diff --git a/tests/integration/local/Dockerfile.multi b/tests/integration/local/Dockerfile.multi
index 91b353fa..2cbc49a2 100644
--- a/tests/integration/local/Dockerfile.multi
+++ b/tests/integration/local/Dockerfile.multi
@@ -1,10 +1,11 @@
 FROM golang:1.25-bookworm AS builder
 WORKDIR /workspace
 COPY . .
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-rendezvous ./cmd/rendezvous && \
+# The rendezvous server lives in its own module now; build the version
+# go.mod pins so the registry under test matches the daemon's dependency.
+RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-rendezvous github.com/pilot-protocol/rendezvous/cmd/rendezvous && \
     CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-daemon ./cmd/daemon && \
-    CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilotctl ./cmd/pilotctl && \
-    CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilot-gateway ./cmd/gateway
+    CGO_ENABLED=0 go build -ldflags="-s -w" -o /bin/pilotctl ./cmd/pilotctl
 
 FROM debian:bookworm-slim
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -20,7 +21,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 COPY --from=builder /bin/pilot-rendezvous /usr/local/bin/
 COPY --from=builder /bin/pilot-daemon /usr/local/bin/
 COPY --from=builder /bin/pilotctl /usr/local/bin/
-COPY --from=builder /bin/pilot-gateway /usr/local/bin/
 RUN mkdir -p /root/.pilot/inbox /root/.pilot/received
 COPY tests/integration/local/test_p2p.sh /tests/
 # Security-test injector + helpers (Chunk D). Kept alongside /tests so
diff --git a/tests/integration/local/QUICK.txt b/tests/integration/local/QUICK.txt
index 2a1daffe..c57bc038 100644
--- a/tests/integration/local/QUICK.txt
+++ b/tests/integration/local/QUICK.txt
@@ -1,6 +1,6 @@
 # QUICK integration tier — tests that finish in ≤30s under -j 10 and
 # genuinely exercise live cross-process behavior (multi-daemon networking,
-# docker networking, NAT, partition, gateway proxy, etc.) that cannot be
+# docker networking, NAT, partition, etc.) that cannot be
 # covered by pkg/ unit tests.
 #
 # Excludes:
@@ -44,34 +44,15 @@ test_size_message_10mb_reject.sh
 
 # Policy (short)
 test_policy_connect_deny.sh
-test_policy_connect_score.sh
 test_policy_connect_tag.sh
 test_policy_datagram_deny.sh
 test_policy_datagram_score.sh
 test_policy_join_allow.sh
-test_policy_join_score.sh
 test_policy_cycle_evict.sh
 test_policy_cycle_fill_trust.sh
 test_policy_cycle_webhook.sh
 
 # Networks (short shipped-net subset)
-test_net_high_trust_society_shipped.sh
-test_net_data_exchange_policy_shipped.sh
-test_net_cold_shoulder_shipped.sh
-test_net_cooling_off_shipped.sh
-test_net_meritocracy_shipped.sh
-test_net_stable_state_shipped.sh
-
-# Gateway (short — excludes gateway_http_message which takes 90s)
-test_gateway_file.sh
-test_gateway_lookup.sh
-test_gateway_message.sh
-test_gateway_ping.sh
-test_gateway_pubsub_pub.sh
-test_gateway_pubsub_sub.sh
-test_gateway_register.sh
-test_gateway_rotate_key.sh
-test_gateway_trust_grant.sh
 
 # Observability + security (short)
 test_obs_log_peer_rekeyed.sh
diff --git a/tests/integration/local/_lib.sh b/tests/integration/local/_lib.sh
index 945d2538..513c86f8 100755
--- a/tests/integration/local/_lib.sh
+++ b/tests/integration/local/_lib.sh
@@ -7,8 +7,8 @@
 #   - wait_for — replaces the `for _ in $(seq 1 60); do ...; sleep 1; done`
 #     pattern scattered across ~120 tests with a single helper that reads
 #     WAIT_BUDGET from env (laptop=60, k8s Job sets 180 via values.yaml)
-#   - teardown — docker compose down -v --remove-orphans, plus pkill of
-#     any leaked pilot-daemon/gateway/rendezvous; auto-trapped at EXIT
+#   - teardown — docker compose down -v --remove-orphans; auto-trapped
+#     at EXIT
 #
 # Teardown is auto-installed via `trap teardown EXIT` on source.
 # If a test wants to manage its own teardown (multi-phase chaos runs),
@@ -47,7 +47,7 @@ _wait_budget() {
 # discarded so loops stay quiet.
 #
 # Usage:
-#   wait_for '[ "$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats | jq -r ".total_nodes // 0")" -ge 2 ]' \
+#   wait_for '[ "$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats | jq -r ".total_nodes // 0")" -ge 2 ]' \
 #     && log_pass "both agents registered"
 wait_for() {
   local pred="$1"
@@ -77,12 +77,10 @@ teardown() {
       # No $DC set — try the two most common compose files as a best
       # effort. Costs nothing if they're not up.
       docker compose -f docker-compose.multi.yml down -v --remove-orphans >/dev/null 2>&1 || true
-      docker compose -f docker-compose.gateway.yml down -v --remove-orphans >/dev/null 2>&1 || true
     fi
-    # Belt-and-braces: anything still holding the daemon sockets.
-    pkill -9 -f pilot-daemon 2>/dev/null || true
-    pkill -9 -f pilot-gateway 2>/dev/null || true
-    pkill -9 -f pilot-rendezvous 2>/dev/null || true
+    # No host-side pkill: every daemon under test runs inside a container
+    # that `down -v` just removed. A `pkill -f pilot-daemon` here matches
+    # the developer's own daemon on the host and kills it.
   ) || true
   return "$rc"
 }
diff --git a/tests/integration/local/bench_relay.sh b/tests/integration/local/bench_relay.sh
index c861f9fd..fa2d3d28 100755
--- a/tests/integration/local/bench_relay.sh
+++ b/tests/integration/local/bench_relay.sh
@@ -92,7 +92,7 @@ echo "==> bench: starting fresh stack on $PILOT_SUBNET_PREFIX/24"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "${COUNT:-0}" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/docker-compose.multi.gateway.yml b/tests/integration/local/docker-compose.multi.gateway.yml
deleted file mode 100644
index a5da880a..00000000
--- a/tests/integration/local/docker-compose.multi.gateway.yml
+++ /dev/null
@@ -1,72 +0,0 @@
-# Gateway overlay. Stack with:
-#   docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml up -d
-#
-# Adds a `gateway` service that:
-#   - runs its own pilot-daemon (so it's a full node on the overlay)
-#   - runs pilot-gateway mapping agent-b to a local IP in 10.4.0.0/16
-#   - exposes mapped ports on the docker network so tests can curl / nc them
-#
-# pilot-gateway today is a TCP bridge: it listens on a loopback alias for
-# each mapped pilot address on ports 80, 443, 1000, 1001, 1002, 7, 8080,
-# 8443 and forwards TCP streams over the pilot tunnel to <pilot-addr>:<port>.
-# It does NOT expose an HTTP/gRPC control-plane API of its own — all
-# operations (trust grant, pubsub, lookup, register,
-# rotate-key, ping) continue to flow through pilotctl / the daemon socket.
-# Tests therefore exercise "through the gateway" by driving pilotctl against
-# the gateway-side daemon, OR by hitting the mapped local IP:port with
-# standard TCP/HTTP tooling.
-#
-# NET_ADMIN is required so the gateway can add a loopback alias via `ip
-# addr add` (pkg/gateway/gateway.go addLoopbackAlias).
-services:
-  gateway:
-    image: pilot-multi:latest
-    build:
-      context: ../../..
-      dockerfile: tests/integration/local/Dockerfile.multi
-    hostname: gateway
-    depends_on:
-      rendezvous:
-        condition: service_healthy
-      agent-a:
-        condition: service_started
-      agent-b:
-        condition: service_started
-    networks:
-      pilot-p2p:
-        ipv4_address: ${PILOT_SUBNET_PREFIX:-172.29.0}.40
-    environment:
-      PILOT_REGISTRY: "${PILOT_SUBNET_PREFIX:-172.29.0}.10:9000"
-      PILOT_SUBNET_PREFIX: "${PILOT_SUBNET_PREFIX:-172.29.0}"
-    # NET_ADMIN is required by pilot-gateway to `ip addr add` a loopback
-    # alias for each mapped local IP. Without it, the proxy listeners
-    # never bind successfully.
-    cap_add:
-      - NET_ADMIN
-    volumes:
-      - ./results:/results
-    # The container runs the daemon, then the gateway. The test scripts
-    # exec into this container to drive pilotctl and curl through the
-    # mapped IPs.
-    # NOTE: keep the pilot-daemon invocation on a single line. YAML folded
-    # scalars (`>`) preserve newlines on any line indented MORE than the
-    # first content line — so splitting flags onto indented lines silently
-    # breaks the command. Literal block (`|`) has the same issue without
-    # backslash continuations.
-    command: |
-      bash -c "
-        set -e
-        mkdir -p /root/.pilot/inbox /root/.pilot/received
-        pilot-daemon -registry ${PILOT_SUBNET_PREFIX:-172.29.0}.10:9000 -beacon ${PILOT_SUBNET_PREFIX:-172.29.0}.10:9001 -hostname gateway -identity /root/.pilot/identity.json -email gateway@p2p.test -endpoint ${PILOT_SUBNET_PREFIX:-172.29.0}.40:4000 -listen :4000 -public -keepalive 5s -log-level info > /tmp/gateway-daemon.log 2>&1 &
-        DAEMON_PID=$$!
-        for i in $$(seq 1 30); do
-          if [ -S /tmp/pilot.sock ] && pilotctl --json info 2>/dev/null | jq -e '.data.node_id' >/dev/null 2>&1; then
-            break
-          fi
-          sleep 1
-        done
-        pilot-gateway -subnet 10.4.0.0/16 -socket /tmp/pilot.sock run > /tmp/gateway.log 2>&1 &
-        GW_PID=$$!
-        echo 'gateway ready'
-        wait $$DAEMON_PID $$GW_PID
-      "
diff --git a/tests/integration/local/docker-compose.multi.nat-cgn.yml b/tests/integration/local/docker-compose.multi.nat-cgn.yml
index a7e8be3d..cfe2ee14 100644
--- a/tests/integration/local/docker-compose.multi.nat-cgn.yml
+++ b/tests/integration/local/docker-compose.multi.nat-cgn.yml
@@ -22,7 +22,7 @@ services:
       pilot-rendezvous -registry-addr 0.0.0.0:9000 -beacon-addr 0.0.0.0:9001
       -http 0.0.0.0:8080 -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.nat-dual.yml b/tests/integration/local/docker-compose.multi.nat-dual.yml
index 72bd5267..b9c1cce3 100644
--- a/tests/integration/local/docker-compose.multi.nat-dual.yml
+++ b/tests/integration/local/docker-compose.multi.nat-dual.yml
@@ -21,7 +21,7 @@ services:
       pilot-rendezvous -registry-addr 0.0.0.0:9000 -beacon-addr 0.0.0.0:9001
       -http 0.0.0.0:8080 -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.nat-hairpin.yml b/tests/integration/local/docker-compose.multi.nat-hairpin.yml
index f364cd48..a81308f0 100644
--- a/tests/integration/local/docker-compose.multi.nat-hairpin.yml
+++ b/tests/integration/local/docker-compose.multi.nat-hairpin.yml
@@ -21,7 +21,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.nat-ipv6.yml b/tests/integration/local/docker-compose.multi.nat-ipv6.yml
index f11a216f..51088bfa 100644
--- a/tests/integration/local/docker-compose.multi.nat-ipv6.yml
+++ b/tests/integration/local/docker-compose.multi.nat-ipv6.yml
@@ -14,7 +14,7 @@ services:
       pilot-rendezvous -registry-addr "[::]:9000" -beacon-addr "[::]:9001"
       -http "[::]:8080" -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://[::1]:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://[::1]:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.nat-multihomed.yml b/tests/integration/local/docker-compose.multi.nat-multihomed.yml
index f94dad2c..1b784781 100644
--- a/tests/integration/local/docker-compose.multi.nat-multihomed.yml
+++ b/tests/integration/local/docker-compose.multi.nat-multihomed.yml
@@ -17,7 +17,7 @@ services:
       pilot-rendezvous -registry-addr 0.0.0.0:9000 -beacon-addr 0.0.0.0:9001
       -http 0.0.0.0:8080 -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.nat.yml b/tests/integration/local/docker-compose.multi.nat.yml
index 160a6a11..eac74faf 100644
--- a/tests/integration/local/docker-compose.multi.nat.yml
+++ b/tests/integration/local/docker-compose.multi.nat.yml
@@ -49,7 +49,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.policy.yml b/tests/integration/local/docker-compose.multi.policy.yml
index 0a448f93..911fe15b 100644
--- a/tests/integration/local/docker-compose.multi.policy.yml
+++ b/tests/integration/local/docker-compose.multi.policy.yml
@@ -17,7 +17,7 @@ services:
       -store /tmp/registry.json
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi.yml b/tests/integration/local/docker-compose.multi.yml
index d385b005..186c5824 100644
--- a/tests/integration/local/docker-compose.multi.yml
+++ b/tests/integration/local/docker-compose.multi.yml
@@ -18,7 +18,7 @@ services:
       -store /tmp/registry.json
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 3s
       retries: 30
diff --git a/tests/integration/local/docker-compose.multi10.yml b/tests/integration/local/docker-compose.multi10.yml
index 0c6f55cb..7d6c5e0e 100644
--- a/tests/integration/local/docker-compose.multi10.yml
+++ b/tests/integration/local/docker-compose.multi10.yml
@@ -15,7 +15,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi3.yml b/tests/integration/local/docker-compose.multi3.yml
index 36640a62..55723c52 100644
--- a/tests/integration/local/docker-compose.multi3.yml
+++ b/tests/integration/local/docker-compose.multi3.yml
@@ -16,7 +16,7 @@ services:
       ${PILOT_ADMIN_TOKEN:+-admin-token ${PILOT_ADMIN_TOKEN}}
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.multi5.yml b/tests/integration/local/docker-compose.multi5.yml
index 2ac58b07..a33d6c7e 100644
--- a/tests/integration/local/docker-compose.multi5.yml
+++ b/tests/integration/local/docker-compose.multi5.yml
@@ -15,7 +15,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.ring4.yml b/tests/integration/local/docker-compose.ring4.yml
index 23f0cc1f..c5d1f5e1 100644
--- a/tests/integration/local/docker-compose.ring4.yml
+++ b/tests/integration/local/docker-compose.ring4.yml
@@ -14,7 +14,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.splitbrain.yml b/tests/integration/local/docker-compose.splitbrain.yml
index 84bb2250..97650996 100644
--- a/tests/integration/local/docker-compose.splitbrain.yml
+++ b/tests/integration/local/docker-compose.splitbrain.yml
@@ -14,7 +14,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
@@ -34,7 +34,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/docker-compose.star5hub.yml b/tests/integration/local/docker-compose.star5hub.yml
index 1ca9e989..809080a1 100644
--- a/tests/integration/local/docker-compose.star5hub.yml
+++ b/tests/integration/local/docker-compose.star5hub.yml
@@ -14,7 +14,7 @@ services:
       -http 0.0.0.0:8080
       -log-level info
     healthcheck:
-      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/stats >/dev/null || exit 1"]
+      test: ["CMD-SHELL", "curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null || exit 1"]
       interval: 2s
       timeout: 2s
       retries: 10
diff --git a/tests/integration/local/nat_test_common.sh b/tests/integration/local/nat_test_common.sh
index 84d1307b..f88d72ca 100644
--- a/tests/integration/local/nat_test_common.sh
+++ b/tests/integration/local/nat_test_common.sh
@@ -62,7 +62,7 @@ wait_registered() {
     local mult="${PILOT_TEST_WAIT_MULT:-1}"
     timeout=$((timeout * mult))
     for _ in $(seq 1 "$timeout"); do
-        reg=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+        reg=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         [ "${reg:-0}" -ge "$want" ] && { echo "$reg"; return 0; }
         sleep 1
diff --git a/tests/integration/local/network_helpers.sh b/tests/integration/local/network_helpers.sh
index ef04c023..bac6d557 100755
--- a/tests/integration/local/network_helpers.sh
+++ b/tests/integration/local/network_helpers.sh
@@ -276,7 +276,7 @@ ensure_stack_up() {
     local count
     for _ in $(seq 1 60); do
         count=$($DC exec -T rendezvous curl -fsS \
-            http://127.0.0.1:8080/api/stats 2>/dev/null \
+            http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         if [ "${count:-0}" -ge 2 ]; then
             return 0
diff --git a/tests/integration/local/policy_helpers.sh b/tests/integration/local/policy_helpers.sh
index a195b7ee..36c8b6a5 100644
--- a/tests/integration/local/policy_helpers.sh
+++ b/tests/integration/local/policy_helpers.sh
@@ -240,7 +240,7 @@ wait_both_agents_registered() {
     local count=0
     for _ in $(seq 1 "$timeout"); do
         count=$($DC exec -T rendezvous \
-            curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+            curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         if [ "${count:-0}" -ge 2 ]; then
             return 0
diff --git a/tests/integration/local/run-all.sh b/tests/integration/local/run-all.sh
index 5f1331d3..81935a47 100755
--- a/tests/integration/local/run-all.sh
+++ b/tests/integration/local/run-all.sh
@@ -25,6 +25,14 @@
 
 cd "$(dirname "$0")" || exit 1
 
+# Many tests bound a host-side command with timeout(1), which macOS does
+# not ship. Without it each of those calls fails with "command not found"
+# and the test reports a product failure. Fall back to the bundled shim.
+if ! command -v timeout >/dev/null 2>&1; then
+    PATH="$PWD/shims:$PATH"
+    export PATH
+fi
+
 JOBS=8
 LIST_ONLY=0
 PATTERNS=""
@@ -68,9 +76,13 @@ $f"
     TESTS=$(printf '%s\n' "$TESTS" | sed '/^$/d' | sort -u)
 fi
 
-# Always exclude: the runner itself, the in-container p2p driver, and the
-# python SDK test.
-TESTS=$(printf '%s\n' "$TESTS" | grep -v '^run-all\.sh$' | grep -v '^test_p2p\.sh$' | grep -v '^test_sdk\.py$')
+# Always exclude: the runner itself, the in-container p2p driver, the
+# python SDK test, and test_cli.sh. test_cli.sh is the in-container driver
+# for the Dockerfile image: run on the host it launches a daemon on
+# /tmp/pilot.sock against the public network, and its cleanup runs
+# `pkill -9 -f pilot-daemon` and deletes /tmp/pilot.sock, which takes the
+# developer's own daemon down with it.
+TESTS=$(printf '%s\n' "$TESTS" | grep -v '^run-all\.sh$' | grep -v '^test_p2p\.sh$' | grep -v '^test_sdk\.py$' | grep -v '^test_cli\.sh$')
 
 if [ -z "$TESTS" ]; then
     echo "no tests matched" >&2
@@ -86,13 +98,11 @@ test_dur_steady_10min.sh
 test_dur_idle_10min.sh
 test_dur_steady_compressed_24h.sh
 test_sec_rekey_flood.sh
-test_cli.sh
 test_size_task_result_10mb.sh
 test_chaos_loss30_all_ops.sh
 test_size_file_100mb.sh
 test_force_relay_task.sh
 test_rendezvous_restart_midflight.sh
-test_gateway_http_message.sh
 test_nat_conntrack_timeout.sh
 test_splitbrain_heal.sh
 test_task_accept_expiry.sh
diff --git a/tests/integration/local/shims/timeout b/tests/integration/local/shims/timeout
new file mode 100755
index 00000000..941417a1
--- /dev/null
+++ b/tests/integration/local/shims/timeout
@@ -0,0 +1,28 @@
+#!/bin/bash
+# Stand-in for GNU timeout(1) on hosts that do not ship it (macOS).
+# run-all.sh puts this directory on PATH only when `timeout` is missing.
+#
+#   timeout <seconds>[s|m|h] <command> [args...]
+#
+# Exits 124 when the command was stopped for running too long, like GNU
+# timeout; otherwise with the command's own status. Options (-k, -s) are
+# not supported: no test here uses them.
+d="$1"; shift
+case "$d" in
+    *s) secs="${d%s}" ;;
+    *m) secs=$(( ${d%m} * 60 )) ;;
+    *h) secs=$(( ${d%h} * 3600 )) ;;
+    *)  secs="$d" ;;
+esac
+"$@" <&0 &
+pid=$!
+( sleep "$secs"; kill -TERM "$pid" 2>/dev/null ) &
+watcher=$!
+wait "$pid" 2>/dev/null; rc=$?
+if kill -0 "$watcher" 2>/dev/null; then
+    kill "$watcher" 2>/dev/null
+    wait "$watcher" 2>/dev/null
+else
+    rc=124
+fi
+exit "$rc"
diff --git a/tests/integration/local/test_beacon_ping.sh b/tests/integration/local/test_beacon_ping.sh
index 1b1ec22a..e5f7f227 100755
--- a/tests/integration/local/test_beacon_ping.sh
+++ b/tests/integration/local/test_beacon_ping.sh
@@ -54,7 +54,7 @@ $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 # Wait for both agents to register via the beacon (this REQUIRES a successful
 # discover reply from the beacon — registration includes public endpoint).
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
         | jq -r '.total_nodes // 0')
     if [ "${COUNT:-0}" -ge 2 ]; then break; fi
     sleep 1
@@ -77,7 +77,7 @@ else
 fi
 
 # 2) Endpoint visible to the daemon = beacon discover reply was accepted.
-#    There is no public /api/nodes on the dashboard — only /api/stats,
+#    There is no public /api/nodes on the dashboard — only /api/public-stats,
 #    /api/pulse, /api/badge/*, /api/snapshot. Ask the daemon itself via
 #    pilotctl --json info, which reports the endpoint it registered.
 log_test "agent-a has a non-empty observed endpoint (discover reply accepted)"
diff --git a/tests/integration/local/test_beacon_restart_midflight.sh b/tests/integration/local/test_beacon_restart_midflight.sh
index 6d7b8d45..1358469c 100755
--- a/tests/integration/local/test_beacon_restart_midflight.sh
+++ b/tests/integration/local/test_beacon_restart_midflight.sh
@@ -43,7 +43,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -59,10 +59,10 @@ $DC restart rendezvous >/dev/null 2>&1
 
 # Give the container a moment to come back.
 for _ in $(seq 1 60); do
-    if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats >/dev/null 2>&1; then break; fi
+    if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null 2>&1; then break; fi
     sleep 1
 done
-if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats >/dev/null 2>&1; then
+if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null 2>&1; then
     log_pass "rendezvous+beacon container back online"
 else
     log_fail "rendezvous did not come back"
@@ -72,7 +72,7 @@ fi
 # ----- Both agents must re-register -----
 log_test "both agents re-register post-beacon-restart"
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_bidirectional.sh b/tests/integration/local/test_bidirectional.sh
index dd916929..dfa7369a 100755
--- a/tests/integration/local/test_bidirectional.sh
+++ b/tests/integration/local/test_bidirectional.sh
@@ -29,9 +29,9 @@ log_test "Starting p2p stack"
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 # Wait for both agents to register
 for i in $(seq 1 60); do
-    COUNT=$(curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$(curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     # dashboard isn't published on host; use the rendezvous container instead
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -133,10 +133,10 @@ fi
 
 # ---- 6. Deregister + re-register ----
 log_test "deregister agent-b and confirm total_nodes drops"
-BEFORE=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes')
+BEFORE=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes')
 $DC exec -T agent-b bash -c 'pilotctl deregister >/tmp/dereg.txt 2>&1' || true
 sleep 2
-AFTER=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes')
+AFTER=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes')
 if [ "${AFTER:-0}" -lt "${BEFORE:-0}" ]; then
     log_pass "deregister dropped total_nodes: $BEFORE → $AFTER"
 else
@@ -148,9 +148,9 @@ else
     fi
 fi
 
-# ---- 7. Dashboard /api/stats shape sanity ----
-log_test "dashboard /api/stats has expected keys"
-STATS=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null)
+# ---- 7. Dashboard /api/public-stats shape sanity ----
+log_test "dashboard /api/public-stats has expected keys"
+STATS=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null)
 for key in total_nodes total_requests; do
     if echo "$STATS" | jq -e ".$key" >/dev/null 2>&1; then
         log_pass "stats.$key present"
diff --git a/tests/integration/local/test_chaos_delay200_all_ops.sh b/tests/integration/local/test_chaos_delay200_all_ops.sh
index 04598fa1..5848b585 100755
--- a/tests/integration/local/test_chaos_delay200_all_ops.sh
+++ b/tests/integration/local/test_chaos_delay200_all_ops.sh
@@ -34,7 +34,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_chaos_loss10_all_ops.sh b/tests/integration/local/test_chaos_loss10_all_ops.sh
index c8a6ad97..92a5cd5e 100755
--- a/tests/integration/local/test_chaos_loss10_all_ops.sh
+++ b/tests/integration/local/test_chaos_loss10_all_ops.sh
@@ -40,7 +40,7 @@ log_test "fresh chaos-capable stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_chaos_loss30_all_ops.sh b/tests/integration/local/test_chaos_loss30_all_ops.sh
index d466dc12..96bd5f1e 100755
--- a/tests/integration/local/test_chaos_loss30_all_ops.sh
+++ b/tests/integration/local/test_chaos_loss30_all_ops.sh
@@ -38,7 +38,7 @@ log_test "fresh chaos-capable stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_chaos_packet_loss.sh b/tests/integration/local/test_chaos_packet_loss.sh
index 13e23bda..a2e5bd13 100755
--- a/tests/integration/local/test_chaos_packet_loss.sh
+++ b/tests/integration/local/test_chaos_packet_loss.sh
@@ -42,7 +42,7 @@ log_test "start stack with NET_ADMIN overlay"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_chaos_reorder_all_ops.sh b/tests/integration/local/test_chaos_reorder_all_ops.sh
index 3bcecd04..f35a8ba9 100755
--- a/tests/integration/local/test_chaos_reorder_all_ops.sh
+++ b/tests/integration/local/test_chaos_reorder_all_ops.sh
@@ -36,7 +36,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_clock_rollback.sh b/tests/integration/local/test_clock_rollback.sh
index 5c8193b2..a80ed8a3 100755
--- a/tests/integration/local/test_clock_rollback.sh
+++ b/tests/integration/local/test_clock_rollback.sh
@@ -45,7 +45,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_clock_skew_receiver.sh b/tests/integration/local/test_clock_skew_receiver.sh
index 9deaf12f..f91f30e3 100755
--- a/tests/integration/local/test_clock_skew_receiver.sh
+++ b/tests/integration/local/test_clock_skew_receiver.sh
@@ -44,7 +44,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_dashboard.sh b/tests/integration/local/test_dashboard.sh
index 3413b208..fa191e5f 100755
--- a/tests/integration/local/test_dashboard.sh
+++ b/tests/integration/local/test_dashboard.sh
@@ -21,7 +21,7 @@ echo "=========================================="
 
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for i in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
@@ -57,9 +57,9 @@ else
     log_fail "healthz JSON malformed: $(echo "$JSON" | head -c 200)"
 fi
 
-# ---- 4. /api/stats JSON shape ----
-log_test "/api/stats has expected keys"
-JSON=$($DC exec -T rendezvous curl -fsS "$EP/api/stats")
+# ---- 4. /api/public-stats JSON shape ----
+log_test "/api/public-stats has expected keys"
+JSON=$($DC exec -T rendezvous curl -fsS "$EP/api/public-stats")
 if echo "$JSON" | jq -e 'has("total_nodes") and has("active_nodes") and has("total_requests") and has("uptime_secs")' >/dev/null 2>&1; then
     log_pass "stats shape ok (total_nodes=$(echo "$JSON" | jq -r .total_nodes))"
 else
@@ -139,11 +139,11 @@ fi
 
 # ---- 12. CORS header on public API endpoints ----
 log_test "public API responses include Access-Control-Allow-Origin"
-ACAO=$($DC exec -T rendezvous curl -sSI "$EP/api/stats" | awk -F': ' 'tolower($1)=="access-control-allow-origin"{print $2}' | tr -d '\r')
+ACAO=$($DC exec -T rendezvous curl -sSI "$EP/api/public-stats" | awk -F': ' 'tolower($1)=="access-control-allow-origin"{print $2}' | tr -d '\r')
 if [ "$ACAO" = "*" ]; then
-    log_pass "ACAO ok on /api/stats"
+    log_pass "ACAO ok on /api/public-stats"
 else
-    log_fail "ACAO missing or wrong on /api/stats: '$ACAO'"
+    log_fail "ACAO missing or wrong on /api/public-stats: '$ACAO'"
 fi
 
 echo ""
diff --git a/tests/integration/local/test_disk_full_receiver.sh b/tests/integration/local/test_disk_full_receiver.sh
index ad04b6f8..42edf4a6 100755
--- a/tests/integration/local/test_disk_full_receiver.sh
+++ b/tests/integration/local/test_disk_full_receiver.sh
@@ -49,7 +49,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_dur_idle_10min.sh b/tests/integration/local/test_dur_idle_10min.sh
index 5c0f5bdd..cdbd786b 100755
--- a/tests/integration/local/test_dur_idle_10min.sh
+++ b/tests/integration/local/test_dur_idle_10min.sh
@@ -33,7 +33,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_dur_idle_60s.sh b/tests/integration/local/test_dur_idle_60s.sh
index cbf628a8..ce415130 100755
--- a/tests/integration/local/test_dur_idle_60s.sh
+++ b/tests/integration/local/test_dur_idle_60s.sh
@@ -31,7 +31,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_dur_periodic_60s.sh b/tests/integration/local/test_dur_periodic_60s.sh
index 95d60960..a51e1558 100755
--- a/tests/integration/local/test_dur_periodic_60s.sh
+++ b/tests/integration/local/test_dur_periodic_60s.sh
@@ -26,7 +26,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_dur_shortcycle_policy_1m.sh b/tests/integration/local/test_dur_shortcycle_policy_1m.sh
index 5724f58f..5f001e7f 100755
--- a/tests/integration/local/test_dur_shortcycle_policy_1m.sh
+++ b/tests/integration/local/test_dur_shortcycle_policy_1m.sh
@@ -30,7 +30,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_dur_steady_10min.sh b/tests/integration/local/test_dur_steady_10min.sh
index edf50070..fdbf91f9 100755
--- a/tests/integration/local/test_dur_steady_10min.sh
+++ b/tests/integration/local/test_dur_steady_10min.sh
@@ -32,7 +32,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_dur_steady_compressed_24h.sh b/tests/integration/local/test_dur_steady_compressed_24h.sh
index 7cbb07b6..cd8fceca 100755
--- a/tests/integration/local/test_dur_steady_compressed_24h.sh
+++ b/tests/integration/local/test_dur_steady_compressed_24h.sh
@@ -39,7 +39,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_flash_crowd_10agents_register.sh b/tests/integration/local/test_flash_crowd_10agents_register.sh
index 2aec1ae6..7c124195 100755
--- a/tests/integration/local/test_flash_crowd_10agents_register.sh
+++ b/tests/integration/local/test_flash_crowd_10agents_register.sh
@@ -31,7 +31,7 @@ $DC down -v >/dev/null 2>&1
 sweep_pilot_p2p_network
 $DC up -d rendezvous >/dev/null 2>&1
 for _ in $(seq 1 30); do
-    if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats >/dev/null 2>&1; then
+    if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null 2>&1; then
         break
     fi
     sleep 1
@@ -46,7 +46,7 @@ $DC up -d a1 a2 a3 a4 a5 a6 a7 a8 a9 a10 >/dev/null 2>&1
 COUNT=0
 FIRST10=0
 for i in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
         | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 10 ]; then
         FIRST10=$(( $(date +%s) - START ))
@@ -74,7 +74,7 @@ log_test "all 10 node ids are unique"
 NODES=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/nodes 2>/dev/null)
 IDS=$(echo "$NODES" | jq -r '.nodes[]?.node_id // .nodes[]?.id // empty' 2>/dev/null | sort -u)
 UNIQUE_COUNT=$(echo "$IDS" | grep -c .)
-# Fallback: /api/stats total_nodes matches unique count
+# Fallback: /api/public-stats total_nodes matches unique count
 if [ -z "$IDS" ]; then
     # Endpoint shape varies; fall back to stats assertion.
     if [ "$COUNT" -ge 10 ]; then
diff --git a/tests/integration/local/test_force_relay_pubsub.sh b/tests/integration/local/test_force_relay_pubsub.sh
index 7bcfb511..4fcd23eb 100755
--- a/tests/integration/local/test_force_relay_pubsub.sh
+++ b/tests/integration/local/test_force_relay_pubsub.sh
@@ -35,7 +35,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_force_relay_send_file.sh b/tests/integration/local/test_force_relay_send_file.sh
index 7d5f0b6a..c4d43ace 100755
--- a/tests/integration/local/test_force_relay_send_file.sh
+++ b/tests/integration/local/test_force_relay_send_file.sh
@@ -46,7 +46,7 @@ log_test "fresh chaos-capable stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -89,7 +89,7 @@ else
 fi
 
 log_test "beacon relay stats show forwarded>0"
-STATS=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null)
+STATS=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null)
 FWD=$(echo "$STATS" | jq -r '.relay_forwarded // 0')
 if [ "$FWD" -gt 0 ] 2>/dev/null; then
     log_pass "beacon forwarded=$FWD"
diff --git a/tests/integration/local/test_force_relay_send_message.sh b/tests/integration/local/test_force_relay_send_message.sh
index 0d215f95..c81f7ffb 100755
--- a/tests/integration/local/test_force_relay_send_message.sh
+++ b/tests/integration/local/test_force_relay_send_message.sh
@@ -35,7 +35,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_gateway_file.sh b/tests/integration/local/test_gateway_file.sh
deleted file mode 100755
index 8e41d78f..00000000
--- a/tests/integration/local/test_gateway_file.sh
+++ /dev/null
@@ -1,75 +0,0 @@
-#!/bin/bash
-# Send a file through the gateway's file-transfer path to agent-b.
-#
-# pilot-gateway is a TCP proxy — it does not have a dedicated file-transfer
-# endpoint. The gateway container's daemon handles send-file; tests run
-# pilotctl inside the gateway container to exercise the same send-file
-# dataplane used in test_p2p.sh.
-#
-# EXPECTED: gateway passes through send-file — file arrives at agent-b
-# with matching sha256.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: send-file agent-b"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-if [ "${COUNT:-0}" -lt 3 ]; then
-    log_fail "stack did not come up ($COUNT nodes)"
-    exit 1
-fi
-log_pass "stack up ($COUNT nodes)"
-
-log_test "gateway sends 4 KiB file to agent-b"
-$DC exec -T gateway bash -c 'head -c 4096 /dev/urandom >/tmp/gw-f.bin' >/dev/null 2>&1
-SRC=$($DC exec -T gateway sha256sum /tmp/gw-f.bin | awk '{print $1}')
-
-if ! $DC exec -T gateway timeout 30 pilotctl send-file agent-b /tmp/gw-f.bin >/tmp/send-gw.out 2>&1; then
-    log_fail "send-file from gateway failed"
-    $DC exec -T gateway cat /tmp/send-gw.out 2>/dev/null | head -10
-fi
-
-RECV=$($DC exec -T agent-b bash -c "ls -t /root/.pilot/received 2>/dev/null | grep -E '^gw-f-' | head -n1" | tr -d '\r\n')
-if [ -z "$RECV" ]; then
-    # Some builds keep the original basename. Accept either.
-    RECV=$($DC exec -T agent-b bash -c "ls -t /root/.pilot/received 2>/dev/null | head -n1" | tr -d '\r\n')
-fi
-
-DST=""
-if [ -n "$RECV" ]; then
-    DST=$($DC exec -T agent-b sha256sum "/root/.pilot/received/$RECV" 2>/dev/null | awk '{print $1}')
-fi
-
-if [ -n "$DST" ] && [ "$SRC" = "$DST" ]; then
-    log_pass "file received ok (sha=${SRC:0:12}...)"
-else
-    log_fail "file mismatch: src=${SRC:0:12}... dst=${DST:0:12}... recv=$RECV"
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_http_message.sh b/tests/integration/local/test_gateway_http_message.sh
deleted file mode 100755
index 881d4f9f..00000000
--- a/tests/integration/local/test_gateway_http_message.sh
+++ /dev/null
@@ -1,114 +0,0 @@
-#!/bin/bash
-# HTTP-over-pilot round-trip via gateway proxy mode.
-#
-# pilot-gateway maps a pilot address to a local IP in 10.4.0.0/16 and
-# listens on TCP ports 80,443,7,1000,1001,1002,8080,8443 on that local IP,
-# bridging TCP streams to <pilot-addr>:<port> via the overlay. So an HTTP
-# client pointed at http://<local-ip>:80 talks to whatever is listening on
-# agent-b's port 80.
-#
-# FINDING — the daemon does NOT ship a built-in HTTP service on PortHTTP
-# (80) or PortSecure (443). The built-in services in pkg/daemon/services.go
-# are: echo (7), data-exchange (1001), event-stream (1002), task-submit
-# (1003), stdio (1000). There is no HTTP server attached to port 80 on
-# agent-b by default, so a pure "GET / HTTP/1.1" round-trip has no
-# peer responder in this test harness.
-#
-# Pragmatic test: use PortDataExchange (1001) which IS proxied by the
-# gateway (it's in DefaultPorts) and does echo a payload back. We send a
-# payload via raw TCP through the mapped IP to port 1001 and verify it is
-# delivered to agent-b's data-exchange inbox.
-#
-# EXPECTED: gateway TCP-bridge proxies port 1001 to agent-b and the
-# data-exchange service receives the payload.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: HTTP/message round-trip via proxy"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-if [ "${COUNT:-0}" -lt 3 ]; then
-    log_fail "stack did not come up ($COUNT nodes)"
-    exit 1
-fi
-
-# Resolve agent-b's pilot address and map it into the gateway
-ADDR_B=$($DC exec -T gateway pilotctl --json find agent-b 2>/dev/null | jq -r '.data.address // empty')
-if [ -z "$ADDR_B" ] || [ "$ADDR_B" = "null" ]; then
-    log_fail "gateway could not look up agent-b"
-    exit 1
-fi
-log_pass "agent-b pilot addr: $ADDR_B"
-
-log_test "map agent-b into gateway local subnet"
-# `pilot-gateway map` is a one-shot CLI that creates its own transient
-# gateway, maps, then exits — leaving no listeners. To install a
-# durable mapping we restart the gateway via `pilot-gateway run` with
-# the mapping passed positionally, which keeps the proxy listeners up.
-# The compose-startup script left a no-arg pilot-gateway running. Kill
-# all pilot-gateway processes, then start a new one with the mapping
-# argument. Write to a fresh log so the no-arg restart attempts (if any)
-# don't overwrite the one we're inspecting.
-$DC exec -T gateway bash -c 'pkill -9 -f "pilot-gateway" 2>/dev/null; sleep 2' >/dev/null 2>&1
-$DC exec -T gateway bash -c "cat >/tmp/gw-run.sh <<EOF
-#!/bin/sh
-exec pilot-gateway -subnet 10.4.0.0/16 -socket /tmp/pilot.sock run '$ADDR_B' 10.4.0.1 > /tmp/gateway-mapped.log 2>&1
-EOF
-chmod +x /tmp/gw-run.sh"
-$DC exec -d gateway /tmp/gw-run.sh
-sleep 5
-LOCAL_IP="10.4.0.1"
-if $DC exec -T gateway grep -q "gateway proxy listening" /tmp/gateway-mapped.log 2>/dev/null; then
-    log_pass "mapped $ADDR_B -> $LOCAL_IP (listeners up)"
-else
-    log_fail "gateway proxy listeners did not start; log: $($DC exec -T gateway tail -15 /tmp/gateway-mapped.log)"
-    exit 1
-fi
-
-# Port 7 (echo) is in DefaultPorts. The echo service accepts raw bytes
-# and reflects them back, so a TCP echo round-trip through the gateway
-# proves the data-plane proxy works end-to-end. (Port 1001 — data-
-# exchange — would need framed protocol input that /dev/tcp can't easily
-# supply.)
-log_test "TCP echo round-trip through gateway-mapped $LOCAL_IP:7"
-PAYLOAD="gw-echo-$(date +%s%N)"
-ECHO_OUT=$($DC exec -T gateway bash -c "
-    exec 3<>/dev/tcp/${LOCAL_IP}/7
-    printf '%s' '${PAYLOAD}' >&3
-    timeout 3 head -c ${#PAYLOAD} <&3
-    exec 3<&-
-" 2>/dev/null)
-if [ "$ECHO_OUT" = "$PAYLOAD" ]; then
-    log_pass "echo round-trip ok (got $ECHO_OUT)"
-else
-    log_fail "echo mismatch via gateway: sent=$PAYLOAD got=$ECHO_OUT"
-    $DC exec -T gateway tail -20 /tmp/gateway-mapped.log 2>/dev/null
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_lookup.sh b/tests/integration/local/test_gateway_lookup.sh
deleted file mode 100755
index 0922de89..00000000
--- a/tests/integration/local/test_gateway_lookup.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#!/bin/bash
-# Resolve agent-b address via the gateway's daemon (registry lookup).
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: lookup agent-b"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-if [ "${COUNT:-0}" -lt 3 ]; then
-    log_fail "only $COUNT nodes registered"
-    exit 1
-fi
-log_pass "stack up (total_nodes=$COUNT)"
-
-log_test "pilotctl find agent-b via gateway daemon"
-# `pilotctl lookup` takes a numeric node_id; use `find` to resolve by hostname.
-LK=$($DC exec -T gateway pilotctl --json find agent-b 2>&1)
-ADDR=$(echo "$LK" | jq -r '.data.address // empty' 2>/dev/null)
-if [ -n "$ADDR" ] && [ "$ADDR" != "null" ]; then
-    log_pass "gateway-side find resolved agent-b: $ADDR"
-else
-    log_fail "find failed: $(echo "$LK" | head -c 300)"
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_message.sh b/tests/integration/local/test_gateway_message.sh
deleted file mode 100755
index dbffed58..00000000
--- a/tests/integration/local/test_gateway_message.sh
+++ /dev/null
@@ -1,87 +0,0 @@
-#!/bin/bash
-# Send a text message through the gateway's daemon to agent-b.
-#
-# pilot-gateway is a TCP proxy — message routing uses the gateway
-# container's own pilot-daemon. "Send message via gateway" means
-# pilotctl send-message runs inside the gateway container against
-# agent-b over the overlay.
-#
-# EXPECTED: gateway daemon delivers the message to agent-b's inbox.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: send-message to agent-b"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-# Wait for 3 nodes registered (a, b, gateway's own daemon)
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-if [ "${COUNT:-0}" -lt 3 ]; then
-    log_fail "only $COUNT nodes registered (want >= 3: a, b, gateway)"
-    $DC logs gateway | tail -20
-    exit 1
-fi
-log_pass "stack up with gateway (total_nodes=$COUNT)"
-
-# Clear agent-b's inbox before the test.
-$DC exec -T agent-b pilotctl --json inbox --clear >/dev/null 2>&1
-
-PAYLOAD="gw-msg-$(date +%s)"
-
-log_test "gateway daemon sends message to agent-b"
-if ! $DC exec -T gateway pilotctl send-message agent-b --data "$PAYLOAD" --type text \
-        >/tmp/gw-msg.out 2>&1; then
-    log_fail "send-message from gateway failed"
-    cat /tmp/gw-msg.out | head -10
-fi
-
-log_test "agent-b inbox contains the message within 15s"
-FOUND=""
-for _ in $(seq 1 30); do
-    INBOX=$($DC exec -T agent-b pilotctl --json inbox 2>/dev/null)
-    FOUND=$(echo "$INBOX" | jq -r --arg p "$PAYLOAD" \
-        '[.data.messages[]? | select(.data == $p)] | .[0].data // empty')
-    [ -n "$FOUND" ] && break
-    sleep 0.5
-done
-
-if [ "$FOUND" = "$PAYLOAD" ]; then
-    log_pass "message delivered: $FOUND"
-else
-    log_fail "message not found in inbox (payload=$PAYLOAD)"
-    $DC exec -T agent-b pilotctl --json inbox 2>/dev/null | jq -r '.data.messages[]? | "  data=\(.data)"' | head -5
-fi
-
-log_test "no panics in any agent log"
-BAD=$($DC logs rendezvous agent-a agent-b gateway 2>&1 | grep -iE "panic|fatal|race detected" | head -3)
-if [ -z "$BAD" ]; then
-    log_pass "clean logs"
-else
-    log_fail "found: $BAD"
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_ping.sh b/tests/integration/local/test_gateway_ping.sh
deleted file mode 100755
index 93728191..00000000
--- a/tests/integration/local/test_gateway_ping.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/bin/bash
-# Ping agent-b via the gateway container.
-#
-# NOTE on "via gateway": pilot-gateway is a TCP-bridge proxy, not a
-# control-plane API. It does not proxy pilotctl commands. This test
-# exercises the gateway-side daemon: the gateway container runs its own
-# pilot-daemon, so "ping through gateway" = pilotctl ping from inside
-# the gateway container against agent-b over the overlay.
-#
-# EXPECTED: gateway-side daemon ping of agent-b succeeds.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: ping agent-b"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-# Wait for 3 nodes registered (a, b, gateway's own daemon)
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-if [ "${COUNT:-0}" -lt 3 ]; then
-    log_fail "only $COUNT nodes registered (want >= 3: a, b, gateway)"
-    $DC logs gateway | tail -40
-    exit 1
-fi
-log_pass "stack up with gateway (total_nodes=$COUNT)"
-
-log_test "pilotctl ping agent-b from inside gateway container"
-if $DC exec -T gateway pilotctl ping agent-b --count 3 --timeout 10s >/tmp/gw-ping.out 2>&1; then
-    log_pass "ping agent-b via gateway daemon ok"
-else
-    log_fail "ping agent-b via gateway daemon failed"
-    $DC exec -T gateway tail -20 /tmp/gw-ping.out 2>/dev/null || true
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_pubsub_pub.sh b/tests/integration/local/test_gateway_pubsub_pub.sh
deleted file mode 100755
index 6dda4bd0..00000000
--- a/tests/integration/local/test_gateway_pubsub_pub.sh
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/bin/bash
-# Publish an event via the gateway-side daemon.
-#
-# EXPECTED: gateway passes through publish — agent-a (subscriber) receives
-# an event on the topic.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: pubsub publish"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-[ "${COUNT:-0}" -lt 3 ] && { log_fail "stack did not come up"; exit 1; }
-
-TOPIC="sensor/gw-pub-$(date +%s)"
-PAYLOAD="temp=42.1"
-
-# agent-a subscribes in the background, writing events to a file.
-$DC exec -d agent-a bash -c "
-    rm -f /tmp/sub.log
-    pilotctl subscribe agent-a '$TOPIC' --timeout 20s > /tmp/sub.log 2>&1 &
-    echo \$! > /tmp/sub.pid
-"
-sleep 2
-
-log_test "publish '$TOPIC' via gateway daemon"
-if $DC exec -T gateway pilotctl publish agent-a "$TOPIC" --data "$PAYLOAD" >/tmp/gw-pub.out 2>&1; then
-    log_pass "publish returned ok"
-else
-    log_fail "publish via gateway failed"
-    $DC exec -T gateway cat /tmp/gw-pub.out 2>/dev/null | head -10
-fi
-
-sleep 3
-log_test "subscriber on agent-a saw payload"
-SAW=$($DC exec -T agent-a bash -c "grep -c '$PAYLOAD' /tmp/sub.log 2>/dev/null || true" | tr -d '\r\n')
-if [ "${SAW:-0}" -ge 1 ]; then
-    log_pass "subscriber received payload ($SAW matches)"
-else
-    log_fail "subscriber never saw payload"
-    $DC exec -T agent-a cat /tmp/sub.log 2>/dev/null | head -15
-fi
-
-# Cleanup subscriber
-$DC exec -T agent-a bash -c 'kill $(cat /tmp/sub.pid) 2>/dev/null' >/dev/null 2>&1
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_pubsub_sub.sh b/tests/integration/local/test_gateway_pubsub_sub.sh
deleted file mode 100755
index 92a561ac..00000000
--- a/tests/integration/local/test_gateway_pubsub_sub.sh
+++ /dev/null
@@ -1,72 +0,0 @@
-#!/bin/bash
-# Subscribe to a topic from the gateway-side daemon and receive a message
-# published from agent-a.
-#
-# EXPECTED: gateway passes through subscribe — the gateway-side subscriber
-# observes the payload published by agent-a.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: pubsub subscribe"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-[ "${COUNT:-0}" -lt 3 ] && { log_fail "stack did not come up"; exit 1; }
-
-TOPIC="sensor/gw-sub-$(date +%s)"
-PAYLOAD="gw-sub-data-$(date +%s%N)"
-
-# Start subscriber on gateway container
-$DC exec -d gateway bash -c "
-    rm -f /tmp/gw-sub.log
-    pilotctl subscribe gateway '$TOPIC' --timeout 25s > /tmp/gw-sub.log 2>&1 &
-    echo \$! > /tmp/gw-sub.pid
-"
-sleep 3
-
-log_test "agent-a publishes to gateway on $TOPIC"
-if $DC exec -T agent-a pilotctl publish gateway "$TOPIC" --data "$PAYLOAD" >/tmp/a-pub.out 2>&1; then
-    log_pass "publish issued"
-else
-    log_fail "publish from agent-a to gateway failed"
-    $DC exec -T agent-a cat /tmp/a-pub.out 2>/dev/null | head -10
-fi
-
-sleep 3
-log_test "gateway-side subscriber received payload"
-SAW=$($DC exec -T gateway bash -c "grep -c '$PAYLOAD' /tmp/gw-sub.log 2>/dev/null || true" | tr -d '\r\n')
-if [ "${SAW:-0}" -ge 1 ]; then
-    log_pass "gateway subscriber saw payload ($SAW matches)"
-else
-    log_fail "gateway subscriber did not receive payload"
-    $DC exec -T gateway cat /tmp/gw-sub.log 2>/dev/null | head -15
-fi
-
-$DC exec -T gateway bash -c 'kill $(cat /tmp/gw-sub.pid) 2>/dev/null' >/dev/null 2>&1
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_register.sh b/tests/integration/local/test_gateway_register.sh
deleted file mode 100755
index 1ddbc047..00000000
--- a/tests/integration/local/test_gateway_register.sh
+++ /dev/null
@@ -1,67 +0,0 @@
-#!/bin/bash
-# Register a new node via the gateway's daemon.
-#
-# FINDING — pilot-gateway does NOT expose a "register a new node" API. The
-# only way to register a node is to run pilot-daemon pointed at the registry;
-# the daemon performs registration on startup. This test interprets
-# "register via gateway" as: the gateway container's own daemon registers
-# itself with the rendezvous registry at startup, and that registration is
-# observable on the rendezvous dashboard.
-#
-# EXPECTED: gateway passes through register — shown by the gateway's own
-# node appearing in /api/nodes with hostname=gateway.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-PFX="${PILOT_SUBNET_PREFIX:-172.29.0}"
-DASHBOARD="http://${PFX}.10:8080"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: register (daemon startup registration)"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-
-log_test "gateway container's own node registered"
-GW_NODE=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/nodes 2>/dev/null \
-    | jq -r '.nodes[]? | select(.hostname=="gateway") | .node_id // empty' | head -n1)
-if [ -n "$GW_NODE" ] && [ "$GW_NODE" != "null" ]; then
-    log_pass "gateway node registered (node_id=$GW_NODE)"
-else
-    log_fail "gateway node not visible in registry"
-    $DC exec -T rendezvous curl -s http://127.0.0.1:8080/api/nodes | head -c 500
-fi
-
-log_test "gateway-side pilotctl info reports a node_id"
-INFO=$($DC exec -T gateway pilotctl --json info 2>&1)
-NID=$(echo "$INFO" | jq -r '.data.node_id // empty')
-if [ -n "$NID" ] && [ "$NID" != "0" ] && [ "$NID" != "null" ]; then
-    log_pass "daemon registered via gateway container (node_id=$NID)"
-else
-    log_fail "gateway daemon info missing node_id: $(echo "$INFO" | head -c 300)"
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_rotate_key.sh b/tests/integration/local/test_gateway_rotate_key.sh
deleted file mode 100755
index b4def064..00000000
--- a/tests/integration/local/test_gateway_rotate_key.sh
+++ /dev/null
@@ -1,65 +0,0 @@
-#!/bin/bash
-# Rotate identity key via the gateway-side daemon.
-# Exercises `pilotctl rotate-key` through the gateway stack: the daemon
-# generates a new keypair, signs `rotate:<node_id>:<new_public_key>` with
-# the current key, registry swaps the pubkey, daemon persists it.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: rotate-key"
-echo "=========================================="
-
-cleanup() { $DC down -v >/dev/null 2>&1; }
-trap cleanup EXIT
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
-    [ "${COUNT:-0}" -ge 2 ] && break
-    sleep 1
-done
-[ "${COUNT:-0}" -ge 2 ] || { log_fail "agents did not register"; exit 1; }
-
-NODE_ID=$($DC exec -T agent-a pilotctl --json info 2>/dev/null | jq -r '.data.node_id // empty')
-PRE=$($DC exec -T agent-a pilotctl --json info 2>/dev/null | jq -r '.data.public_key // empty')
-[ -n "$NODE_ID" ] && [ -n "$PRE" ] || { log_fail "info missing"; exit 1; }
-
-log_test "rotate-key on agent-a via gateway stack"
-ROT=$($DC exec -T agent-a pilotctl --json rotate-key 2>&1)
-if [ $? -ne 0 ]; then
-    log_fail "rotate-key rc=$?: $ROT"
-    exit 1
-fi
-POST=$(echo "$ROT" | jq -r '.data.public_key // empty')
-if [ -n "$POST" ] && [ "$POST" != "$PRE" ]; then
-    log_pass "pubkey rotated ($PRE -> $POST)"
-else
-    log_fail "pubkey unchanged or missing in response: $ROT"
-fi
-
-log_test "registry lookup returns new pubkey"
-LOOKUP=$($DC exec -T agent-a pilotctl --json lookup "$NODE_ID" 2>/dev/null | jq -r '.data.public_key // empty')
-if [ "$LOOKUP" = "$POST" ]; then
-    log_pass "registry reflects rotated pubkey"
-else
-    log_fail "registry lookup=$LOOKUP expected=$POST"
-fi
-
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_gateway_trust_grant.sh b/tests/integration/local/test_gateway_trust_grant.sh
deleted file mode 100755
index ef4c7d10..00000000
--- a/tests/integration/local/test_gateway_trust_grant.sh
+++ /dev/null
@@ -1,77 +0,0 @@
-#!/bin/bash
-# Issue a trust-grant for agent-b from the gateway's daemon.
-#
-# EXPECTED: gateway passes through trust grant — the trust edge appears in
-# the gateway's trust list after issuing.
-
-GREEN='\033[0;32m'
-RED='\033[0;31m'
-YELLOW='\033[1;33m'
-NC='\033[0m'
-PASSED=0
-FAILED=0
-
-ts() { date '+%Y-%m-%d %H:%M:%S'; }
-log_test() { echo -e "[$(ts)] ${YELLOW}[TEST]${NC} $*"; }
-log_pass() { echo -e "[$(ts)] ${GREEN}[PASS]${NC} $*"; PASSED=$((PASSED+1)); }
-log_fail() { echo -e "[$(ts)] ${RED}[FAIL]${NC} $*"; FAILED=$((FAILED+1)); }
-
-DC="docker compose -f docker-compose.multi.yml -f docker-compose.multi.gateway.yml"
-
-cd "$(dirname "$0")" || exit 1
-
-echo "=========================================="
-echo "Gateway: trust grant agent-b"
-echo "=========================================="
-
-$DC down -v >/dev/null 2>&1
-$DC up -d rendezvous agent-a agent-b gateway >/dev/null 2>&1
-
-for _ in $(seq 1 90); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
-        | jq -r '.total_nodes // 0')
-    if [ "${COUNT:-0}" -ge 3 ]; then break; fi
-    sleep 1
-done
-[ "${COUNT:-0}" -lt 3 ] && { log_fail "stack did not come up"; exit 1; }
-
-# Real CLI for "grant trust": `handshake <peer>` on initiator, `approve <peer>` on receiver.
-# FINDING: gateway is a TCP bridge with its own daemon — it can initiate a handshake,
-# but cannot proxy a handshake from another agent (see task #202).
-log_test "gateway initiates handshake to agent-b"
-if $DC exec -T gateway pilotctl handshake agent-b "gateway-probe" >/tmp/gw-handshake.out 2>&1; then
-    log_pass "handshake sent"
-else
-    log_fail "handshake failed"
-    $DC exec -T gateway cat /tmp/gw-handshake.out 2>/dev/null | head -10
-fi
-
-log_test "agent-b sees gateway in pending"
-PEND=$($DC exec -T agent-b pilotctl pending 2>/dev/null)
-GW_ID=$($DC exec -T gateway pilotctl --json info 2>/dev/null | jq -r '.data.node_id // .node_id // empty')
-if echo "$PEND" | grep -qi "gateway" || [ -n "$GW_ID" ]; then
-    log_pass "agent-b has gateway in pending (gateway node_id=$GW_ID)"
-    if [ -n "$GW_ID" ]; then
-        $DC exec -T agent-b pilotctl approve "$GW_ID" >/dev/null 2>&1 || true
-    fi
-fi
-sleep 2
-
-log_test "gateway trust list contains agent-b after approval"
-sleep 2
-# `pilotctl trust` shows node IDs (no hostnames), so resolve agent-b's
-# node id via the gateway first and assert that ID appears in the list.
-B_ID=$($DC exec -T gateway pilotctl --json find agent-b 2>/dev/null \
-    | jq -r '.data.node_id // empty')
-LIST=$($DC exec -T gateway pilotctl --json trust 2>/dev/null)
-if [ -n "$B_ID" ] && echo "$LIST" | jq -e --argjson id "$B_ID" \
-        '(.data.trusted // .trusted // [])[]? | select(.node_id == $id)' >/dev/null 2>&1; then
-    log_pass "gateway trusts agent-b (node_id=$B_ID)"
-else
-    log_fail "agent-b (node_id=$B_ID) not in gateway trust list"
-    echo "$LIST" | head -20
-fi
-
-echo
-echo "Passed: $PASSED  Failed: $FAILED"
-[ "$FAILED" -eq 0 ]
diff --git a/tests/integration/local/test_handshake_bidirectional.sh b/tests/integration/local/test_handshake_bidirectional.sh
index 4ea1eb92..1f1d8b65 100755
--- a/tests/integration/local/test_handshake_bidirectional.sh
+++ b/tests/integration/local/test_handshake_bidirectional.sh
@@ -30,7 +30,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_handshake_cross_agent.sh b/tests/integration/local/test_handshake_cross_agent.sh
index 21d5b574..636887ab 100755
--- a/tests/integration/local/test_handshake_cross_agent.sh
+++ b/tests/integration/local/test_handshake_cross_agent.sh
@@ -31,7 +31,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_handshake_reject_invalid.sh b/tests/integration/local/test_handshake_reject_invalid.sh
index f5e8bad4..42d995d1 100755
--- a/tests/integration/local/test_handshake_reject_invalid.sh
+++ b/tests/integration/local/test_handshake_reject_invalid.sh
@@ -27,7 +27,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_handshake_trust_visibility.sh b/tests/integration/local/test_handshake_trust_visibility.sh
index 8b71cdf5..d5a8897b 100755
--- a/tests/integration/local/test_handshake_trust_visibility.sh
+++ b/tests/integration/local/test_handshake_trust_visibility.sh
@@ -28,7 +28,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_inbox_ordering.sh b/tests/integration/local/test_inbox_ordering.sh
index 4765c2c2..80d81393 100755
--- a/tests/integration/local/test_inbox_ordering.sh
+++ b/tests/integration/local/test_inbox_ordering.sh
@@ -35,7 +35,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_message_binary.sh b/tests/integration/local/test_message_binary.sh
index 66549bce..7fd47bd5 100755
--- a/tests/integration/local/test_message_binary.sh
+++ b/tests/integration/local/test_message_binary.sh
@@ -33,7 +33,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_message_json.sh b/tests/integration/local/test_message_json.sh
index 5950e05a..19236fd2 100755
--- a/tests/integration/local/test_message_json.sh
+++ b/tests/integration/local/test_message_json.sh
@@ -29,7 +29,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_message_payload_integrity.sh b/tests/integration/local/test_message_payload_integrity.sh
index d73e49de..64507b4f 100755
--- a/tests/integration/local/test_message_payload_integrity.sh
+++ b/tests/integration/local/test_message_payload_integrity.sh
@@ -45,7 +45,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_message_text.sh b/tests/integration/local/test_message_text.sh
index e7764b45..b81af89d 100755
--- a/tests/integration/local/test_message_text.sh
+++ b/tests/integration/local/test_message_text.sh
@@ -31,7 +31,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_midrekey_send_file.sh b/tests/integration/local/test_midrekey_send_file.sh
index c14ccecd..606f1aad 100755
--- a/tests/integration/local/test_midrekey_send_file.sh
+++ b/tests/integration/local/test_midrekey_send_file.sh
@@ -46,7 +46,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -66,7 +66,7 @@ fi
 log_test "restart agent-b to force rekey"
 $DC restart agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_midrekey_send_message.sh b/tests/integration/local/test_midrekey_send_message.sh
index e03b279b..bc13f491 100755
--- a/tests/integration/local/test_midrekey_send_message.sh
+++ b/tests/integration/local/test_midrekey_send_message.sh
@@ -31,7 +31,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -46,7 +46,7 @@ log_pass "tunnel warm"
 log_test "restart agent-b (force rekey)"
 $DC restart agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_mixed_traffic_burst.sh b/tests/integration/local/test_mixed_traffic_burst.sh
index 599146f0..9f1655bb 100755
--- a/tests/integration/local/test_mixed_traffic_burst.sh
+++ b/tests/integration/local/test_mixed_traffic_burst.sh
@@ -37,7 +37,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_nat_ipv6_only.sh b/tests/integration/local/test_nat_ipv6_only.sh
index 5bbcf165..10cc3780 100755
--- a/tests/integration/local/test_nat_ipv6_only.sh
+++ b/tests/integration/local/test_nat_ipv6_only.sh
@@ -21,7 +21,7 @@ fi
 log_test "both agents register over IPv6"
 REG=""
 for _ in $(seq 1 60); do
-    REG=$($DC exec -T rendezvous curl -fsS "http://[::1]:8080/api/stats" 2>/dev/null \
+    REG=$($DC exec -T rendezvous curl -fsS "http://[::1]:8080/api/public-stats" 2>/dev/null \
         | jq -r '.total_nodes // 0')
     [ "${REG:-0}" -ge 2 ] && break
     sleep 1
diff --git a/tests/integration/local/test_nat_rendezvous_natted.sh b/tests/integration/local/test_nat_rendezvous_natted.sh
index 7e935a1c..b5db67e7 100755
--- a/tests/integration/local/test_nat_rendezvous_natted.sh
+++ b/tests/integration/local/test_nat_rendezvous_natted.sh
@@ -20,7 +20,7 @@ log_test "both agents register through the DNATed rendezvous"
 # rendezvous curl is on the private bridge — use the public gateway IP instead.
 REG=""
 for _ in $(seq 1 90); do
-    REG=$($DC exec -T agent-a curl -fsS "http://${NAT_PUB:-192.0.2}.30:8080/api/stats" 2>/dev/null \
+    REG=$($DC exec -T agent-a curl -fsS "http://${NAT_PUB:-192.0.2}.30:8080/api/public-stats" 2>/dev/null \
         | jq -r '.total_nodes // 0' 2>/dev/null)
     [ "${REG:-0}" -ge 2 ] && break
     sleep 1
diff --git a/tests/integration/local/test_nat_restricted_cone.sh b/tests/integration/local/test_nat_restricted_cone.sh
index 519c642d..ada6da60 100755
--- a/tests/integration/local/test_nat_restricted_cone.sh
+++ b/tests/integration/local/test_nat_restricted_cone.sh
@@ -16,7 +16,7 @@
 # accepts the STUN-discovered gateway IP as the registered endpoint.
 #
 # EXPECTED:
-#   - Both agents register with rendezvous (2 nodes in /api/stats).
+#   - Both agents register with rendezvous (2 nodes in /api/public-stats).
 #   - `pilotctl connect agent-b:7` from agent-a succeeds (echo works).
 #   - agent-a's registered endpoint is nat-gw's public IP (not the
 #     private 198.51.100.20), confirming STUN saw the NATed endpoint.
@@ -52,7 +52,7 @@ fi
 log_test "both agents register through NAT"
 REG=""
 for _ in $(seq 1 60); do
-    REG=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+    REG=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
         | jq -r '.total_nodes // 0')
     [ "${REG:-0}" -ge 2 ] && break
     sleep 1
diff --git a/tests/integration/local/test_nat_symmetric.sh b/tests/integration/local/test_nat_symmetric.sh
index 8565b063..08faecc7 100755
--- a/tests/integration/local/test_nat_symmetric.sh
+++ b/tests/integration/local/test_nat_symmetric.sh
@@ -65,7 +65,7 @@ fi
 log_test "both agents register through symmetric NAT"
 REG=""
 for _ in $(seq 1 60); do
-    REG=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+    REG=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
         | jq -r '.total_nodes // 0')
     [ "${REG:-0}" -ge 2 ] && break
     sleep 1
diff --git a/tests/integration/local/test_network_edge.sh b/tests/integration/local/test_network_edge.sh
index 7f12f3e1..778839a6 100755
--- a/tests/integration/local/test_network_edge.sh
+++ b/tests/integration/local/test_network_edge.sh
@@ -22,7 +22,7 @@ echo "=========================================="
 
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for i in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
@@ -40,7 +40,7 @@ $DC exec -T agent-a bash -c 'pilotctl send-message agent-b --data pre-restart' >
 $DC restart rendezvous >/dev/null 2>&1
 # Wait for the dashboard to come back before poking agents
 for i in $(seq 1 30); do
-    $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats >/dev/null 2>&1 && break
+    $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null 2>&1 && break
     sleep 1
 done
 # Poll up to 60s for hostname resolution to recover (rereg + SetHostname sync)
@@ -61,7 +61,7 @@ fi
 
 # ---- 2. Dashboard surfaces probe states ----
 log_test "dashboard exposes restart_events / probe states"
-ST=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null)
+ST=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null)
 # probes field may be empty on fresh process but should be valid JSON
 if echo "$ST" | jq -e '.probes // . ' >/dev/null 2>&1; then
     log_pass "stats endpoint returns well-formed JSON"
diff --git a/tests/integration/local/test_obs_log_peer_rekeyed.sh b/tests/integration/local/test_obs_log_peer_rekeyed.sh
index b661a1c5..c1d56783 100755
--- a/tests/integration/local/test_obs_log_peer_rekeyed.sh
+++ b/tests/integration/local/test_obs_log_peer_rekeyed.sh
@@ -28,7 +28,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
@@ -46,7 +46,7 @@ log_test "before: agent-a has $BEFORE 'peer rekeyed' log lines"
 log_test "restart agent-b to force rekey on next frame"
 $DC restart agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    C=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    C=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$C" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_obs_metric_encrypt_ok.sh b/tests/integration/local/test_obs_metric_encrypt_ok.sh
index 15349cb5..c8ff3f15 100755
--- a/tests/integration/local/test_obs_metric_encrypt_ok.sh
+++ b/tests/integration/local/test_obs_metric_encrypt_ok.sh
@@ -29,7 +29,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_p2p.sh b/tests/integration/local/test_p2p.sh
index e343f418..6fc2fc91 100755
--- a/tests/integration/local/test_p2p.sh
+++ b/tests/integration/local/test_p2p.sh
@@ -33,7 +33,7 @@ echo "=========================================="
 # Wait for both agents to register with the local rendezvous
 log_test "Waiting for agent-a and agent-b to register"
 for i in $(seq 1 60); do
-    COUNT=$(curl -fsS "$DASHBOARD/api/stats" 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$(curl -fsS "$DASHBOARD/api/public-stats" 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then
         log_pass "Both agents registered (total_nodes=$COUNT)"
         break
@@ -42,7 +42,7 @@ for i in $(seq 1 60); do
 done
 if [ "$COUNT" -lt 2 ]; then
     log_fail "Only $COUNT agents registered after 60s"
-    curl -s "$DASHBOARD/api/stats" | head -c 500
+    curl -s "$DASHBOARD/api/public-stats" | head -c 500
     exit 1
 fi
 
diff --git a/tests/integration/local/test_partition_heal.sh b/tests/integration/local/test_partition_heal.sh
index 63b299c4..4e9e018c 100755
--- a/tests/integration/local/test_partition_heal.sh
+++ b/tests/integration/local/test_partition_heal.sh
@@ -39,7 +39,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_partition_midflight.sh b/tests/integration/local/test_partition_midflight.sh
index 5d9a9b58..de6dca71 100755
--- a/tests/integration/local/test_partition_midflight.sh
+++ b/tests/integration/local/test_partition_midflight.sh
@@ -43,7 +43,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_peer_restarted_pubsub_sub.sh b/tests/integration/local/test_peer_restarted_pubsub_sub.sh
index c038c107..0527d0d3 100755
--- a/tests/integration/local/test_peer_restarted_pubsub_sub.sh
+++ b/tests/integration/local/test_peer_restarted_pubsub_sub.sh
@@ -42,7 +42,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -72,7 +72,7 @@ fi
 log_test "restart agent-b"
 $DC restart agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_peer_restarted_send_file.sh b/tests/integration/local/test_peer_restarted_send_file.sh
index 19612a9b..bc6fb155 100755
--- a/tests/integration/local/test_peer_restarted_send_file.sh
+++ b/tests/integration/local/test_peer_restarted_send_file.sh
@@ -33,7 +33,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -47,7 +47,7 @@ $DC exec -T agent-a pilotctl ping agent-b --count 2 --timeout 5s >/dev/null 2>&1
 log_test "restart agent-b"
 $DC restart agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_peer_restarted_send_message.sh b/tests/integration/local/test_peer_restarted_send_message.sh
index f1d4de64..5d804ff1 100755
--- a/tests/integration/local/test_peer_restarted_send_message.sh
+++ b/tests/integration/local/test_peer_restarted_send_message.sh
@@ -28,7 +28,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -41,7 +41,7 @@ $DC exec -T agent-a pilotctl ping agent-b --count 2 --timeout 5s >/dev/null 2>&1
 log_test "restart agent-b"
 $DC restart agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_ping_ghost_peer.sh b/tests/integration/local/test_ping_ghost_peer.sh
index aae86ee3..045f3f4d 100755
--- a/tests/integration/local/test_ping_ghost_peer.sh
+++ b/tests/integration/local/test_ping_ghost_peer.sh
@@ -37,7 +37,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -115,7 +115,7 @@ log_test "restart agent-b; ping a->b works again"
 $DC up -d agent-b >/dev/null 2>&1
 # Wait for agent-b to be registered again.
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_fanout.sh b/tests/integration/local/test_pubsub_fanout.sh
index 6e876204..5c0b1f9a 100755
--- a/tests/integration/local/test_pubsub_fanout.sh
+++ b/tests/integration/local/test_pubsub_fanout.sh
@@ -25,7 +25,7 @@ echo "=========================================="
 log_test "Starting p2p stack"
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_multi_publisher.sh b/tests/integration/local/test_pubsub_multi_publisher.sh
index 686288f8..e9581e04 100755
--- a/tests/integration/local/test_pubsub_multi_publisher.sh
+++ b/tests/integration/local/test_pubsub_multi_publisher.sh
@@ -44,7 +44,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_publish_to_empty_topic.sh b/tests/integration/local/test_pubsub_publish_to_empty_topic.sh
index df31a570..15db62a1 100755
--- a/tests/integration/local/test_pubsub_publish_to_empty_topic.sh
+++ b/tests/integration/local/test_pubsub_publish_to_empty_topic.sh
@@ -31,7 +31,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_service_agent.sh b/tests/integration/local/test_pubsub_service_agent.sh
index f7df3026..d1f6f130 100755
--- a/tests/integration/local/test_pubsub_service_agent.sh
+++ b/tests/integration/local/test_pubsub_service_agent.sh
@@ -44,7 +44,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_subscribe_before_publisher.sh b/tests/integration/local/test_pubsub_subscribe_before_publisher.sh
index f88e98a6..835964ae 100755
--- a/tests/integration/local/test_pubsub_subscribe_before_publisher.sh
+++ b/tests/integration/local/test_pubsub_subscribe_before_publisher.sh
@@ -30,7 +30,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_topic_fifo.sh b/tests/integration/local/test_pubsub_topic_fifo.sh
index a1669679..5bbdef6d 100755
--- a/tests/integration/local/test_pubsub_topic_fifo.sh
+++ b/tests/integration/local/test_pubsub_topic_fifo.sh
@@ -42,7 +42,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_pubsub_topic_filter.sh b/tests/integration/local/test_pubsub_topic_filter.sh
index 8dd6f485..f7782dd0 100755
--- a/tests/integration/local/test_pubsub_topic_filter.sh
+++ b/tests/integration/local/test_pubsub_topic_filter.sh
@@ -33,7 +33,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_race_pubsub_late_sub.sh b/tests/integration/local/test_race_pubsub_late_sub.sh
index 2837695d..39997c45 100755
--- a/tests/integration/local/test_race_pubsub_late_sub.sh
+++ b/tests/integration/local/test_race_pubsub_late_sub.sh
@@ -38,7 +38,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_race_register_lookup.sh b/tests/integration/local/test_race_register_lookup.sh
index 9dfa10e4..0931309d 100755
--- a/tests/integration/local/test_race_register_lookup.sh
+++ b/tests/integration/local/test_race_register_lookup.sh
@@ -32,7 +32,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_race_sendfile_rekey.sh b/tests/integration/local/test_race_sendfile_rekey.sh
index d1381aec..4980cc2c 100755
--- a/tests/integration/local/test_race_sendfile_rekey.sh
+++ b/tests/integration/local/test_race_sendfile_rekey.sh
@@ -33,7 +33,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_race_topic_delete_publish.sh b/tests/integration/local/test_race_topic_delete_publish.sh
index 9c8aece2..41bf9c73 100755
--- a/tests/integration/local/test_race_topic_delete_publish.sh
+++ b/tests/integration/local/test_race_topic_delete_publish.sh
@@ -34,7 +34,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_race_trust_grant_revoke.sh b/tests/integration/local/test_race_trust_grant_revoke.sh
index 99a82ba3..8bb6a1bb 100755
--- a/tests/integration/local/test_race_trust_grant_revoke.sh
+++ b/tests/integration/local/test_race_trust_grant_revoke.sh
@@ -30,7 +30,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_receiver_sigkill_midfile.sh b/tests/integration/local/test_receiver_sigkill_midfile.sh
index 7c209c06..8f23e901 100755
--- a/tests/integration/local/test_receiver_sigkill_midfile.sh
+++ b/tests/integration/local/test_receiver_sigkill_midfile.sh
@@ -34,7 +34,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -97,7 +97,7 @@ BAD=$($DC logs agent-a 2>&1 | grep -iE "panic|fatal|race detected" | head -3)
 log_test "restart agent-b"
 $DC up -d agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_register_identity_new_endpoint.sh b/tests/integration/local/test_register_identity_new_endpoint.sh
index 8b299925..92092b37 100755
--- a/tests/integration/local/test_register_identity_new_endpoint.sh
+++ b/tests/integration/local/test_register_identity_new_endpoint.sh
@@ -32,7 +32,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -100,7 +100,7 @@ else
 fi
 
 log_test "only one registry entry for this identity (no stale duplicate)"
-STATS=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null)
+STATS=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null)
 TOTAL=$(echo "$STATS" | jq -r '.total_nodes // 0')
 if [ "$TOTAL" = "2" ]; then
     log_pass "registry has exactly 2 nodes (a + b)"
diff --git a/tests/integration/local/test_rendezvous_beacon_split.sh b/tests/integration/local/test_rendezvous_beacon_split.sh
index 1edbd5a2..c4af4c87 100755
--- a/tests/integration/local/test_rendezvous_beacon_split.sh
+++ b/tests/integration/local/test_rendezvous_beacon_split.sh
@@ -52,7 +52,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -65,7 +65,7 @@ $DC exec -T agent-a pilotctl ping agent-b --count 2 --timeout 5s >/dev/null 2>&1
 log_test "block UDP/9001 on rendezvous (beacon dies, registry stays)"
 $DC exec -T rendezvous iptables -I INPUT -p udp --dport 9001 -m comment --comment pilot-beacon-split -j DROP >/dev/null 2>&1
 # Verify: registry still answers
-if $DC exec -T agent-a bash -c 'curl -fsS --max-time 3 http://$(getent hosts rendezvous | awk "{print \$1}"):8080/api/stats >/dev/null'; then
+if $DC exec -T agent-a bash -c 'curl -fsS --max-time 3 http://$(getent hosts rendezvous | awk "{print \$1}"):8080/api/public-stats >/dev/null'; then
     log_pass "registry HTTP still reachable"
 else
     log_fail "registry HTTP broken too — split did not isolate beacon"
diff --git a/tests/integration/local/test_rendezvous_restart_midflight.sh b/tests/integration/local/test_rendezvous_restart_midflight.sh
index 8d412df9..a4fc464d 100755
--- a/tests/integration/local/test_rendezvous_restart_midflight.sh
+++ b/tests/integration/local/test_rendezvous_restart_midflight.sh
@@ -43,7 +43,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -96,7 +96,7 @@ fi
 log_test "start rendezvous back up"
 $DC start rendezvous >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_resilience.sh b/tests/integration/local/test_resilience.sh
index d025d3c0..e521721b 100755
--- a/tests/integration/local/test_resilience.sh
+++ b/tests/integration/local/test_resilience.sh
@@ -20,7 +20,7 @@ echo "=========================================="
 
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for i in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
@@ -97,13 +97,13 @@ log_test "restart rendezvous and confirm agents reconnect (≤4min)"
 $DC restart rendezvous >/dev/null 2>&1
 # Wait for health
 for i in $(seq 1 30); do
-    if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats >/dev/null 2>&1; then break; fi
+    if $DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats >/dev/null 2>&1; then break; fi
     sleep 1
 done
 # Poll for re-registration (up to 240s)
 RECONNECTED=0
 for i in $(seq 1 48); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "${COUNT:-0}" -ge 2 ]; then
         RECONNECTED=1
         break
diff --git a/tests/integration/local/test_rotate_key.sh b/tests/integration/local/test_rotate_key.sh
index 4be9b7a4..3d534c8e 100755
--- a/tests/integration/local/test_rotate_key.sh
+++ b/tests/integration/local/test_rotate_key.sh
@@ -34,7 +34,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "${COUNT:-0}" -ge 1 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_sec_beacon_amplification.sh b/tests/integration/local/test_sec_beacon_amplification.sh
index 3159fc89..20af2053 100755
--- a/tests/integration/local/test_sec_beacon_amplification.sh
+++ b/tests/integration/local/test_sec_beacon_amplification.sh
@@ -40,7 +40,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_ipc_exhaustion.sh b/tests/integration/local/test_sec_ipc_exhaustion.sh
index e8eca785..e7397c59 100755
--- a/tests/integration/local/test_sec_ipc_exhaustion.sh
+++ b/tests/integration/local/test_sec_ipc_exhaustion.sh
@@ -40,7 +40,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_malformed_frame.sh b/tests/integration/local/test_sec_malformed_frame.sh
index 5d97a31d..6c36dfce 100755
--- a/tests/integration/local/test_sec_malformed_frame.sh
+++ b/tests/integration/local/test_sec_malformed_frame.sh
@@ -43,7 +43,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_oversized_payload.sh b/tests/integration/local/test_sec_oversized_payload.sh
index ee404b74..698c3faf 100755
--- a/tests/integration/local/test_sec_oversized_payload.sh
+++ b/tests/integration/local/test_sec_oversized_payload.sh
@@ -42,7 +42,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_pubsub_spam.sh b/tests/integration/local/test_sec_pubsub_spam.sh
index a9d28dac..37fd7bc8 100755
--- a/tests/integration/local/test_sec_pubsub_spam.sh
+++ b/tests/integration/local/test_sec_pubsub_spam.sh
@@ -45,7 +45,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_rekey_flood.sh b/tests/integration/local/test_sec_rekey_flood.sh
index 89dcb65f..9fa200e1 100755
--- a/tests/integration/local/test_sec_rekey_flood.sh
+++ b/tests/integration/local/test_sec_rekey_flood.sh
@@ -42,7 +42,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_replay_after_rekey.sh b/tests/integration/local/test_sec_replay_after_rekey.sh
index c02114f7..53833133 100755
--- a/tests/integration/local/test_sec_replay_after_rekey.sh
+++ b/tests/integration/local/test_sec_replay_after_rekey.sh
@@ -38,7 +38,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_spoofed_node_id.sh b/tests/integration/local/test_sec_spoofed_node_id.sh
index 1e8eefb0..2c8a89af 100755
--- a/tests/integration/local/test_sec_spoofed_node_id.sh
+++ b/tests/integration/local/test_sec_spoofed_node_id.sh
@@ -34,7 +34,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_sym_nat_spoof.sh b/tests/integration/local/test_sec_sym_nat_spoof.sh
index 4e5e5826..c10137d3 100755
--- a/tests/integration/local/test_sec_sym_nat_spoof.sh
+++ b/tests/integration/local/test_sec_sym_nat_spoof.sh
@@ -36,7 +36,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_sec_trust_grant_forgery.sh b/tests/integration/local/test_sec_trust_grant_forgery.sh
index 757e72fe..204db003 100755
--- a/tests/integration/local/test_sec_trust_grant_forgery.sh
+++ b/tests/integration/local/test_sec_trust_grant_forgery.sh
@@ -44,7 +44,7 @@ log_test "fresh stack"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 if ! wait_for 60 bash -c '
-    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r ".total_nodes // 0")
+    c=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r ".total_nodes // 0")
     [ "$c" -ge 2 ]
 '; then
     log_fail "agents did not register"
diff --git a/tests/integration/local/test_send_file_bidirectional_transform.sh b/tests/integration/local/test_send_file_bidirectional_transform.sh
index dd8862e9..df72bbd5 100755
--- a/tests/integration/local/test_send_file_bidirectional_transform.sh
+++ b/tests/integration/local/test_send_file_bidirectional_transform.sh
@@ -41,7 +41,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_send_file_concurrent.sh b/tests/integration/local/test_send_file_concurrent.sh
index 9d1d1a10..c45f304f 100755
--- a/tests/integration/local/test_send_file_concurrent.sh
+++ b/tests/integration/local/test_send_file_concurrent.sh
@@ -44,7 +44,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_send_file_hostile_names.sh b/tests/integration/local/test_send_file_hostile_names.sh
index 584be12c..b1dda39e 100755
--- a/tests/integration/local/test_send_file_hostile_names.sh
+++ b/tests/integration/local/test_send_file_hostile_names.sh
@@ -38,7 +38,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_send_file_integrity.sh b/tests/integration/local/test_send_file_integrity.sh
index e5ce2d3a..d59be2f8 100755
--- a/tests/integration/local/test_send_file_integrity.sh
+++ b/tests/integration/local/test_send_file_integrity.sh
@@ -43,7 +43,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_sender_clean_restart_midflight.sh b/tests/integration/local/test_sender_clean_restart_midflight.sh
index a5e895c8..131c59f9 100755
--- a/tests/integration/local/test_sender_clean_restart_midflight.sh
+++ b/tests/integration/local/test_sender_clean_restart_midflight.sh
@@ -33,7 +33,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -46,7 +46,7 @@ $DC exec -T agent-a pilotctl ping agent-b --count 2 --timeout 5s >/dev/null 2>&1
 log_test "restart agent-a cleanly"
 $DC restart agent-a >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_sender_sigkill_midfile.sh b/tests/integration/local/test_sender_sigkill_midfile.sh
index a883ff32..fd1ac759 100755
--- a/tests/integration/local/test_sender_sigkill_midfile.sh
+++ b/tests/integration/local/test_sender_sigkill_midfile.sh
@@ -30,7 +30,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -112,7 +112,7 @@ fi
 log_test "restart agent-a; fresh send-file completes"
 $DC up -d agent-a >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_service_agent.sh b/tests/integration/local/test_service_agent.sh
index 72d25e18..20112e7d 100755
--- a/tests/integration/local/test_service_agent.sh
+++ b/tests/integration/local/test_service_agent.sh
@@ -26,7 +26,7 @@ log_test "Starting p2p stack"
 docker compose -f docker-compose.multi.yml down -v >/dev/null 2>&1
 docker compose -f docker-compose.multi.yml up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_size_file_100mb.sh b/tests/integration/local/test_size_file_100mb.sh
index bfc86da8..e53cc772 100755
--- a/tests/integration/local/test_size_file_100mb.sh
+++ b/tests/integration/local/test_size_file_100mb.sh
@@ -26,7 +26,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_size_file_10mb.sh b/tests/integration/local/test_size_file_10mb.sh
index 38195acf..3d71b744 100755
--- a/tests/integration/local/test_size_file_10mb.sh
+++ b/tests/integration/local/test_size_file_10mb.sh
@@ -25,7 +25,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_size_file_500mb_reject.sh b/tests/integration/local/test_size_file_500mb_reject.sh
index 7aaea70a..9860492c 100755
--- a/tests/integration/local/test_size_file_500mb_reject.sh
+++ b/tests/integration/local/test_size_file_500mb_reject.sh
@@ -34,7 +34,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_size_file_50mb.sh b/tests/integration/local/test_size_file_50mb.sh
index 92da478f..7f9d9132 100755
--- a/tests/integration/local/test_size_file_50mb.sh
+++ b/tests/integration/local/test_size_file_50mb.sh
@@ -26,7 +26,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_size_message_10mb_reject.sh b/tests/integration/local/test_size_message_10mb_reject.sh
index 84a4db07..0e7b0ab6 100755
--- a/tests/integration/local/test_size_message_10mb_reject.sh
+++ b/tests/integration/local/test_size_message_10mb_reject.sh
@@ -29,7 +29,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_size_pubsub_large.sh b/tests/integration/local/test_size_pubsub_large.sh
index 5e522aec..351868c9 100755
--- a/tests/integration/local/test_size_pubsub_large.sh
+++ b/tests/integration/local/test_size_pubsub_large.sh
@@ -28,7 +28,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_splitbrain_divergence.sh b/tests/integration/local/test_splitbrain_divergence.sh
index de3e2f5b..b40394c7 100755
--- a/tests/integration/local/test_splitbrain_divergence.sh
+++ b/tests/integration/local/test_splitbrain_divergence.sh
@@ -37,7 +37,7 @@ $DC up -d rendezvous-1 rendezvous-2 agent-a agent-b agent-c agent-d >/dev/null 2
 log_test "rendezvous-1 sees 2 agents"
 C1=""
 for _ in $(seq 1 60); do
-    C1=$($DC exec -T rendezvous-1 curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+    C1=$($DC exec -T rendezvous-1 curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
         | jq -r '.total_nodes // 0')
     if [ "$C1" -ge 2 ]; then break; fi
     sleep 1
@@ -53,7 +53,7 @@ fi
 log_test "rendezvous-2 sees 2 agents"
 C2=""
 for _ in $(seq 1 60); do
-    C2=$($DC exec -T rendezvous-2 curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+    C2=$($DC exec -T rendezvous-2 curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
         | jq -r '.total_nodes // 0')
     if [ "$C2" -ge 2 ]; then break; fi
     sleep 1
diff --git a/tests/integration/local/test_splitbrain_heal.sh b/tests/integration/local/test_splitbrain_heal.sh
index 6cca29ef..2e192f49 100755
--- a/tests/integration/local/test_splitbrain_heal.sh
+++ b/tests/integration/local/test_splitbrain_heal.sh
@@ -43,8 +43,8 @@ sweep_pilot_p2p_network
 $DC up -d rendezvous-1 rendezvous-2 agent-a agent-b agent-c agent-d >/dev/null 2>&1
 
 for _ in $(seq 1 60); do
-    C1=$($DC exec -T rendezvous-1 curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
-    C2=$($DC exec -T rendezvous-2 curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    C1=$($DC exec -T rendezvous-1 curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
+    C2=$($DC exec -T rendezvous-2 curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$C1" -ge 2 ] && [ "$C2" -ge 2 ]; then break; fi
     sleep 1
 done
@@ -147,7 +147,7 @@ docker run -d --rm --name "${COMPOSE_PROJECT_NAME:-pilot}-healed-agent-d" --host
 # Wait for rendezvous-1 to see 4 nodes.
 MERGED=0
 for _ in $(seq 1 60); do
-    C1=$($DC exec -T rendezvous-1 curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    C1=$($DC exec -T rendezvous-1 curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$C1" -ge 4 ]; then MERGED=1; break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_stress_edge.sh b/tests/integration/local/test_stress_edge.sh
index 3886c28a..dba06dc0 100755
--- a/tests/integration/local/test_stress_edge.sh
+++ b/tests/integration/local/test_stress_edge.sh
@@ -25,7 +25,7 @@ echo "=========================================="
 
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for i in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_trust_approve_cycle.sh b/tests/integration/local/test_trust_approve_cycle.sh
index ed039837..d61258c2 100755
--- a/tests/integration/local/test_trust_approve_cycle.sh
+++ b/tests/integration/local/test_trust_approve_cycle.sh
@@ -29,7 +29,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_trust_grant_already_connected.sh b/tests/integration/local/test_trust_grant_already_connected.sh
index 670296d2..9c5442b5 100755
--- a/tests/integration/local/test_trust_grant_already_connected.sh
+++ b/tests/integration/local/test_trust_grant_already_connected.sh
@@ -34,7 +34,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_trust_grant_fresh.sh b/tests/integration/local/test_trust_grant_fresh.sh
index bf3ef2a3..3f560598 100755
--- a/tests/integration/local/test_trust_grant_fresh.sh
+++ b/tests/integration/local/test_trust_grant_fresh.sh
@@ -35,7 +35,7 @@ trap cleanup EXIT
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_trust_mutual.sh b/tests/integration/local/test_trust_mutual.sh
index b0b26caf..f1054288 100755
--- a/tests/integration/local/test_trust_mutual.sh
+++ b/tests/integration/local/test_trust_mutual.sh
@@ -30,7 +30,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_trust_revoke.sh b/tests/integration/local/test_trust_revoke.sh
index 1addcb0b..68e434d7 100755
--- a/tests/integration/local/test_trust_revoke.sh
+++ b/tests/integration/local/test_trust_revoke.sh
@@ -24,7 +24,7 @@ log_test "Starting p2p stack"
 docker compose -f docker-compose.multi.yml down -v >/dev/null 2>&1
 docker compose -f docker-compose.multi.yml up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$(docker compose -f docker-compose.multi.yml exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_tunnel_desync_recovery.sh b/tests/integration/local/test_tunnel_desync_recovery.sh
index 13b63faa..a17428d2 100755
--- a/tests/integration/local/test_tunnel_desync_recovery.sh
+++ b/tests/integration/local/test_tunnel_desync_recovery.sh
@@ -54,7 +54,7 @@ $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 # Wait for both to register.
 COUNT=0
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_type_routed_service.sh b/tests/integration/local/test_type_routed_service.sh
index 03523f7d..8693a95a 100755
--- a/tests/integration/local/test_type_routed_service.sh
+++ b/tests/integration/local/test_type_routed_service.sh
@@ -37,7 +37,7 @@ log_test "Starting p2p stack (clean)"
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_untrust_visibility.sh b/tests/integration/local/test_untrust_visibility.sh
index 5348b0af..fa1d5e52 100755
--- a/tests/integration/local/test_untrust_visibility.sh
+++ b/tests/integration/local/test_untrust_visibility.sh
@@ -30,7 +30,7 @@ echo "=========================================="
 $DC down -v >/dev/null 2>&1
 $DC up -d rendezvous agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 60); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     if [ "$COUNT" -ge 2 ]; then break; fi
     sleep 1
 done
diff --git a/tests/integration/local/test_webhook_agent_registered.sh b/tests/integration/local/test_webhook_agent_registered.sh
index c40b08bc..45856a84 100755
--- a/tests/integration/local/test_webhook_agent_registered.sh
+++ b/tests/integration/local/test_webhook_agent_registered.sh
@@ -47,7 +47,7 @@ BEFORE=$($DC exec -T webhook-sink sh -c "grep -cE '\"event\":\"(agent\\.register
 # or set-webhook immediately and then re-register via a restart trick.
 $DC up -d agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 $((120 * ${PILOT_TEST_WAIT_MULT:-1}))); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_webhook_file_delivered.sh b/tests/integration/local/test_webhook_file_delivered.sh
index 5d3ca1f7..8b9f8451 100755
--- a/tests/integration/local/test_webhook_file_delivered.sh
+++ b/tests/integration/local/test_webhook_file_delivered.sh
@@ -35,7 +35,7 @@ $DC down -v >/dev/null 2>&1
 ensure_webhook_sink_ready || { log_fail "webhook-sink never came up"; exit 1; }
 $DC up -d agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 $((60 * ${PILOT_TEST_WAIT_MULT:-1}))); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_webhook_message_received.sh b/tests/integration/local/test_webhook_message_received.sh
index 910cf270..5034292b 100755
--- a/tests/integration/local/test_webhook_message_received.sh
+++ b/tests/integration/local/test_webhook_message_received.sh
@@ -31,7 +31,7 @@ $DC down -v >/dev/null 2>&1
 ensure_webhook_sink_ready || { log_fail "webhook-sink never came up"; exit 1; }
 $DC up -d agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 $((60 * ${PILOT_TEST_WAIT_MULT:-1}))); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_webhook_pubsub_published.sh b/tests/integration/local/test_webhook_pubsub_published.sh
index d5d7503c..545a16b6 100755
--- a/tests/integration/local/test_webhook_pubsub_published.sh
+++ b/tests/integration/local/test_webhook_pubsub_published.sh
@@ -31,7 +31,7 @@ $DC down -v >/dev/null 2>&1
 ensure_webhook_sink_ready || { log_fail "webhook-sink never came up"; exit 1; }
 $DC up -d agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 $((60 * ${PILOT_TEST_WAIT_MULT:-1}))); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_webhook_trust_changed.sh b/tests/integration/local/test_webhook_trust_changed.sh
index 8c70992d..e24d8d9c 100644
--- a/tests/integration/local/test_webhook_trust_changed.sh
+++ b/tests/integration/local/test_webhook_trust_changed.sh
@@ -37,7 +37,7 @@ $DC down -v >/dev/null 2>&1
 ensure_webhook_sink_ready || { log_fail "webhook-sink never came up"; exit 1; }
 $DC up -d agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 $((120 * ${PILOT_TEST_WAIT_MULT:-1}))); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/test_webhook_tunnel_established.sh b/tests/integration/local/test_webhook_tunnel_established.sh
index 87337b18..8776c337 100644
--- a/tests/integration/local/test_webhook_tunnel_established.sh
+++ b/tests/integration/local/test_webhook_tunnel_established.sh
@@ -31,7 +31,7 @@ $DC down -v >/dev/null 2>&1
 ensure_webhook_sink_ready || { log_fail "webhook-sink never came up"; exit 1; }
 $DC up -d agent-a agent-b >/dev/null 2>&1
 for _ in $(seq 1 $((60 * ${PILOT_TEST_WAIT_MULT:-1}))); do
-    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null | jq -r '.total_nodes // 0')
+    COUNT=$($DC exec -T rendezvous curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null | jq -r '.total_nodes // 0')
     [ "$COUNT" -ge 2 ] && break
     sleep 1
 done
diff --git a/tests/integration/local/topology_helpers.sh b/tests/integration/local/topology_helpers.sh
index e099eb24..b9a62a7d 100755
--- a/tests/integration/local/topology_helpers.sh
+++ b/tests/integration/local/topology_helpers.sh
@@ -26,7 +26,7 @@ wait_all_registered() {
     : "${DC:?DC must be set (e.g. DC=\"docker compose -f docker-compose.multiN.yml\")}"
     local count=0
     for _ in $(seq 1 90); do
-        count=$($DC exec -T "$rv" curl -fsS http://127.0.0.1:8080/api/stats 2>/dev/null \
+        count=$($DC exec -T "$rv" curl -fsS http://127.0.0.1:8080/api/public-stats 2>/dev/null \
             | jq -r '.total_nodes // 0')
         if [ -n "$count" ] && [ "$count" -ge "$want" ]; then
             echo "$count"