diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 00000000..8e854d33
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,70 @@
+# Line-ending and binary rules for the LifeTrac repo.
+#
+# Why: this repo is mostly edited on Windows (core.autocrlf=true), but many
+# files run on the Portenta X8 boards or inside Linux containers, where a CRLF
+# breaks them ("/bin/bash^M: bad interpreter", systemd/udev/mosquitto parse
+# errors, `source`d env files with a trailing \r in every value). The rules
+# below make Git check those files out with LF on every OS and make
+# `git archive` emit LF for them even when core.autocrlf=true.
+#
+# The index already stores these files with LF, so this file changes checkout
+# behaviour only. An EXISTING working tree keeps its old copies until the files
+# are checked out again. With a clean tree (commit or set aside your work
+# first -- this rewrites every tracked file):
+#     git rm --cached -r -q . && git reset --hard
+# On a Windows checkout made with core.autocrlf=true that refresh also repairs
+# binaries that autocrlf had mangled on checkout (some *.pdf, *.hex, *.zip and
+# bench-evidence *.bin files whose content Git guessed was text).
+# Board-side deploys should still pass `-c core.autocrlf=false` to
+# `git archive`, because files not listed here (.txt, .md, .json, .html, ...)
+# follow core.autocrlf.
+#
+# Files not matched below keep the default behaviour (core.autocrlf).
+
+# --- Runs on the boards / in containers: always LF -------------------------
+*.sh            text eol=lf
+*.bash          text eol=lf
+*.py            text eol=lf
+*.service       text eol=lf
+*.timer         text eol=lf
+*.socket        text eol=lf
+*.rules         text eol=lf
+*.conf          text eol=lf
+*.cfg           text eol=lf
+*.yml           text eol=lf
+*.yaml          text eol=lf
+*.toml          text eol=lf
+Dockerfile      text eol=lf
+Dockerfile.*    text eol=lf
+*.dockerfile    text eol=lf
+.env.example    text eol=lf
+*.env           text eol=lf
+*.env.example   text eol=lf
+requirements*.txt text eol=lf
+
+# --- Windows scripts: CRLF in the working tree ------------------------------
+# text=auto leaves anything Git detects as binary (e.g. a UTF-16 file) alone.
+*.ps1           text=auto eol=crlf
+*.bat           text=auto eol=crlf
+
+# --- Binary: never convert, never text-diff/merge ---------------------------
+*.bin           binary
+*.elf           binary
+*.hex           binary
+*.o             binary
+*.a             binary
+*.exe           binary
+*.dll           binary
+*.so            binary
+*.whl           binary
+*.tar           binary
+*.tgz           binary
+*.gz            binary
+*.xz            binary
+*.zip           binary
+*.jpg           binary
+*.jpeg          binary
+*.png           binary
+*.gif           binary
+*.pdf           binary
+*.rgb           binary
diff --git a/.github/workflows/l072-bench-md5.yml b/.github/workflows/l072-bench-md5.yml
new file mode 100644
index 00000000..f6adbf42
--- /dev/null
+++ b/.github/workflows/l072-bench-md5.yml
@@ -0,0 +1,123 @@
+# L072 bench md5 -- NON-BLOCKING reproducibility check (bench kit, 2026-10-10).
+#
+# Rebuilds the Murata L072 firmware with the exact toolchain the bench PC uses
+# (Arm GNU Toolchain 12.2.MPACBTI-Rel1, arm-none-eabi-gcc 12.2.1 20230214) and
+# prints the md5s of the bench and production images next to the reference
+# values in LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/README.md
+# ("Expected md5s") and the committed build/firmware.bin. Mismatches are
+# warnings, never failures: the job is continue-on-error and the md5 step
+# always exits 0. The blocking link/size gate stays in arduino-ci.yml.
+name: L072 bench md5 (non-blocking)
+
+on:
+  push:
+    paths:
+      - 'LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/**'
+      - '.github/workflows/l072-bench-md5.yml'
+  pull_request:
+    paths:
+      - 'LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/**'
+      - '.github/workflows/l072-bench-md5.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  # Linux x86_64 host build of the release the bench PC uses. URL and sha256
+  # checked 2026-10-10 against Arm's published .sha256asc (170 644 784 B).
+  ARM_TOOLCHAIN_URL: https://developer.arm.com/-/media/Files/downloads/gnu/12.2.mpacbti-rel1/binrel/arm-gnu-toolchain-12.2.mpacbti-rel1-x86_64-arm-none-eabi.tar.xz
+  ARM_TOOLCHAIN_SHA256: 17455a06c816031cc2c66243c117cba48463cd6a3a3fdfac7275b4e9c40eb314
+  # murata_l072/README.md "Expected md5s" (main bb4a2071). Update both when the
+  # firmware source changes and the new pair is recorded.
+  EXPECTED_BENCH_MD5: 0c1bb0a9573f813137f941dfa47177d0
+  EXPECTED_PROD_MD5: 589c120323c2d5e7ef9f459d7a4ba42d
+  L072_DIR: LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072
+
+jobs:
+  l072-bench-md5:
+    name: L072 bench md5 (Arm 12.2.MPACBTI-Rel1)
+    runs-on: ubuntu-24.04
+    continue-on-error: true
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Cache the Arm toolchain
+        uses: actions/cache@v4
+        with:
+          path: ~/arm-gnu-toolchain-12.2.mpacbti-rel1
+          key: arm-gnu-toolchain-12.2.mpacbti-rel1-x86_64-${{ env.ARM_TOOLCHAIN_SHA256 }}
+
+      - name: Install Arm GNU Toolchain 12.2.MPACBTI-Rel1
+        run: |
+          set -euo pipefail
+          TC="$HOME/arm-gnu-toolchain-12.2.mpacbti-rel1"
+          if [ ! -x "$TC/bin/arm-none-eabi-gcc" ]; then
+            curl -fsSL --retry 3 -o "$RUNNER_TEMP/tc.tar.xz" "$ARM_TOOLCHAIN_URL"
+            echo "$ARM_TOOLCHAIN_SHA256  $RUNNER_TEMP/tc.tar.xz" | sha256sum -c -
+            mkdir -p "$TC"
+            tar -xJf "$RUNNER_TEMP/tc.tar.xz" -C "$TC" --strip-components=1
+            rm -f "$RUNNER_TEMP/tc.tar.xz"
+          fi
+          echo "$TC/bin" >> "$GITHUB_PATH"
+          "$TC/bin/arm-none-eabi-gcc" --version | head -1
+
+      - name: Record the committed production md5
+        working-directory: ${{ env.L072_DIR }}
+        run: md5sum build/firmware.bin | cut -d' ' -f1 | tee "$RUNNER_TEMP/committed_prod.md5"
+
+      - name: make bench
+        working-directory: ${{ env.L072_DIR }}
+        run: |
+          arm-none-eabi-gcc --version | head -1
+          mkdir -p build   # `bench` writes build/firmware_bench_diag.bin but does not create build/
+          make bench
+
+      - name: make (production)
+        working-directory: ${{ env.L072_DIR }}
+        run: make
+
+      - name: Compare md5s with the README (warn only)
+        working-directory: ${{ env.L072_DIR }}
+        run: |
+          bench=$(md5sum build/firmware_bench_diag.bin | cut -d' ' -f1)
+          prod=$(md5sum build/firmware.bin | cut -d' ' -f1)
+          committed=$(cat "$RUNNER_TEMP/committed_prod.md5")
+          verdict() { [ "$1" = "$2" ] && echo "match" || echo "**differs**"; }
+          {
+            echo "## L072 md5 -- Arm GNU Toolchain 12.2.MPACBTI-Rel1 on Linux"
+            echo
+            echo "| image | built here | reference | |"
+            echo "|---|---|---|---|"
+            echo "| bench \`firmware_bench_diag.bin\` | \`$bench\` | README \`$EXPECTED_BENCH_MD5\` | $(verdict "$bench" "$EXPECTED_BENCH_MD5") |"
+            echo "| production \`firmware.bin\` | \`$prod\` | README \`$EXPECTED_PROD_MD5\` | $(verdict "$prod" "$EXPECTED_PROD_MD5") |"
+            echo "| production \`firmware.bin\` | \`$prod\` | committed \`$committed\` | $(verdict "$prod" "$committed") |"
+            echo
+            echo "A source change since bb4a2071 moves both README md5s; record the new"
+            echo "pair in murata_l072/README.md and in this workflow's env."
+          } >> "$GITHUB_STEP_SUMMARY"
+          echo "bench      built=$bench expected=$EXPECTED_BENCH_MD5"
+          echo "production built=$prod expected=$EXPECTED_PROD_MD5 committed=$committed"
+          if [ "$bench" != "$EXPECTED_BENCH_MD5" ]; then
+            echo "::warning title=L072 bench md5 differs::firmware_bench_diag.bin md5 $bench != README $EXPECTED_BENCH_MD5 (source changed since bb4a2071, or this Linux build of 12.2.MPACBTI-Rel1 is not byte-identical to the bench PC build)"
+          fi
+          if [ "$prod" != "$EXPECTED_PROD_MD5" ]; then
+            echo "::warning title=L072 production md5 differs::firmware.bin md5 $prod != README $EXPECTED_PROD_MD5"
+          fi
+          if [ "$prod" != "$committed" ]; then
+            echo "::warning title=Committed firmware.bin not reproduced::the committed build/firmware.bin ($committed) differs from this build ($prod): rebuild and commit it with the firmware change, using the exact toolchain"
+          fi
+          exit 0
+
+      - name: Upload the built images
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: l072-bench-md5-${{ github.sha }}
+          path: |
+            ${{ env.L072_DIR }}/build/firmware_bench_diag.bin
+            ${{ env.L072_DIR }}/build/firmware.bin
+            ${{ env.L072_DIR }}/build/firmware.map
+          if-no-files-found: warn
+          retention-days: 14
diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index be7ca0bb..0efd3768 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -701,9 +701,10 @@
 			"group": "test"
 		},
 		{
-			"label": "Connect WiFi 5 star LAN",
+			"label": "WiFi connect: run by hand (no PSK in tasks)",
+			"detail": "The WiFi tasks that carried LIFETRAC_WIFI_PSK were removed: VS Code echoes the resolved command line, and the PSK also showed in the adb and sudo argv and in sudo's log. Run the repo-root WiFi script by hand instead (header of wifi_persist_and_reboot.sh). The bench tractor keeps WiFi off.",
 			"type": "shell",
-			"command": "adb -s 2D0A1209DABC240B push wifi_connect.sh /tmp/wifi_connect.sh ; adb -s 2D0A1209DABC240B shell \\\"chmod +x /tmp/wifi_connect.sh ; echo fio | sudo -S /tmp/wifi_connect.sh 2>&1\\\"",
+			"command": "echo 'WiFi tasks removed (they put the PSK on a command line). By hand: adb -s SERIAL push wifi_persist_and_reboot.sh /tmp/wpr.sh, then in an interactive adb shell set LIFETRAC_WIFI_SSID / LIFETRAC_WIFI_PSK (read -r, no echo) and run: sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/wpr.sh -- see the script header.'",
 			"isBackground": false,
 			"problemMatcher": [],
 			"group": "test"
@@ -724,46 +725,6 @@
 			"problemMatcher": [],
 			"group": "test"
 		},
-		{
-			"label": "Wait and connect WiFi",
-			"type": "shell",
-			"command": "adb -s 2D0A1209DABC240B wait-for-device ; adb -s 2D0A1209DABC240B shell \\\"chmod +x /tmp/wifi_connect_fast.sh ; echo fio | sudo -S /tmp/wifi_connect_fast.sh 2>&1\\\"",
-			"isBackground": false,
-			"problemMatcher": [],
-			"group": "test"
-		},
-		{
-			"label": "Push and connect WiFi v2",
-			"type": "shell",
-			"command": "adb -s 2D0A1209DABC240B wait-for-device ; adb -s 2D0A1209DABC240B push wifi_connect_fast.sh /tmp/wifi_connect_fast.sh ; adb -s 2D0A1209DABC240B shell \\\"chmod +x /tmp/wifi_connect_fast.sh ; echo fio | sudo -S /tmp/wifi_connect_fast.sh 2>&1\\\"",
-			"isBackground": false,
-			"problemMatcher": [],
-			"group": "test"
-		},
-		{
-			"label": "Rescan then connect",
-			"type": "shell",
-			"command": "adb -s 2D0A1209DABC240B shell \\\"echo fio | sudo -S nmcli dev wifi rescan ifname wlan0 ; sleep 6 ; echo '--- visible nets ---' ; echo fio | sudo -S nmcli -t -f SSID,SIGNAL dev wifi list ifname wlan0 | head -n 15 ; echo '--- connect ---' ; echo fio | sudo -S nmcli dev wifi connect \\\\\\\"I'm a 5 star LAN!\\\\\\\" password 9182603083 ifname wlan0 ; sleep 3 ; echo '--- status ---' ; nmcli -t -f NAME,DEVICE,STATE con show --active ; ip -4 addr show wlan0\\\"",
-			"isBackground": false,
-			"problemMatcher": [],
-			"group": "test"
-		},
-		{
-			"label": "Rescan connect via script",
-			"type": "shell",
-			"command": "adb -s 2D0A1209DABC240B push wifi_rescan_connect.sh /tmp/wrc.sh ; adb -s 2D0A1209DABC240B shell \\\"chmod +x /tmp/wrc.sh ; echo fio | sudo -S /tmp/wrc.sh 2>&1\\\"",
-			"isBackground": false,
-			"problemMatcher": [],
-			"group": "test"
-		},
-		{
-			"label": "Persist profile and reboot",
-			"type": "shell",
-			"command": "adb -s 2D0A1209DABC240B push wifi_persist_and_reboot.sh /tmp/wpr.sh ; adb -s 2D0A1209DABC240B shell \\\"chmod +x /tmp/wpr.sh ; echo fio | sudo -S /tmp/wpr.sh 2>&1\\\"",
-			"isBackground": false,
-			"problemMatcher": [],
-			"group": "test"
-		},
 		{
 			"label": "Verify autoconnect after reboot",
 			"type": "shell",
diff --git a/LifeTrac-v25/BUILD-CONTROLLER/05_firmware_installation.md b/LifeTrac-v25/BUILD-CONTROLLER/05_firmware_installation.md
index 6797bf32..7d8b2ddf 100644
--- a/LifeTrac-v25/BUILD-CONTROLLER/05_firmware_installation.md
+++ b/LifeTrac-v25/BUILD-CONTROLLER/05_firmware_installation.md
@@ -61,6 +61,27 @@ This prints something like `9f3a8c4e2b1d7506a8e3f4c5b9d2e1f0`. Copy it into a fi
 
 This is the radio + arbitration + Modbus master firmware that runs on the X8's onboard STM32H747.
 
+> [!WARNING]
+> **On a Portenta X8 this step overwrites the stock x8h7 firmware.** The
+> H747's M7 core (flash bank 1) normally runs Arduino's stock **x8h7**
+> firmware: the bridge through which X8 Linux reaches the H7-side peripherals
+> (the `x8h7_*` kernel modules for GPIO, ADC, CAN, UART, PWM and RTC, and
+> `m4-proxy` for M4 sketches). Arduino's own X8 workflow only uploads user
+> sketches to the M4 core for this reason. Uploading `tractor_h7` as
+> *Portenta H7 (M7 core)* replaces the bridge, and everything Linux does
+> through it stops working until the stock image is back.
+> `stm32h7-program.service` can restore it from
+> `/usr/arduino/extra/STM32H747AII6_CM7.bin`, but whether it does so on its
+> own depends on the LmP image.
+>
+> LifeTrac did this to both bench X8s on 2026-05-04; both have run stock
+> x8h7 again since 2026-05-13. The current radio bench does **not** use
+> `tractor_h7` at all: the LoRa radio is the Max Carrier's Murata L072,
+> driven from X8 Linux over `/dev/ttymxc3`. See
+> [`BENCH_BOARDS.md`](../DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_BOARDS.md)
+> before flashing anything on an X8, and skip this step unless you mean to
+> replace the bridge and know how to put the stock image back.
+
 1. Open `firmware/tractor_h7/tractor_h7.ino` in Arduino IDE 2.
 2. Select **Tools → Board → Arduino Mbed OS Portenta Boards → Portenta H7 (M7 core)**. (The X8's onboard H747 enumerates the same way as a standalone H7 for the toolchain — same M7 binary.)
 3. Select **Tools → Port** → the X8's USB-C serial port.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/Dockerfile b/LifeTrac-v25/DESIGN-CONTROLLER/Dockerfile
index b53064f6..2a1462ca 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/Dockerfile
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/Dockerfile
@@ -9,7 +9,10 @@
 # (time/params/logger) — the firmware/tractor_x8 sources are mounted in
 # from the host so the image stays node-agnostic.
 
-FROM python:3.11-slim
+# PYTHON_IMAGE is overridable only to pin the flown base image by digest
+# (see base_station/requirements.lock.txt). The default is unchanged.
+ARG PYTHON_IMAGE=python:3.11-slim
+FROM ${PYTHON_IMAGE}
 
 # Mosquitto client + a few diagnostic tools so an operator shell-in is
 # useful (mosquitto_pub/sub for poking topics by hand).
@@ -22,8 +25,21 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
 WORKDIR /app
 
 # Layer the deps separately so source edits do not invalidate the pip cache.
-COPY base_station/requirements.txt /app/base_station/requirements.txt
-RUN pip install --no-cache-dir -r /app/base_station/requirements.txt
+#
+# Optional LOCKED=1 (`docker build --build-arg LOCKED=1 ...`) installs the
+# wheel versions of the flown bench image: base_station/requirements.lock.txt
+# is applied as a pip constraints file on top of requirements.txt. The
+# default (LOCKED unset or 0) is the unpinned resolve this file always did.
+# The bench deploy script passes LOCKED=1
+# (firmware/x8_lora_bootloader_helper/bench_tools/deploy_base.sh).
+ARG LOCKED=0
+COPY base_station/requirements.txt base_station/requirements.lock.txt /app/base_station/
+RUN if [ "$LOCKED" = "1" ]; then \
+        pip install --no-cache-dir -r /app/base_station/requirements.txt \
+            -c /app/base_station/requirements.lock.txt; \
+    else \
+        pip install --no-cache-dir -r /app/base_station/requirements.txt; \
+    fi
 
 # Application code. firmware/common/lora_proto/ is also copied so
 # lora_bridge.py can import the shared protocol header constants in the
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/FIRMWARE_UPDATES.md b/LifeTrac-v25/DESIGN-CONTROLLER/FIRMWARE_UPDATES.md
index eba23d54..b7579b01 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/FIRMWARE_UPDATES.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/FIRMWARE_UPDATES.md
@@ -50,13 +50,18 @@ The release-key public half is baked into each node's boot loader at manufacture
   3. Watch `journalctl -fu lifetrac-base` for ≥1 minute to confirm the new bridge handshakes with the tractor.
 - **Rollback:** `sudo /usr/local/bin/lifetrac-update vX.Y.<Z-1>` — same wrapper, previous tag.
 
-### Handheld — Portenta H747 (M7 firmware) + secure element
+### Handheld — Arduino MKR WAN 1310 (SAMD21 firmware, `firmware/handheld_mkr`)
 
-- **Artifact:** `lifetrac-handheld-h747-vX.Y.Z.bin` for application code; secure-element provisioning is **separate** and only happens at manufacture or pair.
+> The handheld is an MKR WAN 1310 (SAMD21 MCU + Murata LoRa module), not a
+> Portenta H747 — see [HANDHELD_REMOTE.md](HANDHELD_REMOTE.md) and
+> [firmware/handheld_mkr/](firmware/handheld_mkr/) (FQBN
+> `arduino:samd:mkrwan1310`, [ARDUINO_CI.md](ARDUINO_CI.md)).
+
+- **Artifact:** `lifetrac-handheld-mkr-vX.Y.Z.bin` for application code; key provisioning (secure element or key store) is **separate** and only happens at manufacture or pair.
 - **Channel:** USB-C from the base-station laptop. **Never OTA** — handheld is the operator's safety-critical surface.
 - **Procedure:**
-  1. Connect handheld via USB-C while it is **powered off**. The bootloader enumerates as `Arduino_Bootloader` on USB.
-  2. `python tools/flash_handheld.py --image lifetrac-handheld-h747-vX.Y.Z.bin --port COM7`.
+  1. Connect the handheld via USB-C and double-tap the MKR's RESET button: the SAMD21 bootloader starts (LED pulses) and enumerates as its own COM port.
+  2. `python tools/flash_handheld.py --image lifetrac-handheld-mkr-vX.Y.Z.bin --port COM7` (planned tool; until it exists, compile the sketch as in [ARDUINO_CI.md](ARDUINO_CI.md) and flash it with `arduino-cli upload --fqbn arduino:samd:mkrwan1310 -p <port>`).
   3. Tool verifies signature, flashes, reboots. Power up the handheld and confirm the OLED displays the new firmware version on the splash screen.
   4. **Re-run pairing** — the secure-element key is preserved across firmware updates by design, but verify pairing still works (cf. [OPERATIONS_MANUAL.md § 2](OPERATIONS_MANUAL.md)).
 - **Rollback:** keep the previous `.bin` on the maintenance laptop; reflash with the previous version via the same procedure.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/README.md b/LifeTrac-v25/DESIGN-CONTROLLER/README.md
index 3f5e0739..16a67ce7 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/README.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/README.md
@@ -46,6 +46,7 @@ This folder contains the **primary controller design** for the LifeTrac v25 trac
 - **[VIDEO_OPTIONS.md](VIDEO_OPTIONS.md)** — wireless video streaming analysis (LoRa thumbnails on the air; WiFi/cellular alternatives are archived)
 - **[ARDUINO_CI.md](ARDUINO_CI.md)** — Arduino-CLI continuous integration setup
 - **[firmware/murata_l072/BRINGUP_MAX_CARRIER.md](firmware/murata_l072/BRINGUP_MAX_CARRIER.md)** — Murata L072 flash + bench bring-up runbook (SWD/OpenOCD/J-Link/DFU)
+- **[Radio bench quickstart](firmware/x8_lora_bootloader_helper/bench_tools/BENCH_QUICKSTART.md)** — how to reproduce the two-board LoRa bench (the RS-12/RS-13 campaigns): PC and board setup, L072 firmware, deploy, legs, analysis, park
 - **[arduino_libraries.txt](arduino_libraries.txt)** — pinned library versions
 - **[RESEARCH-CONTROLLER/WIRELESS_OPTIONS.md](RESEARCH-CONTROLLER/WIRELESS_OPTIONS.md)** *(archived)* — historical comparison of wireless technologies considered before LoRa was selected
 
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md b/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md
index a13180b9..879eaf37 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md
@@ -137,7 +137,8 @@ Each of these has been documented as actively destabilizing the bench.
 & $adb -s <serial> reverse --list
 ```
 
-- Observed (2026-05-24, board 2E2C): `reverse tcp:1883 tcp:1883` returns
+- Observed (2026-05-24, board 2D0A -- the base, the board that runs 934-91;
+  2E2C runs the factory 674-88 image): `reverse tcp:1883 tcp:1883` returns
   exit 0 but the tunnel is never installed. From the X8,
   `exec 9<>/dev/tcp/127.0.0.1/1883` returns "Connection refused".
 - `reverse --list` returns `error: protocol fault (couldn't read status
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md b/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md
index ec1bf636..e2bb6d04 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md
@@ -6,62 +6,193 @@
 - T2 cold power cycle did not recover (boot itself wedges).
 - Suspected eMMC corruption (rootfs or OTA partitions damaged).
 - Want a known-good baseline before re-running diagnostics.
+- Bringing up a new bench board: this is step 4 of
+  [BENCH_SETUP.md](../../firmware/x8_lora_bootloader_helper/bench_tools/BENCH_SETUP.md).
 
 **Why it always works:** SDP (Serial Download Protocol) is in i.MX8MM mask
 ROM, not eMMC, so it runs even if the entire on-disk OS is destroyed. `uuu`
 walks the SDP USB endpoint and re-images eMMC end-to-end.
 
+**What it erases:** the whole eMMC: OS, `/etc` changes, docker images,
+`/home/fio` and the base's deployed tree and `secrets/`. Capture first if
+anything matters (`bench_tools/pull_board_state.sh`). It does **not** touch
+the L072 firmware, which lives on the carrier's Murata module. After a
+reflash, run the board through BENCH_SETUP steps 5–7 again (first boot,
+`provision_bench_board.sh`, verify), then redeploy.
+
+## Image and tool (pinned)
+
+### Which image
+
+| image | kernel | URL | on this bench |
+|---|---|---|---|
+| **LmP 4.0.11-934-91** | 6.1.24 | `https://downloads.arduino.cc/portentax8image/934.tar.gz`: 1,097,240,589 B, Last-Modified 2025-08-11 | The base (`2D0A1209DABC240B`), flashed 2026-05-13 and 2026-05-24. **Use this one.** |
+| LmP 4.0.3-674-88 | 5.10.93 | `https://downloads.arduino.cc/portentax8image/674.tar.gz`: 854,998,055 B | The tractor's (`2E2C1209DABC240B`) factory image; that board was never reflashed. Hosted, but never downloaded or byte-verified here, so there is no sha256 on record. |
+| `image-latest.tar.gz` | — | `https://downloads.arduino.cc/portentax8image/image-latest.tar.gz` | **Not the bench image.** The URL moves to newer builds. On 2026-05-08 it still served 934, and the bench bundle was downloaded under that name. |
+
+### Download and verify (Git Bash)
+
+```bash
+mkdir -p ~/portenta-x8-reflash && cd ~/portenta-x8-reflash
+curl -fLO https://downloads.arduino.cc/portentax8image/934.tar.gz
+sha256sum 934.tar.gz
+tar xzf 934.tar.gz                                # creates 934/
+cd 934
+tar xzf mfgtool-files-portenta-x8.tar.gz          # creates mfgtool-files-portenta-x8/
+gunzip -k lmp-factory-image-portenta-x8.wic.gz    # 3,222,240,256 B .wic; -k keeps the .gz
+cd ..
+sha256sum -c 934.sha256                           # the list below, saved as 934.sha256
+```
+
+The bench bundle's outer tarball, saved as `image-latest.tar.gz` on
+2026-05-08, has sha256
+`2f2065c7b10ce33d8444a138353187c507727b5109ddca325506ecaea1efe221`. Today's
+`934.tar.gz` has the same size and Last-Modified date. Nobody has compared
+it byte for byte, so it is expected to match but not proven. If your hash
+differs, the files inside still decide. Save this list as `934.sha256` next
+to the `934/` folder; it holds the sha256 of every file in the bundle used
+for both base reflashes, computed 2026-10-04:
+
+```text
+9cd4dbf7acdb4c4737cc50ad2d23d7deeb136920d37ba42f6ac064b5aaa531df *./934/imx-boot-portenta-x8
+8bc5938a61418c02665baf0d721800045c2caf9818ff1e2c2ab33ca44cad9cc7 *./934/lmp-factory-image-portenta-x8.wic
+a9571a611922170ea7a350a250abd45493652e21393ec6a6806ca1365da73df0 *./934/lmp-factory-image-portenta-x8.wic.gz
+ddeaa6f239feb5cfe9b88ae67a2fe8ef586d52faa8dad609320e338ed596ab2a *./934/mfgtool-files-portenta-x8.tar.gz
+fbb6e417a215d1dfc07de6f069d3b65b7621efa7f1c33fda4d00148e99782421 *./934/mfgtool-files-portenta-x8/bootloader.uuu
+339e63cb0013b8876df643c163440f04fcc2b2a4d4571257660e6d5f25b1936a *./934/mfgtool-files-portenta-x8/erase_emmc.uuu
+e624aa9720debc2914c11d598cbaf5b6b965e7865ea8bdfb3031db7de6b7f4a6 *./934/mfgtool-files-portenta-x8/fitImage-portenta-x8-mfgtool
+3ff0a055c799eb1e5d0c1e4af870d764c968bff0ebbd21c8b6b2da1c15e49af7 *./934/mfgtool-files-portenta-x8/full_image.uuu
+f97e3afaa8491ce4b7023470975d5639afd5302ac79db00c92f508148d9fc300 *./934/mfgtool-files-portenta-x8/imx-boot-mfgtool
+a63a73ec50c455dc4666df3b4bc5161ffcbd2c9e9201638a6327fba81c5a582a *./934/mfgtool-files-portenta-x8/linux_initramfs.uuu
+01e04a0a0e85a99ee0050c7377ca9bf83048a0612409be233b61771eabac3212 *./934/mfgtool-files-portenta-x8/probe_emmc.uuu
+a4f945f5e81255fe52a97143424274e50da01358c83df55ef8a1b02e18a2da4a *./934/mfgtool-files-portenta-x8/probe_sdcard.uuu
+20d6aa39aa525d6325e879853bc40fd0ed751da8aacfc60bd9025de0de7d9bc5 *./934/mfgtool-files-portenta-x8/test_ram.uuu
+51d4f5f95316e3a5026e988f255200f0d7862f97bd9e1063273a37e4b7a50b51 *./934/mfgtool-files-portenta-x8/u-boot-mfgtool.itb
+d5568f967a686dcef4f60932baba2dc8393b79e43dab5c1437226b2a34658a40 *./934/mfgtool-files-portenta-x8/uuu
+ae5dd2b1a6575d1a2416a51ab849009bcaf230d803692c46ade95266b6dcc08e *./934/mfgtool-files-portenta-x8/uuu.exe
+2e37d04e7e4435e25dbe0f9463efe672324e1718b0a272b2d6627b90e13cb4fa *./934/mfgtool-files-portenta-x8/uuu_mac
+c8afc30f003ec18c278ef8da3307f075ffad0bd744565feb95e09f2e8f3d16da *./934/sit-portenta-x8.bin
+b4c055ed4fe6aa7f553fdf2cdcefbfea528d5917abf740a8b55510b52682af08 *./934/u-boot-portenta-x8.itb
+```
+
+The source of this list is
+`LifeTrac-bench-archive\board_state_2026-10-04\pc_only\lmp_934_bundle_sha256.txt`
+in the private archive (PC only).
+
+### `uuu` version: 1.5.243
+
+Use **`uuu` 1.5.243** from NXP's mfgtools releases
+(<https://github.com/nxp-imx/mfgtools/releases>, tag `uuu_1.5.243`). The
+bench's copy of `uuu.exe` has sha256
+`f6b76a6246befabeadfebdc1cbfe58f35939596caf7b78717ceab599b0c85027`.
+**Do not use the `uuu.exe` inside `mfgtool-files-portenta-x8/`.** That one
+is 1.5.109 (sha256 `ae5dd2b1…`), and it was unstable on Windows 11 with this
+image. Both bench reflashes ran 1.5.243 (12/12 stages).
+
+### Extracted layout
+
+`full_image.uuu` refers to the image files as `../<file>`, so run `uuu` from
+inside `mfgtool-files-portenta-x8/`:
+
+```text
+portenta-x8-reflash/
+├── 934.tar.gz
+├── 934.sha256
+└── 934/
+    ├── imx-boot-portenta-x8
+    ├── lmp-factory-image-portenta-x8.wic        (from the .wic.gz)
+    ├── lmp-factory-image-portenta-x8.wic.gz
+    ├── mfgtool-files-portenta-x8.tar.gz
+    ├── mfgtool-files-portenta-x8/               (from the .tar.gz)
+    │   ├── full_image.uuu   <- run uuu here
+    │   ├── imx-boot-mfgtool, u-boot-mfgtool.itb, fitImage-portenta-x8-mfgtool
+    │   └── ... (other .uuu scripts; bundled uuu 1.5.109, do not use)
+    ├── sit-portenta-x8.bin
+    └── u-boot-portenta-x8.itb
+```
+
 ## Pre-flight
 
-1. Run T2.5 first — confirm `VID_1366&PID_0105` (Max Carrier BMP) is
-   enumerating. If not, the carrier is unpowered and SDP won't appear either.
-2. Have a known-good `full_image.uuu` and image set on the host.
+1. Run T2.5 first: confirm `VID_1366&PID_0105` (the Max Carrier's on-board
+   J-Link) is enumerating. If not, the carrier is unpowered and SDP won't
+   appear either.
+2. Have the image downloaded, verified and extracted as above, and
+   `uuu` 1.5.243.
+3. Use a USB-A to USB-C data cable into the **X8 module's** USB-C port,
+   plugged straight into the PC. No hub, and no USB-C to USB-C cable.
 
 ## Procedure
 
-1. Power Board down (USB-C **and** 12V).
-2. Set Max Carrier DIP switches. **The required position is board-dependent**
-   — try (a) first; if SDP does not enumerate after a 12V+USB-C re-attach,
-   power down and try (b):
-   - (a) `BOOT SEL` → **ON** only (`BOOT` → OFF)  *— worked on Board-2 (2D0A) 2026-05-24*
-   - (b) `BOOT SEL` → **ON** and `BOOT` → **ON**  *— worked on Board-1 2026-05-13*
-3. Reconnect 12V, then USB-C.
-4. Confirm SDP enumeration. The mask-ROM PID also varies between silicon revisions:
+1. Power the board down (USB-C **and** 12 V).
+2. Set the Max Carrier DIP switches: **`BOOT SEL` ON** (`BOOT` OFF). If SDP
+   does not appear at step 5, power down and **add `BOOT` ON**.
+   - Both reflashes on this bench, `2D0A1209DABC240B` on 2026-05-13 and
+     2026-05-24, entered SDP with `BOOT SEL` ON only.
+   - `BOOT SEL` + `BOOT` both ON is what Arduino's uuu guide and the
+     2026-05-12 recovery plan describe. It was never needed here.
+3. Start `uuu` so it is waiting, in PowerShell:
+   `cd ...\934\mfgtool-files-portenta-x8; & <path>\uuu.exe full_image.uuu`.
+   It prints `Waiting for Known USB Device Appear...`.
+4. Power up: connect 12 V, then USB-C. On 2026-05-13 SDP appeared on USB-C
+   alone; on 2026-05-24 it needed USB-C and 12 V. Connect both.
+5. Confirm SDP enumeration, in another PowerShell window:
    ```powershell
    Get-PnpDevice -PresentOnly |
      Where-Object { $_.InstanceId -match 'VID_1FC9&PID_(012B|0134)' } |
      Select-Object Status, FriendlyName, InstanceId | Format-List
    ```
-   Observed PIDs: `012B` (Board-1, 2026-05-13) and `0134` (Board-2, 2026-05-24).
-   Either is a valid i.MX SDP endpoint and `uuu` 1.5.243+ accepts both.
-5. Run `uuu full_image.uuu` (or equivalent OE recipe).
-6. Power down. Return both DIP switches to **OFF**.
-7. Power up; allow ~60 s for first-boot.
-8. Run HC-01 → HC-02 → HC-04.
+   Both bench reflashes showed `PID_0134`. `PID_012B` is the PID that older
+   i.MX mask-ROM revisions use; it has not been seen on this bench.
+   `uuu` 1.5.243 accepts both.
+6. `uuu` pushes the boot loaders, then writes the full wic image. That takes
+   about 60–80 minutes (≈75 min on 2026-05-24). Success is 12/12 stages
+   and `Success 1 Failure 0`.
+7. Power down and set **both DIP switches OFF**.
+8. First boot (next section).
+9. Run HC-01, then HC-02. Run HC-04 only for a flash-pipeline session.
 
-## Pass criteria
+## First boot
 
-- SDP enumerated as `VID_1FC9&PID_012B` **or** `VID_1FC9&PID_0134` at step 4.
-- `uuu` reports successful flash + verify (full wic write ≈ 60–80 min).
-- After reboot: HC-01..HC-04 all PASS.
+1. With both DIP switches OFF, connect 12 V, then USB-C. Allow about 60 s.
+   If the LEDs go red or adb has not appeared after 2 minutes, power-cycle
+   once more; the 2026-05-13 reflash needed two cycles.
+2. `adb devices -l` must list the serial as `device`. Then
+   `adb -s <serial> shell cat /etc/os-release` must show
+   `VERSION="4.0.11-934-91"`, and `uname -r` must show `6.1.24-lmp-standard`.
+3. Continue with BENCH_SETUP step 5: password, sudoers drop-in, base
+   network and ssh key, then `provision_bench_board.sh`.
 
 > **First-boot caveat (LmP 934-91):** the freshly imaged X8 has no Wi-Fi
 > credentials and no SSH password. The only post-flash channel is `adb` over
-> USB-C. **Do NOT run `adb kill-server`** — first-boot adbd is fragile and a
-> kill-server leaves the board adb-invisible until a USB-C unplug/replug. See
-> `T0_adb_daemon_kick.md` and the `lifetrac-x8-adb-reverse-broken` repo memory.
+> USB-C. **Do NOT run `adb kill-server`**: first-boot adbd is fragile, and a
+> kill-server leaves the board adb-invisible until a USB-C unplug and replug.
+> See `T0_adb_daemon_kick.md` and the `lifetrac-x8-adb-reverse-broken` repo
+> memory.
+
+## Pass criteria
+
+- SDP enumerated as `VID_1FC9&PID_0134` (or `VID_1FC9&PID_012B` on older
+  silicon) at step 5.
+- `uuu` reports successful flash and verify (full wic write ≈ 60–80 min).
+- After reboot: `os-release` shows the pinned version, and HC-01 and HC-02
+  PASS.
 
 ## Common failure modes
 
 | Symptom | Cause | Action |
 |---|---|---|
-| `1FC9:012B` does not appear with DIPs ON | DIP switches not actually flipped, carrier under-powered, or hardware fault | Re-check DIPs; T2.5 |
-| `uuu` errors mid-flash | Cable / hub flakiness | Use direct host port, not a hub; retry |
-| Flash succeeds but board still boots into hung state | Uncommon — image itself corrupt or pre-flash hardware fault | Try a different image build |
+| No `1FC9:0134` (or `012B`) with `BOOT SEL` ON | DIP switches not actually flipped, `BOOT` also needed, carrier under-powered, or a hardware fault | Re-check the DIP switches; add `BOOT` ON; connect 12 V as well as USB-C; T2.5 |
+| `uuu` errors mid-flash | Cable or hub flakiness, or the bundled `uuu` 1.5.109 | Use a direct host port, not a hub; use `uuu` 1.5.243; retry |
+| `full_image.uuu` cannot find the `.wic` | `.wic.gz` not decompressed, or `uuu` not run from `mfgtool-files-portenta-x8/` | See *Extracted layout* |
+| Flash succeeds, but the board boots a different LmP version | Wrong bundle (for example `image-latest.tar.gz`) | Check `/etc/os-release`; reflash with the pinned bundle |
+| Flash succeeds but board still boots into hung state | Uncommon: the image itself is corrupt, or a pre-flash hardware fault | Verify the sha256 list; try again |
 
 ## Verdict matrix
 
+The May notes call `2D0A1209DABC240B` "Board 1" on 2026-05-13 and "Board-2"
+on 2026-05-24. Go by the serial.
+
 | Date | Board | Outcome | Notes |
 |---|---|---|---|
-| 2026-05-13 | Board-1 (2E2C1209DABC240B) | PASS | DIP = `BOOT`+`BOOT SEL` both ON. SDP enumerated as `VID_1FC9&PID_012B`. `uuu` 1.5.243 EXIT=0. |
+| 2026-05-13 | `2D0A1209DABC240B` (then "Board 1") | PASS | DIP = `BOOT SEL` ON **only**. USB-C only. SDP enumerated as `VID_1FC9&PID_0134`. `uuu` 1.5.243 ran `full_image.uuu`: 12/12 stages, Success 1 / Failure 0. First boot needed 2 power cycles. Fresh `4.0.11-934-91` / `6.1.24-lmp-standard`. Source: [log/2026-05-13_board1_T3a_postreflash_v1.md](../log/2026-05-13_board1_T3a_postreflash_v1.md). *Corrected 2026-10-10 against that log. The row used to say "Board-1 (2E2C1209DABC240B)", "`BOOT`+`BOOT SEL` both ON" and "`PID_012B`". `2E2C` (the tractor) has never been reflashed.* |
 | 2026-05-24 | Board-2 (2D0A1209DABC240B) | PASS | DIP = `BOOT SEL` ON **only** (`BOOT` OFF). SDP enumerated as `VID_1FC9&PID_0134` (NOT `012B`). USB-C + 12V both required to enter SDP. `uuu` 1.5.243 EXIT=0; full wic write ≈75 min total. First-boot adbd later wedged after host-side `adb kill-server`; recovery requires USB-C unplug/replug (no software-only path on a factory image with no Wi-Fi/SSH). |
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/routines/HC-02_linux_bridge_full.md b/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/routines/HC-02_linux_bridge_full.md
index 2c65a4ab..6beb0d91 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/routines/HC-02_linux_bridge_full.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/X8_HEALTH_AND_RECOVERY/routines/HC-02_linux_bridge_full.md
@@ -10,18 +10,20 @@ SWD work.
 ## Procedure
 
 ```powershell
-$script = "LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/board1_healthcheck.sh"
+$script = "LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/x8_max_carrier_healthcheck.sh"
 foreach ($s in '2D0A1209DABC240B','2E2C1209DABC240B') {
   $tag = if ($s -like '2D0A*') {'board1'} else {'board2'}
   $log = "LifeTrac-v25/AI NOTES/$(Get-Date -Format yyyy-MM-dd)_${tag}_healthcheck_v1_0.log"
-  adb -s $s push $script /tmp/board1_healthcheck.sh 2>&1 | Out-Null
-  adb -s $s exec-out "sh /tmp/board1_healthcheck.sh" 2>&1 |
+  adb -s $s push $script /tmp/x8_max_carrier_healthcheck.sh 2>&1 | Out-Null
+  adb -s $s exec-out "sh /tmp/x8_max_carrier_healthcheck.sh" 2>&1 |
     Out-File -FilePath $log -Encoding utf8
   Get-Content $log
 }
 ```
 
-Helper: [board1_healthcheck.sh](../../firmware/x8_lora_bootloader_helper/board1_healthcheck.sh)
+Helper: [x8_max_carrier_healthcheck.sh](../../firmware/x8_lora_bootloader_helper/x8_max_carrier_healthcheck.sh)
+(renamed from `board1_healthcheck.sh` on 2026-05-15; older notes and the
+2026-05-13 logs still use the old name).
 
 ## Pass criteria
 
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/base_station/requirements.lock.txt b/LifeTrac-v25/DESIGN-CONTROLLER/base_station/requirements.lock.txt
new file mode 100644
index 00000000..b4e8cc6d
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/base_station/requirements.lock.txt
@@ -0,0 +1,67 @@
+# LifeTrac v25 base station: the wheels in the FLOWN bench image.
+#
+# Image:   lifetrac-v25:latest 4623980c2dac
+#          (sha256:4623980c2daca116eb68a80fc18285fa273b43545aac498557bcc349871161a6),
+#          built natively (linux/arm64) on the bench base X8 from main d3751286
+#          on 2026-09-15. It is the image the RS-13 legs flew with.
+# Evidence (LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/board_state_2026-10-04/base/files/home_fio/):
+#   - docker_build_d3751286.log, the build of 4623980c2dac, does NOT list the
+#     wheels: its pip step is "Using cache ---> 9e3efb0b5438".
+#   - docker_build.log (2026-09-12, image 12fe97dece57) is the build that
+#     CREATED layer 9e3efb0b5438, on top of the same requirements.txt layer
+#     1d0767921ca1. docker_build_3a0cb524.log (ed7c058774f4) reuses it too.
+#   - The list below is docker_build.log's "Successfully installed" line,
+#     which is every package that pip step installed. pip, setuptools and
+#     wheel come from the python image and are not listed.
+# Python:  FROM python:3.11-slim = image 2fe5ff938d2b,
+#          python@sha256:db3ff2e1800a8581e2c48a27c3995339d47bdf046da21c7627accd3d51053a93
+#          (pip 24.0). The apt step was cached before 2026-09-12, so its
+#          Debian package versions were never logged.
+#
+# Use:     docker build --build-arg LOCKED=1 -t lifetrac-v25:latest .
+#          The Dockerfile then applies this file as a pip CONSTRAINTS file on
+#          top of requirements.txt. A dependency added to requirements.txt
+#          later still installs, unpinned. A floor above a pin here fails the
+#          build loudly; then refresh this file or build without LOCKED.
+#          To pin the base image as well, add:
+#          --build-arg PYTHON_IMAGE=python:3.11-slim@sha256:db3ff2e1800a8581e2c48a27c3995339d47bdf046da21c7627accd3d51053a93
+#          Without LOCKED (the default, as in plain `docker compose build`)
+#          this file is ignored and pip resolves requirements.txt unpinned.
+#          CI does not build the image; it installs requirements-dev.txt,
+#          which pins fastapi 0.136.1 (the flown image has 0.141.1).
+#          The bench deploy (firmware/x8_lora_bootloader_helper/bench_tools/
+#          deploy_base.sh, see DEPLOY.md there) builds with LOCKED=1 by default.
+# Format:  name==version only. Constraints files cannot carry extras, so
+#          uvicorn[standard]'s extras appear as their own packages
+#          (httptools, python-dotenv, pyyaml, uvloop, watchfiles, websockets).
+# Refresh: after a deliberate unlocked rebuild, regenerate from
+#          `docker run --rm --entrypoint python3 lifetrac-v25:latest -m pip freeze`
+#          (deploy_base.sh saves this as /home/fio/pip_freeze_lifetrac-v25_<sha>.txt)
+#          and update the header.
+annotated-doc==0.0.5
+annotated-types==0.8.0
+anyio==4.15.1
+cffi==2.1.1
+click==8.5.0
+cryptography==50.0.1
+fastapi==0.141.1
+h11==0.16.0
+httptools==0.8.0
+idna==3.19
+jinja2==3.1.6
+MarkupSafe==3.0.3
+paho-mqtt==2.1.0
+Pillow==12.3.0
+pycparser==3.0
+pydantic==2.13.5
+pydantic-core==2.46.5
+pyserial==3.5
+python-dotenv==1.2.3
+pyyaml==6.0.3
+starlette==1.6.0
+typing-extensions==4.16.0
+typing-inspection==0.4.4
+uvicorn==0.52.4
+uvloop==0.22.1
+watchfiles==1.2.0
+websockets==17.1
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_13_vector_scene_2026-09-26/scripts/step1_pass_fix.sh b/LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_13_vector_scene_2026-09-26/scripts/step1_pass_fix.sh
index c69f35e5..52f6cf46 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_13_vector_scene_2026-09-26/scripts/step1_pass_fix.sh
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_13_vector_scene_2026-09-26/scripts/step1_pass_fix.sh
@@ -22,7 +22,7 @@ $T "$S docker rm -f camera_svc rs13_cap >/dev/null 2>&1" >/dev/null 2>&1
 # leg (the tractor daemon republishes the base's 0x63 commands here) would flip the
 # camera off VECTOR or onto another profile's budget (2026-10-03 ABORTED1)
 $T "$S docker rm -f bench_mqtt >/dev/null 2>&1; $S docker run -d --name bench_mqtt --network=host -v /tmp/lifetrac_strict/bench_mqtt.conf:/mosquitto/config/mosquitto.conf eclipse-mosquitto:2 >/dev/null; sleep 2" >/dev/null 2>&1
-echo -n "retained on the tractor broker (must be empty): "; $T "$S docker exec bench_mqtt timeout 2 mosquitto_sub -h 127.0.0.1 -t 'lifetrac/#' -v --retained-only 2>/dev/null | wc -l" | tr -d '
'
+echo -n "retained on the tractor broker (must be empty): "; $T "$S docker exec bench_mqtt timeout 2 mosquitto_sub -h 127.0.0.1 -t 'lifetrac/#' -v --retained-only 2>/dev/null | wc -l" | tr -d '\r'
 
 # 1. capture first (the base-station store from /work too: same tree as the encoder)
 $T "$S docker run --rm --name rs13_cap --network=host -v /tmp/lifetrac_strict:/work -w /work \
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/common/setup_x8_mqtt_link.ps1 b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/common/setup_x8_mqtt_link.ps1
index 2b62d572..e79c91d7 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/common/setup_x8_mqtt_link.ps1
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/common/setup_x8_mqtt_link.ps1
@@ -5,8 +5,9 @@
 
 .DESCRIPTION
     The historical recipe used 'adb -s <serial> reverse tcp:1883 tcp:1883' to
-    expose the host broker as 127.0.0.1:1883 on the device. On LmP factory
-    image 934-91 (verified 2026-05-24 on board 2E2C1209DABC240B) that command
+    expose the host broker as 127.0.0.1:1883 on the device. On LmP image
+    4.0.11-934-91 (verified 2026-05-24 on board 2D0A1209DABC240B, the base;
+    the tractor 2E2C runs the as-shipped 4.0.3-674-88 image) that command
     returns exit=0 but does NOT actually install the tunnel:
 
         adb reverse tcp:1883 tcp:1883   -> exit=0  (silent failure)
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/README.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/README.md
index fef448b1..22002835 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/README.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072/README.md
@@ -63,16 +63,79 @@ Future A/B layout (Phase 6, N-26) splits APP:
 
 Stack is reserved at the top (size set in [include/memory_map.h](include/memory_map.h) as `MM_STACK_SIZE`, default 2.5 KB per Claude review §2.3 recommendation).
 
-## Build
+## Building
+
+### Toolchain (byte-identical builds need exactly this)
+
+| tool | version | notes |
+|---|---|---|
+| cross compiler | **Arm GNU Toolchain 12.2.MPACBTI-Rel1**: `arm-none-eabi-gcc --version` prints `arm-none-eabi-gcc (Arm GNU Toolchain 12.2.MPACBTI-Rel1 (Build arm-12-mpacbti.34)) 12.2.1 20230214` | From developer.arm.com, *Arm GNU Toolchain Downloads*, release 12.2.MPACBTI-Rel1, "AArch32 bare-metal target (arm-none-eabi)". Bench PC install: `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\12.2 mpacbti-rel1\bin` on `PATH`. Linux x86_64 tarball: `https://developer.arm.com/-/media/Files/downloads/gnu/12.2.mpacbti-rel1/binrel/arm-gnu-toolchain-12.2.mpacbti-rel1-x86_64-arm-none-eabi.tar.xz` (170 644 784 B, sha256 `17455a06c816031cc2c66243c117cba48463cd6a3a3fdfac7275b4e9c40eb314`, as published in Arm's `.sha256asc`). |
+| make | Windows: WinLibs `mingw32-make` (winget `BrechtSanders.WinLibs.POSIX.UCRT`), **run from PowerShell only**. Linux: GNU make. | On Windows the Makefile uses `cmd` syntax for `mkdir`/`rmdir`, so it fails from Git Bash. |
+| host compiler (`make check` only) | any gcc/cc (WinLibs `gcc` on Windows) | `HOST_CC` overrides. |
+
+Other compilers build **working firmware with different bytes**:
+- Arduino's bundled `arm-none-eabi-gcc` 7-2017q4. [`build.ps1`](build.ps1)
+  picks it first when it is installed, so do not use `build.ps1` for a build
+  you will compare.
+- Ubuntu's `gcc-arm-none-eabi`. The `L072 cross-compile` job in
+  `arduino-ci.yml` uses it for its link + size-budget gate.
+
+A matching md5 therefore proves both the source and the toolchain.
+
+### Targets
 
 ```
-make            # build firmware.elf, firmware.bin, firmware.hex
-make size       # show region usage against the budget
+mingw32-make            # = all: build/firmware.elf/.bin/.hex + region sizes   (Linux: make)
+mingw32-make bench      # build_bench/ with -DHOST_ALLOW_REG_WRITE_DIAG=1, copied to build/firmware_bench_diag.bin
+mingw32-make check      # host-compiler unit vectors + memory-map static asserts (no cross toolchain)
+mingw32-make size       # region usage against the budget
+mingw32-make clean      # removes build/ (including the committed production bin; restore it with `mingw32-make`)
 python3 tools/check_size_budget.py build/firmware.elf
-make clean
 ```
 
-A real toolchain (`arm-none-eabi-gcc`) is required to link. CI now runs a full cross-compile gate on pinned `ubuntu-24.04` with Ubuntu's `gcc-arm-none-eabi` package, publishes the ELF/BIN/HEX/MAP artifacts, and enforces APP/RAM budgets via [tools/check_size_budget.py](tools/check_size_budget.py) using constants from [include/memory_map.h](include/memory_map.h).
+- `all` makes the **production** image `build/firmware.bin`, which is
+  committed (`HOST_ALLOW_REG_WRITE_DIAG=0`). It refuses the bench's
+  diagnostic register writes, such as the DTS carrier pin `-ForceFrfHz`.
+  Rebuild and commit it with every firmware PR.
+- `bench` makes `build/firmware_bench_diag.bin`, the image **both bench
+  boards** run. It is untracked: add firmware files to commits by path, never
+  with `git add <dir>`.
+- `bench` writes into `build/` but does not create it. After a `clean`, run
+  `mingw32-make` (or create `build/`) before `mingw32-make bench`.
+- Run `check` before flashing anything. Flashing is covered in
+  [`../x8_lora_bootloader_helper/FLASH_RUNBOOK.md`](../x8_lora_bootloader_helper/FLASH_RUNBOOK.md).
+
+### Expected md5s
+
+At `main` `bb4a2071` (re-checked 2026-10-04; `firmware/murata_l072` unchanged
+since), built with the toolchain above and the default flags:
+
+| image | md5 | size |
+|---|---|---|
+| `build/firmware_bench_diag.bin` (bench, on both boards since 2026-09-15) | `0c1bb0a9573f813137f941dfa47177d0` | 24 860 B |
+| `build/firmware.bin` (production, committed) | `589c120323c2d5e7ef9f459d7a4ba42d` | 24 860 B |
+
+Check with `certutil -hashfile build\firmware_bench_diag.bin MD5`
+(PowerShell) or `md5sum build/firmware_bench_diag.bin`.
+- Any source change moves both md5s. Record the new pair in the PR.
+- Older flashed builds and their md5s are listed in
+  [`bench-evidence/RS_13_vector_scene_2026-09-26/firmware/README.md`](../../bench-evidence/RS_13_vector_scene_2026-09-26/firmware/README.md).
+
+### CI
+
+- `arduino-ci.yml` → `L072 cross-compile` (blocking): links with Ubuntu's
+  `gcc-arm-none-eabi`. It publishes the ELF/BIN/HEX/MAP artifacts and
+  enforces the APP/RAM budgets through
+  [tools/check_size_budget.py](tools/check_size_budget.py), using constants
+  from [include/memory_map.h](include/memory_map.h). Its bytes differ from
+  the bench build by design.
+- `l072-bench-md5.yml` → `L072 bench md5 (Arm 12.2.MPACBTI-Rel1)`
+  (**non-blocking**): downloads the exact Arm release above for Linux, runs
+  `make bench` and `make`, and prints both md5s against this table and
+  against the committed `build/firmware.bin`, with a warning on mismatch.
+  The Windows bench PC builds are the reference. Whether a Linux build of
+  the same release is byte-identical is what this job tests; it has not been
+  checked by hand.
 
 ## Not yet present
 
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/Dockerfile b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/Dockerfile
index 571f4abb..a1bcfbe3 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/Dockerfile
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/Dockerfile
@@ -1,5 +1,8 @@
 # LifeTrac tractor X8 camera/image pipeline Dockerfile
-FROM python:3.11-slim-bookworm
+# PYTHON_IMAGE is overridable only to pin the flown base image by digest
+# (see requirements.lock.txt). The default is unchanged.
+ARG PYTHON_IMAGE=python:3.11-slim-bookworm
+FROM ${PYTHON_IMAGE}
 
 # Install system dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends \
@@ -9,10 +12,21 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libglib2.0-0 \
     && rm -rf /var/lib/apt/lists/*
 
-# Install Python dependencies
-COPY requirements.txt /app/requirements.txt
+# Install Python dependencies.
+# Optional LOCKED=1 (`docker build --build-arg LOCKED=1 ...`) installs the
+# wheel versions of the flown bench image: requirements.lock.txt is applied
+# as a pip constraints file on top of requirements.txt. The default (LOCKED
+# unset or 0) is the unpinned resolve this file always did. The bench build
+# script passes LOCKED=1
+# (firmware/x8_lora_bootloader_helper/bench_tools/build_tractor_image.sh).
+ARG LOCKED=0
+COPY requirements.txt requirements.lock.txt /app/
 WORKDIR /app
-RUN pip install --no-cache-dir -r requirements.txt
+RUN if [ "$LOCKED" = "1" ]; then \
+        pip install --no-cache-dir -r requirements.txt -c requirements.lock.txt; \
+    else \
+        pip install --no-cache-dir -r requirements.txt; \
+    fi
 
 # Copy camera/image pipeline code
 COPY . /app
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/requirements.lock.txt b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/requirements.lock.txt
new file mode 100644
index 00000000..8492fa78
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8/requirements.lock.txt
@@ -0,0 +1,59 @@
+# LifeTrac v25 tractor X8: the wheels in the FLOWN bench image.
+#
+# Image:   lifetrac-tractor-x8:latest / :rs13-65869517 2727dfd36f9f
+#          (sha256:2727dfd36f9fb2dd58af00694fd6010e2dd8404643470dff3be6ff06aaf01d77),
+#          built natively (linux/arm64) on the bench base X8 on 2026-09-26 from
+#          origin/main 65869517:LifeTrac-v25/DESIGN-CONTROLLER/firmware/tractor_x8,
+#          then loaded on the tractor. It is the image the RS-13 legs flew with.
+# Evidence:
+#   - LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/board_state_2026-10-04/base/files/home_fio/rs13_build.log
+#     is the full build log of 2727dfd36f9f. Its pip step ran uncached; the
+#     list below is its "Successfully installed" line, which is every package
+#     that step installed. pip, setuptools and wheel come from the python
+#     image and are not listed. All were binary wheels: no sdist was built.
+#   - LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_13_vector_scene_2026-09-26/legs/step0_image_build.txt
+#     is the leg summary of the same build (4 of these wheels, same versions).
+# Python:  FROM python:3.11-slim-bookworm = image aad78d4fecb5,
+#          python@sha256:a36c24f9cbdf4fd0f52d67f0823eeac19c2028c637cecc392d97f980d4fec56b
+#          (pip 24.0).
+# Debian packages from the same log (the apt step is unpinned too):
+#          ffmpeg 7:5.1.9-0+deb12u1, libglib2.0-0 2.74.6-2+deb12u9,
+#          libusb-1.0-0 2:1.0.26-1, mosquitto-clients 2.0.11-1.2+deb12u2.
+#
+# Use:     docker build --build-arg LOCKED=1 -t lifetrac-tractor-x8:latest .
+#          (in firmware/tractor_x8). The Dockerfile then applies this file as a
+#          pip CONSTRAINTS file on top of requirements.txt. A dependency added
+#          to requirements.txt later still installs, unpinned. A floor above a
+#          pin here fails the build loudly; then refresh this file or build
+#          without LOCKED. To pin the base image as well, add:
+#          --build-arg PYTHON_IMAGE=python:3.11-slim-bookworm@sha256:a36c24f9cbdf4fd0f52d67f0823eeac19c2028c637cecc392d97f980d4fec56b
+#          Without LOCKED (the default) this file is ignored and pip resolves
+#          requirements.txt unpinned. Note that CI pins OpenCV 4.14.0.94 for
+#          the tests (base_station/requirements-dev.txt), while the flown
+#          tractor image runs OpenCV 5.0.0.93.
+#          The bench build (firmware/x8_lora_bootloader_helper/bench_tools/
+#          build_tractor_image.sh, see DEPLOY.md there) uses LOCKED=1 by default.
+# Format:  name==version only (a pip constraints file allows no extras).
+# Refresh: after a deliberate unlocked rebuild, use the pip freeze that
+#          build_tractor_image.sh saves next to the image tarball
+#          (lifetrac-tractor-x8_<sha>.pip-freeze.txt) and update the header.
+adafruit-blinka==9.2.0
+adafruit-circuitpython-bno08x==1.3.3
+adafruit-circuitpython-busdevice==5.2.17
+Adafruit-Circuitpython-ConnectionManager==3.1.8
+adafruit-circuitpython-gps==4.0.0
+adafruit-circuitpython-requests==4.1.17
+adafruit-circuitpython-typing==1.12.3
+Adafruit-PlatformDetect==3.89.1
+Adafruit-PureIO==1.1.12
+binho-host-adapter==0.1.6
+hidapi==0.15.0
+numpy==2.4.6
+opencv-python-headless==5.0.0.93
+paho-mqtt==2.1.0
+Pillow==12.3.0
+pyftdi==0.57.2
+pyserial==3.5
+pyusb==1.3.1
+sysv_ipc==1.2.0
+typing-extensions==4.16.0
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/FLASH_RUNBOOK.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/FLASH_RUNBOOK.md
index 76d3d3cd..8f54b40b 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/FLASH_RUNBOOK.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/FLASH_RUNBOOK.md
@@ -6,6 +6,18 @@ openocd holds BOOT0/NRST through the H7's GPIOs. Written 2026-09-12 after
 a session that met every trap below; the scripts live in this directory
 and are pushed to `/tmp/lifetrac_p0c` on the board.
 
+- **Scripted form (2026-10-10):** [`bench_tools/flash_l072.sh`](bench_tools/flash_l072.sh)
+  does sections 1–2 from the PC. It reads the serials, base address, ssh key
+  and sudo password from `bench_tools/bench.env` (template
+  `bench_tools/bench.env.example`); without that file it falls back to the
+  original bench's serials and base address, so create it first.
+  Without `--go` it only stages and preflights; `--go` flashes. The manual
+  commands in sections 1–2 are what the script does, for reference.
+- **A board that has never been flashed** (stock MKRWAN AT firmware on the
+  L072): read [section 5](#5-first-flash-from-a-factory-board) first.
+- **A flash is a radio-on event.** The L072 boots into RXCONT. Flash only on
+  the operator's explicit GO for that round.
+
 ## 0. Which binary
 
 | build | command | binary | use |
@@ -17,20 +29,72 @@ Run `mingw32-make check` before flashing anything; `check-stats-layout`
 pins the STATS wire against `host_types.h` (an additive-tail slip shifted
 four fields by one slot on 2026-09-12 — the test exists because of it).
 
+### Byte-identical builds and the expected md5s
+
+The build is reproducible byte for byte, but only with the exact toolchain:
+**Arm GNU Toolchain 12.2.MPACBTI-Rel1** (`arm-none-eabi-gcc --version` →
+`12.2.1 20230214`). On the bench PC it is installed at
+`C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\12.2 mpacbti-rel1\`,
+with WinLibs `mingw32-make` run from PowerShell. Expected md5s at `main`
+`bb4a2071` (`firmware/murata_l072` unchanged since):
+
+| build | md5 | size |
+|---|---|---|
+| bench `build/firmware_bench_diag.bin` (on both boards since 2026-09-15) | `0c1bb0a9573f813137f941dfa47177d0` | 24 860 B |
+| production `build/firmware.bin` (committed) | `589c120323c2d5e7ef9f459d7a4ba42d` | 24 860 B |
+
+Other compilers (Arduino's bundled 7-2017q4, which `build.ps1` picks first;
+Ubuntu's `gcc-arm-none-eabi`, which the main CI job uses) build working
+firmware with **different bytes**, so a matching md5 also proves the
+toolchain. Details and make targets:
+[`../murata_l072/README.md`](../murata_l072/README.md#building). The
+non-blocking CI job `.github/workflows/l072-bench-md5.yml` rebuilds both
+images on Linux with the same Arm release and prints the md5s against these
+values. `flash_l072.sh` names every recorded md5 before it stages. The older
+builds are listed in
+[`bench-evidence/RS_13_vector_scene_2026-09-26/firmware/README.md`](../../bench-evidence/RS_13_vector_scene_2026-09-26/firmware/README.md).
+
 ## 1. Push the tooling (LF!)
 
-git autocrlf rewrites `*.sh`/`*.cfg` to CRLF in the working tree whenever
-git touches them (a pull that changed them, a fresh worktree). Bash on the
+**Use the script.** From this directory, in Git Bash:
+
+```bash
+bash bench_tools/flash_l072.sh <base|tractor> ../murata_l072/build/firmware_bench_diag.bin
+```
+
+It does all of this section: LF-clean copies of the nine pipeline files
+below plus the bin to `/tmp/lifetrac_p0c`, the three wrapper files to
+`/home/fio`, then the wrapper's preflight (`FLASH_PREFLIGHT_ONLY=1`).
+`PREFLIGHT-OK` means the staging is complete. The serials, base address,
+ssh key and sudo password come from `bench_tools/bench.env`. The wrapper
+itself refuses to start — before touching openocd, the UART or the
+watchdog — when a pipeline file or the image is missing or a `.sh`/`.cfg`
+has CRLF (`PREFLIGHT-FAIL`, exit 3).
+
+Why LF matters: git autocrlf rewrites `*.sh`/`*.cfg` to CRLF in the working
+tree whenever git touches them (a pull that changed them, a fresh worktree,
+a checkout made before the repo's `.gitattributes` landed). Bash on the
 board then sees `\r` in every path (`/tmp/lifetrac_p0c\r/pipeline.log: No
-such file`). Normalize before pushing:
+such file`).
+
+**By hand** (what the script does; the `<...>` values are the ones in your
+`bench.env`):
 
 ```bash
-mkdir -p /tmp/p0c_lf && for f in full_flash_pipeline.sh run_flash_l072.sh prep_bridge.sh revive_bridge.sh wdt_pet.sh stm32_an3155_flasher.py 07_assert_pa11_pf4_long.cfg 08_boot_user_app.cfg 99_release_and_reset.cfg; do sed 's/\r$//' "$f" > /tmp/p0c_lf/$f; done
+rm -rf /tmp/p0c_lf && mkdir -p /tmp/p0c_lf/p0c /tmp/p0c_lf/home
+for f in full_flash_pipeline.sh run_flash_l072.sh prep_bridge.sh revive_bridge.sh wdt_pet.sh stm32_an3155_flasher.py 07_assert_pa11_pf4_long.cfg 08_boot_user_app.cfg 99_release_and_reset.cfg; do sed 's/\r$//' "$f" > /tmp/p0c_lf/p0c/$f; done
+for f in run_flash_bench.sh stamp.py kmsg_log.py; do sed 's/\r$//' "bench_tools/$f" > /tmp/p0c_lf/home/$f; done
+cp ../murata_l072/build/firmware_bench_diag.bin /tmp/p0c_lf/p0c/      # binary: copy, never sed
+# base (ethernet)
+ssh -i <BASE_SSH_KEY> fio@<BASE_HOST> "mkdir -p /tmp/lifetrac_p0c"
+scp -i <BASE_SSH_KEY> /tmp/p0c_lf/p0c/* fio@<BASE_HOST>:/tmp/lifetrac_p0c/
+scp -i <BASE_SSH_KEY> /tmp/p0c_lf/home/* fio@<BASE_HOST>:/home/fio/
+# tractor (adb: MSYS_NO_PATHCONV=1 and Windows-style local paths)
+export MSYS_NO_PATHCONV=1
+for f in /tmp/p0c_lf/p0c/*; do adb -s <TRACTOR_SERIAL> push "$(cygpath -m "$f")" /tmp/lifetrac_p0c/; done
+for f in /tmp/p0c_lf/home/*; do adb -s <TRACTOR_SERIAL> push "$(cygpath -m "$f")" /home/fio/; done
 ```
 
-Base (ethernet): `scp /tmp/p0c_lf/* firmware_bench_diag.bin fio@192.168.1.117:/tmp/lifetrac_p0c/`
-Tractor (adb, Windows-style local paths with `MSYS_NO_PATHCONV=1`):
-`adb -s 2E2C1209DABC240B push C:/…/firmware_bench_diag.bin /tmp/lifetrac_p0c/`
 Verify on the board: `grep -l $'\r' /tmp/lifetrac_p0c/*.sh | wc -l` → 0.
 
 The instrumented wrapper `run_flash_bench.sh` plus `stamp.py` and
@@ -40,13 +104,36 @@ evidence.
 
 ## 2. Flash
 
+**Only on the operator's GO.** From the PC, one board at a time; each run
+stages, preflights, then flashes (on the tractor it stops the camera unit
+and container first):
+
+```bash
+bash bench_tools/flash_l072.sh tractor ../murata_l072/build/firmware_bench_diag.bin --go
+bash bench_tools/flash_l072.sh base    ../murata_l072/build/firmware_bench_diag.bin --go
+```
+
+**By hand**, after the by-hand staging of section 1 (`<...>` from your
+`bench.env`; `sudo -n` relies on the sudoers drop-in that provisioning
+installs, see `bench_tools/BENCH_SETUP.md`):
+
 ```bash
 # tractor (adb) — stop the unit AND the container first, or the UART is stolen
-adb -s 2E2C1209DABC240B shell "echo fio | sudo -S -p '' systemctl stop lifetrac-camera.service; echo fio | sudo -S -p '' docker stop tractor-camera; echo fio | sudo -S -p '' env REVIVE_MODE=reboot bash /home/fio/run_flash_bench.sh /tmp/lifetrac_p0c/firmware_bench_diag.bin"
+adb -s <TRACTOR_SERIAL> shell "sudo -n systemctl stop lifetrac-camera.service; sudo -n docker stop tractor-camera; sudo -n env REVIVE_MODE=reboot bash /home/fio/run_flash_bench.sh /tmp/lifetrac_p0c/firmware_bench_diag.bin"
 # base (ssh) — root's SSH shell has no sbin on PATH; the wrapper exports it
-ssh -i ~/.ssh/lifetrac_base_ed25519 fio@192.168.1.117 "REVIVE_MODE=reboot bash /home/fio/run_flash_bench.sh /tmp/lifetrac_p0c/firmware_bench_diag.bin"
+ssh -i <BASE_SSH_KEY> fio@<BASE_HOST> "REVIVE_MODE=reboot bash /home/fio/run_flash_bench.sh /tmp/lifetrac_p0c/firmware_bench_diag.bin"
 ```
 
+**`REVIVE_MODE` now defaults to `reboot`** (2026-10-10) in both
+`run_flash_bench.sh` and `full_flash_pipeline.sh`; it used to default to
+`full`, so every flash had to pass `REVIVE_MODE=reboot` by hand. Passing it
+explicitly, as above, still works. `REVIVE_MODE=full` remains selectable for
+a 5.10 board where a reboot is unwanted; on the base's 6.1 kernel it oopses
+(below). `revive_bridge.sh` treats `reboot` as `reset_run_only`, and it warns
+before a module reload on any 6.x kernel. Other wrapper variables:
+`FLASH_VERIFY_ONLY=1` (read back and compare, write nothing),
+`BENCH_SUDO_PW` and `BENCH_HOME` (defaults `fio`, `/home/fio`).
+
 What happens: `wdt_pet start` (pets `/dev/watchdog0` every 10 s, fsync'd
 log) → `prep_bridge` (unbind consumers, rmmod `x8h7_*`) → `run_flash_l072`
 (openocd holds BOOT0 high + NRST, AN3155 write + `Verify OK`, ~45 s) →
@@ -59,7 +146,8 @@ Why the reboot is deliberate: the old revive re-inserted the `x8h7`
 modules, which OOPSes the base's 6.1.24 kernel in `spi_probe →
 of_irq_get` and drops the board anyway (twice on 2026-09-12, petter alive 2 s
 before). `REVIVE_MODE=full` keeps the old behaviour for the tractor's 5.10
-kernel if ever wanted; nothing needs it.
+kernel if ever wanted; nothing needs it, which is why `reboot` is now the
+default.
 
 ## 3. Watchdog facts (why the scripts look like this)
 
@@ -71,7 +159,14 @@ kernel if ever wanted; nothing needs it.
   with no petter → reboot 60 s later (tractor, 5.10.93, 2026-09-12).
 - No `/sys/class/watchdog/*` attributes, no `devmem`, host python has no
   `mmap`: read registers with `wdog_regs.py` inside the docker image
-  (`--privileged -v /dev/mem:/dev/mem`).
+  (`--privileged -v /dev/mem:/dev/mem`). The script now lives in the repo at
+  [`bench_tools/wdog_regs.py`](bench_tools/wdog_regs.py). Until 2026-10-10
+  it existed only in `/home/fio` on the boards; it was recovered from the
+  board captures. It is read-only (`O_RDONLY`, `PROT_READ`). Push it to
+  `/tmp/lifetrac_strict`, then:
+  `echo fio | sudo -S -p '' docker run --rm --privileged -v /dev/mem:/dev/mem -v /tmp/lifetrac_strict:/work --entrypoint python3 lifetrac-v25:latest /work/wdog_regs.py`
+  (on the tractor use the `arduino-ootb-python-devel:738bc44` image).
+  Expected: `WCR=0x773d WDE=1 WT=119 (60.0 s)`.
 
 ## 4. After the reboot
 
@@ -94,3 +189,135 @@ bracket silently parses only the old fields.
 
 Park at the end of the session: `radio_park.py` → `PARK_OK
 {"opmode_readback": "0x80"}` on both boards.
+
+## 5. First flash from a factory board
+
+This section collects guidance from the 2026-05 bring-up notes that was not
+in one place before. Both bench L072s have been flashed many times since
+May. Nobody has run this first-flash procedure from scratch since then, so
+treat it as consolidated guidance and record what you see.
+
+### What a factory board has
+
+- The L072 inside the Murata CMWX1ZZABZ runs Arduino's stock **MKRWAN AT
+  modem firmware**. The repo keeps 1.2.3 as the factory restore image,
+  [`../../../tools/mlm32l07x01.bin`](../../../tools/mlm32l07x01.bin)
+  (83 032 B). The file of the same name in this directory is misnamed: it is
+  LifeTrac "hello v0.2".
+- **Nothing on the carrier needs to change for this path.** The X8 reaches
+  the L072's ROM bootloader with parts it already has. `/dev/ttymxc3` (i.MX
+  UART4, wired straight to the L072, not through the H7 bridge) carries
+  AN3155 at **19200 8E1**. The X8's own openocd
+  (`/usr/arduino/extra/openocd_script-imx_gpio.cfg`) halts the H747 and
+  drives the L072's **BOOT0 = H7 PA11** and **NRST = H7 PF4**.
+  [`07_assert_pa11_pf4_long.cfg`](07_assert_pa11_pf4_long.cfg) holds BOOT0
+  high for a 600 s window. [`stm32_an3155_flasher.py`](stm32_an3155_flasher.py)
+  is stdlib-only, because LmP's python has no `termios`; `stty` sets up the
+  UART in the shell. Pin map: [Phase 0 crack note](../../../AI%20NOTES/2026-05-07_Portenta_X8_LoRa_Phase0_Crack_and_Phase1_Options_Copilot_v1_0.md).
+  First end-to-end flash, which wrote the MKRWAN image itself:
+  [Method G Phase 1 note](../../../AI%20NOTES/2026-05-08_Method_G_Phase1_End_to_End_Flash_Success_Copilot_v1_0.md).
+- No J-Link or ST-Link is needed. The carrier's L072 SWD header `CN2` is
+  **not populated** by default
+  ([BRINGUP_MAX_CARRIER.md](../murata_l072/BRINGUP_MAX_CARRIER.md) §2); it
+  only matters for the last-resort recovery below.
+
+### Before the first flash
+
+1. Set up the X8 first ([`bench_tools/BENCH_SETUP.md`](bench_tools/BENCH_SETUP.md)):
+   the sudoers drop-in, docker usable, and on the tractor
+   `lifetrac-camera.service` / `tractor-camera` stopped. Both grab
+   `/dev/ttymxc3`, and `run_flash_l072.sh` refuses while anything holds it
+   (exit 90).
+2. **Freshly reflashed X8 (uuu):** `gpio10` (H7 NRST) boots LOW, so openocd
+   reports `cannot read IDR` (README_P0C TT-1). `run_flash_l072.sh` already
+   exports gpio8/10/15, drives gpio10 high and unexports them before
+   openocd attaches. If attach still fails, compare against a good board
+   ([HC-03](../../X8_HEALTH_AND_RECOVERY/routines/HC-03_h7_swd_attach_diff.md)).
+   `SWD DPIDR 0xdeadbeef` on a newer openocd is the sysfs/mmap race, **not a
+   bricked L072** ([T4](../../X8_HEALTH_AND_RECOVERY/recovery/T4_lora_jlink_hardware_unbrick.md)
+   "When NOT to use").
+3. Build with the exact toolchain and check the md5 (section 0).
+
+### The first flash, step by step
+
+1. **Read-only first contact.** Run
+   `bash bench_tools/flash_l072.sh <board> ../../../tools/mlm32l07x01.bin --go --verify-only`.
+   It enters the ROM bootloader, reads the flash back and compares it with
+   the stock image without writing anything, then reboots the X8.
+   - `READY: L072 in STM32 ROM bootloader` (openocd) followed by the
+     flasher's `Bootloader version: 31` means ROM entry and the UART path
+     work.
+   - `Verify-only OK` means the chip carries stock 1.2.3.
+   - A mismatch only means a different stock version. The real question is
+     whether ROM entry works.
+   - This is also how to capture what was on the chip before LifeTrac
+     touched it.
+2. **Flash the bench build:**
+   `bash bench_tools/flash_l072.sh <board> ../murata_l072/build/firmware_bench_diag.bin --go`.
+   - Erase: the flasher first tries Extended Erase mass erase (`0x44`,
+     `0xFFFF`). On the Murata factory part that NACKs, so it falls back to
+     **page-by-page erase** of only the pages the image needs. The rest of
+     the flash and the option bytes are untouched.
+   - Success means `Verify OK`, `flash_rc=0` and `PIPELINE-EXIT=0` in
+     `/home/fio/pipeline_stamped.log`. The X8 reboots
+     (`REVIVE_MODE=reboot`, section 2).
+3. After the reboot, follow section 4: re-stage `/tmp`, stop the tractor
+   camera, run `rs116_health_probe.py`, and park the radio.
+
+### Option bytes and readout protection: do not touch them
+
+- **Never send these AN3155 commands from the X8:** Write Unprotect `0x73`,
+  Readout Protect `0x82`, Readout Unprotect `0x92`, or any Write Memory to
+  the option bytes at `0x1FF80000`. The pipeline's flasher sends none of
+  them.
+  - On 2026-05-14, `flash_l072_via_uart.py wunprot` (through
+    `recover_l072_opt.sh`) was ACKed, and then the chip went silent. Its
+    option-byte complement pairs no longer matched, and it would not run its
+    flash again without SWD
+    ([timeline](../../../AI%20NOTES/2026-05-14_W2-02_Board2_L072_wunprot_Brick_Timeline_Copilot_v1_0.md),
+    [root cause](../../../AI%20NOTES/2026-05-14_W2-02_Board2_L072_OPT_Bytes_Root_Cause_Copilot_v1_0.md)).
+  - That script, `flash_l072_via_uart.py`, `l072_unprotect.py`,
+    `run_l072_unprotect.sh` and `recover_l072_opt.sh` are still in this
+    directory **as history. Do not run them.**
+- Readout Protect sets RDP level 1. The ROM then refuses reads, so the
+  pipeline can no longer verify. Going back to level 0 mass-erases the chip.
+  Level 2 is permanent. Neither has any use on the bench.
+- An option-byte change needs a full power-on reset to load; NRST alone is
+  not enough (root-cause note §4.2).
+- Factory-clean option bytes read `0x807800AA` at `0x1FF80000` (RDP `0xAA` =
+  level 0). Source: the
+  [J-Link note §3a](../../../AI%20NOTES/2026-05-17_Murata_L072_LoRa_Unbrick_JLink_Hardware.md).
+  The bench L072s' current option bytes were never recorded. Reading them
+  (AN3155 Read Memory, read-only) is an open item in
+  [`BENCH_BOARDS.md`](bench_tools/BENCH_BOARDS.md), to be done only on a GO.
+
+### When it goes wrong (2026-05 lessons)
+
+- **Openocd never prints `READY: L072 in STM32 ROM bootloader`.** This is
+  the H7 side (gpio10, the openocd race, or a wedged bridge), not the L072.
+  Power-cycle the X8 and carrier with the 12 V barrel and USB-C unplugged
+  for 10 s
+  ([T2](../../X8_HEALTH_AND_RECOVERY/recovery/T2_cold_power_cycle.md))
+  before you suspect the chip.
+- **Do not use the PWM/gpio163 "SWD bypass"**
+  (`swd_bypass_pa11_pf4_launcher.sh`, sysfs PWM4 + gpio163). It was shown
+  on 2026-05-17 not to enter the ROM. Only the openocd path does.
+- **Last resort: an external J-Link on `CN2`**
+  ([T4](../../X8_HEALTH_AND_RECOVERY/recovery/T4_lora_jlink_hardware_unbrick.md),
+  [J-Link note](../../../AI%20NOTES/2026-05-17_Murata_L072_LoRa_Unbrick_JLink_Hardware.md)).
+  1. Solder a 2×5 1.27 mm header. Use the standard Cortex 10-pin zig-zag
+     cable; the Segger needle adapter does not fit.
+  2. VTref (~3.3 V) needs the 12 V barrel jack **and** the X8 seated and
+     powered.
+  3. Run `JLink.exe -device STM32L072CZ -if SWD -speed 1000 -autoconnect 1`.
+  4. `erase`: a mass erase that also restores the option-byte defaults.
+  5. `mem32 0x1FF80000 4` must show `0x807800AA`.
+  6. `loadbin <bin>, 0x08000000`, then `r` and `go`.
+
+  Once the option bytes are clean, the X8 pipeline above works again.
+- **Which board was bricked is uncertain.** The 05-14 brick ran on adb
+  serial `2E2C…`, but the 05-17 unbrick note says "Board 1 (`2D0A…`)". The
+  notes disagree, which [`BENCH_BOARDS.md`](bench_tools/BENCH_BOARDS.md)
+  lists as an open item.
+- Do not accept J-Link OB firmware-update prompts. An X8 OS reflash (T3a)
+  never fixes an L072 problem.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/README.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/README.md
new file mode 100644
index 00000000..4907c214
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/README.md
@@ -0,0 +1,52 @@
+# x8_lora_bootloader_helper
+
+Tools that run on a Portenta X8 to reflash and talk to the Murata L072
+(the LoRa radio module on the Max Carrier, on `/dev/ttymxc3`), plus the
+PC-side harness for radio bench legs.
+
+Where to start:
+
+- Flashing the L072: [FLASH_RUNBOOK.md](FLASH_RUNBOOK.md).
+- Running the radio bench from scratch:
+  [bench_tools/BENCH_QUICKSTART.md](bench_tools/BENCH_QUICKSTART.md).
+- What is on each bench board today:
+  [bench_tools/BENCH_BOARDS.md](bench_tools/BENCH_BOARDS.md).
+
+## Binaries in this folder: read before you flash
+
+The file names here are misleading. None of these files is the firmware
+the bench boards run.
+
+| file | size | md5 | what it really is |
+|---|---|---|---|
+| `mlm32l07x01.bin` | 4,808 B | `1e3d4328dd74e371e4d583e6fe84f856` | **Misnamed.** A LifeTrac test build ("LIFETRAC L072 hello v0.2 (USART1+LPUART1)"): it prints a banner and a tick counter. It is byte-identical to `../murata_l072/build_hello/hello_world.bin`, built from [`../murata_l072/hello_world.c`](../murata_l072/hello_world.c). It is **not** the Murata/Arduino stock firmware, even though it has the stock file name. |
+| `hello.bin` | 677 B | `972340b8486fb8589ff99fed3dbf4d29` | An earlier, smaller hello build with the same banner. It is byte-identical to `../murata_l072_hello/hello.bin`, built from [`../murata_l072_hello/main.c`](../murata_l072_hello/main.c). |
+| `board2_l072_flash_dump.bin` | 16,440 B | `16e12477f904245f54a694eb7e31fc4c` | A **readback**, not a build. It holds the first 16,440 bytes of L072 flash from `0x08000000`, read in May 2026 (committed 2026-05-13) with [`dump_l072_flash.py`](dump_l072_flash.py) from the board the May notes call "Board 2" (2E2C under that naming). The length is just the size of the `murata_l072` build of that week. It is an early LifeTrac build. It matches no tracked build byte for byte and is not the factory image. Keep it as diagnostic evidence and never flash it. |
+
+### Why the hello build has the stock name
+
+The early flash scripts default to an image called `mlm32l07x01.bin`. For
+example, [`run_flash_l072.sh`](run_flash_l072.sh) uses
+`IMAGE=${1:-/tmp/lifetrac_p0c/mlm32l07x01.bin}`. The hello build was saved
+under that name in May 2026, most likely so those defaults would pick it up
+(the 2026-05-08 hello-world notes push it as
+`/tmp/lifetrac_p0c/mlm32l07x01.bin`). The file is not renamed here because
+old notes and scripts push it by that path. Pass an explicit image path
+instead of relying on the default.
+
+### The real stock image and the real bench firmware
+
+- **Stock (factory) L072 firmware:**
+  [`LifeTrac-v25/tools/mlm32l07x01.bin`](../../../tools/mlm32l07x01.bin)
+  (83,032 B, md5 `33b8a001fac12396c6b7211a463a9cab`). This is Arduino's
+  MKRWAN AT-modem firmware: its strings include the `+VER`/`+DEV` AT
+  commands, `ARD-078` and version `1.2.3`. It was extracted from the MKRWAN
+  library's `MKRWANFWUpdate_standalone/fw.h`. Use it to put a module back to
+  factory state; the LifeTrac bench software does not work with it.
+- **LifeTrac bench firmware (both bench boards since 2026-09-15):** build
+  it with `mingw32-make bench` in [`../murata_l072/`](../murata_l072/). That
+  gives `build/firmware_bench_diag.bin`, md5
+  `0c1bb0a9573f813137f941dfa47177d0`; toolchain and expected hashes are in
+  [`../murata_l072/README.md`](../murata_l072/README.md). Saved copies of
+  every flashed bench build are in
+  [`bench-evidence/RS_13_vector_scene_2026-09-26/firmware/`](../../bench-evidence/RS_13_vector_scene_2026-09-26/firmware/README.md).
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/.gitignore b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/.gitignore
new file mode 100644
index 00000000..c4bede8e
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/.gitignore
@@ -0,0 +1,3 @@
+# Per-bench settings (serials, addresses, the day's DTS carrier); start from
+# bench.env.example. Never commit the real file.
+bench.env
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_BOARDS.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_BOARDS.md
index 53800d9f..b571a934 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_BOARDS.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_BOARDS.md
@@ -8,13 +8,21 @@ captures:
 The rest comes from a review of AI NOTES, bench-evidence,
 X8_HEALTH_AND_RECOVERY and git history.
 
+**To bring up a new pair to this state, see [BENCH_SETUP.md](BENCH_SETUP.md).**
+It covers hardware, the OS image pinned by URL and sha256, the reflash,
+first boot, verification and the L072 firmware.
+[`provision_bench_board.sh`](provision_bench_board.sh) applies the `/etc`
+and docker changes listed under *LifeTrac software living in the X8 Linux*
+below, except the production units, which it never installs. `--check`
+reports how far a board is from that state.
+
 ## The two boards
 
 | | base | tractor |
 |---|---|---|
 | serial (adb) | `2D0A1209DABC240B` | `2E2C1209DABC240B` |
 | hardware | Portenta X8 on a Portenta Max Carrier | same |
-| OS (LmP) | **4.0.11-934-91**, kernel 6.1.24-lmp-standard (uuu reflash 2026-05-13 and 05-24; bundle sha256 in the private archive) | **4.0.3-674-88**, kernel 5.10.93-lmp-standard (factory, never reflashed). **No copy of the 674 image exists.** A reflash would move it to 934/6.1.24. |
+| OS (LmP) | **4.0.11-934-91**, kernel 6.1.24-lmp-standard (uuu reflash 2026-05-13 and 05-24). The bundle is `https://downloads.arduino.cc/portentax8image/934.tar.gz`; its sha256 list is in [T3a](../../../X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md). | **4.0.3-674-88**, kernel 5.10.93-lmp-standard (factory, never reflashed). Arduino still hosts the image at `https://downloads.arduino.cc/portentax8image/674.tar.gz` (854,998,055 B). Nobody here has downloaded or byte-verified it, so there is no sha256 on record. Reflashing to 934 would move it to 6.1.24; BENCH_SETUP §3 compares the two. |
 | access | adb; ethernet 192.168.1.117 with eth0 pinned to 100BASE-TX full (marginal cable); ssh key `~/.ssh/lifetrac_base_ed25519`. On 2026-10-10 it did not enumerate on USB after a power cycle, but ssh worked. | adb only (WiFi off by policy) |
 | power-down | `systemctl poweroff` did **not** keep it off: it booted again about 4.5 min later (2026-10-04). Remove power to keep it down. | stayed off after `systemctl poweroff` |
 | clock | NTP | no time source; it lags by hours to days |
@@ -114,8 +122,11 @@ Repo L072 binaries that are on no board:
   - `docker/key.json`.
 
   All of these were installed by `provision_x8.sh` (2026-05-15) and the May
-  WiFi-off steps. The `disable-wifi.service` unit and the wpa mask are not in
-  git.
+  WiFi-off steps. The `disable-wifi.service` unit is now in git as
+  [`units/disable-wifi.service`](units/disable-wifi.service), copied from
+  the capture. `provision_bench_board.sh tractor` installs and enables it,
+  masks `wpa_supplicant`, and reruns `provision_x8.sh` when the camera
+  files differ.
 - **WiFi:** soft-blocked and disabled in NetworkManager. **A stored
   `5star.nmconnection` holds the WiFi password** (not copied).
 - **`/var/rootdirs/opt/lifetrac`:**
@@ -144,7 +155,9 @@ Repo L072 binaries that are on no board:
 
 - **Repo:**
   - L072 source and bench binaries (PR #140);
-  - provisioning scripts, unit files and the sudoers installer;
+  - provisioning scripts, unit files and the sudoers installer, now driven
+    by [`provision_bench_board.sh`](provision_bench_board.sh) and
+    [BENCH_SETUP.md](BENCH_SETUP.md);
   - every sketch source;
   - the base capture (this folder's sibling);
   - the capture tools [`capture_board_state.sh`](capture_board_state.sh)
@@ -159,8 +172,9 @@ Repo L072 binaries that are on no board:
   - `base/`: the full capture tarball and the deployed tree without
     secrets.
   - `pc_only/`: the patched `libmbed_x8.a`, the LmP 934 bundle's sha256
-    list, and copies of the Claude and Copilot memory notes, which are the
-    only written record of several provisioning steps.
+    list (now also in T3a), and copies of the Claude and Copilot memory
+    notes. Those notes were the only written record of several provisioning
+    steps, which are now in BENCH_SETUP.md.
   - `scripts/`.
 
   **Make a second copy on an external disk or NAS.**
@@ -177,7 +191,10 @@ Repo L072 binaries that are on no board:
 2. Stage only the probe tools (no `push_fix_to_board.sh`). Then run
    `radio_state.py`. At boot the L072 sits in **RXCONT**, listening only;
    `radio_park.py` puts it to `0x80` SLEEP.
-3. Run `bash pull_board_state.sh <base|tractor> [--images]`. Review the
+3. Run `bash pull_board_state.sh <base|tractor> [--images]` (adb only). It
+   writes to `ARCHIVE`, else `ARCHIVE_DIR` from `bench.env`: any folder
+   outside git, in any path form (the script converts it for adb;
+   [BENCH_QUICKSTART.md](BENCH_QUICKSTART.md) step 9). Review the
    reports for secrets before copying them into `bench-evidence/`; the
    2026-10-04 run caught a Dropbear host key, and the filter now excludes it.
 
@@ -190,17 +207,27 @@ Repo L072 binaries that are on no board:
 - [ ] **Decide on the tractor's `lifetrac-tractor-compose.service`.** It is
   enabled and fails at every boot, like the base's units.
 - [ ] Delete the stored `5star` WiFi profile on the tractor once the password
-  is rotated (`nmcli con delete 5star`).
+  is rotated (`nmcli con delete 5star`). `provision_bench_board.sh tractor`
+  backs up the stored WiFi profiles to a root-only directory on the board,
+  then deletes them and prints only their names. Pass `--keep-wifi-profiles`
+  to keep them until then.
 - [ ] **H747 M4 bank 2: identify, then decide.** An openocd
   `dump_image` of banks 1 and 2 halts the H7 and drops the x8h7 bridge, and
   needs a deliberate reboot (FLASH_RUNBOOK precautions; never re-insmod x8h7
   on the base). **Explicit GO only.** Then upload an empty M4 sketch or erase
   bank 2, and record which.
-- [ ] **Rotate the WiFi password.** It is committed in seven repo-root
+- [ ] **Rotate the WiFi password.** It was committed in seven repo-root
   scripts on the public `main` (`connect_wpa.sh`, `do_wifi.sh`,
   `setup_5star_wifi.sh`, `wifi_connect.sh`, `wifi_connect_fast.sh`,
-  `wifi_persist_and_reboot.sh`, `wifi_rescan_connect.sh`). Then replace the
-  literal with an environment variable.
+  `wifi_persist_and_reboot.sh`, `wifi_rescan_connect.sh`) and in
+  `.vscode/tasks.json`.
+  - [x] ~~Replace the literal with an environment variable.~~ Done in the
+    bench kit (2026-10-10): the scripts take the SSID and passphrase from
+    `LIFETRAC_WIFI_SSID` / `LIFETRAC_WIFI_PSK`, and the VS Code tasks that
+    carried the passphrase were removed (it would appear in the task echo).
+  - [ ] **Change the passphrase on the access point.** The old value is
+    still in the public git history, so treat it as compromised. Rewriting a
+    public history with forks is not practical; rotation is the fix.
 - [ ] **Decide on the base's `lifetrac-base.service` /
   `lifetrac-base-compose.service`.** Both are enabled and fail at every boot;
   they would start `lora_bridge` on the radio UART if they ever succeeded.
@@ -209,7 +236,9 @@ Repo L072 binaries that are on no board:
 - [ ] Record the carrier ↔ module pairing, both carriers' DIP switch
   positions and the J-Link OB serials (1078222309 / 1078180658).
 - [ ] Fix the doc errors the review found:
-  - T3a verdict row :66 says 2E2C for the 05-13 reflash; it was 2D0A.
+  - ~~T3a verdict row :66 says 2E2C for the 05-13 reflash; it was 2D0A.~~
+    Fixed 2026-10-10. The row now matches the session log: `BOOT SEL` only,
+    USB-C only, PID 0134.
   - `setup_x8_mqtt_link.ps1:9` names the wrong board.
   - HC-02:13 uses the old name `board1_healthcheck.sh`.
   - FIRMWARE_UPDATES.md:53 calls the handheld a Portenta H747.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_QUICKSTART.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_QUICKSTART.md
new file mode 100644
index 00000000..f9bbec44
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_QUICKSTART.md
@@ -0,0 +1,422 @@
+# Radio bench quickstart
+
+Start here to reproduce the LifeTrac v25 LoRa bench from GitHub: two
+Portenta X8 boards on Max Carriers talking over their Murata L072 radios, as
+in the RS-12 and RS-13 campaigns. This page lists the steps in order with the
+commands. The linked documents explain each step.
+
+**The GO rule.** Radios run only on an explicit operator GO, given for each
+round. Without that GO, nothing that opens `/dev/ttymxc3` runs: no flash
+(the L072 boots into RXCONT, so a flash turns the receiver on), no probe
+(the L072 section of the HC-02 health check writes to that UART too,
+[BENCH_SETUP.md](BENCH_SETUP.md) §7), no channel spot-check, no leg. There is
+one exception: `radio_state.py`, which reads whether a radio is asleep, and
+`radio_park.py`, which puts it to sleep. The power-up guard runs both on its
+own (step 5.1). Apart from the guard's `radio_state.py` / `radio_park.py`,
+power-up, staging, deploys and image builds do not touch the radios.
+
+## What you need
+
+- **Boards.** Two Arduino Portenta X8 (ABX00049), each on a Portenta Max
+  Carrier (ABX00043). The carrier holds the Murata CMWX1ZZABZ (L072 + SX1276).
+  You also need a 12 V supply per carrier and a USB-A to USB-C data cable from
+  each X8 straight to the PC: no hub, and no USB-C to USB-C cable
+  ([BENCH_SETUP.md](BENCH_SETUP.md) §1).
+- **Antennas.** A 915 MHz antenna on each carrier's LoRa SMA (the bench uses
+  Taoglas TD.95.6H31). Never key a radio without one.
+- **Network.** Ethernet for the **base** to a LAN with DHCP and internet; it
+  builds the Docker images. The **tractor** has WiFi off and is reached over
+  adb only.
+- **Camera legs.** A USB UVC camera on the tractor (it enumerates as
+  `/dev/video1`), aimed at the PC screen.
+- **PC.** Windows 11 on the same LAN as the base. Set it up with
+  [PC_SETUP.md](PC_SETUP.md).
+
+On the original bench the **base** is `2D0A1209DABC240B` and the **tractor**
+is `2E2C1209DABC240B`; those are the values in `bench.env.example`. Your
+boards' serials go into `bench.env` (step 1).
+[BENCH_BOARDS.md](BENCH_BOARDS.md) lists what is on every chip of the
+original pair.
+
+## 0. PC setup
+
+Follow [PC_SETUP.md](PC_SETUP.md): Git for Windows (long paths), Python
+through `py -3` plus [`requirements-pc.txt`](requirements-pc.txt), the Arm GNU
+Toolchain 12.2.MPACBTI-Rel1, WinLibs `mingw32-make`, adb, a PowerShell
+execution policy that lets the kit's `.ps1` scripts run
+([PC_SETUP.md](PC_SETUP.md#powershell-execution-policy)), and optionally
+`uuu` and arduino-cli.
+
+## 1. Configure `bench.env`
+
+Every bench script reads `bench_tools/bench.env`: provisioning, the L072
+flash, the deploys and the leg scripts. Create it now, before any script
+touches a board. A script that finds no `bench.env` falls back to the
+original bench's serials and base address (`192.168.1.117`), which on your
+LAN may be some other host.
+
+The commands on this page run in **Git Bash from the repo root**, except
+those marked PowerShell. Start every Git Bash window with:
+
+```bash
+export MSYS_NO_PATHCONV=1                       # adb from Git Bash: no MSYS path rewriting
+DC=LifeTrac-v25/DESIGN-CONTROLLER
+BT=$DC/firmware/x8_lora_bootloader_helper/bench_tools
+```
+
+Create the file once, then edit it:
+
+```bash
+cp "$BT/bench.env.example" "$BT/bench.env"      # gitignored; never commit it
+```
+
+Fill in, following the comments in the file:
+
+- `BASE_SERIAL`, `TRACTOR_SERIAL`: the adb serials. On new boards you read
+  them at first boot ([BENCH_SETUP.md](BENCH_SETUP.md) §5, before
+  provisioning).
+- `BASE_HOST`: the base's reserved DHCP lease. `BASE_SSH_KEY` only if your
+  key is not `~/.ssh/lifetrac_base_ed25519`.
+- `BENCH_SUDO_PW` if you changed the `fio` password.
+- `PC_HOST` (**required** for legs): this PC's LAN IPv4 address as the boards
+  see it. The harness gets it as `-HostIp` and the base rx daemon uses it as
+  its control broker.
+- `BASE_TRANSPORT`: `adb` (radio legs need the base on USB) or `ssh`.
+
+Check what the scripts will use:
+
+```bash
+bash -c '. "$0/lib/bench_env.sh" && bench_show_env' "$BT"
+```
+
+Then load the board values into this shell. The commands below use these
+variables. Paste the block into each new Git Bash window, and again after you
+edit `bench.env`:
+
+```bash
+# board values from bench.env, read in a subshell (the loader is not meant for an interactive shell)
+eval "$(bash -c '. "$0/lib/bench_env.sh" || exit 1
+  for v in BASE_SERIAL TRACTOR_SERIAL BASE_HOST BASE_SSH_USER BASE_SSH_KEY BASE_IMAGE TRACTOR_PROBE_IMAGE ARCHIVE_DIR; do
+    printf "%s=%q\n" "$v" "${!v}"; done' "$BT")"
+BASE="ssh -i $BASE_SSH_KEY $BASE_SSH_USER@$BASE_HOST"   # base: ethernet + ssh
+TRAC="adb -s $TRACTOR_SERIAL shell"                     # tractor: adb only
+R="docker run --rm --network=host --entrypoint python3 --device=/dev/ttymxc3 -v /tmp/lifetrac_strict:/work -w /work -e PYTHONPATH=/work:/work/paho"
+BI=$BASE_IMAGE                                          # base daemon image
+TI=$TRACTOR_PROBE_IMAGE                                 # tractor probe image
+```
+
+## 2. Boards (once per board)
+
+[BENCH_SETUP.md](BENCH_SETUP.md) covers this step:
+
+- the OS image, pinned by URL and sha256 in T3a: LmP 4.0.11-934-91 on both
+  boards. The original tractor still runs its factory 4.0.3-674-88; keep 674
+  only to match that pair exactly (BENCH_SETUP §3);
+- reflashing through
+  [T3a](../../../X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md),
+  brand-new boards included, because the factory image depends on the
+  production batch (BENCH_SETUP §4);
+- first boot, where the serials and the base address go into `bench.env`;
+- [`provision_bench_board.sh`](provision_bench_board.sh), which installs the
+  sudoers drop-in, masks the compose early-start units on the base **before
+  any docker use**, loads the probe image from the repo-root
+  `foundries_python.tar` on both boards, and on the tractor adds WiFi-off
+  ([`units/disable-wifi.service`](units/disable-wifi.service)), the camera
+  unit handling and `eclipse-mosquitto:2` (`--mosquitto-from-base`).
+
+## 3. Radio firmware (L072)
+
+Both boards run the bench build **`0c1bb0a9`**. The production
+`build/firmware.bin` (`589c1203`) refuses the bench carrier pin, so do not put
+it on a bench board.
+
+```powershell
+# PowerShell (mingw32-make does not work from Git Bash)
+cd LifeTrac-v25\DESIGN-CONTROLLER\firmware\murata_l072
+mingw32-make check
+mingw32-make bench
+(Get-FileHash build\firmware_bench_diag.bin -Algorithm MD5).Hash   # 0C1BB0A9573F813137F941DFA47177D0
+```
+
+A different md5 means a different toolchain; see the toolchain section of
+[murata_l072/README.md](../../murata_l072/README.md). If you have no
+toolchain, the same bytes are committed as
+[`firmware_bench_diag_0c1bb0a9.bin`](../../../bench-evidence/RS_13_vector_scene_2026-09-26/firmware/).
+
+Flash with [`flash_l072.sh`](flash_l072.sh), which is
+[FLASH_RUNBOOK.md](../FLASH_RUNBOOK.md) §1–§2 as one script and reads
+`bench.env`. One board at a time:
+
+```bash
+FW=$DC/firmware/murata_l072/build/firmware_bench_diag.bin
+bash "$BT/flash_l072.sh" tractor "$FW"        # stage LF-clean + preflight only: want PREFLIGHT-OK
+bash "$BT/flash_l072.sh" tractor "$FW" --go   # NEEDS THE GO: stops the camera unit, then flashes
+```
+
+Then the same with `base`. Without `--go` the script copies files and runs
+the wrapper's preflight; it touches no radio.
+
+- **New carriers** still run Arduino's stock MKRWAN firmware. Work through
+  [FLASH_RUNBOOK.md §5](../FLASH_RUNBOOK.md#5-first-flash-from-a-factory-board),
+  "First flash from a factory board", first. It starts with a read-only
+  first contact (also on the GO):
+  `bash "$BT/flash_l072.sh" <board> LifeTrac-v25/tools/mlm32l07x01.bin --go --verify-only`,
+  then flashes the bench build as above.
+- **Success** is `Verify OK` and `flash_rc=0` in
+  `/home/fio/pipeline_stamped.log`. The flash reboots the board
+  (`REVIVE_MODE=reboot`), which wipes `/tmp`, and the L072 comes back
+  listening in RXCONT.
+- **Afterwards** run the health probe and park of FLASH_RUNBOOK §4; the
+  commands are in [BENCH_SETUP.md](BENCH_SETUP.md) §8, step 3.
+  `bash "$BT/legs/power_up_guard.sh" --only <board>` does the park part on
+  its own: it stages the probe tools, reads the radio and parks it.
+
+## 4. Board software
+
+[DEPLOY.md](DEPLOY.md) explains both scripts and their arguments:
+
+- [`deploy_base.sh`](deploy_base.sh) puts a commit's `DESIGN-CONTROLLER`
+  subset on the base and builds `lifetrac-v25:latest` there. It never starts
+  `lora_bridge`. The base broker `design-controller-mosquitto-1` must be
+  running.
+- [`build_tractor_image.sh`](build_tractor_image.sh) builds
+  `lifetrac-tractor-x8` natively on the base, then loads it onto the offline
+  tractor. The two images the tractor cannot pull came with provisioning
+  (step 2): `provision_bench_board.sh tractor` loads the probe image from the
+  repo-root `foundries_python.tar` and, with `--mosquitto-from-base`,
+  `eclipse-mosquitto:2`. `build_tractor_image.sh --with-mosquitto` can reload
+  mosquitto.
+
+Wheel versions are pinned in the `requirements.lock.txt` files next to each
+`requirements.txt`.
+
+## 5. Every session
+
+1. **Power-up radio safety.** Arm the guard, then switch the boards on:
+
+   ```bash
+   bash "$BT/legs/power_up_guard.sh" --wait-power-cycle   # boards already up: leave out the flag
+   ```
+
+   As each board comes up, the guard stops the tractor's
+   `lifetrac-camera.service` and the `tractor-camera` container (both grab
+   `/dev/ttymxc3` at every boot) and reports any UART holder. It then stages
+   the probe tools, reads each L072 with `radio_state.py`, and parks any
+   radio that is not in `0x80` SLEEP with `radio_park.py` (3 tries, 60 s
+   apart). Those two scripts are the GO-rule exception; the guard never
+   transmits. Each L072 boots into RXCONT, which only listens, and the guard
+   is what puts it to sleep. `--no-park` only reads; `--check-only` is the
+   end-of-session check (step 8).
+2. **Staging.**
+
+   ```bash
+   bash "$BT/legs/stage_boards.sh"
+   ```
+
+   This re-pushes `/tmp/lifetrac_strict` on both boards. Run it after any
+   reboot (and every flash reboots) or when the last push is 5 days old,
+   because `systemd-tmpfiles` ages `/tmp`. Afterwards,
+   `ls /tmp/lifetrac_strict | wc -l` must be at least 19. The flash staging
+   in `/tmp/lifetrac_p0c` is separate: `flash_l072.sh <board> <bin>` without
+   `--go` re-stages it and runs the wrapper's preflight, and `PREFLIGHT-OK`
+   means it is complete.
+3. **Moving scene (camera legs).** Play the railroad video in a **normal**
+   Firefox window of a separate profile, with the player's own fullscreen
+   (Esc leaves it). **Never use `firefox --kiosk`**: a kiosk locked the
+   operator out of the PC. Before **every** camera run, check the scene: at
+   least 8 % of pixels must change over 10 s (`legs/scene_check.sh`; see
+   [legs/README.md](legs/README.md)).
+4. **Channel spot-check (needs the GO; receive only) and the DTS carrier
+   pin.** The tractor must be parked. The guard parked it at power-up; park
+   it again if anything has woken it since (a probe, a flash, a leg prep):
+
+   ```bash
+   $TRAC "sudo -n $R $TI -u /work/radio_park.py"     # want PARK_OK, both readbacks 0x80
+   ```
+
+   Then sniff the candidate channel on the base, where the known emitter is
+   about 20 dB hotter. `CAND` is the carrier you want to try, in Hz: inside
+   902250000..927750000, and not 915000000.
+
+   ```bash
+   CAND=<candidate carrier in Hz>
+   scp -i "$BASE_SSH_KEY" $DC/firmware/x8_lora_bootloader_helper/channel_survey_sniff.py "$BASE_SSH_USER@$BASE_HOST:/tmp/lifetrac_strict/"
+   $BASE "sudo docker rm -f rx_smoke 2>/dev/null; sudo $R -e LIFETRAC_REG_PROFILE=2 $BI -u /work/channel_survey_sniff.py --start-hz $CAND --stop-hz $CAND --step-hz 500000 --dwell-s 45 --interval-s 0.05" | tee spot_$(date +%F).txt
+   py -3 $DC/tools/survey_compare.py spot_$(date +%F).txt
+   ```
+
+   A hot sample rules a channel out. A clean one does not prove the link;
+   only the leg does. To sweep instead of spot-checking, use
+   `--start-hz 902500000 --stop-hz 927500000 --dwell-s 30`, which takes about
+   26 minutes. Picks hold for hours, not days.
+
+   **Write the pick into `bench.env`** and record it in RESULTS:
+
+   ```bash
+   DTS_CARRIER_HZ=<the pick, in Hz>
+   DTS_CARRIER_DATE=<today, YYYY-MM-DD>
+   ```
+
+   `leg_prep.sh` refuses a profile-2 leg without `DTS_CARRIER_HZ`, on
+   915.000 MHz, and on any day other than `DTS_CARRIER_DATE`. It puts the
+   pick into the harness command as `-ForceFrfHz`. The harness itself
+   refuses `-RegProfile 2` without `-ForceFrfHz`, because the profile
+   default, 915.000 MHz, is the channel of an external emitter (RS-11.6).
+   `-AllowDefaultCarrier` overrides that refusal; use it only for a
+   deliberate 915 MHz control leg.
+
+## 6. Run a leg (needs the GO)
+
+[legs/README.md](legs/README.md) lists the per-leg scripts and their
+arguments. They are parameterised copies of RS-13's `leg_prep.sh` and
+`leg_post.sh`:
+
+- **prep:** scene check, health probes, `clear_retained.py`, pre-brackets,
+  base-side capture. It ends by writing the harness command for this leg;
+- **post:** post-brackets, reports, park.
+
+RS-13 leg 2a, VECTOR at boot on DTS, goes like this:
+
+```bash
+bash "$BT/legs/leg_prep.sh" 2a image_bw500    # prints the wrapper path (--print-harness: preview, touches no board)
+```
+
+```powershell
+# PowerShell, right away: the base capture is already listening.
+# leg_prep.sh printed the exact path of the wrapper.
+& "<BENCH_SCRATCH>/leg2a_harness.ps1"
+```
+
+```bash
+bash "$BT/legs/link_sample.sh" 2a     # while frames flow
+bash "$BT/legs/leg_post.sh" 2a        # after the harness prints "[EVIDENCE] archived to ..."
+```
+
+The wrapper runs
+[`run_live_radio_monitor.ps1`](../run_live_radio_monitor.ps1) from the
+helper directory with the serials, `-HostIp` and `-ForceFrfHz` from
+`bench.env`. It tees the transcript and records the archive folder for
+`leg_post.sh`. If PowerShell says that running scripts is disabled, see
+[PC_SETUP.md](PC_SETUP.md#powershell-execution-policy).
+
+If you must type the harness command yourself, it is the line below, with
+every `<...>` replaced by your `bench.env` values. Typed by hand, it skips
+`leg_prep.sh`'s carrier gate and the archive record, so pass the archive to
+`leg_post.sh 2a <archive dir>`:
+
+```powershell
+cd LifeTrac-v25\DESIGN-CONTROLLER\firmware\x8_lora_bootloader_helper
+.\run_live_radio_monitor.ps1 -TxAdbSerial <TRACTOR_SERIAL> -RxAdbSerial <BASE_SERIAL> -HostIp <PC_HOST> `
+   -TxFeed camera -RegProfile 2 -ForceFrfHz <DTS_CARRIER_HZ from today's spot-check> -DurationS 300 -SynthFps 2 `
+   -KfRequestDisable 1 -ProbeEcho 0 -LogFragArrivals 1 -TxBatch 0 `
+   -CamExtraEnv "-e LIFETRAC_ENCODE_MODE=9 -e LIFETRAC_VECTOR_DETAIL=80" -Archive
+```
+
+The other RS-13 legs (legs/README.md, "The four RS-13 legs"):
+
+- 2b is the same leg on FHSS: `leg_prep.sh 2b image_bw250` (`-RegProfile 1`,
+  no `-ForceFrfHz`).
+- 2c is the `mono_g4` control: `leg_prep.sh 2c image_bw500`
+  (`-CamExtraEnv "-e LIFETRAC_ENCODE_MODE=6"`).
+- 2d is the over-the-air switch: `leg_prep.sh 2d image_bw500`, then
+  `leg2d_switch.sh 2d` right after the harness launch.
+
+**Not flying after the prep after all** (no GO, the harness refused, the
+round was aborted)? `leg_prep.sh` has woken both receivers and left the base
+capture running. `bash "$BT/legs/power_up_guard.sh" --stop-leg-daemons`
+stops the leftover containers and parks both radios.
+
+[RS13_VECTOR_LEG.md](RS13_VECTOR_LEG.md) gives each leg and the pass criteria
+P1–P8. Start the session's `RESULTS.md` from
+[RS13_RESULTS_TEMPLATE.md](RS13_RESULTS_TEMPLATE.md). For RS-12-style tile
+legs, see [BENCH_RUNBOOK.md](BENCH_RUNBOOK.md), "A leg". The archive goes to
+`DESIGN-CONTROLLER/bench-evidence/radio_monitor_<stamp>_<sha>/`, and its
+`params.txt` records what actually ran.
+
+## 7. Analyse
+
+`leg_post.sh` runs the reports for you. To run them by hand, the tools are
+[`rs12_leg_report.py`](../../../tools/rs12_leg_report.py),
+[`frag_gap_report.py`](frag_gap_report.py),
+[`vector_dry_run.py`](../../../tools/vector_dry_run.py) and
+[`legs/leg_replay.py`](legs/leg_replay.py). Run them from
+`DESIGN-CONTROLLER`. From Git Bash, give them Windows-style `C:/...` paths,
+not `/c/...`:
+
+```powershell
+py -3 tools/rs12_leg_report.py <archive> --pre <legs>/leg<X>_pre_base.txt --post <legs>/leg<X>_post_base.txt --capture <legs>/leg<X>_base.jsonl
+py -3 firmware/x8_lora_bootloader_helper/bench_tools/frag_gap_report.py <archive>
+py -3 tools/vector_dry_run.py replay <legs>/leg<X>_base.jsonl --profile image_bw500
+py -3 tools/vector_dry_run.py tractor-log <archive>/camera_service.log
+py -3 firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_replay.py <X> image_bw500 --evidence-dir <legs>
+```
+
+`leg_replay.py <leg> <image_bw500|image_bw250> [--evidence-dir DIR | --capture FILE]`
+gives the post-lock sequence gaps and the P1 resync episodes; it reads
+`<DIR>/leg<leg>_base.jsonl`.
+
+The loss of record is the report's `capture seq gaps` line. The counter
+`loss` line can be stale (RS13_VECTOR_LEG A14) or frozen by a dead stats
+thread (RS-12.17).
+
+## 8. Park and power down
+
+About 2 minutes after the daemons stop, park both radios with
+[`radio_park.py`](radio_park.py). The firmware's scan needs that long to fail
+out. `leg_post.sh` does this at the end of a leg; by hand:
+
+```bash
+$BASE "sudo $R $BI -u /work/radio_park.py"      # want PARK_OK, both readbacks 0x80
+$TRAC "sudo -n $R $TI -u /work/radio_park.py"
+```
+
+`PARK_TRANSIENT` (exit 5) means the scan was still walking: wait 60 s and
+repeat. The park readback does not guarantee the radio stays off, so before
+you call the bench off, re-check both boards with the read-only
+[`radio_state.py`](radio_state.py) (same command line), or run
+`bash "$BT/legs/power_up_guard.sh" --check-only`.
+
+To power down:
+
+- **tractor:** `$TRAC "sudo -n systemctl poweroff"`; it stays off.
+- **base:** `$BASE "sudo systemctl poweroff"`, then **remove its power**.
+  Otherwise it boots again about 4.5 minutes later.
+
+## 9. Capture board state
+
+```bash
+ARCHIVE=$ARCHIVE_DIR bash "$BT/pull_board_state.sh" tractor   # add --images for docker saves
+ARCHIVE=$ARCHIVE_DIR bash "$BT/pull_board_state.sh" base
+```
+
+`ARCHIVE_DIR` comes from `bench.env` through the block in step 1, already in
+the `C:/...` form adb needs. To write somewhere else, set `ARCHIVE` to any
+folder outside git (`C:/...`, `~/...` or `/c/...` all work: the script
+converts it with `cygpath -m`). The capture is adb-only, so the base must be
+on USB.
+
+The capture is read-only and withholds secrets. First stop the tractor's
+camera unit (step 5.1). Review the reports before you copy text into
+`bench-evidence/`, and never commit images or secrets. See
+[BENCH_BOARDS.md](BENCH_BOARDS.md), "Capture at a power-up".
+
+## Troubleshooting
+
+[BENCH_RUNBOOK.md](BENCH_RUNBOOK.md) has the board facts and the full trap
+list. These are the common symptoms:
+
+| symptom | cause | fix |
+|---|---|---|
+| probe or daemon gets no HostLink answer although the L072 transmits | tractor camera unit or container holds `/dev/ttymxc3` | `systemctl stop lifetrac-camera.service; docker stop tractor-camera`; `fuser /dev/ttymxc3` must be empty |
+| flash stops with `PREFLIGHT-FAIL: missing or empty` or `PREFLIGHT-FAIL: CRLF line endings in:` | `/tmp/lifetrac_p0c` aged out or was wiped by a reboot, or a script went up with CRLF | re-run `flash_l072.sh <board> <bin>` without `--go`: it re-stages LF-clean and repeats the preflight; `PREFLIGHT-OK` means the staging is complete |
+| `ERR_PROTO FORBIDDEN detail=6` on `-ForceFrfHz` or a survey | production firmware on the board | flash the bench build (step 3) |
+| harness throws `Refusing a profile-2 (DTS) leg with -ForceFrfHz 0` | a DTS leg without a carrier pin | spot-check (step 5.4) and launch the wrapper `leg_prep.sh` writes |
+| `leg_prep.sh` prints `REFUSED: DTS_CARRIER_HZ ...` | no pick in `bench.env`, 915.000 MHz, or a pick from another day | spot-check today and set `DTS_CARRIER_HZ` / `DTS_CARRIER_DATE` (step 5.4) |
+| DTS loss folds on a ~7.08 s period | the leg flew on 915.000 MHz | spot-check and pin `-ForceFrfHz` (step 5.4) |
+| `running scripts is disabled on this system` in PowerShell | execution policy `Restricted` | [PC_SETUP.md](PC_SETUP.md#powershell-execution-policy) |
+| camera changes mode or a profile is commanded mid-leg | retained control topics | `clear_retained.py` on the base broker **and** `clear_retained_host.py` on the PC broker |
+| report says ~99.8 % loss and `published=1` | stats thread died (RS-12.17) | use `capture seq gaps` / count `published frame_id` lines |
+| docker images vanish on the base | `compose-apps-early-start-recovery.service` is unmasked: it runs `rm -rf /var/lib/docker` every 60 s | mask it ([BENCH_SETUP.md](BENCH_SETUP.md)) |
+| board resets about 60 s into a long operation | the U-Boot-armed X8 watchdog | FLASH_RUNBOOK §3; close `/dev/watchdog0` with `V` |
+| a harness parameter seems ignored | misspelled name | the harness now rejects unknown names; read the archive's `params.txt` |
+| adb lost the board after `adb kill-server` | the board's adbd hung | run `adb -s <serial> wait-for-device` once; if that fails, replug USB-C or press RESET. Avoid `kill-server` while the boards are enumerating ([ADB_TIPS_AND_TRICKS.md](../../../X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md)) |
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_RUNBOOK.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_RUNBOOK.md
index d3922990..ec350c9a 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_RUNBOOK.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_RUNBOOK.md
@@ -5,6 +5,17 @@ next session starts from a checklist instead of memory. Everything that
 keys a radio needs the operator's GO; radios are parked (LoRa SLEEP,
 `0x80` readback) whenever a session ends.
 
+**New to the bench?** Start at [BENCH_QUICKSTART.md](BENCH_QUICKSTART.md).
+It walks through PC and board setup, radio firmware, deploy, a first leg,
+analysis and park, in order, with the commands. This runbook is the
+per-session reference and the trap list. The rest of the bench kit:
+
+- [PC_SETUP.md](PC_SETUP.md)
+- [BENCH_SETUP.md](BENCH_SETUP.md)
+- [DEPLOY.md](DEPLOY.md)
+- [`bench.env.example`](bench.env.example)
+- [legs/README.md](legs/README.md)
+
 ## What is here
 
 | file | runs on | purpose |
@@ -31,16 +42,19 @@ the harness (`run_live_radio_monitor.ps1`) live one directory up. Leg reports:
 * **Powering down.** `systemctl poweroff` keeps the tractor off, but the
   base booted again about 4.5 min later (2026-10-04). Remove power to keep the
   base down.
-* **Powering up.** The L072 boots into RXCONT (listening). Park it with
-  `radio_park.py` if the radios must stay off.
+* **Powering up.** The L072 boots into RXCONT (listening).
+  `legs/power_up_guard.sh` reads each radio with `radio_state.py` and parks
+  any that is listening with `radio_park.py` ([legs/README.md](legs/README.md)).
 * **PC toolchain.** arm-none-eabi-gcc 12.2.1 (Arm GNU Toolchain
   12.2.MPACBTI-Rel1) gives byte-identical L072 builds. Also: WinLibs
   `mingw32-make` (PowerShell only), arduino-cli with
   `arduino:mbed_portenta` 4.5.0, `py -3`. The PC has no Docker; images are
-  built on the base X8.
-* Base `192.168.1.117` via ssh key `~/.ssh/lifetrac_base_ed25519`; tractor
+  built on the base X8. Installation steps: [PC_SETUP.md](PC_SETUP.md).
+* Original bench (the `bench.env.example` values; yours are in `bench.env`):
+  base `192.168.1.117` via ssh key `~/.ssh/lifetrac_base_ed25519`; tractor
   ONLY via `adb -s 2E2C1209DABC240B` (WiFi stays off); base adb
-  `2D0A1209DABC240B`. Password `fio` → `echo fio | sudo -S -p ''`.
+  `2D0A1209DABC240B`. Password `fio` (LmP default) → `echo fio | sudo -S -p ''`;
+  after provisioning, the sudoers drop-in makes `sudo -n` work without it.
 * USB is for programming and debug logs only. Never run the harness or
   `mingw32-make` from bash — PowerShell only.
 * `/tmp` is tmpfs on both boards: **every reboot (every flash) wipes
@@ -53,12 +67,17 @@ the harness (`run_live_radio_monitor.ps1`) live one directory up. Leg reports:
   19 h uptime, no reboot, yet `/tmp/lifetrac_p0c` held only the bin pushed
   the night before — the flash scripts had aged out. A flash attempted then
   fails as `run_flash_bench.sh: line 5: 1: image` (rc 127) and touches no
-  radio. **Count the staging before trusting a flash:**
-  `ls /tmp/lifetrac_p0c | wc -l` must be 11, and `ls /tmp/lifetrac_strict |
-  wc -l` ≥ 19.
+  radio. **Check the staging before trusting a flash:** `flash_l072.sh`
+  re-stages the pipeline and `run_flash_bench.sh` now refuses to run on an
+  incomplete `/tmp/lifetrac_p0c` (preflight); for legs, `ls /tmp/lifetrac_strict |
+  wc -l` ≥ 19 (`legs/stage_boards.sh` re-stages it).
 * The L072 boots into RXCONT (`sx1276_rx_arm()`), so a flash brings the
   receiver up — a flash IS a radio-on event. A probe HostLink connect also
   auto-wakes it.
+* The HC-02 health check (`../x8_max_carrier_healthcheck.sh`) touches the
+  radio UART too: its L072 GET probe sets `/dev/ttymxc3` to 19200 8E1 and
+  writes two bytes (`00 FF`) to it. Run it only with the UART free, and on a
+  GO like any probe ([BENCH_SETUP.md](BENCH_SETUP.md) §7).
 * The tractor's camera unit/container come back on reboot and steal the
   radio UART: `systemctl stop lifetrac-camera.service; docker stop tractor-camera`
   before any probe. Confirm `fuser /dev/ttymxc3` is empty.
@@ -80,7 +99,8 @@ the harness (`run_live_radio_monitor.ps1`) live one directory up. Leg reports:
 1. `git archive` the helper tooling to `/tmp/lifetrac_strict` on both boards
    (probes, `lora_proto.py`, and everything in this directory except the
    `/home/fio` files). `adb push` needs `MSYS_NO_PATHCONV=1` and a
-   Windows-style `C:/...` source path.
+   Windows-style `C:/...` source path. `legs/stage_boards.sh` does this
+   step from `bench.env` ([legs/README.md](legs/README.md)).
 2. Flash staging: push the helper `.sh`/`.cfg`/`.py` pipeline files plus the
    bins to `/tmp/lifetrac_p0c` on both boards **LF-clean** (`tr -d '\r'`);
    a CRLF script fails silently as `1: image` from the wrapper. `scp` to the
@@ -108,8 +128,10 @@ the harness (`run_live_radio_monitor.ps1`) live one directory up. Leg reports:
    fragment and does not exercise the break.
 8. DTS (profile 2) legs: run a same-day receive-only channel spot-check with
    the tractor parked (`../channel_survey_sniff.py` or `../hunt_sniff.ps1`,
-   then `tools/survey_compare.py`). Pass `-ForceFrfHz <the pick>` on every
-   profile-2 leg. `-ForceFrfHz 0` pins 915.000 MHz, where the RS-11.6
+   then `tools/survey_compare.py`). Put the pick in `bench.env`
+   (`DTS_CARRIER_HZ`, `DTS_CARRIER_DATE`) and pass `-ForceFrfHz <the pick>`
+   on every profile-2 leg; the harness refuses a profile-2 leg without it.
+   `-ForceFrfHz 0` pins 915.000 MHz, where the RS-11.6
    external emitter sends ~25 ms bursts at −43 to −45 dBm every ~7.08 s. All
    RS-13.1 DTS legs flew there by accident and their losses fold on its
    period (RS-13.1 A19). The band changes from day to day, so re-check rather
@@ -118,10 +140,18 @@ the harness (`run_live_radio_monitor.ps1`) live one directory up. Leg reports:
 ## A leg
 
 ```
-.\run_live_radio_monitor.ps1 -TxFeed camera|local -RegProfile 1|2 -DurationS 300 `
+.\run_live_radio_monitor.ps1 -TxAdbSerial <TRACTOR_SERIAL> -RxAdbSerial <BASE_SERIAL> -HostIp <PC_HOST> `
+   -TxFeed camera|local -RegProfile 1|2 [-ForceFrfHz <DTS_CARRIER_HZ>] -DurationS 300 `
    [-SynthFps 2 -SynthBudgetB 3000] -KfRequestDisable 0 -ProbeEcho 0 `
    -NoParkLast 0 -LogFragArrivals 1 -IdleDrainQuietS 1.5 -CmdStreamMinGapS 1.0 -Archive
 ```
+The `<...>` values come from `bench.env`; without them the harness falls
+back to the original bench's serials and PC address. `-ForceFrfHz <the pick>`
+is **required with `-RegProfile 2`** (prep 8): the harness refuses a
+profile-2 leg without it, and `-AllowDefaultCarrier` is only for a deliberate
+915 MHz control. Leave it out with `-RegProfile 1`. For an RS-13 leg,
+`legs/leg_prep.sh` writes the complete line ([legs/README.md](legs/README.md)).
+
 On the first `published frame_id` line start the injector on the base
 (`kf_inject.py 15 20` or `dual_inject.py 250`). After `archived to ...`:
 post-brackets both boards, `rs12_leg_report.py`, `frag_gap_report.py`,
@@ -137,9 +167,72 @@ leg V), but that is because of the timing above, not because the write is
 authoritative. RXCONT is receive-only — the TX path only fires on a host
 request, and there is none with the daemons down.
 
+## Bench web UI on the base (optional)
+
+The operator console (`base_station/web_ui.py`) is not part of the harness
+loop. Run it on the base only when a leg needs it, for example the RS-1.4
+Auto selector (leg V) or a look at the tiles. While it runs it adds base
+commands to the control plane (TILE_STALE scans, profile switches), so say in
+RESULTS that it ran. This recipe comes from the F10/F11 sessions and leg V.
+
+1. **Push** `web_ui.py`, `lora_proto.py`, `image_pipeline/` and `web/` from
+   the checkout to `/tmp/lifetrac_strict` on the base. The harness pushes
+   `lora_proto.py` and `image_pipeline/` at every launch, but after a reboot
+   nothing is there until you push it. If `scp` cannot overwrite
+   `image_pipeline/`, remove its root-owned `__pycache__` first.
+
+   ```bash
+   K="-i $HOME/.ssh/lifetrac_base_ed25519"; B=fio@192.168.1.117
+   S=LifeTrac-v25/DESIGN-CONTROLLER/base_station
+   ssh $K $B "sudo rm -rf /tmp/lifetrac_strict/image_pipeline/__pycache__"
+   scp $K -r $S/web_ui.py $S/lora_proto.py $S/image_pipeline $S/web $B:/tmp/lifetrac_strict/
+   ```
+
+2. **Run** it in `lifetrac-v25:latest` with host networking: uvicorn on port
+   **8090**, away from the production compose's 8080,
+   MQTT to the base broker at `127.0.0.1`, and PIN **2525**. That PIN is for
+   the bench only and is never a field PIN; production reads its PIN from
+   `secrets/lifetrac_pin`.
+
+   ```bash
+   ssh $K $B "sudo docker rm -f bench_webui 2>/dev/null; sudo docker run -d --name bench_webui --network=host \
+     -v /tmp/lifetrac_strict:/work -w /work -e PYTHONPATH=/work:/work/paho \
+     -e LIFETRAC_MQTT_HOST=127.0.0.1 -e LIFETRAC_PIN=2525 \
+     --entrypoint python3 lifetrac-v25:latest -m uvicorn web_ui:app --host 0.0.0.0 --port 8090"
+   ```
+
+   Browse to `http://<base IP>:8090`. Some modules, such as `audit_log`,
+   `build_config` and `settings_store`, are imported lazily, and web_ui only
+   degrades when they are missing. If a feature needs one, append
+   `:/app/base_station` to `PYTHONPATH` so the image's deployed copy fills
+   the gap.
+
+3. **Record what it did** with an MQTT tap. web_ui has no root logger, so its
+   info lines never reach `docker logs`:
+
+   ```bash
+   ssh $K $B "sudo docker exec design-controller-mosquitto-1 mosquitto_sub -h 127.0.0.1 -F '%U %t %p' \
+     -t lifetrac/v25/control/radio_profile -t 'lifetrac/v25/status/radio_profile/#' -t lifetrac/v25/video/link_stats" | tee webui_tap.txt
+   ```
+
+4. **Auto selector.** Arm Auto only **after** the daemons are up. With no
+   daemon running, Auto pins FHSS within 60 s (the stale-link rule). At the
+   end of the session, set a concrete profile (e.g. 2) before you stop. A
+   retained `auto` otherwise re-commands the tractor at the next start. Then
+   run `clear_retained.py`.
+
+5. **Stop it** at the end of the session:
+   `ssh $K $B "sudo docker rm -f bench_webui"`. Port 8090 then closes.
+
 ## Traps that cost time this campaign
 
 * Bash-tool heredocs mangle backslashes — write patch scripts to files.
+* **Misspelled harness parameters were ignored without a warning.**
+  `run_live_radio_monitor.ps1` used to put an unknown name into `$args`, so
+  `-DurationSeconds 300` ran the 30 s default of `-DurationS`. The harness
+  now refuses unknown names at launch. Even so, read the archive's
+  `params.txt` for the values that actually ran (`duration_s`,
+  `force_frf_hz`, `reg_profile`, ...) before you quote a leg.
 * `git add <directory>` sweeps the untracked bench binary
   (`build/firmware_bench_diag.bin`) into the commit; add firmware by path.
 * The committed `build/firmware.bin` is the PRODUCTION image (no diag flag);
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_SETUP.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_SETUP.md
new file mode 100644
index 00000000..e2eca321
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_SETUP.md
@@ -0,0 +1,371 @@
+# Bench setup: from two new boards to a bench-ready pair
+
+This page takes two new Portenta X8 boards on Max Carriers to the state the
+LifeTrac radio bench runs in: OS image, board settings, firmware and docker
+images. Work through it in order. Each step names the doc that has the details.
+
+It reproduces the state measured on the original pair. The base was captured
+in [`board_state_2026-10-04/base/`](../../../bench-evidence/board_state_2026-10-04/base/)
+and the tractor in [`board_state_2026-10-10/tractor/`](../../../bench-evidence/board_state_2026-10-10/tractor/);
+[BENCH_BOARDS.md](BENCH_BOARDS.md) describes both captures.
+
+| step | what | where |
+|---|---|---|
+| 0 | Radio safety rules | below |
+| 1 | Hardware | below |
+| 2 | DIP switches | below |
+| 3 | Choose the OS image | below |
+| 4 | Reflash both boards | [T3a](../../../X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md) |
+| 5 | First boot: adb, password, base network, ssh key | below |
+| 6 | Provision: `provision_bench_board.sh base`, then `tractor` | below |
+| 7 | Verify: HC-01, HC-02, `--check` | below |
+| 8 | L072 radio firmware, health probe, park | [FLASH_RUNBOOK.md](../FLASH_RUNBOOK.md) |
+| 9 | Deploy the base tree, the images and the broker | [DEPLOY.md](DEPLOY.md) |
+| 10 | Staging and radio legs | [BENCH_QUICKSTART.md](BENCH_QUICKSTART.md) |
+
+You need a Windows PC set up as in [PC_SETUP.md](PC_SETUP.md): adb, Git Bash,
+PowerShell, `py -3`, the Arm GCC toolchain, `mingw32-make` and `uuu`.
+Run the shell commands on this page in **Git Bash**, from this directory
+(`LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools`),
+unless a step says PowerShell.
+
+Who is the base and who is the tractor: the **base** is on ethernet and is
+reached over ssh or adb. The **tractor** has its WiFi off for good, has the
+camera, and is reached over adb only (USB). Put the serials in `bench.env`
+(step 5).
+
+---
+
+## 0. Radio safety (read this first)
+
+The bench has two LoRa radios in the 902–928 MHz ISM band. The repo's
+references are US rules (FCC §15.247); check your local rules before any
+radio test.
+
+1. **Antennas first.** Screw the antenna onto each carrier's LoRa connector
+   before you power the board. Never let a radio transmit without one.
+2. **The LifeTrac L072 firmware boots listening.** It powers up in RXCONT,
+   which is receive-only. It transmits only when a host program on the X8
+   asks it to: the bench daemons, the harness, or a probe that sends TX
+   requests. If the radios must stay off, park them with
+   `radio_park.py` (step 8). Its `0x80` readback is not a lasting guarantee
+   while the firmware's scan is still running, so confirm a few minutes
+   later with the read-only `radio_state.py`.
+3. **Flashing the L072 turns its receiver on.** A probe that connects to
+   it (rs116, radio_park, radio_state) also wakes it.
+4. **The tractor's camera unit takes the radio UART.** At every boot, and
+   whenever the camera is plugged in, `lifetrac-camera.service` and its
+   `tractor-camera` container grab `/dev/ttymxc3`. Stop both before any
+   probe or flash:
+   `sudo -n systemctl stop lifetrac-camera.service; sudo -n docker stop tractor-camera`.
+   `sudo -n fuser /dev/ttymxc3` must then print nothing.
+5. **The base does not stay off.** After `systemctl poweroff` the base
+   booted again about 4.5 minutes later (2026-10-04). To keep it down,
+   remove its power. The tractor stays off after `systemctl poweroff`.
+6. **Never start the production units on the bench.** These are
+   `lifetrac-base.service`, `lifetrac-base-compose.service` and
+   `lifetrac-tractor-compose.service`. They would start `lora_bridge` or the
+   tractor stack on the radio UART. This kit does not install them. The
+   original pair has them enabled, and they fail at every boot.
+7. **Radio tests need a GO.** On a shared bench, every round of radio
+   tests needs the operator's explicit GO, and both radios are parked
+   after it.
+
+## 1. Hardware
+
+| item | qty | notes |
+|---|---|---|
+| Arduino Portenta X8 (ABX00049) | 2 | The OS, eMMC, H747 and SE050 belong to the module. |
+| Arduino Portenta Max Carrier (ABX00043) | 2 | Carries the Murata CMWX1ZZABZ LoRa module (STM32L072 + SX1276), the BOOT DIP switches and an on-board J-Link. The L072 firmware belongs to the **carrier**. |
+| 915 MHz antenna | 2 | Bench parts: Taoglas TD.95.6H31 Blade (868/915 MHz dual-band dipole, SMA), one on each carrier's LoRa antenna connector. |
+| 12 V DC supply | 2 | One per carrier (barrel jack). |
+| USB-A to USB-C data cable | 2 | Goes into the X8 module's own USB-C port. For a reflash, plug it straight into the PC: no hub, and no USB-C to USB-C cable. |
+| Ethernet cable + LAN with DHCP | 1 | For the base. A marginal cable at gigabit forced the optional 100BASE-TX pin (step 6). |
+| Kurokesu C2 USB camera (16d0:0ed4) | 1 | Goes on the tractor carrier's USB-A host port. Needed only for camera legs. |
+| Windows 10/11 PC | 1 | Set up as in [PC_SETUP.md](PC_SETUP.md). The PC has no Docker: images are built on the base X8. |
+| Optional: a second USB cable per carrier | 2 | For the carrier's own USB-C (on-board J-Link, `VID_1366&PID_0105`). Only the T2.5 and T4 recovery steps use it. |
+
+Label each module and each carrier with its serial, and write down which
+module sits on which carrier. Recovery depends on that pairing: the L072
+firmware, its option bytes and the DIP switches stay with the carrier.
+
+## 2. DIP switches
+
+Each Max Carrier has a `BOOT SEL` and a `BOOT` DIP switch.
+
+- **Normal boot: both OFF.** Check this on new carriers before first power.
+- **Reflash (SDP mode):** set `BOOT SEL` ON. If the SDP device does not
+  appear, power down and set `BOOT` ON as well. Both reflashes on this bench
+  needed only `BOOT SEL`. See [T3a](../../../X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md).
+- After the reflash, set both back to OFF.
+
+Write down each carrier's switch positions, as BENCH_BOARDS asks.
+
+## 3. Choose the OS image
+
+| image | kernel | URL | status |
+|---|---|---|---|
+| **LmP 4.0.11-934-91** | 6.1.24 | `https://downloads.arduino.cc/portentax8image/934.tar.gz` (1,097,240,589 B, Last-Modified 2025-08-11) | **The base image.** Flashed with `uuu` 2026-05-13 and 05-24. Pinned by sha256 in T3a. **Use this on both boards.** |
+| LmP 4.0.3-674-88 | 5.10.93 | `https://downloads.arduino.cc/portentax8image/674.tar.gz` (854,998,055 B) | The tractor's factory image; that board was never reflashed. It is still hosted at this URL, but nobody here has downloaded or byte-checked it, so there is no sha256 on record. |
+| `image-latest.tar.gz` | — | `https://downloads.arduino.cc/portentax8image/image-latest.tar.gz` | **Not the bench image.** This URL moves to newer builds. The bench bundle was downloaded under this name on 2026-05-08, when it still served 934. |
+
+The 934 bundle used on the base has this sha256:
+`2f2065c7b10ce33d8444a138353187c507727b5109ddca325506ecaea1efe221`.
+It was saved as `image-latest.tar.gz`. Today's `934.tar.gz` has the same
+size and date, but nobody has compared it byte for byte. If your download
+hashes the same, it is identical. If not, check the extracted files against
+the full list in T3a; those files are what `uuu` writes.
+
+**Recommendation for a new bench: 934 on both boards.** That gives one image
+to keep and one set of quirks. Be aware that **the tractor role has only ever
+run on 674**. Treat the first tractor-on-934 legs as a new configuration and
+record it in the evidence. The 934 differences that matter for the tractor
+are known and handled:
+
+- The flash wrapper must reboot instead of re-inserting `x8h7`, which crashes
+  the 6.1 kernel. `REVIVE_MODE` now defaults to `reboot` in the flash wrapper, and
+  FLASH_RUNBOOK passes it explicitly too.
+- The compose-apps recovery unit wipes `/var/lib/docker`.
+  `provision_bench_board.sh` masks it.
+- The factory docker images differ. The probe image comes from the repo's
+  `foundries_python.tar`, which `provision_bench_board.sh` loads.
+
+To match the original pair exactly, keep the tractor on its factory 674.
+That works only if the board still runs 674; check
+`cat /etc/os-release` once you have adb.
+
+## 4. Reflash both boards
+
+Follow [T3a_sdp_uuu_reflash.md](../../../X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md).
+It covers the download and sha256 check, the extracted layout, `uuu` 1.5.243,
+the DIP switches, SDP detection and the first boot. Budget 60–80 minutes per
+board for the eMMC write.
+
+Reflash even brand-new boards: the factory image depends on the production
+batch. A reflash erases the whole eMMC (OS, `/etc`, docker images,
+`/home/fio`). It does not touch the L072 firmware on the carrier.
+
+## 5. First boot
+
+1. Set both DIP switches OFF. Connect 12 V, then USB-C. First boot takes
+   about 60 s. If the LEDs go red or adb has not appeared after 2 minutes,
+   power-cycle once more; the 2026-05-13 reflash needed two cycles.
+2. Check the board is visible: `adb devices -l` must list its serial as
+   `device`. **Do not run `adb kill-server`.** On a first-boot board adbd is
+   fragile, and a kill-server can leave it invisible until you replug the
+   USB-C ([ADB_TIPS_AND_TRICKS.md](../../../X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md)).
+3. **Record the serials.** Copy [`bench.env.example`](bench.env.example) to
+   `bench.env` in this directory and set `BASE_SERIAL`, `TRACTOR_SERIAL`
+   and `BASE_HOST`, plus `BENCH_SUDO_PW` if you change the password, and
+   `PC_HOST` (this PC's LAN IPv4 address; radio legs need it). Do this
+   before any kit script runs: without `bench.env` the scripts fall back to
+   the original bench's serials and base address.
+   `bench.env` is your local file: keep it out of git.
+4. **Password.** The image's user is `fio` with password `fio`; adb opens a
+   shell as `fio` without asking for it. Changing it is recommended on the
+   base, which sits on your LAN with ssh. Run `adb -s <serial> shell`, then
+   `passwd`. If you change it, put it in `bench.env` as `BENCH_SUDO_PW`.
+   The provisioning script uses it once, to install the sudoers drop-in;
+   after that `sudo -n` needs no password.
+5. **Sudo without a password.** Step 6 installs this with the repo's
+   [`install_lifetrac_nopasswd.sh`](../install_lifetrac_nopasswd.sh), which
+   writes `/etc/sudoers.d/99-lifetrac-bench-nopasswd` =
+   `fio ALL=(ALL) NOPASSWD: ALL`. It is bench-only: it gives anyone with a
+   shell as `fio` full root. To install it by hand instead:
+
+   ```bash
+   export MSYS_NO_PATHCONV=1
+   sed 's/\r$//' ../install_lifetrac_nopasswd.sh > /tmp/install_nopasswd.sh   # LF only
+   adb -s <serial> push "$(cygpath -m /tmp/install_nopasswd.sh)" /tmp/install_lifetrac_nopasswd.sh
+   adb -s <serial> shell   # then on the board: sudo sh /tmp/install_lifetrac_nopasswd.sh
+   ```
+
+6. **Base network.** Plug the base into the LAN and read its address:
+   `adb -s <base serial> shell ip -br addr show eth0`. Reserve that DHCP
+   lease in your router (the original bench uses `192.168.1.117`) and set
+   `BASE_HOST` in `bench.env`.
+7. **Base ssh key.** Create a key on the PC, in Git Bash:
+
+   ```bash
+   ssh-keygen -t ed25519 -f ~/.ssh/lifetrac_base_ed25519 -C lifetrac-bench-pc
+   ```
+
+   Step 6 appends `~/.ssh/lifetrac_base_ed25519.pub` to the base's
+   `/home/fio/.ssh/authorized_keys`. Afterwards this must work:
+   `ssh -i ~/.ssh/lifetrac_base_ed25519 fio@<BASE_HOST> uptime`. Back up
+   the private key in a password manager, never in git.
+8. **Tractor network: none, on purpose.** Leave its ethernet unplugged.
+   Step 6 turns its WiFi off for good.
+
+## 6. Provision
+
+[`provision_bench_board.sh`](provision_bench_board.sh) runs on the PC and
+applies every board-side customization the original pair has. It reads
+`bench.env` and talks to one board over adb. Every step checks first, so it
+is safe to re-run. `--check` reports without changing anything. Do the base
+first, because the tractor's broker image comes from it.
+
+```bash
+bash provision_bench_board.sh base --check       # what is missing
+bash provision_bench_board.sh base               # add --nic-100 only for a marginal cable
+bash provision_bench_board.sh tractor --check
+bash provision_bench_board.sh tractor --mosquitto-from-base
+```
+
+What it applies, and why:
+
+| step | board | why |
+|---|---|---|
+| sudoers drop-in (`install_lifetrac_nopasswd.sh`) | both | Every bench script uses `sudo -n`. |
+| mask `compose-apps-early-start-recovery.service` and `compose-apps-early-start.service` | base, and the tractor on any image other than 674 | On 934 `compose-apps-early-start` fails at boot. Its `OnFailure` recovery unit then runs `systemctl stop docker` and deletes `/var/lib/docker`, about every 60 s, so every image you load disappears. Mask both before relying on docker. On 674 the unit succeeds and is left alone (`--mask-compose` masks it anyway). |
+| optional `--nic-100`: `Wired connection 1` set to speed 100, duplex full, auto-negotiate yes | base | The original base's cable loses about half its RX frames at gigabit and none at 100. Auto-negotiation stays on, as on the base, so it only advertises 100/full. Skip this on a good cable. To undo it: `sudo nmcli connection modify 'Wired connection 1' 802-3-ethernet.speed 0 802-3-ethernet.duplex '' 802-3-ethernet.auto-negotiate yes`. |
+| PC ssh key appended to `~/.ssh/authorized_keys` | base | Base work goes over ssh. Its USB has failed to enumerate after a power cycle (2026-10-10) while ssh kept working. |
+| [`units/disable-wifi.service`](units/disable-wifi.service) installed and enabled, which runs `rfkill block wifi` at boot | tractor | The tractor has no IP path by policy. This is the unit text from the tractor capture. |
+| `wpa_supplicant.service` masked; `nmcli radio wifi off` | tractor | Same reason. |
+| stored NetworkManager WiFi profiles backed up to a root-only directory on the board, then deleted (only their names are printed) | tractor | The original tractor stores the `5star` profile with its password. `--keep-wifi-profiles` keeps them. |
+| camera USB provisioning: runs the repo's [`provision_x8.sh`](../provision_x8.sh) unchanged | tractor | Installs the `snd_usb_audio` blacklist, the C2 udev rules (autosuspend off, `/dev/lifetrac-c2`) and `lifetrac-camera.service`, and adds `fio` to `video`. The script skips this when all three files already match. It refuses when a camera compose app is installed and the C2 is attached, because `provision_x8.sh` would restart the camera, whose container maps the radio UART; pass `--allow-camera-restart` to accept that. |
+| docker running; probe image `hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44` loaded from the repo-root `foundries_python.tar` (image id `9a454afe48f7`) | both | `radio_park.py`, `radio_state.py` and `rs116_health_probe.py` run in it. The tractor cannot pull images, and the base's own `lifetrac-v25` image exists only after step 9. |
+| `eclipse-mosquitto:2` | base: `docker pull`. Tractor: `--mosquitto-from-base` (docker save on the base, then through the PC) or `--mosquitto-tar FILE` | The base broker and the tractor's local broker. The tag moves, so note the image id the script prints. |
+| `lifetrac-camera.service` and `tractor-camera` stopped | tractor | Keeps the radio UART free (rule 4). Both come back at the next boot. |
+
+It never opens `/dev/ttymxc3` and never starts the production units. It
+reports any of them it finds, and who holds the radio UART. It ends with a
+checklist of what is left. Exit codes: 0 done, 1 a step failed, 2 usage or
+board unreachable, 3 `--check` found work to do. Run
+`bash provision_bench_board.sh --help` for all options.
+
+It does not touch the L072 firmware or option bytes, the H747, the deployed
+tree or the production units. It does not rotate the WiFi password either.
+**That password must be treated as compromised:** it was committed in seven
+repo-root WiFi scripts, and although the bench kit replaced the literals
+with the `LIFETRAC_WIFI_SSID` / `LIFETRAC_WIFI_PSK` environment variables, it
+is still readable in the public git history. Rewriting a public history with
+forks is not practical, so change the passphrase on the access point; see
+the open items in [BENCH_BOARDS.md](BENCH_BOARDS.md).
+
+## 7. Verify
+
+1. **HC-01 (adb and USB enumeration, PowerShell):**
+   [HC-01](../../../X8_HEALTH_AND_RECOVERY/routines/HC-01_adb_and_usb_enumeration.md).
+   Each serial must show `device`, stable over 30 s.
+2. **HC-02 (Linux, x8h7 bridge, GPIO, UART):**
+   [HC-02](../../../X8_HEALTH_AND_RECOVERY/routines/HC-02_linux_bridge_full.md).
+   The helper is [`x8_max_carrier_healthcheck.sh`](../x8_max_carrier_healthcheck.sh).
+   On the tractor, stop the camera unit first (rule 4).
+
+   ```bash
+   export MSYS_NO_PATHCONV=1
+   sed 's/\r$//' ../x8_max_carrier_healthcheck.sh > /tmp/hc.sh
+   adb -s <serial> push "$(cygpath -m /tmp/hc.sh)" /tmp/x8_max_carrier_healthcheck.sh
+   adb -s <serial> shell "sh /tmp/x8_max_carrier_healthcheck.sh"
+   ```
+
+   **Its L072 section touches the radio UART.** The "L072 GET probe" sets
+   `/dev/ttymxc3` to 19200 8E1 and writes two bytes to it (`00 FF`, the
+   AN3155 GET command), then listens for 0.4 s to see whether the L072 sits
+   in its ROM bootloader. A running LifeTrac firmware talks HostLink at
+   921600 baud in COBS frames with a CRC-16, so it should discard the two
+   bytes, and the probe sends nothing over the air. It is still a write to
+   the radio UART: run it only when nothing else holds `/dev/ttymxc3`
+   (`sudo -n fuser /dev/ttymxc3` prints nothing), and on a shared bench
+   treat it like a probe, on the operator's GO. Expected on a fresh board: the x8h7
+   modules load (934 lists 10), `m4-proxy` and `stm32h7-program` are active,
+   and `/dev/ttymxc3` and `/dev/watchdog0` exist. A
+   `/sys/kernel/x8h7_firmware/version` timeout is normal. `gpio8/10/15` are
+   exported only after a flash-pipeline run.
+3. `bash provision_bench_board.sh <role> --check` must report no TODO.
+   After a reboot, the tractor's camera line reads TODO again until you stop
+   the camera.
+
+## 8. L072 radio firmware
+
+A new carrier's L072 normally runs Arduino's stock AT firmware.
+`LifeTrac-v25/tools/mlm32l07x01.bin` is that image (MKRWAN 1.2.3), kept for
+a factory restore. The same-named file in `x8_lora_bootloader_helper/` is a
+different build. The stock firmware does not answer the LifeTrac probes
+until you flash the LifeTrac build.
+
+1. **Build** in PowerShell, in `LifeTrac-v25/DESIGN-CONTROLLER/firmware/murata_l072`:
+   `mingw32-make bench` makes `build/firmware_bench_diag.bin`, md5
+   `0c1bb0a9573f813137f941dfa47177d0`. Use arm-none-eabi-gcc 12.2.1
+   (Arm GNU Toolchain 12.2.MPACBTI-Rel1); the toolchain and the expected md5
+   are in [`murata_l072/README.md`](../../murata_l072/README.md). The
+   committed `build/firmware.bin` (md5 `589c120323c2d5e7ef9f459d7a4ba42d`)
+   is the production image. Do not put it on a bench board: it refuses the
+   bench's diagnostic register writes.
+2. **Flash** with [`flash_l072.sh`](flash_l072.sh), which does
+   [FLASH_RUNBOOK.md](../FLASH_RUNBOOK.md) §1–§2 from the PC and reads
+   `bench.env`: without `--go` it stages and preflights, with `--go` it runs
+   `run_flash_bench.sh` (`REVIVE_MODE=reboot`). On a new carrier that still
+   runs the stock firmware, start with FLASH_RUNBOOK §5,
+   [First flash from a factory board](../FLASH_RUNBOOK.md#5-first-flash-from-a-factory-board):
+   a read-only `--go --verify-only` first contact against
+   `LifeTrac-v25/tools/mlm32l07x01.bin`, then the bench build. U-Boot arms
+   the X8 watchdog (60 s, then a PMIC power-cycle); the runbook says why the
+   scripts pet it and reboot. **Flashing turns the receiver on** (rule 3).
+3. **Health probe and park.** Stage the probe files to
+   `/tmp/lifetrac_strict` and run them in the probe image. The scripts in
+   [`legs/`](legs/README.md) automate this; by hand, for the tractor:
+
+   ```bash
+   export MSYS_NO_PATHCONV=1; S=<serial>; H=$(cygpath -m "$PWD/..")
+   adb -s $S shell "sudo -n systemctl stop lifetrac-camera.service; sudo -n docker stop tractor-camera; mkdir -p /tmp/lifetrac_strict"
+   for f in method_g_stage1_probe.py method_h_stage2_tx_probe_v2.py rs116_health_probe.py bench_tools/radio_park.py bench_tools/radio_state.py; do
+     adb -s $S push "$H/$f" /tmp/lifetrac_strict/ >/dev/null; done
+   R="sudo -n docker run --rm --network=host --entrypoint python3 --device=/dev/ttymxc3 -v /tmp/lifetrac_strict:/work -w /work -e PYTHONPATH=/work hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44"
+   adb -s $S shell "$R -u /work/rs116_health_probe.py"   # STATS-OK, RS115-INSTRUMENTED-FIRMWARE=YES, RS12-URC-COUNTERS=YES, radio_state=4
+   adb -s $S shell "$R -u /work/radio_park.py"           # PARK_OK {"opmode_readback": "0x80"}
+   adb -s $S shell "$R -u /work/radio_state.py"          # read-only; repeat a few minutes later
+   ```
+
+   Do the same on the base, over adb or ssh; it has no camera to stop.
+   `/tmp` is tmpfs: a reboot (and so every flash) wipes the staging, and
+   `systemd-tmpfiles` also ages it out after 5 days.
+
+## 9. Deploy
+
+[DEPLOY.md](DEPLOY.md) covers it:
+
+- **Base** (`deploy_base.sh`): it copies a `git archive` subset of a commit
+  to `/var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER`, builds `lifetrac-v25`
+  there, and starts the broker `design-controller-mosquitto-1` on
+  `127.0.0.1:1883`. It never starts `lora_bridge`.
+- **Tractor** (`build_tractor_image.sh`): it builds `lifetrac-tractor-x8`
+  natively on the base X8, then moves it with `docker save` and
+  `docker load`. The PC has no Docker.
+
+## 10. Staging and radio legs
+
+Continue with [BENCH_QUICKSTART.md](BENCH_QUICKSTART.md), which covers
+staging, a first leg and parking. The other leg docs are:
+
+- the parameterised leg scripts and the power-up guard: [`legs/README.md`](legs/README.md);
+- the per-session checklist: [BENCH_RUNBOOK.md](BENCH_RUNBOOK.md);
+- the RS-13 procedure: [RS13_VECTOR_LEG.md](RS13_VECTOR_LEG.md).
+
+## After every power-up
+
+[`legs/power_up_guard.sh`](legs/README.md) does the tractor and radio steps
+for you and stages the probe tools it needs; arm it with
+`--wait-power-cycle` before you switch the boards on. `legs/stage_boards.sh`
+does the full staging.
+
+- **Tractor:** stop `lifetrac-camera.service` and `tractor-camera`, then
+  check that `sudo -n fuser /dev/ttymxc3` prints nothing.
+- **Both:** `/tmp` staging is gone; stage again before any probe or flash.
+- **Radios:** read them with `radio_state.py`. If they must stay off and
+  the readback is not `0x80`, run `radio_park.py`.
+- **Base:** if it does not show up on USB, use ssh
+  (`provision_bench_board.sh base --ssh --check` works over ssh).
+
+## Troubleshooting
+
+| symptom | cause | fix |
+|---|---|---|
+| Docker images disappear about every minute on a 934 board | The compose-apps recovery unit deletes `/var/lib/docker` | `provision_bench_board.sh <role>` masks it |
+| A probe prints `timeout waiting for response` on the tractor | The camera unit or container holds `/dev/ttymxc3` | Rule 4 |
+| A flash stops with `PREFLIGHT-FAIL: missing or empty` or `PREFLIGHT-FAIL: CRLF line endings in:` (older wrappers: `1: image`, rc 127) | Staging that aged out of `/tmp` or was wiped by a reboot, or a script pushed with CRLF | Re-run `flash_l072.sh <board> <bin>` without `--go`: it re-stages LF-clean and repeats the preflight; `PREFLIGHT-OK` means the staging is complete ([FLASH_RUNBOOK.md](../FLASH_RUNBOOK.md) §1) |
+| `adb devices` is empty right after a first boot | adbd is fragile on first boot | Wait, then replug the USB-C; do not `adb kill-server` ([T0](../../../X8_HEALTH_AND_RECOVERY/recovery/T0_adb_daemon_kick.md)) |
+| `provision_bench_board.sh` stops at the sudoers step | Wrong `BENCH_SUDO_PW` | Fix it in `bench.env` |
+| `$'\r': command not found` when you start a kit script on the PC | git `core.autocrlf` checked the script out with CRLF | The repo's `.gitattributes` keeps `*.sh` LF. On an older checkout, run `git add --renormalize .` or `sed -i 's/\r$//' <script>` |
+| The board is unreachable or hung | — | [X8_HEALTH_AND_RECOVERY](../../../X8_HEALTH_AND_RECOVERY/README.md) recovery tiers T0–T4 |
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/DEPLOY.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/DEPLOY.md
new file mode 100644
index 00000000..3822bc0e
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/DEPLOY.md
@@ -0,0 +1,301 @@
+# Deploying code and images to the bench boards
+
+Two scripts in this folder put a commit's software on the bench X8 boards:
+
+| script | what it does | board(s) |
+|---|---|---|
+| [`deploy_base.sh`](deploy_base.sh) | copies the base-station tree of one commit to the base, builds `lifetrac-v25:latest` there, and (re)starts **only** the compose broker | base |
+| [`build_tractor_image.sh`](build_tractor_image.sh) | builds `lifetrac-tractor-x8` from one commit **on the base**, keeps a copy on the PC, and loads it on the offline tractor over adb | base (build), tractor (load) |
+
+Neither script touches the radios. Neither starts a radio daemon, and neither
+counts as a radio GO. See [Radio safety](#radio-safety).
+
+Both run from Git Bash on the bench PC (or any bash with `git`, `ssh`/`scp`
+and `adb`). Both accept `--dry-run`, which builds everything locally, prints
+the plan and contacts no board, and `--help`.
+
+Related: [BENCH_QUICKSTART.md](BENCH_QUICKSTART.md) (the order of everything),
+[BENCH_SETUP.md](BENCH_SETUP.md) (OS image and board provisioning, which comes
+**before** this page), [PC_SETUP.md](PC_SETUP.md),
+[BENCH_BOARDS.md](BENCH_BOARDS.md) (what is on each board now),
+[BENCH_RUNBOOK.md](BENCH_RUNBOOK.md), [legs/README.md](legs/README.md).
+
+## When to use them
+
+- **`deploy_base.sh`**
+  - after `main` (or the branch under test) changed anything the base runs:
+    `base_station/`, `firmware/common/`, `Dockerfile`, `docker-compose.yml`;
+  - after a base reflash and [provisioning](BENCH_SETUP.md), to install the
+    tree, the image and the broker for the first time;
+  - to roll the base back: deploy an older commit.
+
+  The bench radio daemons (for example `rx_smoke` on the base) run in
+  `lifetrac-v25:latest` but take their code from `/tmp/lifetrac_strict`,
+  staged by the leg scripts ([legs/README.md](legs/README.md)). So the image
+  supplies the Python dependencies, the staged tree supplies the code under
+  test, and the compose broker is the base's MQTT bus.
+- **`build_tractor_image.sh`**
+  - when `firmware/tractor_x8/` changed in a way a leg needs inside the image:
+    `requirements.txt`, the `Dockerfile`, or code that runs from the image and
+    not from the staged tree;
+  - after a tractor reflash (its images are gone and it cannot pull);
+  - with `--push-only <tarball>` to put an archived image back, for example a
+    rollback to the flown image.
+
+  This automates route (a) of [RS13_VECTOR_LEG.md](RS13_VECTOR_LEG.md) step 0.
+  Steps 2 and 3 of [README-DEPLOY.md](../../tractor_x8/README-DEPLOY.md) (the
+  production camera unit) are **not** part of the bench.
+
+## Settings
+
+Both scripts read `bench_tools/bench.env` when it exists (copy
+[`bench.env.example`](bench.env.example); `BENCH_ENV=<path>` points at another
+file). A non-empty variable already in the environment wins over
+`bench.env`, and `bench.env` wins over these defaults:
+
+| variable | default | used for |
+|---|---|---|
+| `BASE_TRANSPORT` | `bench.env.example` sets `adb`. Unset: `ssh` if `BASE_HOST` is set, else `adb` if `BASE_SERIAL` is set, else `ssh` | how to reach the base (`--ssh` / `--adb` override) |
+| `BASE_HOST` | `192.168.1.117` | the base's DHCP lease on the bench; check it after a router change |
+| `BASE_USER` / `TRACTOR_USER` | `fio` | login and file owner on the base / the tractor |
+| `BASE_SSH_KEY` | `~/.ssh/lifetrac_base_ed25519` | ssh/scp key (omitted if the file is missing) |
+| `BASE_SERIAL` | `2D0A1209DABC240B` | adb serial of the base |
+| `TRACTOR_SERIAL` | `2E2C1209DABC240B` | adb serial of the tractor (the tractor is adb-only) |
+| `BENCH_SUDO_PW` | `fio` (LmP factory default) | used only when the passwordless sudoers drop-in is missing |
+| `BASE_DEPLOY_DIR` | `/var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER` | the base tree (`/opt` is a symlink to `/var/rootdirs/opt` on LmP) |
+| `ARCHIVE_DIR` (old name `BENCH_ARCHIVE_DIR`, still read; set only one) | `$HOME/Documents/LifeTrac-bench-archive` | PC folder **outside git** (the same private archive the board captures use): `deploy/` keeps every deploy tarball, `images/` every tractor image. |
+
+`bench.env.example` sets `BASE_TRANSPORT=adb`, which radio legs need anyway:
+the harness drives both boards over adb. When the base is not on USB, set
+`BASE_TRANSPORT=ssh` in `bench.env` or pass `--ssh`. The original base, for
+example, did not enumerate on USB after the 2026-10-10 power cycle, while ssh
+kept working.
+
+## `deploy_base.sh [options] [<commit>]`
+
+```sh
+cd LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools
+bash deploy_base.sh --dry-run            # check the plan
+bash deploy_base.sh                      # deploy HEAD
+bash deploy_base.sh origin/main          # deploy another commit
+```
+
+Options: `--ssh | --adb`, `--unlocked`, `--no-build`, `--no-broker`,
+`--no-clean`, `--dry-run`.
+
+On the PC:
+1. `git -c core.autocrlf=false -c core.eol=lf archive` the commit's
+   `base_station/ firmware/ Dockerfile docker-compose*.yml deploy/` (the
+   Dockerfile COPYs `base_station/` and `firmware/`; compose needs the yml files
+   and `base_station/mosquitto.conf`). Docs, `bench-evidence/`, `hil/` and
+   `tools/` stay on the PC. The tarball (about 2 MB) is kept as
+   `$ARCHIVE_DIR/deploy/dc_deploy_<sha8>.tar.gz`.
+2. It refuses a tarball whose text files hold more CR bytes than the commit's
+   blobs (the [CRLF trap](#traps)).
+3. It writes the board-side script and `DEPLOYED_FROM_<sha8>.txt`, copies the
+   three files to `/home/fio/lifetrac_deploy/`, checks the md5, and runs the
+   script as root.
+
+On the base, the script runs as root and:
+1. **refuses** to run if `compose-apps-early-start-recovery.service` is not
+   masked, if a `lifetrac-base*` unit is active, if any running container maps
+   `/dev/ttymxc3`, or if the board looks like the tractor. It warns when a
+   `lifetrac-base*` unit is enabled.
+2. saves the old tree as `/home/fio/lifetrac_deploy/prev_tree_<oldsha>_<time>.tgz`,
+   deletes `base_station/ firmware/ deploy/` (skip with `--no-clean`; stale files
+   would otherwise end up in the image), and extracts the new tree.
+3. writes `DEPLOYED_FROM.txt`: the full SHA on line 1 (as before), then the
+   subject, time, paths, tarball md5, and after the build the image id.
+4. creates `.env` and `secrets/` **only when missing**: a 16-byte random fleet
+   key and a 6-digit random PIN, made on the board, mode 600, never printed.
+   Read the PIN on the base with `sudo cat <BASE_DEPLOY_DIR>/secrets/lifetrac_pin`.
+   An existing `.env` or `secrets/` is never changed.
+5. `docker build --build-arg LOCKED=1 -t lifetrac-v25:latest -t lifetrac-v25:<sha8> .`,
+   log in `/home/fio/docker_build_<sha8>.log`. The image it replaces is tagged
+   `lifetrac-v25:previous`. The image's `pip freeze` goes to
+   `/home/fio/pip_freeze_lifetrac-v25_<sha8>.txt`, and a dependency import
+   check runs in a container with `--network none`.
+6. `docker compose -p design-controller up -d --no-deps mosquitto` (with
+   `--force-recreate` when `mosquitto.conf` changed), then waits until an MQTT
+   CONNECT on `127.0.0.1:1883` is accepted, and names the container that
+   publishes the port (`design-controller-mosquitto-1`).
+
+The broker keeps its retained topics across a recreate (`persistence true`,
+volume `design-controller_mosquitto_data`). Deploying does not clear them: the
+leg prep's `clear_retained.py` does (BENCH_RUNBOOK prep 5).
+
+## `build_tractor_image.sh [options] [<commit>]`
+
+```sh
+bash build_tractor_image.sh --dry-run
+bash build_tractor_image.sh                       # build HEAD, archive, load on the tractor
+bash build_tractor_image.sh --no-tractor          # build + archive only
+bash build_tractor_image.sh --push-only ~/Documents/LifeTrac-bench-archive/images/lifetrac-tractor-x8_<sha8>.tar.gz
+```
+
+Options: `--ssh | --adb` (base transport), `--unlocked`, `--with-mosquitto`,
+`--no-tractor`, `--push-only FILE`, `--keep-tarball`, `--dry-run`.
+
+1. PC: `git archive` (LF forced) of `firmware/tractor_x8` alone. The
+   Dockerfile does `COPY . /app`, and the encoder's codec is an in-tree mirror,
+   so nothing else is needed.
+2. Base, as root, in `/home/fio/lifetrac_build/`:
+   `docker build --build-arg LOCKED=1 -t lifetrac-tractor-x8:<sha8> -t lifetrac-tractor-x8:latest .`
+   (log `/home/fio/docker_build_tractor_<sha8>.log`). Then a smoke test without
+   network or devices (`import numpy, cv2, x8_image_pipeline.encode_vector`),
+   `pip freeze`, and `docker save -o … && gzip`. With `--with-mosquitto`,
+   `eclipse-mosquitto:2` is saved too.
+3. PC: the tarball, md5, manifest, pip freeze, smoke output and build log go to
+   `$ARCHIVE_DIR/images/`. Once the md5 matches, the tarball is deleted
+   on the base; the image stays there.
+4. Tractor, over adb: push to `/home/fio/lifetrac_images/` (on disk; `/tmp` is a
+   RAM tmpfs), check the md5, then as root `docker load -i`. The image `:latest`
+   pointed at before is tagged `lifetrac-tractor-x8:previous`. The same smoke
+   test runs on the tractor, and the tarball is deleted (keep it with
+   `--keep-tarball`). It refuses a board that carries the base's deploy tree.
+
+The tractor also needs two images it cannot pull. Provisioning loads both
+([BENCH_SETUP.md](BENCH_SETUP.md) §6): `provision_bench_board.sh tractor`
+loads `hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44` from the
+repo-root `foundries_python.tar`, and `eclipse-mosquitto:2` with
+`--mosquitto-from-base` (or `--mosquitto-tar FILE`). This script never
+touches the probe image; `--with-mosquitto` here can reload mosquitto.
+
+## Lock files: the flown wheel versions
+
+`requirements.txt` on both sides holds floors only, so a fresh build resolves
+whatever is newest on PyPI that day. The two lock files record what the flown
+images actually run:
+
+| lock file | flown image | source of the list |
+|---|---|---|
+| [`base_station/requirements.lock.txt`](../../../base_station/requirements.lock.txt) | `lifetrac-v25` `4623980c2dac` (from `d3751286`, 2026-09-15) | its pip layer `9e3efb0b5438` was cached from the 2026-09-12 build; that build's log (`docker_build.log`) has the full list |
+| [`firmware/tractor_x8/requirements.lock.txt`](../../tractor_x8/requirements.lock.txt) | `lifetrac-tractor-x8` `2727dfd36f9f` (from `65869517`, 2026-09-26) | `rs13_build.log`, an uncached build of that image |
+
+Both logs are in
+[`bench-evidence/board_state_2026-10-04/base/files/home_fio/`](../../../bench-evidence/board_state_2026-10-04/base/files/home_fio/).
+The headers name the image ids, the python base image digests and the logs.
+
+Both Dockerfiles gained an optional `ARG LOCKED` (default `0`). With
+`--build-arg LOCKED=1` the lock file is applied as a pip **constraints** file on
+top of `requirements.txt`. A dependency added later still installs, unpinned,
+and a floor raised above a pin fails the build loudly; then refresh the lock
+or deploy with `--unlocked`. The default build is unchanged: plain
+`docker build` and `docker compose build` ignore the lock, and CI builds no
+image. Because the pip `RUN` line changed, the first build after this change
+re-runs pip once instead of using the cached layer. Unlocked, that resolves
+the newest wheels; locked, it reproduces the flown set. The scripts pass
+`LOCKED=1` unless `--unlocked` is given. A commit older than the lock files
+builds unlocked with a warning.
+
+`ARG PYTHON_IMAGE` (default: the old `FROM` tag) can pin the python base image
+by digest. The digests are in the lock headers. Debian packages are not pinned;
+the tractor log's versions are recorded in its lock header.
+
+To refresh a lock after a deliberate unlocked rebuild, use the `pip freeze`
+file the script saved and update the header.
+
+## What the scripts change
+
+| where | `deploy_base.sh` | `build_tractor_image.sh` |
+|---|---|---|
+| base | `BASE_DEPLOY_DIR` tree, `DEPLOYED_FROM.txt`, `.env` + `secrets/` if missing, `lifetrac-v25:latest/:<sha8>/:previous`, broker container, files in `/home/fio/lifetrac_deploy/`, `/home/fio/docker_build_<sha8>.log`, `/home/fio/pip_freeze_lifetrac-v25_<sha8>.txt` | `lifetrac-tractor-x8:<sha8>/:latest` (a build product; the base does not run it), `/home/fio/lifetrac_build/`, `/home/fio/docker_build_tractor_<sha8>.log` |
+| tractor | nothing | loaded image, `:latest`, `:previous`; `/home/fio/lifetrac_images/` while loading |
+| PC | `$ARCHIVE_DIR/deploy/` | `$ARCHIVE_DIR/images/`, `$ARCHIVE_DIR/build/` |
+| never | `/etc`, systemd units, the radios, the L072 firmware, `/tmp/lifetrac_strict`, any container other than the broker | `/etc`, systemd units, the radios, any running container |
+
+## Rollback
+
+- **Base tree:** deploy the older commit: `bash deploy_base.sh <old-sha>`. Or
+  restore the backup by hand:
+  ```sh
+  cd /var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER && sudo rm -rf base_station firmware deploy \
+    && sudo tar -xzf /home/fio/lifetrac_deploy/prev_tree_<oldsha>_<time>.tgz
+  ```
+
+  Keep the `cd` and the `rm` on one line joined by `&&`: if the `cd` fails,
+  the `rm` must not run in whatever directory you are in.
+- **Base image:** `docker tag lifetrac-v25:previous lifetrac-v25:latest`, or any
+  `lifetrac-v25:<sha8>`. The broker runs `eclipse-mosquitto:2`, so nothing
+  needs a restart; the next leg's daemon containers start from the new
+  `:latest`.
+- **Tractor image:** `docker tag lifetrac-tractor-x8:previous lifetrac-tractor-x8:latest`
+  on the tractor, or `bash build_tractor_image.sh --push-only <archived tarball>`.
+  The flown RS-13 image `2727dfd36f9f` is also tagged `:rs13-65869517` on the
+  tractor, and the older `:pre-rs13` (`9bfbbc8d06cb`) is still there. The first
+  run of this script makes `:previous` = `2727dfd36f9f`.
+- **Housekeeping:** remove old builds with `docker image rm lifetrac-v25:<sha8>`
+  or `docker image prune` (dangling images only). **Never `docker image prune -a`
+  or `docker system prune -a` on the tractor**: it deletes every image no
+  container uses, including the Arduino OOTB images and `pre-rs13`, which the
+  offline tractor cannot pull again.
+
+## Traps
+
+- **CRLF.** With Git for Windows' default `core.autocrlf=true`, `git archive`
+  writes CRLF. For `base_station/` plus the Dockerfile that came to 47,419 CR
+  bytes in the tarball against 0 in the commit, and every shell script and
+  config on the board breaks. Both scripts pass `-c core.autocrlf=false -c core.eol=lf` and
+  compare CR counts with the commit's blobs. The board-side scripts they
+  generate are stripped of CR. For any file you push by hand, use
+  `git archive` the same way or `sed -i 's/\r$//'` (`git diff` shows nothing,
+  because the index is LF). The repo's `.gitattributes` keeps scripts LF in the
+  working tree.
+- **sudo eats stdin.** `git archive … | ssh base "echo pw | sudo -S tar -x"`
+  fails with "This does not look like a tar archive": `sudo -S` reads the same
+  stdin as tar. Copy the file first, then `tar -xzf FILE` or `docker load -i FILE`.
+  The scripts do exactly that. They use `sudo -n` (the bench drop-in
+  `99-lifetrac-bench-nopasswd`); the password fallback feeds only sudo.
+- **The recovery unit wipes Docker.** On the LmP 934 image
+  `compose-apps-early-start-recovery.service` runs
+  `systemctl stop docker; rm -rf /var/lib/docker` every 60 s unless it is
+  masked. Both scripts refuse to run while it is unmasked; masking is part of
+  [provisioning](BENCH_SETUP.md).
+- **`docker compose up -d` with no service name** on the base starts
+  `lora_bridge` on `/dev/ttymxc3`. Always name `mosquitto`.
+- **A moved `:latest` does not restart anything.** A container already running
+  the old image keeps it until it is recreated.
+- **`/tmp` is a RAM tmpfs** on both boards, aged at 5 days and emptied at
+  reboot. Large files go to `/home/fio`.
+- **adb from Git Bash** needs `MSYS_NO_PATHCONV=1` for board paths and a
+  Windows path for the local file. The scripts set both per call. `adb shell`
+  does not return the remote exit status on every adbd, so the scripts read a
+  status marker instead.
+
+## Radio safety
+
+- Deploying never touches the radios. The scripts open no serial port, flash
+  nothing, start no radio daemon and restart no container except the base
+  broker. The L072s stay in whatever state they are in. After a power-up that
+  is RXCONT, receive only; parking them is the job of the power-up guard
+  ([legs/README.md](legs/README.md)), not of a deploy. A deploy is not a radio
+  GO.
+- **Never start `lora_bridge`** on the bench. `docker-compose.yml` maps
+  `${LIFETRAC_LORA_DEVICE}`, which the bench `.env` sets to `/dev/ttymxc3`,
+  the L072 radio UART. `lora_bridge` would open it and drive the radio with
+  the old framing, which the Method-G firmware does not speak.
+  `deploy_base.sh` starts only `mosquitto`, with `--no-deps`. It refuses to run
+  while any container maps `/dev/ttymxc3` (a leg in progress) and warns if one
+  appears afterwards.
+- **The base's `lifetrac-base.service` and `lifetrac-base-compose.service` must
+  stay disabled.** On the bench base both are currently **enabled but failing
+  at every boot** (capture
+  [`board_state_2026-10-04/base/10_systemd.txt`](../../../bench-evidence/board_state_2026-10-04/base/10_systemd.txt)).
+  `lifetrac-base.service` runs `docker compose up -d --build --remove-orphans`,
+  which starts `lora_bridge` on `/dev/ttymxc3` and rebuilds the image on the boot
+  path. `lifetrac-base-compose.service` brings up the video-test stack, whose
+  `image_rx` maps `/dev/ttymxc3`. If either ever succeeded, a radio daemon would
+  start at boot without a GO. **Recommendation:** disable both, after the
+  operator agrees (an open item in [BENCH_BOARDS.md](BENCH_BOARDS.md)):
+  ```sh
+  sudo systemctl disable lifetrac-base.service lifetrac-base-compose.service
+  ```
+  `deploy_base.sh` warns while they are enabled and refuses to run if either is
+  active. It never installs, enables or starts them, and the bench kit does not
+  install the unit files in `deploy/`.
+- On the tractor, `lifetrac-camera.service` (started by udev at boot) runs
+  `lifetrac-tractor-x8:latest` with `/dev/ttymxc3` mapped as its M7 port. Loading
+  a new `:latest` does not start it. The next time it starts, it runs the new
+  image, on the radio UART as before. The bench stops it before any radio
+  work: BENCH_RUNBOOK prep 3, `systemctl stop lifetrac-camera.service;
+  docker stop tractor-camera`.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/PC_SETUP.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/PC_SETUP.md
new file mode 100644
index 00000000..73df96ef
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/PC_SETUP.md
@@ -0,0 +1,231 @@
+# Bench PC setup (Windows 11)
+
+One Windows 11 PC drives the bench. Use **Git Bash** for the board scripts
+(`*.sh`, adb, ssh) and **PowerShell** for the radio harness and
+`mingw32-make`. The versions below are the ones that produced the RS-12 and
+RS-13 evidence. Where a version is marked exact, a different one gives
+different bytes. The PC needs no Docker, because images are built on the base
+X8 ([DEPLOY.md](DEPLOY.md)). Next step: [BENCH_QUICKSTART.md](BENCH_QUICKSTART.md).
+
+| tool | bench PC version | needed for |
+|---|---|---|
+| Git for Windows (Git Bash) | 2.52 | checkout, board scripts |
+| Python with the `py` launcher | 3.14 (CI: 3.11) | harness helpers, analysis tools, tests |
+| Arm GNU Toolchain | **12.2.MPACBTI-Rel1, exact** | byte-identical L072 builds |
+| WinLibs `mingw32-make` | GNU Make 4.4.1 | L072 build (PowerShell only) |
+| Android platform-tools (`adb`) | current | tractor access, programming |
+| `uuu` | 1.5.243 | OS reflash only |
+| arduino-cli + `arduino:mbed_portenta` | 1.4.1 + **4.5.0** | optional: X8 H7/M4 sketches |
+| SEGGER J-Link Software | current | optional: last-resort L072 recovery |
+| Firefox | current | the moving scene for camera legs |
+
+## Git for Windows
+
+```bash
+winget install Git.Git
+git clone -c core.longpaths=true https://github.com/OpenSourceEcology/LifeTrac.git
+```
+
+- **Long paths.** Some `bench-evidence/` paths are longer than Windows' 260
+  characters, and the checkout fails on them without `core.longpaths`. For an
+  existing clone, run `git config core.longpaths true`.
+- **Line endings.** Git for Windows defaults to `core.autocrlf=true`. The
+  repo's [`.gitattributes`](../../../../../.gitattributes) keeps board-side
+  files (shell scripts, openocd `.cfg`, ...) LF in the working tree, because
+  a CRLF script breaks on the board: you get `1: image` from the flash
+  wrapper, or `/tmp/lifetrac_p0c\r/...`. Files checked out before
+  `.gitattributes` landed stay CRLF until git rewrites them, so still strip
+  `\r` when you push ([FLASH_RUNBOOK.md](../FLASH_RUNBOOK.md) §1).
+- **ssh** ships with Git for Windows. Create the bench key once, then install
+  its public half on the base as [BENCH_SETUP.md](BENCH_SETUP.md) says. Keep
+  the private key in a password manager, never in git.
+
+  ```bash
+  ssh-keygen -t ed25519 -f ~/.ssh/lifetrac_base_ed25519 -C lifetrac-bench-pc
+  ```
+
+## PowerShell execution policy
+
+The harness (`run_live_radio_monitor.ps1`), `legs/youtube_window.ps1` and the
+leg wrappers that `legs/leg_prep.sh` writes (`leg<X>_harness.ps1`) are
+PowerShell scripts. On a fresh Windows 11 PC, Windows PowerShell 5.1's
+effective policy is usually `Restricted`, and every one of them stops with
+"running scripts is disabled on this system". Check it with
+`Get-ExecutionPolicy -List`. Then pick one of these:
+
+- **Once per Windows user (recommended).** In PowerShell:
+
+  ```powershell
+  Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
+  ```
+
+  `RemoteSigned` runs local scripts and asks for a signature only on files
+  marked as downloaded from the internet. A `git clone` and the wrappers
+  `leg_prep.sh` writes carry no such mark, so the kit runs as is.
+- **Only for one PowerShell window.** Nothing persists after you close it:
+
+  ```powershell
+  Set-ExecutionPolicy -Scope Process Bypass
+  ```
+
+- **Only for one script.** Start it through a new PowerShell process:
+
+  ```powershell
+  powershell -NoProfile -ExecutionPolicy Bypass -File .\run_live_radio_monitor.ps1 <arguments>
+  ```
+
+  `legs/scene_check.sh` already calls `youtube_window.ps1` this way.
+
+If `Get-ExecutionPolicy -List` shows `MachinePolicy` or `UserPolicy` set, a
+group policy decides and the commands above cannot override it; ask whoever
+manages the PC.
+
+## Python
+
+Install Python 3.11 or newer from python.org; it comes with the `py`
+launcher. Every command in the kit uses `py -3`. From the repo root:
+
+```bash
+py -3 -m pip install -r LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/requirements-pc.txt
+py -3 -m pip install -r LifeTrac-v25/DESIGN-CONTROLLER/base_station/requirements-dev.txt
+```
+
+- [`requirements-pc.txt`](requirements-pc.txt) holds what the harness and the
+  PC-side bench tools import, including the amqtt broker.
+- `requirements-dev.txt` holds the test suite and the base-station modules
+  that the analysis tools load (`tools/vector_dry_run.py replay`,
+  `tools/rs12_leg_report.py`).
+
+The harness starts a PC MQTT broker (`start_mqtt_broker.py` at the repo root,
+amqtt, listening on `0.0.0.0:1883`) when nothing answers on `-HostIp`:1883.
+
+- Check that the harness finds your Python. Older copies hardcoded the
+  original bench PC's `python.exe` path.
+- The base's rx daemon uses this broker as its control broker, so allow
+  inbound TCP 1883 when Windows Defender Firewall asks, on **Private**
+  networks only.
+- Retained control topics live on this broker as well as on the base's.
+  Clear both between campaigns with `clear_retained_host.py`
+  ([BENCH_RUNBOOK.md](BENCH_RUNBOOK.md)).
+
+### Run the test suite locally
+
+```bash
+cd LifeTrac-v25/DESIGN-CONTROLLER/base_station
+LIFETRAC_FLEET_KEY_HEX=0102030405060708090a0b0c0d0e0f10 py -3 -m pytest tests -q
+```
+
+In PowerShell: `$env:LIFETRAC_FLEET_KEY_HEX = "0102030405060708090a0b0c0d0e0f10"; py -3 -m pytest tests -q`.
+
+That key is the dummy key CI uses. Real fleet keys (the PC's gitignored
+`key.h`, the base's `secrets/`) never go in git.
+
+## Arm GNU Toolchain 12.2.MPACBTI-Rel1 (exact)
+
+1. Download it from developer.arm.com: *Arm GNU Toolchain Downloads*, release
+   **12.2.MPACBTI-Rel1**. Take the Windows (mingw-w64-i686) host,
+   AArch32 bare-metal (`arm-none-eabi`) installer,
+   `arm-gnu-toolchain-12.2.mpacbti-rel1-mingw-w64-i686-arm-none-eabi.exe`.
+2. Install it and tick *Add path to environment variable*. It installs to
+   `C:\Program Files (x86)\Arm GNU Toolchain arm-none-eabi\12.2 mpacbti-rel1\bin`.
+3. Check it:
+
+   ```
+   arm-none-eabi-gcc --version
+   arm-none-eabi-gcc.exe (Arm GNU Toolchain 12.2.MPACBTI-Rel1 (Build arm-12-mpacbti.34)) 12.2.1 20230214
+   ```
+
+Only this toolchain rebuilds the bench image `0c1bb0a9` and the production
+image `589c1203` byte for byte. Any other GCC, including CI's Ubuntu
+`gcc-arm-none-eabi`, builds working firmware with different bytes. Expected
+md5s and the build steps are in
+[murata_l072/README.md](../../murata_l072/README.md).
+
+## WinLibs `mingw32-make` (PowerShell only)
+
+```powershell
+winget install BrechtSanders.WinLibs.POSIX.UCRT
+```
+
+This provides `mingw32-make.exe` (GNU Make 4.4.1 on the bench) and the host
+`gcc` that `mingw32-make check` needs. If `mingw32-make` is not on PATH after
+the install, it is in
+`%LOCALAPPDATA%\Microsoft\WinGet\Packages\BrechtSanders.WinLibs.POSIX.UCRT_Microsoft.Winget.Source_8wekyb3d8bbwe\mingw64\bin`.
+
+Run it from **PowerShell**. It fails on this bench when run from Git Bash.
+
+## Android platform-tools (adb)
+
+```powershell
+winget install Google.PlatformTools
+```
+
+The harness finds `adb` on PATH. From Git Bash, set `MSYS_NO_PATHCONV=1` and
+give local files as Windows-style paths. Otherwise MSYS rewrites `/tmp/...`
+arguments into Windows paths:
+
+```bash
+export MSYS_NO_PATHCONV=1
+adb -s <serial> push C:/path/to/file.py /tmp/lifetrac_strict/
+```
+
+Plug each board straight into a PC port, not a hub. Do not reach for
+`adb kill-server` while boards are enumerating: it has dropped boards that
+then did not come back ([ADB_TIPS_AND_TRICKS.md](../../../X8_HEALTH_AND_RECOVERY/recovery/ADB_TIPS_AND_TRICKS.md)).
+
+## uuu 1.5.243 (OS reflash only)
+
+You need `uuu` only to reflash an X8's eMMC over SDP
+([T3a](../../../X8_HEALTH_AND_RECOVERY/recovery/T3a_sdp_uuu_reflash.md);
+[BENCH_SETUP.md](BENCH_SETUP.md) pins the image).
+
+- Download **uuu 1.5.243** from NXP's mfgtools releases
+  (`github.com/nxp-imx/mfgtools/releases`, tag `uuu_1.5.243`) and check its
+  sha256 against the one in T3a ("`uuu` version: 1.5.243").
+- **Do not use the `uuu.exe` inside the LmP bundle's
+  `mfgtool-files-portenta-x8/`.** That one is 1.5.109, and it was unstable on
+  Windows 11 with this image (T3a). Both bench reflashes ran 1.5.243.
+- SDP needs the USB-C cable **and** 12 V on the carrier, plus a direct USB
+  port (no hub).
+
+## Optional
+
+- **arduino-cli** (1.4.1 on the bench) with
+  `arduino-cli core install arduino:mbed_portenta@4.5.0`. You need it only
+  for the X8's H7/M4 sketches, not for radio legs. A sketch upload to the M7
+  overwrites the stock x8h7 bridge ([BENCH_BOARDS.md](BENCH_BOARDS.md)).
+- **SEGGER J-Link Software.** Use it only for last-resort L072 recovery over
+  SWD when the ROM-bootloader flash path fails. The carrier's L072 SWD header
+  CN2 is not populated by default
+  ([BRINGUP_MAX_CARRIER.md](../../murata_l072/BRINGUP_MAX_CARRIER.md) §2).
+  Do not accept J-Link OB firmware-update prompts.
+
+## Firefox (camera legs)
+
+Camera legs need moving content on the screen the camera watches. Set it up
+like this:
+
+1. Open a **normal** window of a separate profile:
+   `firefox --no-remote -profile <dir>`.
+2. Put a `user.js` in that profile with
+   `user_pref("media.autoplay.default", 0);` and
+   `user_pref("media.volume_scale", "0.0");`.
+3. Open the railroad video by its watch URL.
+4. Switch to the player's own fullscreen (`f`). Esc leaves it.
+
+**Never use `firefox --kiosk`**, or anything else fully fullscreen that the
+operator cannot leave: a kiosk locked the operator out of the PC for a whole
+round. The window helper and the scene check are in
+[legs/README.md](legs/README.md); the procedure is
+[RS13_VECTOR_LEG.md](RS13_VECTOR_LEG.md), "Scene".
+
+## Check
+
+```powershell
+git config core.longpaths          # true
+py -3 --version                    # 3.11 or newer
+arm-none-eabi-gcc --version        # ... 12.2.MPACBTI-Rel1 ... 12.2.1 20230214
+mingw32-make --version             # GNU Make 4.4.x
+adb version
+Get-ExecutionPolicy                # RemoteSigned (or Bypass in this window), not Restricted
+```
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/RS13_VECTOR_LEG.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/RS13_VECTOR_LEG.md
index 4b37a596..c1fc781d 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/RS13_VECTOR_LEG.md
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/RS13_VECTOR_LEG.md
@@ -14,6 +14,7 @@ started from [RS13_RESULTS_TEMPLATE.md](RS13_RESULTS_TEMPLATE.md). The RS-13.1
 session scripts that did each step below are kept in
 [`bench-evidence/RS_13_vector_scene_2026-09-26/scripts/`](../../../bench-evidence/RS_13_vector_scene_2026-09-26/scripts/)
 (they carry that session's paths).*
+Parameterised copies that run from any checkout (settings in `bench.env`) are in [`legs/`](legs/README.md).
 
 **No firmware change.** VECTOR rides the strict image path as ordinary
 one-fragment 0xFE trains (a 0xFD copies train only if `LIFETRAC_KEYFRAME_COPIES`
@@ -472,25 +473,35 @@ as in the RS-3.3 legs.
 **Pin the DTS carrier on every profile-2 leg.** Before the first DTS leg of the
 day, run a receive-only channel spot-check with the tractor parked
 ([`channel_survey_sniff.py`](../channel_survey_sniff.py) or
-[`hunt_sniff.ps1`](../hunt_sniff.ps1), then `tools/survey_compare.py`). Add
-`-ForceFrfHz <the pick>` to every 2a/2c/2d line below, and record the pick in
-RESULTS. Without it, `-ForceFrfHz 0` pins the profile-2 default of
-915.000 MHz. That is the channel of the RS-11.6 external emitter (about 25 ms
+[`hunt_sniff.ps1`](../hunt_sniff.ps1), then `tools/survey_compare.py`). Every
+2a/2c/2d line below carries `-ForceFrfHz <the pick>`; put the pick in
+`bench.env` as `DTS_CARRIER_HZ` / `DTS_CARRIER_DATE`, and record it in
+RESULTS. Without the pin, profile 2 flies on its default carrier,
+915.000 MHz (`-ForceFrfHz 0`). That is the channel of the RS-11.6 external emitter (about 25 ms
 bursts at −43 to −45 dBm on a hard 7.07–7.09 s grid). All nine RS-13.1 DTS legs
 flew there, and their losses fold on its period (RESULTS A19). The RS-12 legs
 used `-ForceFrfHz 927500000` after a same-day spot-check; the band changes
 from day to day, so re-check rather than reuse a pick.
 
+The harness now refuses a profile-2 line without `-ForceFrfHz` (bench kit
+2026-10-10; `-AllowDefaultCarrier` is only for a deliberate 915 MHz control).
+The `<...>` values come from `bench.env`: without
+`-TxAdbSerial` / `-RxAdbSerial` / `-HostIp` the harness falls back to the
+original bench's serials and PC address. [`legs/leg_prep.sh`](legs/README.md)
+writes the complete line for each leg, with these values filled in, as a
+wrapper you run in PowerShell; prefer it to typing the lines below.
+
 - **2a — DTS (profile 2), VECTOR at boot:**
 
   ```powershell
-  .\run_live_radio_monitor.ps1 -TxFeed camera -RegProfile 2 -DurationS 300 -SynthFps 2 `
+  .\run_live_radio_monitor.ps1 -TxAdbSerial <TRACTOR_SERIAL> -RxAdbSerial <BASE_SERIAL> -HostIp <PC_HOST> `
+     -TxFeed camera -RegProfile 2 -ForceFrfHz <the pick> -DurationS 300 -SynthFps 2 `
      -KfRequestDisable 1 -ProbeEcho 0 -LogFragArrivals 1 -TxBatch 0 `
      -CamExtraEnv "-e LIFETRAC_ENCODE_MODE=9 -e LIFETRAC_VECTOR_DETAIL=80" -Archive
   ```
 
-- **2b — FHSS (profile 1), VECTOR at boot:** the same with `-RegProfile 1`;
-  base capture with `--profile image_bw250`. At `-SynthFps 1` expect the first
+- **2b — FHSS (profile 1), VECTOR at boot:** the same with `-RegProfile 1`
+  and no `-ForceFrfHz`; base capture with `--profile image_bw250`. At `-SynthFps 1` expect the first
   frame at the base near seq 58 (A7) and no time authority on the tractor
   (A11, `tx_stream_streak_max` < 8): read P2/P3 from lock and record the
   streak; no base commands on this leg. Its base capture takes
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/bench.env.example b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/bench.env.example
new file mode 100644
index 00000000..031c452a
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/bench.env.example
@@ -0,0 +1,116 @@
+# bench.env.example -- settings for every bench script: legs/ (through
+# lib/bench_env.sh) and provision_bench_board.sh, flash_l072.sh, deploy_base.sh,
+# build_tractor_image.sh, pull_board_state.sh.
+#
+#   cp bench.env.example bench.env     # then edit bench.env; it is gitignored
+#
+# All of them load bench.env with the same loader (lib/env_file.sh), with the
+# same rules:
+#   * BENCH_ENV=<path> (or BENCH_ENV_FILE=<path>) picks another file;
+#   * a NON-EMPTY variable already set in the caller's environment wins over the
+#     file, so a one-off override is `TRACTOR_SERIAL=... bash flash_l072.sh ...`
+#     or `TRACTOR_SERIAL=... bash legs/leg_prep.sh ...`;
+#   * an empty value means "use the computed default" (next to each variable).
+# Without bench.env the legs/ scripts fall back to THIS file and the setup
+# scripts to their built-in defaults; both print a WARN, and both mean the
+# original OSE bench's serials and addresses. Create bench.env first.
+# Show what the scripts will use: bash -c '. lib/bench_env.sh && bench_show_env'
+#
+# Bash syntax: VAR=value, no spaces around '='. Quote values with spaces. CRLF
+# line endings are tolerated (the loader strips them).
+# The defaults below describe the OSE bench of 2026 (BENCH_BOARDS.md); a new
+# bench changes at least the two serials and the base address.
+
+# --- boards -----------------------------------------------------------------
+# adb serials (`adb devices`). The base talks to the PC over ethernet as well.
+BASE_SERIAL=2D0A1209DABC240B
+TRACTOR_SERIAL=2E2C1209DABC240B
+
+# How the scripts reach the base: adb (USB) or ssh (ethernet). The tractor is
+# adb only (its WiFi is off by policy). Note: run_live_radio_monitor.ps1 itself
+# drives both boards over adb, so radio legs need the base on adb too; ssh
+# is enough for staging, the power-up guard and the radio-state check.
+# flash_l072.sh does not use it: it always flashes the base over ssh.
+BASE_TRANSPORT=adb
+# Base address and ssh login, used when BASE_TRANSPORT=ssh (and by flash_l072.sh).
+BASE_HOST=192.168.1.117
+BASE_SSH_USER=fio
+# (BASE_USER is the old name. When both are set at the same level, file or
+# environment, BASE_SSH_USER wins; an environment BASE_USER still beats the file.)
+# Private key for the base (BENCH_SETUP.md). Empty = $HOME/.ssh/lifetrac_base_ed25519
+BASE_SSH_KEY=
+
+# sudo password of the `fio` user on both boards. The Arduino default is `fio`;
+# BENCH_SETUP.md installs a NOPASSWD sudoers drop-in, after which it is unused.
+# Must not contain a single quote.
+BENCH_SUDO_PW=fio
+
+# --- PC ---------------------------------------------------------------------
+# REQUIRED for radio legs: this PC's LAN IPv4 address as the boards see it,
+# passed to the harness as -HostIp (the base rx daemon's control-plane MQTT
+# host). The harness's built-in default is the original bench PC's lease, which
+# gives a dead control plane anywhere else. Empty = leg_prep.sh looks up this
+# PC's IPv4 addresses and uses the only one on BASE_HOST's /24 (or the only one
+# at all), prints it, and refuses when that is ambiguous. Set it to be sure.
+PC_HOST=
+
+# Scratch space for transcripts and LF-clean copies. Empty = <user temp>/lifetrac-bench
+BENCH_SCRATCH=
+
+# Where leg evidence files go (the `legs/` folder of a bench-evidence session).
+# Empty = <repo>/LifeTrac-v25/DESIGN-CONTROLLER/bench-evidence/RS_13_vector_scene_<UTC date>/legs
+# Set it explicitly for a session that crosses midnight UTC.
+EVIDENCE_DIR=
+
+# Private archive OUTSIDE git (board captures, docker image exports).
+# Empty = $HOME/Documents/LifeTrac-bench-archive
+ARCHIVE_DIR=
+
+# --- radio ------------------------------------------------------------------
+# Carrier for every DTS (profile 2) leg, in Hz, picked from a receive-only
+# channel spot-check made the SAME DAY with the tractor parked
+# (channel_survey_sniff.py or hunt_sniff.ps1, then tools/survey_compare.py;
+# RS13_VECTOR_LEG.md "Pin the DTS carrier"). Must lie in 902250000..927750000.
+# EMPTY = leg_prep.sh refuses profile-2 legs. 915000000 is refused too: it is
+# the channel of the known RS-11.6 external emitter (set DTS_ALLOW_915=1 to
+# fly there on purpose).
+DTS_CARRIER_HZ=
+# Date of that spot-check (YYYY-MM-DD, local). When set, leg_prep.sh refuses a
+# DTS leg on any other day; when empty it only warns.
+DTS_CARRIER_DATE=
+
+# --- scene (camera legs) ----------------------------------------------------
+# Moving content for camera legs: the railroad reference video used since RS-12.
+# Use the watch URL; the youtube-nocookie embed fails with Error 153.
+YOUTUBE_URL=https://www.youtube.com/watch?v=B1yUQwpNhJA
+# Separate Firefox profile for the bench window. Empty = $BENCH_SCRATCH/ff_bench_youtube
+FIREFOX_PROFILE_DIR=
+# firefox.exe. Empty = look in Program Files, then PATH.
+FIREFOX_EXE=
+
+# --- container images on the boards ------------------------------------------
+# Base daemon image, built on the base from the deployed tree (DEPLOY.md).
+BASE_IMAGE=lifetrac-v25:latest
+# Tractor probe/daemon image (= the repo-root foundries_python.tar, docker load -i).
+TRACTOR_PROBE_IMAGE=hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44
+# Tractor camera image (ffmpeg, numpy, OpenCV), built from firmware/tractor_x8.
+TRACTOR_APP_IMAGE=lifetrac-tractor-x8:latest
+# The base's MQTT broker container (eclipse-mosquitto:2 on 127.0.0.1:1883).
+BASE_BROKER_CONTAINER=design-controller-mosquitto-1
+
+# --- OPTIONAL OVERRIDES (defaults shown; leave commented unless needed) -------
+# ADB=adb                                   adb executable for provision_bench_board.sh and
+#                                           flash_l072.sh (the other scripts run adb from PATH)
+# BASE_DEPLOY_DIR=/var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER   deploy_base.sh target on the base
+# BASE_WORK=/home/fio/lifetrac_build         build_tractor_image.sh work dir on the base
+#                                           (default /home/<BASE_SSH_USER>/lifetrac_build)
+# TRACTOR_USER=fio                           build_tractor_image.sh: the tractor's login user
+# TRACTOR_WORK=/home/fio/lifetrac_images     build_tractor_image.sh work dir on the tractor
+#                                           (default /home/<TRACTOR_USER>/lifetrac_images;
+#                                           both work dirs must end in a lifetrac* directory)
+# BOARD_HOME=/home/fio                       flash_l072.sh: where flash logs live on the boards
+# REVIVE_MODE=reboot                         flash_l072.sh: reboot or full (full refused on 6.x kernels)
+# BENCH_ARCHIVE_DIR                          old name for ARCHIVE_DIR (ARCHIVE_DIR wins)
+# DTS_ALLOW_915=0                            1 = let leg scripts run profile 2 on 915.000 MHz (RS-11.6 emitter; don't)
+# Fixed, NOT settable: the board staging dirs /tmp/lifetrac_strict and /tmp/lifetrac_p0c
+# (run_live_radio_monitor.ps1 hardcodes them).
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/build_tractor_image.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/build_tractor_image.sh
new file mode 100755
index 00000000..8c729178
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/build_tractor_image.sh
@@ -0,0 +1,447 @@
+#!/usr/bin/env bash
+# build_tractor_image.sh -- build the tractor's camera/encoder image
+# (lifetrac-tractor-x8) from one commit, natively on the bench BASE X8, keep a
+# copy on the PC, and load it on the offline TRACTOR over adb.
+#
+# Why the base: the image is linux/arm64, the bench PC has no Docker, and the
+# tractor has no network (WiFi off), so it cannot pip-install the numpy/OpenCV
+# wheels itself. The base X8 is aarch64 and online.
+#
+# Usage (Git Bash on the bench PC, or any bash with git + ssh/scp or adb):
+#   bash build_tractor_image.sh [options] [<commit>]    # <commit> defaults to HEAD
+#   bash build_tractor_image.sh --push-only <image.tar.gz>
+#
+# Options:
+#   --ssh | --adb      transport to the BASE (same rule as deploy_base.sh). The
+#                      tractor is always reached over adb (TRACTOR_SERIAL).
+#   --unlocked         build without firmware/tractor_x8/requirements.lock.txt
+#                      (pip resolves requirements.txt unpinned). Default:
+#                      --build-arg LOCKED=1, the flown wheel versions.
+#   --with-mosquitto   also export eclipse-mosquitto:2 from the base and load it
+#                      on the tractor (the tractor cannot pull it).
+#   --no-tractor       build and archive on the PC only; leave the tractor alone.
+#   --push-only FILE   skip the build: load an archived image tarball (docker
+#                      save, .tar or .tar.gz) on the tractor, for example to roll
+#                      back to a flown image from the PC archive.
+#   --keep-tarball     keep the tarball on the tractor after loading
+#                      (default: removed once docker load succeeded).
+#   --dry-run          make the build context and the board-side scripts
+#                      locally, print the plan and stop. Never contacts a board.
+#   -h | --help
+#
+# Settings: bench_tools/bench.env ($BENCH_ENV), loaded by lib/env_file.sh like
+# every bench script (CRLF tolerated; a NON-EMPTY variable already in the
+# environment wins over the file), then the same defaults as deploy_base.sh
+# (BASE_TRANSPORT, BASE_HOST, BASE_SSH_USER, BASE_SSH_KEY, BASE_SERIAL,
+# TRACTOR_SERIAL, BENCH_SUDO_PW, ARCHIVE_DIR). Also:
+#   TRACTOR_USER  fio
+#   BASE_WORK     /home/<BASE_SSH_USER>/lifetrac_build    work dir on the base
+#   TRACTOR_WORK  /home/<TRACTOR_USER>/lifetrac_images    work dir on the tractor
+#                 (both: an absolute path whose last part starts with "lifetrac",
+#                 because the board scripts chown -R / clean inside it)
+# Image tarballs land in $ARCHIVE_DIR/images (default
+# $HOME/Documents/LifeTrac-bench-archive/images), which must be outside git.
+#
+# What it changes:
+#   base:    $BASE_WORK = /home/<user>/lifetrac_build/ (context + tarball, the tarball is
+#            removed once the PC copy is verified), image tags
+#            lifetrac-tractor-x8:<sha> and :latest, log
+#            /home/<user>/docker_build_tractor_<sha>.log.
+#   PC:      lifetrac-tractor-x8_<sha>.tar.gz + .manifest.txt + .pip-freeze.txt
+#            + build log in the images folder.
+#   tractor: $TRACTOR_WORK = /home/<user>/lifetrac_images/ (temporary), the loaded image, its
+#            :latest tag, and lifetrac-tractor-x8:previous = the image :latest
+#            pointed at before.
+#
+# RADIO SAFETY: nothing here opens /dev/ttymxc3 or restarts a container. The
+# smoke tests run the image with --network none and no devices. A container
+# already running the old image (for example tractor-camera, started by
+# lifetrac-camera.service at boot) keeps running it until it is recreated;
+# that unit maps /dev/ttymxc3, and the bench stops it before any radio work
+# (BENCH_RUNBOOK prep 3). See DEPLOY.md.
+set -euo pipefail
+
+BT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+DC_REL=LifeTrac-v25/DESIGN-CONTROLLER
+CTX_REL=$DC_REL/firmware/tractor_x8
+IMAGE=lifetrac-tractor-x8
+
+# ---------------------------------------------------------------- settings --
+BENCH_ENV=${BENCH_ENV:-${BENCH_ENV_FILE:-$BT/bench.env}}
+# shellcheck source=lib/env_file.sh
+. "$BT/lib/env_file.sh"
+if [ -f "$BENCH_ENV" ]; then
+    # CR stripped; the environment wins; nothing is exported (the password stays
+    # out of every child process's environment)
+    bench_load_env_file "$BENCH_ENV" || exit 2
+else
+    echo "build_tractor_image: WARN: no $BENCH_ENV -- the original bench's address and serials apply unless set in the environment (cp bench.env.example bench.env)" >&2
+fi
+
+COMMIT=HEAD
+OPT_TRANSPORT=""
+LOCKED=1
+WITH_MQ=0
+DO_TRACTOR=1
+PUSH_ONLY=""
+KEEP=0
+DRY_RUN=0
+
+usage() { sed -n '2,/^set -euo/p' "${BASH_SOURCE[0]}" | sed '$d; s/^# \{0,1\}//'; }
+
+while [ $# -gt 0 ]; do
+    case $1 in
+        --ssh) OPT_TRANSPORT=ssh ;;
+        --adb) OPT_TRANSPORT=adb ;;
+        --unlocked) LOCKED=0 ;;
+        --with-mosquitto) WITH_MQ=1 ;;
+        --no-tractor) DO_TRACTOR=0 ;;
+        --push-only) [ $# -ge 2 ] || { echo "--push-only needs a file" >&2; exit 2; }; PUSH_ONLY=$2; shift ;;
+        --keep-tarball) KEEP=1 ;;
+        --dry-run) DRY_RUN=1 ;;
+        -h|--help) usage; exit 0 ;;
+        -*) echo "build_tractor_image: unknown option $1 (see --help)" >&2; exit 2 ;;
+        *) COMMIT=$1 ;;
+    esac
+    shift
+done
+
+if [ -n "$OPT_TRANSPORT" ]; then
+    BASE_TRANSPORT=$OPT_TRANSPORT
+elif [ -z "${BASE_TRANSPORT:-}" ]; then
+    if [ -n "${BASE_HOST:-}" ]; then BASE_TRANSPORT=ssh
+    elif [ -n "${BASE_SERIAL:-}" ]; then BASE_TRANSPORT=adb
+    else BASE_TRANSPORT=ssh
+    fi
+fi
+case $BASE_TRANSPORT in ssh|adb) ;; *) echo "build_tractor_image: BASE_TRANSPORT must be ssh or adb" >&2; exit 2 ;; esac
+BASE_HOST=${BASE_HOST:-192.168.1.117}
+BASE_USER=${BASE_SSH_USER:-${BASE_USER:-fio}}
+BASE_SSH_KEY=${BASE_SSH_KEY:-$HOME/.ssh/lifetrac_base_ed25519}
+BASE_SERIAL=${BASE_SERIAL:-2D0A1209DABC240B}
+TRACTOR_SERIAL=${TRACTOR_SERIAL:-2E2C1209DABC240B}
+TRACTOR_USER=${TRACTOR_USER:-fio}
+BENCH_SUDO_PW=${BENCH_SUDO_PW-fio}
+BENCH_ARCHIVE_DIR=${ARCHIVE_DIR:-${BENCH_ARCHIVE_DIR:-$HOME/Documents/LifeTrac-bench-archive}}
+BASE_WORK=${BASE_WORK:-/home/$BASE_USER/lifetrac_build}
+TRACTOR_WORK=${TRACTOR_WORK:-/home/$TRACTOR_USER/lifetrac_images}   # on disk: /tmp is a RAM tmpfs aged at 5 d
+# The board-side scripts run `chown -R` on these as root: allow only a dedicated
+# directory (absolute, no '..', no blanks or quotes, last part lifetrac*).
+for _wd in "BASE_WORK=$BASE_WORK" "TRACTOR_WORK=$TRACTOR_WORK"; do
+    _wv=${_wd#*=}
+    case $_wv in
+        /*/*) ;;
+        *) echo "build_tractor_image: ${_wd%%=*} must be an absolute path below / (got '$_wv')" >&2; exit 2 ;;
+    esac
+    case $_wv in
+        *..*|*[[:space:]\'\"\\]*) echo "build_tractor_image: ${_wd%%=*} must not contain '..', blanks, quotes or backslashes (got '$_wv')" >&2; exit 2 ;;
+    esac
+    case ${_wv##*/} in
+        lifetrac*) ;;
+        *) echo "build_tractor_image: ${_wd%%=*}='$_wv' must end in a directory named lifetrac* (it is chown -R'd as root)" >&2; exit 2 ;;
+    esac
+done
+unset _wd _wv
+
+# ----------------------------------------------------------------- helpers --
+say() { printf '[build_tractor_image %s] %s\n' "$(date -u +%H:%M:%SZ)" "$*"; }
+die() { printf '[build_tractor_image] ERROR: %s\n' "$*" >&2; exit 1; }
+sq() { local s=${1//\'/\'\\\'\'}; printf "'%s'" "$s"; }
+winpath() { if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else printf '%s' "$1"; fi; }
+# tar and scp read "C:/..." as host "C"; Git Bash paths must look like /c/...
+unixpath() { if command -v cygpath >/dev/null 2>&1; then cygpath -u "$1"; else printf '%s' "$1"; fi; }
+md5_local() { if command -v md5sum >/dev/null 2>&1; then md5sum "$1" | cut -d' ' -f1; else md5 -q "$1"; fi; }
+BENCH_ARCHIVE_DIR=$(unixpath "$BENCH_ARCHIVE_DIR")
+BASE_SSH_KEY=$(unixpath "$BASE_SSH_KEY")
+[ -z "$PUSH_ONLY" ] || PUSH_ONLY=$(unixpath "$PUSH_ONLY")
+
+SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=15)
+[ -f "$BASE_SSH_KEY" ] && SSH_OPTS=(-i "$BASE_SSH_KEY" "${SSH_OPTS[@]}")
+
+adb_sh() {    # adb_sh <serial> <command line>; returns the remote exit code
+    local serial=$1 cmd=$2 line rc=""
+    while IFS= read -r line || [ -n "$line" ]; do
+        line=${line%$'\r'}
+        case $line in
+            *__LT_RC=*) rc=${line##*__LT_RC=}; line=${line%__LT_RC=*}; [ -z "$line" ] || printf '%s\n' "$line" ;;
+            *) printf '%s\n' "$line" ;;
+        esac
+    done < <(MSYS_NO_PATHCONV=1 adb -s "$serial" shell "$cmd"'; echo "__LT_RC=$?"' < /dev/null 2>&1)
+    [ -n "$rc" ] || { echo "adb shell on $serial returned no status (device gone?)" >&2; return 255; }
+    return "$rc"
+}
+root_cmd() {  # wrap a command line (that reads no stdin) to run as root
+    local pw; pw=$(sq "$BENCH_SUDO_PW")
+    printf '%s' "if sudo -n true 2>/dev/null; then sudo -n $1; elif [ -n $pw ]; then printf '%s\n' $pw | sudo -S -p '' $1; else echo 'sudo needs a password: install the bench sudoers drop-in (BENCH_SETUP.md) or set BENCH_SUDO_PW' >&2; false; fi"
+}
+
+b_sh() {
+    if [ "$BASE_TRANSPORT" = ssh ]; then
+        ssh -n "${SSH_OPTS[@]}" "$BASE_USER@$BASE_HOST" "$1"
+    else
+        adb_sh "$BASE_SERIAL" "$1"
+    fi
+}
+b_put() {     # b_put <local file> <remote dir>
+    if [ "$BASE_TRANSPORT" = ssh ]; then
+        scp -q "${SSH_OPTS[@]}" "$1" "$BASE_USER@$BASE_HOST:$2/"
+    else
+        MSYS_NO_PATHCONV=1 adb -s "$BASE_SERIAL" push "$(winpath "$1")" "$2/" > /dev/null
+    fi
+}
+b_get() {     # b_get <remote file> <local dir>
+    if [ "$BASE_TRANSPORT" = ssh ]; then
+        scp -q "${SSH_OPTS[@]}" "$BASE_USER@$BASE_HOST:$1" "$2/"
+    else
+        MSYS_NO_PATHCONV=1 adb -s "$BASE_SERIAL" pull "$1" "$(winpath "$2")/" > /dev/null
+    fi
+}
+t_sh() { adb_sh "$TRACTOR_SERIAL" "$1"; }
+t_put() { MSYS_NO_PATHCONV=1 adb -s "$TRACTOR_SERIAL" push "$(winpath "$1")" "$2/" > /dev/null; }
+
+case $(cd "$BENCH_ARCHIVE_DIR" 2>/dev/null && pwd -P || echo "$BENCH_ARCHIVE_DIR")/ in
+    "$(cd "$(git -C "$BT" rev-parse --show-toplevel)" && pwd -P)"/*) die "BENCH_ARCHIVE_DIR must be outside the git repo" ;;
+esac
+IMG_DIR=$BENCH_ARCHIVE_DIR/images
+STAGE=$BENCH_ARCHIVE_DIR/build
+mkdir -p "$IMG_DIR" "$STAGE"
+
+# ------------------------------------------------- board-side scripts (sh) --
+# Both run as root. Values arrive as arguments; the quoted heredocs are verbatim.
+BUILD_SCRIPT=$STAGE/build_tractor_remote.sh
+cat > "$BUILD_SCRIPT" <<'REMOTE'
+#!/bin/sh
+# Board side of build_tractor_image.sh: build on the BASE X8 (aarch64), as root.
+set -eu
+CTX=$1 SHORT=$2 SHA=$3 LOCKED=$4 WITH_MQ=$5 WORK=$6 OWNER=$7
+IMAGE=lifetrac-tractor-x8
+say() { echo "[base $(date -u +%H:%M:%SZ)] $*"; }
+die() { echo "[base] ERROR: $*" >&2; exit 1; }
+
+command -v docker >/dev/null 2>&1 || die "docker not found"
+st=$(systemctl is-enabled compose-apps-early-start-recovery.service 2>/dev/null || true)
+case $st in
+    masked*|"") ;;
+    *) die "compose-apps-early-start-recovery.service is '$st', not masked: it wipes /var/lib/docker every 60 s on the LmP 934 image (BENCH_SETUP.md)." ;;
+esac
+free_kb=$(df -Pk "$WORK" | awk 'NR==2 {print $4}')
+[ "$free_kb" -gt 3000000 ] || die "less than 3 GB free under $WORK"
+
+dir=$WORK/tractor_x8_$SHORT
+rm -rf "$dir"
+mkdir -p "$dir"
+tar -xzf "$CTX" -C "$dir"
+cd "$dir"
+build_args=""
+locked_eff=0
+if [ "$LOCKED" = 1 ]; then
+    if [ -f requirements.lock.txt ] && grep -q '^ARG LOCKED' Dockerfile; then
+        build_args="--build-arg LOCKED=1"
+        locked_eff=1
+    else
+        say "WARNING: $SHORT has no lock-file support; building unlocked"
+    fi
+fi
+log=/home/$OWNER/docker_build_tractor_$SHORT.log
+say "docker build -t $IMAGE:$SHORT -t $IMAGE:latest $build_args . (log $log)"
+# shellcheck disable=SC2086
+if ! docker build $build_args --label "org.lifetrac.source_sha=$SHA" \
+        -t "$IMAGE:$SHORT" -t "$IMAGE:latest" . > "$log" 2>&1; then
+    tail -n 40 "$log"
+    die "docker build failed (full log: $log)"
+fi
+cp "$log" "$WORK/"
+id=$(docker image inspect -f '{{.Id}}' "$IMAGE:$SHORT")
+say "built $id (locked=$locked_eff)"
+
+# Smoke test without network or devices: the VECTOR encoder needs numpy + cv2.
+docker run --rm --network none --entrypoint python3 "$IMAGE:$SHORT" -c \
+    "import numpy, cv2; import x8_image_pipeline.encode_vector as e; print('numpy', numpy.__version__, 'cv2', cv2.__version__, 'encoder', e.VectorEncoder.__name__)" \
+    > "$WORK/${IMAGE}_$SHORT.smoke.txt" 2>&1 || { cat "$WORK/${IMAGE}_$SHORT.smoke.txt"; die "smoke test failed"; }
+cat "$WORK/${IMAGE}_$SHORT.smoke.txt"
+docker run --rm --network none --entrypoint python3 "$IMAGE:$SHORT" -m pip freeze \
+    > "$WORK/${IMAGE}_$SHORT.pip-freeze.txt" 2>&1 || say "WARNING: pip freeze failed"
+
+# docker save to a file, then gzip: no pipe, so a failure cannot hide.
+rm -f "$WORK/${IMAGE}_$SHORT.tar" "$WORK/${IMAGE}_$SHORT.tar.gz"
+docker save -o "$WORK/${IMAGE}_$SHORT.tar" "$IMAGE:$SHORT" "$IMAGE:latest"
+gzip -f "$WORK/${IMAGE}_$SHORT.tar"
+md5sum "$WORK/${IMAGE}_$SHORT.tar.gz" | cut -d' ' -f1 > "$WORK/${IMAGE}_$SHORT.tar.gz.md5"
+{
+    echo "image=$IMAGE:$SHORT $id"
+    echo "source_sha=$SHA"
+    echo "build_locked=$locked_eff"
+    echo "built_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ) on $(uname -n)"
+    echo "build_log=docker_build_tractor_$SHORT.log"
+    echo "tarball_md5=$(cat "$WORK/${IMAGE}_$SHORT.tar.gz.md5")"
+} > "$WORK/${IMAGE}_$SHORT.manifest.txt"
+
+if [ "$WITH_MQ" = 1 ]; then
+    docker image inspect eclipse-mosquitto:2 > /dev/null 2>&1 || docker pull eclipse-mosquitto:2
+    rm -f "$WORK/eclipse-mosquitto_2.tar" "$WORK/eclipse-mosquitto_2.tar.gz"
+    docker save -o "$WORK/eclipse-mosquitto_2.tar" eclipse-mosquitto:2
+    gzip -f "$WORK/eclipse-mosquitto_2.tar"
+    md5sum "$WORK/eclipse-mosquitto_2.tar.gz" | cut -d' ' -f1 > "$WORK/eclipse-mosquitto_2.tar.gz.md5"
+    echo "eclipse-mosquitto:2 $(docker image inspect -f '{{.Id}}' eclipse-mosquitto:2)" >> "$WORK/${IMAGE}_$SHORT.manifest.txt"
+fi
+rm -rf "$dir"
+chown -R "$OWNER:$OWNER" "$WORK" "$log"
+say "saved $WORK/${IMAGE}_$SHORT.tar.gz ($(wc -c < "$WORK/${IMAGE}_$SHORT.tar.gz") B)"
+REMOTE
+
+LOAD_SCRIPT=$STAGE/load_tractor_remote.sh
+cat > "$LOAD_SCRIPT" <<'REMOTE'
+#!/bin/sh
+# Board side of build_tractor_image.sh: docker load on the TRACTOR, as root.
+# Loads images only. It starts, stops and recreates no container.
+set -eu
+TGZ=$1 KEEP=$2 MQ_TGZ=$3
+IMAGE=lifetrac-tractor-x8
+say() { echo "[tractor $(date -u +%H:%M:%SZ)] $*"; }
+die() { echo "[tractor] ERROR: $*" >&2; exit 1; }
+
+command -v docker >/dev/null 2>&1 || die "docker not found"
+if [ -f /var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER/DEPLOYED_FROM.txt ]; then
+    die "this board carries the base deploy tree: it looks like the BASE, not the tractor"
+fi
+[ -f "$TGZ" ] || die "missing $TGZ"
+free_kb=$(df -Pk /var/lib/docker 2>/dev/null | awk 'NR==2 {print $4}')
+[ -z "$free_kb" ] || [ "$free_kb" -gt 2000000 ] || die "less than 2 GB free for /var/lib/docker"
+
+old=$(docker image inspect -f '{{.Id}}' "$IMAGE:latest" 2>/dev/null || true)
+# -i, never stdin: `sudo -S` would eat a piped tarball.
+docker load -i "$TGZ"
+new=$(docker image inspect -f '{{.Id}}' "$IMAGE:latest" 2>/dev/null || true)
+[ -n "$new" ] || die "no $IMAGE:latest after the load"
+if [ -n "$old" ] && [ "$old" != "$new" ]; then
+    docker tag "$old" "$IMAGE:previous"
+    say "$IMAGE:previous = the old :latest ($(echo "$old" | cut -c8-19)); roll back with: docker tag $IMAGE:previous $IMAGE:latest"
+elif [ "$old" = "$new" ]; then
+    say "$IMAGE:latest did not change (same image, or the tarball carries no :latest tag); :previous untouched"
+fi
+docker images "$IMAGE"
+docker run --rm --network none --entrypoint python3 "$IMAGE:latest" -c \
+    "import numpy, cv2; import x8_image_pipeline.encode_vector as e; print('numpy', numpy.__version__, 'cv2', cv2.__version__, 'encoder', e.VectorEncoder.__name__)" \
+    || die "smoke test of $IMAGE:latest failed on the tractor"
+if [ -n "$MQ_TGZ" ]; then
+    [ -f "$MQ_TGZ" ] || die "missing $MQ_TGZ"
+    docker load -i "$MQ_TGZ"
+fi
+running=$(docker ps --filter "ancestor=$IMAGE" --format '{{.Names}} ({{.Image}})' | tr '\n' ' ' | sed 's/ *$//')
+[ -z "$running" ] || say "NOTE: running now, not restarted, still on the image they started with: $running"
+if [ "$KEEP" != 1 ]; then
+    rm -f "$TGZ"
+    [ -z "$MQ_TGZ" ] || rm -f "$MQ_TGZ"
+fi
+say "done"
+REMOTE
+
+for f in "$BUILD_SCRIPT" "$LOAD_SCRIPT"; do
+    tr -d '\r' < "$f" > "$f.tmp" && mv "$f.tmp" "$f"
+    sh -n "$f" || die "generated board script $f has a syntax error"
+done
+
+# ------------------------------------------------- local: the build context --
+if [ -z "$PUSH_ONLY" ]; then
+    REPO=$(git -C "$BT" rev-parse --show-toplevel)
+    SHA=$(git -C "$REPO" rev-parse --verify --quiet "${COMMIT}^{commit}") || die "not a commit: $COMMIT"
+    SHORT=${SHA:0:8}
+    SUBJECT=$(git -C "$REPO" log -1 --format=%s "$SHA")
+    git -C "$REPO" cat-file -e "$SHA:$CTX_REL/Dockerfile" 2>/dev/null || die "$SHORT has no $CTX_REL/Dockerfile"
+    HAS_LOCK=0
+    git -C "$REPO" cat-file -e "$SHA:$CTX_REL/requirements.lock.txt" 2>/dev/null && HAS_LOCK=1
+    CTX=$STAGE/tractor_x8_ctx_$SHORT.tar.gz
+    # The Dockerfile does `COPY . /app`: the context is firmware/tractor_x8 alone
+    # (its VS1 codec is an in-tree mirror; it imports nothing from base_station).
+    # LF forced: see the CRLF trap in DEPLOY.md.
+    git -C "$REPO" -c core.autocrlf=false -c core.eol=lf archive --format=tar.gz -o "$CTX" "$SHA:$CTX_REL"
+    TEXT_RE='(\.(sh|py|yml|conf|cfg|service|txt)|Dockerfile)$'
+    CR_TAR=$(set +o pipefail; { tar -xzOf "$CTX" --wildcards '*.sh' '*.py' '*.yml' '*.conf' '*.cfg' \
+        '*.service' '*.txt' '*Dockerfile' 2>/dev/null || true; } | tr -cd '\r' | wc -c)
+    CR_GIT=$(set +o pipefail; tar -tzf "$CTX" | grep -E "$TEXT_RE" | sed "s|^|$SHA:$CTX_REL/|" \
+        | git -C "$REPO" cat-file --batch | tr -cd '\r' | wc -c)
+    [ "${CR_TAR// /}" -le "${CR_GIT// /}" ] \
+        || die "the context tarball has CRLF the commit does not have; check .gitattributes / core.eol (DEPLOY.md)"
+    CTX_MD5=$(md5_local "$CTX")
+    TGZ_NAME=${IMAGE}_$SHORT.tar.gz
+    say "commit   $SHA ($SUBJECT)"
+    say "context  $CTX ($(wc -c < "$CTX") B, md5 $CTX_MD5)"
+    if [ "$BASE_TRANSPORT" = ssh ]; then say "base     $BASE_USER@$BASE_HOST (ssh), work dir $BASE_WORK"; else say "base     adb $BASE_SERIAL, work dir $BASE_WORK"; fi
+    say "build    $IMAGE:$SHORT + :latest, locked=$LOCKED (commit has lock file: $HAS_LOCK), mosquitto export=$WITH_MQ"
+    say "PC copy  $IMG_DIR/$TGZ_NAME"
+else
+    [ -f "$PUSH_ONLY" ] || die "no such file: $PUSH_ONLY"
+    TGZ_NAME=$(basename "$PUSH_ONLY")
+    say "push-only: $PUSH_ONLY (md5 $(md5_local "$PUSH_ONLY"))"
+fi
+say "tractor  $([ "$DO_TRACTOR" = 1 ] && echo "adb $TRACTOR_SERIAL, docker load from $TRACTOR_WORK" || echo untouched)"
+
+if [ "$DRY_RUN" = 1 ]; then
+    say "dry run: board scripts $BUILD_SCRIPT and $LOAD_SCRIPT; nothing was sent"
+    exit 0
+fi
+if [ "$DO_TRACTOR" = 1 ] && [ "$TRACTOR_SERIAL" = "$BASE_SERIAL" ] && [ "$BASE_TRANSPORT" = adb ]; then
+    die "TRACTOR_SERIAL equals BASE_SERIAL"
+fi
+
+# ------------------------------------------------- build on the base, fetch --
+if [ -z "$PUSH_ONLY" ]; then
+    b_sh "true" > /dev/null || die "cannot reach the base"
+    b_sh "mkdir -p $(sq "$BASE_WORK")"
+    b_put "$CTX" "$BASE_WORK" || die "copy of the context failed"
+    b_put "$BUILD_SCRIPT" "$BASE_WORK" || die "copy of the build script failed"
+    remote_md5=$(b_sh "md5sum $(sq "$BASE_WORK/$(basename "$CTX")")" | tr -d '\r' | cut -d' ' -f1)
+    [ "$remote_md5" = "$CTX_MD5" ] || die "context md5 mismatch on the base"
+    say "building on the base (several minutes when the pip layer is not cached)"
+    b_sh "$(root_cmd "sh $(sq "$BASE_WORK/build_tractor_remote.sh") $(sq "$BASE_WORK/$(basename "$CTX")") $SHORT $SHA $LOCKED $WITH_MQ $(sq "$BASE_WORK") $(sq "$BASE_USER")")" \
+        || die "build on the base failed (see above)"
+
+    say "fetching the image to $IMG_DIR"
+    for f in "$TGZ_NAME" "$TGZ_NAME.md5" "${IMAGE}_$SHORT.manifest.txt" "${IMAGE}_$SHORT.pip-freeze.txt" \
+             "${IMAGE}_$SHORT.smoke.txt" "docker_build_tractor_$SHORT.log"; do
+        b_get "$BASE_WORK/$f" "$IMG_DIR" || die "fetch failed: $f"
+    done
+    want=$(tr -d '\r\n ' < "$IMG_DIR/$TGZ_NAME.md5")
+    got=$(md5_local "$IMG_DIR/$TGZ_NAME")
+    [ "$got" = "$want" ] || die "image tarball md5 mismatch after the fetch ($got vs $want)"
+    if [ "$WITH_MQ" = 1 ]; then
+        b_get "$BASE_WORK/eclipse-mosquitto_2.tar.gz" "$IMG_DIR" || die "fetch failed: eclipse-mosquitto_2.tar.gz"
+        b_get "$BASE_WORK/eclipse-mosquitto_2.tar.gz.md5" "$IMG_DIR" || die "fetch failed: eclipse-mosquitto_2.tar.gz.md5"
+        [ "$(md5_local "$IMG_DIR/eclipse-mosquitto_2.tar.gz")" = "$(tr -d '\r\n ' < "$IMG_DIR/eclipse-mosquitto_2.tar.gz.md5")" ] \
+            || die "eclipse-mosquitto_2.tar.gz md5 mismatch after the fetch"
+    fi
+    {
+        echo "subject=$SUBJECT"
+        echo "context_md5=$CTX_MD5"
+        echo "tool=bench_tools/build_tractor_image.sh"
+    } >> "$IMG_DIR/${IMAGE}_$SHORT.manifest.txt"
+    # The PC copy is verified: drop the big tarballs on the base (the image stays there).
+    b_sh "rm -f $(sq "$BASE_WORK/$TGZ_NAME") $(sq "$BASE_WORK/eclipse-mosquitto_2.tar.gz")" || true
+    say "PC copy verified (md5 $got)"
+    TGZ_LOCAL=$IMG_DIR/$TGZ_NAME
+else
+    TGZ_LOCAL=$PUSH_ONLY
+fi
+
+# ------------------------------------------------------- load on the tractor --
+if [ "$DO_TRACTOR" != 1 ]; then
+    say "done; tractor untouched (--no-tractor). Load later with: bash build_tractor_image.sh --push-only $TGZ_LOCAL"
+    exit 0
+fi
+state=$(MSYS_NO_PATHCONV=1 adb -s "$TRACTOR_SERIAL" get-state 2>/dev/null | tr -d '\r' || true)
+[ "$state" = device ] || die "tractor $TRACTOR_SERIAL is not on adb (state '${state:-none}')"
+t_sh "mkdir -p $(sq "$TRACTOR_WORK")"
+say "pushing $TGZ_NAME to the tractor"
+t_put "$TGZ_LOCAL" "$TRACTOR_WORK" || die "push to the tractor failed"
+want=$(md5_local "$TGZ_LOCAL")
+got=$(t_sh "md5sum $(sq "$TRACTOR_WORK/$TGZ_NAME")" | tr -d '\r' | cut -d' ' -f1)
+[ "$got" = "$want" ] || die "md5 mismatch on the tractor ($got vs $want)"
+MQ_REMOTE=""
+if [ "$WITH_MQ" = 1 ] && [ -f "$IMG_DIR/eclipse-mosquitto_2.tar.gz" ]; then
+    t_put "$IMG_DIR/eclipse-mosquitto_2.tar.gz" "$TRACTOR_WORK" || die "push of eclipse-mosquitto failed"
+    MQ_REMOTE=$TRACTOR_WORK/eclipse-mosquitto_2.tar.gz
+fi
+t_put "$LOAD_SCRIPT" "$TRACTOR_WORK" || die "push of the load script failed"
+t_sh "$(root_cmd "sh $(sq "$TRACTOR_WORK/load_tractor_remote.sh") $(sq "$TRACTOR_WORK/$TGZ_NAME") $KEEP $(sq "$MQ_REMOTE")")" \
+    || die "docker load on the tractor failed (see above)"
+say "tractor loaded $TGZ_NAME. No container was restarted and the radios were not touched."
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/deploy_base.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/deploy_base.sh
new file mode 100755
index 00000000..b74c78f3
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/deploy_base.sh
@@ -0,0 +1,465 @@
+#!/usr/bin/env bash
+# deploy_base.sh -- deploy one commit's base-station tree to the bench BASE X8,
+# build lifetrac-v25:latest there, and (re)start ONLY the compose broker.
+#
+# Usage (Git Bash on the bench PC, or any bash with git + ssh/scp or adb):
+#   bash deploy_base.sh [options] [<commit>]        # <commit> defaults to HEAD
+#
+# Options:
+#   --ssh | --adb   transport to the base. Default: BASE_TRANSPORT from bench.env;
+#                   else ssh when BASE_HOST is set; else adb when BASE_SERIAL is
+#                   set; else ssh to 192.168.1.117.
+#   --unlocked      build without base_station/requirements.lock.txt (pip
+#                   resolves requirements.txt unpinned, as a plain build does).
+#                   Default: --build-arg LOCKED=1, the flown wheel versions.
+#   --no-build      deploy the tree only and keep the current image.
+#   --no-broker     do not touch the broker container.
+#   --no-clean      extract over the old tree. Default: base_station/, firmware/
+#                   and deploy/ are replaced, after a backup tarball of the old
+#                   tree is saved on the base.
+#   --dry-run       make the tarball and the board-side script locally, print the
+#                   plan and stop. Never contacts a board.
+#   -h | --help
+#
+# Settings: bench_tools/bench.env ($BENCH_ENV; see bench.env.example), loaded by
+# lib/env_file.sh like every bench script -- CRLF is tolerated and a NON-EMPTY
+# variable already in the environment wins over the file -- then the defaults
+# below for anything still unset:
+#   BASE_TRANSPORT  ssh | adb
+#   BASE_HOST       192.168.1.117 (the bench base's DHCP lease)
+#   BASE_SSH_USER   fio (old name BASE_USER)
+#   BASE_SSH_KEY    ~/.ssh/lifetrac_base_ed25519
+#   BASE_SERIAL     2D0A1209DABC240B (adb serial of the bench base)
+#   TRACTOR_SERIAL  2E2C1209DABC240B (only used to refuse deploying to the tractor)
+#   BENCH_SUDO_PW   fio, the LmP factory default; only used when passwordless
+#                   sudo is not installed on the base
+#   BASE_DEPLOY_DIR /var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER (= /opt/lifetrac/...)
+#   ARCHIVE_DIR     $HOME/Documents/LifeTrac-bench-archive (old name
+#                   BENCH_ARCHIVE_DIR; outside git; the deploy tarballs are kept
+#                   in its deploy/ folder)
+#
+# What it changes on the base: the tree in BASE_DEPLOY_DIR (backup first),
+# DEPLOYED_FROM.txt, .env and secrets/ ONLY when missing (random PIN and fleet
+# key, generated on the board, never printed), the lifetrac-v25:latest /
+# :<sha> / :previous image tags, and the compose broker container. Files go to
+# /home/<user>/lifetrac_deploy/ and the build log to
+# /home/<user>/docker_build_<sha>.log.
+#
+# RADIO SAFETY: nothing here opens /dev/ttymxc3 (the L072 radio UART) or starts
+# a radio daemon. The board-side script refuses to run while a container maps
+# /dev/ttymxc3 or a lifetrac-base* unit is active, and it never starts
+# lora_bridge (see the comment at the broker step). See DEPLOY.md.
+set -euo pipefail
+
+BT=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+DC_REL=LifeTrac-v25/DESIGN-CONTROLLER
+
+# ---------------------------------------------------------------- settings --
+BENCH_ENV=${BENCH_ENV:-${BENCH_ENV_FILE:-$BT/bench.env}}
+# shellcheck source=lib/env_file.sh
+. "$BT/lib/env_file.sh"
+if [ -f "$BENCH_ENV" ]; then
+    # CR stripped; the environment wins; nothing is exported (the password stays
+    # out of every child process's environment)
+    bench_load_env_file "$BENCH_ENV" || exit 2
+else
+    echo "deploy_base: WARN: no $BENCH_ENV -- the original bench's address and serials apply unless set in the environment (cp bench.env.example bench.env)" >&2
+fi
+
+COMMIT=HEAD
+OPT_TRANSPORT=""
+LOCKED=1
+DO_BUILD=1
+DO_BROKER=1
+DO_CLEAN=1
+DRY_RUN=0
+
+usage() { sed -n '2,/^set -euo/p' "${BASH_SOURCE[0]}" | sed '$d; s/^# \{0,1\}//'; }
+
+while [ $# -gt 0 ]; do
+    case $1 in
+        --ssh) OPT_TRANSPORT=ssh ;;
+        --adb) OPT_TRANSPORT=adb ;;
+        --unlocked) LOCKED=0 ;;
+        --no-build) DO_BUILD=0 ;;
+        --no-broker) DO_BROKER=0 ;;
+        --no-clean) DO_CLEAN=0 ;;
+        --dry-run) DRY_RUN=1 ;;
+        -h|--help) usage; exit 0 ;;
+        -*) echo "deploy_base: unknown option $1 (see --help)" >&2; exit 2 ;;
+        *) COMMIT=$1 ;;
+    esac
+    shift
+done
+
+if [ -n "$OPT_TRANSPORT" ]; then
+    BASE_TRANSPORT=$OPT_TRANSPORT
+elif [ -z "${BASE_TRANSPORT:-}" ]; then
+    if [ -n "${BASE_HOST:-}" ]; then BASE_TRANSPORT=ssh
+    elif [ -n "${BASE_SERIAL:-}" ]; then BASE_TRANSPORT=adb
+    else BASE_TRANSPORT=ssh
+    fi
+fi
+case $BASE_TRANSPORT in ssh|adb) ;; *) echo "deploy_base: BASE_TRANSPORT must be ssh or adb" >&2; exit 2 ;; esac
+BASE_HOST=${BASE_HOST:-192.168.1.117}
+BASE_USER=${BASE_SSH_USER:-${BASE_USER:-fio}}
+BASE_SSH_KEY=${BASE_SSH_KEY:-$HOME/.ssh/lifetrac_base_ed25519}
+BASE_SERIAL=${BASE_SERIAL:-2D0A1209DABC240B}
+TRACTOR_SERIAL=${TRACTOR_SERIAL:-2E2C1209DABC240B}
+BENCH_SUDO_PW=${BENCH_SUDO_PW-fio}
+BASE_DEPLOY_DIR=${BASE_DEPLOY_DIR:-/var/rootdirs/opt/lifetrac/DESIGN-CONTROLLER}
+BENCH_ARCHIVE_DIR=${ARCHIVE_DIR:-${BENCH_ARCHIVE_DIR:-$HOME/Documents/LifeTrac-bench-archive}}
+COMPOSE_PROJECT=design-controller   # the running broker is design-controller-mosquitto-1
+REMOTE_WORK=/home/$BASE_USER/lifetrac_deploy
+
+# ----------------------------------------------------------------- helpers --
+say() { printf '[deploy_base %s] %s\n' "$(date -u +%H:%M:%SZ)" "$*"; }
+die() { printf '[deploy_base] ERROR: %s\n' "$*" >&2; exit 1; }
+sq() { local s=${1//\'/\'\\\'\'}; printf "'%s'" "$s"; }          # shell-quote for the remote sh
+winpath() { if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else printf '%s' "$1"; fi; }
+# tar and scp read "C:/..." as host "C"; Git Bash paths must look like /c/...
+unixpath() { if command -v cygpath >/dev/null 2>&1; then cygpath -u "$1"; else printf '%s' "$1"; fi; }
+md5_local() { if command -v md5sum >/dev/null 2>&1; then md5sum "$1" | cut -d' ' -f1; else md5 -q "$1"; fi; }
+BENCH_ARCHIVE_DIR=$(unixpath "$BENCH_ARCHIVE_DIR")
+BASE_SSH_KEY=$(unixpath "$BASE_SSH_KEY")
+
+SSH_OPTS=(-o BatchMode=yes -o ConnectTimeout=10 -o StrictHostKeyChecking=accept-new -o ServerAliveInterval=15)
+[ -f "$BASE_SSH_KEY" ] && SSH_OPTS=(-i "$BASE_SSH_KEY" "${SSH_OPTS[@]}")
+
+# adb shell does not reliably return the remote exit code on every adbd, so the
+# command prints a marker with its status and adb_sh returns that.
+adb_sh() {
+    local serial=$1 cmd=$2 line rc=""
+    while IFS= read -r line || [ -n "$line" ]; do
+        line=${line%$'\r'}
+        case $line in
+            *__LT_RC=*) rc=${line##*__LT_RC=}; line=${line%__LT_RC=*}; [ -z "$line" ] || printf '%s\n' "$line" ;;
+            *) printf '%s\n' "$line" ;;
+        esac
+    done < <(MSYS_NO_PATHCONV=1 adb -s "$serial" shell "$cmd"'; echo "__LT_RC=$?"' < /dev/null 2>&1)
+    [ -n "$rc" ] || { echo "adb shell on $serial returned no status (device gone?)" >&2; return 255; }
+    return "$rc"
+}
+
+b_sh() {      # run a command line on the base as BASE_USER
+    if [ "$BASE_TRANSPORT" = ssh ]; then
+        ssh -n "${SSH_OPTS[@]}" "$BASE_USER@$BASE_HOST" "$1"
+    else
+        adb_sh "$BASE_SERIAL" "$1"
+    fi
+}
+b_put() {     # b_put <local file> <remote dir>
+    if [ "$BASE_TRANSPORT" = ssh ]; then
+        scp -q "${SSH_OPTS[@]}" "$1" "$BASE_USER@$BASE_HOST:$2/"
+    else
+        MSYS_NO_PATHCONV=1 adb -s "$BASE_SERIAL" push "$(winpath "$1")" "$2/" > /dev/null
+    fi
+}
+# Run a command line as root on the base. The command must not read stdin:
+# when a password is needed it arrives on sudo's stdin (the "sudo eats stdin"
+# trap: never pipe data into a `sudo -S` command; copy the file first).
+b_root() {
+    local pw; pw=$(sq "$BENCH_SUDO_PW")
+    b_sh "if sudo -n true 2>/dev/null; then sudo -n $1; elif [ -n $pw ]; then printf '%s\n' $pw | sudo -S -p '' $1; else echo 'sudo needs a password: install the bench sudoers drop-in (BENCH_SETUP.md) or set BENCH_SUDO_PW' >&2; false; fi"
+}
+
+# -------------------------------------------------------- local: the tarball --
+REPO=$(git -C "$BT" rev-parse --show-toplevel)
+SHA=$(git -C "$REPO" rev-parse --verify --quiet "${COMMIT}^{commit}") || die "not a commit: $COMMIT"
+SHORT=${SHA:0:8}
+SUBJECT=$(git -C "$REPO" log -1 --format=%s "$SHA")
+git -C "$REPO" cat-file -e "$SHA:$DC_REL/Dockerfile" 2>/dev/null || die "$SHORT has no $DC_REL/Dockerfile"
+
+# The image's build context needs base_station/ and firmware/ (the Dockerfile
+# COPYs both); compose needs docker-compose*.yml and base_station/mosquitto.conf;
+# deploy/ carries the unit files. Docs, bench-evidence, hil/ and tools/ stay home.
+PATHS=()
+while IFS= read -r p; do
+    case $p in base_station|firmware|deploy|Dockerfile|docker-compose*.yml) PATHS+=("$p") ;; esac
+done < <(git -C "$REPO" ls-tree --name-only "$SHA:$DC_REL")
+for need in base_station firmware Dockerfile docker-compose.yml; do
+    found=0
+    for p in "${PATHS[@]}"; do [ "$p" != "$need" ] || found=1; done
+    [ "$found" = 1 ] || die "$SHORT: $DC_REL/$need missing"
+done
+HAS_LOCK=0
+git -C "$REPO" cat-file -e "$SHA:$DC_REL/base_station/requirements.lock.txt" 2>/dev/null && HAS_LOCK=1
+
+case $(cd "$BENCH_ARCHIVE_DIR" 2>/dev/null && pwd -P || echo "$BENCH_ARCHIVE_DIR")/ in
+    "$(cd "$REPO" && pwd -P)"/*) die "BENCH_ARCHIVE_DIR must be outside the git repo" ;;
+esac
+STAGE=$BENCH_ARCHIVE_DIR/deploy
+mkdir -p "$STAGE"
+TGZ=$STAGE/dc_deploy_$SHORT.tar.gz
+STAMP=$STAGE/DEPLOYED_FROM_$SHORT.txt
+RSCRIPT=$STAGE/deploy_base_remote.sh
+
+# CRLF trap: with core.autocrlf=true (Git for Windows' default) or a text=auto
+# attribute and core.eol=crlf, git archive writes CRLF, and every shell script
+# and config on the board then breaks. Force LF.
+say "archive $SHORT ($SUBJECT): ${PATHS[*]}"
+git -C "$REPO" -c core.autocrlf=false -c core.eol=lf archive --format=tar.gz -o "$TGZ" "$SHA:$DC_REL" -- "${PATHS[@]}"
+# Check: the text files in the tarball must hold no more CR bytes than the same
+# blobs in git (a few committed logs carry CRs of their own). More CRs means an
+# eol conversion slipped in. (Needs GNU tar's --wildcards, else it is skipped.)
+TEXT_RE='(\.(sh|py|yml|conf|cfg|service|txt)|Dockerfile)$'
+CR_TAR=$(set +o pipefail; { tar -xzOf "$TGZ" --wildcards '*.sh' '*.py' '*.yml' '*.conf' '*.cfg' \
+    '*.service' '*.txt' '*Dockerfile' 2>/dev/null || true; } | tr -cd '\r' | wc -c)
+CR_GIT=$(set +o pipefail; tar -tzf "$TGZ" | grep -E "$TEXT_RE" | sed "s|^|$SHA:$DC_REL/|" \
+    | git -C "$REPO" cat-file --batch | tr -cd '\r' | wc -c)
+[ "${CR_TAR// /}" -le "${CR_GIT// /}" ] \
+    || die "the tarball has CRLF the commit does not have; check .gitattributes / core.eol (DEPLOY.md, CRLF trap)"
+TGZ_MD5=$(md5_local "$TGZ")
+
+{
+    echo "$SHA"
+    echo "subject=$SUBJECT"
+    echo "deployed_utc=$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+    echo "paths=${PATHS[*]}"
+    echo "tarball=dc_deploy_$SHORT.tar.gz md5=$TGZ_MD5"
+    echo "tool=bench_tools/deploy_base.sh"
+} > "$STAMP"
+
+# -------------------------------------------------- the board-side script --
+# Plain POSIX sh, runs as root on the base. Arguments, not expansion, carry
+# every value in, so the quoted heredoc below is copied verbatim.
+cat > "$RSCRIPT" <<'REMOTE'
+#!/bin/sh
+# Board side of deploy_base.sh. Runs as root on the bench BASE X8.
+# Never opens /dev/ttymxc3 and never starts lora_bridge.
+set -eu
+TGZ=$1 STAMP=$2 SHORT=$3 SHA=$4 DEST=$5 OWNER=$6 DO_CLEAN=$7 DO_BUILD=$8 LOCKED=$9
+shift 9
+DO_BROKER=$1 PROJECT=$2 WORK=$3
+
+say() { echo "[base $(date -u +%H:%M:%SZ)] $*"; }
+die() { echo "[base] ERROR: $*" >&2; exit 1; }
+
+radio_containers() {   # running containers that map the L072 radio UART
+    ids=$(docker ps -q)
+    [ -n "$ids" ] || return 0
+    docker inspect -f '{{.Name}} {{range .HostConfig.Devices}}{{.PathOnHost}} {{end}}' $ids \
+        | grep ttymxc3 | cut -d' ' -f1 | tr -d / | tr '\n' ' ' | sed 's/ *$//'
+}
+
+mqtt_probe() {         # 0 = a broker on 127.0.0.1:1883 accepted an MQTT CONNECT
+    if command -v python3 >/dev/null 2>&1; then
+        python3 - <<'PY'
+import socket, sys
+try:
+    s = socket.create_connection(("127.0.0.1", 1883), timeout=3)
+    cid = b"lifetrac-deploy-probe"
+    body = b"\x00\x04MQTT\x04\x02\x00\x0a" + len(cid).to_bytes(2, "big") + cid
+    s.sendall(b"\x10" + bytes([len(body)]) + body)
+    r = s.recv(4)
+    s.sendall(b"\xe0\x00")
+    s.close()
+except OSError as e:
+    print("mqtt probe: %s" % e)
+    sys.exit(1)
+if len(r) == 4 and r[0] == 0x20 and r[3] == 0:
+    print("mqtt probe: CONNACK accepted on 127.0.0.1:1883")
+    sys.exit(0)
+print("mqtt probe: unexpected reply %r" % (r,))
+sys.exit(2)
+PY
+    else
+        docker run --rm --network host eclipse-mosquitto:2 \
+            mosquitto_sub -h 127.0.0.1 -p 1883 -t '$SYS/broker/version' -C 1 -W 5
+    fi
+}
+
+# ---- preconditions (read-only)
+case $DEST in */DESIGN-CONTROLLER) ;; *) die "deploy dir must end in /DESIGN-CONTROLLER: $DEST" ;; esac
+[ -f "$TGZ" ] || die "missing $TGZ"
+command -v docker >/dev/null 2>&1 || die "docker not found"
+if [ -f /etc/systemd/system/lifetrac-camera.service ]; then
+    die "this board has lifetrac-camera.service: it looks like the TRACTOR, not the base"
+fi
+st=$(systemctl is-enabled compose-apps-early-start-recovery.service 2>/dev/null || true)
+case $st in
+    masked*|"") ;;
+    *) die "compose-apps-early-start-recovery.service is '$st', not masked. On the LmP 934 image it runs 'systemctl stop docker; rm -rf /var/lib/docker' every 60 s. Mask it and compose-apps-early-start.service first (BENCH_SETUP.md, provision_bench_board.sh)." ;;
+esac
+st=$(systemctl is-enabled compose-apps-early-start.service 2>/dev/null || true)
+case $st in masked*|"") ;; *) say "WARNING: compose-apps-early-start.service is '$st' (the bench masks it)" ;; esac
+for u in lifetrac-base.service lifetrac-base-compose.service; do
+    en=$(systemctl is-enabled "$u" 2>/dev/null || true)
+    ac=$(systemctl is-active "$u" 2>/dev/null || true)
+    case $ac in
+        active|activating|reloading)
+            die "$u is $ac. It brings up compose services that open /dev/ttymxc3 (lora_bridge or image_rx). Stop and disable it first (DEPLOY.md)." ;;
+    esac
+    case $en in
+        enabled*) say "WARNING: $u is $en ($ac). If it ever succeeds at boot it opens /dev/ttymxc3. Recommended: systemctl disable $u (DEPLOY.md)." ;;
+    esac
+done
+busy=$(radio_containers)
+[ -z "$busy" ] || die "running containers map /dev/ttymxc3 (a leg in progress?): $busy. Deploy only with the radio daemons stopped."
+free_kb=$(df -Pk "$WORK" | awk 'NR==2 {print $4}')
+[ "$DO_BUILD" != 1 ] || [ "$free_kb" -gt 1500000 ] || die "less than 1.5 GB free under $WORK"
+
+# ---- 1. back up the old tree, then replace it
+mkdir -p "$DEST"
+old_sha=$(head -n 1 "$DEST/DEPLOYED_FROM.txt" 2>/dev/null | cut -c1-8 || true)
+old_conf_md5=$(md5sum "$DEST/base_station/mosquitto.conf" 2>/dev/null | cut -d' ' -f1 || true)
+cd "$DEST"
+set --
+for p in base_station firmware deploy Dockerfile DEPLOYED_FROM.txt docker-compose*.yml; do
+    if [ -e "$p" ]; then set -- "$@" "$p"; fi
+done
+if [ $# -gt 0 ]; then
+    backup="$WORK/prev_tree_${old_sha:-unknown}_$(date -u +%Y%m%dT%H%M%SZ).tgz"
+    tar -czf "$backup" "$@"
+    say "old tree (${old_sha:-no DEPLOYED_FROM}) saved to $backup"
+fi
+if [ "$DO_CLEAN" = 1 ]; then
+    rm -rf "$DEST/base_station" "$DEST/firmware" "$DEST/deploy"
+fi
+tar -xzf "$TGZ" -C "$DEST"
+cp "$STAMP" "$DEST/DEPLOYED_FROM.txt"
+chown -R "$OWNER:$OWNER" "$DEST"
+say "tree at $DEST is now $SHORT (clean=$DO_CLEAN)"
+
+# ---- 2. .env and secrets/, only when missing; values never printed
+umask 077
+if [ ! -f .env ]; then
+    cat > .env <<'ENV'
+# Written by bench_tools/deploy_base.sh. web_ui reads the PIN from
+# secrets/lifetrac_pin first, so LIFETRAC_PIN stays empty here.
+LIFETRAC_PIN=
+# Read only by lora_bridge and the video-test image_rx, which the bench
+# deploy never starts.
+LIFETRAC_LORA_DEVICE=/dev/ttymxc3
+LIFETRAC_TRUSTED_PROXIES=
+ENV
+    say "created .env"
+fi
+mkdir -p secrets
+if [ ! -s secrets/lifetrac_fleet_key ]; then
+    head -c 16 /dev/urandom > secrets/lifetrac_fleet_key
+    say "created secrets/lifetrac_fleet_key (16 random bytes, a bench-only key; not printed)"
+fi
+if [ ! -s secrets/lifetrac_pin ]; then
+    n=$(od -An -N4 -tu4 /dev/urandom | tr -d ' \n')
+    case $n in ''|*[!0-9]*) die "could not read /dev/urandom for the PIN" ;; esac
+    printf '%d' $((100000 + n % 900000)) > secrets/lifetrac_pin
+    say "created secrets/lifetrac_pin (6 random digits; read it on the base: sudo cat $DEST/secrets/lifetrac_pin)"
+fi
+chmod 700 secrets
+chmod 600 secrets/lifetrac_fleet_key secrets/lifetrac_pin .env
+chown -R "$OWNER:$OWNER" secrets .env
+umask 022
+
+# ---- 3. build the image (no radio involved)
+if [ "$DO_BUILD" = 1 ]; then
+    build_args=""
+    locked_eff=0
+    if [ "$LOCKED" = 1 ]; then
+        if [ -f base_station/requirements.lock.txt ] && grep -q '^ARG LOCKED' Dockerfile; then
+            build_args="--build-arg LOCKED=1"
+            locked_eff=1
+        else
+            say "WARNING: $SHORT has no lock-file support; building unlocked"
+        fi
+    fi
+    old_id=$(docker image inspect -f '{{.Id}}' lifetrac-v25:latest 2>/dev/null || true)
+    log=/home/$OWNER/docker_build_$SHORT.log
+    say "docker build -t lifetrac-v25:latest -t lifetrac-v25:$SHORT $build_args . (log $log)"
+    # shellcheck disable=SC2086
+    if ! docker build $build_args --label "org.lifetrac.source_sha=$SHA" \
+            -t lifetrac-v25:latest -t "lifetrac-v25:$SHORT" . > "$log" 2>&1; then
+        tail -n 40 "$log"
+        die "docker build failed (full log: $log)"
+    fi
+    chown "$OWNER:$OWNER" "$log"
+    new_id=$(docker image inspect -f '{{.Id}}' lifetrac-v25:latest)
+    if [ -n "$old_id" ] && [ "$old_id" != "$new_id" ]; then
+        docker tag "$old_id" lifetrac-v25:previous
+        say "the image it replaced is kept as lifetrac-v25:previous ($(echo "$old_id" | cut -c8-19))"
+    fi
+    freeze=/home/$OWNER/pip_freeze_lifetrac-v25_$SHORT.txt
+    docker run --rm --network none --entrypoint python3 lifetrac-v25:latest -m pip freeze > "$freeze" 2>&1 \
+        || say "WARNING: pip freeze in the image failed (see $freeze)"
+    chown "$OWNER:$OWNER" "$freeze"
+    docker run --rm --network none --entrypoint python3 lifetrac-v25:latest -c \
+        "import fastapi, uvicorn, paho.mqtt.client, cryptography, PIL, serial, jinja2; print('image deps import OK')" \
+        || die "the new image cannot import its dependencies"
+    {
+        echo "image=lifetrac-v25:latest $new_id"
+        echo "build_locked=$locked_eff build_log=$log pip_freeze=$freeze"
+    } >> DEPLOYED_FROM.txt
+    say "built $(echo "$new_id" | cut -c8-19) (locked=$locked_eff); wheels: $freeze"
+fi
+
+# ---- 4. the broker, and ONLY the broker
+if [ "$DO_BROKER" = 1 ]; then
+    docker compose version > /dev/null 2>&1 || die "the docker compose plugin is missing"
+    docker compose -p "$PROJECT" -f "$DEST/docker-compose.yml" config --services | grep -qx mosquitto \
+        || die "docker-compose.yml has no 'mosquitto' service"
+    recreate=""
+    new_conf_md5=$(md5sum base_station/mosquitto.conf | cut -d' ' -f1)
+    [ "$new_conf_md5" = "$old_conf_md5" ] || recreate=--force-recreate
+    # NEVER run `docker compose up` without a service name here, and never name
+    # lora_bridge (or web_ui / audit_tail, which depend on nothing radio but are
+    # not needed by the bench). lora_bridge maps ${LIFETRAC_LORA_DEVICE}, which is
+    # /dev/ttymxc3 on this bench: the L072 radio UART. It would open the port and
+    # drive the radio with a framing the Method-G firmware does not speak. Radio
+    # daemons are started only by the leg scripts, on an explicit GO.
+    # --no-deps keeps compose from starting anything mosquitto might depend on.
+    # shellcheck disable=SC2086
+    docker compose -p "$PROJECT" -f "$DEST/docker-compose.yml" up -d --no-deps $recreate mosquitto
+    i=0
+    until mqtt_probe; do
+        i=$((i + 1))
+        [ "$i" -lt 20 ] || die "nothing answers MQTT on 127.0.0.1:1883 after 20 s (docker compose -p $PROJECT logs mosquitto)"
+        sleep 1
+    done
+    holder=$(docker ps --filter publish=1883 --format '{{.Names}}' | tr '\n' ' ')
+    case " $holder " in
+        *" $PROJECT-mosquitto-1 "*) say "broker $PROJECT-mosquitto-1 answers on 127.0.0.1:1883" ;;
+        *) say "WARNING: 1883 is published by '$holder', not $PROJECT-mosquitto-1" ;;
+    esac
+    others=$(docker compose -p "$PROJECT" -f "$DEST/docker-compose.yml" ps --services --filter status=running | grep -vx mosquitto | tr '\n' ' ' || true)
+    [ -z "$others" ] || say "WARNING: other services of $PROJECT are running (not started by this script): $others"
+fi
+
+busy=$(radio_containers)
+[ -z "$busy" ] || say "WARNING: containers now map /dev/ttymxc3: $busy (this script started none of them)"
+say "DEPLOYED_FROM.txt:"
+sed 's/^/    /' "$DEST/DEPLOYED_FROM.txt"
+say "done"
+REMOTE
+tr -d '\r' < "$RSCRIPT" > "$RSCRIPT.tmp" && mv "$RSCRIPT.tmp" "$RSCRIPT"
+sh -n "$RSCRIPT" || die "generated board script has a syntax error"
+tr -d '\r' < "$STAMP" > "$STAMP.tmp" && mv "$STAMP.tmp" "$STAMP"
+
+R_ARGS="$(sq "$REMOTE_WORK/dc_deploy_$SHORT.tar.gz") $(sq "$REMOTE_WORK/DEPLOYED_FROM_$SHORT.txt") $SHORT $SHA $(sq "$BASE_DEPLOY_DIR") $(sq "$BASE_USER") $DO_CLEAN $DO_BUILD $LOCKED $DO_BROKER $COMPOSE_PROJECT $(sq "$REMOTE_WORK")"
+
+if [ "$BASE_TRANSPORT" = ssh ]; then TARGET="$BASE_USER@$BASE_HOST (ssh)"; else TARGET="adb $BASE_SERIAL"; fi
+say "commit   $SHA"
+say "target   $TARGET -> $BASE_DEPLOY_DIR"
+say "tarball  $TGZ ($(wc -c < "$TGZ") B, md5 $TGZ_MD5)"
+say "build    $([ "$DO_BUILD" = 1 ] && echo "yes, locked=$LOCKED (commit has lock file: $HAS_LOCK)" || echo no)"
+say "broker   $([ "$DO_BROKER" = 1 ] && echo "docker compose -p $COMPOSE_PROJECT up -d --no-deps mosquitto" || echo untouched)"
+if [ "$DRY_RUN" = 1 ]; then
+    say "dry run: board script $RSCRIPT"
+    say "dry run: would copy the tarball, $STAMP and the script to $REMOTE_WORK, then run as root:"
+    say "         sh $REMOTE_WORK/deploy_base_remote.sh $R_ARGS"
+    exit 0
+fi
+
+# ------------------------------------------------------------ on the base --
+if [ "$BASE_TRANSPORT" = adb ] && [ "$BASE_SERIAL" = "$TRACTOR_SERIAL" ]; then
+    die "BASE_SERIAL equals TRACTOR_SERIAL"
+fi
+b_sh "true" > /dev/null || die "cannot reach the base ($TARGET)"
+b_sh "mkdir -p $(sq "$REMOTE_WORK")"
+for f in "$TGZ" "$STAMP" "$RSCRIPT"; do
+    b_put "$f" "$REMOTE_WORK" || die "copy failed: $f"
+done
+remote_md5=$(b_sh "md5sum $(sq "$REMOTE_WORK/dc_deploy_$SHORT.tar.gz")" | tr -d '\r' | cut -d' ' -f1)
+[ "$remote_md5" = "$TGZ_MD5" ] || die "tarball md5 mismatch on the base ($remote_md5 vs $TGZ_MD5)"
+say "copied to $REMOTE_WORK (md5 OK); running the board-side script as root"
+b_root "sh $(sq "$REMOTE_WORK/deploy_base_remote.sh") $R_ARGS" || die "board-side deploy failed (see above)"
+say "base deployed from $SHORT. The radios were not touched."
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/flash_l072.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/flash_l072.sh
new file mode 100755
index 00000000..705ecf84
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/flash_l072.sh
@@ -0,0 +1,183 @@
+#!/bin/bash
+# flash_l072.sh -- FLASH_RUNBOOK.md sections 1-2 as one PC-side script (Git
+# Bash on the bench PC, or any Linux shell with adb/ssh).
+#
+#   bash flash_l072.sh <base|tractor> <firmware.bin> [--go] [--verify-only] [--revive reboot|full]
+#
+# Without --go: copies the flash pipeline LF-clean to /tmp/lifetrac_p0c and the
+# wrapper to /home/fio on the board, then runs the wrapper's preflight
+# (FLASH_PREFLIGHT_ONLY=1: file presence, CRLF, image md5). Nothing touches
+# openocd, the radio UART or the watchdog.
+# With --go: also stops the tractor's camera unit/container and runs the flash
+# (run_flash_bench.sh -> full_flash_pipeline.sh). A FLASH IS A RADIO-ON EVENT:
+# the L072 boots into RXCONT afterwards, and REVIVE_MODE=reboot reboots the X8
+# (12-24 s; /tmp is wiped). Use --go only on the operator's explicit GO.
+# --verify-only: read back and compare against <firmware.bin>, write nothing
+# (still enters the ROM bootloader and reboots; needs --go too).
+#
+# Configuration: $BENCH_ENV (default: bench.env next to this script; template
+# bench.env.example), loaded by lib/env_file.sh like every bench script: CRLF is
+# tolerated, and a NON-EMPTY variable already in the environment wins over the
+# file (`TRACTOR_SERIAL=<serial> bash flash_l072.sh tractor ...` flashes that
+# board). Defaults (the 2026 bench) for anything still unset:
+#   BASE_SERIAL     2D0A1209DABC240B  base adb serial (shown only; see BASE_HOST)
+#   TRACTOR_SERIAL  2E2C1209DABC240B  tractor adb serial (adb only, WiFi off)
+#   BASE_HOST       192.168.1.117     base ethernet address (DHCP lease). The base
+#                                     is ALWAYS flashed over ssh: BASE_TRANSPORT is
+#                                     not used here.
+#   BASE_SSH_USER   fio               (old name BASE_USER)
+#   BASE_SSH_KEY    ~/.ssh/lifetrac_base_ed25519
+#   BENCH_SUDO_PW   fio               LmP default; both boards have NOPASSWD sudo.
+#                                     Must not contain a single quote.
+#   BOARD_HOME      /home/fio         persistent home for the wrapper and logs
+#   REVIVE_MODE     reboot            or full (5.10 kernels only; refused on a 6.x
+#                                     kernel, which OOPSes on the module reload)
+#   ADB             adb               adb executable (tractor)
+set -euo pipefail
+
+HERE=$(cd "$(dirname "$0")" && pwd)
+HELPER=$(cd "$HERE/.." && pwd)
+BENCH_ENV=${BENCH_ENV:-${BENCH_ENV_FILE:-$HERE/bench.env}}
+# shellcheck source=lib/env_file.sh
+. "$HERE/lib/env_file.sh"
+if [ -f "$BENCH_ENV" ]; then
+  bench_load_env_file "$BENCH_ENV" || exit 2
+  ENV_NOTE="$BENCH_ENV (non-empty environment variables win)"
+else
+  ENV_NOTE="none ($BENCH_ENV missing): environment + the original bench's defaults"
+  echo "flash_l072: WARN: no $BENCH_ENV -- the original bench's serials and address apply unless set in the environment (cp bench.env.example bench.env)" >&2
+fi
+BASE_SERIAL=${BASE_SERIAL:-2D0A1209DABC240B}
+TRACTOR_SERIAL=${TRACTOR_SERIAL:-2E2C1209DABC240B}
+BASE_HOST=${BASE_HOST:-192.168.1.117}
+BASE_USER=${BASE_SSH_USER:-${BASE_USER:-fio}}
+BASE_SSH_KEY=${BASE_SSH_KEY:-$HOME/.ssh/lifetrac_base_ed25519}
+BASE_SSH_KEY=${BASE_SSH_KEY/#\~/$HOME}
+BENCH_SUDO_PW=${BENCH_SUDO_PW:-fio}
+BOARD_HOME=${BOARD_HOME:-/home/fio}
+REVIVE_MODE=${REVIVE_MODE:-reboot}
+ADB_EXE=${ADB:-adb}
+
+die() { echo "flash_l072: $*" >&2; exit 2; }
+case $BENCH_SUDO_PW in *"'"*) die "BENCH_SUDO_PW must not contain a single quote" ;; esac
+usage() { awk 'NR > 1 && /^#/ { sub(/^# ?/, ""); print; next } NR > 1 { exit }' "$0"; exit 2; }
+
+[ $# -ge 2 ] || usage
+BOARD=$1; IMG=$2; shift 2
+GO=0; VERIFY_ONLY=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --go) GO=1 ;;
+    --verify-only) VERIFY_ONLY=1 ;;
+    --revive) [ $# -ge 2 ] || die "--revive needs reboot|full"; REVIVE_MODE=$2; shift ;;
+    -h|--help) usage ;;
+    *) die "unknown option: $1" ;;
+  esac
+  shift
+done
+case "$BOARD" in base|tractor) ;; *) die "board must be base or tractor, got '$BOARD'" ;; esac
+case "$REVIVE_MODE" in reboot|full) ;; *) die "REVIVE_MODE must be reboot or full, got '$REVIVE_MODE'" ;; esac
+[ -s "$IMG" ] || die "image not found or empty: $IMG"
+
+# --- image sanity -----------------------------------------------------------
+IMGNAME=$(basename "$IMG")
+SIZE=$(wc -c < "$IMG" | tr -d ' ')
+MD5=$(md5sum "$IMG" | cut -d' ' -f1)
+# 192 KB flash, of which the last 8 KB is the CFG region (include/memory_map.h).
+[ "$SIZE" -le $((184 * 1024)) ] || die "$IMGNAME is $SIZE B, larger than the 184 KB APP region"
+case "$MD5" in
+  0c1bb0a9573f813137f941dfa47177d0) KIND="bench build on both boards since 2026-09-15 (RS-12.15 v2)" ;;
+  589c120323c2d5e7ef9f459d7a4ba42d) KIND="PRODUCTION build (main bb4a2071): refuses diag register writes, so -ForceFrfHz and channel_survey_sniff.py fail on it -- bench boards normally run the bench build" ;;
+  e8ad842489d5acfc09f204c7807e4661) KIND="RS-12.10 bench build (pre-clock-authority A/B control)" ;;
+  5a160e4a8c9296c7d2e49727bdfb8880) KIND="RS-12.15 v2 bench build as flown in legs R and T" ;;
+  8c112e6f8b42109aab38a69f2b0aa147) KIND="first RS-12.10 build -- STATS-tail serializer bug, do not fly" ;;
+  *) KIND="not a recorded build (see bench-evidence/RS_13_vector_scene_2026-09-26/firmware/README.md)" ;;
+esac
+echo "image: $IMGNAME  $SIZE B  md5 $MD5"
+echo "       $KIND"
+echo "settings: $ENV_NOTE"
+
+# --- LF-clean staging -------------------------------------------------------
+PIPE="full_flash_pipeline.sh run_flash_l072.sh prep_bridge.sh revive_bridge.sh wdt_pet.sh
+      stm32_an3155_flasher.py 07_assert_pa11_pf4_long.cfg 08_boot_user_app.cfg 99_release_and_reset.cfg"
+WRAP="run_flash_bench.sh stamp.py kmsg_log.py"
+STAGE=$(mktemp -d)
+trap '[ -n "${STAGE:-}" ] && [ -d "$STAGE" ] && rm -rf -- "$STAGE"' EXIT
+mkdir -p "$STAGE/p0c" "$STAGE/home"
+for f in $PIPE; do tr -d '\r' < "$HELPER/$f" > "$STAGE/p0c/$f"; done
+for f in $WRAP; do tr -d '\r' < "$HERE/$f" > "$STAGE/home/$f"; done
+cp "$IMG" "$STAGE/p0c/$IMGNAME"   # binary: never line-ending-converted
+
+PW=$BENCH_SUDO_PW
+S="echo '$PW' | sudo -S -p ''"
+ENVS="REVIVE_MODE=$REVIVE_MODE FLASH_VERIFY_ONLY=$VERIFY_ONLY BENCH_HOME=$BOARD_HOME"
+[ "$PW" = "fio" ] || ENVS="$ENVS BENCH_SUDO_PW='$PW'"
+RUN="bash $BOARD_HOME/run_flash_bench.sh /tmp/lifetrac_p0c/$IMGNAME"
+
+winpath() { if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else printf '%s\n' "$1"; fi; }
+# REVIVE_MODE=full re-inserts x8h7_drv, which OOPSes the 6.x kernel (the base's
+# 6.1): refuse it there before anything is staged (FLASH_RUNBOOK).
+check_kernel() {   # check_kernel <uname -r output>
+  echo "kernel: ${1:-unknown}"
+  case "$REVIVE_MODE:$1" in full:6.*) die "REVIVE_MODE=full on kernel $1: the x8h7_drv re-insert OOPSes 6.x kernels. Use --revive reboot." ;; esac
+  return 0
+}
+
+if [ "$BOARD" = "base" ]; then
+  command -v ssh >/dev/null && command -v scp >/dev/null || die "ssh/scp not found"
+  SSHO=(-i "$BASE_SSH_KEY" -o BatchMode=yes -o ConnectTimeout=10)
+  TGT="$BASE_USER@$BASE_HOST"
+  echo "=== base $TGT (adb serial $BASE_SERIAL; the base is flashed over ssh): staging"
+  check_kernel "$(ssh "${SSHO[@]}" "$TGT" "uname -r" | tr -d '\r')"
+  ssh "${SSHO[@]}" "$TGT" "$S mkdir -p /tmp/lifetrac_p0c && $S chmod 0777 /tmp/lifetrac_p0c"
+  scp -q "${SSHO[@]}" "$STAGE"/p0c/* "$TGT:/tmp/lifetrac_p0c/"
+  scp -q "${SSHO[@]}" "$STAGE"/home/* "$TGT:$BOARD_HOME/"
+  echo "=== base: preflight"
+  ssh "${SSHO[@]}" "$TGT" "FLASH_PREFLIGHT_ONLY=1 $ENVS $RUN"
+  if [ "$GO" = "1" ]; then
+    echo "=== base: FLASHING (radio-on event; REVIVE_MODE=$REVIVE_MODE)"
+    set +e
+    ssh "${SSHO[@]}" "$TGT" "$ENVS $RUN"
+    RC=$?
+    set -e
+  fi
+else
+  command -v "$ADB_EXE" >/dev/null || die "adb not found ('$ADB_EXE'; install platform-tools, PC_SETUP.md, or set ADB)"
+  export MSYS_NO_PATHCONV=1
+  ADBC=("$ADB_EXE" -s "$TRACTOR_SERIAL")
+  echo "=== tractor $TRACTOR_SERIAL: staging"
+  check_kernel "$("${ADBC[@]}" shell "uname -r" < /dev/null | tr -d '\r')"
+  "${ADBC[@]}" shell "$S mkdir -p /tmp/lifetrac_p0c; $S chmod 0777 /tmp/lifetrac_p0c" >/dev/null
+  for f in "$STAGE"/p0c/*; do "${ADBC[@]}" push "$(winpath "$f")" /tmp/lifetrac_p0c/ >/dev/null; done
+  for f in "$STAGE"/home/*; do "${ADBC[@]}" push "$(winpath "$f")" "$BOARD_HOME/" >/dev/null; done
+  echo "=== tractor: preflight"
+  "${ADBC[@]}" shell "$S env FLASH_PREFLIGHT_ONLY=1 $ENVS $RUN" | tr -d '\r'
+  if [ "$GO" = "1" ]; then
+    echo "=== tractor: stopping lifetrac-camera.service + tractor-camera (they hold /dev/ttymxc3)"
+    "${ADBC[@]}" shell "$S systemctl stop lifetrac-camera.service; $S docker stop -t 3 tractor-camera" >/dev/null 2>&1 || true
+    echo "=== tractor: FLASHING (radio-on event; REVIVE_MODE=$REVIVE_MODE)"
+    set +e
+    "${ADBC[@]}" shell "$S env $ENVS $RUN" | tr -d '\r'
+    RC=${PIPESTATUS[0]}
+    set -e
+  fi
+fi
+
+if [ "$GO" != "1" ]; then
+  echo
+  echo "Staged and preflighted only. To flash (operator GO required):"
+  echo "  bash $0 $BOARD $IMG --go$([ "$VERIFY_ONLY" = 1 ] && echo ' --verify-only')"
+  exit 0
+fi
+
+echo
+echo "flash exit status: ${RC:-?} (a dropped connection, e.g. 255 over ssh, is expected when REVIVE_MODE=reboot reboots the board)"
+cat <<EOF
+Next (FLASH_RUNBOOK section 4):
+  1. When the board is back: success = 'Verify OK' and 'flash_rc=0' in $BOARD_HOME/pipeline_stamped.log.
+  2. /tmp was wiped: re-stage /tmp/lifetrac_strict (and /tmp/lifetrac_p0c before another flash).
+  3. Tractor: stop lifetrac-camera.service and tractor-camera again; check 'fuser /dev/ttymxc3' is empty.
+  4. rs116_health_probe.py on the board, then park the radio (radio_park.py -> PARK_OK 0x80)
+     unless a leg follows under the same GO.
+EOF
+exit "${RC:-0}"
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/.gitattributes b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/.gitattributes
new file mode 100644
index 00000000..39320165
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/.gitattributes
@@ -0,0 +1,4 @@
+# Git Bash cannot run a CRLF shell script ($'\r': command not found), and these
+# are checked out on Windows with core.autocrlf=true. Keep them LF everywhere.
+*.sh text eol=lf
+*.py text eol=lf
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/README.md b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/README.md
new file mode 100644
index 00000000..d1bf56d8
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/README.md
@@ -0,0 +1,278 @@
+# Bench leg scripts
+
+These scripts run the RS-13 bench procedure
+([RS13_VECTOR_LEG.md](../RS13_VECTOR_LEG.md)) from any checkout. They are
+parameterised copies of the RS-13.1 session scripts.
+
+The originals stay unchanged in
+[`bench-evidence/RS_13_vector_scene_2026-09-26/scripts/`](../../../../bench-evidence/RS_13_vector_scene_2026-09-26/scripts/)
+as the historical record. They hardcode one PC's paths, a session scratchpad,
+the serials and the password. Never edit them. Change these copies instead.
+
+Before you start, read:
+- [BENCH_QUICKSTART.md](../BENCH_QUICKSTART.md), the entry point;
+- [PC_SETUP.md](../PC_SETUP.md) for the PC tools;
+- [BENCH_SETUP.md](../BENCH_SETUP.md) to provision the boards;
+- [DEPLOY.md](../DEPLOY.md) for the images and the base deploy;
+- [BENCH_RUNBOOK.md](../BENCH_RUNBOOK.md) for the campaign rules.
+
+## Rules that apply to every script
+
+- **Radios only on an explicit GO from the operator, per round.**
+  - `leg_prep.sh` wakes the receivers.
+  - The harness transmits.
+  - `leg2d_switch.sh` makes the base transmit commands.
+  - Run them only inside a GO'd leg.
+  - The other scripts never transmit.
+- **Park last.** `leg_post.sh` parks both radios after the reports. Before you
+  leave, run `power_up_guard.sh --check-only`.
+- **Screen.** Never use `firefox --kiosk` or any fullscreen the operator cannot
+  leave with Esc. The bench video runs in a normal window, and only the YouTube
+  player is fullscreen (`youtube_window.ps1`).
+- **DTS carrier.**
+  - A profile-2 (DTS) leg flies only on a carrier from a receive-only
+    spot-check made that same day with the tractor parked.
+  - Without `DTS_CARRIER_HZ`, `leg_prep.sh` refuses the leg.
+  - It also refuses 915.000 MHz, the channel of the RS-11.6 external emitter
+    (RS-13.1 A19).
+- **Shells.** Run the `.sh` scripts in Git Bash. Run the harness only in
+  PowerShell, with an execution policy that lets local scripts run
+  ([PC_SETUP.md](../PC_SETUP.md#powershell-execution-policy)).
+
+## Setup (once per PC)
+
+```bash
+cd LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools
+cp bench.env.example bench.env        # gitignored; edit serials, BASE_TRANSPORT, PC_HOST ...
+bash -c '. lib/bench_env.sh && bench_show_env'   # what the scripts will use
+```
+
+`PC_HOST` is **required** for a leg: this PC's LAN IPv4 address as the
+boards see it. The harness gets it as `-HostIp`, and the base rx daemon uses
+it as its control broker. If it is empty, `leg_prep.sh` auto-detects this
+PC's LAN IPv4 and prints it, or refuses (exit 6) when that is ambiguous;
+it never lets the harness fall back to the original bench PC's address.
+
+Other refusals: leg, scene and suffix tags must match `^[A-Za-z0-9_.-]+$`;
+`leg_post.sh` exits 3 if a board is not radio-quiet when it finishes (park
+with `power_up_guard.sh --stop-leg-daemons`); `leg2d_switch.sh` clears its
+retained `encode_mode_override` when it exits.
+
+Every script sources [`../lib/bench_env.sh`](../lib/bench_env.sh). It works
+out the repo root from its own location, so you can call the scripts from any
+directory. It loads `bench.env`, or `bench.env.example` when there is none;
+the example holds the original bench's serials and addresses, so create
+`bench.env` before the first run. A non-empty variable in your environment
+overrides the file for one run of these `legs/` scripts, for example
+`TRACTOR_SERIAL=... bash leg_prep.sh ...`. Each script prints its usage with
+`-h`.
+
+## The scripts
+
+| script | what it does | boards | radio |
+|---|---|---|---|
+| `power_up_guard.sh` | Waits for the boards. Stops the tractor camera unit. Stages the probes. Reads the L072 and parks it if it is listening. `--check-only` is the end-of-session check. `--stop-leg-daemons` clears an interrupted harness. Works over adb, or over ssh for the base. | both | reads the radio and parks it; never transmits |
+| `stage_boards.sh` | (Re)stages `/tmp/lifetrac_strict` and the harness's `/tmp/lifetrac_p0c/08_boot_user_app.cfg` (LF-clean), then the code tree. md5-verifies every file. | both | file copies only |
+| `push_fix_to_board.sh` | Pushes this checkout's `camera_service.py`, encoder, store and `vector_dry_run.py`, md5-checked, then runs an import smoke without any device. | one | none |
+| `youtube_window.ps1` | `-Open` / `-Front` / `-Close` the bench video window (its own Firefox profile, muted). `-Url`, `-ProfileDir`, `-FirefoxExe`. | none | none |
+| `scene_check.sh` | Before every camera run: window to the front, ~10 s of frames from `/dev/video1`. Needs ≥ 8 % of pixels changed (0 = record only, for a still). | tractor camera | none |
+| `step1_pass.sh` | One camera-only step-1 pass: fresh `bench_mqtt`, capture, then `camera_svc`. `--from-work` runs the pushed tree. Refuses to run while a leg daemon is up. | tractor | none (camera only) |
+| `leg_prep.sh` | Scene check, UART-holder check, health probes, `clear_retained`, pre-brackets, detached base capture. Writes the harness command. | both | wakes the receivers (RXCONT); does not transmit |
+| `link_sample.sh` | During a leg: the first `link_stats` message that has frames (P7). | base broker | none |
+| `leg2d_switch.sh` | Leg 2d only: the override publishes at T+60 s and T+180 s, plus the acks. | base broker | **the base transmits** (0x63 commands) |
+| `leg_post.sh` | Collects the capture, post-brackets, `rs12_leg_report --capture`, `frag_gap_report`, P2/P4 and the tractor-log, then **parks** (with retries). | both | parks; never transmits |
+| `leg_replay.py` | PC only: replays a base capture (seq gaps per codec run, resync episodes, last DIGEST). `py -3 leg_replay.py <leg> <image_bw500\|image_bw250> [--evidence-dir DIR \| --capture FILE]`; it reads `<DIR>/leg<leg>_base.jsonl` (default DIR: `$EVIDENCE_DIR`, which only the scripts export, so pass `--evidence-dir` from a plain shell). `leg_post.sh` runs it for you. | none | none |
+
+## A session
+
+1. **Power-up.** Arm the guard *before* switching the boards on:
+
+   ```bash
+   bash power_up_guard.sh --wait-power-cycle
+   ```
+
+   When the boards are already up, run it without the flag. If the base does
+   not enumerate on USB, set `BASE_TRANSPORT=ssh` for this step.
+2. **Stage both boards:** `bash stage_boards.sh`.
+   - Re-run it after any reboot or flash, and whenever the last push is 5 days
+     old: `/tmp` is tmpfs and ages at 5 days.
+   - Each board should hold ≥ 19 entries.
+3. **Moving content.** In PowerShell:
+
+   ```powershell
+   .\youtube_window.ps1 -Open
+   ```
+
+   Start it at least a minute before the first check, because two pre-roll
+   ads play first.
+4. **DTS carrier.** This step is needed before the first profile-2 leg of the
+   day.
+   - Run a receive-only spot-check with the tractor parked:
+     [`../../channel_survey_sniff.py`](../../channel_survey_sniff.py) or
+     [`../../hunt_sniff.ps1`](../../hunt_sniff.ps1), then
+     `tools/survey_compare.py`.
+   - Put the pick in `bench.env` as `DTS_CARRIER_HZ=<Hz>` with
+     `DTS_CARRIER_DATE=<today, YYYY-MM-DD>`. `leg_prep.sh` refuses a DTS leg
+     without it or on another day, and writes it into the harness command as
+     `-ForceFrfHz`.
+   - Record the pick in RESULTS.
+
+## One leg: prep, harness, link sample, post, park
+
+Example leg 2a (DTS, VECTOR at boot). Tags may carry a suffix (`2a_r5`); the
+tag names every file.
+
+```bash
+# 1. prep (Git Bash). Ends by printing the harness command and writing it to
+#    $BENCH_SCRATCH/leg2a_harness.ps1. Preview without touching a board:
+#    add --print-harness.
+bash leg_prep.sh 2a image_bw500
+```
+
+```powershell
+# 2. harness (PowerShell, right away: the base capture is already listening).
+#    Easiest: run the wrapper leg_prep printed:  & "<BENCH_SCRATCH>/leg2a_harness.ps1"
+#    It tees the transcript and records the archive folder for leg_post.
+#    By hand it is this, from firmware/x8_lora_bootloader_helper/,
+#    with the values of your bench.env:
+$DTS_CARRIER_HZ = <your same-day pick, in Hz>
+.\run_live_radio_monitor.ps1 -TxAdbSerial <TRACTOR_SERIAL> -RxAdbSerial <BASE_SERIAL> -HostIp <PC_HOST> `
+   -TxFeed camera -RegProfile 2 -ForceFrfHz $DTS_CARRIER_HZ -DurationS 300 -SynthFps 2 `
+   -KfRequestDisable 1 -ProbeEcho 0 -LogFragArrivals 1 -TxBatch 0 `
+   -CamExtraEnv "-e LIFETRAC_ENCODE_MODE=9 -e LIFETRAC_VECTOR_DETAIL=80" -Archive
+```
+
+```bash
+# 3. while frames flow (Git Bash):
+bash link_sample.sh 2a
+# 4. after the harness prints "[EVIDENCE] archived to ...": collect, report, park
+bash leg_post.sh 2a          # or: bash leg_post.sh 2a <archive dir>
+```
+
+**Step 5 is the park.**
+- `leg_post.sh` parks both radios last. It retries a `PARK_TRANSIENT` after
+  60 s, up to 3 attempts, and logs every attempt in `leg2a_park.txt`.
+- If it ends with `PARK NOT CONFIRMED`, run `bash power_up_guard.sh`. It parks
+  any board that is not in `0x80`.
+- At the end of the session, run `bash power_up_guard.sh --check-only`.
+
+**Not flying after the prep after all** (no GO, the harness refused, the
+round was aborted)? `leg_prep.sh` has woken both receivers (RXCONT) and left
+the detached base capture `rs13_cap_base` running, and nothing else will park
+them. Run `bash power_up_guard.sh --stop-leg-daemons`: it stops the leftover
+leg containers and parks both radios.
+
+A few cautions about the harness command:
+- Do not drop `-ForceFrfHz` on a profile-2 leg. The harness refuses such a
+  leg (its default carrier is 915.000 MHz); `-AllowDefaultCarrier` is only for
+  a deliberate 915 MHz control.
+- Always pass `-HostIp <PC_HOST>`; `PC_HOST` is required (Setup, above).
+- The harness refuses unknown parameter names at launch (it used to ignore a
+  misspelling such as `-DurationSeconds`). Still copy the generated command
+  rather than typing it.
+
+### The four RS-13 legs
+
+| leg | prep | harness, beyond the 2a line | base capture |
+|---|---|---|---|
+| 2a: DTS, VECTOR at boot | `leg_prep.sh 2a image_bw500` | (the line above) | `--strict`, min 500 frames |
+| 2b: FHSS, VECTOR at boot | `leg_prep.sh 2b image_bw250` | `-RegProfile 1`, **no** `-ForceFrfHz` | `--strict`; at `--fps 1`, min 200 (A7) |
+| 2c: DTS control, `mono_g4` at boot | `leg_prep.sh 2c image_bw500` | `-CamExtraEnv "-e LIFETRAC_ENCODE_MODE=6"` | no `--strict` |
+| 2d: DTS switch leg, boots `mono_g4` | `leg_prep.sh 2d image_bw500`, then `leg2d_switch.sh 2d` right after the harness launch | same as 2c | no `--strict` |
+
+`leg_prep.sh` picks the boot mode and the strictness from the tag (`2c*` and
+`2d*` boot `mono_g4` and run without `--strict`). Override them with
+`--boot-mode`, `--strict` / `--no-strict`, `--fps` and `--min-frames`.
+
+How to fly and read them:
+- For P3, interleave the control with the VECTOR legs (2c, 2a, 2c′, 2a′).
+- At 1 fps, read 2b's P2 and P3 from lock.
+- The pass criteria are in RS13_VECTOR_LEG.md, step 2.
+
+## Step 1: camera-only dry run (no radio)
+
+Three passes. Each pass runs its own scene check and recreates `bench_mqtt`
+(0 retained messages):
+
+```bash
+bash stage_boards.sh tractor                   # code tree + bench_mqtt.conf on the tractor
+bash step1_pass.sh bw250 moving --from-work    # the railroad video (scene check >= 8 %)
+bash step1_pass.sh bw250 landscape --from-work # a still (scene check records only)
+bash step1_pass.sh bw500 landscape --from-work
+```
+
+- `--from-work` runs the pushed tree. The files get a `_work` suffix (RS-13.1
+  used `_fix`).
+- Without the flag, the pass runs the image's own `/app` copy.
+- For the landscape still, show a picture in the same normal window:
+
+  ```powershell
+  .\youtube_window.ps1 -Open -Url file:///C:/path/to/picture.jpg -NoPlayerFullscreen
+  ```
+
+  Maximise it by hand and frame the camera on it.
+- `step1_pass.sh` refuses to start while anything holds `/dev/ttymxc3` or a
+  `tx_smoke` / `rx_smoke` / `synth_pub` container runs. A tx daemon would put
+  the camera frames on the air.
+
+## Where things go
+
+- **Evidence:** `$EVIDENCE_DIR`.
+  - The default is
+    `bench-evidence/RS_13_vector_scene_<UTC date>/legs/`, laid out as in
+    RS13_VECTOR_LEG.md, "Evidence layout".
+  - Set it explicitly for a session that crosses midnight UTC.
+  - `leg_prep.sh` and `leg_post.sh` save their own transcripts there
+    (`leg<X>_prep.txt`, `leg<X>_post_transcript.txt`).
+  - The staging md5s go to `staging_<role>.txt`.
+- **Scratch:** `$BENCH_SCRATCH`, for the harness wrappers and transcripts and
+  the LF-clean copies.
+- **Harness archives:** `bench-evidence/radio_monitor_<stamp>_<sha>/`, where
+  the harness puts them.
+- **Board captures** (`power_up_guard.sh --capture`): `$ARCHIVE_DIR`, outside
+  git.
+
+## Changes from the RS-13.1 originals
+
+- **Paths, serials, password, images.** All paths, serials, the password and
+  the image names come from `bench.env`.
+- **Merged step-1 script.** `step1_pass.sh` and `step1_pass_fix.sh` are now one
+  script (`--from-work`). It always recreates `bench_mqtt` and saves the
+  before/after retained listing to `step1_bench_mqtt_reset.txt`. It also runs
+  the scene check and pulls the pass files into the evidence folder.
+- **`stage_boards.sh`** also stages `/tmp/lifetrac_p0c/08_boot_user_app.cfg`
+  LF-clean. The harness's openocd reset of the tractor uses it. The staging
+  is md5-checked.
+- **`leg_prep.sh`**:
+  - enforces the DTS carrier;
+  - aborts on a radio-UART holder;
+  - picks the boot mode and strictness by tag;
+  - writes the harness command.
+- **`leg_post.sh`**:
+  - passes `--capture` to `rs12_leg_report.py` (A14);
+  - finds the archive by itself;
+  - flags a DTS leg flown on 915.000 MHz;
+  - retries the park.
+- **`leg_replay.py`** takes `--evidence-dir` or `--capture`. It runs from any
+  directory. On the RS-13.1 `2a_r4` capture it reproduces the recorded
+  `leg2a_r4_p2p4.txt` seq-gap line exactly.
+- **`power_up_guard.sh`** replaces `guard_both.sh`, `power_up_guard.sh` and
+  `tractor_guard_capture.sh`. It adds ssh for the base, `--check-only`, the
+  park retry and a refusal to probe while a leg container or a UART holder is
+  present.
+- **`youtube_window.ps1`** sends "f" only to a YouTube window, so a still
+  page is left alone.
+
+## Known limits
+
+- **The harness is adb-only.** `run_live_radio_monitor.ps1` drives both boards
+  over adb. With `BASE_TRANSPORT=ssh` you can stage, guard and check, but you
+  cannot fly a leg.
+- **The harness pushes its own copy of the reset cfg.** At every launch it
+  pushes `08_boot_user_app.cfg` from the working tree. The repo's
+  `.gitattributes` keeps `*.cfg` LF, so this matters only on a checkout made
+  before `.gitattributes` landed: there, with `core.autocrlf=true`, the copy
+  has CRLF line endings and overwrites the LF copy `stage_boards.sh` staged.
+- **`--capture` is adb-only.** `power_up_guard.sh --capture` calls
+  `pull_board_state.sh`, which is adb-only; it reads `BASE_SERIAL` and
+  `TRACTOR_SERIAL` from `bench.env`.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg2d_switch.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg2d_switch.sh
new file mode 100644
index 00000000..df811017
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg2d_switch.sh
@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+# leg2d_switch.sh -- the 2d operator-override switch on the base broker, per
+# RS13_VECTOR_LEG.md step 2 (2d): one ack subscriber for the whole leg (-R skips
+# the retained replay, %U stamps arrival on the base clock), then at T+60 s publish
+# {"mode":"vector","quality":80} and at T+180 s {"mode":"mono_g4"}, each stamped
+# on the base clock IN THE SAME board call as the publish (A13). T = the base
+# capture's first received frame, so the switch lands 60 s into the flowing leg.
+#
+# Usage:   bash leg2d_switch.sh [<leg>]     (default leg tag 2d; start it right
+#                                           after launching the 2d harness)
+# Inputs:  BASE_SERIAL / BASE_TRANSPORT, BASE_BROKER_CONTAINER; rs13_cap_base running
+#          (leg_prep.sh started it).
+# Writes:  $EVIDENCE_DIR/leg<leg>_switch_times.txt, leg<leg>_acks.txt
+# Boards:  base only: a mosquitto_sub inside the broker container (client id
+#          lt2d_<leg>_<pid>; only that one is killed at the end), two retained
+#          publishes to lifetrac/v25/control/encode_mode_override, and at the end a
+#          zero-length retained publish that clears the override again.
+# Radio:   THIS IS PART OF A RADIO LEG. rx_smoke relays each publish over the air
+#          as a 0x63 command (the base transmits; the tractor acks). Run it only
+#          inside a GO'd 2d leg. The final clear sends nothing over the air:
+#          image_rx_daemon ignores an empty payload. An EXIT trap clears the
+#          override and stops the subscriber on an abort too, so no harness run
+#          started later (a direct run, the run_rs12_* wrappers) replays it.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/leg2d_switch.sh
+#          (historical copy, unchanged).
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+LEG=${1:-2d}
+case $LEG in -h|--help) bench_usage; exit 0 ;; esac
+bench_check_name "leg tag" "$LEG"
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+M="docker exec $BASE_BROKER_CONTAINER"
+ACKS=/tmp/leg${LEG}_acks.txt                     # inside the broker container (its /tmp is not the host's)
+OVR=lifetrac/v25/control/encode_mode_override
+SUBID="lt2d_${LEG}_$$"                           # this run's subscriber, and only it, is killed
+
+SUB_UP=0; OVR_SET=0
+clear_override() {
+  board_sh base "$SUDO $M mosquitto_pub -h 127.0.0.1 -t $OVR -r -n" > /dev/null 2>&1
+}
+stop_sub() {                                     # no `sh -c` around pkill: it would match itself
+  board_sh base "$SUDO $M pkill -f $SUBID" > /dev/null 2>&1
+}
+leg2d_cleanup() {
+  if [ $OVR_SET = 1 ]; then clear_override; OVR_SET=0; stamp "cleanup: retained $OVR cleared"; fi
+  if [ $SUB_UP = 1 ]; then stop_sub; SUB_UP=0; stamp "cleanup: ack subscriber $SUBID stopped"; fi
+}
+trap leg2d_cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+SUB_UP=1
+board_sh base "$SUDO $M rm -f $ACKS; $SUDO docker exec -d $BASE_BROKER_CONTAINER sh -c \"mosquitto_sub -i $SUBID -h 127.0.0.1 -R -F '%U %p' -t lifetrac/v25/status/encode_mode > $ACKS\"" > /dev/null 2>&1
+stamp "ack subscriber $SUBID running inside $BASE_BROKER_CONTAINER"
+t0=$(date +%s)
+until [ "$(board_sh base "$SUDO docker logs rs13_cap_base 2>&1 | grep -c '^# *0 '" | tr -d ' ')" != "0" ]; do
+  if [ $(( $(date +%s) - t0 )) -gt 240 ]; then stamp "ABORT: no frame reached the base capture within 240 s"; exit 3; fi
+  sleep 2
+done
+stamp "T = first frame at the base capture"
+sleep 60
+# Stamp and publish in ONE board call: as two calls the return publish once started
+# 16.6 s after its stamp (2026-10-03 leg 2d_yt), which read as a 17 s switch delay.
+OVR_SET=1
+{ echo -n "vector "; board_sh base "date +%s.%N; $SUDO $M mosquitto_pub -h 127.0.0.1 -t $OVR -r -m '{\"mode\":\"vector\",\"quality\":80}' >/dev/null"; } | tee -a "$E/leg${LEG}_switch_times.txt"
+stamp "published vector override (T+60)"
+sleep 120
+{ echo -n "mono_g4 "; board_sh base "date +%s.%N; $SUDO $M mosquitto_pub -h 127.0.0.1 -t $OVR -r -m '{\"mode\":\"mono_g4\"}' >/dev/null"; } | tee -a "$E/leg${LEG}_switch_times.txt"
+stamp "published mono_g4 override (T+180)"
+sleep 130
+board_sh base "$SUDO $M sh -c 'cat $ACKS'" > "$E/leg${LEG}_acks.txt"
+stamp "acks collected: $(wc -l < "$E/leg${LEG}_acks.txt") lines -> $E/leg${LEG}_acks.txt"
+clear_override; OVR_SET=0
+stamp "retained $OVR cleared (empty retained publish; the rx daemon ignores it, nothing goes on the air)"
+stop_sub; SUB_UP=0
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_post.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_post.sh
new file mode 100644
index 00000000..3b24f265
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_post.sh
@@ -0,0 +1,185 @@
+#!/usr/bin/env bash
+# leg_post.sh -- after a leg's "[EVIDENCE] archived to <dir>" line: wait for the base
+# capture, collect its files, post-brackets on both boards, the leg reports
+# (rs12_leg_report.py WITH the base capture -- its "capture seq gaps" line is the
+# loss of record, RS-13.1 A14 -- and frag_gap_report.py), the P2/P4 greps, the
+# tractor-log, then PARK both radios last (PARK_TRANSIENT -> wait 60 s, park again).
+#
+# Usage:   bash leg_post.sh <leg> [<harness archive dir>] [--no-park]
+#   <leg>           the tag given to leg_prep.sh
+#   archive dir     bench-evidence/radio_monitor_<stamp>_<sha> (Windows or MSYS form).
+#                   Default: $BENCH_SCRATCH/leg<leg>_archive.txt (written by the
+#                   harness wrapper leg_prep.sh generates), else the "[EVIDENCE]
+#                   archived to" line of $BENCH_SCRATCH/leg<leg>_harness.txt.
+#   --no-park       skip the park (another leg follows at once; park after the last)
+# Inputs:  lib/bench_env.sh settings; the harness archive; the running rs13_cap_base.
+# Writes:  $EVIDENCE_DIR/leg<leg>_{base.txt,base.jsonl,base.json,post_base,post_tractor,
+#          report,gaps,p2p4,tractor_log,params,harness,park,post_transcript}.txt
+# Boards:  waits for and removes rs13_cap_base (a re-run finds it gone and keeps the
+#          files the first run wrote); then refuses the brackets and the park while a
+#          leg daemon (tx_smoke / rx_smoke / synth_pub / camera_svc) still runs or
+#          anything holds /dev/ttymxc3 -- an interrupted harness leaves them, and a
+#          park would race a live transmitter; rs115 probes and radio_park.py in --rm
+#          containers with /dev/ttymxc3 mapped, named lt_post_<board>. If this script
+#          is interrupted, its EXIT trap removes those lt_post_* containers (and only
+#          those). rs13_cap_base is left to finish on its own (receive-only, no device),
+#          so a re-run can still collect it.
+# Radio:   never transmits. The brackets' HostLink connect keeps the receiver up
+#          (RXCONT); radio_park.py writes SLEEP (0x80) and reads it back. The
+#          readback is not a persistent-off guarantee (BENCH_RUNBOOK): re-check
+#          later with power_up_guard.sh --check-only.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/leg_post.sh
+#          (historical copy, unchanged). New here: --capture on the leg report,
+#          the archive read from the transcript, the DTS-carrier check on
+#          params.txt, the park retry.
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+LEG=""; ARCH=""; PARK=1
+for a in "$@"; do
+  case $a in
+    --no-park) PARK=0 ;;
+    -h|--help) bench_usage; exit 0 ;;
+    -*) die "unknown option '$a'" ;;
+    *) if [ -z "$LEG" ]; then LEG=$a; elif [ -z "$ARCH" ]; then ARCH=$a; else die "extra argument '$a'"; fi ;;
+  esac
+done
+[ -n "$LEG" ] || { bench_usage; exit 2; }
+bench_check_name "leg tag" "$LEG"
+HT="$BENCH_SCRATCH/leg${LEG}_harness.txt"
+AP="$BENCH_SCRATCH/leg${LEG}_archive.txt"
+if [ -z "$ARCH" ] && [ -f "$AP" ]; then ARCH=$(tr -d '\r\n' < "$AP"); fi
+if [ -z "$ARCH" ] && [ -f "$HT" ]; then
+  # PowerShell wraps the Write-Host line at the console width, so the path may
+  # continue on the next line(s): rejoin until the folder holds params.txt.
+  mapfile -t _l < <(tr -d '\000' < "$HT" | tr -d '\r' | awk '/\[EVIDENCE\] archived to/ { n = NR; a = $0; b = ""; c = ""; next }
+    n && NR == n + 1 { b = $0 } n && NR == n + 2 { c = $0 } END { print a; print b; print c }')
+  _p=${_l[0]#*archived to }
+  for _i in 1 2 3; do
+    if [ -n "$_p" ] && [ -f "$(win_path "$_p")/params.txt" ]; then ARCH=$_p; break; fi
+    [ $_i -lt 3 ] && _p="$_p${_l[$_i]:-}"
+  done
+  unset _l _p _i
+fi
+[ -n "$ARCH" ] || die "no archive dir given, and none found in $AP or $HT"
+ARCH=$(win_path "$ARCH")
+[ -f "$ARCH/params.txt" ] || die "not a harness archive (no params.txt): $ARCH"
+
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+exec > >(tee -a "$E/leg${LEG}_post_transcript.txt") 2>&1
+hdr() { echo "# leg $LEG $1, $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock"; }
+param() { tr -d '\r' < "$ARCH/params.txt" | sed 's/^\xEF\xBB\xBF//' | sed -n "s/^$1=//p" | head -1; }
+
+# UART probes run in containers named lt_post_<board>; on an abort (error, Ctrl+C)
+# the EXIT trap removes the ones this run started, so none is left holding the UART.
+POST_STARTED=""
+post_cleanup() {
+  local w
+  for w in $POST_STARTED; do
+    board_sh "$w" "$SUDO docker rm -f lt_post_$w >/dev/null 2>&1" > /dev/null 2>&1
+  done
+  [ -n "$POST_STARTED" ] && stamp "cleanup: removed the probe container(s) this run started on:$POST_STARTED"
+  POST_STARTED=""
+}
+trap post_cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+probe_on() {   # probe_on WHO IMAGE SCRIPT: one UART probe in a container named lt_post_<who>
+  local who=$1
+  case " $POST_STARTED " in *" $who "*) ;; *) POST_STARTED="$POST_STARTED $who" ;; esac
+  board_sh "$who" "$SUDO ${PROBE_RUN/docker run /docker run --name lt_post_$who } $2 -u /work/$3 2>&1"
+}
+
+stamp "== leg $LEG post (archive $ARCH)"
+REGP=$(param reg_profile); FRF=$(param force_frf_hz)
+[ "$REGP" = 1 ] && PROF=image_bw250 || PROF=image_bw500
+
+stamp "-- waiting for the base capture (rs13_cap_base) to finish its 480 s"
+# Only when the container still exists: a re-run must not overwrite the first run's
+# capture log with "No such container".
+board_sh base "if $SUDO docker inspect rs13_cap_base >/dev/null 2>&1; then $SUDO docker wait rs13_cap_base >/dev/null 2>&1; $SUDO docker logs rs13_cap_base > $BOARD_STAGE/legs/leg${LEG}_base.txt 2>&1; $SUDO docker rm -f rs13_cap_base >/dev/null 2>&1; else echo '(rs13_cap_base is gone: using the capture files already on the board)'; fi; sed -n '/== vector dry run summary ==/,\$p' $BOARD_STAGE/legs/leg${LEG}_base.txt"
+for f in leg${LEG}_base.txt leg${LEG}_base.jsonl leg${LEG}_base.json; do
+  board_pull base "$BOARD_STAGE/legs/$f" "$E/$f" || echo "PULL FAILED $f"
+done
+
+stamp "-- radio quiet check before the brackets and the park"
+busy=""
+for who in base tractor; do
+  board_sh "$who" "$SUDO docker rm -f lt_post_$who >/dev/null 2>&1" > /dev/null 2>&1   # a leftover of an earlier run
+  d=$(printf '%s\n' $(board_containers "$who") | grep -E '^(tx_smoke|rx_smoke|synth_pub|camera_svc)$' | tr '\n' ' ' | sed 's/ $//')
+  h=$(board_uart_holders "$who")
+  echo "$who: leg daemons [$d] ttymxc3 holders [$h]"
+  { [ -n "$d" ] || [ -n "$h" ]; } && busy="$busy $who"
+done
+if [ -n "$busy" ]; then
+  stamp "ABORT before the brackets and the park: not quiet on:$busy (an interrupted harness leaves its daemons running,"
+  stamp "       and a park would race a live transmitter). Stop them: bash \"$(win_path "$LEGS_DIR/power_up_guard.sh")\" --stop-leg-daemons"
+  stamp "       (it parks too), then re-run: bash \"$(win_path "$LEGS_DIR/leg_post.sh")\" $LEG \"$ARCH\""
+  exit 3
+fi
+
+stamp "-- post-brackets (rs115) both boards"
+{ hdr "post bracket base"; probe_on base "$BASE_IMAGE" rs115_stats_probe.py; } > "$E/leg${LEG}_post_base.txt"
+{ hdr "post bracket tractor"; probe_on tractor "$TRACTOR_PROBE_IMAGE" rs115_stats_probe.py; } > "$E/leg${LEG}_post_tractor.txt"
+grep -h -E "^radio_(rx_ok|tx_ok|crc_err)=" "$E/leg${LEG}_post_base.txt" | tr '\n' ' '; echo " (base)"
+grep -h -E "^radio_(rx_ok|tx_ok|crc_err)=" "$E/leg${LEG}_post_tractor.txt" | tr '\n' ' '; echo " (tractor)"
+
+stamp "-- rs12_leg_report (--capture) + frag_gap_report"
+CAP=(); [ -f "$E/leg${LEG}_base.jsonl" ] && CAP=(--capture "$E/leg${LEG}_base.jsonl")
+PYTHONIOENCODING=utf-8 bench_py "$DC/tools/rs12_leg_report.py" "$ARCH" --pre "$E/leg${LEG}_pre_base.txt" \
+  --post "$E/leg${LEG}_post_base.txt" ${CAP[@]+"${CAP[@]}"} 2>&1 | tee "$E/leg${LEG}_report.txt" | head -8
+PYTHONIOENCODING=utf-8 bench_py "$BT_DIR/frag_gap_report.py" "$ARCH" 2>&1 | tee "$E/leg${LEG}_gaps.txt" | head -8
+
+stamp "-- P2 / P4 from the archive"
+{ echo "# leg $LEG P2/P4 greps on $ARCH"
+  echo "harness: reg_profile=$REGP force_frf_hz=$FRF tx_batch=$(param tx_batch) synth_fps=$(param synth_fps) cam_extra_env=$(param cam_extra_env)"
+  if [ "$REGP" = 2 ] && { [ "${FRF:-0}" = 0 ] || [ "$FRF" = 915000000 ]; }; then
+    echo "WARNING: this DTS leg flew on 915.000 MHz, the RS-11.6 emitter channel (RS-13.1 A19) -- say so in RESULTS"
+  fi
+  echo -n "published frame_id lines (rx_daemon.log): "; grep -c "published frame_id" "$ARCH/rx_daemon.log"
+  echo -n "tx done K=1 lines: "; grep -cE "done( \(pipelined\))?: 1 fragments ok" "$ARCH/tx_daemon.log"
+  echo -n "tx done K>=2 lines: "; grep -cE "done( \(pipelined\))?: ([2-9]|[1-9][0-9]+) fragments ok" "$ARCH/tx_daemon.log"
+  echo -n "tx ABORTED lines: "; grep -cE "ABORTED( \(pipelined\))?" "$ARCH/tx_daemon.log"
+  echo "max K: $(grep -oE 'done( \(pipelined\))?: [0-9]+ fragments ok' "$ARCH/tx_daemon.log" | grep -oE '[0-9]+ fragments' | sort -n | tail -1)"
+  echo -n "camera_service vector_stats lines: "
+  if [ -f "$ARCH/camera_service.log" ]; then grep -c vector_stats "$ARCH/camera_service.log"; else echo "no camera_service.log"; fi
+  echo "tx drops before air (last tx stats line): $(grep -oE 'drop_(full|stale)=[0-9]+' "$ARCH/tx_daemon.log" | tail -2 | tr '\n' ' ')"
+  echo "tractor FHSS authority (post bracket): $(grep -hoE '(tx_stream_streak_max|tx_first_anchor)=[0-9]+' "$E/leg${LEG}_post_tractor.txt" | tr '\n' ' ')"
+  echo -n "seq-gap loss (per codec run): "
+  if [ -f "$E/leg${LEG}_base.jsonl" ]; then
+    PYTHONIOENCODING=utf-8 bench_py "$LEGS_DIR/leg_replay.py" "$LEG" "$PROF" --evidence-dir "$E" 2>&1 | head -1
+  else
+    echo "no base capture"
+  fi
+} | tee "$E/leg${LEG}_p2p4.txt"
+if [ -f "$ARCH/camera_service.log" ]; then
+  PYTHONIOENCODING=utf-8 bench_py "$DC/tools/vector_dry_run.py" tractor-log "$ARCH/camera_service.log" 2>&1 | tee "$E/leg${LEG}_tractor_log.txt"
+fi
+cp "$ARCH/params.txt" "$E/leg${LEG}_params.txt" 2>/dev/null
+if [ -f "$HT" ]; then
+  if head -c 2 "$HT" | od -An -tx1 | grep -q 'ff fe'; then
+    iconv -f UTF-16 -t UTF-8 "$HT" | tr -d '\r' > "$E/leg${LEG}_harness.txt"
+  else
+    tr -d '\r' < "$HT" > "$E/leg${LEG}_harness.txt"
+  fi
+fi
+
+if [ $PARK = 1 ]; then
+  stamp "-- park both radios (last)"
+  hdr "park" >> "$E/leg${LEG}_park.txt"
+  todo="base tractor"
+  for attempt in 1 2 3; do
+    left=""
+    for who in $todo; do
+      r=$(probe_on "$who" "$(board_image "$who")" radio_park.py | tail -1)
+      printf '%-8s attempt %d: %s\n' "$who:" "$attempt" "$r" | tee -a "$E/leg${LEG}_park.txt"
+      case $r in PARK_OK*) ;; *) left="$left $who" ;; esac
+    done
+    todo=$left
+    [ -z "$todo" ] && break
+    [ $attempt -lt 3 ] && { stamp "not parked:$todo -- the scan SM may still be walking; waiting 60 s"; sleep 60; }
+  done
+  [ -n "$todo" ] && stamp "PARK NOT CONFIRMED on:$todo -- check with power_up_guard.sh --check-only before leaving the bench"
+fi
+POST_STARTED=""                          # finished normally: every probe container ended (--rm)
+stamp "== leg $LEG post done (evidence: $E)"
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_prep.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_prep.sh
new file mode 100644
index 00000000..69c4212e
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_prep.sh
@@ -0,0 +1,211 @@
+#!/usr/bin/env bash
+# leg_prep.sh -- prep for ONE radio leg, per BENCH_RUNBOOK "Prep" and
+# RS13_VECTOR_LEG.md step 2: no radio-UART holders, scene check, health probes on
+# both boards, clear_retained on the base broker, pre-brackets on both boards,
+# then the base-side vector_dry_run capture started DETACHED on the base (it
+# outlives this script and covers the harness's 300 s leg with --duration 480).
+# Ends by printing (and saving) the harness command for this leg.
+#
+# Usage:   bash leg_prep.sh <leg> <image_bw500|image_bw250> [options]
+#   <leg>          tag used in every file name, e.g. 2a, 2b_yt, 2c_r5 (letters,
+#                  digits, '_', '.', '-' only)
+#   image_bw500    DTS profile 2 (refused unless DTS_CARRIER_HZ is set, see below)
+#   image_bw250    FHSS profile 1
+# Options:
+#   --boot-mode vector|mono_g4   camera mode at boot (default: mono_g4 for legs
+#                  named 2c* / 2d*, vector otherwise)
+#   --fps N        camera rate for the harness -SynthFps (default 2)
+#   --strict | --no-strict   base capture --strict (default: strict, except 2c*/2d*)
+#   --min-frames N base capture --min-frames (default 500 at 2 fps; 250 at 1 fps,
+#                  200 for an FHSS leg at 1 fps -- RS13_VECTOR_LEG.md 2b)
+#   --no-scene-check   skip the scene check (only for a leg without the camera)
+#   --print-harness    only write and print the harness command (after the DTS
+#                  gate); touches no board, starts no capture -- a preview
+# Inputs:  lib/bench_env.sh settings; DTS_CARRIER_HZ / DTS_CARRIER_DATE for profile 2;
+#          PC_HOST (the harness -HostIp; when empty, this PC's only IPv4 address on
+#          BASE_HOST's /24, or its only IPv4 address at all, is used and printed --
+#          refused when ambiguous); the boards staged by stage_boards.sh.
+# Writes:  $EVIDENCE_DIR/leg<leg>_{prep,scene,health_base,health_tractor,clear_retained,
+#          pre_base,pre_tractor}.txt (+ _scene.jpg); $BENCH_SCRATCH/leg<leg>_harness.ps1;
+#          base: /tmp/lifetrac_strict/legs/leg<leg>_base.{jsonl,json} (capture, running).
+# Boards:  read-only checks; rs116/rs115 probes and clear_retained in --rm
+#          containers; starts the detached capture container rs13_cap_base on the base.
+# Radio:   the probes open /dev/ttymxc3 and the HostLink connect wakes the L072
+#          into RXCONT (receive-only). NOTHING here transmits -- the harness you
+#          launch next does. Run it only on the operator's explicit GO for this leg.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/leg_prep.sh
+#          (historical copy, unchanged). New here: DTS carrier gate, UART-holder
+#          abort, defaults by leg name, the printed harness command.
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+LEG=""; PROFILE=""; MODE=""; FPS=2; STRICT=""; MINF=""; SCENE=1; PRINT_ONLY=0
+while [ $# -gt 0 ]; do
+  case $1 in
+    --print-harness) PRINT_ONLY=1 ;;
+    --boot-mode) MODE=${2:?--boot-mode vector|mono_g4}; shift ;;
+    --fps) FPS=${2:?--fps N}; shift ;;
+    --strict) STRICT="--strict" ;;
+    --no-strict) STRICT="none" ;;
+    --min-frames) MINF=${2:?--min-frames N}; shift ;;
+    --no-scene-check) SCENE=0 ;;
+    -h|--help) bench_usage; exit 0 ;;
+    -*) die "unknown option '$1'" ;;
+    *) if [ -z "$LEG" ]; then LEG=$1; elif [ -z "$PROFILE" ]; then PROFILE=$1; else die "extra argument '$1'"; fi ;;
+  esac
+  shift
+done
+[ -n "$LEG" ] && [ -n "$PROFILE" ] || { bench_usage; exit 2; }
+bench_check_name "leg tag" "$LEG"
+case $PROFILE in
+  image_bw500) REGP=2 ;;
+  image_bw250) REGP=1 ;;
+  *) die "profile must be image_bw500 (DTS, profile 2) or image_bw250 (FHSS, profile 1), not '$PROFILE'" ;;
+esac
+case $LEG in 2c*|2d*) def_mode=mono_g4; def_strict=none ;; *) def_mode=vector; def_strict=--strict ;; esac
+MODE=${MODE:-$def_mode}; STRICT=${STRICT:-$def_strict}; [ "$STRICT" = none ] && STRICT=""
+case $MODE in
+  vector) CAM_ENV="-e LIFETRAC_ENCODE_MODE=9 -e LIFETRAC_VECTOR_DETAIL=80" ;;
+  mono_g4) CAM_ENV="-e LIFETRAC_ENCODE_MODE=6" ;;
+  *) die "--boot-mode must be vector or mono_g4" ;;
+esac
+case $FPS in ''|*[!0-9.]*) die "--fps must be a number" ;; esac
+if [ -z "$MINF" ]; then
+  if [ "$FPS" = 1 ]; then [ $REGP = 1 ] && MINF=200 || MINF=250; else MINF=500; fi
+fi
+
+# DTS gate: never fly profile 2 on an unchecked carrier (RS-13.1 A19)
+if [ $REGP = 2 ]; then bench_require_dts_carrier || exit 5; fi
+[ "$BASE_TRANSPORT" = ssh ] && echo "NOTE: BASE_TRANSPORT=ssh -- run_live_radio_monitor.ps1 drives the base over adb ($BASE_SERIAL); it must be on USB too."
+
+# --- the PC's address for the harness (-HostIp) -----------------------------------
+# Without -HostIp the harness falls back to the original bench PC's lease, and the
+# base rx daemon's control plane is dead on any other PC. Never omit it.
+pc_ipv4s() {   # this PC's IPv4 addresses, minus loopback and link-local
+  if command -v powershell.exe > /dev/null 2>&1; then
+    powershell.exe -NoProfile -NonInteractive -Command \
+      "Get-NetIPAddress -AddressFamily IPv4 -ErrorAction SilentlyContinue | ForEach-Object { \$_.IPAddress }" 2>/dev/null
+  elif command -v ip > /dev/null 2>&1; then
+    ip -4 -o addr show scope global 2>/dev/null | awk '{ sub(/\/.*/, "", $4); print $4 }'
+  fi | tr -d '\r' | grep -E '^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$' | grep -vE '^(127\.|169\.254\.)' | sort -u
+}
+if [ -z "$PC_HOST" ]; then
+  cands=$(pc_ipv4s)
+  pick=""
+  same=""
+  case $BASE_HOST in
+    *[!0-9.]*|'') ;;
+    *.*.*.*) same=$(printf '%s\n' "$cands" | awk -v p="${BASE_HOST%.*}." 'NF && index($0, p) == 1') ;;
+  esac
+  n_same=$(printf '%s\n' "$same" | grep -c .)
+  n_all=$(printf '%s\n' "$cands" | grep -c .)
+  if [ "$n_same" = 1 ]; then pick=$same; why="the only one on BASE_HOST $BASE_HOST's /24"
+  elif [ "$n_same" = 0 ] && [ "$n_all" = 1 ]; then pick=$cands; why="this PC's only IPv4 address"
+  fi
+  if [ -z "$pick" ]; then
+    echo "REFUSED: PC_HOST is empty and this PC's LAN address is ambiguous (IPv4 candidates: $(printf '%s ' $cands | sed 's/ $//'))." >&2
+    echo "         Set PC_HOST in $BT_DIR/bench.env to the address the boards reach this PC on." >&2
+    exit 6
+  fi
+  PC_HOST=$pick
+  echo "NOTE: PC_HOST is empty -- using $PC_HOST ($why) as the harness -HostIp; set PC_HOST in bench.env to pin it."
+fi
+case $PC_HOST in
+  *[!A-Za-z0-9.:-]*) die "PC_HOST '$PC_HOST' is not a plain address or host name" ;;
+esac
+
+# --- the harness command for this leg ---------------------------------------------
+FRF=""; [ $REGP = 2 ] && FRF=" -ForceFrfHz $DTS_CARRIER_HZ"
+HIP=" -HostIp $PC_HOST"
+LOGW=$(win_path "$BENCH_SCRATCH/leg${LEG}_harness.txt")
+ARCW=$(win_path "$BENCH_SCRATCH/leg${LEG}_archive.txt")
+PS1="$BENCH_SCRATCH/leg${LEG}_harness.ps1"
+HARNESS=".\\run_live_radio_monitor.ps1 -TxAdbSerial $TRACTOR_SERIAL -RxAdbSerial $BASE_SERIAL$HIP -TxFeed camera -RegProfile $REGP$FRF -DurationS 300 -SynthFps $FPS -KfRequestDisable 1 -ProbeEcho 0 -LogFragArrivals 1 -TxBatch 0 -CamExtraEnv \"$CAM_ENV\" -Archive"
+write_harness() {
+  # Tee-Object (Windows PowerShell 5.1) writes UTF-16; leg_post.sh converts the
+  # transcript. The archive the harness creates is written to leg<leg>_archive.txt,
+  # where leg_post.sh looks first.
+  rm -f "$BENCH_SCRATCH/leg${LEG}_archive.txt" "$BENCH_SCRATCH/leg${LEG}_harness.txt"   # no stale pointer for leg_post
+  cat > "$PS1" <<EOF
+# leg $LEG harness, written by leg_prep.sh $(date -u +%Y-%m-%dT%H:%M:%SZ). Run it in PowerShell, never from bash.
+Set-Location "$(win_path "$HELPER_DIR")"
+\$t0 = Get-Date
+& { "# leg $LEG harness launched \$((Get-Date).ToUniversalTime().ToString('yyyy-MM-dd HH:mm:ss'))Z"
+    $HARNESS } *>&1 | Tee-Object -FilePath "$LOGW"
+\$a = Get-ChildItem -Directory "$(win_path "$DC/bench-evidence")" -Filter "radio_monitor_*" | Where-Object { \$_.CreationTime -ge \$t0 } | Sort-Object CreationTime | Select-Object -Last 1
+if (\$a) { \$a.FullName | Out-File -Encoding ascii "$ARCW"; "leg $LEG archive: \$(\$a.FullName)" } else { "leg $LEG - no new radio_monitor_* archive (harness aborted?)" }
+EOF
+}
+print_next() {
+  echo "   & \"$(win_path "$PS1")\""
+  echo "   which runs, from $(win_path "$HELPER_DIR"):"
+  echo "   $HARNESS"
+  case $LEG in 2d*) echo "   then, right after the launch, in Git Bash: bash \"$(win_path "$LEGS_DIR/leg2d_switch.sh")\" $LEG";; esac
+  echo "   while frames flow:            bash \"$(win_path "$LEGS_DIR/link_sample.sh")\" $LEG"
+  echo "   after '[EVIDENCE] archived to':  bash \"$(win_path "$LEGS_DIR/leg_post.sh")\" $LEG"
+  if [ "${1:-}" = probed ]; then
+    echo "   NOT flying after all (no GO, harness refused, round aborted)? The probes left both L072s"
+    echo "   listening (RXCONT) and rs13_cap_base is running. Stop the capture and park both radios:"
+    echo "                                 bash \"$(win_path "$LEGS_DIR/power_up_guard.sh")\" --stop-leg-daemons"
+  fi
+}
+if [ $PRINT_ONLY = 1 ]; then
+  write_harness
+  echo "harness wrapper for leg $LEG written (preview only; no board was touched, no capture is running):"
+  print_next
+  exit 0
+fi
+
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+exec > >(tee -a "$E/leg${LEG}_prep.txt") 2>&1
+hdr() { echo "# leg $LEG $1, $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock"; }
+
+stamp "== leg $LEG prep (profile $PROFILE = harness -RegProfile $REGP, boot $MODE, $FPS fps, capture min-frames $MINF ${STRICT:-no-strict}) from $(bench_git_desc)"
+for who in tractor base; do board_present "$who" || { stamp "ABORT: $who ($(board_serial $who)) not reachable via $(board_via $who)"; exit 3; }; done
+
+stamp "-- production camera unit / radio-UART holders"
+cam=$(board_sh tractor "systemctl is-active lifetrac-camera.service")
+tc=$(board_containers tractor); bc=$(board_containers base)
+th=$(board_uart_holders tractor); bh=$(board_uart_holders base)
+echo "tractor: lifetrac-camera=$cam containers=[$tc] ttymxc3 holders=[$th]"
+echo "base:    containers=[$bc] ttymxc3 holders=[$bh]"
+if [ "$cam" = active ] || echo " $tc " | grep -q ' tractor-camera ' || [ -n "$th" ] || [ -n "$bh" ]; then
+  stamp "ABORT: the radio UART is not free. Tractor: systemctl stop lifetrac-camera.service; docker stop tractor-camera"
+  stamp "       (or bash power_up_guard.sh); stop any leftover tx_smoke / rx_smoke / camera_svc container; then re-run."
+  exit 3
+fi
+board_sh base "$SUDO docker rm -f rs13_cap_base >/dev/null 2>&1" > /dev/null 2>&1
+
+if [ $SCENE = 1 ]; then
+  stamp "-- scene: bench video window to the front + camera check (camera only)"
+  bash "$LEGS_DIR/scene_check.sh" "leg${LEG}" || { stamp "ABORT: scene check failed (see SCENE-CHECK line above) - fix the screen/aim before this leg"; exit 4; }
+fi
+
+stamp "-- health probes (rs116) both boards"
+{ hdr "health base"; board_sh base "$SUDO $PROBE_RUN $BASE_IMAGE -u /work/rs116_health_probe.py 2>&1"; } > "$E/leg${LEG}_health_base.txt"
+grep -E "STATS-OK|STATS-FAILED|radio_state|RS12-URC" "$E/leg${LEG}_health_base.txt" | head -4
+{ hdr "health tractor"; board_sh tractor "$SUDO $PROBE_RUN $TRACTOR_PROBE_IMAGE -u /work/rs116_health_probe.py 2>&1"; } > "$E/leg${LEG}_health_tractor.txt"
+grep -E "STATS-OK|STATS-FAILED|radio_state|RS12-URC" "$E/leg${LEG}_health_tractor.txt" | head -4
+
+stamp "-- clear retained control topics on the base broker"
+{ hdr "clear_retained base broker"; board_sh base "$SUDO $WORK_RUN $BASE_IMAGE -u /work/clear_retained.py 2>&1"; } | tee "$E/leg${LEG}_clear_retained.txt" | tail -1
+
+stamp "-- pre-brackets (rs115) both boards"
+{ hdr "pre bracket base"; board_sh base "$SUDO $PROBE_RUN $BASE_IMAGE -u /work/rs115_stats_probe.py 2>&1"; } > "$E/leg${LEG}_pre_base.txt"
+{ hdr "pre bracket tractor"; board_sh tractor "$SUDO $PROBE_RUN $TRACTOR_PROBE_IMAGE -u /work/rs115_stats_probe.py 2>&1"; } > "$E/leg${LEG}_pre_tractor.txt"
+grep -h -E "^radio_(rx_ok|tx_ok|crc_err)=" "$E/leg${LEG}_pre_base.txt" | tr '\n' ' '; echo " (base)"
+grep -h -E "^radio_(rx_ok|tx_ok|crc_err)=" "$E/leg${LEG}_pre_tractor.txt" | tr '\n' ' '; echo " (tractor)"
+
+stamp "-- base-side capture, detached (docker rs13_cap_base): profile $PROFILE, 480 s, min-frames $MINF ${STRICT:-no-strict}"
+board_sh base "$SUDO rm -f $BOARD_STAGE/legs/leg${LEG}_base.jsonl $BOARD_STAGE/legs/leg${LEG}_base.json; \
+  $SUDO docker run -d --name rs13_cap_base --network=host -v $BOARD_STAGE:/work -w /work \
+  -e PYTHONPATH=/work:/work/paho -e PYTHONUNBUFFERED=1 --entrypoint python3 $BASE_IMAGE \
+  /work/vector_dry_run.py capture --topic lifetrac/v25/video/tile_delta --profile $PROFILE \
+  --duration 480 --min-frames $MINF --out /work/legs/leg${LEG}_base.jsonl --json /work/legs/leg${LEG}_base.json $STRICT" \
+  | cut -c1-12 | sed 's/^/rs13_cap_base id /'
+sleep 3
+board_sh base "$SUDO docker logs rs13_cap_base 2>&1 | head -3"
+
+write_harness
+stamp "== leg $LEG prep done -> launch the harness NOW (the capture is already listening), in PowerShell:"
+print_next probed
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_replay.py b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_replay.py
new file mode 100644
index 00000000..cf445ae3
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/leg_replay.py
@@ -0,0 +1,72 @@
+"""leg_replay.py -- replay a leg's base capture: post-lock seq gaps, resync episodes
+vs epoch starts (the P1 loss rule), orphan bursts, last DIGEST checked.
+
+Usage (PC, any working directory):
+    py -3 leg_replay.py <leg> <image_bw500|image_bw250> [--evidence-dir DIR | --capture FILE]
+
+    <leg>            the leg tag; reads <DIR>/leg<leg>_base.jsonl
+    --evidence-dir   the legs/ folder holding the capture (default: $EVIDENCE_DIR,
+                     which lib/bench_env.sh exports)
+    --capture        a capture file directly (overrides --evidence-dir)
+
+Reads only the capture; touches no board and no radio. leg_post.sh prints its
+first line as the "seq-gap loss (per codec run)" row of leg<leg>_p2p4.txt.
+Origin: bench-evidence/RS_13_vector_scene_2026-09-26/scripts/leg_replay.py
+(historical copy, unchanged; it hardcoded the RS-13.1 legs folder and had to run
+from DESIGN-CONTROLLER).
+"""
+import argparse
+import collections
+import os
+import sys
+from pathlib import Path
+
+DC = Path(__file__).resolve().parents[4]          # legs -> bench_tools -> helper -> firmware -> DESIGN-CONTROLLER
+sys.path.insert(0, str(DC / "tools"))             # vector_dry_run puts base_station/ on sys.path itself
+import vector_dry_run as v  # noqa: E402
+
+ap = argparse.ArgumentParser(description=__doc__.splitlines()[0])
+ap.add_argument("leg")
+ap.add_argument("profile", choices=["image_bw500", "image_bw250"])
+ap.add_argument("--evidence-dir", default=os.environ.get("EVIDENCE_DIR"))
+ap.add_argument("--capture")
+args = ap.parse_args()
+if args.capture:
+    cap = Path(args.capture)
+elif args.evidence_dir:
+    cap = Path(args.evidence_dir) / f"leg{args.leg}_base.jsonl"
+else:
+    ap.error("give --evidence-dir or --capture (or set EVIDENCE_DIR)")
+if not cap.is_file():
+    ap.error(f"no capture at {cap}")
+
+leg, prof = args.leg, args.profile
+dr = v.DryRun(prof, min_frames=250)
+prev = False; episodes = []; start = None; keys = []; seqs = []; codecs = []; orph = collections.Counter(); po = 0; bad = []; lastd = None
+for ts, topic, payload in v.iter_capture(str(cap)):
+    row = dr.feed(payload, ts); st = dr.store.stats; seqs.append(row.seq); codecs.append(row.codec)
+    if row.vector and row.frame_kind == 1: keys.append(row.idx)
+    if row.digest == "BAD": bad.append(row.idx)
+    if row.digest in ("ok", "BAD"): lastd = (row.idx, row.digest)
+    if st["orphans"] > po: orph[row.idx] = st["orphans"] - po
+    po = st["orphans"]
+    if st["resync"] and not prev: start = row.idx
+    if prev and not st["resync"]: episodes.append((start, row.idx, row.frame_kind == 1)); start = None
+    prev = st["resync"]
+if prev: episodes.append((start, None, False))
+if not seqs:
+    print(f"leg {leg}: 0 frames in {cap}")
+    raise SystemExit(1)
+# seq is a u8 per codec, and each codec keeps its own counter (a mono_g4 <-> VECTOR
+# switch restarts it), so only consecutive frames of the SAME codec are compared.
+gaps = [(i, (b - a) % 256 - 1) for i, ((a, ca), (b, cb)) in enumerate(zip(zip(seqs, codecs), zip(seqs[1:], codecs[1:])), start=1)
+        if ca == cb and (b - a) % 256 > 1]
+switches = sum(1 for ca, cb in zip(codecs, codecs[1:]) if ca != cb)
+lost = sum(g for _, g in gaps)
+print(f"leg {leg}: {len(seqs)} frames received; seq gaps within same-codec runs (row, lost): {gaps} -> {lost} lost of {len(seqs) + lost} = {100.0 * lost / (len(seqs) + lost):.1f} % after the first received frame ({switches} codec switch(es) not counted)")
+print(f"  resync episodes (start, end, ended by key): {episodes}")
+print(f"  all ended by an epoch start: {all(e[2] for e in episodes)}; final resync {dr.store.stats['resync']}, digest_ok {dr.store.snapshot(int(dr.last_ts * 1000) + 100)['digest_ok']}")
+print(f"  last DIGEST checked (row, result): {lastd}; last epoch start row {keys[-1] if keys else None}, {len(seqs) - 1 - keys[-1] if keys else None} frame(s) before the end (no DIGEST inside TTL_FRAMES+3 of a range-1/2 start, encode_vector.py)")
+print(f"  key rows ({len(keys)}): {keys[:50]}")
+print(f"  BAD rows ({len(bad)}): {bad[:80]}")
+print(f"  orphan bursts top: {orph.most_common(8)}; orphans {dr.store.stats['orphans']}, ttl_dropped {dr.store.stats['ttl_dropped']}")
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/link_sample.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/link_sample.sh
new file mode 100644
index 00000000..80fe4922
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/link_sample.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# link_sample.sh -- DURING a leg (P7): wait for the first base link_stats message
+# that has seen frames, keep it, then show the first frame line of the base
+# capture. rx_codec_name must read "vector" on a VECTOR leg.
+#
+# Usage:   bash link_sample.sh <leg>        (start it once the harness is running)
+# Inputs:  BASE_SERIAL / BASE_TRANSPORT, BASE_BROKER_CONTAINER.
+# Writes:  $EVIDENCE_DIR/leg<leg>_link_stats.txt
+# Boards:  base only, read-only: `mosquitto_sub -C 1` inside the base broker
+#          container (up to 40 tries, 40 s each) and `docker logs rs13_cap_base`.
+# Radio:   none; never transmits.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/link_sample.sh
+#          (historical copy, unchanged).
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+LEG=${1:-}
+case $LEG in -h|--help|'') bench_usage; exit 0 ;; esac
+bench_check_name "leg tag" "$LEG"
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+
+{ echo "# leg $LEG link_stats (base broker): first message with frames; sampler started $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock"
+  for i in $(seq 1 40); do
+    m=$(board_sh base "$SUDO docker exec $BASE_BROKER_CONTAINER mosquitto_sub -h 127.0.0.1 -C 1 -W 40 -t lifetrac/v25/video/link_stats")
+    if printf '%s\n' "$m" | grep -q '"rx_frames_seen": [1-9]'; then echo "$(date -u +%H:%M:%SZ) $m"; break; fi
+    sleep 4
+  done; } | tee "$E/leg${LEG}_link_stats.txt" | tail -1 | cut -c1-420
+echo "rx_codec_name: $(grep -oE '"rx_codec_name": "[^"]*"' "$E/leg${LEG}_link_stats.txt" | tail -1)"
+echo "=== first frame at the base"
+board_sh base "$SUDO docker logs rs13_cap_base 2>&1 | grep '^#' | head -1" | cut -c1-140
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/power_up_guard.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/power_up_guard.sh
new file mode 100644
index 00000000..005450ae
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/power_up_guard.sh
@@ -0,0 +1,168 @@
+#!/usr/bin/env bash
+# power_up_guard.sh -- keep the L072 radios quiet when the bench boards come up, and
+# the end-of-session radio check. Waits for each board; as each one answers:
+#   tractor: stop lifetrac-camera.service + the tractor-camera container (they map
+#            /dev/ttymxc3, the radio UART, at every boot);
+#   both:    report units, containers and /dev/ttymxc3 holders; stage only the
+#            probe tools; read the radio with the read-only radio_state.py; if it is
+#            not in SLEEP (0x80) -- the L072 boots into RXCONT, listening -- park it
+#            with radio_park.py, re-read after 20 s, and retry (60 s apart, 3 tries).
+#
+# Usage:   bash power_up_guard.sh [options]
+#   --timeout MIN        give up waiting after MIN minutes (default 115)
+#   --only base|tractor  handle one board
+#   --wait-power-cycle   arm BEFORE switching power on: a board already up for more
+#                        than 30 min is ignored until it has rebooted
+#   --check-only         report and run radio_state.py; stop nothing, park nothing
+#                        (the end-of-session check, BENCH_RUNBOOK). It stages the
+#                        probe files only if they are missing.
+#   --no-park            stop the camera and read the state, but do not park
+#   --stop-leg-daemons   also stop leftover tx_smoke / rx_smoke / synth_pub /
+#                        camera_svc / rs13_cap* containers (a harness that was
+#                        interrupted leaves them running; tx_smoke can transmit).
+#                        Without it a board with one running is reported, not probed.
+#   --capture            after a board is handled, run the read-only
+#                        pull_board_state.sh <role> (adb only; BENCH_BOARDS.md)
+# Inputs:  lib/bench_env.sh settings: serials, BASE_TRANSPORT (adb, or ssh when the
+#          base does not enumerate on USB), the probe images.
+# Writes:  board: /tmp/lifetrac_strict/{probes,radio_park.py,radio_state.py,paho};
+#          PC: log $BENCH_SCRATCH/power_up_guard_<UTC date>.log
+#          (+ the archive of pull_board_state.sh with --capture, in $ARCHIVE_DIR).
+# Boards:  systemctl stop lifetrac-camera / docker stop tractor-camera (tractor, not
+#          with --check-only); --rm probe containers with /dev/ttymxc3 mapped.
+# Radio:   NEVER transmits. radio_state.py only reads RegOpMode; radio_park.py writes
+#          STANDBY -> SLEEP. A probe's HostLink connect can wake the receiver
+#          (RXCONT, receive-only). The park readback is not a persistent-off
+#          guarantee (BENCH_RUNBOOK): it holds once the firmware's scan state machine
+#          has failed out, up to ~2 min after the daemons stop.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/guard_both.sh,
+#          power_up_guard.sh and tractor_guard_capture.sh (historical copies,
+#          unchanged), generalised.
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+TIMEOUT_MIN=115; ONLY=""; WAIT_PC=0; CHECK=0; PARK=1; STOPD=0; CAPTURE=0
+while [ $# -gt 0 ]; do
+  case $1 in
+    --timeout) TIMEOUT_MIN=${2:?--timeout MIN}; shift ;;
+    --only) ONLY=${2:?--only base|tractor}; shift ;;
+    --wait-power-cycle) WAIT_PC=1 ;;
+    --check-only) CHECK=1; PARK=0 ;;
+    --no-park) PARK=0 ;;
+    --stop-leg-daemons) STOPD=1 ;;
+    --capture) CAPTURE=1 ;;
+    -h|--help) bench_usage; exit 0 ;;
+    *) die "unknown argument '$1'" ;;
+  esac
+  shift
+done
+case $ONLY in ''|base|tractor) ;; *) die "--only base|tractor" ;; esac
+case $TIMEOUT_MIN in ''|*[!0-9]*) die "--timeout takes whole minutes" ;; esac
+ROLES="tractor base"; [ -n "$ONLY" ] && ROLES=$ONLY
+STAMP_LOG="$BENCH_SCRATCH/power_up_guard_$(date -u +%Y-%m-%d).log"
+LEG_DAEMONS='^(tx_smoke|rx_smoke|synth_pub|camera_svc|rs13_cap|rs13_cap_base)$'
+
+radio_read() {   # $1 who, $2 image -> the RADIO_STATE / STATE_FAIL line
+  board_sh "$1" "$SUDO $PROBE_RUN $2 -u /work/radio_state.py 2>&1 | tail -1"
+}
+is_sleep() { printf '%s\n' "$1" | grep -q '"reg_op_mode": "0x80"'; }
+
+handle() {   # $1 role; returns 0 when the radio reads SLEEP (or was left as asked)
+  local who=$1 img st r attempt holders names daemons
+  stamp "$who $(board_serial "$who") is up via $(board_via "$who"): $(board_sh "$who" uptime)"
+  if [ "$who" = tractor ]; then
+    if [ $CHECK = 0 ]; then
+      board_sh "$who" "$SUDO systemctl stop lifetrac-camera.service; $SUDO docker stop tractor-camera" 2>&1 | sed 's/^/   /' | tee -a "$STAMP_LOG"
+    fi
+    stamp "tractor: lifetrac-camera.service -> $(board_sh "$who" 'systemctl is-active lifetrac-camera.service')"
+  fi
+  names=$(board_containers "$who")
+  stamp "$who containers: [$names]"
+  daemons=$(printf '%s\n' $names | grep -E "$LEG_DAEMONS" | tr '\n' ' ' | sed 's/ $//')
+  if [ -n "$daemons" ]; then
+    if [ $STOPD = 1 ] && [ $CHECK = 0 ]; then
+      stamp "$who: stopping leftover leg containers: $daemons"
+      board_sh "$who" "$SUDO docker stop -t 3 $daemons" 2>&1 | sed 's/^/   /' | tee -a "$STAMP_LOG"
+    else
+      stamp "$who: LEG CONTAINER(S) RUNNING: $daemons -- the radio may be in use; not probing (re-run with --stop-leg-daemons)"
+      return 1
+    fi
+  fi
+  holders=$(board_uart_holders "$who")
+  stamp "$who /dev/ttymxc3 holders (pids): [$holders]"
+  case $holders in
+    unknown*) stamp "$who: cannot tell whether anything holds the radio UART ($holders) -- not probing"; return 1 ;;
+  esac
+  if [ -n "$holders" ]; then
+    stamp "$who: radio UART busy -- not probing. Identify the holder (ps -p $holders) and stop it."
+    return 1
+  fi
+
+  # stage only the probe tools (no code tree); --check-only keeps an existing staging
+  if [ $CHECK = 0 ] || ! board_sh "$who" "test -f $BOARD_STAGE/radio_state.py && test -f $BOARD_STAGE/method_h_stage2_tx_probe_v2.py && test -d $BOARD_STAGE/paho" > /dev/null; then
+    board_sh "$who" "$SUDO mkdir -p $BOARD_STAGE/legs; $SUDO chmod 0777 $BOARD_STAGE $BOARD_STAGE/legs" > /dev/null
+    for f in "$HELPER_DIR/method_g_stage1_probe.py" "$HELPER_DIR/method_h_stage2_tx_probe_v2.py" "$HELPER_DIR/rs115_stats_probe.py" \
+             "$HELPER_DIR/rs116_health_probe.py" "$BT_DIR/radio_park.py" "$BT_DIR/radio_state.py"; do
+      board_push "$who" "$f" "$BOARD_STAGE/" || stamp "PUSH FAILED $f"
+    done
+    board_sh "$who" "$SUDO rm -rf $BOARD_STAGE/paho" > /dev/null
+    board_push "$who" "$REPO_ROOT/_paho_pull/paho" "$BOARD_STAGE/" || stamp "PUSH FAILED paho"
+  fi
+
+  img=$(board_image "$who")
+  if ! board_has_image "$who" "$img"; then
+    if board_has_image "$who" "$TRACTOR_PROBE_IMAGE"; then img=$TRACTOR_PROBE_IMAGE
+    elif board_has_image "$who" "$BASE_IMAGE"; then img=$BASE_IMAGE
+    else stamp "$who: no probe image ($BASE_IMAGE / $TRACTOR_PROBE_IMAGE) -- radio state unknown (the L072 boots into RXCONT, receive-only)"; return 1
+    fi
+  fi
+  st=$(radio_read "$who" "$img")
+  stamp "$who radio: $st"
+  is_sleep "$st" && return 0
+  if [ $PARK = 0 ]; then stamp "$who: not parked ($([ $CHECK = 1 ] && echo check-only || echo --no-park))"; return 1; fi
+  for attempt in 1 2 3; do
+    r=$(board_sh "$who" "$SUDO $PROBE_RUN $img -u /work/radio_park.py 2>&1 | tail -1")
+    stamp "$who park attempt $attempt: $r"
+    sleep 20
+    st=$(radio_read "$who" "$img")
+    stamp "$who radio after park: $st"
+    is_sleep "$st" && return 0
+    [ $attempt -lt 3 ] && { stamp "$who: still not 0x80 -- the scan SM may be walking; waiting 60 s"; sleep 60; }
+  done
+  stamp "$who: PARK NOT CONFIRMED after 3 attempts"
+  return 1
+}
+
+declare -A done_=() seen_old=()
+end=$(( $(date +%s) + TIMEOUT_MIN * 60 ))
+rc=0
+stamp "guard armed for [$ROLES] ($([ $CHECK = 1 ] && echo check-only || echo park-if-listening)); waiting up to $TIMEOUT_MIN min; log $STAMP_LOG"
+while [ "$(date +%s)" -lt $end ]; do
+  for who in $ROLES; do
+    [ -n "${done_[$who]:-}" ] && continue
+    board_present "$who" || continue
+    if [ $WAIT_PC = 1 ]; then
+      up=$(board_sh "$who" "cut -d. -f1 /proc/uptime" | tr -d ' ')
+      if [ "${up:-0}" -gt 1800 ] 2>/dev/null; then
+        [ -z "${seen_old[$who]:-}" ] && { stamp "$who visible but up ${up}s (not freshly booted); waiting for the power cycle"; seen_old[$who]=1; }
+        continue
+      fi
+    fi
+    handle "$who" || rc=1
+    done_[$who]=1
+    if [ $CAPTURE = 1 ]; then
+      if [ "$(board_via "$who")" = adb ]; then
+        stamp "$who capture start (pull_board_state.sh, read-only)"
+        ARCHIVE="$ARCHIVE_DIR" bash "$BT_DIR/pull_board_state.sh" "$who" 2>&1 | tee -a "$STAMP_LOG" | tail -8
+        stamp "$who capture done"
+      else
+        stamp "$who: --capture needs adb (pull_board_state.sh is adb-only); skipped"
+      fi
+    fi
+  done
+  all=1; for who in $ROLES; do [ -n "${done_[$who]:-}" ] || all=0; done
+  if [ $all = 1 ]; then stamp "guard finished (rc $rc)"; exit $rc; fi
+  sleep 3
+done
+for who in $ROLES; do [ -n "${done_[$who]:-}" ] || stamp "TIMEOUT: $who did not appear$([ $WAIT_PC = 1 ] && echo ' (or was not power-cycled)') within $TIMEOUT_MIN min"; done
+exit 2
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/push_fix_to_board.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/push_fix_to_board.sh
new file mode 100644
index 00000000..550017e7
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/push_fix_to_board.sh
@@ -0,0 +1,78 @@
+#!/usr/bin/env bash
+# push_fix_to_board.sh -- push THIS checkout's image-path code tree to
+# /tmp/lifetrac_strict on one board, so a step-1 pass (step1_pass.sh --from-work)
+# and the harness legs run the checkout's camera_service.py / encoder / store
+# without an image rebuild. stage_boards.sh calls it for both boards.
+#
+# Usage:   bash push_fix_to_board.sh [tractor|base|<adb serial>] [--no-smoke]   (default: tractor)
+# Inputs:  this checkout: firmware/tractor_x8/{camera_service.py,image_tx_daemon.py,
+#          x8_image_pipeline/}, base_station/{lora_proto.py,image_pipeline/},
+#          tools/vector_dry_run.py. The name keeps the RS-13.1 one ("the fix
+#          branch"); it pushes whatever branch is checked out.
+# Writes:  board: those files under /tmp/lifetrac_strict (old copies of the two
+#          package dirs removed first, __pycache__ cleared);
+#          PC: md5 of every pushed file appended to $EVIDENCE_DIR/staging_<role>.txt.
+# Boards:  file copies; then (unless --no-smoke) one `docker run --rm` of
+#          $TRACTOR_APP_IMAGE with /tmp/lifetrac_strict mounted and NO device, to
+#          prove the encoder imports from /work. Skipped if the image is absent.
+# Radio:   never opens /dev/ttymxc3; never transmits.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/push_fix_to_board.sh
+#          (historical copy, unchanged; it took BOARD=<serial> and pushed from a
+#          fixed checkout path).
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+WHO=${BOARD:-tractor}; SMOKE=1
+for a in "$@"; do
+  case $a in
+    --no-smoke) SMOKE=0 ;;
+    -h|--help) bench_usage; exit 0 ;;
+    -*) die "unknown option '$a'" ;;
+    *) WHO=$a ;;
+  esac
+done
+ROLE=$(board_role "$WHO")
+board_present "$WHO" || die "$WHO ($(board_serial "$WHO")) is not reachable via $(board_via "$WHO")"
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+REC="$E/staging_$ROLE.txt"
+
+stamp "== push code tree to $WHO $BOARD_STAGE ($(bench_git_desc))"
+board_sh "$WHO" "$SUDO mkdir -p $BOARD_STAGE/legs; $SUDO chmod 0777 $BOARD_STAGE $BOARD_STAGE/legs; $SUDO rm -rf $BOARD_STAGE/x8_image_pipeline $BOARD_STAGE/image_pipeline" > /dev/null
+
+FILES=("$DC/firmware/tractor_x8/camera_service.py" "$DC/firmware/tractor_x8/image_tx_daemon.py"
+       "$DC/base_station/lora_proto.py" "$DC/tools/vector_dry_run.py")
+DIRS=("$DC/base_station/image_pipeline" "$DC/firmware/tractor_x8/x8_image_pipeline")
+for f in "${FILES[@]}" "${DIRS[@]}"; do
+  board_push "$WHO" "$f" "$BOARD_STAGE/" || { stamp "PUSH FAILED $f"; exit 1; }
+done
+board_sh "$WHO" "$SUDO find $BOARD_STAGE -name __pycache__ -type d -prune -exec rm -rf {} + 2>/dev/null; true" > /dev/null
+
+# md5 of every pushed file (relative to /tmp/lifetrac_strict), local vs board
+declare -A LOCAL=()
+for f in "${FILES[@]}"; do LOCAL[$(basename "$f")]=$(md5sum < "$f" | cut -c1-32); done
+for d in "${DIRS[@]}"; do
+  parent=$(dirname "$d")
+  while IFS= read -r f; do
+    LOCAL[${f#"$parent"/}]=$(md5sum < "$f" | cut -c1-32)
+  done < <(find "$d" -type f ! -path '*__pycache__*' ! -name '*.pyc')
+done
+REMOTE=$(board_sh "$WHO" "cd $BOARD_STAGE && md5sum ${!LOCAL[*]} 2>&1")
+{ echo "# code tree -> $ROLE $BOARD_STAGE, $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock, from $(bench_git_desc)"; } >> "$REC"
+bad=0
+for k in $(printf '%s\n' "${!LOCAL[@]}" | sort); do
+  r=$(printf '%s\n' "$REMOTE" | awk -v f="$k" '$2==f{print $1}')
+  if [ "${LOCAL[$k]}" = "$r" ]; then st=ok; else st=MISMATCH; bad=1; echo "MISMATCH $k (local ${LOCAL[$k]}, board ${r:-missing})"; fi
+  printf '%s  %-8s %s\n' "${LOCAL[$k]}" "$st" "$k" >> "$REC"
+done
+[ $bad = 0 ] && stamp "== ${#LOCAL[@]} files md5-verified on $ROLE (record: $REC)" || stamp "== md5 MISMATCH on $ROLE -- see $REC"
+
+if [ $SMOKE = 1 ]; then
+  if board_has_image "$WHO" "$TRACTOR_APP_IMAGE"; then
+    stamp "== import smoke inside $TRACTOR_APP_IMAGE, from /work (the checkout's encoder must load with its codec mirror)"
+    board_sh "$WHO" "$SUDO $WORK_RUN $TRACTOR_APP_IMAGE -c \"import x8_image_pipeline.encode_vector as ev; print('encoder from', ev.__file__); print('codec', ev.vs.__file__, 'TTL_FRAMES', ev.vs.TTL_FRAMES); print('has _tick_ttl', hasattr(ev.VectorEncoder, '_tick_ttl'))\"" 2>&1 \
+      | tee -a "$REC"
+  else
+    stamp "== SKIP import smoke: $TRACTOR_APP_IMAGE is not on $ROLE (build it: DEPLOY.md / build_tractor_image.sh)"
+  fi
+fi
+exit $bad
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/scene_check.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/scene_check.sh
new file mode 100644
index 00000000..d4e7dd5c
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/scene_check.sh
@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+# scene_check.sh -- before EVERY camera run (each step-1 pass, each leg): bring the
+# bench video window to the front (youtube_window.ps1 -Front), grab frames from the
+# tractor's /dev/video1 for ~10 s, report the share of pixels changed over
+# 1.9 / 5 / 10 s, and save the last frame and the numbers as evidence.
+#
+# Usage:   bash scene_check.sh <tag> [min_pct] [--no-front]
+#   <tag>       file tag: $EVIDENCE_DIR/<tag>_scene.{txt,jpg} (e.g. leg2a, step1_bw250_moving)
+#   min_pct     exit 4 when the 10 s change is below it (default 8 = moving content;
+#               pass 0 for a still scene, which only records -- RS13_VECTOR_LEG.md "Scene")
+#   --no-front  do not touch the PC window (e.g. the still is shown some other way)
+# Inputs:  TRACTOR_SERIAL, TRACTOR_APP_IMAGE (has OpenCV), YOUTUBE_URL /
+#          FIREFOX_PROFILE_DIR (the window youtube_window.ps1 -Open started).
+# Writes:  $EVIDENCE_DIR/<tag>_scene.txt and <tag>_scene.jpg; tractor /tmp/scene_check.jpg.
+# Boards:  tractor only: one `docker run --rm --device=/dev/video1` (camera node,
+#          nothing else). /dev/video1 must be free: no camera_svc, lifetrac-camera
+#          stopped. Exit 3 if the camera is busy.
+# Radio:   camera only; never opens /dev/ttymxc3, never transmits.
+# Screen:  never kiosk / never a fullscreen the operator cannot leave: the window
+#          is a normal window, only the player is fullscreen (Esc leaves it).
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/scene_check.sh
+#          (historical copy, unchanged).
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+TAG=""; MIN=8; FRONT=1
+for a in "$@"; do
+  case $a in
+    --no-front) FRONT=0 ;;
+    -h|--help) bench_usage; exit 0 ;;
+    *) if [ -z "$TAG" ]; then TAG=$a; else MIN=$a; fi ;;
+  esac
+done
+[ -n "$TAG" ] || { bench_usage; exit 2; }
+bench_check_name "tag" "$TAG"
+case $MIN in ''|*[!0-9.]*) die "min_pct must be a number, not '$MIN'" ;; esac
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+board_present tractor || die "tractor ($TRACTOR_SERIAL) is not reachable via adb"
+
+if [ $FRONT = 1 ]; then
+  if command -v powershell.exe > /dev/null 2>&1; then
+    powershell.exe -NoProfile -ExecutionPolicy Bypass -File "$(win_path "$LEGS_DIR/youtube_window.ps1")" -Front \
+      -Url "$YOUTUBE_URL" -ProfileDir "$FIREFOX_PROFILE_DIR" 2>&1 | tr -d '\r'
+  else
+    echo "(no powershell.exe: bring the bench video window to the front by hand)"
+  fi
+fi
+
+holders=$(board_sh tractor "$SUDO fuser /dev/video1 2>/dev/null" | tr -s ' \n' ' ' | sed 's/^ //; s/ $//')
+if [ -n "$holders" ]; then
+  echo "SCENE-CHECK-BUSY: /dev/video1 is held by pid(s) $holders on the tractor (camera_svc running? lifetrac-camera not stopped?)"
+  exit 3
+fi
+
+out=$( { echo "# $TAG scene check, $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock (content: $YOUTUBE_URL, normal Firefox window, player fullscreen; min $MIN %)"
+  board_sh tractor "$SUDO docker run --rm --device=/dev/video1 -v /tmp:/tmp --entrypoint python3 $TRACTOR_APP_IMAGE -c \"
+import cv2, time, numpy as np
+c = cv2.VideoCapture('/dev/video1', cv2.CAP_V4L2); fr = []
+t0 = time.time()
+while time.time() - t0 < 10.5:
+    ok, f = c.read()
+    if ok: fr.append((time.time(), f))
+    time.sleep(0.05)
+c.release()
+if len(fr) < 10:
+    raise SystemExit('only %d frames from /dev/video1' % len(fr))
+for gap in (1.9, 5.0, 10.0):
+    a = fr[5]; b = min(fr, key=lambda x: abs((x[0] - a[0]) - gap))
+    d = np.abs(a[1].astype(np.int16) - b[1].astype(np.int16))
+    print('%.1f s apart: mean abs diff %.2f  pct pixels diff>25: %.2f %%' % (b[0] - a[0], d.mean(), 100.0 * (d.max(axis=2) > 25).mean()))
+print('mean luma %.1f' % fr[-1][1].mean())
+cv2.imwrite('/tmp/scene_check.jpg', fr[-1][1])
+\"" 2>&1; } )
+printf '%s\n' "$out" | tee "$E/${TAG}_scene.txt"
+board_pull tractor /tmp/scene_check.jpg "$E/${TAG}_scene.jpg" 2>/dev/null && echo "frame -> $E/${TAG}_scene.jpg"
+pct=$(printf '%s\n' "$out" | grep -E "^(9\.|10\.)[0-9] s apart" | grep -oE "[0-9.]+ %" | grep -oE "[0-9.]+" | head -1)
+if [ -z "$pct" ] || ! awk -v p="$pct" -v m="$MIN" 'BEGIN { exit !(p + 0 >= m + 0) }'; then
+  echo "SCENE-CHECK-FAIL: 10 s change ${pct:-?} % < $MIN % (paused / behind another window / ad card / camera aim) - look at ${TAG}_scene.jpg"
+  exit 4
+fi
+echo "SCENE-CHECK-OK: 10 s change $pct % (min $MIN %)"
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/stage_boards.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/stage_boards.sh
new file mode 100644
index 00000000..4ef95d21
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/stage_boards.sh
@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# stage_boards.sh -- (re)stage the bench tooling on the boards: everything a leg,
+# a step-1 pass or a radio-state check needs in /tmp/lifetrac_strict, the
+# harness's openocd reset cfg in /tmp/lifetrac_p0c, then this checkout's code
+# tree (push_fix_to_board.sh). Run it at the start of every session, after any
+# reboot or flash, and whenever the last push is 5 days old: /tmp is tmpfs and
+# systemd-tmpfiles ages it at 5 days (BENCH_RUNBOOK, Board facts).
+#
+# Usage:   bash stage_boards.sh [--probes-only] [base|tractor ...]     (default: both)
+#   --probes-only   only the radio probe tools + paho (what power_up_guard.sh
+#                   stages); no code tree, no injectors
+# Inputs:  lib/bench_env.sh settings (serials, BASE_TRANSPORT, ...); the files of
+#          THIS checkout (repo-root _paho_pull/paho, the helper probes, bench_tools,
+#          base_station, tools/, firmware/tractor_x8).
+# Writes:  board: /tmp/lifetrac_strict/{probes,bench tools,paho,code tree,legs/},
+#          /tmp/lifetrac_p0c/08_boot_user_app.cfg (tractor; LF-clean);
+#          PC: md5 record appended to $EVIDENCE_DIR/staging_<role>.txt.
+# Boards:  copies files and creates the two staging folders (mode 0777); runs an
+#          import smoke in a container WITHOUT any device (push_fix_to_board.sh).
+# Radio:   nothing here opens /dev/ttymxc3 or talks to the L072. Never transmits.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/stage_boards.sh
+#          (historical copy, unchanged). New here: env-driven paths/serials, the
+#          LF-clean 08_boot_user_app.cfg, md5 verification of every pushed file,
+#          ssh support for the base.
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+PROBES_ONLY=0; WHO=()
+for a in "$@"; do
+  case $a in
+    --probes-only) PROBES_ONLY=1 ;;
+    base|tractor) WHO+=("$a") ;;
+    -h|--help) bench_usage; exit 0 ;;
+    *) die "unknown argument '$a' (base|tractor|--probes-only)" ;;
+  esac
+done
+[ ${#WHO[@]} -gt 0 ] || WHO=(tractor base)
+
+H="$HELPER_DIR"
+PROBES=("$H/method_g_stage1_probe.py" "$H/method_h_stage2_tx_probe_v2.py" "$H/rs115_stats_probe.py"
+        "$H/rs116_health_probe.py" "$BT_DIR/radio_park.py" "$BT_DIR/radio_state.py")
+TOOLS=("$BT_DIR/clear_retained.py" "$BT_DIR/clear_retained_host.py" "$BT_DIR/frag_gap_report.py"
+       "$BT_DIR/kf_inject.py" "$BT_DIR/dual_inject.py" "$DC/base_station/image_rx_daemon.py"
+       "$DC/base_station/cmd_timing.py")
+PAHO="$REPO_ROOT/_paho_pull/paho"
+[ -d "$PAHO" ] || die "missing $PAHO (repo-root _paho_pull/paho, tracked in git)"
+
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+rc_all=0
+for who in "${WHO[@]}"; do
+  ser=$(board_serial "$who"); via=$(board_via "$who")
+  stamp "=== $who ($ser via $via)"
+  board_present "$who" || { stamp "SKIP $who: not reachable via $via"; rc_all=1; continue; }
+  REC="$E/staging_$who.txt"
+  { echo "# staging $who ($ser), $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock, from $(bench_git_desc)$([ $PROBES_ONLY = 1 ] && echo ', probes only')"; } >> "$REC"
+
+  board_sh "$who" "$SUDO mkdir -p $BOARD_STAGE/legs $BOARD_FLASH_STAGE; $SUDO chmod 0777 $BOARD_STAGE $BOARD_STAGE/legs $BOARD_FLASH_STAGE" > /dev/null
+
+  pairs=()                               # "local|remote" for the md5 check
+  list=("${PROBES[@]}"); [ $PROBES_ONLY = 1 ] || list+=("${TOOLS[@]}")
+  for f in "${list[@]}"; do
+    board_push "$who" "$f" "$BOARD_STAGE/" || { stamp "PUSH FAILED $f"; exit 1; }
+    pairs+=("$f|$BOARD_STAGE/$(basename "$f")")
+  done
+  if [ $PROBES_ONLY = 0 ]; then
+    board_push_lf "$who" "$H/bench_mqtt.conf" "$BOARD_STAGE/bench_mqtt.conf" || { stamp "PUSH FAILED bench_mqtt.conf"; exit 1; }
+    pairs+=("$BENCH_SCRATCH/lf/bench_mqtt.conf|$BOARD_STAGE/bench_mqtt.conf")
+  fi
+  if [ "$(board_role "$who")" = tractor ]; then
+    # run_live_radio_monitor.ps1 resets the tractor L072 with
+    # openocd -f /tmp/lifetrac_p0c/08_boot_user_app.cfg (its step 4/5)
+    board_push_lf "$who" "$H/08_boot_user_app.cfg" "$BOARD_FLASH_STAGE/08_boot_user_app.cfg" || { stamp "PUSH FAILED 08_boot_user_app.cfg"; exit 1; }
+    pairs+=("$BENCH_SCRATCH/lf/08_boot_user_app.cfg|$BOARD_FLASH_STAGE/08_boot_user_app.cfg")
+  fi
+  # root-owned __pycache__ (python in the containers runs as root) blocks an overwrite
+  board_sh "$who" "$SUDO rm -rf $BOARD_STAGE/paho" > /dev/null
+  board_push "$who" "$PAHO" "$BOARD_STAGE/" || { stamp "PUSH FAILED paho"; exit 1; }
+
+  # md5: every single file pushed, against what was sent
+  remote=""; for p in "${pairs[@]}"; do remote="$remote ${p#*|}"; done
+  sums=$(board_sh "$who" "md5sum $remote")
+  bad=0
+  for p in "${pairs[@]}"; do
+    l=${p%%|*}; r=${p#*|}
+    lm=$(md5sum < "$l" | cut -c1-32)
+    rm_=$(printf '%s\n' "$sums" | awk -v f="$r" '$2==f{print $1}')
+    if [ "$lm" = "$rm_" ]; then st=ok; else st=MISMATCH; bad=1; fi
+    printf '%s  %-8s %s\n' "$lm" "$st" "$r" >> "$REC"
+  done
+  [ $bad = 0 ] && stamp "$who: ${#pairs[@]} files md5-verified (record: $REC)" || { stamp "$who: md5 MISMATCH -- see $REC"; rc_all=1; }
+
+  if [ $PROBES_ONLY = 0 ]; then
+    stamp "$who: code tree"
+    bash "$LEGS_DIR/push_fix_to_board.sh" "$who" 2>&1 | grep -E "== push|MISMATCH|verified|encoder from|has _tick|SKIP|FAILED" || true
+  fi
+  n=$(board_sh "$who" "ls $BOARD_STAGE | wc -l" | tr -d ' ')
+  stamp "$who: $BOARD_STAGE holds $n entries: $(board_sh "$who" "ls $BOARD_STAGE" | tr '\n' ' ')"
+  if [ $PROBES_ONLY = 0 ] && [ "${n:-0}" -lt 19 ]; then stamp "$who: WARNING fewer than 19 entries (BENCH_RUNBOOK expects >= 19)"; rc_all=1; fi
+done
+exit $rc_all
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/step1_pass.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/step1_pass.sh
new file mode 100644
index 00000000..9dd7f065
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/step1_pass.sh
@@ -0,0 +1,162 @@
+#!/usr/bin/env bash
+# step1_pass.sh -- one RS-13 step-1 pass (camera-only dry run on the tractor, NO
+# radio), per RS13_VECTOR_LEG.md step 1: scene check, a FRESH bench_mqtt with 0
+# retained messages, capture first (wait for its subscribe line), then camera_svc
+# with the /work mount + PYTHONPATH, boot-log check, wait for the capture,
+# tractor-log, teardown, and the pass files pulled into the evidence folder.
+#
+# Usage:   bash step1_pass.sh <bw250|bw500> <scene> [--from-work] [--suffix S]
+#                             [--scene-min PCT] [--no-scene-check]
+#   bw250|bw500     one-fragment budget/profile (image_bw250 = 203 B, image_bw500 = 243 B)
+#   <scene>         name in the file tag, e.g. moving, landscape (scene and suffix:
+#                   letters, digits, '_', '.', '-' only)
+#   --from-work     run camera_service.py and x8_image_pipeline from the pushed
+#                   /tmp/lifetrac_strict tree (push_fix_to_board.sh) instead of the
+#                   image's /app copy; the tag gets the suffix _work (was
+#                   step1_pass_fix.sh, suffix _fix, in RS-13.1)
+#   --suffix S      tag suffix instead of the default ("" or _work)
+#   --scene-min P   scene-check threshold in % (default 8 when <scene> contains
+#                   "moving", "yt" or "youtube", else 0 = record only, for a still)
+#   --no-scene-check
+# Inputs:  TRACTOR_SERIAL, TRACTOR_APP_IMAGE; /tmp/lifetrac_strict staged
+#          (stage_boards.sh: vector_dry_run.py, lora_proto.py, image_pipeline/,
+#          bench_mqtt.conf, paho/).
+# Writes:  tractor /tmp/lifetrac_strict/legs/step1_*_<tag>.*; PC $EVIDENCE_DIR/
+#          step1_<tag>_scene.{txt,jpg}, step1_bench_mqtt_reset.txt (appended),
+#          step1_tractor_<tag>.{jsonl,json,txt}, step1_camera_service_<tag>.log,
+#          step1_tractor_log_<tag>.txt, step1_<tag>_bootcheck.txt.
+# Boards:  tractor only: recreates the bench_mqtt container (127.0.0.1:1883, no
+#          persistence), runs the capture (rs13_cap) and camera_svc (/dev/video1)
+#          containers, removes them at the end -- and, through an EXIT trap, also
+#          when the pass aborts or is interrupted (only the ones it started).
+# Radio:   camera only. Refuses to start while anything holds /dev/ttymxc3 or a
+#          leg daemon (tx_smoke / rx_smoke / synth_pub) runs on the tractor: a
+#          running tx daemon would put the camera frames on the air.
+#          LIFETRAC_USE_LORA_BRIDGE=1 publishes to the local broker only.
+# Origin:  bench-evidence/RS_13_vector_scene_2026-09-26/scripts/step1_pass.sh and
+#          step1_pass_fix.sh (historical copies, unchanged), merged.
+set -u
+. "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh" || exit 1
+
+BW=""; SCENE=""; FROM_WORK=0; SUFFIX="unset"; SMIN=""; DO_SCENE=1
+while [ $# -gt 0 ]; do
+  case $1 in
+    --from-work) FROM_WORK=1 ;;
+    --suffix) SUFFIX=${2-}; shift ;;
+    --scene-min) SMIN=${2:?--scene-min PCT}; shift ;;
+    --no-scene-check) DO_SCENE=0 ;;
+    -h|--help) bench_usage; exit 0 ;;
+    -*) die "unknown option '$1'" ;;
+    *) if [ -z "$BW" ]; then BW=$1; elif [ -z "$SCENE" ]; then SCENE=$1; else die "extra argument '$1'"; fi ;;
+  esac
+  shift
+done
+[ -n "$BW" ] && [ -n "$SCENE" ] || { bench_usage; exit 2; }
+case $BW in bw250|bw500) ;; *) die "first argument must be bw250 or bw500" ;; esac
+bench_check_name "scene name" "$SCENE"
+[ "$SUFFIX" = unset ] && { [ $FROM_WORK = 1 ] && SUFFIX=_work || SUFFIX=""; }
+[ -z "$SUFFIX" ] || bench_check_name "--suffix" "$SUFFIX"
+PROFILE="image_${BW}"; TAG="${BW}_${SCENE}${SUFFIX}"
+if [ -z "$SMIN" ]; then case $SCENE in *moving*|*yt*|*youtube*) SMIN=8 ;; *) SMIN=0 ;; esac; fi
+if [ $FROM_WORK = 1 ]; then WDIR=/work; SCRIPT=/work/camera_service.py; else WDIR=/app; SCRIPT=camera_service.py; fi
+L=$BOARD_STAGE/legs
+E=$(bench_evidence_dir) || die "cannot create $EVIDENCE_DIR"
+OUT="$BENCH_SCRATCH/step1_$TAG"
+
+stamp "== step-1 pass $TAG (profile $PROFILE, camera_service from $WDIR) from $(bench_git_desc)"
+board_present tractor || die "tractor ($TRACTOR_SERIAL) is not reachable via adb"
+# refuse to append onto an earlier pass (--out appends)
+if [ "$(board_sh tractor "ls $L/step1_tractor_$TAG.jsonl 2>/dev/null | wc -l" | tr -d ' ')" != "0" ]; then
+  stamp "ABORT: $L/step1_tractor_$TAG.jsonl already exists (would append) -- pick another scene name or --suffix"; exit 2
+fi
+# radio safety: nothing may hold the radio UART, no leg daemon may run
+holders=$(board_uart_holders tractor); running=$(board_containers tractor)
+if [ -n "$holders" ] || echo " $running " | grep -qE ' (tx_smoke|rx_smoke|synth_pub|tractor-camera) '; then
+  stamp "ABORT: tractor not quiet (ttymxc3 holders [$holders], containers [$running]). Stop them first (power_up_guard.sh --stop-leg-daemons)."
+  exit 3
+fi
+board_sh tractor "$SUDO docker rm -f camera_svc rs13_cap >/dev/null 2>&1" > /dev/null 2>&1
+
+# On an abort ("never subscribed", an error, Ctrl+C) remove the tractor containers
+# this pass started -- a leftover camera_svc would keep publishing frames that a
+# later tx daemon puts on the air. Names are added just before each launch and
+# dropped once the normal teardown has removed them.
+CAP_PID=""; STARTED=""
+step1_cleanup() {
+  if [ -n "$CAP_PID" ]; then kill "$CAP_PID" 2>/dev/null; fi
+  if [ -n "$STARTED" ]; then
+    stamp "cleanup: removing the tractor container(s) this pass started:$STARTED"
+    board_sh tractor "$SUDO docker rm -f$STARTED >/dev/null 2>&1" > /dev/null 2>&1
+    STARTED=""
+  fi
+}
+trap step1_cleanup EXIT
+trap 'exit 130' INT
+trap 'exit 143' TERM
+
+if [ $DO_SCENE = 1 ]; then
+  bash "$LEGS_DIR/scene_check.sh" "step1_${TAG}" "$SMIN" || { stamp "ABORT: scene check failed"; exit 4; }
+fi
+
+# A fresh bench broker: a retained encode_mode_override / link_budget left by a radio
+# leg would flip the camera off VECTOR or onto another profile's budget (A12).
+{ echo "# step-1 $TAG bench_mqtt reset, $(date -u +%Y-%m-%dT%H:%M:%SZ) PC clock"
+  echo "retained before (existing broker, if any):"
+  board_sh tractor "$SUDO docker exec bench_mqtt timeout 2 mosquitto_sub -h 127.0.0.1 -t 'lifetrac/#' -v --retained-only 2>/dev/null"
+  board_sh tractor "$SUDO docker rm -f bench_mqtt >/dev/null 2>&1; $SUDO docker run -d --name bench_mqtt --network=host -v $BOARD_STAGE/bench_mqtt.conf:/mosquitto/config/mosquitto.conf eclipse-mosquitto:2 >/dev/null; sleep 2" > /dev/null 2>&1
+  echo "retained after the recreate (must be 0): $(board_sh tractor "$SUDO docker exec bench_mqtt timeout 2 mosquitto_sub -h 127.0.0.1 -t 'lifetrac/#' -v --retained-only 2>/dev/null | wc -l" | tr -d ' ')"
+} | tee -a "$E/step1_bench_mqtt_reset.txt" | tail -1
+
+# 1. capture first
+STARTED="$STARTED rs13_cap"
+board_sh tractor "$SUDO docker run --rm --name rs13_cap --network=host -v $BOARD_STAGE:/work -w /work \
+  -e PYTHONPATH=/work:/work/paho -e PYTHONUNBUFFERED=1 --entrypoint python3 $TRACTOR_APP_IMAGE \
+  /work/vector_dry_run.py capture --topic lifetrac/v25/cmd/image_frame --profile $PROFILE \
+  --duration 130 --min-frames 200 --out /work/legs/step1_tractor_$TAG.jsonl \
+  --json /work/legs/step1_tractor_$TAG.json --strict 2>&1 | tee $L/step1_tractor_$TAG.txt" \
+  > "$OUT.capture.out" 2>&1 &
+CAP_PID=$!
+t0=$(date +%s)
+until [ "$(board_sh tractor "grep -c subscribing $L/step1_tractor_$TAG.txt 2>/dev/null" | tr -d ' ')" = "1" ]; do
+  if [ $(( $(date +%s) - t0 )) -gt 60 ]; then stamp "ABORT: capture never subscribed"; kill $CAP_PID 2>/dev/null; exit 3; fi
+  sleep 1
+done
+stamp "capture subscribed after $(( $(date +%s) - t0 )) s"
+
+# 2. then the camera
+STARTED="$STARTED camera_svc"
+board_sh tractor "$SUDO docker run -d --name camera_svc --network=host --device=/dev/video1 \
+  -v $BOARD_STAGE:/work -w $WDIR -e PYTHONPATH=/work:/work/paho --entrypoint python3 \
+  -e LIFETRAC_MQTT_HOST=127.0.0.1 -e LIFETRAC_CAMERA_SOURCE=v4l2 -e LIFETRAC_CAMERA_DEVICE=/dev/video1 \
+  -e LIFETRAC_CAMERA_FPS=2 -e LIFETRAC_USE_LORA_BRIDGE=1 \
+  -e LIFETRAC_ENCODE_MODE=9 -e LIFETRAC_VECTOR_DETAIL=80 \
+  -e LIFETRAC_FRAGMENT_BUDGET=1 -e LIFETRAC_FRAGMENT_PROFILE=$PROFILE \
+  $TRACTOR_APP_IMAGE -u $SCRIPT" | cut -c1-12 | sed 's/^/camera_svc id /'
+stamp "camera_svc launched"
+
+sleep 15
+stamp "boot-log check (+15 s): expect byte_budget=$([ $BW = bw250 ] && echo 203 || echo 243) B, no 'link_budget: ->', no [lora_cmd]"
+board_sh tractor "$SUDO docker logs camera_svc 2>&1 | grep -E 'byte_budget|link_budget: ->|lora_cmd|encode_mode|clamp|Traceback|frame build failed' | head -8" \
+  | cut -c1-200 | tee "$E/step1_${TAG}_bootcheck.txt"
+echo -n "vector_stats lines so far: "; board_sh tractor "$SUDO docker logs camera_svc 2>&1 | grep -c vector_stats"
+echo -n "encoder module in use: "
+board_sh tractor "$SUDO docker exec camera_svc python3 -c \"import x8_image_pipeline.encode_vector as ev; print(ev.__file__, hasattr(ev.VectorEncoder, '_tick_ttl'))\" 2>&1" \
+  | tee -a "$E/step1_${TAG}_bootcheck.txt"
+
+# 3. wait for the capture, then encoder timing and teardown
+wait $CAP_PID
+CAP_PID=""
+stamp "capture finished"
+board_sh tractor "$SUDO docker logs camera_svc > $L/step1_camera_service_$TAG.log 2>&1; \
+  $SUDO docker run --rm -v $BOARD_STAGE:/work -w /work -e PYTHONPATH=/work --entrypoint python3 \
+  $TRACTOR_APP_IMAGE /work/vector_dry_run.py tractor-log /work/legs/step1_camera_service_$TAG.log \
+  2>&1 | tee $L/step1_tractor_log_$TAG.txt; $SUDO docker rm -f camera_svc >/dev/null 2>&1" > "$OUT.tractorlog.out"
+STARTED=""                               # torn down: rs13_cap ended (--rm), camera_svc removed
+stamp "== capture summary ($L/step1_tractor_$TAG.txt, from '== vector dry run summary ==')"
+board_sh tractor "sed -n '/== vector dry run summary ==/,\$p' $L/step1_tractor_$TAG.txt"
+stamp "== tractor-log ($L/step1_tractor_log_$TAG.txt)"
+cat "$OUT.tractorlog.out"
+for f in step1_tractor_$TAG.jsonl step1_tractor_$TAG.json step1_tractor_$TAG.txt step1_camera_service_$TAG.log step1_tractor_log_$TAG.txt; do
+  board_pull tractor "$L/$f" "$E/$f" || echo "PULL FAILED $f"
+done
+stamp "== pass $TAG done (evidence: $E)"
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/youtube_window.ps1 b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/youtube_window.ps1
new file mode 100644
index 00000000..2d4c406a
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/legs/youtube_window.ps1
@@ -0,0 +1,157 @@
+# youtube_window.ps1 [-Open] [-Front] [-Close] [-Url <url>] [-ProfileDir <dir>]
+#                    [-FirefoxExe <path>] [-NoPlayerFullscreen]
+#
+# Moving content for camera legs WITHOUT taking the screen away from the operator.
+#   -Open   start a separate Firefox instance (its own profile, audio scaled to 0,
+#           autoplay allowed) as a NORMAL window on -Url, bring it to the front
+#           and press "f" = the YouTube player's own fullscreen button. The
+#           operator leaves it any time with Esc; the window stays a normal
+#           window with its own close button. Never --kiosk.
+#   -Front  bring that window back to the front (it drops behind any app the
+#           operator clicks) and re-enter the player's fullscreen only if the
+#           window shows YouTube and is not already fullscreen.
+#   -Close  close that instance only (the operator's own Firefox is untouched:
+#           the bench instance is found by its exact `-profile "<ProfileDir>"`
+#           argument on the command line, not by a substring).
+#
+# The "f" key goes out only when the bench window is confirmed to be the
+# foreground window (Windows may refuse SetForegroundWindow); otherwise the
+# script says so and the operator clicks the window and presses f.
+# -ProfileDir must be a dedicated folder: a drive root or a path shorter than
+# 10 characters is refused (it is matched against firefox.exe command lines).
+#
+# Parameters (each falls back to the environment that lib/bench_env.sh exports,
+# then to a built-in default):
+#   -Url         $env:YOUTUBE_URL, else the railroad reference video
+#                https://www.youtube.com/watch?v=B1yUQwpNhJA. A still for the
+#                step-1 landscape passes works too (a file:/// or https URL of a
+#                picture); the "f" key is only sent to a YouTube window.
+#   -ProfileDir  $env:FIREFOX_PROFILE_DIR, else %TEMP%\lifetrac-bench\ff_bench_youtube
+#   -FirefoxExe  $env:FIREFOX_EXE, else Program Files\Mozilla Firefox, else PATH
+#   -NoPlayerFullscreen  never send "f" (leave the page as a normal window)
+#
+# Touches no board and no radio. Screen rule (BENCH_RUNBOOK prep 7): never a kiosk
+# and nothing fullscreen the operator cannot leave with Esc -- the 2026-09-27
+# kiosk locked the operator out of the PC for a whole round.
+# Origin: bench-evidence/RS_13_vector_scene_2026-09-26/scripts/youtube_window.ps1
+#         (historical copy, unchanged; it hardcoded the profile dir and the URL).
+param(
+  [switch]$Open,
+  [switch]$Front,
+  [switch]$Close,
+  [string]$Url = "",
+  [string]$ProfileDir = "",
+  [string]$FirefoxExe = "",
+  [switch]$NoPlayerFullscreen
+)
+
+if (-not ($Open -or $Front -or $Close)) {
+  "usage: youtube_window.ps1 -Open | -Front | -Close [-Url <url>] [-ProfileDir <dir>] [-FirefoxExe <path>] [-NoPlayerFullscreen]"
+  exit 1
+}
+if (-not $Url) { $Url = $env:YOUTUBE_URL }
+if (-not $Url) { $Url = "https://www.youtube.com/watch?v=B1yUQwpNhJA" }
+if (-not $ProfileDir) { $ProfileDir = $env:FIREFOX_PROFILE_DIR }
+if (-not $ProfileDir) { $ProfileDir = Join-Path $env:TEMP "lifetrac-bench\ff_bench_youtube" }
+# one canonical spelling (backslashes, absolute) so the command-line match below is exact
+$prof = [System.IO.Path]::GetFullPath(($ProfileDir -replace '/', '\')).TrimEnd('\')
+if ($prof.Length -lt 10 -or $prof -match '^[A-Za-z]:\\?$' -or $prof -match '^\\\\[^\\]+\\[^\\]+$') {
+  "refusing -ProfileDir '$prof': use a dedicated folder (not a drive root or share root, at least 10 characters)"
+  exit 4
+}
+# the exact argument the bench instance was started with: -profile "<prof>" (or unquoted)
+$profArg = '-profile\s+"?' + [regex]::Escape($prof) + '"?(\s|$)'
+
+function Find-Firefox {
+  if ($FirefoxExe) { return $FirefoxExe }
+  if ($env:FIREFOX_EXE) { return $env:FIREFOX_EXE }
+  foreach ($p in @("$env:ProgramFiles\Mozilla Firefox\firefox.exe", "${env:ProgramFiles(x86)}\Mozilla Firefox\firefox.exe")) {
+    if ($p -and (Test-Path $p)) { return $p }
+  }
+  $c = Get-Command firefox.exe -ErrorAction SilentlyContinue
+  if ($c) { return $c.Source }
+  return $null
+}
+
+Add-Type @"
+using System; using System.Runtime.InteropServices;
+public class BenchWin {
+  [DllImport("user32.dll")] public static extern bool SetForegroundWindow(IntPtr h);
+  [DllImport("user32.dll")] public static extern bool BringWindowToTop(IntPtr h);
+  [DllImport("user32.dll")] public static extern bool ShowWindow(IntPtr h, int n);
+  [DllImport("user32.dll")] public static extern bool GetWindowRect(IntPtr h, out RECT r);
+  [DllImport("user32.dll")] public static extern IntPtr GetForegroundWindow();
+  public struct RECT { public int Left, Top, Right, Bottom; }
+}
+"@
+function Get-BenchProcs {
+  Get-CimInstance Win32_Process -Filter "Name='firefox.exe'" | Where-Object {
+    $_.CommandLine -and ($_.CommandLine -imatch $profArg)
+  }
+}
+function Get-BenchWindow {
+  $ids = Get-BenchProcs | ForEach-Object { $_.ProcessId }
+  if (-not $ids) { return $null }
+  Get-Process -Id $ids -ErrorAction SilentlyContinue | Where-Object { $_.MainWindowHandle -ne 0 } | Select-Object -First 1
+}
+function Raise($w) {
+  [BenchWin]::ShowWindow($w.MainWindowHandle, 9) | Out-Null        # SW_RESTORE: a normal window, never kiosk
+  [BenchWin]::BringWindowToTop($w.MainWindowHandle) | Out-Null
+  [BenchWin]::SetForegroundWindow($w.MainWindowHandle) | Out-Null
+  (New-Object -ComObject WScript.Shell).AppActivate($w.Id) | Out-Null
+}
+function Is-PlayerFullscreen($w) {
+  $r = New-Object BenchWin+RECT; [BenchWin]::GetWindowRect($w.MainWindowHandle, [ref]$r) | Out-Null
+  Add-Type -AssemblyName System.Windows.Forms
+  $s = [System.Windows.Forms.Screen]::FromHandle($w.MainWindowHandle).Bounds
+  return ($r.Left -le $s.Left -and $r.Top -le $s.Top -and $r.Right -ge $s.Right -and $r.Bottom -ge $s.Bottom)
+}
+
+if ($Close) {
+  Get-BenchProcs | ForEach-Object { try { Stop-Process -Id $_.ProcessId -ErrorAction Stop } catch {} }
+  "bench video window closed"; exit 0
+}
+if ($Open) {
+  if (-not (Get-BenchWindow)) {
+    $ff = Find-Firefox
+    if (-not $ff) { "Firefox not found: pass -FirefoxExe or set FIREFOX_EXE"; exit 3 }
+    New-Item -ItemType Directory -Force $prof | Out-Null
+    @(
+      'user_pref("browser.aboutwelcome.enabled", false);',
+      'user_pref("browser.shell.checkDefaultBrowser", false);',
+      'user_pref("browser.startup.homepage_override.mstone", "ignore");',
+      'user_pref("datareporting.policy.dataSubmissionPolicyBypassNotification", true);',
+      'user_pref("toolkit.telemetry.reportingpolicy.firstRun", false);',
+      'user_pref("trailhead.firstrun.didSeeAboutWelcome", true);',
+      'user_pref("browser.sessionstore.resume_from_crash", false);',
+      'user_pref("media.autoplay.default", 0);',
+      'user_pref("media.autoplay.blocking_policy", 0);',
+      'user_pref("media.volume_scale", "0.0");',
+      'user_pref("full-screen-api.warning.timeout", 1500);'
+    ) | Set-Content -Path (Join-Path $prof "user.js") -Encoding ascii
+    Start-Process -FilePath $ff -ArgumentList @("--no-remote", "-profile", "`"$prof`"", "-new-window", "`"$Url`"") | Out-Null
+    $t0 = Get-Date
+    do { Start-Sleep -Milliseconds 500; $w = Get-BenchWindow } until ($w -or ((Get-Date) - $t0).TotalSeconds -gt 20)
+    Start-Sleep -Seconds 6                                          # page + player load
+  }
+  $Front = $true
+}
+if ($Front) {
+  $w = Get-BenchWindow
+  if (-not $w) { "no bench video window (run -Open)"; exit 2 }
+  Raise $w
+  Start-Sleep -Milliseconds 600
+  $isYouTube = ($w.MainWindowTitle -match 'YouTube')
+  if ((-not $NoPlayerFullscreen) -and $isYouTube -and -not (Is-PlayerFullscreen $w)) {
+    # SendKeys types into whatever has focus: send "f" only when the bench window
+    # really is the foreground window, never into the operator's terminal or editor.
+    if ([BenchWin]::GetForegroundWindow() -eq $w.MainWindowHandle) {
+      (New-Object -ComObject WScript.Shell).SendKeys("f")             # the player's fullscreen button; Esc leaves it
+      Start-Sleep -Milliseconds 800
+    } else {
+      "bench window is not in the foreground (Windows refused the focus change); 'f' NOT sent -- click the video window and press f"
+    }
+  }
+  $w = Get-BenchWindow
+  "window pid $($w.Id) '$($w.MainWindowTitle)' player fullscreen: $(Is-PlayerFullscreen $w)"
+}
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/.gitattributes b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/.gitattributes
new file mode 100644
index 00000000..d4cc847e
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/.gitattributes
@@ -0,0 +1,2 @@
+# bench_env.sh is sourced by Git Bash, which cannot parse CRLF; keep it LF.
+*.sh text eol=lf
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/bench_env.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/bench_env.sh
new file mode 100644
index 00000000..feb989e5
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/bench_env.sh
@@ -0,0 +1,351 @@
+# shellcheck shell=bash
+# lib/bench_env.sh -- shared settings and helpers for the bench scripts. SOURCE it,
+# do not run it:
+#
+#     . "$(dirname "${BASH_SOURCE[0]}")/../lib/bench_env.sh"
+#
+# What it does when sourced:
+#   * finds the repo root from THIS file's location (git rev-parse --show-toplevel,
+#     falling back to the fixed depth below bench_tools/), so the scripts work from
+#     any checkout and any working directory;
+#   * loads bench_tools/bench.env if it exists, else bench_tools/bench.env.example
+#     with a one-line WARN on stderr (or $BENCH_ENV_FILE), through lib/env_file.sh,
+#     the loader every bench script shares: a NON-EMPTY variable already in the
+#     environment wins over the file; empty values get the computed defaults
+#     documented in the example file;
+#   * exports MSYS_NO_PATHCONV=1 so Git Bash does not rewrite /tmp/... board paths;
+#   * defines the helpers listed below.
+# Sourcing it touches nothing on the boards; it only creates $BENCH_SCRATCH.
+#
+# Paths: on Windows every PC-side path it sets is in mixed form (C:/Users/...),
+# which Git Bash, adb, py and PowerShell all accept. Hand Python tools and
+# `adb pull` that form, never /c/... (RS-13.1 A6). The one exception is scp
+# (BASE_TRANSPORT=ssh), which reads "C:/..." as host "C": board_push and
+# board_pull hand it the /c/... form themselves.
+#
+# Helpers:
+#   win_path P                 P in C:/... form (cygpath -m); unchanged off Windows
+#   bench_py ARGS...           py -3 (Windows launcher) or python3
+#   stamp MSG...               "HH:MM:SSZ MSG" (UTC); also appended to $STAMP_LOG if set
+#   die MSG...                 print to stderr, exit 1
+#   bench_usage                print the calling script's header comment (for -h)
+#   bench_need CMD...          die unless every CMD is on PATH
+#   board_role WHO             base | tractor | other   (WHO = role name or adb serial)
+#   board_serial WHO           adb serial for WHO
+#   board_via WHO              adb | ssh (ssh only for the base with BASE_TRANSPORT=ssh)
+#   board_sh WHO CMD...        run CMD in the board's shell; CR stripped; returns its rc.
+#                              Put "$SUDO" in front of each command that needs root.
+#   board_sudo WHO CMD...      board_sh WHO "$SUDO CMD" (only CMD's first command runs as root)
+#   board_present WHO          true when WHO answers (adb device state, or ssh true)
+#   board_push WHO SRC DST     copy a file/dir to the board (adb push / scp -r)
+#   board_push_lf WHO SRC DST  copy a text file LF-clean (shell, openocd cfg, conf)
+#   board_pull WHO SRC DST     copy a board file to the PC (adb pull / scp)
+#                              (scp gets the PC path in /c/... form: it reads C:/... as host C)
+#   board_image WHO            the probe image for WHO (BASE_IMAGE / TRACTOR_PROBE_IMAGE)
+#   board_has_image WHO IMG    true when IMG exists on the board
+#   board_uart_holders WHO     pids holding /dev/ttymxc3 (the L072 radio UART), nothing when
+#                              free, or "unknown(...)" when the check could not run (no
+#                              fuser, sudo or transport failure) -- callers treat any
+#                              non-empty answer as busy, so the gate fails closed
+#   board_containers WHO       names of the running containers, space separated
+#   strip_to_gzip FILE         drop the login-shell preamble adb exec-out puts before a gzip
+#   bench_require_dts_carrier  return 1 (with the reason) unless DTS_CARRIER_HZ may be flown
+#   bench_check_name WHAT VAL  die unless VAL matches ^[A-Za-z0-9_.-]+$ (leg tags, scene
+#                              names: they end up in file names and board shell commands)
+#   bench_evidence_dir         mkdir -p $EVIDENCE_DIR and print it
+#   bench_git_desc             "<branch> @ <short sha>[ +dirty]" of this checkout
+#   bench_show_env             print the effective settings (password masked)
+#
+# Constants: BOARD_STAGE=/tmp/lifetrac_strict (the harness hardcodes it),
+# BOARD_FLASH_STAGE=/tmp/lifetrac_p0c, SUDO (sudo prefix with the password piped),
+# PROBE_RUN (docker run prefix WITH the radio UART mapped -- radio probes only),
+# WORK_RUN (the same without any device).
+
+[ -n "${BASH_VERSION:-}" ] || { echo "bench_env.sh needs bash" >&2; return 1 2>/dev/null || exit 1; }
+
+export MSYS_NO_PATHCONV=1
+
+win_path() {
+  if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else printf '%s\n' "$1"; fi
+}
+
+bench_py() {
+  if command -v py >/dev/null 2>&1; then py -3 "$@"; else python3 "$@"; fi
+}
+
+stamp() {
+  local line
+  line="$(date -u +%H:%M:%SZ) $*"
+  printf '%s\n' "$line"
+  if [ -n "${STAMP_LOG:-}" ]; then printf '%s\n' "$line" >> "$STAMP_LOG"; fi
+}
+
+die() { echo "$*" >&2; exit 1; }
+
+bench_usage() {                          # print the calling script's header comment
+  awk 'NR > 1 && /^#/ { sub(/^# ?/, ""); print; next } NR > 1 { exit }' "$0"
+}
+
+bench_need() {
+  local c
+  for c in "$@"; do command -v "$c" >/dev/null 2>&1 || die "needs '$c' on PATH (PC_SETUP.md)"; done
+}
+
+# --- locate the checkout ------------------------------------------------------
+BENCH_LIB_DIR=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
+_bench_bt=$(cd "$BENCH_LIB_DIR/.." && pwd)
+REPO_ROOT=$(git -C "$_bench_bt" rev-parse --show-toplevel 2>/dev/null || true)
+if [ -z "$REPO_ROOT" ] || [ ! -f "$REPO_ROOT/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/bench_env.sh" ]; then
+  REPO_ROOT=$(cd "$_bench_bt/../../../../.." && pwd)          # bench_tools is 5 levels below the root
+fi
+REPO_ROOT=$(win_path "$REPO_ROOT")
+DC="$REPO_ROOT/LifeTrac-v25/DESIGN-CONTROLLER"
+HELPER_DIR="$DC/firmware/x8_lora_bootloader_helper"
+BT_DIR="$HELPER_DIR/bench_tools"
+LEGS_DIR="$BT_DIR/legs"
+[ -f "$HELPER_DIR/run_live_radio_monitor.ps1" ] || { echo "bench_env: cannot find the LifeTrac tree (REPO_ROOT=$REPO_ROOT)" >&2; return 1 2>/dev/null || exit 1; }
+unset _bench_bt
+
+# --- load bench.env (or the example) -----------------------------------------
+_BENCH_VARS="BASE_SERIAL TRACTOR_SERIAL BASE_TRANSPORT BASE_HOST BASE_SSH_USER BASE_SSH_KEY BENCH_SUDO_PW
+PC_HOST BENCH_SCRATCH EVIDENCE_DIR ARCHIVE_DIR DTS_CARRIER_HZ DTS_CARRIER_DATE YOUTUBE_URL
+FIREFOX_PROFILE_DIR FIREFOX_EXE BASE_IMAGE TRACTOR_PROBE_IMAGE TRACTOR_APP_IMAGE BASE_BROKER_CONTAINER"
+# BENCH_ENV is the name provision_bench_board.sh, deploy_base.sh, build_tractor_image.sh
+# and flash_l072.sh use for the same thing; accept either.
+if [ -z "${BENCH_ENV_FILE:-}" ] && [ -n "${BENCH_ENV:-}" ]; then BENCH_ENV_FILE=$BENCH_ENV; fi
+if [ -z "${BENCH_ENV_FILE:-}" ]; then
+  if [ -f "$BT_DIR/bench.env" ]; then
+    BENCH_ENV_FILE="$BT_DIR/bench.env"
+  else
+    BENCH_ENV_FILE="$BT_DIR/bench.env.example"
+    if [ -z "${BENCH_ENV_EXAMPLE_WARNED:-}" ]; then        # once per process tree
+      echo "bench_env: WARN: no bench_tools/bench.env -- using bench.env.example (the original OSE bench's serials and addresses); cp bench.env.example bench.env and edit it (BENCH_SETUP.md 5.3)" >&2
+      export BENCH_ENV_EXAMPLE_WARNED=1
+    fi
+  fi
+fi
+[ -f "$BENCH_ENV_FILE" ] || { echo "bench_env: settings file not found: $BENCH_ENV_FILE" >&2; return 1 2>/dev/null || exit 1; }
+# shellcheck source=env_file.sh
+. "$BENCH_LIB_DIR/env_file.sh" || { echo "bench_env: cannot load $BENCH_LIB_DIR/env_file.sh" >&2; return 1 2>/dev/null || exit 1; }
+bench_load_env_file "$BENCH_ENV_FILE" || { return 1 2>/dev/null || exit 1; }   # CRLF-tolerant; the environment wins
+
+: "${BASE_SERIAL:=2D0A1209DABC240B}"
+: "${TRACTOR_SERIAL:=2E2C1209DABC240B}"
+: "${BASE_TRANSPORT:=adb}"
+: "${BASE_HOST:=192.168.1.117}"
+: "${BASE_SSH_USER:=${BASE_USER:-fio}}"          # BASE_USER: the name the setup/deploy scripts use
+BASE_USER=$BASE_SSH_USER
+: "${BASE_SSH_KEY:=$HOME/.ssh/lifetrac_base_ed25519}"
+: "${BENCH_SUDO_PW:=fio}"
+: "${PC_HOST:=}"
+: "${BENCH_SCRATCH:=$(win_path "${TMPDIR:-${TEMP:-/tmp}}")/lifetrac-bench}"
+: "${EVIDENCE_DIR:=$DC/bench-evidence/RS_13_vector_scene_$(date -u +%Y-%m-%d)/legs}"
+: "${ARCHIVE_DIR:=${BENCH_ARCHIVE_DIR:-$HOME/Documents/LifeTrac-bench-archive}}"
+BENCH_ARCHIVE_DIR=$ARCHIVE_DIR
+: "${DTS_CARRIER_HZ:=}"
+: "${DTS_CARRIER_DATE:=}"
+: "${YOUTUBE_URL:=https://www.youtube.com/watch?v=B1yUQwpNhJA}"
+: "${FIREFOX_PROFILE_DIR:=$BENCH_SCRATCH/ff_bench_youtube}"
+: "${FIREFOX_EXE:=}"
+: "${BASE_IMAGE:=lifetrac-v25:latest}"
+: "${TRACTOR_PROBE_IMAGE:=hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44}"
+: "${TRACTOR_APP_IMAGE:=lifetrac-tractor-x8:latest}"
+: "${BASE_BROKER_CONTAINER:=design-controller-mosquitto-1}"
+case $BASE_TRANSPORT in adb|ssh) ;; *) echo "bench_env: BASE_TRANSPORT must be adb or ssh, not '$BASE_TRANSPORT'" >&2; return 1 2>/dev/null || exit 1;; esac
+case $BENCH_SUDO_PW in *"'"*) echo "bench_env: BENCH_SUDO_PW must not contain a single quote" >&2; return 1 2>/dev/null || exit 1;; esac
+
+BASE_SSH_KEY=$(win_path "$BASE_SSH_KEY")
+BENCH_SCRATCH=$(win_path "$BENCH_SCRATCH")
+EVIDENCE_DIR=$(win_path "$EVIDENCE_DIR")
+ARCHIVE_DIR=$(win_path "$ARCHIVE_DIR")
+FIREFOX_PROFILE_DIR=$(win_path "$FIREFOX_PROFILE_DIR")
+mkdir -p "$BENCH_SCRATCH"
+
+# Everything but the password is exported, so nested scripts, PowerShell and the
+# Python tools see the same values.
+export REPO_ROOT DC HELPER_DIR BT_DIR LEGS_DIR BENCH_ENV_FILE
+export BASE_SERIAL TRACTOR_SERIAL BASE_TRANSPORT BASE_HOST BASE_SSH_USER BASE_SSH_KEY PC_HOST BENCH_SCRATCH \
+       EVIDENCE_DIR ARCHIVE_DIR DTS_CARRIER_HZ DTS_CARRIER_DATE YOUTUBE_URL FIREFOX_PROFILE_DIR FIREFOX_EXE \
+       BASE_IMAGE TRACTOR_PROBE_IMAGE TRACTOR_APP_IMAGE BASE_BROKER_CONTAINER
+
+# --- constants ------------------------------------------------------------------
+BOARD_STAGE=/tmp/lifetrac_strict          # run_live_radio_monitor.ps1 mounts exactly this as /work
+BOARD_FLASH_STAGE=/tmp/lifetrac_p0c       # flash tooling + the harness's openocd reset cfg
+SUDO="echo '$BENCH_SUDO_PW' | sudo -S -p ''"
+PROBE_RUN="docker run --rm --network=host --entrypoint python3 --device=/dev/ttymxc3 -v $BOARD_STAGE:/work -w /work -e PYTHONPATH=/work:/work/paho"
+WORK_RUN="docker run --rm --network=host --entrypoint python3 -v $BOARD_STAGE:/work -w /work -e PYTHONPATH=/work:/work/paho"
+# accept-new: a PC without a known_hosts entry for the base would otherwise fail every
+# BatchMode call (deploy_base.sh does the same); a CHANGED host key still fails.
+BENCH_SSH_OPTS=(-i "$BASE_SSH_KEY" -o BatchMode=yes -o ConnectTimeout=8 -o StrictHostKeyChecking=accept-new)
+
+# --- board helpers ----------------------------------------------------------------
+board_role() {
+  case "$1" in
+    base|"$BASE_SERIAL") echo base ;;
+    tractor|"$TRACTOR_SERIAL") echo tractor ;;
+    *) echo other ;;
+  esac
+}
+
+board_serial() {
+  case "$1" in
+    base) echo "$BASE_SERIAL" ;;
+    tractor) echo "$TRACTOR_SERIAL" ;;
+    *) echo "$1" ;;
+  esac
+}
+
+board_via() {
+  if [ "$(board_role "$1")" = base ] && [ "$BASE_TRANSPORT" = ssh ]; then echo ssh; else echo adb; fi
+}
+
+board_sh() {
+  local who=$1 ser
+  shift
+  ser=$(board_serial "$who")
+  if [ "$(board_via "$who")" = ssh ]; then
+    ssh "${BENCH_SSH_OPTS[@]}" "$BASE_SSH_USER@$BASE_HOST" "$*" < /dev/null | tr -d '\r'
+    return "${PIPESTATUS[0]}"
+  fi
+  adb -s "$ser" shell "$*" < /dev/null | tr -d '\r'
+  return "${PIPESTATUS[0]}"
+}
+
+board_sudo() {                           # board_sh with the password piped into sudo for the first command
+  local who=$1
+  shift
+  board_sh "$who" "$SUDO $*"
+}
+
+board_present() {
+  local who=$1 ser
+  ser=$(board_serial "$who")
+  if [ "$(board_via "$who")" = ssh ]; then
+    ssh "${BENCH_SSH_OPTS[@]}" "$BASE_SSH_USER@$BASE_HOST" true < /dev/null > /dev/null 2>&1
+    return
+  fi
+  adb devices 2>/dev/null | tr -d '\r' | awk 'NR>1 && $2=="device"{print $1}' | grep -qx "$ser" \
+    && adb -s "$ser" shell true < /dev/null > /dev/null 2>&1
+}
+
+board_push() {
+  local who=$1 src dst=$3 ser
+  src=$(win_path "$2")
+  ser=$(board_serial "$who")
+  [ -e "$src" ] || { echo "board_push: no such file: $src" >&2; return 1; }
+  if [ "$(board_via "$who")" = ssh ]; then
+    if command -v cygpath >/dev/null 2>&1; then src=$(cygpath -u "$src"); fi   # not C:/... (host "C")
+    scp -q -r "${BENCH_SSH_OPTS[@]}" "$src" "$BASE_SSH_USER@$BASE_HOST:$dst" < /dev/null
+  else
+    adb -s "$ser" push "$src" "$dst" < /dev/null > /dev/null
+  fi
+}
+
+board_push_lf() {                         # CRLF trap: board shell scripts / cfg / conf must be LF
+  local tmp
+  mkdir -p "$BENCH_SCRATCH/lf"
+  tmp="$BENCH_SCRATCH/lf/$(basename "$2")"
+  tr -d '\r' < "$2" > "$tmp" || return 1
+  board_push "$1" "$tmp" "$3"
+}
+
+board_pull() {
+  local who=$1 src=$2 dst ser
+  dst=$(win_path "$3")
+  ser=$(board_serial "$who")
+  if [ "$(board_via "$who")" = ssh ]; then
+    if command -v cygpath >/dev/null 2>&1; then dst=$(cygpath -u "$dst"); fi   # not C:/... (host "C")
+    scp -q -r "${BENCH_SSH_OPTS[@]}" "$BASE_SSH_USER@$BASE_HOST:$src" "$dst" < /dev/null
+  else
+    adb -s "$ser" pull "$src" "$dst" < /dev/null > /dev/null
+  fi
+}
+
+board_image() {
+  case "$(board_role "$1")" in
+    base) echo "$BASE_IMAGE" ;;
+    *) echo "$TRACTOR_PROBE_IMAGE" ;;
+  esac
+}
+
+board_has_image() {
+  [ "$(board_sh "$1" "$SUDO docker image inspect -f ok $2 2>/dev/null")" = ok ]
+}
+
+board_uart_holders() {
+  # The markers tell "nobody holds it" apart from "the check never ran" (fuser missing,
+  # sudo refused, transport down): the latter answers unknown(...), never "free".
+  local out
+  out=$(board_sh "$1" "$SUDO sh -c 'if command -v fuser >/dev/null 2>&1; then fuser /dev/ttymxc3 2>/dev/null; echo; echo __UART_CHK_DONE__; else echo __UART_NO_FUSER__; fi'")
+  case $out in
+    *__UART_NO_FUSER__*) echo "unknown(no fuser on the board)"; return 0 ;;
+    *__UART_CHK_DONE__*) ;;
+    *) echo "unknown(check failed: sudo or transport)"; return 0 ;;
+  esac
+  printf '%s\n' "$out" | grep -v '__UART_CHK_DONE__' | tr -s ' \n' ' ' | sed 's/^ //; s/ $//'
+}
+
+board_containers() {
+  board_sh "$1" "$SUDO docker ps --format '{{.Names}}'" | tr '\n' ' ' | sed 's/ $//'
+}
+
+strip_to_gzip() {
+  bench_py -c "import sys;p=sys.argv[1];d=open(p,'rb').read();i=d.find(b'\x1f\x8b\x08');assert 0<=i<64,i;open(p,'wb').write(d[i:])" "$1"
+}
+
+bench_require_dts_carrier() {
+  local f=${DTS_CARRIER_HZ:-} today
+  today=$(date +%Y-%m-%d)
+  if [ -z "$f" ]; then
+    echo "REFUSED: DTS_CARRIER_HZ is empty. Run a receive-only channel spot-check today with the tractor parked" >&2
+    echo "         (RS13_VECTOR_LEG.md 'Pin the DTS carrier'), then set DTS_CARRIER_HZ and DTS_CARRIER_DATE in $BT_DIR/bench.env." >&2
+    return 1
+  fi
+  case $f in *[!0-9]*) echo "REFUSED: DTS_CARRIER_HZ='$f' is not an integer number of Hz" >&2; return 1 ;; esac
+  if [ "$f" -lt 902250000 ] || [ "$f" -gt 927750000 ]; then
+    echo "REFUSED: DTS_CARRIER_HZ=$f is outside 902250000..927750000 (the 500 kHz channel must stay inside 902-928 MHz)" >&2
+    return 1
+  fi
+  if [ "$f" = 915000000 ] && [ "${DTS_ALLOW_915:-0}" != 1 ]; then
+    echo "REFUSED: 915000000 is the channel of the known RS-11.6 external emitter (RS-13.1 A19). Pick another carrier, or set DTS_ALLOW_915=1 to fly there on purpose." >&2
+    return 1
+  fi
+  if [ -n "${DTS_CARRIER_DATE:-}" ]; then
+    if [ "$DTS_CARRIER_DATE" != "$today" ]; then
+      echo "REFUSED: the spot-check behind DTS_CARRIER_HZ=$f is dated $DTS_CARRIER_DATE, not today ($today). The band changes from day to day: re-check." >&2
+      return 1
+    fi
+  else
+    echo "WARN: DTS_CARRIER_DATE is empty -- make sure the spot-check for $f Hz was made today." >&2
+  fi
+  return 0
+}
+
+bench_check_name() {                     # bench_check_name WHAT VALUE
+  case $2 in
+    ''|*[!A-Za-z0-9_.-]*) die "$1 '$2' is not allowed: use only letters, digits, '_', '.' and '-' (it goes into file names and board shell commands)" ;;
+  esac
+}
+
+bench_evidence_dir() {
+  mkdir -p "$EVIDENCE_DIR" || return 1
+  printf '%s\n' "$EVIDENCE_DIR"
+}
+
+bench_git_desc() {
+  local b s d=""
+  b=$(git -C "$REPO_ROOT" rev-parse --abbrev-ref HEAD 2>/dev/null || echo '?')
+  s=$(git -C "$REPO_ROOT" rev-parse --short HEAD 2>/dev/null || echo '?')
+  git -C "$REPO_ROOT" diff --quiet HEAD -- 2>/dev/null || d=" +dirty"
+  echo "$b @ $s$d"
+}
+
+bench_show_env() {
+  local v
+  echo "settings file: $BENCH_ENV_FILE"
+  echo "repo:          $REPO_ROOT ($(bench_git_desc))"
+  for v in $_BENCH_VARS; do
+    [ "$v" = BENCH_SUDO_PW ] && { echo "BENCH_SUDO_PW=(set, not shown)"; continue; }
+    echo "$v=${!v}"
+  done
+}
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/env_file.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/env_file.sh
new file mode 100644
index 00000000..6bf2e64a
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/lib/env_file.sh
@@ -0,0 +1,53 @@
+# shellcheck shell=bash
+# lib/env_file.sh -- the one bench.env loader. lib/bench_env.sh and the setup
+# scripts (provision_bench_board.sh, flash_l072.sh, deploy_base.sh,
+# build_tractor_image.sh, pull_board_state.sh) source this file and call
+#
+#     bench_load_env_file FILE
+#
+# so that every bench script applies the same rules (bench.env.example states
+# them for the operator):
+#   * CR bytes are dropped first, so a bench.env saved with CRLF endings works;
+#   * every VAR=... line of FILE is applied, EXCEPT that a variable which is
+#     already NON-EMPTY when the function runs keeps that value: the caller's
+#     environment wins over the file (one-off override:
+#     `TRACTOR_SERIAL=... bash flash_l072.sh ...`);
+#   * old names: BASE_USER is BASE_SSH_USER and BENCH_ARCHIVE_DIR is ARCHIVE_DIR.
+#     A caller's old name counts as the caller's new name; at the same level the
+#     new name wins. Afterwards both names of a pair hold the same value (both
+#     stay unset when neither is set).
+# FILE is bash: plain VAR=value lines (a `declare` or `local` in it would stay
+# inside the function). Nothing is exported here; each script decides what to
+# export. Defines only the function; needs bash 3.2 or later.
+
+bench_load_env_file() {
+  local _blef_file=$1 _blef_v _blef_p _blef_keep="" _blef_new _blef_old
+  local _blef_aliases="BASE_SSH_USER:BASE_USER ARCHIVE_DIR:BENCH_ARCHIVE_DIR"
+  [ -f "$_blef_file" ] || { echo "bench_load_env_file: no such file: $_blef_file" >&2; return 1; }
+  for _blef_p in $_blef_aliases; do               # the caller's old name = its new name
+    _blef_new=${_blef_p%%:*}; _blef_old=${_blef_p#*:}
+    if [ -z "${!_blef_new:-}" ] && [ -n "${!_blef_old:-}" ]; then printf -v "$_blef_new" '%s' "${!_blef_old}"; fi
+  done
+  # snapshot every non-empty variable the file would assign (and the new alias names)
+  for _blef_v in $(tr -d '\r' < "$_blef_file" \
+                   | sed -n 's/^[[:space:]]*\(export[[:space:]][[:space:]]*\)\{0,1\}\([A-Za-z_][A-Za-z0-9_]*\)=.*/\2/p') \
+                 BASE_SSH_USER ARCHIVE_DIR; do
+    case $_blef_v in _blef_*) continue ;; esac
+    if [ -n "${!_blef_v:-}" ]; then
+      _blef_keep="$_blef_keep $_blef_v"
+      printf -v "_blef_pre_$_blef_v" '%s' "${!_blef_v}"
+    fi
+  done
+  eval "$(tr -d '\r' < "$_blef_file")" || { echo "bench_load_env_file: error in $_blef_file" >&2; return 1; }
+  for _blef_v in $_blef_keep; do                 # the caller's values win
+    _blef_p=_blef_pre_$_blef_v
+    if [ -n "${!_blef_p+x}" ]; then printf -v "$_blef_v" '%s' "${!_blef_p}"; unset "$_blef_p"; fi
+  done
+  for _blef_p in $_blef_aliases; do               # one value for both names
+    _blef_new=${_blef_p%%:*}; _blef_old=${_blef_p#*:}
+    if [ -n "${!_blef_new:-}" ]; then printf -v "$_blef_old" '%s' "${!_blef_new}"
+    elif [ -n "${!_blef_old:-}" ]; then printf -v "$_blef_new" '%s' "${!_blef_old}"
+    fi
+  done
+  return 0
+}
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/provision_bench_board.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/provision_bench_board.sh
new file mode 100644
index 00000000..8d0fb4d3
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/provision_bench_board.sh
@@ -0,0 +1,505 @@
+#!/usr/bin/env bash
+# provision_bench_board.sh -- bring one freshly imaged Portenta X8 (on a Max
+# Carrier) to the LifeTrac bench state, or report how far it is from it.
+#
+#   bash provision_bench_board.sh base    [--check] [--ssh] [--nic-100]
+#   bash provision_bench_board.sh tractor [--check] [--mosquitto-from-base | --mosquitto-tar FILE]
+#   bash provision_bench_board.sh --help
+#
+# Runs on the bench PC (Git Bash on Windows; any bash with adb works). Talks to
+# one board over adb (the base can use ssh with --ssh). Every step checks first
+# and changes only what is missing, so re-running it is safe. --check changes
+# nothing and exits 3 if something is still to do.
+#
+# What it applies (BENCH_SETUP.md explains each step):
+#   both     sudoers drop-in (../install_lifetrac_nopasswd.sh), docker running,
+#            the probe image hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44
+#            (repo-root foundries_python.tar; radio_park.py / radio_state.py /
+#            rs116_health_probe.py run in it)
+#   base     compose-apps-early-start{,-recovery}.service masked, the PC's ssh
+#            key in fio's authorized_keys, eclipse-mosquitto:2 pulled,
+#            optional eth0 100BASE-TX full pin (--nic-100)
+#   tractor  WiFi off for good (units/disable-wifi.service enabled,
+#            wpa_supplicant masked, nmcli radio wifi off, stored WiFi profiles
+#            deleted after a root-only backup tarball in /root on the board),
+#            camera USB provisioning (../provision_x8.sh),
+#            eclipse-mosquitto:2 loaded from the base or a tarball; the
+#            compose-apps mask too, unless the board still runs the factory
+#            674 image (where that unit succeeds)
+#
+# Radio safety: this script never opens /dev/ttymxc3 (the L072 radio UART),
+# never starts lifetrac-base.service, lifetrac-base-compose.service or
+# lifetrac-tractor-compose.service, and on the tractor it leaves
+# lifetrac-camera.service and the tractor-camera container stopped (both map
+# /dev/ttymxc3; they come back at the next boot).
+#
+# Settings come from bench.env next to this script ($BENCH_ENV; copy
+# bench.env.example), loaded by lib/env_file.sh like every bench script: CRLF is
+# tolerated and a NON-EMPTY variable already in the environment wins over the
+# file. Anything still unset gets these defaults (the original bench pair):
+#   BASE_SERIAL=2D0A1209DABC240B  TRACTOR_SERIAL=2E2C1209DABC240B
+#   BASE_HOST=192.168.1.117       BENCH_SUDO_PW=fio (used once, to install sudoers)
+#   BASE_SSH_KEY=~/.ssh/lifetrac_base_ed25519  BASE_SSH_USER=fio (old name
+#   BASE_USER)  ADB=adb
+# The password is never printed.
+
+set -u
+
+usage() {
+  sed -n '2,/^$/{s/^# \{0,1\}//;p}' "$0"
+  cat <<'EOF'
+Options:
+  --check                 report only; change nothing (exit 3 if anything is missing)
+  --serial SERIAL         adb serial of the board (default: BASE_SERIAL / TRACTOR_SERIAL)
+  --ssh                   base only: use ssh to BASE_HOST instead of adb
+  --nic-100               base only: pin 'Wired connection 1' to 100BASE-TX full
+                          (workaround for a marginal cable; leave it off on a good cable)
+  --mosquitto-from-base   tractor only: docker save eclipse-mosquitto:2 on the base,
+                          copy it through the PC and docker load it on the tractor
+  --mosquitto-tar FILE    tractor only: docker load eclipse-mosquitto:2 from FILE (a docker save tarball)
+  --mask-compose          tractor only: mask compose-apps-early-start{,-recovery} even on the 674 image
+  --keep-wifi-profiles    tractor only: do not delete stored NetworkManager WiFi profiles
+                          (without it they are deleted after a root-only backup on the board)
+  --allow-camera-restart  tractor only: allow provision_x8.sh to run although a camera compose
+                          app is installed (it restarts lifetrac-camera.service, which maps the
+                          radio UART; this script stops it again right after)
+  -h, --help              this text
+Exit codes: 0 done / all present, 1 a step failed, 2 usage or board unreachable, 3 --check found work to do.
+EOF
+}
+
+# ---------------------------------------------------------------- settings --
+SCRIPT_DIR=$(cd "$(dirname "$0")" && pwd)
+HELPER_DIR=$(cd "$SCRIPT_DIR/.." && pwd)
+REPO_ROOT=$(cd "$SCRIPT_DIR/../../../../.." && pwd)
+
+BENCH_ENV=${BENCH_ENV:-${BENCH_ENV_FILE:-$SCRIPT_DIR/bench.env}}
+# shellcheck source=lib/env_file.sh
+. "$SCRIPT_DIR/lib/env_file.sh" || exit 2
+if [ -f "$BENCH_ENV" ]; then
+  # CR stripped (a bench.env saved by a Windows editor); the environment wins
+  bench_load_env_file "$BENCH_ENV" || exit 2
+else
+  echo "WARN: no $BENCH_ENV -- the original bench's serials and address apply unless set in the environment (cp bench.env.example bench.env; BENCH_SETUP.md 5.3)" >&2
+fi
+BASE_SERIAL=${BASE_SERIAL:-2D0A1209DABC240B}
+TRACTOR_SERIAL=${TRACTOR_SERIAL:-2E2C1209DABC240B}
+BASE_HOST=${BASE_HOST:-192.168.1.117}
+BENCH_SUDO_PW=${BENCH_SUDO_PW:-fio}
+BASE_SSH_KEY=${BASE_SSH_KEY:-$HOME/.ssh/lifetrac_base_ed25519}
+BASE_USER=${BASE_SSH_USER:-${BASE_USER:-fio}}
+ADB=${ADB:-adb}
+
+FOUNDRIES_IMG=hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44
+FOUNDRIES_TAR=$REPO_ROOT/foundries_python.tar
+MOSQ_IMG=eclipse-mosquitto:2
+NIC_CON='Wired connection 1'
+RSTAGE=/tmp/lifetrac_provision          # on the board (tmpfs; gone after a reboot)
+UNIT_WIFI=$SCRIPT_DIR/units/disable-wifi.service
+
+# --------------------------------------------------------------- arguments --
+ROLE=""; CHECK_ONLY=0; SERIAL_ARG=""; USE_SSH=0; NIC_100=0
+MOSQ_FROM_BASE=0; MOSQ_TAR=""; MASK_COMPOSE=0; KEEP_WIFI=0; ALLOW_CAMERA_RESTART=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    base|tractor)           ROLE=$1 ;;
+    --check)                CHECK_ONLY=1 ;;
+    --serial|--mosquitto-tar)
+      case "${2:-}" in ''|-*) echo "$1 needs a value" >&2; exit 2 ;; esac
+      if [ "$1" = --serial ]; then SERIAL_ARG=$2; else MOSQ_TAR=$2; fi
+      shift ;;
+    --ssh)                  USE_SSH=1 ;;
+    --nic-100)              NIC_100=1 ;;
+    --mosquitto-from-base)  MOSQ_FROM_BASE=1 ;;
+    --mask-compose)         MASK_COMPOSE=1 ;;
+    --keep-wifi-profiles)   KEEP_WIFI=1 ;;
+    --allow-camera-restart) ALLOW_CAMERA_RESTART=1 ;;
+    -h|--help)              usage; exit 0 ;;
+    *) echo "unknown argument: $1 (see --help)" >&2; exit 2 ;;
+  esac
+  shift
+done
+[ -n "$ROLE" ] || { usage; exit 2; }
+if [ "$ROLE" = tractor ] && [ "$USE_SSH" = 1 ]; then
+  echo "--ssh is for the base only; the tractor is reached over adb (its WiFi stays off)" >&2; exit 2
+fi
+if [ "$ROLE" = base ] && { [ "$MOSQ_FROM_BASE" = 1 ] || [ -n "$MOSQ_TAR" ]; }; then
+  echo "--mosquitto-* are for the tractor; the base pulls $MOSQ_IMG itself" >&2; exit 2
+fi
+
+if [ "$USE_SSH" = 1 ]; then
+  TRANSPORT=ssh; TARGET=$BASE_HOST
+else
+  TRANSPORT=adb
+  if [ -n "$SERIAL_ARG" ]; then TARGET=$SERIAL_ARG
+  elif [ "$ROLE" = base ]; then TARGET=$BASE_SERIAL
+  else TARGET=$TRACTOR_SERIAL; fi
+fi
+
+# ----------------------------------------------------------------- helpers --
+say() { printf '%s\n' "$*"; }
+die() { printf 'ERROR: %s\n' "$2" >&2; exit "$1"; }
+indent() { sed 's/^/      /'; }
+
+winpath() {  # adb.exe wants C:/... paths; elsewhere the path is used as is
+  if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else printf '%s' "$1"; fi
+}
+unixpath() {  # scp reads C:/... as host "C": give it /c/... (e.g. --mosquitto-tar C:/x.tar)
+  if command -v cygpath >/dev/null 2>&1; then cygpath -u "$1"; else printf '%s' "$1"; fi
+}
+
+# on <adb|ssh> <serial|host> <command>: run a shell command on a board, CR stripped
+on() {
+  if [ "$1" = ssh ]; then
+    ssh -i "$BASE_SSH_KEY" -o BatchMode=yes -o ConnectTimeout=10 "$BASE_USER@$2" "$3" 2>&1 | tr -d '\r'
+  else
+    MSYS_NO_PATHCONV=1 "$ADB" -s "$2" shell "$3" 2>&1 | tr -d '\r'
+  fi
+}
+push_to() {    # push_to <adb|ssh> <serial|host> <local file> <remote path>
+  if [ "$1" = ssh ]; then
+    scp -q -i "$BASE_SSH_KEY" -o BatchMode=yes "$(unixpath "$3")" "$BASE_USER@$2:$4"
+  else
+    MSYS_NO_PATHCONV=1 "$ADB" -s "$2" push "$(winpath "$3")" "$4" >/dev/null
+  fi
+}
+pull_from() {  # pull_from <adb|ssh> <serial|host> <remote path> <local file>
+  if [ "$1" = ssh ]; then
+    scp -q -i "$BASE_SSH_KEY" -o BatchMode=yes "$BASE_USER@$2:$3" "$(unixpath "$4")"
+  else
+    MSYS_NO_PATHCONV=1 "$ADB" -s "$2" pull "$3" "$(winpath "$4")" >/dev/null
+  fi
+}
+rsh()   { on "$TRANSPORT" "$TARGET" "$1"; }
+# rtest '<shell condition>': true when it succeeds on the board (does not rely on
+# adb propagating exit codes, which older adbd builds do not)
+rtest() { [ "$(rsh "if { $1; } >/dev/null 2>&1; then echo __YES__; else echo __NO__; fi" | tail -n 1)" = __YES__ ]; }
+rval()  { rsh "$1" | tail -n 1; }
+
+LSTAGE=$(mktemp -d "${TMPDIR:-/tmp}/lifetrac_provision.XXXXXX") || die 2 "mktemp failed"
+trap 'rm -rf "$LSTAGE"' EXIT
+
+stage_text() {  # stage_text <local text file> <remote dir>: strip CR, then push
+  local name; name=$(basename "$1")
+  sed 's/\r$//' "$1" > "$LSTAGE/$name" || return 1
+  push_to "$TRANSPORT" "$TARGET" "$LSTAGE/$name" "$2/$name"
+}
+lsha() { sed 's/\r$//' "$1" | sha256sum | awk '{print $1}'; }
+rsha() { rsh "sha256sum '$1' 2>/dev/null" | awk 'NF==2 {print $1}' | tail -n 1; }
+
+RESULTS=(); N_TODO=0; N_FAIL=0
+record() {  # record <status> <label>
+  RESULTS+=("$(printf '%-9s %s' "[$1]" "$2")")
+  printf '  %-9s %s\n' "[$1]" "$2"
+  case "$1" in TODO) N_TODO=$((N_TODO + 1)) ;; FAILED) N_FAIL=$((N_FAIL + 1)) ;; esac
+}
+info() { record info "$1"; }
+# item <label> <check command> <apply command>: check; if missing and not
+# --check, apply and check again. Commands are this script's own functions.
+item() {
+  if eval "$2"; then record ok "$1"; return 0; fi
+  if [ "$CHECK_ONLY" = 1 ]; then record TODO "$1"; return 1; fi
+  say "  ->        applying: $1"
+  eval "$3"
+  if eval "$2"; then record applied "$1"; return 0; fi
+  record FAILED "$1"; return 1
+}
+
+# ------------------------------------------------------------------- steps --
+# sudo without a password: everything after this uses 'sudo -n'
+chk_sudo() { rtest 'sudo -n test -f /etc/sudoers.d/99-lifetrac-bench-nopasswd'; }
+app_sudo() {
+  local pw
+  rsh "mkdir -p $RSTAGE" >/dev/null
+  stage_text "$HELPER_DIR/install_lifetrac_nopasswd.sh" "$RSTAGE" || return 1
+  pw=$(printf '%s' "$BENCH_SUDO_PW" | sed "s/'/'\\\\''/g")
+  rsh "printf '%s\n' '$pw' | sudo -S -p '' sh $RSTAGE/install_lifetrac_nopasswd.sh" | grep -v '^$' | indent
+}
+
+chk_masked() { [ "$(rval "systemctl is-enabled $1 2>/dev/null")" = masked ]; }
+app_mask()   { rsh "sudo -n systemctl mask --now $1" | indent; }
+
+chk_docker() { rtest 'sudo -n docker info'; }
+app_docker() { rsh 'sudo -n systemctl start docker.service' | indent; }
+
+chk_image() { rtest "sudo -n docker image inspect $1"; }
+load_tar() {  # load_tar <local tarball> <remote file name>
+  rsh "mkdir -p $RSTAGE" >/dev/null
+  say "      pushing $(basename "$1") ($(du -k "$1" | awk '{print $1}') KiB) ..."
+  push_to "$TRANSPORT" "$TARGET" "$1" "$RSTAGE/$2" || return 1
+  rsh "sudo -n docker load -i $RSTAGE/$2; rm -f $RSTAGE/$2" | indent
+}
+app_foundries() {
+  [ -f "$FOUNDRIES_TAR" ] || { say "      $FOUNDRIES_TAR is missing (it is tracked at the repo root)"; return 1; }
+  load_tar "$FOUNDRIES_TAR" foundries_python.tar
+}
+app_mosq_pull() { rsh "sudo -n docker pull $MOSQ_IMG" | tail -n 3 | indent; }
+
+fetch_mosq_from_base() {  # base -> PC: ssh when the key exists, else adb
+  local btr btg
+  for btr in ssh adb; do
+    if [ "$btr" = ssh ]; then
+      { [ -f "$BASE_SSH_KEY" ] && [ -n "$BASE_HOST" ]; } || continue
+      btg=$BASE_HOST
+    else
+      btg=$BASE_SERIAL
+    fi
+    say "      docker save $MOSQ_IMG on the base ($btr $btg) ..."
+    if on "$btr" "$btg" "sudo -n docker image inspect $MOSQ_IMG >/dev/null 2>&1 || sudo -n docker pull $MOSQ_IMG >/dev/null; sudo -n docker save -o /tmp/eclipse-mosquitto_2.tar $MOSQ_IMG && sudo -n chmod 0644 /tmp/eclipse-mosquitto_2.tar && echo __SAVED__" | grep -q __SAVED__ \
+       && pull_from "$btr" "$btg" /tmp/eclipse-mosquitto_2.tar "$LSTAGE/eclipse-mosquitto_2.tar"; then
+      on "$btr" "$btg" "sudo -n rm -f /tmp/eclipse-mosquitto_2.tar" >/dev/null
+      return 0
+    fi
+  done
+  say "      could not get $MOSQ_IMG from the base (provision it first: provision_bench_board.sh base)"
+  return 1
+}
+app_mosq_tractor() {
+  local tar
+  if [ -n "$MOSQ_TAR" ]; then
+    tar=$MOSQ_TAR
+  elif [ "$MOSQ_FROM_BASE" = 1 ]; then
+    fetch_mosq_from_base || return 1
+    tar=$LSTAGE/eclipse-mosquitto_2.tar
+  else
+    say "      the tractor has no network; re-run with --mosquitto-from-base (base provisioned and reachable)"
+    say "      or --mosquitto-tar FILE (a 'docker save $MOSQ_IMG' tarball on this PC)"
+    return 1
+  fi
+  [ -f "$tar" ] || { say "      no such file: $tar"; return 1; }
+  load_tar "$tar" eclipse-mosquitto_2.tar
+}
+
+nic_val() { rval "nmcli -g $1 connection show '$NIC_CON' 2>/dev/null"; }
+chk_nic() { [ "$(nic_val 802-3-ethernet.speed)" = 100 ] && [ "$(nic_val 802-3-ethernet.duplex)" = full ]; }
+app_nic() {
+  rtest "nmcli -g connection.id connection show '$NIC_CON'" \
+    || { say "      no NetworkManager profile '$NIC_CON' (is the ethernet cable plugged in?)"; return 1; }
+  # auto-negotiate stays on: NetworkManager then advertises only 100/full, which is
+  # what the bench base runs (capture 20_network.txt) and avoids a duplex mismatch
+  rsh "sudo -n nmcli connection modify '$NIC_CON' 802-3-ethernet.speed 100 802-3-ethernet.duplex full 802-3-ethernet.auto-negotiate yes" | indent
+  if [ "$TRANSPORT" = adb ]; then
+    rsh "sudo -n nmcli connection up '$NIC_CON'" | indent
+  else
+    say "      saved; it takes effect at the next 'nmcli connection up' or reboot (not re-activated over ssh)"
+  fi
+}
+
+PUBKEY=$BASE_SSH_KEY.pub
+pubkey_id() { sed 's/\r$//' "$PUBKEY" | head -n 1 | awk '{print $1" "$2}'; }
+chk_sshkey() { [ -f "$PUBKEY" ] && rtest "grep -qF '$(pubkey_id)' ~/.ssh/authorized_keys"; }
+app_sshkey() {
+  if [ ! -f "$PUBKEY" ]; then
+    say "      no public key at $PUBKEY; create the pair on this PC first:"
+    say "      ssh-keygen -t ed25519 -f ~/.ssh/lifetrac_base_ed25519 -C lifetrac-bench-pc"
+    return 1
+  fi
+  rsh "mkdir -p $RSTAGE" >/dev/null
+  sed 's/\r$//' "$PUBKEY" | head -n 1 > "$LSTAGE/pc_key.pub"
+  push_to "$TRANSPORT" "$TARGET" "$LSTAGE/pc_key.pub" "$RSTAGE/pc_key.pub" || return 1
+  rsh "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat $RSTAGE/pc_key.pub >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys; rm -f $RSTAGE/pc_key.pub" | indent
+}
+
+# tractor: WiFi off for good
+chk_wifi_unit() { [ "$(rsha /etc/systemd/system/disable-wifi.service)" = "$(lsha "$UNIT_WIFI")" ]; }
+app_wifi_unit() {
+  rsh "mkdir -p $RSTAGE" >/dev/null
+  stage_text "$UNIT_WIFI" "$RSTAGE" || return 1
+  rsh "sudo -n cp $RSTAGE/disable-wifi.service /etc/systemd/system/disable-wifi.service && sudo -n chown root:root /etc/systemd/system/disable-wifi.service && sudo -n chmod 0644 /etc/systemd/system/disable-wifi.service && sudo -n systemctl daemon-reload" | indent
+}
+chk_wifi_enabled() { [ "$(rval 'systemctl is-enabled disable-wifi.service 2>/dev/null')" = enabled ]; }
+app_wifi_enabled() { rsh 'sudo -n systemctl enable disable-wifi.service' | indent; }
+# Remote commands below avoid embedded double quotes (they cross the Windows
+# command line on the way to adb.exe), and the negative checks first prove the
+# query itself works, so a missing 'sudo -n' reads as TODO, not as ok.
+chk_rfkill() { rtest "sudo -n /usr/sbin/rfkill list wifi >/dev/null && ! sudo -n /usr/sbin/rfkill list wifi | grep -q 'Soft blocked: no'"; }
+app_rfkill() { rsh 'sudo -n systemctl start disable-wifi.service; sudo -n /usr/sbin/rfkill block wifi' | indent; }
+chk_nm_wifi() { [ "$(rval 'nmcli radio wifi 2>/dev/null')" = disabled ]; }
+app_nm_wifi() { rsh 'sudo -n nmcli radio wifi off' | indent; }
+
+NM_LIST="sudo -n nmcli -t -f UUID,TYPE connection show"
+WIFI_UUIDS="$NM_LIST 2>/dev/null | grep ':802-11-wireless\$' | cut -d: -f1"
+chk_wifi_profiles() { rtest "$NM_LIST >/dev/null && ! $NM_LIST | grep -q ':802-11-wireless\$'"; }
+list_wifi_profiles() {  # profile names only; secrets are never requested
+  rsh "for u in \$($WIFI_UUIDS); do nmcli -g connection.id connection show uuid \$u 2>/dev/null; done"
+}
+app_wifi_profiles() {
+  local bk
+  # Back the stored profiles up first, root-only (0600): the board may hold the only
+  # copy of a WiFi credential. Nothing from the backup is printed.
+  bk=$(rval "sudo -n sh -c 'umask 077; d=/etc/NetworkManager/system-connections; f=/root/lifetrac_nm_profiles_\$(date -u +%Y%m%dT%H%M%SZ).tgz; if [ -d \$d ] && tar -czf \$f -C \$d . && chmod 600 \$f; then echo \$f; else echo NONE; fi' 2>/dev/null")
+  case "$bk" in
+    /root/lifetrac_nm_profiles_*.tgz)
+      say "      stored profiles backed up on the board (root-only): $bk"
+      say "      restore: sudo tar -xzf $bk -C /etc/NetworkManager/system-connections && sudo nmcli connection reload" ;;
+    *)
+      say "      could not back up /etc/NetworkManager/system-connections, so the WiFi profiles were NOT deleted"
+      say "      (re-run with --keep-wifi-profiles to skip this step)"
+      return 1 ;;
+  esac
+  rsh "for u in \$($WIFI_UUIDS); do n=\$(nmcli -g connection.id connection show uuid \$u 2>/dev/null); if sudo -n nmcli connection delete uuid \$u >/dev/null 2>&1; then echo deleted WiFi profile: \$n; else echo FAILED to delete WiFi profile: \$n; fi; done" | indent
+}
+
+# tractor: camera USB provisioning, by running the repo's provision_x8.sh unchanged
+CAM_FILES="lifetrac-no-usb-audio.conf:/etc/modprobe.d/lifetrac-no-usb-audio.conf 99-w2-01-c2.rules:/etc/udev/rules.d/99-w2-01-c2.rules lifetrac-camera.service:/etc/systemd/system/lifetrac-camera.service"
+chk_camera() {
+  local pair
+  for pair in $CAM_FILES; do
+    [ "$(rsha "${pair#*:}")" = "$(lsha "$HELPER_DIR/${pair%%:*}")" ] || return 1
+  done
+  rtest 'id -nG fio | grep -qw video'
+}
+app_camera() {
+  local f
+  if [ "$ALLOW_CAMERA_RESTART" != 1 ] && rtest 'test -e /dev/lifetrac-c2 && test -f /opt/lifetrac/compose-apps/lifetrac-camera/docker-compose.yml'; then
+    say "      not run: a camera compose app is installed and the C2 is attached, so provision_x8.sh"
+    say "      would restart lifetrac-camera.service, whose container maps /dev/ttymxc3 (the radio UART)."
+    say "      Re-run with --allow-camera-restart to accept that (it is stopped again right after)."
+    return 1
+  fi
+  rsh "mkdir -p $RSTAGE/camera" >/dev/null
+  for f in provision_x8.sh lifetrac-no-usb-audio.conf 99-w2-01-c2.rules lifetrac-camera.service; do
+    stage_text "$HELPER_DIR/$f" "$RSTAGE/camera" || return 1
+  done
+  rsh "cd $RSTAGE/camera && sudo -n bash provision_x8.sh" | indent
+  app_camera_stopped
+}
+
+# tractor: lifetrac-camera.service and the tractor-camera container map /dev/ttymxc3
+chk_camera_stopped() {
+  ! rtest 'systemctl is-active -q lifetrac-camera.service' \
+    && rtest "sudo -n docker ps >/dev/null && ! sudo -n docker ps --format '{{.Names}}' | grep -qx tractor-camera"
+}
+app_camera_stopped() {
+  rsh 'sudo -n systemctl stop lifetrac-camera.service 2>/dev/null; sudo -n docker stop tractor-camera >/dev/null 2>&1; true' >/dev/null
+}
+
+unit_report() {  # never started or changed here
+  local u st
+  for u in "$@"; do
+    st=$(rval "echo \$(systemctl is-enabled $u 2>/dev/null || true)/\$(systemctl is-active $u 2>/dev/null || true)")
+    case "$st" in
+      /*|not-found/*|/inactive) ;;   # not installed: nothing to say
+      *) info "$u is $st -- left alone; do not start it on the bench (it would run the radio stack)" ;;
+    esac
+  done
+}
+image_report() {  # image ids for the session record
+  local id
+  id=$(rval "sudo -n docker image inspect --format '{{.Id}}' $FOUNDRIES_IMG 2>/dev/null" | sed 's/^sha256://' | cut -c1-12)
+  [ -n "$id" ] && info "probe image id $id (foundries_python.tar loads 9a454afe48f7)"
+  id=$(rval "sudo -n docker image inspect --format '{{.Id}}' $MOSQ_IMG 2>/dev/null" | sed 's/^sha256://' | cut -c1-12)
+  [ -n "$id" ] && info "$MOSQ_IMG image id $id (a moving tag: note the id in the session evidence)"
+  return 0
+}
+uart_report() {
+  local h
+  if ! rtest 'command -v fuser'; then info "/dev/ttymxc3 holders: fuser not available on this image"; return; fi
+  h=$(rsh 'sudo -n fuser /dev/ttymxc3 2>/dev/null' | tr -s ' \n' ' ' | sed 's/^ //; s/ $//')
+  if [ -z "$h" ]; then info "/dev/ttymxc3 (radio UART) is free"
+  else info "WARNING: /dev/ttymxc3 (radio UART) is held by pid(s) $h"; fi
+}
+
+# --------------------------------------------------------------- preflight --
+if [ "$TRANSPORT" = adb ]; then
+  command -v "$ADB" >/dev/null 2>&1 || die 2 "adb not found; install Android platform-tools (PC_SETUP.md) or set ADB=/path/to/adb"
+  state=$(MSYS_NO_PATHCONV=1 "$ADB" -s "$TARGET" get-state 2>/dev/null | tr -d '\r')
+  if [ "$state" != device ]; then
+    say "adb devices:"; MSYS_NO_PATHCONV=1 "$ADB" devices -l | tr -d '\r' | indent
+    die 2 "board $TARGET is not listed as 'device' (state: ${state:-absent}). Set BASE_SERIAL / TRACTOR_SERIAL in $BENCH_ENV or pass --serial. Do not run 'adb kill-server' on a first-boot board."
+  fi
+else
+  [ -f "$BASE_SSH_KEY" ] || die 2 "no ssh key at $BASE_SSH_KEY (first run: use adb; the base step installs the key)"
+fi
+[ "$(rval 'echo __OK__')" = __OK__ ] || die 2 "cannot run a shell on $TARGET over $TRANSPORT"
+
+MODE=apply; [ "$CHECK_ONLY" = 1 ] && MODE=check
+IMAGE_VERSION=$(rval '. /etc/os-release 2>/dev/null; echo ${IMAGE_VERSION:-unknown}')
+say "== provision_bench_board.sh: $ROLE on $TARGET over $TRANSPORT ($MODE)"
+info "soc serial $(rval 'cat /sys/devices/soc0/serial_number 2>/dev/null'), $(rval '. /etc/os-release 2>/dev/null; echo LmP ${VERSION:-unknown}'), kernel $(rval 'uname -r'), shell user $(rval 'id -un')"
+if [ "$IMAGE_VERSION" != 934 ] && [ "$IMAGE_VERSION" != 674 ]; then
+  info "WARNING: image $IMAGE_VERSION has never run on this bench (934 = base, 674 = tractor); see BENCH_SETUP.md"
+fi
+
+# ------------------------------------------------------------------- steps --
+item "sudo without a password (sudoers.d/99-lifetrac-bench-nopasswd)" chk_sudo app_sudo
+if ! chk_sudo; then
+  [ "$CHECK_ONLY" = 1 ] || die 1 "the sudoers drop-in did not install; is BENCH_SUDO_PW right for this board?"
+  say "  note: 'sudo -n' does not work yet, so the root-only checks below read as TODO"
+fi
+
+need_compose_mask=0
+if [ "$ROLE" = base ] || [ "$MASK_COMPOSE" = 1 ] || [ "$IMAGE_VERSION" != 674 ]; then need_compose_mask=1; fi
+if [ "$need_compose_mask" = 1 ]; then
+  # On the 934 image compose-apps-early-start.service fails at boot; its OnFailure
+  # unit compose-apps-early-start-recovery.service then stops docker and deletes
+  # /var/lib/docker, about every 60 s. Mask both before relying on docker.
+  item "compose-apps-early-start-recovery.service masked (it wipes /var/lib/docker on 934)" \
+       "chk_masked compose-apps-early-start-recovery.service" "app_mask compose-apps-early-start-recovery.service"
+  item "compose-apps-early-start.service masked (its failure triggers the recovery unit)" \
+       "chk_masked compose-apps-early-start.service" "app_mask compose-apps-early-start.service"
+else
+  info "image 674: compose-apps-early-start.service succeeds here, left as is (--mask-compose to mask anyway)"
+fi
+
+if [ "$ROLE" = base ]; then
+  if [ "$NIC_100" = 1 ]; then
+    item "eth0 '$NIC_CON' pinned to 100BASE-TX full" chk_nic app_nic
+  else
+    info "eth0 '$NIC_CON': speed=$(nic_val 802-3-ethernet.speed) duplex=$(nic_val 802-3-ethernet.duplex) auto-negotiate=$(nic_val 802-3-ethernet.auto-negotiate) (--nic-100 pins 100/full)"
+  fi
+  item "PC ssh key ($PUBKEY) in fio's authorized_keys" chk_sshkey app_sshkey
+fi
+
+if [ "$ROLE" = tractor ]; then
+  item "units/disable-wifi.service installed in /etc/systemd/system" chk_wifi_unit app_wifi_unit
+  item "disable-wifi.service enabled (rfkill block wifi at every boot)" chk_wifi_enabled app_wifi_enabled
+  item "wpa_supplicant.service masked" "chk_masked wpa_supplicant.service" "app_mask wpa_supplicant.service"
+  item "WiFi soft-blocked now (rfkill)" chk_rfkill app_rfkill
+  item "NetworkManager WiFi radio off" chk_nm_wifi app_nm_wifi
+  if [ "$KEEP_WIFI" = 1 ]; then
+    names=$(list_wifi_profiles | tr '\n' ',' | sed 's/,$//; s/,/, /g')
+    info "stored WiFi profiles kept (--keep-wifi-profiles): ${names:-none}"
+  else
+    names=$(list_wifi_profiles | tr '\n' ',' | sed 's/,$//; s/,/, /g')
+    [ -n "$names" ] && say "  stored WiFi profiles found: $names"
+    item "no stored NetworkManager WiFi profiles" chk_wifi_profiles app_wifi_profiles
+  fi
+  item "camera USB provisioning (provision_x8.sh: modprobe, udev, lifetrac-camera.service, fio in video)" chk_camera app_camera
+fi
+
+item "docker running" chk_docker app_docker
+item "probe image $FOUNDRIES_IMG" "chk_image $FOUNDRIES_IMG" app_foundries
+if [ "$ROLE" = base ]; then
+  item "$MOSQ_IMG (the base broker image)" "chk_image $MOSQ_IMG" app_mosq_pull
+  unit_report lifetrac-base.service lifetrac-base-compose.service
+else
+  item "$MOSQ_IMG (the tractor's local broker; it cannot pull)" "chk_image $MOSQ_IMG" app_mosq_tractor
+  item "radio UART free: lifetrac-camera.service and tractor-camera stopped" chk_camera_stopped app_camera_stopped
+  unit_report lifetrac-tractor-compose.service
+fi
+image_report
+uart_report
+
+# ----------------------------------------------------------------- summary --
+say ""
+say "== summary: $ROLE $TARGET ($MODE)"
+for r in "${RESULTS[@]}"; do say "  $r"; done
+say ""
+say "Still to do by hand (BENCH_SETUP.md):"
+say "  [ ] verify: HC-01 / HC-02 health checks, then '$(basename "$0") $ROLE --check' shows no TODO"
+say "  [ ] L072 bench firmware (build md5 0c1bb0a9573f813137f941dfa47177d0): ../FLASH_RUNBOOK.md"
+if [ "$ROLE" = base ]; then
+  say "  [ ] deploy the base tree, image lifetrac-v25 and the broker: DEPLOY.md (deploy_base.sh)"
+  say "  [ ] power: the base boots again after 'systemctl poweroff'; remove power to keep it down"
+else
+  say "  [ ] tractor image lifetrac-tractor-x8 (built on the base): DEPLOY.md (build_tractor_image.sh)"
+  say "  [ ] after every boot: stop lifetrac-camera.service and tractor-camera before any probe;"
+  say "      they come back at boot and on camera hotplug and grab /dev/ttymxc3"
+fi
+say "  [ ] radios: the LifeTrac L072 firmware boots listening (RXCONT); park it with radio_park.py"
+say "      if the radios must stay off, and confirm later with radio_state.py"
+
+if [ "$N_FAIL" -gt 0 ]; then exit 1; fi
+if [ "$CHECK_ONLY" = 1 ] && [ "$N_TODO" -gt 0 ]; then exit 3; fi
+exit 0
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/pull_board_state.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/pull_board_state.sh
index 022653d5..153b3e04 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/pull_board_state.sh
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/pull_board_state.sh
@@ -1,8 +1,12 @@
 #!/bin/bash
 # pull_board_state.sh <base|tractor> [--images] -- PC side (Git Bash). Runs the read-only
 # capture_board_state.sh on one bench X8 over adb and pulls the result into the private
-# archive OUTSIDE git (default C:/Users/dorkm/Documents/LifeTrac-bench-archive/<date>/).
+# archive OUTSIDE git: $ARCHIVE, else ARCHIVE_DIR (bench.env), else
+# $HOME/Documents/LifeTrac-bench-archive, in its board_state_<UTC date>/ folder. adb and
+# py get that path in C:/... form (cygpath -m), so ARCHIVE=~/somewhere works too.
 # Copy only the reviewed text reports into bench-evidence/ (see BENCH_BOARDS.md).
+# Settings: BASE_SERIAL / TRACTOR_SERIAL / ARCHIVE_DIR from bench.env, loaded by
+# lib/env_file.sh (a non-empty environment variable wins over the file).
 #
 #   --images   also stream the board's LifeTrac docker images to the archive (docker save,
 #              nothing is written on the board). Large; never commit them.
@@ -14,9 +18,17 @@
 set -u
 export MSYS_NO_PATHCONV=1
 ROLE=${1:?base|tractor}; IMAGES=0; [ "${2:-}" = --images ] && IMAGES=1
-case $ROLE in base) SER=2D0A1209DABC240B;; tractor) SER=2E2C1209DABC240B;; *) echo "base|tractor"; exit 2;; esac
-HERE=$(cygpath -m "$(dirname "$0")")
-ARC=${ARCHIVE:-C:/Users/dorkm/Documents/LifeTrac-bench-archive}/board_state_$(date -u +%Y-%m-%d)
+_BT=$(cd "$(dirname "$0")" && pwd)
+. "$_BT/lib/env_file.sh" || exit 1
+_ENVF=${BENCH_ENV:-${BENCH_ENV_FILE:-$_BT/bench.env}}
+if [ -f "$_ENVF" ]; then bench_load_env_file "$_ENVF" || exit 1
+else echo "pull_board_state: WARN: no $_ENVF -- the original bench's serials apply unless BASE_SERIAL / TRACTOR_SERIAL are set" >&2; fi
+case $ROLE in base) SER=${BASE_SERIAL:-2D0A1209DABC240B};; tractor) SER=${TRACTOR_SERIAL:-2E2C1209DABC240B};; *) echo "base|tractor"; exit 2;; esac
+mpath() { if command -v cygpath >/dev/null 2>&1; then cygpath -m "$1"; else printf '%s\n' "$1"; fi; }
+HERE=$(mpath "$_BT")
+# MSYS_NO_PATHCONV=1 above: a /c/... path (Git Bash's $HOME) would reach adb.exe and
+# py unconverted and fail, so the archive path is put in C:/... form here.
+ARC=$(mpath "${ARCHIVE:-${ARCHIVE_DIR:-$HOME/Documents/LifeTrac-bench-archive}}")/board_state_$(date -u +%Y-%m-%d)
 mkdir -p "$ARC/$ROLE" "$ARC/images"
 strip_to_gzip() { py -3 -c "import sys;p=sys.argv[1];d=open(p,'rb').read();i=d.find(b'\x1f\x8b\x08');assert 0<=i<64,i;open(p,'wb').write(d[i:])" "$1"; }
 
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/requirements-pc.txt b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/requirements-pc.txt
new file mode 100644
index 00000000..2bd6a109
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/requirements-pc.txt
@@ -0,0 +1,47 @@
+# Bench PC (Windows) Python packages for the radio-bench tooling.
+#
+#   py -3 -m pip install -r LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/requirements-pc.txt
+#
+# Scope: the tools that run ON THE PC during a bench session -- the harness's
+# PC MQTT broker, leg reports, the VECTOR dry-run/replay, the channel-survey
+# and periodicity analysers, and the -TxFeed host synthetic publisher. The
+# board-side code runs inside the X8 docker images (lifetrac-v25,
+# lifetrac-tractor-x8, arduino-ootb-python-devel) and needs nothing from this
+# file; the boards' paho copy is the tracked repo-root _paho_pull/paho/.
+#
+# Versions are the ones installed on the bench PC that flew RS-12/RS-13
+# (Python 3.14.4, checked 2026-10-10). numpy/opencv match
+# base_station/requirements-dev.txt. numpy 2.4 needs Python >= 3.11.
+# To run the base-station SIL suite, install base_station/requirements-dev.txt
+# instead (it is a superset for that purpose).
+#
+# Who needs what (import survey of the PC-side scripts):
+
+# start_mqtt_broker.py (repo root) -- the PC broker run_live_radio_monitor.ps1
+# starts on <HostIp>:1883 when none answers. Not declared anywhere else.
+amqtt==0.11.3
+
+# bench_tools/clear_retained_host.py, tools/vector_dry_run.py (capture/live),
+# tools/lora_rtt.py, publish_synthetic_frames.py (-TxFeed host).
+paho-mqtt==2.1.0
+
+# tools/crc_dump_temporal.py, tools/rssi_sniff_periodicity.py (hunt_sniff.ps1),
+# tools/bulk_loss_boundary.py; camera_service (imported by
+# publish_synthetic_frames.py) and the RS-13 a16_* SIL scripts.
+numpy==2.4.4
+
+# RS-13 a16_* SIL scripts and the VECTOR encoder (x8_image_pipeline
+# encode_vector.py / vector_extract.py) when run on the PC.
+opencv-python-headless==4.14.0.94
+
+# camera_service (publish_synthetic_frames.py -TxFeed host) and
+# base_station/image_pipeline codec_decode / fallback_render.
+Pillow==12.2.0
+
+# base_station/lora_proto.py AES-GCM (imported lazily; needed by anything that
+# builds or opens encrypted frames on the PC).
+cryptography==48.0.0
+
+# Not needed for the radio bench: pyserial (tools/provision.py,
+# tools/pair_handheld.py -- handheld/USB provisioning) and pymodbus
+# (tools/modbus_bench.py). Install them only for those tools.
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/run_flash_bench.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/run_flash_bench.sh
index 56f81b47..86eb6096 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/run_flash_bench.sh
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/run_flash_bench.sh
@@ -2,17 +2,80 @@
 # run_flash_bench.sh — instrumented wrapper around full_flash_pipeline.sh:
 # kernel log tail + monotonic-stamped pipeline log + fsync'd pet log,
 # all under /home/fio so they survive a PMIC power-cycle.
-IMG=${1:?image}
-PW=fio
+#
+# Usage (on the board; see FLASH_RUNBOOK.md, or flash_l072.sh from the PC):
+#   bash /home/fio/run_flash_bench.sh /tmp/lifetrac_p0c/<image>.bin
+# Environment (all optional; defaults are the 2026 bench values):
+#   REVIVE_MODE        reboot (default since 2026-10-10) | full
+#                      reboot = openocd `reset run`, hand the watchdog back,
+#                      `systemctl reboot`. full = re-insert the x8h7 modules,
+#                      which OOPSes the base's 6.1.24 kernel; only for 5.10.
+#   FLASH_VERIFY_ONLY  1 = read back and compare, write nothing (first contact;
+#                      still enters the ROM bootloader and reboots afterwards)
+#   FLASH_PREFLIGHT_ONLY 1 = check the staging below and exit; touches nothing
+#   BENCH_SUDO_PW      sudo password (default: the LmP default `fio`; the bench
+#                      boards have a NOPASSWD sudoers drop-in anyway)
+#   BENCH_HOME         where the wrapper, stamp.py, kmsg_log.py and the logs
+#                      live (default /home/fio, persistent across reboots)
+IMG=${1:?usage: run_flash_bench.sh /tmp/lifetrac_p0c/<image>.bin}
+PW=${BENCH_SUDO_PW:-fio}
+H=${BENCH_HOME:-/home/fio}
+TOOLDIR=/tmp/lifetrac_p0c
+REVIVE_MODE=${REVIVE_MODE:-reboot}
+FLASH_VERIFY_ONLY=${FLASH_VERIFY_ONLY:-0}
 export PATH=/usr/sbin:/sbin:/usr/local/sbin:/usr/bin:/bin:$PATH
-rm -f /home/fio/pipeline_stamped.log /home/fio/kmsg_flash.log /home/fio/wdt_pet.log
-echo "$PW" | sudo -S -p '' bash -c 'nohup python3 -u /home/fio/kmsg_log.py /home/fio/kmsg_flash.log >/dev/null 2>&1 & echo $! > /home/fio/kmsg_log.pid'
+
+case "$REVIVE_MODE" in
+  reboot|full) ;;
+  *) echo "PREFLIGHT-FAIL: REVIVE_MODE=$REVIVE_MODE (want reboot or full)"; exit 3 ;;
+esac
+
+# Preflight (2026-10-10): refuse before ANY hardware is touched when the
+# staging is incomplete or CRLF-damaged. /tmp is tmpfs and systemd-tmpfiles
+# ages it at 5 d, so the pipeline files vanish with the board up; a CRLF
+# script fails in confusing ways (BENCH_RUNBOOK "Board facts").
+# Only the files this pipeline executes (08_boot_user_app.cfg belongs to the
+# harness's tractor reset and is checked there).
+need="$TOOLDIR/full_flash_pipeline.sh $TOOLDIR/run_flash_l072.sh $TOOLDIR/prep_bridge.sh
+      $TOOLDIR/revive_bridge.sh $TOOLDIR/wdt_pet.sh $TOOLDIR/stm32_an3155_flasher.py
+      $TOOLDIR/07_assert_pa11_pf4_long.cfg $H/stamp.py $H/kmsg_log.py"
+missing=""
+for f in $need "$IMG"; do
+  [ -s "$f" ] || missing="$missing $f"
+done
+if [ -n "$missing" ]; then
+  echo "PREFLIGHT-FAIL: missing or empty:$missing"
+  echo "Re-stage /tmp/lifetrac_p0c and $H (FLASH_RUNBOOK section 1). Nothing was touched."
+  exit 3
+fi
+# CRLF breaks bash and the openocd cfg; python tolerates it, so only .sh/.cfg.
+# Byte counts with and without CR: only tr and wc, which the board scripts
+# already rely on (no cmp; grep $'\r' misbehaves under Git Bash).
+crlf=""
+for f in $need; do
+  case "$f" in
+    *.sh|*.cfg) [ "$(tr -d '\r' < "$f" | wc -c)" = "$(wc -c < "$f")" ] || crlf="$crlf $f" ;;
+  esac
+done
+if [ -n "$crlf" ]; then
+  echo "PREFLIGHT-FAIL: CRLF line endings in:" $crlf
+  echo "Re-push LF-clean copies (FLASH_RUNBOOK section 1). Nothing was touched."
+  exit 3
+fi
+echo "PREFLIGHT-OK image=$IMG size=$(stat -c%s "$IMG") md5=$(md5sum "$IMG" | cut -d' ' -f1) REVIVE_MODE=$REVIVE_MODE FLASH_VERIFY_ONLY=$FLASH_VERIFY_ONLY"
+if [ "${FLASH_PREFLIGHT_ONLY:-0}" = "1" ]; then
+  echo "FLASH_PREFLIGHT_ONLY=1: staging checked, stopping before openocd/UART/watchdog."
+  exit 0
+fi
+
+rm -f "$H/pipeline_stamped.log" "$H/kmsg_flash.log" "$H/wdt_pet.log"
+echo "$PW" | sudo -S -p '' bash -c "nohup python3 -u $H/kmsg_log.py $H/kmsg_flash.log >/dev/null 2>&1 & echo \$! > $H/kmsg_log.pid"
 sleep 0.5
-echo "kmsg logger pid=$(cat /home/fio/kmsg_log.pid) uptime_s=$(cut -d' ' -f1 /proc/uptime)"
-echo "$PW" | sudo -S -p '' env PATH=$PATH REVIVE_MODE=${REVIVE_MODE:-full} bash /tmp/lifetrac_p0c/full_flash_pipeline.sh "$IMG" 2>&1 | python3 -u /home/fio/stamp.py /home/fio/pipeline_stamped.log
+echo "kmsg logger pid=$(cat "$H/kmsg_log.pid") uptime_s=$(cut -d' ' -f1 /proc/uptime)"
+echo "$PW" | sudo -S -p '' env PATH=$PATH REVIVE_MODE=$REVIVE_MODE FLASH_VERIFY_ONLY=$FLASH_VERIFY_ONLY WDT_PET_LOG=$H/wdt_pet.log bash $TOOLDIR/full_flash_pipeline.sh "$IMG" 2>&1 | python3 -u "$H/stamp.py" "$H/pipeline_stamped.log"
 RC=${PIPESTATUS[1]}
 echo "PIPELINE-EXIT=$RC uptime_s=$(cut -d' ' -f1 /proc/uptime)"
-echo "$PW" | sudo -S -p '' kill "$(cat /home/fio/kmsg_log.pid)" 2>/dev/null
-echo "--- wdt_pet.log tail:"; tail -3 /home/fio/wdt_pet.log
-echo "--- kmsg tail:"; tail -5 /home/fio/kmsg_flash.log
+echo "$PW" | sudo -S -p '' kill "$(cat "$H/kmsg_log.pid")" 2>/dev/null
+echo "--- wdt_pet.log tail:"; tail -3 "$H/wdt_pet.log"
+echo "--- kmsg tail:"; tail -5 "$H/kmsg_flash.log"
 exit $RC
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/units/disable-wifi.service b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/units/disable-wifi.service
new file mode 100644
index 00000000..de95ce94
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/units/disable-wifi.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Force wifi rfkill block at boot
+After=systemd-rfkill.service
+Before=NetworkManager.service
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/rfkill block wifi
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/wdog_regs.py b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/wdog_regs.py
new file mode 100644
index 00000000..15116be0
--- /dev/null
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/wdog_regs.py
@@ -0,0 +1,42 @@
+# wdog_regs.py -- READ-ONLY dump of the i.MX8M Mini WDOG1 registers.
+#
+# What it reads: WDOG1 at physical 0x30280000 through /dev/mem, opened
+# O_RDONLY and mapped PROT_READ -- it writes nothing and cannot pet, stop or
+# arm the watchdog. One line out:
+#   WCR  (0x00) WDE bit2 = enabled, WT bits15:8 -> timeout (WT+1)/2 s,
+#               WDT bit3 = WDOG_B asserted on timeout (PMIC reset on the X8),
+#               WDZST bit0, WDBG bit1
+#   WSR  (0x02) service register
+#   WRSR (0x04) reset reason: SFTW bit0, TOUT bit1, POR bit4
+#   WICR (0x06), WMCR (0x08)
+# Expected on both bench boards (u-boot arms it, FLASH_RUNBOOK section 3):
+#   WCR=0x773d -> WDE=1 WT=119 (60.0 s), WDT=1. WRSR reads POR even after a
+#   watchdog reset, because WDOG_B power-cycles the board through the PMIC --
+#   so WRSR cannot tell a watchdog reboot from a power-on.
+#
+# Where it runs: ON THE BOARD, inside a docker image, because the LmP host
+# python has no `mmap` module and the image has no `devmem`/sysfs watchdog
+# attributes. Needs root and the /dev/mem device:
+#   base (ssh):     echo fio | sudo -S -p '' docker run --rm --privileged \
+#                     -v /dev/mem:/dev/mem -v /tmp/lifetrac_strict:/work \
+#                     --entrypoint python3 lifetrac-v25:latest /work/wdog_regs.py
+#   tractor (adb):  same, with image
+#                     hub.foundries.io/arduino/arduino-ootb-python-devel:738bc44
+# (push this file to /tmp/lifetrac_strict first; /tmp is tmpfs).
+#
+# Provenance: until 2026-10-10 this script existed only in /home/fio on the
+# two boards (identical copies). Recovered from the read-only captures
+# bench-evidence/board_state_2026-10-04/base/files/home_fio/wdog_regs.py and
+# board_state_2026-10-10/tractor/; the code below is unchanged.
+import mmap, os, struct, sys
+BASE = 0x30280000
+fd = os.open("/dev/mem", os.O_RDONLY | os.O_SYNC)
+m = mmap.mmap(fd, 0x1000, mmap.MAP_SHARED, mmap.PROT_READ, offset=BASE)
+def r16(off):
+    return struct.unpack("<H", m[off:off+2])[0]
+wcr, wsr, wrsr, wicr, wmcr = r16(0), r16(2), r16(4), r16(6), r16(8)
+wt = (wcr >> 8) & 0xFF
+print("WDOG1 WCR=0x%04x WDE=%d WT=%d (%.1f s) WDT=%d WDZST=%d WDBG=%d | WSR=0x%04x | WRSR=0x%04x SFTW=%d TOUT=%d POR=%d | WICR=0x%04x WMCR=0x%04x" % (
+    wcr, (wcr >> 2) & 1, wt, (wt + 1) / 2.0, (wcr >> 3) & 1, wcr & 1, (wcr >> 1) & 1,
+    wsr, wrsr, wrsr & 1, (wrsr >> 1) & 1, (wrsr >> 4) & 1, wicr, wmcr))
+m.close(); os.close(fd)
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/full_flash_pipeline.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/full_flash_pipeline.sh
index f8568e2c..8702434a 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/full_flash_pipeline.sh
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/full_flash_pipeline.sh
@@ -5,6 +5,16 @@
 #
 # Default image is hello.bin in /tmp/lifetrac_p0c/.
 # Logs to /tmp/lifetrac_p0c/pipeline.log
+#
+# REVIVE_MODE (2026-10-10: default is now `reboot`; was `full`):
+#   reboot  openocd `reset run`, hand the watchdog back ('V'), systemctl reboot.
+#           Required on the 6.1.24 base kernel; works on 5.10 too. Every flash
+#           since 2026-09-12 used it.
+#   full    re-insert the x8h7 modules instead of rebooting. OOPSes the base's
+#           6.1 kernel (spi_probe -> of_irq_get) and power-cycles it; kept only
+#           for a 5.10 board where a reboot is unwanted.
+# Note: `sudo` drops the caller's environment, so pass it explicitly:
+#   sudo -S -p '' env REVIVE_MODE=full bash .../full_flash_pipeline.sh img.bin
 
 set -u
 TOOLDIR=/tmp/lifetrac_p0c
@@ -38,7 +48,9 @@ echo "=== T2 $(date) revive_bridge ===" | tee -a "$LOG"
 # the base kernel (6.1.24-lmp) and power-cycles the board anyway. Bring the
 # H7 back with openocd reset run, hand the watchdog back, then reboot on
 # purpose. /tmp is lost either way; the caller re-pushes tooling.
-if [ "${REVIVE_MODE:-full}" = "reboot" ]; then
+REVIVE_MODE=${REVIVE_MODE:-reboot}
+echo "REVIVE_MODE=$REVIVE_MODE" | tee -a "$LOG"
+if [ "$REVIVE_MODE" = "reboot" ]; then
   REVIVE_MODE=reset_run_only bash $TOOLDIR/revive_bridge.sh 2>&1 | tee -a "$LOG"
   REVIVE_RC=${PIPESTATUS[0]}
   echo "revive_rc=$REVIVE_RC (reset_run_only)" | tee -a "$LOG"
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/revive_bridge.sh b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/revive_bridge.sh
index 4a67ab16..988603b9 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/revive_bridge.sh
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/revive_bridge.sh
@@ -52,10 +52,16 @@ sleep 1
 # 2026-09-12/flash/). REVIVE_MODE=reset_run_only stops here, after the H7
 # is back in its firmware, and lets the caller do a controlled reboot
 # instead of the module reload.
-if [ "${REVIVE_MODE:-full}" = "reset_run_only" ]; then
-  echo "=== REVIVE_MODE=reset_run_only: H7 running, modules left unloaded; caller reboots ==="
+# 2026-10-10: `reboot` (the flash pipeline's own name for this path, exported
+# by run_flash_bench.sh) is accepted as an alias, so a standalone call with
+# that environment cannot fall through to the module reload below.
+if [ "${REVIVE_MODE:-full}" = "reset_run_only" ] || [ "${REVIVE_MODE:-full}" = "reboot" ]; then
+  echo "=== REVIVE_MODE=${REVIVE_MODE}: H7 running, modules left unloaded; caller reboots ==="
   exit 0
 fi
+case "$(uname -r)" in
+  6.*) echo "=== WARNING: kernel $(uname -r): the x8h7 module reload below OOPSed the 6.1.24 base kernel twice (2026-09-12); expect a PMIC power-cycle. Prefer REVIVE_MODE=reset_run_only + reboot. ===" ;;
+esac
 echo "=== [3/5] unexport x8h7 gpios ($X8H7_GPIO_BASE..$X8H7_GPIO_LAST) ==="
 for g in $(seq $X8H7_GPIO_BASE $X8H7_GPIO_LAST); do
   if [ -d /sys/class/gpio/gpio$g ]; then
diff --git a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/run_live_radio_monitor.ps1 b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/run_live_radio_monitor.ps1
index 3fbc9b95..41696308 100644
--- a/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/run_live_radio_monitor.ps1
+++ b/LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/run_live_radio_monitor.ps1
@@ -6,7 +6,21 @@
     Launches image_rx_daemon on 2D0A and image_tx_daemon on 2E2C, streams
     synthetic frames from host, and logs real-time throughput / goodput (B/s),
     fragment counts, and demodulation metrics (RSSI, SNR).
+
+    PC requirements (bench kit, 2026-10-10): adb on PATH, the Python launcher
+    `py` (or -PythonExe), and the packages in bench_tools/requirements-pc.txt.
+    The PC MQTT broker this script starts when none answers on -HostIp:1883
+    is start_mqtt_broker.py at the repo root, which needs `amqtt`
+    (`py -3 -m pip install -r bench_tools/requirements-pc.txt`).
+
+    Parameter names are checked ([CmdletBinding()]): a misspelled name such as
+    -DurationSeconds is an error, not a silently ignored argument.
+
+    Profile-2 (DTS) legs must pin a spot-checked carrier with -ForceFrfHz; the
+    profile default is 915.000 MHz, the channel of the RS-11.6 external
+    emitter. -AllowDefaultCarrier overrides the refusal.
 #>
+[CmdletBinding()]
 param(
     [string]$TxAdbSerial = "2E2C1209DABC240B",
     [string]$RxAdbSerial = "2D0A1209DABC240B",
@@ -72,6 +86,21 @@ param(
     # the same argument as FhssLinkId. The known bench interferer sits in the
     # 915.0 MHz channel; e.g. -ForceFrfHz 917000000 moves the link off it.
     [int]$ForceFrfHz      = 0,
+    # Bench kit (2026-10-10): a profile-2 (DTS) leg with -ForceFrfHz 0 is
+    # REFUSED unless this switch is given. Profile 2's default carrier is
+    # 915.000 MHz, where the RS-11.6 external emitter bursts (~25 ms at -43 to
+    # -45 dBm every ~7.08 s); every RS-13.1 DTS leg flew there by accident and
+    # its losses fold on the emitter's period (RS-13.1 A19). Pin the carrier
+    # picked by a same-day receive-only spot-check instead (BENCH_RUNBOOK prep
+    # step 8). Use this switch only for a deliberate 915.000 MHz control leg.
+    [switch]$AllowDefaultCarrier,
+    # Bench kit (2026-10-10): Python used for the two PC-side processes this
+    # script may start -- the PC MQTT broker (start_mqtt_broker.py, needs the
+    # `amqtt` package) and the -TxFeed host synthetic publisher. Default `py`
+    # (the Windows Python launcher, run as `py -3`); pass a full python.exe
+    # path to use a specific interpreter or venv. Replaces a hardcoded
+    # per-user interpreter path. See bench_tools/requirements-pc.txt.
+    [string]$PythonExe    = "py",
     # RS-12 (2026-08-17): 1 = RX daemon logs one line per data fragment with
     # the firmware us RX timestamp (frag_arrival:). Diagnostic instrument for
     # the silent URC-drop timing shape; adds ~2300 log lines per 300 s leg.
@@ -178,6 +207,22 @@ param(
 Set-StrictMode -Version Latest
 $ErrorActionPreference = "Continue"
 
+# Bench kit (2026-10-10): refuse a DTS leg on the default carrier BEFORE
+# anything touches a board. Legs that pass -ForceFrfHz are unaffected.
+if ($RegProfile -eq 2 -and $ForceFrfHz -eq 0 -and -not $AllowDefaultCarrier) {
+    throw ("Refusing a profile-2 (DTS) leg with -ForceFrfHz 0: the profile default " +
+        "carrier is 915.000 MHz, the channel of the known RS-11.6 external emitter " +
+        "(~25 ms bursts at -43 to -45 dBm every ~7.08 s; RS-13.1 DTS losses folded on " +
+        "its period). Run a same-day receive-only channel spot-check with the tractor " +
+        "parked (channel_survey_sniff.py or hunt_sniff.ps1, then tools/survey_compare.py; " +
+        "BENCH_RUNBOOK prep step 8) and pass -ForceFrfHz <the pick>, e.g. -ForceFrfHz " +
+        "927500000 if that channel is clean today. For a deliberate 915.000 MHz control " +
+        "leg add -AllowDefaultCarrier.")
+}
+if ($RegProfile -eq 2 -and $ForceFrfHz -eq 0) {
+    Write-Warning "-AllowDefaultCarrier: this DTS leg flies on 915.000 MHz, the RS-11.6 emitter channel."
+}
+
 # Profile env for both daemons; profile 1 needs the 50-ch wide mask.
 $profEnv = "-e LIFETRAC_REG_PROFILE=$RegProfile"
 if ($RegProfile -eq 1) { $profEnv = "$profEnv -e LIFETRAC_FHSS_WIDE_MASK=1" }
@@ -205,33 +250,62 @@ if ($ForceFrfHz -gt 0) {
     $profEnv = "$profEnv -e LIFETRAC_FORCE_FRF_HZ=$ForceFrfHz"
 }
 
-# Resolve adb dynamically (the winget package dir name varies per
-# machine/source); fall back to the historical hardcoded path.
+# Resolve adb from PATH (the winget package dir name varies per machine/source).
+# No per-user fallback path: on another PC it only produced a confusing
+# "not found" later. Nothing has touched a board yet at this point.
 $adbExe = (Get-Command adb -ErrorAction SilentlyContinue).Source
 if (-not $adbExe) {
-    $adbExe = "C:\Users\dorkm\AppData\Local\Microsoft\WinGet\Packages\Google.PlatformTools_8wekyb3d8bbwe\platform-tools\adb.exe"
+    throw "adb not on PATH. Install Android platform-tools (bench_tools/PC_SETUP.md: winget install Google.PlatformTools), open a new shell, and check 'adb version'."
 }
 $repoRoot = (Resolve-Path "$PSScriptRoot\..\..\..\..").Path
 $baseStation = Join-Path $repoRoot "LifeTrac-v25\DESIGN-CONTROLLER\base_station"
 $tractorX8   = Join-Path $repoRoot "LifeTrac-v25\DESIGN-CONTROLLER\firmware\tractor_x8"
 $helperDir   = $PSScriptRoot
 
+# PC-side Python (broker + -TxFeed host publisher). `py` is the Windows Python
+# launcher and takes `-3` to pick the newest Python 3; any other value is used
+# as the interpreter itself. The broker needs `amqtt`
+# (bench_tools/requirements-pc.txt).
+$pyPrefixArgs = @()
+if ([System.IO.Path]::GetFileNameWithoutExtension($PythonExe) -ieq "py") { $pyPrefixArgs = @("-3") }
+if (-not (Get-Command $PythonExe -ErrorAction SilentlyContinue)) {
+    Write-Warning "PythonExe '$PythonExe' not found; the PC broker / host publisher cannot start. Install Python 3 (py launcher) or pass -PythonExe <path\to\python.exe>."
+}
+
 Write-Host "=== STARTING LIVE LORA RADIO MONITOR ($DurationS s) ===" -ForegroundColor Cyan
 Write-Host "TX Serial: $TxAdbSerial"
 Write-Host "RX Serial: $RxAdbSerial"
 Write-Host "MQTT Host: $HostIp"
+# -HostIp must be THIS PC's LAN address (the boards dial it for the control
+# broker). The default is the original bench PC's DHCP lease; warn, do not
+# change it, when it is not one of this machine's addresses.
+try {
+    $localIps = @(Get-NetIPAddress -AddressFamily IPv4 -ErrorAction Stop | ForEach-Object { $_.IPAddress })
+    if ($localIps.Count -gt 0 -and $localIps -notcontains $HostIp) {
+        Write-Warning "HostIp $HostIp is not an address of this PC ($($localIps -join ', ')). Pass -HostIp <this PC's LAN IPv4>."
+    }
+} catch { }
 
 # 1. Ensure Host MQTT Broker is running
 $socket = New-Object System.Net.Sockets.TcpClient
 $asyncResult = $socket.BeginConnect($HostIp, 1883, $null, $null)
 $waitResult = $asyncResult.AsyncWaitHandle.WaitOne(1000, $false)
 if (-not $waitResult -or -not $socket.Connected) {
-    Write-Host "[MQTT] Starting host broker on $HostIp:1883..." -ForegroundColor Yellow
-    Start-Process -FilePath "C:\Users\dorkm\AppData\Local\Python\pythoncore-3.14-64\python.exe" -ArgumentList "start_mqtt_broker.py" -WorkingDirectory $repoRoot -PassThru -NoNewWindow
+    Write-Host "[MQTT] Starting host broker on $($HostIp):1883 ($PythonExe $($pyPrefixArgs -join ' ') start_mqtt_broker.py; needs amqtt)..." -ForegroundColor Yellow
+    Start-Process -FilePath $PythonExe -ArgumentList (@($pyPrefixArgs) + @("start_mqtt_broker.py")) -WorkingDirectory $repoRoot -PassThru -NoNewWindow
     Start-Sleep -Seconds 2
+    # Advisory re-probe only (the leg continues either way, as before): a
+    # broker that did not come up is almost always a missing `amqtt`.
+    $probe2 = New-Object System.Net.Sockets.TcpClient
+    try {
+        $ar2 = $probe2.BeginConnect($HostIp, 1883, $null, $null)
+        if (-not $ar2.AsyncWaitHandle.WaitOne(1000, $false) -or -not $probe2.Connected) {
+            Write-Warning "PC broker not answering on $($HostIp):1883 after start. Check: $PythonExe $($pyPrefixArgs -join ' ') -c `"import amqtt`" (install with: py -3 -m pip install -r bench_tools\requirements-pc.txt)."
+        }
+    } catch { } finally { $probe2.Close() }
 } else {
     $socket.Close()
-    Write-Host "[MQTT] Host broker active at $HostIp:1883" -ForegroundColor Green
+    Write-Host "[MQTT] Host broker active at $($HostIp):1883" -ForegroundColor Green
 }
 
 # 2. Clean up previous containers
@@ -333,7 +407,16 @@ foreach ($pair in $warmPairs) {
 Write-Host "[RESET] RX L072 via gpio163 NRST..."
 $nrstCmd = "echo fio | sudo -S -p '' sh -c '[ -d /sys/class/gpio/gpio163 ] || echo 163 > /sys/class/gpio/export; echo out > /sys/class/gpio/gpio163/direction; echo 1 > /sys/class/gpio/gpio163/value; sleep 0.02; echo 0 > /sys/class/gpio/gpio163/value; sleep 0.10; echo 1 > /sys/class/gpio/gpio163/value'"
 cmd /c "`"$adbExe`" -s $RxAdbSerial shell `"$nrstCmd`"" | Out-Null
+# Bench kit (2026-10-10): /tmp is tmpfs (wiped by every reboot/flash, aged at
+# 5 d) and the flash pipeline may have left /tmp/lifetrac_p0c root-owned, so
+# make the directory writable before the push and check the cfg landed -- the
+# SWD reset below needs it and its push used to fail silently.
+cmd /c "`"$adbExe`" -s $TxAdbSerial shell `"echo fio | sudo -S -p '' mkdir -p /tmp/lifetrac_p0c ; echo fio | sudo -S -p '' chmod 0777 /tmp/lifetrac_p0c`"" | Out-Null
 cmd /c "`"$adbExe`" -s $TxAdbSerial push `"$(Join-Path $helperDir '08_boot_user_app.cfg')`" /tmp/lifetrac_p0c/08_boot_user_app.cfg" | Out-Null
+$cfgCheck = cmd /c "`"$adbExe`" -s $TxAdbSerial shell `"test -s /tmp/lifetrac_p0c/08_boot_user_app.cfg && echo CFG-OK || echo CFG-MISSING`"" 2>$null
+if ("$cfgCheck" -notmatch "CFG-OK") {
+    Write-Warning "/tmp/lifetrac_p0c/08_boot_user_app.cfg is not on the tractor ($TxAdbSerial); the SWD reset of the TX L072 will fail."
+}
 
 # 5. Fire the tractor SWD reset in the BACKGROUND, then launch the TX daemon
 # immediately. openocd needs ~7-10 s to reach its NRST pulse; the daemon needs
@@ -436,7 +519,7 @@ if ($TxFeed -eq "camera") {
     $env:LIFETRAC_SYNTH_DURATION_S = "$($DurationS + 10)"
     $env:LIFETRAC_SYNTH_BYTE_BUDGET = "$SynthBudgetB"
     $pubScript = Join-Path $repoRoot "publish_synthetic_frames.py"
-    $pubProc = Start-Process -FilePath "C:\Users\dorkm\AppData\Local\Python\pythoncore-3.14-64\python.exe" -ArgumentList "`"$pubScript`"" -PassThru -NoNewWindow -WorkingDirectory $repoRoot
+    $pubProc = Start-Process -FilePath $PythonExe -ArgumentList (@($pyPrefixArgs) + @("`"$pubScript`"")) -PassThru -NoNewWindow -WorkingDirectory $repoRoot
 }
 
 Write-Host "=== MONITORING RADIO TRANSMISSIONS FOR $DurationS SECONDS ===" -ForegroundColor Green
@@ -538,6 +621,7 @@ if ($Archive) {
         "tx_feed=$TxFeed",
         "reg_profile=$RegProfile",
         "force_frf_hz=$ForceFrfHz",
+        "allow_default_carrier=$([bool]$AllowDefaultCarrier)",
         "tx_serial=$TxAdbSerial",
         "rx_serial=$RxAdbSerial",
         "host_ip=$HostIp",
diff --git a/README.md b/README.md
index e85b1b2a..53583dc2 100644
--- a/README.md
+++ b/README.md
@@ -42,3 +42,7 @@ Each version folder contains:
 - **bill_of_materials.md** - Bill of materials information (where available)
 
 The documentation has been extracted and compiled from the [Open Source Ecology wiki](https://wiki.opensourceecology.org) to provide a comprehensive reference for each LifeTrac version.
+
+## LifeTrac v25 radio bench
+
+To reproduce the v25 LoRa radio bench (two Portenta X8 boards on Max Carriers, as in the RS-12/RS-13 test campaigns), start at the [radio bench quickstart](LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/bench_tools/BENCH_QUICKSTART.md).
diff --git a/connect_wpa.sh b/connect_wpa.sh
index 0fe7042e..03e4e7ce 100644
--- a/connect_wpa.sh
+++ b/connect_wpa.sh
@@ -1,10 +1,31 @@
 #!/bin/sh
-cat > /tmp/wpa.conf <<'EOF'
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/connect_wpa.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
+# The config holds the passphrase: keep it root-only. (A '"' in the SSID or
+# passphrase would need escaping for wpa_supplicant.conf.)
+(
+umask 077
+rm -f /tmp/wpa.conf     # umask only applies to a NEW file
+cat > /tmp/wpa.conf <<EOF
 network={
-    ssid="I'm a 5 star LAN!"
-    psk="9182603083"
+    ssid="${LIFETRAC_WIFI_SSID}"
+    psk="${LIFETRAC_WIFI_PSK}"
 }
 EOF
+)
 killall wpa_supplicant 2>/dev/null || true
 wpa_supplicant -B -i wlan0 -c /tmp/wpa.conf
 sleep 3
diff --git a/do_wifi.sh b/do_wifi.sh
index afa3169f..d2918def 100644
--- a/do_wifi.sh
+++ b/do_wifi.sh
@@ -1,6 +1,21 @@
 #!/bin/sh
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/do_wifi.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
 nmcli con delete 5star 2>/dev/null || true
-nmcli con delete "I'm a 5 star LAN!" 2>/dev/null || true
-nmcli con add type wifi con-name 5star ifname wlan0 ssid "I'm a 5 star LAN!" wifi-sec.key-mgmt wpa-psk wifi-sec.psk "9182603083" connection.autoconnect yes
+nmcli con delete "$LIFETRAC_WIFI_SSID" 2>/dev/null || true
+nmcli con add type wifi con-name 5star ifname wlan0 ssid "$LIFETRAC_WIFI_SSID" wifi-sec.key-mgmt wpa-psk wifi-sec.psk "$LIFETRAC_WIFI_PSK" connection.autoconnect yes
 nmcli con up 5star
 ip -4 addr show wlan0
diff --git a/setup_5star_wifi.sh b/setup_5star_wifi.sh
index b0f44834..0294ec9b 100644
--- a/setup_5star_wifi.sh
+++ b/setup_5star_wifi.sh
@@ -1,5 +1,20 @@
 #!/bin/sh
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/setup_5star_wifi.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
 nmcli con delete 5star 2>/dev/null || true
-nmcli con add type wifi ifname wlan0 con-name 5star ssid "I'm a 5 star LAN!" -- wifi-sec.key-mgmt wpa-psk wifi-sec.psk 9182603083 connection.autoconnect yes
+nmcli con add type wifi ifname wlan0 con-name 5star ssid "$LIFETRAC_WIFI_SSID" -- wifi-sec.key-mgmt wpa-psk wifi-sec.psk "$LIFETRAC_WIFI_PSK" connection.autoconnect yes
 nmcli con up 5star
 ip -4 addr show wlan0
diff --git a/wifi_connect.sh b/wifi_connect.sh
index 35071a8e..52bf2ad5 100644
--- a/wifi_connect.sh
+++ b/wifi_connect.sh
@@ -1,7 +1,22 @@
 #!/bin/sh
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/wifi_connect.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
 set -e
-SSID="I'm a 5 star LAN!"
-PSK="9182603083"
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
+SSID="$LIFETRAC_WIFI_SSID"
+PSK="$LIFETRAC_WIFI_PSK"
 nmcli radio wifi on
 nmcli dev wifi rescan 2>/dev/null || true
 sleep 3
diff --git a/wifi_connect_fast.sh b/wifi_connect_fast.sh
index 48d88c10..1543c951 100644
--- a/wifi_connect_fast.sh
+++ b/wifi_connect_fast.sh
@@ -1,6 +1,21 @@
 #!/bin/sh
 # Wait for brcmfmac firmware load to complete, then connect FAST
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/wifi_connect_fast.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
 set -e
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
 echo "=== waiting for wlan0 to appear ==="
 for i in 1 2 3 4 5 6 7 8 9 10 15 20; do
   if ip link show wlan0 >/dev/null 2>&1; then
@@ -17,7 +32,7 @@ echo "=== rescan ==="
 nmcli dev wifi rescan ifname wlan0 2>/dev/null || true
 sleep 4
 echo "=== connect ==="
-nmcli dev wifi connect "I'm a 5 star LAN!" password "9182603083" ifname wlan0
+nmcli dev wifi connect "$LIFETRAC_WIFI_SSID" password "$LIFETRAC_WIFI_PSK" ifname wlan0
 sleep 3
 echo "=== status ==="
 nmcli -t -f NAME,DEVICE,STATE con show --active
diff --git a/wifi_persist_and_reboot.sh b/wifi_persist_and_reboot.sh
index 395ed016..166e4296 100644
--- a/wifi_persist_and_reboot.sh
+++ b/wifi_persist_and_reboot.sh
@@ -1,9 +1,24 @@
 #!/bin/sh
 # Pre-create the NetworkManager profile so auto-connect fires during the
 # brief healthy window right after boot.
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/wifi_persist_and_reboot.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
 set -e
-SSID="I'm a 5 star LAN!"
-PSK="9182603083"
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
+SSID="$LIFETRAC_WIFI_SSID"
+PSK="$LIFETRAC_WIFI_PSK"
 NAME="5star"
 
 # Delete any prior profile with same name
diff --git a/wifi_rescan_connect.sh b/wifi_rescan_connect.sh
index a412d92d..7df7a815 100644
--- a/wifi_rescan_connect.sh
+++ b/wifi_rescan_connect.sh
@@ -1,11 +1,26 @@
 #!/bin/sh
+# WiFi credentials come ONLY from the environment -- never commit an SSID or
+# password to this repo:
+#   LIFETRAC_WIFI_SSID  network name    LIFETRAC_WIFI_PSK  WPA passphrase
+# Run it by hand in an interactive board shell (adb shell / ssh) -- never from a
+# VS Code task or a PC command line, which echo or log the passphrase:
+#   read -r LIFETRAC_WIFI_SSID; stty -echo; read -r LIFETRAC_WIFI_PSK; stty echo
+#   export LIFETRAC_WIFI_SSID LIFETRAC_WIFI_PSK
+#   sudo --preserve-env=LIFETRAC_WIFI_SSID,LIFETRAC_WIFI_PSK sh /tmp/wifi_rescan_connect.sh
+# (`sudo env LIFETRAC_WIFI_PSK=...` would show the passphrase in ps and in
+# sudo's journal entry.)
+# Bench note: the bench tractor runs with WiFi disabled on purpose
+# (LifeTrac-v25/DESIGN-CONTROLLER/firmware/x8_lora_bootloader_helper/
+# bench_tools/BENCH_BOARDS.md); do not re-enable it during radio legs.
+: "${LIFETRAC_WIFI_SSID:?set LIFETRAC_WIFI_SSID (WiFi network name; never commit it)}"
+: "${LIFETRAC_WIFI_PSK:?set LIFETRAC_WIFI_PSK (WiFi passphrase; never commit it)}"
 echo "=== rescan (12s) ==="
 nmcli dev wifi rescan ifname wlan0 2>&1 || true
 sleep 12
 echo "=== visible nets ==="
 nmcli -t -f SSID,SIGNAL dev wifi list ifname wlan0 | head -n 15
 echo "=== connect ==="
-nmcli dev wifi connect "I'm a 5 star LAN!" password "9182603083" ifname wlan0
+nmcli dev wifi connect "$LIFETRAC_WIFI_SSID" password "$LIFETRAC_WIFI_PSK" ifname wlan0
 sleep 4
 echo "=== active connections ==="
 nmcli -t -f NAME,DEVICE,STATE con show --active