trunk-recorder: mark drb-upload.sh and run.sh executable (node-26#45)

TR execvp()s the uploadScript; without +x every call failed with status 127
on node-002 and nothing was uploaded.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -99,6 +99,32 @@ TRIM_SILENCE_THRESHOLD_DB=-40
 # Seconds of audio kept either side of detected speech.
 TRIM_SILENCE_GUARD_SECONDS=0.25
 
+# Upload spool: a recording whose upload to C2 fails is kept on disk and
+# retried, never deleted (default dir: <recordings>/spool). Bounded so a long
+# C2 outage cannot fill the host disk; the oldest recordings go first.
+# UPLOAD_SPOOL_DIR=/recordings/spool
+UPLOAD_SPOOL_MAX_BYTES=536870912
+UPLOAD_SPOOL_MAX_AGE_HOURS=72
+UPLOAD_RETRY_MIN_SECONDS=15
+UPLOAD_RETRY_MAX_SECONDS=600
+
+# --- Recorder backend (node-26#45) -------------------------------------------
+# op25 (default): OP25 + PulseAudio recorder, one call at a time.
+# trunk-recorder: Trunk Recorder records every talkgroup at once, with call
+# boundaries from the decoder. Set BOTH lines below to switch; OP25 is then
+# never started (it would hold the SDR), and the live browser stream (Icecast)
+# goes quiet — Discord live audio keeps working.
+RECORDER_BACKEND=op25
+# COMPOSE_PROFILES=trunk-recorder
+# Trunk Recorder SDR settings (only read with RECORDER_BACKEND=trunk-recorder).
+# TR_SAMPLE_RATE=2400000
+# TR_GAIN=34
+# TR_CENTER_HZ=            # override the computed centre frequency
+# TR_DIGITAL_RECORDERS=4   # simultaneous voice channels on a trunked system
+# TR_MIN_DURATION=1.0      # seconds; shorter calls are dropped by TR
+# TR_SQUELCH_DB=-50        # conventional channels; absolute dB, tune per site
+# TR_LIVE_PORT=9123        # local UDP port for simplestream -> Discord
+
 # OP25 container (usually no need to change)
 OP25_API_URL=http://localhost:8001
 OP25_TERMINAL_URL=http://localhost:8081

.gitea/workflows/build-edge-node.yml

@@ -38,15 +38,20 @@ jobs:
         run: |
           echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
           echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
+          # Source pin (node-26#19): the git tree hash of the build context.
+          # A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
+          # computes the identical value — so its code and image always match.
+          echo "SRC_TAG=src-$(git rev-parse HEAD:drb-edge-node)" >> $GITHUB_OUTPUT
 
       - uses: docker/build-push-action@v6
         with:
           context: ./drb-edge-node
           file: ./drb-edge-node/Dockerfile
-          platforms: linux/arm64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: |
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
+            git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:latest
           cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
           cache-to: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache,mode=max

.gitea/workflows/build-icecast.yml

@@ -38,15 +38,20 @@ jobs:
         run: |
           echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
           echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
+          # Source pin (node-26#19): the git tree hash of the build context.
+          # A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
+          # computes the identical value — so its code and image always match.
+          echo "SRC_TAG=src-$(git rev-parse HEAD:icecast)" >> $GITHUB_OUTPUT
 
       - uses: docker/build-push-action@v6
         with:
           context: ./icecast
           file: ./icecast/Dockerfile
-          platforms: linux/arm64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: |
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
+            git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:latest
           cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
           cache-to: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache,mode=max

.gitea/workflows/build-op25.yml

@@ -38,15 +38,20 @@ jobs:
         run: |
           echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
           echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
+          # Source pin (node-26#19): the git tree hash of the build context.
+          # A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
+          # computes the identical value — so its code and image always match.
+          echo "SRC_TAG=src-$(git rev-parse HEAD:op25-container)" >> $GITHUB_OUTPUT
 
       - uses: docker/build-push-action@v6
         with:
           context: ./op25-container
           file: ./op25-container/Dockerfile
-          platforms: linux/arm64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: |
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
+            git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:stable
           # Registry cache — avoids full recompile of GnuRadio/OP25 when only app code changes
           cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache

.gitea/workflows/build-secondary-sdr.yml

@@ -38,15 +38,20 @@ jobs:
         run: |
           echo "REPO_NAME=$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')" >> $GITHUB_OUTPUT
           echo "VERSION=$(git describe --tags --always | sed 's/^v//')" >> $GITHUB_OUTPUT
+          # Source pin (node-26#19): the git tree hash of the build context.
+          # A node pulls src-<tree of its own checkout> — scripts/image-tags.sh
+          # computes the identical value — so its code and image always match.
+          echo "SRC_TAG=src-$(git rev-parse HEAD:secondary-sdr-container)" >> $GITHUB_OUTPUT
 
       - uses: docker/build-push-action@v6
         with:
           context: ./secondary-sdr-container
           file: ./secondary-sdr-container/Dockerfile
-          platforms: linux/arm64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: |
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.VERSION }}
+            git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:${{ steps.meta.outputs.SRC_TAG }}
             git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:latest
           cache-from: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache
           cache-to: type=registry,ref=git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${{ steps.meta.outputs.REPO_NAME }}/${{ env.CONTAINER_NAME }}:buildcache,mode=max

.gitea/workflows/ci.yml

@@ -19,6 +19,22 @@ jobs:
       - name: Run tests
         run: python3 -m pytest tests -v
 
+  test-op25:
+    # Config generation + tk_drb_conv state machine only (node-26#24) — no
+    # GNU Radio here; tests/test_conventional.py stubs OP25's own modules.
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: op25-container
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install dependencies
+        run: python3 -m pip install --break-system-packages -r requirements.txt pytest httpx
+
+      - name: Run tests
+        run: python3 -m pytest tests -v
+
   lint:
     runs-on: ubuntu-latest
     steps:

.gitea/workflows/publish-public.yml

@@ -95,7 +95,7 @@ jobs:
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.file }}
-          platforms: linux/arm64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: |
             ${{ vars.PUBLIC_REGISTRY }}/${{ vars.PUBLIC_NAMESPACE }}/drb-${{ matrix.name }}:${{ steps.meta.outputs.VERSION }}

.gitea/workflows/release-images.yml

@@ -0,0 +1,91 @@
+name: Release images
+
+# Make sure every node image a release ref needs exists in the registry
+# (node-26#19). A node on `v1` pulls <image>:src-<tree hash of that image's
+# directory at v1>. The per-image build workflows only run when their own
+# directory changes on main, and anything built before #19 has no src- tag at
+# all, so a release tag can point at trees nobody ever built. This fills the
+# gaps: for each image, if src-<tree> is already in the registry it does
+# nothing; otherwise it builds and pushes it (registry cache keeps op25 off a
+# full recompile when only its app code changed).
+#
+# Runs on every v* tag push, including a re-cut `v1`. Also runnable by hand
+# (workflow_dispatch) on any ref — run it once on the ref `v1` points at
+# before re-cutting `v1` onto a commit that contains #19, so nodes never see
+# a moment where their pinned images don't exist yet.
+#
+# Pushes ONLY src- tags. :latest / :stable keep tracking main, as before.
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  ensure:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: edge-node
+            context: drb-edge-node
+          - name: icecast
+            context: icecast
+          - name: op25-client
+            context: op25-container
+          - name: secondary-sdr
+            context: secondary-sdr-container
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: docker/setup-qemu-action@v3
+
+      - uses: docker/setup-buildx-action@v3
+        with:
+          config-inline: |
+            [registry."git.vpn.cusano.net"]
+              http = false
+              insecure = false
+
+      - uses: docker/login-action@v3
+        with:
+          registry: git.vpn.cusano.net
+          username: ${{ gitea.actor }}
+          password: ${{ secrets.BUILD_TOKEN }}
+
+      - name: Resolve source tag
+        id: meta
+        run: |
+          REPO_NAME="$(echo ${GITHUB_REPOSITORY} | awk -F'/' '{print $2}')"
+          # Must match scripts/image-tags.sh and the build-*.yml workflows.
+          IMAGE="git.vpn.cusano.net/${{ vars.DOCKER_ORG }}/${REPO_NAME}/${{ matrix.name }}"
+          TAG="src-$(git rev-parse HEAD:${{ matrix.context }})"
+          echo "IMAGE=$IMAGE" >> $GITHUB_OUTPUT
+          echo "TAG=$TAG" >> $GITHUB_OUTPUT
+          # Present only counts if BOTH platforms are in it: src- tags pushed
+          # before node-26#28 are arm64-only, and an amd64 node can't pull them.
+          RAW="$(docker buildx imagetools inspect --raw "$IMAGE:$TAG" 2>/dev/null | tr -d ' \n' || true)"
+          if printf '%s' "$RAW" | grep -q '"architecture":"amd64"' \
+             && printf '%s' "$RAW" | grep -q '"architecture":"arm64"'; then
+            echo "EXISTS=true" >> $GITHUB_OUTPUT
+            echo "$IMAGE:$TAG already published for amd64 + arm64 — nothing to do"
+          else
+            echo "EXISTS=false" >> $GITHUB_OUTPUT
+            echo "$IMAGE:$TAG missing or not multi-arch — building it"
+          fi
+
+      - if: steps.meta.outputs.EXISTS != 'true'
+        uses: docker/build-push-action@v6
+        with:
+          context: ./${{ matrix.context }}
+          file: ./${{ matrix.context }}/Dockerfile
+          # amd64 + arm64, same as the build-*.yml workflows (node-26#28).
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.IMAGE }}:${{ steps.meta.outputs.TAG }}
+          cache-from: type=registry,ref=${{ steps.meta.outputs.IMAGE }}:buildcache

.gitignore

@@ -13,6 +13,7 @@ venv/
 # Runtime-generated configs and recordings
 configs/
 recordings/
+.drb-update-compose.yml
 
 # Logs
 *.log

README.md

@@ -142,13 +142,17 @@ this repo at the `v1` tag, enrols with C2, pulls the prebuilt images and starts:
 
 ```bash
 curl -fsSL https://git.vpn.cusano.net/logan/node-26/raw/tag/v1/install.sh \
-  | sudo bash -s -- --token DRB-xxxx --node-id node-003 \
+  | sudo bash -s -- --node-id node-003 \
       --c2-url https://api.<domain> --mqtt-broker mqtt.<domain>
 ```
 
-Mint the `--token` at **Settings → Nodes** in the web app (the panel prints the
-whole command). Run `install.sh --help` for every flag; each also has a
-`DRB_*` env var. `--build` compiles op25 on the Pi (~1h) instead of pulling.
+It prompts (hidden input) for an enrollment token, minted at **Settings → Nodes**
+in the web app. The token never goes on the command line — argv lands in shell
+history and `ps` (node-26#18). Unattended installs use `--token-file PATH` (mode
+0600) or an exported `DRB_ENROLLMENT_TOKEN` (pass it through with
+`sudo --preserve-env=DRB_ENROLLMENT_TOKEN`; plain `sudo` drops it); the old `--token` flag still works
+but warns. Run `install.sh --help` for every flag; each also has a `DRB_*` env
+var. `--build` compiles op25 on the Pi (~1h) instead of pulling.
 
 ### Local dev / manual
 

docker-compose.yml

@@ -1,6 +1,10 @@
+# Image tags: a provisioned node pins every image to the source tree it has
+# checked out (DRB_TAG_* = src-<git tree hash>, written into .env by install.sh
+# and scripts/drb-update.sh via scripts/image-tags.sh — node-26#19). Unset, as
+# in local dev, they fall back to :latest / :stable, which CI builds from main.
 services:
   icecast:
-    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/icecast:latest
+    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/icecast:${DRB_TAG_ICECAST:-latest}
     build: ./icecast
     restart: unless-stopped
     network_mode: host
@@ -16,7 +20,7 @@ services:
   # rather than being exposed. edge-node still reaches both over localhost
   # because it shares this host network namespace.
   op25:
-    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/op25-client:stable
+    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/op25-client:${DRB_TAG_OP25:-stable}
     build: ./op25-container
     restart: unless-stopped
     privileged: true
@@ -38,7 +42,7 @@ services:
   # node-26#9. Same network/device access as op25 for the same reason: it
   # needs the raw USB device, not a virtualized one.
   secondary-sdr:
-    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/secondary-sdr:latest
+    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/secondary-sdr:${DRB_TAG_SECONDARY_SDR:-latest}
     build: ./secondary-sdr-container
     restart: unless-stopped
     privileged: true
@@ -47,8 +51,37 @@ services:
     volumes:
       - /dev:/dev
 
+  # Trunk Recorder (node-26#45) — the alternative recorder. Opt-in per node:
+  # it only starts when the node's .env has COMPOSE_PROFILES=trunk-recorder,
+  # and the edge-node only uses it with RECORDER_BACKEND=trunk-recorder. Set
+  # both or neither. Upstream image, pinned by tag AND digest (the digest is
+  # the multi-arch index for 5.2.1 on Docker Hub, amd64/arm64/arm/v7); bump
+  # both together. GPL-3.0: we ship it unmodified as a separate program —
+  # see trunk-recorder/README.md for the source offer.
+  #
+  # The edge-node writes ./configs/trunk-recorder/config.json; run.sh (our
+  # supervisor, replacing the image's CMD) restarts TR when it changes. It
+  # shares OP25's dongle slot, so op25 is never started on such a node.
+  trunk-recorder:
+    image: robotastic/trunk-recorder:5.2.1@sha256:c3e425858bfca16c609d8612808a83f06b0f376d950d11733d7c25b2a28f8866
+    profiles: ["trunk-recorder"]
+    restart: unless-stopped
+    network_mode: host
+    devices:
+      - /dev/bus/usb:/dev/bus/usb
+    # TR stages each transmission in tempDir (/dev/shm); Docker's 64 MB
+    # default is tight with several recorders running at once.
+    shm_size: 256m
+    entrypoint: ["/bin/sh", "/drb/run.sh"]
+    environment:
+      TZ: ${TZ:-UTC}
+    volumes:
+      - ./configs/trunk-recorder:/app
+      - ./recordings:/recordings
+      - ./trunk-recorder:/drb:ro
+
   edge-node:
-    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/edge-node:latest
+    image: ${IMAGE_REGISTRY:-git.vpn.cusano.net}/${DOCKER_ORG:-logan}/${DOCKER_REPO:-node-26}/edge-node:${DRB_TAG_EDGE_NODE:-latest}
     build: ./drb-edge-node
     restart: unless-stopped
     network_mode: host

drb-edge-node/app/config.py

@@ -1,5 +1,5 @@
 from pydantic_settings import BaseSettings
-from typing import Optional
+from typing import Literal, Optional
 
 
 class Settings(BaseSettings):
@@ -54,6 +54,13 @@ class Settings(BaseSettings):
     # Bounded wait for the shared PulseAudio socket before launching FFmpeg.
     pulse_wait_timeout: float = 30.0
 
+    # Discord radio (node-26#25): with the broker unreachable this long, log
+    # every radio bot out. MUST stay below C2's
+    # DISCORD_LEASE_OFFLINE_RELEASE_SECONDS (default 600), after which C2 hands
+    # this node's bot tokens to other nodes — so a token is never logged in on
+    # two nodes at once.
+    discord_mqtt_loss_stop_seconds: int = 300
+
     # ------------------------------------------------------------------
     # Call segmentation
     #
@@ -146,6 +153,63 @@ class Settings(BaseSettings):
     # Offline call buffer — how many call_end events to keep while disconnected
     offline_call_buffer_size: int = 35
 
+    # Upload spool (node-26#44) — recordings whose upload to C2 failed are kept
+    # here and retried instead of deleted. Defaults to <recordings_path>/spool,
+    # i.e. on the host disk via the /recordings bind mount, so it survives a
+    # restart. Bounded both ways because a full host disk stops recording
+    # outright (node-26#41): FLAC is ~1.3 MB per minute of audio, so 512 MiB is
+    # roughly 6 h of continuous traffic. Oldest entries are evicted first.
+    upload_spool_dir: Optional[str] = None
+    upload_spool_max_bytes: int = 512 * 1024 * 1024
+    upload_spool_max_age_hours: float = 72.0
+    # Exponential backoff between retries of one spooled recording.
+    upload_retry_min_seconds: float = 15.0
+    upload_retry_max_seconds: float = 600.0
+    # Timeout for the FIRST, inline upload attempt. metadata_watcher awaits the
+    # call close, so a black-holed C2 used to stall segmentation for the full
+    # 120 s; a failure here just lands in the spool.
+    upload_inline_timeout_seconds: float = 30.0
+
+    # ------------------------------------------------------------------
+    # Recorder backend (node-26#45)
+    #
+    #   op25            OP25 decodes, Liquidsoap mixes into PulseAudio, and
+    #                   call_recorder/metadata_watcher cut calls out of that
+    #                   one stream. The default; every existing node.
+    #   trunk-recorder  Trunk Recorder owns the SDR and records every grant at
+    #                   once, with call boundaries from the decoder. Its
+    #                   uploadScript drops each finished call in tr_inbox_dir
+    #                   and app/internal/trunk_recorder.py uploads it through
+    #                   the same spool. OP25 is never started (it would fight
+    #                   TR for the dongle) and the PulseAudio recorder stays
+    #                   off, so a call is never uploaded twice. Needs the
+    #                   compose profile too: COMPOSE_PROFILES=trunk-recorder.
+    # ------------------------------------------------------------------
+    recorder_backend: Literal["op25", "trunk-recorder"] = "op25"
+    # Shared with the trunk-recorder container (mounted there as /app):
+    # config.json, the CSVs, its logs, and the supervisor's status file.
+    tr_config_dir: Optional[str] = None  # default <config_path>/trunk-recorder
+    # Where TR's uploadScript hands over finished calls (default
+    # <recordings_path>/tr-inbox). Same bind mount in both containers.
+    tr_inbox_dir: Optional[str] = None
+    # Source (SDR) settings for the generated config. 2.4 Msps is the most an
+    # RTL-SDR does without dropping samples; ~2 MHz of it is usable.
+    tr_sample_rate: int = 2_400_000
+    tr_gain: float = 34.0  # dB; matches op25-container's rtl-sdr-v3 preset (lna:34)
+    tr_center_hz: Optional[int] = None  # override the computed centre frequency
+    # Simultaneous voice channels on a trunked system. Each costs CPU (on a
+    # Pi 4 roughly 4-6 is the ceiling); conventional channels get one each.
+    tr_digital_recorders: int = 4
+    # TR deletes calls shorter than this. Matches the key-up noise the old
+    # recorder's trim + all-silence check threw away.
+    tr_min_duration: float = 1.0
+    # Conventional squelch, absolute dB (TR has no noise squelch). Used when
+    # the system config gives no squelch_threshold. Needs hand tuning per site.
+    tr_squelch_db: float = -50.0
+    # simplestream UDP port for live audio (TR -> edge-node -> PulseAudio ->
+    # Discord). Local only.
+    tr_live_port: int = 9123
+
     # ------------------------------------------------------------------
     # Local dashboard / API authentication
     #

drb-edge-node/app/internal/call_recorder.py

@@ -64,12 +64,12 @@ from collections import deque
 from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
-from typing import List, Optional, Tuple
+from typing import Dict, List, Optional, Tuple
 
-import httpx
 from app.config import settings
-from app.internal import audio_trim, credentials, pcm, pulse
+from app.internal import audio_trim, pcm, pulse, upload_spool
 from app.internal.logger import logger
+from app.internal.upload_spool import UploadMeta, UploadResult, UploadSpool
 
 # Safety cap on a single recording; mirrors MAX_SEGMENT_SECONDS in metadata_watcher.
 MAX_RECORDING_SECONDS = 600
@@ -320,16 +320,35 @@ class CallRecorder:
         # why a capture process exited (see _classify_capture_exit).
         self._last_stderr_lines: deque[str] = deque(maxlen=10)
 
+        # Failed uploads wait here for a retry instead of being deleted
+        # (node-26#44). See internal/upload_spool.py.
+        self.spool = UploadSpool(
+            Path(settings.upload_spool_dir or (Path(settings.recordings_path) / "spool")),
+            uploader=self._post,
+            max_bytes=settings.upload_spool_max_bytes,
+            max_age_seconds=settings.upload_spool_max_age_hours * 3600,
+            backoff_min=settings.upload_retry_min_seconds,
+            backoff_max=settings.upload_retry_max_seconds,
+        )
+
     # ------------------------------------------------------------------
     # Lifecycle
     # ------------------------------------------------------------------
 
-    async def start(self) -> None:
-        """Start the persistent capture. Call once from app lifespan."""
-        self._stream_task = asyncio.create_task(self._capture_loop())
-        logger.info("PulseAudio ring-buffer starting.")
+    async def start(self, capture: bool = True) -> None:
+        """Start the persistent capture. Call once from app lifespan.
+
+        capture=False starts only the upload spool: with the trunk-recorder
+        backend (node-26#45) TR does the recording, and a second recorder on
+        the same audio would upload every call twice."""
+        if capture:
+            self._stream_task = asyncio.create_task(self._capture_loop())
+            logger.info("PulseAudio ring-buffer starting.")
+        if settings.c2_url:
+            self.spool.start()
 
     async def stop(self) -> None:
+        await self.spool.stop()
         if self._stream_task:
             self._stream_task.cancel()
             try:
@@ -751,6 +770,18 @@ class CallRecorder:
     # Upload (unchanged interface)
     # ------------------------------------------------------------------
 
+    async def _post(self, file_path: Path, meta: UploadMeta) -> UploadResult:
+        return await upload_spool.post_recording(file_path, meta, upload_spool.mime_for(file_path, AUDIO_MIME))
+
+    async def _post_inline(self, file_path: Path, meta: UploadMeta) -> UploadResult:
+        # metadata_watcher awaits on_call_end, so this attempt blocks the poll
+        # loop. With the spool behind it, it can afford a short timeout; the
+        # background retries get the full UPLOAD_TIMEOUT_SECONDS.
+        return await upload_spool.post_recording(
+            file_path, meta, upload_spool.mime_for(file_path, AUDIO_MIME),
+            timeout=settings.upload_inline_timeout_seconds,
+        )
+
     async def upload_recording(
         self,
         file_path: Path,
@@ -760,51 +791,40 @@ class CallRecorder:
         system_id: Optional[str] = None,
         audio_start_epoch: Optional[float] = None,
         audio_end_epoch: Optional[float] = None,
+        extra: Optional[Dict[str, str]] = None,
     ) -> Optional[str]:
+        """
+        Upload once, inline. Returns the storage URL on success.
+
+        The file is deleted ONLY after a 2xx with a URL (node-26#44). A
+        retryable failure moves it into the spool, which keeps retrying in the
+        background; C2's /upload writes `audio_gcs_uri` onto the call doc by
+        call_id whenever the upload lands, so a late upload still attaches.
+        """
         if not settings.c2_url:
             logger.info("No C2_URL configured — skipping upload.")
+            file_path.unlink(missing_ok=True)
             return None
 
-        upload_url = f"{settings.c2_url}/upload"
-        api_key = credentials.get_api_key()
-        headers = {"Authorization": f"Bearer {api_key}"} if api_key else {}
-
-        form: dict = {"call_id": call_id, "node_id": settings.node_id}
-        if talkgroup_id is not None:
-            form["talkgroup_id"] = str(talkgroup_id)
-        if talkgroup_name:
-            form["talkgroup_name"] = talkgroup_name
-        if system_id:
-            form["system_id"] = system_id
-        # Where this audio really sits on the wall clock once silence is trimmed.
-        # C2 does not declare these Form fields yet, so FastAPI ignores them —
-        # they cost nothing and are here for when playback/correlation want them.
-        if audio_start_epoch is not None:
-            form["audio_start_epoch"] = f"{audio_start_epoch:.3f}"
-        if audio_end_epoch is not None:
-            form["audio_end_epoch"] = f"{audio_end_epoch:.3f}"
-
-        try:
-            async with httpx.AsyncClient(timeout=120) as client:
-                with open(file_path, "rb") as f:
-                    r = await client.post(
-                        upload_url,
-                        files={"file": (file_path.name, f, AUDIO_MIME)},
-                        data=form,
-                        headers=headers,
-                    )
-                    r.raise_for_status()
-                    audio_url = r.json().get("url")
-                    logger.info(f"Upload complete: {audio_url}")
-                    return audio_url
-        except Exception as e:
-            logger.error(f"Upload failed: {e}")
+        meta = UploadMeta(
+            call_id=call_id, talkgroup_id=talkgroup_id, talkgroup_name=talkgroup_name,
+            system_id=system_id, audio_start_epoch=audio_start_epoch, audio_end_epoch=audio_end_epoch,
+            extra=extra,
+        )
+        result = await self._post_inline(file_path, meta)
+        self.spool.last_result = {"call_id": call_id, "kind": result.kind, "status": result.status,
+                                  "detail": result.detail, "epoch": time.time()}
+        if result.kind == upload_spool.OK:
+            logger.info(f"Upload complete: {result.url}")
+            file_path.unlink(missing_ok=True)
+            return result.url
+        if result.kind == upload_spool.REJECT:
+            logger.error(f"C2 rejected the upload of call {call_id} ({result.detail}) — not retryable, deleting it.")
+            file_path.unlink(missing_ok=True)
             return None
-        finally:
-            try:
-                file_path.unlink()
-            except Exception:
-                pass
+        if self.spool.add(file_path, meta, result) is None:
+            self.spool.last_result = {**self.spool.last_result, "kind": "lost"}
+        return None
 
     # ------------------------------------------------------------------
     # State

drb-edge-node/app/internal/conventional.py

@@ -0,0 +1,243 @@
+"""
+Attribution for CONVENTIONAL channels — P25 conventional (node-26#24) and
+analog NBFM (node-26#20) share this one path.
+
+metadata_watcher labels audio with whatever the OP25 console says was talking.
+On a trunked system that is a talkgroup from a control-channel grant. On a
+conventional channel there is no control channel, so:
+
+  * P25 conventional: link control in each LDU1 usually carries the talkgroup
+    and unit id, and our tk_drb_conv module adds `voice` (frames arriving) and
+    encryption. The talkgroup is often the P25 default (1) or "everyone"
+    (0xFFFF) and identical on every channel, which says nothing about WHICH
+    channel was keyed, and sometimes it is missing altogether.
+  * Analog: OP25 reports the channel with tgid None and nothing else — the
+    console never says anyone is talking.
+
+So a conventional channel gets a stable SYNTHETIC talkgroup id derived from its
+frequency (channel_tgid), used whenever link control gives nothing that
+distinguishes the channel. A real, distinct link-control talkgroup is still
+used when present. normalize() rewrites the console update so the rest of the
+watcher sees ordinary "talkgroup X is active" rows and grants and needs no
+conventional special cases, except one: with exactly ONE conventional channel
+configured, every sound OP25 puts on drb_sink came from that channel, so audio
+the console said nothing about is attributed to it (sole_channel) instead of
+being discarded as orphan audio. With two channels there is no such certainty
+and orphan audio is still discarded (DEFERRED.md, metadata_watcher row).
+
+Encrypted conventional traffic is never a talker: the decoder mutes it, so no
+audio follows, and letting it compete for attribution could mislabel a clear
+call on the other channel. It is reported instead (encryption_report).
+"""
+import time
+from typing import Any, Callable, Dict, List, Optional, Tuple
+
+# P25 talkgroups that identify no particular group: TIA-102 default (1) and
+# "everyone" (0xFFFF). 0 is "none" and already rejected by _as_int.
+NON_DISTINCT_TGIDS = frozenset({1, 0xFFFF})
+
+# Synthetic ids are frequency in 100 Hz units: 460.400 MHz -> 4_604_000. Any
+# RTL-SDR frequency (>= 24 MHz) gives >= 240_000, clear of the 16-bit P25
+# talkgroup space, and 6.25 kHz channel steps stay distinct. C2 resolves the
+# same number back to the channel name (server talkgroups.name_from_system).
+SYNTHETIC_TGID_MIN = 240_000
+
+# How long a channel's last real talkgroup is remembered for a transmission
+# whose link control hasn't decoded (yet). Covers the back-and-forth of one
+# conversation; past it, an undecoded call is labelled with the channel.
+REMEMBER_TGID_SECONDS = 30.0
+
+
+def channel_tgid(freq: Any) -> Optional[int]:
+    """Stable synthetic talkgroup id for a conventional channel frequency (Hz or MHz)."""
+    try:
+        f = float(freq)
+    except (TypeError, ValueError):
+        return None
+    if f <= 0:
+        return None
+    hz = f * 1_000_000 if f < 1_000_000 else f
+    return int(round(hz / 100))
+
+
+def _as_int(value: Any) -> Optional[int]:
+    try:
+        n = int(value)
+    except (TypeError, ValueError):
+        return None
+    return n if n > 0 else None
+
+
+def _truthy(value: Any) -> bool:
+    return bool(value) and value not in ("0", "false", "False")
+
+
+ALGID_NAMES = {
+    0x81: "DES-OFB", 0x83: "Triple DES", 0x84: "AES-256", 0x85: "AES-128",
+    0x9F: "DES-XL", 0xA0: "DVI-XL", 0xA1: "DVP-XL", 0xAA: "ADP (RC4)",
+}
+
+
+def algid_name(algid: Any) -> str:
+    a = _as_int(algid)
+    if a is None:
+        return "unknown algorithm"
+    return f"{ALGID_NAMES.get(a, 'algorithm')} (ALGID 0x{a:02X})"
+
+
+class ConventionalChannels:
+    """Per-poll normalizer plus what it has learned about the channels."""
+
+    def __init__(self) -> None:
+        # msgqid -> latest raw conventional row. channel_update is not on every
+        # poll, so this outlives a single update.
+        self._rows: Dict[str, Dict[str, Any]] = {}
+        self._known = False   # have we seen a channel_update at all
+        # synthetic channel id -> the talkgroup that channel last carried. A
+        # transmission's header frame sets `voice` ~180 ms before its first
+        # link control names the talkgroup; without this, every such poll
+        # would label the call with the synthetic id and the real talkgroup
+        # a poll later would force a bogus split (drb-audio-review, #24).
+        self._last_identity: Dict[int, Tuple[int, float]] = {}
+        self._clock: Callable[[], float] = time.time
+
+    # -- identity --------------------------------------------------------
+
+    @staticmethod
+    def _name(row: Dict[str, Any]) -> str:
+        name = str(row.get("name") or "").strip()
+        if name and not name.startswith("["):
+            return name
+        f = row.get("freq")
+        try:
+            return f"{float(f) / 1e6:.4f} MHz"
+        except (TypeError, ValueError):
+            return "Conventional"
+
+    def identity(self, row: Dict[str, Any], lc_tgid: Optional[int]) -> Optional[int]:
+        """Distinctive link-control talkgroup; else (no link control decoded
+        yet) what this channel last carried; else the channel's synthetic id."""
+        synthetic = channel_tgid(row.get("freq"))
+        now = self._clock()
+        if lc_tgid is not None and lc_tgid not in NON_DISTINCT_TGIDS:
+            if synthetic is not None:
+                self._last_identity[synthetic] = (lc_tgid, now)
+            return lc_tgid
+        remembered = self._last_identity.get(synthetic) if synthetic is not None else None
+        if lc_tgid is None and remembered and now - remembered[1] <= REMEMBER_TGID_SECONDS:
+            self._last_identity[synthetic] = (remembered[0], now)   # still the same conversation
+            return remembered[0]
+        if synthetic is not None and lc_tgid is not None:
+            self._last_identity[synthetic] = (synthetic, now)   # explicit default TG: channel identity
+        return synthetic
+
+    # -- normalization ---------------------------------------------------
+
+    def normalize(self, update: Any) -> Any:
+        """Rewrite conventional rows and grants in place; trunked ones untouched."""
+        if update.channels:
+            self._known = True
+            self._rows = {}
+        for i, row in enumerate(update.channels):
+            if not _truthy(row.get("conventional")):
+                continue
+            key = str(row.get("msgqid", i))
+            self._rows[key] = row
+            update.channels[i] = self._normalize_row(row)
+
+        for i, entry in enumerate(update.call_log):
+            row = self._rows.get(str(entry.get("rcvr")))
+            if row is None:
+                continue
+            lc = _as_int(entry.get("tgid"))
+            tgid = self.identity(row, lc)
+            fixed = dict(entry)
+            fixed["lc_tgid"] = lc
+            fixed["tgid"] = tgid
+            fixed["tgtag"] = self._label(row, lc, entry.get("tgtag"))
+            fixed["freq"] = entry.get("freq") or row.get("freq")
+            update.call_log[i] = fixed
+        return update
+
+    def _label(self, row: Dict[str, Any], lc: Optional[int], tag: Any) -> str:
+        name = self._name(row)
+        tag = str(tag or "").strip()
+        if lc is not None and lc not in NON_DISTINCT_TGIDS and tag and tag not in ("Conventional", name):
+            return tag
+        return name
+
+    def _normalize_row(self, row: Dict[str, Any]) -> Dict[str, Any]:
+        lc = _as_int(row.get("tgid"))
+        encrypted = _truthy(row.get("encrypted"))
+        # tgid is only ever set while a call is up (tk_p25 / tk_drb_conv clear
+        # it on TDU and sync timeout); `voice` is tk_drb_conv's own signal.
+        active = (lc is not None or _truthy(row.get("voice"))) and not encrypted
+        out = dict(row)
+        out["lc_tgid"] = lc
+        out["tgid"] = self.identity(row, lc) if active else None
+        out["tag"] = self._label(row, lc, row.get("tag"))
+        out["drb_conventional"] = True
+        out["drb_active"] = active
+        return out
+
+    # -- what the watcher asks -------------------------------------------
+
+    def same_channel_relabel(self, current_tgid: Optional[int], current_freq: Any,
+                             new_tgid: Optional[int], new_freq: Any) -> Optional[str]:
+        """Two labels for ONE conventional channel are not a talkgroup change.
+
+        "adopt": the open segment holds the channel's synthetic id and the
+                 console now names the real talkgroup — relabel, don't split.
+        "keep":  the segment holds a real talkgroup and the console offers the
+                 synthetic id (link control not decoded on this frame) — ignore.
+        None:    not the same conventional channel; the normal split rules apply.
+        """
+        if current_tgid is None or new_tgid is None or current_tgid == new_tgid:
+            return None
+        synthetic = channel_tgid(new_freq)
+        if synthetic is None or channel_tgid(current_freq) != synthetic:
+            return None
+        if not any(channel_tgid(r.get("freq")) == synthetic for r in self._rows.values()):
+            return None   # trunked: freq says nothing about identity
+        if current_tgid == synthetic:
+            return "adopt"
+        if new_tgid == synthetic:
+            return "keep"
+        return None
+
+    def sole_channel(self) -> Optional[Dict[str, Any]]:
+        """The one conventional channel this node listens to, if exactly one
+        (and it is not encrypted). None on any trunked or multi-channel setup."""
+        if len(self._rows) != 1:
+            return None
+        row = next(iter(self._rows.values()))
+        tgid = channel_tgid(row.get("freq"))
+        if tgid is None:
+            return None
+        if _truthy(row.get("encrypted")):
+            return None
+        return {"tgid": tgid, "name": self._name(row), "freq": row.get("freq")}
+
+    def encryption_report(self) -> List[Dict[str, Any]]:
+        """Per conventional channel: is it (or was its last call) encrypted."""
+        out = []
+        for row in self._rows.values():
+            enc_calls = _as_int(row.get("enc_calls")) or 0
+            clear_calls = _as_int(row.get("clear_calls")) or 0
+            now_enc = _truthy(row.get("encrypted"))
+            last_enc = row.get("last_enc_time") or 0
+            last_clear = row.get("last_clear_time") or 0
+            out.append({
+                "name": self._name(row),
+                "freq": row.get("freq"),
+                "nac": _as_int(row.get("nac")),
+                "encrypted_now": now_enc,
+                "enc_calls": enc_calls,
+                "clear_calls": clear_calls,
+                # The channel "is encrypted" when its most recent call was.
+                "encrypted": now_enc or (enc_calls > 0 and float(last_enc) >= float(last_clear)),
+                "algid": _as_int(row.get("algid")) or _as_int(row.get("last_enc_algid")),
+                "keyid": _as_int(row.get("keyid")) or _as_int(row.get("last_enc_keyid")),
+                "voice": _truthy(row.get("voice")),
+            })
+        return out

drb-edge-node/app/internal/credentials.py

@@ -3,8 +3,12 @@ Manages the persisted node API key, plus the local-auth signing material used
 by app/internal/auth.py.
 
 The API key is provisioned by the C2 server after an admin approves the node.
-It arrives via MQTT and is saved to /configs/credentials.json so it survives
-container restarts.
+install.sh fetches it over HTTPS (GET /nodes/{id}/credentials + the pickup
+secret it saved to /configs/pickup_secret) and writes /configs/credentials.json;
+the running app can also fetch it itself (app/internal/key_pickup.py) and
+re-read the file at any time (reload_api_key), so a key written after startup
+is picked up without a container restart (node-26#14). The legacy MQTT
+delivery (nodes/{id}/api_key) still saves here too.
 
 The scrypt salt and session-signing secret are generated locally on first boot
 (never provisioned externally) and persisted the same way, so dashboard
@@ -12,12 +16,14 @@ sessions survive a container restart instead of forcing every operator to
 re-login whenever the node restarts.
 """
 import json
+import os
 import secrets
 from pathlib import Path
 from app.config import settings
 from app.internal.logger import logger
 
 _CREDS_FILE = Path(settings.config_path) / "credentials.json"
+_PICKUP_FILE = Path(settings.config_path) / "pickup_secret"
 _api_key: str | None = None
 _auth_salt: bytes | None = None
 _session_secret: bytes | None = None
@@ -74,6 +80,37 @@ def get_api_key() -> str | None:
     return _api_key
 
 
+def reload_api_key() -> str | None:
+    """Re-read the api_key from disk (install.sh, or an operator, may have
+    written it after startup). Returns the key now in effect. Only the api_key
+    is taken from the file — the auth material already in memory stays."""
+    global _api_key
+    try:
+        data = json.loads(_CREDS_FILE.read_text())
+    except FileNotFoundError:
+        return _api_key
+    except Exception as e:
+        logger.warning(f"Could not re-read credentials file: {e}")
+        return _api_key
+    key = data.get("api_key")
+    if key and key != _api_key:
+        _api_key = key
+        logger.info("Node API key re-read from disk (changed since it was last loaded).")
+    return _api_key
+
+
+def get_pickup_secret() -> str | None:
+    """The one-time pickup secret install.sh saved at enrollment, if any."""
+    try:
+        secret = _PICKUP_FILE.read_text().strip()
+    except FileNotFoundError:
+        return None
+    except Exception as e:
+        logger.warning(f"Could not read pickup secret: {e}")
+        return None
+    return secret or None
+
+
 def save_api_key(key: str) -> None:
     global _api_key
     _api_key = key
@@ -88,4 +125,10 @@ def _write() -> None:
         data["auth_salt"] = _auth_salt.hex()
     if _session_secret is not None:
         data["session_secret"] = _session_secret.hex()
-    _CREDS_FILE.write_text(json.dumps(data))
+    # Atomic replace with 0600: install.sh on the host writes this same file,
+    # and a torn half-written JSON would lose the key AND the auth material.
+    tmp = _CREDS_FILE.with_name(_CREDS_FILE.name + ".tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w") as f:
+        f.write(json.dumps(data))
+    os.replace(tmp, _CREDS_FILE)

drb-edge-node/app/internal/discord_radio.py

@@ -1,299 +1,568 @@
+"""
+Discord radio streams on the edge, driven by desired state (node-26#25,
+server-26#203/#204).
+
+C2 retains ``nodes/{id}/discord/desired`` = the FULL list of streams this node
+should carry: ``{seq, streams: [{stream_id, guild_id, channel_id, token_id,
+system_name, ...}]}``. This module reconciles toward that list and publishes
+``nodes/{id}/discord/actual`` = ``{applied_seq, sessions: [token_id],
+streams: {stream_id: {state, error, code}}}`` after every change.
+
+Rules this enforces by construction:
+
+* One gateway session per leased token; a token no stream needs any more is
+  logged OUT (``client.close()``), not just disconnected from voice. C2 frees
+  the token only after an ``actual`` with ``applied_seq`` >= the drop and the
+  token absent from ``sessions`` — so one token is never logged in on two
+  nodes (node-26#25 item 1).
+* One voice connection per (token, guild); one token can serve many guilds.
+* The watchdog is a separate reconcile loop that never closes itself: closing
+  a session cannot cancel it (node-26#25 item 2).
+* No message-content intent, no ``@bot leave/join`` mention controls — voice
+  is controlled only through C2 (node-26#25 item 3).
+* MQTT-loss fail-safe: if the broker has been unreachable for
+  ``discord_mqtt_loss_stop_seconds`` every radio bot is logged out, because C2
+  returns this node's tokens to the pool after its own (longer) grace.
+
+Bot token strings never travel over MQTT: they are fetched over HTTPS from C2
+(``GET /discord/node/{node}/tokens/{id}``, node API key), which hands a token
+only to the node holding its lease, and are kept in memory only.
+
+Audio: each voice connection plays the PulseAudio monitor (``-f pulse`` on
+``settings.pulse_source``) — the accuracy path, never Icecast.
+"""
+from __future__ import annotations
+
 import asyncio
-from typing import Optional
+import time
+from dataclasses import dataclass
+from typing import Awaitable, Callable, Optional
+
 import discord
-from discord.ext import commands
+
 from app.config import settings
 from app.internal import pulse
 from app.internal.logger import logger
 
-BOT_READY_TIMEOUT = 15   # seconds to wait for Discord bot to become ready
-WATCHDOG_INTERVAL = 30   # seconds between voice-connection health checks
-REJOIN_DELAY = 5  # seconds to wait before attempting a rejoin
-STREAM_RETRY_DELAY = 5   # seconds to back off before re-arming the audio source
+BOT_READY_TIMEOUT = 15     # seconds to wait for a Discord login to become ready
+WATCHDOG_INTERVAL = 15     # seconds between reconcile passes
+STREAM_RETRY_DELAY = 5     # seconds to back off before re-arming an audio source
+REPORT_EVERY_TICKS = 4     # unconditional actual-state report every ~60s
+_VOICE_TYPES = (discord.ChannelType.voice, discord.ChannelType.stage_voice)
 
 
-class RadioBot:
-    def __init__(self):
-        self._bot: Optional[commands.Bot] = None
-        self._voice_client: Optional[discord.VoiceClient] = None
-        self._task: Optional[asyncio.Task] = None
-        self._watchdog_task: Optional[asyncio.Task] = None
-        self._ready_event: Optional[asyncio.Event] = None
-        self._current_token: Optional[str] = None
+@dataclass
+class _Session:
+    token_id: str
+    client: object
+    task: Optional[asyncio.Task] = None
+    presence: Optional[str] = None
+
+    def alive(self) -> bool:
+        return self.task is not None and not self.task.done() and not self.client.is_closed()
+
+
+@dataclass
+class _Voice:
+    stream_id: str
+    token_id: str
+    guild_id: int
+    channel_id: int
+    vc: Optional[object] = None
+    state: str = "connecting"
+    error: Optional[str] = None
+    code: Optional[str] = None
+
+
+def _join_refusal(guild, channel) -> Optional[tuple[str, str]]:
+    """Why Discord would refuse this bot's voice join, or None.
+
+    Discord does not answer a join the bot lacks permission for — the gateway
+    just never sends the voice-server update, discord.py times out after 30s,
+    and the admin page used to read "(TimeoutError: )". Checking first turns
+    that into an instruction. Best effort: if the bot's own member or the
+    permission data is not cached, let the join go ahead.
+    """
+    me = getattr(guild, "me", None)
+    permissions_for = getattr(channel, "permissions_for", None)
+    if me is None or permissions_for is None:
+        return None
+    try:
+        perms = permissions_for(me)
+    except Exception:
+        return None
+    missing = [label for attr, label in (("view_channel", "View Channel"), ("connect", "Connect"))
+               if not getattr(perms, attr, True)]
+    if getattr(channel, "type", None) == discord.ChannelType.voice and not getattr(perms, "speak", True):
+        missing.append("Speak")
+    if missing:
+        return ("missing_permissions",
+                f"The radio bot lacks {', '.join(missing)} on that voice channel — "
+                "allow it in the channel's permission settings in Discord.")
+    limit = getattr(channel, "user_limit", 0) or 0
+    # The bot's own lingering voice state (a dropped connection) is not a
+    # slot it needs; counting it would block the rejoin of a full channel.
+    me_id = getattr(me, "id", None)
+    members = [m for m in (getattr(channel, "members", None) or [])
+               if me_id is None or getattr(m, "id", None) != me_id]
+    if limit and len(members) >= limit and not getattr(perms, "move_members", False):
+        return ("channel_full", f"That voice channel is full ({len(members)}/{limit}) — "
+                                "raise its user limit or free a slot.")
+    return None
+
+
+def _default_client_factory():
+    intents = discord.Intents.none()
+    intents.guilds = True
+    intents.voice_states = True
+    return discord.Client(intents=intents)
+
+
+def _default_audio_factory():
+    # before_options land ahead of -i:  ffmpeg -f pulse -i drb_sink.monitor …
+    source = discord.FFmpegPCMAudio(settings.pulse_source, before_options="-f pulse")
+    return discord.PCMVolumeTransformer(source, volume=1.0)
+
+
+async def _default_token_fetcher(token_id: str) -> Optional[str]:
+    import httpx
+    from app.internal import credentials
+    api_key = credentials.get_api_key()
+    if not settings.c2_url or not api_key:
+        logger.error("Cannot fetch a radio-bot token: C2_URL or the node API key is missing.")
+        return None
+    url = f"{settings.c2_url.rstrip('/')}/discord/node/{settings.node_id}/tokens/{token_id}"
+    try:
+        async with httpx.AsyncClient(timeout=10) as client:
+            r = await client.get(url, headers={"Authorization": f"Bearer {api_key}"})
+            if r.status_code != 200:
+                logger.error(f"C2 refused radio-bot token {token_id}: HTTP {r.status_code}")
+                return None
+            return r.json().get("token")
+    except Exception as e:
+        logger.error(f"Fetching radio-bot token {token_id} failed: {e}")
+        return None
+
+
+async def _default_publisher(payload: dict) -> None:
+    from app.internal.mqtt_manager import mqtt_manager
+    mqtt_manager.publish_discord_actual(payload)
+
+
+def _default_mqtt_up() -> bool:
+    from app.internal.mqtt_manager import mqtt_manager
+    return mqtt_manager.is_connected
+
+
+class RadioManager:
+    def __init__(
+        self,
+        client_factory: Callable[[], object] = _default_client_factory,
+        token_fetcher: Callable[[str], Awaitable[Optional[str]]] = _default_token_fetcher,
+        publisher: Callable[[dict], Awaitable[None]] = _default_publisher,
+        audio_factory: Callable[[], object] = _default_audio_factory,
+        mqtt_up: Callable[[], bool] = _default_mqtt_up,
+        ready_timeout: float = BOT_READY_TIMEOUT,
+    ):
+        self._client_factory = client_factory
+        self._fetch_token = token_fetcher
+        self._publish = publisher
+        self._audio_factory = audio_factory
+        self._mqtt_up = mqtt_up
+        self._ready_timeout = ready_timeout
+
+        self._desired: dict[str, dict] = {}
+        self._applied_seq: Optional[int] = None
+        self._sessions: dict[str, _Session] = {}
+        self._voices: dict[str, _Voice] = {}
+        self._session_errors: dict[str, str] = {}
+        self._tokens: dict[str, str] = {}          # token_id -> string, memory only
+        self._lock = asyncio.Lock()
         self._loop: Optional[asyncio.AbstractEventLoop] = None
+        self._watchdog: Optional[asyncio.Task] = None
+        self._mqtt_down_since: Optional[float] = None
+        self._failsafe = False
+        self._paused = False
+        # The applied seq at the moment of a local pause (node-26#34). The
+        # broker redelivers the retained desired message on every reconnect
+        # with the SAME seq; only a strictly newer seq from C2 lifts the pause.
+        self._paused_at_seq: Optional[int] = None
+        self._ticks = 0
 
-        # Remembered so we can rejoin after an unexpected disconnect
-        self._guild_id: Optional[int] = None
-        self._channel_id: Optional[int] = None
-        self._was_streaming: bool = False
+    # ------------------------------------------------------------------
+    # Inputs
+    # ------------------------------------------------------------------
 
-    async def join(self, guild_id: int, channel_id: int, token: str,
-                   call_active: bool = False, system_name: str = None) -> bool:
-        # (Re)start the bot if the token changed or the bot isn't running
-        if self._current_token != token or not self._is_bot_running():
-            if not await self._start_bot(token):
-                return False
-
-        guild = self._bot.get_guild(guild_id)
-        if not guild:
-            logger.error(f"Guild {guild_id} not found — bot may not be a member.")
-            return False
-
-        channel = guild.get_channel(channel_id)
-        if not isinstance(channel, discord.VoiceChannel):
-            logger.error(f"Channel {channel_id} is not a voice channel.")
-            return False
-
-        try:
-            if self._voice_client and self._voice_client.is_connected():
-                await self._voice_client.disconnect(force=True)
-            self._voice_client = await channel.connect()
-            # Remember where we are so the watchdog can rejoin if we drop
-            self._guild_id = guild_id
-            self._channel_id = channel_id
-            # Bounded wait for the shared PulseAudio socket. Historically FFmpeg was
-            # launched before the op25 container had created it, failed instantly,
-            # and the bot sat silently connected forever.
-            await pulse.wait_until_ready()
-            self._play_stream()
-            if system_name:
-                await self._bot.change_presence(
-                    activity=discord.Activity(
-                        type=discord.ActivityType.listening,
-                        name=system_name,
-                    )
-                )
-            logger.info(f"Joined #{channel.name} in {guild.name}")
-            return True
-        except Exception as e:
-            logger.error(f"Failed to join voice channel: {e}")
-            return False
-
-    async def leave(self) -> bool:
-        # Clear remembered channel so the watchdog doesn't rejoin
-        self._guild_id = None
-        self._channel_id = None
-        self._was_streaming = False
-
-        if self._voice_client and self._voice_client.is_connected():
+    async def apply_desired(self, payload: dict) -> None:
+        """Handle a (retained) desired-state message from C2."""
+        if not isinstance(payload, dict):
+            return
+        seq = payload.get("seq")
+        seq = seq if isinstance(seq, int) and not isinstance(seq, bool) else None
+        if seq is not None and self._applied_seq is not None and seq < self._applied_seq:
+            logger.warning(f"Ignoring stale Discord desired state seq {seq} (applied {self._applied_seq})")
+            return
+        wanted = {}
+        for s in payload.get("streams") or []:
             try:
-                self._stop_stream()
-                await self._voice_client.disconnect(force=True)
-                self._voice_client = None
-                await self._bot.change_presence(activity=None)
-                logger.info("Disconnected from voice channel.")
-                return True
-            except Exception as e:
-                logger.error(f"Failed to disconnect: {e}")
-        return False
+                wanted[str(s["stream_id"])] = {
+                    "stream_id": str(s["stream_id"]), "guild_id": int(s["guild_id"]),
+                    "channel_id": int(s["channel_id"]), "token_id": str(s["token_id"]),
+                    "system_name": s.get("system_name"),
+                }
+            except (KeyError, TypeError, ValueError):
+                logger.error(f"Malformed Discord desired stream entry ignored: {s!r}")
+        self._ensure_watchdog()
+        self._desired = wanted
+        if self._paused and self._redelivery_of_paused_state(seq):
+            logger.info(f"Discord desired seq {seq} is a redelivery — staying paused locally.")
+        else:
+            self._paused = False
+            self._paused_at_seq = None
+        await self.reconcile()
+        if seq is not None:
+            self._applied_seq = seq
+        await self.publish_actual()
 
+    def _redelivery_of_paused_state(self, seq: Optional[int]) -> bool:
+        """True when `seq` is not newer than what was applied at pause time."""
+        return seq is not None and self._paused_at_seq is not None and seq <= self._paused_at_seq
+
+    async def pause_locally(self) -> None:
+        """Local-dashboard stop: log every bot out until C2 sends a NEW list
+        (a seq strictly greater than the one applied now — node-26#34)."""
+        self._paused = True
+        self._paused_at_seq = self._applied_seq
+        await self.reconcile()
+        await self.publish_actual()
+
+    # ------------------------------------------------------------------
+    # Reconcile
+    # ------------------------------------------------------------------
+
+    def _target(self) -> dict[str, dict]:
+        return {} if (self._paused or self._failsafe) else self._desired
+
+    async def reconcile(self) -> None:
+        async with self._lock:
+            target = self._target()
+            # 1) voice connections no longer wanted (or re-pointed)
+            for sid, v in list(self._voices.items()):
+                d = target.get(sid)
+                if not d or (d["token_id"], d["guild_id"], d["channel_id"]) != (v.token_id, v.guild_id, v.channel_id):
+                    await self._disconnect(v)
+                    del self._voices[sid]
+            # 2) gateway sessions no stream needs: LOG OUT, not just leave voice
+            needed = {d["token_id"] for d in target.values()}
+            for tid in list(self._sessions):
+                if tid not in needed:
+                    await self._close_session(tid)
+            for tid in list(self._tokens):
+                if tid not in needed:
+                    self._tokens.pop(tid, None)
+            # 3) sessions + voice for everything wanted
+            for sid, d in sorted(target.items()):
+                v = self._voices.get(sid)
+                if v is None:
+                    v = self._voices[sid] = _Voice(sid, d["token_id"], d["guild_id"], d["channel_id"])
+                sess = await self._ensure_session(d["token_id"])
+                if sess is None:
+                    v.state, v.code = "error", "login_failed"
+                    v.error = self._session_errors.get(d["token_id"], "The radio bot could not log in to Discord.")
+                    continue
+                await self._ensure_voice(sess, v, d)
+            # 4) presence follows voice: "Listening to <system>" only while a
+            #    voice connection for that bot is actually up.
+            for sess in list(self._sessions.values()):
+                await self._sync_presence(sess, target)
+
+    async def _ensure_session(self, token_id: str) -> Optional[_Session]:
+        sess = self._sessions.get(token_id)
+        if sess and sess.alive():
+            return sess
+        if sess:
+            await self._close_session(token_id)
+        token = self._tokens.get(token_id) or await self._fetch_token(token_id)
+        if not token:
+            self._session_errors[token_id] = "DRB would not hand this node the radio bot's token."
+            return None
+        client = self._client_factory()
+        sess = _Session(token_id, client)
+        ready = asyncio.Event()
+
+        async def on_ready():
+            ready.set()
+        client.event(on_ready)
+        sess.task = asyncio.create_task(client.start(token))
+        waiter = asyncio.create_task(ready.wait())
+        done, _ = await asyncio.wait({waiter, sess.task}, timeout=self._ready_timeout,
+                                     return_when=asyncio.FIRST_COMPLETED)
+        if waiter not in done:
+            waiter.cancel()
+            err = sess.task.exception() if sess.task.done() and not sess.task.cancelled() else None
+            msg = f"{type(err).__name__}: {err}" if err else f"not ready after {self._ready_timeout:.0f}s"
+            logger.error(f"Radio bot {token_id} failed to log in: {msg}")
+            self._session_errors[token_id] = f"The radio bot could not log in to Discord ({msg[:120]})."
+            await self._shutdown_client(sess)
+            if isinstance(err, discord.LoginFailure):
+                self._tokens.pop(token_id, None)
+            return None
+        self._tokens[token_id] = token
+        self._sessions[token_id] = sess
+        self._session_errors.pop(token_id, None)
+        logger.info(f"Radio bot {token_id} logged in as {getattr(client, 'user', None)}")
+        return sess
+
+    async def _ensure_voice(self, sess: _Session, v: _Voice, d: dict) -> None:
+        client = sess.client
+        guild = client.get_guild(v.guild_id)
+        if guild is None:
+            v.state, v.code = "error", "not_in_guild"
+            v.error = "This radio bot is not a member of that Discord server — invite it first."
+            return
+        channel = guild.get_channel(v.channel_id)
+        if channel is None or getattr(channel, "type", None) not in _VOICE_TYPES:
+            v.state, v.code = "error", "bad_channel"
+            v.error = "That channel is not a voice channel the radio bot can see."
+            return
+        vc = v.vc
+        if vc is not None and vc.is_connected() and getattr(vc.channel, "id", None) == v.channel_id:
+            if not vc.is_playing():
+                self._play(v)
+            v.state, v.error, v.code = "connected", None, None
+            return
+        refusal = _join_refusal(guild, channel)
+        if refusal:
+            if v.error != refusal[1]:   # once per change, not every watchdog pass
+                logger.error(f"Stream {v.stream_id}: {refusal[1]}")
+            v.state, v.code, v.error = "error", refusal[0], refusal[1]
+            return
+        v.state = "connecting"
+        try:
+            existing = guild.voice_client
+            if existing is not None and existing.is_connected():
+                await existing.move_to(channel)
+                v.vc = existing
+            else:
+                if existing is not None:
+                    await existing.disconnect(force=True)
+                v.vc = await channel.connect()
+        except asyncio.TimeoutError:
+            # discord.py's TimeoutError has no message, so the old text read
+            # "(TimeoutError: )" — useless on the admin page.
+            v.vc = None
+            v.state, v.code = "error", "connect_timeout"
+            # Permissions were checked above, so this is usually the voice
+            # handshake itself (e.g. a pre-2.7 discord.py refused with 4017 for
+            # lacking DAVE E2EE, then retried until the 30s timeout) or UDP egress.
+            v.error = ("Discord never completed the voice join (timed out). Permissions look fine, so "
+                       "check the node's discord.py voice log (DAVE close 4017, UDP blocked).")
+            logger.error(f"Stream {v.stream_id}: voice connect timed out")
+            return
+        except Exception as e:
+            v.vc = None
+            v.state, v.code = "error", "connect_failed"
+            v.error = f"Could not connect to the voice channel ({type(e).__name__}: {str(e)[:120]})."
+            logger.error(f"Stream {v.stream_id}: voice connect failed: {type(e).__name__}: {e}")
+            return
+        # Bounded wait for the shared PulseAudio socket (op25 container creates it).
+        if not await pulse.wait_until_ready():
+            v.state, v.code = "error", "no_audio"
+            v.error = "The node's audio path (PulseAudio) is not up."
+            return
+        self._play(v, pulse_checked=True)
+        v.state, v.error, v.code = "connected", None, None
+        logger.info(f"Stream {v.stream_id} connected (bot {v.token_id})")
+
+    async def _sync_presence(self, sess: _Session, target: dict[str, dict]) -> None:
+        """Show "Listening to <system>" only while this bot is really in voice.
+
+        It used to be set once on the first successful join and never cleared,
+        so a bot whose voice later dropped (or kept failing to rejoin) still
+        looked healthy in Discord's member list.
+        """
+        name = None
+        for sid, v in sorted(self._voices.items()):
+            if (v.token_id == sess.token_id and v.state == "connected"
+                    and v.vc is not None and v.vc.is_connected()):
+                name = (target.get(sid) or {}).get("system_name") or name
+                if name:
+                    break
+        if sess.presence == name:
+            return
+        try:
+            activity = discord.Activity(type=discord.ActivityType.listening, name=name) if name else None
+            await sess.client.change_presence(activity=activity)
+            sess.presence = name
+        except Exception as e:
+            logger.warning(f"Presence update failed: {e}")
+
+    # ------------------------------------------------------------------
+    # Audio
+    # ------------------------------------------------------------------
+
+    def _play(self, v: _Voice, pulse_checked: bool = False) -> None:
+        vc = v.vc
+        if vc is None or not vc.is_connected():
+            return
+        if not pulse_checked and not pulse.is_ready():
+            logger.error(f"PulseAudio socket {pulse.socket_path()} missing — retrying audio in {STREAM_RETRY_DELAY}s.")
+            self._schedule_replay(v.stream_id)
+            return
+        try:
+            vc.play(self._audio_factory(), after=lambda err, sid=v.stream_id: self._on_audio_end(sid, err))
+        except Exception as e:
+            logger.error(f"Stream {v.stream_id}: could not start audio: {e}")
+            self._schedule_replay(v.stream_id)
+
+    def _on_audio_end(self, stream_id: str, error) -> None:
+        """discord.py calls this from its player thread."""
+        if error:
+            logger.error(f"Stream {stream_id} audio ended with error: {error}")
+        self._schedule_replay(stream_id, STREAM_RETRY_DELAY if error else 0.5)
+
+    def _schedule_replay(self, stream_id: str, delay: float = STREAM_RETRY_DELAY) -> None:
+        loop = self._loop
+        if loop is None or loop.is_closed():
+            return
+
+        async def _later():
+            await asyncio.sleep(delay)
+            v = self._voices.get(stream_id)
+            if v and v.vc and v.vc.is_connected() and not v.vc.is_playing():
+                self._play(v)
+
+        loop.call_soon_threadsafe(lambda: asyncio.ensure_future(_later()))
+
+    # ------------------------------------------------------------------
+    # Teardown
+    # ------------------------------------------------------------------
+
+    async def _disconnect(self, v: _Voice) -> None:
+        vc, v.vc = v.vc, None
+        if vc is None:
+            return
+        try:
+            if vc.is_playing():
+                vc.stop()
+            await vc.disconnect(force=True)
+        except Exception as e:
+            logger.warning(f"Stream {v.stream_id}: voice disconnect error: {e}")
+
+    async def _close_session(self, token_id: str) -> None:
+        sess = self._sessions.pop(token_id, None)
+        if sess is None:
+            return
+        for v in self._voices.values():
+            if v.token_id == token_id:
+                await self._disconnect(v)
+        await self._shutdown_client(sess)
+        logger.info(f"Radio bot {token_id} logged out")
+
+    async def _shutdown_client(self, sess: _Session) -> None:
+        try:
+            await sess.client.close()
+        except Exception as e:
+            logger.warning(f"Radio bot {sess.token_id} close error: {e}")
+        if sess.task and not sess.task.done():
+            sess.task.cancel()
+            try:
+                await sess.task
+            except BaseException:
+                pass
+
+    async def stop(self) -> None:
+        """Node shutdown: log every radio bot out."""
+        if self._watchdog:
+            self._watchdog.cancel()
+            self._watchdog = None
+        async with self._lock:
+            for v in list(self._voices.values()):
+                await self._disconnect(v)
+            self._voices.clear()
+            for tid in list(self._sessions):
+                await self._close_session(tid)
+            self._tokens.clear()
+
+    # ------------------------------------------------------------------
+    # Watchdog + MQTT-loss fail-safe
+    # ------------------------------------------------------------------
+
+    def _ensure_watchdog(self) -> None:
+        self._loop = asyncio.get_running_loop()
+        if self._watchdog is None or self._watchdog.done():
+            self._watchdog = asyncio.create_task(self._watchdog_loop())
+
+    async def _watchdog_loop(self) -> None:
+        while True:
+            await asyncio.sleep(WATCHDOG_INTERVAL)
+            try:
+                await self.tick()
+            except asyncio.CancelledError:
+                raise
+            except Exception as e:
+                logger.error(f"Discord watchdog error: {e}")
+
+    async def tick(self, now: Optional[float] = None) -> None:
+        """One watchdog pass: fail-safe check, then reconcile + report if needed."""
+        now = time.monotonic() if now is None else now
+        before = self.snapshot()
+        if self._mqtt_up():
+            self._mqtt_down_since = None
+            if self._failsafe:
+                logger.info("MQTT back — resuming Discord radio streams.")
+                self._failsafe = False
+        else:
+            if self._mqtt_down_since is None:
+                self._mqtt_down_since = now
+            elif (not self._failsafe and self._sessions
+                  and now - self._mqtt_down_since >= settings.discord_mqtt_loss_stop_seconds):
+                logger.warning("MQTT unreachable past the fail-safe — logging every radio bot out "
+                               "(C2 will hand these tokens to other nodes).")
+                self._failsafe = True
+        await self.reconcile()
+        self._ticks += 1
+        # On change, and every few passes regardless: a periodic report is what
+        # lets C2 settle a release whose first ack was lost.
+        if self.snapshot() != before or self._ticks % REPORT_EVERY_TICKS == 0:
+            await self.publish_actual()
+
+    # ------------------------------------------------------------------
+    # Reporting
+    # ------------------------------------------------------------------
+
+    def snapshot(self) -> dict:
+        streams = {}
+        for sid in self._desired:
+            v = self._voices.get(sid)
+            if self._paused:
+                streams[sid] = {"state": "paused_locally", "error": None, "code": None}
+            elif v is None:
+                streams[sid] = {"state": "connecting", "error": None, "code": None}
+            else:
+                streams[sid] = {"state": v.state, "error": v.error, "code": v.code}
+        return {
+            "applied_seq": self._applied_seq,
+            "sessions": sorted(tid for tid, s in self._sessions.items() if s.alive()),
+            "streams": streams,
+        }
+
+    async def publish_actual(self) -> None:
+        try:
+            await self._publish(self.snapshot())
+        except Exception as e:
+            logger.warning(f"Publishing Discord actual state failed: {e}")
+
+    # metadata_watcher hooks — audio plays continuously, nothing to do per call.
     def start_stream(self):
-        """Called when an OP25 call starts — stream plays continuously, nothing to do."""
         pass
 
     def stop_stream(self):
-        """Called when an OP25 call ends — stream plays continuously, nothing to do."""
         pass
 
-    async def stop(self):
-        self._guild_id = None
-        self._channel_id = None
-        self._was_streaming = False
-
-        if self._watchdog_task:
-            self._watchdog_task.cancel()
-            self._watchdog_task = None
-
-        await self.leave()
-
-        if self._task:
-            self._task.cancel()
-        if self._bot:
-            await self._bot.close()
-        self._bot = None
-        self._task = None
-        self._current_token = None
-        self._ready_event = None
-
-    def _play_stream(self):
-        """
-        Feed Discord voice straight from the PulseAudio monitor.
-
-        Icecast is NOT used here: it lags ~1 s at connect and drifts to 100 s+,
-        which is unusable for live listening. Icecast remains the frontend/mobile
-        listening path only.
-        """
-        if not self._voice_client:
-            return
-
-        if not pulse.is_ready():
-            logger.error(
-                f"PulseAudio socket {pulse.socket_path()} missing — "
-                f"cannot start Discord audio; retrying in {STREAM_RETRY_DELAY}s."
-            )
-            self._schedule_restart()
-            return
-
-        # before_options land ahead of -i, so this becomes:
-        #   ffmpeg -f pulse -i drb_sink.monitor …
-        source = discord.FFmpegPCMAudio(
-            settings.pulse_source,
-            before_options="-f pulse",
-        )
-        self._voice_client.play(
-            discord.PCMVolumeTransformer(source, volume=1.0),
-            after=self._on_stream_end,
-        )
-
-    def _schedule_restart(self, delay: float = STREAM_RETRY_DELAY):
-        """Re-arm the audio source after a delay — safe to call from any thread."""
-        if not self._loop:
-            return
-
-        async def _delayed_restart():
-            await asyncio.sleep(delay)
-            vc = self._voice_client
-            if vc and vc.is_connected() and not vc.is_playing():
-                self._play_stream()
-
-        self._loop.call_soon_threadsafe(lambda: asyncio.ensure_future(_delayed_restart()))
-
-    def _on_stream_end(self, error):
-        if error:
-            logger.error(f"Stream ended with error: {error}")
-        vc = self._voice_client
-        if not (self._loop and vc and vc.is_connected() and not vc.is_playing()):
-            return
-        if error:
-            # Back off before retrying — prevents a tight loop when PulseAudio is
-            # unavailable (FFmpeg exits immediately in that case).
-            self._schedule_restart()
-        else:
-            self._loop.call_soon_threadsafe(self._play_stream)
-
-    def _stop_stream(self):
-        if self._voice_client and self._voice_client.is_playing():
-            self._voice_client.stop()
-
-    async def _watchdog_loop(self):
-        """Periodically verify the voice connection is alive; rejoin silently if not."""
-        await asyncio.sleep(WATCHDOG_INTERVAL)  # give initial join time to settle
-        while True:
-            try:
-                await asyncio.sleep(WATCHDOG_INTERVAL)
-
-                # Only act if we're supposed to be in a channel
-                if not self._guild_id or not self._channel_id:
-                    continue
-
-                connected = self._voice_client is not None and self._voice_client.is_connected()
-                if not connected:
-                    logger.warning("Watchdog: voice connection lost — attempting rejoin.")
-                    await asyncio.sleep(REJOIN_DELAY)
-                    rejoined = await self.join(
-                        self._guild_id,
-                        self._channel_id,
-                        self._current_token,
-                    )
-                    if rejoined:
-                        logger.info("Watchdog: successfully rejoined voice channel.")
-                    else:
-                        logger.error("Watchdog: rejoin failed — will retry next cycle.")
-
-            except asyncio.CancelledError:
-                return
-            except Exception as e:
-                logger.error(f"Watchdog error: {e}")
-
-    async def _start_bot(self, token: str) -> bool:
-        await self.stop()  # clean up any previous instance
-
-        intents = discord.Intents.default()
-        intents.voice_states = True
-        intents.message_content = True
-        intents.messages = True
-        self._bot = commands.Bot(command_prefix="!", intents=intents)
-        self._ready_event = asyncio.Event()
-        self._current_token = token
-        self._loop = asyncio.get_event_loop()
-
-        @self._bot.event
-        async def on_ready():
-            logger.info(f"Discord bot ready: {self._bot.user} ({self._bot.user.id})")
-            self._ready_event.set()
-
-        @self._bot.event
-        async def on_voice_state_update(
-            member: discord.Member,
-            before: discord.VoiceState,
-            after: discord.VoiceState,
-        ):
-            """Detect when our own bot gets disconnected from a voice channel."""
-            if self._bot.user and member.id != self._bot.user.id:
-                return
-            if before.channel is not None and after.channel is None:
-                # Bot was disconnected (kicked or server drop).
-                # Don't null _voice_client here — Discord.py reconnects voice
-                # transparently and would leave _voice_client stale as None.
-                # The watchdog detects real disconnects via is_connected().
-                logger.warning("Bot was disconnected from voice channel — watchdog will rejoin if needed.")
-
-        @self._bot.event
-        async def on_message(message: discord.Message):
-            if message.author.bot:
-                return
-            if self._bot.user not in message.mentions:
-                return
-            content = message.content.lower()
-            if "leave" in content:
-                await self.leave()
-                try:
-                    await message.reply("Disconnected.")
-                except Exception:
-                    pass
-            elif "joinme" in content or "join" in content:
-                member = message.guild.get_member(message.author.id) if message.guild else None
-                vc = member.voice.channel if member and member.voice else None
-                if not vc:
-                    try:
-                        await message.reply("You're not in a voice channel.")
-                    except Exception:
-                        pass
-                    return
-                try:
-                    if self._voice_client and self._voice_client.is_connected():
-                        await self._voice_client.move_to(vc)
-                    else:
-                        self._voice_client = await vc.connect()
-                    self._channel_id = vc.id
-                    # A fresh connect() has no audio source attached yet.
-                    if not self._voice_client.is_playing():
-                        self._play_stream()
-                    await message.reply(f"Joined {vc.name}.")
-                except Exception as e:
-                    logger.error(f"joinme failed: {e}")
-
-        self._task = asyncio.create_task(self._bot.start(token))
-
-        try:
-            await asyncio.wait_for(self._ready_event.wait(), timeout=BOT_READY_TIMEOUT)
-            self._watchdog_task = asyncio.create_task(self._watchdog_loop())
-            return True
-        except asyncio.TimeoutError:
-            logger.error("Timed out waiting for Discord bot to become ready.")
-            await self.stop()
-            return False
-
-    def _is_bot_running(self) -> bool:
-        return (
-            self._bot is not None
-            and self._task is not None
-            and not self._task.done()
-        )
-
     @property
     def is_connected(self) -> bool:
-        return self._voice_client is not None and self._voice_client.is_connected()
+        return any(v.vc is not None and v.vc.is_connected() for v in self._voices.values())
 
 
-radio_bot = RadioBot()
+radio_bot = RadioManager()

drb-edge-node/app/internal/health.py

@@ -8,6 +8,10 @@ answers one of those for one link in the chain
     password -> C2 enrollment -> MQTT -> SDR -> what to listen to -> OP25
              -> decoding -> audio (PulseAudio) -> local stream (Icecast)
 
+With RECORDER_BACKEND=trunk-recorder (node-26#45) the last four are replaced
+by Trunk Recorder's: supervisor state, control-channel decode rate (from its
+log), recordings handed over, and the live feed to Discord.
+
 `gather_facts()` does the I/O; `build_checks()` is a pure function of those
 facts so every state (unapproved, no SDR, OP25 crashed, …) is unit-testable.
 
@@ -56,6 +60,51 @@ def _ago(seconds: float) -> str:
     return f"{seconds // 3600} h ago"
 
 
+def _channel_label(ch: Dict[str, Any]) -> str:
+    freq = _mhz(ch.get("freq"))
+    name = ch.get("name") or ""
+    if name and freq and freq not in name:
+        return f"{name} ({freq})"
+    return name or freq or "a channel"
+
+
+def _conventional_decode_check(chans: List[Dict[str, Any]]) -> Dict[str, str]:
+    """P25 conventional (node-26#24): no control channel to lock on to, so the
+    proof of decoding is P25 frames (a NAC) heard on the channels — and the one
+    failure the owner can't fix is encryption."""
+    if not chans:
+        return _check("decode", "Decoding", WARN, "Waiting for OP25 to report its channels…")
+    encrypted = [c for c in chans if c.get("encrypted")]
+    if encrypted:
+        from app.internal.conventional import algid_name
+        parts = []
+        for c in encrypted:
+            key = f", key 0x{c['keyid']:04X}" if c.get("keyid") is not None else ""
+            parts.append(f"{_channel_label(c)}: {algid_name(c.get('algid'))}{key}")
+        # "Everything is encrypted" only when no clear call was ever heard —
+        # `encrypted` alone means a channel's most recent call was.
+        every = len(encrypted) == len(chans) and not any(c.get("clear_calls") for c in chans)
+        return _check(
+            "decode", "Decoding", ERROR if every else WARN,
+            ("Encrypted — " if every else "Partly encrypted — ") + "; ".join(parts)
+            + ". Encrypted calls can't be decoded, so nothing from "
+            + ("these channels" if every else "those channels") + " is recorded.",
+            "Nothing to fix on the node: the agency encrypts this traffic. "
+            + ("Point the node at a different system." if every else "Clear calls are still recorded."),
+        )
+    heard = [c for c in chans if c.get("nac")]
+    listening = ", ".join(_channel_label(c) for c in chans)
+    if not heard:
+        return _check(
+            "decode", "Decoding", OK,
+            f"Listening on {listening} (P25 conventional) — no P25 traffic heard yet.",
+            "Normal on a quiet channel: conventional channels are silent until someone talks. If it stays "
+            "silent through a busy period, check the frequency, antenna and the SDR's PPM.",
+        )
+    nacs = ", ".join(sorted({f"0x{c['nac']:03X}" for c in heard}))
+    return _check("decode", "Decoding", OK, f"Listening on {listening} (P25 conventional) — decoding, NAC {nacs}.")
+
+
 def active_config(node_cfg) -> Any:
     if node_cfg.override_system_id and node_cfg.override_config:
         return node_cfg.override_config
@@ -109,6 +158,22 @@ def build_checks(f: Dict[str, Any]) -> List[Dict[str, str]]:
             f"Not connected to {broker} — expected until the node is approved (the broker only admits approved nodes).",
             "Fixes itself once the node is approved and has its API key (see above).",
         ))
+    elif (f.get("mqtt_last_error") or {}).get("kind") == "refused":
+        err = f["mqtt_last_error"]
+        checks.append(_check(
+            "mqtt", "Live link (MQTT)", ERROR,
+            f"{broker} refused this node's login ({err.get('detail')}).",
+            "The API key on file is not the one the broker expects — every re-approval issues a new one. "
+            "Re-run install.sh to fetch the current key, or ask a DRB admin to re-approve the node.",
+        ))
+    elif (f.get("mqtt_last_error") or {}).get("kind") == "unreachable":
+        err = f["mqtt_last_error"]
+        checks.append(_check(
+            "mqtt", "Live link (MQTT)", ERROR,
+            f"Can't reach {broker} ({err.get('detail')}).",
+            f"Check this site's internet connection, DNS, and that outbound port {f['mqtt_port']} isn't "
+            "blocked by a firewall. The key is not the problem.",
+        ))
     else:
         checks.append(_check(
             "mqtt", "Live link (MQTT)", ERROR,
@@ -144,7 +209,12 @@ def build_checks(f: Dict[str, Any]) -> List[Dict[str, str]]:
         ))
     else:
         origin = "chosen on this dashboard" if src["local"] else "assigned by the server"
-        checks.append(_check("source", "What to listen to", OK, f"{src['name']} ({src['type']}) — {origin}."))
+        kind = "P25 conventional" if src.get("mode") == "conventional" else src["type"]
+        checks.append(_check("source", "What to listen to", OK, f"{src['name']} ({kind}) — {origin}."))
+
+    if f.get("backend") == "trunk-recorder":
+        checks.extend(_trunk_recorder_checks(f, src, now))
+        return checks
 
     # 6. OP25
     op25 = f.get("op25_status")
@@ -170,6 +240,7 @@ def build_checks(f: Dict[str, Any]) -> List[Dict[str, str]]:
     console = f.get("console") or {}
     last_poll = console.get("last_poll_epoch")
     is_analog = bool(src) and str(src.get("type", "")).upper() in ("NBFM", "ANALOG")
+    is_conventional = bool(src) and src.get("mode") == "conventional"
     if not running:
         checks.append(_check("decode", "Decoding", OFF, "Starts when OP25 runs."))
     elif last_poll is None or now - last_poll > CONSOLE_STALE_SECONDS:
@@ -182,8 +253,9 @@ def build_checks(f: Dict[str, Any]) -> List[Dict[str, str]]:
         freq = _mhz(chans[0].get("freq")) if chans else None
         checks.append(_check(
             "decode", "Decoding", OK, f"Tuned to {freq or 'the analog frequency'} (analog FM — no decoding needed).",
-            "Live listening only: analog calls are not recorded or uploaded yet (node-26#20).",
         ))
+    elif is_conventional:
+        checks.append(_conventional_decode_check(f.get("conventional") or []))
     else:
         trunk = console.get("trunk") or []
         tsbk = [float(t.get("last_tsbk") or 0) for t in trunk]
@@ -238,6 +310,104 @@ def build_checks(f: Dict[str, Any]) -> List[Dict[str, str]]:
     return checks
 
 
+def _trunk_recorder_checks(f: Dict[str, Any], src: Optional[Dict[str, Any]], now: float) -> List[Dict[str, str]]:
+    """Checks 6-9 when Trunk Recorder is the recorder (node-26#45)."""
+    tr = f.get("tr") or {}
+    checks: List[Dict[str, str]] = []
+    status = tr.get("status")
+    state = (status or {}).get("state")
+    running = False
+    label = "Radio recorder (Trunk Recorder)"
+    if tr.get("config_error"):
+        checks.append(_check(
+            "recorder", label, ERROR, f"Couldn't build its config — {tr['config_error']}",
+            "Fix the system's channel list (or TR_* settings in .env); the node retries on the next config push.",
+        ))
+    elif status is None:
+        checks.append(_check(
+            "recorder", label, ERROR, "The trunk-recorder service isn't running.",
+            "Set COMPOSE_PROFILES=trunk-recorder in the node's .env, then run `docker compose up -d`.",
+        ))
+    elif status.get("stale"):
+        checks.append(_check(
+            "recorder", label, ERROR, f"Its supervisor stopped reporting {_ago(status.get('age_seconds') or 0)}.",
+            "Check the trunk-recorder container: `docker compose logs trunk-recorder`.",
+        ))
+    elif state == "running":
+        running = True
+        up = now - float(status.get("started_at") or now)
+        restarts = int(status.get("restarts") or 0)
+        checks.append(_check(
+            "recorder", label, OK if restarts < 3 else WARN,
+            f"Running for {_ago(up).replace(' ago', '')}"
+            + (f" — restarted {restarts} times since the container started." if restarts else "."),
+            "" if restarts < 3 else "Frequent restarts: `docker compose logs trunk-recorder` says why.",
+        ))
+    elif state == "crashed":
+        checks.append(_check(
+            "recorder", label, ERROR, f"Exited (code {status.get('last_exit')}) — restarting.",
+            "Usually the SDR is unplugged or held by another program. `docker compose logs trunk-recorder`.",
+        ))
+    elif state == "stopped":
+        checks.append(_check("recorder", label, WARN, "Stopped from the dashboard.", "Press Start."))
+    elif not src:
+        checks.append(_check("recorder", label, OFF, "Waiting — choose what to listen to first."))
+    else:
+        checks.append(_check("recorder", label, WARN, "Waiting for its config…"))
+
+    mode = (src or {}).get("mode")
+    if not running:
+        checks.append(_check("decode", "Decoding", OFF, "Starts when Trunk Recorder runs."))
+    elif mode == "trunked":
+        rate = tr.get("decode_rate")
+        age = tr.get("log_age_seconds")
+        if rate is None or age is None or age > 30:
+            checks.append(_check(
+                "decode", "Decoding", WARN, "No control-channel report from Trunk Recorder yet.",
+                "Give it 30 seconds after a start; if it stays, `docker compose logs trunk-recorder`.",
+            ))
+        elif rate > 0:
+            checks.append(_check("decode", "Decoding", OK, f"Decoding the control channel ({rate:g} messages/sec)."))
+        else:
+            checks.append(_check(
+                "decode", "Decoding", ERROR, "Not decoding the control channel (0 messages/sec).",
+                "Usually a wrong control-channel frequency, a weak signal/antenna, or SDR frequency error (PPM).",
+            ))
+    else:
+        checks.append(_check(
+            "decode", "Decoding", OK, "Listening (conventional) — channels record when their squelch opens.",
+            "If calls never arrive through a busy period, the squelch (TR_SQUELCH_DB or the system's "
+            "squelch_threshold) may be set too high.",
+        ))
+
+    last = tr.get("last_call_epoch")
+    backlog = int(tr.get("inbox_backlog") or 0)
+    if not running and not last:
+        checks.append(_check("audio", "Recordings", OFF, "Nothing recorded yet."))
+    elif backlog > 20:
+        checks.append(_check(
+            "audio", "Recordings", WARN, f"{backlog} finished calls waiting to be sent.",
+            "Normal for a minute after the server link comes back; if it keeps growing, check the C2 link.",
+        ))
+    elif last:
+        extra = f", {tr['encrypted_skipped']} encrypted skipped" if tr.get("encrypted_skipped") else ""
+        checks.append(_check(
+            "audio", "Recordings", OK,
+            f"Last call {_ago(now - last)} ({tr.get('calls_ingested', 0)} since start{extra}).",
+        ))
+    else:
+        checks.append(_check("audio", "Recordings", OK, "Recorder up — no call yet."))
+
+    live = tr.get("live") or {}
+    heard = live.get("last_packet_epoch")
+    checks.append(_check(
+        "stream", "Live audio", OK if heard else OFF,
+        ("Feeding Discord — last audio " + _ago(now - heard) + "." if heard else "Feeds Discord once a call is heard.")
+        + " The local browser stream isn't available with Trunk Recorder.",
+    ))
+    return checks
+
+
 async def icecast_live() -> Optional[bool]:
     """True if the configured mount has a source, False if not, None if Icecast is down."""
     url = f"http://{settings.icecast_host}:{settings.icecast_port}/status-json.xsl"
@@ -261,6 +431,7 @@ async def gather_facts() -> Dict[str, Any]:
     from app.internal.metadata_watcher import metadata_watcher
     from app.internal.mqtt_manager import mqtt_manager
     from app.internal.op25_client import op25_client
+    from app.internal.radio_config import system_mode
     from app.internal.secondary_sdr_client import secondary_sdr_client
 
     node_cfg = load_node_config()
@@ -277,20 +448,26 @@ async def gather_facts() -> Dict[str, Any]:
             sdr_count = op25_devs["count"]
 
     activity = call_recorder.audio_activity()
+    from app.internal import trunk_recorder as tr
     return {
         "now": time.time(),
+        "backend": settings.recorder_backend,
+        "tr": tr.trunk_recorder.health_facts() if tr.enabled() else None,
         "node_id": settings.node_id,
         "default_password": auth.is_using_default_password(),
         "c2_url": settings.c2_url,
         "has_api_key": bool(credentials.get_api_key()),
         "mqtt_connected": mqtt_manager.is_connected,
+        "mqtt_last_error": mqtt_manager.last_error,
         "mqtt_broker": settings.mqtt_broker,
         "mqtt_port": settings.mqtt_port,
         "sdr_count": sdr_count,
         "source": None if cfg is None else {
             "name": cfg.name, "type": cfg.type, "system_id": cfg.system_id,
+            "mode": system_mode(cfg.type, cfg.config),
             "local": bool(node_cfg.override_system_id and node_cfg.override_config),
         },
+        "conventional": metadata_watcher.conventional_channels,
         "op25_status": (op25 or {}).get("status") if op25 is not None else None,
         "console": metadata_watcher.console_state,
         "audio_capturing": call_recorder.is_capturing,

drb-edge-node/app/internal/key_pickup.py

@@ -0,0 +1,73 @@
+"""
+HTTPS api_key pickup — the node's own half of C2's enrollment flow
+(Server/drb-c2-core/app/routers/enrollment.py, GET /nodes/{id}/credentials).
+
+Why this exists (node-26#14): key delivery used to be MQTT-only
+(nodes/{id}/api_key), and a dynsec broker refuses a node that has no key — or
+a stale one — so a locked-out node could never receive the key that would let
+it in. install.sh already did this pickup once at install time; doing it from
+the running app too means a node approved after install, or whose key was
+reissued, recovers on its own with no SSH and no container restart.
+
+Auth is the pickup secret install.sh saved to /configs/pickup_secret at
+enrollment (the same file, bind-mounted). Only ever sent to settings.c2_url,
+over whatever scheme the operator configured (https in production).
+"""
+from typing import Optional
+
+import httpx
+
+from app.config import settings
+from app.internal import credentials
+from app.internal.logger import logger
+
+_TIMEOUT = 15
+
+
+async def fetch_api_key() -> Optional[str]:
+    """Ask C2 for this node's api_key. Returns it, or None when there isn't one
+    to be had yet (not approved, no pickup secret, C2 unreachable, rejected).
+    Never raises — the caller retries on its own backoff."""
+    if not settings.c2_url:
+        logger.warning("Key pickup skipped: C2_URL is not configured.")
+        return None
+    secret = credentials.get_pickup_secret()
+    if not secret:
+        logger.warning(
+            f"Key pickup skipped: no {settings.config_path}/pickup_secret. This node was not enrolled by "
+            "install.sh on this machine — re-run install.sh, or have an admin Reissue key and write it in."
+        )
+        return None
+
+    url = f"{settings.c2_url.rstrip('/')}/nodes/{settings.node_id}/credentials"
+    try:
+        async with httpx.AsyncClient(timeout=_TIMEOUT) as client:
+            r = await client.get(url, headers={"X-Pickup-Secret": secret})
+    except Exception as e:
+        logger.warning(f"Key pickup: could not reach C2 ({e}).")
+        return None
+
+    if r.status_code == 401:
+        logger.error(
+            "Key pickup: C2 rejected the saved pickup secret (401) — it was rotated by a re-enroll elsewhere. "
+            "Re-run install.sh and give it a fresh enrollment token when it asks (node-26#18)."
+        )
+        return None
+    if r.status_code == 404:
+        logger.error("Key pickup: C2 does not know this node (404) — it was deleted server-side. Re-run install.sh.")
+        return None
+    if r.status_code != 200:
+        logger.warning(f"Key pickup: unexpected HTTP {r.status_code} from C2.")
+        return None
+
+    try:
+        body = r.json()
+    except ValueError:
+        logger.warning("Key pickup: C2 returned a non-JSON body.")
+        return None
+    key = body.get("api_key") if isinstance(body, dict) else None
+    if not key or not isinstance(key, str):
+        status = body.get("approval_status") if isinstance(body, dict) else None
+        logger.info(f"Key pickup: no api_key yet (approval_status={status!r}) — waiting for an admin to approve.")
+        return None
+    return key

drb-edge-node/app/internal/metadata_watcher.py

@@ -36,6 +36,19 @@ have seen the whole window and ask the rolling console history "what was active
 during this audio, give or take a few seconds" — see _attribute and the
 ATTRIBUTION_* constants.
 
+CONVENTIONAL CHANNELS (node-26#24 P25 conventional, node-26#20 analog). There
+is no control channel, so internal/conventional.py rewrites each console update
+first: a conventional channel that is keyed becomes an ordinary active row whose
+talkgroup is the link-control TGID when it is distinctive, else a stable
+synthetic id derived from the channel frequency. Such a row counts as a talker
+without a radio id (`drb_active`) — link control does not always carry one and
+analog never does. One more rule, applied only at CLOSE: with exactly one
+conventional channel configured, audio the console said nothing about can only
+have come from that channel, so it is attributed to it rather than discarded.
+Not at open: on a channel whose link control carries a real talkgroup, the
+grant may arrive a poll after the audio, and a premature synthetic label would
+force a bogus split when it does.
+
 ORPHAN AUDIO. If nothing in the console history overlaps the window, the audio
 is unattributed: Liquidsoap fallback, a test tone, stray noise, or a dropped
 `call_log`. Policy is DISCARD AND SHOUT — the recording is not uploaded and no
@@ -74,6 +87,7 @@ from typing import Optional, Callable, Awaitable, Any, List, Dict
 
 from app.config import settings
 from app.internal.call_recorder import AudioActivity
+from app.internal.conventional import ConventionalChannels
 from app.internal.op25_client import op25_client
 from app.internal.logger import logger
 
@@ -177,6 +191,22 @@ def _as_float(value: Any) -> Optional[float]:
         return None
 
 
+def _talker(channel: Dict[str, Any]) -> Optional[tuple]:
+    """(tgid, rid) if this channel row says someone is transmitting, else None.
+
+    Trunked rows need both a talkgroup and a source address — an idle channel
+    can keep its last tgid. A normalized conventional row (`drb_active`) only
+    has a tgid while a call is up, and may legitimately have no radio id.
+    """
+    tgid = _as_int(channel.get("tgid"))
+    if tgid is None:
+        return None
+    rid = _as_int(channel.get("srcaddr"))
+    if rid is None and not channel.get("drb_active"):
+        return None
+    return tgid, rid
+
+
 def _iso(epoch: Optional[float]) -> Optional[str]:
     if epoch is None:
         return None
@@ -252,6 +282,10 @@ class MetadataWatcher:
         # Field-visible counter of discarded orphan audio.
         self._unattributed_segments: int = 0
 
+        # Conventional-channel normalizer (node-26#24/#20); also remembers the
+        # channel list and their encryption state for the dashboard + checkin.
+        self._conventional = ConventionalChannels()
+
         # Injectable for tests; production is always the host wall clock.
         self._clock: Callable[[], float] = time.time
 
@@ -300,6 +334,7 @@ class MetadataWatcher:
             return
 
         self._last_ok_poll = now
+        update = self._conventional.normalize(update)
         self._record_console(update, now)
         self._note_terminal(update, now)
 
@@ -341,10 +376,10 @@ class MetadataWatcher:
                 self._console.append(event)
 
         for channel in update.channels:
-            tgid = _as_int(channel.get("tgid"))
-            srcaddr = _as_int(channel.get("srcaddr"))
-            if tgid is None or srcaddr is None:
+            talker = _talker(channel)
+            if talker is None:
                 continue  # idle channel says nothing about who is talking
+            tgid, srcaddr = talker
             self._console.append(ConsoleEvent(
                 epoch=now,
                 tgid=tgid,
@@ -379,7 +414,7 @@ class MetadataWatcher:
                 return True
         return False
 
-    def _attribute(self, start: float, end: float) -> Optional[Attribution]:
+    def _attribute(self, start: float, end: float, allow_sole_channel: bool = False) -> Optional[Attribution]:
         """
         Resolve which talkgroup a stretch of audio belongs to.
 
@@ -387,7 +422,8 @@ class MetadataWatcher:
         how well its console activity overlaps the audio itself, preferring
         real overlap over merely being nearby, and grants over channel rows.
         Returns None only when NOTHING was observed in that band at all — the
-        orphan-audio case.
+        orphan-audio case — unless allow_sole_channel and the node listens to
+        exactly one conventional channel (see module docstring).
         """
         low = start - ATTRIBUTION_LOOKBACK_SECONDS
         high = end + ATTRIBUTION_LOOKAHEAD_SECONDS
@@ -415,7 +451,14 @@ class MetadataWatcher:
                 found.rid = event.rid  # most recent wins
 
         if not candidates:
-            return None
+            sole = self._conventional.sole_channel() if allow_sole_channel else None
+            if sole is None:
+                return None
+            logger.info(
+                f"No console activity near {start:.3f}-{end:.3f}; attributing to the only "
+                f"conventional channel, {sole['name']} (tgid {sole['tgid']})."
+            )
+            return Attribution(tgid=sole["tgid"], name=sole["name"], freq=sole["freq"])
 
         best = max(
             candidates.values(),
@@ -530,6 +573,11 @@ class MetadataWatcher:
             self._refresh_meta_from_log(entry)
             return
 
+        if self._same_channel(tgid, entry.get("freq"), entry.get("tgtag") or ""):
+            self._transmissions += 1
+            self._refresh_meta_from_log(entry)
+            return
+
         # FORCED SPLIT. Two talkgroups can be back to back with no silence
         # between them; pure audio segmentation would merge them into one file
         # under one label, which is exactly the kind of wrong that corrupts
@@ -546,6 +594,21 @@ class MetadataWatcher:
             transmissions=1,
         )
 
+    def _same_channel(self, tgid: int, freq: Any, name: str) -> bool:
+        """A conventional channel seen under its synthetic id and its real
+        talkgroup is one channel, not a split (see ConventionalChannels.
+        same_channel_relabel). Adopts the real talkgroup when offered."""
+        decision = self._conventional.same_channel_relabel(self._current_tgid, self._current_freq, tgid, freq)
+        if decision == "adopt":
+            logger.info(
+                f"Segment {self._active_call_id}: link control names tgid {tgid} for the channel "
+                f"labelled {self._current_tgid} — relabelling, not splitting."
+            )
+            self._current_tgid = tgid
+            if name:
+                self._current_tgid_name = name
+        return decision is not None
+
     async def _scan_channels(self, channels: List[Dict[str, Any]], now: float) -> None:
         """Channel rows in audio mode: refresh metadata, catch an unlogged split."""
         if self._active_call_id is None:
@@ -554,14 +617,15 @@ class MetadataWatcher:
         active: List[Dict[str, Any]] = []
         ours = False
         for channel in channels:
-            tgid = _as_int(channel.get("tgid"))
-            srcaddr = _as_int(channel.get("srcaddr"))
-            if tgid is None or srcaddr is None:
+            talker = _talker(channel)
+            if talker is None:
                 continue
+            tgid, srcaddr = talker
             active.append(channel)
-            if tgid == self._current_tgid:
+            if tgid == self._current_tgid or self._same_channel(tgid, channel.get("freq"), channel.get("tag") or ""):
                 ours = True
-                self._current_srcaddr = srcaddr
+                if srcaddr is not None:
+                    self._current_srcaddr = srcaddr
                 self._last_activity = now
                 self._refresh_meta_from_channel(channel)
 
@@ -658,13 +722,14 @@ class MetadataWatcher:
         foreign_active_tgid: Optional[int] = None
 
         for channel in channels:
-            srcaddr = _as_int(channel.get("srcaddr"))
-            chan_tgid = _as_int(channel.get("tgid"))
-            if srcaddr is None:
+            talker = _talker(channel)
+            if talker is None:
                 continue
+            chan_tgid, srcaddr = talker
             if chan_tgid == self._current_tgid:
                 tx_active = True
-                self._current_srcaddr = srcaddr
+                if srcaddr is not None:
+                    self._current_srcaddr = srcaddr
                 self._refresh_meta_from_channel(channel)
             elif chan_tgid is not None:
                 foreign_active_tgid = chan_tgid
@@ -868,7 +933,7 @@ class MetadataWatcher:
         two talkgroups' console activity overlaps one recording, i.e. the split
         logic should have fired and did not.
         """
-        found = self._attribute(start, end)
+        found = self._attribute(start, end, allow_sole_channel=self._current_tgid is None)
         if found is None:
             return
 
@@ -931,6 +996,12 @@ class MetadataWatcher:
             },
         }
 
+    @property
+    def conventional_channels(self) -> List[Dict[str, Any]]:
+        """Per conventional channel: name, freq, NAC heard, encryption. Empty on
+        a trunked system. Read by /api/health and the checkin."""
+        return self._conventional.encryption_report()
+
     @property
     def unattributed_segments(self) -> int:
         """Orphan-audio segments discarded since start. Surfaced on /api/status."""

drb-edge-node/app/internal/mqtt_manager.py

@@ -1,16 +1,53 @@
 import asyncio
 import json
+import shutil
+import time
 from datetime import datetime, timezone
 from collections import deque
 from typing import Optional, Callable, Awaitable, Dict, Any
 import paho.mqtt.client as mqtt
 from app.config import settings
 from app.internal.logger import logger
-from app.internal import credentials
+from app.internal import credentials, key_pickup
+
+
+def disk_report(path: str) -> Dict[str, Optional[int]]:
+    """Free/total bytes of the filesystem holding `path` (node-26#41).
+
+    /recordings is a bind mount of the host checkout, so this is the host disk
+    the recorder writes to and Docker's images/build cache live on. A full disk
+    stopped node-002 recording for 17 days while it still showed Online. Nulls
+    on error, so C2 overwrites a stale reading instead of keeping it.
+    """
+    try:
+        usage = shutil.disk_usage(path)
+    except OSError:
+        return {"disk_free_bytes": None, "disk_total_bytes": None}
+    return {"disk_free_bytes": usage.free, "disk_total_bytes": usage.total}
+
 
 CommandCallback = Callable[[Dict[str, Any]], Awaitable[None]]
 ConfigCallback = Callable[[Dict[str, Any]], Awaitable[None]]
 ApiKeyCallback = Callable[[Dict[str, Any]], Awaitable[None]]
+DesiredCallback = Callable[[Dict[str, Any]], Awaitable[None]]
+
+# CONNACK codes meaning "your credentials are wrong", as paho reports them:
+# MQTT 3.1.1 return codes 4/5, and the MQTT 5 reason codes paho maps them to
+# (134 Bad user name or password, 135 Not authorized).
+_AUTH_FAILURE_CODES = {4, 5, 134, 135}
+
+# Credential-recovery backoff (node-26#14). The pickup endpoint is cheap, but a
+# node that is simply not approved yet must not hammer C2 for days.
+RECOVERY_MIN_DELAY = 30
+RECOVERY_MAX_DELAY = 900
+
+
+def _is_auth_failure(reason_code) -> bool:
+    value = getattr(reason_code, "value", reason_code)
+    if isinstance(value, int) and value in _AUTH_FAILURE_CODES:
+        return True
+    text = str(reason_code).lower()
+    return "not authori" in text or "bad user name or password" in text
 
 
 class MQTTManager:
@@ -19,10 +56,22 @@ class MQTTManager:
         self._loop: Optional[asyncio.AbstractEventLoop] = None
         self._connected = False
         self._connect_task: Optional[asyncio.Task] = None
+        # The api_key the CURRENT paho client was built with — not necessarily
+        # credentials.get_api_key(), which can move ahead of it (MQTT key push,
+        # install.sh writing the file). Recovery compares against this.
+        self._client_key: Optional[str] = None
+        self._recovery_task: Optional[asyncio.Task] = None
+        # Why the link is down, for the dashboard (node-26#21): "refused" (the
+        # broker answered and said no), "unreachable" (TCP/TLS never got that
+        # far) or "disconnected" (an established session dropped). Cleared on
+        # every successful connect. Set from paho's thread as well as the event
+        # loop — a single attribute rebind, so no lock.
+        self._last_error: Optional[Dict[str, Any]] = None
 
         self.on_command: Optional[CommandCallback] = None
         self.on_config_push: Optional[ConfigCallback] = None
         self.on_api_key: Optional[ApiKeyCallback] = None
+        self.on_discord_desired: Optional[DesiredCallback] = None
 
         self._offline_buffer = deque(maxlen=settings.offline_call_buffer_size)
 
@@ -32,6 +81,10 @@ class MQTTManager:
         self._t_metadata = f"nodes/{nid}/metadata"
         self._t_commands = f"nodes/{nid}/commands"
         self._t_config = f"nodes/{nid}/config"
+        # Discord radio desired state (retained by C2) and our actual state —
+        # node-26#25. Token IDs only; the strings come over HTTPS.
+        self._t_discord_desired = f"nodes/{nid}/discord/desired"
+        self._t_discord_actual = f"nodes/{nid}/discord/actual"
         # TODO(mqtt-cutover): dead once enrollment lands client-side. This
         # was the pre-dynsec key-delivery path (server retain-publishes the
         # api_key here after admin approval; node asks for redelivery via
@@ -53,6 +106,7 @@ class MQTTManager:
         )
 
         api_key = credentials.get_api_key()
+        self._client_key = api_key
         if api_key:
             # Post-cutover auth: broker's dynsec plugin authenticates this
             # exact (username, password) pair as this node's own client — see
@@ -70,18 +124,14 @@ class MQTTManager:
             client.username_pw_set(settings.mqtt_user, settings.mqtt_pass)
         else:
             # No api_key on disk and no legacy shared login configured. A
-            # dynsec broker (allow_anonymous false) refuses this outright —
-            # expected, not a bug to route around here: this node hasn't been
-            # enrolled/approved yet, and the enrollment flow that would fix
-            # that client-side is a later, separate pass (out of scope here;
-            # see MQTT-PUBLIC-AUTH-PLAN.md). paho's reconnect_delay_set()
-            # below bounds the retry rate (2..60s exponential backoff), so
-            # this degrades to a slow, clearly-logged refusal loop via
-            # _on_connect's "MQTT connect refused" line — not a hot spin.
+            # dynsec broker (allow_anonymous false) refuses this outright.
+            # connect() starts _recover_credentials() in this case, which
+            # fetches the key over HTTPS (key_pickup.py) and rebuilds this
+            # client with it — node-26#14. paho's reconnect_delay_set() below
+            # bounds the refusal loop meanwhile (2..60s backoff).
             logger.warning(
                 "No API key on disk and no legacy MQTT_USER configured — "
-                "connecting without credentials; the broker is expected to "
-                "refuse this until the node is enrolled/approved."
+                "connecting without credentials while the key is fetched from C2."
             )
 
         if settings.mqtt_tls:
@@ -103,14 +153,24 @@ class MQTTManager:
         client.reconnect_delay_set(min_delay=2, max_delay=60)
         client.on_connect = self._on_connect
         client.on_disconnect = self._on_disconnect
+        client.on_connect_fail = self._on_connect_fail
         client.on_message = self._on_message
         return client
 
+    def _set_error(self, kind: str, detail: str) -> None:
+        self._last_error = {"kind": kind, "detail": detail, "epoch": time.time()}
+
+    def _on_connect_fail(self, client, userdata):
+        # paho's own reconnect (after loop_start) could not open the socket.
+        self._set_error("unreachable", f"cannot reach {settings.mqtt_broker}:{settings.mqtt_port}")
+
     def _on_connect(self, client, userdata, flags, reason_code, properties):
         if reason_code == 0:
             self._connected = True
+            self._last_error = None
             client.subscribe(self._t_commands, qos=1)
             client.subscribe(self._t_config, qos=1)
+            client.subscribe(self._t_discord_desired, qos=1)
             client.subscribe(self._t_api_key, qos=2)  # TODO(mqtt-cutover): see _t_api_key comment above
             client.subscribe(self._t_discovery, qos=0)
             logger.info("MQTT connected.")
@@ -120,10 +180,18 @@ class MQTTManager:
             asyncio.run_coroutine_threadsafe(self._flush_offline_buffer(), self._loop)
         else:
             logger.error(f"MQTT connect refused: {reason_code}")
+            self._set_error("refused", str(reason_code))
+            if _is_auth_failure(reason_code) and self._loop is not None:
+                # paho thread -> event loop. A refused login never fixes itself
+                # by retrying the same password, so go get the right one.
+                self._loop.call_soon_threadsafe(self._start_recovery, f"broker refused login ({reason_code})")
 
     def _on_disconnect(self, client, userdata, disconnect_flags, reason_code, properties):
         self._connected = False
         logger.warning(f"MQTT disconnected: {reason_code}")
+        # A refusal is followed by a disconnect; keep the more specific reason.
+        if self._last_error is None:
+            self._set_error("disconnected", str(reason_code))
 
     def _on_message(self, client, userdata, msg):
         try:
@@ -135,6 +203,8 @@ class MQTTManager:
             asyncio.run_coroutine_threadsafe(self.on_command(payload), self._loop)
         elif msg.topic == self._t_config and self.on_config_push:
             asyncio.run_coroutine_threadsafe(self.on_config_push(payload), self._loop)
+        elif msg.topic == self._t_discord_desired and self.on_discord_desired:
+            asyncio.run_coroutine_threadsafe(self.on_discord_desired(payload), self._loop)
         elif msg.topic == self._t_api_key and self.on_api_key:
             asyncio.run_coroutine_threadsafe(self.on_api_key(payload), self._loop)
         elif msg.topic == self._t_discovery:
@@ -144,6 +214,72 @@ class MQTTManager:
         self._loop = asyncio.get_event_loop()
         self._client = self._build_client()
         self._connect_task = asyncio.create_task(self._connect_with_retry())
+        if not self._client_key and not settings.mqtt_user:
+            self._start_recovery("no API key at startup")
+
+    # ------------------------------------------------------------------
+    # Credential self-heal (node-26#14)
+    #
+    # A node with no key, or a stale one, used to sit in an MQTT refusal loop
+    # forever: key delivery was MQTT-only, and credentials were read once at
+    # startup. Now: re-read credentials.json (install.sh may have written it),
+    # else fetch from C2 over HTTPS with the pickup secret; if that yields a
+    # key different from the one the client is using, rebuild the client with
+    # it in place. No container restart.
+    # ------------------------------------------------------------------
+    def _start_recovery(self, why: str) -> None:
+        if self._recovery_task and not self._recovery_task.done():
+            return
+        logger.warning(f"MQTT credential recovery started: {why}")
+        self._recovery_task = asyncio.create_task(self._recover_credentials())
+
+    async def _recover_credentials(self) -> None:
+        delay = RECOVERY_MIN_DELAY
+        while True:
+            tried = self._client_key
+            key = credentials.reload_api_key()
+            if not key or key == tried:
+                fetched = await key_pickup.fetch_api_key()
+                if fetched and fetched != tried:
+                    credentials.save_api_key(fetched)
+                    key = fetched
+            if key and key != tried:
+                logger.info("MQTT credential recovery: new API key in hand — reconnecting with it.")
+                await self._rebuild_client()
+                return
+            if self._connected:
+                return
+            if key and key == tried:
+                logger.error(
+                    "MQTT credential recovery: C2 returns the same key the broker refuses. The broker's login for "
+                    "this node is out of sync with C2 (dynsec) — an admin re-approve re-syncs it without rotating."
+                )
+            logger.info(f"MQTT credential recovery: retrying in {delay}s.")
+            await asyncio.sleep(delay)
+            delay = min(delay * 2, RECOVERY_MAX_DELAY)
+
+    async def _rebuild_client(self) -> None:
+        """Swap the paho client for one built from the current credentials."""
+        old = self._client
+        if self._connect_task and not self._connect_task.done():
+            self._connect_task.cancel()
+        if old is not None:
+            # loop_stop() joins paho's thread, which can be mid-backoff — off the event loop.
+            await asyncio.to_thread(old.loop_stop)
+            try:
+                old.disconnect()
+            except Exception:
+                pass
+        self._connected = False
+        self._client = self._build_client()
+        self._connect_task = asyncio.create_task(self._connect_with_retry())
+
+    def update_api_key(self, key: str) -> None:
+        """A key arrived while connected (legacy MQTT push / reissue): use it on
+        the next reconnect without dropping the current, working session."""
+        if self._client is not None and key != self._client_key:
+            self._client.username_pw_set(settings.node_id, key)
+            self._client_key = key
 
     async def _connect_with_retry(self):
         """Attempt the initial TCP connect, retrying with backoff until it succeeds."""
@@ -157,10 +293,13 @@ class MQTTManager:
                 return
             except Exception as e:
                 logger.warning(f"MQTT connect failed ({e}) — retrying in {delay}s")
+                self._set_error("unreachable", f"cannot reach {settings.mqtt_broker}:{settings.mqtt_port}: {e}")
                 await asyncio.sleep(delay)
                 delay = min(delay * 2, 60)
 
     async def disconnect(self):
+        if self._recovery_task:
+            self._recovery_task.cancel()
         if self._connect_task:
             self._connect_task.cancel()
         if self._client:
@@ -193,6 +332,12 @@ class MQTTManager:
         else:
             self._publish(self._t_metadata, payload, qos=1)
 
+    def publish_discord_actual(self, payload: dict) -> None:
+        """What the Discord radio manager is actually doing. Not buffered while
+        offline: a fresh report is sent after every change and periodically,
+        and only the newest one means anything."""
+        self._publish(self._t_discord_actual, payload, qos=1)
+
     async def _flush_offline_buffer(self):
         if not self._offline_buffer:
             return
@@ -235,6 +380,11 @@ class MQTTManager:
             "secondary_sdr_priority": config.secondary_sdr_priority,
         }
         payload["sdr_pins"] = config.sdr_pins
+        # Conventional channels (node-26#24): name/freq/NAC and whether the
+        # agency encrypts them — the one decode failure nobody can fix on the
+        # node, so C2 has to be told. Empty list on a trunked system.
+        from app.internal.metadata_watcher import metadata_watcher
+        payload["radio_channels"] = metadata_watcher.conventional_channels
         secondary = await secondary_sdr_client.status()
         # Unreachable secondary-sdr: say so with explicit nulls. C2 only
         # overwrites keys present in the checkin, so omitting them would leave
@@ -260,6 +410,23 @@ class MQTTManager:
             count = devices.get("count") or None
         if count is not None:
             payload["sdr_count"] = count
+        payload.update(disk_report(settings.recordings_path))
+        # Upload spool depth + last upload outcome (node-26#44, toward #40).
+        from app.internal.call_recorder import call_recorder
+        spool = call_recorder.spool.stats()
+        payload["upload_spool_files"] = spool["files"]
+        payload["upload_spool_bytes"] = spool["bytes"]
+        last = spool["last_result"] or {}
+        payload["last_upload_status"] = last.get("status")
+        payload["last_upload_kind"] = last.get("kind")
+        # node-26#45: which recorder this node runs; C2 ignores unknown keys.
+        payload["recorder_backend"] = settings.recorder_backend
+        from app.internal import trunk_recorder as tr
+        if tr.enabled():
+            facts = tr.trunk_recorder.health_facts()
+            payload["tr_state"] = (facts["status"] or {}).get("state")
+            payload["tr_decode_rate"] = facts["decode_rate"]
+            payload["tr_inbox_backlog"] = facts["inbox_backlog"]
         self._publish(self._t_checkin, payload, qos=1)
 
     def _publish(self, topic: str, payload: dict, qos: int = 0, retain: bool = False):
@@ -278,5 +445,10 @@ class MQTTManager:
     def is_connected(self) -> bool:
         return self._connected
 
+    @property
+    def last_error(self) -> Optional[Dict[str, Any]]:
+        """{kind, detail, epoch} for the most recent failure, None while connected."""
+        return None if self._connected else self._last_error
+
 
 mqtt_manager = MQTTManager()

drb-edge-node/app/internal/radio_backend.py

@@ -0,0 +1,55 @@
+"""
+Start/stop "the radio" without every caller knowing which recorder backend is
+active (node-26#45). Every path that used to call op25_client.start/stop — C2
+config pushes, the op25_restart command, the dashboard, SDR re-pinning — goes
+through here.
+
+With RECORDER_BACKEND=trunk-recorder, OP25 is never started: both open the
+same RTL-SDR, and OP25 holding it would starve Trunk Recorder. start() becomes
+a restart request to trunk-recorder/run.sh instead.
+"""
+import time
+from typing import Optional
+
+from app.internal import trunk_recorder as tr
+from app.internal.logger import logger
+from app.internal.op25_client import op25_client
+
+
+def name() -> str:
+    return "Trunk Recorder" if tr.enabled() else "OP25"
+
+
+async def start(wait: bool = True) -> bool:
+    return await start_with_reason(wait) is None
+
+
+async def start_with_reason(wait: bool = True) -> Optional[str]:
+    """None on success, else a human-readable reason.
+
+    For Trunk Recorder, `wait` blocks until run.sh reports TR restarted (up
+    to trunk_recorder.RESTART_WAIT_SECONDS), like op25_client.start returns
+    only once OP25 has started — callers hand the spare dongles out next.
+    """
+    if not tr.enabled():
+        return await op25_client.start_with_reason()
+    if tr.trunk_recorder.config_error:
+        return tr.trunk_recorder.config_error
+    requested = time.time()
+    if not tr.trunk_recorder.request_restart():
+        return f"Couldn't write to {tr.config_dir()} to restart Trunk Recorder."
+    if not wait:
+        return None
+    err = await tr.trunk_recorder.wait_started_since(requested)
+    if err:
+        logger.error(err)
+    return err
+
+
+async def stop() -> bool:
+    if not tr.enabled():
+        return await op25_client.stop()
+    ok = tr.trunk_recorder.request_stop()
+    if ok:
+        logger.info("Trunk Recorder stop requested.")
+    return ok

drb-edge-node/app/internal/radio_config.py

@@ -0,0 +1,169 @@
+"""
+What kind of radio system a SystemConfig describes, and the op25-container
+generate-config payload for it.
+
+C2 system documents (the `config` blob is passed through untouched):
+
+    P25 trunked       type "P25", config.mode absent or "trunked",
+                      config.control_channels = [MHz, ...]
+    P25 conventional  type "P25", config.mode "conventional",
+                      config.channels = [{freq: MHz, name, nac?}, ...]   (node-26#24)
+    Analog            type "NBFM", config.channels = [{freq, name}] — or, from
+                      before #24, config.control_channels[0]. Optional squelch
+                      (node-26#46): config.squelch_mode "noise" (default) |
+                      "voice" | "power", config.squelch_db (noise/voice: dB
+                      of quieting to open) and config.squelch_threshold
+                      (power: absolute dB, OP25 default -60)
+
+A missing mode is trunked, so every system saved before #24 behaves exactly as
+it did. Pure functions; main._generate_op25_config does the I/O.
+"""
+from typing import Any, Dict, List, Optional
+
+TRUNKED, CONVENTIONAL, ANALOG, DMR = "trunked", "conventional", "analog", "dmr"
+
+# Mirrors op25-container's MAX_CONVENTIONAL_CHANNELS: one audio.py carries two.
+MAX_CONVENTIONAL_CHANNELS = 2
+
+
+def to_hz(freq: Any) -> int:
+    """MHz floats (< 1e6) or Hz ints -> Hz."""
+    f = float(freq)
+    return int(round(f * 1_000_000)) if f < 1_000_000 else int(f)
+
+
+def parse_nac(value: Any) -> Optional[int]:
+    """NAC as typed by an admin ("293", "0x293") or stored as an int. Hex, like
+    RadioReference prints it. None when blank; ValueError when nonsense."""
+    if value is None or (isinstance(value, str) and not value.strip()):
+        return None
+    if isinstance(value, bool):
+        raise ValueError(f"NAC {value!r} isn't a number.")
+    if isinstance(value, int):
+        nac = value
+    else:
+        text = str(value).strip().lower()
+        text = text[2:] if text.startswith("0x") else text
+        try:
+            nac = int(text, 16)
+        except ValueError:
+            raise ValueError(f"NAC {value!r} isn't hex (e.g. 293 or 0x293).")
+    if not 0 < nac <= 0xFFF:
+        raise ValueError(f"NAC {value!r} is outside 001-FFF.")
+    return nac
+
+
+def system_mode(system_type: str, config: Dict[str, Any]) -> str:
+    t = str(system_type or "").upper()
+    if t in ("NBFM", "ANALOG"):
+        return ANALOG
+    if t == "DMR":
+        return DMR
+    mode = str((config or {}).get("mode") or TRUNKED).lower()
+    return CONVENTIONAL if mode == CONVENTIONAL else TRUNKED
+
+
+def system_kind(system_type: str, config: Dict[str, Any]) -> str:
+    """Label for dashboards: "P25 trunked", "P25 conventional", "Analog FM", "DMR"."""
+    return {
+        TRUNKED: "P25 trunked", CONVENTIONAL: "P25 conventional", ANALOG: "Analog FM", DMR: "DMR",
+    }[system_mode(system_type, config)]
+
+
+def conventional_channels(config: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """config.channels -> [{frequency: Hz, name, nac}] (ValueError if malformed)."""
+    out = []
+    for raw in (config or {}).get("channels") or []:
+        if not isinstance(raw, dict) or raw.get("freq") in (None, ""):
+            raise ValueError("Every conventional channel needs a frequency.")
+        out.append({
+            "frequency": to_hz(raw["freq"]),
+            "name": str(raw.get("name") or "").strip(),
+            "nac": parse_nac(raw.get("nac")),
+        })
+    return out
+
+
+SQUELCH_MODES = ("noise", "voice", "power")
+DEFAULT_SQUELCH_MODE = "noise"
+
+
+def _optional_float(config: Dict[str, Any], key: str) -> Optional[float]:
+    value = (config or {}).get(key)
+    if value is None or (isinstance(value, str) and not value.strip()):
+        return None
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        raise ValueError(f"{key} {value!r} isn't a number.")
+
+
+def analog_squelch(config: Dict[str, Any]) -> Dict[str, Any]:
+    """config -> the op25-container squelch fields for an analog channel.
+
+    Noise squelch by default (node-26#46): OP25's power squelch compares an
+    absolute level that depends on dongle, gain and antenna, and left analog
+    open on static; noise squelch measures FM quieting and needs no
+    calibration. A config that says nothing gets noise mode.
+    """
+    mode = str((config or {}).get("squelch_mode") or DEFAULT_SQUELCH_MODE).strip().lower()
+    if mode not in SQUELCH_MODES:
+        raise ValueError(f"Squelch mode {mode!r} isn't one of {', '.join(SQUELCH_MODES)}.")
+    out: Dict[str, Any] = {"nbfm_squelch_mode": mode}
+    db = _optional_float(config, "squelch_db")
+    if db is not None:
+        out["nbfm_noise_squelch_db"] = db
+    threshold = _optional_float(config, "squelch_threshold")
+    if threshold is not None:
+        out["nbfm_squelch"] = threshold
+    return out
+
+
+def analog_frequency(config: Dict[str, Any]) -> Optional[int]:
+    chans = (config or {}).get("channels") or []
+    if chans and isinstance(chans[0], dict) and chans[0].get("freq") not in (None, ""):
+        return to_hz(chans[0]["freq"])
+    legacy = (config or {}).get("control_channels") or []
+    return to_hz(legacy[0]) if legacy else None
+
+
+def build_generate_payload(
+    system_type: str,
+    name: str,
+    config: Dict[str, Any],
+    icecast: Dict[str, Any],
+    hardware_preset: str,
+    ppm_override: Optional[float],
+) -> Dict[str, Any]:
+    """SystemConfig fields -> op25-container /generate-config body."""
+    mode = system_mode(system_type, config)
+    payload: Dict[str, Any] = {
+        "type": system_type,
+        "systemName": name,
+        "icecastConfig": icecast,
+        "hardware_preset": hardware_preset,
+    }
+    if ppm_override is not None:
+        payload["ppm_override"] = ppm_override
+
+    if mode == CONVENTIONAL:
+        payload["type"] = "P25"
+        payload["p25_mode"] = CONVENTIONAL
+        payload["channels"] = []
+        payload["conv_channels"] = conventional_channels(config)
+        return payload
+
+    if mode == ANALOG:
+        freq = analog_frequency(config)
+        payload["channels"] = [freq] if freq else []
+        payload.update(analog_squelch(config))
+        return payload
+
+    talkgroups = (config or {}).get("talkgroups", []) or []
+    payload["channels"] = [to_hz(ch) for ch in (config or {}).get("control_channels", []) or []]
+    payload["tags"] = [
+        {"talkgroup": str(tg.get("name", "")), "tagDec": int(tg["id"])}
+        for tg in talkgroups if tg.get("id") is not None
+    ]
+    payload["whitelist"] = [int(tg["id"]) for tg in talkgroups if tg.get("id") is not None]
+    return payload

drb-edge-node/app/internal/sdr_settings.py

@@ -83,7 +83,18 @@ async def set_sdr_settings(priority: Optional[Iterable[str]] = None,
         cfg.sdr_pins = normalize_sdr_pins(pins)
     save_node_config(cfg)
 
-    if cfg.sdr_pins.get("op25") != old_op25:
+    if cfg.sdr_pins.get("op25") != old_op25 and settings.recorder_backend == "trunk-recorder":
+        # Trunk Recorder takes the "op25" dongle (node-26#45): rewrite its
+        # config with the new serial; run.sh restarts it on the change.
+        from app.internal.health import active_config
+        from app.main import _generate_op25_config
+        await secondary_sdr_client.apply([], {}, [])
+        current = active_config(cfg)
+        if current is not None and await _generate_op25_config(current):
+            from app.internal import radio_backend
+            await radio_backend.start()  # waits until TR holds the new dongle
+        logger.info(f"Trunk Recorder moved to SDR {cfg.sdr_pins.get('op25') or 'rtl=0 (first dongle)'}")
+    elif cfg.sdr_pins.get("op25") != old_op25:
         from app.internal.op25_client import op25_client
         # Free the new dongle first if a decoder holds it, then move OP25.
         await secondary_sdr_client.apply([], {}, [])

drb-edge-node/app/internal/tr_calls.py

@@ -0,0 +1,210 @@
+"""
+Trunk Recorder call JSON -> what DRB sends for one call (node-26#45).
+
+TR writes one JSON per call next to its WAV and passes both to uploadScript.
+The shape is `create_call_json` in trunk-recorder/call_concluder/
+call_concluder.cc at v5.2.1 (keys, in order: freq, freq_error, signal, noise,
+source_num, recorder_num, tdma_slot, phase2_tdma, start_time, stop_time,
+start_time_ms, stop_time_ms, emergency, priority, mode, duplex, encrypted,
+call_length, call_length_ms, talkgroup, talkgroup_tag, talkgroup_description,
+talkgroup_group_tag, talkgroup_group, color_code, audio_type, short_name,
+patched_talkgroups?, freqList[], srcList[]). Older TR releases omit the *_ms
+keys, so both are read.
+
+Pure: trunk_recorder.py does the I/O.
+"""
+import json
+import uuid
+from dataclasses import dataclass, field
+from datetime import datetime, timezone
+from typing import Any, Dict, List, Optional
+
+DRIVER = "trunk-recorder"
+# Fixed namespace so a call's id is a pure function of its JSON: re-reading the
+# same file after a crash yields the same call_id, so C2 overwrites rather than
+# duplicates (trunk_recorder.py relies on this to be restart-safe).
+CALL_ID_NAMESPACE = uuid.UUID("5d0c7f4e-2b8f-4e0e-9a59-45c0de7c0045")
+
+
+def _iso(epoch: float) -> str:
+    return datetime.fromtimestamp(epoch, timezone.utc).isoformat()
+
+
+def _int(value: Any) -> Optional[int]:
+    try:
+        return int(value)
+    except (TypeError, ValueError):
+        return None
+
+
+def _epoch(data: Dict[str, Any], key: str) -> Optional[float]:
+    ms = data.get(f"{key}_ms")
+    if isinstance(ms, (int, float)) and ms > 0:
+        return ms / 1000.0
+    s = data.get(key)
+    if isinstance(s, (int, float)) and s > 0:
+        return float(s)
+    return None
+
+
+@dataclass
+class TrCall:
+    call_id: str
+    tgid: int
+    tgid_name: str
+    freq: Optional[int]
+    start_epoch: float
+    stop_epoch: float
+    units: List[int] = field(default_factory=list)
+    emergency: bool = False
+    encrypted: bool = False
+    src_list: List[Dict[str, Any]] = field(default_factory=list)
+    freq_list: List[Dict[str, Any]] = field(default_factory=list)
+    call_length: Optional[float] = None
+    signal: Optional[int] = None
+    noise: Optional[int] = None
+    freq_error: Optional[int] = None
+    decode_errors: Optional[int] = None
+    spikes: Optional[int] = None
+    patched_talkgroups: List[int] = field(default_factory=list)
+    short_name: str = ""
+
+    @property
+    def srcaddr(self) -> Optional[int]:
+        return self.units[0] if self.units else None
+
+    def start_payload(self) -> Dict[str, Any]:
+        """MQTT call_start — the keys main.on_call_start publishes, which C2's
+        _on_call_start reads (tgid, tgid_name, freq, srcaddr, started_at)."""
+        return {
+            "call_id": self.call_id,
+            "tgid": self.tgid,
+            "tgid_name": self.tgid_name,
+            "freq": self.freq,
+            "srcaddr": self.srcaddr,
+            "started_at": _iso(self.start_epoch),
+            "started_at_epoch": self.start_epoch,
+            "attributed": True,
+            "driver": DRIVER,
+        }
+
+    def audio_end_epoch(self, wav_seconds: Optional[float] = None) -> float:
+        """Wall clock at the END of the audio file.
+
+        NOT stop_time: TR joins a call's transmissions back to back and drops
+        the gaps between them, so the WAV is shorter than stop - start by the
+        sum of the gaps. start + WAV length is what the file's last sample
+        maps to only if there were no gaps; the exact per-transmission map is
+        srcList/freqList (time = wall clock, pos = offset in the file), sent
+        as src_list / freq_list.
+        """
+        if wav_seconds is None:
+            return self.stop_epoch
+        return self.start_epoch + wav_seconds
+
+    def end_payload(self, wav_seconds: Optional[float] = None) -> Dict[str, Any]:
+        """MQTT call_end. TR cut the call on decoder boundaries with no
+        trimming, so the audio starts at the call start; see audio_end_epoch
+        for why it does not end at the call end."""
+        audio_end = self.audio_end_epoch(wav_seconds)
+        out = self.start_payload()
+        out.update({
+            "ended_at": _iso(self.stop_epoch),
+            "ended_at_epoch": self.stop_epoch,
+            "audio_start_at": _iso(self.start_epoch),
+            "audio_end_at": _iso(audio_end),
+            "audio_start_epoch": self.start_epoch,
+            "audio_end_epoch": audio_end,
+            "units": self.units,
+            "emergency": self.emergency,
+            "encrypted": self.encrypted,
+        })
+        return out
+
+    def upload_extra(self) -> Dict[str, str]:
+        """Extra /upload form fields. C2 declares none of these yet, so FastAPI
+        ignores them (same as audio_start_epoch today); they are here for when
+        it does."""
+        extra = {
+            "recorder_backend": DRIVER,
+            "units": ",".join(str(u) for u in self.units),
+            "src_list": json.dumps(self.src_list, separators=(",", ":")),
+            "freq_list": json.dumps(self.freq_list, separators=(",", ":")),
+            "emergency": "1" if self.emergency else "0",
+            "encrypted": "1" if self.encrypted else "0",
+            "started_at_epoch": f"{self.start_epoch:.3f}",
+            "ended_at_epoch": f"{self.stop_epoch:.3f}",
+        }
+        optional = {
+            "freq": self.freq, "call_length": self.call_length, "signal": self.signal, "noise": self.noise,
+            "freq_error": self.freq_error, "decode_errors": self.decode_errors, "spikes": self.spikes,
+        }
+        extra.update({k: str(v) for k, v in optional.items() if v is not None})
+        if self.patched_talkgroups:
+            extra["patched_talkgroups"] = ",".join(str(t) for t in self.patched_talkgroups)
+        return extra
+
+
+def parse_call(data: Dict[str, Any], node_id: str, file_stem: str = "") -> TrCall:
+    """One TR call JSON -> TrCall. ValueError if it has no talkgroup or start."""
+    tgid = _int(data.get("talkgroup"))
+    if not tgid or tgid <= 0:
+        raise ValueError(f"call JSON has no talkgroup ({data.get('talkgroup')!r})")
+    start = _epoch(data, "start_time")
+    if start is None:
+        raise ValueError("call JSON has no start_time")
+    stop = _epoch(data, "stop_time")
+    length = data.get("call_length_ms")
+    length_s = (length / 1000.0) if isinstance(length, (int, float)) and length > 0 else None
+    if length_s is None and isinstance(data.get("call_length"), (int, float)):
+        length_s = float(data["call_length"])
+    if stop is None or stop < start:
+        stop = start + (length_s or 0.0)
+
+    src_list: List[Dict[str, Any]] = []
+    units: List[int] = []
+    unit_emergency = False
+    for s in data.get("srcList") or []:
+        if not isinstance(s, dict):
+            continue
+        src = _int(s.get("src"))
+        entry = {"src": src, "time": s.get("time"), "pos": s.get("pos"),
+                 "emergency": bool(_int(s.get("emergency")))}
+        if s.get("tag"):
+            entry["tag"] = s.get("tag")
+        src_list.append(entry)
+        unit_emergency = unit_emergency or entry["emergency"]
+        # TR reports 0 / -1 when the unit id wasn't decoded.
+        if src and src > 0 and src not in units:
+            units.append(src)
+
+    freq_list = [f for f in data.get("freqList") or [] if isinstance(f, dict)]
+    errors = sum(_int(f.get("error_count")) or 0 for f in freq_list) if freq_list else None
+    spikes = sum(_int(f.get("spike_count")) or 0 for f in freq_list) if freq_list else None
+
+    freq = _int(data.get("freq"))
+    short_name = str(data.get("short_name") or "")
+    key = f"{node_id}|{short_name}|{tgid}|{start:.3f}|{freq}|{file_stem}"
+    return TrCall(
+        call_id=str(uuid.uuid5(CALL_ID_NAMESPACE, key)),
+        tgid=tgid,
+        tgid_name=str(data.get("talkgroup_tag") or data.get("talkgroup_description") or ""),
+        freq=freq,
+        start_epoch=start,
+        stop_epoch=stop,
+        units=units,
+        emergency=bool(_int(data.get("emergency"))) or unit_emergency,
+        encrypted=bool(_int(data.get("encrypted"))),
+        src_list=src_list,
+        freq_list=[{"freq": _int(f.get("freq")), "time": f.get("time"), "pos": f.get("pos"), "len": f.get("len"),
+                    "error_count": _int(f.get("error_count")), "spike_count": _int(f.get("spike_count"))}
+                   for f in freq_list],
+        call_length=round(length_s, 3) if length_s is not None else None,
+        signal=_int(data.get("signal")),
+        noise=_int(data.get("noise")),
+        freq_error=_int(data.get("freq_error")),
+        decode_errors=errors,
+        spikes=spikes,
+        patched_talkgroups=[t for t in (_int(x) for x in data.get("patched_talkgroups") or []) if t],
+        short_name=short_name,
+    )

drb-edge-node/app/internal/tr_config.py

@@ -0,0 +1,291 @@
+"""
+Trunk Recorder config.json (+ CSVs) from the C2 system config (node-26#45).
+
+Same input as radio_config.build_generate_payload — the SystemConfig C2 pushes —
+so a node can switch backends without anyone re-entering its system:
+
+    P25 trunked       -> system type "p25", control_channels, talkgroupsFile
+    P25 conventional  -> "conventionalP25", channelFile
+    Analog            -> "conventional",    channelFile, squelch
+
+Schema per Trunk Recorder v5.2.1 docs/CONFIGURE.md. Pure functions: the I/O is
+in trunk_recorder.py. Unverified against a radio — see the notes inline.
+
+Conventional channels are numbered with conventional.channel_tgid (frequency in
+100 Hz units), the same synthetic talkgroup the OP25 path reports, so C2 names
+a TR call and an OP25 call on the same channel identically.
+"""
+import csv
+import io
+from typing import Any, Dict, List, Optional, Tuple
+
+from app.internal.logger import logger
+from app.internal.conventional import channel_tgid
+from app.internal.radio_config import (
+    ANALOG, CONVENTIONAL, DMR, TRUNKED, analog_frequency, conventional_channels, system_mode, to_hz,
+)
+
+# Paths INSIDE the trunk-recorder container (see docker-compose.yml).
+TR_APP_DIR = "/app"                         # tr_config_dir is mounted here
+TR_UPLOAD_SCRIPT = "/drb/drb-upload.sh"     # ./trunk-recorder, read-only
+TR_CAPTURE_DIR = "/recordings/tr-capture"   # ./recordings
+TR_TEMP_DIR = "/dev/shm"                    # TR's recommended tmpfs (shm_size in compose)
+TALKGROUPS_FILE = "talkgroups.csv"
+CHANNELS_FILE = "channels.csv"
+SHORT_NAME = "drb"
+
+# TR splits a call longer than this; mirrors call_recorder.MAX_RECORDING_SECONDS.
+MAX_DURATION_SECONDS = 600
+# Seconds of control-channel silence before TR closes a call (TR's default).
+CALL_TIMEOUT_SECONDS = 3
+
+# Of an RTL-SDR's sample rate, the share that is usable passband (anti-alias
+# roll-off eats the edges). Channels must sit inside +-(rate * share / 2).
+USABLE_BANDWIDTH_SHARE = 0.8
+# The RTL-SDR's DC spike sits on the centre frequency; keep channels off it.
+DC_SPIKE_GUARD_HZ = 25_000
+CENTER_NUDGES_HZ = (0, 150_000, -150_000, 300_000, -300_000)
+
+
+def _fits(center: int, freqs: List[int], half_band: float) -> bool:
+    return all(abs(f - center) <= half_band for f in freqs)
+
+
+def widest_cover(freqs: List[int], rate: int) -> List[int]:
+    """The largest run of frequencies one SDR at `rate` can hold at once
+    (ties: the lowest). A trunked system lists every control channel it might
+    use, but TR needs only one live at a time, so a list wider than the SDR is
+    cut down to what fits instead of refusing the whole system."""
+    half = rate * USABLE_BANDWIDTH_SHARE / 2
+    fs = sorted(set(freqs))
+    best: List[int] = []
+    for i, lo in enumerate(fs):
+        run = [f for f in fs[i:] if f - lo <= 2 * half]
+        if len(run) > len(best):
+            best = run
+    return best
+
+
+def choose_center(freqs: List[int], rate: int, override: Optional[int] = None) -> int:
+    """A centre frequency that puts every channel in the passband and none on
+    the DC spike. ValueError if they cannot all fit on one SDR."""
+    if not freqs:
+        raise ValueError("No frequencies to tune to.")
+    half = rate * USABLE_BANDWIDTH_SHARE / 2
+    if override:
+        if not _fits(override, freqs, half):
+            raise ValueError(f"TR_CENTER_HZ {override} leaves a channel outside the SDR's {2 * half / 1e6:.1f} MHz.")
+        return int(override)
+    lo, hi = min(freqs), max(freqs)
+    if hi - lo > 2 * half:
+        raise ValueError(
+            f"Channels span {(hi - lo) / 1e6:.3f} MHz, more than one SDR at {rate / 1e6:.1f} Msps covers "
+            f"({2 * half / 1e6:.2f} MHz). Trim the channel list or raise TR_SAMPLE_RATE."
+        )
+    mid = int(round((lo + hi) / 2))
+    for nudge in CENTER_NUDGES_HZ:
+        c = mid + nudge
+        if _fits(c, freqs, half) and all(abs(f - c) >= DC_SPIKE_GUARD_HZ for f in freqs):
+            return c
+    return mid  # channels packed around the middle: accept the spike over not fitting
+
+
+def _csv(header: List[str], rows: List[List[Any]]) -> str:
+    buf = io.StringIO()
+    w = csv.writer(buf, lineterminator="\n")
+    w.writerow(header)
+    w.writerows(rows)
+    return buf.getvalue()
+
+
+def talkgroups_csv(talkgroups: List[Dict[str, Any]]) -> str:
+    """TR talkgroupsFile: header row required, "Decimal" first (CONFIGURE.md)."""
+    rows = []
+    for tg in talkgroups:
+        if tg.get("id") is None:
+            continue
+        name = str(tg.get("name") or "").strip()
+        rows.append([int(tg["id"]), "D", name, name, "", ""])
+    return _csv(["Decimal", "Mode", "Alpha Tag", "Description", "Tag", "Category"], rows)
+
+
+def channels_csv(channels: List[Dict[str, Any]], squelch: Optional[float] = None) -> str:
+    """TR channelFile: header required, "TG Number" first; Frequency in Hz
+    (no decimal point = Hz). Per-channel Squelch overrides the system's."""
+    header = ["TG Number", "Frequency", "Alpha Tag", "Description"]
+    if squelch is not None:
+        header.append("Squelch")
+    rows = []
+    for ch in channels:
+        name = ch.get("name") or f"{ch['frequency'] / 1e6:.4f} MHz"
+        row = [channel_tgid(ch["frequency"]), ch["frequency"], name, name]
+        if squelch is not None:
+            row.append(squelch)
+        rows.append(row)
+    return _csv(header, rows)
+
+
+def _analog_channels(config: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """Every analog channel the config lists (OP25 only ever used the first)."""
+    out = []
+    for raw in (config or {}).get("channels") or []:
+        if isinstance(raw, dict) and raw.get("freq") not in (None, ""):
+            out.append({"frequency": to_hz(raw["freq"]), "name": str(raw.get("name") or "").strip()})
+    if not out:
+        freq = analog_frequency(config)
+        if freq:
+            out.append({"frequency": freq, "name": ""})
+    return out
+
+
+def _analog_squelch(config: Dict[str, Any], default_db: float) -> float:
+    """TR's squelch is an absolute power level — OP25's "power" mode. Its
+    squelch_threshold carries over; noise/voice squelch_db has no TR
+    equivalent, so those fall back to the default (which needs site tuning)."""
+    value = (config or {}).get("squelch_threshold")
+    if value is None or (isinstance(value, str) and not value.strip()):
+        return float(default_db)
+    try:
+        return float(value)
+    except (TypeError, ValueError):
+        raise ValueError(f"squelch_threshold {value!r} isn't a number.")
+
+
+def build_tr_config(
+    system_type: str,
+    name: str,
+    config: Dict[str, Any],
+    *,
+    device_serial: Optional[str],
+    ppm: Optional[float],
+    sample_rate: int,
+    gain: float,
+    digital_recorders: int,
+    min_duration: float,
+    squelch_db: float,
+    live_port: int,
+    center_override: Optional[int] = None,
+) -> Tuple[Dict[str, Any], Dict[str, str]]:
+    """SystemConfig fields -> (config.json dict, {filename: contents} to write beside it).
+
+    ValueError when the system can't be expressed (DMR, no channels, too wide).
+    """
+    config = config or {}
+    mode = system_mode(system_type, config)
+    files: Dict[str, str] = {}
+    # Kept per system, not globally: audioArchive/callLog false makes TR delete
+    # the wav/json after uploadScript returns, which is why drb-upload.sh
+    # copies them out before it exits.
+    system: Dict[str, Any] = {
+        "shortName": SHORT_NAME,
+        "uploadScript": TR_UPLOAD_SCRIPT,
+        "audioArchive": False,
+        "callLog": False,
+        # WAV, not TR's 32k AAC: the recorder's own rule is one lossless copy
+        # for Whisper (call_recorder AUDIO_* notes). 8 kHz mono is ~1 MB/min.
+        "compressWav": False,
+        "minDuration": float(min_duration),
+        "maxDuration": MAX_DURATION_SECONDS,
+        "hideEncrypted": False,
+    }
+    source: Dict[str, Any] = {
+        "driver": "osmosdr",
+        # By serial, like OP25 (sdr_settings.pin_op25_device): "rtl=0" means
+        # whichever dongle enumerated first, which a decoder can take.
+        "device": f"rtl={device_serial}" if device_serial else "rtl=0",
+        "rate": int(sample_rate),
+        "gain": float(gain),
+        "ppm": float(ppm or 0.0),
+    }
+
+    if mode == DMR:
+        raise ValueError("DMR isn't supported by the edge node.")
+
+    if mode == TRUNKED:
+        ccs = [to_hz(c) for c in config.get("control_channels") or []]
+        if not ccs:
+            raise ValueError(f"System {name!r} has no control channels.")
+        talkgroups = [tg for tg in config.get("talkgroups") or [] if tg.get("id") is not None]
+        system.update({
+            "type": "p25",
+            "control_channels": ccs,
+            # TR's default; "fsk4" is accepted too. Overridable from C2.
+            "modulation": str(config.get("modulation") or "qpsk"),
+        })
+        # Same rule as OP25's whitelist: a talkgroup list means record only
+        # those; no list means record everything.
+        if talkgroups:
+            files[TALKGROUPS_FILE] = talkgroups_csv(talkgroups)
+            system["talkgroupsFile"] = f"{TR_APP_DIR}/{TALKGROUPS_FILE}"
+            system["recordUnknown"] = False
+        else:
+            system["recordUnknown"] = True
+        # Voice channels are wherever the system grants them; only the control
+        # channels are known here, so the SDR is centred on those. A system
+        # whose voice channels sit outside that ~2 MHz loses those calls (TR
+        # logs "no source covering" for each) — needs a second source.
+        if center_override:
+            half = int(sample_rate) * USABLE_BANDWIDTH_SHARE / 2
+            covered = [c for c in ccs if abs(c - center_override) <= half]
+            if not covered:
+                raise ValueError(f"TR_CENTER_HZ {center_override} covers none of {name!r}'s control channels.")
+        else:
+            covered = widest_cover(ccs, int(sample_rate))
+        if len(covered) < len(ccs):
+            system["control_channels"] = covered
+            logger.warning(
+                f"Control channels span {(max(ccs) - min(ccs)) / 1e6:.3f} MHz, wider than one SDR; "
+                f"using the {len(covered)} of {len(ccs)} that fit "
+                f"({min(covered) / 1e6:.5f}-{max(covered) / 1e6:.5f} MHz)."
+            )
+        freqs = covered
+        source["digitalRecorders"] = int(digital_recorders)
+    elif mode == CONVENTIONAL:
+        chans = conventional_channels(config)
+        if not chans:
+            raise ValueError(f"System {name!r} has no conventional channels.")
+        # No NAC filter: TR's conventionalP25 records whatever it decodes, so a
+        # mistyped NAC can no longer silently drop every call (node-26#33).
+        system.update({"type": "conventionalP25", "channelFile": f"{TR_APP_DIR}/{CHANNELS_FILE}",
+                       "squelch": float(squelch_db)})
+        files[CHANNELS_FILE] = channels_csv(chans)
+        freqs = [c["frequency"] for c in chans]
+    else:  # ANALOG
+        chans = _analog_channels(config)
+        if not chans:
+            raise ValueError(f"System {name!r} has no analog frequency.")
+        squelch = _analog_squelch(config, squelch_db)
+        system.update({"type": "conventional", "channelFile": f"{TR_APP_DIR}/{CHANNELS_FILE}",
+                       "squelch": squelch})
+        files[CHANNELS_FILE] = channels_csv(chans)
+        freqs = [c["frequency"] for c in chans]
+
+    source["center"] = choose_center(freqs, int(sample_rate), center_override)
+
+    tr = {
+        "ver": 2,
+        "sources": [source],
+        "systems": [system],
+        "tempDir": TR_TEMP_DIR,
+        "captureDir": TR_CAPTURE_DIR,
+        "callTimeout": CALL_TIMEOUT_SECONDS,
+        # File log too (stdout still goes to docker logs): trunk_recorder.py
+        # reads the control-channel decode rate from it for the health check.
+        "logFile": True,
+        "logDir": f"{TR_APP_DIR}/logs",
+        "logColor": "none",  # TR 5.x: a string ("console"|"none"), not a bool
+        # Live audio for Discord: simplestream sends every call's PCM to the
+        # edge-node, which follows one talkgroup at a time into PulseAudio.
+        "audioStreaming": True,
+        "plugins": [{
+            "name": "simplestream",
+            "library": "libsimplestream.so",
+            "streams": [{"TGID": 0, "address": "127.0.0.1", "port": int(live_port), "sendTGID": True}],
+        }],
+    }
+    return tr, files
+
+
+def live_sample_rate(system_type: str, config: Dict[str, Any]) -> int:
+    """simplestream sends analog audio at 16 kHz and digital at 8 kHz (Plugins.md)."""
+    return 16000 if system_mode(system_type, config or {}) == ANALOG else 8000

drb-edge-node/app/internal/trunk_recorder.py

@@ -0,0 +1,575 @@
+"""
+Trunk Recorder backend, edge-node side (node-26#45). Active only when
+RECORDER_BACKEND=trunk-recorder.
+
+    C2 SystemConfig --apply_config--> <tr_config_dir>/config.json (+ CSVs)
+                                      trunk-recorder/run.sh restarts TR on change
+    TR finishes a call --drb-upload.sh--> <tr_inbox_dir>/<stem>.wav, then <stem>.json
+    ingest loop --> MQTT call_start --> /upload (call_recorder.upload_recording,
+                    i.e. the node-26#44 spool) --> MQTT call_end
+    TR simplestream (UDP) --LiveAudioBridge--> pacat --> drb_sink --> Discord
+
+Why an inbox directory and not an HTTP endpoint: TR deletes the WAV/JSON as
+soon as uploadScript returns (audioArchive/callLog false), so the script must
+copy the files out synchronously anyway, and a file on the host disk survives
+an edge-node restart where a POST to a down edge-node would not. The JSON is
+moved in LAST, so its presence means the WAV is complete.
+
+Restart safety: a call_id is a pure function of the JSON (tr_calls.parse_call),
+and the WAV is renamed to `<YYYYmmdd_HHMMSS>_<call_id>.wav` (the name the spool
+recovers a call_id from) before anything is sent. A crash at any step re-runs
+the same call with the same id, so C2 overwrites instead of duplicating; a JSON
+whose WAV is already gone was handed to the uploader and is just removed.
+"""
+import asyncio
+import json
+import math
+import os
+import re
+import time
+import wave
+from datetime import datetime
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Set
+
+from app.config import settings
+from app.internal.logger import logger
+from app.internal.tr_calls import TrCall, parse_call
+from app.models import SystemConfig
+
+CONFIG_FILE = "config.json"
+STATUS_FILE = "drb-status.json"       # written by trunk-recorder/run.sh every few seconds
+RESTART_REQUEST = "restart-request"   # run.sh restarts TR when this appears
+STOP_REQUEST = "stop-request"         # run.sh keeps TR stopped while this exists
+
+INBOX_POLL_SECONDS = 1.0
+INGEST_CONCURRENCY = 4
+# Hand-off is wav-then-json; a JSON whose WAV never shows is dropped after this.
+ORPHAN_JSON_SECONDS = 60.0
+# C2 creates the call doc from MQTT call_start, and only that message carries
+# the talkgroup and start time. With the broker down, call_start is dropped
+# (mqtt_manager buffers only call_end), so a call waits in the inbox this long
+# for MQTT to come back before it is sent without one.
+MQTT_WAIT_SECONDS = 600.0
+# call_start must be written before /upload stamps audio_gcs_uri: C2's
+# _on_call_start writes the doc with merge=False and would erase it
+# (server-26#303; drop this lead once C2 makes call_start create-only).
+CALL_START_LEAD_SECONDS = 1.0
+# A WAV with no JSON this old is a hand-off drb-upload.sh never finished.
+STRAY_WAV_SECONDS = 3600.0
+# How long radio_backend waits for run.sh to (re)start TR after a request: it
+# polls every 5 s and may spend 15 s stopping the old process.
+RESTART_WAIT_SECONDS = 30.0
+RESTART_POLL_SECONDS = 1.0
+# The name process() renames a claimed WAV to; never swept (its JSON is what
+# drives it, and os.replace keeps TR's old mtime).
+CANONICAL_WAV_RE = re.compile(r"^\d{8}_\d{6}_[0-9a-f-]{36}\.wav$")
+# run.sh rewrites its status every 5 s; past this the supervisor is gone.
+STATUS_STALE_SECONDS = 20.0
+LOG_TAIL_BYTES = 64 * 1024
+# TR logs this for every trunked system every few seconds (main.cpp
+# check_message_count). Exact wording unverified against a live log.
+DECODE_RATE_RE = re.compile(r"Decode Rate:\s*([0-9.]+)\s*/\s*sec", re.IGNORECASE)
+
+
+def enabled() -> bool:
+    return settings.recorder_backend == "trunk-recorder"
+
+
+def config_dir() -> Path:
+    return Path(settings.tr_config_dir or (Path(settings.config_path) / "trunk-recorder"))
+
+
+def inbox_dir() -> Path:
+    return Path(settings.tr_inbox_dir or (Path(settings.recordings_path) / "tr-inbox"))
+
+
+def _atomic_write(path: Path, text: str) -> None:
+    tmp = path.with_name(path.name + ".tmp")
+    tmp.write_text(text)
+    os.replace(tmp, path)
+
+
+def wav_seconds(path: Path) -> Optional[float]:
+    """Length of a WAV from its header; None if it can't be read."""
+    try:
+        with wave.open(str(path), "rb") as w:
+            rate = w.getframerate()
+            return w.getnframes() / rate if rate else None
+    except (OSError, EOFError, wave.Error):
+        return None
+
+
+def canonical_wav_name(call: TrCall) -> str:
+    stamp = datetime.fromtimestamp(call.start_epoch).strftime("%Y%m%d_%H%M%S")
+    return f"{stamp}_{call.call_id}.wav"
+
+
+class TrunkRecorder:
+    def __init__(self):
+        self.config_error: Optional[str] = None
+        self.calls_ingested = 0
+        self.encrypted_skipped = 0
+        self.last_call_epoch: Optional[float] = None
+        self.last_call: Optional[Dict[str, Any]] = None
+        self._task: Optional[asyncio.Task] = None
+        self._inflight: Set[str] = set()
+        self._sem = asyncio.Semaphore(INGEST_CONCURRENCY)
+        self.live = LiveAudioBridge()
+
+    # ------------------------------------------------------------------
+    # Config + supervisor requests
+    # ------------------------------------------------------------------
+
+    async def apply_config(self, config: SystemConfig) -> bool:
+        """Write TR's config for `config`. run.sh restarts TR when config.json
+        changes; a restart request covers a CSV-only change."""
+        from app.internal.config_manager import load_node_config
+        from app.internal.sdr_settings import op25_serial
+        from app.internal.secondary_sdr_client import secondary_sdr_client
+        from app.internal.tr_config import build_tr_config, live_sample_rate
+
+        node_cfg = load_node_config()
+        # TR takes the dongle OP25 would have (pin or first detected), so the
+        # secondary decoders' reservation logic is unchanged.
+        devs = await secondary_sdr_client.devices()
+        serial = op25_serial(node_cfg, devs)
+        if serial and devs and sum(d["serial"] == serial for d in devs) > 1:
+            serial = None  # two dongles share it: by-serial would be ambiguous
+        try:
+            tr, files = build_tr_config(
+                config.type, config.name, config.config,
+                device_serial=serial, ppm=node_cfg.ppm_override,
+                sample_rate=settings.tr_sample_rate, gain=settings.tr_gain,
+                digital_recorders=settings.tr_digital_recorders, min_duration=settings.tr_min_duration,
+                squelch_db=settings.tr_squelch_db, live_port=settings.tr_live_port,
+                center_override=settings.tr_center_hz,
+            )
+        except ValueError as e:
+            self.config_error = f"System {config.name!r}: {e}"
+            logger.error(f"Trunk Recorder config not written — {self.config_error}")
+            return False
+        try:
+            d = config_dir()
+            d.mkdir(parents=True, exist_ok=True)
+            (d / "logs").mkdir(exist_ok=True)
+            # CSVs first: run.sh restarts on config.json, which must never
+            # point at a file that isn't there yet.
+            for name, text in files.items():
+                _atomic_write(d / name, text)
+            _atomic_write(d / CONFIG_FILE, json.dumps(tr, indent=2))
+        except OSError as e:
+            self.config_error = f"Couldn't write {config_dir()}: {e}"
+            logger.error(self.config_error)
+            return False
+        self.config_error = None
+        self.live.sample_rate = live_sample_rate(config.type, config.config)
+        logger.info(f"Trunk Recorder config written for {config.name} (SDR {serial or 'rtl=0'}).")
+        return True
+
+    def request_restart(self) -> bool:
+        try:
+            d = config_dir()
+            d.mkdir(parents=True, exist_ok=True)
+            (d / STOP_REQUEST).unlink(missing_ok=True)
+            (d / RESTART_REQUEST).write_text(str(time.time()))
+            return True
+        except OSError as e:
+            logger.error(f"Couldn't ask Trunk Recorder to restart: {e}")
+            return False
+
+    async def wait_started_since(self, since: float, timeout: Optional[float] = None) -> Optional[str]:
+        """Wait until run.sh reports TR running with started_at >= `since`.
+
+        Callers hand the spare dongles to the secondary decoders right after a
+        start; returning before TR has actually reopened its SDR would let a
+        decoder take it. None when started, else why not.
+        """
+        timeout = RESTART_WAIT_SECONDS if timeout is None else timeout
+        deadline = time.time() + timeout
+        while True:
+            st = self.supervisor_status()
+            if st and not st["stale"] and st.get("state") == "running" \
+                    and float(st.get("started_at") or 0) >= math.floor(since):
+                return None
+            if time.time() >= deadline:
+                break
+            await asyncio.sleep(RESTART_POLL_SECONDS)
+        if st is None:
+            return "The trunk-recorder service isn't running (is COMPOSE_PROFILES=trunk-recorder set?)."
+        return f"Trunk Recorder didn't restart within {timeout:.0f}s (state: {st.get('state')})."
+
+    def request_stop(self) -> bool:
+        try:
+            d = config_dir()
+            d.mkdir(parents=True, exist_ok=True)
+            (d / STOP_REQUEST).write_text(str(time.time()))
+            return True
+        except OSError as e:
+            logger.error(f"Couldn't ask Trunk Recorder to stop: {e}")
+            return False
+
+    # ------------------------------------------------------------------
+    # Health
+    # ------------------------------------------------------------------
+
+    def supervisor_status(self, now: Optional[float] = None) -> Optional[Dict[str, Any]]:
+        now = time.time() if now is None else now
+        try:
+            data = json.loads((config_dir() / STATUS_FILE).read_text())
+        except (OSError, ValueError):
+            return None
+        data["age_seconds"] = round(now - float(data.get("epoch") or 0), 1)
+        data["stale"] = data["age_seconds"] > STATUS_STALE_SECONDS
+        return data
+
+    def log_facts(self, now: Optional[float] = None) -> Dict[str, Any]:
+        now = time.time() if now is None else now
+        logs = config_dir() / "logs"
+        try:
+            files = [p for p in logs.iterdir() if p.is_file()]
+        except OSError:
+            files = []
+        if not files:
+            return {"log_age_seconds": None, "decode_rate": None}
+        newest = max(files, key=lambda p: p.stat().st_mtime)
+        age = now - newest.stat().st_mtime
+        rate = None
+        try:
+            with open(newest, "rb") as f:
+                f.seek(max(0, newest.stat().st_size - LOG_TAIL_BYTES))
+                tail = f.read().decode(errors="replace")
+            found = DECODE_RATE_RE.findall(tail)
+            rate = float(found[-1]) if found else None
+        except OSError:
+            pass
+        return {"log_age_seconds": round(age, 1), "decode_rate": rate}
+
+    def log_tail(self, lines: int = 80) -> List[str]:
+        """Last lines of TR's newest log file, for the dashboard's log panel."""
+        try:
+            files = [p for p in (config_dir() / "logs").iterdir() if p.is_file()]
+            if not files:
+                return []
+            newest = max(files, key=lambda p: p.stat().st_mtime)
+            with open(newest, "rb") as f:
+                f.seek(max(0, newest.stat().st_size - LOG_TAIL_BYTES))
+                text = f.read().decode(errors="replace")
+        except OSError:
+            return []
+        return text.splitlines()[-max(1, min(int(lines), 500)):]
+
+    def sweep_stray_wavs(self, now: Optional[float] = None) -> int:
+        """Delete WAVs whose JSON never arrived (drb-upload.sh died between
+        its two moves). Canonical names (already claimed by a JSON)
+        are never touched, so only true strays go."""
+        now = time.time() if now is None else now
+        removed = 0
+        try:
+            jsons = {p.stem for p in inbox_dir().glob("*.json")}
+            for wav in inbox_dir().glob("*.wav"):
+                if wav.stem in jsons or CANONICAL_WAV_RE.match(wav.name) \
+                        or now - wav.stat().st_mtime < STRAY_WAV_SECONDS:
+                    continue
+                logger.error(f"Trunk Recorder WAV {wav.name} has had no call JSON for an hour — deleting it.")
+                wav.unlink(missing_ok=True)
+                removed += 1
+        except OSError:
+            pass
+        return removed
+
+    def inbox_backlog(self) -> int:
+        try:
+            return sum(1 for _ in inbox_dir().glob("*.json"))
+        except OSError:
+            return 0
+
+    def health_facts(self) -> Dict[str, Any]:
+        return {
+            "status": self.supervisor_status(),
+            **self.log_facts(),
+            "config_error": self.config_error,
+            "inbox_backlog": self.inbox_backlog(),
+            "calls_ingested": self.calls_ingested,
+            "encrypted_skipped": self.encrypted_skipped,
+            "last_call_epoch": self.last_call_epoch,
+            "last_call": self.last_call,
+            "live": self.live.stats(),
+        }
+
+    # ------------------------------------------------------------------
+    # Ingest
+    # ------------------------------------------------------------------
+
+    async def start(self) -> None:
+        inbox_dir().mkdir(parents=True, exist_ok=True)
+        if self._task is None or self._task.done():
+            self._task = asyncio.create_task(self._run())
+        await self.live.start()
+
+    async def stop(self) -> None:
+        if self._task:
+            self._task.cancel()
+            try:
+                await self._task
+            except asyncio.CancelledError:
+                pass
+            self._task = None
+        await self.live.stop()
+
+    async def _run(self) -> None:
+        backlog = self.inbox_backlog()
+        if backlog:
+            logger.info(f"Trunk Recorder inbox has {backlog} call(s) from before this start — sending.")
+        last_sweep = 0.0
+        while True:
+            try:
+                await self.scan_once()
+                if time.time() - last_sweep > 300:
+                    last_sweep = time.time()
+                    self.sweep_stray_wavs()
+            except asyncio.CancelledError:
+                raise
+            except Exception as e:
+                logger.error(f"Trunk Recorder inbox pass failed: {e}")
+            await asyncio.sleep(INBOX_POLL_SECONDS)
+
+    async def scan_once(self, wait: bool = False) -> int:
+        """Start a task per ready call. Returns how many were started; with
+        `wait`, also waits for them (tests)."""
+        from app.internal.mqtt_manager import mqtt_manager
+        try:
+            ready = sorted(inbox_dir().glob("*.json"), key=lambda p: p.stat().st_mtime)
+        except OSError:
+            return 0
+        started: List[asyncio.Task] = []
+        now = time.time()
+        for path in ready:
+            if path.name in self._inflight:
+                continue
+            try:
+                age = now - path.stat().st_mtime
+            except OSError:
+                continue
+            if not mqtt_manager.is_connected and age < MQTT_WAIT_SECONDS:
+                continue
+            self._inflight.add(path.name)
+            started.append(asyncio.create_task(self._guarded(path)))
+        if wait and started:
+            await asyncio.gather(*started)
+        return len(started)
+
+    async def _guarded(self, path: Path) -> None:
+        try:
+            async with self._sem:
+                await self.process(path)
+        except Exception as e:
+            logger.error(f"Trunk Recorder call {path.name} failed: {e}")
+        finally:
+            self._inflight.discard(path.name)
+
+    async def process(self, json_path: Path) -> None:
+        from app.internal.call_recorder import call_recorder
+        from app.internal.config_manager import load_node_config
+        from app.internal.mqtt_manager import mqtt_manager
+
+        try:
+            data = json.loads(json_path.read_text())
+            call = parse_call(data, settings.node_id, json_path.stem)
+        except (OSError, ValueError) as e:
+            logger.error(f"Trunk Recorder call {json_path.name} is unreadable ({e}) — dropping it.")
+            json_path.with_suffix(".wav").unlink(missing_ok=True)
+            json_path.unlink(missing_ok=True)
+            return
+
+        raw_wav = json_path.with_suffix(".wav")
+        wav = json_path.parent / canonical_wav_name(call)
+        if raw_wav.exists():
+            os.replace(raw_wav, wav)
+        if not wav.exists():
+            age = time.time() - json_path.stat().st_mtime
+            if age > ORPHAN_JSON_SECONDS:
+                # Either TR's hand-off broke, or a previous pass already handed
+                # this WAV to the uploader (which deletes or spools it) and
+                # died before removing the JSON. Either way nothing to send.
+                # Still close it in C2: if a previous pass uploaded and died
+                # before this point, the doc would otherwise stay "active".
+                # _on_call_end merges, so a repeat is harmless.
+                logger.warning(f"Trunk Recorder call {call.call_id}: no audio beside {json_path.name} — removing it.")
+                await mqtt_manager.publish_metadata("call_end", {**call.end_payload(), "audio_skipped": "no_audio"})
+                json_path.unlink(missing_ok=True)
+            return
+
+        await mqtt_manager.publish_metadata("call_start", call.start_payload())
+        seconds = wav_seconds(wav)
+        end = call.end_payload(seconds)
+
+        if call.encrypted:
+            # Encrypted P25 voice decodes to noise: nothing for Whisper. The
+            # call is still reported so C2 sees the activity.
+            wav.unlink(missing_ok=True)
+            end["audio_skipped"] = "encrypted"
+            self.encrypted_skipped += 1
+        elif settings.c2_url:
+            await asyncio.sleep(CALL_START_LEAD_SECONDS)
+            node_cfg = load_node_config()
+            url = await call_recorder.upload_recording(
+                wav, call.call_id,
+                talkgroup_id=call.tgid, talkgroup_name=call.tgid_name or None,
+                system_id=node_cfg.assigned_system_id,
+                audio_start_epoch=call.start_epoch, audio_end_epoch=call.audio_end_epoch(seconds),
+                extra=call.upload_extra(),
+            )
+            if url:
+                end["audio_url"] = url
+            else:
+                kind = (call_recorder.spool.last_result or {}).get("kind")
+                end["audio_upload"] = {"retry": "spooled", "lost": "lost"}.get(kind, "rejected")
+        else:
+            wav.unlink(missing_ok=True)
+
+        await mqtt_manager.publish_metadata("call_end", end)
+        json_path.unlink(missing_ok=True)
+        self.calls_ingested += 1
+        self.last_call_epoch = time.time()
+        self.last_call = {"call_id": call.call_id, "tgid": call.tgid, "tgid_name": call.tgid_name,
+                          "units": call.units, "duration": round(call.stop_epoch - call.start_epoch, 1),
+                          "encrypted": call.encrypted, "emergency": call.emergency}
+        logger.info(
+            f"TR call {call.call_id}: TG {call.tgid} {call.tgid_name!r}, "
+            f"{call.stop_epoch - call.start_epoch:.1f}s, units {call.units or '-'}"
+            + (" [EMERGENCY]" if call.emergency else "") + (" [encrypted]" if call.encrypted else "")
+        )
+
+
+class LiveAudioBridge:
+    """TR simplestream (UDP, s16le mono, 4-byte little-endian TGID prefix) ->
+    `pacat` into drb_sink, so Discord keeps reading drb_sink.monitor unchanged.
+
+    TR records every talkgroup at once and streams them all to one port;
+    interleaving two calls' packets would garble both. So this follows ONE
+    talkgroup — the first heard — until it has been quiet for HOLD_SECONDS,
+    like the one-voice-channel scanner OP25 was. Recording is unaffected:
+    every call is still recorded and uploaded in full.
+    """
+
+    HOLD_SECONDS = 2.0
+    RESPAWN_SECONDS = 5.0
+    MAX_BUFFERED_BYTES = 64 * 1024  # ~4 s at 8 kHz; beyond this pacat is stuck, drop
+
+    def __init__(self):
+        self.sample_rate = 8000
+        self.current_tgid: Optional[int] = None
+        self.last_packet_epoch: Optional[float] = None
+        self._last_current_epoch = 0.0
+        self.packets = 0
+        self.dropped = 0
+        self._transport = None
+        self._proc: Optional[asyncio.subprocess.Process] = None
+        self._proc_rate: Optional[int] = None
+        self._spawn_after = 0.0
+        self._spawning = False
+
+    def stats(self) -> Dict[str, Any]:
+        return {"current_tgid": self.current_tgid, "last_packet_epoch": self.last_packet_epoch,
+                "packets": self.packets, "dropped": self.dropped,
+                "pacat_running": self._proc is not None and self._proc.returncode is None}
+
+    async def start(self) -> None:
+        loop = asyncio.get_running_loop()
+        bridge = self
+
+        class _Proto(asyncio.DatagramProtocol):
+            def datagram_received(self, data, addr):
+                bridge.feed(data)
+
+        try:
+            self._transport, _ = await loop.create_datagram_endpoint(
+                _Proto, local_addr=("127.0.0.1", settings.tr_live_port),
+            )
+            logger.info(f"Trunk Recorder live audio: listening on 127.0.0.1:{settings.tr_live_port}.")
+        except OSError as e:
+            logger.error(f"Trunk Recorder live audio disabled — can't bind UDP {settings.tr_live_port}: {e}")
+
+    async def stop(self) -> None:
+        if self._transport:
+            self._transport.close()
+            self._transport = None
+        if self._proc and self._proc.returncode is None:
+            self._proc.terminate()
+        self._proc = None
+
+    def select(self, tgid: int, now: float) -> bool:
+        """Follow-one-talkgroup policy. True if this packet should be played."""
+        if self.current_tgid is None or now - self._last_current_epoch > self.HOLD_SECONDS:
+            self.current_tgid = tgid
+        if tgid != self.current_tgid:
+            return False
+        self._last_current_epoch = now
+        return True
+
+    def feed(self, data: bytes, now: Optional[float] = None) -> Optional[bytes]:
+        """One datagram. Returns the PCM that was (or would be) played."""
+        if len(data) <= 4:
+            return None
+        now = time.time() if now is None else now
+        tgid = int.from_bytes(data[:4], "little")
+        self.packets += 1
+        self.last_packet_epoch = now
+        if not self.select(tgid, now):
+            return None
+        pcm = data[4:]
+        self._write(pcm)
+        return pcm
+
+    def _write(self, pcm: bytes) -> None:
+        proc = self._proc
+        if proc is None or proc.returncode is not None:
+            self._ensure_pacat()
+            return
+        if self._proc_rate != self.sample_rate:
+            # A config change, not a failure: no respawn throttle.
+            self._spawn_after = 0.0
+            self._ensure_pacat()
+            return
+        stdin = proc.stdin
+        if stdin is None or stdin.is_closing():
+            return
+        try:
+            if stdin.transport.get_write_buffer_size() > self.MAX_BUFFERED_BYTES:
+                self.dropped += 1
+                return
+            stdin.write(pcm)
+        except (BrokenPipeError, ConnectionResetError, RuntimeError):
+            self._proc = None  # pacat died; respawned on the next packet
+
+    def _ensure_pacat(self) -> None:
+        if self._spawning or time.time() < self._spawn_after:
+            return
+        self._spawning = True
+        self._spawn_after = time.time() + self.RESPAWN_SECONDS
+        try:
+            asyncio.get_running_loop().create_task(self._spawn())
+        except RuntimeError:
+            self._spawning = False
+
+    async def _spawn(self) -> None:
+        try:
+            if self._proc and self._proc.returncode is None:
+                self._proc.terminate()
+            sink = settings.pulse_source.removesuffix(".monitor")
+            self._proc = await asyncio.create_subprocess_exec(
+                "pacat", "--playback", "--raw", "--format=s16le", f"--rate={self.sample_rate}",
+                "--channels=1", f"--device={sink}", "--latency-msec=250", "--client-name=drb-trunk-recorder",
+                stdin=asyncio.subprocess.PIPE, stdout=asyncio.subprocess.DEVNULL,
+                stderr=asyncio.subprocess.DEVNULL,
+            )
+            self._proc_rate = self.sample_rate
+        except Exception as e:
+            logger.error(f"Trunk Recorder live audio: pacat failed to start ({e}); retrying.")
+            self._proc = None
+        finally:
+            self._spawning = False
+
+
+trunk_recorder = TrunkRecorder()

drb-edge-node/app/internal/update_request.py

@@ -0,0 +1,41 @@
+"""
+Hand an MQTT `node_update` command to the host-level updater (node-26#15).
+
+The edge-node container has no business updating its own host: it writes a
+sentinel file into /configs (bind-mounted from <install dir>/configs), and the
+host's systemd drb-update.path unit — installed by install.sh — triggers
+drb-update.service, which runs Client/scripts/drb-update.sh. The host treats
+the file as a bare "please update" flag and never reads its content as input,
+so nothing C2 sends can pick the ref, image or command that runs.
+"""
+import json
+import os
+from datetime import datetime, timezone
+from pathlib import Path
+
+from app.config import settings
+from app.internal.logger import logger
+
+SENTINEL_NAME = "update-requested"
+
+
+def sentinel_path() -> Path:
+    return Path(settings.config_path) / SENTINEL_NAME
+
+
+def request_host_update() -> bool:
+    """Drop the sentinel. Returns False if it could not be written."""
+    path = sentinel_path()
+    try:
+        path.parent.mkdir(parents=True, exist_ok=True)
+        tmp = path.with_name(SENTINEL_NAME + ".tmp")
+        tmp.write_text(json.dumps({"requested_at": datetime.now(timezone.utc).isoformat()}))
+        os.replace(tmp, path)
+    except OSError as e:
+        logger.error(f"Node update requested but the sentinel could not be written ({e}).")
+        return False
+    logger.info(
+        f"Node update requested — handed to the host updater via {path}. If nothing happens within a minute, "
+        "this node predates the updater: re-run install.sh on it once."
+    )
+    return True

drb-edge-node/app/internal/upload_spool.py

@@ -0,0 +1,433 @@
+"""
+On-disk spool for recordings whose upload to C2 failed (node-26#44).
+
+Before this, `upload_recording` deleted the file in a `finally` whether or not
+the POST succeeded, so a C2 outage, a network blip, a 5xx or a timeout lost the
+call's audio for good — and with it the transcript and the incident link.
+
+Now a recording is deleted only after a 2xx that carries a storage URL. A
+failure that can succeed later is MOVED into this spool with a JSON sidecar
+holding everything needed to re-POST it, and a background task retries with
+exponential backoff. The spool is drained on startup, so a reboot or container
+restart does not lose it either.
+
+Failure classes (see `classify`):
+
+  retry    network error, timeout, 5xx, 2xx with no URL (C2 accepted the
+           request but storage failed), 401 (a reissued key is on its way
+           over MQTT/key pickup), 403 (not approved yet), 408, 429
+  reject   any other 4xx — 400 empty file, 413 too large.
+           Retrying the same bytes cannot change the answer, so the file is
+           deleted with an ERROR log naming the status.
+
+BOUNDED on purpose: /recordings is a bind mount of the host disk, and a full
+disk already stopped node-002 recording for 17 days (node-26#41). Entries older
+than `upload_spool_max_age_hours` are dropped, and past
+`upload_spool_max_bytes` the OLDEST entries go first — the newest audio is the
+most likely to still matter to a live incident.
+
+File layout, one pair per call:
+
+    <spool>/<recording name>.flac
+    <spool>/<recording name>.flac.json     sidecar (written FIRST, atomically)
+
+The sidecar is written before the audio is moved in, and deleted after the
+audio is removed, so a crash at any point leaves at worst a sidecar with no
+audio — which the next scan cleans up — and never audio that cannot be
+re-uploaded.
+"""
+import asyncio
+import json
+import os
+import shutil
+import time
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from typing import Any, Awaitable, Callable, Dict, List, Optional, Tuple
+
+import httpx
+
+from app.config import settings
+from app.internal import credentials
+from app.internal.logger import logger
+
+SIDECAR_SUFFIX = ".json"
+UPLOAD_TIMEOUT_SECONDS = 120.0
+# Statuses in the 4xx range that are worth retrying unchanged.
+# 403 = node not approved yet: approval can arrive later, and the spool caps
+# bound what a never-approved node keeps.
+RETRYABLE_4XX = {401, 403, 408, 429}
+
+OK, RETRY, REJECT = "ok", "retry", "reject"
+
+
+@dataclass
+class UploadMeta:
+    """Everything /upload needs besides the file itself."""
+
+    call_id: str
+    talkgroup_id: Optional[int] = None
+    talkgroup_name: Optional[str] = None
+    system_id: Optional[str] = None
+    audio_start_epoch: Optional[float] = None
+    audio_end_epoch: Optional[float] = None
+    # Further form fields, sent as-is (Trunk Recorder calls carry units,
+    # emergency, encryption — node-26#45). Kept in the sidecar like the rest.
+    extra: Optional[Dict[str, str]] = None
+
+
+# By extension, so a spooled file is re-sent with the type it was first sent
+# with — the PulseAudio recorder writes FLAC, Trunk Recorder WAV.
+AUDIO_MIME_BY_SUFFIX = {".flac": "audio/flac", ".wav": "audio/wav", ".mp3": "audio/mpeg", ".m4a": "audio/mp4"}
+
+
+def mime_for(path: Path, default: str = "application/octet-stream") -> str:
+    return AUDIO_MIME_BY_SUFFIX.get(path.suffix.lower(), default)
+
+
+@dataclass
+class UploadResult:
+    kind: str                     # OK | RETRY | REJECT
+    url: Optional[str] = None
+    status: Optional[int] = None  # HTTP status, None for a network error
+    detail: str = ""
+
+
+def classify(status: int, url: Optional[str]) -> str:
+    if 200 <= status < 300:
+        # C2 answers 200 {"url": null} when its GCS write failed: nothing was
+        # stored, so this is a server-side failure, not a success.
+        return OK if url else RETRY
+    if status in RETRYABLE_4XX or status >= 500:
+        return RETRY
+    if 400 <= status < 500:
+        return REJECT
+    return RETRY
+
+
+def _form(meta: UploadMeta) -> Dict[str, str]:
+    form: Dict[str, str] = {"call_id": meta.call_id, "node_id": settings.node_id}
+    if meta.talkgroup_id is not None:
+        form["talkgroup_id"] = str(meta.talkgroup_id)
+    if meta.talkgroup_name:
+        form["talkgroup_name"] = meta.talkgroup_name
+    if meta.system_id:
+        form["system_id"] = meta.system_id
+    # Where this audio really sits on the wall clock once silence is trimmed.
+    # C2 does not declare these Form fields yet, so FastAPI ignores them —
+    # they cost nothing and are here for when playback/correlation want them.
+    if meta.audio_start_epoch is not None:
+        form["audio_start_epoch"] = f"{meta.audio_start_epoch:.3f}"
+    if meta.audio_end_epoch is not None:
+        form["audio_end_epoch"] = f"{meta.audio_end_epoch:.3f}"
+    for key, value in (meta.extra or {}).items():
+        if value is not None and key not in form:
+            form[key] = str(value)
+    return form
+
+
+async def post_recording(
+    file_path: Path, meta: UploadMeta, mime: str, timeout: float = UPLOAD_TIMEOUT_SECONDS,
+) -> UploadResult:
+    """One POST to C2 /upload. Never raises; never touches the file on disk."""
+    upload_url = f"{settings.c2_url}/upload"
+    api_key = credentials.get_api_key()
+    headers = {"Authorization": f"Bearer {api_key}"} if api_key else {}
+    try:
+        async with httpx.AsyncClient(timeout=timeout) as client:
+            with open(file_path, "rb") as f:
+                r = await client.post(
+                    upload_url,
+                    files={"file": (file_path.name, f, mime)},
+                    data=_form(meta),
+                    headers=headers,
+                )
+    except Exception as e:
+        return UploadResult(RETRY, detail=f"{type(e).__name__}: {e}")
+
+    url: Optional[str] = None
+    if 200 <= r.status_code < 300:
+        try:
+            url = r.json().get("url")
+        except Exception:
+            url = None
+    kind = classify(r.status_code, url)
+    detail = f"HTTP {r.status_code}"
+    if kind != OK:
+        detail += f": {r.text[:200]}"
+    return UploadResult(kind, url=url, status=r.status_code, detail=detail)
+
+
+def _fsync_dir(directory: Path) -> None:
+    try:
+        fd = os.open(directory, os.O_RDONLY)
+    except OSError:
+        return
+    try:
+        os.fsync(fd)
+    except OSError:
+        pass
+    finally:
+        os.close(fd)
+
+
+Uploader = Callable[[Path, UploadMeta], Awaitable[UploadResult]]
+
+
+class UploadSpool:
+    def __init__(
+        self,
+        directory: Path,
+        uploader: Uploader,
+        max_bytes: int,
+        max_age_seconds: float,
+        backoff_min: float,
+        backoff_max: float,
+        poll_seconds: float = 5.0,
+        clock: Callable[[], float] = time.time,
+    ):
+        self.directory = Path(directory)
+        self._upload = uploader
+        self.max_bytes = max_bytes
+        self.max_age_seconds = max_age_seconds
+        self.backoff_min = backoff_min
+        self.backoff_max = backoff_max
+        self.poll_seconds = poll_seconds
+        self._clock = clock
+        self._task: Optional[asyncio.Task] = None
+        self._wake = asyncio.Event()
+        self.last_result: Optional[Dict[str, Any]] = None
+
+    # ------------------------------------------------------------------
+    # Entries
+    # ------------------------------------------------------------------
+
+    def _backoff(self, attempts: int) -> float:
+        return min(self.backoff_min * (2 ** max(0, attempts - 1)), self.backoff_max)
+
+    @staticmethod
+    def _write_sidecar(path: Path, data: Dict[str, Any]) -> None:
+        # fsync file AND directory: on a Pi that loses power, an un-synced
+        # rename can come back as a zero-length sidecar after the audio move
+        # was already journaled.
+        tmp = path.with_name(path.name + ".tmp")
+        with open(tmp, "w") as f:
+            f.write(json.dumps(data))
+            f.flush()
+            os.fsync(f.fileno())
+        os.replace(tmp, path)
+        _fsync_dir(path.parent)
+
+    def _recover_sidecar(self, audio: Path, sidecar: Path, why: str) -> Optional[Dict[str, Any]]:
+        """Rebuild minimal metadata from the recording's own name
+        (`YYYYMMDD_HHMMSS_<call_id>.flac`) rather than delete good audio. C2
+        already has the talkgroup from call_start; only call_id is required."""
+        parts = audio.name.split("_", 2)
+        call_id = parts[2].split(".", 1)[0] if len(parts) == 3 else ""
+        if not call_id:
+            logger.error(f"Spooled audio {audio.name}: {why}, and no call_id in its name — dropping it.")
+            self._remove(audio, sidecar)
+            return None
+        logger.error(f"Spooled audio {audio.name}: {why} — rebuilt metadata from the filename (call {call_id}).")
+        try:
+            spooled_at = audio.stat().st_mtime
+        except OSError:
+            spooled_at = self._clock()
+        data = {**asdict(UploadMeta(call_id=call_id)), "spooled_at": spooled_at, "attempts": 1,
+                "next_attempt_at": self._clock(), "last_error": why, "last_status": None}
+        self._write_sidecar(sidecar, data)
+        return data
+
+    def add(self, file_path: Path, meta: UploadMeta, result: UploadResult) -> Optional[Path]:
+        """Move a recording whose upload failed into the spool. Returns its new path."""
+        try:
+            self.directory.mkdir(parents=True, exist_ok=True)
+            dest = self.directory / file_path.name
+            sidecar = dest.with_name(dest.name + SIDECAR_SUFFIX)
+            now = self._clock()
+            self._write_sidecar(sidecar, {
+                **asdict(meta),
+                "spooled_at": now,
+                "attempts": 1,
+                "next_attempt_at": now + self._backoff(1),
+                "last_error": result.detail,
+                "last_status": result.status,
+            })
+            shutil.move(str(file_path), str(dest))
+            _fsync_dir(self.directory)
+        except Exception as e:
+            logger.error(f"Could not spool recording for call {meta.call_id} ({e}) — audio is lost.")
+            return None
+        logger.warning(
+            f"Upload of call {meta.call_id} failed ({result.detail}) — spooled for retry "
+            f"({self.stats()['files']} waiting)."
+        )
+        self._wake.set()
+        return dest
+
+    def _entries(self) -> List[Tuple[Path, Path, Dict[str, Any]]]:
+        """(audio, sidecar, data) oldest first. Cleans up half-written pairs."""
+        if not self.directory.is_dir():
+            return []
+        entries = []
+        sidecars = set()
+        for sidecar in self.directory.glob(f"*{SIDECAR_SUFFIX}"):
+            audio = sidecar.with_name(sidecar.name[: -len(SIDECAR_SUFFIX)])
+            sidecars.add(audio.name)
+            if not audio.exists():
+                sidecar.unlink(missing_ok=True)
+                continue
+            try:
+                data = json.loads(sidecar.read_text())
+                if not data.get("call_id"):
+                    raise ValueError("no call_id")
+            except Exception as e:
+                data = self._recover_sidecar(audio, sidecar, f"unreadable sidecar ({e})")
+                if data is None:
+                    continue
+            entries.append((audio, sidecar, data))
+        for audio in list(self.directory.iterdir()):
+            if audio.is_file() and not audio.name.endswith((SIDECAR_SUFFIX, ".tmp")) and audio.name not in sidecars:
+                sidecar = audio.with_name(audio.name + SIDECAR_SUFFIX)
+                data = self._recover_sidecar(audio, sidecar, "no metadata sidecar")
+                if data is not None:
+                    entries.append((audio, sidecar, data))
+        entries.sort(key=lambda e: (e[2].get("spooled_at", 0.0), e[0].name))
+        return entries
+
+    @staticmethod
+    def _remove(audio: Path, sidecar: Path) -> None:
+        # Audio first: a crash in between leaves a sidecar, which _entries() cleans.
+        audio.unlink(missing_ok=True)
+        sidecar.unlink(missing_ok=True)
+
+    def stats(self) -> Dict[str, Any]:
+        entries = self._entries()
+        size = 0
+        for audio, _, _ in entries:
+            try:
+                size += audio.stat().st_size
+            except OSError:
+                pass
+        oldest = entries[0][2].get("spooled_at") if entries else None
+        return {
+            "files": len(entries),
+            "bytes": size,
+            "oldest_age_seconds": round(self._clock() - oldest, 1) if oldest else None,
+            "last_result": self.last_result,
+        }
+
+    def enforce_caps(self) -> int:
+        """Drop expired entries, then the oldest until under max_bytes. Returns how many went."""
+        entries = self._entries()
+        now = self._clock()
+        dropped = 0
+        kept = []
+        for audio, sidecar, data in entries:
+            if now - data.get("spooled_at", now) > self.max_age_seconds:
+                logger.error(
+                    f"Spooled call {data['call_id']} was never uploaded within "
+                    f"{self.max_age_seconds / 3600:.0f}h ({data.get('attempts')} attempts, "
+                    f"last: {data.get('last_error')}) — deleting its audio."
+                )
+                self._remove(audio, sidecar)
+                dropped += 1
+            else:
+                kept.append((audio, sidecar, data))
+        sizes = []
+        for audio, sidecar, data in kept:
+            try:
+                sizes.append(audio.stat().st_size)
+            except OSError:
+                sizes.append(0)
+        total = sum(sizes)
+        i = 0
+        while total > self.max_bytes and i < len(kept):
+            audio, sidecar, data = kept[i]
+            logger.error(
+                f"Upload spool over {self.max_bytes} bytes — evicting the oldest, call {data['call_id']}."
+            )
+            self._remove(audio, sidecar)
+            total -= sizes[i]
+            dropped += 1
+            i += 1
+        return dropped
+
+    # ------------------------------------------------------------------
+    # Retry
+    # ------------------------------------------------------------------
+
+    async def drain_once(self, force: bool = False) -> int:
+        """Attempt every due entry (every entry if `force`). Returns how many were uploaded."""
+        self.enforce_caps()
+        uploaded = 0
+        for audio, sidecar, data in self._entries():
+            if not force and data.get("next_attempt_at", 0.0) > self._clock():
+                continue
+            meta = UploadMeta(**{k: data.get(k) for k in UploadMeta.__dataclass_fields__})
+            result = await self._upload(audio, meta)
+            self.last_result = {"call_id": meta.call_id, "kind": result.kind, "status": result.status,
+                                "detail": result.detail, "epoch": self._clock()}
+            if result.kind == OK:
+                logger.info(f"Spooled call {meta.call_id} uploaded after {data.get('attempts')} failed attempt(s).")
+                self._remove(audio, sidecar)
+                uploaded += 1
+            elif result.kind == REJECT:
+                logger.error(
+                    f"C2 rejected spooled call {meta.call_id} ({result.detail}) — not retryable, deleting it."
+                )
+                self._remove(audio, sidecar)
+            else:
+                attempts = int(data.get("attempts", 1)) + 1
+                data.update(attempts=attempts, last_error=result.detail, last_status=result.status,
+                            next_attempt_at=self._clock() + self._backoff(attempts))
+                self._write_sidecar(sidecar, data)
+                logger.warning(
+                    f"Retry {attempts} of spooled call {meta.call_id} failed ({result.detail}); next in "
+                    f"{self._backoff(attempts):.0f}s."
+                )
+                # C2 is still down: the rest would fail the same way. Leave them
+                # for their own timers rather than hammering it in one pass.
+                break
+        return uploaded
+
+    def wake(self) -> None:
+        """Retry everything now (e.g. a new API key just arrived)."""
+        for audio, sidecar, data in self._entries():
+            if data.get("next_attempt_at", 0.0) > self._clock():
+                data["next_attempt_at"] = self._clock()
+                self._write_sidecar(sidecar, data)
+        self._wake.set()
+
+    async def _run(self) -> None:
+        # Startup drain: whatever survived a restart is attempted immediately.
+        force = True
+        while True:
+            try:
+                await self.drain_once(force=force)
+            except asyncio.CancelledError:
+                raise
+            except Exception as e:
+                logger.error(f"Upload spool pass failed: {e}")
+            force = False
+            self._wake.clear()
+            try:
+                await asyncio.wait_for(self._wake.wait(), timeout=self.poll_seconds)
+            except asyncio.TimeoutError:
+                pass
+
+    def start(self) -> None:
+        if self._task is None or self._task.done():
+            pending = len(self._entries())
+            if pending:
+                logger.info(f"Upload spool has {pending} recording(s) from before this start — draining.")
+            self._task = asyncio.create_task(self._run())
+
+    async def stop(self) -> None:
+        if self._task:
+            self._task.cancel()
+            try:
+                await self._task
+            except asyncio.CancelledError:
+                pass
+            self._task = None

drb-edge-node/app/main.py

@@ -111,8 +111,20 @@ async def on_call_end(data: dict):
         )
         if audio_url:
             data["audio_url"] = audio_url
-        else:
-            logger.error(f"Audio upload failed for call {data['call_id']}. Verify C2_URL and Node API Key.")
+        elif settings.c2_url:
+            last = call_recorder.spool.last_result or {}
+            if last.get("kind") == "lost":
+                data["audio_upload"] = "lost"
+            elif last.get("kind") == "retry":
+                # The file is in the upload spool and will be retried; C2 attaches
+                # it to this call_id whenever it lands (node-26#44).
+                data["audio_upload"] = "spooled"
+            else:
+                data["audio_upload"] = "rejected"
+                logger.error(
+                    f"Audio upload for call {data['call_id']} was rejected ({last.get('detail')}). "
+                    "C2 refused this recording (malformed request or file too large); it was not kept."
+                )
     elif recording is not None and recording.all_silence:
         # Explicit policy: an all-silence recording is not uploaded. It has no
         # transcript value and silence is what makes Whisper invent text.
@@ -144,20 +156,11 @@ async def on_command(payload: dict):
     action = payload.get("action")
     logger.info(f"Command received: {action}")
 
-    if action == "discord_join":
-        token = payload.get("token")
-        if not token:
-            logger.error("discord_join command missing token — ignoring.")
-            return
-        await radio_bot.join(
-            guild_id=int(payload["guild_id"]),
-            channel_id=int(payload["channel_id"]),
-            token=token,
-            call_active=metadata_watcher.is_active,
-            system_name=payload.get("system_name"),
-        )
-    elif action == "discord_leave":
-        await radio_bot.leave()
+    if action in ("discord_join", "discord_leave"):
+        # Pre-desired-state C2. Discord streams now arrive on
+        # nodes/{id}/discord/desired (node-26#25); a raw-token join is refused
+        # so a bot token is never taken from an MQTT command again.
+        logger.warning(f"Ignoring legacy {action} command — Discord radio is driven by desired state now.")
     elif action in ("set_sdr_config", "set_secondary_priority"):
         from app.internal.sdr_settings import set_sdr_settings
         try:
@@ -165,22 +168,22 @@ async def on_command(payload: dict):
         except ValueError as e:
             logger.error(f"Rejected SDR settings from C2: {e}")
     elif action == "op25_restart":
-        from app.internal.op25_client import op25_client
-        await op25_client.stop()
+        # Restarts whichever recorder is active (node-26#45): C2 still calls
+        # it "Restart OP25".
+        from app.internal import radio_backend
+        await radio_backend.stop()
         await asyncio.sleep(2)
-        await op25_client.start()
+        await radio_backend.start()
     elif action == "node_update":
-        # TODO: Full OTA update — register a host-level systemd service (e.g. drb-update.service)
-        # that stops all DRB containers, runs `docker compose pull`, then `docker compose up -d`.
-        # The C2 server triggers it by sending this MQTT command; the host service watches for the
-        # restart signal (e.g. via a Unix socket, a sentinel file, or a lightweight webhook).
-        # Not implemented yet — for now, just restart the container so any pre-pulled image
-        # is picked up (requires a prior `docker compose pull` on the host).
-        logger.info("Node update requested — restarting container to pick up latest image.")
-        await mqtt_manager.publish_status("offline")
-        await asyncio.sleep(1)
-        import os
-        os._exit(0)  # Docker restart=unless-stopped will bring the container back up
+        # node-26#15: the container cannot (and must not) update itself. It
+        # drops a sentinel in /configs; the host's drb-update.path unit
+        # (installed by install.sh) sees it and runs drb-update.service, which
+        # pulls the node's own pinned repo ref + images and recreates the
+        # stack. The sentinel's content is ignored by the host — C2 cannot
+        # choose what gets installed. Offline/locked-out nodes get the same
+        # request over HTTPS via the updater's timer instead.
+        from app.internal.update_request import request_host_update
+        request_host_update()
     else:
         logger.warning(f"Unknown command: {action}")
 
@@ -189,39 +192,43 @@ async def on_api_key(payload: dict):
     key = payload.get("api_key")
     if key:
         credentials.save_api_key(key)
+        mqtt_manager.update_api_key(key)
+        # Uploads spooled on a 401 can go now rather than at their next backoff.
+        call_recorder.spool.wake()
         logger.info("Node API key received and saved.")
 
 
-def _to_hz(freq) -> int:
-    """Convert a frequency to Hz. Accepts MHz floats (< 1e6) or Hz ints."""
-    f = float(freq)
-    return int(f * 1_000_000) if f < 1_000_000 else int(f)
-
-
 async def _generate_op25_config(config: SystemConfig) -> bool:
-    """Translate a SystemConfig (Firestore format) into OP25 active.cfg.json + op25.liq."""
+    """Translate a SystemConfig (Firestore format) into OP25 active.cfg.json + op25.liq.
+
+    Trunked / conventional / analog are told apart in radio_config (node-26#24);
+    a system saved before that has no `mode` and is trunked, as it always was.
+
+    With RECORDER_BACKEND=trunk-recorder this writes Trunk Recorder's
+    config.json instead (node-26#45) — the one place every caller (C2 push,
+    dashboard, startup resume) goes through.
+    """
+    from app.internal import trunk_recorder as tr
+    if tr.enabled():
+        return await tr.trunk_recorder.apply_config(config)
     from app.internal.op25_client import op25_client
+    from app.internal.radio_config import build_generate_payload
     node_cfg = load_node_config()
-    raw = config.config
-    payload = {
-        "type": config.type,
-        "systemName": config.name,
-        "channels": [_to_hz(ch) for ch in raw.get("control_channels", [])],
-        "tags": [
-            {"talkgroup": str(tg.get("name", "")), "tagDec": int(tg["id"])}
-            for tg in raw.get("talkgroups", [])
-            if tg.get("id") is not None
-        ],
-        "whitelist": [int(tg["id"]) for tg in raw.get("talkgroups", []) if tg.get("id") is not None],
-        "icecastConfig": {
-            "icecast_host": settings.icecast_host,
-            "icecast_port": settings.icecast_port,
-            "icecast_mountpoint": settings.icecast_mount,
-            "icecast_password": settings.icecast_source_password,
-        },
-        "hardware_preset": node_cfg.hardware_preset,
-        **({"ppm_override": node_cfg.ppm_override} if node_cfg.ppm_override is not None else {}),
-    }
+    try:
+        payload = build_generate_payload(
+            config.type, config.name, config.config,
+            icecast={
+                "icecast_host": settings.icecast_host,
+                "icecast_port": settings.icecast_port,
+                "icecast_mountpoint": settings.icecast_mount,
+                "icecast_password": settings.icecast_source_password,
+            },
+            hardware_preset=node_cfg.hardware_preset,
+            ppm_override=node_cfg.ppm_override,
+        )
+    except ValueError as e:
+        logger.error(f"System {config.name!r} has an unusable channel list: {e}")
+        return False
     return await op25_client.generate_config(payload)
 
 
@@ -266,19 +273,20 @@ async def on_config_push(payload: dict):
             logger.error(f"Ignoring invalid sdr_pins in config push: {e}")
     save_node_config(node_cfg)
 
-    from app.internal.op25_client import op25_client
+    from app.internal import radio_backend
     if not await _generate_op25_config(config):
-        logger.error(f"Failed to generate OP25 config for {config.name}")
+        logger.error(f"Failed to generate {radio_backend.name()} config for {config.name}")
         return
 
     # OP25's (pinned) dongle may be one a decoder holds right now: free the
     # spares, restart OP25 on its own dongle, then hand the rest back out.
+    # (Trunk Recorder takes the same dongle — node-26#45.)
     from app.internal.secondary_sdr_client import secondary_sdr_client
     from app.internal.sdr_settings import apply_secondaries
     await secondary_sdr_client.apply([], {}, [])
-    await op25_client.stop()
+    await radio_backend.stop()
     await asyncio.sleep(2)
-    await op25_client.start()
+    await radio_backend.start()
     logger.info(f"Config push applied: {config.name}")
     await apply_secondaries()
 
@@ -307,11 +315,25 @@ async def lifespan(app: FastAPI):
     mqtt_manager.on_command = on_command
     mqtt_manager.on_config_push = on_config_push
     mqtt_manager.on_api_key = on_api_key
+    mqtt_manager.on_discord_desired = radio_bot.apply_desired
 
-    # Start services (radio_bot starts on-demand when a discord_join command arrives)
+    # Start services (radio_bot starts when C2's retained discord/desired arrives)
     await mqtt_manager.connect()
-    await metadata_watcher.start()
-    await call_recorder.start()  # persistent PulseAudio ring buffer
+    from app.internal import radio_backend
+    from app.internal import trunk_recorder as tr
+    if tr.enabled():
+        # node-26#45: Trunk Recorder records; the OP25 watcher and the
+        # PulseAudio recorder stay off so no call is uploaded twice. Only the
+        # upload spool runs. OP25 is stopped in case it was running before the
+        # backend was switched — it would hold the SDR Trunk Recorder needs.
+        logger.info("Recorder backend: Trunk Recorder (OP25 and the PulseAudio recorder are off).")
+        from app.internal.op25_client import op25_client
+        await op25_client.stop()
+        await call_recorder.start(capture=False)
+        await tr.trunk_recorder.start()
+    else:
+        await metadata_watcher.start()
+        await call_recorder.start()  # persistent PulseAudio ring buffer
 
     # Start system caching in background
     from app.internal.system_cacher import fetch_and_cache_systems
@@ -331,13 +353,14 @@ async def lifespan(app: FastAPI):
     # not-yet-approved node listening to a system chosen on the local
     # dashboard (an override) must come back on it after a reboot too.
     if active_config:
-        from app.internal.op25_client import op25_client
-        logger.info("Node has a system to listen to — waiting for OP25 API then generating config.")
+        logger.info(f"Node has a system to listen to — generating the {radio_backend.name()} config.")
         for attempt in range(10):
             if await _generate_op25_config(active_config):
-                await op25_client.start()
+                # No wait at startup: the trunk-recorder container may still be
+                # coming up, and the app must start serving regardless.
+                await radio_backend.start(wait=False)
                 break
-            logger.warning(f"OP25 not ready yet (attempt {attempt + 1}/10), retrying in 3s…")
+            logger.warning(f"{radio_backend.name()} not ready yet (attempt {attempt + 1}/10), retrying in 3s…")
             await asyncio.sleep(3)
 
     # After op25 has claimed its dongle, so the decoders only get the spares.
@@ -356,6 +379,7 @@ async def lifespan(app: FastAPI):
     heartbeat_task.cancel()
     telemetry_task.cancel()
     await metadata_watcher.stop()
+    await tr.trunk_recorder.stop()
     await call_recorder.stop()
     await radio_bot.stop()
     await mqtt_manager.disconnect()

drb-edge-node/app/routers/api.py

@@ -37,9 +37,12 @@ async def get_status():
         else node_cfg.system_config
     )
     system_type = None
+    system_kind = None
     if active_config:
+        from app.internal.radio_config import system_kind as _kind
         system_name = active_config.name
         system_type = active_config.type
+        system_kind = _kind(active_config.type, active_config.config)
         if active_tgid:
             # Reverse engineer the TGID to talkgroup name based on active system object
             tgs = active_config.config.get("talkgroups", [])
@@ -61,6 +64,8 @@ async def get_status():
         "assigned_system_id": node_cfg.assigned_system_id,
         "system_name": system_name,
         "system_type": system_type,
+        # Human label that tells P25 trunked from P25 conventional (node-26#24).
+        "system_kind": system_kind,
         # True when what OP25 is tuned to was chosen on this dashboard rather
         # than assigned by C2 (a local override, revertible to C2's system).
         "local_choice": bool(node_cfg.override_system_id and node_cfg.override_config),
@@ -77,6 +82,9 @@ async def get_status():
         # it was discarded rather than uploaded. Non-zero means either the
         # console is not decoding or something else is feeding drb_sink.
         "unattributed_segments": metadata_watcher.unattributed_segments,
+        # Recordings whose upload to C2 failed and are waiting for a retry
+        # (node-26#44), plus the outcome of the most recent upload attempt.
+        "upload_spool": call_recorder.spool.stats(),
         "active_tgid": active_tgid,
         "active_tgid_name": active_tgid_name,
         "active_call_id": metadata_watcher.active_call_id,
@@ -89,9 +97,18 @@ async def get_status():
         "icecast_port": settings.icecast_port,
         "icecast_mount": settings.icecast_mount,
         "op25": op25_status,
+        # Which recorder is live (node-26#45) and, for Trunk Recorder, its
+        # supervisor state / decode rate / handed-over calls.
+        "recorder_backend": settings.recorder_backend,
+        "trunk_recorder": _tr_facts(),
     }
 
 
+def _tr_facts():
+    from app.internal import trunk_recorder as tr
+    return tr.trunk_recorder.health_facts() if tr.enabled() else None
+
+
 @router.get("/health")
 async def get_health():
     """Plain-language setup/status checklist for the dashboard (see internal/health.py)."""
@@ -102,7 +119,9 @@ async def get_health():
 
 @router.post("/op25/start")
 async def start_op25():
-    err = await op25_client.start_with_reason()
+    # The active recorder (node-26#45) — the dashboard's Start button.
+    from app.internal import radio_backend
+    err = await radio_backend.start_with_reason()
     if err:
         raise HTTPException(502, err)
     return {"ok": True}
@@ -110,14 +129,18 @@ async def start_op25():
 
 @router.post("/op25/stop")
 async def stop_op25():
-    ok = await op25_client.stop()
+    from app.internal import radio_backend
+    ok = await radio_backend.stop()
     if not ok:
-        raise HTTPException(502, "The op25 container did not answer the stop request.")
+        raise HTTPException(502, f"{radio_backend.name()} did not accept the stop request.")
     return {"ok": True}
 
 
 @router.get("/op25/log")
 async def op25_log(lines: int = 80):
+    from app.internal import trunk_recorder as tr
+    if tr.enabled():
+        return {"lines": tr.trunk_recorder.log_tail(lines)}
     out = await op25_client.log(lines)
     if out is None:
         raise HTTPException(502, "The op25 container isn't answering.")
@@ -130,17 +153,22 @@ async def get_config():
 
 
 async def _restart_op25_with(config: SystemConfig) -> None:
-    """Generate OP25's config for `config` and restart OP25 on it."""
+    """Generate the active recorder's config for `config` and restart it on it."""
     from app.main import _generate_op25_config
+    from app.internal import radio_backend
     if not await _generate_op25_config(config):
+        from app.internal import trunk_recorder as tr
+        if tr.enabled():
+            detail = tr.trunk_recorder.config_error or f"Trunk Recorder config for {config.name} failed."
+            raise HTTPException(502, detail)
         raise HTTPException(
             502, f"The op25 container did not accept the config for {config.name} — is it running?",
         )
-    await op25_client.stop()
+    await radio_backend.stop()
     await asyncio.sleep(2)
-    err = await op25_client.start_with_reason()
+    err = await radio_backend.start_with_reason()
     if err:
-        raise HTTPException(502, f"Config saved, but OP25 did not start: {err}")
+        raise HTTPException(502, f"Config saved, but {radio_backend.name()} did not start: {err}")
 
 
 async def _apply_override(config: SystemConfig) -> None:
@@ -192,11 +220,20 @@ class Talkgroup(BaseModel):
 
 class ListenBody(BaseModel):
     """What to listen to, chosen on the local dashboard."""
-    mode: Literal["system", "p25", "analog"]
+    mode: Literal["system", "p25", "p25conv", "analog"]
     system_id: Optional[str] = None       # mode=system: a cached C2 system
     name: Optional[str] = None
-    frequencies: List[float] = []          # MHz; p25 = control channels, analog = exactly one
+    # MHz. p25 = control channels; p25conv = 1-2 voice channels (node-26#24);
+    # analog = exactly one.
+    frequencies: List[float] = []
     talkgroups: List[Talkgroup] = []       # p25 only; empty = every talkgroup
+    nac: Optional[str] = None              # p25conv only, hex; empty = any NAC
+    # analog only (node-26#46): OP25 squelch. noise (default) needs no
+    # calibration; squelch_db = dB of quieting to open (OP25 default 8);
+    # squelch_threshold = absolute dB for power mode (OP25 default -60).
+    squelch_mode: Optional[Literal["noise", "voice", "power"]] = None
+    squelch_db: Optional[float] = None
+    squelch_threshold: Optional[float] = None
 
 
 # RTL-SDR (R820T/R828D) tuning range.
@@ -225,22 +262,69 @@ async def listen(body: ListenBody):
             )
         if body.mode == "analog" and len(freqs) != 1:
             raise HTTPException(400, "Analog listens to exactly one frequency.")
-        is_p25 = body.mode == "p25"
         first = f"{freqs[0]:.5f}".rstrip("0").rstrip(".")
-        label = (body.name or "").strip() or (f"P25 {first} MHz" if is_p25 else f"Analog {first} MHz")
-        config = SystemConfig(
-            system_id=f"local-{body.mode}",
-            name=label,
-            type="P25" if is_p25 else "NBFM",
-            config={
+        if body.mode == "p25conv":
+            config = _conventional_listen_config(body, freqs, first)
+        else:
+            is_p25 = body.mode == "p25"
+            label = (body.name or "").strip() or (f"P25 {first} MHz" if is_p25 else f"Analog {first} MHz")
+            sys_config = {
                 "control_channels": freqs,
                 "talkgroups": [tg.model_dump() for tg in body.talkgroups] if is_p25 else [],
-            },
-        )
+            }
+            if not is_p25:
+                sys_config["squelch_mode"] = body.squelch_mode or "noise"
+                if body.squelch_db is not None:
+                    sys_config["squelch_db"] = body.squelch_db
+                if body.squelch_threshold is not None:
+                    sys_config["squelch_threshold"] = body.squelch_threshold
+            config = SystemConfig(
+                system_id=f"local-{body.mode}",
+                name=label,
+                type="P25" if is_p25 else "NBFM",
+                config=sys_config,
+            )
     await _apply_override(config)
     return {"ok": True, "name": config.name}
 
 
+# One SDR's usable passband, less a channel's width — op25-container makes the
+# exact check; this one just turns the common mistake into a readable error.
+_CONVENTIONAL_MAX_SPAN_MHZ = 1.5
+
+
+def _conventional_listen_config(body: ListenBody, freqs: List[float], first: str) -> SystemConfig:
+    from app.internal.radio_config import MAX_CONVENTIONAL_CHANNELS, parse_nac
+    if len(freqs) > MAX_CONVENTIONAL_CHANNELS:
+        raise HTTPException(400, f"P25 conventional listens to at most {MAX_CONVENTIONAL_CHANNELS} channels.")
+    if len(set(freqs)) != len(freqs):
+        raise HTTPException(400, "The same frequency is entered twice.")
+    if max(freqs) - min(freqs) > _CONVENTIONAL_MAX_SPAN_MHZ:
+        raise HTTPException(
+            400, f"Those channels are {max(freqs) - min(freqs):.3f} MHz apart — one SDR covers about "
+            f"{_CONVENTIONAL_MAX_SPAN_MHZ:g} MHz. Pick channels closer together.",
+        )
+    try:
+        nac = parse_nac(body.nac)
+    except ValueError as e:
+        raise HTTPException(400, str(e))
+    label = (body.name or "").strip() or f"P25 conventional {first} MHz"
+    return SystemConfig(
+        system_id="local-p25conv",
+        name=label,
+        type="P25",
+        config={
+            "mode": "conventional",
+            "channels": [
+                {"freq": f, "name": f"{label} {f:.4f}" if len(freqs) > 1 else label,
+                 **({"nac": f"{nac:03X}"} if nac is not None else {})}
+                for f in freqs
+            ],
+            "talkgroups": [],
+        },
+    )
+
+
 @router.get("/systems")
 async def get_systems():
     from app.internal.system_cacher import load_cached_systems, fetch_and_cache_systems
@@ -286,7 +370,8 @@ async def revert_config():
     else:
         # Nothing from C2 to go back to: stop rather than keep decoding a
         # system the dashboard now says is cleared.
-        await op25_client.stop()
+        from app.internal import radio_backend
+        await radio_backend.stop()
 
     if mqtt_manager.is_connected:
         await mqtt_manager.publish_checkin()
@@ -352,15 +437,25 @@ async def set_sdr(body: SdrSettingsBody):
     return {"ok": True, "running": running}
 
 
+@router.get("/discord")
+async def discord_status():
+    """What the node's radio bots are doing (desired state from C2, actual here)."""
+    return radio_bot.snapshot()
+
+
 @router.post("/discord/join")
-async def discord_join(guild_id: int, channel_id: int):
-    ok = await radio_bot.join(guild_id, channel_id)
-    if not ok:
-        raise HTTPException(500, "Failed to join voice channel")
-    return {"ok": True}
+async def discord_join():
+    # node-26#25 item 4: this used to call join() without a token and 500 every
+    # time. A node cannot lease a radio bot by itself — C2 owns the pool.
+    raise HTTPException(
+        409,
+        "Discord radio channels are started from Discord (/join) or the DRB web app; "
+        "the node cannot pick a radio bot on its own.",
+    )
 
 
 @router.post("/discord/leave")
 async def discord_leave():
-    await radio_bot.leave()
+    """Local stop: log every radio bot out until DRB sends a new channel list."""
+    await radio_bot.pause_locally()
     return {"ok": True}

drb-edge-node/app/templates/index.html

@@ -142,6 +142,7 @@
     <audio id="player" controls preload="none">Your browser can't play the stream — use the direct link.</audio>
     <dl class="kv">
       <dt>Listening to</dt><dd id="now-system">—</dd>
+      <dt>Recorder</dt><dd id="now-backend">—</dd>
       <dt>Talkgroup</dt><dd id="now-tg">—</dd>
       <dt>Last heard</dt><dd id="now-heard">—</dd>
       <dt>Stream link</dt><dd><a id="stream-link" class="mono" href="#" target="_blank" rel="noopener">—</a></dd>
@@ -167,6 +168,7 @@
 
     <div class="tabs" role="radiogroup" aria-label="Source type">
       <label><input type="radio" name="mode" value="p25" checked> P25 trunked</label>
+      <label><input type="radio" name="mode" value="p25conv"> P25 conventional</label>
       <label><input type="radio" name="mode" value="analog"> Analog FM</label>
       <label><input type="radio" name="mode" value="system" id="mode-system"> Server's systems</label>
     </div>
@@ -188,6 +190,23 @@
       </div>
     </div>
 
+    <div class="pane" data-pane="p25conv" hidden>
+      <div class="field">
+        <label for="pc-freqs">Channel frequencies (MHz)</label>
+        <input type="text" id="pc-freqs" class="mono" placeholder="460.4000, 460.4250" inputmode="decimal">
+        <span class="hint">One or two voice channels, comma-separated, within about 1.5 MHz of each other. No control channel — RadioReference lists these as conventional frequencies with mode P25 (or "DE").</span>
+      </div>
+      <div class="field">
+        <label for="pc-name">Name <span class="hint">(optional)</span></label>
+        <input type="text" id="pc-name" placeholder="City PD">
+      </div>
+      <div class="field">
+        <label for="pc-nac">NAC <span class="hint">(optional, hex)</span></label>
+        <input type="text" id="pc-nac" class="mono" placeholder="293">
+        <span class="hint">RadioReference's NAC for these channels. Leave empty to accept any.</span>
+      </div>
+    </div>
+
     <div class="pane" data-pane="analog" hidden>
       <div class="field">
         <label for="an-freq">Frequency (MHz)</label>
@@ -198,6 +217,20 @@
         <label for="an-name">Name <span class="hint">(optional)</span></label>
         <input type="text" id="an-name" placeholder="Fire dispatch">
       </div>
+      <div class="field">
+        <label for="an-sq-mode">Squelch</label>
+        <select id="an-sq-mode">
+          <option value="noise" selected>Noise (recommended)</option>
+          <option value="voice">Voice (noise + speech detector)</option>
+          <option value="power">Power (old, needs calibration)</option>
+        </select>
+        <span class="hint">Noise squelch opens on a real carrier and needs no tuning per site.</span>
+      </div>
+      <div class="field">
+        <label for="an-sq-level">Squelch level (dB) <span class="hint">(optional)</span></label>
+        <input type="text" id="an-sq-level" class="mono" placeholder="8" inputmode="decimal">
+        <span class="hint" id="an-sq-hint">Noise/voice: dB of quieting to open — 8 default, 12-15 for strong signals only, ~5 for weak ones.</span>
+      </div>
     </div>
 
     <div class="pane" data-pane="system" hidden>
@@ -286,7 +319,8 @@
         ? `<span class="mono">TG ${esc(heard.tgid)}</span>${heard.name ? ' ' + esc(heard.name) : ''}` +
           ` · ${ago(heard.epoch)}${heard.freq ? ` · <span class="mono">${esc(mhz(heard.freq))}</span>` : ''}`
         : 'Nothing heard since the node started.';
-      const op = d.checks.find(c => c.id === 'op25');
+      // 'recorder' is the Trunk Recorder backend's check (node-26#45).
+      const op = d.checks.find(c => c.id === 'op25' || c.id === 'recorder');
       const src = d.checks.find(c => c.id === 'source');
       const running = op && op.state === 'ok';
       $('op25-start').disabled = running || (src && src.state !== 'ok');
@@ -307,7 +341,16 @@
       $('node-name').textContent = d.node_name || 'DRB Edge Node';
       $('node-id').textContent = d.node_id || '';
       document.title = `${d.node_name || 'DRB Edge Node'} — DRB`;
-      $('now-system').textContent = d.system_name ? `${d.system_name} (${d.system_type})` : 'Nothing chosen yet';
+      $('now-system').textContent = d.system_name ? `${d.system_name} (${d.system_kind || d.system_type})` : 'Nothing chosen yet';
+      const isTR = d.recorder_backend === 'trunk-recorder';
+      const trState = isTR && d.trunk_recorder && d.trunk_recorder.status ? d.trunk_recorder.status.state : null;
+      $('now-backend').textContent = isTR
+        ? `Trunk Recorder${trState ? ` (${trState.replace(/_/g, ' ')})` : ' (not running)'} — every talkgroup recorded at once`
+        : 'OP25 — one call at a time';
+      recorderName = isTR ? 'Trunk Recorder' : 'OP25';
+      $('op25-start').textContent = `Start ${recorderName}`;
+      $('op25-stop').textContent = `Stop ${recorderName}`;
+      if ($('op25-log').hidden) $('log-toggle').textContent = `Show ${recorderName} log`;
       $('now-tg').innerHTML = d.active_tgid
         ? `<span class="live">${esc(d.active_tgid_name || 'Talkgroup')}</span> <span class="mono">TG ${esc(d.active_tgid)}</span>`
         : 'No call right now';
@@ -335,14 +378,15 @@
       actions.hidden = true;
       return;
     }
-    cur.innerHTML = `Now: <strong>${esc(d.system_name)}</strong> (${esc(d.system_type)}) — ` +
+    cur.innerHTML = `Now: <strong>${esc(d.system_name)}</strong> (${esc(d.system_kind || d.system_type)}) — ` +
       (d.local_choice ? 'chosen on this dashboard.' : 'assigned by the DRB server.');
     actions.hidden = !d.local_choice;
     $('revert-btn').textContent = d.has_c2_system ? "Go back to the server's system" : 'Clear and stop';
     $('ack-btn').hidden = !(d.local_choice && d.has_c2_system && d.enforce_override_timeout);
   }
 
-  // ── OP25 controls + log ────────────────────────────────────────────────
+  // ── OP25 / Trunk Recorder controls + log ───────────────────────────────
+  let recorderName = 'OP25';
   async function op25(action) {
     $('op25-msg').className = 'msg';
     $('op25-msg').textContent = action === 'start' ? 'Starting…' : 'Stopping…';
@@ -359,25 +403,32 @@
     const pre = $('op25-log');
     try {
       const d = await api('/api/op25/log?lines=120');
-      pre.textContent = d.lines.length ? d.lines.join('\n') : 'OP25 has printed nothing since it last started.';
+      pre.textContent = d.lines.length ? d.lines.join('\n') : `${recorderName} has printed nothing since it last started.`;
     } catch (e) {
       pre.textContent = `Couldn't load the log: ${e.message}`;
     }
     pre.hidden = false;
-    $('log-toggle').textContent = 'Hide OP25 log';
+    $('log-toggle').textContent = `Hide ${recorderName} log`;
     $('log-toggle').setAttribute('aria-expanded', 'true');
   }
   function toggleLog() {
     const pre = $('op25-log');
     if (pre.hidden) return loadLog();
     pre.hidden = true;
-    $('log-toggle').textContent = 'Show OP25 log';
+    $('log-toggle').textContent = `Show ${recorderName} log`;
     $('log-toggle').setAttribute('aria-expanded', 'false');
   }
 
   // ── Listen locally ─────────────────────────────────────────────────────
   let systems = [];
   function mode() { return document.querySelector('input[name=mode]:checked').value; }
+  $('an-sq-mode').addEventListener('change', () => {
+    const power = $('an-sq-mode').value === 'power';
+    $('an-sq-level').placeholder = power ? '-60' : '8';
+    $('an-sq-hint').textContent = power
+      ? 'Power: absolute signal level in dB to open (-60 default); depends on this SDR, gain and antenna.'
+      : 'Noise/voice: dB of quieting to open — 8 default, 12-15 for strong signals only, ~5 for weak ones.';
+  });
   document.querySelectorAll('input[name=mode]').forEach(r => r.addEventListener('change', () => {
     document.querySelectorAll('.pane').forEach(p => { p.hidden = p.dataset.pane !== mode(); });
     $('listen-msg').textContent = '';
@@ -387,7 +438,9 @@
     try { systems = await api('/api/systems'); } catch (e) { systems = []; }
     const pick = $('sys-pick');
     const usable = systems.filter(s => String(s.type).toUpperCase() !== 'DMR');
-    pick.innerHTML = usable.map(s => `<option value="${esc(s.system_id)}">${esc(s.name)} (${esc(s.type)})</option>`).join('');
+    const kind = s => String(s.type).toUpperCase() === 'P25' && s.config && s.config.mode === 'conventional'
+      ? 'P25 conventional' : s.type;
+    pick.innerHTML = usable.map(s => `<option value="${esc(s.system_id)}">${esc(s.name)} (${esc(kind(s))})</option>`).join('');
     const none = usable.length === 0;
     $('mode-system').disabled = none;
     pick.disabled = none;
@@ -416,10 +469,19 @@
         tgs.push({ id: Number(mm[1]), name: mm[2] });
       }
       body = { mode: 'p25', frequencies: freqs, name: $('p25-name').value, talkgroups: tgs };
+    } else if (m === 'p25conv') {
+      const freqs = parseFreqs($('pc-freqs').value);
+      if (!freqs.length || freqs.length > 2 || freqs.some(isNaN)) { msg.className = 'msg err'; msg.textContent = 'Enter one or two channel frequencies in MHz, e.g. 460.4000, 460.4250'; return; }
+      body = { mode: 'p25conv', frequencies: freqs, name: $('pc-name').value, nac: $('pc-nac').value.trim() || null };
     } else {
       const freqs = parseFreqs($('an-freq').value);
       if (freqs.length !== 1 || isNaN(freqs[0])) { msg.className = 'msg err'; msg.textContent = 'Enter one frequency in MHz, e.g. 154.4300'; return; }
-      body = { mode: 'analog', frequencies: freqs, name: $('an-name').value };
+      const sqMode = $('an-sq-mode').value;
+      const sqRaw = $('an-sq-level').value.trim();
+      const sqLevel = sqRaw === '' ? null : Number(sqRaw);
+      if (sqLevel !== null && isNaN(sqLevel)) { msg.className = 'msg err'; msg.textContent = 'Squelch level must be a number of dB, e.g. 8 (or -60 for power mode).'; return; }
+      body = { mode: 'analog', frequencies: freqs, name: $('an-name').value, squelch_mode: sqMode };
+      if (sqLevel !== null) body[sqMode === 'power' ? 'squelch_threshold' : 'squelch_db'] = sqLevel;
     }
     $('listen-btn').disabled = true;
     msg.className = 'msg';

drb-edge-node/requirements.txt

@@ -3,7 +3,9 @@ uvicorn[standard]
 pydantic-settings
 paho-mqtt>=2.0.0
 httpx
-discord.py[voice]
+# >=2.7: Discord requires DAVE (E2EE) voice since 2026-03-01; 2.7 is the first
+# discord.py with it (the [voice] extra pulls `davey`). Older releases cannot join voice.
+discord.py[voice]>=2.7
 PyNaCl
 python-multipart
 pytest

drb-edge-node/tests/test_conventional.py

@@ -0,0 +1,413 @@
+"""
+Conventional channels: P25 conventional (node-26#24) and analog (node-26#20).
+
+Covers the generate-config payload (radio_config), the console normalizer
+(conventional.py) and how the watcher attributes conventional audio. Channel
+rows are shaped like tk_drb_conv's / tk_p25's conventional `channel_update`
+entries; grants like tk_p25.log_call entries.
+"""
+import pytest
+from unittest.mock import AsyncMock
+
+from app.config import settings
+from app.internal import radio_config as rc
+from app.internal.conventional import ConventionalChannels, channel_tgid, NON_DISTINCT_TGIDS
+from app.internal.metadata_watcher import MetadataWatcher
+from tests.test_metadata_watcher import FakeAudio, FakeClock, tick, update
+
+PD1, PD3 = 460_400_000, 460_425_000
+
+
+def conv_row(msgqid=0, freq=PD1, name="PD1 Dispatch", tgid=None, srcaddr=0, voice=False,
+             encrypted=0, **extra):
+    row = {
+        "freq": freq, "name": name, "tgid": tgid, "tag": name, "srcaddr": srcaddr,
+        "encrypted": encrypted, "conventional": True, "msgqid": msgqid, "voice": voice,
+    }
+    row.update(extra)
+    return row
+
+
+def conv_grant(rcvr, tgid, at, freq=PD1, rid=4242):
+    return {"time": at, "sysid": 0, "rcvr": rcvr, "rcvrtag": "", "freq": freq, "slot": 0,
+            "prio": 0, "tgid": tgid, "tgtag": "", "rid": rid, "rtag": ""}
+
+
+# ---------------------------------------------------------------------------
+# radio_config: system document -> op25 generate-config payload
+# ---------------------------------------------------------------------------
+
+ICE = {"icecast_host": "localhost", "icecast_port": 8000, "icecast_mountpoint": "/n", "icecast_password": "p"}
+
+WHITE_PLAINS = {
+    "mode": "conventional",
+    "channels": [
+        {"freq": 460.4, "name": "PD1 Dispatch"},
+        {"freq": 460.425, "name": "PD3 Tac", "nac": "293"},
+    ],
+    "talkgroups": [],
+}
+
+
+def test_conventional_payload():
+    p = rc.build_generate_payload("P25", "White Plains", WHITE_PLAINS, ICE, "rtl-sdr-v3", None)
+    assert p["type"] == "P25" and p["p25_mode"] == "conventional"
+    assert p["channels"] == []    # nothing that could become a control channel
+    assert p["conv_channels"] == [
+        {"frequency": PD1, "name": "PD1 Dispatch", "nac": None},
+        {"frequency": PD3, "name": "PD3 Tac", "nac": 0x293},
+    ]
+    assert "ppm_override" not in p
+
+
+def test_trunked_payload_unchanged_when_mode_missing():
+    cfg = {"control_channels": [851.0125, 851.5125], "talkgroups": [{"id": 9048, "name": "Ossining PD"}]}
+    p = rc.build_generate_payload("P25", "County", cfg, ICE, "other", 1.5)
+    assert "p25_mode" not in p
+    assert p["channels"] == [851_012_500, 851_512_500]
+    assert p["tags"] == [{"talkgroup": "Ossining PD", "tagDec": 9048}]
+    assert p["whitelist"] == [9048]
+    assert p["ppm_override"] == 1.5
+
+
+@pytest.mark.parametrize("cfg", [
+    {"channels": [{"freq": 154.43, "name": "Fire"}]},
+    {"control_channels": [154.43]},                     # saved before #24
+])
+def test_analog_payload_reads_channels_or_legacy(cfg):
+    p = rc.build_generate_payload("NBFM", "Fire", cfg, ICE, "rtl-sdr-v3", None)
+    assert p["channels"] == [154_430_000]
+    assert "p25_mode" not in p
+    assert p["nbfm_squelch_mode"] == "noise"   # node-26#46 default
+
+
+def test_analog_squelch_is_plumbed_and_validated():
+    cfg = {"channels": [{"freq": 154.43}], "squelch_mode": "Power", "squelch_threshold": "-55", "squelch_db": 12}
+    p = rc.build_generate_payload("NBFM", "Fire", cfg, ICE, "rtl-sdr-v3", None)
+    assert p["nbfm_squelch_mode"] == "power" and p["nbfm_squelch"] == -55.0 and p["nbfm_noise_squelch_db"] == 12.0
+    with pytest.raises(ValueError):
+        rc.analog_squelch({"squelch_mode": "loud"})
+    with pytest.raises(ValueError):
+        rc.analog_squelch({"squelch_db": "lots"})
+
+
+def test_system_mode():
+    assert rc.system_mode("P25", {}) == rc.TRUNKED
+    assert rc.system_mode("P25", {"mode": "Conventional"}) == rc.CONVENTIONAL
+    assert rc.system_mode("NBFM", {"mode": "conventional"}) == rc.ANALOG
+    assert rc.system_mode("DMR", {}) == rc.DMR
+
+
+@pytest.mark.parametrize("raw, want", [("293", 0x293), ("0x293", 0x293), (0x293, 0x293), ("", None), (None, None)])
+def test_parse_nac(raw, want):
+    assert rc.parse_nac(raw) == want
+
+
+@pytest.mark.parametrize("raw", ["xyz", "1000", 0, True])
+def test_parse_nac_rejects(raw):
+    with pytest.raises(ValueError):
+        rc.parse_nac(raw)
+
+
+def test_conventional_channel_without_freq_rejected():
+    with pytest.raises(ValueError):
+        rc.conventional_channels({"channels": [{"name": "no freq"}]})
+
+
+# ---------------------------------------------------------------------------
+# Normalizer
+# ---------------------------------------------------------------------------
+
+def test_synthetic_tgid_is_frequency_in_100hz_and_clear_of_p25_space():
+    assert channel_tgid(PD1) == 4_604_000
+    assert channel_tgid(460.4) == 4_604_000
+    assert channel_tgid(460_406_250) != channel_tgid(460_412_500)   # 6.25 kHz steps stay distinct
+    assert channel_tgid(24_000_000) > 0xFFFF                        # lowest RTL-SDR frequency
+
+
+def test_non_distinct_link_control_tgid_becomes_the_channel():
+    conv = ConventionalChannels()
+    up = update(channels=[conv_row(0, PD1, tgid=1, srcaddr=7, voice=True),
+                          conv_row(1, PD3, "PD3 Tac", tgid=1, srcaddr=8, voice=True)])
+    conv.normalize(up)
+    assert [r["tgid"] for r in up.channels] == [4_604_000, 4_604_250]
+    assert [r["lc_tgid"] for r in up.channels] == [1, 1]
+    assert [r["tag"] for r in up.channels] == ["PD1 Dispatch", "PD3 Tac"]
+    assert all(r["drb_active"] for r in up.channels)
+    assert 1 in NON_DISTINCT_TGIDS and 0xFFFF in NON_DISTINCT_TGIDS
+
+
+def test_distinct_link_control_tgid_is_kept():
+    conv = ConventionalChannels()
+    up = update(channels=[conv_row(0, tgid=101, srcaddr=7)],
+                call_log=[conv_grant(0, 101, 1.0)])
+    conv.normalize(up)
+    assert up.channels[0]["tgid"] == 101
+    assert up.call_log[0]["tgid"] == 101
+    assert up.call_log[0]["tgtag"] == "PD1 Dispatch"
+
+
+def test_grants_are_mapped_per_receiver():
+    conv = ConventionalChannels()
+    up = update(channels=[conv_row(0, PD1), conv_row(1, PD3, "PD3 Tac")],
+                call_log=[conv_grant(1, 1, 1.0, freq=PD3)])
+    conv.normalize(up)
+    assert up.call_log[0]["tgid"] == 4_604_250
+    assert up.call_log[0]["tgtag"] == "PD3 Tac"
+
+
+def test_voice_without_link_control_is_still_a_talker():
+    conv = ConventionalChannels()
+    up = update(channels=[conv_row(0, voice=True)])
+    conv.normalize(up)
+    assert up.channels[0]["tgid"] == 4_604_000 and up.channels[0]["drb_active"]
+
+
+def test_idle_and_encrypted_channels_are_not_talkers():
+    conv = ConventionalChannels()
+    up = update(channels=[conv_row(0), conv_row(1, PD3, "PD3 Tac", tgid=1, voice=True, encrypted=1)])
+    conv.normalize(up)
+    assert [r["tgid"] for r in up.channels] == [None, None]
+
+
+def test_trunked_rows_untouched():
+    conv = ConventionalChannels()
+    row = {"freq": 851_000_000, "tgid": 9048, "srcaddr": 5, "tag": "PD", "msgqid": 0}
+    up = update(channels=[dict(row)], call_log=[conv_grant(0, 9048, 1.0)])
+    conv.normalize(up)
+    assert up.channels[0] == row
+    assert up.call_log[0]["tgid"] == 9048
+    assert conv.sole_channel() is None
+
+
+def test_sole_channel_only_with_exactly_one_conventional_channel():
+    conv = ConventionalChannels()
+    conv.normalize(update(channels=[conv_row(0, 154_430_000, "Fire")]))
+    assert conv.sole_channel() == {"tgid": 1_544_300, "name": "Fire", "freq": 154_430_000}
+    conv.normalize(update(channels=[conv_row(0), conv_row(1, PD3)]))
+    assert conv.sole_channel() is None
+    # A poll without channel_update does not forget the channel list.
+    conv.normalize(update())
+    assert conv.sole_channel() is None
+
+
+def test_encryption_report():
+    conv = ConventionalChannels()
+    conv.normalize(update(channels=[
+        conv_row(0, enc_calls=3, clear_calls=0, last_enc_time=50.0, last_enc_algid=0x84,
+                 last_enc_keyid=0x1234, nac=0x293),
+        conv_row(1, PD3, "PD3 Tac", enc_calls=1, clear_calls=5, last_enc_time=10.0, last_clear_time=20.0),
+    ]))
+    pd1, pd3 = conv.encryption_report()
+    assert pd1["encrypted"] is True and pd1["algid"] == 0x84 and pd1["keyid"] == 0x1234 and pd1["nac"] == 0x293
+    assert pd3["encrypted"] is False   # its most recent call was clear
+
+
+# ---------------------------------------------------------------------------
+# Watcher attribution
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def clock():
+    return FakeClock()
+
+
+@pytest.fixture
+def audio(clock):
+    return FakeAudio(clock)
+
+
+@pytest.fixture
+def hearing(clock, audio):
+    w = MetadataWatcher()
+    w._clock = clock
+    w.on_call_start = AsyncMock()
+    w.on_call_end = AsyncMock()
+    w.audio_activity = audio
+    return w
+
+
+async def _finish(hearing, clock, channels):
+    clock.advance(settings.call_silence_timeout + 0.5)
+    await tick(hearing, update(channels=channels))
+    return hearing.on_call_end.call_args[0][0]
+
+
+@pytest.mark.asyncio
+async def test_conventional_call_attributed_to_its_channel(hearing, clock, audio):
+    """White Plains: both channels carry the default TGID 1; the keyed one wins."""
+    audio.speak()
+    await tick(hearing, update(
+        channels=[conv_row(0, tgid=1, srcaddr=4242, voice=True), conv_row(1, PD3, "PD3 Tac")],
+        call_log=[conv_grant(0, 1, clock.now)],
+    ))
+    assert hearing.is_active and hearing.current_tgid == 4_604_000
+
+    ended = await _finish(hearing, clock, [conv_row(0), conv_row(1, PD3, "PD3 Tac")])
+    assert ended["attributed"] is True
+    assert (ended["tgid"], ended["tgid_name"], ended["srcaddr"]) == (4_604_000, "PD1 Dispatch", 4242)
+    assert hearing.unattributed_segments == 0
+
+
+@pytest.mark.asyncio
+async def test_other_channel_keying_splits(hearing, clock, audio):
+    audio.speak()
+    await tick(hearing, update(
+        channels=[conv_row(0, tgid=1, voice=True), conv_row(1, PD3, "PD3 Tac")],
+        call_log=[conv_grant(0, 1, clock.now)],
+    ))
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(
+        channels=[conv_row(0), conv_row(1, PD3, "PD3 Tac", tgid=1, voice=True)],
+        call_log=[conv_grant(1, 1, clock.now, freq=PD3)],
+    ))
+    first = hearing.on_call_end.call_args[0][0]
+    assert first["tgid"] == 4_604_000 and first["end_reason"] == "tgid_change"
+    assert hearing.current_tgid == 4_604_250
+
+
+@pytest.mark.asyncio
+async def test_single_analog_channel_audio_is_kept_not_orphaned(hearing, clock, audio):
+    """node-26#20: analog never reports a talker; the only channel is the answer."""
+    audio.speak()
+    rows = [conv_row(0, 154_430_000, "County Fire")]
+    await tick(hearing, update(channels=rows))
+    # Not labelled at open — only at close.
+    assert hearing.on_call_start.call_args[0][0]["tgid"] is None
+
+    ended = await _finish(hearing, clock, rows)
+    assert ended["attributed"] is True
+    assert (ended["tgid"], ended["tgid_name"]) == (1_544_300, "County Fire")
+    assert hearing.unattributed_segments == 0
+
+
+@pytest.mark.asyncio
+async def test_two_channels_with_no_evidence_is_still_orphan(hearing, clock, audio):
+    audio.speak()
+    rows = [conv_row(0), conv_row(1, PD3, "PD3 Tac")]
+    await tick(hearing, update(channels=rows))
+    ended = await _finish(hearing, clock, rows)
+    assert ended["attributed"] is False
+    assert hearing.unattributed_segments == 1
+
+
+@pytest.mark.asyncio
+async def test_late_real_talkgroup_on_single_channel_does_not_split(hearing, clock, audio):
+    """Audio first, link-control grant a poll later: adopt it, don't split."""
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0)]))
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, tgid=101, srcaddr=9, voice=True)],
+                               call_log=[conv_grant(0, 101, clock.now - 0.3)]))
+    assert hearing.current_tgid == 101
+    hearing.on_call_end.assert_not_called()
+    ended = await _finish(hearing, clock, [conv_row(0)])
+    assert ended["tgid"] == 101 and ended["end_reason"] == "audio_silence"
+
+
+@pytest.mark.asyncio
+async def test_encrypted_channel_does_not_label_clear_audio(hearing, clock, audio):
+    """PD3 is keyed encrypted (muted) while PD1 talks in the clear."""
+    audio.speak()
+    await tick(hearing, update(channels=[
+        conv_row(0, tgid=1, voice=True),
+        conv_row(1, PD3, "PD3 Tac", tgid=1, voice=True, encrypted=1, algid=0x84),
+    ]))
+    ended = await _finish(hearing, clock, [conv_row(0), conv_row(1, PD3, "PD3 Tac")])
+    assert ended["tgid"] == 4_604_000
+
+
+@pytest.mark.asyncio
+async def test_conventional_channels_property(hearing, clock):
+    await tick(hearing, update(channels=[conv_row(0, encrypted=1, voice=True, algid=0x84, keyid=7)]))
+    (only,) = hearing.conventional_channels
+    assert only["encrypted"] and only["encrypted_now"] and only["algid"] == 0x84
+
+
+# drb-audio-review findings on #24: a header frame (voice, no link control yet)
+# must not label the call with the synthetic id and then split against the
+# real talkgroup a poll later; nor may a reply's header split it back.
+
+@pytest.mark.asyncio
+async def test_header_before_link_control_does_not_split(hearing, clock, audio):
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, voice=True)]))       # HDU only
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, tgid=101, srcaddr=9, voice=True)],
+                               call_log=[conv_grant(0, 101, clock.now - 0.2)]))
+    hearing.on_call_end.assert_not_called()
+    assert hearing.current_tgid == 101
+    ended = await _finish(hearing, clock, [conv_row(0)])
+    assert ended["tgid"] == 101 and ended["end_reason"] == "audio_silence"
+    assert hearing.on_call_end.call_count == 1
+
+
+@pytest.mark.asyncio
+async def test_reply_header_inside_conversation_does_not_ping_pong(hearing, clock, audio):
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, tgid=101, srcaddr=9, voice=True)],
+                               call_log=[conv_grant(0, 101, clock.now)]))
+    clock.advance(0.5)
+    await tick(hearing, update(channels=[conv_row(0)]))                   # TDU
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, voice=True)]))       # reply's HDU
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, tgid=101, srcaddr=12, voice=True)],
+                               call_log=[conv_grant(0, 101, clock.now)]))
+    hearing.on_call_end.assert_not_called()
+    ended = await _finish(hearing, clock, [conv_row(0)])
+    assert ended["tgid"] == 101 and hearing.on_call_end.call_count == 1
+
+
+@pytest.mark.asyncio
+async def test_never_decoded_link_control_then_real_tg_relabels(hearing, clock, audio):
+    """First-ever call on a channel: synthetic label, then the real TG adopts it."""
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, voice=True)]))
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, voice=True)]))
+    assert hearing.current_tgid == 4_604_000
+    clock.advance(0.5)
+    audio.speak()
+    await tick(hearing, update(channels=[conv_row(0, tgid=101, voice=True)],
+                               call_log=[conv_grant(0, 101, clock.now)]))
+    hearing.on_call_end.assert_not_called()
+    assert hearing.current_tgid == 101
+
+
+def test_voice_without_link_control_uses_channels_last_talkgroup():
+    conv = ConventionalChannels()
+    conv.normalize(update(channels=[conv_row(0, tgid=101, voice=True)]))
+    up = update(channels=[conv_row(0, voice=True)])
+    conv.normalize(up)
+    assert up.channels[0]["tgid"] == 101
+
+
+def test_same_channel_relabel_is_conventional_only():
+    conv = ConventionalChannels()
+    assert conv.same_channel_relabel(4_604_000, PD1, 101, PD1) is None    # no conventional rows known
+    conv.normalize(update(channels=[conv_row(0), conv_row(1, PD3)]))
+    assert conv.same_channel_relabel(4_604_000, PD1, 101, PD1) == "adopt"
+    assert conv.same_channel_relabel(101, PD1, 4_604_000, PD1) == "keep"
+    assert conv.same_channel_relabel(4_604_000, PD1, 4_604_250, PD3) is None   # other channel: split
+
+
+def test_remembered_talkgroup_expires():
+    conv = ConventionalChannels()
+    t = [1000.0]
+    conv._clock = lambda: t[0]
+    conv.normalize(update(channels=[conv_row(0, tgid=101, voice=True)]))
+    t[0] += 10
+    up = update(channels=[conv_row(0, voice=True)])
+    conv.normalize(up)
+    assert up.channels[0]["tgid"] == 101
+    t[0] += 3600
+    up = update(channels=[conv_row(0, voice=True)])
+    conv.normalize(up)
+    assert up.channels[0]["tgid"] == 4_604_000

drb-edge-node/tests/test_credential_recovery.py

@@ -0,0 +1,205 @@
+"""
+node-26#14 — a node with no key, or a stale key, recovers on its own:
+re-read credentials.json, else fetch over HTTPS with the pickup secret, then
+rebuild the MQTT client in place. node-26#15 — node_update hands off to the
+host updater via a sentinel file.
+"""
+import asyncio
+import json
+from unittest.mock import AsyncMock
+
+import httpx
+import pytest
+
+from app.config import settings
+from app.internal import credentials, key_pickup, mqtt_manager as mm_mod, update_request
+from app.internal.mqtt_manager import MQTTManager, _is_auth_failure
+
+
+@pytest.fixture(autouse=True)
+def isolated(tmp_path, monkeypatch):
+    monkeypatch.setattr(credentials, "_CREDS_FILE", tmp_path / "credentials.json")
+    monkeypatch.setattr(credentials, "_PICKUP_FILE", tmp_path / "pickup_secret")
+    monkeypatch.setattr(credentials, "_api_key", None)
+    monkeypatch.setattr(settings, "config_path", str(tmp_path))
+    monkeypatch.setattr(settings, "c2_url", "https://c2.example")
+    monkeypatch.setattr(settings, "mqtt_user", None)
+    monkeypatch.setattr(mm_mod, "RECOVERY_MIN_DELAY", 0)
+    yield tmp_path
+
+
+def _manager(client_key=None):
+    m = MQTTManager()
+    m._client_key = client_key
+    m._rebuild_client = AsyncMock()
+    return m
+
+
+# --- credentials.py -----------------------------------------------------------
+
+def test_reload_picks_up_a_key_written_after_startup(isolated):
+    credentials.load()
+    assert credentials.get_api_key() is None
+    data = json.loads((isolated / "credentials.json").read_text())
+    data["api_key"] = "written-by-install-sh"
+    (isolated / "credentials.json").write_text(json.dumps(data))
+    assert credentials.reload_api_key() == "written-by-install-sh"
+
+
+def test_write_is_atomic_and_private(isolated):
+    credentials.save_api_key("k1")
+    f = isolated / "credentials.json"
+    assert json.loads(f.read_text())["api_key"] == "k1"
+    assert (f.stat().st_mode & 0o777) == 0o600
+    assert not (isolated / "credentials.json.tmp").exists()
+
+
+def test_pickup_secret_read_and_absent(isolated):
+    assert credentials.get_pickup_secret() is None
+    (isolated / "pickup_secret").write_text("abc123\n")
+    assert credentials.get_pickup_secret() == "abc123"
+
+
+# --- auth-failure classification -------------------------------------------------
+
+@pytest.mark.parametrize("code", [4, 5, 134, 135])
+def test_auth_failure_codes(code):
+    assert _is_auth_failure(code)
+
+
+def test_non_auth_failures_do_not_trigger_recovery():
+    assert not _is_auth_failure(3)  # server unavailable
+    assert not _is_auth_failure(136)
+
+
+def test_paho_reason_code_objects_classified():
+    from paho.mqtt.reasoncodes import ReasonCode
+    from paho.mqtt.packettypes import PacketTypes
+    assert _is_auth_failure(ReasonCode(PacketTypes.CONNACK, "Not authorized"))
+    assert _is_auth_failure(ReasonCode(PacketTypes.CONNACK, "Bad user name or password"))
+    assert not _is_auth_failure(ReasonCode(PacketTypes.CONNACK, "Server unavailable"))
+
+
+# --- recovery loop ----------------------------------------------------------------
+
+async def test_recovery_uses_key_already_on_disk_without_calling_c2(isolated, monkeypatch):
+    credentials.save_api_key("disk-key")
+    monkeypatch.setattr(credentials, "_api_key", None)  # process started before the write
+    fetch = AsyncMock()
+    monkeypatch.setattr(key_pickup, "fetch_api_key", fetch)
+    m = _manager(client_key=None)
+    await m._recover_credentials()
+    m._rebuild_client.assert_awaited_once()
+    fetch.assert_not_awaited()
+
+
+async def test_recovery_fetches_over_https_and_persists(isolated, monkeypatch):
+    monkeypatch.setattr(key_pickup, "fetch_api_key", AsyncMock(return_value="fresh-key"))
+    m = _manager(client_key="stale-key")
+    monkeypatch.setattr(credentials, "_api_key", "stale-key")
+    await m._recover_credentials()
+    m._rebuild_client.assert_awaited_once()
+    assert credentials.get_api_key() == "fresh-key"
+    assert json.loads((isolated / "credentials.json").read_text())["api_key"] == "fresh-key"
+
+
+async def test_recovery_backs_off_until_approved(isolated, monkeypatch):
+    fetch = AsyncMock(side_effect=[None, None, "approved-key"])
+    monkeypatch.setattr(key_pickup, "fetch_api_key", fetch)
+    m = _manager()
+    await asyncio.wait_for(m._recover_credentials(), timeout=5)
+    assert fetch.await_count == 3
+    m._rebuild_client.assert_awaited_once()
+
+
+async def test_recovery_stops_if_connection_recovers_meanwhile(isolated, monkeypatch):
+    monkeypatch.setattr(key_pickup, "fetch_api_key", AsyncMock(return_value=None))
+    m = _manager()
+    m._connected = True
+    await asyncio.wait_for(m._recover_credentials(), timeout=5)
+    m._rebuild_client.assert_not_awaited()
+
+
+async def test_start_recovery_is_single_flight(isolated, monkeypatch):
+    gate = asyncio.Event()
+
+    async def slow_fetch():
+        await gate.wait()
+        return "k"
+    monkeypatch.setattr(key_pickup, "fetch_api_key", slow_fetch)
+    m = _manager()
+    m._start_recovery("a")
+    first = m._recovery_task
+    m._start_recovery("b")
+    assert m._recovery_task is first
+    gate.set()
+    await first
+
+
+async def test_connect_without_key_starts_recovery(isolated, monkeypatch):
+    m = MQTTManager()
+    started = []
+    monkeypatch.setattr(m, "_connect_with_retry", AsyncMock())
+    monkeypatch.setattr(m, "_start_recovery", lambda why: started.append(why))
+    await m.connect()
+    assert started == ["no API key at startup"]
+
+
+def test_update_api_key_changes_creds_for_next_reconnect(isolated):
+    m = MQTTManager()
+    m._client = m._build_client()
+    m.update_api_key("rotated")
+    assert m._client._password == b"rotated"
+    assert m._client_key == "rotated"
+
+
+# --- key_pickup.fetch_api_key -----------------------------------------------------
+
+def _mock_http(monkeypatch, handler):
+    real = httpx.AsyncClient
+
+    def factory(*a, **kw):
+        kw["transport"] = httpx.MockTransport(handler)
+        return real(*a, **kw)
+    monkeypatch.setattr(key_pickup.httpx, "AsyncClient", factory)
+
+
+async def test_fetch_sends_pickup_secret_and_returns_key(isolated, monkeypatch):
+    (isolated / "pickup_secret").write_text("the-secret")
+    seen = {}
+
+    def handler(request):
+        seen["url"] = str(request.url)
+        seen["secret"] = request.headers.get("X-Pickup-Secret")
+        return httpx.Response(200, json={"approval_status": "approved", "api_key": "K"})
+    _mock_http(monkeypatch, handler)
+    assert await key_pickup.fetch_api_key() == "K"
+    assert seen == {"url": f"https://c2.example/nodes/{settings.node_id}/credentials", "secret": "the-secret"}
+
+
+@pytest.mark.parametrize("resp", [
+    httpx.Response(200, json={"approval_status": "pending", "api_key": None}),
+    httpx.Response(401, json={"detail": "Invalid pickup secret"}),
+    httpx.Response(404),
+    httpx.Response(500),
+    httpx.Response(200, text="not json"),
+])
+async def test_fetch_returns_none_when_no_key(isolated, monkeypatch, resp):
+    (isolated / "pickup_secret").write_text("s")
+    _mock_http(monkeypatch, lambda request: resp)
+    assert await key_pickup.fetch_api_key() is None
+
+
+async def test_fetch_without_pickup_secret_does_not_call_c2(isolated, monkeypatch):
+    def handler(request):
+        raise AssertionError("must not call C2 without a pickup secret")
+    _mock_http(monkeypatch, handler)
+    assert await key_pickup.fetch_api_key() is None
+
+
+# --- node_update -> host sentinel ---------------------------------------------------
+
+def test_node_update_writes_sentinel(isolated):
+    assert update_request.request_host_update() is True
+    data = json.loads((isolated / "update-requested").read_text())
+    assert "requested_at" in data

drb-edge-node/tests/test_discord_radio.py

@@ -0,0 +1,345 @@
+"""
+Edge Discord radio manager (node-26#25): desired-state reconcile, logout on
+release, watchdog that survives a dead session, MQTT-loss fail-safe.
+
+Discord itself is faked: FakeClient logs "in" by firing on_ready, guilds and
+channels are plain objects, voice connections record play/disconnect.
+"""
+import asyncio
+
+import discord
+import pytest
+
+from app.internal import discord_radio
+from app.internal.discord_radio import RadioManager
+
+
+class FakeVC:
+    def __init__(self, channel):
+        self.channel = channel
+        self.connected = True
+        self.playing = False
+        self.plays = 0
+
+    def is_connected(self):
+        return self.connected
+
+    def is_playing(self):
+        return self.playing
+
+    def play(self, source, after=None):
+        self.playing = True
+        self.plays += 1
+
+    def stop(self):
+        self.playing = False
+
+    async def disconnect(self, force=False):
+        self.connected = False
+        self.playing = False
+        self.channel.guild.voice_client = None
+
+    async def move_to(self, channel):
+        self.channel = channel
+        channel.guild.voice_client = self
+
+
+class FakeChannel:
+    def __init__(self, guild, cid, kind=discord.ChannelType.voice):
+        self.guild, self.id, self.type = guild, cid, kind
+        self.perms = discord.Permissions(view_channel=True, connect=True, speak=True)
+        self.user_limit = 0
+        self.members = []
+        self.connect_error = None
+
+    def permissions_for(self, member):
+        assert member is self.guild.me
+        return self.perms
+
+    async def connect(self):
+        if self.connect_error:
+            raise self.connect_error
+        vc = FakeVC(self)
+        self.guild.voice_client = vc
+        return vc
+
+
+class FakeGuild:
+    def __init__(self, gid, channel_ids):
+        self.id = gid
+        self.me = object()
+        self.voice_client = None
+        self.channels = {c: FakeChannel(self, c) for c in channel_ids}
+
+    def get_channel(self, cid):
+        return self.channels.get(cid)
+
+
+class FakeClient:
+    instances: list = []
+
+    def __init__(self, guilds, fail_login=False):
+        self.guilds = guilds
+        self.fail_login = fail_login
+        self.closed = False
+        self.handlers = {}
+        self.token = None
+        self.user = "radio-bot"
+        FakeClient.instances.append(self)
+
+    def event(self, coro):
+        self.handlers[coro.__name__] = coro
+        return coro
+
+    async def start(self, token):
+        self.token = token
+        if self.fail_login:
+            raise discord.LoginFailure("Improper token has been passed.")
+        await self.handlers["on_ready"]()
+        while not self.closed:
+            await asyncio.sleep(0.01)
+
+    async def close(self):
+        self.closed = True
+
+    def is_closed(self):
+        return self.closed
+
+    def get_guild(self, gid):
+        return self.guilds.get(gid)
+
+    async def change_presence(self, activity=None):
+        self.presence = activity
+
+
+@pytest.fixture
+def env(monkeypatch):
+    FakeClient.instances = []
+    guilds = {1: FakeGuild(1, [11, 12]), 2: FakeGuild(2, [21])}
+    published = []
+    fetched = []
+    state = {"mqtt": True, "fail_login": False}
+
+    async def fetch(token_id):
+        fetched.append(token_id)
+        return f"secret-{token_id}"
+
+    async def publish(payload):
+        published.append(payload)
+
+    async def pulse_ready(timeout=None):
+        return True
+    monkeypatch.setattr(discord_radio.pulse, "wait_until_ready", pulse_ready)
+    monkeypatch.setattr(discord_radio.pulse, "is_ready", lambda: True)
+
+    mgr = RadioManager(
+        client_factory=lambda: FakeClient(guilds, fail_login=state["fail_login"]),
+        token_fetcher=fetch, publisher=publish, audio_factory=lambda: object(),
+        mqtt_up=lambda: state["mqtt"], ready_timeout=1,
+    )
+    yield type("Env", (), {"mgr": mgr, "guilds": guilds, "published": published,
+                           "fetched": fetched, "state": state})
+    # Leave no background tasks behind.
+    if mgr._watchdog:
+        mgr._watchdog.cancel()
+
+
+def _desired(seq, *streams):
+    return {"seq": seq, "streams": [
+        {"stream_id": f"{g}:{c}", "guild_id": str(g), "channel_id": str(c), "token_id": t, "system_name": "County"}
+        for g, c, t in streams
+    ]}
+
+
+async def test_apply_connects_and_reports(env):
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    actual = env.published[-1]
+    assert actual["applied_seq"] == 1
+    assert actual["sessions"] == ["t1"]
+    assert actual["streams"] == {"1:11": {"state": "connected", "error": None, "code": None}}
+    assert env.mgr.is_connected
+    vc = env.guilds[1].voice_client
+    assert vc.plays == 1 and vc.channel.id == 11
+    assert FakeClient.instances[0].presence.name == "County"
+
+
+async def test_one_session_serves_two_guilds(env):
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1"), (2, 21, "t1")))
+    assert len(FakeClient.instances) == 1
+    assert env.published[-1]["sessions"] == ["t1"]
+    assert env.guilds[1].voice_client.is_connected() and env.guilds[2].voice_client.is_connected()
+
+
+async def test_dropping_the_last_stream_logs_the_bot_out(env):
+    """node-26#25 item 1: leave() used to keep the gateway session alive."""
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1"), (2, 21, "t1")))
+    client = FakeClient.instances[0]
+    await env.mgr.apply_desired(_desired(2, (2, 21, "t1")))
+    assert not client.closed                      # still needed for guild 2
+    assert env.guilds[1].voice_client is None
+    await env.mgr.apply_desired(_desired(3))
+    assert client.closed                          # logged OUT, not just out of voice
+    assert env.published[-1] == {"applied_seq": 3, "sessions": [], "streams": {}}
+
+
+async def test_stale_desired_is_ignored(env):
+    await env.mgr.apply_desired(_desired(5, (1, 11, "t1")))
+    await env.mgr.apply_desired(_desired(4))
+    assert env.mgr.snapshot()["applied_seq"] == 5 and env.mgr.is_connected
+
+
+async def test_dead_session_is_recovered_by_the_watchdog(env):
+    """node-26#25 item 2: the old watchdog cancelled itself on rejoin."""
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    first = FakeClient.instances[0]
+    first.closed = True                           # bot task dies
+    await asyncio.sleep(0.05)
+    env.guilds[1].voice_client.connected = False
+    await env.mgr.tick()
+    assert len(FakeClient.instances) == 2 and not FakeClient.instances[1].closed
+    assert env.mgr.snapshot()["streams"]["1:11"]["state"] == "connected"
+    # The watchdog task itself is still alive after the recovery.
+    assert env.mgr._watchdog is not None and not env.mgr._watchdog.done()
+
+
+async def test_dropped_voice_is_reconnected(env):
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    env.guilds[1].voice_client.connected = False
+    env.guilds[1].voice_client = None
+    await env.mgr.tick()
+    assert env.guilds[1].voice_client.is_connected()
+
+
+async def test_bot_not_in_guild_is_reported_not_swallowed(env):
+    await env.mgr.apply_desired(_desired(1, (9, 91, "t1")))
+    st = env.published[-1]["streams"]["9:91"]
+    assert st["state"] == "error" and st["code"] == "not_in_guild"
+
+
+async def test_login_failure_is_reported(env):
+    env.state["fail_login"] = True
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    st = env.published[-1]["streams"]["1:11"]
+    assert st["state"] == "error" and st["code"] == "login_failed"
+    assert env.published[-1]["sessions"] == []
+
+
+async def test_mqtt_loss_failsafe_logs_out_then_resumes(env, monkeypatch):
+    monkeypatch.setattr(discord_radio.settings, "discord_mqtt_loss_stop_seconds", 300)
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    client = FakeClient.instances[0]
+    env.state["mqtt"] = False
+    await env.mgr.tick(now=1000.0)
+    assert not client.closed                       # inside the window
+    await env.mgr.tick(now=1299.0)
+    assert not client.closed
+    await env.mgr.tick(now=1300.0)
+    assert client.closed and env.mgr.snapshot()["sessions"] == []
+    # Token strings are not kept across a fail-safe logout: re-login refetches
+    # from C2, which refuses if the lease has moved on.
+    assert env.mgr._tokens == {}
+    env.state["mqtt"] = True
+    before = len(env.fetched)
+    await env.mgr.tick(now=1400.0)
+    assert len(env.fetched) == before + 1
+    assert env.mgr.snapshot()["streams"]["1:11"]["state"] == "connected"
+
+
+async def test_token_fetch_refused_reports_error(env):
+    async def refuse(token_id):
+        return None
+    env.mgr._fetch_token = refuse
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    st = env.published[-1]["streams"]["1:11"]
+    assert st["state"] == "error" and FakeClient.instances == []
+
+
+async def test_local_pause_logs_out_until_next_desired(env):
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    await env.mgr.pause_locally()
+    assert FakeClient.instances[0].closed
+    assert env.published[-1]["streams"]["1:11"]["state"] == "paused_locally"
+    await env.mgr.apply_desired(_desired(2, (1, 11, "t1")))
+    assert env.mgr.is_connected
+
+
+async def test_retained_redelivery_does_not_undo_local_pause(env):
+    """node-26#34: the broker redelivers the retained desired message (same
+    seq) on every reconnect; that must not log the bots back in."""
+    await env.mgr.apply_desired(_desired(4, (1, 11, "t1")))
+    await env.mgr.pause_locally()
+    await env.mgr.apply_desired(_desired(4, (1, 11, "t1")))
+    assert not env.mgr.is_connected
+    assert env.published[-1]["streams"]["1:11"]["state"] == "paused_locally"
+    await env.mgr.apply_desired(_desired(5, (1, 11, "t1")))
+    assert env.mgr.is_connected
+
+
+async def test_no_message_content_intent_on_real_client():
+    client = discord_radio._default_client_factory()
+    try:
+        assert client.intents.message_content is False
+        assert client.intents.voice_states and client.intents.guilds
+    finally:
+        await client.close()
+
+
+def _presence(client):
+    activity = getattr(client, "presence", None)
+    return activity.name if activity else None
+
+
+async def test_missing_connect_permission_is_named_not_a_timeout(env):
+    """Discord ignores a join the bot may not make; say which permission is missing."""
+    env.guilds[1].channels[11].perms = discord.Permissions(view_channel=True, speak=True)
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    st = env.published[-1]["streams"]["1:11"]
+    assert st["state"] == "error" and st["code"] == "missing_permissions"
+    assert "Connect" in st["error"] and "View Channel" not in st["error"]
+    assert env.guilds[1].voice_client is None
+    assert _presence(FakeClient.instances[0]) is None   # not "Listening to …" while out of voice
+
+
+async def test_full_channel_is_reported(env):
+    ch = env.guilds[1].channels[11]
+    ch.user_limit, ch.members = 2, [object(), object()]
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    st = env.published[-1]["streams"]["1:11"]
+    assert st["code"] == "channel_full" and "2/2" in st["error"]
+
+
+async def test_bots_own_lingering_voice_state_does_not_fill_the_channel(env):
+    """A dropped connection can leave the bot listed in the channel; that is
+    not a slot it needs to rejoin."""
+    guild = env.guilds[1]
+    guild.me = type("Me", (), {"id": 999})()
+    ch = guild.channels[11]
+    ch.user_limit, ch.members = 2, [object(), guild.me]
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    assert env.published[-1]["streams"]["1:11"]["state"] == "connected"
+
+
+async def test_connect_timeout_has_a_readable_error(env):
+    env.guilds[1].channels[11].connect_error = asyncio.TimeoutError()
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    st = env.published[-1]["streams"]["1:11"]
+    assert st["state"] == "error" and st["code"] == "connect_timeout"
+    assert "timed out" in st["error"] and "TimeoutError: )" not in st["error"]
+
+
+async def test_presence_is_cleared_when_voice_is_lost_and_rejoin_fails(env):
+    """The owner saw "Listening to <system>" on a bot that was not in voice:
+    presence was set once on join and never cleared."""
+    await env.mgr.apply_desired(_desired(1, (1, 11, "t1")))
+    client = FakeClient.instances[0]
+    assert _presence(client) == "County"
+    env.guilds[1].voice_client.connected = False
+    env.guilds[1].voice_client = None
+    env.guilds[1].channels[11].connect_error = RuntimeError("voice handshake failed")
+    await env.mgr.tick()
+    st = env.mgr.snapshot()["streams"]["1:11"]
+    assert st["state"] == "error" and st["code"] == "connect_failed"
+    assert _presence(client) is None
+    env.guilds[1].channels[11].connect_error = None
+    await env.mgr.tick()
+    assert _presence(client) == "County"

drb-edge-node/tests/test_host_updater.py

@@ -0,0 +1,250 @@
+"""
+node-26#15 — Client/scripts/drb-update.sh, the host-level updater.
+
+Runs the real script with stub git/docker/curl on PATH, so what is checked is
+the script's decision logic and its security guards: it only updates when
+asked (MQTT sentinel or a new C2 request), never takes anything but "update
+now" from C2, refuses a mismatched git origin or registry, and keeps node
+credentials off curl's argv.
+"""
+import json
+import os
+import shutil
+import stat
+import subprocess
+from pathlib import Path
+
+import pytest
+
+SCRIPT = Path(__file__).resolve().parents[2] / "scripts" / "drb-update.sh"
+
+pytestmark = pytest.mark.skipif(
+    not (SCRIPT.exists() and shutil.which("bash") and shutil.which("jq") and shutil.which("flock")),
+    reason="needs the repo's scripts/ (absent inside the image) plus bash, jq and flock",
+)
+
+REPO = "https://git.example.net/logan/node-26.git"
+OLD, NEW, TREE = "a" * 40, "b" * 40, "c" * 40
+REPO_ROOT = SCRIPT.parents[1]
+
+STUB_GIT = r'''#!/usr/bin/env bash
+echo "git $*" >> "$STUB/calls"
+while [ "$1" = -c ] || [ "$1" = -C ]; do shift 2; done
+case "$1" in
+  rev-parse)
+    if [ "$2" = HEAD ]; then cat "$STUB/head"
+    elif [ "$2" = --verify ]; then echo "$STUB_TREE"   # tree hash of <commit>:<dir>
+    else echo "$STUB_NEW"; fi ;;
+  remote) echo "$STUB_ORIGIN" ;;
+  fetch) exit 0 ;;
+  show-ref) [ "$4" = "refs/tags/v1" ] ;;
+  cat-file) [ -z "${STUB_NO_PIN:-}" ] ;;   # target has scripts/image-tags.sh
+  show) case "$2" in
+          *:scripts/image-tags.sh) cat "$STUB_REPO/scripts/image-tags.sh" ;;
+          *:docker-compose.yml) cat "$STUB_REPO/docker-compose.yml" ;;
+        esac ;;
+  checkout) echo "${@: -1}" > "$STUB/head" ;;
+  *) exit 0 ;;
+esac
+'''
+STUB_DOCKER = r'''#!/usr/bin/env bash
+echo "docker $*" >> "$STUB/calls"
+case "$*" in
+  *"config --images"*) echo "reg.example/edge-node:$STUB_PULLED_TAG" ;;
+  "image inspect"*) [ -z "${STUB_MISSING_IMAGE:-}" ] || exit 1 ;;
+esac
+exit 0
+'''
+STUB_CURL = r'''#!/usr/bin/env bash
+echo "curl $*" >> "$STUB/calls"
+for a in "$@"; do case "$a" in @*) cat "${a#@}" >> "$STUB/headers" ;; esac; done
+cat "$STUB/response"
+'''
+
+
+def _exe(path: Path, body: str):
+    path.write_text(body)
+    path.chmod(path.stat().st_mode | stat.S_IEXEC)
+
+
+@pytest.fixture
+def env(tmp_path):
+    stub = tmp_path / "stub"
+    bindir = stub / "bin"
+    bindir.mkdir(parents=True)
+    _exe(bindir / "git", STUB_GIT)
+    _exe(bindir / "docker", STUB_DOCKER)
+    _exe(bindir / "curl", STUB_CURL)
+    (stub / "head").write_text(OLD + "\n")
+    (stub / "calls").write_text("")
+    (stub / "response").write_text(json.dumps({"update_requested_at": None}))
+
+    inst = tmp_path / "node"
+    (inst / ".git").mkdir(parents=True)
+    (inst / "configs").mkdir()
+    (inst / ".env").write_text(
+        "NODE_ID=node-7\nC2_URL=https://api.example.net\nIMAGE_REGISTRY=git.example.net\n"
+    )
+    (inst / "configs" / "credentials.json").write_text(json.dumps({"api_key": "k" * 64}))
+    (inst / "configs" / "pickup_secret").write_text("p" * 48)
+
+    conf = tmp_path / "updater.conf"
+    conf.write_text(f"INSTALL_DIR={inst}\nREPO_URL={REPO}\nREF=v1\nREGISTRY=git.example.net\nBUILD=0\n")
+
+    e = dict(os.environ)
+    e.update({
+        "PATH": f"{bindir}:{os.environ['PATH']}",
+        "STUB": str(stub), "STUB_NEW": NEW, "STUB_ORIGIN": REPO,
+        "STUB_TREE": TREE, "STUB_REPO": str(REPO_ROOT), "STUB_PULLED_TAG": f"src-{TREE}",
+        "DRB_UPDATER_CONF": str(conf),
+        "DRB_UPDATER_STATE": str(tmp_path / "state"),
+        "DRB_UPDATER_LOCK": str(tmp_path / "lock"),
+    })
+    return {"env": e, "stub": stub, "inst": inst, "conf": conf, "state": tmp_path / "state"}
+
+
+def _run(env):
+    return subprocess.run(["bash", str(SCRIPT)], env=env["env"], capture_output=True, text=True, timeout=30)
+
+
+def _calls(env):
+    return (env["stub"] / "calls").read_text()
+
+
+def _pulled(calls: str) -> bool:
+    return any(line.startswith("docker compose ") and line.endswith(" pull") for line in calls.splitlines())
+
+
+def test_no_request_means_checkin_only(env):
+    r = _run(env)
+    assert r.returncode == 0, r.stderr
+    calls = _calls(env)
+    assert "update-check" in calls
+    assert "docker" not in calls
+    assert "fetch" not in calls
+
+
+def test_c2_request_updates_once_and_reports(env):
+    (env["stub"] / "response").write_text(json.dumps({"update_requested_at": "2026-10-04T12:00:00+00:00"}))
+    r = _run(env)
+    assert r.returncode == 0, r.stderr + r.stdout
+    calls = _calls(env)
+    assert _pulled(calls)
+    assert "docker compose up -d --no-build --force-recreate --remove-orphans" in calls
+    assert (env["stub"] / "head").read_text().strip() == NEW
+    assert '"applied_request_at":"2026-10-04T12:00:00+00:00"' in calls
+    assert '"result":"ok"' in calls
+    # Same request again: nothing to do.
+    (env["stub"] / "calls").write_text("")
+    assert _run(env).returncode == 0
+    assert "docker" not in _calls(env)
+
+
+def test_mqtt_sentinel_triggers_update_and_is_consumed(env):
+    sentinel = env["inst"] / "configs" / "update-requested"
+    sentinel.write_text('{"ref": "evil", "cmd": "rm -rf /"}')
+    r = _run(env)
+    assert r.returncode == 0, r.stderr
+    assert not sentinel.exists()
+    calls = _calls(env)
+    assert _pulled(calls)
+    assert "evil" not in calls and "rm -rf" not in calls
+
+
+def test_update_prunes_build_cache_and_stale_images_after_up(env):
+    # node-26#41: the build cache was never pruned and filled node-002's disk.
+    (env["stub"] / "response").write_text(json.dumps({"update_requested_at": "2026-10-04T12:00:00+00:00"}))
+    assert _run(env).returncode == 0
+    lines = _calls(env).splitlines()
+    up = next(i for i, ln in enumerate(lines) if ln.startswith("docker compose up -d"))
+    builder = next(i for i, ln in enumerate(lines) if ln.startswith("docker builder prune -af --filter until="))
+    images = next(i for i, ln in enumerate(lines) if ln.startswith("docker image prune -af --filter until="))
+    assert up < builder and up < images  # only after the new containers are running
+
+
+def test_c2_response_is_never_used_as_a_ref_or_command(env):
+    (env["stub"] / "response").write_text(json.dumps({"update_requested_at": "$(touch /tmp/pwned); main"}))
+    r = _run(env)
+    assert r.returncode == 0
+    assert "docker" not in _calls(env)  # malformed request is ignored, not executed
+
+
+def test_refuses_when_git_origin_differs(env):
+    env["env"]["STUB_ORIGIN"] = "https://attacker.example/node-26.git"
+    (env["inst"] / "configs" / "update-requested").write_text("")
+    r = _run(env)
+    assert r.returncode != 0
+    assert "refusing" in r.stderr
+    assert "docker" not in _calls(env)
+
+
+def test_refuses_when_env_registry_differs(env):
+    (env["inst"] / ".env").write_text(
+        "NODE_ID=node-7\nC2_URL=https://api.example.net\nIMAGE_REGISTRY=evil.example\n"
+    )
+    (env["inst"] / "configs" / "update-requested").write_text("")
+    r = _run(env)
+    assert r.returncode != 0
+    assert not _pulled(_calls(env))
+
+
+def test_non_https_repo_in_conf_is_rejected(env):
+    env["conf"].write_text(env["conf"].read_text().replace("https://", "http://"))
+    r = _run(env)
+    assert r.returncode != 0
+    assert "git" not in _calls(env)
+
+
+def test_credentials_go_in_a_header_file_never_argv(env):
+    _run(env)
+    calls = _calls(env)
+    assert "k" * 64 not in calls and "p" * 48 not in calls
+    headers = (env["stub"] / "headers").read_text()
+    assert f"Authorization: Bearer {'k' * 64}" in headers
+    assert f"X-Pickup-Secret: {'p' * 48}" in headers
+
+
+def test_plain_http_c2_skips_checkin(env):
+    (env["inst"] / ".env").write_text("NODE_ID=node-7\nC2_URL=http://api.example.net\nIMAGE_REGISTRY=git.example.net\n")
+    r = _run(env)
+    assert r.returncode == 0
+    assert "curl" not in _calls(env)
+
+
+# ── node-26#19: images pinned to the target's source tree ─────────────────
+
+def test_pins_images_and_pulls_before_checkout(env):
+    (env["inst"] / "configs" / "update-requested").write_text("")
+    r = _run(env)
+    assert r.returncode == 0, r.stderr + r.stdout
+    lines = _calls(env).splitlines()
+    pull = next(i for i, ln in enumerate(lines) if ln.startswith("docker compose ") and ln.endswith(" pull"))
+    checkout = next(i for i, ln in enumerate(lines) if ln.startswith("git") and " checkout " in ln)
+    assert pull < checkout, "images must be pulled before the new code is checked out"
+    dotenv = (env["inst"] / ".env").read_text()
+    for var in ("DRB_TAG_EDGE_NODE", "DRB_TAG_OP25", "DRB_TAG_ICECAST", "DRB_TAG_SECONDARY_SDR"):
+        assert f"{var}=src-{TREE}\n" in dotenv
+    assert dotenv.startswith("NODE_ID=node-7\n")  # existing lines kept
+    assert not (env["inst"] / ".drb-update-compose.yml").exists()
+
+
+def test_missing_pinned_image_changes_nothing(env):
+    env["env"]["STUB_MISSING_IMAGE"] = "1"
+    (env["inst"] / "configs" / "update-requested").write_text("")
+    r = _run(env)
+    assert r.returncode != 0
+    assert (env["stub"] / "head").read_text().strip() == OLD
+    calls = _calls(env)
+    assert " checkout " not in calls
+    assert "up -d" not in calls
+    assert "DRB_TAG_" not in (env["inst"] / ".env").read_text()
+
+
+def test_target_without_pinning_still_updates(env):
+    env["env"]["STUB_NO_PIN"] = "1"
+    (env["inst"] / "configs" / "update-requested").write_text("")
+    r = _run(env)
+    assert r.returncode == 0, r.stderr + r.stdout
+    assert (env["stub"] / "head").read_text().strip() == NEW
+    assert _pulled(_calls(env))
+    assert "DRB_TAG_" not in (env["inst"] / ".env").read_text()

drb-edge-node/tests/test_local_dashboard.py

@@ -100,6 +100,17 @@ def test_key_on_disk_but_mqtt_down_says_restart():
     assert "restart the edge-node container" in c["mqtt"]["action"]
 
 
+def test_mqtt_refused_vs_unreachable_are_told_apart():
+    """node-26#21: 'not authorised' and 'can't reach the broker' need different fixes."""
+    refused = _by_id(health.build_checks(_facts(
+        mqtt_connected=False, mqtt_last_error={"kind": "refused", "detail": "Not authorized", "epoch": 1.0})))
+    assert refused["mqtt"]["state"] == "error"
+    assert "refused" in refused["mqtt"]["summary"] and "install.sh" in refused["mqtt"]["action"]
+    unreachable = _by_id(health.build_checks(_facts(
+        mqtt_connected=False, mqtt_last_error={"kind": "unreachable", "detail": "timed out", "epoch": 1.0})))
+    assert "Can't reach" in unreachable["mqtt"]["summary"] and "firewall" in unreachable["mqtt"]["action"]
+
+
 def test_standalone_node_is_not_an_error():
     c = _by_id(health.build_checks(_facts(c2_url=None, has_api_key=False, mqtt_connected=False)))
     assert c["c2"]["state"] == "off"
@@ -126,10 +137,48 @@ def test_analog_needs_no_control_channel():
         console={"last_poll_epoch": now, "channels": [{"freq": 154430000}], "trunk": [], "last_heard": None},
     )))
     assert c["decode"]["state"] == "ok" and "154.4300 MHz" in c["decode"]["summary"]
-    assert "not recorded" in c["decode"]["action"]
+    # node-26#20: analog calls are recorded now (single-channel attribution).
+    assert c["decode"]["action"] == ""
     assert "this dashboard" in c["source"]["summary"]
 
 
+_CONV_SRC = {"name": "White Plains", "type": "P25", "mode": "conventional", "system_id": "wp", "local": False}
+_PD1 = {"name": "PD1 Dispatch", "freq": 460400000, "nac": None, "encrypted": False, "algid": None, "keyid": None}
+_PD3 = {"name": "PD3 Tac", "freq": 460425000, "nac": None, "encrypted": False, "algid": None, "keyid": None}
+
+
+def _conv_facts(chans):
+    now = 1_000_000.0
+    return _facts(source=_CONV_SRC, conventional=chans,
+                  console={"last_poll_epoch": now, "channels": [], "trunk": [], "last_heard": None})
+
+
+def test_conventional_quiet_channels_are_ok_not_a_control_channel_error():
+    c = _by_id(health.build_checks(_conv_facts([_PD1, _PD3])))
+    assert c["decode"]["state"] == "ok"
+    assert "PD1 Dispatch (460.4000 MHz)" in c["decode"]["summary"]
+    assert "control channel" not in c["decode"]["summary"]
+    assert "P25 conventional" in c["source"]["summary"]
+
+
+def test_conventional_decoding_shows_nac():
+    c = _by_id(health.build_checks(_conv_facts([dict(_PD1, nac=0x293), _PD3])))
+    assert c["decode"]["state"] == "ok" and "NAC 0x293" in c["decode"]["summary"]
+
+
+def test_conventional_all_encrypted_is_an_error_naming_the_algorithm():
+    enc = [dict(_PD1, encrypted=True, algid=0x84, keyid=0x1234), dict(_PD3, encrypted=True, algid=0x84)]
+    c = _by_id(health.build_checks(_conv_facts(enc)))
+    assert c["decode"]["state"] == "error"
+    assert "AES-256" in c["decode"]["summary"] and "0x1234" in c["decode"]["summary"]
+    assert "different system" in c["decode"]["action"]
+
+
+def test_conventional_partly_encrypted_warns():
+    c = _by_id(health.build_checks(_conv_facts([dict(_PD1, encrypted=True, algid=0x81), _PD3])))
+    assert c["decode"]["state"] == "warn" and "PD1 Dispatch" in c["decode"]["summary"]
+
+
 def test_op25_unreachable_and_icecast_down():
     c = _by_id(health.build_checks(_facts(op25_status=None, icecast_live=None)))
     assert c["op25"]["state"] == "error"
@@ -180,9 +229,39 @@ def test_listen_analog_single_frequency(client, op25):
     assert r.status_code == 200, r.text
     cfg = config_manager.load_node_config().override_config
     assert (cfg.type, cfg.name, cfg.config["control_channels"]) == ("NBFM", "Fire", [154.43])
+    assert cfg.config["squelch_mode"] == "noise"   # node-26#46 default
+
+
+def test_listen_analog_squelch_is_saved(client, op25):
+    r = client.post("/api/listen", json={"mode": "analog", "frequencies": [154.43],
+                                         "squelch_mode": "power", "squelch_threshold": -55})
+    assert r.status_code == 200, r.text
+    cfg = config_manager.load_node_config().override_config.config
+    assert (cfg["squelch_mode"], cfg["squelch_threshold"]) == ("power", -55)
+    assert client.post("/api/listen", json={"mode": "analog", "frequencies": [154.43],
+                                            "squelch_mode": "loud"}).status_code == 422
+
+
+def test_listen_p25_conventional(client, op25):
+    r = client.post("/api/listen", json={
+        "mode": "p25conv", "frequencies": [460.4, 460.425], "name": "White Plains", "nac": "0x293",
+    })
+    assert r.status_code == 200, r.text
+    cfg = config_manager.load_node_config().override_config
+    assert cfg.type == "P25" and cfg.config["mode"] == "conventional"
+    assert "control_channels" not in cfg.config
+    assert [c["freq"] for c in cfg.config["channels"]] == [460.4, 460.425]
+    assert {c["nac"] for c in cfg.config["channels"]} == {"293"}
+    op25["gen"].assert_awaited_once()
+    status = client.get("/api/status").json()
+    assert status["system_kind"] == "P25 conventional"
 
 
 @pytest.mark.parametrize("body,needle", [
+    ({"mode": "p25conv", "frequencies": [460.4, 460.425, 460.45]}, "at most 2"),
+    ({"mode": "p25conv", "frequencies": [460.4, 462.6]}, "apart"),
+    ({"mode": "p25conv", "frequencies": [460.4, 460.4]}, "twice"),
+    ({"mode": "p25conv", "frequencies": [460.4], "nac": "zz"}, "hex"),
     ({"mode": "p25", "frequencies": []}, "at least one"),
     ({"mode": "p25", "frequencies": [851012500]}, "MHz"),
     ({"mode": "analog", "frequencies": [154.43, 155.1]}, "exactly one"),

drb-edge-node/tests/test_mqtt_manager.py

@@ -140,3 +140,41 @@ def test_build_client_does_not_touch_offline_buffer(monkeypatch):
 
     assert list(mqtt_manager._offline_buffer) == [("nodes/test/metadata", {"call_id": "sentinel"})]
     mqtt_manager._offline_buffer.clear()
+
+
+def test_disk_report_reads_free_and_total(tmp_path):
+    from app.internal.mqtt_manager import disk_report
+    rep = disk_report(str(tmp_path))
+    assert rep["disk_total_bytes"] > 0
+    assert 0 <= rep["disk_free_bytes"] <= rep["disk_total_bytes"]
+
+
+def test_disk_report_nulls_when_path_unreadable(tmp_path):
+    # node-26#41: nulls (not omitted keys) so C2 never keeps a stale reading.
+    from app.internal.mqtt_manager import disk_report
+    assert disk_report(str(tmp_path / "missing")) == {"disk_free_bytes": None, "disk_total_bytes": None}
+
+
+def test_last_error_records_refusal_and_clears_on_connect(monkeypatch):
+    """node-26#21: the refusal reason survives the disconnect that follows it."""
+    from unittest.mock import MagicMock
+    mqtt_manager._last_error = None
+    mqtt_manager._loop = None
+    mqtt_manager._on_connect(MagicMock(), None, None, 135, None)
+    mqtt_manager._on_disconnect(MagicMock(), None, None, 135, None)
+    assert mqtt_manager.last_error["kind"] == "refused"
+    monkeypatch.setattr(mqtt_manager, "_flush_offline_buffer", MagicMock())
+    monkeypatch.setattr(mqtt_manager, "_publish_checkin", MagicMock())
+    monkeypatch.setattr(mqtt_manager, "_maybe_request_key", MagicMock())
+    monkeypatch.setattr("asyncio.run_coroutine_threadsafe", lambda *a, **k: None)
+    mqtt_manager._on_connect(MagicMock(), None, None, 0, None)
+    assert mqtt_manager.last_error is None
+    mqtt_manager._connected = False
+
+
+def test_last_error_unreachable_from_connect_fail():
+    mqtt_manager._last_error = None
+    mqtt_manager._connected = False
+    mqtt_manager._on_connect_fail(None, None)
+    assert mqtt_manager.last_error["kind"] == "unreachable"
+    mqtt_manager._last_error = None

drb-edge-node/tests/test_trunk_recorder.py

@@ -0,0 +1,508 @@
+"""
+Trunk Recorder backend (node-26#45): config generation from the C2 system
+config, the TR call JSON -> MQTT + /upload mapping, the inbox hand-off, the
+live-audio follow policy and the health checklist.
+
+No radio here: nothing in this file has run against a real Trunk Recorder.
+The sample call JSON below is built from `create_call_json` in
+trunk-recorder/call_concluder/call_concluder.cc at tag v5.2.1 (key names and
+order as written there); the values are invented.
+"""
+import json
+from pathlib import Path
+
+import pytest
+
+from app.config import settings
+from app.internal import health, radio_backend, tr_config, upload_spool
+from app.internal import trunk_recorder as trmod
+from app.internal.conventional import channel_tgid
+from app.internal.tr_calls import parse_call
+from app.internal.upload_spool import UploadMeta
+
+# Shape: call_concluder.cc v5.2.1 create_call_json. Values invented.
+SAMPLE_CALL = {
+    "freq": 851012500,
+    "freq_error": -112,
+    "signal": -48,
+    "noise": -98,
+    "source_num": 0,
+    "recorder_num": 2,
+    "tdma_slot": 0,
+    "phase2_tdma": 0,
+    "start_time": 1793145600,
+    "stop_time": 1793145612,
+    "start_time_ms": 1793145600250,
+    "stop_time_ms": 1793145612730,
+    "emergency": 0,
+    "priority": 1,
+    "mode": 0,
+    "duplex": 0,
+    "encrypted": 0,
+    "call_length": 12,
+    "call_length_ms": 12480,
+    "talkgroup": 101,
+    "talkgroup_tag": "PD Dispatch",
+    "talkgroup_description": "Police Dispatch",
+    "talkgroup_group_tag": "Law Dispatch",
+    "talkgroup_group": "Police",
+    "color_code": -1,
+    "audio_type": "digital",
+    "short_name": "drb",
+    "freqList": [
+        {"freq": 851012500, "time": 1793145600, "pos": 0.0, "len": 5.2, "error_count": 3, "spike_count": 1},
+        {"freq": 851012500, "time": 1793145606, "pos": 5.2, "len": 7.28, "error_count": 2, "spike_count": 0},
+    ],
+    "srcList": [
+        {"src": 1234567, "time": 1793145600, "pos": 0.0, "emergency": 0, "signal_system": "", "tag": "Car 12",
+         "tag_ota": ""},
+        {"src": 7654321, "time": 1793145606, "pos": 5.2, "emergency": 1, "signal_system": "", "tag": "",
+         "tag_ota": ""},
+        {"src": 1234567, "time": 1793145610, "pos": 9.9, "emergency": 0, "signal_system": "", "tag": "Car 12",
+         "tag_ota": ""},
+        {"src": -1, "time": 1793145611, "pos": 11.0, "emergency": 0, "signal_system": "", "tag": "", "tag_ota": ""},
+    ],
+}
+
+TR_KW = dict(device_serial="00000101", ppm=1.5, sample_rate=2_400_000, gain=34.0, digital_recorders=4,
+             min_duration=1.0, squelch_db=-50.0, live_port=9123)
+
+
+# ---------------------------------------------------------------------------
+# Config generation
+# ---------------------------------------------------------------------------
+
+def test_trunked_config_from_c2_system():
+    cfg = {"control_channels": [851.0125, 851.2625], "talkgroups": [{"id": 101, "name": "PD Dispatch, Main"},
+                                                                    {"id": 202, "name": "Fire"}]}
+    tr, files = tr_config.build_tr_config("P25", "County", cfg, **TR_KW)
+    assert tr["ver"] == 2
+    src, sys_ = tr["sources"][0], tr["systems"][0]
+    assert src["driver"] == "osmosdr" and src["device"] == "rtl=00000101"
+    assert src["ppm"] == 1.5 and src["gain"] == 34.0 and src["rate"] == 2_400_000
+    assert src["digitalRecorders"] == 4
+    assert all(abs(f - src["center"]) <= 960_000 for f in (851_012_500, 851_262_500))
+    assert all(abs(f - src["center"]) >= tr_config.DC_SPIKE_GUARD_HZ for f in (851_012_500, 851_262_500))
+    assert sys_["type"] == "p25" and sys_["control_channels"] == [851_012_500, 851_262_500]
+    assert sys_["talkgroupsFile"] == "/app/talkgroups.csv" and sys_["recordUnknown"] is False
+    assert sys_["uploadScript"] == "/drb/drb-upload.sh"
+    assert sys_["audioArchive"] is False and sys_["callLog"] is False and sys_["compressWav"] is False
+    assert tr["tempDir"] == "/dev/shm" and tr["audioStreaming"] is True
+    stream = tr["plugins"][0]["streams"][0]
+    assert tr["plugins"][0]["library"] == "libsimplestream.so"
+    assert stream == {"TGID": 0, "address": "127.0.0.1", "port": 9123, "sendTGID": True}
+    lines = files["talkgroups.csv"].splitlines()
+    assert lines[0].startswith("Decimal,")       # TR: header required, Decimal first
+    assert lines[1] == '101,D,"PD Dispatch, Main","PD Dispatch, Main",,'
+
+
+def test_trunked_without_talkgroups_records_everything():
+    tr, files = tr_config.build_tr_config("P25", "County", {"control_channels": [851.0125]}, **TR_KW)
+    assert tr["systems"][0]["recordUnknown"] is True
+    assert "talkgroupsFile" not in tr["systems"][0] and not files
+
+
+def test_conventional_p25_uses_synthetic_tgids():
+    cfg = {"mode": "conventional", "channels": [{"freq": 460.400, "name": "PD1", "nac": "293"},
+                                                {"freq": 460.425, "name": "PD3"}]}
+    tr, files = tr_config.build_tr_config("P25", "WPPD", cfg, **TR_KW)
+    sys_ = tr["systems"][0]
+    assert sys_["type"] == "conventionalP25" and sys_["channelFile"] == "/app/channels.csv"
+    assert "digitalRecorders" not in tr["sources"][0]
+    rows = files["channels.csv"].splitlines()
+    assert rows[0].startswith("TG Number,Frequency")
+    # Same id the OP25 path reports for the channel, so C2 names both alike.
+    assert rows[1] == f"{channel_tgid(460_400_000)},460400000,PD1,PD1"
+
+
+def test_analog_squelch_threshold_carries_over_else_default():
+    cfg = {"channels": [{"freq": 154.25, "name": "FD"}], "squelch_mode": "power", "squelch_threshold": -62}
+    tr, files = tr_config.build_tr_config("NBFM", "FD", cfg, **TR_KW)
+    assert tr["systems"][0]["type"] == "conventional" and tr["systems"][0]["squelch"] == -62.0
+    tr, _ = tr_config.build_tr_config("NBFM", "FD", {"channels": [{"freq": 154.25}]}, **TR_KW)
+    assert tr["systems"][0]["squelch"] == -50.0
+    # Single channel: centre moved off it (DC spike).
+    assert abs(tr["sources"][0]["center"] - 154_250_000) >= tr_config.DC_SPIKE_GUARD_HZ
+    assert tr_config.live_sample_rate("NBFM", {}) == 16000 and tr_config.live_sample_rate("P25", {}) == 8000
+
+
+def test_legacy_analog_and_unpinned_sdr():
+    kw = {**TR_KW, "device_serial": None}
+    tr, _ = tr_config.build_tr_config("NBFM", "Old", {"control_channels": [155.1]}, **kw)
+    assert tr["sources"][0]["device"] == "rtl=0"
+    assert "155100000" in _["channels.csv"]
+
+
+@pytest.mark.parametrize("stype,cfg", [
+    ("DMR", {"control_channels": [450.0]}),
+    ("P25", {"control_channels": []}),
+    ("P25", {"mode": "conventional", "channels": [{"freq": 851.0}, {"freq": 855.0}]}),  # 4 MHz: every channel must fit
+    ("P25", {"mode": "conventional", "channels": []}),
+])
+def test_unbuildable_systems_raise(stype, cfg):
+    with pytest.raises(ValueError):
+        tr_config.build_tr_config(stype, "x", cfg, **TR_KW)
+
+
+def test_center_override_is_validated():
+    assert tr_config.choose_center([851_000_000], 2_400_000, override=851_500_000) == 851_500_000
+    with pytest.raises(ValueError):
+        tr_config.choose_center([851_000_000], 2_400_000, override=853_000_000)
+
+
+# ---------------------------------------------------------------------------
+# Call JSON -> MQTT + /upload
+# ---------------------------------------------------------------------------
+
+def test_parse_call_maps_tr_json():
+    call = parse_call(SAMPLE_CALL, "node-001", "101-1793145600.250_851012500-call_7")
+    assert call.tgid == 101 and call.tgid_name == "PD Dispatch" and call.freq == 851_012_500
+    assert call.start_epoch == pytest.approx(1793145600.25) and call.stop_epoch == pytest.approx(1793145612.73)
+    assert call.units == [1234567, 7654321]          # unique, in order, undecoded (-1) dropped
+    assert call.emergency is True                     # a unit's emergency flag counts
+    assert call.encrypted is False
+    assert call.decode_errors == 5 and call.spikes == 1 and call.call_length == pytest.approx(12.48)
+    # Deterministic: same JSON -> same id (restart safety), different node -> different id.
+    assert parse_call(SAMPLE_CALL, "node-001", "101-1793145600.250_851012500-call_7").call_id == call.call_id
+    assert parse_call(SAMPLE_CALL, "node-002", "101-1793145600.250_851012500-call_7").call_id != call.call_id
+
+    start = call.start_payload()
+    assert start["tgid"] == 101 and start["tgid_name"] == "PD Dispatch" and start["srcaddr"] == 1234567
+    assert start["attributed"] is True and start["driver"] == "trunk-recorder"
+    assert start["started_at"].startswith("2026-")
+    end = call.end_payload()
+    assert end["ended_at_epoch"] == pytest.approx(1793145612.73)
+    assert end["audio_start_epoch"] == call.start_epoch and end["units"] == [1234567, 7654321]
+    assert end["emergency"] is True and end["encrypted"] is False
+
+
+def test_upload_form_carries_tr_fields():
+    call = parse_call(SAMPLE_CALL, "node-001")
+    meta = UploadMeta(call_id=call.call_id, talkgroup_id=call.tgid, talkgroup_name=call.tgid_name,
+                      system_id="sys1", audio_start_epoch=call.start_epoch, audio_end_epoch=call.stop_epoch,
+                      extra=call.upload_extra())
+    form = upload_spool._form(meta)
+    # Fields C2's /upload declares today:
+    assert form["call_id"] == call.call_id and form["talkgroup_id"] == "101"
+    assert form["talkgroup_name"] == "PD Dispatch" and form["system_id"] == "sys1"
+    # Extra fields (ignored by C2 until it declares them):
+    assert form["units"] == "1234567,7654321" and form["emergency"] == "1" and form["encrypted"] == "0"
+    assert form["freq"] == "851012500" and form["recorder_backend"] == "trunk-recorder"
+    assert json.loads(form["src_list"])[1] == {"src": 7654321, "time": 1793145606, "pos": 5.2, "emergency": True}
+    # Extra can never overwrite a core field.
+    meta.extra = {"call_id": "evil"}
+    assert upload_spool._form(meta)["call_id"] == call.call_id
+
+
+def test_parse_call_old_tr_without_ms_and_bad_json():
+    old = {k: v for k, v in SAMPLE_CALL.items() if not k.endswith("_ms")}
+    call = parse_call(old, "n")
+    assert call.start_epoch == 1793145600.0 and call.stop_epoch == 1793145612.0
+    with pytest.raises(ValueError):
+        parse_call({**SAMPLE_CALL, "talkgroup": 0}, "n")
+    with pytest.raises(ValueError):
+        parse_call({k: v for k, v in old.items() if k != "start_time"}, "n")
+
+
+def test_mime_follows_suffix():
+    assert upload_spool.mime_for(Path("a.wav")) == "audio/wav"
+    assert upload_spool.mime_for(Path("a.flac")) == "audio/flac"
+
+
+# ---------------------------------------------------------------------------
+# Inbox hand-off
+# ---------------------------------------------------------------------------
+
+class FakeMQTT:
+    is_connected = True
+
+    def __init__(self):
+        self.events = []
+
+    async def publish_metadata(self, event, data):
+        self.events.append((event, dict(data)))
+
+
+class FakeRecorder:
+    def __init__(self, url="gs://b/calls/x.wav"):
+        self.url = url
+        self.uploads = []
+
+        class _Spool:
+            last_result = {"kind": "retry"}
+        self.spool = _Spool()
+
+    async def upload_recording(self, path, call_id, **kw):
+        assert path.exists()
+        self.uploads.append((path.name, call_id, kw))
+        path.unlink()
+        return self.url
+
+
+@pytest.fixture
+def tr_env(tmp_path, monkeypatch):
+    monkeypatch.setattr(settings, "recorder_backend", "trunk-recorder")
+    monkeypatch.setattr(settings, "tr_inbox_dir", str(tmp_path / "inbox"))
+    monkeypatch.setattr(settings, "tr_config_dir", str(tmp_path / "tr"))
+    monkeypatch.setattr(settings, "c2_url", "https://c2.example")
+    monkeypatch.setattr(trmod, "CALL_START_LEAD_SECONDS", 0)
+    mqtt, rec = FakeMQTT(), FakeRecorder()
+    import app.internal.call_recorder as cr
+    import app.internal.mqtt_manager as mm
+    monkeypatch.setattr(mm, "mqtt_manager", mqtt)
+    monkeypatch.setattr(cr, "call_recorder", rec)
+    (tmp_path / "inbox").mkdir()
+    return tmp_path / "inbox", mqtt, rec
+
+
+def _wav(path: Path, seconds: float = 2.0, rate: int = 8000) -> None:
+    import wave
+    with wave.open(str(path), "wb") as w:
+        w.setnchannels(1)
+        w.setsampwidth(2)
+        w.setframerate(rate)
+        w.writeframes(b"\x00\x00" * int(seconds * rate))
+
+
+def _drop(inbox: Path, data=SAMPLE_CALL, stem="101-1793145600.250_851012500-call_7", wav=True, seconds=11.68):
+    if wav:
+        _wav(inbox / f"{stem}.wav", seconds)
+    (inbox / f"{stem}.json").write_text(json.dumps(data))
+
+
+async def test_inbox_call_is_published_and_uploaded_once(tr_env):
+    inbox, mqtt, rec = tr_env
+    _drop(inbox)
+    t = trmod.TrunkRecorder()
+    assert await t.scan_once(wait=True) == 1
+    assert [e for e, _ in mqtt.events] == ["call_start", "call_end"]
+    start, end = mqtt.events[0][1], mqtt.events[1][1]
+    assert len(rec.uploads) == 1
+    name, call_id, kw = rec.uploads[0]
+    assert call_id == start["call_id"] == end["call_id"]
+    # Renamed to the spool's recoverable <date>_<time>_<call_id> form.
+    assert name.endswith(f"_{call_id}.wav") and name.count("_") == 2
+    assert kw["talkgroup_id"] == 101 and kw["extra"]["units"] == "1234567,7654321"
+    assert end["audio_url"] == "gs://b/calls/x.wav"
+    # TR drops the gaps between transmissions: the audio ends at start + WAV
+    # length (11.68 s), not at stop_time (12.48 s after start).
+    assert end["audio_end_epoch"] == pytest.approx(1793145600.25 + 11.68)
+    assert kw["audio_end_epoch"] == pytest.approx(1793145600.25 + 11.68)
+    assert end["ended_at_epoch"] == pytest.approx(1793145612.73)
+    assert json.loads(kw["extra"]["freq_list"])[1]["pos"] == 5.2
+    assert list(inbox.iterdir()) == []
+    assert await t.scan_once(wait=True) == 0
+
+
+async def test_encrypted_call_is_reported_not_uploaded(tr_env):
+    inbox, mqtt, rec = tr_env
+    _drop(inbox, {**SAMPLE_CALL, "encrypted": 1})
+    t = trmod.TrunkRecorder()
+    await t.scan_once(wait=True)
+    assert rec.uploads == []
+    assert mqtt.events[-1][1]["audio_skipped"] == "encrypted" and t.encrypted_skipped == 1
+    assert list(inbox.iterdir()) == []
+
+
+async def test_spooled_upload_is_reported(tr_env):
+    inbox, mqtt, rec = tr_env
+    rec.url = None
+    _drop(inbox)
+    await trmod.TrunkRecorder().scan_once(wait=True)
+    assert mqtt.events[-1][1]["audio_upload"] == "spooled"
+
+
+async def test_json_waits_for_wav_then_orphan_is_dropped(tr_env, monkeypatch):
+    inbox, mqtt, rec = tr_env
+    _drop(inbox, wav=False)
+    t = trmod.TrunkRecorder()
+    await t.scan_once(wait=True)
+    assert mqtt.events == [] and len(list(inbox.glob("*.json"))) == 1
+    monkeypatch.setattr(trmod, "ORPHAN_JSON_SECONDS", -1)
+    await t.scan_once(wait=True)
+    # Closed in C2 anyway: a previous pass may have uploaded it and died.
+    assert [e for e, _ in mqtt.events] == ["call_end"] and mqtt.events[0][1]["audio_skipped"] == "no_audio"
+    assert list(inbox.glob("*.json")) == []
+
+
+def test_stray_wavs_are_swept_but_claimed_ones_kept(tr_env):
+    inbox, _, _ = tr_env
+    (inbox / "stray-call_1.wav").write_bytes(b"x")
+    (inbox / "waiting-call_2.wav").write_bytes(b"x")
+    (inbox / "waiting-call_2.json").write_text("{}")
+    claimed = "20261027_120000_" + "0" * 8 + "-0000-0000-0000-" + "0" * 12 + ".wav"
+    (inbox / claimed).write_bytes(b"x")
+    t = trmod.TrunkRecorder()
+    assert t.sweep_stray_wavs() == 0                       # all younger than an hour
+    assert t.sweep_stray_wavs(now=4_000_000_000) == 1
+    assert sorted(p.name for p in inbox.iterdir()) == sorted([claimed, "waiting-call_2.json", "waiting-call_2.wav"])
+
+
+async def test_waits_for_mqtt_so_call_start_isnt_lost(tr_env):
+    inbox, mqtt, rec = tr_env
+    mqtt.is_connected = False
+    _drop(inbox)
+    assert await trmod.TrunkRecorder().scan_once(wait=True) == 0
+    assert rec.uploads == []
+
+
+async def test_unreadable_json_is_dropped(tr_env):
+    inbox, mqtt, rec = tr_env
+    (inbox / "bad.wav").write_bytes(b"x")
+    (inbox / "bad.json").write_text("{not json")
+    await trmod.TrunkRecorder().scan_once(wait=True)
+    assert list(inbox.iterdir()) == [] and mqtt.events == []
+
+
+# ---------------------------------------------------------------------------
+# Config files on disk, supervisor requests, backend dispatch
+# ---------------------------------------------------------------------------
+
+async def test_apply_config_writes_files_and_restart(tr_env, monkeypatch, tmp_path):
+    from app.models import SystemConfig
+    import app.internal.secondary_sdr_client as ssc
+
+    async def devices():
+        return [{"serial": "00000101", "index": 0}]
+    monkeypatch.setattr(ssc.secondary_sdr_client, "devices", devices)
+    t = trmod.TrunkRecorder()
+    ok = await t.apply_config(SystemConfig(system_id="s1", name="County", type="P25",
+                                           config={"control_channels": [851.0125], "talkgroups": [{"id": 1}]}))
+    assert ok and t.config_error is None
+    d = tmp_path / "tr"
+    cfg = json.loads((d / "config.json").read_text())
+    assert cfg["sources"][0]["device"] == "rtl=00000101" and (d / "talkgroups.csv").exists()
+
+    bad = await t.apply_config(SystemConfig(system_id="s2", name="Wide", type="P25",
+                                            config={"mode": "conventional",
+                                                    "channels": [{"freq": 851.0}, {"freq": 856.0}]}))
+    assert not bad and "MHz" in t.config_error
+    # radio_backend reports the config error instead of pretending to start.
+    monkeypatch.setattr(trmod, "trunk_recorder", t)
+    assert "MHz" in await radio_backend.start_with_reason()
+    t.config_error = None
+    monkeypatch.setattr(trmod, "RESTART_POLL_SECONDS", 0.01)
+    # start() waits for run.sh to report a restart, so decoders aren't handed
+    # the dongle before TR has it.
+    monkeypatch.setattr(trmod, "RESTART_WAIT_SECONDS", 0.05)
+    assert "isn't running" in await radio_backend.start_with_reason()
+    assert (d / "restart-request").exists()
+    import time as _t
+    (d / "drb-status.json").write_text(json.dumps({"state": "running", "epoch": _t.time(),
+                                                   "started_at": _t.time() - 600}))
+    assert "didn't restart" in await radio_backend.start_with_reason()   # still the old process
+    (d / "drb-status.json").write_text(json.dumps({"state": "running", "epoch": _t.time() + 5,
+                                                   "started_at": _t.time() + 5}))
+    assert await radio_backend.start_with_reason() is None
+    assert await radio_backend.start_with_reason(wait=False) is None
+    assert await radio_backend.stop() and (d / "stop-request").exists()
+    assert await radio_backend.start() and not (d / "stop-request").exists()
+
+
+async def test_op25_backend_still_drives_op25(monkeypatch):
+    monkeypatch.setattr(settings, "recorder_backend", "op25")
+    calls = []
+
+    async def start_with_reason():
+        calls.append("start")
+        return None
+    monkeypatch.setattr(radio_backend.op25_client, "start_with_reason", start_with_reason)
+    assert await radio_backend.start() and calls == ["start"]
+
+
+def test_supervisor_status_and_decode_rate(tr_env, tmp_path):
+    d = tmp_path / "tr"
+    (d / "logs").mkdir(parents=True)
+    t = trmod.TrunkRecorder()
+    assert t.supervisor_status() is None
+    (d / "drb-status.json").write_text(json.dumps({"state": "running", "epoch": 1000, "started_at": 900}))
+    st = t.supervisor_status(now=1005)
+    assert st["state"] == "running" and not st["stale"]
+    assert t.supervisor_status(now=1100)["stale"]
+    (d / "logs" / "10-27-2026_1200_00.log").write_text(
+        "[2026-10-27 12:00:03.1] (info)   [drb]\tControl Channel Message Decode Rate: 38/sec, count:  114\n"
+        "[2026-10-27 12:00:06.1] (error)  [drb]\tControl Channel Message Decode Rate: 0/sec, count:  0\n")
+    assert t.log_facts()["decode_rate"] == 0.0
+    assert t.log_tail(1)[0].endswith("count:  0")
+
+
+# ---------------------------------------------------------------------------
+# Live audio: follow one talkgroup
+# ---------------------------------------------------------------------------
+
+def test_live_bridge_follows_one_talkgroup():
+    b = trmod.LiveAudioBridge()
+    b._write = lambda pcm: None
+    pkt = lambda tg: tg.to_bytes(4, "little") + b"\x01\x00" * 80   # noqa: E731
+    assert b.feed(pkt(101), now=0.0) is not None
+    assert b.feed(pkt(202), now=0.5) is None                      # simultaneous call: not mixed in
+    assert b.feed(pkt(101), now=1.0) is not None
+    assert b.feed(pkt(202), now=1.0 + b.HOLD_SECONDS + 0.1) is not None   # 101 went quiet: switch
+    assert b.current_tgid == 202 and b.packets == 4
+    assert b.feed(b"\x00\x00", now=9.0) is None
+
+
+# ---------------------------------------------------------------------------
+# Health checklist
+# ---------------------------------------------------------------------------
+
+def _facts(tr, mode="trunked", **over):
+    now = 1_000_000.0
+    f = {
+        "now": now, "node_id": "n", "default_password": False, "c2_url": "https://c2", "has_api_key": True,
+        "mqtt_connected": True, "mqtt_broker": "m", "mqtt_port": 8883, "sdr_count": 1,
+        "source": {"name": "County", "type": "P25", "system_id": "s1", "local": False, "mode": mode},
+        "op25_status": "stopped", "console": {}, "audio_capturing": False, "last_voice_epoch": None,
+        "icecast_live": False, "icecast_port": 8000, "backend": "trunk-recorder", "tr": tr,
+    }
+    f.update(over)
+    return {c["id"]: c for c in health.build_checks(f)}
+
+
+def _tr(**over):
+    now = 1_000_000.0
+    t = {"status": {"state": "running", "started_at": now - 600, "restarts": 0, "stale": False, "age_seconds": 2},
+         "log_age_seconds": 3, "decode_rate": 38.0, "config_error": None, "inbox_backlog": 0,
+         "calls_ingested": 5, "encrypted_skipped": 0, "last_call_epoch": now - 30, "last_call": None,
+         "live": {"last_packet_epoch": now - 30}}
+    t.update(over)
+    return t
+
+
+def test_health_tr_running_and_decoding():
+    c = _facts(_tr())
+    assert "op25" not in c and c["recorder"]["state"] == "ok"
+    assert c["decode"]["state"] == "ok" and "38" in c["decode"]["summary"]
+    assert c["audio"]["state"] == "ok" and c["stream"]["state"] == "ok"
+
+
+@pytest.mark.parametrize("tr,cid,state", [
+    (None, "recorder", "error"),
+    ({"status": None}, "recorder", "error"),                               # profile not enabled
+    ({"status": {"state": "crashed", "last_exit": 1, "stale": False}}, "recorder", "error"),
+    ({"status": {"state": "running", "stale": True, "age_seconds": 60}}, "recorder", "error"),
+    ({"config_error": "too wide"}, "recorder", "error"),
+    ({"decode_rate": 0.0}, "decode", "error"),
+    ({"decode_rate": None}, "decode", "warn"),
+    ({"inbox_backlog": 50}, "audio", "warn"),
+])
+def test_health_tr_failures(tr, cid, state):
+    facts = None if tr is None else _tr(**tr)
+    assert _facts(facts)[cid]["state"] == state
+
+
+def test_health_tr_conventional_has_no_decode_rate():
+    assert _facts(_tr(decode_rate=None), mode="conventional")["decode"]["state"] == "ok"
+
+
+def test_wide_control_channel_list_is_cut_to_what_one_sdr_covers():
+    # MTA Zone 2 (node-002): five control channels spanning 4.15 MHz.
+    ccs = [770_156_250, 770_431_250, 773_293_750, 773_843_750, 774_306_250]
+    assert tr_config.widest_cover(ccs, 2_400_000) == ccs[2:]
+
+
+def test_center_override_keeps_only_the_control_channels_it_covers():
+    tr, _ = tr_config.build_tr_config(
+        "P25", "MTA", {"control_channels": [770.15625, 770.43125, 773.29375]},
+        **{**TR_KW, "center_override": 770_900_000})
+    assert tr["systems"][0]["control_channels"] == [770_156_250, 770_431_250]

drb-edge-node/tests/test_upload_spool.py

@@ -0,0 +1,230 @@
+"""
+Upload spool (node-26#44): a failed upload must never delete the recording.
+
+Before the spool, upload_recording unlinked the file in a `finally`, so any C2
+outage, 5xx or timeout lost that call's audio for good.
+"""
+import asyncio
+import json
+from pathlib import Path
+
+import pytest
+
+from app.config import settings
+from app.internal import upload_spool
+from app.internal.call_recorder import CallRecorder
+from app.internal.upload_spool import OK, REJECT, RETRY, UploadMeta, UploadResult, UploadSpool, classify
+
+
+class Clock:
+    def __init__(self, t: float = 1_000_000.0):
+        self.t = t
+
+    def __call__(self) -> float:
+        return self.t
+
+
+class FakeUploader:
+    def __init__(self, *results: UploadResult):
+        self.results = list(results)
+        self.calls = []
+
+    async def __call__(self, path: Path, meta: UploadMeta) -> UploadResult:
+        assert path.exists(), "the uploader must be handed a file that exists"
+        self.calls.append((path.name, meta))
+        return self.results.pop(0) if self.results else UploadResult(OK, url="gs://x")
+
+
+def _recording(tmp_path: Path, name: str = "20261027_call-1.flac", size: int = 100) -> Path:
+    p = tmp_path / "rec" / name
+    p.parent.mkdir(parents=True, exist_ok=True)
+    p.write_bytes(b"f" * size)
+    return p
+
+
+def _spool(tmp_path: Path, uploader, clock=None, **kw) -> UploadSpool:
+    args = dict(max_bytes=10_000, max_age_seconds=3600, backoff_min=10, backoff_max=80)
+    args.update(kw)
+    return UploadSpool(tmp_path / "spool", uploader, clock=clock or Clock(), **args)
+
+
+# ---------------------------------------------------------------------------
+# Classification
+# ---------------------------------------------------------------------------
+
+@pytest.mark.parametrize("status,url,kind", [
+    (200, "gs://b/o", OK),
+    (200, None, RETRY),      # C2's GCS write failed: nothing stored
+    (401, None, RETRY),      # a reissued key is on its way
+    (408, None, RETRY),
+    (429, None, RETRY),
+    (500, None, RETRY),
+    (503, None, RETRY),
+    (400, None, REJECT),
+    (403, None, RETRY),      # not approved yet: approval may still come
+    (413, None, REJECT),
+])
+def test_classify(status, url, kind):
+    assert classify(status, url) == kind
+
+
+# ---------------------------------------------------------------------------
+# upload_recording: delete only on success
+# ---------------------------------------------------------------------------
+
+@pytest.fixture
+def recorder(tmp_path, monkeypatch):
+    monkeypatch.setattr(settings, "c2_url", "https://c2.example")
+    rec = CallRecorder()
+    rec.spool = _spool(tmp_path, rec._post)
+    return rec
+
+
+def _patch_post(monkeypatch, result: UploadResult):
+    async def fake(path, meta, mime, timeout=None):
+        return result
+    monkeypatch.setattr(upload_spool, "post_recording", fake)
+
+
+async def test_failed_upload_keeps_the_file_in_the_spool(tmp_path, recorder, monkeypatch):
+    _patch_post(monkeypatch, UploadResult(RETRY, detail="ConnectError: refused"))
+    path = _recording(tmp_path)
+    url = await recorder.upload_recording(path, "call-1", talkgroup_id=101, talkgroup_name="Dispatch",
+                                          system_id="sys-1", audio_start_epoch=1.5, audio_end_epoch=9.25)
+    assert url is None
+    assert not path.exists()
+    spooled = tmp_path / "spool" / path.name
+    assert spooled.read_bytes() == b"f" * 100
+    meta = json.loads((tmp_path / "spool" / (path.name + ".json")).read_text())
+    assert meta["call_id"] == "call-1" and meta["talkgroup_id"] == 101 and meta["system_id"] == "sys-1"
+    assert meta["audio_start_epoch"] == 1.5 and meta["audio_end_epoch"] == 9.25
+    assert meta["last_error"] == "ConnectError: refused"
+    assert recorder.spool.stats()["files"] == 1
+
+
+async def test_successful_upload_deletes_the_file(tmp_path, recorder, monkeypatch):
+    _patch_post(monkeypatch, UploadResult(OK, url="gs://b/call-1.flac", status=200))
+    path = _recording(tmp_path)
+    assert await recorder.upload_recording(path, "call-1") == "gs://b/call-1.flac"
+    assert not path.exists()
+    assert recorder.spool.stats()["files"] == 0
+
+
+async def test_rejected_upload_is_not_spooled(tmp_path, recorder, monkeypatch):
+    _patch_post(monkeypatch, UploadResult(REJECT, status=413, detail="HTTP 413: File too large"))
+    path = _recording(tmp_path)
+    assert await recorder.upload_recording(path, "call-1") is None
+    assert not path.exists()
+    assert recorder.spool.stats()["files"] == 0
+    assert recorder.spool.last_result["kind"] == REJECT
+
+
+async def test_real_post_network_error_is_retryable(tmp_path, monkeypatch):
+    monkeypatch.setattr(settings, "c2_url", "http://127.0.0.1:9")  # discard port: refused
+    path = _recording(tmp_path)
+    result = await upload_spool.post_recording(path, UploadMeta(call_id="c"), "audio/flac")
+    assert result.kind == RETRY and result.status is None
+    assert path.exists(), "post_recording must never touch the file"
+
+
+# ---------------------------------------------------------------------------
+# Retry, startup drain, caps
+# ---------------------------------------------------------------------------
+
+async def test_retry_backs_off_then_uploads(tmp_path):
+    clock = Clock()
+    up = FakeUploader(UploadResult(RETRY, status=503, detail="HTTP 503"), UploadResult(OK, url="gs://x"))
+    sp = _spool(tmp_path, up, clock=clock)
+    sp.add(_recording(tmp_path), UploadMeta(call_id="c1"), UploadResult(RETRY, detail="first"))
+
+    assert await sp.drain_once() == 0 and up.calls == []      # not due yet
+    clock.t += 10
+    assert await sp.drain_once() == 0 and len(up.calls) == 1  # retry 2 fails
+    data = json.loads(next((tmp_path / "spool").glob("*.json")).read_text())
+    assert data["attempts"] == 2 and data["next_attempt_at"] == clock.t + 20
+    clock.t += 20
+    assert await sp.drain_once() == 1
+    assert list((tmp_path / "spool").iterdir()) == []
+
+
+async def test_startup_drain_uploads_what_survived_a_restart(tmp_path):
+    clock = Clock()
+    first = _spool(tmp_path, FakeUploader(), clock=clock)
+    first.add(_recording(tmp_path, "a_c1.flac"), UploadMeta(call_id="c1", talkgroup_id=7), UploadResult(RETRY))
+    first.add(_recording(tmp_path, "b_c2.flac"), UploadMeta(call_id="c2"), UploadResult(RETRY))
+
+    # A new process: same directory, nothing due by the sidecar timers.
+    up = FakeUploader()
+    restarted = _spool(tmp_path, up, clock=clock, poll_seconds=0.01)
+    restarted.start()
+    for _ in range(100):
+        if len(up.calls) == 2:
+            break
+        await asyncio.sleep(0.01)
+    await restarted.stop()
+    assert [m.call_id for _, m in up.calls] == ["c1", "c2"]
+    assert up.calls[0][1].talkgroup_id == 7
+    assert list((tmp_path / "spool").iterdir()) == []
+
+
+async def test_rejected_on_retry_is_deleted(tmp_path):
+    clock = Clock()
+    sp = _spool(tmp_path, FakeUploader(UploadResult(REJECT, status=413)), clock=clock)
+    sp.add(_recording(tmp_path), UploadMeta(call_id="c1"), UploadResult(RETRY))
+    await sp.drain_once(force=True)
+    assert sp.stats()["files"] == 0
+
+
+async def test_age_cap_drops_expired_entries(tmp_path):
+    clock = Clock()
+    sp = _spool(tmp_path, FakeUploader(), clock=clock, max_age_seconds=3600)
+    sp.add(_recording(tmp_path, "old_c1.flac"), UploadMeta(call_id="c1"), UploadResult(RETRY))
+    clock.t += 1800
+    sp.add(_recording(tmp_path, "new_c2.flac"), UploadMeta(call_id="c2"), UploadResult(RETRY))
+    clock.t += 1801
+    assert sp.enforce_caps() == 1
+    assert [p.name for p in (tmp_path / "spool").glob("*.flac")] == ["new_c2.flac"]
+
+
+async def test_size_cap_evicts_oldest_first(tmp_path):
+    clock = Clock()
+    sp = _spool(tmp_path, FakeUploader(), clock=clock, max_bytes=250)
+    for i in range(3):
+        sp.add(_recording(tmp_path, f"{i}_c{i}.flac", size=100), UploadMeta(call_id=f"c{i}"), UploadResult(RETRY))
+        clock.t += 1
+    assert sp.enforce_caps() == 1
+    assert sorted(p.name for p in (tmp_path / "spool").glob("*.flac")) == ["1_c1.flac", "2_c2.flac"]
+    assert sp.stats()["bytes"] == 200
+
+
+async def test_half_written_pairs_are_cleaned(tmp_path):
+    sp = _spool(tmp_path, FakeUploader())
+    d = tmp_path / "spool"
+    d.mkdir()
+    (d / "lost.flac.json").write_text(json.dumps({"call_id": "x", "spooled_at": 0}))  # no audio
+    (d / "orphan.flac").write_bytes(b"a")                       # no sidecar, no call_id in name
+    assert sp.stats()["files"] == 0
+    assert list(d.iterdir()) == []
+
+
+async def test_lost_or_corrupt_sidecar_is_rebuilt_from_the_filename(tmp_path):
+    """A power cut can zero a sidecar; the audio must survive it."""
+    up = FakeUploader()
+    sp = _spool(tmp_path, up)
+    d = tmp_path / "spool"
+    d.mkdir()
+    (d / "20261027_120000_call-a.flac").write_bytes(b"a")
+    (d / "20261027_120001_call_b.flac").write_bytes(b"b")
+    (d / "20261027_120001_call_b.flac.json").write_text("")
+    assert sp.stats()["files"] == 2
+    await sp.drain_once()
+    assert sorted(m.call_id for _, m in up.calls) == ["call-a", "call_b"]
+
+
+async def test_wake_makes_everything_due_now(tmp_path):
+    clock = Clock()
+    up = FakeUploader()
+    sp = _spool(tmp_path, up, clock=clock)
+    sp.add(_recording(tmp_path), UploadMeta(call_id="c1"), UploadResult(RETRY, status=401))
+    sp.wake()
+    assert await sp.drain_once() == 1

install.sh

@@ -1,25 +1,34 @@
 #!/usr/bin/env bash
 #
-# DRB edge node — one-shot bootstrap for a clean Raspberry Pi OS (arm64).
+# DRB edge node — one-shot bootstrap for a clean Raspberry Pi OS (arm64) or Debian (amd64).
 #
 #   curl -fsSL https://git.vpn.cusano.net/logan/node-26/raw/tag/v1/install.sh \
-#     | sudo bash -s -- --token DRB-xxxx --node-id node-003 \
+#     | sudo bash -s -- --node-id node-003 \
 #         --c2-url https://api.<domain> --mqtt-broker mqtt.<domain>
 #
+# It prompts (hidden input) for the enrollment token. The token is never
+# taken from the command line by design (node-26#18, CISO condition from
+# server-26#61): argv lands in shell history and in `ps`. Unattended installs
+# use --token-file PATH (a 0600 file) or an exported DRB_ENROLLMENT_TOKEN.
+#
 # (fetch install.sh from the same tag it installs; use raw/branch/main with
 #  --track-main for the owner's own always-latest nodes)
 #
 # Hosting, the pinned ref, and setup.sh's retirement are settled (owner
-# decisions, 2026-09-06). One standing hazard remains — D3 below.
+# decisions, 2026-09-06). D3 below is mitigated by image pinning (node-26#19).
 #
 # What it does, in order:
 #   1. Preflight (root, arch, apt, SDR present)
 #   2. Install Docker + compose plugin + git + curl + jq
 #   3. Clone logan/node-26 at a PINNED ref into $INSTALL_DIR
 #   4. Write .env (non-interactive from flags/env, interactive fallback)
-#   5. Enroll with C2 (POST /nodes/enroll) and poll for the api_key
-#   6. docker compose pull && up -d   (prebuilt; --build opts into the ~1h build)
-#   7. Print the approval step
+#   5. Enroll with C2 (POST /nodes/enroll), then BLOCK until an admin approves
+#      and the api_key is written (node-26#14). Ctrl-C safe: re-run resumes
+#      from configs/pickup_secret. A re-run also refreshes a stale key.
+#   6. docker compose pull && up -d, ALWAYS recreating edge-node so it loads
+#      the key on disk  (prebuilt; --build opts into the ~1h build)
+#   7. Install the host updater (systemd timer + path unit, node-26#15)
+#   8. Print a summary
 #
 # It does NOT set up WireGuard. WireGuard-per-node was evaluated and rejected
 # (Server/MQTT-PUBLIC-AUTH-PLAN.md, Server/infra/main.tf:67-73). A field node
@@ -44,15 +53,18 @@
 #       the mint panel / node-26#4). DEFAULT_REF below is `v1`. `--track-main`
 #       stays as an opt-in for the owner's own nodes.
 #
-# STANDING HAZARD
+# MITIGATED HAZARD
 #
 #   D3  SOURCE-OVERLAY. docker-compose.yml bind-mounts ./drb-edge-node/app and
-#       ./op25-container/app OVER the image's /app. So even in prebuilt mode
-#       the running Python is the CLONED REF's code against the pulled image's
-#       dependencies. `v1` == the commit CI built the current :latest/:stable
-#       from, so today they match — but the moment `v1` and the image tags
-#       diverge this silently mixes them. Fix: drop those two mounts from the
-#       prod compose path, or always retag images from the same ref as `v1`.
+#       ./op25-container/app OVER the image's /app, so the running Python is
+#       the CLONED REF's code against the pulled image's dependencies. Those
+#       used to be :latest/:stable, built from main — silently a different
+#       commit from `v1`. Since node-26#19 every image is pinned to
+#       src-<git tree hash of its own directory at the checked-out ref>
+#       (scripts/image-tags.sh, written into .env as DRB_TAG_*), which CI tags
+#       identically. The mounts now overlay the same code the image was built
+#       from. A pinned image that was never built fails the pull loudly; the
+#       "Release images" workflow builds any a release tag is missing.
 # ---------------------------------------------------------------------------
 set -euo pipefail
 
@@ -74,6 +86,7 @@ MQTT_BROKER="${DRB_MQTT_BROKER:-}"
 MQTT_PORT="${DRB_MQTT_PORT:-8883}"
 MQTT_TLS="${DRB_MQTT_TLS:-true}"
 ENROLLMENT_TOKEN="${DRB_ENROLLMENT_TOKEN:-}"
+unset DRB_ENROLLMENT_TOKEN   # read once; don't leak it into every child's env
 DASHBOARD_USER="${DRB_DASHBOARD_USERNAME:-admin}"
 DASHBOARD_PASS="${DRB_DASHBOARD_PASSWORD:-}"
 REGISTRY="${DRB_IMAGE_REGISTRY:-git.vpn.cusano.net}"   # D1 (public host)
@@ -85,7 +98,14 @@ REGISTRY_PASS="${DRB_REGISTRY_PASS:-}"
 DO_BUILD=0        # 0 = pull prebuilt images (default), 1 = build on the Pi (~1h for op25)
 DO_START=1
 ASSUME_YES=0
-ENROLL_WAIT="${DRB_ENROLL_WAIT:-0}"   # seconds to block waiting for admin approval; 0 = don't block
+# How long to block waiting for admin approval. Default: forever (node-26#14 —
+# the old default of 0 started a keyless stack that never came online).
+# N>0 = give up after N seconds and start anyway; 0 = don't wait at all. Either
+# way the edge-node app keeps fetching the key itself and comes online on its
+# own once approved.
+ENROLL_WAIT="${DRB_ENROLL_WAIT:-forever}"
+APP_URL="${DRB_APP_URL:-}"
+INSTALL_UPDATER=1
 
 C='\033[0;36m'; G='\033[0;32m'; Y='\033[1;33m'; R='\033[0;31m'; N='\033[0m'
 say()  { printf "${C}==>${N} %s\n" "$*"; }
@@ -97,7 +117,10 @@ usage() {
   cat <<'USAGE'
 Usage: install.sh [options]
 
-  --token TOKEN        Enrollment token (Settings -> Nodes -> New token)
+  (enrollment token)   Prompted for on the terminal, input hidden. Mint one at
+                       Settings -> Nodes -> New token.
+  --token-file PATH    read the enrollment token from PATH (unattended installs;
+                       keep it mode 0600 and delete it afterwards)
   --node-id ID         Unique node id, e.g. node-003
   --name NAME          Display name (default: node id)
   --lat N --lon N      Decimal degrees for the map
@@ -111,18 +134,29 @@ Usage: install.sh [options]
   --dir PATH           install location (default /opt/drb/node-26)
   --build              build images locally instead of pulling (~1h for op25)
   --no-start           configure and enroll, but do not start containers
-  --wait-approval SEC  block up to SEC seconds polling for admin approval
+  --wait-approval SEC  stop waiting for admin approval after SEC seconds
+                       (default: wait forever; 0 = don't wait). The node
+                       still fetches its key by itself once approved.
+  --app-url URL        admin UI base for the approval message
+                       (default: C2 URL without its "api." prefix)
+  --no-updater         don't install the host updater (no remote updates)
   -y, --yes            never prompt; fail instead of asking
 
 Every option also has an env var: DRB_NODE_ID, DRB_C2_URL, DRB_ENROLLMENT_TOKEN,
 DRB_MQTT_BROKER, DRB_REF, DRB_INSTALL_DIR, DRB_REGISTRY_USER/PASS, ...
-Secrets are read from the environment or prompted on the TTY, never from a pipe.
+Secrets are read from a file, the environment or a TTY prompt, never from a
+pipe. Never put the token on a command line: `--token X` and
+`sudo DRB_ENROLLMENT_TOKEN=X bash` both expose it in shell history and `ps`.
+An exported DRB_ENROLLMENT_TOKEN only reaches the installer through sudo with
+`sudo --preserve-env=DRB_ENROLLMENT_TOKEN bash` (plain sudo drops it).
+(`--token` still works for old copied commands but is deprecated, see node-26#18.)
 USAGE
 }
 
 while [ $# -gt 0 ]; do
   case "$1" in
-    --token)          ENROLLMENT_TOKEN="$2"; shift 2 ;;
+    --token)          ENROLLMENT_TOKEN="$2"; TOKEN_ON_ARGV=1; shift 2 ;;
+    --token-file)     TOKEN_FILE="$2"; shift 2 ;;
     --node-id)        NODE_ID="$2"; shift 2 ;;
     --name)           NODE_NAME="$2"; shift 2 ;;
     --lat)            NODE_LAT="$2"; shift 2 ;;
@@ -138,12 +172,29 @@ while [ $# -gt 0 ]; do
     --build)          DO_BUILD=1; shift ;;
     --no-start)       DO_START=0; shift ;;
     --wait-approval)  ENROLL_WAIT="$2"; shift 2 ;;
+    --app-url)        APP_URL="$2"; shift 2 ;;
+    --no-updater)     INSTALL_UPDATER=0; shift ;;
     -y|--yes)         ASSUME_YES=1; shift ;;
     -h|--help)        usage; exit 0 ;;
     *)                die "unknown option: $1 (try --help)" ;;
   esac
 done
 
+if [ "${TOKEN_ON_ARGV:-0}" = 1 ]; then
+  warn "--token is deprecated: the token is now in your shell history and visible in"
+  warn "\`ps\` for this whole install (node-26#18). Omit it to be prompted, or use --token-file."
+fi
+if [ -n "${TOKEN_FILE:-}" ]; then
+  [ -r "$TOKEN_FILE" ] || die "--token-file: cannot read $TOKEN_FILE"
+  _mode="$(stat -c %a "$TOKEN_FILE" 2>/dev/null || echo 600)"
+  (( 8#$_mode & 8#044 )) && warn "--token-file $TOKEN_FILE is readable by other users — chmod 600 it"
+  ENROLLMENT_TOKEN="$(tr -d '[:space:]' < "$TOKEN_FILE")"
+  [ -n "$ENROLLMENT_TOKEN" ] || die "--token-file: $TOKEN_FILE is empty"
+fi
+
+[ "$ENROLL_WAIT" = forever ] || [[ "$ENROLL_WAIT" =~ ^[0-9]+$ ]] \
+  || die "--wait-approval takes a number of seconds (or omit it to wait until approved)"
+
 # Prompts must come from the terminal, not from the `curl |` pipe on stdin.
 ask() {  # ask VAR "prompt" "default"
   local __v="$1" __p="$2" __d="${3:-}" __r=""
@@ -160,6 +211,14 @@ ask_secret() {
   read -rsp "$__p: " __r </dev/tty; echo >/dev/tty
   printf -v "$__v" '%s' "$__r"
 }
+# Make sure ENROLLMENT_TOKEN is set: already given, else prompt on the TTY.
+# Returns 1 if there is still no token (non-interactive, or Enter at the prompt).
+need_token() {
+  [ -n "$ENROLLMENT_TOKEN" ] || ask_secret ENROLLMENT_TOKEN "Enrollment token (input hidden)"
+  [ -n "$ENROLLMENT_TOKEN" ]
+}
+NO_TOKEN_HELP="mint one at Settings -> Nodes and re-run the install command; it prompts for
+  the token (unattended: --token-file PATH, or an exported DRB_ENROLLMENT_TOKEN)"
 genpw() { head -c 24 /dev/urandom | base64 | tr -d '\n=' ; }
 
 # ── 1. Preflight ────────────────────────────────────────────────────────────
@@ -169,8 +228,8 @@ command -v apt-get >/dev/null || die "apt-get not found — this script targets
 
 ARCH="$(dpkg --print-architecture)"
 case "$ARCH" in
-  arm64|aarch64) ok "arch $ARCH" ;;
-  *) warn "arch is $ARCH — CI only builds linux/arm64 images. Prebuilt pull will fail; use --build." ;;
+  arm64|aarch64|amd64|x86_64) ok "arch $ARCH" ;;
+  *) warn "arch is $ARCH — CI only builds linux/amd64 + linux/arm64 images. Prebuilt pull will fail; use --build." ;;
 esac
 ok "running as root"
 
@@ -226,7 +285,9 @@ mkdir -p "$(dirname "$INSTALL_DIR")"
 if [ -d "$INSTALL_DIR/.git" ]; then
   ok "existing install at $INSTALL_DIR — updating in place (.env is preserved)"
   git -C "$INSTALL_DIR" remote set-url origin "$REPO_URL"
-  git -C "$INSTALL_DIR" fetch --tags --prune origin
+  # --force: a moved release tag (v1 re-cut) must replace the local copy,
+  # otherwise fetch refuses with "would clobber existing tag" and set -e dies.
+  git -C "$INSTALL_DIR" fetch --force --tags --prune origin
 else
   git clone --no-checkout "$REPO_URL" "$INSTALL_DIR"
 fi
@@ -311,6 +372,20 @@ EOF
   ok ".env written for '$NODE_ID'"
 fi
 
+# Pin every image to the source just checked out (node-26#19, D3). Written
+# into .env — fresh or preserved — so later manual `docker compose` runs on
+# this node use the same pins.
+# A --ref older than #19 has no helper; its compose file hardcodes its tags.
+if [ -f "$INSTALL_DIR/scripts/image-tags.sh" ]; then
+  # shellcheck source=scripts/image-tags.sh
+  . "$INSTALL_DIR/scripts/image-tags.sh"
+  drb_pin_image_tags "$INSTALL_DIR/.env" "$INSTALL_DIR" "$RESOLVED_SHA" || die "could not write image pins to .env"
+  ok "images pinned to the source at ${RESOLVED_SHA:0:12} (DRB_TAG_* in .env)"
+else
+  warn "$REF predates image pinning (node-26#19) — using its compose file's default image tags"
+  drb_images_present() { return 0; }
+fi
+
 # ── 5. Enrollment ───────────────────────────────────────────────────────────
 # Client half of Server/drb-c2-core/app/routers/enrollment.py. It does NOT
 # exist in the edge-node app today (mqtt_manager.py:73-85 says so explicitly),
@@ -345,57 +420,88 @@ PICKUP_FILE="$INSTALL_DIR/configs/pickup_secret"
 # GET /nodes/{id}/credentials. Sets CRED_HTTP + CRED_BODY (no -f: we need the
 # body and status on a 4xx). One implementation so first-run and re-run agree.
 creds_pickup() {  # creds_pickup PICKUP_SECRET
-  local _tmp; _tmp="$(mktemp)"
+  local _tmp _hdr; _tmp="$(mktemp)"; _hdr="$(mktemp)"; chmod 600 "$_hdr"
+  # Secret via a 0600 header file, never curl's argv (visible in `ps`).
+  printf 'X-Pickup-Secret: %s\n' "$1" > "$_hdr"
   CRED_HTTP="$(curl -sS -o "$_tmp" -w '%{http_code}' \
-      "$C2_URL/nodes/$NODE_ID/credentials" -H "X-Pickup-Secret: $1" 2>/dev/null || echo 000)"
+      "$C2_URL/nodes/$NODE_ID/credentials" -H "@$_hdr" 2>/dev/null || echo 000)"
   CRED_BODY="$(cat "$_tmp" 2>/dev/null || true)"
-  rm -f "$_tmp"
+  rm -f "$_tmp" "$_hdr"
 }
 cred_field() { printf '%s' "${CRED_BODY:-}" | jq -r "$1 // empty" 2>/dev/null || true; }
 
+KEY_WRITTEN=0
+# Merge into the existing file: the edge-node app keeps its dashboard auth
+# salt + session secret in the same JSON, and clobbering them logs everyone
+# out. Atomic (tmp + mv) so a Ctrl-C can never leave half a file.
 write_creds() {  # write_creds API_KEY
-  umask 077; jq -n --arg k "$1" '{api_key:$k}' > "$CREDS"; umask 022
-  ok "api_key received and written to configs/credentials.json"
+  local _tmp="$CREDS.tmp"
+  umask 077
+  if [ -s "$CREDS" ] && jq -e . "$CREDS" >/dev/null 2>&1; then
+    jq --arg k "$1" '.api_key = $k' "$CREDS" > "$_tmp"
+  else
+    jq -n --arg k "$1" '{api_key:$k}' > "$_tmp"
+  fi
+  umask 022
+  mv -f "$_tmp" "$CREDS"
+  KEY_WRITTEN=1
+  ok "api_key written to configs/credentials.json"
 }
 
+[ -n "$APP_URL" ] || { APP_URL="${C2_URL/:\/\/api./://}"; }
+APP_URL="${APP_URL%/}"
+
 say_pending() {  # say_pending APPROVAL_STATUS  — not an error: node is enrolled, key not minted yet
   warn "not approved yet — C2 reports approval_status=${1:-pending}, no api_key minted."
-  warn "an admin must, at  <app-url>/settings/nodes :  Approve '$NODE_ID'  (assigning a system is separate)."
-  warn "then re-run this installer — it reuses configs/pickup_secret — or fetch it directly:"
-  warn "  curl -fsS $C2_URL/nodes/$NODE_ID/credentials -H \"X-Pickup-Secret: \$(cat $PICKUP_FILE)\" | jq -r .api_key"
+  warn "an admin must approve '$NODE_ID' at ${APP_URL}/settings/nodes. The node keeps fetching"
+  warn "its key by itself and comes online once approved; re-running this installer also works."
 }
 
-# Poll creds_pickup for up to ENROLL_WAIT seconds while still pending. Result
-# left in CRED_HTTP/CRED_BODY. --wait-approval is what would have avoided the
-# original prod bug; the default (0) does not block, so the re-run path below
-# must stand on its own.
+# Block until the node is approved and C2 hands back an api_key (node-26#14).
+# Result left in CRED_HTTP/CRED_BODY. Returns 0 with a key, 1 on timeout/0-wait,
+# dies on a credential error (401/404) that waiting cannot fix.
 wait_for_key() {  # wait_for_key PICKUP_SECRET
-  [ "${ENROLL_WAIT:-0}" -gt 0 ] || return 0
-  local _end; _end=$(( $(date +%s) + ENROLL_WAIT ))
-  say "Waiting up to ${ENROLL_WAIT}s for an admin to approve '$NODE_ID'"
-  while [ "$(date +%s)" -lt "$_end" ]; do
-    sleep 10
+  [ "$ENROLL_WAIT" = 0 ] && return 1
+  local _end=0 _shown=0 _delay=5
+  [ "$ENROLL_WAIT" = forever ] || _end=$(( $(date +%s) + ENROLL_WAIT ))
+  trap 'printf "\n"; warn "interrupted — nothing is lost: re-run the same command to resume waiting (configs/pickup_secret is saved)."; exit 130' INT TERM
+  while :; do
+    case "$CRED_HTTP" in
+      200) [ -n "$(cred_field '.api_key')" ] && { trap - INT TERM; return 0; } ;;
+      401) die "C2 rejected the saved pickup secret (401) while waiting — re-run the installer to re-enroll (it asks for a fresh enrollment token)." ;;
+      404) die "C2 no longer knows node '$NODE_ID' (404) — it was deleted. Re-run the installer to enroll again (it asks for an enrollment token)." ;;
+      *)   : ;;  # 000/5xx: transient, keep waiting
+    esac
+    if [ "$_shown" = 0 ]; then
+      printf "\n${Y}Please have an admin approve node '%s' at %s/settings/nodes to continue.${N}\n" \
+        "$NODE_ID" "$APP_URL"
+      printf "Waiting for approval%s… (Ctrl-C is safe — re-run the same command to resume)\n\n" \
+        "$([ "$_end" = 0 ] && echo "" || echo " for up to ${ENROLL_WAIT}s")"
+      _shown=1
+    fi
+    if [ "$_end" != 0 ] && [ "$(date +%s)" -ge "$_end" ]; then trap - INT TERM; return 1; fi
+    sleep "$_delay"; [ "$_delay" -lt 30 ] && _delay=$(( _delay + 5 ))
     creds_pickup "$1"
-    [ "$CRED_HTTP" = 200 ] || return 0
-    [ -z "$(cred_field '.api_key')" ] || return 0
   done
 }
 
 do_fresh_enroll() {
   say "Enrolling '$NODE_ID' with $C2_URL"
-  [ -n "$ENROLLMENT_TOKEN" ] || ask_secret ENROLLMENT_TOKEN "Enrollment token"
-  [ -n "$ENROLLMENT_TOKEN" ] || die "no enrollment token — mint one at Settings -> Nodes, then re-run with --token"
+  need_token || die "no enrollment token — $NO_TOKEN_HELP"
 
   local BODY RESP PICKUP STATUS KEY
   BODY="$(jq -nc --arg id "$NODE_ID" --arg n "${NODE_NAME:-$NODE_ID}" \
             --argjson lat "${NODE_LAT:-0}" --argjson lon "${NODE_LON:-0}" \
             '{node_id:$id,name:$n,lat:$lat,lon:$lon}')"
-  # Token goes in a header from a shell variable — never on a process command
-  # line, never echoed.
+  # Token goes in a 0600 header file — never on a process command line (curl's
+  # argv is visible in `ps`; CISO condition, server-26#61), never echoed.
+  local _ehdr; _ehdr="$(mktemp)"; chmod 600 "$_ehdr"
+  printf 'X-Enrollment-Token: %s\n' "$ENROLLMENT_TOKEN" > "$_ehdr"
   if ! RESP="$(curl -fsS -X POST "$C2_URL/nodes/enroll" \
             -H "Content-Type: application/json" \
-            -H "X-Enrollment-Token: $ENROLLMENT_TOKEN" \
+            -H "@$_ehdr" \
             --data "$BODY" 2>&1)"; then
+    rm -f "$_ehdr"
     case "$RESP" in
       *403*) die "enroll refused (403): node '$NODE_ID' is already approved on C2, and
   this machine has no configs/pickup_secret to collect its key with. A token
@@ -404,11 +510,12 @@ do_fresh_enroll() {
   or have an admin Reissue key (Settings -> Nodes) and write the key into
   $CREDS by hand (see node-26#6)." ;;
       *401*) die "enroll refused (401): enrollment token missing/invalid/revoked —
-  mint a fresh one at Settings -> Nodes and re-run with --token." ;;
+  $NO_TOKEN_HELP." ;;
       *429*) die "enroll refused (429): rate limited. Wait ~1 minute, then re-run." ;;
       *)     die "enroll failed: $RESP" ;;
     esac
   fi
+  rm -f "$_ehdr"
   PICKUP="$(printf '%s' "$RESP" | jq -r '.pickup_secret')"
   STATUS="$(printf '%s' "$RESP" | jq -r '.approval_status')"
   [ -n "$PICKUP" ] && [ "$PICKUP" != null ] || die "enroll returned no pickup_secret: $RESP"
@@ -418,21 +525,32 @@ do_fresh_enroll() {
 
   creds_pickup "$PICKUP"
   [ "$CRED_HTTP" = 200 ] || die "post-enroll credential fetch failed (HTTP $CRED_HTTP): ${CRED_BODY:-<no body>}"
-  KEY="$(cred_field '.api_key')"
-  if [ -z "$KEY" ]; then
-    wait_for_key "$PICKUP" || true
-    KEY="$(cred_field '.api_key')"
-  fi
-  if [ -n "$KEY" ]; then
-    write_creds "$KEY"
+  if wait_for_key "$PICKUP"; then
+    write_creds "$(cred_field '.api_key')"
   else
     say_pending "$(cred_field '.approval_status')"
   fi
 }
 
-if [ -s "$CREDS" ] && jq -e '.api_key // empty' "$CREDS" >/dev/null 2>&1; then
+DISK_KEY="$(jq -r '.api_key // empty' "$CREDS" 2>/dev/null || true)"
+if [ -n "$DISK_KEY" ] && [ -s "$PICKUP_FILE" ] && [ -n "${C2_URL:-}" ]; then
+  # Key on disk, but it may be STALE (an admin Reissue, or the old approve
+  # that rotated on every click). Ask C2 for the current one and replace it if
+  # different. Best-effort: on any error keep the key we have.
+  say "Enrollment — key on disk; checking it is still current"
+  creds_pickup "$(cat "$PICKUP_FILE")"
+  SERVER_KEY="$(cred_field '.api_key')"
+  if [ "$CRED_HTTP" = 200 ] && [ -n "$SERVER_KEY" ] && [ "$SERVER_KEY" != "$DISK_KEY" ]; then
+    warn "the key on disk is not the one C2 has on file (reissued?) — replacing it"
+    write_creds "$SERVER_KEY"
+  elif [ "$CRED_HTTP" = 200 ] && [ -n "$SERVER_KEY" ]; then
+    ok "api_key on disk matches C2"
+  else
+    warn "could not confirm the key with C2 (HTTP $CRED_HTTP) — keeping the key on disk"
+  fi
+elif [ -n "$DISK_KEY" ]; then
   say "Enrollment"
-  ok "api_key already on disk — skipping enrollment"
+  ok "api_key already on disk (no pickup secret to re-check it with) — skipping enrollment"
 elif [ -z "${C2_URL:-}" ]; then
   say "Enrollment"
   warn "no C2_URL — skipping enrollment"
@@ -446,38 +564,35 @@ elif [ -s "$PICKUP_FILE" ]; then
   creds_pickup "$PICKUP"
   case "$CRED_HTTP" in
     200)
-      API_KEY="$(cred_field '.api_key')"
-      if [ -z "$API_KEY" ]; then
-        wait_for_key "$PICKUP" || true
-        API_KEY="$(cred_field '.api_key')"
-      fi
-      if [ -n "$API_KEY" ]; then
-        write_creds "$API_KEY"
+      if wait_for_key "$PICKUP"; then
+        write_creds "$(cred_field '.api_key')"
       else
-        # Still pending. Enrolled and idempotent — next run collects the key.
-        # Clean exit, fall through to start the stack. NOT a failure.
+        # Only with --wait-approval N/0. Enrolled and idempotent; the app
+        # fetches the key itself once approved. NOT a failure.
         say_pending "$(cred_field '.approval_status')"
       fi
       ;;
     401)
-      if [ -n "$ENROLLMENT_TOKEN" ]; then
-        warn "saved pickup secret rejected (401) — likely rotated by a re-enroll elsewhere. Re-enrolling with --token."
+      warn "saved pickup secret rejected (401) — likely rotated by a re-enroll elsewhere."
+      if need_token; then
+        warn "re-enrolling with the enrollment token."
         rm -f "$PICKUP_FILE"
         do_fresh_enroll
       else
-        die "saved pickup secret is stale (401) and no --token was given. Re-run with
-  --token DRB-… to re-enroll (only works while the node is still pending), or
-  have an admin Reissue key for an approved node and write $CREDS by hand."
+        die "saved pickup secret is stale (401) and no enrollment token was given.
+  Re-enrolling only works while the node is still pending: $NO_TOKEN_HELP.
+  For an approved node, have an admin Reissue key and write $CREDS by hand."
       fi
       ;;
     404)
-      if [ -n "$ENROLLMENT_TOKEN" ]; then
-        warn "C2 does not know node '$NODE_ID' (404) — deleted server-side or never fully enrolled. Re-enrolling with --token."
+      warn "C2 does not know node '$NODE_ID' (404) — deleted server-side or never fully enrolled."
+      if need_token; then
+        warn "re-enrolling with the enrollment token."
         rm -f "$PICKUP_FILE"
         do_fresh_enroll
       else
-        die "C2 does not know node '$NODE_ID' (404) and no --token was given.
-  Re-run with --token DRB-… to enroll it again."
+        die "C2 does not know node '$NODE_ID' (404) and no enrollment token was given:
+  $NO_TOKEN_HELP."
       fi
       ;;
     000)
@@ -508,14 +623,37 @@ if [ "$DO_START" = 1 ]; then
   requirement or a transient network error: re-run with DRB_REGISTRY_USER /
   DRB_REGISTRY_PASS set, or with --build to compile on the Pi (~1h for op25)."
     fi
+    # compose pull only WARNS for a missing image that also has a build:
+    # section, so check the pinned images really arrived.
+    drb_images_present || die "the images pinned to $REF (${RESOLVED_SHA:0:12}) are not in
+  $REGISTRY yet. CI may still be building them — wait and re-run; the owner can
+  run the 'Release images' workflow on that ref; or re-run with --build."
     docker compose up --no-build -d
   fi
-  ok "stack started"
+  # ALWAYS recreate edge-node (node-26#14): `up -d` leaves an already-running
+  # container alone, and a process started before the key was written would
+  # otherwise keep running keyless. Cheap, and makes every re-run a fix.
+  docker compose up -d --no-build --force-recreate --no-deps edge-node
+  ok "stack started (edge-node recreated so it loads configs/credentials.json)"
 else
   say "Skipping start (--no-start). Run: cd $INSTALL_DIR && make up-prebuilt"
 fi
 
-# ── 7. What the operator does next ──────────────────────────────────────────
+# ── 7. Host updater (node-26#15) ───────────────────────────────────────────
+UPDATER_STATE="not installed (--no-updater)"
+if [ "$INSTALL_UPDATER" = 1 ]; then
+  say "Installing the host updater"
+  UPD_ARGS=(--dir "$INSTALL_DIR" --repo-url "$REPO_URL" --ref "$REF" --registry "$REGISTRY")
+  [ "$DO_BUILD" = 1 ] && UPD_ARGS+=(--build)
+  if bash "$INSTALL_DIR/scripts/install-updater.sh" "${UPD_ARGS[@]}"; then
+    UPDATER_STATE="enabled — checks C2 every ~15 min; 'Update Node Software' in the admin UI"
+  else
+    warn "host updater NOT installed — this node cannot be updated remotely"
+    UPDATER_STATE="FAILED to install (see above)"
+  fi
+fi
+
+# ── 8. Summary ──────────────────────────────────────────────────────────────
 IP="$(hostname -I 2>/dev/null | awk '{print $1}')"
 cat <<EOF
 
@@ -525,21 +663,19 @@ $(printf "${G}Node '%s' installed at %s${N}" "$NODE_ID" "$INSTALL_DIR")
   images         $([ "$DO_BUILD" = 1 ] && echo "built locally" || echo "pulled from $REGISTRY")
   dashboard      http://${IP:-<node-ip>}/    (user: ${DASHBOARD_USER})
   logs           cd $INSTALL_DIR && docker compose logs -f edge-node
+  updater        ${UPDATER_STATE}
+  api key        $([ -n "$(jq -r '.api_key // empty' "$CREDS" 2>/dev/null)" ] && echo "present" || echo "NOT YET — node fetches it once approved")
 
-NEXT — an admin must approve this node before it can do anything:
-
-  1. Open  <app-url>/settings/nodes
-  2. Approve  "$NODE_ID"
-  3. Assign it a radio system
+NEXT — assign this node a radio system at ${APP_URL}/nodes/${NODE_ID}
 
 EOF
 if [ "${GENERATED_DASH:-0}" = 1 ]; then
   printf "${Y}Generated dashboard password (shown once): %s${N}\n\n" "$DASHBOARD_PASS"
 fi
-if [ ! -s "$CREDS" ]; then
+if [ -z "$(jq -r '.api_key // empty' "$CREDS" 2>/dev/null)" ]; then
   if [ -s "$PICKUP_FILE" ]; then
-    printf "${Y}This node has no api_key yet. After an admin approves it, re-run the same\ninstall command — it reuses configs/pickup_secret and will collect the key\n(no --token needed for the re-run).${N}\n\n"
+    printf "${Y}This node has no api_key yet. Once an admin approves it at %s/settings/nodes\nthe node fetches the key and comes online by itself (no re-run needed).${N}\n\n" "$APP_URL"
   else
-    printf "${Y}This node has no api_key and no saved pickup secret, so a plain re-run cannot\nfix it. Re-run with --token DRB-… to enroll; or, if the node is already\napproved, have an admin Reissue key and write it into\n%s by hand.${N}\n\n" "$CREDS"
+    printf "${Y}This node has no api_key and no saved pickup secret. Re-run the installer\nand give it an enrollment token when it asks; or, if the node is already\napproved, have an admin Reissue key and write it into\n%s by hand.${N}\n\n" "$CREDS"
   fi
 fi

op25-container/Dockerfile

@@ -1,62 +1,74 @@
-# OP25 Core Container
-# Pinned to a Python major version deliberately. The bare `slim-trixie` tag
-# carries no version at all, so a rebuild could move the interpreter across a
-# major release -- which this repo has already been bitten by once, when
-# app/models.py only ran because trixie happened to ship 3.14 and PEP 649
-# defers annotation evaluation. Matches drb-edge-node, which is already 3.14.
-FROM python:3.14-slim
-
-# Set environment variables
-ENV DEBIAN_FRONTEND=noninteractive
-
-# Install system dependencies
-RUN apt-get update && \
-    apt-get upgrade -y && \
-    apt-get install git pulseaudio pulseaudio-utils liquidsoap usbutils -y
-
-# Install custom PulseAudio system config (enables anonymous access for edge-node)
-COPY system.pa /etc/pulse/system.pa
-
-# Clone the boatbod op25 repository
-RUN git clone -b gr310 https://github.com/boatbod/op25 /op25
-
-# Set the working directory
-WORKDIR /op25
-
-# Run the install script to set up op25
-RUN sed -i 's/sudo //g' install.sh
-RUN ./install.sh -f
-
-# Install Python dependencies
-COPY requirements.txt /tmp/requirements.txt
-RUN pip3 install --no-cache-dir -r /tmp/requirements.txt
-
-# Create the run_multi-rx_service.sh script
-COPY run_multi-rx_service.sh /op25/op25/gr-op25_repeater/apps/run_multi-rx_service.sh
-RUN chmod +x /op25/op25/gr-op25_repeater/apps/run_multi-rx_service.sh
-
-# Expose ports for HTTP control as needed, for example:
-EXPOSE 8001 8081
-
-# Create and set up the configuration directory
-VOLUME ["/configs"]
-
-# Set the working directory in the container
-WORKDIR /app
-
-# Copy the rest of the directory contents into the container at /app
-COPY ./app /app
-
-# 1. Copy the wrapper script and make it executable
-COPY docker-entrypoint.sh /usr/local/bin/
-RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && \
-    chmod +x /usr/local/bin/docker-entrypoint.sh
-
-# 2. Update ENTRYPOINT to use the wrapper script
-ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-
-# 3. Use CMD to pass the launch command as arguments to the ENTRYPOINT script.
-# main.py starts uvicorn itself (see `if __name__ == "__main__"`) so the bind
-# address can be driven by OP25_DEBUG_EXPOSE at runtime instead of being baked
-# into this image at build time.
+# OP25 Core Container
+# Pinned to a Python major version deliberately. The bare `slim-trixie` tag
+# carries no version at all, so a rebuild could move the interpreter across a
+# major release -- which this repo has already been bitten by once, when
+# app/models.py only ran because trixie happened to ship 3.14 and PEP 649
+# defers annotation evaluation. Matches drb-edge-node, which is already 3.14.
+FROM python:3.14-slim
+
+# Set environment variables
+ENV DEBIAN_FRONTEND=noninteractive
+
+# Install system dependencies
+RUN apt-get update && \
+    apt-get upgrade -y && \
+    apt-get install git pulseaudio pulseaudio-utils liquidsoap usbutils -y
+
+# Install custom PulseAudio system config (enables anonymous access for edge-node)
+COPY system.pa /etc/pulse/system.pa
+
+# Clone the boatbod op25 repository, PINNED (node-26#29, #46). An unpinned
+# clone plus CI's layer cache meant the image held whatever gr310 HEAD was at
+# the last cache miss. 5b58335 (gr310, 2026-08-23) is the commit tk_drb_conv
+# was verified against for node-26#29 and the first gr310 merge that carries
+# the 2026-08-03 NBFM noise/voice squelch (PR #296, op25_nbfm.py
+# nbfm_squelch_mode). Bump deliberately, re-checking tk_drb_conv against
+# tk_p25.py at the new commit.
+ARG OP25_COMMIT=5b583357240e0172bfae905f0c966474e0d0f094
+RUN git clone -b gr310 https://github.com/boatbod/op25 /op25 && \
+    git -C /op25 checkout --detach "${OP25_COMMIT}"
+
+# Set the working directory
+WORKDIR /op25
+
+# Run the install script to set up op25
+RUN sed -i 's/sudo //g' install.sh
+RUN ./install.sh -f
+
+# Install Python dependencies
+COPY requirements.txt /tmp/requirements.txt
+RUN pip3 install --no-cache-dir -r /tmp/requirements.txt
+
+# DRB's trunking module for P25 conventional channels (node-26#24): reports
+# encryption + NAC and applies the NAC filter, which stock tk_p25 does not.
+COPY op25_addons/tk_drb_conv.py /op25/op25/gr-op25_repeater/apps/tk_drb_conv.py
+
+# Create the run_multi-rx_service.sh script
+COPY run_multi-rx_service.sh /op25/op25/gr-op25_repeater/apps/run_multi-rx_service.sh
+RUN chmod +x /op25/op25/gr-op25_repeater/apps/run_multi-rx_service.sh
+
+# Expose ports for HTTP control as needed, for example:
+EXPOSE 8001 8081
+
+# Create and set up the configuration directory
+VOLUME ["/configs"]
+
+# Set the working directory in the container
+WORKDIR /app
+
+# Copy the rest of the directory contents into the container at /app
+COPY ./app /app
+
+# 1. Copy the wrapper script and make it executable
+COPY docker-entrypoint.sh /usr/local/bin/
+RUN sed -i 's/\r$//' /usr/local/bin/docker-entrypoint.sh && \
+    chmod +x /usr/local/bin/docker-entrypoint.sh
+
+# 2. Update ENTRYPOINT to use the wrapper script
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+
+# 3. Use CMD to pass the launch command as arguments to the ENTRYPOINT script.
+# main.py starts uvicorn itself (see `if __name__ == "__main__"`) so the bind
+# address can be driven by OP25_DEBUG_EXPOSE at runtime instead of being baked
+# into this image at build time.
 CMD ["python", "main.py"]

op25-container/app/internal/conventional_config.py

@@ -0,0 +1,118 @@
+"""
+P25 conventional OP25 config (node-26#24).
+
+A conventional P25 channel is a fixed voice frequency with no control channel:
+radios key up on it directly, C4FM (fsk4), and identify themselves in the link
+control of each LDU1 (talkgroup + unit id) and the ESS of each LDU2
+(encryption algorithm + key id). Building a `tk_p25.py` trunking config for one
+— what "P25" always meant before — makes OP25 hunt forever for a control
+channel that does not exist, so nothing is ever decoded.
+
+Layout this produces, per boatbod OP25 gr310 `p25_conventional_example.json`:
+
+  * one non-tunable device parked so every channel sits inside its passband;
+  * one channel per frequency, `trunking_sysname: ""` (so the trunking module
+    treats it as conventional), `demod_type: fsk4`;
+  * trunking module `tk_drb_conv.py` with no chans — our thin subclass of
+    tk_p25.rx_ctl that reports encryption and the NAC for conventional
+    channels and applies the per-channel NAC filter (tk_p25 itself does
+    neither for FDMA conventional);
+  * channel N's audio to UDP 23456+N; with two channels audio.py runs in
+    two-channel mode (left = first channel, right = second).
+
+Pure: no file I/O, so it is unit-testable outside the container.
+"""
+from typing import Any, Dict, List, Tuple
+
+from models import ChannelConfig, ConventionalChannel, DeviceConfig, TerminalConfig
+
+# Two is what one audio.py instance can carry (its A and B sockets). A third
+# channel would need a second audio pipeline into PulseAudio.
+MAX_CONVENTIONAL_CHANNELS = 2
+
+AUDIO_UDP_BASE_PORT = 23456
+
+DEVICE_RATE = 1_920_000
+DEVICE_USABLE_BW_PCT = 0.85
+# Half the occupied bandwidth of a 12.5 kHz P25 channel.
+CHANNEL_HALF_BW_HZ = 6_250
+# Keep the RTL-SDR's DC spike off the channels. A single channel (or two very
+# close together) is offset from the centre; channels further apart than
+# 2x this already straddle the spike, so the centre goes between them.
+DC_SPIKE_OFFSET_HZ = 250_000
+DC_SPIKE_CLEARANCE_HZ = 50_000
+
+CONVENTIONAL_TRUNKING_MODULE = "tk_drb_conv.py"
+
+
+def device_center(freqs: List[int]) -> int:
+    lo, hi = min(freqs), max(freqs)
+    mid = (lo + hi) // 2
+    if (hi - lo) // 2 >= DC_SPIKE_CLEARANCE_HZ:
+        return mid
+    return mid + DC_SPIKE_OFFSET_HZ
+
+
+def validate_channels(channels: List[ConventionalChannel]) -> None:
+    """Raise ValueError with an operator-readable reason."""
+    if not channels:
+        raise ValueError("P25 conventional needs at least one channel frequency.")
+    if len(channels) > MAX_CONVENTIONAL_CHANNELS:
+        raise ValueError(
+            f"P25 conventional supports up to {MAX_CONVENTIONAL_CHANNELS} channels on one SDR "
+            f"(got {len(channels)})."
+        )
+    freqs = [c.frequency for c in channels]
+    if len(set(freqs)) != len(freqs):
+        raise ValueError("The same conventional frequency is listed twice.")
+    for c in channels:
+        if c.nac is not None and not (0 < c.nac <= 0xFFF):
+            raise ValueError(f"NAC {c.nac:#x} on {c.frequency / 1e6:.5f} MHz is outside 0x001-0xFFF.")
+    center = device_center(freqs)
+    half = DEVICE_RATE * DEVICE_USABLE_BW_PCT / 2
+    for f in freqs:
+        if abs(f - center) + CHANNEL_HALF_BW_HZ > half:
+            span = (max(freqs) - min(freqs)) / 1e6
+            raise ValueError(
+                f"These channels are {span:.3f} MHz apart — too far for one SDR "
+                f"(max ~{(2 * (half - CHANNEL_HALF_BW_HZ)) / 1e6:.2f} MHz)."
+            )
+
+
+def build_conventional_config(
+    system_name: str,
+    channels: List[ConventionalChannel],
+    gains: str,
+    ppm: float,
+) -> Tuple[Dict[str, Any], bool]:
+    """Return (OP25 config dict, two_channel_audio)."""
+    validate_channels(channels)
+    freqs = [c.frequency for c in channels]
+    center = device_center(freqs)
+
+    chans = []
+    for i, c in enumerate(channels):
+        chans.append(ChannelConfig(
+            name=c.name or f"{system_name} {c.frequency / 1e6:.4f}",
+            trunking_sysname="",
+            enable_analog="off",
+            demod_type="fsk4",
+            filter_type="rc",
+            frequency=c.frequency,
+            meta_stream_name="",
+            destination=f"udp://127.0.0.1:{AUDIO_UDP_BASE_PORT + i}",
+            nac=c.nac,
+            crypt_behavior=2,
+        ))
+
+    device = DeviceConfig(
+        gains=gains, ppm=ppm, tunable=False, frequency=center,
+        rate=DEVICE_RATE, usable_bw_pct=DEVICE_USABLE_BW_PCT,
+    )
+    config = {
+        "channels": [ch.model_dump() for ch in chans],
+        "devices": [device.model_dump()],
+        "trunking": {"module": CONVENTIONAL_TRUNKING_MODULE, "chans": []},
+        "terminal": TerminalConfig().model_dump(),
+    }
+    return config, len(chans) > 1

op25-container/app/internal/liquidsoap_config_utils.py

@@ -2,7 +2,26 @@ import os
 from internal.op25_liq_template import liquidsoap_config_template
 from models import IcecastConfig
 
-def generate_liquid_script(config: IcecastConfig):
+# P25 conventional with two channels (node-26#24): OP25 sends channel A's
+# audio to UDP 23456 and channel B's to 23457, and audio.py -2 puts them on the
+# left and right of the stereo stream. Every output below is mean(input) — mono
+# — so a lone talker on one side would come out 6 dB down; doubling first keeps
+# the common case (one channel keyed) at the same level as single-channel mode.
+# Liquidsoap mixes in float, so the doubling cannot clip before the output.
+_TWO_CHANNEL_AUDIO_ARGS = " -2"
+_TWO_CHANNEL_MIX = "input = amplify(2.0, input)  # two conventional channels, L=A R=B"
+
+
+def render_liquid_script(config: IcecastConfig, two_channel: bool = False) -> str:
+    content = liquidsoap_config_template
+    for key, value in config.model_dump().items():
+        content = content.replace(f"${{{key}}}", str(value))
+    content = content.replace("${audio_py_args}", _TWO_CHANNEL_AUDIO_ARGS if two_channel else "")
+    content = content.replace("${two_channel_mix}", _TWO_CHANNEL_MIX if two_channel else "")
+    return content
+
+
+def generate_liquid_script(config: IcecastConfig, two_channel: bool = False):
     """
     Generates the "*.liq" file that's run by OP25 on startup. 
 
@@ -13,13 +32,7 @@ def generate_liquid_script(config: IcecastConfig):
                           Keys should match the variable names in the template (e.g., 'icecast_host').
     """
     try:
-        content = liquidsoap_config_template
-        # Replace variables
-        for key, value in config.model_dump().items():
-            placeholder = f"${{{key}}}"
-            # Ensure the value is converted to string for replacement
-            content = content.replace(placeholder, str(value))
-            print(f"  - Replaced placeholder {placeholder}")
+        content = render_liquid_script(config, two_channel)
 
         # Write the processed content to the output path
         output_path = "/configs/op25.liq"

op25-container/app/internal/op25_liq_template.py

@@ -17,8 +17,9 @@ ICE_DESCRIPTION = "${icecast_description}"
 ICE_GENRE = "${icecast_genre}"
 # ==========================================================
 
-input = mksafe(input.external(buffer=0.25, channels=2, samplerate=8000, restart_on_error=false, "./audio.py -x 2.5 -s"))
+input = mksafe(input.external(buffer=0.25, channels=2, samplerate=8000, restart_on_error=false, "./audio.py -x 2.5 -s${audio_py_args}"))
 # Consider increasing the buffer value on slow systems such as RPi3. e.g. buffer=0.25
+${two_channel_mix}
 
 # Compression
 input = compress(input, attack = 2.0, gain = 0.0, knee = 13.0, ratio = 2.0, release = 12.3, threshold = -18.0)

op25-container/app/models.py

@@ -49,19 +49,51 @@ class IcecastConfig(BaseModel):
     icecast_genre: Optional[str] = "Public Safety"
 
 
+class P25Mode(str, Enum):
+    TRUNKED = "trunked"
+    CONVENTIONAL = "conventional"
+
+
+class NbfmSquelchMode(str, Enum):
+    """Values op25_nbfm.py accepts for nbfm_squelch_mode (gr310, 2026-08-03)."""
+    POWER = "power"
+    NOISE = "noise"
+    VOICE = "voice"
+
+
+class ConventionalChannel(BaseModel):
+    """One fixed P25 conventional voice channel (node-26#24)."""
+    frequency: int                 # Hz
+    name: str = ""
+    nac: Optional[int] = None      # 0x001-0xFFF; None = accept any NAC
+
+
 class ConfigGenerator(BaseModel):
     type: DecodeMode
     systemName: str
-    # P25: control channel list (Hz). NBFM: channels[0] is the one analog
-    # frequency to listen to (Hz).
-    channels: List[Union[int, str]]
+    # P25 trunked: control channel list (Hz). NBFM: channels[0] is the one
+    # analog frequency to listen to (Hz). P25 conventional: unused — see
+    # conv_channels.
+    channels: List[Union[int, str]] = []
+    # P25 only. Missing = trunked, so every existing caller is unchanged.
+    p25_mode: P25Mode = P25Mode.TRUNKED
+    conv_channels: List[ConventionalChannel] = []
     tags: Optional[List[TalkgroupTag]] = None
     whitelist: Optional[List[int]] = None
     icecastConfig: Optional[IcecastConfig] = None
     hardware_preset: str = "rtl-sdr-v3"
     ppm_override: Optional[float] = None  # when set, overrides the preset's default PPM
     # NBFM only: power squelch threshold in dB (op25_nbfm default is -60).
+    # Used only in "power" squelch mode.
     nbfm_squelch: Optional[float] = None
+    # NBFM only (node-26#46): OP25 gr310's squelch algorithm — "power" (the
+    # absolute-level squelch, needs per-site calibration), "noise" (FM
+    # quieting, no calibration) or "voice" (noise + speech detector).
+    # Defaults to noise: power mode left analog open on static.
+    nbfm_squelch_mode: NbfmSquelchMode = NbfmSquelchMode.NOISE
+    # dB of quieting needed to open in noise/voice mode (OP25 default 8;
+    # 12-15 opens only on solid signals, ~5 chases weak ones).
+    nbfm_noise_squelch_db: Optional[float] = None
 
 class DemodType(str, Enum):
     CQPSK = "cqpsk"
@@ -83,7 +115,17 @@ class ChannelConfig(BaseModel):
     frequency: Optional[int] = None
     # Key name op25_nbfm.py actually reads (from_dict(config, 'nbfm_squelch_threshold', -60)).
     nbfm_squelch_threshold: Optional[float] = None
+    # Also read by op25_nbfm.py from the channel dict (node-26#46).
+    nbfm_squelch_mode: Optional[str] = None
+    nbfm_noise_squelch_db: Optional[float] = None
     destination: Optional[str] = "udp://127.0.0.1:23456"
+    # P25 conventional only, read by tk_drb_conv.py (not by multi_rx): the NAC
+    # to lock the frame assembler to. multi_rx passes the whole channel dict
+    # through, so an extra key is harmless.
+    nac: Optional[int] = None
+    # Set on the channel itself for conventional (multi_rx forwards it to the
+    # frame assembler). 2 = drop encrypted voice instead of decoding noise.
+    crypt_behavior: Optional[int] = None
     tracking_threshold: Optional[int] = 120
     tracking_feedback: Optional[float] = 0.75
     excess_bw: Optional[float] = 0.2

op25-container/app/routers/op25_controller.py

@@ -8,7 +8,8 @@ import json
 import threading
 from collections import deque
 from typing import Optional
-from models import ConfigGenerator, DecodeMode, ChannelConfig, DeviceConfig, TrunkingConfig, TrunkingChannelConfig, TerminalConfig, MetadataConfig, MetadataStreamConfig, HARDWARE_PRESETS
+from models import ConfigGenerator, DecodeMode, P25Mode, ChannelConfig, DeviceConfig, TrunkingConfig, TrunkingChannelConfig, TerminalConfig, MetadataConfig, MetadataStreamConfig, HARDWARE_PRESETS
+from internal.conventional_config import build_conventional_config, CONVENTIONAL_TRUNKING_MODULE
 from internal.logger import create_logger
 from internal.op25_config_utls import save_talkgroup_tags, save_whitelist, del_none_in_dict, get_current_system_from_config
 from internal.liquidsoap_config_utils import generate_liquid_script
@@ -178,7 +179,20 @@ def create_op25_router():
     @router.post("/generate-config")
     async def generate_config(generator: ConfigGenerator):
         try:
-            if generator.type == DecodeMode.P25:
+            if generator.type == DecodeMode.P25 and generator.p25_mode == P25Mode.CONVENTIONAL:
+                # node-26#24: fixed voice channels, no control channel to hunt.
+                preset = HARDWARE_PRESETS.get(generator.hardware_preset, HARDWARE_PRESETS["other"])
+                ppm = generator.ppm_override if generator.ppm_override is not None else preset["ppm"]
+                try:
+                    config_dict, two_channel = build_conventional_config(
+                        generator.systemName, generator.conv_channels, preset["gains"], ppm,
+                    )
+                except ValueError as e:
+                    raise HTTPException(status_code=400, detail=str(e))
+                if generator.icecastConfig:
+                    generate_liquid_script(generator.icecastConfig, two_channel=two_channel)
+
+            elif generator.type == DecodeMode.P25:
                 preset = HARDWARE_PRESETS.get(generator.hardware_preset, HARDWARE_PRESETS["other"])
                 ppm = generator.ppm_override if generator.ppm_override is not None else preset["ppm"]
                 channels = [ChannelConfig(
@@ -236,9 +250,9 @@ def create_op25_router():
                 preset = HARDWARE_PRESETS.get(generator.hardware_preset, HARDWARE_PRESETS["other"])
                 ppm = generator.ppm_override if generator.ppm_override is not None else preset["ppm"]
                 freq = int(float(generator.channels[0]))
-                # One fixed conventional channel: no trunking section, so
-                # multi_rx adds its default tk_p25 with no chans and reports
-                # the channel as `conventional` on the HTTP terminal.
+                # One fixed conventional channel: a trunking module with no
+                # chans, so the channel is reported as `conventional` on the
+                # HTTP terminal.
                 channels = [ChannelConfig(
                     name=generator.systemName,
                     trunking_sysname="",
@@ -248,6 +262,8 @@ def create_op25_router():
                     frequency=freq,
                     meta_stream_name="",
                     nbfm_squelch_threshold=generator.nbfm_squelch,
+                    nbfm_squelch_mode=generator.nbfm_squelch_mode.value,
+                    nbfm_noise_squelch_db=generator.nbfm_noise_squelch_db,
                 )]
                 devices = [DeviceConfig(
                     gains=preset["gains"], ppm=ppm, tunable=False,
@@ -259,6 +275,11 @@ def create_op25_router():
                 config_dict = {
                     "channels": [channel.dict() for channel in channels],
                     "devices": [device.dict() for device in devices],
+                    # Same module as P25 conventional (node-26#24): it reports
+                    # the channel as `conventional` whatever tk_p25 version the
+                    # image was built with, which is what the edge node's
+                    # single-channel attribution keys on (node-26#20).
+                    "trunking": {"module": CONVENTIONAL_TRUNKING_MODULE, "chans": []},
                     "terminal": TerminalConfig().dict(),
                 }
 

op25-container/op25_addons/tk_drb_conv.py

@@ -0,0 +1,263 @@
+"""
+tk_drb_conv — DRB's trunking module for P25 CONVENTIONAL channels (node-26#24).
+
+Copied into OP25's apps directory by the Dockerfile and named as the trunking
+module by op25-container's conventional config, so multi_rx imports it in place
+of tk_p25. It is tk_p25.rx_ctl with the conventional-channel handling replaced;
+trunked receivers (none in a conventional config) still go to the base class.
+
+Why not stock tk_p25: for an FDMA conventional channel it reports the talkgroup
+and unit id from LDU1 link control, but
+
+  * never reports encryption — the encrypted/algid/keyid JSON OP25 sends after
+    every LDU2 carries no grpaddr, and tk_p25 only records `encrypted` when
+    grpaddr != 0 — so an encrypted channel looks exactly like a quiet one;
+  * never reports the NAC it is hearing, and has no per-channel NAC filter;
+  * has no "voice frames are arriving" signal of its own, so a transmission
+    whose link control is unreadable is invisible to the console.
+
+All three matter to the edge node: it attributes audio to a channel from what
+this module reports, and must tell the owner when a channel is encrypted rather
+than silently recording nothing.
+
+Each conventional channel row in `channel_update` keeps every key tk_p25 sends
+(freq, tgid, srcaddr, tag, encrypted, conventional, ...) and adds:
+
+    voice            True while voice frames are arriving (HDU/LDU1/LDU2 seen,
+                     no TDU or sync timeout since)
+    nac              last NAC heard on the channel (int) or None
+    nac_filter       the configured NAC filter (int) or None
+    algid, keyid     ALGID/key id of the current call (None when clear/idle)
+    enc_calls, clear_calls     calls heard since start, by encryption
+    last_enc_algid, last_enc_keyid, last_enc_time, last_clear_time
+
+Message types handled (lower 16 bits of msg.type(), P25 protocol only):
+    0          HDU                 -> voice start
+    3, 15      TDU / TDULC         -> transmission end
+    19         LDU1 link control   -> tgid, srcaddr, service options (E bit)
+    -3         LDU2 ESS JSON       -> encrypted / algid / keyid
+    -1         sync timeout        -> transmission end
+"""
+import ctypes
+import json
+import sys
+import time
+
+import tk_p25
+from helper_funcs import from_dict, get_ordinals
+from log_ts import log_ts
+
+ALGID_CLEAR = 0x80
+SVCOPT_ENCRYPTED = 0x40
+LCW_PROTECTED = 0x80
+LCO_GROUP_VOICE = 0x00
+DUID_HDU, DUID_TDU, DUID_TDULC, DUID_LCW = 0, 3, 15, 19
+M_TIMEOUT, M_JSON_DATA = -1, -3
+
+
+def _parse_nac(value):
+    if value is None or value == "":
+        return None
+    try:
+        nac = int(value, 16) if isinstance(value, str) else int(value)
+    except (TypeError, ValueError):
+        return None
+    return nac if 0 < nac <= 0xFFF else None
+
+
+class rx_ctl(tk_p25.rx_ctl):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.drb_conv = {}   # msgq_id -> state dict
+
+    def add_receiver(self, msgq_id, config, meta_q=None, freq=0):
+        super().add_receiver(msgq_id, config, meta_q=meta_q, freq=freq)
+        rcvr = self.receivers.get(msgq_id)
+        if rcvr is not None and rcvr.get('rx_rcvr') is not None:
+            return   # trunked receiver: base class owns it
+        self.drb_conv[msgq_id] = {
+            'name': from_dict(config, 'name', str(msgq_id)),
+            'freq': freq,
+            'nac_filter': _parse_nac(config.get('nac')),
+            'nac': None,
+            'voice': False,
+            'tgid': None,
+            'srcaddr': 0,
+            'svc_encrypted': False,
+            'ess_encrypted': False,
+            'algid': None,
+            'keyid': None,
+            'call_start': None,
+            'call_encrypted': False,
+            'logged_tgid': None,
+            'prev_type': None,
+            'enc_calls': 0,
+            'clear_calls': 0,
+            'last_enc_algid': None,
+            'last_enc_keyid': None,
+            'last_enc_time': None,
+            'last_clear_time': None,
+            'last_voice_time': None,
+        }
+
+    def post_init(self):
+        super().post_init()
+        for msgq_id, cs in self.drb_conv.items():
+            if cs['nac_filter'] is not None and self.fa_ctrl is not None:
+                self.fa_ctrl({'tuner': msgq_id, 'cmd': 'set_nac', 'nac': cs['nac_filter']})
+                sys.stderr.write("%s [%d] conventional NAC filter 0x%03x\n" % (log_ts.get(), msgq_id, cs['nac_filter']))
+
+    # ------------------------------------------------------------------
+
+    def _encrypted(self, cs):
+        return cs['svc_encrypted'] or cs['ess_encrypted']
+
+    def _voice_start(self, cs, now):
+        if not cs['voice']:
+            cs['voice'] = True
+            cs['call_start'] = now
+            cs['call_encrypted'] = False
+            cs['logged_tgid'] = None
+        cs['last_voice_time'] = now
+
+    def _voice_end(self, cs, now):
+        if cs['voice']:
+            if cs['call_encrypted']:
+                cs['enc_calls'] += 1
+                cs['last_enc_time'] = now
+            else:
+                cs['clear_calls'] += 1
+                cs['last_clear_time'] = now
+        cs['voice'] = False
+        cs['tgid'] = None
+        cs['srcaddr'] = 0
+        cs['svc_encrypted'] = False
+        cs['ess_encrypted'] = False
+        cs['algid'] = None
+        cs['keyid'] = None
+        cs['call_start'] = None
+        cs['logged_tgid'] = None
+
+    def _note_encryption(self, cs, now):
+        if self._encrypted(cs):
+            cs['call_encrypted'] = True
+            if cs['algid'] is not None:
+                cs['last_enc_algid'] = cs['algid']
+                cs['last_enc_keyid'] = cs['keyid']
+            cs['last_enc_time'] = now
+
+    def _maybe_log_call(self, msgq_id, cs):
+        # One call_log entry per (call, talkgroup), and none for an encrypted
+        # call: it will produce no audio, so a "grant" would only mislead the
+        # edge node's attribution.
+        if cs['tgid'] is None or self._encrypted(cs) or cs['logged_tgid'] == cs['tgid']:
+            return
+        cs['logged_tgid'] = cs['tgid']
+        try:
+            self.log_call(0, msgq_id, cs['freq'], 0, 0, cs['tgid'], cs['name'], cs['srcaddr'], '')
+        except Exception as e:   # older/newer tk_p25 log_call signature
+            sys.stderr.write("%s [%d] conventional call_log failed: %s\n" % (log_ts.get(), msgq_id, e))
+
+    def _process_conv(self, msgq_id, cs, m_type, msg, now):
+        if m_type == M_TIMEOUT or m_type in (DUID_TDU, DUID_TDULC):
+            self._voice_end(cs, now)
+        elif m_type == DUID_HDU:
+            s = msg.to_string()
+            cs['nac'] = get_ordinals(s[0:2]) if len(s) >= 2 else cs['nac']
+            self._voice_start(cs, now)
+        elif m_type == DUID_LCW:
+            s = msg.to_string()
+            if len(s) < 11:
+                return
+            cs['nac'] = get_ordinals(s[0:2])
+            if cs['prev_type'] in (DUID_TDU, DUID_TDULC):
+                return   # TDULC's link control follows its TDU: the call is over
+            lcw = s[2:]
+            self._voice_start(cs, now)
+            pb_sf_lco = get_ordinals(lcw[0:1])
+            if pb_sf_lco & LCW_PROTECTED:
+                # Link control itself is encrypted — the call certainly is.
+                cs['svc_encrypted'] = True
+            elif (pb_sf_lco & 0x3f) == LCO_GROUP_VOICE:
+                svcopts = get_ordinals(lcw[2:3])
+                ga = get_ordinals(lcw[4:6])
+                sa = get_ordinals(lcw[6:9])
+                cs['svc_encrypted'] = bool(svcopts & SVCOPT_ENCRYPTED)
+                if ga:
+                    cs['tgid'] = ga
+                if sa:
+                    cs['srcaddr'] = sa
+            self._note_encryption(cs, now)
+            self._maybe_log_call(msgq_id, cs)
+        elif m_type == M_JSON_DATA:
+            try:
+                js = json.loads(msg.to_string())
+            except (ValueError, TypeError):
+                return
+            if 'encrypted' in js:
+                self._voice_start(cs, now)
+                algid = from_dict(js, 'algid', None)
+                cs['ess_encrypted'] = bool(js.get('encrypted')) and algid != ALGID_CLEAR
+                cs['algid'] = algid if cs['ess_encrypted'] else None
+                cs['keyid'] = from_dict(js, 'keyid', None) if cs['ess_encrypted'] else None
+                self._note_encryption(cs, now)
+            grpaddr = from_dict(js, 'grpaddr', 0)
+            if grpaddr:
+                cs['tgid'] = grpaddr
+                cs['srcaddr'] = from_dict(js, 'srcaddr', 0) or cs['srcaddr']
+                self._maybe_log_call(msgq_id, cs)
+
+    def process_qmsg(self, msg):
+        m_proto = ctypes.c_int16(msg.type() >> 16).value
+        m_rxid = int(msg.arg1()) >> 1
+        if m_proto != 0 or m_rxid not in self.drb_conv:
+            return super().process_qmsg(msg)
+        m_type = ctypes.c_int16(msg.type() & 0xffff).value
+        cs = self.drb_conv[m_rxid]
+        try:
+            self._process_conv(m_rxid, cs, m_type, msg, time.time())
+        except Exception as e:   # never take multi_rx down over a bad frame
+            sys.stderr.write("%s [%d] conventional message type %d failed: %s\n" % (log_ts.get(), m_rxid, m_type, e))
+        cs['prev_type'] = m_type
+
+    def get_chan_status(self):
+        d = json.loads(super().get_chan_status())
+        ids = list(d.get('channels') or [])
+        for msgq_id, cs in self.drb_conv.items():
+            key = str(msgq_id)
+            row = d.get(key) or {}
+            row.update({
+                'freq': cs['freq'],
+                'name': cs['name'],
+                'system': cs['name'],
+                'tdma': 0,
+                'tgid': cs['tgid'],
+                'tag': cs['name'],
+                'srcaddr': cs['srcaddr'],
+                'srctag': '',
+                'svcopts': 0,
+                'encrypted': 1 if self._encrypted(cs) else 0,
+                'emergency': 0,
+                'hold_tgid': 0,
+                'mode': None,
+                'stream': '',
+                'msgqid': msgq_id,
+                'conventional': True,
+                'voice': cs['voice'],
+                'nac': cs['nac'],
+                'nac_filter': cs['nac_filter'],
+                'algid': cs['algid'],
+                'keyid': cs['keyid'],
+                'enc_calls': cs['enc_calls'],
+                'clear_calls': cs['clear_calls'],
+                'last_enc_algid': cs['last_enc_algid'],
+                'last_enc_keyid': cs['last_enc_keyid'],
+                'last_enc_time': cs['last_enc_time'],
+                'last_clear_time': cs['last_clear_time'],
+                'last_voice_time': cs['last_voice_time'],
+            })
+            d[key] = row
+            if key not in ids:
+                ids.append(key)
+        d['channels'] = ids
+        return json.dumps(d)

op25-container/tests/test_conventional.py

@@ -0,0 +1,322 @@
+"""
+P25 conventional (node-26#24): config generation, the liquidsoap two-channel
+variant, and the tk_drb_conv state machine — all without OP25/GNU Radio.
+
+tk_drb_conv imports tk_p25/helper_funcs/log_ts from OP25's apps dir; those are
+stubbed here with the minimum of tk_p25.rx_ctl it relies on. The message
+shapes fed in are the ones boatbod gr310 p25p1_fdma.cc sends: LCW = 2-byte NAC
++ 9 LC bytes (type 19), LDU2 ESS = JSON (type -3), TDU = 2-byte NAC (type 3/15),
+sync timeout = type -1.
+"""
+import json
+import os
+import sys
+import types
+
+import pytest
+
+HERE = os.path.dirname(__file__)
+sys.path.insert(0, os.path.join(HERE, "..", "app"))
+sys.path.insert(0, os.path.join(HERE, "..", "op25_addons"))
+
+from fastapi.testclient import TestClient  # noqa: E402
+from fastapi import FastAPI  # noqa: E402
+
+from models import ConventionalChannel  # noqa: E402
+from internal import conventional_config as cc  # noqa: E402
+from internal.liquidsoap_config_utils import render_liquid_script  # noqa: E402
+from models import IcecastConfig  # noqa: E402
+
+
+# ---------------------------------------------------------------------------
+# Config generation
+# ---------------------------------------------------------------------------
+
+WP = [
+    ConventionalChannel(frequency=460_400_000, name="PD1 Dispatch"),
+    ConventionalChannel(frequency=460_425_000, name="PD3 Tac", nac=0x293),
+]
+
+
+def test_white_plains_two_channels_one_sdr():
+    config, two = cc.build_conventional_config("White Plains", WP, "lna:34", 0.0)
+    assert two is True
+    assert "trunking" in config and config["trunking"]["module"] == "tk_drb_conv.py"
+    assert config["trunking"]["chans"] == []          # nothing for tk_p25 to hunt
+    a, b = config["channels"]
+    for ch in (a, b):
+        assert ch["demod_type"] == "fsk4"
+        assert ch["trunking_sysname"] == ""
+        assert ch["enable_analog"] == "off"
+        assert ch["crypt_behavior"] == 2
+        assert "control_channel_list" not in ch
+    assert (a["frequency"], b["frequency"]) == (460_400_000, 460_425_000)
+    assert a["destination"].endswith(":23456") and b["destination"].endswith(":23457")
+    assert a["name"] == "PD1 Dispatch" and b["nac"] == 0x293
+    dev = config["devices"][0]
+    assert dev["tunable"] is False
+    # 25 kHz apart: centre is offset off both channels (DC spike), and both
+    # still sit inside the usable passband.
+    half = dev["rate"] * dev["usable_bw_pct"] / 2
+    for f in (460_400_000, 460_425_000):
+        assert 100_000 < abs(f - dev["frequency"]) < half
+
+
+def test_single_channel_is_not_two_channel_audio():
+    config, two = cc.build_conventional_config("X", WP[:1], "lna:34", 0.0)
+    assert two is False
+    assert len(config["channels"]) == 1
+
+
+def test_wide_pair_centres_between_channels():
+    chans = [ConventionalChannel(frequency=453_000_000), ConventionalChannel(frequency=454_000_000)]
+    config, _ = cc.build_conventional_config("X", chans, "lna:34", 0.0)
+    assert config["devices"][0]["frequency"] == 453_500_000
+
+
+@pytest.mark.parametrize("chans, needle", [
+    ([], "at least one"),
+    ([ConventionalChannel(frequency=f) for f in (460_000_000, 460_025_000, 460_050_000)], "up to 2"),
+    ([ConventionalChannel(frequency=460_000_000), ConventionalChannel(frequency=462_000_000)], "too far"),
+    ([ConventionalChannel(frequency=460_000_000), ConventionalChannel(frequency=460_000_000)], "twice"),
+    ([ConventionalChannel(frequency=460_000_000, nac=0x1000)], "NAC"),
+])
+def test_rejects_bad_channel_sets(chans, needle):
+    with pytest.raises(ValueError, match=needle):
+        cc.build_conventional_config("X", chans, "lna:34", 0.0)
+
+
+ICE = IcecastConfig(icecast_host="localhost", icecast_port=8000, icecast_mountpoint="/n", icecast_password="p")
+
+
+def test_liquidsoap_single_channel_unchanged_command():
+    liq = render_liquid_script(ICE, two_channel=False)
+    assert '"./audio.py -x 2.5 -s"' in liq
+    assert "amplify" not in liq and "${" not in liq
+
+
+def test_liquidsoap_two_channel():
+    liq = render_liquid_script(ICE, two_channel=True)
+    assert '"./audio.py -x 2.5 -s -2"' in liq
+    assert "input = amplify(2.0, input)" in liq
+    assert "${" not in liq
+
+
+def test_generate_config_route(tmp_path, monkeypatch):
+    from routers import op25_controller
+    monkeypatch.setattr(op25_controller, "_ACTIVE_CFG", str(tmp_path / "active.cfg.json"))
+    written = {}
+    monkeypatch.setattr(op25_controller, "generate_liquid_script",
+                        lambda ice, two_channel=False: written.setdefault("two", two_channel))
+    monkeypatch.setattr(op25_controller, "save_talkgroup_tags", lambda tags: None)
+    monkeypatch.setattr(op25_controller, "save_whitelist", lambda wl: None)
+    app = FastAPI()
+    app.include_router(op25_controller.create_op25_router(), prefix="/op25")
+    client = TestClient(app)
+    ice = ICE.model_dump()
+    r = client.post("/op25/generate-config", json={
+        "type": "P25", "systemName": "White Plains", "p25_mode": "conventional",
+        "conv_channels": [{"frequency": 460400000, "name": "PD1"}, {"frequency": 460425000, "name": "PD3"}],
+        "icecastConfig": ice,
+    })
+    assert r.status_code == 200, r.text
+    cfg = json.loads((tmp_path / "active.cfg.json").read_text())
+    assert cfg["trunking"]["module"] == "tk_drb_conv.py"
+    assert [c["frequency"] for c in cfg["channels"]] == [460400000, 460425000]
+    assert written["two"] is True
+
+    # Trunked P25 without p25_mode is exactly what it was.
+    r = client.post("/op25/generate-config", json={
+        "type": "P25", "systemName": "County", "channels": [851012500], "icecastConfig": ice,
+    })
+    assert r.status_code == 200, r.text
+    cfg = json.loads((tmp_path / "active.cfg.json").read_text())
+    assert cfg["trunking"]["module"] == "tk_p25.py"
+    assert cfg["trunking"]["chans"][0]["control_channel_list"] == "851012500"
+    assert cfg["channels"][0]["demod_type"] == "cqpsk"
+
+    r = client.post("/op25/generate-config", json={
+        "type": "P25", "systemName": "X", "p25_mode": "conventional", "conv_channels": [],
+    })
+    assert r.status_code == 400
+
+    # Analog uses the same module, so the edge node sees a `conventional` row
+    # whatever tk_p25 the image was built with (node-26#20).
+    r = client.post("/op25/generate-config", json={
+        "type": "NBFM", "systemName": "Fire", "channels": [154430000], "icecastConfig": ice,
+    })
+    assert r.status_code == 200, r.text
+    cfg = json.loads((tmp_path / "active.cfg.json").read_text())
+    assert cfg["trunking"]["module"] == "tk_drb_conv.py"
+    assert cfg["channels"][0]["frequency"] == 154430000
+    # node-26#46: analog defaults to OP25's noise squelch, not power.
+    assert cfg["channels"][0]["nbfm_squelch_mode"] == "noise"
+    assert "nbfm_noise_squelch_db" not in cfg["channels"][0]
+
+    r = client.post("/op25/generate-config", json={
+        "type": "NBFM", "systemName": "Fire", "channels": [154430000], "icecastConfig": ice,
+        "nbfm_squelch_mode": "power", "nbfm_squelch": -55, "nbfm_noise_squelch_db": 12,
+    })
+    assert r.status_code == 200, r.text
+    ch = json.loads((tmp_path / "active.cfg.json").read_text())["channels"][0]
+    assert ch["nbfm_squelch_mode"] == "power" and ch["nbfm_squelch_threshold"] == -55
+    assert ch["nbfm_noise_squelch_db"] == 12
+
+    r = client.post("/op25/generate-config", json={
+        "type": "NBFM", "systemName": "Fire", "channels": [154430000], "nbfm_squelch_mode": "loud",
+    })
+    assert r.status_code == 422
+
+
+# ---------------------------------------------------------------------------
+# tk_drb_conv state machine
+# ---------------------------------------------------------------------------
+
+class _BaseRxCtl:
+    """The slice of tk_p25.rx_ctl that tk_drb_conv relies on."""
+
+    def __init__(self, debug=0, frequency_set=None, nbfm_ctrl=None, fa_ctrl=None, chans={}):
+        self.fa_ctrl = fa_ctrl
+        self.receivers = {}
+        self.call_log = []
+
+    def add_receiver(self, msgq_id, config, meta_q=None, freq=0):
+        self.receivers[msgq_id] = {'msgq_id': msgq_id, 'config': config, 'rx_rcvr': None,
+                                   'conv_state': {'tgid': None}}
+
+    def post_init(self):
+        pass
+
+    def process_qmsg(self, msg):
+        self.base_saw = msg
+
+    def log_call(self, sysid, rcvr, freq, slot, prio, tgid, tgtag, rid, rtag):
+        self.call_log.append({"rcvr": rcvr, "freq": freq, "tgid": tgid, "tgtag": tgtag, "rid": rid})
+
+    def get_chan_status(self):
+        return json.dumps({'json_type': 'channel_update', 'channels': []})
+
+
+def _stub_op25_modules():
+    tk = types.ModuleType("tk_p25")
+    tk.rx_ctl = _BaseRxCtl
+    hf = types.ModuleType("helper_funcs")
+
+    def from_dict(d, key, def_val):
+        return d[key] if key in d and d[key] != "" else def_val
+
+    def get_ordinals(s):
+        t = 0
+        for c in s:
+            t = (t << 8) + c
+        return t
+    hf.from_dict = from_dict
+    hf.get_ordinals = get_ordinals
+    lt = types.ModuleType("log_ts")
+    lt.log_ts = types.SimpleNamespace(get=lambda *a: "ts")
+    sys.modules.update({"tk_p25": tk, "helper_funcs": hf, "log_ts": lt})
+
+
+class _Msg:
+    def __init__(self, m_type, rxid, payload=b""):
+        self._type = m_type & 0xffff   # proto 0 in the upper 16 bits
+        self._arg1 = rxid << 1
+        self._payload = payload
+
+    def type(self):
+        return self._type
+
+    def arg1(self):
+        return self._arg1
+
+    def to_string(self):
+        return self._payload
+
+
+def _lcw(nac, tgid, src, svcopts=0, lco=0x00):
+    lc = bytes([lco, 0x00, svcopts, 0x00]) + tgid.to_bytes(2, "big") + src.to_bytes(3, "big")
+    return nac.to_bytes(2, "big") + lc
+
+
+def _ess(encrypted, algid, keyid):
+    return json.dumps({"encrypted": encrypted, "algid": algid, "keyid": keyid}).encode()
+
+
+@pytest.fixture
+def tk():
+    _stub_op25_modules()
+    sys.modules.pop("tk_drb_conv", None)
+    import tk_drb_conv
+    sent = []
+    rx = tk_drb_conv.rx_ctl(fa_ctrl=sent.append, chans=[])
+    rx.add_receiver(0, {"name": "PD1 Dispatch", "nac": 0x293}, freq=460_400_000)
+    rx.add_receiver(1, {"name": "PD3 Tac"}, freq=460_425_000)
+    rx.post_init()
+    rx.sent = sent
+    return rx
+
+
+def _rows(rx):
+    d = json.loads(rx.get_chan_status())
+    return {cid: d[cid] for cid in d["channels"]}
+
+
+def test_nac_filter_applied_only_where_configured(tk):
+    assert tk.sent == [{'tuner': 0, 'cmd': 'set_nac', 'nac': 0x293}]
+
+
+def test_clear_call_reports_tgid_unit_nac_and_logs_once(tk):
+    tk.process_qmsg(_Msg(0, 0, b"\x02\x93"))                       # HDU
+    tk.process_qmsg(_Msg(19, 0, _lcw(0x293, 101, 4242)))            # LDU1
+    tk.process_qmsg(_Msg(-3, 0, _ess(0, 0x80, 0)))                  # LDU2 clear
+    tk.process_qmsg(_Msg(19, 0, _lcw(0x293, 101, 4242)))
+    row = _rows(tk)["0"]
+    assert row["conventional"] and row["voice"]
+    assert (row["tgid"], row["srcaddr"], row["nac"], row["encrypted"]) == (101, 4242, 0x293, 0)
+    assert row["algid"] is None
+    assert [e["tgid"] for e in tk.call_log] == [101]
+    assert tk.call_log[0]["tgtag"] == "PD1 Dispatch"
+    # The other channel is idle.
+    assert _rows(tk)["1"]["voice"] is False
+
+    tk.process_qmsg(_Msg(3, 0, b"\x02\x93"))                         # TDU
+    row = _rows(tk)["0"]
+    assert row["voice"] is False and row["tgid"] is None
+    assert (row["clear_calls"], row["enc_calls"]) == (1, 0)
+
+
+def test_tdulc_link_control_does_not_reopen_the_call(tk):
+    tk.process_qmsg(_Msg(19, 1, _lcw(0x111, 7, 9)))
+    tk.process_qmsg(_Msg(15, 1, b"\x01\x11"))                        # TDULC
+    tk.process_qmsg(_Msg(19, 1, _lcw(0x111, 7, 9)))                 # its LC
+    assert _rows(tk)["1"]["voice"] is False
+
+
+def test_encrypted_call_is_reported_and_never_logged(tk):
+    tk.process_qmsg(_Msg(19, 1, _lcw(0x111, 7, 9, svcopts=0x40)))  # E bit
+    tk.process_qmsg(_Msg(-3, 1, _ess(1, 0x84, 0x1234)))
+    row = _rows(tk)["1"]
+    assert row["encrypted"] == 1 and row["algid"] == 0x84 and row["keyid"] == 0x1234
+    assert tk.call_log == []
+    tk.process_qmsg(_Msg(-1, 1))                                    # sync timeout
+    row = _rows(tk)["1"]
+    assert row["encrypted"] == 0 and row["voice"] is False
+    assert (row["enc_calls"], row["last_enc_algid"], row["last_enc_keyid"]) == (1, 0x84, 0x1234)
+
+
+def test_encryption_seen_only_in_ess_still_counts(tk):
+    tk.process_qmsg(_Msg(-3, 0, _ess(1, 0x81, 0x0001)))
+    assert _rows(tk)["0"]["encrypted"] == 1
+    tk.process_qmsg(_Msg(3, 0, b"\x02\x93"))
+    assert _rows(tk)["0"]["enc_calls"] == 1
+
+
+def test_protected_link_control_marks_encrypted(tk):
+    tk.process_qmsg(_Msg(19, 0, _lcw(0x293, 0, 0, lco=0x80)))
+    assert _rows(tk)["0"]["encrypted"] == 1
+
+
+def test_trunked_receivers_and_other_protocols_go_to_base(tk):
+    msg = _Msg(7, 5)
+    tk.process_qmsg(msg)
+    assert tk.base_saw is msg

scripts/drb-update.sh

@@ -0,0 +1,238 @@
+#!/usr/bin/env bash
+#
+# DRB node host updater (node-26#15). Runs as root from systemd:
+#   drb-update.timer  -> every ~15 min: HTTPS check-in with C2; update if asked
+#   drb-update.path   -> fires when the edge-node container drops
+#                        <install>/configs/update-requested (MQTT node_update)
+# Both start drb-update.service, which runs this script. install-updater.sh
+# writes the units and /etc/drb/updater.conf; install.sh calls it.
+#
+# SECURITY MODEL — this is a remote-update path onto devices in the field:
+#   * What gets installed comes ONLY from /etc/drb/updater.conf (root-owned,
+#     written by install.sh): the repo URL, the ref, the image registry. C2's
+#     answer is a single timestamp meaning "update now"; it is never used as a
+#     ref, URL, path or command. The MQTT sentinel's content is never read.
+#   * git origin must equal the configured REPO_URL (https only) and the .env
+#     IMAGE_REGISTRY must equal the configured REGISTRY, or nothing runs.
+#   * Node credentials go to curl via a 0600 header file, never argv.
+#   * C2 must be https.
+# What this does NOT defend against: a compromised git host or registry —
+# refs and images are not signed (node-26#17).
+#   * Images are pinned to the checked-out source (node-26#19): each one is
+#     pulled as src-<git tree hash of its build directory>, never :latest.
+#
+# The whole body is inside main(), called on the last line: bash parses the
+# function completely before running it, so `git checkout` replacing this
+# very file mid-run cannot change what is executing.
+set -euo pipefail
+
+main() {
+  local CONF="${DRB_UPDATER_CONF:-/etc/drb/updater.conf}"
+  local STATE_DIR="${DRB_UPDATER_STATE:-/var/lib/drb-update}"
+  local LOCK="${DRB_UPDATER_LOCK:-/run/drb-update.lock}"
+
+  log()  { printf 'drb-update: %s\n' "$*"; }
+  err()  { printf 'drb-update: ERROR: %s\n' "$*" >&2; }
+  conf() { grep -E "^$1=" "$CONF" 2>/dev/null | head -1 | cut -d= -f2- || true; }
+
+  [ -r "$CONF" ] || { err "$CONF missing — re-run install.sh"; return 1; }
+  local INSTALL_DIR REPO_URL REF REGISTRY BUILD
+  INSTALL_DIR="$(conf INSTALL_DIR)"; REPO_URL="$(conf REPO_URL)"; REF="$(conf REF)"
+  REGISTRY="$(conf REGISTRY)"; BUILD="$(conf BUILD)"
+
+  [[ "$INSTALL_DIR" =~ ^/[A-Za-z0-9._/-]+$ ]] && [ -d "$INSTALL_DIR/.git" ] \
+    || { err "bad INSTALL_DIR '$INSTALL_DIR' in $CONF"; return 1; }
+  [[ "$REPO_URL" =~ ^https://[A-Za-z0-9._/:-]+$ ]] || { err "REPO_URL must be https: '$REPO_URL'"; return 1; }
+  [[ "$REF" =~ ^[A-Za-z0-9._][A-Za-z0-9._/-]*$ ]] || { err "bad REF '$REF'"; return 1; }
+  [[ "$REGISTRY" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || { err "bad REGISTRY '$REGISTRY'"; return 1; }
+
+  mkdir -p "$STATE_DIR"; chmod 700 "$STATE_DIR"
+  exec 9>"$LOCK"
+  flock -n 9 || { log "another update is already running"; return 0; }
+
+  cd "$INSTALL_DIR"
+  # This runs as root, but a pre-install.sh checkout (e.g. /home/pi/node-26)
+  # is owned by the login user, and git >= 2.35.2 then refuses every command
+  # with "dubious ownership" — which surfaced as origin '' != REPO_URL. Trust
+  # exactly the configured INSTALL_DIR, for this process only (env config is
+  # command-line scope, which safe.directory honours; no global config change).
+  export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=safe.directory GIT_CONFIG_VALUE_0="$INSTALL_DIR"
+  envget() { grep -E "^$1=" .env 2>/dev/null | head -1 | cut -d= -f2- | tr -d '"' || true; }
+  local NODE_ID C2_URL
+  NODE_ID="$(envget NODE_ID)"; C2_URL="$(envget C2_URL)"; C2_URL="${C2_URL%/}"
+  [[ "$NODE_ID" =~ ^[A-Za-z0-9_-]+$ ]] || { err "no valid NODE_ID in $INSTALL_DIR/.env"; return 1; }
+
+  local reason=""
+  local SENTINEL="$INSTALL_DIR/configs/update-requested"
+  if [ -e "$SENTINEL" ] || [ -L "$SENTINEL" ]; then
+    rm -f "$SENTINEL"          # content deliberately ignored
+    reason="mqtt node_update"
+  fi
+
+  # ── HTTPS check-in ──────────────────────────────────────────────────────
+  local tmpd; tmpd="$(mktemp -d)"; chmod 700 "$tmpd"
+  # shellcheck disable=SC2064
+  trap "rm -rf '$tmpd'" RETURN
+
+  local sha; sha="$(git rev-parse HEAD 2>/dev/null || echo '')"
+  local requested=""
+
+  checkin() {  # checkin APPLIED_AT RESULT -> stdout: response body
+    [[ "$C2_URL" == https://* ]] || return 1
+    local key="" pickup=""
+    key="$(jq -r '.api_key // empty' configs/credentials.json 2>/dev/null || true)"
+    pickup="$(cat configs/pickup_secret 2>/dev/null || true)"
+    : > "$tmpd/h"; chmod 600 "$tmpd/h"
+    if [[ "$key" =~ ^[A-Za-z0-9]+$ ]]; then
+      printf 'Authorization: Bearer %s\n' "$key" >> "$tmpd/h"
+    fi
+    if [[ "$pickup" =~ ^[A-Za-z0-9]+$ ]]; then
+      printf 'X-Pickup-Secret: %s\n' "$pickup" >> "$tmpd/h"
+    fi
+    [ -s "$tmpd/h" ] || return 1
+    local body
+    body="$(jq -nc --arg sha "$sha" --arg a "$1" --arg r "$2" \
+      '{sha:$sha} + (if $a != "" then {applied_request_at:$a} else {} end)
+                  + (if $r != "" then {result:$r} else {} end)')"
+    curl -fsS --proto '=https' --max-time 20 -X POST \
+      "$C2_URL/nodes/$NODE_ID/update-check" \
+      -H "Content-Type: application/json" -H "@$tmpd/h" --data "$body"
+  }
+
+  local resp
+  if [[ "$C2_URL" != https://* ]]; then
+    log "C2_URL is not https — skipping the HTTPS check-in"
+  elif resp="$(checkin "" "" 2>"$tmpd/err")"; then
+    requested="$(printf '%s' "$resp" | jq -r '.update_requested_at // empty' 2>/dev/null || true)"
+    if [ -n "$requested" ] && ! [[ "$requested" =~ ^[0-9T:.+Z-]{10,40}$ ]]; then
+      log "ignoring malformed update_requested_at from C2"
+      requested=""
+    fi
+  else
+    log "HTTPS check-in failed: $(tr -d '\n' < "$tmpd/err" | head -c 200)"
+  fi
+
+  local last=""; last="$(cat "$STATE_DIR/last_request" 2>/dev/null || true)"
+  local new_request=""
+  if [ -n "$requested" ] && [ "$requested" != "$last" ]; then
+    new_request="$requested"
+    reason="${reason:-C2 request $requested}"
+  fi
+  [ -n "$reason" ] || { log "no update requested"; return 0; }
+
+  # ── Update ─────────────────────────────────────────────────────────────
+  log "updating ($reason) — repo $REPO_URL @ $REF"
+  local result=ok
+  if do_update; then
+    log "update complete: $(git rev-parse --short HEAD)"
+  else
+    result=failed
+    log "update FAILED — will retry on the next timer run"
+  fi
+  if [ -n "$new_request" ]; then
+    [ "$result" = ok ] && printf '%s' "$new_request" > "$STATE_DIR/last_request"
+    sha="$(git rev-parse HEAD 2>/dev/null || echo '')"
+    checkin "$new_request" "$result" >/dev/null 2>&1 || log "could not report the result to C2"
+  fi
+  [ "$result" = ok ]
+}
+
+do_update() {
+  local origin; origin="$(git remote get-url origin)"
+  [ "$origin" = "$REPO_URL" ] || { err "git origin '$origin' != configured '$REPO_URL' — refusing"; return 1; }
+
+  # --force: a moved release tag (v1) must replace the local copy.
+  git -c protocol.allow=never -c protocol.https.allow=always fetch --force --tags --prune origin || return 1
+
+  local target
+  if git show-ref --verify -q "refs/remotes/origin/$REF"; then
+    target="refs/remotes/origin/$REF"
+  elif git show-ref --verify -q "refs/tags/$REF"; then
+    target="refs/tags/$REF"
+  else
+    err "ref '$REF' not found on origin"; return 1
+  fi
+  local old new
+  old="$(git rev-parse HEAD)"; new="$(git rev-parse "$target^{commit}")"
+
+  local env_registry
+  env_registry="$(grep -E '^IMAGE_REGISTRY=' .env | head -1 | cut -d= -f2- | tr -d '"' || true)"
+  [ "${env_registry:-git.vpn.cusano.net}" = "$REGISTRY" ] \
+    || { err ".env IMAGE_REGISTRY '$env_registry' != configured '$REGISTRY' — refusing"; return 1; }
+
+  # Image pins for the TARGET commit (node-26#19): each image is tagged with
+  # the git tree hash of its own source directory, so the images always match
+  # the code being checked out. The helper is read from the target commit so
+  # its service list matches the target's compose file.
+  # Read into a variable, not `source <(...)`: a failed `git show` must leave
+  # pin=0 rather than "succeed" with no functions defined.
+  local pin=0 helper
+  if git cat-file -e "$new:scripts/image-tags.sh" 2>/dev/null; then
+    helper="$(git show "$new:scripts/image-tags.sh")" && [ -n "$helper" ] && eval "$helper" \
+      && declare -F drb_image_tags drb_images_present drb_pin_image_tags >/dev/null && pin=1
+  fi
+  [ "$pin" = 1 ] || log "target ${new:0:12} predates image pinning — using its compose file's default tags"
+
+  if [ "$BUILD" != 1 ]; then
+    # Pull BEFORE checkout. The app code is bind-mounted from the checkout
+    # (install.sh D3) and edge-node runs uvicorn --reload, so checking out first
+    # would run the new code on the old images for as long as the pull takes —
+    # or for good, if the pinned images don't exist. Pulling against the
+    # target's own compose file means a failed pull changes nothing. It is
+    # written next to the real one so its relative paths (.env, env_file,
+    # build contexts) resolve exactly the same way.
+    local tfile="$INSTALL_DIR/.drb-update-compose.yml" pulled=0
+    git show "$new:docker-compose.yml" > "$tfile" || { rm -f "$tfile"; return 1; }
+    local -a tc=(-f "$tfile" --project-directory "$INSTALL_DIR")
+    (
+      if [ "$pin" = 1 ]; then
+        while IFS= read -r l; do export "$l"; done < <(drb_image_tags "$INSTALL_DIR" "$new")
+      fi
+      docker compose "${tc[@]}" pull || exit 1
+      if [ "$pin" = 1 ]; then drb_images_present "${tc[@]}" || exit 1; fi
+    ) && pulled=1
+    rm -f "$tfile"
+    [ "$pulled" = 1 ] || { err "images for ${new:0:12} are not available — nothing changed (CI may still be building them; the 'Release images' workflow publishes any that are missing)"; return 1; }
+  fi
+
+  if [ "$old" != "$new" ]; then
+    git -c advice.detachedHead=false checkout --force --detach "$new" || return 1
+    log "checked out $REF: ${old:0:12} -> ${new:0:12}"
+    # Units/conf may have changed with the new scripts.
+    bash scripts/install-updater.sh --refresh || log "unit refresh failed (continuing with the old units)"
+  fi
+
+  if [ "$pin" = 1 ]; then
+    drb_pin_image_tags "$INSTALL_DIR/.env" "$INSTALL_DIR" "$new" || { err "could not write image pins to .env"; return 1; }
+  fi
+
+  if [ "$BUILD" = 1 ]; then
+    docker compose build || return 1   # tags the local builds with the same pins
+  fi
+  # --force-recreate: app code is bind-mounted from the checkout (install.sh
+  # D3), so a code-only change also needs every container restarted.
+  docker compose up -d --no-build --force-recreate --remove-orphans || return 1
+
+  # Drop pinned images this node no longer runs. `image prune` only removes
+  # dangling images, and every previous src- tag is still tagged. `image rm`
+  # without -f refuses anything a container still uses.
+  if [ "$pin" = 1 ]; then
+    local keep ref
+    keep="$(drb_image_tags "$INSTALL_DIR" "$new" | cut -d= -f2)"
+    docker images --format '{{.Repository}}:{{.Tag}}' | grep -E ':src-[0-9a-f]{40}$' \
+      | while IFS= read -r ref; do
+          grep -qxF "${ref##*:}" <<< "$keep" || docker image rm "$ref" >/dev/null 2>&1 || true
+        done || true
+  fi
+  docker image prune -f >/dev/null 2>&1 || true
+
+  # node-26#41: neither of the above ever freed BuildKit cache or untagged-
+  # but-unused images, so a BUILD=1 node grew ~40 GB of build cache plus
+  # 16 GB of stale images until the root disk hit 100% and recording silently
+  # stopped (node-002, 17 days). Both prunes skip anything a container uses;
+  # the age filters keep the cache warm for the next build.
+  docker builder prune -af --filter until=72h >/dev/null 2>&1 || true
+  docker image prune -af --filter until=168h >/dev/null 2>&1 || true
+}
+
+main "$@"

scripts/image-tags.sh

@@ -0,0 +1,65 @@
+# shellcheck shell=bash
+#
+# Pin each node image to the exact source it was built from (node-26#19).
+# Sourced by install.sh and scripts/drb-update.sh; not run directly.
+#
+# The tag is the git TREE hash of the image's build context, `src-<tree>`.
+# CI computes the same value (`git rev-parse HEAD:<dir>` in the build
+# workflows), so a node asks for the image built from the very directory it
+# has checked out. That is exact even though each image is only rebuilt when
+# its own directory changes: an unchanged directory keeps the same tree hash,
+# and so the same image, across commits. :latest / :stable still exist for
+# local dev; a provisioned node never uses them.
+#
+# docker-compose.yml reads these as ${DRB_TAG_*:-latest}. The values live in
+# .env so every manual `docker compose ...` on the node sees the same pins.
+
+# VAR:build-context-dir, one per compose service with an image.
+DRB_IMAGE_SOURCES="DRB_TAG_ICECAST:icecast DRB_TAG_OP25:op25-container \
+DRB_TAG_SECONDARY_SDR:secondary-sdr-container DRB_TAG_EDGE_NODE:drb-edge-node"
+
+# drb_image_tags REPO_DIR COMMIT -> "VAR=src-<tree>" lines. A directory that
+# does not exist at COMMIT is skipped (its compose file won't reference it).
+drb_image_tags() {
+  local _p _var _dir _tree
+  for _p in $DRB_IMAGE_SOURCES; do
+    _var="${_p%%:*}"; _dir="${_p#*:}"
+    _tree="$(git -C "$1" rev-parse --verify -q "$2:$_dir" 2>/dev/null)" || continue
+    printf '%s=src-%s\n' "$_var" "$_tree"
+  done
+}
+
+# drb_env_set ENV_FILE KEY VALUE — replace KEY's line in place, or append it.
+# Rewrites through the same inode so .env keeps its 0600 mode and owner.
+drb_env_set() {
+  local _tmp; _tmp="$(mktemp)"
+  awk -v k="$2" -v v="$3" '
+    index($0, k "=") == 1 { if (!done) print k "=" v; done = 1; next }
+    { print }
+    END { if (!done) print k "=" v }' "$1" > "$_tmp" && cat "$_tmp" > "$1"
+  local _rc=$?; rm -f "$_tmp"; return $_rc
+}
+
+# drb_pin_image_tags ENV_FILE REPO_DIR COMMIT — write the pins into .env and
+# export them, so compose sees them whether or not it re-reads .env.
+drb_pin_image_tags() {
+  local _line
+  while IFS= read -r _line; do
+    drb_env_set "$1" "${_line%%=*}" "${_line#*=}" || return 1
+    export "$_line"
+  done < <(drb_image_tags "$2" "$3")
+}
+
+# drb_images_present COMPOSE_ARGS... — 0 if every image the compose project
+# names is in the local image store. `compose pull` only WARNS when a service
+# that also has a build: section fails to pull, so its exit code alone does
+# not prove the pinned images exist.
+drb_images_present() {
+  local _imgs _img _missing=0
+  _imgs="$(docker compose "$@" config --images)" || return 1
+  while IFS= read -r _img; do
+    [ -n "$_img" ] || continue
+    docker image inspect "$_img" >/dev/null 2>&1 || { printf 'missing image: %s\n' "$_img" >&2; _missing=1; }
+  done <<< "$_imgs"
+  return $_missing
+}

scripts/install-updater.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+#
+# Install (or refresh) the DRB host updater units (node-26#15). Run as root.
+#
+#   install-updater.sh --dir /opt/drb/node-26 --repo-url URL --ref v1 \
+#                      --registry git.vpn.cusano.net [--build]
+#   install-updater.sh --refresh      # re-render units from /etc/drb/updater.conf
+#
+# Writes /etc/drb/updater.conf (root:root 0644 — the ONLY source of what the
+# updater may install), drb-update.{service,timer,path}, and enables the timer
+# and the path watcher. install.sh calls this; drb-update.sh calls --refresh
+# after a checkout so unit changes ship with the repo.
+set -euo pipefail
+
+CONF=/etc/drb/updater.conf
+UNIT_DIR="${DRB_UNIT_DIR:-/etc/systemd/system}"
+conf() { grep -E "^$1=" "$CONF" 2>/dev/null | head -1 | cut -d= -f2- || true; }
+die()  { printf 'install-updater: %s\n' "$*" >&2; exit 1; }
+
+INSTALL_DIR="" REPO_URL="" REF="" REGISTRY="" BUILD=0 REFRESH=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --dir)       INSTALL_DIR="$2"; shift 2 ;;
+    --repo-url)  REPO_URL="$2"; shift 2 ;;
+    --ref)       REF="$2"; shift 2 ;;
+    --registry)  REGISTRY="$2"; shift 2 ;;
+    --build)     BUILD=1; shift ;;
+    --refresh)   REFRESH=1; shift ;;
+    *)           die "unknown option: $1" ;;
+  esac
+done
+
+[ "$(id -u)" -eq 0 ] || die "must run as root"
+if [ "$REFRESH" = 1 ]; then
+  [ -r "$CONF" ] || die "$CONF missing — run install.sh"
+  INSTALL_DIR="$(conf INSTALL_DIR)"; REPO_URL="$(conf REPO_URL)"; REF="$(conf REF)"
+  REGISTRY="$(conf REGISTRY)"; BUILD="$(conf BUILD)"
+fi
+
+[[ "$INSTALL_DIR" =~ ^/[A-Za-z0-9._/-]+$ ]] || die "bad --dir '$INSTALL_DIR' (absolute, no spaces)"
+[[ "$REPO_URL" =~ ^https://[A-Za-z0-9._/:-]+$ ]] || die "--repo-url must be https: '$REPO_URL'"
+[[ "$REF" =~ ^[A-Za-z0-9._][A-Za-z0-9._/-]*$ ]] || die "bad --ref '$REF'"
+[[ "$REGISTRY" =~ ^[A-Za-z0-9.-]+(:[0-9]+)?$ ]] || die "bad --registry '$REGISTRY'"
+[ "$BUILD" = 1 ] || BUILD=0
+
+if ! command -v systemctl >/dev/null 2>&1 || [ ! -d /run/systemd/system ]; then
+  die "systemd not running — the host updater needs systemd (remote updates disabled on this node)"
+fi
+
+install -d -m 755 /etc/drb
+umask 022
+cat > "$CONF.tmp" <<EOF
+# DRB host updater — written by install-updater.sh. The updater installs ONLY
+# from these values; nothing C2 sends can change them. Edit = root only.
+INSTALL_DIR=$INSTALL_DIR
+REPO_URL=$REPO_URL
+REF=$REF
+REGISTRY=$REGISTRY
+BUILD=$BUILD
+EOF
+chown root:root "$CONF.tmp"; chmod 644 "$CONF.tmp"; mv -f "$CONF.tmp" "$CONF"
+
+cat > "$UNIT_DIR/drb-update.service" <<EOF
+[Unit]
+Description=DRB node updater (node-26#15)
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+ExecStart=/bin/bash $INSTALL_DIR/scripts/drb-update.sh
+TimeoutStartSec=$([ "$BUILD" = 1 ] && echo 3h || echo 45min)
+Nice=10
+EOF
+
+cat > "$UNIT_DIR/drb-update.timer" <<'EOF'
+[Unit]
+Description=DRB node updater — periodic HTTPS check-in with C2
+
+[Timer]
+OnBootSec=3min
+OnUnitActiveSec=15min
+RandomizedDelaySec=2min
+Persistent=true
+
+[Install]
+WantedBy=timers.target
+EOF
+
+cat > "$UNIT_DIR/drb-update.path" <<EOF
+[Unit]
+Description=DRB node updater — MQTT node_update sentinel
+
+[Path]
+PathExists=$INSTALL_DIR/configs/update-requested
+Unit=drb-update.service
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now drb-update.timer drb-update.path >/dev/null 2>&1 \
+  || die "could not enable drb-update.timer/path"
+printf 'install-updater: host updater enabled (timer every ~15 min + MQTT sentinel), tracking %s @ %s\n' \
+  "$REPO_URL" "$REF"

trunk-recorder/README.md

@@ -0,0 +1,34 @@
+# Trunk Recorder on a DRB node (node-26#45)
+
+Opt-in alternative to the OP25 recorder. On a node, set both in `.env`, then
+`docker compose up -d`:
+
+    RECORDER_BACKEND=trunk-recorder
+    COMPOSE_PROFILES=trunk-recorder
+
+Set both back (`RECORDER_BACKEND=op25`, remove `COMPOSE_PROFILES`) to return
+to OP25.
+
+- `run.sh`: supervisor that replaces the image's CMD. It restarts TR when the
+  edge-node rewrites `configs/trunk-recorder/config.json`, and writes
+  `drb-status.json` for the dashboard health check.
+- `drb-upload.sh`: TR's `uploadScript`. It copies each finished call (WAV +
+  JSON) into `recordings/tr-inbox`, where the edge-node uploads it through the
+  normal spool.
+
+## License (GPL-3.0)
+
+Trunk Recorder is GPL-3.0. DRB runs the unmodified upstream image
+`robotastic/trunk-recorder:5.2.1` (digest pinned in `docker-compose.yml`) as a
+separate program. It talks to DRB only through files, a script argument list
+and a local UDP socket. That makes it mere aggregation, the same position we
+already hold for OP25.
+
+Anyone we distribute a node image or device to must still be able to get the
+corresponding source. Upstream source for this exact version is at
+<https://github.com/TrunkRecorder/trunk-recorder/tree/v5.2.1>. If we ever ship
+the TR image ourselves (mirrored to our registry, preinstalled on a sold
+device), we must also offer that source directly, in writing, for three years,
+or ship it alongside. Pointing to upstream alone is not enough at that point.
+Any patch to TR itself makes DRB's copy a modified version, which must then be
+published under GPL-3.0.

trunk-recorder/drb-upload.sh

@@ -0,0 +1,28 @@
+#!/bin/sh
+# Trunk Recorder uploadScript (node-26#45). TR runs this after every call as
+#     drb-upload.sh <call.wav> <call.json> <call.m4a>
+# (run_upload_script_argv, call_concluder.cc v5.2.1; the m4a only exists with
+# compressWav, which DRB leaves off). TR deletes the wav/json as soon as this
+# exits (audioArchive/callLog false), so it copies them into the edge-node's
+# inbox first. Order matters: the WAV lands first and the JSON last, so the
+# JSON's presence tells the edge-node the WAV is complete. Exit non-zero = TR
+# marks the call failed.
+set -u
+WAV="${1:?wav path}"
+JSON="${2:?json path}"
+INBOX="${DRB_TR_INBOX:-/recordings/tr-inbox}"
+TMP="$INBOX/.incoming"
+
+[ -f "$WAV" ] && [ -f "$JSON" ] || { echo "drb-upload: missing $WAV or $JSON" >&2; exit 1; }
+mkdir -p "$TMP" || exit 1
+
+stem="$(basename "$JSON" .json)"
+# Hard link when on the same filesystem (no copy, TR's unlink leaves ours);
+# copy otherwise.
+put() { ln -f "$1" "$2" 2>/dev/null || cp -f "$1" "$2"; }
+
+put "$WAV" "$TMP/$stem.wav" || exit 1
+put "$JSON" "$TMP/$stem.json" || exit 1
+mv -f "$TMP/$stem.wav" "$INBOX/$stem.wav" || exit 1
+mv -f "$TMP/$stem.json" "$INBOX/$stem.json" || exit 1
+exit 0

trunk-recorder/run.sh

@@ -0,0 +1,87 @@
+#!/bin/sh
+# Supervisor for Trunk Recorder inside its container (node-26#45).
+#
+# The edge-node writes /app/config.json from the C2 system config but has no
+# Docker access, so it cannot restart this container. This loop does it:
+#   - waits for config.json, then runs trunk-recorder on it
+#   - restarts it when config.json changes or /app/restart-request appears
+#   - keeps it stopped while /app/stop-request exists (dashboard Stop)
+#   - restarts it after a crash, backing off 5 s -> 60 s (`restarts` counts
+#     crashes only, not config restarts)
+#   - writes /app/drb-status.json every few seconds for the edge-node's health
+#     check (state, pid, started_at, restarts, last_exit, epoch)
+set -u
+APP="${DRB_TR_APP:-/app}"
+CFG="$APP/config.json"
+STATUS="$APP/drb-status.json"
+RESTART="$APP/restart-request"
+STOP="$APP/stop-request"
+REC="${DRB_RECORDINGS:-/recordings}"
+mkdir -p "$APP/logs" "$REC/tr-capture" "$REC/tr-inbox"
+
+pid=""
+started=0
+restarts=0
+last_exit=null
+backoff=5
+cfgsum=""
+
+write_status() {
+  printf '{"state":"%s","pid":%s,"started_at":%s,"restarts":%s,"last_exit":%s,"epoch":%s}\n' \
+    "$1" "${pid:-null}" "$started" "$restarts" "$last_exit" "$(date +%s)" > "$STATUS.tmp" \
+    && mv -f "$STATUS.tmp" "$STATUS"
+}
+
+sum() { md5sum "$CFG" 2>/dev/null | cut -d' ' -f1; }
+
+stop_tr() {
+  if [ -n "$pid" ] && kill -0 "$pid" 2>/dev/null; then
+    kill -TERM "$pid"
+    i=0
+    while kill -0 "$pid" 2>/dev/null && [ "$i" -lt 30 ]; do sleep 0.5; i=$((i + 1)); done
+    kill -KILL "$pid" 2>/dev/null
+    wait "$pid" 2>/dev/null
+  fi
+  pid=""
+}
+
+trap 'stop_tr; write_status stopped; exit 0' TERM INT
+
+nap() { sleep "$1" & wait $!; }
+
+while :; do
+  if [ -f "$STOP" ]; then
+    [ -n "$pid" ] && { echo "drb: stop requested"; stop_tr; }
+    write_status stopped; nap 2; continue
+  fi
+  if [ ! -f "$CFG" ]; then
+    write_status waiting_for_config; nap 5; continue
+  fi
+  if [ -z "$pid" ]; then
+    rm -f "$RESTART"
+    cfgsum="$(sum)"
+    echo "drb: starting trunk-recorder"
+    trunk-recorder --config="$CFG" &
+    pid=$!
+    started="$(date +%s)"
+  fi
+  write_status running
+  nap 5
+  if ! kill -0 "$pid" 2>/dev/null; then
+    wait "$pid" 2>/dev/null
+    last_exit=$?
+    pid=""
+    restarts=$((restarts + 1))
+    # A run that lasted a while resets the backoff.
+    [ $(( $(date +%s) - started )) -gt 120 ] && backoff=5
+    echo "drb: trunk-recorder exited ($last_exit); restarting in ${backoff}s"
+    write_status crashed
+    nap "$backoff"
+    backoff=$((backoff * 2)); [ "$backoff" -gt 60 ] && backoff=60
+    continue
+  fi
+  if [ -f "$RESTART" ] || [ "$(sum)" != "$cfgsum" ]; then
+    echo "drb: config changed or restart requested — restarting trunk-recorder"
+    stop_tr
+  fi
+done