trailing zero unit
+  }
+  return parts.join(" ");
 }
 
 // Theme switching (Issue #43). Three modes; "auto" follows the browser's prefers-color-scheme.
 // The valid set, display order and labels live here (pure, no DOM) so they're unit-tested; the
 // localStorage + <html data-theme> wiring is in dashboard.js and the segmented control (with its
 // SVG icons) in components.mjs.
-export const THEMES = ['auto', 'light', 'dark'];
-export const THEME_LABELS = { auto: 'Auto', light: 'Light', dark: 'Dark' };
+export const THEMES = ["auto", "light", "dark"];
+export const THEME_LABELS = { auto: "Auto", light: "Light", dark: "Dark" };
 // Left→right order of the segmented control: light · auto · dark (brightness low→high with the
 // system option in the middle).
-export const THEME_ORDER = ['light', 'auto', 'dark'];
+export const THEME_ORDER = ["light", "auto", "dark"];
 
 // Clamp any value (incl. a stale/garbage localStorage entry) to a valid theme; default "auto".
 export function normalizeTheme(t) {
-    return THEMES.includes(t) ? t : 'auto';
+  return THEMES.includes(t) ? t : "auto";
 }
 
 // Hashrate-averaging windows for the chart toggle (#168). The valid set + default live here (pure,
 // no DOM) so they're unit-tested; the localStorage wiring is in dashboard.js and the segmented
 // control (spelled-out labels) in chart.mjs. Keys match the server's `avg` param and
 // config.HASHRATE_WINDOWS.
-export const AVG_WINDOWS = ['1m', '10m', '1h', '12h', '24h'];
-export const DEFAULT_AVG_WINDOW = '10m';
+export const AVG_WINDOWS = ["1m", "10m", "1h", "12h", "24h"];
+export const DEFAULT_AVG_WINDOW = "10m";
 
 // Clamp any value (incl. a stale/garbage localStorage entry) to a valid window; default 10m — the
 // original headline series, so a bad or missing preference reproduces today's chart exactly.
 export function normalizeAvgWindow(w) {
-    return AVG_WINDOWS.includes(w) ? w : DEFAULT_AVG_WINDOW;
+  return AVG_WINDOWS.includes(w) ? w : DEFAULT_AVG_WINDOW;
 }
 
 // Expected-earnings what-if (Issue #12). The server publishes the per-H/s daily XMR *rate*
@@ -150,48 +165,78 @@ export function normalizeAvgWindow(w) {
 // the entered hashrate (and to month/year), and inverts the share difficulty for expected
 // time-to-share — no formula is re-derived here. Kept pure so it's unit-tested (no DOM); the
 // EarningsCard input wiring lives in components.mjs.
-export const DAYS_PER_MONTH = 30;   // estimate convention (not 30.44); a year is 365 days
+export const DAYS_PER_MONTH = 30; // estimate convention (not 30.44); a year is 365 days
 export const DAYS_PER_YEAR = 365;
 
 // Parse a what-if hashrate string into H/s, accepting an optional k/M/G suffix so users can type
 // "10.5k", "1.2 MH/s", or a bare "50000". Returns null for empty/unparseable input (the card then
 // shows "—"). Mirrors helper/utils.parse_hashrate on the server side.
 export function parseHashrate(str) {
-    if (typeof str !== 'string') return null;
-    const m = str.trim().match(/^([0-9]*\.?[0-9]+)\s*([kKmMgG])?/);
-    if (!m) return null;
-    const val = parseFloat(m[1]);
-    if (!Number.isFinite(val) || val < 0) return null;
-    const unit = (m[2] || '').toLowerCase();
-    return val * (unit === 'g' ? 1e9 : unit === 'm' ? 1e6 : unit === 'k' ? 1e3 : 1);
+  if (typeof str !== "string") return null;
+  const m = str.trim().match(/^([0-9]*\.?[0-9]+)\s*([kKmMgG])?/);
+  if (!m) return null;
+  const val = parseFloat(m[1]);
+  if (!Number.isFinite(val) || val < 0) return null;
+  const unit = (m[2] || "").toLowerCase();
+  return val * (unit === "g" ? 1e9 : unit === "m" ? 1e6 : unit === "k" ? 1e3 : 1);
 }
 
 // Scale the server's daily rate to expected XMR over day/month/year for `hashrateHs`, plus the
 // expected seconds to find one P2Pool share (share difficulty / hashrate). Returns nulls when the
 // estimate can't be computed (rate unavailable, or a non-positive hashrate) so the card shows "—".
 export function computeEarnings(hashrateHs, earnings) {
-    if (!earnings || !earnings.available || !(hashrateHs > 0)) {
-        return { day: null, month: null, year: null, timeToShareSec: null };
-    }
-    const day = hashrateHs * earnings.coeff_day;
-    const tts = earnings.pool_difficulty > 0 ? earnings.pool_difficulty / hashrateHs : null;
-    return { day, month: day * DAYS_PER_MONTH, year: day * DAYS_PER_YEAR, timeToShareSec: tts };
+  if (!earnings || !earnings.available || !(hashrateHs > 0)) {
+    return { day: null, month: null, year: null, timeToShareSec: null };
+  }
+  const day = hashrateHs * earnings.coeff_day;
+  const tts = earnings.pool_difficulty > 0 ? earnings.pool_difficulty / hashrateHs : null;
+  return { day, month: day * DAYS_PER_MONTH, year: day * DAYS_PER_YEAR, timeToShareSec: tts };
 }
 
 // Format a client-computed XMR amount. More decimal places for small amounts (a day's earnings can
 // be a tiny fraction) so the figure isn't rounded to "0.0000"; "—" for the null/invalid case.
 export function formatXmr(xmr) {
-    if (xmr === null || xmr === undefined || !Number.isFinite(xmr)) return '—';
-    if (xmr === 0) return '0 XMR';
-    const dp = xmr >= 1 ? 4 : xmr >= 0.001 ? 6 : 8;
-    return xmr.toFixed(dp) + ' XMR';
+  if (xmr === null || xmr === undefined || !Number.isFinite(xmr)) return "—";
+  if (xmr === 0) return "0 XMR";
+  const dp = xmr >= 1 ? 4 : xmr >= 0.001 ? 6 : 8;
+  return xmr.toFixed(dp) + " XMR";
 }
 
 // Format the expected time-to-share (seconds) for display; "—" when not computable. Reuses the
 // two-coarsest-units duration formatter (e.g. "3d 4h", "1h 20m").
 export function formatTimeToShare(sec) {
-    if (sec === null || sec === undefined || !Number.isFinite(sec) || sec <= 0) return '—';
-    return fmtWindowDuration(sec * 1000);
+  if (sec === null || sec === undefined || !Number.isFinite(sec) || sec <= 0) return "—";
+  return fmtWindowDuration(sec * 1000);
+}
+
+// Egress posture (#170): map a connection's route token to a display glyph + label + CSS token for
+// the Component Health panel. The server (service/egress.py) derives the route from live config; the
+// client only maps it to presentation, no logic of its own (the #61 principle).
+export const EGRESS_ROUTES = {
+  tor: { icon: "🧅", label: "Tor", cls: "ok" },
+  clearnet: { icon: "🌐", label: "Clearnet", cls: "bad" },
+  local: { icon: "🏠", label: "Local/LAN", cls: "muted" },
+  inactive: { icon: "⚪", label: "Inactive", cls: "muted" },
+};
+
+export function egressRoute(route) {
+  return EGRESS_ROUTES[route] || { icon: "❔", label: route || "unknown", cls: "muted" };
+}
+
+// Topology edge routing (#170): the point on a node box's border heading toward a target point, so
+// a connector starts/ends flush on the box edge (not its centre). Pure geometry — `node` is
+// {x, y, w, h}; (tx, ty) the target centre. Used by the StackTopology SVG and unit-tested directly.
+export function boxAnchor(node, tx, ty) {
+  const cx = node.x + node.w / 2;
+  const cy = node.y + node.h / 2;
+  const dx = tx - cx;
+  const dy = ty - cy;
+  if (dx === 0 && dy === 0) return { x: cx, y: cy };
+  // Scale the direction vector until it hits the nearest border (half-width / half-height).
+  const sx = dx !== 0 ? node.w / 2 / Math.abs(dx) : Infinity;
+  const sy = dy !== 0 ? node.h / 2 / Math.abs(dy) : Infinity;
+  const s = Math.min(sx, sy);
+  return { x: cx + dx * s, y: cy + dy * s };
 }
 
 // Width of a stacked hashrate band's top border-line for one chart segment. Returns 0 when the band
@@ -201,9 +246,9 @@ export function formatTimeToShare(sec) {
 // the Chart.js line-segment context (p0DataIndex / p1DataIndex). Partial-zero spans are handled
 // per-segment, so a window that's only briefly all-one-pool still hides just the zero stretch.
 export function bandBorderWidth(series, ctx, fullWidth) {
-    const y0 = series[ctx.p0DataIndex]?.y;
-    const y1 = series[ctx.p1DataIndex]?.y;
-    return (y0 === 0 && y1 === 0) ? 0 : fullWidth;
+  const y0 = series[ctx.p0DataIndex]?.y;
+  const y1 = series[ctx.p1DataIndex]?.y;
+  return y0 === 0 && y1 === 0 ? 0 : fullWidth;
 }
 
 // What to show in a worker's "Uptime" cell. For an online worker it's the real uptime; for an
@@ -211,5 +256,5 @@ export function bandBorderWidth(series, ctx, fullWidth) {
 // and read like uptime when it was really downtime (#169). The raw numeric `uptime` is left on the
 // row for client-side column sorting; only the displayed string changes.
 export function uptimeCell(worker) {
-    return worker.status === 'online' ? worker.uptime_str : 'DOWN';
+  return worker.status === "online" ? worker.uptime_str : "DOWN";
 }
diff --git a/build/dashboard/mining_dashboard/web/static/preact.mjs b/build/dashboard/mining_dashboard/web/static/preact.mjs
index be266d7f..0c231c1a 100644
--- a/build/dashboard/mining_dashboard/web/static/preact.mjs
+++ b/build/dashboard/mining_dashboard/web/static/preact.mjs
@@ -2,9 +2,10 @@
 // Preact + the `html` tagged-template (htm bound to Preact's `h`) from here, so there's one
 // htm binding and one place that references the vendored files. All same-origin ES modules,
 // no bare specifiers, no eval — loads cleanly under script-src 'self' (no unsafe-inline/eval).
-import { h, render, Component, Fragment, createRef } from './vendor/preact.module.js';
-import htm from './vendor/htm.module.js';
+
+import htm from "./vendor/htm.module.js";
+import { Component, createRef, Fragment, h, render } from "./vendor/preact.module.js";
 
 const html = htm.bind(h);
 
-export { h, render, Component, Fragment, createRef, html };
+export { Component, createRef, Fragment, h, html, render };
diff --git a/build/dashboard/mining_dashboard/web/static/theme-init.js b/build/dashboard/mining_dashboard/web/static/theme-init.js
index 8ae3a325..e8d3c1f5 100644
--- a/build/dashboard/mining_dashboard/web/static/theme-init.js
+++ b/build/dashboard/mining_dashboard/web/static/theme-init.js
@@ -8,13 +8,13 @@
 // It only sets the attribute the CSS reacts to; dashboard.js owns the live toggle and keeps
 // localStorage in sync. An unset/unknown value is left alone — the CSS default is "auto"
 // (follow prefers-color-scheme), so nothing to do.
-(function () {
-    try {
-        var t = localStorage.getItem('dashboardTheme');
-        if (t === 'light' || t === 'dark' || t === 'auto') {
-            document.documentElement.setAttribute('data-theme', t);
-        }
-    } catch (e) {
-        /* localStorage blocked (e.g. privacy mode) — fall back to the CSS default (auto). */
+(() => {
+  try {
+    const t = localStorage.getItem("dashboardTheme");
+    if (t === "light" || t === "dark" || t === "auto") {
+      document.documentElement.setAttribute("data-theme", t);
     }
+  } catch {
+    /* localStorage blocked (e.g. privacy mode) — fall back to the CSS default (auto). */
+  }
 })();
diff --git a/build/dashboard/mining_dashboard/web/static/topology.mjs b/build/dashboard/mining_dashboard/web/static/topology.mjs
new file mode 100644
index 00000000..487fed6a
--- /dev/null
+++ b/build/dashboard/mining_dashboard/web/static/topology.mjs
@@ -0,0 +1,140 @@
+// Stack topology (#170, trust-boundary view). A data-driven SVG of the whole stack: every component
+// is a node, every connection an edge coloured by the route the server derived from live config
+// (service/egress.py · compute_topology). Tor = green; clearnet = red and lands on the `internet`
+// node so a leak visibly BYPASSES the Tor hub; local/LAN = grey. The P2P daemons get a double arrow
+// (egress + onion ingress). The internal host-only mesh is hidden until expanded, so the default
+// view stays focused on what crosses the trust boundary. Geometry is pure (boxAnchor, logic.mjs);
+// this file is presentation only — it carries no routing logic of its own (the #61 principle).
+
+import { boxAnchor } from "./logic.mjs";
+import { Component, html } from "./preact.mjs";
+
+// Fixed layout — the stack is a known, fixed set of components, so positions are hand-placed
+// (left→right by trust: your LAN, the host bridge, the Tor hub, the internet) rather than solved.
+export const POS = {
+  rigs: { x: 12, y: 64, w: 88, h: 32 },
+  browser: { x: 12, y: 150, w: 88, h: 32 },
+  "xmrig-proxy": { x: 132, y: 64, w: 104, h: 32 },
+  caddy: { x: 132, y: 150, w: 104, h: 32 },
+  dashboard: { x: 132, y: 226, w: 104, h: 32 },
+  p2pool: { x: 262, y: 64, w: 92, h: 32 },
+  monerod: { x: 262, y: 150, w: 92, h: 32 },
+  tari: { x: 262, y: 226, w: 92, h: 32 },
+  docker: { x: 262, y: 282, w: 92, h: 26 },
+  tor: { x: 392, y: 96, w: 96, h: 40 },
+  internet: { x: 392, y: 220, w: 96, h: 36 },
+};
+
+export const ROUTE_COLOR = {
+  tor: "var(--ok)",
+  clearnet: "var(--bad)",
+  local: "var(--text-muted)",
+  inactive: "var(--text-muted)",
+};
+export const ROUTE_NAME = {
+  tor: "Tor",
+  clearnet: "Clearnet",
+  local: "Local/LAN",
+  inactive: "Inactive",
+};
+const ROUTES = ["tor", "clearnet", "local", "inactive"];
+
+const center = (n) => ({ x: n.x + n.w / 2, y: n.y + n.h / 2 });
+const nodeCls = (zone) =>
+  zone === "tor" ? "topo-node topo-hub" : zone === "host" ? "topo-node" : "topo-node topo-ext";
+
+// SVG path for an edge. Most edges are a straight border-to-border segment; the three that would
+// otherwise cross the daemon column are routed orthogonally through a clear lane (xmrig-proxy and
+// dashboard reach the Tor hub over the top / under the bottom; p2pool→tari skips monerod between
+// them). Lanes: y=42 (top), y=312 (bottom), x=372 (right gutter), x=254 (left gutter).
+export function edgePath(e, a, b) {
+  if (e.from === "xmrig-proxy" && (e.to === "tor" || e.to === "internet")) {
+    return `M${a.x + a.w / 2},${a.y} V42 H372 V${b.y + b.h / 2} H${b.x}`;
+  }
+  if (e.from === "dashboard" && (e.to === "tor" || e.to === "internet")) {
+    return `M${a.x + a.w / 2},${a.y + a.h} V312 H372 V${b.y + b.h / 2} H${b.x}`;
+  }
+  if (e.from === "p2pool" && e.to === "tari") {
+    return `M${a.x},${a.y + a.h / 2} H254 V${b.y + b.h / 2} H${b.x}`;
+  }
+  const ac = center(a);
+  const bc = center(b);
+  const s = boxAnchor(a, bc.x, bc.y);
+  const t = boxAnchor(b, ac.x, ac.y);
+  return `M${s.x},${s.y} L${t.x},${t.y}`;
+}
+
+export class StackTopology extends Component {
+  constructor(props) {
+    super(props);
+    this.state = { internal: false };
+  }
+
+  render({ topology }, { internal }) {
+    if (!topology) return null;
+    const nodes = topology.nodes.filter((n) => internal || !n.internal);
+    const edges = topology.edges.filter((e) => internal || e.kind !== "internal");
+    const byId = {};
+    for (const n of topology.nodes) byId[n.id] = n;
+
+    return html`
+      <div class="topology">
+        <div class="topo-controls">
+          <span class="topo-legend"><i class="topo-sw" style="background:var(--ok)"></i>Tor</span>
+          <span class="topo-legend"><i class="topo-sw" style="background:var(--bad)"></i>Clearnet</span>
+          <span class="topo-legend"><i class="topo-sw" style="background:var(--text-muted)"></i>Local / LAN</span>
+          <button class="topo-toggle" onClick=${() => this.setState({ internal: !internal })}>
+            ${internal ? "Hide internal mesh" : "Show internal mesh"}
+          </button>
+        </div>
+        <svg viewBox="0 0 500 322" class="topo-svg" role="img"
+             aria-label="Stack network topology: each component and its connections, coloured green for Tor and red for clearnet.">
+          <defs>
+            ${ROUTES.map(
+              (r) => html`
+                <marker id=${"topo-a-" + r} markerWidth="7" markerHeight="7" refX="6" refY="3" orient="auto">
+                  <path d="M0,0 L6,3 L0,6 Z" fill=${ROUTE_COLOR[r]} />
+                </marker>
+                <marker id=${"topo-s-" + r} markerWidth="7" markerHeight="7" refX="1" refY="3" orient="auto">
+                  <path d="M6,0 L0,3 L6,6 Z" fill=${ROUTE_COLOR[r]} />
+                </marker>`,
+            )}
+          </defs>
+          <text x="56" y="20" class="topo-zone">LAN</text>
+          <text x="243" y="20" class="topo-zone">host — mining_net bridge</text>
+          <text x="440" y="20" class="topo-zone">Tor → internet</text>
+          ${edges.map((e) => this._edge(e, byId)).filter(Boolean)}
+          ${nodes.map((n) => {
+            const p = POS[n.id];
+            if (!p) return null;
+            return html`
+              <g class=${nodeCls(n.zone)}>
+                <rect x=${p.x} y=${p.y} width=${p.w} height=${p.h} rx="6" />
+                <text x=${p.x + p.w / 2} y=${p.y + p.h / 2 + 4} text-anchor="middle">${n.label}</text>
+              </g>`;
+          })}
+        </svg>
+      </div>`;
+  }
+
+  _edge(e, byId) {
+    const a = POS[e.from];
+    const b = POS[e.to];
+    if (!a || !b) return null;
+    const key = e.leak ? "clearnet" : e.route;
+    const color = ROUTE_COLOR[key] || ROUTE_COLOR.local;
+    const dash = e.kind === "internal" ? "3 3" : e.blocked_by_firewall ? "2 3" : null;
+    const note = e.leak ? " — LEAK" : e.blocked_by_firewall ? " — firewall-blocked" : "";
+    const from = byId[e.from]?.label || e.from;
+    const to = byId[e.to]?.label || e.to;
+    const tip = `${from} → ${to}: ${e.label} · ${ROUTE_NAME[key] || key}${note}`;
+    return html`
+      <path d=${edgePath(e, a, b)} fill="none"
+            stroke=${color} stroke-width=${e.kind === "internal" ? 1 : 1.8}
+            stroke-dasharray=${dash} opacity=${e.route === "inactive" ? 0.4 : 1}
+            marker-end=${"url(#topo-a-" + key + ")"}
+            marker-start=${e.kind === "p2p" ? "url(#topo-s-" + key + ")" : null}>
+        <title>${tip}</title>
+      </path>`;
+  }
+}
diff --git a/build/dashboard/mining_dashboard/web/static/vendor/README.md b/build/dashboard/mining_dashboard/web/static/vendor/README.md
index 6372fe41..e132db00 100644
--- a/build/dashboard/mining_dashboard/web/static/vendor/README.md
+++ b/build/dashboard/mining_dashboard/web/static/vendor/README.md
@@ -5,13 +5,16 @@ step and serves entirely from `/static` under a strict Content-Security-Policy
 (`script-src 'self'`, no `'unsafe-inline'`/`'unsafe-eval'`). Both are standalone ES modules
 with no bare imports and no `eval`/`new Function`, so they load and run under that CSP.
 
-| File                | Package  | Version | Source                                               |
-|---------------------|----------|---------|------------------------------------------------------|
-| `preact.module.js`  | preact   | 10.24.3 | https://unpkg.com/preact@10.24.3/dist/preact.module.js |
-| `htm.module.js`     | htm      | 3.1.1   | https://unpkg.com/htm@3.1.1/dist/htm.module.js         |
-| `chart.umd.min.js`  | chart.js | (vendored previously) | https://www.chartjs.org/                 |
-| `chartjs-plugin-zoom.min.js` | chartjs-plugin-zoom | 2.2.0 | https://unpkg.com/chartjs-plugin-zoom@2.2.0/dist/chartjs-plugin-zoom.min.js |
-| `hammer.min.js`     | hammerjs | 2.0.8 | https://unpkg.com/hammerjs@2.0.8/hammer.min.js |
+| File                | Package  | Version | License | Source                                     |
+|---------------------|----------|---------|---------|--------------------------------------------|
+| `preact.module.js`  | preact   | 10.24.3 | MIT | <https://unpkg.com/preact@10.24.3/dist/preact.module.js> |
+| `htm.module.js`     | htm      | 3.1.1   | Apache-2.0 | <https://unpkg.com/htm@3.1.1/dist/htm.module.js>     |
+| `chart.umd.min.js`  | chart.js | 4.4.6 | MIT | <https://www.chartjs.org/>                             |
+| `chartjs-plugin-zoom.min.js` | chartjs-plugin-zoom | 2.2.0 | MIT | <https://unpkg.com/chartjs-plugin-zoom@2.2.0/dist/chartjs-plugin-zoom.min.js> |
+| `hammer.min.js`     | hammerjs | 2.0.8 | MIT | <https://unpkg.com/hammerjs@2.0.8/hammer.min.js> |
+
+These licenses are also recorded in the repo-root `THIRD_PARTY_LICENSES.md`. `chart.umd.min.js`
+lives one directory up (in `static/`, not `vendor/`); listed here so the attribution is complete.
 
 `chartjs-plugin-zoom` is a UMD bundle (like `chart.umd.min.js`), loaded as a classic `<script>`
 after Chart.js; it exposes the global `ChartZoom` and is registered explicitly via
diff --git a/build/dashboard/mining_dashboard/web/views.py b/build/dashboard/mining_dashboard/web/views.py
index eb53911a..d86ce802 100644
--- a/build/dashboard/mining_dashboard/web/views.py
+++ b/build/dashboard/mining_dashboard/web/views.py
@@ -9,27 +9,38 @@
 ``build_state`` is the single assembly point and the contract the ``/api/state`` endpoint and
 the client share; ``server.py`` stays pure transport.
 """
-import os
-import math
-import time
+
 import bisect
 import logging
+import math
+import os
+import time
 
 from mining_dashboard.config.config import (
-    HOST_IP, UPDATE_INTERVAL, DISK_WARN_PERCENT, DISK_CRITICAL_PERCENT,
-    HASHRATE_WINDOWS, DEFAULT_HASHRATE_WINDOW, HASHRATE_WINDOW_COLUMNS,
+    DEFAULT_HASHRATE_WINDOW,
+    DISK_CRITICAL_PERCENT,
+    DISK_WARN_PERCENT,
+    HASHRATE_WINDOW_COLUMNS,
+    HASHRATE_WINDOWS,
+    HOST_IP,
+    UPDATE_INTERVAL,
 )
 from mining_dashboard.helper.utils import (
-    format_hashrate, format_duration, format_time_abs, is_ip_address, detect_host_ipv4,
+    detect_host_ipv4,
+    format_duration,
+    format_hashrate,
+    format_time_abs,
+    is_ip_address,
 )
-from mining_dashboard.service.metrics import build_metrics
 from mining_dashboard.service.earnings import xmr_per_hs_day
+from mining_dashboard.service.egress import egress_posture_from_config, topology_from_config
+from mining_dashboard.service.metrics import build_metrics
 from mining_dashboard.version import resolve_version
 
 logger = logging.getLogger("WebViews")
 
 # Preset range -> window length in seconds. 'all'/unknown -> use the data's own extent.
-_RANGE_SECONDS = {'1h': 3600, '24h': 86400, '1w': 604800, '1m': 2592000}
+_RANGE_SECONDS = {"1h": 3600, "24h": 86400, "1w": 604800, "1m": 2592000}
 
 # Adaptive chart resolution (Issue #47). Point count and line smoothing are chosen from the
 # *visible window duration*: a wide span is a smooth, high-level overview (fewer points, more
@@ -37,11 +48,11 @@
 # is capped near the canvas pixel width — more points than pixels just slows hit-testing.
 # (limit_seconds, target_points); 0 target = send native resolution (no downsampling).
 _POINT_TIERS = ((3600, 0), (21600, 360), (86400, 480), (604800, 600))
-_MAX_CHART_POINTS = 700   # > 1w, and the hard ceiling (~1 point per canvas pixel)
+_MAX_CHART_POINTS = 700  # > 1w, and the hard ceiling (~1 point per canvas pixel)
 
 # (limit_seconds, tension). Chart.js line tension = curve smoothing.
 _TENSION_TIERS = ((3600, 0.0), (86400, 0.2), (604800, 0.35))
-_MAX_TENSION = 0.4        # > 1w: smooth / high-level
+_MAX_TENSION = 0.4  # > 1w: smooth / high-level
 
 
 def _target_points(duration_s):
@@ -74,6 +85,7 @@ def parse_window(from_arg, to_arg):
         return None
     return (lo, hi)
 
+
 # A run of missing samples longer than this is drawn as a real break in the line rather than a
 # segment spanning the outage (Issue #65). Adaptive: a multiple of the series' own median
 # spacing (so it works for both live 30s samples and heavily downsampled long ranges), floored
@@ -82,18 +94,35 @@ def parse_window(from_arg, to_arg):
 
 # Pool/mode palette *tokens* -> CSS colour classes on the client (``.c-<token>``/``.bg-<token>``).
 # The active pool is coloured, the inactive one muted (Issue #27).
-_TOKEN_GREEN = "ok"       # P2Pool active
-_TOKEN_PURPLE = "purple"  # XvB active
-_TOKEN_BLUE = "accent"    # split / neutral mode
-_TOKEN_MUTED = "muted"    # inactive pool
+_TOKEN_GREEN = "ok"  # P2Pool active  # noqa: S105 — CSS palette token, not a secret
+_TOKEN_PURPLE = "purple"  # XvB active  # noqa: S105
+_TOKEN_BLUE = "accent"  # split / neutral mode  # noqa: S105
+_TOKEN_MUTED = "muted"  # inactive pool  # noqa: S105
 
-_LOW_HR_TITLE = ("Your hashrate can't sustain the selected XvB donation tier; "
-                 "donation will fall short of it.")
+_LOW_HR_TITLE = (
+    "Your hashrate can't sustain the selected XvB donation tier; donation will fall short of it."
+)
 
-_NOT_ELIGIBLE_TITLE = ("You have no share in the P2Pool PPLNS window, so you're not eligible to collect "
-                       "an XvB raffle win (what XvB calls being a \"VIP\"). If you win a round you're "
-                       "skipped and take a fail (removed from the raffle after the 3rd) — regardless of "
-                       "your donation tier. Keep enough hashrate on P2Pool to keep landing shares.")
+_NOT_ELIGIBLE_TITLE = (
+    "You have no share in the P2Pool PPLNS window, so you're not eligible to collect "
+    'an XvB raffle win (what XvB calls being a "VIP"). If you win a round you\'re '
+    "skipped and take a fail (removed from the raffle after the 3rd) — regardless of "
+    "your donation tier. Keep enough hashrate on P2Pool to keep landing shares."
+)
+
+# XvB raffle auto-registration status (#263).
+_XVB_REGISTERED_TITLE = (
+    "This wallet is auto-registered with the XMRvsBeast raffle. Re-registration runs periodically; "
+    "no manual signup is needed."
+)
+_XVB_INVALID_TITLE = (
+    "The XvB raffle endpoint rejected your wallet as invalid, so you won't be entered. The raffle "
+    "needs a standard primary Monero address (starts with 4). Check MONERO_WALLET_ADDRESS."
+)
+_XVB_FAILING_TITLE = (
+    "XvB raffle registration keeps failing despite a PPLNS share — the endpoint may be unreachable "
+    "or erroring. Check the dashboard logs and the XvB egress (Tor) path."
+)
 
 
 def build_raffle_eligibility(metrics):
@@ -121,6 +150,7 @@ def build_raffle_eligibility(metrics):
 # Chart series (Issue #65: positioned by real time, with outage gaps as breaks).
 # --------------------------------------------------------------------------------------
 
+
 def build_chart(history, shares, range_arg, window=None, avg_window=DEFAULT_HASHRATE_WINDOW):
     """Build the Chart.js datasets from history. Each point carries its real timestamp as the
     x value (epoch ms) so a linear time axis spaces points to scale; runs of missing samples
@@ -139,7 +169,7 @@ def build_chart(history, shares, range_arg, window=None, avg_window=DEFAULT_HASH
     duration_s = _window_duration(filtered_history, range_arg, window)
     filtered_history = _downsample_history(filtered_history, duration_s)
 
-    timestamps = [x['timestamp'] for x in filtered_history]
+    timestamps = [x["timestamp"] for x in filtered_history]
     gap_after = _gap_after_indices(timestamps)
 
     p2pool = []
@@ -154,9 +184,12 @@ def build_chart(history, shares, range_arg, window=None, avg_window=DEFAULT_HASH
             p2pool.append({"x": mid_ms, "y": None})
             xvb.append({"x": mid_ms, "y": None})
 
-    return {"p2pool": p2pool, "xvb": xvb,
-            "shares": _share_points(filtered_history, filtered_shares),
-            "tension": _chart_tension(duration_s)}
+    return {
+        "p2pool": p2pool,
+        "xvb": xvb,
+        "shares": _share_points(filtered_history, filtered_shares),
+        "tension": _chart_tension(duration_s),
+    }
 
 
 def _filter_range(history, shares, range_arg, window=None):
@@ -165,16 +198,20 @@ def _filter_range(history, shares, range_arg, window=None):
     keeps everything)."""
     if window is not None:
         lo, hi = window
-        return ([x for x in history if lo <= x['timestamp'] <= hi],
-                [s for s in shares if lo <= s['ts'] <= hi])
-    if range_arg == 'all':
+        return (
+            [x for x in history if lo <= x["timestamp"] <= hi],
+            [s for s in shares if lo <= s["ts"] <= hi],
+        )
+    if range_arg == "all":
         return history, shares
     target_seconds = _RANGE_SECONDS.get(range_arg, 0)
     if target_seconds <= 0:
         return history, shares
     cutoff = time.time() - target_seconds
-    return ([x for x in history if x['timestamp'] >= cutoff],
-            [s for s in shares if s['ts'] >= cutoff])
+    return (
+        [x for x in history if x["timestamp"] >= cutoff],
+        [s for s in shares if s["ts"] >= cutoff],
+    )
 
 
 def _window_duration(filtered_history, range_arg, window):
@@ -186,7 +223,7 @@ def _window_duration(filtered_history, range_arg, window):
     if secs > 0:
         return secs
     if len(filtered_history) >= 2:
-        return filtered_history[-1]['timestamp'] - filtered_history[0]['timestamp']
+        return filtered_history[-1]["timestamp"] - filtered_history[0]["timestamp"]
     return 0
 
 
@@ -196,12 +233,14 @@ def _split_values(x, avg_window=DEFAULT_HASHRATE_WINDOW):
     Defaults to 10m — the original headline series — which also keeps the legacy-data fallback
     (older rows stored only the un-split total ``v``). The other windows read their own columns,
     which are 0 on pre-#168 rows (per-window capture is forward-only)."""
-    p_col, x_col = HASHRATE_WINDOW_COLUMNS.get(avg_window, HASHRATE_WINDOW_COLUMNS[DEFAULT_HASHRATE_WINDOW])
+    p_col, x_col = HASHRATE_WINDOW_COLUMNS.get(
+        avg_window, HASHRATE_WINDOW_COLUMNS[DEFAULT_HASHRATE_WINDOW]
+    )
     vp = x.get(p_col, 0) or 0
     vx = x.get(x_col, 0) or 0
     # The fallback only makes sense for the default window, where ``v`` is that window's total.
     if avg_window == DEFAULT_HASHRATE_WINDOW and vp == 0 and vx == 0:
-        v = x.get('v', 0)
+        v = x.get("v", 0)
         if v > 0:
             vp = v
     return vp, vx
@@ -228,9 +267,9 @@ def _gap_after_indices(timestamps):
 # bucket-averaged automatically instead of being silently dropped. (Bug: the old downsampler kept
 # only v/v_p2pool/v_xvb, so the 1m/1h/12h/24h Avg series went flat at 0 on any range wide enough to
 # downsample — e.g. the 24h/1w/1mo ranges — while the default 10m window happened to survive.)
-_DOWNSAMPLE_VALUE_COLUMNS = tuple(dict.fromkeys(
-    ("v",) + tuple(col for cols in HASHRATE_WINDOW_COLUMNS.values() for col in cols)
-))
+_DOWNSAMPLE_VALUE_COLUMNS = tuple(
+    dict.fromkeys(("v",) + tuple(col for cols in HASHRATE_WINDOW_COLUMNS.values() for col in cols))
+)
 
 
 def _downsample_history(filtered_history, duration_s):
@@ -245,11 +284,11 @@ def _downsample_history(filtered_history, duration_s):
     chunk_size = len(filtered_history) / target
     downsampled = []
     for i in range(target):
-        chunk = filtered_history[int(i * chunk_size):int((i + 1) * chunk_size)]
+        chunk = filtered_history[int(i * chunk_size) : int((i + 1) * chunk_size)]
         if not chunk:
             continue
         mid = chunk[len(chunk) // 2]
-        row = {'t': mid['t'], 'timestamp': mid['timestamp']}
+        row = {"t": mid["t"], "timestamp": mid["timestamp"]}
         for col in _DOWNSAMPLE_VALUE_COLUMNS:
             row[col] = round(sum(x.get(col, 0) or 0 for x in chunk) / len(chunk), 2)
         downsampled.append(row)
@@ -270,14 +309,16 @@ def _share_points(filtered_history, filtered_shares):
     if not (filtered_history and filtered_shares):
         return []
 
-    hist_ts = [x['timestamp'] for x in filtered_history]
+    hist_ts = [x["timestamp"] for x in filtered_history]
     counts = {}
     for s in filtered_shares:
-        s_ts = s['ts']
+        s_ts = s["ts"]
         idx = bisect.bisect_left(hist_ts, s_ts)
         candidates = []
-        if idx < len(hist_ts): candidates.append(idx)
-        if idx > 0: candidates.append(idx - 1)
+        if idx < len(hist_ts):
+            candidates.append(idx)
+        if idx > 0:
+            candidates.append(idx - 1)
         if candidates:
             closest_idx = min(candidates, key=lambda i: abs(hist_ts[i] - s_ts))
             counts[closest_idx] = counts.get(closest_idx, 0) + 1
@@ -287,12 +328,14 @@ def _share_points(filtered_history, filtered_shares):
         count = counts[idx]
         # y is fixed (a fraction of the dedicated 0–1 share axis): the marker no longer tracks the
         # hashrate, so it never stretches the y-range. Radius still scales with the share count.
-        points.append({
-            "x": int(hist_ts[idx] * 1000),
-            "y": _SHARE_MARKER_Y,
-            "r": min(6 + (count * 3), 15),
-            "c": count,
-        })
+        points.append(
+            {
+                "x": int(hist_ts[idx] * 1000),
+                "y": _SHARE_MARKER_Y,
+                "r": min(6 + (count * 3), 15),
+                "c": count,
+            }
+        )
     return points
 
 
@@ -300,14 +343,15 @@ def _share_points(filtered_history, filtered_shares):
 # Section builders: Metrics (+ passthrough) -> display data.
 # --------------------------------------------------------------------------------------
 
+
 def _mode_palette(current_mode):
     """(mode, p2p, xvb) palette tokens for the algo mode. Checked most-specific first:
     "XVB (Split)" contains both "Split" and "XVB"."""
     if "Split" in current_mode:
-        return _TOKEN_BLUE, _TOKEN_GREEN, _TOKEN_PURPLE   # both pools active
+        return _TOKEN_BLUE, _TOKEN_GREEN, _TOKEN_PURPLE  # both pools active
     if "XVB" in current_mode:
         return _TOKEN_PURPLE, _TOKEN_MUTED, _TOKEN_PURPLE
-    return _TOKEN_GREEN, _TOKEN_GREEN, _TOKEN_MUTED        # P2POOL
+    return _TOKEN_GREEN, _TOKEN_GREEN, _TOKEN_MUTED  # P2POOL
 
 
 def build_hashrate(metrics, mode_tok, p2p_tok, xvb_tok):
@@ -330,62 +374,70 @@ def build_hashrate(metrics, mode_tok, p2p_tok, xvb_tok):
         "target_tier": metrics.target_tier,
         "xvb_fail_count": metrics.xvb_fail_count,
         "xvb_updated": format_time_abs(metrics.xvb_last_update),
-        "low_hr": {"text": "⚠ Hashrate low for tier", "title": _LOW_HR_TITLE} if metrics.low_hr_warning else None,
+        # Credited 1h/24h are frozen while the fetch is stale (#311) — the UI greys
+        # them and flags the "Updated" line so the operator isn't misled by stale data.
+        "xvb_stale": metrics.xvb_stale,
+        "low_hr": {"text": "⚠ Hashrate low for tier", "title": _LOW_HR_TITLE}
+        if metrics.low_hr_warning
+        else None,
     }
 
 
 def build_pool_network(data, metrics):
     """P2Pool / Stratum / Monero-network display values (computed bits come from Metrics)."""
-    stratum = data.get('stratum', {})
-    local_pool = data.get('pool', {}).get('pool', {})
-    p2p = data.get('pool', {}).get('p2p', {})
-    network = data.get('network', {})
-    s_addr = stratum.get('wallet', 'Unknown')
+    stratum = data.get("stratum", {})
+    local_pool = data.get("pool", {}).get("pool", {})
+    p2p = data.get("pool", {}).get("p2p", {})
+    network = data.get("network", {})
+    s_addr = stratum.get("wallet", "Unknown")
 
     return {
         "stratum": {
             "h15": format_hashrate(metrics.stratum_h15),
             "h1h": format_hashrate(metrics.stratum_h1h),
             "h24h": format_hashrate(metrics.stratum_h24h),
-            "shares": f"{stratum.get('shares_found',0)} / {stratum.get('shares_failed',0)}",
+            "shares": f"{stratum.get('shares_found', 0)} / {stratum.get('shares_failed', 0)}",
             "effort": f"{stratum.get('current_effort', 0):.1f}%",
-            "total_shares": stratum.get('total_stratum_shares', 0),
+            "total_shares": stratum.get("total_stratum_shares", 0),
             "reward_pct": f"{stratum.get('block_reward_share_percent', 0):.4f}%",
-            "conns": stratum.get('connections', 0),
-            "last_share": format_time_abs(stratum.get('last_share_found_time', 0)),
-            "total_hashes": stratum.get('total_hashes', 0),
+            "conns": stratum.get("connections", 0),
+            "last_share": format_time_abs(stratum.get("last_share_found_time", 0)),
+            "total_hashes": stratum.get("total_hashes", 0),
             "wallet": s_addr,
             "wallet_short": _shorten(s_addr),
         },
         "pool": {
             "type": metrics.pool_type,
-            "sidechain_height": local_pool.get('sidechain_height', 0),
-            "diff": f"{metrics.pool_difficulty/1e6:.2f} M",
+            "sidechain_height": local_pool.get("sidechain_height", 0),
+            "diff": f"{metrics.pool_difficulty / 1e6:.2f} M",
             "hr": format_hashrate(metrics.pool_hashrate),
-            "total_hashes": local_pool.get('total_hashes', 0),
-            "miners": local_pool.get('miners', 0),
+            "total_hashes": local_pool.get("total_hashes", 0),
+            "miners": local_pool.get("miners", 0),
             "pplns_win": f"{metrics.pplns_window} ({format_duration(metrics.pplns_window * metrics.block_time)})",
-            "pplns_wgt": local_pool.get('pplns_weight', 0),
-            "blocks": local_pool.get('blocks_found', 0),
-            "last_blk": format_time_abs(local_pool.get('last_block_ts', 0)),
-            "peers": f"{p2p.get('out_peers',0)} / {p2p.get('in_peers',0)}",
-            "uptime": format_duration(p2p.get('uptime', 0)),
+            "pplns_wgt": local_pool.get("pplns_weight", 0),
+            "blocks": local_pool.get("blocks_found", 0),
+            "last_blk": format_time_abs(local_pool.get("last_block_ts", 0)),
+            "peers": f"{p2p.get('out_peers', 0)} / {p2p.get('in_peers', 0)}",
+            "uptime": format_duration(p2p.get("uptime", 0)),
         },
         "network": {
             "height": metrics.network_height,
-            "reward": f"{network.get('reward', 0)/1e12:.4f} XMR",
-            "diff": f"{metrics.network_difficulty/1e9:.2f} G",
-            "hash": _shorten(str(network.get('hash', 'N/A')), threshold=20),
-            "ts": format_time_abs(network.get('timestamp', 0)),
+            "reward": f"{network.get('reward', 0) / 1e12:.4f} XMR",
+            "diff": f"{metrics.network_difficulty / 1e9:.2f} G",
+            "hash": _shorten(str(network.get("hash", "N/A")), threshold=20),
+            "ts": format_time_abs(network.get("timestamp", 0)),
+        },
+        "monero": {
+            "mode": metrics.monero_mode,
+            "db_size": _monero_db_size(data.get("monero_sync", {})),
         },
-        "monero": {"mode": metrics.monero_mode, "db_size": _monero_db_size(data.get('monero_sync', {}))},
         "shares_window": {"count": metrics.shares_in_window, "ok": metrics.shares_in_window > 0},
     }
 
 
 def _monero_db_size(monero_sync):
     """Human-readable on-disk Monero DB size (Issue #32); em-dash when unknown."""
-    db_bytes = monero_sync.get('db_size', 0) or 0
+    db_bytes = monero_sync.get("db_size", 0) or 0
     return f"{db_bytes / 1e9:.1f} GB" if db_bytes > 0 else "—"
 
 
@@ -403,8 +455,8 @@ def _usage_level(percent, threshold=80):
 # rate crosses _REJECT_FLAG_RATE *and* it has enough rejects to not just be early-run noise, so an
 # operator can spot a misbehaving rig. A worker submitting all-rejects (rate 100%) still trips the
 # noise floor, so it flags as soon as the floor is reached.
-_REJECT_FLAG_RATE = 0.05   # >= 5% of submitted shares rejected
-_REJECT_FLAG_MIN = 3       # and at least this many rejects
+_REJECT_FLAG_RATE = 0.05  # >= 5% of submitted shares rejected
+_REJECT_FLAG_MIN = 3  # and at least this many rejects
 
 
 def _reject_flag(accepted, rejected):
@@ -423,38 +475,41 @@ def build_system(data):
 
     These thresholds are purely presentational (how to colour a gauge), so they live here
     rather than in the domain metrics layer."""
-    system = data.get('system', {})
+    system = data.get("system", {})
 
-    disk_usage = system.get('disk', {})
-    disk_percent = disk_usage.get('percent', 0)
+    disk_usage = system.get("disk", {})
+    disk_percent = disk_usage.get("percent", 0)
     disk_fill = "critical" if disk_percent > 90 else "warning" if disk_percent > 70 else ""
 
-    mem_usage = system.get('memory', {})
-    cpu_str = system.get('cpu_percent', "0.0%")
+    mem_usage = system.get("memory", {})
+    cpu_str = system.get("cpu_percent", "0.0%")
     try:
-        cpu_val = float(cpu_str.strip('%'))
+        cpu_val = float(cpu_str.strip("%"))
     except ValueError:
         cpu_val = 0.0
 
-    load_raw = system.get('load', "0.00 0.00 0.00")
+    load_raw = system.get("load", "0.00 0.00 0.00")
     load_parts = load_raw.split()
-    load_avg = (f"1m: {load_parts[0]} 5m: {load_parts[1]} 15m: {load_parts[2]}"
-                if len(load_parts) == 3 else load_raw)
+    load_avg = (
+        f"1m: {load_parts[0]} 5m: {load_parts[1]} 15m: {load_parts[2]}"
+        if len(load_parts) == 3
+        else load_raw
+    )
 
-    hp_status, hp_class, hp_val = system.get('hugepages', ["Disabled", "status-bad", "0/0"])
+    hp_status, hp_class, hp_val = system.get("hugepages", ["Disabled", "status-bad", "0/0"])
 
     return {
         "cpu": {"percent": cpu_str, "load": load_avg, "level": _usage_level(cpu_val)},
         "mem": {
             "used": f"{mem_usage.get('used_gb', 0):.1f}",
             "total": f"{mem_usage.get('total_gb', 0):.1f}",
-            "percent": mem_usage.get('percent_str', '0%'),
-            "level": _usage_level(mem_usage.get('percent', 0)),
+            "percent": mem_usage.get("percent_str", "0%"),
+            "level": _usage_level(mem_usage.get("percent", 0)),
         },
         "disk": {
             "used": f"{disk_usage.get('used_gb', 0):.1f}",
             "total": f"{disk_usage.get('total_gb', 0):.1f}",
-            "percent": disk_usage.get('percent_str', '0%'),
+            "percent": disk_usage.get("percent_str", "0%"),
             "width": f"{disk_percent}%",
             "fill": disk_fill,
             "level": _usage_level(disk_percent),
@@ -471,44 +526,56 @@ def build_workers(workers):
     """Worker rows as data: raw numeric fields (for client-side sorting) alongside their
     formatted display strings, plus a pool token for the badge. Online first, then by name."""
     rows = []
-    sorted_workers = sorted(workers, key=lambda x: (x['status'] != 'online', x['name']))
+    sorted_workers = sorted(workers, key=lambda x: (x["status"] != "online", x["name"]))
 
     for worker in sorted_workers:
         try:
-            active_pool = worker.get('active_pool', '')
-            if any(p in active_pool for p in ['3333', '37889', '37888', '37890']):
+            active_pool = worker.get("active_pool", "")
+            if any(p in active_pool for p in ["3333", "37889", "37888", "37890"]):
                 pool = "p2pool"
-            elif any(p in active_pool for p in ['3344', '4247']):
+            elif any(p in active_pool for p in ["3344", "4247"]):
                 pool = "xvb"
             else:
                 pool = "unknown"
 
-            uptime = worker.get('uptime', 0)
-            h10 = worker.get('h10', 0)
-            h60 = worker.get('h60', 0)
-            h15 = worker.get('h15', 0)
+            uptime = worker.get("uptime", 0)
+            h10 = worker.get("h10", 0)
+            h60 = worker.get("h60", 0)
+            h15 = worker.get("h15", 0)
             # Per-worker share health (Issue #82). Raw counts for client-side sorting; a display
             # string that appends invalid only when it's non-zero (keeps the common case clean);
             # and an optional warning flag the client renders when the reject rate is high.
-            accepted = worker.get('accepted', 0)
-            rejected = worker.get('rejected', 0)
-            invalid = worker.get('invalid', 0)
+            accepted = worker.get("accepted", 0)
+            rejected = worker.get("rejected", 0)
+            invalid = worker.get("invalid", 0)
             rejected_str = f"{rejected:,} (+{invalid:,} inv)" if invalid else f"{rejected:,}"
-            rows.append({
-                "name": worker['name'],
-                "ip": worker['ip'],
-                "ip_sort": _ip_to_sort_int(worker.get('ip', '0.0.0.0')),
-                "pool": pool,
-                "status": "online" if worker['status'] == 'online' else "offline",
-                "uptime": uptime, "uptime_str": format_duration(uptime),
-                "h10": h10, "h10_str": format_hashrate(h10),
-                "h60": h60, "h60_str": format_hashrate(h60),
-                "h15": h15, "h15_str": format_hashrate(h15),
-                "accepted": accepted, "accepted_str": f"{accepted:,}",
-                "rejected": rejected, "rejected_str": rejected_str,
-                "invalid": invalid,
-                "reject_flag": _reject_flag(accepted, rejected),
-            })
+            rows.append(
+                {
+                    "name": worker["name"],
+                    "ip": worker["ip"],
+                    "ip_sort": _ip_to_sort_int(worker.get("ip", "0.0.0.0")),
+                    "pool": pool,
+                    "status": "online" if worker["status"] == "online" else "offline",
+                    "uptime": uptime,
+                    "uptime_str": format_duration(uptime),
+                    "h10": h10,
+                    "h10_str": format_hashrate(h10),
+                    "h60": h60,
+                    "h60_str": format_hashrate(h60),
+                    "h15": h15,
+                    "h15_str": format_hashrate(h15),
+                    "accepted": accepted,
+                    "accepted_str": f"{accepted:,}",
+                    "rejected": rejected,
+                    "rejected_str": rejected_str,
+                    "invalid": invalid,
+                    "reject_flag": _reject_flag(accepted, rejected),
+                    # Worker-API probe verdict: False = configured probe failed (uptime/per-miner
+                    # hashrate unavailable; the client badges it), True = ok, None = not probed
+                    # (internal/invalid IP per the SSRF guard) — don't flag the unknown case.
+                    "api_ok": worker.get("api_ok"),
+                }
+            )
         except Exception as e:
             logger.error(f"Error processing worker {worker.get('name', 'unknown')}: {e}")
             continue
@@ -520,12 +587,12 @@ def build_proxy_summary(data):
     accepted/rejected/invalid/expired shares submitted to the upstream pool, the aggregate reject
     rate, and the best difficulty found. ``has_data`` is False until the proxy has been polled (no
     shares yet) so the client can hide an all-zero footer."""
-    summary = data.get('proxy_summary', {}) or {}
-    accepted = summary.get('accepted', 0) or 0
-    rejected = summary.get('rejected', 0) or 0
-    invalid = summary.get('invalid', 0) or 0
-    expired = summary.get('expired', 0) or 0
-    best = summary.get('best', 0) or 0
+    summary = data.get("proxy_summary", {}) or {}
+    accepted = summary.get("accepted", 0) or 0
+    rejected = summary.get("rejected", 0) or 0
+    invalid = summary.get("invalid", 0) or 0
+    expired = summary.get("expired", 0) or 0
+    best = summary.get("best", 0) or 0
 
     total = accepted + rejected
     reject_pct = (rejected / total * 100) if total > 0 else 0.0
@@ -544,23 +611,29 @@ def build_proxy_summary(data):
 def _ip_to_sort_int(ip):
     """Pack a dotted-quad IP into an int for client-side numeric sorting; 0 on malformed input."""
     try:
-        a, b, c, d = (int(part) for part in ip.split('.'))
+        a, b, c, d = (int(part) for part in ip.split("."))
         return (a << 24) + (b << 16) + (c << 8) + d
     except (ValueError, IndexError, AttributeError):
         return 0
 
 
 def build_tari(data):
-    """Tari merge-mining display values. ``status`` is plain text; the client adds the ✔."""
-    tari_stats = data.get('tari', {})
-    tari_active = tari_stats.get('active', False)
-    t_addr = tari_stats.get('address', 'Unknown')
+    """Tari merge-mining display values. ``status`` is plain text; the client adds the ✔ only when
+    ``connected`` (the gRPC merge-mine channel is actually READY), never merely when ``active``."""
+    # This is the SINGLE place the effective Tari UI status is derived — `active`, the "Waiting..."
+    # fallback, and the connected-gates-the-✔ rule. A duplicate that computed the same thing and then
+    # discarded it lived (dead) in data_service and was removed in #280; keep this the only source so
+    # the panel can't drift or go stale (#295).
+    tari_stats = data.get("tari", {})
+    tari_active = tari_stats.get("active", False)
+    t_addr = tari_stats.get("address", "Unknown")
 
     return {
         "active": tari_active,
-        "status": tari_stats.get('status', 'Waiting...') if tari_active else 'Waiting...',
+        "connected": bool(tari_stats.get("connected", False)) and tari_active,
+        "status": tari_stats.get("status", "Waiting...") if tari_active else "Waiting...",
         "reward": f"{tari_stats.get('reward', 0):.2f} TARI",
-        "height": str(tari_stats.get('height', 0)),
+        "height": str(tari_stats.get("height", 0)),
         "diff": f"{int(tari_stats.get('difficulty', 0)):,}",
         "wallet": t_addr,
         "wallet_short": _shorten(t_addr),
@@ -571,10 +644,16 @@ def build_sync(metrics, monero_db_size):
     """Sync-screen state for both chains, mapping each SyncMetric to the client's 3-state
     gauge: 'done' (caught up — checked first, since a synced node may have no target height),
     'loading' (no target/data yet), else 'syncing'."""
+
     def section(sm, extra=None):
         state = "done" if sm.done else ("loading" if not sm.has_target else "syncing")
-        out = {"state": state, "percent": sm.percent, "current": sm.current,
-               "target": sm.target, "remaining": sm.remaining}
+        out = {
+            "state": state,
+            "percent": sm.percent,
+            "current": sm.current,
+            "target": sm.target,
+            "remaining": sm.remaining,
+        }
         if extra:
             out.update(extra)
         return out
@@ -592,56 +671,130 @@ def build_badges(data, metrics, mode_variant, db_healthy=True):
     # Persistence health (#131): the dashboard keeps serving live data even if its SQLite DB can't
     # be written, but history/shares/stats would silently vanish on restart — surface it loudly.
     if not db_healthy:
-        badges.append({"text": "⚠ DB write failing", "variant": "bad",
-                       "title": "The dashboard can't persist to its database — hashrate history, shares, and stats will be lost on restart. Check disk space and permissions on the dashboard data directory."})
+        badges.append(
+            {
+                "text": "⚠ DB write failing",
+                "variant": "bad",
+                "title": "The dashboard can't persist to its database — hashrate history, shares, and stats will be lost on restart. Check disk space and permissions on the dashboard data directory.",
+            }
+        )
     if metrics.global_syncing:
         badges.append({"text": "Syncing...", "variant": "warn"})
     else:
         badges.append({"text": metrics.mode, "variant": mode_variant})
         badges.append({"text": f"P2Pool {metrics.pool_type}", "variant": "outline"})
         if metrics.low_hr_warning:
-            badges.append({"text": "⚠ Hashrate low for tier", "variant": "warn", "title": _LOW_HR_TITLE})
+            badges.append(
+                {"text": "⚠ Hashrate low for tier", "variant": "warn", "title": _LOW_HR_TITLE}
+            )
         # No PPLNS share while donating (#158): XvB wins are skipped + accrue a fail, regardless of
         # tier. A make-or-break gate worth surfacing loudly so donations aren't wasted. (This is the
         # share half of Raffle Eligible; the tier half is shown by the XvB Tier field.)
         if metrics.xvb_enabled and metrics.shares_in_window == 0:
-            badges.append({"text": "⚠ No PPLNS share — XvB wins skipped", "variant": "warn", "title": _NOT_ELIGIBLE_TITLE})
+            badges.append(
+                {
+                    "text": "⚠ No PPLNS share — XvB wins skipped",
+                    "variant": "warn",
+                    "title": _NOT_ELIGIBLE_TITLE,
+                }
+            )
+
+        # XvB raffle auto-registration status (#263). Warnings take priority over the ✓ so a real
+        # problem (invalid wallet / persistently failing) is never masked by a stale timestamp.
+        if metrics.xvb_enabled:
+            if metrics.xvb_registration_state == "invalid":
+                badges.append(
+                    {
+                        "text": "⚠ XvB wallet rejected",
+                        "variant": "bad",
+                        "title": _XVB_INVALID_TITLE,
+                    }
+                )
+            elif metrics.xvb_registration_state == "failing":
+                badges.append(
+                    {
+                        "text": "⚠ XvB registration failing",
+                        "variant": "bad",
+                        "title": _XVB_FAILING_TITLE,
+                    }
+                )
+            elif metrics.xvb_registered_at > 0:
+                badges.append(
+                    {
+                        "text": "XvB raffle ✓",
+                        "variant": "outline",
+                        "title": _XVB_REGISTERED_TITLE,
+                    }
+                )
 
     # Node-down badges (Issue #31) — shown whenever a node is unreachable, regardless of sync.
     if metrics.monero.down:
         badges.append({"text": "monerod DOWN", "variant": "bad"})
     if metrics.tari.down:
         badges.append({"text": "Tari DOWN", "variant": "bad"})
-    if data.get('workers_rejected'):
-        badges.append({"text": "Workers rejected", "variant": "bad",
-                       "title": "Workers rejected so they fail over to their backup pools"})
+    if data.get("workers_rejected"):
+        badges.append(
+            {
+                "text": "Workers rejected",
+                "variant": "bad",
+                "title": "Workers rejected so they fail over to their backup pools",
+            }
+        )
     # Miner held until required chain(s) finish their initial sync (Issue #35).
-    if data.get('miner_held'):
-        badges.append({"text": "Miner held (sync)", "variant": "warn",
-                       "title": "p2pool and xmrig-proxy are held until the required chains finish syncing"})
+    if data.get("miner_held"):
+        badges.append(
+            {
+                "text": "Miner held (sync)",
+                "variant": "warn",
+                "title": "p2pool and xmrig-proxy are held until the required chains finish syncing",
+            }
+        )
     # Non-blocking Tari (Issue #51): stay operational, surface a top-bar badge with the live
     # percentage once known (omitted early so it isn't a stale "0%").
-    if data.get('tari_syncing_passive'):
+    if data.get("tari_syncing_passive"):
         t_pct = metrics.tari.percent
-        label = f'Tari syncing {t_pct}%' if t_pct > 0 else 'Tari syncing'
-        badges.append({"text": label, "variant": "warn",
-                       "title": "Tari is still syncing — merge mining resumes when it catches up; Monero mining continues"})
+        label = f"Tari syncing {t_pct}%" if t_pct > 0 else "Tari syncing"
+        badges.append(
+            {
+                "text": label,
+                "variant": "warn",
+                "title": "Tari is still syncing — merge mining resumes when it catches up; Monero mining continues",
+            }
+        )
     # Monero pruned/full badge (Issue #32) — only when known (local node).
     if metrics.monero_mode == "Pruned":
-        badges.append({"text": "XMR Pruned", "variant": "outline", "title": "Monero blockchain is pruned"})
+        badges.append(
+            {"text": "XMR Pruned", "variant": "outline", "title": "Monero blockchain is pruned"}
+        )
     elif metrics.monero_mode == "Full":
-        badges.append({"text": "XMR Full", "variant": "outline", "title": "Monero blockchain is full (not pruned)"})
+        badges.append(
+            {
+                "text": "XMR Full",
+                "variant": "outline",
+                "title": "Monero blockchain is full (not pruned)",
+            }
+        )
 
     # Low-disk badge (Issue #138). The data filesystem fills as the chains grow and logs accumulate;
     # a full disk corrupts monerod's DB mid-write. The disk *bar* shows the percentage, but it's easy
     # to miss — surface a prominent top-bar badge near full, on both the sync and main screens.
-    disk_percent = (data.get('system', {}).get('disk', {}) or {}).get('percent', 0) or 0
+    disk_percent = (data.get("system", {}).get("disk", {}) or {}).get("percent", 0) or 0
     if disk_percent >= DISK_CRITICAL_PERCENT:
-        badges.append({"text": f"⚠ Disk {disk_percent:.0f}% full", "variant": "bad",
-                       "title": "The data disk is almost full — free space now; a full disk can corrupt the Monero database."})
+        badges.append(
+            {
+                "text": f"⚠ Disk {disk_percent:.0f}% full",
+                "variant": "bad",
+                "title": "The data disk is almost full — free space now; a full disk can corrupt the Monero database.",
+            }
+        )
     elif disk_percent >= DISK_WARN_PERCENT:
-        badges.append({"text": f"Disk {disk_percent:.0f}% full", "variant": "warn",
-                       "title": "The data disk is filling up — free space or move a data_dir before it runs out."})
+        badges.append(
+            {
+                "text": f"Disk {disk_percent:.0f}% full",
+                "variant": "warn",
+                "title": "The data disk is filling up — free space or move a data_dir before it runs out.",
+            }
+        )
 
     return badges
 
@@ -676,7 +829,7 @@ def build_earnings(data, metrics):
 
     ``available`` is False when the network figures needed for the rate are missing; the client
     then shows ``—`` instead of a bogus estimate (graceful degradation)."""
-    reward_atomic = (data.get('network', {}) or {}).get('reward', 0) or 0
+    reward_atomic = (data.get("network", {}) or {}).get("reward", 0) or 0
     coeff_day = xmr_per_hs_day(reward_atomic, metrics.network_difficulty)
     # Reuse the displayed P2Pool 1h average (header / Overview / My Node) so the calculator's
     # hashrate is consistent with the rest of the dashboard — and because that recorded average
@@ -684,10 +837,10 @@ def build_earnings(data, metrics):
     p2pool_hr = metrics.p2pool_1h
     return {
         "available": coeff_day > 0,
-        "p2pool_hr": p2pool_hr,                             # raw H/s — the what-if default
+        "p2pool_hr": p2pool_hr,  # raw H/s — the what-if default
         "p2pool_hr_str": format_hashrate(p2pool_hr),
-        "coeff_day": coeff_day,                              # XMR per H/s per day
-        "pool_difficulty": metrics.pool_difficulty,         # for expected time-to-share (diff/hr)
+        "coeff_day": coeff_day,  # XMR per H/s per day
+        "pool_difficulty": metrics.pool_difficulty,  # for expected time-to-share (diff/hr)
         "block_reward": f"{reward_atomic / 1e12:.4f} XMR",  # context, server-formatted like NetworkCard
         "disclaimer": _EARNINGS_DISCLAIMER,
     }
@@ -697,6 +850,7 @@ def build_earnings(data, metrics):
 # Assembly.
 # --------------------------------------------------------------------------------------
 
+
 def host_display_addr(host):
     """The numeric IP to show *beside* the configured host in the header, or ``None`` (Issue #119).
 
@@ -714,6 +868,16 @@ def host_display_addr(host):
     return addr
 
 
+def _egress_badge(summary):
+    """Glanceable header badge for the egress posture (#170): green when Tor-only, red on a leak."""
+    ok = summary["level"] == "ok"
+    return {
+        "variant": "ok" if ok else "bad",
+        "text": "🛡️ Tor-only egress" if ok else f"⚠️ {summary['leaks']} clearnet egress",
+        "title": summary["label"],
+    }
+
+
 def build_state(data, state_mgr, range_arg, window=None, avg_window=DEFAULT_HASHRATE_WINDOW):
     """Assemble the full ``/api/state`` payload — the contract the client renders against.
 
@@ -730,19 +894,28 @@ def build_state(data, state_mgr, range_arg, window=None, avg_window=DEFAULT_HASH
     mode_tok, p2p_tok, xvb_tok = _mode_palette(metrics.mode)
     pool_net = build_pool_network(data, metrics)
 
+    egress = egress_posture_from_config()  # per-component egress route + privacy roll-up (#170)
+    topology = (
+        topology_from_config()
+    )  # full stack wiring for the topology panel (#170); shares summary
+    badges = build_badges(data, metrics, mode_tok, db_healthy)
+    badges.append(_egress_badge(egress["summary"]))  # glanceable Tor-only / leak header badge
+
     return {
         "syncing": metrics.global_syncing,
-        "page_title": "Mining Dashboard - Syncing" if metrics.global_syncing else "Mining Dashboard",
+        "page_title": "Mining Dashboard - Syncing"
+        if metrics.global_syncing
+        else "Mining Dashboard",
         "host_ip": HOST_IP,
         "host_addr": host_display_addr(HOST_IP),
         "version": resolve_version(),
-        "update": data.get("update"),   # {available, latest, url} | None — new-release badge (#224)
+        "update": data.get("update"),  # {available, latest, url} | None — new-release badge (#224)
         "last_update": format_time_abs(time.time()),
         "range": range_arg,
         "window": {"from": window[0], "to": window[1]} if window else None,
         "avg_window": avg_window,
         "avg_windows": HASHRATE_WINDOWS,
-        "badges": build_badges(data, metrics, mode_tok, db_healthy),
+        "badges": badges,
         "db_healthy": db_healthy,
         "hashrate": build_hashrate(metrics, mode_tok, p2p_tok, xvb_tok),
         "system": build_system(data),
@@ -756,9 +929,11 @@ def build_state(data, state_mgr, range_arg, window=None, avg_window=DEFAULT_HASH
         "proxy_workers": metrics.workers_online,
         "earnings": build_earnings(data, metrics),
         "tari": build_tari(data),
-        "workers": build_workers(data.get('workers', [])),
+        "workers": build_workers(data.get("workers", [])),
         "proxy_summary": build_proxy_summary(data),
-        "chart": build_chart(history, data.get('shares', []), range_arg, window, avg_window),
+        "egress": egress,
+        "topology": topology,
+        "chart": build_chart(history, data.get("shares", []), range_arg, window, avg_window),
     }
 
 
@@ -778,7 +953,7 @@ def get_shell_html():
     try:
         mtime = os.path.getmtime(SHELL_PATH)
         if _SHELL_CACHE is None or mtime > _SHELL_MTIME:
-            with open(SHELL_PATH, 'r') as f:
+            with open(SHELL_PATH) as f:
                 _SHELL_CACHE = f.read()
             _SHELL_MTIME = mtime
     except Exception as e:
diff --git a/build/dashboard/pyproject.toml b/build/dashboard/pyproject.toml
index 6c51c551..19eac197 100644
--- a/build/dashboard/pyproject.toml
+++ b/build/dashboard/pyproject.toml
@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=68"]
+requires = ["setuptools>=82.0.1"]
 build-backend = "setuptools.build_meta"
 
 [project]
@@ -7,31 +7,38 @@ name = "mining-dashboard"
 # Keep in lockstep with the top-level VERSION file — the single source of truth for the stack version
 # (#44). A shell test (tests/stack/run.sh) fails if these drift; the dashboard *displays* the version
 # from VERSION (baked in as PITHEAD_VERSION, #58), so this is packaging metadata only.
-version = "1.0.3"
+version = "1.1.0"
 description = "Monitoring dashboard and XvB switching engine for Pithead"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "MIT" }
 dependencies = [
-    "aiohttp>=3.10.11",
-    # [socks] pulls in PySocks so the XvB stats fetch can route over the Tor SOCKS proxy (#163).
-    "requests[socks]>=2.32.4",
-    # grpcio/protobuf floors are dictated by the checked-in Tari gRPC stubs
-    # (mining_dashboard/client/tari/generated/*_pb2*.py), which assert these at
-    # import time. Do not resolve lower; regenerate the stubs if bumping.
-    "grpcio>=1.78.0",
-    "protobuf>=6.31.1,<7",
-    "aiofiles>=24.1",
+  "aiohttp>=3.10.11",
+  # [socks] pulls in PySocks so the XvB stats fetch can route over the Tor SOCKS proxy (#163).
+  "requests[socks]>=2.34.2",
+  # grpcio/protobuf floors are dictated by the checked-in Tari gRPC stubs
+  # (mining_dashboard/client/tari/generated/*_pb2*.py), which assert these at
+  # import time. Do not resolve lower; regenerate the stubs if bumping.
+  "grpcio>=1.78.0",
+  "protobuf>=6.31.1,<7",
+  "aiofiles>=24.1",
 ]
 
 [project.optional-dependencies]
 test = [
-    "pytest>=8",
-    "pytest-asyncio>=0.24",
-    "pytest-mock>=3.14",
-    "pytest-cov>=5",
-    "pytest-aiohttp>=1.0",
+  "pytest>=9.1.1",
+  "pytest-asyncio>=0.24",
+  "pytest-mock>=3.14",
+  "pytest-cov>=5",
+  "pytest-aiohttp>=1.0",
+  # diff-cover (#286): patch-coverage gate — new/changed lines must be >=90% covered.
+  "diff-cover>=9",
+  # hypothesis (#284): property-based tests asserting invariants on the money/numeric logic.
+  "hypothesis>=6.155.7",
 ]
+# Developer tooling (Wave 7, #280). Pinned so local, pre-commit, and CI all run the SAME ruff
+# — lint output is version-sensitive, so a floor would let CI and a contributor disagree.
+dev = ["ruff==0.15.20", "pre-commit>=4"]
 
 [tool.setuptools.packages.find]
 include = ["mining_dashboard*"]
@@ -43,19 +50,46 @@ asyncio_mode = "auto"
 # __init__.py packages or sys.path games.
 addopts = "-q --import-mode=importlib"
 markers = [
-    "integration: tests that exercise multiple components or external services",
+  "integration: tests that exercise multiple components or external services",
 ]
 
 [tool.coverage.run]
 source = ["mining_dashboard"]
 omit = [
-    "*/client/tari/generated/*",  # generated gRPC stubs
-    "*/tests/*",
+  "*/client/tari/generated/*", # generated gRPC stubs
+  "*/tests/*",
 ]
 
 [tool.coverage.report]
 show_missing = true
-exclude_also = [
-    "if __name__ == .__main__.:",
-    "raise NotImplementedError",
+exclude_also = ["if __name__ == .__main__.:", "raise NotImplementedError"]
+
+[tool.ruff]
+# Lint + format for the dashboard (Wave 7 tooling, #280). Run via `make lint-py`, pre-commit,
+# and CI. Keep target-version in lockstep with requires-python above.
+target-version = "py311"
+line-length = 100
+# Generated Tari gRPC stubs aren't ours to style — already omitted from coverage too.
+extend-exclude = ["mining_dashboard/client/tari/generated"]
+
+[tool.ruff.lint]
+# E/F/W pycodestyle+pyflakes · I import-sort · B bugbear · UP pyupgrade ·
+# ASYNC flake8-async (the aiohttp/asyncio event loop + Tor SOCKS paths) ·
+# S flake8-bandit (security). Annotation rules (ANN) are deferred to #284.
+select = ["E", "F", "W", "I", "B", "UP", "ASYNC", "S"]
+ignore = [
+  "E501", # line length is owned by `ruff format`
+  "S104", # "bind all interfaces": every hit is the sentinel string "0.0.0.0" used as a
+  # default/comparison value — the dashboard's listen host is config-driven (aiohttp),
+  # it never binds a raw socket to 0.0.0.0 from Python.
 ]
+
+[tool.ruff.lint.per-file-ignores]
+# Tests: asserts are the idiom (S101); fixtures use dummy creds (S106); broad
+# pytest.raises(Exception) is fine (B017); os.path in async test bodies is harmless (ASYNC240).
+"tests/**" = ["S101", "S106", "B017", "ASYNC240"]
+# Generated-stub imports are intentionally grouped below the logger + the generation guidance.
+"mining_dashboard/client/tari/tari_client.py" = ["E402"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["mining_dashboard"]
diff --git a/build/dashboard/tests/client/test_docker_control.py b/build/dashboard/tests/client/test_docker_control.py
index 0e9168e7..8a0e70c2 100644
--- a/build/dashboard/tests/client/test_docker_control.py
+++ b/build/dashboard/tests/client/test_docker_control.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch, MagicMock
+from unittest.mock import MagicMock, patch
 
 import mining_dashboard.client.docker.docker_control as dc_mod
 from mining_dashboard.client.docker.docker_control import DockerControl
diff --git a/build/dashboard/tests/client/test_monero_client.py b/build/dashboard/tests/client/test_monero_client.py
index d5c00a78..8c25e1a3 100644
--- a/build/dashboard/tests/client/test_monero_client.py
+++ b/build/dashboard/tests/client/test_monero_client.py
@@ -1,4 +1,4 @@
-from unittest.mock import patch, MagicMock
+from unittest.mock import MagicMock, patch
 
 import requests
 
@@ -27,7 +27,9 @@ def test_no_username_means_no_auth(self):
     def test_success_returns_payload(self):
         client = MoneroClient(username="u", password="p")
         data = {"status": "OK", "height": 5, "target_height": 10}
-        with patch.object(monero_mod.requests, "get", return_value=_resp(json_data=data)) as mock_get:
+        with patch.object(
+            monero_mod.requests, "get", return_value=_resp(json_data=data)
+        ) as mock_get:
             assert client.get_info() == data
         # Digest auth and a bounded timeout are passed through on every call.
         assert mock_get.call_args.kwargs["timeout"] == client.timeout
@@ -35,8 +37,9 @@ def test_success_returns_payload(self):
 
     def test_network_error_returns_none(self):
         client = MoneroClient(username="u", password="p")
-        with patch.object(monero_mod.requests, "get",
-                          side_effect=requests.RequestException("refused")):
+        with patch.object(
+            monero_mod.requests, "get", side_effect=requests.RequestException("refused")
+        ):
             assert client.get_info() is None
 
     def test_non_200_returns_none(self):
@@ -51,8 +54,9 @@ def test_non_json_returns_none(self):
 
     def test_busy_status_returns_none(self):
         client = MoneroClient(username="u", password="p")
-        with patch.object(monero_mod.requests, "get",
-                          return_value=_resp(json_data={"status": "BUSY"})):
+        with patch.object(
+            monero_mod.requests, "get", return_value=_resp(json_data={"status": "BUSY"})
+        ):
             assert client.get_info() is None
 
 
@@ -64,17 +68,27 @@ def _client_with_info(self, info):
 
     def test_syncing(self):
         client = self._client_with_info(
-            {"status": "OK", "height": 50, "target_height": 100, "database_size": 85_000_000_000})
+            {"status": "OK", "height": 50, "target_height": 100, "database_size": 85_000_000_000}
+        )
         assert client.get_sync_status() == {
-            "is_syncing": True, "current": 50, "target": 100, "percent": 50,
+            "is_syncing": True,
+            "current": 50,
+            "target": 100,
+            "percent": 50,
             "db_size": 85_000_000_000,
         }
 
     def test_synced_via_flag(self):
         # `synchronized` is authoritative even if heights look mid-sync.
         client = self._client_with_info(
-            {"status": "OK", "synchronized": True, "height": 90, "target_height": 100,
-             "database_size": 200_000_000_000})
+            {
+                "status": "OK",
+                "synchronized": True,
+                "height": 90,
+                "target_height": 100,
+                "database_size": 200_000_000_000,
+            }
+        )
         assert client.get_sync_status() == {"is_syncing": False, "db_size": 200_000_000_000}
 
     def test_synced_via_zero_target(self):
diff --git a/build/dashboard/tests/client/test_tari_client.py b/build/dashboard/tests/client/test_tari_client.py
index c3d66e9b..e1dbb16a 100644
--- a/build/dashboard/tests/client/test_tari_client.py
+++ b/build/dashboard/tests/client/test_tari_client.py
@@ -1,12 +1,10 @@
-from unittest.mock import MagicMock, AsyncMock
-
-import pytest
+from unittest.mock import AsyncMock, MagicMock
 
 from mining_dashboard.client.tari.tari_client import TariClient
 
 
 def _client_with_stub():
-    client = TariClient(MagicMock())
+    client = TariClient()
     stub = MagicMock()
     client._channel = MagicMock()
     client._channel.close = AsyncMock()
@@ -33,24 +31,39 @@ async def test_fully_synced(self):
         client, stub = _client_with_stub()
         stub.GetTipInfo = AsyncMock(return_value=_tip(500, synced=True))
         status = await client.get_sync_status()
-        assert status == {"is_syncing": False, "current": 500, "target": 500,
-                          "percent": 100, "reachable": True}
+        assert status == {
+            "is_syncing": False,
+            "current": 500,
+            "target": 500,
+            "percent": 100,
+            "reachable": True,
+        }
 
     async def test_syncing_with_target(self):
         client, stub = _client_with_stub()
         stub.GetTipInfo = AsyncMock(return_value=_tip(100, synced=False))
         stub.GetSyncProgress = AsyncMock(return_value=_progress(100, 200))
         status = await client.get_sync_status()
-        assert status == {"is_syncing": True, "current": 100, "target": 200,
-                          "percent": 50, "reachable": True}
+        assert status == {
+            "is_syncing": True,
+            "current": 100,
+            "target": 200,
+            "percent": 50,
+            "reachable": True,
+        }
 
     async def test_syncing_without_reliable_target(self):
         client, stub = _client_with_stub()
         stub.GetTipInfo = AsyncMock(return_value=_tip(100, synced=False))
         stub.GetSyncProgress = AsyncMock(return_value=_progress(100, 100))  # target <= local
         status = await client.get_sync_status()
-        assert status == {"is_syncing": True, "current": 100, "target": 0,
-                          "percent": 0, "reachable": True}
+        assert status == {
+            "is_syncing": True,
+            "current": 100,
+            "target": 0,
+            "percent": 0,
+            "reachable": True,
+        }
 
     async def test_grpc_error_returns_default_when_no_cache(self):
         client, stub = _client_with_stub()
@@ -77,7 +90,7 @@ async def test_stale_cache_expires(self, monkeypatch):
         stub.GetTipInfo = AsyncMock(return_value=_tip(300, synced=True))
         await client.get_sync_status()
         # Push the cache timestamp beyond the stale window.
-        client._last_sync_ts -= (client._MAX_STALE_SECONDS + 1)
+        client._last_sync_ts -= client._MAX_STALE_SECONDS + 1
         stub.GetTipInfo = AsyncMock(side_effect=RuntimeError("down"))
         assert await client.get_sync_status() == {"is_syncing": False, "reachable": False}
 
diff --git a/build/dashboard/tests/client/test_xmrig_client.py b/build/dashboard/tests/client/test_xmrig_client.py
index f63a22eb..fae542c7 100644
--- a/build/dashboard/tests/client/test_xmrig_client.py
+++ b/build/dashboard/tests/client/test_xmrig_client.py
@@ -1,12 +1,13 @@
 import pytest
 
+from mining_dashboard.client import xmrig_client as xc
 from mining_dashboard.client.xmrig_client import XMRigWorkerClient
 
 
 class FakeResponse:
     def __init__(self, status, payload=None):
         self.status = status
-        self._payload = payload or {}
+        self._payload = payload if payload is not None else {}
 
     async def json(self):
         return self._payload
@@ -14,6 +15,7 @@ async def json(self):
 
 class FakeGet:
     """Mimics the async context manager returned by aiohttp ClientSession.get()."""
+
     def __init__(self, response=None, exc=None):
         self._response = response
         self._exc = exc
@@ -38,27 +40,118 @@ def get(self, url, headers=None, timeout=None):
         return FakeGet(self._response, self._exc)
 
 
-async def test_first_success_returns_payload_and_short_circuits():
-    session = FakeSession(response=FakeResponse(200, {"kind": "proxy", "hashrate": {"total": [10]}}))
+# --- One probe, derived from config (no auto-detection fallback) -------------------------------
+
+
+async def test_success_returns_payload_with_api_ok_and_single_call():
+    session = FakeSession(
+        response=FakeResponse(200, {"kind": "proxy", "hashrate": {"total": [10]}})
+    )
     client = XMRigWorkerClient(session)
     result = await client.get_stats("10.0.0.1", "rig1")
-    assert result == {"kind": "proxy", "hashrate": {"total": [10]}}
-    assert len(session.calls) == 1  # stopped after the first 200
+    assert result == {"kind": "proxy", "hashrate": {"total": [10]}, "api_ok": True}
+    assert len(session.calls) == 1  # exactly one probe — never multiple auth combinations
     assert session.calls[0][0] == "http://10.0.0.1:8080/1/summary"
 
 
-async def test_all_attempts_fail_returns_empty():
-    session = FakeSession(response=FakeResponse(500))
+async def test_default_auth_is_none_no_authorization_header():
+    session = FakeSession(response=FakeResponse(200, {"ok": True}))
+    client = XMRigWorkerClient(session)
+    await client.get_stats("10.0.0.1", "rig1")
+    _, headers = session.calls[0]
+    assert "Authorization" not in (headers or {})  # default mode is no-auth
+
+
+async def test_failure_status_returns_api_ok_false_single_call():
+    session = FakeSession(response=FakeResponse(401))
     client = XMRigWorkerClient(session)
     result = await client.get_stats("10.0.0.1", "rig1")
-    assert result == {}
-    assert len(session.calls) > 1  # tried multiple auth combinations against the validated IP
+    assert result == {"api_ok": False}
+    assert len(session.calls) == 1  # no retry with a different credential
 
 
-async def test_exceptions_are_swallowed():
+async def test_exception_returns_api_ok_false():
     session = FakeSession(exc=OSError("connection refused"))
     client = XMRigWorkerClient(session)
-    assert await client.get_stats("10.0.0.1", "rig1") == {}
+    assert await client.get_stats("10.0.0.1", "rig1") == {"api_ok": False}
+
+
+async def test_non_dict_200_body_is_a_failure():
+    session = FakeSession(response=FakeResponse(200, ["not", "a", "dict"]))
+    client = XMRigWorkerClient(session)
+    assert await client.get_stats("10.0.0.1", "rig1") == {"api_ok": False}
+
+
+# --- Auth modes (the "rest defined through config") --------------------------------------------
+
+
+async def test_auth_name_uses_worker_name_as_bearer(monkeypatch):
+    monkeypatch.setattr(xc, "XMRIG_API_AUTH", "name")
+    session = FakeSession(response=FakeResponse(200, {"ok": True}))
+    client = XMRigWorkerClient(session)
+    await client.get_stats("10.0.0.1", "rig1+worker")
+    _, headers = session.calls[0]
+    assert headers["Authorization"] == "Bearer rig1"  # '+'-suffix stripped, name as token
+
+
+async def test_auth_token_uses_shared_token_as_bearer(monkeypatch):
+    monkeypatch.setattr(xc, "XMRIG_API_AUTH", "token")
+    monkeypatch.setattr(xc, "XMRIG_API_TOKEN", "s3cr3t")
+    session = FakeSession(response=FakeResponse(200, {"ok": True}))
+    client = XMRigWorkerClient(session)
+    await client.get_stats("10.0.0.1", "rig1")
+    _, headers = session.calls[0]
+    assert headers["Authorization"] == "Bearer s3cr3t"
+
+
+async def test_auth_token_without_token_sends_no_header(monkeypatch):
+    monkeypatch.setattr(xc, "XMRIG_API_AUTH", "token")
+    monkeypatch.setattr(xc, "XMRIG_API_TOKEN", "")
+    session = FakeSession(response=FakeResponse(200, {"ok": True}))
+    client = XMRigWorkerClient(session)
+    await client.get_stats("10.0.0.1", "rig1")
+    _, headers = session.calls[0]
+    assert "Authorization" not in (headers or {})
+
+
+async def test_custom_port_is_used(monkeypatch):
+    monkeypatch.setattr(xc, "XMRIG_API_PORT", 18088)
+    session = FakeSession(response=FakeResponse(200, {"ok": True}))
+    client = XMRigWorkerClient(session)
+    await client.get_stats("10.0.0.1", "rig1")
+    assert session.calls[0][0] == "http://10.0.0.1:18088/1/summary"
+
+
+# --- Failure is surfaced once per worker, not every poll ---------------------------------------
+
+
+async def test_repeated_failures_warn_once_then_dedup(monkeypatch, caplog):
+    # Freeze the clock so the dedup window never elapses between calls.
+    monkeypatch.setattr(xc.time, "monotonic", lambda: 1000.0)
+    session = FakeSession(response=FakeResponse(401))
+    client = XMRigWorkerClient(session)
+    with caplog.at_level("WARNING", logger="WorkerClient"):
+        for _ in range(5):
+            await client.get_stats("10.0.0.1", "rig1")
+    warnings = [r for r in caplog.records if r.levelname == "WARNING"]
+    assert len(warnings) == 1  # one worker, one warning per interval
+    assert "rig1" in warnings[0].getMessage()
+    assert "10.0.0.1" in warnings[0].getMessage()
+
+
+async def test_recovery_then_failure_warns_again(monkeypatch, caplog):
+    monkeypatch.setattr(xc.time, "monotonic", lambda: 1000.0)
+    fail = FakeSession(response=FakeResponse(401))
+    client = XMRigWorkerClient(fail)
+    with caplog.at_level("WARNING", logger="WorkerClient"):
+        await client.get_stats("10.0.0.1", "rig1")  # warns
+        # A success clears the dedup state...
+        client.session = FakeSession(response=FakeResponse(200, {"ok": True}))
+        await client.get_stats("10.0.0.1", "rig1")
+        # ...so the next failure warns again even within the interval.
+        client.session = fail
+        await client.get_stats("10.0.0.1", "rig1")  # warns again
+    assert len([r for r in caplog.records if r.levelname == "WARNING"]) == 2
 
 
 # --- SSRF guard (#122) -------------------------------------------------------------------------
@@ -66,55 +159,65 @@ async def test_exceptions_are_swallowed():
 # stratum. A worker name must NEVER become an outbound request host, and worker IPs pointing at our
 # own infrastructure / host-local services must never be probed.
 
-@pytest.mark.parametrize("ip,name,why", [
-    ("127.0.0.1", "rig", "loopback / host-local services"),
-    ("::1", "rig", "IPv6 loopback"),
-    ("172.28.0.30", "rig", "docker bridge — the read-only socket proxy"),
-    ("172.28.0.29", "rig", "docker bridge — xmrig-proxy itself"),
-    ("169.254.169.254", "rig", "link-local cloud-metadata endpoint"),
-    ("0.0.0.0", "rig", "unspecified"),
-    ("255.255.255.255", "rig", "reserved broadcast"),
-    ("not-an-ip", "rig", "garbage, not an address"),
-    ("", "127.0.0.1", "name is an internal IP string — must never become a host"),
-    ("", "172.28.0.30", "name is the socket proxy — must never become a host"),
-    ("", "evil.example.com", "name is a hostname — must never become a host"),
-])
+
+@pytest.mark.parametrize(
+    "ip,name,why",
+    [
+        ("127.0.0.1", "rig", "loopback / host-local services"),
+        ("::1", "rig", "IPv6 loopback"),
+        ("172.28.0.30", "rig", "docker bridge — the read-only socket proxy"),
+        ("172.28.0.29", "rig", "docker bridge — xmrig-proxy itself"),
+        ("169.254.169.254", "rig", "link-local cloud-metadata endpoint"),
+        ("0.0.0.0", "rig", "unspecified"),
+        ("255.255.255.255", "rig", "reserved broadcast"),
+        ("not-an-ip", "rig", "garbage, not an address"),
+        ("", "127.0.0.1", "name is an internal IP string — must never become a host"),
+        ("", "172.28.0.30", "name is the socket proxy — must never become a host"),
+        ("", "evil.example.com", "name is a hostname — must never become a host"),
+    ],
+)
 async def test_ssrf_targets_are_never_probed(ip, name, why):
     session = FakeSession(response=FakeResponse(200, {"ok": True}))
     client = XMRigWorkerClient(session)
+    # A skipped target returns {} (api_ok unset = "unknown", not a failure) and issues no request.
     assert await client.get_stats(ip, name) == {}, why
     assert session.calls == [], f"issued a request despite {why}"
 
 
-@pytest.mark.parametrize("ip", [
-    "192.168.1.50",      # LAN miner
-    "10.0.0.1",          # LAN miner
-    "172.16.5.5",        # LAN miner outside the docker bridge
-    "8.8.8.8",           # public miner
-    "10.0.0.1:54321",    # "ip:port" form is tolerated
-])
+@pytest.mark.parametrize(
+    "ip",
+    [
+        "192.168.1.50",  # LAN miner
+        "10.0.0.1",  # LAN miner
+        "172.16.5.5",  # LAN miner outside the docker bridge
+        "8.8.8.8",  # public miner
+        "10.0.0.1:54321",  # "ip:port" form is tolerated
+    ],
+)
 async def test_real_miner_ip_is_probed(ip):
     session = FakeSession(response=FakeResponse(200, {"ok": True}))
     client = XMRigWorkerClient(session)
     result = await client.get_stats(ip, "rig")
-    assert result == {"ok": True}
+    assert result == {"ok": True, "api_ok": True}
     host = ip.split(":")[0]
     assert session.calls[0][0] == f"http://{host}:8080/1/summary"
 
 
-async def test_name_is_used_as_bearer_never_as_host():
-    # With a valid IP, the stripped name is offered back as the miner's access token — but every
+async def test_name_is_used_as_bearer_never_as_host(monkeypatch):
+    # Under name-auth, the stripped name is offered back as the miner's access token — but the
     # request still targets the validated IP, never the name.
+    monkeypatch.setattr(xc, "XMRIG_API_AUTH", "name")
     session = FakeSession(response=FakeResponse(404))
     client = XMRigWorkerClient(session)
     await client.get_stats("10.0.0.1", "rig1+worker")
     assert all("10.0.0.1" in url for url, _ in session.calls)
-    assert not any("rig1" in url for url, _ in session.calls)   # name never becomes a host
+    assert not any("rig1" in url for url, _ in session.calls)  # name never becomes a host
     bearers = [h.get("Authorization") for _, h in session.calls if h]
-    assert "Bearer rig1" in bearers                              # '+'-suffix stripped, used as token
+    assert "Bearer rig1" in bearers  # '+'-suffix stripped, used as token
 
 
-async def test_long_name_token_is_capped():
+async def test_long_name_token_is_capped(monkeypatch):
+    monkeypatch.setattr(xc, "XMRIG_API_AUTH", "name")
     session = FakeSession(response=FakeResponse(404))
     client = XMRigWorkerClient(session)
     await client.get_stats("10.0.0.1", "A" * 500)
diff --git a/build/dashboard/tests/client/test_xvb_client.py b/build/dashboard/tests/client/test_xvb_client.py
index b3b8b1fc..70a10d9b 100644
--- a/build/dashboard/tests/client/test_xvb_client.py
+++ b/build/dashboard/tests/client/test_xvb_client.py
@@ -1,10 +1,16 @@
-from unittest.mock import patch, MagicMock
+from unittest.mock import MagicMock, patch
 
 import requests
 
 import mining_dashboard.client.xvb_client as xvb_mod
-from mining_dashboard.client.xvb_client import XvbClient
-
+from mining_dashboard.client.xvb_client import (
+    REG_DISABLED,
+    REG_ERROR,
+    REG_INVALID,
+    REG_NOT_ELIGIBLE,
+    REG_OK,
+    XvbClient,
+)
 
 SAMPLE_HTML = "Fail Count: 2\n1hr avg: 1.5 kH/s\n24hr avg: 3.0 kH/s\n"
 
@@ -31,7 +37,7 @@ def test_get_stats_routes_through_tor_proxy():
     with patch.object(xvb_mod.requests, "get", return_value=resp) as mock_get:
         client.get_stats()
     proxies = mock_get.call_args.kwargs["proxies"]
-    assert proxies["https"].startswith("socks5h://")   # socks5h resolves the host via Tor too
+    assert proxies["https"].startswith("socks5h://")  # socks5h resolves the host via Tor too
     assert proxies["http"] == proxies["https"]
 
 
@@ -55,6 +61,98 @@ def test_get_stats_network_error_returns_none():
         assert client.get_stats() is None
 
 
+def test_get_stats_unexpected_error_returns_none():
+    client = XvbClient("49abc")
+    with patch.object(xvb_mod.requests, "get", side_effect=ValueError("kaboom")):
+        assert client.get_stats() is None
+
+
+_SUBMIT = (
+    "https://xmrvsbeast.example/submit.cgi"  # placeholder; real endpoint is unpublished (#263)
+)
+
+
+def _resp(status, text=""):
+    return MagicMock(status_code=status, text=text)
+
+
+class TestRegister:
+    """register() classifies the endpoint's real contract (status + body), verified live (#263)."""
+
+    def test_disabled_when_no_endpoint(self):
+        # Disable sentinel => empty submit_url => never reach out at all.
+        client = XvbClient("49abc", submit_url="")
+        with patch.object(xvb_mod.requests, "get") as mock_get:
+            assert client.register() == REG_DISABLED
+        mock_get.assert_not_called()
+
+    def test_missing_wallet_is_invalid(self):
+        client = XvbClient("", submit_url=_SUBMIT)
+        with patch.object(xvb_mod.requests, "get") as mock_get:
+            assert client.register() == REG_INVALID
+        mock_get.assert_not_called()
+        assert XvbClient("placeholder", submit_url=_SUBMIT).register() == REG_INVALID
+
+    def test_2xx_is_registered_and_sends_full_wallet(self):
+        client = XvbClient("49fullwalletaddress", submit_url=_SUBMIT)
+        with patch.object(xvb_mod.requests, "get", return_value=_resp(200, "OK")) as mock_get:
+            assert client.register() == REG_OK
+        # Registration takes the FULL wallet address as ?address=...
+        assert mock_get.call_args.kwargs["params"] == {"address": "49fullwalletaddress"}
+        assert mock_get.call_args.args[0] == _SUBMIT
+
+    def test_already_registered_422_is_idempotent_success(self):
+        # The real steady state for an entered wallet (verified live): 422 + this body.
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        resp = _resp(422, "ERROR: Wallet Address Already Registered")
+        with patch.object(xvb_mod.requests, "get", return_value=resp):
+            assert client.register() == REG_OK
+
+    def test_invalid_wallet_422(self):
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        resp = _resp(422, "ERROR: Invalid Wallet Address")
+        with patch.object(xvb_mod.requests, "get", return_value=resp):
+            assert client.register() == REG_INVALID
+
+    def test_no_share_body_is_not_eligible(self):
+        # Best-effort: a body mentioning the PPLNS share => retry quietly, not a failure.
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        resp = _resp(422, "ERROR: No share in PPLNS window")
+        with patch.object(xvb_mod.requests, "get", return_value=resp):
+            assert client.register() == REG_NOT_ELIGIBLE
+
+    def test_5xx_is_transient_error(self):
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        with patch.object(xvb_mod.requests, "get", return_value=_resp(500, "Server error!")):
+            assert client.register() == REG_ERROR
+
+    def test_unrecognised_body_is_error(self):
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        with patch.object(xvb_mod.requests, "get", return_value=_resp(418, "teapot")):
+            assert client.register() == REG_ERROR
+
+    def test_routes_through_configured_tor_proxy_by_default(self):
+        # #163: the call carries the full wallet, so it ALWAYS rides the bridge Tor SOCKS like
+        # get_stats — a default-constructed client (as main.py builds it) uses XVB_TOR_PROXY.
+        client = XvbClient("49abc", submit_url=_SUBMIT)  # no tor_proxy => the configured default
+        with patch.object(xvb_mod.requests, "get", return_value=_resp(200, "OK")) as mock_get:
+            client.register()
+        proxies = mock_get.call_args.kwargs["proxies"]
+        assert proxies["https"] == xvb_mod.XVB_TOR_PROXY
+        assert proxies["https"].startswith("socks5h://")  # resolves the host over Tor too
+        assert proxies["http"] == proxies["https"]
+
+    def test_network_error_is_transient_error(self):
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        with patch.object(xvb_mod.requests, "get", side_effect=requests.RequestException("boom")):
+            assert client.register() == REG_ERROR
+
+    def test_unexpected_error_is_transient_error(self):
+        client = XvbClient("49abc", submit_url=_SUBMIT)
+        with patch.object(xvb_mod.requests, "get", side_effect=ValueError("kaboom")):
+            assert client.register() == REG_ERROR
+
+
 class TestParseHtml:
     def test_fail_count_only(self):
         client = XvbClient("49abc")
diff --git a/build/dashboard/tests/collector/test_logs.py b/build/dashboard/tests/collector/test_logs.py
index 73bce1e1..b4ae0599 100644
--- a/build/dashboard/tests/collector/test_logs.py
+++ b/build/dashboard/tests/collector/test_logs.py
@@ -1,7 +1,5 @@
 import struct
-from unittest.mock import patch, AsyncMock, MagicMock
-
-import pytest
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import mining_dashboard.collector.logs as logs
 
@@ -71,14 +69,20 @@ async def _patch_file(self, content):
         return patch.object(logs.aiofiles, "open", return_value=_AsyncCM(_FakeFile(content)))
 
     async def test_syncing(self):
-        with patch.object(logs.aiofiles, "open",
-                          return_value=_AsyncCM(_FakeFile('{"height": 50, "target_height": 100}'))):
+        with patch.object(
+            logs.aiofiles,
+            "open",
+            return_value=_AsyncCM(_FakeFile('{"height": 50, "target_height": 100}')),
+        ):
             status = await logs._get_remote_monero_sync_status()
         assert status == {"is_syncing": True, "current": 50, "target": 100, "percent": 50}
 
     async def test_synced(self):
-        with patch.object(logs.aiofiles, "open",
-                          return_value=_AsyncCM(_FakeFile('{"height": 100, "target_height": 100}'))):
+        with patch.object(
+            logs.aiofiles,
+            "open",
+            return_value=_AsyncCM(_FakeFile('{"height": 100, "target_height": 100}')),
+        ):
             assert await logs._get_remote_monero_sync_status() == {"is_syncing": False}
 
     async def test_file_not_found(self):
@@ -94,21 +98,28 @@ class TestLogSyncStatus:
     """Log-scraping fallback path (`_get_monero_sync_status_from_logs`)."""
 
     async def test_new_format_top_block_candidate(self):
-        with patch.object(logs, "get_monero_logs",
-                          AsyncMock(return_value=["top block candidate: 100 -> 200 [node]"])):
+        with patch.object(
+            logs,
+            "get_monero_logs",
+            AsyncMock(return_value=["top block candidate: 100 -> 200 [node]"]),
+        ):
             status = await logs._get_monero_sync_status_from_logs()
         assert status["is_syncing"] is True
         assert status["current"] == 100 and status["target"] == 200
         assert status["percent"] == 50
 
     async def test_old_synced_format(self):
-        with patch.object(logs, "get_monero_logs",
-                          AsyncMock(return_value=["Synced 50/100 (50%, ...)"])):
+        with patch.object(
+            logs, "get_monero_logs", AsyncMock(return_value=["Synced 50/100 (50%, ...)"])
+        ):
             assert (await logs._get_monero_sync_status_from_logs())["percent"] == 50
 
     async def test_already_synchronized(self):
-        with patch.object(logs, "get_monero_logs",
-                          AsyncMock(return_value=["You are now synchronized with the network"])):
+        with patch.object(
+            logs,
+            "get_monero_logs",
+            AsyncMock(return_value=["You are now synchronized with the network"]),
+        ):
             assert await logs._get_monero_sync_status_from_logs() == {"is_syncing": False}
 
     async def test_error_logs(self):
@@ -122,8 +133,10 @@ class TestLocalSyncStatus:
     async def test_rpc_result_used_when_available(self):
         # RPC returns a status → use it directly (flagged reachable), never touch the logs.
         rpc_status = {"is_syncing": True, "current": 10, "target": 20, "percent": 50}
-        with patch.object(logs._monero_client, "get_sync_status", return_value=rpc_status), \
-             patch.object(logs, "get_monero_logs", AsyncMock()) as mock_logs:
+        with (
+            patch.object(logs._monero_client, "get_sync_status", return_value=rpc_status),
+            patch.object(logs, "get_monero_logs", AsyncMock()) as mock_logs,
+        ):
             status = await logs._get_local_monero_sync_status()
         assert status["is_syncing"] is True and status["percent"] == 50
         assert status["reachable"] is True
@@ -132,9 +145,12 @@ async def test_rpc_result_used_when_available(self):
     async def test_falls_back_to_logs_when_rpc_unreachable(self):
         # RPC returns None (node unreachable / creds absent) → scrape logs, flagged not
         # reachable so the down-detector can act (Issue #31).
-        with patch.object(logs._monero_client, "get_sync_status", return_value=None), \
-             patch.object(logs, "get_monero_logs",
-                          AsyncMock(return_value=["Synced 50/100 (50%, ...)"])):
+        with (
+            patch.object(logs._monero_client, "get_sync_status", return_value=None),
+            patch.object(
+                logs, "get_monero_logs", AsyncMock(return_value=["Synced 50/100 (50%, ...)"])
+            ),
+        ):
             status = await logs._get_local_monero_sync_status()
         assert status["is_syncing"] is True and status["percent"] == 50
         assert status["reachable"] is False
@@ -142,13 +158,23 @@ async def test_falls_back_to_logs_when_rpc_unreachable(self):
 
 class TestDispatch:
     async def test_local_when_default_host(self):
-        with patch.object(logs, "MONERO_NODE_HOST", "172.28.0.26"), \
-             patch.object(logs, "_get_local_monero_sync_status", AsyncMock(return_value={"is_syncing": True})):
+        with (
+            patch.object(logs, "MONERO_NODE_HOST", "172.28.0.26"),
+            patch.object(
+                logs, "_get_local_monero_sync_status", AsyncMock(return_value={"is_syncing": True})
+            ),
+        ):
             assert (await logs.get_monero_sync_status())["is_syncing"] is True
 
     async def test_remote_when_other_host(self):
-        with patch.object(logs, "MONERO_NODE_HOST", "10.0.0.9"), \
-             patch.object(logs, "_get_remote_monero_sync_status", AsyncMock(return_value={"is_syncing": False})):
+        with (
+            patch.object(logs, "MONERO_NODE_HOST", "10.0.0.9"),
+            patch.object(
+                logs,
+                "_get_remote_monero_sync_status",
+                AsyncMock(return_value={"is_syncing": False}),
+            ),
+        ):
             # Remote node is reported reachable so reject-workers no-ops for it (Issue #31).
             assert await logs.get_monero_sync_status() == {"is_syncing": False, "reachable": True}
 
diff --git a/build/dashboard/tests/collector/test_pools.py b/build/dashboard/tests/collector/test_pools.py
index 99ba66e1..b7bbcbee 100644
--- a/build/dashboard/tests/collector/test_pools.py
+++ b/build/dashboard/tests/collector/test_pools.py
@@ -2,12 +2,17 @@
 
 import mining_dashboard.collector.pools as pools
 from mining_dashboard.collector.pools import (
-    detect_pool_type, get_p2pool_stats, get_network_stats,
-    get_stratum_stats, get_tari_stats,
+    detect_pool_type,
+    get_network_stats,
+    get_p2pool_stats,
+    get_stratum_stats,
+    get_tari_stats,
 )
 from mining_dashboard.config.config import (
-    P2P_STATS_PATH, POOL_STATS_PATH, STRATUM_STATS_PATH,
-    NETWORK_STATS_PATH, TARI_STATS_PATH, SECOND_PER_BLOCK_MAIN,
+    P2P_STATS_PATH,
+    POOL_STATS_PATH,
+    SECOND_PER_BLOCK_MAIN,
+    STRATUM_STATS_PATH,
 )
 
 
@@ -29,8 +34,10 @@ def test_port_matched_exactly_not_as_substring(self):
         # Each of these returned a WRONG pool under the old `"37889" in p` substring check (#142).
         assert detect_pool_type(["1.1.1.1:137889"]) == "Unknown"  # old: contained "37889" -> Main
         assert detect_pool_type(["1.1.1.1:378880"]) == "Unknown"  # old: contained "37888" -> Mini
-        assert detect_pool_type(["1.1.1.1:37889x"]) == "Unknown"  # trailing junk -> not the Main port
-        assert detect_pool_type(["1.1.1.1:37888"]) == "Mini"      # exact port still detected
+        assert (
+            detect_pool_type(["1.1.1.1:37889x"]) == "Unknown"
+        )  # trailing junk -> not the Main port
+        assert detect_pool_type(["1.1.1.1:37888"]) == "Mini"  # exact port still detected
 
 
 def _read_json_map(mapping):
@@ -41,8 +48,14 @@ def _read_json_map(mapping):
 class TestP2poolStats:
     def test_aggregates_sources(self):
         mapping = {
-            P2P_STATS_PATH: {"peers": ["1.1.1.1:37889"], "connections": 8, "incoming_connections": 2},
-            POOL_STATS_PATH: {"pool_statistics": {"hashRate": 1234, "miners": 5, "pplnsWindowSize": 2160}},
+            P2P_STATS_PATH: {
+                "peers": ["1.1.1.1:37889"],
+                "connections": 8,
+                "incoming_connections": 2,
+            },
+            POOL_STATS_PATH: {
+                "pool_statistics": {"hashRate": 1234, "miners": 5, "pplnsWindowSize": 2160}
+            },
             STRATUM_STATS_PATH: {"last_share_found_time": 99, "shares_found": 7},
         }
         with patch.object(pools, "_read_json", side_effect=_read_json_map(mapping)):
@@ -74,28 +87,41 @@ def test_hashrate_passthrough(self):
 
 
 class TestStratumStats:
-    def test_worker_parsing(self):
-        raw = {"workers": ["10.0.0.1:3333,x,y,z,rig-01,extra"]}
+    def test_returns_raw_json(self):
+        raw = {"workers": ["10.0.0.1:3333,x,y,z,rig-01"]}
         with patch.object(pools, "_read_json", return_value=raw):
-            _, workers = get_stratum_stats()
-        assert workers == [{"ip": "10.0.0.1", "name": "rig-01",
-                            "parts": ["10.0.0.1:3333", "x", "y", "z", "rig-01", "extra"]}]
-
-    def test_worker_without_name_defaults_to_miner(self):
-        with patch.object(pools, "_read_json", return_value={"workers": ["10.0.0.2:3333"]}):
-            _, workers = get_stratum_stats()
-        assert workers[0]["name"] == "miner"
+            assert get_stratum_stats() == raw
 
 
 class TestTariStats:
     def test_active_chain_converts_utari(self):
-        raw = {"chains": [{"channel_state": "Active", "wallet": "T123", "height": 5,
-                           "reward": 2_000_000, "difficulty": 42}]}
+        raw = {
+            "chains": [
+                {
+                    "channel_state": "READY",
+                    "wallet": "T123",
+                    "height": 5,
+                    "reward": 2_000_000,
+                    "difficulty": 42,
+                }
+            ]
+        }
         with patch.object(pools, "_read_json", return_value=raw):
             s = get_tari_stats()
         assert s["active"] is True
         assert s["reward"] == 2.0  # 2_000_000 uTari -> 2 Tari
-        assert s["status"] == "Active"
+        assert s["status"] == "READY"
+        assert s["connected"] is True  # gRPC channel READY -> drives the ✔
+
+    def test_unhealthy_channel_is_active_but_not_connected(self):
+        # A configured chain whose gRPC channel is down (e.g. dialled through Tor and rejected) must
+        # report active=True (so the panel shows) but connected=False (so the UI shows no ✔).
+        raw = {"chains": [{"channel_state": "TRANSIENT_FAILURE", "wallet": "T123"}]}
+        with patch.object(pools, "_read_json", return_value=raw):
+            s = get_tari_stats()
+        assert s["active"] is True
+        assert s["status"] == "TRANSIENT_FAILURE"
+        assert s["connected"] is False
 
     def test_no_chains_inactive(self):
         with patch.object(pools, "_read_json", return_value={}):
diff --git a/build/dashboard/tests/collector/test_system.py b/build/dashboard/tests/collector/test_system.py
index 7c01bde1..9e54b433 100644
--- a/build/dashboard/tests/collector/test_system.py
+++ b/build/dashboard/tests/collector/test_system.py
@@ -12,7 +12,9 @@ def _fake_open(content):
 
 class TestDiskUsage:
     def test_normal(self):
-        usage = SimpleNamespace(total=100 * system.BYTES_IN_GB, used=25 * system.BYTES_IN_GB, free=0)
+        usage = SimpleNamespace(
+            total=100 * system.BYTES_IN_GB, used=25 * system.BYTES_IN_GB, free=0
+        )
         with patch.object(system.shutil, "disk_usage", return_value=usage):
             d = system.get_disk_usage()
         assert d["total_gb"] == 100
diff --git a/build/dashboard/tests/config/test_config.py b/build/dashboard/tests/config/test_config.py
index eef8715f..3cfa2d97 100644
--- a/build/dashboard/tests/config/test_config.py
+++ b/build/dashboard/tests/config/test_config.py
@@ -1,11 +1,12 @@
-import os
-import json
 import importlib
+import json
+import os
 from unittest.mock import patch
 
 
 def _reload_config():
     import mining_dashboard.config.config as cfg
+
     return importlib.reload(cfg)
 
 
@@ -16,6 +17,7 @@ def teardown_method(self):
 
     def test_defaults_load(self):
         import mining_dashboard.config.config as cfg
+
         assert cfg.XMRIG_API_PORT == 8080
         assert cfg.XVB_DONATION_LEVEL == "auto"
         assert cfg.XVB_MAX_DONATION_FRACTION == 0.85
@@ -65,3 +67,20 @@ def test_xvb_enabled_flag(self):
         with patch.dict(os.environ, {"XVB_ENABLED": "true"}):
             cfg = _reload_config()
             assert cfg.ENABLE_XVB is True
+
+    def test_xvb_submit_url_default_is_the_real_endpoint(self):
+        # #263: registration works out of the box — the default is the real submit endpoint.
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("XVB_SUBMIT_URL", None)
+            cfg = _reload_config()
+        assert cfg.XVB_SUBMIT_URL == "https://xmrvsbeast.com/cgi-bin/p2pool_bonus_submit_api.cgi"
+
+    def test_xvb_submit_url_explicit_override(self):
+        with patch.dict(os.environ, {"XVB_SUBMIT_URL": "https://test.example/submit.cgi"}):
+            assert _reload_config().XVB_SUBMIT_URL == "https://test.example/submit.cgi"
+
+    def test_xvb_submit_url_disable_sentinels(self):
+        # Turn auto-registration off (keeping XvB on) without knowing the endpoint.
+        for v in ("off", "none", "FALSE", "disabled", "0"):
+            with patch.dict(os.environ, {"XVB_SUBMIT_URL": v}):
+                assert _reload_config().XVB_SUBMIT_URL == "", f"{v!r} should disable"
diff --git a/build/dashboard/tests/conftest.py b/build/dashboard/tests/conftest.py
index f3925f6a..b5917e53 100644
--- a/build/dashboard/tests/conftest.py
+++ b/build/dashboard/tests/conftest.py
@@ -2,6 +2,7 @@
 
 Everything here keeps tests hermetic: no real database on disk, no network, no containers.
 """
+
 import pytest
 
 from mining_dashboard.service.storage_service import StateManager
diff --git a/build/dashboard/tests/frontend/chart.test.mjs b/build/dashboard/tests/frontend/chart.test.mjs
new file mode 100644
index 00000000..fccff6ce
--- /dev/null
+++ b/build/dashboard/tests/frontend/chart.test.mjs
@@ -0,0 +1,54 @@
+// Unit tests for the chart's pure helpers (mining_dashboard/web/static/chart.mjs).
+//
+// Run with Node's built-in test runner (CI runs exactly this):
+//     node --test build/dashboard/tests/frontend/
+//
+// Only the DOM-free logic is covered here (the Chart.js wiring + canvas gradients need a browser,
+// by the repo's deliberate no-DOM-toolchain policy). withAlpha and padYAxis carry real regression
+// risk — a colour-fill correctness rule and the near-flat-series y-padding maths.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import { withAlpha, padYAxis } from '../../mining_dashboard/web/static/chart.mjs';
+
+test('withAlpha: appends an 8-bit alpha to a #rrggbb hex', () => {
+    assert.equal(withAlpha('#58a6ff', '26'), '#58a6ff26');
+    assert.equal(withAlpha('#000000', '0d'), '#0000000d');
+});
+
+test('withAlpha: non-#rrggbb values pass through opaque (a palette change cannot break fills)', () => {
+    // CSS vars can resolve to rgb()/named/already-aa'd colours; those must pass through unchanged.
+    for (const v of ['rgb(1,2,3)', 'red', '#abc', '#58a6ff26', '']) {
+        assert.equal(withAlpha(v, '26'), v, v);
+    }
+});
+
+test('padYAxis: pads the range and clamps the floor to zero', () => {
+    const s = { min: 100, max: 200 };
+    padYAxis(s);
+    // pad = max(span*0.2, max*0.03) = max(20, 6) = 20
+    assert.equal(s.min, 80);
+    assert.equal(s.max, 220);
+});
+
+test('padYAxis: the floor is clamped to zero, never negative', () => {
+    const s = { min: 10, max: 100 };
+    padYAxis(s);
+    // pad = max(span*0.2, max*0.03) = max(18, 3) = 18; 10 - 18 < 0 → clamps to 0.
+    assert.equal(s.min, 0);
+    assert.equal(s.max, 118);
+});
+
+test('padYAxis: the magnitude floor applies when the span is flat', () => {
+    const s = { min: 1000, max: 1000 };
+    padYAxis(s);
+    // span is 0, so pad falls back to max*0.03 = 30
+    assert.equal(s.min, 970);
+    assert.equal(s.max, 1030);
+});
+
+test('padYAxis: no-op when the range is non-finite (all series hidden / no data)', () => {
+    const s = { min: NaN, max: NaN };
+    padYAxis(s);
+    assert.ok(Number.isNaN(s.min) && Number.isNaN(s.max));
+});
diff --git a/build/dashboard/tests/frontend/components.test.mjs b/build/dashboard/tests/frontend/components.test.mjs
new file mode 100644
index 00000000..d8caf4b6
--- /dev/null
+++ b/build/dashboard/tests/frontend/components.test.mjs
@@ -0,0 +1,246 @@
+// Render smoke tests for the dashboard's Preact components (mining_dashboard/web/static/components.mjs).
+//
+// Run with Node's built-in test runner (CI runs exactly this):
+//     node --test build/dashboard/tests/frontend/
+//
+// components.mjs exports only the App root by design, so these drive every card *through* App —
+// varying the /api/state fixture to reach each branch (loading / syncing / operational) and edge
+// case. The fixture is a real build_state() payload (tests/frontend/fixtures/state.json, regenerate
+// with fixtures/_gen_state.py), so the components are exercised against the true server contract.
+// Rendering uses a dependency-free vnode walker (helpers/render.mjs) — no DOM, no npm deps.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+import { App } from '../../mining_dashboard/web/static/components.mjs';
+import { render } from './helpers/render.mjs';
+
+const BASE = JSON.parse(readFileSync(new URL('./fixtures/state.json', import.meta.url)));
+const clone = () => structuredClone(BASE);
+
+// Default client UI state; the handlers are no-ops (the renderer never invokes them).
+const UI = {
+    view: 'advanced', range: 'all', window: null, series: {}, avg: '10m',
+    theme: 'auto', sortIndex: null, sortAsc: true,
+};
+const noop = () => {};
+const HANDLERS = {
+    onRange: noop, onSort: noop, onView: noop, onTheme: noop,
+    onZoom: noop, onResetZoom: noop, onToggleSeries: noop, onAvgWindow: noop,
+};
+
+function renderApp({ state = BASE, connected = true, ui = UI } = {}) {
+    return render(App, { state, connected, ui, ...HANDLERS });
+}
+
+// --- App shell / connection states -----------------------------------------------------
+
+test('App without state shows the right connection message', () => {
+    assert.match(renderApp({ state: null, connected: true }), /Connecting to the dashboard/);
+    assert.match(renderApp({ state: null, connected: false }), /Cannot reach the dashboard/);
+});
+
+test('App always renders the theme switcher, even before the first load', () => {
+    assert.match(renderApp(), /theme-switcher/);
+    assert.match(renderApp({ state: null }), /theme-switcher/);
+});
+
+test('operational App shows a disconnected banner when not connected', () => {
+    assert.match(renderApp({ connected: false }), /Disconnected — showing last known data/);
+    assert.doesNotMatch(renderApp({ connected: true }), /Disconnected — showing last known data/);
+});
+
+// --- Header -----------------------------------------------------------------------------
+
+test('Header renders the brand, server badges, version + update badges', () => {
+    const html = renderApp();
+    assert.match(html, /brand-name">Pithead/);
+    assert.match(html, /P2POOL/); // a server-provided mode badge
+    assert.match(html, /Tor-only egress/); // the #170 egress badge rides in the header
+    assert.match(html, /dev build/); // version badge text
+    assert.match(html, /New release v9\.9\.9 available/); // update badge (#224)
+});
+
+test('Header surfaces a High Usage badge only when a resource is hot', () => {
+    assert.doesNotMatch(renderApp(), /High Usage/); // base fixture is all "ok"
+    const s = clone();
+    s.system.cpu.level = 'high';
+    assert.match(renderApp({ state: s }), /High Usage/);
+});
+
+// --- Hero band + operational cards ------------------------------------------------------
+
+test('operational App renders the hero band and the headline cards', () => {
+    const html = renderApp();
+    assert.match(html, /hero-band/);
+    assert.match(html, /Workers Alive/);
+    assert.match(html, /Overview/);
+    assert.match(html, /My P2Pool Node Stats/);
+    assert.match(html, /XvB Donation Stats/);
+    assert.match(html, /Stack Topology & Egress/);
+});
+
+test('operational App renders the remaining advanced cards', () => {
+    const html = renderApp();
+    assert.match(html, /Global P2Pool Stats/);
+    assert.match(html, /XMR Network/);
+    assert.match(html, /Tari Merge Mining/);
+    assert.match(html, /P2Pool Earnings \(estimated\)/);
+});
+
+test('EarningsCard shows the fallback when stats are down, the calculator when available', () => {
+    // The base fixture has earnings.available === false → the fallback copy, no what-if input.
+    const down = renderApp();
+    assert.match(down, /the estimate can't be computed right now/);
+    assert.doesNotMatch(down, /whatif-hr/);
+    // With stats available, the class component renders its what-if input (local UI state).
+    const s = clone();
+    s.earnings.available = true;
+    const up = renderApp({ state: s });
+    assert.match(up, /Your P2Pool Hashrate/);
+    assert.match(up, /id="whatif-hr"/);
+});
+
+test('XvBStats greys the credited figures and flags the footer when the fetch is stale (#311)', () => {
+    // Fresh (base fixture, xvb_stale false): the normal "Stats fetched" footer, no stale marks.
+    const fresh = renderApp();
+    assert.match(fresh, /Stats fetched from xmrvsbeast\.com \(Updated:/);
+    assert.doesNotMatch(fresh, /Stale —/);
+    assert.doesNotMatch(fresh, /Credited\) ⚠/);
+    // Stale: credited labels get a ⚠, the footer flips to the stale warning, status-warn applied.
+    const s = clone();
+    s.hashrate.xvb_stale = true;
+    const stale = renderApp({ state: s });
+    assert.match(stale, /1h Avg \(Credited\) ⚠/);
+    assert.match(stale, /24h Avg \(Credited\) ⚠/);
+    assert.match(stale, /⚠ Stale — last successful fetch from xmrvsbeast\.com/);
+    assert.match(stale, /status-warn/);
+});
+
+// --- Workers table ----------------------------------------------------------------------
+
+test('WorkersTable renders headers and a row per worker with status classes', () => {
+    const html = renderApp();
+    for (const label of ['Worker', 'IP', 'Uptime', 'Accepted', 'Rejected']) {
+        assert.match(html, new RegExp(`>${label}<`), `missing column: ${label}`);
+    }
+    assert.match(html, /rig-alpha/);
+    assert.match(html, /rig-bravo/);
+    assert.match(html, /status-ok/); // the online worker's row
+    assert.match(html, /status-bad/); // the offline worker's row
+    assert.match(html, /badge-ok">P2Pool/); // PoolBadge for a p2pool worker
+});
+
+test('WorkersTable with no workers still renders the headers but no rows', () => {
+    const s = clone();
+    s.workers = [];
+    const html = renderApp({ state: s });
+    assert.match(html, /Workers Alive/);
+    assert.match(html, />Worker</);
+    assert.doesNotMatch(html, /rig-alpha/);
+});
+
+test('ProxyTotals footer is hidden until the proxy reports data', () => {
+    assert.doesNotMatch(renderApp(), /Proxy totals/); // fixture has has_data:false
+    const s = clone();
+    s.proxy_summary.has_data = true;
+    s.proxy_summary.accepted = '1200';
+    assert.match(renderApp({ state: s }), /Proxy totals/);
+});
+
+test('ProxyTotals reddens the rejected figure only when reject_level is high', () => {
+    // The base fixture's workers are all clean, so nothing reaches the styled-rejects branch.
+    const s = clone();
+    Object.assign(s.proxy_summary, {
+        has_data: true, accepted: '1200', rejected: '50', reject_pct: '4%',
+        reject_level: 'high', invalid: '0', best: '123',
+    });
+    assert.match(renderApp({ state: s }), /status-bad">50/); // high -> rejected total is reddened
+    s.proxy_summary.reject_level = 'ok';
+    assert.doesNotMatch(renderApp({ state: s }), /status-bad">50/); // ok -> plain, not reddened
+});
+
+test('WorkersTable surfaces the per-rig api-unreadable and reject badges, and the pool badge variants', () => {
+    // The single fixture pins both workers to pool=p2pool, api_ok=null, reject_flag=null, so these
+    // three problem-rig signals — the whole point of the pool/api/rejected columns — never render.
+    const s = clone();
+    s.workers[0].api_ok = false; // xmrig API unreadable -> "api ⚠"
+    s.workers[0].reject_flag = { text: '90% rejected', title: 'high reject rate' };
+    s.workers[0].pool = 'xvb'; // purple XvB badge
+    s.workers[1].pool = 'somethingelse'; // unrecognised -> Unknown (bad) badge
+    const html = renderApp({ state: s });
+    assert.match(html, /api ⚠/); // api_ok===false badge (only UI signal a rig's API is unreadable)
+    assert.match(html, /90% rejected/); // per-row reject badge (how you spot a problem rig)
+    assert.match(html, /badge-purple">XvB/);
+    assert.match(html, /badge-bad">Unknown/);
+});
+
+test('Tari status gates the ✔ on a live gRPC channel, never on active-but-dead (#278/#313)', () => {
+    // The ✔ must mean the merge-mine channel is actually up. A dead channel that still reads "active"
+    // must show status-warn and NO check — otherwise a TRANSIENT_FAILURE reads as healthy (#278/#313).
+    const connected = clone();
+    Object.assign(connected.tari, { connected: true, active: true, status: 'Merge mining' });
+    const cHtml = renderApp({ state: connected });
+    assert.match(cHtml, /status-ok">Merge mining/);
+    assert.match(cHtml, /check-inline/); // connected -> the ✔ shows
+
+    const deadButActive = clone();
+    Object.assign(deadButActive.tari, { connected: false, active: true, status: 'Merge mining' });
+    const dHtml = renderApp({ state: deadButActive });
+    assert.match(dHtml, /status-warn">Merge mining/);
+    assert.doesNotMatch(dHtml, /check-inline/); // active-but-dead -> NO ✔ (the invariant)
+});
+
+test('Sync gauge shows a ✔ for a done chain and a live percent while syncing', () => {
+    const s = clone();
+    s.syncing = true;
+    s.sync.monero.state = 'syncing';
+    s.sync.monero.percent = 42;
+    assert.match(renderApp({ state: s }), /42%/); // syncing chain shows its percent
+    s.sync.monero.state = 'done';
+    assert.match(renderApp({ state: s }), /check-big/); // done chain shows the ✔, not a percent
+});
+
+// --- Component Health & Egress (#170) ---------------------------------------------------
+
+test('ComponentHealth shows a Tor-only summary, the topology nodes, and the egress drawer', () => {
+    const html = renderApp();
+    assert.match(html, /Stack Topology & Egress/);
+    assert.match(html, /🛡️/); // safe shield, not the warning triangle
+    assert.match(html, /All egress via Tor/);
+    // the StackTopology SVG renders its node labels...
+    assert.match(html, /Mining rigs/);
+    assert.match(html, /monerod/);
+    // ...and the per-component egress drawer lists each component.
+    assert.match(html, /All connections \(per component\)/);
+    assert.match(html, /xmrig-proxy/);
+});
+
+test('ComponentHealth flips to a warning summary when the posture leaks', () => {
+    const s = clone();
+    s.topology.summary.level = 'warn';
+    s.topology.summary.label = '2 clearnet egress path(s) exposing your IP';
+    assert.match(renderApp({ state: s }), /⚠️/);
+    assert.match(renderApp({ state: s }), /exposing your IP/);
+    assert.match(renderApp({ state: s }), /egress-summary c-bad/);
+});
+
+test('ComponentHealth still renders the panel but omits the drawer when egress is absent', () => {
+    const s = clone();
+    s.egress = null;
+    const html = renderApp({ state: s });
+    assert.match(html, /Stack Topology & Egress/); // the map still renders
+    assert.doesNotMatch(html, /All connections \(per component\)/); // no drawer
+});
+
+// --- Sync mode --------------------------------------------------------------------------
+
+test('syncing App renders the sync gauges instead of the dashboard', () => {
+    const s = clone();
+    s.syncing = true;
+    const html = renderApp({ state: s });
+    assert.match(html, /synchronizing with the network/);
+    assert.match(html, /Monero Sync/);
+    assert.match(html, /Tari Sync/);
+    assert.doesNotMatch(html, /Workers Alive/);
+});
diff --git a/build/dashboard/tests/frontend/fixtures/_gen_state.py b/build/dashboard/tests/frontend/fixtures/_gen_state.py
new file mode 100644
index 00000000..c2d88c96
--- /dev/null
+++ b/build/dashboard/tests/frontend/fixtures/_gen_state.py
@@ -0,0 +1,87 @@
+"""Generate a representative /api/state payload fixture for the frontend render tests.
+
+Run from build/dashboard:  uv run --extra test python tests/frontend/fixtures/_gen_state.py
+Writes tests/frontend/fixtures/state.json — a real build_state() payload (the exact contract the
+Preact client renders), so the JS smoke tests run against the true server shape rather than a
+hand-built guess. Regenerate when the payload contract changes.
+"""
+
+import json
+import os
+import time
+from pathlib import Path
+from unittest.mock import MagicMock
+
+import mining_dashboard.web.views as views
+
+# Pin everything machine- or time-dependent so the fixture regenerates identically on any box.
+# build_state stamps last_update via time.localtime(time.time()) and the chart x-axis is
+# now-relative, so freeze NOW (2025-01-01 00:00:00 UTC) + patch views.time.time and force UTC
+# for the localtime-based last_update string. host_addr is a live socket lookup
+# (detect_host_ipv4) and host_ip an env default — pin both too.
+os.environ["TZ"] = "UTC"
+time.tzset()
+NOW = 1735689600
+
+views.time.time = lambda: NOW  # build_state's last_update + history cutoff
+views.HOST_IP = "Unknown Host"
+views.detect_host_ipv4 = lambda: "100.68.38.126"
+
+HISTORY = [
+    {"timestamp": NOW - 600, "v": 10200, "v_p2pool": 8000, "v_xvb": 2200, "t": "a"},
+    {"timestamp": NOW - 300, "v": 10500, "v_p2pool": 8100, "v_xvb": 2400, "t": "b"},
+]
+
+WORKERS = [
+    {
+        "name": "rig-alpha",
+        "ip": "192.168.1.10",
+        "status": "online",
+        "active_pool": "3333",
+        "accepted": 1200,
+        "rejected": 1,
+        "hashrate_10s": 5200,
+        "hashrate_1m": 5100,
+        "hashrate_15m": 5000,
+    },
+    {
+        "name": "rig-bravo",
+        "ip": "192.168.1.11",
+        "status": "offline",
+        "active_pool": "3333",
+        "accepted": 800,
+        "rejected": 40,
+        "hashrate_10s": 0,
+        "hashrate_1m": 0,
+        "hashrate_15m": 4800,
+    },
+]
+
+
+def _state_mgr():
+    sm = MagicMock()
+    sm.get_history.return_value = HISTORY
+    sm.get_xvb_stats.return_value = {"current_mode": "P2POOL"}
+    sm.get_tiers.return_value = {}
+    sm.is_db_healthy.return_value = True
+    return sm
+
+
+def main():
+    data = {
+        "shares": [{"ts": NOW - 120}],
+        "workers": WORKERS,
+        "global_sync": False,
+        "total_live_h15": 10000,
+        "monero_sync": {"percent": 100, "current": 3000000, "target": 3000000},
+        "tari_sync": {"percent": 100, "current": 50000, "target": 50000},
+        "update": {"available": True, "latest": "v9.9.9", "url": "https://example/releases/v9.9.9"},
+    }
+    state = views.build_state(data, _state_mgr(), "all")
+    out = Path(__file__).with_name("state.json")
+    out.write_text(json.dumps(state, indent=2, sort_keys=True) + "\n")
+    print(f"wrote {out} ({out.stat().st_size} bytes)")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/build/dashboard/tests/frontend/fixtures/state.json b/build/dashboard/tests/frontend/fixtures/state.json
new file mode 100644
index 00000000..065c4d59
--- /dev/null
+++ b/build/dashboard/tests/frontend/fixtures/state.json
@@ -0,0 +1,547 @@
+{
+  "avg_window": "10m",
+  "avg_windows": [
+    "1m",
+    "10m",
+    "1h",
+    "12h",
+    "24h"
+  ],
+  "badges": [
+    {
+      "text": "P2POOL",
+      "variant": "ok"
+    },
+    {
+      "text": "P2Pool Main",
+      "variant": "outline"
+    },
+    {
+      "text": "XMR Pruned",
+      "title": "Monero blockchain is pruned",
+      "variant": "outline"
+    },
+    {
+      "text": "\ud83d\udee1\ufe0f Tor-only egress",
+      "title": "All egress via Tor",
+      "variant": "ok"
+    }
+  ],
+  "chart": {
+    "p2pool": [
+      {
+        "x": 1735689000000,
+        "y": 8000
+      },
+      {
+        "x": 1735689300000,
+        "y": 8100
+      }
+    ],
+    "shares": [
+      {
+        "c": 1,
+        "r": 9,
+        "x": 1735689300000,
+        "y": 0.93
+      }
+    ],
+    "tension": 0.0,
+    "xvb": [
+      {
+        "x": 1735689000000,
+        "y": 2200
+      },
+      {
+        "x": 1735689300000,
+        "y": 2400
+      }
+    ]
+  },
+  "db_healthy": true,
+  "earnings": {
+    "available": false,
+    "block_reward": "0.0000 XMR",
+    "coeff_day": 0.0,
+    "disclaimer": "Estimated XMR from P2Pool mining only \u2014 excludes XvB donations (donated hashrate earns no P2Pool payout) and Tari merge-mining. Expected values only; mining is variance-heavy, so real payouts swing well above and below these figures. Estimates, not guarantees.",
+    "p2pool_hr": 8050.0,
+    "p2pool_hr_str": "8.05 kH/s",
+    "pool_difficulty": 0
+  },
+  "egress": {
+    "components": [
+      {
+        "conns": [
+          {
+            "route": "tor",
+            "to": "Monero P2P / tx relay"
+          }
+        ],
+        "firewalled": true,
+        "name": "monerod"
+      },
+      {
+        "conns": [
+          {
+            "route": "tor",
+            "to": "sidechain P2P peers"
+          },
+          {
+            "route": "local",
+            "to": "monerod RPC/ZMQ"
+          }
+        ],
+        "firewalled": true,
+        "name": "p2pool"
+      },
+      {
+        "conns": [
+          {
+            "route": "tor",
+            "to": "Tari P2P transport"
+          },
+          {
+            "route": "local",
+            "to": "DNS resolution"
+          }
+        ],
+        "firewalled": true,
+        "name": "tari"
+      },
+      {
+        "conns": [
+          {
+            "route": "local",
+            "to": "upstream pool (local p2pool stratum)"
+          },
+          {
+            "route": "tor",
+            "to": "XvB donation pool"
+          },
+          {
+            "route": "inactive",
+            "to": "dev donation"
+          }
+        ],
+        "firewalled": true,
+        "name": "xmrig-proxy"
+      },
+      {
+        "conns": [
+          {
+            "route": "tor",
+            "to": "XvB stats (xmrvsbeast.com)"
+          },
+          {
+            "route": "tor",
+            "to": "update check (github)"
+          }
+        ],
+        "firewalled": false,
+        "name": "dashboard"
+      },
+      {
+        "conns": [
+          {
+            "route": "local",
+            "to": "TLS (internal CA, no ACME)"
+          }
+        ],
+        "firewalled": true,
+        "name": "caddy"
+      }
+    ],
+    "summary": {
+      "all_tor": true,
+      "blocked_by_firewall": 0,
+      "firewall": true,
+      "label": "All egress via Tor",
+      "leaks": 0,
+      "level": "ok"
+    }
+  },
+  "hashrate": {
+    "low_hr": null,
+    "mode_name": "P2POOL",
+    "mode_variant": "ok",
+    "p2p_1h": "8.05 kH/s",
+    "p2p_24h": "8.05 kH/s",
+    "p2p_variant": "ok",
+    "target_tier": "None",
+    "tier": "None",
+    "total": "10.00 kH/s",
+    "xvb_1h": "0.00 H/s",
+    "xvb_24h": "0.00 H/s",
+    "xvb_fail_count": 0,
+    "xvb_routed_1h": "2.30 kH/s",
+    "xvb_routed_24h": "2.30 kH/s",
+    "xvb_stale": false,
+    "xvb_updated": "Never",
+    "xvb_variant": "muted"
+  },
+  "host_addr": "100.68.38.126",
+  "host_ip": "Unknown Host",
+  "last_update": "00:00:00",
+  "monero": {
+    "db_size": "\u2014",
+    "mode": "Pruned"
+  },
+  "network": {
+    "diff": "0.00 G",
+    "hash": "N/A",
+    "height": 0,
+    "reward": "0.0000 XMR",
+    "ts": "Never"
+  },
+  "page_title": "Mining Dashboard",
+  "pool": {
+    "blocks": 0,
+    "diff": "0.00 M",
+    "hr": "0.00 H/s",
+    "last_blk": "Never",
+    "miners": 0,
+    "peers": "0 / 0",
+    "pplns_wgt": 0,
+    "pplns_win": "2160 (6h 0m)",
+    "sidechain_height": 0,
+    "total_hashes": 0,
+    "type": "Main",
+    "uptime": "0m 0s"
+  },
+  "proxy_summary": {
+    "accepted": "0",
+    "best": "\u2014",
+    "expired": "0",
+    "has_data": false,
+    "invalid": "0",
+    "reject_level": "ok",
+    "reject_pct": "0.00%",
+    "rejected": "0"
+  },
+  "proxy_workers": 1,
+  "raffle_eligible": {
+    "applies": true,
+    "eligible": false,
+    "label": "No"
+  },
+  "range": "all",
+  "shares_window": {
+    "count": 1,
+    "ok": true
+  },
+  "stratum": {
+    "conns": 0,
+    "effort": "0.0%",
+    "h15": "0.00 H/s",
+    "h1h": "0.00 H/s",
+    "h24h": "0.00 H/s",
+    "last_share": "Never",
+    "reward_pct": "0.0000%",
+    "shares": "0 / 0",
+    "total_hashes": 0,
+    "total_shares": 0,
+    "wallet": "Unknown",
+    "wallet_short": "Unknown"
+  },
+  "sync": {
+    "monero": {
+      "current": 3000000,
+      "db_size": "\u2014",
+      "mode": "Pruned",
+      "percent": 100,
+      "remaining": 0,
+      "state": "done",
+      "target": 3000000
+    },
+    "tari": {
+      "current": 50000,
+      "percent": 100,
+      "remaining": 0,
+      "state": "done",
+      "target": 50000
+    }
+  },
+  "syncing": false,
+  "system": {
+    "cpu": {
+      "level": "ok",
+      "load": "1m: 0.00 5m: 0.00 15m: 0.00",
+      "percent": "0.0%"
+    },
+    "disk": {
+      "fill": "",
+      "level": "ok",
+      "percent": "0%",
+      "total": "0.0",
+      "used": "0.0",
+      "width": "0%"
+    },
+    "hugepages": {
+      "status": "Disabled",
+      "value": "0/0",
+      "variant": "bad"
+    },
+    "mem": {
+      "level": "ok",
+      "percent": "0%",
+      "total": "0.0",
+      "used": "0.0"
+    }
+  },
+  "tari": {
+    "active": false,
+    "connected": false,
+    "diff": "0",
+    "height": "0",
+    "reward": "0.00 TARI",
+    "status": "Waiting...",
+    "wallet": "Unknown",
+    "wallet_short": "Unknown"
+  },
+  "topology": {
+    "edges": [
+      {
+        "from": "rigs",
+        "kind": "ingress",
+        "label": "stratum :3333",
+        "route": "local",
+        "to": "xmrig-proxy"
+      },
+      {
+        "from": "browser",
+        "kind": "ingress",
+        "label": "https :443",
+        "route": "local",
+        "to": "caddy"
+      },
+      {
+        "from": "p2pool",
+        "kind": "p2p",
+        "label": "sidechain P2P",
+        "route": "tor",
+        "to": "tor"
+      },
+      {
+        "from": "monerod",
+        "kind": "p2p",
+        "label": "Monero P2P + tx",
+        "route": "tor",
+        "to": "tor"
+      },
+      {
+        "from": "tari",
+        "kind": "p2p",
+        "label": "Tari P2P",
+        "route": "tor",
+        "to": "tor"
+      },
+      {
+        "from": "xmrig-proxy",
+        "kind": "egress",
+        "label": "XvB donation",
+        "route": "tor",
+        "to": "tor"
+      },
+      {
+        "from": "dashboard",
+        "kind": "egress",
+        "label": "update check",
+        "route": "tor",
+        "to": "tor"
+      },
+      {
+        "from": "dashboard",
+        "kind": "egress",
+        "label": "XvB stats",
+        "route": "tor",
+        "to": "tor"
+      },
+      {
+        "from": "tor",
+        "kind": "p2p",
+        "label": "SOCKS + onion circuits",
+        "route": "tor",
+        "to": "internet"
+      },
+      {
+        "from": "xmrig-proxy",
+        "kind": "internal",
+        "label": "upstream pool",
+        "route": "local",
+        "to": "p2pool"
+      },
+      {
+        "from": "p2pool",
+        "kind": "internal",
+        "label": "RPC / ZMQ",
+        "route": "local",
+        "to": "monerod"
+      },
+      {
+        "from": "p2pool",
+        "kind": "internal",
+        "label": "gRPC merge-mine",
+        "route": "local",
+        "to": "tari"
+      },
+      {
+        "from": "caddy",
+        "kind": "internal",
+        "label": "reverse-proxy :8000",
+        "route": "local",
+        "to": "dashboard"
+      },
+      {
+        "from": "dashboard",
+        "kind": "internal",
+        "label": "get_info RPC",
+        "route": "local",
+        "to": "monerod"
+      },
+      {
+        "from": "dashboard",
+        "kind": "internal",
+        "label": "proxy API",
+        "route": "local",
+        "to": "xmrig-proxy"
+      },
+      {
+        "from": "dashboard",
+        "kind": "internal",
+        "label": "gRPC",
+        "route": "local",
+        "to": "tari"
+      },
+      {
+        "from": "dashboard",
+        "kind": "internal",
+        "label": "container API",
+        "route": "local",
+        "to": "docker"
+      }
+    ],
+    "nodes": [
+      {
+        "id": "rigs",
+        "label": "Mining rigs",
+        "zone": "lan"
+      },
+      {
+        "id": "browser",
+        "label": "Browser",
+        "zone": "lan"
+      },
+      {
+        "id": "xmrig-proxy",
+        "label": "xmrig-proxy",
+        "zone": "host"
+      },
+      {
+        "id": "caddy",
+        "label": "caddy",
+        "zone": "host"
+      },
+      {
+        "id": "dashboard",
+        "label": "dashboard",
+        "zone": "host"
+      },
+      {
+        "id": "p2pool",
+        "label": "p2pool",
+        "zone": "host"
+      },
+      {
+        "id": "monerod",
+        "label": "monerod",
+        "zone": "host"
+      },
+      {
+        "id": "tari",
+        "label": "tari",
+        "zone": "host"
+      },
+      {
+        "id": "docker",
+        "internal": true,
+        "label": "docker-proxy",
+        "zone": "host"
+      },
+      {
+        "id": "tor",
+        "label": "tor",
+        "zone": "tor"
+      },
+      {
+        "id": "internet",
+        "label": "Tor network",
+        "zone": "internet"
+      }
+    ],
+    "summary": {
+      "all_tor": true,
+      "blocked_by_firewall": 0,
+      "firewall": true,
+      "label": "All egress via Tor",
+      "leaks": 0,
+      "level": "ok"
+    }
+  },
+  "update": {
+    "available": true,
+    "latest": "v9.9.9",
+    "url": "https://example/releases/v9.9.9"
+  },
+  "version": {
+    "dev": true,
+    "text": "dev build",
+    "title": "Development build"
+  },
+  "window": null,
+  "workers": [
+    {
+      "accepted": 1200,
+      "accepted_str": "1,200",
+      "api_ok": null,
+      "h10": 0,
+      "h10_str": "0.00 H/s",
+      "h15": 0,
+      "h15_str": "0.00 H/s",
+      "h60": 0,
+      "h60_str": "0.00 H/s",
+      "invalid": 0,
+      "ip": "192.168.1.10",
+      "ip_sort": 3232235786,
+      "name": "rig-alpha",
+      "pool": "p2pool",
+      "reject_flag": null,
+      "rejected": 1,
+      "rejected_str": "1",
+      "status": "online",
+      "uptime": 0,
+      "uptime_str": "0m 0s"
+    },
+    {
+      "accepted": 800,
+      "accepted_str": "800",
+      "api_ok": null,
+      "h10": 0,
+      "h10_str": "0.00 H/s",
+      "h15": 0,
+      "h15_str": "0.00 H/s",
+      "h60": 0,
+      "h60_str": "0.00 H/s",
+      "invalid": 0,
+      "ip": "192.168.1.11",
+      "ip_sort": 3232235787,
+      "name": "rig-bravo",
+      "pool": "p2pool",
+      "reject_flag": null,
+      "rejected": 40,
+      "rejected_str": "40",
+      "status": "offline",
+      "uptime": 0,
+      "uptime_str": "0m 0s"
+    }
+  ]
+}
diff --git a/build/dashboard/tests/frontend/helpers/render.mjs b/build/dashboard/tests/frontend/helpers/render.mjs
new file mode 100644
index 00000000..5544c58d
--- /dev/null
+++ b/build/dashboard/tests/frontend/helpers/render.mjs
@@ -0,0 +1,68 @@
+// A tiny, dependency-free Preact vnode -> string renderer for `node --test`.
+//
+// Why not preact-render-to-string / jsdom? The repo deliberately runs its frontend tests with no
+// package.json, no node_modules, and no DOM toolchain (see tests/frontend/logic.test.mjs). The
+// dashboard components (components.mjs) make that affordable: they are pure functional or simple
+// class components with NO hooks, and their only browser work (Chart.js, refs) lives in
+// componentDidMount — never in render(). So a static walk of the vnode tree reproduces exactly what
+// the browser paints on first mount, with zero dependencies.
+//
+// This intentionally does NOT run effects, refs, or event handlers, and does not escape text — it
+// is a render *probe* for asserting structure/content in tests, not a production SSR engine.
+
+// Props that are never serialized as HTML attributes.
+const SKIP_ATTRS = new Set(["children", "key", "ref"]);
+
+function attrs(props) {
+  let out = "";
+  for (const name of Object.keys(props)) {
+    if (SKIP_ATTRS.has(name)) continue;
+    const v = props[name];
+    if (v == null || v === false || typeof v === "function") continue; // handlers/empty -> dropped
+    if (name === "style" && typeof v === "object") {
+      const css = Object.entries(v)
+        .map(([p, val]) => `${p}:${val}`)
+        .join(";");
+      out += ` style="${css}"`;
+      continue;
+    }
+    if (typeof v === "object") continue; // other object-valued props have no string form
+    if (v === true) {
+      out += ` ${name}`;
+      continue;
+    }
+    out += ` ${name}="${String(v)}"`;
+  }
+  return out;
+}
+
+export function renderToString(vnode) {
+  if (vnode == null || vnode === false || vnode === true) return "";
+  if (typeof vnode === "string" || typeof vnode === "number" || typeof vnode === "bigint") {
+    return String(vnode);
+  }
+  if (Array.isArray(vnode)) return vnode.map(renderToString).join("");
+
+  const { type, props = {} } = vnode;
+  if (type == null) return "";
+
+  if (typeof type === "function") {
+    // A class component carries its own render() on the prototype; functional and arrow
+    // components do not (arrows have no prototype at all). Preact's Fragment is a plain function
+    // that returns props.children, so it falls through the functional branch correctly.
+    if (type.prototype && typeof type.prototype.render === "function") {
+      const inst = new type(props);
+      inst.props = props;
+      if (inst.state == null) inst.state = {};
+      return renderToString(inst.render(inst.props, inst.state, inst.context));
+    }
+    return renderToString(type(props));
+  }
+
+  return `<${type}${attrs(props)}>${renderToString(props.children)}</${type}>`;
+}
+
+// Render a component to a string given its props, e.g. render(App, { state, ui, ...handlers }).
+export function render(Component, props = {}) {
+  return renderToString({ type: Component, props });
+}
diff --git a/build/dashboard/tests/frontend/logic.test.mjs b/build/dashboard/tests/frontend/logic.test.mjs
index 7ee6cd7c..99e6694e 100644
--- a/build/dashboard/tests/frontend/logic.test.mjs
+++ b/build/dashboard/tests/frontend/logic.test.mjs
@@ -19,6 +19,7 @@ import {
     parseHashrate, computeEarnings, formatXmr, formatTimeToShare,
     DAYS_PER_MONTH, DAYS_PER_YEAR,
     bandBorderWidth, uptimeCell,
+    egressRoute, boxAnchor,
 } from '../../mining_dashboard/web/static/logic.mjs';
 
 const col = (key) => WORKER_COLUMNS.findIndex((c) => c.key === key);
@@ -297,3 +298,26 @@ test('uptimeCell: online shows uptime, offline shows DOWN', () => {
     assert.equal(uptimeCell({ status: 'online', uptime_str: '3h 20m' }), '3h 20m');
     assert.equal(uptimeCell({ status: 'offline', uptime_str: '99h 9m' }), 'DOWN');
 });
+
+// #170: egressRoute maps a server route token to a display glyph + label + CSS colour token.
+test('egressRoute: known routes map to icon/label/class; unknown falls back to muted', () => {
+    assert.deepEqual(egressRoute('tor'), { icon: '🧅', label: 'Tor', cls: 'ok' });
+    assert.equal(egressRoute('clearnet').cls, 'bad');
+    assert.equal(egressRoute('local').cls, 'muted');
+    assert.equal(egressRoute('inactive').cls, 'muted');
+    const unknown = egressRoute('weird');
+    assert.equal(unknown.cls, 'muted');
+    assert.equal(unknown.label, 'weird');
+});
+
+// #170: boxAnchor returns the point on a node box's border heading toward a target — for topology
+// connectors that start/end flush on the box edge.
+test('boxAnchor: lands on the border facing the target, not the centre', () => {
+    const node = { x: 100, y: 100, w: 40, h: 20 }; // centre (120, 110)
+    // Target straight to the right → exits the right edge (x = 140) at the centre height.
+    assert.deepEqual(boxAnchor(node, 300, 110), { x: 140, y: 110 });
+    // Target straight up → exits the top edge (y = 100) at the centre width.
+    assert.deepEqual(boxAnchor(node, 120, 0), { x: 120, y: 100 });
+    // Degenerate (target == centre) → the centre itself, no NaN.
+    assert.deepEqual(boxAnchor(node, 120, 110), { x: 120, y: 110 });
+});
diff --git a/build/dashboard/tests/frontend/topology.test.mjs b/build/dashboard/tests/frontend/topology.test.mjs
new file mode 100644
index 00000000..bf9a4927
--- /dev/null
+++ b/build/dashboard/tests/frontend/topology.test.mjs
@@ -0,0 +1,72 @@
+// Unit tests for the stack-topology diagram geometry (mining_dashboard/web/static/topology.mjs).
+//
+// Run with Node's built-in test runner — no dependencies, no package.json, no build step:
+//     node --test build/dashboard/tests/frontend/
+// (CI runs exactly this; Node is preinstalled on the runner.)
+//
+// The SVG *component* isn't rendered here (that needs a DOM toolchain the repo avoids); these
+// cover the pure geometry + the node-placement contract that decides whether every server-derived
+// config actually "shows correctly" in the diagram. The server half of the data is exercised in
+// tests/service/test_egress.py.
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+
+import {
+    POS, ROUTE_COLOR, ROUTE_NAME, edgePath,
+} from '../../mining_dashboard/web/static/topology.mjs';
+
+// Canonical node ids — MUST equal service/egress.py TOPOLOGY_NODES ids. The backend half of this
+// contract is tests/service/test_egress.py::test_topology_nodes_match_the_canonical_set. If the
+// two drift, the server can emit an edge whose endpoint POS can't place and it vanishes from the
+// SVG silently (StackTopology._edge returns null when POS[id] is missing).
+const NODE_IDS = [
+    'rigs', 'browser', 'xmrig-proxy', 'caddy', 'dashboard',
+    'p2pool', 'monerod', 'tari', 'docker', 'tor', 'internet',
+];
+
+test('POS places every canonical node and nothing extra', () => {
+    assert.deepEqual(new Set(Object.keys(POS)), new Set(NODE_IDS));
+});
+
+test('every POS box has finite, positive geometry', () => {
+    for (const [id, b] of Object.entries(POS)) {
+        for (const k of ['x', 'y', 'w', 'h']) {
+            assert.ok(Number.isFinite(b[k]), `${id}.${k} is not finite`);
+        }
+        assert.ok(b.w > 0 && b.h > 0, `${id} has non-positive size`);
+    }
+});
+
+test('edgePath: any edge between two nodes yields a valid, finite SVG path', () => {
+    // Every config produces a subset of these node-to-node edges; none may render as malformed
+    // geometry (a stray NaN/undefined makes the whole <path> disappear in the browser).
+    for (const from of NODE_IDS) {
+        for (const to of NODE_IDS) {
+            if (from === to) continue;
+            const d = edgePath({ from, to }, POS[from], POS[to]);
+            assert.ok(d.startsWith('M'), `${from}->${to}: "${d}" must start with a moveto`);
+            assert.ok(!/NaN|undefined/.test(d), `${from}->${to}: "${d}" has NaN/undefined`);
+        }
+    }
+});
+
+test('edgePath: column-crossing edges route orthogonally through a clear lane', () => {
+    // The three edges that would otherwise cut across the daemon column are routed through a
+    // dedicated lane; they must NOT fall through to the straight diagonal default.
+    assert.match(edgePath({ from: 'xmrig-proxy', to: 'tor' }, POS['xmrig-proxy'], POS.tor), /V42/);
+    assert.match(edgePath({ from: 'dashboard', to: 'tor' }, POS.dashboard, POS.tor), /V312/);
+    assert.match(edgePath({ from: 'p2pool', to: 'tari' }, POS.p2pool, POS.tari), /H254/);
+    // A clearnet leak lands on `internet` instead of `tor` but must take the SAME lane.
+    assert.match(
+        edgePath({ from: 'dashboard', to: 'internet' }, POS.dashboard, POS.internet),
+        /V312/,
+    );
+});
+
+test('route palette + names cover every route the server can emit', () => {
+    // egress.py emits exactly these four route tokens; the diagram must colour & label them all.
+    for (const r of ['tor', 'clearnet', 'local', 'inactive']) {
+        assert.ok(ROUTE_COLOR[r], `no colour for route "${r}"`);
+        assert.ok(ROUTE_NAME[r], `no label for route "${r}"`);
+    }
+});
diff --git a/build/dashboard/tests/helper/test_utils.py b/build/dashboard/tests/helper/test_utils.py
index 663be28b..112acf5c 100644
--- a/build/dashboard/tests/helper/test_utils.py
+++ b/build/dashboard/tests/helper/test_utils.py
@@ -1,12 +1,68 @@
-import pytest
+import time
 from unittest.mock import patch
+
+from mining_dashboard.config.config import XVB_STATS_STALE_AFTER_S
 from mining_dashboard.helper.utils import (
-    parse_hashrate, format_hashrate, format_duration,
-    format_time_abs, get_tier_info, resolve_target_threshold,
-    is_ip_address, detect_host_ipv4,
+    PPLNS_BLOCK_TIME_DEFAULT,
+    PPLNS_BLOCK_TIME_NANO,
+    detect_host_ipv4,
+    format_duration,
+    format_hashrate,
+    format_time_abs,
+    get_tier_info,
+    is_ip_address,
+    parse_hashrate,
+    pplns_block_time,
+    resolve_target_threshold,
+    shares_in_pplns_window,
+    xvb_stats_are_stale,
 )
 
 
+class TestXvbStatsAreStale:
+    """#311: the shared freshness predicate used by both the controller and the dashboard."""
+
+    def test_cold_start_never_fetched_is_not_stale(self):
+        # No/zero last_update => never fetched => the feedforward-ramp regime, not stale.
+        assert xvb_stats_are_stale({}) is False
+        assert xvb_stats_are_stale({"last_update": 0}) is False
+        assert xvb_stats_are_stale(None) is False
+
+    def test_recent_fetch_is_not_stale(self):
+        assert xvb_stats_are_stale({"last_update": time.time()}) is False
+
+    def test_old_fetch_is_stale(self):
+        assert (
+            xvb_stats_are_stale({"last_update": time.time() - XVB_STATS_STALE_AFTER_S - 1}) is True
+        )
+
+    def test_boundary_just_within_threshold_is_not_stale(self):
+        # Age just under the threshold is still fresh (strict > comparison).
+        assert (
+            xvb_stats_are_stale({"last_update": time.time() - XVB_STATS_STALE_AFTER_S + 5}) is False
+        )
+
+
+class TestPplnsWindow:
+    """#263: shared PPLNS-window math used by metrics, the controller, and XvB auto-register."""
+
+    def test_block_time_by_pool_type(self):
+        assert pplns_block_time("Nano") == PPLNS_BLOCK_TIME_NANO
+        assert pplns_block_time("Main") == PPLNS_BLOCK_TIME_DEFAULT
+        assert pplns_block_time("Mini") == PPLNS_BLOCK_TIME_DEFAULT
+        assert pplns_block_time("anything-else") == PPLNS_BLOCK_TIME_DEFAULT
+
+    def test_counts_only_shares_inside_the_window(self):
+        now = 10_000
+        # window = 2 blocks * 10 s = 20 s => cutoff at now-20
+        shares = [{"ts": now - 5}, {"ts": now - 19}, {"ts": now - 20}, {"ts": now - 21}, {}]
+        # ts >= cutoff counts: -5, -19, -20 (boundary inclusive); -21 and the missing-ts drop out.
+        assert shares_in_pplns_window(shares, 2, 10, now=now) == 3
+
+    def test_empty_shares_is_zero(self):
+        assert shares_in_pplns_window([], 2160, 10, now=10_000) == 0
+
+
 class TestParseHashrate:
     def test_plain_numbers(self):
         assert parse_hashrate("100") == 100.0
@@ -86,8 +142,7 @@ def test_zero_threshold_ignored(self):
 
 
 class TestResolveTargetThreshold:
-    TIERS = {"donor_mega": 1_000_000, "donor_whale": 100_000,
-             "donor_vip": 10_000, "donor": 1_000}
+    TIERS = {"donor_mega": 1_000_000, "donor_whale": 100_000, "donor_vip": 10_000, "donor": 1_000}
 
     def test_auto_picks_highest_sustainable(self):
         # 15_000 * 0.85 = 12_750 -> VIP (10_000) is the highest we can hold.
diff --git a/build/dashboard/tests/service/test_algo_service.py b/build/dashboard/tests/service/test_algo_service.py
index 408990de..6ede37f5 100644
--- a/build/dashboard/tests/service/test_algo_service.py
+++ b/build/dashboard/tests/service/test_algo_service.py
@@ -1,17 +1,23 @@
 import asyncio
-from unittest.mock import MagicMock, AsyncMock, patch
+import time
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
+from mining_dashboard.config.config import (
+    TIER_DEFAULTS,
+    XVB_STATS_STALE_AFTER_S,
+    XVB_SWITCH_OVERHEAD_MS,
+    XVB_TIME_ALGO_MS,
+)
 from mining_dashboard.service.algo_service import AlgoService
-from mining_dashboard.config.config import TIER_DEFAULTS, XVB_TIME_ALGO_MS, XVB_SWITCH_OVERHEAD_MS
 
 
 @pytest.fixture
 def algo():
     state_manager = MagicMock()
     state_manager.get_tiers.return_value = dict(TIER_DEFAULTS)
-    proxy_client = MagicMock()       # called via asyncio.to_thread -> sync methods
+    proxy_client = MagicMock()  # called via asyncio.to_thread -> sync methods
     data_service = MagicMock()
     data_service.workers_rejected = False  # not rejecting workers (Issue #31 guard off)
     return AlgoService(state_manager, proxy_client, data_service)
@@ -20,10 +26,20 @@ def algo():
 # A share inside the PPLNS window (recent) so the "zero shares" guard doesn't trip.
 RECENT_SHARES = [{"ts": 10**12}]  # far-future ts -> always within window
 P2P_MAIN = {"type": "Main"}
-POOL_STATS = {"pplns_window": 2160}                          # no difficulty -> flat reserve
+POOL_STATS = {"pplns_window": 2160}  # no difficulty -> flat reserve
 POOL_STATS_DIFF = {"pplns_window": 2160, "difficulty": 120_000_000}
 
 
+def _fresh_ts():
+    """A `last_update` that reads as a just-landed XvB fetch (not stale)."""
+    return time.time()
+
+
+def _stale_ts():
+    """A `last_update` old enough that the fetch is considered stale (#311)."""
+    return time.time() - (XVB_STATS_STALE_AFTER_S + 60)
+
+
 def _split_ms(decision):
     mode, dur = decision
     return XVB_TIME_ALGO_MS if mode == "XVB" else dur
@@ -36,22 +52,39 @@ def test_xvb_disabled_forces_p2pool(self, algo):
 
     def test_zero_shares_forces_p2pool(self, algo):
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            mode, dur = algo.get_decision(10_000, 10_000, POOL_STATS, P2P_MAIN,
-                                          {"avg_24h": 0, "avg_1h": 0, "fail_count": 0}, [])
+            mode, dur = algo.get_decision(
+                10_000,
+                10_000,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_24h": 0, "avg_1h": 0, "fail_count": 0},
+                [],
+            )
             assert mode == "P2POOL"
 
     def test_excessive_failures_forces_p2pool(self, algo):
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            mode, _ = algo.get_decision(10_000, 10_000, POOL_STATS, P2P_MAIN,
-                                        {"avg_24h": 9_999_999, "avg_1h": 9_999_999, "fail_count": 3},
-                                        RECENT_SHARES)
+            mode, _ = algo.get_decision(
+                10_000,
+                10_000,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_24h": 9_999_999, "avg_1h": 9_999_999, "fail_count": 3},
+                RECENT_SHARES,
+            )
             assert mode == "P2POOL"
 
     def test_low_hashrate_no_tier_is_p2pool(self, algo):
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
             # 100 H/s * 0.85 < lowest tier (1000) -> no tier -> P2POOL
-            mode, _ = algo.get_decision(100, 100, POOL_STATS, P2P_MAIN,
-                                        {"avg_24h": 0, "avg_1h": 0, "fail_count": 0}, RECENT_SHARES)
+            mode, _ = algo.get_decision(
+                100,
+                100,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_24h": 0, "avg_1h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
             assert mode == "P2POOL"
 
     def test_cold_start_seeds_feedforward(self, algo):
@@ -59,8 +92,14 @@ def test_cold_start_seeds_feedforward(self, algo):
         estimate (reference / current_hr), so it starts donating a sane amount."""
         algo.donation_level = "vip"  # target 10_000
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            mode, dur = algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                                          {"avg_24h": 0, "avg_1h": 0, "fail_count": 0}, RECENT_SHARES)
+            mode, dur = algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_24h": 0, "avg_1h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
             assert mode in ("SPLIT", "XVB")
             # reference 10_300 / 46_300 ~ 0.222 of the cycle.
             assert algo.donation_fraction == pytest.approx(10_300 / 46_300, rel=0.05)
@@ -70,12 +109,24 @@ def test_loop_ramps_up_when_below_reference(self, algo):
         donated fraction upward (closed-loop catch-up, not a one-shot spike)."""
         algo.donation_level = "vip"
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            d1 = algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                                   {"avg_1h": 0, "avg_24h": 0, "fail_count": 0}, RECENT_SHARES)
+            d1 = algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
             f_after_seed = algo.donation_fraction
-            d2 = algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                                   {"avg_1h": 0, "avg_24h": 0, "fail_count": 0}, RECENT_SHARES)
-            assert algo.donation_fraction > f_after_seed   # ramped up
+            d2 = algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
+            assert algo.donation_fraction > f_after_seed  # ramped up
             assert _split_ms(d2) > _split_ms(d1)
 
     def test_loop_backs_off_when_above_reference(self, algo):
@@ -83,29 +134,59 @@ def test_loop_backs_off_when_above_reference(self, algo):
         donated fraction — the property the old unbounded catch-up lacked."""
         algo.donation_level = "vip"
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                              {"avg_1h": 0, "avg_24h": 0, "fail_count": 0}, RECENT_SHARES)
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
             seeded = algo.donation_fraction
-            algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                              {"avg_1h": 30_000, "avg_24h": 30_000, "fail_count": 0}, RECENT_SHARES)
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 30_000, "avg_24h": 30_000, "fail_count": 0},
+                RECENT_SHARES,
+            )
             assert algo.donation_fraction < seeded  # backed off
 
     def test_advance_false_does_not_move_the_loop(self, algo):
         """_smart_sleep re-reads with advance=False; that must not step the loop."""
         algo.donation_level = "vip"
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                              {"avg_1h": 0, "avg_24h": 0, "fail_count": 0}, RECENT_SHARES)
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
             held = algo.donation_fraction
-            algo.get_decision(46_300, 46_300, POOL_STATS, P2P_MAIN,
-                              {"avg_1h": 0, "avg_24h": 0, "fail_count": 0}, RECENT_SHARES,
-                              advance=False)
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0},
+                RECENT_SHARES,
+                advance=False,
+            )
             assert algo.donation_fraction == held
 
     def test_nano_pool_uses_longer_window(self, algo):
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
-            mode, _ = algo.get_decision(10_000, 10_000, POOL_STATS, {"type": "Nano"},
-                                        {"avg_24h": 0, "avg_1h": 0, "fail_count": 0}, RECENT_SHARES)
+            mode, _ = algo.get_decision(
+                10_000,
+                10_000,
+                POOL_STATS,
+                {"type": "Nano"},
+                {"avg_24h": 0, "avg_1h": 0, "fail_count": 0},
+                RECENT_SHARES,
+            )
             assert mode in ("P2POOL", "XVB", "SPLIT")
 
 
@@ -129,8 +210,14 @@ def test_loop_clamped_to_reserve(self, algo):
         algo.donation_level = "mega"  # unsustainable target -> loop pushes up hard
         with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
             for _ in range(50):
-                algo.get_decision(46_300, 46_300, POOL_STATS_DIFF, P2P_MAIN,
-                                  {"avg_1h": 0, "avg_24h": 0, "fail_count": 0}, RECENT_SHARES)
+                algo.get_decision(
+                    46_300,
+                    46_300,
+                    POOL_STATS_DIFF,
+                    P2P_MAIN,
+                    {"avg_1h": 0, "avg_24h": 0, "fail_count": 0},
+                    RECENT_SHARES,
+                )
             cap = algo._max_donation_fraction(46_300, 21600, POOL_STATS_DIFF)
             assert algo.donation_fraction <= cap + 1e-9
 
@@ -146,7 +233,9 @@ def test_reference_cushion_is_absolute_capped(self, algo):
     def test_fraction_to_ms_zero_and_positive(self, algo):
         assert algo._fraction_to_ms(0) == 0
         assert algo._fraction_to_ms(-1) == 0
-        assert algo._fraction_to_ms(0.2) == pytest.approx(0.2 * XVB_TIME_ALGO_MS + XVB_SWITCH_OVERHEAD_MS, abs=1)
+        assert algo._fraction_to_ms(0.2) == pytest.approx(
+            0.2 * XVB_TIME_ALGO_MS + XVB_SWITCH_OVERHEAD_MS, abs=1
+        )
 
     def test_advance_noop_when_no_hashrate(self, algo):
         algo.donation_fraction = 0.3
@@ -179,13 +268,124 @@ def test_explicit_tier_not_downgraded(self, algo):
         assert algo._get_target_donation_hr(15_000) == 1_000_000
 
 
+class TestStaleStatsGuard:
+    """#311: when the xmrvsbeast.com stats fetch goes quiet, avg_1h freezes. The
+    controller must not keep steering off that frozen number (it over-donates against
+    a target it can't refresh). `last_update` (bumped only on a real fetch, #136) is
+    the freshness signal."""
+
+    def test_predicate_cold_start_is_not_stale(self, algo):
+        # Never fetched (no/zero last_update) -> cold start, NOT stale: the
+        # feedforward ramp must be left alone to climb to tier.
+        assert algo._stats_are_stale({}) is False
+        assert algo._stats_are_stale({"last_update": 0}) is False
+
+    def test_predicate_fresh_is_not_stale(self, algo):
+        assert algo._stats_are_stale({"last_update": _fresh_ts()}) is False
+
+    def test_predicate_old_fetch_is_stale(self, algo):
+        assert algo._stats_are_stale({"last_update": _stale_ts()}) is True
+
+    def test_stale_read_holds_fraction_instead_of_winding_up(self, algo):
+        """The bug: a frozen avg_1h below reference keeps ramping the donated
+        fraction up. With a stale read the loop must HOLD, not advance."""
+        algo.donation_level = "vip"
+        with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
+            # Seed from a fresh reading so we have a sane held fraction.
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0, "last_update": _fresh_ts()},
+                RECENT_SHARES,
+            )
+            held = algo.donation_fraction
+            # Now the fetch is stale and frozen below reference — must NOT ramp.
+            for _ in range(10):
+                algo.get_decision(
+                    46_300,
+                    46_300,
+                    POOL_STATS,
+                    P2P_MAIN,
+                    {"avg_1h": 0, "avg_24h": 0, "fail_count": 0, "last_update": _stale_ts()},
+                    RECENT_SHARES,
+                )
+            assert algo.donation_fraction == held  # held, not wound up
+
+    def test_fresh_read_below_reference_still_ramps(self, algo):
+        """Guard against over-correcting: a *fresh* below-tier read must still drive
+        the #9/#70 catch-up. Only stale reads are frozen out."""
+        algo.donation_level = "vip"
+        with patch("mining_dashboard.service.algo_service.ENABLE_XVB", True):
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0, "last_update": _fresh_ts()},
+                RECENT_SHARES,
+            )
+            seeded = algo.donation_fraction
+            algo.get_decision(
+                46_300,
+                46_300,
+                POOL_STATS,
+                P2P_MAIN,
+                {"avg_1h": 0, "avg_24h": 0, "fail_count": 0, "last_update": _fresh_ts()},
+                RECENT_SHARES,
+            )
+            assert algo.donation_fraction > seeded  # fresh read still ramps
+
+    async def test_smart_sleep_does_not_bail_early_on_stale_below_tier(self, algo):
+        """The dominant symptom (#311): a frozen below-tier avg_1h made _smart_sleep
+        end every p2pool dwell early, driving the effective split to ~55% XvB. With a
+        stale read the under-tier override must pause — let the dwell run."""
+        algo.data_service.latest_data = {
+            "total_live_h15": 15_000,
+            "total_live_h10": 15_000,
+            "pool": {},
+            "shares": [],
+        }
+        algo.state_manager.get_xvb_stats.return_value = {
+            "avg_24h": 0,
+            "avg_1h": 500,  # frozen far below tier
+            "fail_count": 0,
+            "last_update": _stale_ts(),
+        }
+        algo.get_decision = MagicMock(return_value=("P2POOL", 0))
+        with patch("asyncio.sleep", new_callable=AsyncMock) as slept:
+            await algo._smart_sleep(90, check_interval_sec=30)
+        assert slept.await_count == 3  # full dwell, no early bail
+
+    async def test_smart_sleep_still_bails_on_fresh_below_tier(self, algo):
+        """Regression guard: the catch-up early-exit must still fire on a FRESH
+        below-tier read (mirrors test_aborts_early_when_below_tier with last_update)."""
+        algo.data_service.latest_data = {
+            "total_live_h15": 15_000,
+            "total_live_h10": 15_000,
+            "pool": {},
+            "shares": [],
+        }
+        algo.state_manager.get_xvb_stats.return_value = {
+            "avg_24h": 0,
+            "avg_1h": 500,
+            "fail_count": 0,
+            "last_update": _fresh_ts(),
+        }
+        algo.get_decision = MagicMock(return_value=("P2POOL", 0))
+        with patch("asyncio.sleep", new_callable=AsyncMock) as slept:
+            await algo._smart_sleep(600, check_interval_sec=30)
+        assert slept.await_count == 1  # bailed early to catch up
+
+
 class TestSwitchMiners:
     async def test_switch_updates_proxy_and_state(self, algo):
         algo.proxy_client.get_config.return_value = {"pools": [], "other": "keep"}
         await algo.switch_miners("XVB")
         algo.proxy_client.update_config.assert_called_once()
         sent = algo.proxy_client.update_config.call_args[0][0]
-        assert sent["other"] == "keep"           # preserves existing config
+        assert sent["other"] == "keep"  # preserves existing config
         assert sent["pools"][0]["enabled"] is True
         algo.state_manager.update_xvb_stats.assert_called_once()
 
@@ -194,6 +394,40 @@ async def test_switch_aborts_on_bad_config(self, algo):
         await algo.switch_miners("P2POOL")
         algo.proxy_client.update_config.assert_not_called()
 
+    async def test_xvb_pool_routed_over_tor_by_default(self, algo):
+        # #166: the XvB pool carries a per-pool socks5 (Tor); the local p2pool pool never does.
+        algo.proxy_client.get_config.return_value = {"pools": []}
+        with (
+            patch("mining_dashboard.service.algo_service.XVB_TOR_ENABLED", True),
+            patch("mining_dashboard.service.algo_service.XVB_TOR_SOCKS5", "172.28.0.25:9050"),
+        ):
+            await algo.switch_miners("XVB")
+        pools = algo.proxy_client.update_config.call_args[0][0]["pools"]
+        xvb, local = pools[0], pools[1]  # enabled XvB pool first in XVB mode
+        assert xvb["enabled"] is True and xvb["socks5"] == "172.28.0.25:9050"
+        assert "socks5" not in local  # local p2pool dials direct, never via Tor
+
+    async def test_local_pool_never_routed_over_tor(self, algo):
+        # Even in P2POOL mode (XvB pool present but disabled), only the XvB pool carries socks5.
+        algo.proxy_client.get_config.return_value = {"pools": []}
+        with (
+            patch("mining_dashboard.service.algo_service.XVB_TOR_ENABLED", True),
+            patch("mining_dashboard.service.algo_service.XVB_TOR_SOCKS5", "172.28.0.25:9050"),
+        ):
+            await algo.switch_miners("P2POOL")
+        pools = algo.proxy_client.update_config.call_args[0][0]["pools"]
+        local, xvb = pools[0], pools[1]  # enabled local pool first in P2POOL mode
+        assert "socks5" not in local
+        assert xvb["socks5"] == "172.28.0.25:9050"
+
+    async def test_xvb_tor_opt_out_no_socks5(self, algo):
+        # xvb.tor:false → XVB_TOR_ENABLED False → no pool carries socks5 (direct clearnet, max yield).
+        algo.proxy_client.get_config.return_value = {"pools": []}
+        with patch("mining_dashboard.service.algo_service.XVB_TOR_ENABLED", False):
+            await algo.switch_miners("XVB")
+        pools = algo.proxy_client.update_config.call_args[0][0]["pools"]
+        assert all("socks5" not in p for p in pools)
+
 
 class TestSmartSleep:
     LATEST = {"total_live_h15": 15_000, "total_live_h10": 15_000, "pool": {}, "shares": []}
@@ -210,7 +444,11 @@ async def test_aborts_early_when_below_tier(self, algo):
         """Even if the cached decision is P2POOL, a 1h average below the tier means
         we must catch up — bail to re-decide rather than wait out the dwell."""
         algo.data_service.latest_data = dict(self.LATEST)
-        algo.state_manager.get_xvb_stats.return_value = {"avg_24h": 0, "avg_1h": 500, "fail_count": 0}
+        algo.state_manager.get_xvb_stats.return_value = {
+            "avg_24h": 0,
+            "avg_1h": 500,
+            "fail_count": 0,
+        }
         algo.get_decision = MagicMock(return_value=("P2POOL", 0))
         with patch("asyncio.sleep", new_callable=AsyncMock) as slept:
             await algo._smart_sleep(600, check_interval_sec=30)
@@ -219,7 +457,11 @@ async def test_aborts_early_when_below_tier(self, algo):
     async def test_sleeps_full_duration_when_in_tier_on_p2pool(self, algo):
         algo.data_service.latest_data = dict(self.LATEST)
         # In tier (1h above the VIP threshold) and decision P2POOL -> rest, no bail.
-        algo.state_manager.get_xvb_stats.return_value = {"avg_24h": 12_000, "avg_1h": 12_000, "fail_count": 0}
+        algo.state_manager.get_xvb_stats.return_value = {
+            "avg_24h": 12_000,
+            "avg_1h": 12_000,
+            "fail_count": 0,
+        }
         algo.get_decision = MagicMock(return_value=("P2POOL", 0))
         with patch("asyncio.sleep", new_callable=AsyncMock) as slept:
             await algo._smart_sleep(90, check_interval_sec=30)
@@ -228,8 +470,12 @@ async def test_sleeps_full_duration_when_in_tier_on_p2pool(self, algo):
 
 class TestRunLoop:
     async def test_run_invokes_switch_then_stops(self, algo):
-        algo.data_service.latest_data = {"total_live_h10": 10_000, "total_live_h15": 10_000,
-                                         "pool": {}, "shares": []}
+        algo.data_service.latest_data = {
+            "total_live_h10": 10_000,
+            "total_live_h15": 10_000,
+            "pool": {},
+            "shares": [],
+        }
         algo.state_manager.get_xvb_stats.return_value = {"avg_24h": 0, "avg_1h": 0, "fail_count": 0}
         algo.get_decision = MagicMock(return_value=("P2POOL", 0))
         algo.switch_miners = MagicMock(side_effect=lambda *a, **k: asyncio.sleep(0))
diff --git a/build/dashboard/tests/service/test_clearnet_sync.py b/build/dashboard/tests/service/test_clearnet_sync.py
index d6285d93..94fe79f5 100644
--- a/build/dashboard/tests/service/test_clearnet_sync.py
+++ b/build/dashboard/tests/service/test_clearnet_sync.py
@@ -1,6 +1,7 @@
 """Tests for the clearnet→Tor auto-transition supervisor (#183/#234)."""
+
 import os
-from unittest.mock import MagicMock, AsyncMock
+from unittest.mock import AsyncMock, MagicMock
 
 from mining_dashboard.service.clearnet_sync import ClearnetSyncSupervisor
 
@@ -38,8 +39,10 @@ async def test_synced_writes_marker_and_restarts_onto_tor(self, tmp_path):
         exposed = await sup.maybe_transition("monero", "monerod", flag_on=True, synced=True)
         assert exposed is False  # transitioned → no longer exposed
         assert os.path.exists(sup.marker_path("monero"))  # persistent marker written
-        dc.stop.assert_awaited_once(); assert dc.stop.await_args.args[0] == "monerod"
-        dc.start.assert_awaited_once(); assert dc.start.await_args.args[0] == "monerod"
+        dc.stop.assert_awaited_once()
+        assert dc.stop.await_args.args[0] == "monerod"
+        dc.start.assert_awaited_once()
+        assert dc.start.await_args.args[0] == "monerod"
         assert events == [("monero", True)]
 
     async def test_marker_written_before_restart(self, tmp_path):
@@ -47,9 +50,11 @@ async def test_marker_written_before_restart(self, tmp_path):
         guaranteed to render Tor even if the dashboard dies mid-flip."""
         sup, dc = make_supervisor(tmp_path)
         seen = {}
+
         async def record_stop(container, *a, **k):
             seen["marker_at_stop"] = os.path.exists(sup.marker_path("monero"))
             return True
+
         dc.stop = AsyncMock(side_effect=record_stop)
         await sup.maybe_transition("monero", "monerod", flag_on=True, synced=True)
         assert seen["marker_at_stop"] is True
@@ -57,7 +62,8 @@ async def record_stop(container, *a, **k):
     async def test_already_transitioned_is_idempotent(self, tmp_path):
         sup, dc = make_supervisor(tmp_path)
         await sup.maybe_transition("monero", "monerod", flag_on=True, synced=True)
-        dc.stop.reset_mock(); dc.start.reset_mock()
+        dc.stop.reset_mock()
+        dc.start.reset_mock()
         # Second call: already flipped this run → no further restarts.
         exposed = await sup.maybe_transition("monero", "monerod", flag_on=True, synced=True)
         assert exposed is False
@@ -93,11 +99,14 @@ async def test_slow_stop_does_not_skip_start(self, tmp_path):
         # and report False; the old `stop and start` short-circuited and NEVER started it, leaving
         # the daemon down. start must ALWAYS be attempted — a slow/failed stop can't strand it.
         sup, dc = make_supervisor(tmp_path)
-        dc.stop = AsyncMock(return_value=False)   # stop "fails" (HTTP timed out before the slow stop)
-        dc.start = AsyncMock(return_value=True)   # the container does come back up
+        dc.stop = AsyncMock(
+            return_value=False
+        )  # stop "fails" (HTTP timed out before the slow stop)
+        dc.start = AsyncMock(return_value=True)  # the container does come back up
         exposed = await sup.maybe_transition("tari", "tari", flag_on=True, synced=True)
-        assert exposed is False                   # transitioned despite the stop hiccup
-        dc.start.assert_awaited_once(); assert dc.start.await_args.args[0] == "tari"
+        assert exposed is False  # transitioned despite the stop hiccup
+        dc.start.assert_awaited_once()
+        assert dc.start.await_args.args[0] == "tari"
 
     async def test_restart_stop_timeout_outlasts_kill_deadline(self, tmp_path):
         # The stop's HTTP timeout must exceed its SIGTERM→SIGKILL deadline, or a slow daemon's stop
@@ -116,7 +125,8 @@ async def test_per_chain_independent(self, tmp_path):
         assert m is False and t is True
         assert os.path.exists(sup.marker_path("monero"))
         assert not os.path.exists(sup.marker_path("tari"))
-        dc.stop.assert_awaited_once(); assert dc.stop.await_args.args[0] == "monerod"
+        dc.stop.assert_awaited_once()
+        assert dc.stop.await_args.args[0] == "monerod"
 
     async def test_marker_write_failure_does_not_restart(self, tmp_path):
         # If the marker can't be persisted (e.g. read-only dir), DON'T restart — a restart without
diff --git a/build/dashboard/tests/service/test_data_service.py b/build/dashboard/tests/service/test_data_service.py
index 9e3f2507..752fd95b 100644
--- a/build/dashboard/tests/service/test_data_service.py
+++ b/build/dashboard/tests/service/test_data_service.py
@@ -1,17 +1,37 @@
-from unittest.mock import MagicMock, AsyncMock, patch
+import asyncio
+import time
+from unittest.mock import AsyncMock, MagicMock, patch
 
 import pytest
 
 import mining_dashboard.service.data_service as ds_mod
+from mining_dashboard.client.xmrig_client import XMRigWorkerClient
+from mining_dashboard.client.xvb_client import (
+    REG_ERROR,
+    REG_INVALID,
+    REG_NOT_ELIGIBLE,
+    REG_OK,
+)
+from mining_dashboard.config.config import XVB_REGISTER_INTERVAL_S
 from mining_dashboard.service.data_service import (
-    DataService, _normalize_proxy_workers, _merge_direct_stats, _aggregate_hashrate,
-    _aggregate_window_hashrates, _parse_proxy_list_worker, _parse_legacy_dict_worker,
-    _parse_proxy_summary, _merge_proxy_summary, _shares_to_record, WorkerLifecycle,
+    _XVB_REGISTER_FAIL_ALERT,
+    DataService,
+    WorkerLifecycle,
+    _aggregate_hashrate,
+    _aggregate_window_hashrates,
+    _merge_direct_stats,
+    _merge_proxy_summary,
+    _normalize_proxy_workers,
+    _parse_legacy_dict_worker,
+    _parse_proxy_list_worker,
+    _parse_proxy_summary,
+    _shares_to_record,
 )
 
 
 class _FakeClientSession:
     """Stand-in for aiohttp.ClientSession used as an async context manager."""
+
     async def __aenter__(self):
         return MagicMock()
 
@@ -61,10 +81,21 @@ def test_parse_list_row_named_fields(self):
         # native hashrate windows at idx8..12 = 1m/10m/1h/12h/24h kH/s (the 1h/12h/24h ones are #168).
         row = ["rig", "10.0.0.1", 1, 0, 0, 0, 0, 0, 1.0, 2.0, 3.0, 4.0, 5.0]
         w = _parse_proxy_list_worker(row)
-        assert w == {"name": "rig", "ip": "10.0.0.1", "status": "online",
-                     "h10": 1000, "h60": 1000, "h15": 2000,
-                     "h1h": 3000, "h12h": 4000, "h24h": 5000, "uptime": 0,
-                     "accepted": 0, "rejected": 0, "invalid": 0}
+        assert w == {
+            "name": "rig",
+            "ip": "10.0.0.1",
+            "status": "online",
+            "h10": 1000,
+            "h60": 1000,
+            "h15": 2000,
+            "h1h": 3000,
+            "h12h": 4000,
+            "h24h": 5000,
+            "uptime": 0,
+            "accepted": 0,
+            "rejected": 0,
+            "invalid": 0,
+        }
 
     def test_parse_list_row_share_counts(self):
         # idx3=accepted, idx4=rejected, idx5=invalid are carried through (Issue #82).
@@ -81,14 +112,26 @@ def test_parse_list_row_offline_and_uptime(self):
         assert w["uptime"] == 0
 
     def test_parse_legacy_dict_row(self):
-        w = _parse_legacy_dict_worker({"id": "old", "ip": "1.2.3.4",
-                                       "hashrate": [10, 20, 30], "uptime": 5})
+        w = _parse_legacy_dict_worker(
+            {"id": "old", "ip": "1.2.3.4", "hashrate": [10, 20, 30], "uptime": 5}
+        )
         # The legacy shape has only 10s/60s/15m, so the #168 long windows fall back to its longest
         # available average (hr[2]=30) rather than reading zero.
-        assert w == {"name": "old", "ip": "1.2.3.4", "status": "online",
-                     "h10": 10, "h60": 20, "h15": 30,
-                     "h1h": 30, "h12h": 30, "h24h": 30, "uptime": 5,
-                     "accepted": 0, "rejected": 0, "invalid": 0}
+        assert w == {
+            "name": "old",
+            "ip": "1.2.3.4",
+            "status": "online",
+            "h10": 10,
+            "h60": 20,
+            "h15": 30,
+            "h1h": 30,
+            "h12h": 30,
+            "h24h": 30,
+            "uptime": 5,
+            "accepted": 0,
+            "rejected": 0,
+            "invalid": 0,
+        }
 
     def test_parse_legacy_dict_share_counts(self):
         # When a legacy payload happens to carry share counts, they pass through.
@@ -107,8 +150,8 @@ def test_list_format_online(self):
         assert w["ip"] == "10.0.0.1"
         assert w["status"] == "online"
         assert w["h10"] == 1000 and w["h60"] == 1000  # idx8 kH/s -> H/s
-        assert w["h15"] == 2000                         # idx9 kH/s -> H/s
-        assert w["uptime"] == 0                          # idx7 (last share ms) == 0
+        assert w["h15"] == 2000  # idx9 kH/s -> H/s
+        assert w["uptime"] == 0  # idx7 (last share ms) == 0
 
     def test_list_format_offline_when_no_connections(self):
         # A worker still listed by the proxy but with 0 connections is a stopped miner.
@@ -151,10 +194,21 @@ class TestParseProxySummary:
     """Pool-wide share totals from the proxy /summary `results` block (Issue #82)."""
 
     def test_extracts_results_and_best(self):
-        summary = {"results": {"accepted": 1000, "rejected": 12, "invalid": 3, "expired": 1,
-                               "best": [987654, 5000, 100]}}
+        summary = {
+            "results": {
+                "accepted": 1000,
+                "rejected": 12,
+                "invalid": 3,
+                "expired": 1,
+                "best": [987654, 5000, 100],
+            }
+        }
         assert _parse_proxy_summary(summary) == {
-            "accepted": 1000, "rejected": 12, "invalid": 3, "expired": 1, "best": 987654,
+            "accepted": 1000,
+            "rejected": 12,
+            "invalid": 3,
+            "expired": 1,
+            "best": 987654,
         }
 
     def test_best_defaults_to_zero_when_empty(self):
@@ -178,8 +232,15 @@ class TestMergeProxySummary:
     _LAST = {"accepted": 999, "rejected": 9, "invalid": 1, "expired": 0, "best": 42}
 
     def test_valid_summary_is_adopted(self):
-        summary = {"results": {"accepted": 1000, "rejected": 12, "invalid": 3, "expired": 1,
-                               "best": [987654]}}
+        summary = {
+            "results": {
+                "accepted": 1000,
+                "rejected": 12,
+                "invalid": 3,
+                "expired": 1,
+                "best": [987654],
+            }
+        }
         assert _merge_proxy_summary(self._LAST, summary) == self._GOOD
 
     def test_malformed_payload_keeps_last_good(self):
@@ -204,9 +265,9 @@ def _w(name, status, uptime=0):
     def test_online_uptime_counts_from_first_seen(self):
         lc = WorkerLifecycle(falloff_sec=3600)
         [w] = lc.update([self._w("rig", "online")], now=1000.0)
-        assert w["uptime"] == 0                       # just connected
+        assert w["uptime"] == 0  # just connected
         [w] = lc.update([self._w("rig", "online")], now=1075.0)
-        assert w["uptime"] == 75                      # now - connected_since, monotonic
+        assert w["uptime"] == 75  # now - connected_since, monotonic
 
     def test_real_api_uptime_is_not_overwritten(self):
         # A worker whose direct API is reachable already carries a real (>0) uptime — keep it.
@@ -216,11 +277,11 @@ def test_real_api_uptime_is_not_overwritten(self):
 
     def test_offline_worker_shown_until_falloff_then_dropped(self):
         lc = WorkerLifecycle(falloff_sec=3600)
-        lc.update([self._w("rig", "online")], now=1000.0)           # active at t=1000
-        kept = lc.update([self._w("rig", "offline")], now=4000.0)   # 3000s later: within 1h window
-        assert [w["name"] for w in kept] == ["rig"]                 # still shown (as DOWN)
-        gone = lc.update([self._w("rig", "offline")], now=5000.0)   # 4000s since active: > falloff
-        assert gone == []                                           # fell off the table
+        lc.update([self._w("rig", "online")], now=1000.0)  # active at t=1000
+        kept = lc.update([self._w("rig", "offline")], now=4000.0)  # 3000s later: within 1h window
+        assert [w["name"] for w in kept] == ["rig"]  # still shown (as DOWN)
+        gone = lc.update([self._w("rig", "offline")], now=5000.0)  # 4000s since active: > falloff
+        assert gone == []  # fell off the table
 
     def test_fallen_off_worker_stays_gone_while_proxy_keeps_reporting_it(self):
         # Regression (#182): xmrig-proxy keeps a disconnected worker in /workers for HOURS, so the
@@ -228,7 +289,7 @@ def test_fallen_off_worker_stays_gone_while_proxy_keeps_reporting_it(self):
         # internal state at falloff meant the next poll re-created it with last_active=now, resetting
         # the 1h clock — the row flickered off for one cycle then came back as DOWN forever.
         lc = WorkerLifecycle(falloff_sec=3600)
-        lc.update([self._w("rig", "online")], now=1000.0)               # active at t=1000
+        lc.update([self._w("rig", "online")], now=1000.0)  # active at t=1000
         assert lc.update([self._w("rig", "offline")], now=4700.0) == []  # 3700s > falloff → dropped
         # The proxy STILL reports it offline on every subsequent poll — it must stay gone, not flicker.
         for t in (4730.0, 8400.0, 8430.0, 30000.0):
@@ -240,17 +301,17 @@ def test_fallen_off_worker_stays_gone_while_proxy_keeps_reporting_it(self):
     def test_reconnect_restarts_uptime_and_readds(self):
         lc = WorkerLifecycle(falloff_sec=10)
         lc.update([self._w("rig", "online")], now=1000.0)
-        lc.update([], now=2000.0)                                   # proxy drops it entirely (fell off)
-        [w] = lc.update([self._w("rig", "online")], now=3000.0)     # reconnects fresh
-        assert w["uptime"] == 0                                     # uptime restarts, not inherited
+        lc.update([], now=2000.0)  # proxy drops it entirely (fell off)
+        [w] = lc.update([self._w("rig", "online")], now=3000.0)  # reconnects fresh
+        assert w["uptime"] == 0  # uptime restarts, not inherited
         [w] = lc.update([self._w("rig", "online")], now=3050.0)
         assert w["uptime"] == 50
 
     def test_offline_then_online_resets_connected_since(self):
         lc = WorkerLifecycle(falloff_sec=3600)
         lc.update([self._w("rig", "online")], now=1000.0)
-        lc.update([self._w("rig", "offline")], now=1100.0)          # disconnect resets connected_since
-        [w] = lc.update([self._w("rig", "online")], now=1200.0)     # back online — counts from here
+        lc.update([self._w("rig", "offline")], now=1100.0)  # disconnect resets connected_since
+        [w] = lc.update([self._w("rig", "online")], now=1200.0)  # back online — counts from here
         assert w["uptime"] == 0
 
 
@@ -258,33 +319,55 @@ class TestMergeDirectStats:
     """Augment proxy workers with direct-API stats; kind-based scaling + keep-online (#39/#28)."""
 
     def _worker(self):
-        return {"name": "rig", "ip": "10.0.0.1", "status": "online",
-                "h10": 1, "h60": 2, "h15": 3, "uptime": 0}
+        return {
+            "name": "rig",
+            "ip": "10.0.0.1",
+            "status": "online",
+            "h10": 1,
+            "h60": 2,
+            "h15": 3,
+            "uptime": 0,
+        }
 
     def test_proxy_kind_scales_khs_to_hs(self):
-        extra = {"kind": "proxy", "uptime": 120, "hashrate": {"total": [1, 2, 3]}}
+        # A successful probe carries api_ok=True (injected by get_stats); enrichment applies.
+        extra = {"api_ok": True, "kind": "proxy", "uptime": 120, "hashrate": {"total": [1, 2, 3]}}
         [w] = _merge_direct_stats([self._worker()], [extra], "3333")
         assert (w["h10"], w["h60"], w["h15"]) == (1000, 2000, 3000)
         assert w["uptime"] == 120
         assert w["active_pool"] == "3333"
+        assert w["api_ok"] is True
 
     def test_xmrig_kind_not_scaled(self):
-        extra = {"uptime": 99, "hashrate": {"total": [10, 20, 30]}}
+        extra = {"api_ok": True, "uptime": 99, "hashrate": {"total": [10, 20, 30]}}
         [w] = _merge_direct_stats([self._worker()], [extra], "3344")
         assert (w["h10"], w["h60"], w["h15"]) == (10, 20, 30)
         assert w["active_pool"] == "3344"
+        assert w["api_ok"] is True
 
-    def test_unreachable_direct_api_keeps_proxy_values_online(self):
-        # Falsy extra_stats -> keep proxy-derived hashrate/uptime and stay online (#28).
+    def test_failed_probe_flags_api_ok_false_keeps_proxy_values_online(self):
+        # A surfaced failure (api_ok=False) keeps proxy-derived hashrate/uptime and stays online
+        # (#28) but flags the worker so the UI can distinguish "API misconfigured" from "offline".
+        w0 = self._worker()
+        [w] = _merge_direct_stats([w0], [{"api_ok": False}], "3333")
+        assert w["status"] == "online"
+        assert (w["h10"], w["h60"], w["h15"]) == (1, 2, 3)  # untouched
+        assert w["api_ok"] is False
+        assert w["active_pool"] == "3333"
+
+    def test_skipped_probe_leaves_api_ok_unset(self):
+        # An empty result is a worker we deliberately didn't probe (SSRF guard): unknown, not a
+        # failure — keep proxy values, stay online, and don't claim an api_ok verdict.
         w0 = self._worker()
         [w] = _merge_direct_stats([w0], [{}], "3333")
         assert w["status"] == "online"
         assert (w["h10"], w["h60"], w["h15"]) == (1, 2, 3)  # untouched
+        assert "api_ok" not in w
         assert w["active_pool"] == "3333"
 
     def test_short_hashrate_total_ignored(self):
         # A <3-entry total isn't applied; uptime still updates and active_pool is tagged.
-        extra = {"uptime": 7, "hashrate": {"total": [5, 6]}}
+        extra = {"api_ok": True, "uptime": 7, "hashrate": {"total": [5, 6]}}
         [w] = _merge_direct_stats([self._worker()], [extra], "3333")
         assert (w["h10"], w["h60"], w["h15"]) == (1, 2, 3)
         assert w["uptime"] == 7
@@ -300,7 +383,7 @@ def test_prefers_h15(self):
     def test_falls_back_to_h60_then_h10(self):
         workers = [
             {"status": "online", "h15": 0, "h60": 1500, "h10": 500},  # uses h60
-            {"status": "online", "h15": 0, "h60": 0, "h10": 700},     # uses h10
+            {"status": "online", "h15": 0, "h60": 0, "h10": 700},  # uses h10
         ]
         total_h15, total_h10 = _aggregate_hashrate(workers)
         assert total_h15 == 1500 + 700
@@ -324,10 +407,13 @@ class TestAggregateWindowHashrates:
     def test_sums_each_window_independently(self):
         workers = [
             {"status": "online", "h10": 100, "h1h": 300, "h12h": 1200, "h24h": 2400},
-            {"status": "online", "h10": 50,  "h1h": 150, "h12h": 600,  "h24h": 1200},
+            {"status": "online", "h10": 50, "h1h": 150, "h12h": 600, "h24h": 1200},
         ]
         assert _aggregate_window_hashrates(workers) == {
-            "1m": 150, "1h": 450, "12h": 1800, "24h": 3600,
+            "1m": 150,
+            "1h": 450,
+            "12h": 1800,
+            "24h": 3600,
         }
 
     def test_no_fallback_between_windows(self):
@@ -339,8 +425,8 @@ def test_no_fallback_between_windows(self):
 
     def test_offline_excluded_and_missing_keys_zero(self):
         workers = [
-            {"status": "online", "h10": 100},                              # missing long windows -> 0
-            {"status": "offline", "h10": 9999, "h1h": 9999, "h24h": 9999}, # excluded entirely
+            {"status": "online", "h10": 100},  # missing long windows -> 0
+            {"status": "offline", "h10": 9999, "h1h": 9999, "h24h": 9999},  # excluded entirely
         ]
         assert _aggregate_window_hashrates(workers) == {"1m": 100, "1h": 0, "12h": 0, "24h": 0}
 
@@ -402,7 +488,10 @@ def _tari(self, required=True):
     async def test_stop_when_monero_down(self):
         # monerod is required, so its outage always rejects — even with Tari non-blocking.
         svc = self._svc()
-        with self._tari(required=False), patch.object(ds_mod, "REJECT_WORKERS_CONTAINER", "xmrig-proxy"):
+        with (
+            self._tari(required=False),
+            patch.object(ds_mod, "REJECT_WORKERS_CONTAINER", "xmrig-proxy"),
+        ):
             await svc._apply_worker_rejection(monero_down=True, tari_down=False)
         svc.docker_control.stop.assert_awaited_once_with("xmrig-proxy")
         assert svc.workers_rejected is True
@@ -552,8 +641,15 @@ async def test_single_iteration_aggregates(self):
         # idx8=1.0 kH/s, idx9=2.0 kH/s -> h15 = 2000 H/s.
         worker_row = ["rig1", "10.0.0.1", 1, 0, 0, 0, 0, 0, 1.0, 2.0, 0, 0, 0]
         proxy.get_workers.return_value = {"workers": [worker_row]}
-        proxy.get_summary.return_value = {"results": {"accepted": 100, "rejected": 5, "invalid": 1,
-                                                      "expired": 2, "best": [123456]}}
+        proxy.get_summary.return_value = {
+            "results": {
+                "accepted": 100,
+                "rejected": 5,
+                "invalid": 1,
+                "expired": 2,
+                "best": [123456],
+            }
+        }
 
         worker_client = MagicMock()
         worker_client.get_stats = AsyncMock(return_value={})  # direct API unreachable
@@ -561,20 +657,39 @@ async def test_single_iteration_aggregates(self):
         tari_client.get_sync_status = AsyncMock(return_value={"is_syncing": False})
         tari_client.close = AsyncMock()
 
-        with patch.object(ds_mod, "ClientSession", _FakeClientSession), \
-             patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client), \
-             patch.object(ds_mod, "TariClient", return_value=tari_client), \
-             patch.object(ds_mod, "get_stratum_stats", return_value=({}, [])), \
-             patch.object(ds_mod, "get_network_stats", return_value={"height": 100}), \
-             patch.object(ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}), \
-             patch.object(ds_mod, "get_p2pool_stats", return_value={"pool": {"last_share_time": 0, "difficulty": 0}}), \
-             patch.object(ds_mod, "get_monero_sync_status", AsyncMock(return_value={"is_syncing": False, "percent": 100, "target": 100, "current": 100})), \
-             patch.object(ds_mod, "get_disk_usage", return_value={}), \
-             patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")), \
-             patch.object(ds_mod, "get_memory_usage", return_value={}), \
-             patch.object(ds_mod, "get_load_average", return_value="0"), \
-             patch.object(ds_mod, "get_cpu_usage", return_value="0%"), \
-             patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)):
+        with (
+            patch.object(ds_mod, "ClientSession", _FakeClientSession),
+            patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client),
+            patch.object(ds_mod, "TariClient", return_value=tari_client),
+            patch.object(ds_mod, "get_stratum_stats", return_value={}),
+            patch.object(ds_mod, "get_network_stats", return_value={"height": 100}),
+            patch.object(
+                ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}
+            ),
+            patch.object(
+                ds_mod,
+                "get_p2pool_stats",
+                return_value={"pool": {"last_share_time": 0, "difficulty": 0}},
+            ),
+            patch.object(
+                ds_mod,
+                "get_monero_sync_status",
+                AsyncMock(
+                    return_value={
+                        "is_syncing": False,
+                        "percent": 100,
+                        "target": 100,
+                        "current": 100,
+                    }
+                ),
+            ),
+            patch.object(ds_mod, "get_disk_usage", return_value={}),
+            patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")),
+            patch.object(ds_mod, "get_memory_usage", return_value={}),
+            patch.object(ds_mod, "get_load_average", return_value="0"),
+            patch.object(ds_mod, "get_cpu_usage", return_value="0%"),
+            patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)),
+        ):
             with pytest.raises(StopAsyncIteration):
                 await svc.run()
 
@@ -584,7 +699,11 @@ async def test_single_iteration_aggregates(self):
         assert svc.latest_data["total_live_h15"] == 2000.0
         # The proxy /summary totals were collected and surfaced (Issue #82).
         assert svc.latest_data["proxy_summary"] == {
-            "accepted": 100, "rejected": 5, "invalid": 1, "expired": 2, "best": 123456,
+            "accepted": 100,
+            "rejected": 5,
+            "invalid": 1,
+            "expired": 2,
+            "best": 123456,
         }
         sm.update_history.assert_called()
         sm.save_snapshot.assert_called()
@@ -599,24 +718,46 @@ async def test_run_holds_miner_while_syncing(self):
         worker_client = MagicMock()
         worker_client.get_stats = AsyncMock(return_value={})
         tari_client = MagicMock()
-        tari_client.get_sync_status = AsyncMock(return_value={"is_syncing": False, "reachable": True})
+        tari_client.get_sync_status = AsyncMock(
+            return_value={"is_syncing": False, "reachable": True}
+        )
         tari_client.close = AsyncMock()
 
-        with patch.object(ds_mod, "ClientSession", _FakeClientSession), \
-             patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client), \
-             patch.object(ds_mod, "TariClient", return_value=tari_client), \
-             patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]), \
-             patch.object(ds_mod, "get_stratum_stats", return_value=({}, [])), \
-             patch.object(ds_mod, "get_network_stats", return_value={"height": 100}), \
-             patch.object(ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}), \
-             patch.object(ds_mod, "get_p2pool_stats", return_value={"pool": {"last_share_time": 0, "difficulty": 0}}), \
-             patch.object(ds_mod, "get_monero_sync_status", AsyncMock(return_value={"is_syncing": True, "reachable": True, "percent": 50, "current": 50, "target": 100})), \
-             patch.object(ds_mod, "get_disk_usage", return_value={}), \
-             patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")), \
-             patch.object(ds_mod, "get_memory_usage", return_value={}), \
-             patch.object(ds_mod, "get_load_average", return_value="0"), \
-             patch.object(ds_mod, "get_cpu_usage", return_value="0%"), \
-             patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)):
+        with (
+            patch.object(ds_mod, "ClientSession", _FakeClientSession),
+            patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client),
+            patch.object(ds_mod, "TariClient", return_value=tari_client),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+            patch.object(ds_mod, "get_stratum_stats", return_value={}),
+            patch.object(ds_mod, "get_network_stats", return_value={"height": 100}),
+            patch.object(
+                ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}
+            ),
+            patch.object(
+                ds_mod,
+                "get_p2pool_stats",
+                return_value={"pool": {"last_share_time": 0, "difficulty": 0}},
+            ),
+            patch.object(
+                ds_mod,
+                "get_monero_sync_status",
+                AsyncMock(
+                    return_value={
+                        "is_syncing": True,
+                        "reachable": True,
+                        "percent": 50,
+                        "current": 50,
+                        "target": 100,
+                    }
+                ),
+            ),
+            patch.object(ds_mod, "get_disk_usage", return_value={}),
+            patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")),
+            patch.object(ds_mod, "get_memory_usage", return_value={}),
+            patch.object(ds_mod, "get_load_average", return_value="0"),
+            patch.object(ds_mod, "get_cpu_usage", return_value="0%"),
+            patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)),
+        ):
             with pytest.raises(StopAsyncIteration):
                 await svc.run()
 
@@ -638,24 +779,38 @@ async def test_run_releases_despite_height_override(self):
         worker_client = MagicMock()
         worker_client.get_stats = AsyncMock(return_value={})
         tari_client = MagicMock()
-        tari_client.get_sync_status = AsyncMock(return_value={"is_syncing": False, "reachable": True})
+        tari_client.get_sync_status = AsyncMock(
+            return_value={"is_syncing": False, "reachable": True}
+        )
         tari_client.close = AsyncMock()
 
-        with patch.object(ds_mod, "ClientSession", _FakeClientSession), \
-             patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client), \
-             patch.object(ds_mod, "TariClient", return_value=tari_client), \
-             patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]), \
-             patch.object(ds_mod, "get_stratum_stats", return_value=({}, [])), \
-             patch.object(ds_mod, "get_network_stats", return_value={"height": 0}), \
-             patch.object(ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}), \
-             patch.object(ds_mod, "get_p2pool_stats", return_value={"pool": {"last_share_time": 0, "difficulty": 0}}), \
-             patch.object(ds_mod, "get_monero_sync_status", AsyncMock(return_value={"is_syncing": False, "reachable": True})), \
-             patch.object(ds_mod, "get_disk_usage", return_value={}), \
-             patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")), \
-             patch.object(ds_mod, "get_memory_usage", return_value={}), \
-             patch.object(ds_mod, "get_load_average", return_value="0"), \
-             patch.object(ds_mod, "get_cpu_usage", return_value="0%"), \
-             patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)):
+        with (
+            patch.object(ds_mod, "ClientSession", _FakeClientSession),
+            patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client),
+            patch.object(ds_mod, "TariClient", return_value=tari_client),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+            patch.object(ds_mod, "get_stratum_stats", return_value={}),
+            patch.object(ds_mod, "get_network_stats", return_value={"height": 0}),
+            patch.object(
+                ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}
+            ),
+            patch.object(
+                ds_mod,
+                "get_p2pool_stats",
+                return_value={"pool": {"last_share_time": 0, "difficulty": 0}},
+            ),
+            patch.object(
+                ds_mod,
+                "get_monero_sync_status",
+                AsyncMock(return_value={"is_syncing": False, "reachable": True}),
+            ),
+            patch.object(ds_mod, "get_disk_usage", return_value={}),
+            patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")),
+            patch.object(ds_mod, "get_memory_usage", return_value={}),
+            patch.object(ds_mod, "get_load_average", return_value="0"),
+            patch.object(ds_mod, "get_cpu_usage", return_value="0%"),
+            patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)),
+        ):
             with pytest.raises(StopAsyncIteration):
                 await svc.run()
 
@@ -677,25 +832,44 @@ async def test_run_nonblocking_tari_releases_and_stays_operational(self):
         worker_client.get_stats = AsyncMock(return_value={})
         tari_client = MagicMock()
         tari_client.get_sync_status = AsyncMock(
-            return_value={"is_syncing": True, "reachable": True, "percent": 42, "current": 42, "target": 100})
+            return_value={
+                "is_syncing": True,
+                "reachable": True,
+                "percent": 42,
+                "current": 42,
+                "target": 100,
+            }
+        )
         tari_client.close = AsyncMock()
 
-        with patch.object(ds_mod, "ClientSession", _FakeClientSession), \
-             patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client), \
-             patch.object(ds_mod, "TariClient", return_value=tari_client), \
-             patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]), \
-             patch.object(ds_mod, "TARI_REQUIRED", False), \
-             patch.object(ds_mod, "get_stratum_stats", return_value=({}, [])), \
-             patch.object(ds_mod, "get_network_stats", return_value={"height": 100}), \
-             patch.object(ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}), \
-             patch.object(ds_mod, "get_p2pool_stats", return_value={"pool": {"last_share_time": 0, "difficulty": 0}}), \
-             patch.object(ds_mod, "get_monero_sync_status", AsyncMock(return_value={"is_syncing": False, "reachable": True})), \
-             patch.object(ds_mod, "get_disk_usage", return_value={}), \
-             patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")), \
-             patch.object(ds_mod, "get_memory_usage", return_value={}), \
-             patch.object(ds_mod, "get_load_average", return_value="0"), \
-             patch.object(ds_mod, "get_cpu_usage", return_value="0%"), \
-             patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)):
+        with (
+            patch.object(ds_mod, "ClientSession", _FakeClientSession),
+            patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client),
+            patch.object(ds_mod, "TariClient", return_value=tari_client),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+            patch.object(ds_mod, "TARI_REQUIRED", False),
+            patch.object(ds_mod, "get_stratum_stats", return_value={}),
+            patch.object(ds_mod, "get_network_stats", return_value={"height": 100}),
+            patch.object(
+                ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}
+            ),
+            patch.object(
+                ds_mod,
+                "get_p2pool_stats",
+                return_value={"pool": {"last_share_time": 0, "difficulty": 0}},
+            ),
+            patch.object(
+                ds_mod,
+                "get_monero_sync_status",
+                AsyncMock(return_value={"is_syncing": False, "reachable": True}),
+            ),
+            patch.object(ds_mod, "get_disk_usage", return_value={}),
+            patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")),
+            patch.object(ds_mod, "get_memory_usage", return_value={}),
+            patch.object(ds_mod, "get_load_average", return_value="0"),
+            patch.object(ds_mod, "get_cpu_usage", return_value="0%"),
+            patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)),
+        ):
             with pytest.raises(StopAsyncIteration):
                 await svc.run()
 
@@ -712,11 +886,13 @@ async def test_iteration_survives_collector_error(self):
         tari_client = MagicMock()
         tari_client.get_sync_status = AsyncMock(return_value={})
 
-        with patch.object(ds_mod, "ClientSession", _FakeClientSession), \
-             patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client), \
-             patch.object(ds_mod, "TariClient", return_value=tari_client), \
-             patch.object(ds_mod, "get_stratum_stats", side_effect=RuntimeError("boom")), \
-             patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)):
+        with (
+            patch.object(ds_mod, "ClientSession", _FakeClientSession),
+            patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client),
+            patch.object(ds_mod, "TariClient", return_value=tari_client),
+            patch.object(ds_mod, "get_stratum_stats", side_effect=RuntimeError("boom")),
+            patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)),
+        ):
             # The error is caught inside the loop; the sleep after it raises to stop us.
             with pytest.raises(StopAsyncIteration):
                 await svc.run()
@@ -738,25 +914,44 @@ async def test_run_holds_when_tari_required_and_only_monero_synced(self):
         worker_client.get_stats = AsyncMock(return_value={})
         tari_client = MagicMock()
         tari_client.get_sync_status = AsyncMock(
-            return_value={"is_syncing": True, "reachable": True, "percent": 80, "current": 80, "target": 100})
+            return_value={
+                "is_syncing": True,
+                "reachable": True,
+                "percent": 80,
+                "current": 80,
+                "target": 100,
+            }
+        )
         tari_client.close = AsyncMock()
 
-        with patch.object(ds_mod, "ClientSession", _FakeClientSession), \
-             patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client), \
-             patch.object(ds_mod, "TariClient", return_value=tari_client), \
-             patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]), \
-             patch.object(ds_mod, "TARI_REQUIRED", True), \
-             patch.object(ds_mod, "get_stratum_stats", return_value=({}, [])), \
-             patch.object(ds_mod, "get_network_stats", return_value={"height": 100}), \
-             patch.object(ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}), \
-             patch.object(ds_mod, "get_p2pool_stats", return_value={"pool": {"last_share_time": 0, "difficulty": 0}}), \
-             patch.object(ds_mod, "get_monero_sync_status", AsyncMock(return_value={"is_syncing": False, "reachable": True})), \
-             patch.object(ds_mod, "get_disk_usage", return_value={}), \
-             patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")), \
-             patch.object(ds_mod, "get_memory_usage", return_value={}), \
-             patch.object(ds_mod, "get_load_average", return_value="0"), \
-             patch.object(ds_mod, "get_cpu_usage", return_value="0%"), \
-             patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)):
+        with (
+            patch.object(ds_mod, "ClientSession", _FakeClientSession),
+            patch.object(ds_mod, "XMRigWorkerClient", return_value=worker_client),
+            patch.object(ds_mod, "TariClient", return_value=tari_client),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+            patch.object(ds_mod, "TARI_REQUIRED", True),
+            patch.object(ds_mod, "get_stratum_stats", return_value={}),
+            patch.object(ds_mod, "get_network_stats", return_value={"height": 100}),
+            patch.object(
+                ds_mod, "get_tari_stats", return_value={"active": True, "status": "OK", "height": 3}
+            ),
+            patch.object(
+                ds_mod,
+                "get_p2pool_stats",
+                return_value={"pool": {"last_share_time": 0, "difficulty": 0}},
+            ),
+            patch.object(
+                ds_mod,
+                "get_monero_sync_status",
+                AsyncMock(return_value={"is_syncing": False, "reachable": True}),
+            ),
+            patch.object(ds_mod, "get_disk_usage", return_value={}),
+            patch.object(ds_mod, "get_hugepages_status", return_value=("Enabled", "ok", "1/2")),
+            patch.object(ds_mod, "get_memory_usage", return_value={}),
+            patch.object(ds_mod, "get_load_average", return_value="0"),
+            patch.object(ds_mod, "get_cpu_usage", return_value="0%"),
+            patch("asyncio.sleep", AsyncMock(side_effect=StopAsyncIteration)),
+        ):
             with pytest.raises(StopAsyncIteration):
                 await svc.run()
 
@@ -772,21 +967,253 @@ async def test_post_release_blip_lets_failover_act_without_rehold(self):
         # The two coexist: gate no-ops, rejection acts on the proxy only.
         svc, _sm, _proxy = _make_service()
         svc.miner_released = True
-        with patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]), \
-             patch.object(ds_mod, "REJECT_WORKERS_CONTAINER", "xmrig-proxy"), \
-             patch.object(ds_mod, "TARI_REQUIRED", True):
-            await svc._apply_sync_gate(gate_satisfied=False)   # latch → no-op
+        with (
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+            patch.object(ds_mod, "REJECT_WORKERS_CONTAINER", "xmrig-proxy"),
+            patch.object(ds_mod, "TARI_REQUIRED", True),
+        ):
+            await svc._apply_sync_gate(gate_satisfied=False)  # latch → no-op
             await svc._apply_worker_rejection(monero_down=True, tari_down=False)
         stopped = [c.args[0] for c in svc.docker_control.stop.await_args_list]
-        assert stopped == ["xmrig-proxy"]          # p2pool was NOT re-held
+        assert stopped == ["xmrig-proxy"]  # p2pool was NOT re-held
         svc.docker_control.start.assert_not_called()
         assert svc.workers_rejected is True
 
     async def test_both_nodes_down_rejects_once(self):
         # A simultaneous Monero+Tari outage (both required) is a single rejection, not two.
         svc, _sm, _proxy = _make_service()
-        with patch.object(ds_mod, "REJECT_WORKERS_CONTAINER", "xmrig-proxy"), \
-             patch.object(ds_mod, "TARI_REQUIRED", True):
+        with (
+            patch.object(ds_mod, "REJECT_WORKERS_CONTAINER", "xmrig-proxy"),
+            patch.object(ds_mod, "TARI_REQUIRED", True),
+        ):
             await svc._apply_worker_rejection(monero_down=True, tari_down=True)
         svc.docker_control.stop.assert_awaited_once_with("xmrig-proxy")
         assert svc.workers_rejected is True
+
+
+class TestXvbAutoRegister:
+    """XvB raffle auto-registration gating (#263)."""
+
+    def _svc(self, submit_url="https://xvb.example/submit"):
+        sm = MagicMock()
+        sm.load_snapshot.return_value = None
+        xvb = MagicMock()
+        xvb.submit_url = submit_url  # configured by default; pass "" for the unconfigured case
+        svc = DataService(sm, MagicMock(), xvb)
+        return svc, sm, xvb
+
+    def _stats(self, pplns_window=2160, pool_type="Main"):
+        return {"p2p": {"type": pool_type}, "pool": {"pplns_window": pplns_window}}
+
+    def _fresh_share(self):
+        return [{"ts": time.time()}]
+
+    def _state_writes(self, sm):
+        """Merged kwargs across all update_xvb_stats calls (the persisted XvB-state writes)."""
+        merged = {}
+        for call in sm.update_xvb_stats.call_args_list:
+            merged.update(call.kwargs)
+        return merged
+
+    async def test_no_share_does_not_register(self):
+        # Endpoint only takes effect with a PPLNS share, so we don't even call it before then.
+        svc, _sm, xvb = self._svc()
+        await svc._maybe_register_xvb(shares=[], p2pool_stats=self._stats())
+        xvb.register.assert_not_called()
+        assert svc._xvb_last_registered is None
+
+    async def test_stale_share_outside_window_does_not_register(self):
+        svc, _sm, xvb = self._svc()
+        # 2160 blocks * 10s = 6h window; a share 7h old is outside it.
+        stale = [{"ts": time.time() - 7 * 3600}]
+        await svc._maybe_register_xvb(shares=stale, p2pool_stats=self._stats())
+        xvb.register.assert_not_called()
+
+    async def test_registers_once_eligible(self):
+        # REG_OK covers both a fresh 2xx and the idempotent "already registered" steady state.
+        svc, sm, xvb = self._svc()
+        xvb.register.return_value = REG_OK
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        xvb.register.assert_called_once()
+        assert svc._xvb_last_registered is not None
+        writes = self._state_writes(sm)
+        assert "registered_at" in writes
+        assert writes["registration_state"] == "registered"
+
+    async def test_transient_error_retries_next_poll(self):
+        # A transient error must NOT latch the timestamp, so the next eligible poll retries; and one
+        # blip stays below the failing threshold (no dashboard warning yet).
+        svc, sm, xvb = self._svc()
+        xvb.register.return_value = REG_ERROR
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        assert svc._xvb_last_registered is None
+        assert svc._xvb_register_failures == 1
+        assert "registration_state" not in self._state_writes(sm)
+
+    async def test_not_eligible_is_quiet_retry(self):
+        # Local share hasn't propagated to XvB yet => retry quietly, NOT counted as a failure.
+        svc, sm, xvb = self._svc()
+        xvb.register.return_value = REG_NOT_ELIGIBLE
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        assert svc._xvb_register_failures == 0
+        sm.update_xvb_stats.assert_not_called()
+        assert svc._xvb_last_registered is None  # not registered, will retry
+
+    async def test_invalid_wallet_latches_and_warns(self, caplog):
+        # Permanent rejection: surface "invalid", warn once, and stop calling the endpoint.
+        svc, sm, xvb = self._svc()
+        xvb.register.return_value = REG_INVALID
+        with caplog.at_level("WARNING"):
+            await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+            await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        xvb.register.assert_called_once()  # latched after the first rejection — no re-hammering
+        assert self._state_writes(sm)["registration_state"] == "invalid"
+        assert sum("rejected MONERO_WALLET_ADDRESS" in r.message for r in caplog.records) == 1
+
+    async def test_skips_when_recently_registered(self):
+        svc, _sm, xvb = self._svc()
+        svc._xvb_last_registered = time.time()  # just registered
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        xvb.register.assert_not_called()
+
+    async def test_reregisters_after_interval(self):
+        # Idempotent daily re-register once the cadence elapses.
+        svc, _sm, xvb = self._svc()
+        xvb.register.return_value = REG_OK
+        svc._xvb_last_registered = time.time() - XVB_REGISTER_INTERVAL_S - 1
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        xvb.register.assert_called_once()
+
+    async def test_disabled_endpoint_skips_silently(self):
+        # XVB_SUBMIT_URL disabled => empty submit_url => no call, no warning, no status write.
+        svc, sm, xvb = self._svc(submit_url="")
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        xvb.register.assert_not_called()
+        sm.update_xvb_stats.assert_not_called()
+
+    async def test_persistent_failure_flags_failing_after_threshold(self):
+        # A configured-but-erroring endpoint surfaces a "failing" badge only after a few attempts.
+        svc, sm, xvb = self._svc()
+        xvb.register.return_value = REG_ERROR
+        for _ in range(_XVB_REGISTER_FAIL_ALERT - 1):
+            await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        # Below the threshold: no dashboard warning yet.
+        assert "registration_state" not in self._state_writes(sm)
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        assert self._state_writes(sm)["registration_state"] == "failing"
+        assert svc._xvb_last_registered is None  # still never succeeded
+
+    async def test_success_after_failures_resets_counter(self):
+        svc, sm, xvb = self._svc()
+        xvb.register.return_value = REG_ERROR
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        assert svc._xvb_register_failures == 1
+        xvb.register.return_value = REG_OK
+        await svc._maybe_register_xvb(shares=self._fresh_share(), p2pool_stats=self._stats())
+        assert svc._xvb_register_failures == 0
+        assert self._state_writes(sm)["registration_state"] == "registered"
+
+
+class TestXvbStatsSync:
+    """XvB stats fetch → persist (#163), and the #311 precondition: a FAILED fetch must write
+    nothing, so the last reading and ``last_update`` stay frozen and the staleness guard can fire.
+    This is the integration seam the algo-level unit tests assume but can't see."""
+
+    def _svc(self):
+        sm = MagicMock()
+        sm.load_snapshot.return_value = None
+        xvb = MagicMock()
+        return DataService(sm, MagicMock(), xvb), sm, xvb
+
+    async def test_successful_fetch_persists_stats(self):
+        svc, sm, xvb = self._svc()
+        xvb.get_stats.return_value = {"avg_1h": 12_000.0, "avg_24h": 11_000.0, "fail_count": 0}
+        await svc._sync_xvb_stats()
+        sm.update_xvb_stats.assert_called_once_with(avg_1h=12_000.0, avg_24h=11_000.0, fail_count=0)
+
+    async def test_failed_fetch_writes_nothing(self):
+        # #311 linchpin: get_stats() returns None on a Tor timeout / 5xx. Persisting nothing is what
+        # keeps last_update frozen so the controller can detect the feed is stale. If this regresses
+        # to stamping on failure, the staleness guard silently never triggers.
+        svc, sm, xvb = self._svc()
+        xvb.get_stats.return_value = None
+        await svc._sync_xvb_stats()
+        sm.update_xvb_stats.assert_not_called()
+
+
+class _RecordingGet:
+    """One aiohttp ``session.get()`` async-context-manager that records nothing itself."""
+
+    async def __aenter__(self):
+        resp = MagicMock()
+        resp.status = 200
+        resp.json = AsyncMock(return_value={"ok": True})
+        return resp
+
+    async def __aexit__(self, *exc):
+        return False
+
+
+class _RecordingSession:
+    """Minimal aiohttp ClientSession stub that records every probed URL."""
+
+    def __init__(self):
+        self.urls = []
+
+    def get(self, url, headers=None, timeout=None):
+        self.urls.append(url)
+        return _RecordingGet()
+
+
+class TestWorkerProbeSsrfWiring:
+    """End-to-end SSRF guard (#122): a miner controls its own row in xmrig-proxy's ``/workers``
+    list (name at index 0, IP at index 1). Prove that an internal/loopback IP or a crafted name
+    can't make the dashboard probe an internal target — the exact tier-1 mirror of the deferred
+    live test in #206. Threads the real proxy-row → probe path (``_normalize_proxy_workers`` then
+    the same task construction as DataService.run), so the parsed IP — never the name — is the only
+    thing ever used as a host."""
+
+    @staticmethod
+    def _row(name, ip):
+        # A full positional xmrig-proxy 6.x row (>= _PX_MIN_FIELDS): 1 active conn, some hashrate.
+        return [name, ip, 1, 0, 0, 0, 0, 0, 1.0, 2.0, 0, 0, 0]
+
+    async def _probe(self, raw_workers):
+        workers = _normalize_proxy_workers({"workers": raw_workers})
+        session = _RecordingSession()
+        client = XMRigWorkerClient(session)
+        # Mirror DataService.run's probe fan-out verbatim (data_service.py:632).
+        results = await asyncio.gather(*[client.get_stats(w["ip"], w["name"]) for w in workers])
+        return workers, results, session.urls
+
+    async def test_internal_ip_worker_is_never_probed(self):
+        # Every class the guard blocks: cloud metadata (link-local), loopback, the stack's own
+        # docker bridge (socket proxies / Tor / monerod), multicast, unspecified, and a name that
+        # isn't a bare IP. LAN/public miner IPs are intentionally NOT here — those are real miners.
+        for ip in (
+            "169.254.169.254",  # cloud metadata (link-local)
+            "127.0.0.1",  # loopback
+            "172.28.0.2",  # internal docker bridge (default MINING_NET_CIDR)
+            "224.0.0.1",  # multicast
+            "0.0.0.0",  # unspecified
+            "p2pool",  # a worker name, not a bare IP
+            "",  # missing
+        ):
+            _, results, urls = await self._probe([self._row("evil", ip)])
+            assert results == [{}], f"probed an internal/invalid target {ip!r}"
+            assert urls == [], f"issued a request to internal/invalid target {ip!r}"
+
+    async def test_real_worker_is_probed_internal_neighbour_is_not(self):
+        workers, results, urls = await self._probe(
+            [self._row("rig", "8.8.8.8"), self._row("evil", "169.254.169.254")]
+        )
+        # Exactly one probe, to the real miner only.
+        assert urls == ["http://8.8.8.8:8080/1/summary"]
+        assert results[0].get("api_ok") is True
+        assert results[1] == {}
+
+    async def test_malicious_name_is_never_used_as_a_host(self):
+        # The name is fully attacker-controlled; it must never end up in the request URL.
+        _, _, urls = await self._probe([self._row("169.254.169.254", "8.8.8.8")])
+        assert urls == ["http://8.8.8.8:8080/1/summary"]
+        assert all("169.254.169.254" not in u for u in urls)
diff --git a/build/dashboard/tests/service/test_earnings.py b/build/dashboard/tests/service/test_earnings.py
index 5a567e24..0d1beb41 100644
--- a/build/dashboard/tests/service/test_earnings.py
+++ b/build/dashboard/tests/service/test_earnings.py
@@ -5,18 +5,21 @@
 the graceful-degradation behaviour when inputs are missing. The client scales this rate to the
 what-if hashrate; that scaling/formatting is tested in tests/frontend/logic.test.mjs.
 """
+
 import pytest
 
 from mining_dashboard.service.earnings import (
-    xmr_per_hs_day, ATOMIC_PER_XMR, SECONDS_PER_DAY,
+    ATOMIC_PER_XMR,
+    SECONDS_PER_DAY,
+    xmr_per_hs_day,
 )
 
 
 class TestXmrPerHsDay:
     def test_matches_closed_form(self):
         # reward_xmr / difficulty * seconds_per_day, with reward given in atomic units.
-        reward_atomic = 0.6 * ATOMIC_PER_XMR        # 0.6 XMR block reward
-        difficulty = 400_000_000_000                # 400 G
+        reward_atomic = 0.6 * ATOMIC_PER_XMR  # 0.6 XMR block reward
+        difficulty = 400_000_000_000  # 400 G
         expected = 0.6 / difficulty * SECONDS_PER_DAY
         assert xmr_per_hs_day(reward_atomic, difficulty) == pytest.approx(expected)
 
@@ -33,13 +36,16 @@ def test_linear_in_inputs(self):
         assert xmr_per_hs_day(2 * ATOMIC_PER_XMR, 1_000_000) == pytest.approx(2 * base)
         assert xmr_per_hs_day(ATOMIC_PER_XMR, 2_000_000) == pytest.approx(base / 2)
 
-    @pytest.mark.parametrize("reward,diff", [
-        (0, 400_000_000_000),                 # no reward collected yet
-        (0.6 * ATOMIC_PER_XMR, 0),            # no difficulty yet
-        (0, 0),                               # nothing collected
-        (-1, 400_000_000_000),               # defensive: negative reward
-        (0.6 * ATOMIC_PER_XMR, -5),          # defensive: negative difficulty
-    ])
+    @pytest.mark.parametrize(
+        "reward,diff",
+        [
+            (0, 400_000_000_000),  # no reward collected yet
+            (0.6 * ATOMIC_PER_XMR, 0),  # no difficulty yet
+            (0, 0),  # nothing collected
+            (-1, 400_000_000_000),  # defensive: negative reward
+            (0.6 * ATOMIC_PER_XMR, -5),  # defensive: negative difficulty
+        ],
+    )
     def test_missing_or_bad_inputs_are_zero(self, reward, diff):
         # A zero rate is the dashboard's "unavailable" signal (shows "—"); never raise or divide
         # by zero on incomplete live data.
diff --git a/build/dashboard/tests/service/test_egress.py b/build/dashboard/tests/service/test_egress.py
new file mode 100644
index 00000000..c5986306
--- /dev/null
+++ b/build/dashboard/tests/service/test_egress.py
@@ -0,0 +1,314 @@
+"""Tests for the #170 egress-posture derivation."""
+
+import itertools
+
+from mining_dashboard.service.egress import (
+    CLEARNET,
+    INACTIVE,
+    LOCAL,
+    TOPOLOGY_NODES,
+    TOR,
+    compute_egress_posture,
+    compute_topology,
+)
+
+# The privacy-safe resting config: firewall on, p2pool over Tor, XvB over Tor, local node, no sync.
+SAFE = {
+    "firewall": True,
+    "p2pool_clearnet": False,
+    "xvb_enabled": True,
+    "xvb_tor": True,
+    "monero_clearnet_sync": False,
+    "tari_clearnet_sync": False,
+    "remote_monero": False,
+}
+
+
+def _posture(**overrides):
+    return compute_egress_posture(**{**SAFE, **overrides})
+
+
+def _conn(posture, component, needle):
+    comp = next(c for c in posture["components"] if c["name"] == component)
+    return next(c for c in comp["conns"] if needle in c["to"])
+
+
+def test_safe_config_is_all_tor():
+    p = _posture()
+    assert p["summary"] == {
+        "firewall": True,
+        "leaks": 0,
+        "blocked_by_firewall": 0,
+        "all_tor": True,
+        "level": "ok",
+        "label": "All egress via Tor",
+    }
+
+
+def test_p2pool_clearnet_blocked_by_firewall_is_not_a_leak():
+    p = _posture(p2pool_clearnet=True, firewall=True)
+    assert _conn(p, "p2pool", "sidechain")["route"] == CLEARNET
+    assert _conn(p, "p2pool", "sidechain")["blocked_by_firewall"] is True
+    assert p["summary"]["leaks"] == 0
+    assert p["summary"]["blocked_by_firewall"] == 1
+    assert p["summary"]["all_tor"] is True  # fail-closed: configured-clearnet can't actually leave
+
+
+def test_p2pool_clearnet_without_firewall_is_a_leak():
+    p = _posture(p2pool_clearnet=True, firewall=False)
+    assert p["summary"]["leaks"] == 1
+    assert p["summary"]["level"] == "warn"
+    assert "exposing your IP" in p["summary"]["label"]
+
+
+def test_host_networked_dashboard_leaks_despite_firewall():
+    # The dashboard's XvB stats fetch is host-networked, so the #270 container firewall can't cover
+    # it — disabling XvB-over-Tor leaks the host IP even with the firewall on. This is the key nuance.
+    p = _posture(xvb_tor=False, firewall=True)
+    assert _conn(p, "dashboard", "XvB stats")["route"] == CLEARNET
+    assert _conn(p, "dashboard", "XvB stats").get("blocked_by_firewall") is None
+    # The xmrig-proxy donation dial (a container) IS blocked by the firewall, but the dashboard isn't.
+    assert _conn(p, "xmrig-proxy", "XvB donation")["blocked_by_firewall"] is True
+    assert p["summary"]["leaks"] >= 1
+    assert p["summary"]["all_tor"] is False
+
+
+def test_xvb_disabled_routes_are_inactive():
+    p = _posture(xvb_enabled=False)
+    assert _conn(p, "dashboard", "XvB stats")["route"] == INACTIVE
+    assert _conn(p, "xmrig-proxy", "XvB donation")["route"] == INACTIVE
+    assert p["summary"]["leaks"] == 0
+
+
+def test_remote_monerod_rpc_is_clearnet():
+    assert _conn(_posture(remote_monero=False), "p2pool", "monerod RPC")["route"] != CLEARNET
+    assert _conn(_posture(remote_monero=True), "p2pool", "monerod RPC")["route"] == CLEARNET
+
+
+def test_clearnet_initial_sync_surfaces_only_when_enabled():
+    base = _posture()
+    assert not any(
+        "initial" in c["to"]
+        for c in next(x for x in base["components"] if x["name"] == "monerod")["conns"]
+    )
+    synced = _posture(monero_clearnet_sync=True, firewall=False)
+    assert _conn(synced, "monerod", "initial block download")["route"] == CLEARNET
+
+
+def test_monerod_p2p_always_tor():
+    assert _conn(_posture(firewall=False), "monerod", "Monero P2P")["route"] == TOR
+
+
+# --- Topology (#170 trust-boundary view) -----------------------------------------------
+
+
+def _topo(**overrides):
+    return compute_topology(**{**SAFE, **overrides})
+
+
+def _edge(topo, src, dst):
+    return next(e for e in topo["edges"] if e["from"] == src and e["to"] == dst)
+
+
+def _from(topo, src):
+    return [e for e in topo["edges"] if e["from"] == src]
+
+
+def test_topology_summary_is_shared_with_egress_list():
+    # The badge can never disagree with the map: same knobs in, identical summary out.
+    for overrides in ({}, {"xvb_tor": False}, {"p2pool_clearnet": True, "firewall": False}):
+        assert _topo(**overrides)["summary"] == _posture(**overrides)["summary"]
+
+
+def test_topology_safe_has_no_leaks_and_hub_nodes():
+    topo = _topo()
+    ids = {n["id"] for n in topo["nodes"]}
+    assert {"tor", "internet", "rigs", "browser"} <= ids
+    assert not any(e.get("leak") for e in topo["edges"])
+    assert topo["summary"]["all_tor"] is True
+
+
+def test_topology_lan_ingress_edges():
+    topo = _topo()
+    rigs = _edge(topo, "rigs", "xmrig-proxy")
+    assert rigs["kind"] == "ingress" and rigs["route"] == "local"
+    assert _edge(topo, "browser", "caddy")["kind"] == "ingress"
+
+
+def test_topology_daemon_p2p_is_bidirectional_over_tor():
+    topo = _topo()
+    for daemon in ("monerod", "tari", "p2pool"):
+        edge = _edge(topo, daemon, "tor")
+        assert edge["kind"] == "p2p", daemon  # egress + onion ingress
+        assert edge["route"] == TOR, daemon
+
+
+def test_topology_clearnet_link_bypasses_the_tor_hub():
+    # A clearnet route must land on `internet`, not `tor`, so a leak visibly skips the hub.
+    topo = _topo(p2pool_clearnet=True, firewall=False)
+    edge = _edge(topo, "p2pool", "internet")
+    assert edge["route"] == CLEARNET and edge["leak"] is True
+    assert not any(e["to"] == "tor" and e["from"] == "p2pool" for e in topo["edges"])
+
+
+def test_topology_clearnet_blocked_by_firewall_is_not_a_leak():
+    topo = _topo(p2pool_clearnet=True, firewall=True)
+    edge = _edge(topo, "p2pool", "internet")
+    assert edge.get("blocked_by_firewall") is True and edge.get("leak") is None
+    assert topo["summary"]["all_tor"] is True
+
+
+def test_topology_host_networked_dashboard_xvb_leaks_but_proxy_is_blocked():
+    topo = _topo(xvb_tor=False, firewall=True)
+    # The dashboard's XvB stats fetch is host-networked → the #270 firewall can't cover it.
+    assert _edge(topo, "dashboard", "internet")["leak"] is True
+    # The xmrig-proxy XvB dial IS a container → the firewall blocks its clearnet route.
+    assert _edge(topo, "xmrig-proxy", "internet").get("blocked_by_firewall") is True
+
+
+def test_topology_xvb_disabled_is_inactive_not_a_leak():
+    topo = _topo(xvb_enabled=False)
+    assert _edge(topo, "xmrig-proxy", "tor")["route"] == INACTIVE
+    assert _edge(topo, "dashboard", "tor")  # update check still present
+    assert not any(e.get("leak") for e in topo["edges"])
+
+
+def test_topology_internal_mesh_is_flagged_and_includes_merge_mining():
+    topo = _topo()
+    merge = _edge(topo, "p2pool", "tari")
+    assert merge["kind"] == "internal" and "merge-mine" in merge["label"]
+    docker = next(n for n in topo["nodes"] if n["id"] == "docker")
+    assert docker.get("internal") is True
+
+
+def test_topology_clearnet_sync_adds_bypass_edge():
+    topo = _topo(monero_clearnet_sync=True, firewall=False)
+    edge = _edge(topo, "monerod", "internet")
+    assert edge["route"] == CLEARNET and edge["leak"] is True
+
+
+def test_tari_clearnet_sync_surfaces_in_egress_and_topology():
+    # The Tari clearnet-sync branch is symmetric with Monero's — exercise it explicitly so the
+    # tari path can't regress unnoticed (only the monerod one was covered before).
+    base = _posture()
+    tari_conns = next(c for c in base["components"] if c["name"] == "tari")["conns"]
+    assert not any("initial sync" in c["to"] for c in tari_conns)
+
+    p = _posture(tari_clearnet_sync=True, firewall=False)
+    assert _conn(p, "tari", "initial sync")["route"] == CLEARNET
+    topo = _topo(tari_clearnet_sync=True, firewall=False)
+    edge = _edge(topo, "tari", "internet")
+    assert edge["route"] == CLEARNET and edge["leak"] is True
+
+
+# --- Exhaustive config sweep + frontend contract ---------------------------------------
+# The diagram must hold for ANY operator config, not just the hand-picked cases above.
+
+_KNOBS = (
+    "firewall",
+    "p2pool_clearnet",
+    "xvb_enabled",
+    "xvb_tor",
+    "monero_clearnet_sync",
+    "tari_clearnet_sync",
+    "remote_monero",
+)
+
+
+def _all_configs():
+    """Every one of the 2**7 combinations of the boolean knobs."""
+    for combo in itertools.product((False, True), repeat=len(_KNOBS)):
+        yield dict(zip(_KNOBS, combo, strict=True))
+
+
+# Canonical node ids — MUST stay in lockstep with the frontend's POS map in
+# web/static/topology.mjs (the SVG silently drops any edge whose endpoint it can't place, so a
+# drift here would make a real connection vanish from the diagram with no error). The frontend
+# half of this contract is asserted in tests/frontend/topology.test.mjs.
+TOPOLOGY_NODE_IDS = {
+    "rigs",
+    "browser",
+    "xmrig-proxy",
+    "caddy",
+    "dashboard",
+    "p2pool",
+    "monerod",
+    "tari",
+    "docker",
+    "tor",
+    "internet",
+}
+
+
+def test_topology_nodes_match_the_canonical_set():
+    assert {n["id"] for n in TOPOLOGY_NODES} == TOPOLOGY_NODE_IDS
+
+
+def test_every_edge_endpoint_is_a_placeable_node_for_all_configs():
+    # No config may emit an edge to/from a node the diagram can't place — that edge would silently
+    # disappear from the SVG. This is the contract that keeps "various configs show correctly".
+    for cfg in _all_configs():
+        topo = compute_topology(**cfg)
+        assert {n["id"] for n in topo["nodes"]} == TOPOLOGY_NODE_IDS, cfg
+        for e in topo["edges"]:
+            assert e["from"] in TOPOLOGY_NODE_IDS, (cfg, e)
+            assert e["to"] in TOPOLOGY_NODE_IDS, (cfg, e)
+
+
+def test_every_edge_is_well_formed_for_all_configs():
+    routes = {TOR, CLEARNET, LOCAL, INACTIVE}
+    kinds = {"ingress", "egress", "p2p", "internal"}
+    for cfg in _all_configs():
+        for e in compute_topology(**cfg)["edges"]:
+            assert e["route"] in routes, (cfg, e)
+            assert e["kind"] in kinds, (cfg, e)
+            assert e["label"], (cfg, e)
+            # A link is either a real leak or firewall-blocked, never tagged both at once.
+            assert not (e.get("leak") and e.get("blocked_by_firewall")), (cfg, e)
+            # Only clearnet links may carry a leak / blocked tag.
+            if e.get("leak") or e.get("blocked_by_firewall"):
+                assert e["route"] == CLEARNET, (cfg, e)
+
+
+def test_topology_summary_matches_egress_for_all_configs():
+    # The header badge (built from the egress summary) can never disagree with the map: the two are
+    # derived from the same knobs and must return a byte-identical summary for every combination.
+    for cfg in _all_configs():
+        assert compute_topology(**cfg)["summary"] == compute_egress_posture(**cfg)["summary"], cfg
+
+
+def test_firewall_off_counts_every_clearnet_path_as_a_leak():
+    # Firewall down + every clearnet knob on: there's no backstop, so each clearnet path is a real,
+    # counted leak — leaks must equal the number of clearnet connections, with nothing "blocked".
+    p = _posture(
+        firewall=False,
+        p2pool_clearnet=True,
+        xvb_tor=False,
+        monero_clearnet_sync=True,
+        tari_clearnet_sync=True,
+        remote_monero=True,
+    )
+    clearnet = sum(1 for comp in p["components"] for c in comp["conns"] if c["route"] == CLEARNET)
+    assert clearnet >= 5  # sidechain, RPC, monero IBD, tari IBD, XvB donation, XvB stats...
+    assert p["summary"]["leaks"] == clearnet
+    assert p["summary"]["blocked_by_firewall"] == 0
+    assert p["summary"]["all_tor"] is False
+    assert "exposing your IP" in p["summary"]["label"]
+
+
+def test_firewall_on_blocks_containers_but_not_the_host_dashboard():
+    # Same clearnet-everywhere config with the firewall ON: every container path is blocked, leaving
+    # exactly the host-networked dashboard's XvB stats fetch as the sole real leak (the #270 nuance).
+    p = _posture(
+        firewall=True,
+        p2pool_clearnet=True,
+        xvb_tor=False,
+        monero_clearnet_sync=True,
+        tari_clearnet_sync=True,
+        remote_monero=True,
+    )
+    assert p["summary"]["leaks"] == 1
+    assert _conn(p, "dashboard", "XvB stats")["route"] == CLEARNET
+    assert _conn(p, "dashboard", "XvB stats").get("blocked_by_firewall") is None
+    assert p["summary"]["blocked_by_firewall"] >= 4
+    assert p["summary"]["all_tor"] is False
diff --git a/build/dashboard/tests/service/test_metrics.py b/build/dashboard/tests/service/test_metrics.py
index 9a2fb3bc..0169eae3 100644
--- a/build/dashboard/tests/service/test_metrics.py
+++ b/build/dashboard/tests/service/test_metrics.py
@@ -5,13 +5,17 @@
 sync/down state. The web view layer and future consumers (#45 Telegram, #12 calculator) all
 read these, so the logic is covered thoroughly here rather than through rendered output.
 """
-import time
 
+import time
 from unittest.mock import MagicMock
 
 import mining_dashboard.service.metrics as metrics
-from mining_dashboard.service.metrics import build_metrics, _avg_p2pool_over_window, _avg_xvb_over_window
-from mining_dashboard.config.config import TIER_DEFAULTS
+from mining_dashboard.config.config import TIER_DEFAULTS, XVB_STATS_STALE_AFTER_S
+from mining_dashboard.service.metrics import (
+    _avg_p2pool_over_window,
+    _avg_xvb_over_window,
+    build_metrics,
+)
 
 
 def _mgr(history=None, mode="P2POOL", xvb=None, tiers=None):
@@ -28,7 +32,10 @@ def _mgr(history=None, mode="P2POOL", xvb=None, tiers=None):
 
 def _data(**over):
     d = {
-        "shares": [], "workers": [], "global_sync": False, "total_live_h15": 0,
+        "shares": [],
+        "workers": [],
+        "global_sync": False,
+        "total_live_h15": 0,
         "monero_sync": {"percent": 100, "current": 10, "target": 10},
         "tari_sync": {"percent": 100, "current": 5, "target": 5},
     }
@@ -106,13 +113,15 @@ def test_complements_p2pool_to_total(self):
             {"timestamp": now - 60, "v": 1000, "v_p2pool": 0, "v_xvb": 1000},
         ]
         assert _avg_xvb_over_window(history, 3600) == 500.0
-        assert _avg_p2pool_over_window(history, 3600) == 500.0   # 500 + 500 == 1000 total
+        assert _avg_p2pool_over_window(history, 3600) == 500.0  # 500 + 500 == 1000 total
 
 
 class TestHashrate:
     def test_total_and_stratum_passthrough(self):
-        data = _data(total_live_h15=12345,
-                     stratum={"hashrate_15m": 100, "hashrate_1h": 200, "hashrate_24h": 300})
+        data = _data(
+            total_live_h15=12345,
+            stratum={"hashrate_15m": 100, "hashrate_1h": 200, "hashrate_24h": 300},
+        )
         m = build_metrics(data, _mgr())
         assert m.total_h15 == 12345
         assert (m.stratum_h15, m.stratum_h1h, m.stratum_h24h) == (100, 200, 300)
@@ -138,7 +147,7 @@ def test_xvb_routed_averages_from_history(self):
         m = build_metrics(_data(), _mgr(history=history, xvb={"avg_1h": 30_000, "avg_24h": 30_000}))
         assert m.xvb_routed_1h == 400.0
         assert m.xvb_routed_24h == 400.0
-        assert m.xvb_1h == 30_000      # credited, independent of routed
+        assert m.xvb_1h == 30_000  # credited, independent of routed
 
     def test_xvb_routed_zero_without_history(self):
         m = build_metrics(_data(total_live_h15=40_000), _mgr())
@@ -162,7 +171,7 @@ def test_xvb_disabled_overrides_mode_and_tiers(self, monkeypatch):
     def test_current_tier_from_min_1h_24h(self):
         # Current tier qualifies on the lower of the 1h/24h credited averages (#157) — set both.
         m = build_metrics(_data(), _mgr(xvb={"avg_1h": 50_000_000, "avg_24h": 50_000_000}))
-        assert m.current_tier != "None"   # some tier qualifies at 50 MH/s on both windows
+        assert m.current_tier != "None"  # some tier qualifies at 50 MH/s on both windows
         assert isinstance(m.target_threshold, float)
 
     def test_current_tier_uses_lower_of_1h_24h_on_drop(self):
@@ -171,8 +180,8 @@ def test_current_tier_uses_lower_of_1h_24h_on_drop(self):
         high = build_metrics(_data(), _mgr(xvb={"avg_1h": 50_000_000, "avg_24h": 50_000_000}))
         dropped = build_metrics(_data(), _mgr(xvb={"avg_1h": 50_000, "avg_24h": 50_000_000}))
         only_1h = build_metrics(_data(), _mgr(xvb={"avg_1h": 50_000, "avg_24h": 50_000}))
-        assert dropped.current_tier != high.current_tier      # the 1h drop lowered the tier
-        assert dropped.current_tier == only_1h.current_tier   # tier follows the LOWER (1h) average
+        assert dropped.current_tier != high.current_tier  # the 1h drop lowered the tier
+        assert dropped.current_tier == only_1h.current_tier  # tier follows the LOWER (1h) average
 
     def test_low_hr_warning_for_unsustainable_explicit_tier(self, monkeypatch):
         monkeypatch.setattr(metrics, "ENABLE_XVB", True)
@@ -196,14 +205,53 @@ def test_fail_count_and_last_update(self):
         assert m.xvb_fail_count == 4
         assert m.xvb_last_update == 1700000000
 
+    def test_registration_status_surfaced(self):
+        # #263: registered_at + registration_state flow from XvB state to the metrics (badge driver).
+        m = build_metrics(
+            _data(), _mgr(xvb={"registered_at": 1700000500, "registration_state": "registered"})
+        )
+        assert m.xvb_registered_at == 1700000500
+        assert m.xvb_registration_state == "registered"
+
+    def test_registration_status_defaults(self):
+        # Absent from state (older DBs / fresh start) => safe zero/empty defaults, no badge.
+        m = build_metrics(_data(), _mgr(xvb={}))
+        assert m.xvb_registered_at == 0
+        assert m.xvb_registration_state == ""
+
+    def test_xvb_stale_flag_tracks_fetch_age(self, monkeypatch):
+        # #311: surface a stale fetch so the UI can grey the credited figures.
+        monkeypatch.setattr(metrics, "ENABLE_XVB", True)
+        fresh = build_metrics(_data(), _mgr(xvb={"last_update": time.time()}))
+        assert fresh.xvb_stale is False
+        stale = build_metrics(
+            _data(), _mgr(xvb={"last_update": time.time() - XVB_STATS_STALE_AFTER_S - 60})
+        )
+        assert stale.xvb_stale is True
+
+    def test_xvb_stale_never_set_when_disabled(self, monkeypatch):
+        # XvB off => no donation logic, so an old timestamp must not raise a stale flag.
+        monkeypatch.setattr(metrics, "ENABLE_XVB", False)
+        m = build_metrics(
+            _data(), _mgr(xvb={"last_update": time.time() - XVB_STATS_STALE_AFTER_S - 60})
+        )
+        assert m.xvb_stale is False
+
+    def test_xvb_stale_false_on_cold_start(self, monkeypatch):
+        # Never fetched (last_update absent) => cold start, not stale (the ramp regime).
+        monkeypatch.setattr(metrics, "ENABLE_XVB", True)
+        assert build_metrics(_data(), _mgr(xvb={})).xvb_stale is False
+
 
 class TestWorkers:
     def test_counts_online_and_total(self):
-        data = _data(workers=[
-            {"name": "a", "status": "online"},
-            {"name": "b", "status": "offline"},
-            {"name": "c", "status": "online"},
-        ])
+        data = _data(
+            workers=[
+                {"name": "a", "status": "online"},
+                {"name": "b", "status": "offline"},
+                {"name": "c", "status": "online"},
+            ]
+        )
         m = build_metrics(data, _mgr())
         assert m.workers_online == 2
         assert m.workers_total == 3
@@ -217,7 +265,7 @@ class TestSharesWindow:
     def test_counts_recent_within_pplns_window(self):
         now = time.time()
         data = _data(
-            pool={"pool": {"pplns_window": 10}},          # 10 blocks * 10s (Main) = 100s
+            pool={"pool": {"pplns_window": 10}},  # 10 blocks * 10s (Main) = 100s
             shares=[{"ts": now - 5}, {"ts": now - 50}, {"ts": now - 10_000}],
         )
         m = build_metrics(data, _mgr())
@@ -274,8 +322,10 @@ def test_remote_unknown(self, monkeypatch):
 class TestCalculatorInputs:
     def test_pool_and_network_figures(self):
         data = _data(
-            pool={"p2p": {"type": "Mini"},
-                  "pool": {"hashrate": 120_000_000, "difficulty": 250_000_000}},
+            pool={
+                "p2p": {"type": "Mini"},
+                "pool": {"hashrate": 120_000_000, "difficulty": 250_000_000},
+            },
             network={"difficulty": 380_000_000_000, "height": 3210001},
         )
         m = build_metrics(data, _mgr())
@@ -302,11 +352,11 @@ def test_empty_snapshot_does_not_crash(self):
     def test_history_fetched_when_not_passed(self):
         now = time.time()
         sm = _mgr(history=[{"timestamp": now - 10, "v": 500, "v_p2pool": 500, "v_xvb": 0}])
-        m = build_metrics(_data(), sm)   # no history arg -> pulled from state_mgr
+        m = build_metrics(_data(), sm)  # no history arg -> pulled from state_mgr
         sm.get_history.assert_called_once()
         assert m.p2pool_1h == 500.0
 
     def test_passed_history_avoids_refetch(self):
         sm = _mgr()
-        build_metrics(_data(), sm, history=[])   # explicit history -> no get_history call
+        build_metrics(_data(), sm, history=[])  # explicit history -> no get_history call
         sm.get_history.assert_not_called()
diff --git a/build/dashboard/tests/service/test_node_health.py b/build/dashboard/tests/service/test_node_health.py
index 83600eb1..27eee3b2 100644
--- a/build/dashboard/tests/service/test_node_health.py
+++ b/build/dashboard/tests/service/test_node_health.py
@@ -3,6 +3,7 @@
 
 class _Clock:
     """Manually advanced monotonic clock for deterministic debounce tests."""
+
     def __init__(self):
         self.t = 1000.0
 
@@ -15,16 +16,18 @@ def advance(self, secs):
 
 def _monitor(down_after=90, recovery_after=60):
     clock = _Clock()
-    return NodeHealthMonitor(down_after=down_after, recovery_after=recovery_after, clock=clock), clock
+    return NodeHealthMonitor(
+        down_after=down_after, recovery_after=recovery_after, clock=clock
+    ), clock
 
 
 class TestDebounceToDown:
     def test_not_down_before_threshold(self):
         m, clock = _monitor()
-        m.update(True)            # establish ever_up
-        m.update(False)           # outage begins
+        m.update(True)  # establish ever_up
+        m.update(False)  # outage begins
         clock.advance(89)
-        assert m.update(False) is False   # still within debounce window
+        assert m.update(False) is False  # still within debounce window
 
     def test_down_after_threshold(self):
         m, clock = _monitor()
@@ -36,8 +39,10 @@ def test_down_after_threshold(self):
     def test_single_blip_does_not_trip(self):
         m, clock = _monitor()
         m.update(True)
-        clock.advance(5); m.update(False)   # brief blip
-        clock.advance(5); assert m.update(True) is False  # recovered well before 90s
+        clock.advance(5)
+        m.update(False)  # brief blip
+        clock.advance(5)
+        assert m.update(True) is False  # recovered well before 90s
         assert m.down is False
 
 
@@ -56,14 +61,18 @@ class TestRecoveryHysteresis:
     def test_down_clears_only_after_recovery_window(self):
         m, clock = _monitor()
         m.update(True)
-        m.update(False); clock.advance(90); m.update(False)   # now DOWN
+        m.update(False)
+        clock.advance(90)
+        m.update(False)  # now DOWN
         assert m.down is True
         # Node returns, but DOWN holds until reachable for recovery_after.
         m.update(True)
         assert m.down is True and m.healthy is False
-        clock.advance(59); m.update(True)
+        clock.advance(59)
+        m.update(True)
         assert m.down is True
-        clock.advance(1); m.update(True)
+        clock.advance(1)
+        m.update(True)
         assert m.down is False and m.healthy is True
 
     def test_healthy_requires_stable_window_from_unknown(self):
@@ -71,7 +80,7 @@ def test_healthy_requires_stable_window_from_unknown(self):
         # observed the node reachable for the recovery window.
         m, clock = _monitor()
         assert m.update(True) is False
-        assert m.healthy is False        # just came up — not yet confirmed
+        assert m.healthy is False  # just came up — not yet confirmed
         clock.advance(60)
         m.update(True)
         assert m.healthy is True
diff --git a/build/dashboard/tests/service/test_numeric_properties.py b/build/dashboard/tests/service/test_numeric_properties.py
new file mode 100644
index 00000000..f5d408c2
--- /dev/null
+++ b/build/dashboard/tests/service/test_numeric_properties.py
@@ -0,0 +1,112 @@
+"""Property-based tests (#284, hypothesis) for the money/numeric service layer.
+
+These assert *invariants* — non-negativity, conservation, monotonicity, clamp bounds — across a
+wide input range rather than fixed examples, the class of bug example tests miss (cf. the #70
+anti-windup overshoot). Pure functions only; no I/O.
+"""
+
+import math
+from unittest.mock import MagicMock
+
+from hypothesis import given
+from hypothesis import strategies as st
+
+from mining_dashboard.config.config import TIER_DEFAULTS, XVB_TIME_ALGO_MS
+from mining_dashboard.service.algo_service import AlgoService
+from mining_dashboard.service.earnings import xmr_per_hs_day
+from mining_dashboard.service.metrics import _avg_p2pool_over_window, _avg_xvb_over_window
+
+_nonneg = st.floats(min_value=0, max_value=1e18, allow_nan=False, allow_infinity=False)
+_pos = st.floats(min_value=1e-6, max_value=1e15, allow_nan=False, allow_infinity=False)
+
+
+# --------------------------------------------------------------------------- earnings
+@given(reward=_nonneg, diff=_nonneg)
+def test_xmr_per_hs_day_non_negative(reward, diff):
+    assert xmr_per_hs_day(reward, diff) >= 0.0
+
+
+@given(reward=st.floats(max_value=0, allow_nan=False, allow_infinity=False), diff=_nonneg)
+def test_xmr_per_hs_day_zero_on_nonpositive_reward(reward, diff):
+    assert xmr_per_hs_day(reward, diff) == 0.0
+
+
+@given(reward=_pos, diff=_pos, k=st.floats(min_value=0, max_value=1e6, allow_nan=False))
+def test_xmr_per_hs_day_linear_in_reward(reward, diff, k):
+    # Expected earnings are linear in the block reward (the model's defining property).
+    base = xmr_per_hs_day(reward, diff)
+    assert math.isclose(xmr_per_hs_day(k * reward, diff), k * base, rel_tol=1e-9, abs_tol=1e-30)
+
+
+@given(reward=_pos, diff=_pos, bump=_pos)
+def test_xmr_per_hs_day_decreases_with_difficulty(reward, diff, bump):
+    # Higher network difficulty -> a lower per-H/s rate.
+    assert xmr_per_hs_day(reward, diff + bump) <= xmr_per_hs_day(reward, diff)
+
+
+# --------------------------------------------------------------- metrics windowed averages
+@st.composite
+def _in_window_rows(draw):
+    """History rows inside the window, with v == v_p2pool + v_xvb (no legacy fallback)."""
+    hr = st.floats(min_value=0, max_value=1e9, allow_nan=False, allow_infinity=False)
+    rows = []
+    for _ in range(draw(st.integers(min_value=1, max_value=30))):
+        vp, vx = draw(hr), draw(hr)
+        rows.append({"timestamp": 10**12, "v_p2pool": vp, "v_xvb": vx, "v": vp + vx})
+    return rows
+
+
+@given(rows=_in_window_rows())
+def test_window_avgs_non_negative_and_conserve(rows):
+    window = 10**9  # all rows fall inside
+    ap = _avg_p2pool_over_window(rows, window)
+    ax = _avg_xvb_over_window(rows, window)
+    assert ap >= 0.0 and ax >= 0.0
+    # Conservation: with v == vp + vx (no legacy fallback), the routed parts sum to the total avg.
+    avg_v = sum(r["v"] for r in rows) / len(rows)
+    assert math.isclose(ap + ax, avg_v, rel_tol=1e-9, abs_tol=1e-6)
+
+
+@given(window=st.floats(min_value=1, max_value=1e9, allow_nan=False))
+def test_window_avgs_empty_history_is_zero(window):
+    assert _avg_p2pool_over_window([], window) == 0.0
+    assert _avg_xvb_over_window([], window) == 0.0
+
+
+# --------------------------------------------------------------- algo_service clamp / fraction
+def _algo():
+    sm = MagicMock()
+    sm.get_tiers.return_value = dict(TIER_DEFAULTS)
+    return AlgoService(sm, MagicMock(), MagicMock())
+
+
+@given(frac=st.floats(min_value=0, max_value=1, allow_nan=False))
+def test_fraction_to_ms_monotone_and_non_negative(frac):
+    a = _algo()
+    assert a._fraction_to_ms(frac) >= 0
+    # A larger fraction never yields a shorter slice.
+    assert a._fraction_to_ms(frac) <= a._fraction_to_ms(min(frac + 0.1, 1.0))
+
+
+@given(frac=st.floats(max_value=0, allow_nan=False, allow_infinity=False))
+def test_fraction_to_ms_zero_on_nonpositive(frac):
+    assert _algo()._fraction_to_ms(frac) == 0
+
+
+@given(dur=st.floats(min_value=0, max_value=XVB_TIME_ALGO_MS, allow_nan=False))
+def test_routed_fraction_in_unit_interval(dur):
+    assert AlgoService._routed_fraction("XVB", dur) == 1.0
+    assert AlgoService._routed_fraction("P2POOL", dur) == 0.0
+    assert 0.0 <= AlgoService._routed_fraction("SPLIT", dur) <= 1.0
+
+
+@given(
+    current_hr=st.floats(min_value=1, max_value=1e9, allow_nan=False),
+    window=st.floats(min_value=1, max_value=1e6, allow_nan=False),
+    diff=st.floats(min_value=0, max_value=1e15, allow_nan=False),
+)
+def test_max_donation_fraction_within_reserve_bounds(current_hr, window, diff):
+    # The VIP/PPLNS reserve clamp must keep the donatable fraction in [0, the hard cap].
+    a = _algo()
+    f = a._max_donation_fraction(current_hr, window, {"difficulty": diff})
+    assert 0.0 <= f <= a.max_donation_fraction
diff --git a/build/dashboard/tests/service/test_storage_service.py b/build/dashboard/tests/service/test_storage_service.py
index 12b7a5b3..54dc62e9 100644
--- a/build/dashboard/tests/service/test_storage_service.py
+++ b/build/dashboard/tests/service/test_storage_service.py
@@ -3,8 +3,8 @@
 
 import pytest
 
+from mining_dashboard.config.config import HISTORY_RETENTION_SEC, TIER_DEFAULTS
 from mining_dashboard.service.storage_service import StateManager
-from mining_dashboard.config.config import TIER_DEFAULTS, HISTORY_RETENTION_SEC, WORKER_RETENTION_SEC
 
 
 class TestDefaults:
@@ -77,7 +77,7 @@ def test_add_shares_records_count_distinct(self, state_manager):
         state_manager.add_shares(3, ts, 500)
         shares = state_manager.get_shares()
         assert len(shares) == 3
-        assert len({s["ts"] for s in shares}) == 3            # all distinct timestamps
+        assert len({s["ts"] for s in shares}) == 3  # all distinct timestamps
         assert max(s["ts"] for s in shares) == pytest.approx(ts)  # most recent stamped at latest_ts
 
     def test_add_shares_count_zero_or_one(self, state_manager):
@@ -106,14 +106,16 @@ def test_per_window_splits_persisted(self, state_manager):
         # The chart's window toggle (#168): each window's (p2pool, xvb) split is stored in its own
         # column and read back; an omitted window defaults to 0.
         state_manager.update_history(
-            1000, p2pool_hr=1000, xvb_hr=0,
+            1000,
+            p2pool_hr=1000,
+            xvb_hr=0,
             windows={"1m": (900, 0), "1h": (1100, 0), "12h": (50, 0)},  # 24h intentionally omitted
         )
         row = state_manager.get_history()[-1]
         assert (row["v_p2pool_1m"], row["v_xvb_1m"]) == (900, 0)
         assert (row["v_p2pool_1h"], row["v_xvb_1h"]) == (1100, 0)
         assert (row["v_p2pool_12h"], row["v_xvb_12h"]) == (50, 0)
-        assert (row["v_p2pool_24h"], row["v_xvb_24h"]) == (0, 0)   # omitted -> default 0
+        assert (row["v_p2pool_24h"], row["v_xvb_24h"]) == (0, 0)  # omitted -> default 0
 
     def test_per_window_splits_survive_reload(self, tmp_path):
         # Persisted to disk and re-read on a fresh StateManager (load() path), not just in-memory.
@@ -140,26 +142,11 @@ def test_unhealthy_after_write_error(self):
         sm = StateManager(":memory:")
         assert sm.is_db_healthy() is True
         sm._conn.execute("DROP TABLE shares")
-        sm.add_share(time.time(), 500)          # INSERT fails -> caught -> flag flips
+        sm.add_share(time.time(), 500)  # INSERT fails -> caught -> flag flips
         assert sm.is_db_healthy() is False
         sm.close()
 
 
-class TestWorkers:
-    def test_update_and_get_known_workers(self, state_manager):
-        state_manager.update_known_workers([{"name": "rig1", "ip": "10.0.0.1"}])
-        workers = state_manager.get_known_workers()
-        assert workers == [{"name": "rig1", "ip": "10.0.0.1"}]
-
-    def test_worker_without_ip_skipped(self, state_manager):
-        state_manager.update_known_workers([{"name": "rig1"}, {"ip": "10.0.0.2"}])
-        assert state_manager.get_known_workers() == []
-
-    def test_none_list_is_noop(self, state_manager):
-        state_manager.update_known_workers(None)
-        assert state_manager.get_known_workers() == []
-
-
 class TestSnapshot:
     def test_roundtrip(self, state_manager):
         state_manager.save_snapshot({"a": 1, "b": [1, 2, 3]})
@@ -172,25 +159,55 @@ def test_empty_snapshot_not_saved(self, state_manager):
     def test_load_missing_snapshot_returns_none(self, state_manager):
         assert state_manager.load_snapshot() is None
 
+    def test_unserializable_snapshot_flags_persistence_unhealthy(self, state_manager):
+        # A snapshot json.dumps can't serialize (here a set) is a persistent write failure: the
+        # data is lost and will be lost on restart. Like every other write path it must flip
+        # db_healthy so /api/state raises the #131 badge — not log-and-look-green (regression guard
+        # for save_snapshot's TypeError branch that used to call logger.error directly).
+        assert state_manager.is_db_healthy() is True
+        state_manager.save_snapshot({"workers": {1, 2, 3}})  # set -> TypeError in json.dumps
+        assert state_manager.is_db_healthy() is False
+        assert state_manager.load_snapshot() is None  # nothing was persisted
+
     def test_share_stats_persist_across_instances(self, tmp_path):
         # Issue #82: the per-worker share counts and the proxy /summary totals ride along in the
         # latest_data snapshot, so they survive a dashboard restart (the snapshot is what
         # DataService restores on init). Save with one instance, read back with a fresh one.
         db = str(tmp_path / "state.db")
         sm1 = StateManager(db_path=db)
-        sm1.save_snapshot({
-            "workers": [{"name": "rig1", "ip": "10.0.0.1", "status": "online",
-                         "accepted": 1234, "rejected": 5, "invalid": 0}],
-            "proxy_summary": {"accepted": 12345, "rejected": 67, "invalid": 2,
-                              "expired": 1, "best": 9876543},
-        })
+        sm1.save_snapshot(
+            {
+                "workers": [
+                    {
+                        "name": "rig1",
+                        "ip": "10.0.0.1",
+                        "status": "online",
+                        "accepted": 1234,
+                        "rejected": 5,
+                        "invalid": 0,
+                    }
+                ],
+                "proxy_summary": {
+                    "accepted": 12345,
+                    "rejected": 67,
+                    "invalid": 2,
+                    "expired": 1,
+                    "best": 9876543,
+                },
+            }
+        )
         sm1.close()
 
         snap = StateManager(db_path=db).load_snapshot()  # fresh instance -> reads from disk
         assert snap["workers"][0]["accepted"] == 1234
         assert snap["workers"][0]["rejected"] == 5
-        assert snap["proxy_summary"] == {"accepted": 12345, "rejected": 67, "invalid": 2,
-                                         "expired": 1, "best": 9876543}
+        assert snap["proxy_summary"] == {
+            "accepted": 12345,
+            "rejected": 67,
+            "invalid": 2,
+            "expired": 1,
+            "best": 9876543,
+        }
 
 
 class TestPersistenceAndMigration:
@@ -277,26 +294,67 @@ def test_per_window_columns_added_on_upgrade(self, tmp_path):
         now = time.time()
         t1 = time.strftime("%Y-%m-%d %H:%M:%S", time.gmtime(now - 3600))
         conn = sqlite3.connect(db)
-        conn.execute("CREATE TABLE history (t TEXT, v REAL, v_p2pool REAL, v_xvb REAL, timestamp REAL)")
-        conn.execute("INSERT INTO history VALUES (?, ?, ?, ?, ?)", (t1, 800.0, 800.0, 0.0, now - 3600))
+        conn.execute(
+            "CREATE TABLE history (t TEXT, v REAL, v_p2pool REAL, v_xvb REAL, timestamp REAL)"
+        )
+        conn.execute(
+            "INSERT INTO history VALUES (?, ?, ?, ?, ?)", (t1, 800.0, 800.0, 0.0, now - 3600)
+        )
         conn.commit()
         conn.close()
 
         sm = StateManager(db_path=db)
         try:
             cols = {info[1] for info in sm._conn.execute("PRAGMA table_info(history)").fetchall()}
-            for c in ("v_p2pool_1m", "v_xvb_1m", "v_p2pool_1h", "v_xvb_1h",
-                      "v_p2pool_12h", "v_xvb_12h", "v_p2pool_24h", "v_xvb_24h"):
+            for c in (
+                "v_p2pool_1m",
+                "v_xvb_1m",
+                "v_p2pool_1h",
+                "v_xvb_1h",
+                "v_p2pool_12h",
+                "v_xvb_12h",
+                "v_p2pool_24h",
+                "v_xvb_24h",
+            ):
                 assert c in cols, f"migration missing {c}"
             old = sm.get_history()[-1]
-            assert old["v_p2pool"] == 800.0          # original 10m split preserved
-            assert old["v_p2pool_1h"] == 0           # forward-only: no per-window data pre-#168
+            assert old["v_p2pool"] == 800.0  # original 10m split preserved
+            assert old["v_p2pool_1h"] == 0  # forward-only: no per-window data pre-#168
             # a new write after the upgrade fills the per-window columns
             sm.update_history(900, p2pool_hr=900, xvb_hr=0, windows={"1h": (950, 0)})
             assert sm.get_history()[-1]["v_p2pool_1h"] == 950
         finally:
             sm.close()
 
+    def test_orphaned_workers_table_dropped_on_upgrade(self, tmp_path):
+        # Intent (#144): the dead known_workers persistence layer was removed, so opening a DB
+        # that still has its orphaned `workers` table drops it in place — tidying old installs
+        # without touching history/shares/kv. The worker list is now sourced live from the
+        # xmrig-proxy, never from the DB. Also asserts the in-memory state key is gone.
+        db = str(tmp_path / "with_workers.db")
+        conn = sqlite3.connect(db)
+        conn.execute(
+            "CREATE TABLE history (t TEXT, v REAL, v_p2pool REAL, v_xvb REAL, timestamp REAL)"
+        )
+        conn.execute("CREATE TABLE workers (name TEXT PRIMARY KEY, ip TEXT, last_seen REAL)")
+        conn.execute("INSERT INTO workers VALUES (?, ?, ?)", ("rig1", "10.0.0.1", 123.0))
+        conn.commit()
+        conn.close()
+
+        sm = StateManager(db_path=db)  # __init__ runs _migrate_db -> DROP TABLE IF EXISTS workers
+        try:
+            tables = {
+                r[0]
+                for r in sm._conn.execute(
+                    "SELECT name FROM sqlite_master WHERE type='table'"
+                ).fetchall()
+            }
+            assert "workers" not in tables, "orphaned workers table dropped (#144)"
+            assert "known_workers" not in sm.state, "dead known_workers state key removed (#144)"
+            assert {"history", "kv_store", "shares"} <= tables, "core tables left intact"
+        finally:
+            sm.close()
+
 
 class TestRetention:
     """Long-running behavior: history/workers must not grow unbounded. Tests are white-box
@@ -305,10 +363,15 @@ class TestRetention:
     def test_history_older_than_retention_pruned_from_memory(self, state_manager):
         # Intent: appending a fresh sample drops in-memory points older than the 30-day window
         # (the popleft loop), so the deque can't grow without bound on a long-running dashboard.
-        state_manager.state["hashrate_history"].append({
-            "t": "old", "v": 1.0, "v_p2pool": 0, "v_xvb": 0,
-            "timestamp": time.time() - HISTORY_RETENTION_SEC - 3600,  # 30d + 1h ago
-        })
+        state_manager.state["hashrate_history"].append(
+            {
+                "t": "old",
+                "v": 1.0,
+                "v_p2pool": 0,
+                "v_xvb": 0,
+                "timestamp": time.time() - HISTORY_RETENTION_SEC - 3600,  # 30d + 1h ago
+            }
+        )
         assert len(state_manager.get_history()) == 1
         state_manager.update_history(2000.0)  # a fresh sample at "now"
         hist = state_manager.get_history()
@@ -321,22 +384,14 @@ def test_old_history_pruned_from_db_when_cleanup_fires(self, state_manager, monk
         with state_manager._db_lock:
             state_manager._conn.execute(
                 "INSERT INTO history (t, v, v_p2pool, v_xvb, timestamp) VALUES (?,?,?,?,?)",
-                ("old", 1.0, 0, 0, old_ts))
+                ("old", 1.0, 0, 0, old_ts),
+            )
             state_manager._conn.commit()
         monkeypatch.setattr("mining_dashboard.service.storage_service.random.random", lambda: 0.0)
         state_manager.update_history(2000.0)
         with state_manager._db_lock:
             remaining = state_manager._conn.execute(
                 "SELECT COUNT(*) FROM history WHERE timestamp < ?",
-                (time.time() - HISTORY_RETENTION_SEC,)).fetchone()[0]
+                (time.time() - HISTORY_RETENTION_SEC,),
+            ).fetchone()[0]
         assert remaining == 0, "expired DB rows are pruned"
-
-    def test_stale_workers_pruned_after_retention_window(self, state_manager):
-        # Intent: a worker not seen within WORKER_RETENTION_SEC (7d) is dropped when any worker
-        # next checks in — so stale name→IP mappings don't linger and leak memory.
-        state_manager.update_known_workers([{"name": "rig1", "ip": "10.0.0.1"}])
-        # Backdate rig1 so it's now older than the retention window.
-        state_manager.state["known_workers"]["rig1"]["last_seen"] = time.time() - WORKER_RETENTION_SEC - 3600
-        state_manager.update_known_workers([{"name": "rig2", "ip": "10.0.0.2"}])  # a fresh check-in
-        names = {w["name"] for w in state_manager.get_known_workers()}
-        assert "rig2" in names and "rig1" not in names
diff --git a/build/dashboard/tests/service/test_update_checker.py b/build/dashboard/tests/service/test_update_checker.py
index dd6c8431..fb7c716f 100644
--- a/build/dashboard/tests/service/test_update_checker.py
+++ b/build/dashboard/tests/service/test_update_checker.py
@@ -1,10 +1,14 @@
 """Tests for the notify-only new-release check (#224)."""
+
 from unittest.mock import MagicMock, patch
 
 import requests
 
 from mining_dashboard.service.update_checker import (
-    parse_semver, compute_update, GitHubReleaseClient, UpdateChecker,
+    GitHubReleaseClient,
+    UpdateChecker,
+    compute_update,
+    parse_semver,
 )
 
 
@@ -26,11 +30,15 @@ def test_rejects_garbage_partial_and_empty(self):
 class TestComputeUpdate:
     def test_newer_returns_payload(self):
         out = compute_update("0.1.0", "v0.2.0", "https://x/releases/tag/v0.2.0")
-        assert out == {"available": True, "latest": "v0.2.0", "url": "https://x/releases/tag/v0.2.0"}
+        assert out == {
+            "available": True,
+            "latest": "v0.2.0",
+            "url": "https://x/releases/tag/v0.2.0",
+        }
 
     def test_equal_or_older_returns_none(self):
-        assert compute_update("0.2.0", "v0.2.0", "u") is None     # equal
-        assert compute_update("0.2.0", "v0.1.0", "u") is None     # older
+        assert compute_update("0.2.0", "v0.2.0", "u") is None  # equal
+        assert compute_update("0.2.0", "v0.1.0", "u") is None  # older
 
     def test_unparseable_either_side_returns_none(self):
         assert compute_update("0.1.0", "nightly", "u") is None
@@ -38,7 +46,7 @@ def test_unparseable_either_side_returns_none(self):
 
     def test_major_and_minor_ordering(self):
         assert compute_update("1.9.9", "v2.0.0", "u")["latest"] == "v2.0.0"
-        assert compute_update("1.2.0", "v1.10.0", "u")["latest"] == "v1.10.0"   # 10 > 2, not lexical
+        assert compute_update("1.2.0", "v1.10.0", "u")["latest"] == "v1.10.0"  # 10 > 2, not lexical
 
 
 class TestGitHubReleaseClient:
@@ -50,27 +58,38 @@ def _resp(self, status=200, payload=None):
 
     def test_parses_tag_and_url(self):
         c = GitHubReleaseClient("https://api/releases/latest", tor_proxy="socks5h://t:9050")
-        with patch("mining_dashboard.service.update_checker.requests.get",
-                   return_value=self._resp(200, {"tag_name": "v1.4.0", "html_url": "https://h/v1.4.0"})) as g:
+        with patch(
+            "mining_dashboard.service.update_checker.requests.get",
+            return_value=self._resp(200, {"tag_name": "v1.4.0", "html_url": "https://h/v1.4.0"}),
+        ) as g:
             assert c.latest_release() == {"tag": "v1.4.0", "url": "https://h/v1.4.0"}
             # routed through the Tor proxy
-            assert g.call_args.kwargs["proxies"] == {"http": "socks5h://t:9050", "https": "socks5h://t:9050"}
+            assert g.call_args.kwargs["proxies"] == {
+                "http": "socks5h://t:9050",
+                "https": "socks5h://t:9050",
+            }
 
     def test_non_200_is_silent_none(self):
         c = GitHubReleaseClient("u")
-        with patch("mining_dashboard.service.update_checker.requests.get", return_value=self._resp(404)):
+        with patch(
+            "mining_dashboard.service.update_checker.requests.get", return_value=self._resp(404)
+        ):
             assert c.latest_release() is None
 
     def test_network_error_is_silent_none(self):
         c = GitHubReleaseClient("u")
-        with patch("mining_dashboard.service.update_checker.requests.get",
-                   side_effect=requests.RequestException("offline")):
+        with patch(
+            "mining_dashboard.service.update_checker.requests.get",
+            side_effect=requests.RequestException("offline"),
+        ):
             assert c.latest_release() is None
 
     def test_missing_fields_is_none(self):
         c = GitHubReleaseClient("u")
-        with patch("mining_dashboard.service.update_checker.requests.get",
-                   return_value=self._resp(200, {"tag_name": "v1.0.0"})):   # no html_url
+        with patch(
+            "mining_dashboard.service.update_checker.requests.get",
+            return_value=self._resp(200, {"tag_name": "v1.0.0"}),
+        ):  # no html_url
             assert c.latest_release() is None
 
 
@@ -101,15 +120,15 @@ def test_throttles_to_interval(self):
         c = _FakeClient({"tag": "v0.2.0", "url": "u"})
         uc = UpdateChecker(c, "0.1.0", enabled=True, interval=3600)
         uc.maybe_check(1000)
-        uc.maybe_check(1000 + 1800)   # within window -> cached, no network
+        uc.maybe_check(1000 + 1800)  # within window -> cached, no network
         assert c.calls == 1
-        uc.maybe_check(1000 + 3601)   # past window -> network again
+        uc.maybe_check(1000 + 3601)  # past window -> network again
         assert c.calls == 2
 
     def test_failed_fetch_keeps_previous_result(self):
         uc = UpdateChecker(_FakeClient(None), "0.1.0", enabled=True, interval=0)
         uc.result = {"available": True, "latest": "v0.2.0", "url": "u"}
-        assert uc.maybe_check(2000)["latest"] == "v0.2.0"   # a blip must not drop the badge
+        assert uc.maybe_check(2000)["latest"] == "v0.2.0"  # a blip must not drop the badge
 
     def test_up_to_date_yields_none(self):
         uc = UpdateChecker(_FakeClient({"tag": "v0.1.0", "url": "u"}), "0.1.0", enabled=True)
diff --git a/build/dashboard/tests/sim/test_donation_model.py b/build/dashboard/tests/sim/test_donation_model.py
index f6136d6b..98404505 100644
--- a/build/dashboard/tests/sim/test_donation_model.py
+++ b/build/dashboard/tests/sim/test_donation_model.py
@@ -9,21 +9,27 @@
 tier at minimum waste regardless of how XvB scales the donation, never winds up,
 keeps p2pool "VIP", and recovers from disturbances.
 """
+
 import pytest
 
 from mining_dashboard.sim.donation_model import (
-    Scenario,
     CYCLES_PER_DAY,
     CYCLES_PER_HOUR,
-    run_algo,
+    Scenario,
     build_controller,
     make_algo_controller,
+    run_algo,
 )
 
 # A real-ish p2pool-main sidechain difficulty so the VIP reserve is exercised.
 DIFFICULTY = 120_000_000
-FIELD = dict(target_hr=10_000, current_hr=46_300, measurement="fixed",
-             p2pool_difficulty=DIFFICULTY, cycles=3 * CYCLES_PER_DAY)
+FIELD = dict(
+    target_hr=10_000,
+    current_hr=46_300,
+    measurement="fixed",
+    p2pool_difficulty=DIFFICULTY,
+    cycles=3 * CYCLES_PER_DAY,
+)
 
 
 class TestHoldsTierMinimumWaste:
@@ -42,9 +48,14 @@ def test_no_windup_from_cold_start(self):
 
     @pytest.mark.parametrize("current_hr,expected_p2pool", [(46_300, 0.70), (200_000, 0.90)])
     def test_more_headroom_means_more_p2pool(self, current_hr, expected_p2pool):
-        sc = Scenario(name="hr", target_hr=10_000, current_hr=current_hr,
-                      measurement="fixed", p2pool_difficulty=DIFFICULTY,
-                      cycles=3 * CYCLES_PER_DAY)
+        sc = Scenario(
+            name="hr",
+            target_hr=10_000,
+            current_hr=current_hr,
+            measurement="fixed",
+            p2pool_difficulty=DIFFICULTY,
+            cycles=3 * CYCLES_PER_DAY,
+        )
         r = run_algo(sc)
         assert r.tier_held()
         assert r.p2pool_efficiency >= expected_p2pool
@@ -55,9 +66,15 @@ class TestSelfCalibration:
 
     @pytest.mark.parametrize("k", [0.8, 1.0, 2.0, 3.0])
     def test_holds_tier_across_credit_factor(self, k):
-        sc = Scenario(name=f"k{k}", target_hr=10_000, current_hr=46_300,
-                      measurement="fixed", credit_factor=k, p2pool_difficulty=DIFFICULTY,
-                      cycles=4 * CYCLES_PER_DAY)
+        sc = Scenario(
+            name=f"k{k}",
+            target_hr=10_000,
+            current_hr=46_300,
+            measurement="fixed",
+            credit_factor=k,
+            p2pool_difficulty=DIFFICULTY,
+            cycles=4 * CYCLES_PER_DAY,
+        )
         r = run_algo(sc)
         assert r.tier_held()
         assert r.steady_overshoot_24h <= 1.12  # no k-x waste — the loop backs off
@@ -65,21 +82,44 @@ def test_holds_tier_across_credit_factor(self, k):
     def test_overcredit_frees_p2pool(self):
         """When XvB over-credits, holding the tier needs *less* donation, so more
         hashrate stays on p2pool — the open-loop designs can't do this."""
-        lo = run_algo(Scenario(name="k1", target_hr=10_000, current_hr=46_300,
-                               measurement="fixed", credit_factor=1.0,
-                               p2pool_difficulty=DIFFICULTY, cycles=4 * CYCLES_PER_DAY))
-        hi = run_algo(Scenario(name="k3", target_hr=10_000, current_hr=46_300,
-                               measurement="fixed", credit_factor=3.0,
-                               p2pool_difficulty=DIFFICULTY, cycles=4 * CYCLES_PER_DAY))
+        lo = run_algo(
+            Scenario(
+                name="k1",
+                target_hr=10_000,
+                current_hr=46_300,
+                measurement="fixed",
+                credit_factor=1.0,
+                p2pool_difficulty=DIFFICULTY,
+                cycles=4 * CYCLES_PER_DAY,
+            )
+        )
+        hi = run_algo(
+            Scenario(
+                name="k3",
+                target_hr=10_000,
+                current_hr=46_300,
+                measurement="fixed",
+                credit_factor=3.0,
+                p2pool_difficulty=DIFFICULTY,
+                cycles=4 * CYCLES_PER_DAY,
+            )
+        )
         assert hi.p2pool_efficiency > lo.p2pool_efficiency + 0.05
 
     @pytest.mark.parametrize("semantics", ["fixed", "connected"])
     def test_stable_under_lag(self, semantics):
         """Low gain keeps the integrator stable even with API reporting lag (the
         harness found that higher gains hunt)."""
-        sc = Scenario(name="lag", target_hr=10_000, current_hr=46_300,
-                      measurement=semantics, report_lag_cycles=6, credit_factor=2.0,
-                      p2pool_difficulty=DIFFICULTY, cycles=5 * CYCLES_PER_DAY)
+        sc = Scenario(
+            name="lag",
+            target_hr=10_000,
+            current_hr=46_300,
+            measurement=semantics,
+            report_lag_cycles=6,
+            credit_factor=2.0,
+            p2pool_difficulty=DIFFICULTY,
+            cycles=5 * CYCLES_PER_DAY,
+        )
         r = run_algo(sc)
         assert r.tier_held()
         last_day = r.credited_1h[-CYCLES_PER_DAY:]
@@ -98,9 +138,14 @@ def test_low_tier_high_difficulty_caps_donation_for_vip(self):
         """With a high sidechain difficulty relative to hashrate, the reserve must
         bite — donation is capped so p2pool still lands shares."""
         # Difficulty needing ~half the rig on p2pool to keep ~2 shares/window.
-        sc = Scenario(name="tightvip", target_hr=10_000, current_hr=46_300,
-                      measurement="fixed", p2pool_difficulty=300_000_000,
-                      cycles=3 * CYCLES_PER_DAY)
+        sc = Scenario(
+            name="tightvip",
+            target_hr=10_000,
+            current_hr=46_300,
+            measurement="fixed",
+            p2pool_difficulty=300_000_000,
+            cycles=3 * CYCLES_PER_DAY,
+        )
         r = run_algo(sc)
         assert r.vip_held()
         assert max(r.fraction) <= build_controller().max_donation_fraction + 1e-9
@@ -126,10 +171,18 @@ class TestDisturbanceRecovery:
     def test_recovers_after_worker_drop(self):
         """A sustained drop below tier capacity knocks the averages down; once
         hashrate returns the loop ramps back and re-qualifies by the end."""
-        sc = Scenario(name="drop", target_hr=10_000, current_hr=46_300, warm_avg=10_300,
-                      measurement="fixed", p2pool_difficulty=DIFFICULTY,
-                      cycles=4 * CYCLES_PER_DAY,
-                      drop_at=CYCLES_PER_DAY, drop_until=CYCLES_PER_DAY + 18, drop_factor=0.2)
+        sc = Scenario(
+            name="drop",
+            target_hr=10_000,
+            current_hr=46_300,
+            warm_avg=10_300,
+            measurement="fixed",
+            p2pool_difficulty=DIFFICULTY,
+            cycles=4 * CYCLES_PER_DAY,
+            drop_at=CYCLES_PER_DAY,
+            drop_until=CYCLES_PER_DAY + 18,
+            drop_factor=0.2,
+        )
         r = run_algo(sc)
         # Re-qualified on the 1h average by the final cycles (24h lags a full day).
         assert min(r.credited_1h[-CYCLES_PER_HOUR:]) >= sc.target_hr * 0.98
diff --git a/build/dashboard/tests/sim/test_donation_model_properties.py b/build/dashboard/tests/sim/test_donation_model_properties.py
new file mode 100644
index 00000000..559b28dc
--- /dev/null
+++ b/build/dashboard/tests/sim/test_donation_model_properties.py
@@ -0,0 +1,46 @@
+"""Property-based tests (#284, hypothesis) for the XvB donation-controller simulator.
+
+The closed-loop controller (Issue #70) must never *wind up*: whatever the rig hashrate, tier
+target, measurement semantics, crediting, or report lag, the donated fraction stays clamped to
+[0, 1] every cycle — so p2pool efficiency stays in [0, 1] and the credited rate stays non-negative.
+Asserting this over randomized scenarios catches the overshoot class of bug that the fixed-example
+tests in test_donation_model.py can't.
+"""
+
+from hypothesis import given, settings
+from hypothesis import strategies as st
+
+from mining_dashboard.sim.donation_model import CYCLES_PER_DAY, Scenario, run_algo
+
+_hr = st.floats(min_value=1e3, max_value=1e7, allow_nan=False, allow_infinity=False)
+
+
+@settings(max_examples=50, deadline=None)
+@given(
+    target_hr=_hr,
+    current_hr=_hr,
+    warm_avg=st.floats(min_value=0, max_value=1e7, allow_nan=False),
+    measurement=st.sampled_from(["fixed", "connected"]),
+    credit_factor=st.floats(min_value=0.5, max_value=2.0, allow_nan=False),
+    report_lag=st.integers(min_value=0, max_value=6),
+)
+def test_controller_never_winds_up(
+    target_hr, current_hr, warm_avg, measurement, credit_factor, report_lag
+):
+    result = run_algo(
+        Scenario(
+            name="prop",
+            target_hr=target_hr,
+            current_hr=current_hr,
+            cycles=2 * CYCLES_PER_DAY,  # 2 days — reaches steady state, stays fast
+            warm_avg=warm_avg,
+            measurement=measurement,
+            credit_factor=credit_factor,
+            report_lag_cycles=report_lag,
+        )
+    )
+    # Anti-windup (#70): the donated fraction is clamped to [0, 1] every cycle ...
+    assert all(0.0 <= f <= 1.0 for f in result.fraction)
+    # ... so the derived steady-state efficiency and the credited rate stay sane.
+    assert 0.0 <= result.p2pool_efficiency <= 1.0
+    assert all(c >= 0.0 for c in result.credited)
diff --git a/build/dashboard/tests/test_version.py b/build/dashboard/tests/test_version.py
index 9113aee9..b2108fa6 100644
--- a/build/dashboard/tests/test_version.py
+++ b/build/dashboard/tests/test_version.py
@@ -4,6 +4,7 @@
 badge renders. A clean release must show ``vX.Y.Z``; anything else must show an unmistakable
 dev indicator (branch + short hash) so a working-tree build is never read as a release.
 """
+
 from mining_dashboard.version import resolve_version
 
 
@@ -18,25 +19,40 @@ def test_leading_v_in_version_is_not_doubled(self):
 
     def test_explicit_release_flag_wins_over_git_metadata(self):
         # The (future) release pipeline can force a release even with git info present.
-        info = resolve_version({
-            "PITHEAD_VERSION": "1.3.0", "PITHEAD_RELEASE": "1",
-            "PITHEAD_GIT_BRANCH": "main", "PITHEAD_GIT_COMMIT": "a1b2c3d",
-        })
+        info = resolve_version(
+            {
+                "PITHEAD_VERSION": "1.3.0",
+                "PITHEAD_RELEASE": "1",
+                "PITHEAD_GIT_BRANCH": "main",
+                "PITHEAD_GIT_COMMIT": "a1b2c3d",
+            }
+        )
         assert info["text"] == "v1.3.0"
         assert info["dev"] is False
 
     def test_release_flag_accepts_common_truthy_spellings(self):
         for val in ("1", "true", "TRUE", "yes", "on"):
-            assert resolve_version({"PITHEAD_VERSION": "1.0.0", "PITHEAD_RELEASE": val,
-                                    "PITHEAD_GIT_COMMIT": "deadbee"})["dev"] is False
+            assert (
+                resolve_version(
+                    {
+                        "PITHEAD_VERSION": "1.0.0",
+                        "PITHEAD_RELEASE": val,
+                        "PITHEAD_GIT_COMMIT": "deadbee",
+                    }
+                )["dev"]
+                is False
+            )
 
 
 class TestDev:
     def test_branch_and_commit(self):
-        info = resolve_version({
-            "PITHEAD_VERSION": "1.3.0",
-            "PITHEAD_GIT_BRANCH": "feature/x", "PITHEAD_GIT_COMMIT": "a1b2c3d",
-        })
+        info = resolve_version(
+            {
+                "PITHEAD_VERSION": "1.3.0",
+                "PITHEAD_GIT_BRANCH": "feature/x",
+                "PITHEAD_GIT_COMMIT": "a1b2c3d",
+            }
+        )
         assert info["text"] == "dev · feature/x @ a1b2c3d"
         assert info["dev"] is True
         assert "feature/x" in info["title"] and "a1b2c3d" in info["title"]
@@ -49,7 +65,9 @@ def test_branch_only(self):
 
     def test_dirty_marker_passes_through(self):
         # render_env appends -dirty for uncommitted changes; it must reach the badge verbatim.
-        info = resolve_version({"PITHEAD_GIT_BRANCH": "main", "PITHEAD_GIT_COMMIT": "a1b2c3d-dirty"})
+        info = resolve_version(
+            {"PITHEAD_GIT_BRANCH": "main", "PITHEAD_GIT_COMMIT": "a1b2c3d-dirty"}
+        )
         assert info["text"] == "dev · main @ a1b2c3d-dirty"
         assert info["dev"] is True
 
@@ -65,6 +83,7 @@ def test_no_metadata_falls_back_to_generic_dev(self):
         assert info == {"text": "dev build", "title": "Development build", "dev": True}
 
     def test_blank_values_treated_as_absent(self):
-        info = resolve_version({"PITHEAD_VERSION": "  ", "PITHEAD_GIT_BRANCH": "",
-                                "PITHEAD_GIT_COMMIT": "  "})
+        info = resolve_version(
+            {"PITHEAD_VERSION": "  ", "PITHEAD_GIT_BRANCH": "", "PITHEAD_GIT_COMMIT": "  "}
+        )
         assert info["text"] == "dev build"
diff --git a/build/dashboard/tests/web/test_server.py b/build/dashboard/tests/web/test_server.py
index 74dfbc7a..078eac9b 100644
--- a/build/dashboard/tests/web/test_server.py
+++ b/build/dashboard/tests/web/test_server.py
@@ -2,9 +2,8 @@
 
 import pytest
 
-from mining_dashboard.web.server import create_app, _apply_security_headers
 from mining_dashboard.service.storage_service import StateManager
-
+from mining_dashboard.web.server import _apply_security_headers, create_app
 
 SECURITY_HEADERS = [
     "X-Content-Type-Options",
@@ -43,7 +42,7 @@ async def test_index_serves_shell(self, client):
         body = await resp.text()
         # Static shell: no data, just the app mount point + the module entry.
         assert 'id="app"' in body
-        assert '/static/dashboard.js' in body
+        assert "/static/dashboard.js" in body
 
 
 class TestStateApi:
@@ -79,12 +78,17 @@ async def test_window_filters_history_end_to_end(self, aiohttp_client):
         base = 1_000_000
         for i in range(20):
             sm.state["hashrate_history"].append(
-                {"t": "x", "v": 100, "v_p2pool": 100, "v_xvb": 0, "timestamp": base + i * 60})
-        data = {"shares": [], "workers": [], "global_sync": False,
-                "monero_sync": {"percent": 100, "current": 1, "target": 1},
-                "tari_sync": {"percent": 100, "current": 1, "target": 1}}
+                {"t": "x", "v": 100, "v_p2pool": 100, "v_xvb": 0, "timestamp": base + i * 60}
+            )
+        data = {
+            "shares": [],
+            "workers": [],
+            "global_sync": False,
+            "monero_sync": {"percent": 100, "current": 1, "target": 1},
+            "tari_sync": {"percent": 100, "current": 1, "target": 1},
+        }
         cli = await aiohttp_client(create_app(sm, data))
-        resp = await cli.get(f"/api/state?from={base + 300}&to={base + 540}")   # indices 5..9
+        resp = await cli.get(f"/api/state?from={base + 300}&to={base + 540}")  # indices 5..9
         body = await resp.json()
         sm.close()
         pts = [p for p in body["chart"]["p2pool"] if p["y"] is not None]
@@ -94,7 +98,9 @@ async def test_window_filters_history_end_to_end(self, aiohttp_client):
     async def test_node_down_badges_in_state(self, aiohttp_client):
         # When a node is down / workers rejected, the state surfaces it (Issue #31).
         data = {
-            "shares": [], "workers": [], "global_sync": False,
+            "shares": [],
+            "workers": [],
+            "global_sync": False,
             "monero_sync": {"percent": 100, "current": 10, "target": 10, "down": True},
             "tari_sync": {"percent": 100, "current": 10, "target": 10, "down": False},
             "workers_rejected": True,
@@ -110,7 +116,9 @@ async def test_node_down_badges_in_state(self, aiohttp_client):
     async def test_passive_tari_badge_in_state(self, aiohttp_client):
         # Non-blocking Tari (Issue #51): operational, with a top-bar "Tari syncing" badge.
         data = {
-            "shares": [], "workers": [], "global_sync": False,
+            "shares": [],
+            "workers": [],
+            "global_sync": False,
             "monero_sync": {"percent": 100, "current": 10, "target": 10},
             "tari_sync": {"percent": 42, "current": 42, "target": 100},
             "tari_syncing_passive": True,
@@ -130,8 +138,8 @@ async def test_state_error_is_sanitized_json(self, aiohttp_client, app_data):
         assert resp.status == 500
         body = await resp.json()
         assert "error" in body
-        assert "SECRET internal detail" not in str(body)        # no leak
-        assert "X-Frame-Options" in resp.headers                 # headers still applied
+        assert "SECRET internal detail" not in str(body)  # no leak
+        assert "X-Frame-Options" in resp.headers  # headers still applied
 
 
 class TestSecurityHeaders:
@@ -169,6 +177,7 @@ def test_js_mimetypes_registered(self):
         # Importing server registers these so .mjs/.js always serve as JS, even on slim
         # images with no /etc/mime.types (browsers refuse non-JS MIME for modules).
         import mimetypes
+
         assert "javascript" in (mimetypes.guess_type("app.mjs")[0] or "")
         assert "javascript" in (mimetypes.guess_type("app.js")[0] or "")
 
diff --git a/build/dashboard/tests/web/test_views.py b/build/dashboard/tests/web/test_views.py
index 33b80f08..8d477984 100644
--- a/build/dashboard/tests/web/test_views.py
+++ b/build/dashboard/tests/web/test_views.py
@@ -5,6 +5,7 @@
 tested in tests/service/test_metrics.py; here we test the *display* mapping (formatting +
 presentation tokens), the chart series (Issue #65), and the full ``build_state`` contract.
 """
+
 import json
 import time
 from dataclasses import replace
@@ -13,32 +14,72 @@
 import pytest
 
 import mining_dashboard.web.views as views
-from mining_dashboard.web.views import (
-    build_chart, build_hashrate, build_pool_network, build_workers, build_tari,
-    build_system, build_sync, build_badges, build_earnings, build_state, build_raffle_eligibility, get_shell_html,
-    _mode_palette, parse_window, _target_points, _chart_tension,
-    build_proxy_summary, _reject_flag, host_display_addr, canonical_window,
-)
+from mining_dashboard.config import config as egress_config
 from mining_dashboard.config.config import DEFAULT_HASHRATE_WINDOW, HASHRATE_WINDOWS
 from mining_dashboard.service.metrics import Metrics, SyncMetric, _sync_metric
-
+from mining_dashboard.web.views import (
+    _chart_tension,
+    _mode_palette,
+    _reject_flag,
+    _target_points,
+    build_badges,
+    build_chart,
+    build_earnings,
+    build_hashrate,
+    build_pool_network,
+    build_proxy_summary,
+    build_raffle_eligibility,
+    build_state,
+    build_sync,
+    build_system,
+    build_tari,
+    build_workers,
+    canonical_window,
+    get_shell_html,
+    host_display_addr,
+    parse_window,
+)
 
 # --- Metrics fixtures for the presentation builders -----------------------------------
 
-_SYNC_DONE = SyncMetric(percent=100, current=10, target=10, remaining=0,
-                        has_target=True, done=True, down=False)
+_SYNC_DONE = SyncMetric(
+    percent=100, current=10, target=10, remaining=0, has_target=True, done=True, down=False
+)
 
 _BASE = Metrics(
-    total_h15=10500.0, p2pool_1h=8000.0, p2pool_24h=8100.0, xvb_1h=2100.0, xvb_24h=2300.0,
-    xvb_routed_1h=2000.0, xvb_routed_24h=2050.0,
-    stratum_h15=10300.0, stratum_h1h=10400.0, stratum_h24h=10200.0,
-    mode="P2POOL", xvb_enabled=True, current_tier="Donor (1.00 kH/s+)",
-    target_tier="Donor (1.00 kH/s+)", target_threshold=1000.0, target_sustainable=True,
-    low_hr_warning=False, xvb_fail_count=0, xvb_last_update=0,
-    workers_online=2, workers_total=3, shares_in_window=5, pplns_window=2160, block_time=10,
-    pool_type="Mini", pool_hashrate=120_000_000.0, pool_difficulty=250_000_000.0,
-    network_difficulty=380_000_000_000.0, network_height=3210001,
-    global_syncing=False, monero=_SYNC_DONE, tari=_SYNC_DONE, monero_mode="Unknown",
+    total_h15=10500.0,
+    p2pool_1h=8000.0,
+    p2pool_24h=8100.0,
+    xvb_1h=2100.0,
+    xvb_24h=2300.0,
+    xvb_routed_1h=2000.0,
+    xvb_routed_24h=2050.0,
+    stratum_h15=10300.0,
+    stratum_h1h=10400.0,
+    stratum_h24h=10200.0,
+    mode="P2POOL",
+    xvb_enabled=True,
+    current_tier="Donor (1.00 kH/s+)",
+    target_tier="Donor (1.00 kH/s+)",
+    target_threshold=1000.0,
+    target_sustainable=True,
+    low_hr_warning=False,
+    xvb_fail_count=0,
+    xvb_last_update=0,
+    workers_online=2,
+    workers_total=3,
+    shares_in_window=5,
+    pplns_window=2160,
+    block_time=10,
+    pool_type="Mini",
+    pool_hashrate=120_000_000.0,
+    pool_difficulty=250_000_000.0,
+    network_difficulty=380_000_000_000.0,
+    network_height=3210001,
+    global_syncing=False,
+    monero=_SYNC_DONE,
+    tari=_SYNC_DONE,
+    monero_mode="Unknown",
     tari_mining=True,
 )
 
@@ -58,28 +99,42 @@ def _hashrate(metrics):
 
 # --- Chart (Issue #65: real-time x-axis, outage gaps as breaks) -----------------------
 
+
 class TestChart:
     def _line(self, n, start_ts, step=30):
-        return [{"timestamp": start_ts + i * step, "v": 100 + i, "v_p2pool": 100 + i,
-                 "v_xvb": 0, "t": "x"} for i in range(n)]
+        return [
+            {
+                "timestamp": start_ts + i * step,
+                "v": 100 + i,
+                "v_p2pool": 100 + i,
+                "v_xvb": 0,
+                "t": "x",
+            }
+            for i in range(n)
+        ]
 
     def test_point_shape_is_xy_with_epoch_ms(self):
-        chart = build_chart([{"timestamp": 1000, "v": 800, "v_p2pool": 500, "v_xvb": 300, "t": "a"}],
-                            [], "all")
+        chart = build_chart(
+            [{"timestamp": 1000, "v": 800, "v_p2pool": 500, "v_xvb": 300, "t": "a"}], [], "all"
+        )
         assert chart["p2pool"] == [{"x": 1_000_000, "y": 500}]
         assert chart["xvb"] == [{"x": 1_000_000, "y": 300}]
 
     def test_legacy_rows_attributed_to_p2pool(self):
-        chart = build_chart([{"timestamp": 1, "v": 800, "v_p2pool": 0, "v_xvb": 0, "t": "a"}], [], "all")
+        chart = build_chart(
+            [{"timestamp": 1, "v": 800, "v_p2pool": 0, "v_xvb": 0, "t": "a"}], [], "all"
+        )
         assert chart["p2pool"][0]["y"] == 800
         assert chart["xvb"][0]["y"] == 0
 
     def test_range_filtering(self):
         now = time.time()
-        history = [{"timestamp": now - 7200, "v": 1, "v_p2pool": 1, "v_xvb": 0, "t": "x"},
-                   {"timestamp": now - 60, "v": 2, "v_p2pool": 2, "v_xvb": 0, "t": "x"}]
+        history = [
+            {"timestamp": now - 7200, "v": 1, "v_p2pool": 1, "v_xvb": 0, "t": "x"},
+            {"timestamp": now - 60, "v": 2, "v_p2pool": 2, "v_xvb": 0, "t": "x"},
+        ]
         chart = build_chart(history, [], "1h")
-        assert len(chart["p2pool"]) == 1   # the 2h-old point is dropped
+        assert len(chart["p2pool"]) == 1  # the 2h-old point is dropped
 
     def test_downsampling_caps_points(self):
         now = time.time()
@@ -93,12 +148,15 @@ def test_outage_inserts_null_break(self):
         # 10 regular 30s samples, a 2-hour outage, then 5 more.
         hist = self._line(10, 1_000_000)
         t = hist[-1]["timestamp"] + 7200
-        hist += [{"timestamp": t + i * 30, "v": 200, "v_p2pool": 200, "v_xvb": 0, "t": "x"} for i in range(5)]
+        hist += [
+            {"timestamp": t + i * 30, "v": 200, "v_p2pool": 200, "v_xvb": 0, "t": "x"}
+            for i in range(5)
+        ]
         chart = build_chart(hist, [], "all")
         nulls = [p for p in chart["p2pool"] if p["y"] is None]
-        assert len(nulls) == 1                                  # exactly one break, in the gap
+        assert len(nulls) == 1  # exactly one break, in the gap
         xs = [p["x"] for p in chart["p2pool"]]
-        assert xs == sorted(xs)                                 # still chronological
+        assert xs == sorted(xs)  # still chronological
         # both series break at the same place
         assert sum(1 for p in chart["xvb"] if p["y"] is None) == 1
 
@@ -119,7 +177,10 @@ def test_break_sits_inside_the_gap(self):
         # the empty span, making the gap visible) — not at an endpoint.
         hist = self._line(5, 1_000_000)
         t = hist[-1]["timestamp"] + 7200
-        hist += [{"timestamp": t + i * 30, "v": 200, "v_p2pool": 200, "v_xvb": 0, "t": "x"} for i in range(5)]
+        hist += [
+            {"timestamp": t + i * 30, "v": 200, "v_p2pool": 200, "v_xvb": 0, "t": "x"}
+            for i in range(5)
+        ]
         pts = build_chart(hist, [], "all")["p2pool"]
         i = next(k for k, p in enumerate(pts) if p["y"] is None)
         assert pts[i - 1]["x"] < pts[i]["x"] < pts[i + 1]["x"]
@@ -135,14 +196,16 @@ def test_downsampled_outage_still_breaks(self):
         # The real #65 scenario: a long range that gets downsampled, with an outage in it. The
         # break must survive downsampling (gap detected on the post-downsample timestamps).
         now = time.time()
-        hist = self._line(1000, now - 100000, step=30)            # dense, will downsample
-        gap_start = hist[-1]["timestamp"] + 6 * 3600              # 6h outage
+        hist = self._line(1000, now - 100000, step=30)  # dense, will downsample
+        gap_start = hist[-1]["timestamp"] + 6 * 3600  # 6h outage
         hist += self._line(1000, gap_start, step=30)
         chart = build_chart(hist, [], "all")
         assert any(p["y"] is None for p in chart["p2pool"])
 
     def test_single_point_no_break(self):
-        chart = build_chart([{"timestamp": 1, "v": 5, "v_p2pool": 5, "v_xvb": 0, "t": "a"}], [], "all")
+        chart = build_chart(
+            [{"timestamp": 1, "v": 5, "v_p2pool": 5, "v_xvb": 0, "t": "a"}], [], "all"
+        )
         assert len(chart["p2pool"]) == 1
 
     def test_share_points_sparse_and_top_pinned(self):
@@ -152,21 +215,29 @@ def test_share_points_sparse_and_top_pinned(self):
             {"timestamp": 1000, "v": 500, "v_p2pool": 500, "v_xvb": 0, "t": "a"},
             {"timestamp": 1030, "v": 600, "v_p2pool": 600, "v_xvb": 0, "t": "b"},
         ]
-        shares = [{"ts": 1001}, {"ts": 1029}]   # one near each sample
+        shares = [{"ts": 1001}, {"ts": 1029}]  # one near each sample
         pts = build_chart(history, shares, "all")["shares"]
         assert pts == [
-            {"x": 1_000_000, "y": 0.93, "r": 9, "c": 1},   # fixed top position, radius 6+3
+            {"x": 1_000_000, "y": 0.93, "r": 9, "c": 1},  # fixed top position, radius 6+3
             {"x": 1_030_000, "y": 0.93, "r": 9, "c": 1},
         ]
 
     def test_share_marker_top_pinned_when_value_zero(self):
         # Same fixed position even at zero hashrate — the marker stays visible without a floor hack.
-        pts = build_chart([{"timestamp": 1000, "v": 0, "v_p2pool": 0, "v_xvb": 0, "t": "a"}],
-                          [{"ts": 1000}], "all")["shares"]
+        pts = build_chart(
+            [{"timestamp": 1000, "v": 0, "v_p2pool": 0, "v_xvb": 0, "t": "a"}],
+            [{"ts": 1000}],
+            "all",
+        )["shares"]
         assert pts == [{"x": 1_000_000, "y": 0.93, "r": 9, "c": 1}]
 
     def test_no_shares_no_points(self):
-        assert build_chart([{"timestamp": 1, "v": 5, "v_p2pool": 5, "v_xvb": 0, "t": "a"}], [], "all")["shares"] == []
+        assert (
+            build_chart([{"timestamp": 1, "v": 5, "v_p2pool": 5, "v_xvb": 0, "t": "a"}], [], "all")[
+                "shares"
+            ]
+            == []
+        )
 
     def test_unknown_range_keeps_everything(self):
         # An unrecognized range value falls through to "no filtering" (same as 'all').
@@ -181,10 +252,10 @@ def test_empty_history(self):
 
     def test_custom_window_filters_both_bounds(self):
         # A preset bounds only the lower end; a custom window clips BOTH ends.
-        hist = self._line(10, 1000)   # timestamps 1000..1270 (step 30)
+        hist = self._line(10, 1000)  # timestamps 1000..1270 (step 30)
         chart = build_chart(hist, [], "all", window=(1060, 1150))
         xs = [p["x"] for p in chart["p2pool"]]
-        assert xs == [1060_000, 1090_000, 1120_000, 1150_000]   # only ts in [1060, 1150]
+        assert xs == [1060_000, 1090_000, 1120_000, 1150_000]  # only ts in [1060, 1150]
 
     def test_window_overrides_range(self):
         # When both a window and a range are given, the window wins.
@@ -195,7 +266,7 @@ def test_window_overrides_range(self):
     def test_short_window_kept_at_native_resolution(self):
         # A <=1h window is never downsampled — full 30s detail (the "more detail zoomed in" goal).
         now = time.time()
-        hist = self._line(120, now - 119 * 30, step=30)   # ~1h of 30s samples, ending now
+        hist = self._line(120, now - 119 * 30, step=30)  # ~1h of 30s samples, ending now
         chart = build_chart(hist, [], "1h")
         assert len([p for p in chart["p2pool"] if p["y"] is not None]) == 120
 
@@ -206,11 +277,11 @@ def test_long_window_downsamples_to_tier(self):
         assert len([p for p in chart["p2pool"] if p["y"] is not None]) <= 600
 
     def test_target_points_tiers(self):
-        assert _target_points(3600) == 0          # <= 1h: native
-        assert _target_points(3601) == 360        # <= 6h
-        assert _target_points(86400) == 480       # <= 24h
-        assert _target_points(604800) == 600      # <= 1w
-        assert _target_points(604801) == 700      # > 1w
+        assert _target_points(3600) == 0  # <= 1h: native
+        assert _target_points(3601) == 360  # <= 6h
+        assert _target_points(86400) == 480  # <= 24h
+        assert _target_points(604800) == 600  # <= 1w
+        assert _target_points(604801) == 700  # > 1w
         assert _target_points(30 * 86400) == 700  # ceiling
 
     def test_chart_tension_tiers(self):
@@ -227,26 +298,28 @@ def test_stacked_series_sum_to_the_total(self):
         # Guard that invariant on the emitted points so a future data change can't silently
         # break the stack (Issue #47).
         hist = [
-            {"timestamp": 1000, "v": 500, "v_p2pool": 500, "v_xvb": 0, "t": "a"},   # P2Pool sample
-            {"timestamp": 1030, "v": 700, "v_p2pool": 0, "v_xvb": 700, "t": "b"},   # XvB sample
+            {"timestamp": 1000, "v": 500, "v_p2pool": 500, "v_xvb": 0, "t": "a"},  # P2Pool sample
+            {"timestamp": 1030, "v": 700, "v_p2pool": 0, "v_xvb": 700, "t": "b"},  # XvB sample
             {"timestamp": 1060, "v": 600, "v_p2pool": 600, "v_xvb": 0, "t": "c"},
         ]
         chart = build_chart(hist, [], "all")
-        for p2p, xvb, row in zip(chart["p2pool"], chart["xvb"], hist):
-            assert p2p["y"] + xvb["y"] == row["v"]      # stack top == total at every point
+        for p2p, xvb, row in zip(chart["p2pool"], chart["xvb"], hist, strict=False):
+            assert p2p["y"] + xvb["y"] == row["v"]  # stack top == total at every point
 
     def test_zoom_reveals_more_detail(self):
         # Core intent (Issue #47): zooming into a sub-window shows finer data than the wide view
         # of the same history. 8h of dense 30s samples — a ~1h window stays native resolution
         # while the full 8h downsamples, so the narrow window has more points per hour.
         now = time.time()
-        dense = self._line(960, now - 8 * 3600, step=30)          # 8h @ 30s
+        dense = self._line(960, now - 8 * 3600, step=30)  # 8h @ 30s
         wide = build_chart(dense, [], "all", window=(dense[0]["timestamp"], dense[-1]["timestamp"]))
-        narrow = build_chart(dense, [], "all", window=(dense[-120]["timestamp"], dense[-1]["timestamp"]))
+        narrow = build_chart(
+            dense, [], "all", window=(dense[-120]["timestamp"], dense[-1]["timestamp"])
+        )
         wide_pts = len([p for p in wide["p2pool"] if p["y"] is not None])
         narrow_pts = len([p for p in narrow["p2pool"] if p["y"] is not None])
-        assert narrow_pts == 120                                  # 1h window: native, untouched
-        assert narrow_pts / 1 > wide_pts / 8                      # more points per hour zoomed in
+        assert narrow_pts == 120  # 1h window: native, untouched
+        assert narrow_pts / 1 > wide_pts / 8  # more points per hour zoomed in
 
     def test_all_range_adapts_density_to_data_extent(self):
         # With "all" (no preset length, no window) the adaptive density keys off the actual data
@@ -263,18 +336,37 @@ class TestChartWindow:
 
     def _row(self):
         # One row carrying both the original 10m split and the per-window columns.
-        return {"timestamp": 1000, "t": "a", "v": 1000, "v_p2pool": 1000, "v_xvb": 0,
-                "v_p2pool_1m": 900, "v_xvb_1m": 0, "v_p2pool_1h": 1100, "v_xvb_1h": 0,
-                "v_p2pool_12h": 50, "v_xvb_12h": 0, "v_p2pool_24h": 10, "v_xvb_24h": 0}
+        return {
+            "timestamp": 1000,
+            "t": "a",
+            "v": 1000,
+            "v_p2pool": 1000,
+            "v_xvb": 0,
+            "v_p2pool_1m": 900,
+            "v_xvb_1m": 0,
+            "v_p2pool_1h": 1100,
+            "v_xvb_1h": 0,
+            "v_p2pool_12h": 50,
+            "v_xvb_12h": 0,
+            "v_p2pool_24h": 10,
+            "v_xvb_24h": 0,
+        }
 
     def test_default_window_is_10m(self):
         # No avg_window arg -> the original v_p2pool/v_xvb pair (today's headline series).
         chart = build_chart([self._row()], [], "all")
         assert chart["p2pool"][0]["y"] == 1000
 
-    @pytest.mark.parametrize("win,expected", [
-        ("1m", 900), ("10m", 1000), ("1h", 1100), ("12h", 50), ("24h", 10),
-    ])
+    @pytest.mark.parametrize(
+        "win,expected",
+        [
+            ("1m", 900),
+            ("10m", 1000),
+            ("1h", 1100),
+            ("12h", 50),
+            ("24h", 10),
+        ],
+    )
     def test_each_window_selects_its_columns(self, win, expected):
         chart = build_chart([self._row()], [], "all", None, win)
         assert chart["p2pool"][0]["y"] == expected
@@ -298,9 +390,9 @@ def test_downsample_preserves_per_window_columns(self):
         # downsampler dropped all but v/v_p2pool/v_xvb, so non-default Avg windows read 0 on any
         # range wide enough to downsample (24h/1w/1mo).
         base = self._row()
-        rows = [{**base, "timestamp": i} for i in range(600)]   # 600 > target(480) for a 24h span
+        rows = [{**base, "timestamp": i} for i in range(600)]  # 600 > target(480) for a 24h span
         out = views._downsample_history(rows, 86400)
-        assert len(out) < len(rows)                              # actually downsampled
+        assert len(out) < len(rows)  # actually downsampled
         assert out[0]["v_p2pool_1m"] == 900 and out[-1]["v_p2pool_1m"] == 900
         assert out[0]["v_p2pool_1h"] == 1100 and out[0]["v_p2pool_24h"] == 10
 
@@ -310,23 +402,24 @@ def test_wide_range_keeps_nondefault_avg_nonzero(self):
         history = [{**base, "timestamp": i * 30} for i in range(600)]
         chart = build_chart(history, [], "24h", (0, 86400), "1m")
         ys = [p["y"] for p in chart["p2pool"] if p["y"] is not None]
-        assert len(chart["p2pool"]) < 600        # downsampled
+        assert len(chart["p2pool"]) < 600  # downsampled
         assert ys and all(y == 900 for y in ys)  # 1m series preserved (was 0 before the fix)
 
     def test_build_state_echoes_selected_window(self):
         state = build_state(_data(), _state_mgr(history=[self._row()]), "all", None, "1h")
         assert state["avg_window"] == "1h"
         assert state["avg_windows"] == HASHRATE_WINDOWS
-        assert state["chart"]["p2pool"][0]["y"] == 1100   # the 1h column, end to end
+        assert state["chart"]["p2pool"][0]["y"] == 1100  # the 1h column, end to end
 
     def test_build_state_defaults_to_10m(self):
         state = build_state(_data(), _state_mgr(history=[self._row()]), "all")
         assert state["avg_window"] == DEFAULT_HASHRATE_WINDOW
-        assert state["chart"]["p2pool"][0]["y"] == 1000   # the original 10m series
+        assert state["chart"]["p2pool"][0]["y"] == 1000  # the original 10m series
 
 
 # --- Hashrate / mode / tier formatting ------------------------------------------------
 
+
 class TestHashrate:
     def test_formats_hashrates(self):
         hr = _hashrate(_metrics(total_h15=10500, p2pool_1h=8000, xvb_1h=2100))
@@ -373,10 +466,15 @@ def test_tiers_and_fail_count_passthrough(self):
 
 # --- Sync display state mapping -------------------------------------------------------
 
+
 class TestSync:
     def test_loading_done_syncing_states(self):
-        m = _metrics(monero=_sync(has_target=False, done=False),
-                     tari=_sync(has_target=True, done=False, percent=40, current=40, target=100, remaining=60))
+        m = _metrics(
+            monero=_sync(has_target=False, done=False),
+            tari=_sync(
+                has_target=True, done=False, percent=40, current=40, target=100, remaining=60
+            ),
+        )
         sync = build_sync(m, "85.0 GB")
         assert sync["monero"]["state"] == "loading"
         assert sync["tari"]["state"] == "syncing"
@@ -387,7 +485,7 @@ def test_done_state(self):
         assert sync["monero"]["state"] == "done"
 
     def test_synced_node_with_no_target_shows_done(self):
-        # Regression for the bug found in the #180 gouda validation: a fully-synced monerod reports
+        # Regression for the bug found in the #180 live validation: a fully-synced monerod reports
         # target_height: 0 (so has_target is False) and is_syncing: False. Through the real
         # _sync_metric + build_sync it must read "done" — previously it stuck at "loading" forever,
         # because _sync_metric derived `done` purely from percent>=100 (which needs a target) and
@@ -398,8 +496,11 @@ def test_synced_node_with_no_target_shows_done(self):
     def test_no_target_but_not_caught_up_is_not_done(self):
         # The same no-target shape, but NOT caught up, must not read "done".
         m_loading = _metrics(monero=_sync_metric({}))  # no status yet
-        m_syncing = _metrics(monero=_sync_metric({"is_syncing": True, "reachable": True,
-                                                  "current": 5, "target": 10, "percent": 50}))
+        m_syncing = _metrics(
+            monero=_sync_metric(
+                {"is_syncing": True, "reachable": True, "current": 5, "target": 10, "percent": 50}
+            )
+        )
         assert build_sync(m_loading, "1.0 GB")["monero"]["state"] == "loading"
         assert build_sync(m_syncing, "1.0 GB")["monero"]["state"] == "syncing"
 
@@ -411,6 +512,7 @@ def test_monero_mode_and_db_passthrough(self):
 
 # --- Badges ---------------------------------------------------------------------------
 
+
 class TestBadges:
     def _texts(self, badges):
         return [b["text"] for b in badges]
@@ -436,10 +538,42 @@ def test_no_share_badge_when_donating_without_a_share(self):
 
     def test_no_share_badge_absent_when_has_share_or_xvb_off(self):
         # Has a share => no badge; XvB off => raffle moot, no badge.
-        assert not any("No PPLNS share" in t for t in self._texts(
-            build_badges({}, _metrics(xvb_enabled=True, shares_in_window=3), "ok")))
-        assert not any("No PPLNS share" in t for t in self._texts(
-            build_badges({}, _metrics(xvb_enabled=False, shares_in_window=0), "ok")))
+        assert not any(
+            "No PPLNS share" in t
+            for t in self._texts(
+                build_badges({}, _metrics(xvb_enabled=True, shares_in_window=3), "ok")
+            )
+        )
+        assert not any(
+            "No PPLNS share" in t
+            for t in self._texts(
+                build_badges({}, _metrics(xvb_enabled=False, shares_in_window=0), "ok")
+            )
+        )
+
+    def test_xvb_registered_badge(self):
+        # registered_at set + clean state => a muted "✓" confirmation badge (#263).
+        out = build_badges({}, _metrics(xvb_enabled=True, xvb_registered_at=1.0), "ok")
+        assert any(b["text"] == "XvB raffle ✓" and b["variant"] == "outline" for b in out)
+
+    def test_xvb_invalid_wallet_badge(self):
+        # Endpoint rejected the wallet => loud "bad" badge so the user fixes MONERO_WALLET_ADDRESS.
+        out = build_badges({}, _metrics(xvb_enabled=True, xvb_registration_state="invalid"), "ok")
+        assert any(b["variant"] == "bad" and "wallet rejected" in b["text"] for b in out)
+
+    def test_xvb_failing_badge_takes_priority_over_checkmark(self):
+        # A real problem must not be masked by a stale registered_at.
+        out = build_badges(
+            {},
+            _metrics(xvb_enabled=True, xvb_registration_state="failing", xvb_registered_at=1.0),
+            "ok",
+        )
+        assert any(b["variant"] == "bad" and "failing" in b["text"] for b in out)
+        assert not any("✓" in b["text"] for b in out)
+
+    def test_no_xvb_registration_badge_when_disabled(self):
+        out = build_badges({}, _metrics(xvb_enabled=False, xvb_registered_at=1.0), "ok")
+        assert not any("XvB raffle" in b["text"] for b in out)
 
     def test_node_down_and_rejected(self):
         m = _metrics(monero=_sync(down=True), tari=_sync(down=True))
@@ -452,7 +586,9 @@ def test_miner_held(self):
         assert "Miner held (sync)" in self._texts(out)
 
     def test_passive_tari_with_and_without_percent(self):
-        with_pct = build_badges({"tari_syncing_passive": True}, _metrics(tari=_sync(percent=42)), "ok")
+        with_pct = build_badges(
+            {"tari_syncing_passive": True}, _metrics(tari=_sync(percent=42)), "ok"
+        )
         assert "Tari syncing 42%" in self._texts(with_pct)
         no_pct = build_badges({"tari_syncing_passive": True}, _metrics(tari=_sync(percent=0)), "ok")
         assert "Tari syncing" in self._texts(no_pct)
@@ -489,14 +625,20 @@ def test_no_disk_badge_when_missing(self):
 
 # --- System (presentation thresholds) -------------------------------------------------
 
+
 class TestSystem:
     def test_high_usage_levels_and_fill(self):
-        s = build_system({"system": {
-            "disk": {"percent": 95, "used_gb": 90, "total_gb": 100, "percent_str": "95%"},
-            "memory": {"percent": 85, "used_gb": 13, "total_gb": 16, "percent_str": "85%"},
-            "cpu_percent": "90.0%", "load": "0.5 0.4 0.3",
-            "hugepages": ["Enabled", "status-ok", "1555/3072"],
-        }})
+        s = build_system(
+            {
+                "system": {
+                    "disk": {"percent": 95, "used_gb": 90, "total_gb": 100, "percent_str": "95%"},
+                    "memory": {"percent": 85, "used_gb": 13, "total_gb": 16, "percent_str": "85%"},
+                    "cpu_percent": "90.0%",
+                    "load": "0.5 0.4 0.3",
+                    "hugepages": ["Enabled", "status-ok", "1555/3072"],
+                }
+            }
+        )
         assert s["disk"]["fill"] == "critical"
         assert s["disk"]["level"] == "high"
         assert s["mem"]["level"] == "high"
@@ -519,61 +661,145 @@ def test_empty_system_defaults(self):
 
 # --- Workers --------------------------------------------------------------------------
 
+
 class TestWorkers:
     def test_pool_tokens(self):
-        assert build_workers([{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"}])[0]["pool"] == "p2pool"
-        assert build_workers([{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": "3344"}])[0]["pool"] == "xvb"
-        assert build_workers([{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": ""}])[0]["pool"] == "unknown"
+        assert (
+            build_workers(
+                [{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"}]
+            )[0]["pool"]
+            == "p2pool"
+        )
+        assert (
+            build_workers(
+                [{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": "3344"}]
+            )[0]["pool"]
+            == "xvb"
+        )
+        assert (
+            build_workers([{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": ""}])[
+                0
+            ]["pool"]
+            == "unknown"
+        )
 
     def test_formatted_and_raw_fields(self):
-        row = build_workers([{"name": "r", "ip": "10.0.0.1", "status": "online",
-                              "active_pool": "3333", "uptime": 3600, "h10": 5000, "h60": 5100, "h15": 5200}])[0]
+        row = build_workers(
+            [
+                {
+                    "name": "r",
+                    "ip": "10.0.0.1",
+                    "status": "online",
+                    "active_pool": "3333",
+                    "uptime": 3600,
+                    "h10": 5000,
+                    "h60": 5100,
+                    "h15": 5200,
+                }
+            ]
+        )[0]
         assert row["uptime"] == 3600 and row["uptime_str"]
         assert row["h10"] == 5000 and "kH/s" in row["h10_str"]
 
+    def test_api_ok_passes_through(self):
+        # The probe verdict reaches the client so it can badge a misconfigured worker API; a worker
+        # we never probed (no api_ok) stays None and is left unflagged.
+        base = {"name": "r", "ip": "10.0.0.1", "status": "online", "active_pool": "3333"}
+        assert build_workers([{**base, "api_ok": False}])[0]["api_ok"] is False
+        assert build_workers([{**base, "api_ok": True}])[0]["api_ok"] is True
+        assert build_workers([base])[0]["api_ok"] is None
+
     def test_online_sorted_before_offline(self):
-        rows = build_workers([
-            {"name": "zzz", "ip": "10.0.0.9", "status": "offline", "active_pool": "3333"},
-            {"name": "aaa", "ip": "10.0.0.1", "status": "online", "active_pool": "3333"},
-        ])
+        rows = build_workers(
+            [
+                {"name": "zzz", "ip": "10.0.0.9", "status": "offline", "active_pool": "3333"},
+                {"name": "aaa", "ip": "10.0.0.1", "status": "online", "active_pool": "3333"},
+            ]
+        )
         assert [r["name"] for r in rows] == ["aaa", "zzz"]
 
     def test_malformed_worker_skipped(self):
-        rows = build_workers([
-            {"name": "good", "ip": "10.0.0.1", "status": "online", "active_pool": "3333"},
-            {"name": "skipme", "status": "online", "active_pool": "3333"},  # no 'ip'
-        ])
+        rows = build_workers(
+            [
+                {"name": "good", "ip": "10.0.0.1", "status": "online", "active_pool": "3333"},
+                {"name": "skipme", "status": "online", "active_pool": "3333"},  # no 'ip'
+            ]
+        )
         assert [r["name"] for r in rows] == ["good"]
 
     def test_bad_ip_sorts_to_zero(self):
-        assert build_workers([{"name": "r", "ip": "nope", "status": "online", "active_pool": "3333"}])[0]["ip_sort"] == 0
+        assert (
+            build_workers([{"name": "r", "ip": "nope", "status": "online", "active_pool": "3333"}])[
+                0
+            ]["ip_sort"]
+            == 0
+        )
 
     def test_name_passthrough(self):
         # Raw name as data; the client text-escapes it on render.
-        assert build_workers([{"name": "<rig>", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"}])[0]["name"] == "<rig>"
+        assert (
+            build_workers(
+                [{"name": "<rig>", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"}]
+            )[0]["name"]
+            == "<rig>"
+        )
 
     def test_share_counts_raw_and_formatted(self):
         # Per-worker accepted/rejected/invalid: raw counts (sort keys) + display strings (#82).
-        row = build_workers([{"name": "r", "ip": "10.0.0.1", "status": "online", "active_pool": "3333",
-                              "accepted": 1234, "rejected": 5, "invalid": 0}])[0]
+        row = build_workers(
+            [
+                {
+                    "name": "r",
+                    "ip": "10.0.0.1",
+                    "status": "online",
+                    "active_pool": "3333",
+                    "accepted": 1234,
+                    "rejected": 5,
+                    "invalid": 0,
+                }
+            ]
+        )[0]
         assert row["accepted"] == 1234 and row["accepted_str"] == "1,234"
         assert row["rejected"] == 5 and row["rejected_str"] == "5"
         assert row["invalid"] == 0
 
     def test_invalid_appended_to_rejected_string_only_when_nonzero(self):
-        with_inv = build_workers([{"name": "r", "ip": "1.1.1.1", "status": "online",
-                                   "active_pool": "3333", "rejected": 3, "invalid": 2}])[0]
+        with_inv = build_workers(
+            [
+                {
+                    "name": "r",
+                    "ip": "1.1.1.1",
+                    "status": "online",
+                    "active_pool": "3333",
+                    "rejected": 3,
+                    "invalid": 2,
+                }
+            ]
+        )[0]
         assert with_inv["rejected_str"] == "3 (+2 inv)"
 
     def test_missing_share_fields_default_to_zero(self):
         # Workers restored from an old snapshot (pre-#82) lack the share fields entirely.
-        row = build_workers([{"name": "r", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"}])[0]
+        row = build_workers(
+            [{"name": "r", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"}]
+        )[0]
         assert (row["accepted"], row["rejected"], row["invalid"]) == (0, 0, 0)
         assert row["reject_flag"] is None
 
     def test_reject_flag_set_on_high_reject_rate(self):
-        row = build_workers([{"name": "r", "ip": "1.1.1.1", "status": "online", "active_pool": "3333",
-                              "accepted": 90, "rejected": 10, "invalid": 0}])[0]
+        row = build_workers(
+            [
+                {
+                    "name": "r",
+                    "ip": "1.1.1.1",
+                    "status": "online",
+                    "active_pool": "3333",
+                    "accepted": 90,
+                    "rejected": 10,
+                    "invalid": 0,
+                }
+            ]
+        )[0]
         assert row["reject_flag"] and row["reject_flag"]["text"] == "⚠"
         assert "10.0%" in row["reject_flag"]["title"]
 
@@ -586,14 +812,14 @@ def test_none_without_rejects(self):
 
     def test_none_below_noise_floor(self):
         # A couple of rejects out of a few shares is noise, even at a high rate.
-        assert _reject_flag(2, 1) is None     # 33% but only 1 reject
-        assert _reject_flag(0, 2) is None     # 100% but below the 3-reject floor
+        assert _reject_flag(2, 1) is None  # 33% but only 1 reject
+        assert _reject_flag(0, 2) is None  # 100% but below the 3-reject floor
 
     def test_none_when_rate_low(self):
         assert _reject_flag(1000, 5) is None  # 5 rejects but only 0.5%
 
     def test_flags_high_rate_above_floor(self):
-        flag = _reject_flag(90, 10)           # 10% with 10 rejects
+        flag = _reject_flag(90, 10)  # 10% with 10 rejects
         assert flag["text"] == "⚠"
         assert "10.0%" in flag["title"] and "10 rejected" in flag["title"]
 
@@ -604,18 +830,54 @@ def test_flags_all_rejects_at_floor(self):
 
 # --- Tari -----------------------------------------------------------------------------
 
+
 class TestTari:
     def test_active(self):
-        t = build_tari({"tari": {"active": True, "status": "Mining", "reward": 12.5, "height": 42,
-                                 "difficulty": 1234567, "address": "addr"}})
+        t = build_tari(
+            {
+                "tari": {
+                    "active": True,
+                    "connected": True,
+                    "status": "READY",
+                    "reward": 12.5,
+                    "height": 42,
+                    "difficulty": 1234567,
+                    "address": "addr",
+                }
+            }
+        )
         assert t["active"] is True
-        assert t["status"] == "Mining"
+        assert t["connected"] is True  # gates the ✔ on the client
+        assert t["status"] == "READY"
         assert t["reward"] == "12.50 TARI"
         assert t["diff"] == "1,234,567"
 
+    def test_active_but_disconnected_has_no_check(self):
+        # Configured but the gRPC channel is down: active stays True (panel shows) but connected is
+        # False, so the client renders the raw state with no ✔ — never "TRANSIENT_FAILURE ✔".
+        t = build_tari(
+            {"tari": {"active": True, "connected": False, "status": "TRANSIENT_FAILURE"}}
+        )
+        assert t["active"] is True
+        assert t["connected"] is False
+        assert t["status"] == "TRANSIENT_FAILURE"
+
     def test_inactive_defaults(self):
         t = build_tari({"tari": {"active": False}})
-        assert t["active"] is False and t["status"] == "Waiting..."
+        assert t["active"] is False and t["connected"] is False and t["status"] == "Waiting..."
+
+    def test_active_without_status_falls_back_to_waiting(self):
+        # #295: effective status is derived here (not data_service). Active but the channel state is
+        # absent => the "Waiting..." fallback still applies, so the panel is never blank.
+        t = build_tari({"tari": {"active": True}})
+        assert t["status"] == "Waiting..."
+
+    def test_connected_requires_active(self):
+        # #295: a stray connected=True while inactive must not render as connected, and an inactive
+        # chain's status is always "Waiting..." regardless of any raw status it carries.
+        t = build_tari({"tari": {"active": False, "connected": True, "status": "READY"}})
+        assert t["connected"] is False
+        assert t["status"] == "Waiting..."
 
     def test_long_wallet_shortened(self):
         t = build_tari({"tari": {"active": True, "address": "T" * 40}})
@@ -624,10 +886,20 @@ def test_long_wallet_shortened(self):
 
 # --- Proxy summary (Issue #82) --------------------------------------------------------
 
+
 class TestProxySummary:
     def test_formats_totals_and_best(self):
-        ps = build_proxy_summary({"proxy_summary": {
-            "accepted": 12345, "rejected": 67, "invalid": 2, "expired": 1, "best": 9876543}})
+        ps = build_proxy_summary(
+            {
+                "proxy_summary": {
+                    "accepted": 12345,
+                    "rejected": 67,
+                    "invalid": 2,
+                    "expired": 1,
+                    "best": 9876543,
+                }
+            }
+        )
         assert ps["accepted"] == "12,345"
         assert ps["rejected"] == "67"
         assert ps["invalid"] == "2"
@@ -655,17 +927,32 @@ def test_empty_summary_has_no_data(self):
 
 # --- pool/network passthrough ---------------------------------------------------------
 
+
 class TestPoolNetwork:
     def test_formats_from_metrics_and_data(self):
         data = {
-            "stratum": {"hashrate_15m": 0, "shares_found": 5, "shares_failed": 1, "wallet": "W" * 40},
+            "stratum": {
+                "hashrate_15m": 0,
+                "shares_found": 5,
+                "shares_failed": 1,
+                "wallet": "W" * 40,
+            },
             "pool": {"pool": {"sidechain_height": 100}},
             "network": {"reward": 600_000_000_000, "hash": "abc", "timestamp": 0},
             "monero_sync": {"db_size": 85_000_000_000},
         }
-        pn = build_pool_network(data, _metrics(pool_hashrate=120_000_000, pool_difficulty=250_000_000,
-                                               network_difficulty=380_000_000_000, network_height=42,
-                                               pplns_window=2160, block_time=10, monero_mode="Pruned"))
+        pn = build_pool_network(
+            data,
+            _metrics(
+                pool_hashrate=120_000_000,
+                pool_difficulty=250_000_000,
+                network_difficulty=380_000_000_000,
+                network_height=42,
+                pplns_window=2160,
+                block_time=10,
+                monero_mode="Pruned",
+            ),
+        )
         assert pn["pool"]["hr"] == "120.00 MH/s"
         assert pn["pool"]["diff"] == "250.00 M"
         assert pn["network"]["diff"] == "380.00 G"
@@ -673,7 +960,7 @@ def test_formats_from_metrics_and_data(self):
         assert pn["stratum"]["shares"] == "5 / 1"
         assert pn["monero"]["mode"] == "Pruned"
         assert pn["monero"]["db_size"] == "85.0 GB"
-        assert pn["shares_window"]["count"] == 5      # from _BASE metrics
+        assert pn["shares_window"]["count"] == 5  # from _BASE metrics
         assert pn["shares_window"]["ok"] is True
 
     def test_db_size_dash_when_unknown(self):
@@ -683,6 +970,7 @@ def test_db_size_dash_when_unknown(self):
 
 # --- Host address beside the hostname (Issue #119) ------------------------------------
 
+
 class TestHostDisplayAddr:
     def test_resolves_ip_for_a_hostname(self):
         with patch.object(views, "detect_host_ipv4", return_value="192.168.1.42"):
@@ -705,15 +993,19 @@ def test_none_when_detected_ip_equals_host(self):
 
 # --- Earnings calculator (Issue #12) --------------------------------------------------
 
+
 class TestEarnings:
-    _NET = {"network": {"reward": 600_000_000_000}}   # 0.6 XMR block reward (atomic units)
+    _NET = {"network": {"reward": 600_000_000_000}}  # 0.6 XMR block reward (atomic units)
 
     def test_publishes_rate_and_inputs(self):
         # The server sends the daily XMR-per-H/s *rate* + the raw inputs the client scales/inverts
         # (the P2Pool hashrate, P2Pool share difficulty) — not pre-formatted earnings.
-        e = build_earnings(self._NET, _metrics(p2pool_1h=10500,
-                                               network_difficulty=400_000_000_000,
-                                               pool_difficulty=250_000_000))
+        e = build_earnings(
+            self._NET,
+            _metrics(
+                p2pool_1h=10500, network_difficulty=400_000_000_000, pool_difficulty=250_000_000
+            ),
+        )
         assert e["available"] is True
         assert e["p2pool_hr"] == 10500
         assert e["p2pool_hr_str"] == "10.50 kH/s"
@@ -731,8 +1023,10 @@ def test_default_hashrate_is_the_displayed_p2pool_1h(self):
         # (and its display string) matches build_hashrate's "p2p_1h" exactly.
         m = _metrics(total_h15=46_300, xvb_routed_1h=10_000, p2pool_1h=35_000)
         e = build_earnings(self._NET, m)
-        assert e["p2pool_hr"] == 35_000                       # p2pool_1h, independent of total/routed
-        assert e["p2pool_hr_str"] == _hashrate(m)["p2p_1h"]   # identical display string to the header
+        assert e["p2pool_hr"] == 35_000  # p2pool_1h, independent of total/routed
+        assert (
+            e["p2pool_hr_str"] == _hashrate(m)["p2p_1h"]
+        )  # identical display string to the header
 
     def test_no_p2pool_hashrate_when_average_is_zero(self):
         # E.g. fresh start (no history) or full-XvB: p2pool_1h is 0 -> client shows 0 / "—" (honest).
@@ -760,6 +1054,10 @@ def test_p2pool_hr_passthrough_is_raw(self):
 
 # --- build_state integration ----------------------------------------------------------
 
+
+# ponytail: this _state_mgr()/_data() pair looks near-duplicated with the ones in test_metrics.py,
+# but the per-module defaults differ on purpose (e.g. tari_sync, the get_tiers/xvb shapes). A shared
+# builder would need enough params that it reads worse than the local copy — left duplicated.
 def _state_mgr(history=None, mode="P2POOL"):
     sm = MagicMock()
     sm.get_history.return_value = history or []
@@ -771,7 +1069,10 @@ def _state_mgr(history=None, mode="P2POOL"):
 
 def _data(**over):
     data = {
-        "shares": [], "workers": [], "global_sync": False, "total_live_h15": 0,
+        "shares": [],
+        "workers": [],
+        "global_sync": False,
+        "total_live_h15": 0,
         "monero_sync": {"percent": 100, "current": 10, "target": 10},
         "tari_sync": {"percent": 50, "current": 5, "target": 10},
     }
@@ -782,10 +1083,33 @@ def _data(**over):
 class TestBuildState:
     def test_has_all_sections(self):
         st = build_state(_data(), _state_mgr(), "all")
-        for key in ("syncing", "page_title", "host_ip", "host_addr", "version", "last_update",
-                    "range", "window", "badges", "hashrate", "system", "sync", "stratum", "pool",
-                    "network", "monero", "shares_window", "proxy_workers", "earnings", "tari",
-                    "workers", "proxy_summary", "chart"):
+        for key in (
+            "syncing",
+            "page_title",
+            "host_ip",
+            "host_addr",
+            "version",
+            "last_update",
+            "range",
+            "window",
+            "badges",
+            "hashrate",
+            "system",
+            "sync",
+            "stratum",
+            "pool",
+            "network",
+            "monero",
+            "shares_window",
+            "proxy_workers",
+            "earnings",
+            "tari",
+            "workers",
+            "proxy_summary",
+            "egress",
+            "topology",
+            "chart",
+        ):
             assert key in st, f"missing section: {key}"
 
     def test_version_section_shape(self):
@@ -836,13 +1160,19 @@ def test_syncing_flag_and_title(self):
         assert st["page_title"] == "Mining Dashboard - Syncing"
 
     def test_proxy_workers_from_metrics(self):
-        data = _data(workers=[{"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"},
-                              {"name": "b", "ip": "1.1.1.2", "status": "offline", "active_pool": "3333"}])
+        data = _data(
+            workers=[
+                {"name": "a", "ip": "1.1.1.1", "status": "online", "active_pool": "3333"},
+                {"name": "b", "ip": "1.1.1.2", "status": "offline", "active_pool": "3333"},
+            ]
+        )
         assert build_state(data, _state_mgr(), "all")["proxy_workers"] == 1
 
     def test_chart_uses_timestamps(self):
-        history = [{"timestamp": 100, "v": 500, "v_p2pool": 500, "v_xvb": 0, "t": "a"},
-                   {"timestamp": 160, "v": 600, "v_p2pool": 300, "v_xvb": 300, "t": "b"}]
+        history = [
+            {"timestamp": 100, "v": 500, "v_p2pool": 500, "v_xvb": 0, "t": "a"},
+            {"timestamp": 160, "v": 600, "v_p2pool": 300, "v_xvb": 300, "t": "b"},
+        ]
         chart = build_state(_data(), _state_mgr(history=history), "all")["chart"]
         assert chart["p2pool"] == [{"x": 100_000, "y": 500}, {"x": 160_000, "y": 300}]
         assert chart["xvb"][1] == {"x": 160_000, "y": 300}
@@ -854,6 +1184,76 @@ def test_propagates_state_errors(self):
             build_state(_data(), bad_sm, "all")
 
 
+def _set_egress_config(monkeypatch, **over):
+    """Pin the live egress knobs so the #170 panel is deterministic regardless of the test env.
+
+    Defaults are the privacy-safe resting config (firewall on, everything over Tor, local node);
+    pass overrides to model a leak. ``egress_posture_from_config`` / ``topology_from_config`` read
+    these off the config module at call time, so patching them steers ``build_state``'s payload.
+    """
+    safe = {
+        "TOR_EGRESS_FIREWALL": True,
+        "P2POOL_CLEARNET": False,
+        "ENABLE_XVB": True,
+        "XVB_TOR_ENABLED": True,
+        "MONERO_CLEARNET_SYNC": False,
+        "TARI_CLEARNET_SYNC": False,
+        "MONERO_NODE_HOST": "127.0.0.1",
+        "LOCAL_MONERO_HOST": "127.0.0.1",
+    }
+    for name, value in {**safe, **over}.items():
+        monkeypatch.setattr(egress_config, name, value)
+
+
+class TestEgressTopology:
+    """The #170 egress posture + topology ride on /api/state and feed the header badge. These
+    cover the *wiring* (build_state → payload → badge); the derivation itself is unit-tested in
+    tests/service/test_egress.py."""
+
+    def test_both_sections_present_and_share_one_summary(self, monkeypatch):
+        _set_egress_config(monkeypatch)
+        st = build_state(_data(), _state_mgr(), "all")
+        assert st["egress"]["components"]
+        assert st["topology"]["nodes"] and st["topology"]["edges"]
+        # The badge can never contradict the map: identical summary in both sections.
+        assert st["topology"]["summary"] == st["egress"]["summary"]
+
+    def test_safe_config_emits_a_tor_only_header_badge(self, monkeypatch):
+        _set_egress_config(monkeypatch)
+        st = build_state(_data(), _state_mgr(), "all")
+        badge = st["badges"][-1]  # _egress_badge is appended last in build_state
+        assert badge["variant"] == "ok"
+        assert "Tor-only" in badge["text"]
+        assert st["egress"]["summary"]["all_tor"] is True
+
+    def test_host_dashboard_clearnet_leak_emits_a_warning_badge(self, monkeypatch):
+        # The host-networked dashboard's XvB stats fetch over clearnet leaks despite the firewall —
+        # the payload must flip the badge to a loud warning and the topology summary to "warn".
+        _set_egress_config(monkeypatch, XVB_TOR_ENABLED=False)
+        st = build_state(_data(), _state_mgr(), "all")
+        badge = st["badges"][-1]
+        assert badge["variant"] == "bad"
+        assert "clearnet egress" in badge["text"]
+        assert st["topology"]["summary"]["level"] == "warn"
+        assert st["egress"]["summary"]["leaks"] >= 1
+
+    def test_remote_monerod_is_reflected_in_the_payload(self, monkeypatch):
+        # A remote (non-local) monerod RPC host is a clearnet hop; with the firewall on it's blocked,
+        # not leaked, so the badge stays green but the blocked count rises — end to end.
+        _set_egress_config(monkeypatch, MONERO_NODE_HOST="10.0.0.9", LOCAL_MONERO_HOST="127.0.0.1")
+        st = build_state(_data(), _state_mgr(), "all")
+        assert st["egress"]["summary"]["all_tor"] is True
+        assert st["egress"]["summary"]["blocked_by_firewall"] >= 1
+        assert any(
+            e["from"] == "p2pool" and e["to"] == "monerod" and e["route"] == "clearnet"
+            for e in st["topology"]["edges"]
+        )
+
+    def test_payload_stays_json_serializable_with_a_leak(self, monkeypatch):
+        _set_egress_config(monkeypatch, XVB_TOR_ENABLED=False, P2POOL_CLEARNET=True)
+        json.dumps(build_state(_data(), _state_mgr(), "all"))
+
+
 class TestParseWindow:
     def test_valid_pair(self):
         assert parse_window("1000", "2000") == (1000.0, 2000.0)
@@ -862,14 +1262,17 @@ def test_absent_is_none(self):
         assert parse_window(None, None) is None
         assert parse_window("1000", None) is None
 
-    @pytest.mark.parametrize("frm,to", [
-        ("bad", "2000"),   # non-numeric
-        ("2000", "1000"),  # from >= to
-        ("1000", "1000"),  # zero-width
-        ("-5", "2000"),    # non-positive
-        ("nan", "2000"),   # not finite
-        ("inf", "2000"),
-    ])
+    @pytest.mark.parametrize(
+        "frm,to",
+        [
+            ("bad", "2000"),  # non-numeric
+            ("2000", "1000"),  # from >= to
+            ("1000", "1000"),  # zero-width
+            ("-5", "2000"),  # non-positive
+            ("nan", "2000"),  # not finite
+            ("inf", "2000"),
+        ],
+    )
     def test_malformed_falls_back_to_none(self, frm, to):
         assert parse_window(frm, to) is None
 
@@ -878,13 +1281,12 @@ class TestShell:
     def test_returns_html_referencing_module(self):
         shell = get_shell_html()
         assert "<!DOCTYPE html>" in shell
-        assert '/static/dashboard.js' in shell
+        assert "/static/dashboard.js" in shell
         assert 'id="app"' in shell
 
     def test_error_fallback(self, monkeypatch):
         views._SHELL_CACHE = None
-        monkeypatch.setattr(views.os.path, "getmtime",
-                            lambda p: (_ for _ in ()).throw(OSError()))
+        monkeypatch.setattr(views.os.path, "getmtime", lambda p: (_ for _ in ()).throw(OSError()))
         assert get_shell_html() == "<h1>Dashboard shell error</h1>"
 
 
@@ -906,4 +1308,8 @@ def test_no_when_in_tier_but_no_share(self):
 
     def test_na_when_xvb_off(self):
         m = _metrics(xvb_enabled=False, current_tier="Donor (1.00 kH/s+)", shares_in_window=5)
-        assert build_raffle_eligibility(m) == {"applies": False, "eligible": False, "label": "N/A (XvB off)"}
+        assert build_raffle_eligibility(m) == {
+            "applies": False,
+            "eligible": False,
+            "label": "N/A (XvB off)",
+        }
diff --git a/build/dashboard/uv.lock b/build/dashboard/uv.lock
new file mode 100644
index 00000000..18bbe510
--- /dev/null
+++ b/build/dashboard/uv.lock
@@ -0,0 +1,1468 @@
+version = 1
+revision = 3
+requires-python = ">=3.11"
+
+[[package]]
+name = "aiofiles"
+version = "25.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/41/c3/534eac40372d8ee36ef40df62ec129bee4fdb5ad9706e58a29be53b2c970/aiofiles-25.1.0.tar.gz", hash = "sha256:a8d728f0a29de45dc521f18f07297428d56992a742f0cd2701ba86e44d23d5b2", size = 46354, upload-time = "2025-10-09T20:51:04.358Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bc/8a/340a1555ae33d7354dbca4faa54948d76d89a27ceef032c8c3bc661d003e/aiofiles-25.1.0-py3-none-any.whl", hash = "sha256:abe311e527c862958650f9438e859c1fa7568a141b22abcd015e120e86a85695", size = 14668, upload-time = "2025-10-09T20:51:03.174Z" },
+]
+
+[[package]]
+name = "aiohappyeyeballs"
+version = "2.6.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/33/c6/61a2d7b7572279226bb2e7f61d7a19ca7c90da0329c93fa0d560cbf288d8/aiohappyeyeballs-2.6.2.tar.gz", hash = "sha256:e202810ee718bd01fc6ef49e8ea53d023d5cb6b581076d7925aa499fa55dbe64", size = 22591, upload-time = "2026-05-20T15:12:24.631Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5f/fc/a7bf5b6e4e617b45f90f2d9d2a68519c249c81dd4fc2658c7a2a61c4f4b7/aiohappyeyeballs-2.6.2-py3-none-any.whl", hash = "sha256:4708045e2d7a6c6bdf8aafa8ed39649eaf926a4543b54560659129e3365953c4", size = 15062, upload-time = "2026-05-20T15:12:23.328Z" },
+]
+
+[[package]]
+name = "aiohttp"
+version = "3.14.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "aiohappyeyeballs" },
+    { name = "aiosignal" },
+    { name = "attrs" },
+    { name = "frozenlist" },
+    { name = "multidict" },
+    { name = "propcache" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+    { name = "yarl" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/82/78/8ea7308cac6934de8c74a14f3d5f65d1c89287426688be79538d0e5c013d/aiohttp-3.14.1.tar.gz", hash = "sha256:307f2cff90a764d329e77040603fa032db89c5c24fdad50c4c15334cba744035", size = 7955794, upload-time = "2026-06-07T21:09:35.529Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/26/dd/bf526e6f0a1120dd6f2df2e97bacfe4d358f13d17a0ff5847301a1375a51/aiohttp-3.14.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:aa00140699487bd435fde4342d85c94cb256b7cd3a5b9c3396c67f19922afda2", size = 765225, upload-time = "2026-06-07T21:06:07.957Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/e1/a2872aa55495a70f61310d411541c6ee23812d9a884e000c716e1bc3edbf/aiohttp-3.14.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1c1af67559445498b502030c35c59db59966f47041ca9de5b4e707f86bd10b5f", size = 518743, upload-time = "2026-06-07T21:06:09.749Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/e7/c60c7b209e509cc787de3cea0550a518538cfc08003e1c1e14c1c63fff71/aiohttp-3.14.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d44ec478e713ee7f29b439f7eb8dc2b9d4079e11ae114d2c2ac3d5daf30516c8", size = 514139, upload-time = "2026-06-07T21:06:11.26Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/8d/614ace2f579702c9840ab1e1447fd8509e35b0b904f7196418fa2f57b25d/aiohttp-3.14.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d3b1a184a9a8f548a6b73f1e26b96b052193e4b3175ed7342aaf1151a1f00a04", size = 1784088, upload-time = "2026-06-07T21:06:12.887Z" },
+    { url = "https://files.pythonhosted.org/packages/49/e0/726e90f99542bf292f81a96a12cc4847deb86f3ccf62c6f4014a201f4d33/aiohttp-3.14.1-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:5f2504bc0322437c9a1ff6d3333ca56c7477b727c995f036b976ae17b98372c8", size = 1737835, upload-time = "2026-06-07T21:06:14.564Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/4b/d176d5c4db9d33dacf0543102ea59503bc1d528af4cfd0b719949ca49389/aiohttp-3.14.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:73f05ea02013e02512c3bf42714f1208c57168c779cc6fe23516e4543089d0a6", size = 1842801, upload-time = "2026-06-07T21:06:16.228Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/d6/5a99b563690ea0cbed912ae94a2ce33993a5709a651a3a4fe761e7dd973a/aiohttp-3.14.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:797457503c2d426bee06eef808d07b31ede30b65e054444e7de64cad0061b7af", size = 1929992, upload-time = "2026-06-07T21:06:17.947Z" },
+    { url = "https://files.pythonhosted.org/packages/76/7f/a987b14a3859094b3cea3f4825219c3e5536242564af6e3f9c2f6c994eb2/aiohttp-3.14.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b821a1f7dedf7e37450654e620038ac3b2e81e8fa6ea269337e97101978ec730", size = 1786989, upload-time = "2026-06-07T21:06:19.677Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/1a/420e5c85a3e73349372ed22ce0b6af86bfa6ce16a4b20a64a2e94608c781/aiohttp-3.14.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4cd96b5ba05d67ed0cf00b5b405c8cd99586d8e3481e8ee0a831057591af7621", size = 1640129, upload-time = "2026-06-07T21:06:22.558Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/80/18a592ed3be0a402cc03670bd72ee1f8563ddbe1d8d5542dbf868f274136/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d459b98a932296c6f0e94f87511a0b1b90a8a02c30a50e60a297619cd5a58ee", size = 1756576, upload-time = "2026-06-07T21:06:24.8Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/0b/8b3d5713373858ff71a617daf6e3b0e81ad63e79d09a3cf2f6b6b983939c/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:764457a7be60825fb770a644852ff717bcbb5042f189f2bd16df61a81b3f6573", size = 1754668, upload-time = "2026-06-07T21:06:26.528Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/49/fd564575cf225821d7ba5a117cb8bc27213d8a7e1811162afb43ae077039/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f7a16ef45b081454ef844502d87a848876c490c4cb5c650c230f6ec79ed2c1e7", size = 1817019, upload-time = "2026-06-07T21:06:28.297Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/1b/e850c9ae6fc91356552ae668bb6c51e93fa29c8aef13398a10b56678557f/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:2fbc3ed048b3475b9f0cbcb9978e9d2d3511acd91ead203af26ed9f0056004cf", size = 1631638, upload-time = "2026-06-07T21:06:30.242Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/94/3c337ba72451a89806ace6f75bddc92bafc5b8d53d90115a512858024b63/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:bedb0cd073cc2dc035e30aeb99444389d3cd2113afe4ef9fcd23d439f5bade85", size = 1835660, upload-time = "2026-06-07T21:06:31.943Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/9c/9c18cf367a0498212d9ba7daf990b504a5e8ae064cda4b504e2647c89c03/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b6feea921016eb3d4e04d65fc4e9ca402d1a3801f562aef94989f54694917af3", size = 1775698, upload-time = "2026-06-07T21:06:33.72Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/63/a251a9d2a6cb45065b2ddc0bde2b3dd10108740a9a42f632c66405a761a2/aiohttp-3.14.1-cp311-cp311-win32.whl", hash = "sha256:313701e488100074ce99850404ee36e741abf6330179fec908a1944ecf570126", size = 458386, upload-time = "2026-06-07T21:06:35.279Z" },
+    { url = "https://files.pythonhosted.org/packages/17/ca/69274c51dcd6e8947d77b2806cf47a4a15f2c846e2cbeb1882547d3da283/aiohttp-3.14.1-cp311-cp311-win_amd64.whl", hash = "sha256:03ab4530fdcb3a543a122ba4b65ac9919da9fe9f78a03d328a6e38ff962f7aa5", size = 483406, upload-time = "2026-06-07T21:06:36.824Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/8a/c25904f77690c3688ec140f87591ef11a0cfe36bf3d5c0f1f38056fb62b3/aiohttp-3.14.1-cp311-cp311-win_arm64.whl", hash = "sha256:486f7d16ed54c39c2cbd7ca71fd8ba2b8bb7860df65bd7b6ed640bab96a38a8b", size = 452987, upload-time = "2026-06-07T21:06:38.371Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/21/151624b51cd92553d95424daf4bf19f19ce9be9002d19253e7e7ce67197b/aiohttp-3.14.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:d35143e27778b4bb0fb189562d7f275bff79c62ab8e98459717c0ea617ff2480", size = 757402, upload-time = "2026-06-07T21:06:40.311Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/82/280619e0bd7bf2454987e19282616e84762255dd9c8468f62382e8c191f1/aiohttp-3.14.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:bcfb80a2cc36fba2534e5e5b5264dc7ae6fcd9bf15256da3e53d2f499e6fa29d", size = 512310, upload-time = "2026-06-07T21:06:42.207Z" },
+    { url = "https://files.pythonhosted.org/packages/55/b2/2aac325583aaa1353045f96dffa586d8a34e8322e14a7ba49cffeb103ab4/aiohttp-3.14.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:27fd7c91e51729b4f7e1577865fa6d34c9adccbc39aabe9000285b48af9f0ec2", size = 512448, upload-time = "2026-06-07T21:06:43.813Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/72/a60607cb849faa8af8a356c9329ea2eb6f395d49e82cc82ccba1fd8deb8f/aiohttp-3.14.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:64c567bf9eaf664280116a8688f63016e6b32db2505908e2bdaca1b6438142f2", size = 1766854, upload-time = "2026-06-07T21:06:45.391Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/d3/d9fe1c9ec7557ab4d0d82bebaa728c6418f0b93295ec2f4ab015f7710cc7/aiohttp-3.14.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:f5e6ff2bdbb8f4cd3fbe41f99e25bbcd58e3bf9f13d3dd31a11e7917251cc77a", size = 1740884, upload-time = "2026-06-07T21:06:47.413Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/dc/f2cecfaf9337ba3e63f181500814ff502aa3d00d9c7ec93a9d23d10a27b2/aiohttp-3.14.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2f73e01dc37122325caf079982621262f96d74823c179038a82fddfc50359264", size = 1810034, upload-time = "2026-06-07T21:06:50.165Z" },
+    { url = "https://files.pythonhosted.org/packages/66/d7/2ff65c5e65c0d7476daf7e15c032e0805e36811185b9623e3238ad6c763e/aiohttp-3.14.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:bb2c0c80d431c0d03f2c7dbf125150fedd4f0de17366a7ca33f7ccb822391842", size = 1904054, upload-time = "2026-06-07T21:06:52.035Z" },
+    { url = "https://files.pythonhosted.org/packages/20/9c/d445818389df371f56d141d881153ba23183c4735a03f7356ffb43f7757d/aiohttp-3.14.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3e6fc1a85fa7194a1a7d19f44e8609180f4a8eb5fa4c7ed8b4355f080fad235c", size = 1790278, upload-time = "2026-06-07T21:06:54.049Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/aa/bf04cb4d865fc6101c2229a294ad744973b72e513fdc5a6b791e6983d72a/aiohttp-3.14.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:686b6c0d3911ec387b444ddf5dc62fb7f7c0a7d5186a7861626496a5ab4aff95", size = 1591795, upload-time = "2026-06-07T21:06:55.911Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/b4/4dac0038960427ba832f6609dfb4ea5437d7fd80c72001b9e48f834f428b/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c6fa4dc7ad6f8109c70bb1499e589f76b0b792baf39f9b017eb92c8a81d0a199", size = 1728397, upload-time = "2026-06-07T21:06:57.777Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/f9/7cd4e8ad7aa3b75f17d56bb5498dd604a93d4e6eece822ba0568c413fff0/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:87a5eea1b2a5e21e1ebdbb33ad4165359189327e63fc4e4894693e7f821ac817", size = 1766504, upload-time = "2026-06-07T21:07:00.009Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/df/fc01d9fcad0f73fed3f3d361f1f94f975947b50dff82919f6dc2bf4316cc/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:1c1421eb01d4fd608d88cc8290211d177a58532b55ad94076fb349c5bf467f0a", size = 1777806, upload-time = "2026-06-07T21:07:02.064Z" },
+    { url = "https://files.pythonhosted.org/packages/41/09/47e2d090bddcc8fb4ccb4c314aadc32d7c5d9bb55f50f6ad1c92fc15d501/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:34b257ec41345c1e8f2df68fa908a7952f5de932723871eb633ecbbff396c9a4", size = 1580707, upload-time = "2026-06-07T21:07:03.942Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/36/f1a4ce904ae0b6930cfe9afc96d0896f7ec1a620c400405d63783bb95a9c/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:de538791a80e5d862addbc183f70f0158ac9b9bb872bb147f1fd2a683691e087", size = 1798121, upload-time = "2026-06-07T21:07:05.987Z" },
+    { url = "https://files.pythonhosted.org/packages/70/0a/e0075ce9ca0279ee1d4f0c0b85f54fea02ebc83c3007651a72bece658fec/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6f71173be42d3241d428f760122febb748de0623f44308a6f120d0dd9ec572e3", size = 1767580, upload-time = "2026-06-07T21:07:07.873Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/61/a0c0a8f327a9c52095cdd8e312391b00d3ed64ab6c72bb5c33d8ec251cf7/aiohttp-3.14.1-cp312-cp312-win32.whl", hash = "sha256:ec8dc383ee57ea3e883477dcca3f11b65d58199f1080acaf4cd6ad9a99698be4", size = 452771, upload-time = "2026-06-07T21:07:09.669Z" },
+    { url = "https://files.pythonhosted.org/packages/df/d9/ea367c75f16ac9c6cdc8febb25e8318fa21a2b1bc8d6514d4b2d890bface/aiohttp-3.14.1-cp312-cp312-win_amd64.whl", hash = "sha256:2aa92c87868cd13674989f9ee83e5f9f7ea4237589b728048e1f0c8f6caa3271", size = 479873, upload-time = "2026-06-07T21:07:11.538Z" },
+    { url = "https://files.pythonhosted.org/packages/03/64/8d96784a7851156db8a4c6c3f6f91042fdf39fb15a4cc38c8b3c14833c45/aiohttp-3.14.1-cp312-cp312-win_arm64.whl", hash = "sha256:2c840c90759922cb5e6dda94596e079a30fb5a5ba548e7e0dc00574703940847", size = 448073, upload-time = "2026-06-07T21:07:13.637Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/97/bd137012dd97e1649162b099135a80e1fd59aaa807b2430fc448d1029aff/aiohttp-3.14.1-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:b3a03285a7f9c7b016324574a6d92a1c895da6b978cb8f1deee3ac72bc6da178", size = 506882, upload-time = "2026-06-07T21:07:15.501Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/79/e5cc690e9d922a66887ceeaca53a8ffd5a7b0be3816142b7abc433742d89/aiohttp-3.14.1-cp313-cp313-android_21_x86_64.whl", hash = "sha256:2a73f487ab8ef5abbb24b7aa9b73e98eaba9e9e031804ff2416f02eca315ccaf", size = 515270, upload-time = "2026-06-07T21:07:17.53Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/22/a73ccbf9dbd6e26dda0b24d5fd5db7da92ee3383a79f47677ffb834c5c5b/aiohttp-3.14.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:915fbb7b41b115192259f8c9ae58f3ddc444d2b5579917270211858e606a4afd", size = 485841, upload-time = "2026-06-07T21:07:19.555Z" },
+    { url = "https://files.pythonhosted.org/packages/3b/b9/57ed8eaf596321c2ad747bd480fb1700dbd7177c60dfc9e4c187f629662e/aiohttp-3.14.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:7fb4bdf95b0561a79f259f9d28fbc109728c5ee7f27aff6391f0ca703a329abe", size = 492088, upload-time = "2026-06-07T21:07:21.581Z" },
+    { url = "https://files.pythonhosted.org/packages/78/c0/5ebe5270a7c140d7c6f79dcb018640225f14d406c149e4eec04a7d82fe71/aiohttp-3.14.1-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:1b9748363260121d2927704f5d4fc498150669ca3ae93625986ee89c8f80dcd4", size = 501564, upload-time = "2026-06-07T21:07:23.388Z" },
+    { url = "https://files.pythonhosted.org/packages/75/7f/8cdaa24fc7983865e0915153b96a9ac5bcdd3548d64c5a27d17cecccad2d/aiohttp-3.14.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:86a6dab78b0e43e2897a3bbe15745aa60dc5423ca437b7b0b164c069bf91b876", size = 751998, upload-time = "2026-06-07T21:07:25.046Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/f4/c4227aacfacc5cb0cc2d119b65301d177912a6842cd64e120c47af76064f/aiohttp-3.14.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4dfd6e47d3c44c2279907607f73a4240b88c69eb8b90da7e2441a8045dfd21da", size = 510918, upload-time = "2026-06-07T21:07:27.28Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/01/a2d5f96cd4e74424864d30bc0a7e44d0a12dacdcfa91b5b2d1bd3dca6bf3/aiohttp-3.14.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:317acd9f8602858dc7d59679812c376c7f0b97bcbbf16e0d6237f54141d8a8a6", size = 508657, upload-time = "2026-06-07T21:07:29.252Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/ed/3c0fb5c500fdd8e7ebc10d1889c04384fffa1a9163eac1356088ca9da1b1/aiohttp-3.14.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bd869c427324e5cb15195793de951295710db28be7d818247f3097b4ab5d4b96", size = 1757907, upload-time = "2026-06-07T21:07:31.03Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/ab/d4c924d9bd5be3050c226612413ce68cb54c70d2c31b661bfc8d9a5b6a70/aiohttp-3.14.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:93b032b5ec3255473c143627d21a69ac74ae12f7f33974cb587c564d11b1066f", size = 1737565, upload-time = "2026-06-07T21:07:33.031Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2a/37326821ff779084020cdc33224d20b19f42f4183a500ff92022a739eda7/aiohttp-3.14.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f234b4deb12f3ad59127e037bc57c40c21e45b45282df7d3a55a0f409f595296", size = 1799018, upload-time = "2026-06-07T21:07:35.003Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/4f/6e947ba73e4ce09070761c05ed3a8ceb7c21f5e46798671d8b2aac0e4626/aiohttp-3.14.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:9af6779bfb46abf124068327abcdf9ce95c9ef8287a3e8da76ccf2d0f16c28fa", size = 1894416, upload-time = "2026-06-07T21:07:36.956Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/6e/dbf1d0625dc711fb2851f4f3c3055c39ed58bae92082d8c627dbe6013736/aiohttp-3.14.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:faccab372e66bc76d5731525e7f1143c922271725b9d38c9f97edcc66266b451", size = 1783881, upload-time = "2026-06-07T21:07:39.063Z" },
+    { url = "https://files.pythonhosted.org/packages/44/c2/5e25098a67268ed369483ae7d1a58bd0a13d03aab860d2a0e4a6eb25b046/aiohttp-3.14.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f380468b09d2a81633ee863b0ec5648d364bd17bb8ecfb8c2f387f7ac1faf42c", size = 1587572, upload-time = "2026-06-07T21:07:41.058Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/bd/cf9cee17e140f942a3de73e658a543aa8fbf35a5fc67a9d2538d52d77f0b/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:97e704dcd26271f5bda3fa07c3ce0fb76d6d3f8659f4baa1a24442cc9ba177ca", size = 1722137, upload-time = "2026-06-07T21:07:43.014Z" },
+    { url = "https://files.pythonhosted.org/packages/89/6d/5684f8c59045c96f81a18cefbc1fbbd79d25b88f1c622f2a5c5c08fcb632/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:269b76ac5394092b95bc4a098f4fc6c191c083c3bd12775d1e30e663132f6a09", size = 1755953, upload-time = "2026-06-07T21:07:45.933Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/40/35caf3170f8359760740a7d9aa0fff2e344bef98e1d1186f5a0f6dec17e6/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c0b3e614340c889d575451696374c9d17affd54cd607ca0babed8f8c37b9397", size = 1766479, upload-time = "2026-06-07T21:07:48.047Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/a1/b0c61e7a137f0d81de49a82023a6df73c3c16d6fefb0f8e4a93d21639002/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:5663ee9257cfa1add7253a7da3035a02f31b6600ec48261585e1800a81533080", size = 1580077, upload-time = "2026-06-07T21:07:50.069Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/41/194ea4623693009fcefebef7aef63c141754f153e9cd0d39d3b9e36c175c/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:603a2c834142172ffddc054067f5ec0ca65d57a0aa98a71bc81952573208e345", size = 1791688, upload-time = "2026-06-07T21:07:52.106Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/45/4de841f005cfe1fd63e2a2fe011262c515e2a62aa6994b15947e7d717ac9/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cb21957bb8aca671c1765e32f58164cf0c50e6bf41c0bbbd16da20732ecaf588", size = 1761094, upload-time = "2026-06-07T21:07:54.113Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/ae/dbce10533d3896d544d5053939ed75b7dc31a1b0973d959b1b5ae21028d6/aiohttp-3.14.1-cp313-cp313-win32.whl", hash = "sha256:e509a55f681e6158c20f70f102f9cf61fb20fbc382272bc6d94b7343f2582780", size = 452662, upload-time = "2026-06-07T21:07:56.06Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/d9/0bf1a19362c32f06229da5e7ddfcec91f93474d6307f7a2d3135e9c674dc/aiohttp-3.14.1-cp313-cp313-win_amd64.whl", hash = "sha256:1ac8531b638959718e18c2207fbfe297819875da46a740b29dfa29beba64355a", size = 479748, upload-time = "2026-06-07T21:07:58.319Z" },
+    { url = "https://files.pythonhosted.org/packages/22/0a/62e7232dc9484fbec112ceb32efb6a624cc7994ec6e2b019286f17c4e8f2/aiohttp-3.14.1-cp313-cp313-win_arm64.whl", hash = "sha256:250d14af67f6b6a1a4a811049b1afa69d61d617fca6bf33149b3ab1a6dbcf7b8", size = 447723, upload-time = "2026-06-07T21:08:00.154Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/a1/5fafa04e1ca91ddb47608699d60649c1c6db3cf41c99e78fc4056f9513db/aiohttp-3.14.1-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:7c106c26852ca1c2047c6b80384f17100b4e439af276f21ef3d4e2f450ae7e15", size = 508531, upload-time = "2026-06-07T21:08:02.093Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/2e/bfa02f699d87ffc86d5959270b28f1cb410add3ccaced8ed2e0b8a5238fc/aiohttp-3.14.1-cp314-cp314-android_24_x86_64.whl", hash = "sha256:20205f7f5ade7aaec9f4b500549bbc071b046453aed72f9c06dcab87896a83e8", size = 514718, upload-time = "2026-06-07T21:08:04.476Z" },
+    { url = "https://files.pythonhosted.org/packages/85/a5/9594ad6289eebbc97d167c44213d557807f90e59115caad24de21ad2c3b1/aiohttp-3.14.1-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:62a759436b29e677181a9e76bab8b8f689a29cb9c535f45f7c48c9c830d3f8c3", size = 487918, upload-time = "2026-06-07T21:08:06.377Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/61/16a32c36c3c49edec122a3dc811f2057df2f94d3b14aa107c8017d981618/aiohttp-3.14.1-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:2964cbf553df4d7a57348da44d961d871895fc1ee4e8c322b2a95612c7b17fba", size = 494014, upload-time = "2026-06-07T21:08:08.263Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/89/3ebcf96ed99c05bec9c434aaac6963fd3cbab4a786ae739908a144d9ce44/aiohttp-3.14.1-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:237651caadc3a59badd39319c54642b5299e9cc98a3a194310e55d5bb9f5e397", size = 502398, upload-time = "2026-06-07T21:08:10.244Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/3d/b74870a0c2d40c355928cd5b96c7a11fa821b8a40fc41365e64479b151fb/aiohttp-3.14.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:896e12dfdbbab9d8f7e16d2b28c6769a60126fa92095d1ebf9473d02593a2448", size = 758018, upload-time = "2026-06-07T21:08:12.447Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/66/f42f5c984d99e49c6cff5f26f590750f2e2f7ef1fcfb99966ab5be1b632e/aiohttp-3.14.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d03f281ed22579314ba00821ce20115a7c0ac430660b4cc05704a3f818b3e004", size = 512462, upload-time = "2026-06-07T21:08:14.624Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/a7/248e1aebe0c7810b0271e021a0f2a5eb6e78a051885b3c9df49f42a5802d/aiohttp-3.14.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:07eabb979d236335fed927e137a928c9adfb7df3b9ec7aa31726f133a62be983", size = 512824, upload-time = "2026-06-07T21:08:16.572Z" },
+    { url = "https://files.pythonhosted.org/packages/26/97/2aa0e5ba0727dc3bd5aaebb7ccbc510f7dfb7fb961ec87497cd496635ab1/aiohttp-3.14.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4fe1f1087cbadb280b5e1bb054a4f00d1423c74d6626c5e48400d871d34ecefe", size = 1749898, upload-time = "2026-06-07T21:08:18.635Z" },
+    { url = "https://files.pythonhosted.org/packages/00/8d/e97f6c96c891d457c8479d92a514ba194d0412f981d72c70341ee18488ed/aiohttp-3.14.1-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:367a9314fdc79dab0fac96e216cb41dd73c85bdca85306ce8999118ba7e0f333", size = 1710114, upload-time = "2026-06-07T21:08:20.892Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/e6/aa8d7e863048c8fceb5cd6ce74017311cec3ead07847387e12265fb4444e/aiohttp-3.14.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a24f677ebe83749039e7bdf862ff0bbb16818ae4193d4ef96505e269375bcce0", size = 1802541, upload-time = "2026-06-07T21:08:23.044Z" },
+    { url = "https://files.pythonhosted.org/packages/83/a8/72193137de57fda4ebfae4563182d082c8856e3b6e9871d0b46f028fb369/aiohttp-3.14.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c83afe0ba876be7e943d2e0ba645809ad441575d2840c895c21ee5de93b9377a", size = 1875776, upload-time = "2026-06-07T21:08:25.288Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/18/938441025db6769a3464596b2410af3afde0b21eb2f204c6f766f68af4bd/aiohttp-3.14.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:634e385930fb6d2d479cf3aa66515955863b77a5e3c2b5894ca259a25b308602", size = 1760329, upload-time = "2026-06-07T21:08:27.363Z" },
+    { url = "https://files.pythonhosted.org/packages/60/29/bf2496b4065e76e09fe48015aaffe5ce161d8f089b06ac6982070f653076/aiohttp-3.14.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:eeea07c4397bbc57719c4eed8f9c284874d4f175f9b6d57f7a1546b976d455ca", size = 1587293, upload-time = "2026-06-07T21:08:29.805Z" },
+    { url = "https://files.pythonhosted.org/packages/49/a2/2136674d52123b1354bd05dd5753c318db47dc0c927cc70b27bab3755456/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:335c0cc3e3545ce98dcb9cfcb836f40c3411f43fa03dab757597d80c89af8a35", size = 1714756, upload-time = "2026-06-07T21:08:32.094Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/b9/e5fd2e6f915503081c0f9b1e8540947037929c70c191da2e4d54b31a21a1/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:ae6be797afdef264e8a84864a85b196ca06045586481b3df8a967322fd2fa844", size = 1721052, upload-time = "2026-06-07T21:08:34.167Z" },
+    { url = "https://files.pythonhosted.org/packages/63/5a/2833e324a2263e104e31e2e91bc5bbee81bc499afd32203faee048a883f0/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:8560b4d712474335d08907db7973f71912d3a9a8f1dee992ec06b5d2fe359496", size = 1766888, upload-time = "2026-06-07T21:08:36.95Z" },
+    { url = "https://files.pythonhosted.org/packages/57/fa/dea6511870913162f3b2e8c42a7614eb203a4540b8c2da43e0bfb0548f3c/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b7edd08e0a5deb1e8564a2fcd8f4561014a3f05252334671bbf55ddd47db0e5", size = 1581679, upload-time = "2026-06-07T21:08:39.292Z" },
+    { url = "https://files.pythonhosted.org/packages/14/bd/3cf0d55e71784b33534e9710a67d382d900598b4787fbce6cc7317f8c42a/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:b6ff7fcee63287ae57b5df3e4f5957ce032122802509246dec1a5bcc55904c95", size = 1782021, upload-time = "2026-06-07T21:08:41.407Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/af/14bb5843eccbe234f4dfb78ab73e549d99727247e62ae5d62cbd22eaf5b0/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:6ffbb2f4ec1ceaff7e07d43922954da26b223d188bf30658e561b98e23089444", size = 1742574, upload-time = "2026-06-07T21:08:43.795Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/1e/fbeb7af9210a67ac0f9c9bec0f8f4568497924e33137a3d5b48e1cf85f3f/aiohttp-3.14.1-cp314-cp314-win32.whl", hash = "sha256:a9875b46d910cff3ea2f5962f9d266b465459fe634e22556ab9bd6fc1192eea0", size = 457773, upload-time = "2026-06-07T21:08:46.168Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/2b/13e8d741a9ec5db7d900c060554cf8352ab85e44e2a4469ebb9d377bda17/aiohttp-3.14.1-cp314-cp314-win_amd64.whl", hash = "sha256:af8b4b81a960eeaf1234971ac3cd0ba5901f3cd42eae42a46b4d089a8b492719", size = 485001, upload-time = "2026-06-07T21:08:48.401Z" },
+    { url = "https://files.pythonhosted.org/packages/df/30/491acfa2c4d6c3ff59c49a14fc1b50be3241e25bbb0c84c09e2da4d11395/aiohttp-3.14.1-cp314-cp314-win_arm64.whl", hash = "sha256:cf4491381b1b57425c315a56a439251b1bdac07b2275f19a8c44bc57744532ec", size = 453809, upload-time = "2026-06-07T21:08:50.7Z" },
+    { url = "https://files.pythonhosted.org/packages/34/e3/19dbe1a1f4cc6230eb9e314de7fe68053b0992f9302b27d12141a0b5db53/aiohttp-3.14.1-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:819c054312f1af92947e6a55883d1b66feefab11531a7fc45e0fb9b63880b5c2", size = 793320, upload-time = "2026-06-07T21:08:52.775Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/20/1b7182219ba1b108430d6e4dc53d25ae02dcfcf5a045b33af4e8c5167527/aiohttp-3.14.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:10ee9c1753a8f706345b22496c79fbddb5be0599e0823f3738b1534058e25340", size = 529077, upload-time = "2026-06-07T21:08:55Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/c8/14ce60ec31a2e5f5274bb17d383a6f7a3aabca31ac04eee05585bbadab16/aiohttp-3.14.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1601cc37baf5750ccacae618ec2daf020769581695550e3b654a911f859c563d", size = 532476, upload-time = "2026-06-07T21:08:57.176Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/02/9ac85e081e53da2e061b02fa7758fe0a12d17b8ce2d1f5e6c7cb76730328/aiohttp-3.14.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4d6e0ac9da31c9c04c84e1c0182ad8d6df35965a85cae29cd71d089621b3ae94", size = 1922347, upload-time = "2026-06-07T21:08:59.563Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/3e/d3ba07a0ab38b5389e10bec4362d21e10a4f667cba2d79ba30837b3a5059/aiohttp-3.14.1-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9e8f2d660c350b3d0e259c7a7e3d9b7fc8b41210cbcc3d4a7076ff0a5e5c2fdc", size = 1786465, upload-time = "2026-06-07T21:09:01.909Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/cb/e2ee978a00cfb2df829704a69528b18154eba5939f45bc1efa8f33aee4c5/aiohttp-3.14.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4691802dda97be727f79d86818acaad7eb8e9252626a1d6b519fedbb92d5e251", size = 1909423, upload-time = "2026-06-07T21:09:04.357Z" },
+    { url = "https://files.pythonhosted.org/packages/73/5d/1430334858b1022b58ae50399a918f0bd6fe8fa7fa183598d657ff61e040/aiohttp-3.14.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c389c482a7e9b9dc3ee2701ac46c4125297a3818875b9c305ddb603c04828fd1", size = 2001906, upload-time = "2026-06-07T21:09:06.722Z" },
+    { url = "https://files.pythonhosted.org/packages/66/4e/560c7472d3d198a23aa5c8b19a5115bf6a9b77b7d3e4bb363da320430ad2/aiohttp-3.14.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fc0cacab7ba4e56f0f81c82a98c09bed2f39c940107b03a34b168bdf7597edd3", size = 1877095, upload-time = "2026-06-07T21:09:09.011Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/f1/4745806578d447db4a784a8591e2dae3afdfc2bcb96f8f81271b13df6543/aiohttp-3.14.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:979ed4717f59b8bb12e3963378fa285d93d367e15bcd66c721311826d3c44a6c", size = 1676222, upload-time = "2026-06-07T21:09:11.461Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/c9/48255813cca749a229ef0ab476004ec623728ad79a9c0840616f6c076325/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:38e1e7daaea81df51c952e18483f323d878499a1e2bfe564790e0f9701d6f203", size = 1842922, upload-time = "2026-06-07T21:09:14.118Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/c0/bbd054e2bee909f529523a5af3891052606af5143c09f5f183ec3b234676/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:4132e72c608fe9fecb8f409113567605915b83e9bdd3ea56538d2f9cd35002f1", size = 1825035, upload-time = "2026-06-07T21:09:16.447Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/ae/90395d4376deceb74e09ec26b6adf7d2015a6f8802d6d84446af860fef04/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:eefd9cc9b6d4a2db5f00a26bc3e4f9acf71926a6ec557cd56c9c6f27c290b665", size = 1849512, upload-time = "2026-06-07T21:09:18.742Z" },
+    { url = "https://files.pythonhosted.org/packages/93/bd/fb25f3049957553d4ce0ba6ae480aa2f592a6985497fca590837d16c1be0/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:b165790117eea512d7f3fb22f1f6dad3d55a7189571993eb015591c1401276d1", size = 1668571, upload-time = "2026-06-07T21:09:21.458Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/22/7f73303d64dd567ff3addca90b556690ed1233a47b8f55d242fb90af3681/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:ed09c7eb1c391271c2ed0314a51903e72a3acb653d5ccfc264cdf3ef11f8269d", size = 1881159, upload-time = "2026-06-07T21:09:23.813Z" },
+    { url = "https://files.pythonhosted.org/packages/44/be/0474c5a8b5640e1e4aa1923430a91f4151be82e511373fe764189b89aef5/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:99abd37084b82f5830c635fddd0b4993b9742a66eb746dacf433c8590e8f9e3c", size = 1841409, upload-time = "2026-06-07T21:09:26.207Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/3c/bb4a7cba26956cb3da4553cc2056cf67be5b5ff6e6d8fa4fbdff73bfb7ae/aiohttp-3.14.1-cp314-cp314t-win32.whl", hash = "sha256:47ddf841cdecc810749921d25606dee45857d12d2ad5ddb7b5bd7eab12e4b365", size = 494166, upload-time = "2026-06-07T21:09:28.505Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/84/ec80c2c1f66a952555a9f86df6b33af65108a6febfa0471b69013a12f807/aiohttp-3.14.1-cp314-cp314t-win_amd64.whl", hash = "sha256:5e78b522b7a6e27e0b25d19b247b75039ac4c94f99823e3c9e53ae1603a9f7e9", size = 530255, upload-time = "2026-06-07T21:09:30.843Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/71/6e22be134a4061ada85a92951b842f2657f17d926b727f3f94c56ae963d6/aiohttp-3.14.1-cp314-cp314t-win_arm64.whl", hash = "sha256:90d53f1609c29ccc2193945ef732428382a28f78d0456ae4d3daf0d48b74f0f6", size = 469640, upload-time = "2026-06-07T21:09:33.028Z" },
+]
+
+[[package]]
+name = "aiosignal"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "frozenlist" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/61/62/06741b579156360248d1ec624842ad0edf697050bbaf7c3e46394e106ad1/aiosignal-1.4.0.tar.gz", hash = "sha256:f47eecd9468083c2029cc99945502cb7708b082c232f9aca65da147157b251c7", size = 25007, upload-time = "2025-07-03T22:54:43.528Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fb/76/641ae371508676492379f16e2fa48f4e2c11741bd63c48be4b12a6b09cba/aiosignal-1.4.0-py3-none-any.whl", hash = "sha256:053243f8b92b990551949e63930a839ff0cf0b0ebbe0597b0f3fb19e1a0fe82e", size = 7490, upload-time = "2025-07-03T22:54:42.156Z" },
+]
+
+[[package]]
+name = "attrs"
+version = "26.1.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/9a/8e/82a0fe20a541c03148528be8cac2408564a6c9a0cc7e9171802bc1d26985/attrs-26.1.0.tar.gz", hash = "sha256:d03ceb89cb322a8fd706d4fb91940737b6642aa36998fe130a9bc96c985eff32", size = 952055, upload-time = "2026-03-19T14:22:25.026Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/64/b4/17d4b0b2a2dc85a6df63d1157e028ed19f90d4cd97c36717afef2bc2f395/attrs-26.1.0-py3-none-any.whl", hash = "sha256:c647aa4a12dfbad9333ca4e71fe62ddc36f4e63b2d260a37a8b83d2f043ac309", size = 67548, upload-time = "2026-03-19T14:22:23.645Z" },
+]
+
+[[package]]
+name = "certifi"
+version = "2026.6.17"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c9/c7/424b75da314c1045981bd9777432fad05a9e0c69daa4ed7e308bbaffe405/certifi-2026.6.17.tar.gz", hash = "sha256:024c88eeec92ca068db80f02b8b07c9cef7b9fe261d1d535abfd5abd6f6af432", size = 134594, upload-time = "2026-06-17T10:31:07.894Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ef/2f/c5464532e965badff2f4c4c1a3a83f5697f0d7c407ed0cda44aaa99bb451/certifi-2026.6.17-py3-none-any.whl", hash = "sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db", size = 133289, upload-time = "2026-06-17T10:31:06.348Z" },
+]
+
+[[package]]
+name = "cfgv"
+version = "3.5.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/4e/b5/721b8799b04bf9afe054a3899c6cf4e880fcf8563cc71c15610242490a0c/cfgv-3.5.0.tar.gz", hash = "sha256:d5b1034354820651caa73ede66a6294d6e95c1b00acc5e9b098e917404669132", size = 7334, upload-time = "2025-11-19T20:55:51.612Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/db/3c/33bac158f8ab7f89b2e59426d5fe2e4f63f7ed25df84c036890172b412b5/cfgv-3.5.0-py2.py3-none-any.whl", hash = "sha256:a8dc6b26ad22ff227d2634a65cb388215ce6cc96bbcc5cfde7641ae87e8dacc0", size = 7445, upload-time = "2025-11-19T20:55:50.744Z" },
+]
+
+[[package]]
+name = "chardet"
+version = "7.4.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/19/b6/9df434a8eeba2e6628c465a1dfa31034228ef79b26f76f46278f4ef7e49d/chardet-7.4.3.tar.gz", hash = "sha256:cc1d4eb92a4ec1c2df3b490836ffa46922e599d34ce0bb75cf41fd2bf6303d56", size = 784800, upload-time = "2026-04-13T21:33:39.803Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/19/52/505c207f334d51e937cbaa27ff95776e16e2d120e13cbe491cd7b3a70b50/chardet-7.4.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:25a862cddc6a9ac07023e808aedd297115345fbaabc2690479481ddc0f980e09", size = 870747, upload-time = "2026-04-13T21:32:56.916Z" },
+    { url = "https://files.pythonhosted.org/packages/14/4b/d3c79495dee4831b8bebca2790e72cb90f0c5849c940570a7c7e5b70b952/chardet-7.4.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:7005c88da26fd95d8abb8acbe6281d833e9a9181b03cf49b4546c4555389bd97", size = 853210, upload-time = "2026-04-13T21:32:58.309Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/99/f6a822ad1bde25a4c38dc3e770485e78e0893dfd871cd6e18ed3ea3a795e/chardet-7.4.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:dc50f28bad067393cce0af9091052c3b8df7a23115afd8ba7b2e0947f0cef1f8", size = 873625, upload-time = "2026-04-13T21:32:59.606Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/10/31932775c94a86814f76b41c4a772b52abfb0e6125324f32c6da1196c297/chardet-7.4.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4c3da294de1a681097848ab58bd3f2771a674f8039d2d87a5538b28856b815e9", size = 883436, upload-time = "2026-04-13T21:33:01.351Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/63/0f43e3acf2c436fdb32a0f904aeb03a2904d2126eed34a042a194d235926/chardet-7.4.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:93c45e116dd51b66226a53ade3f9f635e870de5399b90e00ce45dcc311093bf4", size = 876589, upload-time = "2026-04-13T21:33:02.636Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/a6/e9b8f8a3e99602792b01fa7d0a731737615ab56d8bfd0b52935a0ef88b85/chardet-7.4.3-cp311-cp311-win_amd64.whl", hash = "sha256:ccc1f83ab4bcfb901cf39e0c4ba6bc6e726fc6264735f10e24ceb5cb47387578", size = 941866, upload-time = "2026-04-13T21:33:04.282Z" },
+    { url = "https://files.pythonhosted.org/packages/61/33/29de185079e6675c3f375546e30a559b7ddc75ce972f18d6e566cd9ea4eb/chardet-7.4.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:75d3c65cc16bddf40b8da1fd25ba84fca5f8070f2b14e86083653c1c85aee971", size = 874870, upload-time = "2026-04-13T21:33:05.977Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/2f/4c5af01fd1a7506a1d5375403d68925eac70289229492db5aa68b58103d8/chardet-7.4.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:29af5999f654e8729d251f1724a62b538b1262d9292cccaefddf8a02aae1ef6a", size = 854859, upload-time = "2026-04-13T21:33:07.381Z" },
+    { url = "https://files.pythonhosted.org/packages/36/21/edb36ad5dfa48d7f8eed97ab43931ecdaa8c15166c21b1d614967e49d681/chardet-7.4.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:626f00299ad62dfe937058a09572beed442ccc7b58f87aa667949b20fd3db235", size = 875032, upload-time = "2026-04-13T21:33:08.741Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/59/a32a241d861cf180853a11c8e5a67641cb1b2af13c3a5ccce83ec07e2c9f/chardet-7.4.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9a4904dd5f071b7a7d7f50b4a67a86db3c902d243bf31708f1d5cde2f68239cb", size = 888283, upload-time = "2026-04-13T21:33:10.213Z" },
+    { url = "https://files.pythonhosted.org/packages/87/2e/e1ee6a77abf3782c00e05b89c4d4328c8353bf9500661c4348df1dd68614/chardet-7.4.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5d2879598bc220689e8ce509fe9c3f37ad2fca53a36be9c9bd91abdd91dd364f", size = 879974, upload-time = "2026-04-13T21:33:11.448Z" },
+    { url = "https://files.pythonhosted.org/packages/32/60/fca69c534602a7ced04280c952a246ad1edde2a6ca3a164f65d32ac41fe7/chardet-7.4.3-cp312-cp312-win_amd64.whl", hash = "sha256:4b2799bd58e7245cfa8d4ab2e8ad1d76a5c3a5b1f32318eb6acca4c69a3e7101", size = 943973, upload-time = "2026-04-13T21:33:12.756Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/43/79ac9b4db5bc87020c9dbc419125371d80882d1d197e9c4765ba8682b605/chardet-7.4.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:a9e4486df251b8962e86ea9f139ca235aa6e0542a00f7844c9a04160afb99aa9", size = 873769, upload-time = "2026-04-13T21:33:14.002Z" },
+    { url = "https://files.pythonhosted.org/packages/55/5f/25bdec773905bff0ff6cf35ca73b17bd05593b4f87bd8c5fa43705f7167d/chardet-7.4.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4fbff1907925b0c5a1064cffb5e040cd5e338585c9c552625f30de6bc2f3107a", size = 853991, upload-time = "2026-04-13T21:33:15.564Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/07/a29380ee0b215d23d77733b5ad60c5c0c7969650e080c667acdf9462040d/chardet-7.4.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:365135eaf37ba65a828f8e668eb0a8c38c479dcbec724dc25f4dfd781049c357", size = 874024, upload-time = "2026-04-13T21:33:16.915Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/b1/3338e121cbd4c8a126b8ccb1061170c2ce51a53f678c502793ea49c6fd6d/chardet-7.4.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bfc134b70c846c21ead8e43ada3ae1a805fff732f6922f8abcf2ff27b8f6493d", size = 887410, upload-time = "2026-04-13T21:33:18.368Z" },
+    { url = "https://files.pythonhosted.org/packages/63/1c/44a9a9e0c59c185a5d307ceaeee8768afa1558f0a24f7a4b5fa11b67586b/chardet-7.4.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:9acd9988a93e09390f3cd231201ea7166c415eb8da1b735928990ffc05cb9fbb", size = 879269, upload-time = "2026-04-13T21:33:20.377Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/b3/5d0e77ea774bd3224321c248880ea0c0379000ac5c2bb6d77609549de247/chardet-7.4.3-cp313-cp313-win_amd64.whl", hash = "sha256:e1b98790c284ff813f18f7cf7de5f05ea2435a080030c7f1a8318f3a4f80b131", size = 944155, upload-time = "2026-04-13T21:33:21.694Z" },
+    { url = "https://files.pythonhosted.org/packages/70/a8/bf0811d859e13801279a2ae64f37a408027b282f2047bc0001c75dd356ad/chardet-7.4.3-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d892d3dcd652fdef53e3d6327d39b17c0df40a899dfc919abaeb64c974497531", size = 872887, upload-time = "2026-04-13T21:33:23.328Z" },
+    { url = "https://files.pythonhosted.org/packages/51/ac/b9d68ebddfe1b02c77af5bf81120e12b036b4432dc6af7a303d90e2bc38b/chardet-7.4.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:acc46d1b8b7d5783216afe15db56d1c179b9a40e5a1558bc13164c4fd20674c4", size = 853964, upload-time = "2026-04-13T21:33:24.724Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/81/17fa103ea9caf5d325a5e4051ab2ba65996fd66baa60b81ee41af1f54e10/chardet-7.4.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ac3bf11c645734a1701a3804e43eabd98851838192267d08c353a834ab79fea", size = 876006, upload-time = "2026-04-13T21:33:26.098Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/20/193faab46a68ea550587331a698c3dca8099f8901d10937c4443135c7ed9/chardet-7.4.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6e3bd9f936e04bae89c254262af08d9e5b98f805175ba1e29d454e6cba3107b7", size = 887680, upload-time = "2026-04-13T21:33:27.49Z" },
+    { url = "https://files.pythonhosted.org/packages/40/c6/94a3c673327392652ee8bdea9a45bc8a5f5365197a7387d68f0eed007115/chardet-7.4.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:27cc23da03630cdecc9aa81a895aa86629c211f995cd57651f0fbc280717bf93", size = 879865, upload-time = "2026-04-13T21:33:29.052Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/2c/cad8b5e3623a987f3c930b68e2bdd06cfc388cd91cd42ed05f1227701b73/chardet-7.4.3-cp314-cp314-win_amd64.whl", hash = "sha256:b95c934b9ad59e2ba8abb9be49df70d3ad1b0d95d864b9fdb7588d4fa8bd921c", size = 939594, upload-time = "2026-04-13T21:33:31.391Z" },
+    { url = "https://files.pythonhosted.org/packages/33/e0/d06e42fd6f02a58e5e227e5106587751cb38adcff0aaf949add744b78b6e/chardet-7.4.3-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:c77867f0c1cb8bd819502249fcdc500364aedb07881e11b743726fa2148e7b6e", size = 889714, upload-time = "2026-04-13T21:33:32.772Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/ed/40d091954d48abea037baae6be8fb79905e5f78d34d12ea955132c7d8011/chardet-7.4.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:cf1efeaf65a6ef2f5b9cc3a1df6f08ba2831b369ccaa4c7018eaf90aa757bb11", size = 872319, upload-time = "2026-04-13T21:33:34.427Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/77/82a46821dbfbdfe062710d2bf2ede13426304e3567a23c57d919c0c31630/chardet-7.4.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9f3504c139a2ad544077dd2d9e412cd08b01786843d76997cd43bb6de311723c", size = 892021, upload-time = "2026-04-13T21:33:35.766Z" },
+    { url = "https://files.pythonhosted.org/packages/49/57/42d30c562bda5b4a839766c1aad8d5856b798ad2a1c3247b72a679afec94/chardet-7.4.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457f619882ba66327d4d8d14c6c342269bdb1e4e1c38e8117df941d14d351b04", size = 902509, upload-time = "2026-04-13T21:33:37.096Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/6c/0a40afdb50a0fe041ab95553b835a8160b6cf0e81edf2ae2fe9f5224cbf9/chardet-7.4.3-py3-none-any.whl", hash = "sha256:1173b74051570cf08099d7429d92e4882d375ad4217f92a6e5240ccfb26f231e", size = 626562, upload-time = "2026-04-13T21:33:38.559Z" },
+]
+
+[[package]]
+name = "charset-normalizer"
+version = "3.4.7"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e7/a1/67fe25fac3c7642725500a3f6cfe5821ad557c3abb11c9d20d12c7008d3e/charset_normalizer-3.4.7.tar.gz", hash = "sha256:ae89db9e5f98a11a4bf50407d4363e7b09b31e55bc117b4f7d80aab97ba009e5", size = 144271, upload-time = "2026-04-02T09:28:39.342Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c2/d7/b5b7020a0565c2e9fa8c09f4b5fa6232feb326b8c20081ccded47ea368fd/charset_normalizer-3.4.7-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7641bb8895e77f921102f72833904dcd9901df5d6d72a2ab8f31d04b7e51e4e7", size = 309705, upload-time = "2026-04-02T09:26:02.191Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/53/58c29116c340e5456724ecd2fff4196d236b98f3da97b404bc5e51ac3493/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:202389074300232baeb53ae2569a60901f7efadd4245cf3a3bf0617d60b439d7", size = 206419, upload-time = "2026-04-02T09:26:03.583Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/02/e8146dc6591a37a00e5144c63f29fb7c97a734ea8a111190783c0e60ab63/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:30b8d1d8c52a48c2c5690e152c169b673487a2a58de1ec7393196753063fcd5e", size = 227901, upload-time = "2026-04-02T09:26:04.738Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/73/77486c4cd58f1267bf17db420e930c9afa1b3be3fe8c8b8ebbebc9624359/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:532bc9bf33a68613fd7d65e4b1c71a6a38d7d42604ecf239c77392e9b4e8998c", size = 222742, upload-time = "2026-04-02T09:26:06.36Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/fa/f74eb381a7d94ded44739e9d94de18dc5edc9c17fb8c11f0a6890696c0a9/charset_normalizer-3.4.7-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:2fe249cb4651fd12605b7288b24751d8bfd46d35f12a20b1ba33dea122e690df", size = 214061, upload-time = "2026-04-02T09:26:08.347Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/92/42bd3cefcf7687253fb86694b45f37b733c97f59af3724f356fa92b8c344/charset_normalizer-3.4.7-cp311-cp311-manylinux_2_31_armv7l.whl", hash = "sha256:65bcd23054beab4d166035cabbc868a09c1a49d1efe458fe8e4361215df40265", size = 199239, upload-time = "2026-04-02T09:26:09.823Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/3d/069e7184e2aa3b3cddc700e3dd267413dc259854adc3380421c805c6a17d/charset_normalizer-3.4.7-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:08e721811161356f97b4059a9ba7bafb23ea5ee2255402c42881c214e173c6b4", size = 210173, upload-time = "2026-04-02T09:26:10.953Z" },
+    { url = "https://files.pythonhosted.org/packages/62/51/9d56feb5f2e7074c46f93e0ebdbe61f0848ee246e2f0d89f8e20b89ebb8f/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:e060d01aec0a910bdccb8be71faf34e7799ce36950f8294c8bf612cba65a2c9e", size = 209841, upload-time = "2026-04-02T09:26:12.142Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/59/893d8f99cc4c837dda1fe2f1139079703deb9f321aabcb032355de13b6c7/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:38c0109396c4cfc574d502df99742a45c72c08eff0a36158b6f04000043dbf38", size = 200304, upload-time = "2026-04-02T09:26:13.711Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/1d/ee6f3be3464247578d1ed5c46de545ccc3d3ff933695395c402c21fa6b77/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:1c2a768fdd44ee4a9339a9b0b130049139b8ce3c01d2ce09f67f5a68048d477c", size = 229455, upload-time = "2026-04-02T09:26:14.941Z" },
+    { url = "https://files.pythonhosted.org/packages/54/bb/8fb0a946296ea96a488928bdce8ef99023998c48e4713af533e9bb98ef07/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:1a87ca9d5df6fe460483d9a5bbf2b18f620cbed41b432e2bddb686228282d10b", size = 210036, upload-time = "2026-04-02T09:26:16.478Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/bc/015b2387f913749f82afd4fcba07846d05b6d784dd16123cb66860e0237d/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:d635aab80466bc95771bb78d5370e74d36d1fe31467b6b29b8b57b2a3cd7d22c", size = 224739, upload-time = "2026-04-02T09:26:17.751Z" },
+    { url = "https://files.pythonhosted.org/packages/17/ab/63133691f56baae417493cba6b7c641571a2130eb7bceba6773367ab9ec5/charset_normalizer-3.4.7-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ae196f021b5e7c78e918242d217db021ed2a6ace2bc6ae94c0fc596221c7f58d", size = 216277, upload-time = "2026-04-02T09:26:18.981Z" },
+    { url = "https://files.pythonhosted.org/packages/06/6d/3be70e827977f20db77c12a97e6a9f973631a45b8d186c084527e53e77a4/charset_normalizer-3.4.7-cp311-cp311-win32.whl", hash = "sha256:adb2597b428735679446b46c8badf467b4ca5f5056aae4d51a19f9570301b1ad", size = 147819, upload-time = "2026-04-02T09:26:20.295Z" },
+    { url = "https://files.pythonhosted.org/packages/20/d9/5f67790f06b735d7c7637171bbfd89882ad67201891b7275e51116ed8207/charset_normalizer-3.4.7-cp311-cp311-win_amd64.whl", hash = "sha256:8e385e4267ab76874ae30db04c627faaaf0b509e1ccc11a95b3fc3e83f855c00", size = 159281, upload-time = "2026-04-02T09:26:21.74Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/83/6413f36c5a34afead88ce6f66684d943d91f233d76dd083798f9602b75ae/charset_normalizer-3.4.7-cp311-cp311-win_arm64.whl", hash = "sha256:d4a48e5b3c2a489fae013b7589308a40146ee081f6f509e047e0e096084ceca1", size = 147843, upload-time = "2026-04-02T09:26:22.901Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/eb/4fc8d0a7110eb5fc9cc161723a34a8a6c200ce3b4fbf681bc86feee22308/charset_normalizer-3.4.7-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:eca9705049ad3c7345d574e3510665cb2cf844c2f2dcfe675332677f081cbd46", size = 311328, upload-time = "2026-04-02T09:26:24.331Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/e3/0fadc706008ac9d7b9b5be6dc767c05f9d3e5df51744ce4cc9605de7b9f4/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6178f72c5508bfc5fd446a5905e698c6212932f25bcdd4b47a757a50605a90e2", size = 208061, upload-time = "2026-04-02T09:26:25.568Z" },
+    { url = "https://files.pythonhosted.org/packages/42/f0/3dd1045c47f4a4604df85ec18ad093912ae1344ac706993aff91d38773a2/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e1421b502d83040e6d7fb2fb18dff63957f720da3d77b2fbd3187ceb63755d7b", size = 229031, upload-time = "2026-04-02T09:26:26.865Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/67/675a46eb016118a2fbde5a277a5d15f4f69d5f3f5f338e5ee2f8948fcf43/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:edac0f1ab77644605be2cbba52e6b7f630731fc42b34cb0f634be1a6eface56a", size = 225239, upload-time = "2026-04-02T09:26:28.044Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/f8/d0118a2f5f23b02cd166fa385c60f9b0d4f9194f574e2b31cef350ad7223/charset_normalizer-3.4.7-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5649fd1c7bade02f320a462fdefd0b4bd3ce036065836d4f42e0de958038e116", size = 216589, upload-time = "2026-04-02T09:26:29.239Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/f1/6d2b0b261b6c4ceef0fcb0d17a01cc5bc53586c2d4796fa04b5c540bc13d/charset_normalizer-3.4.7-cp312-cp312-manylinux_2_31_armv7l.whl", hash = "sha256:203104ed3e428044fd943bc4bf45fa73c0730391f9621e37fe39ecf477b128cb", size = 202733, upload-time = "2026-04-02T09:26:30.5Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/c0/7b1f943f7e87cc3db9626ba17807d042c38645f0a1d4415c7a14afb5591f/charset_normalizer-3.4.7-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:298930cec56029e05497a76988377cbd7457ba864beeea92ad7e844fe74cd1f1", size = 212652, upload-time = "2026-04-02T09:26:31.709Z" },
+    { url = "https://files.pythonhosted.org/packages/38/dd/5a9ab159fe45c6e72079398f277b7d2b523e7f716acc489726115a910097/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:708838739abf24b2ceb208d0e22403dd018faeef86ddac04319a62ae884c4f15", size = 211229, upload-time = "2026-04-02T09:26:33.282Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/ff/531a1cad5ca855d1c1a8b69cb71abfd6d85c0291580146fda7c82857caa1/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:0f7eb884681e3938906ed0434f20c63046eacd0111c4ba96f27b76084cd679f5", size = 203552, upload-time = "2026-04-02T09:26:34.845Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/4c/a5fb52d528a8ca41f7598cb619409ece30a169fbdf9cdce592e53b46c3a6/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:4dc1e73c36828f982bfe79fadf5919923f8a6f4df2860804db9a98c48824ce8d", size = 230806, upload-time = "2026-04-02T09:26:36.152Z" },
+    { url = "https://files.pythonhosted.org/packages/59/7a/071feed8124111a32b316b33ae4de83d36923039ef8cf48120266844285b/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:aed52fea0513bac0ccde438c188c8a471c4e0f457c2dd20cdbf6ea7a450046c7", size = 212316, upload-time = "2026-04-02T09:26:37.672Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/35/f7dba3994312d7ba508e041eaac39a36b120f32d4c8662b8814dab876431/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:fea24543955a6a729c45a73fe90e08c743f0b3334bbf3201e6c4bc1b0c7fa464", size = 227274, upload-time = "2026-04-02T09:26:38.93Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/2d/a572df5c9204ab7688ec1edc895a73ebded3b023bb07364710b05dd1c9be/charset_normalizer-3.4.7-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:bb6d88045545b26da47aa879dd4a89a71d1dce0f0e549b1abcb31dfe4a8eac49", size = 218468, upload-time = "2026-04-02T09:26:40.17Z" },
+    { url = "https://files.pythonhosted.org/packages/86/eb/890922a8b03a568ca2f336c36585a4713c55d4d67bf0f0c78924be6315ca/charset_normalizer-3.4.7-cp312-cp312-win32.whl", hash = "sha256:2257141f39fe65a3fdf38aeccae4b953e5f3b3324f4ff0daf9f15b8518666a2c", size = 148460, upload-time = "2026-04-02T09:26:41.416Z" },
+    { url = "https://files.pythonhosted.org/packages/35/d9/0e7dffa06c5ab081f75b1b786f0aefc88365825dfcd0ac544bdb7b2b6853/charset_normalizer-3.4.7-cp312-cp312-win_amd64.whl", hash = "sha256:5ed6ab538499c8644b8a3e18debabcd7ce684f3fa91cf867521a7a0279cab2d6", size = 159330, upload-time = "2026-04-02T09:26:42.554Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/5d/481bcc2a7c88ea6b0878c299547843b2521ccbc40980cb406267088bc701/charset_normalizer-3.4.7-cp312-cp312-win_arm64.whl", hash = "sha256:56be790f86bfb2c98fb742ce566dfb4816e5a83384616ab59c49e0604d49c51d", size = 147828, upload-time = "2026-04-02T09:26:44.075Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/3b/66777e39d3ae1ddc77ee606be4ec6d8cbd4c801f65e5a1b6f2b11b8346dd/charset_normalizer-3.4.7-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:f496c9c3cc02230093d8330875c4c3cdfc3b73612a5fd921c65d39cbcef08063", size = 309627, upload-time = "2026-04-02T09:26:45.198Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/4e/b7f84e617b4854ade48a1b7915c8ccfadeba444d2a18c291f696e37f0d3b/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0ea948db76d31190bf08bd371623927ee1339d5f2a0b4b1b4a4439a65298703c", size = 207008, upload-time = "2026-04-02T09:26:46.824Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/bb/ec73c0257c9e11b268f018f068f5d00aa0ef8c8b09f7753ebd5f2880e248/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a277ab8928b9f299723bc1a2dabb1265911b1a76341f90a510368ca44ad9ab66", size = 228303, upload-time = "2026-04-02T09:26:48.397Z" },
+    { url = "https://files.pythonhosted.org/packages/85/fb/32d1f5033484494619f701e719429c69b766bfc4dbc61aa9e9c8c166528b/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:3bec022aec2c514d9cf199522a802bd007cd588ab17ab2525f20f9c34d067c18", size = 224282, upload-time = "2026-04-02T09:26:49.684Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/07/330e3a0dda4c404d6da83b327270906e9654a24f6c546dc886a0eb0ffb23/charset_normalizer-3.4.7-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e044c39e41b92c845bc815e5ae4230804e8e7bc29e399b0437d64222d92809dd", size = 215595, upload-time = "2026-04-02T09:26:50.915Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/7c/fc890655786e423f02556e0216d4b8c6bcb6bdfa890160dc66bf52dee468/charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_armv7l.whl", hash = "sha256:f495a1652cf3fbab2eb0639776dad966c2fb874d79d87ca07f9d5f059b8bd215", size = 201986, upload-time = "2026-04-02T09:26:52.197Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/97/bfb18b3db2aed3b90cf54dc292ad79fdd5ad65c4eae454099475cbeadd0d/charset_normalizer-3.4.7-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e712b419df8ba5e42b226c510472b37bd57b38e897d3eca5e8cfd410a29fa859", size = 211711, upload-time = "2026-04-02T09:26:53.49Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/a5/a581c13798546a7fd557c82614a5c65a13df2157e9ad6373166d2a3e645d/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:7804338df6fcc08105c7745f1502ba68d900f45fd770d5bdd5288ddccb8a42d8", size = 210036, upload-time = "2026-04-02T09:26:54.975Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/bf/b3ab5bcb478e4193d517644b0fb2bf5497fbceeaa7a1bc0f4d5b50953861/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:481551899c856c704d58119b5025793fa6730adda3571971af568f66d2424bb5", size = 202998, upload-time = "2026-04-02T09:26:56.303Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/4e/23efd79b65d314fa320ec6017b4b5834d5c12a58ba4610aa353af2e2f577/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:f59099f9b66f0d7145115e6f80dd8b1d847176df89b234a5a6b3f00437aa0832", size = 230056, upload-time = "2026-04-02T09:26:57.554Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/9f/1e1941bc3f0e01df116e68dc37a55c4d249df5e6fa77f008841aef68264f/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:f59ad4c0e8f6bba240a9bb85504faa1ab438237199d4cce5f622761507b8f6a6", size = 211537, upload-time = "2026-04-02T09:26:58.843Z" },
+    { url = "https://files.pythonhosted.org/packages/80/0f/088cbb3020d44428964a6c97fe1edfb1b9550396bf6d278330281e8b709c/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:3dedcc22d73ec993f42055eff4fcfed9318d1eeb9a6606c55892a26964964e48", size = 226176, upload-time = "2026-04-02T09:27:00.437Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/9f/130394f9bbe06f4f63e22641d32fc9b202b7e251c9aef4db044324dac493/charset_normalizer-3.4.7-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:64f02c6841d7d83f832cd97ccf8eb8a906d06eb95d5276069175c696b024b60a", size = 217723, upload-time = "2026-04-02T09:27:02.021Z" },
+    { url = "https://files.pythonhosted.org/packages/73/55/c469897448a06e49f8fa03f6caae97074fde823f432a98f979cc42b90e69/charset_normalizer-3.4.7-cp313-cp313-win32.whl", hash = "sha256:4042d5c8f957e15221d423ba781e85d553722fc4113f523f2feb7b188cc34c5e", size = 148085, upload-time = "2026-04-02T09:27:03.192Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/78/1b74c5bbb3f99b77a1715c91b3e0b5bdb6fe302d95ace4f5b1bec37b0167/charset_normalizer-3.4.7-cp313-cp313-win_amd64.whl", hash = "sha256:3946fa46a0cf3e4c8cb1cc52f56bb536310d34f25f01ca9b6c16afa767dab110", size = 158819, upload-time = "2026-04-02T09:27:04.454Z" },
+    { url = "https://files.pythonhosted.org/packages/68/86/46bd42279d323deb8687c4a5a811fd548cb7d1de10cf6535d099877a9a9f/charset_normalizer-3.4.7-cp313-cp313-win_arm64.whl", hash = "sha256:80d04837f55fc81da168b98de4f4b797ef007fc8a79ab71c6ec9bc4dd662b15b", size = 147915, upload-time = "2026-04-02T09:27:05.971Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c8/c67cb8c70e19ef1960b97b22ed2a1567711de46c4ddf19799923adc836c2/charset_normalizer-3.4.7-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:c36c333c39be2dbca264d7803333c896ab8fa7d4d6f0ab7edb7dfd7aea6e98c0", size = 309234, upload-time = "2026-04-02T09:27:07.194Z" },
+    { url = "https://files.pythonhosted.org/packages/99/85/c091fdee33f20de70d6c8b522743b6f831a2f1cd3ff86de4c6a827c48a76/charset_normalizer-3.4.7-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1c2aed2e5e41f24ea8ef1590b8e848a79b56f3a5564a65ceec43c9d692dc7d8a", size = 208042, upload-time = "2026-04-02T09:27:08.749Z" },
+    { url = "https://files.pythonhosted.org/packages/87/1c/ab2ce611b984d2fd5d86a5a8a19c1ae26acac6bad967da4967562c75114d/charset_normalizer-3.4.7-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:54523e136b8948060c0fa0bc7b1b50c32c186f2fceee897a495406bb6e311d2b", size = 228706, upload-time = "2026-04-02T09:27:09.951Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/29/2b1d2cb00bf085f59d29eb773ce58ec2d325430f8c216804a0a5cd83cbca/charset_normalizer-3.4.7-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:715479b9a2802ecac752a3b0efa2b0b60285cf962ee38414211abdfccc233b41", size = 224727, upload-time = "2026-04-02T09:27:11.175Z" },
+    { url = "https://files.pythonhosted.org/packages/47/5c/032c2d5a07fe4d4855fea851209cca2b6f03ebeb6d4e3afdb3358386a684/charset_normalizer-3.4.7-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bd6c2a1c7573c64738d716488d2cdd3c00e340e4835707d8fdb8dc1a66ef164e", size = 215882, upload-time = "2026-04-02T09:27:12.446Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/c2/356065d5a8b78ed04499cae5f339f091946a6a74f91e03476c33f0ab7100/charset_normalizer-3.4.7-cp314-cp314-manylinux_2_31_armv7l.whl", hash = "sha256:c45e9440fb78f8ddabcf714b68f936737a121355bf59f3907f4e17721b9d1aae", size = 200860, upload-time = "2026-04-02T09:27:13.721Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/cd/a32a84217ced5039f53b29f460962abb2d4420def55afabe45b1c3c7483d/charset_normalizer-3.4.7-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3534e7dcbdcf757da6b85a0bbf5b6868786d5982dd959b065e65481644817a18", size = 211564, upload-time = "2026-04-02T09:27:15.272Z" },
+    { url = "https://files.pythonhosted.org/packages/44/86/58e6f13ce26cc3b8f4a36b94a0f22ae2f00a72534520f4ae6857c4b81f89/charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e8ac484bf18ce6975760921bb6148041faa8fef0547200386ea0b52b5d27bf7b", size = 211276, upload-time = "2026-04-02T09:27:16.834Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/fe/d17c32dc72e17e155e06883efa84514ca375f8a528ba2546bee73fc4df81/charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:a5fe03b42827c13cdccd08e6c0247b6a6d4b5e3cdc53fd1749f5896adcdc2356", size = 201238, upload-time = "2026-04-02T09:27:18.229Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/29/f33daa50b06525a237451cdb6c69da366c381a3dadcd833fa5676bc468b3/charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:2d6eb928e13016cea4f1f21d1e10c1cebd5a421bc57ddf5b1142ae3f86824fab", size = 230189, upload-time = "2026-04-02T09:27:19.445Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/6e/52c84015394a6a0bdcd435210a7e944c5f94ea1055f5cc5d56c5fe368e7b/charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:e74327fb75de8986940def6e8dee4f127cc9752bee7355bb323cc5b2659b6d46", size = 211352, upload-time = "2026-04-02T09:27:20.79Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/d7/4353be581b373033fb9198bf1da3cf8f09c1082561e8e922aa7b39bf9fe8/charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:d6038d37043bced98a66e68d3aa2b6a35505dc01328cd65217cefe82f25def44", size = 227024, upload-time = "2026-04-02T09:27:22.063Z" },
+    { url = "https://files.pythonhosted.org/packages/30/45/99d18aa925bd1740098ccd3060e238e21115fffbfdcb8f3ece837d0ace6c/charset_normalizer-3.4.7-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:7579e913a5339fb8fa133f6bbcfd8e6749696206cf05acdbdca71a1b436d8e72", size = 217869, upload-time = "2026-04-02T09:27:23.486Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/05/5ee478aa53f4bb7996482153d4bfe1b89e0f087f0ab6b294fcf92d595873/charset_normalizer-3.4.7-cp314-cp314-win32.whl", hash = "sha256:5b77459df20e08151cd6f8b9ef8ef1f961ef73d85c21a555c7eed5b79410ec10", size = 148541, upload-time = "2026-04-02T09:27:25.146Z" },
+    { url = "https://files.pythonhosted.org/packages/48/77/72dcb0921b2ce86420b2d79d454c7022bf5be40202a2a07906b9f2a35c97/charset_normalizer-3.4.7-cp314-cp314-win_amd64.whl", hash = "sha256:92a0a01ead5e668468e952e4238cccd7c537364eb7d851ab144ab6627dbbe12f", size = 159634, upload-time = "2026-04-02T09:27:26.642Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/a3/c2369911cd72f02386e4e340770f6e158c7980267da16af8f668217abaa0/charset_normalizer-3.4.7-cp314-cp314-win_arm64.whl", hash = "sha256:67f6279d125ca0046a7fd386d01b311c6363844deac3e5b069b514ba3e63c246", size = 148384, upload-time = "2026-04-02T09:27:28.271Z" },
+    { url = "https://files.pythonhosted.org/packages/94/09/7e8a7f73d24dba1f0035fbbf014d2c36828fc1bf9c88f84093e57d315935/charset_normalizer-3.4.7-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:effc3f449787117233702311a1b7d8f59cba9ced946ba727bdc329ec69028e24", size = 330133, upload-time = "2026-04-02T09:27:29.474Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/da/96975ddb11f8e977f706f45cddd8540fd8242f71ecdb5d18a80723dcf62c/charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fbccdc05410c9ee21bbf16a35f4c1d16123dcdeb8a1d38f33654fa21d0234f79", size = 216257, upload-time = "2026-04-02T09:27:30.793Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/e8/1d63bf8ef2d388e95c64b2098f45f84758f6d102a087552da1485912637b/charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:733784b6d6def852c814bce5f318d25da2ee65dd4839a0718641c696e09a2960", size = 234851, upload-time = "2026-04-02T09:27:32.44Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/40/e5ff04233e70da2681fa43969ad6f66ca5611d7e669be0246c4c7aaf6dc8/charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a89c23ef8d2c6b27fd200a42aa4ac72786e7c60d40efdc76e6011260b6e949c4", size = 233393, upload-time = "2026-04-02T09:27:34.03Z" },
+    { url = "https://files.pythonhosted.org/packages/be/c1/06c6c49d5a5450f76899992f1ee40b41d076aee9279b49cf9974d2f313d5/charset_normalizer-3.4.7-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6c114670c45346afedc0d947faf3c7f701051d2518b943679c8ff88befe14f8e", size = 223251, upload-time = "2026-04-02T09:27:35.369Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/9f/f2ff16fb050946169e3e1f82134d107e5d4ae72647ec8a1b1446c148480f/charset_normalizer-3.4.7-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:a180c5e59792af262bf263b21a3c49353f25945d8d9f70628e73de370d55e1e1", size = 206609, upload-time = "2026-04-02T09:27:36.661Z" },
+    { url = "https://files.pythonhosted.org/packages/69/d5/a527c0cd8d64d2eab7459784fb4169a0ac76e5a6fc5237337982fd61347e/charset_normalizer-3.4.7-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3c9a494bc5ec77d43cea229c4f6db1e4d8fe7e1bbffa8b6f0f0032430ff8ab44", size = 220014, upload-time = "2026-04-02T09:27:38.019Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/80/8a7b8104a3e203074dc9aa2c613d4b726c0e136bad1cc734594b02867972/charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8d828b6667a32a728a1ad1d93957cdf37489c57b97ae6c4de2860fa749b8fc1e", size = 218979, upload-time = "2026-04-02T09:27:39.37Z" },
+    { url = "https://files.pythonhosted.org/packages/02/9a/b759b503d507f375b2b5c153e4d2ee0a75aa215b7f2489cf314f4541f2c0/charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:cf1493cd8607bec4d8a7b9b004e699fcf8f9103a9284cc94962cb73d20f9d4a3", size = 209238, upload-time = "2026-04-02T09:27:40.722Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/4e/0f3f5d47b86bdb79256e7290b26ac847a2832d9a4033f7eb2cd4bcf4bb5b/charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:0c96c3b819b5c3e9e165495db84d41914d6894d55181d2d108cc1a69bfc9cce0", size = 236110, upload-time = "2026-04-02T09:27:42.33Z" },
+    { url = "https://files.pythonhosted.org/packages/96/23/bce28734eb3ed2c91dcf93abeb8a5cf393a7b2749725030bb630e554fdd8/charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:752a45dc4a6934060b3b0dab47e04edc3326575f82be64bc4fc293914566503e", size = 219824, upload-time = "2026-04-02T09:27:43.924Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/6f/6e897c6984cc4d41af319b077f2f600fc8214eb2fe2d6bcb79141b882400/charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:8778f0c7a52e56f75d12dae53ae320fae900a8b9b4164b981b9c5ce059cd1fcb", size = 233103, upload-time = "2026-04-02T09:27:45.348Z" },
+    { url = "https://files.pythonhosted.org/packages/76/22/ef7bd0fe480a0ae9b656189ec00744b60933f68b4f42a7bb06589f6f576a/charset_normalizer-3.4.7-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:ce3412fbe1e31eb81ea42f4169ed94861c56e643189e1e75f0041f3fe7020abe", size = 225194, upload-time = "2026-04-02T09:27:46.706Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/a7/0e0ab3e0b5bc1219bd80a6a0d4d72ca74d9250cb2382b7c699c147e06017/charset_normalizer-3.4.7-cp314-cp314t-win32.whl", hash = "sha256:c03a41a8784091e67a39648f70c5f97b5b6a37f216896d44d2cdcb82615339a0", size = 159827, upload-time = "2026-04-02T09:27:48.053Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/1d/29d32e0fb40864b1f878c7f5a0b343ae676c6e2b271a2d55cc3a152391da/charset_normalizer-3.4.7-cp314-cp314t-win_amd64.whl", hash = "sha256:03853ed82eeebbce3c2abfdbc98c96dc205f32a79627688ac9a27370ea61a49c", size = 174168, upload-time = "2026-04-02T09:27:49.795Z" },
+    { url = "https://files.pythonhosted.org/packages/de/32/d92444ad05c7a6e41fb2036749777c163baf7a0301a040cb672d6b2b1ae9/charset_normalizer-3.4.7-cp314-cp314t-win_arm64.whl", hash = "sha256:c35abb8bfff0185efac5878da64c45dafd2b37fb0383add1be155a763c1f083d", size = 153018, upload-time = "2026-04-02T09:27:51.116Z" },
+    { url = "https://files.pythonhosted.org/packages/db/8f/61959034484a4a7c527811f4721e75d02d653a35afb0b6054474d8185d4c/charset_normalizer-3.4.7-py3-none-any.whl", hash = "sha256:3dce51d0f5e7951f8bb4900c257dad282f49190fdbebecd4ba99bcc41fef404d", size = 61958, upload-time = "2026-04-02T09:28:37.794Z" },
+]
+
+[[package]]
+name = "colorama"
+version = "0.4.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d8/53/6f443c9a4a8358a93a6792e2acffb9d9d5cb0a5cfd8802644b7b1c9a02e4/colorama-0.4.6.tar.gz", hash = "sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44", size = 27697, upload-time = "2022-10-25T02:36:22.414Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
+]
+
+[[package]]
+name = "coverage"
+version = "7.14.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/54/fd/0ab2772530e946e1be1abd0bc09e647ec9b02e88f0867857601fefca8953/coverage-7.14.1.tar.gz", hash = "sha256:30c08f7d90415aa98b3c990385dea2939b0da55f38515e5b369b83655f8523be", size = 920132, upload-time = "2026-05-26T20:41:36.783Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7d/d7/477ad149490e6cb849f28abea1dabb9c823cea72e7500c81b4240ce619c0/coverage-7.14.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:478b5bcd63c2e1357c5c7e16c070690df7b07f676b1c114d7b93e533c664309f", size = 219848, upload-time = "2026-05-26T20:38:38.715Z" },
+    { url = "https://files.pythonhosted.org/packages/91/82/a5eb47257c50601bb7b9a9d2857c67b7a3a85ad74180eb2c98bb1fbe0ce5/coverage-7.14.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:a24a81f9715ee42ef59a316cc11611c98fe23920f7c81861315c9f3ff4a230f4", size = 220354, upload-time = "2026-05-26T20:38:40.232Z" },
+    { url = "https://files.pythonhosted.org/packages/43/8b/78419b5391a5cb706b6544390507e469d83ffc9a8248b02c4011aceb9365/coverage-7.14.1-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:196a13319ad88d6d8ef5ab489ec4f44ddde2143c0c7d5b27786f6c3ffd56a7e1", size = 250771, upload-time = "2026-05-26T20:38:41.782Z" },
+    { url = "https://files.pythonhosted.org/packages/77/63/e77aaacd491182210d639636b7a8bba23ffffa9b82aa3762da9431855fa9/coverage-7.14.1-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:3d452fd08b5c72c5167c93e6867b5c08500bd40f2a21e1e854a500550b6cc36f", size = 252683, upload-time = "2026-05-26T20:38:43.305Z" },
+    { url = "https://files.pythonhosted.org/packages/65/1c/a022e3cfbec2ac241640003cb3a817e161d9c7f5aa9b49173756cdc03204/coverage-7.14.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:23bf7fa51ac02e07fc7c96849b82946da47ae862dc8f86d183b2a4864fc38129", size = 254791, upload-time = "2026-05-26T20:38:45.361Z" },
+    { url = "https://files.pythonhosted.org/packages/61/d6/967e408aca4c1ceb88cb0cc677169110ae7f5995fb5eaf5fb1f5a1bb8f5d/coverage-7.14.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:bcaa50684dcaadfa599ac48f81103c756d791cfd85c97203d2217c593d48b860", size = 256748, upload-time = "2026-05-26T20:38:46.91Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/be/869188f7fe28638078ec479331ace6dc5f7b40b7153eb616f47ab79404d8/coverage-7.14.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4ea1c034f95c9b056e856b794630b17f9fa3d57e4800ff1e503d3be0f9c9078c", size = 250907, upload-time = "2026-05-26T20:38:48.493Z" },
+    { url = "https://files.pythonhosted.org/packages/07/aa/adb7d3b4278d690e68703abcd76ab1b948242e3668d921711551b78f9ddb/coverage-7.14.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c7e057326434e441306226fbeb5d1aaf14a2637efe97ba668306635835f32ad7", size = 252483, upload-time = "2026-05-26T20:38:50.074Z" },
+    { url = "https://files.pythonhosted.org/packages/43/61/331c74103c62dcb0c4b9b3a0de9a61aca016208b0a90f109592a9f9ecc28/coverage-7.14.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:59baf88468dbc8d63b1887afd92bda52e40bb1561696e5819670601403810cec", size = 250545, upload-time = "2026-05-26T20:38:51.613Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/b6/c5dae3c104d89be04828f61810e6b3473825482e4c288cc4ed04553e08ae/coverage-7.14.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:d34d75f892b3ab73ba11cab5442cce7b3e168fd64162b16f0e1e0d09c508edef", size = 254310, upload-time = "2026-05-26T20:38:53.503Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/a1/2b9d5863e3b83c01ad8199e3c597802fbb3a9dc90b058885804c20296d31/coverage-7.14.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3a56abc20a472baf0304c455721bc601477440d28ecfde8a03dde79ede07e0df", size = 250266, upload-time = "2026-05-26T20:38:55.414Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/5e/0e511fbdb269359be26fe678a1c3fa1f2aa2a01573cc3f54268c8d6d4797/coverage-7.14.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:6a3cb83d1552c0cd1b4906655b6a33fd4a8473229633a901c6b73bf86914dee9", size = 251174, upload-time = "2026-05-26T20:38:57.141Z" },
+    { url = "https://files.pythonhosted.org/packages/85/10/e55307b622b3dd9671cb321824502dc10f93e72f2802b9946159a8edadeb/coverage-7.14.1-cp311-cp311-win32.whl", hash = "sha256:10274a1fbeb8ec5d72966e17bb198a3104257aca4ac09d98667c5f8aca8c8548", size = 222354, upload-time = "2026-05-26T20:38:58.727Z" },
+    { url = "https://files.pythonhosted.org/packages/71/cf/107421693cfb71e4f1ca5bf70443f64d4161878068d07a3e51c7ad21d17b/coverage-7.14.1-cp311-cp311-win_amd64.whl", hash = "sha256:87ebdf787d4888e3f3f2d523eadc6e18c6d18c6d0eb173801a189641627fb37e", size = 223290, upload-time = "2026-05-26T20:39:00.413Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/1d/3e3644585eb29e9dafefb19555078529a4d7cce12bd21929664eea989277/coverage-7.14.1-cp311-cp311-win_arm64.whl", hash = "sha256:dd34767fa19848d35659ffc0a75314f58c7af3f1cd87ec521e8292a1238398a3", size = 221953, upload-time = "2026-05-26T20:39:02.159Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/b7/bdbb725ba02c5b42825b200c940f38b7a54fcad24627b7192f78f8110d76/coverage-7.14.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:a06c76364a9360e33d6d23769aefdf7f66f38e2ffb60ceb1baaa4989d83b695c", size = 220022, upload-time = "2026-05-26T20:39:03.702Z" },
+    { url = "https://files.pythonhosted.org/packages/72/81/fdc0898a55c6219223291ec1a1fe89966ef212ce82276aa0899df84b5de0/coverage-7.14.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fad54e871165f6ec2f536063ac74c3104508a12963e64072ba44bd822de52b0c", size = 220379, upload-time = "2026-05-26T20:39:05.381Z" },
+    { url = "https://files.pythonhosted.org/packages/de/72/de048c4a25e13bce59ac6a339351c10bdf2515e07459afcdaf04dc3143a2/coverage-7.14.1-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:84b535f00655ecafe1d929d1fb00ed5d6fa3051ea643ab2c161a3887b86f294b", size = 251888, upload-time = "2026-05-26T20:39:07.367Z" },
+    { url = "https://files.pythonhosted.org/packages/28/30/300c343f68beb9d4cbb64ec81e58c5b6b80b56927f72d2b38654ac26e013/coverage-7.14.1-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:6b6b0853b895fe0e98cbfc580d1ec3393d9302b4b1e96a77b3f5c91fdab899e6", size = 254624, upload-time = "2026-05-26T20:39:09.037Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/ed/7b25642496e8170b6bac14adce00537c6e5fa2d586159401a4de3e8b49e6/coverage-7.14.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:442cc9c952b2df400cda54bb04ab87330cf2cd08a8692cbbea36773531eb6f37", size = 255739, upload-time = "2026-05-26T20:39:10.889Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/a2/abd210b8c4e29c24e4624916db97bb519097a91034aaeb767f937e7da794/coverage-7.14.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8270544c361ed405a27a060dbc9ed2c124b084d96dfdc2d9a2510482aef981ad", size = 257998, upload-time = "2026-05-26T20:39:12.722Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/24/7c50beed3792fe62f6ce0545c6686ce83379719e2c0276179333d97eae92/coverage-7.14.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:48b283b1dd6372e8de2a7a9a4c4d5dc06f4d4fd209b876f3c88a7a205a0c8f84", size = 252296, upload-time = "2026-05-26T20:39:14.259Z" },
+    { url = "https://files.pythonhosted.org/packages/15/05/0f874628ebcbfc77ead559ff210281ef06a97db08481832e7dd39274a135/coverage-7.14.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:5b0c99ba93a07d56f6df340bb79be53202a082b2fdb81bfe6190b741a3470d54", size = 253658, upload-time = "2026-05-26T20:39:15.923Z" },
+    { url = "https://files.pythonhosted.org/packages/99/6f/ca6ad067364b337ef997802115e7ecad2abd2248b05471464b0dea02b4d4/coverage-7.14.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:e471bc5769ff073b058cfadb0d736b56ce067c8560eabeb0da88462df98c23e7", size = 251803, upload-time = "2026-05-26T20:39:17.537Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/30/b9b4d377cd9f40baf228068f5a81faf8450c6228503011bd499708483a50/coverage-7.14.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:f497a1ea81d4cd7c10ddcaa685135b9aabd291af3d55775a9ddf3cb7a364cdd9", size = 255873, upload-time = "2026-05-26T20:39:19.414Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/21/7c721a9e5e6bb88547d30a787aefb97512d3f54c1324c7488d9b3743f7f9/coverage-7.14.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:2222be86d0b54f5dd5a38f45f17f315f737245e857bf0bdedc70734f84a13c02", size = 251372, upload-time = "2026-05-26T20:39:21.169Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/8c/f8ae5a2200130e1503cd7661a6cd3b2b7bacef98277fbf3571fb13f8b766/coverage-7.14.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:85e85586565842f6932abebd4c18bcb1074223dc0b3576e7d173ca710622813a", size = 253245, upload-time = "2026-05-26T20:39:23.097Z" },
+    { url = "https://files.pythonhosted.org/packages/34/62/70a9024672a5f6910517d9628c52c9afbdd3cf8f46426af52bb148a56fff/coverage-7.14.1-cp312-cp312-win32.whl", hash = "sha256:4a28fd227808366b196a75476dced2eb35b351d6766ba9c858dc93319e87f4f1", size = 222567, upload-time = "2026-05-26T20:39:24.868Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/81/8b7cd386839b039ebe1855733b9f9449a8dec5d79564018234f185a7fa70/coverage-7.14.1-cp312-cp312-win_amd64.whl", hash = "sha256:54acdb6674a4661768d7bf7db32dfb9f46ab1d764f8aba6df75ce1a6a088724e", size = 223372, upload-time = "2026-05-26T20:39:26.603Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/ba/b44d472022f620d289d95fa830143235c0c36461c6f2437ea8d51e5481ed/coverage-7.14.1-cp312-cp312-win_arm64.whl", hash = "sha256:99cd41ff91afd94896fea3bc002706b6ae4ce95727d06e4a0f39c0a8d8bd8b1a", size = 221989, upload-time = "2026-05-26T20:39:28.242Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/9e/5f6d56327c62b185225d145191c607e07515294a0aa6338e58805cd4a5ac/coverage-7.14.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:be9f2c802dcfce3f71298303aa5dad0dce440a76c52f2f60dacd8656dab78793", size = 220044, upload-time = "2026-05-26T20:39:29.902Z" },
+    { url = "https://files.pythonhosted.org/packages/75/92/e82aca356744cbbc0f77a0b623e38918c1872361963413a3bab5d0340393/coverage-7.14.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:6223a72fd0e4c7156353ec0f08a5f93623e1d3034d0e2683b9bb8ea674131b1d", size = 220412, upload-time = "2026-05-26T20:39:31.561Z" },
+    { url = "https://files.pythonhosted.org/packages/27/c9/385bde0bf7ed0f4bf3a7ee5367060a86b5d218718cfd6fb943c0f836b34f/coverage-7.14.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7279d2110a28cebc738b6459ecda2771735a4c18465fbbd36b3288fe5ed92247", size = 251412, upload-time = "2026-05-26T20:39:33.337Z" },
+    { url = "https://files.pythonhosted.org/packages/51/8c/23faf6a2343a0d17f960a4bd56c43bc7eb4cf312f774dd6ceebd82c7d8fc/coverage-7.14.1-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:9eeb3fcbc13ba40dfbdb22d01d196a28e9cef9ed4c29b60061a1e0e823a9929d", size = 254008, upload-time = "2026-05-26T20:39:35.009Z" },
+    { url = "https://files.pythonhosted.org/packages/42/06/36f4aa9ca8a815e6036156e80706a67828bb97bd826948244f6996dda957/coverage-7.14.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5f0cfc27c539f07cf5c0a4cfe211d0b6cae039f8f40526dbaa71944e64b50a7b", size = 255241, upload-time = "2026-05-26T20:39:36.71Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/79/95266316352f90f6b1c6736bb413302edfde2453fb32422d3911642691b3/coverage-7.14.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:221c70f316241a78e77e607c227cefc8808d4e08f28d99c04f35694690e940be", size = 257373, upload-time = "2026-05-26T20:39:38.412Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/9c/58316d1f66c488b5fca8a0eb3e98348807813efa8a0d0833b9021be27488/coverage-7.14.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:da028256b04ec30e5e0114b6f76172938c313991f0a2d3d894271315cf5d5e43", size = 251635, upload-time = "2026-05-26T20:39:40.268Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/5a/ca2398a568e16fed7bb713e84ba3603a7164fb65779abe645c565ec890d5/coverage-7.14.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:76a085d7005236a767e3426148b2c407e53ad61695c562f8a81da2d373324901", size = 253373, upload-time = "2026-05-26T20:39:42.145Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/2c/0396562c32deaebe7be51d865b3a41e9a87d7561acafe1a28f53b07e019a/coverage-7.14.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:b553d04b5e778a8e56d57eb134aff42a92718ecba45e79c4764ecfa40efd92ff", size = 251341, upload-time = "2026-05-26T20:39:43.907Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/8f/a94f9221184c9cae1ee115820e3798e48b6b17777a9f19e46fb9a0c8dc74/coverage-7.14.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:46f714d2fb8ae2f4f29f23ada7f1e79b759fff5a70f94a1dac23af204c3ec9e4", size = 255497, upload-time = "2026-05-26T20:39:46.166Z" },
+    { url = "https://files.pythonhosted.org/packages/71/69/505d70e47db1eaebcd002c39759707621ef184cd6b1ae084d9f41293f323/coverage-7.14.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:1896f5e19ff3f0431c7ce2172adc54890fd97f86b59ced8ca1649145d9ffe35d", size = 251159, upload-time = "2026-05-26T20:39:48.03Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/aa/58681c383aa33a9d2ed40a02d7a22fbf780d1fa4d575396365777828198c/coverage-7.14.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:62fd185ef9df3c33d1c8178c5af105f762afbad96038de9a4ae100aa6297ca33", size = 252934, upload-time = "2026-05-26T20:39:49.872Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/fd/11c928cd6bdffc7074bb5965c173d9ebf517fb00205e1da524b98d29ef92/coverage-7.14.1-cp313-cp313-win32.whl", hash = "sha256:ab4af6352741a604c431c6072fce5bee33bf0f20dc7a56618d6bf6bb89e9810c", size = 222584, upload-time = "2026-05-26T20:39:51.68Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/92/fb416fc26d340dcba19518c418d6048e913186e17243982c5e435e41fa7a/coverage-7.14.1-cp313-cp313-win_amd64.whl", hash = "sha256:7af486dabe8954d03b087f0021540897afe084f04e16ff5579e08cc46f871416", size = 223394, upload-time = "2026-05-26T20:39:53.472Z" },
+    { url = "https://files.pythonhosted.org/packages/73/c6/02d56e3867972f77d5036de924643f26c056e848f00452cafb4dbc3c29b4/coverage-7.14.1-cp313-cp313-win_arm64.whl", hash = "sha256:2224f89ffd0c5605ccce1ed7a584da162bc7c55f601ab1c946bc9de31a486b42", size = 222015, upload-time = "2026-05-26T20:39:55.374Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/9e/fcc77914050df73f7662fa1f00902774c79c075a8388ab334074574bf77e/coverage-7.14.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:de286598cc65d2b489411174b1faec2f5a7775fb3201fd925db2a76b4030f37d", size = 220733, upload-time = "2026-05-26T20:39:57.189Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/67/2963cbdaf5cbadec44efa3a1e39eaa1f02df4079585f05387607a221e126/coverage-7.14.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:042c46ded7c288aeb07cf14a28b6c1e10b78fcba40171c3fa1e939377eeef0b5", size = 221086, upload-time = "2026-05-26T20:39:59.019Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/c5/8701645574e11881f2f47d8930f98bc48b5d43b25eb5b4430dfc4a2f9f48/coverage-7.14.1-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:f4ddbe407477f04c45115d1a4e5bc480f753553b534d338d4c3358b1cdd0ea52", size = 262381, upload-time = "2026-05-26T20:40:00.822Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/28/7a64d73598263e0c5abd5084211a8474488d31b3c552ff531c719dfcff62/coverage-7.14.1-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:d13e6725992e2d2fd7d81d4f5241952d13740121dfd501da09201be39b2c003a", size = 264458, upload-time = "2026-05-26T20:40:02.506Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/d8/4969179db9f7eb4df218e69540adf829d1c835f59452513d065d15446802/coverage-7.14.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f747dc8edcfe740130f28f32f3995e955494285717e86ee25af51db2219df08a", size = 266884, upload-time = "2026-05-26T20:40:04.421Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/78/a45d5794dbc9bafd97afc96a4377c86c7820d78b6cf51b89bc1d4e919275/coverage-7.14.1-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:ced2f09ef276fd58611a1ef502164ad266d2b75174e5a40cabbdb4033f9f6cf2", size = 268022, upload-time = "2026-05-26T20:40:06.298Z" },
+    { url = "https://files.pythonhosted.org/packages/21/cb/4f5e354e9e3e67af96bd4e57113e6db6b22298c7168b13eec408a549903d/coverage-7.14.1-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b84800013769a78ccb9ef4659402e26d06867e337b61ec365f77ad008adea80e", size = 261631, upload-time = "2026-05-26T20:40:08.226Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/49/eced49af4cb996d5d8b7e94e736175c513e4facd3398507b89892b4326d8/coverage-7.14.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:ea8cd6ca0ee9f616aaef3afc6882e32c2cbf18b00d96313ffd76af650574034d", size = 264443, upload-time = "2026-05-26T20:40:10.137Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/d8/5603a88a7c5913a6b54f6cb1a8c46f7b39cbb30f27cd3f492908da09b2d7/coverage-7.14.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:aa5e304a873fabddc11e484e9b6b738bd38bd7bed17b09aa84eecf5332e8b8bb", size = 262069, upload-time = "2026-05-26T20:40:11.999Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/59/2ae3cb79da554a06c8619d6c88ea19dd1e4aed4b834b6a83bb1fa243bdc5/coverage-7.14.1-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:5a1c5215be81035e629d5bc756650634d0bf31991038db7a0eccb90f025ce16d", size = 265780, upload-time = "2026-05-26T20:40:13.858Z" },
+    { url = "https://files.pythonhosted.org/packages/af/5f/b130c1dc999031f2648bd25317fbce505ad8d5562079b4ed81e736a84967/coverage-7.14.1-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:79058c47dae6788504b5effb319961bcd72d7240551464b91d474bc0ed186d69", size = 260970, upload-time = "2026-05-26T20:40:16.142Z" },
+    { url = "https://files.pythonhosted.org/packages/87/d1/ec13ccddeb48ec963bdfa72a11224bac2584bd045ba13beca82f8113e9c7/coverage-7.14.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:370c5afae3fa0658e11694a32b24c2778f6bc2d17718121f94ee185e69f26b54", size = 263157, upload-time = "2026-05-26T20:40:18.382Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/c2/cd91ead503045161092d3845f7bb95ea2f25131ce96d3e314dd835d91b9c/coverage-7.14.1-cp313-cp313t-win32.whl", hash = "sha256:3758dd0a7f1fa57365ef2e781df0f0731d38b6e3772259d13dae4bd8a958d4b1", size = 223259, upload-time = "2026-05-26T20:40:20.381Z" },
+    { url = "https://files.pythonhosted.org/packages/71/9f/1e28d97e6bd2c76b07f38b7c02870f1371255ff6717f54eca578fcbbdd0e/coverage-7.14.1-cp313-cp313t-win_amd64.whl", hash = "sha256:6ff665fb023a77386fe11685190cee1f60a7d635994a30d9b0a061533d470fce", size = 224320, upload-time = "2026-05-26T20:40:22.316Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/e0/d936e908f0e1efa55e52b91e01b52f1055cef5e1ab2718493390ed8e2fb8/coverage-7.14.1-cp313-cp313t-win_arm64.whl", hash = "sha256:17a5a241e5997621a956a7f402a7433ef4221e5152809b785bec79e2323799f1", size = 222577, upload-time = "2026-05-26T20:40:24.894Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/34/fc2f101b151af3799a101f0550b0454aa008afdc0add677394ec4aa8ea10/coverage-7.14.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d5ed429d0b8edaac649e889b4ffcedb6c80b06629a3f93050e3dddfb99235bee", size = 220091, upload-time = "2026-05-26T20:40:27.249Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/a7/1ebae2ab5b961b5c79bb09fe7b3ac99edb190d8be4a8c510b2cf66f46468/coverage-7.14.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:8011224a62280e50dab346960c03cf47aca1a1e09e608c0fb33fd6e0cc8e9500", size = 220421, upload-time = "2026-05-26T20:40:30.084Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/90/92aca9cf0acc95123c96cd1eb1f08917897a7f5dee01e15738922971ec31/coverage-7.14.1-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:12c42ec1e14f553c4f817e989365982e646e27211f10a0f717855b94a79c8906", size = 251466, upload-time = "2026-05-26T20:40:32.542Z" },
+    { url = "https://files.pythonhosted.org/packages/26/2b/78048cbe3b999f6cbf9cc0d90abba6a88a3e0863a8c1c6cbc762f3f8802f/coverage-7.14.1-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:06144cd511cf2624873a035c5069cf297144f6e77a73ee3d7a55b605ec5efb42", size = 253973, upload-time = "2026-05-26T20:40:34.473Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/21/c2e33b29d1cfde484a19d437afc343c6cd30b08d78cbbf9f5aff14e57b2b/coverage-7.14.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a311d8e1da24be5c1ccf85cbfb06315dbaa1703d5a1eab3f6432c72b837917c8", size = 255318, upload-time = "2026-05-26T20:40:38.154Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/ee/aad2f108d63b769121005302f16bf66db8625c88ceaba466942e09a2607e/coverage-7.14.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c79cead5b5bc584d9c71451cb984d0e3a84e0c0937379c8efcbf27c8d661b851", size = 257633, upload-time = "2026-05-26T20:40:40.164Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/f8/11a2c29b4fd76d9849f81d0bb812ec0017a9396df3217214e38934a8c837/coverage-7.14.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:dcbf65f1f66a26cdd88c35cf68fb4729c5d1cd2e88added72420541dfb212034", size = 251488, upload-time = "2026-05-26T20:40:42.631Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/b8/9a5820de4b8ac2b71d85e3b5fb49108d7469c665f0e2ad0dd7569023e305/coverage-7.14.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:fd86572566fb40189a8260446158235159bc7a82dfbc87a3b39cf4fb57fcec1c", size = 253329, upload-time = "2026-05-26T20:40:45.208Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/ff/f33e4823667e27548e8fd8df44217515303f9808d0ff29817db56f87d990/coverage-7.14.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:7771b601718fdde84832c3a434ca9bbf4ae9adbc49d84198b4110700c3c77c36", size = 251291, upload-time = "2026-05-26T20:40:47.502Z" },
+    { url = "https://files.pythonhosted.org/packages/68/9b/489db0ebb209054766b90a9014a45f6d26eb724c02ec21311c3733b5a644/coverage-7.14.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:39b21e212c55af06fa375e3dbf90a8a8e38792f3a910c580066d23563830ddd5", size = 255564, upload-time = "2026-05-26T20:40:49.372Z" },
+    { url = "https://files.pythonhosted.org/packages/27/b5/16bc2d4c2409b23c7737edb68c83bc89e345f378050549fe1d75ac7d34d5/coverage-7.14.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:f2302660e32562a532b442480121aef8aa61a5bdb20b30bf0adab29f10a5a4b4", size = 251107, upload-time = "2026-05-26T20:40:51.677Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/0c/2629997469a00cd069d588a41c9dc887610f2775ae89d250c4791e65272a/coverage-7.14.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:03a6f93c1ec3b7f2e77b5dbcc5573a2c21f12529a5c6bbe0f16f72303cc2fa4d", size = 252764, upload-time = "2026-05-26T20:40:54.267Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/ee/f78d63c8f079e0d7211c7e2401fa17e311514534ba61bae03e4b287ce4ab/coverage-7.14.1-cp314-cp314-win32.whl", hash = "sha256:8a3ce026d73290f42f08dafecbd82c193a74df280461fbf97300fec51fd133ee", size = 222837, upload-time = "2026-05-26T20:40:56.496Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/b9/be539854f93a70dfbeec69117f33ec70dc42ff0b65b5b07ab8d40d04228e/coverage-7.14.1-cp314-cp314-win_amd64.whl", hash = "sha256:114c95ef29302423b87d159075805f4ab973254a2638a5d7d046c94887cc87d7", size = 223650, upload-time = "2026-05-26T20:40:58.351Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/9e/24e2842fef40f35ac82ba3a7719c8023d011bf3bf652d0675316a9d088a1/coverage-7.14.1-cp314-cp314-win_arm64.whl", hash = "sha256:a07891c3f4805442b31b71e84ba3cf29ed1aa9a428284e06deeb4b23e5b46343", size = 222218, upload-time = "2026-05-26T20:41:00.321Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/1d/ac0a9df5fe31c1e8bdd658074905fc12844a05c1a7e3fdb8417e97c31e23/coverage-7.14.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:1101a5ebb083aecb625ebb6209d4105b58f647b093cb2dc8122d7b33f743cfe1", size = 220822, upload-time = "2026-05-26T20:41:02.281Z" },
+    { url = "https://files.pythonhosted.org/packages/32/cf/f964fd9aff20323f9f1a726c97135f8a76bcd87b92dad141a456a43f3c64/coverage-7.14.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:851b9e1e4e8a4608e77c79714b2e77c0970d2ed7202a05e92ae407817481887b", size = 221084, upload-time = "2026-05-26T20:41:04.593Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/5e/7e5ef2aba844de2b80d678619fcf0841b42e3f37f16411226f3fe4c1016f/coverage-7.14.1-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:d5b89cdfb2ee051b71e8c3c70bd81a9eff81100f736a269136fe1a68efe00474", size = 262454, upload-time = "2026-05-26T20:41:06.641Z" },
+    { url = "https://files.pythonhosted.org/packages/64/62/75809bded87015cc4935524218a2a8ed8dd1a8498bfed30a2f4f7a4b4d34/coverage-7.14.1-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:0177614a0370f227888b4e436a7c55686d6a9f90eb1ade2b624ba685a1686e86", size = 264578, upload-time = "2026-05-26T20:41:08.556Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/42/d33392dc14633525012d2d504fa1a33b05538bf535f5c1d64675e5754b78/coverage-7.14.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2d69af5dea2de76fc485a83032a630523f985198b7e25be901ec60181587b01e", size = 266981, upload-time = "2026-05-26T20:41:10.824Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/49/0157c4428c2aca7f1e09d5565930586fd5ae36f1655f08b0daa7cf1fcae1/coverage-7.14.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:35ab22d91de736e8966b980dc355cbcdd2c6dbbcfe275f9a2991bc8a91b3df65", size = 268112, upload-time = "2026-05-26T20:41:12.966Z" },
+    { url = "https://files.pythonhosted.org/packages/96/26/86b9ce71f4092b1ed325ce1421698081df1286b833400b6836912834d6e0/coverage-7.14.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:357d4e32935c36588aaba057d734fa32428c360c9fc2e4442afbf1b646beee6e", size = 261558, upload-time = "2026-05-26T20:41:15Z" },
+    { url = "https://files.pythonhosted.org/packages/20/4c/c311210c5472cf5401d8422b0d7812cdd520f24417673afabda6c323faca/coverage-7.14.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:51bd64741cc6fa065abd300ede1afe5a5291ece9c31da8b24884deda48bcc3f8", size = 264447, upload-time = "2026-05-26T20:41:17.369Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/71/59513f8710ed3e6b0ac0a050a5b7e977bb9c9e880354863b5d00d8809256/coverage-7.14.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:9132cd363a68a4c3daa7c8704a654b1e39d3360f6f5b8ddd470608a945236c07", size = 262048, upload-time = "2026-05-26T20:41:19.309Z" },
+    { url = "https://files.pythonhosted.org/packages/84/8d/bceed32dc494f5bbf50f775cd2e78ca814953942b5ea28d3c1c3ac316f14/coverage-7.14.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:07c6290b1697b862c0478eab545eec949a0d0e4d6d03497f446d706da3b4f2de", size = 265781, upload-time = "2026-05-26T20:41:21.559Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/c5/9348fe40dbfd4991aaf78df2c6c3098bfb2cc834d1fd362a64b4efef855a/coverage-7.14.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:5ea0c297e27133853b4d8a3eb799bff5a2dbd9f2f41537a240d337ac9b4df890", size = 260896, upload-time = "2026-05-26T20:41:23.428Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/92/1ea0f03929da7cf87206b1fa24f4c8e9c158be0455481af29ec0a1f3503f/coverage-7.14.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:01b7733daad0237daa01ef80fe2dfceffc911e6a17fa7b55d14aa8214eaaaecd", size = 263214, upload-time = "2026-05-26T20:41:25.419Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/a9/b2493c054c0e01a643266742ab45e15744e60743f9260cd930c7142b1124/coverage-7.14.1-cp314-cp314t-win32.whl", hash = "sha256:6adc5a36984624a70bf11d7184e20fa0a49aa7c47ffab43804106a1a695ea22e", size = 223624, upload-time = "2026-05-26T20:41:27.795Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/bd/3e1e6a57fccd2d7c83fcdf338e93ba98eb85c6e877dd34731ac585375490/coverage-7.14.1-cp314-cp314t-win_amd64.whl", hash = "sha256:ddf799247318f34dbcd2efa8c95a8d0642674e926bb1774cf9b63dfd2a389d1c", size = 224728, upload-time = "2026-05-26T20:41:30.098Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/d7/31066cf1d2f0c6c797fce911bcfa01dd35642dc6da992a950256097c5860/coverage-7.14.1-cp314-cp314t-win_arm64.whl", hash = "sha256:145986fe66647eb489f18d9a997567a3fd358584c4b5a808769113abc07466af", size = 222752, upload-time = "2026-05-26T20:41:32.123Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/3c/1a983b9a745d7f83d53f057bcc5bf79ba6a2bbc08266b3f0c7d6fe630c9b/coverage-7.14.1-py3-none-any.whl", hash = "sha256:a252f21c27e38347e60111a3266b03827422a7d5525951aceee313aa68bab1d2", size = 211815, upload-time = "2026-05-26T20:41:34.078Z" },
+]
+
+[package.optional-dependencies]
+toml = [
+    { name = "tomli", marker = "python_full_version <= '3.11'" },
+]
+
+[[package]]
+name = "diff-cover"
+version = "10.3.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "chardet" },
+    { name = "jinja2" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/35/21/057e816125c162662d2a2cc2ebcd72dd333e78e51678298d07dd3146011a/diff_cover-10.3.0.tar.gz", hash = "sha256:474dbc63e815fbb7567d7b7ca5b104123e96129f25426ebdbc9a1bdbb935b2c6", size = 106546, upload-time = "2026-05-30T14:17:14.32Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/83/0a/a96e57a7a3fca419cd5ceff0d13dee2166520fa67103fb82624ad64700fb/diff_cover-10.3.0-py3-none-any.whl", hash = "sha256:2e47d5ab3868d1e92131c11f364f3f4a8583c97123d3bbc6b6cc8ce0a4cc2202", size = 58989, upload-time = "2026-05-30T14:17:12.858Z" },
+]
+
+[[package]]
+name = "distlib"
+version = "0.4.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c9/02/bd72be9134d25ed783ecbbc38a539ffaefbf90c78418c7fb7229600dbac7/distlib-0.4.3.tar.gz", hash = "sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed", size = 615141, upload-time = "2026-06-12T08:04:52.847Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/02/08/9c41fb51ab5b43eb21674aff13df270e8ba6c4b29c8624e328dc7a9482af/distlib-0.4.3-py2.py3-none-any.whl", hash = "sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b", size = 470628, upload-time = "2026-06-12T08:04:50.506Z" },
+]
+
+[[package]]
+name = "filelock"
+version = "3.29.4"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e6/dc/be6cbe99670cd6e4ad387123647cb08e0c32975e223f82551e914c5568a6/filelock-3.29.4.tar.gz", hash = "sha256:10cdb3656fc44541cdf30652a93fb10ec6b05325620eb316bd26893e4201538a", size = 63028, upload-time = "2026-06-13T16:12:00.744Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/13/37/a065dc3bd6e49423a6532c642ca7378d3f467b1ef44c2800c937af7f9739/filelock-3.29.4-py3-none-any.whl", hash = "sha256:dac1648087d5115554850d113e7dd8c83ab2d38e3435dde2d4f163847e57b767", size = 42757, upload-time = "2026-06-13T16:11:59.582Z" },
+]
+
+[[package]]
+name = "frozenlist"
+version = "1.8.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/2d/f5/c831fac6cc817d26fd54c7eaccd04ef7e0288806943f7cc5bbf69f3ac1f0/frozenlist-1.8.0.tar.gz", hash = "sha256:3ede829ed8d842f6cd48fc7081d7a41001a56f1f38603f9d49bf3020d59a31ad", size = 45875, upload-time = "2025-10-06T05:38:17.865Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/bc/03/077f869d540370db12165c0aa51640a873fb661d8b315d1d4d67b284d7ac/frozenlist-1.8.0-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:09474e9831bc2b2199fad6da3c14c7b0fbdd377cce9d3d77131be28906cb7d84", size = 86912, upload-time = "2025-10-06T05:35:45.98Z" },
+    { url = "https://files.pythonhosted.org/packages/df/b5/7610b6bd13e4ae77b96ba85abea1c8cb249683217ef09ac9e0ae93f25a91/frozenlist-1.8.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:17c883ab0ab67200b5f964d2b9ed6b00971917d5d8a92df149dc2c9779208ee9", size = 50046, upload-time = "2025-10-06T05:35:47.009Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/ef/0e8f1fe32f8a53dd26bdd1f9347efe0778b0fddf62789ea683f4cc7d787d/frozenlist-1.8.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:fa47e444b8ba08fffd1c18e8cdb9a75db1b6a27f17507522834ad13ed5922b93", size = 50119, upload-time = "2025-10-06T05:35:48.38Z" },
+    { url = "https://files.pythonhosted.org/packages/11/b1/71a477adc7c36e5fb628245dfbdea2166feae310757dea848d02bd0689fd/frozenlist-1.8.0-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:2552f44204b744fba866e573be4c1f9048d6a324dfe14475103fd51613eb1d1f", size = 231067, upload-time = "2025-10-06T05:35:49.97Z" },
+    { url = "https://files.pythonhosted.org/packages/45/7e/afe40eca3a2dc19b9904c0f5d7edfe82b5304cb831391edec0ac04af94c2/frozenlist-1.8.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:957e7c38f250991e48a9a73e6423db1bb9dd14e722a10f6b8bb8e16a0f55f695", size = 233160, upload-time = "2025-10-06T05:35:51.729Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/aa/7416eac95603ce428679d273255ffc7c998d4132cfae200103f164b108aa/frozenlist-1.8.0-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:8585e3bb2cdea02fc88ffa245069c36555557ad3609e83be0ec71f54fd4abb52", size = 228544, upload-time = "2025-10-06T05:35:53.246Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/3d/2a2d1f683d55ac7e3875e4263d28410063e738384d3adc294f5ff3d7105e/frozenlist-1.8.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:edee74874ce20a373d62dc28b0b18b93f645633c2943fd90ee9d898550770581", size = 243797, upload-time = "2025-10-06T05:35:54.497Z" },
+    { url = "https://files.pythonhosted.org/packages/78/1e/2d5565b589e580c296d3bb54da08d206e797d941a83a6fdea42af23be79c/frozenlist-1.8.0-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c9a63152fe95756b85f31186bddf42e4c02c6321207fd6601a1c89ebac4fe567", size = 247923, upload-time = "2025-10-06T05:35:55.861Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/c3/65872fcf1d326a7f101ad4d86285c403c87be7d832b7470b77f6d2ed5ddc/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:b6db2185db9be0a04fecf2f241c70b63b1a242e2805be291855078f2b404dd6b", size = 230886, upload-time = "2025-10-06T05:35:57.399Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/76/ac9ced601d62f6956f03cc794f9e04c81719509f85255abf96e2510f4265/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:f4be2e3d8bc8aabd566f8d5b8ba7ecc09249d74ba3c9ed52e54dc23a293f0b92", size = 245731, upload-time = "2025-10-06T05:35:58.563Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/49/ecccb5f2598daf0b4a1415497eba4c33c1e8ce07495eb07d2860c731b8d5/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:c8d1634419f39ea6f5c427ea2f90ca85126b54b50837f31497f3bf38266e853d", size = 241544, upload-time = "2025-10-06T05:35:59.719Z" },
+    { url = "https://files.pythonhosted.org/packages/53/4b/ddf24113323c0bbcc54cb38c8b8916f1da7165e07b8e24a717b4a12cbf10/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:1a7fa382a4a223773ed64242dbe1c9c326ec09457e6b8428efb4118c685c3dfd", size = 241806, upload-time = "2025-10-06T05:36:00.959Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/fb/9b9a084d73c67175484ba2789a59f8eebebd0827d186a8102005ce41e1ba/frozenlist-1.8.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:11847b53d722050808926e785df837353bd4d75f1d494377e59b23594d834967", size = 229382, upload-time = "2025-10-06T05:36:02.22Z" },
+    { url = "https://files.pythonhosted.org/packages/95/a3/c8fb25aac55bf5e12dae5c5aa6a98f85d436c1dc658f21c3ac73f9fa95e5/frozenlist-1.8.0-cp311-cp311-win32.whl", hash = "sha256:27c6e8077956cf73eadd514be8fb04d77fc946a7fe9f7fe167648b0b9085cc25", size = 39647, upload-time = "2025-10-06T05:36:03.409Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/f5/603d0d6a02cfd4c8f2a095a54672b3cf967ad688a60fb9faf04fc4887f65/frozenlist-1.8.0-cp311-cp311-win_amd64.whl", hash = "sha256:ac913f8403b36a2c8610bbfd25b8013488533e71e62b4b4adce9c86c8cea905b", size = 44064, upload-time = "2025-10-06T05:36:04.368Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/16/c2c9ab44e181f043a86f9a8f84d5124b62dbcb3a02c0977ec72b9ac1d3e0/frozenlist-1.8.0-cp311-cp311-win_arm64.whl", hash = "sha256:d4d3214a0f8394edfa3e303136d0575eece0745ff2b47bd2cb2e66dd92d4351a", size = 39937, upload-time = "2025-10-06T05:36:05.669Z" },
+    { url = "https://files.pythonhosted.org/packages/69/29/948b9aa87e75820a38650af445d2ef2b6b8a6fab1a23b6bb9e4ef0be2d59/frozenlist-1.8.0-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:78f7b9e5d6f2fdb88cdde9440dc147259b62b9d3b019924def9f6478be254ac1", size = 87782, upload-time = "2025-10-06T05:36:06.649Z" },
+    { url = "https://files.pythonhosted.org/packages/64/80/4f6e318ee2a7c0750ed724fa33a4bdf1eacdc5a39a7a24e818a773cd91af/frozenlist-1.8.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:229bf37d2e4acdaf808fd3f06e854a4a7a3661e871b10dc1f8f1896a3b05f18b", size = 50594, upload-time = "2025-10-06T05:36:07.69Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/94/5c8a2b50a496b11dd519f4a24cb5496cf125681dd99e94c604ccdea9419a/frozenlist-1.8.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f833670942247a14eafbb675458b4e61c82e002a148f49e68257b79296e865c4", size = 50448, upload-time = "2025-10-06T05:36:08.78Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/bd/d91c5e39f490a49df14320f4e8c80161cfcce09f1e2cde1edd16a551abb3/frozenlist-1.8.0-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:494a5952b1c597ba44e0e78113a7266e656b9794eec897b19ead706bd7074383", size = 242411, upload-time = "2025-10-06T05:36:09.801Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/83/f61505a05109ef3293dfb1ff594d13d64a2324ac3482be2cedc2be818256/frozenlist-1.8.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:96f423a119f4777a4a056b66ce11527366a8bb92f54e541ade21f2374433f6d4", size = 243014, upload-time = "2025-10-06T05:36:11.394Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/cb/cb6c7b0f7d4023ddda30cf56b8b17494eb3a79e3fda666bf735f63118b35/frozenlist-1.8.0-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3462dd9475af2025c31cc61be6652dfa25cbfb56cbbf52f4ccfe029f38decaf8", size = 234909, upload-time = "2025-10-06T05:36:12.598Z" },
+    { url = "https://files.pythonhosted.org/packages/31/c5/cd7a1f3b8b34af009fb17d4123c5a778b44ae2804e3ad6b86204255f9ec5/frozenlist-1.8.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c4c800524c9cd9bac5166cd6f55285957fcfc907db323e193f2afcd4d9abd69b", size = 250049, upload-time = "2025-10-06T05:36:14.065Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/01/2f95d3b416c584a1e7f0e1d6d31998c4a795f7544069ee2e0962a4b60740/frozenlist-1.8.0-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d6a5df73acd3399d893dafc71663ad22534b5aa4f94e8a2fabfe856c3c1b6a52", size = 256485, upload-time = "2025-10-06T05:36:15.39Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/03/024bf7720b3abaebcff6d0793d73c154237b85bdf67b7ed55e5e9596dc9a/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:405e8fe955c2280ce66428b3ca55e12b3c4e9c336fb2103a4937e891c69a4a29", size = 237619, upload-time = "2025-10-06T05:36:16.558Z" },
+    { url = "https://files.pythonhosted.org/packages/69/fa/f8abdfe7d76b731f5d8bd217827cf6764d4f1d9763407e42717b4bed50a0/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:908bd3f6439f2fef9e85031b59fd4f1297af54415fb60e4254a95f75b3cab3f3", size = 250320, upload-time = "2025-10-06T05:36:17.821Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/3c/b051329f718b463b22613e269ad72138cc256c540f78a6de89452803a47d/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:294e487f9ec720bd8ffcebc99d575f7eff3568a08a253d1ee1a0378754b74143", size = 246820, upload-time = "2025-10-06T05:36:19.046Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/ae/58282e8f98e444b3f4dd42448ff36fa38bef29e40d40f330b22e7108f565/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:74c51543498289c0c43656701be6b077f4b265868fa7f8a8859c197006efb608", size = 250518, upload-time = "2025-10-06T05:36:20.763Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/96/007e5944694d66123183845a106547a15944fbbb7154788cbf7272789536/frozenlist-1.8.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:776f352e8329135506a1d6bf16ac3f87bc25b28e765949282dcc627af36123aa", size = 239096, upload-time = "2025-10-06T05:36:22.129Z" },
+    { url = "https://files.pythonhosted.org/packages/66/bb/852b9d6db2fa40be96f29c0d1205c306288f0684df8fd26ca1951d461a56/frozenlist-1.8.0-cp312-cp312-win32.whl", hash = "sha256:433403ae80709741ce34038da08511d4a77062aa924baf411ef73d1146e74faf", size = 39985, upload-time = "2025-10-06T05:36:23.661Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/af/38e51a553dd66eb064cdf193841f16f077585d4d28394c2fa6235cb41765/frozenlist-1.8.0-cp312-cp312-win_amd64.whl", hash = "sha256:34187385b08f866104f0c0617404c8eb08165ab1272e884abc89c112e9c00746", size = 44591, upload-time = "2025-10-06T05:36:24.958Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/06/1dc65480ab147339fecc70797e9c2f69d9cea9cf38934ce08df070fdb9cb/frozenlist-1.8.0-cp312-cp312-win_arm64.whl", hash = "sha256:fe3c58d2f5db5fbd18c2987cba06d51b0529f52bc3a6cdc33d3f4eab725104bd", size = 40102, upload-time = "2025-10-06T05:36:26.333Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/40/0832c31a37d60f60ed79e9dfb5a92e1e2af4f40a16a29abcc7992af9edff/frozenlist-1.8.0-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:8d92f1a84bb12d9e56f818b3a746f3efba93c1b63c8387a73dde655e1e42282a", size = 85717, upload-time = "2025-10-06T05:36:27.341Z" },
+    { url = "https://files.pythonhosted.org/packages/30/ba/b0b3de23f40bc55a7057bd38434e25c34fa48e17f20ee273bbde5e0650f3/frozenlist-1.8.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:96153e77a591c8adc2ee805756c61f59fef4cf4073a9275ee86fe8cba41241f7", size = 49651, upload-time = "2025-10-06T05:36:28.855Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/ab/6e5080ee374f875296c4243c381bbdef97a9ac39c6e3ce1d5f7d42cb78d6/frozenlist-1.8.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f21f00a91358803399890ab167098c131ec2ddd5f8f5fd5fe9c9f2c6fcd91e40", size = 49417, upload-time = "2025-10-06T05:36:29.877Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/4e/e4691508f9477ce67da2015d8c00acd751e6287739123113a9fca6f1604e/frozenlist-1.8.0-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:fb30f9626572a76dfe4293c7194a09fb1fe93ba94c7d4f720dfae3b646b45027", size = 234391, upload-time = "2025-10-06T05:36:31.301Z" },
+    { url = "https://files.pythonhosted.org/packages/40/76/c202df58e3acdf12969a7895fd6f3bc016c642e6726aa63bd3025e0fc71c/frozenlist-1.8.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eaa352d7047a31d87dafcacbabe89df0aa506abb5b1b85a2fb91bc3faa02d822", size = 233048, upload-time = "2025-10-06T05:36:32.531Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/c0/8746afb90f17b73ca5979c7a3958116e105ff796e718575175319b5bb4ce/frozenlist-1.8.0-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:03ae967b4e297f58f8c774c7eabcce57fe3c2434817d4385c50661845a058121", size = 226549, upload-time = "2025-10-06T05:36:33.706Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/eb/4c7eefc718ff72f9b6c4893291abaae5fbc0c82226a32dcd8ef4f7a5dbef/frozenlist-1.8.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f6292f1de555ffcc675941d65fffffb0a5bcd992905015f85d0592201793e0e5", size = 239833, upload-time = "2025-10-06T05:36:34.947Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/4e/e5c02187cf704224f8b21bee886f3d713ca379535f16893233b9d672ea71/frozenlist-1.8.0-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:29548f9b5b5e3460ce7378144c3010363d8035cea44bc0bf02d57f5a685e084e", size = 245363, upload-time = "2025-10-06T05:36:36.534Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/96/cb85ec608464472e82ad37a17f844889c36100eed57bea094518bf270692/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:ec3cc8c5d4084591b4237c0a272cc4f50a5b03396a47d9caaf76f5d7b38a4f11", size = 229314, upload-time = "2025-10-06T05:36:38.582Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/6f/4ae69c550e4cee66b57887daeebe006fe985917c01d0fff9caab9883f6d0/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:517279f58009d0b1f2e7c1b130b377a349405da3f7621ed6bfae50b10adf20c1", size = 243365, upload-time = "2025-10-06T05:36:40.152Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/58/afd56de246cf11780a40a2c28dc7cbabbf06337cc8ddb1c780a2d97e88d8/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:db1e72ede2d0d7ccb213f218df6a078a9c09a7de257c2fe8fcef16d5925230b1", size = 237763, upload-time = "2025-10-06T05:36:41.355Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/36/cdfaf6ed42e2644740d4a10452d8e97fa1c062e2a8006e4b09f1b5fd7d63/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:b4dec9482a65c54a5044486847b8a66bf10c9cb4926d42927ec4e8fd5db7fed8", size = 240110, upload-time = "2025-10-06T05:36:42.716Z" },
+    { url = "https://files.pythonhosted.org/packages/03/a8/9ea226fbefad669f11b52e864c55f0bd57d3c8d7eb07e9f2e9a0b39502e1/frozenlist-1.8.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:21900c48ae04d13d416f0e1e0c4d81f7931f73a9dfa0b7a8746fb2fe7dd970ed", size = 233717, upload-time = "2025-10-06T05:36:44.251Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/0b/1b5531611e83ba7d13ccc9988967ea1b51186af64c42b7a7af465dcc9568/frozenlist-1.8.0-cp313-cp313-win32.whl", hash = "sha256:8b7b94a067d1c504ee0b16def57ad5738701e4ba10cec90529f13fa03c833496", size = 39628, upload-time = "2025-10-06T05:36:45.423Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/cf/174c91dbc9cc49bc7b7aab74d8b734e974d1faa8f191c74af9b7e80848e6/frozenlist-1.8.0-cp313-cp313-win_amd64.whl", hash = "sha256:878be833caa6a3821caf85eb39c5ba92d28e85df26d57afb06b35b2efd937231", size = 43882, upload-time = "2025-10-06T05:36:46.796Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/17/502cd212cbfa96eb1388614fe39a3fc9ab87dbbe042b66f97acb57474834/frozenlist-1.8.0-cp313-cp313-win_arm64.whl", hash = "sha256:44389d135b3ff43ba8cc89ff7f51f5a0bb6b63d829c8300f79a2fe4fe61bcc62", size = 39676, upload-time = "2025-10-06T05:36:47.8Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/5c/3bbfaa920dfab09e76946a5d2833a7cbdf7b9b4a91c714666ac4855b88b4/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:e25ac20a2ef37e91c1b39938b591457666a0fa835c7783c3a8f33ea42870db94", size = 89235, upload-time = "2025-10-06T05:36:48.78Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/d6/f03961ef72166cec1687e84e8925838442b615bd0b8854b54923ce5b7b8a/frozenlist-1.8.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:07cdca25a91a4386d2e76ad992916a85038a9b97561bf7a3fd12d5d9ce31870c", size = 50742, upload-time = "2025-10-06T05:36:49.837Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/bb/a6d12b7ba4c3337667d0e421f7181c82dda448ce4e7ad7ecd249a16fa806/frozenlist-1.8.0-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:4e0c11f2cc6717e0a741f84a527c52616140741cd812a50422f83dc31749fb52", size = 51725, upload-time = "2025-10-06T05:36:50.851Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/71/d1fed0ffe2c2ccd70b43714c6cab0f4188f09f8a67a7914a6b46ee30f274/frozenlist-1.8.0-cp313-cp313t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:b3210649ee28062ea6099cfda39e147fa1bc039583c8ee4481cb7811e2448c51", size = 284533, upload-time = "2025-10-06T05:36:51.898Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/1f/fb1685a7b009d89f9bf78a42d94461bc06581f6e718c39344754a5d9bada/frozenlist-1.8.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:581ef5194c48035a7de2aefc72ac6539823bb71508189e5de01d60c9dcd5fa65", size = 292506, upload-time = "2025-10-06T05:36:53.101Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/3b/b991fe1612703f7e0d05c0cf734c1b77aaf7c7d321df4572e8d36e7048c8/frozenlist-1.8.0-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:3ef2d026f16a2b1866e1d86fc4e1291e1ed8a387b2c333809419a2f8b3a77b82", size = 274161, upload-time = "2025-10-06T05:36:54.309Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/ec/c5c618767bcdf66e88945ec0157d7f6c4a1322f1473392319b7a2501ded7/frozenlist-1.8.0-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5500ef82073f599ac84d888e3a8c1f77ac831183244bfd7f11eaa0289fb30714", size = 294676, upload-time = "2025-10-06T05:36:55.566Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/ce/3934758637d8f8a88d11f0585d6495ef54b2044ed6ec84492a91fa3b27aa/frozenlist-1.8.0-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:50066c3997d0091c411a66e710f4e11752251e6d2d73d70d8d5d4c76442a199d", size = 300638, upload-time = "2025-10-06T05:36:56.758Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/4f/a7e4d0d467298f42de4b41cbc7ddaf19d3cfeabaf9ff97c20c6c7ee409f9/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:5c1c8e78426e59b3f8005e9b19f6ff46e5845895adbde20ece9218319eca6506", size = 283067, upload-time = "2025-10-06T05:36:57.965Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/48/c7b163063d55a83772b268e6d1affb960771b0e203b632cfe09522d67ea5/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:eefdba20de0d938cec6a89bd4d70f346a03108a19b9df4248d3cf0d88f1b0f51", size = 292101, upload-time = "2025-10-06T05:36:59.237Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/d0/2366d3c4ecdc2fd391e0afa6e11500bfba0ea772764d631bbf82f0136c9d/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:cf253e0e1c3ceb4aaff6df637ce033ff6535fb8c70a764a8f46aafd3d6ab798e", size = 289901, upload-time = "2025-10-06T05:37:00.811Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/94/daff920e82c1b70e3618a2ac39fbc01ae3e2ff6124e80739ce5d71c9b920/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:032efa2674356903cd0261c4317a561a6850f3ac864a63fc1583147fb05a79b0", size = 289395, upload-time = "2025-10-06T05:37:02.115Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/20/bba307ab4235a09fdcd3cc5508dbabd17c4634a1af4b96e0f69bfe551ebd/frozenlist-1.8.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:6da155091429aeba16851ecb10a9104a108bcd32f6c1642867eadaee401c1c41", size = 283659, upload-time = "2025-10-06T05:37:03.711Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/00/04ca1c3a7a124b6de4f8a9a17cc2fcad138b4608e7a3fc5877804b8715d7/frozenlist-1.8.0-cp313-cp313t-win32.whl", hash = "sha256:0f96534f8bfebc1a394209427d0f8a63d343c9779cda6fc25e8e121b5fd8555b", size = 43492, upload-time = "2025-10-06T05:37:04.915Z" },
+    { url = "https://files.pythonhosted.org/packages/59/5e/c69f733a86a94ab10f68e496dc6b7e8bc078ebb415281d5698313e3af3a1/frozenlist-1.8.0-cp313-cp313t-win_amd64.whl", hash = "sha256:5d63a068f978fc69421fb0e6eb91a9603187527c86b7cd3f534a5b77a592b888", size = 48034, upload-time = "2025-10-06T05:37:06.343Z" },
+    { url = "https://files.pythonhosted.org/packages/16/6c/be9d79775d8abe79b05fa6d23da99ad6e7763a1d080fbae7290b286093fd/frozenlist-1.8.0-cp313-cp313t-win_arm64.whl", hash = "sha256:bf0a7e10b077bf5fb9380ad3ae8ce20ef919a6ad93b4552896419ac7e1d8e042", size = 41749, upload-time = "2025-10-06T05:37:07.431Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/c8/85da824b7e7b9b6e7f7705b2ecaf9591ba6f79c1177f324c2735e41d36a2/frozenlist-1.8.0-cp314-cp314-macosx_10_13_universal2.whl", hash = "sha256:cee686f1f4cadeb2136007ddedd0aaf928ab95216e7691c63e50a8ec066336d0", size = 86127, upload-time = "2025-10-06T05:37:08.438Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/e8/a1185e236ec66c20afd72399522f142c3724c785789255202d27ae992818/frozenlist-1.8.0-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:119fb2a1bd47307e899c2fac7f28e85b9a543864df47aa7ec9d3c1b4545f096f", size = 49698, upload-time = "2025-10-06T05:37:09.48Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/93/72b1736d68f03fda5fdf0f2180fb6caaae3894f1b854d006ac61ecc727ee/frozenlist-1.8.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:4970ece02dbc8c3a92fcc5228e36a3e933a01a999f7094ff7c23fbd2beeaa67c", size = 49749, upload-time = "2025-10-06T05:37:10.569Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/b2/fabede9fafd976b991e9f1b9c8c873ed86f202889b864756f240ce6dd855/frozenlist-1.8.0-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:cba69cb73723c3f329622e34bdbf5ce1f80c21c290ff04256cff1cd3c2036ed2", size = 231298, upload-time = "2025-10-06T05:37:11.993Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/3b/d9b1e0b0eed36e70477ffb8360c49c85c8ca8ef9700a4e6711f39a6e8b45/frozenlist-1.8.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:778a11b15673f6f1df23d9586f83c4846c471a8af693a22e066508b77d201ec8", size = 232015, upload-time = "2025-10-06T05:37:13.194Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/94/be719d2766c1138148564a3960fc2c06eb688da592bdc25adcf856101be7/frozenlist-1.8.0-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0325024fe97f94c41c08872db482cf8ac4800d80e79222c6b0b7b162d5b13686", size = 225038, upload-time = "2025-10-06T05:37:14.577Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/09/6712b6c5465f083f52f50cf74167b92d4ea2f50e46a9eea0523d658454ae/frozenlist-1.8.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:97260ff46b207a82a7567b581ab4190bd4dfa09f4db8a8b49d1a958f6aa4940e", size = 240130, upload-time = "2025-10-06T05:37:15.781Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/d4/cd065cdcf21550b54f3ce6a22e143ac9e4836ca42a0de1022da8498eac89/frozenlist-1.8.0-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:54b2077180eb7f83dd52c40b2750d0a9f175e06a42e3213ce047219de902717a", size = 242845, upload-time = "2025-10-06T05:37:17.037Z" },
+    { url = "https://files.pythonhosted.org/packages/62/c3/f57a5c8c70cd1ead3d5d5f776f89d33110b1addae0ab010ad774d9a44fb9/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:2f05983daecab868a31e1da44462873306d3cbfd76d1f0b5b69c473d21dbb128", size = 229131, upload-time = "2025-10-06T05:37:18.221Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/52/232476fe9cb64f0742f3fde2b7d26c1dac18b6d62071c74d4ded55e0ef94/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:33f48f51a446114bc5d251fb2954ab0164d5be02ad3382abcbfe07e2531d650f", size = 240542, upload-time = "2025-10-06T05:37:19.771Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/85/07bf3f5d0fb5414aee5f47d33c6f5c77bfe49aac680bfece33d4fdf6a246/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:154e55ec0655291b5dd1b8731c637ecdb50975a2ae70c606d100750a540082f7", size = 237308, upload-time = "2025-10-06T05:37:20.969Z" },
+    { url = "https://files.pythonhosted.org/packages/11/99/ae3a33d5befd41ac0ca2cc7fd3aa707c9c324de2e89db0e0f45db9a64c26/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:4314debad13beb564b708b4a496020e5306c7333fa9a3ab90374169a20ffab30", size = 238210, upload-time = "2025-10-06T05:37:22.252Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/60/b1d2da22f4970e7a155f0adde9b1435712ece01b3cd45ba63702aea33938/frozenlist-1.8.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:073f8bf8becba60aa931eb3bc420b217bb7d5b8f4750e6f8b3be7f3da85d38b7", size = 231972, upload-time = "2025-10-06T05:37:23.5Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/ab/945b2f32de889993b9c9133216c068b7fcf257d8595a0ac420ac8677cab0/frozenlist-1.8.0-cp314-cp314-win32.whl", hash = "sha256:bac9c42ba2ac65ddc115d930c78d24ab8d4f465fd3fc473cdedfccadb9429806", size = 40536, upload-time = "2025-10-06T05:37:25.581Z" },
+    { url = "https://files.pythonhosted.org/packages/59/ad/9caa9b9c836d9ad6f067157a531ac48b7d36499f5036d4141ce78c230b1b/frozenlist-1.8.0-cp314-cp314-win_amd64.whl", hash = "sha256:3e0761f4d1a44f1d1a47996511752cf3dcec5bbdd9cc2b4fe595caf97754b7a0", size = 44330, upload-time = "2025-10-06T05:37:26.928Z" },
+    { url = "https://files.pythonhosted.org/packages/82/13/e6950121764f2676f43534c555249f57030150260aee9dcf7d64efda11dd/frozenlist-1.8.0-cp314-cp314-win_arm64.whl", hash = "sha256:d1eaff1d00c7751b7c6662e9c5ba6eb2c17a2306ba5e2a37f24ddf3cc953402b", size = 40627, upload-time = "2025-10-06T05:37:28.075Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/c7/43200656ecc4e02d3f8bc248df68256cd9572b3f0017f0a0c4e93440ae23/frozenlist-1.8.0-cp314-cp314t-macosx_10_13_universal2.whl", hash = "sha256:d3bb933317c52d7ea5004a1c442eef86f426886fba134ef8cf4226ea6ee1821d", size = 89238, upload-time = "2025-10-06T05:37:29.373Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/29/55c5f0689b9c0fb765055629f472c0de484dcaf0acee2f7707266ae3583c/frozenlist-1.8.0-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:8009897cdef112072f93a0efdce29cd819e717fd2f649ee3016efd3cd885a7ed", size = 50738, upload-time = "2025-10-06T05:37:30.792Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/7d/b7282a445956506fa11da8c2db7d276adcbf2b17d8bb8407a47685263f90/frozenlist-1.8.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:2c5dcbbc55383e5883246d11fd179782a9d07a986c40f49abe89ddf865913930", size = 51739, upload-time = "2025-10-06T05:37:32.127Z" },
+    { url = "https://files.pythonhosted.org/packages/62/1c/3d8622e60d0b767a5510d1d3cf21065b9db874696a51ea6d7a43180a259c/frozenlist-1.8.0-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:39ecbc32f1390387d2aa4f5a995e465e9e2f79ba3adcac92d68e3e0afae6657c", size = 284186, upload-time = "2025-10-06T05:37:33.21Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/14/aa36d5f85a89679a85a1d44cd7a6657e0b1c75f61e7cad987b203d2daca8/frozenlist-1.8.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:92db2bf818d5cc8d9c1f1fc56b897662e24ea5adb36ad1f1d82875bd64e03c24", size = 292196, upload-time = "2025-10-06T05:37:36.107Z" },
+    { url = "https://files.pythonhosted.org/packages/05/23/6bde59eb55abd407d34f77d39a5126fb7b4f109a3f611d3929f14b700c66/frozenlist-1.8.0-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:2dc43a022e555de94c3b68a4ef0b11c4f747d12c024a520c7101709a2144fb37", size = 273830, upload-time = "2025-10-06T05:37:37.663Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/3f/22cff331bfad7a8afa616289000ba793347fcd7bc275f3b28ecea2a27909/frozenlist-1.8.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:cb89a7f2de3602cfed448095bab3f178399646ab7c61454315089787df07733a", size = 294289, upload-time = "2025-10-06T05:37:39.261Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/89/5b057c799de4838b6c69aa82b79705f2027615e01be996d2486a69ca99c4/frozenlist-1.8.0-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:33139dc858c580ea50e7e60a1b0ea003efa1fd42e6ec7fdbad78fff65fad2fd2", size = 300318, upload-time = "2025-10-06T05:37:43.213Z" },
+    { url = "https://files.pythonhosted.org/packages/30/de/2c22ab3eb2a8af6d69dc799e48455813bab3690c760de58e1bf43b36da3e/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:168c0969a329b416119507ba30b9ea13688fafffac1b7822802537569a1cb0ef", size = 282814, upload-time = "2025-10-06T05:37:45.337Z" },
+    { url = "https://files.pythonhosted.org/packages/59/f7/970141a6a8dbd7f556d94977858cfb36fa9b66e0892c6dd780d2219d8cd8/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:28bd570e8e189d7f7b001966435f9dac6718324b5be2990ac496cf1ea9ddb7fe", size = 291762, upload-time = "2025-10-06T05:37:46.657Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/15/ca1adae83a719f82df9116d66f5bb28bb95557b3951903d39135620ef157/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:b2a095d45c5d46e5e79ba1e5b9cb787f541a8dee0433836cea4b96a2c439dcd8", size = 289470, upload-time = "2025-10-06T05:37:47.946Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/83/dca6dc53bf657d371fbc88ddeb21b79891e747189c5de990b9dfff2ccba1/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:eab8145831a0d56ec9c4139b6c3e594c7a83c2c8be25d5bcf2d86136a532287a", size = 289042, upload-time = "2025-10-06T05:37:49.499Z" },
+    { url = "https://files.pythonhosted.org/packages/96/52/abddd34ca99be142f354398700536c5bd315880ed0a213812bc491cff5e4/frozenlist-1.8.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:974b28cf63cc99dfb2188d8d222bc6843656188164848c4f679e63dae4b0708e", size = 283148, upload-time = "2025-10-06T05:37:50.745Z" },
+    { url = "https://files.pythonhosted.org/packages/af/d3/76bd4ed4317e7119c2b7f57c3f6934aba26d277acc6309f873341640e21f/frozenlist-1.8.0-cp314-cp314t-win32.whl", hash = "sha256:342c97bf697ac5480c0a7ec73cd700ecfa5a8a40ac923bd035484616efecc2df", size = 44676, upload-time = "2025-10-06T05:37:52.222Z" },
+    { url = "https://files.pythonhosted.org/packages/89/76/c615883b7b521ead2944bb3480398cbb07e12b7b4e4d073d3752eb721558/frozenlist-1.8.0-cp314-cp314t-win_amd64.whl", hash = "sha256:06be8f67f39c8b1dc671f5d83aaefd3358ae5cdcf8314552c57e7ed3e6475bdd", size = 49451, upload-time = "2025-10-06T05:37:53.425Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/a3/5982da14e113d07b325230f95060e2169f5311b1017ea8af2a29b374c289/frozenlist-1.8.0-cp314-cp314t-win_arm64.whl", hash = "sha256:102e6314ca4da683dca92e3b1355490fed5f313b768500084fbe6371fddfdb79", size = 42507, upload-time = "2025-10-06T05:37:54.513Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/9a/e35b4a917281c0b8419d4207f4334c8e8c5dbf4f3f5f9ada73958d937dcc/frozenlist-1.8.0-py3-none-any.whl", hash = "sha256:0c18a16eab41e82c295618a77502e17b195883241c563b00f0aa5106fc4eaa0d", size = 13409, upload-time = "2025-10-06T05:38:16.721Z" },
+]
+
+[[package]]
+name = "grpcio"
+version = "1.81.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b0/b5/1ff353970a87eda4c98251e34d2dfd214abd4982dc89119c9252a2a482d2/grpcio-1.81.1.tar.gz", hash = "sha256:6fa10a767143a5e82e8eaab53918af0cd8909a57a27f8cb2288b80a613ac671b", size = 13026582, upload-time = "2026-06-11T12:46:51.673Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/52/ea/1c2fa386b718ff493225e61cfc052ef400b4d6ffc54cbe261026432624b5/grpcio-1.81.1-cp311-cp311-linux_armv7l.whl", hash = "sha256:d71d30f2d92f67d944631c523713934fee37292469e182ebcd2c1dd8a64ce53f", size = 6093112, upload-time = "2026-06-11T12:44:52.131Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/18/acf45fa8bd1bc5d7b0c2fd3dc4c209379fbd5bb396b440b68a83342226b7/grpcio-1.81.1-cp311-cp311-macosx_11_0_universal2.whl", hash = "sha256:b137f4bf3ada9dc44d411478decc6ff09a79ed30b306cd2abaa98408c3588137", size = 12074277, upload-time = "2026-06-11T12:44:55.354Z" },
+    { url = "https://files.pythonhosted.org/packages/48/d7/ee86a60699b7db039f772a2c4a7e4facc7138984ff42c0130933a0063884/grpcio-1.81.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:a3acb384427816dd5d470f47e62137b87f74da694faa8a50147012cf40df276a", size = 6640348, upload-time = "2026-06-11T12:44:59.223Z" },
+    { url = "https://files.pythonhosted.org/packages/26/ee/d2de5e47378ffc207d476c230fea3be4d2601edbce9995f4fe45535d4896/grpcio-1.81.1-cp311-cp311-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:f9a0ebbe45c29b5e5866593c12b78bd9035f0f0f0d4bc8361680cd580d99db49", size = 7331842, upload-time = "2026-06-11T12:45:02.001Z" },
+    { url = "https://files.pythonhosted.org/packages/23/d6/abeda5c2b896a0b341584fe5ac411bbf72e197a9a374c355fb90965e08d2/grpcio-1.81.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:0a37165cc80b1a368384b383e63a4c38116a10467ae44c904d2d7468c4470ec2", size = 6842229, upload-time = "2026-06-11T12:45:04.76Z" },
+    { url = "https://files.pythonhosted.org/packages/10/1c/1f0da7d590b4aeee006826ba568d0e419ca14b23e18f901a3da3e9fba613/grpcio-1.81.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6282caffb41ec326d4cb67ca9cf53b739d1b2f975a2acb498c7418e9f7d9a416", size = 7446096, upload-time = "2026-06-11T12:45:07.499Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/81/5c505d508f7c887aa7982d21443a4126597c80d34b0bcf40f9cec576d7f3/grpcio-1.81.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:a35009284d0d3d5c2c9601c164a911b8b4331608d98a9a66d47d97bb2f522b70", size = 8445238, upload-time = "2026-06-11T12:45:10.243Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/b2/524847365122ee509ca17bcc4e092198b700e94af7bfd5bb5e6dd9f3ee66/grpcio-1.81.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:1b22c80559854b789a01fd89e8929b3798a156c0829b5282a8939f33ad4115ad", size = 7873989, upload-time = "2026-06-11T12:45:13.102Z" },
+    { url = "https://files.pythonhosted.org/packages/18/fa/07c037c50b006909d1d13a5848774f8aa7b242f70dc03a035c64eea0e6db/grpcio-1.81.1-cp311-cp311-win32.whl", hash = "sha256:428bec0161b48d8cf583c068591bc0016d0d9cfff52462b72b3884861ea768c5", size = 4202223, upload-time = "2026-06-11T12:45:16.166Z" },
+    { url = "https://files.pythonhosted.org/packages/41/ed/6bff15376920942fac6b95b9802752b837437172c9e8fc2d3170546b89cc/grpcio-1.81.1-cp311-cp311-win_amd64.whl", hash = "sha256:30e825f6848d9f18bba350ed6c75c1b02a0b5184474a31db9a32b1fa66fd8c79", size = 4941303, upload-time = "2026-06-11T12:45:18.724Z" },
+    { url = "https://files.pythonhosted.org/packages/85/07/9a979c81738863a738dc23d65177056e71fbb2db817740ed870b33434e7a/grpcio-1.81.1-cp312-cp312-linux_armv7l.whl", hash = "sha256:8b39472beafc0bdcafc4c8c73ad082ebfdb449d566897a61e7acb4fa88089115", size = 6053264, upload-time = "2026-06-11T12:45:21.017Z" },
+    { url = "https://files.pythonhosted.org/packages/75/95/539706ca0d3bd40dbad583dc56fd883da941f37556b629132da5762781b9/grpcio-1.81.1-cp312-cp312-macosx_11_0_universal2.whl", hash = "sha256:12b7524c88d4026d3dcb7b0ebe16b6714f3b4af402ddd0f0639ab064a00c87c3", size = 12052560, upload-time = "2026-06-11T12:45:23.652Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/44/f257b7e0bd69c93b06c6cb8ac8d1b901ccb42bedabd83c1a4c77a71f8810/grpcio-1.81.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1e123f9b37edb8375fd74130d1f69c944bbf0a7b06761ae7211154b8759e94d2", size = 6595983, upload-time = "2026-06-11T12:45:26.963Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/f3/19782aa04c960968bef8c5539329d8e3bbc3364e2e46d19eb5e5cc5e43b7/grpcio-1.81.1-cp312-cp312-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:2c2e2ae6867c2966b8daccc836d54a13218e0007e9a490aeb81dd05be64d22d7", size = 7303455, upload-time = "2026-06-11T12:45:29.707Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/8c/dea020b6d91508cd84463917a63149ec196ee7db505d032ae43fcb3303b9/grpcio-1.81.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:766bc7c9a9c340342f4c864ccbda8e78111e4751f13b895812b9c148fb79e9d0", size = 6809167, upload-time = "2026-06-11T12:45:32.52Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/c7/3030dd940408083bd32cd95d634777a71605ade4887154d93e8a89244946/grpcio-1.81.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:b259a04a737cb3496be0901328eb8b7552ed8df4865d8c8f1cf1bffcfc0776a3", size = 7412536, upload-time = "2026-06-11T12:45:35.403Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/dd/1172a9e42b168edcafefad6115346ef619a3fc02158bb170e66ced24bcdd/grpcio-1.81.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:85b10a45b8993d195c4f3ff57025b8d1e11834909ee475c403bfa60cb4caefaf", size = 8408276, upload-time = "2026-06-11T12:45:37.78Z" },
+    { url = "https://files.pythonhosted.org/packages/25/7a/71437c7f3596e5246155c515852795a85a1a8d228190212432b13b97a95d/grpcio-1.81.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:8ea1936c26b99999b27479853039a7f34713f56c49375ad52b38535ec93a796c", size = 7849660, upload-time = "2026-06-11T12:45:40.627Z" },
+    { url = "https://files.pythonhosted.org/packages/65/40/7debc0da45d2efebafb82da75644be347497fe4ee250514b8cd3b86ae8bf/grpcio-1.81.1-cp312-cp312-win32.whl", hash = "sha256:a185a04039df6cae8648bc8ab6d6fde7bf94f7188ecf7828e76ac52eef1e41d6", size = 4185819, upload-time = "2026-06-11T12:45:43.027Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/b9/8fe3ba5ed462067774ebc1f9c7f26aa7ebcc280ddd476be107153de1339e/grpcio-1.81.1-cp312-cp312-win_amd64.whl", hash = "sha256:3ad74f8bb1a18963914c5452d289422830b39459e8776ebbcd207be1fbfb1d94", size = 4930461, upload-time = "2026-06-11T12:45:45.775Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/42/dcc2e4b600538ef18327c0839d56b7d3c3812337c5d710df5877dbb39b1e/grpcio-1.81.1-cp313-cp313-linux_armv7l.whl", hash = "sha256:b10e1ff4756ed27d5a29d7fc79cfce7ef1ff56ad20025b89bac7cf79e09abbbe", size = 6054466, upload-time = "2026-06-11T12:45:48.43Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/4a/a36e03210183a8a7d4c80c3936acee679f4bd77d5861f369db47b2cc5f05/grpcio-1.81.1-cp313-cp313-macosx_11_0_universal2.whl", hash = "sha256:819edbdcb42ab8598b494bcf0222684bbb7a3c772bd1b1f0be7e029a6063c28e", size = 12048795, upload-time = "2026-06-11T12:45:54.011Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/d5/d68e30b29098f63beab6fe501100fe82674ff142b32c672532da86a99b3a/grpcio-1.81.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c5bf2dc311127d91230cc79b92188c082634a06cf66c5234db49a43b910183b0", size = 6599094, upload-time = "2026-06-11T12:45:57.799Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/b3/e837954d279754f638a11cca5dcf6b24a005efb398984cefaf7735945a54/grpcio-1.81.1-cp313-cp313-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:e8ca6a1fcdb2943c9cbc1804a1baf3acb6071d72a471591678ded84218006e14", size = 7307182, upload-time = "2026-06-11T12:46:00.568Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/1e/b47957057e729adc6cdf519a47f8be2562b7140e280f1418443eb4022192/grpcio-1.81.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:e64dd101d380a115cc5a0c7856788adb535f1a4e21fc543775602f8be95180ae", size = 6810962, upload-time = "2026-06-11T12:46:03.312Z" },
+    { url = "https://files.pythonhosted.org/packages/40/26/569868e364e05b19ec8f969da53d230bcd89c962cd198f7c29943155c4d3/grpcio-1.81.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:98a07f9bf591e3a8919797bee1c53f026ba4acd587e5a4404c8e57c9ec36b2a5", size = 7415698, upload-time = "2026-06-11T12:46:06.005Z" },
+    { url = "https://files.pythonhosted.org/packages/36/0c/5440a0582cb5653fc42a6e262eeb22700943313f8076f9dc927491b20a59/grpcio-1.81.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:c261d74b1a945cf895a9d6eccd1685a8e837531beaab782da4d630a8d12deffb", size = 8407779, upload-time = "2026-06-11T12:46:08.84Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/aa/66fe9f39871d766987d869a03ee0842a026f499c7b1e62decb9e78a8088e/grpcio-1.81.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:58ad1131c300d3c9b933802b3cc4dc69d380822935ba50b28703156ea826fbf7", size = 7844521, upload-time = "2026-06-11T12:46:12.171Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/9e/69bb7194861bcd28fb3193261d4f9c3831b4446993f002cf59068943e7ab/grpcio-1.81.1-cp313-cp313-win32.whl", hash = "sha256:78e29211f26da2fdd0e9c6d2b79f489476140cf7029b6a64808ade7ca4156a42", size = 4182786, upload-time = "2026-06-11T12:46:15.192Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/20/3da8bb0d637feccdc3e1e419bb511ce93651ce7d54164f95de22cc0b8b34/grpcio-1.81.1-cp313-cp313-win_amd64.whl", hash = "sha256:edb59506291b647a30884b1d51a599d605f40b20af4a7dc3d33786a47a31de60", size = 4928648, upload-time = "2026-06-11T12:46:17.823Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/58/19414622b1bf6981bc9c05a365bd548e71876c89000083b3af489251e9c0/grpcio-1.81.1-cp314-cp314-linux_armv7l.whl", hash = "sha256:506f48f2f9c29b143fca3dad7b0d518c188b6c9648c75a2ae6e2d9f2c13a060b", size = 6055336, upload-time = "2026-06-11T12:46:20.557Z" },
+    { url = "https://files.pythonhosted.org/packages/32/f1/2ec88adb92b0eba970dd0e0e7dd086341daa3c75eba4f735f9e44bf684b0/grpcio-1.81.1-cp314-cp314-macosx_11_0_universal2.whl", hash = "sha256:d865db4a6318e1c1bea83292e0ed231090538fc4ca45425b0f0480eb338bbc6e", size = 12056279, upload-time = "2026-06-11T12:46:24.255Z" },
+    { url = "https://files.pythonhosted.org/packages/41/36/e8c5f8c6ec71de73733695ebc809e98b178b534ec6d8eaa31a7ebab4ad4c/grpcio-1.81.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e2aa72e3ce1770317ef534f63d397b55e130725f5149bd36077c3b539019db27", size = 6608225, upload-time = "2026-06-11T12:46:27.601Z" },
+    { url = "https://files.pythonhosted.org/packages/30/22/96fc577a845ab093326d9ab1adb874bd4936c8cf98ac8ed2f3db13a0a2fb/grpcio-1.81.1-cp314-cp314-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:0490c30c261eded63f3f354979f9dc4502a9fb944cccb60cd9dc85f5a7349854", size = 7306576, upload-time = "2026-06-11T12:46:30.514Z" },
+    { url = "https://files.pythonhosted.org/packages/76/7b/61dab5d5969f28d97fb1009cead1df0a5cd987d3315e1b37f18a4449f8bc/grpcio-1.81.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:410482da976329fe5f4067270401b12cf2bd552ff8020f054ecfaddb5475f9d6", size = 6812165, upload-time = "2026-06-11T12:46:33.699Z" },
+    { url = "https://files.pythonhosted.org/packages/82/78/6e501929d4f5f96462fd82fd9f0f06e5f9612207582b862868d68757b27d/grpcio-1.81.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:e3657301562ac3cb8018d30d0d3ebfa39932239f7b5703422057ef14b69949f5", size = 7422962, upload-time = "2026-06-11T12:46:36.511Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/7e/f2157589e66daa78ebb3165942d05a08bdea93b9d11c2bc1e172aef89685/grpcio-1.81.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:24c8e57504c8f45b237e40b99262d181071e5099a07053695b75d97bb53053a0", size = 8408176, upload-time = "2026-06-11T12:46:39.803Z" },
+    { url = "https://files.pythonhosted.org/packages/da/df/c6717fef716e00d235ffb96123baf6dce76d6004f6233fa767c502861460/grpcio-1.81.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:b427c19380991a4eaab2f6144b64b99b412043314c6bf4ab544f97bb31ee4190", size = 7846681, upload-time = "2026-06-11T12:46:43.013Z" },
+    { url = "https://files.pythonhosted.org/packages/36/84/3502e9f210a6a5c4438c8aca3f88edd2e04f6a27f3d41b26cf0a0024b096/grpcio-1.81.1-cp314-cp314-win32.whl", hash = "sha256:61233fe8951e5c85dff81c2458b6528624760166946b5b47ea150a589168411f", size = 4264615, upload-time = "2026-06-11T12:46:45.741Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/b0/4af731ff7492c68a96e4c71bfd0f4590acde92b31c6fe4894e6465c10ff6/grpcio-1.81.1-cp314-cp314-win_amd64.whl", hash = "sha256:3768a5ff1b2125e6f552e561b6b2dca0e64982d8949689b4df145cf8b98d7821", size = 5070275, upload-time = "2026-06-11T12:46:48.486Z" },
+]
+
+[[package]]
+name = "hypothesis"
+version = "6.155.7"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "sortedcontainers" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f2/55/983b6bc1b6b343a5ff6020388f9d0680ab477be59a731517e6c4a0387100/hypothesis-6.155.7.tar.gz", hash = "sha256:d8d6091753d0669db3c90c5e5b346cb37c72f3dd9378c8413acb1fd5da63f7ea", size = 478291, upload-time = "2026-06-21T05:54:31.573Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/01/f8/c151e196d4f397ed9436a071e52666c70a2f021138dea828b0a461e245db/hypothesis-6.155.7-py3-none-any.whl", hash = "sha256:9f634bdb1f9e9b8ab6ba09431cf2deedb750c96978125a6fb3c5a0f6c6db4131", size = 544762, upload-time = "2026-06-21T05:54:29.506Z" },
+]
+
+[[package]]
+name = "identify"
+version = "2.6.19"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/52/63/51723b5f116cc04b061cb6f5a561790abf249d25931d515cd375e063e0f4/identify-2.6.19.tar.gz", hash = "sha256:6be5020c38fcb07da56c53733538a3081ea5aa70d36a156f83044bfbf9173842", size = 99567, upload-time = "2026-04-17T18:39:50.265Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/94/84/d9273cd09688070a6523c4aee4663a8538721b2b755c4962aafae0011e72/identify-2.6.19-py2.py3-none-any.whl", hash = "sha256:20e6a87f786f768c092a721ad107fc9df0eb89347be9396cadf3f4abbd1fb78a", size = 99397, upload-time = "2026-04-17T18:39:49.221Z" },
+]
+
+[[package]]
+name = "idna"
+version = "3.18"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cd/63/9496c57188a2ee585e0f1db071d75089a11e98aa86eb99d9d7618fc1edce/idna-3.18.tar.gz", hash = "sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848", size = 196711, upload-time = "2026-06-02T14:34:07.794Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" },
+]
+
+[[package]]
+name = "iniconfig"
+version = "2.3.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/34/14ca021ce8e5dfedc35312d08ba8bf51fdd999c576889fc2c24cb97f4f10/iniconfig-2.3.0.tar.gz", hash = "sha256:c76315c77db068650d49c5b56314774a7804df16fee4402c1f19d6d15d8c4730", size = 20503, upload-time = "2025-10-18T21:55:43.219Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
+]
+
+[[package]]
+name = "jinja2"
+version = "3.1.6"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markupsafe" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/df/bf/f7da0350254c0ed7c72f3e33cef02e048281fec7ecec5f032d4aac52226b/jinja2-3.1.6.tar.gz", hash = "sha256:0137fb05990d35f1275a587e9aee6d56da821fc83491a0fb838183be43f66d6d", size = 245115, upload-time = "2025-03-05T20:05:02.478Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/62/a1/3d680cbfd5f4b8f15abc1d571870c5fc3e594bb582bc3b64ea099db13e56/jinja2-3.1.6-py3-none-any.whl", hash = "sha256:85ece4451f492d0c13c5dd7c13a64681a86afae63a5f347908daf103ce6d2f67", size = 134899, upload-time = "2025-03-05T20:05:00.369Z" },
+]
+
+[[package]]
+name = "markupsafe"
+version = "3.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/7e/99/7690b6d4034fffd95959cbe0c02de8deb3098cc577c67bb6a24fe5d7caa7/markupsafe-3.0.3.tar.gz", hash = "sha256:722695808f4b6457b320fdc131280796bdceb04ab50fe1795cd540799ebe1698", size = 80313, upload-time = "2025-09-27T18:37:40.426Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/08/db/fefacb2136439fc8dd20e797950e749aa1f4997ed584c62cfb8ef7c2be0e/markupsafe-3.0.3-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1cc7ea17a6824959616c525620e387f6dd30fec8cb44f649e31712db02123dad", size = 11631, upload-time = "2025-09-27T18:36:18.185Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/2e/5898933336b61975ce9dc04decbc0a7f2fee78c30353c5efba7f2d6ff27a/markupsafe-3.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4bd4cd07944443f5a265608cc6aab442e4f74dff8088b0dfc8238647b8f6ae9a", size = 12058, upload-time = "2025-09-27T18:36:19.444Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/09/adf2df3699d87d1d8184038df46a9c80d78c0148492323f4693df54e17bb/markupsafe-3.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6b5420a1d9450023228968e7e6a9ce57f65d148ab56d2313fcd589eee96a7a50", size = 24287, upload-time = "2025-09-27T18:36:20.768Z" },
+    { url = "https://files.pythonhosted.org/packages/30/ac/0273f6fcb5f42e314c6d8cd99effae6a5354604d461b8d392b5ec9530a54/markupsafe-3.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0bf2a864d67e76e5c9a34dc26ec616a66b9888e25e7b9460e1c76d3293bd9dbf", size = 22940, upload-time = "2025-09-27T18:36:22.249Z" },
+    { url = "https://files.pythonhosted.org/packages/19/ae/31c1be199ef767124c042c6c3e904da327a2f7f0cd63a0337e1eca2967a8/markupsafe-3.0.3-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:bc51efed119bc9cfdf792cdeaa4d67e8f6fcccab66ed4bfdd6bde3e59bfcbb2f", size = 21887, upload-time = "2025-09-27T18:36:23.535Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/76/7edcab99d5349a4532a459e1fe64f0b0467a3365056ae550d3bcf3f79e1e/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:068f375c472b3e7acbe2d5318dea141359e6900156b5b2ba06a30b169086b91a", size = 23692, upload-time = "2025-09-27T18:36:24.823Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/28/6e74cdd26d7514849143d69f0bf2399f929c37dc2b31e6829fd2045b2765/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:7be7b61bb172e1ed687f1754f8e7484f1c8019780f6f6b0786e76bb01c2ae115", size = 21471, upload-time = "2025-09-27T18:36:25.95Z" },
+    { url = "https://files.pythonhosted.org/packages/62/7e/a145f36a5c2945673e590850a6f8014318d5577ed7e5920a4b3448e0865d/markupsafe-3.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f9e130248f4462aaa8e2552d547f36ddadbeaa573879158d721bbd33dfe4743a", size = 22923, upload-time = "2025-09-27T18:36:27.109Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/62/d9c46a7f5c9adbeeeda52f5b8d802e1094e9717705a645efc71b0913a0a8/markupsafe-3.0.3-cp311-cp311-win32.whl", hash = "sha256:0db14f5dafddbb6d9208827849fad01f1a2609380add406671a26386cdf15a19", size = 14572, upload-time = "2025-09-27T18:36:28.045Z" },
+    { url = "https://files.pythonhosted.org/packages/83/8a/4414c03d3f891739326e1783338e48fb49781cc915b2e0ee052aa490d586/markupsafe-3.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:de8a88e63464af587c950061a5e6a67d3632e36df62b986892331d4620a35c01", size = 15077, upload-time = "2025-09-27T18:36:29.025Z" },
+    { url = "https://files.pythonhosted.org/packages/35/73/893072b42e6862f319b5207adc9ae06070f095b358655f077f69a35601f0/markupsafe-3.0.3-cp311-cp311-win_arm64.whl", hash = "sha256:3b562dd9e9ea93f13d53989d23a7e775fdfd1066c33494ff43f5418bc8c58a5c", size = 13876, upload-time = "2025-09-27T18:36:29.954Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/72/147da192e38635ada20e0a2e1a51cf8823d2119ce8883f7053879c2199b5/markupsafe-3.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:d53197da72cc091b024dd97249dfc7794d6a56530370992a5e1a08983ad9230e", size = 11615, upload-time = "2025-09-27T18:36:30.854Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/81/7e4e08678a1f98521201c3079f77db69fb552acd56067661f8c2f534a718/markupsafe-3.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:1872df69a4de6aead3491198eaf13810b565bdbeec3ae2dc8780f14458ec73ce", size = 12020, upload-time = "2025-09-27T18:36:31.971Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/2c/799f4742efc39633a1b54a92eec4082e4f815314869865d876824c257c1e/markupsafe-3.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:3a7e8ae81ae39e62a41ec302f972ba6ae23a5c5396c8e60113e9066ef893da0d", size = 24332, upload-time = "2025-09-27T18:36:32.813Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/2e/8d0c2ab90a8c1d9a24f0399058ab8519a3279d1bd4289511d74e909f060e/markupsafe-3.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d6dd0be5b5b189d31db7cda48b91d7e0a9795f31430b7f271219ab30f1d3ac9d", size = 22947, upload-time = "2025-09-27T18:36:33.86Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/54/887f3092a85238093a0b2154bd629c89444f395618842e8b0c41783898ea/markupsafe-3.0.3-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:94c6f0bb423f739146aec64595853541634bde58b2135f27f61c1ffd1cd4d16a", size = 21962, upload-time = "2025-09-27T18:36:35.099Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/2f/336b8c7b6f4a4d95e91119dc8521402461b74a485558d8f238a68312f11c/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:be8813b57049a7dc738189df53d69395eba14fb99345e0a5994914a3864c8a4b", size = 23760, upload-time = "2025-09-27T18:36:36.001Z" },
+    { url = "https://files.pythonhosted.org/packages/32/43/67935f2b7e4982ffb50a4d169b724d74b62a3964bc1a9a527f5ac4f1ee2b/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:83891d0e9fb81a825d9a6d61e3f07550ca70a076484292a70fde82c4b807286f", size = 21529, upload-time = "2025-09-27T18:36:36.906Z" },
+    { url = "https://files.pythonhosted.org/packages/89/e0/4486f11e51bbba8b0c041098859e869e304d1c261e59244baa3d295d47b7/markupsafe-3.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:77f0643abe7495da77fb436f50f8dab76dbc6e5fd25d39589a0f1fe6548bfa2b", size = 23015, upload-time = "2025-09-27T18:36:37.868Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/e1/78ee7a023dac597a5825441ebd17170785a9dab23de95d2c7508ade94e0e/markupsafe-3.0.3-cp312-cp312-win32.whl", hash = "sha256:d88b440e37a16e651bda4c7c2b930eb586fd15ca7406cb39e211fcff3bf3017d", size = 14540, upload-time = "2025-09-27T18:36:38.761Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/5b/bec5aa9bbbb2c946ca2733ef9c4ca91c91b6a24580193e891b5f7dbe8e1e/markupsafe-3.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:26a5784ded40c9e318cfc2bdb30fe164bdb8665ded9cd64d500a34fb42067b1c", size = 15105, upload-time = "2025-09-27T18:36:39.701Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/f1/216fc1bbfd74011693a4fd837e7026152e89c4bcf3e77b6692fba9923123/markupsafe-3.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:35add3b638a5d900e807944a078b51922212fb3dedb01633a8defc4b01a3c85f", size = 13906, upload-time = "2025-09-27T18:36:40.689Z" },
+    { url = "https://files.pythonhosted.org/packages/38/2f/907b9c7bbba283e68f20259574b13d005c121a0fa4c175f9bed27c4597ff/markupsafe-3.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e1cf1972137e83c5d4c136c43ced9ac51d0e124706ee1c8aa8532c1287fa8795", size = 11622, upload-time = "2025-09-27T18:36:41.777Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/d9/5f7756922cdd676869eca1c4e3c0cd0df60ed30199ffd775e319089cb3ed/markupsafe-3.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:116bb52f642a37c115f517494ea5feb03889e04df47eeff5b130b1808ce7c219", size = 12029, upload-time = "2025-09-27T18:36:43.257Z" },
+    { url = "https://files.pythonhosted.org/packages/00/07/575a68c754943058c78f30db02ee03a64b3c638586fba6a6dd56830b30a3/markupsafe-3.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:133a43e73a802c5562be9bbcd03d090aa5a1fe899db609c29e8c8d815c5f6de6", size = 24374, upload-time = "2025-09-27T18:36:44.508Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/21/9b05698b46f218fc0e118e1f8168395c65c8a2c750ae2bab54fc4bd4e0e8/markupsafe-3.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ccfcd093f13f0f0b7fdd0f198b90053bf7b2f02a3927a30e63f3ccc9df56b676", size = 22980, upload-time = "2025-09-27T18:36:45.385Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/71/544260864f893f18b6827315b988c146b559391e6e7e8f7252839b1b846a/markupsafe-3.0.3-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:509fa21c6deb7a7a273d629cf5ec029bc209d1a51178615ddf718f5918992ab9", size = 21990, upload-time = "2025-09-27T18:36:46.916Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/28/b50fc2f74d1ad761af2f5dcce7492648b983d00a65b8c0e0cb457c82ebbe/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a4afe79fb3de0b7097d81da19090f4df4f8d3a2b3adaa8764138aac2e44f3af1", size = 23784, upload-time = "2025-09-27T18:36:47.884Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/76/104b2aa106a208da8b17a2fb72e033a5a9d7073c68f7e508b94916ed47a9/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:795e7751525cae078558e679d646ae45574b47ed6e7771863fcc079a6171a0fc", size = 21588, upload-time = "2025-09-27T18:36:48.82Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/99/16a5eb2d140087ebd97180d95249b00a03aa87e29cc224056274f2e45fd6/markupsafe-3.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:8485f406a96febb5140bfeca44a73e3ce5116b2501ac54fe953e488fb1d03b12", size = 23041, upload-time = "2025-09-27T18:36:49.797Z" },
+    { url = "https://files.pythonhosted.org/packages/19/bc/e7140ed90c5d61d77cea142eed9f9c303f4c4806f60a1044c13e3f1471d0/markupsafe-3.0.3-cp313-cp313-win32.whl", hash = "sha256:bdd37121970bfd8be76c5fb069c7751683bdf373db1ed6c010162b2a130248ed", size = 14543, upload-time = "2025-09-27T18:36:51.584Z" },
+    { url = "https://files.pythonhosted.org/packages/05/73/c4abe620b841b6b791f2edc248f556900667a5a1cf023a6646967ae98335/markupsafe-3.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:9a1abfdc021a164803f4d485104931fb8f8c1efd55bc6b748d2f5774e78b62c5", size = 15113, upload-time = "2025-09-27T18:36:52.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/3a/fa34a0f7cfef23cf9500d68cb7c32dd64ffd58a12b09225fb03dd37d5b80/markupsafe-3.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:7e68f88e5b8799aa49c85cd116c932a1ac15caaa3f5db09087854d218359e485", size = 13911, upload-time = "2025-09-27T18:36:53.513Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/d7/e05cd7efe43a88a17a37b3ae96e79a19e846f3f456fe79c57ca61356ef01/markupsafe-3.0.3-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:218551f6df4868a8d527e3062d0fb968682fe92054e89978594c28e642c43a73", size = 11658, upload-time = "2025-09-27T18:36:54.819Z" },
+    { url = "https://files.pythonhosted.org/packages/99/9e/e412117548182ce2148bdeacdda3bb494260c0b0184360fe0d56389b523b/markupsafe-3.0.3-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:3524b778fe5cfb3452a09d31e7b5adefeea8c5be1d43c4f810ba09f2ceb29d37", size = 12066, upload-time = "2025-09-27T18:36:55.714Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/e6/fa0ffcda717ef64a5108eaa7b4f5ed28d56122c9a6d70ab8b72f9f715c80/markupsafe-3.0.3-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e885a3d1efa2eadc93c894a21770e4bc67899e3543680313b09f139e149ab19", size = 25639, upload-time = "2025-09-27T18:36:56.908Z" },
+    { url = "https://files.pythonhosted.org/packages/96/ec/2102e881fe9d25fc16cb4b25d5f5cde50970967ffa5dddafdb771237062d/markupsafe-3.0.3-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:8709b08f4a89aa7586de0aadc8da56180242ee0ada3999749b183aa23df95025", size = 23569, upload-time = "2025-09-27T18:36:57.913Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/30/6f2fce1f1f205fc9323255b216ca8a235b15860c34b6798f810f05828e32/markupsafe-3.0.3-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b8512a91625c9b3da6f127803b166b629725e68af71f8184ae7e7d54686a56d6", size = 23284, upload-time = "2025-09-27T18:36:58.833Z" },
+    { url = "https://files.pythonhosted.org/packages/58/47/4a0ccea4ab9f5dcb6f79c0236d954acb382202721e704223a8aafa38b5c8/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:9b79b7a16f7fedff2495d684f2b59b0457c3b493778c9eed31111be64d58279f", size = 24801, upload-time = "2025-09-27T18:36:59.739Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/70/3780e9b72180b6fecb83a4814d84c3bf4b4ae4bf0b19c27196104149734c/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:12c63dfb4a98206f045aa9563db46507995f7ef6d83b2f68eda65c307c6829eb", size = 22769, upload-time = "2025-09-27T18:37:00.719Z" },
+    { url = "https://files.pythonhosted.org/packages/98/c5/c03c7f4125180fc215220c035beac6b9cb684bc7a067c84fc69414d315f5/markupsafe-3.0.3-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:8f71bc33915be5186016f675cd83a1e08523649b0e33efdb898db577ef5bb009", size = 23642, upload-time = "2025-09-27T18:37:01.673Z" },
+    { url = "https://files.pythonhosted.org/packages/80/d6/2d1b89f6ca4bff1036499b1e29a1d02d282259f3681540e16563f27ebc23/markupsafe-3.0.3-cp313-cp313t-win32.whl", hash = "sha256:69c0b73548bc525c8cb9a251cddf1931d1db4d2258e9599c28c07ef3580ef354", size = 14612, upload-time = "2025-09-27T18:37:02.639Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/98/e48a4bfba0a0ffcf9925fe2d69240bfaa19c6f7507b8cd09c70684a53c1e/markupsafe-3.0.3-cp313-cp313t-win_amd64.whl", hash = "sha256:1b4b79e8ebf6b55351f0d91fe80f893b4743f104bff22e90697db1590e47a218", size = 15200, upload-time = "2025-09-27T18:37:03.582Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/72/e3cc540f351f316e9ed0f092757459afbc595824ca724cbc5a5d4263713f/markupsafe-3.0.3-cp313-cp313t-win_arm64.whl", hash = "sha256:ad2cf8aa28b8c020ab2fc8287b0f823d0a7d8630784c31e9ee5edea20f406287", size = 13973, upload-time = "2025-09-27T18:37:04.929Z" },
+    { url = "https://files.pythonhosted.org/packages/33/8a/8e42d4838cd89b7dde187011e97fe6c3af66d8c044997d2183fbd6d31352/markupsafe-3.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:eaa9599de571d72e2daf60164784109f19978b327a3910d3e9de8c97b5b70cfe", size = 11619, upload-time = "2025-09-27T18:37:06.342Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/64/7660f8a4a8e53c924d0fa05dc3a55c9cee10bbd82b11c5afb27d44b096ce/markupsafe-3.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c47a551199eb8eb2121d4f0f15ae0f923d31350ab9280078d1e5f12b249e0026", size = 12029, upload-time = "2025-09-27T18:37:07.213Z" },
+    { url = "https://files.pythonhosted.org/packages/da/ef/e648bfd021127bef5fa12e1720ffed0c6cbb8310c8d9bea7266337ff06de/markupsafe-3.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:f34c41761022dd093b4b6896d4810782ffbabe30f2d443ff5f083e0cbbb8c737", size = 24408, upload-time = "2025-09-27T18:37:09.572Z" },
+    { url = "https://files.pythonhosted.org/packages/41/3c/a36c2450754618e62008bf7435ccb0f88053e07592e6028a34776213d877/markupsafe-3.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:457a69a9577064c05a97c41f4e65148652db078a3a509039e64d3467b9e7ef97", size = 23005, upload-time = "2025-09-27T18:37:10.58Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/20/b7fdf89a8456b099837cd1dc21974632a02a999ec9bf7ca3e490aacd98e7/markupsafe-3.0.3-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:e8afc3f2ccfa24215f8cb28dcf43f0113ac3c37c2f0f0806d8c70e4228c5cf4d", size = 22048, upload-time = "2025-09-27T18:37:11.547Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/a7/591f592afdc734f47db08a75793a55d7fbcc6902a723ae4cfbab61010cc5/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:ec15a59cf5af7be74194f7ab02d0f59a62bdcf1a537677ce67a2537c9b87fcda", size = 23821, upload-time = "2025-09-27T18:37:12.48Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/33/45b24e4f44195b26521bc6f1a82197118f74df348556594bd2262bda1038/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:0eb9ff8191e8498cca014656ae6b8d61f39da5f95b488805da4bb029cccbfbaf", size = 21606, upload-time = "2025-09-27T18:37:13.485Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/0e/53dfaca23a69fbfbbf17a4b64072090e70717344c52eaaaa9c5ddff1e5f0/markupsafe-3.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:2713baf880df847f2bece4230d4d094280f4e67b1e813eec43b4c0e144a34ffe", size = 23043, upload-time = "2025-09-27T18:37:14.408Z" },
+    { url = "https://files.pythonhosted.org/packages/46/11/f333a06fc16236d5238bfe74daccbca41459dcd8d1fa952e8fbd5dccfb70/markupsafe-3.0.3-cp314-cp314-win32.whl", hash = "sha256:729586769a26dbceff69f7a7dbbf59ab6572b99d94576a5592625d5b411576b9", size = 14747, upload-time = "2025-09-27T18:37:15.36Z" },
+    { url = "https://files.pythonhosted.org/packages/28/52/182836104b33b444e400b14f797212f720cbc9ed6ba34c800639d154e821/markupsafe-3.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:bdc919ead48f234740ad807933cdf545180bfbe9342c2bb451556db2ed958581", size = 15341, upload-time = "2025-09-27T18:37:16.496Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/18/acf23e91bd94fd7b3031558b1f013adfa21a8e407a3fdb32745538730382/markupsafe-3.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:5a7d5dc5140555cf21a6fefbdbf8723f06fcd2f63ef108f2854de715e4422cb4", size = 14073, upload-time = "2025-09-27T18:37:17.476Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/f0/57689aa4076e1b43b15fdfa646b04653969d50cf30c32a102762be2485da/markupsafe-3.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:1353ef0c1b138e1907ae78e2f6c63ff67501122006b0f9abad68fda5f4ffc6ab", size = 11661, upload-time = "2025-09-27T18:37:18.453Z" },
+    { url = "https://files.pythonhosted.org/packages/89/c3/2e67a7ca217c6912985ec766c6393b636fb0c2344443ff9d91404dc4c79f/markupsafe-3.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1085e7fbddd3be5f89cc898938f42c0b3c711fdcb37d75221de2666af647c175", size = 12069, upload-time = "2025-09-27T18:37:19.332Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/00/be561dce4e6ca66b15276e184ce4b8aec61fe83662cce2f7d72bd3249d28/markupsafe-3.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1b52b4fb9df4eb9ae465f8d0c228a00624de2334f216f178a995ccdcf82c4634", size = 25670, upload-time = "2025-09-27T18:37:20.245Z" },
+    { url = "https://files.pythonhosted.org/packages/50/09/c419f6f5a92e5fadde27efd190eca90f05e1261b10dbd8cbcb39cd8ea1dc/markupsafe-3.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fed51ac40f757d41b7c48425901843666a6677e3e8eb0abcff09e4ba6e664f50", size = 23598, upload-time = "2025-09-27T18:37:21.177Z" },
+    { url = "https://files.pythonhosted.org/packages/22/44/a0681611106e0b2921b3033fc19bc53323e0b50bc70cffdd19f7d679bb66/markupsafe-3.0.3-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f190daf01f13c72eac4efd5c430a8de82489d9cff23c364c3ea822545032993e", size = 23261, upload-time = "2025-09-27T18:37:22.167Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/57/1b0b3f100259dc9fffe780cfb60d4be71375510e435efec3d116b6436d43/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e56b7d45a839a697b5eb268c82a71bd8c7f6c94d6fd50c3d577fa39a9f1409f5", size = 24835, upload-time = "2025-09-27T18:37:23.296Z" },
+    { url = "https://files.pythonhosted.org/packages/26/6a/4bf6d0c97c4920f1597cc14dd720705eca0bf7c787aebc6bb4d1bead5388/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:f3e98bb3798ead92273dc0e5fd0f31ade220f59a266ffd8a4f6065e0a3ce0523", size = 22733, upload-time = "2025-09-27T18:37:24.237Z" },
+    { url = "https://files.pythonhosted.org/packages/14/c7/ca723101509b518797fedc2fdf79ba57f886b4aca8a7d31857ba3ee8281f/markupsafe-3.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:5678211cb9333a6468fb8d8be0305520aa073f50d17f089b5b4b477ea6e67fdc", size = 23672, upload-time = "2025-09-27T18:37:25.271Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/df/5bd7a48c256faecd1d36edc13133e51397e41b73bb77e1a69deab746ebac/markupsafe-3.0.3-cp314-cp314t-win32.whl", hash = "sha256:915c04ba3851909ce68ccc2b8e2cd691618c4dc4c4232fb7982bca3f41fd8c3d", size = 14819, upload-time = "2025-09-27T18:37:26.285Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/8a/0402ba61a2f16038b48b39bccca271134be00c5c9f0f623208399333c448/markupsafe-3.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4faffd047e07c38848ce017e8725090413cd80cbc23d86e55c587bf979e579c9", size = 15426, upload-time = "2025-09-27T18:37:27.316Z" },
+    { url = "https://files.pythonhosted.org/packages/70/bc/6f1c2f612465f5fa89b95bead1f44dcb607670fd42891d8fdcd5d039f4f4/markupsafe-3.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:32001d6a8fc98c8cb5c947787c5d08b0a50663d139f1305bac5885d98d9b40fa", size = 14146, upload-time = "2025-09-27T18:37:28.327Z" },
+]
+
+[[package]]
+name = "mining-dashboard"
+version = "1.1.0"
+source = { editable = "." }
+dependencies = [
+    { name = "aiofiles" },
+    { name = "aiohttp" },
+    { name = "grpcio" },
+    { name = "protobuf" },
+    { name = "requests", extra = ["socks"] },
+]
+
+[package.optional-dependencies]
+dev = [
+    { name = "pre-commit" },
+    { name = "ruff" },
+]
+test = [
+    { name = "diff-cover" },
+    { name = "hypothesis" },
+    { name = "pytest" },
+    { name = "pytest-aiohttp" },
+    { name = "pytest-asyncio" },
+    { name = "pytest-cov" },
+    { name = "pytest-mock" },
+]
+
+[package.metadata]
+requires-dist = [
+    { name = "aiofiles", specifier = ">=24.1" },
+    { name = "aiohttp", specifier = ">=3.10.11" },
+    { name = "diff-cover", marker = "extra == 'test'", specifier = ">=9" },
+    { name = "grpcio", specifier = ">=1.78.0" },
+    { name = "hypothesis", marker = "extra == 'test'", specifier = ">=6.155.7" },
+    { name = "pre-commit", marker = "extra == 'dev'", specifier = ">=4" },
+    { name = "protobuf", specifier = ">=6.31.1,<7" },
+    { name = "pytest", marker = "extra == 'test'", specifier = ">=9.1.1" },
+    { name = "pytest-aiohttp", marker = "extra == 'test'", specifier = ">=1.0" },
+    { name = "pytest-asyncio", marker = "extra == 'test'", specifier = ">=0.24" },
+    { name = "pytest-cov", marker = "extra == 'test'", specifier = ">=5" },
+    { name = "pytest-mock", marker = "extra == 'test'", specifier = ">=3.14" },
+    { name = "requests", extras = ["socks"], specifier = ">=2.34.2" },
+    { name = "ruff", marker = "extra == 'dev'", specifier = "==0.15.20" },
+]
+provides-extras = ["test", "dev"]
+
+[[package]]
+name = "multidict"
+version = "6.7.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/1a/c2/c2d94cbe6ac1753f3fc980da97b3d930efe1da3af3c9f5125354436c073d/multidict-6.7.1.tar.gz", hash = "sha256:ec6652a1bee61c53a3e5776b6049172c53b6aaba34f18c9ad04f82712bac623d", size = 102010, upload-time = "2026-01-26T02:46:45.979Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ce/f1/a90635c4f88fb913fbf4ce660b83b7445b7a02615bda034b2f8eb38fd597/multidict-6.7.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:7ff981b266af91d7b4b3793ca3382e53229088d193a85dfad6f5f4c27fc73e5d", size = 76626, upload-time = "2026-01-26T02:43:26.485Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/9b/267e64eaf6fc637a15b35f5de31a566634a2740f97d8d094a69d34f524a4/multidict-6.7.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:844c5bca0b5444adb44a623fb0a1310c2f4cd41f402126bb269cd44c9b3f3e1e", size = 44706, upload-time = "2026-01-26T02:43:27.607Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/a4/d45caf2b97b035c57267791ecfaafbd59c68212004b3842830954bb4b02e/multidict-6.7.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:f2a0a924d4c2e9afcd7ec64f9de35fcd96915149b2216e1cb2c10a56df483855", size = 44356, upload-time = "2026-01-26T02:43:28.661Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/d2/0a36c8473f0cbaeadd5db6c8b72d15bbceeec275807772bfcd059bef487d/multidict-6.7.1-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:8be1802715a8e892c784c0197c2ace276ea52702a0ede98b6310c8f255a5afb3", size = 244355, upload-time = "2026-01-26T02:43:31.165Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/16/8c65be997fd7dd311b7d39c7b6e71a0cb449bad093761481eccbbe4b42a2/multidict-6.7.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2e2d2ed645ea29f31c4c7ea1552fcfd7cb7ba656e1eafd4134a6620c9f5fdd9e", size = 246433, upload-time = "2026-01-26T02:43:32.581Z" },
+    { url = "https://files.pythonhosted.org/packages/01/fb/4dbd7e848d2799c6a026ec88ad39cf2b8416aa167fcc903baa55ecaa045c/multidict-6.7.1-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:95922cee9a778659e91db6497596435777bd25ed116701a4c034f8e46544955a", size = 225376, upload-time = "2026-01-26T02:43:34.417Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/8a/4a3a6341eac3830f6053062f8fbc9a9e54407c80755b3f05bc427295c2d0/multidict-6.7.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6b83cabdc375ffaaa15edd97eb7c0c672ad788e2687004990074d7d6c9b140c8", size = 257365, upload-time = "2026-01-26T02:43:35.741Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/a2/dd575a69c1aa206e12d27d0770cdf9b92434b48a9ef0cd0d1afdecaa93c4/multidict-6.7.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:38fb49540705369bab8484db0689d86c0a33a0a9f2c1b197f506b71b4b6c19b0", size = 254747, upload-time = "2026-01-26T02:43:36.976Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/56/21b27c560c13822ed93133f08aa6372c53a8e067f11fbed37b4adcdac922/multidict-6.7.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:439cbebd499f92e9aa6793016a8acaa161dfa749ae86d20960189f5398a19144", size = 246293, upload-time = "2026-01-26T02:43:38.258Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/a4/23466059dc3854763423d0ad6c0f3683a379d97673b1b89ec33826e46728/multidict-6.7.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:6d3bc717b6fe763b8be3f2bee2701d3c8eb1b2a8ae9f60910f1b2860c82b6c49", size = 242962, upload-time = "2026-01-26T02:43:40.034Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/67/51dd754a3524d685958001e8fa20a0f5f90a6a856e0a9dcabff69be3dbb7/multidict-6.7.1-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:619e5a1ac57986dbfec9f0b301d865dddf763696435e2962f6d9cf2fdff2bb71", size = 237360, upload-time = "2026-01-26T02:43:41.752Z" },
+    { url = "https://files.pythonhosted.org/packages/64/3f/036dfc8c174934d4b55d86ff4f978e558b0e585cef70cfc1ad01adc6bf18/multidict-6.7.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:0b38ebffd9be37c1170d33bc0f36f4f262e0a09bc1aac1c34c7aa51a7293f0b3", size = 245940, upload-time = "2026-01-26T02:43:43.042Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/20/6214d3c105928ebc353a1c644a6ef1408bc5794fcb4f170bb524a3c16311/multidict-6.7.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:10ae39c9cfe6adedcdb764f5e8411d4a92b055e35573a2eaa88d3323289ef93c", size = 253502, upload-time = "2026-01-26T02:43:44.371Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/e2/c653bc4ae1be70a0f836b82172d643fcf1dade042ba2676ab08ec08bff0f/multidict-6.7.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:25167cc263257660290fba06b9318d2026e3c910be240a146e1f66dd114af2b0", size = 247065, upload-time = "2026-01-26T02:43:45.745Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/11/a854b4154cd3bd8b1fd375e8a8ca9d73be37610c361543d56f764109509b/multidict-6.7.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:128441d052254f42989ef98b7b6a6ecb1e6f708aa962c7984235316db59f50fa", size = 241870, upload-time = "2026-01-26T02:43:47.054Z" },
+    { url = "https://files.pythonhosted.org/packages/13/bf/9676c0392309b5fdae322333d22a829715b570edb9baa8016a517b55b558/multidict-6.7.1-cp311-cp311-win32.whl", hash = "sha256:d62b7f64ffde3b99d06b707a280db04fb3855b55f5a06df387236051d0668f4a", size = 41302, upload-time = "2026-01-26T02:43:48.753Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/68/f16a3a8ba6f7b6dc92a1f19669c0810bd2c43fc5a02da13b1cbf8e253845/multidict-6.7.1-cp311-cp311-win_amd64.whl", hash = "sha256:bdbf9f3b332abd0cdb306e7c2113818ab1e922dc84b8f8fd06ec89ed2a19ab8b", size = 45981, upload-time = "2026-01-26T02:43:49.921Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/ad/9dd5305253fa00cd3c7555dbef69d5bf4133debc53b87ab8d6a44d411665/multidict-6.7.1-cp311-cp311-win_arm64.whl", hash = "sha256:b8c990b037d2fff2f4e33d3f21b9b531c5745b33a49a7d6dbe7a177266af44f6", size = 43159, upload-time = "2026-01-26T02:43:51.635Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/9c/f20e0e2cf80e4b2e4b1c365bf5fe104ee633c751a724246262db8f1a0b13/multidict-6.7.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:a90f75c956e32891a4eda3639ce6dd86e87105271f43d43442a3aedf3cddf172", size = 76893, upload-time = "2026-01-26T02:43:52.754Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/cf/18ef143a81610136d3da8193da9d80bfe1cb548a1e2d1c775f26b23d024a/multidict-6.7.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:3fccb473e87eaa1382689053e4a4618e7ba7b9b9b8d6adf2027ee474597128cd", size = 45456, upload-time = "2026-01-26T02:43:53.893Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/65/1caac9d4cd32e8433908683446eebc953e82d22b03d10d41a5f0fefe991b/multidict-6.7.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:b0fa96985700739c4c7853a43c0b3e169360d6855780021bfc6d0f1ce7c123e7", size = 43872, upload-time = "2026-01-26T02:43:55.041Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/3b/d6bd75dc4f3ff7c73766e04e705b00ed6dbbaccf670d9e05a12b006f5a21/multidict-6.7.1-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:cb2a55f408c3043e42b40cc8eecd575afa27b7e0b956dfb190de0f8499a57a53", size = 251018, upload-time = "2026-01-26T02:43:56.198Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/80/c959c5933adedb9ac15152e4067c702a808ea183a8b64cf8f31af8ad3155/multidict-6.7.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:eb0ce7b2a32d09892b3dd6cc44877a0d02a33241fafca5f25c8b6b62374f8b75", size = 258883, upload-time = "2026-01-26T02:43:57.499Z" },
+    { url = "https://files.pythonhosted.org/packages/86/85/7ed40adafea3d4f1c8b916e3b5cc3a8e07dfcdcb9cd72800f4ed3ca1b387/multidict-6.7.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c3a32d23520ee37bf327d1e1a656fec76a2edd5c038bf43eddfa0572ec49c60b", size = 242413, upload-time = "2026-01-26T02:43:58.755Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/57/b8565ff533e48595503c785f8361ff9a4fde4d67de25c207cd0ba3befd03/multidict-6.7.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:9c90fed18bffc0189ba814749fdcc102b536e83a9f738a9003e569acd540a733", size = 268404, upload-time = "2026-01-26T02:44:00.216Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/50/9810c5c29350f7258180dfdcb2e52783a0632862eb334c4896ac717cebcb/multidict-6.7.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:da62917e6076f512daccfbbde27f46fed1c98fee202f0559adec8ee0de67f71a", size = 269456, upload-time = "2026-01-26T02:44:02.202Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/8d/5e5be3ced1d12966fefb5c4ea3b2a5b480afcea36406559442c6e31d4a48/multidict-6.7.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bfde23ef6ed9db7eaee6c37dcec08524cb43903c60b285b172b6c094711b3961", size = 256322, upload-time = "2026-01-26T02:44:03.56Z" },
+    { url = "https://files.pythonhosted.org/packages/31/6e/d8a26d81ac166a5592782d208dd90dfdc0a7a218adaa52b45a672b46c122/multidict-6.7.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3758692429e4e32f1ba0df23219cd0b4fc0a52f476726fff9337d1a57676a582", size = 253955, upload-time = "2026-01-26T02:44:04.845Z" },
+    { url = "https://files.pythonhosted.org/packages/59/4c/7c672c8aad41534ba619bcd4ade7a0dc87ed6b8b5c06149b85d3dd03f0cd/multidict-6.7.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:398c1478926eca669f2fd6a5856b6de9c0acf23a2cb59a14c0ba5844fa38077e", size = 251254, upload-time = "2026-01-26T02:44:06.133Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/bd/84c24de512cbafbdbc39439f74e967f19570ce7924e3007174a29c348916/multidict-6.7.1-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:c102791b1c4f3ab36ce4101154549105a53dc828f016356b3e3bcae2e3a039d3", size = 252059, upload-time = "2026-01-26T02:44:07.518Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/ba/f5449385510825b73d01c2d4087bf6d2fccc20a2d42ac34df93191d3dd03/multidict-6.7.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:a088b62bd733e2ad12c50dad01b7d0166c30287c166e137433d3b410add807a6", size = 263588, upload-time = "2026-01-26T02:44:09.382Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/11/afc7c677f68f75c84a69fe37184f0f82fce13ce4b92f49f3db280b7e92b3/multidict-6.7.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:3d51ff4785d58d3f6c91bdbffcb5e1f7ddfda557727043aa20d20ec4f65e324a", size = 259642, upload-time = "2026-01-26T02:44:10.73Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/17/ebb9644da78c4ab36403739e0e6e0e30ebb135b9caf3440825001a0bddcb/multidict-6.7.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:fc5907494fccf3e7d3f94f95c91d6336b092b5fc83811720fae5e2765890dfba", size = 251377, upload-time = "2026-01-26T02:44:12.042Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/a4/840f5b97339e27846c46307f2530a2805d9d537d8b8bd416af031cad7fa0/multidict-6.7.1-cp312-cp312-win32.whl", hash = "sha256:28ca5ce2fd9716631133d0e9a9b9a745ad7f60bac2bccafb56aa380fc0b6c511", size = 41887, upload-time = "2026-01-26T02:44:14.245Z" },
+    { url = "https://files.pythonhosted.org/packages/80/31/0b2517913687895f5904325c2069d6a3b78f66cc641a86a2baf75a05dcbb/multidict-6.7.1-cp312-cp312-win_amd64.whl", hash = "sha256:fcee94dfbd638784645b066074b338bc9cc155d4b4bffa4adce1615c5a426c19", size = 46053, upload-time = "2026-01-26T02:44:15.371Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/5b/aba28e4ee4006ae4c7df8d327d31025d760ffa992ea23812a601d226e682/multidict-6.7.1-cp312-cp312-win_arm64.whl", hash = "sha256:ba0a9fb644d0c1a2194cf7ffb043bd852cea63a57f66fbd33959f7dae18517bf", size = 43307, upload-time = "2026-01-26T02:44:16.852Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/22/929c141d6c0dba87d3e1d38fbdf1ba8baba86b7776469f2bc2d3227a1e67/multidict-6.7.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:2b41f5fed0ed563624f1c17630cb9941cf2309d4df00e494b551b5f3e3d67a23", size = 76174, upload-time = "2026-01-26T02:44:18.509Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/75/bc704ae15fee974f8fccd871305e254754167dce5f9e42d88a2def741a1d/multidict-6.7.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:84e61e3af5463c19b67ced91f6c634effb89ef8bfc5ca0267f954451ed4bb6a2", size = 45116, upload-time = "2026-01-26T02:44:19.745Z" },
+    { url = "https://files.pythonhosted.org/packages/79/76/55cd7186f498ed080a18440c9013011eb548f77ae1b297206d030eb1180a/multidict-6.7.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:935434b9853c7c112eee7ac891bc4cb86455aa631269ae35442cb316790c1445", size = 43524, upload-time = "2026-01-26T02:44:21.571Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/3c/414842ef8d5a1628d68edee29ba0e5bcf235dbfb3ccd3ea303a7fe8c72ff/multidict-6.7.1-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:432feb25a1cb67fe82a9680b4d65fb542e4635cb3166cd9c01560651ad60f177", size = 249368, upload-time = "2026-01-26T02:44:22.803Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/32/befed7f74c458b4a525e60519fe8d87eef72bb1e99924fa2b0f9d97a221e/multidict-6.7.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e82d14e3c948952a1a85503817e038cba5905a3352de76b9a465075d072fba23", size = 256952, upload-time = "2026-01-26T02:44:24.306Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d6/c878a44ba877f366630c860fdf74bfb203c33778f12b6ac274936853c451/multidict-6.7.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:4cfb48c6ea66c83bcaaf7e4dfa7ec1b6bbcf751b7db85a328902796dfde4c060", size = 240317, upload-time = "2026-01-26T02:44:25.772Z" },
+    { url = "https://files.pythonhosted.org/packages/68/49/57421b4d7ad2e9e60e25922b08ceb37e077b90444bde6ead629095327a6f/multidict-6.7.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:1d540e51b7e8e170174555edecddbd5538105443754539193e3e1061864d444d", size = 267132, upload-time = "2026-01-26T02:44:27.648Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/fe/ec0edd52ddbcea2a2e89e174f0206444a61440b40f39704e64dc807a70bd/multidict-6.7.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:273d23f4b40f3dce4d6c8a821c741a86dec62cded82e1175ba3d99be128147ed", size = 268140, upload-time = "2026-01-26T02:44:29.588Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/73/6e1b01cbeb458807aa0831742232dbdd1fa92bfa33f52a3f176b4ff3dc11/multidict-6.7.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9d624335fd4fa1c08a53f8b4be7676ebde19cd092b3895c421045ca87895b429", size = 254277, upload-time = "2026-01-26T02:44:30.902Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/b2/5fb8c124d7561a4974c342bc8c778b471ebbeb3cc17df696f034a7e9afe7/multidict-6.7.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:12fad252f8b267cc75b66e8fc51b3079604e8d43a75428ffe193cd9e2195dfd6", size = 252291, upload-time = "2026-01-26T02:44:32.31Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/96/51d4e4e06bcce92577fcd488e22600bd38e4fd59c20cb49434d054903bd2/multidict-6.7.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:03ede2a6ffbe8ef936b92cb4529f27f42be7f56afcdab5ab739cd5f27fb1cbf9", size = 250156, upload-time = "2026-01-26T02:44:33.734Z" },
+    { url = "https://files.pythonhosted.org/packages/db/6b/420e173eec5fba721a50e2a9f89eda89d9c98fded1124f8d5c675f7a0c0f/multidict-6.7.1-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:90efbcf47dbe33dcf643a1e400d67d59abeac5db07dc3f27d6bdeae497a2198c", size = 249742, upload-time = "2026-01-26T02:44:35.222Z" },
+    { url = "https://files.pythonhosted.org/packages/44/a3/ec5b5bd98f306bc2aa297b8c6f11a46714a56b1e6ef5ebda50a4f5d7c5fb/multidict-6.7.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c4b9bfc148f5a91be9244d6264c53035c8a0dcd2f51f1c3c6e30e30ebaa1c84", size = 262221, upload-time = "2026-01-26T02:44:36.604Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/f7/e8c0d0da0cd1e28d10e624604e1a36bcc3353aaebdfdc3a43c72bc683a12/multidict-6.7.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:401c5a650f3add2472d1d288c26deebc540f99e2fb83e9525007a74cd2116f1d", size = 258664, upload-time = "2026-01-26T02:44:38.008Z" },
+    { url = "https://files.pythonhosted.org/packages/52/da/151a44e8016dd33feed44f730bd856a66257c1ee7aed4f44b649fb7edeb3/multidict-6.7.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:97891f3b1b3ffbded884e2916cacf3c6fc87b66bb0dde46f7357404750559f33", size = 249490, upload-time = "2026-01-26T02:44:39.386Z" },
+    { url = "https://files.pythonhosted.org/packages/87/af/a3b86bf9630b732897f6fc3f4c4714b90aa4361983ccbdcd6c0339b21b0c/multidict-6.7.1-cp313-cp313-win32.whl", hash = "sha256:e1c5988359516095535c4301af38d8a8838534158f649c05dd1050222321bcb3", size = 41695, upload-time = "2026-01-26T02:44:41.318Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/35/e994121b0e90e46134673422dd564623f93304614f5d11886b1b3e06f503/multidict-6.7.1-cp313-cp313-win_amd64.whl", hash = "sha256:960c83bf01a95b12b08fd54324a4eb1d5b52c88932b5cba5d6e712bb3ed12eb5", size = 45884, upload-time = "2026-01-26T02:44:42.488Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/61/42d3e5dbf661242a69c97ea363f2d7b46c567da8eadef8890022be6e2ab0/multidict-6.7.1-cp313-cp313-win_arm64.whl", hash = "sha256:563fe25c678aaba333d5399408f5ec3c383ca5b663e7f774dd179a520b8144df", size = 43122, upload-time = "2026-01-26T02:44:43.664Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/b3/e6b21c6c4f314bb956016b0b3ef2162590a529b84cb831c257519e7fde44/multidict-6.7.1-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:c76c4bec1538375dad9d452d246ca5368ad6e1c9039dadcf007ae59c70619ea1", size = 83175, upload-time = "2026-01-26T02:44:44.894Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/76/23ecd2abfe0957b234f6c960f4ade497f55f2c16aeb684d4ecdbf1c95791/multidict-6.7.1-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:57b46b24b5d5ebcc978da4ec23a819a9402b4228b8a90d9c656422b4bdd8a963", size = 48460, upload-time = "2026-01-26T02:44:46.106Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/57/a0ed92b23f3a042c36bc4227b72b97eca803f5f1801c1ab77c8a212d455e/multidict-6.7.1-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:e954b24433c768ce78ab7929e84ccf3422e46deb45a4dc9f93438f8217fa2d34", size = 46930, upload-time = "2026-01-26T02:44:47.278Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/66/02ec7ace29162e447f6382c495dc95826bf931d3818799bbef11e8f7df1a/multidict-6.7.1-cp313-cp313t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3bd231490fa7217cc832528e1cd8752a96f0125ddd2b5749390f7c3ec8721b65", size = 242582, upload-time = "2026-01-26T02:44:48.604Z" },
+    { url = "https://files.pythonhosted.org/packages/58/18/64f5a795e7677670e872673aca234162514696274597b3708b2c0d276cce/multidict-6.7.1-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:253282d70d67885a15c8a7716f3a73edf2d635793ceda8173b9ecc21f2fb8292", size = 250031, upload-time = "2026-01-26T02:44:50.544Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/ed/e192291dbbe51a8290c5686f482084d31bcd9d09af24f63358c3d42fd284/multidict-6.7.1-cp313-cp313t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:0b4c48648d7649c9335cf1927a8b87fa692de3dcb15faa676c6a6f1f1aabda43", size = 228596, upload-time = "2026-01-26T02:44:51.951Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/7e/3562a15a60cf747397e7f2180b0a11dc0c38d9175a650e75fa1b4d325e15/multidict-6.7.1-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:98bc624954ec4d2c7cb074b8eefc2b5d0ce7d482e410df446414355d158fe4ca", size = 257492, upload-time = "2026-01-26T02:44:53.902Z" },
+    { url = "https://files.pythonhosted.org/packages/24/02/7d0f9eae92b5249bb50ac1595b295f10e263dd0078ebb55115c31e0eaccd/multidict-6.7.1-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1b99af4d9eec0b49927b4402bcbb58dea89d3e0db8806a4086117019939ad3dd", size = 255899, upload-time = "2026-01-26T02:44:55.316Z" },
+    { url = "https://files.pythonhosted.org/packages/00/e3/9b60ed9e23e64c73a5cde95269ef1330678e9c6e34dd4eb6b431b85b5a10/multidict-6.7.1-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6aac4f16b472d5b7dc6f66a0d49dd57b0e0902090be16594dc9ebfd3d17c47e7", size = 247970, upload-time = "2026-01-26T02:44:56.783Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/06/538e58a63ed5cfb0bd4517e346b91da32fde409d839720f664e9a4ae4f9d/multidict-6.7.1-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:21f830fe223215dffd51f538e78c172ed7c7f60c9b96a2bf05c4848ad49921c3", size = 245060, upload-time = "2026-01-26T02:44:58.195Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/2f/d743a3045a97c895d401e9bd29aaa09b94f5cbdf1bd561609e5a6c431c70/multidict-6.7.1-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:f5dd81c45b05518b9aa4da4aa74e1c93d715efa234fd3e8a179df611cc85e5f4", size = 235888, upload-time = "2026-01-26T02:44:59.57Z" },
+    { url = "https://files.pythonhosted.org/packages/38/83/5a325cac191ab28b63c52f14f1131f3b0a55ba3b9aa65a6d0bf2a9b921a0/multidict-6.7.1-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:eb304767bca2bb92fb9c5bd33cedc95baee5bb5f6c88e63706533a1c06ad08c8", size = 243554, upload-time = "2026-01-26T02:45:01.054Z" },
+    { url = "https://files.pythonhosted.org/packages/20/1f/9d2327086bd15da2725ef6aae624208e2ef828ed99892b17f60c344e57ed/multidict-6.7.1-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:c9035dde0f916702850ef66460bc4239d89d08df4d02023a5926e7446724212c", size = 252341, upload-time = "2026-01-26T02:45:02.484Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/2c/2a1aa0280cf579d0f6eed8ee5211c4f1730bd7e06c636ba2ee6aafda302e/multidict-6.7.1-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:af959b9beeb66c822380f222f0e0a1889331597e81f1ded7f374f3ecb0fd6c52", size = 246391, upload-time = "2026-01-26T02:45:03.862Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/03/7ca022ffc36c5a3f6e03b179a5ceb829be9da5783e6fe395f347c0794680/multidict-6.7.1-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:41f2952231456154ee479651491e94118229844dd7226541788be783be2b5108", size = 243422, upload-time = "2026-01-26T02:45:05.296Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/1d/b31650eab6c5778aceed46ba735bd97f7c7d2f54b319fa916c0f96e7805b/multidict-6.7.1-cp313-cp313t-win32.whl", hash = "sha256:df9f19c28adcb40b6aae30bbaa1478c389efd50c28d541d76760199fc1037c32", size = 47770, upload-time = "2026-01-26T02:45:06.754Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/5b/2d2d1d522e51285bd61b1e20df8f47ae1a9d80839db0b24ea783b3832832/multidict-6.7.1-cp313-cp313t-win_amd64.whl", hash = "sha256:d54ecf9f301853f2c5e802da559604b3e95bb7a3b01a9c295c6ee591b9882de8", size = 53109, upload-time = "2026-01-26T02:45:08.044Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/a3/cc409ba012c83ca024a308516703cf339bdc4b696195644a7215a5164a24/multidict-6.7.1-cp313-cp313t-win_arm64.whl", hash = "sha256:5a37ca18e360377cfda1d62f5f382ff41f2b8c4ccb329ed974cc2e1643440118", size = 45573, upload-time = "2026-01-26T02:45:09.349Z" },
+    { url = "https://files.pythonhosted.org/packages/91/cc/db74228a8be41884a567e88a62fd589a913708fcf180d029898c17a9a371/multidict-6.7.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:8f333ec9c5eb1b7105e3b84b53141e66ca05a19a605368c55450b6ba208cb9ee", size = 75190, upload-time = "2026-01-26T02:45:10.651Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/22/492f2246bb5b534abd44804292e81eeaf835388901f0c574bac4eeec73c5/multidict-6.7.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:a407f13c188f804c759fc6a9f88286a565c242a76b27626594c133b82883b5c2", size = 44486, upload-time = "2026-01-26T02:45:11.938Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/4f/733c48f270565d78b4544f2baddc2fb2a245e5a8640254b12c36ac7ac68e/multidict-6.7.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:0e161ddf326db5577c3a4cc2d8648f81456e8a20d40415541587a71620d7a7d1", size = 43219, upload-time = "2026-01-26T02:45:14.346Z" },
+    { url = "https://files.pythonhosted.org/packages/24/bb/2c0c2287963f4259c85e8bcbba9182ced8d7fca65c780c38e99e61629d11/multidict-6.7.1-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:1e3a8bb24342a8201d178c3b4984c26ba81a577c80d4d525727427460a50c22d", size = 245132, upload-time = "2026-01-26T02:45:15.712Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/f9/44d4b3064c65079d2467888794dea218d1601898ac50222ab8a9a8094460/multidict-6.7.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:97231140a50f5d447d3164f994b86a0bed7cd016e2682f8650d6a9158e14fd31", size = 252420, upload-time = "2026-01-26T02:45:17.293Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/13/78f7275e73fa17b24c9a51b0bd9d73ba64bb32d0ed51b02a746eb876abe7/multidict-6.7.1-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:6b10359683bd8806a200fd2909e7c8ca3a7b24ec1d8132e483d58e791d881048", size = 233510, upload-time = "2026-01-26T02:45:19.356Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/25/8167187f62ae3cbd52da7893f58cb036b47ea3fb67138787c76800158982/multidict-6.7.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:283ddac99f7ac25a4acadbf004cb5ae34480bbeb063520f70ce397b281859362", size = 264094, upload-time = "2026-01-26T02:45:20.834Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/e7/69a3a83b7b030cf283fb06ce074a05a02322359783424d7edf0f15fe5022/multidict-6.7.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:538cec1e18c067d0e6103aa9a74f9e832904c957adc260e61cd9d8cf0c3b3d37", size = 260786, upload-time = "2026-01-26T02:45:22.818Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/3b/8ec5074bcfc450fe84273713b4b0a0dd47c0249358f5d82eb8104ffe2520/multidict-6.7.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7eee46ccb30ff48a1e35bb818cc90846c6be2b68240e42a78599166722cea709", size = 248483, upload-time = "2026-01-26T02:45:24.368Z" },
+    { url = "https://files.pythonhosted.org/packages/48/5a/d5a99e3acbca0e29c5d9cba8f92ceb15dce78bab963b308ae692981e3a5d/multidict-6.7.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:fa263a02f4f2dd2d11a7b1bb4362aa7cb1049f84a9235d31adf63f30143469a0", size = 248403, upload-time = "2026-01-26T02:45:25.982Z" },
+    { url = "https://files.pythonhosted.org/packages/35/48/e58cd31f6c7d5102f2a4bf89f96b9cf7e00b6c6f3d04ecc44417c00a5a3c/multidict-6.7.1-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:2e1425e2f99ec5bd36c15a01b690a1a2456209c5deed58f95469ffb46039ccbb", size = 240315, upload-time = "2026-01-26T02:45:27.487Z" },
+    { url = "https://files.pythonhosted.org/packages/94/33/1cd210229559cb90b6786c30676bb0c58249ff42f942765f88793b41fdce/multidict-6.7.1-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:497394b3239fc6f0e13a78a3e1b61296e72bf1c5f94b4c4eb80b265c37a131cd", size = 245528, upload-time = "2026-01-26T02:45:28.991Z" },
+    { url = "https://files.pythonhosted.org/packages/64/f2/6e1107d226278c876c783056b7db43d800bb64c6131cec9c8dfb6903698e/multidict-6.7.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:233b398c29d3f1b9676b4b6f75c518a06fcb2ea0b925119fb2c1bc35c05e1601", size = 258784, upload-time = "2026-01-26T02:45:30.503Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/c1/11f664f14d525e4a1b5327a82d4de61a1db604ab34c6603bb3c2cc63ad34/multidict-6.7.1-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:93b1818e4a6e0930454f0f2af7dfce69307ca03cdcfb3739bf4d91241967b6c1", size = 251980, upload-time = "2026-01-26T02:45:32.603Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/9f/75a9ac888121d0c5bbd4ecf4eead45668b1766f6baabfb3b7f66a410e231/multidict-6.7.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:f33dc2a3abe9249ea5d8360f969ec7f4142e7ac45ee7014d8f8d5acddf178b7b", size = 243602, upload-time = "2026-01-26T02:45:34.043Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/e7/50bf7b004cc8525d80dbbbedfdc7aed3e4c323810890be4413e589074032/multidict-6.7.1-cp314-cp314-win32.whl", hash = "sha256:3ab8b9d8b75aef9df299595d5388b14530839f6422333357af1339443cff777d", size = 40930, upload-time = "2026-01-26T02:45:36.278Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/bf/52f25716bbe93745595800f36fb17b73711f14da59ed0bb2eba141bc9f0f/multidict-6.7.1-cp314-cp314-win_amd64.whl", hash = "sha256:5e01429a929600e7dab7b166062d9bb54a5eed752384c7384c968c2afab8f50f", size = 45074, upload-time = "2026-01-26T02:45:37.546Z" },
+    { url = "https://files.pythonhosted.org/packages/97/ab/22803b03285fa3a525f48217963da3a65ae40f6a1b6f6cf2768879e208f9/multidict-6.7.1-cp314-cp314-win_arm64.whl", hash = "sha256:4885cb0e817aef5d00a2e8451d4665c1808378dc27c2705f1bf4ef8505c0d2e5", size = 42471, upload-time = "2026-01-26T02:45:38.889Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/6d/f9293baa6146ba9507e360ea0292b6422b016907c393e2f63fc40ab7b7b5/multidict-6.7.1-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:0458c978acd8e6ea53c81eefaddbbee9c6c5e591f41b3f5e8e194780fe026581", size = 82401, upload-time = "2026-01-26T02:45:40.254Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/68/53b5494738d83558d87c3c71a486504d8373421c3e0dbb6d0db48ad42ee0/multidict-6.7.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:c0abd12629b0af3cf590982c0b413b1e7395cd4ec026f30986818ab95bfaa94a", size = 48143, upload-time = "2026-01-26T02:45:41.635Z" },
+    { url = "https://files.pythonhosted.org/packages/37/e8/5284c53310dcdc99ce5d66563f6e5773531a9b9fe9ec7a615e9bc306b05f/multidict-6.7.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:14525a5f61d7d0c94b368a42cff4c9a4e7ba2d52e2672a7b23d84dc86fb02b0c", size = 46507, upload-time = "2026-01-26T02:45:42.99Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/fc/6800d0e5b3875568b4083ecf5f310dcf91d86d52573160834fb4bfcf5e4f/multidict-6.7.1-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:17307b22c217b4cf05033dabefe68255a534d637c6c9b0cc8382718f87be4262", size = 239358, upload-time = "2026-01-26T02:45:44.376Z" },
+    { url = "https://files.pythonhosted.org/packages/41/75/4ad0973179361cdf3a113905e6e088173198349131be2b390f9fa4da5fc6/multidict-6.7.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7a7e590ff876a3eaf1c02a4dfe0724b6e69a9e9de6d8f556816f29c496046e59", size = 246884, upload-time = "2026-01-26T02:45:47.167Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/9c/095bb28b5da139bd41fb9a5d5caff412584f377914bd8787c2aa98717130/multidict-6.7.1-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:5fa6a95dfee63893d80a34758cd0e0c118a30b8dcb46372bf75106c591b77889", size = 225878, upload-time = "2026-01-26T02:45:48.698Z" },
+    { url = "https://files.pythonhosted.org/packages/07/d0/c0a72000243756e8f5a277b6b514fa005f2c73d481b7d9e47cd4568aa2e4/multidict-6.7.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a0543217a6a017692aa6ae5cc39adb75e587af0f3a82288b1492eb73dd6cc2a4", size = 253542, upload-time = "2026-01-26T02:45:50.164Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/6b/f69da15289e384ecf2a68837ec8b5ad8c33e973aa18b266f50fe55f24b8c/multidict-6.7.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f99fe611c312b3c1c0ace793f92464d8cd263cc3b26b5721950d977b006b6c4d", size = 252403, upload-time = "2026-01-26T02:45:51.779Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/76/b9669547afa5a1a25cd93eaca91c0da1c095b06b6d2d8ec25b713588d3a1/multidict-6.7.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:9004d8386d133b7e6135679424c91b0b854d2d164af6ea3f289f8f2761064609", size = 244889, upload-time = "2026-01-26T02:45:53.27Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/a9/a50d2669e506dad33cfc45b5d574a205587b7b8a5f426f2fbb2e90882588/multidict-6.7.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:e628ef0e6859ffd8273c69412a2465c4be4a9517d07261b33334b5ec6f3c7489", size = 241982, upload-time = "2026-01-26T02:45:54.919Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/bb/1609558ad8b456b4827d3c5a5b775c93b87878fd3117ed3db3423dfbce1b/multidict-6.7.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:841189848ba629c3552035a6a7f5bf3b02eb304e9fea7492ca220a8eda6b0e5c", size = 232415, upload-time = "2026-01-26T02:45:56.981Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/59/6f61039d2aa9261871e03ab9dc058a550d240f25859b05b67fd70f80d4b3/multidict-6.7.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:ce1bbd7d780bb5a0da032e095c951f7014d6b0a205f8318308140f1a6aba159e", size = 240337, upload-time = "2026-01-26T02:45:58.698Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/29/fdc6a43c203890dc2ae9249971ecd0c41deaedfe00d25cb6564b2edd99eb/multidict-6.7.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:b26684587228afed0d50cf804cc71062cc9c1cdf55051c4c6345d372947b268c", size = 248788, upload-time = "2026-01-26T02:46:00.862Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/14/a153a06101323e4cf086ecee3faadba52ff71633d471f9685c42e3736163/multidict-6.7.1-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:9f9af11306994335398293f9958071019e3ab95e9a707dc1383a35613f6abcb9", size = 242842, upload-time = "2026-01-26T02:46:02.824Z" },
+    { url = "https://files.pythonhosted.org/packages/41/5f/604ae839e64a4a6efc80db94465348d3b328ee955e37acb24badbcd24d83/multidict-6.7.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:b4938326284c4f1224178a560987b6cf8b4d38458b113d9b8c1db1a836e640a2", size = 240237, upload-time = "2026-01-26T02:46:05.898Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/60/c3a5187bf66f6fb546ff4ab8fb5a077cbdd832d7b1908d4365c7f74a1917/multidict-6.7.1-cp314-cp314t-win32.whl", hash = "sha256:98655c737850c064a65e006a3df7c997cd3b220be4ec8fe26215760b9697d4d7", size = 48008, upload-time = "2026-01-26T02:46:07.468Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/f7/addf1087b860ac60e6f382240f64fb99f8bfb532bb06f7c542b83c29ca61/multidict-6.7.1-cp314-cp314t-win_amd64.whl", hash = "sha256:497bde6223c212ba11d462853cfa4f0ae6ef97465033e7dc9940cdb3ab5b48e5", size = 53542, upload-time = "2026-01-26T02:46:08.809Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/81/4629d0aa32302ef7b2ec65c75a728cc5ff4fa410c50096174c1632e70b3e/multidict-6.7.1-cp314-cp314t-win_arm64.whl", hash = "sha256:2bbd113e0d4af5db41d5ebfe9ccaff89de2120578164f86a5d17d5a576d1e5b2", size = 44719, upload-time = "2026-01-26T02:46:11.146Z" },
+    { url = "https://files.pythonhosted.org/packages/81/08/7036c080d7117f28a4af526d794aab6a84463126db031b007717c1a6676e/multidict-6.7.1-py3-none-any.whl", hash = "sha256:55d97cc6dae627efa6a6e548885712d4864b81110ac76fa4e534c03819fa4a56", size = 12319, upload-time = "2026-01-26T02:46:44.004Z" },
+]
+
+[[package]]
+name = "nodeenv"
+version = "1.10.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/24/bf/d1bda4f6168e0b2e9e5958945e01910052158313224ada5ce1fb2e1113b8/nodeenv-1.10.0.tar.gz", hash = "sha256:996c191ad80897d076bdfba80a41994c2b47c68e224c542b48feba42ba00f8bb", size = 55611, upload-time = "2025-12-20T14:08:54.006Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/88/b2/d0896bdcdc8d28a7fc5717c305f1a861c26e18c05047949fb371034d98bd/nodeenv-1.10.0-py2.py3-none-any.whl", hash = "sha256:5bb13e3eed2923615535339b3c620e76779af4cb4c6a90deccc9e36b274d3827", size = 23438, upload-time = "2025-12-20T14:08:52.782Z" },
+]
+
+[[package]]
+name = "packaging"
+version = "26.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/f1/e7a6dd94a8d4a5626c03e4e99c87f241ba9e350cd9e6d75123f992427270/packaging-26.2.tar.gz", hash = "sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661", size = 228134, upload-time = "2026-04-24T20:15:23.917Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
+]
+
+[[package]]
+name = "platformdirs"
+version = "4.10.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d7/47/e4501f49c178ae1d9f4a75073fda4204f52647993f075a9db4d14930e0c5/platformdirs-4.10.0.tar.gz", hash = "sha256:31e761a6a0ca04faf7353ea759bdba55652be214725111e5aac52dfa29d4bef7", size = 31224, upload-time = "2026-05-28T03:32:53.587Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/81/e6/cd9575ac904136b3cbf7aa7ee819ef86eedb7274e46f230e94ea4342e729/platformdirs-4.10.0-py3-none-any.whl", hash = "sha256:fb516cdb12eb0d857d0cd85a7c57cea4d060bee4578d6cf5a14dfdf8cbf8784a", size = 22743, upload-time = "2026-05-28T03:32:52.175Z" },
+]
+
+[[package]]
+name = "pluggy"
+version = "1.6.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/f9/e2/3e91f31a7d2b083fe6ef3fa267035b518369d9511ffab804f839851d2779/pluggy-1.6.0.tar.gz", hash = "sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3", size = 69412, upload-time = "2025-05-15T12:30:07.975Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
+]
+
+[[package]]
+name = "pre-commit"
+version = "4.6.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cfgv" },
+    { name = "identify" },
+    { name = "nodeenv" },
+    { name = "pyyaml" },
+    { name = "virtualenv" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/8e/22/2de9408ac81acbb8a7d05d4cc064a152ccf33b3d480ebe0cd292153db239/pre_commit-4.6.0.tar.gz", hash = "sha256:718d2208cef53fdc38206e40524a6d4d9576d103eb16f0fec11c875e7716e9d9", size = 198525, upload-time = "2026-04-21T20:31:41.613Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/80/6e/4b28b62ecb6aae56769c34a8ff1d661473ec1e9519e2d5f8b2c150086b26/pre_commit-4.6.0-py2.py3-none-any.whl", hash = "sha256:e2cf246f7299edcabcf15f9b0571fdce06058527f0a06535068a86d38089f29b", size = 226472, upload-time = "2026-04-21T20:31:40.092Z" },
+]
+
+[[package]]
+name = "propcache"
+version = "0.5.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/ec/44/c87281c333769159c50594f22610f77398a47ccbfbbf23074e744e86f87c/propcache-0.5.2.tar.gz", hash = "sha256:01c4fc7480cd0598bb4b57022df55b9ca296da7fc5a8760bd8451a7e63a7d427", size = 50208, upload-time = "2026-05-08T21:02:12.199Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e7/f1/8a8cc1c2c7e7934ab77e0163414f736fadbc0f5e8dd9673b952355ac175b/propcache-0.5.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:74b70780220e2dd89175ca24b81b68b67c83db499ae611e7f2313cb329801c78", size = 90744, upload-time = "2026-05-08T20:59:45.799Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/f4/651b1225e976bd1a2ba5cfba0c29d096581c2636b437e3a9a7ab6276270a/propcache-0.5.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a4840ab0ae0216d952f4b53dc6d0b992bfc2bedbfe360bdd9b548bc184c08959", size = 52033, upload-time = "2026-05-08T20:59:47.408Z" },
+    { url = "https://files.pythonhosted.org/packages/15/a8/8ede85d6aa1f79fc7dc2f8fd2c8d65920b8272c3892903c8a1affde48cfb/propcache-0.5.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c6844ba6364fb12f403928a82cfd295ab103a2b315c77c747b2dbe4a41894ea7", size = 52754, upload-time = "2026-05-08T20:59:49.202Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/fe/b3551b41bbc2f5b5bb088fc6920567cd43101253e68fbaa261339eb96fe1/propcache-0.5.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2293949b855ce597f2826452d17c2d545fb5622379c4ea6fdf525e9b8e8a2511", size = 57573, upload-time = "2026-05-08T20:59:50.778Z" },
+    { url = "https://files.pythonhosted.org/packages/83/27/ab851ebd1b7172e3e161f5f8d39e315d54a91bea246f01f4d872d3376aef/propcache-0.5.2-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0fd59b5af35f74da48d905dcbad55449ba13be91823cb05a9bd590bbf5b61660", size = 60645, upload-time = "2026-05-08T20:59:52.227Z" },
+    { url = "https://files.pythonhosted.org/packages/95/7d/466b3d18022e9897cbda9c735c493c5bd747d7a4c6f5ea1480b4cec434b6/propcache-0.5.2-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:29f9309a2e42b0d273be006fdb4be2d6c39a47f6f57d8fb1cf9f81481df81b66", size = 61563, upload-time = "2026-05-08T20:59:53.866Z" },
+    { url = "https://files.pythonhosted.org/packages/27/1b/16ab7f2cf2041da2f60d156ba64c2484eadf9168075b4ff43c3ef60045af/propcache-0.5.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5aaa2b923c1944ac8febd6609cb373540a5563e7cbcb0fd770f75dace2eb817b", size = 58888, upload-time = "2026-05-08T20:59:55.457Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/67/bb777ffd907633563bf35fd859c4ce97b0512c32f4633cf5d1eb7c33512b/propcache-0.5.2-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:66ea454f095ddf5b6b14f56c064c0941c4788be11e18d2464cf643bf7203ff67", size = 59253, upload-time = "2026-05-08T20:59:57.075Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/42/64f8d90b73fd9cdc1499b48057ff6d9cd2a98a25734c9bb62ecf07e87061/propcache-0.5.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:95f1e3f4760d404b13c9976c0229b2b49a3c8e2c62a9ce92efdd2b11ada75e3f", size = 57558, upload-time = "2026-05-08T20:59:58.602Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/02/dba5bc03c9041f2092ea55a449caf5dfe68352c6654511b29ba0654ddb69/propcache-0.5.2-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:85341b12b9d55bad0bded24cac341bb34289469e03a11f3f583ea1cc1db0326c", size = 55007, upload-time = "2026-05-08T20:59:59.837Z" },
+    { url = "https://files.pythonhosted.org/packages/14/c0/43f649c7aa2a77a3b100d84e9dea3a483120ecb608bfe36ce49eaff517fe/propcache-0.5.2-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:26a4dca084132874e639895c3135dfad5eb20bae209f62d1aeb31b03e601c3c0", size = 60355, upload-time = "2026-05-08T21:00:01.144Z" },
+    { url = "https://files.pythonhosted.org/packages/83/c0/435dafd27f1cb4a495381dae60e25883ccfe4020bb72818e8184c1678092/propcache-0.5.2-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:3b199b9b2b3d6a7edf3183ba8a9a137a22b97f7df525feb5ae1eccf026d2a9c6", size = 59057, upload-time = "2026-05-08T21:00:02.401Z" },
+    { url = "https://files.pythonhosted.org/packages/53/ae/6e292df9135d659944e96cb3389258e4a663e5b2b5f6c217ef0ddc8d2f73/propcache-0.5.2-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:e59bc9e66329185b93dab73f210f1a37f81cb40f321501db8017c9aea15dba27", size = 61938, upload-time = "2026-05-08T21:00:03.638Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/42/314ebc50d8159055411fd6b0bda322ff510e4b1f7d2e4927940ad0f6af20/propcache-0.5.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:552ffadf6ad409844bc5919c42a0a83d88314cedddaea0e41e80a8b8fffe881f", size = 59731, upload-time = "2026-05-08T21:00:04.881Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/9b/2da6dee38871c3c8772fabc2758325a5c9077d6d18c597737dc04dd884cd/propcache-0.5.2-cp311-cp311-win32.whl", hash = "sha256:cd416c1de191973c52ff1a12a57446bfc7642797b282d7caf2162d7d1b8aa9a0", size = 38966, upload-time = "2026-05-08T21:00:06.511Z" },
+    { url = "https://files.pythonhosted.org/packages/42/4e/f17363fb58c0afe05b067361cb6d86ed2d29de6506779a27547c4d183075/propcache-0.5.2-cp311-cp311-win_amd64.whl", hash = "sha256:44e488ef40dbb452700b2b1f8188934121f6648f52c295055662d2191959ff82", size = 42135, upload-time = "2026-05-08T21:00:08.088Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/eb/6af6685077d22e8b33358d3c548e3282706a0b3cd85044ffba4e5dd08e3b/propcache-0.5.2-cp311-cp311-win_arm64.whl", hash = "sha256:54adaa85a22078d1e306304a40984dc5be99d599bf3dc0a24dc98f7daeab89ab", size = 38381, upload-time = "2026-05-08T21:00:09.692Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/cb/e27bc2b2737a0bb49962b275efa051e8f1c35a936df7d5139b6b658b7dc9/propcache-0.5.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:806719138ecd720339a12410fb9614ac9b2b2d3a5fdf8235d56981c36f4039ba", size = 95887, upload-time = "2026-05-08T21:00:11.277Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/13/b8ae04c59392f8d11c6cd9fb4011d1dc7c86b81225c770280300e259ffe1/propcache-0.5.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:db2b80ea58eab4f86b2beec3cc8b39e8ff9276ac20e96b7cce43c8ae84cd6b5a", size = 54654, upload-time = "2026-05-08T21:00:12.604Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/7d/49777a3e20b55863d4794384a38acd460c04157b0a00f8602b0d508b8431/propcache-0.5.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:e5cbfac9f61484f7e9f3597775500cd3ebe8274e9b050c38f9525c77c97520bf", size = 55190, upload-time = "2026-05-08T21:00:13.935Z" },
+    { url = "https://files.pythonhosted.org/packages/44/c7/085d0cd63062e84044e3f05797749c3f8e3938ff3aeb0eb2f69d43fafc91/propcache-0.5.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5dbc581d2814337da56222fab8dc5f161cd798a434e49bac27930aaef798e144", size = 59995, upload-time = "2026-05-08T21:00:15.526Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/42/32cf8e3009e92b2645cf1e944f701e8ea4e924dffde1ee26db860bcbf7e4/propcache-0.5.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:857187f381f88c8e2fa2fe56ab94879d011b883d5a2ee5a1b60a8cd2a06846d9", size = 63422, upload-time = "2026-05-08T21:00:16.824Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/1b/f112433f99fc979431b87a39ef169e3f8df070d99a72792c56d6937ac48b/propcache-0.5.2-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:178b4a2cdaac1818e2bf1c5a99b94383fa73ea5382e032a48dec07dc5668dc42", size = 64342, upload-time = "2026-05-08T21:00:18.362Z" },
+    { url = "https://files.pythonhosted.org/packages/14/15/5574111ae50dd6e879456888c0eadd4c5a869959775854e18e18a6b345f3/propcache-0.5.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:6f328175a2cde1f0ff2c4ed8ce968b9dcfb55f3a7153f39e2957ed994da13476", size = 61639, upload-time = "2026-05-08T21:00:19.692Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/da/4d775080b1490c0ae604acda868bd71aabe3a89ed16f2aa4339eb8a283e7/propcache-0.5.2-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5671d09a36b06d0fd4a3da0fccbcae360e9b1570924171a15e9e0997f0249fba", size = 61588, upload-time = "2026-05-08T21:00:21.155Z" },
+    { url = "https://files.pythonhosted.org/packages/04/ac/f076982cbe2195ee9cf32de5a1e46951d9fb399fc207f390562dd0fd8fb2/propcache-0.5.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:80168e2ebe4d3ec6599d10ad8f520304ae1cad9b6c5a95372aef1b66b7bfb53a", size = 60029, upload-time = "2026-05-08T21:00:22.713Z" },
+    { url = "https://files.pythonhosted.org/packages/70/60/189be62e0dd898dce3b331e1b8c7a543cd3a405ac0c81fe8ee8a9d5d77e1/propcache-0.5.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:45f11346f884bc47444f6e6647131055844134c3175b629f84952e2b5cd62b64", size = 56774, upload-time = "2026-05-08T21:00:24.001Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/9e/93377b9c7939c1ffae98f878dee955efadfd638078bc86dbc21f9d52f651/propcache-0.5.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:8e778ebd44ef4f66ed60a0416b06b489687db264a9c0b3620362f26489492913", size = 63532, upload-time = "2026-05-08T21:00:25.545Z" },
+    { url = "https://files.pythonhosted.org/packages/14/f9/590ef6cfb9b8028d516d287812ece32bb0bc5f11fbb9c8bf6b2e6313fec8/propcache-0.5.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:c0cb9ed24c8964e172768d455a38254c2dd8a552905729ce006cad3d3dda59b1", size = 61592, upload-time = "2026-05-08T21:00:27.186Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/5e/70958b3034c297a630bba2f17ca7abc2d5f39a803ad7e370ab79d1ecd022/propcache-0.5.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:1d1ad32d9d4355e2be65574fd0bfd3677e7066b009cd5b9b2dee8aa6a6393b33", size = 64788, upload-time = "2026-05-08T21:00:28.8Z" },
+    { url = "https://files.pythonhosted.org/packages/12/fd/77fe5936d8c3086ca9048f7f415f122ed82e53884a9ec193646b42deef06/propcache-0.5.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c80f4ba3e8f00189165999a742ee526ebeccedf6c3f7beb0c7df821e9772435a", size = 62514, upload-time = "2026-05-08T21:00:30.098Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/74/66bd798b5b3be70aa1b391f5cc9d6a0a5532d7fd3b19ec0b213e72e6ad9d/propcache-0.5.2-cp312-cp312-win32.whl", hash = "sha256:8c7972d8f193740d9175f0998ab38717e6cd322d5935c5b0fef8c0d323fd9031", size = 39018, upload-time = "2026-05-08T21:00:31.622Z" },
+    { url = "https://files.pythonhosted.org/packages/61/7c/5c0d34aa3024694d6dcb9271cdbdd08c4e47c1c0ad95ec7e7bc74cdea145/propcache-0.5.2-cp312-cp312-win_amd64.whl", hash = "sha256:d9ee8826a7d47863a08ac44e1a5f611a462eefc3a194b492da242128bec75b42", size = 42322, upload-time = "2026-05-08T21:00:32.918Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/91/875812f1a3feb20ceba818ef39fbe4d92f1081e04ac815c822496d0d038b/propcache-0.5.2-cp312-cp312-win_arm64.whl", hash = "sha256:2800a4a8ead6b28cccd1ec54b59346f0def7922ee1c7598e8499c733cfbb7c84", size = 38172, upload-time = "2026-05-08T21:00:35.124Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/09/f049e45385503fe67db75a6b6186a7b9f0c3930366dc960522c312a825b1/propcache-0.5.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:099aaf4b4d1a02265b92a977edf00b5c4f63b3b17ac6de39b0d637c9cac0188a", size = 94457, upload-time = "2026-05-08T21:00:36.355Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/65/83d1d05655baf63113731bd5a1008435e14f8d1e5a06cbe4ec5b23ad7a31/propcache-0.5.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:68ce1c44c7a813a7f71ea04315a8c7b330b63db99d059a797a4651bb6f69f117", size = 53835, upload-time = "2026-05-08T21:00:38.072Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/12/a6ba6482bb5ea3260c000c9b20881c95fa11c6b30173715668259f844ed7/propcache-0.5.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:fc299c129490f55f254cd90be0deca4764e36e9a7c08b4aa588479a3bbed3098", size = 54545, upload-time = "2026-05-08T21:00:39.319Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/19/7fa086f5764c59ec8a8e157cd93aa8497acc00aba9dcdec56bfffb32602d/propcache-0.5.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a6ae2198be502c10f09b2516e7b5d019816924bc3183a43ce792a7bd6625e6f4", size = 59886, upload-time = "2026-05-08T21:00:40.621Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/e4/5d7663dc8235956c8f5281698a3af1d351d8820341ddd890f59d9a9127f2/propcache-0.5.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:6041d31504dc1779d700e1edcfb08eea334b357620b06681a4eabb57a74e574e", size = 63261, upload-time = "2026-05-08T21:00:41.775Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/4a/15a03adee24d6350da4292caeac44c34c033d2afe5e87eb370f38854560f/propcache-0.5.2-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f7eabc04151c78a9f4d5bbb5f1faf571e4defeb4b585e0fe95b60ff2dbe4d3d7", size = 64184, upload-time = "2026-05-08T21:00:43.018Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/c6/979176efdaa3d239e36d503d5af63a0a773b36662ed8f52e5b6a6d9fd40e/propcache-0.5.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4db0ba63d693afd40d249bd93f842b5f144f8fcbb83de05660373bcf30517b1d", size = 61534, upload-time = "2026-05-08T21:00:44.507Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/22/63e8cd1bae4c2d2be6493b6b7d10566ddafad88137cfbc99964a1119853c/propcache-0.5.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1dbcf7675229b35d31abb6547d8ebc8c27a830ac3f9a794edff6254873ec7c0a", size = 61500, upload-time = "2026-05-08T21:00:45.796Z" },
+    { url = "https://files.pythonhosted.org/packages/60/5a/28e5d9acbac1cc9ccb67045e8c1b943aa8d79fdf39c93bd73cacd68008ea/propcache-0.5.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d310c013aad2c72f1c3f2f8dd3279d460a858c551f97aeb8c63e4693cca7b4d2", size = 59994, upload-time = "2026-05-08T21:00:47.093Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/40/db650677f554a95b9c01a7c9d93d629e93a15562f5deb4573c9ee136fed2/propcache-0.5.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:06187263ddad280d05b4d8a8b3bb7d164cbebd469236544a42e6d9b28ac6a4fa", size = 56884, upload-time = "2026-05-08T21:00:48.376Z" },
+    { url = "https://files.pythonhosted.org/packages/80/45/70b39b89516ff8b96bf732fa6fded8cef20f293cb1508690101c3c07ec51/propcache-0.5.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:3115559b8effafd63b142ea5ed53d63a16ea6469cbc63dce4ee194b42db5d853", size = 63464, upload-time = "2026-05-08T21:00:49.954Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/e2/fa59d3a89eac5534293124af4f1d0d0ada091ce4a0ab4610ce03fd2bdd8d/propcache-0.5.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:c60462af8e6dc30c35407c7237ea908d777b22862bbee27bc4699c0d8bcdc45a", size = 61588, upload-time = "2026-05-08T21:00:51.281Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/97/efb547a55c4bc7381cfb202d6a2239ac621045277bc1ea5dfd3a7f0516c0/propcache-0.5.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:40314bca9ac559716fe374094fc81c11dcc34b64fd6c585360f5775690505704", size = 64667, upload-time = "2026-05-08T21:00:52.602Z" },
+    { url = "https://files.pythonhosted.org/packages/92/56/f5c7d9b4b7595d5127da38974d791b2153f3d1eae6c674af3583ace92ad3/propcache-0.5.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cfa21e036ce1e1db2be04ba3b85d2df1bb1702fa01932d984c5464c665228ff4", size = 62463, upload-time = "2026-05-08T21:00:54.303Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/3b/484a3a65fc9f9f60c41dcd17b428bace5389544e2c680994534a20755066/propcache-0.5.2-cp313-cp313-win32.whl", hash = "sha256:f156a3529f38063b6dbaf356e15602a7f95f8055b1295a438433a6386f10463d", size = 38621, upload-time = "2026-05-08T21:00:55.808Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/fd/3f0f10dba4dabad3bf53102be007abf55481067952bde0fdddff439e7c61/propcache-0.5.2-cp313-cp313-win_amd64.whl", hash = "sha256:dfed59d0a5aeb01e242e66ff0300bc4a265a7c05f612d30016f0b60b1017d757", size = 41649, upload-time = "2026-05-08T21:00:57.061Z" },
+    { url = "https://files.pythonhosted.org/packages/90/ec/6ce619cc32bb500a482f811f9cd509368b4e58e638d13f2c68f370d6b475/propcache-0.5.2-cp313-cp313-win_arm64.whl", hash = "sha256:ba338430e87ceb9c8f0cf754de38a9860560261e56c00376debd628698a7364f", size = 37636, upload-time = "2026-05-08T21:00:58.646Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/82/c1d268bbbf2ef981c5bf0fbbe746db617c66e3bcefe431a1aa8943fbe23a/propcache-0.5.2-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:a592f5f3da71c8691c788c13cb6734b6d17663d2e1cb8caddf0673d01ef8847d", size = 98872, upload-time = "2026-05-08T21:00:59.889Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/d4/52c871e73e864e6b34c0e2d58ac1ec5ccd149497ddc7ad2137ae98323a35/propcache-0.5.2-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:6a997d0489e9668a384fcfd5061b857aa5361de73191cac204d04b889cfbbafa", size = 56257, upload-time = "2026-05-08T21:01:01.195Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f0/9b90ca2a210b3d09bcfcd96ecd0f55545c091535abce2a45de2775cfd357/propcache-0.5.2-cp313-cp313t-macosx_11_0_arm64.whl", hash = "sha256:10734b5484ea113152ee25a91dccedf81631791805d2c9ccb054958e51842c94", size = 56696, upload-time = "2026-05-08T21:01:02.941Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/0e/6e9d4ba07c8e56e21ddec1e75f12148142b21ca83a51871babce095334f4/propcache-0.5.2-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:cafca7e56c12bb02ae16d283742bef25a61122e9dab2b5b3f2ccbe589ce32164", size = 62378, upload-time = "2026-05-08T21:01:04.475Z" },
+    { url = "https://files.pythonhosted.org/packages/65/19/c10badaa463dde8a27ce884f8ee2ec37e6035b7c9f5ff0c8f74f06f08dac/propcache-0.5.2-cp313-cp313t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f064f8d2b59177878b7615df1735cd8fe3462ed6be8c7b217d17a276489c2b7f", size = 65283, upload-time = "2026-05-08T21:01:05.959Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/b6/93bea99ca80e19cef6512a8580e5b7857bbe09422d9daa7fd4ef5723306c/propcache-0.5.2-cp313-cp313t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:f78abfa8dfc32376fd1aacf597b2f2fbbe0ea751419aee718af5d4f82537ef8c", size = 66616, upload-time = "2026-05-08T21:01:07.228Z" },
+    { url = "https://files.pythonhosted.org/packages/83/e4/5c7462e50625f051f37fb38b8224f7639f667184bbd34424ec83819bb1b7/propcache-0.5.2-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f7467da8a9822bf1a55336f877340c5bcbd3c482afc43a99771169f74a26dedc", size = 63773, upload-time = "2026-05-08T21:01:08.514Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/b6/99238894047b13c823be25027e736626cd414a52a5e30d2c3347c2733529/propcache-0.5.2-cp313-cp313t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a6ddc6ac9e25de626c1f129c1b467d7ecd33ce2237d3fd0c4e429feef0a7ee1f", size = 63664, upload-time = "2026-05-08T21:01:09.874Z" },
+    { url = "https://files.pythonhosted.org/packages/85/1e/a3a1a63116a2b8edb415a8bb9a6f0c34bd03830b1e18e8ce2904e1dc1cf4/propcache-0.5.2-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:2f22cbbac9e26a8e864c0985ff1268d5d939d53d9d9411a9824279097e03a2cb", size = 62643, upload-time = "2026-05-08T21:01:11.132Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/03/893cf147de2fc6543c5eaa07ad833170e7e2a2385725bbebe8c0503723bb/propcache-0.5.2-cp313-cp313t-musllinux_1_2_armv7l.whl", hash = "sha256:fc76378c62a0f04d0cd82fbb1a2cd2d7e28fcb40d5873f28a6c44e388aaa2751", size = 59595, upload-time = "2026-05-08T21:01:12.387Z" },
+    { url = "https://files.pythonhosted.org/packages/86/3b/04c1a2e12c57766568ba75ba72b3bf2042818d4c1425fab6fc07155c7cff/propcache-0.5.2-cp313-cp313t-musllinux_1_2_ppc64le.whl", hash = "sha256:acd2c8edba48e31e58a363b8cf4e5c7db3b04b3f9e371f601df30d9b0d244836", size = 65711, upload-time = "2026-05-08T21:01:13.676Z" },
+    { url = "https://files.pythonhosted.org/packages/1c/34/80f8d0099f8d6bacc4de1624c85672681c8cd1149ca2da0e38fd120b817f/propcache-0.5.2-cp313-cp313t-musllinux_1_2_riscv64.whl", hash = "sha256:452b5065457eb9991ec5eb38ff41d6cd4c991c9ac7c531c4d5849ae473a9a13f", size = 64247, upload-time = "2026-05-08T21:01:14.936Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/1a/8b08f3a5f1037e9e370c55883ceeeee0f6dd0416fb2d2d67b8bfc91f2a79/propcache-0.5.2-cp313-cp313t-musllinux_1_2_s390x.whl", hash = "sha256:3430bb2bfe1331885c427745a751e774ee679fd4344f80b97bf879815fe8fa55", size = 67102, upload-time = "2026-05-08T21:01:16.281Z" },
+    { url = "https://files.pythonhosted.org/packages/34/68/8bdb7bb7756d76e005490649d10e4a8369e610c74d619f71e1aedf889e9c/propcache-0.5.2-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:cef6cea3922890dd6c9654971001fa797b526c16ab5e1e46c05fd6f877be7568", size = 64964, upload-time = "2026-05-08T21:01:17.57Z" },
+    { url = "https://files.pythonhosted.org/packages/0a/aa/50fb0b5d3968b61a510926ff8b8465f1d6e976b3ab74496d7a4b9fc42515/propcache-0.5.2-cp313-cp313t-win32.whl", hash = "sha256:72d61e16dd78228b58c5d47be830ff3da7e5f139abdf0aef9d86cde1c5cf2191", size = 42546, upload-time = "2026-05-08T21:01:18.946Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/4c/0ddbae64321bd4a95bcbfc19307238016b5b1fee645c84626c8d539e5b74/propcache-0.5.2-cp313-cp313t-win_amd64.whl", hash = "sha256:0958834041a0166d343b8d2cedcd8bcbaeb4fdbe0cf08320c5379f143c3be6e7", size = 46330, upload-time = "2026-05-08T21:01:20.162Z" },
+    { url = "https://files.pythonhosted.org/packages/00/d9/9cddc8efb78d8af264c5ec9f6d10b62f57c515feda8d321595f56010fb23/propcache-0.5.2-cp313-cp313t-win_arm64.whl", hash = "sha256:6de8bd93ddde9b992cf2b2e0d796d501a19026b5b9fd87356d7d0779531a8d96", size = 40521, upload-time = "2026-05-08T21:01:21.399Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/ea/23ee535d90ce8bcc465a3028eb3cc0ce3bd1005f4bb27710b30587de798d/propcache-0.5.2-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:46088abff4cba581dea21ae0467a480526cb25aa5f3c269e909f800328bc3999", size = 94662, upload-time = "2026-05-08T21:01:22.683Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/06/c5a52f419b5d8972f8d46a7577476090d8e3263ff589ce40b5ca4968d5be/propcache-0.5.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:fc88b26f08d634f7bc819a7852e5214f5802641ab8d9fd5326892292eee1993e", size = 53928, upload-time = "2026-05-08T21:01:23.986Z" },
+    { url = "https://files.pythonhosted.org/packages/63/b1/4260d67d6bd85e58a66b72d54ce15d5de789b6f3870cc6bedf8ff9667401/propcache-0.5.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:97797ebb098e670a2f92dd66f32897e30d7615b14e7f59711de23e30a9072539", size = 54650, upload-time = "2026-05-08T21:01:25.305Z" },
+    { url = "https://files.pythonhosted.org/packages/70/06/2f46c318e3307cd7a6a7481def374ce838c0fe20084b39dd54b0879d0e99/propcache-0.5.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ba57fffe4ac99c5d30076161b5866336d97600769bad35cc68f7774b15298a4e", size = 59912, upload-time = "2026-05-08T21:01:26.545Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/29/fe1aebec2ce57ab985a9c382bded1124431f85078113aa222c5d278430d4/propcache-0.5.2-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:583c19759d9eec1e5b69e2fbef36a7d9c326041be9746cb822d335c8cedc2979", size = 63300, upload-time = "2026-05-08T21:01:27.937Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/18/2334b26768b6c82be8c69e83671b767d5ef426aa09b0cba6c2ea47816774/propcache-0.5.2-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:d0326e2e5e1f3163fa306c834e48e8d490e5fae607a097a40c0648109b47ba80", size = 64208, upload-time = "2026-05-08T21:01:29.484Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/76/7f1bfd6afff4c5e38e36a3c6d68eb5f4b7311ea80baf693db78d95b603c4/propcache-0.5.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e00820e192c8dbebcafb383ebbf99030895f09905e7a0eb2e0340a0bcc2bc825", size = 61633, upload-time = "2026-05-08T21:01:31.068Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/46/b3ff8aba2b4953a3e50de2cf72f1b5748b8eca93b15f3dc2c84339084c09/propcache-0.5.2-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c66afea89b1e43725731d2004732a046fe6fe955d51f952c3e95a7314a284a39", size = 61724, upload-time = "2026-05-08T21:01:32.374Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/01/814cfcafbcff954f94c01cf30e097ddc88a076b5440fbcf4570753437d40/propcache-0.5.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:d4dc37dec6c6cdad0b57881a5658fd14fbf53e333b1a86cf86559f190e1d9ec4", size = 60069, upload-time = "2026-05-08T21:01:33.67Z" },
+    { url = "https://files.pythonhosted.org/packages/da/68/5c6f7622d510cc666a300687e06fd060c1a43361c0c9b20d284f06d8096a/propcache-0.5.2-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:5570dbcc97571c15f68068e529c92715a12f8d54030e272d264b377e22bd17a5", size = 57099, upload-time = "2026-05-08T21:01:34.915Z" },
+    { url = "https://files.pythonhosted.org/packages/55/27/9cb0b4c679124085327957d42521c99dba04c88c90c3e55a6f0b633ebccc/propcache-0.5.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:f814362777a9f841adddb200ecdf8f5cb1e5a3c4b7a86378edbd6ccb26edd702", size = 63391, upload-time = "2026-05-08T21:01:36.231Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/9d/7258aaa5bdf60fc6f27591eef6fe52768cb0beda7140be477c8b12c9794a/propcache-0.5.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:196913dea116aeb5a2ba95af4ddcb7ea85559ae07d8eee8751688310d09168c3", size = 61626, upload-time = "2026-05-08T21:01:37.545Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/0d/41c602003e8a9b16fe1e7eadf62c7bfba9d5474370b24200bf48b315f45f/propcache-0.5.2-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:6e7b8719005dd1175be4ab1cd25e9b98659a5e0347331506ec6760d2773a7fb5", size = 64781, upload-time = "2026-05-08T21:01:38.83Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/f3/38e66b1856e9bd079deea015bc4a55f7767c0e4db2f7dcf69e7e680ba4ce/propcache-0.5.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:51f96d685ab16e88cab128cd37a52c5da540809c8b879fa047731bfcb4ad35a4", size = 62570, upload-time = "2026-05-08T21:01:40.415Z" },
+    { url = "https://files.pythonhosted.org/packages/95/ca/bbfe9b910ce57dde8bb4876b4520fc02a4e89497c10de26be936758a3aaa/propcache-0.5.2-cp314-cp314-win32.whl", hash = "sha256:cc6fc3cc62e8501d3ed62894425040d2728ecddb1ed072737a5c70bd537aa9f0", size = 39436, upload-time = "2026-05-08T21:01:41.654Z" },
+    { url = "https://files.pythonhosted.org/packages/61/d2/45c9defbaa1ea297035d9d4cce9e8f80daafbf19319c6007f157c6256ea9/propcache-0.5.2-cp314-cp314-win_amd64.whl", hash = "sha256:81e3a30b0bb60caa22033dd0f8a3618d1d67356212514f62c57db75cb0ef410c", size = 42373, upload-time = "2026-05-08T21:01:43.041Z" },
+    { url = "https://files.pythonhosted.org/packages/44/68/9ea5103f41d5217d7d6ec24db90018e23aebec070c3f9a6e54d12b841fd8/propcache-0.5.2-cp314-cp314-win_arm64.whl", hash = "sha256:0d2c9bf8528f135dbb805ce027567e09164f7efa51a2be07458a2c0420f292d0", size = 38554, upload-time = "2026-05-08T21:01:44.336Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/81/fadf555f42d3b762eea8a53950b0489fdc0aa9da5f8ed9e10ce0a4e01b48/propcache-0.5.2-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:4bc8ff1feffc6a61c7002ffe84634c41b822e104990ae009f44a0834430070bb", size = 99395, upload-time = "2026-05-08T21:01:45.883Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/c9/c61e134a686949cf7971af3a390148b1156f7be81c73bc0cd12c873e2d48/propcache-0.5.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:79aa3ff0a9b566633b642fa9caf7e21ed1c13d6feca718187873f199e1514078", size = 56653, upload-time = "2026-05-08T21:01:47.307Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/73/daf935ea7048ddd7ec8eec5345b4a40b619d2d178b3c0a0900796bc3c794/propcache-0.5.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1b31822f4474c4036bae62de9402710051d431a606d6a0f907fec79935a071aa", size = 56914, upload-time = "2026-05-08T21:01:48.573Z" },
+    { url = "https://files.pythonhosted.org/packages/79/9f/aba959b435ea18617edd7cf0a7ad0b9c574b8fc7e3d2cd55fb59cb255d33/propcache-0.5.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:13fef48778b5a2a756523fdb781326b028ca75e32858b04f2cdd19f394564917", size = 62567, upload-time = "2026-05-08T21:01:49.903Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/a1/859942de9a791ff42f6141736f5b37749b8f53e65edfa49638c67dd67e6a/propcache-0.5.2-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8b73ab70f1a3351fbc71f663b3e645af6dd0329100c353081cf69c37433fc6fe", size = 65542, upload-time = "2026-05-08T21:01:51.204Z" },
+    { url = "https://files.pythonhosted.org/packages/b5/61/315bc0fd6c0fc7f80a528b8afd209e5fc4a875ea79571b91b8f50f442907/propcache-0.5.2-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5538d2c13d93e4698af7e092b57bc7298fd35d1d58e656ae18f23ee0d0378e03", size = 66845, upload-time = "2026-05-08T21:01:52.539Z" },
+    { url = "https://files.pythonhosted.org/packages/47/f7/9f8122e3132e8e354ac41975ef8f1099be7d5a16bc7ae562734e993665c0/propcache-0.5.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cd645f03898405cabe694fb8bc35241e3a9c332ec85627584fe3de201452b335", size = 63985, upload-time = "2026-05-08T21:01:53.847Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/54/c317819ec157cbf6f35df9df9657a6f82daf34d5faf15948b2f639c2192e/propcache-0.5.2-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:a473b3440261e0c60706e732b2ed2f517857344fc21bf48fdfe211e2d98eb285", size = 63999, upload-time = "2026-05-08T21:01:55.179Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/56/387e3f7dfce0a9233df41fb888aa1c30222cb4bbbf09537c02dd9bd85fe2/propcache-0.5.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:7afa37062e6650640e932e4cc9297d81f9f42d9944029cc386b8247dea4da837", size = 62779, upload-time = "2026-05-08T21:01:57.489Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/9c/596784cb5824ed61ee960d3f8655a3f0993e107c6e98ab6c818b7fb92ccb/propcache-0.5.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:8a90efd5777e996e42d568db9ac740b944d691e565cbfd31b2f7832f9184b2b8", size = 59796, upload-time = "2026-05-08T21:01:58.736Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/3d/1a6cfa1726a48542c1e8784a0761421476a5b68e09b7f36bf95eb954aaba/propcache-0.5.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:f19bb891234d72535764d703bfed1153cc34f4214d5bd7150aee1eec9e8f4366", size = 66023, upload-time = "2026-05-08T21:02:00.228Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/0e/05fd6990369477076e4e280bcb970de760fddf0161a46e988bc95f7940ec/propcache-0.5.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:32775082acd2d807ee3db715c7770d38767b817870acfa08c29e057f3c4d5b56", size = 64448, upload-time = "2026-05-08T21:02:01.888Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/86/5f8da315a4309c62c10c0b2516b17492d5d3bbe1bb862b96604db67e2a37/propcache-0.5.2-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:9282fb1a3bccd038da9f768b927b24a0c753e466c086b7c4f3c6982851eefb2d", size = 67329, upload-time = "2026-05-08T21:02:03.484Z" },
+    { url = "https://files.pythonhosted.org/packages/da/d3/3368efe79ab21f0cdf86ef49895811c9cc933131d4cde1f28a624e22e712/propcache-0.5.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:cc49723e2f60d6b32a0f0b08a3fd6d13203c07f1cd9566cfce0f12a917c967a2", size = 65172, upload-time = "2026-05-08T21:02:04.745Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/07/127e8b0bacfb325396196f9d976a22453049b89b9b2b08477cc3145faa44/propcache-0.5.2-cp314-cp314t-win32.whl", hash = "sha256:2d7aa89ebca5acc98cba9d1472d976e394782f587bad6661003602a619fd1821", size = 43813, upload-time = "2026-05-08T21:02:06.025Z" },
+    { url = "https://files.pythonhosted.org/packages/88/fb/46dad6c0ae49ed230ab1b16c890c2b6314e2403e6c412976f4a72d64a527/propcache-0.5.2-cp314-cp314t-win_amd64.whl", hash = "sha256:d447bb0b3054be5818458fbb171208b1d9ff11eba14e18ca18b90cbb45767370", size = 47764, upload-time = "2026-05-08T21:02:07.353Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/c4/a47d0a63aa309d10d59ede6e9d4cff03a344a79d1f0f4cd0cd74997b53e0/propcache-0.5.2-cp314-cp314t-win_arm64.whl", hash = "sha256:fe67a3d11cd9b4efabfa45c3d00ffba2b26811442a73a581a94b67c2b5faccf6", size = 41140, upload-time = "2026-05-08T21:02:09.065Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/ed/1cdcab6ba3d6ab7feca11fc14f0eeea80755bb53ef4e892079f31b10a25f/propcache-0.5.2-py3-none-any.whl", hash = "sha256:be1ddfcbb376e3de5d2e2db1d58d6d67463e6b4f9f040c000de8e300295465fe", size = 14036, upload-time = "2026-05-08T21:02:10.673Z" },
+]
+
+[[package]]
+name = "protobuf"
+version = "6.33.6"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/66/70/e908e9c5e52ef7c3a6c7902c9dfbb34c7e29c25d2f81ade3856445fd5c94/protobuf-6.33.6.tar.gz", hash = "sha256:a6768d25248312c297558af96a9f9c929e8c4cee0659cb07e780731095f38135", size = 444531, upload-time = "2026-03-18T19:05:00.988Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fc/9f/2f509339e89cfa6f6a4c4ff50438db9ca488dec341f7e454adad60150b00/protobuf-6.33.6-cp310-abi3-win32.whl", hash = "sha256:7d29d9b65f8afef196f8334e80d6bc1d5d4adedb449971fefd3723824e6e77d3", size = 425739, upload-time = "2026-03-18T19:04:48.373Z" },
+    { url = "https://files.pythonhosted.org/packages/76/5d/683efcd4798e0030c1bab27374fd13a89f7c2515fb1f3123efdfaa5eab57/protobuf-6.33.6-cp310-abi3-win_amd64.whl", hash = "sha256:0cd27b587afca21b7cfa59a74dcbd48a50f0a6400cfb59391340ad729d91d326", size = 437089, upload-time = "2026-03-18T19:04:50.381Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/01/a3c3ed5cd186f39e7880f8303cc51385a198a81469d53d0fdecf1f64d929/protobuf-6.33.6-cp39-abi3-macosx_10_9_universal2.whl", hash = "sha256:9720e6961b251bde64edfdab7d500725a2af5280f3f4c87e57c0208376aa8c3a", size = 427737, upload-time = "2026-03-18T19:04:51.866Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/90/b3c01fdec7d2f627b3a6884243ba328c1217ed2d978def5c12dc50d328a3/protobuf-6.33.6-cp39-abi3-manylinux2014_aarch64.whl", hash = "sha256:e2afbae9b8e1825e3529f88d514754e094278bb95eadc0e199751cdd9a2e82a2", size = 324610, upload-time = "2026-03-18T19:04:53.096Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/ca/25afc144934014700c52e05103c2421997482d561f3101ff352e1292fb81/protobuf-6.33.6-cp39-abi3-manylinux2014_s390x.whl", hash = "sha256:c96c37eec15086b79762ed265d59ab204dabc53056e3443e702d2681f4b39ce3", size = 339381, upload-time = "2026-03-18T19:04:54.616Z" },
+    { url = "https://files.pythonhosted.org/packages/16/92/d1e32e3e0d894fe00b15ce28ad4944ab692713f2e7f0a99787405e43533a/protobuf-6.33.6-cp39-abi3-manylinux2014_x86_64.whl", hash = "sha256:e9db7e292e0ab79dd108d7f1a94fe31601ce1ee3f7b79e0692043423020b0593", size = 323436, upload-time = "2026-03-18T19:04:55.768Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/72/02445137af02769918a93807b2b7890047c32bfb9f90371cbc12688819eb/protobuf-6.33.6-py3-none-any.whl", hash = "sha256:77179e006c476e69bf8e8ce866640091ec42e1beb80b213c3900006ecfba6901", size = 170656, upload-time = "2026-03-18T19:04:59.826Z" },
+]
+
+[[package]]
+name = "pygments"
+version = "2.20.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/c3/b2/bc9c9196916376152d655522fdcebac55e66de6603a76a02bca1b6414f6c/pygments-2.20.0.tar.gz", hash = "sha256:6757cd03768053ff99f3039c1a36d6c0aa0b263438fcab17520b30a303a82b5f", size = 4955991, upload-time = "2026-03-29T13:29:33.898Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/7e/a72dd26f3b0f4f2bf1dd8923c85f7ceb43172af56d63c7383eb62b332364/pygments-2.20.0-py3-none-any.whl", hash = "sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176", size = 1231151, upload-time = "2026-03-29T13:29:30.038Z" },
+]
+
+[[package]]
+name = "pysocks"
+version = "1.7.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/bd/11/293dd436aea955d45fc4e8a35b6ae7270f5b8e00b53cf6c024c83b657a11/PySocks-1.7.1.tar.gz", hash = "sha256:3f8804571ebe159c380ac6de37643bb4685970655d3bba243530d6558b799aa0", size = 284429, upload-time = "2019-09-20T02:07:35.714Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/8d/59/b4572118e098ac8e46e399a1dd0f2d85403ce8bbaad9ec79373ed6badaf9/PySocks-1.7.1-py3-none-any.whl", hash = "sha256:2725bd0a9925919b9b51739eea5f9e2bae91e83288108a9ad338b2e3a4435ee5", size = 16725, upload-time = "2019-09-20T02:06:22.938Z" },
+]
+
+[[package]]
+name = "pytest"
+version = "9.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "colorama", marker = "sys_platform == 'win32'" },
+    { name = "iniconfig" },
+    { name = "packaging" },
+    { name = "pluggy" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/e4/47/b9efed96c114afcfa3c9d3fe98a76a1d14c74a9e266d397cf6eb64be5e01/pytest-9.1.1.tar.gz", hash = "sha256:1088fbde8f2b49d95a549a195707afa7a76a3ce9bcadc26b6d71f0ffda5fe313", size = 1636369, upload-time = "2026-06-19T10:58:32.857Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
+]
+
+[[package]]
+name = "pytest-aiohttp"
+version = "1.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "aiohttp" },
+    { name = "pytest" },
+    { name = "pytest-asyncio" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/51/4d/c6621fc79022f6c84a806e23d9b7eca24fae4f3ee779219bbe524339d666/pytest_aiohttp-1.1.1.tar.gz", hash = "sha256:3aa9c9fe26e543eaccc7eb0add381c685ba3ed3e2fed0af74540f63bcd31458d", size = 13704, upload-time = "2026-06-07T23:56:34.173Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/fa/b0/5056ed4c3f68a4db2b4a39fb0ec61b1e4cf1d89ee14effe5261cc587264c/pytest_aiohttp-1.1.1-py3-none-any.whl", hash = "sha256:f293441ad4f8446a1e12257130c26c7de03a615c2a5572a8cb046e5b3b4e5211", size = 9007, upload-time = "2026-06-07T23:56:33.333Z" },
+]
+
+[[package]]
+name = "pytest-asyncio"
+version = "1.4.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pytest" },
+    { name = "typing-extensions", marker = "python_full_version < '3.13'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/43/7c/d36d04db312ecf4298932ef77e6e4a9e8ad017906e24e34f0b0c361a2473/pytest_asyncio-1.4.0.tar.gz", hash = "sha256:c6c0d2259945122819f171a32ecea2c349ead889ee28176caaf492143424be42", size = 58514, upload-time = "2026-05-26T09:56:04.083Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/03/e2/08a497ef684b88559c9cc5f4ad53a37e7b99e727094a86d6ea32536d5d3c/pytest_asyncio-1.4.0-py3-none-any.whl", hash = "sha256:933ca923a23075a87fb7070c0ec272a6848489824d887c85c812670932835aa1", size = 16930, upload-time = "2026-05-26T09:56:02.576Z" },
+]
+
+[[package]]
+name = "pytest-cov"
+version = "7.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "coverage", extra = ["toml"] },
+    { name = "pluggy" },
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/51/a849f96e117386044471c8ec2bd6cfebacda285da9525c9106aeb28da671/pytest_cov-7.1.0.tar.gz", hash = "sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2", size = 55592, upload-time = "2026-03-21T20:11:16.284Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9d/7a/d968e294073affff457b041c2be9868a40c1c71f4a35fcc1e45e5493067b/pytest_cov-7.1.0-py3-none-any.whl", hash = "sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678", size = 22876, upload-time = "2026-03-21T20:11:14.438Z" },
+]
+
+[[package]]
+name = "pytest-mock"
+version = "3.15.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/68/14/eb014d26be205d38ad5ad20d9a80f7d201472e08167f0bb4361e251084a9/pytest_mock-3.15.1.tar.gz", hash = "sha256:1849a238f6f396da19762269de72cb1814ab44416fa73a8686deac10b0d87a0f", size = 34036, upload-time = "2025-09-16T16:37:27.081Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5a/cc/06253936f4a7fa2e0f48dfe6d851d9c56df896a9ab09ac019d70b760619c/pytest_mock-3.15.1-py3-none-any.whl", hash = "sha256:0a25e2eb88fe5168d535041d09a4529a188176ae608a6d249ee65abc0949630d", size = 10095, upload-time = "2025-09-16T16:37:25.734Z" },
+]
+
+[[package]]
+name = "python-discovery"
+version = "1.4.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "filelock" },
+    { name = "platformdirs" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/0b/1a/cbbaf13b730abb0a16b964d984e19f2fe520c21a4dc664051359a3f5a9e7/python_discovery-1.4.2.tar.gz", hash = "sha256:8f3746c4b4968d22afbb97d36e1a0e5b66e6c0f297290f2e95f05b9b8bf18690", size = 70277, upload-time = "2026-06-11T16:10:42.383Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/1a/82/a70006589557f267f15bd384c0642ad49f0d97b690c3a05b166b9dcbad3b/python_discovery-1.4.2-py3-none-any.whl", hash = "sha256:475803f53b7b2ed6e490e27373f9d8340f7d2eebf9acdaf645d7d714c97bb500", size = 33886, upload-time = "2026-06-11T16:10:41.192Z" },
+]
+
+[[package]]
+name = "pyyaml"
+version = "6.0.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/05/8e/961c0007c59b8dd7729d542c61a4d537767a59645b82a0b521206e1e25c2/pyyaml-6.0.3.tar.gz", hash = "sha256:d76623373421df22fb4cf8817020cbb7ef15c725b9d5e45f17e189bfc384190f", size = 130960, upload-time = "2025-09-25T21:33:16.546Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6d/16/a95b6757765b7b031c9374925bb718d55e0a9ba8a1b6a12d25962ea44347/pyyaml-6.0.3-cp311-cp311-macosx_10_13_x86_64.whl", hash = "sha256:44edc647873928551a01e7a563d7452ccdebee747728c1080d881d68af7b997e", size = 185826, upload-time = "2025-09-25T21:31:58.655Z" },
+    { url = "https://files.pythonhosted.org/packages/16/19/13de8e4377ed53079ee996e1ab0a9c33ec2faf808a4647b7b4c0d46dd239/pyyaml-6.0.3-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:652cb6edd41e718550aad172851962662ff2681490a8a711af6a4d288dd96824", size = 175577, upload-time = "2025-09-25T21:32:00.088Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/62/d2eb46264d4b157dae1275b573017abec435397aa59cbcdab6fc978a8af4/pyyaml-6.0.3-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:10892704fc220243f5305762e276552a0395f7beb4dbf9b14ec8fd43b57f126c", size = 775556, upload-time = "2025-09-25T21:32:01.31Z" },
+    { url = "https://files.pythonhosted.org/packages/10/cb/16c3f2cf3266edd25aaa00d6c4350381c8b012ed6f5276675b9eba8d9ff4/pyyaml-6.0.3-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:850774a7879607d3a6f50d36d04f00ee69e7fc816450e5f7e58d7f17f1ae5c00", size = 882114, upload-time = "2025-09-25T21:32:03.376Z" },
+    { url = "https://files.pythonhosted.org/packages/71/60/917329f640924b18ff085ab889a11c763e0b573da888e8404ff486657602/pyyaml-6.0.3-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b8bb0864c5a28024fac8a632c443c87c5aa6f215c0b126c449ae1a150412f31d", size = 806638, upload-time = "2025-09-25T21:32:04.553Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/6f/529b0f316a9fd167281a6c3826b5583e6192dba792dd55e3203d3f8e655a/pyyaml-6.0.3-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d37d57ad971609cf3c53ba6a7e365e40660e3be0e5175fa9f2365a379d6095a", size = 767463, upload-time = "2025-09-25T21:32:06.152Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/6a/b627b4e0c1dd03718543519ffb2f1deea4a1e6d42fbab8021936a4d22589/pyyaml-6.0.3-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:37503bfbfc9d2c40b344d06b2199cf0e96e97957ab1c1b546fd4f87e53e5d3e4", size = 794986, upload-time = "2025-09-25T21:32:07.367Z" },
+    { url = "https://files.pythonhosted.org/packages/45/91/47a6e1c42d9ee337c4839208f30d9f09caa9f720ec7582917b264defc875/pyyaml-6.0.3-cp311-cp311-win32.whl", hash = "sha256:8098f252adfa6c80ab48096053f512f2321f0b998f98150cea9bd23d83e1467b", size = 142543, upload-time = "2025-09-25T21:32:08.95Z" },
+    { url = "https://files.pythonhosted.org/packages/da/e3/ea007450a105ae919a72393cb06f122f288ef60bba2dc64b26e2646fa315/pyyaml-6.0.3-cp311-cp311-win_amd64.whl", hash = "sha256:9f3bfb4965eb874431221a3ff3fdcddc7e74e3b07799e0e84ca4a0f867d449bf", size = 158763, upload-time = "2025-09-25T21:32:09.96Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/33/422b98d2195232ca1826284a76852ad5a86fe23e31b009c9886b2d0fb8b2/pyyaml-6.0.3-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:7f047e29dcae44602496db43be01ad42fc6f1cc0d8cd6c83d342306c32270196", size = 182063, upload-time = "2025-09-25T21:32:11.445Z" },
+    { url = "https://files.pythonhosted.org/packages/89/a0/6cf41a19a1f2f3feab0e9c0b74134aa2ce6849093d5517a0c550fe37a648/pyyaml-6.0.3-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:fc09d0aa354569bc501d4e787133afc08552722d3ab34836a80547331bb5d4a0", size = 173973, upload-time = "2025-09-25T21:32:12.492Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/23/7a778b6bd0b9a8039df8b1b1d80e2e2ad78aa04171592c8a5c43a56a6af4/pyyaml-6.0.3-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9149cad251584d5fb4981be1ecde53a1ca46c891a79788c0df828d2f166bda28", size = 775116, upload-time = "2025-09-25T21:32:13.652Z" },
+    { url = "https://files.pythonhosted.org/packages/65/30/d7353c338e12baef4ecc1b09e877c1970bd3382789c159b4f89d6a70dc09/pyyaml-6.0.3-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5fdec68f91a0c6739b380c83b951e2c72ac0197ace422360e6d5a959d8d97b2c", size = 844011, upload-time = "2025-09-25T21:32:15.21Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/9d/b3589d3877982d4f2329302ef98a8026e7f4443c765c46cfecc8858c6b4b/pyyaml-6.0.3-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ba1cc08a7ccde2d2ec775841541641e4548226580ab850948cbfda66a1befcdc", size = 807870, upload-time = "2025-09-25T21:32:16.431Z" },
+    { url = "https://files.pythonhosted.org/packages/05/c0/b3be26a015601b822b97d9149ff8cb5ead58c66f981e04fedf4e762f4bd4/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:8dc52c23056b9ddd46818a57b78404882310fb473d63f17b07d5c40421e47f8e", size = 761089, upload-time = "2025-09-25T21:32:17.56Z" },
+    { url = "https://files.pythonhosted.org/packages/be/8e/98435a21d1d4b46590d5459a22d88128103f8da4c2d4cb8f14f2a96504e1/pyyaml-6.0.3-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:41715c910c881bc081f1e8872880d3c650acf13dfa8214bad49ed4cede7c34ea", size = 790181, upload-time = "2025-09-25T21:32:18.834Z" },
+    { url = "https://files.pythonhosted.org/packages/74/93/7baea19427dcfbe1e5a372d81473250b379f04b1bd3c4c5ff825e2327202/pyyaml-6.0.3-cp312-cp312-win32.whl", hash = "sha256:96b533f0e99f6579b3d4d4995707cf36df9100d67e0c8303a0c55b27b5f99bc5", size = 137658, upload-time = "2025-09-25T21:32:20.209Z" },
+    { url = "https://files.pythonhosted.org/packages/86/bf/899e81e4cce32febab4fb42bb97dcdf66bc135272882d1987881a4b519e9/pyyaml-6.0.3-cp312-cp312-win_amd64.whl", hash = "sha256:5fcd34e47f6e0b794d17de1b4ff496c00986e1c83f7ab2fb8fcfe9616ff7477b", size = 154003, upload-time = "2025-09-25T21:32:21.167Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/08/67bd04656199bbb51dbed1439b7f27601dfb576fb864099c7ef0c3e55531/pyyaml-6.0.3-cp312-cp312-win_arm64.whl", hash = "sha256:64386e5e707d03a7e172c0701abfb7e10f0fb753ee1d773128192742712a98fd", size = 140344, upload-time = "2025-09-25T21:32:22.617Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/11/0fd08f8192109f7169db964b5707a2f1e8b745d4e239b784a5a1dd80d1db/pyyaml-6.0.3-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8da9669d359f02c0b91ccc01cac4a67f16afec0dac22c2ad09f46bee0697eba8", size = 181669, upload-time = "2025-09-25T21:32:23.673Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/16/95309993f1d3748cd644e02e38b75d50cbc0d9561d21f390a76242ce073f/pyyaml-6.0.3-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:2283a07e2c21a2aa78d9c4442724ec1eb15f5e42a723b99cb3d822d48f5f7ad1", size = 173252, upload-time = "2025-09-25T21:32:25.149Z" },
+    { url = "https://files.pythonhosted.org/packages/50/31/b20f376d3f810b9b2371e72ef5adb33879b25edb7a6d072cb7ca0c486398/pyyaml-6.0.3-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ee2922902c45ae8ccada2c5b501ab86c36525b883eff4255313a253a3160861c", size = 767081, upload-time = "2025-09-25T21:32:26.575Z" },
+    { url = "https://files.pythonhosted.org/packages/49/1e/a55ca81e949270d5d4432fbbd19dfea5321eda7c41a849d443dc92fd1ff7/pyyaml-6.0.3-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a33284e20b78bd4a18c8c2282d549d10bc8408a2a7ff57653c0cf0b9be0afce5", size = 841159, upload-time = "2025-09-25T21:32:27.727Z" },
+    { url = "https://files.pythonhosted.org/packages/74/27/e5b8f34d02d9995b80abcef563ea1f8b56d20134d8f4e5e81733b1feceb2/pyyaml-6.0.3-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:0f29edc409a6392443abf94b9cf89ce99889a1dd5376d94316ae5145dfedd5d6", size = 801626, upload-time = "2025-09-25T21:32:28.878Z" },
+    { url = "https://files.pythonhosted.org/packages/f9/11/ba845c23988798f40e52ba45f34849aa8a1f2d4af4b798588010792ebad6/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:f7057c9a337546edc7973c0d3ba84ddcdf0daa14533c2065749c9075001090e6", size = 753613, upload-time = "2025-09-25T21:32:30.178Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/e0/7966e1a7bfc0a45bf0a7fb6b98ea03fc9b8d84fa7f2229e9659680b69ee3/pyyaml-6.0.3-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:eda16858a3cab07b80edaf74336ece1f986ba330fdb8ee0d6c0d68fe82bc96be", size = 794115, upload-time = "2025-09-25T21:32:31.353Z" },
+    { url = "https://files.pythonhosted.org/packages/de/94/980b50a6531b3019e45ddeada0626d45fa85cbe22300844a7983285bed3b/pyyaml-6.0.3-cp313-cp313-win32.whl", hash = "sha256:d0eae10f8159e8fdad514efdc92d74fd8d682c933a6dd088030f3834bc8e6b26", size = 137427, upload-time = "2025-09-25T21:32:32.58Z" },
+    { url = "https://files.pythonhosted.org/packages/97/c9/39d5b874e8b28845e4ec2202b5da735d0199dbe5b8fb85f91398814a9a46/pyyaml-6.0.3-cp313-cp313-win_amd64.whl", hash = "sha256:79005a0d97d5ddabfeeea4cf676af11e647e41d81c9a7722a193022accdb6b7c", size = 154090, upload-time = "2025-09-25T21:32:33.659Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e8/2bdf3ca2090f68bb3d75b44da7bbc71843b19c9f2b9cb9b0f4ab7a5a4329/pyyaml-6.0.3-cp313-cp313-win_arm64.whl", hash = "sha256:5498cd1645aa724a7c71c8f378eb29ebe23da2fc0d7a08071d89469bf1d2defb", size = 140246, upload-time = "2025-09-25T21:32:34.663Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/8c/f4bd7f6465179953d3ac9bc44ac1a8a3e6122cf8ada906b4f96c60172d43/pyyaml-6.0.3-cp314-cp314-macosx_10_13_x86_64.whl", hash = "sha256:8d1fab6bb153a416f9aeb4b8763bc0f22a5586065f86f7664fc23339fc1c1fac", size = 181814, upload-time = "2025-09-25T21:32:35.712Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/9c/4d95bb87eb2063d20db7b60faa3840c1b18025517ae857371c4dd55a6b3a/pyyaml-6.0.3-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:34d5fcd24b8445fadc33f9cf348c1047101756fd760b4dacb5c3e99755703310", size = 173809, upload-time = "2025-09-25T21:32:36.789Z" },
+    { url = "https://files.pythonhosted.org/packages/92/b5/47e807c2623074914e29dabd16cbbdd4bf5e9b2db9f8090fa64411fc5382/pyyaml-6.0.3-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:501a031947e3a9025ed4405a168e6ef5ae3126c59f90ce0cd6f2bfc477be31b7", size = 766454, upload-time = "2025-09-25T21:32:37.966Z" },
+    { url = "https://files.pythonhosted.org/packages/02/9e/e5e9b168be58564121efb3de6859c452fccde0ab093d8438905899a3a483/pyyaml-6.0.3-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b3bc83488de33889877a0f2543ade9f70c67d66d9ebb4ac959502e12de895788", size = 836355, upload-time = "2025-09-25T21:32:39.178Z" },
+    { url = "https://files.pythonhosted.org/packages/88/f9/16491d7ed2a919954993e48aa941b200f38040928474c9e85ea9e64222c3/pyyaml-6.0.3-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c458b6d084f9b935061bc36216e8a69a7e293a2f1e68bf956dcd9e6cbcd143f5", size = 794175, upload-time = "2025-09-25T21:32:40.865Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/3f/5989debef34dc6397317802b527dbbafb2b4760878a53d4166579111411e/pyyaml-6.0.3-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7c6610def4f163542a622a73fb39f534f8c101d690126992300bf3207eab9764", size = 755228, upload-time = "2025-09-25T21:32:42.084Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/ce/af88a49043cd2e265be63d083fc75b27b6ed062f5f9fd6cdc223ad62f03e/pyyaml-6.0.3-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5190d403f121660ce8d1d2c1bb2ef1bd05b5f68533fc5c2ea899bd15f4399b35", size = 789194, upload-time = "2025-09-25T21:32:43.362Z" },
+    { url = "https://files.pythonhosted.org/packages/23/20/bb6982b26a40bb43951265ba29d4c246ef0ff59c9fdcdf0ed04e0687de4d/pyyaml-6.0.3-cp314-cp314-win_amd64.whl", hash = "sha256:4a2e8cebe2ff6ab7d1050ecd59c25d4c8bd7e6f400f5f82b96557ac0abafd0ac", size = 156429, upload-time = "2025-09-25T21:32:57.844Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/f4/a4541072bb9422c8a883ab55255f918fa378ecf083f5b85e87fc2b4eda1b/pyyaml-6.0.3-cp314-cp314-win_arm64.whl", hash = "sha256:93dda82c9c22deb0a405ea4dc5f2d0cda384168e466364dec6255b293923b2f3", size = 143912, upload-time = "2025-09-25T21:32:59.247Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/f9/07dd09ae774e4616edf6cda684ee78f97777bdd15847253637a6f052a62f/pyyaml-6.0.3-cp314-cp314t-macosx_10_13_x86_64.whl", hash = "sha256:02893d100e99e03eda1c8fd5c441d8c60103fd175728e23e431db1b589cf5ab3", size = 189108, upload-time = "2025-09-25T21:32:44.377Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/78/8d08c9fb7ce09ad8c38ad533c1191cf27f7ae1effe5bb9400a46d9437fcf/pyyaml-6.0.3-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c1ff362665ae507275af2853520967820d9124984e0f7466736aea23d8611fba", size = 183641, upload-time = "2025-09-25T21:32:45.407Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/5b/3babb19104a46945cf816d047db2788bcaf8c94527a805610b0289a01c6b/pyyaml-6.0.3-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:6adc77889b628398debc7b65c073bcb99c4a0237b248cacaf3fe8a557563ef6c", size = 831901, upload-time = "2025-09-25T21:32:48.83Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/cc/dff0684d8dc44da4d22a13f35f073d558c268780ce3c6ba1b87055bb0b87/pyyaml-6.0.3-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a80cb027f6b349846a3bf6d73b5e95e782175e52f22108cfa17876aaeff93702", size = 861132, upload-time = "2025-09-25T21:32:50.149Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/5e/f77dc6b9036943e285ba76b49e118d9ea929885becb0a29ba8a7c75e29fe/pyyaml-6.0.3-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:00c4bdeba853cc34e7dd471f16b4114f4162dc03e6b7afcc2128711f0eca823c", size = 839261, upload-time = "2025-09-25T21:32:51.808Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/88/a9db1376aa2a228197c58b37302f284b5617f56a5d959fd1763fb1675ce6/pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:66e1674c3ef6f541c35191caae2d429b967b99e02040f5ba928632d9a7f0f065", size = 805272, upload-time = "2025-09-25T21:32:52.941Z" },
+    { url = "https://files.pythonhosted.org/packages/da/92/1446574745d74df0c92e6aa4a7b0b3130706a4142b2d1a5869f2eaa423c6/pyyaml-6.0.3-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:16249ee61e95f858e83976573de0f5b2893b3677ba71c9dd36b9cf8be9ac6d65", size = 829923, upload-time = "2025-09-25T21:32:54.537Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/7a/1c7270340330e575b92f397352af856a8c06f230aa3e76f86b39d01b416a/pyyaml-6.0.3-cp314-cp314t-win_amd64.whl", hash = "sha256:4ad1906908f2f5ae4e5a8ddfce73c320c2a1429ec52eafd27138b7f1cbe341c9", size = 174062, upload-time = "2025-09-25T21:32:55.767Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/12/de94a39c2ef588c7e6455cfbe7343d3b2dc9d6b6b2f40c4c6565744c873d/pyyaml-6.0.3-cp314-cp314t-win_arm64.whl", hash = "sha256:ebc55a14a21cb14062aa4162f906cd962b28e2e9ea38f9b4391244cd8de4ae0b", size = 149341, upload-time = "2025-09-25T21:32:56.828Z" },
+]
+
+[[package]]
+name = "requests"
+version = "2.34.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "certifi" },
+    { name = "charset-normalizer" },
+    { name = "idna" },
+    { name = "urllib3" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/ac/c3/e2a2b89f2d3e2179abd6d00ebd70bff6273f37fb3e0cc209f48b39d00cbf/requests-2.34.2.tar.gz", hash = "sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed", size = 142856, upload-time = "2026-05-14T19:25:27.735Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/a0/f4/c67b0b3f1b9245e8d266f0f112c500d50e5b4e83cb6f3b71b6528104182a/requests-2.34.2-py3-none-any.whl", hash = "sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0", size = 73075, upload-time = "2026-05-14T19:25:26.443Z" },
+]
+
+[package.optional-dependencies]
+socks = [
+    { name = "pysocks" },
+]
+
+[[package]]
+name = "ruff"
+version = "0.15.20"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/dc/35b341fc554ba02f217fc10da57d1a75168cfbcf75b0ef2202176d4c4f2d/ruff-0.15.20.tar.gz", hash = "sha256:1416eb04349192646b54de98f146c4f59afe37d0decfc02c3cbbf396f3a28566", size = 4755489, upload-time = "2026-06-25T17:20:37.578Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/94/d9/2d5014f0253ba541d2061d9fa7193f48e941c8b21bb88a7ff9bbe0bd0596/ruff-0.15.20-py3-none-linux_armv6l.whl", hash = "sha256:00e188c53e499c3c1637f73c91dcf2fb56d576cab76ce1be50a27c4e80e37078", size = 10839665, upload-time = "2026-06-25T17:19:44.702Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/d3/ac1798ba64f670698867fcfc591d50e7e421bef137db564858f619a30fcf/ruff-0.15.20-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:9ebd1fd9b9c95fc0bd7b2761aebec1f030013d2e193a2901b224af68fe47251b", size = 11208649, upload-time = "2026-06-25T17:19:48.787Z" },
+    { url = "https://files.pythonhosted.org/packages/47/47/d3ac899991202095dfcf3d5176be4272642be3cf981a2f1a30f72a2afb95/ruff-0.15.20-py3-none-macosx_11_0_arm64.whl", hash = "sha256:c5b16cdd67ca108185cd36dce98c576350c03b1660a751de725fb049193a0632", size = 10622638, upload-time = "2026-06-25T17:19:51.354Z" },
+    { url = "https://files.pythonhosted.org/packages/33/13/4e043fe30aa94d4ff5213a9881fc296d12960f5971b234a5263fdc225312/ruff-0.15.20-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:3413bb3c3d2ca6a8208f1f4809cd2dca3c6de6d0b491c0e70847672bde6e6efd", size = 10984227, upload-time = "2026-06-25T17:19:54.044Z" },
+    { url = "https://files.pythonhosted.org/packages/76/e6/92e7bf40388bc5800073b96564f56264f7e48bfd1a498f5ced6ae6d5a769/ruff-0.15.20-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:bd7ec42b3bb3da066488db093308a69c4ac5ee6d2af333a86ba6e2eb2e7dd44b", size = 10622882, upload-time = "2026-06-25T17:19:57.037Z" },
+    { url = "https://files.pythonhosted.org/packages/13/7a/43460be3f24495a3aa46d4b16873e2c4941b3b5f0b00cf88c03b7b94b339/ruff-0.15.20-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:e1a36ad0eb77fba9aabfb69ede54de6f376d04ac18ebea022847046d340a8267", size = 11474808, upload-time = "2026-06-25T17:20:00.357Z" },
+    { url = "https://files.pythonhosted.org/packages/27/a0/f37077884873221c6b33b4ab49eb18f9f88e54a16a25a5bca59bef46dd66/ruff-0.15.20-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:b6df3b1e4610432f0386dba04d853b5f08cbbc903410c6fcc02f620f05aff53c", size = 12293094, upload-time = "2026-06-25T17:20:03.446Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/74/165545b60256a9704c21ac0ec4a0d07933b320812f9584836c9f4aca4292/ruff-0.15.20-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e89f198a1ea6ef0d727c1cf16088bc91a6cb0ab947dedc966715691647186eae", size = 11526176, upload-time = "2026-06-25T17:20:06.301Z" },
+    { url = "https://files.pythonhosted.org/packages/86/b1/a976a136d40ade83ce743578399865f57001003a409acadc0ecbb3051082/ruff-0.15.20-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:309809086c2acb67624950a3c8133e80f32d0d3e27106c0cd60ff26657c9f24b", size = 11520767, upload-time = "2026-06-25T17:20:09.191Z" },
+    { url = "https://files.pythonhosted.org/packages/19/0f/f032696cb01c9b54c0263fa393474d7758f1cdc021a01b04e3cbc2500999/ruff-0.15.20-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:2d2374caa2f2c2f9e2b7da0a50802cfb8b79f55a9b5e49379f564544fbf56487", size = 11500132, upload-time = "2026-06-25T17:20:13.602Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/f4/51b1a14bc69e8c224b15dab9cce8e99b425e0455d462caa2b3c9be2b6a8e/ruff-0.15.20-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:a1ed17b65293e0c2f22fc387bc13198a5de94bf4429589b0ff6946b0feaf21a3", size = 10943828, upload-time = "2026-06-25T17:20:16.635Z" },
+    { url = "https://files.pythonhosted.org/packages/71/4b/fe267640783cd02bf6c5cc290b1df1051be2ec294c678b5c15fe19e52343/ruff-0.15.20-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:f701305e66b38ea6c91882490eb73459796808e4c6362a1b765255e0cdcd4053", size = 10645418, upload-time = "2026-06-25T17:20:19.4Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/c0/a65aa4ec2f5e87a1df32dc3ec1fede434fe3dfd5cbcf3b503cafc676ab54/ruff-0.15.20-py3-none-musllinux_1_2_i686.whl", hash = "sha256:5b9c0c367ad8e5d0d5b5b8537864c469a0a0e55417aadfbeca41fa61333be9f4", size = 11211770, upload-time = "2026-06-25T17:20:22.033Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/a4/0caa331d954ae2723d729d351c989cb4ca8b6077d5c6c2cb6de75e98c041/ruff-0.15.20-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:01cc00dd58f0df339d0e902219dd53990ea99996a0344e5d9cc8d45d5307e460", size = 11618698, upload-time = "2026-06-25T17:20:25.259Z" },
+    { url = "https://files.pythonhosted.org/packages/10/9b/5f14927848d2fd4aa891fd88d883788c5a7baba561c7874732364045708c/ruff-0.15.20-py3-none-win32.whl", hash = "sha256:ed65ef510e43a137207e0f01cfcf998aeddb1aeeda5c9d35023e910284d7cf21", size = 10857322, upload-time = "2026-06-25T17:20:28.612Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/f0/fe47c501f9dea92a26d788ff98bb5d92ed4cb4c88792c5c88af6b697dc8e/ruff-0.15.20-py3-none-win_amd64.whl", hash = "sha256:a525c81c70fb0380344dd1d8745d8cc1c890b7fc94a58d5a07bd8eb9557b8415", size = 11993274, upload-time = "2026-06-25T17:20:31.871Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/2b/9555445e1201d92b3195f45cdb153a0b68f24e0a4273f6e3d5ab46e212bb/ruff-0.15.20-py3-none-win_arm64.whl", hash = "sha256:2f5b2a6d614e8700388806a14996c40fab2c47b819ef57d790a34878858ed9ca", size = 11343498, upload-time = "2026-06-25T17:20:35.03Z" },
+]
+
+[[package]]
+name = "sortedcontainers"
+version = "2.4.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/e8/c4/ba2f8066cceb6f23394729afe52f3bf7adec04bf9ed2c820b39e19299111/sortedcontainers-2.4.0.tar.gz", hash = "sha256:25caa5a06cc30b6b83d11423433f65d1f9d76c4c6a0c90e3379eaa43b9bfdb88", size = 30594, upload-time = "2021-05-16T22:03:42.897Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/32/46/9cb0e58b2deb7f82b84065f37f3bffeb12413f947f9388e4cac22c4621ce/sortedcontainers-2.4.0-py2.py3-none-any.whl", hash = "sha256:a163dcaede0f1c021485e957a39245190e74249897e2ae4b2aa38595db237ee0", size = 29575, upload-time = "2021-05-16T22:03:41.177Z" },
+]
+
+[[package]]
+name = "tomli"
+version = "2.4.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/22/de/48c59722572767841493b26183a0d1cc411d54fd759c5607c4590b6563a6/tomli-2.4.1.tar.gz", hash = "sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f", size = 17543, upload-time = "2026-03-25T20:22:03.828Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/11/db3d5885d8528263d8adc260bb2d28ebf1270b96e98f0e0268d32b8d9900/tomli-2.4.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30", size = 154704, upload-time = "2026-03-25T20:21:10.473Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/f7/675db52c7e46064a9aa928885a9b20f4124ecb9bc2e1ce74c9106648d202/tomli-2.4.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a", size = 149454, upload-time = "2026-03-25T20:21:12.036Z" },
+    { url = "https://files.pythonhosted.org/packages/61/71/81c50943cf953efa35bce7646caab3cf457a7d8c030b27cfb40d7235f9ee/tomli-2.4.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076", size = 237561, upload-time = "2026-03-25T20:21:13.098Z" },
+    { url = "https://files.pythonhosted.org/packages/48/c1/f41d9cb618acccca7df82aaf682f9b49013c9397212cb9f53219e3abac37/tomli-2.4.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9", size = 243824, upload-time = "2026-03-25T20:21:14.569Z" },
+    { url = "https://files.pythonhosted.org/packages/22/e4/5a816ecdd1f8ca51fb756ef684b90f2780afc52fc67f987e3c61d800a46d/tomli-2.4.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c", size = 242227, upload-time = "2026-03-25T20:21:15.712Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/49/2b2a0ef529aa6eec245d25f0c703e020a73955ad7edf73e7f54ddc608aa5/tomli-2.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc", size = 247859, upload-time = "2026-03-25T20:21:17.001Z" },
+    { url = "https://files.pythonhosted.org/packages/83/bd/6c1a630eaca337e1e78c5903104f831bda934c426f9231429396ce3c3467/tomli-2.4.1-cp311-cp311-win32.whl", hash = "sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049", size = 97204, upload-time = "2026-03-25T20:21:18.079Z" },
+    { url = "https://files.pythonhosted.org/packages/42/59/71461df1a885647e10b6bb7802d0b8e66480c61f3f43079e0dcd315b3954/tomli-2.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e", size = 108084, upload-time = "2026-03-25T20:21:18.978Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/83/dceca96142499c069475b790e7913b1044c1a4337e700751f48ed723f883/tomli-2.4.1-cp311-cp311-win_arm64.whl", hash = "sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece", size = 95285, upload-time = "2026-03-25T20:21:20.309Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/ba/42f134a3fe2b370f555f44b1d72feebb94debcab01676bf918d0cb70e9aa/tomli-2.4.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a", size = 155924, upload-time = "2026-03-25T20:21:21.626Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/c7/62d7a17c26487ade21c5422b646110f2162f1fcc95980ef7f63e73c68f14/tomli-2.4.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085", size = 150018, upload-time = "2026-03-25T20:21:23.002Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/05/79d13d7c15f13bdef410bdd49a6485b1c37d28968314eabee452c22a7fda/tomli-2.4.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9", size = 244948, upload-time = "2026-03-25T20:21:24.04Z" },
+    { url = "https://files.pythonhosted.org/packages/10/90/d62ce007a1c80d0b2c93e02cab211224756240884751b94ca72df8a875ca/tomli-2.4.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5", size = 253341, upload-time = "2026-03-25T20:21:25.177Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/7e/caf6496d60152ad4ed09282c1885cca4eea150bfd007da84aea07bcc0a3e/tomli-2.4.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585", size = 248159, upload-time = "2026-03-25T20:21:26.364Z" },
+    { url = "https://files.pythonhosted.org/packages/99/e7/c6f69c3120de34bbd882c6fba7975f3d7a746e9218e56ab46a1bc4b42552/tomli-2.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1", size = 253290, upload-time = "2026-03-25T20:21:27.46Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/2f/4a3c322f22c5c66c4b836ec58211641a4067364f5dcdd7b974b4c5da300c/tomli-2.4.1-cp312-cp312-win32.whl", hash = "sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917", size = 98141, upload-time = "2026-03-25T20:21:28.492Z" },
+    { url = "https://files.pythonhosted.org/packages/24/22/4daacd05391b92c55759d55eaee21e1dfaea86ce5c571f10083360adf534/tomli-2.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9", size = 108847, upload-time = "2026-03-25T20:21:29.386Z" },
+    { url = "https://files.pythonhosted.org/packages/68/fd/70e768887666ddd9e9f5d85129e84910f2db2796f9096aa02b721a53098d/tomli-2.4.1-cp312-cp312-win_arm64.whl", hash = "sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257", size = 95088, upload-time = "2026-03-25T20:21:30.677Z" },
+    { url = "https://files.pythonhosted.org/packages/07/06/b823a7e818c756d9a7123ba2cda7d07bc2dd32835648d1a7b7b7a05d848d/tomli-2.4.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54", size = 155866, upload-time = "2026-03-25T20:21:31.65Z" },
+    { url = "https://files.pythonhosted.org/packages/14/6f/12645cf7f08e1a20c7eb8c297c6f11d31c1b50f316a7e7e1e1de6e2e7b7e/tomli-2.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a", size = 149887, upload-time = "2026-03-25T20:21:33.028Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/e0/90637574e5e7212c09099c67ad349b04ec4d6020324539297b634a0192b0/tomli-2.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897", size = 243704, upload-time = "2026-03-25T20:21:34.51Z" },
+    { url = "https://files.pythonhosted.org/packages/10/8f/d3ddb16c5a4befdf31a23307f72828686ab2096f068eaf56631e136c1fdd/tomli-2.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f", size = 251628, upload-time = "2026-03-25T20:21:36.012Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/f1/dbeeb9116715abee2485bf0a12d07a8f31af94d71608c171c45f64c0469d/tomli-2.4.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d", size = 247180, upload-time = "2026-03-25T20:21:37.136Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/74/16336ffd19ed4da28a70959f92f506233bd7cfc2332b20bdb01591e8b1d1/tomli-2.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5", size = 251674, upload-time = "2026-03-25T20:21:38.298Z" },
+    { url = "https://files.pythonhosted.org/packages/16/f9/229fa3434c590ddf6c0aa9af64d3af4b752540686cace29e6281e3458469/tomli-2.4.1-cp313-cp313-win32.whl", hash = "sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd", size = 97976, upload-time = "2026-03-25T20:21:39.316Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/1e/71dfd96bcc1c775420cb8befe7a9d35f2e5b1309798f009dca17b7708c1e/tomli-2.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36", size = 108755, upload-time = "2026-03-25T20:21:40.248Z" },
+    { url = "https://files.pythonhosted.org/packages/83/7a/d34f422a021d62420b78f5c538e5b102f62bea616d1d75a13f0a88acb04a/tomli-2.4.1-cp313-cp313-win_arm64.whl", hash = "sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd", size = 95265, upload-time = "2026-03-25T20:21:41.219Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/fb/9a5c8d27dbab540869f7c1f8eb0abb3244189ce780ba9cd73f3770662072/tomli-2.4.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf", size = 155726, upload-time = "2026-03-25T20:21:42.23Z" },
+    { url = "https://files.pythonhosted.org/packages/62/05/d2f816630cc771ad836af54f5001f47a6f611d2d39535364f148b6a92d6b/tomli-2.4.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac", size = 149859, upload-time = "2026-03-25T20:21:43.386Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/48/66341bdb858ad9bd0ceab5a86f90eddab127cf8b046418009f2125630ecb/tomli-2.4.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662", size = 244713, upload-time = "2026-03-25T20:21:44.474Z" },
+    { url = "https://files.pythonhosted.org/packages/df/6d/c5fad00d82b3c7a3ab6189bd4b10e60466f22cfe8a08a9394185c8a8111c/tomli-2.4.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853", size = 252084, upload-time = "2026-03-25T20:21:45.62Z" },
+    { url = "https://files.pythonhosted.org/packages/00/71/3a69e86f3eafe8c7a59d008d245888051005bd657760e96d5fbfb0b740c2/tomli-2.4.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15", size = 247973, upload-time = "2026-03-25T20:21:46.937Z" },
+    { url = "https://files.pythonhosted.org/packages/67/50/361e986652847fec4bd5e4a0208752fbe64689c603c7ae5ea7cb16b1c0ca/tomli-2.4.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba", size = 256223, upload-time = "2026-03-25T20:21:48.467Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/9a/b4173689a9203472e5467217e0154b00e260621caa227b6fa01feab16998/tomli-2.4.1-cp314-cp314-win32.whl", hash = "sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6", size = 98973, upload-time = "2026-03-25T20:21:49.526Z" },
+    { url = "https://files.pythonhosted.org/packages/14/58/640ac93bf230cd27d002462c9af0d837779f8773bc03dee06b5835208214/tomli-2.4.1-cp314-cp314-win_amd64.whl", hash = "sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7", size = 109082, upload-time = "2026-03-25T20:21:50.506Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/2f/702d5e05b227401c1068f0d386d79a589bb12bf64c3d2c72ce0631e3bc49/tomli-2.4.1-cp314-cp314-win_arm64.whl", hash = "sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232", size = 96490, upload-time = "2026-03-25T20:21:51.474Z" },
+    { url = "https://files.pythonhosted.org/packages/45/4b/b877b05c8ba62927d9865dd980e34a755de541eb65fffba52b4cc495d4d2/tomli-2.4.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4", size = 164263, upload-time = "2026-03-25T20:21:52.543Z" },
+    { url = "https://files.pythonhosted.org/packages/24/79/6ab420d37a270b89f7195dec5448f79400d9e9c1826df982f3f8e97b24fd/tomli-2.4.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c", size = 160736, upload-time = "2026-03-25T20:21:53.674Z" },
+    { url = "https://files.pythonhosted.org/packages/02/e0/3630057d8eb170310785723ed5adcdfb7d50cb7e6455f85ba8a3deed642b/tomli-2.4.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d", size = 270717, upload-time = "2026-03-25T20:21:55.129Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/b4/1613716072e544d1a7891f548d8f9ec6ce2faf42ca65acae01d76ea06bb0/tomli-2.4.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41", size = 278461, upload-time = "2026-03-25T20:21:56.228Z" },
+    { url = "https://files.pythonhosted.org/packages/05/38/30f541baf6a3f6df77b3df16b01ba319221389e2da59427e221ef417ac0c/tomli-2.4.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c", size = 274855, upload-time = "2026-03-25T20:21:57.653Z" },
+    { url = "https://files.pythonhosted.org/packages/77/a3/ec9dd4fd2c38e98de34223b995a3b34813e6bdadf86c75314c928350ed14/tomli-2.4.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f", size = 283144, upload-time = "2026-03-25T20:21:59.089Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/be/605a6261cac79fba2ec0c9827e986e00323a1945700969b8ee0b30d85453/tomli-2.4.1-cp314-cp314t-win32.whl", hash = "sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8", size = 108683, upload-time = "2026-03-25T20:22:00.214Z" },
+    { url = "https://files.pythonhosted.org/packages/12/64/da524626d3b9cc40c168a13da8335fe1c51be12c0a63685cc6db7308daae/tomli-2.4.1-cp314-cp314t-win_amd64.whl", hash = "sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26", size = 121196, upload-time = "2026-03-25T20:22:01.169Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/cd/e80b62269fc78fc36c9af5a6b89c835baa8af28ff5ad28c7028d60860320/tomli-2.4.1-cp314-cp314t-win_arm64.whl", hash = "sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396", size = 100393, upload-time = "2026-03-25T20:22:02.137Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/61/cceae43728b7de99d9b847560c262873a1f6c98202171fd5ed62640b494b/tomli-2.4.1-py3-none-any.whl", hash = "sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe", size = 14583, upload-time = "2026-03-25T20:22:03.012Z" },
+]
+
+[[package]]
+name = "typing-extensions"
+version = "4.15.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/72/94/1a15dd82efb362ac84269196e94cf00f187f7ed21c242792a923cdb1c61f/typing_extensions-4.15.0.tar.gz", hash = "sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466", size = 109391, upload-time = "2025-08-25T13:49:26.313Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/18/67/36e9267722cc04a6b9f15c7f3441c2363321a3ea07da7ae0c0707beb2a9c/typing_extensions-4.15.0-py3-none-any.whl", hash = "sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548", size = 44614, upload-time = "2025-08-25T13:49:24.86Z" },
+]
+
+[[package]]
+name = "urllib3"
+version = "2.7.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/53/0c/06f8b233b8fd13b9e5ee11424ef85419ba0d8ba0b3138bf360be2ff56953/urllib3-2.7.0.tar.gz", hash = "sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c", size = 433602, upload-time = "2026-05-07T16:13:18.596Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/7f/3e/5db95bcf282c52709639744ca2a8b149baccf648e39c8cc87553df9eae0c/urllib3-2.7.0-py3-none-any.whl", hash = "sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897", size = 131087, upload-time = "2026-05-07T16:13:17.151Z" },
+]
+
+[[package]]
+name = "virtualenv"
+version = "21.5.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "distlib" },
+    { name = "filelock" },
+    { name = "platformdirs" },
+    { name = "python-discovery" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f1/a5/81f987504738e6defeed61ec1c47e2aefab3c35d8eeb87e1b3f38cf28254/virtualenv-21.5.1.tar.gz", hash = "sha256:dca3bf98275a59c652b69d68e73433e597d977c2da9198882479d1a7188009c8", size = 4578798, upload-time = "2026-06-16T16:23:58.603Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/2c/02/3623e6169bed617ed1e2d372f7c69f92ec28d54c4dfc997055c8578ec148/virtualenv-21.5.1-py3-none-any.whl", hash = "sha256:55aa670b67bbfb991b03fda39bd3276d92c419d702376e98c5df1c9989a26783", size = 4558820, upload-time = "2026-06-16T16:23:56.963Z" },
+]
+
+[[package]]
+name = "yarl"
+version = "1.24.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "idna" },
+    { name = "multidict" },
+    { name = "propcache" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/79/12/1e8f37460ea0f7eb59c221fdaf0ed75e7ac43e97f8093b9c6f411df50a78/yarl-1.24.2.tar.gz", hash = "sha256:9ac374123c6fd7abf64d1fec93962b0bd4ee2c19751755a762a72dd96c0378f8", size = 210798, upload-time = "2026-05-19T21:31:05.599Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/c5/c5/1ce244152ff2839645e7cae92f90e7bafcb2c52bea7ff586ac714f14f5df/yarl-1.24.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:36348bebb147b83818b9d7e673ea4debc75970afc6ffdc7e3975ad05ce5a58c1", size = 128971, upload-time = "2026-05-19T21:28:20.543Z" },
+    { url = "https://files.pythonhosted.org/packages/87/5a/00f36967203ed89cb3acd2c8ed526cc3fed9418eb70ce128160a911c8499/yarl-1.24.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1a97e42c8a2233f2f279ecadd9e4a037bcb5d813b78435e8eedd4db5a9e9708c", size = 91507, upload-time = "2026-05-19T21:28:22.556Z" },
+    { url = "https://files.pythonhosted.org/packages/31/d0/1fb0c1cd27288f39f6974da4318c32768d72c9890984541fdf1e2e32a51d/yarl-1.24.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:8d027d56f1035e339d1001ac33eceab5b2ec8e42e449787bb75e289fb9a5cd1d", size = 91343, upload-time = "2026-05-19T21:28:24.092Z" },
+    { url = "https://files.pythonhosted.org/packages/03/ce/d4a646508bed2f8dec6435b40166fe9308dd191262033d3f307b2bbcaecd/yarl-1.24.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:0a6377060e7927187a42b7eb202090cbe2b34933a4eeaf90e3bd9e33432e5cae", size = 105704, upload-time = "2026-05-19T21:28:25.872Z" },
+    { url = "https://files.pythonhosted.org/packages/4b/07/b3278e82d8bc41485bcf6d856cd0433262593de615b1d3dc43bd3f5bead4/yarl-1.24.2-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:17076578bce0049a5ce57d14ad1bded391b68a3b213e9b81b0097b090244999a", size = 97281, upload-time = "2026-05-19T21:28:27.352Z" },
+    { url = "https://files.pythonhosted.org/packages/17/5b/4cee6e7c92e487bebe7afc797da0aa54a248ab4e776a68fe369ec29665a5/yarl-1.24.2-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:50713f1d4d6be6375bb178bb43d140ee1acb8abe589cd723320b7925a275be1e", size = 114020, upload-time = "2026-05-19T21:28:29.458Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/82/111076571545a7d4f9cca3fbd5c6f40615af58642be09f12328f48022468/yarl-1.24.2-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:34263e2fa8fb5bb63a0d97706cda38edbad62fddb58c7f12d6acbc092812aa50", size = 111450, upload-time = "2026-05-19T21:28:31.262Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/ec/08f671f69a444d704aeecebf92af659b67b97a869942411d0a578b08c334/yarl-1.24.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:49016d82f032b1bd1e10b01078a7d29ae71bf468eeae0ea22df8bab691e60003", size = 106384, upload-time = "2026-05-19T21:28:32.856Z" },
+    { url = "https://files.pythonhosted.org/packages/e5/86/ce41e7a7a199340b2330d52b60f25c4074b6636dd0e60b1a80d31a9db042/yarl-1.24.2-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3f6d2c216318f8f32038ca3f72501ba08536f0fd18a36e858836b121b2deed9f", size = 106153, upload-time = "2026-05-19T21:28:35.222Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/5d/31be8a729531ab3e55ac3e7e5c800be8c89ea98947f418b2f6ea259fb6ee/yarl-1.24.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:08d3a33218e0c64393e7610284e770409a9c31c429b078bcb24096ed0a783b8f", size = 105322, upload-time = "2026-05-19T21:28:36.642Z" },
+    { url = "https://files.pythonhosted.org/packages/47/9b/b57afb22b386ae87ac9940f09878b98d8c333f89113e6fc96fcf4ca9eb64/yarl-1.24.2-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:5d699376c4ca3cba49bbfae3a05b5b70ded572937171ce1e0b8d87118e2ba294", size = 99057, upload-time = "2026-05-19T21:28:38.386Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/4f/06348c27c8389256c313e8a57d796808fc0264c915dd5e7cfd3c0e314dc7/yarl-1.24.2-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:a1cab588b4fa14bea2e55ebea27478adfb05372f47573738e1acc4a36c0b05d2", size = 113502, upload-time = "2026-05-19T21:28:40.091Z" },
+    { url = "https://files.pythonhosted.org/packages/5f/1c/284f307b298e4a17b7943b07d9d7ecc4151537f8d137ba51f3bb6c31ca20/yarl-1.24.2-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:ec87ccc31bd21db7ad009d8572c127c1000f268517618a4cc09adba3c2a7f21c", size = 105253, upload-time = "2026-05-19T21:28:41.987Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/bf/0de123bec8619e45c80cbded9085f61b5b4a9eddb8abe6d25d28ee1ec866/yarl-1.24.2-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:d1dd47a22843b212baa8d74f37796815d43bd046b42a0f41e9da433386c3136b", size = 111345, upload-time = "2026-05-19T21:28:43.93Z" },
+    { url = "https://files.pythonhosted.org/packages/90/af/0248eb065e51129d2a9b2436cd1b5c772c19a6b04e5b6a186955671e3319/yarl-1.24.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7b54b9c67c2b06bd7b9a77253d242124b9c95d2c02def5a1144001ee547dd9d5", size = 106558, upload-time = "2026-05-19T21:28:45.806Z" },
+    { url = "https://files.pythonhosted.org/packages/21/3c/f960d7a65ef97d8ba9b424fb5128796a4bc710fc6df2ddbbd7dfdc3bbd20/yarl-1.24.2-cp311-cp311-win_amd64.whl", hash = "sha256:f8fdbcff8b2c7c9284e60c196f693588598ddcee31e11c18e14949ce44519d45", size = 92808, upload-time = "2026-05-19T21:28:48.465Z" },
+    { url = "https://files.pythonhosted.org/packages/03/1a/49fb03750e4de4d2284cd5b885a383133c34eef45bd59631b2bb8b7e81e8/yarl-1.24.2-cp311-cp311-win_arm64.whl", hash = "sha256:b32c37a7a337e90822c45797bf3d79d60875cfcccd3ecc80e9f453d87026c122", size = 87610, upload-time = "2026-05-19T21:28:50.07Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/da/866bcb01076ba49d2b42b309867bed3826421f1c479655eb7a607b44f20b/yarl-1.24.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:b975866c184564c827e0877380f0dae57dcca7e52782128381b72feff6dfceb8", size = 129957, upload-time = "2026-05-19T21:28:51.695Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/1d/fcefb70922ea2268a8971d8e5874d9a8218644200fb8465f1dcad55e6851/yarl-1.24.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:3b075301a2836a0e297b1b658cb6d6135df535d62efefdd60366bd589c2c82f2", size = 92164, upload-time = "2026-05-19T21:28:53.242Z" },
+    { url = "https://files.pythonhosted.org/packages/29/b6/170e2b8d4e3bc30e6bfdcca53556537f5bf595e938632dfcb059311f3ff6/yarl-1.24.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:8ae44649b00947634ab0dab2a374a638f52923a6e67083f2c156cd5cbd1a881d", size = 91688, upload-time = "2026-05-19T21:28:54.865Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/a5/c9f655d5553ea0b99fdac9d6a99ad3f9b3e73b8e5758bb46f58c9831f74c/yarl-1.24.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:507cc19f0b45454e2d6dcd62ff7d062b9f77a2812404e62dbdaec05b50faa035", size = 102902, upload-time = "2026-05-19T21:28:56.963Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/bc/6b9664d815d79af4ee553337f9d606c56bbf269186ada9172de45f1b5f60/yarl-1.24.2-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:c4c17bad5a530912d2111825d3f05e89bab2dd376aaa8cbc77e449e6db63e576", size = 97931, upload-time = "2026-05-19T21:28:58.56Z" },
+    { url = "https://files.pythonhosted.org/packages/98/ec/32ba48acae30fecd60928f5791188b80a9d6ee3840507ffda29fecd37b71/yarl-1.24.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f5f0cbb112838a4a293985b6ed73948a547dadcc1ba6d2089938e7abdedceef8", size = 111030, upload-time = "2026-05-19T21:29:00.148Z" },
+    { url = "https://files.pythonhosted.org/packages/82/5a/6f4cd081e5f4934d2ae3a8ef4abe3afacc010d26f0035ee91b35cd7d7c37/yarl-1.24.2-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:5ec8356b8a6afcf81fc7aeeef13b1ff7a49dec00f313394bbb9e83830d32ccd7", size = 110392, upload-time = "2026-05-19T21:29:02.155Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/da/323a01c349bd5fb01bb6652e314d9bb218cee630a736bdb810ad50e4013f/yarl-1.24.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:7e7ebcdef69dec6c6451e616f32b622a6d4a2e92b445c992f7c8e5274a6bbc4c", size = 105612, upload-time = "2026-05-19T21:29:04.247Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/80/264ab684f181e1a876389374519ff05d10248725535ae2ac4e8ac4e563d6/yarl-1.24.2-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:47a55d6cf6db2f401017a9e96e5288844e5051911fb4e0c8311a3980f5e59a7d", size = 104487, upload-time = "2026-05-19T21:29:06.491Z" },
+    { url = "https://files.pythonhosted.org/packages/41/07/efabe5df87e96d7ad5959760b888344be48cd6884db127b407c6b5503adc/yarl-1.24.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3065657c80a2321225e804048597ad55658a7e76b32d6f5ee4074d04c50401db", size = 102333, upload-time = "2026-05-19T21:29:08.267Z" },
+    { url = "https://files.pythonhosted.org/packages/44/0c/bcf7c42603e1009295f586d8890f2ba032c8b53310e815adf0a202c73d9f/yarl-1.24.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:cb84b80d88e19ede158619b80813968713d8d008b0e2497a576e6a0557d50712", size = 99025, upload-time = "2026-05-19T21:29:10.682Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/82/84482ab1a57a0f21a08afe6a7004c61d741f8f2ecc3b05c321577c612164/yarl-1.24.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:990de4f680b1c217e77ff0d6aa0029f9eb79889c11fb3e9a3942c7eba29c1996", size = 110507, upload-time = "2026-05-19T21:29:12.954Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/8d/a546ba1dfe1b0f290e05fef145cd07614c0f15df1a707195e512d1e39d1d/yarl-1.24.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:abb8ec0323b80161e3802da3150ef660b41d0e9be2048b76a363d93eee992c2b", size = 103719, upload-time = "2026-05-19T21:29:14.893Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/b6/267f2a09213138473adfce6b8a6e17791d7fee70bd4d9003218e4dec58b0/yarl-1.24.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:e7977781f83638a4c73e0f88425563d70173e0dfd90ac006a45c65036293ee3c", size = 110438, upload-time = "2026-05-19T21:29:16.485Z" },
+    { url = "https://files.pythonhosted.org/packages/48/2d/1c8d89c7c5f9cad9fb2902445d94e2ab1d7aa35de029afbb8ae95c42d00f/yarl-1.24.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:e30dd55825dc554ec5b66a94953b8eda8745926514c5089dfcacecb9c99b5bd1", size = 105719, upload-time = "2026-05-19T21:29:18.367Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/25/722e3b93bd687009afb2d59a35e13d30ddd8f80571445bb0c4e4ce26ec66/yarl-1.24.2-cp312-cp312-win_amd64.whl", hash = "sha256:7dafe10c12ddd4d120d528c4b5599c953bd7b12845347d507b95451195bb6cad", size = 92901, upload-time = "2026-05-19T21:29:20.014Z" },
+    { url = "https://files.pythonhosted.org/packages/39/47/4486ccfb674c04854a1ef8aa77868b6a6f765feaf69633409d7ca4f02cb8/yarl-1.24.2-cp312-cp312-win_arm64.whl", hash = "sha256:044a09d8401fcf8681977faef6d286b8ade1e2d2e9dceda175d1cfa5ca496f30", size = 87229, upload-time = "2026-05-19T21:29:22.1Z" },
+    { url = "https://files.pythonhosted.org/packages/82/62/fcf0ce677f17e5c471c06311dd25964be38a4c586993632910d2e75278bc/yarl-1.24.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:491ac9141decf49ee8030199e1ee251cdff0e131f25678817ff6aa5f837a3536", size = 128978, upload-time = "2026-05-19T21:29:23.83Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/58/8e63299bb71ed61a834121d9d3fe6c9fcf2a6a5d09754ff4f20f2d20baf5/yarl-1.24.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e89418f65eda18f99030386305bd44d7d504e328a7945db1ead514fbe03a0607", size = 91733, upload-time = "2026-05-19T21:29:25.375Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/24/16748d5dab6daec8b0ed81ccec639a1cded0f18dcc62a4f696b4fe366c37/yarl-1.24.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:cdfcce633b4a4bb8281913c57fcafd4b5933fbc19111a5e3930bbd299d6102f1", size = 91113, upload-time = "2026-05-19T21:29:26.928Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/66/b63fff7b71211e866624b21432d5943cbb633eb0c2872d9ee3070648f22c/yarl-1.24.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:863297ddede92ee49024e9a9b11ecb59f310ca85b60d8537f56bed9bbb5b1986", size = 103899, upload-time = "2026-05-19T21:29:28.842Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/ac/ba1974b8533909636f7733fe86cf677e3619527c3c2fa913e0ea89c48757/yarl-1.24.2-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:374423f70754a2c96942ede36a29d37dc6b0cb8f92f8d009ddf3ed78d3da5488", size = 97862, upload-time = "2026-05-19T21:29:31.086Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/a5/123ac993b5c2ba6f554a140305620cb8f150fa543711bbc49be3ec0a65a4/yarl-1.24.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:33a29b5d00ccbf3219bb3e351d7875739c19481e030779f48cc46a7a71681a9b", size = 111060, upload-time = "2026-05-19T21:29:32.657Z" },
+    { url = "https://files.pythonhosted.org/packages/23/37/c472d3af3509688392134a88a825276770a187f1daa4de3f6dc0a327a751/yarl-1.24.2-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a9532c57211730c515341af11fef6e9b61d157487272a096d0c04da445642592", size = 110613, upload-time = "2026-05-19T21:29:34.379Z" },
+    { url = "https://files.pythonhosted.org/packages/df/88/09c28dad91e662ccfaa1b78f1c57badde74fc9d0b23e74aef644750ecd73/yarl-1.24.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:91e72cf093fd833483a97ee648e0c053c7c629f51ff4a0e7edd84f806b0c5617", size = 107012, upload-time = "2026-05-19T21:29:36.216Z" },
+    { url = "https://files.pythonhosted.org/packages/07/ab/9d4f69d571a94f4d112fa7e2e007200f5a54d319f58c82ac7b7baa61f5c6/yarl-1.24.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:b3177bc0a768ef3bacceb4f272632990b7bea352f1b2f1eee9d6d6ff16516f92", size = 105887, upload-time = "2026-05-19T21:29:38.746Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/9a/000b2b66c0d772a499fc531d21dab92dfeb73b640a12eed6ba89f49bb2d0/yarl-1.24.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:e196952aacaf3b232e265ff02980b64d483dc0972bd49bcb061171ff22ac203a", size = 103620, upload-time = "2026-05-19T21:29:40.368Z" },
+    { url = "https://files.pythonhosted.org/packages/41/7c/7c1050f73450fbdaa3f0c72017059f00ce5e13366692f3dba25275a1083d/yarl-1.24.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:204e7a61ce99919c0de1bf904ab5d7aa188a129ea8f690a8f76cfb6e2844dc44", size = 100599, upload-time = "2026-05-19T21:29:42.66Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/b1/29e5756b3926705f5f6089bd5b9f50a56eaac550da6e260bf713ead44d04/yarl-1.24.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:4b156914620f0b9d78dc1adb3751141daee561cfec796088abb89ed49d220f1a", size = 110604, upload-time = "2026-05-19T21:29:44.632Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/4b/8415bc96e9b150cde942fbac9a8182985e58f40ce5c54c34ed015407d3ee/yarl-1.24.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:8372a2b976cf70654b2be6619ab6068acabb35f724c0fda7b277fbf53d66a5cf", size = 105161, upload-time = "2026-05-19T21:29:46.755Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/d4/cde059abfa229553b7298a2eadde2752e723d50aeedaef86ce59da2718ee/yarl-1.24.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:f9a1e9b622ca284143aab5d885848686dcd85453bb1ca9abcdb7503e64dc0056", size = 110619, upload-time = "2026-05-19T21:29:48.972Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/2c/d6a6c9a61549f7b6c7e6dc6937d195bcf069582b47b7200dcd0e7b256acf/yarl-1.24.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:810e19b685c8c3c5862f6a38160a1f4e4c0916c9390024ec347b6157a45a0992", size = 107362, upload-time = "2026-05-19T21:29:51Z" },
+    { url = "https://files.pythonhosted.org/packages/92/dd/3ae5fe417e9d1c353a548553326eb9935e76b6b727161563b424cc296df3/yarl-1.24.2-cp313-cp313-win_amd64.whl", hash = "sha256:7d37fb7c38f2b6edab0f845c4f85148d4c44204f52bc127021bd2bc9fdbf1656", size = 92667, upload-time = "2026-05-19T21:29:52.743Z" },
+    { url = "https://files.pythonhosted.org/packages/10/cc/a7beb239f78f27fca1b053c8e8595e4179c02e62249b4687ec218c370c50/yarl-1.24.2-cp313-cp313-win_arm64.whl", hash = "sha256:1e831894be7c2954240e49791fa4b50c05a0dc881de2552cfe3ffd8631c7f461", size = 87069, upload-time = "2026-05-19T21:29:54.442Z" },
+    { url = "https://files.pythonhosted.org/packages/40/0e/e08087695fc12789263821c5dc0f8dc52b5b17efd0887cacf419f8a43ba3/yarl-1.24.2-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:f9312b3c02d9b3d23840f67952913c9c8721d7f1b7db305289faefa878f364c2", size = 129670, upload-time = "2026-05-19T21:29:56.631Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/98/ab4b5ed1b1b5cd973c8a3eb994c3a6aefb6ce6d399e21bb5f0316c33815c/yarl-1.24.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:a4f4d6cd615823bfc7fb7e9b5987c3f41666371d870d51058f77e2680fbe9630", size = 91916, upload-time = "2026-05-19T21:29:58.645Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/b1/5297bb6a7df4782f7605bffc43b31f5044070935fbbcaa6c705a07e6ac65/yarl-1.24.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:0c3063e5c0a8e8e62fae6c2596fa01da1561e4cd1da6fec5789f5cf99a8aefd8", size = 91625, upload-time = "2026-05-19T21:30:00.412Z" },
+    { url = "https://files.pythonhosted.org/packages/02/a7/45baabfff76829264e623b185cff0c340d7e11bf3e1cd9ea37e7d17934bd/yarl-1.24.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:fecd17873a096036c1c87ab3486f1aef7f269ada7f23f7f856f93b1cc7744f14", size = 104574, upload-time = "2026-05-19T21:30:02.544Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/40/3a5ab144d3d650ca37d4f4b57e56169be8af3ca34c448793e064b30baaed/yarl-1.24.2-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a46d1ab4ba4d32e6dc80daf8a28ce0bd83d08df52fbc32f3e288663427734535", size = 97534, upload-time = "2026-05-19T21:30:04.319Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/b5/5658fef3681fb5776b4513b052bec750009f47b3a592251c705d75375798/yarl-1.24.2-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:73e68edf6dfd5f73f9ca127d84e2a6f9213c65bdffb736bda19524c0564fcd14", size = 111481, upload-time = "2026-05-19T21:30:05.988Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/06/fdcd7dde037f00866dce123ed4ba23dba94beb56fc4cf561668d27be37f2/yarl-1.24.2-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:a296ca617f2d25fbceafb962b88750d627e5984e75732c712154d058ae8d79a3", size = 111529, upload-time = "2026-05-19T21:30:07.738Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/53/d81269aaafccea0d33396c03035de997b743f11e648e6e27a0df99c72980/yarl-1.24.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e51b2cf5ec89a8b8470177641ed62a3ba22d74e1e898e06ad53aa77972487208", size = 107338, upload-time = "2026-05-19T21:30:09.713Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/04/23049463f729bd899df203a7960505a75333edd499cda8aa1d5a82b64df5/yarl-1.24.2-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:310fc687f7b2044ec54e372c8cbe923bb88f5c37bded0d3079e5791c2fc3cf50", size = 106147, upload-time = "2026-05-19T21:30:11.365Z" },
+    { url = "https://files.pythonhosted.org/packages/14/18/04a4b5830b43ed5e4c5015b40e9f6241ad91487d71611061b4e111d6ac80/yarl-1.24.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:297a2fe352ecf858b30a98f87948746ec16f001d279f84aebdbd3bd965e2f1bd", size = 104272, upload-time = "2026-05-19T21:30:12.978Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/f7/8cffdf319aee7a7c1dbd07b61d91c3e3fda460c7a93b5f93e445f3806c4c/yarl-1.24.2-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:2a263e76b97bc42bdcd7c5f4953dec1f7cd62a1112fa7f869e57255229390d67", size = 99962, upload-time = "2026-05-19T21:30:15.001Z" },
+    { url = "https://files.pythonhosted.org/packages/d7/39/b3cce3b7dbef64ac700ad4cea156a207d01bede0f507587616c364b5468e/yarl-1.24.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:822519b64cf0b474f1a0aaef1dc621438ea46bb77c94df97a5b4d213a7d8a8b1", size = 111063, upload-time = "2026-05-19T21:30:16.683Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/ea/100818505e7ebf165c7242ff17fdf7d9fee79e27234aeca871c1082920d7/yarl-1.24.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:b6067060d9dc594899ba83e6db6c48c68d1e494a6dab158156ed86977ca7bcb1", size = 105438, upload-time = "2026-05-19T21:30:18.769Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/d2/e075a0b32aa6625087de9e653087df0759fed5de4a435fef594181102a77/yarl-1.24.2-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:0063adad533e57171b79db3943b229d40dfafeeee579767f96541f106bac5f1b", size = 111458, upload-time = "2026-05-19T21:30:21.024Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/5c/ceea7ba98b65c8eb8d947fdc52f9bedfcd43c6a57c9e3c90c17be8f324a3/yarl-1.24.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:ee8e3fb34513e8dc082b586ef4910c98335d43a6fab688cd44d4851bacfce3e8", size = 107589, upload-time = "2026-05-19T21:30:23.412Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/d9/5582d57e2b2db9b85eb6663a22efdd78e08805f3f5389566e9fcad254d1b/yarl-1.24.2-cp314-cp314-win_amd64.whl", hash = "sha256:afb00d7fd8e0f285ca29a44cc50df2d622ff2f7a6d933fa641577b5f9d5f3db0", size = 94424, upload-time = "2026-05-19T21:30:25.425Z" },
+    { url = "https://files.pythonhosted.org/packages/92/10/7dc07a0e22806a9280f42a57361395506e800c64e22737cd7b0886feab42/yarl-1.24.2-cp314-cp314-win_arm64.whl", hash = "sha256:68cf6eacd6028ef1142bc4b48376b81566385ca6f9e7dde3b0fa91be08ffcb57", size = 88690, upload-time = "2026-05-19T21:30:27.623Z" },
+    { url = "https://files.pythonhosted.org/packages/9e/13/d5b8e2c8667db955bcb3de233f18798fefe7edf1d7429c2c9d4f9c401114/yarl-1.24.2-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:221ce1dd921ac4f603957f17d7c18c5cc0797fbb52f156941f92e04605d1d67b", size = 136248, upload-time = "2026-05-19T21:30:29.297Z" },
+    { url = "https://files.pythonhosted.org/packages/de/46/a4a97c05c9c9b8fd266bb2a0df12992c7fbd02391eb9640583411b6dab32/yarl-1.24.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:5f3224db28173a00d7afacdee07045cc4673dfab2b15492c7ae10deddbece761", size = 95084, upload-time = "2026-05-19T21:30:31.031Z" },
+    { url = "https://files.pythonhosted.org/packages/95/b2/845cf2074a015e6fe0d0808cf1a2d9e868386c4220d657ebd8302b199043/yarl-1.24.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:c557165320d6244ebe3a02431b2a201a20080e02f41f0cfa0ccc47a183765da8", size = 95272, upload-time = "2026-05-19T21:30:33.062Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/16/e69d4aa244aef45235ddfebc0e04036a6829842bc5a6a795aedc6c998d23/yarl-1.24.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:904065e6e85b1fa54d0d87438bd58c14c0bad97aad654ad1077fd9d87e8478ed", size = 101497, upload-time = "2026-05-19T21:30:34.842Z" },
+    { url = "https://files.pythonhosted.org/packages/15/94/c07107715d621076863ee88b3ddf183fa5e9d4aba5769623c9979828410a/yarl-1.24.2-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:8cec2a38d70edc10e0e856ceda886af5327a017ccbde8e1de1bd44d300357543", size = 94002, upload-time = "2026-05-19T21:30:37.724Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/35/fc1bbdd895b5e4010b8fdd037f7ed3aa289d3863e08231b30231ca9a0815/yarl-1.24.2-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:e7484b9361ed222ee1ca5b4337aa4cbdcc4618ce5aff57d9ef1582fd95893fc0", size = 106524, upload-time = "2026-05-19T21:30:40.196Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/f2/32b66d0a4ba47c296cf86d03e2c67bff58399fe6d6d84d5205c04c66cc6d/yarl-1.24.2-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:84f9670b89f34db07f81e53aee83e0b938a3412329d51c8f922488be7fcc4024", size = 106165, upload-time = "2026-05-19T21:30:41.888Z" },
+    { url = "https://files.pythonhosted.org/packages/95/47/37cb5ff50c5e825d4d38e81bb04d1b7e96bf960f7ab89f9850b162f3f114/yarl-1.24.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:abb2759733d63a28b4956500a5dd57140f26486c92b2caedfb964ab7d9b79dbf", size = 103010, upload-time = "2026-05-19T21:30:43.985Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/d2/4597912315096f7bb359e46e13bf8b60994fcbb2db29b804c0902ef4eff5/yarl-1.24.2-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:081c2bf54efe03774d0311172bc04fedf9ca01e644d4cd8c805688e527209bdc", size = 101128, upload-time = "2026-05-19T21:30:46.291Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/d5/c8e86e120521e646013d02a8e3b8884392e28494be8f392366e50d208efc/yarl-1.24.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:86746bef442aa479107fe28132e1277237f9c24c2f00b0b0cf22b3ee0904f2bb", size = 101382, upload-time = "2026-05-19T21:30:48.085Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/98/70b229236118f89dbeb739b76f10225bbf53b5497725502594c9a01d699a/yarl-1.24.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:2d07d21d0bc4b17558e8de0b02fbfdf1e347d3bb3699edd00bb92e7c57925420", size = 95964, upload-time = "2026-05-19T21:30:49.785Z" },
+    { url = "https://files.pythonhosted.org/packages/87/f8/56c386981e3c8648d279fdef2397ffec577e8320fd5649745e34d54faeb7/yarl-1.24.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:4fb1ac3fc5fecd8ae7453ea237e4d22b49befa70266dfe1629924245c21a0c7f", size = 106204, upload-time = "2026-05-19T21:30:51.862Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/1e/765afe97811ca35933e2a7de70ac57b1997ea2e4ee895719ee7a231fb7e5/yarl-1.24.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:4da31a5512ed1729ca8d8aacde3f7faeb8843cde3165d6bcf7f88f74f17bb8aa", size = 101510, upload-time = "2026-05-19T21:30:53.62Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/78/393913f4b9039e1edd09ae8a9bbb9d539be909a8abf6d8a2084585bed4b7/yarl-1.24.2-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:533ded4dceb5f1f3da7906244f4e82cf46cfd40d84c69a1faf5ac506aa65ecbe", size = 105584, upload-time = "2026-05-19T21:30:55.962Z" },
+    { url = "https://files.pythonhosted.org/packages/78/87/deb17b7049bbe74ea11a713b86f8f27800cc1c8648b0b797243ebb4830ba/yarl-1.24.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:7b3a85525f6e7eeabcfdd372862b21ee1915db1b498a04e8bf0e389b607ff0bd", size = 103410, upload-time = "2026-05-19T21:30:57.962Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/be/f9f7594e23b5b93affff0318e4593c1920331bcaefda326cabcad94296a1/yarl-1.24.2-cp314-cp314t-win_amd64.whl", hash = "sha256:a7624b1ca46ca5d7b864ef0d2f8efe3091454085ee1855b4e992314529972215", size = 102980, upload-time = "2026-05-19T21:30:59.735Z" },
+    { url = "https://files.pythonhosted.org/packages/65/a4/ba80dccd3593ff1f01051a818694d07b58cb8232677ee9a22a5a1f93a9fc/yarl-1.24.2-cp314-cp314t-win_arm64.whl", hash = "sha256:e434a45ce2e7a947f951fc5a8944c8cc080b7e59f9c50ae80fd39107cf88126d", size = 91219, upload-time = "2026-05-19T21:31:01.934Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/4d/4b880086bd0d3e034d25647be1d830afc3e3f610e98c4ab3490af6b1b6d5/yarl-1.24.2-py3-none-any.whl", hash = "sha256:2783d9226db8797636cd6896e4de81feed252d1db72265686c9558d97a4d94b9", size = 53576, upload-time = "2026-05-19T21:31:03.909Z" },
+]
diff --git a/build/monero/Dockerfile b/build/monero/Dockerfile
index 73b8f147..096ce3f2 100644
--- a/build/monero/Dockerfile
+++ b/build/monero/Dockerfile
@@ -28,5 +28,10 @@ RUN chmod +x /usr/local/bin/entrypoint.sh
 COPY healthcheck.sh /usr/local/bin/monerod-healthcheck.sh
 RUN chmod +x /usr/local/bin/monerod-healthcheck.sh
 
-WORKDIR /root
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
\ No newline at end of file
+# Run non-root (#255). Reuse ubuntu:24.04's built-in 'ubuntu' user (uid 1000) and keep monerod's
+# data under that user's home — /home/ubuntu/.bitmonero, which is also monerod's native
+# $HOME/.bitmonero default. pithead chowns the blockchain bind-mount to match.
+RUN install -d -o ubuntu -g ubuntu /home/ubuntu
+WORKDIR /home/ubuntu
+USER ubuntu
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
diff --git a/build/monero/bitmonero.conf.template b/build/monero/bitmonero.conf.template
index 99f82d3c..fe706dcd 100644
--- a/build/monero/bitmonero.conf.template
+++ b/build/monero/bitmonero.conf.template
@@ -1,7 +1,7 @@
 # --- Data & Logging Configuration ---
 # Internal container paths for blockchain data and logs
-data-dir=/root/.bitmonero
-log-file=/root/.bitmonero/bitmonero.log
+data-dir=/home/ubuntu/.bitmonero
+log-file=/home/ubuntu/.bitmonero/bitmonero.log
 log-level=0
 
 # --- Blockchain Pruning ---
diff --git a/build/monero/entrypoint.sh b/build/monero/entrypoint.sh
index 1cd67ef7..30d6a93f 100644
--- a/build/monero/entrypoint.sh
+++ b/build/monero/entrypoint.sh
@@ -2,8 +2,8 @@
 set -e
 
 # Define paths for configuration management (overridable for testing).
-TEMPLATE_PATH="${TEMPLATE_PATH:-/root/bitmonero.conf.template}"
-CONFIG_PATH="${CONFIG_PATH:-/root/.bitmonero/bitmonero.conf}"
+TEMPLATE_PATH="${TEMPLATE_PATH:-/home/ubuntu/bitmonero.conf.template}"
+CONFIG_PATH="${CONFIG_PATH:-/home/ubuntu/.bitmonero/bitmonero.conf}"
 # Shared, dashboard-writable state dir (#234). The dashboard drops this marker once monerod has
 # finished its clearnet initial sync and restarts the container; seeing it here means "the clearnet
 # sync already completed — come up on Tor." Default matches the compose mount; overridable for tests.
@@ -29,8 +29,8 @@ CLEARNET_MARKER="${CLEARNET_MARKER:-/clearnet-state/monero.synced}"
 # Kept as a function (portable sed, no in-place -e) so the shell test suite can exercise it directly.
 apply_clearnet_initial_sync() {
     local cfg="$1" tmp="$1.tmp"
-    sed -e '/^proxy=/d' -e 's/^out-peers=.*/out-peers=32/' "$cfg" > "$tmp" && mv "$tmp" "$cfg"
-    cat >> "$cfg" <<'PRIONODES'
+    sed -e '/^proxy=/d' -e 's/^out-peers=.*/out-peers=32/' "$cfg" >"$tmp" && mv "$tmp" "$cfg"
+    cat >>"$cfg" <<'PRIONODES'
 
 # P2Pool v4.16 recommended priority nodes (clearnet sync window only — removed when flipped to Tor).
 add-priority-node=p2pmd.xmrvsbeast.com:18080
@@ -59,7 +59,7 @@ echo "Initializing Monero configuration from template..."
 
 # Inject environment variables into the configuration template
 # We explicitly list variables to avoid accidental substitution of system environment variables
-envsubst '${MONERO_NODE_USERNAME}${MONERO_NODE_PASSWORD}${MONERO_ONION_ADDRESS}${MONERO_PRUNE}${MONERO_PREP_THREADS}${NETWORK_PREFIX}' < "$TEMPLATE_PATH" > "$CONFIG_PATH"
+envsubst '${MONERO_NODE_USERNAME}${MONERO_NODE_PASSWORD}${MONERO_ONION_ADDRESS}${MONERO_PRUNE}${MONERO_PREP_THREADS}${NETWORK_PREFIX}' <"$TEMPLATE_PATH" >"$CONFIG_PATH"
 
 # Apply the optional clearnet initial-sync transform (#183) and warn loudly while it's active.
 if clearnet_sync_active; then
diff --git a/build/monero/healthcheck.sh b/build/monero/healthcheck.sh
index f53c5374..1aaac22b 100755
--- a/build/monero/healthcheck.sh
+++ b/build/monero/healthcheck.sh
@@ -8,6 +8,6 @@
 set -eu
 
 curl -fsS --digest \
-  -u "${MONERO_NODE_USERNAME:-}:${MONERO_NODE_PASSWORD:-}" \
-  -o /dev/null \
-  http://localhost:18081/get_info
+    -u "${MONERO_NODE_USERNAME:-}:${MONERO_NODE_PASSWORD:-}" \
+    -o /dev/null \
+    http://localhost:18081/get_info
diff --git a/build/p2pool/Dockerfile b/build/p2pool/Dockerfile
index f4b99f4b..4ee66154 100644
--- a/build/p2pool/Dockerfile
+++ b/build/p2pool/Dockerfile
@@ -4,9 +4,12 @@ FROM ubuntu:24.04@sha256:786a8b558f7be160c6c8c4a54f9a57274f3b4fb1491cf65146521ae
 ARG P2POOL_VERSION=v4.16
 ARG P2POOL_HASH=1b03b2e4d4adfe488b2867eb85b57366fbaf8594a7f84cdbf13a3c8519159280
 
-# Install runtime dependencies
+# Install runtime dependencies. socat (#278): the entrypoint bridges 127.0.0.1 -> the real monerod
+# (node RPC/ZMQ) and the Tari base node (merge-mine gRPC) so those intra-stack legs stay DIRECT while
+# --socks5 routes only the sidechain/merge-mine P2P over Tor (p2pool proxies everything but loopback
+# when --socks5 is set, so a private Docker IP would otherwise be dialled through Tor and rejected).
 RUN apt-get update && apt-get install -y \
-    wget ca-certificates libgomp1 \
+    wget ca-certificates libgomp1 socat \
     && rm -rf /var/lib/apt/lists/*
 
 RUN wget -O p2pool.tar.gz https://github.com/SChernykh/p2pool/releases/download/${P2POOL_VERSION}/p2pool-${P2POOL_VERSION}-linux-x64.tar.gz \
@@ -24,7 +27,14 @@ RUN chmod +x /usr/local/bin/entrypoint.sh
 COPY healthcheck.sh /usr/local/bin/p2pool-healthcheck.sh
 RUN chmod +x /usr/local/bin/p2pool-healthcheck.sh
 
-WORKDIR /root
+# Run non-root (#255). Reuse ubuntu:24.04's built-in 'ubuntu' user (uid 1000) and keep p2pool's data
+# under that user's home; pithead chowns the ${P2POOL_DATA_DIR} bind-mount (mapped to /home/ubuntu)
+# + /stats to match, so the cache and data-api writes succeed as uid 1000. The IPC_LOCK/SYS_NICE
+# caps granted in compose are not effective for a non-root process, but p2pool only needs them for
+# mlock (covered by the unlimited memlock ulimit) and best-effort thread priority — neither is fatal.
+RUN install -d -o ubuntu -g ubuntu /home/ubuntu
+WORKDIR /home/ubuntu
+USER ubuntu
 
 # Use the wrapper script as the entrypoint
-ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
\ No newline at end of file
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
diff --git a/build/p2pool/entrypoint.sh b/build/p2pool/entrypoint.sh
index f8376b60..1217b152 100644
--- a/build/p2pool/entrypoint.sh
+++ b/build/p2pool/entrypoint.sh
@@ -3,4 +3,88 @@ set -euo pipefail
 
 # P2Pool launcher. (mDNS/.local resolution was removed — point p2pool at an IP or a
 # DNS-resolvable hostname; on a home LAN, use a DHCP reservation or static IP.)
-exec p2pool "$@"
+#
+# Extra flags arrive via $P2POOL_FLAGS (rendered by pithead: the pool-type flag + the #165 Tor SOCKS
+# routing — e.g. "--mini --socks5 172.28.0.25:9050 --socks5-proxy-type tor"). We word-split it HERE
+# because Docker Compose passes a `- ${VAR}` command item as ONE argument (no word-splitting), which
+# would hand p2pool a single mangled flag. An empty value expands to nothing (no stray empty arg).
+# #278: p2pool's --socks5 (#165 Tor sidechain routing) ALSO proxies the monerod RPC/ZMQ connection —
+# unless the node address is LOOPBACK. p2pool exempts only 127.0.0.1/::1/localhost from the SOCKS5
+# proxy (verified vs p2pool v4.16: json_rpc_request.cpp / util.cpp is_localhost), so a private Docker
+# node IP (e.g. 172.28.0.26) gets dialled THROUGH Tor — which can't reach a private IP → "get_info ...
+# empty response", no block template, no mining. There is no per-host proxy-bypass flag. So when the
+# Tor proxy is on, bridge 127.0.0.1 -> the real node with socat and repoint --host at loopback: the
+# node RPC/ZMQ then stay DIRECT (socat is a plain TCP forward, not p2pool's proxy) while the sidechain
+# P2P still rides --socks5 over Tor. The socat hops (loopback -> node) are intra-stack, allowed by the
+# #270 firewall (subnet -> 172.16/12).
+if printf '%s' "${P2POOL_FLAGS:-}" | grep -q -- '--socks5'; then
+    _node="" _rpc="18081" _zmq="18083" _prev=""
+    for _a in "$@"; do
+        case "$_prev" in --host) _node="$_a" ;; --rpc-port) _rpc="$_a" ;; --zmq-port) _zmq="$_a" ;; esac
+        _prev="$_a"
+    done
+    case "$_node" in
+    "" | 127.0.0.1 | ::1 | localhost) : ;; # already loopback (or p2pool's 127.0.0.1 default) — nothing to bridge
+    *)
+        echo "[p2pool-entrypoint] Tor on (#278): bridging 127.0.0.1 -> $_node for monerod RPC($_rpc)/ZMQ($_zmq) so the node stays DIRECT (p2pool only exempts loopback from --socks5)."
+        socat "TCP-LISTEN:$_rpc,bind=127.0.0.1,fork,reuseaddr" "TCP:$_node:$_rpc" &
+        socat "TCP-LISTEN:$_zmq,bind=127.0.0.1,fork,reuseaddr" "TCP:$_node:$_zmq" &
+        _args=()
+        _skip=0
+        for _a in "$@"; do
+            if [ "$_skip" = 1 ]; then
+                _args+=("127.0.0.1")
+                _skip=0
+                continue
+            fi
+            _args+=("$_a")
+            [ "$_a" = "--host" ] && _skip=1
+        done
+        set -- "${_args[@]}"
+        ;;
+    esac
+
+    # Same trap, one leg further (#278 covered monerod only): p2pool's MergeMiningClientTari reaches
+    # the Tari base node via TCPServer::connect_to_peer, which — like the node RPC — only skips the
+    # SOCKS5 proxy for a LOOPBACK IP literal (no_proxy = m_addressType != DomainName && is_localhost();
+    # verified vs p2pool v4.16 src/tcp_server.cpp). So `--merge-mine tari://<private-docker-ip>:18142`
+    # is dialled THROUGH Tor, which rejects RFC1918 ("Rejecting SOCKS request ... to private address")
+    # → the gRPC channel_state sticks at TRANSIENT_FAILURE and no Tari is merge-mined. Same remedy:
+    # bridge 127.0.0.1 -> the real node and rewrite the URL host to the 127.0.0.1 IP literal (NOT
+    # "localhost" — that parses as a DomainName and would still be proxied). The merge-mine P2P egress
+    # is unaffected; only this local gRPC leg is moved back onto loopback.
+    _mm="" _prev=""
+    for _a in "$@"; do
+        [ "$_prev" = "--merge-mine" ] && {
+            _mm="$_a"
+            break
+        }
+        _prev="$_a"
+    done
+    case "$_mm" in
+    tari://*)
+        _mmhp="${_mm#tari://}" # HOST:PORT
+        _mmhost="${_mmhp%:*}" _mmport="${_mmhp##*:}"
+        case "$_mmhost" in
+        "" | 127.0.0.1 | ::1 | localhost) : ;; # already loopback — nothing to bridge
+        *)
+            echo "[p2pool-entrypoint] Tor on (#278): bridging 127.0.0.1 -> $_mmhost for Tari merge-mine gRPC($_mmport) so it stays DIRECT (p2pool only exempts loopback from --socks5)."
+            socat "TCP-LISTEN:$_mmport,bind=127.0.0.1,fork,reuseaddr" "TCP:$_mmhost:$_mmport" &
+            _args=()
+            for _a in "$@"; do
+                if [ "$_a" = "$_mm" ]; then _args+=("tari://127.0.0.1:$_mmport"); else _args+=("$_a"); fi
+            done
+            set -- "${_args[@]}"
+            ;;
+        esac
+        ;;
+    esac
+fi
+
+# Log the FINAL launch command (#273): makes the applied flags — notably the #165 `--socks5` Tor
+# routing — auditable in `docker logs p2pool`, so a stale image silently dropping P2POOL_FLAGS shows
+# up here (and `pithead doctor` fails on it) rather than leaking quietly. After the #278 block above so
+# it reflects the rewritten --host.
+echo "[p2pool-entrypoint] launching: p2pool $* ${P2POOL_FLAGS:-}"
+# shellcheck disable=SC2086  # intentional word-splitting of the space-separated flag string
+exec p2pool "$@" ${P2POOL_FLAGS:-}
diff --git a/build/tari/config.toml.template b/build/tari/config.toml.template
index 0d9f3e1f..005a8f5f 100644
--- a/build/tari/config.toml.template
+++ b/build/tari/config.toml.template
@@ -41,7 +41,12 @@ mining_enabled = true
 grpc_enabled = true
 grpc_address = "/ip4/0.0.0.0/tcp/18142"
 
-# Allowed gRPC methods for interaction with the dashboard and miner
+# Allowed gRPC methods (#91): pruned to the node-status + merge-mining surface our two consumers
+# actually call. The dashboard's Tari client (tari_client.py) uses get_tip_info + get_sync_progress
+# (with get_version/get_sync_info as fallbacks); p2pool's merge-mining needs the block-template,
+# submit_block and tip methods. Everything else — the wallet/transaction, UTXO/kernel/payment-ref
+# search, mempool-tx and DAN validator-node calls — has no consumer here, so it's removed (smaller
+# attack surface on the gRPC port). Re-add a method if a future dashboard panel needs it.
 grpc_server_allow_methods = [
     "get_version",
     "get_sync_info",
@@ -56,7 +61,6 @@ grpc_server_allow_methods = [
     "get_constants",
     "get_block_size",
     "get_block_fees",
-    "get_tokens_in_circulation",
     "get_network_difficulty",
     "get_new_block_template",
     "get_new_block",
@@ -65,22 +69,8 @@ grpc_server_allow_methods = [
     "get_new_block_blob",
     "submit_block",
     "submit_block_blob",
-    "submit_transaction",
-    "search_kernels",
-    "search_utxos",
-    "fetch_matching_utxos",
     "get_peers",
-    "get_mempool_transactions",
-    "transaction_state",
     "list_connected_peers",
-    "get_mempool_stats",
-    "get_active_validator_nodes",
-    "get_validator_node_changes",
-    "get_shard_key",
-    "get_template_registrations",
-    "get_side_chain_utxos",
-    "search_payment_references",
-    "search_payment_references_via_output_hash",
 ]
 
 [base_node.p2p]
@@ -112,5 +102,13 @@ control_address = "/ip4/172.28.0.25/tcp/9051"
 socks_address_override = "/ip4/172.28.0.25/tcp/9050"
 control_auth = "auto"
 
+# Route EVERY outbound dial through the Tor SOCKS proxy — including peers learned via gossip that
+# advertise a bare /ip4 (clearnet) address. With this true (an upstream default that favours speed),
+# minotari direct-dials those clearnet peers and leaks the home IP (#271, observed as sustained
+# connections to public IPs). false = clearnet peers are reached via Tor exit nodes, so Tari stays
+# fully functional AND never touches clearnet directly. No per-address exemptions (no local wallet).
+proxy_bypass_for_outbound_tcp = false
+proxy_bypass_addresses = []
+
 # Port mapping for the hidden service
 onion_port = 18189
diff --git a/build/tari/entrypoint.sh b/build/tari/entrypoint.sh
index 0768d3ac..40647739 100755
--- a/build/tari/entrypoint.sh
+++ b/build/tari/entrypoint.sh
@@ -28,7 +28,7 @@ apply_clearnet_initial_sync() {
     sed -e 's/^type = "tor"/type = "tcp"/' \
         -e 's/^dns_seeds = \[\]/dns_seeds = ["seeds.tari.com"]/' \
         -e 's#^public_addresses = .*#public_addresses = []#' \
-        "$cfg" > "$tmp" && mv "$tmp" "$cfg"
+        "$cfg" >"$tmp" && mv "$tmp" "$cfg"
 }
 
 # True when Tari should sync over clearnet NOW: flag on AND the auto-transition marker absent (#234).
diff --git a/build/tor/Dockerfile b/build/tor/Dockerfile
index 77a23414..676b0944 100644
--- a/build/tor/Dockerfile
+++ b/build/tor/Dockerfile
@@ -1,6 +1,6 @@
 # Pinned by digest (#135). NOTE: still the floating `latest` tag — a follow-up could move this to a
 # specific alpine version; the digest already makes the build reproducible regardless.
-FROM alpine:latest@sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11
+FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b
 
 # Install Tor plus the tools the bootstrap healthcheck needs: netcat (talk to the
 # control port) and xxd (hex-encode the auth cookie). --no-cache keeps the image small.
diff --git a/build/tor/entrypoint.sh b/build/tor/entrypoint.sh
index 818efed7..f1266c4c 100755
--- a/build/tor/entrypoint.sh
+++ b/build/tor/entrypoint.sh
@@ -7,6 +7,6 @@ set -eu
 
 : "${NETWORK_PREFIX:=172.28.0}"
 
-sed "s/__NETWORK_PREFIX__/${NETWORK_PREFIX}/g" /etc/tor/torrc.template > /tmp/torrc
+sed "s/__NETWORK_PREFIX__/${NETWORK_PREFIX}/g" /etc/tor/torrc.template >/tmp/torrc
 
 exec tor -f /tmp/torrc
diff --git a/build/tor/healthcheck.sh b/build/tor/healthcheck.sh
index e4d5af9d..8f9fa89f 100755
--- a/build/tor/healthcheck.sh
+++ b/build/tor/healthcheck.sh
@@ -23,6 +23,6 @@ COOKIE_HEX=$(xxd -p -c 256 "$COOKIE_FILE" | tr -d '\n')
 [ -n "$COOKIE_HEX" ] || exit 1
 
 # Authenticate, query bootstrap phase, then close. Healthy only at TAG=done (100%).
-printf 'AUTHENTICATE %s\r\nGETINFO status/bootstrap-phase\r\nQUIT\r\n' "$COOKIE_HEX" \
-  | nc -w 3 "$CONTROL_HOST" "$CONTROL_PORT" \
-  | grep -q 'TAG=done'
+printf 'AUTHENTICATE %s\r\nGETINFO status/bootstrap-phase\r\nQUIT\r\n' "$COOKIE_HEX" |
+    nc -w 3 "$CONTROL_HOST" "$CONTROL_PORT" |
+    grep -q 'TAG=done'
diff --git a/build/xmrig-proxy/Dockerfile b/build/xmrig-proxy/Dockerfile
index afd797c0..427d7607 100644
--- a/build/xmrig-proxy/Dockerfile
+++ b/build/xmrig-proxy/Dockerfile
@@ -19,5 +19,10 @@ RUN wget -O xmrig-proxy.tar.gz https://github.com/xmrig/xmrig-proxy/releases/dow
     && chmod +x /usr/local/bin/xmrig-proxy \
     && rm -rf xmrig-proxy*
 
-WORKDIR /root
-ENTRYPOINT ["xmrig-proxy"]
\ No newline at end of file
+# Run non-root (#255) — the easy win: pure network proxy, no bind-mounts, already cap_drop:[ALL]
+# + no-new-privileges in compose. Reuse ubuntu:24.04's 'ubuntu' user (uid 1000) and give it a
+# writable home as the cwd in case xmrig-proxy drops a config/log there.
+RUN install -d -o ubuntu -g ubuntu /home/ubuntu
+WORKDIR /home/ubuntu
+USER ubuntu
+ENTRYPOINT ["xmrig-proxy"]
diff --git a/config.json.template b/config.minimal.json
similarity index 100%
rename from config.json.template
rename to config.minimal.json
diff --git a/config.advanced.example.json b/config.reference.json
similarity index 87%
rename from config.advanced.example.json
rename to config.reference.json
index 7a1d32cc..013538d9 100644
--- a/config.advanced.example.json
+++ b/config.reference.json
@@ -32,6 +32,7 @@
         "pool": "main",
         "stratum_bind": "0.0.0.0",
         "stratum_password": "",
+        "clearnet": false,
         "data_dir": "auto"
     },
 
@@ -43,7 +44,8 @@
         "enabled": true,
         "url": "na.xmrvsbeast.com:4247",
         "donor_id": "auto",
-        "donation_level": "auto"
+        "donation_level": "auto",
+        "tor": true
     },
 
     "tor": {
@@ -63,7 +65,14 @@
         }
     },
 
+    "workers": {
+        "api_port": 8080,
+        "api_auth": "none",
+        "api_token": ""
+    },
+
     "network": {
-        "subnet": "172.28.0.0/24"
+        "subnet": "172.28.0.0/24",
+        "tor_egress_firewall": true
     }
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index e98b7158..cac8cba7 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -75,9 +75,9 @@ services:
       # Subnet prefix (#180): the entrypoint envsubst's it into the Tor SOCKS IP in bitmonero.conf.
       - NETWORK_PREFIX=${NETWORK_PREFIX:-172.28.0}
     volumes:
-      - ${MONERO_DATA_DIR}:/root/.bitmonero
+      - ${MONERO_DATA_DIR}:/home/ubuntu/.bitmonero
       - /dev/hugepages:/dev/hugepages
-      - ./build/monero/bitmonero.conf.template:/root/bitmonero.conf.template:ro
+      - ./build/monero/bitmonero.conf.template:/home/ubuntu/bitmonero.conf.template:ro
       # Read-only view of the shared clearnet-state dir (#234): the entrypoint reads the
       # dashboard-written "sync complete" marker to decide clearnet-vs-Tor at startup.
       - ${CLEARNET_STATE_DIR:-./data/clearnet-state}:/clearnet-state:ro
@@ -106,6 +106,10 @@ services:
     # Pinned by digest (#135) so the v5.3.1-mainnet tag can't be silently re-pointed.
     image: quay.io/tarilabs/minotari_node:v5.3.1-mainnet@sha256:824fd6ec21d618805317d7eede374d6782906eeae17d2fc8aaad4df6205f94e0
     container_name: tari
+    # Run non-root (#255). Pulled image (not our Dockerfile), so set the uid via compose to match the
+    # uid pithead chowns ${TARI_DATA_DIR} to. The wrapper entrypoint reads the canonical config
+    # read-only and writes its runtime copy to /tmp, so only the data dir needs to be owned by 1000.
+    user: "1000:1000"
     restart: unless-stopped
     stop_grace_period: 1m
     logging: *default-logging
@@ -178,8 +182,10 @@ services:
     memswap_limit: 1g
     restart: unless-stopped
     logging: *default-logging
-    # Replaces 'privileged: true'. p2pool only needs to lock HugePages for the
-    # RandomX dataset (IPC_LOCK) and raise thread priority (SYS_NICE).
+    # Replaces 'privileged: true'. p2pool only needs to lock HugePages for the RandomX dataset
+    # (IPC_LOCK) and raise thread priority (SYS_NICE). NOTE (#255): the container now runs non-root,
+    # so these caps aren't in the process's effective set — but mlock is covered by the unlimited
+    # memlock ulimit below, and SYS_NICE is best-effort (p2pool warns and continues without it).
     cap_add:
       - IPC_LOCK
       - SYS_NICE
@@ -188,7 +194,7 @@ services:
         soft: -1
         hard: -1
     volumes:
-      - ${P2POOL_DATA_DIR}:/root
+      - ${P2POOL_DATA_DIR}:/home/ubuntu
       - ${P2POOL_DATA_DIR}/stats:/stats
       - /dev/hugepages:/dev/hugepages
     command:
@@ -201,12 +207,12 @@ services:
       - --zmq-port
       - "${MONERO_ZMQ_PORT}"
       - --wallet
-      - ${MONERO_WALLET_ADDRESS} 
+      - ${MONERO_WALLET_ADDRESS}
       - --merge-mine
       - tari://${NETWORK_PREFIX:-172.28.0}.27:18142
       - ${TARI_WALLET_ADDRESS}
       - --onion-address
-      - ${P2POOL_ONION_ADDRESS} 
+      - ${P2POOL_ONION_ADDRESS}
       - --local-api
       - --stratum
       - 0.0.0.0:3333
@@ -214,7 +220,11 @@ services:
       - 0.0.0.0:${P2POOL_PORT}
       - --data-api
       - /stats
-      - ${P2POOL_FLAGS}
+    # P2POOL_FLAGS (pool type + the #165 Tor SOCKS routing) is passed via the environment, not as a
+    # `- ${P2POOL_FLAGS}` command item: Compose passes such an item as a SINGLE argument (no
+    # word-splitting), which mangles a multi-flag value. The entrypoint word-splits this env var.
+    environment:
+      - P2POOL_FLAGS=${P2POOL_FLAGS:-}
     networks:
       mining_net:
         ipv4_address: ${NETWORK_PREFIX:-172.28.0}.28
@@ -305,41 +315,46 @@ services:
 
   # --- Monitoring Dashboard ---
   dashboard:
-      image: ${PITHEAD_REGISTRY:-ghcr.io/p2pool-starter-stack}/pithead-dashboard:${STACK_VERSION:-dev}
-      build:
-        context: ./build/dashboard
-        # Stack version baked into the image so the dashboard header can show it (Issue #58).
-        # pithead exports these for the build (PITHEAD_VERSION from the top-level VERSION file;
-        # git branch/commit for dev builds — see export_build_provenance); empty defaults keep a
-        # bare `docker compose build` working (the badge then falls back to a generic dev indicator).
-        args:
-          PITHEAD_VERSION: ${PITHEAD_VERSION:-}
-          PITHEAD_GIT_COMMIT: ${PITHEAD_GIT_COMMIT:-}
-          PITHEAD_GIT_BRANCH: ${PITHEAD_GIT_BRANCH:-}
-          PITHEAD_RELEASE: ${PITHEAD_RELEASE:-}
-      container_name: dashboard
-      # Memory ceiling (#132 — see monerod). A small Flask + SQLite app (~0.06 GiB observed); a tight
-      # cap is pure upside — a memory regression OOM-restarts the dashboard, not the revenue services.
-      mem_limit: 512m
-      memswap_limit: 512m
-      restart: unless-stopped
-      logging: *default-logging
-      network_mode: "host"
-      # Hardened with no-new-privileges (#90). Deliberately NOT cap_drop: [ALL] like the other
-      # leaf services: the dashboard runs as root and persists its SQLite history into the
-      # ${DASHBOARD_DATA_DIR} bind mount, which pithead creates owned by the host user. Dropping
-      # all capabilities strips CAP_DAC_OVERRIDE, so root could no longer create the SQLite
-      # WAL/journal files in that user-owned directory and history writes would fail.
-      security_opt:
-        - no-new-privileges:true
-      volumes:
-        - ${P2POOL_DATA_DIR}/stats:/app/stats:ro
-        - ${DASHBOARD_DATA_DIR}:/data
-        # Read-WRITE: the supervisor drops the per-chain "clearnet sync complete" marker here once a
-        # node finishes a clearnet initial sync, then restarts it onto Tor (#234). monerod/tari mount
-        # the same dir read-only. Holds only non-secret state markers.
-        - ${CLEARNET_STATE_DIR:-./data/clearnet-state}:/clearnet-state
-      environment:
+    image: ${PITHEAD_REGISTRY:-ghcr.io/p2pool-starter-stack}/pithead-dashboard:${STACK_VERSION:-dev}
+    build:
+      context: ./build/dashboard
+      # Stack version baked into the image so the dashboard header can show it (Issue #58).
+      # pithead exports these for the build (PITHEAD_VERSION from the top-level VERSION file;
+      # git branch/commit for dev builds — see export_build_provenance); empty defaults keep a
+      # bare `docker compose build` working (the badge then falls back to a generic dev indicator).
+      args:
+        PITHEAD_VERSION: ${PITHEAD_VERSION:-}
+        PITHEAD_GIT_COMMIT: ${PITHEAD_GIT_COMMIT:-}
+        PITHEAD_GIT_BRANCH: ${PITHEAD_GIT_BRANCH:-}
+        PITHEAD_RELEASE: ${PITHEAD_RELEASE:-}
+    container_name: dashboard
+    # Memory ceiling (#132 — see monerod). A small Flask + SQLite app (~0.06 GiB observed); a tight
+    # cap is pure upside — a memory regression OOM-restarts the dashboard, not the revenue services.
+    mem_limit: 512m
+    memswap_limit: 512m
+    restart: unless-stopped
+    logging: *default-logging
+    # Host networking, kept deliberately (#91 P5, evaluated & closed): the dashboard reaches the
+    # local monerod RPC on 127.0.0.1:18081 (Issue #29) plus the host-published proxy/Tor-SOCKS
+    # endpoints, and Caddy proxies it on the host. Moving to the bridge would mean re-plumbing the
+    # monerod address, the dashboard's bind, Caddy's upstream and LAN-worker reachability for a
+    # marginal gain — net negative, so host networking stays. It binds only 127.0.0.1 (HOST_IP).
+    network_mode: "host"
+    # Now runs non-root (uid 1000, #255) and owns ${DASHBOARD_DATA_DIR}, so it no longer needs
+    # root's CAP_DAC_OVERRIDE to write its SQLite history — drop all capabilities like the other
+    # leaf services (#90). no-new-privileges stays as defense-in-depth.
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    volumes:
+      - ${P2POOL_DATA_DIR}/stats:/app/stats:ro
+      - ${DASHBOARD_DATA_DIR}:/data
+      # Read-WRITE: the supervisor drops the per-chain "clearnet sync complete" marker here once a
+      # node finishes a clearnet initial sync, then restarts it onto Tor (#234). monerod/tari mount
+      # the same dir read-only. Holds only non-secret state markers.
+      - ${CLEARNET_STATE_DIR:-./data/clearnet-state}:/clearnet-state
+    environment:
       - HOST_IP=${HOST_IP:-127.0.0.1}
       # Timezone for dashboard timestamps/charts. Set via `dashboard.timezone` in config.json
       # (`auto` = the host's timezone, auto-detected); pithead renders it to DASHBOARD_TZ in
@@ -358,15 +373,32 @@ services:
       - MONERO_CLEARNET_SYNC=${MONERO_CLEARNET_SYNC:-false}
       - TARI_CLEARNET_SYNC=${TARI_CLEARNET_SYNC:-false}
       - CLEARNET_STATE_DIR=/clearnet-state
+      # Egress-posture panel (#170): the #270 firewall state + p2pool's clearnet toggle, so the
+      # dashboard can show each component's real egress route rather than a guess.
+      - TOR_EGRESS_FIREWALL=${TOR_EGRESS_FIREWALL:-true}
+      - P2POOL_CLEARNET=${P2POOL_CLEARNET:-false}
       - P2POOL_URL=${P2POOL_URL}
       - MONERO_WALLET_ADDRESS=${MONERO_WALLET_ADDRESS}
       - XVB_ENABLED=${XVB_ENABLED}
       - XVB_POOL_URL=${XVB_POOL_URL}
       - XVB_DONOR_ID=${XVB_DONOR_ID}
+      # Route XvB donation mining over Tor by default (#166); xvb.tor:false opts out.
+      - XVB_TOR_ENABLED=${XVB_TOR_ENABLED:-true}
       - XVB_DONATION_LEVEL=${XVB_DONATION_LEVEL:-auto}
+      # XvB raffle auto-registration endpoint (#263). Defaults to the real endpoint (in the dashboard
+      # config) so registration just works. Override here to point at a different/test endpoint, or
+      # set a disable sentinel (off/none/false/disabled) to turn auto-registration off while keeping
+      # XvB on. The call carries the full wallet and is always Tor-routed like the stats fetch.
+      - XVB_SUBMIT_URL=${XVB_SUBMIT_URL:-}
       - PROXY_HOST=${NETWORK_PREFIX:-172.28.0}.29
       - PROXY_API_PORT=${PROXY_API_PORT}
       - PROXY_AUTH_TOKEN=${PROXY_AUTH_TOKEN}
+      # How the dashboard reads each worker's own xmrig /1/summary (config.json: workers.*). One
+      # configured way, no auto-detection. Defaults = stock RigForge worker (open read-only API,
+      # no token, port 8080). api_auth: none (default) | name (Bearer=worker name) | token.
+      - XMRIG_API_PORT=${XMRIG_API_PORT:-8080}
+      - XMRIG_API_AUTH=${XMRIG_API_AUTH:-none}
+      - XMRIG_API_TOKEN=${XMRIG_API_TOKEN}
       - DOCKER_PROXY_URL=tcp://${NETWORK_PREFIX:-172.28.0}.30:2375
       - DOCKER_CONTROL_URL=tcp://${NETWORK_PREFIX:-172.28.0}.31:2375
       - TARI_GRPC_ADDRESS=${NETWORK_PREFIX:-172.28.0}.27:18142
@@ -486,7 +518,7 @@ services:
 
 # --- Volumes ---
 volumes:
-  caddy_data: 
+  caddy_data:
 
 # --- Network Configuration ---
 networks:
@@ -495,4 +527,4 @@ networks:
     name: mining_net
     ipam:
       config:
-        - subnet: ${NETWORK_SUBNET:-172.28.0.0/24}
\ No newline at end of file
+        - subnet: ${NETWORK_SUBNET:-172.28.0.0/24}
diff --git a/docs/README.md b/docs/README.md
index a6713d98..854a2975 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,29 +1,29 @@
 # Documentation
 
-Everything you need to run, configure, and operate **Pithead**.
+Guides for running, configuring, and operating Pithead.
 
-New here? Start with the [Getting Started](getting-started.md) guide — it takes you from a
-fresh Ubuntu machine to a synced, mining stack in a handful of commands. The other guides go
-deeper on individual topics once you're up and running.
+New here? Start with the [Getting Started](getting-started.md) guide. It takes you from a fresh
+Ubuntu machine to a synced, mining stack in a handful of commands. The other guides go deeper on
+individual topics once you're running.
 
 ## Guides
 
 | Guide | What it covers |
 |---|---|
 | [Getting Started](getting-started.md) | Prerequisites, installation, first-run setup, and what to expect while the node syncs. |
-| [Hardware Requirements](hardware.md) | Minimum vs. recommended specs for the **stack host** — CPU, RAM, disk, network, OS — plus lighter-footprint options. (Miner hardware lives in [RigForge](https://github.com/p2pool-starter-stack/rigforge).) |
-| [Configuration](configuration.md) | Every `config.json` key and default, applying changes safely, **reusing an existing node via data directories**, and connecting to a **remote Monero node**. |
-| [The Dashboard](dashboard.md) | **Sync Mode**, the live operational view, and how to read every panel. |
+| [Hardware Requirements](hardware.md) | Minimum vs. recommended specs for the stack host (CPU, RAM, disk, network, OS), plus lighter-footprint options. (Miner hardware lives in [RigForge](https://github.com/p2pool-starter-stack/rigforge).) |
+| [Configuration](configuration.md) | Every `config.json` key and default, applying changes safely, reusing an existing node via data directories, and connecting to a remote Monero node. |
+| [The Dashboard](dashboard.md) | Sync Mode, the live operational view, and how to read every panel. |
 | [Connecting Miners](workers.md) | Pointing any existing rig at the stack, plus [RigForge](https://github.com/p2pool-starter-stack/rigforge) for setting up new miners. |
 | [Architecture](architecture.md) | The nine services, how they fit together, the privacy model, and the algorithmic XvB switching engine. |
-| [Privacy & Network Egress](privacy.md) | Every connection the stack makes off-box — what's Tor-routed, what's clearnet today, and how to harden each path. |
+| [Privacy & Network Egress](privacy.md) | Every connection the stack makes off-box: what's Tor-routed, what's clearnet today, and how to harden each path. |
 | [Operations & Maintenance](operations.md) | The full `pithead` command reference, upgrades, backups, and troubleshooting. |
 | [Testing Strategy](testing-strategy.md) | The four test tiers (unit → contract → fake-daemon mini-stack → live matrix), the full scenario catalog, and which tier proves each situation. |
 | [Testing Guide](testing-guide.md) | For developers: how to write and run tests, per-change recipes, conventions, and real-hardware gotchas. |
-| [Test Inventory](test-inventory.md) | Generated, exhaustive list of every test/scenario across all suites — the inventory of what's covered. |
-| [Integration Testing](integration-testing.md) | The end-to-end config-matrix suite that validates the stack against real Monero + Tari nodes — the blocking pre-release gate. |
-| [Releasing](releasing.md) | How Pithead is versioned and released — one product, one version, the `VERSION` source of truth, and the GHCR stage→promote pipeline. |
-| [Release / Validation Server](release-server.md) | Why end-to-end validation needs a dedicated server (and what GitHub Actions does free on every PR), how to provision and **harden** it, and the safe self-hosted-runner setup. |
+| [Test Inventory](test-inventory.md) | Generated, exhaustive list of every test/scenario across all suites: what's covered. |
+| [Integration Testing](integration-testing.md) | The end-to-end config-matrix suite that validates the stack against real Monero + Tari nodes: the blocking pre-release gate. |
+| [Releasing](releasing.md) | How Pithead is versioned and released: one product, one version, the `VERSION` source of truth, and the GHCR stage→promote pipeline. |
+| [Release / Validation Server](release-server.md) | Why end-to-end validation needs a dedicated server (and what GitHub Actions does free on every PR), how to provision and harden it, and the safe self-hosted-runner setup. |
 | [FAQ](faq.md) | Common questions, plus why Pithead vs. doing it yourself or Gupax. |
 
 ## Quick links
diff --git a/docs/architecture.md b/docs/architecture.md
index 342b27e1..4b811e32 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -1,8 +1,11 @@
 # Architecture
 
-The stack orchestrates nine containerized services via Docker Compose. Together they give you a
-private Monero full node, decentralized P2Pool mining, Tari merge mining, a single worker
-endpoint, and a monitoring dashboard — all behind Tor, with no public port forwarding required.
+This doc describes the nine containerized services the stack runs under Docker Compose and how they
+fit together.
+
+Together they give you a private Monero full node, decentralized P2Pool mining, Tari merge mining, a
+single worker endpoint, and a monitoring dashboard. Everything runs behind Tor, with no public port
+forwarding required.
 
 ## The services
 
@@ -78,52 +81,53 @@ flowchart TB
     style core stroke:#10b981,stroke-width:1px,stroke-dasharray:5 4;
 ```
 
-**Reading the diagram:** **thick arrows** carry mining hashrate and inbound connections, **dotted
-arrows** are the dashboard's control and monitoring, and **solid arrows** are internal service
-data and anonymized network traffic. Node colors group services by role — 🟦 control plane
-(Caddy, Dashboard), 🟪 privacy & isolation (Tor, Docker socket proxy), and 🟩 the mining core.
-In remote-node mode the bundled 🟠 Monero node isn't started, and P2Pool talks to your external
-node instead.
+Reading the diagram: thick arrows carry mining hashrate and inbound connections, dotted arrows are
+the dashboard's control and monitoring, and solid arrows are internal service data and anonymized
+network traffic. Node colors group services by role: 🟦 control plane (Caddy, Dashboard), 🟪 privacy
+and isolation (Tor, Docker socket proxy), and 🟩 the mining core. In remote-node mode the bundled 🟠
+Monero node isn't started, and P2Pool talks to your external node instead.
 
 ## Privacy by design
 
-Privacy is a primary design goal, not an afterthought — the stack is **Tor-first**. A dedicated Tor
-daemon provides hidden services (onion addresses) for Monero, Tari, and P2Pool, so **inbound**
-connectivity needs **no public IPv4 port forwarding**. Monero and Tari route their P2P and
-transaction traffic over Tor, and the clearnet DNS lookups those nodes used to leak are closed
-(monerod checkpoints/blocklist/update-check, Tari DNS seeds + Pulse). The node's RPC is bound to
-localhost by default (opt into LAN access explicitly via `monero.rpc_lan_access`).
+The stack is Tor-first. A dedicated Tor daemon provides hidden services (onion addresses) for
+Monero, Tari, and P2Pool, so inbound connectivity needs no public IPv4 port forwarding. Monero and
+Tari route their P2P and transaction traffic over Tor, and the clearnet DNS lookups those nodes used
+to leak are closed (monerod checkpoints/blocklist/update-check, Tari DNS seeds + Pulse). The node's
+RPC is bound to localhost by default; opt into LAN access explicitly via `monero.rpc_lan_access`.
 
-It is **Tor-first, not yet Tor-only.** Two *outbound* yield paths still use clearnet in v1.0 and so
-**can reveal your home IP** — P2Pool's outbound sidechain peers and XvB donation mining — both slated
-to move to Tor-by-default (with a documented opt-out) in v1.1, and both hardenable today. Install and
-image pulls also reveal your IP once. See **[Privacy & network egress](privacy.md)** for the complete
-connection-by-connection map and how to lock down the rest.
+Two outbound yield paths used clearnet in v1.0 and could reveal your home IP: P2Pool's outbound
+sidechain peers and XvB donation mining. As of v1.1 both are Tor by default, each with a documented
+opt-out for operators who'd trade privacy for yield (measured at ~10 % of yield on `mini`; see the
+[Tor-vs-clearnet benchmark](benchmarks/tor-vs-clearnet.md)). Install and image pulls still reveal
+your IP once. See [Privacy & network egress](privacy.md) for the complete connection-by-connection
+map and how to lock down the rest.
 
 ## Security posture
 
-- **Containerized & least-privilege.** Services run in containers; where privileges are needed
-  (e.g. P2Pool's memory locking) they're granted narrowly via specific Linux capabilities rather
-  than running fully privileged. The leaf services (Caddy, the dashboard, the two Docker socket
-  proxies, and `xmrig-proxy`) run with `no-new-privileges`, and all of them **except the
-  dashboard** also drop **every Linux capability** (`cap_drop: [ALL]`) — Caddy keeps only
-  `NET_BIND_SERVICE` so it can bind `:80`/`:443`. The dashboard is the exception because it runs
-  as root and writes its history database into a host-user-owned volume, which needs the default
-  file-permission capability. Caddy and both socket proxies additionally run with a **read-only
-  root filesystem**, writing only to a small ephemeral `tmpfs` and (for Caddy) the `caddy_data`
-  volume that holds its certs.
-- **Mining endpoint stays on the LAN.** The stratum port (`3333`) your rigs connect to is meant
-  for your local network, never the public internet. It's published on all interfaces by default
-  so LAN rigs work out of the box; narrow it with `p2pool.stratum_bind` (a specific LAN IP, or
+- **Containerized, non-root, least-privilege.** Services run in containers, and every one runs its
+  main process as a non-root user (not uid 0). pithead owns the data directories and chowns each
+  bind-mount to the uid its container uses, so a breakout or RCE in any daemon lands as an
+  unprivileged user. Where a privilege is genuinely needed (e.g. P2Pool's memory locking) it's
+  granted narrowly: P2Pool relies on an unlimited `memlock` ulimit rather than running privileged.
+  The leaf services (Caddy, the dashboard, the two Docker socket proxies, and `xmrig-proxy`) run
+  with `no-new-privileges`, and all of them drop every Linux capability (`cap_drop: [ALL]`). Caddy
+  keeps only `NET_BIND_SERVICE` so it can bind `:80`/`:443`. The dashboard writes its history
+  database as that non-root user into its (matching-owned) volume, so it no longer needs root's
+  file-permission capability and drops all caps like the others. Caddy and both socket proxies also
+  run with a read-only root filesystem, writing only to a small ephemeral `tmpfs` and (for Caddy)
+  the `caddy_data` volume that holds its certs.
+- **Mining endpoint stays on the LAN.** The stratum port (`3333`) your rigs connect to is meant for
+  your local network, never the public internet. It's published on all interfaces by default so LAN
+  rigs work without extra config; narrow it with `p2pool.stratum_bind` (a specific LAN IP, or
   `127.0.0.1`) and firewall it to your LAN. See [Connecting Miners › Firewall](workers.md#firewall).
 - **Verified binaries.** Third-party binaries are SHA256-verified during the image build.
 - **Pinned versions.** Service images and binaries are pinned to known-good versions.
 - **Hardened dashboard.** Security headers (a restrictive `Content-Security-Policy`,
-  `X-Frame-Options: DENY`, `nosniff`, `Referrer-Policy`) and a sanitized error handler; it reaches
-  Docker only through socket proxies, never the raw socket: a **read-only** one for stats/logs, and
-  a separate **control** proxy scoped to `start`/`stop` only (its ruleset denies create/kill/exec
-  and all reads). Splitting them means the write grant needed for node-down worker failover can't
-  widen the read-only proxy's access. General Docker write access stays off.
+  `X-Frame-Options: DENY`, `nosniff`, `Referrer-Policy`) and a sanitized error handler. It reaches
+  Docker only through socket proxies, never the raw socket: a read-only one for stats/logs, and a
+  separate control proxy scoped to `start`/`stop` only (its ruleset denies create/kill/exec and all
+  reads). Splitting them means the write grant needed for node-down worker failover can't widen the
+  read-only proxy's access. General Docker write access stays off.
 - **Locked-down config.** `config.json` is created `chmod 600` (owner-only), and the internal RPC
   proxy token is generated once and preserved across re-runs.
 
@@ -131,25 +135,24 @@ connection-by-connection map and how to lock down the rest.
 
 ## Algorithmic switching
 
-**Set it once and the stack plays the XvB raffle for you — no per-rig pool juggling, ever.** Rather
-than asking you to configure each rig for a different pool, it manages hashrate distribution
-**centrally**: all your workers connect to a single endpoint — the `xmrig-proxy` service on port
-`3333` — and the dashboard's decision engine continuously reallocates that hashrate between
-**P2Pool** (your own zero-fee Monero + Tari payouts) and **XMRvsBeast (XvB)** bonus rounds. It
-donates only the **minimum** needed to hold your target tier and hands every spare cycle back to
-P2Pool — maximizing yield with no manual tuning and no over-donating.
+The stack plays the XvB raffle for you, with no per-rig pool juggling. Rather than asking you to
+configure each rig for a different pool, it manages hashrate distribution centrally: all your
+workers connect to a single endpoint, the `xmrig-proxy` service on port `3333`, and the dashboard's
+decision engine continuously reallocates that hashrate between P2Pool (your own zero-fee Monero +
+Tari payouts) and XMRvsBeast (XvB) bonus rounds. It donates only the minimum needed to hold your
+target tier and hands every spare cycle back to P2Pool, so you don't over-donate.
 
 ### How the engine decides
 
 1. **Tier targeting.** The engine picks which XvB donation tier to aim for, set by
    `xvb.donation_level`:
-   - `auto` (default) — the highest tier your current hashrate can sustain.
-   - a specific tier — `donor`, `vip`, `whale`, or `mega`. A specific tier is honored **even if
-     your hashrate is too low to hold it**, in which case the dashboard shows a
-     **⚠ Hashrate low for tier** badge.
+   - `auto` (default): the highest tier your current hashrate can sustain.
+   - a specific tier: `donor`, `vip`, `whale`, or `mega`. A specific tier is honored even if your
+     hashrate is too low to hold it, in which case the dashboard shows a **⚠ Hashrate low for tier**
+     badge.
 
-   The four tiers and the donation hashrate each requires — which you must sustain on **both** your
-   1-hour **and** 24-hour donation averages (as measured by XMRvsBeast) — are set by the XvB raffle:
+   The four tiers and the donation hashrate each requires, which you must sustain on both your
+   1-hour and 24-hour donation averages (as measured by XMRvsBeast), are set by the XvB raffle:
 
    | Tier | Donation hashrate to hold it |
    |---|---|
@@ -158,30 +161,30 @@ P2Pool — maximizing yield with no manual tuning and no over-donating.
    | `whale` | **100 kH/s** (100,000 H/s) |
    | `mega` | **1 MH/s** (1,000,000 H/s) |
 
-   > **Heads-up on the name "VIP".** The `vip` *tier* above is a **donation level** (10 kH/s) — don't
+   > NOTE: the name "VIP" is overloaded. The `vip` tier above is a donation level (10 kH/s). Don't
    > confuse it with the dashboard's **Raffle Eligible** box. That box turns green only when you're set
-   > up to actually win *and* collect a payout: donating at least the **donor** tier (on credited 1h+24h,
-   > the same threshold tracked by **Current Tier**) **and** holding a P2Pool PPLNS share. XvB's bare
-   > rule calls just-having-a-share a "VIP"; the dashboard is stricter, so a green "Yes" means a win is
-   > actually paid — see the [Dashboard](dashboard.md) guide.
+   > up to actually win and collect a payout: donating at least the `donor` tier (on credited 1h+24h,
+   > the same threshold tracked by **Current Tier**) and holding a P2Pool PPLNS share. XvB's bare rule
+   > calls just-having-a-share a "VIP"; the dashboard is stricter, so a green "Yes" means a win is
+   > actually paid. See the [Dashboard](dashboard.md) guide.
 
-   Because the XvB raffle picks winners at random, donating *above* a tier's threshold earns
-   nothing extra — so the engine donates only enough to hold the target tier and routes the rest
-   to P2Pool.
+   Because the XvB raffle picks winners at random, donating above a tier's threshold earns nothing
+   extra. The engine donates only enough to hold the target tier and routes the rest to P2Pool.
 
-2. **Dynamic proxy reconfiguration.** A feedback controller watches your measured **1h / 24h
-   donation averages** and reconfigures the `xmrig-proxy` to send just enough time to XvB to stay
-   in tier — ramping donation up when you fall behind and easing off as you catch up — with the
-   remainder going to P2Pool. This happens seamlessly, with **no changes on your workers**.
+2. **Dynamic proxy reconfiguration.** A feedback controller watches your measured 1h / 24h donation
+   averages and reconfigures the `xmrig-proxy` to send just enough time to XvB to stay in tier:
+   ramping donation up when you fall behind and easing off as you catch up, with the remainder going
+   to P2Pool. The controller edits the proxy config only; your workers keep their existing connection
+   to `3333` and need no changes.
 
-The result: you stay in your chosen XvB tier with minimal donation, and every spare cycle mines
-Monero + Tari on P2Pool. The dashboard's hashrate chart shades the P2Pool/XvB split over time so
-you can watch the controller work.
+You stay in your chosen XvB tier with minimal donation, and every spare cycle mines Monero + Tari on
+P2Pool. The dashboard's hashrate chart shades the P2Pool/XvB split over time so you can watch the
+controller work.
 
 ---
 
 ## See also
 
-- [The Dashboard](dashboard.md) — Sync Mode and the live operational view.
-- [Configuration](configuration.md) — the `xvb.*` settings, data directories, and remote nodes.
-- [Connecting Miners](workers.md) — connecting hardware to the single `3333` endpoint.
+- [The Dashboard](dashboard.md): Sync Mode and the live operational view.
+- [Configuration](configuration.md): the `xvb.*` settings, data directories, and remote nodes.
+- [Connecting Miners](workers.md): connecting hardware to the single `3333` endpoint.
diff --git a/docs/benchmarks/data/run-2026-06-17-mini/clearnet.jsonl b/docs/benchmarks/data/run-2026-06-17-mini/clearnet.jsonl
new file mode 100644
index 00000000..2765ec16
--- /dev/null
+++ b/docs/benchmarks/data/run-2026-06-17-mini/clearnet.jsonl
@@ -0,0 +1,722 @@
+{"ts":1781811214,"arm":"clearnet","reward_share":1.582,"avg_effort":108.765,"cur_effort":160.544,"hashrate_1h":272323,"hashrate_24h":269908,"shares_found":107,"shares_failed":0,"last_share":1781810110,"peers_out":10,"peers_in":0,"peer_list":469,"pool_hr":10000,"sidechain_diff":100000,"tor_cpu_pct":24.32,"tor_mem":"79.06MiB"}
+{"ts":1781811515,"arm":"clearnet","reward_share":1.539,"avg_effort":13.481,"cur_effort":23.529,"hashrate_1h":227687,"hashrate_24h":227687,"shares_found":1,"shares_failed":0,"last_share":1781811318,"peers_out":10,"peers_in":0,"peer_list":582,"pool_hr":17396146,"sidechain_diff":173961468,"tor_cpu_pct":21.68,"tor_mem":"78.93MiB"}
+{"ts":1781811816,"arm":"clearnet","reward_share":1.537,"avg_effort":13.481,"cur_effort":77.051,"hashrate_1h":271158,"hashrate_24h":271158,"shares_found":1,"shares_failed":0,"last_share":1781811318,"peers_out":10,"peers_in":0,"peer_list":623,"pool_hr":17378523,"sidechain_diff":173785237,"tor_cpu_pct":6.2,"tor_mem":"78.9MiB"}
+{"ts":1781812117,"arm":"clearnet","reward_share":1.535,"avg_effort":13.481,"cur_effort":131.665,"hashrate_1h":280823,"hashrate_24h":280823,"shares_found":1,"shares_failed":0,"last_share":1781811318,"peers_out":10,"peers_in":0,"peer_list":639,"pool_hr":17260065,"sidechain_diff":172600659,"tor_cpu_pct":18.09,"tor_mem":"79.38MiB"}
+{"ts":1781812419,"arm":"clearnet","reward_share":1.489,"avg_effort":13.481,"cur_effort":180.137,"hashrate_1h":283238,"hashrate_24h":283238,"shares_found":1,"shares_failed":0,"last_share":1781811318,"peers_out":10,"peers_in":0,"peer_list":650,"pool_hr":17437276,"sidechain_diff":174372768,"tor_cpu_pct":30.11,"tor_mem":"79.3MiB"}
+{"ts":1781812720,"arm":"clearnet","reward_share":1.536,"avg_effort":99.827,"cur_effort":41.874,"hashrate_1h":289137,"hashrate_24h":289137,"shares_found":2,"shares_failed":0,"last_share":1781812464,"peers_out":10,"peers_in":0,"peer_list":658,"pool_hr":17651991,"sidechain_diff":176519919,"tor_cpu_pct":44.45,"tor_mem":"79.42MiB"}
+{"ts":1781813021,"arm":"clearnet","reward_share":1.533,"avg_effort":99.827,"cur_effort":85.517,"hashrate_1h":283900,"hashrate_24h":283900,"shares_found":2,"shares_failed":0,"last_share":1781812464,"peers_out":10,"peers_in":0,"peer_list":664,"pool_hr":17498421,"sidechain_diff":174984212,"tor_cpu_pct":21.48,"tor_mem":"79.46MiB"}
+{"ts":1781813322,"arm":"clearnet","reward_share":1.533,"avg_effort":99.827,"cur_effort":134.097,"hashrate_1h":280823,"hashrate_24h":280823,"shares_found":2,"shares_failed":0,"last_share":1781812464,"peers_out":10,"peers_in":0,"peer_list":666,"pool_hr":17489571,"sidechain_diff":174895717,"tor_cpu_pct":24.37,"tor_mem":"85.06MiB"}
+{"ts":1781813624,"arm":"clearnet","reward_share":1.580,"avg_effort":116.040,"cur_effort":28.266,"hashrate_1h":278377,"hashrate_24h":278377,"shares_found":3,"shares_failed":0,"last_share":1781813438,"peers_out":10,"peers_in":0,"peer_list":667,"pool_hr":17432107,"sidechain_diff":174321071,"tor_cpu_pct":26.82,"tor_mem":"83.78MiB"}
+{"ts":1781813925,"arm":"clearnet","reward_share":1.578,"avg_effort":116.040,"cur_effort":71.405,"hashrate_1h":275217,"hashrate_24h":275217,"shares_found":3,"shares_failed":0,"last_share":1781813438,"peers_out":10,"peers_in":0,"peer_list":670,"pool_hr":17405278,"sidechain_diff":174052784,"tor_cpu_pct":29.52,"tor_mem":"80.99MiB"}
+{"ts":1781814226,"arm":"clearnet","reward_share":1.582,"avg_effort":87.219,"cur_effort":27.762,"hashrate_1h":271607,"hashrate_24h":271607,"shares_found":5,"shares_failed":0,"last_share":1781814054,"peers_out":10,"peers_in":0,"peer_list":671,"pool_hr":17476150,"sidechain_diff":174761508,"tor_cpu_pct":30.64,"tor_mem":"80.83MiB"}
+{"ts":1781814527,"arm":"clearnet","reward_share":1.624,"avg_effort":84.552,"cur_effort":11.128,"hashrate_1h":275885,"hashrate_24h":275885,"shares_found":6,"shares_failed":0,"last_share":1781814471,"peers_out":10,"peers_in":0,"peer_list":673,"pool_hr":17509356,"sidechain_diff":175093565,"tor_cpu_pct":29.08,"tor_mem":"81.21MiB"}
+{"ts":1781814829,"arm":"clearnet","reward_share":1.584,"avg_effort":74.301,"cur_effort":51.930,"hashrate_1h":278576,"hashrate_24h":278568,"shares_found":7,"shares_failed":0,"last_share":1781814538,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":17398273,"sidechain_diff":173982735,"tor_cpu_pct":34.41,"tor_mem":"81.02MiB"}
+{"ts":1781815130,"arm":"clearnet","reward_share":1.549,"avg_effort":74.301,"cur_effort":103.789,"hashrate_1h":285694,"hashrate_24h":280990,"shares_found":7,"shares_failed":0,"last_share":1781814538,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17492298,"sidechain_diff":174922987,"tor_cpu_pct":24.09,"tor_mem":"81.02MiB"}
+{"ts":1781815431,"arm":"clearnet","reward_share":1.547,"avg_effort":74.301,"cur_effort":140.870,"hashrate_1h":276376,"hashrate_24h":276507,"shares_found":7,"shares_failed":0,"last_share":1781814538,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17502131,"sidechain_diff":175021318,"tor_cpu_pct":24.34,"tor_mem":"81.07MiB"}
+{"ts":1781815732,"arm":"clearnet","reward_share":1.549,"avg_effort":86.967,"cur_effort":17.769,"hashrate_1h":277374,"hashrate_24h":278447,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17473150,"sidechain_diff":174731504,"tor_cpu_pct":23.6,"tor_mem":"80.84MiB"}
+{"ts":1781816034,"arm":"clearnet","reward_share":1.506,"avg_effort":86.967,"cur_effort":72.355,"hashrate_1h":279296,"hashrate_24h":280392,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17401066,"sidechain_diff":174010661,"tor_cpu_pct":27.01,"tor_mem":"80.2MiB"}
+{"ts":1781816335,"arm":"clearnet","reward_share":1.461,"avg_effort":86.967,"cur_effort":115.916,"hashrate_1h":275434,"hashrate_24h":279104,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":17410744,"sidechain_diff":174107447,"tor_cpu_pct":23.44,"tor_mem":"80.04MiB"}
+{"ts":1781816636,"arm":"clearnet","reward_share":1.460,"avg_effort":86.967,"cur_effort":157.078,"hashrate_1h":274835,"hashrate_24h":277297,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":420,"pool_hr":17623221,"sidechain_diff":176232210,"tor_cpu_pct":17.83,"tor_mem":"80.11MiB"}
+{"ts":1781816937,"arm":"clearnet","reward_share":1.415,"avg_effort":86.967,"cur_effort":198.913,"hashrate_1h":272885,"hashrate_24h":275983,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":421,"pool_hr":17832998,"sidechain_diff":178329986,"tor_cpu_pct":42.77,"tor_mem":"80.32MiB"}
+{"ts":1781817239,"arm":"clearnet","reward_share":1.413,"avg_effort":86.967,"cur_effort":246.856,"hashrate_1h":274239,"hashrate_24h":275524,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":17415107,"sidechain_diff":174151075,"tor_cpu_pct":28.94,"tor_mem":"80.07MiB"}
+{"ts":1781817540,"arm":"clearnet","reward_share":1.380,"avg_effort":86.967,"cur_effort":282.557,"hashrate_1h":270052,"hashrate_24h":271731,"shares_found":8,"shares_failed":0,"last_share":1781815585,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17509251,"sidechain_diff":175092516,"tor_cpu_pct":22.24,"tor_mem":"80.11MiB"}
+{"ts":1781817841,"arm":"clearnet","reward_share":1.426,"avg_effort":111.903,"cur_effort":10.246,"hashrate_1h":268927,"hashrate_24h":270304,"shares_found":9,"shares_failed":0,"last_share":1781817752,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17388938,"sidechain_diff":173889384,"tor_cpu_pct":20.57,"tor_mem":"80.2MiB"}
+{"ts":1781818142,"arm":"clearnet","reward_share":1.470,"avg_effort":105.627,"cur_effort":0.000,"hashrate_1h":261196,"hashrate_24h":268035,"shares_found":10,"shares_failed":0,"last_share":1781818126,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17441935,"sidechain_diff":174419357,"tor_cpu_pct":30.28,"tor_mem":"80.61MiB"}
+{"ts":1781818444,"arm":"clearnet","reward_share":1.432,"avg_effort":105.627,"cur_effort":43.016,"hashrate_1h":256188,"hashrate_24h":267391,"shares_found":10,"shares_failed":0,"last_share":1781818126,"peers_out":10,"peers_in":0,"peer_list":420,"pool_hr":17448001,"sidechain_diff":174480019,"tor_cpu_pct":25.56,"tor_mem":"80.83MiB"}
+{"ts":1781818745,"arm":"clearnet","reward_share":1.433,"avg_effort":103.019,"cur_effort":22.903,"hashrate_1h":257744,"hashrate_24h":269964,"shares_found":11,"shares_failed":0,"last_share":1781818613,"peers_out":10,"peers_in":0,"peer_list":421,"pool_hr":17377900,"sidechain_diff":173779001,"tor_cpu_pct":22.13,"tor_mem":"80.67MiB"}
+{"ts":1781819046,"arm":"clearnet","reward_share":1.477,"avg_effort":97.185,"cur_effort":43.889,"hashrate_1h":262791,"hashrate_24h":270789,"shares_found":12,"shares_failed":0,"last_share":1781818780,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17325163,"sidechain_diff":173251633,"tor_cpu_pct":21.6,"tor_mem":"80.72MiB"}
+{"ts":1781819347,"arm":"clearnet","reward_share":1.476,"avg_effort":97.185,"cur_effort":99.261,"hashrate_1h":262925,"hashrate_24h":272345,"shares_found":12,"shares_failed":0,"last_share":1781818780,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":17331044,"sidechain_diff":173310445,"tor_cpu_pct":19.15,"tor_mem":"80.84MiB"}
+{"ts":1781819649,"arm":"clearnet","reward_share":1.478,"avg_effort":98.033,"cur_effort":39.415,"hashrate_1h":263821,"hashrate_24h":273199,"shares_found":13,"shares_failed":0,"last_share":1781819389,"peers_out":10,"peers_in":0,"peer_list":426,"pool_hr":17227261,"sidechain_diff":172272614,"tor_cpu_pct":21.37,"tor_mem":"80.62MiB"}
+{"ts":1781819950,"arm":"clearnet","reward_share":1.521,"avg_effort":96.285,"cur_effort":18.536,"hashrate_1h":266816,"hashrate_24h":273910,"shares_found":14,"shares_failed":0,"last_share":1781819826,"peers_out":10,"peers_in":0,"peer_list":426,"pool_hr":17269671,"sidechain_diff":172696713,"tor_cpu_pct":27.02,"tor_mem":"80.75MiB"}
+{"ts":1781820251,"arm":"clearnet","reward_share":1.520,"avg_effort":96.285,"cur_effort":73.941,"hashrate_1h":272994,"hashrate_24h":275186,"shares_found":14,"shares_failed":0,"last_share":1781819826,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":17253685,"sidechain_diff":172536855,"tor_cpu_pct":27.65,"tor_mem":"80.67MiB"}
+{"ts":1781820552,"arm":"clearnet","reward_share":1.522,"avg_effort":96.356,"cur_effort":24.963,"hashrate_1h":272802,"hashrate_24h":275118,"shares_found":15,"shares_failed":0,"last_share":1781820379,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17182011,"sidechain_diff":171820118,"tor_cpu_pct":22.38,"tor_mem":"80.64MiB"}
+{"ts":1781820854,"arm":"clearnet","reward_share":1.522,"avg_effort":96.356,"cur_effort":63.434,"hashrate_1h":271925,"hashrate_24h":273402,"shares_found":15,"shares_failed":0,"last_share":1781820379,"peers_out":10,"peers_in":0,"peer_list":426,"pool_hr":17254918,"sidechain_diff":172549182,"tor_cpu_pct":20.38,"tor_mem":"80.57MiB"}
+{"ts":1781821155,"arm":"clearnet","reward_share":1.568,"avg_effort":97.272,"cur_effort":2.122,"hashrate_1h":277643,"hashrate_24h":273705,"shares_found":16,"shares_failed":0,"last_share":1781821128,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":17283441,"sidechain_diff":172834417,"tor_cpu_pct":20.87,"tor_mem":"80.58MiB"}
+{"ts":1781821456,"arm":"clearnet","reward_share":1.660,"avg_effort":84.363,"cur_effort":10.187,"hashrate_1h":283767,"hashrate_24h":274889,"shares_found":19,"shares_failed":0,"last_share":1781821387,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":17349432,"sidechain_diff":173494328,"tor_cpu_pct":25.51,"tor_mem":"80.59MiB"}
+{"ts":1781821757,"arm":"clearnet","reward_share":1.614,"avg_effort":84.363,"cur_effort":53.868,"hashrate_1h":286032,"hashrate_24h":274027,"shares_found":19,"shares_failed":0,"last_share":1781821387,"peers_out":10,"peers_in":0,"peer_list":423,"pool_hr":17314740,"sidechain_diff":173147400,"tor_cpu_pct":33.38,"tor_mem":"81.07MiB"}
+{"ts":1781822059,"arm":"clearnet","reward_share":1.572,"avg_effort":83.554,"cur_effort":39.035,"hashrate_1h":289226,"hashrate_24h":274755,"shares_found":20,"shares_failed":0,"last_share":1781821845,"peers_out":10,"peers_in":0,"peer_list":431,"pool_hr":17399807,"sidechain_diff":173998071,"tor_cpu_pct":31.3,"tor_mem":"81.68MiB"}
+{"ts":1781822360,"arm":"clearnet","reward_share":1.661,"avg_effort":79.803,"cur_effort":1.325,"hashrate_1h":284808,"hashrate_24h":274792,"shares_found":22,"shares_failed":0,"last_share":1781822340,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":17243572,"sidechain_diff":172435726,"tor_cpu_pct":20.44,"tor_mem":"81.67MiB"}
+{"ts":1781822661,"arm":"clearnet","reward_share":1.661,"avg_effort":79.803,"cur_effort":42.050,"hashrate_1h":279620,"hashrate_24h":273509,"shares_found":22,"shares_failed":0,"last_share":1781822340,"peers_out":10,"peers_in":0,"peer_list":450,"pool_hr":17256010,"sidechain_diff":172560107,"tor_cpu_pct":20.06,"tor_mem":"80.83MiB"}
+{"ts":1781822962,"arm":"clearnet","reward_share":1.703,"avg_effort":79.403,"cur_effort":13.637,"hashrate_1h":274087,"hashrate_24h":272963,"shares_found":23,"shares_failed":0,"last_share":1781822850,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":17271870,"sidechain_diff":172718703,"tor_cpu_pct":23.33,"tor_mem":"85.03MiB"}
+{"ts":1781823264,"arm":"clearnet","reward_share":1.703,"avg_effort":77.811,"cur_effort":16.205,"hashrate_1h":269263,"hashrate_24h":272326,"shares_found":24,"shares_failed":0,"last_share":1781823144,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":17364363,"sidechain_diff":173643633,"tor_cpu_pct":34.06,"tor_mem":"141.5MiB"}
+{"ts":1781823565,"arm":"clearnet","reward_share":1.701,"avg_effort":77.811,"cur_effort":64.031,"hashrate_1h":268586,"hashrate_24h":272410,"shares_found":24,"shares_failed":0,"last_share":1781823144,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":17310217,"sidechain_diff":173102177,"tor_cpu_pct":36.29,"tor_mem":"135.5MiB"}
+{"ts":1781823866,"arm":"clearnet","reward_share":1.745,"avg_effort":78.765,"cur_effort":2.885,"hashrate_1h":263656,"hashrate_24h":271649,"shares_found":25,"shares_failed":0,"last_share":1781823824,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":17453102,"sidechain_diff":174531023,"tor_cpu_pct":32.39,"tor_mem":"83.09MiB"}
+{"ts":1781824167,"arm":"clearnet","reward_share":1.744,"avg_effort":78.765,"cur_effort":63.668,"hashrate_1h":269628,"hashrate_24h":273450,"shares_found":25,"shares_failed":0,"last_share":1781823824,"peers_out":10,"peers_in":0,"peer_list":461,"pool_hr":17368711,"sidechain_diff":173687111,"tor_cpu_pct":14.22,"tor_mem":"82.16MiB"}
+{"ts":1781824469,"arm":"clearnet","reward_share":1.701,"avg_effort":78.765,"cur_effort":114.309,"hashrate_1h":274489,"hashrate_24h":273761,"shares_found":25,"shares_failed":0,"last_share":1781823824,"peers_out":10,"peers_in":0,"peer_list":460,"pool_hr":17429002,"sidechain_diff":174290021,"tor_cpu_pct":20.06,"tor_mem":"82.54MiB"}
+{"ts":1781824770,"arm":"clearnet","reward_share":1.745,"avg_effort":80.657,"cur_effort":32.948,"hashrate_1h":273550,"hashrate_24h":273867,"shares_found":26,"shares_failed":0,"last_share":1781824561,"peers_out":10,"peers_in":0,"peer_list":463,"pool_hr":17351187,"sidechain_diff":173511872,"tor_cpu_pct":25.91,"tor_mem":"81.98MiB"}
+{"ts":1781825071,"arm":"clearnet","reward_share":1.742,"avg_effort":80.657,"cur_effort":70.957,"hashrate_1h":265763,"hashrate_24h":272295,"shares_found":26,"shares_failed":0,"last_share":1781824561,"peers_out":10,"peers_in":0,"peer_list":460,"pool_hr":17317643,"sidechain_diff":173176436,"tor_cpu_pct":15.95,"tor_mem":"82.4MiB"}
+{"ts":1781825372,"arm":"clearnet","reward_share":1.742,"avg_effort":80.985,"cur_effort":22.381,"hashrate_1h":265659,"hashrate_24h":271888,"shares_found":27,"shares_failed":0,"last_share":1781825186,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":17596768,"sidechain_diff":175967683,"tor_cpu_pct":16.16,"tor_mem":"82.02MiB"}
+{"ts":1781825674,"arm":"clearnet","reward_share":1.784,"avg_effort":78.949,"cur_effort":47.086,"hashrate_1h":263888,"hashrate_24h":272074,"shares_found":28,"shares_failed":0,"last_share":1781825377,"peers_out":10,"peers_in":0,"peer_list":456,"pool_hr":17421288,"sidechain_diff":174212887,"tor_cpu_pct":8.57,"tor_mem":"81.73MiB"}
+{"ts":1781825975,"arm":"clearnet","reward_share":1.786,"avg_effort":78.949,"cur_effort":97.313,"hashrate_1h":266932,"hashrate_24h":272652,"shares_found":28,"shares_failed":0,"last_share":1781825377,"peers_out":10,"peers_in":0,"peer_list":459,"pool_hr":17497831,"sidechain_diff":174978314,"tor_cpu_pct":17.1,"tor_mem":"81.42MiB"}
+{"ts":1781826276,"arm":"clearnet","reward_share":1.741,"avg_effort":78.949,"cur_effort":137.128,"hashrate_1h":266635,"hashrate_24h":271661,"shares_found":28,"shares_failed":0,"last_share":1781825377,"peers_out":10,"peers_in":0,"peer_list":462,"pool_hr":17512028,"sidechain_diff":175120286,"tor_cpu_pct":17.57,"tor_mem":"81.35MiB"}
+{"ts":1781826577,"arm":"clearnet","reward_share":1.695,"avg_effort":78.949,"cur_effort":176.842,"hashrate_1h":266053,"hashrate_24h":271446,"shares_found":28,"shares_failed":0,"last_share":1781825377,"peers_out":10,"peers_in":0,"peer_list":464,"pool_hr":18021565,"sidechain_diff":180215659,"tor_cpu_pct":23.26,"tor_mem":"81.48MiB"}
+{"ts":1781826879,"arm":"clearnet","reward_share":1.741,"avg_effort":83.201,"cur_effort":25.951,"hashrate_1h":269877,"hashrate_24h":271669,"shares_found":29,"shares_failed":0,"last_share":1781826684,"peers_out":10,"peers_in":0,"peer_list":466,"pool_hr":17561530,"sidechain_diff":175615307,"tor_cpu_pct":17.82,"tor_mem":"81.29MiB"}
+{"ts":1781827180,"arm":"clearnet","reward_share":1.740,"avg_effort":83.201,"cur_effort":65.925,"hashrate_1h":265846,"hashrate_24h":270815,"shares_found":29,"shares_failed":0,"last_share":1781826684,"peers_out":10,"peers_in":0,"peer_list":469,"pool_hr":17598724,"sidechain_diff":175987245,"tor_cpu_pct":17.69,"tor_mem":"81.37MiB"}
+{"ts":1781827481,"arm":"clearnet","reward_share":1.740,"avg_effort":83.201,"cur_effort":123.727,"hashrate_1h":273664,"hashrate_24h":272199,"shares_found":29,"shares_failed":0,"last_share":1781826684,"peers_out":10,"peers_in":0,"peer_list":470,"pool_hr":17596674,"sidechain_diff":175966744,"tor_cpu_pct":23.03,"tor_mem":"81.41MiB"}
+{"ts":1781827782,"arm":"clearnet","reward_share":1.741,"avg_effort":84.844,"cur_effort":41.606,"hashrate_1h":269067,"hashrate_24h":272508,"shares_found":30,"shares_failed":0,"last_share":1781827501,"peers_out":10,"peers_in":0,"peer_list":471,"pool_hr":17620394,"sidechain_diff":176203943,"tor_cpu_pct":22.89,"tor_mem":"81.54MiB"}
+{"ts":1781828084,"arm":"clearnet","reward_share":1.740,"avg_effort":84.844,"cur_effort":92.479,"hashrate_1h":270065,"hashrate_24h":272882,"shares_found":30,"shares_failed":0,"last_share":1781827501,"peers_out":10,"peers_in":0,"peer_list":471,"pool_hr":17626136,"sidechain_diff":176261365,"tor_cpu_pct":12.98,"tor_mem":"81.47MiB"}
+{"ts":1781828385,"arm":"clearnet","reward_share":1.740,"avg_effort":84.844,"cur_effort":132.427,"hashrate_1h":266304,"hashrate_24h":272188,"shares_found":30,"shares_failed":0,"last_share":1781827501,"peers_out":10,"peers_in":0,"peer_list":472,"pool_hr":17653783,"sidechain_diff":176537830,"tor_cpu_pct":20.37,"tor_mem":"81.17MiB"}
+{"ts":1781828686,"arm":"clearnet","reward_share":1.740,"avg_effort":84.844,"cur_effort":174.092,"hashrate_1h":268348,"hashrate_24h":271499,"shares_found":30,"shares_failed":0,"last_share":1781827501,"peers_out":10,"peers_in":0,"peer_list":475,"pool_hr":17511506,"sidechain_diff":175115069,"tor_cpu_pct":19.69,"tor_mem":"81.68MiB"}
+{"ts":1781828987,"arm":"clearnet","reward_share":1.785,"avg_effort":87.870,"cur_effort":41.512,"hashrate_1h":270295,"hashrate_24h":271506,"shares_found":31,"shares_failed":0,"last_share":1781828707,"peers_out":10,"peers_in":0,"peer_list":474,"pool_hr":17608577,"sidechain_diff":176085775,"tor_cpu_pct":19.37,"tor_mem":"81.07MiB"}
+{"ts":1781829289,"arm":"clearnet","reward_share":1.739,"avg_effort":87.870,"cur_effort":91.008,"hashrate_1h":269097,"hashrate_24h":271815,"shares_found":31,"shares_failed":0,"last_share":1781828707,"peers_out":10,"peers_in":0,"peer_list":474,"pool_hr":17689377,"sidechain_diff":176893779,"tor_cpu_pct":21.31,"tor_mem":"81.46MiB"}
+{"ts":1781829590,"arm":"clearnet","reward_share":1.704,"avg_effort":87.870,"cur_effort":119.107,"hashrate_1h":260897,"hashrate_24h":270237,"shares_found":31,"shares_failed":0,"last_share":1781828707,"peers_out":10,"peers_in":0,"peer_list":472,"pool_hr":17743998,"sidechain_diff":177439983,"tor_cpu_pct":4.51,"tor_mem":"81.41MiB"}
+{"ts":1781829891,"arm":"clearnet","reward_share":1.660,"avg_effort":89.778,"cur_effort":13.736,"hashrate_1h":261171,"hashrate_24h":269781,"shares_found":32,"shares_failed":0,"last_share":1781829785,"peers_out":10,"peers_in":0,"peer_list":464,"pool_hr":17690953,"sidechain_diff":176909534,"tor_cpu_pct":35.62,"tor_mem":"80.93MiB"}
+{"ts":1781830192,"arm":"clearnet","reward_share":1.659,"avg_effort":89.778,"cur_effort":53.436,"hashrate_1h":261048,"hashrate_24h":269451,"shares_found":32,"shares_failed":0,"last_share":1781829785,"peers_out":10,"peers_in":0,"peer_list":463,"pool_hr":17640229,"sidechain_diff":176402299,"tor_cpu_pct":23.76,"tor_mem":"80.92MiB"}
+{"ts":1781830494,"arm":"clearnet","reward_share":1.704,"avg_effort":87.734,"cur_effort":3.852,"hashrate_1h":264576,"hashrate_24h":270532,"shares_found":34,"shares_failed":0,"last_share":1781830471,"peers_out":10,"peers_in":0,"peer_list":462,"pool_hr":17483611,"sidechain_diff":174836115,"tor_cpu_pct":22.29,"tor_mem":"81.2MiB"}
+{"ts":1781830795,"arm":"clearnet","reward_share":1.796,"avg_effort":84.059,"cur_effort":12.201,"hashrate_1h":271550,"hashrate_24h":270979,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":17469582,"sidechain_diff":174695829,"tor_cpu_pct":24.95,"tor_mem":"81.4MiB"}
+{"ts":1781831096,"arm":"clearnet","reward_share":1.795,"avg_effort":84.059,"cur_effort":52.267,"hashrate_1h":261368,"hashrate_24h":270388,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17539860,"sidechain_diff":175398609,"tor_cpu_pct":16.56,"tor_mem":"81.37MiB"}
+{"ts":1781831397,"arm":"clearnet","reward_share":1.794,"avg_effort":84.059,"cur_effort":96.465,"hashrate_1h":259695,"hashrate_24h":270452,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17535734,"sidechain_diff":175357344,"tor_cpu_pct":18.81,"tor_mem":"81.12MiB"}
+{"ts":1781831699,"arm":"clearnet","reward_share":1.714,"avg_effort":84.059,"cur_effort":143.105,"hashrate_1h":258024,"hashrate_24h":270283,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":17497768,"sidechain_diff":174977684,"tor_cpu_pct":17.25,"tor_mem":"81.2MiB"}
+{"ts":1781832000,"arm":"clearnet","reward_share":1.669,"avg_effort":84.059,"cur_effort":189.139,"hashrate_1h":260687,"hashrate_24h":270091,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17427153,"sidechain_diff":174271538,"tor_cpu_pct":28.62,"tor_mem":"81.46MiB"}
+{"ts":1781832301,"arm":"clearnet","reward_share":1.623,"avg_effort":84.059,"cur_effort":233.075,"hashrate_1h":263021,"hashrate_24h":270126,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17529385,"sidechain_diff":175293857,"tor_cpu_pct":20.98,"tor_mem":"81.53MiB"}
+{"ts":1781832602,"arm":"clearnet","reward_share":1.623,"avg_effort":84.059,"cur_effort":282.716,"hashrate_1h":265559,"hashrate_24h":270579,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":17683298,"sidechain_diff":176832989,"tor_cpu_pct":18.12,"tor_mem":"81.54MiB"}
+{"ts":1781832904,"arm":"clearnet","reward_share":1.622,"avg_effort":84.059,"cur_effort":332.901,"hashrate_1h":266593,"hashrate_24h":270919,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":17681669,"sidechain_diff":176816696,"tor_cpu_pct":19.13,"tor_mem":"81.34MiB"}
+{"ts":1781833205,"arm":"clearnet","reward_share":1.622,"avg_effort":84.059,"cur_effort":381.076,"hashrate_1h":273427,"hashrate_24h":270916,"shares_found":36,"shares_failed":0,"last_share":1781830726,"peers_out":10,"peers_in":0,"peer_list":452,"pool_hr":17652900,"sidechain_diff":176529000,"tor_cpu_pct":18.69,"tor_mem":"81.41MiB"}
+{"ts":1781833506,"arm":"clearnet","reward_share":1.622,"avg_effort":92.817,"cur_effort":12.172,"hashrate_1h":272643,"hashrate_24h":270244,"shares_found":37,"shares_failed":0,"last_share":1781833405,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17667320,"sidechain_diff":176673202,"tor_cpu_pct":17.57,"tor_mem":"81.26MiB"}
+{"ts":1781833807,"arm":"clearnet","reward_share":1.623,"avg_effort":92.817,"cur_effort":58.185,"hashrate_1h":273395,"hashrate_24h":270163,"shares_found":37,"shares_failed":0,"last_share":1781833405,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17964445,"sidechain_diff":179644451,"tor_cpu_pct":1.71,"tor_mem":"81.34MiB"}
+{"ts":1781834109,"arm":"clearnet","reward_share":1.621,"avg_effort":92.817,"cur_effort":98.107,"hashrate_1h":266059,"hashrate_24h":269829,"shares_found":37,"shares_failed":0,"last_share":1781833405,"peers_out":10,"peers_in":0,"peer_list":454,"pool_hr":17749940,"sidechain_diff":177499401,"tor_cpu_pct":20.33,"tor_mem":"81.31MiB"}
+{"ts":1781834410,"arm":"clearnet","reward_share":1.713,"avg_effort":91.519,"cur_effort":12.111,"hashrate_1h":265199,"hashrate_24h":270059,"shares_found":39,"shares_failed":0,"last_share":1781834310,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17930056,"sidechain_diff":179300561,"tor_cpu_pct":16.91,"tor_mem":"81.3MiB"}
+{"ts":1781834711,"arm":"clearnet","reward_share":1.714,"avg_effort":89.741,"cur_effort":42.598,"hashrate_1h":270852,"hashrate_24h":270445,"shares_found":40,"shares_failed":0,"last_share":1781834451,"peers_out":10,"peers_in":0,"peer_list":454,"pool_hr":17543773,"sidechain_diff":175437737,"tor_cpu_pct":0.55,"tor_mem":"81.34MiB"}
+{"ts":1781835012,"arm":"clearnet","reward_share":1.716,"avg_effort":89.741,"cur_effort":88.360,"hashrate_1h":269970,"hashrate_24h":270355,"shares_found":40,"shares_failed":0,"last_share":1781834451,"peers_out":10,"peers_in":0,"peer_list":454,"pool_hr":17519198,"sidechain_diff":175191983,"tor_cpu_pct":21.14,"tor_mem":"81.64MiB"}
+{"ts":1781835314,"arm":"clearnet","reward_share":1.716,"avg_effort":89.741,"cur_effort":126.545,"hashrate_1h":267509,"hashrate_24h":269972,"shares_found":40,"shares_failed":0,"last_share":1781834451,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":17562727,"sidechain_diff":175627279,"tor_cpu_pct":3.61,"tor_mem":"81.79MiB"}
+{"ts":1781835615,"arm":"clearnet","reward_share":1.670,"avg_effort":89.741,"cur_effort":173.761,"hashrate_1h":267238,"hashrate_24h":269858,"shares_found":40,"shares_failed":0,"last_share":1781834451,"peers_out":10,"peers_in":0,"peer_list":452,"pool_hr":17409022,"sidechain_diff":174090225,"tor_cpu_pct":3.39,"tor_mem":"81.79MiB"}
+{"ts":1781835916,"arm":"clearnet","reward_share":1.671,"avg_effort":89.741,"cur_effort":213.381,"hashrate_1h":264670,"hashrate_24h":269445,"shares_found":40,"shares_failed":0,"last_share":1781834451,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17388899,"sidechain_diff":173888999,"tor_cpu_pct":8.69,"tor_mem":"84.52MiB"}
+{"ts":1781836217,"arm":"clearnet","reward_share":1.715,"avg_effort":91.118,"cur_effort":23.561,"hashrate_1h":262646,"hashrate_24h":269477,"shares_found":42,"shares_failed":0,"last_share":1781836034,"peers_out":10,"peers_in":0,"peer_list":444,"pool_hr":17439736,"sidechain_diff":174397361,"tor_cpu_pct":1.22,"tor_mem":"81.16MiB"}
+{"ts":1781836519,"arm":"clearnet","reward_share":1.716,"avg_effort":90.448,"cur_effort":3.013,"hashrate_1h":259762,"hashrate_24h":269201,"shares_found":43,"shares_failed":0,"last_share":1781836486,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":17522885,"sidechain_diff":175228856,"tor_cpu_pct":15.79,"tor_mem":"80.44MiB"}
+{"ts":1781836820,"arm":"clearnet","reward_share":1.626,"avg_effort":90.448,"cur_effort":51.138,"hashrate_1h":259236,"hashrate_24h":269329,"shares_found":43,"shares_failed":0,"last_share":1781836486,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17482420,"sidechain_diff":174824207,"tor_cpu_pct":0.34,"tor_mem":"80.15MiB"}
+{"ts":1781837121,"arm":"clearnet","reward_share":1.671,"avg_effort":89.737,"cur_effort":38.250,"hashrate_1h":263498,"hashrate_24h":269238,"shares_found":44,"shares_failed":0,"last_share":1781836857,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":17404633,"sidechain_diff":174046334,"tor_cpu_pct":13.63,"tor_mem":"80.31MiB"}
+{"ts":1781837422,"arm":"clearnet","reward_share":1.715,"avg_effort":88.715,"cur_effort":35.758,"hashrate_1h":261308,"hashrate_24h":268990,"shares_found":45,"shares_failed":0,"last_share":1781837146,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":17544391,"sidechain_diff":175443910,"tor_cpu_pct":0.46,"tor_mem":"79.9MiB"}
+{"ts":1781837724,"arm":"clearnet","reward_share":1.716,"avg_effort":88.715,"cur_effort":80.640,"hashrate_1h":262429,"hashrate_24h":268763,"shares_found":45,"shares_failed":0,"last_share":1781837146,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":17478942,"sidechain_diff":174789422,"tor_cpu_pct":13.63,"tor_mem":"79.84MiB"}
+{"ts":1781838025,"arm":"clearnet","reward_share":1.715,"avg_effort":88.810,"cur_effort":34.773,"hashrate_1h":261498,"hashrate_24h":268956,"shares_found":46,"shares_failed":0,"last_share":1781837780,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17364282,"sidechain_diff":173642824,"tor_cpu_pct":16.68,"tor_mem":"79.93MiB"}
+{"ts":1781838326,"arm":"clearnet","reward_share":1.713,"avg_effort":88.810,"cur_effort":80.762,"hashrate_1h":258876,"hashrate_24h":268912,"shares_found":46,"shares_failed":0,"last_share":1781837780,"peers_out":10,"peers_in":0,"peer_list":454,"pool_hr":17538126,"sidechain_diff":175381261,"tor_cpu_pct":17.39,"tor_mem":"79.79MiB"}
+{"ts":1781838627,"arm":"clearnet","reward_share":1.759,"avg_effort":88.655,"cur_effort":47.321,"hashrate_1h":259254,"hashrate_24h":268899,"shares_found":47,"shares_failed":0,"last_share":1781838314,"peers_out":10,"peers_in":0,"peer_list":454,"pool_hr":17303955,"sidechain_diff":173039553,"tor_cpu_pct":11.87,"tor_mem":"79.76MiB"}
+{"ts":1781838929,"arm":"clearnet","reward_share":1.759,"avg_effort":88.655,"cur_effort":92.399,"hashrate_1h":261595,"hashrate_24h":268783,"shares_found":47,"shares_failed":0,"last_share":1781838314,"peers_out":10,"peers_in":0,"peer_list":456,"pool_hr":17389298,"sidechain_diff":173892984,"tor_cpu_pct":1.24,"tor_mem":"79.68MiB"}
+{"ts":1781839230,"arm":"clearnet","reward_share":1.803,"avg_effort":88.897,"cur_effort":35.526,"hashrate_1h":259614,"hashrate_24h":268584,"shares_found":48,"shares_failed":0,"last_share":1781839014,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":17407496,"sidechain_diff":174074966,"tor_cpu_pct":20.92,"tor_mem":"79.64MiB"}
+{"ts":1781839531,"arm":"clearnet","reward_share":1.802,"avg_effort":88.897,"cur_effort":83.187,"hashrate_1h":264460,"hashrate_24h":268759,"shares_found":48,"shares_failed":0,"last_share":1781839014,"peers_out":10,"peers_in":0,"peer_list":461,"pool_hr":17424387,"sidechain_diff":174243875,"tor_cpu_pct":18.81,"tor_mem":"79.6MiB"}
+{"ts":1781839832,"arm":"clearnet","reward_share":1.801,"avg_effort":88.897,"cur_effort":127.561,"hashrate_1h":262737,"hashrate_24h":268687,"shares_found":48,"shares_failed":0,"last_share":1781839014,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":17377756,"sidechain_diff":173777567,"tor_cpu_pct":21.86,"tor_mem":"79.44MiB"}
+{"ts":1781840134,"arm":"clearnet","reward_share":1.802,"avg_effort":88.897,"cur_effort":168.252,"hashrate_1h":261520,"hashrate_24h":268328,"shares_found":48,"shares_failed":0,"last_share":1781839014,"peers_out":10,"peers_in":0,"peer_list":456,"pool_hr":17378323,"sidechain_diff":173783234,"tor_cpu_pct":18.88,"tor_mem":"79.57MiB"}
+{"ts":1781840435,"arm":"clearnet","reward_share":1.757,"avg_effort":88.897,"cur_effort":216.076,"hashrate_1h":262692,"hashrate_24h":268490,"shares_found":48,"shares_failed":0,"last_share":1781839014,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":17457107,"sidechain_diff":174571077,"tor_cpu_pct":25.12,"tor_mem":"79.66MiB"}
+{"ts":1781840736,"arm":"clearnet","reward_share":1.712,"avg_effort":88.897,"cur_effort":270.385,"hashrate_1h":265948,"hashrate_24h":268854,"shares_found":48,"shares_failed":0,"last_share":1781839014,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":17529668,"sidechain_diff":175296683,"tor_cpu_pct":30.08,"tor_mem":"79.95MiB"}
+{"ts":1781841037,"arm":"clearnet","reward_share":1.758,"avg_effort":93.526,"cur_effort":1.134,"hashrate_1h":267487,"hashrate_24h":268838,"shares_found":49,"shares_failed":0,"last_share":1781841028,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":17535639,"sidechain_diff":175356394,"tor_cpu_pct":21.46,"tor_mem":"79.98MiB"}
+{"ts":1781841339,"arm":"clearnet","reward_share":1.715,"avg_effort":92.540,"cur_effort":5.931,"hashrate_1h":269621,"hashrate_24h":268942,"shares_found":50,"shares_failed":0,"last_share":1781841309,"peers_out":10,"peers_in":0,"peer_list":452,"pool_hr":17253516,"sidechain_diff":172535161,"tor_cpu_pct":18.57,"tor_mem":"80.94MiB"}
+{"ts":1781841640,"arm":"clearnet","reward_share":1.715,"avg_effort":92.540,"cur_effort":44.599,"hashrate_1h":266480,"hashrate_24h":268555,"shares_found":50,"shares_failed":0,"last_share":1781841309,"peers_out":10,"peers_in":0,"peer_list":449,"pool_hr":17252032,"sidechain_diff":172520325,"tor_cpu_pct":24.05,"tor_mem":"79.79MiB"}
+{"ts":1781841941,"arm":"clearnet","reward_share":1.760,"avg_effort":91.711,"cur_effort":40.147,"hashrate_1h":263763,"hashrate_24h":268407,"shares_found":51,"shares_failed":0,"last_share":1781841665,"peers_out":10,"peers_in":0,"peer_list":449,"pool_hr":17536311,"sidechain_diff":175363115,"tor_cpu_pct":19.18,"tor_mem":"79.78MiB"}
+{"ts":1781842242,"arm":"clearnet","reward_share":1.715,"avg_effort":91.711,"cur_effort":91.780,"hashrate_1h":268386,"hashrate_24h":268796,"shares_found":51,"shares_failed":0,"last_share":1781841665,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17318591,"sidechain_diff":173185911,"tor_cpu_pct":16.68,"tor_mem":"80.03MiB"}
+{"ts":1781842544,"arm":"clearnet","reward_share":1.717,"avg_effort":92.455,"cur_effort":12.190,"hashrate_1h":271991,"hashrate_24h":269108,"shares_found":52,"shares_failed":0,"last_share":1781842457,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17415966,"sidechain_diff":174159660,"tor_cpu_pct":2.17,"tor_mem":"80.02MiB"}
+{"ts":1781842845,"arm":"clearnet","reward_share":1.672,"avg_effort":92.455,"cur_effort":66.623,"hashrate_1h":275291,"hashrate_24h":269345,"shares_found":52,"shares_failed":0,"last_share":1781842457,"peers_out":10,"peers_in":0,"peer_list":449,"pool_hr":17054154,"sidechain_diff":170541543,"tor_cpu_pct":0.42,"tor_mem":"79.88MiB"}
+{"ts":1781843146,"arm":"clearnet","reward_share":1.672,"avg_effort":92.455,"cur_effort":112.136,"hashrate_1h":273378,"hashrate_24h":269346,"shares_found":52,"shares_failed":0,"last_share":1781842457,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":17130830,"sidechain_diff":171308302,"tor_cpu_pct":16.89,"tor_mem":"80MiB"}
+{"ts":1781843447,"arm":"clearnet","reward_share":1.672,"avg_effort":92.455,"cur_effort":153.184,"hashrate_1h":271161,"hashrate_24h":268978,"shares_found":52,"shares_failed":0,"last_share":1781842457,"peers_out":10,"peers_in":0,"peer_list":456,"pool_hr":17045254,"sidechain_diff":170452544,"tor_cpu_pct":17.43,"tor_mem":"79.96MiB"}
+{"ts":1781843749,"arm":"clearnet","reward_share":1.672,"avg_effort":92.455,"cur_effort":199.511,"hashrate_1h":273047,"hashrate_24h":268832,"shares_found":52,"shares_failed":0,"last_share":1781842457,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17083765,"sidechain_diff":170837651,"tor_cpu_pct":24.38,"tor_mem":"80MiB"}
+{"ts":1781844050,"arm":"clearnet","reward_share":1.538,"avg_effort":92.455,"cur_effort":235.368,"hashrate_1h":267976,"hashrate_24h":268305,"shares_found":52,"shares_failed":0,"last_share":1781842457,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":16987908,"sidechain_diff":169879089,"tor_cpu_pct":25.27,"tor_mem":"81.84MiB"}
+{"ts":1781844351,"arm":"clearnet","reward_share":1.538,"avg_effort":95.276,"cur_effort":44.823,"hashrate_1h":266964,"hashrate_24h":268667,"shares_found":53,"shares_failed":0,"last_share":1781844085,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":17040055,"sidechain_diff":170400559,"tor_cpu_pct":21.94,"tor_mem":"80.43MiB"}
+{"ts":1781844652,"arm":"clearnet","reward_share":1.494,"avg_effort":95.276,"cur_effort":94.149,"hashrate_1h":267029,"hashrate_24h":268666,"shares_found":53,"shares_failed":0,"last_share":1781844085,"peers_out":10,"peers_in":0,"peer_list":456,"pool_hr":17076471,"sidechain_diff":170764715,"tor_cpu_pct":18.5,"tor_mem":"80.7MiB"}
+{"ts":1781844954,"arm":"clearnet","reward_share":1.539,"avg_effort":95.403,"cur_effort":23.401,"hashrate_1h":259924,"hashrate_24h":267979,"shares_found":54,"shares_failed":0,"last_share":1781844731,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17117382,"sidechain_diff":171173825,"tor_cpu_pct":19.05,"tor_mem":"80.87MiB"}
+{"ts":1781845255,"arm":"clearnet","reward_share":1.494,"avg_effort":94.372,"cur_effort":32.840,"hashrate_1h":262131,"hashrate_24h":267815,"shares_found":55,"shares_failed":0,"last_share":1781845010,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":17134824,"sidechain_diff":171348249,"tor_cpu_pct":23.69,"tor_mem":"80.71MiB"}
+{"ts":1781845556,"arm":"clearnet","reward_share":1.495,"avg_effort":94.372,"cur_effort":90.164,"hashrate_1h":267712,"hashrate_24h":268397,"shares_found":55,"shares_failed":0,"last_share":1781845010,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17158086,"sidechain_diff":171580863,"tor_cpu_pct":25.47,"tor_mem":"80.95MiB"}
+{"ts":1781845857,"arm":"clearnet","reward_share":1.495,"avg_effort":94.771,"cur_effort":20.775,"hashrate_1h":265815,"hashrate_24h":268489,"shares_found":56,"shares_failed":0,"last_share":1781845721,"peers_out":10,"peers_in":0,"peer_list":454,"pool_hr":17070161,"sidechain_diff":170701612,"tor_cpu_pct":20.15,"tor_mem":"80.83MiB"}
+{"ts":1781846159,"arm":"clearnet","reward_share":1.539,"avg_effort":94.119,"cur_effort":7.559,"hashrate_1h":260798,"hashrate_24h":268273,"shares_found":57,"shares_failed":0,"last_share":1781846091,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":16976776,"sidechain_diff":169767766,"tor_cpu_pct":30.23,"tor_mem":"81.24MiB"}
+{"ts":1781846460,"arm":"clearnet","reward_share":1.494,"avg_effort":94.119,"cur_effort":60.723,"hashrate_1h":260410,"hashrate_24h":268482,"shares_found":57,"shares_failed":0,"last_share":1781846091,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":16740746,"sidechain_diff":167407466,"tor_cpu_pct":47.74,"tor_mem":"82.42MiB"}
+{"ts":1781846761,"arm":"clearnet","reward_share":1.540,"avg_effort":93.709,"cur_effort":32.231,"hashrate_1h":256694,"hashrate_24h":268089,"shares_found":58,"shares_failed":0,"last_share":1781846513,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":16889442,"sidechain_diff":168894421,"tor_cpu_pct":36.34,"tor_mem":"83.93MiB"}
+{"ts":1781847062,"arm":"clearnet","reward_share":1.495,"avg_effort":93.709,"cur_effort":77.693,"hashrate_1h":259744,"hashrate_24h":267952,"shares_found":58,"shares_failed":0,"last_share":1781846513,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":16784991,"sidechain_diff":167849919,"tor_cpu_pct":24.32,"tor_mem":"84.21MiB"}
+{"ts":1781847364,"arm":"clearnet","reward_share":1.581,"avg_effort":92.607,"cur_effort":6.771,"hashrate_1h":260691,"hashrate_24h":267908,"shares_found":60,"shares_failed":0,"last_share":1781847308,"peers_out":10,"peers_in":0,"peer_list":461,"pool_hr":16805107,"sidechain_diff":168051074,"tor_cpu_pct":27.23,"tor_mem":"83.56MiB"}
+{"ts":1781847665,"arm":"clearnet","reward_share":1.537,"avg_effort":92.607,"cur_effort":62.112,"hashrate_1h":268264,"hashrate_24h":268262,"shares_found":60,"shares_failed":0,"last_share":1781847308,"peers_out":10,"peers_in":0,"peer_list":464,"pool_hr":16664605,"sidechain_diff":166646052,"tor_cpu_pct":19.26,"tor_mem":"83.62MiB"}
+{"ts":1781847966,"arm":"clearnet","reward_share":1.625,"avg_effort":91.039,"cur_effort":25.111,"hashrate_1h":264686,"hashrate_24h":268236,"shares_found":62,"shares_failed":0,"last_share":1781847788,"peers_out":10,"peers_in":0,"peer_list":465,"pool_hr":16703190,"sidechain_diff":167031903,"tor_cpu_pct":18.53,"tor_mem":"83.55MiB"}
+{"ts":1781848267,"arm":"clearnet","reward_share":1.582,"avg_effort":91.039,"cur_effort":77.498,"hashrate_1h":266089,"hashrate_24h":268394,"shares_found":62,"shares_failed":0,"last_share":1781847788,"peers_out":10,"peers_in":0,"peer_list":466,"pool_hr":16583473,"sidechain_diff":165834732,"tor_cpu_pct":19.89,"tor_mem":"83.84MiB"}
+{"ts":1781848569,"arm":"clearnet","reward_share":1.537,"avg_effort":91.039,"cur_effort":127.756,"hashrate_1h":270597,"hashrate_24h":268427,"shares_found":62,"shares_failed":0,"last_share":1781847788,"peers_out":10,"peers_in":0,"peer_list":467,"pool_hr":16482514,"sidechain_diff":164825148,"tor_cpu_pct":14.26,"tor_mem":"83.69MiB"}
+{"ts":1781848870,"arm":"clearnet","reward_share":1.541,"avg_effort":91.039,"cur_effort":176.159,"hashrate_1h":274220,"hashrate_24h":268435,"shares_found":62,"shares_failed":0,"last_share":1781847788,"peers_out":10,"peers_in":0,"peer_list":467,"pool_hr":16566525,"sidechain_diff":165665259,"tor_cpu_pct":29.47,"tor_mem":"83.54MiB"}
+{"ts":1781849171,"arm":"clearnet","reward_share":1.542,"avg_effort":91.039,"cur_effort":229.677,"hashrate_1h":271545,"hashrate_24h":268670,"shares_found":62,"shares_failed":0,"last_share":1781847788,"peers_out":10,"peers_in":0,"peer_list":467,"pool_hr":16659718,"sidechain_diff":166597181,"tor_cpu_pct":17.75,"tor_mem":"83.47MiB"}
+{"ts":1781849472,"arm":"clearnet","reward_share":1.585,"avg_effort":93.724,"cur_effort":18.997,"hashrate_1h":275802,"hashrate_24h":269016,"shares_found":63,"shares_failed":0,"last_share":1781849354,"peers_out":10,"peers_in":0,"peer_list":462,"pool_hr":16602323,"sidechain_diff":166023234,"tor_cpu_pct":20.96,"tor_mem":"83.8MiB"}
+{"ts":1781849774,"arm":"clearnet","reward_share":1.629,"avg_effort":93.242,"cur_effort":8.074,"hashrate_1h":278265,"hashrate_24h":269151,"shares_found":64,"shares_failed":0,"last_share":1781849700,"peers_out":10,"peers_in":0,"peer_list":464,"pool_hr":16645672,"sidechain_diff":166456721,"tor_cpu_pct":21.64,"tor_mem":"83.83MiB"}
+{"ts":1781850075,"arm":"clearnet","reward_share":1.627,"avg_effort":92.695,"cur_effort":4.219,"hashrate_1h":276944,"hashrate_24h":269183,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":16556436,"sidechain_diff":165564369,"tor_cpu_pct":17.91,"tor_mem":"83.84MiB"}
+{"ts":1781850376,"arm":"clearnet","reward_share":1.629,"avg_effort":92.695,"cur_effort":53.697,"hashrate_1h":279786,"hashrate_24h":269191,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":442,"pool_hr":16581005,"sidechain_diff":165810057,"tor_cpu_pct":28.05,"tor_mem":"83.82MiB"}
+{"ts":1781850677,"arm":"clearnet","reward_share":1.584,"avg_effort":92.695,"cur_effort":98.580,"hashrate_1h":279290,"hashrate_24h":269007,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":428,"pool_hr":16577758,"sidechain_diff":165777583,"tor_cpu_pct":23.45,"tor_mem":"83.93MiB"}
+{"ts":1781850979,"arm":"clearnet","reward_share":1.585,"avg_effort":92.695,"cur_effort":149.260,"hashrate_1h":283005,"hashrate_24h":269241,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":427,"pool_hr":16643850,"sidechain_diff":166438502,"tor_cpu_pct":29.51,"tor_mem":"83.72MiB"}
+{"ts":1781851280,"arm":"clearnet","reward_share":1.586,"avg_effort":92.695,"cur_effort":191.363,"hashrate_1h":275348,"hashrate_24h":268882,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":16727158,"sidechain_diff":167271586,"tor_cpu_pct":21.11,"tor_mem":"83.88MiB"}
+{"ts":1781851581,"arm":"clearnet","reward_share":1.587,"avg_effort":92.695,"cur_effort":243.011,"hashrate_1h":275550,"hashrate_24h":268855,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":442,"pool_hr":16307081,"sidechain_diff":163070813,"tor_cpu_pct":23.18,"tor_mem":"83.88MiB"}
+{"ts":1781851882,"arm":"clearnet","reward_share":1.588,"avg_effort":92.695,"cur_effort":292.914,"hashrate_1h":274815,"hashrate_24h":268927,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":16375932,"sidechain_diff":163759325,"tor_cpu_pct":20.24,"tor_mem":"83.88MiB"}
+{"ts":1781852184,"arm":"clearnet","reward_share":1.543,"avg_effort":92.695,"cur_effort":342.161,"hashrate_1h":275121,"hashrate_24h":269076,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":443,"pool_hr":16542378,"sidechain_diff":165423782,"tor_cpu_pct":13.46,"tor_mem":"83.9MiB"}
+{"ts":1781852485,"arm":"clearnet","reward_share":1.545,"avg_effort":92.695,"cur_effort":391.222,"hashrate_1h":273934,"hashrate_24h":268879,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":443,"pool_hr":16365926,"sidechain_diff":163659267,"tor_cpu_pct":28.43,"tor_mem":"84.01MiB"}
+{"ts":1781852786,"arm":"clearnet","reward_share":1.546,"avg_effort":92.695,"cur_effort":454.896,"hashrate_1h":277667,"hashrate_24h":269469,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":16371377,"sidechain_diff":163713777,"tor_cpu_pct":19.86,"tor_mem":"84.18MiB"}
+{"ts":1781853087,"arm":"clearnet","reward_share":1.500,"avg_effort":92.695,"cur_effort":498.273,"hashrate_1h":270964,"hashrate_24h":269149,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":16399964,"sidechain_diff":163999646,"tor_cpu_pct":25.65,"tor_mem":"84.18MiB"}
+{"ts":1781853389,"arm":"clearnet","reward_share":1.502,"avg_effort":92.695,"cur_effort":541.540,"hashrate_1h":268347,"hashrate_24h":268955,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":16379597,"sidechain_diff":163795974,"tor_cpu_pct":30.43,"tor_mem":"84.2MiB"}
+{"ts":1781853690,"arm":"clearnet","reward_share":1.411,"avg_effort":92.695,"cur_effort":586.839,"hashrate_1h":262360,"hashrate_24h":268543,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":443,"pool_hr":16228601,"sidechain_diff":162286019,"tor_cpu_pct":20.74,"tor_mem":"84.2MiB"}
+{"ts":1781853991,"arm":"clearnet","reward_share":1.366,"avg_effort":92.695,"cur_effort":639.986,"hashrate_1h":265622,"hashrate_24h":268853,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":443,"pool_hr":16359782,"sidechain_diff":163597824,"tor_cpu_pct":25.18,"tor_mem":"84.56MiB"}
+{"ts":1781854292,"arm":"clearnet","reward_share":1.319,"avg_effort":92.695,"cur_effort":699.100,"hashrate_1h":269086,"hashrate_24h":269013,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":16237729,"sidechain_diff":162377297,"tor_cpu_pct":31.4,"tor_mem":"84.52MiB"}
+{"ts":1781854594,"arm":"clearnet","reward_share":1.321,"avg_effort":92.695,"cur_effort":750.074,"hashrate_1h":265920,"hashrate_24h":268896,"shares_found":65,"shares_failed":0,"last_share":1781850045,"peers_out":10,"peers_in":0,"peer_list":435,"pool_hr":16148132,"sidechain_diff":161481323,"tor_cpu_pct":25.92,"tor_mem":"83.75MiB"}
+{"ts":1781854895,"arm":"clearnet","reward_share":1.365,"avg_effort":102.251,"cur_effort":43.622,"hashrate_1h":274750,"hashrate_24h":269379,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":428,"pool_hr":16101868,"sidechain_diff":161018687,"tor_cpu_pct":23.51,"tor_mem":"84.43MiB"}
+{"ts":1781855196,"arm":"clearnet","reward_share":1.366,"avg_effort":102.251,"cur_effort":94.959,"hashrate_1h":275918,"hashrate_24h":269467,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":427,"pool_hr":15998841,"sidechain_diff":159988419,"tor_cpu_pct":25.52,"tor_mem":"84.4MiB"}
+{"ts":1781855497,"arm":"clearnet","reward_share":1.366,"avg_effort":102.251,"cur_effort":155.637,"hashrate_1h":279809,"hashrate_24h":269808,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":429,"pool_hr":16135424,"sidechain_diff":161354241,"tor_cpu_pct":17.78,"tor_mem":"84.54MiB"}
+{"ts":1781855799,"arm":"clearnet","reward_share":1.368,"avg_effort":102.251,"cur_effort":190.498,"hashrate_1h":272077,"hashrate_24h":269228,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":431,"pool_hr":16102910,"sidechain_diff":161029107,"tor_cpu_pct":20.91,"tor_mem":"84.65MiB"}
+{"ts":1781856100,"arm":"clearnet","reward_share":1.370,"avg_effort":102.251,"cur_effort":242.561,"hashrate_1h":273669,"hashrate_24h":269247,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":427,"pool_hr":16078691,"sidechain_diff":160786916,"tor_cpu_pct":29.19,"tor_mem":"84.61MiB"}
+{"ts":1781856401,"arm":"clearnet","reward_share":1.371,"avg_effort":102.251,"cur_effort":282.735,"hashrate_1h":264686,"hashrate_24h":269023,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":429,"pool_hr":16144189,"sidechain_diff":161441897,"tor_cpu_pct":20.07,"tor_mem":"84.57MiB"}
+{"ts":1781856702,"arm":"clearnet","reward_share":1.326,"avg_effort":102.251,"cur_effort":339.480,"hashrate_1h":269760,"hashrate_24h":269180,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":430,"pool_hr":16130119,"sidechain_diff":161301197,"tor_cpu_pct":19.9,"tor_mem":"84.59MiB"}
+{"ts":1781857004,"arm":"clearnet","reward_share":1.327,"avg_effort":102.251,"cur_effort":384.822,"hashrate_1h":271376,"hashrate_24h":269141,"shares_found":66,"shares_failed":0,"last_share":1781854671,"peers_out":10,"peers_in":0,"peer_list":433,"pool_hr":16245712,"sidechain_diff":162457122,"tor_cpu_pct":18.29,"tor_mem":"103.4MiB"}
+{"ts":1781857305,"arm":"clearnet","reward_share":1.374,"avg_effort":106.514,"cur_effort":25.265,"hashrate_1h":275745,"hashrate_24h":269066,"shares_found":67,"shares_failed":0,"last_share":1781857128,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":16087533,"sidechain_diff":160875339,"tor_cpu_pct":25.67,"tor_mem":"85.62MiB"}
+{"ts":1781857606,"arm":"clearnet","reward_share":1.280,"avg_effort":106.514,"cur_effort":85.408,"hashrate_1h":275205,"hashrate_24h":269352,"shares_found":67,"shares_failed":0,"last_share":1781857128,"peers_out":10,"peers_in":0,"peer_list":437,"pool_hr":16031766,"sidechain_diff":160317662,"tor_cpu_pct":6.19,"tor_mem":"85.54MiB"}
+{"ts":1781857907,"arm":"clearnet","reward_share":1.276,"avg_effort":106.761,"cur_effort":4.629,"hashrate_1h":268089,"hashrate_24h":269129,"shares_found":68,"shares_failed":0,"last_share":1781857870,"peers_out":10,"peers_in":0,"peer_list":437,"pool_hr":16025318,"sidechain_diff":160253184,"tor_cpu_pct":22.37,"tor_mem":"85.43MiB"}
+{"ts":1781858209,"arm":"clearnet","reward_share":1.276,"avg_effort":106.761,"cur_effort":65.032,"hashrate_1h":275717,"hashrate_24h":269410,"shares_found":68,"shares_failed":0,"last_share":1781857870,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":15927215,"sidechain_diff":159272151,"tor_cpu_pct":18.98,"tor_mem":"85.31MiB"}
+{"ts":1781858510,"arm":"clearnet","reward_share":1.320,"avg_effort":106.907,"cur_effort":10.797,"hashrate_1h":273675,"hashrate_24h":269847,"shares_found":69,"shares_failed":0,"last_share":1781858464,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":15958511,"sidechain_diff":159585118,"tor_cpu_pct":15.54,"tor_mem":"85.57MiB"}
+{"ts":1781858811,"arm":"clearnet","reward_share":1.322,"avg_effort":106.907,"cur_effort":65.202,"hashrate_1h":275849,"hashrate_24h":269984,"shares_found":69,"shares_failed":0,"last_share":1781858464,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":15972334,"sidechain_diff":159723346,"tor_cpu_pct":19.6,"tor_mem":"85.14MiB"}
+{"ts":1781859112,"arm":"clearnet","reward_share":1.229,"avg_effort":106.907,"cur_effort":131.293,"hashrate_1h":279062,"hashrate_24h":270532,"shares_found":69,"shares_failed":0,"last_share":1781858464,"peers_out":10,"peers_in":0,"peer_list":436,"pool_hr":15994030,"sidechain_diff":159940309,"tor_cpu_pct":18.29,"tor_mem":"85.18MiB"}
+{"ts":1781859414,"arm":"clearnet","reward_share":1.232,"avg_effort":106.907,"cur_effort":187.659,"hashrate_1h":289965,"hashrate_24h":270777,"shares_found":69,"shares_failed":0,"last_share":1781858464,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":15998542,"sidechain_diff":159985422,"tor_cpu_pct":25.67,"tor_mem":"85.14MiB"}
+{"ts":1781859715,"arm":"clearnet","reward_share":1.230,"avg_effort":108.374,"cur_effort":11.640,"hashrate_1h":285394,"hashrate_24h":270429,"shares_found":70,"shares_failed":0,"last_share":1781859601,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":16033724,"sidechain_diff":160337248,"tor_cpu_pct":19.56,"tor_mem":"85.45MiB"}
+{"ts":1781860016,"arm":"clearnet","reward_share":1.228,"avg_effort":107.245,"cur_effort":35.575,"hashrate_1h":287600,"hashrate_24h":270347,"shares_found":71,"shares_failed":0,"last_share":1781859776,"peers_out":10,"peers_in":0,"peer_list":436,"pool_hr":16405408,"sidechain_diff":164054081,"tor_cpu_pct":20.06,"tor_mem":"85.49MiB"}
+{"ts":1781860317,"arm":"clearnet","reward_share":1.226,"avg_effort":106.640,"cur_effort":6.263,"hashrate_1h":275722,"hashrate_24h":269680,"shares_found":72,"shares_failed":0,"last_share":1781860246,"peers_out":10,"peers_in":0,"peer_list":437,"pool_hr":16102957,"sidechain_diff":161029574,"tor_cpu_pct":24.68,"tor_mem":"85.73MiB"}
+{"ts":1781860619,"arm":"clearnet","reward_share":1.316,"avg_effort":104.715,"cur_effort":5.041,"hashrate_1h":282737,"hashrate_24h":269998,"shares_found":74,"shares_failed":0,"last_share":1781860573,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":16150849,"sidechain_diff":161508499,"tor_cpu_pct":22,"tor_mem":"85.3MiB"}
+{"ts":1781860920,"arm":"clearnet","reward_share":1.270,"avg_effort":104.715,"cur_effort":66.798,"hashrate_1h":286392,"hashrate_24h":270310,"shares_found":74,"shares_failed":0,"last_share":1781860573,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":16113921,"sidechain_diff":161139216,"tor_cpu_pct":27.14,"tor_mem":"85.56MiB"}
+{"ts":1781861221,"arm":"clearnet","reward_share":1.271,"avg_effort":104.715,"cur_effort":124.600,"hashrate_1h":287001,"hashrate_24h":270619,"shares_found":74,"shares_failed":0,"last_share":1781860573,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":16132745,"sidechain_diff":161327459,"tor_cpu_pct":29.27,"tor_mem":"85.57MiB"}
+{"ts":1781861522,"arm":"clearnet","reward_share":1.225,"avg_effort":104.715,"cur_effort":187.249,"hashrate_1h":295293,"hashrate_24h":271012,"shares_found":74,"shares_failed":0,"last_share":1781860573,"peers_out":10,"peers_in":0,"peer_list":441,"pool_hr":16133252,"sidechain_diff":161332529,"tor_cpu_pct":25.16,"tor_mem":"85.52MiB"}
+{"ts":1781861824,"arm":"clearnet","reward_share":1.180,"avg_effort":104.715,"cur_effort":243.648,"hashrate_1h":294034,"hashrate_24h":271094,"shares_found":74,"shares_failed":0,"last_share":1781860573,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":16009232,"sidechain_diff":160092324,"tor_cpu_pct":25.2,"tor_mem":"85.68MiB"}
+{"ts":1781862125,"arm":"clearnet","reward_share":1.225,"avg_effort":106.864,"cur_effort":12.839,"hashrate_1h":286666,"hashrate_24h":271026,"shares_found":75,"shares_failed":0,"last_share":1781862028,"peers_out":10,"peers_in":0,"peer_list":436,"pool_hr":16132181,"sidechain_diff":161321811,"tor_cpu_pct":24.33,"tor_mem":"85.41MiB"}
+{"ts":1781862426,"arm":"clearnet","reward_share":1.227,"avg_effort":106.864,"cur_effort":67.508,"hashrate_1h":285564,"hashrate_24h":271102,"shares_found":75,"shares_failed":0,"last_share":1781862028,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":16299777,"sidechain_diff":162997778,"tor_cpu_pct":21.96,"tor_mem":"85.17MiB"}
+{"ts":1781862727,"arm":"clearnet","reward_share":1.226,"avg_effort":106.864,"cur_effort":109.211,"hashrate_1h":274913,"hashrate_24h":270833,"shares_found":75,"shares_failed":0,"last_share":1781862028,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":16181160,"sidechain_diff":161811609,"tor_cpu_pct":5.32,"tor_mem":"85.32MiB"}
+{"ts":1781863029,"arm":"clearnet","reward_share":1.228,"avg_effort":106.864,"cur_effort":159.837,"hashrate_1h":271804,"hashrate_24h":270844,"shares_found":75,"shares_failed":0,"last_share":1781862028,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":16139261,"sidechain_diff":161392611,"tor_cpu_pct":22.01,"tor_mem":"85.23MiB"}
+{"ts":1781863330,"arm":"clearnet","reward_share":1.230,"avg_effort":106.864,"cur_effort":214.923,"hashrate_1h":277067,"hashrate_24h":270915,"shares_found":75,"shares_failed":0,"last_share":1781862028,"peers_out":10,"peers_in":0,"peer_list":441,"pool_hr":15976915,"sidechain_diff":159769157,"tor_cpu_pct":20.77,"tor_mem":"85.39MiB"}
+{"ts":1781863631,"arm":"clearnet","reward_share":1.184,"avg_effort":106.864,"cur_effort":265.040,"hashrate_1h":278815,"hashrate_24h":270905,"shares_found":75,"shares_failed":0,"last_share":1781862028,"peers_out":10,"peers_in":0,"peer_list":443,"pool_hr":16067360,"sidechain_diff":160673606,"tor_cpu_pct":21.87,"tor_mem":"85.51MiB"}
+{"ts":1781863932,"arm":"clearnet","reward_share":1.182,"avg_effort":109.399,"cur_effort":6.367,"hashrate_1h":289380,"hashrate_24h":271154,"shares_found":76,"shares_failed":0,"last_share":1781863902,"peers_out":10,"peers_in":0,"peer_list":442,"pool_hr":16603483,"sidechain_diff":166034838,"tor_cpu_pct":17.4,"tor_mem":"85.38MiB"}
+{"ts":1781864234,"arm":"clearnet","reward_share":1.135,"avg_effort":109.399,"cur_effort":59.296,"hashrate_1h":288069,"hashrate_24h":271207,"shares_found":76,"shares_failed":0,"last_share":1781863902,"peers_out":10,"peers_in":0,"peer_list":445,"pool_hr":16231144,"sidechain_diff":162311443,"tor_cpu_pct":21.53,"tor_mem":"85.37MiB"}
+{"ts":1781864535,"arm":"clearnet","reward_share":1.182,"avg_effort":109.082,"cur_effort":15.788,"hashrate_1h":277979,"hashrate_24h":270904,"shares_found":77,"shares_failed":0,"last_share":1781864411,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":16241812,"sidechain_diff":162418122,"tor_cpu_pct":27.26,"tor_mem":"85.57MiB"}
+{"ts":1781864836,"arm":"clearnet","reward_share":1.227,"avg_effort":107.982,"cur_effort":52.792,"hashrate_1h":276274,"hashrate_24h":271078,"shares_found":78,"shares_failed":0,"last_share":1781864538,"peers_out":10,"peers_in":0,"peer_list":445,"pool_hr":16186682,"sidechain_diff":161866825,"tor_cpu_pct":16.93,"tor_mem":"85.56MiB"}
+{"ts":1781865137,"arm":"clearnet","reward_share":1.226,"avg_effort":107.747,"cur_effort":19.962,"hashrate_1h":273297,"hashrate_24h":271194,"shares_found":79,"shares_failed":0,"last_share":1781865017,"peers_out":10,"peers_in":0,"peer_list":444,"pool_hr":16197375,"sidechain_diff":161973758,"tor_cpu_pct":17.84,"tor_mem":"85.43MiB"}
+{"ts":1781865439,"arm":"clearnet","reward_share":1.271,"avg_effort":106.845,"cur_effort":35.231,"hashrate_1h":271733,"hashrate_24h":271103,"shares_found":80,"shares_failed":0,"last_share":1781865220,"peers_out":10,"peers_in":0,"peer_list":444,"pool_hr":16328454,"sidechain_diff":163284546,"tor_cpu_pct":19.77,"tor_mem":"85.86MiB"}
+{"ts":1781865740,"arm":"clearnet","reward_share":1.317,"avg_effort":106.266,"cur_effort":22.247,"hashrate_1h":271394,"hashrate_24h":271033,"shares_found":81,"shares_failed":0,"last_share":1781865599,"peers_out":10,"peers_in":0,"peer_list":445,"pool_hr":16413707,"sidechain_diff":164137071,"tor_cpu_pct":20.45,"tor_mem":"85.61MiB"}
+{"ts":1781866041,"arm":"clearnet","reward_share":1.317,"avg_effort":106.266,"cur_effort":75.400,"hashrate_1h":271975,"hashrate_24h":271136,"shares_found":81,"shares_failed":0,"last_share":1781865599,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":16530904,"sidechain_diff":165309045,"tor_cpu_pct":25.85,"tor_mem":"85.86MiB"}
+{"ts":1781866343,"arm":"clearnet","reward_share":1.271,"avg_effort":106.266,"cur_effort":129.078,"hashrate_1h":276729,"hashrate_24h":271207,"shares_found":81,"shares_failed":0,"last_share":1781865599,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":16476146,"sidechain_diff":164761463,"tor_cpu_pct":19.69,"tor_mem":"85.89MiB"}
+{"ts":1781866644,"arm":"clearnet","reward_share":1.273,"avg_effort":106.266,"cur_effort":167.762,"hashrate_1h":271789,"hashrate_24h":270915,"shares_found":81,"shares_failed":0,"last_share":1781865599,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":16520346,"sidechain_diff":165203460,"tor_cpu_pct":25.42,"tor_mem":"85.72MiB"}
+{"ts":1781866945,"arm":"clearnet","reward_share":1.362,"avg_effort":104.914,"cur_effort":16.446,"hashrate_1h":271119,"hashrate_24h":270898,"shares_found":84,"shares_failed":0,"last_share":1781866857,"peers_out":10,"peers_in":0,"peer_list":449,"pool_hr":16465221,"sidechain_diff":164652214,"tor_cpu_pct":24.34,"tor_mem":"87.51MiB"}
+{"ts":1781867246,"arm":"clearnet","reward_share":1.362,"avg_effort":104.277,"cur_effort":2.721,"hashrate_1h":264641,"hashrate_24h":270593,"shares_found":85,"shares_failed":0,"last_share":1781867208,"peers_out":10,"peers_in":0,"peer_list":450,"pool_hr":17045400,"sidechain_diff":170454007,"tor_cpu_pct":21.13,"tor_mem":"87.57MiB"}
+{"ts":1781867547,"arm":"clearnet","reward_share":1.363,"avg_effort":104.277,"cur_effort":62.107,"hashrate_1h":268225,"hashrate_24h":270954,"shares_found":85,"shares_failed":0,"last_share":1781867208,"peers_out":10,"peers_in":0,"peer_list":452,"pool_hr":16784805,"sidechain_diff":167848058,"tor_cpu_pct":21.62,"tor_mem":"87.75MiB"}
+{"ts":1781867849,"arm":"clearnet","reward_share":1.407,"avg_effort":102.964,"cur_effort":19.439,"hashrate_1h":266233,"hashrate_24h":270925,"shares_found":87,"shares_failed":0,"last_share":1781867723,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":16476618,"sidechain_diff":164766185,"tor_cpu_pct":32.61,"tor_mem":"88MiB"}
+{"ts":1781868150,"arm":"clearnet","reward_share":1.362,"avg_effort":102.964,"cur_effort":62.415,"hashrate_1h":266938,"hashrate_24h":270690,"shares_found":87,"shares_failed":0,"last_share":1781867723,"peers_out":10,"peers_in":0,"peer_list":452,"pool_hr":16408913,"sidechain_diff":164089139,"tor_cpu_pct":25.04,"tor_mem":"88.29MiB"}
+{"ts":1781868451,"arm":"clearnet","reward_share":1.362,"avg_effort":102.644,"cur_effort":34.953,"hashrate_1h":265054,"hashrate_24h":270617,"shares_found":88,"shares_failed":0,"last_share":1781868242,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":16594345,"sidechain_diff":165943459,"tor_cpu_pct":30.76,"tor_mem":"89.8MiB"}
+{"ts":1781868753,"arm":"clearnet","reward_share":1.362,"avg_effort":102.644,"cur_effort":76.890,"hashrate_1h":259632,"hashrate_24h":270468,"shares_found":88,"shares_failed":0,"last_share":1781868242,"peers_out":10,"peers_in":0,"peer_list":457,"pool_hr":16624542,"sidechain_diff":166245428,"tor_cpu_pct":23.05,"tor_mem":"90.3MiB"}
+{"ts":1781869054,"arm":"clearnet","reward_share":1.361,"avg_effort":102.644,"cur_effort":124.183,"hashrate_1h":260058,"hashrate_24h":270425,"shares_found":88,"shares_failed":0,"last_share":1781868242,"peers_out":10,"peers_in":0,"peer_list":462,"pool_hr":16612514,"sidechain_diff":166125140,"tor_cpu_pct":34.7,"tor_mem":"90.54MiB"}
+{"ts":1781869355,"arm":"clearnet","reward_share":1.269,"avg_effort":102.644,"cur_effort":167.417,"hashrate_1h":259005,"hashrate_24h":270298,"shares_found":88,"shares_failed":0,"last_share":1781868242,"peers_out":10,"peers_in":0,"peer_list":464,"pool_hr":16692407,"sidechain_diff":166924072,"tor_cpu_pct":17.77,"tor_mem":"90.09MiB"}
+{"ts":1781869656,"arm":"clearnet","reward_share":1.177,"avg_effort":102.644,"cur_effort":212.616,"hashrate_1h":255727,"hashrate_24h":270232,"shares_found":88,"shares_failed":0,"last_share":1781868242,"peers_out":10,"peers_in":0,"peer_list":466,"pool_hr":16940487,"sidechain_diff":169404871,"tor_cpu_pct":7.85,"tor_mem":"89.91MiB"}
+{"ts":1781869958,"arm":"clearnet","reward_share":1.223,"avg_effort":104.407,"cur_effort":2.004,"hashrate_1h":255934,"hashrate_24h":270265,"shares_found":89,"shares_failed":0,"last_share":1781869919,"peers_out":10,"peers_in":0,"peer_list":467,"pool_hr":16614150,"sidechain_diff":166141504,"tor_cpu_pct":26.64,"tor_mem":"89.97MiB"}
+{"ts":1781870259,"arm":"clearnet","reward_share":1.268,"avg_effort":103.888,"cur_effort":1.916,"hashrate_1h":263003,"hashrate_24h":270455,"shares_found":90,"shares_failed":0,"last_share":1781870226,"peers_out":10,"peers_in":0,"peer_list":470,"pool_hr":16663246,"sidechain_diff":166632464,"tor_cpu_pct":25.22,"tor_mem":"89.97MiB"}
+{"ts":1781870560,"arm":"clearnet","reward_share":1.268,"avg_effort":103.888,"cur_effort":55.411,"hashrate_1h":265558,"hashrate_24h":270543,"shares_found":90,"shares_failed":0,"last_share":1781870226,"peers_out":10,"peers_in":0,"peer_list":470,"pool_hr":16502718,"sidechain_diff":165027180,"tor_cpu_pct":33.29,"tor_mem":"89.94MiB"}
+{"ts":1781870861,"arm":"clearnet","reward_share":1.314,"avg_effort":103.733,"cur_effort":15.521,"hashrate_1h":270173,"hashrate_24h":270548,"shares_found":91,"shares_failed":0,"last_share":1781870781,"peers_out":10,"peers_in":0,"peer_list":473,"pool_hr":16893404,"sidechain_diff":168934046,"tor_cpu_pct":26.43,"tor_mem":"90.04MiB"}
+{"ts":1781871163,"arm":"clearnet","reward_share":1.268,"avg_effort":103.733,"cur_effort":61.746,"hashrate_1h":263602,"hashrate_24h":270554,"shares_found":91,"shares_failed":0,"last_share":1781870781,"peers_out":10,"peers_in":0,"peer_list":476,"pool_hr":16927613,"sidechain_diff":169276136,"tor_cpu_pct":19.89,"tor_mem":"89.88MiB"}
+{"ts":1781871464,"arm":"clearnet","reward_share":1.268,"avg_effort":103.531,"cur_effort":25.640,"hashrate_1h":264381,"hashrate_24h":270506,"shares_found":92,"shares_failed":0,"last_share":1781871285,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":16670257,"sidechain_diff":166702575,"tor_cpu_pct":34.74,"tor_mem":"90.19MiB"}
+{"ts":1781871765,"arm":"clearnet","reward_share":1.222,"avg_effort":103.531,"cur_effort":72.781,"hashrate_1h":266912,"hashrate_24h":270449,"shares_found":92,"shares_failed":0,"last_share":1781871285,"peers_out":10,"peers_in":0,"peer_list":477,"pool_hr":16846279,"sidechain_diff":168462794,"tor_cpu_pct":33.9,"tor_mem":"90.23MiB"}
+{"ts":1781872066,"arm":"clearnet","reward_share":1.223,"avg_effort":103.531,"cur_effort":122.339,"hashrate_1h":269334,"hashrate_24h":270532,"shares_found":92,"shares_failed":0,"last_share":1781871285,"peers_out":10,"peers_in":0,"peer_list":476,"pool_hr":16802622,"sidechain_diff":168026222,"tor_cpu_pct":20.52,"tor_mem":"99.65MiB"}
+{"ts":1781872368,"arm":"clearnet","reward_share":1.222,"avg_effort":103.531,"cur_effort":172.182,"hashrate_1h":274494,"hashrate_24h":270685,"shares_found":92,"shares_failed":0,"last_share":1781871285,"peers_out":10,"peers_in":0,"peer_list":478,"pool_hr":17477279,"sidechain_diff":174772797,"tor_cpu_pct":93.64,"tor_mem":"94.6MiB"}
+{"ts":1781872669,"arm":"clearnet","reward_share":1.222,"avg_effort":103.531,"cur_effort":218.987,"hashrate_1h":275069,"hashrate_24h":270707,"shares_found":92,"shares_failed":0,"last_share":1781871285,"peers_out":10,"peers_in":0,"peer_list":481,"pool_hr":17335989,"sidechain_diff":173359893,"tor_cpu_pct":60.96,"tor_mem":"93.53MiB"}
+{"ts":1781872970,"arm":"clearnet","reward_share":1.269,"avg_effort":104.856,"cur_effort":33.641,"hashrate_1h":273656,"hashrate_24h":270480,"shares_found":93,"shares_failed":0,"last_share":1781872681,"peers_out":10,"peers_in":0,"peer_list":478,"pool_hr":17193463,"sidechain_diff":171934632,"tor_cpu_pct":85.56,"tor_mem":"101.4MiB"}
+{"ts":1781873271,"arm":"clearnet","reward_share":1.362,"avg_effort":103.251,"cur_effort":18.652,"hashrate_1h":270032,"hashrate_24h":270258,"shares_found":95,"shares_failed":0,"last_share":1781873122,"peers_out":10,"peers_in":0,"peer_list":483,"pool_hr":16801521,"sidechain_diff":168015214,"tor_cpu_pct":26.87,"tor_mem":"102.4MiB"}
+{"ts":1781873573,"arm":"clearnet","reward_share":1.409,"avg_effort":102.518,"cur_effort":34.566,"hashrate_1h":269346,"hashrate_24h":270269,"shares_found":96,"shares_failed":0,"last_share":1781873315,"peers_out":10,"peers_in":0,"peer_list":482,"pool_hr":16969859,"sidechain_diff":169698591,"tor_cpu_pct":46.03,"tor_mem":"102.5MiB"}
+{"ts":1781873874,"arm":"clearnet","reward_share":1.454,"avg_effort":102.036,"cur_effort":39.030,"hashrate_1h":272032,"hashrate_24h":270597,"shares_found":97,"shares_failed":0,"last_share":1781873682,"peers_out":10,"peers_in":0,"peer_list":485,"pool_hr":16951336,"sidechain_diff":169513365,"tor_cpu_pct":29.08,"tor_mem":"103.7MiB"}
+{"ts":1781874175,"arm":"clearnet","reward_share":1.501,"avg_effort":101.438,"cur_effort":40.539,"hashrate_1h":269941,"hashrate_24h":270532,"shares_found":98,"shares_failed":0,"last_share":1781873909,"peers_out":10,"peers_in":0,"peer_list":483,"pool_hr":17132608,"sidechain_diff":171326084,"tor_cpu_pct":95.99,"tor_mem":"104.6MiB"}
+{"ts":1781874476,"arm":"clearnet","reward_share":1.548,"avg_effort":101.093,"cur_effort":19.834,"hashrate_1h":269963,"hashrate_24h":270510,"shares_found":99,"shares_failed":0,"last_share":1781874318,"peers_out":10,"peers_in":0,"peer_list":478,"pool_hr":16945861,"sidechain_diff":169458615,"tor_cpu_pct":58.37,"tor_mem":"104.9MiB"}
+{"ts":1781874778,"arm":"clearnet","reward_share":1.546,"avg_effort":101.093,"cur_effort":64.732,"hashrate_1h":270728,"hashrate_24h":270505,"shares_found":99,"shares_failed":0,"last_share":1781874318,"peers_out":10,"peers_in":0,"peer_list":474,"pool_hr":17023815,"sidechain_diff":170238158,"tor_cpu_pct":57.15,"tor_mem":"105.7MiB"}
+{"ts":1781875079,"arm":"clearnet","reward_share":1.592,"avg_effort":100.805,"cur_effort":35.881,"hashrate_1h":267745,"hashrate_24h":270351,"shares_found":100,"shares_failed":0,"last_share":1781874820,"peers_out":10,"peers_in":0,"peer_list":475,"pool_hr":16887364,"sidechain_diff":168873646,"tor_cpu_pct":31.83,"tor_mem":"101.5MiB"}
+{"ts":1781875380,"arm":"clearnet","reward_share":1.684,"avg_effort":99.361,"cur_effort":22.808,"hashrate_1h":265011,"hashrate_24h":270142,"shares_found":102,"shares_failed":0,"last_share":1781875173,"peers_out":10,"peers_in":0,"peer_list":478,"pool_hr":17026211,"sidechain_diff":170262115,"tor_cpu_pct":67.24,"tor_mem":"100.4MiB"}
+{"ts":1781875681,"arm":"clearnet","reward_share":1.686,"avg_effort":99.361,"cur_effort":68.716,"hashrate_1h":261854,"hashrate_24h":270082,"shares_found":102,"shares_failed":0,"last_share":1781875173,"peers_out":10,"peers_in":0,"peer_list":480,"pool_hr":17012290,"sidechain_diff":170122900,"tor_cpu_pct":42.63,"tor_mem":"100.5MiB"}
+{"ts":1781875983,"arm":"clearnet","reward_share":1.686,"avg_effort":99.361,"cur_effort":109.910,"hashrate_1h":255023,"hashrate_24h":269878,"shares_found":102,"shares_failed":0,"last_share":1781875173,"peers_out":10,"peers_in":0,"peer_list":480,"pool_hr":17057559,"sidechain_diff":170575597,"tor_cpu_pct":59.01,"tor_mem":"100.8MiB"}
+{"ts":1781876284,"arm":"clearnet","reward_share":1.687,"avg_effort":99.550,"cur_effort":27.923,"hashrate_1h":250667,"hashrate_24h":269625,"shares_found":103,"shares_failed":0,"last_share":1781876057,"peers_out":10,"peers_in":0,"peer_list":482,"pool_hr":16966924,"sidechain_diff":169669241,"tor_cpu_pct":86.43,"tor_mem":"100.3MiB"}
+{"ts":1781876585,"arm":"clearnet","reward_share":1.688,"avg_effort":99.550,"cur_effort":82.142,"hashrate_1h":259227,"hashrate_24h":269831,"shares_found":103,"shares_failed":0,"last_share":1781876057,"peers_out":10,"peers_in":0,"peer_list":477,"pool_hr":16974120,"sidechain_diff":169741203,"tor_cpu_pct":32.72,"tor_mem":"100.5MiB"}
+{"ts":1781876886,"arm":"clearnet","reward_share":1.730,"avg_effort":99.485,"cur_effort":34.731,"hashrate_1h":259970,"hashrate_24h":269732,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":17107890,"sidechain_diff":171078907,"tor_cpu_pct":86.97,"tor_mem":"100.5MiB"}
+{"ts":1781877188,"arm":"clearnet","reward_share":1.730,"avg_effort":99.485,"cur_effort":88.232,"hashrate_1h":261691,"hashrate_24h":269862,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":17103939,"sidechain_diff":171039396,"tor_cpu_pct":23.25,"tor_mem":"99.38MiB"}
+{"ts":1781877489,"arm":"clearnet","reward_share":1.729,"avg_effort":99.485,"cur_effort":136.250,"hashrate_1h":258173,"hashrate_24h":269911,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":481,"pool_hr":17154318,"sidechain_diff":171543184,"tor_cpu_pct":24.05,"tor_mem":"99.29MiB"}
+{"ts":1781877790,"arm":"clearnet","reward_share":1.728,"avg_effort":99.485,"cur_effort":188.333,"hashrate_1h":261599,"hashrate_24h":270019,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":478,"pool_hr":17146916,"sidechain_diff":171469164,"tor_cpu_pct":37.82,"tor_mem":"99.49MiB"}
+{"ts":1781878091,"arm":"clearnet","reward_share":1.728,"avg_effort":99.485,"cur_effort":235.019,"hashrate_1h":262276,"hashrate_24h":270066,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":474,"pool_hr":17197942,"sidechain_diff":171979421,"tor_cpu_pct":29.13,"tor_mem":"99.43MiB"}
+{"ts":1781878393,"arm":"clearnet","reward_share":1.726,"avg_effort":99.485,"cur_effort":284.088,"hashrate_1h":261686,"hashrate_24h":270038,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":475,"pool_hr":17069680,"sidechain_diff":170696800,"tor_cpu_pct":30.08,"tor_mem":"98.96MiB"}
+{"ts":1781878694,"arm":"clearnet","reward_share":1.725,"avg_effort":99.485,"cur_effort":336.161,"hashrate_1h":267886,"hashrate_24h":270196,"shares_found":104,"shares_failed":0,"last_share":1781876621,"peers_out":10,"peers_in":0,"peer_list":477,"pool_hr":17119615,"sidechain_diff":171196155,"tor_cpu_pct":17.49,"tor_mem":"99.05MiB"}
+{"ts":1781878995,"arm":"clearnet","reward_share":1.726,"avg_effort":102.035,"cur_effort":14.299,"hashrate_1h":268918,"hashrate_24h":270096,"shares_found":105,"shares_failed":0,"last_share":1781878880,"peers_out":10,"peers_in":0,"peer_list":475,"pool_hr":17137786,"sidechain_diff":171377861,"tor_cpu_pct":31.99,"tor_mem":"98.93MiB"}
+{"ts":1781879296,"arm":"clearnet","reward_share":1.725,"avg_effort":102.035,"cur_effort":57.229,"hashrate_1h":268552,"hashrate_24h":270008,"shares_found":105,"shares_failed":0,"last_share":1781878880,"peers_out":10,"peers_in":0,"peer_list":472,"pool_hr":17104268,"sidechain_diff":171042688,"tor_cpu_pct":18.4,"tor_mem":"98.55MiB"}
+{"ts":1781879598,"arm":"clearnet","reward_share":1.681,"avg_effort":102.035,"cur_effort":95.782,"hashrate_1h":266666,"hashrate_24h":269710,"shares_found":105,"shares_failed":0,"last_share":1781878880,"peers_out":10,"peers_in":0,"peer_list":472,"pool_hr":17111242,"sidechain_diff":171112421,"tor_cpu_pct":18.31,"tor_mem":"98.29MiB"}
+{"ts":1781879899,"arm":"clearnet","reward_share":1.680,"avg_effort":102.035,"cur_effort":152.627,"hashrate_1h":275761,"hashrate_24h":269926,"shares_found":105,"shares_failed":0,"last_share":1781878880,"peers_out":10,"peers_in":0,"peer_list":474,"pool_hr":17047153,"sidechain_diff":170471536,"tor_cpu_pct":1.09,"tor_mem":"98.05MiB"}
+{"ts":1781880200,"arm":"clearnet","reward_share":1.682,"avg_effort":102.702,"cur_effort":21.603,"hashrate_1h":269416,"hashrate_24h":269829,"shares_found":106,"shares_failed":0,"last_share":1781880051,"peers_out":10,"peers_in":0,"peer_list":473,"pool_hr":17062003,"sidechain_diff":170620030,"tor_cpu_pct":22.92,"tor_mem":"98.11MiB"}
+{"ts":1781880501,"arm":"clearnet","reward_share":1.681,"avg_effort":102.702,"cur_effort":73.465,"hashrate_1h":272450,"hashrate_24h":269879,"shares_found":106,"shares_failed":0,"last_share":1781880051,"peers_out":10,"peers_in":0,"peer_list":471,"pool_hr":17054663,"sidechain_diff":170546636,"tor_cpu_pct":26.62,"tor_mem":"97.83MiB"}
+{"ts":1781880802,"arm":"clearnet","reward_share":1.727,"avg_effort":102.458,"cur_effort":50.503,"hashrate_1h":272866,"hashrate_24h":270019,"shares_found":107,"shares_failed":0,"last_share":1781880523,"peers_out":10,"peers_in":0,"peer_list":473,"pool_hr":17079461,"sidechain_diff":170794619,"tor_cpu_pct":35.08,"tor_mem":"97.57MiB"}
+{"ts":1781881104,"arm":"clearnet","reward_share":1.820,"avg_effort":101.341,"cur_effort":12.022,"hashrate_1h":270247,"hashrate_24h":269939,"shares_found":109,"shares_failed":0,"last_share":1781881039,"peers_out":10,"peers_in":0,"peer_list":467,"pool_hr":17074108,"sidechain_diff":170741083,"tor_cpu_pct":27.36,"tor_mem":"97.41MiB"}
+{"ts":1781881405,"arm":"clearnet","reward_share":1.819,"avg_effort":100.740,"cur_effort":17.201,"hashrate_1h":264649,"hashrate_24h":269769,"shares_found":110,"shares_failed":0,"last_share":1781881272,"peers_out":10,"peers_in":0,"peer_list":463,"pool_hr":17000969,"sidechain_diff":170009696,"tor_cpu_pct":1.4,"tor_mem":"97.27MiB"}
+{"ts":1781881706,"arm":"clearnet","reward_share":1.773,"avg_effort":100.740,"cur_effort":61.575,"hashrate_1h":264001,"hashrate_24h":269800,"shares_found":110,"shares_failed":0,"last_share":1781881272,"peers_out":10,"peers_in":0,"peer_list":462,"pool_hr":17516851,"sidechain_diff":175168513,"tor_cpu_pct":19.48,"tor_mem":"97.06MiB"}
+{"ts":1781882008,"arm":"clearnet","reward_share":1.726,"avg_effort":100.740,"cur_effort":112.879,"hashrate_1h":264246,"hashrate_24h":269831,"shares_found":110,"shares_failed":0,"last_share":1781881272,"peers_out":10,"peers_in":0,"peer_list":463,"pool_hr":17101426,"sidechain_diff":171014262,"tor_cpu_pct":18.65,"tor_mem":"96.44MiB"}
+{"ts":1781882309,"arm":"clearnet","reward_share":1.636,"avg_effort":100.740,"cur_effort":162.115,"hashrate_1h":263538,"hashrate_24h":269830,"shares_found":110,"shares_failed":0,"last_share":1781881272,"peers_out":10,"peers_in":0,"peer_list":459,"pool_hr":16897480,"sidechain_diff":168974800,"tor_cpu_pct":17.34,"tor_mem":"96.28MiB"}
+{"ts":1781882610,"arm":"clearnet","reward_share":1.681,"avg_effort":101.715,"cur_effort":4.278,"hashrate_1h":266785,"hashrate_24h":269899,"shares_found":111,"shares_failed":0,"last_share":1781882577,"peers_out":10,"peers_in":0,"peer_list":458,"pool_hr":16871372,"sidechain_diff":168713725,"tor_cpu_pct":21.44,"tor_mem":"96.1MiB"}
+{"ts":1781882911,"arm":"clearnet","reward_share":1.679,"avg_effort":101.715,"cur_effort":46.028,"hashrate_1h":265026,"hashrate_24h":269740,"shares_found":111,"shares_failed":0,"last_share":1781882577,"peers_out":10,"peers_in":0,"peer_list":456,"pool_hr":17045629,"sidechain_diff":170456294,"tor_cpu_pct":16.55,"tor_mem":"95.94MiB"}
+{"ts":1781883213,"arm":"clearnet","reward_share":1.677,"avg_effort":101.715,"cur_effort":92.527,"hashrate_1h":270291,"hashrate_24h":269725,"shares_found":111,"shares_failed":0,"last_share":1781882577,"peers_out":10,"peers_in":0,"peer_list":455,"pool_hr":17368620,"sidechain_diff":173686208,"tor_cpu_pct":29.7,"tor_mem":"95.9MiB"}
+{"ts":1781883514,"arm":"clearnet","reward_share":1.675,"avg_effort":600.063,"cur_effort":19.655,"hashrate_1h":280450,"hashrate_24h":280450,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":545,"pool_hr":17056473,"sidechain_diff":170564733,"tor_cpu_pct":34.78,"tor_mem":"95.75MiB"}
+{"ts":1781955378,"arm":"clearnet","reward_share":1.000,"avg_effort":113.903,"cur_effort":13.830,"hashrate_1h":265265,"hashrate_24h":268526,"shares_found":76,"shares_failed":0,"last_share":1781955264,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":10000,"sidechain_diff":100000,"tor_cpu_pct":78.02,"tor_mem":"114.5MiB"}
+{"ts":1781955679,"arm":"clearnet","reward_share":1.001,"avg_effort":131.467,"cur_effort":37.175,"hashrate_1h":324819,"hashrate_24h":324819,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":24639427,"sidechain_diff":246394276,"tor_cpu_pct":100.21,"tor_mem":"117.5MiB"}
+{"ts":1781955980,"arm":"clearnet","reward_share":0.955,"avg_effort":131.467,"cur_effort":72.674,"hashrate_1h":313598,"hashrate_24h":313598,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":24970592,"sidechain_diff":249705924,"tor_cpu_pct":44.07,"tor_mem":"116.1MiB"}
+{"ts":1781956282,"arm":"clearnet","reward_share":0.955,"avg_effort":131.467,"cur_effort":102.195,"hashrate_1h":290050,"hashrate_24h":290050,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":731,"pool_hr":24639572,"sidechain_diff":246395722,"tor_cpu_pct":54.65,"tor_mem":"115.5MiB"}
+{"ts":1781956583,"arm":"clearnet","reward_share":0.910,"avg_effort":131.467,"cur_effort":137.087,"hashrate_1h":286771,"hashrate_24h":286771,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":755,"pool_hr":24609128,"sidechain_diff":246091283,"tor_cpu_pct":38.87,"tor_mem":"115.5MiB"}
+{"ts":1781956884,"arm":"clearnet","reward_share":0.910,"avg_effort":131.467,"cur_effort":173.492,"hashrate_1h":289372,"hashrate_24h":289372,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":784,"pool_hr":24603002,"sidechain_diff":246030027,"tor_cpu_pct":53.18,"tor_mem":"115.8MiB"}
+{"ts":1781957185,"arm":"clearnet","reward_share":0.956,"avg_effort":195.485,"cur_effort":6.806,"hashrate_1h":279442,"hashrate_24h":279442,"shares_found":1,"shares_failed":0,"last_share":1781957084,"peers_out":10,"peers_in":0,"peer_list":800,"pool_hr":24600617,"sidechain_diff":246006172,"tor_cpu_pct":34.77,"tor_mem":"116.2MiB"}
+{"ts":1781957487,"arm":"clearnet","reward_share":0.956,"avg_effort":195.485,"cur_effort":45.201,"hashrate_1h":285744,"hashrate_24h":285744,"shares_found":1,"shares_failed":0,"last_share":1781957084,"peers_out":10,"peers_in":0,"peer_list":809,"pool_hr":24531341,"sidechain_diff":245313414,"tor_cpu_pct":35.79,"tor_mem":"116.7MiB"}
+{"ts":1781957788,"arm":"clearnet","reward_share":1.003,"avg_effort":135.807,"cur_effort":2.965,"hashrate_1h":282911,"hashrate_24h":282911,"shares_found":2,"shares_failed":0,"last_share":1781957742,"peers_out":10,"peers_in":0,"peer_list":813,"pool_hr":24722554,"sidechain_diff":247225545,"tor_cpu_pct":18.47,"tor_mem":"117MiB"}
+{"ts":1781958089,"arm":"clearnet","reward_share":1.050,"avg_effort":98.820,"cur_effort":5.362,"hashrate_1h":276692,"hashrate_24h":276692,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":818,"pool_hr":24654773,"sidechain_diff":246547737,"tor_cpu_pct":35.59,"tor_mem":"116.8MiB"}
+{"ts":1781958390,"arm":"clearnet","reward_share":1.050,"avg_effort":98.820,"cur_effort":37.516,"hashrate_1h":274962,"hashrate_24h":274962,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":819,"pool_hr":24778494,"sidechain_diff":247784949,"tor_cpu_pct":34.68,"tor_mem":"116.8MiB"}
+{"ts":1781958692,"arm":"clearnet","reward_share":1.004,"avg_effort":98.820,"cur_effort":64.557,"hashrate_1h":271119,"hashrate_24h":271119,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":821,"pool_hr":24592514,"sidechain_diff":245925145,"tor_cpu_pct":24.43,"tor_mem":"117MiB"}
+{"ts":1781958993,"arm":"clearnet","reward_share":1.004,"avg_effort":98.820,"cur_effort":103.638,"hashrate_1h":275590,"hashrate_24h":275590,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":24654813,"sidechain_diff":246548130,"tor_cpu_pct":31.73,"tor_mem":"116.9MiB"}
+{"ts":1781959294,"arm":"clearnet","reward_share":0.912,"avg_effort":98.820,"cur_effort":134.573,"hashrate_1h":269103,"hashrate_24h":273677,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":604,"pool_hr":24882819,"sidechain_diff":248828192,"tor_cpu_pct":29.92,"tor_mem":"117.1MiB"}
+{"ts":1781959595,"arm":"clearnet","reward_share":0.912,"avg_effort":98.820,"cur_effort":164.143,"hashrate_1h":265541,"hashrate_24h":272359,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":602,"pool_hr":24895039,"sidechain_diff":248950390,"tor_cpu_pct":25.67,"tor_mem":"117.7MiB"}
+{"ts":1781959897,"arm":"clearnet","reward_share":0.911,"avg_effort":98.820,"cur_effort":194.223,"hashrate_1h":265093,"hashrate_24h":269977,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":602,"pool_hr":24725631,"sidechain_diff":247256317,"tor_cpu_pct":32.13,"tor_mem":"117.5MiB"}
+{"ts":1781960198,"arm":"clearnet","reward_share":0.911,"avg_effort":98.820,"cur_effort":228.792,"hashrate_1h":266532,"hashrate_24h":272234,"shares_found":3,"shares_failed":0,"last_share":1781958018,"peers_out":10,"peers_in":0,"peer_list":606,"pool_hr":25217341,"sidechain_diff":252173413,"tor_cpu_pct":19.68,"tor_mem":"117.6MiB"}
+{"ts":1781960499,"arm":"clearnet","reward_share":0.958,"avg_effort":110.638,"cur_effort":7.198,"hashrate_1h":266236,"hashrate_24h":272626,"shares_found":5,"shares_failed":0,"last_share":1781960428,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":24694834,"sidechain_diff":246948347,"tor_cpu_pct":28.65,"tor_mem":"117.8MiB"}
+{"ts":1781960800,"arm":"clearnet","reward_share":0.958,"avg_effort":110.638,"cur_effort":39.857,"hashrate_1h":269182,"hashrate_24h":272878,"shares_found":5,"shares_failed":0,"last_share":1781960428,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":24706121,"sidechain_diff":247061214,"tor_cpu_pct":29.09,"tor_mem":"118.1MiB"}
+{"ts":1781961102,"arm":"clearnet","reward_share":0.912,"avg_effort":110.638,"cur_effort":76.785,"hashrate_1h":267155,"hashrate_24h":273691,"shares_found":5,"shares_failed":0,"last_share":1781960428,"peers_out":10,"peers_in":0,"peer_list":606,"pool_hr":24690384,"sidechain_diff":246903847,"tor_cpu_pct":34.48,"tor_mem":"118.5MiB"}
+{"ts":1781961403,"arm":"clearnet","reward_share":0.859,"avg_effort":110.638,"cur_effort":107.922,"hashrate_1h":266467,"hashrate_24h":273185,"shares_found":5,"shares_failed":0,"last_share":1781960428,"peers_out":10,"peers_in":0,"peer_list":611,"pool_hr":24997636,"sidechain_diff":249976366,"tor_cpu_pct":41.7,"tor_mem":"97.83MiB"}
+{"ts":1781961704,"arm":"clearnet","reward_share":0.859,"avg_effort":110.638,"cur_effort":145.835,"hashrate_1h":270707,"hashrate_24h":274273,"shares_found":5,"shares_failed":0,"last_share":1781960428,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":24571431,"sidechain_diff":245714316,"tor_cpu_pct":27.02,"tor_mem":"98.18MiB"}
+{"ts":1781962005,"arm":"clearnet","reward_share":0.860,"avg_effort":110.638,"cur_effort":184.205,"hashrate_1h":277729,"hashrate_24h":276423,"shares_found":5,"shares_failed":0,"last_share":1781960428,"peers_out":10,"peers_in":0,"peer_list":634,"pool_hr":24543068,"sidechain_diff":245430687,"tor_cpu_pct":32.9,"tor_mem":"98.27MiB"}
+{"ts":1781962307,"arm":"clearnet","reward_share":0.951,"avg_effort":109.302,"cur_effort":3.215,"hashrate_1h":277523,"hashrate_24h":275087,"shares_found":7,"shares_failed":0,"last_share":1781962271,"peers_out":10,"peers_in":0,"peer_list":640,"pool_hr":24684304,"sidechain_diff":246843044,"tor_cpu_pct":13.23,"tor_mem":"98.22MiB"}
+{"ts":1781962608,"arm":"clearnet","reward_share":0.950,"avg_effort":109.302,"cur_effort":30.382,"hashrate_1h":270458,"hashrate_24h":272859,"shares_found":7,"shares_failed":0,"last_share":1781962271,"peers_out":10,"peers_in":0,"peer_list":645,"pool_hr":24565373,"sidechain_diff":245653739,"tor_cpu_pct":25.4,"tor_mem":"98.13MiB"}
+{"ts":1781962909,"arm":"clearnet","reward_share":0.950,"avg_effort":102.555,"cur_effort":17.033,"hashrate_1h":278174,"hashrate_24h":275856,"shares_found":8,"shares_failed":0,"last_share":1781962759,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":24484180,"sidechain_diff":244841809,"tor_cpu_pct":38.23,"tor_mem":"98.25MiB"}
+{"ts":1781963210,"arm":"clearnet","reward_share":0.950,"avg_effort":102.555,"cur_effort":50.658,"hashrate_1h":280405,"hashrate_24h":275508,"shares_found":8,"shares_failed":0,"last_share":1781962759,"peers_out":10,"peers_in":0,"peer_list":655,"pool_hr":24419574,"sidechain_diff":244195741,"tor_cpu_pct":17.08,"tor_mem":"98.36MiB"}
+{"ts":1781963512,"arm":"clearnet","reward_share":0.950,"avg_effort":102.555,"cur_effort":84.170,"hashrate_1h":283453,"hashrate_24h":275960,"shares_found":8,"shares_failed":0,"last_share":1781962759,"peers_out":10,"peers_in":0,"peer_list":655,"pool_hr":24667074,"sidechain_diff":246670746,"tor_cpu_pct":26.82,"tor_mem":"97.7MiB"}
+{"ts":1781963813,"arm":"clearnet","reward_share":0.950,"avg_effort":102.555,"cur_effort":127.310,"hashrate_1h":284641,"hashrate_24h":277897,"shares_found":8,"shares_failed":0,"last_share":1781962759,"peers_out":10,"peers_in":0,"peer_list":655,"pool_hr":24573173,"sidechain_diff":245731735,"tor_cpu_pct":17.61,"tor_mem":"97.89MiB"}
+{"ts":1781964114,"arm":"clearnet","reward_share":0.996,"avg_effort":105.403,"cur_effort":33.273,"hashrate_1h":286270,"hashrate_24h":278031,"shares_found":9,"shares_failed":0,"last_share":1781963828,"peers_out":10,"peers_in":0,"peer_list":644,"pool_hr":24445140,"sidechain_diff":244451405,"tor_cpu_pct":23.76,"tor_mem":"97.6MiB"}
+{"ts":1781964415,"arm":"clearnet","reward_share":0.995,"avg_effort":105.403,"cur_effort":61.584,"hashrate_1h":282665,"hashrate_24h":277029,"shares_found":9,"shares_failed":0,"last_share":1781963828,"peers_out":10,"peers_in":0,"peer_list":641,"pool_hr":24929223,"sidechain_diff":249292234,"tor_cpu_pct":20.49,"tor_mem":"97.31MiB"}
+{"ts":1781964717,"arm":"clearnet","reward_share":0.994,"avg_effort":105.403,"cur_effort":95.727,"hashrate_1h":282161,"hashrate_24h":276964,"shares_found":9,"shares_failed":0,"last_share":1781963828,"peers_out":10,"peers_in":0,"peer_list":630,"pool_hr":24491205,"sidechain_diff":244912059,"tor_cpu_pct":25.17,"tor_mem":"97.3MiB"}
+{"ts":1781965018,"arm":"clearnet","reward_share":0.996,"avg_effort":105.403,"cur_effort":131.798,"hashrate_1h":283050,"hashrate_24h":276905,"shares_found":9,"shares_failed":0,"last_share":1781963828,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":24123786,"sidechain_diff":241237869,"tor_cpu_pct":21.67,"tor_mem":"97.27MiB"}
+{"ts":1781965319,"arm":"clearnet","reward_share":0.996,"avg_effort":105.403,"cur_effort":164.938,"hashrate_1h":280869,"hashrate_24h":276628,"shares_found":9,"shares_failed":0,"last_share":1781963828,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":24313498,"sidechain_diff":243134986,"tor_cpu_pct":20.06,"tor_mem":"97.18MiB"}
+{"ts":1781965620,"arm":"clearnet","reward_share":0.996,"avg_effort":105.403,"cur_effort":198.892,"hashrate_1h":274742,"hashrate_24h":275927,"shares_found":9,"shares_failed":0,"last_share":1781963828,"peers_out":10,"peers_in":0,"peer_list":604,"pool_hr":23922471,"sidechain_diff":239224718,"tor_cpu_pct":34.38,"tor_mem":"97.64MiB"}
+{"ts":1781965922,"arm":"clearnet","reward_share":1.086,"avg_effort":106.934,"cur_effort":2.348,"hashrate_1h":274798,"hashrate_24h":274968,"shares_found":11,"shares_failed":0,"last_share":1781965894,"peers_out":10,"peers_in":0,"peer_list":604,"pool_hr":23808799,"sidechain_diff":238087999,"tor_cpu_pct":19.06,"tor_mem":"97.15MiB"}
+{"ts":1781966223,"arm":"clearnet","reward_share":1.086,"avg_effort":106.934,"cur_effort":34.226,"hashrate_1h":277772,"hashrate_24h":274597,"shares_found":11,"shares_failed":0,"last_share":1781965894,"peers_out":10,"peers_in":0,"peer_list":606,"pool_hr":23789189,"sidechain_diff":237891892,"tor_cpu_pct":15.02,"tor_mem":"97.39MiB"}
+{"ts":1781966524,"arm":"clearnet","reward_share":1.085,"avg_effort":106.934,"cur_effort":76.091,"hashrate_1h":276676,"hashrate_24h":275839,"shares_found":11,"shares_failed":0,"last_share":1781965894,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":23945252,"sidechain_diff":239452524,"tor_cpu_pct":32.45,"tor_mem":"97.29MiB"}
+{"ts":1781966825,"arm":"clearnet","reward_share":1.087,"avg_effort":106.934,"cur_effort":108.002,"hashrate_1h":275024,"hashrate_24h":275351,"shares_found":11,"shares_failed":0,"last_share":1781965894,"peers_out":10,"peers_in":0,"peer_list":606,"pool_hr":24016387,"sidechain_diff":240163873,"tor_cpu_pct":26.72,"tor_mem":"97.18MiB"}
+{"ts":1781967127,"arm":"clearnet","reward_share":1.087,"avg_effort":106.934,"cur_effort":140.306,"hashrate_1h":270934,"hashrate_24h":274810,"shares_found":11,"shares_failed":0,"last_share":1781965894,"peers_out":10,"peers_in":0,"peer_list":610,"pool_hr":23943648,"sidechain_diff":239436487,"tor_cpu_pct":38.14,"tor_mem":"97.25MiB"}
+{"ts":1781967428,"arm":"clearnet","reward_share":1.132,"avg_effort":111.915,"cur_effort":1.834,"hashrate_1h":264925,"hashrate_24h":273840,"shares_found":12,"shares_failed":0,"last_share":1781967393,"peers_out":10,"peers_in":0,"peer_list":608,"pool_hr":23963859,"sidechain_diff":239638594,"tor_cpu_pct":24.28,"tor_mem":"97.34MiB"}
+{"ts":1781967729,"arm":"clearnet","reward_share":1.177,"avg_effort":104.404,"cur_effort":22.990,"hashrate_1h":263105,"hashrate_24h":273717,"shares_found":13,"shares_failed":0,"last_share":1781967525,"peers_out":10,"peers_in":0,"peer_list":612,"pool_hr":23859395,"sidechain_diff":238593951,"tor_cpu_pct":26.98,"tor_mem":"97.19MiB"}
+{"ts":1781968030,"arm":"clearnet","reward_share":1.177,"avg_effort":104.404,"cur_effort":57.177,"hashrate_1h":264225,"hashrate_24h":273493,"shares_found":13,"shares_failed":0,"last_share":1781967525,"peers_out":10,"peers_in":0,"peer_list":609,"pool_hr":23589381,"sidechain_diff":235893812,"tor_cpu_pct":23.67,"tor_mem":"97.29MiB"}
+{"ts":1781968332,"arm":"clearnet","reward_share":1.221,"avg_effort":101.932,"cur_effort":18.533,"hashrate_1h":262373,"hashrate_24h":272965,"shares_found":14,"shares_failed":0,"last_share":1781968128,"peers_out":10,"peers_in":0,"peer_list":610,"pool_hr":24822493,"sidechain_diff":248224934,"tor_cpu_pct":26.66,"tor_mem":"97.49MiB"}
+{"ts":1781968633,"arm":"clearnet","reward_share":1.221,"avg_effort":101.932,"cur_effort":50.164,"hashrate_1h":259651,"hashrate_24h":272495,"shares_found":14,"shares_failed":0,"last_share":1781968128,"peers_out":10,"peers_in":0,"peer_list":612,"pool_hr":23973516,"sidechain_diff":239735162,"tor_cpu_pct":29.93,"tor_mem":"97.13MiB"}
+{"ts":1781968934,"arm":"clearnet","reward_share":1.175,"avg_effort":101.932,"cur_effort":94.185,"hashrate_1h":265390,"hashrate_24h":273707,"shares_found":14,"shares_failed":0,"last_share":1781968128,"peers_out":10,"peers_in":0,"peer_list":614,"pool_hr":23532630,"sidechain_diff":235326305,"tor_cpu_pct":18.76,"tor_mem":"97.13MiB"}
+{"ts":1781969235,"arm":"clearnet","reward_share":1.175,"avg_effort":101.932,"cur_effort":123.088,"hashrate_1h":262782,"hashrate_24h":272626,"shares_found":14,"shares_failed":0,"last_share":1781968128,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":23548808,"sidechain_diff":235488080,"tor_cpu_pct":24.44,"tor_mem":"97.31MiB"}
+{"ts":1781969537,"arm":"clearnet","reward_share":1.176,"avg_effort":105.269,"cur_effort":5.829,"hashrate_1h":268078,"hashrate_24h":273134,"shares_found":15,"shares_failed":0,"last_share":1781969480,"peers_out":10,"peers_in":0,"peer_list":615,"pool_hr":23957777,"sidechain_diff":239577778,"tor_cpu_pct":20.45,"tor_mem":"97.22MiB"}
+{"ts":1781969838,"arm":"clearnet","reward_share":1.220,"avg_effort":99.629,"cur_effort":22.511,"hashrate_1h":267582,"hashrate_24h":272739,"shares_found":16,"shares_failed":0,"last_share":1781969656,"peers_out":10,"peers_in":0,"peer_list":615,"pool_hr":24172548,"sidechain_diff":241725483,"tor_cpu_pct":22.27,"tor_mem":"97.03MiB"}
+{"ts":1781970139,"arm":"clearnet","reward_share":1.220,"avg_effort":99.629,"cur_effort":57.895,"hashrate_1h":263188,"hashrate_24h":272648,"shares_found":16,"shares_failed":0,"last_share":1781969656,"peers_out":10,"peers_in":0,"peer_list":617,"pool_hr":23523996,"sidechain_diff":235239968,"tor_cpu_pct":18.24,"tor_mem":"96.93MiB"}
+{"ts":1781970440,"arm":"clearnet","reward_share":1.131,"avg_effort":99.629,"cur_effort":90.371,"hashrate_1h":262206,"hashrate_24h":272304,"shares_found":16,"shares_failed":0,"last_share":1781969656,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":23374698,"sidechain_diff":233746980,"tor_cpu_pct":17.21,"tor_mem":"96.91MiB"}
+{"ts":1781970742,"arm":"clearnet","reward_share":1.132,"avg_effort":99.629,"cur_effort":123.291,"hashrate_1h":263234,"hashrate_24h":272136,"shares_found":16,"shares_failed":0,"last_share":1781969656,"peers_out":10,"peers_in":0,"peer_list":618,"pool_hr":23466817,"sidechain_diff":234668175,"tor_cpu_pct":23.03,"tor_mem":"97.39MiB"}
+{"ts":1781971043,"arm":"clearnet","reward_share":1.089,"avg_effort":99.629,"cur_effort":150.169,"hashrate_1h":261193,"hashrate_24h":270998,"shares_found":16,"shares_failed":0,"last_share":1781969656,"peers_out":10,"peers_in":0,"peer_list":620,"pool_hr":23675595,"sidechain_diff":236755956,"tor_cpu_pct":0.92,"tor_mem":"96.64MiB"}
+{"ts":1781971344,"arm":"clearnet","reward_share":1.176,"avg_effort":93.753,"cur_effort":8.405,"hashrate_1h":266606,"hashrate_24h":271924,"shares_found":19,"shares_failed":0,"last_share":1781971266,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":23409992,"sidechain_diff":234099925,"tor_cpu_pct":19.22,"tor_mem":"95.8MiB"}
+{"ts":1781971645,"arm":"clearnet","reward_share":1.175,"avg_effort":89.876,"cur_effort":33.931,"hashrate_1h":269714,"hashrate_24h":272470,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":614,"pool_hr":23448286,"sidechain_diff":234482862,"tor_cpu_pct":22.8,"tor_mem":"95.84MiB"}
+{"ts":1781971947,"arm":"clearnet","reward_share":1.130,"avg_effort":89.876,"cur_effort":63.185,"hashrate_1h":265647,"hashrate_24h":271501,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":612,"pool_hr":23509098,"sidechain_diff":235090986,"tor_cpu_pct":16.78,"tor_mem":"95.62MiB"}
+{"ts":1781972248,"arm":"clearnet","reward_share":1.042,"avg_effort":89.876,"cur_effort":105.472,"hashrate_1h":273161,"hashrate_24h":272658,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":612,"pool_hr":23518786,"sidechain_diff":235187863,"tor_cpu_pct":16.02,"tor_mem":"94.98MiB"}
+{"ts":1781972549,"arm":"clearnet","reward_share":1.041,"avg_effort":89.876,"cur_effort":137.125,"hashrate_1h":266193,"hashrate_24h":272118,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":23484669,"sidechain_diff":234846697,"tor_cpu_pct":24.73,"tor_mem":"95.07MiB"}
+{"ts":1781972850,"arm":"clearnet","reward_share":1.041,"avg_effort":89.876,"cur_effort":176.104,"hashrate_1h":272776,"hashrate_24h":272703,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":610,"pool_hr":23529175,"sidechain_diff":235291755,"tor_cpu_pct":15.68,"tor_mem":"94.56MiB"}
+{"ts":1781973152,"arm":"clearnet","reward_share":1.041,"avg_effort":89.876,"cur_effort":214.351,"hashrate_1h":273900,"hashrate_24h":273246,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":607,"pool_hr":23443978,"sidechain_diff":234439784,"tor_cpu_pct":20.96,"tor_mem":"94.54MiB"}
+{"ts":1781973453,"arm":"clearnet","reward_share":1.040,"avg_effort":89.876,"cur_effort":245.660,"hashrate_1h":271136,"hashrate_24h":272412,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":607,"pool_hr":23336949,"sidechain_diff":233369499,"tor_cpu_pct":20.1,"tor_mem":"94.38MiB"}
+{"ts":1781973754,"arm":"clearnet","reward_share":1.040,"avg_effort":89.876,"cur_effort":274.985,"hashrate_1h":269397,"hashrate_24h":271951,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":608,"pool_hr":23371332,"sidechain_diff":233713322,"tor_cpu_pct":17.79,"tor_mem":"94.2MiB"}
+{"ts":1781974055,"arm":"clearnet","reward_share":1.041,"avg_effort":89.876,"cur_effort":314.110,"hashrate_1h":271726,"hashrate_24h":272278,"shares_found":20,"shares_failed":0,"last_share":1781971381,"peers_out":10,"peers_in":0,"peer_list":612,"pool_hr":23284294,"sidechain_diff":232842946,"tor_cpu_pct":27.53,"tor_mem":"94.4MiB"}
+{"ts":1781974357,"arm":"clearnet","reward_share":1.129,"avg_effort":97.256,"cur_effort":1.220,"hashrate_1h":274171,"hashrate_24h":272332,"shares_found":22,"shares_failed":0,"last_share":1781974324,"peers_out":10,"peers_in":0,"peer_list":610,"pool_hr":23366154,"sidechain_diff":233661546,"tor_cpu_pct":26.44,"tor_mem":"94.21MiB"}
+{"ts":1781974658,"arm":"clearnet","reward_share":1.262,"avg_effort":87.120,"cur_effort":1.409,"hashrate_1h":276076,"hashrate_24h":272045,"shares_found":25,"shares_failed":0,"last_share":1781974611,"peers_out":10,"peers_in":0,"peer_list":614,"pool_hr":23521451,"sidechain_diff":235214511,"tor_cpu_pct":17.43,"tor_mem":"93.96MiB"}
+{"ts":1781974959,"arm":"clearnet","reward_share":1.306,"avg_effort":84.087,"cur_effort":25.549,"hashrate_1h":268728,"hashrate_24h":271392,"shares_found":26,"shares_failed":0,"last_share":1781974684,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":23835643,"sidechain_diff":238356439,"tor_cpu_pct":22.05,"tor_mem":"94.12MiB"}
+{"ts":1781975260,"arm":"clearnet","reward_share":1.305,"avg_effort":84.087,"cur_effort":57.803,"hashrate_1h":264617,"hashrate_24h":270990,"shares_found":26,"shares_failed":0,"last_share":1781974684,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":23593877,"sidechain_diff":235938772,"tor_cpu_pct":14.73,"tor_mem":"93.78MiB"}
+{"ts":1781975562,"arm":"clearnet","reward_share":1.306,"avg_effort":84.087,"cur_effort":91.273,"hashrate_1h":266938,"hashrate_24h":270777,"shares_found":26,"shares_failed":0,"last_share":1781974684,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":23461025,"sidechain_diff":234610259,"tor_cpu_pct":22.7,"tor_mem":"93.71MiB"}
+{"ts":1781975863,"arm":"clearnet","reward_share":1.306,"avg_effort":84.087,"cur_effort":123.198,"hashrate_1h":261512,"hashrate_24h":270612,"shares_found":26,"shares_failed":0,"last_share":1781974684,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":23593462,"sidechain_diff":235934628,"tor_cpu_pct":22.99,"tor_mem":"93.63MiB"}
+{"ts":1781976164,"arm":"clearnet","reward_share":1.304,"avg_effort":84.087,"cur_effort":155.107,"hashrate_1h":263523,"hashrate_24h":270602,"shares_found":26,"shares_failed":0,"last_share":1781974684,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":23800285,"sidechain_diff":238002857,"tor_cpu_pct":31.22,"tor_mem":"94.86MiB"}
+{"ts":1781976465,"arm":"clearnet","reward_share":1.394,"avg_effort":84.666,"cur_effort":7.961,"hashrate_1h":262732,"hashrate_24h":270961,"shares_found":28,"shares_failed":0,"last_share":1781976342,"peers_out":10,"peers_in":0,"peer_list":618,"pool_hr":23263146,"sidechain_diff":232631460,"tor_cpu_pct":43.06,"tor_mem":"94.7MiB"}
+{"ts":1781976767,"arm":"clearnet","reward_share":1.350,"avg_effort":84.666,"cur_effort":43.501,"hashrate_1h":259320,"hashrate_24h":270903,"shares_found":28,"shares_failed":0,"last_share":1781976342,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":22997536,"sidechain_diff":229975369,"tor_cpu_pct":26.17,"tor_mem":"94.72MiB"}
+{"ts":1781977068,"arm":"clearnet","reward_share":1.394,"avg_effort":84.223,"cur_effort":1.773,"hashrate_1h":258237,"hashrate_24h":270148,"shares_found":29,"shares_failed":0,"last_share":1781977014,"peers_out":10,"peers_in":0,"peer_list":620,"pool_hr":23086678,"sidechain_diff":230866783,"tor_cpu_pct":22.84,"tor_mem":"95.02MiB"}
+{"ts":1781977369,"arm":"clearnet","reward_share":1.439,"avg_effort":81.738,"cur_effort":34.744,"hashrate_1h":263990,"hashrate_24h":270746,"shares_found":30,"shares_failed":0,"last_share":1781977129,"peers_out":10,"peers_in":0,"peer_list":624,"pool_hr":23405487,"sidechain_diff":234054878,"tor_cpu_pct":28.79,"tor_mem":"94.8MiB"}
+{"ts":1781977670,"arm":"clearnet","reward_share":1.393,"avg_effort":81.738,"cur_effort":72.213,"hashrate_1h":264713,"hashrate_24h":270953,"shares_found":30,"shares_failed":0,"last_share":1781977129,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":22860522,"sidechain_diff":228605226,"tor_cpu_pct":19.41,"tor_mem":"95.06MiB"}
+{"ts":1781977972,"arm":"clearnet","reward_share":1.394,"avg_effort":81.738,"cur_effort":108.952,"hashrate_1h":264904,"hashrate_24h":270900,"shares_found":30,"shares_failed":0,"last_share":1781977129,"peers_out":10,"peers_in":0,"peer_list":619,"pool_hr":22843929,"sidechain_diff":228439295,"tor_cpu_pct":25.12,"tor_mem":"95.02MiB"}
+{"ts":1781978273,"arm":"clearnet","reward_share":1.349,"avg_effort":81.738,"cur_effort":149.415,"hashrate_1h":268695,"hashrate_24h":271436,"shares_found":30,"shares_failed":0,"last_share":1781977129,"peers_out":10,"peers_in":0,"peer_list":617,"pool_hr":22917743,"sidechain_diff":229177432,"tor_cpu_pct":20.13,"tor_mem":"94.79MiB"}
+{"ts":1781978574,"arm":"clearnet","reward_share":1.349,"avg_effort":81.738,"cur_effort":183.308,"hashrate_1h":271909,"hashrate_24h":271394,"shares_found":30,"shares_failed":0,"last_share":1781977129,"peers_out":10,"peers_in":0,"peer_list":617,"pool_hr":23083242,"sidechain_diff":230832423,"tor_cpu_pct":19.65,"tor_mem":"94.78MiB"}
+{"ts":1781978875,"arm":"clearnet","reward_share":1.445,"avg_effort":82.512,"cur_effort":38.907,"hashrate_1h":279424,"hashrate_24h":272295,"shares_found":32,"shares_failed":0,"last_share":1781978614,"peers_out":10,"peers_in":0,"peer_list":619,"pool_hr":22903091,"sidechain_diff":229030916,"tor_cpu_pct":34.05,"tor_mem":"94.9MiB"}
+{"ts":1781979177,"arm":"clearnet","reward_share":1.525,"avg_effort":79.495,"cur_effort":14.314,"hashrate_1h":280857,"hashrate_24h":272176,"shares_found":34,"shares_failed":0,"last_share":1781979050,"peers_out":10,"peers_in":0,"peer_list":622,"pool_hr":22910408,"sidechain_diff":229104089,"tor_cpu_pct":0.36,"tor_mem":"94.74MiB"}
+{"ts":1781979478,"arm":"clearnet","reward_share":1.525,"avg_effort":79.495,"cur_effort":47.513,"hashrate_1h":281259,"hashrate_24h":272038,"shares_found":34,"shares_failed":0,"last_share":1781979050,"peers_out":10,"peers_in":0,"peer_list":622,"pool_hr":22986667,"sidechain_diff":229866678,"tor_cpu_pct":19.64,"tor_mem":"94.93MiB"}
+{"ts":1781979779,"arm":"clearnet","reward_share":1.527,"avg_effort":79.495,"cur_effort":81.278,"hashrate_1h":278037,"hashrate_24h":271796,"shares_found":34,"shares_failed":0,"last_share":1781979050,"peers_out":10,"peers_in":0,"peer_list":625,"pool_hr":23053115,"sidechain_diff":230531159,"tor_cpu_pct":2.68,"tor_mem":"94.68MiB"}
+{"ts":1781980080,"arm":"clearnet","reward_share":1.528,"avg_effort":79.495,"cur_effort":109.900,"hashrate_1h":275037,"hashrate_24h":271393,"shares_found":34,"shares_failed":0,"last_share":1781979050,"peers_out":10,"peers_in":0,"peer_list":623,"pool_hr":23226843,"sidechain_diff":232268438,"tor_cpu_pct":26.03,"tor_mem":"94.48MiB"}
+{"ts":1781980382,"arm":"clearnet","reward_share":1.482,"avg_effort":79.495,"cur_effort":136.781,"hashrate_1h":269348,"hashrate_24h":270648,"shares_found":34,"shares_failed":0,"last_share":1781979050,"peers_out":10,"peers_in":0,"peer_list":619,"pool_hr":23454555,"sidechain_diff":234545551,"tor_cpu_pct":19.62,"tor_mem":"94.41MiB"}
+{"ts":1781980683,"arm":"clearnet","reward_share":1.483,"avg_effort":79.495,"cur_effort":168.640,"hashrate_1h":273127,"hashrate_24h":270513,"shares_found":34,"shares_failed":0,"last_share":1781979050,"peers_out":10,"peers_in":0,"peer_list":619,"pool_hr":23589418,"sidechain_diff":235894180,"tor_cpu_pct":24.24,"tor_mem":"93.76MiB"}
+{"ts":1781980984,"arm":"clearnet","reward_share":1.526,"avg_effort":80.630,"cur_effort":9.977,"hashrate_1h":274364,"hashrate_24h":271176,"shares_found":36,"shares_failed":0,"last_share":1781980890,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":23596839,"sidechain_diff":235968391,"tor_cpu_pct":20.26,"tor_mem":"93.91MiB"}
+{"ts":1781981285,"arm":"clearnet","reward_share":1.480,"avg_effort":80.630,"cur_effort":40.725,"hashrate_1h":269445,"hashrate_24h":270767,"shares_found":36,"shares_failed":0,"last_share":1781980890,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":23060195,"sidechain_diff":230601951,"tor_cpu_pct":15.96,"tor_mem":"94.13MiB"}
+{"ts":1781981587,"arm":"clearnet","reward_share":1.568,"avg_effort":77.948,"cur_effort":25.208,"hashrate_1h":272977,"hashrate_24h":271070,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":622,"pool_hr":23206511,"sidechain_diff":232065117,"tor_cpu_pct":14.88,"tor_mem":"93.8MiB"}
+{"ts":1781981888,"arm":"clearnet","reward_share":1.569,"avg_effort":77.948,"cur_effort":58.970,"hashrate_1h":267305,"hashrate_24h":270925,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":623,"pool_hr":22919659,"sidechain_diff":229196593,"tor_cpu_pct":19.59,"tor_mem":"93.79MiB"}
+{"ts":1781982189,"arm":"clearnet","reward_share":1.571,"avg_effort":77.948,"cur_effort":93.304,"hashrate_1h":267774,"hashrate_24h":270766,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":624,"pool_hr":22750328,"sidechain_diff":227503287,"tor_cpu_pct":21.44,"tor_mem":"94.25MiB"}
+{"ts":1781982490,"arm":"clearnet","reward_share":1.573,"avg_effort":77.948,"cur_effort":132.578,"hashrate_1h":263162,"hashrate_24h":271098,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":623,"pool_hr":22821478,"sidechain_diff":228214785,"tor_cpu_pct":24.66,"tor_mem":"93.78MiB"}
+{"ts":1781982792,"arm":"clearnet","reward_share":1.575,"avg_effort":77.948,"cur_effort":161.749,"hashrate_1h":259512,"hashrate_24h":270545,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":634,"pool_hr":22897510,"sidechain_diff":228975100,"tor_cpu_pct":13.5,"tor_mem":"94.02MiB"}
+{"ts":1781983093,"arm":"clearnet","reward_share":1.577,"avg_effort":77.948,"cur_effort":198.152,"hashrate_1h":262089,"hashrate_24h":270640,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":642,"pool_hr":22745048,"sidechain_diff":227450482,"tor_cpu_pct":20.19,"tor_mem":"93.98MiB"}
+{"ts":1781983394,"arm":"clearnet","reward_share":1.484,"avg_effort":77.948,"cur_effort":232.581,"hashrate_1h":262578,"hashrate_24h":270611,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":652,"pool_hr":22825625,"sidechain_diff":228256251,"tor_cpu_pct":18.38,"tor_mem":"94MiB"}
+{"ts":1781983695,"arm":"clearnet","reward_share":1.485,"avg_effort":77.948,"cur_effort":264.192,"hashrate_1h":264294,"hashrate_24h":270563,"shares_found":38,"shares_failed":0,"last_share":1781981378,"peers_out":10,"peers_in":0,"peer_list":653,"pool_hr":23089723,"sidechain_diff":230897234,"tor_cpu_pct":1.36,"tor_mem":"93.62MiB"}
+{"ts":1781983997,"arm":"clearnet","reward_share":1.531,"avg_effort":82.856,"cur_effort":25.191,"hashrate_1h":270427,"hashrate_24h":270515,"shares_found":39,"shares_failed":0,"last_share":1781983768,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":23117728,"sidechain_diff":231177280,"tor_cpu_pct":23.78,"tor_mem":"94.63MiB"}
+{"ts":1781984298,"arm":"clearnet","reward_share":1.532,"avg_effort":82.856,"cur_effort":61.218,"hashrate_1h":269617,"hashrate_24h":270497,"shares_found":39,"shares_failed":0,"last_share":1781983768,"peers_out":10,"peers_in":0,"peer_list":654,"pool_hr":23118274,"sidechain_diff":231182745,"tor_cpu_pct":13.59,"tor_mem":"93.71MiB"}
+{"ts":1781984599,"arm":"clearnet","reward_share":1.576,"avg_effort":83.042,"cur_effort":2.295,"hashrate_1h":264155,"hashrate_24h":270277,"shares_found":40,"shares_failed":0,"last_share":1781984566,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":23172366,"sidechain_diff":231723665,"tor_cpu_pct":15.25,"tor_mem":"93.51MiB"}
+{"ts":1781984900,"arm":"clearnet","reward_share":1.529,"avg_effort":83.042,"cur_effort":37.333,"hashrate_1h":267418,"hashrate_24h":270372,"shares_found":40,"shares_failed":0,"last_share":1781984566,"peers_out":10,"peers_in":0,"peer_list":659,"pool_hr":23920510,"sidechain_diff":239205107,"tor_cpu_pct":11.29,"tor_mem":"92.23MiB"}
+{"ts":1781985202,"arm":"clearnet","reward_share":1.528,"avg_effort":82.672,"cur_effort":7.650,"hashrate_1h":267979,"hashrate_24h":270644,"shares_found":41,"shares_failed":0,"last_share":1781985139,"peers_out":10,"peers_in":0,"peer_list":659,"pool_hr":23687803,"sidechain_diff":236878037,"tor_cpu_pct":0.19,"tor_mem":"91.89MiB"}
+{"ts":1781985503,"arm":"clearnet","reward_share":1.529,"avg_effort":82.672,"cur_effort":36.799,"hashrate_1h":265150,"hashrate_24h":270252,"shares_found":41,"shares_failed":0,"last_share":1781985139,"peers_out":10,"peers_in":0,"peer_list":660,"pool_hr":23419717,"sidechain_diff":234197179,"tor_cpu_pct":18.83,"tor_mem":"91.79MiB"}
+{"ts":1781985804,"arm":"clearnet","reward_share":1.482,"avg_effort":82.672,"cur_effort":66.708,"hashrate_1h":260867,"hashrate_24h":269774,"shares_found":41,"shares_failed":0,"last_share":1781985139,"peers_out":10,"peers_in":0,"peer_list":653,"pool_hr":23377454,"sidechain_diff":233774544,"tor_cpu_pct":3,"tor_mem":"91.82MiB"}
+{"ts":1781986105,"arm":"clearnet","reward_share":1.483,"avg_effort":82.672,"cur_effort":99.243,"hashrate_1h":260046,"hashrate_24h":269762,"shares_found":41,"shares_failed":0,"last_share":1781985139,"peers_out":10,"peers_in":0,"peer_list":642,"pool_hr":23609748,"sidechain_diff":236097484,"tor_cpu_pct":1.93,"tor_mem":"91.73MiB"}
+{"ts":1781986407,"arm":"clearnet","reward_share":1.529,"avg_effort":83.516,"cur_effort":15.811,"hashrate_1h":262492,"hashrate_24h":269656,"shares_found":42,"shares_failed":0,"last_share":1781986223,"peers_out":10,"peers_in":0,"peer_list":629,"pool_hr":23344635,"sidechain_diff":233446359,"tor_cpu_pct":2.11,"tor_mem":"91.18MiB"}
+{"ts":1781986708,"arm":"clearnet","reward_share":1.484,"avg_effort":83.516,"cur_effort":45.431,"hashrate_1h":258514,"hashrate_24h":269332,"shares_found":42,"shares_failed":0,"last_share":1781986223,"peers_out":10,"peers_in":0,"peer_list":633,"pool_hr":23345194,"sidechain_diff":233451946,"tor_cpu_pct":10.32,"tor_mem":"91.02MiB"}
+{"ts":1781987009,"arm":"clearnet","reward_share":1.486,"avg_effort":83.516,"cur_effort":78.510,"hashrate_1h":258340,"hashrate_24h":269148,"shares_found":42,"shares_failed":0,"last_share":1781986223,"peers_out":10,"peers_in":0,"peer_list":630,"pool_hr":23263003,"sidechain_diff":232630037,"tor_cpu_pct":0.4,"tor_mem":"90.93MiB"}
+{"ts":1781987310,"arm":"clearnet","reward_share":1.488,"avg_effort":83.516,"cur_effort":120.810,"hashrate_1h":263548,"hashrate_24h":269728,"shares_found":42,"shares_failed":0,"last_share":1781986223,"peers_out":10,"peers_in":0,"peer_list":632,"pool_hr":23238619,"sidechain_diff":232386194,"tor_cpu_pct":0.28,"tor_mem":"90.81MiB"}
+{"ts":1781987612,"arm":"clearnet","reward_share":1.533,"avg_effort":84.837,"cur_effort":9.340,"hashrate_1h":258243,"hashrate_24h":269187,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":634,"pool_hr":23961999,"sidechain_diff":239619999,"tor_cpu_pct":16.71,"tor_mem":"90.75MiB"}
+{"ts":1781987913,"arm":"clearnet","reward_share":1.533,"avg_effort":84.837,"cur_effort":39.804,"hashrate_1h":256678,"hashrate_24h":268962,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":637,"pool_hr":23505324,"sidechain_diff":235053242,"tor_cpu_pct":14.5,"tor_mem":"90.82MiB"}
+{"ts":1781988214,"arm":"clearnet","reward_share":1.486,"avg_effort":84.837,"cur_effort":71.169,"hashrate_1h":257221,"hashrate_24h":268779,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":636,"pool_hr":23428600,"sidechain_diff":234286002,"tor_cpu_pct":26.08,"tor_mem":"91.06MiB"}
+{"ts":1781988515,"arm":"clearnet","reward_share":1.441,"avg_effort":84.837,"cur_effort":105.580,"hashrate_1h":253814,"hashrate_24h":268611,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":635,"pool_hr":23072910,"sidechain_diff":230729100,"tor_cpu_pct":22.26,"tor_mem":"91.04MiB"}
+{"ts":1781988817,"arm":"clearnet","reward_share":1.443,"avg_effort":84.837,"cur_effort":137.984,"hashrate_1h":251475,"hashrate_24h":268553,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":637,"pool_hr":23306455,"sidechain_diff":233064558,"tor_cpu_pct":21.94,"tor_mem":"90.82MiB"}
+{"ts":1781989118,"arm":"clearnet","reward_share":1.444,"avg_effort":84.837,"cur_effort":169.728,"hashrate_1h":252967,"hashrate_24h":268351,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":639,"pool_hr":23210821,"sidechain_diff":232108219,"tor_cpu_pct":27.72,"tor_mem":"90.93MiB"}
+{"ts":1781989419,"arm":"clearnet","reward_share":1.444,"avg_effort":84.837,"cur_effort":209.131,"hashrate_1h":258720,"hashrate_24h":268585,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":642,"pool_hr":23323778,"sidechain_diff":233237780,"tor_cpu_pct":23.64,"tor_mem":"90.86MiB"}
+{"ts":1781989720,"arm":"clearnet","reward_share":1.444,"avg_effort":84.837,"cur_effort":240.377,"hashrate_1h":256073,"hashrate_24h":268359,"shares_found":43,"shares_failed":0,"last_share":1781987504,"peers_out":10,"peers_in":0,"peer_list":642,"pool_hr":23163746,"sidechain_diff":231637467,"tor_cpu_pct":18.85,"tor_mem":"90.84MiB"}
+{"ts":1781990022,"arm":"clearnet","reward_share":1.397,"avg_effort":88.422,"cur_effort":32.134,"hashrate_1h":258106,"hashrate_24h":268472,"shares_found":44,"shares_failed":0,"last_share":1781989767,"peers_out":10,"peers_in":0,"peer_list":641,"pool_hr":23062899,"sidechain_diff":230628994,"tor_cpu_pct":20.03,"tor_mem":"90.87MiB"}
+{"ts":1781990323,"arm":"clearnet","reward_share":1.441,"avg_effort":87.872,"cur_effort":6.610,"hashrate_1h":262719,"hashrate_24h":268616,"shares_found":45,"shares_failed":0,"last_share":1781990245,"peers_out":10,"peers_in":0,"peer_list":640,"pool_hr":23052793,"sidechain_diff":230527933,"tor_cpu_pct":24.85,"tor_mem":"90.98MiB"}
+{"ts":1781990624,"arm":"clearnet","reward_share":1.395,"avg_effort":87.872,"cur_effort":38.006,"hashrate_1h":262725,"hashrate_24h":268476,"shares_found":45,"shares_failed":0,"last_share":1781990245,"peers_out":10,"peers_in":0,"peer_list":638,"pool_hr":23299089,"sidechain_diff":232990893,"tor_cpu_pct":26.66,"tor_mem":"91.09MiB"}
+{"ts":1781990925,"arm":"clearnet","reward_share":1.397,"avg_effort":87.872,"cur_effort":75.693,"hashrate_1h":258395,"hashrate_24h":268553,"shares_found":45,"shares_failed":0,"last_share":1781990245,"peers_out":10,"peers_in":0,"peer_list":639,"pool_hr":22866850,"sidechain_diff":228668506,"tor_cpu_pct":32.83,"tor_mem":"91.18MiB"}
+{"ts":1781991227,"arm":"clearnet","reward_share":1.398,"avg_effort":87.872,"cur_effort":115.025,"hashrate_1h":264854,"hashrate_24h":268810,"shares_found":45,"shares_failed":0,"last_share":1781990245,"peers_out":10,"peers_in":0,"peer_list":634,"pool_hr":23014505,"sidechain_diff":230145055,"tor_cpu_pct":32.56,"tor_mem":"91.3MiB"}
+{"ts":1781991528,"arm":"clearnet","reward_share":1.442,"avg_effort":88.742,"cur_effort":21.435,"hashrate_1h":267370,"hashrate_24h":268819,"shares_found":46,"shares_failed":0,"last_share":1781991369,"peers_out":10,"peers_in":0,"peer_list":633,"pool_hr":22999213,"sidechain_diff":229992130,"tor_cpu_pct":27.43,"tor_mem":"91.73MiB"}
+{"ts":1781991829,"arm":"clearnet","reward_share":1.487,"avg_effort":87.715,"cur_effort":19.603,"hashrate_1h":270463,"hashrate_24h":268990,"shares_found":47,"shares_failed":0,"last_share":1781991689,"peers_out":10,"peers_in":0,"peer_list":632,"pool_hr":23018673,"sidechain_diff":230186738,"tor_cpu_pct":19.35,"tor_mem":"91.54MiB"}
+{"ts":1781992130,"arm":"clearnet","reward_share":1.532,"avg_effort":84.811,"cur_effort":24.601,"hashrate_1h":271396,"hashrate_24h":268909,"shares_found":49,"shares_failed":0,"last_share":1781991881,"peers_out":10,"peers_in":0,"peer_list":634,"pool_hr":23545704,"sidechain_diff":235457042,"tor_cpu_pct":26.43,"tor_mem":"91.35MiB"}
+{"ts":1781992432,"arm":"clearnet","reward_share":1.487,"avg_effort":84.811,"cur_effort":71.230,"hashrate_1h":278442,"hashrate_24h":269552,"shares_found":49,"shares_failed":0,"last_share":1781991881,"peers_out":10,"peers_in":0,"peer_list":633,"pool_hr":23030452,"sidechain_diff":230304522,"tor_cpu_pct":19.63,"tor_mem":"91.4MiB"}
+{"ts":1781992733,"arm":"clearnet","reward_share":1.533,"avg_effort":84.645,"cur_effort":27.318,"hashrate_1h":279936,"hashrate_24h":269480,"shares_found":50,"shares_failed":0,"last_share":1781992474,"peers_out":10,"peers_in":0,"peer_list":631,"pool_hr":23190795,"sidechain_diff":231907950,"tor_cpu_pct":19.89,"tor_mem":"91.52MiB"}
+{"ts":1781993034,"arm":"clearnet","reward_share":1.533,"avg_effort":84.645,"cur_effort":61.824,"hashrate_1h":277230,"hashrate_24h":269394,"shares_found":50,"shares_failed":0,"last_share":1781992474,"peers_out":10,"peers_in":0,"peer_list":628,"pool_hr":23149424,"sidechain_diff":231494241,"tor_cpu_pct":15.03,"tor_mem":"91.5MiB"}
+{"ts":1781993335,"arm":"clearnet","reward_share":1.587,"avg_effort":84.346,"cur_effort":20.920,"hashrate_1h":275440,"hashrate_24h":269050,"shares_found":51,"shares_failed":0,"last_share":1781993094,"peers_out":10,"peers_in":0,"peer_list":628,"pool_hr":23725238,"sidechain_diff":237252386,"tor_cpu_pct":15.29,"tor_mem":"91.38MiB"}
+{"ts":1781993637,"arm":"clearnet","reward_share":1.586,"avg_effort":84.346,"cur_effort":62.453,"hashrate_1h":277973,"hashrate_24h":269401,"shares_found":51,"shares_failed":0,"last_share":1781993094,"peers_out":10,"peers_in":0,"peer_list":628,"pool_hr":23623329,"sidechain_diff":236233295,"tor_cpu_pct":26.33,"tor_mem":"91.82MiB"}
+{"ts":1781993938,"arm":"clearnet","reward_share":1.449,"avg_effort":84.346,"cur_effort":98.614,"hashrate_1h":279038,"hashrate_24h":269578,"shares_found":51,"shares_failed":0,"last_share":1781993094,"peers_out":10,"peers_in":0,"peer_list":641,"pool_hr":23550312,"sidechain_diff":235503126,"tor_cpu_pct":21.75,"tor_mem":"92.45MiB"}
+{"ts":1781994239,"arm":"clearnet","reward_share":1.450,"avg_effort":85.305,"cur_effort":2.996,"hashrate_1h":283352,"hashrate_24h":269816,"shares_found":52,"shares_failed":0,"last_share":1781994201,"peers_out":10,"peers_in":0,"peer_list":647,"pool_hr":23478034,"sidechain_diff":234780346,"tor_cpu_pct":16.73,"tor_mem":"92.65MiB"}
+{"ts":1781994540,"arm":"clearnet","reward_share":1.451,"avg_effort":85.305,"cur_effort":35.593,"hashrate_1h":279679,"hashrate_24h":269692,"shares_found":52,"shares_failed":0,"last_share":1781994201,"peers_out":10,"peers_in":0,"peer_list":664,"pool_hr":23136599,"sidechain_diff":231365999,"tor_cpu_pct":25.16,"tor_mem":"92.82MiB"}
+{"ts":1781994842,"arm":"clearnet","reward_share":1.451,"avg_effort":85.305,"cur_effort":76.058,"hashrate_1h":282779,"hashrate_24h":270078,"shares_found":52,"shares_failed":0,"last_share":1781994201,"peers_out":10,"peers_in":0,"peer_list":672,"pool_hr":23423376,"sidechain_diff":234233768,"tor_cpu_pct":28.02,"tor_mem":"92.87MiB"}
+{"ts":1781995143,"arm":"clearnet","reward_share":1.450,"avg_effort":85.305,"cur_effort":113.715,"hashrate_1h":283197,"hashrate_24h":270101,"shares_found":52,"shares_failed":0,"last_share":1781994201,"peers_out":10,"peers_in":0,"peer_list":672,"pool_hr":23025775,"sidechain_diff":230257752,"tor_cpu_pct":19.24,"tor_mem":"92.68MiB"}
+{"ts":1781995444,"arm":"clearnet","reward_share":1.451,"avg_effort":85.305,"cur_effort":152.067,"hashrate_1h":281924,"hashrate_24h":270278,"shares_found":52,"shares_failed":0,"last_share":1781994201,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":22908973,"sidechain_diff":229089733,"tor_cpu_pct":21.13,"tor_mem":"93.04MiB"}
+{"ts":1781995745,"arm":"clearnet","reward_share":1.487,"avg_effort":86.546,"cur_effort":32.143,"hashrate_1h":282795,"hashrate_24h":270132,"shares_found":53,"shares_failed":0,"last_share":1781995437,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":22898975,"sidechain_diff":228989758,"tor_cpu_pct":24.89,"tor_mem":"92.91MiB"}
+{"ts":1781996047,"arm":"clearnet","reward_share":1.489,"avg_effort":86.546,"cur_effort":66.434,"hashrate_1h":275751,"hashrate_24h":270101,"shares_found":53,"shares_failed":0,"last_share":1781995437,"peers_out":10,"peers_in":0,"peer_list":680,"pool_hr":23025987,"sidechain_diff":230259874,"tor_cpu_pct":18.34,"tor_mem":"92.78MiB"}
+{"ts":1781996348,"arm":"clearnet","reward_share":1.535,"avg_effort":86.331,"cur_effort":21.725,"hashrate_1h":273958,"hashrate_24h":269893,"shares_found":54,"shares_failed":0,"last_share":1781996109,"peers_out":10,"peers_in":0,"peer_list":677,"pool_hr":23274333,"sidechain_diff":232743331,"tor_cpu_pct":20.51,"tor_mem":"93.04MiB"}
+{"ts":1781996649,"arm":"clearnet","reward_share":1.535,"avg_effort":86.331,"cur_effort":60.762,"hashrate_1h":275722,"hashrate_24h":270005,"shares_found":54,"shares_failed":0,"last_share":1781996109,"peers_out":10,"peers_in":0,"peer_list":672,"pool_hr":22937613,"sidechain_diff":229376131,"tor_cpu_pct":20.17,"tor_mem":"92.54MiB"}
+{"ts":1781996950,"arm":"clearnet","reward_share":1.534,"avg_effort":86.128,"cur_effort":24.891,"hashrate_1h":282552,"hashrate_24h":270196,"shares_found":55,"shares_failed":0,"last_share":1781996760,"peers_out":10,"peers_in":0,"peer_list":657,"pool_hr":22899148,"sidechain_diff":228991481,"tor_cpu_pct":18.96,"tor_mem":"93.04MiB"}
+{"ts":1781997252,"arm":"clearnet","reward_share":1.489,"avg_effort":85.271,"cur_effort":22.173,"hashrate_1h":278304,"hashrate_24h":270180,"shares_found":56,"shares_failed":0,"last_share":1781997052,"peers_out":10,"peers_in":0,"peer_list":652,"pool_hr":22702852,"sidechain_diff":227028528,"tor_cpu_pct":1.13,"tor_mem":"92.82MiB"}
+{"ts":1781997553,"arm":"clearnet","reward_share":1.396,"avg_effort":84.280,"cur_effort":28.789,"hashrate_1h":274960,"hashrate_24h":270056,"shares_found":57,"shares_failed":0,"last_share":1781997268,"peers_out":10,"peers_in":0,"peer_list":651,"pool_hr":22561958,"sidechain_diff":225619582,"tor_cpu_pct":12.79,"tor_mem":"92.8MiB"}
+{"ts":1781997854,"arm":"clearnet","reward_share":1.477,"avg_effort":82.376,"cur_effort":8.328,"hashrate_1h":267811,"hashrate_24h":269682,"shares_found":59,"shares_failed":0,"last_share":1781997754,"peers_out":10,"peers_in":0,"peer_list":653,"pool_hr":22547252,"sidechain_diff":225472527,"tor_cpu_pct":0.13,"tor_mem":"91.96MiB"}
+{"ts":1781998155,"arm":"clearnet","reward_share":1.478,"avg_effort":82.376,"cur_effort":37.483,"hashrate_1h":264543,"hashrate_24h":269346,"shares_found":59,"shares_failed":0,"last_share":1781997754,"peers_out":10,"peers_in":0,"peer_list":655,"pool_hr":22432047,"sidechain_diff":224320474,"tor_cpu_pct":0.09,"tor_mem":"91.96MiB"}
+{"ts":1781998457,"arm":"clearnet","reward_share":1.478,"avg_effort":82.376,"cur_effort":76.378,"hashrate_1h":263734,"hashrate_24h":269520,"shares_found":59,"shares_failed":0,"last_share":1781997754,"peers_out":10,"peers_in":0,"peer_list":653,"pool_hr":22437300,"sidechain_diff":224373008,"tor_cpu_pct":19.8,"tor_mem":"92.11MiB"}
+{"ts":1781998758,"arm":"clearnet","reward_share":1.482,"avg_effort":82.376,"cur_effort":109.317,"hashrate_1h":261669,"hashrate_24h":269417,"shares_found":59,"shares_failed":0,"last_share":1781997754,"peers_out":10,"peers_in":0,"peer_list":652,"pool_hr":22519460,"sidechain_diff":225194609,"tor_cpu_pct":20.41,"tor_mem":"91.81MiB"}
+{"ts":1781999059,"arm":"clearnet","reward_share":1.478,"avg_effort":81.640,"cur_effort":31.859,"hashrate_1h":259452,"hashrate_24h":269488,"shares_found":61,"shares_failed":0,"last_share":1781998803,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":22406338,"sidechain_diff":224063384,"tor_cpu_pct":31.49,"tor_mem":"92.7MiB"}
+{"ts":1781999360,"arm":"clearnet","reward_share":1.478,"avg_effort":81.640,"cur_effort":71.141,"hashrate_1h":266085,"hashrate_24h":269717,"shares_found":61,"shares_failed":0,"last_share":1781998803,"peers_out":10,"peers_in":0,"peer_list":660,"pool_hr":22472294,"sidechain_diff":224722943,"tor_cpu_pct":21.01,"tor_mem":"91.81MiB"}
+{"ts":1781999662,"arm":"clearnet","reward_share":1.477,"avg_effort":81.511,"cur_effort":32.257,"hashrate_1h":265054,"hashrate_24h":269691,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":662,"pool_hr":22482583,"sidechain_diff":224825835,"tor_cpu_pct":19.72,"tor_mem":"91.95MiB"}
+{"ts":1781999963,"arm":"clearnet","reward_share":1.433,"avg_effort":81.511,"cur_effort":66.845,"hashrate_1h":265385,"hashrate_24h":269506,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":663,"pool_hr":22624329,"sidechain_diff":226243296,"tor_cpu_pct":20.84,"tor_mem":"92.05MiB"}
+{"ts":1782000264,"arm":"clearnet","reward_share":1.434,"avg_effort":81.511,"cur_effort":100.091,"hashrate_1h":264197,"hashrate_24h":269487,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":662,"pool_hr":22636721,"sidechain_diff":226367218,"tor_cpu_pct":24.19,"tor_mem":"91.89MiB"}
+{"ts":1782000565,"arm":"clearnet","reward_share":1.435,"avg_effort":81.511,"cur_effort":141.880,"hashrate_1h":265279,"hashrate_24h":269763,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":658,"pool_hr":22855933,"sidechain_diff":228559330,"tor_cpu_pct":34.17,"tor_mem":"92.36MiB"}
+{"ts":1782000867,"arm":"clearnet","reward_share":1.435,"avg_effort":81.511,"cur_effort":178.184,"hashrate_1h":267467,"hashrate_24h":269869,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":663,"pool_hr":23026606,"sidechain_diff":230266069,"tor_cpu_pct":13.19,"tor_mem":"92.04MiB"}
+{"ts":1782001168,"arm":"clearnet","reward_share":1.435,"avg_effort":81.511,"cur_effort":215.021,"hashrate_1h":266246,"hashrate_24h":269840,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":658,"pool_hr":22752719,"sidechain_diff":227527199,"tor_cpu_pct":11.93,"tor_mem":"92.11MiB"}
+{"ts":1782001469,"arm":"clearnet","reward_share":1.436,"avg_effort":81.511,"cur_effort":248.701,"hashrate_1h":271277,"hashrate_24h":269771,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":657,"pool_hr":22728954,"sidechain_diff":227289541,"tor_cpu_pct":17.03,"tor_mem":"92.04MiB"}
+{"ts":1782001770,"arm":"clearnet","reward_share":1.337,"avg_effort":81.511,"cur_effort":287.645,"hashrate_1h":277058,"hashrate_24h":269966,"shares_found":62,"shares_failed":0,"last_share":1781999359,"peers_out":10,"peers_in":0,"peer_list":659,"pool_hr":22754162,"sidechain_diff":227541624,"tor_cpu_pct":0.84,"tor_mem":"92MiB"}
+{"ts":1782002072,"arm":"clearnet","reward_share":1.382,"avg_effort":84.887,"cur_effort":18.666,"hashrate_1h":272901,"hashrate_24h":269753,"shares_found":63,"shares_failed":0,"last_share":1782001840,"peers_out":10,"peers_in":0,"peer_list":657,"pool_hr":22686622,"sidechain_diff":226866227,"tor_cpu_pct":1.1,"tor_mem":"91.7MiB"}
+{"ts":1782002373,"arm":"clearnet","reward_share":1.302,"avg_effort":84.887,"cur_effort":53.204,"hashrate_1h":273252,"hashrate_24h":269658,"shares_found":63,"shares_failed":0,"last_share":1782001840,"peers_out":10,"peers_in":0,"peer_list":657,"pool_hr":22633521,"sidechain_diff":226335213,"tor_cpu_pct":0.31,"tor_mem":"90.22MiB"}
+{"ts":1782002674,"arm":"clearnet","reward_share":1.303,"avg_effort":84.887,"cur_effort":80.275,"hashrate_1h":266012,"hashrate_24h":269233,"shares_found":63,"shares_failed":0,"last_share":1782001840,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":22877212,"sidechain_diff":228772126,"tor_cpu_pct":0.28,"tor_mem":"89.94MiB"}
+{"ts":1782002975,"arm":"clearnet","reward_share":1.302,"avg_effort":84.887,"cur_effort":110.666,"hashrate_1h":258739,"hashrate_24h":268917,"shares_found":63,"shares_failed":0,"last_share":1782001840,"peers_out":10,"peers_in":0,"peer_list":659,"pool_hr":22313630,"sidechain_diff":223136300,"tor_cpu_pct":0.44,"tor_mem":"89.97MiB"}
+{"ts":1782003277,"arm":"clearnet","reward_share":1.347,"avg_effort":85.762,"cur_effort":10.002,"hashrate_1h":263291,"hashrate_24h":269249,"shares_found":64,"shares_failed":0,"last_share":1782003181,"peers_out":10,"peers_in":0,"peer_list":658,"pool_hr":22244178,"sidechain_diff":222441781,"tor_cpu_pct":11.95,"tor_mem":"89.57MiB"}
+{"ts":1782003578,"arm":"clearnet","reward_share":1.347,"avg_effort":85.762,"cur_effort":48.798,"hashrate_1h":267884,"hashrate_24h":269356,"shares_found":64,"shares_failed":0,"last_share":1782003181,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":22869008,"sidechain_diff":228690088,"tor_cpu_pct":19.52,"tor_mem":"89.63MiB"}
+{"ts":1782003879,"arm":"clearnet","reward_share":1.254,"avg_effort":85.762,"cur_effort":91.326,"hashrate_1h":270420,"hashrate_24h":269552,"shares_found":64,"shares_failed":0,"last_share":1782003181,"peers_out":10,"peers_in":0,"peer_list":653,"pool_hr":22325245,"sidechain_diff":223252456,"tor_cpu_pct":10.64,"tor_mem":"89.96MiB"}
+{"ts":1782004180,"arm":"clearnet","reward_share":1.299,"avg_effort":85.969,"cur_effort":20.712,"hashrate_1h":263238,"hashrate_24h":269271,"shares_found":65,"shares_failed":0,"last_share":1782003940,"peers_out":10,"peers_in":0,"peer_list":648,"pool_hr":22071090,"sidechain_diff":220710902,"tor_cpu_pct":14.02,"tor_mem":"89.54MiB"}
+{"ts":1782004482,"arm":"clearnet","reward_share":1.209,"avg_effort":85.969,"cur_effort":56.510,"hashrate_1h":260867,"hashrate_24h":269197,"shares_found":65,"shares_failed":0,"last_share":1782003940,"peers_out":10,"peers_in":0,"peer_list":645,"pool_hr":21866080,"sidechain_diff":218660806,"tor_cpu_pct":12.61,"tor_mem":"89.66MiB"}
+{"ts":1782004783,"arm":"clearnet","reward_share":1.211,"avg_effort":85.969,"cur_effort":91.219,"hashrate_1h":259032,"hashrate_24h":269046,"shares_found":65,"shares_failed":0,"last_share":1782003940,"peers_out":10,"peers_in":0,"peer_list":645,"pool_hr":21977710,"sidechain_diff":219777108,"tor_cpu_pct":14.82,"tor_mem":"89.6MiB"}
+{"ts":1782005084,"arm":"clearnet","reward_share":1.211,"avg_effort":85.969,"cur_effort":122.706,"hashrate_1h":257422,"hashrate_24h":268888,"shares_found":65,"shares_failed":0,"last_share":1782003940,"peers_out":10,"peers_in":0,"peer_list":644,"pool_hr":21993952,"sidechain_diff":219939521,"tor_cpu_pct":16.04,"tor_mem":"89.62MiB"}
+{"ts":1782005385,"arm":"clearnet","reward_share":1.341,"avg_effort":84.653,"cur_effort":5.398,"hashrate_1h":258070,"hashrate_24h":269112,"shares_found":68,"shares_failed":0,"last_share":1782005342,"peers_out":10,"peers_in":0,"peer_list":646,"pool_hr":21770371,"sidechain_diff":217703713,"tor_cpu_pct":20.16,"tor_mem":"89.68MiB"}
+{"ts":1782005687,"arm":"clearnet","reward_share":1.342,"avg_effort":84.653,"cur_effort":32.861,"hashrate_1h":255203,"hashrate_24h":268709,"shares_found":68,"shares_failed":0,"last_share":1782005342,"peers_out":10,"peers_in":0,"peer_list":647,"pool_hr":21980845,"sidechain_diff":219808450,"tor_cpu_pct":19.14,"tor_mem":"89.72MiB"}
+{"ts":1782005988,"arm":"clearnet","reward_share":1.342,"avg_effort":84.653,"cur_effort":69.759,"hashrate_1h":258206,"hashrate_24h":268825,"shares_found":68,"shares_failed":0,"last_share":1782005342,"peers_out":10,"peers_in":0,"peer_list":647,"pool_hr":22597156,"sidechain_diff":225971567,"tor_cpu_pct":18.67,"tor_mem":"89.68MiB"}
+{"ts":1782006289,"arm":"clearnet","reward_share":1.342,"avg_effort":84.653,"cur_effort":98.720,"hashrate_1h":259049,"hashrate_24h":268503,"shares_found":68,"shares_failed":0,"last_share":1782005342,"peers_out":10,"peers_in":0,"peer_list":646,"pool_hr":22367096,"sidechain_diff":223670963,"tor_cpu_pct":2.8,"tor_mem":"89.9MiB"}
+{"ts":1782006590,"arm":"clearnet","reward_share":1.387,"avg_effort":85.132,"cur_effort":9.073,"hashrate_1h":256604,"hashrate_24h":268146,"shares_found":69,"shares_failed":0,"last_share":1782006450,"peers_out":10,"peers_in":0,"peer_list":642,"pool_hr":22372572,"sidechain_diff":223725728,"tor_cpu_pct":21.71,"tor_mem":"89.75MiB"}
+{"ts":1782006892,"arm":"clearnet","reward_share":1.429,"avg_effort":83.293,"cur_effort":16.174,"hashrate_1h":254547,"hashrate_24h":268306,"shares_found":71,"shares_failed":0,"last_share":1782006777,"peers_out":10,"peers_in":0,"peer_list":645,"pool_hr":22038830,"sidechain_diff":220388306,"tor_cpu_pct":22.29,"tor_mem":"89.73MiB"}
+{"ts":1782007193,"arm":"clearnet","reward_share":1.431,"avg_effort":83.293,"cur_effort":55.705,"hashrate_1h":257016,"hashrate_24h":268502,"shares_found":71,"shares_failed":0,"last_share":1782006777,"peers_out":10,"peers_in":0,"peer_list":644,"pool_hr":22086285,"sidechain_diff":220862850,"tor_cpu_pct":0.21,"tor_mem":"89.66MiB"}
+{"ts":1782007494,"arm":"clearnet","reward_share":1.433,"avg_effort":83.293,"cur_effort":97.357,"hashrate_1h":255215,"hashrate_24h":268613,"shares_found":71,"shares_failed":0,"last_share":1782006777,"peers_out":10,"peers_in":0,"peer_list":644,"pool_hr":21948631,"sidechain_diff":219486316,"tor_cpu_pct":0.22,"tor_mem":"89.66MiB"}
+{"ts":1782007795,"arm":"clearnet","reward_share":1.389,"avg_effort":83.293,"cur_effort":129.615,"hashrate_1h":256323,"hashrate_24h":268453,"shares_found":71,"shares_failed":0,"last_share":1782006777,"peers_out":10,"peers_in":0,"peer_list":644,"pool_hr":22069551,"sidechain_diff":220695519,"tor_cpu_pct":0.9,"tor_mem":"90.4MiB"}
+{"ts":1782008097,"arm":"clearnet","reward_share":1.344,"avg_effort":83.293,"cur_effort":180.420,"hashrate_1h":266794,"hashrate_24h":269016,"shares_found":71,"shares_failed":0,"last_share":1782006777,"peers_out":10,"peers_in":0,"peer_list":643,"pool_hr":21955507,"sidechain_diff":219555075,"tor_cpu_pct":26.48,"tor_mem":"92.36MiB"}
+{"ts":1782008398,"arm":"clearnet","reward_share":1.346,"avg_effort":83.293,"cur_effort":204.476,"hashrate_1h":262325,"hashrate_24h":268662,"shares_found":71,"shares_failed":0,"last_share":1782006777,"peers_out":10,"peers_in":0,"peer_list":642,"pool_hr":22388231,"sidechain_diff":223882319,"tor_cpu_pct":1.34,"tor_mem":"90.14MiB"}
+{"ts":1782008699,"arm":"clearnet","reward_share":1.382,"avg_effort":85.110,"cur_effort":27.881,"hashrate_1h":270785,"hashrate_24h":268940,"shares_found":72,"shares_failed":0,"last_share":1782008506,"peers_out":10,"peers_in":0,"peer_list":643,"pool_hr":21834920,"sidechain_diff":218349209,"tor_cpu_pct":19.07,"tor_mem":"90.09MiB"}
+{"ts":1782009000,"arm":"clearnet","reward_share":1.384,"avg_effort":85.110,"cur_effort":70.380,"hashrate_1h":269742,"hashrate_24h":269115,"shares_found":72,"shares_failed":0,"last_share":1782008506,"peers_out":10,"peers_in":0,"peer_list":643,"pool_hr":21794116,"sidechain_diff":217941167,"tor_cpu_pct":0.72,"tor_mem":"90.05MiB"}
+{"ts":1782009302,"arm":"clearnet","reward_share":1.338,"avg_effort":85.110,"cur_effort":99.649,"hashrate_1h":270840,"hashrate_24h":268821,"shares_found":72,"shares_failed":0,"last_share":1782008506,"peers_out":10,"peers_in":0,"peer_list":646,"pool_hr":21793700,"sidechain_diff":217937006,"tor_cpu_pct":15.98,"tor_mem":"90.41MiB"}
+{"ts":1782009603,"arm":"clearnet","reward_share":1.383,"avg_effort":85.404,"cur_effort":34.706,"hashrate_1h":273338,"hashrate_24h":269033,"shares_found":73,"shares_failed":0,"last_share":1782009337,"peers_out":10,"peers_in":0,"peer_list":643,"pool_hr":21800994,"sidechain_diff":218009946,"tor_cpu_pct":10.02,"tor_mem":"89.78MiB"}
+{"ts":1782009904,"arm":"clearnet","reward_share":1.384,"avg_effort":85.404,"cur_effort":69.066,"hashrate_1h":276221,"hashrate_24h":268946,"shares_found":73,"shares_failed":0,"last_share":1782009337,"peers_out":10,"peers_in":0,"peer_list":635,"pool_hr":21869569,"sidechain_diff":218695694,"tor_cpu_pct":12.86,"tor_mem":"89.56MiB"}
+{"ts":1782010205,"arm":"clearnet","reward_share":1.430,"avg_effort":85.321,"cur_effort":27.408,"hashrate_1h":279768,"hashrate_24h":268952,"shares_found":74,"shares_failed":0,"last_share":1782009998,"peers_out":10,"peers_in":0,"peer_list":636,"pool_hr":22112660,"sidechain_diff":221126605,"tor_cpu_pct":1.29,"tor_mem":"89.48MiB"}
+{"ts":1782010507,"arm":"clearnet","reward_share":1.386,"avg_effort":85.321,"cur_effort":58.328,"hashrate_1h":275458,"hashrate_24h":268773,"shares_found":74,"shares_failed":0,"last_share":1782009998,"peers_out":10,"peers_in":0,"peer_list":635,"pool_hr":21731058,"sidechain_diff":217310586,"tor_cpu_pct":1.67,"tor_mem":"89.44MiB"}
+{"ts":1782010808,"arm":"clearnet","reward_share":1.388,"avg_effort":85.321,"cur_effort":97.285,"hashrate_1h":273225,"hashrate_24h":268747,"shares_found":74,"shares_failed":0,"last_share":1782009998,"peers_out":10,"peers_in":0,"peer_list":639,"pool_hr":21680562,"sidechain_diff":216805624,"tor_cpu_pct":5.02,"tor_mem":"88.27MiB"}
+{"ts":1782011109,"arm":"clearnet","reward_share":1.390,"avg_effort":85.321,"cur_effort":136.778,"hashrate_1h":273222,"hashrate_24h":268898,"shares_found":74,"shares_failed":0,"last_share":1782009998,"peers_out":10,"peers_in":0,"peer_list":638,"pool_hr":21773629,"sidechain_diff":217736298,"tor_cpu_pct":12.48,"tor_mem":"88.01MiB"}
+{"ts":1782011410,"arm":"clearnet","reward_share":1.391,"avg_effort":85.321,"cur_effort":175.729,"hashrate_1h":275488,"hashrate_24h":268870,"shares_found":74,"shares_failed":0,"last_share":1782009998,"peers_out":10,"peers_in":0,"peer_list":639,"pool_hr":21632187,"sidechain_diff":216321879,"tor_cpu_pct":14.93,"tor_mem":"88.25MiB"}
+{"ts":1782011712,"arm":"clearnet","reward_share":1.392,"avg_effort":85.321,"cur_effort":212.632,"hashrate_1h":266654,"hashrate_24h":268843,"shares_found":74,"shares_failed":0,"last_share":1782009998,"peers_out":10,"peers_in":0,"peer_list":640,"pool_hr":21661064,"sidechain_diff":216610646,"tor_cpu_pct":1.46,"tor_mem":"88MiB"}
+{"ts":1782012013,"arm":"clearnet","reward_share":1.437,"avg_effort":87.043,"cur_effort":27.175,"hashrate_1h":272774,"hashrate_24h":268951,"shares_found":75,"shares_failed":0,"last_share":1782011793,"peers_out":10,"peers_in":0,"peer_list":639,"pool_hr":21526895,"sidechain_diff":215268950,"tor_cpu_pct":4.58,"tor_mem":"88.23MiB"}
+{"ts":1782012314,"arm":"clearnet","reward_share":1.437,"avg_effort":87.043,"cur_effort":57.237,"hashrate_1h":264807,"hashrate_24h":268718,"shares_found":75,"shares_failed":0,"last_share":1782011793,"peers_out":10,"peers_in":0,"peer_list":648,"pool_hr":21864827,"sidechain_diff":218648274,"tor_cpu_pct":20.62,"tor_mem":"87.96MiB"}
+{"ts":1782012615,"arm":"clearnet","reward_share":1.436,"avg_effort":86.990,"cur_effort":8.911,"hashrate_1h":260235,"hashrate_24h":268545,"shares_found":76,"shares_failed":0,"last_share":1782012557,"peers_out":10,"peers_in":0,"peer_list":671,"pool_hr":21758785,"sidechain_diff":217587852,"tor_cpu_pct":13.47,"tor_mem":"87.9MiB"}
+{"ts":1782012917,"arm":"clearnet","reward_share":1.481,"avg_effort":86.095,"cur_effort":35.276,"hashrate_1h":266094,"hashrate_24h":268654,"shares_found":77,"shares_failed":0,"last_share":1782012637,"peers_out":10,"peers_in":0,"peer_list":682,"pool_hr":21701888,"sidechain_diff":217018884,"tor_cpu_pct":0.48,"tor_mem":"87.83MiB"}
+{"ts":1782013218,"arm":"clearnet","reward_share":1.436,"avg_effort":86.095,"cur_effort":74.158,"hashrate_1h":263798,"hashrate_24h":268694,"shares_found":77,"shares_failed":0,"last_share":1782012637,"peers_out":10,"peers_in":0,"peer_list":690,"pool_hr":21660827,"sidechain_diff":216608272,"tor_cpu_pct":16.24,"tor_mem":"87.86MiB"}
+{"ts":1782013519,"arm":"clearnet","reward_share":1.482,"avg_effort":86.064,"cur_effort":25.320,"hashrate_1h":263592,"hashrate_24h":268574,"shares_found":78,"shares_failed":0,"last_share":1782013335,"peers_out":10,"peers_in":0,"peer_list":701,"pool_hr":21789426,"sidechain_diff":217894260,"tor_cpu_pct":0.21,"tor_mem":"88.31MiB"}
+{"ts":1782013820,"arm":"clearnet","reward_share":1.528,"avg_effort":85.371,"cur_effort":32.221,"hashrate_1h":262611,"hashrate_24h":268523,"shares_found":79,"shares_failed":0,"last_share":1782013536,"peers_out":10,"peers_in":0,"peer_list":708,"pool_hr":21850900,"sidechain_diff":218509003,"tor_cpu_pct":19.55,"tor_mem":"87.92MiB"}
+{"ts":1782014122,"arm":"clearnet","reward_share":1.483,"avg_effort":85.371,"cur_effort":68.443,"hashrate_1h":264912,"hashrate_24h":268517,"shares_found":79,"shares_failed":0,"last_share":1782013536,"peers_out":10,"peers_in":0,"peer_list":711,"pool_hr":21771261,"sidechain_diff":217712617,"tor_cpu_pct":17.7,"tor_mem":"88.46MiB"}
+{"ts":1782014423,"arm":"clearnet","reward_share":1.481,"avg_effort":85.222,"cur_effort":39.223,"hashrate_1h":267936,"hashrate_24h":268727,"shares_found":80,"shares_failed":0,"last_share":1782014148,"peers_out":10,"peers_in":0,"peer_list":713,"pool_hr":21675509,"sidechain_diff":216755098,"tor_cpu_pct":21.93,"tor_mem":"89.39MiB"}
+{"ts":1782014724,"arm":"clearnet","reward_share":1.388,"avg_effort":85.222,"cur_effort":80.283,"hashrate_1h":268340,"hashrate_24h":268868,"shares_found":80,"shares_failed":0,"last_share":1782014148,"peers_out":10,"peers_in":0,"peer_list":708,"pool_hr":21781101,"sidechain_diff":217811019,"tor_cpu_pct":20.57,"tor_mem":"89.04MiB"}
+{"ts":1782015025,"arm":"clearnet","reward_share":1.343,"avg_effort":85.222,"cur_effort":110.666,"hashrate_1h":263255,"hashrate_24h":268593,"shares_found":80,"shares_failed":0,"last_share":1782014148,"peers_out":10,"peers_in":0,"peer_list":704,"pool_hr":21793682,"sidechain_diff":217936823,"tor_cpu_pct":17.05,"tor_mem":"89.04MiB"}
+{"ts":1782015327,"arm":"clearnet","reward_share":1.344,"avg_effort":85.222,"cur_effort":139.106,"hashrate_1h":260884,"hashrate_24h":268319,"shares_found":80,"shares_failed":0,"last_share":1782014148,"peers_out":10,"peers_in":0,"peer_list":691,"pool_hr":22014198,"sidechain_diff":220141988,"tor_cpu_pct":33.14,"tor_mem":"89.12MiB"}
+{"ts":1782015628,"arm":"clearnet","reward_share":1.335,"avg_effort":86.254,"cur_effort":3.434,"hashrate_1h":259755,"hashrate_24h":268385,"shares_found":81,"shares_failed":0,"last_share":1782015594,"peers_out":10,"peers_in":0,"peer_list":677,"pool_hr":22074673,"sidechain_diff":220746736,"tor_cpu_pct":18.94,"tor_mem":"89.07MiB"}
+{"ts":1782015929,"arm":"clearnet","reward_share":1.336,"avg_effort":86.254,"cur_effort":41.063,"hashrate_1h":264083,"hashrate_24h":268479,"shares_found":81,"shares_failed":0,"last_share":1782015594,"peers_out":10,"peers_in":0,"peer_list":678,"pool_hr":22265306,"sidechain_diff":222653063,"tor_cpu_pct":18.44,"tor_mem":"90.03MiB"}
+{"ts":1782016230,"arm":"clearnet","reward_share":1.382,"avg_effort":85.960,"cur_effort":11.623,"hashrate_1h":263975,"hashrate_24h":268292,"shares_found":82,"shares_failed":0,"last_share":1782016102,"peers_out":10,"peers_in":0,"peer_list":676,"pool_hr":22255377,"sidechain_diff":222553776,"tor_cpu_pct":16.66,"tor_mem":"90MiB"}
+{"ts":1782016532,"arm":"clearnet","reward_share":1.336,"avg_effort":85.960,"cur_effort":51.576,"hashrate_1h":263477,"hashrate_24h":268372,"shares_found":82,"shares_failed":0,"last_share":1782016102,"peers_out":10,"peers_in":0,"peer_list":670,"pool_hr":22097784,"sidechain_diff":220977846,"tor_cpu_pct":22.33,"tor_mem":"90.02MiB"}
+{"ts":1782016833,"arm":"clearnet","reward_share":1.383,"avg_effort":85.913,"cur_effort":4.636,"hashrate_1h":262719,"hashrate_24h":268325,"shares_found":83,"shares_failed":0,"last_share":1782016796,"peers_out":10,"peers_in":0,"peer_list":671,"pool_hr":22110571,"sidechain_diff":221105711,"tor_cpu_pct":25.81,"tor_mem":"90.22MiB"}
+{"ts":1782017134,"arm":"clearnet","reward_share":1.384,"avg_effort":85.913,"cur_effort":43.744,"hashrate_1h":266010,"hashrate_24h":268426,"shares_found":83,"shares_failed":0,"last_share":1782016796,"peers_out":10,"peers_in":0,"peer_list":670,"pool_hr":22177249,"sidechain_diff":221772491,"tor_cpu_pct":33.85,"tor_mem":"91.1MiB"}
+{"ts":1782017435,"arm":"clearnet","reward_share":1.347,"avg_effort":85.913,"cur_effort":81.733,"hashrate_1h":269156,"hashrate_24h":268514,"shares_found":83,"shares_failed":0,"last_share":1782016796,"peers_out":10,"peers_in":0,"peer_list":667,"pool_hr":22122857,"sidechain_diff":221228570,"tor_cpu_pct":38.33,"tor_mem":"92.27MiB"}
+{"ts":1782017737,"arm":"clearnet","reward_share":1.348,"avg_effort":85.913,"cur_effort":116.014,"hashrate_1h":269069,"hashrate_24h":268490,"shares_found":83,"shares_failed":0,"last_share":1782016796,"peers_out":10,"peers_in":0,"peer_list":670,"pool_hr":22529020,"sidechain_diff":225290206,"tor_cpu_pct":30.89,"tor_mem":"91.61MiB"}
+{"ts":1782018038,"arm":"clearnet","reward_share":1.347,"avg_effort":86.617,"cur_effort":6.662,"hashrate_1h":265193,"hashrate_24h":268543,"shares_found":84,"shares_failed":0,"last_share":1782017962,"peers_out":10,"peers_in":0,"peer_list":670,"pool_hr":22339444,"sidechain_diff":223394449,"tor_cpu_pct":25.66,"tor_mem":"91.64MiB"}
+{"ts":1782018339,"arm":"clearnet","reward_share":1.347,"avg_effort":86.617,"cur_effort":45.520,"hashrate_1h":264279,"hashrate_24h":268585,"shares_found":84,"shares_failed":0,"last_share":1782017962,"peers_out":10,"peers_in":0,"peer_list":666,"pool_hr":22601364,"sidechain_diff":226013642,"tor_cpu_pct":20.98,"tor_mem":"91.44MiB"}
+{"ts":1782018640,"arm":"clearnet","reward_share":1.301,"avg_effort":86.617,"cur_effort":80.063,"hashrate_1h":268829,"hashrate_24h":268575,"shares_found":84,"shares_failed":0,"last_share":1782017962,"peers_out":10,"peers_in":0,"peer_list":664,"pool_hr":22803170,"sidechain_diff":228031702,"tor_cpu_pct":25.51,"tor_mem":"91.66MiB"}
+{"ts":1782018942,"arm":"clearnet","reward_share":1.254,"avg_effort":86.617,"cur_effort":109.753,"hashrate_1h":268702,"hashrate_24h":268340,"shares_found":84,"shares_failed":0,"last_share":1782017962,"peers_out":10,"peers_in":0,"peer_list":663,"pool_hr":22404702,"sidechain_diff":224047029,"tor_cpu_pct":16.29,"tor_mem":"91.47MiB"}
+{"ts":1782019243,"arm":"clearnet","reward_share":1.207,"avg_effort":86.617,"cur_effort":147.386,"hashrate_1h":268555,"hashrate_24h":268398,"shares_found":84,"shares_failed":0,"last_share":1782017962,"peers_out":10,"peers_in":0,"peer_list":666,"pool_hr":22441675,"sidechain_diff":224416759,"tor_cpu_pct":20.85,"tor_mem":"91.65MiB"}
+{"ts":1782019544,"arm":"clearnet","reward_share":1.124,"avg_effort":86.617,"cur_effort":186.655,"hashrate_1h":269739,"hashrate_24h":268530,"shares_found":84,"shares_failed":0,"last_share":1782017962,"peers_out":10,"peers_in":0,"peer_list":667,"pool_hr":22530904,"sidechain_diff":225309046,"tor_cpu_pct":26.17,"tor_mem":"91.35MiB"}
+{"ts":1782019845,"arm":"clearnet","reward_share":1.171,"avg_effort":87.821,"cur_effort":31.924,"hashrate_1h":273231,"hashrate_24h":268570,"shares_found":85,"shares_failed":0,"last_share":1782019564,"peers_out":10,"peers_in":0,"peer_list":665,"pool_hr":22680134,"sidechain_diff":226801342,"tor_cpu_pct":15.9,"tor_mem":"91.36MiB"}
+{"ts":1782020147,"arm":"clearnet","reward_share":1.263,"avg_effort":86.653,"cur_effort":2.282,"hashrate_1h":276958,"hashrate_24h":268792,"shares_found":87,"shares_failed":0,"last_share":1782020109,"peers_out":10,"peers_in":0,"peer_list":667,"pool_hr":22785993,"sidechain_diff":227859932,"tor_cpu_pct":14.03,"tor_mem":"91.18MiB"}
+{"ts":1782020448,"arm":"clearnet","reward_share":1.216,"avg_effort":86.653,"cur_effort":32.663,"hashrate_1h":273178,"hashrate_24h":268601,"shares_found":87,"shares_failed":0,"last_share":1782020109,"peers_out":10,"peers_in":0,"peer_list":664,"pool_hr":22796774,"sidechain_diff":227967741,"tor_cpu_pct":1.37,"tor_mem":"91.37MiB"}
+{"ts":1782020749,"arm":"clearnet","reward_share":1.171,"avg_effort":86.653,"cur_effort":63.059,"hashrate_1h":268074,"hashrate_24h":268426,"shares_found":87,"shares_failed":0,"last_share":1782020109,"peers_out":10,"peers_in":0,"peer_list":663,"pool_hr":22821878,"sidechain_diff":228218788,"tor_cpu_pct":0.24,"tor_mem":"90.64MiB"}
+{"ts":1782021050,"arm":"clearnet","reward_share":1.218,"avg_effort":86.427,"cur_effort":28.932,"hashrate_1h":266205,"hashrate_24h":268357,"shares_found":88,"shares_failed":0,"last_share":1782020787,"peers_out":10,"peers_in":0,"peer_list":668,"pool_hr":22910566,"sidechain_diff":229105669,"tor_cpu_pct":1.31,"tor_mem":"90.33MiB"}
+{"ts":1782021352,"arm":"clearnet","reward_share":1.276,"avg_effort":84.944,"cur_effort":20.721,"hashrate_1h":266155,"hashrate_24h":268340,"shares_found":90,"shares_failed":0,"last_share":1782021141,"peers_out":10,"peers_in":0,"peer_list":672,"pool_hr":23252970,"sidechain_diff":232529702,"tor_cpu_pct":0.88,"tor_mem":"90.05MiB"}
+{"ts":1782021653,"arm":"clearnet","reward_share":1.276,"avg_effort":84.944,"cur_effort":60.005,"hashrate_1h":267689,"hashrate_24h":268468,"shares_found":90,"shares_failed":0,"last_share":1782021141,"peers_out":10,"peers_in":0,"peer_list":678,"pool_hr":23040880,"sidechain_diff":230408807,"tor_cpu_pct":1.09,"tor_mem":"90.12MiB"}
+{"ts":1782021954,"arm":"clearnet","reward_share":1.323,"avg_effort":84.712,"cur_effort":30.805,"hashrate_1h":266717,"hashrate_24h":268447,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":677,"pool_hr":22936143,"sidechain_diff":229361438,"tor_cpu_pct":2.87,"tor_mem":"90.09MiB"}
+{"ts":1782022255,"arm":"clearnet","reward_share":1.323,"avg_effort":84.712,"cur_effort":60.231,"hashrate_1h":263434,"hashrate_24h":268235,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":677,"pool_hr":23058755,"sidechain_diff":230587551,"tor_cpu_pct":0.14,"tor_mem":"89.78MiB"}
+{"ts":1782022556,"arm":"clearnet","reward_share":1.322,"avg_effort":84.712,"cur_effort":92.931,"hashrate_1h":265204,"hashrate_24h":268237,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":23159324,"sidechain_diff":231593248,"tor_cpu_pct":13.22,"tor_mem":"90.2MiB"}
+{"ts":1782022858,"arm":"clearnet","reward_share":1.322,"avg_effort":84.712,"cur_effort":127.543,"hashrate_1h":264207,"hashrate_24h":268172,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":683,"pool_hr":23119578,"sidechain_diff":231195783,"tor_cpu_pct":1.28,"tor_mem":"89.76MiB"}
+{"ts":1782023159,"arm":"clearnet","reward_share":1.321,"avg_effort":84.712,"cur_effort":163.256,"hashrate_1h":262885,"hashrate_24h":268229,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":677,"pool_hr":23038264,"sidechain_diff":230382649,"tor_cpu_pct":0.78,"tor_mem":"89.7MiB"}
+{"ts":1782023460,"arm":"clearnet","reward_share":1.319,"avg_effort":84.712,"cur_effort":197.423,"hashrate_1h":266445,"hashrate_24h":268461,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":674,"pool_hr":23972607,"sidechain_diff":239726072,"tor_cpu_pct":14.86,"tor_mem":"89.92MiB"}
+{"ts":1782023761,"arm":"clearnet","reward_share":1.272,"avg_effort":84.712,"cur_effort":227.664,"hashrate_1h":256847,"hashrate_24h":268178,"shares_found":91,"shares_failed":0,"last_share":1782021673,"peers_out":10,"peers_in":0,"peer_list":678,"pool_hr":23644434,"sidechain_diff":236444345,"tor_cpu_pct":3.13,"tor_mem":"89.96MiB"}
+{"ts":1782024063,"arm":"clearnet","reward_share":1.318,"avg_effort":86.523,"cur_effort":10.810,"hashrate_1h":258755,"hashrate_24h":268081,"shares_found":92,"shares_failed":0,"last_share":1782023954,"peers_out":10,"peers_in":0,"peer_list":680,"pool_hr":23339403,"sidechain_diff":233394035,"tor_cpu_pct":5.26,"tor_mem":"90.2MiB"}
+{"ts":1782024364,"arm":"clearnet","reward_share":1.317,"avg_effort":86.523,"cur_effort":44.368,"hashrate_1h":261030,"hashrate_24h":267975,"shares_found":92,"shares_failed":0,"last_share":1782023954,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":22828534,"sidechain_diff":228285348,"tor_cpu_pct":1.31,"tor_mem":"89.61MiB"}
+{"ts":1782024665,"arm":"clearnet","reward_share":1.318,"avg_effort":86.523,"cur_effort":77.920,"hashrate_1h":259395,"hashrate_24h":267903,"shares_found":92,"shares_failed":0,"last_share":1782023954,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":22779269,"sidechain_diff":227792693,"tor_cpu_pct":2.65,"tor_mem":"88.49MiB"}
+{"ts":1782024966,"arm":"clearnet","reward_share":1.273,"avg_effort":86.523,"cur_effort":111.999,"hashrate_1h":259137,"hashrate_24h":267869,"shares_found":92,"shares_failed":0,"last_share":1782023954,"peers_out":10,"peers_in":0,"peer_list":683,"pool_hr":22767626,"sidechain_diff":227676269,"tor_cpu_pct":2.48,"tor_mem":"88.49MiB"}
+{"ts":1782025268,"arm":"clearnet","reward_share":1.274,"avg_effort":86.523,"cur_effort":144.588,"hashrate_1h":255189,"hashrate_24h":267764,"shares_found":92,"shares_failed":0,"last_share":1782023954,"peers_out":10,"peers_in":0,"peer_list":675,"pool_hr":22627237,"sidechain_diff":226272374,"tor_cpu_pct":0.9,"tor_mem":"88.26MiB"}
+{"ts":1782025569,"arm":"clearnet","reward_share":1.275,"avg_effort":87.371,"cur_effort":13.946,"hashrate_1h":255122,"hashrate_24h":267750,"shares_found":93,"shares_failed":0,"last_share":1782025421,"peers_out":10,"peers_in":0,"peer_list":674,"pool_hr":22549013,"sidechain_diff":225490131,"tor_cpu_pct":0.78,"tor_mem":"88.27MiB"}
+{"ts":1782025870,"arm":"clearnet","reward_share":1.275,"avg_effort":87.371,"cur_effort":42.900,"hashrate_1h":255606,"hashrate_24h":267590,"shares_found":93,"shares_failed":0,"last_share":1782025421,"peers_out":10,"peers_in":0,"peer_list":671,"pool_hr":22615473,"sidechain_diff":226154731,"tor_cpu_pct":24.67,"tor_mem":"88.38MiB"}
+{"ts":1782026171,"arm":"clearnet","reward_share":1.274,"avg_effort":87.371,"cur_effort":78.154,"hashrate_1h":254082,"hashrate_24h":267588,"shares_found":93,"shares_failed":0,"last_share":1782025421,"peers_out":10,"peers_in":0,"peer_list":674,"pool_hr":23355808,"sidechain_diff":233558087,"tor_cpu_pct":5.32,"tor_mem":"88.55MiB"}
+{"ts":1782026473,"arm":"clearnet","reward_share":1.273,"avg_effort":87.371,"cur_effort":115.621,"hashrate_1h":257062,"hashrate_24h":267632,"shares_found":93,"shares_failed":0,"last_share":1782025421,"peers_out":10,"peers_in":0,"peer_list":673,"pool_hr":22952506,"sidechain_diff":229525066,"tor_cpu_pct":1.22,"tor_mem":"88.19MiB"}
+{"ts":1782026774,"arm":"clearnet","reward_share":1.272,"avg_effort":87.371,"cur_effort":147.962,"hashrate_1h":254868,"hashrate_24h":267545,"shares_found":93,"shares_failed":0,"last_share":1782025421,"peers_out":10,"peers_in":0,"peer_list":669,"pool_hr":22463694,"sidechain_diff":224636948,"tor_cpu_pct":0.38,"tor_mem":"88.64MiB"}
+{"ts":1782027075,"arm":"clearnet","reward_share":1.139,"avg_effort":87.371,"cur_effort":175.180,"hashrate_1h":244729,"hashrate_24h":267255,"shares_found":93,"shares_failed":0,"last_share":1782025421,"peers_out":10,"peers_in":0,"peer_list":671,"pool_hr":22558734,"sidechain_diff":225587349,"tor_cpu_pct":4.16,"tor_mem":"88.55MiB"}
+{"ts":1782027376,"arm":"clearnet","reward_share":1.184,"avg_effort":88.364,"cur_effort":20.293,"hashrate_1h":246015,"hashrate_24h":267060,"shares_found":94,"shares_failed":0,"last_share":1782027136,"peers_out":10,"peers_in":0,"peer_list":672,"pool_hr":22937242,"sidechain_diff":229372426,"tor_cpu_pct":0.36,"tor_mem":"88.17MiB"}
+{"ts":1782027678,"arm":"clearnet","reward_share":1.183,"avg_effort":108.164,"cur_effort":9.880,"hashrate_1h":245943,"hashrate_24h":245943,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":728,"pool_hr":22780074,"sidechain_diff":227800746,"tor_cpu_pct":0.6,"tor_mem":"88.62MiB"}
+{"ts":1782099542,"arm":"clearnet","reward_share":1.026,"avg_effort":95.213,"cur_effort":137.539,"hashrate_1h":263196,"hashrate_24h":266964,"shares_found":87,"shares_failed":0,"last_share":1782098344,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":10000,"sidechain_diff":100000,"tor_cpu_pct":27.98,"tor_mem":"104.8MiB"}
+{"ts":1782099844,"arm":"clearnet","reward_share":1.071,"avg_effort":5.702,"cur_effort":26.265,"hashrate_1h":263038,"hashrate_24h":263038,"shares_found":1,"shares_failed":0,"last_share":1782099608,"peers_out":10,"peers_in":0,"peer_list":656,"pool_hr":22985657,"sidechain_diff":229856577,"tor_cpu_pct":28.89,"tor_mem":"104.5MiB"}
+{"ts":1782100145,"arm":"clearnet","reward_share":1.073,"avg_effort":5.702,"cur_effort":60.669,"hashrate_1h":257188,"hashrate_24h":257188,"shares_found":1,"shares_failed":0,"last_share":1782099608,"peers_out":10,"peers_in":0,"peer_list":751,"pool_hr":22696552,"sidechain_diff":226965527,"tor_cpu_pct":24.19,"tor_mem":"104.1MiB"}
+{"ts":1782100446,"arm":"clearnet","reward_share":1.115,"avg_effort":30.490,"cur_effort":4.356,"hashrate_1h":250322,"hashrate_24h":250322,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":817,"pool_hr":22860149,"sidechain_diff":228601490,"tor_cpu_pct":30.06,"tor_mem":"104.1MiB"}
+{"ts":1782100747,"arm":"clearnet","reward_share":1.116,"avg_effort":30.490,"cur_effort":42.237,"hashrate_1h":258791,"hashrate_24h":258791,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":862,"pool_hr":22932255,"sidechain_diff":229322552,"tor_cpu_pct":19.09,"tor_mem":"104.3MiB"}
+{"ts":1782101049,"arm":"clearnet","reward_share":1.116,"avg_effort":30.490,"cur_effort":77.219,"hashrate_1h":259803,"hashrate_24h":259803,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":894,"pool_hr":23128835,"sidechain_diff":231288357,"tor_cpu_pct":26.06,"tor_mem":"104.3MiB"}
+{"ts":1782101350,"arm":"clearnet","reward_share":1.116,"avg_effort":30.490,"cur_effort":104.691,"hashrate_1h":251619,"hashrate_24h":251619,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":917,"pool_hr":22952342,"sidechain_diff":229523424,"tor_cpu_pct":29.31,"tor_mem":"104.1MiB"}
+{"ts":1782101651,"arm":"clearnet","reward_share":1.116,"avg_effort":30.490,"cur_effort":133.514,"hashrate_1h":251376,"hashrate_24h":251376,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":931,"pool_hr":23540917,"sidechain_diff":235409171,"tor_cpu_pct":24.36,"tor_mem":"104MiB"}
+{"ts":1782101952,"arm":"clearnet","reward_share":1.071,"avg_effort":30.490,"cur_effort":168.197,"hashrate_1h":251912,"hashrate_24h":251912,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":941,"pool_hr":23189227,"sidechain_diff":231892275,"tor_cpu_pct":16.13,"tor_mem":"104.1MiB"}
+{"ts":1782102254,"arm":"clearnet","reward_share":1.072,"avg_effort":30.490,"cur_effort":205.820,"hashrate_1h":252994,"hashrate_24h":252994,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":956,"pool_hr":22958385,"sidechain_diff":229583858,"tor_cpu_pct":30.08,"tor_mem":"104.3MiB"}
+{"ts":1782102555,"arm":"clearnet","reward_share":1.072,"avg_effort":30.490,"cur_effort":236.476,"hashrate_1h":253602,"hashrate_24h":253602,"shares_found":3,"shares_failed":0,"last_share":1782100374,"peers_out":10,"peers_in":0,"peer_list":963,"pool_hr":23332132,"sidechain_diff":233321329,"tor_cpu_pct":19.92,"tor_mem":"105.5MiB"}
+{"ts":1782102856,"arm":"clearnet","reward_share":1.117,"avg_effort":86.897,"cur_effort":11.102,"hashrate_1h":250740,"hashrate_24h":250740,"shares_found":4,"shares_failed":0,"last_share":1782102686,"peers_out":10,"peers_in":0,"peer_list":968,"pool_hr":23046284,"sidechain_diff":230462840,"tor_cpu_pct":24.65,"tor_mem":"105.1MiB"}
+{"ts":1782103157,"arm":"clearnet","reward_share":1.118,"avg_effort":86.897,"cur_effort":50.041,"hashrate_1h":253824,"hashrate_24h":253718,"shares_found":4,"shares_failed":0,"last_share":1782102686,"peers_out":10,"peers_in":0,"peer_list":971,"pool_hr":23045781,"sidechain_diff":230457815,"tor_cpu_pct":3.88,"tor_mem":"104.9MiB"}
+{"ts":1782103459,"arm":"clearnet","reward_share":1.118,"avg_effort":86.897,"cur_effort":83.576,"hashrate_1h":251814,"hashrate_24h":253308,"shares_found":4,"shares_failed":0,"last_share":1782102686,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":22568390,"sidechain_diff":225683904,"tor_cpu_pct":20.61,"tor_mem":"104.7MiB"}
+{"ts":1782103760,"arm":"clearnet","reward_share":1.118,"avg_effort":86.897,"cur_effort":118.336,"hashrate_1h":254696,"hashrate_24h":254843,"shares_found":4,"shares_failed":0,"last_share":1782102686,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22664798,"sidechain_diff":226647980,"tor_cpu_pct":18.45,"tor_mem":"104.2MiB"}
+{"ts":1782104061,"arm":"clearnet","reward_share":1.119,"avg_effort":86.897,"cur_effort":159.585,"hashrate_1h":258805,"hashrate_24h":257315,"shares_found":4,"shares_failed":0,"last_share":1782102686,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22309186,"sidechain_diff":223091862,"tor_cpu_pct":23.26,"tor_mem":"104MiB"}
+{"ts":1782104362,"arm":"clearnet","reward_share":1.208,"avg_effort":86.006,"cur_effort":30.799,"hashrate_1h":258537,"hashrate_24h":259293,"shares_found":6,"shares_failed":0,"last_share":1782104083,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22255754,"sidechain_diff":222557543,"tor_cpu_pct":22.97,"tor_mem":"104MiB"}
+{"ts":1782104664,"arm":"clearnet","reward_share":1.163,"avg_effort":86.006,"cur_effort":65.975,"hashrate_1h":258687,"hashrate_24h":258947,"shares_found":6,"shares_failed":0,"last_share":1782104083,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22235756,"sidechain_diff":222357563,"tor_cpu_pct":24.13,"tor_mem":"104MiB"}
+{"ts":1782104965,"arm":"clearnet","reward_share":1.207,"avg_effort":87.377,"cur_effort":8.098,"hashrate_1h":266627,"hashrate_24h":261090,"shares_found":7,"shares_failed":0,"last_share":1782104903,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":22545391,"sidechain_diff":225453914,"tor_cpu_pct":15.38,"tor_mem":"103.7MiB"}
+{"ts":1782105266,"arm":"clearnet","reward_share":1.253,"avg_effort":78.491,"cur_effort":31.581,"hashrate_1h":269528,"hashrate_24h":262849,"shares_found":8,"shares_failed":0,"last_share":1782105017,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":22335070,"sidechain_diff":223350700,"tor_cpu_pct":19.51,"tor_mem":"103.6MiB"}
+{"ts":1782105567,"arm":"clearnet","reward_share":1.254,"avg_effort":78.491,"cur_effort":65.750,"hashrate_1h":269283,"hashrate_24h":262048,"shares_found":8,"shares_failed":0,"last_share":1782105017,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22370277,"sidechain_diff":223702778,"tor_cpu_pct":20.46,"tor_mem":"103.7MiB"}
+{"ts":1782105869,"arm":"clearnet","reward_share":1.209,"avg_effort":78.491,"cur_effort":107.384,"hashrate_1h":272113,"hashrate_24h":263939,"shares_found":8,"shares_failed":0,"last_share":1782105017,"peers_out":10,"peers_in":0,"peer_list":780,"pool_hr":22194879,"sidechain_diff":221948791,"tor_cpu_pct":30.06,"tor_mem":"103.6MiB"}
+{"ts":1782106170,"arm":"clearnet","reward_share":1.206,"avg_effort":85.876,"cur_effort":1.116,"hashrate_1h":275518,"hashrate_24h":265398,"shares_found":9,"shares_failed":0,"last_share":1782106139,"peers_out":10,"peers_in":0,"peer_list":780,"pool_hr":22150342,"sidechain_diff":221503420,"tor_cpu_pct":24.49,"tor_mem":"103.6MiB"}
+{"ts":1782106471,"arm":"clearnet","reward_share":1.251,"avg_effort":79.553,"cur_effort":26.104,"hashrate_1h":284486,"hashrate_24h":268193,"shares_found":10,"shares_failed":0,"last_share":1782106278,"peers_out":10,"peers_in":0,"peer_list":778,"pool_hr":22231071,"sidechain_diff":222310717,"tor_cpu_pct":25.96,"tor_mem":"103.6MiB"}
+{"ts":1782106772,"arm":"clearnet","reward_share":1.206,"avg_effort":79.553,"cur_effort":60.915,"hashrate_1h":281576,"hashrate_24h":267623,"shares_found":10,"shares_failed":0,"last_share":1782106278,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":22177909,"sidechain_diff":221779096,"tor_cpu_pct":18.79,"tor_mem":"103.6MiB"}
+{"ts":1782107074,"arm":"clearnet","reward_share":1.209,"avg_effort":79.553,"cur_effort":98.692,"hashrate_1h":283021,"hashrate_24h":267931,"shares_found":10,"shares_failed":0,"last_share":1782106278,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22066652,"sidechain_diff":220666525,"tor_cpu_pct":25.05,"tor_mem":"103.4MiB"}
+{"ts":1782107375,"arm":"clearnet","reward_share":1.253,"avg_effort":81.473,"cur_effort":35.071,"hashrate_1h":286030,"hashrate_24h":268533,"shares_found":11,"shares_failed":0,"last_share":1782107095,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":21889645,"sidechain_diff":218896454,"tor_cpu_pct":20.07,"tor_mem":"103.6MiB"}
+{"ts":1782107676,"arm":"clearnet","reward_share":1.243,"avg_effort":78.759,"cur_effort":33.744,"hashrate_1h":287200,"hashrate_24h":271059,"shares_found":12,"shares_failed":0,"last_share":1782107442,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":21858166,"sidechain_diff":218581668,"tor_cpu_pct":27.37,"tor_mem":"103.6MiB"}
+{"ts":1782107977,"arm":"clearnet","reward_share":1.244,"avg_effort":78.759,"cur_effort":64.457,"hashrate_1h":283460,"hashrate_24h":269308,"shares_found":12,"shares_failed":0,"last_share":1782107442,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":21874292,"sidechain_diff":218742928,"tor_cpu_pct":20.46,"tor_mem":"103.5MiB"}
+{"ts":1782108279,"arm":"clearnet","reward_share":1.331,"avg_effort":74.924,"cur_effort":3.939,"hashrate_1h":285910,"hashrate_24h":270254,"shares_found":14,"shares_failed":0,"last_share":1782108258,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":21841986,"sidechain_diff":218419861,"tor_cpu_pct":17.17,"tor_mem":"103.2MiB"}
+{"ts":1782108580,"arm":"clearnet","reward_share":1.328,"avg_effort":71.857,"cur_effort":14.091,"hashrate_1h":286032,"hashrate_24h":270882,"shares_found":15,"shares_failed":0,"last_share":1782108422,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":21836231,"sidechain_diff":218362316,"tor_cpu_pct":30.34,"tor_mem":"103.3MiB"}
+{"ts":1782108881,"arm":"clearnet","reward_share":1.329,"avg_effort":71.857,"cur_effort":57.112,"hashrate_1h":286368,"hashrate_24h":272138,"shares_found":15,"shares_failed":0,"last_share":1782108422,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":21994084,"sidechain_diff":219940849,"tor_cpu_pct":19.21,"tor_mem":"103.2MiB"}
+{"ts":1782109182,"arm":"clearnet","reward_share":1.373,"avg_effort":71.312,"cur_effort":35.110,"hashrate_1h":290690,"hashrate_24h":272904,"shares_found":16,"shares_failed":0,"last_share":1782108899,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":22133371,"sidechain_diff":221333719,"tor_cpu_pct":6.96,"tor_mem":"102.8MiB"}
+{"ts":1782109484,"arm":"clearnet","reward_share":1.418,"avg_effort":69.321,"cur_effort":30.056,"hashrate_1h":285286,"hashrate_24h":271959,"shares_found":17,"shares_failed":0,"last_share":1782109190,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":22514501,"sidechain_diff":225145014,"tor_cpu_pct":25.65,"tor_mem":"102.7MiB"}
+{"ts":1782109785,"arm":"clearnet","reward_share":1.462,"avg_effort":68.868,"cur_effort":3.847,"hashrate_1h":282670,"hashrate_24h":271493,"shares_found":18,"shares_failed":0,"last_share":1782109722,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":22153832,"sidechain_diff":221538328,"tor_cpu_pct":7.07,"tor_mem":"102.6MiB"}
+{"ts":1782110086,"arm":"clearnet","reward_share":1.508,"avg_effort":66.821,"cur_effort":8.899,"hashrate_1h":276558,"hashrate_24h":271070,"shares_found":19,"shares_failed":0,"last_share":1782109978,"peers_out":10,"peers_in":0,"peer_list":783,"pool_hr":22104013,"sidechain_diff":221040130,"tor_cpu_pct":18.71,"tor_mem":"102.2MiB"}
+{"ts":1782110387,"arm":"clearnet","reward_share":1.511,"avg_effort":66.821,"cur_effort":46.203,"hashrate_1h":277707,"hashrate_24h":271102,"shares_found":19,"shares_failed":0,"last_share":1782109978,"peers_out":10,"peers_in":0,"peer_list":784,"pool_hr":22112067,"sidechain_diff":221120679,"tor_cpu_pct":14.72,"tor_mem":"101.9MiB"}
+{"ts":1782110689,"arm":"clearnet","reward_share":1.511,"avg_effort":66.821,"cur_effort":79.959,"hashrate_1h":276443,"hashrate_24h":270454,"shares_found":19,"shares_failed":0,"last_share":1782109978,"peers_out":10,"peers_in":0,"peer_list":780,"pool_hr":22273008,"sidechain_diff":222730087,"tor_cpu_pct":8.27,"tor_mem":"101.7MiB"}
+{"ts":1782110990,"arm":"clearnet","reward_share":1.557,"avg_effort":67.547,"cur_effort":27.363,"hashrate_1h":269675,"hashrate_24h":269103,"shares_found":20,"shares_failed":0,"last_share":1782110692,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":22394129,"sidechain_diff":223941293,"tor_cpu_pct":20.14,"tor_mem":"101.2MiB"}
+{"ts":1782111291,"arm":"clearnet","reward_share":1.557,"avg_effort":67.547,"cur_effort":61.103,"hashrate_1h":265487,"hashrate_24h":268803,"shares_found":20,"shares_failed":0,"last_share":1782110692,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":22712871,"sidechain_diff":227128712,"tor_cpu_pct":17.08,"tor_mem":"101.2MiB"}
+{"ts":1782111592,"arm":"clearnet","reward_share":1.511,"avg_effort":67.547,"cur_effort":94.277,"hashrate_1h":266118,"hashrate_24h":268164,"shares_found":20,"shares_failed":0,"last_share":1782110692,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":22462370,"sidechain_diff":224623700,"tor_cpu_pct":19.44,"tor_mem":"101.1MiB"}
+{"ts":1782111894,"arm":"clearnet","reward_share":1.514,"avg_effort":67.547,"cur_effort":134.519,"hashrate_1h":265143,"hashrate_24h":268962,"shares_found":20,"shares_failed":0,"last_share":1782110692,"peers_out":10,"peers_in":0,"peer_list":782,"pool_hr":22536217,"sidechain_diff":225362173,"tor_cpu_pct":22.36,"tor_mem":"101.2MiB"}
+{"ts":1782112195,"arm":"clearnet","reward_share":1.516,"avg_effort":67.547,"cur_effort":166.237,"hashrate_1h":259028,"hashrate_24h":267854,"shares_found":20,"shares_failed":0,"last_share":1782110692,"peers_out":10,"peers_in":0,"peer_list":783,"pool_hr":22355897,"sidechain_diff":223558978,"tor_cpu_pct":24.54,"tor_mem":"100.7MiB"}
+{"ts":1782112496,"arm":"clearnet","reward_share":1.470,"avg_effort":67.547,"cur_effort":208.775,"hashrate_1h":260001,"hashrate_24h":269030,"shares_found":20,"shares_failed":0,"last_share":1782110692,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22363495,"sidechain_diff":223634952,"tor_cpu_pct":24.92,"tor_mem":"100.1MiB"}
+{"ts":1782112797,"arm":"clearnet","reward_share":1.469,"avg_effort":75.260,"cur_effort":18.538,"hashrate_1h":259376,"hashrate_24h":269393,"shares_found":21,"shares_failed":0,"last_share":1782112651,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22356536,"sidechain_diff":223565360,"tor_cpu_pct":0.32,"tor_mem":"99.81MiB"}
+{"ts":1782113099,"arm":"clearnet","reward_share":1.423,"avg_effort":75.260,"cur_effort":48.575,"hashrate_1h":259505,"hashrate_24h":268548,"shares_found":21,"shares_failed":0,"last_share":1782112651,"peers_out":10,"peers_in":0,"peer_list":778,"pool_hr":22648506,"sidechain_diff":226485060,"tor_cpu_pct":21.07,"tor_mem":"99.58MiB"}
+{"ts":1782113400,"arm":"clearnet","reward_share":1.423,"avg_effort":74.809,"cur_effort":19.347,"hashrate_1h":260030,"hashrate_24h":268546,"shares_found":22,"shares_failed":0,"last_share":1782113220,"peers_out":10,"peers_in":0,"peer_list":782,"pool_hr":22151379,"sidechain_diff":221513791,"tor_cpu_pct":18.19,"tor_mem":"99.34MiB"}
+{"ts":1782113701,"arm":"clearnet","reward_share":1.424,"avg_effort":74.809,"cur_effort":52.211,"hashrate_1h":257949,"hashrate_24h":267900,"shares_found":22,"shares_failed":0,"last_share":1782113220,"peers_out":10,"peers_in":0,"peer_list":785,"pool_hr":22163122,"sidechain_diff":221631220,"tor_cpu_pct":22.77,"tor_mem":"100.2MiB"}
+{"ts":1782114002,"arm":"clearnet","reward_share":1.422,"avg_effort":73.963,"cur_effort":35.224,"hashrate_1h":259940,"hashrate_24h":268277,"shares_found":23,"shares_failed":0,"last_share":1782113728,"peers_out":10,"peers_in":0,"peer_list":782,"pool_hr":22269502,"sidechain_diff":222695028,"tor_cpu_pct":17.44,"tor_mem":"99.38MiB"}
+{"ts":1782114304,"arm":"clearnet","reward_share":1.423,"avg_effort":73.963,"cur_effort":74.123,"hashrate_1h":263487,"hashrate_24h":268698,"shares_found":23,"shares_failed":0,"last_share":1782113728,"peers_out":10,"peers_in":0,"peer_list":778,"pool_hr":22177066,"sidechain_diff":221770664,"tor_cpu_pct":2.54,"tor_mem":"99.4MiB"}
+{"ts":1782114605,"arm":"clearnet","reward_share":1.513,"avg_effort":72.668,"cur_effort":1.921,"hashrate_1h":271751,"hashrate_24h":269554,"shares_found":25,"shares_failed":0,"last_share":1782114582,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":22507048,"sidechain_diff":225070489,"tor_cpu_pct":14.3,"tor_mem":"98.58MiB"}
+{"ts":1782114906,"arm":"clearnet","reward_share":1.469,"avg_effort":72.668,"cur_effort":30.713,"hashrate_1h":267512,"hashrate_24h":268484,"shares_found":25,"shares_failed":0,"last_share":1782114582,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":22298559,"sidechain_diff":222985593,"tor_cpu_pct":1.38,"tor_mem":"98.64MiB"}
+{"ts":1782115207,"arm":"clearnet","reward_share":1.513,"avg_effort":71.078,"cur_effort":36.036,"hashrate_1h":270657,"hashrate_24h":268766,"shares_found":26,"shares_failed":0,"last_share":1782114901,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22482854,"sidechain_diff":224828540,"tor_cpu_pct":0.31,"tor_mem":"96.62MiB"}
+{"ts":1782115509,"arm":"clearnet","reward_share":1.515,"avg_effort":70.342,"cur_effort":26.483,"hashrate_1h":271201,"hashrate_24h":269448,"shares_found":27,"shares_failed":0,"last_share":1782115291,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22324407,"sidechain_diff":223244078,"tor_cpu_pct":2.28,"tor_mem":"96.49MiB"}
+{"ts":1782115810,"arm":"clearnet","reward_share":1.514,"avg_effort":70.342,"cur_effort":67.852,"hashrate_1h":278589,"hashrate_24h":270316,"shares_found":27,"shares_failed":0,"last_share":1782115291,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22836254,"sidechain_diff":228362543,"tor_cpu_pct":18.26,"tor_mem":"96.35MiB"}
+{"ts":1782116111,"arm":"clearnet","reward_share":1.469,"avg_effort":70.342,"cur_effort":102.326,"hashrate_1h":273493,"hashrate_24h":269896,"shares_found":27,"shares_failed":0,"last_share":1782115291,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":22488415,"sidechain_diff":224884153,"tor_cpu_pct":16.58,"tor_mem":"96.17MiB"}
+{"ts":1782116412,"arm":"clearnet","reward_share":1.423,"avg_effort":70.342,"cur_effort":141.080,"hashrate_1h":273383,"hashrate_24h":270084,"shares_found":27,"shares_failed":0,"last_share":1782115291,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":22524501,"sidechain_diff":225245019,"tor_cpu_pct":0.59,"tor_mem":"96.06MiB"}
+{"ts":1782116714,"arm":"clearnet","reward_share":1.422,"avg_effort":70.342,"cur_effort":179.329,"hashrate_1h":275596,"hashrate_24h":269931,"shares_found":27,"shares_failed":0,"last_share":1782115291,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":22061522,"sidechain_diff":220615224,"tor_cpu_pct":14.6,"tor_mem":"96.13MiB"}
+{"ts":1782117015,"arm":"clearnet","reward_share":1.466,"avg_effort":74.474,"cur_effort":33.908,"hashrate_1h":280387,"hashrate_24h":270816,"shares_found":28,"shares_failed":0,"last_share":1782116750,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":22303378,"sidechain_diff":223033783,"tor_cpu_pct":4.62,"tor_mem":"95.79MiB"}
+{"ts":1782117316,"arm":"clearnet","reward_share":1.375,"avg_effort":74.474,"cur_effort":71.767,"hashrate_1h":283479,"hashrate_24h":270959,"shares_found":28,"shares_failed":0,"last_share":1782116750,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":22298997,"sidechain_diff":222989977,"tor_cpu_pct":2.46,"tor_mem":"99.24MiB"}
+{"ts":1782117617,"arm":"clearnet","reward_share":1.376,"avg_effort":74.474,"cur_effort":105.709,"hashrate_1h":280085,"hashrate_24h":270468,"shares_found":28,"shares_failed":0,"last_share":1782116750,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":22219202,"sidechain_diff":222192021,"tor_cpu_pct":26.9,"tor_mem":"109.7MiB"}
+{"ts":1782117919,"arm":"clearnet","reward_share":1.384,"avg_effort":76.453,"cur_effort":12.457,"hashrate_1h":280357,"hashrate_24h":271030,"shares_found":29,"shares_failed":0,"last_share":1782117812,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22556625,"sidechain_diff":225566254,"tor_cpu_pct":16.07,"tor_mem":"96.22MiB"}
+{"ts":1782118220,"arm":"clearnet","reward_share":1.384,"avg_effort":76.453,"cur_effort":54.602,"hashrate_1h":280575,"hashrate_24h":271632,"shares_found":29,"shares_failed":0,"last_share":1782117812,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":22166622,"sidechain_diff":221666227,"tor_cpu_pct":11.07,"tor_mem":"95.76MiB"}
+{"ts":1782118521,"arm":"clearnet","reward_share":1.386,"avg_effort":76.453,"cur_effort":98.223,"hashrate_1h":290326,"hashrate_24h":272632,"shares_found":29,"shares_failed":0,"last_share":1782117812,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":22360968,"sidechain_diff":223609683,"tor_cpu_pct":2.97,"tor_mem":"95.78MiB"}
+{"ts":1782118822,"arm":"clearnet","reward_share":1.430,"avg_effort":78.077,"cur_effort":7.765,"hashrate_1h":285010,"hashrate_24h":271987,"shares_found":30,"shares_failed":0,"last_share":1782118758,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":21936655,"sidechain_diff":219366551,"tor_cpu_pct":13.62,"tor_mem":"95.74MiB"}
+{"ts":1782119124,"arm":"clearnet","reward_share":1.430,"avg_effort":78.077,"cur_effort":44.890,"hashrate_1h":282509,"hashrate_24h":272079,"shares_found":30,"shares_failed":0,"last_share":1782118758,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":21946779,"sidechain_diff":219467792,"tor_cpu_pct":20.71,"tor_mem":"95.91MiB"}
+{"ts":1782119425,"arm":"clearnet","reward_share":1.430,"avg_effort":78.077,"cur_effort":81.089,"hashrate_1h":279370,"hashrate_24h":271871,"shares_found":30,"shares_failed":0,"last_share":1782118758,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":22039718,"sidechain_diff":220397187,"tor_cpu_pct":20.78,"tor_mem":"96.46MiB"}
+{"ts":1782119726,"arm":"clearnet","reward_share":1.385,"avg_effort":78.077,"cur_effort":122.486,"hashrate_1h":284828,"hashrate_24h":272478,"shares_found":30,"shares_failed":0,"last_share":1782118758,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22088577,"sidechain_diff":220885773,"tor_cpu_pct":0.64,"tor_mem":"96.75MiB"}
+{"ts":1782120027,"arm":"clearnet","reward_share":1.430,"avg_effort":79.803,"cur_effort":30.171,"hashrate_1h":285708,"hashrate_24h":272830,"shares_found":31,"shares_failed":0,"last_share":1782119791,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":21973563,"sidechain_diff":219735635,"tor_cpu_pct":4.43,"tor_mem":"96.51MiB"}
+{"ts":1782120329,"arm":"clearnet","reward_share":1.431,"avg_effort":79.803,"cur_effort":75.615,"hashrate_1h":291532,"hashrate_24h":273676,"shares_found":31,"shares_failed":0,"last_share":1782119791,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22053149,"sidechain_diff":220531491,"tor_cpu_pct":23.16,"tor_mem":"96.75MiB"}
+{"ts":1782120630,"arm":"clearnet","reward_share":1.476,"avg_effort":80.517,"cur_effort":12.491,"hashrate_1h":286658,"hashrate_24h":273844,"shares_found":32,"shares_failed":0,"last_share":1782120509,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22013671,"sidechain_diff":220136719,"tor_cpu_pct":19.2,"tor_mem":"96.56MiB"}
+{"ts":1782120931,"arm":"clearnet","reward_share":1.523,"avg_effort":78.663,"cur_effort":24.328,"hashrate_1h":285102,"hashrate_24h":273326,"shares_found":33,"shares_failed":0,"last_share":1782120644,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22018781,"sidechain_diff":220187817,"tor_cpu_pct":11.73,"tor_mem":"96.57MiB"}
+{"ts":1782121232,"arm":"clearnet","reward_share":1.477,"avg_effort":78.663,"cur_effort":59.675,"hashrate_1h":286560,"hashrate_24h":273100,"shares_found":33,"shares_failed":0,"last_share":1782120644,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22231160,"sidechain_diff":222311600,"tor_cpu_pct":1,"tor_mem":"97.83MiB"}
+{"ts":1782121534,"arm":"clearnet","reward_share":1.478,"avg_effort":78.663,"cur_effort":95.833,"hashrate_1h":282028,"hashrate_24h":272865,"shares_found":33,"shares_failed":0,"last_share":1782120644,"peers_out":10,"peers_in":0,"peer_list":763,"pool_hr":22110822,"sidechain_diff":221108224,"tor_cpu_pct":32.02,"tor_mem":"98.24MiB"}
+{"ts":1782121835,"arm":"clearnet","reward_share":1.480,"avg_effort":78.663,"cur_effort":129.930,"hashrate_1h":277710,"hashrate_24h":272734,"shares_found":33,"shares_failed":0,"last_share":1782120644,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":22585161,"sidechain_diff":225851616,"tor_cpu_pct":25.91,"tor_mem":"97.1MiB"}
+{"ts":1782122136,"arm":"clearnet","reward_share":1.525,"avg_effort":81.084,"cur_effort":6.097,"hashrate_1h":273697,"hashrate_24h":272827,"shares_found":34,"shares_failed":0,"last_share":1782122049,"peers_out":10,"peers_in":0,"peer_list":762,"pool_hr":22410632,"sidechain_diff":224106324,"tor_cpu_pct":20.7,"tor_mem":"97.06MiB"}
+{"ts":1782122437,"arm":"clearnet","reward_share":1.479,"avg_effort":81.084,"cur_effort":39.654,"hashrate_1h":275440,"hashrate_24h":272504,"shares_found":34,"shares_failed":0,"last_share":1782122049,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":22335301,"sidechain_diff":223353010,"tor_cpu_pct":11.03,"tor_mem":"97.33MiB"}
+{"ts":1782122739,"arm":"clearnet","reward_share":1.523,"avg_effort":77.808,"cur_effort":23.143,"hashrate_1h":267573,"hashrate_24h":271489,"shares_found":36,"shares_failed":0,"last_share":1782122472,"peers_out":10,"peers_in":0,"peer_list":785,"pool_hr":22403511,"sidechain_diff":224035110,"tor_cpu_pct":18.42,"tor_mem":"97.46MiB"}
+{"ts":1782123040,"arm":"clearnet","reward_share":1.477,"avg_effort":77.808,"cur_effort":56.991,"hashrate_1h":267123,"hashrate_24h":271240,"shares_found":36,"shares_failed":0,"last_share":1782122472,"peers_out":10,"peers_in":0,"peer_list":795,"pool_hr":22457081,"sidechain_diff":224570815,"tor_cpu_pct":2.44,"tor_mem":"97.28MiB"}
+{"ts":1782123341,"arm":"clearnet","reward_share":1.478,"avg_effort":77.808,"cur_effort":92.547,"hashrate_1h":264813,"hashrate_24h":271247,"shares_found":36,"shares_failed":0,"last_share":1782122472,"peers_out":10,"peers_in":0,"peer_list":799,"pool_hr":22569040,"sidechain_diff":225690405,"tor_cpu_pct":3.25,"tor_mem":"97.27MiB"}
+{"ts":1782123642,"arm":"clearnet","reward_share":1.478,"avg_effort":77.808,"cur_effort":126.627,"hashrate_1h":259807,"hashrate_24h":271123,"shares_found":36,"shares_failed":0,"last_share":1782122472,"peers_out":10,"peers_in":0,"peer_list":808,"pool_hr":22588282,"sidechain_diff":225882827,"tor_cpu_pct":10.67,"tor_mem":"97.41MiB"}
+{"ts":1782123944,"arm":"clearnet","reward_share":1.478,"avg_effort":77.808,"cur_effort":160.673,"hashrate_1h":255564,"hashrate_24h":271039,"shares_found":36,"shares_failed":0,"last_share":1782122472,"peers_out":10,"peers_in":0,"peer_list":815,"pool_hr":22756615,"sidechain_diff":227566150,"tor_cpu_pct":19.32,"tor_mem":"97.08MiB"}
+{"ts":1782124245,"arm":"clearnet","reward_share":1.523,"avg_effort":80.494,"cur_effort":16.140,"hashrate_1h":250398,"hashrate_24h":270540,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":818,"pool_hr":23819252,"sidechain_diff":238192527,"tor_cpu_pct":15.14,"tor_mem":"97.02MiB"}
+{"ts":1782124546,"arm":"clearnet","reward_share":1.521,"avg_effort":80.494,"cur_effort":44.564,"hashrate_1h":251946,"hashrate_24h":270076,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":822,"pool_hr":23636207,"sidechain_diff":236362071,"tor_cpu_pct":14.49,"tor_mem":"97.01MiB"}
+{"ts":1782124847,"arm":"clearnet","reward_share":1.475,"avg_effort":80.494,"cur_effort":82.881,"hashrate_1h":254384,"hashrate_24h":270412,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":832,"pool_hr":23535315,"sidechain_diff":235353150,"tor_cpu_pct":14.83,"tor_mem":"97.3MiB"}
+{"ts":1782125149,"arm":"clearnet","reward_share":1.475,"avg_effort":80.494,"cur_effort":122.983,"hashrate_1h":259407,"hashrate_24h":270829,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":836,"pool_hr":23474953,"sidechain_diff":234749533,"tor_cpu_pct":16.99,"tor_mem":"97.17MiB"}
+{"ts":1782125450,"arm":"clearnet","reward_share":1.475,"avg_effort":80.494,"cur_effort":160.505,"hashrate_1h":259906,"hashrate_24h":270952,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":835,"pool_hr":23130378,"sidechain_diff":231303788,"tor_cpu_pct":0.55,"tor_mem":"97.17MiB"}
+{"ts":1782125751,"arm":"clearnet","reward_share":1.475,"avg_effort":80.494,"cur_effort":188.888,"hashrate_1h":255411,"hashrate_24h":270386,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":826,"pool_hr":23381032,"sidechain_diff":233810327,"tor_cpu_pct":2.76,"tor_mem":"97.21MiB"}
+{"ts":1782126052,"arm":"clearnet","reward_share":1.383,"avg_effort":80.494,"cur_effort":221.481,"hashrate_1h":257976,"hashrate_24h":270515,"shares_found":37,"shares_failed":0,"last_share":1782124070,"peers_out":10,"peers_in":0,"peer_list":802,"pool_hr":23326286,"sidechain_diff":233262864,"tor_cpu_pct":5.39,"tor_mem":"97.27MiB"}
+{"ts":1782126354,"arm":"clearnet","reward_share":1.419,"avg_effort":84.964,"cur_effort":17.292,"hashrate_1h":264079,"hashrate_24h":270496,"shares_found":38,"shares_failed":0,"last_share":1782126186,"peers_out":10,"peers_in":0,"peer_list":797,"pool_hr":23371074,"sidechain_diff":233710745,"tor_cpu_pct":22.57,"tor_mem":"97.54MiB"}
+{"ts":1782126655,"arm":"clearnet","reward_share":1.420,"avg_effort":83.890,"cur_effort":14.591,"hashrate_1h":269700,"hashrate_24h":271153,"shares_found":39,"shares_failed":0,"last_share":1782126545,"peers_out":10,"peers_in":0,"peer_list":797,"pool_hr":23730502,"sidechain_diff":237305024,"tor_cpu_pct":19.98,"tor_mem":"97.26MiB"}
+{"ts":1782126956,"arm":"clearnet","reward_share":1.373,"avg_effort":83.890,"cur_effort":54.362,"hashrate_1h":273357,"hashrate_24h":271513,"shares_found":39,"shares_failed":0,"last_share":1782126545,"peers_out":10,"peers_in":0,"peer_list":803,"pool_hr":23250221,"sidechain_diff":232502217,"tor_cpu_pct":17.81,"tor_mem":"97.7MiB"}
+{"ts":1782127257,"arm":"clearnet","reward_share":1.373,"avg_effort":83.890,"cur_effort":86.082,"hashrate_1h":272398,"hashrate_24h":271322,"shares_found":39,"shares_failed":0,"last_share":1782126545,"peers_out":10,"peers_in":0,"peer_list":802,"pool_hr":23019688,"sidechain_diff":230196884,"tor_cpu_pct":24.29,"tor_mem":"97.3MiB"}
+{"ts":1782127559,"arm":"clearnet","reward_share":1.372,"avg_effort":83.890,"cur_effort":118.531,"hashrate_1h":269660,"hashrate_24h":270889,"shares_found":39,"shares_failed":0,"last_share":1782126545,"peers_out":10,"peers_in":0,"peer_list":797,"pool_hr":22834562,"sidechain_diff":228345622,"tor_cpu_pct":29.12,"tor_mem":"97.6MiB"}
+{"ts":1782127860,"arm":"clearnet","reward_share":1.330,"avg_effort":85.685,"cur_effort":2.116,"hashrate_1h":276250,"hashrate_24h":271238,"shares_found":40,"shares_failed":0,"last_share":1782127819,"peers_out":10,"peers_in":0,"peer_list":787,"pool_hr":23007605,"sidechain_diff":230076056,"tor_cpu_pct":14.99,"tor_mem":"97.46MiB"}
+{"ts":1782128161,"arm":"clearnet","reward_share":1.373,"avg_effort":83.865,"cur_effort":16.811,"hashrate_1h":274382,"hashrate_24h":270556,"shares_found":41,"shares_failed":0,"last_share":1782127951,"peers_out":10,"peers_in":0,"peer_list":780,"pool_hr":23054635,"sidechain_diff":230546350,"tor_cpu_pct":24.17,"tor_mem":"97.79MiB"}
+{"ts":1782128462,"arm":"clearnet","reward_share":1.420,"avg_effort":82.594,"cur_effort":20.166,"hashrate_1h":271894,"hashrate_24h":270534,"shares_found":42,"shares_failed":0,"last_share":1782128290,"peers_out":10,"peers_in":0,"peer_list":782,"pool_hr":23338214,"sidechain_diff":233382145,"tor_cpu_pct":27.38,"tor_mem":"98.11MiB"}
+{"ts":1782128764,"arm":"clearnet","reward_share":1.419,"avg_effort":82.594,"cur_effort":55.938,"hashrate_1h":269309,"hashrate_24h":270601,"shares_found":42,"shares_failed":0,"last_share":1782128290,"peers_out":10,"peers_in":0,"peer_list":780,"pool_hr":23217883,"sidechain_diff":232178834,"tor_cpu_pct":15.09,"tor_mem":"97.83MiB"}
+{"ts":1782129065,"arm":"clearnet","reward_share":1.373,"avg_effort":82.594,"cur_effort":87.024,"hashrate_1h":265184,"hashrate_24h":270258,"shares_found":42,"shares_failed":0,"last_share":1782128290,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":23149514,"sidechain_diff":231495142,"tor_cpu_pct":23.49,"tor_mem":"98.28MiB"}
+{"ts":1782129366,"arm":"clearnet","reward_share":1.327,"avg_effort":82.594,"cur_effort":131.837,"hashrate_1h":275927,"hashrate_24h":271125,"shares_found":42,"shares_failed":0,"last_share":1782128290,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23438418,"sidechain_diff":234384180,"tor_cpu_pct":28.19,"tor_mem":"98.12MiB"}
+{"ts":1782129667,"arm":"clearnet","reward_share":1.283,"avg_effort":82.594,"cur_effort":173.900,"hashrate_1h":279419,"hashrate_24h":271520,"shares_found":42,"shares_failed":0,"last_share":1782128290,"peers_out":10,"peers_in":0,"peer_list":763,"pool_hr":23250932,"sidechain_diff":232509324,"tor_cpu_pct":29.55,"tor_mem":"98.68MiB"}
+{"ts":1782129969,"arm":"clearnet","reward_share":1.241,"avg_effort":85.490,"cur_effort":6.605,"hashrate_1h":278944,"hashrate_24h":271602,"shares_found":43,"shares_failed":0,"last_share":1782129924,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23151584,"sidechain_diff":231515842,"tor_cpu_pct":22.55,"tor_mem":"98.8MiB"}
+{"ts":1782130270,"arm":"clearnet","reward_share":1.239,"avg_effort":85.490,"cur_effort":50.443,"hashrate_1h":280321,"hashrate_24h":272197,"shares_found":43,"shares_failed":0,"last_share":1782129924,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22992612,"sidechain_diff":229926121,"tor_cpu_pct":32.26,"tor_mem":"98.63MiB"}
+{"ts":1782130571,"arm":"clearnet","reward_share":1.195,"avg_effort":85.490,"cur_effort":86.099,"hashrate_1h":277539,"hashrate_24h":272198,"shares_found":43,"shares_failed":0,"last_share":1782129924,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":23072138,"sidechain_diff":230721385,"tor_cpu_pct":30.24,"tor_mem":"98.67MiB"}
+{"ts":1782130872,"arm":"clearnet","reward_share":1.151,"avg_effort":85.490,"cur_effort":118.482,"hashrate_1h":279175,"hashrate_24h":272202,"shares_found":43,"shares_failed":0,"last_share":1782129924,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":23760077,"sidechain_diff":237600772,"tor_cpu_pct":21.45,"tor_mem":"98.68MiB"}
+{"ts":1782131174,"arm":"clearnet","reward_share":1.198,"avg_effort":86.534,"cur_effort":20.075,"hashrate_1h":280502,"hashrate_24h":271962,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":23546942,"sidechain_diff":235469422,"tor_cpu_pct":22.45,"tor_mem":"98.64MiB"}
+{"ts":1782131475,"arm":"clearnet","reward_share":1.153,"avg_effort":86.534,"cur_effort":61.412,"hashrate_1h":283321,"hashrate_24h":272496,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":23933221,"sidechain_diff":239332213,"tor_cpu_pct":40.3,"tor_mem":"98.98MiB"}
+{"ts":1782131776,"arm":"clearnet","reward_share":1.108,"avg_effort":86.534,"cur_effort":90.743,"hashrate_1h":284209,"hashrate_24h":272056,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":23821260,"sidechain_diff":238212605,"tor_cpu_pct":23.15,"tor_mem":"98.73MiB"}
+{"ts":1782132077,"arm":"clearnet","reward_share":1.107,"avg_effort":86.534,"cur_effort":125.122,"hashrate_1h":283775,"hashrate_24h":272038,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":23839240,"sidechain_diff":238392409,"tor_cpu_pct":17.16,"tor_mem":"98.66MiB"}
+{"ts":1782132379,"arm":"clearnet","reward_share":1.106,"avg_effort":86.534,"cur_effort":157.891,"hashrate_1h":283883,"hashrate_24h":272105,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":23993526,"sidechain_diff":239935263,"tor_cpu_pct":15.35,"tor_mem":"98.73MiB"}
+{"ts":1782132680,"arm":"clearnet","reward_share":1.061,"avg_effort":86.534,"cur_effort":193.088,"hashrate_1h":286613,"hashrate_24h":272079,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":23821724,"sidechain_diff":238217240,"tor_cpu_pct":19.27,"tor_mem":"98.82MiB"}
+{"ts":1782132981,"arm":"clearnet","reward_share":1.061,"avg_effort":86.534,"cur_effort":228.850,"hashrate_1h":278644,"hashrate_24h":271950,"shares_found":44,"shares_failed":0,"last_share":1782130965,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":23465483,"sidechain_diff":234654830,"tor_cpu_pct":22.65,"tor_mem":"98.6MiB"}
+{"ts":1782133282,"arm":"clearnet","reward_share":1.152,"avg_effort":88.629,"cur_effort":12.102,"hashrate_1h":284138,"hashrate_24h":272866,"shares_found":46,"shares_failed":0,"last_share":1782133196,"peers_out":10,"peers_in":0,"peer_list":764,"pool_hr":23366701,"sidechain_diff":233667014,"tor_cpu_pct":0.58,"tor_mem":"98.57MiB"}
+{"ts":1782133584,"arm":"clearnet","reward_share":1.151,"avg_effort":88.629,"cur_effort":42.703,"hashrate_1h":279605,"hashrate_24h":272500,"shares_found":46,"shares_failed":0,"last_share":1782133196,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":23762086,"sidechain_diff":237620868,"tor_cpu_pct":18.77,"tor_mem":"98.71MiB"}
+{"ts":1782133885,"arm":"clearnet","reward_share":1.149,"avg_effort":88.629,"cur_effort":73.265,"hashrate_1h":272410,"hashrate_24h":272272,"shares_found":46,"shares_failed":0,"last_share":1782133196,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23510968,"sidechain_diff":235109680,"tor_cpu_pct":24.85,"tor_mem":"98.72MiB"}
+{"ts":1782134186,"arm":"clearnet","reward_share":1.148,"avg_effort":88.629,"cur_effort":109.952,"hashrate_1h":271626,"hashrate_24h":272298,"shares_found":46,"shares_failed":0,"last_share":1782133196,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":23651898,"sidechain_diff":236518981,"tor_cpu_pct":17.65,"tor_mem":"98.89MiB"}
+{"ts":1782134487,"arm":"clearnet","reward_share":1.194,"avg_effort":89.921,"cur_effort":0.000,"hashrate_1h":275038,"hashrate_24h":272394,"shares_found":47,"shares_failed":0,"last_share":1782134480,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":23397344,"sidechain_diff":233973444,"tor_cpu_pct":23.84,"tor_mem":"99.05MiB"}
+{"ts":1782134789,"arm":"clearnet","reward_share":1.193,"avg_effort":89.921,"cur_effort":32.680,"hashrate_1h":273891,"hashrate_24h":272208,"shares_found":47,"shares_failed":0,"last_share":1782134480,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":23165730,"sidechain_diff":231657306,"tor_cpu_pct":21.44,"tor_mem":"98.96MiB"}
+{"ts":1782135090,"arm":"clearnet","reward_share":1.149,"avg_effort":89.921,"cur_effort":61.755,"hashrate_1h":266181,"hashrate_24h":271783,"shares_found":47,"shares_failed":0,"last_share":1782134480,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23076126,"sidechain_diff":230761265,"tor_cpu_pct":22.29,"tor_mem":"98.81MiB"}
+{"ts":1782135391,"arm":"clearnet","reward_share":1.149,"avg_effort":89.921,"cur_effort":94.209,"hashrate_1h":268619,"hashrate_24h":271669,"shares_found":47,"shares_failed":0,"last_share":1782134480,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":23398418,"sidechain_diff":233984186,"tor_cpu_pct":21.69,"tor_mem":"100.7MiB"}
+{"ts":1782135692,"arm":"clearnet","reward_share":1.104,"avg_effort":89.921,"cur_effort":124.195,"hashrate_1h":264635,"hashrate_24h":271275,"shares_found":47,"shares_failed":0,"last_share":1782134480,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":23195015,"sidechain_diff":231950155,"tor_cpu_pct":20.67,"tor_mem":"100.6MiB"}
+{"ts":1782135994,"arm":"clearnet","reward_share":1.102,"avg_effort":89.921,"cur_effort":162.549,"hashrate_1h":266605,"hashrate_24h":271596,"shares_found":47,"shares_failed":0,"last_share":1782134480,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":23414219,"sidechain_diff":234142197,"tor_cpu_pct":26,"tor_mem":"100.8MiB"}
+{"ts":1782136295,"arm":"clearnet","reward_share":1.105,"avg_effort":91.595,"cur_effort":28.535,"hashrate_1h":267430,"hashrate_24h":271663,"shares_found":48,"shares_failed":0,"last_share":1782136052,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":23443619,"sidechain_diff":234436199,"tor_cpu_pct":24.12,"tor_mem":"96MiB"}
+{"ts":1782136596,"arm":"clearnet","reward_share":1.105,"avg_effort":91.595,"cur_effort":70.783,"hashrate_1h":271187,"hashrate_24h":272041,"shares_found":48,"shares_failed":0,"last_share":1782136052,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":23096119,"sidechain_diff":230961195,"tor_cpu_pct":24.77,"tor_mem":"96.2MiB"}
+{"ts":1782136897,"arm":"clearnet","reward_share":1.105,"avg_effort":91.300,"cur_effort":34.090,"hashrate_1h":267919,"hashrate_24h":272323,"shares_found":49,"shares_failed":0,"last_share":1782136631,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":23128033,"sidechain_diff":231280330,"tor_cpu_pct":22.61,"tor_mem":"95.77MiB"}
+{"ts":1782137199,"arm":"clearnet","reward_share":1.061,"avg_effort":91.300,"cur_effort":74.156,"hashrate_1h":274193,"hashrate_24h":272600,"shares_found":49,"shares_failed":0,"last_share":1782136631,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":23077144,"sidechain_diff":230771443,"tor_cpu_pct":3.73,"tor_mem":"95.85MiB"}
+{"ts":1782137500,"arm":"clearnet","reward_share":1.151,"avg_effort":89.851,"cur_effort":4.933,"hashrate_1h":280018,"hashrate_24h":272900,"shares_found":51,"shares_failed":0,"last_share":1782137450,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22875744,"sidechain_diff":228757447,"tor_cpu_pct":25.28,"tor_mem":"96.01MiB"}
+{"ts":1782137801,"arm":"clearnet","reward_share":1.107,"avg_effort":89.851,"cur_effort":41.417,"hashrate_1h":279250,"hashrate_24h":272943,"shares_found":51,"shares_failed":0,"last_share":1782137450,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":22951752,"sidechain_diff":229517523,"tor_cpu_pct":25.3,"tor_mem":"96MiB"}
+{"ts":1782138102,"arm":"clearnet","reward_share":1.108,"avg_effort":89.444,"cur_effort":6.590,"hashrate_1h":278130,"hashrate_24h":272907,"shares_found":52,"shares_failed":0,"last_share":1782138039,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":22891479,"sidechain_diff":228914798,"tor_cpu_pct":22.65,"tor_mem":"96.03MiB"}
+{"ts":1782138404,"arm":"clearnet","reward_share":1.109,"avg_effort":89.444,"cur_effort":41.324,"hashrate_1h":278335,"hashrate_24h":272768,"shares_found":52,"shares_failed":0,"last_share":1782138039,"peers_out":10,"peers_in":0,"peer_list":762,"pool_hr":22949080,"sidechain_diff":229490801,"tor_cpu_pct":22.34,"tor_mem":"96.05MiB"}
+{"ts":1782138705,"arm":"clearnet","reward_share":1.153,"avg_effort":88.870,"cur_effort":15.949,"hashrate_1h":281795,"hashrate_24h":272731,"shares_found":53,"shares_failed":0,"last_share":1782138547,"peers_out":10,"peers_in":0,"peer_list":761,"pool_hr":23001487,"sidechain_diff":230014875,"tor_cpu_pct":7.21,"tor_mem":"95.81MiB"}
+{"ts":1782139006,"arm":"clearnet","reward_share":1.153,"avg_effort":88.870,"cur_effort":46.579,"hashrate_1h":279792,"hashrate_24h":272378,"shares_found":53,"shares_failed":0,"last_share":1782138547,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":22967670,"sidechain_diff":229676704,"tor_cpu_pct":24.38,"tor_mem":"95.79MiB"}
+{"ts":1782139307,"arm":"clearnet","reward_share":1.110,"avg_effort":88.870,"cur_effort":76.890,"hashrate_1h":281035,"hashrate_24h":272191,"shares_found":53,"shares_failed":0,"last_share":1782138547,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":23077059,"sidechain_diff":230770594,"tor_cpu_pct":23.66,"tor_mem":"94.97MiB"}
+{"ts":1782139609,"arm":"clearnet","reward_share":1.110,"avg_effort":88.870,"cur_effort":107.131,"hashrate_1h":275412,"hashrate_24h":271909,"shares_found":53,"shares_failed":0,"last_share":1782138547,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":23137954,"sidechain_diff":231379547,"tor_cpu_pct":25.87,"tor_mem":"94.97MiB"}
+{"ts":1782139910,"arm":"clearnet","reward_share":1.155,"avg_effort":89.460,"cur_effort":24.058,"hashrate_1h":274607,"hashrate_24h":271924,"shares_found":54,"shares_failed":0,"last_share":1782139720,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":23178211,"sidechain_diff":231782116,"tor_cpu_pct":31.02,"tor_mem":"94.96MiB"}
+{"ts":1782140211,"arm":"clearnet","reward_share":1.111,"avg_effort":89.460,"cur_effort":64.037,"hashrate_1h":274388,"hashrate_24h":272190,"shares_found":54,"shares_failed":0,"last_share":1782139720,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":23419238,"sidechain_diff":234192388,"tor_cpu_pct":22.14,"tor_mem":"95.1MiB"}
+{"ts":1782140512,"arm":"clearnet","reward_share":1.154,"avg_effort":89.392,"cur_effort":14.983,"hashrate_1h":271838,"hashrate_24h":272281,"shares_found":55,"shares_failed":0,"last_share":1782140391,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":23111208,"sidechain_diff":231112083,"tor_cpu_pct":22.03,"tor_mem":"94.97MiB"}
+{"ts":1782140814,"arm":"clearnet","reward_share":1.198,"avg_effort":88.551,"cur_effort":10.985,"hashrate_1h":272463,"hashrate_24h":272569,"shares_found":56,"shares_failed":0,"last_share":1782140729,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":23117267,"sidechain_diff":231172673,"tor_cpu_pct":20.86,"tor_mem":"95.07MiB"}
+{"ts":1782141115,"arm":"clearnet","reward_share":1.155,"avg_effort":88.551,"cur_effort":41.865,"hashrate_1h":265811,"hashrate_24h":272287,"shares_found":56,"shares_failed":0,"last_share":1782140729,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22999487,"sidechain_diff":229994870,"tor_cpu_pct":29.64,"tor_mem":"94.86MiB"}
+{"ts":1782141416,"arm":"clearnet","reward_share":1.155,"avg_effort":88.551,"cur_effort":77.034,"hashrate_1h":264429,"hashrate_24h":272247,"shares_found":56,"shares_failed":0,"last_share":1782140729,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22992433,"sidechain_diff":229924331,"tor_cpu_pct":29.16,"tor_mem":"95.38MiB"}
+{"ts":1782141717,"arm":"clearnet","reward_share":1.155,"avg_effort":88.551,"cur_effort":114.512,"hashrate_1h":265902,"hashrate_24h":272269,"shares_found":56,"shares_failed":0,"last_share":1782140729,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":22989723,"sidechain_diff":229897236,"tor_cpu_pct":21.8,"tor_mem":"95.49MiB"}
+{"ts":1782142019,"arm":"clearnet","reward_share":1.156,"avg_effort":89.286,"cur_effort":26.248,"hashrate_1h":269729,"hashrate_24h":272563,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":23107489,"sidechain_diff":231074899,"tor_cpu_pct":27.36,"tor_mem":"95.39MiB"}
+{"ts":1782142320,"arm":"clearnet","reward_share":1.156,"avg_effort":89.286,"cur_effort":62.672,"hashrate_1h":271730,"hashrate_24h":272616,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23135924,"sidechain_diff":231359247,"tor_cpu_pct":36.71,"tor_mem":"95.18MiB"}
+{"ts":1782142621,"arm":"clearnet","reward_share":1.111,"avg_effort":89.286,"cur_effort":103.538,"hashrate_1h":277810,"hashrate_24h":272891,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":23120652,"sidechain_diff":231206520,"tor_cpu_pct":5.11,"tor_mem":"94.93MiB"}
+{"ts":1782142922,"arm":"clearnet","reward_share":1.068,"avg_effort":89.286,"cur_effort":136.357,"hashrate_1h":279261,"hashrate_24h":272757,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":23153272,"sidechain_diff":231532725,"tor_cpu_pct":25.47,"tor_mem":"95.96MiB"}
+{"ts":1782143224,"arm":"clearnet","reward_share":1.068,"avg_effort":89.286,"cur_effort":171.972,"hashrate_1h":284699,"hashrate_24h":272845,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":22978358,"sidechain_diff":229783588,"tor_cpu_pct":17.56,"tor_mem":"95.14MiB"}
+{"ts":1782143525,"arm":"clearnet","reward_share":1.067,"avg_effort":89.286,"cur_effort":200.246,"hashrate_1h":276076,"hashrate_24h":272363,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":756,"pool_hr":22951935,"sidechain_diff":229519352,"tor_cpu_pct":16.53,"tor_mem":"94.96MiB"}
+{"ts":1782143826,"arm":"clearnet","reward_share":1.066,"avg_effort":89.286,"cur_effort":243.992,"hashrate_1h":278627,"hashrate_24h":272721,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":759,"pool_hr":22864526,"sidechain_diff":228645268,"tor_cpu_pct":13.82,"tor_mem":"95.19MiB"}
+{"ts":1782144127,"arm":"clearnet","reward_share":1.067,"avg_effort":89.286,"cur_effort":271.391,"hashrate_1h":274856,"hashrate_24h":272486,"shares_found":57,"shares_failed":0,"last_share":1782141837,"peers_out":10,"peers_in":0,"peer_list":757,"pool_hr":23168315,"sidechain_diff":231683150,"tor_cpu_pct":23.66,"tor_mem":"94.88MiB"}
+{"ts":1782144429,"arm":"clearnet","reward_share":1.069,"avg_effort":92.860,"cur_effort":10.295,"hashrate_1h":271847,"hashrate_24h":272431,"shares_found":58,"shares_failed":0,"last_share":1782144340,"peers_out":10,"peers_in":0,"peer_list":763,"pool_hr":24019478,"sidechain_diff":240194781,"tor_cpu_pct":23.28,"tor_mem":"94.87MiB"}
+{"ts":1782144730,"arm":"clearnet","reward_share":0.980,"avg_effort":92.860,"cur_effort":40.131,"hashrate_1h":271504,"hashrate_24h":272213,"shares_found":58,"shares_failed":0,"last_share":1782144340,"peers_out":10,"peers_in":0,"peer_list":763,"pool_hr":23526202,"sidechain_diff":235262024,"tor_cpu_pct":26.73,"tor_mem":"95.12MiB"}
+{"ts":1782145031,"arm":"clearnet","reward_share":0.979,"avg_effort":92.860,"cur_effort":71.646,"hashrate_1h":267211,"hashrate_24h":271941,"shares_found":58,"shares_failed":0,"last_share":1782144340,"peers_out":10,"peers_in":0,"peer_list":764,"pool_hr":23158437,"sidechain_diff":231584377,"tor_cpu_pct":33.5,"tor_mem":"95.25MiB"}
+{"ts":1782145332,"arm":"clearnet","reward_share":0.978,"avg_effort":92.860,"cur_effort":100.952,"hashrate_1h":265867,"hashrate_24h":271762,"shares_found":58,"shares_failed":0,"last_share":1782144340,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":23757514,"sidechain_diff":237575149,"tor_cpu_pct":27,"tor_mem":"95.33MiB"}
+{"ts":1782145634,"arm":"clearnet","reward_share":0.978,"avg_effort":92.860,"cur_effort":138.376,"hashrate_1h":263387,"hashrate_24h":271843,"shares_found":58,"shares_failed":0,"last_share":1782144340,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":23494264,"sidechain_diff":234942642,"tor_cpu_pct":19.32,"tor_mem":"95.21MiB"}
+{"ts":1782145935,"arm":"clearnet","reward_share":1.024,"avg_effort":93.806,"cur_effort":23.642,"hashrate_1h":260463,"hashrate_24h":271676,"shares_found":59,"shares_failed":0,"last_share":1782145697,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":23270831,"sidechain_diff":232708310,"tor_cpu_pct":30.58,"tor_mem":"95.13MiB"}
+{"ts":1782146236,"arm":"clearnet","reward_share":1.024,"avg_effort":93.806,"cur_effort":53.168,"hashrate_1h":253369,"hashrate_24h":271426,"shares_found":59,"shares_failed":0,"last_share":1782145697,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":23112643,"sidechain_diff":231126439,"tor_cpu_pct":30.23,"tor_mem":"95.15MiB"}
+{"ts":1782146537,"arm":"clearnet","reward_share":1.068,"avg_effort":93.669,"cur_effort":2.146,"hashrate_1h":253072,"hashrate_24h":271276,"shares_found":60,"shares_failed":0,"last_share":1782146514,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":24029917,"sidechain_diff":240299177,"tor_cpu_pct":21.2,"tor_mem":"95.52MiB"}
+{"ts":1782146839,"arm":"clearnet","reward_share":1.071,"avg_effort":92.287,"cur_effort":22.433,"hashrate_1h":253036,"hashrate_24h":271239,"shares_found":61,"shares_failed":0,"last_share":1782146632,"peers_out":10,"peers_in":0,"peer_list":778,"pool_hr":23655526,"sidechain_diff":236555260,"tor_cpu_pct":20.49,"tor_mem":"95.23MiB"}
+{"ts":1782147140,"arm":"clearnet","reward_share":1.071,"avg_effort":92.287,"cur_effort":60.313,"hashrate_1h":258936,"hashrate_24h":271477,"shares_found":61,"shares_failed":0,"last_share":1782146632,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":23385485,"sidechain_diff":233854852,"tor_cpu_pct":12.96,"tor_mem":"95.05MiB"}
+{"ts":1782147441,"arm":"clearnet","reward_share":1.117,"avg_effort":92.252,"cur_effort":19.398,"hashrate_1h":264770,"hashrate_24h":272098,"shares_found":62,"shares_failed":0,"last_share":1782147298,"peers_out":10,"peers_in":0,"peer_list":778,"pool_hr":23189179,"sidechain_diff":231891794,"tor_cpu_pct":31.96,"tor_mem":"95.37MiB"}
+{"ts":1782147742,"arm":"clearnet","reward_share":1.117,"avg_effort":92.252,"cur_effort":51.285,"hashrate_1h":265644,"hashrate_24h":271997,"shares_found":62,"shares_failed":0,"last_share":1782147298,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":23258413,"sidechain_diff":232584130,"tor_cpu_pct":21.59,"tor_mem":"95.12MiB"}
+{"ts":1782148044,"arm":"clearnet","reward_share":1.117,"avg_effort":92.252,"cur_effort":89.773,"hashrate_1h":269006,"hashrate_24h":272087,"shares_found":62,"shares_failed":0,"last_share":1782147298,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":23434314,"sidechain_diff":234343140,"tor_cpu_pct":20.09,"tor_mem":"95.04MiB"}
+{"ts":1782148345,"arm":"clearnet","reward_share":1.117,"avg_effort":92.252,"cur_effort":118.368,"hashrate_1h":267496,"hashrate_24h":271870,"shares_found":62,"shares_failed":0,"last_share":1782147298,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22955318,"sidechain_diff":229553187,"tor_cpu_pct":18.35,"tor_mem":"94.99MiB"}
+{"ts":1782148646,"arm":"clearnet","reward_share":1.118,"avg_effort":92.252,"cur_effort":159.496,"hashrate_1h":272821,"hashrate_24h":271978,"shares_found":62,"shares_failed":0,"last_share":1782147298,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":23109022,"sidechain_diff":231090220,"tor_cpu_pct":19.74,"tor_mem":"95.28MiB"}
+{"ts":1782148947,"arm":"clearnet","reward_share":1.083,"avg_effort":92.252,"cur_effort":201.841,"hashrate_1h":279133,"hashrate_24h":272343,"shares_found":62,"shares_failed":0,"last_share":1782147298,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":23181450,"sidechain_diff":231814506,"tor_cpu_pct":26.48,"tor_mem":"95.26MiB"}
+{"ts":1782149249,"arm":"clearnet","reward_share":1.128,"avg_effort":94.470,"cur_effort":12.547,"hashrate_1h":281886,"hashrate_24h":272521,"shares_found":63,"shares_failed":0,"last_share":1782149138,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22860951,"sidechain_diff":228609512,"tor_cpu_pct":25.5,"tor_mem":"98.7MiB"}
+{"ts":1782149550,"arm":"clearnet","reward_share":1.127,"avg_effort":93.631,"cur_effort":11.824,"hashrate_1h":286601,"hashrate_24h":272730,"shares_found":64,"shares_failed":0,"last_share":1782149425,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":22630177,"sidechain_diff":226301771,"tor_cpu_pct":20.22,"tor_mem":"96.3MiB"}
+{"ts":1782149851,"arm":"clearnet","reward_share":1.127,"avg_effort":93.631,"cur_effort":44.312,"hashrate_1h":288435,"hashrate_24h":272572,"shares_found":64,"shares_failed":0,"last_share":1782149425,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":22955201,"sidechain_diff":229552017,"tor_cpu_pct":10.62,"tor_mem":"95.16MiB"}
+{"ts":1782150152,"arm":"clearnet","reward_share":1.127,"avg_effort":93.631,"cur_effort":86.570,"hashrate_1h":292582,"hashrate_24h":272839,"shares_found":64,"shares_failed":0,"last_share":1782149425,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22752934,"sidechain_diff":227529340,"tor_cpu_pct":4.56,"tor_mem":"95MiB"}
+{"ts":1782150454,"arm":"clearnet","reward_share":1.127,"avg_effort":93.631,"cur_effort":118.329,"hashrate_1h":290820,"hashrate_24h":272623,"shares_found":64,"shares_failed":0,"last_share":1782149425,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22332729,"sidechain_diff":223327293,"tor_cpu_pct":1.34,"tor_mem":"92.46MiB"}
+{"ts":1782150755,"arm":"clearnet","reward_share":1.083,"avg_effort":94.262,"cur_effort":19.970,"hashrate_1h":283500,"hashrate_24h":272515,"shares_found":65,"shares_failed":0,"last_share":1782150562,"peers_out":10,"peers_in":0,"peer_list":781,"pool_hr":22514464,"sidechain_diff":225144641,"tor_cpu_pct":20.8,"tor_mem":"92.65MiB"}
+{"ts":1782151056,"arm":"clearnet","reward_share":1.038,"avg_effort":94.262,"cur_effort":60.384,"hashrate_1h":280996,"hashrate_24h":272724,"shares_found":65,"shares_failed":0,"last_share":1782150562,"peers_out":10,"peers_in":0,"peer_list":781,"pool_hr":22233975,"sidechain_diff":222339754,"tor_cpu_pct":0.53,"tor_mem":"92.18MiB"}
+{"ts":1782151357,"arm":"clearnet","reward_share":1.039,"avg_effort":94.262,"cur_effort":95.914,"hashrate_1h":281321,"hashrate_24h":272684,"shares_found":65,"shares_failed":0,"last_share":1782150562,"peers_out":10,"peers_in":0,"peer_list":781,"pool_hr":22489245,"sidechain_diff":224892456,"tor_cpu_pct":17.53,"tor_mem":"92.13MiB"}
+{"ts":1782151659,"arm":"clearnet","reward_share":1.040,"avg_effort":94.262,"cur_effort":132.711,"hashrate_1h":281051,"hashrate_24h":272659,"shares_found":65,"shares_failed":0,"last_share":1782150562,"peers_out":10,"peers_in":0,"peer_list":781,"pool_hr":22518121,"sidechain_diff":225181210,"tor_cpu_pct":20.77,"tor_mem":"92.7MiB"}
+{"ts":1782151960,"arm":"clearnet","reward_share":1.086,"avg_effort":94.842,"cur_effort":45.032,"hashrate_1h":290080,"hashrate_24h":273099,"shares_found":66,"shares_failed":0,"last_share":1782151660,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":22537304,"sidechain_diff":225373040,"tor_cpu_pct":15.64,"tor_mem":"92.54MiB"}
+{"ts":1782152261,"arm":"clearnet","reward_share":1.086,"avg_effort":94.842,"cur_effort":80.448,"hashrate_1h":287617,"hashrate_24h":273021,"shares_found":66,"shares_failed":0,"last_share":1782151660,"peers_out":10,"peers_in":0,"peer_list":780,"pool_hr":22378810,"sidechain_diff":223788102,"tor_cpu_pct":18.79,"tor_mem":"92.7MiB"}
+{"ts":1782152562,"arm":"clearnet","reward_share":1.086,"avg_effort":94.842,"cur_effort":111.497,"hashrate_1h":279257,"hashrate_24h":272769,"shares_found":66,"shares_failed":0,"last_share":1782151660,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":22500328,"sidechain_diff":225003287,"tor_cpu_pct":12.14,"tor_mem":"92.05MiB"}
+{"ts":1782152864,"arm":"clearnet","reward_share":1.085,"avg_effort":95.619,"cur_effort":0.130,"hashrate_1h":276207,"hashrate_24h":272793,"shares_found":67,"shares_failed":0,"last_share":1782152838,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22491968,"sidechain_diff":224919689,"tor_cpu_pct":15.97,"tor_mem":"92.37MiB"}
+{"ts":1782153165,"arm":"clearnet","reward_share":1.087,"avg_effort":95.619,"cur_effort":31.252,"hashrate_1h":269563,"hashrate_24h":272482,"shares_found":67,"shares_failed":0,"last_share":1782152838,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22514398,"sidechain_diff":225143987,"tor_cpu_pct":24.06,"tor_mem":"92.29MiB"}
+{"ts":1782153466,"arm":"clearnet","reward_share":1.087,"avg_effort":95.619,"cur_effort":67.085,"hashrate_1h":271118,"hashrate_24h":272486,"shares_found":67,"shares_failed":0,"last_share":1782152838,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":22312892,"sidechain_diff":223128926,"tor_cpu_pct":1.32,"tor_mem":"92.09MiB"}
+{"ts":1782153767,"arm":"clearnet","reward_share":1.085,"avg_effort":95.344,"cur_effort":25.190,"hashrate_1h":265847,"hashrate_24h":272383,"shares_found":68,"shares_failed":0,"last_share":1782153530,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":22512028,"sidechain_diff":225120288,"tor_cpu_pct":1.89,"tor_mem":"92.11MiB"}
+{"ts":1782154069,"arm":"clearnet","reward_share":1.131,"avg_effort":94.835,"cur_effort":1.931,"hashrate_1h":271483,"hashrate_24h":272550,"shares_found":69,"shares_failed":0,"last_share":1782154029,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":23063536,"sidechain_diff":230635365,"tor_cpu_pct":1.17,"tor_mem":"92.33MiB"}
+{"ts":1782154370,"arm":"clearnet","reward_share":1.132,"avg_effort":94.835,"cur_effort":36.878,"hashrate_1h":272608,"hashrate_24h":272521,"shares_found":69,"shares_failed":0,"last_share":1782154029,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":23047499,"sidechain_diff":230474998,"tor_cpu_pct":2.15,"tor_mem":"92.09MiB"}
+{"ts":1782154671,"arm":"clearnet","reward_share":1.177,"avg_effort":94.314,"cur_effort":18.408,"hashrate_1h":272042,"hashrate_24h":272631,"shares_found":70,"shares_failed":0,"last_share":1782154501,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":22828747,"sidechain_diff":228287472,"tor_cpu_pct":20.32,"tor_mem":"92.07MiB"}
+{"ts":1782154972,"arm":"clearnet","reward_share":1.178,"avg_effort":94.314,"cur_effort":51.641,"hashrate_1h":270208,"hashrate_24h":272502,"shares_found":70,"shares_failed":0,"last_share":1782154501,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22976132,"sidechain_diff":229761324,"tor_cpu_pct":15.39,"tor_mem":"92.05MiB"}
+{"ts":1782155274,"arm":"clearnet","reward_share":1.178,"avg_effort":94.314,"cur_effort":80.786,"hashrate_1h":267069,"hashrate_24h":272298,"shares_found":70,"shares_failed":0,"last_share":1782154501,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":23216991,"sidechain_diff":232169919,"tor_cpu_pct":18.63,"tor_mem":"92.2MiB"}
+{"ts":1782155575,"arm":"clearnet","reward_share":1.179,"avg_effort":94.314,"cur_effort":114.776,"hashrate_1h":260812,"hashrate_24h":272317,"shares_found":70,"shares_failed":0,"last_share":1782154501,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":23626648,"sidechain_diff":236266481,"tor_cpu_pct":17.27,"tor_mem":"92.38MiB"}
+{"ts":1782155876,"arm":"clearnet","reward_share":1.087,"avg_effort":94.314,"cur_effort":147.501,"hashrate_1h":259922,"hashrate_24h":272210,"shares_found":70,"shares_failed":0,"last_share":1782154501,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":23492818,"sidechain_diff":234928183,"tor_cpu_pct":30.51,"tor_mem":"93.08MiB"}
+{"ts":1782156177,"arm":"clearnet","reward_share":1.134,"avg_effort":95.560,"cur_effort":3.501,"hashrate_1h":264042,"hashrate_24h":272228,"shares_found":71,"shares_failed":0,"last_share":1782156126,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":23071291,"sidechain_diff":230712910,"tor_cpu_pct":18.35,"tor_mem":"96.53MiB"}
+{"ts":1782156479,"arm":"clearnet","reward_share":1.134,"avg_effort":95.560,"cur_effort":38.281,"hashrate_1h":262537,"hashrate_24h":272194,"shares_found":71,"shares_failed":0,"last_share":1782156126,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":23144788,"sidechain_diff":231447883,"tor_cpu_pct":26.16,"tor_mem":"98.8MiB"}
+{"ts":1782156780,"arm":"clearnet","reward_share":1.088,"avg_effort":95.560,"cur_effort":69.766,"hashrate_1h":264877,"hashrate_24h":271985,"shares_found":71,"shares_failed":0,"last_share":1782156126,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":23219112,"sidechain_diff":232191126,"tor_cpu_pct":17.28,"tor_mem":"96.13MiB"}
+{"ts":1782157081,"arm":"clearnet","reward_share":1.088,"avg_effort":95.560,"cur_effort":107.624,"hashrate_1h":266839,"hashrate_24h":272084,"shares_found":71,"shares_failed":0,"last_share":1782156126,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23275767,"sidechain_diff":232757678,"tor_cpu_pct":27.42,"tor_mem":"96.04MiB"}
+{"ts":1782157382,"arm":"clearnet","reward_share":1.134,"avg_effort":96.120,"cur_effort":1.634,"hashrate_1h":265590,"hashrate_24h":271942,"shares_found":72,"shares_failed":0,"last_share":1782157353,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":23148320,"sidechain_diff":231483200,"tor_cpu_pct":19.31,"tor_mem":"97.32MiB"}
+{"ts":1782157684,"arm":"clearnet","reward_share":1.134,"avg_effort":96.120,"cur_effort":41.358,"hashrate_1h":264015,"hashrate_24h":272027,"shares_found":72,"shares_failed":0,"last_share":1782157353,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":23149315,"sidechain_diff":231493158,"tor_cpu_pct":18.32,"tor_mem":"96.02MiB"}
+{"ts":1782157985,"arm":"clearnet","reward_share":1.181,"avg_effort":95.686,"cur_effort":18.185,"hashrate_1h":269178,"hashrate_24h":272380,"shares_found":73,"shares_failed":0,"last_share":1782157844,"peers_out":10,"peers_in":0,"peer_list":761,"pool_hr":23008396,"sidechain_diff":230083963,"tor_cpu_pct":17.85,"tor_mem":"95.71MiB"}
+{"ts":1782158286,"arm":"clearnet","reward_share":1.134,"avg_effort":95.686,"cur_effort":58.209,"hashrate_1h":270207,"hashrate_24h":272509,"shares_found":73,"shares_failed":0,"last_share":1782157844,"peers_out":10,"peers_in":0,"peer_list":762,"pool_hr":23926534,"sidechain_diff":239265349,"tor_cpu_pct":23.2,"tor_mem":"95.95MiB"}
+{"ts":1782158587,"arm":"clearnet","reward_share":1.180,"avg_effort":95.425,"cur_effort":11.395,"hashrate_1h":270723,"hashrate_24h":272411,"shares_found":74,"shares_failed":0,"last_share":1782158470,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":23539558,"sidechain_diff":235395580,"tor_cpu_pct":18.86,"tor_mem":"95.95MiB"}
+{"ts":1782158889,"arm":"clearnet","reward_share":1.134,"avg_effort":95.425,"cur_effort":47.023,"hashrate_1h":272776,"hashrate_24h":272376,"shares_found":74,"shares_failed":0,"last_share":1782158470,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":23328776,"sidechain_diff":233287765,"tor_cpu_pct":24.97,"tor_mem":"95.53MiB"}
+{"ts":1782159190,"arm":"clearnet","reward_share":1.135,"avg_effort":95.425,"cur_effort":77.891,"hashrate_1h":271496,"hashrate_24h":272288,"shares_found":74,"shares_failed":0,"last_share":1782158470,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":23321961,"sidechain_diff":233219614,"tor_cpu_pct":16.1,"tor_mem":"95.61MiB"}
+{"ts":1782159491,"arm":"clearnet","reward_share":1.134,"avg_effort":95.425,"cur_effort":117.721,"hashrate_1h":277361,"hashrate_24h":272494,"shares_found":74,"shares_failed":0,"last_share":1782158470,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23465823,"sidechain_diff":234658231,"tor_cpu_pct":26.9,"tor_mem":"95.74MiB"}
+{"ts":1782159792,"arm":"clearnet","reward_share":1.127,"avg_effort":94.574,"cur_effort":27.598,"hashrate_1h":279563,"hashrate_24h":272694,"shares_found":76,"shares_failed":0,"last_share":1782159566,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":23948480,"sidechain_diff":239484802,"tor_cpu_pct":21.94,"tor_mem":"95.33MiB"}
+{"ts":1782160094,"arm":"clearnet","reward_share":1.126,"avg_effort":94.574,"cur_effort":56.948,"hashrate_1h":276861,"hashrate_24h":272434,"shares_found":76,"shares_failed":0,"last_share":1782159566,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":23771416,"sidechain_diff":237714164,"tor_cpu_pct":17.03,"tor_mem":"95.16MiB"}
+{"ts":1782160395,"arm":"clearnet","reward_share":1.127,"avg_effort":94.152,"cur_effort":35.407,"hashrate_1h":283584,"hashrate_24h":272689,"shares_found":77,"shares_failed":0,"last_share":1782160136,"peers_out":10,"peers_in":0,"peer_list":764,"pool_hr":23109055,"sidechain_diff":231090552,"tor_cpu_pct":12.41,"tor_mem":"95.45MiB"}
+{"ts":1782160696,"arm":"clearnet","reward_share":1.127,"avg_effort":94.152,"cur_effort":71.958,"hashrate_1h":282761,"hashrate_24h":272679,"shares_found":77,"shares_failed":0,"last_share":1782160136,"peers_out":10,"peers_in":0,"peer_list":768,"pool_hr":22835899,"sidechain_diff":228358998,"tor_cpu_pct":30.37,"tor_mem":"94.93MiB"}
+{"ts":1782160997,"arm":"clearnet","reward_share":1.083,"avg_effort":94.152,"cur_effort":109.872,"hashrate_1h":285113,"hashrate_24h":272748,"shares_found":77,"shares_failed":0,"last_share":1782160136,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":22862291,"sidechain_diff":228622912,"tor_cpu_pct":24.65,"tor_mem":"95.13MiB"}
+{"ts":1782161299,"arm":"clearnet","reward_share":1.084,"avg_effort":94.152,"cur_effort":144.759,"hashrate_1h":284848,"hashrate_24h":272793,"shares_found":77,"shares_failed":0,"last_share":1782160136,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":22988377,"sidechain_diff":229883774,"tor_cpu_pct":17.74,"tor_mem":"94.91MiB"}
+{"ts":1782161600,"arm":"clearnet","reward_share":1.084,"avg_effort":94.152,"cur_effort":175.327,"hashrate_1h":274511,"hashrate_24h":272550,"shares_found":77,"shares_failed":0,"last_share":1782160136,"peers_out":10,"peers_in":0,"peer_list":763,"pool_hr":23049393,"sidechain_diff":230493932,"tor_cpu_pct":20.5,"tor_mem":"94.97MiB"}
+{"ts":1782161901,"arm":"clearnet","reward_share":1.039,"avg_effort":94.152,"cur_effort":210.636,"hashrate_1h":271395,"hashrate_24h":272427,"shares_found":77,"shares_failed":0,"last_share":1782160136,"peers_out":10,"peers_in":0,"peer_list":762,"pool_hr":22707481,"sidechain_diff":227074818,"tor_cpu_pct":26.43,"tor_mem":"95.25MiB"}
+{"ts":1782162202,"arm":"clearnet","reward_share":1.083,"avg_effort":95.726,"cur_effort":22.150,"hashrate_1h":269218,"hashrate_24h":272239,"shares_found":78,"shares_failed":0,"last_share":1782161952,"peers_out":10,"peers_in":0,"peer_list":756,"pool_hr":23237619,"sidechain_diff":232376190,"tor_cpu_pct":25.84,"tor_mem":"94.93MiB"}
+{"ts":1782162504,"arm":"clearnet","reward_share":1.084,"avg_effort":95.726,"cur_effort":53.613,"hashrate_1h":265493,"hashrate_24h":272004,"shares_found":78,"shares_failed":0,"last_share":1782161952,"peers_out":10,"peers_in":0,"peer_list":753,"pool_hr":22848110,"sidechain_diff":228481101,"tor_cpu_pct":15.43,"tor_mem":"95.18MiB"}
+{"ts":1782162805,"arm":"clearnet","reward_share":1.039,"avg_effort":95.726,"cur_effort":93.729,"hashrate_1h":270284,"hashrate_24h":272129,"shares_found":78,"shares_failed":0,"last_share":1782161952,"peers_out":10,"peers_in":0,"peer_list":757,"pool_hr":22649530,"sidechain_diff":226495309,"tor_cpu_pct":17.49,"tor_mem":"95.24MiB"}
+{"ts":1782163106,"arm":"clearnet","reward_share":0.994,"avg_effort":95.726,"cur_effort":123.122,"hashrate_1h":266956,"hashrate_24h":272143,"shares_found":78,"shares_failed":0,"last_share":1782161952,"peers_out":10,"peers_in":0,"peer_list":759,"pool_hr":23928083,"sidechain_diff":239280835,"tor_cpu_pct":3.05,"tor_mem":"94.96MiB"}
+{"ts":1782163407,"arm":"clearnet","reward_share":1.041,"avg_effort":96.237,"cur_effort":19.677,"hashrate_1h":260408,"hashrate_24h":271977,"shares_found":79,"shares_failed":0,"last_share":1782163208,"peers_out":10,"peers_in":0,"peer_list":763,"pool_hr":23678421,"sidechain_diff":236784213,"tor_cpu_pct":26.29,"tor_mem":"95.4MiB"}
+{"ts":1782163709,"arm":"clearnet","reward_share":1.040,"avg_effort":96.237,"cur_effort":53.227,"hashrate_1h":264453,"hashrate_24h":271986,"shares_found":79,"shares_failed":0,"last_share":1782163208,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":23107931,"sidechain_diff":231079311,"tor_cpu_pct":29.68,"tor_mem":"94.71MiB"}
+{"ts":1782164010,"arm":"clearnet","reward_share":1.085,"avg_effort":96.263,"cur_effort":1.977,"hashrate_1h":266059,"hashrate_24h":272285,"shares_found":80,"shares_failed":0,"last_share":1782163983,"peers_out":10,"peers_in":0,"peer_list":767,"pool_hr":22850410,"sidechain_diff":228504105,"tor_cpu_pct":17.11,"tor_mem":"95.1MiB"}
+{"ts":1782164311,"arm":"clearnet","reward_share":1.039,"avg_effort":96.263,"cur_effort":34.564,"hashrate_1h":263570,"hashrate_24h":272179,"shares_found":80,"shares_failed":0,"last_share":1782163983,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":22716913,"sidechain_diff":227169136,"tor_cpu_pct":20.41,"tor_mem":"94.68MiB"}
+{"ts":1782164612,"arm":"clearnet","reward_share":1.084,"avg_effort":95.592,"cur_effort":24.642,"hashrate_1h":260073,"hashrate_24h":272065,"shares_found":81,"shares_failed":0,"last_share":1782164387,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":22754424,"sidechain_diff":227544241,"tor_cpu_pct":18.75,"tor_mem":"94.75MiB"}
+{"ts":1782164914,"arm":"clearnet","reward_share":1.084,"avg_effort":95.592,"cur_effort":58.125,"hashrate_1h":257222,"hashrate_24h":271939,"shares_found":81,"shares_failed":0,"last_share":1782164387,"peers_out":10,"peers_in":0,"peer_list":778,"pool_hr":22742369,"sidechain_diff":227423690,"tor_cpu_pct":20.48,"tor_mem":"94.91MiB"}
+{"ts":1782165215,"arm":"clearnet","reward_share":1.085,"avg_effort":95.592,"cur_effort":95.109,"hashrate_1h":261614,"hashrate_24h":271974,"shares_found":81,"shares_failed":0,"last_share":1782164387,"peers_out":10,"peers_in":0,"peer_list":782,"pool_hr":22507315,"sidechain_diff":225073153,"tor_cpu_pct":19.21,"tor_mem":"94.89MiB"}
+{"ts":1782165516,"arm":"clearnet","reward_share":1.130,"avg_effort":95.664,"cur_effort":30.316,"hashrate_1h":263786,"hashrate_24h":271964,"shares_found":82,"shares_failed":0,"last_share":1782165252,"peers_out":10,"peers_in":0,"peer_list":787,"pool_hr":22674184,"sidechain_diff":226741844,"tor_cpu_pct":22.02,"tor_mem":"94.98MiB"}
+{"ts":1782165817,"arm":"clearnet","reward_share":1.175,"avg_effort":94.949,"cur_effort":27.160,"hashrate_1h":265875,"hashrate_24h":271838,"shares_found":83,"shares_failed":0,"last_share":1782165569,"peers_out":10,"peers_in":0,"peer_list":789,"pool_hr":22361242,"sidechain_diff":223612420,"tor_cpu_pct":20.67,"tor_mem":"94.92MiB"}
+{"ts":1782166119,"arm":"clearnet","reward_share":1.175,"avg_effort":94.949,"cur_effort":66.721,"hashrate_1h":270461,"hashrate_24h":271913,"shares_found":83,"shares_failed":0,"last_share":1782165569,"peers_out":10,"peers_in":0,"peer_list":783,"pool_hr":22559887,"sidechain_diff":225598872,"tor_cpu_pct":21,"tor_mem":"94.72MiB"}
+{"ts":1782166420,"arm":"clearnet","reward_share":1.175,"avg_effort":94.949,"cur_effort":107.356,"hashrate_1h":272643,"hashrate_24h":272157,"shares_found":83,"shares_failed":0,"last_share":1782165569,"peers_out":10,"peers_in":0,"peer_list":782,"pool_hr":22670590,"sidechain_diff":226705901,"tor_cpu_pct":18.31,"tor_mem":"95.02MiB"}
+{"ts":1782166721,"arm":"clearnet","reward_share":1.174,"avg_effort":94.949,"cur_effort":151.125,"hashrate_1h":277397,"hashrate_24h":272384,"shares_found":83,"shares_failed":0,"last_share":1782165569,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":22701400,"sidechain_diff":227014000,"tor_cpu_pct":24.63,"tor_mem":"94.82MiB"}
+{"ts":1782167022,"arm":"clearnet","reward_share":1.128,"avg_effort":94.949,"cur_effort":190.333,"hashrate_1h":280645,"hashrate_24h":272454,"shares_found":83,"shares_failed":0,"last_share":1782165569,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22665919,"sidechain_diff":226659197,"tor_cpu_pct":25.93,"tor_mem":"95.05MiB"}
+{"ts":1782167324,"arm":"clearnet","reward_share":1.129,"avg_effort":94.949,"cur_effort":217.843,"hashrate_1h":280360,"hashrate_24h":272398,"shares_found":83,"shares_failed":0,"last_share":1782165569,"peers_out":10,"peers_in":0,"peer_list":779,"pool_hr":23254663,"sidechain_diff":232546635,"tor_cpu_pct":16.51,"tor_mem":"94.77MiB"}
+{"ts":1782167625,"arm":"clearnet","reward_share":1.175,"avg_effort":96.743,"cur_effort":11.110,"hashrate_1h":273742,"hashrate_24h":272362,"shares_found":84,"shares_failed":0,"last_share":1782167499,"peers_out":10,"peers_in":0,"peer_list":777,"pool_hr":22800365,"sidechain_diff":228003650,"tor_cpu_pct":20.45,"tor_mem":"95.12MiB"}
+{"ts":1782167926,"arm":"clearnet","reward_share":1.221,"avg_effort":96.101,"cur_effort":7.949,"hashrate_1h":275362,"hashrate_24h":272380,"shares_found":85,"shares_failed":0,"last_share":1782167852,"peers_out":10,"peers_in":0,"peer_list":771,"pool_hr":22720244,"sidechain_diff":227202441,"tor_cpu_pct":23.92,"tor_mem":"94.88MiB"}
+{"ts":1782168227,"arm":"clearnet","reward_share":1.175,"avg_effort":96.101,"cur_effort":42.866,"hashrate_1h":278072,"hashrate_24h":272379,"shares_found":85,"shares_failed":0,"last_share":1782167852,"peers_out":10,"peers_in":0,"peer_list":773,"pool_hr":22570890,"sidechain_diff":225708902,"tor_cpu_pct":16.99,"tor_mem":"95.23MiB"}
+{"ts":1782168529,"arm":"clearnet","reward_share":1.174,"avg_effort":96.101,"cur_effort":83.520,"hashrate_1h":284668,"hashrate_24h":272570,"shares_found":85,"shares_failed":0,"last_share":1782167852,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":23394560,"sidechain_diff":233945604,"tor_cpu_pct":21.36,"tor_mem":"95.1MiB"}
+{"ts":1782168830,"arm":"clearnet","reward_share":1.173,"avg_effort":96.101,"cur_effort":118.263,"hashrate_1h":284008,"hashrate_24h":272610,"shares_found":85,"shares_failed":0,"last_share":1782167852,"peers_out":10,"peers_in":0,"peer_list":775,"pool_hr":23331545,"sidechain_diff":233315456,"tor_cpu_pct":17.44,"tor_mem":"95.02MiB"}
+{"ts":1782169131,"arm":"clearnet","reward_share":1.126,"avg_effort":96.685,"cur_effort":17.150,"hashrate_1h":288325,"hashrate_24h":272803,"shares_found":86,"shares_failed":0,"last_share":1782168984,"peers_out":10,"peers_in":0,"peer_list":772,"pool_hr":22781143,"sidechain_diff":227811434,"tor_cpu_pct":26.19,"tor_mem":"95.17MiB"}
+{"ts":1782169432,"arm":"clearnet","reward_share":1.127,"avg_effort":96.685,"cur_effort":54.051,"hashrate_1h":290411,"hashrate_24h":272815,"shares_found":86,"shares_failed":0,"last_share":1782168984,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":22674432,"sidechain_diff":226744320,"tor_cpu_pct":28.77,"tor_mem":"95.17MiB"}
+{"ts":1782169734,"arm":"clearnet","reward_share":1.080,"avg_effort":96.685,"cur_effort":88.047,"hashrate_1h":288447,"hashrate_24h":272761,"shares_found":86,"shares_failed":0,"last_share":1782168984,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":22554711,"sidechain_diff":225547115,"tor_cpu_pct":30.17,"tor_mem":"95.36MiB"}
+{"ts":1782170035,"arm":"clearnet","reward_share":1.081,"avg_effort":96.685,"cur_effort":121.527,"hashrate_1h":280253,"hashrate_24h":272614,"shares_found":86,"shares_failed":0,"last_share":1782168984,"peers_out":10,"peers_in":0,"peer_list":766,"pool_hr":22613038,"sidechain_diff":226130386,"tor_cpu_pct":18.8,"tor_mem":"95.21MiB"}
+{"ts":1782170336,"arm":"clearnet","reward_share":1.080,"avg_effort":96.685,"cur_effort":156.924,"hashrate_1h":277290,"hashrate_24h":272628,"shares_found":86,"shares_failed":0,"last_share":1782168984,"peers_out":10,"peers_in":0,"peer_list":765,"pool_hr":22804201,"sidechain_diff":228042015,"tor_cpu_pct":21.15,"tor_mem":"95.64MiB"}
+{"ts":1782170637,"arm":"clearnet","reward_share":1.081,"avg_effort":96.685,"cur_effort":199.243,"hashrate_1h":279996,"hashrate_24h":272808,"shares_found":86,"shares_failed":0,"last_share":1782168984,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":22721788,"sidechain_diff":227217888,"tor_cpu_pct":19.11,"tor_mem":"96.17MiB"}
+{"ts":1782170939,"arm":"clearnet","reward_share":1.126,"avg_effort":98.146,"cur_effort":16.300,"hashrate_1h":283255,"hashrate_24h":272927,"shares_found":87,"shares_failed":0,"last_share":1782170819,"peers_out":10,"peers_in":0,"peer_list":770,"pool_hr":22620424,"sidechain_diff":226204248,"tor_cpu_pct":18.05,"tor_mem":"95.94MiB"}
+{"ts":1782171240,"arm":"clearnet","reward_share":1.125,"avg_effort":98.146,"cur_effort":44.557,"hashrate_1h":279003,"hashrate_24h":272745,"shares_found":87,"shares_failed":0,"last_share":1782170819,"peers_out":10,"peers_in":0,"peer_list":774,"pool_hr":22555913,"sidechain_diff":225559136,"tor_cpu_pct":28.33,"tor_mem":"95.96MiB"}
+{"ts":1782171541,"arm":"clearnet","reward_share":1.126,"avg_effort":98.146,"cur_effort":82.146,"hashrate_1h":280645,"hashrate_24h":272786,"shares_found":87,"shares_failed":0,"last_share":1782170819,"peers_out":10,"peers_in":0,"peer_list":776,"pool_hr":22681389,"sidechain_diff":226813899,"tor_cpu_pct":19.08,"tor_mem":"96MiB"}
diff --git a/docs/benchmarks/data/run-2026-06-17-mini/events.log b/docs/benchmarks/data/run-2026-06-17-mini/events.log
new file mode 100644
index 00000000..87b5ba49
--- /dev/null
+++ b/docs/benchmarks/data/run-2026-06-17-mini/events.log
@@ -0,0 +1,13 @@
+2026-06-17T23:33:11Z RUN START pool=mini block-hours=20 blocks=6 settle-hours=3
+2026-06-17T23:37:05Z arm=tor egress-gate=PASS(after-tari-restart)
+2026-06-18T19:33:30Z BLOCK 2/6 arm=clearnet (settle 3h)
+2026-06-18T19:33:33Z arm=clearnet egress-gate=skip(clearnet)
+2026-06-19T15:35:52Z BLOCK 3/6 arm=tor (settle 3h)
+2026-06-19T15:39:48Z arm=tor egress-gate=PASS(after-tari-restart)
+2026-06-20T11:36:14Z BLOCK 4/6 arm=clearnet (settle 3h)
+2026-06-20T11:36:17Z arm=clearnet egress-gate=skip(clearnet)
+2026-06-21T07:38:38Z BLOCK 5/6 arm=tor (settle 3h)
+2026-06-21T07:42:33Z arm=tor egress-gate=PASS(after-tari-restart)
+2026-06-22T03:38:59Z BLOCK 6/6 arm=clearnet (settle 3h)
+2026-06-22T03:39:01Z arm=clearnet egress-gate=skip(clearnet)
+2026-06-22T23:41:28Z RUN COMPLETE — 6 blocks done
diff --git a/docs/benchmarks/data/run-2026-06-17-mini/tor.jsonl b/docs/benchmarks/data/run-2026-06-17-mini/tor.jsonl
new file mode 100644
index 00000000..b4e2f1dd
--- /dev/null
+++ b/docs/benchmarks/data/run-2026-06-17-mini/tor.jsonl
@@ -0,0 +1,717 @@
+{"ts":1781739426,"arm":"tor","reward_share":0.217,"avg_effort":49.258,"cur_effort":41.717,"hashrate_1h":312227,"hashrate_24h":312227,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":9,"peers_in":0,"peer_list":832,"pool_hr":15669030,"sidechain_diff":156690309,"tor_cpu_pct":20.88,"tor_mem":"103.5MiB"}
+{"ts":1781739727,"arm":"tor","reward_share":0.217,"avg_effort":49.258,"cur_effort":93.908,"hashrate_1h":288223,"hashrate_24h":288223,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":868,"pool_hr":15533033,"sidechain_diff":155330336,"tor_cpu_pct":100.13,"tor_mem":"104.4MiB"}
+{"ts":1781740029,"arm":"tor","reward_share":0.217,"avg_effort":49.258,"cur_effort":145.150,"hashrate_1h":277630,"hashrate_24h":277630,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":11,"peers_in":0,"peer_list":882,"pool_hr":15406348,"sidechain_diff":154063482,"tor_cpu_pct":49.29,"tor_mem":"104.8MiB"}
+{"ts":1781740330,"arm":"tor","reward_share":0.217,"avg_effort":49.258,"cur_effort":199.540,"hashrate_1h":276593,"hashrate_24h":276593,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":9,"peers_in":0,"peer_list":892,"pool_hr":15530850,"sidechain_diff":155308508,"tor_cpu_pct":102.88,"tor_mem":"107.8MiB"}
+{"ts":1781740631,"arm":"tor","reward_share":0.217,"avg_effort":49.258,"cur_effort":242.385,"hashrate_1h":264871,"hashrate_24h":264871,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":901,"pool_hr":15486318,"sidechain_diff":154863184,"tor_cpu_pct":44.22,"tor_mem":"107.4MiB"}
+{"ts":1781740932,"arm":"tor","reward_share":0.216,"avg_effort":49.258,"cur_effort":291.628,"hashrate_1h":264587,"hashrate_24h":264587,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":11,"peers_in":0,"peer_list":906,"pool_hr":15562335,"sidechain_diff":155623355,"tor_cpu_pct":90.77,"tor_mem":"108.4MiB"}
+{"ts":1781741234,"arm":"tor","reward_share":0.308,"avg_effort":156.308,"cur_effort":45.724,"hashrate_1h":279378,"hashrate_24h":279378,"shares_found":2,"shares_failed":0,"last_share":1781741058,"peers_out":10,"peers_in":0,"peer_list":914,"pool_hr":15566288,"sidechain_diff":155662883,"tor_cpu_pct":63.1,"tor_mem":"107.8MiB"}
+{"ts":1781741535,"arm":"tor","reward_share":0.308,"avg_effort":156.308,"cur_effort":101.633,"hashrate_1h":281221,"hashrate_24h":281221,"shares_found":2,"shares_failed":0,"last_share":1781741058,"peers_out":9,"peers_in":0,"peer_list":916,"pool_hr":15631319,"sidechain_diff":156313192,"tor_cpu_pct":41.52,"tor_mem":"107.8MiB"}
+{"ts":1781741836,"arm":"tor","reward_share":0.409,"avg_effort":117.551,"cur_effort":5.819,"hashrate_1h":286999,"hashrate_24h":286999,"shares_found":4,"shares_failed":0,"last_share":1781741784,"peers_out":9,"peers_in":0,"peer_list":916,"pool_hr":15653627,"sidechain_diff":156536275,"tor_cpu_pct":25.22,"tor_mem":"107.6MiB"}
+{"ts":1781742137,"arm":"tor","reward_share":0.455,"avg_effort":98.499,"cur_effort":44.379,"hashrate_1h":289937,"hashrate_24h":289937,"shares_found":5,"shares_failed":0,"last_share":1781741881,"peers_out":11,"peers_in":0,"peer_list":920,"pool_hr":15686927,"sidechain_diff":156869275,"tor_cpu_pct":27.84,"tor_mem":"107.5MiB"}
+{"ts":1781742439,"arm":"tor","reward_share":0.547,"avg_effort":79.986,"cur_effort":20.987,"hashrate_1h":283134,"hashrate_24h":283134,"shares_found":7,"shares_failed":0,"last_share":1781742276,"peers_out":10,"peers_in":0,"peer_list":923,"pool_hr":15681725,"sidechain_diff":156817258,"tor_cpu_pct":41.54,"tor_mem":"107MiB"}
+{"ts":1781742740,"arm":"tor","reward_share":0.546,"avg_effort":79.986,"cur_effort":76.837,"hashrate_1h":283256,"hashrate_24h":283256,"shares_found":7,"shares_failed":0,"last_share":1781742276,"peers_out":10,"peers_in":0,"peer_list":923,"pool_hr":15652041,"sidechain_diff":156520411,"tor_cpu_pct":22.36,"tor_mem":"107MiB"}
+{"ts":1781743041,"arm":"tor","reward_share":0.546,"avg_effort":79.986,"cur_effort":134.301,"hashrate_1h":285527,"hashrate_24h":286510,"shares_found":7,"shares_failed":0,"last_share":1781742276,"peers_out":10,"peers_in":0,"peer_list":465,"pool_hr":16040650,"sidechain_diff":160406504,"tor_cpu_pct":21.14,"tor_mem":"106.6MiB"}
+{"ts":1781743342,"arm":"tor","reward_share":0.593,"avg_effort":89.935,"cur_effort":26.299,"hashrate_1h":284843,"hashrate_24h":285067,"shares_found":8,"shares_failed":0,"last_share":1781743159,"peers_out":10,"peers_in":0,"peer_list":419,"pool_hr":15839439,"sidechain_diff":158394391,"tor_cpu_pct":22.48,"tor_mem":"105.5MiB"}
+{"ts":1781743644,"arm":"tor","reward_share":0.648,"avg_effort":83.509,"cur_effort":43.793,"hashrate_1h":283389,"hashrate_24h":282586,"shares_found":9,"shares_failed":0,"last_share":1781743360,"peers_out":10,"peers_in":0,"peer_list":413,"pool_hr":15724118,"sidechain_diff":157241184,"tor_cpu_pct":21.49,"tor_mem":"105.4MiB"}
+{"ts":1781743945,"arm":"tor","reward_share":0.648,"avg_effort":83.509,"cur_effort":102.648,"hashrate_1h":287569,"hashrate_24h":284443,"shares_found":9,"shares_failed":0,"last_share":1781743360,"peers_out":10,"peers_in":0,"peer_list":407,"pool_hr":15800665,"sidechain_diff":158006651,"tor_cpu_pct":24.21,"tor_mem":"105.4MiB"}
+{"ts":1781744246,"arm":"tor","reward_share":0.604,"avg_effort":83.509,"cur_effort":153.908,"hashrate_1h":291059,"hashrate_24h":283307,"shares_found":9,"shares_failed":0,"last_share":1781743360,"peers_out":10,"peers_in":0,"peer_list":399,"pool_hr":15894994,"sidechain_diff":158949949,"tor_cpu_pct":21.7,"tor_mem":"103.9MiB"}
+{"ts":1781744547,"arm":"tor","reward_share":0.604,"avg_effort":83.509,"cur_effort":206.047,"hashrate_1h":291892,"hashrate_24h":283123,"shares_found":9,"shares_failed":0,"last_share":1781743360,"peers_out":10,"peers_in":0,"peer_list":393,"pool_hr":15898395,"sidechain_diff":158983953,"tor_cpu_pct":32.54,"tor_mem":"103.6MiB"}
+{"ts":1781744849,"arm":"tor","reward_share":0.695,"avg_effort":90.130,"cur_effort":7.236,"hashrate_1h":279247,"hashrate_24h":279071,"shares_found":11,"shares_failed":0,"last_share":1781744777,"peers_out":10,"peers_in":0,"peer_list":387,"pool_hr":15827972,"sidechain_diff":158279727,"tor_cpu_pct":21.97,"tor_mem":"102.9MiB"}
+{"ts":1781745150,"arm":"tor","reward_share":0.732,"avg_effort":84.718,"cur_effort":31.948,"hashrate_1h":276710,"hashrate_24h":278617,"shares_found":12,"shares_failed":0,"last_share":1781744960,"peers_out":10,"peers_in":0,"peer_list":386,"pool_hr":15928269,"sidechain_diff":159282697,"tor_cpu_pct":25.52,"tor_mem":"102.9MiB"}
+{"ts":1781745451,"arm":"tor","reward_share":0.731,"avg_effort":84.718,"cur_effort":92.440,"hashrate_1h":276156,"hashrate_24h":281095,"shares_found":12,"shares_failed":0,"last_share":1781744960,"peers_out":10,"peers_in":0,"peer_list":379,"pool_hr":15984647,"sidechain_diff":159846471,"tor_cpu_pct":6.74,"tor_mem":"102.3MiB"}
+{"ts":1781745752,"arm":"tor","reward_share":0.731,"avg_effort":84.718,"cur_effort":137.621,"hashrate_1h":273469,"hashrate_24h":280370,"shares_found":12,"shares_failed":0,"last_share":1781744960,"peers_out":10,"peers_in":0,"peer_list":354,"pool_hr":16544444,"sidechain_diff":165444444,"tor_cpu_pct":29.88,"tor_mem":"102.2MiB"}
+{"ts":1781746054,"arm":"tor","reward_share":0.730,"avg_effort":84.718,"cur_effort":185.607,"hashrate_1h":275464,"hashrate_24h":279012,"shares_found":12,"shares_failed":0,"last_share":1781744960,"peers_out":10,"peers_in":0,"peer_list":328,"pool_hr":16347230,"sidechain_diff":163472306,"tor_cpu_pct":27.8,"tor_mem":"102.6MiB"}
+{"ts":1781746355,"arm":"tor","reward_share":0.730,"avg_effort":84.718,"cur_effort":230.335,"hashrate_1h":270941,"hashrate_24h":277081,"shares_found":12,"shares_failed":0,"last_share":1781744960,"peers_out":10,"peers_in":0,"peer_list":331,"pool_hr":16194384,"sidechain_diff":161943849,"tor_cpu_pct":35.74,"tor_mem":"102.4MiB"}
+{"ts":1781746656,"arm":"tor","reward_share":0.776,"avg_effort":100.458,"cur_effort":3.699,"hashrate_1h":269603,"hashrate_24h":278293,"shares_found":13,"shares_failed":0,"last_share":1781746611,"peers_out":10,"peers_in":0,"peer_list":314,"pool_hr":16226920,"sidechain_diff":162269203,"tor_cpu_pct":33.02,"tor_mem":"102.6MiB"}
+{"ts":1781746957,"arm":"tor","reward_share":0.775,"avg_effort":100.458,"cur_effort":52.241,"hashrate_1h":268425,"hashrate_24h":277298,"shares_found":13,"shares_failed":0,"last_share":1781746611,"peers_out":10,"peers_in":0,"peer_list":312,"pool_hr":16221243,"sidechain_diff":162212438,"tor_cpu_pct":30.64,"tor_mem":"102.1MiB"}
+{"ts":1781747259,"arm":"tor","reward_share":0.916,"avg_effort":86.613,"cur_effort":12.511,"hashrate_1h":266832,"hashrate_24h":275785,"shares_found":16,"shares_failed":0,"last_share":1781747164,"peers_out":10,"peers_in":0,"peer_list":312,"pool_hr":16178372,"sidechain_diff":161783729,"tor_cpu_pct":27.9,"tor_mem":"102.3MiB"}
+{"ts":1781747560,"arm":"tor","reward_share":0.915,"avg_effort":86.613,"cur_effort":60.150,"hashrate_1h":264027,"hashrate_24h":275452,"shares_found":16,"shares_failed":0,"last_share":1781747164,"peers_out":10,"peers_in":0,"peer_list":310,"pool_hr":16164232,"sidechain_diff":161642325,"tor_cpu_pct":33.05,"tor_mem":"102.4MiB"}
+{"ts":1781747861,"arm":"tor","reward_share":0.915,"avg_effort":86.613,"cur_effort":102.534,"hashrate_1h":258377,"hashrate_24h":273476,"shares_found":16,"shares_failed":0,"last_share":1781747164,"peers_out":10,"peers_in":0,"peer_list":308,"pool_hr":16261178,"sidechain_diff":162611785,"tor_cpu_pct":31.91,"tor_mem":"102.1MiB"}
+{"ts":1781748162,"arm":"tor","reward_share":1.009,"avg_effort":83.950,"cur_effort":21.389,"hashrate_1h":256166,"hashrate_24h":272492,"shares_found":18,"shares_failed":0,"last_share":1781748011,"peers_out":10,"peers_in":0,"peer_list":309,"pool_hr":16142285,"sidechain_diff":161422852,"tor_cpu_pct":22.29,"tor_mem":"102.4MiB"}
+{"ts":1781748464,"arm":"tor","reward_share":1.102,"avg_effort":78.788,"cur_effort":4.670,"hashrate_1h":263453,"hashrate_24h":272647,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16114004,"sidechain_diff":161140047,"tor_cpu_pct":26.6,"tor_mem":"102.2MiB"}
+{"ts":1781748765,"arm":"tor","reward_share":1.102,"avg_effort":78.788,"cur_effort":63.817,"hashrate_1h":263517,"hashrate_24h":273461,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":309,"pool_hr":16074157,"sidechain_diff":160741577,"tor_cpu_pct":22.78,"tor_mem":"102.3MiB"}
+{"ts":1781749066,"arm":"tor","reward_share":1.101,"avg_effort":78.788,"cur_effort":113.622,"hashrate_1h":260459,"hashrate_24h":273750,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":309,"pool_hr":16115433,"sidechain_diff":161154334,"tor_cpu_pct":33.02,"tor_mem":"102.4MiB"}
+{"ts":1781749367,"arm":"tor","reward_share":1.101,"avg_effort":78.788,"cur_effort":160.543,"hashrate_1h":260516,"hashrate_24h":273091,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":305,"pool_hr":16095362,"sidechain_diff":160953627,"tor_cpu_pct":30.4,"tor_mem":"102.6MiB"}
+{"ts":1781749669,"arm":"tor","reward_share":1.100,"avg_effort":78.788,"cur_effort":210.309,"hashrate_1h":260234,"hashrate_24h":272512,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":304,"pool_hr":16033414,"sidechain_diff":160334143,"tor_cpu_pct":33.47,"tor_mem":"102.3MiB"}
+{"ts":1781749970,"arm":"tor","reward_share":1.099,"avg_effort":78.788,"cur_effort":255.577,"hashrate_1h":260710,"hashrate_24h":271414,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":305,"pool_hr":16043976,"sidechain_diff":160439764,"tor_cpu_pct":27.25,"tor_mem":"102.6MiB"}
+{"ts":1781750271,"arm":"tor","reward_share":1.098,"avg_effort":78.788,"cur_effort":304.368,"hashrate_1h":257103,"hashrate_24h":271460,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16130309,"sidechain_diff":161303094,"tor_cpu_pct":19.29,"tor_mem":"102.2MiB"}
+{"ts":1781750572,"arm":"tor","reward_share":1.098,"avg_effort":78.788,"cur_effort":351.767,"hashrate_1h":258339,"hashrate_24h":271240,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":307,"pool_hr":16121994,"sidechain_diff":161219942,"tor_cpu_pct":32.76,"tor_mem":"102.8MiB"}
+{"ts":1781750874,"arm":"tor","reward_share":1.098,"avg_effort":78.788,"cur_effort":411.820,"hashrate_1h":263708,"hashrate_24h":271948,"shares_found":20,"shares_failed":0,"last_share":1781748414,"peers_out":10,"peers_in":0,"peer_list":308,"pool_hr":16059590,"sidechain_diff":160595902,"tor_cpu_pct":23.19,"tor_mem":"103.2MiB"}
+{"ts":1781751175,"arm":"tor","reward_share":1.144,"avg_effort":95.360,"cur_effort":42.536,"hashrate_1h":265491,"hashrate_24h":272769,"shares_found":21,"shares_failed":0,"last_share":1781750969,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16201826,"sidechain_diff":162018267,"tor_cpu_pct":20.69,"tor_mem":"103.6MiB"}
+{"ts":1781751476,"arm":"tor","reward_share":1.143,"avg_effort":95.360,"cur_effort":86.121,"hashrate_1h":268133,"hashrate_24h":271909,"shares_found":21,"shares_failed":0,"last_share":1781750969,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16250541,"sidechain_diff":162505419,"tor_cpu_pct":18.7,"tor_mem":"103.5MiB"}
+{"ts":1781751777,"arm":"tor","reward_share":1.189,"avg_effort":96.865,"cur_effort":10.750,"hashrate_1h":271668,"hashrate_24h":272206,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16292831,"sidechain_diff":162928312,"tor_cpu_pct":12.11,"tor_mem":"103.7MiB"}
+{"ts":1781752079,"arm":"tor","reward_share":1.188,"avg_effort":96.865,"cur_effort":61.083,"hashrate_1h":272639,"hashrate_24h":272462,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16295374,"sidechain_diff":162953747,"tor_cpu_pct":6.23,"tor_mem":"102.6MiB"}
+{"ts":1781752380,"arm":"tor","reward_share":1.186,"avg_effort":96.865,"cur_effort":109.500,"hashrate_1h":268487,"hashrate_24h":272102,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":304,"pool_hr":16243904,"sidechain_diff":162439044,"tor_cpu_pct":23.39,"tor_mem":"101.9MiB"}
+{"ts":1781752681,"arm":"tor","reward_share":1.185,"avg_effort":96.865,"cur_effort":153.650,"hashrate_1h":264736,"hashrate_24h":271237,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":303,"pool_hr":16252084,"sidechain_diff":162520847,"tor_cpu_pct":18.18,"tor_mem":"101.4MiB"}
+{"ts":1781752982,"arm":"tor","reward_share":1.184,"avg_effort":96.865,"cur_effort":192.995,"hashrate_1h":261723,"hashrate_24h":270002,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":299,"pool_hr":16190053,"sidechain_diff":161900539,"tor_cpu_pct":20.19,"tor_mem":"100.8MiB"}
+{"ts":1781753284,"arm":"tor","reward_share":1.184,"avg_effort":96.865,"cur_effort":241.409,"hashrate_1h":262205,"hashrate_24h":269455,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":296,"pool_hr":16180853,"sidechain_diff":161808537,"tor_cpu_pct":3.44,"tor_mem":"101MiB"}
+{"ts":1781753585,"arm":"tor","reward_share":1.181,"avg_effort":96.865,"cur_effort":289.531,"hashrate_1h":263100,"hashrate_24h":269412,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":297,"pool_hr":16163779,"sidechain_diff":161637797,"tor_cpu_pct":5.73,"tor_mem":"99.59MiB"}
+{"ts":1781753886,"arm":"tor","reward_share":1.181,"avg_effort":96.865,"cur_effort":342.477,"hashrate_1h":263653,"hashrate_24h":269559,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":300,"pool_hr":16133482,"sidechain_diff":161334823,"tor_cpu_pct":16.7,"tor_mem":"97.41MiB"}
+{"ts":1781754187,"arm":"tor","reward_share":1.180,"avg_effort":96.865,"cur_effort":394.879,"hashrate_1h":267103,"hashrate_24h":270220,"shares_found":22,"shares_failed":0,"last_share":1781751698,"peers_out":10,"peers_in":0,"peer_list":302,"pool_hr":16311938,"sidechain_diff":163119389,"tor_cpu_pct":3.89,"tor_mem":"97.11MiB"}
+{"ts":1781754489,"arm":"tor","reward_share":1.227,"avg_effort":111.640,"cur_effort":15.489,"hashrate_1h":266296,"hashrate_24h":270555,"shares_found":23,"shares_failed":0,"last_share":1781754338,"peers_out":10,"peers_in":0,"peer_list":300,"pool_hr":16252993,"sidechain_diff":162529930,"tor_cpu_pct":5.08,"tor_mem":"96.49MiB"}
+{"ts":1781754790,"arm":"tor","reward_share":1.272,"avg_effort":107.628,"cur_effort":41.046,"hashrate_1h":258547,"hashrate_24h":269504,"shares_found":24,"shares_failed":0,"last_share":1781754482,"peers_out":10,"peers_in":0,"peer_list":301,"pool_hr":16170436,"sidechain_diff":161704365,"tor_cpu_pct":3.49,"tor_mem":"96.2MiB"}
+{"ts":1781755091,"arm":"tor","reward_share":1.238,"avg_effort":107.628,"cur_effort":94.878,"hashrate_1h":263925,"hashrate_24h":270037,"shares_found":24,"shares_failed":0,"last_share":1781754482,"peers_out":10,"peers_in":0,"peer_list":299,"pool_hr":16008476,"sidechain_diff":160084768,"tor_cpu_pct":2.99,"tor_mem":"95.94MiB"}
+{"ts":1781755392,"arm":"tor","reward_share":1.238,"avg_effort":107.628,"cur_effort":155.097,"hashrate_1h":266514,"hashrate_24h":271015,"shares_found":24,"shares_failed":0,"last_share":1781754482,"peers_out":10,"peers_in":0,"peer_list":299,"pool_hr":16054705,"sidechain_diff":160547052,"tor_cpu_pct":15.48,"tor_mem":"96.07MiB"}
+{"ts":1781755694,"arm":"tor","reward_share":1.328,"avg_effort":107.148,"cur_effort":11.477,"hashrate_1h":267980,"hashrate_24h":271661,"shares_found":26,"shares_failed":0,"last_share":1781755606,"peers_out":10,"peers_in":0,"peer_list":298,"pool_hr":16054073,"sidechain_diff":160540736,"tor_cpu_pct":4.81,"tor_mem":"95.79MiB"}
+{"ts":1781755995,"arm":"tor","reward_share":1.328,"avg_effort":107.148,"cur_effort":57.136,"hashrate_1h":268889,"hashrate_24h":271354,"shares_found":26,"shares_failed":0,"last_share":1781755606,"peers_out":10,"peers_in":0,"peer_list":300,"pool_hr":16080141,"sidechain_diff":160801411,"tor_cpu_pct":21.03,"tor_mem":"96.32MiB"}
+{"ts":1781756296,"arm":"tor","reward_share":1.327,"avg_effort":107.148,"cur_effort":106.929,"hashrate_1h":271574,"hashrate_24h":271261,"shares_found":26,"shares_failed":0,"last_share":1781755606,"peers_out":10,"peers_in":0,"peer_list":301,"pool_hr":16122004,"sidechain_diff":161220040,"tor_cpu_pct":25.61,"tor_mem":"96.13MiB"}
+{"ts":1781756597,"arm":"tor","reward_share":1.326,"avg_effort":107.148,"cur_effort":144.442,"hashrate_1h":270275,"hashrate_24h":270064,"shares_found":26,"shares_failed":0,"last_share":1781755606,"peers_out":10,"peers_in":0,"peer_list":303,"pool_hr":16317074,"sidechain_diff":163170743,"tor_cpu_pct":14.26,"tor_mem":"95.82MiB"}
+{"ts":1781756899,"arm":"tor","reward_share":1.325,"avg_effort":107.148,"cur_effort":203.408,"hashrate_1h":274958,"hashrate_24h":270653,"shares_found":26,"shares_failed":0,"last_share":1781755606,"peers_out":10,"peers_in":0,"peer_list":301,"pool_hr":16131607,"sidechain_diff":161316079,"tor_cpu_pct":17.37,"tor_mem":"95.84MiB"}
+{"ts":1781757200,"arm":"tor","reward_share":1.370,"avg_effort":112.064,"cur_effort":11.445,"hashrate_1h":273870,"hashrate_24h":270433,"shares_found":27,"shares_failed":0,"last_share":1781757124,"peers_out":10,"peers_in":0,"peer_list":300,"pool_hr":16072869,"sidechain_diff":160728690,"tor_cpu_pct":18.37,"tor_mem":"96.19MiB"}
+{"ts":1781757501,"arm":"tor","reward_share":1.368,"avg_effort":112.064,"cur_effort":59.067,"hashrate_1h":273092,"hashrate_24h":270153,"shares_found":27,"shares_failed":0,"last_share":1781757124,"peers_out":10,"peers_in":0,"peer_list":302,"pool_hr":16300890,"sidechain_diff":163008909,"tor_cpu_pct":21.29,"tor_mem":"96.25MiB"}
+{"ts":1781757802,"arm":"tor","reward_share":1.412,"avg_effort":110.733,"cur_effort":43.077,"hashrate_1h":273730,"hashrate_24h":270782,"shares_found":28,"shares_failed":0,"last_share":1781757591,"peers_out":10,"peers_in":0,"peer_list":303,"pool_hr":16160144,"sidechain_diff":161601449,"tor_cpu_pct":24.66,"tor_mem":"96.04MiB"}
+{"ts":1781758104,"arm":"tor","reward_share":1.411,"avg_effort":110.733,"cur_effort":87.124,"hashrate_1h":269898,"hashrate_24h":270393,"shares_found":28,"shares_failed":0,"last_share":1781757591,"peers_out":10,"peers_in":0,"peer_list":303,"pool_hr":16220947,"sidechain_diff":162209478,"tor_cpu_pct":24.68,"tor_mem":"95MiB"}
+{"ts":1781758405,"arm":"tor","reward_share":1.410,"avg_effort":110.733,"cur_effort":148.042,"hashrate_1h":276338,"hashrate_24h":270979,"shares_found":28,"shares_failed":0,"last_share":1781757591,"peers_out":10,"peers_in":0,"peer_list":305,"pool_hr":15950136,"sidechain_diff":159501368,"tor_cpu_pct":22.95,"tor_mem":"95.05MiB"}
+{"ts":1781758706,"arm":"tor","reward_share":1.453,"avg_effort":112.579,"cur_effort":39.063,"hashrate_1h":278091,"hashrate_24h":271432,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":302,"pool_hr":16212364,"sidechain_diff":162123646,"tor_cpu_pct":3.33,"tor_mem":"95.05MiB"}
+{"ts":1781759007,"arm":"tor","reward_share":1.409,"avg_effort":112.579,"cur_effort":86.129,"hashrate_1h":270535,"hashrate_24h":271249,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":302,"pool_hr":15971478,"sidechain_diff":159714780,"tor_cpu_pct":7.09,"tor_mem":"95.4MiB"}
+{"ts":1781759309,"arm":"tor","reward_share":1.407,"avg_effort":112.579,"cur_effort":133.340,"hashrate_1h":268630,"hashrate_24h":270983,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":302,"pool_hr":16001439,"sidechain_diff":160014395,"tor_cpu_pct":4.4,"tor_mem":"95.36MiB"}
+{"ts":1781759610,"arm":"tor","reward_share":1.407,"avg_effort":112.579,"cur_effort":193.183,"hashrate_1h":273581,"hashrate_24h":271736,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":303,"pool_hr":16286762,"sidechain_diff":162867624,"tor_cpu_pct":24.91,"tor_mem":"95.36MiB"}
+{"ts":1781759911,"arm":"tor","reward_share":1.406,"avg_effort":112.579,"cur_effort":252.362,"hashrate_1h":277902,"hashrate_24h":272150,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":299,"pool_hr":16056916,"sidechain_diff":160569167,"tor_cpu_pct":17.16,"tor_mem":"95.28MiB"}
+{"ts":1781760212,"arm":"tor","reward_share":1.404,"avg_effort":112.579,"cur_effort":305.459,"hashrate_1h":284049,"hashrate_24h":272426,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":299,"pool_hr":16027979,"sidechain_diff":160279799,"tor_cpu_pct":27.19,"tor_mem":"95.36MiB"}
+{"ts":1781760514,"arm":"tor","reward_share":1.360,"avg_effort":112.579,"cur_effort":358.389,"hashrate_1h":282169,"hashrate_24h":272742,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":298,"pool_hr":16209087,"sidechain_diff":162090877,"tor_cpu_pct":26.01,"tor_mem":"95.18MiB"}
+{"ts":1781760815,"arm":"tor","reward_share":1.360,"avg_effort":112.579,"cur_effort":402.745,"hashrate_1h":280773,"hashrate_24h":272167,"shares_found":29,"shares_failed":0,"last_share":1781758477,"peers_out":10,"peers_in":0,"peer_list":306,"pool_hr":16120250,"sidechain_diff":161202505,"tor_cpu_pct":26.09,"tor_mem":"95.52MiB"}
+{"ts":1781761116,"arm":"tor","reward_share":1.370,"avg_effort":122.778,"cur_effort":36.841,"hashrate_1h":282008,"hashrate_24h":272167,"shares_found":30,"shares_failed":0,"last_share":1781760896,"peers_out":10,"peers_in":0,"peer_list":320,"pool_hr":16122645,"sidechain_diff":161226457,"tor_cpu_pct":23.27,"tor_mem":"95.24MiB"}
+{"ts":1781761417,"arm":"tor","reward_share":1.369,"avg_effort":122.778,"cur_effort":95.369,"hashrate_1h":281297,"hashrate_24h":272598,"shares_found":30,"shares_failed":0,"last_share":1781760896,"peers_out":10,"peers_in":0,"peer_list":341,"pool_hr":16080026,"sidechain_diff":160800269,"tor_cpu_pct":22.6,"tor_mem":"95.43MiB"}
+{"ts":1781761719,"arm":"tor","reward_share":1.411,"avg_effort":122.922,"cur_effort":16.821,"hashrate_1h":283556,"hashrate_24h":272598,"shares_found":31,"shares_failed":0,"last_share":1781761597,"peers_out":10,"peers_in":0,"peer_list":350,"pool_hr":16207410,"sidechain_diff":162074109,"tor_cpu_pct":28.49,"tor_mem":"95.55MiB"}
+{"ts":1781762020,"arm":"tor","reward_share":1.411,"avg_effort":122.922,"cur_effort":55.082,"hashrate_1h":273977,"hashrate_24h":271526,"shares_found":31,"shares_failed":0,"last_share":1781761597,"peers_out":10,"peers_in":0,"peer_list":359,"pool_hr":15953222,"sidechain_diff":159532224,"tor_cpu_pct":31.15,"tor_mem":"96.9MiB"}
+{"ts":1781762321,"arm":"tor","reward_share":1.411,"avg_effort":122.922,"cur_effort":98.440,"hashrate_1h":271890,"hashrate_24h":271517,"shares_found":31,"shares_failed":0,"last_share":1781761597,"peers_out":10,"peers_in":0,"peer_list":370,"pool_hr":16597846,"sidechain_diff":165978466,"tor_cpu_pct":31.49,"tor_mem":"97.08MiB"}
+{"ts":1781762622,"arm":"tor","reward_share":1.454,"avg_effort":123.325,"cur_effort":20.822,"hashrate_1h":274393,"hashrate_24h":271773,"shares_found":32,"shares_failed":0,"last_share":1781762495,"peers_out":10,"peers_in":0,"peer_list":375,"pool_hr":16222316,"sidechain_diff":162223161,"tor_cpu_pct":37.43,"tor_mem":"96.82MiB"}
+{"ts":1781762924,"arm":"tor","reward_share":1.500,"avg_effort":121.537,"cur_effort":8.058,"hashrate_1h":276404,"hashrate_24h":271884,"shares_found":33,"shares_failed":0,"last_share":1781762852,"peers_out":10,"peers_in":0,"peer_list":381,"pool_hr":15976285,"sidechain_diff":159762857,"tor_cpu_pct":26.58,"tor_mem":"96.52MiB"}
+{"ts":1781763225,"arm":"tor","reward_share":1.500,"avg_effort":119.084,"cur_effort":31.418,"hashrate_1h":277293,"hashrate_24h":272569,"shares_found":34,"shares_failed":0,"last_share":1781763047,"peers_out":10,"peers_in":0,"peer_list":384,"pool_hr":16016325,"sidechain_diff":160163251,"tor_cpu_pct":20.65,"tor_mem":"96.29MiB"}
+{"ts":1781763526,"arm":"tor","reward_share":1.456,"avg_effort":119.084,"cur_effort":89.844,"hashrate_1h":277709,"hashrate_24h":273012,"shares_found":34,"shares_failed":0,"last_share":1781763047,"peers_out":10,"peers_in":0,"peer_list":390,"pool_hr":16033528,"sidechain_diff":160335285,"tor_cpu_pct":22.98,"tor_mem":"96.54MiB"}
+{"ts":1781763827,"arm":"tor","reward_share":1.454,"avg_effort":119.084,"cur_effort":135.620,"hashrate_1h":274032,"hashrate_24h":272620,"shares_found":34,"shares_failed":0,"last_share":1781763047,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16023806,"sidechain_diff":160238064,"tor_cpu_pct":18.86,"tor_mem":"96.57MiB"}
+{"ts":1781764129,"arm":"tor","reward_share":1.497,"avg_effort":119.919,"cur_effort":44.165,"hashrate_1h":274423,"hashrate_24h":272900,"shares_found":35,"shares_failed":0,"last_share":1781763908,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16289852,"sidechain_diff":162898524,"tor_cpu_pct":24.45,"tor_mem":"96.48MiB"}
+{"ts":1781764430,"arm":"tor","reward_share":1.357,"avg_effort":119.919,"cur_effort":92.934,"hashrate_1h":277330,"hashrate_24h":272889,"shares_found":35,"shares_failed":0,"last_share":1781763908,"peers_out":10,"peers_in":0,"peer_list":395,"pool_hr":16207465,"sidechain_diff":162074657,"tor_cpu_pct":5.6,"tor_mem":"96.25MiB"}
+{"ts":1781764731,"arm":"tor","reward_share":1.312,"avg_effort":119.919,"cur_effort":149.840,"hashrate_1h":280476,"hashrate_24h":273242,"shares_found":35,"shares_failed":0,"last_share":1781763908,"peers_out":10,"peers_in":0,"peer_list":396,"pool_hr":16145263,"sidechain_diff":161452638,"tor_cpu_pct":6.86,"tor_mem":"96.32MiB"}
+{"ts":1781765032,"arm":"tor","reward_share":1.348,"avg_effort":117.674,"cur_effort":51.212,"hashrate_1h":280323,"hashrate_24h":273705,"shares_found":37,"shares_failed":0,"last_share":1781764762,"peers_out":10,"peers_in":0,"peer_list":395,"pool_hr":16125010,"sidechain_diff":161250107,"tor_cpu_pct":18.85,"tor_mem":"96.62MiB"}
+{"ts":1781765334,"arm":"tor","reward_share":1.348,"avg_effort":117.674,"cur_effort":95.525,"hashrate_1h":278455,"hashrate_24h":273273,"shares_found":37,"shares_failed":0,"last_share":1781764762,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16121379,"sidechain_diff":161213796,"tor_cpu_pct":16.36,"tor_mem":"96.83MiB"}
+{"ts":1781765635,"arm":"tor","reward_share":1.391,"avg_effort":118.572,"cur_effort":1.723,"hashrate_1h":286995,"hashrate_24h":273585,"shares_found":38,"shares_failed":0,"last_share":1781765614,"peers_out":10,"peers_in":0,"peer_list":388,"pool_hr":16043361,"sidechain_diff":160433619,"tor_cpu_pct":33.11,"tor_mem":"96.48MiB"}
+{"ts":1781765936,"arm":"tor","reward_share":1.295,"avg_effort":118.572,"cur_effort":49.056,"hashrate_1h":286478,"hashrate_24h":273489,"shares_found":38,"shares_failed":0,"last_share":1781765614,"peers_out":10,"peers_in":0,"peer_list":390,"pool_hr":16003306,"sidechain_diff":160033067,"tor_cpu_pct":12.01,"tor_mem":"96.11MiB"}
+{"ts":1781766237,"arm":"tor","reward_share":1.294,"avg_effort":118.572,"cur_effort":100.355,"hashrate_1h":283297,"hashrate_24h":273397,"shares_found":38,"shares_failed":0,"last_share":1781765614,"peers_out":10,"peers_in":0,"peer_list":389,"pool_hr":16119067,"sidechain_diff":161190674,"tor_cpu_pct":17.56,"tor_mem":"96.28MiB"}
+{"ts":1781766539,"arm":"tor","reward_share":1.337,"avg_effort":118.188,"cur_effort":49.633,"hashrate_1h":283165,"hashrate_24h":273504,"shares_found":39,"shares_failed":0,"last_share":1781766241,"peers_out":10,"peers_in":0,"peer_list":390,"pool_hr":16239862,"sidechain_diff":162398628,"tor_cpu_pct":32.57,"tor_mem":"96.15MiB"}
+{"ts":1781766840,"arm":"tor","reward_share":1.382,"avg_effort":117.594,"cur_effort":3.984,"hashrate_1h":278617,"hashrate_24h":273538,"shares_found":40,"shares_failed":0,"last_share":1781766783,"peers_out":10,"peers_in":0,"peer_list":390,"pool_hr":16264249,"sidechain_diff":162642496,"tor_cpu_pct":25.7,"tor_mem":"96.62MiB"}
+{"ts":1781767141,"arm":"tor","reward_share":1.340,"avg_effort":115.065,"cur_effort":37.112,"hashrate_1h":276092,"hashrate_24h":273417,"shares_found":41,"shares_failed":0,"last_share":1781766909,"peers_out":10,"peers_in":0,"peer_list":384,"pool_hr":16511926,"sidechain_diff":165119265,"tor_cpu_pct":22.75,"tor_mem":"99.76MiB"}
+{"ts":1781767442,"arm":"tor","reward_share":1.351,"avg_effort":114.395,"cur_effort":5.192,"hashrate_1h":279487,"hashrate_24h":273470,"shares_found":42,"shares_failed":0,"last_share":1781767413,"peers_out":10,"peers_in":0,"peer_list":388,"pool_hr":16131923,"sidechain_diff":161319232,"tor_cpu_pct":7.62,"tor_mem":"96.39MiB"}
+{"ts":1781767744,"arm":"tor","reward_share":1.350,"avg_effort":114.395,"cur_effort":55.214,"hashrate_1h":277045,"hashrate_24h":273498,"shares_found":42,"shares_failed":0,"last_share":1781767413,"peers_out":10,"peers_in":0,"peer_list":392,"pool_hr":16091384,"sidechain_diff":160913841,"tor_cpu_pct":11.25,"tor_mem":"96.73MiB"}
+{"ts":1781768045,"arm":"tor","reward_share":1.350,"avg_effort":114.395,"cur_effort":109.255,"hashrate_1h":278935,"hashrate_24h":273678,"shares_found":42,"shares_failed":0,"last_share":1781767413,"peers_out":10,"peers_in":0,"peer_list":387,"pool_hr":16306889,"sidechain_diff":163068890,"tor_cpu_pct":13.66,"tor_mem":"95.59MiB"}
+{"ts":1781768346,"arm":"tor","reward_share":1.395,"avg_effort":115.437,"cur_effort":0.725,"hashrate_1h":276601,"hashrate_24h":273544,"shares_found":43,"shares_failed":0,"last_share":1781768336,"peers_out":10,"peers_in":0,"peer_list":387,"pool_hr":16154955,"sidechain_diff":161549553,"tor_cpu_pct":17.67,"tor_mem":"95.05MiB"}
+{"ts":1781768647,"arm":"tor","reward_share":1.396,"avg_effort":113.319,"cur_effort":32.023,"hashrate_1h":275421,"hashrate_24h":273859,"shares_found":44,"shares_failed":0,"last_share":1781768443,"peers_out":10,"peers_in":0,"peer_list":390,"pool_hr":16139705,"sidechain_diff":161397059,"tor_cpu_pct":26.48,"tor_mem":"95.12MiB"}
+{"ts":1781768949,"arm":"tor","reward_share":1.350,"avg_effort":113.319,"cur_effort":88.212,"hashrate_1h":280206,"hashrate_24h":274086,"shares_found":44,"shares_failed":0,"last_share":1781768443,"peers_out":10,"peers_in":0,"peer_list":395,"pool_hr":16195253,"sidechain_diff":161952532,"tor_cpu_pct":3.82,"tor_mem":"95.09MiB"}
+{"ts":1781769250,"arm":"tor","reward_share":1.259,"avg_effort":113.319,"cur_effort":127.112,"hashrate_1h":273230,"hashrate_24h":273470,"shares_found":44,"shares_failed":0,"last_share":1781768443,"peers_out":10,"peers_in":0,"peer_list":395,"pool_hr":16353454,"sidechain_diff":163534549,"tor_cpu_pct":3.93,"tor_mem":"94.55MiB"}
+{"ts":1781769551,"arm":"tor","reward_share":1.259,"avg_effort":113.319,"cur_effort":168.009,"hashrate_1h":268700,"hashrate_24h":272927,"shares_found":44,"shares_failed":0,"last_share":1781768443,"peers_out":10,"peers_in":0,"peer_list":396,"pool_hr":16225371,"sidechain_diff":162253711,"tor_cpu_pct":20.62,"tor_mem":"94.43MiB"}
+{"ts":1781769852,"arm":"tor","reward_share":1.258,"avg_effort":115.370,"cur_effort":19.428,"hashrate_1h":270587,"hashrate_24h":273157,"shares_found":45,"shares_failed":0,"last_share":1781769766,"peers_out":10,"peers_in":0,"peer_list":393,"pool_hr":16233842,"sidechain_diff":162338428,"tor_cpu_pct":3.16,"tor_mem":"94.29MiB"}
+{"ts":1781770154,"arm":"tor","reward_share":1.213,"avg_effort":115.370,"cur_effort":66.355,"hashrate_1h":268143,"hashrate_24h":272988,"shares_found":45,"shares_failed":0,"last_share":1781769766,"peers_out":10,"peers_in":0,"peer_list":400,"pool_hr":16180278,"sidechain_diff":161802786,"tor_cpu_pct":21.59,"tor_mem":"94.36MiB"}
+{"ts":1781770455,"arm":"tor","reward_share":1.123,"avg_effort":115.370,"cur_effort":118.079,"hashrate_1h":269230,"hashrate_24h":273064,"shares_found":45,"shares_failed":0,"last_share":1781769766,"peers_out":10,"peers_in":0,"peer_list":400,"pool_hr":16285401,"sidechain_diff":162854019,"tor_cpu_pct":3.52,"tor_mem":"94.34MiB"}
+{"ts":1781770756,"arm":"tor","reward_share":1.214,"avg_effort":113.959,"cur_effort":6.768,"hashrate_1h":270638,"hashrate_24h":273201,"shares_found":47,"shares_failed":0,"last_share":1781770724,"peers_out":10,"peers_in":0,"peer_list":404,"pool_hr":16311163,"sidechain_diff":163111638,"tor_cpu_pct":8.14,"tor_mem":"94.24MiB"}
+{"ts":1781771057,"arm":"tor","reward_share":1.213,"avg_effort":113.959,"cur_effort":50.418,"hashrate_1h":268730,"hashrate_24h":272976,"shares_found":47,"shares_failed":0,"last_share":1781770724,"peers_out":10,"peers_in":0,"peer_list":399,"pool_hr":16466630,"sidechain_diff":164666304,"tor_cpu_pct":6.65,"tor_mem":"94.24MiB"}
+{"ts":1781771359,"arm":"tor","reward_share":1.213,"avg_effort":113.959,"cur_effort":100.649,"hashrate_1h":268396,"hashrate_24h":272893,"shares_found":47,"shares_failed":0,"last_share":1781770724,"peers_out":10,"peers_in":0,"peer_list":398,"pool_hr":16479195,"sidechain_diff":164791950,"tor_cpu_pct":14.22,"tor_mem":"94.35MiB"}
+{"ts":1781771660,"arm":"tor","reward_share":1.213,"avg_effort":113.959,"cur_effort":137.556,"hashrate_1h":261534,"hashrate_24h":272360,"shares_found":47,"shares_failed":0,"last_share":1781770724,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16459822,"sidechain_diff":164598220,"tor_cpu_pct":2.53,"tor_mem":"94.15MiB"}
+{"ts":1781771961,"arm":"tor","reward_share":1.260,"avg_effort":114.893,"cur_effort":26.994,"hashrate_1h":263043,"hashrate_24h":272379,"shares_found":48,"shares_failed":0,"last_share":1781771789,"peers_out":10,"peers_in":0,"peer_list":395,"pool_hr":16932544,"sidechain_diff":169325445,"tor_cpu_pct":3.09,"tor_mem":"94.27MiB"}
+{"ts":1781772262,"arm":"tor","reward_share":1.352,"avg_effort":111.469,"cur_effort":5.883,"hashrate_1h":256731,"hashrate_24h":272057,"shares_found":50,"shares_failed":0,"last_share":1781772214,"peers_out":10,"peers_in":0,"peer_list":392,"pool_hr":16647516,"sidechain_diff":166475163,"tor_cpu_pct":14.12,"tor_mem":"94.03MiB"}
+{"ts":1781772564,"arm":"tor","reward_share":1.399,"avg_effort":109.839,"cur_effort":18.791,"hashrate_1h":253718,"hashrate_24h":271915,"shares_found":51,"shares_failed":0,"last_share":1781772428,"peers_out":10,"peers_in":0,"peer_list":391,"pool_hr":16628808,"sidechain_diff":166288089,"tor_cpu_pct":5.04,"tor_mem":"94.52MiB"}
+{"ts":1781772865,"arm":"tor","reward_share":1.352,"avg_effort":109.839,"cur_effort":68.801,"hashrate_1h":260031,"hashrate_24h":272015,"shares_found":51,"shares_failed":0,"last_share":1781772428,"peers_out":10,"peers_in":0,"peer_list":392,"pool_hr":17091191,"sidechain_diff":170911917,"tor_cpu_pct":23.68,"tor_mem":"94.28MiB"}
+{"ts":1781773166,"arm":"tor","reward_share":1.398,"avg_effort":109.802,"cur_effort":3.727,"hashrate_1h":262029,"hashrate_24h":271771,"shares_found":52,"shares_failed":0,"last_share":1781773124,"peers_out":10,"peers_in":0,"peer_list":393,"pool_hr":16846627,"sidechain_diff":168466276,"tor_cpu_pct":15.15,"tor_mem":"94.34MiB"}
+{"ts":1781773467,"arm":"tor","reward_share":1.398,"avg_effort":109.802,"cur_effort":59.826,"hashrate_1h":262146,"hashrate_24h":271974,"shares_found":52,"shares_failed":0,"last_share":1781773124,"peers_out":10,"peers_in":0,"peer_list":392,"pool_hr":16658477,"sidechain_diff":166584778,"tor_cpu_pct":9.43,"tor_mem":"94.48MiB"}
+{"ts":1781773769,"arm":"tor","reward_share":1.489,"avg_effort":105.520,"cur_effort":4.076,"hashrate_1h":261326,"hashrate_24h":271822,"shares_found":55,"shares_failed":0,"last_share":1781773734,"peers_out":10,"peers_in":0,"peer_list":391,"pool_hr":16659256,"sidechain_diff":166592568,"tor_cpu_pct":19.06,"tor_mem":"94.07MiB"}
+{"ts":1781774070,"arm":"tor","reward_share":1.536,"avg_effort":104.265,"cur_effort":13.678,"hashrate_1h":261520,"hashrate_24h":271817,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16637160,"sidechain_diff":166371608,"tor_cpu_pct":21.01,"tor_mem":"94.21MiB"}
+{"ts":1781774371,"arm":"tor","reward_share":1.534,"avg_effort":104.265,"cur_effort":62.519,"hashrate_1h":258058,"hashrate_24h":271706,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":392,"pool_hr":16700873,"sidechain_diff":167008732,"tor_cpu_pct":5.1,"tor_mem":"94.57MiB"}
+{"ts":1781774672,"arm":"tor","reward_share":1.532,"avg_effort":104.265,"cur_effort":109.317,"hashrate_1h":260796,"hashrate_24h":271649,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":390,"pool_hr":16857525,"sidechain_diff":168575254,"tor_cpu_pct":14.7,"tor_mem":"94.72MiB"}
+{"ts":1781774974,"arm":"tor","reward_share":1.531,"avg_effort":104.265,"cur_effort":157.930,"hashrate_1h":261068,"hashrate_24h":271653,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16832041,"sidechain_diff":168320411,"tor_cpu_pct":18.96,"tor_mem":"94.36MiB"}
+{"ts":1781775275,"arm":"tor","reward_share":1.531,"avg_effort":104.265,"cur_effort":202.345,"hashrate_1h":263292,"hashrate_24h":271506,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":400,"pool_hr":16946639,"sidechain_diff":169466391,"tor_cpu_pct":20.24,"tor_mem":"94.27MiB"}
+{"ts":1781775576,"arm":"tor","reward_share":1.531,"avg_effort":104.265,"cur_effort":242.685,"hashrate_1h":261339,"hashrate_24h":271251,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":398,"pool_hr":16938479,"sidechain_diff":169384799,"tor_cpu_pct":22.1,"tor_mem":"95.08MiB"}
+{"ts":1781775878,"arm":"tor","reward_share":1.530,"avg_effort":104.265,"cur_effort":289.508,"hashrate_1h":263030,"hashrate_24h":271114,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":403,"pool_hr":17011810,"sidechain_diff":170118100,"tor_cpu_pct":27.94,"tor_mem":"94.9MiB"}
+{"ts":1781776179,"arm":"tor","reward_share":1.483,"avg_effort":104.265,"cur_effort":340.980,"hashrate_1h":265090,"hashrate_24h":271270,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":404,"pool_hr":16942279,"sidechain_diff":169422790,"tor_cpu_pct":30.95,"tor_mem":"96.12MiB"}
+{"ts":1781776480,"arm":"tor","reward_share":1.438,"avg_effort":104.265,"cur_effort":388.619,"hashrate_1h":262849,"hashrate_24h":271155,"shares_found":56,"shares_failed":0,"last_share":1781773927,"peers_out":10,"peers_in":0,"peer_list":405,"pool_hr":16896070,"sidechain_diff":168960707,"tor_cpu_pct":22.53,"tor_mem":"95.77MiB"}
+{"ts":1781776781,"arm":"tor","reward_share":1.483,"avg_effort":109.548,"cur_effort":49.016,"hashrate_1h":267839,"hashrate_24h":271411,"shares_found":57,"shares_failed":0,"last_share":1781776501,"peers_out":10,"peers_in":0,"peer_list":411,"pool_hr":17225484,"sidechain_diff":172254841,"tor_cpu_pct":25.47,"tor_mem":"96.07MiB"}
+{"ts":1781777083,"arm":"tor","reward_share":1.438,"avg_effort":109.548,"cur_effort":96.516,"hashrate_1h":266678,"hashrate_24h":271478,"shares_found":57,"shares_failed":0,"last_share":1781776501,"peers_out":10,"peers_in":0,"peer_list":404,"pool_hr":16927327,"sidechain_diff":169273278,"tor_cpu_pct":25.45,"tor_mem":"96.68MiB"}
+{"ts":1781777384,"arm":"tor","reward_share":1.439,"avg_effort":109.739,"cur_effort":15.866,"hashrate_1h":263073,"hashrate_24h":271061,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":400,"pool_hr":16912723,"sidechain_diff":169127235,"tor_cpu_pct":28.81,"tor_mem":"96.51MiB"}
+{"ts":1781777685,"arm":"tor","reward_share":1.438,"avg_effort":109.739,"cur_effort":65.720,"hashrate_1h":263426,"hashrate_24h":270980,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16849538,"sidechain_diff":168495386,"tor_cpu_pct":6.95,"tor_mem":"96.24MiB"}
+{"ts":1781777986,"arm":"tor","reward_share":1.436,"avg_effort":109.739,"cur_effort":112.061,"hashrate_1h":262912,"hashrate_24h":270900,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":399,"pool_hr":16736854,"sidechain_diff":167368548,"tor_cpu_pct":18.06,"tor_mem":"96.35MiB"}
+{"ts":1781778288,"arm":"tor","reward_share":1.436,"avg_effort":109.739,"cur_effort":160.320,"hashrate_1h":264167,"hashrate_24h":270960,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":402,"pool_hr":16714770,"sidechain_diff":167147709,"tor_cpu_pct":5.83,"tor_mem":"96.5MiB"}
+{"ts":1781778589,"arm":"tor","reward_share":1.436,"avg_effort":109.739,"cur_effort":209.093,"hashrate_1h":263716,"hashrate_24h":270877,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":397,"pool_hr":16688963,"sidechain_diff":166889636,"tor_cpu_pct":23.91,"tor_mem":"96.5MiB"}
+{"ts":1781778890,"arm":"tor","reward_share":1.389,"avg_effort":109.739,"cur_effort":256.759,"hashrate_1h":265575,"hashrate_24h":270962,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":396,"pool_hr":16892562,"sidechain_diff":168925625,"tor_cpu_pct":23.8,"tor_mem":"96.32MiB"}
+{"ts":1781779191,"arm":"tor","reward_share":1.389,"avg_effort":109.739,"cur_effort":302.223,"hashrate_1h":265223,"hashrate_24h":270700,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":400,"pool_hr":16796772,"sidechain_diff":167967722,"tor_cpu_pct":1.05,"tor_mem":"96.21MiB"}
+{"ts":1781779493,"arm":"tor","reward_share":1.345,"avg_effort":109.739,"cur_effort":344.442,"hashrate_1h":264656,"hashrate_24h":270599,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":399,"pool_hr":16883105,"sidechain_diff":168831054,"tor_cpu_pct":21.63,"tor_mem":"96.17MiB"}
+{"ts":1781779794,"arm":"tor","reward_share":1.344,"avg_effort":109.739,"cur_effort":390.228,"hashrate_1h":262088,"hashrate_24h":270471,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":393,"pool_hr":16816635,"sidechain_diff":168166358,"tor_cpu_pct":17.43,"tor_mem":"96.41MiB"}
+{"ts":1781780095,"arm":"tor","reward_share":1.343,"avg_effort":109.739,"cur_effort":438.654,"hashrate_1h":263511,"hashrate_24h":270462,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":394,"pool_hr":16892205,"sidechain_diff":168922054,"tor_cpu_pct":25.88,"tor_mem":"96.45MiB"}
+{"ts":1781780396,"arm":"tor","reward_share":1.298,"avg_effort":109.739,"cur_effort":474.087,"hashrate_1h":256912,"hashrate_24h":270170,"shares_found":58,"shares_failed":0,"last_share":1781777226,"peers_out":10,"peers_in":0,"peer_list":391,"pool_hr":17020926,"sidechain_diff":170209266,"tor_cpu_pct":17.85,"tor_mem":"96.67MiB"}
+{"ts":1781780698,"arm":"tor","reward_share":1.342,"avg_effort":117.176,"cur_effort":2.392,"hashrate_1h":259291,"hashrate_24h":270389,"shares_found":59,"shares_failed":0,"last_share":1781780675,"peers_out":10,"peers_in":0,"peer_list":399,"pool_hr":16928129,"sidechain_diff":169281299,"tor_cpu_pct":18.37,"tor_mem":"96.38MiB"}
+{"ts":1781780999,"arm":"tor","reward_share":1.339,"avg_effort":117.176,"cur_effort":47.145,"hashrate_1h":263294,"hashrate_24h":270311,"shares_found":59,"shares_failed":0,"last_share":1781780675,"peers_out":10,"peers_in":0,"peer_list":396,"pool_hr":16964249,"sidechain_diff":169642493,"tor_cpu_pct":7.9,"tor_mem":"96.54MiB"}
+{"ts":1781781300,"arm":"tor","reward_share":1.338,"avg_effort":117.176,"cur_effort":104.375,"hashrate_1h":267540,"hashrate_24h":270663,"shares_found":59,"shares_failed":0,"last_share":1781780675,"peers_out":10,"peers_in":0,"peer_list":398,"pool_hr":16977475,"sidechain_diff":169774759,"tor_cpu_pct":16.97,"tor_mem":"96.25MiB"}
+{"ts":1781781601,"arm":"tor","reward_share":1.337,"avg_effort":117.176,"cur_effort":154.337,"hashrate_1h":269168,"hashrate_24h":270753,"shares_found":59,"shares_failed":0,"last_share":1781780675,"peers_out":10,"peers_in":0,"peer_list":410,"pool_hr":16941292,"sidechain_diff":169412924,"tor_cpu_pct":22.8,"tor_mem":"96.43MiB"}
+{"ts":1781781903,"arm":"tor","reward_share":1.391,"avg_effort":118.020,"cur_effort":37.415,"hashrate_1h":269171,"hashrate_24h":270726,"shares_found":60,"shares_failed":0,"last_share":1781781667,"peers_out":10,"peers_in":0,"peer_list":411,"pool_hr":16892073,"sidechain_diff":168920731,"tor_cpu_pct":17.17,"tor_mem":"96.28MiB"}
+{"ts":1781782204,"arm":"tor","reward_share":1.436,"avg_effort":116.885,"cur_effort":34.985,"hashrate_1h":269308,"hashrate_24h":270783,"shares_found":61,"shares_failed":0,"last_share":1781782008,"peers_out":10,"peers_in":0,"peer_list":417,"pool_hr":16955744,"sidechain_diff":169557441,"tor_cpu_pct":21.42,"tor_mem":"96.25MiB"}
+{"ts":1781782505,"arm":"tor","reward_share":1.436,"avg_effort":116.885,"cur_effort":86.948,"hashrate_1h":269248,"hashrate_24h":270900,"shares_found":61,"shares_failed":0,"last_share":1781782008,"peers_out":10,"peers_in":0,"peer_list":418,"pool_hr":17026975,"sidechain_diff":170269751,"tor_cpu_pct":24.76,"tor_mem":"96.64MiB"}
+{"ts":1781782806,"arm":"tor","reward_share":1.384,"avg_effort":116.885,"cur_effort":126.597,"hashrate_1h":271253,"hashrate_24h":270718,"shares_found":61,"shares_failed":0,"last_share":1781782008,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":17188923,"sidechain_diff":171889235,"tor_cpu_pct":26.28,"tor_mem":"96.59MiB"}
+{"ts":1781783108,"arm":"tor","reward_share":1.429,"avg_effort":117.424,"cur_effort":23.671,"hashrate_1h":272261,"hashrate_24h":270649,"shares_found":62,"shares_failed":0,"last_share":1781782943,"peers_out":10,"peers_in":0,"peer_list":414,"pool_hr":17354061,"sidechain_diff":173540611,"tor_cpu_pct":5.1,"tor_mem":"96.29MiB"}
+{"ts":1781783409,"arm":"tor","reward_share":1.429,"avg_effort":117.424,"cur_effort":62.277,"hashrate_1h":269400,"hashrate_24h":270366,"shares_found":62,"shares_failed":0,"last_share":1781782943,"peers_out":10,"peers_in":0,"peer_list":420,"pool_hr":17624119,"sidechain_diff":176241196,"tor_cpu_pct":4.62,"tor_mem":"96.42MiB"}
+{"ts":1781783710,"arm":"tor","reward_share":1.386,"avg_effort":117.424,"cur_effort":116.677,"hashrate_1h":272552,"hashrate_24h":270644,"shares_found":62,"shares_failed":0,"last_share":1781782943,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17388923,"sidechain_diff":173889230,"tor_cpu_pct":23.5,"tor_mem":"96.33MiB"}
+{"ts":1781784011,"arm":"tor","reward_share":1.432,"avg_effort":117.700,"cur_effort":30.577,"hashrate_1h":274466,"hashrate_24h":270675,"shares_found":63,"shares_failed":0,"last_share":1781783806,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17493160,"sidechain_diff":174931601,"tor_cpu_pct":16.15,"tor_mem":"96.06MiB"}
+{"ts":1781784313,"arm":"tor","reward_share":1.430,"avg_effort":117.700,"cur_effort":73.822,"hashrate_1h":272300,"hashrate_24h":270542,"shares_found":63,"shares_failed":0,"last_share":1781783806,"peers_out":10,"peers_in":0,"peer_list":420,"pool_hr":17423359,"sidechain_diff":174233597,"tor_cpu_pct":5.18,"tor_mem":"96.05MiB"}
+{"ts":1781784614,"arm":"tor","reward_share":1.429,"avg_effort":117.700,"cur_effort":130.922,"hashrate_1h":277857,"hashrate_24h":270908,"shares_found":63,"shares_failed":0,"last_share":1781783806,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17415334,"sidechain_diff":174153349,"tor_cpu_pct":17.81,"tor_mem":"96.06MiB"}
+{"ts":1781784915,"arm":"tor","reward_share":1.432,"avg_effort":118.534,"cur_effort":12.595,"hashrate_1h":273796,"hashrate_24h":270950,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":17410050,"sidechain_diff":174100505,"tor_cpu_pct":3.95,"tor_mem":"95.87MiB"}
+{"ts":1781785216,"arm":"tor","reward_share":1.388,"avg_effort":118.534,"cur_effort":60.525,"hashrate_1h":274934,"hashrate_24h":271031,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":419,"pool_hr":17482225,"sidechain_diff":174822253,"tor_cpu_pct":16.06,"tor_mem":"95.59MiB"}
+{"ts":1781785518,"arm":"tor","reward_share":1.343,"avg_effort":118.534,"cur_effort":104.746,"hashrate_1h":273731,"hashrate_24h":270907,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":422,"pool_hr":17343992,"sidechain_diff":173439926,"tor_cpu_pct":5.33,"tor_mem":"95.86MiB"}
+{"ts":1781785819,"arm":"tor","reward_share":1.342,"avg_effort":118.534,"cur_effort":144.467,"hashrate_1h":267861,"hashrate_24h":270609,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":417,"pool_hr":17269970,"sidechain_diff":172699704,"tor_cpu_pct":26.84,"tor_mem":"95.6MiB"}
+{"ts":1781786120,"arm":"tor","reward_share":1.342,"avg_effort":118.534,"cur_effort":185.771,"hashrate_1h":264291,"hashrate_24h":270351,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":411,"pool_hr":17212419,"sidechain_diff":172124193,"tor_cpu_pct":17.72,"tor_mem":"95.74MiB"}
+{"ts":1781786421,"arm":"tor","reward_share":1.299,"avg_effort":118.534,"cur_effort":227.604,"hashrate_1h":263615,"hashrate_24h":270147,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":412,"pool_hr":17064701,"sidechain_diff":170647013,"tor_cpu_pct":27.13,"tor_mem":"96.1MiB"}
+{"ts":1781786723,"arm":"tor","reward_share":1.298,"avg_effort":118.534,"cur_effort":269.589,"hashrate_1h":261331,"hashrate_24h":269899,"shares_found":64,"shares_failed":0,"last_share":1781784823,"peers_out":10,"peers_in":0,"peer_list":412,"pool_hr":17046042,"sidechain_diff":170460423,"tor_cpu_pct":2.96,"tor_mem":"95.62MiB"}
+{"ts":1781787024,"arm":"tor","reward_share":1.344,"avg_effort":121.654,"cur_effort":3.465,"hashrate_1h":264549,"hashrate_24h":269976,"shares_found":65,"shares_failed":0,"last_share":1781786985,"peers_out":10,"peers_in":0,"peer_list":409,"pool_hr":16989480,"sidechain_diff":169894807,"tor_cpu_pct":18.18,"tor_mem":"96.1MiB"}
+{"ts":1781787325,"arm":"tor","reward_share":1.302,"avg_effort":120.187,"cur_effort":17.290,"hashrate_1h":259808,"hashrate_24h":269727,"shares_found":66,"shares_failed":0,"last_share":1781787182,"peers_out":10,"peers_in":0,"peer_list":413,"pool_hr":16802783,"sidechain_diff":168027832,"tor_cpu_pct":2.26,"tor_mem":"95.9MiB"}
+{"ts":1781787626,"arm":"tor","reward_share":1.301,"avg_effort":120.187,"cur_effort":65.422,"hashrate_1h":258004,"hashrate_24h":269677,"shares_found":66,"shares_failed":0,"last_share":1781787182,"peers_out":10,"peers_in":0,"peer_list":416,"pool_hr":16638586,"sidechain_diff":166385862,"tor_cpu_pct":4.95,"tor_mem":"95.82MiB"}
+{"ts":1781787928,"arm":"tor","reward_share":1.259,"avg_effort":120.187,"cur_effort":115.759,"hashrate_1h":258714,"hashrate_24h":269737,"shares_found":66,"shares_failed":0,"last_share":1781787182,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":16651738,"sidechain_diff":166517382,"tor_cpu_pct":2.97,"tor_mem":"95.81MiB"}
+{"ts":1781788229,"arm":"tor","reward_share":1.259,"avg_effort":120.187,"cur_effort":174.580,"hashrate_1h":259691,"hashrate_24h":270071,"shares_found":66,"shares_failed":0,"last_share":1781787182,"peers_out":10,"peers_in":0,"peer_list":413,"pool_hr":16476564,"sidechain_diff":164765647,"tor_cpu_pct":19.24,"tor_mem":"96.24MiB"}
+{"ts":1781788530,"arm":"tor","reward_share":1.215,"avg_effort":120.187,"cur_effort":220.826,"hashrate_1h":257978,"hashrate_24h":269984,"shares_found":66,"shares_failed":0,"last_share":1781787182,"peers_out":10,"peers_in":0,"peer_list":419,"pool_hr":16518426,"sidechain_diff":165184263,"tor_cpu_pct":22.21,"tor_mem":"96.16MiB"}
+{"ts":1781788831,"arm":"tor","reward_share":1.214,"avg_effort":120.187,"cur_effort":268.591,"hashrate_1h":254358,"hashrate_24h":269872,"shares_found":66,"shares_failed":0,"last_share":1781787182,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":16508307,"sidechain_diff":165083073,"tor_cpu_pct":21.88,"tor_mem":"96.38MiB"}
+{"ts":1781789132,"arm":"tor","reward_share":1.303,"avg_effort":121.199,"cur_effort":4.908,"hashrate_1h":254954,"hashrate_24h":269779,"shares_found":68,"shares_failed":0,"last_share":1781789094,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":16449950,"sidechain_diff":164499503,"tor_cpu_pct":3.57,"tor_mem":"96.82MiB"}
+{"ts":1781789434,"arm":"tor","reward_share":1.214,"avg_effort":121.199,"cur_effort":47.551,"hashrate_1h":254908,"hashrate_24h":269506,"shares_found":68,"shares_failed":0,"last_share":1781789094,"peers_out":10,"peers_in":0,"peer_list":429,"pool_hr":16461763,"sidechain_diff":164617638,"tor_cpu_pct":23.19,"tor_mem":"96.56MiB"}
+{"ts":1781789735,"arm":"tor","reward_share":1.347,"avg_effort":117.311,"cur_effort":8.349,"hashrate_1h":258967,"hashrate_24h":269510,"shares_found":71,"shares_failed":0,"last_share":1781789668,"peers_out":10,"peers_in":0,"peer_list":429,"pool_hr":16505336,"sidechain_diff":165053361,"tor_cpu_pct":7.53,"tor_mem":"96.6MiB"}
+{"ts":1781790036,"arm":"tor","reward_share":1.393,"avg_effort":114.618,"cur_effort":20.563,"hashrate_1h":262931,"hashrate_24h":269669,"shares_found":73,"shares_failed":0,"last_share":1781789895,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":16492038,"sidechain_diff":164920388,"tor_cpu_pct":3.37,"tor_mem":"96.3MiB"}
+{"ts":1781790337,"arm":"tor","reward_share":1.392,"avg_effort":114.618,"cur_effort":70.320,"hashrate_1h":267631,"hashrate_24h":269707,"shares_found":73,"shares_failed":0,"last_share":1781789895,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":16456999,"sidechain_diff":164569993,"tor_cpu_pct":11.37,"tor_mem":"96.16MiB"}
+{"ts":1781790639,"arm":"tor","reward_share":1.392,"avg_effort":114.618,"cur_effort":115.877,"hashrate_1h":265406,"hashrate_24h":269570,"shares_found":73,"shares_failed":0,"last_share":1781789895,"peers_out":10,"peers_in":0,"peer_list":441,"pool_hr":16555378,"sidechain_diff":165553781,"tor_cpu_pct":14.35,"tor_mem":"75.81MiB"}
+{"ts":1781790940,"arm":"tor","reward_share":1.392,"avg_effort":115.284,"cur_effort":3.864,"hashrate_1h":269116,"hashrate_24h":269673,"shares_found":74,"shares_failed":0,"last_share":1781790890,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":16418529,"sidechain_diff":164185295,"tor_cpu_pct":5.68,"tor_mem":"75.76MiB"}
+{"ts":1781791241,"arm":"tor","reward_share":1.348,"avg_effort":115.284,"cur_effort":52.812,"hashrate_1h":266697,"hashrate_24h":269554,"shares_found":74,"shares_failed":0,"last_share":1781790890,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":16423199,"sidechain_diff":164231991,"tor_cpu_pct":21.59,"tor_mem":"91.71MiB"}
+{"ts":1781791542,"arm":"tor","reward_share":1.349,"avg_effort":115.284,"cur_effort":102.000,"hashrate_1h":268279,"hashrate_24h":269586,"shares_found":74,"shares_failed":0,"last_share":1781790890,"peers_out":10,"peers_in":0,"peer_list":442,"pool_hr":16452664,"sidechain_diff":164526649,"tor_cpu_pct":29.04,"tor_mem":"103.4MiB"}
+{"ts":1781791844,"arm":"tor","reward_share":1.348,"avg_effort":115.284,"cur_effort":151.089,"hashrate_1h":261376,"hashrate_24h":269514,"shares_found":74,"shares_failed":0,"last_share":1781790890,"peers_out":10,"peers_in":0,"peer_list":444,"pool_hr":16324750,"sidechain_diff":163247509,"tor_cpu_pct":19.33,"tor_mem":"78.05MiB"}
+{"ts":1781792145,"arm":"tor","reward_share":1.348,"avg_effort":115.284,"cur_effort":196.707,"hashrate_1h":261971,"hashrate_24h":269416,"shares_found":74,"shares_failed":0,"last_share":1781790890,"peers_out":10,"peers_in":0,"peer_list":437,"pool_hr":16371090,"sidechain_diff":163710906,"tor_cpu_pct":27.16,"tor_mem":"76.98MiB"}
+{"ts":1781792446,"arm":"tor","reward_share":1.349,"avg_effort":115.284,"cur_effort":258.469,"hashrate_1h":268914,"hashrate_24h":269798,"shares_found":74,"shares_failed":0,"last_share":1781790890,"peers_out":10,"peers_in":0,"peer_list":436,"pool_hr":16321604,"sidechain_diff":163216047,"tor_cpu_pct":21.02,"tor_mem":"76.66MiB"}
+{"ts":1781792747,"arm":"tor","reward_share":1.393,"avg_effort":116.077,"cur_effort":16.119,"hashrate_1h":269187,"hashrate_24h":269769,"shares_found":76,"shares_failed":0,"last_share":1781792661,"peers_out":10,"peers_in":0,"peer_list":430,"pool_hr":16475116,"sidechain_diff":164751169,"tor_cpu_pct":8.02,"tor_mem":"77.2MiB"}
+{"ts":1781793049,"arm":"tor","reward_share":1.392,"avg_effort":116.077,"cur_effort":58.831,"hashrate_1h":269321,"hashrate_24h":269512,"shares_found":76,"shares_failed":0,"last_share":1781792661,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":16566446,"sidechain_diff":165664463,"tor_cpu_pct":18.68,"tor_mem":"76.75MiB"}
+{"ts":1781793350,"arm":"tor","reward_share":1.348,"avg_effort":116.077,"cur_effort":104.711,"hashrate_1h":268567,"hashrate_24h":269443,"shares_found":76,"shares_failed":0,"last_share":1781792661,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":16337170,"sidechain_diff":163371708,"tor_cpu_pct":21.21,"tor_mem":"77MiB"}
+{"ts":1781793651,"arm":"tor","reward_share":1.391,"avg_effort":114.905,"cur_effort":17.389,"hashrate_1h":266689,"hashrate_24h":269448,"shares_found":78,"shares_failed":0,"last_share":1781793544,"peers_out":10,"peers_in":0,"peer_list":430,"pool_hr":16151507,"sidechain_diff":161515070,"tor_cpu_pct":16.79,"tor_mem":"77.93MiB"}
+{"ts":1781793952,"arm":"tor","reward_share":1.425,"avg_effort":113.799,"cur_effort":32.478,"hashrate_1h":263765,"hashrate_24h":269233,"shares_found":79,"shares_failed":0,"last_share":1781793719,"peers_out":10,"peers_in":0,"peer_list":431,"pool_hr":16209634,"sidechain_diff":162096347,"tor_cpu_pct":14.54,"tor_mem":"77.18MiB"}
+{"ts":1781794254,"arm":"tor","reward_share":1.425,"avg_effort":113.799,"cur_effort":78.153,"hashrate_1h":263251,"hashrate_24h":269143,"shares_found":79,"shares_failed":0,"last_share":1781793719,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":16269080,"sidechain_diff":162690804,"tor_cpu_pct":26.39,"tor_mem":"76.89MiB"}
+{"ts":1781794555,"arm":"tor","reward_share":1.467,"avg_effort":113.782,"cur_effort":25.856,"hashrate_1h":265530,"hashrate_24h":269412,"shares_found":80,"shares_failed":0,"last_share":1781794433,"peers_out":10,"peers_in":0,"peer_list":430,"pool_hr":16173119,"sidechain_diff":161731194,"tor_cpu_pct":15.85,"tor_mem":"76.79MiB"}
+{"ts":1781794856,"arm":"tor","reward_share":1.420,"avg_effort":112.765,"cur_effort":43.161,"hashrate_1h":266545,"hashrate_24h":269340,"shares_found":81,"shares_failed":0,"last_share":1781794571,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":16210388,"sidechain_diff":162103886,"tor_cpu_pct":4.32,"tor_mem":"76.74MiB"}
+{"ts":1781795157,"arm":"tor","reward_share":1.421,"avg_effort":112.185,"cur_effort":28.428,"hashrate_1h":266075,"hashrate_24h":269329,"shares_found":82,"shares_failed":0,"last_share":1781794992,"peers_out":10,"peers_in":0,"peer_list":426,"pool_hr":16302693,"sidechain_diff":163026933,"tor_cpu_pct":21.72,"tor_mem":"76.76MiB"}
+{"ts":1781795459,"arm":"tor","reward_share":1.377,"avg_effort":112.185,"cur_effort":88.059,"hashrate_1h":270659,"hashrate_24h":269569,"shares_found":82,"shares_failed":0,"last_share":1781794992,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":16154799,"sidechain_diff":161547991,"tor_cpu_pct":24.67,"tor_mem":"76.81MiB"}
+{"ts":1781795760,"arm":"tor","reward_share":1.423,"avg_effort":111.952,"cur_effort":53.659,"hashrate_1h":275660,"hashrate_24h":269824,"shares_found":83,"shares_failed":0,"last_share":1781795472,"peers_out":10,"peers_in":0,"peer_list":428,"pool_hr":16034364,"sidechain_diff":160343647,"tor_cpu_pct":7.71,"tor_mem":"77.37MiB"}
+{"ts":1781796061,"arm":"tor","reward_share":1.377,"avg_effort":111.952,"cur_effort":98.132,"hashrate_1h":268875,"hashrate_24h":269726,"shares_found":83,"shares_failed":0,"last_share":1781795472,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":16167146,"sidechain_diff":161671468,"tor_cpu_pct":21.28,"tor_mem":"77.2MiB"}
+{"ts":1781796362,"arm":"tor","reward_share":1.412,"avg_effort":111.879,"cur_effort":45.273,"hashrate_1h":270656,"hashrate_24h":269777,"shares_found":84,"shares_failed":0,"last_share":1781796077,"peers_out":10,"peers_in":0,"peer_list":426,"pool_hr":16235674,"sidechain_diff":162356743,"tor_cpu_pct":27.18,"tor_mem":"76.87MiB"}
+{"ts":1781796664,"arm":"tor","reward_share":1.279,"avg_effort":111.879,"cur_effort":89.799,"hashrate_1h":271457,"hashrate_24h":269617,"shares_found":84,"shares_failed":0,"last_share":1781796077,"peers_out":10,"peers_in":0,"peer_list":424,"pool_hr":16365069,"sidechain_diff":163650693,"tor_cpu_pct":27.67,"tor_mem":"76.86MiB"}
+{"ts":1781796965,"arm":"tor","reward_share":1.269,"avg_effort":111.848,"cur_effort":29.565,"hashrate_1h":273141,"hashrate_24h":269627,"shares_found":85,"shares_failed":0,"last_share":1781796774,"peers_out":10,"peers_in":0,"peer_list":418,"pool_hr":16229916,"sidechain_diff":162299167,"tor_cpu_pct":19.93,"tor_mem":"77.5MiB"}
+{"ts":1781797266,"arm":"tor","reward_share":1.316,"avg_effort":111.086,"cur_effort":41.143,"hashrate_1h":274909,"hashrate_24h":269817,"shares_found":86,"shares_failed":0,"last_share":1781797045,"peers_out":10,"peers_in":0,"peer_list":413,"pool_hr":16122154,"sidechain_diff":161221546,"tor_cpu_pct":3.71,"tor_mem":"77.53MiB"}
+{"ts":1781797567,"arm":"tor","reward_share":1.317,"avg_effort":111.086,"cur_effort":86.901,"hashrate_1h":277437,"hashrate_24h":269755,"shares_found":86,"shares_failed":0,"last_share":1781797045,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":16306274,"sidechain_diff":163062744,"tor_cpu_pct":21.81,"tor_mem":"77.41MiB"}
+{"ts":1781797869,"arm":"tor","reward_share":1.361,"avg_effort":111.086,"cur_effort":27.327,"hashrate_1h":278878,"hashrate_24h":269751,"shares_found":87,"shares_failed":0,"last_share":1781797695,"peers_out":10,"peers_in":0,"peer_list":420,"pool_hr":16216915,"sidechain_diff":162169159,"tor_cpu_pct":24.04,"tor_mem":"77.14MiB"}
+{"ts":1781798170,"arm":"tor","reward_share":1.362,"avg_effort":111.086,"cur_effort":82.159,"hashrate_1h":276162,"hashrate_24h":269824,"shares_found":87,"shares_failed":0,"last_share":1781797695,"peers_out":10,"peers_in":0,"peer_list":420,"pool_hr":16131481,"sidechain_diff":161314816,"tor_cpu_pct":17.1,"tor_mem":"77.43MiB"}
+{"ts":1781798471,"arm":"tor","reward_share":1.408,"avg_effort":110.960,"cur_effort":26.701,"hashrate_1h":275613,"hashrate_24h":269677,"shares_found":88,"shares_failed":0,"last_share":1781798284,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":16171334,"sidechain_diff":161713343,"tor_cpu_pct":19.26,"tor_mem":"77.13MiB"}
+{"ts":1781798773,"arm":"tor","reward_share":1.361,"avg_effort":110.960,"cur_effort":86.657,"hashrate_1h":279623,"hashrate_24h":269936,"shares_found":88,"shares_failed":0,"last_share":1781798284,"peers_out":10,"peers_in":0,"peer_list":429,"pool_hr":16281305,"sidechain_diff":162813054,"tor_cpu_pct":21.55,"tor_mem":"77.79MiB"}
+{"ts":1781799074,"arm":"tor","reward_share":1.361,"avg_effort":110.960,"cur_effort":132.286,"hashrate_1h":275176,"hashrate_24h":269925,"shares_found":88,"shares_failed":0,"last_share":1781798284,"peers_out":10,"peers_in":0,"peer_list":432,"pool_hr":16494002,"sidechain_diff":164940020,"tor_cpu_pct":23.53,"tor_mem":"77.67MiB"}
+{"ts":1781799375,"arm":"tor","reward_share":1.406,"avg_effort":111.794,"cur_effort":1.285,"hashrate_1h":273748,"hashrate_24h":270050,"shares_found":89,"shares_failed":0,"last_share":1781799355,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":16620334,"sidechain_diff":166203346,"tor_cpu_pct":8.55,"tor_mem":"77.73MiB"}
+{"ts":1781799676,"arm":"tor","reward_share":1.405,"avg_effort":110.970,"cur_effort":8.371,"hashrate_1h":271987,"hashrate_24h":269904,"shares_found":90,"shares_failed":0,"last_share":1781799560,"peers_out":10,"peers_in":0,"peer_list":431,"pool_hr":16502441,"sidechain_diff":165024415,"tor_cpu_pct":19.38,"tor_mem":"77.13MiB"}
+{"ts":1781799977,"arm":"tor","reward_share":1.494,"avg_effort":109.218,"cur_effort":1.305,"hashrate_1h":275307,"hashrate_24h":270079,"shares_found":92,"shares_failed":0,"last_share":1781799964,"peers_out":10,"peers_in":0,"peer_list":425,"pool_hr":16510935,"sidechain_diff":165109351,"tor_cpu_pct":4.35,"tor_mem":"76.65MiB"}
+{"ts":1781800279,"arm":"tor","reward_share":1.496,"avg_effort":109.218,"cur_effort":48.594,"hashrate_1h":277082,"hashrate_24h":270036,"shares_found":92,"shares_failed":0,"last_share":1781799964,"peers_out":10,"peers_in":0,"peer_list":427,"pool_hr":16475156,"sidechain_diff":164751569,"tor_cpu_pct":6.39,"tor_mem":"76.76MiB"}
+{"ts":1781800580,"arm":"tor","reward_share":1.496,"avg_effort":109.218,"cur_effort":89.164,"hashrate_1h":273466,"hashrate_24h":269852,"shares_found":92,"shares_failed":0,"last_share":1781799964,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":16525414,"sidechain_diff":165254147,"tor_cpu_pct":7.93,"tor_mem":"76.64MiB"}
+{"ts":1781800881,"arm":"tor","reward_share":1.497,"avg_effort":109.218,"cur_effort":132.651,"hashrate_1h":267210,"hashrate_24h":269614,"shares_found":92,"shares_failed":0,"last_share":1781799964,"peers_out":10,"peers_in":0,"peer_list":435,"pool_hr":16417860,"sidechain_diff":164178605,"tor_cpu_pct":23.55,"tor_mem":"76.74MiB"}
+{"ts":1781801182,"arm":"tor","reward_share":1.542,"avg_effort":109.811,"cur_effort":26.471,"hashrate_1h":270188,"hashrate_24h":269865,"shares_found":93,"shares_failed":0,"last_share":1781801028,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":16315457,"sidechain_diff":163154575,"tor_cpu_pct":8.6,"tor_mem":"76.35MiB"}
+{"ts":1781801484,"arm":"tor","reward_share":1.543,"avg_effort":109.811,"cur_effort":72.369,"hashrate_1h":270950,"hashrate_24h":269864,"shares_found":93,"shares_failed":0,"last_share":1781801028,"peers_out":10,"peers_in":0,"peer_list":437,"pool_hr":16924717,"sidechain_diff":169247173,"tor_cpu_pct":12.49,"tor_mem":"76.62MiB"}
+{"ts":1781801785,"arm":"tor","reward_share":1.544,"avg_effort":109.811,"cur_effort":120.850,"hashrate_1h":270521,"hashrate_24h":269864,"shares_found":93,"shares_failed":0,"last_share":1781801028,"peers_out":10,"peers_in":0,"peer_list":439,"pool_hr":16853251,"sidechain_diff":168532510,"tor_cpu_pct":20.88,"tor_mem":"77MiB"}
+{"ts":1781802086,"arm":"tor","reward_share":1.545,"avg_effort":109.811,"cur_effort":171.950,"hashrate_1h":272981,"hashrate_24h":269870,"shares_found":93,"shares_failed":0,"last_share":1781801028,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":16640100,"sidechain_diff":166401004,"tor_cpu_pct":16.66,"tor_mem":"76.57MiB"}
+{"ts":1781802387,"arm":"tor","reward_share":1.590,"avg_effort":110.900,"cur_effort":7.885,"hashrate_1h":265818,"hashrate_24h":269719,"shares_found":94,"shares_failed":0,"last_share":1781802340,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":16425049,"sidechain_diff":164250497,"tor_cpu_pct":16.18,"tor_mem":"76.18MiB"}
+{"ts":1781802689,"arm":"tor","reward_share":1.592,"avg_effort":110.900,"cur_effort":61.170,"hashrate_1h":268850,"hashrate_24h":269893,"shares_found":94,"shares_failed":0,"last_share":1781802340,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":16547938,"sidechain_diff":165479381,"tor_cpu_pct":26.51,"tor_mem":"76.3MiB"}
+{"ts":1781802990,"arm":"tor","reward_share":1.547,"avg_effort":110.900,"cur_effort":111.941,"hashrate_1h":264999,"hashrate_24h":269905,"shares_found":94,"shares_failed":0,"last_share":1781802340,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":16743431,"sidechain_diff":167434313,"tor_cpu_pct":29.21,"tor_mem":"77.14MiB"}
+{"ts":1781803291,"arm":"tor","reward_share":1.595,"avg_effort":111.240,"cur_effort":8.640,"hashrate_1h":265715,"hashrate_24h":269696,"shares_found":95,"shares_failed":0,"last_share":1781803227,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":16866690,"sidechain_diff":168666903,"tor_cpu_pct":46.81,"tor_mem":"78.48MiB"}
+{"ts":1781803592,"arm":"tor","reward_share":1.597,"avg_effort":111.240,"cur_effort":52.344,"hashrate_1h":262276,"hashrate_24h":269657,"shares_found":95,"shares_failed":0,"last_share":1781803227,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":16909815,"sidechain_diff":169098157,"tor_cpu_pct":18.93,"tor_mem":"79.53MiB"}
+{"ts":1781803894,"arm":"tor","reward_share":1.540,"avg_effort":111.240,"cur_effort":109.199,"hashrate_1h":267527,"hashrate_24h":269895,"shares_found":95,"shares_failed":0,"last_share":1781803227,"peers_out":10,"peers_in":0,"peer_list":445,"pool_hr":16881235,"sidechain_diff":168812353,"tor_cpu_pct":30.49,"tor_mem":"79.28MiB"}
+{"ts":1781804195,"arm":"tor","reward_share":1.540,"avg_effort":111.240,"cur_effort":153.153,"hashrate_1h":268006,"hashrate_24h":269817,"shares_found":95,"shares_failed":0,"last_share":1781803227,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17042861,"sidechain_diff":170428615,"tor_cpu_pct":36.05,"tor_mem":"78.98MiB"}
+{"ts":1781804496,"arm":"tor","reward_share":1.586,"avg_effort":110.889,"cur_effort":5.764,"hashrate_1h":268069,"hashrate_24h":269601,"shares_found":97,"shares_failed":0,"last_share":1781804470,"peers_out":10,"peers_in":0,"peer_list":449,"pool_hr":17044047,"sidechain_diff":170440471,"tor_cpu_pct":24.75,"tor_mem":"79.15MiB"}
+{"ts":1781804797,"arm":"tor","reward_share":1.588,"avg_effort":110.889,"cur_effort":58.249,"hashrate_1h":268814,"hashrate_24h":269792,"shares_found":97,"shares_failed":0,"last_share":1781804470,"peers_out":10,"peers_in":0,"peer_list":448,"pool_hr":17057238,"sidechain_diff":170572387,"tor_cpu_pct":27.88,"tor_mem":"79.07MiB"}
+{"ts":1781805099,"arm":"tor","reward_share":1.540,"avg_effort":110.889,"cur_effort":106.189,"hashrate_1h":269469,"hashrate_24h":269852,"shares_found":97,"shares_failed":0,"last_share":1781804470,"peers_out":10,"peers_in":0,"peer_list":446,"pool_hr":17295952,"sidechain_diff":172959525,"tor_cpu_pct":33.68,"tor_mem":"78.96MiB"}
+{"ts":1781805400,"arm":"tor","reward_share":1.540,"avg_effort":110.889,"cur_effort":152.265,"hashrate_1h":268228,"hashrate_24h":269740,"shares_found":97,"shares_failed":0,"last_share":1781804470,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":17212154,"sidechain_diff":172121548,"tor_cpu_pct":25.29,"tor_mem":"79.22MiB"}
+{"ts":1781805701,"arm":"tor","reward_share":1.539,"avg_effort":111.509,"cur_effort":30.044,"hashrate_1h":268417,"hashrate_24h":269737,"shares_found":98,"shares_failed":0,"last_share":1781805514,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":17185852,"sidechain_diff":171858520,"tor_cpu_pct":13.7,"tor_mem":"79.3MiB"}
+{"ts":1781806002,"arm":"tor","reward_share":1.540,"avg_effort":111.509,"cur_effort":82.119,"hashrate_1h":271843,"hashrate_24h":269886,"shares_found":98,"shares_failed":0,"last_share":1781805514,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":17336423,"sidechain_diff":173364238,"tor_cpu_pct":24.2,"tor_mem":"79.25MiB"}
+{"ts":1781806304,"arm":"tor","reward_share":1.540,"avg_effort":111.509,"cur_effort":125.162,"hashrate_1h":267307,"hashrate_24h":269779,"shares_found":98,"shares_failed":0,"last_share":1781805514,"peers_out":10,"peers_in":0,"peer_list":436,"pool_hr":17288303,"sidechain_diff":172883037,"tor_cpu_pct":28.87,"tor_mem":"79.08MiB"}
+{"ts":1781806605,"arm":"tor","reward_share":1.492,"avg_effort":111.509,"cur_effort":170.599,"hashrate_1h":268773,"hashrate_24h":269834,"shares_found":98,"shares_failed":0,"last_share":1781805514,"peers_out":10,"peers_in":0,"peer_list":436,"pool_hr":17512693,"sidechain_diff":175126936,"tor_cpu_pct":26.08,"tor_mem":"79.11MiB"}
+{"ts":1781806906,"arm":"tor","reward_share":1.492,"avg_effort":111.509,"cur_effort":224.466,"hashrate_1h":273888,"hashrate_24h":269910,"shares_found":98,"shares_failed":0,"last_share":1781805514,"peers_out":10,"peers_in":0,"peer_list":441,"pool_hr":17245230,"sidechain_diff":172452304,"tor_cpu_pct":26.86,"tor_mem":"79.29MiB"}
+{"ts":1781807207,"arm":"tor","reward_share":1.540,"avg_effort":112.828,"cur_effort":27.556,"hashrate_1h":270370,"hashrate_24h":269737,"shares_found":99,"shares_failed":0,"last_share":1781806981,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":17329431,"sidechain_diff":173294318,"tor_cpu_pct":23.04,"tor_mem":"79.77MiB"}
+{"ts":1781807509,"arm":"tor","reward_share":1.577,"avg_effort":112.407,"cur_effort":3.680,"hashrate_1h":267475,"hashrate_24h":269766,"shares_found":100,"shares_failed":0,"last_share":1781807465,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":17545187,"sidechain_diff":175451877,"tor_cpu_pct":43.03,"tor_mem":"79.43MiB"}
+{"ts":1781807810,"arm":"tor","reward_share":1.672,"avg_effort":110.258,"cur_effort":19.652,"hashrate_1h":265637,"hashrate_24h":269509,"shares_found":102,"shares_failed":0,"last_share":1781807611,"peers_out":10,"peers_in":0,"peer_list":434,"pool_hr":17313864,"sidechain_diff":173138649,"tor_cpu_pct":30.57,"tor_mem":"79.62MiB"}
+{"ts":1781808111,"arm":"tor","reward_share":1.671,"avg_effort":110.258,"cur_effort":68.387,"hashrate_1h":268190,"hashrate_24h":269544,"shares_found":102,"shares_failed":0,"last_share":1781807611,"peers_out":10,"peers_in":0,"peer_list":438,"pool_hr":17353981,"sidechain_diff":173539816,"tor_cpu_pct":32.96,"tor_mem":"79.16MiB"}
+{"ts":1781808412,"arm":"tor","reward_share":1.670,"avg_effort":109.872,"cur_effort":31.464,"hashrate_1h":258820,"hashrate_24h":269302,"shares_found":103,"shares_failed":0,"last_share":1781808161,"peers_out":10,"peers_in":0,"peer_list":441,"pool_hr":17248605,"sidechain_diff":172486058,"tor_cpu_pct":31.43,"tor_mem":"79.27MiB"}
+{"ts":1781808714,"arm":"tor","reward_share":1.635,"avg_effort":109.872,"cur_effort":91.581,"hashrate_1h":266401,"hashrate_24h":269688,"shares_found":103,"shares_failed":0,"last_share":1781808161,"peers_out":10,"peers_in":0,"peer_list":447,"pool_hr":17513078,"sidechain_diff":175130781,"tor_cpu_pct":21.54,"tor_mem":"78.89MiB"}
+{"ts":1781809015,"arm":"tor","reward_share":1.634,"avg_effort":109.872,"cur_effort":145.322,"hashrate_1h":270872,"hashrate_24h":269812,"shares_found":103,"shares_failed":0,"last_share":1781808161,"peers_out":10,"peers_in":0,"peer_list":440,"pool_hr":17328000,"sidechain_diff":173280004,"tor_cpu_pct":18.62,"tor_mem":"79.57MiB"}
+{"ts":1781809316,"arm":"tor","reward_share":1.632,"avg_effort":109.872,"cur_effort":196.480,"hashrate_1h":272287,"hashrate_24h":269904,"shares_found":103,"shares_failed":0,"last_share":1781808161,"peers_out":10,"peers_in":0,"peer_list":437,"pool_hr":17368216,"sidechain_diff":173682163,"tor_cpu_pct":21.09,"tor_mem":"79.77MiB"}
+{"ts":1781809618,"arm":"tor","reward_share":1.678,"avg_effort":110.878,"cur_effort":35.537,"hashrate_1h":271947,"hashrate_24h":270004,"shares_found":104,"shares_failed":0,"last_share":1781809369,"peers_out":10,"peers_in":0,"peer_list":444,"pool_hr":17373356,"sidechain_diff":173733569,"tor_cpu_pct":28.02,"tor_mem":"79.78MiB"}
+{"ts":1781809919,"arm":"tor","reward_share":1.715,"avg_effort":110.188,"cur_effort":49.637,"hashrate_1h":278150,"hashrate_24h":270201,"shares_found":105,"shares_failed":0,"last_share":1781809632,"peers_out":10,"peers_in":0,"peer_list":451,"pool_hr":17275648,"sidechain_diff":172756489,"tor_cpu_pct":23.94,"tor_mem":"79.84MiB"}
+{"ts":1781810220,"arm":"tor","reward_share":1.808,"avg_effort":108.765,"cur_effort":16.938,"hashrate_1h":274366,"hashrate_24h":270066,"shares_found":107,"shares_failed":0,"last_share":1781810110,"peers_out":10,"peers_in":0,"peer_list":453,"pool_hr":17499451,"sidechain_diff":174994517,"tor_cpu_pct":30.82,"tor_mem":"79.9MiB"}
+{"ts":1781810521,"arm":"tor","reward_share":1.762,"avg_effort":108.765,"cur_effort":65.591,"hashrate_1h":274493,"hashrate_24h":270148,"shares_found":107,"shares_failed":0,"last_share":1781810110,"peers_out":10,"peers_in":0,"peer_list":464,"pool_hr":17556903,"sidechain_diff":175569037,"tor_cpu_pct":22.86,"tor_mem":"80.3MiB"}
+{"ts":1781810823,"arm":"tor","reward_share":1.716,"avg_effort":108.765,"cur_effort":108.085,"hashrate_1h":275452,"hashrate_24h":270028,"shares_found":107,"shares_failed":0,"last_share":1781810110,"peers_out":10,"peers_in":0,"peer_list":474,"pool_hr":17586545,"sidechain_diff":175865456,"tor_cpu_pct":31.38,"tor_mem":"80.39MiB"}
+{"ts":1781811124,"arm":"tor","reward_share":1.582,"avg_effort":108.765,"cur_effort":152.157,"hashrate_1h":271996,"hashrate_24h":269939,"shares_found":107,"shares_failed":0,"last_share":1781810110,"peers_out":10,"peers_in":0,"peer_list":469,"pool_hr":17468512,"sidechain_diff":174685126,"tor_cpu_pct":29.01,"tor_mem":"80.6MiB"}
+{"ts":1781883590,"arm":"tor","reward_share":1.632,"avg_effort":600.063,"cur_effort":31.648,"hashrate_1h":284060,"hashrate_24h":284060,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":555,"pool_hr":16978206,"sidechain_diff":169782066,"tor_cpu_pct":17.44,"tor_mem":"95.64MiB"}
+{"ts":1781883891,"arm":"tor","reward_share":1.676,"avg_effort":75.006,"cur_effort":10.605,"hashrate_1h":276240,"hashrate_24h":276240,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":10,"peers_in":0,"peer_list":647,"pool_hr":16876505,"sidechain_diff":168765051,"tor_cpu_pct":100.12,"tor_mem":"96MiB"}
+{"ts":1781884192,"arm":"tor","reward_share":1.676,"avg_effort":75.006,"cur_effort":59.364,"hashrate_1h":276762,"hashrate_24h":276762,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":10,"peers_in":0,"peer_list":686,"pool_hr":17061225,"sidechain_diff":170612256,"tor_cpu_pct":18.28,"tor_mem":"95.86MiB"}
+{"ts":1781884493,"arm":"tor","reward_share":1.676,"avg_effort":75.006,"cur_effort":106.184,"hashrate_1h":277161,"hashrate_24h":277161,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":10,"peers_in":0,"peer_list":735,"pool_hr":17064335,"sidechain_diff":170643356,"tor_cpu_pct":100.1,"tor_mem":"96.98MiB"}
+{"ts":1781884795,"arm":"tor","reward_share":1.675,"avg_effort":75.006,"cur_effort":142.646,"hashrate_1h":263292,"hashrate_24h":263292,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":10,"peers_in":0,"peer_list":769,"pool_hr":17297680,"sidechain_diff":172976802,"tor_cpu_pct":59.3,"tor_mem":"97.85MiB"}
+{"ts":1781885096,"arm":"tor","reward_share":1.673,"avg_effort":75.006,"cur_effort":190.889,"hashrate_1h":262494,"hashrate_24h":262494,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":10,"peers_in":0,"peer_list":809,"pool_hr":17085132,"sidechain_diff":170851328,"tor_cpu_pct":100.28,"tor_mem":"102.8MiB"}
+{"ts":1781885397,"arm":"tor","reward_share":1.671,"avg_effort":75.006,"cur_effort":225.004,"hashrate_1h":254167,"hashrate_24h":254167,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":10,"peers_in":0,"peer_list":842,"pool_hr":17268851,"sidechain_diff":172688519,"tor_cpu_pct":77.33,"tor_mem":"101.9MiB"}
+{"ts":1781885698,"arm":"tor","reward_share":1.627,"avg_effort":75.006,"cur_effort":279.189,"hashrate_1h":262083,"hashrate_24h":262083,"shares_found":1,"shares_failed":0,"last_share":1781883825,"peers_out":11,"peers_in":0,"peer_list":863,"pool_hr":17331279,"sidechain_diff":173312798,"tor_cpu_pct":100.02,"tor_mem":"102.4MiB"}
+{"ts":1781886000,"arm":"tor","reward_share":1.671,"avg_effort":204.949,"cur_effort":2.759,"hashrate_1h":267549,"hashrate_24h":267549,"shares_found":2,"shares_failed":0,"last_share":1781885976,"peers_out":10,"peers_in":0,"peer_list":888,"pool_hr":17191546,"sidechain_diff":171915464,"tor_cpu_pct":45.18,"tor_mem":"101.7MiB"}
+{"ts":1781886301,"arm":"tor","reward_share":1.627,"avg_effort":204.949,"cur_effort":58.608,"hashrate_1h":272682,"hashrate_24h":272682,"shares_found":2,"shares_failed":0,"last_share":1781885976,"peers_out":10,"peers_in":0,"peer_list":898,"pool_hr":17120679,"sidechain_diff":171206798,"tor_cpu_pct":100.1,"tor_mem":"103.1MiB"}
+{"ts":1781886602,"arm":"tor","reward_share":1.582,"avg_effort":204.949,"cur_effort":102.983,"hashrate_1h":271778,"hashrate_24h":271778,"shares_found":2,"shares_failed":0,"last_share":1781885976,"peers_out":10,"peers_in":0,"peer_list":909,"pool_hr":17058077,"sidechain_diff":170580772,"tor_cpu_pct":66.4,"tor_mem":"102.3MiB"}
+{"ts":1781886903,"arm":"tor","reward_share":1.536,"avg_effort":204.949,"cur_effort":147.062,"hashrate_1h":269459,"hashrate_24h":269459,"shares_found":2,"shares_failed":0,"last_share":1781885976,"peers_out":10,"peers_in":0,"peer_list":919,"pool_hr":17018016,"sidechain_diff":170180163,"tor_cpu_pct":99.83,"tor_mem":"103.1MiB"}
+{"ts":1781887205,"arm":"tor","reward_share":1.537,"avg_effort":191.495,"cur_effort":34.070,"hashrate_1h":268995,"hashrate_24h":270192,"shares_found":3,"shares_failed":0,"last_share":1781886992,"peers_out":10,"peers_in":0,"peer_list":678,"pool_hr":17133119,"sidechain_diff":171331194,"tor_cpu_pct":52.01,"tor_mem":"102.6MiB"}
+{"ts":1781887506,"arm":"tor","reward_share":1.493,"avg_effort":191.495,"cur_effort":90.491,"hashrate_1h":274775,"hashrate_24h":274961,"shares_found":3,"shares_failed":0,"last_share":1781886992,"peers_out":10,"peers_in":0,"peer_list":657,"pool_hr":17074518,"sidechain_diff":170745180,"tor_cpu_pct":100.27,"tor_mem":"103.1MiB"}
+{"ts":1781887807,"arm":"tor","reward_share":1.492,"avg_effort":191.495,"cur_effort":132.950,"hashrate_1h":271542,"hashrate_24h":272490,"shares_found":3,"shares_failed":0,"last_share":1781886992,"peers_out":10,"peers_in":0,"peer_list":638,"pool_hr":17190246,"sidechain_diff":171902463,"tor_cpu_pct":33.55,"tor_mem":"104.2MiB"}
+{"ts":1781888108,"arm":"tor","reward_share":1.491,"avg_effort":191.495,"cur_effort":172.077,"hashrate_1h":268848,"hashrate_24h":270042,"shares_found":3,"shares_failed":0,"last_share":1781886992,"peers_out":10,"peers_in":0,"peer_list":624,"pool_hr":17283647,"sidechain_diff":172836477,"tor_cpu_pct":100.29,"tor_mem":"104.1MiB"}
+{"ts":1781888410,"arm":"tor","reward_share":1.490,"avg_effort":191.495,"cur_effort":223.969,"hashrate_1h":273418,"hashrate_24h":270983,"shares_found":3,"shares_failed":0,"last_share":1781886992,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":17263997,"sidechain_diff":172639979,"tor_cpu_pct":50.96,"tor_mem":"103.8MiB"}
+{"ts":1781888711,"arm":"tor","reward_share":1.404,"avg_effort":208.208,"cur_effort":7.837,"hashrate_1h":271979,"hashrate_24h":269255,"shares_found":4,"shares_failed":0,"last_share":1781888653,"peers_out":10,"peers_in":0,"peer_list":612,"pool_hr":17228543,"sidechain_diff":172285430,"tor_cpu_pct":40.35,"tor_mem":"103.7MiB"}
+{"ts":1781889012,"arm":"tor","reward_share":1.448,"avg_effort":172.194,"cur_effort":32.886,"hashrate_1h":280929,"hashrate_24h":271802,"shares_found":5,"shares_failed":0,"last_share":1781888810,"peers_out":10,"peers_in":0,"peer_list":597,"pool_hr":17269537,"sidechain_diff":172695377,"tor_cpu_pct":33.6,"tor_mem":"103.8MiB"}
+{"ts":1781889313,"arm":"tor","reward_share":1.401,"avg_effort":172.194,"cur_effort":78.996,"hashrate_1h":277291,"hashrate_24h":271243,"shares_found":5,"shares_failed":0,"last_share":1781888810,"peers_out":10,"peers_in":0,"peer_list":574,"pool_hr":17209616,"sidechain_diff":172096167,"tor_cpu_pct":38.29,"tor_mem":"103.6MiB"}
+{"ts":1781889615,"arm":"tor","reward_share":1.311,"avg_effort":172.194,"cur_effort":129.894,"hashrate_1h":277186,"hashrate_24h":272940,"shares_found":5,"shares_failed":0,"last_share":1781888810,"peers_out":10,"peers_in":0,"peer_list":571,"pool_hr":17466307,"sidechain_diff":174663078,"tor_cpu_pct":32.88,"tor_mem":"103.9MiB"}
+{"ts":1781889916,"arm":"tor","reward_share":1.311,"avg_effort":172.194,"cur_effort":178.280,"hashrate_1h":273155,"hashrate_24h":272776,"shares_found":5,"shares_failed":0,"last_share":1781888810,"peers_out":10,"peers_in":0,"peer_list":575,"pool_hr":17248385,"sidechain_diff":172483850,"tor_cpu_pct":30.61,"tor_mem":"103.5MiB"}
+{"ts":1781890217,"arm":"tor","reward_share":1.266,"avg_effort":172.194,"cur_effort":212.433,"hashrate_1h":268242,"hashrate_24h":269532,"shares_found":5,"shares_failed":0,"last_share":1781888810,"peers_out":10,"peers_in":0,"peer_list":570,"pool_hr":17280936,"sidechain_diff":172809367,"tor_cpu_pct":35.3,"tor_mem":"103.5MiB"}
+{"ts":1781890518,"arm":"tor","reward_share":1.265,"avg_effort":172.194,"cur_effort":269.437,"hashrate_1h":274849,"hashrate_24h":271863,"shares_found":5,"shares_failed":0,"last_share":1781888810,"peers_out":10,"peers_in":0,"peer_list":571,"pool_hr":17389103,"sidechain_diff":173891031,"tor_cpu_pct":41.74,"tor_mem":"103.1MiB"}
+{"ts":1781890820,"arm":"tor","reward_share":1.312,"avg_effort":190.483,"cur_effort":37.462,"hashrate_1h":273395,"hashrate_24h":271498,"shares_found":6,"shares_failed":0,"last_share":1781890601,"peers_out":10,"peers_in":0,"peer_list":572,"pool_hr":17238469,"sidechain_diff":172384699,"tor_cpu_pct":30.83,"tor_mem":"103.1MiB"}
+{"ts":1781891121,"arm":"tor","reward_share":1.356,"avg_effort":171.030,"cur_effort":21.978,"hashrate_1h":265640,"hashrate_24h":270127,"shares_found":7,"shares_failed":0,"last_share":1781890957,"peers_out":10,"peers_in":0,"peer_list":572,"pool_hr":17231813,"sidechain_diff":172318134,"tor_cpu_pct":24.54,"tor_mem":"102.9MiB"}
+{"ts":1781891422,"arm":"tor","reward_share":1.356,"avg_effort":171.030,"cur_effort":65.084,"hashrate_1h":265542,"hashrate_24h":269234,"shares_found":7,"shares_failed":0,"last_share":1781890957,"peers_out":10,"peers_in":0,"peer_list":570,"pool_hr":17324904,"sidechain_diff":173249048,"tor_cpu_pct":3.45,"tor_mem":"102.8MiB"}
+{"ts":1781891723,"arm":"tor","reward_share":1.401,"avg_effort":162.766,"cur_effort":18.096,"hashrate_1h":273739,"hashrate_24h":271732,"shares_found":8,"shares_failed":0,"last_share":1781891605,"peers_out":10,"peers_in":0,"peer_list":568,"pool_hr":17236047,"sidechain_diff":172360479,"tor_cpu_pct":22.4,"tor_mem":"102.9MiB"}
+{"ts":1781892025,"arm":"tor","reward_share":1.356,"avg_effort":162.766,"cur_effort":65.842,"hashrate_1h":273205,"hashrate_24h":271846,"shares_found":8,"shares_failed":0,"last_share":1781891605,"peers_out":10,"peers_in":0,"peer_list":568,"pool_hr":17242434,"sidechain_diff":172424344,"tor_cpu_pct":30.2,"tor_mem":"102.8MiB"}
+{"ts":1781892326,"arm":"tor","reward_share":1.401,"avg_effort":155.987,"cur_effort":12.604,"hashrate_1h":276407,"hashrate_24h":271874,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":569,"pool_hr":17213009,"sidechain_diff":172130092,"tor_cpu_pct":23.37,"tor_mem":"101.9MiB"}
+{"ts":1781892627,"arm":"tor","reward_share":1.357,"avg_effort":155.987,"cur_effort":52.447,"hashrate_1h":268392,"hashrate_24h":270633,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":565,"pool_hr":17239926,"sidechain_diff":172399263,"tor_cpu_pct":23.9,"tor_mem":"101.5MiB"}
+{"ts":1781892928,"arm":"tor","reward_share":1.312,"avg_effort":155.987,"cur_effort":99.680,"hashrate_1h":270356,"hashrate_24h":270737,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":570,"pool_hr":17277545,"sidechain_diff":172775452,"tor_cpu_pct":21.09,"tor_mem":"100.8MiB"}
+{"ts":1781893230,"arm":"tor","reward_share":1.311,"avg_effort":155.987,"cur_effort":146.763,"hashrate_1h":264466,"hashrate_24h":270129,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":571,"pool_hr":17096883,"sidechain_diff":170968830,"tor_cpu_pct":29.01,"tor_mem":"100.8MiB"}
+{"ts":1781893531,"arm":"tor","reward_share":1.266,"avg_effort":155.987,"cur_effort":184.583,"hashrate_1h":261952,"hashrate_24h":268787,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":576,"pool_hr":17147969,"sidechain_diff":171479694,"tor_cpu_pct":29.2,"tor_mem":"98.74MiB"}
+{"ts":1781893832,"arm":"tor","reward_share":1.266,"avg_effort":155.987,"cur_effort":229.394,"hashrate_1h":266426,"hashrate_24h":268141,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":17031770,"sidechain_diff":170317706,"tor_cpu_pct":21.46,"tor_mem":"98.69MiB"}
+{"ts":1781894133,"arm":"tor","reward_share":1.266,"avg_effort":155.987,"cur_effort":277.745,"hashrate_1h":262538,"hashrate_24h":268654,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":607,"pool_hr":17231287,"sidechain_diff":172312874,"tor_cpu_pct":40.31,"tor_mem":"98.98MiB"}
+{"ts":1781894435,"arm":"tor","reward_share":1.220,"avg_effort":155.987,"cur_effort":324.637,"hashrate_1h":261868,"hashrate_24h":268218,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":17115989,"sidechain_diff":171159892,"tor_cpu_pct":32.27,"tor_mem":"98.76MiB"}
+{"ts":1781894736,"arm":"tor","reward_share":1.129,"avg_effort":155.987,"cur_effort":377.380,"hashrate_1h":267246,"hashrate_24h":269184,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":611,"pool_hr":17131659,"sidechain_diff":171316596,"tor_cpu_pct":19.3,"tor_mem":"98.92MiB"}
+{"ts":1781895037,"arm":"tor","reward_share":1.084,"avg_effort":155.987,"cur_effort":418.569,"hashrate_1h":266486,"hashrate_24h":268489,"shares_found":9,"shares_failed":0,"last_share":1781892221,"peers_out":10,"peers_in":0,"peer_list":611,"pool_hr":17165090,"sidechain_diff":171650908,"tor_cpu_pct":26.99,"tor_mem":"98.8MiB"}
+{"ts":1781895338,"arm":"tor","reward_share":1.040,"avg_effort":183.462,"cur_effort":31.281,"hashrate_1h":262471,"hashrate_24h":268762,"shares_found":10,"shares_failed":0,"last_share":1781895105,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":17465050,"sidechain_diff":174650501,"tor_cpu_pct":22.24,"tor_mem":"99.7MiB"}
+{"ts":1781895640,"arm":"tor","reward_share":1.040,"avg_effort":183.462,"cur_effort":81.797,"hashrate_1h":263941,"hashrate_24h":269370,"shares_found":10,"shares_failed":0,"last_share":1781895105,"peers_out":10,"peers_in":0,"peer_list":600,"pool_hr":17382615,"sidechain_diff":173826157,"tor_cpu_pct":20.7,"tor_mem":"98.35MiB"}
+{"ts":1781895941,"arm":"tor","reward_share":0.993,"avg_effort":183.462,"cur_effort":132.281,"hashrate_1h":264261,"hashrate_24h":269890,"shares_found":10,"shares_failed":0,"last_share":1781895105,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":17449191,"sidechain_diff":174491913,"tor_cpu_pct":11.71,"tor_mem":"97.95MiB"}
+{"ts":1781896242,"arm":"tor","reward_share":0.994,"avg_effort":181.202,"cur_effort":19.151,"hashrate_1h":267752,"hashrate_24h":270127,"shares_found":11,"shares_failed":0,"last_share":1781896081,"peers_out":10,"peers_in":0,"peer_list":578,"pool_hr":17545985,"sidechain_diff":175459851,"tor_cpu_pct":27.44,"tor_mem":"97.38MiB"}
+{"ts":1781896543,"arm":"tor","reward_share":0.903,"avg_effort":181.202,"cur_effort":63.030,"hashrate_1h":269615,"hashrate_24h":270438,"shares_found":11,"shares_failed":0,"last_share":1781896081,"peers_out":10,"peers_in":0,"peer_list":560,"pool_hr":18483718,"sidechain_diff":184837186,"tor_cpu_pct":23.82,"tor_mem":"97.07MiB"}
+{"ts":1781896845,"arm":"tor","reward_share":0.901,"avg_effort":181.202,"cur_effort":110.200,"hashrate_1h":271450,"hashrate_24h":270344,"shares_found":11,"shares_failed":0,"last_share":1781896081,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":18006174,"sidechain_diff":180061741,"tor_cpu_pct":21.01,"tor_mem":"96.75MiB"}
+{"ts":1781897146,"arm":"tor","reward_share":0.854,"avg_effort":181.202,"cur_effort":149.799,"hashrate_1h":272267,"hashrate_24h":269642,"shares_found":11,"shares_failed":0,"last_share":1781896081,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":17969763,"sidechain_diff":179697636,"tor_cpu_pct":19.79,"tor_mem":"96.43MiB"}
+{"ts":1781897447,"arm":"tor","reward_share":0.853,"avg_effort":181.202,"cur_effort":201.116,"hashrate_1h":276611,"hashrate_24h":270438,"shares_found":11,"shares_failed":0,"last_share":1781896081,"peers_out":10,"peers_in":0,"peer_list":524,"pool_hr":18025663,"sidechain_diff":180256634,"tor_cpu_pct":22.51,"tor_mem":"96.27MiB"}
+{"ts":1781897748,"arm":"tor","reward_share":0.809,"avg_effort":181.202,"cur_effort":238.598,"hashrate_1h":275326,"hashrate_24h":270620,"shares_found":11,"shares_failed":0,"last_share":1781896081,"peers_out":10,"peers_in":0,"peer_list":520,"pool_hr":18846248,"sidechain_diff":188462484,"tor_cpu_pct":21.14,"tor_mem":"96.36MiB"}
+{"ts":1781898050,"arm":"tor","reward_share":0.856,"avg_effort":187.833,"cur_effort":34.939,"hashrate_1h":280878,"hashrate_24h":271143,"shares_found":12,"shares_failed":0,"last_share":1781897831,"peers_out":10,"peers_in":0,"peer_list":524,"pool_hr":18764242,"sidechain_diff":187642423,"tor_cpu_pct":14.51,"tor_mem":"96.02MiB"}
+{"ts":1781898351,"arm":"tor","reward_share":0.901,"avg_effort":177.334,"cur_effort":14.795,"hashrate_1h":275393,"hashrate_24h":270575,"shares_found":13,"shares_failed":0,"last_share":1781898197,"peers_out":10,"peers_in":0,"peer_list":527,"pool_hr":18410799,"sidechain_diff":184107993,"tor_cpu_pct":19.4,"tor_mem":"97.34MiB"}
+{"ts":1781898652,"arm":"tor","reward_share":0.948,"avg_effort":165.752,"cur_effort":41.146,"hashrate_1h":279671,"hashrate_24h":271275,"shares_found":14,"shares_failed":0,"last_share":1781898392,"peers_out":10,"peers_in":0,"peer_list":525,"pool_hr":18604362,"sidechain_diff":186043629,"tor_cpu_pct":15.41,"tor_mem":"97.47MiB"}
+{"ts":1781898953,"arm":"tor","reward_share":0.946,"avg_effort":165.752,"cur_effort":88.551,"hashrate_1h":282238,"hashrate_24h":271998,"shares_found":14,"shares_failed":0,"last_share":1781898392,"peers_out":10,"peers_in":0,"peer_list":524,"pool_hr":19341784,"sidechain_diff":193417844,"tor_cpu_pct":24.33,"tor_mem":"97.46MiB"}
+{"ts":1781899255,"arm":"tor","reward_share":0.900,"avg_effort":165.752,"cur_effort":130.246,"hashrate_1h":280171,"hashrate_24h":271736,"shares_found":14,"shares_failed":0,"last_share":1781898392,"peers_out":10,"peers_in":0,"peer_list":521,"pool_hr":19151498,"sidechain_diff":191514987,"tor_cpu_pct":13.2,"tor_mem":"96.5MiB"}
+{"ts":1781899556,"arm":"tor","reward_share":0.946,"avg_effort":163.909,"cur_effort":31.751,"hashrate_1h":278531,"hashrate_24h":271760,"shares_found":15,"shares_failed":0,"last_share":1781899351,"peers_out":10,"peers_in":0,"peer_list":520,"pool_hr":19084721,"sidechain_diff":190847215,"tor_cpu_pct":7.1,"tor_mem":"96.39MiB"}
+{"ts":1781899857,"arm":"tor","reward_share":0.943,"avg_effort":163.909,"cur_effort":75.536,"hashrate_1h":276795,"hashrate_24h":271910,"shares_found":15,"shares_failed":0,"last_share":1781899351,"peers_out":10,"peers_in":0,"peer_list":517,"pool_hr":19066478,"sidechain_diff":190664789,"tor_cpu_pct":3.13,"tor_mem":"95.83MiB"}
+{"ts":1781900158,"arm":"tor","reward_share":0.897,"avg_effort":163.909,"cur_effort":123.787,"hashrate_1h":279641,"hashrate_24h":272280,"shares_found":15,"shares_failed":0,"last_share":1781899351,"peers_out":10,"peers_in":0,"peer_list":514,"pool_hr":19036738,"sidechain_diff":190367389,"tor_cpu_pct":4.56,"tor_mem":"95.73MiB"}
+{"ts":1781900460,"arm":"tor","reward_share":0.851,"avg_effort":163.909,"cur_effort":163.266,"hashrate_1h":280002,"hashrate_24h":272431,"shares_found":15,"shares_failed":0,"last_share":1781899351,"peers_out":10,"peers_in":0,"peer_list":530,"pool_hr":19598717,"sidechain_diff":195987174,"tor_cpu_pct":16.88,"tor_mem":"95.79MiB"}
+{"ts":1781900761,"arm":"tor","reward_share":0.767,"avg_effort":164.910,"cur_effort":23.351,"hashrate_1h":281795,"hashrate_24h":272138,"shares_found":16,"shares_failed":0,"last_share":1781900516,"peers_out":11,"peers_in":0,"peer_list":537,"pool_hr":20556290,"sidechain_diff":205562903,"tor_cpu_pct":0.96,"tor_mem":"95.66MiB"}
+{"ts":1781901062,"arm":"tor","reward_share":0.817,"avg_effort":155.801,"cur_effort":38.417,"hashrate_1h":280602,"hashrate_24h":272275,"shares_found":17,"shares_failed":0,"last_share":1781900807,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":20219423,"sidechain_diff":202194233,"tor_cpu_pct":2.81,"tor_mem":"95.31MiB"}
+{"ts":1781901363,"arm":"tor","reward_share":0.814,"avg_effort":155.801,"cur_effort":79.507,"hashrate_1h":280165,"hashrate_24h":272484,"shares_found":17,"shares_failed":0,"last_share":1781900807,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":20103959,"sidechain_diff":201039592,"tor_cpu_pct":19.99,"tor_mem":"95.07MiB"}
+{"ts":1781901665,"arm":"tor","reward_share":0.863,"avg_effort":151.848,"cur_effort":27.617,"hashrate_1h":277708,"hashrate_24h":272391,"shares_found":18,"shares_failed":0,"last_share":1781901441,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":20191076,"sidechain_diff":201910762,"tor_cpu_pct":13.66,"tor_mem":"95.2MiB"}
+{"ts":1781901966,"arm":"tor","reward_share":0.913,"avg_effort":146.707,"cur_effort":1.167,"hashrate_1h":278534,"hashrate_24h":272161,"shares_found":19,"shares_failed":0,"last_share":1781901951,"peers_out":11,"peers_in":0,"peer_list":543,"pool_hr":20419728,"sidechain_diff":204197280,"tor_cpu_pct":16.09,"tor_mem":"102.6MiB"}
+{"ts":1781902267,"arm":"tor","reward_share":0.959,"avg_effort":126.663,"cur_effort":3.344,"hashrate_1h":278860,"hashrate_24h":272711,"shares_found":22,"shares_failed":0,"last_share":1781902241,"peers_out":11,"peers_in":0,"peer_list":540,"pool_hr":20782508,"sidechain_diff":207825086,"tor_cpu_pct":28.5,"tor_mem":"96.57MiB"}
+{"ts":1781902568,"arm":"tor","reward_share":0.958,"avg_effort":126.663,"cur_effort":48.453,"hashrate_1h":278506,"hashrate_24h":273249,"shares_found":22,"shares_failed":0,"last_share":1781902241,"peers_out":11,"peers_in":0,"peer_list":543,"pool_hr":20563316,"sidechain_diff":205633168,"tor_cpu_pct":19.09,"tor_mem":"96.15MiB"}
+{"ts":1781902870,"arm":"tor","reward_share":1.006,"avg_effort":123.716,"cur_effort":22.470,"hashrate_1h":280406,"hashrate_24h":273321,"shares_found":23,"shares_failed":0,"last_share":1781902682,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":21087061,"sidechain_diff":210870617,"tor_cpu_pct":34.94,"tor_mem":"96.78MiB"}
+{"ts":1781903171,"arm":"tor","reward_share":0.961,"avg_effort":123.716,"cur_effort":72.338,"hashrate_1h":286611,"hashrate_24h":274603,"shares_found":23,"shares_failed":0,"last_share":1781902682,"peers_out":11,"peers_in":0,"peer_list":553,"pool_hr":21435636,"sidechain_diff":214356364,"tor_cpu_pct":19.58,"tor_mem":"96.79MiB"}
+{"ts":1781903472,"arm":"tor","reward_share":0.957,"avg_effort":123.716,"cur_effort":108.971,"hashrate_1h":285637,"hashrate_24h":274453,"shares_found":23,"shares_failed":0,"last_share":1781902682,"peers_out":11,"peers_in":0,"peer_list":551,"pool_hr":21462987,"sidechain_diff":214629873,"tor_cpu_pct":15.35,"tor_mem":"97MiB"}
+{"ts":1781903773,"arm":"tor","reward_share":1.007,"avg_effort":123.092,"cur_effort":45.516,"hashrate_1h":288384,"hashrate_24h":275334,"shares_found":24,"shares_failed":0,"last_share":1781903482,"peers_out":11,"peers_in":0,"peer_list":550,"pool_hr":21249314,"sidechain_diff":212493149,"tor_cpu_pct":21.72,"tor_mem":"97.14MiB"}
+{"ts":1781904075,"arm":"tor","reward_share":1.004,"avg_effort":123.092,"cur_effort":75.259,"hashrate_1h":284790,"hashrate_24h":274541,"shares_found":24,"shares_failed":0,"last_share":1781903482,"peers_out":11,"peers_in":0,"peer_list":541,"pool_hr":21340783,"sidechain_diff":213407838,"tor_cpu_pct":27.49,"tor_mem":"97.37MiB"}
+{"ts":1781904376,"arm":"tor","reward_share":1.001,"avg_effort":123.092,"cur_effort":116.525,"hashrate_1h":288826,"hashrate_24h":274795,"shares_found":24,"shares_failed":0,"last_share":1781903482,"peers_out":11,"peers_in":0,"peer_list":544,"pool_hr":21642493,"sidechain_diff":216424938,"tor_cpu_pct":2.45,"tor_mem":"98.28MiB"}
+{"ts":1781904677,"arm":"tor","reward_share":1.092,"avg_effort":118.070,"cur_effort":23.585,"hashrate_1h":288340,"hashrate_24h":275117,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":547,"pool_hr":21691421,"sidechain_diff":216914219,"tor_cpu_pct":18.4,"tor_mem":"98.23MiB"}
+{"ts":1781904978,"arm":"tor","reward_share":1.089,"avg_effort":118.070,"cur_effort":70.272,"hashrate_1h":293009,"hashrate_24h":275877,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":21833922,"sidechain_diff":218339228,"tor_cpu_pct":56.19,"tor_mem":"98.37MiB"}
+{"ts":1781905280,"arm":"tor","reward_share":1.085,"avg_effort":118.070,"cur_effort":100.319,"hashrate_1h":289338,"hashrate_24h":275336,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":22330339,"sidechain_diff":223303398,"tor_cpu_pct":67.97,"tor_mem":"103.9MiB"}
+{"ts":1781905581,"arm":"tor","reward_share":1.040,"avg_effort":118.070,"cur_effort":141.098,"hashrate_1h":293432,"hashrate_24h":275592,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":22103558,"sidechain_diff":221035589,"tor_cpu_pct":66.8,"tor_mem":"108.8MiB"}
+{"ts":1781905882,"arm":"tor","reward_share":1.037,"avg_effort":118.070,"cur_effort":167.861,"hashrate_1h":284245,"hashrate_24h":274623,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":22197055,"sidechain_diff":221970552,"tor_cpu_pct":100.09,"tor_mem":"109.4MiB"}
+{"ts":1781906183,"arm":"tor","reward_share":1.031,"avg_effort":118.070,"cur_effort":203.894,"hashrate_1h":282171,"hashrate_24h":274619,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":22418982,"sidechain_diff":224189820,"tor_cpu_pct":53.32,"tor_mem":"108MiB"}
+{"ts":1781906485,"arm":"tor","reward_share":0.984,"avg_effort":118.070,"cur_effort":243.175,"hashrate_1h":282458,"hashrate_24h":274745,"shares_found":26,"shares_failed":0,"last_share":1781904469,"peers_out":11,"peers_in":0,"peer_list":544,"pool_hr":22237294,"sidechain_diff":222372941,"tor_cpu_pct":63.27,"tor_mem":"108.3MiB"}
+{"ts":1781906786,"arm":"tor","reward_share":1.042,"avg_effort":125.101,"cur_effort":0.000,"hashrate_1h":275390,"hashrate_24h":274802,"shares_found":27,"shares_failed":0,"last_share":1781906776,"peers_out":11,"peers_in":0,"peer_list":540,"pool_hr":22356976,"sidechain_diff":223569767,"tor_cpu_pct":44.48,"tor_mem":"108.4MiB"}
+{"ts":1781907087,"arm":"tor","reward_share":1.038,"avg_effort":125.101,"cur_effort":37.991,"hashrate_1h":276230,"hashrate_24h":274816,"shares_found":27,"shares_failed":0,"last_share":1781906776,"peers_out":11,"peers_in":0,"peer_list":540,"pool_hr":22509007,"sidechain_diff":225090073,"tor_cpu_pct":44.35,"tor_mem":"108.4MiB"}
+{"ts":1781907388,"arm":"tor","reward_share":1.034,"avg_effort":125.101,"cur_effort":68.707,"hashrate_1h":269434,"hashrate_24h":274303,"shares_found":27,"shares_failed":0,"last_share":1781906776,"peers_out":11,"peers_in":0,"peer_list":540,"pool_hr":22693969,"sidechain_diff":226939692,"tor_cpu_pct":41.59,"tor_mem":"108.6MiB"}
+{"ts":1781907690,"arm":"tor","reward_share":1.031,"avg_effort":125.101,"cur_effort":104.634,"hashrate_1h":273610,"hashrate_24h":274417,"shares_found":27,"shares_failed":0,"last_share":1781906776,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":22926739,"sidechain_diff":229267394,"tor_cpu_pct":19.17,"tor_mem":"109MiB"}
+{"ts":1781907991,"arm":"tor","reward_share":1.040,"avg_effort":125.332,"cur_effort":4.983,"hashrate_1h":268440,"hashrate_24h":273815,"shares_found":28,"shares_failed":0,"last_share":1781907947,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":22833795,"sidechain_diff":228337954,"tor_cpu_pct":24.05,"tor_mem":"108.8MiB"}
+{"ts":1781908292,"arm":"tor","reward_share":1.050,"avg_effort":120.961,"cur_effort":16.023,"hashrate_1h":262719,"hashrate_24h":273367,"shares_found":29,"shares_failed":0,"last_share":1781908137,"peers_out":11,"peers_in":0,"peer_list":538,"pool_hr":23747402,"sidechain_diff":237474021,"tor_cpu_pct":34.88,"tor_mem":"108.9MiB"}
+{"ts":1781908593,"arm":"tor","reward_share":1.047,"avg_effort":120.961,"cur_effort":47.892,"hashrate_1h":256526,"hashrate_24h":273055,"shares_found":29,"shares_failed":0,"last_share":1781908137,"peers_out":11,"peers_in":0,"peer_list":541,"pool_hr":23606521,"sidechain_diff":236065212,"tor_cpu_pct":30.67,"tor_mem":"109.1MiB"}
+{"ts":1781908895,"arm":"tor","reward_share":1.095,"avg_effort":119.034,"cur_effort":4.959,"hashrate_1h":254826,"hashrate_24h":272574,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":543,"pool_hr":23578646,"sidechain_diff":235786463,"tor_cpu_pct":30.26,"tor_mem":"108.9MiB"}
+{"ts":1781909196,"arm":"tor","reward_share":1.090,"avg_effort":119.034,"cur_effort":35.259,"hashrate_1h":251178,"hashrate_24h":272105,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":543,"pool_hr":23840799,"sidechain_diff":238407997,"tor_cpu_pct":28.09,"tor_mem":"109.3MiB"}
+{"ts":1781909497,"arm":"tor","reward_share":1.085,"avg_effort":119.034,"cur_effort":71.349,"hashrate_1h":255740,"hashrate_24h":272371,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":547,"pool_hr":24160559,"sidechain_diff":241605592,"tor_cpu_pct":22.08,"tor_mem":"109.1MiB"}
+{"ts":1781909798,"arm":"tor","reward_share":1.040,"avg_effort":119.034,"cur_effort":102.722,"hashrate_1h":254968,"hashrate_24h":272057,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":23898111,"sidechain_diff":238981117,"tor_cpu_pct":30.63,"tor_mem":"108.8MiB"}
+{"ts":1781910100,"arm":"tor","reward_share":0.996,"avg_effort":119.034,"cur_effort":145.339,"hashrate_1h":259330,"hashrate_24h":272877,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":550,"pool_hr":23755708,"sidechain_diff":237557084,"tor_cpu_pct":37.68,"tor_mem":"108.8MiB"}
+{"ts":1781910401,"arm":"tor","reward_share":0.990,"avg_effort":119.034,"cur_effort":183.227,"hashrate_1h":262467,"hashrate_24h":273030,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":550,"pool_hr":23663009,"sidechain_diff":236630093,"tor_cpu_pct":28.98,"tor_mem":"108.5MiB"}
+{"ts":1781910702,"arm":"tor","reward_share":0.947,"avg_effort":119.034,"cur_effort":209.537,"hashrate_1h":257351,"hashrate_24h":272470,"shares_found":30,"shares_failed":0,"last_share":1781908841,"peers_out":11,"peers_in":0,"peer_list":547,"pool_hr":24032515,"sidechain_diff":240325159,"tor_cpu_pct":23.38,"tor_mem":"108.7MiB"}
+{"ts":1781911003,"arm":"tor","reward_share":0.997,"avg_effort":123.346,"cur_effort":19.124,"hashrate_1h":262080,"hashrate_24h":272707,"shares_found":31,"shares_failed":0,"last_share":1781910874,"peers_out":11,"peers_in":0,"peer_list":540,"pool_hr":23887056,"sidechain_diff":238870562,"tor_cpu_pct":43.46,"tor_mem":"108.8MiB"}
+{"ts":1781911305,"arm":"tor","reward_share":0.954,"avg_effort":123.346,"cur_effort":53.026,"hashrate_1h":261874,"hashrate_24h":272804,"shares_found":31,"shares_failed":0,"last_share":1781910874,"peers_out":11,"peers_in":0,"peer_list":538,"pool_hr":24242463,"sidechain_diff":242424635,"tor_cpu_pct":30.42,"tor_mem":"108.9MiB"}
+{"ts":1781911606,"arm":"tor","reward_share":0.951,"avg_effort":123.346,"cur_effort":82.912,"hashrate_1h":262539,"hashrate_24h":272377,"shares_found":31,"shares_failed":0,"last_share":1781910874,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":23834064,"sidechain_diff":238340647,"tor_cpu_pct":25,"tor_mem":"108.6MiB"}
+{"ts":1781911907,"arm":"tor","reward_share":0.948,"avg_effort":123.346,"cur_effort":115.508,"hashrate_1h":263543,"hashrate_24h":272040,"shares_found":31,"shares_failed":0,"last_share":1781910874,"peers_out":11,"peers_in":0,"peer_list":539,"pool_hr":23839139,"sidechain_diff":238391396,"tor_cpu_pct":35.66,"tor_mem":"108.8MiB"}
+{"ts":1781912208,"arm":"tor","reward_share":0.945,"avg_effort":123.346,"cur_effort":145.566,"hashrate_1h":264372,"hashrate_24h":271971,"shares_found":31,"shares_failed":0,"last_share":1781910874,"peers_out":11,"peers_in":0,"peer_list":536,"pool_hr":23984102,"sidechain_diff":239841021,"tor_cpu_pct":28.47,"tor_mem":"109MiB"}
+{"ts":1781912510,"arm":"tor","reward_share":0.983,"avg_effort":125.097,"cur_effort":10.753,"hashrate_1h":267658,"hashrate_24h":271968,"shares_found":32,"shares_failed":0,"last_share":1781912380,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":23984962,"sidechain_diff":239849624,"tor_cpu_pct":26.34,"tor_mem":"107.4MiB"}
+{"ts":1781912811,"arm":"tor","reward_share":0.978,"avg_effort":125.097,"cur_effort":46.520,"hashrate_1h":271295,"hashrate_24h":272073,"shares_found":32,"shares_failed":0,"last_share":1781912380,"peers_out":11,"peers_in":0,"peer_list":544,"pool_hr":24341636,"sidechain_diff":243416367,"tor_cpu_pct":32.09,"tor_mem":"107.5MiB"}
+{"ts":1781913112,"arm":"tor","reward_share":0.973,"avg_effort":125.097,"cur_effort":81.714,"hashrate_1h":271051,"hashrate_24h":272142,"shares_found":32,"shares_failed":0,"last_share":1781912380,"peers_out":11,"peers_in":0,"peer_list":541,"pool_hr":24158105,"sidechain_diff":241581055,"tor_cpu_pct":22.11,"tor_mem":"107.4MiB"}
+{"ts":1781913413,"arm":"tor","reward_share":0.969,"avg_effort":125.097,"cur_effort":111.622,"hashrate_1h":269165,"hashrate_24h":271831,"shares_found":32,"shares_failed":0,"last_share":1781912380,"peers_out":11,"peers_in":0,"peer_list":544,"pool_hr":24282818,"sidechain_diff":242828184,"tor_cpu_pct":26.59,"tor_mem":"107.1MiB"}
+{"ts":1781913715,"arm":"tor","reward_share":1.017,"avg_effort":125.316,"cur_effort":14.043,"hashrate_1h":261898,"hashrate_24h":271810,"shares_found":33,"shares_failed":0,"last_share":1781913582,"peers_out":11,"peers_in":0,"peer_list":547,"pool_hr":24317746,"sidechain_diff":243177469,"tor_cpu_pct":24.23,"tor_mem":"107.6MiB"}
+{"ts":1781914016,"arm":"tor","reward_share":1.011,"avg_effort":125.316,"cur_effort":53.675,"hashrate_1h":267484,"hashrate_24h":272341,"shares_found":33,"shares_failed":0,"last_share":1781913582,"peers_out":11,"peers_in":0,"peer_list":546,"pool_hr":24422591,"sidechain_diff":244225910,"tor_cpu_pct":20.51,"tor_mem":"107.5MiB"}
+{"ts":1781914317,"arm":"tor","reward_share":1.005,"avg_effort":125.316,"cur_effort":86.834,"hashrate_1h":270236,"hashrate_24h":272212,"shares_found":33,"shares_failed":0,"last_share":1781913582,"peers_out":11,"peers_in":0,"peer_list":539,"pool_hr":24170514,"sidechain_diff":241705140,"tor_cpu_pct":13.87,"tor_mem":"107.7MiB"}
+{"ts":1781914618,"arm":"tor","reward_share":1.002,"avg_effort":125.316,"cur_effort":115.508,"hashrate_1h":262767,"hashrate_24h":271723,"shares_found":33,"shares_failed":0,"last_share":1781913582,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":24055884,"sidechain_diff":240558845,"tor_cpu_pct":39.79,"tor_mem":"107.5MiB"}
+{"ts":1781914920,"arm":"tor","reward_share":0.999,"avg_effort":125.316,"cur_effort":146.394,"hashrate_1h":260990,"hashrate_24h":271417,"shares_found":33,"shares_failed":0,"last_share":1781913582,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":23891868,"sidechain_diff":238918681,"tor_cpu_pct":31.01,"tor_mem":"107.5MiB"}
+{"ts":1781915221,"arm":"tor","reward_share":1.009,"avg_effort":126.958,"cur_effort":1.679,"hashrate_1h":262295,"hashrate_24h":271120,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":541,"pool_hr":24153458,"sidechain_diff":241534580,"tor_cpu_pct":23.1,"tor_mem":"107.5MiB"}
+{"ts":1781915522,"arm":"tor","reward_share":1.005,"avg_effort":126.958,"cur_effort":32.755,"hashrate_1h":262166,"hashrate_24h":270893,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":24252628,"sidechain_diff":242526284,"tor_cpu_pct":33.18,"tor_mem":"107.7MiB"}
+{"ts":1781915823,"arm":"tor","reward_share":1.002,"avg_effort":126.958,"cur_effort":67.768,"hashrate_1h":264505,"hashrate_24h":271131,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":541,"pool_hr":24297216,"sidechain_diff":242972165,"tor_cpu_pct":24.63,"tor_mem":"107.8MiB"}
+{"ts":1781916125,"arm":"tor","reward_share":0.997,"avg_effort":126.958,"cur_effort":100.991,"hashrate_1h":261939,"hashrate_24h":270883,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":540,"pool_hr":23975748,"sidechain_diff":239757481,"tor_cpu_pct":24.83,"tor_mem":"107.2MiB"}
+{"ts":1781916426,"arm":"tor","reward_share":0.958,"avg_effort":126.958,"cur_effort":136.243,"hashrate_1h":261632,"hashrate_24h":270984,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":539,"pool_hr":23997367,"sidechain_diff":239973678,"tor_cpu_pct":29.69,"tor_mem":"107.1MiB"}
+{"ts":1781916727,"arm":"tor","reward_share":0.955,"avg_effort":126.958,"cur_effort":165.072,"hashrate_1h":257834,"hashrate_24h":270618,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":535,"pool_hr":24137556,"sidechain_diff":241375567,"tor_cpu_pct":20.74,"tor_mem":"107.3MiB"}
+{"ts":1781917028,"arm":"tor","reward_share":0.952,"avg_effort":126.958,"cur_effort":201.786,"hashrate_1h":261070,"hashrate_24h":270723,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":536,"pool_hr":23964436,"sidechain_diff":239644360,"tor_cpu_pct":25.73,"tor_mem":"107.2MiB"}
+{"ts":1781917330,"arm":"tor","reward_share":0.949,"avg_effort":126.958,"cur_effort":232.199,"hashrate_1h":261952,"hashrate_24h":270764,"shares_found":34,"shares_failed":0,"last_share":1781915176,"peers_out":11,"peers_in":0,"peer_list":535,"pool_hr":24201154,"sidechain_diff":242011541,"tor_cpu_pct":28.85,"tor_mem":"107.4MiB"}
+{"ts":1781917631,"arm":"tor","reward_share":0.994,"avg_effort":131.193,"cur_effort":20.887,"hashrate_1h":258864,"hashrate_24h":271006,"shares_found":35,"shares_failed":0,"last_share":1781917416,"peers_out":11,"peers_in":0,"peer_list":538,"pool_hr":24214854,"sidechain_diff":242148541,"tor_cpu_pct":26.25,"tor_mem":"107.4MiB"}
+{"ts":1781917932,"arm":"tor","reward_share":0.988,"avg_effort":131.193,"cur_effort":54.623,"hashrate_1h":259759,"hashrate_24h":270927,"shares_found":35,"shares_failed":0,"last_share":1781917416,"peers_out":11,"peers_in":0,"peer_list":537,"pool_hr":23787233,"sidechain_diff":237872330,"tor_cpu_pct":36.9,"tor_mem":"106.9MiB"}
+{"ts":1781918233,"arm":"tor","reward_share":1.033,"avg_effort":129.055,"cur_effort":22.888,"hashrate_1h":264512,"hashrate_24h":270978,"shares_found":36,"shares_failed":0,"last_share":1781918010,"peers_out":11,"peers_in":0,"peer_list":538,"pool_hr":24061246,"sidechain_diff":240612465,"tor_cpu_pct":21.97,"tor_mem":"108.1MiB"}
+{"ts":1781918535,"arm":"tor","reward_share":1.030,"avg_effort":129.055,"cur_effort":58.148,"hashrate_1h":266760,"hashrate_24h":270907,"shares_found":36,"shares_failed":0,"last_share":1781918010,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":23672383,"sidechain_diff":236723833,"tor_cpu_pct":30.84,"tor_mem":"107.8MiB"}
+{"ts":1781918836,"arm":"tor","reward_share":1.038,"avg_effort":128.004,"cur_effort":3.011,"hashrate_1h":273351,"hashrate_24h":271346,"shares_found":37,"shares_failed":0,"last_share":1781918811,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":23409760,"sidechain_diff":234097601,"tor_cpu_pct":30.24,"tor_mem":"108MiB"}
+{"ts":1781919137,"arm":"tor","reward_share":0.997,"avg_effort":128.004,"cur_effort":35.466,"hashrate_1h":272857,"hashrate_24h":271151,"shares_found":37,"shares_failed":0,"last_share":1781918811,"peers_out":11,"peers_in":0,"peer_list":547,"pool_hr":23304828,"sidechain_diff":233048282,"tor_cpu_pct":24.95,"tor_mem":"108MiB"}
+{"ts":1781919438,"arm":"tor","reward_share":1.003,"avg_effort":125.687,"cur_effort":18.506,"hashrate_1h":270087,"hashrate_24h":271024,"shares_found":38,"shares_failed":0,"last_share":1781919241,"peers_out":11,"peers_in":0,"peer_list":542,"pool_hr":23510786,"sidechain_diff":235107862,"tor_cpu_pct":33.05,"tor_mem":"108.1MiB"}
+{"ts":1781919740,"arm":"tor","reward_share":1.001,"avg_effort":125.687,"cur_effort":52.732,"hashrate_1h":271808,"hashrate_24h":271012,"shares_found":38,"shares_failed":0,"last_share":1781919241,"peers_out":11,"peers_in":0,"peer_list":541,"pool_hr":23257793,"sidechain_diff":232577938,"tor_cpu_pct":30.47,"tor_mem":"108.4MiB"}
+{"ts":1781920041,"arm":"tor","reward_share":0.999,"avg_effort":125.687,"cur_effort":83.620,"hashrate_1h":270180,"hashrate_24h":270892,"shares_found":38,"shares_failed":0,"last_share":1781919241,"peers_out":11,"peers_in":0,"peer_list":543,"pool_hr":23408989,"sidechain_diff":234089893,"tor_cpu_pct":32.17,"tor_mem":"107MiB"}
+{"ts":1781920342,"arm":"tor","reward_share":0.997,"avg_effort":125.687,"cur_effort":122.611,"hashrate_1h":274678,"hashrate_24h":271059,"shares_found":38,"shares_failed":0,"last_share":1781919241,"peers_out":11,"peers_in":0,"peer_list":544,"pool_hr":23410312,"sidechain_diff":234103128,"tor_cpu_pct":38,"tor_mem":"106.9MiB"}
+{"ts":1781920643,"arm":"tor","reward_share":1.003,"avg_effort":126.004,"cur_effort":23.222,"hashrate_1h":275203,"hashrate_24h":271099,"shares_found":39,"shares_failed":0,"last_share":1781920467,"peers_out":11,"peers_in":0,"peer_list":545,"pool_hr":23215557,"sidechain_diff":232155578,"tor_cpu_pct":32.94,"tor_mem":"107.3MiB"}
+{"ts":1781920945,"arm":"tor","reward_share":1.001,"avg_effort":126.004,"cur_effort":60.481,"hashrate_1h":274542,"hashrate_24h":271215,"shares_found":39,"shares_failed":0,"last_share":1781920467,"peers_out":11,"peers_in":0,"peer_list":547,"pool_hr":23307451,"sidechain_diff":233074515,"tor_cpu_pct":30.58,"tor_mem":"107.1MiB"}
+{"ts":1781921246,"arm":"tor","reward_share":0.997,"avg_effort":126.004,"cur_effort":90.682,"hashrate_1h":270851,"hashrate_24h":270983,"shares_found":39,"shares_failed":0,"last_share":1781920467,"peers_out":11,"peers_in":0,"peer_list":550,"pool_hr":23180870,"sidechain_diff":231808706,"tor_cpu_pct":24.14,"tor_mem":"107MiB"}
+{"ts":1781921547,"arm":"tor","reward_share":1.039,"avg_effort":125.486,"cur_effort":14.051,"hashrate_1h":269672,"hashrate_24h":270754,"shares_found":40,"shares_failed":0,"last_share":1781921377,"peers_out":11,"peers_in":0,"peer_list":548,"pool_hr":23288174,"sidechain_diff":232881746,"tor_cpu_pct":29.89,"tor_mem":"107MiB"}
+{"ts":1781921848,"arm":"tor","reward_share":1.037,"avg_effort":125.486,"cur_effort":53.596,"hashrate_1h":271844,"hashrate_24h":271079,"shares_found":40,"shares_failed":0,"last_share":1781921377,"peers_out":11,"peers_in":0,"peer_list":554,"pool_hr":23381733,"sidechain_diff":233817333,"tor_cpu_pct":20.28,"tor_mem":"107MiB"}
+{"ts":1781922150,"arm":"tor","reward_share":0.996,"avg_effort":125.486,"cur_effort":83.400,"hashrate_1h":269087,"hashrate_24h":270709,"shares_found":40,"shares_failed":0,"last_share":1781921377,"peers_out":11,"peers_in":0,"peer_list":552,"pool_hr":23619346,"sidechain_diff":236193460,"tor_cpu_pct":42.37,"tor_mem":"107.1MiB"}
+{"ts":1781922451,"arm":"tor","reward_share":0.994,"avg_effort":125.486,"cur_effort":117.586,"hashrate_1h":264492,"hashrate_24h":270778,"shares_found":40,"shares_failed":0,"last_share":1781921377,"peers_out":11,"peers_in":0,"peer_list":553,"pool_hr":23566270,"sidechain_diff":235662705,"tor_cpu_pct":25.6,"tor_mem":"106.8MiB"}
+{"ts":1781922752,"arm":"tor","reward_share":0.951,"avg_effort":125.486,"cur_effort":148.877,"hashrate_1h":262405,"hashrate_24h":270380,"shares_found":40,"shares_failed":0,"last_share":1781921377,"peers_out":10,"peers_in":0,"peer_list":549,"pool_hr":23252844,"sidechain_diff":232528444,"tor_cpu_pct":22.05,"tor_mem":"107.2MiB"}
+{"ts":1781923053,"arm":"tor","reward_share":0.950,"avg_effort":125.486,"cur_effort":189.036,"hashrate_1h":266623,"hashrate_24h":270619,"shares_found":40,"shares_failed":0,"last_share":1781921377,"peers_out":10,"peers_in":0,"peer_list":550,"pool_hr":23162672,"sidechain_diff":231626723,"tor_cpu_pct":28.71,"tor_mem":"106.8MiB"}
+{"ts":1781923355,"arm":"tor","reward_share":0.954,"avg_effort":127.479,"cur_effort":25.078,"hashrate_1h":265470,"hashrate_24h":270584,"shares_found":41,"shares_failed":0,"last_share":1781923110,"peers_out":10,"peers_in":0,"peer_list":547,"pool_hr":23291166,"sidechain_diff":232911664,"tor_cpu_pct":25.08,"tor_mem":"107.1MiB"}
+{"ts":1781923656,"arm":"tor","reward_share":0.997,"avg_effort":125.411,"cur_effort":8.442,"hashrate_1h":269190,"hashrate_24h":270582,"shares_found":42,"shares_failed":0,"last_share":1781923573,"peers_out":10,"peers_in":0,"peer_list":547,"pool_hr":23440241,"sidechain_diff":234402417,"tor_cpu_pct":24.45,"tor_mem":"106.9MiB"}
+{"ts":1781923957,"arm":"tor","reward_share":0.969,"avg_effort":122.571,"cur_effort":19.358,"hashrate_1h":263172,"hashrate_24h":270279,"shares_found":43,"shares_failed":0,"last_share":1781923718,"peers_out":10,"peers_in":0,"peer_list":549,"pool_hr":23827521,"sidechain_diff":238275215,"tor_cpu_pct":41.97,"tor_mem":"107MiB"}
+{"ts":1781924258,"arm":"tor","reward_share":0.927,"avg_effort":122.571,"cur_effort":53.118,"hashrate_1h":261257,"hashrate_24h":270204,"shares_found":43,"shares_failed":0,"last_share":1781923718,"peers_out":10,"peers_in":0,"peer_list":548,"pool_hr":23676070,"sidechain_diff":236760706,"tor_cpu_pct":39.17,"tor_mem":"107.5MiB"}
+{"ts":1781924560,"arm":"tor","reward_share":0.930,"avg_effort":120.875,"cur_effort":29.803,"hashrate_1h":259967,"hashrate_24h":270216,"shares_found":44,"shares_failed":0,"last_share":1781924269,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24100473,"sidechain_diff":241004737,"tor_cpu_pct":26.39,"tor_mem":"108.3MiB"}
+{"ts":1781924861,"arm":"tor","reward_share":0.929,"avg_effort":120.875,"cur_effort":62.038,"hashrate_1h":261340,"hashrate_24h":270121,"shares_found":44,"shares_failed":0,"last_share":1781924269,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":23897435,"sidechain_diff":238974358,"tor_cpu_pct":44.65,"tor_mem":"108.3MiB"}
+{"ts":1781925162,"arm":"tor","reward_share":0.973,"avg_effort":119.465,"cur_effort":28.953,"hashrate_1h":259438,"hashrate_24h":269896,"shares_found":45,"shares_failed":0,"last_share":1781924897,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":23974506,"sidechain_diff":239745065,"tor_cpu_pct":37.65,"tor_mem":"108.8MiB"}
+{"ts":1781925463,"arm":"tor","reward_share":0.930,"avg_effort":119.465,"cur_effort":62.777,"hashrate_1h":257695,"hashrate_24h":269915,"shares_found":45,"shares_failed":0,"last_share":1781924897,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":24207958,"sidechain_diff":242079588,"tor_cpu_pct":35.63,"tor_mem":"109.3MiB"}
+{"ts":1781925765,"arm":"tor","reward_share":0.928,"avg_effort":119.465,"cur_effort":88.226,"hashrate_1h":257304,"hashrate_24h":269571,"shares_found":45,"shares_failed":0,"last_share":1781924897,"peers_out":10,"peers_in":0,"peer_list":544,"pool_hr":24177049,"sidechain_diff":241770491,"tor_cpu_pct":33.91,"tor_mem":"109.4MiB"}
+{"ts":1781926066,"arm":"tor","reward_share":0.927,"avg_effort":119.465,"cur_effort":121.040,"hashrate_1h":255396,"hashrate_24h":269411,"shares_found":45,"shares_failed":0,"last_share":1781924897,"peers_out":10,"peers_in":0,"peer_list":543,"pool_hr":24112216,"sidechain_diff":241122166,"tor_cpu_pct":23.73,"tor_mem":"110.1MiB"}
+{"ts":1781926367,"arm":"tor","reward_share":0.852,"avg_effort":119.465,"cur_effort":159.254,"hashrate_1h":262223,"hashrate_24h":269699,"shares_found":45,"shares_failed":0,"last_share":1781924897,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24071474,"sidechain_diff":240714745,"tor_cpu_pct":26.39,"tor_mem":"110.3MiB"}
+{"ts":1781926668,"arm":"tor","reward_share":0.851,"avg_effort":119.465,"cur_effort":199.360,"hashrate_1h":263934,"hashrate_24h":270071,"shares_found":45,"shares_failed":0,"last_share":1781924897,"peers_out":10,"peers_in":0,"peer_list":537,"pool_hr":24048752,"sidechain_diff":240487526,"tor_cpu_pct":26.4,"tor_mem":"110.2MiB"}
+{"ts":1781926970,"arm":"tor","reward_share":0.886,"avg_effort":122.303,"cur_effort":0.979,"hashrate_1h":264643,"hashrate_24h":270082,"shares_found":46,"shares_failed":0,"last_share":1781926945,"peers_out":10,"peers_in":0,"peer_list":537,"pool_hr":24095202,"sidechain_diff":240952021,"tor_cpu_pct":25.18,"tor_mem":"110.2MiB"}
+{"ts":1781927271,"arm":"tor","reward_share":0.885,"avg_effort":122.303,"cur_effort":30.806,"hashrate_1h":262575,"hashrate_24h":269906,"shares_found":46,"shares_failed":0,"last_share":1781926945,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24201461,"sidechain_diff":242014619,"tor_cpu_pct":21.26,"tor_mem":"110.2MiB"}
+{"ts":1781927572,"arm":"tor","reward_share":0.931,"avg_effort":120.292,"cur_effort":24.426,"hashrate_1h":265542,"hashrate_24h":269893,"shares_found":47,"shares_failed":0,"last_share":1781927334,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24223964,"sidechain_diff":242239647,"tor_cpu_pct":27.36,"tor_mem":"110.1MiB"}
+{"ts":1781927873,"arm":"tor","reward_share":0.930,"avg_effort":120.292,"cur_effort":52.491,"hashrate_1h":263639,"hashrate_24h":269669,"shares_found":47,"shares_failed":0,"last_share":1781927334,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":24552196,"sidechain_diff":245521967,"tor_cpu_pct":25.28,"tor_mem":"110.2MiB"}
+{"ts":1781928175,"arm":"tor","reward_share":0.977,"avg_effort":119.050,"cur_effort":14.477,"hashrate_1h":263039,"hashrate_24h":269516,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24602456,"sidechain_diff":246024560,"tor_cpu_pct":21.57,"tor_mem":"110.4MiB"}
+{"ts":1781928476,"arm":"tor","reward_share":0.976,"avg_effort":119.050,"cur_effort":44.734,"hashrate_1h":262074,"hashrate_24h":269423,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":551,"pool_hr":24239910,"sidechain_diff":242399104,"tor_cpu_pct":23.34,"tor_mem":"110.4MiB"}
+{"ts":1781928777,"arm":"tor","reward_share":0.924,"avg_effort":119.050,"cur_effort":76.441,"hashrate_1h":261740,"hashrate_24h":269335,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":550,"pool_hr":24540234,"sidechain_diff":245402347,"tor_cpu_pct":35.62,"tor_mem":"110.4MiB"}
+{"ts":1781929078,"arm":"tor","reward_share":0.923,"avg_effort":119.050,"cur_effort":106.860,"hashrate_1h":261260,"hashrate_24h":269233,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":552,"pool_hr":24485781,"sidechain_diff":244857816,"tor_cpu_pct":24.92,"tor_mem":"109.9MiB"}
+{"ts":1781929380,"arm":"tor","reward_share":0.922,"avg_effort":119.050,"cur_effort":144.678,"hashrate_1h":269049,"hashrate_24h":269445,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":551,"pool_hr":24486458,"sidechain_diff":244864586,"tor_cpu_pct":21.91,"tor_mem":"110MiB"}
+{"ts":1781929681,"arm":"tor","reward_share":0.878,"avg_effort":119.050,"cur_effort":182.048,"hashrate_1h":271131,"hashrate_24h":269590,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":554,"pool_hr":24410659,"sidechain_diff":244106598,"tor_cpu_pct":21.04,"tor_mem":"109.9MiB"}
+{"ts":1781929982,"arm":"tor","reward_share":0.834,"avg_effort":119.050,"cur_effort":216.210,"hashrate_1h":269351,"hashrate_24h":269681,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":548,"pool_hr":24460756,"sidechain_diff":244607560,"tor_cpu_pct":21.29,"tor_mem":"109.9MiB"}
+{"ts":1781930283,"arm":"tor","reward_share":0.834,"avg_effort":119.050,"cur_effort":249.988,"hashrate_1h":263905,"hashrate_24h":269682,"shares_found":48,"shares_failed":0,"last_share":1781928012,"peers_out":10,"peers_in":0,"peer_list":548,"pool_hr":24388337,"sidechain_diff":243883373,"tor_cpu_pct":25.9,"tor_mem":"109.5MiB"}
+{"ts":1781930585,"arm":"tor","reward_share":0.926,"avg_effort":119.505,"cur_effort":26.967,"hashrate_1h":264031,"hashrate_24h":269739,"shares_found":50,"shares_failed":0,"last_share":1781930342,"peers_out":10,"peers_in":0,"peer_list":544,"pool_hr":24506217,"sidechain_diff":245062170,"tor_cpu_pct":16.75,"tor_mem":"109.3MiB"}
+{"ts":1781930886,"arm":"tor","reward_share":0.928,"avg_effort":117.999,"cur_effort":1.421,"hashrate_1h":264314,"hashrate_24h":269449,"shares_found":51,"shares_failed":0,"last_share":1781930840,"peers_out":10,"peers_in":0,"peer_list":546,"pool_hr":24383768,"sidechain_diff":243837687,"tor_cpu_pct":16.34,"tor_mem":"109.4MiB"}
+{"ts":1781931187,"arm":"tor","reward_share":0.927,"avg_effort":117.999,"cur_effort":27.831,"hashrate_1h":259394,"hashrate_24h":269103,"shares_found":51,"shares_failed":0,"last_share":1781930840,"peers_out":10,"peers_in":0,"peer_list":546,"pool_hr":24538843,"sidechain_diff":245388438,"tor_cpu_pct":15.98,"tor_mem":"108.7MiB"}
+{"ts":1781931488,"arm":"tor","reward_share":0.927,"avg_effort":117.999,"cur_effort":62.872,"hashrate_1h":265061,"hashrate_24h":269245,"shares_found":51,"shares_failed":0,"last_share":1781930840,"peers_out":10,"peers_in":0,"peer_list":545,"pool_hr":24658407,"sidechain_diff":246584071,"tor_cpu_pct":17.33,"tor_mem":"108.5MiB"}
+{"ts":1781931790,"arm":"tor","reward_share":0.928,"avg_effort":117.999,"cur_effort":94.868,"hashrate_1h":265977,"hashrate_24h":269272,"shares_found":51,"shares_failed":0,"last_share":1781930840,"peers_out":10,"peers_in":0,"peer_list":546,"pool_hr":24921132,"sidechain_diff":249211324,"tor_cpu_pct":22.3,"tor_mem":"106.4MiB"}
+{"ts":1781932091,"arm":"tor","reward_share":0.928,"avg_effort":117.999,"cur_effort":122.225,"hashrate_1h":263255,"hashrate_24h":268990,"shares_found":51,"shares_failed":0,"last_share":1781930840,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":24885236,"sidechain_diff":248852367,"tor_cpu_pct":14.37,"tor_mem":"106.4MiB"}
+{"ts":1781932392,"arm":"tor","reward_share":0.927,"avg_effort":117.999,"cur_effort":151.597,"hashrate_1h":262366,"hashrate_24h":268818,"shares_found":51,"shares_failed":0,"last_share":1781930840,"peers_out":10,"peers_in":0,"peer_list":543,"pool_hr":24868236,"sidechain_diff":248682363,"tor_cpu_pct":19.83,"tor_mem":"105.9MiB"}
+{"ts":1781932693,"arm":"tor","reward_share":1.067,"avg_effort":114.437,"cur_effort":1.377,"hashrate_1h":267230,"hashrate_24h":269014,"shares_found":54,"shares_failed":0,"last_share":1781932670,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":24789153,"sidechain_diff":247891539,"tor_cpu_pct":17.18,"tor_mem":"105.4MiB"}
+{"ts":1781932995,"arm":"tor","reward_share":1.021,"avg_effort":114.437,"cur_effort":32.834,"hashrate_1h":262114,"hashrate_24h":268957,"shares_found":54,"shares_failed":0,"last_share":1781932670,"peers_out":10,"peers_in":0,"peer_list":548,"pool_hr":24831473,"sidechain_diff":248314733,"tor_cpu_pct":4.35,"tor_mem":"105.5MiB"}
+{"ts":1781933296,"arm":"tor","reward_share":1.021,"avg_effort":114.437,"cur_effort":69.664,"hashrate_1h":264644,"hashrate_24h":269229,"shares_found":54,"shares_failed":0,"last_share":1781932670,"peers_out":10,"peers_in":0,"peer_list":551,"pool_hr":25248608,"sidechain_diff":252486081,"tor_cpu_pct":18.71,"tor_mem":"105.4MiB"}
+{"ts":1781933597,"arm":"tor","reward_share":1.067,"avg_effort":114.178,"cur_effort":5.397,"hashrate_1h":266667,"hashrate_24h":269418,"shares_found":55,"shares_failed":0,"last_share":1781933558,"peers_out":10,"peers_in":0,"peer_list":550,"pool_hr":24797009,"sidechain_diff":247970095,"tor_cpu_pct":19.77,"tor_mem":"104.5MiB"}
+{"ts":1781933898,"arm":"tor","reward_share":1.067,"avg_effort":114.178,"cur_effort":42.370,"hashrate_1h":267977,"hashrate_24h":269531,"shares_found":55,"shares_failed":0,"last_share":1781933558,"peers_out":10,"peers_in":0,"peer_list":546,"pool_hr":24407379,"sidechain_diff":244073790,"tor_cpu_pct":13.67,"tor_mem":"104.5MiB"}
+{"ts":1781934200,"arm":"tor","reward_share":1.076,"avg_effort":113.057,"cur_effort":11.209,"hashrate_1h":264855,"hashrate_24h":269363,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":547,"pool_hr":24462325,"sidechain_diff":244623252,"tor_cpu_pct":15.83,"tor_mem":"104.2MiB"}
+{"ts":1781934501,"arm":"tor","reward_share":1.076,"avg_effort":113.057,"cur_effort":41.182,"hashrate_1h":267037,"hashrate_24h":269252,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":543,"pool_hr":24827253,"sidechain_diff":248272535,"tor_cpu_pct":19.02,"tor_mem":"104.3MiB"}
+{"ts":1781934802,"arm":"tor","reward_share":1.076,"avg_effort":113.057,"cur_effort":68.336,"hashrate_1h":266476,"hashrate_24h":268885,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":540,"pool_hr":24614966,"sidechain_diff":246149666,"tor_cpu_pct":1.1,"tor_mem":"103.7MiB"}
+{"ts":1781935103,"arm":"tor","reward_share":1.076,"avg_effort":113.057,"cur_effort":99.777,"hashrate_1h":262608,"hashrate_24h":268792,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24592895,"sidechain_diff":245928957,"tor_cpu_pct":12.58,"tor_mem":"102.1MiB"}
+{"ts":1781935405,"arm":"tor","reward_share":1.075,"avg_effort":113.057,"cur_effort":130.591,"hashrate_1h":263202,"hashrate_24h":268827,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24788583,"sidechain_diff":247885839,"tor_cpu_pct":6.04,"tor_mem":"102.3MiB"}
+{"ts":1781935706,"arm":"tor","reward_share":1.029,"avg_effort":113.057,"cur_effort":163.182,"hashrate_1h":266665,"hashrate_24h":268824,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24809562,"sidechain_diff":248095620,"tor_cpu_pct":4.08,"tor_mem":"102.4MiB"}
+{"ts":1781936007,"arm":"tor","reward_share":1.028,"avg_effort":113.057,"cur_effort":195.247,"hashrate_1h":267680,"hashrate_24h":268792,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24945712,"sidechain_diff":249457122,"tor_cpu_pct":12.03,"tor_mem":"102MiB"}
+{"ts":1781936308,"arm":"tor","reward_share":1.029,"avg_effort":113.057,"cur_effort":226.849,"hashrate_1h":267203,"hashrate_24h":268891,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":25021372,"sidechain_diff":250213722,"tor_cpu_pct":0.72,"tor_mem":"101.9MiB"}
+{"ts":1781936610,"arm":"tor","reward_share":1.028,"avg_effort":113.057,"cur_effort":256.110,"hashrate_1h":268583,"hashrate_24h":268904,"shares_found":56,"shares_failed":0,"last_share":1781934078,"peers_out":10,"peers_in":0,"peer_list":536,"pool_hr":25482881,"sidechain_diff":254828810,"tor_cpu_pct":0.99,"tor_mem":"101.8MiB"}
+{"ts":1781936911,"arm":"tor","reward_share":1.074,"avg_effort":116.063,"cur_effort":25.561,"hashrate_1h":262053,"hashrate_24h":268750,"shares_found":57,"shares_failed":0,"last_share":1781936632,"peers_out":10,"peers_in":0,"peer_list":533,"pool_hr":24891429,"sidechain_diff":248914291,"tor_cpu_pct":17.39,"tor_mem":"101.7MiB"}
+{"ts":1781937212,"arm":"tor","reward_share":1.073,"avg_effort":116.063,"cur_effort":58.431,"hashrate_1h":256241,"hashrate_24h":268642,"shares_found":57,"shares_failed":0,"last_share":1781936632,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24618153,"sidechain_diff":246181533,"tor_cpu_pct":17.12,"tor_mem":"101.9MiB"}
+{"ts":1781937513,"arm":"tor","reward_share":1.120,"avg_effort":112.901,"cur_effort":21.712,"hashrate_1h":255611,"hashrate_24h":268595,"shares_found":59,"shares_failed":0,"last_share":1781937299,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24636413,"sidechain_diff":246364137,"tor_cpu_pct":0.55,"tor_mem":"101.7MiB"}
+{"ts":1781937815,"arm":"tor","reward_share":1.120,"avg_effort":112.901,"cur_effort":48.700,"hashrate_1h":255220,"hashrate_24h":268366,"shares_found":59,"shares_failed":0,"last_share":1781937299,"peers_out":10,"peers_in":0,"peer_list":544,"pool_hr":24471001,"sidechain_diff":244710019,"tor_cpu_pct":2.24,"tor_mem":"101.8MiB"}
+{"ts":1781938116,"arm":"tor","reward_share":1.121,"avg_effort":112.901,"cur_effort":83.967,"hashrate_1h":257228,"hashrate_24h":268420,"shares_found":59,"shares_failed":0,"last_share":1781937299,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":24295200,"sidechain_diff":242952002,"tor_cpu_pct":1.74,"tor_mem":"102.1MiB"}
+{"ts":1781938417,"arm":"tor","reward_share":1.121,"avg_effort":112.901,"cur_effort":113.954,"hashrate_1h":260018,"hashrate_24h":268305,"shares_found":59,"shares_failed":0,"last_share":1781937299,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":24225067,"sidechain_diff":242250674,"tor_cpu_pct":3.56,"tor_mem":"101.6MiB"}
+{"ts":1781938718,"arm":"tor","reward_share":1.166,"avg_effort":113.030,"cur_effort":34.193,"hashrate_1h":265304,"hashrate_24h":268560,"shares_found":60,"shares_failed":0,"last_share":1781938443,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24584472,"sidechain_diff":245844720,"tor_cpu_pct":1.55,"tor_mem":"101.7MiB"}
+{"ts":1781939020,"arm":"tor","reward_share":1.167,"avg_effort":113.030,"cur_effort":64.838,"hashrate_1h":262620,"hashrate_24h":268414,"shares_found":60,"shares_failed":0,"last_share":1781938443,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24419462,"sidechain_diff":244194624,"tor_cpu_pct":27.44,"tor_mem":"101.7MiB"}
+{"ts":1781939321,"arm":"tor","reward_share":1.221,"avg_effort":110.688,"cur_effort":5.193,"hashrate_1h":264223,"hashrate_24h":268539,"shares_found":62,"shares_failed":0,"last_share":1781939269,"peers_out":10,"peers_in":0,"peer_list":545,"pool_hr":24094804,"sidechain_diff":240948045,"tor_cpu_pct":1.3,"tor_mem":"101.7MiB"}
+{"ts":1781939622,"arm":"tor","reward_share":1.223,"avg_effort":110.688,"cur_effort":37.633,"hashrate_1h":264922,"hashrate_24h":268528,"shares_found":62,"shares_failed":0,"last_share":1781939269,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24833054,"sidechain_diff":248330542,"tor_cpu_pct":13.34,"tor_mem":"101.8MiB"}
+{"ts":1781939923,"arm":"tor","reward_share":1.222,"avg_effort":110.688,"cur_effort":72.917,"hashrate_1h":265178,"hashrate_24h":268680,"shares_found":62,"shares_failed":0,"last_share":1781939269,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":24534252,"sidechain_diff":245342523,"tor_cpu_pct":17.36,"tor_mem":"101.8MiB"}
+{"ts":1781940225,"arm":"tor","reward_share":1.176,"avg_effort":110.688,"cur_effort":110.717,"hashrate_1h":268342,"hashrate_24h":268804,"shares_found":62,"shares_failed":0,"last_share":1781939269,"peers_out":10,"peers_in":0,"peer_list":540,"pool_hr":24464105,"sidechain_diff":244641055,"tor_cpu_pct":1.2,"tor_mem":"101.7MiB"}
+{"ts":1781940526,"arm":"tor","reward_share":1.222,"avg_effort":111.298,"cur_effort":0.000,"hashrate_1h":272577,"hashrate_24h":268938,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":540,"pool_hr":24944734,"sidechain_diff":249447347,"tor_cpu_pct":17.82,"tor_mem":"102.1MiB"}
+{"ts":1781940827,"arm":"tor","reward_share":1.222,"avg_effort":111.298,"cur_effort":28.813,"hashrate_1h":271411,"hashrate_24h":268841,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":24525832,"sidechain_diff":245258323,"tor_cpu_pct":1.38,"tor_mem":"102MiB"}
+{"ts":1781941128,"arm":"tor","reward_share":1.177,"avg_effort":111.298,"cur_effort":68.534,"hashrate_1h":276785,"hashrate_24h":269095,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":548,"pool_hr":24412852,"sidechain_diff":244128521,"tor_cpu_pct":4.42,"tor_mem":"101.8MiB"}
+{"ts":1781941430,"arm":"tor","reward_share":1.133,"avg_effort":111.298,"cur_effort":106.025,"hashrate_1h":283208,"hashrate_24h":269283,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":24495788,"sidechain_diff":244957880,"tor_cpu_pct":18.45,"tor_mem":"100.8MiB"}
+{"ts":1781941731,"arm":"tor","reward_share":1.132,"avg_effort":111.298,"cur_effort":143.452,"hashrate_1h":283172,"hashrate_24h":269382,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":543,"pool_hr":24167968,"sidechain_diff":241679684,"tor_cpu_pct":0.7,"tor_mem":"100.8MiB"}
+{"ts":1781942032,"arm":"tor","reward_share":1.131,"avg_effort":111.298,"cur_effort":171.184,"hashrate_1h":283335,"hashrate_24h":269246,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24748766,"sidechain_diff":247487662,"tor_cpu_pct":1.06,"tor_mem":"100.8MiB"}
+{"ts":1781942333,"arm":"tor","reward_share":1.131,"avg_effort":111.298,"cur_effort":203.254,"hashrate_1h":278914,"hashrate_24h":269165,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":543,"pool_hr":24435212,"sidechain_diff":244352128,"tor_cpu_pct":8.07,"tor_mem":"100.9MiB"}
+{"ts":1781942635,"arm":"tor","reward_share":1.086,"avg_effort":111.298,"cur_effort":234.792,"hashrate_1h":280332,"hashrate_24h":269119,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":24421553,"sidechain_diff":244215539,"tor_cpu_pct":0.51,"tor_mem":"100.7MiB"}
+{"ts":1781942936,"arm":"tor","reward_share":1.085,"avg_effort":111.298,"cur_effort":274.409,"hashrate_1h":279634,"hashrate_24h":269214,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24091309,"sidechain_diff":240913096,"tor_cpu_pct":1.81,"tor_mem":"100.5MiB"}
+{"ts":1781943237,"arm":"tor","reward_share":1.085,"avg_effort":111.298,"cur_effort":311.376,"hashrate_1h":280951,"hashrate_24h":269262,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24044660,"sidechain_diff":240446605,"tor_cpu_pct":18.89,"tor_mem":"100.7MiB"}
+{"ts":1781943538,"arm":"tor","reward_share":1.041,"avg_effort":111.298,"cur_effort":341.954,"hashrate_1h":278549,"hashrate_24h":269280,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":538,"pool_hr":24225363,"sidechain_diff":242253636,"tor_cpu_pct":1.64,"tor_mem":"100.5MiB"}
+{"ts":1781943840,"arm":"tor","reward_share":1.040,"avg_effort":111.298,"cur_effort":374.561,"hashrate_1h":275223,"hashrate_24h":269211,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":24139796,"sidechain_diff":241397969,"tor_cpu_pct":17.18,"tor_mem":"100.5MiB"}
+{"ts":1781944141,"arm":"tor","reward_share":1.040,"avg_effort":111.298,"cur_effort":410.184,"hashrate_1h":270678,"hashrate_24h":269041,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":542,"pool_hr":23717305,"sidechain_diff":237173057,"tor_cpu_pct":25.49,"tor_mem":"100.5MiB"}
+{"ts":1781944442,"arm":"tor","reward_share":1.039,"avg_effort":111.298,"cur_effort":438.575,"hashrate_1h":271686,"hashrate_24h":269021,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":544,"pool_hr":24046176,"sidechain_diff":240461769,"tor_cpu_pct":18.15,"tor_mem":"100.8MiB"}
+{"ts":1781944743,"arm":"tor","reward_share":1.039,"avg_effort":111.298,"cur_effort":486.045,"hashrate_1h":271935,"hashrate_24h":269221,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":23630545,"sidechain_diff":236305450,"tor_cpu_pct":2.67,"tor_mem":"100.6MiB"}
+{"ts":1781945045,"arm":"tor","reward_share":1.038,"avg_effort":111.298,"cur_effort":512.420,"hashrate_1h":270453,"hashrate_24h":269319,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":539,"pool_hr":24135834,"sidechain_diff":241358346,"tor_cpu_pct":18.56,"tor_mem":"100.6MiB"}
+{"ts":1781945346,"arm":"tor","reward_share":1.038,"avg_effort":111.298,"cur_effort":544.761,"hashrate_1h":263756,"hashrate_24h":269045,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":544,"pool_hr":23863227,"sidechain_diff":238632273,"tor_cpu_pct":20.12,"tor_mem":"100.6MiB"}
+{"ts":1781945647,"arm":"tor","reward_share":0.995,"avg_effort":111.298,"cur_effort":573.044,"hashrate_1h":262470,"hashrate_24h":268946,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":545,"pool_hr":23976781,"sidechain_diff":239767814,"tor_cpu_pct":29.07,"tor_mem":"108.4MiB"}
+{"ts":1781945948,"arm":"tor","reward_share":0.995,"avg_effort":111.298,"cur_effort":606.491,"hashrate_1h":264153,"hashrate_24h":268862,"shares_found":63,"shares_failed":0,"last_share":1781940526,"peers_out":10,"peers_in":0,"peer_list":545,"pool_hr":23836436,"sidechain_diff":238364366,"tor_cpu_pct":16.47,"tor_mem":"102.6MiB"}
+{"ts":1781946250,"arm":"tor","reward_share":0.954,"avg_effort":120.117,"cur_effort":14.803,"hashrate_1h":270786,"hashrate_24h":269164,"shares_found":64,"shares_failed":0,"last_share":1781946121,"peers_out":10,"peers_in":0,"peer_list":553,"pool_hr":24522827,"sidechain_diff":245228274,"tor_cpu_pct":16.25,"tor_mem":"102.6MiB"}
+{"ts":1781946551,"arm":"tor","reward_share":0.953,"avg_effort":120.117,"cur_effort":39.734,"hashrate_1h":262839,"hashrate_24h":268856,"shares_found":64,"shares_failed":0,"last_share":1781946121,"peers_out":10,"peers_in":0,"peer_list":561,"pool_hr":24367007,"sidechain_diff":243670079,"tor_cpu_pct":23.38,"tor_mem":"102.7MiB"}
+{"ts":1781946852,"arm":"tor","reward_share":0.909,"avg_effort":120.117,"cur_effort":59.379,"hashrate_1h":252568,"hashrate_24h":268329,"shares_found":64,"shares_failed":0,"last_share":1781946121,"peers_out":10,"peers_in":0,"peer_list":576,"pool_hr":23996795,"sidechain_diff":239967952,"tor_cpu_pct":22.94,"tor_mem":"102.7MiB"}
+{"ts":1781947153,"arm":"tor","reward_share":0.953,"avg_effort":119.280,"cur_effort":26.133,"hashrate_1h":253457,"hashrate_24h":268392,"shares_found":65,"shares_failed":0,"last_share":1781946917,"peers_out":10,"peers_in":0,"peer_list":630,"pool_hr":23879831,"sidechain_diff":238798315,"tor_cpu_pct":11.34,"tor_mem":"103.2MiB"}
+{"ts":1781947455,"arm":"tor","reward_share":0.908,"avg_effort":119.280,"cur_effort":49.132,"hashrate_1h":247961,"hashrate_24h":267991,"shares_found":65,"shares_failed":0,"last_share":1781946917,"peers_out":10,"peers_in":0,"peer_list":641,"pool_hr":23907202,"sidechain_diff":239072020,"tor_cpu_pct":19.47,"tor_mem":"105.8MiB"}
+{"ts":1781947756,"arm":"tor","reward_share":0.996,"avg_effort":116.616,"cur_effort":7.133,"hashrate_1h":246773,"hashrate_24h":267832,"shares_found":67,"shares_failed":0,"last_share":1781947708,"peers_out":10,"peers_in":0,"peer_list":660,"pool_hr":23860335,"sidechain_diff":238603351,"tor_cpu_pct":16.26,"tor_mem":"104.7MiB"}
+{"ts":1781948057,"arm":"tor","reward_share":0.996,"avg_effort":116.616,"cur_effort":36.146,"hashrate_1h":244359,"hashrate_24h":267713,"shares_found":67,"shares_failed":0,"last_share":1781947708,"peers_out":10,"peers_in":0,"peer_list":670,"pool_hr":23655425,"sidechain_diff":236554250,"tor_cpu_pct":16.65,"tor_mem":"104.7MiB"}
+{"ts":1781948358,"arm":"tor","reward_share":1.084,"avg_effort":114.059,"cur_effort":2.835,"hashrate_1h":242539,"hashrate_24h":267751,"shares_found":69,"shares_failed":0,"last_share":1781948308,"peers_out":10,"peers_in":0,"peer_list":666,"pool_hr":23586827,"sidechain_diff":235868276,"tor_cpu_pct":7.1,"tor_mem":"104.8MiB"}
+{"ts":1781948660,"arm":"tor","reward_share":1.084,"avg_effort":114.059,"cur_effort":38.881,"hashrate_1h":243394,"hashrate_24h":267889,"shares_found":69,"shares_failed":0,"last_share":1781948308,"peers_out":10,"peers_in":0,"peer_list":661,"pool_hr":24650134,"sidechain_diff":246501341,"tor_cpu_pct":22.97,"tor_mem":"105.1MiB"}
+{"ts":1781948961,"arm":"tor","reward_share":1.129,"avg_effort":113.007,"cur_effort":33.812,"hashrate_1h":253128,"hashrate_24h":268177,"shares_found":70,"shares_failed":0,"last_share":1781948726,"peers_out":10,"peers_in":0,"peer_list":633,"pool_hr":24300268,"sidechain_diff":243002686,"tor_cpu_pct":25.55,"tor_mem":"105.7MiB"}
+{"ts":1781949262,"arm":"tor","reward_share":1.172,"avg_effort":111.974,"cur_effort":25.098,"hashrate_1h":258001,"hashrate_24h":268322,"shares_found":71,"shares_failed":0,"last_share":1781949057,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":23838570,"sidechain_diff":238385706,"tor_cpu_pct":19.19,"tor_mem":"106MiB"}
+{"ts":1781949563,"arm":"tor","reward_share":1.225,"avg_effort":109.197,"cur_effort":25.149,"hashrate_1h":258015,"hashrate_24h":268346,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":560,"pool_hr":24010424,"sidechain_diff":240104247,"tor_cpu_pct":24.93,"tor_mem":"106.2MiB"}
+{"ts":1781949865,"arm":"tor","reward_share":1.225,"avg_effort":109.197,"cur_effort":58.390,"hashrate_1h":252657,"hashrate_24h":268330,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":486,"pool_hr":23822894,"sidechain_diff":238228943,"tor_cpu_pct":17.4,"tor_mem":"106.1MiB"}
+{"ts":1781950166,"arm":"tor","reward_share":1.181,"avg_effort":109.197,"cur_effort":91.936,"hashrate_1h":261604,"hashrate_24h":268311,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":23874230,"sidechain_diff":238742303,"tor_cpu_pct":21.72,"tor_mem":"106.3MiB"}
+{"ts":1781950467,"arm":"tor","reward_share":1.181,"avg_effort":109.197,"cur_effort":120.156,"hashrate_1h":267451,"hashrate_24h":268219,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":408,"pool_hr":24119269,"sidechain_diff":241192695,"tor_cpu_pct":8.42,"tor_mem":"106.5MiB"}
+{"ts":1781950768,"arm":"tor","reward_share":1.136,"avg_effort":109.197,"cur_effort":158.915,"hashrate_1h":268881,"hashrate_24h":268333,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":412,"pool_hr":24120543,"sidechain_diff":241205438,"tor_cpu_pct":11.46,"tor_mem":"106.5MiB"}
+{"ts":1781951070,"arm":"tor","reward_share":1.135,"avg_effort":109.197,"cur_effort":193.894,"hashrate_1h":277951,"hashrate_24h":268470,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":24412834,"sidechain_diff":244128348,"tor_cpu_pct":13.66,"tor_mem":"106.9MiB"}
+{"ts":1781951371,"arm":"tor","reward_share":1.136,"avg_effort":109.197,"cur_effort":225.605,"hashrate_1h":279176,"hashrate_24h":268424,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":411,"pool_hr":24077543,"sidechain_diff":240775435,"tor_cpu_pct":15.43,"tor_mem":"106.9MiB"}
+{"ts":1781951672,"arm":"tor","reward_share":1.136,"avg_effort":109.197,"cur_effort":265.326,"hashrate_1h":285185,"hashrate_24h":268646,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":412,"pool_hr":24314117,"sidechain_diff":243141170,"tor_cpu_pct":15.91,"tor_mem":"106.5MiB"}
+{"ts":1781951973,"arm":"tor","reward_share":1.137,"avg_effort":109.197,"cur_effort":299.999,"hashrate_1h":285784,"hashrate_24h":268681,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":413,"pool_hr":24285252,"sidechain_diff":242852526,"tor_cpu_pct":17.59,"tor_mem":"106.5MiB"}
+{"ts":1781952275,"arm":"tor","reward_share":1.137,"avg_effort":109.197,"cur_effort":331.437,"hashrate_1h":280957,"hashrate_24h":268552,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":24123189,"sidechain_diff":241231896,"tor_cpu_pct":22.01,"tor_mem":"106.7MiB"}
+{"ts":1781952576,"arm":"tor","reward_share":1.136,"avg_effort":109.197,"cur_effort":368.575,"hashrate_1h":276179,"hashrate_24h":268622,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":414,"pool_hr":24113207,"sidechain_diff":241132072,"tor_cpu_pct":24.15,"tor_mem":"106.8MiB"}
+{"ts":1781952877,"arm":"tor","reward_share":1.091,"avg_effort":109.197,"cur_effort":393.257,"hashrate_1h":271845,"hashrate_24h":268505,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":414,"pool_hr":24295484,"sidechain_diff":242954849,"tor_cpu_pct":22.35,"tor_mem":"106.8MiB"}
+{"ts":1781953178,"arm":"tor","reward_share":1.046,"avg_effort":109.197,"cur_effort":431.215,"hashrate_1h":271662,"hashrate_24h":268507,"shares_found":73,"shares_failed":0,"last_share":1781949332,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":24159429,"sidechain_diff":241594294,"tor_cpu_pct":38.06,"tor_mem":"107.3MiB"}
+{"ts":1781953480,"arm":"tor","reward_share":1.045,"avg_effort":114.254,"cur_effort":14.537,"hashrate_1h":274522,"hashrate_24h":268639,"shares_found":74,"shares_failed":0,"last_share":1781953361,"peers_out":10,"peers_in":0,"peer_list":416,"pool_hr":24015643,"sidechain_diff":240156438,"tor_cpu_pct":13.13,"tor_mem":"107.3MiB"}
+{"ts":1781953781,"arm":"tor","reward_share":1.046,"avg_effort":114.254,"cur_effort":45.807,"hashrate_1h":273738,"hashrate_24h":268550,"shares_found":74,"shares_failed":0,"last_share":1781953361,"peers_out":10,"peers_in":0,"peer_list":417,"pool_hr":24208719,"sidechain_diff":242087192,"tor_cpu_pct":15.78,"tor_mem":"107.3MiB"}
+{"ts":1781954082,"arm":"tor","reward_share":1.046,"avg_effort":114.254,"cur_effort":69.318,"hashrate_1h":267630,"hashrate_24h":268222,"shares_found":74,"shares_failed":0,"last_share":1781953361,"peers_out":10,"peers_in":0,"peer_list":417,"pool_hr":24274744,"sidechain_diff":242747446,"tor_cpu_pct":19.79,"tor_mem":"107.5MiB"}
+{"ts":1781954383,"arm":"tor","reward_share":1.046,"avg_effort":114.254,"cur_effort":104.795,"hashrate_1h":268334,"hashrate_24h":268316,"shares_found":74,"shares_failed":0,"last_share":1781953361,"peers_out":10,"peers_in":0,"peer_list":413,"pool_hr":24382582,"sidechain_diff":243825828,"tor_cpu_pct":19.17,"tor_mem":"107.4MiB"}
+{"ts":1781954685,"arm":"tor","reward_share":1.091,"avg_effort":114.586,"cur_effort":0.889,"hashrate_1h":264972,"hashrate_24h":268320,"shares_found":75,"shares_failed":0,"last_share":1781954663,"peers_out":10,"peers_in":0,"peer_list":412,"pool_hr":24495240,"sidechain_diff":244952403,"tor_cpu_pct":23.22,"tor_mem":"107.9MiB"}
+{"ts":1781954986,"arm":"tor","reward_share":1.091,"avg_effort":114.586,"cur_effort":32.603,"hashrate_1h":266125,"hashrate_24h":268311,"shares_found":75,"shares_failed":0,"last_share":1781954663,"peers_out":10,"peers_in":0,"peer_list":411,"pool_hr":24812202,"sidechain_diff":248122022,"tor_cpu_pct":82.6,"tor_mem":"108.3MiB"}
+{"ts":1781955287,"arm":"tor","reward_share":1.000,"avg_effort":113.903,"cur_effort":1.428,"hashrate_1h":264447,"hashrate_24h":268429,"shares_found":76,"shares_failed":0,"last_share":1781955264,"peers_out":10,"peers_in":0,"peer_list":415,"pool_hr":24527609,"sidechain_diff":245276095,"tor_cpu_pct":102.83,"tor_mem":"113.5MiB"}
+{"ts":1782027754,"arm":"tor","reward_share":1.183,"avg_effort":108.164,"cur_effort":17.692,"hashrate_1h":256901,"hashrate_24h":256901,"shares_found":0,"shares_failed":0,"last_share":0,"peers_out":10,"peers_in":0,"peer_list":747,"pool_hr":22775246,"sidechain_diff":227752462,"tor_cpu_pct":55.08,"tor_mem":"89.25MiB"}
+{"ts":1782028055,"arm":"tor","reward_share":1.219,"avg_effort":33.703,"cur_effort":28.577,"hashrate_1h":285783,"hashrate_24h":285783,"shares_found":1,"shares_failed":0,"last_share":1782027837,"peers_out":10,"peers_in":0,"peer_list":801,"pool_hr":22919874,"sidechain_diff":229198745,"tor_cpu_pct":34.58,"tor_mem":"91.97MiB"}
+{"ts":1782028356,"arm":"tor","reward_share":1.174,"avg_effort":33.703,"cur_effort":61.887,"hashrate_1h":278568,"hashrate_24h":278568,"shares_found":1,"shares_failed":0,"last_share":1782027837,"peers_out":10,"peers_in":0,"peer_list":856,"pool_hr":23563288,"sidechain_diff":235632886,"tor_cpu_pct":43.85,"tor_mem":"94.18MiB"}
+{"ts":1782028657,"arm":"tor","reward_share":1.083,"avg_effort":33.703,"cur_effort":94.932,"hashrate_1h":273739,"hashrate_24h":273739,"shares_found":1,"shares_failed":0,"last_share":1782027837,"peers_out":10,"peers_in":0,"peer_list":886,"pool_hr":23459472,"sidechain_diff":234594721,"tor_cpu_pct":91.87,"tor_mem":"94.13MiB"}
+{"ts":1782028959,"arm":"tor","reward_share":1.081,"avg_effort":33.703,"cur_effort":132.491,"hashrate_1h":272002,"hashrate_24h":272002,"shares_found":1,"shares_failed":0,"last_share":1782027837,"peers_out":10,"peers_in":0,"peer_list":909,"pool_hr":23030999,"sidechain_diff":230309995,"tor_cpu_pct":15.77,"tor_mem":"93.25MiB"}
+{"ts":1782029260,"arm":"tor","reward_share":1.081,"avg_effort":33.703,"cur_effort":174.388,"hashrate_1h":280742,"hashrate_24h":280742,"shares_found":1,"shares_failed":0,"last_share":1782027837,"peers_out":10,"peers_in":0,"peer_list":926,"pool_hr":23006314,"sidechain_diff":230063144,"tor_cpu_pct":33.63,"tor_mem":"94.08MiB"}
+{"ts":1782029561,"arm":"tor","reward_share":1.081,"avg_effort":33.703,"cur_effort":207.349,"hashrate_1h":283506,"hashrate_24h":283506,"shares_found":1,"shares_failed":0,"last_share":1782027837,"peers_out":10,"peers_in":0,"peer_list":937,"pool_hr":23643173,"sidechain_diff":236431734,"tor_cpu_pct":44.59,"tor_mem":"94.48MiB"}
+{"ts":1782029862,"arm":"tor","reward_share":1.127,"avg_effort":137.308,"cur_effort":1.380,"hashrate_1h":282883,"hashrate_24h":282883,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":943,"pool_hr":23566396,"sidechain_diff":235663965,"tor_cpu_pct":84.47,"tor_mem":"94.63MiB"}
+{"ts":1782030164,"arm":"tor","reward_share":1.126,"avg_effort":137.308,"cur_effort":35.399,"hashrate_1h":281402,"hashrate_24h":281402,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":949,"pool_hr":23101059,"sidechain_diff":231010590,"tor_cpu_pct":23.11,"tor_mem":"94.6MiB"}
+{"ts":1782030465,"arm":"tor","reward_share":1.091,"avg_effort":137.308,"cur_effort":71.781,"hashrate_1h":281085,"hashrate_24h":281085,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":949,"pool_hr":22881098,"sidechain_diff":228810985,"tor_cpu_pct":21.48,"tor_mem":"94.51MiB"}
+{"ts":1782030766,"arm":"tor","reward_share":1.090,"avg_effort":137.308,"cur_effort":107.845,"hashrate_1h":280557,"hashrate_24h":280557,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":953,"pool_hr":22980658,"sidechain_diff":229806588,"tor_cpu_pct":10.91,"tor_mem":"94.63MiB"}
+{"ts":1782031067,"arm":"tor","reward_share":1.089,"avg_effort":137.308,"cur_effort":146.627,"hashrate_1h":281751,"hashrate_24h":281751,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":953,"pool_hr":22972313,"sidechain_diff":229723135,"tor_cpu_pct":52.24,"tor_mem":"94.8MiB"}
+{"ts":1782031369,"arm":"tor","reward_share":1.043,"avg_effort":137.308,"cur_effort":182.905,"hashrate_1h":281458,"hashrate_24h":280514,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":487,"pool_hr":22885364,"sidechain_diff":228853648,"tor_cpu_pct":1.28,"tor_mem":"94.75MiB"}
+{"ts":1782031670,"arm":"tor","reward_share":1.043,"avg_effort":137.308,"cur_effort":214.115,"hashrate_1h":276139,"hashrate_24h":277818,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":472,"pool_hr":23028774,"sidechain_diff":230287740,"tor_cpu_pct":11.69,"tor_mem":"95.28MiB"}
+{"ts":1782031971,"arm":"tor","reward_share":0.997,"avg_effort":137.308,"cur_effort":256.132,"hashrate_1h":280489,"hashrate_24h":280414,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":469,"pool_hr":22832273,"sidechain_diff":228322733,"tor_cpu_pct":63.93,"tor_mem":"101.1MiB"}
+{"ts":1782032272,"arm":"tor","reward_share":0.997,"avg_effort":137.308,"cur_effort":293.113,"hashrate_1h":281744,"hashrate_24h":280568,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":465,"pool_hr":22843994,"sidechain_diff":228439943,"tor_cpu_pct":99.94,"tor_mem":"104.5MiB"}
+{"ts":1782032574,"arm":"tor","reward_share":0.996,"avg_effort":137.308,"cur_effort":328.146,"hashrate_1h":282214,"hashrate_24h":279297,"shares_found":2,"shares_failed":0,"last_share":1782029843,"peers_out":10,"peers_in":0,"peer_list":486,"pool_hr":22855448,"sidechain_diff":228554480,"tor_cpu_pct":44.77,"tor_mem":"105.9MiB"}
+{"ts":1782032875,"arm":"tor","reward_share":1.042,"avg_effort":204.650,"cur_effort":16.119,"hashrate_1h":276345,"hashrate_24h":278235,"shares_found":3,"shares_failed":0,"last_share":1782032715,"peers_out":10,"peers_in":0,"peer_list":502,"pool_hr":22999004,"sidechain_diff":229990042,"tor_cpu_pct":100.12,"tor_mem":"105.7MiB"}
+{"ts":1782033176,"arm":"tor","reward_share":1.086,"avg_effort":164.753,"cur_effort":15.071,"hashrate_1h":279611,"hashrate_24h":281009,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":509,"pool_hr":22985046,"sidechain_diff":229850461,"tor_cpu_pct":29.86,"tor_mem":"106.1MiB"}
+{"ts":1782033477,"arm":"tor","reward_share":1.086,"avg_effort":164.753,"cur_effort":53.536,"hashrate_1h":278509,"hashrate_24h":280587,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":513,"pool_hr":22787291,"sidechain_diff":227872915,"tor_cpu_pct":98.93,"tor_mem":"106.4MiB"}
+{"ts":1782033779,"arm":"tor","reward_share":1.085,"avg_effort":164.753,"cur_effort":91.434,"hashrate_1h":279315,"hashrate_24h":280478,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":520,"pool_hr":22897937,"sidechain_diff":228979372,"tor_cpu_pct":37.57,"tor_mem":"106.1MiB"}
+{"ts":1782034080,"arm":"tor","reward_share":1.040,"avg_effort":164.753,"cur_effort":130.232,"hashrate_1h":282316,"hashrate_24h":281259,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":527,"pool_hr":22895953,"sidechain_diff":228959534,"tor_cpu_pct":100.09,"tor_mem":"106.7MiB"}
+{"ts":1782034381,"arm":"tor","reward_share":1.041,"avg_effort":164.753,"cur_effort":163.055,"hashrate_1h":280064,"hashrate_24h":280221,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":533,"pool_hr":22911193,"sidechain_diff":229111931,"tor_cpu_pct":32.49,"tor_mem":"106.7MiB"}
+{"ts":1782034682,"arm":"tor","reward_share":0.996,"avg_effort":164.753,"cur_effort":199.260,"hashrate_1h":279726,"hashrate_24h":280176,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":537,"pool_hr":23029988,"sidechain_diff":230299888,"tor_cpu_pct":48.18,"tor_mem":"107.6MiB"}
+{"ts":1782034984,"arm":"tor","reward_share":0.952,"avg_effort":164.753,"cur_effort":242.254,"hashrate_1h":283397,"hashrate_24h":281596,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":537,"pool_hr":22888165,"sidechain_diff":228881659,"tor_cpu_pct":54.93,"tor_mem":"109.7MiB"}
+{"ts":1782035285,"arm":"tor","reward_share":0.952,"avg_effort":164.753,"cur_effort":274.432,"hashrate_1h":280680,"hashrate_24h":279038,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":533,"pool_hr":22509501,"sidechain_diff":225095019,"tor_cpu_pct":44.07,"tor_mem":"114.1MiB"}
+{"ts":1782035586,"arm":"tor","reward_share":0.908,"avg_effort":164.753,"cur_effort":313.057,"hashrate_1h":276330,"hashrate_24h":278737,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":532,"pool_hr":22424009,"sidechain_diff":224240090,"tor_cpu_pct":58.23,"tor_mem":"113.3MiB"}
+{"ts":1782035887,"arm":"tor","reward_share":0.865,"avg_effort":164.753,"cur_effort":346.358,"hashrate_1h":273652,"hashrate_24h":277316,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":541,"pool_hr":22280701,"sidechain_diff":222807017,"tor_cpu_pct":77.44,"tor_mem":"112.9MiB"}
+{"ts":1782036189,"arm":"tor","reward_share":0.865,"avg_effort":164.753,"cur_effort":382.467,"hashrate_1h":273853,"hashrate_24h":277115,"shares_found":4,"shares_failed":0,"last_share":1782033043,"peers_out":10,"peers_in":0,"peer_list":555,"pool_hr":22251441,"sidechain_diff":222514410,"tor_cpu_pct":46.08,"tor_mem":"112.5MiB"}
+{"ts":1782036490,"arm":"tor","reward_share":0.865,"avg_effort":211.443,"cur_effort":12.635,"hashrate_1h":274320,"hashrate_24h":276793,"shares_found":5,"shares_failed":0,"last_share":1782036382,"peers_out":10,"peers_in":0,"peer_list":558,"pool_hr":22172345,"sidechain_diff":221723459,"tor_cpu_pct":63.6,"tor_mem":"113.9MiB"}
+{"ts":1782036791,"arm":"tor","reward_share":0.865,"avg_effort":211.443,"cur_effort":47.057,"hashrate_1h":267526,"hashrate_24h":275898,"shares_found":5,"shares_failed":0,"last_share":1782036382,"peers_out":10,"peers_in":0,"peer_list":565,"pool_hr":22366847,"sidechain_diff":223668470,"tor_cpu_pct":41.21,"tor_mem":"114.2MiB"}
+{"ts":1782037092,"arm":"tor","reward_share":0.866,"avg_effort":211.443,"cur_effort":75.660,"hashrate_1h":262954,"hashrate_24h":274033,"shares_found":5,"shares_failed":0,"last_share":1782036382,"peers_out":10,"peers_in":0,"peer_list":568,"pool_hr":22132041,"sidechain_diff":221320417,"tor_cpu_pct":39.5,"tor_mem":"113.5MiB"}
+{"ts":1782037394,"arm":"tor","reward_share":0.866,"avg_effort":211.443,"cur_effort":109.003,"hashrate_1h":260717,"hashrate_24h":273405,"shares_found":5,"shares_failed":0,"last_share":1782036382,"peers_out":10,"peers_in":0,"peer_list":564,"pool_hr":22561449,"sidechain_diff":225614493,"tor_cpu_pct":27.72,"tor_mem":"113.3MiB"}
+{"ts":1782037695,"arm":"tor","reward_share":0.910,"avg_effort":200.172,"cur_effort":5.081,"hashrate_1h":259543,"hashrate_24h":273375,"shares_found":6,"shares_failed":0,"last_share":1782037642,"peers_out":10,"peers_in":0,"peer_list":560,"pool_hr":22224623,"sidechain_diff":222246231,"tor_cpu_pct":34.6,"tor_mem":"113.9MiB"}
+{"ts":1782037996,"arm":"tor","reward_share":0.955,"avg_effort":156.957,"cur_effort":0.000,"hashrate_1h":259747,"hashrate_24h":273589,"shares_found":8,"shares_failed":0,"last_share":1782037993,"peers_out":10,"peers_in":0,"peer_list":560,"pool_hr":22141285,"sidechain_diff":221412850,"tor_cpu_pct":37.16,"tor_mem":"112.7MiB"}
+{"ts":1782038297,"arm":"tor","reward_share":0.954,"avg_effort":156.957,"cur_effort":40.588,"hashrate_1h":262592,"hashrate_24h":274519,"shares_found":8,"shares_failed":0,"last_share":1782037993,"peers_out":10,"peers_in":0,"peer_list":559,"pool_hr":22891306,"sidechain_diff":228913061,"tor_cpu_pct":34.2,"tor_mem":"112.8MiB"}
+{"ts":1782038599,"arm":"tor","reward_share":0.954,"avg_effort":156.957,"cur_effort":80.046,"hashrate_1h":261216,"hashrate_24h":274874,"shares_found":8,"shares_failed":0,"last_share":1782037993,"peers_out":10,"peers_in":0,"peer_list":570,"pool_hr":22490504,"sidechain_diff":224905046,"tor_cpu_pct":30.85,"tor_mem":"112.4MiB"}
+{"ts":1782038900,"arm":"tor","reward_share":0.910,"avg_effort":156.957,"cur_effort":108.481,"hashrate_1h":260298,"hashrate_24h":273136,"shares_found":8,"shares_failed":0,"last_share":1782037993,"peers_out":10,"peers_in":0,"peer_list":580,"pool_hr":22223975,"sidechain_diff":222239751,"tor_cpu_pct":34.19,"tor_mem":"112.7MiB"}
+{"ts":1782039201,"arm":"tor","reward_share":0.910,"avg_effort":156.957,"cur_effort":137.452,"hashrate_1h":259159,"hashrate_24h":272707,"shares_found":8,"shares_failed":0,"last_share":1782037993,"peers_out":10,"peers_in":0,"peer_list":578,"pool_hr":23030116,"sidechain_diff":230301166,"tor_cpu_pct":34.59,"tor_mem":"112.6MiB"}
+{"ts":1782039502,"arm":"tor","reward_share":0.909,"avg_effort":156.957,"cur_effort":176.215,"hashrate_1h":261188,"hashrate_24h":272958,"shares_found":8,"shares_failed":0,"last_share":1782037993,"peers_out":10,"peers_in":0,"peer_list":577,"pool_hr":22898998,"sidechain_diff":228989982,"tor_cpu_pct":21.19,"tor_mem":"112.6MiB"}
+{"ts":1782039804,"arm":"tor","reward_share":0.910,"avg_effort":160.319,"cur_effort":18.089,"hashrate_1h":259241,"hashrate_24h":271644,"shares_found":9,"shares_failed":0,"last_share":1782039585,"peers_out":10,"peers_in":0,"peer_list":586,"pool_hr":22336646,"sidechain_diff":223366465,"tor_cpu_pct":21.25,"tor_mem":"112.5MiB"}
+{"ts":1782040105,"arm":"tor","reward_share":0.952,"avg_effort":148.602,"cur_effort":12.854,"hashrate_1h":257515,"hashrate_24h":271129,"shares_found":10,"shares_failed":0,"last_share":1782040000,"peers_out":10,"peers_in":0,"peer_list":585,"pool_hr":22188968,"sidechain_diff":221889686,"tor_cpu_pct":26.62,"tor_mem":"112.3MiB"}
+{"ts":1782040406,"arm":"tor","reward_share":0.952,"avg_effort":148.602,"cur_effort":45.917,"hashrate_1h":257369,"hashrate_24h":270675,"shares_found":10,"shares_failed":0,"last_share":1782040000,"peers_out":10,"peers_in":0,"peer_list":586,"pool_hr":22096976,"sidechain_diff":220969766,"tor_cpu_pct":30.77,"tor_mem":"112MiB"}
+{"ts":1782040707,"arm":"tor","reward_share":0.952,"avg_effort":142.367,"cur_effort":4.682,"hashrate_1h":261617,"hashrate_24h":270606,"shares_found":11,"shares_failed":0,"last_share":1782040643,"peers_out":10,"peers_in":0,"peer_list":591,"pool_hr":22064058,"sidechain_diff":220640589,"tor_cpu_pct":25.61,"tor_mem":"111.8MiB"}
+{"ts":1782041009,"arm":"tor","reward_share":0.952,"avg_effort":142.367,"cur_effort":48.447,"hashrate_1h":264898,"hashrate_24h":271479,"shares_found":11,"shares_failed":0,"last_share":1782040643,"peers_out":10,"peers_in":0,"peer_list":592,"pool_hr":22042217,"sidechain_diff":220422175,"tor_cpu_pct":23.47,"tor_mem":"111.5MiB"}
+{"ts":1782041310,"arm":"tor","reward_share":0.951,"avg_effort":142.367,"cur_effort":81.729,"hashrate_1h":264622,"hashrate_24h":271019,"shares_found":11,"shares_failed":0,"last_share":1782040643,"peers_out":10,"peers_in":0,"peer_list":599,"pool_hr":22080923,"sidechain_diff":220809234,"tor_cpu_pct":17.2,"tor_mem":"111.6MiB"}
+{"ts":1782041611,"arm":"tor","reward_share":0.952,"avg_effort":142.367,"cur_effort":119.329,"hashrate_1h":265899,"hashrate_24h":271315,"shares_found":11,"shares_failed":0,"last_share":1782040643,"peers_out":10,"peers_in":0,"peer_list":604,"pool_hr":22372249,"sidechain_diff":223722492,"tor_cpu_pct":23.74,"tor_mem":"111.7MiB"}
+{"ts":1782041912,"arm":"tor","reward_share":0.952,"avg_effort":142.367,"cur_effort":155.401,"hashrate_1h":259680,"hashrate_24h":270998,"shares_found":11,"shares_failed":0,"last_share":1782040643,"peers_out":10,"peers_in":0,"peer_list":601,"pool_hr":22253664,"sidechain_diff":222536644,"tor_cpu_pct":19.49,"tor_mem":"111.4MiB"}
+{"ts":1782042214,"arm":"tor","reward_share":0.997,"avg_effort":134.558,"cur_effort":10.700,"hashrate_1h":261127,"hashrate_24h":271346,"shares_found":13,"shares_failed":0,"last_share":1782042120,"peers_out":10,"peers_in":0,"peer_list":597,"pool_hr":22238750,"sidechain_diff":222387508,"tor_cpu_pct":27.7,"tor_mem":"110.1MiB"}
+{"ts":1782042515,"arm":"tor","reward_share":1.041,"avg_effort":119.967,"cur_effort":4.321,"hashrate_1h":266448,"hashrate_24h":271905,"shares_found":15,"shares_failed":0,"last_share":1782042483,"peers_out":10,"peers_in":0,"peer_list":591,"pool_hr":22240926,"sidechain_diff":222409268,"tor_cpu_pct":20.96,"tor_mem":"109.6MiB"}
+{"ts":1782042816,"arm":"tor","reward_share":0.996,"avg_effort":119.967,"cur_effort":37.497,"hashrate_1h":267293,"hashrate_24h":271462,"shares_found":15,"shares_failed":0,"last_share":1782042483,"peers_out":10,"peers_in":0,"peer_list":588,"pool_hr":22568178,"sidechain_diff":225681789,"tor_cpu_pct":29.34,"tor_mem":"109.7MiB"}
+{"ts":1782043117,"arm":"tor","reward_share":0.951,"avg_effort":119.967,"cur_effort":69.325,"hashrate_1h":265372,"hashrate_24h":271205,"shares_found":15,"shares_failed":0,"last_share":1782042483,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22501796,"sidechain_diff":225017967,"tor_cpu_pct":19.66,"tor_mem":"108.3MiB"}
+{"ts":1782043419,"arm":"tor","reward_share":0.938,"avg_effort":112.173,"cur_effort":5.813,"hashrate_1h":273508,"hashrate_24h":271791,"shares_found":17,"shares_failed":0,"last_share":1782043355,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22347788,"sidechain_diff":223477885,"tor_cpu_pct":0.18,"tor_mem":"106.2MiB"}
+{"ts":1782043720,"arm":"tor","reward_share":0.938,"avg_effort":112.173,"cur_effort":40.319,"hashrate_1h":272427,"hashrate_24h":271412,"shares_found":17,"shares_failed":0,"last_share":1782043355,"peers_out":10,"peers_in":0,"peer_list":594,"pool_hr":22308644,"sidechain_diff":223086448,"tor_cpu_pct":19.18,"tor_mem":"105.2MiB"}
+{"ts":1782044021,"arm":"tor","reward_share":0.892,"avg_effort":112.173,"cur_effort":86.879,"hashrate_1h":279232,"hashrate_24h":272678,"shares_found":17,"shares_failed":0,"last_share":1782043355,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":22512458,"sidechain_diff":225124587,"tor_cpu_pct":17.11,"tor_mem":"104.5MiB"}
+{"ts":1782044322,"arm":"tor","reward_share":0.892,"avg_effort":112.173,"cur_effort":124.128,"hashrate_1h":283149,"hashrate_24h":273114,"shares_found":17,"shares_failed":0,"last_share":1782043355,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22676867,"sidechain_diff":226768670,"tor_cpu_pct":22.3,"tor_mem":"104.6MiB"}
+{"ts":1782044624,"arm":"tor","reward_share":0.939,"avg_effort":114.012,"cur_effort":18.201,"hashrate_1h":280489,"hashrate_24h":273420,"shares_found":18,"shares_failed":0,"last_share":1782044459,"peers_out":10,"peers_in":0,"peer_list":592,"pool_hr":22839196,"sidechain_diff":228391966,"tor_cpu_pct":18.24,"tor_mem":"104.6MiB"}
+{"ts":1782044925,"arm":"tor","reward_share":0.939,"avg_effort":114.012,"cur_effort":56.596,"hashrate_1h":282611,"hashrate_24h":273582,"shares_found":18,"shares_failed":0,"last_share":1782044459,"peers_out":10,"peers_in":0,"peer_list":594,"pool_hr":22767598,"sidechain_diff":227675980,"tor_cpu_pct":10.7,"tor_mem":"104.5MiB"}
+{"ts":1782045226,"arm":"tor","reward_share":0.938,"avg_effort":114.012,"cur_effort":86.344,"hashrate_1h":277421,"hashrate_24h":272848,"shares_found":18,"shares_failed":0,"last_share":1782044459,"peers_out":10,"peers_in":0,"peer_list":595,"pool_hr":22854029,"sidechain_diff":228540290,"tor_cpu_pct":0.3,"tor_mem":"104MiB"}
+{"ts":1782045527,"arm":"tor","reward_share":0.938,"avg_effort":114.012,"cur_effort":123.344,"hashrate_1h":280910,"hashrate_24h":272998,"shares_found":18,"shares_failed":0,"last_share":1782044459,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":22679989,"sidechain_diff":226799896,"tor_cpu_pct":23.26,"tor_mem":"100.6MiB"}
+{"ts":1782045829,"arm":"tor","reward_share":0.939,"avg_effort":114.012,"cur_effort":164.819,"hashrate_1h":280598,"hashrate_24h":273403,"shares_found":18,"shares_failed":0,"last_share":1782044459,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22641052,"sidechain_diff":226410520,"tor_cpu_pct":3.6,"tor_mem":"100.4MiB"}
+{"ts":1782046130,"arm":"tor","reward_share":0.985,"avg_effort":118.313,"cur_effort":7.034,"hashrate_1h":281408,"hashrate_24h":273775,"shares_found":19,"shares_failed":0,"last_share":1782046054,"peers_out":10,"peers_in":0,"peer_list":584,"pool_hr":22614387,"sidechain_diff":226143879,"tor_cpu_pct":5.27,"tor_mem":"100MiB"}
+{"ts":1782046431,"arm":"tor","reward_share":0.984,"avg_effort":112.969,"cur_effort":31.327,"hashrate_1h":281960,"hashrate_24h":273522,"shares_found":20,"shares_failed":0,"last_share":1782046164,"peers_out":10,"peers_in":0,"peer_list":586,"pool_hr":22661591,"sidechain_diff":226615912,"tor_cpu_pct":0.47,"tor_mem":"100MiB"}
+{"ts":1782046732,"arm":"tor","reward_share":0.984,"avg_effort":112.969,"cur_effort":67.609,"hashrate_1h":285143,"hashrate_24h":273624,"shares_found":20,"shares_failed":0,"last_share":1782046164,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":22676322,"sidechain_diff":226763220,"tor_cpu_pct":14.17,"tor_mem":"99.76MiB"}
+{"ts":1782047034,"arm":"tor","reward_share":0.983,"avg_effort":112.969,"cur_effort":103.595,"hashrate_1h":283161,"hashrate_24h":273703,"shares_found":20,"shares_failed":0,"last_share":1782046164,"peers_out":10,"peers_in":0,"peer_list":587,"pool_hr":22907432,"sidechain_diff":229074326,"tor_cpu_pct":0.95,"tor_mem":"99.81MiB"}
+{"ts":1782047335,"arm":"tor","reward_share":1.028,"avg_effort":112.857,"cur_effort":27.937,"hashrate_1h":280501,"hashrate_24h":273468,"shares_found":21,"shares_failed":0,"last_share":1782047091,"peers_out":10,"peers_in":0,"peer_list":587,"pool_hr":22584661,"sidechain_diff":225846611,"tor_cpu_pct":12,"tor_mem":"100.1MiB"}
+{"ts":1782047636,"arm":"tor","reward_share":1.074,"avg_effort":109.083,"cur_effort":35.144,"hashrate_1h":278750,"hashrate_24h":273766,"shares_found":22,"shares_failed":0,"last_share":1782047347,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":22504335,"sidechain_diff":225043359,"tor_cpu_pct":1.15,"tor_mem":"99.59MiB"}
+{"ts":1782047937,"arm":"tor","reward_share":1.028,"avg_effort":109.083,"cur_effort":79.062,"hashrate_1h":280972,"hashrate_24h":274322,"shares_found":22,"shares_failed":0,"last_share":1782047347,"peers_out":10,"peers_in":0,"peer_list":587,"pool_hr":22471504,"sidechain_diff":224715040,"tor_cpu_pct":12.41,"tor_mem":"99.57MiB"}
+{"ts":1782048239,"arm":"tor","reward_share":1.072,"avg_effort":107.804,"cur_effort":32.715,"hashrate_1h":277375,"hashrate_24h":274163,"shares_found":23,"shares_failed":0,"last_share":1782047937,"peers_out":10,"peers_in":0,"peer_list":584,"pool_hr":22380297,"sidechain_diff":223802970,"tor_cpu_pct":1.45,"tor_mem":"99.78MiB"}
+{"ts":1782048540,"arm":"tor","reward_share":1.071,"avg_effort":107.804,"cur_effort":66.802,"hashrate_1h":274519,"hashrate_24h":273770,"shares_found":23,"shares_failed":0,"last_share":1782047937,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":22593986,"sidechain_diff":225939868,"tor_cpu_pct":12.86,"tor_mem":"99.78MiB"}
+{"ts":1782048841,"arm":"tor","reward_share":1.072,"avg_effort":107.804,"cur_effort":99.135,"hashrate_1h":276070,"hashrate_24h":273431,"shares_found":23,"shares_failed":0,"last_share":1782047937,"peers_out":10,"peers_in":0,"peer_list":586,"pool_hr":22572607,"sidechain_diff":225726076,"tor_cpu_pct":17.52,"tor_mem":"100MiB"}
+{"ts":1782049142,"arm":"tor","reward_share":1.127,"avg_effort":107.708,"cur_effort":34.664,"hashrate_1h":279209,"hashrate_24h":273948,"shares_found":24,"shares_failed":0,"last_share":1782048866,"peers_out":10,"peers_in":0,"peer_list":585,"pool_hr":22539810,"sidechain_diff":225398107,"tor_cpu_pct":18.3,"tor_mem":"100.1MiB"}
+{"ts":1782049444,"arm":"tor","reward_share":1.081,"avg_effort":107.708,"cur_effort":68.444,"hashrate_1h":274843,"hashrate_24h":273548,"shares_found":24,"shares_failed":0,"last_share":1782048866,"peers_out":10,"peers_in":0,"peer_list":585,"pool_hr":22549290,"sidechain_diff":225492903,"tor_cpu_pct":14.57,"tor_mem":"99.8MiB"}
+{"ts":1782049745,"arm":"tor","reward_share":1.082,"avg_effort":107.708,"cur_effort":97.401,"hashrate_1h":268768,"hashrate_24h":272974,"shares_found":24,"shares_failed":0,"last_share":1782048866,"peers_out":10,"peers_in":0,"peer_list":583,"pool_hr":22789238,"sidechain_diff":227892389,"tor_cpu_pct":17.64,"tor_mem":"90.95MiB"}
+{"ts":1782050046,"arm":"tor","reward_share":1.045,"avg_effort":107.708,"cur_effort":130.128,"hashrate_1h":267728,"hashrate_24h":272594,"shares_found":24,"shares_failed":0,"last_share":1782048866,"peers_out":10,"peers_in":0,"peer_list":584,"pool_hr":22614750,"sidechain_diff":226147504,"tor_cpu_pct":14.44,"tor_mem":"90.87MiB"}
+{"ts":1782050347,"arm":"tor","reward_share":1.046,"avg_effort":107.708,"cur_effort":160.081,"hashrate_1h":264019,"hashrate_24h":272150,"shares_found":24,"shares_failed":0,"last_share":1782048866,"peers_out":10,"peers_in":0,"peer_list":581,"pool_hr":22948986,"sidechain_diff":229489865,"tor_cpu_pct":22.4,"tor_mem":"90.86MiB"}
+{"ts":1782050649,"arm":"tor","reward_share":1.092,"avg_effort":110.266,"cur_effort":24.510,"hashrate_1h":263970,"hashrate_24h":272045,"shares_found":25,"shares_failed":0,"last_share":1782050420,"peers_out":10,"peers_in":0,"peer_list":584,"pool_hr":22482067,"sidechain_diff":224820673,"tor_cpu_pct":16.3,"tor_mem":"90.77MiB"}
+{"ts":1782050950,"arm":"tor","reward_share":1.092,"avg_effort":110.266,"cur_effort":61.584,"hashrate_1h":264348,"hashrate_24h":272080,"shares_found":25,"shares_failed":0,"last_share":1782050420,"peers_out":10,"peers_in":0,"peer_list":585,"pool_hr":22659665,"sidechain_diff":226596657,"tor_cpu_pct":18.94,"tor_mem":"90.8MiB"}
+{"ts":1782051251,"arm":"tor","reward_share":1.139,"avg_effort":108.728,"cur_effort":33.303,"hashrate_1h":268133,"hashrate_24h":272865,"shares_found":26,"shares_failed":0,"last_share":1782050985,"peers_out":10,"peers_in":0,"peer_list":585,"pool_hr":22804041,"sidechain_diff":228040410,"tor_cpu_pct":6.13,"tor_mem":"91.04MiB"}
+{"ts":1782051552,"arm":"tor","reward_share":1.138,"avg_effort":108.728,"cur_effort":72.848,"hashrate_1h":265627,"hashrate_24h":273135,"shares_found":26,"shares_failed":0,"last_share":1782050985,"peers_out":10,"peers_in":0,"peer_list":586,"pool_hr":23263617,"sidechain_diff":232636175,"tor_cpu_pct":25.23,"tor_mem":"90.88MiB"}
+{"ts":1782051854,"arm":"tor","reward_share":1.092,"avg_effort":108.728,"cur_effort":112.831,"hashrate_1h":269427,"hashrate_24h":273548,"shares_found":26,"shares_failed":0,"last_share":1782050985,"peers_out":10,"peers_in":0,"peer_list":588,"pool_hr":23023847,"sidechain_diff":230238478,"tor_cpu_pct":25.05,"tor_mem":"90.76MiB"}
+{"ts":1782052155,"arm":"tor","reward_share":1.137,"avg_effort":109.529,"cur_effort":20.719,"hashrate_1h":272920,"hashrate_24h":273692,"shares_found":27,"shares_failed":0,"last_share":1782051961,"peers_out":10,"peers_in":0,"peer_list":588,"pool_hr":22843884,"sidechain_diff":228438848,"tor_cpu_pct":17.67,"tor_mem":"90.88MiB"}
+{"ts":1782052456,"arm":"tor","reward_share":1.137,"avg_effort":109.529,"cur_effort":51.201,"hashrate_1h":272161,"hashrate_24h":273312,"shares_found":27,"shares_failed":0,"last_share":1782051961,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":23375119,"sidechain_diff":233751195,"tor_cpu_pct":18.14,"tor_mem":"90.77MiB"}
+{"ts":1782052757,"arm":"tor","reward_share":1.183,"avg_effort":107.504,"cur_effort":33.624,"hashrate_1h":270790,"hashrate_24h":273302,"shares_found":28,"shares_failed":0,"last_share":1782052474,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":23067220,"sidechain_diff":230672209,"tor_cpu_pct":15.17,"tor_mem":"91.1MiB"}
+{"ts":1782053059,"arm":"tor","reward_share":1.275,"avg_effort":101.500,"cur_effort":23.567,"hashrate_1h":268216,"hashrate_24h":272673,"shares_found":30,"shares_failed":0,"last_share":1782052790,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":22885507,"sidechain_diff":228855076,"tor_cpu_pct":32.55,"tor_mem":"91.12MiB"}
+{"ts":1782053360,"arm":"tor","reward_share":1.365,"avg_effort":96.803,"cur_effort":7.943,"hashrate_1h":272322,"hashrate_24h":272877,"shares_found":32,"shares_failed":0,"last_share":1782053295,"peers_out":10,"peers_in":0,"peer_list":592,"pool_hr":23086960,"sidechain_diff":230869605,"tor_cpu_pct":15.6,"tor_mem":"91.32MiB"}
+{"ts":1782053661,"arm":"tor","reward_share":1.366,"avg_effort":96.803,"cur_effort":50.728,"hashrate_1h":279632,"hashrate_24h":273440,"shares_found":32,"shares_failed":0,"last_share":1782053295,"peers_out":10,"peers_in":0,"peer_list":589,"pool_hr":22800731,"sidechain_diff":228007310,"tor_cpu_pct":0.18,"tor_mem":"91.04MiB"}
+{"ts":1782053962,"arm":"tor","reward_share":1.402,"avg_effort":95.535,"cur_effort":30.051,"hashrate_1h":281969,"hashrate_24h":273477,"shares_found":33,"shares_failed":0,"last_share":1782053682,"peers_out":10,"peers_in":0,"peer_list":588,"pool_hr":22990248,"sidechain_diff":229902482,"tor_cpu_pct":7.05,"tor_mem":"90.96MiB"}
+{"ts":1782054264,"arm":"tor","reward_share":1.449,"avg_effort":94.014,"cur_effort":20.788,"hashrate_1h":282246,"hashrate_24h":273434,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":585,"pool_hr":22855580,"sidechain_diff":228555801,"tor_cpu_pct":18.39,"tor_mem":"90.48MiB"}
+{"ts":1782054565,"arm":"tor","reward_share":1.449,"avg_effort":94.014,"cur_effort":50.606,"hashrate_1h":278818,"hashrate_24h":272995,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":586,"pool_hr":22876201,"sidechain_diff":228762016,"tor_cpu_pct":16.58,"tor_mem":"90.8MiB"}
+{"ts":1782054866,"arm":"tor","reward_share":1.449,"avg_effort":94.014,"cur_effort":89.671,"hashrate_1h":274270,"hashrate_24h":273137,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22860191,"sidechain_diff":228601913,"tor_cpu_pct":19.85,"tor_mem":"90.5MiB"}
+{"ts":1782055167,"arm":"tor","reward_share":1.357,"avg_effort":94.014,"cur_effort":123.044,"hashrate_1h":272378,"hashrate_24h":272939,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22951330,"sidechain_diff":229513304,"tor_cpu_pct":16.1,"tor_mem":"90.62MiB"}
+{"ts":1782055469,"arm":"tor","reward_share":1.357,"avg_effort":94.014,"cur_effort":160.237,"hashrate_1h":269198,"hashrate_24h":272976,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":590,"pool_hr":22916318,"sidechain_diff":229163187,"tor_cpu_pct":22.38,"tor_mem":"90.68MiB"}
+{"ts":1782055770,"arm":"tor","reward_share":1.357,"avg_effort":94.014,"cur_effort":185.886,"hashrate_1h":262181,"hashrate_24h":272196,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":594,"pool_hr":22840199,"sidechain_diff":228401990,"tor_cpu_pct":21.19,"tor_mem":"90.64MiB"}
+{"ts":1782056071,"arm":"tor","reward_share":1.357,"avg_effort":94.014,"cur_effort":222.563,"hashrate_1h":263606,"hashrate_24h":272046,"shares_found":34,"shares_failed":0,"last_share":1782054093,"peers_out":10,"peers_in":0,"peer_list":597,"pool_hr":22751643,"sidechain_diff":227516433,"tor_cpu_pct":23.52,"tor_mem":"90.8MiB"}
+{"ts":1782056372,"arm":"tor","reward_share":1.403,"avg_effort":98.396,"cur_effort":18.418,"hashrate_1h":267697,"hashrate_24h":272617,"shares_found":35,"shares_failed":0,"last_share":1782056202,"peers_out":10,"peers_in":0,"peer_list":598,"pool_hr":22685852,"sidechain_diff":226858524,"tor_cpu_pct":25.37,"tor_mem":"90.73MiB"}
+{"ts":1782056673,"arm":"tor","reward_share":1.449,"avg_effort":97.048,"cur_effort":9.267,"hashrate_1h":276412,"hashrate_24h":273049,"shares_found":36,"shares_failed":0,"last_share":1782056576,"peers_out":10,"peers_in":0,"peer_list":601,"pool_hr":22877973,"sidechain_diff":228779737,"tor_cpu_pct":30.15,"tor_mem":"90.56MiB"}
+{"ts":1782056975,"arm":"tor","reward_share":1.495,"avg_effort":95.169,"cur_effort":12.279,"hashrate_1h":270700,"hashrate_24h":272718,"shares_found":37,"shares_failed":0,"last_share":1782056862,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":22765304,"sidechain_diff":227653042,"tor_cpu_pct":29.02,"tor_mem":"89.77MiB"}
+{"ts":1782057276,"arm":"tor","reward_share":1.495,"avg_effort":95.169,"cur_effort":37.496,"hashrate_1h":260179,"hashrate_24h":271845,"shares_found":37,"shares_failed":0,"last_share":1782056862,"peers_out":10,"peers_in":0,"peer_list":595,"pool_hr":22756555,"sidechain_diff":227565551,"tor_cpu_pct":17.62,"tor_mem":"90MiB"}
+{"ts":1782057577,"arm":"tor","reward_share":1.495,"avg_effort":95.169,"cur_effort":72.574,"hashrate_1h":259410,"hashrate_24h":271853,"shares_found":37,"shares_failed":0,"last_share":1782056862,"peers_out":10,"peers_in":0,"peer_list":598,"pool_hr":22765292,"sidechain_diff":227652922,"tor_cpu_pct":2.05,"tor_mem":"90.27MiB"}
+{"ts":1782057878,"arm":"tor","reward_share":1.494,"avg_effort":95.169,"cur_effort":105.002,"hashrate_1h":257974,"hashrate_24h":271578,"shares_found":37,"shares_failed":0,"last_share":1782056862,"peers_out":10,"peers_in":0,"peer_list":596,"pool_hr":22746096,"sidechain_diff":227460963,"tor_cpu_pct":11.11,"tor_mem":"89.93MiB"}
+{"ts":1782058180,"arm":"tor","reward_share":1.494,"avg_effort":95.169,"cur_effort":141.815,"hashrate_1h":261297,"hashrate_24h":271714,"shares_found":37,"shares_failed":0,"last_share":1782056862,"peers_out":10,"peers_in":0,"peer_list":594,"pool_hr":23027215,"sidechain_diff":230272158,"tor_cpu_pct":1.09,"tor_mem":"89.64MiB"}
+{"ts":1782058481,"arm":"tor","reward_share":1.538,"avg_effort":96.691,"cur_effort":26.873,"hashrate_1h":260994,"hashrate_24h":271716,"shares_found":38,"shares_failed":0,"last_share":1782058258,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":22553744,"sidechain_diff":225537442,"tor_cpu_pct":1.6,"tor_mem":"89.59MiB"}
+{"ts":1782058782,"arm":"tor","reward_share":1.494,"avg_effort":96.691,"cur_effort":57.967,"hashrate_1h":258751,"hashrate_24h":271409,"shares_found":38,"shares_failed":0,"last_share":1782058258,"peers_out":10,"peers_in":0,"peer_list":594,"pool_hr":22479999,"sidechain_diff":224799990,"tor_cpu_pct":0.24,"tor_mem":"89.45MiB"}
+{"ts":1782059083,"arm":"tor","reward_share":1.493,"avg_effort":96.691,"cur_effort":91.879,"hashrate_1h":258149,"hashrate_24h":271283,"shares_found":38,"shares_failed":0,"last_share":1782058258,"peers_out":10,"peers_in":0,"peer_list":601,"pool_hr":22511447,"sidechain_diff":225114476,"tor_cpu_pct":12.64,"tor_mem":"89.7MiB"}
+{"ts":1782059385,"arm":"tor","reward_share":1.537,"avg_effort":97.292,"cur_effort":10.993,"hashrate_1h":266178,"hashrate_24h":271387,"shares_found":39,"shares_failed":0,"last_share":1782059288,"peers_out":10,"peers_in":0,"peer_list":597,"pool_hr":22577196,"sidechain_diff":225771969,"tor_cpu_pct":0.14,"tor_mem":"89.57MiB"}
+{"ts":1782059686,"arm":"tor","reward_share":1.537,"avg_effort":97.292,"cur_effort":45.085,"hashrate_1h":265815,"hashrate_24h":271344,"shares_found":39,"shares_failed":0,"last_share":1782059288,"peers_out":10,"peers_in":0,"peer_list":594,"pool_hr":22660993,"sidechain_diff":226609936,"tor_cpu_pct":13.14,"tor_mem":"89.35MiB"}
+{"ts":1782059987,"arm":"tor","reward_share":1.536,"avg_effort":97.292,"cur_effort":92.742,"hashrate_1h":268653,"hashrate_24h":272177,"shares_found":39,"shares_failed":0,"last_share":1782059288,"peers_out":10,"peers_in":0,"peer_list":595,"pool_hr":22693158,"sidechain_diff":226931580,"tor_cpu_pct":12.39,"tor_mem":"89.55MiB"}
+{"ts":1782060288,"arm":"tor","reward_share":1.537,"avg_effort":97.986,"cur_effort":1.340,"hashrate_1h":263778,"hashrate_24h":272005,"shares_found":40,"shares_failed":0,"last_share":1782060256,"peers_out":10,"peers_in":0,"peer_list":592,"pool_hr":22687533,"sidechain_diff":226875330,"tor_cpu_pct":1.64,"tor_mem":"89.58MiB"}
+{"ts":1782060590,"arm":"tor","reward_share":1.448,"avg_effort":97.986,"cur_effort":40.073,"hashrate_1h":267145,"hashrate_24h":272080,"shares_found":40,"shares_failed":0,"last_share":1782060256,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":22405174,"sidechain_diff":224051747,"tor_cpu_pct":0.64,"tor_mem":"89.83MiB"}
+{"ts":1782060891,"arm":"tor","reward_share":1.448,"avg_effort":97.986,"cur_effort":70.457,"hashrate_1h":271081,"hashrate_24h":271792,"shares_found":40,"shares_failed":0,"last_share":1782060256,"peers_out":10,"peers_in":0,"peer_list":591,"pool_hr":22811939,"sidechain_diff":228119391,"tor_cpu_pct":0.89,"tor_mem":"89.41MiB"}
+{"ts":1782061192,"arm":"tor","reward_share":1.448,"avg_effort":97.986,"cur_effort":111.353,"hashrate_1h":273558,"hashrate_24h":272047,"shares_found":40,"shares_failed":0,"last_share":1782060256,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":22489242,"sidechain_diff":224892425,"tor_cpu_pct":0.31,"tor_mem":"89.51MiB"}
+{"ts":1782061493,"arm":"tor","reward_share":1.493,"avg_effort":98.951,"cur_effort":6.182,"hashrate_1h":272854,"hashrate_24h":271797,"shares_found":41,"shares_failed":0,"last_share":1782061425,"peers_out":10,"peers_in":0,"peer_list":593,"pool_hr":22437671,"sidechain_diff":224376713,"tor_cpu_pct":3.97,"tor_mem":"89.3MiB"}
+{"ts":1782061795,"arm":"tor","reward_share":1.494,"avg_effort":98.951,"cur_effort":35.824,"hashrate_1h":269186,"hashrate_24h":271379,"shares_found":41,"shares_failed":0,"last_share":1782061425,"peers_out":10,"peers_in":0,"peer_list":592,"pool_hr":22401055,"sidechain_diff":224010554,"tor_cpu_pct":1.96,"tor_mem":"89.46MiB"}
+{"ts":1782062096,"arm":"tor","reward_share":1.448,"avg_effort":98.951,"cur_effort":71.284,"hashrate_1h":267488,"hashrate_24h":271321,"shares_found":41,"shares_failed":0,"last_share":1782061425,"peers_out":10,"peers_in":0,"peer_list":596,"pool_hr":22500907,"sidechain_diff":225009071,"tor_cpu_pct":1.07,"tor_mem":"89.29MiB"}
+{"ts":1782062397,"arm":"tor","reward_share":1.406,"avg_effort":98.951,"cur_effort":112.415,"hashrate_1h":272758,"hashrate_24h":271458,"shares_found":41,"shares_failed":0,"last_share":1782061425,"peers_out":10,"peers_in":0,"peer_list":597,"pool_hr":22115844,"sidechain_diff":221158449,"tor_cpu_pct":16.28,"tor_mem":"90.02MiB"}
+{"ts":1782062698,"arm":"tor","reward_share":1.450,"avg_effort":99.369,"cur_effort":34.356,"hashrate_1h":274659,"hashrate_24h":271581,"shares_found":42,"shares_failed":0,"last_share":1782062442,"peers_out":10,"peers_in":0,"peer_list":598,"pool_hr":22295798,"sidechain_diff":222957989,"tor_cpu_pct":3.17,"tor_mem":"89.24MiB"}
+{"ts":1782063000,"arm":"tor","reward_share":1.406,"avg_effort":99.369,"cur_effort":66.448,"hashrate_1h":269585,"hashrate_24h":271223,"shares_found":42,"shares_failed":0,"last_share":1782062442,"peers_out":10,"peers_in":0,"peer_list":599,"pool_hr":22003586,"sidechain_diff":220035865,"tor_cpu_pct":3.65,"tor_mem":"88.79MiB"}
+{"ts":1782063301,"arm":"tor","reward_share":1.406,"avg_effort":99.369,"cur_effort":104.408,"hashrate_1h":270792,"hashrate_24h":271366,"shares_found":42,"shares_failed":0,"last_share":1782062442,"peers_out":10,"peers_in":0,"peer_list":600,"pool_hr":21991330,"sidechain_diff":219913305,"tor_cpu_pct":3.64,"tor_mem":"88.8MiB"}
+{"ts":1782063602,"arm":"tor","reward_share":1.408,"avg_effort":99.369,"cur_effort":145.693,"hashrate_1h":264787,"hashrate_24h":271455,"shares_found":42,"shares_failed":0,"last_share":1782062442,"peers_out":10,"peers_in":0,"peer_list":604,"pool_hr":21927769,"sidechain_diff":219277691,"tor_cpu_pct":20.57,"tor_mem":"88.96MiB"}
+{"ts":1782063903,"arm":"tor","reward_share":1.408,"avg_effort":99.369,"cur_effort":176.754,"hashrate_1h":266050,"hashrate_24h":271321,"shares_found":42,"shares_failed":0,"last_share":1782062442,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":21991082,"sidechain_diff":219910822,"tor_cpu_pct":2.19,"tor_mem":"88.73MiB"}
+{"ts":1782064205,"arm":"tor","reward_share":1.407,"avg_effort":99.369,"cur_effort":219.085,"hashrate_1h":268347,"hashrate_24h":271742,"shares_found":42,"shares_failed":0,"last_share":1782062442,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":22337883,"sidechain_diff":223378832,"tor_cpu_pct":1.16,"tor_mem":"88.95MiB"}
+{"ts":1782064506,"arm":"tor","reward_share":1.407,"avg_effort":102.873,"cur_effort":5.939,"hashrate_1h":272937,"hashrate_24h":271877,"shares_found":43,"shares_failed":0,"last_share":1782064448,"peers_out":10,"peers_in":0,"peer_list":619,"pool_hr":22092204,"sidechain_diff":220922041,"tor_cpu_pct":18.44,"tor_mem":"88.71MiB"}
+{"ts":1782064807,"arm":"tor","reward_share":1.317,"avg_effort":102.873,"cur_effort":43.514,"hashrate_1h":271283,"hashrate_24h":271888,"shares_found":43,"shares_failed":0,"last_share":1782064448,"peers_out":10,"peers_in":0,"peer_list":618,"pool_hr":22251680,"sidechain_diff":222516807,"tor_cpu_pct":25.13,"tor_mem":"88.75MiB"}
+{"ts":1782065108,"arm":"tor","reward_share":1.273,"avg_effort":102.873,"cur_effort":77.061,"hashrate_1h":270659,"hashrate_24h":271621,"shares_found":43,"shares_failed":0,"last_share":1782064448,"peers_out":10,"peers_in":0,"peer_list":617,"pool_hr":22218384,"sidechain_diff":222183846,"tor_cpu_pct":1.17,"tor_mem":"89.05MiB"}
+{"ts":1782065410,"arm":"tor","reward_share":1.273,"avg_effort":102.873,"cur_effort":117.958,"hashrate_1h":276649,"hashrate_24h":271876,"shares_found":43,"shares_failed":0,"last_share":1782064448,"peers_out":10,"peers_in":0,"peer_list":619,"pool_hr":22290170,"sidechain_diff":222901708,"tor_cpu_pct":2.99,"tor_mem":"89.07MiB"}
+{"ts":1782065711,"arm":"tor","reward_share":1.229,"avg_effort":102.873,"cur_effort":153.241,"hashrate_1h":275577,"hashrate_24h":271807,"shares_found":43,"shares_failed":0,"last_share":1782064448,"peers_out":10,"peers_in":0,"peer_list":616,"pool_hr":22307837,"sidechain_diff":223078379,"tor_cpu_pct":0.3,"tor_mem":"88.78MiB"}
+{"ts":1782066012,"arm":"tor","reward_share":1.184,"avg_effort":102.873,"cur_effort":185.248,"hashrate_1h":275928,"hashrate_24h":271800,"shares_found":43,"shares_failed":0,"last_share":1782064448,"peers_out":10,"peers_in":0,"peer_list":611,"pool_hr":22913979,"sidechain_diff":229139794,"tor_cpu_pct":0.77,"tor_mem":"89MiB"}
+{"ts":1782066313,"arm":"tor","reward_share":1.226,"avg_effort":105.070,"cur_effort":22.062,"hashrate_1h":273224,"hashrate_24h":271741,"shares_found":44,"shares_failed":0,"last_share":1782066090,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":22362675,"sidechain_diff":223626759,"tor_cpu_pct":2.33,"tor_mem":"88.89MiB"}
+{"ts":1782066615,"arm":"tor","reward_share":1.272,"avg_effort":103.757,"cur_effort":9.730,"hashrate_1h":275425,"hashrate_24h":271563,"shares_found":45,"shares_failed":0,"last_share":1782066508,"peers_out":10,"peers_in":0,"peer_list":614,"pool_hr":22687878,"sidechain_diff":226878783,"tor_cpu_pct":23.03,"tor_mem":"91.88MiB"}
+{"ts":1782066916,"arm":"tor","reward_share":1.226,"avg_effort":103.757,"cur_effort":40.985,"hashrate_1h":271821,"hashrate_24h":271377,"shares_found":45,"shares_failed":0,"last_share":1782066508,"peers_out":10,"peers_in":0,"peer_list":615,"pool_hr":22399100,"sidechain_diff":223991007,"tor_cpu_pct":19.18,"tor_mem":"89.39MiB"}
+{"ts":1782067217,"arm":"tor","reward_share":1.272,"avg_effort":103.031,"cur_effort":10.968,"hashrate_1h":271920,"hashrate_24h":271443,"shares_found":46,"shares_failed":0,"last_share":1782067112,"peers_out":10,"peers_in":0,"peer_list":613,"pool_hr":22558907,"sidechain_diff":225589070,"tor_cpu_pct":17.31,"tor_mem":"89.27MiB"}
+{"ts":1782067518,"arm":"tor","reward_share":1.272,"avg_effort":103.031,"cur_effort":45.925,"hashrate_1h":273072,"hashrate_24h":271472,"shares_found":46,"shares_failed":0,"last_share":1782067112,"peers_out":10,"peers_in":0,"peer_list":604,"pool_hr":22733637,"sidechain_diff":227336374,"tor_cpu_pct":19.03,"tor_mem":"89.06MiB"}
+{"ts":1782067820,"arm":"tor","reward_share":1.364,"avg_effort":100.020,"cur_effort":22.198,"hashrate_1h":267865,"hashrate_24h":271513,"shares_found":48,"shares_failed":0,"last_share":1782067629,"peers_out":10,"peers_in":0,"peer_list":597,"pool_hr":22676002,"sidechain_diff":226760020,"tor_cpu_pct":17.19,"tor_mem":"89MiB"}
+{"ts":1782068121,"arm":"tor","reward_share":1.366,"avg_effort":99.019,"cur_effort":13.599,"hashrate_1h":270985,"hashrate_24h":271775,"shares_found":49,"shares_failed":0,"last_share":1782068003,"peers_out":10,"peers_in":0,"peer_list":595,"pool_hr":22488731,"sidechain_diff":224887316,"tor_cpu_pct":1.41,"tor_mem":"88.81MiB"}
+{"ts":1782068422,"arm":"tor","reward_share":1.355,"avg_effort":97.824,"cur_effort":11.503,"hashrate_1h":272537,"hashrate_24h":271919,"shares_found":50,"shares_failed":0,"last_share":1782068283,"peers_out":10,"peers_in":0,"peer_list":595,"pool_hr":22745392,"sidechain_diff":227453920,"tor_cpu_pct":20.71,"tor_mem":"89MiB"}
+{"ts":1782068723,"arm":"tor","reward_share":1.354,"avg_effort":97.824,"cur_effort":54.085,"hashrate_1h":278830,"hashrate_24h":272235,"shares_found":50,"shares_failed":0,"last_share":1782068283,"peers_out":10,"peers_in":0,"peer_list":595,"pool_hr":22630483,"sidechain_diff":226304832,"tor_cpu_pct":21.57,"tor_mem":"88.99MiB"}
+{"ts":1782069025,"arm":"tor","reward_share":1.398,"avg_effort":96.987,"cur_effort":35.829,"hashrate_1h":276952,"hashrate_24h":272300,"shares_found":51,"shares_failed":0,"last_share":1782068714,"peers_out":10,"peers_in":0,"peer_list":600,"pool_hr":23007967,"sidechain_diff":230079678,"tor_cpu_pct":14.9,"tor_mem":"88.93MiB"}
+{"ts":1782069326,"arm":"tor","reward_share":1.353,"avg_effort":96.987,"cur_effort":70.769,"hashrate_1h":276587,"hashrate_24h":272281,"shares_found":51,"shares_failed":0,"last_share":1782068714,"peers_out":10,"peers_in":0,"peer_list":601,"pool_hr":23403678,"sidechain_diff":234036788,"tor_cpu_pct":14.91,"tor_mem":"89.64MiB"}
+{"ts":1782069627,"arm":"tor","reward_share":1.308,"avg_effort":96.987,"cur_effort":109.327,"hashrate_1h":278181,"hashrate_24h":272336,"shares_found":51,"shares_failed":0,"last_share":1782068714,"peers_out":10,"peers_in":0,"peer_list":600,"pool_hr":22576488,"sidechain_diff":225764885,"tor_cpu_pct":5,"tor_mem":"89.84MiB"}
+{"ts":1782069928,"arm":"tor","reward_share":1.309,"avg_effort":97.445,"cur_effort":15.771,"hashrate_1h":275383,"hashrate_24h":272074,"shares_found":52,"shares_failed":0,"last_share":1782069764,"peers_out":10,"peers_in":0,"peer_list":601,"pool_hr":23256502,"sidechain_diff":232565028,"tor_cpu_pct":23.12,"tor_mem":"90.35MiB"}
+{"ts":1782070230,"arm":"tor","reward_share":1.310,"avg_effort":97.445,"cur_effort":51.599,"hashrate_1h":277126,"hashrate_24h":271955,"shares_found":52,"shares_failed":0,"last_share":1782069764,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":22689881,"sidechain_diff":226898811,"tor_cpu_pct":18.14,"tor_mem":"90.43MiB"}
+{"ts":1782070531,"arm":"tor","reward_share":1.310,"avg_effort":97.445,"cur_effort":90.938,"hashrate_1h":281023,"hashrate_24h":272126,"shares_found":52,"shares_failed":0,"last_share":1782069764,"peers_out":10,"peers_in":0,"peer_list":602,"pool_hr":22655871,"sidechain_diff":226558716,"tor_cpu_pct":3.54,"tor_mem":"89.95MiB"}
+{"ts":1782070832,"arm":"tor","reward_share":1.255,"avg_effort":97.445,"cur_effort":126.443,"hashrate_1h":280045,"hashrate_24h":272195,"shares_found":52,"shares_failed":0,"last_share":1782069764,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":22879976,"sidechain_diff":228799766,"tor_cpu_pct":1.67,"tor_mem":"90.01MiB"}
+{"ts":1782071133,"arm":"tor","reward_share":1.347,"avg_effort":96.724,"cur_effort":11.538,"hashrate_1h":282812,"hashrate_24h":272419,"shares_found":54,"shares_failed":0,"last_share":1782071044,"peers_out":10,"peers_in":0,"peer_list":605,"pool_hr":22869725,"sidechain_diff":228697258,"tor_cpu_pct":7.11,"tor_mem":"101.3MiB"}
+{"ts":1782071435,"arm":"tor","reward_share":1.344,"avg_effort":96.724,"cur_effort":45.965,"hashrate_1h":281729,"hashrate_24h":272339,"shares_found":54,"shares_failed":0,"last_share":1782071044,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":22872563,"sidechain_diff":228725630,"tor_cpu_pct":18.31,"tor_mem":"90.01MiB"}
+{"ts":1782071736,"arm":"tor","reward_share":1.343,"avg_effort":96.724,"cur_effort":76.603,"hashrate_1h":275919,"hashrate_24h":272099,"shares_found":54,"shares_failed":0,"last_share":1782071044,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":22859931,"sidechain_diff":228599310,"tor_cpu_pct":18.15,"tor_mem":"89.8MiB"}
+{"ts":1782072037,"arm":"tor","reward_share":1.344,"avg_effort":96.724,"cur_effort":107.842,"hashrate_1h":270447,"hashrate_24h":271860,"shares_found":54,"shares_failed":0,"last_share":1782071044,"peers_out":11,"peers_in":0,"peer_list":608,"pool_hr":22975574,"sidechain_diff":229755745,"tor_cpu_pct":18.09,"tor_mem":"90.07MiB"}
+{"ts":1782072338,"arm":"tor","reward_share":1.390,"avg_effort":97.141,"cur_effort":22.983,"hashrate_1h":267584,"hashrate_24h":271804,"shares_found":55,"shares_failed":0,"last_share":1782072144,"peers_out":11,"peers_in":0,"peer_list":611,"pool_hr":22898727,"sidechain_diff":228987274,"tor_cpu_pct":18.51,"tor_mem":"90.05MiB"}
+{"ts":1782072640,"arm":"tor","reward_share":1.390,"avg_effort":96.220,"cur_effort":4.776,"hashrate_1h":261470,"hashrate_24h":271449,"shares_found":56,"shares_failed":0,"last_share":1782072554,"peers_out":11,"peers_in":0,"peer_list":606,"pool_hr":22916696,"sidechain_diff":229166962,"tor_cpu_pct":30.08,"tor_mem":"89.89MiB"}
+{"ts":1782072941,"arm":"tor","reward_share":1.345,"avg_effort":96.220,"cur_effort":38.040,"hashrate_1h":259611,"hashrate_24h":271293,"shares_found":56,"shares_failed":0,"last_share":1782072554,"peers_out":11,"peers_in":0,"peer_list":605,"pool_hr":23004463,"sidechain_diff":230044638,"tor_cpu_pct":20.94,"tor_mem":"90.4MiB"}
+{"ts":1782073242,"arm":"tor","reward_share":1.390,"avg_effort":95.269,"cur_effort":31.658,"hashrate_1h":260378,"hashrate_24h":271361,"shares_found":57,"shares_failed":0,"last_share":1782072992,"peers_out":11,"peers_in":0,"peer_list":604,"pool_hr":23372256,"sidechain_diff":233722564,"tor_cpu_pct":5.32,"tor_mem":"90.62MiB"}
+{"ts":1782073544,"arm":"tor","reward_share":1.482,"avg_effort":93.039,"cur_effort":6.167,"hashrate_1h":262449,"hashrate_24h":271327,"shares_found":59,"shares_failed":0,"last_share":1782073468,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":23171437,"sidechain_diff":231714378,"tor_cpu_pct":19.3,"tor_mem":"89.95MiB"}
+{"ts":1782073845,"arm":"tor","reward_share":1.436,"avg_effort":93.039,"cur_effort":38.606,"hashrate_1h":262702,"hashrate_24h":271242,"shares_found":59,"shares_failed":0,"last_share":1782073468,"peers_out":10,"peers_in":0,"peer_list":603,"pool_hr":23062797,"sidechain_diff":230627973,"tor_cpu_pct":28.17,"tor_mem":"90.13MiB"}
+{"ts":1782074146,"arm":"tor","reward_share":1.434,"avg_effort":93.039,"cur_effort":64.980,"hashrate_1h":255855,"hashrate_24h":270864,"shares_found":59,"shares_failed":0,"last_share":1782073468,"peers_out":10,"peers_in":0,"peer_list":601,"pool_hr":23130697,"sidechain_diff":231306976,"tor_cpu_pct":37.47,"tor_mem":"90.13MiB"}
+{"ts":1782074447,"arm":"tor","reward_share":1.480,"avg_effort":91.453,"cur_effort":8.394,"hashrate_1h":253206,"hashrate_24h":270774,"shares_found":61,"shares_failed":0,"last_share":1782074342,"peers_out":10,"peers_in":0,"peer_list":592,"pool_hr":23042596,"sidechain_diff":230425963,"tor_cpu_pct":26.71,"tor_mem":"90.24MiB"}
+{"ts":1782074749,"arm":"tor","reward_share":1.388,"avg_effort":91.453,"cur_effort":43.965,"hashrate_1h":250358,"hashrate_24h":270754,"shares_found":61,"shares_failed":0,"last_share":1782074342,"peers_out":10,"peers_in":0,"peer_list":584,"pool_hr":23090606,"sidechain_diff":230906064,"tor_cpu_pct":22.96,"tor_mem":"90.39MiB"}
+{"ts":1782075050,"arm":"tor","reward_share":1.343,"avg_effort":91.453,"cur_effort":77.442,"hashrate_1h":250925,"hashrate_24h":270706,"shares_found":61,"shares_failed":0,"last_share":1782074342,"peers_out":10,"peers_in":0,"peer_list":573,"pool_hr":23166525,"sidechain_diff":231665254,"tor_cpu_pct":23.63,"tor_mem":"90.09MiB"}
+{"ts":1782075351,"arm":"tor","reward_share":1.299,"avg_effort":91.453,"cur_effort":110.083,"hashrate_1h":251780,"hashrate_24h":270551,"shares_found":61,"shares_failed":0,"last_share":1782074342,"peers_out":10,"peers_in":0,"peer_list":546,"pool_hr":23101170,"sidechain_diff":231011701,"tor_cpu_pct":33.01,"tor_mem":"90.71MiB"}
+{"ts":1782075652,"arm":"tor","reward_share":1.356,"avg_effort":90.661,"cur_effort":12.254,"hashrate_1h":255990,"hashrate_24h":270685,"shares_found":63,"shares_failed":0,"last_share":1782075566,"peers_out":10,"peers_in":0,"peer_list":537,"pool_hr":23583590,"sidechain_diff":235835908,"tor_cpu_pct":19.96,"tor_mem":"90.49MiB"}
+{"ts":1782075954,"arm":"tor","reward_share":1.309,"avg_effort":90.661,"cur_effort":42.801,"hashrate_1h":256377,"hashrate_24h":270570,"shares_found":63,"shares_failed":0,"last_share":1782075566,"peers_out":10,"peers_in":0,"peer_list":526,"pool_hr":24458736,"sidechain_diff":244587361,"tor_cpu_pct":14.07,"tor_mem":"90.19MiB"}
+{"ts":1782076255,"arm":"tor","reward_share":1.308,"avg_effort":90.661,"cur_effort":73.904,"hashrate_1h":257956,"hashrate_24h":270461,"shares_found":63,"shares_failed":0,"last_share":1782075566,"peers_out":10,"peers_in":0,"peer_list":507,"pool_hr":23962440,"sidechain_diff":239624404,"tor_cpu_pct":23.58,"tor_mem":"97.54MiB"}
+{"ts":1782076556,"arm":"tor","reward_share":1.308,"avg_effort":90.661,"cur_effort":108.620,"hashrate_1h":260107,"hashrate_24h":270462,"shares_found":63,"shares_failed":0,"last_share":1782075566,"peers_out":10,"peers_in":0,"peer_list":483,"pool_hr":24003691,"sidechain_diff":240036910,"tor_cpu_pct":21.75,"tor_mem":"92.39MiB"}
+{"ts":1782076857,"arm":"tor","reward_share":1.354,"avg_effort":91.415,"cur_effort":7.288,"hashrate_1h":259994,"hashrate_24h":270477,"shares_found":64,"shares_failed":0,"last_share":1782076760,"peers_out":12,"peers_in":0,"peer_list":516,"pool_hr":23637101,"sidechain_diff":236371011,"tor_cpu_pct":23.01,"tor_mem":"92.3MiB"}
+{"ts":1782077159,"arm":"tor","reward_share":1.354,"avg_effort":91.415,"cur_effort":44.159,"hashrate_1h":260777,"hashrate_24h":270581,"shares_found":64,"shares_failed":0,"last_share":1782076760,"peers_out":12,"peers_in":0,"peer_list":540,"pool_hr":23747235,"sidechain_diff":237472353,"tor_cpu_pct":15.19,"tor_mem":"92.41MiB"}
+{"ts":1782077460,"arm":"tor","reward_share":1.352,"avg_effort":91.415,"cur_effort":76.048,"hashrate_1h":259282,"hashrate_24h":270370,"shares_found":64,"shares_failed":0,"last_share":1782076760,"peers_out":12,"peers_in":0,"peer_list":551,"pool_hr":23646103,"sidechain_diff":236461037,"tor_cpu_pct":24.37,"tor_mem":"126.4MiB"}
+{"ts":1782077761,"arm":"tor","reward_share":1.399,"avg_effort":91.367,"cur_effort":22.299,"hashrate_1h":263230,"hashrate_24h":270374,"shares_found":65,"shares_failed":0,"last_share":1782077610,"peers_out":12,"peers_in":0,"peer_list":557,"pool_hr":23606059,"sidechain_diff":236060599,"tor_cpu_pct":18.99,"tor_mem":"105.8MiB"}
+{"ts":1782078062,"arm":"tor","reward_share":1.353,"avg_effort":91.367,"cur_effort":50.523,"hashrate_1h":261980,"hashrate_24h":270178,"shares_found":65,"shares_failed":0,"last_share":1782077610,"peers_out":12,"peers_in":0,"peer_list":569,"pool_hr":23582000,"sidechain_diff":235820003,"tor_cpu_pct":4.59,"tor_mem":"92.23MiB"}
+{"ts":1782078364,"arm":"tor","reward_share":1.352,"avg_effort":91.367,"cur_effort":81.889,"hashrate_1h":258505,"hashrate_24h":269926,"shares_found":65,"shares_failed":0,"last_share":1782077610,"peers_out":11,"peers_in":0,"peer_list":580,"pool_hr":23494599,"sidechain_diff":234945998,"tor_cpu_pct":16.17,"tor_mem":"92.09MiB"}
+{"ts":1782078665,"arm":"tor","reward_share":1.261,"avg_effort":91.367,"cur_effort":107.881,"hashrate_1h":255953,"hashrate_24h":269649,"shares_found":65,"shares_failed":0,"last_share":1782077610,"peers_out":11,"peers_in":0,"peer_list":584,"pool_hr":23695695,"sidechain_diff":236956959,"tor_cpu_pct":18.66,"tor_mem":"92.21MiB"}
+{"ts":1782078966,"arm":"tor","reward_share":1.260,"avg_effort":91.367,"cur_effort":140.937,"hashrate_1h":256364,"hashrate_24h":269530,"shares_found":65,"shares_failed":0,"last_share":1782077610,"peers_out":11,"peers_in":0,"peer_list":583,"pool_hr":23621698,"sidechain_diff":236216984,"tor_cpu_pct":0.74,"tor_mem":"92.08MiB"}
+{"ts":1782079267,"arm":"tor","reward_share":1.305,"avg_effort":92.164,"cur_effort":34.868,"hashrate_1h":255754,"hashrate_24h":269655,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":586,"pool_hr":23838401,"sidechain_diff":238384014,"tor_cpu_pct":5.74,"tor_mem":"92.02MiB"}
+{"ts":1782079569,"arm":"tor","reward_share":1.304,"avg_effort":92.164,"cur_effort":64.280,"hashrate_1h":254099,"hashrate_24h":269392,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":590,"pool_hr":23941157,"sidechain_diff":239411576,"tor_cpu_pct":1.62,"tor_mem":"91.57MiB"}
+{"ts":1782079870,"arm":"tor","reward_share":1.304,"avg_effort":92.164,"cur_effort":95.184,"hashrate_1h":253146,"hashrate_24h":269199,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":589,"pool_hr":23735231,"sidechain_diff":237352312,"tor_cpu_pct":13.86,"tor_mem":"90.96MiB"}
+{"ts":1782080171,"arm":"tor","reward_share":1.258,"avg_effort":92.164,"cur_effort":126.111,"hashrate_1h":249660,"hashrate_24h":269046,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":588,"pool_hr":23591125,"sidechain_diff":235911257,"tor_cpu_pct":0.73,"tor_mem":"91.12MiB"}
+{"ts":1782080472,"arm":"tor","reward_share":1.257,"avg_effort":92.164,"cur_effort":167.951,"hashrate_1h":252946,"hashrate_24h":269329,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":585,"pool_hr":23375725,"sidechain_diff":233757250,"tor_cpu_pct":0.5,"tor_mem":"91.08MiB"}
+{"ts":1782080774,"arm":"tor","reward_share":1.257,"avg_effort":92.164,"cur_effort":196.212,"hashrate_1h":253888,"hashrate_24h":269402,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":583,"pool_hr":24221309,"sidechain_diff":242213092,"tor_cpu_pct":2.69,"tor_mem":"90.93MiB"}
+{"ts":1782081075,"arm":"tor","reward_share":1.256,"avg_effort":92.164,"cur_effort":236.064,"hashrate_1h":258609,"hashrate_24h":269524,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":586,"pool_hr":23969651,"sidechain_diff":239696511,"tor_cpu_pct":29.36,"tor_mem":"91.48MiB"}
+{"ts":1782081376,"arm":"tor","reward_share":1.211,"avg_effort":92.164,"cur_effort":275.052,"hashrate_1h":260124,"hashrate_24h":269630,"shares_found":66,"shares_failed":0,"last_share":1782078968,"peers_out":11,"peers_in":0,"peer_list":584,"pool_hr":23797982,"sidechain_diff":237979821,"tor_cpu_pct":27.56,"tor_mem":"91.36MiB"}
+{"ts":1782081677,"arm":"tor","reward_share":1.257,"avg_effort":95.410,"cur_effort":10.501,"hashrate_1h":263741,"hashrate_24h":269721,"shares_found":67,"shares_failed":0,"last_share":1782081604,"peers_out":11,"peers_in":0,"peer_list":581,"pool_hr":23716900,"sidechain_diff":237169004,"tor_cpu_pct":17.18,"tor_mem":"91.27MiB"}
+{"ts":1782081979,"arm":"tor","reward_share":1.211,"avg_effort":95.410,"cur_effort":34.295,"hashrate_1h":260525,"hashrate_24h":269322,"shares_found":67,"shares_failed":0,"last_share":1782081604,"peers_out":10,"peers_in":0,"peer_list":581,"pool_hr":23663904,"sidechain_diff":236639046,"tor_cpu_pct":15.65,"tor_mem":"91.02MiB"}
+{"ts":1782082280,"arm":"tor","reward_share":1.210,"avg_effort":95.410,"cur_effort":72.597,"hashrate_1h":266377,"hashrate_24h":269487,"shares_found":67,"shares_failed":0,"last_share":1782081604,"peers_out":10,"peers_in":0,"peer_list":581,"pool_hr":23739854,"sidechain_diff":237398542,"tor_cpu_pct":18.35,"tor_mem":"90.94MiB"}
+{"ts":1782082581,"arm":"tor","reward_share":1.209,"avg_effort":95.410,"cur_effort":107.086,"hashrate_1h":269619,"hashrate_24h":269528,"shares_found":67,"shares_failed":0,"last_share":1782081604,"peers_out":10,"peers_in":0,"peer_list":582,"pool_hr":23776740,"sidechain_diff":237767403,"tor_cpu_pct":13.69,"tor_mem":"91.46MiB"}
+{"ts":1782082882,"arm":"tor","reward_share":1.254,"avg_effort":95.936,"cur_effort":19.880,"hashrate_1h":273364,"hashrate_24h":269803,"shares_found":68,"shares_failed":0,"last_share":1782082757,"peers_out":10,"peers_in":0,"peer_list":583,"pool_hr":23520673,"sidechain_diff":235206732,"tor_cpu_pct":27.1,"tor_mem":"91.04MiB"}
+{"ts":1782083184,"arm":"tor","reward_share":1.255,"avg_effort":94.856,"cur_effort":25.091,"hashrate_1h":271817,"hashrate_24h":269540,"shares_found":69,"shares_failed":0,"last_share":1782082922,"peers_out":10,"peers_in":0,"peer_list":582,"pool_hr":23368122,"sidechain_diff":233681227,"tor_cpu_pct":11.4,"tor_mem":"91.56MiB"}
+{"ts":1782083485,"arm":"tor","reward_share":1.300,"avg_effort":94.173,"cur_effort":11.413,"hashrate_1h":273501,"hashrate_24h":269498,"shares_found":70,"shares_failed":0,"last_share":1782083358,"peers_out":12,"peers_in":0,"peer_list":605,"pool_hr":23851187,"sidechain_diff":238511873,"tor_cpu_pct":0.58,"tor_mem":"91.09MiB"}
+{"ts":1782083786,"arm":"tor","reward_share":1.298,"avg_effort":94.173,"cur_effort":43.676,"hashrate_1h":273220,"hashrate_24h":269376,"shares_found":70,"shares_failed":0,"last_share":1782083358,"peers_out":11,"peers_in":0,"peer_list":603,"pool_hr":23303461,"sidechain_diff":233034619,"tor_cpu_pct":19.08,"tor_mem":"91.15MiB"}
+{"ts":1782084087,"arm":"tor","reward_share":1.253,"avg_effort":94.173,"cur_effort":80.885,"hashrate_1h":273140,"hashrate_24h":269566,"shares_found":70,"shares_failed":0,"last_share":1782083358,"peers_out":11,"peers_in":0,"peer_list":599,"pool_hr":23371226,"sidechain_diff":233712262,"tor_cpu_pct":19.23,"tor_mem":"91.42MiB"}
+{"ts":1782084389,"arm":"tor","reward_share":1.253,"avg_effort":94.173,"cur_effort":113.836,"hashrate_1h":271359,"hashrate_24h":269550,"shares_found":70,"shares_failed":0,"last_share":1782083358,"peers_out":11,"peers_in":0,"peer_list":592,"pool_hr":23312082,"sidechain_diff":233120827,"tor_cpu_pct":18.18,"tor_mem":"91.16MiB"}
+{"ts":1782084690,"arm":"tor","reward_share":1.305,"avg_effort":94.501,"cur_effort":35.629,"hashrate_1h":271603,"hashrate_24h":269606,"shares_found":71,"shares_failed":0,"last_share":1782084384,"peers_out":11,"peers_in":0,"peer_list":575,"pool_hr":23344641,"sidechain_diff":233446419,"tor_cpu_pct":3.84,"tor_mem":"91.53MiB"}
+{"ts":1782084991,"arm":"tor","reward_share":1.304,"avg_effort":94.501,"cur_effort":65.921,"hashrate_1h":266785,"hashrate_24h":269447,"shares_found":71,"shares_failed":0,"last_share":1782084384,"peers_out":10,"peers_in":0,"peer_list":564,"pool_hr":23342151,"sidechain_diff":233421519,"tor_cpu_pct":6.09,"tor_mem":"92.24MiB"}
+{"ts":1782085292,"arm":"tor","reward_share":1.302,"avg_effort":94.501,"cur_effort":103.451,"hashrate_1h":267633,"hashrate_24h":269537,"shares_found":71,"shares_failed":0,"last_share":1782084384,"peers_out":10,"peers_in":0,"peer_list":530,"pool_hr":23612565,"sidechain_diff":236125650,"tor_cpu_pct":11.46,"tor_mem":"91.74MiB"}
+{"ts":1782085593,"arm":"tor","reward_share":1.348,"avg_effort":94.697,"cur_effort":20.130,"hashrate_1h":266096,"hashrate_24h":269195,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":531,"pool_hr":23501736,"sidechain_diff":235017365,"tor_cpu_pct":13.73,"tor_mem":"90.85MiB"}
+{"ts":1782085895,"arm":"tor","reward_share":1.347,"avg_effort":94.697,"cur_effort":50.830,"hashrate_1h":261561,"hashrate_24h":269029,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":531,"pool_hr":23558968,"sidechain_diff":235589684,"tor_cpu_pct":0.53,"tor_mem":"90.63MiB"}
+{"ts":1782086196,"arm":"tor","reward_share":1.346,"avg_effort":94.697,"cur_effort":85.012,"hashrate_1h":260898,"hashrate_24h":269017,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":531,"pool_hr":23462864,"sidechain_diff":234628648,"tor_cpu_pct":2.19,"tor_mem":"90.9MiB"}
+{"ts":1782086497,"arm":"tor","reward_share":1.302,"avg_effort":94.697,"cur_effort":118.384,"hashrate_1h":256671,"hashrate_24h":269004,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":524,"pool_hr":23393384,"sidechain_diff":233933841,"tor_cpu_pct":0.49,"tor_mem":"90.51MiB"}
+{"ts":1782086798,"arm":"tor","reward_share":1.301,"avg_effort":94.697,"cur_effort":151.514,"hashrate_1h":259750,"hashrate_24h":268938,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":520,"pool_hr":23526479,"sidechain_diff":235264795,"tor_cpu_pct":10.77,"tor_mem":"90.9MiB"}
+{"ts":1782087100,"arm":"tor","reward_share":1.300,"avg_effort":94.697,"cur_effort":180.642,"hashrate_1h":259245,"hashrate_24h":268886,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":498,"pool_hr":23967022,"sidechain_diff":239670220,"tor_cpu_pct":10.95,"tor_mem":"90.74MiB"}
+{"ts":1782087401,"arm":"tor","reward_share":1.299,"avg_effort":94.697,"cur_effort":205.137,"hashrate_1h":255098,"hashrate_24h":268516,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":496,"pool_hr":23958986,"sidechain_diff":239589862,"tor_cpu_pct":0.27,"tor_mem":"90.48MiB"}
+{"ts":1782087702,"arm":"tor","reward_share":1.297,"avg_effort":94.697,"cur_effort":245.953,"hashrate_1h":250929,"hashrate_24h":268452,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":498,"pool_hr":23244376,"sidechain_diff":232443767,"tor_cpu_pct":11.84,"tor_mem":"90.45MiB"}
+{"ts":1782088003,"arm":"tor","reward_share":1.297,"avg_effort":94.697,"cur_effort":275.640,"hashrate_1h":249156,"hashrate_24h":268327,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":502,"pool_hr":23117183,"sidechain_diff":231171835,"tor_cpu_pct":1.6,"tor_mem":"90.47MiB"}
+{"ts":1782088305,"arm":"tor","reward_share":1.296,"avg_effort":94.697,"cur_effort":308.958,"hashrate_1h":247167,"hashrate_24h":268247,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":502,"pool_hr":23183054,"sidechain_diff":231830545,"tor_cpu_pct":0.49,"tor_mem":"90.73MiB"}
+{"ts":1782088606,"arm":"tor","reward_share":1.296,"avg_effort":94.697,"cur_effort":337.076,"hashrate_1h":246641,"hashrate_24h":268102,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":497,"pool_hr":23501603,"sidechain_diff":235016033,"tor_cpu_pct":0.35,"tor_mem":"90.47MiB"}
+{"ts":1782088907,"arm":"tor","reward_share":1.254,"avg_effort":94.697,"cur_effort":371.279,"hashrate_1h":243214,"hashrate_24h":267963,"shares_found":72,"shares_failed":0,"last_share":1782085359,"peers_out":10,"peers_in":0,"peer_list":491,"pool_hr":23188246,"sidechain_diff":231882468,"tor_cpu_pct":12.08,"tor_mem":"90.52MiB"}
+{"ts":1782089208,"arm":"tor","reward_share":1.253,"avg_effort":98.570,"cur_effort":35.037,"hashrate_1h":247564,"hashrate_24h":267992,"shares_found":73,"shares_failed":0,"last_share":1782088906,"peers_out":10,"peers_in":0,"peer_list":492,"pool_hr":23134823,"sidechain_diff":231348236,"tor_cpu_pct":1.59,"tor_mem":"90.51MiB"}
+{"ts":1782089510,"arm":"tor","reward_share":1.252,"avg_effort":98.570,"cur_effort":68.505,"hashrate_1h":251327,"hashrate_24h":268000,"shares_found":73,"shares_failed":0,"last_share":1782088906,"peers_out":10,"peers_in":0,"peer_list":493,"pool_hr":23167866,"sidechain_diff":231678664,"tor_cpu_pct":0.93,"tor_mem":"90.5MiB"}
+{"ts":1782089811,"arm":"tor","reward_share":1.208,"avg_effort":98.570,"cur_effort":99.426,"hashrate_1h":248269,"hashrate_24h":267791,"shares_found":73,"shares_failed":0,"last_share":1782088906,"peers_out":10,"peers_in":0,"peer_list":493,"pool_hr":22960255,"sidechain_diff":229602558,"tor_cpu_pct":0.92,"tor_mem":"90.89MiB"}
+{"ts":1782090112,"arm":"tor","reward_share":1.252,"avg_effort":98.706,"cur_effort":27.505,"hashrate_1h":248410,"hashrate_24h":267847,"shares_found":74,"shares_failed":0,"last_share":1782089869,"peers_out":10,"peers_in":0,"peer_list":492,"pool_hr":22879181,"sidechain_diff":228791814,"tor_cpu_pct":0.15,"tor_mem":"91.04MiB"}
+{"ts":1782090413,"arm":"tor","reward_share":1.209,"avg_effort":98.091,"cur_effort":8.685,"hashrate_1h":249412,"hashrate_24h":267807,"shares_found":75,"shares_failed":0,"last_share":1782090328,"peers_out":10,"peers_in":0,"peer_list":488,"pool_hr":22698760,"sidechain_diff":226987606,"tor_cpu_pct":3.78,"tor_mem":"90.91MiB"}
+{"ts":1782090715,"arm":"tor","reward_share":1.209,"avg_effort":98.091,"cur_effort":41.102,"hashrate_1h":248498,"hashrate_24h":267750,"shares_found":75,"shares_failed":0,"last_share":1782090328,"peers_out":10,"peers_in":0,"peer_list":489,"pool_hr":22758222,"sidechain_diff":227582228,"tor_cpu_pct":15.75,"tor_mem":"91.2MiB"}
+{"ts":1782091016,"arm":"tor","reward_share":1.254,"avg_effort":96.563,"cur_effort":0.912,"hashrate_1h":255910,"hashrate_24h":267809,"shares_found":77,"shares_failed":0,"last_share":1782090986,"peers_out":10,"peers_in":0,"peer_list":488,"pool_hr":22493385,"sidechain_diff":224933852,"tor_cpu_pct":0.21,"tor_mem":"91.05MiB"}
+{"ts":1782091317,"arm":"tor","reward_share":1.219,"avg_effort":96.563,"cur_effort":34.903,"hashrate_1h":254705,"hashrate_24h":267671,"shares_found":77,"shares_failed":0,"last_share":1782090986,"peers_out":10,"peers_in":0,"peer_list":490,"pool_hr":22531378,"sidechain_diff":225313785,"tor_cpu_pct":1.22,"tor_mem":"91.07MiB"}
+{"ts":1782091618,"arm":"tor","reward_share":1.176,"avg_effort":96.563,"cur_effort":76.491,"hashrate_1h":261541,"hashrate_24h":267953,"shares_found":77,"shares_failed":0,"last_share":1782090986,"peers_out":10,"peers_in":0,"peer_list":491,"pool_hr":22686336,"sidechain_diff":226863363,"tor_cpu_pct":1.41,"tor_mem":"90.78MiB"}
+{"ts":1782091920,"arm":"tor","reward_share":1.221,"avg_effort":96.460,"cur_effort":18.700,"hashrate_1h":261455,"hashrate_24h":267782,"shares_found":78,"shares_failed":0,"last_share":1782091736,"peers_out":10,"peers_in":0,"peer_list":491,"pool_hr":22760809,"sidechain_diff":227608093,"tor_cpu_pct":0.13,"tor_mem":"91MiB"}
+{"ts":1782092221,"arm":"tor","reward_share":1.222,"avg_effort":96.460,"cur_effort":53.679,"hashrate_1h":261619,"hashrate_24h":267770,"shares_found":78,"shares_failed":0,"last_share":1782091736,"peers_out":10,"peers_in":0,"peer_list":491,"pool_hr":22695779,"sidechain_diff":226957790,"tor_cpu_pct":8.48,"tor_mem":"91.11MiB"}
+{"ts":1782092522,"arm":"tor","reward_share":1.222,"avg_effort":96.460,"cur_effort":86.414,"hashrate_1h":262841,"hashrate_24h":267678,"shares_found":78,"shares_failed":0,"last_share":1782091736,"peers_out":10,"peers_in":0,"peer_list":489,"pool_hr":22698887,"sidechain_diff":226988873,"tor_cpu_pct":2.79,"tor_mem":"90.8MiB"}
+{"ts":1782092823,"arm":"tor","reward_share":1.220,"avg_effort":96.444,"cur_effort":27.189,"hashrate_1h":261075,"hashrate_24h":267627,"shares_found":79,"shares_failed":0,"last_share":1782092566,"peers_out":10,"peers_in":0,"peer_list":490,"pool_hr":22566575,"sidechain_diff":225665753,"tor_cpu_pct":0.16,"tor_mem":"91.04MiB"}
+{"ts":1782093125,"arm":"tor","reward_share":1.221,"avg_effort":96.444,"cur_effort":59.660,"hashrate_1h":261308,"hashrate_24h":267600,"shares_found":79,"shares_failed":0,"last_share":1782092566,"peers_out":10,"peers_in":0,"peer_list":490,"pool_hr":22428693,"sidechain_diff":224286939,"tor_cpu_pct":1.07,"tor_mem":"90.8MiB"}
+{"ts":1782093426,"arm":"tor","reward_share":1.262,"avg_effort":96.104,"cur_effort":20.734,"hashrate_1h":259835,"hashrate_24h":267362,"shares_found":80,"shares_failed":0,"last_share":1782093178,"peers_out":10,"peers_in":0,"peer_list":486,"pool_hr":22526655,"sidechain_diff":225266553,"tor_cpu_pct":0.18,"tor_mem":"90.8MiB"}
+{"ts":1782093727,"arm":"tor","reward_share":1.263,"avg_effort":96.104,"cur_effort":60.963,"hashrate_1h":261739,"hashrate_24h":267495,"shares_found":80,"shares_failed":0,"last_share":1782093178,"peers_out":10,"peers_in":0,"peer_list":487,"pool_hr":22408124,"sidechain_diff":224081244,"tor_cpu_pct":0.16,"tor_mem":"91.03MiB"}
+{"ts":1782094028,"arm":"tor","reward_share":1.262,"avg_effort":94.967,"cur_effort":2.410,"hashrate_1h":262005,"hashrate_24h":267538,"shares_found":82,"shares_failed":0,"last_share":1782094006,"peers_out":10,"peers_in":0,"peer_list":485,"pool_hr":22320021,"sidechain_diff":223200210,"tor_cpu_pct":0.45,"tor_mem":"91.05MiB"}
+{"ts":1782094330,"arm":"tor","reward_share":1.263,"avg_effort":94.967,"cur_effort":34.787,"hashrate_1h":260360,"hashrate_24h":267417,"shares_found":82,"shares_failed":0,"last_share":1782094006,"peers_out":10,"peers_in":0,"peer_list":490,"pool_hr":22177179,"sidechain_diff":221771797,"tor_cpu_pct":0.99,"tor_mem":"90.82MiB"}
+{"ts":1782094631,"arm":"tor","reward_share":1.264,"avg_effort":94.967,"cur_effort":61.540,"hashrate_1h":255466,"hashrate_24h":267115,"shares_found":82,"shares_failed":0,"last_share":1782094006,"peers_out":10,"peers_in":0,"peer_list":487,"pool_hr":22350915,"sidechain_diff":223509151,"tor_cpu_pct":2.35,"tor_mem":"90.04MiB"}
+{"ts":1782094932,"arm":"tor","reward_share":1.307,"avg_effort":93.829,"cur_effort":2.967,"hashrate_1h":255316,"hashrate_24h":267009,"shares_found":84,"shares_failed":0,"last_share":1782094882,"peers_out":10,"peers_in":0,"peer_list":543,"pool_hr":22337274,"sidechain_diff":223372743,"tor_cpu_pct":44.12,"tor_mem":"91.01MiB"}
+{"ts":1782095233,"arm":"tor","reward_share":1.295,"avg_effort":93.090,"cur_effort":11.194,"hashrate_1h":251823,"hashrate_24h":267052,"shares_found":85,"shares_failed":0,"last_share":1782095134,"peers_out":10,"peers_in":0,"peer_list":623,"pool_hr":22315299,"sidechain_diff":223152994,"tor_cpu_pct":61.42,"tor_mem":"101.5MiB"}
+{"ts":1782095535,"arm":"tor","reward_share":1.295,"avg_effort":93.090,"cur_effort":54.259,"hashrate_1h":258213,"hashrate_24h":267301,"shares_found":85,"shares_failed":0,"last_share":1782095134,"peers_out":10,"peers_in":0,"peer_list":681,"pool_hr":22383575,"sidechain_diff":223835756,"tor_cpu_pct":100.21,"tor_mem":"107MiB"}
+{"ts":1782095836,"arm":"tor","reward_share":1.252,"avg_effort":93.090,"cur_effort":87.666,"hashrate_1h":259151,"hashrate_24h":267255,"shares_found":85,"shares_failed":0,"last_share":1782095134,"peers_out":10,"peers_in":0,"peer_list":703,"pool_hr":22522259,"sidechain_diff":225222599,"tor_cpu_pct":36.53,"tor_mem":"104.6MiB"}
+{"ts":1782096137,"arm":"tor","reward_share":1.207,"avg_effort":93.090,"cur_effort":123.710,"hashrate_1h":259771,"hashrate_24h":267242,"shares_found":85,"shares_failed":0,"last_share":1782095134,"peers_out":10,"peers_in":0,"peer_list":722,"pool_hr":22611778,"sidechain_diff":226117786,"tor_cpu_pct":40.31,"tor_mem":"105.1MiB"}
+{"ts":1782096438,"arm":"tor","reward_share":1.163,"avg_effort":93.090,"cur_effort":153.230,"hashrate_1h":259695,"hashrate_24h":267179,"shares_found":85,"shares_failed":0,"last_share":1782095134,"peers_out":10,"peers_in":0,"peer_list":728,"pool_hr":22854798,"sidechain_diff":228547987,"tor_cpu_pct":47.93,"tor_mem":"104.6MiB"}
+{"ts":1782096740,"arm":"tor","reward_share":1.164,"avg_effort":93.090,"cur_effort":192.872,"hashrate_1h":260298,"hashrate_24h":267212,"shares_found":85,"shares_failed":0,"last_share":1782095134,"peers_out":10,"peers_in":0,"peer_list":732,"pool_hr":22566916,"sidechain_diff":225669164,"tor_cpu_pct":34.29,"tor_mem":"104.8MiB"}
+{"ts":1782097041,"arm":"tor","reward_share":1.163,"avg_effort":94.383,"cur_effort":18.104,"hashrate_1h":261581,"hashrate_24h":267061,"shares_found":86,"shares_failed":0,"last_share":1782096846,"peers_out":10,"peers_in":0,"peer_list":725,"pool_hr":22639317,"sidechain_diff":226393177,"tor_cpu_pct":34.62,"tor_mem":"104.8MiB"}
+{"ts":1782097342,"arm":"tor","reward_share":1.119,"avg_effort":94.383,"cur_effort":51.400,"hashrate_1h":257754,"hashrate_24h":266988,"shares_found":86,"shares_failed":0,"last_share":1782096846,"peers_out":10,"peers_in":0,"peer_list":705,"pool_hr":23362060,"sidechain_diff":233620603,"tor_cpu_pct":22.54,"tor_mem":"104.3MiB"}
+{"ts":1782097643,"arm":"tor","reward_share":1.118,"avg_effort":94.383,"cur_effort":83.008,"hashrate_1h":254948,"hashrate_24h":266892,"shares_found":86,"shares_failed":0,"last_share":1782096846,"peers_out":10,"peers_in":0,"peer_list":672,"pool_hr":23142023,"sidechain_diff":231420230,"tor_cpu_pct":30.85,"tor_mem":"104.3MiB"}
+{"ts":1782097945,"arm":"tor","reward_share":1.118,"avg_effort":94.383,"cur_effort":120.636,"hashrate_1h":259312,"hashrate_24h":266948,"shares_found":86,"shares_failed":0,"last_share":1782096846,"peers_out":10,"peers_in":0,"peer_list":621,"pool_hr":22978868,"sidechain_diff":229788680,"tor_cpu_pct":32.1,"tor_mem":"104.5MiB"}
+{"ts":1782098246,"arm":"tor","reward_share":1.027,"avg_effort":94.383,"cur_effort":152.432,"hashrate_1h":262396,"hashrate_24h":266849,"shares_found":86,"shares_failed":0,"last_share":1782096846,"peers_out":10,"peers_in":0,"peer_list":535,"pool_hr":23120325,"sidechain_diff":231203256,"tor_cpu_pct":24.39,"tor_mem":"104.5MiB"}
+{"ts":1782098547,"arm":"tor","reward_share":1.072,"avg_effort":95.213,"cur_effort":22.983,"hashrate_1h":264294,"hashrate_24h":266894,"shares_found":87,"shares_failed":0,"last_share":1782098344,"peers_out":10,"peers_in":0,"peer_list":481,"pool_hr":23355944,"sidechain_diff":233559442,"tor_cpu_pct":31.26,"tor_mem":"104.3MiB"}
+{"ts":1782098848,"arm":"tor","reward_share":1.072,"avg_effort":95.213,"cur_effort":54.545,"hashrate_1h":262389,"hashrate_24h":266799,"shares_found":87,"shares_failed":0,"last_share":1782098344,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":22956299,"sidechain_diff":229562999,"tor_cpu_pct":23.78,"tor_mem":"104.5MiB"}
+{"ts":1782099150,"arm":"tor","reward_share":1.072,"avg_effort":95.213,"cur_effort":90.250,"hashrate_1h":259719,"hashrate_24h":266845,"shares_found":87,"shares_failed":0,"last_share":1782098344,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":23186508,"sidechain_diff":231865083,"tor_cpu_pct":34.12,"tor_mem":"104.3MiB"}
+{"ts":1782099451,"arm":"tor","reward_share":1.072,"avg_effort":95.213,"cur_effort":129.438,"hashrate_1h":260647,"hashrate_24h":266902,"shares_found":87,"shares_failed":0,"last_share":1782098344,"peers_out":10,"peers_in":0,"peer_list":479,"pool_hr":22749423,"sidechain_diff":227494236,"tor_cpu_pct":27.42,"tor_mem":"104.3MiB"}
diff --git a/docs/benchmarks/tor-vs-clearnet.md b/docs/benchmarks/tor-vs-clearnet.md
new file mode 100644
index 00000000..417710dd
--- /dev/null
+++ b/docs/benchmarks/tor-vs-clearnet.md
@@ -0,0 +1,227 @@
+# Benchmark: mining over Tor vs clearnet (#256)
+
+This document records a benchmark of mining-path yield over Tor versus clearnet: what we measured, from
+where, and how we decided.
+
+> **Status: complete (2026-06-22).** Routing p2pool over Tor costs **≈10 % of mining yield**
+> on `mini`. The cost is propagation latency (uncle/late shares), not rejects, and **Tor stays the
+> default**. Full per-arm results and the committed raw data are in [Results](#results). The methodology
+> and decision rule below were fixed **before** the run (pre-registration); the run executed on the
+> [test bench](../../tests/integration/testbench-README.md).
+
+## The question
+
+While the stack is actively mining at steady state, does routing the mining-path networking
+over Tor instead of clearnet measurably cost yield or reliability? This gates the Tor-by-default
+decision for two paths:
+
+- p2pool outbound sidechain P2P ([#165](https://github.com/p2pool-starter-stack/pithead/issues/165)) — `p2pool.clearnet` knob.
+- XvB donation mining ([#166](https://github.com/p2pool-starter-stack/pithead/issues/166)) — `xvb.tor` knob.
+
+This is not about initial sync over Tor. That is a separate, already-settled question
+([#183](https://github.com/p2pool-starter-stack/pithead/issues/183)/#234: Tor IBD is impractically
+slow, hence the opt-in clearnet-then-Tor initial sync). Here both monerod and Tari stay on Tor
+throughout; only the p2pool / XvB egress changes between arms.
+
+## What we measure, and from where
+
+Every source below was verified against the live p2pool container on the test bench (`/stats/*` files written
+by p2pool's `--local-api` / `--data-api`, plus the dashboard `/api/state` and `docker stats`).
+
+### Primary — yield (the bottom line)
+
+"Does Tor cost us money" is captured directly by our share of the PPLNS reward window. No raw orphan
+counter is required: an orphaned/uncled share fails to earn its full weight, which shows up here.
+
+| Metric | Meaning | Source · field |
+|---|---|---|
+| **PPLNS reward share** | our % of the sidechain reward window — direct revenue | `/stats/local/stratum` · `block_reward_share_percent` |
+| **Yield efficiency** | reward-share ÷ hashrate-share; `< 1` ⇒ shares going stale | derived: `block_reward_share_percent` ÷ ( `hashrate_1h` ÷ `/stats/pool/stats` · `pool_statistics.hashRate` ) |
+| **Effort** | hashes-per-share vs expected — rises when shares are found but not counted | `/stats/local/stratum` · `average_effort`, `current_effort` |
+| **Uncle / orphan events** (our shares) | raw stale-share count — a mechanism cross-check on the yield number | parse the p2pool **console log** (`SHARE FOUND` + `SideChain` uncle markers); **not** in `/api/state` |
+
+> **Why reward-share is primary, not a raw orphan count.** p2pool includes uncle shares at reduced
+> weight and drops orphans entirely; both effects land in `block_reward_share_percent`, so the net
+> revenue impact is measurable from the stratum stats today. The raw uncle count (log-parse) is kept
+> as a secondary cross-check, not the decision metric. It is noisier and harder to attribute to *our*
+> shares.
+
+### Secondary — the mechanism (latency / connectivity)
+
+These explain why the yield moved, or confirm it didn't. All are available today.
+
+| Metric | Source · field |
+|---|---|
+| Share-found cadence / time-to-first-share | `/stats/local/stratum` · `shares_found`, `last_share_found_time` |
+| Sidechain peer count & churn | `/stats/local/p2p` · `connections`, `incoming_connections`, `peer_list_size` |
+| Stratum-level rejects | `/stats/local/stratum` · `shares_failed` |
+| Effective hashrate on pool | `/stats/local/stratum` · `hashrate_1h`, `hashrate_24h` |
+| Tor daemon overhead under sustained traffic | `docker stats tor` (CPU %, mem) |
+
+### XvB donation path (#166)
+
+> **Not collected in the headline run.** XvB is disabled so the p2pool-yield comparison isn't
+> confounded (see *Method* below). These fields apply only to a separate, dedicated XvB-transport
+> measurement, where they'd be sampled during donation windows (when `algo_service` has routed the
+> proxy to XvB).
+
+| Metric | Source · field |
+|---|---|
+| Accepted / rejected / invalid shares to XvB | xmrig-proxy `/summary` → `/api/state` · `proxy_summary.{accepted,rejected,invalid}` |
+| Credited raffle weight | XvB stats API (already fetched over Tor, #163) · `block_reward_share_percent` analogue at XvB |
+
+## Method
+
+- **Rig:** the test bench (running `develop`) plus the **full RigForge fleet (8 miners,
+  ~269 kH/s combined)** at a **fixed hashrate**, all pointed at the bench's stratum. A constant total
+  hashrate across both arms is load-bearing for the ratio metric below.
+- **Sidechain: `mini`.** At ~269 kH/s we are **~1.8 % of the `mini` sidechain** (observed ~14.75 MH/s),
+  or **~155 of our own shares/day**. That gives enough statistical power while staying a small,
+  representative participant. (`main` at this hashrate yields only ~10 shares/day, too sparse. `nano`
+  would make us **~11 % of the chain**, large enough that our own latency would drag it and overstate the
+  Tor penalty. The uncle/orphan rate is set by the ~10 s share interval, the same on every sidechain,
+  so the `mini` result generalises to `main`/`nano`.)
+- **Design — INTERLEAVED A/B** (not one long block per arm): alternate **T → C → T → C** in fixed
+  **20 h blocks** so each arm samples the same diurnal / weekly / network-weather range. (A "5 days Tor
+  then 5 days clearnet" layout would confound the arm with the calendar period.) **Discard the first
+  3 h after each switch** while p2pool reconnects and the PPLNS window re-stabilises. As run: **6 blocks,
+  3 per arm, over ~5 days**, yielding ~270–290 of our shares per arm. That is below the ideal ≥500, a
+  deliberately shortened schedule, which is why the result is reported as "roughly 10 %"
+  rather than a tight point estimate (see the confidence note in [Results](#results)).
+  - **Arm T (Tor):** `p2pool.clearnet=false` (`--socks5`), `tor_egress_firewall=true`, `xvb.tor=true` —
+    the `develop` defaults (fail-closed, egress-gated).
+  - **Arm C (clearnet):** `p2pool.clearnet=true`, `tor_egress_firewall=false`, `xvb.tor=false`. The
+    **firewall must be off in this arm.** The #270 Tor-egress firewall DROPs direct clearnet dials, so
+    leaving it on would give p2pool 0 sidechain peers and the arm would silently collect garbage. The
+    arm switch toggles the two together. monerod + Tari keep their Tor app-config in both arms, so only
+    p2pool's transport differs; clearnet exposure here is the intended baseline on the test bench.
+  - Only the **mining-path transport** flips. Held constant in both arms: monerod + Tari on Tor,
+    **XvB disabled** (`xvb.enabled=false`, see below), the rig, hashrate, sidechain, and monerod tip.
+  - **Why XvB is disabled for this run.** With `XVB_DONATION_LEVEL=auto` the optimizer dynamically
+    splits the fleet between p2pool and XvB to climb raffle tiers. On the test bench it routed ~96 kH/s
+    to XvB vs only ~18 kH/s to p2pool while chasing the **Whale** tier. That (a) starves p2pool, so
+    `reward_share`, our **primary** metric, would be measured on a fraction of the fleet, and (b)
+    makes the split itself a function of Tor latency, i.e. the optimizer reacts to the very thing we're
+    trying to isolate. Disabling XvB sends the **full ~269 kH/s to p2pool in both arms**, so
+    `reward_share` is a clean readout of transport overhead (and ~155 shares/day, not a trickle). The
+    XvB **transport** overhead (#166) is a separate, smaller question, benchmarked on its own, not
+    folded into the p2pool-yield comparison. The harness re-asserts `xvb.enabled=false` on every
+    `pithead apply` so a switch or recovery can't let the optimizer drift back on.
+  - Every switch is **egress-gated** by `bench-verify-egress.sh`. Arm T must be a clean all-Tor PASS
+    before any data is collected, so a leak can never silently invalidate a window.
+- **Controlling natural variance:** (1) **interleave** (the dominant control); (2) compare the
+  **ratio** yield-efficiency = reward-share ÷ hashrate-share, which cancels out the sidechain's total
+  hashrate drifting as other miners come and go; (3) run to a **target share count**, not a fixed
+  clock, so Poisson noise (~1/√N) sits below the effect we're resolving; (4) the **clearnet arm's
+  block-to-block variance is the noise floor** for the decision; (5) hold everything else constant.
+- **Collector:** [`bench-collect.sh`](../../tests/integration/benchmarks/bench-collect.sh), a
+  read-only poller that snapshots the `/stats/*` fields plus `docker stats tor` into one JSONL line per
+  interval (default 5 min), per arm, in `~/pithead-bench/<arm>.jsonl`. No new container.
+
+## Running it — autonomous on the test bench
+
+The run must survive the operator being offline for days, so **everything runs on the test bench**; a
+laptop / SSH session is only an optional observer. Three layers:
+
+- **[`bench-orchestrate.sh`](../../tests/integration/benchmarks/bench-orchestrate.sh)** (detached on
+  the bench) drives the whole run: flips the arm each block via `pithead apply`, egress-gates the switch,
+  (re)starts the collector, health-checks every cycle, writes `~/pithead-bench/status.json`, and
+  **self-protects**. Transient blips (a miner reconnecting, Tor circuit churn) are tolerated and
+  recorded, but a genuine *unrecoverable* break **pauses collection and marks that window invalid**
+  rather than polluting the dataset. An unwatched multi-day break then costs calendar time, not data.
+- **Cron watchdog** (`*/15 * * * *` plus an `@reboot` entry) runs
+  [`bench-healthcheck.sh`](../../tests/integration/benchmarks/bench-healthcheck.sh): restarts the
+  orchestrator or collector if either died, re-`up`s the stack if it's down, appends `health.log`.
+  This catches the orchestrator itself dying or a bench reboot, which the orchestrator can't
+  self-report. Runs as the operator user; the only privileged step (`iptables`) is covered by the
+  scoped `/etc/sudoers.d/pithead-firewall` grant.
+- **Observe over Tailscale:** `ssh $BENCH_HOST bench-status`
+  ([`bench-status.sh`](../../tests/integration/benchmarks/bench-status.sh)) prints a one-screen
+  summary: current arm, day, last-OK, shares per arm, egress verdict, miners, collector. The
+  dashboard UI (on the bench's Tailscale IP) is the live stack glance.
+
+### Runbook
+
+```bash
+# 1. calibrate (~6–12 h, Tor arm): confirm live mini total, our share, shares/day
+tests/integration/benchmarks/bench-orchestrate.sh --calibrate --pool mini
+
+# 2. start the autonomous interleaved run + install the watchdog cron
+#    (the exact invocation used for the run recorded in Results)
+nohup tests/integration/benchmarks/bench-orchestrate.sh run \
+      --pool mini --block-hours 20 --blocks 6 --settle-hours 3 --interval 300 >/dev/null 2>&1 &
+tests/integration/benchmarks/bench-orchestrate.sh --install-cron   # */15 + @reboot watchdog
+
+# 3. check from anywhere over Tailscale
+ssh $BENCH_HOST bench-status
+ssh $BENCH_HOST tail -n 40 pithead-bench/health.log
+
+# 4. graceful stop (restores the Tor default + egress firewall + re-enables XvB, removes the cron, keeps the JSONL)
+tests/integration/benchmarks/bench-orchestrate.sh --stop
+```
+
+## Decision rule
+
+The clearnet arm establishes the **noise floor** (its own variance across sub-windows). Then:
+
+- **Tor yield-efficiency / reward-share delta within that noise floor** ⇒ keep **Tor as the default**
+  for that path (#165/#166 ship as-is); document the measured (negligible) trade-off.
+- **Tor materially below clearnet** (a reward-share loss clearly outside the noise, especially if
+  concentrated on `--mini`/`--nano`) ⇒ document the trade-off and reconsider: a **per-sidechain
+  default**, or **clearnet-default with a Tor opt-in**, rather than a blanket Tor default.
+
+Either way the conclusion lands in [`docs/privacy.md`](../privacy.md) so operators get an honest
+trade-off, and it sets the final default for #165/#166 before the v1.1 release.
+
+## Results
+
+**Run:** `mini`, 2026-06-17 → 2026-06-22 (~5 days), 6 × 20h blocks interleaved T/C/T/C/T/C (3 per arm),
+first 3h of each block discarded. Full **8-miner fleet ≈ 269 kH/s held constant**, **XvB disabled**
+so the whole fleet hit p2pool in both arms. The sidechain grew from ~14.7 to ~20.9 MH/s over the run
+(our share drifted ~1.8 % → ~1.3 %), which is why the yield-efficiency ratio (reward ÷
+hashrate share) is the headline metric, not raw reward share. ~1,220 post-settle snapshots total.
+Reproduce with `python3 tests/integration/benchmarks/bench-analyze.py docs/benchmarks/data/run-2026-06-17-mini`;
+the raw per-arm JSONL plus `events.log` are committed there (originals on the test bench at `~/pithead-bench/`).
+
+**Per-arm** (mean of the 3 block means; ± is the block-to-block stdev, the noise floor):
+
+| Arm | Blocks | Reward share % | Yield-efficiency | Avg effort % | Shares | Rejects | Peers | Tor-daemon CPU |
+|---|---|---|---|---|---|---|---|---|
+| clearnet | 3 | **1.375 ± 0.132** | **1.054 ± 0.085** | 89.9 | 292 | 0 | 10.0 | 19.6 % |
+| Tor | 3 | **1.218 ± 0.157** | **0.933 ± 0.098** | 112.9 | 270 | 0 | 10.2 | 18.7 % |
+| **Δ (Tor vs clearnet)** | | **−11.4 %** | **−11.5 %** | +23 pts | −7.5 % | — | ≈0 | ≈0 |
+
+**Per-block** (transparency; note the ranges overlap):
+
+| Blk | Arm | Reward % | Yield-eff | Effort % | Shares |
+|---|---|---|---|---|---|
+| 1 | Tor | 1.396 | 0.860 | 111.8 | 107 |
+| 2 | clearnet | 1.543 | 0.969 | 95.6 | 111 |
+| 3 | Tor | 1.013 | 0.869 | 125.0 | 76 |
+| 4 | clearnet | 1.363 | 1.170 | 86.3 | 94 |
+| 5 | Tor | 1.245 | 1.071 | 101.9 | 87 |
+| 6 | clearnet | 1.220 | 1.024 | 87.7 | 87 |
+
+**Findings:**
+
+1. **Tor costs ≈ 10–12 % of p2pool yield** on `mini`. Reward share and yield-efficiency agree (−11.4 % /
+   −11.5 %), and the direction is consistent across the run.
+2. **The cost is propagation latency, not anything else.** Rejects were **0 in both arms**, the Tor
+   daemon used the **same CPU** in both (~19 %, since monerod + Tari route over Tor regardless of arm),
+   and peer counts matched (~10). The only moving part is share-propagation delay over Tor, which shows up
+   as **higher effort on Tor (113 % vs 90 %)**: more hashing per counted share, i.e. more shares
+   landing as uncles or too late for the PPLNS window.
+3. **Confidence: moderate, not precise.** With 3 blocks per arm the ~11 % effect sits only modestly
+   above the clearnet block-to-block noise floor (±8–10 %), and per-block yield-eff ranges overlap
+   (Tor 0.86–1.07 vs clearnet 0.97–1.17). Read it as "**roughly 10 %**", economically real and
+   directionally consistent, but not a tight point estimate. A longer run would narrow the interval.
+
+**Recommendation — keep Tor the default (#165/#166 ship as-is in `develop`).** Per the decision rule
+this is the "materially below clearnet" case, so the trade-off is documented rather than hidden. Not
+exposing the operator's home IP to the P2Pool network is the project's core value, and **~10 % is a
+modest, opt-out-able price** for it. Operators who prioritise yield over IP privacy can set
+`p2pool.clearnet: true` (now functional; it was a no-op until the #294 firewall-toggle fix
+found during this benchmark) and accept the exposure. No per-sidechain split is warranted: the
+mechanism is the ~10 s share interval, common to every sidechain, so `mini` is representative. The
+absolute cost is largest on the smaller, faster chains where our share, and thus uncle sensitivity,
+is highest. This conclusion is mirrored operator-facing in [`../privacy.md`](../privacy.md).
diff --git a/docs/configuration.md b/docs/configuration.md
index d9aad647..43d658cc 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -1,17 +1,15 @@
 # Configuration
 
-`config.json` is the **single source of truth** for the entire stack. The interactive `setup`
-writes a minimal one for you; from then on you change the stack by editing `config.json` and
-running `./pithead apply`.
+`config.json` is the single source of truth for the stack. The interactive `setup` writes a minimal
+one for you. After that, change the stack by editing `config.json` and running `./pithead apply`.
 
 ## The minimal config
 
-Only your two **wallet addresses** are required. **Every other key is optional and falls back to
-a sensible default** — the node runs locally, on the `main` pool, with a secure dashboard, and the
-local node's RPC credentials are **auto-generated** for you — so leave a key out unless you want to
-change it.
+Only your two wallet addresses are required. Every other key is optional and falls back to a default:
+the node runs locally, on the `main` pool, with a secure dashboard, and the local node's RPC
+credentials are auto-generated. Leave a key out unless you want to change it.
 
-A fresh `config.json` is just this (see [`config.json.template`](../config.json.template)):
+A fresh `config.json` is just this (see [`config.minimal.json`](../config.minimal.json)):
 
 ```json
 {
@@ -24,11 +22,11 @@ A fresh `config.json` is just this (see [`config.json.template`](../config.json.
 }
 ```
 
-For the complete shape with **every** key and its default, see
-[`config.advanced.example.json`](../config.advanced.example.json) and copy in only the keys you
+For the full shape with every key and its default, see
+[`config.reference.json`](../config.reference.json) and copy in only the keys you
 want to override.
 
-> The string `"auto"` anywhere means **"let the stack pick the default"** — a default path, the
+> The string `"auto"` anywhere means "let the stack pick the default": a default path, the
 > machine's hostname, a derived donor id, and so on.
 
 ---
@@ -38,17 +36,16 @@ want to override.
 1. Edit `config.json`.
 2. Run `./pithead apply`.
 
-`apply` is designed to be safe to run anytime:
+`apply` is safe to run anytime:
 
-- It **previews exactly what will change**, diffing your edited `config.json` against the running
-  configuration.
-- It **warns before anything disruptive** — switching the Monero node local↔remote, toggling
-  pruning, changing a payout address, exposing the RPC to your LAN, or moving a data directory all
-  trigger a confirmation prompt.
-- It then regenerates the `.env`, Caddy, and Tari configs and recreates **only** the containers
-  that actually need it.
-- It does **not** re-provision Tor, touch GRUB, or rotate the proxy token. If nothing changed, it
-  does nothing.
+- It previews what will change, diffing your edited `config.json` against the running configuration.
+- It warns before anything disruptive. Switching the Monero node local↔remote, toggling pruning,
+  changing a payout address, exposing the RPC to your LAN, or moving a data directory each trigger a
+  confirmation prompt.
+- It then regenerates the `.env`, Caddy, and Tari configs and recreates only the containers that
+  need it.
+- It does not re-provision Tor, touch GRUB, or rotate the proxy token. If nothing changed, it does
+  nothing.
 
 ```bash
 # edit config.json, then:
@@ -63,47 +60,68 @@ plain HTTP, edit `config.json` and run `./pithead apply`.
 
 ## Configuration reference
 
-> **Only `monero.wallet_address` and `tari.wallet_address` are required.** Everything below is
-> optional and has a sensible default — add a key only when you want to change its behavior.
+> Only `monero.wallet_address` and `tari.wallet_address` are required. Everything below is optional
+> and has a default. Add a key only when you want to change its behavior.
 
 | Key | Default | Description |
 |---|---|---|
 | `monero.mode` | `local` | `local` runs the bundled Monero node; `remote` connects to an external node (see `monero.remote`). |
-| `monero.wallet_address` | _required_ | Your Monero payout address — must be a **primary/standard** address (starts with `4`, 95 chars). **Subaddresses (`8…`) and integrated addresses are _not_ supported**: p2pool pays via coinbase, which can't send to them, and XvB credits by this address — a wrong type mines but is never paid. `setup`/`apply` reject the wrong type, and `doctor` flags it. |
-| `monero.node_username` / `node_password` | _auto (local)_ | Credentials for the local node's RPC, used only inside the stack (monerod, p2pool, and the dashboard, which reads the node's `get_info` for sync status). **Leave them blank** — on `setup` and on every `apply`, the stack fills in anything missing (username `admin`, a random alphanumeric password) and writes the values back into `config.json`, so they stay stable and you can see what was set. Set these yourself only for a **remote** node that requires RPC auth. |
-| `monero.prune` | `true` | Prune the Monero blockchain to save disk space. The dashboard's Monero panel shows the resulting **Pruned**/**Full** mode and the node's on-disk DB size, so you can spot a config-vs-data mismatch when reusing a chain. |
-| `monero.clearnet_initial_sync` | `false` | **Privacy-relevant, default off.** `true` makes monerod do its **initial block download over clearnet** (much faster than Tor) by dropping the Tor P2P `proxy=` and lowering `out-peers` to 16; transaction broadcast **stays on Tor** and wallets are never exposed. Your node's **IP becomes visible** to the Monero P2P network while it's on, and `pithead` warns loudly (apply/status/doctor/up) the whole time. **The dashboard switches monerod back to Tor automatically once the chain is synced** (#234) and keeps it there — you can leave this `true`. Full threat model: [Privacy › Optional clearnet initial sync](privacy.md#optional-clearnet-initial-sync-off-by-default). |
+| `monero.wallet_address` | _required_ | Your Monero payout address. Must be a primary/standard address (starts with `4`, 95 chars). Subaddresses (`8…`) and integrated addresses are not supported: p2pool pays via coinbase, which can't send to them, and XvB credits by this address. A wrong type mines but is never paid. `setup`/`apply` reject the wrong type, and `doctor` flags it. |
+| `monero.node_username` / `node_password` | _auto (local)_ | Credentials for the local node's RPC, used only inside the stack (monerod, p2pool, and the dashboard, which reads the node's `get_info` for sync status). Leave them blank. On `setup` and on every `apply`, the stack fills in anything missing (username `admin`, a random alphanumeric password) and writes the values back into `config.json`, so they stay stable and you can see what was set. Set these yourself only for a remote node that requires RPC auth. |
+| `monero.prune` | `true` | Prune the Monero blockchain to save disk space. The dashboard's Monero panel shows the resulting Pruned/Full mode and the node's on-disk DB size, so you can spot a config-vs-data mismatch when reusing a chain. |
+| `monero.clearnet_initial_sync` | `false` | Privacy-relevant, default off. `true` makes monerod do its initial block download over clearnet (much faster than Tor) by dropping the Tor P2P `proxy=` and lowering `out-peers` to 16. Transaction broadcast stays on Tor and wallets are never exposed. Your node's IP becomes visible to the Monero P2P network while it's on, and `pithead` warns loudly (apply/status/doctor/up) the whole time. The dashboard switches monerod back to Tor automatically once the chain is synced (#234) and keeps it there, so you can leave this `true`. Full threat model: [Privacy › Optional clearnet initial sync](privacy.md#optional-clearnet-initial-sync-off-by-default). |
 | `monero.prep_blocks_threads` | `auto` | Block-verification threads during sync. `auto` = host cores − 2, clamped to 4–8. |
 | `monero.rpc_lan_access` | `false` | `true` publishes the node's RPC on the LAN (`0.0.0.0`) for wallets on other machines; default is localhost-only. |
 | `monero.remote.host` / `rpc_port` / `zmq_port` | — / `18081` / `18083` | Remote node connection details (used when `mode` is `remote`). |
-| `monero.data_dir` | `auto` | Where the Monero blockchain lives on the host. `auto` = `./data/monero`. Point this at an existing `.bitmonero` directory to reuse a synced node — see [Reusing an existing node](#reusing-an-existing-node). |
-| `monero.mem_limit` | `auto` | Upper limit on the monerod container's memory, so a leak/runaway OOM-restarts monerod alone instead of the host's OOM-killer picking a victim. `auto` is a generous ceiling (**6 GB**) that won't trip during normal operation **or initial sync** — monerod's OOM-triggering memory is small (~0.1 GiB at rest, ~1–3 GiB during sync) while its multi-GB blockchain DB is reclaimable, memory-mapped page cache that the kernel evicts under pressure rather than OOM-killing. Lower it only to free RAM; **raise it** for a **full (unpruned) node** doing a heavy initial sync on a fast disk, or if a low-RAM host ever OOMs monerod during IBD (it restarts and resumes — the on-disk chain is transactional, no data loss). Accepts any Docker memory value, e.g. `"8g"`. (Tari has its own `tari.mem_limit`; the dashboard, P2Pool, Tor, and the proxies are small and carry fixed conservative ceilings in `docker-compose.yml`.) |
+| `monero.data_dir` | `auto` | Where the Monero blockchain lives on the host. `auto` = `./data/monero`. Point this at an existing `.bitmonero` directory to reuse a synced node. See [Reusing an existing node](#reusing-an-existing-node). |
+| `monero.mem_limit` | `auto` | Upper limit on the monerod container's memory, so a leak/runaway OOM-restarts monerod alone instead of the host's OOM-killer picking a victim. `auto` is a generous ceiling (6 GB) that won't trip during normal operation or initial sync. monerod's OOM-triggering memory is small (~0.1 GiB at rest, ~1–3 GiB during sync) while its multi-GB blockchain DB is reclaimable, memory-mapped page cache that the kernel evicts under pressure rather than OOM-killing. Lower it only to free RAM. Raise it for a full (unpruned) node doing a heavy initial sync on a fast disk, or if a low-RAM host ever OOMs monerod during IBD (it restarts and resumes; the on-disk chain is transactional, no data loss). Accepts any Docker memory value, e.g. `"8g"`. (Tari has its own `tari.mem_limit`; the dashboard, P2Pool, Tor, and the proxies are small and carry fixed conservative ceilings in `docker-compose.yml`.) |
 | `tari.wallet_address` | _required_ | Your Tari (Minotari) payout address. |
-| `tari.clearnet_initial_sync` | `false` | **Privacy-relevant, default off.** `true` makes the Tari base node sync over **clearnet** instead of Tor — it switches the P2P transport to TCP, re-enables the `seeds.tari.com` DNS seed (the bundled onion `peer_seeds` are unreachable without Tor), and stops advertising its onion. Your node's **IP becomes visible** to the Tari P2P network while it's on, plus one DNS lookup of `seeds.tari.com`. `pithead` warns loudly (apply/status/doctor/up). **The dashboard switches Tari back to Tor automatically once it's synced** (#234) — you can leave this `true`. Full threat model: [Privacy › Optional clearnet initial sync](privacy.md#optional-clearnet-initial-sync-off-by-default). |
+| `tari.clearnet_initial_sync` | `false` | Privacy-relevant, default off. `true` makes the Tari base node sync over clearnet instead of Tor: it switches the P2P transport to TCP, re-enables the `seeds.tari.com` DNS seed (the bundled onion `peer_seeds` are unreachable without Tor), and stops advertising its onion. Your node's IP becomes visible to the Tari P2P network while it's on, plus one DNS lookup of `seeds.tari.com`. `pithead` warns loudly (apply/status/doctor/up). The dashboard switches Tari back to Tor automatically once it's synced (#234), so you can leave this `true`. Full threat model: [Privacy › Optional clearnet initial sync](privacy.md#optional-clearnet-initial-sync-off-by-default). |
 | `tari.data_dir` | `auto` | Where the Tari node data lives on the host. `auto` = `./data/tari`. |
-| `tari.mem_limit` | `auto` | Upper limit on the Tari container's memory, so a runaway Tari restarts cleanly on its own instead of dragging down the whole host. `auto` picks a safe size for your machine — leave it unless you want to give Tari less RAM (to free it for other apps) or more (if it ever restarts too often). Accepts any Docker memory value, e.g. `"8g"`. |
-| `p2pool.pool` | `main` | Which P2Pool sidechain to mine: `main`, `mini`, or `nano`. **Lower hashrate? Pick `mini` (or `nano`).** They have a lower share difficulty, so you find shares far more often — smoother, more frequent PPLNS payouts instead of long dry spells. `main` suits high hashrate; `mini`/`nano` suit typical home rigs. |
-| `p2pool.stratum_bind` | `0.0.0.0` | Host **bind address** for the stratum port (`3333`) your rigs connect to — a single IPv4 address (maps to Docker's port-publish host IP), **not** a subnet/CIDR. Default `0.0.0.0` reaches the whole LAN out of the box; set a specific LAN IP (e.g. `192.168.1.10`) to limit it to one interface, or `127.0.0.1` to disable LAN access entirely. To restrict *which source subnet* may connect, use a firewall — see [Connecting Miners › Firewall](workers.md#firewall). |
-| `p2pool.stratum_password` | `""` _(off)_ | Optional **password every rig must send** to mine through the proxy — turns the otherwise-open `3333` port into authenticated stratum. `""` (default) = no password, any rig may connect. `"auto"` = generate a random secret once and keep it stable (shown after `setup`/`apply` and stored in `.env`); set it as each rig's stratum `pass`. Any literal string = use exactly that password. Only devices that know the secret can mine — which also shrinks the worker-name [SSRF](workers.md#authentication) surface. The password is sent **in cleartext** over stratum, so this is access control ("who may mine"), **not** encryption — pair it with `stratum_bind`/a firewall. See [Connecting Miners › Authentication](workers.md#authentication). |
+| `tari.mem_limit` | `auto` | Upper limit on the Tari container's memory, so a runaway Tari restarts cleanly on its own instead of dragging down the whole host. `auto` picks a safe size for your machine. Leave it unless you want to give Tari less RAM (to free it for other apps) or more (if it ever restarts too often). Accepts any Docker memory value, e.g. `"8g"`. |
+| `p2pool.pool` | `main` | Which P2Pool sidechain to mine: `main`, `mini`, or `nano`. Lower hashrate? Pick `mini` (or `nano`). They have a lower share difficulty, so you find shares far more often: smoother, more frequent PPLNS payouts instead of long dry spells. `main` suits high hashrate; `mini`/`nano` suit typical home rigs. |
+| `p2pool.stratum_bind` | `0.0.0.0` | Host bind address for the stratum port (`3333`) your rigs connect to. A single IPv4 address (maps to Docker's port-publish host IP), not a subnet/CIDR. Default `0.0.0.0` reaches the whole LAN with no setup; set a specific LAN IP (e.g. `192.168.1.10`) to limit it to one interface, or `127.0.0.1` to disable LAN access entirely. To restrict which source subnet may connect, use a firewall. See [Connecting Miners › Firewall](workers.md#firewall). |
+| `p2pool.stratum_password` | `""` _(off)_ | Optional password every rig must send to mine through the proxy. Turns the otherwise-open `3333` port into authenticated stratum. `""` (default) = no password, any rig may connect. `"auto"` = generate a random secret once and keep it stable (shown after `setup`/`apply` and stored in `.env`); set it as each rig's stratum `pass`. Any literal string = use exactly that password. Only devices that know the secret can mine, which also shrinks the worker-name [SSRF](workers.md#authentication) surface. The password is sent in cleartext over stratum, so this is access control ("who may mine"), not encryption. Pair it with `stratum_bind`/a firewall. See [Connecting Miners › Authentication](workers.md#authentication). |
+| `p2pool.clearnet` | `false` | Privacy-relevant, default off (Tor). P2Pool's `--onion-address` only advertises an onion for inbound peers; its outbound sidechain dials need a SOCKS proxy or they go over clearnet, exposing your home IP. Default (`false`) routes those dials through the bundled Tor proxy (`--socks5 <tor>:9050 --socks5-proxy-type tor`). Set `true` to dial peers directly over clearnet for maximum yield: Tor latency raises the stale/uncle-share rate and onion-only shrinks the peer set, both worse on `--mini`/`--nano`, so a high-variance small rig may prefer clearnet (at the cost of IP exposure). Full threat model: [Privacy › P2Pool outbound peers](privacy.md#p2pool-outbound-peers-165--tor-by-default). |
 | `p2pool.data_dir` | `auto` | Where P2Pool data lives on the host. `auto` = `./data/p2pool`. |
-| `proxy.donate_level` | `0` | xmrig-proxy's built-in **dev-fee donation** to the xmrig developers, as a percentage of submitted hashrate. Defaults to **`0` — no donation** (xmrig-proxy's own compiled-in default, which the stack now renders explicitly so it's visible rather than invisible). Set an integer `1`–`99` to donate that share to the xmrig devs if you want to support them. **This is not the XvB donation** — that's the separate `xvb.*` mechanism the optimizer steers, never this dev fee. |
+| `proxy.donate_level` | `0` | xmrig-proxy's built-in dev-fee donation to the xmrig developers, as a percentage of submitted hashrate. Defaults to `0`, no donation (xmrig-proxy's own compiled-in default, which the stack now renders explicitly so it's visible rather than invisible). Set an integer `1`–`99` to donate that share to the xmrig devs if you want to support them. This is not the XvB donation; that's the separate `xvb.*` mechanism the optimizer steers, never this dev fee. |
 | `xvb.enabled` | `true` | Enable XMRvsBeast bonus-round hashrate switching. |
 | `xvb.url` | `na.xmrvsbeast.com:4247` | XMRvsBeast pool endpoint. |
 | `xvb.donor_id` | `auto` | XvB donor id. `auto` = the first 8 characters of your Monero address. |
-| `xvb.donation_level` | `auto` | Donation tier to target: `auto` (the highest tier your hashrate can sustain) or a specific tier — **`donor` (1 kH/s) / `vip` (10 kH/s) / `whale` (100 kH/s) / `mega` (1 MH/s)** — where the figure is the donation hashrate you must hold on both your 1h and 24h averages. A specific tier is honored even if your hashrate can't hold it — the dashboard shows a warning badge in that case. (The `vip` tier is a donation level, not the dashboard's separate **Raffle Eligible** status; see [Architecture › Algorithmic switching](architecture.md#algorithmic-switching).) |
+| `xvb.donation_level` | `auto` | Donation tier to target: `auto` (the highest tier your hashrate can sustain) or a specific tier: `donor` (1 kH/s) / `vip` (10 kH/s) / `whale` (100 kH/s) / `mega` (1 MH/s), where the figure is the donation hashrate you must hold on both your 1h and 24h averages. A specific tier is honored even if your hashrate can't hold it; the dashboard shows a warning badge in that case. (The `vip` tier is a donation level, not the dashboard's separate Raffle Eligible status; see [Architecture › Algorithmic switching](architecture.md#algorithmic-switching).) |
+| `xvb.tor` | `true` | Privacy-relevant, default on (Tor). While donating, the proxy connects to `na.xmrvsbeast.com`, which would otherwise expose your home IP to XvB. Default (`true`) routes that connection through the bundled Tor proxy (a per-pool `socks5` on the XvB pool; DNS resolved proxy-side). Set `false` to dial direct over clearnet for maximum yield: stratum-over-Tor adds latency that can raise rejected shares (scales with hashrate). Only the XvB pool is affected; your local p2pool stratum is unaffected. Full threat model: [Privacy › XvB donation mining](privacy.md#xvb-donation-mining-166--tor-by-default). |
 | `tor.data_dir` | `auto` | Where Tor's state (including onion keys) lives. `auto` = `./data/tor`. |
 | `dashboard.secure` | `true` | `true` serves the dashboard over HTTPS (Caddy `tls internal`); `false` uses plain HTTP. |
 | `dashboard.host` | `auto` | Hostname you use to reach the dashboard. `auto` = this machine's hostname. |
 | `dashboard.auth.username` | `admin` | Login name for the dashboard when a password is set (see below). Letters, digits, and `. _ @ -`, 1–64 chars. Ignored while `dashboard.auth.password` is empty. |
-| `dashboard.auth.password` | `""` _(off)_ | Optional **password to open the dashboard** — turns on a Caddy [HTTP basic-auth](https://caddyserver.com/docs/caddyfile/directives/basic_auth) prompt in front of every page. `""` (default) = **no login**, anyone who can reach the dashboard sees it (fine for a private LAN appliance). Any 8–128-character string (no double-quotes) turns the prompt on. The plaintext lives **only in your owner-only `config.json`**; pithead bcrypt-hashes it with the pinned Caddy image and stores **only the hash** in `.env`, so the password itself is never persisted in rendered state. Basic-auth credentials travel in cleartext over HTTP, so keep `dashboard.secure: true` (the default) — pithead warns if you set a password with `secure: false`. See [Exposing the dashboard safely](#exposing-the-dashboard-safely). |
-| `dashboard.timezone` | `auto` | Timezone for the dashboard's timestamps and charts. `auto` = **the host machine's timezone** (auto-detected, falling back to `Etc/UTC`); set an IANA name (e.g. `America/Chicago`) to override. |
+| `dashboard.auth.password` | `""` _(off)_ | Optional password to open the dashboard. Turns on a Caddy [HTTP basic-auth](https://caddyserver.com/docs/caddyfile/directives/basic_auth) prompt in front of every page. `""` (default) = no login, anyone who can reach the dashboard sees it (fine for a private LAN appliance). Any 8–128-character string (no double-quotes) turns the prompt on. The plaintext lives only in your owner-only `config.json`; pithead bcrypt-hashes it with the pinned Caddy image and stores only the hash in `.env`, so the password itself is never persisted in rendered state. Basic-auth credentials travel in cleartext over HTTP, so keep `dashboard.secure: true` (the default); pithead warns if you set a password with `secure: false`. See [Exposing the dashboard safely](#exposing-the-dashboard-safely). |
+| `dashboard.timezone` | `auto` | Timezone for the dashboard's timestamps and charts. `auto` = the host machine's timezone (auto-detected, falling back to `Etc/UTC`); set an IANA name (e.g. `America/Chicago`) to override. |
 | `dashboard.data_dir` | `auto` | Where the dashboard's database lives. `auto` = `./data/dashboard`. |
-| `dashboard.check_for_updates` | `true` _(on)_ | The dashboard periodically asks GitHub whether a **newer Pithead release** exists and, if so, shows a header badge linking to it (e.g. "New release v1.4.0 available"). **Notify-only** — it never updates anything; you upgrade with `./pithead upgrade` on your own terms. **On by default** because the check is **routed over Tor** (the same bridge SOCKS as the XvB fetch, `socks5h` so the DNS lookup goes through Tor too) — GitHub sees a Tor exit, not your IP, so it's a privacy-safe default. It's cached (hourly) and fails silently offline. Set to `false` to opt out entirely. See [Privacy › Runtime egress](privacy.md#runtime-egress). |
-| `dashboard.tari_required` | `true` | How much a Tari problem holds up the rest of the stack. Monero is **required** to mine, so its behavior isn't configurable: a monerod outage always rejects workers (stops `xmrig-proxy` so miners **fail over to their backup pools**), and the miner is always held until monerod finishes syncing. Tari is **only needed for merge mining**, so this one flag decides how much it blocks. **`true` (default):** a Tari outage also rejects workers, the miner waits for Tari's initial sync too, and a Tari-only (re)sync shows the full-screen Sync view. **`false` (non-blocking):** keep mining Monero through a Tari outage, start mining as soon as Monero is synced (Tari finishes in the background), and keep the normal dashboard — with a `Tari syncing` indicator — instead of the takeover screen. |
-| `network.subnet` | `172.28.0.0/24` | The private Docker bridge the stack's containers run on. Change it **only** if install fails with `Pool overlaps with other one on this address space` — i.e. your host already uses `172.28.0.0/24` for another Docker network or interface. Must be a free **`X.Y.Z.0/24`** block (e.g. `"172.30.0.0/24"`); the services keep their fixed host octets (`.25`–`.31`) within it, so the structured addressing the dashboard and the worker SSRF guard rely on is preserved. |
+| `dashboard.check_for_updates` | `true` _(on)_ | The dashboard periodically asks GitHub whether a newer Pithead release exists and, if so, shows a header badge linking to it (e.g. "New release v1.4.0 available"). Notify-only: it never updates anything; you upgrade with `./pithead upgrade` on your own terms. On by default because the check is routed over Tor (the same bridge SOCKS as the XvB fetch, `socks5h` so the DNS lookup goes through Tor too), so GitHub sees a Tor exit, not your IP. It's cached (hourly) and fails silently offline. Set to `false` to opt out entirely. See [Privacy › Runtime egress](privacy.md#runtime-egress). |
+| `dashboard.tari_required` | `true` | How much a Tari problem holds up the rest of the stack. Monero is required to mine, so its behavior isn't configurable: a monerod outage always rejects workers (stops `xmrig-proxy` so miners fail over to their backup pools), and the miner is always held until monerod finishes syncing. Tari is only needed for merge mining, so this one flag decides how much it blocks. `true` (default): a Tari outage also rejects workers, the miner waits for Tari's initial sync too, and a Tari-only (re)sync shows the full-screen Sync view. `false` (non-blocking): keep mining Monero through a Tari outage, start mining as soon as Monero is synced (Tari finishes in the background), and keep the normal dashboard, with a `Tari syncing` indicator, instead of the takeover screen. |
+| `network.subnet` | `172.28.0.0/24` | The private Docker bridge the stack's containers run on. Change it only if install fails with `Pool overlaps with other one on this address space`, i.e. your host already uses `172.28.0.0/24` for another Docker network or interface. Must be a free `X.Y.Z.0/24` block (e.g. `"172.30.0.0/24"`); the services keep their fixed host octets (`.25`–`.31`) within it, so the structured addressing the dashboard and the worker SSRF guard rely on is preserved. |
+| `network.tor_egress_firewall` | `true` _(on)_ | Privacy-relevant, default on. Enforces "behind Tor" fail-closed: at `up`/`apply`, `pithead` installs host firewall rules (Docker's `DOCKER-USER` chain) that drop any direct clearnet dial from the mining containers (monerod/p2pool/tari/xmrig-proxy). Only the Tor container reaches the internet, so a misconfigured or buggy daemon can't leak your IP. Needs root (like the GRUB/HugePages steps); removed at `down`. Set `false` to skip it and rely on per-app Tor config only (e.g. a host where you manage egress yourself, or where `iptables` isn't available). Full detail: [Privacy › Enforced fail-closed](privacy.md#enforced-fail-closed-not-just-configured-270). |
+| `workers.api_auth` | `none` | How the dashboard reads each worker's xmrig API. Beyond what the proxy reports, the dashboard probes every connected miner's own xmrig HTTP API (`/1/summary`) for uptime and per-miner hashrate, one configured way, no auto-detection. `none` (default) expects an open, read-only API (xmrig `http.restricted` with no `access-token`), which is what a stock RigForge worker exposes. `name` sends the worker's stratum name as the Bearer token (for miners whose `access-token` equals their name). `token` sends a single shared `workers.api_token` for every worker. A worker whose probe fails isn't dropped: it keeps its proxy-reported hashrate and is flagged `api ⚠` on the dashboard, with one log line explaining why (so a misconfigured API is distinct from an offline miner). Upgrading from a build whose miners set an `access-token`? Set this to `name` (or reprovision the miners to drop the token), otherwise the default no-auth probe `401`s and every worker shows `api ⚠`. |
+| `workers.api_token` | `""` | The single shared Bearer token used when `workers.api_auth` is `token`. Ignored otherwise. |
+| `workers.api_port` | `8080` | TCP port the worker xmrig API listens on. Change only if your miners expose the API on a non-standard port. |
 
 ---
 
+### XvB raffle auto-registration (`XVB_SUBMIT_URL`)
+
+When XvB is enabled, the stack auto-registers your wallet in the XMRvsBeast raffle once you have a P2Pool PPLNS share, no manual signup ([FAQ](faq.md#do-i-have-to-sign-up-for-the-xvb-raffle)). The registration call carries your full wallet address and is always routed over Tor like the XvB stats fetch (it is not subject to the `xvb.tor` donation opt-out), so it never exposes your IP ([Privacy › Runtime egress](privacy.md#runtime-egress)). It re-registers on a daily cadence and is idempotent (re-running an already-entered wallet is a no-op).
+
+The endpoint ships as the working default, so it is not a `config.json` key. Two `XVB_SUBMIT_URL` environment overrides exist for operators who need them:
+
+- Set it to a URL to point registration at a different endpoint (e.g. a test server).
+- Set it to a disable sentinel (`off` / `none` / `false` / `disabled` / `0`) to turn auto-registration off while keeping the rest of XvB running. (`xvb.enabled: false` stops _all_ XvB activity instead.)
+
+The dashboard surfaces the result as a header badge:
+
+- `XvB raffle ✓`: registered (or already entered).
+- `⚠ XvB wallet rejected`: the endpoint rejected your wallet as invalid; the raffle needs a standard primary Monero address (`4…`). Check `monero.wallet_address`.
+- `⚠ XvB registration failing`: the endpoint is unreachable or erroring despite a PPLNS share (transient; retried automatically).
+
 ## Data directories
 
 Every stateful service stores its data in a host directory that you can place anywhere. By
@@ -111,13 +129,13 @@ default each one lives under `./data/<service>` inside the repo:
 
 | Service | Config key | Default path | Mounted in container at |
 |---|---|---|---|
-| Monero | `monero.data_dir` | `./data/monero` | `/root/.bitmonero` |
+| Monero | `monero.data_dir` | `./data/monero` | `/home/ubuntu/.bitmonero` |
 | Tari | `tari.data_dir` | `./data/tari` | `/var/tari/node` |
-| P2Pool | `p2pool.data_dir` | `./data/p2pool` | `/root` |
+| P2Pool | `p2pool.data_dir` | `./data/p2pool` | `/home/ubuntu` |
 | Tor | `tor.data_dir` | `./data/tor` | `/var/lib/tor` |
 | Dashboard | `dashboard.data_dir` | `./data/dashboard` | `/data` |
 
-Set any `data_dir` to an absolute path to move that service's storage — for example, to put the
+Set any `data_dir` to an absolute path to move that service's storage. For example, to put the
 Monero blockchain on a dedicated SSD:
 
 ```json
@@ -134,7 +152,7 @@ Then run `./pithead apply`. Moving a data directory is treated as a disruptive c
 `apply` confirms before recreating the affected container. `apply` creates any missing directory
 and sets ownership automatically (Monero/Tari/P2Pool to your user, Tor to the container's user).
 
-> **Note:** `apply` does **not** copy your existing data into a new location — it only points the
+> NOTE: `apply` does not copy your existing data into a new location; it only points the
 > container at the new path. If you're relocating data you already have, move the files yourself
 > first (with the stack stopped), then update `data_dir` and run `apply`.
 
@@ -142,16 +160,16 @@ and sets ownership automatically (Monero/Tari/P2Pool to your user, Tor to the co
 
 ## Exposing the dashboard safely
 
-The dashboard is designed for a **trusted private network** — the home or office LAN the appliance
-sits on. By default it has no login: anyone who can reach the host can open it. That's the right
-trade-off for a single-user box behind your router, and it stays the default.
+The dashboard is built for a trusted private network: the home or office LAN the appliance sits on.
+By default it has no login: anyone who can reach the host can open it. That's the right trade-off
+for a single-user box behind your router, and it stays the default.
 
-You should add a login (and keep HTTPS on) whenever the dashboard is reachable by anyone you don't
-fully trust — for example:
+Add a login (and keep HTTPS on) whenever the dashboard is reachable by anyone you don't fully trust.
+For example:
 
-- the machine is **shared** (a co-hosted home server other people use), or
-- you've **port-forwarded / reverse-proxied** the dashboard so it's reachable from outside the LAN, or
-- you simply want a second layer in front of it.
+- the machine is shared (a co-hosted home server other people use), or
+- you've port-forwarded / reverse-proxied the dashboard so it's reachable from outside the LAN, or
+- you want a second layer in front of it.
 
 Turn it on by setting a password in `config.json` and running `./pithead apply`:
 
@@ -166,42 +184,42 @@ Turn it on by setting a password in `config.json` and running `./pithead apply`:
 
 How it works and what to keep in mind:
 
-- **The password is bcrypt-hashed, never stored in cleartext.** pithead hashes it with the **same
-  pinned Caddy image** the stack already runs (`caddy hash-password`) and writes **only the hash** to
-  `.env`. The plaintext exists only in your owner-only `config.json` — treat that file like any other
-  secret (it's already git-ignored). The hash is stable across `apply` runs and only re-computed when
-  you actually change the password, so the Caddyfile doesn't churn.
-- **Keep `dashboard.secure: true`.** Basic-auth sends the credentials with every request; over plain
-  HTTP (`secure: false`) they'd travel in cleartext. pithead **warns** if you set a password without
-  HTTPS, but won't stop you. With the default `tls internal`, Caddy serves a locally-trusted
-  certificate — your browser will warn the first time unless you trust Caddy's local CA.
-- **A login is access control for the *dashboard*, not the miner.** It gates the web UI only. The
-  stratum port miners connect to is a separate surface — gate that with
+- The password is bcrypt-hashed, never stored in cleartext. pithead hashes it with the same pinned
+  Caddy image the stack already runs (`caddy hash-password`) and writes only the hash to `.env`. The
+  plaintext exists only in your owner-only `config.json`; treat that file like any other secret (it's
+  already git-ignored). The hash is stable across `apply` runs and only re-computed when you change
+  the password, so the Caddyfile doesn't churn.
+- Keep `dashboard.secure: true`. Basic-auth sends the credentials with every request; over plain HTTP
+  (`secure: false`) they'd travel in cleartext. pithead warns if you set a password without HTTPS, but
+  won't stop you. With the default `tls internal`, Caddy serves a locally-trusted certificate; your
+  browser will warn the first time unless you trust Caddy's local CA.
+- A login is access control for the dashboard, not the miner. It gates the web UI only. The stratum
+  port miners connect to is a separate surface; gate that with
   [`p2pool.stratum_password`](#configuration-reference) and `p2pool.stratum_bind`.
-- **Exposing to the public internet is still discouraged.** A password plus HTTPS is the right
-  baseline, but the safest remote-access path remains a VPN / SSH tunnel / Tailscale back to the LAN
-  rather than a forwarded port. Basic-auth has no rate-limiting or lockout on its own.
+- Exposing to the public internet is still discouraged. A password plus HTTPS is the right baseline,
+  but the safest remote-access path remains a VPN / SSH tunnel / Tailscale back to the LAN rather than
+  a forwarded port. Basic-auth has no rate-limiting or lockout on its own.
 
-To remove the login again, clear the password (`"password": ""`) and `apply` — pithead drops the
+To remove the login again, clear the password (`"password": ""`) and `apply`. pithead drops the
 `basic_auth` block and the dashboard is open on the LAN as before.
 
 ---
 
 ## Reusing an existing node
 
-If you already run a synced Monero node, you can skip most — or all — of the initial blockchain
-sync. There are two ways to do it.
+If you already run a synced Monero node, you can skip most or all of the initial blockchain sync.
+There are two ways to do it.
 
-> **No existing node, but the over-Tor first sync is too slow?** You don't have to reuse a chain —
-> you can sync the bundled nodes over **clearnet** for the one-time initial download, then switch back
-> to Tor. It's a default-off, privacy-relevant opt-in: see
+> No existing node, but the over-Tor first sync is too slow? You don't have to reuse a chain. You
+> can sync the bundled nodes over clearnet for the one-time initial download, then switch back to
+> Tor. It's a default-off, privacy-relevant opt-in: see
 > [`monero.clearnet_initial_sync` / `tari.clearnet_initial_sync`](#configuration-reference) and the
 > full [threat model in Privacy](privacy.md#optional-clearnet-initial-sync-off-by-default).
 
 ### Option A — Point the bundled node at your existing blockchain
 
-The Monero data directory mounts to `/root/.bitmonero` inside the container, the same layout a
-standard `monerod` uses. To have the bundled node adopt a blockchain you've already downloaded,
+The Monero data directory mounts to `/home/ubuntu/.bitmonero` inside the container, the same layout a
+standard `monerod` uses (its native `$HOME/.bitmonero`). To have the bundled node adopt a blockchain you've already downloaded,
 point `monero.data_dir` at your existing `.bitmonero` directory:
 
 ```json
@@ -214,26 +232,25 @@ point `monero.data_dir` at your existing `.bitmonero` directory:
 }
 ```
 
-Then run `./pithead apply`. The bundled `monerod` reuses the blockchain in place — no re-sync
+Then run `./pithead apply`. The bundled `monerod` reuses the blockchain in place: no re-sync
 from genesis, just a quick catch-up of any blocks produced since your node last ran.
 
 A few things to keep in mind:
 
-- **Stop your other node first.** Two `monerod` processes must never use the same data directory
-  at the same time, or they'll corrupt the database.
-- **Match the prune setting.** A pruned blockchain needs `monero.prune: true` (the default); an
-  unpruned (full) blockchain needs `monero.prune: false`. They're not interchangeable.
-- **Ownership.** The host directory must be readable/writable by the user that runs the stack.
-  `apply` sets ownership on directories it creates, but won't change an existing tree out from
-  under you.
+- Stop your other node first. Two `monerod` processes must never use the same data directory at the
+  same time, or they'll corrupt the database.
+- Match the prune setting. A pruned blockchain needs `monero.prune: true` (the default); an unpruned
+  (full) blockchain needs `monero.prune: false`. They're not interchangeable.
+- Ownership: the host directory must be readable/writable by the user that runs the stack. `apply`
+  sets ownership on directories it creates, but won't change an existing tree out from under you.
 
 ### Option B — Connect to a remote node
 
-If your existing Monero node runs on another machine — or you want to use a node you don't host —
-switch to **remote mode** and the stack won't run its own `monerod` at all. See
+If your existing Monero node runs on another machine, or you want to use a node you don't host,
+switch to remote mode and the stack won't run its own `monerod` at all. See
 [Connecting to a remote Monero node](#connecting-to-a-remote-monero-node) below.
 
-> **Tari** uses the same mechanism: point `tari.data_dir` at an existing Minotari node directory
+> Tari uses the same mechanism: point `tari.data_dir` at an existing Minotari node directory
 > (mounted at `/var/tari/node`) to reuse its synced chain.
 
 ---
@@ -258,10 +275,9 @@ To connect to an external Monero node instead of running one locally, set `moner
 ```
 
 - The bundled `monerod` container is not started in remote mode.
-- The remote node must be set up for **P2Pool mining** — with **ZMQ publishing enabled**
-  (`zmq-pub`, port `18083` by default) and its RPC reachable by P2Pool. In practice that means a
-  node **you run and control**; general-purpose public "open node" endpoints do **not** work,
-  since they don't expose ZMQ.
+- The remote node must be set up for P2Pool mining, with ZMQ publishing enabled (`zmq-pub`, port
+  `18083` by default) and its RPC reachable by P2Pool. In practice that means a node you run and
+  control; general-purpose public "open node" endpoints do not work, since they don't expose ZMQ.
 - If the remote node requires RPC authentication, set `monero.node_username` / `node_password`
   to match it; otherwise leave them out.
 
diff --git a/docs/dashboard.md b/docs/dashboard.md
index c047fbe1..124b2ddb 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -1,22 +1,19 @@
 # The Dashboard
 
-The dashboard is the control center for your stack: a single web page that monitors every
-service, charts your hashrate, and surfaces the decisions made by the algorithmic XvB switching
-engine. It's served over HTTPS by Caddy at `https://<your-hostname>` (the URL is printed when the
-stack starts).
+The dashboard is a single web page that monitors every service, charts your hashrate, and shows
+the decisions made by the algorithmic XvB switching engine. Caddy serves it over HTTPS at
+`https://<your-hostname>` (the URL is printed when the stack starts).
 
-The dashboard has **two states**. While your nodes are catching up to the network it shows
-**Sync Mode**; once both chains are synced it switches automatically to the full **operational
-view**.
+The dashboard has two states. While your nodes catch up to the network it shows Sync Mode. Once
+both chains are synced it switches automatically to the full operational view.
 
 ---
 
 ## Sync Mode
 
-The first time you start the stack — or any time the Monero or Tari node is still catching up to
-the network — the dashboard shows **Sync Mode**. A **`Syncing…`** badge appears next to the
-hostname, the headline reads *"System is currently synchronizing with the network,"* and no
-hashrate is routed yet.
+The dashboard shows Sync Mode the first time you start the stack, or any time the Monero or Tari
+node is still catching up. A `Syncing…` badge appears next to the hostname, the headline reads
+*"System is currently synchronizing with the network,"* and no hashrate is routed yet.
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="../images/launch/sync.png">
@@ -25,29 +22,28 @@ hashrate is routed yet.
 
 Sync Mode gives each chain its own progress card so you can see exactly where things stand:
 
-- **Monero Sync** — current verified block height vs. the network tip, with the number of blocks
+- **Monero Sync**: current verified block height vs. the network tip, with the number of blocks
   remaining. A green check means this chain is fully caught up. It also shows whether the node is
-  running **Pruned** or **Full** and its on-disk DB size (also in the **XMR Network** panel of the
-  operational view) — handy for confirming a reused chain matches your `monero.prune` setting.
-- **Tari Sync** — the same, as a percentage ring, for the Minotari chain.
-
-The top bar still shows live host telemetry throughout — CPU, load average, RAM, **HugePages**
-(so you can confirm RandomX optimization is active), and disk usage — which is handy for keeping
-an eye on resources during the initial download.
-
-**Why this screen exists:** a Monero or Tari node can't mine until it has downloaded and verified
-the blockchain, which on a first run can take from a few hours to over a day depending on your
-hardware, disk, and network. Sync Mode makes that progress visible instead of leaving you
-guessing. Once the required chains report fully synced, the dashboard automatically swaps Sync
-Mode for the operational view and mining begins — no refresh or restart needed.
-
-While the chains are syncing, the dashboard keeps `p2pool` and `xmrig-proxy` **stopped** (a
-**`Miner held (sync)`** badge shows next to the hostname) and starts them automatically once
-they're ready. Running p2pool against an unsynced node achieves nothing and floods Tari's logs
-with merge-mining chatter that buries the messages you'd actually want while debugging a sync.
-Releasing the miner is one-way — once it starts it stays up. By default the stack waits for
-**both** Monero and Tari; if you've set [`dashboard.tari_required: false`](configuration.md), it
-waits only for Monero and starts mining while Tari finishes syncing in the background.
+  running Pruned or Full and its on-disk DB size (also in the **XMR Network** panel of the
+  operational view), so you can confirm a reused chain matches your `monero.prune` setting.
+- **Tari Sync**: the same, as a percentage ring, for the Minotari chain.
+
+The top bar shows live host telemetry throughout: CPU, load average, RAM, HugePages (so you can
+confirm RandomX optimization is active), and disk usage. Useful for watching resources during the
+initial download.
+
+A Monero or Tari node can't mine until it has downloaded and verified the blockchain. On a first
+run that takes from a few hours to over a day depending on your hardware, disk, and network. Sync
+Mode makes the progress visible. Once the required chains report fully synced, the dashboard swaps
+Sync Mode for the operational view and mining begins. No refresh or restart needed.
+
+While the chains are syncing, the dashboard keeps `p2pool` and `xmrig-proxy` stopped (a
+`Miner held (sync)` badge shows next to the hostname) and starts them automatically once they're
+ready. Running p2pool against an unsynced node achieves nothing and floods Tari's logs with
+merge-mining chatter that buries the messages you'd want while debugging a sync. Releasing the
+miner is one-way: once it starts it stays up. By default the stack waits for both Monero and Tari.
+With [`dashboard.tari_required: false`](configuration.md) it waits only for Monero and starts
+mining while Tari finishes syncing in the background.
 
 > **Want to skip most of the wait?** Point the stack at an existing synced blockchain, or connect
 > to a remote node. See [Configuration › Reusing an existing node](configuration.md#reusing-an-existing-node).
@@ -70,89 +66,89 @@ Once both nodes are synced, the dashboard shows the full operational view.
   <img alt="Operational dashboard — Simple view" src="../images/launch/simple-light.png">
 </picture>
 
-The page updates itself **live** every 30 seconds, refreshing each panel in place rather than
-reloading the whole page — so your scroll position, the column you've sorted the worker table by,
-and the chart all stay put between updates.
+The page updates live every 30 seconds, refreshing each panel in place rather than reloading the
+whole page. Your scroll position, the column you've sorted the worker table by, and the chart all
+stay put between updates.
 
 ### Top bar
 
 A persistent status strip across the top shows the hostname, host telemetry (CPU, load, RAM,
-HugePages, disk), your **total hashrate**, and headline **1h / 24h routed averages** for both P2Pool
-and XvB so you can see your split at a glance. Next to the disk readout, an **`XMR Pruned`** /
-**`XMR Full`** badge shows the Monero node's blockchain mode at a glance.
-
-When the dashboard host is a name (not already an IP), the machine's **IP address** is shown
-beside it as `hostname @ ip` (e.g. `pithead.local @ 192.168.1.42`) — a reliable way back in when
-the hostname doesn't resolve from your phone or another machine on the LAN.
-
-A small **version badge** sits beside the hostname so you always know which build is running. A
-released build shows the version (e.g. **`v1.3.0`**); a development or working-tree build shows a
-dashed **`dev · branch @ commit`** marker instead, so it's never mistaken for a release. It appears
-on every screen — including Sync Mode — which makes it easy to confirm what you're on when sharing a
+HugePages, disk), your total hashrate, and 1h / 24h routed averages for both P2Pool and XvB so you
+can read your split. Next to the disk readout, an `XMR Pruned` / `XMR Full` badge shows the Monero
+node's blockchain mode.
+
+When the dashboard host is a name (not already an IP), the machine's IP address shows beside it as
+`hostname @ ip` (e.g. `pithead.local @ 192.168.1.42`). This is a reliable way back in when the
+hostname doesn't resolve from your phone or another machine on the LAN.
+
+A small version badge sits beside the hostname so you know which build is running. A released
+build shows the version (e.g. `v1.3.0`); a development or working-tree build shows a dashed
+`dev · branch @ commit` marker instead, so it's never mistaken for a release. It appears on every
+screen, including Sync Mode, which makes it easy to confirm what you're on when sharing a
 screenshot in a bug report. On a `dev` build but would rather run a published release? See
 [Switching a source checkout to release images](operations.md#switching-a-source-checkout-to-release-images).
 
-When a **newer Pithead release** is out, a clickable **`New release vX.Y.Z available ↗`** badge
-appears next to the version badge, linking to the GitHub release. It's a heads-up only — it never
-updates anything; you upgrade with `./pithead upgrade` when you're ready. The check is on by default
-and routed over Tor (so it can't reveal your IP); turn it off with `dashboard.check_for_updates: false`
+When a newer Pithead release is out, a clickable `New release vX.Y.Z available ↗` badge appears
+next to the version badge, linking to the GitHub release. It's a heads-up only. It never updates
+anything; you upgrade with `./pithead upgrade` when you're ready. The check is on by default and
+routed over Tor (so it can't reveal your IP). Turn it off with `dashboard.check_for_updates: false`
 (see [Configuration](configuration.md#configuration-reference)).
 
 ### Hero band
 
-A bold strip of headline KPIs sits just below the top bar, so the numbers that matter read at a
-glance the moment the page loads:
+A strip of headline KPIs sits just below the top bar, so the numbers that matter read the moment
+the page loads:
 
 | KPI | Meaning |
 |---|---|
 | **Total Hashrate** | Your combined hashrate across all workers. |
 | **Shares in Window** | Shares you currently hold in the P2Pool PPLNS window (green when above zero). |
-| **Raffle Eligible** | Whether you'd actually win **and** collect an XvB raffle payout — green **Yes**, red **No**, or muted **N/A** when XvB is off. (Full definition in [Overview](#overview).) |
+| **Raffle Eligible** | Whether you'd actually win **and** collect an XvB raffle payout: green **Yes**, red **No**, or muted **N/A** when XvB is off. (Full definition in [Overview](#overview).) |
 | **Blocks Found** | P2Pool sidechain blocks your node has found. |
 | **XvB Tier** | The donation tier you're currently holding. |
-| **Mining Mode** | What your hashrate is routed to right now — P2Pool, XvB, or a split. |
+| **Mining Mode** | What your hashrate is routed to right now: P2Pool, XvB, or a split. |
 
 ### Node status & failover
 
-If a local node becomes unreachable, a red **`monerod DOWN`** or **`Tari DOWN`** badge appears in
-the top bar (after a short debounce, so a momentary blip doesn't flap). Sync state is read from
-monerod's `get_info` RPC and Tari's gRPC, so "down" means the node itself is unreachable — not just
-that a log line changed.
+If a local node becomes unreachable, a red `monerod DOWN` or `Tari DOWN` badge appears in the top
+bar (after a short debounce, so a momentary blip doesn't flap). Sync state is read from monerod's
+`get_info` RPC and Tari's gRPC, so "down" means the node itself is unreachable, not just that a log
+line changed.
 
-A red **`⚠ DB write failing`** badge appears if the dashboard can't write to its own SQLite database
-(a full or read-only disk, a permissions problem). The dashboard keeps serving live data, but
-hashrate history, shares, and stats won't survive a restart until it's fixed — so it's surfaced
-rather than lost silently.
+A red `⚠ DB write failing` badge appears if the dashboard can't write to its own SQLite database (a
+full or read-only disk, a permissions problem). The dashboard keeps serving live data, but hashrate
+history, shares, and stats won't survive a restart until it's fixed. It's surfaced rather than lost
+silently.
 
-While a node is down, the dashboard also **rejects workers** so they fail over to the backup pools
-you've configured, instead of sitting idle on a stack that can't mine for them — a sustained outage
-stops the `xmrig-proxy` container (a **`Workers rejected`** badge shows) and a confirmed recovery
+While a node is down, the dashboard also rejects workers so they fail over to the backup pools
+you've configured, instead of sitting idle on a stack that can't mine for them. A sustained outage
+stops the `xmrig-proxy` container (a `Workers rejected` badge shows) and a confirmed recovery
 restarts it. monerod is required to mine, so a monerod outage always rejects. Tari is merge-mining
 gravy, so whether a Tari outage rejects follows [`dashboard.tari_required`](configuration.md): when
 it's `true` (default) a Tari outage rejects too; set it `false` to keep mining Monero straight
-through a Tari outage. (Rejection never triggers for a remote monerod — the stack doesn't manage
-that node.)
+through a Tari outage. (Rejection never triggers for a remote monerod, since the stack doesn't
+manage that node.)
 
 **Non-blocking Tari.** With `tari_required: false`, a Tari-only (re)sync no longer takes over the
-screen: the operational view stays up, mining continues, and a **`Tari syncing`** badge shows Tari's
+screen: the operational view stays up, mining continues, and a `Tari syncing` badge shows Tari's
 progress until it catches up and merge mining resumes.
 
 ### Hashrate chart
 
-A time-series chart of your hashrate with selectable **ranges** (1h / 24h / 1w / 1mo) that switch
-instantly without reloading the page. The shaded bands show how hashrate was split between
-**P2Pool** and **XvB** over time, so you can see the switching engine at work.
+A time-series chart of your hashrate with selectable ranges (1h / 24h / 1w / 1mo) that switch
+without reloading the page. The shaded bands show how hashrate was split between P2Pool and XvB
+over time, so you can see the switching engine at work.
 
-An **Avg** control picks the hashrate-**averaging window** the chart plots — `1 Min` / `10 Min` /
+An **Avg** control picks the hashrate-averaging window the chart plots: `1 Min` / `10 Min` /
 `1 Hr` / `12 Hr` / `24 Hr` (the native windows xmrig-proxy reports). This is independent of the
-Range control: the **range** sets how much *time* the x-axis spans, while the **averaging window**
-sets how *smooth* each plotted point is. Short windows (1–10 min) react quickly — a rig dropping or
-joining shows up within a poll or two — while long windows (12–24 h) ride out the noise to show the
+Range control. The range sets how much *time* the x-axis spans; the averaging window sets how
+*smooth* each plotted point is. Short windows (1–10 min) react quickly, so a rig dropping or
+joining shows up within a poll or two. Long windows (12–24 h) ride out the noise to show the
 underlying trend. Your choice is remembered across reloads. Two things to know:
 
-- **`10 Min` is the default** and matches the dashboard's headline hashrate, so the chart looks the
+- `10 Min` is the default and matches the dashboard's headline hashrate, so the chart looks the
   same as before unless you change it.
-- The longer windows **need that much rig uptime to fill** — right after a (re)start, `12 Hr`/`24 Hr`
+- The longer windows need that much rig uptime to fill. Right after a (re)start, `12 Hr`/`24 Hr`
   read low and climb until enough history exists. Per-window history is also kept only *going
   forward* from the version that introduced this control, so those lines are flat at the far-left
   edge of a long range until new data accumulates. That's expected, not a fault.
@@ -167,45 +163,42 @@ The summary panel pulls the key numbers together:
 | **Total Hashrate** | Your combined hashrate across all workers. |
 | **Workers Alive** | How many rigs are connected and online right now. |
 | **Share in Window** | Your shares in the current P2Pool PPLNS window. |
-| **Raffle Eligible** | **Yes** only when you're set up to both *win* and *collect* an XvB payout: you're donating at least the **donor tier** (1 kH/s on XvB's *credited* 1h **and** 24h averages — the same threshold as **Current Tier**) **and** you hold a P2Pool PPLNS share (XvB's "VIP" gate — without it a win is skipped and you take a fail). Reads **No** when donating but a gate is unmet, and **N/A (XvB off)** when XvB is disabled. Intentionally stricter than XvB's bare "VIP = just a share" so a green Yes means a win is paid. |
+| **Raffle Eligible** | **Yes** only when you're set up to both *win* and *collect* an XvB payout: you're donating at least the **donor tier** (1 kH/s on XvB's *credited* 1h **and** 24h averages, the same threshold as **Current Tier**) **and** you hold a P2Pool PPLNS share (XvB's "VIP" gate; without it a win is skipped and you take a fail). Reads **No** when donating but a gate is unmet, and **N/A (XvB off)** when XvB is disabled. Intentionally stricter than XvB's bare "VIP = just a share" so a green Yes means a win is paid. |
 | **Last Share** | Time since your last accepted share. |
 | **P2Pool 1h / 24h (routed)** | Time-weighted average hashrate the proxy actually routed to P2Pool. |
-| **XvB 1h / 24h (routed)** | Time-weighted average hashrate the proxy actually **routed** to XvB. (The XvB-API *credited* figure — XvB's definitive record — appears in the **Advanced** view's *XvB Donation Stats* card.) |
-| **Current Tier** | The XvB tier you're currently holding — the one cleared by the **lower of your credited 1h and 24h** donation averages, so a recent hashrate drop shows up right away. |
+| **XvB 1h / 24h (routed)** | Time-weighted average hashrate the proxy actually **routed** to XvB. (The XvB-API *credited* figure, XvB's definitive record, appears in the **Advanced** view's *XvB Donation Stats* card.) |
+| **Current Tier** | The XvB tier you're currently holding, the one cleared by the **lower of your credited 1h and 24h** donation averages, so a recent hashrate drop shows up right away. |
 | **Target Tier** | The tier the engine is aiming for (from `xvb.donation_level`). If your hashrate can't sustain an explicitly chosen tier, a **⚠ Hashrate low for tier** badge appears. |
 | **Tari Mining** | Whether merge mining of Tari is active and healthy. |
 | **Wallets** | Your configured Monero and Tari payout addresses. |
 
 ### Workers Alive
 
-A live table of every connected rig — worker name, IP, uptime, and per-worker hashrate over
-several windows (e.g. 10s / 60s / 15m) — so you can spot a rig that has dropped off or is
-underperforming. A worker that's connected but whose direct API is unreachable still counts (with
-proxy-derived hashrate); a worker whose miner has stopped drops out of the total. On a narrow
-screen the table scrolls sideways within its card, so its columns stay readable rather than
-stretching the page.
-
-Each rig also shows its **accepted** and **rejected** share counts (with invalid shares folded
-into the rejected column as `3 (+2 inv)` when present). A rig whose reject rate climbs past ~5%
-gets a red **⚠** flag next to its rejected count — a quick way to catch a rig that's submitting
-stale or bad shares (bad overclock, flaky network, clock drift) rather than earning. Every column
-is sortable, so you can click **Rejected** to float the worst offenders to the top. The shares are
-cumulative since the proxy last started, so a brief early-run blip clears itself as good shares
-accumulate.
+A live table of every connected rig: worker name, IP, uptime, and per-worker hashrate over several
+windows (e.g. 10s / 60s / 15m), so you can spot a rig that has dropped off or is underperforming.
+A worker that's connected but whose direct API is unreachable still counts (with proxy-derived
+hashrate); a worker whose miner has stopped drops out of the total. On a narrow screen the table
+scrolls sideways within its card, so its columns stay readable rather than stretching the page.
+
+Each rig also shows its accepted and rejected share counts (with invalid shares folded into the
+rejected column as `3 (+2 inv)` when present). A rig whose reject rate climbs past ~5% gets a red
+**⚠** flag next to its rejected count. That's a quick way to catch a rig submitting stale or bad
+shares (bad overclock, flaky network, clock drift) rather than earning. Every column is sortable,
+so you can click **Rejected** to float the worst offenders to the top. The shares are cumulative
+since the proxy last started, so a brief early-run blip clears itself as good shares accumulate.
 
 Below the table, a **Proxy totals** line sums the whole stack's share health as reported by the
 xmrig-proxy: total accepted / rejected (with the aggregate reject %) / invalid shares submitted
-upstream, plus the **best difficulty** any of your shares has hit. It's hidden until the proxy has
+upstream, plus the best difficulty any of your shares has hit. It's hidden until the proxy has
 submitted its first shares.
 
 ### Simple vs. Advanced view
 
 A **Simple / Advanced** toggle sits above the chart. **Simple** (the default) keeps the page to
-the essentials — the chart, the Overview summary, and the worker table. **Advanced** swaps the
-Overview for a set of power-user cards that break out the same data in more detail: **My P2Pool
-Node Stats**, **Global P2Pool Stats**, **XvB Donation Stats**, **XMR Network**, **Tari Merge
-Mining**, and the **P2Pool Earnings (estimated)** calculator below. Your choice is remembered
-across reloads.
+the essentials: the chart, the Overview summary, and the worker table. **Advanced** swaps the
+Overview for a set of cards that break out the same data in more detail: **My P2Pool Node Stats**,
+**Global P2Pool Stats**, **XvB Donation Stats**, **XMR Network**, **Tari Merge Mining**, and the
+**P2Pool Earnings (estimated)** calculator below. Your choice is remembered across reloads.
 
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="../images/launch/advanced.png">
@@ -214,31 +207,31 @@ across reloads.
 
 ### P2Pool Earnings (estimated)
 
-A **P2Pool** mining calculator (Advanced view): it estimates the **XMR earned from P2Pool mining
-only**, turning your P2Pool hashrate and the live Monero network figures into a rough payout
-estimate. It is deliberately scoped to P2Pool — it is **not** an XvB or a Tari calculator:
+A P2Pool mining calculator (Advanced view). It estimates the XMR earned from P2Pool mining only,
+turning your P2Pool hashrate and the live Monero network figures into a rough payout estimate. It
+is deliberately scoped to P2Pool. It is **not** an XvB or a Tari calculator:
 
 - **XvB donations are excluded.** Hashrate you route to XvB earns no P2Pool payout, so it isn't
-  counted. The default is your **P2Pool 1h-average hashrate** — the *same* `P2Pool (1h)` figure
-  shown in the header and the Overview / My Node cards — which already excludes any XvB-donated
-  slice. So if you're running an **XvB split**, the estimate reflects your real P2Pool earnings,
-  not an inflated total, and it stays consistent with the hashrate shown elsewhere on the page.
-  (When that average is 0 — a fresh start with no history yet, or donating everything to XvB —
-  the estimate is 0 until you enter a what-if value.)
+  counted. The default is your P2Pool 1h-average hashrate, the *same* `P2Pool (1h)` figure shown
+  in the header and the Overview / My Node cards, which already excludes any XvB-donated slice. So
+  if you're running an XvB split, the estimate reflects your real P2Pool earnings, not an inflated
+  total, and it stays consistent with the hashrate shown elsewhere on the page. (When that average
+  is 0, a fresh start with no history yet, or donating everything to XvB, the estimate is 0 until
+  you enter a what-if value.)
 - **Tari merge-mining is excluded.** Tari is earned alongside Monero but is a separate payout
   (its own calculator is planned).
 
 | Field | Meaning |
 |---|---|
 | **Your P2Pool Hashrate** | The hashrate the estimate is based on. Defaults to your **P2Pool 1h average** (the same figure the header shows, excluding any XvB-donated portion); type a different value (e.g. `50k`, `1.2 MH/s`) to see a **what-if** projection if you added or removed P2Pool hashpower. |
-| **XMR / day · month · year** | Expected Monero earned over each horizon, computed as `hashrate × block reward ÷ network difficulty` — the standard variance-free mining expectation. P2Pool's zero-fee PPLNS payout makes this the right long-run expectation. |
+| **XMR / day · month · year** | Expected Monero earned over each horizon, computed as `hashrate × block reward ÷ network difficulty`, the standard variance-free mining expectation. P2Pool's zero-fee PPLNS payout makes this the right long-run expectation. |
 | **Time / Share** | How long, on average, that hashrate takes to find one P2Pool (sidechain) share. |
 | **XMR Block Reward** | The current Monero block reward, for context. |
 
 > **These are estimates, not guarantees.** Mining is variance-heavy, so real payouts swing well
-> above and below these figures — the calculator says so in a disclaimer on the card. If the
-> network figures aren't available yet, the card shows `—` rather than a bogus number. **Tari**
-> earnings and an **XvB tier** projection aren't included yet.
+> above and below these figures. The calculator says so in a disclaimer on the card. If the
+> network figures aren't available yet, the card shows `—` rather than a bogus number. Tari
+> earnings and an XvB tier projection aren't included yet.
 
 ---
 
@@ -250,11 +243,11 @@ estimate. It is deliberately scoped to P2Pool — it is **not** an XvB or a Tari
   `./pithead apply`.
 - **Reaching it from another machine.** Use the hostname/IP of the stack server. If your hostname
   doesn't resolve on your LAN, set `dashboard.host` in `config.json` to an address that does.
-- **Adding a login.** By default the dashboard has no password — fine for a private LAN appliance.
-  If the box is shared or reachable beyond your LAN, set `dashboard.auth.password` (keep
+- **Adding a login.** By default the dashboard has no password, which is fine for a private LAN
+  appliance. If the box is shared or reachable beyond your LAN, set `dashboard.auth.password` (keep
   `dashboard.secure: true`) and run `./pithead apply` to put a login prompt in front of it. See
   [Configuration › Exposing the dashboard safely](configuration.md#exposing-the-dashboard-safely).
-- **On your phone.** The dashboard is responsive — open the same URL on a phone and the layout
+- **On your phone.** The dashboard is responsive. Open the same URL on a phone and the layout
   reflows to a single column with a stacked header, so you can check on the stack from the couch.
 - **Stuck on Sync Mode?** That usually just means the chain is still downloading. Check
   `./pithead logs monerod` / `./pithead logs tari` for steady progress; see
diff --git a/docs/faq.md b/docs/faq.md
index af3cd38c..5ee442d0 100644
--- a/docs/faq.md
+++ b/docs/faq.md
@@ -1,8 +1,8 @@
 # FAQ
 
-Common questions about what Pithead is, what it does for you, and how it compares to wiring the
-pieces together yourself. If you're new here, start with [Getting Started](getting-started.md);
-the deeper "why" lives in [Architecture](architecture.md).
+Common questions about what Pithead is, what it does, and how it compares to wiring the pieces
+together yourself. New here? Start with [Getting Started](getting-started.md); the deeper "why"
+lives in [Architecture](architecture.md).
 
 ---
 
@@ -10,8 +10,8 @@ the deeper "why" lives in [Architecture](architecture.md).
 
 ### vs. doing it yourself
 
-You can absolutely run a private Monero + P2Pool + Tari setup by hand — plenty of people do, and
-the underlying projects ([monerod](https://www.getmonero.org/), [P2Pool](https://github.com/SChernykh/p2pool),
+You can run a private Monero + P2Pool + Tari setup by hand; plenty of people do, and the
+underlying projects ([monerod](https://www.getmonero.org/), [P2Pool](https://github.com/SChernykh/p2pool),
 [XMRig](https://github.com/xmrig/xmrig)) are excellent. Doing it yourself means standing up and
 maintaining each piece and the wiring between them:
 
@@ -19,47 +19,55 @@ maintaining each piece and the wiring between them:
 - P2Pool pointed at that node, with an onion address for inbound peers.
 - Tari (Minotari) merge-mining alongside Monero.
 - Each rig configured for the pool, plus a plan for what happens when the node goes down.
-- Some way to actually *see* hashrate, sync progress, and your PPLNS window.
+- Some way to see hashrate, sync progress, and your PPLNS window.
 
-Pithead automates that whole stack in one command and adds the parts that are tedious to build
+Pithead automates that stack in one command and adds the parts that are tedious to build
 yourself:
 
-- **Tor-first networking.** A built-in Tor daemon gives Monero, Tari, and P2Pool hidden-service
-  (onion) addresses — no public port forwarding, and Monero/Tari traffic runs over Tor. A couple of
-  outbound yield paths still use clearnet today; see [Privacy & network egress](privacy.md) for the
-  full map and how to harden them.
-- **One endpoint for every rig.** All workers point at a single `xmrig-proxy` endpoint on `:3333`.
-  There's nothing per-rig to configure — no wallet address, no pool URL juggling. See
+- Tor-first networking. A built-in Tor daemon gives Monero, Tari, and P2Pool hidden-service
+  (onion) addresses, so there's no public port forwarding and Monero/Tari traffic runs over Tor. A
+  couple of outbound yield paths still use clearnet today; see
+  [Privacy & network egress](privacy.md) for the full map and how to harden them.
+- One endpoint for every rig. All workers point at a single `xmrig-proxy` endpoint on `:3333`.
+  There's nothing per-rig to configure: no wallet address, no pool URL juggling. See
   [Connecting Miners](workers.md).
-- **Algorithmic XvB switching.** A feedback controller splits your hashrate between P2Pool and
+- Algorithmic XvB switching. A feedback controller splits your hashrate between P2Pool and
   XMRvsBeast (XvB) bonus rounds, donating only the minimum needed to hold your target tier and
   routing the rest to P2Pool. See [Architecture › Algorithmic switching](architecture.md#algorithmic-switching).
-- **Node-down worker failover.** If monerod goes down, the stack stops `xmrig-proxy` so your
-  miners fail over to their backup pools instead of mining into a void. See
+- Node-down worker failover. If monerod goes down, the stack stops `xmrig-proxy` so your miners
+  fail over to their backup pools instead of mining into a void. See
   [Configuration › `dashboard.tari_required`](configuration.md#configuration-reference).
-- **A dashboard that tells you things.** Live hashrate, sync progress, the PPLNS window,
-  per-worker stats, and your P2Pool/XvB split — served over HTTPS on your LAN. See
+- A dashboard that tells you things. Live hashrate, sync progress, the PPLNS window, per-worker
+  stats, and your P2Pool/XvB split, served over HTTPS on your LAN. See
   [The Dashboard](dashboard.md).
-- **Hardened defaults.** Least-privilege containers, SHA256-verified and version-pinned binaries,
+- Hardened defaults. Least-privilege containers, SHA256-verified and version-pinned binaries,
   localhost-only RPC, and split read-only / start-stop Docker socket proxies. See
   [Architecture › Security posture](architecture.md#security-posture).
 
-If you enjoy hand-wiring infrastructure, the manual route is a great learning exercise. If you'd
-rather get a private, multi-rig, merge-mining stack running before your coffee gets cold, that's
-what Pithead is for.
+If you enjoy hand-wiring infrastructure, the manual route is a good learning exercise. If you want
+a private, multi-rig, merge-mining stack running with less of that work, that's what Pithead is
+for.
 
 ### vs. Gupax
 
-[Gupax](https://github.com/hinto-janai/gupax) is an excellent GUI for running P2Pool + XMRig on a
-**single machine** — if you want a friendly, one-box way to solo-mine Monero on P2Pool, it's a
-great choice and worth a look.
+[Gupax](https://github.com/gupax-io/gupax) is a desktop GUI for mining Monero on P2Pool. It runs on
+Windows, macOS, and Linux, has a `--daemon` headless mode, and manages more than it used to: P2Pool
+and XMRig by default, plus optional tabs for a local Monero node, a proxy for external miners, and
+XvB hashrate-splitting. If you mine on one machine and want a friendly app to drive it, Gupax is a
+great choice.
 
-Pithead solves a different problem. It's a full self-hosted **stack**, not a single-machine GUI:
-your own Monero full node, Tor for privacy, Tari merge-mining, a single proxy endpoint for many
-rigs, algorithmic XvB switching, node-down failover, and a LAN dashboard — all orchestrated
-together. Think of Gupax as the right tool when you're mining on one PC, and Pithead as the right
-tool when you want to run the whole operation — node, privacy, dashboard, and a fleet of workers —
-yourself. Different tools for different goals.
+Pithead is a different form factor — an always-on server stack rather than a desktop app you launch
+on your mining PC. The two overlap more than they once did: both can run your own node, take
+external miners through a proxy, and split hashrate to the XvB raffle. Where Pithead goes further:
+
+- **Tor-first by default.** Monero, Tari, and P2Pool reach the network over onion addresses with no
+  extra setup. Gupax ships no built-in Tor; a community Docker image adds an optional hidden service.
+- **Tari merge-mining.** A second payout from the same hashes. Gupax doesn't merge-mine Tari.
+- **Built to run unattended.** Nine version-pinned containers on a dedicated Linux box, node-down
+  worker failover, and a LAN web dashboard — not an app you keep open on your desktop.
+
+Pick Gupax to mine from one machine. Pick Pithead to run the whole operation yourself — node,
+privacy, dashboard, and a fleet of workers — as a server you set up once.
 
 ---
 
@@ -67,71 +75,88 @@ yourself. Different tools for different goals.
 
 ### Is my home IP exposed?
 
-**Mostly not — with two clearnet exceptions today, plus a one-time exposure at install.** A built-in
-Tor daemon gives Monero, Tari, and P2Pool hidden-service (onion) addresses, so **inbound** connections
-need no port forwarding and don't reveal your IP. Monero and Tari route P2P and transaction traffic
-over Tor, and their old clearnet DNS lookups are closed.
+Mostly not. With the Tor defaults, the only time your IP leaves the box is the one-time install.
+A built-in Tor daemon gives Monero, Tari, and P2Pool hidden-service (onion) addresses, so inbound
+connections need no port forwarding and don't reveal your IP. Monero and Tari route P2P and
+transaction traffic over Tor, and their old clearnet DNS lookups are closed.
+
+The two former clearnet yield paths are Tor-by-default as of v1.1, each with a yield-vs-privacy opt-out:
+
+- P2Pool's outbound sidechain peers (#165) are Tor-routed by default. You may opt into clearnet
+  (`p2pool.clearnet: true`) for ~10 % more yield on `mini`, at the cost of exposing your IP; see the
+  [Tor-vs-clearnet benchmark](benchmarks/tor-vs-clearnet.md).
+- XvB donation mining (#166), only if XvB is enabled: the donation connection to `xmrvsbeast.com`
+  is Tor-routed by default (opt out with `xvb.tor: false`). The XvB *stats* fetch is Tor-routed too.
 
-What still touches clearnet (and so can reveal your IP):
+What still touches clearnet, and so can reveal your IP:
 
-- **P2Pool's outbound sidechain peers** — clearnet today; Tor-by-default is planned for v1.1 (#165),
-  and you can route it through Tor now (see the privacy guide).
-- **XvB donation mining** — only if XvB is enabled; clearnet to `xmrvsbeast.com`. Disable XvB to stop
-  it, or wait for the v1.1 Tor routing (#166). (The XvB *stats* fetch is already Tor-routed.)
-- **Install / build** fetches code and container images from GitHub, getmonero.org, and the image
-  registries once — inherent and integrity-pinned, but it reveals your IP at that moment.
+- Install / build fetches code and container images from GitHub, getmonero.org, and the image
+  registries once. This is inherent and integrity-pinned, but it reveals your IP at that moment.
 
-**Bottom line:** with XvB disabled, on a normal home connection behind NAT the only time your IP
+Bottom line: on a normal home connection behind NAT, with the Tor defaults, the only time your IP
 leaves the box is that one-time install.
 
 See **[Privacy & network egress](privacy.md)** for every connection and how to harden each one.
 
 ### Do I need to port-forward?
 
-No. Because connectivity runs through Tor hidden services, there's **no public IPv4 port
-forwarding required**. (On your LAN, port `3333` does need to be reachable from each rig to the
-stack host — that's local network traffic, not an internet-facing port. See
+No. Because connectivity runs through Tor hidden services, no public IPv4 port forwarding is
+required. (On your LAN, port `3333` does need to be reachable from each rig to the stack host.
+That's local network traffic, not an internet-facing port. See
 [Connecting Miners › Networking notes](workers.md#networking-notes).)
 
 ### Is the XvB donation mandatory? Will it cost me?
 
 It's optional, and the engine is designed to minimize what you give up. XvB switching is on by
 default but can be turned off (`xvb.enabled: false`). When it's on, the decision engine donates
-only enough hashrate to **hold your target tier** and routes everything else to P2Pool — because
-the XvB raffle picks winners at random, donating above a tier's threshold earns nothing extra. See
+only enough hashrate to hold your target tier and routes everything else to P2Pool. Because the
+XvB raffle picks winners at random, donating above a tier's threshold earns nothing extra. See
 [Architecture › Algorithmic switching](architecture.md#algorithmic-switching) and the `xvb.*`
 keys in [Configuration](configuration.md#configuration-reference).
 
+### Do I have to sign up for the XvB raffle?
+
+No, there's no manual signup. With `xvb.enabled: true`, the stack auto-registers your wallet in
+the XMRvsBeast raffle once you have a share in the P2Pool PPLNS window (registration only takes
+effect after that first share, so it can take a little while on a fresh stack). It then re-registers
+periodically so a long-offline rig re-enters cleanly. The registration call carries your full wallet
+address and is routed over Tor like the XvB stats fetch, so it never exposes your IP on clearnet. If
+XvB is disabled, no registration happens.
+
+The dashboard shows an `XvB raffle ✓` header badge once you're registered (and a warning badge
+if your wallet is rejected or registration is failing; see
+[Configuration › XvB raffle auto-registration](configuration.md#xvb-raffle-auto-registration-xvb_submit_url)).
+
 ### What is Tari? Do I have to mine it?
 
-Tari (the [Minotari](https://www.tari.com/) node) is a chain that's **merge-mined alongside
-Monero** through P2Pool — you earn on both at once for the same RandomX work. You do need a Tari
-payout address, but you don't have to let Tari problems hold up Monero mining: set
+Tari (the [Minotari](https://www.tari.com/) node) is a chain that's merge-mined alongside Monero
+through P2Pool; you earn on both at once for the same RandomX work. You do need a Tari payout
+address, but you don't have to let Tari problems hold up Monero mining. Set
 `dashboard.tari_required: false` to keep mining Monero through a Tari outage or resync, with Tari
 catching up in the background. See [Configuration › `dashboard.tari_required`](configuration.md#configuration-reference).
 
 ### Can I use my existing synced Monero node?
 
-Yes. You can skip most — or all — of the initial blockchain sync two ways: point the bundled node
-at your existing `.bitmonero` directory via `monero.data_dir`, or switch to **remote mode** and
-connect to a node you run elsewhere (it must have ZMQ publishing enabled for P2Pool). The same
-`data_dir` trick works for reusing a synced Tari node. See
+Yes. You can skip most or all of the initial blockchain sync two ways: point the bundled node at
+your existing `.bitmonero` directory via `monero.data_dir`, or switch to remote mode and connect
+to a node you run elsewhere (it must have ZMQ publishing enabled for P2Pool). The same `data_dir`
+trick works for reusing a synced Tari node. See
 [Configuration › Reusing an existing node](configuration.md#reusing-an-existing-node).
 
 ### What hardware do I need?
 
-Plan for **16 GB+ RAM**, a CPU with **AVX2** for RandomX, and an **SSD** (~300 GB pruned /
-~500 GB full minimum — Tari's chain alone is ~135 GB, and both chains grow ~100+ GB/year, so a
-**2–4 TB** drive is the set-and-forget choice). Full minimum-vs-recommended sizing for the stack host is in
+Plan for 16 GB+ RAM, a CPU with AVX2 for RandomX, and an SSD (~300 GB pruned / ~500 GB full
+minimum; Tari's chain alone is ~135 GB, and both chains grow ~100+ GB/year, so a 2–4 TB drive is
+the set-and-forget choice). Full minimum-vs-recommended sizing for the stack host is in
 [Hardware Requirements](hardware.md). (Miner hardware is sized separately in
 [RigForge](https://github.com/p2pool-starter-stack/rigforge).)
 
 ### How do I connect my miners?
 
 Point any [XMRig](https://github.com/xmrig/xmrig) (or other RandomX miner) at
-`YOUR_STACK_IP:3333` — that single endpoint is the only pool setting your rigs need, and you do
-**not** put a wallet address in the miner config. Point all your rigs at the same address; the
-stack aggregates them. New to mining? [RigForge](https://github.com/p2pool-starter-stack/rigforge)
+`YOUR_STACK_IP:3333`. That single endpoint is the only pool setting your rigs need, and you do
+not put a wallet address in the miner config. Point all your rigs at the same address; the stack
+aggregates them. New to mining? [RigForge](https://github.com/p2pool-starter-stack/rigforge)
 provisions a tuned worker and wires up the `3333` connection in one command. See
 [Connecting Miners](workers.md).
 
diff --git a/docs/getting-started.md b/docs/getting-started.md
index a558d0fa..61a1a767 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -1,15 +1,17 @@
 # Getting Started
 
-This guide takes you from a fresh machine to a synced, mining stack. The whole process is
-driven by a single script — `pithead` — and most of it is automated.
+This guide takes a fresh machine to a synced, mining stack. One script, `pithead`, drives the
+process; most of it runs on its own.
 
 > **TL;DR**
+>
 > ```bash
 > curl -fsSL https://github.com/p2pool-starter-stack/pithead/releases/latest/download/pithead.tar.gz | tar xz
 > cd pithead
-> cp config.json.template config.json   # set your Monero + Tari payout addresses
+> cp config.minimal.json config.json   # set your Monero + Tari payout addresses
 > ./pithead setup
 > ```
+>
 > Let it run, then open the dashboard at `https://<your-hostname>`.
 
 ---
@@ -18,62 +20,61 @@ driven by a single script — `pithead` — and most of it is automated.
 
 | Requirement | Recommendation |
 |---|---|
-| **Operating system** | Ubuntu Server **24.04 LTS** is the officially supported platform. Other Linux distributions and macOS may work but aren't officially supported. |
-| **CPU** | A processor with **AVX2** support is highly recommended for RandomX performance. |
-| **RAM** | **16 GB** minimum with HugePages enabled (~6 GB is reserved for RandomX); **32 GB** recommended for a full node or long uptimes. |
-| **Disk** | A **pruned** Monero node needs ~**100 GB** and a **full** one ~**265 GB**, plus ~**135 GB** for the Tari node (its chain is the biggest single consumer) — so plan for **~300 GB** (pruned) or **~500 GB** (full) of **SSD** minimum. Both chains grow ~**100+ GB/year**, so a **2–4 TB** drive is the set-and-forget choice. |
-| **Software** | Docker Engine, Docker Compose V2, `jq`, and `openssl`. |
-
-> 📐 **Full sizing guidance** for the stack host — minimum vs. recommended specs, plus ways to run
-> leaner — is in **[Hardware Requirements](hardware.md)**. Miner specs live in
+| Operating system | Ubuntu Server 24.04 LTS is the supported platform. Other Linux distributions and macOS may work but aren't supported. |
+| CPU | A processor with AVX2 support for RandomX performance. |
+| RAM | 16 GB minimum with HugePages enabled (~6 GB is reserved for RandomX); 32 GB for a full node or long uptimes. |
+| Disk | A pruned Monero node needs ~100 GB and a full one ~265 GB, plus ~135 GB for the Tari node (its chain is the biggest single consumer). Plan for ~300 GB (pruned) or ~500 GB (full) of SSD minimum. Both chains grow ~100+ GB/year, so a 2–4 TB drive is the set-and-forget choice. |
+| Software | Docker Engine, Docker Compose V2, `jq`, and `openssl`. |
+
+> 📐 Sizing guidance for the stack host — minimum vs. recommended specs, plus ways to run leaner —
+> is in **[Hardware Requirements](hardware.md)**. Miner specs live in
 > [RigForge](https://github.com/p2pool-starter-stack/rigforge).
 
-> 🔎 **`setup` checks this for you.** Before it starts anything, `pithead setup` runs a best-effort
+> 🔎 `setup` checks this for you. Before it starts anything, `pithead setup` runs a best-effort
 > pre-flight on free disk and total RAM. If either is below the recommended minimums (~300 GB
-> pruned / ~500 GB full disk, 16 GB RAM), it prints a **warning** — but it never blocks setup, so
-> you can proceed on a smaller host at your own risk. See **[Hardware Requirements](hardware.md)**.
+> pruned / ~500 GB full disk, 16 GB RAM), it prints a warning. It never blocks setup, so you can
+> proceed on a smaller host at your own risk. See **[Hardware Requirements](hardware.md)**.
 
-You don't have to install the software dependencies yourself. `setup` checks for them and, **on
-Ubuntu, offers to install anything that's missing**. If you'd rather do it manually:
+You don't have to install the software dependencies yourself. `setup` checks for them and, on
+Ubuntu, offers to install anything missing. To do it manually:
 
 ```bash
 sudo apt update && sudo apt install -y jq docker.io docker-compose-v2 openssl
 ```
 
-On an unsupported OS — or if dependency detection misfires on an unusual setup — run setup with
+On an unsupported OS, or if dependency detection misfires on an unusual setup, run setup with
 `--skip-deps` to bypass the check entirely.
 
 ---
 
 ## 2. Get the code
 
-Download the latest release — this pulls the **published, tested images** (no local build), so the
+Download the latest release. This pulls the published, tested images (no local build), so the
 dashboard shows the real version and the update-checker works:
 
 ```bash
 curl -fsSL https://github.com/p2pool-starter-stack/pithead/releases/latest/download/pithead.tar.gz | tar xz
 cd pithead
-cp config.json.template config.json   # then set your Monero + Tari payout addresses
+cp config.minimal.json config.json   # then set your Monero + Tari payout addresses
 ```
 
-`config.json.template` is minimal — just your two payout addresses; `setup` fills in sensible defaults
-for everything else. Want the full set of knobs? Copy `config.advanced.example.json` instead. Have your
-**Monero** and **Tari** payout addresses ready (Tari wallets are sometimes labeled **Minotari** — same
-thing).
+`config.minimal.json` is minimal: just your two payout addresses. `setup` fills in defaults for
+everything else. For the full set of knobs, copy `config.reference.json` instead. Have your
+Monero and Tari payout addresses ready (Tari wallets are sometimes labeled Minotari, same thing).
 
 ### Alternative: build from source
 
-To build the images locally instead of pulling the published ones — e.g. to develop or modify the
-stack — clone the repo. pithead sees the `build/` context and builds locally, tagging the images `:dev`
+To build the images locally instead of pulling the published ones, e.g. to develop or modify the
+stack, clone the repo. pithead sees the `build/` context and builds locally, tagging the images `:dev`
 (the dashboard badge then reads `dev · <branch> @ <commit>` instead of the release version):
 
 ```bash
 git clone https://github.com/p2pool-starter-stack/pithead.git
 cd pithead && chmod +x pithead
-cp config.json.template config.json   # then set your payout addresses
+cp config.minimal.json config.json   # then set your payout addresses
 ```
 
-> Changed your mind later? You can convert a clone to the published images in place — see
+> Changed your mind later? You can convert a clone to the published images in place. See
 > [Switching a source checkout to release images](operations.md#switching-a-source-checkout-to-release-images).
 
 ---
@@ -87,25 +88,25 @@ cp config.json.template config.json   # then set your payout addresses
 Setup walks through five stages. It's interactive on the first run and safe to re-run later.
 
 1. **Dependency check.** Verifies Docker, Docker Compose, `jq`, and `openssl` are present. On
-   Ubuntu it offers to `apt install` anything missing; on other systems it tells you exactly
-   what to install. Skip with `--skip-deps`.
+   Ubuntu it offers to `apt install` anything missing; on other systems it tells you what to
+   install. Skip with `--skip-deps`.
 
 2. **Interactive configuration.** Asks for your Monero and Tari wallet addresses and whether
-   you're running a **local** Monero node (the default — the stack runs its own) or connecting
-   to a **remote** one. For a local node it **auto-generates** the internal RPC credentials for
-   you. It then writes a minimal `config.json` and locks it down to owner-only (`chmod 600`).
+   you're running a local Monero node (the default — the stack runs its own) or connecting to a
+   remote one. For a local node it auto-generates the internal RPC credentials. It then writes a
+   minimal `config.json` and locks it down to owner-only (`chmod 600`).
 
 3. **Tor provisioning.** Brings up the Tor service and waits for the hidden-service (onion)
    addresses to be generated for Monero, Tari, and P2Pool.
 
-4. **Kernel optimization (Linux only).** Configures **HugePages** for RandomX performance.
-   Making HugePages *persistent* edits GRUB and requires a **reboot** — you'll be prompted
-   before any GRUB change, and you can skip this whole stage with `--skip-optimize`.
+4. **Kernel optimization (Linux only).** Configures HugePages for RandomX performance. Making
+   HugePages persistent edits GRUB and requires a reboot. You're prompted before any GRUB change,
+   and you can skip this whole stage with `--skip-optimize`.
 
-5. **Start.** Once everything is provisioned, setup offers to start the stack for you.
+5. **Start.** Once everything is provisioned, setup offers to start the stack.
 
-> **If you enabled persistent HugePages, reboot before mining.** After the reboot, start the
-> stack with `./pithead up`.
+> If you enabled persistent HugePages, reboot before mining. After the reboot, start the stack
+> with `./pithead up`.
 
 ### Setup flags
 
@@ -118,30 +119,30 @@ Setup walks through five stages. It's interactive on the first run and safe to r
 
 ## 4. First boot: the node syncs
 
-The first time the stack starts, your Monero and Tari nodes have to **download and verify the
-blockchain from the network**. Until both are fully synced, the dashboard shows a dedicated
-**Sync Mode** screen with live progress for each chain — and no hashrate is routed yet.
+The first time the stack starts, your Monero and Tari nodes download and verify the blockchain
+from the network. Until both are fully synced, the dashboard shows a dedicated Sync Mode screen
+with live progress for each chain, and no hashrate is routed yet.
 
-This is normal and can take anywhere from a few hours to a day or more depending on your
-hardware, disk, and network. You can watch progress on the dashboard or in the logs:
+This can take anywhere from a few hours to a day or more depending on your hardware, disk, and
+network. Watch progress on the dashboard or in the logs:
 
 ```bash
 ./pithead logs monerod
 ./pithead logs tari
 ```
 
-Once both chains report fully synced, the dashboard automatically switches from Sync Mode to
-the full operational view and the stack begins mining. See [The Dashboard](dashboard.md) for a
-tour of both states.
+Once both chains report fully synced, the dashboard switches from Sync Mode to the full
+operational view and the stack begins mining. See [The Dashboard](dashboard.md) for a tour of
+both states.
 
-> **Already have a synced Monero node?** You can skip most of the initial sync by pointing the
-> stack at your existing blockchain data, or by connecting to a remote node. See
+> Already have a synced Monero node? You can skip most of the initial sync by pointing the stack
+> at your existing blockchain data, or by connecting to a remote node. See
 > [Reusing an existing node](configuration.md#reusing-an-existing-node).
 
-> **Sync is crawling over Tor?** The default routes the first sync over Tor for privacy, which is
-> slow. You can opt into a faster **clearnet initial sync** for Monero and/or Tari; each node then
-> **switches back to Tor automatically once it's synced**. It's default-off and privacy-relevant, so
-> read the trade-off first:
+> Sync crawling over Tor? The default routes the first sync over Tor for privacy, which is slow.
+> You can opt into a faster clearnet initial sync for Monero and/or Tari; each node switches back
+> to Tor automatically once it's synced. It's default-off and privacy-relevant, so read the
+> trade-off first:
 > [Optional clearnet initial sync](privacy.md#optional-clearnet-initial-sync-off-by-default).
 
 ---
@@ -155,20 +156,20 @@ https://<your-hostname>
 ```
 
 `<your-hostname>` is the host you set during setup (the script prints the exact URL when it
-starts the stack). Caddy uses a self-signed certificate (`tls internal`), so the **first** time
-you visit, your browser shows a one-time "your connection is not private" / untrusted-certificate
-warning — accept it to continue. Prefer plain HTTP on your LAN? Set `dashboard.secure: false` in
+starts the stack). Caddy uses a self-signed certificate (`tls internal`), so the first time you
+visit, your browser shows a one-time "your connection is not private" / untrusted-certificate
+warning. Accept it to continue. Prefer plain HTTP on your LAN? Set `dashboard.secure: false` in
 `config.json` and run `./pithead apply`.
 
 ---
 
 ## 6. Connect your miners
 
-Point your XMRig miners at the stack machine on port **3333** — that's the single endpoint for all
-your rigs. You do **not** put your wallet address in the miner config; the stack handles payouts
+Point your XMRig miners at the stack machine on port `3333`. That's the single endpoint for all
+your rigs. Do not put your wallet address in the miner config; the stack handles payouts
 centrally.
 
-See [Connecting Miners](workers.md) to point an **existing** rig at the stack, or use
+See [Connecting Miners](workers.md) to point an existing rig at the stack, or use
 [RigForge](https://github.com/p2pool-starter-stack/rigforge) to provision a tuned miner from scratch
 in one command.
 
diff --git a/docs/hardware.md b/docs/hardware.md
index f4e968b4..e8844630 100644
--- a/docs/hardware.md
+++ b/docs/hardware.md
@@ -1,18 +1,18 @@
 # Hardware Requirements
 
-This stack involves **two different kinds of machine**, and they have very different hardware
+Hardware sizing for the stack host. The stack involves two kinds of machine, with very different
 needs:
 
-1. **The stack host** — the one machine that runs `./pithead` and the Docker stack (Monero node,
-   P2Pool, Tari, the XMRig proxy, the dashboard, Tor). **It does not mine.** It runs the nodes and
-   coordinates everything; the actual hashing happens elsewhere.
-2. **Worker rigs** — one or more separate machines running [XMRig](https://github.com/xmrig/xmrig).
-   These do the real RandomX hashing and point at the stack host's port `3333`. A worker can be the
-   same machine as the host, but treating them separately is what lets you scale hashrate.
+1. The stack host: the one machine that runs `./pithead` and the Docker stack (Monero node, P2Pool,
+   Tari, the XMRig proxy, the dashboard, Tor). It does not mine. It runs the nodes and coordinates
+   everything; the actual hashing happens elsewhere.
+2. Worker rigs: one or more separate machines running [XMRig](https://github.com/xmrig/xmrig). These
+   do the real RandomX hashing and point at the stack host's port `3333`. A worker can be the same
+   machine as the host, but treating them separately is what lets you scale hashrate.
 
-Size the **host** for nodes, storage, and uptime; size the **workers** for CPU mining performance.
+Size the host for nodes, storage, and uptime; size the workers for CPU mining performance.
 
-> **This page covers the stack host.** Miner (worker-rig) hardware lives with the miner kit — see
+> This page covers the stack host. Miner (worker-rig) hardware lives with the miner kit, see
 > [RigForge](https://github.com/p2pool-starter-stack/rigforge#-hardware-requirements).
 
 ---
@@ -30,80 +30,79 @@ Size the **host** for nodes, storage, and uptime; size the **workers** for CPU m
 | **Network** | Always-on broadband | Unmetered broadband |
 | **OS** | Ubuntu Server **24.04 LTS** | Ubuntu Server 24.04 LTS |
 
-> These figures assume the **default local Monero node** with **pruning on** and **HugePages
-> enabled**. Remote-node mode and other tweaks lower them — see
+> These figures assume the default local Monero node with pruning on and HugePages enabled.
+> Remote-node mode and other tweaks lower them, see
 > [Lighter-footprint options](#lighter-footprint-options).
 
 ### Where these numbers come from
 
-The host runs several services in one box, so its requirement is really the **sum of what each
-service needs**, plus headroom for the operating system. Here's the per-component breakdown, taken
-from each project's own guidance:
+The host runs several services in one box, so its requirement is the sum of what each service needs,
+plus headroom for the OS. Here's the per-component breakdown, taken from each project's own guidance:
 
 | Service | RAM it wants | Disk | Notes |
 |---|---|---|---|
 | **[Monero node](https://docs.getmonero.org/running-node/)** (`monerod`) | **4 GB** minimum; more RAM = bigger DB cache and faster sync | **~100 GB** pruned · **~265 GB** full — and growing | SSD strongly recommended. Not run at all in remote-node mode. |
 | **[P2Pool](https://github.com/SChernykh/p2pool)** | **~2.3 GB** for the RandomX dataset it uses to verify blocks fast (`--light-mode` skips it, saving ~2 GB, but verifies slower) | tiny (sidechain state) | Needs a 64-bit CPU with **AVX2** and a synced `monerod`. |
-| **[Tari base node](https://www.tari.com/integration-guide)** (`minotari_node`) | **4 GB** minimum, **8 GB+** recommended; grows over time | **~135 GB** SSD — and growing | **The single largest disk consumer** — Tari's chain rivals a *full* Monero node, so budget for it whether or not you prune Monero. The stack caps its memory so growth can't take the host down. |
-| **XMRig proxy · Tor · Caddy · dashboard · Docker** | a few hundred MB combined | a few GB (Docker images) | These coordinate and serve the UI — they don't mine, so no special CPU. |
+| **[Tari base node](https://www.tari.com/integration-guide)** (`minotari_node`) | **4 GB** minimum, **8 GB+** recommended; grows over time | **~135 GB** SSD — and growing | The single largest disk consumer. Tari's chain rivals a *full* Monero node, so budget for it whether or not you prune Monero. The stack caps its memory so growth can't take the host down. |
+| **XMRig proxy · Tor · Caddy · dashboard · Docker** | a few hundred MB combined | a few GB (Docker images) | These coordinate and serve the UI. They don't mine, so no special CPU. |
 
-Add the three heavy services' RAM — Monero (4 GB), P2Pool (~2.3 GB), Tari (4 GB) — plus a couple of
-GB for the OS, page cache, and supporting containers, and you land on the **16 GB minimum** above.
+Add the three heavy services' RAM (Monero 4 GB, P2Pool ~2.3 GB, Tari 4 GB) plus a couple of GB for
+the OS, page cache, and supporting containers, and you land on the 16 GB minimum above.
 
-**Disk is dominated by the two chains.** A pruned Monero node (~100 GB) **plus the Tari node
-(~135 GB)** and a few GB for P2Pool and the OS put a pruned host near **~250 GB today**; a
-*full* Monero node (~265 GB) instead of pruned pushes that toward **~400 GB**. The surprise for most
-people is **Tari** — its chain rivals a full Monero node, so pruning Monero doesn't shrink it. (A
-*freshly synced* pruned node is ~100 GB, but **pruning an existing full chain doesn't reclaim the
-space until you compact it** — `mdb_copy -c` — so until then it sits at full size.)
+Disk is dominated by the two chains. A pruned Monero node (~100 GB) plus the Tari node (~135 GB) and
+a few GB for P2Pool and the OS put a pruned host near ~250 GB today; a *full* Monero node (~265 GB)
+instead of pruned pushes that toward ~400 GB. The surprise for most people is Tari: its chain rivals
+a full Monero node, so pruning Monero doesn't shrink it. (A *freshly synced* pruned node is ~100 GB,
+but pruning an existing full chain doesn't reclaim the space until you compact it with `mdb_copy -c`,
+so until then it sits at full size.)
 
-**Both chains keep growing — roughly ~100+ GB/year combined** (Tari, a young chain, grows fastest;
-Monero adds tens of GB/year). That's why the table above lists a **~300 GB (pruned) / ~500 GB (full)
-minimum** but recommends much more: for a **set-and-forget host, put it on a 2–4 TB SSD** and you
-won't think about disk for years. (Current sizes are measured on live deployments, not estimates.)
+Both chains keep growing, roughly ~100+ GB/year combined (Tari, a young chain, grows fastest; Monero
+adds tens of GB/year). That's why the table above lists a ~300 GB (pruned) / ~500 GB (full) minimum
+but recommends much more: for a set-and-forget host, put it on a 2–4 TB SSD and you won't think about
+disk for years. (Current sizes are measured on live deployments, not estimates.)
 
-> **Heads-up on RandomX RAM:** Monero and P2Pool both want large memory pages for RandomX, so they
-> share **one ~6 GB HugePages reservation** rather than each adding their own — see
-> [Memory](#memory) for what that means for the 16 GB floor.
+> NOTE: Monero and P2Pool both want large memory pages for RandomX, so they share one ~6 GB
+> HugePages reservation rather than each adding their own. See [Memory](#memory) for what that means
+> for the 16 GB floor.
 
 ### CPU
 
-The host CPU runs the nodes, P2Pool's block verification, the proxy, and the dashboard — it is
-**not** your miner, so it doesn't need to be a high-end mining chip. Two things matter:
+The host CPU runs the nodes, P2Pool's block verification, the proxy, and the dashboard. It is not
+your miner, so it doesn't need to be a high-end mining chip. Two things matter:
 
-- **AVX2 is strongly recommended.** P2Pool verifies blocks with RandomX, which runs far better with
+- AVX2 is strongly recommended. P2Pool verifies blocks with RandomX, which runs far better with
   AVX2; setup warns *"AVX2 not detected. Mining performance will be poor."* if it's missing. (P2Pool
-  also requires a 64-bit CPU — ARMv7 and older aren't supported.)
-- **More cores speed up the first sync.** Monero parallelizes block verification during the initial
-  sync: `monero.prep_blocks_threads` defaults to `auto` = **host cores − 2, clamped to 4–8**. So
-  6–10 cores let it use the full thread budget while leaving headroom for the rest of the stack.
-  After the initial sync, steady-state CPU load is low.
+  also requires a 64-bit CPU; ARMv7 and older aren't supported.)
+- More cores speed up the first sync. Monero parallelizes block verification during the initial
+  sync: `monero.prep_blocks_threads` defaults to `auto` = host cores − 2, clamped to 4–8. So 6–10
+  cores let it use the full thread budget while leaving headroom for the rest of the stack. After the
+  initial sync, steady-state CPU load is low.
 
 ### Memory
 
-**16 GB is the practical floor** with the default configuration. The budget breaks down as:
+16 GB is the practical floor with the default configuration. The budget breaks down as:
 
-- **~6 GB reserved for HugePages.** RandomX wants large pages, so setup configures
-  `vm.nr_hugepages=3072` (3072 × 2 MB = **6 GB**), shared by `monerod` and P2Pool. This RAM is
-  carved out of the kernel up front and is **invisible** to container memory stats — it's gone
-  whether or not it's fully used at any moment.
-- **Tari** (4 GB+, growing) gets an auto-sized **safety ceiling** (`tari.mem_limit: auto`) so a
-  genuine runaway restarts cleanly instead of taking the host down. On a 16 GB host that ceiling
-  lands around **7.5 GB**; on 32 GB, around **19 GB**.
-- **The OS, page cache, and the lighter containers** take the rest.
+- ~6 GB reserved for HugePages. RandomX wants large pages, so setup configures
+  `vm.nr_hugepages=3072` (3072 × 2 MB = 6 GB), shared by `monerod` and P2Pool. This RAM is carved out
+  of the kernel up front and is invisible to container memory stats; it's gone whether or not it's
+  fully used at any moment.
+- Tari (4 GB+, growing) gets an auto-sized safety ceiling (`tari.mem_limit: auto`) so a genuine
+  runaway restarts cleanly instead of taking the host down. On a 16 GB host that ceiling lands around
+  7.5 GB; on 32 GB, around 19 GB.
+- The OS, page cache, and the lighter containers take the rest.
 
-On a 16 GB machine this all fits but is tight, which is exactly why Tari is capped. **32 GB is
-recommended** if you run a full (unpruned) node, drive a lot of workers, or want long uptimes
-without Tari's growth ever pressing on the cap.
+On a 16 GB machine this all fits but is tight, which is exactly why Tari is capped. 32 GB is
+recommended if you run a full (unpruned) node, drive a lot of workers, or want long uptimes without
+Tari's growth ever pressing on the cap.
 
-> **Running with only 8 GB?** It can boot **only** if you disable HugePages (`./pithead setup
-> --skip-optimize`), which frees the 6 GB reservation — but it leaves very little headroom and
-> hurts RandomX verification performance. Not recommended; prefer 16 GB+.
+> Running with only 8 GB? It can boot only if you disable HugePages (`./pithead setup
+> --skip-optimize`), which frees the 6 GB reservation, but it leaves very little headroom and hurts
+> RandomX verification performance. Not recommended; prefer 16 GB+.
 
 ### Disk
 
-The two blockchains dominate, and an **SSD is strongly recommended** — initial-sync verification
-and the node databases do a lot of random I/O that punishes spinning disks. What to provision:
+The two blockchains dominate, and an SSD is strongly recommended: initial-sync verification and the
+node databases do a lot of random I/O that punishes spinning disks. What to provision:
 
 | | Pruned (default) | Full (`monero.prune: false`) |
 |---|---|---|
@@ -112,46 +111,44 @@ and the node databases do a lot of random I/O that punishes spinning disks. What
 | P2Pool + dashboard + Docker images | a few GB | a few GB |
 | **Plan for** | **~300 GB+ SSD** | **~500 GB+ SSD** |
 
-Both chains **keep growing — ~100+ GB/year combined** (Tari, a young chain, grows fastest), so leave
-plenty of headroom: the *recommended* **1 TB+ (pruned) / 2 TB+ (full)** sizes exist for exactly that,
-and a **2–4 TB SSD** is the true set-and-forget choice — you won't revisit disk for years. Note that
-**Tari's chain (~135 GB) is the largest single item** and is the same whether or not you prune
-Monero, so pruning only saves disk on the Monero side.
-Pruning (the default) keeps a fully validating Monero node at a fraction of the size and is the
+Both chains keep growing, ~100+ GB/year combined (Tari, a young chain, grows fastest), so leave
+plenty of headroom: the *recommended* 1 TB+ (pruned) / 2 TB+ (full) sizes exist for exactly that, and
+a 2–4 TB SSD is the true set-and-forget choice. Note that Tari's chain (~135 GB) is the largest
+single item and is the same whether or not you prune Monero, so pruning only saves disk on the Monero
+side. Pruning (the default) keeps a fully validating Monero node at a fraction of the size and is the
 right choice for almost everyone.
 
-> **`setup` pre-flights these.** Before committing to a sync, `./pithead setup` checks free disk and
+> `setup` pre-flights these. Before committing to a sync, `./pithead setup` checks free disk and
 > total RAM against the minimums on this page (~300 GB pruned / ~500 GB full disk, 16 GB RAM) and
-> **warns** if the host falls short — it never blocks. `./pithead doctor` re-runs the same disk and
-> RAM checks on demand, so you can re-verify a host at any time.
+> warns if the host falls short; it never blocks. `./pithead doctor` re-runs the same disk and RAM
+> checks on demand, so you can re-verify a host at any time.
 
-You can put any service's data on a dedicated disk by pointing its `*.data_dir` at an absolute path
-— e.g. to keep the Monero blockchain on a separate SSD. See
+You can put any service's data on a dedicated disk by pointing its `*.data_dir` at an absolute path,
+e.g. to keep the Monero blockchain on a separate SSD. See
 [Configuration › Data directories](configuration.md#data-directories).
 
 ### Network
 
-- **Always-on broadband.** All upstream traffic (Monero, Tari, P2Pool) goes over **Tor**, with **no
-  public port forwarding** required — the stack uses hidden services for inbound peers.
-- **Initial sync is the heavy part.** The first run downloads and verifies both chains over Tor
-  (slower than clearnet): ~100 GB pruned / ~265 GB full for Monero, plus ~135 GB for Tari. This can
-  take anywhere from a few hours to a day or more. You can avoid it by
+- Always-on broadband. All upstream traffic (Monero, Tari, P2Pool) goes over Tor, with no public
+  port forwarding required; the stack uses hidden services for inbound peers.
+- Initial sync is the heavy part. The first run downloads and verifies both chains over Tor (slower
+  than clearnet): ~100 GB pruned / ~265 GB full for Monero, plus ~135 GB for Tari. This can take
+  anywhere from a few hours to a day or more. You can avoid it by
   [reusing an existing synced node](configuration.md#reusing-an-existing-node), or speed it up with
   an [optional clearnet initial sync](privacy.md#optional-clearnet-initial-sync-off-by-default)
   (default off, privacy-relevant) that downloads over clearnet and then returns to Tor.
-- **Steady state is light.** Once synced, bandwidth is modest.
-- **LAN reachability for workers.** Each worker rig connects to the host on **port 3333** over your
-  local network (plain stratum, not Tor). If the host has a firewall, allow inbound `3333` from your
-  LAN.
+- Steady state is light. Once synced, bandwidth is modest.
+- LAN reachability for workers. Each worker rig connects to the host on port 3333 over your local
+  network (plain stratum, not Tor). If the host has a firewall, allow inbound `3333` from your LAN.
 
 ### Operating system & dependencies
 
-- **Ubuntu Server 24.04 LTS** is the officially supported platform. macOS and other Linux distros
-  may work but aren't officially supported.
-- The **kernel/HugePages tuning is Linux-only.** On Linux, making HugePages persistent edits GRUB
-  and needs a **reboot** (you're prompted first, and can skip with `--skip-optimize`).
-- Required software: **Docker Engine**, **Docker Compose v2**, **`jq`**, and **`openssl`**. On
-  Ubuntu, `./pithead setup` offers to install anything missing — or do it yourself:
+- Ubuntu Server 24.04 LTS is the officially supported platform. macOS and other Linux distros may
+  work but aren't officially supported.
+- The kernel/HugePages tuning is Linux-only. On Linux, making HugePages persistent edits GRUB and
+  needs a reboot (you're prompted first, and can skip with `--skip-optimize`).
+- Required software: Docker Engine, Docker Compose v2, `jq`, and `openssl`. On Ubuntu, `./pithead
+  setup` offers to install anything missing, or do it yourself:
 
   ```bash
   sudo apt update && sudo apt install -y jq docker.io docker-compose-v2 openssl
@@ -166,31 +163,31 @@ away:
 
 | Want to… | Do this | Saves |
 |---|---|---|
-| Skip the Monero node entirely | **Remote-node mode** (`monero.mode: remote`) — the bundled `monerod` isn't started | ~100–265 GB disk + Monero's 4 GB RAM/CPU |
+| Skip the Monero node entirely | Remote-node mode (`monero.mode: remote`); the bundled `monerod` isn't started | ~100–265 GB disk + Monero's 4 GB RAM/CPU |
 | Skip the initial sync wait | [Reuse an existing synced chain](configuration.md#reusing-an-existing-node) | Hours–days + sync bandwidth |
 | Free the 6 GB HugePages reservation | `./pithead setup --skip-optimize` | ~6 GB RAM (at the cost of RandomX performance) |
 | Free RAM for other apps | Lower `tari.mem_limit` (e.g. `"4g"`) | Caps Tari's ceiling lower |
 | Keep mining when Tari has issues | `dashboard.tari_required: false` | Tari outages/syncs stop blocking Monero mining |
 
-> Remote-node mode still runs Tari, P2Pool, the proxy, dashboard, and Tor locally — it only drops
-> `monerod`. The remote node must be one you control with **ZMQ publishing enabled**; public "open
-> node" endpoints don't qualify. See
+> Remote-node mode still runs Tari, P2Pool, the proxy, dashboard, and Tor locally; it only drops
+> `monerod`. The remote node must be one you control with ZMQ publishing enabled; public "open node"
+> endpoints don't qualify. See
 > [Connecting to a remote Monero node](configuration.md#connecting-to-a-remote-monero-node).
 
 ---
 
 ## Sizing examples
 
-- **Small home setup (pruned):** a 6-core / 16 GB / 240 GB SSD mini-PC as the host, HugePages on,
-  with one or two workers pointed at it. Comfortable for getting started.
-- **Full node + several workers:** an 8-core / 32 GB / 600 GB SSD host running an unpruned node,
-  feeding a handful of dedicated mining rigs. Headroom for Tari growth and long uptimes.
-- **Minimal / reuse-an-existing-node:** point the stack at a Monero node you already run (remote
-  mode), and the host needs only enough for Tari, P2Pool, the proxy, dashboard, and Tor — far less
-  disk and RAM.
+- Small home setup (pruned): a 6-core / 16 GB / 240 GB SSD mini-PC as the host, HugePages on, with
+  one or two workers pointed at it. Comfortable for getting started.
+- Full node + several workers: an 8-core / 32 GB / 600 GB SSD host running an unpruned node, feeding
+  a handful of dedicated mining rigs. Headroom for Tari growth and long uptimes.
+- Minimal / reuse-an-existing-node: point the stack at a Monero node you already run (remote mode),
+  and the host needs only enough for Tari, P2Pool, the proxy, dashboard, and Tor; far less disk and
+  RAM.
 
-> **Sizing the miners** that connect to this host is a separate exercise — their CPU is what
-> determines hashrate. See RigForge's
+> Sizing the miners that connect to this host is a separate exercise; their CPU is what determines
+> hashrate. See RigForge's
 > [Hardware Requirements](https://github.com/p2pool-starter-stack/rigforge#-hardware-requirements).
 
 ---
diff --git a/docs/integration-testing.md b/docs/integration-testing.md
index 05d7c73d..25aa5347 100644
--- a/docs/integration-testing.md
+++ b/docs/integration-testing.md
@@ -1,29 +1,29 @@
 # Integration Testing
 
-How Pithead is validated end-to-end against a **real Ubuntu server** running full Monero and
-full Tari nodes — the runtime/integration half of our testing, and the **blocking pre-release
-gate** described in [Releasing](releasing.md) (issue
+This suite validates Pithead end-to-end against a real Ubuntu server running full Monero and
+full Tari nodes. It is the runtime/integration half of testing and the blocking pre-release
+gate described in [Releasing](releasing.md) (issue
 [#54](https://github.com/p2pool-starter-stack/pithead/issues/54)).
 
-Our other suites are client-side and never touch a daemon: the `pithead` shell tests stub out
+The other suites are client-side and never touch a daemon: the `pithead` shell tests stub out
 `docker`/`sudo`, the compose test only checks `docker compose config` interpolation, and the
-dashboard pytest mocks its clients. They prove the *code* is correct; they can't prove that a
+dashboard pytest mocks its clients. They prove the code is correct. They can't prove that a
 real `apply → sync-gate → mine → status` flow works on a real host. That's what this suite is
 for.
 
-> This live matrix is **tier 4** of a four-tier plan. The runtime *situations* a healthy box
-> can't show (cold sync, node-down, unhealthy containers, XvB tiers) are simulated more cheaply
-> at lower tiers — unit tests, a client **contract test** against controllable fakes
-> ([`tests/integration/fakes/`](../tests/integration/fakes/)), and a **fake-daemon docker
-> mini-stack** ([`tests/integration/mini-stack/`](../tests/integration/mini-stack/)). See
+> This live matrix is tier 4 of a four-tier plan. The runtime situations a healthy box can't
+> show (cold sync, node-down, unhealthy containers, XvB tiers) are simulated more cheaply at
+> lower tiers: unit tests, a client contract test against controllable fakes
+> ([`tests/integration/fakes/`](../tests/integration/fakes/)), and a fake-daemon docker
+> mini-stack ([`tests/integration/mini-stack/`](../tests/integration/mini-stack/)). See
 > [Testing Strategy](testing-strategy.md) for the full picture and scenario catalog.
 
-The lives under [`tests/integration/`](../tests/integration/):
+The suite lives under [`tests/integration/`](../tests/integration/):
 
 | File | Role |
 |---|---|
 | `run.sh` | Entry point. Connects to the box (SSH or `--local`), iterates the config matrix, asserts, captures artifacts, restores. |
-| `scenarios.sh` | The **declarative config matrix** — adding a case is a one-line data edit. |
+| `scenarios.sh` | The declarative config matrix. Adding a case is a one-line data edit. |
 | `lib.sh` | Shared helpers: target I/O (SSH/local), assertions, readiness waiters, config rendering, secret redaction. |
 | `selftest.sh` | Pure-logic self-test (no server). Runs in CI on every PR. |
 
@@ -31,66 +31,65 @@ The lives under [`tests/integration/`](../tests/integration/):
 
 ## How it works
 
-The suite assumes the box is **already deployed and synced with miners connected** — the whole
-point of a dedicated test server is that the full Monero and Tari nodes are synced once and
-*reused*, so each scenario runs in minutes instead of waiting days for a chain sync.
+The suite assumes the box is already deployed and synced with miners connected. The point of a
+dedicated test server is that the full Monero and Tari nodes are synced once and reused, so each
+scenario runs in minutes instead of waiting days for a chain sync.
 
-Given that, the harness moves between matrix scenarios with non-interactive **`pithead apply
--y`**, which:
+Given that, the harness moves between matrix scenarios with non-interactive `pithead apply -y`,
+which:
 
 - recreates only the containers whose resolved config changed,
-- **reuses the synced chain data dirs** (it never re-syncs, never re-provisions Tor), and
-- **preserves secrets** (`PROXY_AUTH_TOKEN`, onion addresses).
+- reuses the synced chain data dirs (it never re-syncs, never re-provisions Tor), and
+- preserves secrets (`PROXY_AUTH_TOKEN`, onion addresses).
 
-For each scenario it writes a `config.json`, applies it, **waits on real readiness signals**
-(container health, `pithead status`, dashboard sync %, miner-released) with timeouts — never a
-fixed `sleep` — then runs the assertion battery below. All reads happen *on the box*
+For each scenario it writes a `config.json`, applies it, then waits on real readiness signals
+(container health, `pithead status`, dashboard sync %, miner-released) with timeouts. Never a
+fixed `sleep`. It then runs the assertion battery below. All reads happen on the box
 (`pithead status`/`doctor` and `curl http://127.0.0.1:8000/api/state`), so SSH and `--local`
-behave identically and we never depend on resolving the box's dashboard hostname.
+behave identically and never depend on resolving the box's dashboard hostname.
 
 Before the first scenario it snapshots the box's original `config.json` and a fingerprint of
-its secrets; after the run it **restores the original config** and re-applies (unless
-`--keep`).
+its secrets. After the run it restores the original config and re-applies (unless `--keep`).
 
 ### Safety model
 
-The test box holds real synced nodes and real keys — treat it as production-sensitive.
+The test box holds real synced nodes and real keys. Treat it as production-sensitive.
 
-- **Never mutates the canonical chains.** The harness only ever writes `config.json` and lets
+- Never mutates the canonical chains. The harness only ever writes `config.json` and lets
   `apply` recreate containers. It does not `rm -rf` data dirs. The destructive `monero.prune`
-  axis (a pruned vs. full DB are different on disk) is only exercised against a *separate*
-  synced data dir you pass with `--pruned-data-dir` / `--full-data-dir`; without it the case
-  is reported **SKIPPED**, never run against the canonical DB.
-- **No silent coverage drops.** Any scenario whose prerequisite is missing (an alt data dir, a
-  remote endpoint) is logged as `SKIPPED` with the reason — it never quietly disappears.
-- **Secrets hygiene.** RPC creds, the proxy token, and onion addresses are never printed.
-  Secret-preservation is checked by hashing them **on the box** (`sha256sum`) and comparing the
-  hash — the plaintext never crosses the wire. All captured artifacts are passed through a
+  axis (a pruned vs. full DB are different on disk) is only exercised against a separate
+  synced data dir you pass with `--pruned-data-dir` / `--full-data-dir`. Without it the case
+  is reported `SKIPPED`, never run against the canonical DB.
+- No silent coverage drops. Any scenario whose prerequisite is missing (an alt data dir, a
+  remote endpoint) is logged as `SKIPPED` with the reason. It never quietly disappears.
+- Secrets hygiene. RPC creds, the proxy token, and onion addresses are never printed.
+  Secret-preservation is checked by hashing them on the box (`sha256sum`) and comparing the
+  hash, so the plaintext never crosses the wire. All captured artifacts pass through a
   redactor.
-- **Continue-on-error.** A failing assertion doesn't abort the run; the whole matrix is
-  collected and summarized, with per-scenario artifacts for the failures.
+- Continue-on-error. A failing assertion doesn't abort the run. The whole matrix is collected
+  and summarized, with per-scenario artifacts for the failures.
 
 ---
 
 ## Provisioning the test box
 
-A one-time setup. Target the Ubuntu LTS releases we support (22.04 / 24.04).
+A one-time setup. Target the Ubuntu LTS releases the stack supports (22.04 / 24.04).
 
-1. **Install and deploy Pithead** normally (see [Getting Started](getting-started.md)) and let
-   it fully sync. You want the box in the steady state: all containers healthy, Monero + Tari
-   synced, and at least one miner (ideally two) connected and submitting shares.
-2. **Reusable synced data.** The synced `monero.data_dir` and `tari.data_dir` are the key
-   enabler — they're reused across every scenario. The same synced full monerod is also what
-   the `remote` scenario points at as an external node (see `--remote-monero-host`).
-3. **Tools on the box:** `jq`, `curl`, `docker` (with compose v2), and `sha256sum`. The first
-   three are already Pithead prerequisites; `sha256sum` ships with coreutils.
-4. **Access.** Key-based SSH from wherever you run the suite (or run it on the box with
-   `--local`). If Docker needs root there, use `--pithead "sudo ./pithead"`.
-5. *(Optional)* A second synced data dir for the **opposite** prune mode if you want to cover
-   both pruned and full in one run — see the prune axis above.
+1. Install and deploy Pithead normally (see [Getting Started](getting-started.md)) and let it
+   fully sync. You want the box in steady state: all containers healthy, Monero + Tari synced,
+   and at least one miner (ideally two) connected and submitting shares.
+2. Reusable synced data. The synced `monero.data_dir` and `tari.data_dir` are reused across
+   every scenario. The same synced full monerod is also what the `remote` scenario points at as
+   an external node (see `--remote-monero-host`).
+3. Tools on the box: `jq`, `curl`, `docker` (with compose v2), and `sha256sum`. The first three
+   are already Pithead prerequisites; `sha256sum` ships with coreutils.
+4. Access. Key-based SSH from wherever you run the suite, or run it on the box with `--local`.
+   If Docker needs root there, use `--pithead "sudo ./pithead"`.
+5. Optional: a second synced data dir for the opposite prune mode if you want to cover both
+   pruned and full in one run. See the prune axis above.
 
-> **Runner security.** Keep the box least-privilege and network-isolated; it holds real keys.
-> This is a self-hosted/manual gate, not something we run on public CI.
+> NOTE: Keep the box least-privilege and network-isolated; it holds real keys. This is a
+> self-hosted/manual gate, not something to run on public CI.
 
 ---
 
@@ -125,17 +124,18 @@ Useful flags (full list in `run.sh --help`):
 | Flag | Purpose |
 |---|---|
 | `--host <user@host>` / `--local` | Drive the box over SSH, or a stack on this machine. |
-| `--dir <path>` | The Pithead stack directory **on the box** — relative to the SSH login dir or absolute (default `pithead`). Avoid a literal `~`; your local shell expands it before the box sees it. |
+| `--dir <path>` | The Pithead stack directory on the box, relative to the SSH login dir or absolute (default `pithead`). Avoid a literal `~`; your local shell expands it before the box sees it. |
 | `--pithead <cmd>` | How to invoke pithead there (e.g. `"sudo ./pithead"`). |
-| `--check` | **Non-destructive**: assert the box's current live state only — no config change, no apply, no restore. The safe first run / ongoing health check. |
-| `--readiness` | **Non-destructive**: assess whether the box is fit to be a release/validation server (synced chains reusable, snapshot-capable FS, disk headroom, secrets owner-only, dashboard localhost-only). See [Release Server](release-server.md). |
+| `--check` | Non-destructive: assert the box's current live state only. No config change, no apply, no restore. The safe first run / ongoing health check. |
+| `--readiness` | Non-destructive: assess whether the box is fit to be a release/validation server (synced chains reusable, snapshot-capable FS, disk headroom, secrets owner-only, dashboard localhost-only). See [Release Server](release-server.md). |
 | `--scenario <name>` | Run just one scenario. |
 | `--workers <n>` | Miners expected online while mining (default `2`). |
 | `--remote-monero-host <h>` | External node endpoint for the `remote` scenario. |
 | `--pruned-data-dir` / `--full-data-dir` | Synced alt DB to enable the opposite prune mode. |
 | `--lifecycle` | Also run the lifecycle phase (restart, apply secret-preservation). |
 | `--fault-injection` | Also break monerod (stop / SIGSTOP / remove) and assert `status`' down/unhealthy/missing verdicts and the failover→recovery cycle. Destructive-then-restored; local mode only; slow. |
-| `--safety-backup` | Take a `pithead backup` before the destructive scenarios and **auto-roll-back** (down → restore → up) if anything fails; the archive is removed on success. Recommended for the destructive matrix on a precious box; also exercises backup/restore end-to-end. |
+| `--auth-fail-closed` | Also empty `PROXY_AUTH_TOKEN` in `.env` and assert `pithead up` refuses to start (the live counterpart to the tier-1 compose-config check, [#153](https://github.com/p2pool-starter-stack/pithead/issues/153)/[#203](https://github.com/p2pool-starter-stack/pithead/issues/203)), then restore the exact token and recover. Destructive-then-restored; ssh or local mode. |
+| `--safety-backup` | Take a `pithead backup` before the destructive scenarios and auto-roll-back (down → restore → up) if anything fails; the archive is removed on success. Recommended for the destructive matrix on a precious box; also exercises backup/restore end-to-end. |
 | `--keep` | Don't restore the original config (leave the box on the last scenario). |
 | `--out <dir>` | Where to write the manifest and failure artifacts. |
 | `--list` | Print the matrix and axis coverage and exit. |
@@ -144,11 +144,52 @@ The runner exits non-zero if any assertion failed.
 
 ---
 
+## One-command branch e2e (`e2e.sh`)
+
+`run.sh` assumes a stack is already deployed on the box. [`tests/integration/e2e.sh`](../tests/integration/e2e.sh)
+is the wrapper that does the whole thing for a branch against the live test bench in one command:
+deploy, borrow a real miner, run the matrix, and put everything back.
+
+```bash
+tests/integration/e2e.sh <branch> [--mode targeted|check|matrix] [--workers N] [--miner HOST]
+tests/integration/e2e.sh claude/my-feature                 # default: LEAN — dashboard + sync logic
+tests/integration/e2e.sh claude/my-feature --mode check    # non-destructive smoke (pure reads)
+tests/integration/e2e.sh claude/my-feature --mode matrix   # full config sweep (opt-in, pre-release)
+```
+
+What it does, then reverses on exit (even on failure / Ctrl-C, via an `EXIT` trap):
+
+1. Dedicated checkout. Provisions `/srv/code/pithead-e2e` (clone-once, then `git fetch`) and checks
+   out `<branch>` there. The canonical `/srv/code/pithead` is the baseline and is never git-touched.
+   Because the Compose project name is pinned to `pithead`, the two checkouts drive the same
+   containers and the same shared chains. They're two code copies of one stack, run one at a time, so
+   borrow→test→restore is a fast code/image swap, never a re-sync.
+2. Seeds the e2e checkout with the canonical `config.json`/`.env` (same wallet, secrets, onion keys,
+   and shared `monero/tari/p2pool` data dirs), so only the branch's code differs.
+3. Safety backup (`pithead backup`) as the rollback anchor.
+4. Borrows a miner (default the configured miner): backs up its xmrig config and repoints it at the
+   bench so the matrix has a real worker mining through this stack (1 worker → run with `--workers 1`).
+5. Deploys the branch (`pithead apply` builds the branch's images) and runs `run.sh` detached on the
+   box (survives an SSH drop on a long matrix), streaming a heartbeat and the full log at the end.
+6. Restores the miner's original pool config and the canonical baseline stack. The synced chains are
+   never touched (asserted post-restore).
+
+`--mode`: `targeted` (default, lean) validates the dashboard and the sync logic against the
+already-synced node: `check` + `--lifecycle` (one controlled restart exercises the sync gate /
+node-down failover) + `--auth-fail-closed`. No full config sweep, and never a re-sync. Container
+restarts reload the existing chain and re-confirm the tip in seconds. `check` is pure reads only.
+`matrix` is the opt-in full destructive config sweep (lifecycle + fault-injection + auth-fail-closed,
+`--safety-backup` auto-rollback) for a pre-release tier-4 gate. `--keep` leaves it deployed for
+inspection (skips the restore). Requires SSH access to the test bench and the miner; see the
+[testbench README](../tests/integration/testbench-README.md).
+
+---
+
 ## The config matrix
 
 Every axis below changes a real runtime path. The matrix covers the realistic combinations and
-guarantees **every value of every axis is exercised at least once** (the `selftest` enforces
-this, and `--list` prints it).
+guarantees every value of every axis is exercised at least once (the `selftest` enforces this,
+and `--list` prints it).
 
 | Axis | Values | What it exercises |
 |---|---|---|
@@ -162,30 +203,30 @@ this, and `--list` prints it).
 
 ### What each scenario asserts
 
-- **Expected containers up, unexpected absent** — every service for that config is running and
-  healthy; in `remote` mode there is **no** `monerod`.
-- **`pithead status` exit code** — `0` for a healthy config.
-- **Dashboard reads live state** — `/api/state` is reachable; Monero is synced (`done`);
-  pruned/full display matches `monero.prune` ([#32](https://github.com/p2pool-starter-stack/pithead/issues/32)); the sidechain `pool.type` matches `p2pool.pool`.
-- **End-to-end mining** — workers are online (`proxy_workers >= --workers`), stratum has
-  connections, and total hashes are accumulating ([#28](https://github.com/p2pool-starter-stack/pithead/issues/28)).
-- **Posture propagated** — `MONERO_RPC_BIND`, `DASHBOARD_SECURE`, `XVB_ENABLED`, and
-  `TARI_REQUIRED` in `.env` match the config; the Caddyfile uses the right scheme.
-- **Idempotency** — a second `apply -y` with no change is a clean no-op.
-- **Secrets preserved** — the proxy token and onion addresses are unchanged across every apply.
+- Expected containers up, unexpected absent. Every service for that config is running and
+  healthy; in `remote` mode there is no `monerod`.
+- `pithead status` exit code: `0` for a healthy config.
+- Dashboard reads live state. `/api/state` is reachable; Monero is synced (`done`); pruned/full
+  display matches `monero.prune` ([#32](https://github.com/p2pool-starter-stack/pithead/issues/32)); the sidechain `pool.type` matches `p2pool.pool`.
+- End-to-end mining. Workers are online (`proxy_workers >= --workers`), stratum has connections,
+  and total hashes are accumulating ([#28](https://github.com/p2pool-starter-stack/pithead/issues/28)).
+- Posture propagated. `MONERO_RPC_BIND`, `DASHBOARD_SECURE`, `XVB_ENABLED`, and `TARI_REQUIRED`
+  in `.env` match the config; the Caddyfile uses the right scheme.
+- Idempotency. A second `apply -y` with no change is a clean no-op.
+- Secrets preserved. The proxy token and onion addresses are unchanged across every apply.
 
 ### Lifecycle + failover (`--lifecycle`)
 
 For one representative config:
 
 - `restart` brings the stack back healthy (`status` → `0`).
-- An `apply` that changes the sidechain recreates only the affected containers and
-  **preserves secrets**; the dashboard reflects the new pool; then it's reverted.
-- **Node-down failover ([#31](https://github.com/p2pool-starter-stack/pithead/issues/31)):**
+- An `apply` that changes the sidechain recreates only the affected containers and preserves
+  secrets; the dashboard reflects the new pool; then it's reverted.
+- Node-down failover ([#31](https://github.com/p2pool-starter-stack/pithead/issues/31)):
   stop `monerod` → `status` returns non-zero (node down) and the dashboard rejects workers
   (stops `xmrig-proxy`) → start `monerod` → workers readmitted → `status` → `0`.
 
-> `upgrade` (which rebuilds/pulls images) is intentionally **not** run unattended — it's slow
+> NOTE: `upgrade` (which rebuilds/pulls images) is intentionally not run unattended. It's slow
 > and changes the bundle under test. Validate it as part of the [release](releasing.md)
 > staging smoke test instead.
 
@@ -193,8 +234,8 @@ For one representative config:
 
 ## Artifacts & triage
 
-Each run writes a **manifest** (`results/manifest.txt`) recording exactly what was under test
-— the stack `VERSION`, git revision, and `docker compose images` — so a run is reproducible.
+Each run writes a manifest (`results/manifest.txt`) recording exactly what was under test: the
+stack `VERSION`, git revision, and `docker compose images`. A run is reproducible.
 
 On a scenario failure, the harness captures (redacted) to `results/<scenario>/`:
 `compose-ps.txt`, `status.txt`, `doctor.txt`, `config.json`, `env.redacted.txt`,
@@ -205,18 +246,18 @@ each failed assertion and points at these.
 
 ## The self-test (CI)
 
-`tests/integration/selftest.sh` exercises the harness's pure logic — config rendering and
-value typing, expectation derivation (profile gating), secret redaction, the SSH/local exec
-wrapper, JSON parsing, and **matrix axis coverage** — with no server. It runs in CI on every
-PR (the `shell` job) and via `make test-integration-selftest`, so the harness itself is held to
-the same lint/test standard as the rest of the stack.
+`tests/integration/selftest.sh` exercises the harness's pure logic with no server: config
+rendering and value typing, expectation derivation (profile gating), secret redaction, the
+SSH/local exec wrapper, JSON parsing, and matrix axis coverage. It runs in CI on every PR (the
+`shell` job) and via `make test-integration-selftest`, so the harness itself is held to the
+same lint/test standard as the rest of the stack.
 
 ---
 
 ## Release gate (#44)
 
-The live matrix is the **required, blocking pre-release gate**: a release is not promoted or
+The live matrix is the required, blocking pre-release gate: a release is not promoted or
 published unless it's green against the real Monero + Tari nodes. It's surfaced as `make
-test-integration` and wired into the `make release` pipeline's test gate — see
+test-integration` and wired into the `make release` pipeline's test gate. See
 [Releasing › Pre-release gate](releasing.md#pre-release-gate-54). The version tagged/published
 is the exact bundle this run validated.
diff --git a/docs/operations.md b/docs/operations.md
index c393417d..b8232ba0 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -1,24 +1,23 @@
 # Operations & Maintenance
 
-Everything you do to the stack runs through `pithead`. Run `./pithead help` at any time to see
-the full list.
+Everything you do to the stack runs through `pithead`. Run `./pithead help` to see the full list.
 
 ## Command reference
 
 | Command | Description |
 |---|---|
 | `./pithead setup` | First-time setup (interactive): dependency check, config, Tor provisioning, kernel optimization, and start. `--skip-optimize` skips kernel/GRUB tuning; `--skip-deps` skips the dependency check/install. |
-| `./pithead apply` | Preview and apply `config.json` changes — warns before disruptive ones and recreates only what changed. `-y` / `--yes` skips the prompt. |
+| `./pithead apply` | Preview and apply `config.json` changes. Warns before disruptive ones and recreates only what changed. `-y` / `--yes` skips the prompt. |
 | `./pithead up` | Start the stack. |
 | `./pithead down` | Stop the stack. |
 | `./pithead restart` | Restart the stack. |
 | `./pithead upgrade` | Re-render the generated config, then **pull** (release bundle) or **rebuild** (source checkout) the images and restart. Run after downloading a newer bundle or a `git pull`. |
 | `./pithead logs [service]` | Follow logs for all containers, or a single service (e.g. `logs p2pool`). |
-| `./pithead status` | Show container status **and health-check every expected service** — warns about anything down/unhealthy and exits non-zero if so (handy for cron/monitoring). Profile-aware, and treats a stopped `p2pool`/`xmrig-proxy` as intentional during a node-down failover or while the miner is held until the chains sync. |
-| `./pithead doctor` | Read-only diagnostics: deps, Docker, AVX2, HugePages, RAM/disk, `.env`/onion state, and container status — a paste-able health report. |
+| `./pithead status` | Show container status and health-check every expected service. Warns about anything down/unhealthy and exits non-zero if so (handy for cron/monitoring). Profile-aware, and treats a stopped `p2pool`/`xmrig-proxy` as intentional during a node-down failover or while the miner is held until the chains sync. |
+| `./pithead doctor` | Read-only diagnostics: deps, Docker, AVX2, HugePages, RAM/disk, `.env`/onion state, and container status. A paste-able health report. |
 | `./pithead backup` | Save `config.json`, `.env`, `Caddyfile`, the Tor onion keys, and the dashboard's database (your hashrate history & settings) to a timestamped `tar.gz` under `backups/` (checks free space first; stops a running stack for a clean copy, then restarts it). `--with-chains` also includes the blockchain data; `-y` / `--yes` skips the prompts (low free space and stopping the stack). |
 | `./pithead restore <archive>` | Restore those files from a backup archive (asks before overwriting; fixes Tor key ownership). `-y` / `--yes` skips the prompt. |
-| `./pithead reset-dashboard` | **DESTRUCTIVE** — wipes and recreates the dashboard and P2Pool data. `-y` / `--yes` skips the prompt. |
+| `./pithead reset-dashboard` | **DESTRUCTIVE**. Wipes and recreates the dashboard and P2Pool data. `-y` / `--yes` skips the prompt. |
 | `./pithead help` | Show all commands. |
 
 Service names for `logs` match the containers: `monerod`, `p2pool`, `tari`, `xmrig-proxy`,
@@ -36,12 +35,12 @@ Service names for `logs` match the containers: `monerod`, `p2pool`, `tari`, `xmr
 ./pithead logs p2pool          # one service
 ```
 
-`status` prints the usual compose table, then a per-service health check — a green ✓ for each
+`status` prints the usual compose table, then a per-service health check: a green ✓ for each
 running (and healthy) service, and a ⚠/✗ for anything unhealthy, restarting, stopped, or missing.
 It exits non-zero when something needs attention, so you can wire it into a cron/monitoring check.
-A stopped `p2pool`/`xmrig-proxy` is reported as **intentional**, not an error: the dashboard stops
-it either to fail workers over a node-down outage or while the miner is held until the required
-chains finish their initial sync — check the dashboard to see which.
+A stopped `p2pool`/`xmrig-proxy` is reported as intentional, not an error: the dashboard stops it
+either to fail workers over a node-down outage or while the miner is held until the required chains
+finish their initial sync. Check the dashboard to see which.
 
 **Start / stop / restart:**
 
@@ -54,9 +53,9 @@ chains finish their initial sync — check the dashboard to see which.
 **Change a setting:** edit `config.json`, then `./pithead apply`. See
 [Configuration › Changing settings later](configuration.md#changing-settings-later).
 
-**Reboot resilience:** every service runs with `restart: unless-stopped`, so the whole stack
-comes back **on its own after a reboot or power loss** — *provided the Docker daemon itself starts
-at boot*. On Ubuntu's packaged Docker that's the default, but a custom/rootless install (or
+**Reboot resilience:** every service runs with `restart: unless-stopped`, so the whole stack comes
+back on its own after a reboot or power loss, *provided the Docker daemon itself starts at boot*.
+On Ubuntu's packaged Docker that's the default, but a custom/rootless install (or
 `setup --skip-deps`) may leave it disabled. `./pithead doctor` checks this and warns if Docker
 isn't boot-enabled; the fix is `sudo systemctl enable --now docker`.
 
@@ -67,14 +66,14 @@ isn't boot-enabled; the fix is `sudo systemctl enable --now docker`.
 How you update depends on how you installed (see [Getting Started](getting-started.md#2-get-the-code)).
 
 **Release bundle (the default):** from your install directory, re-download the latest bundle over it,
-then upgrade — `upgrade` **pulls** the new published images:
+then upgrade. `upgrade` **pulls** the new published images:
 
 ```bash
 curl -fsSL https://github.com/p2pool-starter-stack/pithead/releases/latest/download/pithead.tar.gz | tar xz --strip-components=1
 ./pithead upgrade
 ```
 
-**Source checkout:** pull the latest code, then upgrade — `upgrade` **rebuilds** the images locally:
+**Source checkout:** pull the latest code, then upgrade. `upgrade` **rebuilds** the images locally:
 
 ```bash
 git pull
@@ -82,14 +81,14 @@ git pull
 ```
 
 Either way, `upgrade` re-renders the generated config (`.env`, the Caddyfile, and the Tari config) for
-the new release *before* pulling/rebuilding — so a release that changes a config template or adds an
+the new release *before* pulling/rebuilding, so a release that changes a config template or adds an
 `.env` var takes effect, not just the new image. Your data directories and `config.json` are untouched,
 so your blockchain sync and settings are preserved across upgrades.
 
 ### Switching a source checkout to release images
 
 If you cloned the repo (so the dashboard badge reads `dev · branch @ commit`) and would rather run the
-**published, tested images** — a clean version badge, a working update-checker, and no local build —
+**published, tested images** (a clean version badge, a working update-checker, and no local build),
 convert the install in place. Your `config.json`, `.env`, Tor onion keys, and data directories are all
 preserved:
 
@@ -101,8 +100,8 @@ rm -f build/*/Dockerfile     # remove the image Dockerfiles → pithead switches
 ./pithead upgrade            # re-render config, pull :vX.Y.Z, recreate
 ```
 
-`pithead` chooses build-vs-pull by whether the image Dockerfiles are present (`build/<svc>/Dockerfile`) —
-deleting them is what flips it from building `:dev` locally to pulling the published `:vX.Y.Z`. To go
+`pithead` chooses build-vs-pull by whether the image Dockerfiles are present (`build/<svc>/Dockerfile`).
+Deleting them is what flips it from building `:dev` locally to pulling the published `:vX.Y.Z`. To go
 back to building from source, `git checkout vX.Y.Z` (or `git pull`) restores the Dockerfiles, then
 `./pithead upgrade` rebuilds locally again. The new validation in `upgrade` will refuse to start on a
 non-primary Monero payout address, so confirm yours is a `4…`/95-char address first (see
@@ -110,7 +109,7 @@ non-primary Monero payout address, so confirm yours is a `4…`/95-char address
 
 > **Moving the install?** Data directories are stored as absolute paths in `.env`, so relocating or
 > copying the stack to a different path (or running a second checkout) points it at a *different,
-> empty* `data/` — a full re-sync, and the dashboard history is orphaned. If you move the install,
+> empty* `data/`: a full re-sync, and the dashboard history is orphaned. If you move the install,
 > move its `data/` with it, or set absolute `data_dir` paths in `config.json` and run `./pithead
 > apply`. `pithead up` and `pithead doctor` now warn when a data directory named in `.env` is missing.
 
@@ -119,15 +118,15 @@ non-primary Monero payout address, so confirm yours is a `4…`/95-char address
 ## Backups
 
 Your important state lives in the data directories (by default under `./data/`, or wherever you
-pointed each `*.data_dir` — see [Configuration › Data directories](configuration.md#data-directories)):
+pointed each `*.data_dir`; see [Configuration › Data directories](configuration.md#data-directories)):
 
-- **`config.json`** — your settings (keep a copy somewhere safe; it's `chmod 600`).
-- **`data/tor/`** — your **onion service keys**. Back these up if you want to keep the same onion
+- **`config.json`**: your settings (keep a copy somewhere safe; it's `chmod 600`).
+- **`data/tor/`**: your onion service keys. Back these up if you want to keep the same onion
   addresses across a rebuild.
-- **`data/monero/`**, **`data/tari/`** — the blockchains. Large, but backing them up saves a
+- **`data/monero/`**, **`data/tari/`**: the blockchains. Large, but backing them up saves a
   re-sync; they can also be re-downloaded from the network if lost.
-- **`data/dashboard/`** — the dashboard's database: your **hashrate history and settings**.
-  Small but irreplaceable (it doesn't re-sync), so it's part of the default `backup`.
+- **`data/dashboard/`**: the dashboard's database, your hashrate history and settings. Small but
+  irreplaceable (it doesn't re-sync), so it's part of the default `backup`.
 
 Stop the stack (`./pithead down`) before copying data directories so files are in a consistent
 state.
@@ -140,14 +139,13 @@ Rather than copying files by hand, let `pithead` do it for you:
 ./pithead backup
 ```
 
-That's it. This saves the things you can't get back — your `config.json`, your secrets
-(`.env`), your `Caddyfile` (if you have one), the **Tor onion address keys**, and the
-**dashboard's database** (your hashrate history and settings) — into a small, timestamped file
-under `backups/`.
-It's quick and small because your blockchains are **not** included (they just re-sync). The
-archive is locked down to `chmod 600`, and `pithead` prints its path when it's done. Before it
-writes anything, it checks there's room — if free space looks tight, it asks before going ahead
-so a backup can't quietly fill your disk.
+That's it. This saves the things you can't get back: your `config.json`, your secrets (`.env`),
+your `Caddyfile` (if you have one), the Tor onion address keys, and the dashboard's database (your
+hashrate history and settings), into a small, timestamped file under `backups/`.
+It's quick and small because your blockchains are **not** included (they just re-sync). The archive
+is locked down to `chmod 600`, and `pithead` prints its path when it's done. Before it writes
+anything, it checks there's room; if free space looks tight, it asks before going ahead so a backup
+can't quietly fill your disk.
 
 If the stack is running, `backup` offers to briefly stop it for a clean copy and start it again
 when it's done. Pass `-y` / `--yes` to skip the prompts (the low-space warning and the
@@ -159,7 +157,7 @@ stop-the-stack question) and just back up.
 ./pithead backup --with-chains   # also include the blockchain data — much bigger and slower
 ```
 
-To recover — on a new machine, or after a wipe — copy the archive back and run:
+To recover (on a new machine, or after a wipe) copy the archive back and run:
 
 ```bash
 ./pithead down                       # stop the stack first so files restore cleanly
@@ -169,11 +167,11 @@ To recover — on a new machine, or after a wipe — copy the archive back and r
 
 `restore` always **asks before it overwrites anything**, so you can change your mind (pass
 `-y` / `--yes` to skip that prompt). It puts the files back where they belong and sorts out the
-Tor key ownership for you, so your onion address comes back exactly as it was — and your
-hashrate history and dashboard settings come back too.
+Tor key ownership for you, so your onion address comes back exactly as it was, and your hashrate
+history and dashboard settings come back too.
 
 > **Note:** After a restore, the dashboard's HTTPS certificate is regenerated, so your browser
-> may show its "not trusted" warning once — that's expected; accept it as you did on first setup.
+> may show its "not trusted" warning once. That's expected; accept it as you did on first setup.
 
 ---
 
@@ -189,18 +187,18 @@ This usually just means a chain is still downloading. Confirm steady progress:
 
 If a node looks genuinely stalled (no new blocks over a long period), restart it with
 `./pithead restart`. To avoid the wait entirely, point the stack at an existing synced
-blockchain or a remote node — see
+blockchain or a remote node. See
 [Configuration › Reusing an existing node](configuration.md#reusing-an-existing-node).
 
 **Tari shows high memory use.**
-Usually nothing to worry about — most of it is reclaimable disk cache, not a leak. Tari has an
+Usually nothing to worry about; most of it is reclaimable disk cache, not a leak. Tari has an
 auto-sized memory limit (`tari.mem_limit`) that keeps a genuine runaway from affecting the rest of
 the stack. Only change it if Tari restarts repeatedly (give it more) or you want to free RAM for
 other apps (give it less), then run `./pithead apply`.
 
 **Browser warns "your connection is not private."**
-Expected with `dashboard.secure: true` — Caddy uses a self-signed certificate. Accept the
-warning once. To use plain HTTP, set `dashboard.secure: false` and run `./pithead apply`.
+Expected with `dashboard.secure: true`: Caddy uses a self-signed certificate. Accept the warning
+once. To use plain HTTP, set `dashboard.secure: false` and run `./pithead apply`.
 
 **Workers don't show up in the dashboard.**
 Check that each rig points at `YOUR_STACK_IP:3333` and that port `3333` is reachable from the
@@ -211,8 +209,8 @@ Give it a minute after a worker connects for stats to populate. Confirm the work
 hashing (`./pithead logs xmrig-proxy`).
 
 **P2Pool can't connect to a remote node.**
-The node must be set up for mining — **ZMQ publishing enabled** (`zmq-pub`) and its RPC reachable
-by P2Pool. Public "open node" endpoints don't qualify — use a node you run and control. See
+The node must be set up for mining: **ZMQ publishing enabled** (`zmq-pub`) and its RPC reachable
+by P2Pool. Public "open node" endpoints don't qualify; use a node you run and control. See
 [Configuration › Connecting to a remote Monero node](configuration.md#connecting-to-a-remote-monero-node).
 
 **HugePages shows as disabled / low.**
@@ -221,14 +219,14 @@ Persistent HugePages require a GRUB change and a **reboot**. Re-run `./pithead s
 
 **Something looks broken in the dashboard data and you want a clean slate.**
 `./pithead reset-dashboard` wipes and recreates the dashboard and P2Pool data. This is
-**destructive** — you'll lose P2Pool sidechain state and dashboard history (your blockchains and
+**destructive**: you'll lose P2Pool sidechain state and dashboard history (your blockchains and
 wallets are unaffected). Pass `-y` / `--yes` to skip the confirmation prompt.
 
 ---
 
 ## For developers
 
-- **Run the test suites locally** (mirrors CI): `make test` — or individually `make
+- **Run the test suites locally** (mirrors CI): `make test`, or individually `make
   test-dashboard`, `make test-stack`, `make test-compose`, `make lint`.
-- **Dashboard development** — see [`build/dashboard/README.md`](../build/dashboard/README.md) for
+- **Dashboard development**: see [`build/dashboard/README.md`](../build/dashboard/README.md) for
   the package layout, local dev setup, and the hermetic test suite.
diff --git a/docs/privacy.md b/docs/privacy.md
index 9814eba3..7acde66c 100644
--- a/docs/privacy.md
+++ b/docs/privacy.md
@@ -1,38 +1,55 @@
 # Privacy & network egress
 
-This is the single source of truth for **every connection the stack makes off your box** — where it
-goes, whether it's routed over Tor, whether it's on by default, and how to lock it down.
+This doc lists every connection the stack makes off your box: where it goes, whether it's routed
+over Tor, whether it's on by default, and how to lock it down.
 
-**North-star:** nothing should leave the host to the internet except through Tor. Where that isn't
-possible (or trades away yield), the connection must be **off or Tor-routed by default**, have a
-**documented toggle**, and be **listed here**.
+The rule: nothing should leave the host to the internet except through Tor. Where that isn't
+possible (or trades away yield), the connection must be off or Tor-routed by default, have a
+documented toggle, and be listed here.
 
-Honesty first: the stack is **Tor-first, not yet Tor-only**. Monero and Tari — including the DNS
-lookups they used to leak — are fully Tor-routed. But as of v1.0 **two outbound yield paths still
-use clearnet** (P2Pool's outbound peers and XvB donation mining), and **install/build reveals your
-IP once**. Those are called out below with how to mitigate each today, and both clearnet yield paths
-are slated to move to Tor-by-default (with an opt-out) in v1.1.
+As of v1.1 the stack is Tor-by-default for all runtime egress. Monero and Tari (including the DNS
+lookups they used to leak), P2Pool's outbound sidechain peers (#165), and XvB donation mining (#166)
+are all Tor-routed by default, each with a documented opt-out for operators who trade privacy for
+yield. What's left is inherent: the one-time install/build reveals your IP to the download host, and
+remote-node mode (`monero.mode: remote`, off by default) talks to the node you choose. Both are
+called out below.
 
-There is also one **opt-in** that deliberately moves a node onto clearnet: an
+One opt-in deliberately moves a node onto clearnet: an
 [optional clearnet initial sync](#optional-clearnet-initial-sync-off-by-default) that lets Monero
-and/or Tari download their chains over clearnet (much faster than over Tor) for the **one-time
-initial sync**, then return to Tor. It is **off by default**, loudly warned, and covered in full
-below.
+and/or Tari download their chains over clearnet (much faster than over Tor) for the one-time initial
+sync, then returns to Tor. It is off by default, loudly warned, and covered in full below.
+
+---
+
+## Enforced fail-closed, not just configured (#270)
+
+Every per-app Tor setting below is backed by a host firewall, so "behind Tor" is a property the
+stack enforces, not one it merely hopes each daemon is configured for. At `up`/`apply`, `pithead`
+installs rules in Docker's `DOCKER-USER` chain: the mining bridge (monerod, p2pool, tari,
+xmrig-proxy) may reach the LAN, the other containers, and the Tor SOCKS, but any direct dial to the
+public internet is DROPPED. Only the `tor` container reaches the internet. So if a daemon is
+misconfigured, buggy, or learns a clearnet peer address (as Tari's comms layer does), the connection
+fails closed instead of leaking your IP.
+
+- Needs root (the firewall rules), like the GRUB/HugePages steps; removed at `pithead down`.
+- Opt out with `network.tor_egress_firewall: false` (then routing falls back to per-app config only).
+- The host-networked dashboard and caddy aren't on the bridge; the dashboard's only external calls
+  already go over the Tor SOCKS (`socks5h`, [#163](#runtime-egress)/#224).
+- Verify it live with [`tests/integration/benchmarks/bench-verify-egress.sh`](../tests/integration/benchmarks/bench-verify-egress.sh); it confirms 0 app-container public connections.
 
 ---
 
 ## Inbound — no port forwarding
 
-**Your home IP is never advertised to a single inbound peer, and you never touch your router's
-port-forward settings.** Every service that accepts inbound connections does so through a **Tor
-hidden service (onion address)**: monerod, Tari, and P2Pool each get one from the built-in Tor
-daemon. So:
+Your home IP is never advertised to an inbound peer, and you never touch your router's port-forward
+settings. Every service that accepts inbound connections does so through a Tor hidden service (onion
+address): monerod, Tari, and P2Pool each get one from the built-in Tor daemon. So:
 
-- **No public IPv4 port forwarding is required**, and your IP is not advertised to inbound peers.
-- The **only** LAN-facing port is the stratum endpoint **`:3333`** that your own rigs connect to. It
-  is plain stratum — **unauthenticated by default** — and must never face the internet:
-  `pithead setup`/`doctor` warn if your host has a public IP. Lock it down with `p2pool.stratum_bind`,
-  a firewall, and/or an optional `p2pool.stratum_password` that requires each rig to authenticate.
+- No public IPv4 port forwarding is required, and your IP is not advertised to inbound peers.
+- The only LAN-facing port is the stratum endpoint `:3333` that your own rigs connect to. It is
+  plain stratum, unauthenticated by default, and must never face the internet: `pithead
+  setup`/`doctor` warn if your host has a public IP. Lock it down with `p2pool.stratum_bind`, a
+  firewall, and/or an optional `p2pool.stratum_password` that requires each rig to authenticate.
   See [Connecting miners › Firewall](workers.md#firewall) and [Authentication](workers.md#authentication).
 
 ---
@@ -49,25 +66,26 @@ What the running stack sends to the internet, connection by connection.
 | **Tari** P2P | Tari network | — | ✅ Tor (`type = "tor"`) | on | Tor by default; can opt into clearnet (TCP) for the initial sync only ([#183](#optional-clearnet-initial-sync-off-by-default)) |
 | **Tari** DNS seeds + Pulse (`seeds.tari.com`, `checkpoints.tari.com`) | DNS resolvers | "this IP runs Tari" | ✅ **closed** — `dns_seeds = []`, onion `peer_seeds`, resolver pointed at a dead address (#162) | n/a | clearnet sync ([#183](#optional-clearnet-initial-sync-off-by-default)) re-enables the `seeds.tari.com` DNS seed for the sync window |
 | **P2Pool** inbound peers | reach you via onion | — | ✅ onion hidden service | on | — |
-| **P2Pool** outbound sidechain peers | clearnet P2Pool peers | **your real home IP** | ❌ **clearnet** | **on** | ⏳ Tor-by-default in v1.1 (#165). Harden now → [below](#hardening-the-clearnet-paths) |
+| **P2Pool** outbound sidechain peers | P2Pool sidechain peers, via Tor | — | ✅ **Tor** (`--socks5`, proxy-type `tor`) by default (#165) | on | opt out with `p2pool.clearnet: true` (exposes your IP for max yield) → [below](#p2pool-outbound-peers-165---tor-by-default) |
 | Dashboard **XvB stats** fetch | `xmrvsbeast.com` | your Monero **wallet** (no longer your IP) | ✅ Tor (`socks5h`, #163) | on, only if XvB enabled | `XVB_ENABLED=false` stops it |
-| **XvB donation mining** (only while donating) | `na.xmrvsbeast.com:4247` | **your real home IP** | ❌ **clearnet** | on while donating | ⏳ Tor-by-default in v1.1 (#166). Disable XvB to stop it |
+| Dashboard **XvB raffle registration** (#263) | `xmrvsbeast.com` | your Monero **wallet** (no longer your IP) | ✅ Tor (`socks5h`, same path as the stats fetch) | on, only if XvB enabled; fires once you have a PPLNS share | `XVB_ENABLED=false`, or set `XVB_SUBMIT_URL` to a disable sentinel (`off`), to stop it |
+| **XvB donation mining** (only while donating) | `na.xmrvsbeast.com:4247` via Tor | — | ✅ **Tor** (per-pool `socks5`, DNS proxy-side) by default (#166) | on while donating | opt out with `xvb.tor: false` (exposes IP for max yield); `xvb.enabled: false` stops it entirely |
 | Dashboard **update check** (#224) | `api.github.com` | nothing about you — GitHub sees a **Tor exit**, not your IP | ✅ Tor (`socks5h`) | **on** | `dashboard.check_for_updates: false` to opt out; cached, fails silently offline |
 | **Caddy** TLS (dashboard HTTPS) | local only | — | n/a — `tls internal`, **no ACME / no external CA** | on | clean (no egress) |
 | **Telegram** alerts (#121) | Telegram API | your IP | ❌ | **off** | opt-in only |
 | **Healthchecks** pings (#79) | external | your IP | ❌ | **off** | opt-in only |
 
-`socks5h` (used for the XvB stats fetch) routes **DNS resolution through Tor too**, so the hostname
-isn't resolved on the clearnet either. The host-networked dashboard reaches the bridge's Tor SOCKS
-at `172.28.0.25:9050`.
+`socks5h` (used for the XvB stats fetch) routes DNS resolution through Tor too, so the hostname isn't
+resolved on the clearnet either. The host-networked dashboard reaches the bridge's Tor SOCKS at
+`172.28.0.25:9050`.
 
 ---
 
 ## Build / setup-time egress
 
-These run **once**, at install or `pithead apply`, and inherently reveal your IP to the host you
-download from. They cannot be Tor-routed transparently, but they are **integrity-pinned** so a
-network attacker can't substitute what you receive.
+These run once, at install or `pithead apply`, and inherently reveal your IP to the host you
+download from. They cannot be Tor-routed transparently, but they are integrity-pinned so a network
+attacker can't substitute what you receive.
 
 | What | Destination | When |
 |---|---|---|
@@ -75,65 +93,74 @@ network attacker can't substitute what you receive.
 | Component binaries (monerod / p2pool / xmrig-proxy) | `downloads.getmonero.org`, `github.com` | **image build only** — verified against a published **SHA256** / checksum. A release install *pulls* prebuilt images instead, so it never runs these. |
 | Container images | **`ghcr.io`** (the `pithead-*` images, #44), `quay.io` (Tari), Docker Hub (caddy, socket-proxy) | image **pull** on a release install / `pithead upgrade`, or build from source. All pinned by **`@sha256:` digest** (#135). |
 
-**Mitigation:** run the install/build behind a **VPN** or with `torsocks`, or pre-pull the images and
-clone on another machine and copy them over. The downloads are pinned (SHA256 + image digests), so
-the risk is the **one-time IP disclosure**, not tampering.
+Mitigation: run the install/build behind a VPN or with `torsocks`, or pre-pull the images and clone
+on another machine and copy them over. The downloads are pinned (SHA256 + image digests), so the
+risk is the one-time IP disclosure, not tampering.
 
 ---
 
-## Hardening the clearnet paths
-
-Two outbound yield paths use clearnet in v1.0. Here's how to close each one **today**; v1.1 will make
-the Tor routing the default.
-
-### P2Pool outbound peers (#165)
-
-P2Pool advertises its onion for *inbound* peers but dials *outbound* sidechain peers over clearnet,
-exposing your IP to the P2Pool network. **v1.0 has no config knob for this yet** (a Tor-by-default
-toggle is tracked in #165); to route those dials through Tor today, hand-edit P2Pool's `command:` in
-`docker-compose.yml`, adding the SOCKS flags just before `${P2POOL_FLAGS}`:
-
-```yaml
-# docker-compose.yml — the p2pool service `command:`
-      - --socks5
-      - 172.28.0.25:9050
-      - --socks5-proxy-type
-      - tor
-      # add '--no-clearnet-p2p' (its own line) to refuse clearnet peers entirely (onion-only)
-      - ${P2POOL_FLAGS}
-```
-
-Then `docker compose up -d p2pool`. **Trade-off:** Tor adds latency to share propagation, which can
-raise your orphan/uncle rate (most noticeable on mini/nano), and `--no-clearnet-p2p` shrinks your
-peer set to onion-only. Measure the effect on your earnings before keeping it — which is exactly why
-the Tor-by-default flip is a benchmarked **v1.1** change (#165), not a v1.0 default. (This hand-edit
-lives in `docker-compose.yml`, so re-apply it after a stack update until #165 lands.)
-
-### XvB donation mining (#166)
-
-When the optimizer donates to XMRvsBeast (XvB), it points the proxy at `na.xmrvsbeast.com:4247`
-over clearnet, exposing your IP to XvB. Pool stratum over Tor is high-latency and hurts share
-acceptance, so there's no clean Tor fix yet. To stop the egress entirely, **disable XvB**:
-
-```jsonc
-// config.json
-"xvb": { "enabled": false }
-```
-
-This also stops the (already Tor-routed) stats fetch. v1.1 adds an `xvb.tor` opt-in to route donation
-mining through Tor and pins `--donate-level 0`.
+## The Tor-by-default yield paths (and their opt-outs)
+
+As of v1.1 both former clearnet yield paths, P2Pool outbound peers (#165) and XvB donation mining
+(#166), route over Tor by default. Each has an opt-out for operators who'd trade the IP exposure for
+maximum yield (Tor latency can raise stale/uncle shares and rejects). The two sections below document
+the routing and how to opt out.
+
+What Tor costs you (measured): a 5-day interleaved benchmark on `mini` (#256, full
+[methodology + data](benchmarks/tor-vs-clearnet.md)) puts the price of routing P2Pool over Tor at
+roughly 10 % of mining yield (−11 % reward share / yield-efficiency vs clearnet, just above the run's
+noise floor). The cause is pure share-propagation latency: there were zero extra rejected shares and
+no measurable Tor CPU overhead. The loss is shares arriving late enough to land as uncles. We keep
+Tor the default anyway, because not leaking your home IP to the P2Pool network is the point and ~10 %
+is a modest, opt-out-able price. The cost is largest on the smaller/faster sidechains (where your
+share of the chain is biggest) and negligible on `main`.
+
+### P2Pool outbound peers (#165) — ✅ Tor by default
+
+P2Pool advertises its onion for inbound peers but, without a SOCKS proxy, would dial outbound
+sidechain peers over clearnet, exposing your IP to the P2Pool network. As of v1.1 `pithead` injects
+`--socks5 <tor-ip>:9050 --socks5-proxy-type tor` into P2Pool's `command:` by default, so outbound
+dials go through Tor. No action needed.
+
+Opt out for maximum yield (lower stale/uncle rate plus a larger peer set, at the cost of exposing
+your IP, worse on `--mini`/`--nano`): set `p2pool.clearnet: true` in `config.json` and re-run
+`pithead apply`. For the strictest posture, refuse clearnet peers entirely (onion-only): P2Pool also
+has a `--no-clearnet-p2p` flag, not yet wired to its own config knob.
+
+Trade-off (measured): Tor adds latency to share propagation, costing ~10 % of yield on `mini` (#256,
+the loss is uncles/late shares, not rejects; see the box above), and `--no-clearnet-p2p` shrinks your
+peer set to onion-only. The Tor-by-default flip was gated on that benchmark, which is why it's a v1.1
+change (#165), not a v1.0 default. NOTE: the `p2pool.clearnet: true` opt-out only began working once #294
+fixed a config bug that had silently pinned the egress firewall on; on a current build it takes
+effect after `pithead apply`.
+
+### XvB donation mining (#166) — ✅ Tor by default
+
+When the optimizer donates to XMRvsBeast (XvB), it points the proxy at `na.xmrvsbeast.com:4247`. As
+of v1.1 that connection routes through Tor by default: `algo_service` sets a per-pool `socks5` on the
+XvB pool object it pushes to xmrig-proxy (the pool's DNS is resolved proxy-side, like the stats fetch
+in #163), so donation mining no longer exposes your home IP. No action needed.
+
+Opt out for maximum yield (stratum-over-Tor adds latency that can raise rejected shares, scaling with
+hashrate): set `xvb.tor: false` and re-run `pithead apply`; the donation connection then dials
+direct. To stop the egress entirely instead, disable XvB (`"xvb": { "enabled": false }`), which also
+stops the (already Tor-routed, #163) stats fetch.
+
+> NOTE: the xmrig-proxy dev-fee `--donate-level` is pinned to `0` by default (`proxy.donate_level`,
+> rendered explicitly per #173) and does not ride the XvB pool's `socks5`, so if you set it above 0,
+> that dev-fee traffic goes clearnet. Keep it at `0` for a fully Tor runtime.
 
 ---
 
 ## Optional clearnet initial sync (off by default)
 
-Routing **everything** over Tor is correct for ongoing operation, but it makes the **one-time initial
-blockchain sync** (IBD) painfully slow: Tor circuits are bandwidth-capped and flaky, so a full Monero
+Routing everything over Tor is correct for ongoing operation, but it makes the one-time initial
+blockchain sync (IBD) painfully slow: Tor circuits are bandwidth-capped and flaky, so a full Monero
 sync can crawl at near-zero blocks/sec and stall for long stretches, and Tari's large chain is no
-better. The standard pattern for Tor-based nodes is to **sync once over clearnet (fast), then lock
-back to Tor.** This stack supports that as an explicit, default-off opt-in (#183).
+better. The standard pattern for Tor-based nodes is to sync once over clearnet (fast), then lock back
+to Tor. This stack supports that as an explicit, default-off opt-in (#183).
 
-**Per-component flags in `config.json`, both `false` by default:**
+Per-component flags in `config.json`, both `false` by default:
 
 ```jsonc
 "monero": { "clearnet_initial_sync": false },
@@ -154,88 +181,88 @@ you can enable either, both, or neither.
 
 ### The privacy trade-off (threat model)
 
-**What is exposed while a flag is on:** your host's **IP address**, to the P2P network of the enabled
-chain — i.e. "this IP is running a Monero/Tari node." A few **DNS lookups** also happen over clearnet
-during the window: for Monero, the two P2Pool-recommended priority-node hostnames
-(`p2pmd.xmrvsbeast.com`, `nodes.hashvault.pro`); for Tari, `seeds.tari.com` (to the configured
-resolvers `1.1.1.1` / `8.8.8.8` / `9.9.9.9`) to discover clearnet peers. This is the same exposure as
-any ordinary clearnet node — which is exactly what this window temporarily is.
+What is exposed while a flag is on: your host's IP address, to the P2P network of the enabled chain,
+i.e. "this IP is running a Monero/Tari node." A few DNS lookups also happen over clearnet during the
+window: for Monero, the two P2Pool-recommended priority-node hostnames (`p2pmd.xmrvsbeast.com`,
+`nodes.hashvault.pro`); for Tari, `seeds.tari.com` (to the configured resolvers `1.1.1.1` /
+`8.8.8.8` / `9.9.9.9`) to discover clearnet peers. This is the same exposure as any ordinary clearnet
+node, which is exactly what this window temporarily is.
 
-**What is *not* exposed:**
+What is *not* exposed:
 
-- **Your wallet addresses / payouts** — there is no wallet activity during a sync.
-- **Monero transaction origin** — `tx-proxy=tor` is left in place, so any tx broadcast still goes over
+- Your wallet addresses / payouts: there is no wallet activity during a sync.
+- Monero transaction origin: `tx-proxy=tor` is left in place, so any tx broadcast still goes over
   Tor. (And there's no broadcasting during IBD anyway.)
-- Nothing about *what* you mine — only that an IP runs a node.
+- Nothing about *what* you mine, only that an IP runs a node.
 
 That's the same exposure as running any ordinary (non-Tor) full node, scoped to the sync window. For
-a privacy-first deployment it's still a real disclosure, which is why it is **off by default** and
-must be **explicitly opted into**.
+a privacy-first deployment it's still a real disclosure, which is why it is off by default and must
+be explicitly opted into.
 
 ### It switches back to Tor automatically (#234)
 
-You don't have to babysit it. The dashboard already tracks each chain's sync state; the **first time
-a clearnet node reports fully synced, it switches that node back to Tor for you** — it writes a
-persistent "sync complete" marker and restarts the daemon, which comes back up Tor-only. From then
-on the node stays on Tor across restarts, `apply`, and reboots (the marker, not the flag, is the
-source of truth — so a restart can never silently re-expose a synced node). Monero and Tari transition
-independently, each as soon as *it* finishes.
+You don't have to babysit it. The dashboard already tracks each chain's sync state; the first time a
+clearnet node reports fully synced, it switches that node back to Tor for you. It writes a persistent
+"sync complete" marker and restarts the daemon, which comes back up Tor-only. From then on the node
+stays on Tor across restarts, `apply`, and reboots (the marker, not the flag, is the source of truth,
+so a restart can never silently re-expose a synced node). Monero and Tari transition independently,
+each as soon as *it* finishes.
 
 You can leave `clearnet_initial_sync: true` in `config.json`; it's effectively spent once the sync
-completes. (To deliberately re-sync over clearnet later — e.g. after wiping a chain — toggle the flag
+completes. (To deliberately re-sync over clearnet later, e.g. after wiping a chain, toggle the flag
 off and on again with `./pithead apply`, which re-arms it.)
 
 ### It is loud and always-visible
 
 You can't enable this by accident or miss that it's active:
 
-- **`./pithead apply`** prints a `⚠`-flagged, disruptive-change confirmation describing exactly what
+- `./pithead apply` prints a `⚠`-flagged, disruptive-change confirmation describing exactly what
   becomes exposed before it recreates the daemon.
-- **`./pithead status`** and **`./pithead up`** print a prominent **"CLEARNET INITIAL SYNC ACTIVE —
-  node IP exposed"** banner the whole time a node is actually on clearnet — and it **clears by itself**
-  once the auto-transition completes.
-- **`./pithead doctor`** raises a `⚠ WARN` while a node is exposed and flips back to a green
+- `./pithead status` and `./pithead up` print a prominent **"CLEARNET INITIAL SYNC ACTIVE — node IP
+  exposed"** banner the whole time a node is actually on clearnet, and it clears by itself once the
+  auto-transition completes.
+- `./pithead doctor` raises a `⚠ WARN` while a node is exposed and flips back to a green
   `✓ OK "all node P2P is Tor-only"` once it's switched back.
-- The **dashboard** shows the clearnet state live, and the **daemon container logs** a matching
-  warning on every start until the transition completes.
+- The dashboard shows the clearnet state live, and the daemon container logs a matching warning on
+  every start until the transition completes.
 
 If the automatic switch ever fails (e.g. the dashboard couldn't restart the container), it is
-**fail-safe**: the marker is written before the restart, so any later restart still comes up Tor-only,
-and the supervisor keeps retrying — a node is never silently stranded on clearnet. The banners and
+fail-safe: the marker is written before the restart, so any later restart still comes up Tor-only,
+and the supervisor keeps retrying. A node is never silently stranded on clearnet. The banners and
 `doctor` warning stay up until it's genuinely back on Tor.
 
 ---
 
 ## Local trust boundary & known limitations
 
-Everything above is about **network** egress — what leaves the host. On the **host itself**, the
-stack assumes the local machine and the private Docker bridge are trusted, which is the right model
-for a single-purpose appliance. One consequence is worth recording explicitly:
+Everything above is about network egress, what leaves the host. On the host itself, the stack assumes
+the local machine and the private Docker bridge are trusted, which is the right model for a
+single-purpose appliance. One consequence is worth recording explicitly:
 
 - **The monerod RPC credential appears in the p2pool container's process arguments (#57).** p2pool
-  accepts the monerod RPC login (`--rpc-login`) **only** as a command-line argument — it has no
-  environment-variable or config-file equivalent — so the username/password are visible in the
-  p2pool process's argv to any local process that can read it (`ps`, `/proc/<pid>/cmdline`). This is
-  **local-only** (never remotely reachable) and the credential is an **auto-generated random secret**
+  accepts the monerod RPC login (`--rpc-login`) only as a command-line argument; it has no
+  environment-variable or config-file equivalent, so the username/password are visible in the p2pool
+  process's argv to any local process that can read it (`ps`, `/proc/<pid>/cmdline`). This is
+  local-only (never remotely reachable) and the credential is an auto-generated random secret
   guarding a `restricted-rpc` (read-only, public-safe) endpoint that by default is bound to localhost
-  plus the Docker bridge — **not** the LAN (set `monero.rpc_lan_access: true` to expose it, in which
-  case the credential matters more). Moving it off argv isn't possible without removing RPC
-  authentication (a worse trade-off — it's defense-in-depth on the internal path) or an upstream
-  p2pool change, so it's **accepted as a known limitation** rather than fixed. Practical guidance: on
-  a single-user appliance this is a non-issue; if you **co-host** the stack on a machine shared with
-  other local users, treat the monerod RPC credential as visible to them and prefer a single-purpose
-  host for stronger isolation.
+  plus the Docker bridge, not the LAN (set `monero.rpc_lan_access: true` to expose it, in which case
+  the credential matters more). Moving it off argv isn't possible without removing RPC authentication
+  (a worse trade-off, it's defense-in-depth on the internal path) or an upstream p2pool change, so
+  it's accepted as a known limitation rather than fixed. Practical guidance: on a single-user
+  appliance this is a non-issue; if you co-host the stack on a machine shared with other local users,
+  treat the monerod RPC credential as visible to them and prefer a single-purpose host for stronger
+  isolation.
 
 ## Maximum-privacy checklist
 
-- [ ] Keep `:3333` off the public internet — firewall it to your LAN, set `p2pool.stratum_bind`,
+- [ ] Keep `:3333` off the public internet: firewall it to your LAN, set `p2pool.stratum_bind`,
   and/or require a `p2pool.stratum_password` (`pithead doctor` flags public-IP exposure).
 - [ ] Route P2Pool outbound through Tor by editing its compose `command:` (above) if you accept the latency.
 - [ ] Set `xvb.enabled: false` if you don't want any XvB egress.
-- [ ] Leave `monero.clearnet_initial_sync` / `tari.clearnet_initial_sync` **off** (the default) to keep all node P2P on Tor. If you do use a clearnet sync, the dashboard switches each node back to Tor automatically once it's synced — `pithead doctor` flags it while exposed and clears when done.
+- [ ] Leave `monero.clearnet_initial_sync` / `tari.clearnet_initial_sync` off (the default) to keep all node P2P on Tor. If you do use a clearnet sync, the dashboard switches each node back to Tor automatically once it's synced; `pithead doctor` flags it while exposed and clears when done.
 - [ ] Run the initial install/build behind a VPN or `torsocks`.
-- [ ] Leave Telegram (#121) and Healthchecks (#79) **off** unless you accept the inherent IP exposure.
-- [ ] Run `pithead doctor` — it surfaces the public-IP exposure check among its diagnostics.
+- [ ] Leave Telegram (#121) and Healthchecks (#79) off unless you accept the inherent IP exposure.
+- [ ] Run `pithead doctor`; it surfaces the public-IP exposure check among its diagnostics.
 
 ---
 
diff --git a/docs/release-server.md b/docs/release-server.md
index 69c966f5..0445281e 100644
--- a/docs/release-server.md
+++ b/docs/release-server.md
@@ -1,88 +1,88 @@
 # The Release / Validation Server
 
-How we validate a build **end-to-end before release**, why that needs a dedicated server, what
-GitHub Actions does for free on every PR, and how to harden the server so it can't become a
-liability. This is the operational companion to [Releasing](releasing.md) (the version/promote
-pipeline) and [Integration Testing](integration-testing.md) (the harness it runs).
-
-## Can GitHub Actions do the full end-to-end? (short answer: no — and that's fine)
-
-**GitHub-hosted runners can't do the real-chain tier.** On a public repo the hosted Ubuntu
-runners are generous and **free** (4 vCPU / 16 GiB RAM), but they are **ephemeral** — a fresh VM
-per job, ~14 GiB of free disk, and a 6-hour job ceiling. A Monero chain is ~95 GiB pruned /
-~270 GiB full and takes **days** to sync; Tari adds ~50 GiB. There is nowhere to keep that
-synced state between runs, and no time to sync it inside a job. So the **real-daemon, real
-merge-mining tier (tier 4) is simply not possible on hosted runners** — which is the whole
-reason a dedicated, already-synced server exists ([#54](https://github.com/p2pool-starter-stack/pithead/issues/54)).
-
-**But GitHub already runs almost everything else, free, on every PR.** Tiers 1–3 of the
+This page covers how a build is validated end-to-end before release, why that needs a dedicated
+server, what GitHub Actions does for free on every PR, and how to harden the server. It is the
+operational companion to [Releasing](releasing.md) (the version/promote pipeline) and
+[Integration Testing](integration-testing.md) (the harness it runs).
+
+## Can GitHub Actions do the full end-to-end? (no)
+
+GitHub-hosted runners can't do the real-chain tier. On a public repo the hosted Ubuntu runners
+are free (4 vCPU / 16 GiB RAM), but they are ephemeral: a fresh VM per job, ~14 GiB of free
+disk, and a 6-hour job ceiling. A Monero chain is ~95 GiB pruned / ~270 GiB full and takes days
+to sync; Tari adds ~50 GiB. There is nowhere to keep that synced state between runs, and no time
+to sync it inside a job. So the real-daemon, real merge-mining tier (tier 4) is not possible on
+hosted runners. That's the reason a dedicated, already-synced server exists
+([#54](https://github.com/p2pool-starter-stack/pithead/issues/54)).
+
+GitHub already runs almost everything else, free, on every PR. Tiers 1–3 of the
 [testing strategy](testing-strategy.md) need no real chain and run on the hosted runners in
 minutes:
 
-- **Tier 1 — unit/component** (dashboard pytest + coverage gate, frontend, the `pithead` shell
-  suite, compose interpolation **and the #90 security/hardening invariants**).
-- **Tier 2 — contract** (the real Monero/Tari clients vs. controllable fakes).
-- **Tier 3 — the fake-daemon mini-stack** (the **real** dashboard + docker-control proxy driven
-  against fake daemons, with **real Docker** on the hosted runner) — this proves the control
-  plane end-to-end (sync hold/release, reject/readmit) on every PR.
+- Tier 1, unit/component (dashboard pytest + coverage gate, frontend, the `pithead` shell
+  suite, compose interpolation, and the #90 security/hardening invariants).
+- Tier 2, contract (the real Monero/Tari clients vs. controllable fakes).
+- Tier 3, the fake-daemon mini-stack (the real dashboard + docker-control proxy driven against
+  fake daemons, with real Docker on the hosted runner). This proves the control plane
+  end-to-end (sync hold/release, reject/readmit) on every PR.
 
 So the split is clean:
 
 | | Runs | Cost | Triggered |
 |---|---|---|---|
-| **Tiers 1–3** (logic, wiring, control plane, hardening) | GitHub-hosted runners | free (public repo) | **every PR** — the merge gate |
-| **Tier 4** (real synced Monero+Tari, real merge-mining, prune/full DB, TLS/Tor, the config matrix, the staging smoke test) | the **dedicated server** | your hardware | pre-release / on-demand — the **release gate** |
+| **Tiers 1–3** (logic, wiring, control plane, hardening) | GitHub-hosted runners | free (public repo) | every PR, the merge gate |
+| **Tier 4** (real synced Monero+Tari, real merge-mining, prune/full DB, TLS/Tor, the config matrix, the staging smoke test) | the dedicated server | your hardware | pre-release / on-demand, the release gate |
 
-The hosted runners catch the vast majority of regressions before merge; the dedicated server
-proves the things only reality can — and it's the **blocking pre-release gate**.
+The hosted runners catch the vast majority of regressions before merge. The dedicated server
+proves the things only reality can, and it's the blocking pre-release gate.
 
-## Validating PRs on the dedicated server — possible, but security-loaded
+## Validating PRs on the dedicated server (possible, but security-loaded)
 
-You *can* register the server as a GitHub Actions **self-hosted runner** so Actions dispatches
-the tier-4 job to it (self-hosted minutes don't count against anything — also free). But there
-is a sharp edge, and it's the single most important thing on this page:
+You can register the server as a GitHub Actions self-hosted runner so Actions dispatches the
+tier-4 job to it (self-hosted minutes don't count against anything, also free). But there is a
+sharp edge, and it's the single most important thing on this page:
 
-> **GitHub explicitly recommends against self-hosted runners on public repositories.** Any user
-> can open a pull request, and a malicious PR can run **arbitrary code on the runner**. Our
-> server holds real **wallet payout addresses, Tor onion private keys, and RPC credentials**, so
-> a compromised runner is a key-theft / persistent-backdoor event, not a flaky build.
+> NOTE: GitHub explicitly recommends against self-hosted runners on public repositories. Any
+> user can open a pull request, and a malicious PR can run arbitrary code on the runner. The
+> server holds real wallet payout addresses, Tor onion private keys, and RPC credentials, so a
+> compromised runner is a key-theft / persistent-backdoor event, not a flaky build.
 
-The safe rule: **the keyed server only ever runs code we trust.** Concretely:
+The safe rule: the keyed server only ever runs code you trust. Concretely:
 
-- **Do NOT trigger tier-4 on `pull_request`** (and never on a fork PR). "Require approval" only
-  gates *starting* the run — once it starts, the PR's code still executes on the box.
-- **Trigger tier-4 only on trusted code:** `workflow_dispatch` (a maintainer manually runs it on
-  a ref they've reviewed) and/or `push` to `main` (post-merge). To E2E a specific fork PR, a
+- Do not trigger tier-4 on `pull_request` (and never on a fork PR). "Require approval" only
+  gates starting the run; once it starts, the PR's code still executes on the box.
+- Trigger tier-4 only on trusted code: `workflow_dispatch` (a maintainer manually runs it on a
+  ref they've reviewed) and/or `push` to `main` (post-merge). To E2E a specific fork PR, a
   maintainer reviews it first, then dispatches the workflow on that ref.
-- Register the runner as **ephemeral / just-in-time** (one job, then auto-removed) in its own
-  **runner group**, isolated from any private repos.
-- Keep the runner **least-privilege**: a dedicated unprivileged user, the box runs nothing else
-  sensitive, and ideally the runner can reach the stack only through `pithead`/`docker`, not the
+- Register the runner as ephemeral / just-in-time (one job, then auto-removed) in its own runner
+  group, isolated from any private repos.
+- Keep the runner least-privilege: a dedicated unprivileged user, the box runs nothing else
+  sensitive, and ideally the runner reaches the stack only through `pithead`/`docker`, not the
   raw key files.
 
-This is exactly how the workflow ships:
-[`.github/workflows/release-gate.yml`](../.github/workflows/release-gate.yml) runs **only** on
-`workflow_dispatch` (and `push` to `main`) on a `[self-hosted, pithead-release]` runner — never
+This is how the workflow ships.
+[`.github/workflows/release-gate.yml`](../.github/workflows/release-gate.yml) runs only on
+`workflow_dispatch` (and `push` to `main`) on a `[self-hosted, pithead-release]` runner, never
 automatically on a PR.
 
 ## Provisioning the server
 
 Target an LTS Ubuntu (22.04 / 24.04). One-time:
 
-1. **Install Pithead and let it fully sync** ([Getting Started](getting-started.md)) — full
-   Monero + full Tari, all containers healthy, a worker (ideally two) mining. The synced
+1. Install Pithead and let it fully sync ([Getting Started](getting-started.md)): full Monero +
+   full Tari, all containers healthy, a worker (ideally two) mining. The synced
    `monero.data_dir` / `tari.data_dir` are the asset the harness reuses.
-2. **Keep the active chain on fast storage (SSD/NVMe).** monerod is random-I/O heavy, so the
-   chain it runs against must not sit on a spinning HDD — that alone makes every scenario crawl.
-   A snapshot/reflink-capable filesystem (**btrfs**/**zfs**/**xfs reflink**) is a *bonus*: it lets
-   the harness snapshot/restore a chain cheaply for the prune axis. But it's optional — on plain
-   ext4-on-SSD the matrix only edits `config.json` and reuses one chain, with `--safety-backup`
-   isolating destructive runs. See the recipe below for the prune-axis details.
-3. **Disk headroom** — enough for the chains plus a snapshot / second DB (budget ≥ ~150 GiB
-   free beyond the live chains).
-4. **Tools** — `jq`, `curl`, `docker` (compose v2), `sha256sum`, `git`, `tar`.
-
-Check the box is fit at any time, **non-destructively**:
+2. Keep the active chain on fast storage (SSD/NVMe). monerod is random-I/O heavy, so the chain
+   it runs against must not sit on a spinning HDD; that alone makes every scenario crawl. A
+   snapshot/reflink-capable filesystem (btrfs/zfs/xfs reflink) is a bonus: it lets the harness
+   snapshot/restore a chain cheaply for the prune axis. It's optional. On plain ext4-on-SSD the
+   matrix only edits `config.json` and reuses one chain, with `--safety-backup` isolating
+   destructive runs. See the recipe below for the prune-axis details.
+3. Disk headroom: enough for the chains plus a snapshot / second DB (budget ≥ ~150 GiB free
+   beyond the live chains).
+4. Tools: `jq`, `curl`, `docker` (compose v2), `sha256sum`, `git`, `tar`.
+
+Check the box is fit at any time, non-destructively:
 
 ```bash
 tests/integration/run.sh --host you@server --dir pithead --readiness
@@ -92,9 +92,9 @@ It asserts: chains synced (reusable), the prune axis is exercisable (the live ch
 snapshot-capable **or** a pre-built variant chain is supplied), disk headroom, `.env` is
 owner-only, the dashboard is bound to localhost, and the backup/rollback net is usable.
 
-### Recipe: prune-axis coverage, and the storage that actually matters
+### Recipe: prune-axis coverage, and the storage that matters
 
-**Put the active chain on fast storage.** The biggest factor is the *disk*, not the filesystem:
+Put the active chain on fast storage. The biggest factor is the disk, not the filesystem:
 monerod does heavy random LMDB I/O, so a chain on a 7200 rpm HDD makes every scenario crawl.
 Check what you have before placing chains:
 
@@ -102,109 +102,108 @@ Check what you have before placing chains:
 lsblk -d -o NAME,ROTA,SIZE,MODEL   # ROTA=0 is SSD/NVMe, ROTA=1 is a spinning HDD
 ```
 
-Keep the chain monerod runs against on an **SSD/NVMe**. A spare **HDD** is fine for cold backups
-and `pithead backup` archives — but *not* for an active test chain.
+Keep the chain monerod runs against on an SSD/NVMe. A spare HDD is fine for cold backups and
+`pithead backup` archives, but not for an active test chain.
 
-**A CoW filesystem (btrfs/zfs/xfs-reflink) is a bonus, not a requirement.** On a CoW volume the
-harness can snapshot/restore a chain cheaply for per-scenario isolation — but only if it's on
+A CoW filesystem (btrfs/zfs/xfs-reflink) is a bonus, not a requirement. On a CoW volume the
+harness can snapshot/restore a chain cheaply for per-scenario isolation, but only if it's on
 fast storage. A loopback btrfs on a spare HDD gives you CoW semantics at HDD speed, which is the
-wrong trade for an *active* chain. If your root FS is ext4 on an SSD (the common case) you don't
+wrong trade for an active chain. If your root FS is ext4 on an SSD (the common case) you don't
 need CoW at all: the matrix only edits `config.json` and reuses one chain, and `--safety-backup`
 (a `pithead backup` + auto-rollback) isolates the destructive scenarios.
 
-**Covering both prune modes.** The box mines one mode (its real config). The harness exercises
-that mode against the live chain and **skips** the other unless you supply a chain for it
+Covering both prune modes. The box mines one mode (its real config). The harness exercises that
+mode against the live chain and skips the other unless you supply a chain for it
 (`--full-data-dir` / `--pruned-data-dir`). You usually don't need to: the opposite mode is
 covered by the fake mini-stack ([integration-testing](integration-testing.md)) plus the
 compose/config tests, which need no real chain. Supply the opposite-mode chain only to exercise
-it end-to-end — and build it on fast storage:
+it end-to-end, and build it on fast storage:
 
-- **Pruned chain next to a full one?** [`build-pruned-chain.sh`](../tests/integration/build-pruned-chain.sh)
-  copies the LMDB consistently (brief monerod stop, then immediate restart) and prunes the *copy*,
-  leaving the canonical chain untouched. Fetch `monero-blockchain-prune` at the **same version**
-  as the running monerod and verify it against the hash the image pins (`build/monero/Dockerfile`
+- Pruned chain next to a full one? [`build-pruned-chain.sh`](../tests/integration/build-pruned-chain.sh)
+  copies the LMDB consistently (brief monerod stop, then immediate restart) and prunes the copy,
+  leaving the canonical chain untouched. Fetch `monero-blockchain-prune` at the same version as
+  the running monerod and verify it against the hash the image pins (`build/monero/Dockerfile`
   → `MONERO_VERSION` / `MONERO_HASH`).
-- **Full chain?** Pruning is irreversible, so a full chain means a fresh full sync
-  (`MONERO_PRUNE=0`, ~1–3 days) — rarely worth it just for test coverage.
+- Full chain? Pruning is irreversible, so a full chain means a fresh full sync
+  (`MONERO_PRUNE=0`, ~1–3 days), rarely worth it just for test coverage.
 
-`gouda` (the reference box) is a **pruned** node on NVMe: it validates pruned mode live with
-`--safety-backup`, and full mode comes from the fakes. `--readiness` reports exactly this:
+The reference box is a pruned node on NVMe: it validates pruned mode live with `--safety-backup`,
+and full mode comes from the fakes. `--readiness` reports exactly this:
 
 ```bash
 tests/integration/run.sh --host you@server --dir pithead --readiness
 ```
 
-> **Gotcha — a pruned chain's file stays large.** An in-place prune does *not* shrink the LMDB
-> file: it stays at the full-chain high-water mark (~250 GiB) with the freed space sitting as
-> internal free pages (Monero reuses them as the chain grows). To actually reclaim it you must
-> rewrite the DB with `monero-blockchain-prune --copy-pruned-database` (see
-> [`compact-chain.sh`](../tests/integration/compact-chain.sh)) — slow (it copies every block over
-> hours), though it reads through a snapshot so monerod keeps mining; you then swap the compact
-> copy in during a ~2 min window. The generic `mdb_copy -c` does **not** work: Monero ships a
+> NOTE: a pruned chain's file stays large. An in-place prune does not shrink the LMDB file: it
+> stays at the full-chain high-water mark (~250 GiB) with the freed space sitting as internal
+> free pages (Monero reuses them as the chain grows). To reclaim it you must rewrite the DB with
+> `monero-blockchain-prune --copy-pruned-database` (see
+> [`compact-chain.sh`](../tests/integration/compact-chain.sh)). It's slow (it copies every block
+> over hours), though it reads through a snapshot so monerod keeps mining; you then swap the
+> compact copy in during a ~2 min window. The generic `mdb_copy -c` does not work: Monero ships a
 > patched LMDB and stock mdb_copy rejects the format (`MDB_VERSION_MISMATCH`). Often it's simplest
 > to leave the free pages.
 
 ## Hardening checklist (the pitfalls)
 
-Treat the box as **production-sensitive** — it holds keys *and* it's the thing that signs off
-releases.
-
-- **Secrets.** `.env` (RPC creds), `config.json` (wallet addresses), and the Tor data dir
-  (onion private keys) must be **owner-only** (`chmod 600 .env`; the `--readiness` check verifies
-  this). Never print secrets in logs; the harness hashes them on the box and redacts artifacts.
-  If the box also *publishes* releases, the GHCR token lives in the environment / a secret store,
-  never in the repo.
-- **Network.** Firewall to least exposure: inbound **SSH** (key-only, no root login, fail2ban)
-  and the **stratum** port scoped to the LAN ([workers › firewall](workers.md#firewall)); the
-  **dashboard stays on localhost behind Caddy** and the **monerod RPC on localhost** (both
-  asserted by `--readiness`). Nothing else should be reachable from the internet.
-- **Untrusted code.** The runner only runs trusted code (see above). Prefer ephemeral/JIT
-  runners; don't share the runner with private repos.
-- **Least privilege.** A dedicated unprivileged user; the stack already runs least-privilege
-  containers (`no-new-privileges`, `cap_drop`, read-only roots, scoped Docker socket proxies —
+Treat the box as production-sensitive. It holds keys and it's the thing that signs off releases.
+
+- Secrets. `.env` (RPC creds), `config.json` (wallet addresses), and the Tor data dir (onion
+  private keys) must be owner-only (`chmod 600 .env`; the `--readiness` check verifies this).
+  Never print secrets in logs; the harness hashes them on the box and redacts artifacts. If the
+  box also publishes releases, the GHCR token lives in the environment / a secret store, never in
+  the repo.
+- Network. Firewall to least exposure: inbound SSH (key-only, no root login, fail2ban) and the
+  stratum port scoped to the LAN ([workers › firewall](workers.md#firewall)); the dashboard
+  stays on localhost behind Caddy and the monerod RPC on localhost (both asserted by
+  `--readiness`). Nothing else should be reachable from the internet.
+- Untrusted code. The runner only runs trusted code (see above). Prefer ephemeral/JIT runners;
+  don't share the runner with private repos.
+- Least privilege. A dedicated unprivileged user; the stack already runs least-privilege
+  containers (`no-new-privileges`, `cap_drop`, read-only roots, scoped Docker socket proxies,
   regression-guarded in `tests/stack/test_compose.sh`).
-- **Reproducible, clean baseline.** The matrix reuses the synced chains and never mutates the
+- Reproducible, clean baseline. The matrix reuses the synced chains and never mutates the
   canonical copies (config-only changes, snapshot/restore for the prune axis), restores the
   original `config.json` at the end, and `--safety-backup` takes a `pithead backup` first and
-  **rolls the box back** (down → restore → up) if anything fails.
-- **Build isolation & integrity.** Build images in containers with pinned upstream versions and
-  SHA256-verified binaries (the stack already does this); promote releases **by digest** so the
+  rolls the box back (down → restore → up) if anything fails.
+- Build isolation and integrity. Build images in containers with pinned upstream versions and
+  SHA256-verified binaries (the stack already does this); promote releases by digest so the
   published bundle is bit-for-bit what was validated ([Releasing](releasing.md)).
 
 ## How a release is validated end-to-end
 
-1. **Every PR** → GitHub-hosted runners run tiers 1–3 (the merge gate). Cheap, free, fast.
-2. **Pre-release (or on-demand for a reviewed PR)** → a maintainer dispatches the release-gate
-   workflow on the dedicated server: `make test` (tiers 1–2 on the trusted box) **+** the tier-4
-   live matrix against the real synced nodes (`run.sh --safety-backup`), then — per
-   [Releasing](releasing.md) — the staging smoke test (pull the GHCR images on a clean host,
-   real `setup → up → status → mine` check).
-3. **Nothing is tagged or published until that's green**, and promotion is by digest, so the
-   version users get is the exact bundle the server validated.
+1. Every PR → GitHub-hosted runners run tiers 1–3 (the merge gate). Cheap, free, fast.
+2. Pre-release (or on-demand for a reviewed PR) → a maintainer dispatches the release-gate
+   workflow on the dedicated server: `make test` (tiers 1–2 on the trusted box) plus the tier-4
+   live matrix against the real synced nodes (`run.sh --safety-backup`), then per
+   [Releasing](releasing.md) the staging smoke test (pull the GHCR images on a clean host, real
+   `setup → up → status → mine` check).
+3. Nothing is tagged or published until that's green, and promotion is by digest, so the version
+   users get is the exact bundle the server validated.
 
 ## End-to-end coverage & gaps
 
-What the live tier-4 gate actually exercises, and what it doesn't — so a release decision is made
-with eyes open. (The reference box `gouda` is a **pruned** Monero node on NVMe; its own snapshot
-and this table also live at `~/pithead-testbench/` on the box, for operators and AI agents.)
+What the live tier-4 gate exercises, and what it doesn't, so a release decision is made with eyes
+open. (The reference box is a pruned Monero node on NVMe; its own snapshot and this table also
+live at `~/pithead-testbench/` on the box, for operators and AI agents.)
 
-**Validated live** (real synced chains): the config matrix (remote/local node, dashboard
+Validated live (real synced chains): the config matrix (remote/local node, dashboard
 secure/insecure, Tari required/optional, RPC LAN access, XvB on/off) applied + asserted; lifecycle
 (restart, secret-preserving `apply`, backup→restore round-trip); node-down failover → recovery;
-release readiness; pruned monerod (the real prod config). **Covered without a real chain**
-(tiers 1–3): client↔daemon contract tests, the fake-daemon mini-stack (incl. full-prune behavior),
+release readiness; pruned monerod (the real prod config). Covered without a real chain (tiers
+1–3): client↔daemon contract tests, the fake-daemon mini-stack (incl. full-prune behavior),
 compose hardening, config rendering, dashboard tests.
 
 | Gap (not tested live) | Worth filling before release? |
 |---|---|
-| **Full (unpruned) Monero** live — a pruned box can't exercise it | **Low** — stack paths don't differ by prune mode; fakes/config cover it. A multi-day full sync isn't justified. |
-| **Privacy / Tor egress** — no clearnet-leak assertions in the live harness (#160) | **High** — privacy is a core promise. Add egress checks (no clearnet to XvB stats, p2pool, Tari DNS). |
-| **Automated PR gate** — the self-hosted runner is manual/opt-in | **Medium-high, high-leverage** — wire the live harness as a required check on `workflow_dispatch`/push-to-`main` only (never fork PRs). |
-| **Upgrade / migration** across image versions with chain continuity | **Medium** — add a scenario: pull new images → `apply` → assert no re-sync + secrets intact. |
-| **XvB live routing** end-to-end (the raffle optimization) | **Medium** — core value-prop but unit/sim-tested today; a periodic live smoke test would help. |
-| **Multi-worker scale** — the harness assumes ~2 workers | **Medium** — add a load-gen worker + assert proxy routing/hashrate for perf confidence. |
-| **Real Tari merge-mined block** acceptance | **Low** — probabilistic; rely on template/connectivity checks. |
-| **Fault injection over SSH** (currently local-mode only) | **Low-Medium** — extend the SIGSTOP/remove cases to the `--host` path. |
-
-**Recommended before release:** the privacy-egress checks and the automated PR gate; then the
+| Full (unpruned) Monero live, which a pruned box can't exercise | Low. Stack paths don't differ by prune mode; fakes/config cover it. A multi-day full sync isn't justified. |
+| Privacy / Tor egress: no clearnet-leak assertions in the live harness (#160) | High. Privacy is a core promise. Add egress checks (no clearnet to XvB stats, p2pool, Tari DNS). |
+| Automated PR gate: the self-hosted runner is manual/opt-in | Medium-high, high-value. Wire the live harness as a required check on `workflow_dispatch`/push-to-`main` only (never fork PRs). |
+| Upgrade / migration across image versions with chain continuity | Medium. Add a scenario: pull new images → `apply` → assert no re-sync + secrets intact. |
+| XvB live routing end-to-end (the raffle optimization) | Medium. Core value-prop but unit/sim-tested today; a periodic live smoke test would help. |
+| Multi-worker scale: the harness assumes ~2 workers | Medium. Add a load-gen worker + assert proxy routing/hashrate for perf confidence. |
+| Real Tari merge-mined block acceptance | Low. Probabilistic; rely on template/connectivity checks. |
+| Fault injection over SSH (currently local-mode only) | Low-Medium. Extend the SIGSTOP/remove cases to the `--host` path. |
+
+Recommended before release: the privacy-egress checks and the automated PR gate; then the
 upgrade scenario and an XvB live smoke test. The remainder are nice-to-have.
diff --git a/docs/releasing.md b/docs/releasing.md
index ff337d0b..778bc822 100644
--- a/docs/releasing.md
+++ b/docs/releasing.md
@@ -1,138 +1,135 @@
 # Releasing
 
-How Pithead is versioned and released. This page documents the **agreed process**
+How Pithead is versioned and released. This page documents the agreed process
 ([#44](https://github.com/p2pool-starter-stack/pithead/issues/44)). The pipeline it describes
-is implemented as **[`scripts/release.sh`](../scripts/release.sh)** — run it from the build/test
-server with `make release` (preview a run safely with `make release ARGS="--dry-run"`). The one
-remaining piece is wiring `${STACK_VERSION}` into `docker-compose.yml` so installs *pull* the
+is implemented as [`scripts/release.sh`](../scripts/release.sh). Run it from the build/test
+server with `make release` (preview a run with `make release ARGS="--dry-run"`). The one
+remaining piece is wiring `${STACK_VERSION}` into `docker-compose.yml` so installs pull the
 published images rather than building; see [Status](#status) below.
 
 ## One product, one version
 
-Pithead is versioned and released as a **single product**, not as individual components.
+Pithead is versioned and released as a single product, not as individual components.
 
-The components are upstream projects we *pin and integrate*, not author — `p2pool`
+The components are upstream projects pinned and integrated, not authored here: `p2pool`
 (`ARG P2POOL_VERSION`), `xmrig-proxy`, `monerod`, and `tari`
 (`quay.io/tarilabs/minotari_node:vX-mainnet`). The only first-party code is the dashboard
-plus the orchestration (`pithead`, `docker-compose.yml`, configs). The unit of value — and
-the thing the integration matrix validates — is the *composed, tested-together set*. So a
-release is **one artifact with one version, one changelog, one upgrade path, and one
-"new version available" signal**.
+plus the orchestration (`pithead`, `docker-compose.yml`, configs). The unit of value, and the
+thing the integration matrix validates, is the composed, tested-together set. So a release is
+one artifact with one version, one changelog, one upgrade path, and one "new version available"
+signal.
 
-The one accepted trade-off: we don't support hot-swapping a single component to a version
-we haven't tested together. Power users can still override an ARG or image tag locally, but
-that combination isn't a *supported* release.
+The one accepted trade-off: hot-swapping a single component to a version not tested together
+isn't supported. Power users can still override an ARG or image tag locally, but that
+combination isn't a supported release.
 
 ## Single source of truth
 
-The product version lives in a top-level **[`VERSION`](../VERSION)** file — plain text,
-one line, [SemVer](https://semver.org/spec/v2.0.0.html). Nothing else hardcodes the version:
+The product version lives in a top-level [`VERSION`](../VERSION) file: plain text, one line,
+[SemVer](https://semver.org/spec/v2.0.0.html). Nothing else hardcodes the version:
 
 - `pithead` reads it for tagging and upgrade.
 - The dashboard bakes it in for display ([#58](https://github.com/p2pool-starter-stack/pithead/issues/58)).
 - Released images carry it in the `org.opencontainers.image.version` OCI label.
-- The dashboard's `pyproject.toml` is kept in lockstep (packaging metadata only) — a shell test fails
+- The dashboard's `pyproject.toml` is kept in lockstep (packaging metadata only); a shell test fails
   if it drifts from `VERSION`.
 
-> **Note for the first real release.** `VERSION` is `0.1.0`. Bump it to the version you want to
-> publish first (the `pyproject.toml` metadata will need to match — the drift-guard test enforces it).
+> NOTE: for the first real release, `VERSION` is `0.1.0`. Bump it to the version you want to
+> publish first (the `pyproject.toml` metadata must match, enforced by the drift-guard test).
 
 ## Component pins = an ingredients manifest
 
-We keep pinning every component (build ARGs and image tags), but treat the pins as the
-*ingredients lockfile* of each product release — not as independent releases:
+Every component stays pinned (build ARGs and image tags), but the pins are the ingredients
+lockfile of each product release, not independent releases:
 
-- Surface them in the dashboard as "what's inside vX.Y.Z" (we already show component info).
-- Bumping any component — including a security patch, e.g. a `monerod` CVE — is just a
-  normal stack release: bump the pin → cut a stack patch → re-run the integration gate →
-  ship. No loss of patch agility; we always ship a *re-tested bundle*.
+- Surface them in the dashboard as "what's inside vX.Y.Z" (component info is already shown).
+- Bumping any component, including a security patch such as a `monerod` CVE, is a normal stack
+  release: bump the pin → cut a stack patch → re-run the integration gate → ship. No loss of
+  patch agility; the bundle ships re-tested.
 
-## Published images — GHCR, single-tag model
+## Published images: GHCR, single-tag model
 
-Images are published to **GitHub Container Registry** (`ghcr.io/p2pool-starter-stack/*`),
-which is free for public images: unlimited free pulls and no Docker Hub-style rate limits.
+Images are published to GitHub Container Registry (`ghcr.io/p2pool-starter-stack/*`), which is
+free for public images: unlimited free pulls and no Docker Hub-style rate limits.
 
-"One product" doesn't mean one image — the stack is inherently multi-container. We publish
-**every image we build** (`dashboard`, `p2pool`, `xmrig-proxy`, `monero`, `tor`), **all
-tagged with the single stack version**, and compose references one `${STACK_VERSION}`.
-Users `docker compose pull` a coherent set with one knob — removing the old
-"git pull + rebuild" upgrade path. The version is the *bundle*, not the layers.
+"One product" doesn't mean one image; the stack is inherently multi-container. Every built image
+(`dashboard`, `p2pool`, `xmrig-proxy`, `monero`, `tor`) is published, all tagged with the single
+stack version, and compose references one `${STACK_VERSION}`. Users `docker compose pull` a
+coherent set with one knob, removing the old "git pull + rebuild" upgrade path. The version is
+the bundle, not the layers.
 
 ## Release process
 
-Releases are cut on a **private build/test server** that runs the full Monero and full Tari
-nodes (the integration-test environment from
-[#54](https://github.com/p2pool-starter-stack/pithead/issues/54)). A single entry
-point — `make release` (or `pithead release`) — runs the whole pipeline. **Nothing is
-promoted or published until every gate is green.**
+Releases are cut on a private build/test server that runs the full Monero and full Tari nodes
+(the integration-test environment from
+[#54](https://github.com/p2pool-starter-stack/pithead/issues/54)). A single entry point,
+`make release` (or `pithead release`), runs the whole pipeline. Nothing is promoted or published
+until every gate is green.
 
-> How to provision and **harden** that server, why end-to-end validation can't run on
-> GitHub-hosted runners (and what does run free on every PR), and the safe self-hosted-runner
-> setup are covered in **[Release / Validation Server](release-server.md)**.
+> How to provision and harden that server, why end-to-end validation can't run on GitHub-hosted
+> runners (and what does run free on every PR), and the safe self-hosted-runner setup are covered
+> in [Release / Validation Server](release-server.md).
 
 ### Pipeline: stage → smoke-test → promote
 
-1. **Preflight** — clean working tree; read the product version from the top-level
-   `VERSION` file; confirm `vX.Y.Z` isn't already released; resolve the component pins into
-   the ingredients manifest.
-2. **Test gate (blocking)** — run the existing tests (`make test`: lint + dashboard pytest
-   ≥ 80% + the `pithead` shell suite + compose validation) **and** the
-   [#54](https://github.com/p2pool-starter-stack/pithead/issues/54) integration matrix
-   against the real nodes. **Abort the release on any failure** — see
-   [Pre-release gate](#pre-release-gate-54).
-3. **Build** — build the first-party images with the pinned upstream versions baked in and
-   OCI labels stamped (`org.opencontainers.image.version` = the `VERSION` value, source
-   revision, etc.). The dashboard already reads `PITHEAD_VERSION` / git build-args for its
-   header badge ([#58](https://github.com/p2pool-starter-stack/pithead/issues/58)); a release
-   build must pass `PITHEAD_RELEASE=1` (and `PITHEAD_VERSION` from `VERSION`) so the badge shows
-   the clean `vX.Y.Z` rather than the `dev · branch @ hash` it shows for working-tree builds.
-4. **Push to staging** — push to a **staging tag** on GHCR (e.g. `:vX.Y.Z-rc.N`) and
-   capture the immutable digests. Nothing user-facing points here yet.
-5. **Staging smoke test (gate)** — on a *clean host*, pull the **staged images from GHCR**
-   and run the real user path (`setup` → up → `status`, minimal mine check). This proves the
-   actually-pushed artifacts work — not just the local build. **Abort on failure.**
-6. **Promote by digest** — re-tag the **exact digests** just smoke-tested to `:vX.Y.Z`
-   **and** `:latest`, then push. Promotion is by digest (no rebuild), so the released bundle
-   is bit-for-bit what was validated. Same version on every image.
-7. **Publish GitHub Release** — create the git tag `vX.Y.Z`, write the `CHANGELOG.md`
-   entry / release notes, and attach release assets: a pinned `docker-compose.yml` / config
-   bundle referencing `${STACK_VERSION}=vX.Y.Z`, plus the **ingredients manifest** (exact
-   component versions + promoted image digests).
+1. Preflight: clean working tree; read the product version from the top-level `VERSION` file;
+   confirm `vX.Y.Z` isn't already released; resolve the component pins into the ingredients
+   manifest.
+2. Test gate (blocking): run the existing tests (`make test`: lint + dashboard pytest ≥ 80% +
+   the `pithead` shell suite + compose validation) and the
+   [#54](https://github.com/p2pool-starter-stack/pithead/issues/54) integration matrix against
+   the real nodes. Abort the release on any failure. See [Pre-release gate](#pre-release-gate-54).
+3. Build: build the first-party images with the pinned upstream versions baked in and OCI labels
+   stamped (`org.opencontainers.image.version` = the `VERSION` value, source revision, etc.). The
+   dashboard already reads `PITHEAD_VERSION` / git build-args for its header badge
+   ([#58](https://github.com/p2pool-starter-stack/pithead/issues/58)); a release build must pass
+   `PITHEAD_RELEASE=1` (and `PITHEAD_VERSION` from `VERSION`) so the badge shows the clean
+   `vX.Y.Z` rather than the `dev · branch @ hash` it shows for working-tree builds.
+4. Push to staging: push to a staging tag on GHCR (e.g. `:vX.Y.Z-rc.N`) and capture the
+   immutable digests. Nothing user-facing points here yet.
+5. Staging smoke test (gate): on a clean host, pull the staged images from GHCR and run the real
+   user path (`setup` → up → `status`, minimal mine check). This proves the actually-pushed
+   artifacts work, not just the local build. Abort on failure.
+6. Promote by digest: re-tag the exact digests just smoke-tested to `:vX.Y.Z` and `:latest`,
+   then push. Promotion is by digest (no rebuild), so the released bundle is bit-for-bit what was
+   validated. Same version on every image.
+7. Publish GitHub Release: create the git tag `vX.Y.Z`, write the `CHANGELOG.md` entry / release
+   notes, and attach release assets: a pinned `docker-compose.yml` / config bundle referencing
+   `${STACK_VERSION}=vX.Y.Z`, plus the ingredients manifest (exact component versions + promoted
+   image digests).
 
 ### Pre-release gate (#54)
 
-The [#54](https://github.com/p2pool-starter-stack/pithead/issues/54) integration test
-matrix is a **required, blocking pre-release gate**. A release must not be promoted or
-published unless that matrix is green against the real Monero + Tari nodes. This is what
-makes every published version a single, validated bundle.
+The [#54](https://github.com/p2pool-starter-stack/pithead/issues/54) integration test matrix is a
+required, blocking pre-release gate. A release must not be promoted or published unless that
+matrix is green against the real Monero + Tari nodes. This is what makes every published version
+a single, validated bundle.
 
 ## Conventions
 
-- **Versioning** — [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
-  (`vMAJOR.MINOR.PATCH`), single source of truth in the top-level `VERSION` file. `pithead`
-  reads it for tagging/upgrade; the dashboard reads it for display
+- Versioning: [Semantic Versioning](https://semver.org/spec/v2.0.0.html) (`vMAJOR.MINOR.PATCH`),
+  single source of truth in the top-level `VERSION` file. `pithead` reads it for tagging/upgrade;
+  the dashboard reads it for display
   ([#58](https://github.com/p2pool-starter-stack/pithead/issues/58)).
-- **Changelog** — hand-curated [`CHANGELOG.md`](../CHANGELOG.md) following
-  [Keep a Changelog](https://keepachangelog.com) + SemVer, with GitHub's auto-generated PR
-  list as a supplement in the release body. (Chosen over Conventional-Commits /
-  release-please automation because our commit style is human, issue-referencing summaries —
-  curated notes read better for users; we can automate later if we adopt a commit
-  convention.)
-- **Patches** — security and component bumps ship as normal patch releases, re-validated
-  through the same gate.
+- Changelog: hand-curated [`CHANGELOG.md`](../CHANGELOG.md) following
+  [Keep a Changelog](https://keepachangelog.com) + SemVer, with GitHub's auto-generated PR list
+  as a supplement in the release body. (Chosen over Conventional-Commits / release-please
+  automation because the commit style here is human, issue-referencing summaries; curated notes
+  read better for users, and automation can come later if a commit convention is adopted.)
+- Patches: security and component bumps ship as normal patch releases, re-validated through the
+  same gate.
 
 ## Install & upgrade UX
 
-The goal is professional and one-command:
+The goal is one command:
 
-- **Install** — download the release's compose bundle (or `git checkout vX.Y.Z`) →
-  `./pithead setup`. Images are *pulled* from GHCR — no local build, no compile wait.
-- **Upgrade** — the dashboard shows "vX.Y.Z available"
+- Install: download the release's compose bundle (or `git checkout vX.Y.Z`) → `./pithead setup`.
+  Images are pulled from GHCR. No local build, no compile wait.
+- Upgrade: the dashboard shows "vX.Y.Z available"
   ([#59](https://github.com/p2pool-starter-stack/pithead/issues/59)) → the user runs
-  `./pithead upgrade` → it pulls the new single-tagged images and recreates only what
-  changed.
-- **Trust** — every published version is one immutable, #54-validated bundle; release notes
-  list exactly what's inside and what changed.
+  `./pithead upgrade` → it pulls the new single-tagged images and recreates only what changed.
+- Trust: every published version is one immutable, #54-validated bundle; release notes list
+  exactly what's inside and what changed.
 
 ## Status
 
@@ -142,35 +139,35 @@ What exists today:
 - ✅ `CHANGELOG.md` (Keep a Changelog + SemVer, with an `Unreleased` section).
 - ✅ This document.
 - ✅ The [#54](https://github.com/p2pool-starter-stack/pithead/issues/54) integration test
-  suite — the live config-matrix gate against real nodes (`tests/integration/`, `make
+  suite: the live config-matrix gate against real nodes (`tests/integration/`, `make
   test-integration`). See [Integration Testing](integration-testing.md).
-- ✅ The dashboard version badge ([#58](https://github.com/p2pool-starter-stack/pithead/issues/58)) —
+- ✅ The dashboard version badge ([#58](https://github.com/p2pool-starter-stack/pithead/issues/58)):
   `VERSION` + git build-args baked into the dashboard image (env + OCI labels); shows `vX.Y.Z` on
   releases and `dev · branch @ hash` otherwise.
-- ✅ **The release pipeline — [`scripts/release.sh`](../scripts/release.sh) (`make release`).**
+- ✅ The release pipeline, [`scripts/release.sh`](../scripts/release.sh) (`make release`).
   Implements the full preflight → test gate (`make test` + the #54 matrix, blocking) → build (OCI
   labels + `PITHEAD_RELEASE=1`) → stage to `:vX.Y.Z-rc.N` → smoke-verify the pushed images →
   promote-by-digest to `:vX.Y.Z` + `:latest` → publish the GitHub Release. It generates the
-  **ingredients manifest** (promoted digests + upstream pins) and a pinned install bundle as release
+  ingredients manifest (promoted digests + upstream pins) and a pinned install bundle as release
   assets, never starts the live stack on the build host, and never prints the registry token.
   Preview any run with `make release ARGS="--dry-run"`.
 
-- ✅ **Pull-based install — `${STACK_VERSION}` wired through `docker-compose.yml`.** Each first-party
+- ✅ Pull-based install: `${STACK_VERSION}` wired through `docker-compose.yml`. Each first-party
   service now carries an `image: ${PITHEAD_REGISTRY:-…}/pithead-<svc>:${STACK_VERSION:-dev}` ref
-  alongside its `build:`. pithead picks build-vs-pull automatically: a **source checkout** (the image
-  Dockerfiles are present) builds locally and tags `:dev` with `--pull never`; a **release install**
+  alongside its `build:`. pithead picks build-vs-pull automatically: a source checkout (the image
+  Dockerfiles are present) builds locally and tags `:dev` with `--pull never`; a release install
   (the bundle ships no Dockerfiles, just `pithead` + `VERSION` + compose + the config templates + the
-  `./build` runtime mounts) resolves `STACK_VERSION` to `vX.Y.Z` and **pulls** the published images
+  `./build` runtime mounts) resolves `STACK_VERSION` to `vX.Y.Z` and pulls the published images
   (`--pull missing`; `upgrade` forces a re-pull). Override with `PITHEAD_REGISTRY` / `PITHEAD_PULL`. So
-  a release is now `cp config.json.template config.json && ./pithead setup` — no local build.
+  a release is now `cp config.minimal.json config.json && ./pithead setup`, no local build.
 
 **Remaining:**
 
 - ⬜ The dashboard "new version available" update warning
   ([#59](https://github.com/p2pool-starter-stack/pithead/issues/59)), which builds on the
-  version badge — tracked separately.
+  version badge. Tracked separately.
 
-> **Before the first real release:** choose the first published version — set `VERSION` (the
-> `pyproject.toml` metadata follows it, enforced by the drift-guard test) — and confirm the GHCR image
+> NOTE: before the first real release, choose the first published version. Set `VERSION` (the
+> `pyproject.toml` metadata follows it, enforced by the drift-guard test) and confirm the GHCR image
 > namespace (`scripts/release.sh` defaults to `ghcr.io/p2pool-starter-stack/pithead-*`; override with
 > `PITHEAD_REGISTRY` / `PITHEAD_IMAGE_PREFIX`).
diff --git a/docs/test-inventory.md b/docs/test-inventory.md
index d58ff3a1..f250bf63 100644
--- a/docs/test-inventory.md
+++ b/docs/test-inventory.md
@@ -4,9 +4,9 @@ _Generated by `make test-inventory` ([`tests/inventory.sh`](../tests/inventory.s
 edit by hand** — re-run the target to refresh. See [Testing Strategy](testing-strategy.md) for
 how the tiers fit together._
 
-**Totals:** 500 dashboard unit tests · 12 contract tests · 31 frontend
-tests · 41 `pithead` shell sections · 17 harness self-test sections ·
-9 live config scenarios (17 axis values) · 6 mini-stack scenarios.
+**Totals:** 609 dashboard unit tests · 12 contract tests · 64 frontend
+tests · 52 `pithead` shell sections · 17 harness self-test sections ·
+9 live config scenarios (17 axis values) · 7 mini-stack scenarios.
 
 > Counts are **test functions / named cases** (parametrized pytest cases expand to more at
 > run time — e.g. the dashboard suite collects ~381). Generated statically by grep, so it's
@@ -14,12 +14,12 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 
 | Tier | Suite | Cases |
 |---|---|---|
-| 1 — Unit | dashboard pytest | 500 |
-| 1 — Unit | frontend (node --test) | 31 |
-| 1 — Unit | `pithead` shell suite | 41 sections |
+| 1 — Unit | dashboard pytest | 609 |
+| 1 — Unit | frontend (node --test) | 64 |
+| 1 — Unit | `pithead` shell suite | 52 sections |
 | 1 — Unit | compose interpolation + hardening (#90) | 1 |
 | 2 — Contract | fake-daemon clients | 12 |
-| 3 — Mini-stack | docker control-plane scenarios | 6 |
+| 3 — Mini-stack | docker control-plane scenarios | 7 |
 | 4 — Live matrix | config scenarios | 9 (17 axis values) |
 | 4 — Live matrix | harness self-test | 17 sections |
 
@@ -27,7 +27,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 
 ## Tier 1 — Unit & component
 
-### Dashboard (pytest) — 500 tests
+### Dashboard (pytest) — 609 tests
 
 #### tests/client/test_docker_control.py — 6
 - test_tcp_scheme_rewritten_to_http
@@ -60,10 +60,18 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_stale_cache_expires
 - test_close_closes_channel
 
-#### tests/client/test_xmrig_client.py — 7
-- test_first_success_returns_payload_and_short_circuits
-- test_all_attempts_fail_returns_empty
-- test_exceptions_are_swallowed
+#### tests/client/test_xmrig_client.py — 15
+- test_success_returns_payload_with_api_ok_and_single_call
+- test_default_auth_is_none_no_authorization_header
+- test_failure_status_returns_api_ok_false_single_call
+- test_exception_returns_api_ok_false
+- test_non_dict_200_body_is_a_failure
+- test_auth_name_uses_worker_name_as_bearer
+- test_auth_token_uses_shared_token_as_bearer
+- test_auth_token_without_token_sends_no_header
+- test_custom_port_is_used
+- test_repeated_failures_warn_once_then_dedup
+- test_recovery_then_failure_warns_again
 - test_ssrf_targets_are_never_probed
 - test_real_miner_ip_is_probed
 - test_name_is_used_as_bearer_never_as_host
@@ -78,13 +86,25 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_update_config_204_returns_empty
 - test_get_summary_raises_on_http_error
 
-#### tests/client/test_xvb_client.py — 9
+#### tests/client/test_xvb_client.py — 21
 - test_missing_wallet_returns_none
 - test_get_stats_success_parses_html
 - test_get_stats_routes_through_tor_proxy
 - test_get_stats_honours_explicit_proxy
 - test_get_stats_non_200_returns_none
 - test_get_stats_network_error_returns_none
+- test_get_stats_unexpected_error_returns_none
+- test_disabled_when_no_endpoint
+- test_missing_wallet_is_invalid
+- test_2xx_is_registered_and_sends_full_wallet
+- test_already_registered_422_is_idempotent_success
+- test_invalid_wallet_422
+- test_no_share_body_is_not_eligible
+- test_5xx_is_transient_error
+- test_unrecognised_body_is_error
+- test_routes_through_configured_tor_proxy_by_default
+- test_network_error_is_transient_error
+- test_unexpected_error_is_transient_error
 - test_fail_count_only
 - test_no_critical_stats_returns_none
 - test_hashrate_units
@@ -118,9 +138,9 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_empty_files_give_defaults
 - test_hashrate_derived_when_missing
 - test_hashrate_passthrough
-- test_worker_parsing
-- test_worker_without_name_defaults_to_miner
+- test_returns_raw_json
 - test_active_chain_converts_utari
+- test_unhealthy_channel_is_active_but_not_connected
 - test_no_chains_inactive
 - test_missing_file_returns_empty
 - test_malformed_json_returns_empty
@@ -139,7 +159,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_allocated_when_unused
 - test_unknown_when_missing
 
-#### tests/config/test_config.py — 8
+#### tests/config/test_config.py — 11
 - test_defaults_load
 - test_donation_level_env_override
 - test_monero_prune_accepts_truthy_forms
@@ -148,8 +168,18 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_tier_config_env_override_valid
 - test_tier_config_env_override_invalid_json_falls_back
 - test_xvb_enabled_flag
-
-#### tests/helper/test_utils.py — 29
+- test_xvb_submit_url_default_is_the_real_endpoint
+- test_xvb_submit_url_explicit_override
+- test_xvb_submit_url_disable_sentinels
+
+#### tests/helper/test_utils.py — 36
+- test_cold_start_never_fetched_is_not_stale
+- test_recent_fetch_is_not_stale
+- test_old_fetch_is_stale
+- test_boundary_just_within_threshold_is_not_stale
+- test_block_time_by_pool_type
+- test_counts_only_shares_inside_the_window
+- test_empty_shares_is_zero
 - test_plain_numbers
 - test_unit_suffixes_case_insensitive
 - test_unrecognized_suffix_is_raw
@@ -180,7 +210,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_none_when_no_route
 - test_socket_is_closed_even_on_error
 
-#### tests/service/test_algo_service.py — 28
+#### tests/service/test_algo_service.py — 38
 - test_xvb_disabled_forces_p2pool
 - test_zero_shares_forces_p2pool
 - test_excessive_failures_forces_p2pool
@@ -202,8 +232,18 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_get_target_uses_state_manager_tiers
 - test_default_auto_targets_highest_sustainable
 - test_explicit_tier_not_downgraded
+- test_predicate_cold_start_is_not_stale
+- test_predicate_fresh_is_not_stale
+- test_predicate_old_fetch_is_stale
+- test_stale_read_holds_fraction_instead_of_winding_up
+- test_fresh_read_below_reference_still_ramps
+- test_smart_sleep_does_not_bail_early_on_stale_below_tier
+- test_smart_sleep_still_bails_on_fresh_below_tier
 - test_switch_updates_proxy_and_state
 - test_switch_aborts_on_bad_config
+- test_xvb_pool_routed_over_tor_by_default
+- test_local_pool_never_routed_over_tor
+- test_xvb_tor_opt_out_no_socks5
 - test_aborts_early_when_decision_flips_to_donate
 - test_aborts_early_when_below_tier
 - test_sleeps_full_duration_when_in_tier_on_p2pool
@@ -223,7 +263,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_per_chain_independent
 - test_marker_write_failure_does_not_restart
 
-#### tests/service/test_data_service.py — 68
+#### tests/service/test_data_service.py — 85
 - test_first_poll_baselines_without_backfill
 - test_delta_records_the_difference
 - test_no_change_records_nothing
@@ -255,7 +295,8 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_offline_then_online_resets_connected_since
 - test_proxy_kind_scales_khs_to_hs
 - test_xmrig_kind_not_scaled
-- test_unreachable_direct_api_keeps_proxy_values_online
+- test_failed_probe_flags_api_ok_false_keeps_proxy_values_online
+- test_skipped_probe_leaves_api_ok_unset
 - test_short_hashrate_total_ignored
 - test_prefers_h15
 - test_falls_back_to_h60_then_h10
@@ -292,6 +333,22 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_run_holds_when_tari_required_and_only_monero_synced
 - test_post_release_blip_lets_failover_act_without_rehold
 - test_both_nodes_down_rejects_once
+- test_no_share_does_not_register
+- test_stale_share_outside_window_does_not_register
+- test_registers_once_eligible
+- test_transient_error_retries_next_poll
+- test_not_eligible_is_quiet_retry
+- test_invalid_wallet_latches_and_warns
+- test_skips_when_recently_registered
+- test_reregisters_after_interval
+- test_disabled_endpoint_skips_silently
+- test_persistent_failure_flags_failing_after_threshold
+- test_success_after_failures_resets_counter
+- test_successful_fetch_persists_stats
+- test_failed_fetch_writes_nothing
+- test_internal_ip_worker_is_never_probed
+- test_real_worker_is_probed_internal_neighbour_is_not
+- test_malicious_name_is_never_used_as_a_host
 
 #### tests/service/test_earnings.py — 4
 - test_matches_closed_form
@@ -299,7 +356,34 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_linear_in_inputs
 - test_missing_or_bad_inputs_are_zero
 
-#### tests/service/test_metrics.py — 40
+#### tests/service/test_egress.py — 25
+- test_safe_config_is_all_tor
+- test_p2pool_clearnet_blocked_by_firewall_is_not_a_leak
+- test_p2pool_clearnet_without_firewall_is_a_leak
+- test_host_networked_dashboard_leaks_despite_firewall
+- test_xvb_disabled_routes_are_inactive
+- test_remote_monerod_rpc_is_clearnet
+- test_clearnet_initial_sync_surfaces_only_when_enabled
+- test_monerod_p2p_always_tor
+- test_topology_summary_is_shared_with_egress_list
+- test_topology_safe_has_no_leaks_and_hub_nodes
+- test_topology_lan_ingress_edges
+- test_topology_daemon_p2p_is_bidirectional_over_tor
+- test_topology_clearnet_link_bypasses_the_tor_hub
+- test_topology_clearnet_blocked_by_firewall_is_not_a_leak
+- test_topology_host_networked_dashboard_xvb_leaks_but_proxy_is_blocked
+- test_topology_xvb_disabled_is_inactive_not_a_leak
+- test_topology_internal_mesh_is_flagged_and_includes_merge_mining
+- test_topology_clearnet_sync_adds_bypass_edge
+- test_tari_clearnet_sync_surfaces_in_egress_and_topology
+- test_topology_nodes_match_the_canonical_set
+- test_every_edge_endpoint_is_a_placeable_node_for_all_configs
+- test_every_edge_is_well_formed_for_all_configs
+- test_topology_summary_matches_egress_for_all_configs
+- test_firewall_off_counts_every_clearnet_path_as_a_leak
+- test_firewall_on_blocks_containers_but_not_the_host_dashboard
+
+#### tests/service/test_metrics.py — 45
 - test_empty_history_returns_zero
 - test_averages_v_p2pool_in_window
 - test_excludes_samples_outside_window
@@ -323,6 +407,11 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_no_warning_for_auto
 - test_no_warning_when_sustainable
 - test_fail_count_and_last_update
+- test_registration_status_surfaced
+- test_registration_status_defaults
+- test_xvb_stale_flag_tracks_fetch_age
+- test_xvb_stale_never_set_when_disabled
+- test_xvb_stale_false_on_cold_start
 - test_counts_online_and_total
 - test_empty
 - test_counts_recent_within_pplns_window
@@ -349,7 +438,19 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_down_clears_only_after_recovery_window
 - test_healthy_requires_stable_window_from_unknown
 
-#### tests/service/test_storage_service.py — 33
+#### tests/service/test_numeric_properties.py — 10
+- test_xmr_per_hs_day_non_negative
+- test_xmr_per_hs_day_zero_on_nonpositive_reward
+- test_xmr_per_hs_day_linear_in_reward
+- test_xmr_per_hs_day_decreases_with_difficulty
+- test_window_avgs_non_negative_and_conserve
+- test_window_avgs_empty_history_is_zero
+- test_fraction_to_ms_monotone_and_non_negative
+- test_fraction_to_ms_zero_on_nonpositive
+- test_routed_fraction_in_unit_interval
+- test_max_donation_fraction_within_reserve_bounds
+
+#### tests/service/test_storage_service.py — 31
 - test_get_tiers
 - test_default_xvb_stats
 - test_partial_updates
@@ -368,21 +469,19 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_per_window_splits_survive_reload
 - test_healthy_by_default
 - test_unhealthy_after_write_error
-- test_update_and_get_known_workers
-- test_worker_without_ip_skipped
-- test_none_list_is_noop
 - test_roundtrip
 - test_empty_snapshot_not_saved
 - test_load_missing_snapshot_returns_none
+- test_unserializable_snapshot_flags_persistence_unhealthy
 - test_share_stats_persist_across_instances
 - test_state_persists_across_instances
 - test_legacy_kv_keys_migrated_on_load
 - test_corrupted_kv_value_skipped
 - test_history_timestamp_backfilled_from_iso_on_upgrade
 - test_per_window_columns_added_on_upgrade
+- test_orphaned_workers_table_dropped_on_upgrade
 - test_history_older_than_retention_pruned_from_memory
 - test_old_history_pruned_from_db_when_cleanup_fires
-- test_stale_workers_pruned_after_retention_window
 
 #### tests/service/test_update_checker.py — 16
 - test_accepts_plain_and_v_prefixed
@@ -414,6 +513,9 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_zero_reads_do_not_run_away
 - test_recovers_after_worker_drop
 
+#### tests/sim/test_donation_model_properties.py — 1
+- test_controller_never_winds_up
+
 #### tests/test_main.py — 1
 - test_build_app_returns_wired_application
 
@@ -455,7 +557,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_css_lets_hostname_wrap
 - test_host_at_separator_styled_and_rendered
 
-#### tests/web/test_views.py — 120
+#### tests/web/test_views.py — 133
 - test_point_shape_is_xy_with_epoch_ms
 - test_legacy_rows_attributed_to_p2pool
 - test_range_filtering
@@ -506,6 +608,10 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_low_hr_badge
 - test_no_share_badge_when_donating_without_a_share
 - test_no_share_badge_absent_when_has_share_or_xvb_off
+- test_xvb_registered_badge
+- test_xvb_invalid_wallet_badge
+- test_xvb_failing_badge_takes_priority_over_checkmark
+- test_no_xvb_registration_badge_when_disabled
 - test_node_down_and_rejected
 - test_miner_held
 - test_passive_tari_with_and_without_percent
@@ -522,6 +628,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_empty_system_defaults
 - test_pool_tokens
 - test_formatted_and_raw_fields
+- test_api_ok_passes_through
 - test_online_sorted_before_offline
 - test_malformed_worker_skipped
 - test_bad_ip_sorts_to_zero
@@ -536,7 +643,10 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_flags_high_rate_above_floor
 - test_flags_all_rejects_at_floor
 - test_active
+- test_active_but_disconnected_has_no_check
 - test_inactive_defaults
+- test_active_without_status_falls_back_to_waiting
+- test_connected_requires_active
 - test_long_wallet_shortened
 - test_formats_totals_and_best
 - test_reject_pct_and_level
@@ -567,6 +677,11 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_proxy_workers_from_metrics
 - test_chart_uses_timestamps
 - test_propagates_state_errors
+- test_both_sections_present_and_share_one_summary
+- test_safe_config_emits_a_tor_only_header_badge
+- test_host_dashboard_clearnet_leak_emits_a_warning_badge
+- test_remote_monerod_is_reflected_in_the_payload
+- test_payload_stays_json_serializable_with_a_leak
 - test_valid_pair
 - test_absent_is_none
 - test_malformed_falls_back_to_none
@@ -577,7 +692,33 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - test_no_when_in_tier_but_no_share
 - test_na_when_xvb_off
 
-### Frontend logic (node --test) — 31 tests
+### Frontend logic (node --test) — 64 tests
+- withAlpha: appends an 8-bit alpha to a #rrggbb hex
+- withAlpha: non-#rrggbb values pass through opaque (a palette change cannot break fills)
+- padYAxis: pads the range and clamps the floor to zero
+- padYAxis: the floor is clamped to zero, never negative
+- padYAxis: the magnitude floor applies when the span is flat
+- padYAxis: no-op when the range is non-finite (all series hidden / no data)
+- App without state shows the right connection message
+- App always renders the theme switcher, even before the first load
+- operational App shows a disconnected banner when not connected
+- Header renders the brand, server badges, version + update badges
+- Header surfaces a High Usage badge only when a resource is hot
+- operational App renders the hero band and the headline cards
+- operational App renders the remaining advanced cards
+- EarningsCard shows the fallback when stats are down, the calculator when available
+- XvBStats greys the credited figures and flags the footer when the fetch is stale (#311)
+- WorkersTable renders headers and a row per worker with status classes
+- WorkersTable with no workers still renders the headers but no rows
+- ProxyTotals footer is hidden until the proxy reports data
+- ProxyTotals reddens the rejected figure only when reject_level is high
+- WorkersTable surfaces the per-rig api-unreadable and reject badges, and the pool badge variants
+- Tari status gates the ✔ on a live gRPC channel, never on active-but-dead (#278/#313)
+- Sync gauge shows a ✔ for a done chain and a live percent while syncing
+- ComponentHealth shows a Tor-only summary, the topology nodes, and the egress drawer
+- ComponentHealth flips to a warning summary when the posture leaks
+- ComponentHealth still renders the panel but omits the drawer when egress is absent
+- syncing App renders the sync gauges instead of the dashboard
 - sortWorkers: null index keeps the server-provided order
 - sortWorkers: numeric columns sort numerically, not lexically
 - sortWorkers: hashrate column also sorts numerically
@@ -609,16 +750,32 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - heroKpis: total is accent-coloured; blocks and tier carry no colour class
 - bandBorderWidth: zero-height segments get no border, real ones keep full width
 - uptimeCell: online shows uptime, offline shows DOWN
-
-### `pithead` shell suite (tests/stack/run.sh) — 41 sections
+- egressRoute: known routes map to icon/label/class; unknown falls back to muted
+- boxAnchor: lands on the border facing the target, not the centre
+- POS places every canonical node and nothing extra
+- every POS box has finite, positive geometry
+- edgePath: any edge between two nodes yields a valid, finite SVG path
+- edgePath: column-crossing edges route orthogonally through a clear lane
+- route palette + names cover every route the server can emit
+
+### `pithead` shell suite (tests/stack/run.sh) — 52 sections
 - unit: resolve_default
 - unit: assert_safe_dir
 - unit: is_public_ip classifier (#113)
+- unit: check_stratum_exposure warning (#113/#206)
 - unit: is_ipv4
 - unit: resolve_dashboard_host (dashboard.host 'auto' revert, 247c5a0)
 - unit: docker_boot_enabled (#137)
 - unit: is_valid_host (#130)
 - unit: describe_change
+- unit: p2pool_outbound_flags — Tor-by-default for outbound P2P (#165)
+- p2pool entrypoint word-splits P2POOL_FLAGS into separate args (#165)
+- p2pool entrypoint moves the Tari merge-mine gRPC onto loopback under Tor (#278 follow-up)
+- unit: tor_egress_rules — fail-closed Tor-only egress ruleset (#270)
+- black-box: apply/remove_tor_egress_firewall via stubbed iptables (#270)
+- regression: every command installs the Tor-egress firewall BEFORE compose (#291)
+- unit: config_bool honours an explicit false (jq // false-coercion guard, #294)
+- unit: monero_prune_flag maps prune bool -> 1/0, honouring explicit false (#294)
 - unit: clearnet initial sync helpers (#183)
 - unit: clock_sync_status (mining is time-sensitive)
 - unit: monero_address_type — p2pool needs a PRIMARY address (#250)
@@ -633,6 +790,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - unit: node credential helpers
 - unit: randomx_boot_params (#176)
 - unit: grub heal + boot-param insert (#176)
+- unit: ensure_owner conditional recursive chown (#255)
 - unit: disk_component_gib
 - unit: check_disk_grouped (mocked df)
 - node configs: no clearnet DNS egress (#161 monerod, #162 tari)
@@ -652,6 +810,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - black-box: backup -> restore round-trip (#140)
 - black-box: reset-dashboard targets .env dirs, not config.json (#139)
 - black-box: reset-dashboard refuses to guess without .env dirs (#139)
+- release: install bundle is free of macOS xattr pax headers (#252)
 
 ### Compose validation + hardening (tests/stack/test_compose.sh)
 - docker-compose.yml `${VAR}` interpolation resolves against a representative .env
@@ -676,7 +835,8 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 
 ## Tier 3 — Fake-daemon mini-stack (docker)
 
-### tests/integration/mini-stack/run-mini-stack.sh — 6 scenarios
+### tests/integration/mini-stack/run-mini-stack.sh — 7 scenarios
+- scenario 0: /api/state exposes a well-formed #170 topology + egress contract
 - scenario 1: holds the miner while both chains sync
 - scenario 2: keeps holding while Tari (required) is still syncing
 - scenario 3: releases the miner once both chains are synced
@@ -726,16 +886,23 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - TARI_CLEARNET_SYNC matches config (#183)
 - TARI_REQUIRED env matches config
 - XVB_ENABLED matches config
+- XvB stats + auto-register wired to the Tor SOCKS (#206/#163)
+- apply migrates root-owned CONTENTS to the container uid (#255)
 - backup archive contains .env
 - backup archive contains config.json
 - backup/rollback prerequisites present (writable backups/, tar)
 - both prune modes exercisable (live=$baseline_mode + supplied $opp_label chain at $opp_dir)
 - check
+- compose guard refuses the unauthenticated proxy API (#153)
 - container up: $svc
 - dashboard /api/state reachable
 - dashboard bound to localhost only (Caddy fronts it)
 - default-off stratum: no --access-password live (#152)
 - disk headroom on the live chain FS (${avail} GiB free)
+- egress posture section present
+- firewall apply degrades gracefully on an insert failure (rc 0)
+- firewall reinstated after recovery
+- insert failure leaves NO half-open firewall (rolled back)
 - memory ceiling live on $svc (#132)
 - monero auto-transitioned clearnet→Tor (#234)
 - monero display mode determinate ($dmode)
@@ -748,6 +915,9 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - monerod reports synced (RPC)
 - monerod running-but-unhealthy
 - monerod runs Tor-only in steady state — proxy present (#183/#234)
+- no clearnet egress — every app dials via Tor (#274/#270)
+- original PROXY_AUTH_TOKEN restored verbatim
+- pithead up fails closed (non-zero exit) on an empty PROXY_AUTH_TOKEN
 - pool actually changed
 - pool type
 - prune axis: live FS is snapshot-capable ($fstype) — the $opp_label variant can be built cheaply
@@ -758,6 +928,7 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - secrets intact after restore
 - secrets preserved across pool change
 - snapshot-isolated $baseline_mode chain on a CoW FS ($same_dir, $sfs) — destructive scenarios needn't touch the live chain
+- stack healthy again after token restore
 - stack is healthy (pithead status)
 - status OK after monerod recovery
 - status OK after node recovery
@@ -772,6 +943,9 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 - tari auto-transitioned clearnet→Tor (#234)
 - tari canonical config is always Tor (#234)
 - tari synced (required)
+- topology + egress share one summary
+- topology exposes the canonical node set
+- topology section present
 - workers online (>= $EXPECTED_WORKERS)
 - xmrig-proxy dev-fee donate-level is explicit + live (#173)
 - xmrig-proxy stopped for failover
@@ -797,5 +971,5 @@ tests · 41 `pithead` shell sections · 17 harness self-test sections ·
 
 ---
 
-_Grand total: **616** enumerated cases/sections across the four tiers (plus the live
+_Grand total: **770** enumerated cases/sections across the four tiers (plus the live
 lifecycle and fault-injection phases, which are exercised on a real server)._
diff --git a/docs/test-server-architecture.md b/docs/test-server-architecture.md
index 8d752270..b7d68b9d 100644
--- a/docs/test-server-architecture.md
+++ b/docs/test-server-architecture.md
@@ -1,21 +1,21 @@
 # Test / build server architecture & recreation
 
-How the Pithead reference test server (`gouda`) is structured, and how to **recreate it on another
-box** with minimal pain. The whole point: the synced chains are the slow-to-acquire asset (days to
-sync) — everything else is reproducible in minutes from the repo.
+How the Pithead reference test server (the reference box) is structured, and how to recreate it on
+another box. The synced chains are the slow-to-acquire asset (days to sync); everything else is
+reproducible in minutes from the repo.
 
 ## What this server is
 
-A single box that runs the **live Pithead stack** against real, synced chains and serves three jobs:
+A single box that runs the live Pithead stack against real, synced chains and serves three jobs:
 
-1. **Tier-4 release gate** — the integration harness ([integration-testing](integration-testing.md))
+1. Tier-4 release gate: the integration harness ([integration-testing](integration-testing.md))
    validates a release end-to-end here before it ships.
-2. **Developer + AI-agent test bench** — a consistent place to reproduce, test, and debug stack
+2. Developer + AI-agent test bench: a consistent place to reproduce, test, and debug stack
    behavior against real daemons.
-3. **Reference deployment** — a known-good, documented install other boxes can be cloned from.
+3. Reference deployment: a known-good, documented install other boxes can be cloned from.
 
-It is **not** a production miner — downtime is fine; tear-down/redeploy is fine. The one rule:
-**don't lose the synced chains** (reuse them, don't re-sync).
+It is not a production miner. Downtime is fine; tear-down/redeploy is fine. The one rule: don't
+lose the synced chains (reuse them, don't re-sync).
 
 ## Hardware & storage policy
 
@@ -28,12 +28,12 @@ NVMe SSD (fast, PRIMARY)               HDD (slow, SPARING)
     └─ /srv/code/pithead-data (CHAINS)  ← the asset, on fast storage
 ```
 
-**Policy — the single most important hardware rule:** the chains monerod/Tari actively run against
-live on the **SSD/NVMe**. monerod is random-I/O heavy; a chain on a spinning HDD makes every test
-crawl. The HDD is for **cold** things only (backup tarballs, archived snapshots). Check `lsblk -d
--o NAME,ROTA` before placing any chain — `ROTA=0` is SSD/NVMe, `ROTA=1` is HDD.
+Policy, the single most important hardware rule: the chains monerod/Tari actively run against
+live on the SSD/NVMe. monerod is random-I/O heavy; a chain on a spinning HDD makes every test
+crawl. The HDD is for cold things only (backup tarballs, archived snapshots). Check `lsblk -d
+-o NAME,ROTA` before placing any chain: `ROTA=0` is SSD/NVMe, `ROTA=1` is HDD.
 
-**Sizing (a pruned-Monero test bench fits comfortably in ~1 TB):**
+Sizing (a pruned-Monero test bench fits in ~1 TB):
 
 | Component | Size |
 |---|---|
@@ -45,44 +45,45 @@ crawl. The HDD is for **cold** things only (backup tarballs, archived snapshots)
 | *+ optional full Monero node* | *+250 GB* |
 | *+ a few full chain copies* | *95–250 GB each* |
 
-A 1 TB NVMe holds the pruned bench with ~650 GB to spare — room for a full node and copies too.
+A 1 TB NVMe holds the pruned bench with ~650 GB to spare, room for a full node and copies too.
 
-> **⚠️ Verify the disk is actually fast.** "SSD" in the model name is not enough — check the *bus*.
-> On the reference box (`gouda`) the original "1 TB SSD" enumerated as `/dev/sdb` on **SATA** (not
-> `/dev/nvme0n1`), on a link that negotiated down to 1.5 Gbps, and benchmarked at **~37–98 MB/s —
-> HDD-class**. That single fact bottlenecked monerod, builds, and made LMDB compaction (heavy
-> random I/O) impractical (~16 h instead of ~10 min). **Confirm the *bus* before relying on a drive:**
+> NOTE: verify the disk is actually fast. "SSD" in the model name is not enough; check the bus.
+> A drive sold as an "SSD" can enumerate on SATA rather than NVMe, on a link that negotiates down
+> to a slow speed, and benchmark at ~37–98 MB/s, HDD-class. That single fact bottlenecks monerod,
+> builds, and makes LMDB compaction (heavy random I/O) impractical (~16 h instead of ~10 min).
+> Confirm the bus before relying on a drive:
+>
 > ```bash
 > lsblk -d -o NAME,TRAN,ROTA,MODEL   # want TRAN=nvme, not sata
-> ls /dev/nvme*                       # an NVMe drive appears as /dev/nvme0n1
+> ls /dev/nvme*                       # an NVMe drive appears as a /dev/nvme* node
 > # quick reality check on random read (what monerod does):
 > dd if=/path/to/data.mdb of=/dev/null bs=4k count=200000 skip=10000000   # want >>100 MB/s
 > ```
 >
-> **✅ Resolved on `gouda` (2026-06):** a **4 TB WD SN850X m.2 PCIe NVMe** (`/dev/nvme0n1`) was added
-> and the chains migrated onto it. `/srv/code/pithead-data` is now `/dev/nvme0n1p1` (ext4, `noatime`,
-> mounted by UUID via fstab with `nofail`); the SATA SSD now carries only the OS. monerod opens the
-> ~266 GB pruned LMDB in seconds, and the full integration matrix runs green against it. Compaction
-> to ~95 GB is now a minutes-long `mdb_copy -c <chain>/lmdb <dest>` if ever wanted (the chain is
-> correctly pruned — the extra size is reclaimable free-page bloat, not a full chain); the matching
-> `mdb_copy` (LMDB 0.9.70, from Monero's vendored source) is staged at `~/pithead-testbench/bin/mdb_copy`.
-> CoW snapshots would still need btrfs/zfs on the NVMe (it's ext4 today) — see below.
-
-A **second m.2 NVMe (PCIe) with btrfs/zfs** additionally enables **copy-on-write snapshots** —
-instant, near-free chain clones for isolated/parallel test runs — the upgrade that helps a busy
-multi-agent bench.
+> The fix is to put the chains on a fast NVMe SSD. Add an m.2 PCIe NVMe and migrate the chains
+> onto it; mount the data dir by UUID via fstab (ext4, `noatime`, `nofail`) and keep the OS on a
+> separate disk. monerod then opens the ~266 GB pruned LMDB in seconds and the full integration
+> matrix runs green. Compaction to ~95 GB is a minutes-long `mdb_copy -c <chain>/lmdb <dest>` if ever
+> wanted (the chain is correctly pruned; the extra size is reclaimable free-page bloat, not a full
+> chain); stage the matching `mdb_copy` (LMDB 0.9.70, from Monero's vendored source) at
+> `~/pithead-testbench/bin/mdb_copy`. CoW snapshots would still need btrfs/zfs on the NVMe (if it's
+> ext4); see below.
+
+A second m.2 NVMe (PCIe) with btrfs/zfs additionally enables copy-on-write snapshots: instant,
+near-free chain clones for isolated/parallel test runs, the upgrade that helps a busy multi-agent
+bench.
 
 ## Directory layout
 
 | Path | Disk | What | Lose it? |
 |---|---|---|---|
 | `~/code/pithead/` (`/srv/code/pithead`) | SSD | stack checkout (`docker-compose.yml`, the `pithead` CLI), `config.json`, `.env` | reproducible (clone) |
-| `/srv/code/pithead-data/{monero,tari,p2pool,dashboard,tor}/` | **NVMe** | the chains + Tor onion keys — **the asset** (`/dev/nvme0n1p1`, ext4) | **don't** (days to re-sync) |
+| `/srv/code/pithead-data/{monero,tari,p2pool,dashboard,tor}/` | NVMe | the chains + Tor onion keys, the asset (mounted by UUID, ext4) | **don't** (days to re-sync) |
 | `/var/lib/docker/` | SSD | images / build cache | reproducible (rebuild) |
 | `~/pithead-testbench/` | HDD | build-server docs + ops tools (see its `README.md`) | reproducible (repo) |
 | `/home` … `/mnt/chains` | HDD | cold backups / archives | — |
 
-The chains live **outside** the checkout (`/srv/...`, absolute paths in `config.json`), so the stack
+The chains live outside the checkout (`/srv/...`, absolute paths in `config.json`), so the stack
 can be refreshed/redeployed without ever touching them.
 
 ## Recreate on another box
@@ -90,9 +91,10 @@ can be refreshed/redeployed without ever touching them.
 Goal: stand up an equivalent server. Minutes of work + one chain transfer (vs days of re-sync).
 
 **1. Prereqs.** Ubuntu LTS, Docker (Compose v2), `git jq curl tar`, and your user in the `docker`
-group. Put the chains' target on the **SSD**.
+   group. Put the chains' target on the SSD.
 
 **2. Clone + configure:**
+
 ```bash
 git clone https://github.com/p2pool-starter-stack/pithead.git ~/pithead && cd ~/pithead
 cp /path/to/your/config.json .         # your wallets/settings — or run `./pithead setup` to make one
@@ -104,40 +106,45 @@ jq '.monero.data_dir="/srv/<you>/pithead/data/monero"
   | .tor.data_dir="/srv/<you>/pithead/data/tor"' config.json | sponge config.json
 ```
 
-**3. Bring the chains (the painless part — reuse, don't re-sync).** Stop the stack on the source
-box (`./pithead down`) so the LMDBs are consistent, then copy `/srv/.../pithead/data/` to the new
-box's SSD — over the network or a fast external drive:
+**3. Bring the chains (reuse, don't re-sync).** Stop the stack on the source box (`./pithead down`)
+   so the LMDBs are consistent, then copy `/srv/.../pithead/data/` to the new box's SSD, over the
+   network or a fast external drive:
+
 ```bash
 # from the new box, pulling from the old one (chains are ~230 GB; hours over GbE, faster over USB3/10G):
 rsync -aP --info=progress2 olduser@oldbox:/srv/code/pithead-data/ /srv/<you>/pithead/data/
 ```
+
 The Tor onion keys travel in `data/tor`, so the box keeps its onion identity. (No old box yet? Omit
-this and let monerod/Tari sync from scratch — days, but hands-off.)
+this and let monerod/Tari sync from scratch; days, but hands-off.)
 
 **4. Deploy + verify:**
+
 ```bash
 cd ~/pithead && ./pithead setup        # deps, .env, Tor, Caddy; then `up`
 ./pithead status                        # all healthy; monerod just catches up the gap
 ```
 
 **5. Test-bench tooling:**
+
 ```bash
 mkdir -p ~/pithead-testbench/bin
 cp ~/pithead/tests/integration/{build-pruned-chain,compact-chain,system-info}.sh ~/pithead-testbench/
-cp ~/pithead/tests/integration/gouda-testbench-README.md ~/pithead-testbench/README.md
+cp ~/pithead/tests/integration/testbench-README.md ~/pithead-testbench/README.md
 # fetch monero-blockchain-prune at the running monerod's version (see build/monero/Dockerfile pins):
 ~/pithead-testbench/system-info.sh > ~/pithead-testbench/system-info.md
 ```
 
 **6. Validate it's release-fit:**
+
 ```bash
 tests/integration/run.sh --host you@newbox --dir pithead --readiness
 ```
 
-## Migrating gouda → a bigger box later
+## Migrating the test bench → a bigger box later
 
 Same as above, steps 3–6: `rsync` the chains + `config.json` over, `pithead setup`, redeploy,
 copy the test-bench tooling, regenerate `system-info.md`. Because the chains are decoupled and the
-config is captured, the move is a transfer + a redeploy — no reconfiguration, no re-sync. Put the
+config is captured, the move is a transfer + a redeploy. No reconfiguration, no re-sync. Put the
 chains on the bigger box's fastest disk; if it has spare NVMe, that's the place for a btrfs/zfs CoW
 volume to get cheap test-chain snapshots.
diff --git a/docs/testing-guide.md b/docs/testing-guide.md
index 1efed351..d69ec209 100644
--- a/docs/testing-guide.md
+++ b/docs/testing-guide.md
@@ -1,20 +1,19 @@
 # Testing Guide (for developers)
 
-Practical "how do I test the change I just made?" companion to the
-[Testing Strategy](testing-strategy.md) (which explains *why* the tiers exist) and the
-generated [Test Inventory](test-inventory.md) (which lists *what* exists today).
+How to test a change you just made. The [Testing Strategy](testing-strategy.md) explains why the
+tiers exist; the generated [Test Inventory](test-inventory.md) lists what exists today.
 
 ## Philosophy
 
-- **Test the intent, not the line.** A test should pin down a *behavior or contract* —
-  "a pruned node displays Pruned", "the gate holds until both chains sync", "an old DB
-  migrates without losing history" — and read clearly enough that its name + one-line comment
-  explain *why it exists*. Don't add a test purely to move the coverage number.
-- **The 80% coverage gate is a floor, not a target.** Uncovered defensive error-handling is
-  fine; uncovered *behavior* (a migration path, a retention rule, a decision branch) is a gap.
-- **Tests are real code.** They're linted (`shellcheck`), version-controlled with the change
-  they protect, and listed in the inventory (a CI drift check fails if you add/remove a test
-  without regenerating it).
+- Test the intent, not the line. A test pins down a behavior or contract — "a pruned node
+  displays Pruned", "the gate holds until both chains sync", "an old DB migrates without losing
+  history" — and reads clearly enough that its name plus a one-line comment explain why it exists.
+  Don't add a test purely to move the coverage number.
+- The 80% coverage gate is a floor, not a target. Uncovered defensive error-handling is fine;
+  uncovered behavior (a migration path, a retention rule, a decision branch) is a gap.
+- Tests are real code. They're linted (`shellcheck`), version-controlled with the change they
+  protect, and listed in the inventory. A CI drift check fails if you add or remove a test without
+  regenerating it.
 
 ## Commands
 
@@ -46,9 +45,10 @@ make test-integration ARGS="--host user@box --dir pithead --check"   # tier-4 li
 ## Recipes
 
 ### Dashboard behavior (tier 1)
-Add a `test_*` to the matching file under `build/dashboard/tests/`. Name it for the behavior,
-add a one-line docstring stating the intent, mock at the client boundary (the conftest gives
-you an in-memory `state_manager`). Run `make test-dashboard` — coverage must stay ≥ 80%.
+
+Add a `test_*` to the matching file under `build/dashboard/tests/`. Name it for the behavior, add
+a one-line docstring stating the intent, mock at the client boundary (the conftest gives you an
+in-memory `state_manager`). Run `make test-dashboard`; coverage must stay ≥ 80%.
 
 ```python
 def test_pruned_node_is_labelled_pruned(...):
@@ -57,54 +57,57 @@ def test_pruned_node_is_labelled_pruned(...):
 ```
 
 ### A client parsing a new daemon state (tier 2)
+
 1. Teach the fake to produce the state: edit `tests/integration/fakes/fake_monerod.py` or
    `fake_tari.py` (add a `mode`, or a field the daemon returns).
-2. Assert the *real* client parses it: add a test to `fakes/test_contract.py` that points the
-   real `MoneroClient`/`TariClient` at the fake and checks the parsed result.
+2. Assert the real client parses it: add a test to `fakes/test_contract.py` that points the real
+   `MoneroClient`/`TariClient` at the fake and checks the parsed result.
 3. `make test-fakes`. This is the seam that catches "the daemon changed its wire format".
 
 ### A config axis (tier 4)
+
 Add a `NAME<TAB>overrides` row to `scenario_matrix()` in `scenarios.sh`, and the value to
-`axis_coverage()`. The self-test **enforces** that every axis value appears in some scenario,
-so a half-added axis fails `make test-integration-selftest`. No code changes needed.
+`axis_coverage()`. The self-test enforces that every axis value appears in some scenario, so a
+half-added axis fails `make test-integration-selftest`. No code changes needed.
 
 ### A control-plane scenario (tier 3)
+
 Add a scenario to `tests/integration/mini-stack/run-mini-stack.sh`: drive the fakes via their
 `/control` endpoints (`set_monerod`/`set_tari`) and assert real container state with
 `assert_state` / `assert_stays`. `make test-mini-stack` (needs docker).
 
 ## Conventions
 
-- **Determinism, no sleep-and-hope.** Wait on a real signal with a timeout (`wait_for`,
-  `assert_state`, `wait_status_ok`). For time-based logic, **backdate timestamps white-box**
-  rather than patching the global clock — e.g. push an old point into the deque, then act
-  (see `test_history_older_than_retention_pruned_from_memory`).
-- **Shell:** pure logic goes in `lib.sh`/`scenarios.sh` and is tested by `selftest.sh`; I/O
-  (ssh, docker, RPC) is thin wrappers that aren't unit-tested. Everything stays
+- Determinism, no sleep-and-hope. Wait on a real signal with a timeout (`wait_for`,
+  `assert_state`, `wait_status_ok`). For time-based logic, backdate timestamps white-box rather
+  than patching the global clock — push an old point into the deque, then act (see
+  `test_history_older_than_retention_pruned_from_memory`).
+- Shell: pure logic goes in `lib.sh`/`scenarios.sh` and is tested by `selftest.sh`. I/O (ssh,
+  docker, RPC) is thin wrappers that aren't unit-tested. Everything stays
   `shellcheck --severity=warning` clean.
-- **Regenerate the inventory** (`make test-inventory`) when you add/remove a test — CI's
-  drift check (`make test-inventory-check`) fails otherwise.
-- **Secrets:** never print tokens/creds/onions; the harness redacts artifacts and hashes
-  secrets on the box. If you add a secret-bearing field, confirm `redact()` covers it (there's
-  a self-test for the patterns).
+- Regenerate the inventory (`make test-inventory`) when you add or remove a test. CI's drift check
+  (`make test-inventory-check`) fails otherwise.
+- Secrets: never print tokens, creds, or onions. The harness redacts artifacts and hashes secrets
+  on the box. If you add a secret-bearing field, confirm `redact()` covers it (there's a self-test
+  for the patterns).
 
 ## Gotchas learned on real hardware
 
-The live harness was first run against a real synced, mining box — these are the
-calibration lessons baked into the tests now. Keep them in mind:
-
-- **A synced *local* monerod shows `state: "loading"` in `/api/state`**, not `"done"` — it has
-  no target height once caught up. Assert "synced" via monerod's own `get_info.synchronized`
-  (the harness's `monero_caught_up`), not the dashboard UI field.
-- **`stratum.conns` can read 0 on a healthy, mining box.** Use `proxy_workers` /
-  `total_hashes` for mining-liveness; `conns` is informational.
-- **The mini-stack must be isolated.** Containers are named `itest-*` and control ports are
-  28081/28152 so it can't collide with — or control — a real deployment on the same host.
-  A fake server inside a container must bind `0.0.0.0` (binding `127.0.0.1` makes it
-  unreachable from peer containers — this once broke release in the mini-stack).
-- **monerod-down failover isn't simulated in the mini-stack** (the dashboard's monerod
-  down-path log-scrapes a real `monerod` container the fake stack lacks); it's covered on real
-  hardware by `run.sh --fault-injection`. Tari-down is simulated there cleanly.
-- **Run `--check` first.** Against any real box, `run.sh --check` asserts the current live
-  state non-destructively (no config change) — the safe way to validate before the
-  config-churning matrix.
+The live harness was first run against a real synced, mining box. These are the calibration lessons
+now baked into the tests. Keep them in mind.
+
+- A synced local monerod shows `state: "loading"` in `/api/state`, not `"done"` — it has no target
+  height once caught up. Assert "synced" via monerod's own `get_info.synchronized` (the harness's
+  `monero_caught_up`), not the dashboard UI field.
+- `stratum.conns` can read 0 on a healthy, mining box. Use `proxy_workers` / `total_hashes` for
+  mining-liveness; `conns` is informational.
+- The mini-stack must be isolated. Containers are named `itest-*` and control ports are
+  28081/28152 so it can't collide with — or control — a real deployment on the same host. A fake
+  server inside a container must bind `0.0.0.0`; binding `127.0.0.1` makes it unreachable from peer
+  containers, which once broke release in the mini-stack.
+- monerod-down failover isn't simulated in the mini-stack. The dashboard's monerod down-path
+  log-scrapes a real `monerod` container the fake stack lacks; it's covered on real hardware by
+  `run.sh --fault-injection`. Tari-down is simulated there cleanly.
+- Run `--check` first. Against any real box, `run.sh --check` asserts the current live state
+  non-destructively (no config change). It's the safe way to validate before the config-churning
+  matrix.
diff --git a/docs/testing-strategy.md b/docs/testing-strategy.md
index 89c32b02..c3111fb4 100644
--- a/docs/testing-strategy.md
+++ b/docs/testing-strategy.md
@@ -1,13 +1,13 @@
 # Testing Strategy
 
-How Pithead simulates **every situation the stack can be in** — and which layer proves each
-one. This is the map behind the [integration suite](integration-testing.md); read that for how
-to run the live matrix, and this for *what we test where, and why*.
+How Pithead simulates every situation the stack can be in, and which layer proves each one. This
+is the map behind the [integration suite](integration-testing.md); read that for how to run the
+live matrix, and this for what we test where, and why.
 
-The guiding idea: the stack's runtime behaviour is a **state machine** (syncing → held →
-released; healthy → down → rejected → recovered → readmitted; XvB tiers; container health),
-and a healthy, already-synced box only ever shows you one corner of it. So we simulate the rest
-— at the cheapest layer that can prove each situation honestly.
+The stack's runtime behaviour is a state machine: syncing → held → released; healthy → down →
+rejected → recovered → readmitted; XvB tiers; container health. A healthy, already-synced box only
+ever shows one corner of it, so we simulate the rest at the cheapest layer that can prove each
+situation honestly.
 
 ## The four tiers
 
@@ -18,19 +18,18 @@ and a healthy, already-synced box only ever shows you one corner of it. So we si
 | **3 — Mini-stack** | `tests/integration/mini-stack/` (real dashboard + docker-control vs fake daemons) | The control plane **end-to-end with real containers**: hold/release and reject/readmit actually stopping/starting `p2pool`/`xmrig-proxy`, driven deterministically | CI with Docker (`make test-mini-stack`) |
 | **4 — Live matrix** | `tests/integration/run.sh` against a real, synced box | What only reality proves: real merge-mining, prune/full DB size, Caddy TLS, Tor onions, HugePages, plus fault injection for real container health verdicts | Manual / release gate (`make test-integration`) |
 
-**Why this shape, and the answer to "should we use stubs?"** Stubs already do the heavy
-lifting — the dashboard has ~140 unit tests that exhaustively drive the hard runtime states with
-mocked clients. Adding *more* mocks for the same logic would be duplication. What stubs **can't**
-prove is wiring: that the real clients parse real daemon output (tier 2), that the dashboard's
-stop/start actually moves real containers (tier 3), and that real daemons sync/merge-mine and
-real containers go unhealthy (tier 4). So the strategy is **stubs for logic, controllable fake
-daemons for the control-plane wiring, and the real box for the irreducibly-real** — each
-situation tested once, at the lowest tier that's honest.
+Why this shape, and whether to use stubs: stubs already do most of the work. The dashboard has
+~140 unit tests that drive the hard runtime states with mocked clients. More mocks for the same
+logic would be duplication. What stubs can't prove is wiring: that the real clients parse real
+daemon output (tier 2), that the dashboard's stop/start moves real containers (tier 3), and that
+real daemons sync/merge-mine and real containers go unhealthy (tier 4). So the strategy is stubs
+for logic, controllable fake daemons for the control-plane wiring, and the real box for the
+irreducibly-real. Each situation is tested once, at the lowest tier that's honest.
 
-The fakes are the key enabler: because the whole control plane is env-configurable
+The fakes are the key enabler. Because the whole control plane is env-configurable
 (`MONERO_RPC_URL`, `TARI_GRPC_ADDRESS`, `DOCKER_CONTROL_URL`, `NODE_DOWN_AFTER_SEC`,
-`UPDATE_INTERVAL`, …), we can point the real code at tiny controllable servers and drive the
-entire state machine in seconds, in CI, with no chain and no test box.
+`UPDATE_INTERVAL`, …), we point the real code at tiny controllable servers and drive the entire
+state machine in seconds, in CI, with no chain and no test box.
 
 ## Scenario catalog
 
@@ -38,6 +37,7 @@ Every situation we care about, what triggers it, and the tier(s) that cover it.
 today; ▶ = exercised by the live matrix / mini-stack when run.
 
 ### A. Configuration permutations
+
 The deploy-time axes — each changes a real runtime path. Full table and assertions in
 [Integration Testing › The config matrix](integration-testing.md#the-config-matrix).
 
@@ -49,6 +49,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | `p2pool.pool` main / mini / nano (sidechain, flags) | config | 4 ▶ |
 
 ### B. Sync lifecycle (#35)
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | Cold start, chains syncing → **hold** `p2pool`+`xmrig-proxy` | both `is_syncing` | 1 ✅ · 3 ▶ |
@@ -59,6 +60,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | Restart mid-sync / post-release (latch persisted) | snapshot reload | 1 ✅ |
 
 ### C. Node health & failover (#31)
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | monerod down → **reject workers** (stop `xmrig-proxy`) | unreachable ≥ `NODE_DOWN_AFTER_SEC` | 1 ✅ · 3 ▶ · 4 ▶ |
@@ -70,6 +72,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | Stop/start fails → retry next cycle (idempotent) | docker error | 1 ✅ |
 
 ### D. Container health verdicts (`pithead status`)
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | All healthy → exit 0 | steady state | 1 ✅ · 4 ▶ |
@@ -79,6 +82,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | Remote mode ignores monerod | profile off | 1 ✅ · 4 ▶ |
 
 ### E. XvB switching engine
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | Disabled / zero shares / `fail_count ≥ 3` / no sustainable tier → P2POOL | guards | 1 ✅ |
@@ -87,6 +91,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | Real XvB endpoint reachable / failing | network | 4 (real endpoint) |
 
 ### F. Dashboard `/api/state` field states
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | sync state loading/syncing/done; pruned/full/unknown; db_size | metrics | 1 ✅ |
@@ -95,6 +100,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | Dashboard reads correct live state on a real stack | real daemons | 4 ▶ |
 
 ### G. CLI lifecycle (`pithead`)
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | Config validation, secret preservation, `apply` no-op/destructive guards | sourced fns | 1 ✅ |
@@ -103,6 +109,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | `backup`/`restore`, `reset-dashboard`, `doctor` | real box | 1 ✅ (partial) · 4 (future) |
 
 ### H. Host / infrastructure (real-only)
+
 | Situation | Trigger | Tier |
 |---|---|---|
 | Real merge-mining share lands; real hashrate on dashboard | live mining | 4 ▶ |
@@ -119,9 +126,9 @@ make test-integration ARGS="--host user@box --dir pithead --lifecycle --fault-in
 
 ## Production-readiness posture
 
-What gates a merge vs. a release, the engineering standards every test holds to, and the gaps
-we know about. The full enumerated coverage is in the generated
-[Test Inventory](test-inventory.md) (kept honest by a CI drift check).
+What gates a merge vs. a release, the engineering standards every test holds to, and the gaps we
+know about. The full enumerated coverage is in the generated [Test Inventory](test-inventory.md)
+(kept honest by a CI drift check).
 
 ### What runs where
 
@@ -138,73 +145,116 @@ we know about. The full enumerated coverage is in the generated
 | Fake-daemon **docker mini-stack** | 3 | PRs touching the harness/dashboard | ✅ (own workflow) |
 | **Live config matrix** on real nodes | 4 | manual / pre-release | ✅ **release gate** ([#44](https://github.com/p2pool-starter-stack/pithead/issues/44)) |
 
-The first three tiers run on every PR with no special infrastructure; tier 4 is the blocking
-**pre-release** gate (see [Releasing](releasing.md)) because it needs the real synced nodes.
+The first three tiers run on every PR with no special infrastructure. Tier 4 is the blocking
+pre-release gate (see [Releasing](releasing.md)) because it needs the real synced nodes.
 
 ### Engineering standards
 
-Every scenario, at every tier, holds to the same discipline:
+Every scenario, at every tier, holds to the same discipline.
 
-- **Deterministic, no sleep-and-hope.** Wait on real readiness signals — container health,
+- Deterministic, no sleep-and-hope. Wait on real readiness signals — container health,
   `pithead status`, dashboard sync %, miner-released — with timeouts. The only fixed sleeps are
-  *poll intervals* and the deliberate "stays in state" windows that prove the gate does **not**
-  act prematurely.
-- **Isolated & idempotent.** Each scenario starts from a known baseline and restores it; the
-  live matrix snapshots `config.json` and reuses (never mutates) the canonical chain dirs; the
+  poll intervals and the deliberate "stays in state" windows that prove the gate does not act
+  prematurely.
+- Isolated and idempotent. Each scenario starts from a known baseline and restores it. The live
+  matrix snapshots `config.json` and reuses (never mutates) the canonical chain dirs; the
   mini-stack tears down with `down -v`.
-- **Actionable failures.** Per-scenario pass/fail, continue-on-error to collect the whole
-  matrix, and artifact capture (redacted logs, `compose ps`, `.env`-minus-secrets, dashboard
-  responses) on failure.
-- **Secrets hygiene.** Tokens / RPC creds / onions are never printed; preservation is checked
-  by hashing on the box; all artifacts pass a redactor.
-- **Reproducible.** The live run records a manifest (stack `VERSION`, git rev, image digests).
-- **Test code is real code.** Same lint (shellcheck), the coverage gate, and the inventory
-  drift check apply to the tests themselves.
+- Actionable failures. Per-scenario pass/fail, continue-on-error to collect the whole matrix, and
+  artifact capture (redacted logs, `compose ps`, `.env`-minus-secrets, dashboard responses) on
+  failure.
+- Secrets hygiene. Tokens, RPC creds, and onions are never printed; preservation is checked by
+  hashing on the box; all artifacts pass a redactor.
+- Reproducible. The live run records a manifest (stack `VERSION`, git rev, image digests).
+- Test code is real code. The same lint (shellcheck), coverage gate, and inventory drift check
+  apply to the tests themselves.
 
 ### Flake policy
 
-Integration scenarios **quarantine, never blind-retry**: a scenario that fails intermittently
-is marked and investigated, not wrapped in a retry loop that hides a real race. The waiters
-have generous timeouts so a slow-but-correct stack passes while a genuinely broken one fails
-fast with artifacts.
+Integration scenarios quarantine, never blind-retry. A scenario that fails intermittently is
+marked and investigated, not wrapped in a retry loop that hides a real race. The waiters have
+generous timeouts so a slow-but-correct stack passes while a genuinely broken one fails fast with
+artifacts.
 
 ### Known gaps (honest)
 
-These are deliberately **not** yet covered and are the road to full production confidence:
-
-- **First green run on real hardware.** ✅ Two of the three real-environment tiers are green:
-  the live harness `--check` (tier 4 read path — 22/22 against a synced, mining box) and the
-  fake-daemon mini-stack (tier 3 — 11/11 on a real Docker host). Between them they surfaced and
-  fixed four bugs: the dashboard pruned/full label (#32); the harness's three over-strict
-  assertions (monero-synced, conns, prune display); the fake Tari binding gRPC to loopback; and
-  the mini-stack's container-name/port isolation. Still pending: the full **destructive** config
-  matrix run on the box (its read path is already proven via `--check`).
-- **Destructive-matrix safety.** ✅ `run.sh --safety-backup` takes a real `pithead backup`
-  before the destructive scenarios and **automatically rolls the box back** (down → restore →
-  up) if anything fails; the archive is removed on success. So the matrix can run on a precious
-  box with a one-command rollback net.
-- **CLI breadth in automation.** ✅ `backup`/`restore` are now exercised end-to-end — by
-  `--safety-backup` and by a `--lifecycle` backup→restore round-trip (assert the pool reverts
-  and secrets survive). `reset-dashboard` and `upgrade` are still only unit-covered (upgrade
-  belongs to the release staging smoke test, since it rebuilds/pulls the bundle under test).
-- **Soak / longevity.** No multi-hour run asserting no leaks, no log/DB growth runaway, and that
-  the XvB controller converges over a realistic window.
-- **Load / capacity.** No test drives many workers or high share rates to find limits.
-- **Security review.** The compose **hardening invariants are regression-guarded** (the #90
-  section of `tests/stack/test_compose.sh`: RPC creds never in a healthcheck command,
+These are deliberately not yet covered and are the road to full production confidence.
+
+- First green run on real hardware. ✅ Two of the three real-environment tiers are green: the live
+  harness `--check` (tier 4 read path, 22/22 against a synced, mining box) and the fake-daemon
+  mini-stack (tier 3, 11/11 on a real Docker host). Between them they surfaced and fixed four bugs:
+  the dashboard pruned/full label (#32); the harness's three over-strict assertions (monero-synced,
+  conns, prune display); the fake Tari binding gRPC to loopback; and the mini-stack's
+  container-name/port isolation. Still pending: the full destructive config matrix run on the box
+  (its read path is already proven via `--check`).
+- Destructive-matrix safety. ✅ `run.sh --safety-backup` takes a real `pithead backup` before the
+  destructive scenarios and automatically rolls the box back (down → restore → up) if anything
+  fails; the archive is removed on success. So the matrix can run on a precious box with a
+  one-command rollback net.
+- CLI breadth in automation. ✅ `backup`/`restore` are now exercised end-to-end: by
+  `--safety-backup` and by a `--lifecycle` backup→restore round-trip (assert the pool reverts and
+  secrets survive). `reset-dashboard` and `upgrade` are still only unit-covered (upgrade belongs to
+  the release staging smoke test, since it rebuilds/pulls the bundle under test).
+- Soak / longevity. No multi-hour run asserting no leaks, no log/DB growth runaway, and that the
+  XvB controller converges over a realistic window.
+- Load / capacity. No test drives many workers or high share rates to find limits.
+- Security review. The compose hardening invariants are regression-guarded (the #90 section of
+  `tests/stack/test_compose.sh`: RPC creds never in a healthcheck command,
   `no-new-privileges` / `cap_drop` on the leaf containers, the Docker socket proxies stay
-  least-privilege), so a past fix can't be silently undone. A full security *audit* is still a
-  separate exercise (`SECURITY.md`) — these tests pin the decisions we've already made, they
-  don't find new ones.
+  least-privilege), so a past fix can't be silently undone. A full security audit is still a
+  separate exercise (`SECURITY.md`). These tests pin the decisions we've already made; they don't
+  find new ones.
+
+### Coverage-audit follow-ups (2026-06)
+
+A source-vs-tests audit added Tier-1 coverage for a real bug (snapshot serialization failure left
+the #131 persistence badge green), the firewall install-failure rollback (#270), the wallet
+hard-fail guards (#250), remote-host/subnet validation (#180), `ensure_owner`'s whole-tree scan
+(#255), and several dashboard render branches (per-worker api/reject badges, XvB/Unknown pool
+badges, the #278/#313 Tari-✔ invariant, `Gauge` done vs syncing). The gaps it surfaced that are
+**not yet covered at an automatable tier** — all needing Docker or the real box, so they land at
+tier 3/4:
+
+- **Firewall rollback, real kernel.** ✅ Now a tier-4 `--fault-injection` case: it shadows `iptables`
+  with a wrapper that fails every `-I` insert, re-runs `apply_tor_egress_firewall`, and asserts the
+  box ends fail-closed (no `pithead-tor-egress` rule left half-installed), then reinstates the real
+  firewall. The tier-1 stubbed test proves the control flow; this proves the real-kernel strip.
+  Runs at the release gate only (destructive-then-restored, local box).
+- **`ensure_owner` real mixed-ownership tree.** ✅ Now a tier-4 `--lifecycle` step: it plants a
+  root-owned file under the dashboard data dir and asserts the pool-flip `apply` (which runs
+  `ensure_directories` → `ensure_owner`) chowns it to uid 1000 — the #255 "scan contents, not just
+  the dir" regression. Runs at the release gate only (needs root to create a foreign-uid inode).
+- **Real-container monerod failover in PR CI.** The primary-node reject/readmit cycle only runs on
+  the manual tier-4 box (`--fault-injection`); the mini-stack (tier 3) breaks Tari, not monerod.
+- **Non-blocking-Tari "ignore" path with real containers.** Unit-tested only; the mini-stack proves
+  Tari-down-while-required (reject) but never Tari-down-while-optional (keep mining). This is the
+  path that silently kills yield if it regresses to a reject.
+- **monerod busy / mid-reorg failover.** The contract test proves the client reads a busy node as
+  unreachable; no mini-stack or fault-injection scenario asserts the dashboard actually rejects
+  workers on a busy-but-alive node (a real reorg state, distinct from a clean stop).
+- **Double outage, both-must-recover.** Unit-tested (monerod ∧ Tari down → readmit only when both
+  healthy); never driven with real containers, so the recovery ordering is unproven end-to-end.
+- **Partial-start / stop-failure idempotency.** The control loop's "container fails to start/stop →
+  retry next cycle" is unit-only; no tier-3/4 scenario injects a docker start/stop error.
+- **`pithead doctor` on a real box.** Only its exit code is unit-tested; its NTP/clock-drift check
+  (mining is time-sensitive) is never fault-injected or asserted at tier 4.
+- **Disk-full / ENOSPC verdict.** Only a disk-headroom *warning* is checked; a real
+  container-unhealthy-on-ENOSPC verdict is never forced, though the disk badge + db-write-error
+  paths are unit-tested.
+- **Tor-container-down partial start.** No Caddy/Tor services exist in the mini-stack compose, so
+  "what happens when the Tor container is down" (SOCKS unreachable) is exercised at no tier below
+  the manual real box; every all-Tor egress assertion is read-path only.
+- **Insecure + main matrix row.** `dashboard.secure=false` only ever pairs with `p2pool.pool=nano`,
+  so the Caddy-scheme / bind assertions for insecure mode are entangled with the nano path; an
+  insecure+main regression has no row.
 
 ## Adding a scenario
 
-- **Logic** (a new decision/branch) → a unit test (tier 1). Cheapest, fastest.
-- **A new daemon state** the clients must parse → extend the fakes + the contract test (tier 2),
-  and it becomes drivable in the mini-stack (tier 3).
-- **A config axis** → one row in `tests/integration/scenarios.sh` (tier 4). The self-test
-  enforces every axis value is covered.
-- **A failure mode needing real containers** → a fault in `run.sh`'s fault-injection phase
-  (tier 4) and/or a mini-stack scenario (tier 3).
+- Logic (a new decision/branch) → a unit test (tier 1). Cheapest, fastest.
+- A new daemon state the clients must parse → extend the fakes plus the contract test (tier 2), and
+  it becomes drivable in the mini-stack (tier 3).
+- A config axis → one row in `tests/integration/scenarios.sh` (tier 4). The self-test enforces
+  every axis value is covered.
+- A failure mode needing real containers → a fault in `run.sh`'s fault-injection phase (tier 4)
+  and/or a mini-stack scenario (tier 3).
 
 Keep each situation at the lowest honest tier; don't re-prove logic with a heavier harness.
diff --git a/docs/workers.md b/docs/workers.md
index 03f308b0..6c9b98bb 100644
--- a/docs/workers.md
+++ b/docs/workers.md
@@ -1,14 +1,13 @@
 # Connecting Miners
 
-This stack is the **orchestrator** for your mining operation: every miner you own connects to a
-**single endpoint**, and the stack routes their combined hashrate — handling pool selection,
-payouts, and the P2Pool/XvB split centrally. Your miners stay dead simple; all the coordination
-lives here.
+How to point miners at the stack. Every miner you own connects to one endpoint, and the stack routes
+their combined hashrate: pool selection, payouts, and the P2Pool/XvB split are handled centrally.
+Miners stay simple; all the coordination lives here.
 
-The endpoint is the `xmrig-proxy` service on port **3333**.
+The endpoint is the `xmrig-proxy` service on port `3333`.
 
-> **You do not put a wallet address in your miner config.** Payouts are managed by the P2Pool
-> service on the stack — miners only need to know *where the stack is*.
+> You do not put a wallet address in your miner config. Payouts are managed by the P2Pool service on
+> the stack. Miners only need to know where the stack is.
 
 ---
 
@@ -28,65 +27,65 @@ stack and you're done. Use the machine running the stack as the host, on port `3
 }
 ```
 
-That's the whole pool config. Start the miner and it appears in the dashboard's **Workers Alive**
-table within a few seconds.
+That's the whole pool config. Start the miner and it appears in the dashboard's Workers Alive table
+within a few seconds.
 
-- **`user` is just a label** for the rig — use its hostname so you can tell workers apart on the
-  dashboard. (No wallet address — see above.)
-- **Point all your rigs at the same `YOUR_STACK_IP:3333`.** The stack aggregates them; there's
-  nothing per-rig to configure beyond the label.
-- **`YOUR_STACK_IP`** is the stack host's IP or a DNS-resolvable hostname. For a stable address
-  on a home LAN, set a DHCP reservation (or a static IP) for the stack host.
-- **Add a backup pool for automatic failover.** List a second entry in `pools` (a public pool, or
-  another stack). If your Monero node goes down or is still syncing, the stack briefly stops
-  accepting work so your rigs **fail over to the backup automatically** — and switch back the moment
-  it recovers. You never sit idle on a stalled node.
+- `user` is just a label for the rig. Use its hostname so you can tell workers apart on the
+  dashboard. (No wallet address; see above.)
+- Point all your rigs at the same `YOUR_STACK_IP:3333`. The stack aggregates them; there's nothing
+  per-rig to configure beyond the label.
+- `YOUR_STACK_IP` is the stack host's IP or a DNS-resolvable hostname. For a stable address on a home
+  LAN, set a DHCP reservation (or a static IP) for the stack host.
+- Add a backup pool for automatic failover. List a second entry in `pools` (a public pool, or another
+  stack). If your Monero node goes down or is still syncing, the stack briefly stops accepting work so
+  your rigs fail over to the backup automatically, then switch back the moment it recovers. You never
+  sit idle on a stalled node.
 
 ### Miner version & compatibility
 
-There's **no required miner version**. The stack's `xmrig-proxy` and P2Pool speak the standard
-Stratum protocol and accept any miner that supports NiceHash (XMRig enables this automatically when
-it connects through a proxy). Any reasonably recent **XMRig (5.0+, which introduced RandomX)** works
-— the stack's component versions don't dictate a miner version. When in doubt, run the latest XMRig.
+There's no required miner version. The stack's `xmrig-proxy` and P2Pool speak the standard Stratum
+protocol and accept any miner that supports NiceHash (XMRig enables this automatically when it
+connects through a proxy). Any reasonably recent XMRig (5.0+, which introduced RandomX) works; the
+stack's component versions don't dictate a miner version. When in doubt, run the latest XMRig.
 
 ### Networking notes
 
-- Miners connect over your local network (plain stratum). The Tor layer is for the stack's
-  *upstream* connections to the Monero/Tari/P2Pool networks — **your rigs don't need Tor**.
+- Miners connect over your local network (plain stratum). The Tor layer is for the stack's upstream
+  connections to the Monero/Tari/P2Pool networks. Your rigs don't need Tor.
 
 ### Firewall
 
-- Port **3333** must be reachable from each miner to the stack machine. If the stack host has a
+- Port `3333` must be reachable from each miner to the stack machine. If the stack host has a
   firewall, allow inbound `3333` from your LAN.
-- By default the stack publishes `3333` on **all** of the host's interfaces (`0.0.0.0`) so any rig
-  on your LAN can connect with no extra setup. **On a host with a public IP, that port is reachable
-  from the internet** — plain stratum is unauthenticated by default, so it should never be exposed
-  there. Lock it down with controls that complement each other: narrow the **bind address** with
-  [`p2pool.stratum_bind`](configuration.md#configuration-reference), restrict the **source range**
-  with a host firewall, and/or require a **password** with [`p2pool.stratum_password`](#authentication).
-- **`pithead setup` and `doctor` flag this for you**: when the host has a public IP and stratum is
-  bound to all interfaces, they print a warning pointing back here. A NAT'd home host — no public IP
-  on its own interfaces — sees nothing, so this only nudges the hosts that are actually exposed.
+- By default the stack publishes `3333` on all of the host's interfaces (`0.0.0.0`) so any rig on
+  your LAN can connect with no extra setup. On a host with a public IP, that port is reachable from
+  the internet, and plain stratum is unauthenticated by default, so it should never be exposed there.
+  Lock it down with controls that complement each other: narrow the bind address with
+  [`p2pool.stratum_bind`](configuration.md#configuration-reference), restrict the source range with a
+  host firewall, and/or require a password with [`p2pool.stratum_password`](#authentication).
+- `pithead setup` and `doctor` flag this for you: when the host has a public IP and stratum is bound
+  to all interfaces, they print a warning pointing back here. A NAT'd home host (no public IP on its
+  own interfaces) sees nothing, so this only nudges the hosts that are actually exposed.
 
 #### `p2pool.stratum_bind` — which interface to listen on
 
-This is the host **bind address**: it controls *which network interface* the `3333` port is
-published on. It takes a **single IPv4 address** (it maps directly to Docker's port-publish host
-IP), **not** a subnet/CIDR — `192.168.1.0/24` is invalid and is rejected at setup.
+This is the host bind address: it controls which network interface the `3333` port is published on.
+It takes a single IPv4 address (it maps directly to Docker's port-publish host IP), not a
+subnet/CIDR. `192.168.1.0/24` is invalid and is rejected at setup.
 
 | Value | Effect |
 |---|---|
-| `0.0.0.0` (default) | All interfaces — every rig on the LAN can connect (and the public IP, if any). |
-| `192.168.1.10` | Only the interface holding that LAN IP — not published on a public/WAN interface. Must be an IP actually assigned to the host. |
-| `127.0.0.1` | Loopback only — disables LAN access entirely (e.g. when every worker runs on the stack host itself). |
+| `0.0.0.0` (default) | All interfaces. Every rig on the LAN can connect (and the public IP, if any). |
+| `192.168.1.10` | Only the interface holding that LAN IP, not published on a public/WAN interface. Must be an IP actually assigned to the host. |
+| `127.0.0.1` | Loopback only. Disables LAN access entirely (e.g. when every worker runs on the stack host itself). |
 
-Narrowing the bind to a LAN IP stops the port appearing on a public interface, but **any host that
-can route to that LAN IP can still connect**. To allow only a specific subnet, use a firewall.
+Narrowing the bind to a LAN IP stops the port appearing on a public interface, but any host that can
+route to that LAN IP can still connect. To allow only a specific subnet, use a firewall.
 
 #### Restricting by subnet — use a firewall
 
-Limiting *which source addresses* may connect (e.g. only `192.168.1.0/24`) is source-based access
-control, which a bind address can't express — that's a firewall rule. Examples that allow your LAN
+Limiting which source addresses may connect (e.g. only `192.168.1.0/24`) is source-based access
+control, which a bind address can't express. That's a firewall rule. Examples that allow your LAN
 subnet and drop everything else on `3333`:
 
 ```bash
@@ -101,19 +100,19 @@ sudo nft add rule inet filter input tcp dport 3333 ip saddr 192.168.1.0/24 accep
 sudo nft add rule inet filter input tcp dport 3333 drop
 ```
 
-Adjust `192.168.1.0/24` to your own LAN range. Combining both — bind to the LAN IP **and**
-firewall the subnet — is the belt-and-suspenders setup for a host that also has a public IP.
+Adjust `192.168.1.0/24` to your own LAN range. Combining both (bind to the LAN IP and firewall the
+subnet) is the belt-and-suspenders setup for a host that also has a public IP.
 
 If a worker doesn't show up, see
 [Operations › Troubleshooting](operations.md#troubleshooting).
 
 ### Authentication
 
-By default `3333` accepts **any** rig that can reach it — the stratum `pass` is ignored. To require a
-shared secret, set [`p2pool.stratum_password`](configuration.md#configuration-reference); the proxy
+By default `3333` accepts any rig that can reach it; the stratum `pass` is ignored. To require a
+shared secret, set [`p2pool.stratum_password`](configuration.md#configuration-reference). The proxy
 then rejects any rig whose stratum `pass` doesn't match, so only devices you've configured can mine.
-That also means only they can register a worker name, which shrinks the worker-name **SSRF** surface
-(a malicious worker name is how an untrusted device could otherwise probe the dashboard's internals).
+That also means only they can register a worker name, which shrinks the worker-name SSRF surface (a
+malicious worker name is how an untrusted device could otherwise probe the dashboard's internals).
 
 ```jsonc
 // config.json — "auto" generates a stable random secret; or set your own string
@@ -121,7 +120,7 @@ That also means only they can register a worker name, which shrinks the worker-n
 ```
 
 After `pithead apply`, the stack prints the password (it's also saved in `.env` as
-`PROXY_STRATUM_PASSWORD`). Add it as the `pass` field on **every** rig — rigs without it are rejected:
+`PROXY_STRATUM_PASSWORD`). Add it as the `pass` field on every rig; rigs without it are rejected:
 
 ```json
 {
@@ -135,26 +134,54 @@ After `pithead apply`, the stack prints the password (it's also saved in `.env`
 }
 ```
 
-Using **[RigForge](https://github.com/p2pool-starter-stack/rigforge)** (below)? It's the same
-`pools[].pass` field — set it in the rig's `config.json` and run `rigforge apply`. See
+Using [RigForge](https://github.com/p2pool-starter-stack/rigforge) (below)? It's the same
+`pools[].pass` field. Set it in the rig's `config.json` and run `rigforge apply`. See
 [RigForge › Pithead Integration › Stratum authentication](https://github.com/p2pool-starter-stack/rigforge/blob/main/docs/pithead-integration.md#stratum-authentication-optional).
 
-**Caveat:** the password travels in **cleartext** over the LAN (plain stratum has no TLS), so this is
-access control — *who may mine* — not eavesdropping protection. On a trusted LAN it's enough; if you
-must expose `3333` more widely, combine it with `stratum_bind` and a firewall (above). Leaving it
-unset (`""`, the default) keeps the open, no-password behavior.
+NOTE: the password travels in cleartext over the LAN (plain stratum has no TLS), so this is access
+control (who may mine), not eavesdropping protection. On a trusted LAN it's enough; if you must
+expose `3333` more widely, combine it with `stratum_bind` and a firewall (above). Leaving it unset
+(`""`, the default) keeps the open, no-password behavior.
+
+### Reading each worker's stats (the dashboard's worker API probe)
+
+Beyond what the proxy reports, the dashboard fetches each connected miner's own xmrig HTTP API
+(`http://<miner-ip>:8080/1/summary`) for uptime and per-miner hashrate. It does this one way, chosen
+by config; there's no trial-and-error. Defaults match a stock
+[RigForge](https://github.com/p2pool-starter-stack/rigforge) worker: an open, read-only API (xmrig
+`http.restricted` with no `access-token`) on port `8080`, so the standard stack needs no
+configuration.
+
+To point it at a differently-configured fleet, set
+[`workers.api_auth`](configuration.md#configuration-reference) (and `workers.api_port` /
+`workers.api_token`):
+
+| `workers.api_auth` | Use when… | Bearer sent |
+|---|---|---|
+| `none` *(default)* | miners expose an open, restricted API (no token) | — |
+| `name` | each miner's `access-token` equals its stratum name | the worker's name |
+| `token` | all miners share one API token | `workers.api_token` |
+
+Only the worker's validated IP is ever contacted; a miner-controlled worker name is never used as a
+request host (the SSRF guard). If a probe fails, the worker isn't dropped: it keeps its
+proxy-reported hashrate and is flagged `api ⚠` on the dashboard, with a single log line naming the
+URL, status, and likely fix, so a misconfigured API reads differently from an offline miner.
+
+> Upgrading? Earlier builds provisioned each miner with `access-token = <worker name>`. If your
+> miners still carry a token, set `workers.api_auth: name`, otherwise the new no-auth default probe
+> gets `401` and every worker shows `api ⚠`. (Reprovisioning the miners to drop the token is the
+> other option; new RigForge workers ship open by default.)
 
 ---
 
 ## New to mining? Start with RigForge
 
-If you don't have miners set up yet — or you want the best hashrate without hand-tuning — use
-**[RigForge](https://github.com/p2pool-starter-stack/rigforge)**, the companion miner kit for this
-stack.
+If you don't have miners set up yet, or you want the best hashrate without hand-tuning, use
+[RigForge](https://github.com/p2pool-starter-stack/rigforge), the companion miner kit for this stack.
 
-RigForge turns a fresh machine into a fully tuned worker in one command: it builds XMRig from
-source, applies CPU- and kernel-level tuning (HugePages, MSR, NUMA), and runs it as a managed
-service. During setup it asks for your stack's hostname and wires up the `3333` connection for you.
+RigForge turns a fresh machine into a tuned worker in one command: it builds XMRig from source,
+applies CPU- and kernel-level tuning (HugePages, MSR, NUMA), and runs it as a managed service. During
+setup it asks for your stack's hostname and wires up the `3333` connection for you.
 
 ```bash
 git clone https://github.com/p2pool-starter-stack/rigforge.git
@@ -163,8 +190,8 @@ chmod +x rigforge.sh
 sudo ./rigforge.sh
 ```
 
-See the **[RigForge README](https://github.com/p2pool-starter-stack/rigforge)** for the full guide,
-including **[worker hardware requirements](https://github.com/p2pool-starter-stack/rigforge#-hardware-requirements)**,
+See the [RigForge README](https://github.com/p2pool-starter-stack/rigforge) for the full guide,
+including [worker hardware requirements](https://github.com/p2pool-starter-stack/rigforge#-hardware-requirements),
 kernel tuning, and verification.
 
 ---
@@ -173,4 +200,4 @@ kernel tuning, and verification.
 
 - [Getting Started](getting-started.md) — first-run setup and what to expect while the node syncs.
 - [The Dashboard](dashboard.md) — the Workers Alive table and per-worker stats.
-- [Hardware Requirements](hardware.md) — sizing the **stack host** (miners are sized in RigForge).
+- [Hardware Requirements](hardware.md) — sizing the stack host (miners are sized in RigForge).
diff --git a/images/launch/README.md b/images/launch/README.md
index 5c6b4aba..798647cd 100644
--- a/images/launch/README.md
+++ b/images/launch/README.md
@@ -1,7 +1,7 @@
 # Launch assets
 
-Marketing/launch visuals for the Pithead dashboard (Issue #80). Static views ship in **dark** and
-**light** themes (`*-light.png`), so docs can serve a theme-adaptive `<picture>`.
+Marketing/launch visuals for the Pithead dashboard (Issue #80). Static views ship in dark and light
+themes (`*-light.png`), so docs can serve a theme-adaptive `<picture>`.
 
 | Asset | Files | What |
 |---|---|---|
@@ -12,16 +12,16 @@ Marketing/launch visuals for the Pithead dashboard (Issue #80). Static views shi
 | **Demo GIF** | `demo.gif` | ~12s scroll-tour of the Advanced dashboard (600×338) |
 | **Social preview** | `social-preview.png` | 1280×640 card for GitHub's repo social preview (Settings → Social preview) |
 
-**These are illustrative mockups.** Static views are rendered from the **real dashboard UI** (the
-shipping Preact components + `dashboard.css`) fed a **synthetic `/api/state`** payload, so they are
-pixel-accurate to the product — but the numbers (a ~847 kH/s farm holding the Whale XvB tier, 14
-workers, etc.) and the wallet/host values are **fabricated for presentation**. No real wallet, host,
-or operator data appears in any of them (wallet fields are obvious `EXAMPLE` placeholders).
+These are illustrative mockups. Static views are rendered from the real dashboard UI (the shipping
+Preact components + `dashboard.css`) fed a synthetic `/api/state` payload, so they are pixel-accurate
+to the product. The numbers (a ~847 kH/s farm holding the Whale XvB tier, 14 workers, etc.) and the
+wallet/host values are fabricated for presentation. No real wallet, host, or operator data appears
+in any of them (wallet fields are obvious `EXAMPLE` placeholders).
 
 Static views rendered at retina 2× (`hero*` 2880×600; `sync*` 2880×1336; `simple*`/`advanced*`
 full-page). Used in the [README](../../README.md) (hero + demo GIF) and
 [docs/dashboard.md](../../docs/dashboard.md) (Simple / Advanced / Sync).
 
-> **`social-preview.png` is not wired up automatically** — GitHub's repo social-preview image can
-> only be set from the web UI: **repo → Settings → General → Social preview → Edit → upload
-> `social-preview.png`**.
+> NOTE: `social-preview.png` is not wired up automatically. GitHub's repo social-preview image can
+> only be set from the web UI: repo → Settings → General → Social preview → Edit → upload
+> `social-preview.png`.
diff --git a/pithead b/pithead
index 0d5712db..1fc0d00a 100755
--- a/pithead
+++ b/pithead
@@ -16,15 +16,24 @@ set -Eeuo pipefail
 # --- Logging Utilities ---
 # Colour only when stdout is a terminal and NO_COLOR is unset (https://no-color.org).
 if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
-    C_RESET='\033[0m'; C_GREEN='\033[1;32m'; C_YELLOW='\033[1;33m'; C_RED='\033[1;31m'
+    C_RESET='\033[0m'
+    C_GREEN='\033[1;32m'
+    C_YELLOW='\033[1;33m'
+    C_RED='\033[1;31m'
 else
-    C_RESET=''; C_GREEN=''; C_YELLOW=''; C_RED=''
+    C_RESET=''
+    C_GREEN=''
+    C_YELLOW=''
+    C_RED=''
 fi
 readonly C_RESET C_GREEN C_YELLOW C_RED
 
 log() { echo -e "${C_GREEN}[STACK]${C_RESET} $1"; }
 warn() { echo -e "${C_YELLOW}[WARNING]${C_RESET} $1" >&2; }
-error() { echo -e "${C_RED}[ERROR]${C_RESET} $1" >&2; exit 1; }
+error() {
+    echo -e "${C_RED}[ERROR]${C_RESET} $1" >&2
+    exit 1
+}
 
 on_err() {
     local ec=$?
@@ -33,11 +42,19 @@ on_err() {
 }
 
 # Detect Operating System
-OS_TYPE="$(uname -s)"; readonly OS_TYPE
+OS_TYPE="$(uname -s)"
+readonly OS_TYPE
 readonly CONFIG_FILE="config.json"
 readonly ENV_FILE=".env"
 readonly REAL_USER="${SUDO_USER:-$USER}"
 
+# Non-root uid:gid the BUILT images run their main process as (#255). pithead owns the data dirs,
+# so it chowns each service's bind-mount to this id to match the in-image USER. Tor is the
+# exception — it keeps its own alpine 'tor' user (100:101). Was $REAL_USER when every container
+# ran as root; existing installs are migrated in place by ensure_owner on the next apply/upgrade.
+readonly APP_UID=1000
+readonly APP_GID=1000
+
 REBOOT_REQUIRED=false
 SKIP_OPTIMIZE=0
 SKIP_DEPS=0
@@ -91,7 +108,7 @@ migrate_compose_project() {
         [ -n "$cid" ] || continue
         proj=$(docker inspect --format '{{index .Config.Labels "com.docker.compose.project"}}' "$cid" 2>/dev/null) || proj=""
         [ "$proj" = "$dir_project" ] && stale+=("$name")
-    done <<< "$names"
+    done <<<"$names"
 
     [ "${#stale[@]}" -gt 0 ] || return 0
     warn "Migrating this stack from the old Compose project '$dir_project' to '$our_project'."
@@ -105,10 +122,13 @@ migrate_compose_project() {
 # space"), which happens when the host already uses the stack's /24.
 explain_subnet_collision() {
     case "$1" in
-        *"overlaps with other one"*|*"Pool overlaps"*)
-            local sub; sub="$(env_get NETWORK_SUBNET 2>/dev/null || true)"; [ -n "$sub" ] || sub="172.28.0.0/24"
-            warn "Docker refused the stack's bridge subnet ($sub): it overlaps a network already on this host."
-            warn "Pick a free /24 and set it in ${CONFIG_FILE:-config.json} — e.g.  \"network\": { \"subnet\": \"172.30.0.0/24\" }  — then re-run '$0 apply' && '$0 up' (see docs/configuration.md, network.subnet)." ;;
+    *"overlaps with other one"* | *"Pool overlaps"*)
+        local sub
+        sub="$(env_get NETWORK_SUBNET 2>/dev/null || true)"
+        [ -n "$sub" ] || sub="172.28.0.0/24"
+        warn "Docker refused the stack's bridge subnet ($sub): it overlaps a network already on this host."
+        warn "Pick a free /24 and set it in ${CONFIG_FILE:-config.json} — e.g.  \"network\": { \"subnet\": \"172.30.0.0/24\" }  — then re-run '$0 apply' && '$0 up' (see docs/configuration.md, network.subnet)."
+        ;;
     esac
 }
 
@@ -123,8 +143,10 @@ is_source_checkout() { [ -f build/dashboard/Dockerfile ]; }
 # while a release install pulls them: `missing`. Override with PITHEAD_PULL (e.g. `always` to force a
 # re-pull on upgrade).
 resolve_pull_policy() {
-    if [ -n "${PITHEAD_PULL:-}" ]; then printf '%s' "$PITHEAD_PULL"
-    elif is_source_checkout; then printf 'never'
+    if [ -n "${PITHEAD_PULL:-}" ]; then
+        printf '%s' "$PITHEAD_PULL"
+    elif is_source_checkout; then
+        printf 'never'
     else printf 'missing'; fi
 }
 
@@ -135,7 +157,8 @@ compose_up_checked() {
     tmp="$(mktemp)"
     docker compose up --pull "$(resolve_pull_policy)" "$@" 2>&1 | tee "$tmp"
     rc=${PIPESTATUS[0]}
-    out="$(cat "$tmp")"; rm -f "$tmp"
+    out="$(<"$tmp")"
+    rm -f "$tmp"
     [ "$rc" -ne 0 ] && explain_subnet_collision "$out"
     return "$rc"
 }
@@ -144,6 +167,12 @@ stack_up() {
     log "Starting stack..."
     warn_missing_data_dirs
     migrate_compose_project
+    # Install the Tor-only egress firewall BEFORE the containers start (#270). DOCKER-USER is a static
+    # chain whose rules reference the fixed subnet/Tor IP, so they can go in before the network exists;
+    # Docker preserves DOCKER-USER and (re)adds the FORWARD jump when it creates the network. Doing this
+    # first closes the startup window in which a clearnet app (e.g. Tari) could open a connection that
+    # the ESTABLISHED rule would then grandfather past the DROP.
+    apply_tor_egress_firewall
     # Docker Compose automatically picks up COMPOSE_PROFILES from .env
     if ! compose_up_checked -d; then
         error "Stack failed to start — see the error above."
@@ -156,6 +185,7 @@ stack_up() {
 
 stack_down() {
     log "Stopping stack..."
+    remove_tor_egress_firewall
     docker compose down
     log "Stack stopped."
 }
@@ -166,6 +196,85 @@ stack_restart() {
     log "Stack restarted."
 }
 
+# --- Tor-only egress enforcement (#270) ---------------------------------------------------------
+# Fail-closed host firewall so a misconfigured/buggy bridge daemon (monerod/p2pool/tari/xmrig-proxy)
+# CAN'T leak the home IP: each may reach the LAN, the other containers and the Tor SOCKS, but any
+# DIRECT clearnet dial is DROPPED — only the `tor` container reaches the internet. Rules live in
+# Docker's DOCKER-USER chain (preserved across Docker restarts), installed BEFORE containers start on
+# every path that brings a clearnet-capable app up — `up`, `upgrade`, `apply`, `reset-dashboard` (so
+# there is no startup window to grandfather a leak past) — and removed at `down`. Needs
+# root (sudo), like the GRUB/HugePages steps; IPv4-only (mining_net is IPv4). Opt out with
+# network.tor_egress_firewall=false. Proven by tests/integration/benchmarks/bench-verify-egress.sh.
+# See docs/privacy.md.
+TOR_EGRESS_TAG="pithead-tor-egress"
+
+# Ordered iptables rule bodies (no chain/comment) for <subnet> <tor_ip>. Pure (args only) so it
+# unit-tests; ACCEPTs first, DROP last — the order is load-bearing.
+tor_egress_rules() { # <subnet> <tor_ip>
+    local subnet="$1" tor_ip="$2"
+    printf '%s\n' \
+        "-m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT" \
+        "-s $tor_ip -j ACCEPT" \
+        "-s $subnet -d 10.0.0.0/8 -j ACCEPT" \
+        "-s $subnet -d 172.16.0.0/12 -j ACCEPT" \
+        "-s $subnet -d 192.168.0.0/16 -j ACCEPT" \
+        "-s $subnet -d 100.64.0.0/10 -j ACCEPT" \
+        "-s $subnet -j DROP"
+}
+
+# Remove every rule we previously installed (matched by the comment tag) — idempotent, config-agnostic.
+remove_tor_egress_firewall() {
+    command -v iptables >/dev/null 2>&1 || return 0
+    local saved match line
+    saved=$(sudo iptables-save 2>/dev/null) || return 0
+    # Our tagged DOCKER-USER rules (empty if none). `|| true` so a no-match grep (rc 1, under
+    # `set -e`/pipefail) doesn't abort — removal is best-effort + idempotent.
+    match=$(printf '%s\n' "$saved" | grep -- '^-A DOCKER-USER' | grep -F -- "$TOR_EGRESS_TAG") || true
+    [ -n "$match" ] || return 0
+    while IFS= read -r line; do
+        [ -n "$line" ] || continue
+        # shellcheck disable=SC2086  # intentional word-splitting of the saved rule spec
+        sudo iptables -D DOCKER-USER ${line#-A DOCKER-USER } 2>/dev/null || true
+    done <<<"$match"
+    return 0
+}
+
+# Install (or re-install, idempotently) the fail-closed Tor-only egress rules. Reads the toggle +
+# subnet from .env so it works in the `up` path (where config.json isn't re-parsed).
+apply_tor_egress_firewall() {
+    local enabled subnet tor_ip pos=1 rule
+    enabled=$(env_get TOR_EGRESS_FIREWALL 2>/dev/null)
+    [ -n "$enabled" ] || enabled=true
+    remove_tor_egress_firewall # clear stale rules so a re-apply is idempotent
+    if [ "$(normalize_bool "$enabled")" != "true" ]; then
+        warn "Tor-only egress firewall is OFF (network.tor_egress_firewall=false) — a misconfigured app could reach clearnet (#270)."
+        return 0
+    fi
+    if ! command -v iptables >/dev/null 2>&1; then
+        warn "iptables not found — cannot enforce Tor-only egress (#270). The stack runs, but clearnet egress is NOT fail-closed."
+        return 0
+    fi
+    subnet=$(env_get NETWORK_SUBNET 2>/dev/null)
+    [ -n "$subnet" ] || subnet="172.28.0.0/24"
+    tor_ip=$(env_get NETWORK_PREFIX 2>/dev/null)
+    [ -n "$tor_ip" ] || tor_ip="172.28.0"
+    tor_ip="${tor_ip}.25"
+    # DOCKER-USER may not exist yet on a first-ever `up` (Docker creates it with its first network).
+    # Pre-create it so installing here — before compose runs — succeeds; Docker adopts the existing
+    # chain and adds the FORWARD jump. Harmless (-N fails with rc 1) once the chain is already there.
+    sudo iptables -N DOCKER-USER 2>/dev/null || true
+    while IFS= read -r rule; do
+        # shellcheck disable=SC2086  # intentional word-splitting of the rule body
+        if ! sudo iptables -I DOCKER-USER "$pos" -m comment --comment "$TOR_EGRESS_TAG" $rule 2>/dev/null; then
+            warn "Could not install the Tor-egress firewall (needs root + iptables). Stack runs, but clearnet egress is NOT fail-closed (#270)."
+            remove_tor_egress_firewall
+            return 0
+        fi
+        pos=$((pos + 1))
+    done < <(tor_egress_rules "$subnet" "$tor_ip")
+    log "Tor-only egress enforced (#270): clearnet dials from $subnet dropped except via Tor ($tor_ip)."
+}
+
 stack_upgrade() {
     log "Upgrading stack (rebuilding containers)..."
     # A release (git pull) may change config templates, add/rename .env vars, or restructure the
@@ -177,7 +286,7 @@ stack_upgrade() {
     parse_and_validate_config
     load_preserved_state
     ensure_directories
-    resolve_dashboard_host        # non-interactive; sets HOST_IP for the render
+    resolve_dashboard_host # non-interactive; sets HOST_IP for the render
     # render_env writes DEPLOYMENT_COMPLETED=${DEPLOYMENT_COMPLETED:-false}; load_preserved_state
     # doesn't carry it, so re-assert it here (as apply does) — otherwise every upgrade rewrites the
     # flag to false and the next require_deployed command (up/apply/upgrade) errors "run setup". We
@@ -189,6 +298,13 @@ stack_upgrade() {
     generate_caddyfile
     log "Re-rendered generated config for the current release."
     migrate_compose_project
+    # (Re)assert the Tor-only egress firewall BEFORE compose — same ordering as stack_up (#276), for
+    # the same reason: if the firewall isn't already installed (e.g. `down` then `upgrade`), starting
+    # containers first opens a startup window where a clearnet app (Tari, #271) can open a connection
+    # that the leading ESTABLISHED rule then grandfathers past the DROP (#291). In normal operation
+    # it's already installed from `up` and this is a cheap idempotent re-apply. Runs after the .env
+    # render above so the toggle/subnet are current.
+    apply_tor_egress_firewall # Tor-only egress (#270), consistent with up/apply
     # Source checkout: rebuild the images from build/. Release install: pull the new published images
     # instead — force a re-pull so a moved tag is refreshed (#44).
     if is_source_checkout; then
@@ -210,7 +326,8 @@ stack_upgrade() {
 # the marker appears the node is Tor-only again and this reads false — which is why the status/doctor
 # warnings clear on their own. Read-only; safe from status/doctor/up.
 clearnet_state_dir() {
-    local sdir; sdir=$(env_get CLEARNET_STATE_DIR 2>/dev/null)
+    local sdir
+    sdir=$(env_get CLEARNET_STATE_DIR 2>/dev/null)
     [ -n "$sdir" ] && printf '%s' "$sdir" || printf '%s' "$PWD/data/clearnet-state"
 }
 monero_clearnet_exposed() {
@@ -267,10 +384,12 @@ stack_status() {
 
         cid=$(docker compose ps -aq "$s" 2>/dev/null | head -n1 || true)
         if [ -z "$cid" ]; then
-            state="missing"; health="none"
+            state="missing"
+            health="none"
         else
             info=$(docker inspect --format '{{.State.Status}} {{if .State.Health}}{{.State.Health.Status}}{{else}}none{{end}}' "$cid" 2>/dev/null || echo "unknown none")
-            state=${info%% *}; health=${info##* }
+            state=${info%% *}
+            health=${info##* }
         fi
 
         # Track required-node health (monerod/tari) to interpret a stopped proxy below.
@@ -292,18 +411,26 @@ stack_status() {
         fi
 
         case "$state" in
-            running)
-                case "$health" in
-                    healthy|none) printf '  %b✓%b %-13s running\n'  "$C_GREEN"  "$C_RESET" "$s" ;;
-                    starting)     printf '  %b…%b %-13s starting (health check pending)\n' "$C_YELLOW" "$C_RESET" "$s" ;;
-                    *)            printf '  %b⚠%b %-13s running but UNHEALTHY\n' "$C_YELLOW" "$C_RESET" "$s"; problems=$((problems + 1)) ;;
-                esac ;;
-            restarting)
-                printf '  %b✗%b %-13s restarting (possible crash loop — check logs)\n' "$C_RED" "$C_RESET" "$s"; problems=$((problems + 1)) ;;
+        running)
+            case "$health" in
+            healthy | none) printf '  %b✓%b %-13s running\n' "$C_GREEN" "$C_RESET" "$s" ;;
+            starting) printf '  %b…%b %-13s starting (health check pending)\n' "$C_YELLOW" "$C_RESET" "$s" ;;
             *)
-                printf '  %b✗%b %-13s %s\n' "$C_RED" "$C_RESET" "$s" "$state"; problems=$((problems + 1)) ;;
+                printf '  %b⚠%b %-13s running but UNHEALTHY\n' "$C_YELLOW" "$C_RESET" "$s"
+                problems=$((problems + 1))
+                ;;
+            esac
+            ;;
+        restarting)
+            printf '  %b✗%b %-13s restarting (possible crash loop — check logs)\n' "$C_RED" "$C_RESET" "$s"
+            problems=$((problems + 1))
+            ;;
+        *)
+            printf '  %b✗%b %-13s %s\n' "$C_RED" "$C_RESET" "$s" "$state"
+            problems=$((problems + 1))
+            ;;
         esac
-    done <<< "$expected"
+    done <<<"$expected"
 
     # A stopped p2pool/xmrig-proxy is normally intentional: the dashboard stops xmrig-proxy to
     # fail workers over a node-down (#31), and holds the miner until the required chains finish
@@ -311,7 +438,8 @@ stack_status() {
     # still be syncing), so report it as likely-intentional and point at the dashboard.
     local held name st why
     for held in "p2pool=$p2pool_state" "xmrig-proxy=$proxy_state"; do
-        name=${held%%=*}; st=${held#*=}
+        name=${held%%=*}
+        st=${held#*=}
         [ -z "$st" ] && continue
         if [ "$node_down" -eq 1 ]; then
             why="a node is down, so workers were rejected to fail over to backups"
@@ -343,11 +471,22 @@ stack_status() {
 # (e.g. /proc/meminfo) are skipped on macOS dev hosts.
 
 # Per-run tallies for the closing summary. Reset at the top of doctor().
-DR_OK=0; DR_WARN=0; DR_FAIL=0
+DR_OK=0
+DR_WARN=0
+DR_FAIL=0
 
-dr_ok()   { DR_OK=$((DR_OK + 1));     printf '  %b✓ OK%b   %s\n'   "$C_GREEN"  "$C_RESET" "$1"; }
-dr_warn() { DR_WARN=$((DR_WARN + 1)); printf '  %b⚠ WARN%b %s\n'   "$C_YELLOW" "$C_RESET" "$1"; }
-dr_fail() { DR_FAIL=$((DR_FAIL + 1)); printf '  %b✗ FAIL%b %s\n'   "$C_RED"    "$C_RESET" "$1"; }
+dr_ok() {
+    DR_OK=$((DR_OK + 1))
+    printf '  %b✓ OK%b   %s\n' "$C_GREEN" "$C_RESET" "$1"
+}
+dr_warn() {
+    DR_WARN=$((DR_WARN + 1))
+    printf '  %b⚠ WARN%b %s\n' "$C_YELLOW" "$C_RESET" "$1"
+}
+dr_fail() {
+    DR_FAIL=$((DR_FAIL + 1))
+    printf '  %b✗ FAIL%b %s\n' "$C_RED" "$C_RESET" "$1"
+}
 # Neutral note for context lines that aren't pass/fail (e.g. a skipped Linux-only check).
 dr_info() { printf '  %b•%b      %s\n' "$C_YELLOW" "$C_RESET" "$1"; }
 
@@ -356,11 +495,14 @@ dr_info() { printf '  %b•%b      %s\n' "$C_YELLOW" "$C_RESET" "$1"; }
 # system clock before you start mining"). Prints: synced | unsynced | unknown. Pure given the
 # timedatectl output, so a stubbed timedatectl makes the classification unit-testable.
 clock_sync_status() {
-    command -v timedatectl >/dev/null 2>&1 || { echo unknown; return; }
+    command -v timedatectl >/dev/null 2>&1 || {
+        echo unknown
+        return
+    }
     case "$(timedatectl show -p NTPSynchronized --value 2>/dev/null)" in
-        yes) echo synced ;;
-        no)  echo unsynced ;;
-        *)   echo unknown ;;
+    yes) echo synced ;;
+    no) echo unsynced ;;
+    *) echo unknown ;;
     esac
 }
 
@@ -371,8 +513,20 @@ docker_boot_enabled() {
     systemctl is-enabled docker.service >/dev/null 2>&1 || systemctl is-enabled docker.socket >/dev/null 2>&1
 }
 
+# True (rc 0) when the host CPU advertises AVX2 — RandomX wants it, but it's performance-only,
+# not fatal. Linux reads /proc/cpuinfo; macOS reads sysctl's machdep CPU features.
+cpu_has_avx2() {
+    if [ "$OS_TYPE" == "Darwin" ]; then
+        sysctl -a 2>/dev/null | grep "machdep.cpu" | grep -q "AVX2"
+    else
+        grep -q "avx2" /proc/cpuinfo 2>/dev/null
+    fi
+}
+
 doctor() {
-    DR_OK=0; DR_WARN=0; DR_FAIL=0
+    DR_OK=0
+    DR_WARN=0
+    DR_FAIL=0
     detect_os
 
     log "Running pithead diagnostics (read-only)..."
@@ -431,13 +585,7 @@ doctor() {
     # --- CPU: AVX2 (performance only) ---
     echo ""
     echo "CPU:"
-    local avx2_detected=0
-    if [ "$OS_TYPE" == "Darwin" ]; then
-        if sysctl -a 2>/dev/null | grep "machdep.cpu" | grep -q "AVX2"; then avx2_detected=1; fi
-    else
-        if grep -q "avx2" /proc/cpuinfo 2>/dev/null; then avx2_detected=1; fi
-    fi
-    if [ "$avx2_detected" -eq 1 ]; then
+    if cpu_has_avx2; then
         dr_ok "AVX2 supported."
     else
         dr_warn "AVX2 not detected — mining performance will be poor (performance only, not fatal)."
@@ -445,20 +593,21 @@ doctor() {
 
     # --- Time sync (mining is time-sensitive; P2Pool strongly recommends NTP before mining) ---
     case "$(clock_sync_status)" in
-        synced)   dr_ok "System clock is NTP-synchronized." ;;
-        unsynced) dr_warn "System clock is NOT NTP-synchronized — clock skew gets shares/blocks rejected. Enable time sync: 'sudo timedatectl set-ntp true' (or run chrony/systemd-timesyncd/ntpd)." ;;
-        *)        dr_info "Could not verify system-clock sync (no timedatectl) — make sure NTP is running; mining is time-sensitive." ;;
+    synced) dr_ok "System clock is NTP-synchronized." ;;
+    unsynced) dr_warn "System clock is NOT NTP-synchronized — clock skew gets shares/blocks rejected. Enable time sync: 'sudo timedatectl set-ntp true' (or run chrony/systemd-timesyncd/ntpd)." ;;
+    *) dr_info "Could not verify system-clock sync (no timedatectl) — make sure NTP is running; mining is time-sensitive." ;;
     esac
 
     # --- Monero payout address must be a PRIMARY address (p2pool can't pay subaddresses/integrated) (#250) ---
     if [ -f "$CONFIG_FILE" ]; then
-        local _mw; _mw=$(jq -r '.monero.wallet_address // empty' "$CONFIG_FILE" 2>/dev/null)
+        local _mw
+        _mw=$(jq -r '.monero.wallet_address // empty' "$CONFIG_FILE" 2>/dev/null)
         if [ -n "$_mw" ] && [ "$_mw" != "your_monero_wallet_address" ]; then
             case "$(monero_address_type "$_mw")" in
-                primary)    dr_ok   "Monero payout address is a primary address (p2pool/XvB can pay it)." ;;
-                subaddress) dr_fail "Monero payout address is a SUBADDRESS (8…) — p2pool CANNOT pay it, so you are NOT being paid. Set monero.wallet_address to your PRIMARY address (4…) and run 'pithead apply'." ;;
-                integrated) dr_fail "Monero payout address is an INTEGRATED address — p2pool can't pay it. Use your plain PRIMARY address (4…)." ;;
-                *)          dr_warn "Monero payout address doesn't look like a primary address (expected 95 chars starting with 4)." ;;
+            primary) dr_ok "Monero payout address is a primary address (p2pool/XvB can pay it)." ;;
+            subaddress) dr_fail "Monero payout address is a SUBADDRESS (8…) — p2pool CANNOT pay it, so you are NOT being paid. Set monero.wallet_address to your PRIMARY address (4…) and run 'pithead apply'." ;;
+            integrated) dr_fail "Monero payout address is an INTEGRATED address — p2pool can't pay it. Use your plain PRIMARY address (4…)." ;;
+            *) dr_warn "Monero payout address doesn't look like a primary address (expected 95 chars starting with 4)." ;;
             esac
         fi
     fi
@@ -488,7 +637,7 @@ doctor() {
         if [ -z "$mem_avail_kb" ]; then
             dr_warn "Could not read MemAvailable from /proc/meminfo."
         else
-            mem_avail_mb=$(( mem_avail_kb / 1024 ))
+            mem_avail_mb=$((mem_avail_kb / 1024))
             if [ "$mem_avail_mb" -ge 2048 ] 2>/dev/null; then
                 dr_ok "Free RAM: ${mem_avail_mb} MiB available."
             else
@@ -512,6 +661,24 @@ doctor() {
         dr_ok "No clearnet initial sync active — all node P2P is Tor-only (#183)."
     fi
 
+    # p2pool Tor-routing fail-safe (#273): with clearnet off, P2POOL_FLAGS carries the #165 --socks5;
+    # the RUNNING p2pool must actually carry it. A STALE p2pool image (pre-#165 entrypoint) ignores the
+    # env var and dials sidechain peers directly — over CLEARNET, exposing the home IP. The #270 firewall
+    # now DROPs that dial (so a stale p2pool just can't peer rather than leaking), but surface the cause
+    # loudly so the fix — rebuild with 'pithead upgrade' — is obvious instead of a silent leak/stall.
+    # Read the EXEC'd args from /proc/1/cmdline (the env flags are word-split in the entrypoint, so they
+    # never appear in the container's Args). Empty = p2pool not running (often an intentional sync hold
+    # #31/#35) — don't flag.
+    if printf '%s' "$(env_get P2POOL_FLAGS 2>/dev/null)" | grep -q -- '--socks5'; then
+        local _p2args
+        _p2args=$(docker exec p2pool cat /proc/1/cmdline 2>/dev/null | tr '\0' ' ')
+        case "$_p2args" in
+        "") : ;;
+        *--socks5*) dr_ok "p2pool routes outbound sidechain P2P via Tor (#165)." ;;
+        *) dr_fail "p2pool is NOT routing over Tor despite p2pool.clearnet=false — its sidechain P2P would hit CLEARNET (exposing your IP). Almost certainly a STALE p2pool image not applying P2POOL_FLAGS (#165/#273): run 'pithead upgrade' to rebuild it. (#270's egress firewall blocks the dial meanwhile, so p2pool can't peer until you do.)" ;;
+        esac
+    fi
+
     # --- Disk: free space per underlying filesystem ---
     echo ""
     echo "Disk:"
@@ -523,16 +690,26 @@ doctor() {
     # monero, tari, p2pool, dashboard, tor.
     local mono_dir tari_dir p2pool_dir dash_dir tor_dir doctor_prune
     if [ -f "$ENV_FILE" ]; then
-        mono_dir=$(env_get MONERO_DATA_DIR);     [ -n "$mono_dir" ]   || mono_dir="$PWD/data/monero"
-        tari_dir=$(env_get TARI_DATA_DIR);       [ -n "$tari_dir" ]   || tari_dir="$PWD/data/tari"
-        p2pool_dir=$(env_get P2POOL_DATA_DIR);   [ -n "$p2pool_dir" ] || p2pool_dir="$PWD/data/p2pool"
-        dash_dir=$(env_get DASHBOARD_DATA_DIR);  [ -n "$dash_dir" ]   || dash_dir="$PWD/data/dashboard"
-        tor_dir=$(env_get TOR_DATA_DIR);         [ -n "$tor_dir" ]    || tor_dir="$PWD/data/tor"
+        mono_dir=$(env_get MONERO_DATA_DIR)
+        [ -n "$mono_dir" ] || mono_dir="$PWD/data/monero"
+        tari_dir=$(env_get TARI_DATA_DIR)
+        [ -n "$tari_dir" ] || tari_dir="$PWD/data/tari"
+        p2pool_dir=$(env_get P2POOL_DATA_DIR)
+        [ -n "$p2pool_dir" ] || p2pool_dir="$PWD/data/p2pool"
+        dash_dir=$(env_get DASHBOARD_DATA_DIR)
+        [ -n "$dash_dir" ] || dash_dir="$PWD/data/dashboard"
+        tor_dir=$(env_get TOR_DATA_DIR)
+        [ -n "$tor_dir" ] || tor_dir="$PWD/data/tor"
         # .env renders MONERO_PRUNE as 1 (pruning on) / 0 (off); default to pruned if unset.
-        doctor_prune=$(env_get MONERO_PRUNE); [ -n "$doctor_prune" ] || doctor_prune=1
+        doctor_prune=$(env_get MONERO_PRUNE)
+        [ -n "$doctor_prune" ] || doctor_prune=1
     else
-        mono_dir="$PWD/data/monero"; tari_dir="$PWD/data/tari"; p2pool_dir="$PWD/data/p2pool"
-        dash_dir="$PWD/data/dashboard"; tor_dir="$PWD/data/tor"; doctor_prune=1
+        mono_dir="$PWD/data/monero"
+        tari_dir="$PWD/data/tari"
+        p2pool_dir="$PWD/data/p2pool"
+        dash_dir="$PWD/data/dashboard"
+        tor_dir="$PWD/data/tor"
+        doctor_prune=1
         dr_info "No data dirs in $ENV_FILE — checking the default ./data location."
     fi
     check_disk_grouped doctor "$doctor_prune" \
@@ -545,7 +722,7 @@ doctor() {
     if [ -n "$_stale" ]; then
         while IFS= read -r _l; do
             dr_warn "Data dir from .env not found: ${_l%%=*}=${_l#*=} — a relocated/copied install re-syncs from scratch. Move the data here, or set the data_dir in config.json and run 'apply'."
-        done <<< "$_stale"
+        done <<<"$_stale"
     elif [ "$(env_get DEPLOYMENT_COMPLETED 2>/dev/null)" = "true" ]; then
         dr_ok "Data directories named in .env are present."
     fi
@@ -639,8 +816,8 @@ reset_dashboard() {
     local assume_yes=0 arg
     for arg in "$@"; do
         case "$arg" in
-            -y|--yes) assume_yes=1 ;;
-            *) error "Unknown option for reset-dashboard: $arg. Run '$0 help'." ;;
+        -y | --yes) assume_yes=1 ;;
+        *) error "Unknown option for reset-dashboard: $arg. Run '$0 help'." ;;
         esac
     done
 
@@ -677,12 +854,18 @@ reset_dashboard() {
 
     log "Recreating data directories..."
     mkdir -p "$dashboard_dir" "$p2pool_dir"
-    sudo chown -R "$REAL_USER":"$REAL_USER" "$p2pool_dir"
+    # Owned by the non-root uid the dashboard + p2pool containers run as (#255).
+    sudo chown -R "$APP_UID":"$APP_GID" "$p2pool_dir" "$dashboard_dir"
     mkdir -p "$p2pool_dir/stats"
     sudo chmod -R 755 "$p2pool_dir/stats"
 
     log "Bringing services back up..."
-    docker compose up --pull "$(resolve_pull_policy)" -d dashboard p2pool
+    # p2pool can dial clearnet, so assert the Tor-only egress firewall BEFORE it starts (#270/#291).
+    # Idempotent if it's already present from `up`; closes the gap where running reset-dashboard on a
+    # `down` stack would otherwise bring p2pool up with no firewall installed at all.
+    apply_tor_egress_firewall
+    # Route through compose_up_checked so a subnet collision (#180) gets explained, like every other up-path.
+    compose_up_checked -d dashboard p2pool
 }
 
 # --- Backup / Restore ---
@@ -693,9 +876,9 @@ stack_backup() {
     local with_chains=0 assume_yes=0 was_running=0
     for arg in "$@"; do
         case "$arg" in
-            --with-chains) with_chains=1 ;;
-            -y|--yes) assume_yes=1 ;;
-            *) error "Unknown option for backup: $arg. Run '$0 help'." ;;
+        --with-chains) with_chains=1 ;;
+        -y | --yes) assume_yes=1 ;;
+        *) error "Unknown option for backup: $arg. Run '$0 help'." ;;
         esac
     done
 
@@ -794,7 +977,7 @@ stack_backup() {
 
     log "Creating backup archive..."
     # Read with sudo because the Tor data dir is owned by 100:101.
-    ( umask 077 && sudo tar -czf "$archive" -C "/" "${rel[@]}" )
+    (umask 077 && sudo tar -czf "$archive" -C "/" "${rel[@]}")
     sudo chown "$REAL_USER":"$REAL_USER" "$archive"
     chmod 600 "$archive"
 
@@ -813,9 +996,9 @@ stack_restore() {
     local assume_yes=0 archive="" arg
     for arg in "$@"; do
         case "$arg" in
-            -y|--yes) assume_yes=1 ;;
-            -*) error "Unknown option for restore: $arg. Run '$0 help'." ;;
-            *) [ -n "$archive" ] || archive="$arg" ;;
+        -y | --yes) assume_yes=1 ;;
+        -*) error "Unknown option for restore: $arg. Run '$0 help'." ;;
+        *) [ -n "$archive" ] || archive="$arg" ;;
         esac
     done
 
@@ -848,6 +1031,13 @@ stack_restore() {
     parse_and_validate_config
     log "Fixing Tor data ownership (100:101)..."
     sudo chown -R 100:101 "$TOR_DATA_DIR"
+    # The archive is extracted as root, so the restored dashboard DB (and any --with-chains data)
+    # comes back root-owned. The containers run non-root (#255), so hand each data dir back to the
+    # uid its container uses — conditional, so a same-owner archive is a no-op.
+    ensure_owner "$MONERO_DIR" "$APP_UID" "$APP_GID"
+    ensure_owner "$TARI_DIR" "$APP_UID" "$APP_GID"
+    ensure_owner "$P2POOL_DIR" "$APP_UID" "$APP_GID"
+    ensure_owner "$DASHBOARD_DIR" "$APP_UID" "$APP_GID"
 
     log "Restore complete. Start the stack with '$0 up'."
 }
@@ -917,8 +1107,8 @@ env_get_file() {
     local file="$1" key="$2" line
     [ -f "$file" ] || return 0
     line=$(grep -E "^$key=" "$file" 2>/dev/null) || true
-    line=${line%%$'\n'*}        # first matching line
-    printf '%s' "${line#*=}"    # value after the first '='
+    line=${line%%$'\n'*}     # first matching line
+    printf '%s' "${line#*=}" # value after the first '='
 }
 
 env_get() { env_get_file "$ENV_FILE" "$1"; }
@@ -926,18 +1116,44 @@ env_get() { env_get_file "$ENV_FILE" "$1"; }
 # Normalize a config truthy value to the literal "true"/"false". Accepts 1/true/yes/on
 # (case-insensitive) as true; everything else (incl. empty/absent) is false. Matches the
 # dashboard's MONERO_PRUNE parsing so config booleans read the same on both sides (#183).
+# ponytail: deliberately distinct from config_bool below — this normalizes an already-extracted
+# STRING; config_bool does the null-aware JSON READ. Merging them risks the #294 `// false` bug.
 normalize_bool() {
     case "$(printf '%s' "${1:-}" | tr '[:upper:]' '[:lower:]')" in
-        true|1|yes|on) printf 'true' ;;
-        *)             printf 'false' ;;
+    true | 1 | yes | on) printf 'true' ;;
+    *) printf 'false' ;;
     esac
 }
 
+# Read a JSON boolean from $CONFIG_FILE honouring an explicit `false`. jq's `//` treats `false` (not
+# just `null`) as empty, so `<path> // true` silently coerces a configured false back to the default —
+# we null-check instead. Args: <jq-path-expr> <default:true|false>. Pure given $CONFIG_FILE so it
+# unit-tests in isolation (#294 — this bug had broken the #270 firewall opt-out and xvb.tor=false).
+config_bool() {
+    jq -r "if $1 == null then $2 else $1 end" "$CONFIG_FILE"
+}
+
+# Monero pruning as the .env-style flag the dashboard reads: 1 (on) / 0 (off). Pruning is on
+# unless config explicitly sets monero.prune:false — via config_bool so that explicit false is
+# honoured, not coerced (#294). Tolerates a missing/unreadable config (defaults to pruned).
+monero_prune_flag() {
+    [ "$(config_bool '.monero.prune' true 2>/dev/null || echo true)" = "true" ] && echo 1 || echo 0
+}
+
+# p2pool outbound SOCKS flags (#165). p2pool's --onion-address only advertises an onion for INBOUND;
+# without --socks5 it dials outbound sidechain peers over clearnet, exposing the home IP. Returns the
+# Tor SOCKS flags by default; empty when the operator opts into clearnet (p2pool.clearnet=true) for
+# max yield. Pure (args only: <clearnet-bool> <network-prefix>) so it unit-tests in isolation.
+p2pool_outbound_flags() {
+    [ "$(normalize_bool "${1:-}")" = "true" ] && return 0
+    printf -- '--socks5 %s.25:9050 --socks5-proxy-type tor' "${2:-172.28.0}"
+}
+
 # Keys whose value differs between two env files (added, removed, or changed), one per line.
 env_changed_keys() {
-    comm -3 <(sort "$1") <(sort "$2") 2>/dev/null \
-        | sed -E 's/^[[:space:]]+//; s/=.*$//' \
-        | sort -u
+    comm -3 <(sort "$1") <(sort "$2") 2>/dev/null |
+        sed -E 's/^[[:space:]]+//; s/=.*$//' |
+        sort -u
 }
 
 # Compute the stack version + build provenance and EXPORT them for docker-compose's dashboard
@@ -951,7 +1167,7 @@ env_changed_keys() {
 export_build_provenance() {
     local commit=""
     export PITHEAD_VERSION="" PITHEAD_GIT_COMMIT="" PITHEAD_GIT_BRANCH=""
-    [ -f VERSION ] && PITHEAD_VERSION="$(tr -d ' \t\r\n' < VERSION 2>/dev/null || true)"
+    [ -f VERSION ] && PITHEAD_VERSION="$(tr -d ' \t\r\n' <VERSION 2>/dev/null || true)"
     if git rev-parse --git-dir >/dev/null 2>&1; then
         commit="$(git rev-parse --short HEAD 2>/dev/null || true)"
         PITHEAD_GIT_BRANCH="$(git rev-parse --abbrev-ref HEAD 2>/dev/null || true)"
@@ -989,9 +1205,24 @@ require_deployed() {
 
 # Refuse data directories that would be catastrophic to chown -R / rm -rf.
 assert_safe_dir() {
-    case "$1" in
-        ""|/|//|/.|/root|/home|/etc|/usr|/var|/bin|/sbin|/lib|/lib64|/boot|/dev|/proc|/sys)
-            error "Refusing to use '$1' as a data directory. Choose a dedicated folder in $CONFIG_FILE." ;;
+    local d="$1"
+    # 1) System + top-level roots, the invoking and real user's homes, and the bare mount/parent
+    #    dirs people most often fat-finger a data_dir to. A dedicated SUBfolder of any of these
+    #    (e.g. /srv/pithead, /mnt/disk/monero) is still allowed — only the bare root is refused (#91).
+    case "$d" in
+    "" | / | // | /. | /root | /home | /etc | /usr | /var | /var/lib | /opt | /srv | /mnt | /media | /tmp | /bin | /sbin | /lib | /lib64 | /boot | /dev | /proc | /sys | /Users | /Applications | "$HOME" | "/home/$REAL_USER" | "/Users/$REAL_USER")
+        error "Refusing to use '$d' as a data directory — it's a system, home, or bare mount root. Choose a dedicated subfolder in $CONFIG_FILE (e.g. .../pithead-data)."
+        ;;
+    esac
+    # 2) Data dirs are stored as ABSOLUTE paths in .env; reject anything relative or containing a
+    #    '..' traversal so a malformed config.json value can't resolve somewhere unexpected before
+    #    a chown -R / rm -rf runs against it (#91).
+    case "$d" in
+    /*) ;;
+    *) error "Refusing non-absolute data directory '$d' — set an absolute path in $CONFIG_FILE." ;;
+    esac
+    case "$d" in
+    *..*) error "Refusing data directory '$d' — '..' path traversal is not allowed." ;;
     esac
 }
 
@@ -1007,6 +1238,9 @@ safe_sed() {
 
 # Like safe_sed, but with sudo — for editing root-owned system files such as /etc/default/grub.
 # Same GNU/BSD in-place (-i) portability split as safe_sed.
+# ponytail: kept as a separate twin of safe_sed on purpose. Collapsing the two onto a shared
+# helper needs an unquoted `${1:+sudo}` (shellcheck disable) or an empty-array sudo toggle that's
+# fragile under `set -u` on macOS bash 3.2 — more risk than the 5 trivial duplicated lines is worth.
 sudo_sed() {
     if [ "$OS_TYPE" == "Darwin" ]; then
         sudo sed -i '' "$1" "$2"
@@ -1019,8 +1253,8 @@ sudo_sed() {
 # "use the stack default". $1 = configured value, $2 = default.
 resolve_default() {
     case "$1" in
-        ""|auto|DYNAMIC_DATA|DYNAMIC_HOST|DYNAMIC_ID) printf '%s' "$2" ;;
-        *) printf '%s' "$1" ;;
+    "" | auto | DYNAMIC_DATA | DYNAMIC_HOST | DYNAMIC_ID) printf '%s' "$2" ;;
+    *) printf '%s' "$1" ;;
     esac
 }
 
@@ -1042,25 +1276,25 @@ is_ipv4() {
 is_public_ip() {
     local addr="$1" a b h
     case "$addr" in
-        *:*)  # IPv6 — public only within 2000::/3 (first hextet 0x2000-0x3fff).
-            h="${addr%%:*}"
-            case "$h" in ""|*[!0-9a-fA-F]*) return 1 ;; esac
-            h=$(( 16#$h ))
-            [ "$h" -ge 8192 ] && [ "$h" -le 16383 ]
-            ;;
-        *.*)  # IPv4 dotted-quad.
-            is_ipv4 "$addr" || return 1
-            IFS=. read -r a b _ _ <<<"$addr"
-            case "$a" in
-                0|10|127) return 1 ;;
-                169) [ "$b" = 254 ] && return 1 ;;
-                172) { [ "$b" -ge 16 ] && [ "$b" -le 31 ]; } && return 1 ;;
-                192) [ "$b" = 168 ] && return 1 ;;
-                100) { [ "$b" -ge 64 ] && [ "$b" -le 127 ]; } && return 1 ;;
-            esac
-            return 0
-            ;;
-        *) return 1 ;;
+    *:*) # IPv6 — public only within 2000::/3 (first hextet 0x2000-0x3fff).
+        h="${addr%%:*}"
+        case "$h" in "" | *[!0-9a-fA-F]*) return 1 ;; esac
+        h=$((16#$h))
+        [ "$h" -ge 8192 ] && [ "$h" -le 16383 ]
+        ;;
+    *.*) # IPv4 dotted-quad.
+        is_ipv4 "$addr" || return 1
+        IFS=. read -r a b _ _ <<<"$addr"
+        case "$a" in
+        0 | 10 | 127) return 1 ;;
+        169) [ "$b" = 254 ] && return 1 ;;
+        172) { [ "$b" -ge 16 ] && [ "$b" -le 31 ]; } && return 1 ;;
+        192) [ "$b" = 168 ] && return 1 ;;
+        100) { [ "$b" -ge 64 ] && [ "$b" -le 127 ]; } && return 1 ;;
+        esac
+        return 0
+        ;;
+    *) return 1 ;;
     esac
 }
 
@@ -1070,7 +1304,7 @@ host_public_ips() {
     command -v ip >/dev/null 2>&1 || return 0
     local fam addr
     while read -r _ _ fam addr _; do
-        case "$fam" in inet|inet6) ;; *) continue ;; esac
+        case "$fam" in inet | inet6) ;; *) continue ;; esac
         addr="${addr%%/*}"
         if is_public_ip "$addr"; then printf '%s\n' "$addr"; fi
     done < <(ip -o addr show 2>/dev/null)
@@ -1091,12 +1325,15 @@ check_stratum_exposure() {
         return 0
     fi
     case "$bind" in
-        0.0.0.0|"") ;;   # all interfaces — the exposed case
-        *) [ "$mode" = doctor ] && dr_ok "Stratum :3333 bound to $bind (not all interfaces) — not publicly exposed."
-           return 0 ;;
+    0.0.0.0 | "") ;; # all interfaces — the exposed case
+    *)
+        [ "$mode" = doctor ] && dr_ok "Stratum :3333 bound to $bind (not all interfaces) — not publicly exposed."
+        return 0
+        ;;
     esac
 
-    pub="$(host_public_ips)"; pub="${pub//$'\n'/, }"
+    pub="$(host_public_ips)"
+    pub="${pub//$'\n'/, }"
     if [ -n "$pub" ]; then
         msg="This host appears to have a public IP ($pub). The stratum port 3333 is unauthenticated by default and cleartext — firewall it to your LAN, set p2pool.stratum_bind to a LAN IP / 127.0.0.1, and/or require a p2pool.stratum_password. See docs/workers.md#firewall."
         if [ "$mode" = doctor ]; then dr_warn "$msg"; else warn "$msg"; fi
@@ -1119,7 +1356,8 @@ is_valid_host() {
 detect_host_timezone() {
     local tz="" link
     # 1) Explicit TZ in the environment wins.
-    if [ -n "${TZ:-}" ]; then tz="$TZ"
+    if [ -n "${TZ:-}" ]; then
+        tz="$TZ"
     # 2) systemd hosts.
     elif command -v timedatectl >/dev/null 2>&1; then
         tz=$(timedatectl show -p Timezone --value 2>/dev/null || true)
@@ -1130,7 +1368,7 @@ detect_host_timezone() {
     if [ -z "$tz" ] && [ -L /etc/localtime ]; then
         link=$(readlink /etc/localtime 2>/dev/null || true)
         tz=${link##*/zoneinfo/}
-        [ "$tz" = "$link" ] && tz=""   # prefix not found -> unusable
+        [ "$tz" = "$link" ] && tz="" # prefix not found -> unusable
     fi
     # Sanity-check it looks like an IANA zone (Area/City, UTC, Etc/GMT+5, ...); else UTC.
     if [ -n "$tz" ] && [[ "$tz" =~ ^[A-Za-z0-9._+-]+(/[A-Za-z0-9._+-]+)*$ ]]; then
@@ -1147,20 +1385,31 @@ detect_host_timezone() {
 # shellcheck disable=SC1090  # os-release path is dynamic by design
 detect_os() {
     local osr="${OS_RELEASE_FILE:-/etc/os-release}"
-    OS_ID=""; OS_VERSION=""; OS_PRETTY="$OS_TYPE"
+    OS_ID=""
+    OS_VERSION=""
+    OS_PRETTY="$OS_TYPE"
     if [ -r "$osr" ]; then
-        OS_ID=$(. "$osr" 2>/dev/null; printf '%s' "${ID:-}")
-        OS_VERSION=$(. "$osr" 2>/dev/null; printf '%s' "${VERSION_ID:-}")
-        OS_PRETTY=$(. "$osr" 2>/dev/null; printf '%s' "${PRETTY_NAME:-$OS_TYPE}")
+        OS_ID=$(
+            . "$osr" 2>/dev/null
+            printf '%s' "${ID:-}"
+        )
+        OS_VERSION=$(
+            . "$osr" 2>/dev/null
+            printf '%s' "${VERSION_ID:-}"
+        )
+        OS_PRETTY=$(
+            . "$osr" 2>/dev/null
+            printf '%s' "${PRETTY_NAME:-$OS_TYPE}"
+        )
     fi
 }
 
 # True when the four runtime dependencies are all present.
 deps_satisfied() {
-    command -v jq >/dev/null 2>&1 \
-        && command -v openssl >/dev/null 2>&1 \
-        && command -v docker >/dev/null 2>&1 \
-        && docker compose version >/dev/null 2>&1
+    command -v jq >/dev/null 2>&1 &&
+        command -v openssl >/dev/null 2>&1 &&
+        command -v docker >/dev/null 2>&1 &&
+        docker compose version >/dev/null 2>&1
 }
 
 check_prerequisites() {
@@ -1178,12 +1427,20 @@ check_prerequisites() {
 
     # Detect missing dependencies and the apt packages that provide them.
     local missing_cmds=() missing_pkgs=()
-    command -v jq      >/dev/null 2>&1 || { missing_cmds+=("jq");      missing_pkgs+=("jq"); }
-    command -v openssl >/dev/null 2>&1 || { missing_cmds+=("openssl"); missing_pkgs+=("openssl"); }
+    command -v jq >/dev/null 2>&1 || {
+        missing_cmds+=("jq")
+        missing_pkgs+=("jq")
+    }
+    command -v openssl >/dev/null 2>&1 || {
+        missing_cmds+=("openssl")
+        missing_pkgs+=("openssl")
+    }
     if ! command -v docker >/dev/null 2>&1; then
-        missing_cmds+=("docker"); missing_pkgs+=("docker.io" "docker-compose-v2")
+        missing_cmds+=("docker")
+        missing_pkgs+=("docker.io" "docker-compose-v2")
     elif ! docker compose version >/dev/null 2>&1; then
-        missing_cmds+=("docker compose (v2 plugin)"); missing_pkgs+=("docker-compose-v2")
+        missing_cmds+=("docker compose (v2 plugin)")
+        missing_pkgs+=("docker-compose-v2")
     fi
 
     if [ "${#missing_cmds[@]}" -gt 0 ]; then
@@ -1207,19 +1464,11 @@ check_prerequisites() {
     docker info >/dev/null 2>&1 || error "Docker daemon is not reachable. Start it (e.g. 'sudo systemctl start docker') and ensure your user can use Docker (add yourself to the 'docker' group, then re-log in)."
 
     # Verify AVX2 instruction set support (performance only)
-    if [ "$OS_TYPE" == "Darwin" ]; then
-        if ! sysctl -a 2>/dev/null | grep "machdep.cpu" | grep -q "AVX2"; then
-            warn "AVX2 not detected. Mining performance will be poor."
-        fi
-    else
-        if ! grep -q "avx2" /proc/cpuinfo 2>/dev/null; then
-            warn "AVX2 not detected. Mining performance will be poor."
-        fi
-    fi
+    cpu_has_avx2 || warn "AVX2 not detected. Mining performance will be poor."
     log "All dependencies satisfied."
 }
 
-# Placeholder credentials shipped in config.json.template / config.advanced.example.json. We
+# Placeholder credentials shipped in config.minimal.json / config.reference.json. We
 # treat them like empty values so a user who copies the template but never edits the node creds
 # still gets real, auto-generated ones (rather than working-but-predictable defaults).
 readonly PLACEHOLDER_NODE_USER="create_a_username_for_node"
@@ -1257,8 +1506,8 @@ cred_needs_generating() {
 persist_node_credentials() {
     local user="$1" pass="$2" tmp="${CONFIG_FILE}.tmp"
     if jq --arg u "$user" --arg p "$pass" \
-          '.monero.node_username = $u | .monero.node_password = $p' \
-          "$CONFIG_FILE" > "$tmp" 2>/dev/null; then
+        '.monero.node_username = $u | .monero.node_password = $p' \
+        "$CONFIG_FILE" >"$tmp" 2>/dev/null; then
         mv "$tmp" "$CONFIG_FILE"
         chmod 600 "$CONFIG_FILE" 2>/dev/null || true
     else
@@ -1271,7 +1520,7 @@ ensure_config_exists() {
     [ -f "$CONFIG_FILE" ] && return 0
 
     if [ ! -t 0 ]; then
-        error "$CONFIG_FILE not found and no interactive terminal is available.\n  Create it first (copy config.json.template to config.json and edit it), then re-run."
+        error "$CONFIG_FILE not found and no interactive terminal is available.\n  Create it first (copy config.minimal.json to config.json and edit it), then re-run."
     fi
 
     log "$CONFIG_FILE not found. Starting interactive setup..."
@@ -1280,10 +1529,10 @@ ensure_config_exists() {
     while :; do
         read -r -p "Enter Monero Wallet Address (primary — starts with 4): " IN_MONERO_WALLET || break
         case "$(monero_address_type "$IN_MONERO_WALLET")" in
-            primary)    break ;;
-            subaddress) echo "  ✗ That's a subaddress (8…) — p2pool can't pay it. Use your PRIMARY address (starts with 4)." >&2 ;;
-            integrated) echo "  ✗ That's an integrated address — use your plain primary address." >&2 ;;
-            *)          echo "  ✗ Not a valid Monero primary address (95 chars, starts with 4). Try again." >&2 ;;
+        primary) break ;;
+        subaddress) echo "  ✗ That's a subaddress (8…) — p2pool can't pay it. Use your PRIMARY address (starts with 4)." >&2 ;;
+        integrated) echo "  ✗ That's an integrated address — use your plain primary address." >&2 ;;
+        *) echo "  ✗ Not a valid Monero primary address (95 chars, starts with 4). Try again." >&2 ;;
         esac
     done
     read -r -p "Enter Tari Wallet Address: " IN_TARI_WALLET || true
@@ -1306,7 +1555,7 @@ ensure_config_exists() {
         IN_MONERO_USER=$(default_node_username)
         IN_MONERO_PASS=$(generate_node_password)
         log "Generated internal Monero node RPC credentials (saved in $CONFIG_FILE)."
-        cat <<EOF > "$CONFIG_FILE"
+        cat <<EOF >"$CONFIG_FILE"
 {
     "monero": {
         "mode": "local",
@@ -1340,7 +1589,7 @@ EOF
             read -r -s -p "Enter Remote Node Password: " IN_MONERO_PASS || true
             echo ""
         fi
-        cat <<EOF > "$CONFIG_FILE"
+        cat <<EOF >"$CONFIG_FILE"
 {
     "monero": {
         "mode": "remote",
@@ -1376,9 +1625,9 @@ EOF
 # Echoes: primary | integrated | subaddress | invalid  (#250)
 monero_address_type() {
     case "$1" in
-        4*) case "${#1}" in 95) echo primary ;; 106) echo integrated ;; *) echo invalid ;; esac ;;
-        8*) case "${#1}" in 95) echo subaddress ;; *) echo invalid ;; esac ;;
-        *)  echo invalid ;;
+    4*) case "${#1}" in 95) echo primary ;; 106) echo integrated ;; *) echo invalid ;; esac ;;
+    8*) case "${#1}" in 95) echo subaddress ;; *) echo invalid ;; esac ;;
+    *) echo invalid ;;
     esac
 }
 
@@ -1401,16 +1650,16 @@ parse_and_validate_config() {
     # PRIMARY/standard address (XvB credits by the same address too). A wrong type mines but is NEVER
     # paid, silently — so hard-fail here rather than let someone lose rewards (#250).
     case "$(monero_address_type "$MONERO_WALLET")" in
-        primary)    ;;
-        subaddress) error "monero.wallet_address is a SUBADDRESS (starts with 8). p2pool cannot pay subaddresses — use your PRIMARY/standard Monero address (starts with 4)." ;;
-        integrated) error "monero.wallet_address is an INTEGRATED address. p2pool needs your plain PRIMARY address (95 chars, starts with 4)." ;;
-        *)          error "monero.wallet_address ('${MONERO_WALLET:0:6}…', ${#MONERO_WALLET} chars) is not a valid Monero primary address (expected 95 chars starting with 4)." ;;
+    primary) ;;
+    subaddress) error "monero.wallet_address is a SUBADDRESS (starts with 8). p2pool cannot pay subaddresses — use your PRIMARY/standard Monero address (starts with 4)." ;;
+    integrated) error "monero.wallet_address is an INTEGRATED address. p2pool needs your plain PRIMARY address (95 chars, starts with 4)." ;;
+    *) error "monero.wallet_address ('${MONERO_WALLET:0:6}…', ${#MONERO_WALLET} chars) is not a valid Monero primary address (expected 95 chars starting with 4)." ;;
     esac
 
     MONERO_MODE=$(jq -r '.monero.mode // "local"' "$CONFIG_FILE")
     case "$MONERO_MODE" in
-        local|remote) ;;
-        *) error "monero.mode must be \"local\" or \"remote\" (got \"$MONERO_MODE\")." ;;
+    local | remote) ;;
+    *) error "monero.mode must be \"local\" or \"remote\" (got \"$MONERO_MODE\")." ;;
     esac
 
     # Bridge network subnet (#180): configurable so the stack can avoid colliding with a 172.28.0.0/24
@@ -1421,10 +1670,15 @@ parse_and_validate_config() {
     # three octets). Must be an X.Y.Z.0/24 block.
     NETWORK_SUBNET=$(jq -r '.network.subnet // "172.28.0.0/24"' "$CONFIG_FILE")
     case "$NETWORK_SUBNET" in
-        *.0/24) NETWORK_PREFIX="${NETWORK_SUBNET%.0/24}" ;;
-        *) error "network.subnet must be an X.Y.Z.0/24 block (got \"$NETWORK_SUBNET\")." ;;
+    *.0/24) NETWORK_PREFIX="${NETWORK_SUBNET%.0/24}" ;;
+    *) error "network.subnet must be an X.Y.Z.0/24 block (got \"$NETWORK_SUBNET\")." ;;
     esac
     is_ipv4 "${NETWORK_PREFIX}.0" || error "network.subnet is not a valid IPv4 /24 (got \"$NETWORK_SUBNET\")."
+    # Fail-closed Tor-only egress firewall (#270); default on. Renders to .env so `up` can read it.
+    # config_bool (not a plain `// true`) so an explicit false actually disables it — see #294.
+    TOR_EGRESS_FIREWALL=$(normalize_bool "$(config_bool '.network.tor_egress_firewall' true)")
+    # Surfaced for the dashboard's egress-posture panel (#170); mirrors what p2pool_outbound_flags reads.
+    P2POOL_CLEARNET=$(normalize_bool "$(config_bool '.p2pool.clearnet' false)")
     if [ "$MONERO_MODE" == "remote" ]; then
         local remote_host
         remote_host=$(jq -r '.monero.remote.host // empty' "$CONFIG_FILE")
@@ -1433,8 +1687,8 @@ parse_and_validate_config() {
 
     POOL_TYPE=$(jq -r '.p2pool.pool // "main"' "$CONFIG_FILE")
     case "$POOL_TYPE" in
-        main|mini|nano) ;;
-        *) error "p2pool.pool must be \"main\", \"mini\", or \"nano\" (got \"$POOL_TYPE\")." ;;
+    main | mini | nano) ;;
+    *) error "p2pool.pool must be \"main\", \"mini\", or \"nano\" (got \"$POOL_TYPE\")." ;;
     esac
 
     # Host interface the stratum port (:3333) publishes on. Default 0.0.0.0 so LAN rigs can
@@ -1457,7 +1711,7 @@ parse_and_validate_config() {
     # access control ("who may mine"), not encryption — pair it with a LAN-only bind / firewall.
     STRATUM_PASSWORD=$(jq -r '.p2pool.stratum_password // ""' "$CONFIG_FILE")
     if [ "$STRATUM_PASSWORD" = "auto" ]; then
-        STRATUM_PASSWORD=$(env_get PROXY_STRATUM_PASSWORD)            # reuse a previously generated one
+        STRATUM_PASSWORD=$(env_get PROXY_STRATUM_PASSWORD) # reuse a previously generated one
         [ -n "$STRATUM_PASSWORD" ] || STRATUM_PASSWORD=$(openssl rand -hex 12)
     fi
     # A non-empty password is written to .env and substituted into the proxy's CLI args, so restrict
@@ -1489,10 +1743,12 @@ parse_and_validate_config() {
     if [ "$MONERO_MODE" == "local" ]; then
         local creds_generated=0
         if cred_needs_generating "$MONERO_USER" "$PLACEHOLDER_NODE_USER"; then
-            MONERO_USER=$(default_node_username); creds_generated=1
+            MONERO_USER=$(default_node_username)
+            creds_generated=1
         fi
         if cred_needs_generating "$MONERO_PASS" "$PLACEHOLDER_NODE_PASS"; then
-            MONERO_PASS=$(generate_node_password); creds_generated=1
+            MONERO_PASS=$(generate_node_password)
+            creds_generated=1
         fi
         if [ "$creds_generated" -eq 1 ]; then
             persist_node_credentials "$MONERO_USER" "$MONERO_PASS"
@@ -1542,7 +1798,8 @@ parse_and_validate_config() {
     DASHBOARD_AUTH_USER=$(jq -r '.dashboard.auth.username // "admin"' "$CONFIG_FILE")
     DASHBOARD_AUTH_HASH_B64=""
     DASHBOARD_AUTH_PW_FP=""
-    local dash_pw; dash_pw=$(jq -r '.dashboard.auth.password // ""' "$CONFIG_FILE")
+    local dash_pw
+    dash_pw=$(jq -r '.dashboard.auth.password // ""' "$CONFIG_FILE")
     if [ -n "$dash_pw" ]; then
         if ! printf '%s' "$DASHBOARD_AUTH_USER" | grep -qE '^[A-Za-z0-9._@-]{1,64}$'; then
             error "dashboard.auth.username must be 1–64 chars of letters, digits, and . _ @ - (got \"$DASHBOARD_AUTH_USER\")."
@@ -1555,10 +1812,10 @@ parse_and_validate_config() {
         prev_fp=$(env_get DASHBOARD_AUTH_PW_FP)
         prev_hash=$(env_get DASHBOARD_AUTH_HASH_B64)
         if [ "$DASHBOARD_AUTH_PW_FP" = "$prev_fp" ] && [ -n "$prev_hash" ]; then
-            DASHBOARD_AUTH_HASH_B64="$prev_hash"          # password unchanged — keep the stable hash
+            DASHBOARD_AUTH_HASH_B64="$prev_hash" # password unchanged — keep the stable hash
         else
-            DASHBOARD_AUTH_HASH_B64=$(caddy_hash_password_b64 "$dash_pw") \
-                || error "Could not hash dashboard.auth.password (is Docker running and the Caddy image pulled? Run '$0 setup' first)."
+            DASHBOARD_AUTH_HASH_B64=$(caddy_hash_password_b64 "$dash_pw") ||
+                error "Could not hash dashboard.auth.password (is Docker running and the Caddy image pulled? Run '$0 setup' first)."
         fi
         # basic_auth credentials are only safe over TLS; warn (don't fail) on plain HTTP.
         if [ "$DASHBOARD_SECURE" != "true" ]; then
@@ -1588,9 +1845,10 @@ prepare_directories() {
     log "Initializing data directories..."
     mkdir -p "$MONERO_DIR" "$TARI_DIR" "$P2POOL_DIR" "$TOR_DATA_DIR" "$DASHBOARD_DIR" "$CLEARNET_STATE_DIR"
 
-    # Enforce permissions
+    # Enforce permissions. Each data dir is owned by the uid its container runs as: Tor keeps its
+    # alpine 'tor' user (100:101); the built images + tari run non-root as APP_UID:APP_GID (#255).
     sudo chown -R 100:101 "$TOR_DATA_DIR"
-    sudo chown -R "$REAL_USER":"$REAL_USER" "$MONERO_DIR" "$TARI_DIR" "$P2POOL_DIR"
+    sudo chown -R "$APP_UID":"$APP_GID" "$MONERO_DIR" "$TARI_DIR" "$P2POOL_DIR" "$DASHBOARD_DIR"
     mkdir -p "$P2POOL_DIR/stats"
     sudo chmod -R 755 "$P2POOL_DIR/stats"
     # World-writable so the dashboard container (its own uid) can drop the clearnet auto-transition
@@ -1615,36 +1873,46 @@ missing_data_dirs() {
 
 # Loud warning (on `up`) when .env names data dirs that don't exist — see missing_data_dirs (#126).
 warn_missing_data_dirs() {
-    local stale line; stale=$(missing_data_dirs)
+    local stale line
+    stale=$(missing_data_dirs)
     [ -n "$stale" ] || return 0
     warn "Data directories named in .env are MISSING — did you relocate, copy, or run a different checkout of this install?"
-    while IFS= read -r line; do warn "  ${line%%=*} → ${line#*=} (not found)"; done <<< "$stale"
+    while IFS= read -r line; do warn "  ${line%%=*} → ${line#*=} (not found)"; done <<<"$stale"
     warn "The stack will start a FRESH sync and the dashboard history will be orphaned. To keep your synced chains,"
     warn "move the data to these paths, or set the data_dir(s) in config.json (absolute) and run './pithead apply'."
 }
 
-# Lightweight directory check for `apply`: create any missing data dir and chown only the
-# ones we just created, so a routine apply does not require sudo on every run.
+# chown -R "$dir" to $uid:$gid, but ONLY when something in it isn't already owned by $uid. Keeps a
+# routine apply sudo-free in steady state, while migrating an existing install in one pass the first
+# time the owning uid changes — e.g. the root->non-root container switch (#255). We scan the whole
+# tree, not just the top-level dir: an install upgraded from the root-container era has a user-owned
+# data dir but root-owned *contents* (the daemons wrote bitmonero.conf, the SQLite DB, etc. as
+# root), and those are exactly what the non-root container can no longer overwrite. `find … -quit`
+# stops at the first foreign inode, so a clean dir stays a quick metadata scan with no chown/sudo.
+ensure_owner() {
+    local d="$1" want_u="$2" want_g="$3"
+    [ -d "$d" ] || return 0
+    [ -z "$(find "$d" ! -uid "$want_u" -print -quit 2>/dev/null)" ] && return 0
+    log "Setting ownership of $d to $want_u:$want_g (non-root containers, #255)..."
+    sudo chown -R "$want_u":"$want_g" "$d"
+}
+
+# Lightweight directory check for `apply`/`upgrade`: create any missing data dir, then ensure each is
+# owned by the uid its container runs as. ensure_owner is conditional, so a routine apply stays
+# sudo-free once ownership is correct; the first run after the non-root switch migrates the data.
 ensure_directories() {
     local d created=()
     for d in "$MONERO_DIR" "$TARI_DIR" "$P2POOL_DIR" "$TOR_DATA_DIR" "$DASHBOARD_DIR"; do
-        if [ ! -d "$d" ]; then
-            mkdir -p "$d"
-            created+=("$d")
-        fi
+        [ -d "$d" ] || { mkdir -p "$d" && created+=("$d"); }
     done
     mkdir -p "$P2POOL_DIR/stats"
-    if [ "${#created[@]}" -gt 0 ]; then
-        log "Created new data directories; applying ownership..."
-        for d in "${created[@]}"; do
-            if [ "$d" == "$TOR_DATA_DIR" ]; then
-                sudo chown -R 100:101 "$d"
-            else
-                sudo chown -R "$REAL_USER":"$REAL_USER" "$d"
-            fi
-        done
-        sudo chmod -R 755 "$P2POOL_DIR/stats"
-    fi
+    ensure_owner "$TOR_DATA_DIR" 100 101
+    ensure_owner "$MONERO_DIR" "$APP_UID" "$APP_GID"
+    ensure_owner "$TARI_DIR" "$APP_UID" "$APP_GID"
+    ensure_owner "$P2POOL_DIR" "$APP_UID" "$APP_GID"
+    ensure_owner "$DASHBOARD_DIR" "$APP_UID" "$APP_GID"
+    [ "${#created[@]}" -gt 0 ] && sudo chmod -R 755 "$P2POOL_DIR/stats"
+    return 0
 }
 
 # Decide the hostname the dashboard is reached at: an explicit dashboard.host wins; otherwise
@@ -1675,9 +1943,9 @@ provision_tor() {
     # more or less than 15s to publish them, especially on first run.
     log "Waiting for Tor hidden services to be generated..."
     local elapsed=0 timeout=60
-    until docker exec tor test -f /var/lib/tor/monero/hostname \
-        && docker exec tor test -f /var/lib/tor/tari/hostname \
-        && docker exec tor test -f /var/lib/tor/p2pool/hostname; do
+    until docker exec tor test -f /var/lib/tor/monero/hostname &&
+        docker exec tor test -f /var/lib/tor/tari/hostname &&
+        docker exec tor test -f /var/lib/tor/p2pool/hostname; do
         if [ "$elapsed" -ge "$timeout" ]; then
             error "Timed out after ${timeout}s waiting for Tor hidden-service hostnames."
         fi
@@ -1711,21 +1979,19 @@ render_env() {
         profiles="" # Empty profile disables local monerod
     fi
 
-    # Pruning. Use the `!= null` form, not `//`: jq's `//` treats a literal `false` as absent,
-    # which would silently ignore "prune": false and leave pruning on.
-    local prune_bool prune
-    prune_bool=$(jq -r 'if .monero.prune != null then .monero.prune else true end' "$CONFIG_FILE")
-    if [ "$prune_bool" == "true" ]; then prune=1; else prune=0; fi
+    # Pruning is on unless config explicitly sets monero.prune:false (config_bool honours that
+    # explicit false rather than coercing it back to the default — see #294).
+    local prune
+    prune=$(monero_prune_flag)
 
     # Optional clearnet initial sync (#183). DEFAULT OFF (privacy-first). When on for a daemon, its
     # initial blockchain download runs over CLEARNET (fast) instead of Tor — briefly exposing this
-    # host's IP to that P2P network. Per-component, since Monero and Tari sync independently. The
-    # `// false` is safe for a false-default bool (jq's // treats a literal false as the default,
-    # which is what we want); normalize_bool then accepts 1/true/yes/on. Monero keeps tx-proxy=tor
-    # the whole time. Flip back to false + `apply` once synced to return all P2P to Tor.
+    # host's IP to that P2P network. Per-component, since Monero and Tari sync independently.
+    # config_bool honours an explicit false; normalize_bool then maps the result to true/false.
+    # Monero keeps tx-proxy=tor the whole time. Flip back to false + `apply` once synced.
     local monero_clearnet tari_clearnet
-    monero_clearnet=$(normalize_bool "$(jq -r '.monero.clearnet_initial_sync // false' "$CONFIG_FILE")")
-    tari_clearnet=$(normalize_bool "$(jq -r '.tari.clearnet_initial_sync // false' "$CONFIG_FILE")")
+    monero_clearnet=$(normalize_bool "$(config_bool '.monero.clearnet_initial_sync' false)")
+    tari_clearnet=$(normalize_bool "$(config_bool '.tari.clearnet_initial_sync' false)")
 
     # Block-verification threads — hardware-dependent, so derive from THIS host's core count
     # rather than hardcoding (more cores = faster initial-sync verification). Reserve 2 cores
@@ -1734,7 +2000,7 @@ render_env() {
     prep_threads=$(jq -r '.monero.prep_blocks_threads // "auto"' "$CONFIG_FILE")
     if ! [[ "$prep_threads" =~ ^[0-9]+$ ]]; then
         cores=$(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 4)
-        prep_threads=$(( cores - 2 ))
+        prep_threads=$((cores - 2))
         [ "$prep_threads" -lt 4 ] && prep_threads=4
         [ "$prep_threads" -gt 8 ] && prep_threads=8
     fi
@@ -1751,19 +2017,31 @@ render_env() {
     p2pool_flags=""
     p2pool_port="37889"
     if [ "$pool_type" == "mini" ]; then
-        p2pool_flags="--mini"; p2pool_port="37888"
+        p2pool_flags="--mini"
+        p2pool_port="37888"
     elif [ "$pool_type" == "nano" ]; then
-        p2pool_flags="--nano"; p2pool_port="37890"
+        p2pool_flags="--nano"
+        p2pool_port="37890"
     fi
 
+    # Route outbound sidechain P2P through Tor by default (#165); p2pool.clearnet opts out for yield.
+    # See p2pool_outbound_flags + docs/privacy.md. Uses the configured subnet so a custom NETWORK_PREFIX
+    # (#180) still points at the Tor container (.25).
+    local p2pool_socks
+    p2pool_socks=$(p2pool_outbound_flags "$(jq -r '.p2pool.clearnet // false' "$CONFIG_FILE")" "$NETWORK_PREFIX")
+    [ -n "$p2pool_socks" ] && p2pool_flags="${p2pool_flags:+$p2pool_flags }$p2pool_socks"
+
     # XvB config (accepts legacy xmrig_proxy.* keys)
-    local xvb_enabled xvb_url xvb_donor xvb_donation_level
+    local xvb_enabled xvb_url xvb_donor xvb_donation_level xvb_tor
     xvb_enabled=$(jq -r 'if .xvb.enabled != null then .xvb.enabled elif .xmrig_proxy.enabled != null then .xmrig_proxy.enabled else "true" end' "$CONFIG_FILE")
+    # Route XvB donation mining through Tor by default (#166); xvb.tor:false opts out for max yield.
+    # config_bool so xvb.tor=false (route XvB over clearnet) is honoured rather than coerced to Tor (#294).
+    xvb_tor=$(normalize_bool "$(config_bool '.xvb.tor' true)")
     xvb_url=$(jq -r '.xvb.url // .xmrig_proxy.url // empty' "$CONFIG_FILE")
     [ -z "$xvb_url" ] && xvb_url="na.xmrvsbeast.com:4247"
     xvb_donor=$(jq -r '.xvb.donor_id // .xmrig_proxy.donor_id // empty' "$CONFIG_FILE")
     case "$xvb_donor" in
-        ""|auto|DYNAMIC_ID) xvb_donor=$(echo "$MONERO_WALLET" | cut -c 1-8) ;;
+    "" | auto | DYNAMIC_ID) xvb_donor="${MONERO_WALLET:0:8}" ;;
     esac
     # Donation tier target: auto (default) / donor|vip|whale|mega
     xvb_donation_level=$(jq -r '.xvb.donation_level // empty' "$CONFIG_FILE")
@@ -1783,6 +2061,19 @@ render_env() {
     local check_for_updates
     check_for_updates=$(jq -r 'if .dashboard.check_for_updates == false then "false" else "true" end' "$CONFIG_FILE")
 
+    # Per-worker xmrig API probe (#171/#172). The dashboard enriches each proxy-reported worker by
+    # reading that miner's own xmrig /1/summary for uptime + per-miner hashrate — ONE configured
+    # way, no auto-detection. Defaults match the stock RigForge worker: an open, read-only API
+    # (xmrig http.restricted, no access-token) on port 8080, so the standard stack needs no config.
+    #   workers.api_auth: none (default) | name (Bearer = the worker's stratum name) | token
+    #                     (Bearer = workers.api_token, a single shared token for every worker).
+    # Upgrade note: a stack whose miners still set an xmrig access-token should set api_auth "name",
+    # else the no-auth probe 401s and those workers read api_ok=false (see docs/configuration.md).
+    local worker_api_port worker_api_auth worker_api_token
+    worker_api_port=$(jq -r '.workers.api_port // 8080' "$CONFIG_FILE")
+    worker_api_auth=$(jq -r '.workers.api_auth // "none"' "$CONFIG_FILE")
+    worker_api_token=$(jq -r '.workers.api_token // ""' "$CONFIG_FILE")
+
     # Tari memory cap (#55). Tari officially needs only a few GB (min 4 GB host, 8 GB+ recommended),
     # but its memory grows unbounded over time — one 32 GB host was seen at ~11 GB while staying
     # healthy. Uncapped, that growth can OOM the whole host on small machines. So the cap is a SAFETY
@@ -1805,36 +2096,36 @@ render_env() {
     local tari_mem_limit ram_mb huge_mb avail_mb reserve_mb monero_mem_limit
     tari_mem_limit=$(jq -r '.tari.mem_limit // "auto"' "$CONFIG_FILE")
     case "$tari_mem_limit" in
-        ""|auto)
-            huge_mb=0
-            if [ "$OS_TYPE" == "Darwin" ]; then
-                ram_mb=$(( $(sysctl -n hw.memsize 2>/dev/null || echo 0) / 1048576 ))
-            else
-                ram_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null || echo 0)
-                # HugePages_Total (pages) * Hugepagesize (kB) -> MiB reserved out of RAM.
-                huge_mb=$(awk '/HugePages_Total/{t=$2} /Hugepagesize/{s=$2} END{print int(t*s/1024)}' /proc/meminfo 2>/dev/null || echo 0)
-            fi
-            [ "${ram_mb:-0}" -gt 0 ] 2>/dev/null   || ram_mb=16384   # unknown host => assume 16 GB
-            [ "${huge_mb:-0}" -ge 0 ] 2>/dev/null  || huge_mb=0
-            avail_mb=$(( ram_mb - huge_mb ))                         # RAM left after HugePages
-            [ "$avail_mb" -lt 2048 ] && avail_mb=2048
-            reserve_mb=$(( avail_mb / 4 ))                           # rest of the stack + OS + cache
-            [ "$reserve_mb" -lt 2048 ] && reserve_mb=2048
-            tari_mem_limit=$(( avail_mb - reserve_mb ))
-            [ "$tari_mem_limit" -lt 2048 ] && tari_mem_limit=2048    # never starve Tari below 2 GB
-            tari_mem_limit="${tari_mem_limit}m"
-            ;;
+    "" | auto)
+        huge_mb=0
+        if [ "$OS_TYPE" == "Darwin" ]; then
+            ram_mb=$(($(sysctl -n hw.memsize 2>/dev/null || echo 0) / 1048576))
+        else
+            ram_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null || echo 0)
+            # HugePages_Total (pages) * Hugepagesize (kB) -> MiB reserved out of RAM.
+            huge_mb=$(awk '/HugePages_Total/{t=$2} /Hugepagesize/{s=$2} END{print int(t*s/1024)}' /proc/meminfo 2>/dev/null || echo 0)
+        fi
+        [ "${ram_mb:-0}" -gt 0 ] 2>/dev/null || ram_mb=16384 # unknown host => assume 16 GB
+        [ "${huge_mb:-0}" -ge 0 ] 2>/dev/null || huge_mb=0
+        avail_mb=$((ram_mb - huge_mb)) # RAM left after HugePages
+        [ "$avail_mb" -lt 2048 ] && avail_mb=2048
+        reserve_mb=$((avail_mb / 4)) # rest of the stack + OS + cache
+        [ "$reserve_mb" -lt 2048 ] && reserve_mb=2048
+        tari_mem_limit=$((avail_mb - reserve_mb))
+        [ "$tari_mem_limit" -lt 2048 ] && tari_mem_limit=2048 # never starve Tari below 2 GB
+        tari_mem_limit="${tari_mem_limit}m"
+        ;;
     esac
 
     # monerod memory ceiling (#132): a generous default so heavy initial-sync verification never trips
     # it (monerod's LMDB is reclaimable page cache, so its capped RSS stays low). Tunable for low-RAM
     # hosts that OOM during IBD, or to give a big host more LMDB-cache headroom.
     monero_mem_limit=$(jq -r '.monero.mem_limit // "auto"' "$CONFIG_FILE")
-    case "$monero_mem_limit" in ""|auto) monero_mem_limit="6g" ;; esac
+    case "$monero_mem_limit" in "" | auto) monero_mem_limit="6g" ;; esac
 
     log "Monero block-prep threads: $prep_threads | pool: $pool_type | mode: $MONERO_MODE"
 
-    cat <<EOF > "$target"
+    cat <<EOF >"$target"
 MONERO_DATA_DIR=$MONERO_DIR
 TARI_DATA_DIR=$TARI_DIR
 P2POOL_DATA_DIR=$P2POOL_DIR
@@ -1854,6 +2145,7 @@ PROXY_STRATUM_PASSWORD=$STRATUM_PASSWORD
 XVB_POOL_URL=$xvb_url
 XVB_DONOR_ID=$xvb_donor
 XVB_ENABLED=$xvb_enabled
+XVB_TOR_ENABLED=$xvb_tor
 XVB_DONATION_LEVEL=$xvb_donation_level
 TARI_REQUIRED=$tari_required
 DASHBOARD_CHECK_UPDATES=$check_for_updates
@@ -1862,8 +2154,13 @@ MONERO_MEM_LIMIT=$monero_mem_limit
 P2POOL_URL=${NETWORK_PREFIX}.28:3333
 NETWORK_SUBNET=$NETWORK_SUBNET
 NETWORK_PREFIX=$NETWORK_PREFIX
+TOR_EGRESS_FIREWALL=$TOR_EGRESS_FIREWALL
+P2POOL_CLEARNET=$P2POOL_CLEARNET
 PROXY_API_PORT=3344
 PROXY_AUTH_TOKEN=$PROXY_AUTH_TOKEN
+XMRIG_API_PORT=$worker_api_port
+XMRIG_API_AUTH=$worker_api_auth
+XMRIG_API_TOKEN=$worker_api_token
 PROXY_DONATE_LEVEL=$DONATE_LEVEL
 MONERO_PRUNE=$prune
 MONERO_CLEARNET_SYNC=$monero_clearnet
@@ -1890,8 +2187,7 @@ EOF
 inject_service_configs() {
     log "Injecting service configurations..."
     cp build/tari/config.toml.template build/tari/config.toml
-    local tari_onion_short
-    tari_onion_short=$(echo "$TARI_ONION" | cut -d'.' -f1)
+    local tari_onion_short="${TARI_ONION%%.*}"
     safe_sed "s/<your_tari_onion_address_no_extension>/$tari_onion_short/g" build/tari/config.toml
     # Rebase the Tor control/SOCKS IPs onto the configured subnet prefix (#180): a no-op at the
     # default 172.28.0, rewrites the .25 Tor IP when network.subnet has been moved.
@@ -1907,15 +2203,17 @@ inject_service_configs() {
     # Re-arm clearnet auto-sync (#234): clear a chain's "sync complete" marker whenever its flag is
     # OFF, so re-enabling later starts a fresh clearnet sync. While a flag is ON the dashboard owns
     # the marker, so leave it. Markers live in the shared, dashboard-writable clearnet-state dir.
-    local _csdir; _csdir=$(env_get CLEARNET_STATE_DIR); [ -n "$_csdir" ] || _csdir="$PWD/data/clearnet-state"
+    local _csdir
+    _csdir=$(clearnet_state_dir)
     mkdir -p "$_csdir" 2>/dev/null || true
     [ "$(env_get MONERO_CLEARNET_SYNC)" = "true" ] || rm -f "$_csdir/monero.synced" 2>/dev/null || true
-    [ "$(env_get TARI_CLEARNET_SYNC)" = "true" ]   || rm -f "$_csdir/tari.synced" 2>/dev/null || true
+    [ "$(env_get TARI_CLEARNET_SYNC)" = "true" ] || rm -f "$_csdir/tari.synced" 2>/dev/null || true
 }
 
 # sha256 of stdin as lowercase hex — portable across the sha256sum / shasum split.
 sha256_hex() {
-    if command -v sha256sum >/dev/null 2>&1; then sha256sum | cut -d' ' -f1
+    if command -v sha256sum >/dev/null 2>&1; then
+        sha256sum | cut -d' ' -f1
     else shasum -a 256 | cut -d' ' -f1; fi
 }
 
@@ -1937,12 +2235,13 @@ generate_caddyfile() {
     # protects every route, so the dashboard prompts for login before anything is served.
     local auth=""
     if [ -n "$DASHBOARD_AUTH_HASH_B64" ]; then
-        local hash; hash=$(printf '%s' "$DASHBOARD_AUTH_HASH_B64" | openssl base64 -d -A)
+        local hash
+        hash=$(printf '%s' "$DASHBOARD_AUTH_HASH_B64" | openssl base64 -d -A)
         auth=$(printf '    basic_auth {\n        %s %s\n    }' "$DASHBOARD_AUTH_USER" "$hash")
     fi
     if [ "$DASHBOARD_SECURE" == "true" ]; then
         log "Generating Caddyfile for automatic HTTPS ($HOST_IP)$([ -n "$auth" ] && echo ' with login')..."
-        cat <<EOF > "Caddyfile"
+        cat <<EOF >"Caddyfile"
 https://$HOST_IP {
     tls internal
 $auth
@@ -1951,7 +2250,7 @@ $auth
 EOF
     else
         log "Generating Caddyfile for HTTP ($HOST_IP)$([ -n "$auth" ] && echo ' with login')..."
-        cat <<EOF > "Caddyfile"
+        cat <<EOF >"Caddyfile"
 http://$HOST_IP {
 $auth
     reverse_proxy 127.0.0.1:8000
@@ -2064,12 +2363,12 @@ prompt_start_stack() {
 # Args: <component> [<prune>] where prune (1 = on, 0 = off) only matters for "monero". Prints GiB.
 disk_component_gib() {
     case "$1" in
-        monero)    if [ "${2:-1}" -eq 1 ] 2>/dev/null; then echo 120; else echo 320; fi ;;
-        tari)      echo 170 ;;
-        p2pool)    echo 5 ;;
-        dashboard) echo 2 ;;
-        tor)       echo 1 ;;
-        *)         echo 0 ;;
+    monero) if [ "${2:-1}" -eq 1 ] 2>/dev/null; then echo 120; else echo 320; fi ;;
+    tari) echo 170 ;;
+    p2pool) echo 5 ;;
+    dashboard) echo 2 ;;
+    tor) echo 1 ;;
+    *) echo 0 ;;
     esac
 }
 
@@ -2117,12 +2416,17 @@ check_disk_grouped() {
         idx=-1
         local j
         for j in "${!mounts[@]}"; do
-            if [ "${mounts[$j]}" = "$mount" ]; then idx="$j"; break; fi
+            if [ "${mounts[$j]}" = "$mount" ]; then
+                idx="$j"
+                break
+            fi
         done
         if [ "$idx" -lt 0 ]; then
-            mounts+=("$mount"); req_gib+=("$gib"); comp_list+=("$comp")
+            mounts+=("$mount")
+            req_gib+=("$gib")
+            comp_list+=("$comp")
         else
-            req_gib[idx]=$(( req_gib[idx] + gib ))
+            req_gib[idx]=$((req_gib[idx] + gib))
             comp_list[idx]="${comp_list[idx]}, $comp"
         fi
     done
@@ -2137,7 +2441,7 @@ check_disk_grouped() {
     for i in "${!mounts[@]}"; do
         mount="${mounts[$i]}"
         comps="${comp_list[$i]}"
-        need_kb=$(( req_gib[i] * 1048576 ))          # GiB -> KiB (df -P is 1K-blocks)
+        need_kb=$((req_gib[i] * 1048576)) # GiB -> KiB (df -P is 1K-blocks)
         # df the resolved MOUNT POINT (always exists), not the data dir — on first run the dir isn't
         # created yet and `df` on a missing path fails the pipe, tripping `set -Eeuo pipefail` (#179).
         avail_kb=$(df -P "$mount" 2>/dev/null | awk 'NR==2{print $4}')
@@ -2162,11 +2466,9 @@ check_disk_grouped() {
 # blocks or exits: a missing path or unreadable file just skips that check. Call after
 # parse_and_validate_config has resolved the data dirs, before starting the stack.
 preflight_resources() {
-    # Pruning is on unless config explicitly sets monero.prune:false (matches render_env's
-    # `!= null` form, not `//`, so a literal false isn't mistaken for absent).
-    local prune_bool prune
-    prune_bool=$(jq -r 'if .monero.prune != null then .monero.prune else true end' "$CONFIG_FILE" 2>/dev/null || echo true)
-    if [ "$prune_bool" == "true" ]; then prune=1; else prune=0; fi
+    # Pruning is on unless config explicitly sets monero.prune:false (same derivation as render_env).
+    local prune
+    prune=$(monero_prune_flag)
 
     # --- Disk: free space per underlying filesystem ---
     # Treat the stack as one unit: group all five data dirs by the filesystem they live on and warn
@@ -2182,7 +2484,7 @@ preflight_resources() {
         # 16 GiB in KiB.
         if [ -n "$mem_total_kb" ] && [ "$mem_total_kb" -lt 16777216 ] 2>/dev/null; then
             local mem_total_gb
-            mem_total_gb=$(( mem_total_kb / 1048576 ))
+            mem_total_gb=$((mem_total_kb / 1048576))
             warn "Low total RAM: ${mem_total_gb} GB detected, below the recommended ~16 GB. The stack (Tari especially) may be memory-starved during sync."
         fi
     fi
@@ -2206,15 +2508,15 @@ setup() {
     check_prerequisites
     ensure_config_exists
     parse_and_validate_config
-    preflight_resources   # WARN-only: low disk/RAM heads-up before committing to a sync (#87)
-    check_stratum_exposure setup  # WARN-only: public-IP host => unauthenticated stratum :3333 exposed (#113)
+    preflight_resources          # WARN-only: low disk/RAM heads-up before committing to a sync (#87)
+    check_stratum_exposure setup # WARN-only: public-IP host => unauthenticated stratum :3333 exposed (#113)
     load_preserved_state
     resolve_dashboard_host "interactive"
     prepare_directories
-    render_env            # bootstrap .env so Tor (and compose var substitution) have what they need
-    provision_tor         # populates the real onion addresses
+    render_env    # bootstrap .env so Tor (and compose var substitution) have what they need
+    provision_tor # populates the real onion addresses
     DEPLOYMENT_COMPLETED=true
-    render_env            # finalize with real onions + completion flag
+    render_env # finalize with real onions + completion flag
     inject_service_configs
     optimize_kernel
     generate_caddyfile
@@ -2234,105 +2536,141 @@ setup() {
 describe_change() {
     local key="$1" old="$2" new="$3" flag="INFO" msg
     case "$key" in
-        MONERO_PRUNE)
-            flag=DEST; msg="Monero pruning ($old → $new) — enabling prunes existing blocks; disabling needs a full re-sync (pruned data can't be restored). Wipe the Monero data dir to fully re-sync." ;;
-        COMPOSE_PROFILES)
+    MONERO_PRUNE)
+        flag=DEST
+        msg="Monero pruning ($old → $new) — enabling prunes existing blocks; disabling needs a full re-sync (pruned data can't be restored). Wipe the Monero data dir to fully re-sync."
+        ;;
+    COMPOSE_PROFILES)
+        flag=DEST
+        if [ -z "$new" ]; then
+            msg="Switching to a REMOTE Monero node — the local monerod container will be STOPPED and removed (its on-disk data is kept)."
+        else
+            msg="Switching to a LOCAL Monero node — monerod will start and SYNC the blockchain (large download / disk use)."
+        fi
+        ;;
+    MONERO_WALLET_ADDRESS)
+        flag=DEST
+        msg="Monero payout address is changing — future mining rewards go to the new address."
+        ;;
+    TARI_WALLET_ADDRESS)
+        flag=DEST
+        msg="Tari payout address is changing — future merge-mining rewards go to the new address."
+        ;;
+    MONERO_RPC_BIND)
+        if [ "$new" == "0.0.0.0" ]; then
             flag=DEST
-            if [ -z "$new" ]; then
-                msg="Switching to a REMOTE Monero node — the local monerod container will be STOPPED and removed (its on-disk data is kept)."
-            else
-                msg="Switching to a LOCAL Monero node — monerod will start and SYNC the blockchain (large download / disk use)."
-            fi ;;
-        MONERO_WALLET_ADDRESS)
-            flag=DEST; msg="Monero payout address is changing — future mining rewards go to the new address." ;;
-        TARI_WALLET_ADDRESS)
-            flag=DEST; msg="Tari payout address is changing — future merge-mining rewards go to the new address." ;;
-        MONERO_RPC_BIND)
-            if [ "$new" == "0.0.0.0" ]; then
-                flag=DEST; msg="Monero RPC will be EXPOSED on your LAN ($old → $new) — make sure this is intended."
-            else
-                msg="Monero RPC bind address: $old → $new."
-            fi ;;
-        STRATUM_BIND)
-            if [ "$new" == "0.0.0.0" ]; then
-                flag=DEST; msg="Stratum (:3333) will be published on ALL interfaces ($old → $new) — keep it firewalled to your LAN."
-            else
-                msg="Stratum (:3333) bind address: $old → $new (workers must reach this address)."
-            fi ;;
-        PROXY_STRATUM_PASSWORD)
-            # Secret — never echo the value into the change preview / logs.
-            if [ -z "$new" ]; then
-                msg="Stratum access-password DISABLED (#152) — any rig that can reach :3333 may mine again."
-            elif [ -z "$old" ]; then
-                flag=DEST; msg="Stratum access-password ENABLED (#152) — rigs must now send the matching 'pass' (find it in .env / 'pithead status') or they're rejected; the xmrig-proxy container is recreated."
-            else
-                flag=DEST; msg="Stratum access-password CHANGED (#152) — update every rig's 'pass' to match or they're rejected; the xmrig-proxy container is recreated."
-            fi ;;
-        PROXY_DONATE_LEVEL)
-            msg="xmrig-proxy dev-fee donation level: ${old:-0}% → ${new}% (#173) — the xmrig-proxy container is recreated (brief restart)." ;;
-        *_DATA_DIR)
-            flag=DEST; msg="$key: $old → $new — the service will use the new (empty) directory and re-sync; old data is left in place." ;;
-        P2POOL_FLAGS|P2POOL_PORT)
-            msg="P2Pool sidechain changing ($key: '$old' → '$new') — p2pool re-syncs the new sidechain and your PPLNS window resets." ;;
-        MONERO_NODE_HOST|MONERO_RPC_PORT|MONERO_ZMQ_PORT)
-            msg="Monero node endpoint ($key): $old → $new." ;;
-        MONERO_NODE_USERNAME|MONERO_NODE_PASSWORD)
-            msg="Monero node RPC credential updated ($key)." ;;
-        XVB_ENABLED|XVB_POOL_URL|XVB_DONOR_ID|XVB_DONATION_LEVEL)
-            msg="XMRvsBeast setting ($key): $old → $new." ;;
-        TARI_REQUIRED)
-            if [ "$new" == "true" ]; then
-                msg="Tari → required — a Tari outage rejects workers, the miner waits for Tari's sync, and a Tari-only sync takes over the dashboard."
-            else
-                msg="Tari → non-blocking — keep mining Monero through a Tari outage, start as soon as Monero is synced, and keep the operational dashboard while Tari syncs."
-            fi ;;
-        DASHBOARD_CHECK_UPDATES)
-            if [ "$new" == "true" ]; then
-                msg="Dashboard update check ENABLED (#224) — the dashboard will check GitHub (over Tor) for a newer release and show a link badge; the dashboard container is recreated."
-            else
-                msg="Dashboard update check DISABLED (#224) — the dashboard no longer contacts GitHub; the dashboard container is recreated."
-            fi ;;
-        TARI_MEM_LIMIT)
-            msg="Tari memory cap: $old → $new — the tari container is recreated (brief restart; on-disk chain data is preserved)." ;;
-        MONERO_MEM_LIMIT)
-            msg="Monero memory cap: $old → $new — the monerod container is recreated (brief restart; the blockchain on disk is preserved)." ;;
-        DASHBOARD_SECURE)
-            msg="Dashboard scheme → $([ "$new" == "true" ] && echo HTTPS || echo HTTP) (secure=$new)." ;;
-        DASHBOARD_AUTH_HASH_B64)
-            # Secret — never echo the hash into the change preview / logs.
-            if [ -z "$new" ]; then
-                msg="Dashboard login DISABLED (#8) — the dashboard is reachable without a password again."
-            elif [ -z "$old" ]; then
-                flag=DEST; msg="Dashboard login ENABLED (#8) — Caddy now requires the configured username/password; the caddy container is recreated."
-            else
-                flag=DEST; msg="Dashboard login password CHANGED (#8) — use the new credentials; the caddy container is recreated."
-            fi ;;
-        DASHBOARD_AUTH_USER)
-            msg="Dashboard login username: $old → $new (#8)." ;;
-        DASHBOARD_AUTH_PW_FP)
-            # Internal fingerprint — always co-changes with DASHBOARD_AUTH_HASH_B64, which already
-            # carries the user-facing message. Emit no message so the preview shows one line, not two.
-            msg="" ;;
-        HOST_IP)
-            msg="Dashboard hostname: $old → $new." ;;
-        MONERO_PREP_THREADS)
-            msg="Monero block-prep threads: $old → $new." ;;
-        MONERO_CLEARNET_SYNC)
+            msg="Monero RPC will be EXPOSED on your LAN ($old → $new) — make sure this is intended."
+        else
+            msg="Monero RPC bind address: $old → $new."
+        fi
+        ;;
+    STRATUM_BIND)
+        if [ "$new" == "0.0.0.0" ]; then
             flag=DEST
-            if [ "$new" == "true" ]; then
-                msg="⚠ Monero CLEARNET initial sync ENABLED (#183) — monerod P2P will run over CLEARNET (this host's IP becomes visible to the Monero P2P network) so the chain syncs fast. Transaction broadcast STAYS on Tor; wallets are never exposed. The dashboard switches monerod back to Tor automatically once the chain is synced (#234). monerod is recreated."
-            else
-                msg="Monero clearnet sync DISABLED (#183) — monerod P2P returns to Tor-only. monerod is recreated."
-            fi ;;
-        TARI_CLEARNET_SYNC)
+            msg="Stratum (:3333) will be published on ALL interfaces ($old → $new) — keep it firewalled to your LAN."
+        else
+            msg="Stratum (:3333) bind address: $old → $new (workers must reach this address)."
+        fi
+        ;;
+    PROXY_STRATUM_PASSWORD)
+        # Secret — never echo the value into the change preview / logs.
+        if [ -z "$new" ]; then
+            msg="Stratum access-password DISABLED (#152) — any rig that can reach :3333 may mine again."
+        elif [ -z "$old" ]; then
             flag=DEST
-            if [ "$new" == "true" ]; then
-                msg="⚠ Tari CLEARNET initial sync ENABLED (#183) — the Tari base node will sync over CLEARNET (TCP transport + seeds.tari.com DNS seed; this host's IP becomes visible to the Tari P2P network) so its large chain syncs fast. The dashboard switches Tari back to Tor automatically once the chain is synced (#234). tari is recreated."
-            else
-                msg="Tari clearnet sync DISABLED (#183) — the Tari base node returns to Tor-only transport. tari is recreated."
-            fi ;;
-        *)
-            msg="$key: $old → $new." ;;
+            msg="Stratum access-password ENABLED (#152) — rigs must now send the matching 'pass' (find it in .env / 'pithead status') or they're rejected; the xmrig-proxy container is recreated."
+        else
+            flag=DEST
+            msg="Stratum access-password CHANGED (#152) — update every rig's 'pass' to match or they're rejected; the xmrig-proxy container is recreated."
+        fi
+        ;;
+    PROXY_DONATE_LEVEL)
+        msg="xmrig-proxy dev-fee donation level: ${old:-0}% → ${new}% (#173) — the xmrig-proxy container is recreated (brief restart)."
+        ;;
+    *_DATA_DIR)
+        flag=DEST
+        msg="$key: $old → $new — the service will use the new (empty) directory and re-sync; old data is left in place."
+        ;;
+    P2POOL_FLAGS | P2POOL_PORT)
+        msg="P2Pool sidechain changing ($key: '$old' → '$new') — p2pool re-syncs the new sidechain and your PPLNS window resets."
+        ;;
+    MONERO_NODE_HOST | MONERO_RPC_PORT | MONERO_ZMQ_PORT)
+        msg="Monero node endpoint ($key): $old → $new."
+        ;;
+    MONERO_NODE_USERNAME | MONERO_NODE_PASSWORD)
+        msg="Monero node RPC credential updated ($key)."
+        ;;
+    XVB_ENABLED | XVB_POOL_URL | XVB_DONOR_ID | XVB_DONATION_LEVEL)
+        msg="XMRvsBeast setting ($key): $old → $new."
+        ;;
+    TARI_REQUIRED)
+        if [ "$new" == "true" ]; then
+            msg="Tari → required — a Tari outage rejects workers, the miner waits for Tari's sync, and a Tari-only sync takes over the dashboard."
+        else
+            msg="Tari → non-blocking — keep mining Monero through a Tari outage, start as soon as Monero is synced, and keep the operational dashboard while Tari syncs."
+        fi
+        ;;
+    DASHBOARD_CHECK_UPDATES)
+        if [ "$new" == "true" ]; then
+            msg="Dashboard update check ENABLED (#224) — the dashboard will check GitHub (over Tor) for a newer release and show a link badge; the dashboard container is recreated."
+        else
+            msg="Dashboard update check DISABLED (#224) — the dashboard no longer contacts GitHub; the dashboard container is recreated."
+        fi
+        ;;
+    TARI_MEM_LIMIT)
+        msg="Tari memory cap: $old → $new — the tari container is recreated (brief restart; on-disk chain data is preserved)."
+        ;;
+    MONERO_MEM_LIMIT)
+        msg="Monero memory cap: $old → $new — the monerod container is recreated (brief restart; the blockchain on disk is preserved)."
+        ;;
+    DASHBOARD_SECURE)
+        msg="Dashboard scheme → $([ "$new" == "true" ] && echo HTTPS || echo HTTP) (secure=$new)."
+        ;;
+    DASHBOARD_AUTH_HASH_B64)
+        # Secret — never echo the hash into the change preview / logs.
+        if [ -z "$new" ]; then
+            msg="Dashboard login DISABLED (#8) — the dashboard is reachable without a password again."
+        elif [ -z "$old" ]; then
+            flag=DEST
+            msg="Dashboard login ENABLED (#8) — Caddy now requires the configured username/password; the caddy container is recreated."
+        else
+            flag=DEST
+            msg="Dashboard login password CHANGED (#8) — use the new credentials; the caddy container is recreated."
+        fi
+        ;;
+    DASHBOARD_AUTH_USER)
+        msg="Dashboard login username: $old → $new (#8)."
+        ;;
+    DASHBOARD_AUTH_PW_FP)
+        # Internal fingerprint — always co-changes with DASHBOARD_AUTH_HASH_B64, which already
+        # carries the user-facing message. Emit no message so the preview shows one line, not two.
+        msg=""
+        ;;
+    HOST_IP)
+        msg="Dashboard hostname: $old → $new."
+        ;;
+    MONERO_PREP_THREADS)
+        msg="Monero block-prep threads: $old → $new."
+        ;;
+    MONERO_CLEARNET_SYNC)
+        flag=DEST
+        if [ "$new" == "true" ]; then
+            msg="⚠ Monero CLEARNET initial sync ENABLED (#183) — monerod P2P will run over CLEARNET (this host's IP becomes visible to the Monero P2P network) so the chain syncs fast. Transaction broadcast STAYS on Tor; wallets are never exposed. The dashboard switches monerod back to Tor automatically once the chain is synced (#234). monerod is recreated."
+        else
+            msg="Monero clearnet sync DISABLED (#183) — monerod P2P returns to Tor-only. monerod is recreated."
+        fi
+        ;;
+    TARI_CLEARNET_SYNC)
+        flag=DEST
+        if [ "$new" == "true" ]; then
+            msg="⚠ Tari CLEARNET initial sync ENABLED (#183) — the Tari base node will sync over CLEARNET (TCP transport + seeds.tari.com DNS seed; this host's IP becomes visible to the Tari P2P network) so its large chain syncs fast. The dashboard switches Tari back to Tor automatically once the chain is synced (#234). tari is recreated."
+        else
+            msg="Tari clearnet sync DISABLED (#183) — the Tari base node returns to Tor-only transport. tari is recreated."
+        fi
+        ;;
+    *)
+        msg="$key: $old → $new."
+        ;;
     esac
     printf '%s\t%s' "$flag" "$msg"
 }
@@ -2341,8 +2679,8 @@ apply() {
     local assume_yes=0 arg
     for arg in "$@"; do
         case "$arg" in
-            -y|--yes) assume_yes=1 ;;
-            *) error "Unknown option for apply: $arg. Run '$0 help'." ;;
+        -y | --yes) assume_yes=1 ;;
+        *) error "Unknown option for apply: $arg. Run '$0 help'." ;;
         esac
     done
 
@@ -2354,7 +2692,7 @@ apply() {
     fi
 
     ensure_directories
-    resolve_dashboard_host       # non-interactive
+    resolve_dashboard_host # non-interactive
     DEPLOYMENT_COMPLETED=true
 
     # Render the new config to a staging file and diff it against the live .env, so we can
@@ -2381,11 +2719,11 @@ apply() {
         for key in "${changed[@]}"; do
             old=$(env_get_file "$ENV_FILE" "$key")
             new=$(env_get_file "$newenv" "$key")
-            case "$key" in HOST_IP|DASHBOARD_SECURE|DASHBOARD_AUTH_USER|DASHBOARD_AUTH_HASH_B64) caddy_changed=1 ;; esac
+            case "$key" in HOST_IP | DASHBOARD_SECURE | DASHBOARD_AUTH_USER | DASHBOARD_AUTH_HASH_B64) caddy_changed=1 ;; esac
             line=$(describe_change "$key" "$old" "$new")
             flag=${line%%$'\t'*}
             msg=${line#*$'\t'}
-            [ -z "$msg" ] && continue   # internal-only keys (e.g. the auth fingerprint) stay silent
+            [ -z "$msg" ] && continue # internal-only keys (e.g. the auth fingerprint) stay silent
             if [ "$flag" == "DEST" ]; then
                 echo -e "  ${C_YELLOW}⚠ ${msg}${C_RESET}"
                 destructive=1
@@ -2419,16 +2757,22 @@ apply() {
 
     log "Updating containers..."
     migrate_compose_project
+    # (Re)assert the Tor-only egress firewall BEFORE compose recreates anything — same ordering as
+    # up/upgrade (#276/#291), for the same reason: if it isn't already installed (e.g. `down` then
+    # `apply`), recreating containers first opens a startup window where a clearnet app dials out and
+    # the leading ESTABLISHED rule grandfathers it past the DROP. Idempotent, so the common case
+    # (already installed from `up`) is a cheap re-assert; the .env it reads was committed just above.
+    apply_tor_egress_firewall
     # Mark the recreate in-flight: cleared only after a SUCCESSFUL `up`, so a failure here (image
     # build error, a port already bound, a failed health/dependency gate, daemon hiccup) leaves the
     # marker for the next apply to retry instead of no-opping on the already-committed config (#125).
-    : > "$apply_marker"
+    : >"$apply_marker"
     # Compose recreates only the services whose resolved config changed; --remove-orphans
     # drops monerod when a local→remote switch deactivates the local_node profile.
     if ! compose_up_checked -d --remove-orphans; then
         warn "Config files were updated but containers were NOT recreated ('docker compose up' failed)."
         warn "Fix the cause shown above, then re-run '$0 apply' (it will retry the recreate) — or '$0 up'."
-        exit 1   # leave $apply_marker in place so the retry re-attempts the recreate
+        exit 1 # leave $apply_marker in place so the retry re-attempts the recreate
     fi
     # Caddy mounts the Caddyfile read-only, so a content change alone won't recreate it.
     if [ "$caddy_changed" -eq 1 ]; then
@@ -2450,33 +2794,55 @@ main() {
     export_build_provenance
 
     case "$cmd" in
-        "")
-            # No command: first-time users get setup, deployed users get help.
-            if is_deployed; then show_help; else setup; fi
-            ;;
-        setup)
-            for arg in "$@"; do
-                case "$arg" in
-                    --skip-optimize) SKIP_OPTIMIZE=1 ;;
-                    --skip-deps)     SKIP_DEPS=1 ;;
-                    *) error "Unknown option for setup: $arg. Run '$0 help'." ;;
-                esac
-            done
-            setup
-            ;;
-        apply)            apply "$@" ;;
-        up)               require_deployed; stack_up ;;
-        down)             require_env; stack_down ;;
-        restart)          require_deployed; stack_restart ;;
-        upgrade)          require_deployed; stack_upgrade ;;
-        logs)             require_env; log "Following logs (Ctrl+C to exit)..."; docker compose logs -f "$@" ;;
-        status)           require_env; stack_status || exit 1 ;;
-        doctor)           doctor || exit 1 ;;
-        reset-dashboard)  require_deployed; reset_dashboard "$@" ;;
-        backup)           stack_backup "$@" ;;
-        restore)          stack_restore "$@" ;;
-        help|-h|--help)   show_help ;;
-        *)                error "Unknown command: $cmd. Run '$0 help'." ;;
+    "")
+        # No command: first-time users get setup, deployed users get help.
+        if is_deployed; then show_help; else setup; fi
+        ;;
+    setup)
+        for arg in "$@"; do
+            case "$arg" in
+            --skip-optimize) SKIP_OPTIMIZE=1 ;;
+            --skip-deps) SKIP_DEPS=1 ;;
+            *) error "Unknown option for setup: $arg. Run '$0 help'." ;;
+            esac
+        done
+        setup
+        ;;
+    apply) apply "$@" ;;
+    up)
+        require_deployed
+        stack_up
+        ;;
+    down)
+        require_env
+        stack_down
+        ;;
+    restart)
+        require_deployed
+        stack_restart
+        ;;
+    upgrade)
+        require_deployed
+        stack_upgrade
+        ;;
+    logs)
+        require_env
+        log "Following logs (Ctrl+C to exit)..."
+        docker compose logs -f "$@"
+        ;;
+    status)
+        require_env
+        stack_status || exit 1
+        ;;
+    doctor) doctor || exit 1 ;;
+    reset-dashboard)
+        require_deployed
+        reset_dashboard "$@"
+        ;;
+    backup) stack_backup "$@" ;;
+    restore) stack_restore "$@" ;;
+    help | -h | --help) show_help ;;
+    *) error "Unknown command: $cmd. Run '$0 help'." ;;
     esac
 }
 
diff --git a/ruff.toml b/ruff.toml
new file mode 100644
index 00000000..a7f01b25
--- /dev/null
+++ b/ruff.toml
@@ -0,0 +1,14 @@
+# Repo-root ruff config (Wave 7 tooling, #280).
+#
+# The dashboard package keeps the canonical ruff rules in build/dashboard/pyproject.toml; this
+# root config `extend`s them so that Python *outside* the package — the integration-test fakes
+# under tests/integration/ — is linted with the SAME rules, and so `ruff`/pre-commit can discover
+# a config from anywhere in the repo (per-file discovery: dashboard files resolve to the package
+# config, repo-level files resolve here).
+extend = "build/dashboard/pyproject.toml"
+extend-exclude = [".venv"]
+
+[lint.per-file-ignores]
+# The contract-test fakes are test infrastructure: bare asserts (S101) and dummy creds (S106)
+# are expected, as is a broad pytest.raises (B017) and os.path use in async bodies (ASYNC240).
+"tests/integration/fakes/**" = ["S101", "S106", "B017", "ASYNC240"]
diff --git a/scripts/release.sh b/scripts/release.sh
index 587c057c..aa60d7f9 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# Pithead release pipeline (#44) — run from the private build/test server (e.g. gouda).
+# Pithead release pipeline (#44) — run from the private build/test server.
 #
 # Implements the documented stage -> smoke-test -> promote-by-digest flow (docs/releasing.md):
 #
@@ -63,17 +63,27 @@ SOURCE_URL="https://github.com/p2pool-starter-stack/pithead"
 
 # --- Small utilities -----------------------------------------------------------------------------
 
-C_RESET=$'\033[0m'; C_BLUE=$'\033[1;34m'; C_GREEN=$'\033[1;32m'; C_YELLOW=$'\033[1;33m'; C_RED=$'\033[1;31m'
-
-log()   { printf '%s==>%s %s\n' "$C_BLUE"   "$C_RESET" "$*"; }
-ok()    { printf '%s ✓%s %s\n'  "$C_GREEN"  "$C_RESET" "$*"; }
-warn()  { printf '%s !%s %s\n'  "$C_YELLOW" "$C_RESET" "$*" >&2; }
-die()   { printf '%s ✗%s %s\n'  "$C_RED"    "$C_RESET" "$*" >&2; exit 1; }
+C_RESET=$'\033[0m'
+C_BLUE=$'\033[1;34m'
+C_GREEN=$'\033[1;32m'
+C_YELLOW=$'\033[1;33m'
+C_RED=$'\033[1;31m'
+
+log() { printf '%s==>%s %s\n' "$C_BLUE" "$C_RESET" "$*"; }
+ok() { printf '%s ✓%s %s\n' "$C_GREEN" "$C_RESET" "$*"; }
+warn() { printf '%s !%s %s\n' "$C_YELLOW" "$C_RESET" "$*" >&2; }
+die() {
+    printf '%s ✗%s %s\n' "$C_RED" "$C_RESET" "$*" >&2
+    exit 1
+}
 stage() { printf '\n%s━━ %s %s\n' "$C_BLUE" "$*" "$C_RESET"; }
 
 # In --dry-run, side-effecting commands are printed, not run. Read-only steps always run.
 run() {
-    if [ "$DRY_RUN" -eq 1 ]; then printf '   %s[dry-run]%s %s\n' "$C_YELLOW" "$C_RESET" "$*"; return 0; fi
+    if [ "$DRY_RUN" -eq 1 ]; then
+        printf '   %s[dry-run]%s %s\n' "$C_YELLOW" "$C_RESET" "$*"
+        return 0
+    fi
     "$@"
 }
 
@@ -92,23 +102,36 @@ is_semver() { [[ "$1" =~ ^[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.]+)?$ ]]; }
 
 # --- Argument parsing ----------------------------------------------------------------------------
 
-DRY_RUN=0; RC=1; SKIP_TESTS=0; SKIP_INTEGRATION=0; SKIP_SMOKE=0
-RESUME_PROMOTE=0; ALLOW_DIRTY=0; ASSUME_YES=0; DRAFT=0
+DRY_RUN=0
+RC=1
+SKIP_TESTS=0
+SKIP_INTEGRATION=0
+SKIP_SMOKE=0
+RESUME_PROMOTE=0
+ALLOW_DIRTY=0
+ASSUME_YES=0
+DRAFT=0
 
 while [ $# -gt 0 ]; do
     case "$1" in
-        --dry-run)          DRY_RUN=1 ;;
-        --rc)               RC="${2:?--rc needs a number}"; shift ;;
-        --rc=*)             RC="${1#*=}" ;;
-        --skip-tests)       SKIP_TESTS=1 ;;
-        --skip-integration) SKIP_INTEGRATION=1 ;;
-        --skip-smoke)       SKIP_SMOKE=1 ;;
-        --draft)            DRAFT=1 ;;
-        --resume-promote)   RESUME_PROMOTE=1 ;;
-        --allow-dirty)      ALLOW_DIRTY=1 ;;
-        -y|--yes)           ASSUME_YES=1 ;;
-        -h|--help)          sed -n '2,40p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
-        *)                  die "Unknown option: $1 (try --help)" ;;
+    --dry-run) DRY_RUN=1 ;;
+    --rc)
+        RC="${2:?--rc needs a number}"
+        shift
+        ;;
+    --rc=*) RC="${1#*=}" ;;
+    --skip-tests) SKIP_TESTS=1 ;;
+    --skip-integration) SKIP_INTEGRATION=1 ;;
+    --skip-smoke) SKIP_SMOKE=1 ;;
+    --draft) DRAFT=1 ;;
+    --resume-promote) RESUME_PROMOTE=1 ;;
+    --allow-dirty) ALLOW_DIRTY=1 ;;
+    -y | --yes) ASSUME_YES=1 ;;
+    -h | --help)
+        sed -n '2,40p' "$0" | sed 's/^# \{0,1\}//'
+        exit 0
+        ;;
+    *) die "Unknown option: $1 (try --help)" ;;
     esac
     shift
 done
@@ -118,11 +141,11 @@ done
 # --- State (filled by the stages) ----------------------------------------------------------------
 
 REPO_ROOT="" STACK_VERSION="" TAG="" STAGING_TAG="" GIT_COMMIT="" GIT_BRANCH="" BUILD_DATE=""
-WORKDIR=""   # scratch dir for digests, the manifest and the bundle (created in main, after preflight)
+WORKDIR="" # scratch dir for digests, the manifest and the bundle (created in main, after preflight)
 
 # Staged image digests are kept as files ($WORKDIR/digest.<suffix>), not an associative array, so this
 # runs on the stock macOS bash 3.2 too and the digests survive across stages.
-set_digest() { printf '%s' "$2" > "$WORKDIR/digest.$1"; }
+set_digest() { printf '%s' "$2" >"$WORKDIR/digest.$1"; }
 get_digest() { cat "$WORKDIR/digest.$1" 2>/dev/null || true; }
 
 # The manifest-LIST (index) digest of a pushed tag — the sha that spans every built platform, which
@@ -134,13 +157,13 @@ manifest_digest() { docker buildx imagetools inspect "$1" 2>/dev/null | awk '/^D
 # Resolve a single upstream component pin on demand (the "ingredients" each release bundles).
 pin() {
     case "$1" in
-        p2pool)       grep -oE '^ARG P2POOL_VERSION=.*'      build/p2pool/Dockerfile      | cut -d= -f2 ;;
-        monero)       grep -oE '^ARG MONERO_VERSION=.*'       build/monero/Dockerfile       | cut -d= -f2 ;;
-        xmrig-proxy)  grep -oE '^ARG XMRIG_PROXY_VERSION=.*'  build/xmrig-proxy/Dockerfile  | cut -d= -f2 ;;
-        tor-base)     grep -oE '^FROM [^ ]+' build/tor/Dockerfile | head -1 | awk '{print $2}' ;;
-        tari)         grep -oE 'quay.io/tarilabs/minotari_node:[^ ]+' docker-compose.yml | head -1 ;;
-        caddy)        grep -oE 'caddy:[0-9.]+@sha256:[a-f0-9]+' docker-compose.yml | head -1 ;;
-        socket-proxy) grep -oE 'tecnativa/docker-socket-proxy:[^ ]+' docker-compose.yml | head -1 ;;
+    p2pool) grep -oE '^ARG P2POOL_VERSION=.*' build/p2pool/Dockerfile | cut -d= -f2 ;;
+    monero) grep -oE '^ARG MONERO_VERSION=.*' build/monero/Dockerfile | cut -d= -f2 ;;
+    xmrig-proxy) grep -oE '^ARG XMRIG_PROXY_VERSION=.*' build/xmrig-proxy/Dockerfile | cut -d= -f2 ;;
+    tor-base) grep -oE '^FROM [^ ]+' build/tor/Dockerfile | head -1 | awk '{print $2}' ;;
+    tari) grep -oE 'quay.io/tarilabs/minotari_node:[^ ]+' docker-compose.yml | head -1 ;;
+    caddy) grep -oE 'caddy:[0-9.]+@sha256:[a-f0-9]+' docker-compose.yml | head -1 ;;
+    socket-proxy) grep -oE 'tecnativa/docker-socket-proxy:[^ ]+' docker-compose.yml | head -1 ;;
     esac
 }
 
@@ -155,7 +178,7 @@ preflight() {
     command -v docker >/dev/null 2>&1 || die "docker is required."
     docker buildx version >/dev/null 2>&1 || die "docker buildx is required (for digest-level promotion)."
 
-    STACK_VERSION="$(tr -d ' \t\r\n' < VERSION)"
+    STACK_VERSION="$(tr -d ' \t\r\n' <VERSION)"
     is_semver "$STACK_VERSION" || die "VERSION ('$STACK_VERSION') is not SemVer (expected X.Y.Z)."
     TAG="v$STACK_VERSION"
     STAGING_TAG="${TAG}-rc.${RC}"
@@ -268,7 +291,9 @@ stage_push() {
     for suffix in "${IMAGES[@]}"; do
         repo="$(image_for "$suffix")"
         if [ "$DRY_RUN" -eq 1 ]; then
-            set_digest "$suffix" "$repo@sha256:<dry-run>"; log "  digest: $repo@sha256:<dry-run>"; continue
+            set_digest "$suffix" "$repo@sha256:<dry-run>"
+            log "  digest: $repo@sha256:<dry-run>"
+            continue
         fi
         digest="$(manifest_digest "$repo:$STAGING_TAG")"
         [ -n "$digest" ] || die "Could not read the pushed manifest digest for $repo:$STAGING_TAG."
@@ -283,7 +308,7 @@ ghcr_login() {
     user="${GHCR_USER:-}"
     token="${GHCR_TOKEN:-${GITHUB_TOKEN:-}}"
     [ -n "$token" ] || token="$(gh auth token 2>/dev/null || true)"
-    [ -n "$user" ]  || user="$(gh api user --jq .login 2>/dev/null || true)"
+    [ -n "$user" ] || user="$(gh api user --jq .login 2>/dev/null || true)"
     if [ -z "$token" ]; then
         warn "No registry token (GHCR_TOKEN / GITHUB_TOKEN / gh auth) — assuming docker is already logged in to $registry_host."
         return 0
@@ -295,8 +320,8 @@ ghcr_login() {
         return 0
     fi
     log "Logging in to $registry_host as ${user:-<token-user>} (token not shown)..."
-    printf '%s' "$token" | docker login "$registry_host" -u "${user:-x}" --password-stdin >/dev/null \
-        || die "docker login to $registry_host failed."
+    printf '%s' "$token" | docker login "$registry_host" -u "${user:-x}" --password-stdin >/dev/null ||
+        die "docker login to $registry_host failed."
     ok "Registry login OK."
 }
 
@@ -322,15 +347,17 @@ smoke_test() {
         run docker pull --quiet --platform "${PLATFORMS%%,*}" "$repo:$STAGING_TAG"
         if [ "$DRY_RUN" -eq 0 ]; then
             got="$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.version"}}' "$repo:$STAGING_TAG" 2>/dev/null || true)"
-            [ "$got" = "$STACK_VERSION" ] \
-                || die "Smoke: $repo:$STAGING_TAG reports version '$got', expected '$STACK_VERSION'."
+            [ "$got" = "$STACK_VERSION" ] ||
+                die "Smoke: $repo:$STAGING_TAG reports version '$got', expected '$STACK_VERSION'."
             # The pushed manifest MUST carry every target platform — a wrong-arch image here means the
             # build host's arch leaked through (the v1.0.0 bug: an arm64 host produced an arm64-labelled
             # image that doesn't run on x86_64). Read the raw manifest list and require each $PLATFORMS.
-            local arches; arches="$(docker buildx imagetools inspect "$repo:$STAGING_TAG" --raw 2>/dev/null \
-                | python3 -c 'import sys,json;d=json.load(sys.stdin);print(" ".join(sorted({m.get("platform",{}).get("os","")+"/"+m["platform"]["architecture"] for m in d.get("manifests",[]) if m.get("platform",{}).get("architecture") not in (None,"unknown")})))' 2>/dev/null || true)"
-            local p; for p in ${PLATFORMS//,/ }; do
-                case " $arches " in *" $p "*) ;; *) die "Smoke: $repo:$STAGING_TAG is missing target platform $p (got: ${arches:-none}). A wrong-arch build leaked through (the v1.0.0 arm64-only bug).";; esac
+            local arches
+            arches="$(docker buildx imagetools inspect "$repo:$STAGING_TAG" --raw 2>/dev/null |
+                python3 -c 'import sys,json;d=json.load(sys.stdin);print(" ".join(sorted({m.get("platform",{}).get("os","")+"/"+m["platform"]["architecture"] for m in d.get("manifests",[]) if m.get("platform",{}).get("architecture") not in (None,"unknown")})))' 2>/dev/null || true)"
+            local p
+            for p in ${PLATFORMS//,/ }; do
+                case " $arches " in *" $p "*) ;; *) die "Smoke: $repo:$STAGING_TAG is missing target platform $p (got: ${arches:-none}). A wrong-arch build leaked through (the v1.0.0 arm64-only bug)." ;; esac
             done
             log "  $repo:$STAGING_TAG OK ($arches)"
         fi
@@ -346,8 +373,8 @@ smoke_test() {
 
 promote() {
     stage "6/7  Promote by digest -> $TAG + latest"
-    confirm "Promote the smoke-tested digests to $TAG and :latest (publishes user-facing tags)?" \
-        || die "Promotion cancelled — nothing user-facing was published."
+    confirm "Promote the smoke-tested digests to $TAG and :latest (publishes user-facing tags)?" ||
+        die "Promotion cancelled — nothing user-facing was published."
     ghcr_login
     local suffix repo digest
     for suffix in "${IMAGES[@]}"; do
@@ -368,18 +395,21 @@ publish() {
     stage "7/7  Publish GitHub Release $TAG"
     local manifest="$WORKDIR/ingredients-$TAG.md"
     write_manifest "$manifest"
-    local bundle="$WORKDIR/pithead.tar.gz"   # versionless name → stable /releases/latest/download/ URL
+    local bundle="$WORKDIR/pithead.tar.gz" # versionless name → stable /releases/latest/download/ URL
     make_bundle "$bundle"
 
-    confirm "Create git tag $TAG, push it, and publish the GitHub Release?" \
-        || { warn "Publish cancelled. Images are promoted; re-run --resume-promote-less to finish, or publish by hand."; return 0; }
+    confirm "Create git tag $TAG, push it, and publish the GitHub Release?" ||
+        {
+            warn "Publish cancelled. Images are promoted; re-run --resume-promote to finish, or publish by hand."
+            return 0
+        }
 
     run git tag -a "$TAG" -m "Pithead $TAG"
     run git push origin "$TAG"
 
     local notes="$WORKDIR/notes.md"
-    changelog_notes > "$notes"
-    cat "$manifest" >> "$notes"
+    changelog_notes >"$notes"
+    cat "$manifest" >>"$notes"
 
     if command -v gh >/dev/null 2>&1; then
         # --draft holds the GitHub Release for review (not visible/announced until published by hand).
@@ -406,27 +436,27 @@ write_manifest() {
             printf -- '- `%s`\n  - digest: `%s`\n' "$repo:$TAG" "${dg:-<not staged>}"
         done
         printf '\n### Upstream component pins\n\n'
-        printf -- '- p2pool: `%s`\n'              "$(pin p2pool)"
-        printf -- '- monerod: `%s`\n'             "$(pin monero)"
-        printf -- '- xmrig-proxy: `%s`\n'         "$(pin xmrig-proxy)"
-        printf -- '- tor base: `%s`\n'            "$(pin tor-base)"
-        printf -- '- tari: `%s`\n'                "$(pin tari)"
-        printf -- '- caddy: `%s`\n'               "$(pin caddy)"
+        printf -- '- p2pool: `%s`\n' "$(pin p2pool)"
+        printf -- '- monerod: `%s`\n' "$(pin monero)"
+        printf -- '- xmrig-proxy: `%s`\n' "$(pin xmrig-proxy)"
+        printf -- '- tor base: `%s`\n' "$(pin tor-base)"
+        printf -- '- tari: `%s`\n' "$(pin tari)"
+        printf -- '- caddy: `%s`\n' "$(pin caddy)"
         printf -- '- docker-socket-proxy: `%s`\n' "$(pin socket-proxy)"
-    } > "$out"
+    } >"$out"
     log "Wrote ingredients manifest: $out"
 }
 
 # The host paths under ./build/ that docker-compose.yml MOUNTS at runtime (volumes:), as opposed to
 # build: contexts. A pull-based bundle builds nothing and the images do NOT bake these in — monerod, for
-# instance, reads /root/bitmonero.conf.template purely from this host mount — so every one MUST ship in
+# instance, reads /home/ubuntu/bitmonero.conf.template purely from this host mount — so every one MUST ship in
 # the bundle, or the container mounts an empty dir and fails to start (the v1.0.0 bundle missed monerod's
 # template this way). Matches the volume short-syntax source (between "- " and the first ":"); ignores
 # build:/context: lines so no Dockerfile lands in the bundle (which would flip is_source_checkout to true
 # and make pithead build instead of pull). Sourced + unit-tested.
 compose_build_mounts() {
-    grep -oE '^[[:space:]]*-[[:space:]]+\./build/[^:[:space:]]+:' "${1:-docker-compose.yml}" \
-        | sed -E 's/^[[:space:]]*-[[:space:]]+//; s/:$//' | sort -u
+    grep -oE '^[[:space:]]*-[[:space:]]+\./build/[^:[:space:]]+:' "${1:-docker-compose.yml}" |
+        sed -E 's/^[[:space:]]*-[[:space:]]+//; s/:$//' | sort -u
 }
 
 # A pinned, pull-based install bundle: the runtime files needed to `./pithead setup` WITHOUT building.
@@ -436,29 +466,50 @@ compose_build_mounts() {
 # containers find the config templates they render at setup.
 make_bundle() {
     # Unpacks to a versionless "pithead/" dir so the documented quick start can `cd pithead` and so a
-    # later bundle re-download upgrades it in place. Ships BOTH config templates: config.json.template
+    # later bundle re-download upgrades it in place. Ships BOTH config templates: config.minimal.json
     # (basic — just the two wallet addresses, the documented quick-start config) and the advanced
     # example. The bundle README + the repo quick start both point at the basic one (matching setup's
-    # own "copy config.json.template" guidance); the advanced example is "for more options".
+    # own "copy config.minimal.json" guidance); the advanced example is "for more options".
     local out="$1" d="$WORKDIR/pithead"
     mkdir -p "$d"
-    cp pithead VERSION docker-compose.yml config.json.template config.advanced.example.json "$d/" 2>/dev/null || true
+    cp pithead VERSION docker-compose.yml config.minimal.json config.reference.json "$d/" 2>/dev/null || true
     local m
     while IFS= read -r m; do
-        [ -e "$m" ] || { warn "bundle: compose mounts '$m' but it is missing from the tree — skipping"; continue; }
+        [ -e "$m" ] || {
+            warn "bundle: compose mounts '$m' but it is missing from the tree — skipping"
+            continue
+        }
         mkdir -p "$d/$(dirname "$m")"
         cp -R "$m" "$d/$(dirname "$m")/"
     done < <(compose_build_mounts docker-compose.yml)
-    printf 'Pithead %s — pinned install bundle (images pulled from %s, no local build).\n\nQuick start:\n  1. cp config.json.template config.json   # then set your Monero + Tari payout addresses\n     (more options: config.advanced.example.json)\n  2. ./pithead setup\n\nThere are no build contexts here, so pithead pulls the published %s images instead of building.\n' \
-        "$TAG" "$REGISTRY" "$TAG" > "$d/README.txt"
-    if [ "$DRY_RUN" -eq 1 ]; then printf '   %s[dry-run]%s would tar -> %s\n' "$C_YELLOW" "$C_RESET" "$out"; return 0; fi
-    tar -czf "$out" -C "$WORKDIR" "pithead"
+    printf 'Pithead %s — pinned install bundle (images pulled from %s, no local build).\n\nQuick start:\n  1. cp config.minimal.json config.json   # then set your Monero + Tari payout addresses\n     (more options: config.reference.json)\n  2. ./pithead setup\n\nThere are no build contexts here, so pithead pulls the published %s images instead of building.\n' \
+        "$TAG" "$REGISTRY" "$TAG" >"$d/README.txt"
+    if [ "$DRY_RUN" -eq 1 ]; then
+        printf '   %s[dry-run]%s would tar -> %s\n' "$C_YELLOW" "$C_RESET" "$out"
+        return 0
+    fi
+    # --no-xattrs: we cut releases on macOS, where tar is bsdtar and stores each file's extended
+    # attributes (incl. macOS's com.apple.provenance) as LIBARCHIVE.xattr.* pax headers. GNU tar on
+    # a user's Linux box doesn't know that keyword and warns once per file on extract (#252). Stripping
+    # xattrs makes the bundle clean; the flag is a portable no-op on GNU tar (xattrs aren't stored by
+    # default), so release.sh stays correct if a release is ever cut on Linux.
+    tar --no-xattrs -czf "$out" -C "$WORKDIR" "pithead"
+    # Guard the fix (#252): the bundle must carry no extended-attribute pax headers
+    # (LIBARCHIVE.xattr.* from bsdtar / SCHILY.xattr.* from GNU tar) — those make GNU tar warn once
+    # per file on a Linux extract. pax headers store the keyword as plain text in the tar stream, so
+    # grepping the decompressed bytes detects them regardless of which tar built the archive.
+    if gzip -dc "$out" 2>/dev/null | grep -qa -e 'LIBARCHIVE.xattr' -e 'SCHILY.xattr'; then
+        die "Bundle $out carries xattr pax headers (#252) — GNU tar will warn on extract. Does this tar honor --no-xattrs?"
+    fi
     log "Wrote install bundle: $out"
 }
 
 # Release notes = the top (newest) section of CHANGELOG.md — the curated, user-facing summary.
 changelog_notes() {
-    if [ ! -f CHANGELOG.md ]; then printf 'Pithead %s\n' "$TAG"; return; fi
+    if [ ! -f CHANGELOG.md ]; then
+        printf 'Pithead %s\n' "$TAG"
+        return
+    fi
     # Print from the first "## [" heading up to (but not including) the next one.
     awk '/^## \[/{ if (seen) exit; seen=1 } seen' CHANGELOG.md
 }
@@ -468,7 +519,7 @@ changelog_notes() {
 main() {
     log "Pithead release pipeline (#44)$([ "$DRY_RUN" -eq 1 ] && echo '  [DRY RUN]')"
     preflight
-    WORKDIR="$(mktemp -d)"   # holds the captured digests, the ingredients manifest and the bundle
+    WORKDIR="$(mktemp -d)" # holds the captured digests, the ingredients manifest and the bundle
     if [ "$RESUME_PROMOTE" -eq 1 ]; then
         warn "--resume-promote: skipping build/stage. Re-staging to recover digests..."
         ghcr_login
diff --git a/tests/integration/README.md b/tests/integration/README.md
index 760aeba3..8515dce2 100644
--- a/tests/integration/README.md
+++ b/tests/integration/README.md
@@ -1,7 +1,7 @@
 # Integration tests (`tests/integration/`)
 
-End-to-end suite that drives a **real, already-provisioned Pithead server** through the
-config matrix and asserts the stack behaves (issue
+End-to-end suite that drives a real, already-provisioned Pithead server through the config matrix
+and asserts the stack behaves (issue
 [#54](https://github.com/p2pool-starter-stack/pithead/issues/54)).
 
 ```
@@ -16,7 +16,7 @@ mini-stack/    docker overlay running the real dashboard + docker-control vs the
                scenario runner for hold/release + reject/readmit (tier 3; needs docker)
 ```
 
-The live matrix here is **tier 4** of the broader plan — see
+The live matrix here is tier 4 of the broader plan. See
 [`docs/testing-strategy.md`](../../docs/testing-strategy.md) for all four tiers and the full
 scenario catalog.
 
@@ -33,5 +33,5 @@ make test-integration ARGS="--host miner@10.0.0.5 --dir pithead"
 make test-integration-selftest
 ```
 
-**Full guide — provisioning the box, the safety model, the matrix, artifacts, and
-CI/release wiring — is in [`docs/integration-testing.md`](../../docs/integration-testing.md).**
+Full guide — provisioning the box, the safety model, the matrix, artifacts, and CI/release
+wiring — is in [`docs/integration-testing.md`](../../docs/integration-testing.md).
diff --git a/tests/integration/benchmarks/bench-analyze.py b/tests/integration/benchmarks/bench-analyze.py
new file mode 100755
index 00000000..a424c040
--- /dev/null
+++ b/tests/integration/benchmarks/bench-analyze.py
@@ -0,0 +1,190 @@
+#!/usr/bin/env python3
+"""bench-analyze.py — reduce the #256 Tor-vs-clearnet JSONL into a per-arm comparison.
+
+Reads the collector output (tor.jsonl / clearnet.jsonl) plus events.log (for the block
+boundaries) from a benchmark dir and prints a per-block + per-arm summary, then the Tor-vs-clearnet
+verdict. Read-only; pure stdlib so it runs anywhere.
+
+    bench-analyze.py [BENCH_DIR]          # default: ~/pithead-bench
+
+Methodology (matches docs/benchmarks/tor-vs-clearnet.md):
+  * The block is the statistical unit — 5-min snapshots within a block are autocorrelated, so we
+    reduce each block to one number (its post-settle mean) and compare the 3 Tor vs 3 clearnet blocks.
+  * The first settle-hours of every block are DISCARDED (p2pool reconnects + the PPLNS window
+    re-stabilises after each arm switch).
+  * Primary metric: reward_share (p2pool block_reward_share_percent). Because the fleet hashrate is
+    held constant across arms, we also report yield-efficiency = reward_share / hashrate_share, which
+    cancels drift in the sidechain's total hashrate as other miners come and go.
+  * shares_found / shares_failed are cumulative counters that RESET when p2pool is recreated at each
+    switch, so per-block totals are taken as the max within the block.
+"""
+
+import calendar
+import json
+import os
+import sys
+import time
+from statistics import mean, pstdev
+
+
+def parse_ts(s):
+    # timegm treats the parsed struct_time as UTC (the events.log stamps are all `...Z`). Avoids the
+    # datetime.UTC alias so the script stays portable to older Pythons — it's documented as run-anywhere.
+    return calendar.timegm(time.strptime(s, "%Y-%m-%dT%H:%M:%SZ"))
+
+
+def load_blocks(events_path):
+    """Return [(block_idx, arm, start_epoch, end_epoch)] and settle seconds, from events.log."""
+    starts, end, settle_h = [], None, 3.0
+    with open(events_path) as fh:
+        for line in fh:
+            parts = line.split()
+            if len(parts) < 2:
+                continue
+            ts = parse_ts(parts[0])
+            rest = " ".join(parts[1:])
+            if rest.startswith("RUN START"):
+                starts.append((1, "tor", ts))  # block 1 is always the Tor arm
+                for tok in parts:
+                    if tok.startswith("settle-hours="):
+                        settle_h = float(tok.split("=", 1)[1])
+            elif rest.startswith("BLOCK "):
+                idx = int(parts[2].split("/")[0])
+                arm = next(t.split("=", 1)[1] for t in parts if t.startswith("arm="))
+                starts.append((idx, arm, ts))
+            elif rest.startswith("RUN COMPLETE"):
+                end = ts
+    starts.sort(key=lambda x: x[0])
+    blocks = []
+    for i, (idx, arm, start) in enumerate(starts):
+        stop = starts[i + 1][2] if i + 1 < len(starts) else (end or float("inf"))
+        blocks.append((idx, arm, start, stop))
+    return blocks, settle_h * 3600
+
+
+def load_rows(path):
+    rows = []
+    if os.path.exists(path):
+        with open(path) as fh:
+            for line in fh:
+                line = line.strip()
+                if line:
+                    try:
+                        rows.append(json.loads(line))
+                    except json.JSONDecodeError:
+                        pass
+    return rows
+
+
+def num(rows, key):
+    return [r[key] for r in rows if isinstance(r.get(key), (int, float))]
+
+
+def block_summary(rows):
+    """Reduce one block's post-settle snapshots to a dict of metrics."""
+    rs = num(rows, "reward_share")
+    our_hr = num(rows, "hashrate_1h")
+    pool_hr = [h for h in num(rows, "pool_hr") if h > 0]
+    # hashrate share (%) computed per-snapshot then averaged, guarding divide-by-zero.
+    hs = [
+        100.0 * r["hashrate_1h"] / r["pool_hr"]
+        for r in rows
+        if r.get("pool_hr") and r.get("hashrate_1h") is not None and r["pool_hr"] > 0
+    ]
+    return {
+        "n": len(rows),
+        "reward_share": mean(rs) if rs else 0.0,
+        "hashrate_share": mean(hs) if hs else 0.0,
+        "yield_eff": (mean(rs) / mean(hs)) if rs and hs and mean(hs) else 0.0,
+        "shares_found": max(num(rows, "shares_found") or [0]),
+        "shares_failed": max(num(rows, "shares_failed") or [0]),
+        "avg_effort": mean(num(rows, "avg_effort")) if num(rows, "avg_effort") else 0.0,
+        "peers_out": mean(num(rows, "peers_out")) if num(rows, "peers_out") else 0.0,
+        "our_hr_khs": (mean(our_hr) / 1000.0) if our_hr else 0.0,
+        "pool_hr_mhs": (mean(pool_hr) / 1e6) if pool_hr else 0.0,
+        "tor_cpu": mean(num(rows, "tor_cpu_pct")) if num(rows, "tor_cpu_pct") else 0.0,
+    }
+
+
+def main():
+    bench_dir = sys.argv[1] if len(sys.argv) > 1 else os.path.expanduser("~/pithead-bench")
+    blocks, settle = load_blocks(os.path.join(bench_dir, "events.log"))
+    rows = {
+        "tor": load_rows(os.path.join(bench_dir, "tor.jsonl")),
+        "clearnet": load_rows(os.path.join(bench_dir, "clearnet.jsonl")),
+    }
+
+    print(f"# #256 Tor-vs-clearnet analysis   (settle discarded: {settle / 3600:.0f}h/block)\n")
+    per_block = {"tor": [], "clearnet": []}
+    hdr = (
+        f"{'blk':>3} {'arm':<8} {'n':>4} {'reward%':>8} {'hr-share%':>9} {'yield-eff':>9} "
+        f"{'shares':>6} {'rej':>4} {'effort%':>7} {'peers':>5} {'torCPU%':>7}"
+    )
+    print(hdr)
+    print("-" * len(hdr))
+    for idx, arm, start, stop in blocks:
+        keep = [r for r in rows[arm] if start + settle <= r["ts"] < stop]
+        if not keep:
+            continue
+        s = block_summary(keep)
+        per_block[arm].append(s)
+        print(
+            f"{idx:>3} {arm:<8} {s['n']:>4} {s['reward_share']:>8.3f} {s['hashrate_share']:>9.3f} "
+            f"{s['yield_eff']:>9.3f} {int(s['shares_found']):>6} {int(s['shares_failed']):>4} "
+            f"{s['avg_effort']:>7.1f} {s['peers_out']:>5.1f} {s['tor_cpu']:>7.1f}"
+        )
+
+    print("\n## Per-arm (mean of block means; ± = block-to-block stdev, the noise floor)\n")
+    agg = {}
+    for arm in ("tor", "clearnet"):
+        bs = per_block[arm]
+        if not bs:
+            continue
+
+        def col(key, blocks=bs):
+            return [b[key] for b in blocks]
+
+        agg[arm] = {k: mean(col(k)) for k in bs[0]}
+        agg[arm]["reward_sd"] = pstdev(col("reward_share")) if len(bs) > 1 else 0.0
+        agg[arm]["yield_sd"] = pstdev(col("yield_eff")) if len(bs) > 1 else 0.0
+        agg[arm]["shares_total"] = sum(col("shares_found"))
+        agg[arm]["rej_total"] = sum(col("shares_failed"))
+        a = agg[arm]
+        print(
+            f"  {arm:<9} blocks={len(bs)}  reward%={a['reward_share']:.3f} ±{a['reward_sd']:.3f}  "
+            f"yield-eff={a['yield_eff']:.3f} ±{a['yield_sd']:.3f}  "
+            f"shares={int(a['shares_total'])}  rej={int(a['rej_total'])}  "
+            f"effort={a['avg_effort']:.1f}%  peers={a['peers_out']:.1f}  "
+            f"our_hr={a['our_hr_khs']:.0f}kH/s  pool={a['pool_hr_mhs']:.1f}MH/s  torCPU={a['tor_cpu']:.1f}%"
+        )
+
+    if "tor" in agg and "clearnet" in agg:
+        t, c = agg["tor"], agg["clearnet"]
+        d_rs = (
+            100.0 * (t["reward_share"] - c["reward_share"]) / c["reward_share"]
+            if c["reward_share"]
+            else 0.0
+        )
+        d_ye = 100.0 * (t["yield_eff"] - c["yield_eff"]) / c["yield_eff"] if c["yield_eff"] else 0.0
+        print("\n## Tor vs clearnet")
+        print(
+            f"  reward-share:     Tor is {d_rs:+.1f}% vs clearnet  "
+            f"(clearnet block-to-block spread ±{100 * c['reward_sd'] / c['reward_share']:.1f}%)"
+            if c["reward_share"]
+            else ""
+        )
+        print(
+            f"  yield-efficiency: Tor is {d_ye:+.1f}% vs clearnet  "
+            f"(clearnet spread ±{100 * c['yield_sd'] / c['yield_eff']:.1f}%)"
+            if c["yield_eff"]
+            else ""
+        )
+        print(
+            f"  reject rate:      Tor {t['rej_total']}/{int(t['shares_total'])}  "
+            f"clearnet {c['rej_total']}/{int(c['shares_total'])}"
+        )
+        print(f"  Tor daemon CPU:   Tor arm {t['tor_cpu']:.1f}%   clearnet arm {c['tor_cpu']:.1f}%")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/tests/integration/benchmarks/bench-collect.sh b/tests/integration/benchmarks/bench-collect.sh
new file mode 100755
index 00000000..4ed8c78c
--- /dev/null
+++ b/tests/integration/benchmarks/bench-collect.sh
@@ -0,0 +1,125 @@
+#!/usr/bin/env bash
+#
+# bench-collect.sh — Tor-vs-clearnet mining benchmark collector (#256).
+#
+# Snapshots p2pool's yield + latency/connectivity metrics and the Tor daemon's overhead into a JSONL
+# file, ONE line per interval, until killed. Read-only: it only reads the `/stats/*` files p2pool
+# already writes (its --local-api / --data-api) and `docker stats`. Runs ON the mining host,
+# typically detached for days per arm. Metrics + sources are documented in
+# docs/benchmarks/tor-vs-clearnet.md.
+#
+# Usage (on the box, in or near the stack dir):
+#   tests/integration/benchmarks/bench-collect.sh <arm-label> [options]
+#   nohup .../bench-collect.sh clearnet --interval 300 >/dev/null 2>&1 &   # detached, survives logout
+#
+# Options:
+#   --interval N   seconds between snapshots (default 300 = 5 min)
+#   --out FILE     JSONL output path (default ~/pithead-bench/<arm>.jsonl; appended to)
+#   --p2pool NAME  p2pool container name (default: p2pool — the pinned compose project)
+#   --tor NAME     tor container name (default: tor)
+#   --once         take a single snapshot to stdout and exit (smoke test)
+#
+# Analyse later, e.g. the per-arm mean reward share:
+#   jq -s 'map(.reward_share|numbers)|add/length' clearnet.jsonl
+
+set -uo pipefail
+
+ARM="${1:-}"
+shift || true
+case "$ARM" in "" | -*)
+    echo "usage: bench-collect.sh <arm-label> [--interval N] [--out FILE] [--once]" >&2
+    exit 2
+    ;;
+esac
+
+INTERVAL=300
+OUT=""
+P2POOL="p2pool"
+TOR="tor"
+ONCE=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+    --interval)
+        INTERVAL="$2"
+        shift 2
+        ;;
+    --out)
+        OUT="$2"
+        shift 2
+        ;;
+    --p2pool)
+        P2POOL="$2"
+        shift 2
+        ;;
+    --tor)
+        TOR="$2"
+        shift 2
+        ;;
+    --once)
+        ONCE=1
+        shift
+        ;;
+    *)
+        echo "unknown arg: $1" >&2
+        exit 2
+        ;;
+    esac
+done
+[ -n "$OUT" ] || OUT="$HOME/pithead-bench/${ARM}.jsonl"
+
+# Read a /stats file out of the p2pool container as compact JSON, or `null` on any error/garbage.
+pstat() { docker exec "$P2POOL" cat "/stats/$1" 2>/dev/null | jq -c . 2>/dev/null || true; }
+
+snapshot() {
+    local now strat p2p pool tor_line tor_cpu tor_mem
+    now=$(date -u +%s)
+    strat=$(pstat local/stratum)
+    [ -n "$strat" ] || strat=null
+    p2p=$(pstat local/p2p)
+    [ -n "$p2p" ] || p2p=null
+    pool=$(pstat pool/stats)
+    [ -n "$pool" ] || pool=null
+    # Tor daemon overhead under sustained mining traffic.
+    tor_line=$(docker stats --no-stream --format '{{.CPUPerc}}|{{.MemUsage}}' "$TOR" 2>/dev/null)
+    tor_cpu=$(printf '%s' "$tor_line" | awk -F'|' '{gsub(/%/,"",$1); print ($1==""?"null":$1+0)}')
+    tor_mem=$(printf '%s' "$tor_line" | awk -F'|' '{split($2,a," / "); print a[1]}') # e.g. "12.3MiB"
+    [ -n "$tor_cpu" ] || tor_cpu=null
+
+    jq -cn --arg arm "$ARM" --argjson ts "$now" \
+        --argjson strat "$strat" --argjson p2p "$p2p" --argjson pool "$pool" \
+        --argjson tor_cpu "$tor_cpu" --arg tor_mem "${tor_mem:-}" '
+        {
+            ts: $ts, arm: $arm,
+            # --- primary: yield ---
+            reward_share:   ($strat.block_reward_share_percent),
+            avg_effort:     ($strat.average_effort),
+            cur_effort:     ($strat.current_effort),
+            # --- secondary: hashrate / share cadence ---
+            hashrate_1h:    ($strat.hashrate_1h),
+            hashrate_24h:   ($strat.hashrate_24h),
+            shares_found:   ($strat.shares_found),
+            shares_failed:  ($strat.shares_failed),
+            last_share:     ($strat.last_share_found_time),
+            # --- secondary: sidechain connectivity (the Tor-latency mechanism) ---
+            peers_out:      ($p2p.connections),
+            peers_in:       ($p2p.incoming_connections),
+            peer_list:      ($p2p.peer_list_size),
+            pool_hr:        ($pool.pool_statistics.hashRate),
+            sidechain_diff: ($pool.pool_statistics.sidechainDifficulty),
+            # --- Tor overhead ---
+            tor_cpu_pct:    $tor_cpu,
+            tor_mem:        $tor_mem
+        }'
+}
+
+if [ "$ONCE" = "1" ]; then
+    snapshot
+    exit 0
+fi
+
+mkdir -p "$(dirname "$OUT")"
+echo "[bench] arm=$ARM interval=${INTERVAL}s out=$OUT started=$(date -u +%FT%TZ)" >&2
+while :; do
+    line=$(snapshot 2>/dev/null) && [ -n "$line" ] && printf '%s\n' "$line" >>"$OUT"
+    sleep "$INTERVAL"
+done
diff --git a/tests/integration/benchmarks/bench-healthcheck.sh b/tests/integration/benchmarks/bench-healthcheck.sh
new file mode 100755
index 00000000..81ae8f78
--- /dev/null
+++ b/tests/integration/benchmarks/bench-healthcheck.sh
@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+#
+# bench-healthcheck.sh — read-only health assessment for the Tor-vs-clearnet benchmark (#256).
+#
+# Runs the checklist that tells us "is the run still valid?" and prints a one-line verdict plus a
+# compact JSON blob. NO side effects — the orchestrator calls it every cycle to decide whether to
+# self-protect, the cron watchdog calls it to log, and an operator can run it by hand over Tailscale.
+#
+#   bench-healthcheck.sh [--dir STACK_DIR] [--min-khs N] [--json]
+#
+# Exit code: 0 = OK, 1 = WARN (degraded but data still usable), 2 = BROKEN (this window is invalid).
+#
+# Checks (sources match bench-collect.sh so the picture is consistent):
+#   stack    — the core containers are running                         (docker compose ps)
+#   p2pool   — serving stratum + has sidechain peers + sees our hashrate (/stats/local/{stratum,p2p})
+#   hashrate — p2pool's view of our hashrate is >= --min-khs            (miners still connected)
+#   egress   — TOR arm only: no persistent clearnet leak                (bench-verify-egress.sh)
+#   firewall — TOR arm only: the #270 DOCKER-USER rules are installed
+# The current arm is inferred from .env P2POOL_FLAGS (--socks5 present => Tor arm).
+
+set -uo pipefail
+
+DIR="/srv/code/pithead"
+MIN_KHS=200
+MIN_WORKERS=6
+JSON=0
+while [ $# -gt 0 ]; do
+    case "$1" in
+    --dir)
+        DIR="$2"
+        shift 2
+        ;;
+    --min-khs)
+        MIN_KHS="$2"
+        shift 2
+        ;; # accepted for compat; hashrate is display-only (see below)
+    --min-workers)
+        MIN_WORKERS="$2"
+        shift 2
+        ;;
+    --json)
+        JSON=1
+        shift
+        ;;
+    *)
+        echo "unknown arg: $1" >&2
+        exit 2
+        ;;
+    esac
+done
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+pstat() { docker exec p2pool cat "/stats/$1" 2>/dev/null | jq -c . 2>/dev/null || true; }
+envv() { grep -E "^$1=" "$DIR/.env" 2>/dev/null | head -n1 | cut -d= -f2-; }
+
+problems=""
+warns=""
+
+# 1. Core containers running.
+running="$(cd "$DIR" && docker compose ps --services --status running 2>/dev/null | sort | tr '\n' ' ')"
+core_down=""
+for s in monerod p2pool tari xmrig-proxy tor; do
+    case " $running " in *" $s "*) ;; *) core_down="${core_down}$s " ;; esac
+done
+[ -z "$core_down" ] || problems="${problems}core-down:[${core_down% }] "
+
+# 2. p2pool serving + peers + our hashrate.
+strat="$(pstat local/stratum)"
+[ -n "$strat" ] || strat=null
+p2p="$(pstat local/p2p)"
+[ -n "$p2p" ] || p2p=null
+# 15m average (not 1h) so the check reflects reality within ~15 min of a fleet connect / arm-switch
+# p2pool restart, instead of falsely flagging low-hashrate for ~an hour while a 1h average ramps.
+hr_hs="$(printf '%s' "$strat" | jq -r '(.hashrate_15m // 0)')"
+[ "$hr_hs" = null ] && hr_hs=0
+hr_khs=$(awk -v h="${hr_hs:-0}" 'BEGIN{printf "%.0f", h/1000}')
+peers="$(printf '%s' "$p2p" | jq -r '(.connections // 0)')"
+[ "$peers" = null ] && peers=0
+[ "$strat" = null ] && problems="${problems}p2pool-no-stratum "
+[ "${peers:-0}" -gt 0 ] 2>/dev/null || warns="${warns}p2pool-0-peers "
+
+# 3. Miners connected — use proxy_workers (reliable). p2pool's hashrate_1h/15m is a SHARE-BASED
+# estimate, very jumpy on mini where shares are sparse, so it would false-WARN; it's display-only.
+# The dashboard is host-networked, so it's on 127.0.0.1:8000 of the box.
+workers="$(curl -fsS --max-time 5 http://127.0.0.1:8000/api/state 2>/dev/null | jq -r '.proxy_workers // empty' 2>/dev/null)"
+if [ -n "$workers" ]; then
+    [ "$workers" -ge "$MIN_WORKERS" ] 2>/dev/null || warns="${warns}miners(${workers}/${MIN_WORKERS}+expected) "
+else
+    workers="?" # dashboard unreachable; don't WARN on the noisy hashrate estimate
+fi
+
+# 4 + 5. Arm-dependent: TOR arm must not leak and must have the firewall.
+arm=clearnet
+case "$(envv P2POOL_FLAGS)" in *--socks5*) arm=tor ;; esac
+egress=n/a
+fw=n/a
+if [ "$arm" = tor ]; then
+    # 3-poll/30s persistence check — matches the switch-time gate's rigor so a brief Tari connection
+    # (Tari still attempts some direct dials that the firewall DROPs; the home IP is never exposed)
+    # doesn't false-flag BROKEN and trigger an unnecessary recovery. Only a SUSTAINED leak fails.
+    if bash "$HERE/bench-verify-egress.sh" tor --dir "$DIR" --polls 3 --interval 10 >/dev/null 2>&1; then
+        egress=clean
+    else
+        egress=LEAK
+        problems="${problems}clearnet-leak "
+    fi
+    fwn=$(sudo -n iptables -S DOCKER-USER 2>/dev/null | grep -c pithead-tor-egress || true)
+    fw="${fwn:-0}"
+    [ "${fwn:-0}" -ge 7 ] 2>/dev/null || warns="${warns}firewall(${fwn:-0}/7) "
+fi
+
+# Verdict.
+if [ -n "$problems" ]; then
+    verdict=BROKEN
+    rc=2
+elif [ -n "$warns" ]; then
+    verdict=WARN
+    rc=1
+else
+    verdict=OK
+    rc=0
+fi
+
+now="$(date -u +%FT%TZ)"
+if [ "$JSON" = 1 ]; then
+    jq -cn --arg v "$verdict" --arg arm "$arm" --arg workers "${workers:-?}" --argjson khs "${hr_khs:-0}" --argjson peers "${peers:-0}" \
+        --arg egress "$egress" --arg fw "$fw" --arg t "$now" \
+        --arg problems "${problems% }" --arg warns "${warns% }" \
+        '{ts:$t, verdict:$v, arm:$arm, workers:$workers, hashrate_khs:$khs, peers:$peers, egress:$egress, firewall:$fw, problems:$problems, warns:$warns}'
+else
+    printf '%s [%s] arm=%s workers=%s hashrate~%skH/s peers=%s egress=%s%s%s\n' \
+        "$now" "$verdict" "$arm" "${workers:-?}" "${hr_khs:-0}" "${peers:-0}" "$egress" \
+        "${problems:+ problems=[${problems% }]}" "${warns:+ warns=[${warns% }]}"
+fi
+exit "$rc"
diff --git a/tests/integration/benchmarks/bench-orchestrate.sh b/tests/integration/benchmarks/bench-orchestrate.sh
new file mode 100755
index 00000000..20a6bc34
--- /dev/null
+++ b/tests/integration/benchmarks/bench-orchestrate.sh
@@ -0,0 +1,346 @@
+#!/usr/bin/env bash
+#
+# bench-orchestrate.sh — autonomous driver for the Tor-vs-clearnet benchmark (#256).
+#
+# Runs ENTIRELY on the mining host so the benchmark survives the operator being offline for
+# days. It interleaves the two arms on a fixed block schedule (T -> C -> T -> C ...), egress-gates
+# every switch, keeps the collector running, health-checks each cycle, and writes a heartbeat the
+# operator reads over Tailscale (`bench-status`). All state lives in ~/pithead-bench, so a crash or a
+# reboot resumes cleanly (the cron watchdog + an @reboot entry restart it). See
+# docs/benchmarks/tor-vs-clearnet.md.
+#
+# Subcommands:
+#   run [--pool mini --block-hours 36 --blocks 8 --settle-hours 6 --interval 300 --min-khs 200]
+#                       start (fresh, writes state) or resume (no args, reads state) the interleaved run
+#   --calibrate [--pool mini --calibrate-hours 6]   measure our share rate + sidechain fraction, then exit
+#   --watchdog          (cron) ensure the run loop + stack are alive; restart/re-up if not; log health
+#   --status            print status.json (see also bench-status.sh)
+#   --stop              graceful stop: end the loop, restore the develop default (Tor), remove the cron
+#   --install-cron      add the */15 watchdog + @reboot entries
+#
+# NOT `set -e`: a long unattended loop must survive transient command failures.
+
+set -uo pipefail
+
+DIR="${BENCH_STACK_DIR:-/srv/code/pithead}"
+BENCH_DIR="${BENCH_DIR:-$HOME/pithead-bench}"
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+STATE="$BENCH_DIR/state.env"
+STATUS="$BENCH_DIR/status.json"
+EVENTS="$BENCH_DIR/events.log"
+ORCH_LOG="$BENCH_DIR/orchestrate.log"
+PIDF="$BENCH_DIR/run.pid"
+STOPF="$BENCH_DIR/stop.flag"
+mkdir -p "$BENCH_DIR"
+
+log() { printf '%s %s\n' "$(date -u +%FT%TZ)" "$*" | tee -a "$ORCH_LOG" >&2; }
+event() { printf '%s %s\n' "$(date -u +%FT%TZ)" "$*" >>"$EVENTS"; }
+now() { date -u +%s; }
+pstat() { docker exec p2pool cat "/stats/$1" 2>/dev/null | jq -c . 2>/dev/null || true; }
+
+# --- config edits (only the two transport toggles; never touches wallets/tier/other secrets) -------
+set_arm() { # <tor|clearnet>  — flip p2pool.clearnet + the #270 egress firewall together (XvB stays DISABLED), then apply (recreates p2pool+dashboard)
+    local arm="$1" cn xt fw
+    if [ "$arm" = tor ]; then
+        cn=false
+        xt=true
+        fw=true
+    else
+        cn=true
+        xt=false
+        fw=false
+    fi
+    log "switching to arm=$arm (p2pool.clearnet=$cn, tor_egress_firewall=$fw, xvb.tor=$xt, xvb.enabled=false) — pithead apply"
+    # The #270 Tor-egress firewall MUST track the arm. With it ON it DROPs direct clearnet dials from
+    # the container subnet, so the clearnet arm would get 0 sidechain peers / 0 shares (silent garbage).
+    #   tor arm      → firewall ON  (fail-closed; the switch is egress-gated before data counts)
+    #   clearnet arm → firewall OFF so p2pool can actually peer over clearnet — the baseline we measure.
+    # monerod + Tari keep their own Tor app-config in BOTH arms (so only p2pool's transport differs);
+    # firewall-off can't make them dial clearnet except Tari's upstream direct-dial bug (tari#7883),
+    # which is immaterial to the p2pool reward_share metric and self-heals on the switch back to tor.
+    # XvB stays disabled both arms: with donation_level=auto the optimizer shoves the fleet into XvB to
+    # climb tiers (observed ~96 vs ~18 kH/s, target=Whale), starving p2pool and confounding reward_share.
+    (cd "$DIR" && jq ".p2pool.clearnet=$cn | .network.tor_egress_firewall=$fw | .xvb.tor=$xt | .xvb.enabled=false" config.json >config.json.bench && mv config.json.bench config.json)
+    (cd "$DIR" && ./pithead apply -y) >>"$ORCH_LOG" 2>&1 || log "WARN: pithead apply returned non-zero"
+}
+
+gate_egress() { # <arm> — Tor arm must pass the rigorous multi-poll leak check; retry once after re-applying the firewall
+    local arm="$1"
+    [ "$arm" = tor ] || {
+        event "arm=$arm egress-gate=skip(clearnet)"
+        return 0
+    }
+    sleep 20 # let p2pool/tari re-dial under the firewall before judging
+    if bash "$HERE/bench-verify-egress.sh" tor --dir "$DIR" --polls 4 --interval 10 >>"$ORCH_LOG" 2>&1; then
+        event "arm=tor egress-gate=PASS"
+        return 0
+    fi
+    log "egress gate FAILED on tor arm — re-applying firewall + re-checking"
+    (cd "$DIR" && ./pithead apply -y) >>"$ORCH_LOG" 2>&1 || true
+    sleep 20
+    if bash "$HERE/bench-verify-egress.sh" tor --dir "$DIR" --polls 4 --interval 10 >>"$ORCH_LOG" 2>&1; then
+        event "arm=tor egress-gate=PASS(after-firewall-retry)"
+        return 0
+    fi
+    # Last resort: a grandfathered Tari clearnet connection (#271 residue, survives via ESTABLISHED).
+    # Restarting tari makes it re-dial under the firewall + proxy_bypass=false (SOCKS) → clean.
+    log "still leaking — restarting tari to clear grandfathered clearnet connections (#271 residue)"
+    (cd "$DIR" && docker compose restart tari) >>"$ORCH_LOG" 2>&1 || true
+    sleep 30
+    if bash "$HERE/bench-verify-egress.sh" tor --dir "$DIR" --polls 4 --interval 10 >>"$ORCH_LOG" 2>&1; then
+        event "arm=tor egress-gate=PASS(after-tari-restart)"
+        return 0
+    fi
+    event "arm=tor egress-gate=FAIL — window flagged invalid"
+    log "ERROR: tor arm still leaking; window flagged invalid"
+    return 1
+}
+
+collector_running() { pgrep -f "bench-collect.sh ${1} " >/dev/null 2>&1; }
+start_collector() { # <arm>
+    local arm="$1"
+    pkill -f "bench-collect.sh " 2>/dev/null || true
+    sleep 1
+    nohup bash "$HERE/bench-collect.sh" "$arm" --interval "$INTERVAL" --out "$BENCH_DIR/${arm}.jsonl" >/dev/null 2>&1 &
+    log "collector started for arm=$arm -> $BENCH_DIR/${arm}.jsonl"
+}
+
+write_status() { # <verdict-json>
+    local hc="$1" elapsed day
+    elapsed=$(($(now) - RUN_START))
+    day=$(awk -v e="$elapsed" 'BEGIN{printf "%.1f", e/86400}')
+    local sh
+    sh="$(printf '%s' "$(pstat local/stratum)" | jq -r '(.shares_found // 0)' 2>/dev/null)"
+    [ -n "$sh" ] && [ "$sh" != null ] || sh=0
+    local settling=false
+    [ "$(now)" -lt "$SETTLE_UNTIL" ] && settling=true
+    jq -n --arg updated "$(date -u +%FT%TZ)" --arg arm "$ARM" \
+        --argjson block "$BLOCK_IDX" --argjson blocks "$BLOCKS" --arg day "$day" \
+        --arg started "$(date -u -d "@$RUN_START" +%FT%TZ 2>/dev/null || echo "")" \
+        --argjson block_shares "$sh" --arg pool "$POOL" --argjson settling "$settling" \
+        --argjson stopped "$([ -f "$STOPF" ] && echo true || echo false)" \
+        --argjson hc "$hc" '
+        {updated:$updated, pool:$pool, arm:$arm, block:$block, blocks:$blocks, day:($day|tonumber),
+         started:$started, block_shares:$block_shares, settling:$settling, stopped:$stopped, health:$hc}' \
+        >"$STATUS.tmp" 2>/dev/null && mv "$STATUS.tmp" "$STATUS"
+}
+
+save_state() {
+    cat >"$STATE" <<EOF
+POOL=$POOL
+BLOCK_HOURS=$BLOCK_HOURS
+BLOCK_SECS=$BLOCK_SECS
+BLOCKS=$BLOCKS
+INTERVAL=$INTERVAL
+SETTLE_HOURS=$SETTLE_HOURS
+SETTLE_SECS=$SETTLE_SECS
+MIN_KHS=$MIN_KHS
+ARM=$ARM
+BLOCK_IDX=$BLOCK_IDX
+BLOCK_START=$BLOCK_START
+RUN_START=$RUN_START
+SETTLE_UNTIL=$SETTLE_UNTIL
+EOF
+}
+
+# --- the run loop -----------------------------------------------------------------------------------
+cmd_run() {
+    # Fresh start writes state from args; a bare `run` (watchdog/reboot) resumes from state.
+    POOL=mini
+    BLOCK_HOURS=36
+    BLOCKS=8
+    INTERVAL=300
+    SETTLE_HOURS=6
+    MIN_KHS=200
+    local fresh=0
+    while [ $# -gt 0 ]; do case "$1" in
+        --pool)
+            POOL="$2"
+            fresh=1
+            shift 2
+            ;;
+        --block-hours)
+            BLOCK_HOURS="$2"
+            shift 2
+            ;;
+        --blocks)
+            BLOCKS="$2"
+            shift 2
+            ;;
+        --interval)
+            INTERVAL="$2"
+            shift 2
+            ;;
+        --settle-hours)
+            SETTLE_HOURS="$2"
+            shift 2
+            ;;
+        --min-khs)
+            MIN_KHS="$2"
+            shift 2
+            ;;
+        *) shift ;;
+        esac done
+
+    # bash arithmetic is integer-only — convert hours to seconds up front (float-safe).
+    BLOCK_SECS=$(awk -v h="$BLOCK_HOURS" 'BEGIN{printf "%d", h*3600}')
+    SETTLE_SECS=$(awk -v h="$SETTLE_HOURS" 'BEGIN{printf "%d", h*3600}')
+    rm -f "$STOPF"
+    if [ "$fresh" = 1 ] || [ ! -f "$STATE" ]; then
+        ARM=tor
+        BLOCK_IDX=1
+        BLOCK_START=$(now)
+        RUN_START=$(now)
+        SETTLE_UNTIL=$(($(now) + SETTLE_SECS))
+        save_state
+        event "RUN START pool=$POOL block-hours=$BLOCK_HOURS blocks=$BLOCKS settle-hours=$SETTLE_HOURS"
+        (cd "$DIR" && jq ".p2pool.pool=\"$POOL\" | .xvb.enabled=false" config.json >config.json.bench && mv config.json.bench config.json)
+        set_arm tor
+        gate_egress tor || true
+        start_collector tor
+    else
+        # shellcheck disable=SC1090
+        . "$STATE"
+        log "resuming: arm=$ARM block=$BLOCK_IDX/$BLOCKS"
+        collector_running "$ARM" || start_collector "$ARM"
+    fi
+    echo $$ >"$PIDF"
+
+    while :; do
+        [ -f "$STOPF" ] && {
+            log "stop flag seen — exiting loop"
+            break
+        }
+
+        # time to switch arms?
+        if [ $(($(now) - BLOCK_START)) -ge "$BLOCK_SECS" ]; then
+            if [ "$BLOCK_IDX" -ge "$BLOCKS" ]; then
+                event "RUN COMPLETE — $BLOCKS blocks done"
+                log "all $BLOCKS blocks complete — stopping"
+                cmd_stop
+                break
+            fi
+            BLOCK_IDX=$((BLOCK_IDX + 1))
+            [ "$ARM" = tor ] && ARM=clearnet || ARM=tor
+            BLOCK_START=$(now)
+            SETTLE_UNTIL=$(($(now) + SETTLE_SECS))
+            event "BLOCK $BLOCK_IDX/$BLOCKS arm=$ARM (settle ${SETTLE_HOURS}h)"
+            save_state
+            set_arm "$ARM"
+            gate_egress "$ARM" || true
+            start_collector "$ARM"
+        fi
+
+        # health + self-heal + heartbeat
+        collector_running "$ARM" || {
+            log "collector died — restarting"
+            start_collector "$ARM"
+        }
+        local hc verdict
+        hc="$(bash "$HERE/bench-healthcheck.sh" --dir "$DIR" --min-khs "$MIN_KHS" --json 2>/dev/null)"
+        [ -n "$hc" ] || hc='{"verdict":"UNKNOWN"}'
+        verdict="$(printf '%s' "$hc" | jq -r '.verdict // "UNKNOWN"')"
+        if [ "$verdict" = BROKEN ]; then
+            event "HEALTH BROKEN: $(printf '%s' "$hc" | jq -r '.problems')"
+            log "BROKEN — attempting recovery (stack up + re-gate egress)"
+            (cd "$DIR" && ./pithead up >>"$ORCH_LOG" 2>&1) || true
+            gate_egress "$ARM" || true
+        fi
+        save_state
+        write_status "$hc"
+        sleep "$INTERVAL"
+    done
+}
+
+# --- calibration ------------------------------------------------------------------------------------
+cmd_calibrate() {
+    POOL=mini
+    local CH=6
+    while [ $# -gt 0 ]; do case "$1" in --pool)
+        POOL="$2"
+        shift 2
+        ;;
+    --calibrate-hours)
+        CH="$2"
+        shift 2
+        ;;
+    *) shift ;; esac done
+    log "calibration: pool=$POOL window=${CH}h — setting Tor arm + sampling share rate"
+    (cd "$DIR" && jq ".p2pool.pool=\"$POOL\" | .p2pool.clearnet=false | .xvb.tor=true | .xvb.enabled=false" config.json >config.json.bench && mv config.json.bench config.json)
+    set_arm tor
+    gate_egress tor || true
+    start_collector tor
+    log "warming up 600s for p2pool to connect + start finding shares..."
+    sleep 600
+    local s0 t0 s1 t1 secs spd frac poolhr ourhr
+    s0="$(printf '%s' "$(pstat local/stratum)" | jq -r '(.shares_found // 0)')"
+    t0=$(now)
+    log "baseline shares_found=$s0; sampling for ${CH}h..."
+    sleep "$(awk -v h="$CH" 'BEGIN{print int(h*3600)}')"
+    s1="$(printf '%s' "$(pstat local/stratum)" | jq -r '(.shares_found // 0)')"
+    t1=$(now)
+    ourhr="$(printf '%s' "$(pstat local/stratum)" | jq -r '(.hashrate_1h // 0)')"
+    poolhr="$(printf '%s' "$(pstat pool/stats)" | jq -r '(.pool_statistics.hashRate // 0)')"
+    secs=$((t1 - t0))
+    spd="$(awk -v a="$s0" -v b="$s1" -v s="$secs" 'BEGIN{ if(s>0) printf "%.1f", (b-a)*86400/s; else print "0"}')"
+    frac="$(awk -v o="$ourhr" -v p="$poolhr" 'BEGIN{ if(p>0) printf "%.2f", o*100/p; else print "0"}')"
+    log "CALIBRATION RESULT: ~${spd} shares/day | our hashrate=${ourhr} H/s = ${frac}% of the ${POOL} sidechain (pool=${poolhr} H/s)"
+    printf 'shares/day=%s our_pct=%s pool_hr=%s our_hr=%s\n' "$spd" "$frac" "$poolhr" "$ourhr" | tee -a "$EVENTS"
+}
+
+# --- watchdog (cron) --------------------------------------------------------------------------------
+cmd_watchdog() {
+    [ -f "$STOPF" ] && { exit 0; } # intentionally stopped
+    [ -f "$STATE" ] || { exit 0; } # nothing to supervise yet
+    if ! pgrep -f "bench-orchestrate.sh run" >/dev/null 2>&1; then
+        log "watchdog: run loop not alive — restarting (resume from state)"
+        nohup bash "$HERE/bench-orchestrate.sh" run >>"$ORCH_LOG" 2>&1 &
+    fi
+    local running
+    running="$(cd "$DIR" && docker compose ps --services --status running 2>/dev/null | wc -l)"
+    if [ "${running:-0}" -lt 5 ] 2>/dev/null; then
+        log "watchdog: stack down (${running:-0} svc) — pithead up"
+        (cd "$DIR" && ./pithead up >>"$ORCH_LOG" 2>&1) || true
+    fi
+    bash "$HERE/bench-healthcheck.sh" --dir "$DIR" --min-khs "$(grep -E '^MIN_KHS=' "$STATE" 2>/dev/null | cut -d= -f2 || echo 200)" >>"$BENCH_DIR/health.log" 2>&1 || true
+}
+
+cmd_stop() {
+    touch "$STOPF"
+    log "stop requested"
+    pkill -f "bench-collect.sh " 2>/dev/null || true
+    crontab -l 2>/dev/null | grep -v "bench-orchestrate.sh" | crontab - 2>/dev/null || true
+    # Restore the resting config: Tor default + firewall fail-closed + XvB re-enabled (the bench's normal
+    # pre-benchmark state). The firewall=true is load-bearing — if we stop mid-clearnet-block we must
+    # not leave the bench with the egress firewall off.
+    (cd "$DIR" && jq '.p2pool.clearnet=false | .network.tor_egress_firewall=true | .xvb.tor=true | .xvb.enabled=true' config.json >config.json.bench && mv config.json.bench config.json && ./pithead apply -y) >>"$ORCH_LOG" 2>&1 || true
+    log "stopped: collector killed, cron removed, restored Tor default + firewall on + re-enabled XvB. Data kept in $BENCH_DIR."
+}
+
+cmd_install_cron() {
+    local self="$HERE/bench-orchestrate.sh" tmp
+    tmp="$(mktemp)"
+    crontab -l 2>/dev/null | grep -v "bench-orchestrate.sh" >"$tmp" || true
+    echo "*/15 * * * * BENCH_STACK_DIR=$DIR bash $self --watchdog" >>"$tmp"
+    echo "@reboot BENCH_STACK_DIR=$DIR bash $self --watchdog" >>"$tmp"
+    crontab "$tmp" && rm -f "$tmp" && log "watchdog cron installed (*/15 + @reboot)"
+}
+
+case "${1:-}" in
+run)
+    shift
+    cmd_run "$@"
+    ;;
+--calibrate)
+    shift
+    cmd_calibrate "$@"
+    ;;
+--watchdog) cmd_watchdog ;;
+--status) cat "$STATUS" 2>/dev/null || echo "no status yet" ;;
+--stop) cmd_stop ;;
+--install-cron) cmd_install_cron ;;
+*)
+    echo "usage: bench-orchestrate.sh {run|--calibrate|--watchdog|--status|--stop|--install-cron} [opts]" >&2
+    exit 2
+    ;;
+esac
diff --git a/tests/integration/benchmarks/bench-status.sh b/tests/integration/benchmarks/bench-status.sh
new file mode 100755
index 00000000..8a5fc525
--- /dev/null
+++ b/tests/integration/benchmarks/bench-status.sh
@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+#
+# bench-status.sh — one-screen status of the Tor-vs-clearnet benchmark (#256), for checking over
+# Remotely: `ssh <bench-host> bench-status`. Read-only; prints status.json + the recent event/health tail.
+#
+#   bench-status.sh [--json]     (--json: dump the raw status.json instead of the pretty view)
+
+set -uo pipefail
+BENCH_DIR="${BENCH_DIR:-$HOME/pithead-bench}"
+S="$BENCH_DIR/status.json"
+
+[ "${1:-}" = --json ] && {
+    cat "$S" 2>/dev/null || echo '{}'
+    exit 0
+}
+[ -f "$S" ] || {
+    echo "No benchmark status yet ($S missing). Is the run started?"
+    exit 0
+}
+
+jq -r '
+  "Tor-vs-clearnet benchmark  (pool=\(.pool))",
+  "  arm:        \(.arm | ascii_upcase)\(if .settling then "   (SETTLING — excluded)" else "" end)",
+  "  block:      \(.block)/\(.blocks)     day \(.day)",
+  "  block shares: \(.block_shares)",
+  "  verdict:    \(.health.verdict // "?")   workers \(.health.workers // "?")/8   hashrate~\(.health.hashrate_khs // "?")kH/s (p2pool est)   peers \(.health.peers // "?")   egress \(.health.egress // "?")",
+  (if (.health.problems // "") != "" then "  problems:   \(.health.problems)" else empty end),
+  (if (.health.warns // "")    != "" then "  warns:      \(.health.warns)"    else empty end),
+  "  updated:    \(.updated)\(if .stopped then "   [STOPPED]" else "" end)"
+' "$S" 2>/dev/null || cat "$S"
+
+echo "  ---"
+# Stability line FIRST so old launch-time events below aren't alarming: if nothing has happened for
+# a while, the run is simply healthy and quiet (switches/leaks/recoveries would log a fresh event).
+last_ts="$(tail -n1 "$BENCH_DIR/events.log" 2>/dev/null | awk '{print $1}')"
+if [ -n "$last_ts" ]; then
+    age=$(($(date -u +%s) - $(date -u -d "$last_ts" +%s 2>/dev/null || echo "$(date -u +%s)")))
+    [ "$age" -lt 0 ] && age=0
+    printf '  stable: no new events for %dh %dm (a switch / leak / recovery would log one)\n' $((age / 3600)) $(((age % 3600) / 60))
+fi
+echo "  recent events (oldest may be from launch):"
+tail -n 5 "$BENCH_DIR/events.log" 2>/dev/null | sed 's/^/    /' || true
+tcl() { [ -f "$1" ] && wc -l <"$1" | tr -d ' ' || echo 0; }
+echo "  collector lines: tor=$(tcl "$BENCH_DIR/tor.jsonl")  clearnet=$(tcl "$BENCH_DIR/clearnet.jsonl")"
diff --git a/tests/integration/benchmarks/bench-verify-egress.sh b/tests/integration/benchmarks/bench-verify-egress.sh
new file mode 100755
index 00000000..74f49ddf
--- /dev/null
+++ b/tests/integration/benchmarks/bench-verify-egress.sh
@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+#
+# bench-verify-egress.sh — prove each container's ACTUAL egress posture: a live, runtime privacy-leak
+# check (and the gate for the #256 benchmark arms). It reads `/proc/net/tcp` from inside each container
+# (root there, so no host sudo) and reports every ESTABLISHED connection to a **public** IP — i.e. one
+# that bypasses the Tor SOCKS at <bridge>.25:9050 (a private 172.x address). Run ON the mining host.
+#
+#   tests/integration/benchmarks/bench-verify-egress.sh <tor|clearnet> \
+#       [--dir STACK_DIR] [--prefix 172.28.0] [--polls N] [--interval S] [--min-hits K]
+#
+# It POLLS `--polls` times (default 4) `--interval` seconds apart (default 10) and only flags a
+# foreign IP seen in `--min-hits` or more polls (default 2) — so a post-restart STARTUP TRANSIENT
+# (e.g. a brief direct dial before Tor circuits build / before p2pool's `--socks5` connects) clears
+# within a poll or two and does NOT false-positive. A real leak (a sustained peer connection) persists
+# across polls and is reported. `--polls 1` gives a single instantaneous snapshot. (#274)
+#
+# Interpretation:
+#   - `tor` arm  → EVERY app container must show 0 PERSISTENT public connections (all egress via Tor).
+#                  Only the `tor` container should reach public IPs (Tor relays). A persistent app
+#                  connection = LEAK → exit 1.
+#   - `clearnet` → the mining-path containers (p2pool, xmrig-proxy while donating) SHOULD show direct
+#                  public connections; monerod/tari staying at 0 confirms node-sync is still Tor
+#                  (the benchmark holds those constant — see docs/benchmarks/tor-vs-clearnet.md).
+#
+# Ground-truth backstop (needs root, so run by hand): a WAN-interface capture should show NO mining
+# traffic to non-Tor IPs in the tor arm —
+#   sudo tcpdump -ni <wan> 'tcp and (port 18080 or portrange 37888-37890 or port 4247) and not host <tor-relays>'
+
+set -uo pipefail
+
+ARM="${1:-}"
+case "$ARM" in tor | clearnet) shift ;; *)
+    echo "usage: bench-verify-egress.sh <tor|clearnet> [--dir DIR] [--prefix P] [--polls N] [--interval S] [--min-hits K]" >&2
+    exit 2
+    ;;
+esac
+DIR="/srv/code/pithead"
+PREFIX="172.28.0"
+POLLS=4
+INTERVAL=10
+MIN_HITS=2
+while [ $# -gt 0 ]; do
+    case "$1" in
+    --dir)
+        DIR="$2"
+        shift 2
+        ;;
+    --prefix)
+        PREFIX="$2"
+        shift 2
+        ;;
+    --polls)
+        POLLS="$2"
+        shift 2
+        ;;
+    --interval)
+        INTERVAL="$2"
+        shift 2
+        ;;
+    --min-hits)
+        MIN_HITS="$2"
+        shift 2
+        ;;
+    *)
+        echo "unknown arg: $1" >&2
+        exit 2
+        ;;
+    esac
+done
+[ "$POLLS" -ge 1 ] 2>/dev/null || {
+    echo "--polls must be >= 1" >&2
+    exit 2
+}
+[ "$MIN_HITS" -le "$POLLS" ] 2>/dev/null || MIN_HITS="$POLLS" # can't need more hits than polls
+APPS="monerod p2pool tari xmrig-proxy"
+
+# Established (st=01) foreign IPv4s for a container that are PUBLIC (skip loopback/private/bridge/
+# link-local — the Tor SOCKS lives in the private 172.16/12 range, so SOCKS-routed traffic is skipped).
+# /proc/net/tcp `rem_address` is little-endian hex "IIIIIIII:PPPP"; decode with bash arithmetic so we
+# don't depend on gawk/strtonum inside minimal images (only `cat` runs in the container). IPv4-only by
+# design — mining_net is IPv4 (matches the #270 firewall scope).
+public_conns() { # <container-id>  → one "ip:port" per established public connection
+    docker exec "$1" sh -c 'cat /proc/net/tcp 2>/dev/null' | while read -r _sl _local rem st _rest; do
+        [ "$st" = "01" ] || continue
+        local hip="${rem%:*}" hport="${rem#*:}" o1 o2 o3 o4
+        o1=$((16#${hip:6:2}))
+        o2=$((16#${hip:4:2}))
+        o3=$((16#${hip:2:2}))
+        o4=$((16#${hip:0:2}))
+        case "$o1.$o2" in 10.* | 127.* | 0.* | 169.254 | 192.168) continue ;; esac
+        { [ "$o1" = 172 ] && [ "$o2" -ge 16 ] && [ "$o2" -le 31 ]; } && continue
+        printf '%d.%d.%d.%d:%d\n' "$o1" "$o2" "$o3" "$o4" "$((16#$hport))"
+    done
+}
+
+cid_of() { (cd "$DIR" && docker compose ps -q "$1" 2>/dev/null | head -n1); }
+
+echo "[verify-egress] arm=$ARM  stack=$DIR  tor-socks=${PREFIX}.25:9050  (polls=$POLLS interval=${INTERVAL}s, persistent>=$MIN_HITS)"
+
+# Poll POLLS times; per poll record each app's UNIQUE public foreign IPs (drop the churning port). An
+# (app, ip) pair seen in >= MIN_HITS distinct polls is a SUSTAINED connection, not a startup transient.
+samples="$(mktemp)"
+trap 'rm -f "$samples"' EXIT
+p=1
+while [ "$p" -le "$POLLS" ]; do
+    for c in $APPS; do
+        cid=$(cid_of "$c")
+        [ -n "$cid" ] || continue
+        public_conns "$cid" | sed 's/:.*//' | sort -u | sed "s/^/$c /" >>"$samples"
+    done
+    [ "$p" -lt "$POLLS" ] && sleep "$INTERVAL"
+    p=$((p + 1))
+done
+# uniq -c over the per-poll-unique lines = #polls each (app,ip) appeared in; keep the persistent ones.
+persistent=$(sort "$samples" | uniq -c | awk -v m="$MIN_HITS" '$1>=m {print $2" "$3" "$1}') # "app ip hits"
+
+fail=0
+for c in $APPS; do
+    cid=$(cid_of "$c")
+    [ -n "$cid" ] || {
+        echo "  - $c: not running (skip)"
+        continue
+    }
+    rows=$(printf '%s\n' "$persistent" | awk -v a="$c" -v P="$POLLS" '$1==a {print $2" ("$3"/"P" polls)"}')
+    n=$(printf '%s' "$rows" | grep -c . || true)
+    if [ "$ARM" = "tor" ]; then
+        if [ "$n" -eq 0 ]; then
+            echo "  ✓ $c: no persistent public connections — all egress via Tor"
+        else
+            echo "  ✗ $c: $n PERSISTENT PUBLIC connection(s) — CLEARNET LEAK:"
+            printf '%s\n' "$rows" | sed 's/^/        /'
+            fail=1
+        fi
+    else
+        if [ "$n" -gt 0 ]; then
+            echo "  ✓ $c: $n persistent public connection(s) — clearnet, as expected for this arm"
+        else echo "  · $c: no persistent public connections (still Tor / idle — expected for monerod & tari)"; fi
+    fi
+done
+tcid=$(cid_of tor)
+tn=$(public_conns "$tcid" | sed 's/:.*//' | sort -u | grep -c . || true)
+echo "  · tor: $tn external relay connection(s) (expected > 0 — this is the only container that should reach the internet)"
+
+if [ "$ARM" = "tor" ] && [ "$fail" -ne 0 ]; then
+    echo "[verify-egress] FAIL — persistent clearnet leak(s) above; the 'all-Tor' arm is not clean." >&2
+    exit 1
+fi
+echo "[verify-egress] OK"
diff --git a/tests/integration/build-pruned-chain.sh b/tests/integration/build-pruned-chain.sh
index 40dbcbc6..4c75749e 100644
--- a/tests/integration/build-pruned-chain.sh
+++ b/tests/integration/build-pruned-chain.sh
@@ -21,14 +21,18 @@ CONTAINER="${CONTAINER:-monerod}"
 
 ts() { date '+%Y-%m-%dT%H:%M:%S%z'; }
 say() { echo "[$(ts)] $*"; }
-set_status() { echo "$1" > "$STATUS"; }
+set_status() { echo "$1" >"$STATUS"; }
 
 say "START build-pruned-chain"
 say "src=$SRC_DIR dst=$DST_DIR"
 mkdir -p "$DST_DIR/lmdb"
 
 src_mdb="$SRC_DIR/lmdb/data.mdb"
-if [ ! -f "$src_mdb" ]; then say "FATAL: source $src_mdb not found"; set_status "FAIL_NO_SRC"; exit 1; fi
+if [ ! -f "$src_mdb" ]; then
+    say "FATAL: source $src_mdb not found"
+    set_status "FAIL_NO_SRC"
+    exit 1
+fi
 say "source size: $(du -h "$src_mdb" | cut -f1)"
 
 set_status "STOPPING"
@@ -48,7 +52,11 @@ set_status "RESTARTING"
 say "starting $CONTAINER (downtime ends)"
 docker start "$CONTAINER" >/dev/null 2>&1 || say "WARN docker start failed"
 
-if [ $rc -ne 0 ]; then say "FATAL: copy failed"; set_status "FAIL_COPY"; exit 1; fi
+if [ $rc -ne 0 ]; then
+    say "FATAL: copy failed"
+    set_status "FAIL_COPY"
+    exit 1
+fi
 
 set_status "PRUNING"
 say "prune begin (full chain is back online; pruning the copy)"
@@ -57,7 +65,11 @@ prune_start=$(date +%s)
 rc=$?
 prune_end=$(date +%s)
 say "prune done rc=$rc in $((prune_end - prune_start))s"
-if [ $rc -ne 0 ]; then say "FATAL: prune failed"; set_status "FAIL_PRUNE"; exit 1; fi
+if [ $rc -ne 0 ]; then
+    say "FATAL: prune failed"
+    set_status "FAIL_PRUNE"
+    exit 1
+fi
 
 say "pruned size: $(du -h "$DST_DIR/lmdb/data.mdb" | cut -f1)"
 set_status "DONE"
diff --git a/tests/integration/compact-chain.sh b/tests/integration/compact-chain.sh
index d27971a1..41601424 100644
--- a/tests/integration/compact-chain.sh
+++ b/tests/integration/compact-chain.sh
@@ -34,26 +34,30 @@ ts() { date '+%Y-%m-%dT%H:%M:%S%z'; }
 say() { echo "[$(ts)] $*" | tee -a "$LOG"; }
 
 {
-  echo "===== compact run $(ts) ====="
-  echo "data-dir: $DATA_DIR"
-  echo "--- lmdb BEFORE ---"
-  ls -la "$DATA_DIR/lmdb/" 2>/dev/null
-  echo "data.mdb apparent+disk:"; du -h --apparent-size "$DATA_DIR/lmdb/data.mdb" 2>/dev/null; du -h "$DATA_DIR/lmdb/data.mdb" 2>/dev/null
-} >> "$LOG" 2>&1
+    echo "===== compact run $(ts) ====="
+    echo "data-dir: $DATA_DIR"
+    echo "--- lmdb BEFORE ---"
+    ls -la "$DATA_DIR/lmdb/" 2>/dev/null
+    echo "data.mdb apparent+disk:"
+    du -h --apparent-size "$DATA_DIR/lmdb/data.mdb" 2>/dev/null
+    du -h "$DATA_DIR/lmdb/data.mdb" 2>/dev/null
+} >>"$LOG" 2>&1
 
-echo COMPACTING > "$STATUS"
+echo COMPACTING >"$STATUS"
 say "compaction begin (data-dir=$DATA_DIR)"
 t0=$(date +%s)
-"$PRUNE_BIN" --data-dir "$DATA_DIR" --copy-pruned-database >> "$LOG" 2>&1
+"$PRUNE_BIN" --data-dir "$DATA_DIR" --copy-pruned-database >>"$LOG" 2>&1
 rc=$?
 t1=$(date +%s)
 say "compaction done rc=$rc in $((t1 - t0))s"
 
 {
-  echo "--- lmdb AFTER ---"
-  ls -la "$DATA_DIR/lmdb/" 2>/dev/null
-  echo "data.mdb apparent+disk:"; du -h --apparent-size "$DATA_DIR/lmdb/data.mdb" 2>/dev/null; du -h "$DATA_DIR/lmdb/data.mdb" 2>/dev/null
-} >> "$LOG" 2>&1
+    echo "--- lmdb AFTER ---"
+    ls -la "$DATA_DIR/lmdb/" 2>/dev/null
+    echo "data.mdb apparent+disk:"
+    du -h --apparent-size "$DATA_DIR/lmdb/data.mdb" 2>/dev/null
+    du -h "$DATA_DIR/lmdb/data.mdb" 2>/dev/null
+} >>"$LOG" 2>&1
 
-if [ $rc -eq 0 ]; then echo DONE > "$STATUS"; else echo "FAIL_rc$rc" > "$STATUS"; fi
+if [ $rc -eq 0 ]; then echo DONE >"$STATUS"; else echo "FAIL_rc$rc" >"$STATUS"; fi
 say "status=$(cat "$STATUS")"
diff --git a/tests/integration/e2e.sh b/tests/integration/e2e.sh
new file mode 100755
index 00000000..4541e145
--- /dev/null
+++ b/tests/integration/e2e.sh
@@ -0,0 +1,423 @@
+#!/usr/bin/env bash
+#
+# e2e.sh — one-command Tier-4 end-to-end run of a branch against a live test bench.
+#
+#   tests/integration/e2e.sh <branch> [options]
+#   tests/integration/e2e.sh claude/my-feature --mode matrix
+#
+# What it does, end to end, then puts everything back the way it found it:
+#   1. Provisions a DEDICATED checkout on the test bench (/srv/code/pithead-e2e) — the canonical
+#      /srv/code/pithead is the baseline and is never git-touched.
+#   2. Fetches + checks out <branch> there, and seeds it with the canonical config.json/.env so
+#      it has the same wallet / secrets / onion keys / shared chains (just the branch's code).
+#   3. Takes a `pithead backup` of the live stack (the rollback anchor).
+#   4. Borrows a miner (set MINER_HOST): backs up its xmrig config and repoints it at the test bench so
+#      the live matrix has a real worker mining through this stack.
+#   5. Deploys the branch (`pithead upgrade` — re-renders configs AND rebuilds the branch's first-party
+#      images from build/, so a Dockerfile/entrypoint change is actually tested #272) and runs the live
+#      harness (tests/integration/run.sh) DETACHED on the box so an SSH drop can't kill a long matrix.
+#   6. ALWAYS restores: the miner's original pool config, and the canonical baseline stack — even
+#      on failure or Ctrl-C (an EXIT trap). The synced chains are never touched.
+#
+# The Compose project name is pinned to "pithead", so the e2e checkout and the canonical checkout
+# drive the SAME containers + the SAME shared chains — they are two code copies of one stack, run
+# one at a time, not two stacks. That's why borrow→test→restore is a code/image swap, not a re-sync.
+#
+# Requires: SSH access to the test bench and the miner (keys, LAN reachable), and `jq` on both.
+# See tests/integration/testbench-README.md and docs/integration-testing.md.
+
+set -uo pipefail
+
+# --- Config (override via env or flags) -------------------------------------
+BENCH_HOST="${BENCH_HOST:-}"
+MINER_HOST="${MINER_HOST:-}"
+CANONICAL_DIR="${CANONICAL_DIR:-/srv/code/pithead}"
+E2E_DIR="${E2E_DIR:-/srv/code/pithead-e2e}"
+MINER_XMRIG_CONFIG="${MINER_XMRIG_CONFIG:-/opt/rigforge/data/worker/xmrig/build/config.json}"
+GIT_REMOTE_URL="${GIT_REMOTE_URL:-https://github.com/p2pool-starter-stack/pithead.git}"
+MODE="targeted" # targeted (default, lean) | check | matrix (full sweep, opt-in)
+WORKERS=1
+BORROW_MINER=1
+KEEP=0
+BRANCH=""
+
+# --- Output -----------------------------------------------------------------
+if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
+    C_RESET='\033[0m'
+    C_GREEN='\033[1;32m'
+    C_YELLOW='\033[1;33m'
+    C_RED='\033[1;31m'
+    C_BLUE='\033[1;34m'
+    C_DIM='\033[2m'
+else
+    C_RESET=''
+    C_GREEN=''
+    C_YELLOW=''
+    C_RED=''
+    C_BLUE=''
+    C_DIM=''
+fi
+log() { printf '%b==>%b %s\n' "$C_BLUE" "$C_RESET" "$*"; }
+ok() { printf '%b ✓%b %s\n' "$C_GREEN" "$C_RESET" "$*"; }
+warn() { printf '%b !%b %s\n' "$C_YELLOW" "$C_RESET" "$*" >&2; }
+step() { printf '%b  → %s%b\n' "$C_DIM" "$*" "$C_RESET"; }
+die() {
+    printf '%b ✗%b %s\n' "$C_RED" "$C_RESET" "$*" >&2
+    exit 1
+}
+
+usage() {
+    cat <<EOF
+Run a branch end-to-end against a live test bench, then restore everything.
+
+USAGE:
+  tests/integration/e2e.sh <branch> [options]
+
+OPTIONS:
+  --mode <m>        targeted | check | matrix   (default: targeted)
+                      targeted — LEAN (default): validate the dashboard + the sync logic against
+                                 the EXISTING synced node — no full config sweep, no node re-sync.
+                                 = check + lifecycle (one controlled restart exercises the sync
+                                 gate / node-down failover) + --auth-fail-closed.
+                      check    — non-destructive: readiness + current live state only (pure reads).
+                      matrix   — the full destructive config matrix + lifecycle + fault-injection
+                                 + auth-fail-closed, with --safety-backup auto-rollback. Opt-in —
+                                 a full pre-release sweep; recreates containers across many configs.
+  --workers <n>     workers expected mining through the stack (default: 1 — the borrowed miner)
+  --bench <host>    SSH host of the test bench to deploy onto (or set BENCH_HOST)
+  --miner <host>    SSH host of the miner to borrow (or set MINER_HOST)
+  --no-miner        don't borrow a miner (mining assertions will be skipped/limited)
+  --keep            don't restore at the end (leave the branch deployed + miner repointed — debugging)
+  -h, --help        this help
+
+ENV OVERRIDES: BENCH_HOST, MINER_HOST, CANONICAL_DIR, E2E_DIR, MINER_XMRIG_CONFIG, GIT_REMOTE_URL
+
+EXAMPLES:
+  tests/integration/e2e.sh claude/my-feature                 # full matrix, borrow the configured miner
+  tests/integration/e2e.sh claude/my-feature --mode check    # safe, non-destructive first run
+  tests/integration/e2e.sh main --mode targeted --keep       # quick, leave it deployed to inspect
+EOF
+}
+
+# --- Arg parsing ------------------------------------------------------------
+while [ $# -gt 0 ]; do
+    case "$1" in
+    --mode)
+        MODE="$2"
+        shift 2
+        ;;
+    --workers)
+        WORKERS="$2"
+        shift 2
+        ;;
+    --bench)
+        BENCH_HOST="$2"
+        shift 2
+        ;;
+    --miner)
+        MINER_HOST="$2"
+        shift 2
+        ;;
+    --no-miner)
+        BORROW_MINER=0
+        shift
+        ;;
+    --keep)
+        KEEP=1
+        shift
+        ;;
+    -h | --help)
+        usage
+        exit 0
+        ;;
+    -*) die "Unknown option: $1 (try --help)" ;;
+    *)
+        [ -z "$BRANCH" ] && BRANCH="$1" || die "Unexpected arg: $1"
+        shift
+        ;;
+    esac
+done
+[ -n "$BRANCH" ] || {
+    usage
+    die "A <branch> is required."
+}
+case "$MODE" in check | targeted | matrix) ;; *) die "--mode must be check|targeted|matrix (got '$MODE')." ;; esac
+
+# --- SSH helpers ------------------------------------------------------------
+# Keepalives so a quiet (but live) connection isn't dropped; BatchMode so we never hang on a prompt.
+SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=10 -o ServerAliveInterval=30 -o ServerAliveCountMax=8 -o StrictHostKeyChecking=accept-new)
+# NOTE (testbench README): avoid literal shell parens '()' in remote command strings — they break the
+# non-interactive remote shell. jq filters (quoted) are fine; shell subshells are not.
+on_bench() { ssh "${SSH_OPTS[@]}" "$BENCH_HOST" "$1"; }
+on_miner() { ssh "${SSH_OPTS[@]}" "$MINER_HOST" "$1"; }
+
+# State captured for the restore trap.
+SAFETY_ARCHIVE=""
+MINER_CFG_BACKUP=""
+RESTORED=0
+
+# --- Restore (runs on EXIT, even on failure / Ctrl-C) -----------------------
+restore_all() {
+    local rc=$?
+    [ "$RESTORED" = "1" ] && return
+    RESTORED=1
+    if [ "$KEEP" = "1" ]; then
+        warn "--keep set: leaving the branch deployed on $BENCH_HOST and the miner repointed."
+        warn "  Re-run without --keep, or restore by hand: canonical=$CANONICAL_DIR, miner cfg backup=$MINER_CFG_BACKUP"
+        return
+    fi
+    echo ""
+    log "Restoring everything to the pre-run state…"
+
+    # 1. Miner: put its original pool config back and nudge xmrig to reconnect.
+    if [ -n "$MINER_CFG_BACKUP" ]; then
+        step "restoring $MINER_HOST xmrig config from $MINER_CFG_BACKUP"
+        if on_miner "cp -a '$MINER_CFG_BACKUP' '$MINER_XMRIG_CONFIG' && chmod 600 '$MINER_XMRIG_CONFIG'"; then
+            miner_reload && ok "$MINER_HOST repointed to its original pool(s)" || warn "$MINER_HOST config restored; verify xmrig reconnected"
+        else
+            warn "FAILED to restore $MINER_HOST config — backup kept at $MINER_CFG_BACKUP"
+        fi
+    fi
+
+    # 2. Stack: stop the branch (e2e checkout) and bring the canonical baseline back up healthy.
+    step "bringing the canonical baseline stack ($CANONICAL_DIR) back up"
+    on_bench "cd '$E2E_DIR' && ./pithead down >/dev/null 2>&1 || true"
+    if on_bench "cd '$CANONICAL_DIR' && ./pithead apply -y >/dev/null 2>&1 && ./pithead up >/dev/null 2>&1"; then
+        wait_bench_healthy 300 && ok "canonical baseline stack healthy again" || warn "canonical stack came up but isn't reporting healthy yet — check 'pithead status' on $BENCH_HOST"
+    else
+        warn "canonical 'pithead apply/up' returned non-zero — check $BENCH_HOST by hand."
+        warn "  Safety backup to roll back to: $SAFETY_ARCHIVE"
+    fi
+
+    # 3. Chains sanity: they must be untouched (the whole point).
+    local sync
+    sync="$(on_bench "curl -fsS --max-time 8 http://127.0.0.1:8000/api/state 2>/dev/null | jq -r '\"\(.sync.monero.state)/\(.sync.tari.state)\"' 2>/dev/null" || true)"
+    [ -n "$sync" ] && step "post-restore sync state (monero/tari): $sync"
+
+    if [ "$rc" -eq 0 ]; then ok "restore complete."; else warn "restore complete (the run itself failed — see above)."; fi
+}
+trap restore_all EXIT INT TERM
+
+# --- Small waiters / helpers ------------------------------------------------
+wait_bench_healthy() { # <timeout_s>
+    local deadline=$(($(date +%s) + ${1:-300}))
+    while :; do
+        on_bench "cd '$CANONICAL_DIR' && ./pithead status >/dev/null 2>&1" && return 0
+        [ "$(date +%s)" -ge "$deadline" ] && return 1
+        sleep 10
+    done
+}
+
+# After a deploy recreates monerod/tari, they reload the EXISTING synced chain and re-confirm their
+# tip (seconds — NOT a re-sync). Wait for the dashboard to report both back to "done" before running
+# the harness, so the readiness pre-check doesn't flap on the brief post-restart "loading". Doubles as
+# a direct check that the sync-detection logic settles correctly against the reused chains.
+wait_synced() { # <timeout_s>
+    local deadline=$(($(date +%s) + ${1:-300})) st
+    while :; do
+        st="$(on_bench "curl -fsS --max-time 8 http://127.0.0.1:8000/api/state 2>/dev/null | jq -r '\"\(.sync.monero.state)/\(.sync.tari.state)\"' 2>/dev/null" || true)"
+        [ "$st" = "done/done" ] && {
+            ok "monero + tari re-confirmed synced ($st) — existing chains reused, no re-sync"
+            return 0
+        }
+        [ "$(date +%s)" -ge "$deadline" ] && {
+            warn "sync panels still '$st' after $((${1:-300}))s — the harness will wait further on real sync signals"
+            return 1
+        }
+        sleep 8
+    done
+}
+
+# Nudge the miner's xmrig to reload its (rewritten) config. xmrig watches its config file and
+# reloads on change; the systemctl/SIGHUP fallbacks cover builds that don't. Whichever works, we
+# verify by polling the test bench for the worker — so the exact mechanism doesn't matter.
+miner_reload() {
+    on_miner "sudo -n systemctl restart xmrig >/dev/null 2>&1 || systemctl --user restart xmrig >/dev/null 2>&1 || pkill -HUP -x xmrig >/dev/null 2>&1 || true"
+    return 0
+}
+
+# Poll the test bench's dashboard for at least <n> workers connected.
+wait_workers() { # <n> <timeout_s>
+    local want="$1" deadline=$(($(date +%s) + ${2:-180})) got
+    while :; do
+        got="$(on_bench "curl -fsS --max-time 8 http://127.0.0.1:8000/api/state 2>/dev/null | jq -r '.proxy_workers // 0' 2>/dev/null" || echo 0)"
+        [ -n "$got" ] && [ "$got" -ge "$want" ] 2>/dev/null && {
+            ok "$got worker(s) mining through the test bench"
+            return 0
+        }
+        [ "$(date +%s)" -ge "$deadline" ] && {
+            warn "only $got worker(s) connected after $((${2:-180}))s (wanted $want)"
+            return 1
+        }
+        sleep 8
+    done
+}
+
+# --- Phase 0: preflight -----------------------------------------------------
+preflight() {
+    log "Preflight"
+    [ -n "$BENCH_HOST" ] || die "Set BENCH_HOST to your test-bench SSH host (env BENCH_HOST or --bench)."
+    [ "$BORROW_MINER" != "1" ] || [ -n "$MINER_HOST" ] || die "Set MINER_HOST to a miner to borrow, or pass --no-miner."
+    on_bench 'echo ok >/dev/null' || die "Cannot SSH to test-bench host '$BENCH_HOST'."
+    ok "SSH to $BENCH_HOST"
+    on_bench "test -x '$CANONICAL_DIR/pithead'" || die "No pithead at $CANONICAL_DIR on $BENCH_HOST."
+    on_bench "cd '$CANONICAL_DIR' && ./pithead status >/dev/null 2>&1" &&
+        ok "canonical stack is currently healthy" ||
+        warn "canonical stack is NOT healthy right now — continuing, but check the box."
+    if [ "$BORROW_MINER" = "1" ]; then
+        on_miner 'echo ok >/dev/null' || die "Cannot SSH to miner '$MINER_HOST' (use --no-miner to skip)."
+        on_miner "test -f '$MINER_XMRIG_CONFIG'" || die "No xmrig config at $MINER_XMRIG_CONFIG on $MINER_HOST."
+        ok "SSH to $MINER_HOST + xmrig config found"
+    fi
+}
+
+# --- Phase 1: provision the dedicated e2e checkout + check out the branch ---
+provision() {
+    log "Provisioning the dedicated e2e checkout ($E2E_DIR) on $BENCH_HOST"
+    # Clone from the local canonical checkout (fast, no network) the first time, then point origin
+    # at GitHub so we can fetch arbitrary branches.
+    on_bench "
+        set -e
+        if [ ! -d '$E2E_DIR/.git' ]; then
+            git clone --quiet '$CANONICAL_DIR' '$E2E_DIR'
+            git -C '$E2E_DIR' remote set-url origin '$GIT_REMOTE_URL'
+        fi
+        git -C '$E2E_DIR' remote set-url origin '$GIT_REMOTE_URL'
+        git -C '$E2E_DIR' fetch --quiet origin '$BRANCH'
+        git -C '$E2E_DIR' checkout -q -B '$BRANCH' FETCH_HEAD
+        git -C '$E2E_DIR' reset -q --hard FETCH_HEAD
+    " || die "Failed to provision/checkout '$BRANCH' in $E2E_DIR."
+    local head
+    head="$(on_bench "git -C '$E2E_DIR' rev-parse --short HEAD")"
+    ok "e2e checkout on $BRANCH @ $head"
+
+    step "seeding the e2e checkout with the canonical config.json/.env (same wallet/secrets/chains)"
+    on_bench "cp -a '$CANONICAL_DIR/config.json' '$E2E_DIR/config.json' && cp -a '$CANONICAL_DIR/.env' '$E2E_DIR/.env'" ||
+        die "Failed to seed config.json/.env into $E2E_DIR."
+    ok "config seeded (data dirs point at the shared chains)"
+}
+
+# --- Phase 2: safety backup of the live stack -------------------------------
+backup_stack() {
+    log "Taking a safety backup of the live stack (the rollback anchor)"
+    on_bench "cd '$CANONICAL_DIR' && ./pithead backup -y >/dev/null 2>&1" || die "pithead backup failed."
+    SAFETY_ARCHIVE="$(on_bench "ls -t '$CANONICAL_DIR'/backups/pithead-backup-*.tar.gz 2>/dev/null | head -n1")"
+    [ -n "$SAFETY_ARCHIVE" ] || die "Backup ran but produced no archive."
+    ok "safety backup: $SAFETY_ARCHIVE"
+}
+
+# --- Phase 3: borrow the miner ----------------------------------------------
+borrow_miner() {
+    [ "$BORROW_MINER" = "1" ] || {
+        warn "--no-miner: not borrowing a miner."
+        return 0
+    }
+    log "Borrowing $MINER_HOST → pointing it at $BENCH_HOST"
+    MINER_CFG_BACKUP="$MINER_XMRIG_CONFIG.e2e-orig.$(on_miner 'date +%Y%m%d-%H%M%S')"
+    on_miner "cp -a '$MINER_XMRIG_CONFIG' '$MINER_CFG_BACKUP'" || die "Failed to back up the miner config."
+    step "miner config backed up → $MINER_CFG_BACKUP"
+    # Reorder pools so the test-bench pool is primary (index 0); keep the rest as failover. Non-destructive
+    # and fully reversible from the backup above. Assumes a test-bench pool already exists in the config.
+    on_miner "
+        jq '.pools |= ([.[] | select(.url | ascii_downcase | contains(\"$BENCH_HOST\"))] + [.[] | select(.url | ascii_downcase | contains(\"$BENCH_HOST\") | not)])' \
+            '$MINER_XMRIG_CONFIG' > '$MINER_XMRIG_CONFIG.e2e.tmp' \
+        && mv '$MINER_XMRIG_CONFIG.e2e.tmp' '$MINER_XMRIG_CONFIG' && chmod 600 '$MINER_XMRIG_CONFIG'
+    " || die "Failed to repoint the miner config."
+    local primary
+    primary="$(on_miner "jq -r '.pools[0].url' '$MINER_XMRIG_CONFIG'")"
+    [ -n "$primary" ] && step "miner primary pool is now: $primary"
+    case "$primary" in *"$BENCH_HOST"*) ;; *) warn "primary pool ($primary) doesn't look like the test bench — does the miner config have a test-bench pool?" ;; esac
+    miner_reload
+    wait_workers "$WORKERS" 180 || warn "proceeding, but the matrix's mining assertions may not pass with too few workers"
+}
+
+# --- Phase 4: deploy the branch ---------------------------------------------
+deploy_branch() {
+    # #272: `pithead apply` runs `compose up --pull` (never --build), so it would test whatever images
+    # were last built on the box, not this branch. `pithead upgrade` re-renders the generated configs
+    # (inject_service_configs) AND rebuilds the first-party images from build/ (--build) before
+    # recreating — so a Dockerfile/entrypoint change in the branch is actually under test.
+    log "Deploying the branch on $BENCH_HOST (pithead upgrade — re-render configs + rebuild first-party images)"
+    on_bench "cd '$E2E_DIR' && ./pithead upgrade" || die "pithead upgrade failed in $E2E_DIR — branch did not deploy."
+    # Record what was actually built, so "what did we test" is unambiguous in the run log (#272).
+    on_bench "cd '$E2E_DIR' && docker compose images --format '{{.Service}} {{.Repository}}:{{.Tag}} {{.ID}}' 2>/dev/null | grep -E 'p2pool|dashboard|monero|tor|xmrig' || true" | while IFS= read -r l; do step "image: $l"; done
+    wait_bench_healthy 300 || warn "stack applied but not yet healthy; the harness will wait on real readiness signals"
+    wait_synced 300 || true # let the recreated monerod/tari re-confirm their tip before the harness pre-check
+    ok "branch deployed; stack reconciled"
+}
+
+# --- Phase 5: run the live harness (detached on the box) --------------------
+run_harness() {
+    local phases
+    case "$MODE" in
+    check) phases="--check" ;;
+    targeted) phases="--readiness --auth-fail-closed --lifecycle" ;; # --readiness/--check run first below
+    matrix) phases="--safety-backup --lifecycle --fault-injection --auth-fail-closed" ;;
+    esac
+    log "Running the live harness on $BENCH_HOST (mode=$MODE, detached so an SSH drop can't kill it)"
+    step "phases: $phases  (workers=$WORKERS)"
+
+    # Push a tiny runner that captures the harness exit code into a done-marker, then nohup it.
+    local runner
+    runner="$(mktemp)"
+    cat >"$runner" <<'RUNNER'
+#!/usr/bin/env bash
+set -uo pipefail
+dir="$1"; workers="$2"; shift 2
+mkdir -p "$dir/results"
+bash "$dir/tests/integration/run.sh" --local --dir "$dir" --workers "$workers" "$@" \
+    > "$dir/results/e2e-harness.log" 2>&1
+echo $? > "$dir/results/e2e-harness.done"
+RUNNER
+    on_bench "cat > '$E2E_DIR/.e2e-run.sh' && chmod +x '$E2E_DIR/.e2e-run.sh'" <"$runner"
+    rm -f "$runner"
+
+    # For non-check modes, run the safe readiness + current-state assertions inline first (fast,
+    # gives early signal), then the destructive phases detached.
+    if [ "$MODE" != "check" ]; then
+        on_bench "cd '$E2E_DIR' && bash tests/integration/run.sh --local --dir '$E2E_DIR' --readiness --check" ||
+            warn "readiness/check reported issues (see above) — continuing to the destructive phases"
+    fi
+
+    on_bench "rm -f '$E2E_DIR/results/e2e-harness.done'; cd '$E2E_DIR' && nohup ./.e2e-run.sh '$E2E_DIR' '$WORKERS' $phases >/dev/null 2>&1 & echo launched" ||
+        die "Failed to launch the harness."
+
+    # Poll the done-marker, printing a heartbeat tail of the log.
+    local rc="" waited=0
+    while :; do
+        if on_bench "test -f '$E2E_DIR/results/e2e-harness.done'"; then
+            rc="$(on_bench "cat '$E2E_DIR/results/e2e-harness.done'")"
+            break
+        fi
+        sleep 20
+        waited=$((waited + 20))
+        step "harness running… ${waited}s — latest:"
+        on_bench "tail -n 2 '$E2E_DIR/results/e2e-harness.log' 2>/dev/null" | sed 's/^/      /' || true
+    done
+
+    echo ""
+    log "Harness finished (exit $rc). Full log:"
+    on_bench "cat '$E2E_DIR/results/e2e-harness.log' 2>/dev/null" | sed 's/^/  /'
+    return "${rc:-1}"
+}
+
+# --- Main -------------------------------------------------------------------
+main() {
+    log "Pithead e2e — branch '$BRANCH' → $BENCH_HOST (mode=$MODE)$([ "$KEEP" = 1 ] && echo '  [--keep: no restore]')"
+    preflight
+    provision
+    backup_stack
+    borrow_miner
+    deploy_branch
+    local hrc=0
+    run_harness || hrc=$?
+    # restore_all runs via the EXIT trap.
+    echo ""
+    if [ "$hrc" -eq 0 ]; then
+        ok "E2E PASSED for '$BRANCH' (mode=$MODE)."
+    else
+        die "E2E FAILED for '$BRANCH' (harness exit $hrc). Artifacts under $E2E_DIR/results on $BENCH_HOST."
+    fi
+}
+
+main
diff --git a/tests/integration/fakes/fake_monerod.py b/tests/integration/fakes/fake_monerod.py
index 82d3db7c..1682b846 100644
--- a/tests/integration/fakes/fake_monerod.py
+++ b/tests/integration/fakes/fake_monerod.py
@@ -20,6 +20,7 @@
         m.set(mode="syncing", height=1500, target_height=3000)
         ...point a real MoneroClient at m.url...
 """
+
 import argparse
 import json
 import threading
@@ -60,8 +61,10 @@ def do_GET(self):
         # "busy" → RPC answers HTTP 200 but reports a non-OK status (e.g. mid-reorg). The
         # client must distrust the heights and treat it as unreachable, not as synced.
         if st["mode"] == "busy":
-            self._send(200, {"status": "BUSY", "height": st["height"],
-                             "target_height": st["target_height"]})
+            self._send(
+                200,
+                {"status": "BUSY", "height": st["height"], "target_height": st["target_height"]},
+            )
             return
         if st["mode"] == "syncing":
             payload = {
@@ -132,8 +135,12 @@ def main():
     ap = argparse.ArgumentParser(description="Controllable fake monerod")
     ap.add_argument("--port", type=int, default=18081)
     ap.add_argument("--host", default="0.0.0.0")  # noqa: S104 — test-only container
-    ap.add_argument("--mode", default="synced", choices=["synced", "syncing", "down"],
-                    help="initial state (the mini-stack boots 'syncing' to exercise the hold)")
+    ap.add_argument(
+        "--mode",
+        default="synced",
+        choices=["synced", "syncing", "down"],
+        help="initial state (the mini-stack boots 'syncing' to exercise the hold)",
+    )
     args = ap.parse_args()
     state = dict(DEFAULT_STATE, mode=args.mode)
     # "syncing" needs height < target_height to read as syncing (else it looks caught up).
diff --git a/tests/integration/fakes/fake_tari.py b/tests/integration/fakes/fake_tari.py
index 3f913d5e..40ccc286 100644
--- a/tests/integration/fakes/fake_tari.py
+++ b/tests/integration/fakes/fake_tari.py
@@ -16,6 +16,7 @@
 
 Use in-process (the contract test) via start_server().
 """
+
 import argparse
 import asyncio
 import json
@@ -117,8 +118,12 @@ def main():
     ap = argparse.ArgumentParser(description="Controllable fake Tari base node")
     ap.add_argument("--grpc-port", type=int, default=18142)
     ap.add_argument("--control-port", type=int, default=18152)
-    ap.add_argument("--mode", default="synced", choices=["synced", "syncing", "down"],
-                    help="initial state (the mini-stack boots 'syncing' to exercise the hold)")
+    ap.add_argument(
+        "--mode",
+        default="synced",
+        choices=["synced", "syncing", "down"],
+        help="initial state (the mini-stack boots 'syncing' to exercise the hold)",
+    )
     args = ap.parse_args()
     state = dict(DEFAULT_STATE, mode=args.mode)
     if args.mode == "syncing" and state["height"] >= state["target_height"]:
diff --git a/tests/integration/fakes/test_contract.py b/tests/integration/fakes/test_contract.py
index 019f8296..124e9be3 100644
--- a/tests/integration/fakes/test_contract.py
+++ b/tests/integration/fakes/test_contract.py
@@ -8,12 +8,12 @@
 
 Run: PYTHONPATH=build/dashboard python3 -m pytest tests/integration/fakes -q
 """
+
 import asyncio
 import pathlib
 import sys
 
 import requests
-from unittest.mock import MagicMock
 
 _HERE = pathlib.Path(__file__).resolve().parent
 _REPO = _HERE.parents[2]
@@ -23,6 +23,7 @@
 
 from fake_monerod import FakeMonerod  # noqa: E402
 from fake_tari import start_server  # noqa: E402
+
 from mining_dashboard.client.monero.monero_client import MoneroClient  # noqa: E402
 from mining_dashboard.client.tari.tari_client import TariClient  # noqa: E402
 
@@ -76,7 +77,11 @@ def test_monero_db_size_unknown_reads_zero():
 def test_monero_http_control_mutates_state():
     # Validates the /control path the docker mini-stack drives over the network.
     with FakeMonerod() as m:
-        requests.post(m.url + "/control", json={"mode": "syncing", "height": 10, "target_height": 100}, timeout=5)
+        requests.post(
+            m.url + "/control",
+            json={"mode": "syncing", "height": 10, "target_height": 100},
+            timeout=5,
+        )
         info = requests.get(m.url + "/get_info", timeout=5).json()
     assert info["synchronized"] is False and info["height"] == 10 and info["target_height"] == 100
 
@@ -86,7 +91,7 @@ def test_monero_http_control_mutates_state():
 # asyncio_mode=auto only applies when pytest's rootdir is build/dashboard).
 async def _tari_get_status(state):
     server, bound = await start_server(0, state)
-    client = TariClient(MagicMock())
+    client = TariClient()
     client.grpc_address = f"127.0.0.1:{bound}"
     try:
         return await client.get_sync_status()
@@ -124,12 +129,12 @@ def test_tari_serves_cached_reading_when_briefly_unreachable():
     async def _impl():
         state = {"mode": "synced", "height": 2000, "target_height": 2000}
         server, bound = await start_server(0, state)
-        client = TariClient(MagicMock())
+        client = TariClient()
         client.grpc_address = f"127.0.0.1:{bound}"
         try:
-            first = await client.get_sync_status()    # live: synced + reachable
+            first = await client.get_sync_status()  # live: synced + reachable
             state["mode"] = "down"
-            second = await client.get_sync_status()    # cached: last reading, reachable False
+            second = await client.get_sync_status()  # cached: last reading, reachable False
             return first, second
         finally:
             await client.close()
diff --git a/tests/integration/gouda-testbench-README.md b/tests/integration/gouda-testbench-README.md
deleted file mode 100644
index 62dd31ea..00000000
--- a/tests/integration/gouda-testbench-README.md
+++ /dev/null
@@ -1,111 +0,0 @@
-# Pithead reference build & test server (`gouda`)
-
-A dedicated **dev + AI-agent test platform** that runs the **live Pithead stack** (Monero node +
-P2Pool + Tari merge-mining + dashboard) against real, synced chains, and serves as the **Tier-4
-release gate** — changes are validated end-to-end here before release. Read this first.
-
-See **`docs/test-server-architecture.md`** in the repo for the full architecture + how to recreate
-this box on another machine. `system-info.md` (next to this file) is a live hardware snapshot:
-regenerate with `~/pithead-testbench/system-info.sh > ~/pithead-testbench/system-info.md`.
-
-## ⚠️ Golden rules
-
-This is a **test bench, not a production miner** — downtime and teardown/redeploy are fine. The
-constraints that matter:
-
-1. **Never lose the synced chains.** They are the only slow-to-acquire asset (days to re-sync) —
-   reuse them. They live at `/srv/code/pithead-data/`, decoupled from the checkout, so you can
-   refresh/redeploy the stack freely without touching them.
-2. **Storage: chains on NVMe, OS on SATA.** A **4 TB WD SN850X m.2 PCIe NVMe** (`/dev/nvme0n1`) holds
-   the chains at `/srv/code/pithead-data` (`/dev/nvme0n1p1`, ext4, `noatime`, fstab by UUID with
-   `nofail`) — monerod opens the ~266 GB LMDB in seconds. The original SATA "SSD" (`sdb`, ~37–98 MB/s,
-   HDD-class) now carries only the OS + Docker; the `/home`/`/mnt/chains` HDD stays cold storage. See
-   `docs/test-server-architecture.md` for the migration notes + the disk-bus caveat.
-3. **Least privilege.** `sudo` is password-protected and interactive-only — don't expect or leave
-   passwordless grants. Almost everything here needs **no sudo** (your user is in the `docker` group).
-4. **Secrets stay put.** `.env` (RPC creds) and `config.json` (wallet addresses) are owner-only.
-   Never print, copy, or commit them.
-
-## Where things are
-
-| Path | What |
-|---|---|
-| `~/code/pithead/` (`/srv/code/pithead`, SATA SSD) | the stack checkout: `docker-compose.yml`, the `pithead` CLI, your `config.json`/`.env` |
-| `/srv/code/pithead-data/{monero,tari,p2pool,dashboard,tor}/` | the chains — **the asset**, on the NVMe, decoupled from the checkout |
-| `~/pithead-testbench/` | **this dir** — build-server docs + tools |
-| `~/pithead-testbench/bin/monero-blockchain-prune` | verified offline Monero tool (version matches monerod) |
-| `~/pithead-testbench/{build-pruned-chain,compact-chain,system-info}.sh` | chain ops + system snapshot (also versioned in the repo `tests/integration/`) |
-| `/home`, `/mnt/chains` | HDD — cold backups / archives only |
-
-## The chains (this was the confusing part)
-
-- **Monero is PRUNED** (`MONERO_PRUNE=1`) and compacted to its true ~95 GiB. If it ever reads
-  ~250 GiB again, that is **LMDB free-page bloat** from an in-place prune — *not* a full chain.
-  Compact it (below). Note: the generic `mdb_copy` **cannot** read Monero's patched LMDB
-  (`MDB_VERSION_MISMATCH`); only `monero-blockchain-prune` works.
-- **Tari is ARCHIVAL/full** (~132 GiB, no pruning configured). That size is genuine data, not
-  bloat — there is nothing to compact. Shrinking it would mean *pruning* Tari (a config change +
-  re-sync), which is a product decision, not housekeeping.
-
-**Compacting the Monero chain** (reclaim bloat; hours, but no downtime until the swap):
-```bash
-~/pithead-testbench/compact-chain.sh /srv/code/pithead-data/monero   # builds lmdb-pruned/ (monerod stays up)
-# when DONE, swap it in (brief downtime):
-docker stop monerod
-cd /srv/code/pithead-data/monero && mv lmdb lmdb.bloated && mv lmdb-pruned lmdb
-docker start monerod        # re-syncs the few blocks added during the copy
-# confirm `pithead status` healthy, then: rm -rf lmdb.bloated
-```
-
-## Running the stack
-```bash
-cd ~/code/pithead
-./pithead status         # health summary
-./pithead doctor         # deeper diagnostics
-./pithead up | down | apply | backup
-```
-
-## Running the test harness (the point of this box)
-
-Tiers 1–3 run anywhere with no real chains; **Tier 4 (the live matrix) runs here.**
-```bash
-# Drive gouda over SSH from a dev checkout (start non-destructive):
-tests/integration/run.sh --host vijit@gouda --dir code/pithead --check       # assert current live state
-tests/integration/run.sh --host vijit@gouda --dir code/pithead --readiness   # is the box fit to gate a release?
-# Full destructive config matrix, with a pithead backup + auto-rollback on failure:
-tests/integration/run.sh --host vijit@gouda --dir code/pithead --safety-backup
-# On the box itself:
-cd ~/code/pithead && tests/integration/run.sh --local --dir "$PWD" --lifecycle
-```
-Always start with `--check`/`--readiness`. Use `--safety-backup` for the destructive matrix so a
-failure rolls the box back (down → restore → up). See `docs/integration-testing.md` in the repo.
-
-## End-to-end coverage: validated live vs. gaps
-
-**Validated live on gouda (Tier 4):** the config matrix (remote/local node, dashboard secure/insecure,
-Tari required/optional, RPC LAN access, XvB on/off) applied + asserted on real synced chains;
-lifecycle (restart, secret-preserving `apply`, backup→restore round-trip); node-down failover →
-recovery; release readiness; **pruned** monerod (the real prod config).
-**Covered without a real chain:** client↔daemon contract tests, the fake daemon mini-stack
-(incl. full-prune behavior), compose hardening, config rendering, dashboard unit/frontend tests.
-
-| # | Gap (not tested live) | Worth filling before release? |
-|---|---|---|
-| 1 | **Full (unpruned) Monero** mode live — gouda is pruned-only | **Low.** Stack code paths don't differ by prune mode (monerod-internal); fakes/config cover it. A multi-day full sync isn't justified. |
-| 2 | **Privacy / Tor egress** — no clearnet-leak assertions in the live harness (issue #160) | **High.** Privacy is a core promise. Add egress checks (no clearnet to XvB stats, p2pool, Tari DNS) to the live harness. |
-| 3 | **Automated PR gate** — self-hosted runner exists but is manual/opt-in | **Medium-high, high-leverage.** Wire the live harness as a required check on `workflow_dispatch`/push-to-`main` only (never fork PRs). |
-| 4 | **Upgrade / migration** across image versions with chain continuity | **Medium.** Real users upgrade. Add a scenario: pull new images → `apply` → assert chain continuity + no re-sync + secrets intact. |
-| 5 | **XvB live routing** end-to-end (the raffle optimization) | **Medium.** Core value-prop, but unit/sim-tested today. A periodic live XvB smoke test would help; hard to assert deterministically. |
-| 6 | **Multi-worker scale** — harness assumes ~2 workers | **Medium.** For perf confidence add a load-gen worker + assert proxy routing/hashrate. Not a blocker. |
-| 7 | **Real Tari merge-mined block** acceptance | **Low.** Finding a block is probabilistic; rely on template/connectivity checks. |
-| 8 | **Fault injection over SSH** (currently local-mode only) | **Low-Medium.** Extend SIGSTOP/remove fault cases to the `--host` path. |
-
-**Recommended before release:** #2 (privacy egress) and #3 (automated PR gate); then #4 (upgrade)
-and #5 (XvB smoke). The rest are nice-to-have.
-
-## Notes for AI agents
-- SSH from a sandboxed agent needs the LAN allowance (e.g. `dangerouslyDisableSandbox`); gouda is on the LAN.
-- **Avoid literal `( )` in remote command strings** — they break the non-interactive remote shell.
-- `pkill -f <pattern>` self-matches your own command line — kill by PID, or use the `[x]`-bracket trick.
-- Don't stop monerod without reason; check `docker ps` health first and narrate any downtime.
-- Long jobs: launch detached (`nohup … &`) and poll a status file; SSH sessions drop.
diff --git a/tests/integration/lib.sh b/tests/integration/lib.sh
index 3a666b45..aa1e86cd 100644
--- a/tests/integration/lib.sh
+++ b/tests/integration/lib.sh
@@ -14,14 +14,22 @@
 # --- Output -----------------------------------------------------------------
 # Colour only on a TTY with NO_COLOR unset (https://no-color.org), matching pithead.
 if [ -t 1 ] && [ -z "${NO_COLOR:-}" ]; then
-    IT_RESET='\033[0m'; IT_GREEN='\033[1;32m'; IT_YELLOW='\033[1;33m'; IT_RED='\033[1;31m'; IT_DIM='\033[2m'
+    IT_RESET='\033[0m'
+    IT_GREEN='\033[1;32m'
+    IT_YELLOW='\033[1;33m'
+    IT_RED='\033[1;31m'
+    IT_DIM='\033[2m'
 else
-    IT_RESET=''; IT_GREEN=''; IT_YELLOW=''; IT_RED=''; IT_DIM=''
+    IT_RESET=''
+    IT_GREEN=''
+    IT_YELLOW=''
+    IT_RED=''
+    IT_DIM=''
 fi
 
-it_log()  { echo -e "${IT_GREEN}[ITEST]${IT_RESET} $1"; }
+it_log() { echo -e "${IT_GREEN}[ITEST]${IT_RESET} $1"; }
 it_warn() { echo -e "${IT_YELLOW}[ITEST]${IT_RESET} $1" >&2; }
-it_err()  { echo -e "${IT_RED}[ITEST]${IT_RESET} $1" >&2; }
+it_err() { echo -e "${IT_RED}[ITEST]${IT_RESET} $1" >&2; }
 it_step() { echo -e "${IT_DIM}  → $1${IT_RESET}"; }
 
 # --- Secrets hygiene --------------------------------------------------------
@@ -41,22 +49,25 @@ IT_PASS=0
 IT_FAIL=0
 IT_FAILED_NAMES=""
 
-it_pass() { IT_PASS=$((IT_PASS + 1)); printf '    %b✓%b %s\n' "$IT_GREEN" "$IT_RESET" "$1"; }
+it_pass() {
+    IT_PASS=$((IT_PASS + 1))
+    printf '    %b✓%b %s\n' "$IT_GREEN" "$IT_RESET" "$1"
+}
 it_fail() {
     IT_FAIL=$((IT_FAIL + 1))
     IT_FAILED_NAMES="${IT_FAILED_NAMES}\n    - ${IT_CURRENT_SCENARIO:-?}: $1"
     printf '    %b✗%b %s\n        %s\n' "$IT_RED" "$IT_RESET" "$1" "${2:-}"
 }
 
-assert_eq()       { if [ "$2" = "$3" ]; then it_pass "$1"; else it_fail "$1" "expected [$3], got [$2]"; fi; }
-assert_ne()       { if [ "$2" != "$3" ]; then it_pass "$1"; else it_fail "$1" "expected not [$3]"; fi; }
-assert_rc()       { if [ "$2" = "$3" ]; then it_pass "$1"; else it_fail "$1" "expected rc $3, got $2"; fi; }
-assert_contains() { case "$2" in *"$3"*) it_pass "$1" ;; *) it_fail "$1" "[$2] missing [$3]" ;; esac; }
+assert_eq() { if [ "$2" = "$3" ]; then it_pass "$1"; else it_fail "$1" "expected [$3], got [$2]"; fi; }
+assert_ne() { if [ "$2" != "$3" ]; then it_pass "$1"; else it_fail "$1" "expected not [$3]"; fi; }
+assert_rc() { if [ "$2" = "$3" ]; then it_pass "$1"; else it_fail "$1" "expected rc $3, got $2"; fi; }
+assert_contains() { case "$2" in *"$3"*) it_pass "$1" ;; *) it_fail "$1" "[$2] missing [$3]" ;; esac }
 # Numeric "greater than / >=" with a graceful non-number guard.
-assert_num_ge()   {
+assert_num_ge() {
     if [ -n "$2" ] && [ "$2" -ge "$3" ] 2>/dev/null; then it_pass "$1"; else it_fail "$1" "expected >= $3, got [$2]"; fi
 }
-assert_num_gt()   {
+assert_num_gt() {
     if [ -n "$2" ] && [ "$2" -gt "$3" ] 2>/dev/null; then it_pass "$1"; else it_fail "$1" "expected > $3, got [$2]"; fi
 }
 
@@ -71,9 +82,9 @@ overrides_to_jq() {
         path="${pair%%=*}"
         value="${pair#*=}"
         case "$value" in
-            true|false)               jsonval="$value" ;;
-            ''|*[!0-9-]*)             jsonval="\"$value\"" ;;   # has a non-digit -> string
-            *)                        jsonval="$value" ;;       # all digits (+ optional leading -) -> number
+        true | false) jsonval="$value" ;;
+        '' | *[!0-9-]*) jsonval="\"$value\"" ;; # has a non-digit -> string
+        *) jsonval="$value" ;;                  # all digits (+ optional leading -) -> number
         esac
         program="${program} | .${path}=${jsonval}"
     done
@@ -83,8 +94,10 @@ overrides_to_jq() {
 # Render a scenario's config.json to stdout: start from the box's baseline config (real
 # wallets / data dirs / host preserved) and apply the scenario overrides. Requires jq.
 render_scenario_config() {
-    local baseline_json="$1"; shift
-    local program; program="$(overrides_to_jq "$@")"
+    local baseline_json="$1"
+    shift
+    local program
+    program="$(overrides_to_jq "$@")"
     printf '%s' "$baseline_json" | jq "$program"
 }
 
@@ -99,25 +112,35 @@ SKIP_REASON=""
 # shellcheck disable=SC2034  # RESOLVED/SKIP_REASON are output globals consumed by run.sh & selftest.sh
 resolve_overrides() {
     local overrides="$1" prune mode out="$1"
-    RESOLVED=""; SKIP_REASON=""
+    RESOLVED=""
+    SKIP_REASON=""
 
     prune="$(printf '%s' "$overrides" | tr ' ' '\n' | sed -n 's/^monero\.prune=//p')"
-    mode="$(printf '%s' "$overrides"  | tr ' ' '\n' | sed -n 's/^monero\.mode=//p')"
+    mode="$(printf '%s' "$overrides" | tr ' ' '\n' | sed -n 's/^monero\.mode=//p')"
 
     # Prune axis: only flip away from the baseline DB if a matching synced dir is provided —
     # flipping prune on the canonical dir would invalidate it (a DEST change).
     if [ "$prune" = "true" ] && [ "${BASELINE_PRUNE:-}" = "0" ]; then
-        [ -n "${PRUNED_DATA_DIR:-}" ] || { SKIP_REASON="needs --pruned-data-dir (box baseline is full)"; return 1; }
+        [ -n "${PRUNED_DATA_DIR:-}" ] || {
+            SKIP_REASON="needs --pruned-data-dir (box baseline is full)"
+            return 1
+        }
         out="$out monero.data_dir=$PRUNED_DATA_DIR"
     fi
     if [ "$prune" = "false" ] && [ "${BASELINE_PRUNE:-}" = "1" ]; then
-        [ -n "${FULL_DATA_DIR:-}" ] || { SKIP_REASON="needs --full-data-dir (box baseline is pruned)"; return 1; }
+        [ -n "${FULL_DATA_DIR:-}" ] || {
+            SKIP_REASON="needs --full-data-dir (box baseline is pruned)"
+            return 1
+        }
         out="$out monero.data_dir=$FULL_DATA_DIR"
     fi
 
     # Remote mode needs an external endpoint to point at.
     if [ "$mode" = "remote" ]; then
-        [ -n "${REMOTE_MONERO_HOST:-}" ] || { SKIP_REASON="needs --remote-monero-host"; return 1; }
+        [ -n "${REMOTE_MONERO_HOST:-}" ] || {
+            SKIP_REASON="needs --remote-monero-host"
+            return 1
+        }
         out="$out monero.remote.host=$REMOTE_MONERO_HOST"
     fi
 
@@ -151,10 +174,10 @@ absent_services() {
 # Human-readable pool label as the dashboard reports it, from the config pool key.
 pool_label() {
     case "$1" in
-        main) printf 'Main' ;;
-        mini) printf 'Mini' ;;
-        nano) printf 'Nano' ;;
-        *)    printf '%s' "$1" ;;
+    main) printf 'Main' ;;
+    mini) printf 'Mini' ;;
+    nano) printf 'Nano' ;;
+    *) printf '%s' "$1" ;;
     esac
 }
 
@@ -167,7 +190,7 @@ pool_label() {
 rx() {
     local snippet="$1"
     if [ "$IT_MODE" = "local" ]; then
-        ( cd "$IT_REMOTE_DIR" && bash -c "$snippet" )
+        (cd "$IT_REMOTE_DIR" && bash -c "$snippet")
     else
         local remote
         remote="cd $(quote_arg "$IT_REMOTE_DIR") && { $snippet; }"
@@ -190,7 +213,7 @@ api_state() { rx "curl -fsS --max-time 10 http://127.0.0.1:8000/api/state" 2>/de
 
 # Split a "<state> <health>" string (from service_state) into its two fields. Pure helpers so
 # the self-test can verify the fault-injection predicates classify correctly.
-svc_state_of()  { printf '%s' "${1%% *}"; }
+svc_state_of() { printf '%s' "${1%% *}"; }
 svc_health_of() { printf '%s' "${1##* }"; }
 
 # Pull a jq path out of a JSON blob, printing nothing for an absent/null value. The `?`
@@ -219,9 +242,10 @@ monero_caught_up() {
 # success, 1 on timeout.
 now_s() { date +%s; }
 
-wait_for() {  # wait_for <timeout_s> <interval_s> <desc> <predicate-cmd...>
-    local timeout="$1" interval="$2" desc="$3"; shift 3
-    local deadline=$(( $(now_s) + timeout ))
+wait_for() { # wait_for <timeout_s> <interval_s> <desc> <predicate-cmd...>
+    local timeout="$1" interval="$2" desc="$3"
+    shift 3
+    local deadline=$(($(now_s) + timeout))
     it_step "waiting for ${desc} (timeout ${timeout}s)…"
     while :; do
         if "$@"; then return 0; fi
@@ -246,15 +270,20 @@ _pred_monero_synced() { monero_caught_up; }
 # failed one scenario during the v1.0.0 release gate; a genuinely stuck panel (the #180 regression)
 # never settles, so a bounded wait still catches it.
 _pred_monero_panel_done() {
-    local st; st="$(api_state)"; [ -n "$st" ] || return 1
+    local st
+    st="$(api_state)"
+    [ -n "$st" ] || return 1
     [ "$(jq_get "$st" '.sync.monero.state')" = "done" ]
 }
 
 # Predicate: the sync gate has released the miner — at least one worker is online on the proxy.
 # (proxy_workers is the reliable signal; stratum.conns can read 0 on a healthy, mining box.)
 _pred_miner_running() {
-    local st; st="$(api_state)"; [ -n "$st" ] || return 1
-    local w; w="$(jq_get "$st" '.proxy_workers')"
+    local st
+    st="$(api_state)"
+    [ -n "$st" ] || return 1
+    local w
+    w="$(jq_get "$st" '.proxy_workers')"
     [ -n "$w" ] && [ "$w" -ge 1 ] 2>/dev/null
 }
 
@@ -264,7 +293,9 @@ _pred_miner_running() {
 # a restart Tari needs a moment to re-establish peers and close its offline gap, so we poll this
 # rather than asserting cold (issue #54: a real readiness signal, not "sleep and hope").
 _pred_tari_synced() {
-    local st; st="$(api_state)"; [ -n "$st" ] || return 1
+    local st
+    st="$(api_state)"
+    [ -n "$st" ] || return 1
     [ "$(jq_get "$st" '.sync.tari.state')" = "done" ]
 }
 
@@ -272,8 +303,10 @@ _pred_tari_synced() {
 # type is inferred from connected peers' ports (detect_pool_type: 37889 Main / 37888 Mini / 37890
 # Nano), so right after a sidechain switch it reads "Unknown" until enough peers on the NEW chain
 # connect — poll until it matches the expected label rather than asserting cold (issue #54).
-_pred_pool_ready() {  # _pred_pool_ready <expected-label>
-    local st; st="$(api_state)"; [ -n "$st" ] || return 1
+_pred_pool_ready() { # _pred_pool_ready <expected-label>
+    local st
+    st="$(api_state)"
+    [ -n "$st" ] || return 1
     [ "$(jq_get "$st" '.pool.type')" = "$1" ]
 }
 
@@ -283,16 +316,19 @@ _pred_pool_ready() {  # _pred_pool_ready <expected-label>
 # p2pool re-syncs its sidechain before serving) it reads 0. It's monotonic within a session, so
 # polling until >0 is robust where the instantaneous stratum.conns is not (issue #54).
 _pred_hashes_flowing() {
-    local st; st="$(api_state)"; [ -n "$st" ] || return 1
-    local h; h="$(jq_get "$st" '.stratum.total_hashes')"
+    local st
+    st="$(api_state)"
+    [ -n "$st" ] || return 1
+    local h
+    h="$(jq_get "$st" '.stratum.total_hashes')"
     [ -n "$h" ] && [ "$h" -gt 0 ] 2>/dev/null
 }
 
-wait_status_ok()     { wait_for "${1:-180}" 5 "pithead status OK"     _pred_status_ok; }
+wait_status_ok() { wait_for "${1:-180}" 5 "pithead status OK" _pred_status_ok; }
 wait_monero_synced() { wait_for "${1:-300}" 10 "Monero sync complete" _pred_monero_synced; }
-wait_miner_running() { wait_for "${1:-180}" 5 "miner released"        _pred_miner_running; }
-wait_tari_synced()   { wait_for "${1:-300}" 10 "Tari sync complete"   _pred_tari_synced; }
-wait_pool_ready()    { wait_for "${1:-180}" 5 "pool type determinate (${2})" _pred_pool_ready "$2"; }
+wait_miner_running() { wait_for "${1:-180}" 5 "miner released" _pred_miner_running; }
+wait_tari_synced() { wait_for "${1:-300}" 10 "Tari sync complete" _pred_tari_synced; }
+wait_pool_ready() { wait_for "${1:-180}" 5 "pool type determinate (${2})" _pred_pool_ready "$2"; }
 wait_hashes_flowing() { wait_for "${1:-300}" 5 "stratum hashes flowing" _pred_hashes_flowing; }
 
 # --- Artifact capture -------------------------------------------------------
@@ -303,12 +339,12 @@ capture_artifacts() {
     local dir="${outdir}/${scenario}"
     mkdir -p "$dir"
     it_step "capturing artifacts to ${dir}"
-    rx "docker compose ps"                 2>&1 | redact > "${dir}/compose-ps.txt"      || true
-    rx "$IT_PITHEAD status"                2>&1 | redact > "${dir}/status.txt"          || true
-    rx "$IT_PITHEAD doctor"                2>&1 | redact > "${dir}/doctor.txt"          || true
-    rx "cat config.json"                   2>&1 | redact > "${dir}/config.json"         || true
-    rx "cat .env"                          2>&1 | redact > "${dir}/env.redacted.txt"    || true
-    api_state                                   | redact > "${dir}/api-state.json"      || true
+    rx "docker compose ps" 2>&1 | redact >"${dir}/compose-ps.txt" || true
+    rx "$IT_PITHEAD status" 2>&1 | redact >"${dir}/status.txt" || true
+    rx "$IT_PITHEAD doctor" 2>&1 | redact >"${dir}/doctor.txt" || true
+    rx "cat config.json" 2>&1 | redact >"${dir}/config.json" || true
+    rx "cat .env" 2>&1 | redact >"${dir}/env.redacted.txt" || true
+    api_state | redact >"${dir}/api-state.json" || true
     # Last 200 lines of each service's logs, redacted.
-    rx "docker compose logs --tail=200 --no-color" 2>&1 | redact > "${dir}/logs.txt"   || true
+    rx "docker compose logs --tail=200 --no-color" 2>&1 | redact >"${dir}/logs.txt" || true
 }
diff --git a/tests/integration/mini-stack/run-mini-stack.sh b/tests/integration/mini-stack/run-mini-stack.sh
index 42a00c66..0a1791da 100755
--- a/tests/integration/mini-stack/run-mini-stack.sh
+++ b/tests/integration/mini-stack/run-mini-stack.sh
@@ -18,9 +18,15 @@ COMPOSE_FILE="$HERE/docker-compose.fake.yml"
 PASS=0
 FAIL=0
 
-c_ok()  { PASS=$((PASS + 1)); printf '  \033[1;32m✓\033[0m %s\n' "$1"; }
-c_bad() { FAIL=$((FAIL + 1)); printf '  \033[1;31m✗\033[0m %s\n      %s\n' "$1" "${2:-}"; }
-log()   { printf '\033[1;36m[mini-stack]\033[0m %s\n' "$1"; }
+c_ok() {
+    PASS=$((PASS + 1))
+    printf '  \033[1;32m✓\033[0m %s\n' "$1"
+}
+c_bad() {
+    FAIL=$((FAIL + 1))
+    printf '  \033[1;31m✗\033[0m %s\n      %s\n' "$1" "${2:-}"
+}
+log() { printf '\033[1;36m[mini-stack]\033[0m %s\n' "$1"; }
 
 if ! docker compose version >/dev/null 2>&1; then
     echo "SKIP: docker compose not available"
@@ -28,13 +34,13 @@ if ! docker compose version >/dev/null 2>&1; then
 fi
 
 compose() { docker compose -f "$COMPOSE_FILE" "$@"; }
-cstate()  { docker inspect -f '{{.State.Status}}' "$1" 2>/dev/null || echo "missing"; }
-ctl()     { curl -fsS --max-time 5 "$1" -d "$2" >/dev/null; }   # POST JSON to a fake /control
+cstate() { docker inspect -f '{{.State.Status}}' "$1" 2>/dev/null || echo "missing"; }
+ctl() { curl -fsS --max-time 5 "$1" -d "$2" >/dev/null; } # POST JSON to a fake /control
 
 # Poll a container until it reaches an expected state, or time out.
-wait_state() {  # wait_state <container> <expected-state> [timeout_s]
+wait_state() { # wait_state <container> <expected-state> [timeout_s]
     local c="$1" want="$2" timeout="${3:-60}" end
-    end=$(( $(date +%s) + timeout ))
+    end=$(($(date +%s) + timeout))
     while :; do
         [ "$(cstate "$c")" = "$want" ] && return 0
         [ "$(date +%s)" -ge "$end" ] && return 1
@@ -42,7 +48,7 @@ wait_state() {  # wait_state <container> <expected-state> [timeout_s]
     done
 }
 
-assert_state() {  # assert_state <label> <container> <expected> [timeout]
+assert_state() { # assert_state <label> <container> <expected> [timeout]
     if wait_state "$2" "$3" "${4:-60}"; then
         c_ok "$1 ($2 → $3)"
     else
@@ -53,7 +59,7 @@ assert_state() {  # assert_state <label> <container> <expected> [timeout]
 # Assert a container STAYS in a state for a window — proves the gate does NOT release/act
 # prematurely (e.g. holds while only one required chain is synced). At UPDATE_INTERVAL=2 a
 # few seconds spans multiple control-loop cycles.
-assert_stays() {  # assert_stays <label> <container> <state> <seconds>
+assert_stays() { # assert_stays <label> <container> <state> <seconds>
     sleep "$4"
     if [ "$(cstate "$2")" = "$3" ]; then
         c_ok "$1 ($2 stays $3 for ${4}s)"
@@ -65,7 +71,7 @@ assert_stays() {  # assert_stays <label> <container> <state> <seconds>
 # POST a new mode to a fake's /control endpoint with a clear failure label. Host ports are
 # 28081/28152 (namespaced away from a real monerod/dashboard on the same host).
 set_monerod() { ctl "http://127.0.0.1:28081/control" "{\"mode\":\"$1\"}" || c_bad "set monerod $1" "control POST failed"; }
-set_tari()    { ctl "http://127.0.0.1:28152/control" "{\"mode\":\"$1\"}" || c_bad "set tari $1" "control POST failed"; }
+set_tari() { ctl "http://127.0.0.1:28152/control" "{\"mode\":\"$1\"}" || c_bad "set tari $1" "control POST failed"; }
 
 teardown() {
     log "tearing down"
@@ -88,16 +94,63 @@ api_up=0
 for _ in $(seq 1 30); do
     if compose exec -T dashboard python3 -c \
         "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/state', timeout=3)" >/dev/null 2>&1; then
-        api_up=1; break
+        api_up=1
+        break
     fi
     sleep 2
 done
 [ "$api_up" = 1 ] && c_ok "dashboard API is up" || c_bad "dashboard API is up" "no /api/state after ~60s"
 
+# 0. The /api/state payload must carry the #170 Stack Topology & Egress contract, derived live
+#    from config by the REAL dashboard. The pure derivation is unit-tested (tests/service/
+#    test_egress.py); this proves it survives the trip through build_state -> /api/state on a
+#    running server: both sections present, their summary shared verbatim with the map (so the
+#    header badge can't disagree with it), the topology's node set is the canonical one, and every
+#    edge lands on a placeable node (an off-map endpoint would vanish silently from the diagram).
+log "scenario 0: /api/state exposes a well-formed #170 topology + egress contract"
+contract="$(
+    compose exec -T dashboard python3 - <<'PY' 2>&1
+import json
+import urllib.request
+
+NODES = {"rigs", "browser", "xmrig-proxy", "caddy", "dashboard", "p2pool",
+         "monerod", "tari", "docker", "tor", "internet"}
+
+
+def bail(msg):
+    print("FAIL:", msg)
+    raise SystemExit(1)
+
+
+st = json.load(urllib.request.urlopen("http://127.0.0.1:8000/api/state", timeout=5))
+eg, topo = st.get("egress"), st.get("topology")
+if not isinstance(eg, dict) or not isinstance(topo, dict):
+    bail("egress/topology section missing")
+if topo.get("summary") != eg.get("summary"):
+    bail("topology and egress summaries disagree")
+ids = {n["id"] for n in topo["nodes"]}
+if ids != NODES:
+    bail("topology node ids %s != canonical set" % sorted(ids))
+for e in topo["edges"]:
+    if e["from"] not in NODES or e["to"] not in NODES:
+        bail("edge endpoint off the map: %s" % e)
+if not any("egress" in b.get("text", "") for b in st.get("badges", [])):
+    bail("no egress header badge in /api/state")
+if not isinstance(st.get("db_healthy"), bool):
+    bail("db_healthy missing or not a bool")
+print("OK level=%s nodes=%d edges=%d db_healthy=%s"
+      % (topo["summary"]["level"], len(ids), len(topo["edges"]), st["db_healthy"]))
+PY
+)"
+case "$contract" in
+OK*) c_ok "/api/state #170 contract — $contract" ;;
+*) c_bad "/api/state #170 topology+egress contract" "$contract" ;;
+esac
+
 # 1. Booting mid-sync → the gate holds both miner containers (stops them). (#35)
 log "scenario 1: holds the miner while both chains sync"
-assert_state "held: itest-p2pool stopped"      itest-p2pool      exited  90
-assert_state "held: itest-xmrig-proxy stopped" itest-xmrig-proxy exited  90
+assert_state "held: itest-p2pool stopped" itest-p2pool exited 90
+assert_state "held: itest-xmrig-proxy stopped" itest-xmrig-proxy exited 90
 
 # 2. Monerod synced but Tari still syncing, Tari REQUIRED → STILL held (the gate needs both).
 log "scenario 2: keeps holding while Tari (required) is still syncing"
@@ -107,7 +160,7 @@ assert_stays "still held on monerod-only" itest-p2pool exited 8
 # 3. Tari synced too → release both. (#35)
 log "scenario 3: releases the miner once both chains are synced"
 set_tari synced
-assert_state "released: itest-p2pool running"      itest-p2pool      running 90
+assert_state "released: itest-p2pool running" itest-p2pool running 90
 assert_state "released: itest-xmrig-proxy running" itest-xmrig-proxy running 90
 
 # 4. Tari down while required → reject workers (stop the proxy); itest-p2pool keeps running. (#31)
@@ -138,7 +191,7 @@ for _ in $(seq 1 30); do
         "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8000/api/state', timeout=3)" >/dev/null 2>&1 && break
     sleep 2
 done
-assert_stays "itest-p2pool stays up across restart"      itest-p2pool      running 6
+assert_stays "itest-p2pool stays up across restart" itest-p2pool running 6
 assert_stays "itest-xmrig-proxy stays up across restart" itest-xmrig-proxy running 6
 
 echo ""
diff --git a/tests/integration/run.sh b/tests/integration/run.sh
index 5d85c812..63d83251 100755
--- a/tests/integration/run.sh
+++ b/tests/integration/run.sh
@@ -17,7 +17,7 @@
 # Read-only against the canonical chain data dirs; safe to run against the live box. See
 # docs/integration-testing.md for provisioning, the safety model, and CI/release wiring.
 #
-set -uo pipefail   # NOT -e: we deliberately continue-on-error to collect the whole matrix.
+set -uo pipefail # NOT -e: we deliberately continue-on-error to collect the whole matrix.
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=tests/integration/lib.sh
@@ -37,6 +37,7 @@ CHECK_ONLY=0
 READINESS=0
 RUN_LIFECYCLE=0
 RUN_FAULTS=0
+RUN_AUTH_FAIL_CLOSED=0
 SAFETY_BACKUP=0
 SAFETY_ARCHIVE=""
 KEEP_STATE=0
@@ -82,16 +83,23 @@ MATRIX:
                          box's baseline is full)
   --full-data-dir <d>    synced FULL monero data dir (enables the full case when the box's
                          baseline is pruned)
-  --lifecycle            also run the lifecycle phase (restart, apply secret-preservation)
+  --lifecycle            also run the lifecycle phase (restart, apply secret-preservation,
+                         and the #255 ensure_owner migration: a root-owned file under a data
+                         dir must be chowned to the container uid by apply)
   --safety-backup        take a `pithead backup` BEFORE the destructive scenarios; if anything
                          fails, automatically roll the box back to it (down → restore → up).
                          The archive is removed on success. Recommended for the destructive
                          matrix on a precious box. Also exercises backup/restore end-to-end.
   --fault-injection      also run the fault-injection phase: deliberately break monerod
                          (stop / SIGSTOP / remove) and assert pithead's status verdicts
-                         (down / unhealthy / missing) and the failover→recovery cycle.
-                         DESTRUCTIVE-then-restored; local mode only. Slow (healthcheck +
-                         node-health debounce).
+                         (down / unhealthy / missing) and the failover→recovery cycle. Also
+                         forces a real `iptables -I` failure and asserts the #270 firewall
+                         rolls back fail-closed (no half-open ruleset). DESTRUCTIVE-then-
+                         restored; local mode only. Slow (healthcheck + node-health debounce).
+  --auth-fail-closed     also run the fail-closed auth phase (#153/#203): empty PROXY_AUTH_TOKEN
+                         in .env and assert `pithead up` REFUSES to start (the live counterpart
+                         to the tier-1 compose-config check), then restore the exact token and
+                         recover. DESTRUCTIVE-then-restored; works in both ssh and local mode.
   --keep                 do NOT restore the original config.json at the end (leaves the box
                          on the last scenario — useful for debugging)
 
@@ -110,27 +118,95 @@ EOF
 parse_args() {
     while [ $# -gt 0 ]; do
         case "$1" in
-            --host)       IT_SSH_DEST="$2"; IT_MODE="ssh"; shift 2 ;;
-            --identity)   IT_SSH_OPTS+=(-i "$2"); shift 2 ;;
-            --ssh-opt)    IT_SSH_OPTS+=(-o "$2"); shift 2 ;;
-            --local)      IT_MODE="local"; shift ;;
-            --dir)        IT_REMOTE_DIR="$2"; shift 2 ;;
-            --pithead)    IT_PITHEAD="$2"; shift 2 ;;
-            --check)      CHECK_ONLY=1; shift ;;
-            --readiness)  READINESS=1; shift ;;
-            --scenario)   ONLY_SCENARIO="$2"; shift 2 ;;
-            --workers)    EXPECTED_WORKERS="$2"; shift 2 ;;
-            --remote-monero-host) REMOTE_MONERO_HOST="$2"; shift 2 ;;
-            --pruned-data-dir)    PRUNED_DATA_DIR="$2"; shift 2 ;;
-            --full-data-dir)      FULL_DATA_DIR="$2"; shift 2 ;;
-            --lifecycle)  RUN_LIFECYCLE=1; shift ;;
-            --fault-injection) RUN_FAULTS=1; shift ;;
-            --safety-backup)   SAFETY_BACKUP=1; shift ;;
-            --keep)       KEEP_STATE=1; shift ;;
-            --out)        OUT_DIR="$2"; shift 2 ;;
-            --list)       print_list; exit 0 ;;
-            -h|--help)    usage; exit 0 ;;
-            *)            it_err "Unknown option: $1 (try --help)"; exit 2 ;;
+        --host)
+            IT_SSH_DEST="$2"
+            IT_MODE="ssh"
+            shift 2
+            ;;
+        --identity)
+            IT_SSH_OPTS+=(-i "$2")
+            shift 2
+            ;;
+        --ssh-opt)
+            IT_SSH_OPTS+=(-o "$2")
+            shift 2
+            ;;
+        --local)
+            IT_MODE="local"
+            shift
+            ;;
+        --dir)
+            IT_REMOTE_DIR="$2"
+            shift 2
+            ;;
+        --pithead)
+            IT_PITHEAD="$2"
+            shift 2
+            ;;
+        --check)
+            CHECK_ONLY=1
+            shift
+            ;;
+        --readiness)
+            READINESS=1
+            shift
+            ;;
+        --scenario)
+            ONLY_SCENARIO="$2"
+            shift 2
+            ;;
+        --workers)
+            EXPECTED_WORKERS="$2"
+            shift 2
+            ;;
+        --remote-monero-host)
+            REMOTE_MONERO_HOST="$2"
+            shift 2
+            ;;
+        --pruned-data-dir)
+            PRUNED_DATA_DIR="$2"
+            shift 2
+            ;;
+        --full-data-dir)
+            FULL_DATA_DIR="$2"
+            shift 2
+            ;;
+        --lifecycle)
+            RUN_LIFECYCLE=1
+            shift
+            ;;
+        --fault-injection)
+            RUN_FAULTS=1
+            shift
+            ;;
+        --auth-fail-closed)
+            RUN_AUTH_FAIL_CLOSED=1
+            shift
+            ;;
+        --safety-backup)
+            SAFETY_BACKUP=1
+            shift
+            ;;
+        --keep)
+            KEEP_STATE=1
+            shift
+            ;;
+        --out)
+            OUT_DIR="$2"
+            shift 2
+            ;;
+        --list)
+            print_list
+            exit 0
+            ;;
+        -h | --help)
+            usage
+            exit 0
+            ;;
+        *)
+            it_err "Unknown option: $1 (try --help)"
+            exit 2
+            ;;
         esac
     done
 
@@ -156,7 +232,7 @@ print_list() {
 push_config() {
     local json="$1"
     if [ "$IT_MODE" = "local" ]; then
-        printf '%s\n' "$json" > "$IT_REMOTE_DIR/config.json"
+        printf '%s\n' "$json" >"$IT_REMOTE_DIR/config.json"
     else
         printf '%s\n' "$json" | ssh "${IT_SSH_OPTS[@]}" "$IT_SSH_DEST" \
             "cd $(quote_arg "$IT_REMOTE_DIR") && cat > config.json"
@@ -216,7 +292,7 @@ preflight() {
 
     # Snapshot the baseline so we can restore it and compare secrets later.
     BASELINE_CONFIG="$(rx 'cat config.json')"
-    BASELINE_PRUNE="$(env_on_box MONERO_PRUNE)"   # 1 = pruned, 0 = full
+    BASELINE_PRUNE="$(env_on_box MONERO_PRUNE)" # 1 = pruned, 0 = full
     BASELINE_SECRET_FP="$(secret_fingerprint)"
     if [ -z "$BASELINE_CONFIG" ]; then
         it_err "Could not read baseline config.json from the box."
@@ -238,7 +314,7 @@ record_manifest() {
         echo ""
         echo "# docker compose images"
         rx "docker compose images 2>/dev/null"
-    } | redact > "$f" 2>/dev/null || true
+    } | redact >"$f" 2>/dev/null || true
     it_step "wrote run manifest to $f"
 }
 
@@ -271,19 +347,21 @@ run_scenario() {
     push_config "$config"
 
     it_step "applying config (pithead apply -y)…"
-    if ! pithead apply -y > "$OUT_DIR/${name}.apply.log" 2>&1; then
+    if ! pithead apply -y >"$OUT_DIR/${name}.apply.log" 2>&1; then
         it_fail "apply succeeded" "see $OUT_DIR/${name}.apply.log"
         capture_artifacts "$name" "$OUT_DIR"
         return 0
     fi
 
     # Wait for the stack to settle on real readiness signals before asserting.
-    wait_status_ok 240    || true
+    wait_status_ok 240 || true
     wait_monero_synced 120 || true
     wait_miner_running 180 || true
     # p2pool infers its sidechain from connected peers, so after a pool switch it reads "Unknown"
     # until peers on the new chain connect — wait for the dashboard to classify it (issue #54).
-    local _pool; _pool="$(jq_get "$config" '.p2pool.pool')"; _pool="${_pool:-main}"
+    local _pool
+    _pool="$(jq_get "$config" '.p2pool.pool')"
+    _pool="${_pool:-main}"
     wait_pool_ready 180 "$(pool_label "$_pool")" || true
     # End-to-end mining: p2pool's stratum hash counter resets on restart and climbs only once the
     # proxy's upstream reconnects and a share lands — wait for it before asserting hashes>0 (issue #54).
@@ -310,15 +388,19 @@ run_scenario() {
 assert_running_state() {
     local name="$1" config="$2"
     local st mode pool secure tari_req xvb rpc_lan monero_clearnet tari_clearnet
-    mode="$(jq_get "$config" '.monero.mode')";          mode="${mode:-local}"
-    pool="$(jq_get "$config" '.p2pool.pool')";          pool="${pool:-main}"
+    mode="$(jq_get "$config" '.monero.mode')"
+    mode="${mode:-local}"
+    pool="$(jq_get "$config" '.p2pool.pool')"
+    pool="${pool:-main}"
     secure="$(jq_get "$config" '.dashboard.secure')"
     tari_req="$(jq_get "$config" '.dashboard.tari_required')"
     xvb="$(jq_get "$config" '.xvb.enabled')"
     rpc_lan="$(jq_get "$config" '.monero.rpc_lan_access')"
     # Clearnet initial sync (#183): absent => default false.
-    monero_clearnet="$(jq_get "$config" '.monero.clearnet_initial_sync')"; [ "$monero_clearnet" = "true" ] || monero_clearnet="false"
-    tari_clearnet="$(jq_get "$config" '.tari.clearnet_initial_sync')";     [ "$tari_clearnet" = "true" ] || tari_clearnet="false"
+    monero_clearnet="$(jq_get "$config" '.monero.clearnet_initial_sync')"
+    [ "$monero_clearnet" = "true" ] || monero_clearnet="false"
+    tari_clearnet="$(jq_get "$config" '.tari.clearnet_initial_sync')"
+    [ "$tari_clearnet" = "true" ] || tari_clearnet="false"
 
     # 0. Clearnet auto-transition settle (#234). Enabling clearnet on an already-synced node makes the
     # dashboard supervisor flip it back to Tor, which RESTARTS the daemon(s). Wait for that to fully
@@ -328,17 +410,18 @@ assert_running_state() {
     # running config (only true once the flip-back re-render + restart finished), then for the whole
     # stack to report healthy. This block also IS the end-to-end proof the transition fired.
     if [ "$monero_clearnet" = "true" ] || [ "$tari_clearnet" = "true" ]; then
-        local csdir; csdir="$(env_on_box CLEARNET_STATE_DIR)"
+        local csdir
+        csdir="$(env_on_box CLEARNET_STATE_DIR)"
         if [ "$monero_clearnet" = "true" ]; then
-            if wait_for 180 10 "monero clearnet→Tor transition marker (#234)" rx "test -f '$csdir/monero.synced'"
-            then it_pass "monero auto-transitioned clearnet→Tor (#234)"
+            if wait_for 180 10 "monero clearnet→Tor transition marker (#234)" rx "test -f '$csdir/monero.synced'"; then
+                it_pass "monero auto-transitioned clearnet→Tor (#234)"
             else it_fail "monero auto-transitioned clearnet→Tor (#234)" "marker not written within 180s"; fi
             wait_for 240 10 "monerod restarted back on Tor — proxy restored (#234)" \
-                rx "docker exec monerod grep -qE '^proxy=' /root/.bitmonero/bitmonero.conf 2>/dev/null" || true
+                rx "docker exec monerod grep -qE '^proxy=' /home/ubuntu/.bitmonero/bitmonero.conf 2>/dev/null" || true
         fi
         if [ "$tari_clearnet" = "true" ]; then
-            if wait_for 180 10 "tari clearnet→Tor transition marker (#234)" rx "test -f '$csdir/tari.synced'"
-            then it_pass "tari auto-transitioned clearnet→Tor (#234)"
+            if wait_for 180 10 "tari clearnet→Tor transition marker (#234)" rx "test -f '$csdir/tari.synced'"; then
+                it_pass "tari auto-transitioned clearnet→Tor (#234)"
             else it_fail "tari auto-transitioned clearnet→Tor (#234)" "marker not written within 180s"; fi
         fi
         wait_for 240 5 "stack healthy after clearnet→Tor transition (#234)" _pred_status_ok || true
@@ -351,19 +434,20 @@ assert_running_state() {
     while IFS= read -r svc; do
         [ -z "$svc" ] && continue
         case "$running" in
-            *"$svc"*) it_pass "container up: $svc" ;;
-            *)        it_fail "container up: $svc" "not in running services" ;;
+        *"$svc"*) it_pass "container up: $svc" ;;
+        *) it_fail "container up: $svc" "not in running services" ;;
         esac
-    done <<< "$expected"
+    done <<<"$expected"
     if [ "$mode" = "remote" ]; then
         case "$running" in
-            *monerod*) it_fail "monerod absent in remote mode" "monerod is running" ;;
-            *)         it_pass "monerod absent in remote mode" ;;
+        *monerod*) it_fail "monerod absent in remote mode" "monerod is running" ;;
+        *) it_pass "monerod absent in remote mode" ;;
         esac
     fi
 
     # 2. pithead status is green for a healthy config.
-    pithead status >/dev/null 2>&1; assert_rc "status exit code is 0 (healthy)" "$?" "0"
+    pithead status >/dev/null 2>&1
+    assert_rc "status exit code is 0 (healthy)" "$?" "0"
 
     # 3. Dashboard reachable and reading live state. In local mode, let the monero sync panel finish
     #    its first poll after the scenario's apply/restart before snapshotting, so step 4 sees settled
@@ -382,17 +466,18 @@ assert_running_state() {
     # The dashboard's sync panel must also read "done" for a synced node — not stay stuck at
     # "loading". A synced monerod reports target_height 0, so the panel has to trust the caught-up
     # flag, not percent-vs-target; getting that wrong left a synced node "loading" forever (the real
-    # bug found in the #180 gouda validation). Local only: we control + know the node is synced.
+    # bug found in the #180 live validation). Local only: we control + know the node is synced.
     if [ "$mode" = "local" ]; then
         assert_eq "monero sync panel reads done (dashboard)" "$(jq_get "$st" '.sync.monero.state')" "done"
     fi
     # Pruned/full panel (#32): determinate (Pruned|Full) for a local node; remote is often Unknown.
-    local dmode; dmode="$(jq_get "$st" '.monero.mode')"
+    local dmode
+    dmode="$(jq_get "$st" '.monero.mode')"
     if [ "$mode" = "remote" ]; then
         it_pass "monero display mode present ($dmode)"
     else
-        case "$dmode" in Pruned|Full) it_pass "monero display mode determinate ($dmode)" ;;
-                         *)            it_fail "monero display mode determinate" "got [$dmode], want Pruned|Full" ;; esac
+        case "$dmode" in Pruned | Full) it_pass "monero display mode determinate ($dmode)" ;;
+        *) it_fail "monero display mode determinate" "got [$dmode], want Pruned|Full" ;; esac
     fi
 
     # 5. Sidechain selection matches the pool axis.
@@ -414,8 +499,23 @@ assert_running_state() {
         assert_eq "tari synced (required)" "$(jq_get "$st" '.sync.tari.state')" "done"
     fi
 
+    # 7b. The #170 Stack Topology & Egress panel rides on /api/state, derived live from config.
+    #     Assert the data contract survives the trip (the on-the-wire privacy posture is verified
+    #     separately by assert_egress_posture via /proc/net/tcp): both sections present, the badge
+    #     summary shared verbatim with the map so they can never disagree, and the canonical node
+    #     set exposed. Holds for every scenario — the node set is static and the summary invariant
+    #     is config-independent.
+    assert_eq "egress posture section present" "$(jq_get "$st" '.egress.summary | type')" "object"
+    assert_eq "topology section present" "$(jq_get "$st" '.topology.summary | type')" "object"
+    assert_eq "topology + egress share one summary" \
+        "$(jq_get "$st" '.topology.summary == .egress.summary')" "true"
+    assert_eq "topology exposes the canonical node set" \
+        "$(jq_get "$st" '[.topology.nodes[].id] | sort | join(",")')" \
+        "browser,caddy,dashboard,docker,internet,monerod,p2pool,rigs,tari,tor,xmrig-proxy"
+
     # 8. Security/posture axes propagated to .env.
-    local want_bind; [ "$rpc_lan" = "true" ] && want_bind="0.0.0.0" || want_bind="127.0.0.1"
+    local want_bind
+    [ "$rpc_lan" = "true" ] && want_bind="0.0.0.0" || want_bind="127.0.0.1"
     assert_eq "MONERO_RPC_BIND matches rpc_lan_access" "$(env_on_box MONERO_RPC_BIND)" "$want_bind"
     assert_eq "DASHBOARD_SECURE matches config" "$(env_on_box DASHBOARD_SECURE)" "${secure:-true}"
     assert_eq "XVB_ENABLED matches config" "$(env_on_box XVB_ENABLED)" "${xvb:-true}"
@@ -431,45 +531,47 @@ assert_running_state() {
             assert_num_gt "memory ceiling live on $svc (#132)" "${memlim:-0}" 0
         done
         assert_num_ge "monerod DNS checkpoints disabled (#161)" \
-            "$(rx "docker exec monerod grep -c '^disable-dns-checkpoints=1' /root/.bitmonero/bitmonero.conf 2>/dev/null")" 1
+            "$(rx "docker exec monerod grep -c '^disable-dns-checkpoints=1' /home/ubuntu/.bitmonero/bitmonero.conf 2>/dev/null")" 1
         assert_eq "monerod has no clearnet priority-node hostnames (#161)" \
-            "$(rx "docker exec monerod grep -cE 'xmrvsbeast.com|hashvault.pro' /root/.bitmonero/bitmonero.conf 2>/dev/null")" "0"
+            "$(rx "docker exec monerod grep -cE 'xmrvsbeast.com|hashvault.pro' /home/ubuntu/.bitmonero/bitmonero.conf 2>/dev/null")" "0"
         # Clearnet initial sync (#183) + auto-transition (#234). The flag propagates to .env; pithead
         # ALWAYS renders the canonical Tor config (the clearnet transform is applied per-start
         # in-container, gated on the flag AND the dashboard's marker). The dashboard switches a
         # clearnet node back to Tor once it's synced — so in the synced steady state asserted here,
         # monerod always carries the Tor P2P proxy and Tari's canonical config stays `type = "tor"`.
         assert_eq "MONERO_CLEARNET_SYNC matches config (#183)" "$(env_on_box MONERO_CLEARNET_SYNC)" "$monero_clearnet"
-        assert_eq "TARI_CLEARNET_SYNC matches config (#183)"   "$(env_on_box TARI_CLEARNET_SYNC)"   "$tari_clearnet"
+        assert_eq "TARI_CLEARNET_SYNC matches config (#183)" "$(env_on_box TARI_CLEARNET_SYNC)" "$tari_clearnet"
         assert_num_ge "tari canonical config is always Tor (#234)" \
             "$(rx "docker exec tari grep -c '^type = \"tor\"' /var/tari/config/config.toml 2>/dev/null")" 1
         assert_num_ge "monerod runs Tor-only in steady state — proxy present (#183/#234)" \
-            "$(rx "docker exec monerod grep -cE '^proxy=' /root/.bitmonero/bitmonero.conf 2>/dev/null")" 1
+            "$(rx "docker exec monerod grep -cE '^proxy=' /home/ubuntu/.bitmonero/bitmonero.conf 2>/dev/null")" 1
         # (The clearnet→Tor auto-transition was already awaited + asserted at the top of this function,
         # before the steady-state battery, so the assertions above see the settled post-flip state.)
         case "$(rx "docker inspect tari --format '{{.HostConfig.Dns}}' 2>/dev/null")" in
-            *1.1.1.1*|*8.8.8.8*) it_fail "tari DNS sinkholed — no clearnet resolver (#162)" "clearnet nameserver present" ;;
-            *127.0.0.1*)         it_pass "tari DNS sinkholed — no clearnet resolver (#162)" ;;
-            *)                   it_fail "tari DNS sinkholed — no clearnet resolver (#162)" "unexpected HostConfig.Dns" ;;
+        *1.1.1.1* | *8.8.8.8*) it_fail "tari DNS sinkholed — no clearnet resolver (#162)" "clearnet nameserver present" ;;
+        *127.0.0.1*) it_pass "tari DNS sinkholed — no clearnet resolver (#162)" ;;
+        *) it_fail "tari DNS sinkholed — no clearnet resolver (#162)" "unexpected HostConfig.Dns" ;;
         esac
         # The xmrig-proxy config knobs must reach the RUNNING proxy's argv, not just the compose
         # render. donate-level is rendered explicitly so it's always visible (#173). The matrix
         # deploys the default config (no p2pool.stratum_password) → stratum auth OFF, which must
         # render NO --access-password flag at all: a literal empty '--access-password=' would demand
         # an empty password and reject every rig (the bug verified + guarded for #152).
-        local proxy_args; proxy_args="$(rx "docker inspect xmrig-proxy --format '{{json .Args}}' 2>/dev/null")"
+        local proxy_args
+        proxy_args="$(rx "docker inspect xmrig-proxy --format '{{json .Args}}' 2>/dev/null")"
         case "$proxy_args" in
-            *'--donate-level='*) it_pass "xmrig-proxy dev-fee donate-level is explicit + live (#173)" ;;
-            *)                   it_fail "xmrig-proxy dev-fee donate-level is explicit + live (#173)" "no --donate-level in proxy argv" ;;
+        *'--donate-level='*) it_pass "xmrig-proxy dev-fee donate-level is explicit + live (#173)" ;;
+        *) it_fail "xmrig-proxy dev-fee donate-level is explicit + live (#173)" "no --donate-level in proxy argv" ;;
         esac
         case "$proxy_args" in
-            *'--access-password='*) it_fail "default-off stratum: no --access-password live (#152)" "found --access-password with no stratum_password set — would reject rigs" ;;
-            *)                      it_pass "default-off stratum: no --access-password live (#152)" ;;
+        *'--access-password='*) it_fail "default-off stratum: no --access-password live (#152)" "found --access-password with no stratum_password set — would reject rigs" ;;
+        *) it_pass "default-off stratum: no --access-password live (#152)" ;;
         esac
     fi
 
     # 9. Caddy scheme matches dashboard.secure.
-    local scheme; [ "$secure" = "false" ] && scheme="http://" || scheme="https://"
+    local scheme
+    [ "$secure" = "false" ] && scheme="http://" || scheme="https://"
     assert_contains "Caddyfile uses correct scheme" "$(rx 'head -n1 Caddyfile 2>/dev/null')" "$scheme"
 
     # 10. Secrets intact (proxy token + onions unchanged vs the baseline we captured).
@@ -481,10 +583,58 @@ assert_running_state() {
 assert_scenario() {
     local name="$1" config="$2"
     assert_running_state "$name" "$config"
-    local again; again="$(pithead apply -y 2>&1)"
+    local again
+    again="$(pithead apply -y 2>&1)"
     assert_contains "re-apply is a no-op" "$again" "No configuration changes detected"
 }
 
+# Runtime egress posture (#274) — the structural proof of #270, beyond config: poll each app
+# container's LIVE connections and FAIL if any holds a PERSISTENT direct public connection (i.e. it
+# isn't dialing through the Tor SOCKS). Config-level checks miss this — it's what caught the #165
+# stale-image p2pool leak and the #271 Tari direct-dial. Reuses bench-verify-egress.sh (the #256
+# verifier) in its persistent-only mode so post-restart startup transients don't false-positive.
+# Skipped when a clearnet initial sync is active (#183): a node is then intentionally on clearnet.
+assert_egress_posture() {
+    local mc tc prefix out
+    mc="$(env_on_box MONERO_CLEARNET_SYNC)"
+    tc="$(env_on_box TARI_CLEARNET_SYNC)"
+    if [ "$mc" = "true" ] || [ "$tc" = "true" ]; then
+        it_log "   egress: clearnet initial sync active (#183) — skipping the all-Tor egress gate"
+        return 0
+    fi
+    prefix="$(env_on_box NETWORK_PREFIX)"
+    [ -n "$prefix" ] || prefix="172.28.0"
+    out="$(rx "bash tests/integration/benchmarks/bench-verify-egress.sh tor --dir . --prefix '$prefix' --polls 3 --interval 8 2>&1")"
+    case "$out" in
+    *"[verify-egress] OK"*) it_pass "no clearnet egress — every app dials via Tor (#274/#270)" ;;
+    *) it_fail "no clearnet egress — every app dials via Tor (#274/#270)" "$(printf '%s' "$out" | grep -E 'LEAK|✗' | head -4)" ;;
+    esac
+}
+
+# XvB stats + auto-registration over Tor (#206/#163). The dashboard's ONLY clearnet-bound traffic is
+# the XvB call to xmrvsbeast (the bonus-history stats fetch and the #263 auto-register POST). It must
+# ride the bridge Tor SOCKS so the operator's home IP is never correlated with the wallet. Two-part
+# LIVE proof, the tier-4 counterpart to test_xvb_client's socks5h assertion:
+#   1. the RUNNING dashboard is wired to the Tor SOCKS — XVB_TOR_PROXY = socks5h://<prefix>.25:9050.
+#      Reading the live container env (not the compose render) catches a stale-image/partial update
+#      that didn't apply the proxy, exactly like the #152/#173 live xmrig-proxy argv checks. socks5h
+#      (not socks5) means the xmrvsbeast hostname resolves over Tor too — no local DNS leak.
+#   2. assert_egress_posture (run alongside, below) proves NO app container holds a direct clearnet
+#      connection — so the XvB call provably could only have left via Tor.
+# Skipped when XvB is disabled (nothing dials xmrvsbeast then).
+assert_xvb_over_tor() {
+    if [ "$(env_on_box XVB_ENABLED)" != "true" ]; then
+        it_log "   xvb: disabled — skipping the XvB-over-Tor wiring check"
+        return 0
+    fi
+    local prefix proxy want
+    prefix="$(env_on_box NETWORK_PREFIX)"
+    [ -n "$prefix" ] || prefix="172.28.0"
+    want="socks5h://$prefix.25:9050"
+    proxy="$(rx "docker exec dashboard printenv XVB_TOR_PROXY 2>/dev/null")"
+    assert_eq "XvB stats + auto-register wired to the Tor SOCKS (#206/#163)" "$proxy" "$want"
+}
+
 # Non-destructive --check: assert the box's CURRENT live state (its own config), no apply.
 assert_current_state() {
     IT_CURRENT_SCENARIO="check"
@@ -492,6 +642,8 @@ assert_current_state() {
     it_log "── read-only check against the live stack ──────────"
     local fails_before="$IT_FAIL"
     assert_running_state "check" "$BASELINE_CONFIG"
+    assert_egress_posture
+    assert_xvb_over_tor
     [ "$IT_FAIL" -gt "$fails_before" ] && capture_artifacts "check" "$OUT_DIR"
 }
 
@@ -501,9 +653,9 @@ assert_current_state() {
 # from leaking. Complements `pithead doctor` (stack health) — this checks the server's fitness
 # for the integration harness's job. A WARN is "works, but not ideal"; a FAIL is "fix before
 # using as a release gate".
-box_fstype()   { rx "df --output=fstype $(quote_arg "$1") 2>/dev/null | tail -n1 | tr -d ' '"; }
+box_fstype() { rx "df --output=fstype $(quote_arg "$1") 2>/dev/null | tail -n1 | tr -d ' '"; }
 box_avail_gb() { rx "df -BG --output=avail $(quote_arg "$1") 2>/dev/null | tail -n1 | tr -dc '0-9'"; }
-box_mode()     { rx "stat -c %a $(quote_arg "$1") 2>/dev/null"; }
+box_mode() { rx "stat -c %a $(quote_arg "$1") 2>/dev/null"; }
 
 assert_release_readiness() {
     IT_CURRENT_SCENARIO="readiness"
@@ -512,35 +664,44 @@ assert_release_readiness() {
 
     # 1. The whole point of a release server: chains already synced, reused in minutes.
     if monero_caught_up; then it_pass "Monero is synced (chain reusable by the matrix)"; else it_fail "Monero is synced" "monerod not caught up — the matrix would have to re-sync"; fi
-    pithead status >/dev/null 2>&1; assert_rc "stack is healthy (pithead status)" "$?" "0"
+    pithead status >/dev/null 2>&1
+    assert_rc "stack is healthy (pithead status)" "$?" "0"
 
     # 2. The prune axis must vary the DB without re-syncing or mutating the canonical chain. The
     #    OTHER prune mode is unlocked either by (a) a snapshot/reflink-capable live FS (so a
     #    variant can be made cheaply) or (b) supplying a pre-built chain of the OPPOSITE mode
     #    (--full-data-dir when the box is pruned, --pruned-data-dir when it's full). A SAME-mode
     #    copy on a CoW volume is also useful: it lets destructive scenarios run off the live chain.
-    #    gouda is a pruned box (MONERO_PRUNE=1) with a pruned copy on a btrfs CoW loopback, so it
+    #    the test bench is a pruned box (MONERO_PRUNE=1) with a pruned copy on a btrfs CoW loopback, so it
     #    exercises pruned mode live with snapshot isolation; full mode is covered by the fakes.
     local mdir fstype="" cow_live=0 baseline_mode="full" bp
     mdir="$(env_on_box MONERO_DATA_DIR)"
-    bp="${BASELINE_PRUNE:-$(env_on_box MONERO_PRUNE)}"   # so standalone --readiness sees it too
+    bp="${BASELINE_PRUNE:-$(env_on_box MONERO_PRUNE)}" # so standalone --readiness sees it too
     [ -n "$mdir" ] && fstype="$(box_fstype "$mdir")"
-    case "$fstype" in btrfs|zfs|xfs) cow_live=1 ;; esac
+    case "$fstype" in btrfs | zfs | xfs) cow_live=1 ;; esac
     [ "$bp" = "1" ] && baseline_mode="pruned"
     it_log "   live chain: ${mdir:-?} (${fstype:-unknown}, ${baseline_mode})"
 
     # Classify any supplied chains by prune mode relative to the live baseline.
     local opp_dir opp_label same_dir
-    if [ "$bp" = "1" ]; then opp_dir="${FULL_DATA_DIR:-}"; opp_label="full"; same_dir="${PRUNED_DATA_DIR:-}"
-    else opp_dir="${PRUNED_DATA_DIR:-}"; opp_label="pruned"; same_dir="${FULL_DATA_DIR:-}"; fi
+    if [ "$bp" = "1" ]; then
+        opp_dir="${FULL_DATA_DIR:-}"
+        opp_label="full"
+        same_dir="${PRUNED_DATA_DIR:-}"
+    else
+        opp_dir="${PRUNED_DATA_DIR:-}"
+        opp_label="pruned"
+        same_dir="${FULL_DATA_DIR:-}"
+    fi
 
     # A same-mode copy (e.g. the CoW pruned chain) — snapshot isolation for destructive scenarios.
     if [ -n "$same_dir" ]; then
-        local sfs; sfs="$(box_fstype "$same_dir")"
+        local sfs
+        sfs="$(box_fstype "$same_dir")"
         if rx "test -e $(quote_arg "$same_dir")/lmdb/data.mdb" >/dev/null 2>&1; then
             case "$sfs" in
-                btrfs|zfs|xfs) it_pass "snapshot-isolated $baseline_mode chain on a CoW FS ($same_dir, $sfs) — destructive scenarios needn't touch the live chain" ;;
-                *)             it_log "   same-mode copy at $same_dir ($sfs — not CoW)" ;;
+            btrfs | zfs | xfs) it_pass "snapshot-isolated $baseline_mode chain on a CoW FS ($same_dir, $sfs) — destructive scenarios needn't touch the live chain" ;;
+            *) it_log "   same-mode copy at $same_dir ($sfs — not CoW)" ;;
             esac
         else
             it_warn "supplied same-mode dir has no lmdb/data.mdb ($same_dir)"
@@ -562,7 +723,8 @@ assert_release_readiness() {
 
     # 3. Disk headroom on the live chain FS (room to operate + hold a co-located second chain).
     if [ -n "$mdir" ]; then
-        local avail; avail="$(box_avail_gb "$mdir")"
+        local avail
+        avail="$(box_avail_gb "$mdir")"
         if [ -n "$avail" ] && [ "$avail" -ge 100 ] 2>/dev/null; then
             it_pass "disk headroom on the live chain FS (${avail} GiB free)"
         else
@@ -571,11 +733,12 @@ assert_release_readiness() {
     fi
 
     # 4. Secrets must not be world/group readable (the box holds wallet/RPC creds + onion keys).
-    local envmode; envmode="$(box_mode .env)"
+    local envmode
+    envmode="$(box_mode .env)"
     case "$envmode" in
-        ""|*[!0-9]*) it_warn ".env permissions unknown" ;;
-        ?00)         it_pass ".env is owner-only (mode $envmode)" ;;
-        *)           it_fail ".env is owner-only" "mode is $envmode — group/other can read RPC creds & onions; run: chmod 600 .env" ;;
+    "" | *[!0-9]*) it_warn ".env permissions unknown" ;;
+    ?00) it_pass ".env is owner-only (mode $envmode)" ;;
+    *) it_fail ".env is owner-only" "mode is $envmode — group/other can read RPC creds & onions; run: chmod 600 .env" ;;
     esac
 
     # 5. The dashboard must sit behind Caddy on localhost, never bound to a public interface.
@@ -586,8 +749,8 @@ assert_release_readiness() {
     else
         while read -r st _q1 _q2 laddr _; do
             [ -n "$laddr" ] || continue
-            case "$laddr" in 127.0.0.1:*|"[::1]:"*) : ;; *) exposed=1 ;; esac
-        done <<< "$d_addrs"
+            case "$laddr" in 127.0.0.1:* | "[::1]:"*) : ;; *) exposed=1 ;; esac
+        done <<<"$d_addrs"
         if [ "$exposed" -eq 0 ]; then it_pass "dashboard bound to localhost only (Caddy fronts it)"; else it_fail "dashboard bound to localhost only" "it is listening on a non-loopback address — do not expose the dashboard directly"; fi
     fi
 
@@ -609,19 +772,42 @@ run_lifecycle() {
     it_step "pithead restart…"
     pithead restart >/dev/null 2>&1
     wait_status_ok 240 || true
-    pithead status >/dev/null 2>&1; assert_rc "status OK after restart" "$?" "0"
+    pithead status >/dev/null 2>&1
+    assert_rc "status OK after restart" "$?" "0"
 
     # apply that changes the sidechain recreates only the affected containers, preserving
     # secrets. We flip main<->mini and assert the token/onions are untouched, then revert.
     local cur_pool fp_before
-    cur_pool="$(jq_get "$BASELINE_CONFIG" '.p2pool.pool')"; cur_pool="${cur_pool:-main}"
-    local other; [ "$cur_pool" = "mini" ] && other="main" || other="mini"
+    cur_pool="$(jq_get "$BASELINE_CONFIG" '.p2pool.pool')"
+    cur_pool="${cur_pool:-main}"
+    local other
+    [ "$cur_pool" = "mini" ] && other="main" || other="mini"
     fp_before="$(secret_fingerprint)"
+    # ensure_owner whole-tree migration (#255): plant a root-owned file UNDER a data dir (the
+    # root-container-era signature — user-owned dir, root-owned contents) and prove this apply chowns
+    # it to the container uid, the exact regression MEMORY flags ("scan contents, not just the dir").
+    # Piggybacks the pool-flip apply below, which always runs ensure_directories -> ensure_owner.
+    # Local mode only (has data dirs); a stub can't create a foreign-uid inode, so this is tier-4.
+    local own_dir own_probe=""
+    if [ "$(env_on_box COMPOSE_PROFILES)" = "local_node" ]; then
+        own_dir="$(env_on_box DASHBOARD_DATA_DIR)"
+        if [ -n "$own_dir" ]; then
+            own_probe="$own_dir/.itest-owner-probe"
+            it_step "planting a root-owned file under $own_dir to exercise ensure_owner (#255)…"
+            rx "sudo touch $(quote_arg "$own_probe") && sudo chown 0:0 $(quote_arg "$own_probe")" >/dev/null 2>&1
+        fi
+    fi
     push_config "$(render_scenario_config "$BASELINE_CONFIG" "p2pool.pool=$other")"
     it_step "apply pool $cur_pool -> $other…"
     pithead apply -y >/dev/null 2>&1
     wait_status_ok 180 || true
     assert_eq "secrets preserved across pool change" "$(secret_fingerprint)" "$fp_before"
+    # APP_UID is 1000 in pithead; the migrated contents must now be owned by it, not root.
+    if [ -n "$own_probe" ]; then
+        assert_eq "apply migrates root-owned CONTENTS to the container uid (#255)" \
+            "$(rx "stat -c %u $(quote_arg "$own_probe") 2>/dev/null")" "1000"
+        rx "sudo rm -f $(quote_arg "$own_probe")" >/dev/null 2>&1 || true
+    fi
     # .pool.type lags a sidechain switch until peers on the new chain connect — wait, don't assert cold (#54).
     wait_pool_ready 180 "$(pool_label "$other")" || true
     assert_eq "pool actually changed" "$(jq_get "$(api_state)" '.pool.type')" "$(pool_label "$other")"
@@ -632,11 +818,13 @@ run_lifecycle() {
         it_step "stopping monerod to exercise node-down failover…"
         rx "docker compose stop monerod" >/dev/null 2>&1
         wait_for 120 5 "status to report node down" _pred_status_down || true
-        pithead status >/dev/null 2>&1; assert_rc "status non-zero when node down" "$?" "1"
+        pithead status >/dev/null 2>&1
+        assert_rc "status non-zero when node down" "$?" "1"
         it_step "starting monerod and waiting for readmit…"
         rx "docker compose start monerod" >/dev/null 2>&1
         wait_status_ok 240 || true
-        pithead status >/dev/null 2>&1; assert_rc "status OK after node recovery" "$?" "0"
+        pithead status >/dev/null 2>&1
+        assert_rc "status OK after node recovery" "$?" "0"
     else
         it_warn "skipping node-down failover (remote mode: no local monerod to stop)"
     fi
@@ -646,10 +834,13 @@ run_lifecycle() {
     # secrets survived — exercising both CLI verbs end-to-end (not just the rollback net).
     it_step "backup → restore round-trip…"
     if pithead backup -y >/dev/null 2>&1; then
-        local arch; arch="$(rx 'ls -t backups/pithead-backup-*.tar.gz 2>/dev/null | head -n1')"
+        local arch
+        arch="$(rx 'ls -t backups/pithead-backup-*.tar.gz 2>/dev/null | head -n1')"
         if [ -n "$arch" ]; then
-            local fp_b; fp_b="$(secret_fingerprint)"
-            local backed_pool; backed_pool="$(jq_get "$(api_state)" '.pool.type')"
+            local fp_b
+            fp_b="$(secret_fingerprint)"
+            local backed_pool
+            backed_pool="$(jq_get "$(api_state)" '.pool.type')"
             # Diverge from the backed-up state, then restore it back.
             push_config "$(render_scenario_config "$BASELINE_CONFIG" "p2pool.pool=$other")"
             pithead apply -y >/dev/null 2>&1
@@ -678,20 +869,22 @@ _pred_status_down() { ! pithead status >/dev/null 2>&1; }
 # dashboard's failover, then restore. Local mode only (needs a local monerod to break).
 # These are destructive-then-restored and slow (healthcheck + node-health debounce), so the
 # phase is opt-in.
-_monerod_is() {  # _monerod_is <state> [<health>]
-    local s; s="$(service_state monerod)"
+_monerod_is() { # _monerod_is <state> [<health>]
+    local s
+    s="$(service_state monerod)"
     [ "$(svc_state_of "$s")" = "$1" ] && { [ -z "${2:-}" ] || [ "$(svc_health_of "$s")" = "$2" ]; }
 }
-_pred_monerod_missing()   { _monerod_is missing; }
+_pred_monerod_missing() { _monerod_is missing; }
 _pred_monerod_unhealthy() { _monerod_is running unhealthy; }
-_pred_monerod_healthy()   { _monerod_is running healthy; }
-_pred_proxy_stopped()     { [ "$(svc_state_of "$(service_state xmrig-proxy)")" != "running" ]; }
+_pred_monerod_healthy() { _monerod_is running healthy; }
+_pred_proxy_stopped() { [ "$(svc_state_of "$(service_state xmrig-proxy)")" != "running" ]; }
 
 fault_node_down() {
     it_step "fault: stop monerod (required node down)…"
     rx "docker compose stop monerod" >/dev/null 2>&1
     wait_for 60 5 "status to report a problem" _pred_status_down || true
-    pithead status >/dev/null 2>&1; assert_rc "status non-zero when monerod is down" "$?" "1"
+    pithead status >/dev/null 2>&1
+    assert_rc "status non-zero when monerod is down" "$?" "1"
     # The dashboard rejects workers (stops xmrig-proxy) after its node-health debounce so they
     # fail over to backup pools (#31).
     wait_for 180 10 "xmrig-proxy stopped by failover" _pred_proxy_stopped || true
@@ -700,7 +893,8 @@ fault_node_down() {
     rx "docker compose start monerod" >/dev/null 2>&1
     wait_for 240 5 "monerod healthy" _pred_monerod_healthy || true
     wait_status_ok 240 || true
-    pithead status >/dev/null 2>&1; assert_rc "status OK after monerod recovery" "$?" "0"
+    pithead status >/dev/null 2>&1
+    assert_rc "status OK after monerod recovery" "$?" "0"
 }
 
 fault_unhealthy() {
@@ -710,7 +904,8 @@ fault_unhealthy() {
     # running-but-unhealthy — the verdict stack_status flags as a problem.
     wait_for 200 10 "monerod to report unhealthy" _pred_monerod_unhealthy || true
     assert_eq "monerod running-but-unhealthy" "$(service_state monerod)" "running unhealthy"
-    pithead status >/dev/null 2>&1; assert_rc "status non-zero when monerod unhealthy" "$?" "1"
+    pithead status >/dev/null 2>&1
+    assert_rc "status non-zero when monerod unhealthy" "$?" "1"
     it_step "recover: thaw monerod (SIGCONT)…"
     rx "docker compose kill -s SIGCONT monerod" >/dev/null 2>&1
     wait_for 120 5 "monerod healthy" _pred_monerod_healthy || true
@@ -721,12 +916,48 @@ fault_missing() {
     rx "docker compose rm -sf monerod" >/dev/null 2>&1
     wait_for 30 3 "monerod to be missing" _pred_monerod_missing || true
     assert_eq "monerod reported missing" "$(svc_state_of "$(service_state monerod)")" "missing"
-    pithead status >/dev/null 2>&1; assert_rc "status non-zero when monerod missing" "$?" "1"
+    pithead status >/dev/null 2>&1
+    assert_rc "status non-zero when monerod missing" "$?" "1"
     it_step "recover: recreate monerod…"
     rx "docker compose up -d monerod" >/dev/null 2>&1
     wait_for 240 5 "monerod healthy" _pred_monerod_healthy || true
 }
 
+# Live counterpart to the tier-1 stubbed rollback (tests/stack/run.sh #270): force a REAL
+# `iptables -I` to fail mid-apply and prove the box ends fail-closed — the partial ruleset is
+# rolled BACK, not left half-open (a stubbed iptables can't prove the real kernel strips a partial
+# insert). DESTRUCTIVE-then-restored: apply_tor_egress_firewall clears the live rules before
+# re-inserting, so on the sabotaged run the firewall is briefly down until the recover step (and
+# run_fault_injection's belt-and-braces) reinstate it — hence opt-in, local-box only.
+fault_firewall_rollback() {
+    if [ "$(env_on_box TOR_EGRESS_FIREWALL)" = "false" ]; then
+        it_warn "skipping firewall-rollback fault (network.tor_egress_firewall=false)"
+        return 0
+    fi
+    it_step "fault: force an iptables -I failure during the firewall apply…"
+    # Shadow SUDO (not iptables): apply calls `sudo iptables -I`, and sudo's secure_path ignores a
+    # PATH-shadowed iptables, so the insert would really succeed. sudo itself is still found via PATH,
+    # so a wrapper that fails an `iptables … -I …` insert and execs real sudo for everything else
+    # (remove's -D, -N, iptables-save) makes the insert fail exactly as a real mid-insert error would.
+    # On PATH only for the apply below, deleted on recover. $realsudo baked at write time; \$1/\$a/\$@
+    # stay literal. (Verified live on a real box — the iptables-shadow variant silently no-ops.)
+    rx 'realsudo=$(command -v sudo) && mkdir -p .itest-bin && printf "%s\n" "#!/usr/bin/env bash" "if [ \"\$1\" = iptables ]; then for a; do [ \"\$a\" = -I ] && exit 1; done; fi" "exec $realsudo \"\$@\"" > .itest-bin/sudo && chmod +x .itest-bin/sudo' >/dev/null 2>&1
+    # apply_tor_egress_firewall is a pithead function (main is guarded when sourced), so sourcing +
+    # calling it with the sabotaged iptables hits the exact rollback branch.
+    local rc
+    rx 'PATH="$PWD/.itest-bin:$PATH" bash -c "source ./pithead && apply_tor_egress_firewall" >/dev/null 2>&1'
+    rc=$?
+    assert_rc "firewall apply degrades gracefully on an insert failure (rc 0)" "$rc" "0"
+    # No pithead-tagged rule may survive a failed insert — the rollback must strip the partial set.
+    assert_eq "insert failure leaves NO half-open firewall (rolled back)" \
+        "$(rx 'sudo iptables-save 2>/dev/null | grep -c pithead-tor-egress')" "0"
+    it_step "recover: drop the sabotage and reinstall the real firewall…"
+    rx 'rm -rf .itest-bin' >/dev/null 2>&1
+    rx 'bash -c "source ./pithead && apply_tor_egress_firewall" >/dev/null 2>&1' || true
+    assert_num_gt "firewall reinstated after recovery" \
+        "$(rx 'sudo iptables-save 2>/dev/null | grep -c pithead-tor-egress')" 0
+}
+
 run_fault_injection() {
     # shellcheck disable=SC2034  # read by lib.sh:it_fail to label captured failures
     IT_CURRENT_SCENARIO="fault-injection"
@@ -741,14 +972,71 @@ run_fault_injection() {
     fault_node_down
     fault_unhealthy
     fault_missing
+    fault_firewall_rollback
     [ "$IT_FAIL" -gt "$fails_before" ] && capture_artifacts "fault-injection" "$OUT_DIR"
 
-    # Belt-and-braces: whatever happened above, leave monerod up and the stack healthy.
+    # Belt-and-braces: whatever happened above, leave monerod up, the firewall reinstated, and the
+    # stack healthy (the firewall reinstate is unconditional so a mid-phase abort can't leave the box
+    # with clearnet egress open).
     rx "docker compose up -d monerod" >/dev/null 2>&1 || true
+    rx 'bash -c "source ./pithead && apply_tor_egress_firewall" >/dev/null 2>&1' || true
     wait_for 240 5 "monerod healthy after fault phase" _pred_monerod_healthy || true
     wait_status_ok 240 || true
 }
 
+# --- Fail-closed auth phase (--auth-fail-closed) ----------------------------
+# Live counterpart to the tier-1 compose-config assertion (tests/stack/test_compose.sh): prove the
+# DEPLOY path — not just `docker compose config` — refuses to start an unauthenticated xmrig-proxy
+# control API when PROXY_AUTH_TOKEN is empty (#153/#203). We empty the token in .env and run
+# `pithead up`, which does NOT re-render .env (only setup/apply do — and apply would self-heal by
+# regenerating the token), so the compose `:?` guard fires and the stack refuses to start. The
+# `:?` error aborts `docker compose up` before it touches any container, so a running stack is left
+# intact. We then restore the EXACT original token (a fresh one would break the run's end-of-run
+# secret-fingerprint check) and bring the stack back healthy. DESTRUCTIVE-then-restored.
+
+# Rewrite PROXY_AUTH_TOKEN in .env in place, preserving line order. quote_arg makes the value safe
+# for the remote shell; awk leaves every other line untouched.
+_set_env_token() { # _set_env_token <value>
+    rx "awk -v t=$(quote_arg "$1") '/^PROXY_AUTH_TOKEN=/{print \"PROXY_AUTH_TOKEN=\" t; next} {print}' .env > .env.itest && mv .env.itest .env"
+}
+
+run_auth_fail_closed() {
+    # shellcheck disable=SC2034  # read by lib.sh:it_fail to label captured failures
+    IT_CURRENT_SCENARIO="auth-fail-closed"
+    echo ""
+    it_log "── fail-closed auth phase (#153/#203) ──────────────"
+
+    local orig
+    orig="$(env_on_box PROXY_AUTH_TOKEN)"
+    if [ -z "$orig" ]; then
+        it_warn "skipping: PROXY_AUTH_TOKEN already empty on the box (run 'pithead setup'/'apply' first)"
+        return 0
+    fi
+
+    local fails_before="$IT_FAIL"
+
+    # 1. Empty the token; `pithead up` must refuse to start AND name the documented fix.
+    it_step "emptying PROXY_AUTH_TOKEN in .env and running 'pithead up'…"
+    _set_env_token ""
+    local out rc
+    out="$(pithead up 2>&1)"
+    rc=$?
+    assert_ne "pithead up fails closed (non-zero exit) on an empty PROXY_AUTH_TOKEN" "$rc" "0"
+    assert_contains "compose guard refuses the unauthenticated proxy API (#153)" \
+        "$out" "refusing to start an unauthenticated xmrig-proxy control API"
+
+    # 2. Restore the EXACT original token (apply would mint a new one) and recover.
+    it_step "restoring the original PROXY_AUTH_TOKEN and recovering…"
+    _set_env_token "$orig"
+    assert_eq "original PROXY_AUTH_TOKEN restored verbatim" "$(env_on_box PROXY_AUTH_TOKEN)" "$orig"
+    pithead up >/dev/null 2>&1 || it_warn "recovery 'pithead up' returned non-zero; check the box."
+    wait_status_ok 240 || true
+    pithead status >/dev/null 2>&1
+    assert_rc "stack healthy again after token restore" "$?" "0"
+
+    [ "$IT_FAIL" -gt "$fails_before" ] && capture_artifacts "auth-fail-closed" "$OUT_DIR"
+}
+
 # --- Safety backup / rollback (--safety-backup) -----------------------------
 # Take a real `pithead backup` before the destructive scenarios so a failed run can be rolled
 # all the way back (config, .env, Caddyfile, Tor onion keys, dashboard DB). This both protects
@@ -756,7 +1044,7 @@ run_fault_injection() {
 safety_backup() {
     [ "$SAFETY_BACKUP" = "1" ] || return 0
     it_log "Taking a safety backup before destructive scenarios (pithead backup -y)…"
-    if ! pithead backup -y > "$OUT_DIR/backup.log" 2>&1; then
+    if ! pithead backup -y >"$OUT_DIR/backup.log" 2>&1; then
         it_fail "safety backup created" "see $OUT_DIR/backup.log"
         return 0
     fi
@@ -767,9 +1055,10 @@ safety_backup() {
     fi
     it_log "Safety backup: $SAFETY_ARCHIVE"
     # Exercise backup as an assertion: the archive must list the core files we'd roll back to.
-    local listing; listing="$(rx "tar -tzf $(quote_arg "$SAFETY_ARCHIVE") 2>/dev/null")"
+    local listing
+    listing="$(rx "tar -tzf $(quote_arg "$SAFETY_ARCHIVE") 2>/dev/null")"
     assert_contains "backup archive contains config.json" "$listing" "config.json"
-    assert_contains "backup archive contains .env"        "$listing" ".env"
+    assert_contains "backup archive contains .env" "$listing" ".env"
 }
 
 # On a failed run, roll the box back to the pre-test safety backup.
@@ -801,7 +1090,10 @@ safety_cleanup() {
 
 # --- Restore + summary ------------------------------------------------------
 restore_baseline() {
-    [ "$KEEP_STATE" = "1" ] && { it_warn "--keep set: leaving the box on the last scenario."; return; }
+    [ "$KEEP_STATE" = "1" ] && {
+        it_warn "--keep set: leaving the box on the last scenario."
+        return
+    }
     [ -z "$BASELINE_CONFIG" ] && return
     it_log "Restoring original config.json and re-applying…"
     push_config "$BASELINE_CONFIG"
@@ -852,7 +1144,10 @@ main() {
 
     local name rest
     if [ -n "$ONLY_SCENARIO" ]; then
-        rest="$(scenario_overrides "$ONLY_SCENARIO")" || { it_err "Unknown scenario: $ONLY_SCENARIO"; exit 2; }
+        rest="$(scenario_overrides "$ONLY_SCENARIO")" || {
+            it_err "Unknown scenario: $ONLY_SCENARIO"
+            exit 2
+        }
         run_scenario "$ONLY_SCENARIO" "$rest"
     else
         while IFS=$'\t' read -r name rest; do
@@ -865,6 +1160,7 @@ main() {
 
     [ "$RUN_LIFECYCLE" = "1" ] && run_lifecycle
     [ "$RUN_FAULTS" = "1" ] && run_fault_injection
+    [ "$RUN_AUTH_FAIL_CLOSED" = "1" ] && run_auth_fail_closed
 
     # Failure → roll the box back to the safety backup; success → leave it (restore_baseline
     # just puts config.json back to where we found it). Then drop the generated archive.
diff --git a/tests/integration/scenarios.sh b/tests/integration/scenarios.sh
index 805449ce..8d3ac504 100644
--- a/tests/integration/scenarios.sh
+++ b/tests/integration/scenarios.sh
@@ -74,7 +74,10 @@ EOF
 scenario_overrides() {
     local want="$1" name rest
     while IFS=$'\t' read -r name rest; do
-        [ "$name" = "$want" ] && { printf '%s' "$rest"; return 0; }
+        [ "$name" = "$want" ] && {
+            printf '%s' "$rest"
+            return 0
+        }
     done < <(scenario_matrix)
     return 1
 }
diff --git a/tests/integration/selftest.sh b/tests/integration/selftest.sh
index 54026711..d8603958 100755
--- a/tests/integration/selftest.sh
+++ b/tests/integration/selftest.sh
@@ -17,45 +17,60 @@ source "$HERE/scenarios.sh"
 
 echo "== overrides_to_jq: value typing =="
 assert_contains "boolean stays unquoted" "$(overrides_to_jq monero.prune=false)" '.monero.prune=false'
-assert_contains "string gets quoted"     "$(overrides_to_jq monero.mode=remote)"  '.monero.mode="remote"'
-assert_contains "integer stays unquoted"  "$(overrides_to_jq monero.remote.rpc_port=18081)" '.monero.remote.rpc_port=18081'
-assert_contains "negative int unquoted"   "$(overrides_to_jq foo=-5)" '.foo=-5'
-assert_contains "dotted ip is a string"   "$(overrides_to_jq monero.remote.host=10.0.0.5)" '.monero.remote.host="10.0.0.5"'
-assert_eq       "no overrides is identity" "$(overrides_to_jq)" '.'
-assert_eq       "empty token is skipped"   "$(overrides_to_jq '' a=1)" '. | .a=1'
+assert_contains "string gets quoted" "$(overrides_to_jq monero.mode=remote)" '.monero.mode="remote"'
+assert_contains "integer stays unquoted" "$(overrides_to_jq monero.remote.rpc_port=18081)" '.monero.remote.rpc_port=18081'
+assert_contains "negative int unquoted" "$(overrides_to_jq foo=-5)" '.foo=-5'
+assert_contains "dotted ip is a string" "$(overrides_to_jq monero.remote.host=10.0.0.5)" '.monero.remote.host="10.0.0.5"'
+assert_eq "no overrides is identity" "$(overrides_to_jq)" '.'
+assert_eq "empty token is skipped" "$(overrides_to_jq '' a=1)" '. | .a=1'
 
 echo "== resolve_overrides: prerequisite gate (never mutates the canonical chain) =="
 # Happy path: a scenario needing no alt resources resolves unchanged.
-BASELINE_PRUNE=1; PRUNED_DATA_DIR=""; FULL_DATA_DIR=""; REMOTE_MONERO_HOST=""
-resolve_overrides "monero.mode=local monero.prune=true p2pool.pool=main"; rc=$?
+BASELINE_PRUNE=1
+PRUNED_DATA_DIR=""
+FULL_DATA_DIR=""
+REMOTE_MONERO_HOST=""
+resolve_overrides "monero.mode=local monero.prune=true p2pool.pool=main"
+rc=$?
 assert_rc "no-prereq scenario resolves" "$rc" "0"
 assert_eq "RESOLVED unchanged when no prereq" "$RESOLVED" "monero.mode=local monero.prune=true p2pool.pool=main"
 # prune=false (full) on a pruned box: SKIP without a dir, augment with one — never flips the canonical DB.
-BASELINE_PRUNE=1; FULL_DATA_DIR=""
-resolve_overrides "monero.prune=false"; rc=$?
+BASELINE_PRUNE=1
+FULL_DATA_DIR=""
+resolve_overrides "monero.prune=false"
+rc=$?
 assert_rc "full-on-pruned-box skips without dir" "$rc" "1"
 assert_contains "skip names --full-data-dir" "$SKIP_REASON" "--full-data-dir"
 FULL_DATA_DIR="/srv/full"
-resolve_overrides "monero.prune=false"; rc=$?
+resolve_overrides "monero.prune=false"
+rc=$?
 assert_rc "full-on-pruned-box ok with dir" "$rc" "0"
 assert_contains "augments full data_dir" "$RESOLVED" "monero.data_dir=/srv/full"
 # prune=true (pruned) on a full box: SKIP without a dir.
-BASELINE_PRUNE=0; PRUNED_DATA_DIR=""
-resolve_overrides "monero.prune=true"; rc=$?
+BASELINE_PRUNE=0
+PRUNED_DATA_DIR=""
+resolve_overrides "monero.prune=true"
+rc=$?
 assert_rc "pruned-on-full-box skips without dir" "$rc" "1"
 assert_contains "skip names --pruned-data-dir" "$SKIP_REASON" "--pruned-data-dir"
 # remote mode: SKIP without an endpoint, augment with one.
-BASELINE_PRUNE=1; REMOTE_MONERO_HOST=""
-resolve_overrides "monero.mode=remote"; rc=$?
+BASELINE_PRUNE=1
+REMOTE_MONERO_HOST=""
+resolve_overrides "monero.mode=remote"
+rc=$?
 assert_rc "remote skips without endpoint" "$rc" "1"
 assert_contains "skip names --remote-monero-host" "$SKIP_REASON" "--remote-monero-host"
 REMOTE_MONERO_HOST="10.0.0.5:18081"
-resolve_overrides "monero.mode=remote"; rc=$?
+resolve_overrides "monero.mode=remote"
+rc=$?
 assert_rc "remote ok with endpoint" "$rc" "0"
 assert_contains "augments remote host" "$RESOLVED" "monero.remote.host=10.0.0.5:18081"
 # Compound prerequisites both augment.
-BASELINE_PRUNE=1; FULL_DATA_DIR="/srv/full"; REMOTE_MONERO_HOST="10.0.0.5:18081"
-resolve_overrides "monero.mode=remote monero.prune=false"; rc=$?
+BASELINE_PRUNE=1
+FULL_DATA_DIR="/srv/full"
+REMOTE_MONERO_HOST="10.0.0.5:18081"
+resolve_overrides "monero.mode=remote monero.prune=false"
+rc=$?
 assert_rc "compound prereqs resolve" "$rc" "0"
 assert_contains "compound: data_dir" "$RESOLVED" "monero.data_dir=/srv/full"
 assert_contains "compound: remote host" "$RESOLVED" "monero.remote.host=10.0.0.5:18081"
@@ -65,9 +80,9 @@ echo "== render_scenario_config: applies overrides, stays valid JSON =="
 BASE='{"monero":{"mode":"local","prune":true,"wallet_address":"49keep"},"p2pool":{"pool":"main"}}'
 RENDERED="$(render_scenario_config "$BASE" monero.mode=remote monero.prune=false p2pool.pool=mini)"
 printf '%s' "$RENDERED" | jq empty 2>/dev/null && it_pass "rendered config is valid JSON" || it_fail "rendered config is valid JSON" "jq rejected it"
-assert_eq "override: mode"   "$(jq_get "$RENDERED" '.monero.mode')"  "remote"
-assert_eq "override: prune"  "$(jq_get "$RENDERED" '.monero.prune')" "false"
-assert_eq "override: pool"   "$(jq_get "$RENDERED" '.p2pool.pool')"  "mini"
+assert_eq "override: mode" "$(jq_get "$RENDERED" '.monero.mode')" "remote"
+assert_eq "override: prune" "$(jq_get "$RENDERED" '.monero.prune')" "false"
+assert_eq "override: pool" "$(jq_get "$RENDERED" '.p2pool.pool')" "mini"
 assert_eq "preserved: wallet" "$(jq_get "$RENDERED" '.monero.wallet_address')" "49keep"
 
 echo "== clearnet initial sync overrides + matrix (#183) =="
@@ -76,36 +91,36 @@ echo "== clearnet initial sync overrides + matrix (#183) =="
 CN="$(render_scenario_config "$BASE" monero.clearnet_initial_sync=true tari.clearnet_initial_sync=true)"
 printf '%s' "$CN" | jq empty 2>/dev/null && it_pass "clearnet config is valid JSON" || it_fail "clearnet config is valid JSON" "jq rejected it"
 assert_eq "monero clearnet renders boolean true" "$(jq_get "$CN" '.monero.clearnet_initial_sync')" "true"
-assert_eq "tari clearnet renders boolean true"   "$(jq_get "$CN" '.tari.clearnet_initial_sync')" "true"
+assert_eq "tari clearnet renders boolean true" "$(jq_get "$CN" '.tari.clearnet_initial_sync')" "true"
 assert_eq "clearnet absent in baseline (default off)" "$(jq_get "$BASE" '.monero.clearnet_initial_sync')" ""
 # The matrix carries a dedicated clearnet scenario so the live suite exercises the on-state on a box.
 assert_contains "matrix has a clearnet scenario" "$(scenario_names)" "local-pruned-main-clearnet-sync"
 assert_contains "clearnet scenario enables monero" "$(scenario_overrides local-pruned-main-clearnet-sync)" "monero.clearnet_initial_sync=true"
-assert_contains "clearnet scenario enables tari"   "$(scenario_overrides local-pruned-main-clearnet-sync)" "tari.clearnet_initial_sync=true"
+assert_contains "clearnet scenario enables tari" "$(scenario_overrides local-pruned-main-clearnet-sync)" "tari.clearnet_initial_sync=true"
 
 echo "== expected/absent services: profile gating =="
 LOCAL='{"monero":{"mode":"local"}}'
 REMOTE='{"monero":{"mode":"remote"}}'
-assert_contains "local includes monerod"  "$(expected_services "$LOCAL")"  "monerod"
-assert_contains "local includes p2pool"   "$(expected_services "$LOCAL")"  "p2pool"
+assert_contains "local includes monerod" "$(expected_services "$LOCAL")" "monerod"
+assert_contains "local includes p2pool" "$(expected_services "$LOCAL")" "p2pool"
 case "$(expected_services "$REMOTE")" in *monerod*) it_fail "remote excludes monerod" "monerod present" ;; *) it_pass "remote excludes monerod" ;; esac
-assert_eq "remote marks monerod absent"   "$(absent_services "$REMOTE")" "monerod"
-assert_eq "local marks nothing absent"    "$(absent_services "$LOCAL")" ""
-assert_eq "pool_label main"  "$(pool_label main)" "Main"
-assert_eq "pool_label mini"  "$(pool_label mini)" "Mini"
-assert_eq "pool_label nano"  "$(pool_label nano)" "Nano"
+assert_eq "remote marks monerod absent" "$(absent_services "$REMOTE")" "monerod"
+assert_eq "local marks nothing absent" "$(absent_services "$LOCAL")" ""
+assert_eq "pool_label main" "$(pool_label main)" "Main"
+assert_eq "pool_label mini" "$(pool_label mini)" "Mini"
+assert_eq "pool_label nano" "$(pool_label nano)" "Nano"
 assert_eq "pool_label unknown passes through" "$(pool_label custom)" "custom"
 
 echo "== redact: secrets never leak into artifacts =="
 ONION="$(printf 'a%.0s' $(seq 1 56)).onion"
 SECRETS="$(printf 'PROXY_AUTH_TOKEN=deadbeefcafe\nMONERO_NODE_PASSWORD=hunter2\nMONERO_RPC_PASSWORD=p\nBACKUP_SECRET=s3kr3t\nMONERO_ONION_ADDRESS=%s\nHOST_IP=box.lan\n' "$ONION")"
 REDACTED="$(printf '%s' "$SECRETS" | redact)"
-assert_contains "token redacted"      "$REDACTED" "PROXY_AUTH_TOKEN=<redacted>"
-assert_contains "password redacted"   "$REDACTED" "MONERO_NODE_PASSWORD=<redacted>"
+assert_contains "token redacted" "$REDACTED" "PROXY_AUTH_TOKEN=<redacted>"
+assert_contains "password redacted" "$REDACTED" "MONERO_NODE_PASSWORD=<redacted>"
 assert_contains "*_PASSWORD redacted" "$REDACTED" "MONERO_RPC_PASSWORD=<redacted>"
-assert_contains "*_SECRET redacted"   "$REDACTED" "BACKUP_SECRET=<redacted>"
-assert_contains "onion redacted"      "$REDACTED" "<redacted>.onion"
-assert_contains "non-secret kept"     "$REDACTED" "HOST_IP=box.lan"
+assert_contains "*_SECRET redacted" "$REDACTED" "BACKUP_SECRET=<redacted>"
+assert_contains "onion redacted" "$REDACTED" "<redacted>.onion"
+assert_contains "non-secret kept" "$REDACTED" "HOST_IP=box.lan"
 case "$REDACTED" in *deadbeefcafe*) it_fail "raw token absent" "token leaked" ;; *) it_pass "raw token absent" ;; esac
 case "$REDACTED" in *s3kr3t*) it_fail "raw secret absent" "secret leaked" ;; *) it_pass "raw secret absent" ;; esac
 
@@ -114,8 +129,8 @@ CORPUS="$(scenario_matrix | cut -f2 | tr '\n' ' ')"
 while IFS= read -r val; do
     [ -z "$val" ] && continue
     case " $CORPUS " in
-        *" $val "*) it_pass "axis covered: $val" ;;
-        *)          it_fail "axis covered: $val" "no scenario sets $val" ;;
+    *" $val "*) it_pass "axis covered: $val" ;;
+    *) it_fail "axis covered: $val" "no scenario sets $val" ;;
     esac
 done < <(axis_coverage)
 
@@ -124,16 +139,19 @@ assert_ne "scenario_names is non-empty" "$(scenario_names | head -n1)" ""
 assert_eq "scenario count matches matrix" "$(scenario_names | grep -c .)" "$(scenario_matrix | grep -c .)"
 assert_contains "overrides lookup works" "$(scenario_overrides remote-main-secure-tari)" "monero.mode=remote"
 # An unknown scenario name must fail (return 1) and print nothing — never silently resolve.
-miss="$(scenario_overrides no-such-scenario)"; rc=$?
+miss="$(scenario_overrides no-such-scenario)"
+rc=$?
 assert_rc "unknown scenario returns 1" "$rc" "1"
 assert_eq "unknown scenario prints nothing" "$miss" ""
 
 echo "== rx: local exec runs in the stack dir =="
-TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
-printf 'marker' > "$TMP/sentinel"
-IT_MODE="local"; IT_REMOTE_DIR="$TMP"
+TMP="$(mktemp -d)"
+trap 'rm -rf "$TMP"' EXIT
+printf 'marker' >"$TMP/sentinel"
+IT_MODE="local"
+IT_REMOTE_DIR="$TMP"
 assert_eq "rx runs command on target" "$(rx 'cat sentinel')" "marker"
-assert_eq "rx cwd is the stack dir"   "$(rx 'pwd')" "$TMP"
+assert_eq "rx cwd is the stack dir" "$(rx 'pwd')" "$TMP"
 
 echo "== api_state + jq_get: parse a fixture =="
 # Stub rx so api_state returns a representative /api/state payload.
@@ -141,14 +159,14 @@ FIXTURE='{"sync":{"monero":{"state":"done"},"tari":{"state":"done"}},"monero":{"
 rx() { printf '%s' "$FIXTURE"; }
 ST="$(api_state)"
 assert_eq "parse monero sync state" "$(jq_get "$ST" '.sync.monero.state')" "done"
-assert_eq "parse pool type"         "$(jq_get "$ST" '.pool.type')" "Main"
-assert_eq "parse worker count"      "$(jq_get "$ST" '.proxy_workers')" "2"
-assert_eq "missing key -> empty"    "$(jq_get "$ST" '.nope.nope')" ""
+assert_eq "parse pool type" "$(jq_get "$ST" '.pool.type')" "Main"
+assert_eq "parse worker count" "$(jq_get "$ST" '.proxy_workers')" "2"
+assert_eq "missing key -> empty" "$(jq_get "$ST" '.nope.nope')" ""
 
 echo "== _pred_tari_synced: gates on .sync.tari.state =="
 # rx is still stubbed to FIXTURE above (sync.tari.state == "done").
 if _pred_tari_synced; then it_pass "_pred_tari_synced true when tari done"; else it_fail "_pred_tari_synced true when tari done" "returned non-zero on done"; fi
-# A still-loading Tari must hold the gate (this is the gouda regression: asserting cold caught it here).
+# A still-loading Tari must hold the gate (this regression was caught by live validation: asserting cold caught it here).
 FIXTURE='{"sync":{"monero":{"state":"done"},"tari":{"state":"loading"}}}'
 if _pred_tari_synced; then it_fail "_pred_tari_synced false when tari loading" "passed on loading"; else it_pass "_pred_tari_synced false when tari loading"; fi
 FIXTURE='{"sync":{"monero":{"state":"done"},"tari":{"state":"done"}},"monero":{"mode":"Pruned"},"pool":{"type":"Main"},"proxy_workers":2,"stratum":{"conns":2,"total_hashes":12345}}'
@@ -165,14 +183,14 @@ FIXTURE='{"sync":{"monero":{"state":"done"},"tari":{"state":"done"}},"monero":{"
 echo "== _pred_pool_ready: gates on .pool.type matching expected =="
 if _pred_pool_ready "Main"; then it_pass "_pred_pool_ready true when pool matches"; else it_fail "_pred_pool_ready true when pool matches" "returned non-zero on Main==Main"; fi
 if _pred_pool_ready "Mini"; then it_fail "_pred_pool_ready false when pool differs" "passed on Main!=Mini"; else it_pass "_pred_pool_ready false when pool differs"; fi
-# "Unknown" right after a pool switch must hold the gate (the gouda regression caught here).
+# "Unknown" right after a pool switch must hold the gate (the live-validation regression caught here).
 FIXTURE='{"pool":{"type":"Unknown"}}'
 if _pred_pool_ready "Main"; then it_fail "_pred_pool_ready false when pool Unknown" "passed on Unknown"; else it_pass "_pred_pool_ready false when pool Unknown"; fi
 FIXTURE='{"sync":{"monero":{"state":"done"},"tari":{"state":"done"}},"monero":{"mode":"Pruned"},"pool":{"type":"Main"},"proxy_workers":2,"stratum":{"conns":2,"total_hashes":12345}}'
 
 echo "== _pred_hashes_flowing: gates on stratum.total_hashes > 0 =="
 if _pred_hashes_flowing; then it_pass "_pred_hashes_flowing true when hashes>0"; else it_fail "_pred_hashes_flowing true when hashes>0" "returned non-zero on 12345"; fi
-# total_hashes resets to 0 on a p2pool restart; the gate must hold there (the gouda regression).
+# total_hashes resets to 0 on a p2pool restart; the gate must hold there (the live-validation regression).
 FIXTURE='{"stratum":{"conns":0,"total_hashes":0}}'
 if _pred_hashes_flowing; then it_fail "_pred_hashes_flowing false when hashes==0" "passed on 0"; else it_pass "_pred_hashes_flowing false when hashes==0"; fi
 FIXTURE='{"sync":{"monero":{"state":"done"},"tari":{"state":"done"}},"monero":{"mode":"Pruned"},"pool":{"type":"Main"},"proxy_workers":2,"stratum":{"conns":2,"total_hashes":12345}}'
@@ -182,7 +200,7 @@ echo "== dispatch loop: a stdin-draining child must not skip iterations =="
 # drains the loop and silently runs only the first scenario. The guard is `</dev/null` on the
 # child (plus `ssh -n` in rx). Verify the technique keeps every iteration alive.
 _seen=0
-_drainer() { cat >/dev/null 2>&1 || true; }   # stands in for ssh inheriting + draining stdin
+_drainer() { cat >/dev/null 2>&1 || true; } # stands in for ssh inheriting + draining stdin
 while IFS= read -r _l; do
     [ -z "$_l" ] && continue
     _seen=$((_seen + 1))
@@ -191,14 +209,15 @@ done < <(printf 'one\ntwo\nthree\n')
 assert_eq "loop visits every line with </dev/null guard" "$_seen" "3"
 
 echo "== service_state parsing (fault-injection predicates) =="
-assert_eq "state of 'running healthy'"  "$(svc_state_of 'running healthy')"  "running"
+assert_eq "state of 'running healthy'" "$(svc_state_of 'running healthy')" "running"
 assert_eq "health of 'running healthy'" "$(svc_health_of 'running healthy')" "healthy"
-assert_eq "state of 'missing none'"     "$(svc_state_of 'missing none')"     "missing"
+assert_eq "state of 'missing none'" "$(svc_state_of 'missing none')" "missing"
 assert_eq "health of 'running unhealthy'" "$(svc_health_of 'running unhealthy')" "unhealthy"
-assert_eq "state of 'exited none'"      "$(svc_state_of 'exited none')"      "exited"
+assert_eq "state of 'exited none'" "$(svc_state_of 'exited none')" "exited"
 
 echo "== assertion helpers: counters behave =="
-_p="$IT_PASS"; _f="$IT_FAIL"
+_p="$IT_PASS"
+_f="$IT_FAIL"
 assert_num_ge "num_ge passes when equal" 5 5
 assert_num_gt "num_gt passes when greater" 6 5
 [ "$IT_PASS" -gt "$_p" ] && it_pass "passing assertions increment IT_PASS" || it_fail "passing assertions increment IT_PASS" "no increment"
diff --git a/tests/integration/system-info.sh b/tests/integration/system-info.sh
index 8b65430f..3d3cd3ec 100644
--- a/tests/integration/system-info.sh
+++ b/tests/integration/system-info.sh
@@ -10,8 +10,12 @@ set -uo pipefail
 
 STACK_DIR="${STACK_DIR:-$HOME/code/pithead}"
 
-h()    { printf '\n## %s\n\n' "$1"; }
-fence(){ printf '```\n'; cat; printf '```\n'; }
+h() { printf '\n## %s\n\n' "$1"; }
+fence() {
+    printf '```\n'
+    cat
+    printf '```\n'
+}
 
 printf '# Pithead build server — system snapshot\n\n'
 printf '_Host `%s` — generated %s_\n' "$(hostname)" "$(date '+%Y-%m-%d %H:%M:%S %z')"
@@ -64,6 +68,9 @@ h "monerod version"
 docker exec monerod monerod --version 2>/dev/null | head -1 | fence
 
 h "Listening sockets — dashboard :8000 must be 127.0.0.1"
-{ PATH="/usr/sbin:/sbin:$PATH"; ss -tlnH 2>/dev/null | awk '{print $4}' | grep -E ':(8000|3333|18081|18083|37889|3344)$' | sort -u || echo "(ss not available)"; } | fence
+{
+    PATH="/usr/sbin:/sbin:$PATH"
+    ss -tlnH 2>/dev/null | awk '{print $4}' | grep -E ':(8000|3333|18081|18083|37889|3344)$' | sort -u || echo "(ss not available)"
+} | fence
 
 printf '\n---\n_See `README.md` in this directory for how to run the stack and the test harness._\n'
diff --git a/tests/integration/testbench-README.md b/tests/integration/testbench-README.md
new file mode 100644
index 00000000..c40153e0
--- /dev/null
+++ b/tests/integration/testbench-README.md
@@ -0,0 +1,118 @@
+# Pithead reference build & test server
+
+A dev and test box that runs the live Pithead stack (Monero node + P2Pool + Tari merge-mining +
+dashboard) against real, synced chains, and serves as the Tier-4 release gate: changes are
+validated end-to-end here before release. This guide covers how to provision and run your own;
+substitute your own host, user, and paths throughout. The examples assume the host is reachable
+over SSH as `$BENCH_HOST`.
+
+See `docs/test-server-architecture.md` for the full architecture and how to stand a box up from
+scratch.
+
+## ⚠️ Golden rules
+
+This is a test bench, not a production miner — downtime and teardown/redeploy are fine. The
+constraints that matter:
+
+1. **Never lose the synced chains.** They are the only slow-to-acquire asset (days to re-sync), so
+   reuse them. Keep them in a data directory decoupled from the checkout (e.g. a sibling
+   `pithead-data/` dir) so you can refresh or redeploy the stack without touching them.
+2. **Chains on fast storage, OS on its own disk.** Put the chains on an NVMe SSD — monerod's LMDB
+   is random-read heavy, so it opens a multi-hundred-GB database in seconds there and crawls on a
+   slow SATA SSD or HDD. Mount the chain volume by UUID with `noatime` and `nofail`. Keep the OS
+   and Docker on a separate disk so a chain-volume problem can't take the box down.
+3. **Least privilege.** Keep `sudo` password-protected and interactive — don't leave passwordless
+   grants lying around. Almost nothing here needs sudo if your user is in the `docker` group.
+4. **Secrets stay put.** `.env` (RPC creds) and `config.json` (wallet addresses) are owner-only.
+   Never print, copy, or commit them.
+
+## Where things are
+
+A workable layout (adjust to taste):
+
+| Path | What |
+|---|---|
+| `<checkout>/` (e.g. `/srv/code/pithead`) | the stack checkout: `docker-compose.yml`, the `pithead` CLI, your `config.json`/`.env` |
+| `<data-dir>/{monero,tari,p2pool,dashboard,tor}/` (e.g. `/srv/code/pithead-data`) | the chains — the asset, on the NVMe, decoupled from the checkout |
+| `<tools-dir>/` | build-server docs and chain-ops tools (the `*.sh` helpers are also versioned in the repo under `tests/integration/`) |
+| `<tools-dir>/bin/monero-blockchain-prune` | the verified offline Monero tool, version-matched to monerod |
+
+## The chains
+
+- **Monero is pruned** (`MONERO_PRUNE=1`) and compacted to its true size (~95 GiB). If it ever
+  reads back up near ~250 GiB, that is LMDB free-page bloat from an in-place prune, not a full
+  chain — compact it (below). The generic `mdb_copy` cannot read Monero's patched LMDB
+  (`MDB_VERSION_MISMATCH`); only `monero-blockchain-prune` works.
+- **Tari is archival/full** (~132 GiB, no pruning configured). That size is genuine data, not
+  bloat, so there is nothing to compact. Shrinking it would mean pruning Tari (a config change plus
+  re-sync), which is a product decision, not housekeeping.
+
+**Compacting the Monero chain** (reclaim bloat; takes hours, but no downtime until the swap):
+
+```bash
+tests/integration/compact-chain.sh <data-dir>/monero   # builds lmdb-pruned/ (monerod stays up)
+# when DONE, swap it in (brief downtime):
+docker stop monerod
+cd <data-dir>/monero && mv lmdb lmdb.bloated && mv lmdb-pruned lmdb
+docker start monerod        # re-syncs the few blocks added during the copy
+# confirm `pithead status` healthy, then: rm -rf lmdb.bloated
+```
+
+## Running the stack
+
+```bash
+cd <checkout>
+./pithead status         # health summary
+./pithead doctor         # deeper diagnostics
+./pithead up | down | apply | backup
+```
+
+## Running the test harness (the point of this box)
+
+Tiers 1–3 run anywhere with no real chains; Tier 4 (the live matrix) runs here.
+
+```bash
+# Drive the test bench over SSH from a dev checkout (start non-destructive):
+tests/integration/run.sh --host "$BENCH_HOST" --dir <checkout> --check       # assert current live state
+tests/integration/run.sh --host "$BENCH_HOST" --dir <checkout> --readiness   # is the box fit to gate a release?
+# Full destructive config matrix, with a pithead backup + auto-rollback on failure:
+tests/integration/run.sh --host "$BENCH_HOST" --dir <checkout> --safety-backup
+# On the box itself:
+cd <checkout> && tests/integration/run.sh --local --dir "$PWD" --lifecycle
+```
+
+Always start with `--check`/`--readiness`. Use `--safety-backup` for the destructive matrix so a
+failure rolls the box back (down → restore → up). See `docs/integration-testing.md`.
+
+## End-to-end coverage: validated live vs. gaps
+
+**Validated live (Tier 4):** the config matrix (remote/local node, dashboard secure/insecure, Tari
+required/optional, RPC LAN access, XvB on/off) applied and asserted on real synced chains;
+lifecycle (restart, secret-preserving `apply`, backup→restore round-trip); node-down failover and
+recovery; release readiness; pruned monerod (the common production config).
+
+**Covered without a real chain:** client↔daemon contract tests, the fake-daemon mini-stack
+(including full-prune behavior), compose hardening, config rendering, dashboard unit/frontend tests.
+
+| # | Gap (not tested live) | Worth filling before release? |
+|---|---|---|
+| 1 | Full (unpruned) Monero mode live — a pruned bench can't cover it | Low. Stack code paths don't differ by prune mode (it's monerod-internal); fakes/config cover it. A multi-day full sync isn't justified. |
+| 2 | Privacy / Tor egress — clearnet-leak assertions in the live harness (issue #160) | High. Privacy is a core promise. Assert no clearnet to XvB stats, p2pool, or Tari DNS. |
+| 3 | Automated PR gate — a self-hosted runner is manual/opt-in | Medium-high, high-impact. Wire the live harness as a required check on `workflow_dispatch`/push-to-`main` only (never fork PRs). |
+| 4 | Upgrade / migration across image versions with chain continuity | Medium. Real users upgrade. Add a scenario: pull new images → `apply` → assert chain continuity, no re-sync, secrets intact. |
+| 5 | XvB live routing end-to-end (the raffle optimization) | Medium. Core value-prop, but unit/sim-tested today. A periodic live XvB smoke test would help; hard to assert deterministically. |
+| 6 | Multi-worker scale — the harness assumes ~2 workers | Medium. For perf confidence add a load-gen worker and assert proxy routing/hashrate. Not a blocker. |
+| 7 | Real Tari merge-mined block acceptance | Low. Finding a block is probabilistic; rely on template/connectivity checks. |
+| 8 | Fault injection over SSH (currently local-mode only) | Low-Medium. Extend the SIGSTOP/remove fault cases to the `--host` path. |
+
+**Recommended before release:** #2 (privacy egress) and #3 (automated PR gate); then #4 (upgrade)
+and #5 (XvB smoke). The rest are nice-to-have.
+
+## Notes for AI agents
+
+- SSH from a sandboxed agent needs the LAN allowance (e.g. `dangerouslyDisableSandbox`) when the
+  test bench is on the LAN.
+- Avoid literal `( )` in remote command strings — they break the non-interactive remote shell.
+- `pkill -f <pattern>` self-matches your own command line — kill by PID, or use the `[x]`-bracket trick.
+- Don't stop monerod without reason; check `docker ps` health first and narrate any downtime.
+- Long jobs: launch detached (`nohup … &`) and poll a status file; SSH sessions drop.
diff --git a/tests/inventory.sh b/tests/inventory.sh
index d80fb869..0f560456 100755
--- a/tests/inventory.sh
+++ b/tests/inventory.sh
@@ -13,8 +13,8 @@ cd "$ROOT" || exit 1
 
 # Test functions (def test_… / async def test_…) in a python file, in source order.
 py_tests() {
-    grep -E '^[[:space:]]*(async[[:space:]]+)?def test_' "$1" 2>/dev/null \
-        | sed -E 's/^[[:space:]]*(async[[:space:]]+)?def (test_[A-Za-z0-9_]+).*/\2/'
+    grep -E '^[[:space:]]*(async[[:space:]]+)?def test_' "$1" 2>/dev/null |
+        sed -E 's/^[[:space:]]*(async[[:space:]]+)?def (test_[A-Za-z0-9_]+).*/\2/'
 }
 # test('name' | test("name") cases in a node test file.
 node_tests() { grep -oE "test\((['\"])[^'\"]+\1" "$1" 2>/dev/null | sed -E "s/^test\(['\"]//; s/['\"]$//"; }
@@ -114,8 +114,8 @@ cat <<EOF
 
 ### tests/integration/mini-stack/run-mini-stack.sh — ${n_mini} scenarios
 EOF
-grep -oE 'log "scenario [0-9]+: [^"]+"' tests/integration/mini-stack/run-mini-stack.sh \
-    | sed -E 's/^log "//; s/"$//' | bullets
+grep -oE 'log "scenario [0-9]+: [^"]+"' tests/integration/mini-stack/run-mini-stack.sh |
+    sed -E 's/^log "//; s/"$//' | bullets
 
 cat <<EOF
 
@@ -123,8 +123,8 @@ cat <<EOF
 
 ### Config scenarios (tests/integration/scenarios.sh) — ${n_scen}
 EOF
-sed -n '/scenario_matrix() {/,/^EOF/p' tests/integration/scenarios.sh \
-    | grep -E $'\t' | awk -F'\t' '{print $1}' | bullets
+sed -n '/scenario_matrix() {/,/^EOF/p' tests/integration/scenarios.sh |
+    grep -E $'\t' | awk -F'\t' '{print $1}' | bullets
 
 cat <<EOF
 
@@ -136,9 +136,9 @@ cat <<EOF
 
 ### Per-scenario assertions (tests/integration/run.sh)
 EOF
-grep -hoE '(assert_[a-z_]+|it_pass) "[^"]+"' tests/integration/run.sh \
-    | sed -E 's/^(assert_[a-z_]+|it_pass) "//; s/"$//' \
-    | grep -vE '^\$[A-Za-z_]+$' | sort -u | bullets
+grep -hoE '(assert_[a-z_]+|it_pass) "[^"]+"' tests/integration/run.sh |
+    sed -E 's/^(assert_[a-z_]+|it_pass) "//; s/"$//' |
+    grep -vE '^\$[A-Za-z_]+$' | sort -u | bullets
 
 cat <<EOF
 
diff --git a/tests/stack/run.sh b/tests/stack/run.sh
index 56def022..2ba692a7 100755
--- a/tests/stack/run.sh
+++ b/tests/stack/run.sh
@@ -11,19 +11,32 @@ STACK="$ROOT/pithead"
 PASS=0
 FAIL=0
 
-ok()  { PASS=$((PASS + 1)); printf '  \033[1;32m✓\033[0m %s\n' "$1"; }
-bad() { FAIL=$((FAIL + 1)); printf '  \033[1;31m✗\033[0m %s\n      %s\n' "$1" "$2"; }
+ok() {
+    PASS=$((PASS + 1))
+    printf '  \033[1;32m✓\033[0m %s\n' "$1"
+}
+bad() {
+    FAIL=$((FAIL + 1))
+    printf '  \033[1;31m✗\033[0m %s\n      %s\n' "$1" "$2"
+}
 
-assert_eq()       { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "expected [$3], got [$2]"; fi; }
-assert_contains() { case "$2" in *"$3"*) ok "$1" ;; *) bad "$1" "[$2] missing [$3]" ;; esac; }
-assert_rc()       { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "expected rc $3, got $2"; fi; }
+assert_eq() { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "expected [$3], got [$2]"; fi; }
+assert_contains() { case "$2" in *"$3"*) ok "$1" ;; *) bad "$1" "[$2] missing [$3]" ;; esac }
+assert_not_contains() { case "$2" in *"$3"*) bad "$1" "[$2] unexpectedly contains [$3]" ;; *) ok "$1" ;; esac }
+assert_rc() { if [ "$2" = "$3" ]; then ok "$1"; else bad "$1" "expected rc $3, got $2"; fi; }
 
 # Run a command with pithead sourced (functions available, no cd/main side effects),
 # from a given working directory. Usage: run_sourced <dir> <cmd> [args...]
 # shellcheck disable=SC1090  # STACK path is dynamic by design
 run_sourced() {
-    local dir="$1"; shift
-    ( cd "$dir" || return; source "$STACK"; set +e; "$@" )
+    local dir="$1"
+    shift
+    (
+        cd "$dir" || return
+        source "$STACK"
+        set +e
+        "$@"
+    )
 }
 
 # A throwaway sandbox dir, cleaned on exit.
@@ -34,7 +47,7 @@ trap 'rm -rf "$SANDBOX"' EXIT
 make_stubs() {
     local bin="$1"
     mkdir -p "$bin"
-    cat > "$bin/docker" <<'EOF'
+    cat >"$bin/docker" <<'EOF'
 #!/usr/bin/env bash
 echo "[docker] $*" >> "${DOCKER_LOG:-/dev/null}"
 case "$*" in
@@ -43,6 +56,7 @@ case "$*" in
   "exec tor cat /var/lib/tor/monero/hostname") echo "mona.onion" ;;
   "exec tor cat /var/lib/tor/tari/hostname")   echo "taria.onion" ;;
   "exec tor cat /var/lib/tor/p2pool/hostname") echo "p2pa.onion" ;;
+  "exec p2pool cat /proc/1/cmdline") printf '%s' "${P2POOL_PROC1:-}" ;;  # #273: tests set the running p2pool argv
   *hash-password*)
     # Fake `caddy hash-password` (#8): a per-password digest so enable/change paths differ, and it
     # never echoes the plaintext back (real bcrypt doesn't either) — keeps the leak checks honest.
@@ -52,59 +66,138 @@ case "$*" in
 esac
 exit 0
 EOF
-    printf '#!/usr/bin/env bash\nexit 0\n' > "$bin/sudo"
+    printf '#!/usr/bin/env bash\nexit 0\n' >"$bin/sudo"
     chmod +x "$bin/docker" "$bin/sudo"
 }
 
 # ---------------------------------------------------------------------------
 echo "== unit: resolve_default =="
-assert_eq "auto -> default"        "$(run_sourced "$SANDBOX" resolve_default auto /def)"          "/def"
-assert_eq "empty -> default"       "$(run_sourced "$SANDBOX" resolve_default '' /def)"            "/def"
+assert_eq "auto -> default" "$(run_sourced "$SANDBOX" resolve_default auto /def)" "/def"
+assert_eq "empty -> default" "$(run_sourced "$SANDBOX" resolve_default '' /def)" "/def"
 assert_eq "DYNAMIC_DATA -> default" "$(run_sourced "$SANDBOX" resolve_default DYNAMIC_DATA /def)" "/def"
-assert_eq "custom kept"            "$(run_sourced "$SANDBOX" resolve_default /my/dir /def)"        "/my/dir"
+assert_eq "custom kept" "$(run_sourced "$SANDBOX" resolve_default /my/dir /def)" "/my/dir"
 
 echo "== unit: assert_safe_dir =="
-run_sourced "$SANDBOX" assert_safe_dir "/"       >/dev/null 2>&1; assert_rc "rejects /"        "$?" "1"
-run_sourced "$SANDBOX" assert_safe_dir "/home"   >/dev/null 2>&1; assert_rc "rejects /home"    "$?" "1"
-run_sourced "$SANDBOX" assert_safe_dir ""        >/dev/null 2>&1; assert_rc "rejects empty"    "$?" "1"
-run_sourced "$SANDBOX" assert_safe_dir "/srv/p2pool/data" >/dev/null 2>&1; assert_rc "allows real dir" "$?" "0"
+run_sourced "$SANDBOX" assert_safe_dir "/" >/dev/null 2>&1
+assert_rc "rejects /" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "/home" >/dev/null 2>&1
+assert_rc "rejects /home" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "" >/dev/null 2>&1
+assert_rc "rejects empty" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "/srv/p2pool/data" >/dev/null 2>&1
+assert_rc "allows real dir" "$?" "0"
+# Tightened guard (#91): bare mount/parent roots, non-absolute paths and '..' traversal are refused;
+# a dedicated subfolder of a mount root is still fine.
+run_sourced "$SANDBOX" assert_safe_dir "/srv" >/dev/null 2>&1
+assert_rc "rejects bare /srv" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "/mnt" >/dev/null 2>&1
+assert_rc "rejects bare /mnt" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "relative/data" >/dev/null 2>&1
+assert_rc "rejects relative path" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "/srv/../etc/data" >/dev/null 2>&1
+assert_rc "rejects .. traversal" "$?" "1"
+run_sourced "$SANDBOX" assert_safe_dir "/mnt/disk/monero" >/dev/null 2>&1
+assert_rc "allows mount subfolder" "$?" "0"
 
 echo "== unit: is_public_ip classifier (#113) =="
 # Globally-routable -> rc 0 (public). Includes boundaries just OUTSIDE each excluded range.
 for ip in 8.8.8.8 1.1.1.1 172.15.0.1 172.32.0.1 100.128.0.1 169.1.1.1 2606:4700:4700::1111 2001:db8::1; do
-    run_sourced "$SANDBOX" is_public_ip "$ip" >/dev/null 2>&1; assert_rc "public: $ip" "$?" "0"
+    run_sourced "$SANDBOX" is_public_ip "$ip" >/dev/null 2>&1
+    assert_rc "public: $ip" "$?" "0"
 done
 # Private / loopback / link-local / CGNAT / ULA / multicast / unspecified / garbage -> rc 1.
 for ip in 10.0.0.5 172.16.0.1 172.31.255.1 192.168.1.50 127.0.0.1 169.254.1.1 100.64.0.1 0.0.0.0 \
-          ::1 fe80::1 fc00::1 fd12:3456::1 ff02::1 999.1.1.1 not-an-ip ""; do
-    run_sourced "$SANDBOX" is_public_ip "$ip" >/dev/null 2>&1; assert_rc "non-public: ${ip:-<empty>}" "$?" "1"
+    ::1 fe80::1 fc00::1 fd12:3456::1 ff02::1 999.1.1.1 not-an-ip ""; do
+    run_sourced "$SANDBOX" is_public_ip "$ip" >/dev/null 2>&1
+    assert_rc "non-public: ${ip:-<empty>}" "$?" "1"
 done
 
+echo "== unit: check_stratum_exposure warning (#113/#206) =="
+# The classifier above is unit-tested; this exercises the WARNING COMPOSITION that uses it —
+# the bind × public-IP × mode matrix that #206 wanted live-validated. We shadow `ip` with a stub
+# emitting canned `ip -o addr show` lines, so the host's real interfaces never decide the outcome.
+# STRATUM_BIND is read straight from the env when set, so no .env is needed.
+IPBIN="$SANDBOX/ipbin"
+mkdir -p "$IPBIN"
+make_ip_stub() { # $1 = body for `ip -o addr show`
+    {
+        printf '#!/usr/bin/env bash\n'
+        printf 'cat <<'\''ADDRS'\''\n%s\nADDRS\n' "$1"
+    } >"$IPBIN/ip"
+    chmod +x "$IPBIN/ip"
+}
+PUBLIC_IFACE='2: eth0    inet 8.8.8.8/24 scope global eth0'
+PRIVATE_IFACE='1: lo    inet 127.0.0.1/8 scope host lo
+2: eth0    inet 192.168.1.5/24 scope global eth0'
+
+# Exposed: a public IP on an interface AND stratum on the default all-interfaces bind -> warn.
+make_ip_stub "$PUBLIC_IFACE"
+out="$(STRATUM_BIND=0.0.0.0 PATH="$IPBIN:$PATH" run_sourced "$SANDBOX" check_stratum_exposure setup 2>&1)"
+assert_contains "setup warns: public IP + 0.0.0.0 bind" "$out" "public IP"
+out="$(STRATUM_BIND=0.0.0.0 PATH="$IPBIN:$PATH" run_sourced "$SANDBOX" check_stratum_exposure doctor 2>&1)"
+assert_contains "doctor WARNs: public IP + 0.0.0.0 bind" "$out" "WARN"
+
+# No public IP on any interface -> quiet in setup; an explicit OK in doctor.
+make_ip_stub "$PRIVATE_IFACE"
+out="$(STRATUM_BIND=0.0.0.0 PATH="$IPBIN:$PATH" run_sourced "$SANDBOX" check_stratum_exposure setup 2>&1)"
+assert_eq "setup is quiet: no public IP" "$out" ""
+out="$(STRATUM_BIND=0.0.0.0 PATH="$IPBIN:$PATH" run_sourced "$SANDBOX" check_stratum_exposure doctor 2>&1)"
+assert_contains "doctor OK: no public IP" "$out" "No public IP"
+
+# Narrowed bind short-circuits BEFORE the IP check (public stub present): quiet setup / OK doctor.
+make_ip_stub "$PUBLIC_IFACE"
+out="$(STRATUM_BIND=192.168.1.5 PATH="$IPBIN:$PATH" run_sourced "$SANDBOX" check_stratum_exposure setup 2>&1)"
+assert_eq "setup is quiet: bind narrowed to a LAN IP" "$out" ""
+out="$(STRATUM_BIND=192.168.1.5 PATH="$IPBIN:$PATH" run_sourced "$SANDBOX" check_stratum_exposure doctor 2>&1)"
+assert_contains "doctor OK: bind narrowed to a LAN IP" "$out" "not all interfaces"
+
 echo "== unit: is_ipv4 =="
-run_sourced "$SANDBOX" is_ipv4 "0.0.0.0"      >/dev/null 2>&1; assert_rc "accepts 0.0.0.0"     "$?" "0"
-run_sourced "$SANDBOX" is_ipv4 "127.0.0.1"    >/dev/null 2>&1; assert_rc "accepts 127.0.0.1"   "$?" "0"
-run_sourced "$SANDBOX" is_ipv4 "192.168.1.10" >/dev/null 2>&1; assert_rc "accepts LAN IP"      "$?" "0"
-run_sourced "$SANDBOX" is_ipv4 "256.0.0.1"    >/dev/null 2>&1; assert_rc "rejects octet >255"  "$?" "1"
-run_sourced "$SANDBOX" is_ipv4 "1.2.3"        >/dev/null 2>&1; assert_rc "rejects 3 octets"    "$?" "1"
-run_sourced "$SANDBOX" is_ipv4 "192.168.1.0/24" >/dev/null 2>&1; assert_rc "rejects CIDR/subnet" "$?" "1"
-run_sourced "$SANDBOX" is_ipv4 "example.com"  >/dev/null 2>&1; assert_rc "rejects hostname"    "$?" "1"
-run_sourced "$SANDBOX" is_ipv4 ""             >/dev/null 2>&1; assert_rc "rejects empty"       "$?" "1"
+run_sourced "$SANDBOX" is_ipv4 "0.0.0.0" >/dev/null 2>&1
+assert_rc "accepts 0.0.0.0" "$?" "0"
+run_sourced "$SANDBOX" is_ipv4 "127.0.0.1" >/dev/null 2>&1
+assert_rc "accepts 127.0.0.1" "$?" "0"
+run_sourced "$SANDBOX" is_ipv4 "192.168.1.10" >/dev/null 2>&1
+assert_rc "accepts LAN IP" "$?" "0"
+run_sourced "$SANDBOX" is_ipv4 "256.0.0.1" >/dev/null 2>&1
+assert_rc "rejects octet >255" "$?" "1"
+run_sourced "$SANDBOX" is_ipv4 "1.2.3" >/dev/null 2>&1
+assert_rc "rejects 3 octets" "$?" "1"
+run_sourced "$SANDBOX" is_ipv4 "192.168.1.0/24" >/dev/null 2>&1
+assert_rc "rejects CIDR/subnet" "$?" "1"
+run_sourced "$SANDBOX" is_ipv4 "example.com" >/dev/null 2>&1
+assert_rc "rejects hostname" "$?" "1"
+run_sourced "$SANDBOX" is_ipv4 "" >/dev/null 2>&1
+assert_rc "rejects empty" "$?" "1"
 
 echo "== unit: resolve_dashboard_host (dashboard.host 'auto' revert, 247c5a0) =="
 # A configured dashboard.host is used verbatim.
 # shellcheck disable=SC1090,SC2034  # $STACK path is dynamic; DASHBOARD_HOST is read by the sourced function
-got="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e; DASHBOARD_HOST='my.box.lan'; resolve_dashboard_host >/dev/null 2>&1; printf '%s' "$HOST_IP" )"
+got="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    DASHBOARD_HOST='my.box.lan'
+    resolve_dashboard_host >/dev/null 2>&1
+    printf '%s' "$HOST_IP"
+)"
 assert_eq "configured dashboard.host is used" "$got" "my.box.lan"
 # 'auto' (no dashboard.host) on a non-interactive run must REVERT HOST_IP to the machine
 # hostname, not keep a stale prior value — the regression fixed in 247c5a0.
 # shellcheck disable=SC1090,SC2034
-got="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e; DASHBOARD_HOST=''; HOST_IP='STALE'; resolve_dashboard_host >/dev/null 2>&1; printf '%s' "$HOST_IP" )"
+got="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    DASHBOARD_HOST=''
+    HOST_IP='STALE'
+    resolve_dashboard_host >/dev/null 2>&1
+    printf '%s' "$HOST_IP"
+)"
 assert_eq "dashboard.host 'auto' reverts to hostname" "$got" "$(hostname)"
 echo "== unit: docker_boot_enabled (#137) =="
 # A systemctl stub on PATH; FAKE_BOOT picks which unit reports "enabled". Docker counts as
 # boot-enabled if EITHER docker.service or docker.socket is enabled.
-BOOT="$SANDBOX/boot"; mkdir -p "$BOOT/bin"
-cat > "$BOOT/bin/systemctl" <<'EOF'
+BOOT="$SANDBOX/boot"
+mkdir -p "$BOOT/bin"
+cat >"$BOOT/bin/systemctl" <<'EOF'
 #!/usr/bin/env bash
 case "$1 $2" in
   "is-enabled docker.service") [ "${FAKE_BOOT:-}" = "service" ] && exit 0 || exit 1 ;;
@@ -113,51 +206,324 @@ case "$1 $2" in
 esac
 EOF
 chmod +x "$BOOT/bin/systemctl"
-PATH="$BOOT/bin:$PATH" FAKE_BOOT=service run_sourced "$SANDBOX" docker_boot_enabled; assert_rc "docker.service enabled -> 0" "$?" "0"
-PATH="$BOOT/bin:$PATH" FAKE_BOOT=socket  run_sourced "$SANDBOX" docker_boot_enabled; assert_rc "docker.socket enabled -> 0"  "$?" "0"
-PATH="$BOOT/bin:$PATH" FAKE_BOOT=none    run_sourced "$SANDBOX" docker_boot_enabled; assert_rc "neither enabled -> 1"        "$?" "1"
+PATH="$BOOT/bin:$PATH" FAKE_BOOT=service run_sourced "$SANDBOX" docker_boot_enabled
+assert_rc "docker.service enabled -> 0" "$?" "0"
+PATH="$BOOT/bin:$PATH" FAKE_BOOT=socket run_sourced "$SANDBOX" docker_boot_enabled
+assert_rc "docker.socket enabled -> 0" "$?" "0"
+PATH="$BOOT/bin:$PATH" FAKE_BOOT=none run_sourced "$SANDBOX" docker_boot_enabled
+assert_rc "neither enabled -> 1" "$?" "1"
 
 echo "== unit: is_valid_host (#130) =="
-run_sourced "$SANDBOX" is_valid_host "box.lan"       >/dev/null 2>&1; assert_rc "accepts hostname"      "$?" "0"
-run_sourced "$SANDBOX" is_valid_host "192.168.1.10"  >/dev/null 2>&1; assert_rc "accepts IPv4"          "$?" "0"
-run_sourced "$SANDBOX" is_valid_host "fe80::1"       >/dev/null 2>&1; assert_rc "accepts IPv6"          "$?" "0"
-run_sourced "$SANDBOX" is_valid_host "bad host"      >/dev/null 2>&1; assert_rc "rejects space"         "$?" "1"
-run_sourced "$SANDBOX" is_valid_host 'evil{block}'   >/dev/null 2>&1; assert_rc "rejects braces"        "$?" "1"
-run_sourced "$SANDBOX" is_valid_host "a/b"           >/dev/null 2>&1; assert_rc "rejects slash"         "$?" "1"
-run_sourced "$SANDBOX" is_valid_host ""              >/dev/null 2>&1; assert_rc "rejects empty"         "$?" "1"
+run_sourced "$SANDBOX" is_valid_host "box.lan" >/dev/null 2>&1
+assert_rc "accepts hostname" "$?" "0"
+run_sourced "$SANDBOX" is_valid_host "192.168.1.10" >/dev/null 2>&1
+assert_rc "accepts IPv4" "$?" "0"
+run_sourced "$SANDBOX" is_valid_host "fe80::1" >/dev/null 2>&1
+assert_rc "accepts IPv6" "$?" "0"
+run_sourced "$SANDBOX" is_valid_host "bad host" >/dev/null 2>&1
+assert_rc "rejects space" "$?" "1"
+run_sourced "$SANDBOX" is_valid_host 'evil{block}' >/dev/null 2>&1
+assert_rc "rejects braces" "$?" "1"
+run_sourced "$SANDBOX" is_valid_host "a/b" >/dev/null 2>&1
+assert_rc "rejects slash" "$?" "1"
+run_sourced "$SANDBOX" is_valid_host "" >/dev/null 2>&1
+assert_rc "rejects empty" "$?" "1"
 
 echo "== unit: describe_change =="
-assert_contains "prune is DEST"      "$(run_sourced "$SANDBOX" describe_change MONERO_PRUNE 1 0)"        "DEST"
-assert_contains "rpc lan is DEST"    "$(run_sourced "$SANDBOX" describe_change MONERO_RPC_BIND 127.0.0.1 0.0.0.0)" "DEST"
+assert_contains "prune is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_PRUNE 1 0)" "DEST"
+assert_contains "rpc lan is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_RPC_BIND 127.0.0.1 0.0.0.0)" "DEST"
 assert_contains "stratum open is DEST" "$(run_sourced "$SANDBOX" describe_change STRATUM_BIND 127.0.0.1 0.0.0.0)" "DEST"
-assert_contains "stratum lan is INFO"  "$(run_sourced "$SANDBOX" describe_change STRATUM_BIND 0.0.0.0 127.0.0.1)" "INFO"
+assert_contains "stratum lan is INFO" "$(run_sourced "$SANDBOX" describe_change STRATUM_BIND 0.0.0.0 127.0.0.1)" "INFO"
 # Stratum access-password (#152): enabling/changing is DEST (rigs need the new pass), disabling is
 # INFO — and the secret value must NEVER appear in the change preview.
-assert_contains "stratum pw enable is DEST"  "$(run_sourced "$SANDBOX" describe_change PROXY_STRATUM_PASSWORD '' s3cr3t)" "DEST"
+assert_contains "stratum pw enable is DEST" "$(run_sourced "$SANDBOX" describe_change PROXY_STRATUM_PASSWORD '' s3cr3t)" "DEST"
 assert_contains "stratum pw disable is INFO" "$(run_sourced "$SANDBOX" describe_change PROXY_STRATUM_PASSWORD s3cr3t '')" "INFO"
 case "$(run_sourced "$SANDBOX" describe_change PROXY_STRATUM_PASSWORD oldpw newpw)" in
-    *oldpw*|*newpw*) bad "stratum pw change hides the secret" "value leaked into the change preview" ;;
-    *DEST*)          ok  "stratum pw change hides the secret (DEST, no value shown)" ;;
-    *)               bad "stratum pw change hides the secret" "expected DEST" ;;
+*oldpw* | *newpw*) bad "stratum pw change hides the secret" "value leaked into the change preview" ;;
+*DEST*) ok "stratum pw change hides the secret (DEST, no value shown)" ;;
+*) bad "stratum pw change hides the secret" "expected DEST" ;;
 esac
 # Dev-fee donate-level (#173): a brief restart (INFO), shown as a percentage.
-assert_contains "donate-level is INFO"      "$(run_sourced "$SANDBOX" describe_change PROXY_DONATE_LEVEL 0 1)" "INFO"
-assert_contains "donate-level shows pct"    "$(run_sourced "$SANDBOX" describe_change PROXY_DONATE_LEVEL 0 1)" "0% → 1%"
-assert_contains "wallet is DEST"     "$(run_sourced "$SANDBOX" describe_change MONERO_WALLET_ADDRESS a b)" "DEST"
-assert_contains "xvb url is INFO"    "$(run_sourced "$SANDBOX" describe_change XVB_POOL_URL a b)"        "INFO"
-assert_contains "data_dir is DEST"   "$(run_sourced "$SANDBOX" describe_change MONERO_DATA_DIR /a /b)"   "DEST"
-assert_contains "tari mem is INFO"   "$(run_sourced "$SANDBOX" describe_change TARI_MEM_LIMIT 2048m 4g)" "INFO"
-assert_contains "monero mem is INFO" "$(run_sourced "$SANDBOX" describe_change MONERO_MEM_LIMIT 4g 6g)"  "INFO"
+assert_contains "donate-level is INFO" "$(run_sourced "$SANDBOX" describe_change PROXY_DONATE_LEVEL 0 1)" "INFO"
+assert_contains "donate-level shows pct" "$(run_sourced "$SANDBOX" describe_change PROXY_DONATE_LEVEL 0 1)" "0% → 1%"
+assert_contains "wallet is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_WALLET_ADDRESS a b)" "DEST"
+assert_contains "xvb url is INFO" "$(run_sourced "$SANDBOX" describe_change XVB_POOL_URL a b)" "INFO"
+assert_contains "data_dir is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_DATA_DIR /a /b)" "DEST"
+assert_contains "tari mem is INFO" "$(run_sourced "$SANDBOX" describe_change TARI_MEM_LIMIT 2048m 4g)" "INFO"
+assert_contains "monero mem is INFO" "$(run_sourced "$SANDBOX" describe_change MONERO_MEM_LIMIT 4g 6g)" "INFO"
 assert_contains "monero mem recreate note" "$(run_sourced "$SANDBOX" describe_change MONERO_MEM_LIMIT 4g 6g)" "monerod container is recreated"
 # Clearnet initial sync (#183): enabling OR disabling is DEST (the daemon is recreated), and enabling
 # must spell out the exposure so the apply confirmation is unambiguous.
-assert_contains "monero clearnet enable is DEST"  "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "DEST"
+assert_contains "monero clearnet enable is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "DEST"
 assert_contains "monero clearnet enable warns exposure" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "CLEARNET"
 assert_contains "monero clearnet keeps tx on Tor" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "Tor"
 assert_contains "monero clearnet disable is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC true false)" "DEST"
-assert_contains "tari clearnet enable is DEST"    "$(run_sourced "$SANDBOX" describe_change TARI_CLEARNET_SYNC false true)" "DEST"
+assert_contains "tari clearnet enable is DEST" "$(run_sourced "$SANDBOX" describe_change TARI_CLEARNET_SYNC false true)" "DEST"
 assert_contains "tari clearnet enable warns exposure" "$(run_sourced "$SANDBOX" describe_change TARI_CLEARNET_SYNC false true)" "CLEARNET"
 
+echo "== unit: p2pool_outbound_flags — Tor-by-default for outbound P2P (#165) =="
+# Default (clearnet absent/false) routes outbound sidechain dials through the bundled Tor SOCKS proxy.
+assert_eq "default → Tor SOCKS flags" "$(run_sourced "$SANDBOX" p2pool_outbound_flags false 172.28.0)" "--socks5 172.28.0.25:9050 --socks5-proxy-type tor"
+assert_eq "empty arg → Tor (default off)" "$(run_sourced "$SANDBOX" p2pool_outbound_flags '' 172.28.0)" "--socks5 172.28.0.25:9050 --socks5-proxy-type tor"
+# clearnet opt-out → no SOCKS flags (p2pool dials peers directly, IP exposed).
+assert_eq "clearnet=true → no SOCKS flags" "$(run_sourced "$SANDBOX" p2pool_outbound_flags true 172.28.0)" ""
+assert_eq "clearnet=yes (any truthy) → no SOCKS flags" "$(run_sourced "$SANDBOX" p2pool_outbound_flags yes 172.28.0)" ""
+# Honours a custom bridge subnet (#180) — the Tor container is always .25 of the configured /24.
+assert_contains "custom NETWORK_PREFIX points at its Tor (.25)" "$(run_sourced "$SANDBOX" p2pool_outbound_flags false 172.30.5)" "172.30.5.25:9050"
+
+echo "== p2pool entrypoint word-splits P2POOL_FLAGS into separate args (#165) =="
+# Compose passes P2POOL_FLAGS as ONE env var (a `- ${VAR}` command item is a single arg, unsplit);
+# the entrypoint must word-split it so a multi-flag value reaches p2pool as distinct args. A stub
+# p2pool on PATH captures what it's exec'd with.
+PE="$SANDBOX/p2pool-ep/bin"
+mkdir -p "$PE"
+cat >"$PE/p2pool" <<'STUB'
+#!/usr/bin/env bash
+printf 'ARGC=%s\n' "$#"; for a in "$@"; do printf 'ARG=[%s]\n' "$a"; done
+STUB
+chmod +x "$PE/p2pool"
+ep_out=$(PATH="$PE:$PATH" P2POOL_FLAGS="--mini --socks5 172.28.0.25:9050 --socks5-proxy-type tor" bash "$ROOT/build/p2pool/entrypoint.sh" --stratum 0.0.0.0:3333 2>&1)
+assert_contains "--socks5 is its own arg" "$ep_out" "ARG=[--socks5]"
+assert_contains "socks address is its own arg" "$ep_out" "ARG=[172.28.0.25:9050]"
+assert_contains "proxy-type value split out" "$ep_out" "ARG=[tor]"
+assert_contains "2 fixed + 5 flag tokens = ARGC 7" "$ep_out" "ARGC=7"
+ep_empty=$(PATH="$PE:$PATH" P2POOL_FLAGS="" bash "$ROOT/build/p2pool/entrypoint.sh" --stratum 0.0.0.0:3333 2>&1)
+assert_contains "empty P2POOL_FLAGS → no stray empty arg (ARGC=2)" "$ep_empty" "ARGC=2"
+
+echo "== p2pool entrypoint moves the Tari merge-mine gRPC onto loopback under Tor (#278 follow-up) =="
+# With --socks5 on, p2pool would dial --merge-mine tari://<private-ip> THROUGH Tor (rejected as an
+# RFC1918 address → TRANSIENT_FAILURE). The entrypoint must socat-bridge that node to 127.0.0.1 and
+# rewrite the URL host to the loopback IP literal. Stub socat so the test never binds a real port.
+SE="$SANDBOX/socat-ep/bin"
+mkdir -p "$SE"
+cat >"$SE/socat" <<STUB
+#!/usr/bin/env bash
+printf 'SOCAT=[%s]\n' "\$*" >> "$SANDBOX/socat.log"
+STUB
+chmod +x "$SE/socat"
+: >"$SANDBOX/socat.log"
+mm_out=$(PATH="$PE:$SE:$PATH" P2POOL_FLAGS="--mini --socks5 172.28.0.25:9050 --socks5-proxy-type tor" \
+    bash "$ROOT/build/p2pool/entrypoint.sh" --host 172.28.0.26 --merge-mine tari://172.28.0.27:18142 WALLET --stratum 0.0.0.0:3333 2>&1)
+assert_contains "merge-mine URL rewritten to loopback IP literal" "$mm_out" "ARG=[tari://127.0.0.1:18142]"
+assert_not_contains "original private merge-mine IP no longer dialled by p2pool" "$mm_out" "ARG=[tari://172.28.0.27:18142]"
+assert_contains "merge-mine wallet arg preserved" "$mm_out" "ARG=[WALLET]"
+assert_contains "socat bridges loopback:18142 -> the real Tari node" "$(cat "$SANDBOX/socat.log")" "TCP-LISTEN:18142,bind=127.0.0.1,fork,reuseaddr TCP:172.28.0.27:18142"
+# No SOCKS proxy → no rewrite, no bridge (clearnet mode dials the node directly, the gRPC stays put).
+: >"$SANDBOX/socat.log"
+mm_clear=$(PATH="$PE:$SE:$PATH" P2POOL_FLAGS="--mini" \
+    bash "$ROOT/build/p2pool/entrypoint.sh" --merge-mine tari://172.28.0.27:18142 WALLET --stratum 0.0.0.0:3333 2>&1)
+assert_contains "no --socks5 → merge-mine URL untouched" "$mm_clear" "ARG=[tari://172.28.0.27:18142]"
+assert_eq "no --socks5 → no Tari bridge spawned" "$(cat "$SANDBOX/socat.log")" ""
+
+echo "== unit: tor_egress_rules — fail-closed Tor-only egress ruleset (#270) =="
+TER=$(run_sourced "$SANDBOX" tor_egress_rules 172.28.0.0/24 172.28.0.25)
+assert_contains "ESTABLISHED/RELATED accepted (published-port replies, ongoing flows)" "$TER" "conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT"
+assert_contains "only Tor (.25) may egress to the internet" "$TER" "-s 172.28.0.25 -j ACCEPT"
+assert_contains "inter-container + 172.16/12 LAN allowed" "$TER" "-s 172.28.0.0/24 -d 172.16.0.0/12 -j ACCEPT"
+assert_contains "10/8 LAN allowed" "$TER" "-s 172.28.0.0/24 -d 10.0.0.0/8 -j ACCEPT"
+assert_contains "192.168/16 LAN allowed" "$TER" "-s 172.28.0.0/24 -d 192.168.0.0/16 -j ACCEPT"
+assert_eq "the clearnet DROP is the FINAL rule (fail-closed)" "$(printf '%s\n' "$TER" | tail -1)" "-s 172.28.0.0/24 -j DROP"
+assert_contains "honours a custom subnet/prefix (#180)" "$(run_sourced "$SANDBOX" tor_egress_rules 172.30.5.0/24 172.30.5.25)" "-s 172.30.5.0/24 -j DROP"
+
+echo "== black-box: apply/remove_tor_egress_firewall via stubbed iptables (#270) =="
+FW="$SANDBOX/fw"
+mkdir -p "$FW/bin"
+printf '#!/usr/bin/env bash\nexec "$@"\n' >"$FW/bin/sudo"
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$*" >> "%s/ipt.log"\n' "$FW" >"$FW/bin/iptables"
+printf '#!/usr/bin/env bash\nexit 0\n' >"$FW/bin/iptables-save" # no pre-existing rules
+chmod +x "$FW/bin/sudo" "$FW/bin/iptables" "$FW/bin/iptables-save"
+printf 'NETWORK_SUBNET=172.28.0.0/24\nNETWORK_PREFIX=172.28.0\nTOR_EGRESS_FIREWALL=true\n' >"$FW/.env"
+: >"$FW/ipt.log"
+PATH="$FW/bin:$PATH" run_sourced "$FW" apply_tor_egress_firewall >/dev/null 2>&1
+iptlog="$(cat "$FW/ipt.log" 2>/dev/null)"
+assert_contains "installs the fail-closed clearnet DROP, tagged" "$iptlog" "-I DOCKER-USER 7 -m comment --comment pithead-tor-egress -s 172.28.0.0/24 -j DROP"
+assert_contains "exempts the Tor container" "$iptlog" "-m comment --comment pithead-tor-egress -s 172.28.0.25 -j ACCEPT"
+# Pre-creates DOCKER-USER so the BEFORE-compose install at `up` can't miss on a first-ever start where
+# Docker hasn't created the chain yet — closes the startup window that grandfathered leaks (#276).
+assert_contains "pre-creates the DOCKER-USER chain (idempotently)" "$iptlog" "-N DOCKER-USER"
+# opt-out: TOR_EGRESS_FIREWALL=false installs nothing
+printf 'NETWORK_SUBNET=172.28.0.0/24\nNETWORK_PREFIX=172.28.0\nTOR_EGRESS_FIREWALL=false\n' >"$FW/.env"
+: >"$FW/ipt.log"
+PATH="$FW/bin:$PATH" run_sourced "$FW" apply_tor_egress_firewall >/dev/null 2>&1
+assert_eq "opt-out (network.tor_egress_firewall=false) installs no DROP" "$(grep -c 'DROP' "$FW/ipt.log" 2>/dev/null)" "0"
+# install-failure rollback (#270): if an `iptables -I` insert fails partway, apply must NOT leave a
+# half-open firewall it believes is fail-closed — it warns and rolls back via remove_tor_egress_firewall.
+# Stub: -N/-D succeed but every -I insert fails (rc 1). remove runs once up-front (idempotent clear)
+# and again on rollback, so iptables-save fires TWICE — that second call is the proof the rollback ran.
+FF="$SANDBOX/fwfail"
+mkdir -p "$FF/bin"
+printf '#!/usr/bin/env bash\nexec "$@"\n' >"$FF/bin/sudo"
+cat >"$FF/bin/iptables" <<'IPT'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"$IPT_LOG"
+case "$1" in -I) exit 1 ;; esac # every insert fails midway
+exit 0
+IPT
+printf '#!/usr/bin/env bash\nprintf "save\\n" >>"$IPT_LOG"\nexit 0\n' >"$FF/bin/iptables-save"
+chmod +x "$FF/bin/sudo" "$FF/bin/iptables" "$FF/bin/iptables-save"
+printf 'NETWORK_SUBNET=172.28.0.0/24\nNETWORK_PREFIX=172.28.0\nTOR_EGRESS_FIREWALL=true\n' >"$FF/.env"
+: >"$FF/ipt.log"
+fwfail_out="$(PATH="$FF/bin:$PATH" IPT_LOG="$FF/ipt.log" run_sourced "$FF" apply_tor_egress_firewall 2>&1)"
+fwfail_rc=$?
+assert_rc "insert failure degrades gracefully (stack still runs, rc 0)" "$fwfail_rc" "0"
+assert_contains "insert failure warns clearnet is NOT fail-closed" "$fwfail_out" "NOT fail-closed"
+assert_eq "insert failure rolls back the partial firewall (remove reruns -> save x2)" "$(grep -c '^save$' "$FF/ipt.log")" "2"
+# remove: `down` (and every re-apply) strips ONLY our tagged rules — this removal is the precondition
+# for the #291 down->upgrade/apply window, so prove it deletes the tags and spares foreign DOCKER-USER
+# rules. iptables-save replays two tagged rules + one foreign rule; remove must -D the tagged pair only.
+RM="$SANDBOX/rm"
+mkdir -p "$RM/bin"
+printf '#!/usr/bin/env bash\nexec "$@"\n' >"$RM/bin/sudo"
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$*" >> "%s/ipt.log"\n' "$RM" >"$RM/bin/iptables"
+cat >"$RM/bin/iptables-save" <<'SAVE'
+#!/usr/bin/env bash
+cat <<'RULES'
+-A DOCKER-USER -m comment --comment pithead-tor-egress -s 172.28.0.0/24 -j DROP
+-A DOCKER-USER -m comment --comment pithead-tor-egress -s 172.28.0.25 -j ACCEPT
+-A DOCKER-USER -j RETURN
+RULES
+SAVE
+chmod +x "$RM/bin/sudo" "$RM/bin/iptables" "$RM/bin/iptables-save"
+: >"$RM/ipt.log"
+PATH="$RM/bin:$PATH" run_sourced "$RM" remove_tor_egress_firewall >/dev/null 2>&1
+rmlog="$(cat "$RM/ipt.log" 2>/dev/null)"
+assert_contains "down removes the tagged clearnet DROP" "$rmlog" "-D DOCKER-USER -m comment --comment pithead-tor-egress -s 172.28.0.0/24 -j DROP"
+assert_contains "down removes the tagged Tor-exempt ACCEPT" "$rmlog" "-D DOCKER-USER -m comment --comment pithead-tor-egress -s 172.28.0.25 -j ACCEPT"
+assert_not_contains "down leaves foreign DOCKER-USER rules untouched" "$rmlog" "RETURN"
+
+echo "== regression: every command installs the Tor-egress firewall BEFORE compose (#291) =="
+# The firewall must go in BEFORE any clearnet-capable container starts, on EVERY path that brings one
+# up (#276 closed the window for stack_up; #291 + this change close it for upgrade/apply/reset). If a
+# container starts first, the leading ESTABLISHED rule grandfathers its clearnet dial past the DROP.
+# Each case neutralises the command's preamble and records the order of the two load-bearing ops; the
+# firewall sentinel MUST precede the compose sentinel. fw_then_compose() extracts just those two from
+# whatever else the function prints (warnings, banners) so the assert is exact.
+fw_then_compose() { printf '%s\n' "$1" | grep -xE 'firewall|compose' | tr '\n' ','; }
+
+# up: the reference path #276 fixed — pin it too so a future reorder of stack_up is caught here.
+up_order=$(
+    cd "$SANDBOX" || exit
+    # shellcheck disable=SC1090
+    source "$STACK"
+    set +e
+    log() { :; }
+    warn_missing_data_dirs() { :; }
+    migrate_compose_project() { :; }
+    print_clearnet_banner() { :; }
+    announce_dashboard_url() { :; }
+    apply_tor_egress_firewall() { echo firewall; }
+    compose_up_checked() { echo compose; }
+    stack_up
+)
+assert_eq "up applies the firewall before 'compose up' (#276)" "$(fw_then_compose "$up_order")" "firewall,compose,"
+
+upg_order=$(
+    cd "$SANDBOX" || exit
+    # shellcheck disable=SC1090
+    source "$STACK"
+    set +e
+    require_env() { :; }
+    parse_and_validate_config() { :; }
+    load_preserved_state() { :; }
+    ensure_directories() { :; }
+    resolve_dashboard_host() { :; }
+    render_env() { :; }
+    mv() { :; }
+    inject_service_configs() { :; }
+    generate_caddyfile() { :; }
+    migrate_compose_project() { :; }
+    is_source_checkout() { return 1; }
+    log() { :; }
+    docker() { :; }
+    apply_tor_egress_firewall() { echo firewall; }
+    compose_up_checked() { echo compose; }
+    stack_upgrade
+)
+assert_eq "upgrade applies the firewall before 'compose up' (#291)" "$(fw_then_compose "$upg_order")" "firewall,compose,"
+
+# apply had the same after-compose ordering bug as #272's stack_upgrade — fixed alongside #291. Take
+# the no-change-but-incomplete-marker retry path so apply recreates containers without the interactive
+# diff (env_changed_keys returns nothing; a pre-seeded .apply-incomplete marker forces the retry).
+apply_order=$(
+    cd "$SANDBOX" || exit
+    # shellcheck disable=SC1090
+    source "$STACK"
+    set +e
+    # shellcheck disable=SC2034  # read by the sourced apply()'s "not provisioned" guard, unseen here
+    MONERO_ONION=onion
+    require_env() { :; }
+    parse_and_validate_config() { :; }
+    load_preserved_state() { :; }
+    is_deployed() { return 0; }
+    ensure_directories() { :; }
+    resolve_dashboard_host() { :; }
+    render_env() { :; }
+    env_changed_keys() { :; }
+    mv() { :; }
+    inject_service_configs() { :; }
+    generate_caddyfile() { :; }
+    migrate_compose_project() { :; }
+    announce_dashboard_url() { :; }
+    log() { :; }
+    warn() { :; }
+    docker() { :; }
+    apply_tor_egress_firewall() { echo firewall; }
+    compose_up_checked() { echo compose; }
+    : >".env.apply-incomplete" # force the retry path
+    apply
+)
+assert_eq "apply applies the firewall before 'compose up' (#291)" "$(fw_then_compose "$apply_order")" "firewall,compose,"
+
+# reset-dashboard recreates p2pool (clearnet-capable); on a `down` stack it must install the firewall
+# first or p2pool comes up with no firewall at all. -y skips the destructive confirm; the docker stub
+# emits the compose sentinel only for the `compose up` it ends on.
+rd_order=$(
+    cd "$SANDBOX" || exit
+    # shellcheck disable=SC1090
+    source "$STACK"
+    set +e
+    env_get() { echo "/nonexistent/reset-$1"; } # non-existent dirs -> rm skipped
+    assert_safe_dir() { :; }
+    mkdir() { :; }
+    sudo() { :; }
+    log() { :; }
+    docker() {
+        [ "$1 $2" = "compose up" ] && echo compose
+        return 0
+    }
+    apply_tor_egress_firewall() { echo firewall; }
+    reset_dashboard -y
+)
+assert_eq "reset-dashboard applies the firewall before 'compose up' (#291)" "$(fw_then_compose "$rd_order")" "firewall,compose,"
+
+echo "== unit: config_bool honours an explicit false (jq // false-coercion guard, #294) =="
+# Regression for #294: `.x // true` returns true even when x is explicitly false (jq treats false as
+# empty), which silently broke the #270 firewall opt-out (config false → .env stayed true) and
+# xvb.tor=false. config_bool null-checks instead. CONFIG_FILE is the relative "config.json", so a
+# fixture in the cwd is what the sourced helper reads.
+CB="$SANDBOX/cb"
+mkdir -p "$CB"
+printf '{"network":{"tor_egress_firewall":false},"xvb":{"tor":false}}' >"$CB/config.json"
+assert_eq "explicit false honoured (firewall)" "$(run_sourced "$CB" config_bool '.network.tor_egress_firewall' true)" "false"
+assert_eq "explicit false honoured (xvb.tor)" "$(run_sourced "$CB" config_bool '.xvb.tor' true)" "false"
+printf '{"network":{"tor_egress_firewall":true}}' >"$CB/config.json"
+assert_eq "explicit true honoured" "$(run_sourced "$CB" config_bool '.network.tor_egress_firewall' true)" "true"
+printf '{}' >"$CB/config.json"
+assert_eq "absent -> default true" "$(run_sourced "$CB" config_bool '.network.tor_egress_firewall' true)" "true"
+assert_eq "absent -> default false" "$(run_sourced "$CB" config_bool '.xvb.tor' false)" "false"
+
+echo "== unit: monero_prune_flag maps prune bool -> 1/0, honouring explicit false (#294) =="
+# render_env + preflight both size disk off this flag; an explicit prune:false must yield 0, not the
+# pruned default of 1. Missing config falls back to pruned (1).
+printf '{"monero":{"prune":false}}' >"$CB/config.json"
+assert_eq "explicit false -> 0" "$(run_sourced "$CB" monero_prune_flag)" "0"
+printf '{"monero":{"prune":true}}' >"$CB/config.json"
+assert_eq "explicit true -> 1" "$(run_sourced "$CB" monero_prune_flag)" "1"
+printf '{}' >"$CB/config.json"
+assert_eq "absent -> 1 (pruned default)" "$(run_sourced "$CB" monero_prune_flag)" "1"
+rm -f "$CB/config.json"
+assert_eq "missing config -> 1 (pruned default)" "$(run_sourced "$CB" monero_prune_flag)" "1"
+
 echo "== unit: clearnet initial sync helpers (#183) =="
 # normalize_bool: 1/true/yes/on (any case) => true; everything else (incl. empty) => false, matching
 # the dashboard's MONERO_PRUNE truthiness so a config bool reads the same on both sides.
@@ -173,156 +539,228 @@ done
 MONT="$SANDBOX/mon-clearnet.conf"
 cp "$ROOT/build/monero/bitmonero.conf.template" "$MONT"
 # shellcheck disable=SC1090
-( export PITHEAD_TEST_SOURCE=1; source "$ROOT/build/monero/entrypoint.sh"; apply_clearnet_initial_sync "$MONT" )
+(
+    export PITHEAD_TEST_SOURCE=1
+    source "$ROOT/build/monero/entrypoint.sh"
+    apply_clearnet_initial_sync "$MONT"
+)
 case "$(grep -E '^proxy=' "$MONT" || true)" in
-    "") ok "monero clearnet: P2P proxy= line stripped (#183)" ;;
-    *)  bad "monero clearnet: P2P proxy= line stripped (#183)" "still present" ;;
+"") ok "monero clearnet: P2P proxy= line stripped (#183)" ;;
+*) bad "monero clearnet: P2P proxy= line stripped (#183)" "still present" ;;
 esac
-assert_contains "monero clearnet: tx-proxy stays on Tor (#183)"   "$(cat "$MONT")" "tx-proxy=tor"
+assert_contains "monero clearnet: tx-proxy stays on Tor (#183)" "$(cat "$MONT")" "tx-proxy=tor"
 # P2Pool v4.16 clearnet recommendation: out-peers 32 + the recommended priority nodes (added only in
 # the clearnet window; the Tor template has neither — the #161 check below guards that).
-assert_contains "monero clearnet: out-peers=32 (p2pool v4.16 rec)"  "$(cat "$MONT")" "out-peers=32"
+assert_contains "monero clearnet: out-peers=32 (p2pool v4.16 rec)" "$(cat "$MONT")" "out-peers=32"
 assert_contains "monero clearnet: xmrvsbeast priority node (v4.16)" "$(cat "$MONT")" "add-priority-node=p2pmd.xmrvsbeast.com:18080"
-assert_contains "monero clearnet: hashvault priority node (v4.16)"  "$(cat "$MONT")" "add-priority-node=nodes.hashvault.pro:18080"
+assert_contains "monero clearnet: hashvault priority node (v4.16)" "$(cat "$MONT")" "add-priority-node=nodes.hashvault.pro:18080"
 # The committed template (the Tor-only default) keeps the proxy line + the Tor-tuned out-peers.
 assert_contains "monero default: Tor P2P proxy present (#183)" "$(cat "$ROOT/build/monero/bitmonero.conf.template")" 'proxy=${NETWORK_PREFIX}.25:9050'
-assert_contains "monero default: out-peers 48 for Tor (#183)"  "$(cat "$ROOT/build/monero/bitmonero.conf.template")" "out-peers=48"
+assert_contains "monero default: out-peers 48 for Tor (#183)" "$(cat "$ROOT/build/monero/bitmonero.conf.template")" "out-peers=48"
 # Compose wires both flags into container env: monerod reads MONERO_CLEARNET_SYNC in its entrypoint;
 # TARI_CLEARNET_SYNC is inert in the container but its presence makes a flag change recreate tari so
 # it re-reads the host-rendered config.toml (a bind-mount content change alone won't recreate it).
 assert_contains "compose passes MONERO_CLEARNET_SYNC to monerod (#183)" "$(cat "$ROOT/docker-compose.yml")" 'MONERO_CLEARNET_SYNC=${MONERO_CLEARNET_SYNC'
-assert_contains "compose passes TARI_CLEARNET_SYNC to tari (#183)"      "$(cat "$ROOT/docker-compose.yml")" 'TARI_CLEARNET_SYNC=${TARI_CLEARNET_SYNC'
+assert_contains "compose passes TARI_CLEARNET_SYNC to tari (#183)" "$(cat "$ROOT/docker-compose.yml")" 'TARI_CLEARNET_SYNC=${TARI_CLEARNET_SYNC'
 
 # --- Auto-transition (#234): the entrypoints gate clearnet on flag AND the absence of the
 # dashboard-written marker, so a node returns to Tor on its own once synced. ---
 # Monero entrypoint marker gate.
-mono_active() { ( export PITHEAD_TEST_SOURCE=1 MONERO_CLEARNET_SYNC="$1" CLEARNET_MARKER="$2"; source "$ROOT/build/monero/entrypoint.sh"; clearnet_sync_active ); }
+mono_active() { (
+    export PITHEAD_TEST_SOURCE=1 MONERO_CLEARNET_SYNC="$1" CLEARNET_MARKER="$2"
+    source "$ROOT/build/monero/entrypoint.sh"
+    clearnet_sync_active
+); }
 if mono_active true "$SANDBOX/absent-marker"; then ok "monero clearnet ACTIVE when flag on + no marker (#234)"; else bad "monero clearnet active gate (#234)" "expected active"; fi
-: > "$SANDBOX/mono.marker"
+: >"$SANDBOX/mono.marker"
 if mono_active true "$SANDBOX/mono.marker"; then bad "monero clearnet inactive once marker present (#234)" "still active"; else ok "monero clearnet INACTIVE once marker present → Tor (#234)"; fi
 if mono_active false "$SANDBOX/absent-marker"; then bad "monero clearnet off when flag off (#234)" "active with flag off"; else ok "monero clearnet OFF when flag off (#234)"; fi
 
 # Tari entrypoint renders a runtime config from the canonical Tor config; transform only when active.
-TARISRC="$SANDBOX/tari-src.toml"; cp "$ROOT/build/tari/config.toml.template" "$TARISRC"
+TARISRC="$SANDBOX/tari-src.toml"
+cp "$ROOT/build/tari/config.toml.template" "$TARISRC"
 # shellcheck disable=SC1090
-( export PITHEAD_TEST_SOURCE=1 TARI_CLEARNET_SYNC=true CLEARNET_MARKER="$SANDBOX/absent-marker"; source "$ROOT/build/tari/entrypoint.sh"; render_tari_runtime_config "$TARISRC" "$SANDBOX/tari-rt.toml" )
-assert_contains "tari entrypoint clearnet: TCP transport (#234)"   "$(cat "$SANDBOX/tari-rt.toml")" 'type = "tcp"'
+(
+    export PITHEAD_TEST_SOURCE=1 TARI_CLEARNET_SYNC=true CLEARNET_MARKER="$SANDBOX/absent-marker"
+    source "$ROOT/build/tari/entrypoint.sh"
+    render_tari_runtime_config "$TARISRC" "$SANDBOX/tari-rt.toml"
+)
+assert_contains "tari entrypoint clearnet: TCP transport (#234)" "$(cat "$SANDBOX/tari-rt.toml")" 'type = "tcp"'
 assert_contains "tari entrypoint clearnet: DNS seed enabled (#234)" "$(cat "$SANDBOX/tari-rt.toml")" 'dns_seeds = ["seeds.tari.com"]'
-: > "$SANDBOX/tari.marker"
+: >"$SANDBOX/tari.marker"
 # shellcheck disable=SC1090
-( export PITHEAD_TEST_SOURCE=1 TARI_CLEARNET_SYNC=true CLEARNET_MARKER="$SANDBOX/tari.marker"; source "$ROOT/build/tari/entrypoint.sh"; render_tari_runtime_config "$TARISRC" "$SANDBOX/tari-rt2.toml" )
-assert_contains "tari entrypoint marker→Tor: transport tor (#234)"  "$(cat "$SANDBOX/tari-rt2.toml")" 'type = "tor"'
+(
+    export PITHEAD_TEST_SOURCE=1 TARI_CLEARNET_SYNC=true CLEARNET_MARKER="$SANDBOX/tari.marker"
+    source "$ROOT/build/tari/entrypoint.sh"
+    render_tari_runtime_config "$TARISRC" "$SANDBOX/tari-rt2.toml"
+)
+assert_contains "tari entrypoint marker→Tor: transport tor (#234)" "$(cat "$SANDBOX/tari-rt2.toml")" 'type = "tor"'
 assert_contains "tari entrypoint marker→Tor: DNS seeds empty (#234)" "$(cat "$SANDBOX/tari-rt2.toml")" "dns_seeds = []"
 assert_contains "tari entrypoint never mutates the canonical config (#234)" "$(cat "$TARISRC")" 'type = "tor"'
 # Compose wires the shared marker dir into all three: dashboard rw, monerod + tari ro, + the tari
 # wrapper entrypoint that chains to the upstream start_tari_app.sh.
 assert_contains "compose mounts clearnet-state into monerod (#234)" "$(cat "$ROOT/docker-compose.yml")" ':/clearnet-state:ro'
-assert_contains "compose wires the tari wrapper entrypoint (#234)"  "$(cat "$ROOT/docker-compose.yml")" '/var/tari/config/entrypoint.sh'
+assert_contains "compose wires the tari wrapper entrypoint (#234)" "$(cat "$ROOT/docker-compose.yml")" '/var/tari/config/entrypoint.sh'
 
 echo "== unit: clock_sync_status (mining is time-sensitive) =="
 # doctor's NTP check classifies timedatectl's NTPSynchronized: yes→synced, no→unsynced, else unknown.
-CLKBIN="$SANDBOX/clk-bin"; mkdir -p "$CLKBIN"
-mk_timedatectl() { printf '#!/usr/bin/env bash\nprintf "%%s\\n" "%s"\n' "$1" > "$CLKBIN/timedatectl"; chmod +x "$CLKBIN/timedatectl"; }
-mk_timedatectl "yes"; assert_eq "clock_sync_status: NTP yes => synced"   "$(PATH="$CLKBIN:$PATH" run_sourced "$SANDBOX" clock_sync_status)" "synced"
-mk_timedatectl "no";  assert_eq "clock_sync_status: NTP no => unsynced"  "$(PATH="$CLKBIN:$PATH" run_sourced "$SANDBOX" clock_sync_status)" "unsynced"
-mk_timedatectl "";    assert_eq "clock_sync_status: blank => unknown"     "$(PATH="$CLKBIN:$PATH" run_sourced "$SANDBOX" clock_sync_status)" "unknown"
+CLKBIN="$SANDBOX/clk-bin"
+mkdir -p "$CLKBIN"
+mk_timedatectl() {
+    printf '#!/usr/bin/env bash\nprintf "%%s\\n" "%s"\n' "$1" >"$CLKBIN/timedatectl"
+    chmod +x "$CLKBIN/timedatectl"
+}
+mk_timedatectl "yes"
+assert_eq "clock_sync_status: NTP yes => synced" "$(PATH="$CLKBIN:$PATH" run_sourced "$SANDBOX" clock_sync_status)" "synced"
+mk_timedatectl "no"
+assert_eq "clock_sync_status: NTP no => unsynced" "$(PATH="$CLKBIN:$PATH" run_sourced "$SANDBOX" clock_sync_status)" "unsynced"
+mk_timedatectl ""
+assert_eq "clock_sync_status: blank => unknown" "$(PATH="$CLKBIN:$PATH" run_sourced "$SANDBOX" clock_sync_status)" "unknown"
 
 echo "== unit: monero_address_type — p2pool needs a PRIMARY address (#250) =="
 # Classify by network-byte prefix + length: primary 4…/95 (the only payable kind), integrated 4…/106,
 # subaddress 8…/95. setup/apply hard-fail anything but primary so nobody mines to an unpayable address.
-_a94="$(printf 'a%.0s' $(seq 94))"; _a93="$(printf 'a%.0s' $(seq 93))"; _a105="$(printf 'a%.0s' $(seq 105))"
-assert_eq "monero_address_type: 4…/95  => primary"    "$(run_sourced "$SANDBOX" monero_address_type "4$_a94")"  "primary"
-assert_eq "monero_address_type: 8…/95  => subaddress" "$(run_sourced "$SANDBOX" monero_address_type "8$_a94")"  "subaddress"
+_a94="$(printf 'a%.0s' $(seq 94))"
+_a93="$(printf 'a%.0s' $(seq 93))"
+_a105="$(printf 'a%.0s' $(seq 105))"
+assert_eq "monero_address_type: 4…/95  => primary" "$(run_sourced "$SANDBOX" monero_address_type "4$_a94")" "primary"
+assert_eq "monero_address_type: 8…/95  => subaddress" "$(run_sourced "$SANDBOX" monero_address_type "8$_a94")" "subaddress"
 assert_eq "monero_address_type: 4…/106 => integrated" "$(run_sourced "$SANDBOX" monero_address_type "4$_a105")" "integrated"
-assert_eq "monero_address_type: 4…/94  => invalid"    "$(run_sourced "$SANDBOX" monero_address_type "4$_a93")"  "invalid"
-assert_eq "monero_address_type: other  => invalid"    "$(run_sourced "$SANDBOX" monero_address_type "1abc")"    "invalid"
+assert_eq "monero_address_type: 4…/94  => invalid" "$(run_sourced "$SANDBOX" monero_address_type "4$_a93")" "invalid"
+assert_eq "monero_address_type: other  => invalid" "$(run_sourced "$SANDBOX" monero_address_type "1abc")" "invalid"
 
 echo "== unit: dashboard auth (#8) =="
 # Dashboard login (#8): enabling/changing is DEST (caddy is recreated), disabling is INFO. The bcrypt
 # hash is a secret and must never surface in the change preview; the internal fingerprint stays silent.
-assert_contains "dash login enable is DEST"  "$(run_sourced "$SANDBOX" describe_change DASHBOARD_AUTH_HASH_B64 '' aGFzaA==)" "DEST"
+assert_contains "dash login enable is DEST" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_AUTH_HASH_B64 '' aGFzaA==)" "DEST"
 assert_contains "dash login disable is INFO" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_AUTH_HASH_B64 aGFzaA== '')" "INFO"
 case "$(run_sourced "$SANDBOX" describe_change DASHBOARD_AUTH_HASH_B64 b2xkSA== bmV3SA==)" in
-    *b2xkSA==*|*bmV3SA==*) bad "dash login change hides the hash" "hash value leaked into the change preview" ;;
-    *DEST*)                ok  "dash login change hides the hash (DEST, no value shown)" ;;
-    *)                     bad "dash login change hides the hash" "expected DEST" ;;
+*b2xkSA==* | *bmV3SA==*) bad "dash login change hides the hash" "hash value leaked into the change preview" ;;
+*DEST*) ok "dash login change hides the hash (DEST, no value shown)" ;;
+*) bad "dash login change hides the hash" "expected DEST" ;;
 esac
 assert_contains "dash login username change is shown" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_AUTH_USER admin bob)" "admin → bob"
 case "$(run_sourced "$SANDBOX" describe_change DASHBOARD_AUTH_PW_FP aaa bbb)" in
-    *PW_FP*|*updated*|*fingerprint*) bad "dash login fingerprint stays silent" "internal fingerprint surfaced in the preview" ;;
-    INFO*)                           ok  "dash login fingerprint stays silent (no preview line)" ;;
-    *)                               bad "dash login fingerprint stays silent" "unexpected message emitted" ;;
+*PW_FP* | *updated* | *fingerprint*) bad "dash login fingerprint stays silent" "internal fingerprint surfaced in the preview" ;;
+INFO*) ok "dash login fingerprint stays silent (no preview line)" ;;
+*) bad "dash login fingerprint stays silent" "unexpected message emitted" ;;
 esac
 
 # New-release check toggle (#224): enabling/disabling is INFO, and the message names GitHub + Tor.
-assert_contains "update-check enable is INFO"   "$(run_sourced "$SANDBOX" describe_change DASHBOARD_CHECK_UPDATES false true)" "INFO"
+assert_contains "update-check enable is INFO" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_CHECK_UPDATES false true)" "INFO"
 assert_contains "update-check enable mentions GitHub/Tor" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_CHECK_UPDATES false true)" "GitHub"
-assert_contains "update-check disable is INFO"  "$(run_sourced "$SANDBOX" describe_change DASHBOARD_CHECK_UPDATES true false)" "no longer contacts GitHub"
+assert_contains "update-check disable is INFO" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_CHECK_UPDATES true false)" "no longer contacts GitHub"
 
 # generate_caddyfile renders a basic_auth block ONLY when a hash is configured, carrying the username
 # and the *decoded* bcrypt string Caddy expects; with no hash the dashboard stays open (no basic_auth).
 auth_hb64="$(printf '%s' '$2y$14$UNITTESTbcrypthashvalue000000000000000000000000000000' | openssl base64 -A)"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-caddy_on="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e
+caddy_on="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
     DASHBOARD_SECURE=true HOST_IP=box.lan DASHBOARD_AUTH_USER=admin DASHBOARD_AUTH_HASH_B64="$auth_hb64" \
-        generate_caddyfile >/dev/null 2>&1; cat Caddyfile )"
+        generate_caddyfile >/dev/null 2>&1
+    cat Caddyfile
+)"
 assert_contains "caddy renders basic_auth when login set" "$caddy_on" "basic_auth"
-assert_contains "caddy basic_auth carries the username"   "$caddy_on" "admin"
-assert_contains "caddy basic_auth carries decoded hash"   "$caddy_on" '$2y$14$UNITTESTbcrypthashvalue'
+assert_contains "caddy basic_auth carries the username" "$caddy_on" "admin"
+assert_contains "caddy basic_auth carries decoded hash" "$caddy_on" '$2y$14$UNITTESTbcrypthashvalue'
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-caddy_off="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e
+caddy_off="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
     DASHBOARD_SECURE=true HOST_IP=box.lan DASHBOARD_AUTH_USER=admin DASHBOARD_AUTH_HASH_B64="" \
-        generate_caddyfile >/dev/null 2>&1; cat Caddyfile )"
+        generate_caddyfile >/dev/null 2>&1
+    cat Caddyfile
+)"
 case "$caddy_off" in
-    *basic_auth*) bad "caddy stays open when no login set" "basic_auth rendered without a password" ;;
-    *)            ok  "caddy stays open when no login set (no basic_auth)" ;;
+*basic_auth*) bad "caddy stays open when no login set" "basic_auth rendered without a password" ;;
+*) ok "caddy stays open when no login set (no basic_auth)" ;;
 esac
 
 echo "== unit: generate_caddyfile scheme (#140) =="
 # The HTTPS-vs-HTTP choice is security-relevant: secure -> https:// + `tls internal`; insecure ->
 # plain http:// and no TLS directive. (Auth on/off is covered in the dashboard-auth block above.)
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-caddy_https="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e
-    DASHBOARD_SECURE=true HOST_IP=box.lan DASHBOARD_AUTH_HASH_B64="" generate_caddyfile >/dev/null 2>&1; cat Caddyfile )"
-assert_contains "caddyfile secure uses https"  "$caddy_https" "https://box.lan"
+caddy_https="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    DASHBOARD_SECURE=true HOST_IP=box.lan DASHBOARD_AUTH_HASH_B64="" generate_caddyfile >/dev/null 2>&1
+    cat Caddyfile
+)"
+assert_contains "caddyfile secure uses https" "$caddy_https" "https://box.lan"
 assert_contains "caddyfile secure enables TLS" "$caddy_https" "tls internal"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-caddy_http="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e
-    DASHBOARD_SECURE=false HOST_IP=box.lan DASHBOARD_AUTH_HASH_B64="" generate_caddyfile >/dev/null 2>&1; cat Caddyfile )"
+caddy_http="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    DASHBOARD_SECURE=false HOST_IP=box.lan DASHBOARD_AUTH_HASH_B64="" generate_caddyfile >/dev/null 2>&1
+    cat Caddyfile
+)"
 assert_contains "caddyfile insecure uses http" "$caddy_http" "http://box.lan"
 case "$caddy_http" in
-    *"tls internal"*) bad "caddyfile insecure has no TLS" "'tls internal' present on a plain-HTTP site" ;;
-    *)                ok  "caddyfile insecure has no TLS" ;;
+*"tls internal"*) bad "caddyfile insecure has no TLS" "'tls internal' present on a plain-HTTP site" ;;
+*) ok "caddyfile insecure has no TLS" ;;
 esac
 
 echo "== unit: host detection (#140) =="
 # detect_os reads ID / VERSION_ID / PRETTY_NAME from an overridable os-release (drives the
 # 'supported on Ubuntu 24.04' check); a missing file leaves the fields empty (caller warns).
 osr="$SANDBOX/os-release"
-printf 'ID=ubuntu\nVERSION_ID="24.04"\nPRETTY_NAME="Ubuntu 24.04.1 LTS"\n' > "$osr"
+printf 'ID=ubuntu\nVERSION_ID="24.04"\nPRETTY_NAME="Ubuntu 24.04.1 LTS"\n' >"$osr"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-os_out="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e; OS_RELEASE_FILE="$osr" detect_os; printf '%s|%s|%s' "$OS_ID" "$OS_VERSION" "$OS_PRETTY" )"
+os_out="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    OS_RELEASE_FILE="$osr" detect_os
+    printf '%s|%s|%s' "$OS_ID" "$OS_VERSION" "$OS_PRETTY"
+)"
 assert_eq "detect_os parses os-release" "$os_out" "ubuntu|24.04|Ubuntu 24.04.1 LTS"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-os_missing="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e; OS_RELEASE_FILE="$SANDBOX/nope" detect_os; printf '%s' "$OS_ID" )"
+os_missing="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    OS_RELEASE_FILE="$SANDBOX/nope" detect_os
+    printf '%s' "$OS_ID"
+)"
 assert_eq "detect_os tolerates a missing file" "$os_missing" ""
 
 # detect_host_timezone: an explicit IANA-shaped TZ wins; garbage falls back to Etc/UTC.
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-tz_good="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e; TZ="America/Chicago" detect_host_timezone )"
+tz_good="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    TZ="America/Chicago" detect_host_timezone
+)"
 assert_eq "detect_host_timezone honors a valid TZ" "$tz_good" "America/Chicago"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-tz_bad="$( cd "$SANDBOX" && source "$STACK" 2>/dev/null; set +e; TZ="not a zone!" detect_host_timezone )"
+tz_bad="$(
+    cd "$SANDBOX" && source "$STACK" 2>/dev/null
+    set +e
+    TZ="not a zone!" detect_host_timezone
+)"
 assert_eq "detect_host_timezone rejects garbage -> Etc/UTC" "$tz_bad" "Etc/UTC"
 
 # deps_satisfied is true only when jq/openssl/docker are present AND `docker compose version` works
 # (the v2-plugin gate). A docker whose `compose version` fails makes it false.
-DEPS="$SANDBOX/deps"; make_stubs "$DEPS/bin"
+DEPS="$SANDBOX/deps"
+make_stubs "$DEPS/bin"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-( cd "$SANDBOX" && PATH="$DEPS/bin:$PATH" && source "$STACK" 2>/dev/null; set +e; deps_satisfied ); assert_rc "deps_satisfied true with all deps" "$?" "0"
-printf '#!/usr/bin/env bash\n[ "$*" = "compose version" ] && exit 1\nexit 0\n' > "$DEPS/bin/docker"; chmod +x "$DEPS/bin/docker"
+(
+    cd "$SANDBOX" && PATH="$DEPS/bin:$PATH" && source "$STACK" 2>/dev/null
+    set +e
+    deps_satisfied
+)
+assert_rc "deps_satisfied true with all deps" "$?" "0"
+printf '#!/usr/bin/env bash\n[ "$*" = "compose version" ] && exit 1\nexit 0\n' >"$DEPS/bin/docker"
+chmod +x "$DEPS/bin/docker"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
-( cd "$SANDBOX" && PATH="$DEPS/bin:$PATH" && source "$STACK" 2>/dev/null; set +e; deps_satisfied ); assert_rc "deps_satisfied false without compose v2" "$?" "1"
+(
+    cd "$SANDBOX" && PATH="$DEPS/bin:$PATH" && source "$STACK" 2>/dev/null
+    set +e
+    deps_satisfied
+)
+assert_rc "deps_satisfied false without compose v2" "$?" "1"
 
 echo "== unit: release.sh pure logic (#44) =="
 # The release pipeline's side-effect-free helpers (no docker needed). Sourced from the repo root with
@@ -330,47 +768,97 @@ echo "== unit: release.sh pure logic (#44) =="
 # release.sh guards its main() behind a BASH_SOURCE check, so sourcing only defines the functions.
 REL="$ROOT/scripts/release.sh"
 # shellcheck disable=SC1090
-( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; is_semver "0.1.0" );      assert_rc "is_semver accepts 0.1.0"        "$?" "0"
+(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    is_semver "0.1.0"
+)
+assert_rc "is_semver accepts 0.1.0" "$?" "0"
 # shellcheck disable=SC1090
-( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; is_semver "1.2.3-rc.1" ); assert_rc "is_semver accepts a prerelease" "$?" "0"
+(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    is_semver "1.2.3-rc.1"
+)
+assert_rc "is_semver accepts a prerelease" "$?" "0"
 # shellcheck disable=SC1090
-( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; is_semver "1.2" );        assert_rc "is_semver rejects a partial"    "$?" "1"
+(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    is_semver "1.2"
+)
+assert_rc "is_semver rejects a partial" "$?" "1"
 # shellcheck disable=SC1090
-( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; is_semver "v1.2.3" );     assert_rc "is_semver rejects a leading v"  "$?" "1"
+(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    is_semver "v1.2.3"
+)
+assert_rc "is_semver rejects a leading v" "$?" "1"
 # shellcheck disable=SC1090
 assert_eq "image_for builds the GHCR image name" \
-    "$( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; image_for dashboard )" \
+    "$(
+        cd "$ROOT" || exit
+        set --
+        source "$REL" 2>/dev/null
+        set +eu
+        image_for dashboard
+    )" \
     "ghcr.io/p2pool-starter-stack/pithead-dashboard"
 # --draft (#44): documented in --help, and --help stops at the comment header (a too-wide sed range
 # used to leak the script body, e.g. `set -euo pipefail`, into the help output).
-assert_contains "release --help documents --draft"     "$(bash "$REL" --help 2>&1)" "--draft"
+assert_contains "release --help documents --draft" "$(bash "$REL" --help 2>&1)" "--draft"
 case "$(bash "$REL" --help 2>&1)" in
-    *"set -euo pipefail"*) bad "release --help stops at the comment header" "leaked the script body into --help" ;;
-    *)                     ok  "release --help stops at the comment header" ;;
+*"set -euo pipefail"*) bad "release --help stops at the comment header" "leaked the script body into --help" ;;
+*) ok "release --help stops at the comment header" ;;
 esac
 # Bundle completeness: the pull-based bundle must ship every ./build/* path the compose MOUNTS at
 # runtime. A pull install builds nothing and the images don't bake these in, so a missing one mounts an
 # empty dir and breaks the container — the v1.0.0 bundle shipped without monerod's bitmonero.conf.template
 # exactly this way. compose_build_mounts derives the list make_bundle copies.
 # shellcheck disable=SC1090
-BUILD_MOUNTS="$( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; compose_build_mounts docker-compose.yml )"
+BUILD_MOUNTS="$(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    compose_build_mounts docker-compose.yml
+)"
 assert_contains "bundle ships monerod's config template" "$BUILD_MOUNTS" "./build/monero/bitmonero.conf.template"
-assert_contains "bundle ships the tari config dir"        "$BUILD_MOUNTS" "./build/tari"
+assert_contains "bundle ships the tari config dir" "$BUILD_MOUNTS" "./build/tari"
 # The bundle must ship the BASIC config template (the documented quick-start config — `cp
-# config.json.template config.json`) and unpack to a versionless `pithead/` dir for the stable
+# config.minimal.json config.json`) and unpack to a versionless `pithead/` dir for the stable
 # /releases/latest/download/pithead.tar.gz URL. Build a real bundle and inspect it.
 # shellcheck disable=SC1090,SC2034  # dynamic source; TAG/REGISTRY/DRY_RUN are consumed inside make_bundle
-( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu
-  WORKDIR="$SANDBOX/bundle"; mkdir -p "$WORKDIR"; TAG=v9.9.9; REGISTRY=ghcr.io/test; DRY_RUN=0
-  make_bundle "$WORKDIR/pithead.tar.gz" >/dev/null 2>&1; tar tzf "$WORKDIR/pithead.tar.gz" 2>/dev/null ) > "$SANDBOX/bundle.list" 2>/dev/null
-grep -q '^pithead/config.json.template$' "$SANDBOX/bundle.list" && ok "bundle ships config.json.template (basic quick-start config)" || bad "bundle ships config.json.template" "absent from the bundle"
-grep -q '^pithead/$'                     "$SANDBOX/bundle.list" && ok "bundle unpacks to versionless pithead/"               || bad "bundle unpacks to pithead/" "top-level dir is not pithead/"
+(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    WORKDIR="$SANDBOX/bundle"
+    mkdir -p "$WORKDIR"
+    TAG=v9.9.9
+    REGISTRY=ghcr.io/test
+    DRY_RUN=0
+    make_bundle "$WORKDIR/pithead.tar.gz" >/dev/null 2>&1
+    tar tzf "$WORKDIR/pithead.tar.gz" 2>/dev/null
+) >"$SANDBOX/bundle.list" 2>/dev/null
+grep -q '^pithead/config.minimal.json$' "$SANDBOX/bundle.list" && ok "bundle ships config.minimal.json (basic quick-start config)" || bad "bundle ships config.minimal.json" "absent from the bundle"
+grep -q '^pithead/$' "$SANDBOX/bundle.list" && ok "bundle unpacks to versionless pithead/" || bad "bundle unpacks to pithead/" "top-level dir is not pithead/"
 _bm_missing=""
 for _m in $BUILD_MOUNTS; do [ -e "$ROOT/$_m" ] || _bm_missing="$_bm_missing $_m"; done
 assert_eq "every compose ./build runtime mount exists in the tree" "${_bm_missing:-none}" "none"
 case "$BUILD_MOUNTS" in
-    *Dockerfile*) bad "bundle build-mounts exclude Dockerfiles" "a Dockerfile would flip the bundle pull->build mode" ;;
-    *)            ok  "bundle build-mounts exclude Dockerfiles" ;;
+*Dockerfile*) bad "bundle build-mounts exclude Dockerfiles" "a Dockerfile would flip the bundle pull->build mode" ;;
+*) ok "bundle build-mounts exclude Dockerfiles" ;;
 esac
 # Target-arch guard: the release MUST build linux/amd64 (the bundled binaries are x86_64; xmrig-proxy
 # has no arm64 build, so the stack can't be arm64). A plain host-arch `docker build` on an arm64 dev box
@@ -381,23 +869,38 @@ REL_SRC="$(cat "$REL")"
 assert_contains "release builds with buildx (forces the target arch)" "$REL_SRC" "docker buildx build"
 PLAT_DEF="$(grep -E '^PLATFORMS=' "$REL" | head -1)"
 case "$PLAT_DEF" in
-    *linux/amd64*) ok "release targets linux/amd64 (the x86_64 binaries' platform)" ;;
-    *) bad "release targets linux/amd64" "PLATFORMS default: $PLAT_DEF" ;;
+*linux/amd64*) ok "release targets linux/amd64 (the x86_64 binaries' platform)" ;;
+*) bad "release targets linux/amd64" "PLATFORMS default: $PLAT_DEF" ;;
 esac
 assert_contains "smoke stage verifies the pushed image's target platform" "$REL_SRC" "missing target platform"
 # write_manifest's "- **Version:**" line starts with a dash; without `printf --` it died with
 # "printf: - : invalid option" and broke the whole publish stage. Render it and assert it survives.
 man_out="$SANDBOX/manifest.md"
 # shellcheck disable=SC1090,SC2034  # dynamic source; the globals are consumed inside write_manifest
-( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu
-  TAG="v9.9.9"; STACK_VERSION="9.9.9"; GIT_COMMIT="abc1234"; BUILD_DATE="now"; WORKDIR="$SANDBOX"
-  write_manifest "$man_out" ) 2>/dev/null
+(
+    cd "$ROOT" || exit
+    set --
+    source "$REL" 2>/dev/null
+    set +eu
+    TAG="v9.9.9"
+    STACK_VERSION="9.9.9"
+    GIT_COMMIT="abc1234"
+    BUILD_DATE="now"
+    WORKDIR="$SANDBOX"
+    write_manifest "$man_out"
+) 2>/dev/null
 assert_contains "manifest renders the leading-dash Version line (printf --)" "$(cat "$man_out" 2>/dev/null)" "- **Version:** 9.9.9"
 # The ingredients manifest's component pins must resolve to a real value present in each Dockerfile —
 # a drift guard so a renamed ARG can't silently emit an empty pin in the release notes.
 for svc in p2pool monero xmrig-proxy; do
     # shellcheck disable=SC1090
-    pv="$( cd "$ROOT" || exit; set --; source "$REL" 2>/dev/null; set +eu; pin "$svc" )"
+    pv="$(
+        cd "$ROOT" || exit
+        set --
+        source "$REL" 2>/dev/null
+        set +eu
+        pin "$svc"
+    )"
     if [ -n "$pv" ] && grep -q -- "$pv" "$ROOT/build/$svc/Dockerfile"; then
         ok "pin $svc resolves to a value in its Dockerfile"
     else
@@ -406,7 +909,7 @@ for svc in p2pool monero xmrig-proxy; do
 done
 # The top-level VERSION file is the single source of truth (#44); the dashboard's Python package
 # metadata must stay in lockstep so a release can't ship two different "stack versions".
-ver_file="$(tr -d ' \t\r\n' < "$ROOT/VERSION")"
+ver_file="$(tr -d ' \t\r\n' <"$ROOT/VERSION")"
 ver_pyproject="$(grep -oE '^version = "[^"]+"' "$ROOT/build/dashboard/pyproject.toml" | head -1 | cut -d'"' -f2)"
 assert_eq "pyproject.toml version matches VERSION (#44)" "$ver_pyproject" "$ver_file"
 
@@ -416,7 +919,10 @@ assert_eq "pyproject.toml version matches VERSION (#44)" "$ver_pyproject" "$ver_
 tier_cfg="$ROOT/build/dashboard/mining_dashboard/config/config.py"
 tier_doc="$ROOT/docs/architecture.md"
 for tier in "donor:1_000:1 kH/s" "vip:10_000:10 kH/s" "whale:100_000:100 kH/s" "mega:1_000_000:1 MH/s"; do
-    t_name="${tier%%:*}"; t_rest="${tier#*:}"; t_val="${t_rest%%:*}"; t_human="${t_rest#*:}"
+    t_name="${tier%%:*}"
+    t_rest="${tier#*:}"
+    t_val="${t_rest%%:*}"
+    t_human="${t_rest#*:}"
     if grep -qE ": ${t_val}[ ,]" "$tier_cfg" && grep -qF "$t_human" "$tier_doc"; then
         ok "XvB $t_name tier: config.py $t_val matches docs '$t_human'"
     else
@@ -428,34 +934,85 @@ echo "== unit: pull-vs-build mode (#44) =="
 # is_source_checkout / resolve_pull_policy / STACK_VERSION key off whether the image build CONTEXTS
 # (Dockerfiles) are present: a source checkout builds locally (:dev, --pull never); a release bundle
 # (only build/tari/ + VERSION) pulls (:vX.Y.Z, --pull missing). Two scratch dirs stand in for each.
-SRCM="$SANDBOX/srcmode"; mkdir -p "$SRCM/build/dashboard"; : > "$SRCM/build/dashboard/Dockerfile"; printf '0.1.0\n' > "$SRCM/VERSION"
-RELM="$SANDBOX/relmode"; mkdir -p "$RELM/build/tari"; printf '0.1.0\n' > "$RELM/VERSION"
+SRCM="$SANDBOX/srcmode"
+mkdir -p "$SRCM/build/dashboard"
+: >"$SRCM/build/dashboard/Dockerfile"
+printf '0.1.0\n' >"$SRCM/VERSION"
+RELM="$SANDBOX/relmode"
+mkdir -p "$RELM/build/tari"
+printf '0.1.0\n' >"$RELM/VERSION"
 # shellcheck disable=SC1090
-( cd "$SRCM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; is_source_checkout ); assert_rc "is_source_checkout true with a Dockerfile" "$?" "0"
+(
+    cd "$SRCM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    is_source_checkout
+)
+assert_rc "is_source_checkout true with a Dockerfile" "$?" "0"
 # shellcheck disable=SC1090
-( cd "$RELM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; is_source_checkout ); assert_rc "is_source_checkout false without a Dockerfile" "$?" "1"
+(
+    cd "$RELM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    is_source_checkout
+)
+assert_rc "is_source_checkout false without a Dockerfile" "$?" "1"
 # shellcheck disable=SC1090
-assert_eq "pull policy: source -> never"      "$( cd "$SRCM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; resolve_pull_policy )" "never"
+assert_eq "pull policy: source -> never" "$(
+    cd "$SRCM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    resolve_pull_policy
+)" "never"
 # shellcheck disable=SC1090
-assert_eq "pull policy: release -> missing"   "$( cd "$RELM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; resolve_pull_policy )" "missing"
+assert_eq "pull policy: release -> missing" "$(
+    cd "$RELM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    resolve_pull_policy
+)" "missing"
 # shellcheck disable=SC1090
-assert_eq "pull policy: PITHEAD_PULL override" "$( cd "$SRCM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; PITHEAD_PULL=always resolve_pull_policy )" "always"
+assert_eq "pull policy: PITHEAD_PULL override" "$(
+    cd "$SRCM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    PITHEAD_PULL=always resolve_pull_policy
+)" "always"
 # shellcheck disable=SC1090
-assert_eq "STACK_VERSION dev in a source checkout"   "$( cd "$SRCM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; export_build_provenance; printf '%s' "$STACK_VERSION" )" "dev"
+assert_eq "STACK_VERSION dev in a source checkout" "$(
+    cd "$SRCM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    export_build_provenance
+    printf '%s' "$STACK_VERSION"
+)" "dev"
 # shellcheck disable=SC1090
-assert_eq "STACK_VERSION v0.1.0 in a release bundle" "$( cd "$RELM" || exit; set --; source "$STACK" 2>/dev/null; set +eu; export_build_provenance; printf '%s' "$STACK_VERSION" )" "v0.1.0"
+assert_eq "STACK_VERSION v0.1.0 in a release bundle" "$(
+    cd "$RELM" || exit
+    set --
+    source "$STACK" 2>/dev/null
+    set +eu
+    export_build_provenance
+    printf '%s' "$STACK_VERSION"
+)" "v0.1.0"
 
 echo "== unit: explain_subnet_collision (#180) =="
 ov="$(run_sourced "$SANDBOX" explain_subnet_collision "invalid pool request: Pool overlaps with other one on this address space" 2>&1)"
-assert_contains "subnet overlap -> network.subnet hint"  "$ov" "network"
-assert_contains "subnet overlap -> suggests a free /24"  "$ov" "/24"
+assert_contains "subnet overlap -> network.subnet hint" "$ov" "network"
+assert_contains "subnet overlap -> suggests a free /24" "$ov" "/24"
 assert_eq "non-overlap failure stays silent" "$(run_sourced "$SANDBOX" explain_subnet_collision "some other failure" 2>&1)" ""
 
 echo "== unit: env helpers =="
-printf 'A=1\nB=two\nPROXY_AUTH_TOKEN=keep=me\n' > "$SANDBOX/old.env"
-printf 'A=1\nB=three\nC=4\nPROXY_AUTH_TOKEN=keep=me\n' > "$SANDBOX/new.env"
-assert_eq "env_get_file reads value"      "$(run_sourced "$SANDBOX" env_get_file "$SANDBOX/old.env" B)" "two"
-assert_eq "env_get_file value with ="     "$(run_sourced "$SANDBOX" env_get_file "$SANDBOX/old.env" PROXY_AUTH_TOKEN)" "keep=me"
+printf 'A=1\nB=two\nPROXY_AUTH_TOKEN=keep=me\n' >"$SANDBOX/old.env"
+printf 'A=1\nB=three\nC=4\nPROXY_AUTH_TOKEN=keep=me\n' >"$SANDBOX/new.env"
+assert_eq "env_get_file reads value" "$(run_sourced "$SANDBOX" env_get_file "$SANDBOX/old.env" B)" "two"
+assert_eq "env_get_file value with =" "$(run_sourced "$SANDBOX" env_get_file "$SANDBOX/old.env" PROXY_AUTH_TOKEN)" "keep=me"
 changed="$(run_sourced "$SANDBOX" env_changed_keys "$SANDBOX/old.env" "$SANDBOX/new.env" | sort | tr '\n' ' ')"
 assert_eq "env_changed_keys finds B and C" "$changed" "B C "
 
@@ -464,11 +1021,14 @@ echo "== unit: export_build_provenance (Issue #58) =="
 # branch/commit for the dashboard build args — deliberately NOT written into .env, since the
 # volatile commit would otherwise churn `apply`. The sandbox isn't a git repo, so branch/commit
 # come back empty here; the release/dev split is unit-tested in build/dashboard/tests/test_version.py.
-PROV="$SANDBOX/prov"; mkdir -p "$PROV"; printf '  9.9.9 \n' > "$PROV/VERSION"
+PROV="$SANDBOX/prov"
+mkdir -p "$PROV"
+printf '  9.9.9 \n' >"$PROV/VERSION"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
 ver="$(cd "$PROV" && source "$STACK" && set +e && export_build_provenance && printf '%s' "$PITHEAD_VERSION")"
 assert_eq "export_build_provenance reads VERSION (trimmed)" "$ver" "9.9.9"
-NOVER="$SANDBOX/nover"; mkdir -p "$NOVER"
+NOVER="$SANDBOX/nover"
+mkdir -p "$NOVER"
 # shellcheck disable=SC1090  # STACK path is dynamic by design
 ver="$(cd "$NOVER" && source "$STACK" && set +e && export_build_provenance && printf '%s' "$PITHEAD_VERSION")"
 assert_eq "export_build_provenance empty when no VERSION" "$ver" ""
@@ -476,13 +1036,16 @@ assert_eq "export_build_provenance empty when no VERSION" "$ver" ""
 echo "== unit: node credential helpers =="
 assert_eq "default username is admin" "$(run_sourced "$SANDBOX" default_node_username)" "admin"
 PW="$(run_sourced "$SANDBOX" generate_node_password)"
-assert_eq "generated password is 32 chars"   "${#PW}" "32"
+assert_eq "generated password is 32 chars" "${#PW}" "32"
 assert_eq "generated password is alphanumeric" "$(printf '%s' "$PW" | tr -dc 'A-Za-z0-9')" "$PW"
 PW2="$(run_sourced "$SANDBOX" generate_node_password)"
 if [ "$PW" != "$PW2" ]; then ok "two generations differ"; else bad "two generations differ" "both were [$PW]"; fi
-run_sourced "$SANDBOX" cred_needs_generating "" "PLACE";      assert_rc "empty needs generating"       "$?" "0"
-run_sourced "$SANDBOX" cred_needs_generating "PLACE" "PLACE"; assert_rc "placeholder needs generating" "$?" "0"
-run_sourced "$SANDBOX" cred_needs_generating "real" "PLACE";  assert_rc "real value kept"              "$?" "1"
+run_sourced "$SANDBOX" cred_needs_generating "" "PLACE"
+assert_rc "empty needs generating" "$?" "0"
+run_sourced "$SANDBOX" cred_needs_generating "PLACE" "PLACE"
+assert_rc "placeholder needs generating" "$?" "0"
+run_sourced "$SANDBOX" cred_needs_generating "real" "PLACE"
+assert_rc "real value kept" "$?" "1"
 
 echo "== unit: randomx_boot_params (#176) =="
 # The kernel boot params pithead writes into GRUB_CMDLINE_LINUX_DEFAULT for RandomX. Guards the
@@ -490,51 +1053,90 @@ echo "== unit: randomx_boot_params (#176) =="
 # param the kernel silently ignores, so THP was never actually disabled. The valid param is singular.
 bp="$(run_sourced "$SANDBOX" randomx_boot_params)"
 assert_contains "reserves 2M huge page size" "$bp" "hugepagesz=2M"
-assert_contains "reserves 3072 huge pages"   "$bp" "hugepages=3072"
+assert_contains "reserves 3072 huge pages" "$bp" "hugepages=3072"
 assert_contains "disables THP (singular param)" "$bp" "transparent_hugepage=never"
 case "$bp" in
-    *transparent_hugepages=*) bad "THP param must be singular, not the kernel-ignored plural" "got [$bp]" ;;
-    *) ok "THP param is singular (no plural transparent_hugepages= typo)" ;;
+*transparent_hugepages=*) bad "THP param must be singular, not the kernel-ignored plural" "got [$bp]" ;;
+*) ok "THP param is singular (no plural transparent_hugepages= typo)" ;;
 esac
 
 echo "== unit: grub heal + boot-param insert (#176) =="
 # A passthrough sudo so the helpers' `sudo cp` / `sudo sed -i` actually edit a sandbox grub file
 # (the global stub sudo is a no-op). The helpers select GNU vs BSD sed via OS_TYPE, so this exercises
 # the real transformation on both Linux CI and a macOS dev box.
-GR="$SANDBOX/grub"; mkdir -p "$GR/bin"
-printf '#!/usr/bin/env bash\nexec "$@"\n' > "$GR/bin/sudo"
+GR="$SANDBOX/grub"
+mkdir -p "$GR/bin"
+printf '#!/usr/bin/env bash\nexec "$@"\n' >"$GR/bin/sudo"
 chmod +x "$GR/bin/sudo"
 run_grub() { PATH="$GR/bin:$PATH" run_sourced "$SANDBOX" "$@"; }
 
 # heal: rewrites an existing plural typo to the singular param, then is an idempotent no-op.
 g="$GR/healed"
-printf 'GRUB_CMDLINE_LINUX_DEFAULT="hugepagesz=2M hugepages=3072 transparent_hugepages=never quiet"\n' > "$g"
-run_grub heal_grub_thp_typo "$g"; assert_rc "heal: rewrites plural typo (rc 0)" "$?" "0"
+printf 'GRUB_CMDLINE_LINUX_DEFAULT="hugepagesz=2M hugepages=3072 transparent_hugepages=never quiet"\n' >"$g"
+run_grub heal_grub_thp_typo "$g"
+assert_rc "heal: rewrites plural typo (rc 0)" "$?" "0"
 assert_contains "heal: file now uses singular param" "$(cat "$g")" "transparent_hugepage=never"
 case "$(cat "$g")" in *transparent_hugepages=*) bad "heal: plural typo removed" "$(cat "$g")" ;; *) ok "heal: plural typo removed" ;; esac
-run_grub heal_grub_thp_typo "$g"; assert_rc "heal: idempotent no-op when already singular (rc 1)" "$?" "1"
+run_grub heal_grub_thp_typo "$g"
+assert_rc "heal: idempotent no-op when already singular (rc 1)" "$?" "1"
 
 # insert: appends the params to the active line, preserving what's already there.
 g="$GR/fresh"
-printf 'GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"\n' > "$g"
-run_grub append_grub_boot_params "$g"; assert_rc "insert: edits the active line (rc 0)" "$?" "0"
+printf 'GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"\n' >"$g"
+run_grub append_grub_boot_params "$g"
+assert_rc "insert: edits the active line (rc 0)" "$?" "0"
 out="$(cat "$g")"
-assert_contains "insert: keeps existing params"      "$out" "quiet splash"
+assert_contains "insert: keeps existing params" "$out" "quiet splash"
 assert_contains "insert: adds hugepages reservation" "$out" "hugepages=3072"
-assert_contains "insert: adds singular THP param"    "$out" "transparent_hugepage=never"
+assert_contains "insert: adds singular THP param" "$out" "transparent_hugepage=never"
 
 # insert: a commented-out line is not the active form -> rc 1, file untouched (no silent reboot).
 g="$GR/commented"
-printf '# GRUB_CMDLINE_LINUX_DEFAULT="quiet"\nGRUB_TIMEOUT=5\n' > "$g"
+printf '# GRUB_CMDLINE_LINUX_DEFAULT="quiet"\nGRUB_TIMEOUT=5\n' >"$g"
 before="$(cat "$g")"
-run_grub append_grub_boot_params "$g"; assert_rc "insert: no active line -> rc 1" "$?" "1"
+run_grub append_grub_boot_params "$g"
+assert_rc "insert: no active line -> rc 1" "$?" "1"
 assert_eq "insert: leaves file unchanged when no active line" "$(cat "$g")" "$before"
 
+echo "== unit: ensure_owner conditional recursive chown (#255) =="
+# ensure_owner migrates a data tree to the container's uid ONLY when something in it is foreign-owned,
+# and scans the WHOLE tree (not just the top dir) — an install upgraded from the root-container era has
+# a user-owned dir but root-owned *contents*, and those are what the non-root container can't overwrite.
+# MEMORY flags "must scan contents not just dir" as a past bug, so we guard both the decision and that
+# the find scan is recursive (no -maxdepth). sudo is stubbed to record what it would chown.
+EO="$SANDBOX/eo"
+mkdir -p "$EO/bin" "$EO/tree/sub"
+: >"$EO/tree/sub/file"
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$*" >>"%s/sudo.log"\n' "$EO" >"$EO/bin/sudo"
+chmod +x "$EO/bin/sudo"
+myuid="$(id -u)"
+: >"$EO/sudo.log"
+PATH="$EO/bin:$PATH" run_sourced "$EO" ensure_owner "$EO/tree" "$myuid" "$myuid" >/dev/null 2>&1
+assert_rc "clean tree (already owned) stays sudo-free" "$?" "0"
+assert_eq "clean tree triggers no chown" "$(grep -c chown "$EO/sudo.log")" "0"
+: >"$EO/sudo.log"
+PATH="$EO/bin:$PATH" run_sourced "$EO" ensure_owner "$EO/tree" 424242 424242 >/dev/null 2>&1
+assert_contains "foreign ownership triggers a recursive chown" "$(cat "$EO/sudo.log")" "chown -R 424242:424242 $EO/tree"
+: >"$EO/sudo.log"
+PATH="$EO/bin:$PATH" run_sourced "$EO" ensure_owner "$EO/nonexistent" "$myuid" "$myuid" >/dev/null 2>&1
+assert_rc "missing dir is a no-op" "$?" "0"
+assert_eq "missing dir triggers no chown" "$(grep -c chown "$EO/sudo.log")" "0"
+# Regression guard for #255: the ownership scan must be whole-tree. Stub `find` to capture its args and
+# assert ensure_owner never passes -maxdepth (which would re-introduce the top-dir-only bug).
+mkdir -p "$EO/findbin"
+printf '#!/usr/bin/env bash\nprintf "%%s\\n" "$*" >>"%s/find.log"\n' "$EO" >"$EO/findbin/find"
+printf '#!/usr/bin/env bash\nexit 0\n' >"$EO/findbin/sudo"
+chmod +x "$EO/findbin/find" "$EO/findbin/sudo"
+: >"$EO/find.log"
+PATH="$EO/findbin:$PATH" run_sourced "$EO" ensure_owner "$EO/tree" "$myuid" "$myuid" >/dev/null 2>&1
+assert_not_contains "the ownership scan is recursive (no -maxdepth)" "$(cat "$EO/find.log")" "-maxdepth"
+assert_contains "the ownership scan keys off foreign uid" "$(cat "$EO/find.log")" "! -uid $myuid"
+
 echo "== unit: disk_component_gib =="
 assert_eq "monero pruned -> 120" "$(run_sourced "$SANDBOX" disk_component_gib monero 1)" "120"
-assert_eq "monero full -> 320"   "$(run_sourced "$SANDBOX" disk_component_gib monero 0)" "320"
-assert_eq "tari -> 170"          "$(run_sourced "$SANDBOX" disk_component_gib tari)"     "170"
-assert_eq "tor -> 1"             "$(run_sourced "$SANDBOX" disk_component_gib tor)"      "1"
+assert_eq "monero full -> 320" "$(run_sourced "$SANDBOX" disk_component_gib monero 0)" "320"
+assert_eq "tari -> 170" "$(run_sourced "$SANDBOX" disk_component_gib tari)" "170"
+assert_eq "tor -> 1" "$(run_sourced "$SANDBOX" disk_component_gib tor)" "1"
 
 echo "== unit: check_disk_grouped (mocked df) =="
 # A df stub on PATH so check_disk_grouped sees a scripted filesystem layout. DF_MAP maps each path
@@ -542,8 +1144,9 @@ echo "== unit: check_disk_grouped (mocked df) =="
 # resolves the mount from these) AND the mount points themselves (check_disk_grouped reads free
 # space via the mount, not the possibly-missing dir — #179). DF_AVAIL_KB / DF_AVAIL_H give the
 # (single) free figure every mount reports. Real temp dirs make disk_fs_mount resolve without walking up.
-DISK="$SANDBOX/disk"; mkdir -p "$DISK/bin"
-cat > "$DISK/bin/df" <<'EOF'
+DISK="$SANDBOX/disk"
+mkdir -p "$DISK/bin"
+cat >"$DISK/bin/df" <<'EOF'
 #!/usr/bin/env bash
 human=0; path=""
 for a in "$@"; do case "$a" in -Ph) human=1 ;; -*) : ;; *) path="$a" ;; esac; done
@@ -554,14 +1157,15 @@ echo "Filesystem 1024-blocks Used Available Capacity Mounted on"
 if [ "$human" = 1 ]; then echo "src 9 9 ${DF_AVAIL_H} 1% $mount"; else echo "src 9 9 ${DF_AVAIL_KB} 1% $mount"; fi
 EOF
 chmod +x "$DISK/bin/df"
-DM="$DISK/data"; mkdir -p "$DM/monero" "$DM/tari" "$DM/p2pool" "$DM/dashboard" "$DM/tor"
+DM="$DISK/data"
+mkdir -p "$DM/monero" "$DM/tari" "$DM/p2pool" "$DM/dashboard" "$DM/tor"
 md="$DM/monero" td="$DM/tari" pd="$DM/p2pool" dd="$DM/dashboard" rd="$DM/tor"
 
 # All five dirs on ONE filesystem with plenty of space -> a SINGLE grouped OK line naming every
 # component, with the combined pruned requirement (120+170+5+2+1 = 298 GB).
 one_map="$md=/data $td=/data $pd=/data $dd=/data $rd=/data /data=/data"
 out="$(PATH="$DISK/bin:$PATH" DF_MAP="$one_map" DF_AVAIL_KB=629145600 DF_AVAIL_H=600G \
-       run_sourced "$SANDBOX" check_disk_grouped doctor 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
+    run_sourced "$SANDBOX" check_disk_grouped doctor 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
 assert_eq "one fs -> single line" "$(printf '%s\n' "$out" | grep -c 'Data on')" "1"
 assert_contains "single line names all components" "$out" "(monero, tari, p2pool, dashboard, tor)"
 assert_contains "single line shows combined ~298 GB" "$out" "needs ~298 GB"
@@ -569,24 +1173,24 @@ assert_contains "ample space -> OK" "$out" "OK"
 
 # Same single filesystem but too small (100 GiB < 298 GiB) -> ONE WARN line.
 out="$(PATH="$DISK/bin:$PATH" DF_MAP="$one_map" DF_AVAIL_KB=104857600 DF_AVAIL_H=100G \
-       run_sourced "$SANDBOX" check_disk_grouped doctor 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
+    run_sourced "$SANDBOX" check_disk_grouped doctor 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
 assert_eq "one small fs -> single line" "$(printf '%s\n' "$out" | grep -c 'Data on')" "1"
 assert_contains "small fs warns below need" "$out" "below the ~298 GB"
 
 # Two filesystems: monero+tari on /big, the rest on /small -> ONE line per filesystem.
 two_map="$md=/big $td=/big $pd=/small $dd=/small $rd=/small /big=/big /small=/small"
 out="$(PATH="$DISK/bin:$PATH" DF_MAP="$two_map" DF_AVAIL_KB=629145600 DF_AVAIL_H=600G \
-       run_sourced "$SANDBOX" check_disk_grouped doctor 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
+    run_sourced "$SANDBOX" check_disk_grouped doctor 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
 assert_eq "two fs -> two lines" "$(printf '%s\n' "$out" | grep -c 'Data on')" "2"
 assert_contains "/big groups monero+tari (~290 GB)" "$out" "/big (monero, tari): 600G free — needs ~290 GB"
 assert_contains "/small groups the small three (~8 GB)" "$out" "/small (p2pool, dashboard, tor): 600G free — needs ~8 GB"
 
 # Preflight mode is WARN-only and silent when there's enough room.
 out="$(PATH="$DISK/bin:$PATH" DF_MAP="$one_map" DF_AVAIL_KB=629145600 DF_AVAIL_H=600G \
-       run_sourced "$SANDBOX" check_disk_grouped preflight 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
+    run_sourced "$SANDBOX" check_disk_grouped preflight 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
 assert_eq "preflight silent when ample" "$out" ""
 out="$(PATH="$DISK/bin:$PATH" DF_MAP="$one_map" DF_AVAIL_KB=104857600 DF_AVAIL_H=100G \
-       run_sourced "$SANDBOX" check_disk_grouped preflight 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
+    run_sourced "$SANDBOX" check_disk_grouped preflight 1 "$md" "$td" "$pd" "$dd" "$rd" 2>&1)"
 assert_contains "preflight warns once when low" "$out" "Low disk on /data (hosts monero, tari, p2pool, dashboard, tor)"
 
 # Regression #179: on first run the data dirs don't exist yet; check_disk_grouped must resolve to the
@@ -595,8 +1199,8 @@ assert_contains "preflight warns once when low" "$out" "Low disk on /data (hosts
 # `set +e` and would mask the crash — so a re-introduced df-on-missing-dir would actually abort here.
 fresh_map="$DM=/data /data=/data"
 PATH="$DISK/bin:$PATH" DF_MAP="$fresh_map" DF_AVAIL_KB=629145600 DF_AVAIL_H=600G \
-  bash -c 'source "$1" 2>/dev/null; check_disk_grouped preflight 1 "$2/fresh/monero" "$2/fresh/tari" "$2/fresh/p2pool" "$2/fresh/dashboard" "$2/fresh/tor"' \
-  _ "$STACK" "$DM" >/dev/null 2>&1
+    bash -c 'source "$1" 2>/dev/null; check_disk_grouped preflight 1 "$2/fresh/monero" "$2/fresh/tari" "$2/fresh/p2pool" "$2/fresh/dashboard" "$2/fresh/tor"' \
+    _ "$STACK" "$DM" >/dev/null 2>&1
 assert_rc "check_disk_grouped survives not-yet-created data dirs under set -e (#179)" "$?" "0"
 
 echo "== node configs: no clearnet DNS egress (#161 monerod, #162 tari) =="
@@ -604,24 +1208,28 @@ MONC="$ROOT/build/monero/bitmonero.conf.template"
 TARC="$ROOT/build/tari/config.toml.template"
 # monerod (#161): hostname priority-nodes dropped; DNS checkpoints + update check off.
 case "$(cat "$MONC")" in
-    *xmrvsbeast.com:18080*|*nodes.hashvault.pro*) bad "monerod: priority-node hostnames dropped (#161)" "still present" ;;
-    *) ok "monerod: priority-node hostnames dropped (#161)" ;;
+*xmrvsbeast.com:18080* | *nodes.hashvault.pro*) bad "monerod: priority-node hostnames dropped (#161)" "still present" ;;
+*) ok "monerod: priority-node hostnames dropped (#161)" ;;
 esac
 case "$(grep -E '^enforce-dns-checkpointing' "$MONC" || true)" in
-    "") ok "monerod: enforce-dns-checkpointing removed (#161)" ;;
-    *)  bad "monerod: enforce-dns-checkpointing removed (#161)" "still present" ;;
+"") ok "monerod: enforce-dns-checkpointing removed (#161)" ;;
+*) bad "monerod: enforce-dns-checkpointing removed (#161)" "still present" ;;
 esac
 assert_contains "monerod: DNS checkpoints disabled (#161)" "$(cat "$MONC")" "disable-dns-checkpoints=1"
-assert_contains "monerod: update check disabled (#161)"    "$(cat "$MONC")" "check-updates=disabled"
+assert_contains "monerod: update check disabled (#161)" "$(cat "$MONC")" "check-updates=disabled"
 # tari (#162): no DNS seeds; peer_seeds onion-only; the inert check_for_updates gRPC method dropped.
 assert_contains "tari: DNS seeds disabled (#162)" "$(cat "$TARC")" "dns_seeds = []"
+# #271: minotari defaults proxy_bypass_for_outbound_tcp=true → it direct-dials peers advertising a bare
+# /ip4 (clearnet) address, bypassing Tor. false routes every dial through the SOCKS proxy (reach those
+# peers via Tor exits) — so Tari is functional AND never touches clearnet directly.
+assert_contains "tari: outbound TCP dials routed via Tor SOCKS, not direct (#271)" "$(cat "$TARC")" "proxy_bypass_for_outbound_tcp = false"
 case "$(grep -E '::/ip4/|::/ip6/' "$TARC" || true)" in
-    "") ok "tari: peer_seeds are onion-only (#162)" ;;
-    *)  bad "tari: peer_seeds are onion-only (#162)" "clearnet /ip4//ip6/ peer seeds present" ;;
+"") ok "tari: peer_seeds are onion-only (#162)" ;;
+*) bad "tari: peer_seeds are onion-only (#162)" "clearnet /ip4//ip6/ peer seeds present" ;;
 esac
 case "$(grep -E 'check_for_updates' "$TARC" || true)" in
-    "") ok "tari: check_for_updates dropped from gRPC allow-list (#162)" ;;
-    *)  bad "tari: check_for_updates dropped from gRPC allow-list (#162)" "still present" ;;
+"") ok "tari: check_for_updates dropped from gRPC allow-list (#162)" ;;
+*) bad "tari: check_for_updates dropped from gRPC allow-list (#162)" "still present" ;;
 esac
 # The Pulse (checkpoints.tari.com TXT, ~120s) is the last clearnet DNS path: the tari container's
 # resolver is pointed at a dead local address so the lookup fails without a packet leaving the host
@@ -629,32 +1237,42 @@ esac
 # service-discovery dependency is broken. Assert no clearnet resolvers remain on the tari service.
 TARI_SVC="$(awk '/^  tari:/{f=1;print;next} f&&/^  [a-z]/{f=0} f' "$ROOT/docker-compose.yml")"
 case "$TARI_SVC" in
-    *1.1.1.1*|*8.8.8.8*) bad "tari: clearnet DNS resolvers removed from compose (#162)" "1.1.1.1/8.8.8.8 present" ;;
-    *)                   ok "tari: clearnet DNS resolvers removed from compose (#162)" ;;
+*1.1.1.1* | *8.8.8.8*) bad "tari: clearnet DNS resolvers removed from compose (#162)" "1.1.1.1/8.8.8.8 present" ;;
+*) ok "tari: clearnet DNS resolvers removed from compose (#162)" ;;
 esac
 assert_contains "tari: resolver pointed at dead local sinkhole (#162)" "$TARI_SVC" "127.0.0.1"
 
 # ---------------------------------------------------------------------------
 echo "== black-box: CLI dispatch =="
-"$STACK" help >/dev/null 2>&1; assert_rc "help exits 0" "$?" "0"
+"$STACK" help >/dev/null 2>&1
+assert_rc "help exits 0" "$?" "0"
 assert_contains "help shows usage" "$("$STACK" help 2>&1)" "Usage:"
-out="$("$STACK" frobnicate 2>&1)"; rc=$?
+out="$("$STACK" frobnicate 2>&1)"
+rc=$?
 assert_rc "unknown command fails" "$rc" "1"
 assert_contains "unknown command message" "$out" "Unknown command"
 
 echo "== black-box: guards =="
-G="$SANDBOX/guard"; mkdir -p "$G/build/tari"; cp "$STACK" "$G/pithead"
+G="$SANDBOX/guard"
+mkdir -p "$G/build/tari"
+cp "$STACK" "$G/pithead"
 cp "$ROOT/build/tari/config.toml.template" "$G/build/tari/" 2>/dev/null || true
 make_stubs "$G/bin"
-out="$(cd "$G" && PATH="$G/bin:$PATH" ./pithead apply 2>&1)"; rc=$?
+out="$(cd "$G" && PATH="$G/bin:$PATH" ./pithead apply 2>&1)"
+rc=$?
 assert_rc "apply without .env fails" "$rc" "1"
 assert_contains "apply needs setup" "$out" "setup"
 
 echo "== black-box: config validation =="
-V="$SANDBOX/val"; mkdir -p "$V/build/tari" "$V/build/dashboard"; : > "$V/build/dashboard/Dockerfile"; cp "$STACK" "$V/pithead"; make_stubs "$V/bin"
+V="$SANDBOX/val"
+mkdir -p "$V/build/tari" "$V/build/dashboard"
+: >"$V/build/dashboard/Dockerfile"
+cp "$STACK" "$V/pithead"
+make_stubs "$V/bin"
 cp "$ROOT/build/tari/config.toml.template" "$V/build/tari/"
 mkdir -p "$V/data/monero" "$V/data/tari" "$V/data/p2pool" "$V/data/tor" "$V/data/dashboard" "$V/data/p2pool/stats"
-seed_env() { cat > "$V/.env" <<EOF
+seed_env() {
+    cat >"$V/.env" <<EOF
 MONERO_ONION_ADDRESS=mona.onion
 TARI_ONION_ADDRESS=taria.onion
 P2POOL_ONION_ADDRESS=p2pa.onion
@@ -664,59 +1282,104 @@ DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 EOF
 }
-WALLET="4$(printf 'A%.0s' $(seq 94))"   # 95-char mainnet primary (starts with 4); #250 now hard-validates this
+WALLET="4$(printf 'A%.0s' $(seq 94))" # 95-char mainnet primary (starts with 4); #250 now hard-validates this
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"banana"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"banana"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "invalid pool rejected" "$rc" "1"
 assert_contains "invalid pool message" "$out" "p2pool.pool"
 
 # A non-IP stratum_bind must be rejected before it reaches the compose port mapping.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main","stratum_bind":"not-an-ip"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main","stratum_bind":"not-an-ip"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "invalid stratum_bind rejected" "$rc" "1"
 assert_contains "invalid stratum_bind message" "$out" "p2pool.stratum_bind"
 
 # A dashboard.host with Caddyfile-breaking characters (space/braces) must be rejected before render.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"bad host{x}"} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"bad host{x}"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "invalid dashboard.host rejected" "$rc" "1"
 assert_contains "invalid dashboard.host message" "$out" "dashboard.host"
 
 # proxy.donate_level must be an integer 0-99 (default 0); an out-of-range value is rejected (#173).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":150}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":150}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "out-of-range donate_level rejected" "$rc" "1"
 assert_contains "donate_level message" "$out" "proxy.donate_level"
 # Non-numeric donate_level is rejected (the "auto" sentinel was removed — the value is a plain integer).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":"auto"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":"auto"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "non-numeric donate_level rejected" "$rc" "1"
 
 # A stratum_password with a shell/.env-unsafe character (a space) is rejected before render (#152).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main","stratum_password":"bad pass"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main","stratum_password":"bad pass"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "unsafe stratum_password rejected" "$rc" "1"
 assert_contains "stratum_password message" "$out" "p2pool.stratum_password"
 
 # Dashboard login (#8): a username with a Caddyfile-unsafe character (a space) is rejected before any
 # hashing; the password is validated for length/charset too. Both fail fast on apply.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"bad user","password":"longenough1"}} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"bad user","password":"longenough1"}} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "invalid dashboard.auth.username rejected" "$rc" "1"
 assert_contains "dashboard.auth.username message" "$out" "dashboard.auth.username"
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"short"}} }\n' "$WALLET" > "$V/config.json"
-out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"short"}} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "too-short dashboard.auth.password rejected" "$rc" "1"
 assert_contains "dashboard.auth.password message" "$out" "dashboard.auth.password"
 
+# Wallet-type hard-fail (#250): p2pool pays via coinbase, which CANNOT reach a subaddress or an
+# integrated address — a wrong type MINES but is NEVER paid, silently. monero_address_type is
+# unit-tested in isolation; these prove parse_and_validate_config actually ABORTS apply on each,
+# so the guardrail against losing every reward is wired, not just present.
+SUBADDR="8$(printf 'A%.0s' $(seq 94))"  # 95-char, starts with 8 -> subaddress
+INTADDR="4$(printf 'A%.0s' $(seq 105))" # 106-char, starts with 4 -> integrated
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$SUBADDR" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
+assert_rc "subaddress payout rejected (would never be paid)" "$rc" "1"
+assert_contains "subaddress message names the type" "$out" "SUBADDRESS"
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$INTADDR" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
+assert_rc "integrated payout rejected (would never be paid)" "$rc" "1"
+assert_contains "integrated message names the type" "$out" "INTEGRATED"
+
+# Remote mode with no host (#*): renders an empty MONERO_NODE_HOST -> p2pool/dashboard dial nothing,
+# mining can't start. Must abort at validation, not silently proceed.
+seed_env
+printf '{ "monero": {"mode":"remote","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
+assert_rc "remote mode without a host rejected" "$rc" "1"
+assert_contains "remote-host message" "$out" "monero.remote.host"
+
+# A malformed network.subnet (#180): anything but an X.Y.Z.0/24 block renders a broken NETWORK_PREFIX
+# into every service IP and the #270 firewall rules — reject before it can.
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "network":{"subnet":"172.28.0.0/16"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
+assert_rc "non-/24 network.subnet rejected" "$rc" "1"
+assert_contains "network.subnet message" "$out" "network.subnet"
+
 echo "== black-box: dashboard auth lifecycle (#8) =="
 # The hashing reads the pinned Caddy image out of docker-compose.yml and shells out to the stubbed
 # `caddy hash-password`, so the whole enable → reuse → change → disable path runs offline.
@@ -725,66 +1388,71 @@ AUTH_LOG="$V/auth-docker.log"
 
 # (1) ENABLE: a password turns on basic_auth — hash + fingerprint persisted, plaintext never stored.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":0}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"hunter2hunter2"}} }\n' "$WALLET" > "$V/config.json"
-: > "$AUTH_LOG"
-out="$(cd "$V" && DOCKER_LOG="$AUTH_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":0}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"hunter2hunter2"}} }\n' "$WALLET" >"$V/config.json"
+: >"$AUTH_LOG"
+out="$(cd "$V" && DOCKER_LOG="$AUTH_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "auth enable applies cleanly" "$rc" "0"
 assert_eq "auth username persisted" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_AUTH_USER)" "admin"
 hash1="$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_AUTH_HASH_B64)"
 fp1="$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_AUTH_PW_FP)"
 [ -n "$hash1" ] && ok "auth hash persisted (base64)" || bad "auth hash persisted (base64)" "empty"
-[ -n "$fp1" ]   && ok "auth fingerprint persisted"   || bad "auth fingerprint persisted"   "empty"
+[ -n "$fp1" ] && ok "auth fingerprint persisted" || bad "auth fingerprint persisted" "empty"
 assert_contains "auth hashed via the pinned caddy image" "$(cat "$AUTH_LOG")" "hash-password"
-assert_contains "Caddyfile gains basic_auth"             "$(cat "$V/Caddyfile")" "basic_auth"
+assert_contains "Caddyfile gains basic_auth" "$(cat "$V/Caddyfile")" "basic_auth"
 case "$(cat "$V/.env" "$V/Caddyfile")" in
-    *hunter2hunter2*) bad "auth plaintext never persisted" "password leaked into .env/Caddyfile" ;;
-    *)                ok  "auth plaintext never persisted" ;;
+*hunter2hunter2*) bad "auth plaintext never persisted" "password leaked into .env/Caddyfile" ;;
+*) ok "auth plaintext never persisted" ;;
 esac
 
 # (2) REUSE: re-applying (here nudging an unrelated knob) keeps the SAME hash and does NOT re-hash —
 # bcrypt is salted, so a stable fingerprint is what keeps the Caddyfile from churning every apply.
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":1}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"hunter2hunter2"}} }\n' "$WALLET" > "$V/config.json"
-: > "$AUTH_LOG"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":1}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"hunter2hunter2"}} }\n' "$WALLET" >"$V/config.json"
+: >"$AUTH_LOG"
 out="$(cd "$V" && DOCKER_LOG="$AUTH_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "unchanged password keeps the same hash" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_AUTH_HASH_B64)" "$hash1"
 case "$(cat "$AUTH_LOG")" in
-    *hash-password*) bad "unchanged password is not re-hashed" "caddy hash-password was called again" ;;
-    *)               ok  "unchanged password is not re-hashed (stable hash)" ;;
+*hash-password*) bad "unchanged password is not re-hashed" "caddy hash-password was called again" ;;
+*) ok "unchanged password is not re-hashed (stable hash)" ;;
 esac
 
 # (3) CHANGE: a new password re-hashes (fingerprint changes) and recreates the caddy container.
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":1}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"freshpass99"}} }\n' "$WALLET" > "$V/config.json"
-: > "$AUTH_LOG"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":1}, "dashboard":{"secure":true,"host":"box.lan","auth":{"username":"admin","password":"freshpass99"}} }\n' "$WALLET" >"$V/config.json"
+: >"$AUTH_LOG"
 out="$(cd "$V" && DOCKER_LOG="$AUTH_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
-assert_contains "changed password re-hashes"     "$(cat "$AUTH_LOG")" "hash-password"
+assert_contains "changed password re-hashes" "$(cat "$AUTH_LOG")" "hash-password"
 assert_eq "changed password updates fingerprint" "$([ "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_AUTH_PW_FP)" != "$fp1" ] && echo changed)" "changed"
-assert_contains "auth change recreates caddy"     "$(cat "$AUTH_LOG")" "restart caddy"
+assert_contains "auth change recreates caddy" "$(cat "$AUTH_LOG")" "restart caddy"
 
 # (4) DISABLE: clearing the password drops basic_auth — hash cleared, dashboard reachable again.
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":1}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "proxy":{"donate_level":1}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$AUTH_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "auth disable clears the hash" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_AUTH_HASH_B64)" ""
 case "$(cat "$V/Caddyfile")" in
-    *basic_auth*) bad "auth disable drops basic_auth" "basic_auth still present in the Caddyfile" ;;
-    *)            ok  "auth disable drops basic_auth" ;;
+*basic_auth*) bad "auth disable drops basic_auth" "basic_auth still present in the Caddyfile" ;;
+*) ok "auth disable drops basic_auth" ;;
 esac
 
 echo "== black-box: apply preserves secrets + propagates =="
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
-DOCKER_LOG="$V/docker.log"; : > "$DOCKER_LOG"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
+DOCKER_LOG="$V/docker.log"
+: >"$DOCKER_LOG"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
-assert_eq "pool flag propagated"  "$(run_sourced "$V" env_get_file "$V/.env" P2POOL_FLAGS)"  "--mini"
-assert_eq "stratum_bind default"  "$(run_sourced "$V" env_get_file "$V/.env" STRATUM_BIND)" "0.0.0.0"
-assert_eq "token preserved"       "$(run_sourced "$V" env_get_file "$V/.env" PROXY_AUTH_TOKEN)" "ORIGINALTOKEN"
-assert_eq "onion preserved"       "$(run_sourced "$V" env_get_file "$V/.env" P2POOL_ONION_ADDRESS)" "p2pa.onion"
-assert_eq "tari_required default"  "$(run_sourced "$V" env_get_file "$V/.env" TARI_REQUIRED)" "true"
+assert_contains "pool flag propagated" "$(run_sourced "$V" env_get_file "$V/.env" P2POOL_FLAGS)" "--mini"
+# Default routes outbound sidechain P2P through Tor (#165): the rendered P2POOL_FLAGS carries the
+# pool flag AND the Tor SOCKS flags (no p2pool.clearnet set in this config).
+assert_contains "outbound P2P via Tor by default (#165)" "$(run_sourced "$V" env_get_file "$V/.env" P2POOL_FLAGS)" "--socks5 172.28.0.25:9050 --socks5-proxy-type tor"
+assert_eq "stratum_bind default" "$(run_sourced "$V" env_get_file "$V/.env" STRATUM_BIND)" "0.0.0.0"
+assert_eq "token preserved" "$(run_sourced "$V" env_get_file "$V/.env" PROXY_AUTH_TOKEN)" "ORIGINALTOKEN"
+assert_eq "onion preserved" "$(run_sourced "$V" env_get_file "$V/.env" P2POOL_ONION_ADDRESS)" "p2pa.onion"
+assert_eq "tari_required default" "$(run_sourced "$V" env_get_file "$V/.env" TARI_REQUIRED)" "true"
 # The new-release check (#224) defaults ON when absent from config — it's Tor-routed, so it leaks
 # nothing, and an operator who wants zero GitHub contact sets check_for_updates:false to opt out.
 assert_eq "check_for_updates default on" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_CHECK_UPDATES)" "true"
 # Both new xmrig-proxy knobs default to OFF/no-fee when absent from config (#152/#173).
-assert_eq "stratum auth off by default"        "$(run_sourced "$V" env_get_file "$V/.env" PROXY_STRATUM_PASSWORD)" ""
-assert_eq "donate-level 0 by default (no fee)"  "$(run_sourced "$V" env_get_file "$V/.env" PROXY_DONATE_LEVEL)" "0"
+assert_eq "stratum auth off by default" "$(run_sourced "$V" env_get_file "$V/.env" PROXY_STRATUM_PASSWORD)" ""
+assert_eq "donate-level 0 by default (no fee)" "$(run_sourced "$V" env_get_file "$V/.env" PROXY_DONATE_LEVEL)" "0"
 # Build provenance is exported for the build args, not persisted to .env (Issue #58) — so a git pull
 # never shows up as a config change. Assert it stays out of the rendered .env.
 assert_eq "provenance not written to .env" "$(run_sourced "$V" env_get_file "$V/.env" PITHEAD_VERSION)" ""
@@ -793,41 +1461,44 @@ assert_contains "compose up called (build mode)" "$(cat "$DOCKER_LOG")" "compose
 # Regression (Issue #58): a second apply with nothing changed must report no changes and exit 0
 # cleanly — never tripping the ERR trap. (Provenance keys briefly leaked into this diff; when they
 # were the only delta the filter emptied the pipeline and `set -o pipefail` aborted apply.)
-out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "no-op apply exits 0" "$rc" "0"
 assert_contains "no-op apply reports no changes" "$out" "No configuration changes detected"
 case "$out" in
-    *"aborted unexpectedly"*) bad "no-op apply does not trip the error trap" "got: $out" ;;
-    *) ok "no-op apply does not trip the error trap" ;;
+*"aborted unexpectedly"*) bad "no-op apply does not trip the error trap" "got: $out" ;;
+*) ok "no-op apply does not trip the error trap" ;;
 esac
 # tari.mem_limit absent => "auto" is a safety ceiling: host RAM minus a >=2 GB reserve, floored at
 # 2048m. Assert it ends in 'm', is >= the 2048m floor, and never exceeds physical RAM.
 mem="$(run_sourced "$V" env_get_file "$V/.env" TARI_MEM_LIMIT)"
 host_ram_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null || echo 0)
 case "$mem" in
-    *m) n="${mem%m}"
-        if [ "$n" -ge 2048 ] && { [ "$host_ram_mb" -le 0 ] || [ "$n" -le "$host_ram_mb" ]; }
-        then ok "tari mem auto is a sane ceiling ($mem, host ${host_ram_mb}m)"
-        else bad "tari mem auto sane ceiling" "got [$mem] on ${host_ram_mb}m host"; fi ;;
-    *) bad "tari mem auto has m suffix" "got [$mem]" ;;
+*m)
+    n="${mem%m}"
+    if [ "$n" -ge 2048 ] && { [ "$host_ram_mb" -le 0 ] || [ "$n" -le "$host_ram_mb" ]; }; then
+        ok "tari mem auto is a sane ceiling ($mem, host ${host_ram_mb}m)"
+    else bad "tari mem auto sane ceiling" "got [$mem] on ${host_ram_mb}m host"; fi
+    ;;
+*) bad "tari mem auto has m suffix" "got [$mem]" ;;
 esac
 
 # Non-blocking Tari (dashboard.tari_required:false) propagates as TARI_REQUIRED=false.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan","tari_required":false} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan","tari_required":false} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "tari_required propagated false" "$(run_sourced "$V" env_get_file "$V/.env" TARI_REQUIRED)" "false"
 
 # Opting out (dashboard.check_for_updates:false) propagates as DASHBOARD_CHECK_UPDATES=false (#224) —
 # only an explicit false disables it (anything else, incl. absent, stays the default-on true).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan","check_for_updates":false} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan","check_for_updates":false} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "check_for_updates opt-out propagated false" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_CHECK_UPDATES)" "false"
 
 # An explicit tari.mem_limit is passed through verbatim (overriding the "auto" host-RAM scaling).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T","mem_limit":"3072m"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T","mem_limit":"3072m"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "tari mem_limit explicit propagated" "$(run_sourced "$V" env_get_file "$V/.env" TARI_MEM_LIMIT)" "3072m"
 
@@ -835,7 +1506,7 @@ echo "== black-box: xmrig-proxy knobs (#152 stratum auth, #173 donate-level) =="
 # stratum_password "auto" generates + persists a stable secret and surfaces it for rigs; an explicit
 # proxy.donate_level propagates verbatim.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini","stratum_password":"auto"}, "proxy":{"donate_level":1}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini","stratum_password":"auto"}, "proxy":{"donate_level":1}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 sp1="$(run_sourced "$V" env_get_file "$V/.env" PROXY_STRATUM_PASSWORD)"
 case "$sp1" in ?*) ok "stratum_password auto generated a secret" ;; *) bad "stratum_password auto generated a secret" "got empty" ;; esac
@@ -849,21 +1520,21 @@ echo "== black-box: clearnet initial sync render (#183) =="
 # Default (no flags): both daemons stay Tor-only — .env flags are false and the rendered Tari config
 # keeps the Tor transport, empty DNS seeds, and an onion public address.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "monero clearnet off by default" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_CLEARNET_SYNC)" "false"
-assert_eq "tari clearnet off by default"   "$(run_sourced "$V" env_get_file "$V/.env" TARI_CLEARNET_SYNC)" "false"
-assert_contains "tari default: Tor transport"    "$(cat "$V/build/tari/config.toml")" 'type = "tor"'
-assert_contains "tari default: DNS seeds empty"   "$(cat "$V/build/tari/config.toml")" "dns_seeds = []"
-assert_contains "tari default: advertises onion"  "$(cat "$V/build/tari/config.toml")" "/onion3/"
+assert_eq "tari clearnet off by default" "$(run_sourced "$V" env_get_file "$V/.env" TARI_CLEARNET_SYNC)" "false"
+assert_contains "tari default: Tor transport" "$(cat "$V/build/tari/config.toml")" 'type = "tor"'
+assert_contains "tari default: DNS seeds empty" "$(cat "$V/build/tari/config.toml")" "dns_seeds = []"
+assert_contains "tari default: advertises onion" "$(cat "$V/build/tari/config.toml")" "/onion3/"
 
 # Monero clearnet ON (Tari left off): only the Monero flag flips; Tari stays Tor. The apply preview
 # must spell out the clearnet exposure (it's a DEST change).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p","clearnet_initial_sync":true}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p","clearnet_initial_sync":true}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "monero clearnet flag propagated true" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_CLEARNET_SYNC)" "true"
-assert_eq "tari clearnet still false"            "$(run_sourced "$V" env_get_file "$V/.env" TARI_CLEARNET_SYNC)" "false"
+assert_eq "tari clearnet still false" "$(run_sourced "$V" env_get_file "$V/.env" TARI_CLEARNET_SYNC)" "false"
 assert_contains "tari stays Tor when only monero is clearnet" "$(cat "$V/build/tari/config.toml")" 'type = "tor"'
 assert_contains "apply preview warns clearnet exposure" "$out" "CLEARNET"
 
@@ -872,36 +1543,46 @@ assert_contains "apply preview warns clearnet exposure" "$out" "CLEARNET"
 # stays Tor even with the flag on. That's what lets the node return to Tor on its own after sync
 # without pithead re-rendering clearnet over it.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T","clearnet_initial_sync":true}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T","clearnet_initial_sync":true}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "tari clearnet flag propagated true" "$(run_sourced "$V" env_get_file "$V/.env" TARI_CLEARNET_SYNC)" "true"
-assert_contains "tari host-render stays Tor even with flag on (#234)"  "$(cat "$V/build/tari/config.toml")" 'type = "tor"'
-assert_contains "tari host-render keeps DNS seeds empty (#234)"        "$(cat "$V/build/tari/config.toml")" "dns_seeds = []"
-assert_contains "tari host-render still advertises the onion (#234)"   "$(cat "$V/build/tari/config.toml")" "/onion3/"
+assert_contains "tari host-render stays Tor even with flag on (#234)" "$(cat "$V/build/tari/config.toml")" 'type = "tor"'
+assert_contains "tari host-render keeps DNS seeds empty (#234)" "$(cat "$V/build/tari/config.toml")" "dns_seeds = []"
+assert_contains "tari host-render still advertises the onion (#234)" "$(cat "$V/build/tari/config.toml")" "/onion3/"
 
 # Truthy parse consistency (#183): a JSON string "yes" reads as enabled, like normalize_bool/MONERO_PRUNE.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p","clearnet_initial_sync":"yes"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p","clearnet_initial_sync":"yes"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "monero clearnet truthy 'yes' => true" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_CLEARNET_SYNC)" "true"
 
 # doctor flags the active clearnet sync (read-only). Re-render Tor-only first so later sections see a
 # clean default, then assert doctor's WARN/OK both ways.
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_contains "doctor: OK when Tor-only (#183)" "$(cd "$V" && PATH="$V/bin:$PATH" ./pithead doctor 2>&1)" "Tor-only"
 
+# p2pool compose↔image coupling fail-safe (#273): clearnet is off, so apply renders P2POOL_FLAGS with
+# the #165 --socks5. doctor reads the RUNNING p2pool argv (/proc/1/cmdline, stubbed via P2POOL_PROC1)
+# and must FAIL loudly if --socks5 is absent (a stale pre-#165 image silently dropping the env flags),
+# and pass when it IS present. The config above (p2pool.pool=mini, clearnet default off) is reused.
+dr273() { cd "$V" && P2POOL_PROC1="$1" PATH="$V/bin:$PATH" ./pithead doctor 2>&1; }
+assert_contains "doctor FAILs when p2pool isn't on Tor — stale image (#273)" \
+    "$(dr273 'p2pool --host 172.28.0.26 --rpc-port 18081 --mini')" "STALE p2pool image"
+assert_contains "doctor OK when p2pool IS routed over Tor (#273)" \
+    "$(dr273 'p2pool --host 172.28.0.26 --mini --socks5 172.28.0.25:9050 --socks5-proxy-type tor')" "routes outbound sidechain P2P via Tor"
+
 echo "== black-box: local node creds auto-generated + persisted (#50) =="
 # A local node with BLANK creds: apply must generate them, write them into .env AND back into
 # config.json, and keep them stable on a second apply (don't regenerate every run).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"","node_password":""}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"","node_password":""}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_contains "auto-gen is logged" "$out" "Auto-generated missing local"
 env_pass="$(run_sourced "$V" env_get_file "$V/.env" MONERO_NODE_PASSWORD)"
 assert_eq "blank username -> admin in .env" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_NODE_USERNAME)" "admin"
-assert_eq "generated password is 32 chars"  "${#env_pass}" "32"
+assert_eq "generated password is 32 chars" "${#env_pass}" "32"
 assert_eq "username persisted to config.json" "$(jq -r '.monero.node_username' "$V/config.json")" "admin"
 assert_eq "password persisted to config.json" "$(jq -r '.monero.node_password' "$V/config.json")" "$env_pass"
 # Second apply must not rotate the now-populated creds.
@@ -910,7 +1591,7 @@ assert_eq "password stable across apply" "$(jq -r '.monero.node_password' "$V/co
 
 # A REMOTE node with blank creds means "no auth" — leave it empty, don't invent credentials.
 seed_env
-printf '{ "monero": {"mode":"remote","wallet_address":"%s","node_username":"","node_password":"","remote":{"host":"node.example.com"}}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"remote","wallet_address":"%s","node_username":"","node_password":"","remote":{"host":"node.example.com"}}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "remote username left blank" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_NODE_USERNAME)" ""
 assert_eq "remote creds not persisted" "$(jq -r '.monero.node_username' "$V/config.json")" ""
@@ -918,29 +1599,33 @@ assert_eq "remote creds not persisted" "$(jq -r '.monero.node_username' "$V/conf
 # Custom remote rpc_port/zmq_port propagate to .env (the dashboard + p2pool read these to reach the
 # node); both default to 18081/18083 but an operator can point at a node on non-standard ports.
 seed_env
-printf '{ "monero": {"mode":"remote","wallet_address":"%s","node_username":"","node_password":"","remote":{"host":"node.example.com","rpc_port":28081,"zmq_port":28083}}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"remote","wallet_address":"%s","node_username":"","node_password":"","remote":{"host":"node.example.com","rpc_port":28081,"zmq_port":28083}}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "remote rpc_port propagated" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_RPC_PORT)" "28081"
 assert_eq "remote zmq_port propagated" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_ZMQ_PORT)" "28083"
 # And the defaults apply when omitted (local node).
 seed_env
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$V/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "zmq_port defaults to 18083" "$(run_sourced "$V" env_get_file "$V/.env" MONERO_ZMQ_PORT)" "18083"
 
 # `logs` forwards its service argument to `docker compose logs -f` (read-only follow).
 seed_env
-: > "$DOCKER_LOG"
+: >"$DOCKER_LOG"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead logs monerod 2>&1)"
 assert_contains "logs follows (-f) the named service" "$(cat "$DOCKER_LOG")" "compose logs -f monerod"
 
 echo "== black-box: upgrade re-renders generated config (#128) =="
 # `upgrade` used to be just `up --build`, leaving the generated .env/Caddyfile/Tari config stale
 # after a git pull. It must now re-render them while preserving secrets.
-U="$SANDBOX/upgrade"; mkdir -p "$U/build/tari" "$U/build/dashboard" "$U/data/monero" "$U/data/tari" "$U/data/p2pool/stats" "$U/data/tor" "$U/data/dashboard"; : > "$U/build/dashboard/Dockerfile"
-cp "$STACK" "$U/pithead"; make_stubs "$U/bin"; cp "$ROOT/build/tari/config.toml.template" "$U/build/tari/"
+U="$SANDBOX/upgrade"
+mkdir -p "$U/build/tari" "$U/build/dashboard" "$U/data/monero" "$U/data/tari" "$U/data/p2pool/stats" "$U/data/tor" "$U/data/dashboard"
+: >"$U/build/dashboard/Dockerfile"
+cp "$STACK" "$U/pithead"
+make_stubs "$U/bin"
+cp "$ROOT/build/tari/config.toml.template" "$U/build/tari/"
 # Stale .env: secrets present, but STRATUM_BIND (a rendered var) is missing — the upgrade must fill it.
-cat > "$U/.env" <<EOF
+cat >"$U/.env" <<EOF
 MONERO_ONION_ADDRESS=mona.onion
 TARI_ONION_ADDRESS=taria.onion
 P2POOL_ONION_ADDRESS=p2pa.onion
@@ -949,12 +1634,14 @@ HOST_IP=box.lan
 DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 EOF
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$U/config.json"
-UL="$U/docker.log"; : > "$UL"
-out="$(cd "$U" && DOCKER_LOG="$UL" PATH="$U/bin:$PATH" ./pithead upgrade 2>&1)"; rc=$?
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$U/config.json"
+UL="$U/docker.log"
+: >"$UL"
+out="$(cd "$U" && DOCKER_LOG="$UL" PATH="$U/bin:$PATH" ./pithead upgrade 2>&1)"
+rc=$?
 assert_rc "upgrade exits 0" "$rc" "0"
 assert_eq "upgrade re-renders a missing var (STRATUM_BIND)" "$(run_sourced "$U" env_get_file "$U/.env" STRATUM_BIND)" "0.0.0.0"
-assert_eq "upgrade preserves the proxy token"               "$(run_sourced "$U" env_get_file "$U/.env" PROXY_AUTH_TOKEN)" "ORIGINALTOKEN"
+assert_eq "upgrade preserves the proxy token" "$(run_sourced "$U" env_get_file "$U/.env" PROXY_AUTH_TOKEN)" "ORIGINALTOKEN"
 # render_env writes DEPLOYMENT_COMPLETED=${DEPLOYMENT_COMPLETED:-false} and load_preserved_state
 # doesn't carry it, so upgrade must re-assert it — else the flag flips to false and the NEXT
 # require_deployed command (up/apply/upgrade) errors "run setup" on an already-deployed box.
@@ -967,10 +1654,12 @@ assert_contains "upgrade pulls non-buildable images first (digest bumps)" "$(cat
 
 echo "== black-box: apply recovers from a failed 'compose up' (#125) =="
 # A docker stub that fails `compose up -d --remove-orphans` only when FAIL_UP=1 (else succeeds).
-A="$SANDBOX/applyfail"; mkdir -p "$A/build/tari" "$A/build/dashboard" "$A/bin" "$A/data/monero" "$A/data/tari" "$A/data/p2pool/stats" "$A/data/tor" "$A/data/dashboard"
-: > "$A/build/dashboard/Dockerfile"   # source-checkout marker → pithead builds (--pull never), #44
-cp "$STACK" "$A/pithead"; cp "$ROOT/build/tari/config.toml.template" "$A/build/tari/"
-cat > "$A/bin/docker" <<'EOF'
+A="$SANDBOX/applyfail"
+mkdir -p "$A/build/tari" "$A/build/dashboard" "$A/bin" "$A/data/monero" "$A/data/tari" "$A/data/p2pool/stats" "$A/data/tor" "$A/data/dashboard"
+: >"$A/build/dashboard/Dockerfile" # source-checkout marker → pithead builds (--pull never), #44
+cp "$STACK" "$A/pithead"
+cp "$ROOT/build/tari/config.toml.template" "$A/build/tari/"
+cat >"$A/bin/docker" <<'EOF'
 #!/usr/bin/env bash
 echo "[docker] $*" >> "${DOCKER_LOG:-/dev/null}"
 case "$*" in
@@ -982,8 +1671,9 @@ case "$*" in
 esac
 exit 0
 EOF
-printf '#!/usr/bin/env bash\nexit 0\n' > "$A/bin/sudo"; chmod +x "$A/bin/docker" "$A/bin/sudo"
-cat > "$A/.env" <<EOF
+printf '#!/usr/bin/env bash\nexit 0\n' >"$A/bin/sudo"
+chmod +x "$A/bin/docker" "$A/bin/sudo"
+cat >"$A/.env" <<EOF
 MONERO_ONION_ADDRESS=mona.onion
 TARI_ONION_ADDRESS=taria.onion
 P2POOL_ONION_ADDRESS=p2pa.onion
@@ -992,23 +1682,30 @@ HOST_IP=box.lan
 DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 EOF
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" > "$A/config.json"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$A/config.json"
 # First apply: real config delta committed, but `compose up` FAILS -> marker left, rc 1, guidance.
-out="$(cd "$A" && FAIL_UP=1 PATH="$A/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
+out="$(cd "$A" && FAIL_UP=1 PATH="$A/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
 assert_rc "apply fails (rc 1) when compose up fails" "$rc" "1"
-assert_contains "apply prints recovery guidance"     "$out" "were NOT recreated"
-if [ -f "$A/.env.apply-incomplete" ]; then mk=present; else mk=absent; fi; assert_eq "apply leaves the incomplete marker" "$mk" "present"
+assert_contains "apply prints recovery guidance" "$out" "were NOT recreated"
+if [ -f "$A/.env.apply-incomplete" ]; then mk=present; else mk=absent; fi
+assert_eq "apply leaves the incomplete marker" "$mk" "present"
 # Second apply: config already committed (no delta), but the marker forces a retry, not a silent no-op.
-out="$(cd "$A" && FAIL_UP=0 PATH="$A/bin:$PATH" ./pithead apply -y 2>&1)"; rc=$?
-assert_rc "re-apply retries and succeeds (rc 0)"          "$rc" "0"
-assert_contains "re-apply re-attempts the recreate"      "$out" "retrying"
-if [ -f "$A/.env.apply-incomplete" ]; then mk=present; else mk=absent; fi; assert_eq "marker cleared after a successful retry" "$mk" "absent"
+out="$(cd "$A" && FAIL_UP=0 PATH="$A/bin:$PATH" ./pithead apply -y 2>&1)"
+rc=$?
+assert_rc "re-apply retries and succeeds (rc 0)" "$rc" "0"
+assert_contains "re-apply re-attempts the recreate" "$out" "retrying"
+if [ -f "$A/.env.apply-incomplete" ]; then mk=present; else mk=absent; fi
+assert_eq "marker cleared after a successful retry" "$mk" "absent"
 
 echo "== black-box: up warns about missing (relocated) data dirs (#126) =="
-RL="$SANDBOX/reloc"; mkdir -p "$RL/bin"; cp "$STACK" "$RL/pithead"; make_stubs "$RL/bin"
+RL="$SANDBOX/reloc"
+mkdir -p "$RL/bin"
+cp "$STACK" "$RL/pithead"
+make_stubs "$RL/bin"
 # Deployed, but .env names data dirs that don't exist — as if the install was moved/copied or a
 # second checkout is being run. The stack would silently re-sync; `up` must warn first.
-cat > "$RL/.env" <<EOF
+cat >"$RL/.env" <<EOF
 DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 HOST_IP=box.lan
@@ -1018,13 +1715,14 @@ P2POOL_DATA_DIR=/no/such/data/p2pool
 DASHBOARD_DATA_DIR=/no/such/data/dashboard
 TOR_DATA_DIR=/no/such/data/tor
 EOF
-out="$(cd "$RL" && PATH="$RL/bin:$PATH" ./pithead up 2>&1)"; rc=$?
-assert_rc "up still starts (rc 0)"               "$rc" "0"
+out="$(cd "$RL" && PATH="$RL/bin:$PATH" ./pithead up 2>&1)"
+rc=$?
+assert_rc "up still starts (rc 0)" "$rc" "0"
 assert_contains "up warns about a fresh re-sync" "$out" "start a FRESH sync"
 assert_contains "up names the missing monero dir" "$out" "MONERO_DATA_DIR → /no/such/data/monero"
 # A healthy deployment (dirs present) must NOT warn.
 mkdir -p "$RL/d/monero" "$RL/d/tari" "$RL/d/p2pool" "$RL/d/dashboard" "$RL/d/tor"
-cat > "$RL/.env" <<EOF
+cat >"$RL/.env" <<EOF
 DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 HOST_IP=box.lan
@@ -1037,15 +1735,16 @@ EOF
 out="$(cd "$RL" && PATH="$RL/bin:$PATH" ./pithead up 2>&1)"
 case "$out" in *"FRESH sync"*) bad "no false warning when data dirs exist" "got: $out" ;; *) ok "no false warning when data dirs exist" ;; esac
 # Gating: before the first deploy (no DEPLOYMENT_COMPLETED) the dirs are legitimately absent -> silent.
-printf 'MONERO_DATA_DIR=/no/such/monero\n' > "$RL/.env"
+printf 'MONERO_DATA_DIR=/no/such/monero\n' >"$RL/.env"
 assert_eq "missing_data_dirs silent before first deploy" "$(run_sourced "$RL" missing_data_dirs)" ""
 
 echo "== black-box: status health check =="
 # A docker stub driven by FAKE_STATES ("svc=state:health ..."; state "missing" = no container)
 # so we can script each service's state and assert how `status` reports it.
 make_status_stub() {
-    local bin="$1"; mkdir -p "$bin"
-    cat > "$bin/docker" <<'EOF'
+    local bin="$1"
+    mkdir -p "$bin"
+    cat >"$bin/docker" <<'EOF'
 #!/usr/bin/env bash
 sub="$*"
 case "$sub" in
@@ -1066,19 +1765,24 @@ exit 0
 EOF
     chmod +x "$bin/docker"
 }
-ST="$SANDBOX/status"; mkdir -p "$ST/bin"; cp "$STACK" "$ST/pithead"
+ST="$SANDBOX/status"
+mkdir -p "$ST/bin"
+cp "$STACK" "$ST/pithead"
 make_status_stub "$ST/bin"
-printf 'DEPLOYMENT_COMPLETED=true\nCOMPOSE_PROFILES=local_node\nHOST_IP=box.lan\n' > "$ST/.env"
+printf 'DEPLOYMENT_COMPLETED=true\nCOMPOSE_PROFILES=local_node\nHOST_IP=box.lan\n' >"$ST/.env"
 ALL_UP="tor=running:healthy monerod=running:healthy p2pool=running:none tari=running:healthy xmrig-proxy=running:none dashboard=running:none docker-proxy=running:none docker-control=running:none caddy=running:none"
 
 # All services up -> success, friendly summary.
-out="$(cd "$ST" && FAKE_STATES="$ALL_UP" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"; rc=$?
+out="$(cd "$ST" && FAKE_STATES="$ALL_UP" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"
+rc=$?
 assert_rc "status: all up exits 0" "$rc" "0"
 assert_contains "status: all-up summary" "$out" "All expected services are up"
 
 # A node down + proxy stopped -> node flagged, proxy treated as intentional failover.
-NODE_DOWN="${ALL_UP/monerod=running:healthy/monerod=exited:none}"; NODE_DOWN="${NODE_DOWN/xmrig-proxy=running:none/xmrig-proxy=exited:none}"
-out="$(cd "$ST" && FAKE_STATES="$NODE_DOWN" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"; rc=$?
+NODE_DOWN="${ALL_UP/monerod=running:healthy/monerod=exited:none}"
+NODE_DOWN="${NODE_DOWN/xmrig-proxy=running:none/xmrig-proxy=exited:none}"
+out="$(cd "$ST" && FAKE_STATES="$NODE_DOWN" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"
+rc=$?
 assert_rc "status: node down exits 1" "$rc" "1"
 assert_contains "status: proxy stop is intentional" "$out" "likely intentional"
 
@@ -1086,39 +1790,45 @@ assert_contains "status: proxy stop is intentional" "$out" "likely intentional"
 # healthchecks while still syncing and the dashboard holds the miner until they're synced
 # (#35), so status reports it as likely-intentional (exit 0), not a fault.
 PROXY_ONLY="${ALL_UP/xmrig-proxy=running:none/xmrig-proxy=exited:none}"
-out="$(cd "$ST" && FAKE_STATES="$PROXY_ONLY" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"; rc=$?
+out="$(cd "$ST" && FAKE_STATES="$PROXY_ONLY" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"
+rc=$?
 assert_rc "status: proxy stop under sync hold exits 0" "$rc" "0"
 assert_contains "status: proxy stop notes sync hold" "$out" "finish syncing"
 
 P2POOL_ONLY="${ALL_UP/p2pool=running:none/p2pool=exited:none}"
-out="$(cd "$ST" && FAKE_STATES="$P2POOL_ONLY" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"; rc=$?
+out="$(cd "$ST" && FAKE_STATES="$P2POOL_ONLY" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"
+rc=$?
 assert_rc "status: p2pool stop under sync hold exits 0" "$rc" "0"
 assert_contains "status: p2pool stop notes sync hold" "$out" "finish syncing"
 
 # Remote-node mode: the bundled monerod is not expected even if absent.
-printf 'DEPLOYMENT_COMPLETED=true\nCOMPOSE_PROFILES=\nHOST_IP=box.lan\n' > "$ST/.env"
+printf 'DEPLOYMENT_COMPLETED=true\nCOMPOSE_PROFILES=\nHOST_IP=box.lan\n' >"$ST/.env"
 REMOTE="tor=running:healthy monerod=missing p2pool=running:none tari=running:healthy xmrig-proxy=running:none dashboard=running:none docker-proxy=running:none docker-control=running:none caddy=running:none"
-out="$(cd "$ST" && FAKE_STATES="$REMOTE" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"; rc=$?
+out="$(cd "$ST" && FAKE_STATES="$REMOTE" PATH="$ST/bin:$PATH" ./pithead status 2>&1)"
+rc=$?
 assert_rc "status: remote mode ignores monerod" "$rc" "0"
 
 echo "== black-box: doctor exit code (#127) =="
 # doctor must EXIT NON-ZERO when a critical check fails, so it's usable as a cron/CI health gate
 # (it previously always returned 0). Drive one failure via an unreachable Docker daemon; jq/openssl
 # stay real on PATH so only the daemon check fails.
-DOC="$SANDBOX/doctor"; mkdir -p "$DOC/bin"; cp "$STACK" "$DOC/pithead"
-cat > "$DOC/bin/docker" <<'EOF'
+DOC="$SANDBOX/doctor"
+mkdir -p "$DOC/bin"
+cp "$STACK" "$DOC/pithead"
+cat >"$DOC/bin/docker" <<'EOF'
 #!/usr/bin/env bash
 case "$*" in
   "info") exit 1 ;;   # daemon unreachable -> doctor records a critical FAIL
   *)      exit 0 ;;   # `--version`, `compose version`, etc. succeed
 esac
 EOF
-printf '#!/usr/bin/env bash\nexit 0\n' > "$DOC/bin/sudo"
+printf '#!/usr/bin/env bash\nexit 0\n' >"$DOC/bin/sudo"
 chmod +x "$DOC/bin/docker" "$DOC/bin/sudo"
-out="$(cd "$DOC" && PATH="$DOC/bin:$PATH" ./pithead doctor 2>&1)"; rc=$?
-assert_contains "doctor runs to the summary"          "$out" "Diagnostics summary"
+out="$(cd "$DOC" && PATH="$DOC/bin:$PATH" ./pithead doctor 2>&1)"
+rc=$?
+assert_contains "doctor runs to the summary" "$out" "Diagnostics summary"
 assert_contains "doctor flags the unreachable daemon" "$out" "Docker daemon is not reachable"
-assert_rc       "doctor exits 1 on a critical FAIL"   "$rc" "1"
+assert_rc "doctor exits 1 on a critical FAIL" "$rc" "1"
 
 echo "== black-box: backup -> restore round-trip (#140) =="
 # backup/restore touch irreplaceable state (onion keys, the dashboard DB) and have fiddly logic
@@ -1130,16 +1840,18 @@ echo "== black-box: backup -> restore round-trip (#140) =="
 # Use the sandbox's PHYSICAL path (pwd -P): `restore` extracts at '/', and on macOS the /var ->
 # /private/var symlink would otherwise make BSD tar refuse to "extract through symlink" (Linux /tmp
 # isn't symlinked, so this is a no-op there).
-BK="$(cd "$SANDBOX" && pwd -P)/backup"; mkdir -p "$BK/build/tari" "$BK/data/tor" "$BK/data/dashboard" "$BK/bin"
-cp "$STACK" "$BK/pithead"; cp "$ROOT/build/tari/config.toml.template" "$BK/build/tari/"
-cat > "$BK/bin/docker" <<'EOF'
+BK="$(cd "$SANDBOX" && pwd -P)/backup"
+mkdir -p "$BK/build/tari" "$BK/data/tor" "$BK/data/dashboard" "$BK/bin"
+cp "$STACK" "$BK/pithead"
+cp "$ROOT/build/tari/config.toml.template" "$BK/build/tari/"
+cat >"$BK/bin/docker" <<'EOF'
 #!/usr/bin/env bash
 case "$*" in
   "compose ps --status running -q") exit 0 ;;   # empty output -> stack treated as not running
 esac
 exit 0
 EOF
-cat > "$BK/bin/sudo" <<'EOF'
+cat >"$BK/bin/sudo" <<'EOF'
 #!/usr/bin/env bash
 # Run backup/restore's privileged commands as the test user, except chown (can't set 100:101
 # unprivileged) which is accepted as a no-op so restore doesn't abort.
@@ -1147,7 +1859,7 @@ cat > "$BK/bin/sudo" <<'EOF'
 exec "$@"
 EOF
 chmod +x "$BK/bin/docker" "$BK/bin/sudo"
-cat > "$BK/.env" <<EOF
+cat >"$BK/.env" <<EOF
 MONERO_ONION_ADDRESS=mona.onion
 TARI_ONION_ADDRESS=taria.onion
 P2POOL_ONION_ADDRESS=p2pa.onion
@@ -1156,27 +1868,28 @@ HOST_IP=box.lan
 DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 EOF
-printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" > "$BK/config.json"
-printf 'CADDY-ORIG\n'    > "$BK/Caddyfile"
-printf 'ONIONKEY-ORIG\n' > "$BK/data/tor/hs_ed25519_secret_key"
-printf 'DBDATA-ORIG\n'    > "$BK/data/dashboard/dashboard.db"
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"main"}, "dashboard":{"secure":true,"host":"box.lan"} }\n' "$WALLET" >"$BK/config.json"
+printf 'CADDY-ORIG\n' >"$BK/Caddyfile"
+printf 'ONIONKEY-ORIG\n' >"$BK/data/tor/hs_ed25519_secret_key"
+printf 'DBDATA-ORIG\n' >"$BK/data/dashboard/dashboard.db"
 
 # 1) Backup creates a timestamped archive.
-out="$(cd "$BK" && PATH="$BK/bin:$PATH" ./pithead backup -y 2>&1)"; rc=$?
+out="$(cd "$BK" && PATH="$BK/bin:$PATH" ./pithead backup -y 2>&1)"
+rc=$?
 assert_rc "backup exits 0" "$rc" "0"
 archive="$(ls "$BK"/backups/pithead-backup-*.tar.gz 2>/dev/null | head -1)"
 { [ -n "$archive" ] && [ -f "$archive" ]; } && ok "backup archive created" || bad "backup archive created" "no archive under backups/"
 
 # 2) Archive layout: the irreplaceable bits are in it; blockchains are NOT (no --with-chains).
 listing="$(tar -tzf "$archive" 2>/dev/null)"
-assert_contains "archive has config.json"      "$listing" "config.json"
-assert_contains "archive has .env"             "$listing" ".env"
-assert_contains "archive has Caddyfile"        "$listing" "Caddyfile"
+assert_contains "archive has config.json" "$listing" "config.json"
+assert_contains "archive has .env" "$listing" ".env"
+assert_contains "archive has Caddyfile" "$listing" "Caddyfile"
 assert_contains "archive has the tor onion key" "$listing" "hs_ed25519_secret_key"
 assert_contains "archive has the dashboard db" "$listing" "dashboard.db"
 case "$listing" in
-    *data/monero*|*data/p2pool/*|*data/tari*) bad "archive excludes blockchains by default" "chain data present without --with-chains" ;;
-    *)                                        ok  "archive excludes blockchains by default" ;;
+*data/monero* | *data/p2pool/* | *data/tari*) bad "archive excludes blockchains by default" "chain data present without --with-chains" ;;
+*) ok "archive excludes blockchains by default" ;;
 esac
 # Safety tripwire: every archived path is under the sandbox, so restore's `tar -C /` can't escape it.
 sandbox_rel="${BK#/}"
@@ -1184,19 +1897,20 @@ escaped="$(printf '%s\n' "$listing" | grep -v '^$' | grep -v "^$sandbox_rel" ||
 assert_eq "archive paths stay inside the sandbox" "$escaped" ""
 
 # 3) Round-trip: corrupt/delete the live files, restore, assert the originals come back in place.
-printf 'CORRUPTED\n' > "$BK/Caddyfile"
-printf 'CORRUPTED\n' > "$BK/data/dashboard/dashboard.db"
+printf 'CORRUPTED\n' >"$BK/Caddyfile"
+printf 'CORRUPTED\n' >"$BK/data/dashboard/dashboard.db"
 rm -f "$BK/data/tor/hs_ed25519_secret_key"
-out="$(cd "$BK" && PATH="$BK/bin:$PATH" ./pithead restore -y "$archive" 2>&1)"; rc=$?
+out="$(cd "$BK" && PATH="$BK/bin:$PATH" ./pithead restore -y "$archive" 2>&1)"
+rc=$?
 assert_rc "restore exits 0" "$rc" "0"
-assert_eq "restore brings back the Caddyfile"     "$(cat "$BK/Caddyfile")" "CADDY-ORIG"
-assert_eq "restore brings back the dashboard db"  "$(cat "$BK/data/dashboard/dashboard.db")" "DBDATA-ORIG"
-assert_eq "restore brings back the onion key"     "$(cat "$BK/data/tor/hs_ed25519_secret_key" 2>/dev/null)" "ONIONKEY-ORIG"
+assert_eq "restore brings back the Caddyfile" "$(cat "$BK/Caddyfile")" "CADDY-ORIG"
+assert_eq "restore brings back the dashboard db" "$(cat "$BK/data/dashboard/dashboard.db")" "DBDATA-ORIG"
+assert_eq "restore brings back the onion key" "$(cat "$BK/data/tor/hs_ed25519_secret_key" 2>/dev/null)" "ONIONKEY-ORIG"
 
 # 4) Low-space pre-check (#127): a df reporting almost no free space makes backup prompt; answering
 # "no" cancels and writes nothing, while --yes proceeds with a warning. The check runs BEFORE the
 # stack is touched, so a cancel leaves everything as it was.
-cat > "$BK/bin/df" <<'EOF'
+cat >"$BK/bin/df" <<'EOF'
 #!/usr/bin/env bash
 printf '%s\n' 'Filesystem 1024-blocks Used Available Capacity Mounted on' '/dev/fake 100 99 1 99% /'
 EOF
@@ -1206,23 +1920,26 @@ out="$(cd "$BK" && printf 'n\n' | PATH="$BK/bin:$PATH" ./pithead backup 2>&1)"
 assert_contains "low-space prompt, then cancel" "$out" "ancelled"
 leftover="$(ls "$BK"/backups/pithead-backup-*.tar.gz 2>/dev/null | head -1)"
 assert_eq "cancelled backup writes no archive" "$leftover" ""
-out="$(cd "$BK" && PATH="$BK/bin:$PATH" ./pithead backup -y 2>&1)"; rc=$?
-assert_rc       "low-space backup proceeds with --yes" "$rc" "0"
-assert_contains "low-space backup warns first"         "$out" "Low free space"
+out="$(cd "$BK" && PATH="$BK/bin:$PATH" ./pithead backup -y 2>&1)"
+rc=$?
+assert_rc "low-space backup proceeds with --yes" "$rc" "0"
+assert_contains "low-space backup warns first" "$out" "Low free space"
 
 echo "== black-box: reset-dashboard targets .env dirs, not config.json (#139) =="
 # reset-dashboard must wipe the LIVE deployment's data dirs (from .env), not a path the user may
 # have edited into config.json without applying. docker = noop; sudo only LOGS (never executes the
 # rm), so we can assert what it would have targeted without deleting anything.
-R="$SANDBOX/reset"; mkdir -p "$R/bin" "$R/envdir/dashboard" "$R/envdir/p2pool"; cp "$STACK" "$R/pithead"
-printf '#!/usr/bin/env bash\nexit 0\n' > "$R/bin/docker"
-cat > "$R/bin/sudo" <<'EOF'
+R="$SANDBOX/reset"
+mkdir -p "$R/bin" "$R/envdir/dashboard" "$R/envdir/p2pool"
+cp "$STACK" "$R/pithead"
+printf '#!/usr/bin/env bash\nexit 0\n' >"$R/bin/docker"
+cat >"$R/bin/sudo" <<'EOF'
 #!/usr/bin/env bash
 echo "[sudo] $*" >> "${SUDO_LOG:-/dev/null}"
 exit 0
 EOF
 chmod +x "$R/bin/docker" "$R/bin/sudo"
-cat > "$R/.env" <<EOF
+cat >"$R/.env" <<EOF
 DEPLOYMENT_COMPLETED=true
 COMPOSE_PROFILES=local_node
 HOST_IP=box.lan
@@ -1230,22 +1947,53 @@ DASHBOARD_DATA_DIR=$R/envdir/dashboard
 P2POOL_DATA_DIR=$R/envdir/p2pool
 EOF
 # config.json points the data dirs somewhere ELSE (a path the running stack never used).
-printf '{ "monero":{"mode":"local","wallet_address":"%s"}, "tari":{"wallet_address":"T"}, "p2pool":{"data_dir":"%s/CONFIGONLY/p2pool"}, "dashboard":{"data_dir":"%s/CONFIGONLY/dashboard"} }\n' "$WALLET" "$R" "$R" > "$R/config.json"
-SUDO_LOG="$R/sudo.log"; : > "$SUDO_LOG"
-out="$(cd "$R" && SUDO_LOG="$SUDO_LOG" PATH="$R/bin:$PATH" ./pithead reset-dashboard -y 2>&1)"; rc=$?
+printf '{ "monero":{"mode":"local","wallet_address":"%s"}, "tari":{"wallet_address":"T"}, "p2pool":{"data_dir":"%s/CONFIGONLY/p2pool"}, "dashboard":{"data_dir":"%s/CONFIGONLY/dashboard"} }\n' "$WALLET" "$R" "$R" >"$R/config.json"
+SUDO_LOG="$R/sudo.log"
+: >"$SUDO_LOG"
+out="$(cd "$R" && SUDO_LOG="$SUDO_LOG" PATH="$R/bin:$PATH" ./pithead reset-dashboard -y 2>&1)"
+rc=$?
 assert_rc "reset-dashboard succeeds" "$rc" "0"
 sudo_calls="$(cat "$SUDO_LOG")"
 assert_contains "reset rm targets the .env dashboard dir" "$sudo_calls" "rm -rf $R/envdir/dashboard"
 case "$sudo_calls" in *CONFIGONLY*) bad "reset must ignore the config-only data_dir" "$sudo_calls" ;; *) ok "reset ignores the config-only data_dir" ;; esac
 
 echo "== black-box: reset-dashboard refuses to guess without .env dirs (#139) =="
-printf 'DEPLOYMENT_COMPLETED=true\nCOMPOSE_PROFILES=local_node\nHOST_IP=box.lan\n' > "$R/.env"
-out="$(cd "$R" && SUDO_LOG=/dev/null PATH="$R/bin:$PATH" ./pithead reset-dashboard -y 2>&1)"; rc=$?
+printf 'DEPLOYMENT_COMPLETED=true\nCOMPOSE_PROFILES=local_node\nHOST_IP=box.lan\n' >"$R/.env"
+out="$(cd "$R" && SUDO_LOG=/dev/null PATH="$R/bin:$PATH" ./pithead reset-dashboard -y 2>&1)"
+rc=$?
 assert_rc "reset refuses with no data dirs in .env" "$rc" "1"
 assert_contains "reset refuse message" "$out" "refusing to guess"
 
+echo "== release: install bundle is free of macOS xattr pax headers (#252) =="
+# Static guard: make_bundle must keep `--no-xattrs` AND the post-bundle xattr assertion, so the
+# fix can't be silently reverted in a future edit.
+REL="$ROOT/scripts/release.sh"
+assert_contains "release.sh tars the bundle with --no-xattrs" \
+    "$(grep -E '^[[:space:]]*tar .*--no-xattrs' "$REL" || true)" "--no-xattrs"
+assert_contains "release.sh guards the bundle against xattr pax headers" \
+    "$(cat "$REL")" "LIBARCHIVE.xattr"
+# Functional: this platform's tar must actually honour --no-xattrs (the guard's whole premise).
+# Tar a file that carries an xattr where we can set one (macOS: xattr -w / Linux: setfattr; a
+# no-op elsewhere), and assert no LIBARCHIVE.xattr/SCHILY.xattr pax header survives — the exact
+# check release.sh runs. Reproduces #252 on macOS; a clean no-op on GNU tar.
+RELTMP="$(mktemp -d)"
+mkdir -p "$RELTMP/pithead"
+echo hi >"$RELTMP/pithead/f"
+xattr -w com.test val "$RELTMP/pithead/f" 2>/dev/null ||
+    setfattr -n user.test -v val "$RELTMP/pithead/f" 2>/dev/null || true
+tar --no-xattrs -czf "$RELTMP/b.tar.gz" -C "$RELTMP" pithead 2>/dev/null
+if gzip -dc "$RELTMP/b.tar.gz" 2>/dev/null | grep -qa -e 'LIBARCHIVE.xattr' -e 'SCHILY.xattr'; then
+    bad "tar --no-xattrs yields an xattr-free bundle" "xattr pax headers present despite --no-xattrs"
+else
+    ok "tar --no-xattrs yields an xattr-free bundle"
+fi
+rm -rf "$RELTMP"
+
 # ---------------------------------------------------------------------------
 echo ""
 printf 'pithead tests: \033[1;32m%d passed\033[0m, ' "$PASS"
-if [ "$FAIL" -gt 0 ]; then printf '\033[1;31m%d failed\033[0m\n' "$FAIL"; exit 1; fi
+if [ "$FAIL" -gt 0 ]; then
+    printf '\033[1;31m%d failed\033[0m\n' "$FAIL"
+    exit 1
+fi
 printf '0 failed\n'
diff --git a/tests/stack/test_compose.sh b/tests/stack/test_compose.sh
index 420db230..b30fa580 100755
--- a/tests/stack/test_compose.sh
+++ b/tests/stack/test_compose.sh
@@ -18,7 +18,7 @@ EMPTY_TOKEN_ENV="$(mktemp)"
 trap 'rm -f "$ENV_FILE" "$EMPTY_TOKEN_ENV"' EXIT
 
 # A representative, fully-populated environment (mirrors what pithead renders).
-cat > "$ENV_FILE" <<'EOF'
+cat >"$ENV_FILE" <<'EOF'
 MONERO_DATA_DIR=/srv/data/monero
 TARI_DATA_DIR=/srv/data/tari
 P2POOL_DATA_DIR=/srv/data/p2pool
@@ -71,23 +71,40 @@ echo "Checking hardening directives (#90) ..."
 RENDERED="$(docker compose --env-file "$ENV_FILE" -f "$ROOT/docker-compose.yml" config)"
 fails=0
 expect_min() { # <label> <pattern> <min-count>
-    local n; n=$(printf '%s\n' "$RENDERED" | grep -c -- "$2")
-    if [ "$n" -ge "$3" ]; then echo "  ✓ $1 ($n)"; else echo "  ✗ $1: expected >= $3, got $n"; fails=$((fails + 1)); fi
+    local n
+    n=$(printf '%s\n' "$RENDERED" | grep -c -- "$2")
+    if [ "$n" -ge "$3" ]; then echo "  ✓ $1 ($n)"; else
+        echo "  ✗ $1: expected >= $3, got $n"
+        fails=$((fails + 1))
+    fi
 }
 expect_present() { # <label> <pattern>
-    if printf '%s\n' "$RENDERED" | grep -q -- "$2"; then echo "  ✓ $1"; else echo "  ✗ $1: missing [$2]"; fails=$((fails + 1)); fi
+    if printf '%s\n' "$RENDERED" | grep -q -- "$2"; then echo "  ✓ $1"; else
+        echo "  ✗ $1: missing [$2]"
+        fails=$((fails + 1))
+    fi
 }
 expect_absent() { # <label> <pattern>
-    if printf '%s\n' "$RENDERED" | grep -q -- "$2"; then echo "  ✗ $1: found [$2]"; fails=$((fails + 1)); else echo "  ✓ $1"; fi
+    if printf '%s\n' "$RENDERED" | grep -q -- "$2"; then
+        echo "  ✗ $1: found [$2]"
+        fails=$((fails + 1))
+    else echo "  ✓ $1"; fi
 }
 
 # no-new-privileges on all 5 leaf services.
 expect_min "no-new-privileges on leaf services" "no-new-privileges:true" 5
-# cap_drop: [ALL] on exactly 4 of them — caddy, xmrig-proxy, and the two socket proxies. The
-# dashboard is intentionally exempt (it writes its history DB as root into a user-owned volume,
-# which needs CAP_DAC_OVERRIDE); pin the count so re-adding cap_drop there fails CI.
+# cap_drop: [ALL] on all 5 leaf services — caddy, xmrig-proxy, the two socket proxies, AND the
+# dashboard. The dashboard now runs non-root and owns its volume (#255), so it no longer needs
+# CAP_DAC_OVERRIDE to write its history DB and joins the others; pin the count so dropping cap_drop
+# from any leaf fails CI.
 caps=$(printf '%s\n' "$RENDERED" | grep -c -- "- ALL")
-if [ "$caps" -eq 4 ]; then echo "  ✓ cap_drop: [ALL] on 4 leaves, dashboard exempt ($caps)"; else echo "  ✗ cap_drop: [ALL]: expected 4 (dashboard exempt), got $caps"; fails=$((fails + 1)); fi
+if [ "$caps" -eq 5 ]; then echo "  ✓ cap_drop: [ALL] on all 5 leaves incl. dashboard ($caps)"; else
+    echo "  ✗ cap_drop: [ALL]: expected 5 (incl. dashboard, #255), got $caps"
+    fails=$((fails + 1))
+fi
+# Non-root containers (#255): the pulled tari image has no first-party Dockerfile USER, so its
+# non-root uid is pinned via compose. Guard it so a silent drop back to root fails CI.
+expect_min "tari runs non-root via compose user: (#255)" "user: 1000:1000" 1
 # Anchor to the 4-space service-level indent so read-only :ro *bind mounts* (rendered with the
 # same key, deeper-indented) don't inflate the count — we want exactly the 3 read-only roots.
 expect_min "read-only roots (caddy + 2 socket proxies)" "^    read_only: true" 3
@@ -98,7 +115,7 @@ expect_present "stratum host port published" '"3333"'
 # Healthchecks moved to scripts; RPC creds no longer appear in the compose healthcheck command.
 expect_present "monerod healthcheck via script" "monerod-healthcheck.sh"
 expect_present "p2pool healthcheck via script" "p2pool-healthcheck.sh"
-expect_absent  "no get_info (creds) in compose healthcheck" "get_info"
+expect_absent "no get_info (creds) in compose healthcheck" "get_info"
 
 # Log rotation (#123): every service must carry the json-file size cap, including caddy and the two
 # socket proxies that previously fell back to Docker's uncapped default. All 9 services (monerod is
@@ -114,7 +131,10 @@ expect_present "tari node pinned by digest" "minotari_node:v5.3.1-mainnet@sha256
 # Docker socket proxies must stay least-privilege, and the Tari probe must self-match safely.
 JSON="$(docker compose --env-file "$ENV_FILE" -f "$ROOT/docker-compose.yml" config --format json 2>/dev/null)"
 jq_assert() { # <label> <filter>
-    if printf '%s' "$JSON" | jq -e "$2" >/dev/null 2>&1; then echo "  ✓ $1"; else echo "  ✗ $1: failed [$2]"; fails=$((fails + 1)); fi
+    if printf '%s' "$JSON" | jq -e "$2" >/dev/null 2>&1; then echo "  ✓ $1"; else
+        echo "  ✗ $1: failed [$2]"
+        fails=$((fails + 1))
+    fi
 }
 # The read proxy must never gain write (POST) access; the control proxy is start/stop ONLY.
 jq_assert "docker-proxy cannot POST (read-only API)" '(.services["docker-proxy"].environment.POST // "0") != "1"'
@@ -138,9 +158,11 @@ jq_assert "memory ceiling (mem_limit) on every service (#132)" '[.services[] | s
 # must make the stack refuse to start rather than expose an unauthenticated API.
 jq_assert "xmrig-proxy API carries a non-empty access token (#153)" \
     '.services["xmrig-proxy"].command as $c | ($c | index("--http-access-token")) as $i | ($i != null) and (($c[($i + 1)] // "") | length > 0)'
-grep -v '^PROXY_AUTH_TOKEN=' "$ENV_FILE" > "$EMPTY_TOKEN_ENV"; echo 'PROXY_AUTH_TOKEN=' >> "$EMPTY_TOKEN_ENV"
+grep -v '^PROXY_AUTH_TOKEN=' "$ENV_FILE" >"$EMPTY_TOKEN_ENV"
+echo 'PROXY_AUTH_TOKEN=' >>"$EMPTY_TOKEN_ENV"
 if docker compose --env-file "$EMPTY_TOKEN_ENV" -f "$ROOT/docker-compose.yml" config -q >/dev/null 2>&1; then
-    echo "  ✗ empty PROXY_AUTH_TOKEN still rendered (would start an UNAUTHENTICATED API)"; fails=$((fails + 1))
+    echo "  ✗ empty PROXY_AUTH_TOKEN still rendered (would start an UNAUTHENTICATED API)"
+    fails=$((fails + 1))
 else
     echo "  ✓ empty PROXY_AUTH_TOKEN makes the stack refuse to start (#153)"
 fi
@@ -156,28 +178,37 @@ jq_assert "xmrig-proxy dev-fee donate-level rendered (#173)" \
 # any rig may still mine (a literal empty '--access-password=' would demand an empty password and
 # reject every rig, the bug this guards). donate-level falls back to '0' (no dev fee).
 OFF_ENV="$(mktemp)"
-grep -vE '^PROXY_STRATUM_PASSWORD=|^PROXY_DONATE_LEVEL=' "$ENV_FILE" > "$OFF_ENV"
-echo 'PROXY_STRATUM_PASSWORD=' >> "$OFF_ENV"
+grep -vE '^PROXY_STRATUM_PASSWORD=|^PROXY_DONATE_LEVEL=' "$ENV_FILE" >"$OFF_ENV"
+echo 'PROXY_STRATUM_PASSWORD=' >>"$OFF_ENV"
 OFF_JSON="$(docker compose --env-file "$OFF_ENV" -f "$ROOT/docker-compose.yml" config --format json 2>/dev/null)"
 rm -f "$OFF_ENV"
 if printf '%s' "$OFF_JSON" | jq -e '.services["xmrig-proxy"].command | ((any(startswith("--access-password")) | not) and any(. == "--donate-level=0"))' >/dev/null 2>&1; then
     echo "  ✓ default-off omits --access-password (any rig may mine) + --donate-level=0 (#152/#173)"
 else
-    echo "  ✗ default-off must omit --access-password and render --donate-level=0"; fails=$((fails + 1))
+    echo "  ✗ default-off must omit --access-password and render --donate-level=0"
+    fails=$((fails + 1))
 fi
 
 # Configurable bridge subnet (#180): a custom network.subnet must rebase every static IP, the bridge
 # CIDR, and the dashboard's derived bridge endpoints — the host address-space-collision install fix.
-CUSTOM_ENV="$(mktemp)"; { cat "$ENV_FILE"; printf 'NETWORK_SUBNET=10.84.0.0/24\nNETWORK_PREFIX=10.84.0\n'; } > "$CUSTOM_ENV"
+CUSTOM_ENV="$(mktemp)"
+{
+    cat "$ENV_FILE"
+    printf 'NETWORK_SUBNET=10.84.0.0/24\nNETWORK_PREFIX=10.84.0\n'
+} >"$CUSTOM_ENV"
 CUSTOM="$(docker compose --env-file "$CUSTOM_ENV" -f "$ROOT/docker-compose.yml" config 2>/dev/null)"
 rm -f "$CUSTOM_ENV"
 sub_check() { # <label> <pattern> <min-count>
-    local n; n=$(printf '%s\n' "$CUSTOM" | grep -c -- "$2")
-    if [ "$n" -ge "$3" ]; then echo "  ✓ $1 ($n)"; else echo "  ✗ $1: expected >= $3, got $n"; fails=$((fails + 1)); fi
+    local n
+    n=$(printf '%s\n' "$CUSTOM" | grep -c -- "$2")
+    if [ "$n" -ge "$3" ]; then echo "  ✓ $1 ($n)"; else
+        echo "  ✗ $1: expected >= $3, got $n"
+        fails=$((fails + 1))
+    fi
 }
-sub_check "custom subnet rebases the bridge network (#180)"            "subnet: 10.84.0.0/24" 1
-sub_check "custom subnet rebases all static service IPs (#180)"        "ipv4_address: 10.84.0." 7
-sub_check "custom subnet rebases the dashboard SSRF CIDR (#180)"       "MINING_NET_CIDR: 10.84.0.0/24" 1
+sub_check "custom subnet rebases the bridge network (#180)" "subnet: 10.84.0.0/24" 1
+sub_check "custom subnet rebases all static service IPs (#180)" "ipv4_address: 10.84.0." 7
+sub_check "custom subnet rebases the dashboard SSRF CIDR (#180)" "MINING_NET_CIDR: 10.84.0.0/24" 1
 sub_check "custom subnet rebases the dashboard Tor SOCKS endpoint (#180)" "XVB_TOR_PROXY: socks5h://10.84.0.25:9050" 1
 
 if [ "$fails" -ne 0 ]; then