diff --git a/Dockerfile b/Dockerfile
index 9fa4fd5..8ec5133 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -113,6 +113,8 @@ RUN if [ "$TARGETARCH" = "arm64" ]; then \
 
 COPY --from=backend-builder /app/VERSION /VERSION
 
+ENV PULSE_NO_AUTO_UPDATE=true
+
 ENTRYPOINT ["/usr/local/bin/pulse-docker-agent"]
 
 # Final stage (Pulse server runtime)
diff --git a/docs/DOCKER_MONITORING.md b/docs/DOCKER_MONITORING.md
index 87698af..9b8f0ad 100644
--- a/docs/DOCKER_MONITORING.md
+++ b/docs/DOCKER_MONITORING.md
@@ -1,6 +1,6 @@
 # Docker Monitoring Agent
 
-Pulse is focused on Proxmox VE and PBS, but many homelabs also run application stacks in Docker. The optional Pulse Docker agent turns container health and resource usage into first-class metrics that show up alongside your hypervisor data.
+Pulse is focused on Proxmox VE and PBS, but many homelabs also run application stacks in Docker. The optional Pulse Docker agent turns container health and resource usage into first-class metrics that show up alongside your hypervisor data. The recommended deployment is the bundled, least-privilege systemd service that runs the static `pulse-docker-agent` binary directly on the host. That path lets the installer lock down permissions, manage upgrades automatically, and integrate with the native init system. Containerising the agent is still available for orchestrated environments, but it trades away some of those controls (and still needs the Docker socket) so treat that option as advanced.
 
 ## What the agent reports
 
@@ -12,6 +12,7 @@ Every check interval (30s by default) the agent collects:
 - CPU usage, memory consumption and limits
 - Images, port mappings, network addresses, and start times
 - Writable layer size, root filesystem size, block I/O totals, and mount metadata (shown in the Docker table drawer)
+- Read/write throughput derived from Docker block I/O counters so you can spot noisy workloads at a glance
 - Health-check failures, restart-loop windows, and recent exit codes (displayed in the UI under each container drawer)
 
 Data is pushed to Pulse over HTTPS using your existing API token – no inbound firewall rules required.
@@ -38,7 +39,7 @@ Copy the binary to your Docker host (e.g. `/usr/local/bin/pulse-docker-agent`) a
 
 > **Why `CGO_ENABLED=0`?** Building a fully static binary ensures the agent runs on hosts still using older glibc releases (for example Debian 11 with glibc 2.31).
 
-### Quick install from your Pulse server
+### Quick install from your Pulse server (recommended)
 
 Use the bundled installation script (ships with Pulse v4.22.0+) to deploy and manage the agent. Replace the token placeholder with an API token generated in **Settings → Security**. Create a dedicated token for each Docker host so you can revoke individual credentials without touching others—sharing one token across many hosts makes incident response much harder. Tokens used here should include the `docker:report` scope so the agent can submit telemetry (add `docker:manage` only if you plan to issue lifecycle commands remotely).
 
@@ -49,6 +50,10 @@ curl -fsSL http://pulse.example.com/install-docker-agent.sh \
 
 > **Why sudo?** The installer needs to drop binaries under `/usr/local/bin`, create a systemd service, and start it—actions that require root privileges. Piping to `sudo bash …` saves you from retrying if you run the command as an unprivileged user.
 
+The script stores credentials in `/etc/pulse/pulse-docker-agent.env` (mode `600`) and creates a locked-down `pulse-docker` service account that only needs access to the Docker socket. Rotate tokens by editing that env file and running `sudo systemctl restart pulse-docker-agent`.
+
+To keep remote stop/remove commands working from Pulse, the installer also drops a small polkit rule that lets the `pulse-docker` service account run `systemctl stop/disable pulse-docker-agent` without password prompts. If you remove that rule, expect to acknowledge stop requests manually with `sudo systemctl disable --now pulse-docker-agent`.
+
 Running the one-liner again from another Pulse server (with its own URL/token) will merge that server into the same agent automatically—no extra flags required.
 
 To report to more than one Pulse instance from the same Docker host, repeat the `--target` flag (format: `https://pulse.example.com|<api-token>`) or export `PULSE_TARGETS` before running the script:
@@ -112,32 +117,58 @@ A single `pulse-docker-agent` process can now serve any number of Pulse backends
 ```ini
 [Unit]
 Description=Pulse Docker Agent
-After=network.target docker.service
-Requires=docker.service
+After=network-online.target docker.socket docker.service
+Wants=network-online.target docker.socket
 
 [Service]
 Type=simple
-Environment=PULSE_URL=https://pulse.example.com
-Environment=PULSE_TOKEN=replace-me
-Environment=PULSE_TARGETS=https://pulse.example.com|replace-me;https://pulse-dr.example.com|replace-me-dr
+EnvironmentFile=-/etc/pulse/pulse-docker-agent.env
 ExecStart=/usr/local/bin/pulse-docker-agent --interval 30s
-Restart=always
-RestartSec=5
+Restart=on-failure
+RestartSec=5s
+StartLimitIntervalSec=120
+StartLimitBurst=5
+User=pulse-docker
+Group=pulse-docker
+SupplementaryGroups=docker
+UMask=0077
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=read-only
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectKernelLogs=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/run/docker.sock
+ProtectHostname=yes
+ProtectClock=yes
 
 [Install]
 WantedBy=multi-user.target
 ```
 
-### Containerised agent (advanced)
+Rotate credentials or add additional Pulse targets by editing `/etc/pulse/pulse-docker-agent.env` and reloading the service with `sudo systemctl restart pulse-docker-agent`.
+
+### Containerised agent (advanced / optional)
 
 If you prefer to run the agent inside a container, mount the Docker socket and supply the same environment variables:
 
 ```bash
 docker run -d \
   --name pulse-docker-agent \
+  --pid=host \
+  --uts=host \
   -e PULSE_URL="https://pulse.example.com" \
   -e PULSE_TOKEN="<token>" \
   -e PULSE_TARGETS="https://pulse.example.com|<token>;https://pulse-dr.example.com|<token-dr>" \
+  -e PULSE_NO_AUTO_UPDATE=true \
+  -v /etc/machine-id:/etc/machine-id:ro \
   -v /var/run/docker.sock:/var/run/docker.sock \
   --restart unless-stopped \
   ghcr.io/rcourtman/pulse-docker-agent:latest
@@ -145,6 +176,8 @@ docker run -d \
 
 > **Note**: Official images for `linux/amd64` and `linux/arm64` are published to `ghcr.io/rcourtman/pulse-docker-agent`. To test local changes, run `docker build --target agent_runtime -t pulse-docker-agent:test .` from the repository root.
 
+`--pid=host`, `--uts=host`, and the `/etc/machine-id` bind keep host metadata stable so Pulse doesn’t think the container itself is the Docker host. Auto-update is disabled in the image by default; rebuild or override `PULSE_NO_AUTO_UPDATE=false` only if you manage upgrades outside of your orchestrator. Expect to grant the container the same level of Docker socket access as the systemd service—running inside Docker doesn’t sandbox the agent from the host.
+
 ## Configuration reference
 
 | Flag / Env var          | Description                                               | Default         |
diff --git a/docs/TEMPERATURE_MONITORING.md b/docs/TEMPERATURE_MONITORING.md
index a9c1d69..5031d1f 100644
--- a/docs/TEMPERATURE_MONITORING.md
+++ b/docs/TEMPERATURE_MONITORING.md
@@ -173,6 +173,13 @@ The auto-setup script (Settings → Nodes → Setup Script) will prompt you to c
 
 If the node is part of a Proxmox cluster, the script will now detect the other members and offer to configure the same SSH/lm-sensors setup on each of them automatically—confirm when prompted to roll it out cluster-wide.
 
+### Host-side responsibilities
+
+- Run the host installer (`install-sensor-proxy.sh`) on the Proxmox machine that hosts Pulse to install and maintain the `pulse-sensor-proxy` service. The node setup script does not create this service.
+- Re-run the host installer if the service or socket disappears after a host upgrade or configuration cleanup; the installer is idempotent.
+- The installer now ships a self-heal timer (`pulse-sensor-proxy-selfheal.timer`) that restarts or reinstalls the proxy if it ever goes missing; leave it enabled for automatic recovery.
+- Hot dev builds now warn when only a container-local proxy socket is present, signalling that the host proxy needs to be reinstalled before temperatures will flow back into Pulse.
+
 ### Turnkey Setup for Standalone Nodes (v4.25.0+)
 
 **For standalone nodes** (not in a Proxmox cluster) running **containerized Pulse**, the setup script now automatically configures temperature monitoring with zero manual steps:
diff --git a/frontend-modern/pnpm-lock.yaml b/frontend-modern/pnpm-lock.yaml
new file mode 100644
index 0000000..847fae7
Binary files /dev/null and b/frontend-modern/pnpm-lock.yaml differ
diff --git a/frontend-modern/src/api/monitoring.ts b/frontend-modern/src/api/monitoring.ts
index 9536312..4bf5ed3 100644
--- a/frontend-modern/src/api/monitoring.ts
+++ b/frontend-modern/src/api/monitoring.ts
@@ -148,6 +148,76 @@ export class MonitoringAPI {
     }
   }
 
+  static async allowDockerHostReenroll(hostId: string): Promise<void> {
+    const url = `${this.baseUrl}/agents/docker/hosts/${encodeURIComponent(hostId)}/allow-reenroll`;
+
+    const response = await apiFetch(url, {
+      method: 'POST',
+    });
+
+    if (!response.ok) {
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            }
+          } catch (_err) {
+            // ignore parse error, use raw text
+          }
+        }
+      } catch (_err) {
+        // ignore read error
+      }
+
+      throw new Error(message);
+    }
+  }
+
+  static async deleteHostAgent(hostId: string): Promise<void> {
+    if (!hostId) {
+      throw new Error('Host ID is required to remove a host agent.');
+    }
+
+    const url = `${this.baseUrl}/agents/host/${encodeURIComponent(hostId)}`;
+    const response = await apiFetch(url, { method: 'DELETE' });
+
+    if (!response.ok) {
+      let message = `Failed with status ${response.status}`;
+      try {
+        const text = await response.text();
+        if (text?.trim()) {
+          message = text.trim();
+          try {
+            const parsed = JSON.parse(text);
+            if (typeof parsed?.error === 'string' && parsed.error.trim()) {
+              message = parsed.error.trim();
+            } else if (typeof parsed?.message === 'string' && parsed.message.trim()) {
+              message = parsed.message.trim();
+            }
+          } catch (_err) {
+            // Ignore JSON parse errors, fallback to raw text.
+          }
+        }
+      } catch (_err) {
+        // Ignore body read errors, keep default message.
+      }
+
+      throw new Error(message);
+    }
+
+    // Consume and ignore the body so the fetch can be reused by the connection pool.
+    try {
+      await response.text();
+    } catch (_err) {
+      // Swallow body read errors; the deletion already succeeded.
+    }
+  }
+
   static async lookupHost(params: { id?: string; hostname?: string }): Promise<HostLookupResponse | null> {
     const search = new URLSearchParams();
     if (params.id) search.set('id', params.id);
diff --git a/frontend-modern/src/components/Alerts/ResourceTable.tsx b/frontend-modern/src/components/Alerts/ResourceTable.tsx
index b1a2c0c..ea5064f 100644
--- a/frontend-modern/src/components/Alerts/ResourceTable.tsx
+++ b/frontend-modern/src/components/Alerts/ResourceTable.tsx
@@ -4,6 +4,7 @@ import { StatusBadge } from '@/components/shared/StatusBadge';
 import type { Alert } from '@/types/api';
 import { Card } from '@/components/shared/Card';
 import { SectionHeader } from '@/components/shared/SectionHeader';
+import { ThresholdSlider } from '@/components/Dashboard/ThresholdSlider';
 
 const COLUMN_TOOLTIP_LOOKUP: Record<string, string> = {
   'cpu %': 'Percent CPU utilization allowed before an alert fires.',
@@ -48,6 +49,8 @@ const COLUMN_TOOLTIP_LOOKUP: Record<string, string> = {
 const OFFLINE_ALERTS_TOOLTIP =
   'Toggle default behavior for powered-off or connectivity alerts for this resource type.';
 
+const SLIDER_METRICS = new Set(['cpu', 'memory', 'disk', 'temperature']);
+
 export interface Resource {
   id: string;
   name: string;
@@ -79,6 +82,7 @@ export interface Resource {
   toggleTitleEnabled?: string;
   toggleTitleDisabled?: string;
   editable?: boolean;
+  note?: string;
   [key: string]: unknown;
 }
 
@@ -103,6 +107,7 @@ interface ResourceTableProps {
     resourceId: string,
     thresholds: Record<string, number | undefined>,
     defaults: Record<string, number | undefined>,
+    note: string | undefined,
   ) => void;
   onSaveEdit: (resourceId: string) => void;
   onCancelEdit: () => void;
@@ -136,6 +141,8 @@ interface ResourceTableProps {
   groupHeaderMeta?: Record<string, GroupHeaderMeta>;
   factoryDefaults?: Record<string, number | undefined>;
   onResetDefaults?: () => void;
+  editingNote: () => string;
+  setEditingNote: (value: string) => void;
 }
 
 type OfflineState = 'off' | 'warning' | 'critical';
@@ -513,7 +520,7 @@ export function ResourceTable(props: ResourceTableProps) {
           </thead>
           <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
             {/* Global Defaults Row */}
-            <Show
+              <Show
               when={props.globalDefaults && props.setGlobalDefaults && props.setHasUnsavedChanges}
             >
               <tr
@@ -961,6 +968,26 @@ export function ResourceTable(props: ResourceTableProps) {
                                       Custom
                                     </span>
                                   </Show>
+                                  <Show when={isEditing()}>
+                                    <div class="mt-2 w-full">
+                                      <label class="sr-only" for={`note-${resource.id}`}>
+                                        Override note
+                                      </label>
+                                      <textarea
+                                        id={`note-${resource.id}`}
+                                        class="w-full rounded border border-gray-300 bg-white px-2 py-1 text-xs text-gray-700 shadow-sm focus:border-blue-500 focus:outline-none focus:ring-1 focus:ring-blue-500 dark:border-gray-600 dark:bg-gray-800 dark:text-gray-200"
+                                        rows={2}
+                                        placeholder="Add a note about this override (optional)"
+                                        value={props.editingNote()}
+                                        onInput={(e) => props.setEditingNote(e.currentTarget.value)}
+                                      />
+                                    </div>
+                                  </Show>
+                                  <Show when={!isEditing() && resource.note}>
+                                    <p class="mt-2 text-xs italic text-gray-500 dark:text-gray-400 break-words">
+                                      {resource.note as string}
+                                    </p>
+                                  </Show>
                                 </div>
                               </td>
                               {/* Metric columns - dynamically rendered based on resource type */}
@@ -979,6 +1006,7 @@ export function ResourceTable(props: ResourceTableProps) {
                                       resource.id,
                                       resource.thresholds ? { ...resource.thresholds } : {},
                                       resource.defaults ? { ...resource.defaults } : {},
+                                      typeof resource.note === 'string' ? resource.note : undefined,
                                     );
                                   };
 
@@ -1011,56 +1039,121 @@ export function ResourceTable(props: ResourceTableProps) {
                                             </div>
                                           }
                                         >
-                                          <div class="flex items-center justify-center">
-                                            <input
-                                              type="number"
-                                              min={bounds.min}
-                                              max={bounds.max}
-                                              step={metricStep(metric)}
-                                              value={thresholds()?.[metric] ?? ''}
-                                              placeholder={isDisabled() ? 'Off' : ''}
-                                              title="Set to -1 to disable alerts for this metric"
-                                              ref={(el) => {
-                                                if (
-                                                  isEditing() &&
-                                                  activeMetricInput()?.resourceId === resource.id &&
-                                                  activeMetricInput()?.metric === metric
-                                                ) {
-                                                  queueMicrotask(() => {
-                                                    el.focus();
-                                                    el.select();
-                                                  });
-                                                }
-                                              }}
-                                              onInput={(e) => {
-                                                const raw = e.currentTarget.value;
-                                                if (raw === '') {
-                                                  props.setEditingThresholds({
-                                                    ...props.editingThresholds(),
-                                                    [metric]: undefined,
-                                                  });
-                                                  return;
-                                                }
-                                                const val = parseFloat(raw);
-                                                if (!Number.isNaN(val)) {
-                                                  props.setEditingThresholds({
-                                                    ...props.editingThresholds(),
-                                                    [metric]: val,
-                                                  });
-                                                }
-                                              }}
-                                              onBlur={() => {
-                                                if (props.editingId() === resource.id) {
-                                                  props.onSaveEdit(resource.id);
-                                                }
-                                                setActiveMetricInput(null);
-                                              }}
-                                              class={`w-16 px-2 py-0.5 text-sm text-center border rounded ${
-                                                isDisabled()
-                                                  ? 'bg-gray-100 dark:bg-gray-800 text-gray-400 dark:text-gray-600 border-gray-300 dark:border-gray-600'
-                                                  : 'bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 border-gray-300 dark:border-gray-600'
-                                              }`}
-                                            />
+                                          <div class="flex w-full items-center gap-3">
+                                            <Show when={SLIDER_METRICS.has(metric)}>
+                                              {(() => {
+                                                const sliderMin =
+                                                  metric === 'temperature'
+                                                    ? Math.max(0, bounds.min)
+                                                    : Math.max(0, bounds.min);
+                                                const sliderMax =
+                                                  metric === 'temperature'
+                                                    ? Math.max(
+                                                        sliderMin,
+                                                        bounds.max > 0 ? bounds.max : 120,
+                                                      )
+                                                    : bounds.max;
+                                                const defaultSliderValue = () => {
+                                                  if (metric === 'disk') return 90;
+                                                  if (metric === 'memory') return 85;
+                                                  if (metric === 'temperature') return 80;
+                                                  return 80;
+                                                };
+                                                const currentSliderValue = () => {
+                                                  const editingVal =
+                                                    props.editingThresholds()?.[metric];
+                                                  if (
+                                                    typeof editingVal === 'number' &&
+                                                    editingVal >= 0
+                                                  ) {
+                                                    return Math.round(editingVal);
+                                                  }
+                                                  const displayVal = displayValue(metric);
+                                                  if (
+                                                    typeof displayVal === 'number' &&
+                                                    displayVal >= 0
+                                                  ) {
+                                                    return Math.round(displayVal);
+                                                  }
+                                                  return defaultSliderValue();
+                                                };
+                                                return (
+                                                  <div class="w-36">
+                                                    <ThresholdSlider
+                                                      value={Math.max(
+                                                        sliderMin,
+                                                        Math.min(sliderMax, currentSliderValue()),
+                                                      )}
+                                                      onChange={(val) => {
+                                                        props.setEditingThresholds({
+                                                          ...props.editingThresholds(),
+                                                          [metric]: val,
+                                                        });
+                                                      }}
+                                                      type={
+                                                        metric === 'temperature'
+                                                          ? 'temperature'
+                                                          : (metric as 'cpu' | 'memory' | 'disk')
+                                                      }
+                                                      min={sliderMin}
+                                                      max={sliderMax}
+                                                    />
+                                                  </div>
+                                                );
+                                              })()}
+                                            </Show>
+                                            <div class="flex items-center justify-center">
+                                              <input
+                                                type="number"
+                                                min={bounds.min}
+                                                max={bounds.max}
+                                                step={metricStep(metric)}
+                                                value={thresholds()?.[metric] ?? ''}
+                                                placeholder={isDisabled() ? 'Off' : ''}
+                                                title="Set to -1 to disable alerts for this metric"
+                                                ref={(el) => {
+                                                  if (
+                                                    isEditing() &&
+                                                    activeMetricInput()?.resourceId ===
+                                                      resource.id &&
+                                                    activeMetricInput()?.metric === metric
+                                                  ) {
+                                                    queueMicrotask(() => {
+                                                      el.focus();
+                                                      el.select();
+                                                    });
+                                                  }
+                                                }}
+                                                onInput={(e) => {
+                                                  const raw = e.currentTarget.value;
+                                                  if (raw === '') {
+                                                    props.setEditingThresholds({
+                                                      ...props.editingThresholds(),
+                                                      [metric]: undefined,
+                                                    });
+                                                    return;
+                                                  }
+                                                  const val = parseFloat(raw);
+                                                  if (!Number.isNaN(val)) {
+                                                    props.setEditingThresholds({
+                                                      ...props.editingThresholds(),
+                                                      [metric]: val,
+                                                    });
+                                                  }
+                                                }}
+                                                onBlur={() => {
+                                                  if (props.editingId() === resource.id) {
+                                                    props.onSaveEdit(resource.id);
+                                                  }
+                                                  setActiveMetricInput(null);
+                                                }}
+                                                class={`w-16 px-2 py-0.5 text-sm text-center border rounded ${
+                                                  isDisabled()
+                                                    ? 'bg-gray-100 dark:bg-gray-800 text-gray-400 dark:text-gray-600 border-gray-300 dark:border-gray-600'
+                                                    : 'bg-white dark:bg-gray-700 text-gray-900 dark:text-gray-100 border-gray-300 dark:border-gray-600'
+                                                }`}
+                                              />
+                                            </div>
                                           </div>
                                         </Show>
                                       </Show>
@@ -1171,6 +1264,7 @@ export function ResourceTable(props: ResourceTableProps) {
                                             resource.id,
                                             resource.thresholds ? { ...resource.thresholds } : {},
                                             resource.defaults ? { ...resource.defaults } : {},
+                                            typeof resource.note === 'string' ? resource.note : undefined,
                                           )
                                         }
                                         class="p-1 text-blue-600 hover:text-blue-700 dark:text-blue-400 dark:hover:text-blue-300"
@@ -1421,11 +1515,12 @@ export function ResourceTable(props: ResourceTableProps) {
                                   return;
                                 }
                                 setActiveMetricInput({ resourceId: resource.id, metric });
-                                props.onEdit(
-                                  resource.id,
-                                  resource.thresholds ? { ...resource.thresholds } : {},
-                                  resource.defaults ? { ...resource.defaults } : {},
-                                );
+        props.onEdit(
+          resource.id,
+          resource.thresholds ? { ...resource.thresholds } : {},
+          resource.defaults ? { ...resource.defaults } : {},
+          typeof resource.note === 'string' ? resource.note : undefined,
+        );
                               };
 
                               return (
@@ -1597,11 +1692,12 @@ export function ResourceTable(props: ResourceTableProps) {
                                   <div class="flex items-center gap-1">
                                     <button
                                       type="button"
-                                      onClick={() =>
+                                onClick={() =>
                                         props.onEdit(
                                           resource.id,
                                           resource.thresholds ? { ...resource.thresholds } : {},
                                           resource.defaults ? { ...resource.defaults } : {},
+                                          typeof resource.note === 'string' ? resource.note : undefined,
                                         )
                                       }
                                       class="p-1 text-blue-600 hover:text-blue-700 dark:text-blue-400 dark:hover:text-blue-300"
diff --git a/frontend-modern/src/components/Alerts/ThresholdsTable.tsx b/frontend-modern/src/components/Alerts/ThresholdsTable.tsx
index 6b44fc8..545b9c6 100644
--- a/frontend-modern/src/components/Alerts/ThresholdsTable.tsx
+++ b/frontend-modern/src/components/Alerts/ThresholdsTable.tsx
@@ -52,6 +52,7 @@ interface Override {
   disabled?: boolean;
   disableConnectivity?: boolean; // For nodes only - disable offline alerts
   poweredOffSeverity?: 'warning' | 'critical';
+  note?: string;
   thresholds: {
     cpu?: number;
     memory?: number;
@@ -307,9 +308,10 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
 
   const [searchTerm, setSearchTerm] = createSignal('');
   const [editingId, setEditingId] = createSignal<string | null>(null);
-  const [editingThresholds, setEditingThresholds] = createSignal<
-    Record<string, number | undefined>
-  >({});
+const [editingThresholds, setEditingThresholds] = createSignal<
+  Record<string, number | undefined>
+>({});
+  const [editingNote, setEditingNote] = createSignal('');
   const [activeTab, setActiveTab] = createSignal<'proxmox' | 'pmg' | 'hosts' | 'docker'>('proxmox');
   let searchInputRef: HTMLInputElement | undefined;
   const [dockerIgnoredInput, setDockerIgnoredInput] = createSignal(
@@ -585,6 +587,9 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
           );
         });
 
+      const note = typeof override?.note === 'string' ? override.note : undefined;
+      const hasNote = Boolean(note && note.trim().length > 0);
+
       const originalDisplayName = node.displayName?.trim() || node.name;
       const friendlyName = getFriendlyNodeName(originalDisplayName, node.clusterName);
       const rawName = node.name;
@@ -608,7 +613,8 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
         uptime: node.uptime,
         cpu: node.cpu,
         memory: node.memory?.usage,
-        hasOverride: hasCustomThresholds || false,
+        hasOverride:
+          hasCustomThresholds || hasNote || Boolean(override?.disableConnectivity) || false,
         disabled: false,
         disableConnectivity: override?.disableConnectivity || false,
         thresholds: override?.thresholds || {},
@@ -616,6 +622,7 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
         clusterName: node.isClusterMember ? node.clusterName?.trim() : undefined,
         isClusterMember: node.isClusterMember ?? false,
         instance: node.instance,
+        note,
       } satisfies Resource;
     });
 
@@ -1518,11 +1525,13 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
     resourceId: string,
     currentThresholds: Record<string, number | undefined>,
     defaults: Record<string, number | undefined>,
+    note?: string,
   ) => {
     setEditingId(resourceId);
     // Merge defaults with overrides for editing
     const mergedThresholds = { ...defaults, ...currentThresholds };
     setEditingThresholds(mergedThresholds);
+    setEditingNote(note ?? '');
   };
 
   const saveEdit = (resourceId: string) => {
@@ -1542,6 +1551,8 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
     if (!resource) return;
 
     const editedThresholds = editingThresholds();
+    const trimmedNote = editingNote().trim();
+    const noteForOverride = trimmedNote.length > 0 ? trimmedNote : undefined;
 
     if (resource.editScope === 'backup') {
       const currentBackupDefaults = props.backupDefaults();
@@ -1610,7 +1621,8 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
     const hasStateOnlyOverride = Boolean(
       resource.disabled ||
         resource.disableConnectivity ||
-        resource.poweredOffSeverity !== undefined,
+        resource.poweredOffSeverity !== undefined ||
+        noteForOverride !== undefined,
     );
 
     // If no threshold overrides or state flags remain, remove the override entirely
@@ -1642,6 +1654,7 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
       disabled: resource.disabled,
       disableConnectivity: resource.disableConnectivity,
       poweredOffSeverity: resource.poweredOffSeverity,
+      note: noteForOverride,
       thresholds: overrideThresholds,
     };
 
@@ -1701,18 +1714,25 @@ export function ThresholdsTable(props: ThresholdsTableProps) {
         delete hysteresisThresholds.poweredOffSeverity;
       }
     }
+    if (noteForOverride) {
+      hysteresisThresholds.note = noteForOverride;
+    } else {
+      delete hysteresisThresholds.note;
+    }
     newRawConfig[resourceId] = hysteresisThresholds;
     props.setRawOverridesConfig(newRawConfig);
 
     props.setHasUnsavedChanges(true);
     setEditingId(null);
     setEditingThresholds({});
+    setEditingNote('');
   };
 
-  const cancelEdit = () => {
-    setEditingId(null);
-    setEditingThresholds({});
-  };
+const cancelEdit = () => {
+  setEditingId(null);
+  setEditingThresholds({});
+  setEditingNote('');
+};
 
   const updateMetricDelay = (
     typeKey: 'guest' | 'node' | 'storage' | 'pbs',
diff --git a/frontend-modern/src/components/Dashboard/ThresholdSlider.tsx b/frontend-modern/src/components/Dashboard/ThresholdSlider.tsx
index 9f408b5..0517830 100644
--- a/frontend-modern/src/components/Dashboard/ThresholdSlider.tsx
+++ b/frontend-modern/src/components/Dashboard/ThresholdSlider.tsx
@@ -3,7 +3,7 @@ import { createSignal, createEffect, onMount } from 'solid-js';
 interface ThresholdSliderProps {
   value: number;
   onChange: (value: number) => void;
-  type: 'cpu' | 'memory' | 'disk';
+  type: 'cpu' | 'memory' | 'disk' | 'temperature';
   min?: number;
   max?: number;
 }
@@ -15,10 +15,11 @@ export function ThresholdSlider(props: ThresholdSliderProps) {
   const [isDragging, setIsDragging] = createSignal(false);
 
   // Color mapping
-  const colorMap = {
+  const colorMap: Record<ThresholdSliderProps['type'], string> = {
     cpu: 'text-blue-500',
     memory: 'text-green-500',
     disk: 'text-amber-500',
+    temperature: 'text-rose-500',
   };
 
   // Calculate visual position - allow full range 0-100%
@@ -81,7 +82,9 @@ export function ThresholdSlider(props: ThresholdSliderProps) {
             ? 'bg-blue-500/30'
             : props.type === 'memory'
               ? 'bg-green-500/30'
-              : 'bg-amber-500/30'
+              : props.type === 'disk'
+                ? 'bg-amber-500/30'
+                : 'bg-rose-500/30'
         }`}
         style={{ width: `${calculateVisualPosition(props.value)}%` }}
       ></div>
@@ -98,7 +101,11 @@ export function ThresholdSlider(props: ThresholdSliderProps) {
         onWheel={(e) => e.preventDefault()}
         class="absolute inset-0 w-full h-3.5 opacity-0 cursor-pointer z-20"
         style={{ 'touch-action': 'none' }}
-        title={`${props.type.toUpperCase()}: ${props.value}%`}
+        title={
+          props.type === 'temperature'
+            ? `Temperature: ${props.value}°C`
+            : `${props.type.toUpperCase()}: ${props.value}%`
+        }
       />
 
       {/* Custom thumb with value */}
@@ -118,7 +125,9 @@ export function ThresholdSlider(props: ThresholdSliderProps) {
       >
         <div class="relative">
           <div class="w-9 h-4 bg-white dark:bg-gray-800 rounded-full shadow-md border-2 border-current flex items-center justify-center">
-            <span class="text-[9px] font-semibold">{props.value}%</span>
+            <span class="text-[9px] font-semibold">
+              {props.type === 'temperature' ? `${props.value}°` : `${props.value}%`}
+            </span>
           </div>
         </div>
       </div>
diff --git a/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx b/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx
index 2076438..296225f 100644
--- a/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx
+++ b/frontend-modern/src/components/Docker/DockerUnifiedTable.tsx
@@ -374,13 +374,26 @@ const DockerContainerRow: Component<{
   const blockIo = createMemo(() => container.blockIo);
   const blockIoReadBytes = createMemo(() => blockIo()?.readBytes ?? 0);
   const blockIoWriteBytes = createMemo(() => blockIo()?.writeBytes ?? 0);
+  const blockIoReadRate = createMemo(() => blockIo()?.readRateBytesPerSecond ?? null);
+  const blockIoWriteRate = createMemo(() => blockIo()?.writeRateBytesPerSecond ?? null);
+  const formatIoRate = (value?: number | null) => {
+    if (value === undefined || value === null) return undefined;
+    if (value <= 0) return undefined;
+    const decimals = value >= 1024 * 1024 ? 1 : value >= 1024 ? 1 : 0;
+    return `${formatBytes(value, decimals)}/s`;
+  };
+  const blockIoReadRateLabel = createMemo(() => formatIoRate(blockIoReadRate()));
+  const blockIoWriteRateLabel = createMemo(() => formatIoRate(blockIoWriteRate()));
   const hasBlockIo = createMemo(() => {
     const stats = blockIo();
     if (!stats) return false;
     const read = stats.readBytes ?? 0;
     const write = stats.writeBytes ?? 0;
-    return read > 0 || write > 0;
+    const readRate = stats.readRateBytesPerSecond ?? 0;
+    const writeRate = stats.writeRateBytesPerSecond ?? 0;
+    return read > 0 || write > 0 || readRate > 0 || writeRate > 0;
   });
+  const hasBlockIoRates = createMemo(() => !!blockIoReadRateLabel() || !!blockIoWriteRateLabel());
 
   const hasDrawerContent = createMemo(() => {
     return (
@@ -765,6 +778,19 @@ const DockerContainerRow: Component<{
               />
             </Show>
           </Show>
+          <Show when={hasBlockIoRates()}>
+            <div class="mt-1 text-[11px] text-gray-500 dark:text-gray-400">
+              <Show when={blockIoReadRateLabel()}>
+                <span>R {blockIoReadRateLabel()}</span>
+              </Show>
+              <Show when={blockIoReadRateLabel() && blockIoWriteRateLabel()}>
+                <span class="mx-1 text-gray-300 dark:text-gray-600">•</span>
+              </Show>
+              <Show when={blockIoWriteRateLabel()}>
+                <span>W {blockIoWriteRateLabel()}</span>
+              </Show>
+            </div>
+          </Show>
         </td>
         <td class="px-2 py-0.5 text-xs text-gray-700 dark:text-gray-300">
           <Show when={isRunning()} fallback={<span class="text-gray-400">—</span>}>
@@ -838,15 +864,29 @@ const DockerContainerRow: Component<{
                   <div class="mt-1 space-y-1 text-[11px] text-gray-600 dark:text-gray-300">
                     <div class="flex items-center justify-between">
                       <span>Read</span>
-                      <span class="font-semibold text-gray-900 dark:text-gray-100">
-                        {formatBytes(blockIoReadBytes())}
-                      </span>
+                      <div class="text-right">
+                        <div class="font-semibold text-gray-900 dark:text-gray-100">
+                          {formatBytes(blockIoReadBytes())}
+                        </div>
+                        <Show when={blockIoReadRateLabel()}>
+                          <div class="text-[10px] text-gray-500 dark:text-gray-400">
+                            {blockIoReadRateLabel()}
+                          </div>
+                        </Show>
+                      </div>
                     </div>
                     <div class="flex items-center justify-between">
                       <span>Write</span>
-                      <span class="font-semibold text-gray-900 dark:text-gray-100">
-                        {formatBytes(blockIoWriteBytes())}
-                      </span>
+                      <div class="text-right">
+                        <div class="font-semibold text-gray-900 dark:text-gray-100">
+                          {formatBytes(blockIoWriteBytes())}
+                        </div>
+                        <Show when={blockIoWriteRateLabel()}>
+                          <div class="text-[10px] text-gray-500 dark:text-gray-400">
+                            {blockIoWriteRateLabel()}
+                          </div>
+                        </Show>
+                      </div>
                     </div>
                   </div>
                 </div>
diff --git a/frontend-modern/src/components/Settings/DockerAgents.tsx b/frontend-modern/src/components/Settings/DockerAgents.tsx
index 0aa23b7..95cde0c 100644
--- a/frontend-modern/src/components/Settings/DockerAgents.tsx
+++ b/frontend-modern/src/components/Settings/DockerAgents.tsx
@@ -17,25 +17,46 @@ export const DockerAgents: Component = () => {
 
   const [showHidden, setShowHidden] = createSignal(false);
 
-  const dockerHosts = () => {
-    const all = state.dockerHosts || [];
-    return showHidden() ? all : all.filter(host => !host.hidden);
-  };
+  const allDockerHosts = () => state.dockerHosts || [];
 
-  const hiddenCount = () => (state.dockerHosts || []).filter(host => host.hidden).length;
+  const dockerHosts = createMemo(() => {
+    const all = allDockerHosts();
+    const includeHidden = showHidden();
+    let filtered = includeHidden ? all : all.filter(host => !host.hidden);
 
-  const pendingHosts = () =>
-    dockerHosts().filter(host => {
+    if (!includeHidden) {
+      filtered = filtered.filter(host => {
+        if (!host.pendingUninstall) {
+          return true;
+        }
+        const status = host.command?.status;
+        return status === 'failed' || status === 'expired';
+      });
+    }
+
+    return filtered;
+  });
+
+  const hiddenCount = () => allDockerHosts().filter(host => host.hidden).length;
+
+  const pendingHosts = createMemo(() =>
+    allDockerHosts().filter(host => {
+      if (host.pendingUninstall) return true;
       const status = host.command?.status;
-      if (status === 'queued' || status === 'dispatched' || status === 'acknowledged') return true;
-      return Boolean(host.pendingUninstall);
-    });
+      return status === 'queued' || status === 'dispatched' || status === 'acknowledged' || status === 'completed';
+    }),
+  );
+
+  const removedHosts = () => state.removedDockerHosts ?? [];
+  const hasRemovedHosts = () => removedHosts().length > 0;
 
   const [removingHostId, setRemovingHostId] = createSignal<string | null>(null);
   const [showRemoveModal, setShowRemoveModal] = createSignal(false);
   const [hostToRemoveId, setHostToRemoveId] = createSignal<string | null>(null);
   const [uninstallCommandCopied, setUninstallCommandCopied] = createSignal(false);
-  const [removeActionLoading, setRemoveActionLoading] = createSignal<'queue' | 'force' | 'hide' | null>(null);
+  const [removeActionLoading, setRemoveActionLoading] = createSignal<
+    'queue' | 'force' | 'hide' | 'awaitingCommand' | null
+  >(null);
   const [showAdvancedOptions, setShowAdvancedOptions] = createSignal(false);
   const [securityStatus, setSecurityStatus] = createSignal<SecurityStatus | null>(null);
   const [isGeneratingToken, setIsGeneratingToken] = createSignal(false);
@@ -131,6 +152,10 @@ const modalLastHeartbeat = createMemo(() => {
   return host?.lastReportTime ? formatRelativeTime(new Date(host.lastReportTime)) : null;
 });
 
+const modalHostPendingUninstall = createMemo(() => Boolean(hostToRemove()?.pendingUninstall));
+const modalHasCommand = createMemo(() => Boolean(modalCommand()));
+const [hasShownCommandCompletion, setHasShownCommandCompletion] = createSignal(false);
+
 const formatElapsedTime = (seconds: number) => {
   if (seconds < 60) {
     return `${seconds}s`;
@@ -140,6 +165,55 @@ const formatElapsedTime = (seconds: number) => {
   return `${mins}m ${secs}s`;
 };
 
+type RemovalStatusTone = 'info' | 'success' | 'danger';
+
+const removalBadgeClassMap: Record<RemovalStatusTone, string> = {
+  info: 'inline-flex items-center gap-1 rounded-full bg-blue-100 px-2 py-0.5 text-[11px] font-semibold uppercase tracking-wide text-blue-700 dark:bg-blue-900/40 dark:text-blue-200',
+  success:
+    'inline-flex items-center gap-1 rounded-full bg-emerald-100 px-2 py-0.5 text-[11px] font-semibold uppercase tracking-wide text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-200',
+  danger:
+    'inline-flex items-center gap-1 rounded-full bg-red-100 px-2 py-0.5 text-[11px] font-semibold uppercase tracking-wide text-red-600 dark:bg-red-900/40 dark:text-red-200',
+};
+
+const removalTextClassMap: Record<RemovalStatusTone, string> = {
+  info: 'text-blue-700 dark:text-blue-300',
+  success: 'text-emerald-700 dark:text-emerald-300',
+  danger: 'text-red-600 dark:text-red-300',
+};
+
+const getRemovalStatusInfo = (host: DockerHost): { label: string; tone: RemovalStatusTone } | null => {
+  const status = host.command?.status ?? null;
+
+  switch (status) {
+    case 'failed':
+      return {
+        label: host.command?.failureReason || 'Pulse could not stop the agent automatically.',
+        tone: 'danger',
+      };
+    case 'expired':
+      return {
+        label: 'Stop command expired before the agent responded.',
+        tone: 'danger',
+      };
+    case 'completed':
+      return {
+        label: 'Agent stopped. Pulse will hide this host after the next missed heartbeat.',
+        tone: 'success',
+      };
+    case 'acknowledged':
+      return { label: 'Agent acknowledged the stop command—waiting for shutdown.', tone: 'info' };
+    case 'dispatched':
+      return { label: 'Instruction delivered to the agent.', tone: 'info' };
+    case 'queued':
+      return { label: 'Stop command queued; waiting to reach the agent.', tone: 'info' };
+    default:
+      if (host.pendingUninstall) {
+        return { label: 'Marked for uninstall; waiting for agent confirmation.', tone: 'info' };
+      }
+      return null;
+  }
+};
+
   createEffect(() => {
     if (!showRemoveModal()) return;
     const id = hostToRemoveId();
@@ -149,6 +223,17 @@ const formatElapsedTime = (seconds: number) => {
     }
   });
 
+  createEffect(() => {
+    if (!showRemoveModal()) {
+      return;
+    }
+    if (removeActionLoading() === 'awaitingCommand') {
+      if (modalHasCommand() || modalHostPendingUninstall() || modalCommandFailed()) {
+        setRemoveActionLoading(null);
+      }
+    }
+  });
+
   // Track elapsed time for command execution
   createEffect(() => {
     const cmd = modalCommand();
@@ -178,6 +263,23 @@ const formatElapsedTime = (seconds: number) => {
     }
   });
 
+  createEffect(() => {
+    if (!showRemoveModal()) {
+      return;
+    }
+    if (modalCommandCompleted() && !hasShownCommandCompletion()) {
+      setHasShownCommandCompletion(true);
+      notificationStore.success('Agent stopped. Pulse will hide this host after the next heartbeat.', 5000);
+      if (typeof window !== 'undefined') {
+        window.setTimeout(() => {
+          closeRemoveModal();
+        }, 1200);
+      } else {
+        closeRemoveModal();
+      }
+    }
+  });
+
   onMount(() => {
     if (typeof window === 'undefined') {
       return;
@@ -293,6 +395,32 @@ User=root
 WantedBy=multi-user.target`;
   };
 
+  const getAllowReenrollCommand = (hostId: string) => {
+    const url = pulseUrl();
+    return `curl -X POST -H "X-API-Token: <token-with-docker:manage>" ${url}/api/agents/docker/hosts/${hostId}/allow-reenroll`;
+  };
+
+  const handleAllowReenroll = async (hostId: string, label: string) => {
+    try {
+      await MonitoringAPI.allowDockerHostReenroll(hostId);
+      notificationStore.success(`Allowed ${label} to report again`, 4000);
+    } catch (error) {
+      console.error('Failed to allow Docker host re-enroll', error);
+      const message = error instanceof Error ? error.message : 'Failed to clear the removal block. Confirm your account has docker:manage access.';
+      notificationStore.error(message, 8000);
+    }
+  };
+
+  const handleCopyAllowCommand = async (hostId: string, label: string) => {
+    const command = getAllowReenrollCommand(hostId);
+    const copied = await copyToClipboard(command);
+    if (copied) {
+      notificationStore.success(`Command copied for ${label}`, 3500);
+    } else {
+      notificationStore.error('Copy failed. You can still manually copy the snippet.', 4000);
+    }
+  };
+
   const isRemovingHost = (hostId: string) => removingHostId() === hostId;
 
   const openRemoveModal = (host: DockerHost) => {
@@ -301,6 +429,7 @@ WantedBy=multi-user.target`;
     setRemoveActionLoading(null);
     setShowAdvancedOptions(false);
     setShowRemoveModal(true);
+    setHasShownCommandCompletion(false);
   };
 
   const closeRemoveModal = () => {
@@ -309,6 +438,7 @@ WantedBy=multi-user.target`;
     setUninstallCommandCopied(false);
     setRemoveActionLoading(null);
     setShowAdvancedOptions(false);
+    setHasShownCommandCompletion(false);
   };
 
   const handleQueueStopCommand = async () => {
@@ -322,19 +452,20 @@ WantedBy=multi-user.target`;
     try {
       await MonitoringAPI.deleteDockerHost(host.id);
       notificationStore.success(`Stop command sent to ${displayName}`, 3500);
+      setRemoveActionLoading('awaitingCommand');
     } catch (error) {
       console.error('Failed to queue Docker host stop command', error);
       const message = error instanceof Error ? error.message : 'Failed to send stop command';
       notificationStore.error(message, 8000);
+      setRemoveActionLoading(null);
     } finally {
       setRemovingHostId(null);
-      setRemoveActionLoading(null);
     }
   };
 
   const handleHideHostFromModal = async () => {
     const host = hostToRemove();
-    if (!host || removeActionLoading()) return;
+    if (!host || (removeActionLoading() && removeActionLoading() !== 'awaitingCommand')) return;
 
     const displayName = getDisplayName(host);
     setRemovingHostId(host.id);
@@ -356,7 +487,7 @@ WantedBy=multi-user.target`;
 
   const handleRemoveHostNow = async () => {
     const host = hostToRemove();
-    if (!host || removeActionLoading()) return;
+    if (!host || (removeActionLoading() && removeActionLoading() !== 'awaitingCommand')) return;
 
     const displayName = getDisplayName(host);
     setRemovingHostId(host.id);
@@ -415,6 +546,62 @@ WantedBy=multi-user.target`;
 
   return (
     <div class="space-y-6">
+      <Show when={hasRemovedHosts()}>
+        <Card
+          padding="lg"
+          class="space-y-4 border border-amber-300 bg-amber-50 text-amber-900 shadow-sm dark:border-amber-500/40 dark:bg-amber-500/10 dark:text-amber-100"
+        >
+          <div class="space-y-1">
+            <h3 class="text-sm font-semibold">Recently removed Docker hosts</h3>
+            <p class="text-sm text-amber-800 dark:text-amber-200">
+              Pulse is currently blocking these hosts because they were explicitly removed. Allow them to re-enroll or
+              copy the command below and run it with a token that includes the <code>docker:manage</code> scope.
+            </p>
+          </div>
+
+          <div class="space-y-3">
+            <For each={removedHosts()}>
+              {(entry) => {
+                const label = entry.displayName || entry.hostname || entry.id;
+                return (
+                  <div class="rounded-lg border border-amber-200 bg-white/80 p-4 shadow-sm dark:border-amber-500/40 dark:bg-amber-950/20">
+                    <div class="flex flex-col gap-1 sm:flex-row sm:items-center sm:justify-between">
+                      <div>
+                        <p class="text-sm font-semibold text-gray-900 dark:text-gray-100">{label}</p>
+                        <p class="text-xs text-gray-500 dark:text-gray-400">Host ID: {entry.id}</p>
+                      </div>
+                      <div class="text-xs text-gray-500 dark:text-gray-400">
+                        Removed {formatRelativeTime(entry.removedAt)}
+                      </div>
+                    </div>
+
+                    <div class="mt-3 flex flex-wrap gap-2">
+                      <button
+                        type="button"
+                        onClick={() => handleAllowReenroll(entry.id, label)}
+                        class="inline-flex items-center justify-center gap-2 rounded-md bg-emerald-600 px-3 py-1.5 text-xs font-medium text-white transition hover:bg-emerald-700 focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-1 dark:focus:ring-offset-gray-900"
+                      >
+                        Allow re-enroll
+                      </button>
+                      <button
+                        type="button"
+                        onClick={() => handleCopyAllowCommand(entry.id, label)}
+                        class="inline-flex items-center justify-center gap-2 rounded-md border border-emerald-600/50 px-3 py-1.5 text-xs font-medium text-emerald-700 transition hover:bg-emerald-50 focus:outline-none focus:ring-2 focus:ring-emerald-500 focus:ring-offset-1 dark:border-emerald-400/60 dark:text-emerald-200 dark:hover:bg-emerald-500/20 dark:focus:ring-offset-gray-900"
+                      >
+                        Copy curl command
+                      </button>
+                    </div>
+                  </div>
+                );
+              }}
+            </For>
+            <p class="text-xs text-amber-800 dark:text-amber-200">
+              If you removed a host intentionally, you can simply ignore it—entries expire automatically after 24 hours.
+            </p>
+          </div>
+        </Card>
+      </Show>
+
         <Card padding="lg" class="space-y-5">
           <div class="space-y-1">
             <h3 class="text-base font-semibold text-gray-900 dark:text-gray-100">Add a Docker host</h3>
@@ -631,7 +818,12 @@ WantedBy=multi-user.target`;
                     <button
                       type="button"
                       onClick={handleQueueStopCommand}
-                      disabled={removeActionLoading() !== null || modalCommandInProgress() || modalCommandStatus() === 'completed'}
+                      disabled={
+                        removeActionLoading() !== null ||
+                        modalCommandInProgress() ||
+                        modalCommandStatus() === 'completed' ||
+                        (modalHostPendingUninstall() && !modalHasCommand())
+                      }
                       class={`inline-flex items-center justify-center rounded px-4 py-2 text-sm font-medium text-white transition-colors ${
                         modalCommandStatus() === 'completed'
                           ? 'bg-emerald-600 dark:bg-emerald-500'
@@ -640,61 +832,110 @@ WantedBy=multi-user.target`;
                     >
                       {(() => {
                         if (removeActionLoading() === 'queue') return 'Sending…';
+                        if (removeActionLoading() === 'awaitingCommand') return 'Waiting for agent…';
                         if (modalCommandInProgress()) return 'Waiting for agent…';
                         if (modalCommandStatus() === 'completed') return 'Agent stopped';
+                        if (!modalHasCommand() && modalHostPendingUninstall()) return 'Waiting for host…';
                         if (modalCommandFailed()) return 'Retry stop command';
                         return 'Stop agent now';
                       })()}
                     </button>
-                    <Show when={modalCommandInProgress()}>
-                      <div class="space-y-3">
-                        {/* Progress steps */}
-                        <div class="rounded border border-blue-200 bg-white p-3 dark:border-blue-700 dark:bg-blue-800/20">
-                          <div class="mb-2 flex items-center justify-between">
-                            <span class="text-xs font-semibold uppercase tracking-wide text-blue-700 dark:text-blue-300">Progress</span>
-                            <span class="text-xs text-blue-600 dark:text-blue-400">{formatElapsedTime(elapsedSeconds())} elapsed</span>
-                          </div>
-                          <ul class="space-y-1.5">
-                            <For each={modalCommandProgress()}>
-                              {(step) => (
-                                <li
-                                  class={`${step.done || step.active ? 'text-blue-700 dark:text-blue-200' : 'text-gray-500 dark:text-gray-400'} flex items-center gap-2 text-xs`}
-                                >
-                                  <span
-                                    class={`h-2 w-2 flex-shrink-0 rounded-full ${
-                                      step.done
-                                        ? 'bg-blue-500'
-                                        : step.active
-                                          ? 'bg-blue-400 animate-pulse'
-                                          : 'bg-gray-300 dark:bg-gray-600'
-                                    }`}
-                                  />
-                                  {step.label}
-                                </li>
-                              )}
-                            </For>
-                          </ul>
-                        </div>
-
-                        {/* Expected time and last heartbeat */}
-                        <div class="flex items-start gap-2 text-xs text-blue-700 dark:text-blue-300">
-                          <svg class="w-4 h-4 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <Show
+                      when={
+                        removeActionLoading() === 'awaitingCommand' &&
+                        !modalHasCommand() &&
+                        !modalHostPendingUninstall()
+                      }
+                    >
+                      <div class="rounded border border-blue-200 bg-white p-3 dark:border-blue-700 dark:bg-blue-800/20">
+                        <div class="flex items-start gap-2 text-xs text-blue-700 dark:text-blue-200">
+                          <svg class="mt-0.5 h-4 w-4 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
                             <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
                           </svg>
                           <div>
-                            <p>
-                              <Show when={!modalCommandTimedOut()} fallback="This is taking longer than expected.">
-                                This usually takes 30-60 seconds.
-                              </Show>
-                              <Show when={modalLastHeartbeat()}>
-                                {' '}Last heartbeat: {modalLastHeartbeat()}.
-                              </Show>
+                            <p class="font-semibold">Stop command sent.</p>
+                            <p class="mt-1 leading-snug">
+                              Pulse is waiting for <span class="font-medium">{modalHostname()}</span> to pick up the shutdown instruction. This usually finishes within 30-60 seconds.
                             </p>
                           </div>
                         </div>
+                      </div>
+                    </Show>
+                    <Show
+                      when={
+                        modalCommandInProgress() ||
+                        modalCommandCompleted() ||
+                        (!modalHasCommand() && modalHostPendingUninstall())
+                      }
+                    >
+                      <div class="space-y-3">
+                        <Show when={modalHasCommand()}>
+                          <div class="rounded border border-blue-200 bg-white p-3 dark:border-blue-700 dark:bg-blue-800/20">
+                            <div class="mb-2 flex items-center justify-between">
+                              <span class="text-xs font-semibold uppercase tracking-wide text-blue-700 dark:text-blue-300">Progress</span>
+                              <Show
+                                when={!modalCommandCompleted()}
+                                fallback={<span class="text-xs font-semibold text-emerald-600 dark:text-emerald-300">Completed</span>}
+                              >
+                                <span class="text-xs text-blue-600 dark:text-blue-400">{formatElapsedTime(elapsedSeconds())} elapsed</span>
+                              </Show>
+                            </div>
+                            <ul class="space-y-1.5">
+                              <For each={modalCommandProgress()}>
+                                {(step) => (
+                                  <li
+                                    class={`${step.done || step.active ? 'text-blue-700 dark:text-blue-200' : 'text-gray-500 dark:text-gray-400'} flex items-center gap-2 text-xs`}
+                                  >
+                                    <span
+                                      class={`relative h-2 w-2 flex-shrink-0 rounded-full ${
+                                        step.done
+                                          ? 'bg-blue-500'
+                                          : step.active
+                                            ? 'bg-blue-400 animate-pulse'
+                                            : 'bg-gray-300 dark:bg-gray-600'
+                                      } ${modalCommandCompleted() && step.done ? 'after:absolute after:-inset-1 after:rounded-full after:border after:border-emerald-400/40 after:animate-pulse' : ''}`}
+                                    />
+                                    {step.label}
+                                  </li>
+                                )}
+                              </For>
+                            </ul>
+                          </div>
+                        </Show>
 
-                        {/* Timeout warning */}
-                        <Show when={modalCommandTimedOut()}>
+                        <Show when={!modalHasCommand() && modalHostPendingUninstall()}>
+                          <div class="rounded border border-blue-200 bg-white p-3 text-xs text-blue-700 dark:border-blue-700 dark:bg-blue-800/20 dark:text-blue-200">
+                            <p class="font-semibold">Agent already stopped.</p>
+                            <p class="mt-1 leading-snug">
+                              Pulse is waiting for <span class="font-medium">{modalHostname()}</span> to miss its next heartbeat so the host can be removed automatically. No further action is required—this usually finishes within 60 seconds.
+                            </p>
+                            <Show when={modalLastHeartbeat()}>
+                              <p class="mt-2 text-[11px]">
+                                Last heartbeat: {modalLastHeartbeat()}. Pulse will clear the entry after the next missed report.
+                              </p>
+                            </Show>
+                          </div>
+                        </Show>
+
+                        <Show when={modalHasCommand() && !modalCommandCompleted()}>
+                          <div class="flex items-start gap-2 text-xs text-blue-700 dark:text-blue-300">
+                            <svg class="w-4 h-4 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                              <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
+                            </svg>
+                            <div>
+                              <p>
+                                <Show when={!modalCommandTimedOut()} fallback="This is taking longer than expected.">
+                                  This usually takes 30-60 seconds.
+                                </Show>
+                                <Show when={modalLastHeartbeat()}>
+                                  {' '}Last heartbeat: {modalLastHeartbeat()}.
+                                </Show>
+                              </p>
+                            </div>
+                          </div>
+                        </Show>
+
+                        <Show when={modalHasCommand() && modalCommandTimedOut() && !modalCommandCompleted()}>
                           <div class="rounded border border-yellow-200 bg-yellow-50 p-3 dark:border-yellow-700 dark:bg-yellow-900/20">
                             <div class="flex items-start gap-2">
                               <svg class="w-4 h-4 mt-0.5 flex-shrink-0 text-yellow-600 dark:text-yellow-400" fill="none" viewBox="0 0 24 24" stroke="currentColor">
@@ -747,13 +988,13 @@ WantedBy=multi-user.target`;
                                   class={`${step.done || step.active ? 'text-blue-700 dark:text-blue-200' : 'text-gray-500 dark:text-gray-400'} flex items-center gap-2`}
                                 >
                                   <span
-                                    class={`h-2 w-2 rounded-full ${
+                                    class={`relative h-2 w-2 rounded-full ${
                                       step.done
                                         ? 'bg-blue-500'
                                         : step.active
                                           ? 'bg-blue-400 animate-pulse'
                                           : 'bg-gray-300 dark:bg-gray-600'
-                                    }`}
+                                    } ${modalCommandCompleted() && step.done ? 'after:absolute after:-inset-1 after:rounded-full after:border after:border-emerald-400/40 after:animate-pulse' : ''}`}
                                   />
                                   {step.label}
                                 </li>
@@ -790,7 +1031,7 @@ WantedBy=multi-user.target`;
                     <button
                       type="button"
                       onClick={handleRemoveHostNow}
-                      disabled={removeActionLoading() !== null}
+                      disabled={removeActionLoading() !== null && removeActionLoading() !== 'awaitingCommand'}
                       class="self-start rounded bg-orange-600 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-orange-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-orange-500 dark:hover:bg-orange-400 whitespace-nowrap"
                     >
                       {removeActionLoading() === 'force' ? 'Removing…' : 'Force remove now'}
@@ -811,7 +1052,7 @@ WantedBy=multi-user.target`;
                     <button
                       type="button"
                       onClick={handleRemoveHostNow}
-                      disabled={removeActionLoading() !== null}
+                      disabled={removeActionLoading() !== null && removeActionLoading() !== 'awaitingCommand'}
                       class="self-start rounded bg-emerald-600 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-emerald-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-emerald-500 dark:hover:bg-emerald-400"
                     >
                       {removeActionLoading() === 'force' ? 'Removing…' : 'Remove host'}
@@ -877,7 +1118,7 @@ WantedBy=multi-user.target`;
                       <button
                         type="button"
                         onClick={handleRemoveHostNow}
-                        disabled={removeActionLoading() !== null}
+                        disabled={removeActionLoading() !== null && removeActionLoading() !== 'awaitingCommand'}
                         class="self-start rounded bg-red-600 px-3 py-1.5 text-xs font-semibold text-white transition-colors hover:bg-red-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-red-500 dark:hover:bg-red-400"
                       >
                         {removeActionLoading() === 'force' ? 'Removing…' : 'Force remove now'}
@@ -896,7 +1137,7 @@ WantedBy=multi-user.target`;
                       <button
                         type="button"
                         onClick={handleHideHostFromModal}
-                        disabled={removeActionLoading() !== null || modalHostHidden()}
+                        disabled={(removeActionLoading() !== null && removeActionLoading() !== 'awaitingCommand') || modalHostHidden()}
                         class="self-start rounded bg-gray-200 px-3 py-1.5 text-xs font-medium text-gray-800 transition-colors hover:bg-gray-300 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-gray-700 dark:text-gray-200 dark:hover:bg-gray-600"
                       >
                         {removeActionLoading() === 'hide' ? 'Hiding...' : modalHostHidden() ? 'Already hidden' : 'Hide host'}
@@ -930,13 +1171,75 @@ WantedBy=multi-user.target`;
                 <svg class="w-5 h-5 text-yellow-600 dark:text-yellow-400 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
                   <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M12 8v4l3 3m6-3a9 9 0 11-18 0 9 9 0 0118 0z" />
                 </svg>
-                <div class="flex-1">
-                  <h4 class="text-sm font-semibold text-yellow-900 dark:text-yellow-100">
-                    Stopping {pendingHosts().length} host{pendingHosts().length !== 1 ? 's' : ''}
-                  </h4>
-                  <p class="mt-1 text-sm text-yellow-800 dark:text-yellow-200">
-                    Pulse has sent the stop command. Once an agent acknowledges (or goes offline), the entry will disappear automatically.
-                  </p>
+                <div class="flex-1 space-y-3">
+                  <div>
+                    <h4 class="text-sm font-semibold text-yellow-900 dark:text-yellow-100">
+                      Stopping {pendingHosts().length} host{pendingHosts().length !== 1 ? 's' : ''}
+                    </h4>
+                    <p class="mt-1 text-sm text-yellow-800 dark:text-yellow-200">
+                      Pulse has the stop command in flight. You can keep working—these hosts will disappear automatically once the agent shuts down or misses its next heartbeat.
+                    </p>
+                  </div>
+
+                  <div class="space-y-2">
+                    <For each={pendingHosts()}>
+                      {(host) => {
+                        const label = getDisplayName(host);
+                        const statusInfo = getRemovalStatusInfo(host) ?? {
+                          label: 'Marked for uninstall; waiting for agent confirmation.',
+                          tone: 'info' as RemovalStatusTone,
+                        };
+                        const status = host.command?.status ?? (host.pendingUninstall ? 'pending' : 'unknown');
+                        const isOnline = host.status?.toLowerCase() === 'online';
+                        const lastSeenLabel = host.lastSeen ? formatRelativeTime(host.lastSeen) : 'Awaiting first report';
+                        const badgeText =
+                          status === 'completed'
+                            ? 'Agent stopped'
+                            : status === 'acknowledged'
+                              ? 'Acknowledged'
+                              : status === 'dispatched'
+                                ? 'Dispatched'
+                                : status === 'queued'
+                                  ? 'Queued'
+                                  : 'Pending';
+
+                        return (
+                          <div class="rounded-lg border border-yellow-200 bg-white/80 p-3 shadow-sm dark:border-yellow-700/40 dark:bg-yellow-900/20">
+                            <div class="flex flex-col gap-2 sm:flex-row sm:items-start sm:justify-between">
+                              <div>
+                                <p class="text-sm font-semibold text-gray-900 dark:text-gray-100">{label}</p>
+                                <p class="text-xs text-gray-500 dark:text-gray-400">{host.hostname || host.id}</p>
+                                <span class={removalBadgeClassMap[statusInfo.tone]}>{badgeText}</span>
+                              </div>
+                              <div class="text-[11px] text-gray-500 dark:text-gray-400 sm:text-right">
+                                Last seen {lastSeenLabel}
+                              </div>
+                            </div>
+                            <p class={`mt-2 text-xs ${removalTextClassMap[statusInfo.tone]}`}>{statusInfo.label}</p>
+                            <div class="mt-3 flex flex-col gap-2 sm:flex-row sm:items-center sm:gap-3">
+                              <button
+                                type="button"
+                                class="inline-flex items-center justify-center gap-2 rounded bg-blue-600 px-3 py-1.5 text-xs font-semibold text-white transition-colors hover:bg-blue-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-blue-500 dark:hover:bg-blue-400"
+                                onClick={() => openRemoveModal(host)}
+                              >
+                                View progress
+                              </button>
+                              <Show when={!isOnline || status === 'failed' || status === 'expired'}>
+                                <button
+                                  type="button"
+                                  class="inline-flex items-center justify-center gap-2 rounded border border-blue-500/40 px-3 py-1.5 text-xs font-medium text-blue-700 transition-colors hover:bg-blue-50 dark:border-blue-400/40 dark:text-blue-200 dark:hover:bg-blue-500/20"
+                                  onClick={() => handleCleanupOfflineHost(host.id, label)}
+                                  disabled={isRemovingHost(host.id)}
+                                >
+                                  {isRemovingHost(host.id) ? 'Cleaning up…' : 'Force remove now'}
+                                </button>
+                              </Show>
+                            </div>
+                          </div>
+                        );
+                      }}
+                    </For>
+                  </div>
                 </div>
               </div>
             </div>
@@ -1013,17 +1316,21 @@ WantedBy=multi-user.target`;
                       const isOnline = host.status?.toLowerCase() === 'online';
                       const displayName = getDisplayName(host);
                       const commandStatus = host.command?.status ?? null;
+                      const removalStatusInfo = getRemovalStatusInfo(host);
                       const commandInProgress =
                         commandStatus === 'queued' ||
                         commandStatus === 'dispatched' ||
                         commandStatus === 'acknowledged';
                       const commandFailed = commandStatus === 'failed';
                       const commandCompleted = commandStatus === 'completed';
-                      const offlineActionLabel = commandFailed
-                        ? 'Force remove host'
-                        : host.pendingUninstall
-                          ? 'Clean up pending host'
-                          : 'Remove offline host';
+                      const offlineActionLabel =
+                        commandFailed || commandStatus === 'expired'
+                          ? 'Force remove host'
+                          : removalStatusInfo?.tone === 'success'
+                            ? 'Remove host'
+                            : host.pendingUninstall
+                              ? 'Skip wait and remove now'
+                              : 'Remove offline host';
                       const tokenRevoked = typeof host.tokenRevokedAt === 'number';
                       const tokenRevokedRelative = tokenRevoked ? formatRelativeTime(host.tokenRevokedAt!) : '';
 
@@ -1088,12 +1395,14 @@ WantedBy=multi-user.target`;
                                 </span>
                               </Show>
                             </div>
-                            <Show when={host.pendingUninstall}>
-                              <div class="mt-2 text-xs text-gray-500 dark:text-gray-400">
-                                Stop command queued; waiting for acknowledgement.
-                              </div>
+                            <Show when={removalStatusInfo}>
+                              {(info) => (
+                                <div class={`mt-2 text-xs ${removalTextClassMap[info.tone]}`}>
+                                  {info.label}
+                                </div>
+                              )}
                             </Show>
-                          </td>
+                         </td>
                           <td class="py-3 px-4 align-top">
                             <div class="text-sm font-medium text-gray-900 dark:text-gray-100">
                               {host.dockerVersion ? `Docker ${host.dockerVersion}` : 'Docker version unavailable'}
diff --git a/frontend-modern/src/components/Settings/HostAgents.tsx b/frontend-modern/src/components/Settings/HostAgents.tsx
index adbfe71..4d8e3e7 100644
--- a/frontend-modern/src/components/Settings/HostAgents.tsx
+++ b/frontend-modern/src/components/Settings/HostAgents.tsx
@@ -94,6 +94,25 @@ const commandsByPlatform: Record<
   },
 };
 
+const computeHostStaleness = (host: Host) => {
+  const intervalSeconds = host.intervalSeconds && host.intervalSeconds > 0 ? host.intervalSeconds : 30;
+  const staleThresholdMs = Math.max(intervalSeconds * 1000 * 3, 60_000);
+  const lastSeenValue =
+    typeof host.lastSeen === 'number'
+      ? host.lastSeen
+      : Number.isFinite(Number(host.lastSeen))
+        ? Number(host.lastSeen)
+        : NaN;
+  const lastSeenMs = Number.isFinite(lastSeenValue) ? lastSeenValue : null;
+  const isStale = lastSeenMs === null ? true : Date.now() - lastSeenMs >= staleThresholdMs;
+
+  return {
+    isStale,
+    lastSeenMs,
+    staleThresholdMs,
+  };
+};
+
 export const HostAgents: Component = () => {
   const { state } = useWebSocket();
 
@@ -111,6 +130,13 @@ export const HostAgents: Component = () => {
   const [lookupLoading, setLookupLoading] = createSignal(false);
   const [highlightedHostId, setHighlightedHostId] = createSignal<string | null>(null);
   let highlightTimer: ReturnType<typeof setTimeout> | null = null;
+  const [showRemoveModal, setShowRemoveModal] = createSignal(false);
+  const [hostToRemoveId, setHostToRemoveId] = createSignal<string | null>(null);
+  const [removeActionLoading, setRemoveActionLoading] = createSignal<'remove' | null>(null);
+  const [uninstallCommandCopied, setUninstallCommandCopied] = createSignal(false);
+  const [uninstallCommandCopiedAt, setUninstallCommandCopiedAt] = createSignal<number | null>(null);
+  const [hostRemovalCountdownSeconds, setHostRemovalCountdownSeconds] = createSignal<number | null>(null);
+  const [uninstallConfirmed, setUninstallConfirmed] = createSignal(false);
 
   createEffect(() => {
     if (requiresToken()) {
@@ -146,6 +172,129 @@ export const HostAgents: Component = () => {
     return value === 'online' || value === 'running' || value === 'healthy';
   };
 
+  const hostToRemove = createMemo(() => {
+    const id = hostToRemoveId();
+    if (!id) return null;
+    return allHosts().find((host) => host.id === id) ?? null;
+  });
+
+  const hostRemovalDisplayName = () => {
+    const host = hostToRemove();
+    return host ? host.displayName || host.hostname || host.id : '';
+  };
+
+  const hostRemovalPlatform = createMemo(() => hostToRemove()?.platform?.toLowerCase() || '');
+  const hostRemovalStatus = createMemo(() => {
+    const host = hostToRemove();
+    return (host?.status || 'unknown').toLowerCase();
+  });
+
+  const hostRemovalStatusLabel = () => hostToRemove()?.status || 'unknown';
+
+  const hostRemovalIsOnline = createMemo(() => {
+    const status = hostRemovalStatus();
+    return status === 'online' || status === 'running' || status === 'healthy';
+  });
+
+  const hostRemovalStaleness = createMemo(() => {
+    const host = hostToRemove();
+    if (!host) {
+      return { isStale: false, lastSeenMs: null as number | null, staleThresholdMs: 90_000 };
+    }
+    return computeHostStaleness(host);
+  });
+
+  const hostRemovalIsStale = createMemo(() => hostRemovalStaleness().isStale);
+
+  const hostRemovalLastSeen = createMemo(() => {
+    const { lastSeenMs } = hostRemovalStaleness();
+    if (!lastSeenMs) return null;
+    return {
+      relative: formatRelativeTime(lastSeenMs),
+      absolute: formatAbsoluteTime(lastSeenMs),
+    };
+  });
+
+  const hostRemovalStaleThresholdSeconds = createMemo(() => {
+    const threshold = hostRemovalStaleness().staleThresholdMs;
+    return Math.max(Math.round(threshold / 1000), 0);
+  });
+
+  const hostRemovalUninstallCommand = createMemo(() => getHostUninstallCommand(hostToRemove()));
+
+  const hostRemovalUninstallNote = () => {
+    const platform = hostRemovalPlatform();
+    if (platform === 'macos' || platform === 'darwin' || platform === 'mac') {
+      return 'Unloads the launch agent, removes the plist, deletes the binary, and clears the local log.';
+    }
+    if (platform === 'windows' || platform === 'win32' || platform === 'windows_nt') {
+      return 'Stops the Windows service, removes it, and deletes the installed binary and log. Run from an elevated PowerShell window.';
+    }
+    return 'Stops the agent, removes the systemd unit, deletes the binary, and reloads systemd.';
+  };
+
+  const formatCountdown = (seconds: number | null) => {
+    if (seconds === null || seconds < 0) return null;
+    if (seconds === 0) return 'any moment now';
+    const mins = Math.floor(seconds / 60);
+    const secs = seconds % 60;
+    if (mins <= 0) {
+      return `${secs}s`;
+    }
+    if (secs === 0) {
+      return `${mins}m`;
+    }
+    return `${mins}m ${secs}s`;
+  };
+
+  const countdownLabel = createMemo(() => formatCountdown(hostRemovalCountdownSeconds()));
+
+  const canRemoveHost = createMemo(() => uninstallCommandCopied() && uninstallConfirmed());
+
+  const openRemoveModal = (host: Host) => {
+    setHostToRemoveId(host.id);
+    setShowRemoveModal(true);
+    setRemoveActionLoading(null);
+    setUninstallCommandCopied(false);
+    setUninstallCommandCopiedAt(null);
+    setHostRemovalCountdownSeconds(null);
+    setUninstallConfirmed(false);
+  };
+
+  const closeRemoveModal = () => {
+    setShowRemoveModal(false);
+    setHostToRemoveId(null);
+    setRemoveActionLoading(null);
+    setUninstallCommandCopied(false);
+    setUninstallCommandCopiedAt(null);
+    setHostRemovalCountdownSeconds(null);
+    setUninstallConfirmed(false);
+  };
+
+  const performHostRemoval = async () => {
+    const host = hostToRemove();
+    if (!host || removeActionLoading()) return;
+
+    setRemoveActionLoading('remove');
+    const displayName = host.displayName || host.hostname || host.id;
+
+    try {
+      await MonitoringAPI.deleteHostAgent(host.id);
+      notificationStore.success(`Host "${displayName}" removed`, 4000);
+      closeRemoveModal();
+    } catch (error) {
+      console.error('Failed to remove host agent', error);
+      const message = error instanceof Error ? error.message : 'Failed to remove host. Please try again.';
+      notificationStore.error(message, 6000);
+    } finally {
+      setRemoveActionLoading(null);
+    }
+  };
+
+  const handleRemoveHost = () => {
+    void performHostRemoval();
+  };
+
   createEffect(() => {
     const current = lookupResult();
     if (!current) return;
@@ -196,6 +345,48 @@ export const HostAgents: Component = () => {
     setLookupError(null);
   });
 
+  createEffect(() => {
+    if (!showRemoveModal()) return;
+    const id = hostToRemoveId();
+    const host = hostToRemove();
+    if (id && !host) {
+      closeRemoveModal();
+    }
+  });
+
+  createEffect(() => {
+    if (!showRemoveModal()) {
+      setHostRemovalCountdownSeconds(null);
+      return;
+    }
+
+    const updateCountdown = () => {
+      const host = hostToRemove();
+      if (!host) {
+        setHostRemovalCountdownSeconds(null);
+        return;
+      }
+
+      const { lastSeenMs, staleThresholdMs } = computeHostStaleness(host);
+      if (!lastSeenMs) {
+        setHostRemovalCountdownSeconds(null);
+        return;
+      }
+
+      const elapsed = Date.now() - lastSeenMs;
+      const remaining = staleThresholdMs - elapsed;
+      setHostRemovalCountdownSeconds(remaining > 0 ? Math.ceil(remaining / 1000) : 0);
+    };
+
+    updateCountdown();
+    const interval = setInterval(updateCountdown, 1000);
+
+    return () => {
+      clearInterval(interval);
+      setHostRemovalCountdownSeconds(null);
+    };
+  });
+
   onMount(() => {
     if (typeof window === 'undefined') {
       return;
@@ -348,12 +539,30 @@ User=root
 [Install]
 WantedBy=multi-user.target`;
 
-  const getManualUninstallCommand = () =>
-    `sudo systemctl stop pulse-host-agent && \\
+  function getManualUninstallCommand(): string {
+    return `sudo systemctl stop pulse-host-agent && \\
 sudo systemctl disable pulse-host-agent && \\
 sudo rm -f /etc/systemd/system/pulse-host-agent.service && \\
 sudo rm -f /usr/local/bin/pulse-host-agent && \\
 sudo systemctl daemon-reload`;
+  }
+
+  function getHostUninstallCommand(host: Host | null): string {
+    const platform = host?.platform?.toLowerCase();
+    if (platform === 'macos' || platform === 'darwin' || platform === 'mac') {
+      return `launchctl unload ~/Library/LaunchAgents/com.pulse.host-agent.plist >/dev/null 2>&1 || true && \\
+rm -f ~/Library/LaunchAgents/com.pulse.host-agent.plist && \\
+sudo rm -f /usr/local/bin/pulse-host-agent && \\
+rm -f ~/Library/Logs/pulse-host-agent.log`;
+    }
+    if (platform === 'windows' || platform === 'win32' || platform === 'windows_nt') {
+      return `Stop-Service -Name PulseHostAgent -ErrorAction SilentlyContinue; \\
+sc.exe delete PulseHostAgent; \\
+Remove-Item 'C:\\\\Program Files\\\\Pulse\\\\pulse-host-agent.exe' -Force -ErrorAction SilentlyContinue; \\
+Remove-Item '$env:ProgramData\\\\Pulse\\\\pulse-host-agent.log' -Force -ErrorAction SilentlyContinue`;
+    }
+    return getManualUninstallCommand();
+  }
 
   return (
     <div class="space-y-6">
@@ -697,22 +906,15 @@ sudo systemctl daemon-reload`;
                 <tbody class="divide-y divide-gray-200 dark:divide-gray-700">
                   <For each={allHosts()}>
                     {(host) => {
-                      const [isDeleting, setIsDeleting] = createSignal(false);
+                      const staleness = computeHostStaleness(host);
+                      const isStale = staleness.isStale;
                       const tokenRevokedAt = host.tokenRevokedAt;
                       const tokenRevoked = typeof tokenRevokedAt === 'number';
-                      const lastSeenMs = host.lastSeen ? new Date(host.lastSeen).getTime() : null;
-                      const expectedIntervalMs =
-                        (host.intervalSeconds && host.intervalSeconds > 0 ? host.intervalSeconds : 30) * 1000;
-                      const staleThresholdMs = Math.max(expectedIntervalMs * 3, 60_000);
-                      const isStale =
-                        lastSeenMs === null || Date.now() - lastSeenMs >= staleThresholdMs;
-
                       const status = (host.status || 'unknown').toLowerCase();
                       const isOnline =
-                        status === 'online' ||
-                        status === 'running' ||
-                        status === 'healthy';
+                        status === 'online' || status === 'running' || status === 'healthy';
                       const isHighlighted = highlightedHostId() === host.id;
+                      const isRemovingThisHost = hostToRemoveId() === host.id && removeActionLoading() !== null;
 
                       const baseRowClass = isStale
                         ? 'bg-gray-50 dark:bg-gray-800/50 opacity-60'
@@ -724,33 +926,8 @@ sudo systemctl daemon-reload`;
                         ? 'ring-2 ring-blue-500/70 dark:ring-blue-400/70 shadow-md'
                         : '';
 
-                      const handleDelete = async () => {
-                        if (!confirm(`Remove host "${host.displayName || host.hostname || host.id}"?\n\nThis will remove the host from Pulse monitoring. The host agent will re-register if it continues to report.`)) {
-                          return;
-                        }
-
-                        setIsDeleting(true);
-                        try {
-                          const response = await fetch(`/api/agents/host/${host.id}`, {
-                            method: 'DELETE',
-                            credentials: 'include',
-                          });
-
-                          if (!response.ok) {
-                            const errorData = await response.json();
-                            throw new Error(errorData.message || 'Failed to delete host');
-                          }
-
-                          notificationStore.success(`Host "${host.displayName || host.hostname}" removed`, 4000);
-                        } catch (err) {
-                          console.error('Failed to delete host:', err);
-                          notificationStore.error(
-                            err instanceof Error ? err.message : 'Failed to delete host. Please try again.',
-                            6000,
-                          );
-                        } finally {
-                          setIsDeleting(false);
-                        }
+                      const handleRemoveClick = () => {
+                        openRemoveModal(host);
                       };
 
                       return (
@@ -828,16 +1005,16 @@ sudo systemctl daemon-reload`;
                           <td class="py-3 px-4 text-right">
                             <button
                               type="button"
-                              onClick={handleDelete}
-                              disabled={isDeleting() || !isStale}
+                              onClick={handleRemoveClick}
+                              disabled={isRemovingThisHost}
                               class="inline-flex items-center gap-1 px-2 py-1 text-xs font-medium text-red-600 dark:text-red-400 hover:bg-red-50 dark:hover:bg-red-900/20 rounded transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
                               title={
                                 isStale
                                   ? 'Remove this stale host entry from the inventory'
-                                  : 'Host is still reporting — stop the agent before removing'
+                                  : 'Host is still reporting — review the removal steps first'
                               }
                             >
-                              {isDeleting() ? (
+                              {isRemovingThisHost ? (
                                 <>
                                   <svg class="animate-spin h-3 w-3" fill="none" viewBox="0 0 24 24">
                                     <circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4" />
@@ -848,7 +1025,7 @@ sudo systemctl daemon-reload`;
                               ) : (
                                 <>
                                   <svg class="h-3 w-3" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1-1h-4a1 1 0 00-1 1v3M4 7h16" />
+                                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M19 7l-.867 12.142A2 2 0 0116.138 21H7.862a2 2 0 01-1.995-1.858L5 7m5 4v6m4-6v6m1-10V4a1 1 0 00-1 1v3M4 7h16" />
                                   </svg>
                                   <span>Remove</span>
                                 </>
@@ -865,6 +1042,181 @@ sudo systemctl daemon-reload`;
         </Show>
         </div>
       </Card>
+
+      <Show when={showRemoveModal()}>
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+          <div class="w-full max-w-2xl rounded-lg bg-white p-6 shadow-xl dark:bg-gray-800">
+            <div class="space-y-2">
+              <h3 class="text-lg font-semibold text-gray-900 dark:text-gray-100">
+                Remove host "{hostRemovalDisplayName()}"
+              </h3>
+              <p class="text-sm text-gray-600 dark:text-gray-400">
+                Walk through uninstalling the agent and cleaning up the entry in Pulse.
+              </p>
+            </div>
+
+            <div class="mt-4 space-y-4">
+              <div class="space-y-3 rounded-lg border border-blue-200 bg-blue-50 p-4 dark:border-blue-800 dark:bg-blue-900/20">
+                <div class="flex items-start gap-3">
+                  <svg class="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor">
+                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                  </svg>
+                  <div class="flex-1 space-y-2">
+                    <h4 class="text-sm font-semibold text-blue-900 dark:text-blue-100">Step 1 · Stop the agent on {hostRemovalDisplayName()}</h4>
+                    <p class="text-sm text-blue-800 dark:text-blue-200">
+                      Copy the tailored uninstall script below, run it on the host, then confirm once the command finishes. It runs silently, so no terminal output is expected.
+                    </p>
+                  </div>
+                </div>
+
+                <div class="space-y-2 rounded border border-blue-200 bg-white p-3 text-xs text-blue-800 dark:border-blue-700 dark:bg-blue-800/20 dark:text-blue-200">
+                  <div class="flex items-center justify-between gap-2">
+                    <span class="font-semibold uppercase tracking-wide text-[11px] text-blue-600 dark:text-blue-300">Manual uninstall</span>
+                    <button
+                      type="button"
+                      onClick={async () => {
+                        const command = hostRemovalUninstallCommand();
+                        if (!command) return;
+                        const success = await copyToClipboard(command);
+                        if (success) {
+                          setUninstallCommandCopied(true);
+                          setUninstallCommandCopiedAt(Date.now());
+                        }
+                        if (typeof window !== 'undefined' && window.showToast) {
+                          window.showToast(success ? 'success' : 'error', success ? 'Copied!' : 'Failed to copy');
+                        }
+                      }}
+                      class="inline-flex items-center gap-2 rounded bg-blue-600 px-3 py-1.5 text-[11px] font-semibold text-white transition-colors hover:bg-blue-700 dark:bg-blue-500 dark:hover:bg-blue-400"
+                    >
+                      <svg class="h-3 w-3" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+                        <path d="M4 4a2 2 0 012-2h5a2 2 0 012 2v2h-2V4H6v10h5v-2h2v2a2 2 0 01-2 2H6a2 2 0 01-2-2V4z" />
+                        <path d="M14.293 7.293a1 1 0 011.414 0L18 9.586l-2.293 2.293a1 1 0 01-1.414-1.415L14.586 10H9a1 1 0 110-2h5.586l-.293-.293a1 1 0 010-1.414z" />
+                      </svg>
+                      {uninstallCommandCopied() ? 'Copied' : 'Copy command'}
+                    </button>
+                  </div>
+                  <code class="block overflow-x-auto rounded bg-gray-900 px-3 py-2 font-mono text-xs text-gray-100 dark:bg-gray-950 whitespace-pre-wrap">
+                    {hostRemovalUninstallCommand()}
+                  </code>
+                  <p class="text-[11px] leading-snug">{hostRemovalUninstallNote()}</p>
+                  <Show when={uninstallCommandCopied()}>
+                    <div class="space-y-2 rounded border border-blue-200 bg-white p-3 text-[11px] text-blue-800 dark:border-blue-700 dark:bg-blue-800/20 dark:text-blue-200">
+                      <p class="font-medium">Command copied.</p>
+                      <p>This script runs silently—no CLI output is expected. Once it completes, mark it finished below.</p>
+                      <Show when={uninstallCommandCopiedAt()}>
+                        <p class="text-blue-700/80 dark:text-blue-200/80">Copied {formatRelativeTime(uninstallCommandCopiedAt()!)}.</p>
+                      </Show>
+                      <button
+                        type="button"
+                        onClick={() => setUninstallConfirmed(true)}
+                        disabled={uninstallConfirmed()}
+                        class={`inline-flex items-center gap-2 rounded ${uninstallConfirmed() ? 'bg-blue-100 text-blue-500 cursor-default' : 'bg-blue-600 text-white hover:bg-blue-700'} px-3 py-1.5 text-[11px] font-semibold transition-colors dark:${uninstallConfirmed() ? 'bg-blue-900/30 text-blue-200' : 'bg-blue-500 hover:bg-blue-400'}`}
+                      >
+                        <svg class="h-3.5 w-3.5" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+                          <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.707a1 1 0 00-1.414-1.414L9 10.172 7.707 8.879A1 1 0 006.293 10.293l2 2a1 1 0 001.414 0l3-3z" clip-rule="evenodd" />
+                        </svg>
+                        {uninstallConfirmed() ? 'Marked complete' : 'I ran this command'}
+                      </button>
+                      <Show when={!uninstallConfirmed()}>
+                        <p>Click once you have run the script on {hostRemovalDisplayName()}.</p>
+                      </Show>
+                    </div>
+                  </Show>
+                </div>
+              </div>
+
+              <div class="space-y-3 rounded-lg border border-gray-200 bg-white p-4 shadow-sm dark:border-gray-700 dark:bg-gray-900">
+                <div class="flex items-center justify-between text-xs text-gray-600 dark:text-gray-300">
+                  <span class="font-semibold uppercase tracking-wide text-[11px] text-gray-500 dark:text-gray-400">Host status</span>
+                  <span
+                    class={`inline-flex items-center gap-1 rounded-full px-2 py-0.5 text-[11px] font-semibold uppercase ${
+                      hostRemovalIsOnline()
+                        ? 'bg-emerald-100 text-emerald-700 dark:bg-emerald-900/40 dark:text-emerald-200'
+                        : 'bg-gray-200 text-gray-700 dark:bg-gray-700 dark:text-gray-200'
+                    }`}
+                  >
+                    {hostRemovalStatusLabel()}
+                  </span>
+                </div>
+                <div class="text-xs text-gray-600 dark:text-gray-300">
+                  <div class="flex items-center justify-between">
+                    <span class="font-medium">Last heartbeat</span>
+                    <span class="text-gray-700 dark:text-gray-200">
+                      {hostRemovalLastSeen()?.relative ?? 'No reports yet'}
+                    </span>
+                  </div>
+                  <Show when={hostRemovalLastSeen()}>
+                    <div class="text-[11px] text-gray-500 dark:text-gray-400 text-right">
+                      {hostRemovalLastSeen()?.absolute}
+                    </div>
+                  </Show>
+                </div>
+                <Show when={!hostRemovalIsStale()}>
+                  <div class="rounded border border-yellow-200 bg-yellow-50 p-3 text-xs text-yellow-800 dark:border-yellow-700 dark:bg-yellow-900/20 dark:text-yellow-200">
+                    <p class="font-semibold">Host still reporting</p>
+                    <p class="mt-1 leading-snug">
+                      Pulse revokes the host's API token as soon as you remove it. After the uninstall script stops the service, the next heartbeat will fail and the agent will disappear within about {hostRemovalStaleThresholdSeconds()} seconds.
+                    </p>
+                    <Show when={countdownLabel()}>
+                      <p class="mt-2 rounded bg-yellow-100/60 px-2 py-1 text-[11px] font-medium text-yellow-800 dark:bg-yellow-900/40 dark:text-yellow-100">
+                        Waiting for the next missed heartbeat ({countdownLabel()}).
+                      </p>
+                    </Show>
+                  </div>
+                </Show>
+                <Show when={hostRemovalIsStale()}>
+                  <div class="rounded border border-emerald-200 bg-emerald-50 p-3 text-xs text-emerald-800 dark:border-emerald-700 dark:bg-emerald-900/20 dark:text-emerald-200">
+                    <p class="flex items-center gap-1 font-semibold">
+                      <svg class="h-3.5 w-3.5" viewBox="0 0 20 20" fill="currentColor" aria-hidden="true">
+                        <path fill-rule="evenodd" d="M10 18a8 8 0 100-16 8 8 0 000 16zm3.707-9.707a1 1 0 00-1.414-1.414L9 10.172 7.707 8.879A1 1 0 006.293 10.293l2 2a1 1 0 001.414 0l3-3z" clip-rule="evenodd" />
+                      </svg>
+                      Host offline
+                    </p>
+                    <p class="mt-1 leading-snug">
+                      Pulse no longer receives heartbeats from {hostRemovalDisplayName()}. It’s safe to remove the entry now.
+                    </p>
+                  </div>
+                </Show>
+              </div>
+            </div>
+
+            <div class="mt-6 flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+              <button
+                type="button"
+                onClick={closeRemoveModal}
+                class="self-start rounded-lg px-4 py-2 text-sm font-medium text-gray-700 transition-colors hover:bg-gray-100 dark:text-gray-300 dark:hover:bg-gray-700"
+              >
+                Close
+              </button>
+              <Show
+                when={canRemoveHost()}
+                fallback={
+                  <div class="max-w-sm text-xs text-gray-500 dark:text-gray-400">
+                    <p class="font-semibold text-gray-600 dark:text-gray-200">Run the uninstall script and mark it complete above.</p>
+                    <p class="mt-1">Once confirmed, Pulse will enable the final removal step.</p>
+                  </div>
+                }
+              >
+                <div class="flex flex-col gap-2 sm:flex-row sm:items-center sm:gap-3">
+                  <button
+                    type="button"
+                    onClick={handleRemoveHost}
+                    disabled={removeActionLoading() !== null}
+                    class="rounded bg-red-600 px-4 py-2 text-sm font-semibold text-white transition-colors hover:bg-red-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-red-500 dark:hover:bg-red-400"
+                  >
+                    {removeActionLoading() === 'remove' ? 'Removing…' : 'Remove host'}
+                  </button>
+                  <div class="text-xs text-gray-500 dark:text-gray-400">
+                    <p>
+                      Removing a host revokes its API token so it cannot register again. With the service already uninstalled, Pulse just needs one more missed heartbeat to clear the row automatically.
+                    </p>
+                  </div>
+                </div>
+              </Show>
+            </div>
+          </div>
+        </div>
+      </Show>
     </div>
   );
 };
diff --git a/frontend-modern/src/components/Settings/Settings.tsx b/frontend-modern/src/components/Settings/Settings.tsx
index 504bb93..e96b84e 100644
--- a/frontend-modern/src/components/Settings/Settings.tsx
+++ b/frontend-modern/src/components/Settings/Settings.tsx
@@ -1,15 +1,24 @@
-import { Component, createSignal, onMount, For, Show, createEffect, createMemo, onCleanup, on } from 'solid-js';
+import {
+  Component,
+  createSignal,
+  onMount,
+  For,
+  Show,
+  createEffect,
+  createMemo,
+  onCleanup,
+  on,
+} from 'solid-js';
 import type { JSX } from 'solid-js';
 import { useNavigate, useLocation } from '@solidjs/router';
 import { useWebSocket } from '@/App';
 import { showSuccess, showError } from '@/utils/toast';
 import { copyToClipboard } from '@/utils/clipboard';
+import { clearStoredAPIToken, getStoredAPIToken, setStoredAPIToken } from '@/utils/tokenStorage';
 import {
-  clearStoredAPIToken,
-  getStoredAPIToken,
-  setStoredAPIToken,
-} from '@/utils/tokenStorage';
-import { clearApiToken as clearApiClientToken, setApiToken as setApiClientToken } from '@/utils/apiClient';
+  clearApiToken as clearApiClientToken,
+  setApiToken as setApiClientToken,
+} from '@/utils/apiClient';
 import { NodeModal } from './NodeModal';
 import { ChangePasswordModal } from './ChangePasswordModal';
 import { DockerAgents } from './DockerAgents';
@@ -187,6 +196,21 @@ interface DockerAgentDiagnostic {
   notes?: string[];
 }
 
+interface DiscoveryDiagnostic {
+  enabled: boolean;
+  configuredSubnet?: string;
+  activeSubnet?: string;
+  environmentOverride?: string;
+  subnetAllowlist?: string[];
+  subnetBlocklist?: string[];
+  scanning?: boolean;
+  scanInterval?: string;
+  lastScanStartedAt?: string;
+  lastResultTimestamp?: string;
+  lastResultServers?: number;
+  lastResultErrors?: number;
+}
+
 interface AlertsDiagnostic {
   legacyThresholdsDetected: boolean;
   legacyThresholdSources?: string[];
@@ -221,6 +245,7 @@ interface DiagnosticsData {
   apiTokens?: APITokenDiagnostic | null;
   dockerAgents?: DockerAgentDiagnostic | null;
   alerts?: AlertsDiagnostic | null;
+  discovery?: DiscoveryDiagnostic | null;
   errors: string[];
 }
 
@@ -252,11 +277,13 @@ type AgentKey = 'pve' | 'pbs' | 'pmg' | 'docker' | 'host';
 const SETTINGS_HEADER_META: Record<SettingsTab, { title: string; description: string }> = {
   proxmox: {
     title: 'Proxmox',
-    description: 'Monitor your Proxmox Virtual Environment, Backup Server, and Mail Gateway infrastructure.',
+    description:
+      'Monitor your Proxmox Virtual Environment, Backup Server, and Mail Gateway infrastructure.',
   },
   docker: {
     title: 'Docker',
-    description: 'Monitor Docker hosts, containers, images, and volumes across your infrastructure.',
+    description:
+      'Monitor Docker hosts, containers, images, and volumes across your infrastructure.',
   },
   hosts: {
     title: 'Hosts',
@@ -272,7 +299,8 @@ const SETTINGS_HEADER_META: Record<SettingsTab, { title: string; description: st
   },
   'system-updates': {
     title: 'Updates',
-    description: 'Check for updates, configure update channels, and manage automatic update checks.',
+    description:
+      'Check for updates, configure update channels, and manage automatic update checks.',
   },
   'system-backups': {
     title: 'Backup Polling',
@@ -280,7 +308,8 @@ const SETTINGS_HEADER_META: Record<SettingsTab, { title: string; description: st
   },
   api: {
     title: 'API access',
-    description: 'Generate scoped tokens and manage automation credentials for agents and integrations.',
+    description:
+      'Generate scoped tokens and manage automation credentials for agents and integrations.',
   },
   'security-overview': {
     title: 'Security Overview',
@@ -296,7 +325,8 @@ const SETTINGS_HEADER_META: Record<SettingsTab, { title: string; description: st
   },
   diagnostics: {
     title: 'Diagnostics',
-    description: 'Inspect discovery scans, connection health, and runtime metrics for troubleshooting.',
+    description:
+      'Inspect discovery scans, connection health, and runtime metrics for troubleshooting.',
   },
   updates: {
     title: 'Update History',
@@ -337,7 +367,12 @@ const Settings: Component<SettingsProps> = (props) => {
     if (path.includes('/settings/proxmox')) return 'proxmox';
     if (path.includes('/settings/agent-hub')) return 'proxmox';
     if (path.includes('/settings/docker')) return 'docker';
-    if (path.includes('/settings/hosts') || path.includes('/settings/host-agents') || path.includes('/settings/servers')) return 'hosts';
+    if (
+      path.includes('/settings/hosts') ||
+      path.includes('/settings/host-agents') ||
+      path.includes('/settings/servers')
+    )
+      return 'hosts';
     if (path.includes('/settings/system-general')) return 'system-general';
     if (path.includes('/settings/system-network')) return 'system-network';
     if (path.includes('/settings/system-updates')) return 'system-updates';
@@ -382,7 +417,9 @@ const Settings: Component<SettingsProps> = (props) => {
     return null;
   };
 
-  const [currentTab, setCurrentTab] = createSignal<SettingsTab>(deriveTabFromPath(location.pathname));
+  const [currentTab, setCurrentTab] = createSignal<SettingsTab>(
+    deriveTabFromPath(location.pathname),
+  );
   const activeTab = () => currentTab();
 
   const [selectedAgent, setSelectedAgent] = createSignal<AgentKey>('pve');
@@ -635,9 +672,13 @@ const Settings: Component<SettingsProps> = (props) => {
   const [diagnosticsData, setDiagnosticsData] = createSignal<DiagnosticsData | null>(null);
   const [runningDiagnostics, setRunningDiagnostics] = createSignal(false);
   const [proxyActionLoading, setProxyActionLoading] = createSignal<'register-nodes' | null>(null);
-  const [proxyRegisterSummary, setProxyRegisterSummary] = createSignal<ProxyRegisterNode[] | null>(null);
+  const [proxyRegisterSummary, setProxyRegisterSummary] = createSignal<ProxyRegisterNode[] | null>(
+    null,
+  );
   const [dockerActionLoading, setDockerActionLoading] = createSignal<string | null>(null);
-  const [dockerMigrationResults, setDockerMigrationResults] = createSignal<Record<string, DockerMigrationResult>>({});
+  const [dockerMigrationResults, setDockerMigrationResults] = createSignal<
+    Record<string, DockerMigrationResult>
+  >({});
 
   // Security
   const [securityStatus, setSecurityStatus] = createSignal<SecurityStatusInfo | null>(null);
@@ -685,6 +726,28 @@ const Settings: Component<SettingsProps> = (props) => {
     return new Date(timestamp).toLocaleString();
   };
 
+  const formatIsoDateTime = (iso?: string) => {
+    if (!iso) {
+      return '';
+    }
+    const timestamp = Date.parse(iso);
+    if (Number.isNaN(timestamp)) {
+      return '';
+    }
+    return new Date(timestamp).toLocaleString();
+  };
+
+  const formatIsoRelativeTime = (iso?: string) => {
+    if (!iso) {
+      return '';
+    }
+    const timestamp = Date.parse(iso);
+    if (Number.isNaN(timestamp)) {
+      return '';
+    }
+    return formatRelativeTime(timestamp);
+  };
+
   const formatUptime = (seconds: number) => {
     if (!seconds || seconds <= 0) {
       return 'Unknown';
@@ -729,7 +792,8 @@ const Settings: Component<SettingsProps> = (props) => {
       });
       const data = await response.json().catch(() => null);
       if (!response.ok || !data || data.success !== true) {
-        const message = data && typeof data.message === 'string' ? data.message : 'Failed to query proxy nodes';
+        const message =
+          data && typeof data.message === 'string' ? data.message : 'Failed to query proxy nodes';
         showError(message);
         return;
       }
@@ -764,7 +828,10 @@ const Settings: Component<SettingsProps> = (props) => {
       });
       const data = await response.json().catch(() => null);
       if (!response.ok || !data || data.success !== true) {
-        const message = data && typeof data.message === 'string' ? data.message : 'Failed to prepare Docker token';
+        const message =
+          data && typeof data.message === 'string'
+            ? data.message
+            : 'Failed to prepare Docker token';
         showError(message);
         return;
       }
@@ -842,16 +909,32 @@ const Settings: Component<SettingsProps> = (props) => {
       label: 'Operations',
       items: [
         { id: 'api', label: 'API Tokens', icon: <ApiIcon class="w-4 h-4" /> },
-        { id: 'diagnostics', label: 'Diagnostics', icon: <Activity class="w-4 h-4" strokeWidth={2} /> },
+        {
+          id: 'diagnostics',
+          label: 'Diagnostics',
+          icon: <Activity class="w-4 h-4" strokeWidth={2} />,
+        },
       ],
     },
     {
       id: 'system',
       label: 'System',
       items: [
-        { id: 'system-general', label: 'General', icon: <Sliders class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'system-network', label: 'Network', icon: <Network class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'system-updates', label: 'Updates', icon: <RefreshCw class="w-4 h-4" strokeWidth={2} /> },
+        {
+          id: 'system-general',
+          label: 'General',
+          icon: <Sliders class="w-4 h-4" strokeWidth={2} />,
+        },
+        {
+          id: 'system-network',
+          label: 'Network',
+          icon: <Network class="w-4 h-4" strokeWidth={2} />,
+        },
+        {
+          id: 'system-updates',
+          label: 'Updates',
+          icon: <RefreshCw class="w-4 h-4" strokeWidth={2} />,
+        },
         { id: 'system-backups', label: 'Backups', icon: <Clock class="w-4 h-4" strokeWidth={2} /> },
       ],
     },
@@ -859,9 +942,21 @@ const Settings: Component<SettingsProps> = (props) => {
       id: 'security',
       label: 'Security',
       items: [
-        { id: 'security-overview', label: 'Overview', icon: <Shield class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'security-auth', label: 'Authentication', icon: <Lock class="w-4 h-4" strokeWidth={2} /> },
-        { id: 'security-sso', label: 'Single Sign-On', icon: <Key class="w-4 h-4" strokeWidth={2} /> },
+        {
+          id: 'security-overview',
+          label: 'Overview',
+          icon: <Shield class="w-4 h-4" strokeWidth={2} />,
+        },
+        {
+          id: 'security-auth',
+          label: 'Authentication',
+          icon: <Lock class="w-4 h-4" strokeWidth={2} />,
+        },
+        {
+          id: 'security-sso',
+          label: 'Single Sign-On',
+          icon: <Key class="w-4 h-4" strokeWidth={2} />,
+        },
       ],
     },
   ];
@@ -1012,12 +1107,7 @@ const Settings: Component<SettingsProps> = (props) => {
           return null;
         }
 
-        const port =
-          typeof server.port === 'number'
-            ? server.port
-            : type === 'pbs'
-            ? 8007
-            : 8006;
+        const port = typeof server.port === 'number' ? server.port : type === 'pbs' ? 8007 : 8006;
 
         return {
           ip,
@@ -1153,7 +1243,9 @@ const Settings: Component<SettingsProps> = (props) => {
           return false;
         }
         if (!isValidCIDR(trimmedDraft)) {
-          setDiscoverySubnetError('Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)');
+          setDiscoverySubnetError(
+            'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)',
+          );
           notificationStore.error('Enter valid CIDR subnet values before enabling discovery');
           return false;
         }
@@ -1215,7 +1307,9 @@ const Settings: Component<SettingsProps> = (props) => {
       return false;
     }
     if (!isValidCIDR(value)) {
-      setDiscoverySubnetError('Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)');
+      setDiscoverySubnetError(
+        'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)',
+      );
       return false;
     }
 
@@ -1305,8 +1399,7 @@ const Settings: Component<SettingsProps> = (props) => {
     }
 
     setDiscoveryMode('custom');
-    const rawDraft =
-      discoverySubnet() !== 'auto' ? discoverySubnet() : lastCustomSubnet() || '';
+    const rawDraft = discoverySubnet() !== 'auto' ? discoverySubnet() : lastCustomSubnet() || '';
     const normalizedDraft = normalizeSubnetList(rawDraft);
     setDiscoverySubnetDraft(normalizedDraft);
     setDiscoverySubnetError(undefined);
@@ -1551,8 +1644,12 @@ const Settings: Component<SettingsProps> = (props) => {
 
   const saveSettings = async () => {
     try {
-      if (activeTab() === 'system-general' || activeTab() === 'system-network' ||
-          activeTab() === 'system-updates' || activeTab() === 'system-backups') {
+      if (
+        activeTab() === 'system-general' ||
+        activeTab() === 'system-network' ||
+        activeTab() === 'system-updates' ||
+        activeTab() === 'system-backups'
+      ) {
         // Save system settings using typed API
         await SettingsAPI.updateSystemSettings({
           // PBS polling interval is now fixed at 10 seconds
@@ -1698,11 +1795,7 @@ const Settings: Component<SettingsProps> = (props) => {
     // Only check for API token if user is not authenticated via password
     // If user is logged in with password, session auth is sufficient
     const hasPasswordAuth = securityStatus()?.hasAuthentication;
-    if (
-      !hasPasswordAuth &&
-      securityStatus()?.apiTokenConfigured &&
-      !getStoredAPIToken()
-    ) {
+    if (!hasPasswordAuth && securityStatus()?.apiTokenConfigured && !getStoredAPIToken()) {
       setApiTokenModalSource('export');
       setShowApiTokenModal(true);
       return;
@@ -1803,11 +1896,7 @@ const Settings: Component<SettingsProps> = (props) => {
     // Only check for API token if user is not authenticated via password
     // If user is logged in with password, session auth is sufficient
     const hasPasswordAuth = securityStatus()?.hasAuthentication;
-    if (
-      !hasPasswordAuth &&
-      securityStatus()?.apiTokenConfigured &&
-      !getStoredAPIToken()
-    ) {
+    if (!hasPasswordAuth && securityStatus()?.apiTokenConfigured && !getStoredAPIToken()) {
       setApiTokenModalSource('import');
       setShowApiTokenModal(true);
       return;
@@ -1904,9 +1993,7 @@ const Settings: Component<SettingsProps> = (props) => {
           <h1 class="text-2xl font-bold text-gray-900 dark:text-gray-100 mb-2">
             {headerMeta().title}
           </h1>
-          <p class="text-base text-gray-600 dark:text-gray-400">
-            {headerMeta().description}
-          </p>
+          <p class="text-base text-gray-600 dark:text-gray-400">{headerMeta().description}</p>
         </div>
 
         {/* Save notification bar - only show when there are unsaved changes */}
@@ -1914,8 +2001,10 @@ const Settings: Component<SettingsProps> = (props) => {
           when={
             hasUnsavedChanges() &&
             (activeTab() === 'proxmox' ||
-             activeTab() === 'system-general' || activeTab() === 'system-network' ||
-             activeTab() === 'system-updates' || activeTab() === 'system-backups')
+              activeTab() === 'system-general' ||
+              activeTab() === 'system-network' ||
+              activeTab() === 'system-updates' ||
+              activeTab() === 'system-backups')
           }
         >
           <div class="bg-amber-50 dark:bg-amber-900/30 border-l-4 border-amber-500 dark:border-amber-400 rounded-r-lg shadow-sm p-4">
@@ -1928,11 +2017,17 @@ const Settings: Component<SettingsProps> = (props) => {
                   stroke="currentColor"
                   stroke-width="2"
                 >
-                  <path stroke-linecap="round" stroke-linejoin="round" d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z" />
+                  <path
+                    stroke-linecap="round"
+                    stroke-linejoin="round"
+                    d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                  />
                 </svg>
                 <div>
                   <p class="font-semibold text-amber-900 dark:text-amber-100">Unsaved changes</p>
-                  <p class="text-sm text-amber-700 dark:text-amber-200 mt-0.5">Your changes will be lost if you navigate away</p>
+                  <p class="text-sm text-amber-700 dark:text-amber-200 mt-0.5">
+                    Your changes will be lost if you navigate away
+                  </p>
                 </div>
               </div>
               <div class="flex w-full sm:w-auto gap-3">
@@ -1963,7 +2058,9 @@ const Settings: Component<SettingsProps> = (props) => {
             aria-label="Settings navigation"
             aria-expanded={!sidebarCollapsed()}
           >
-            <div class={`sticky top-0 ${sidebarCollapsed() ? 'px-2' : 'px-4'} py-5 space-y-5 transition-all duration-200`}>
+            <div
+              class={`sticky top-0 ${sidebarCollapsed() ? 'px-2' : 'px-4'} py-5 space-y-5 transition-all duration-200`}
+            >
               <Show when={!sidebarCollapsed()}>
                 <div class="flex items-center justify-between pb-2 border-b border-gray-200 dark:border-gray-700">
                   <h2 class="text-sm font-semibold text-gray-900 dark:text-gray-100">Settings</h2>
@@ -1974,7 +2071,12 @@ const Settings: Component<SettingsProps> = (props) => {
                     aria-label="Collapse sidebar"
                   >
                     <svg class="w-5 h-5" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                      <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M11 19l-7-7 7-7m8 14l-7-7 7-7" />
+                      <path
+                        stroke-linecap="round"
+                        stroke-linejoin="round"
+                        stroke-width="2"
+                        d="M11 19l-7-7 7-7m8 14l-7-7 7-7"
+                      />
                     </svg>
                   </button>
                 </div>
@@ -1986,8 +2088,18 @@ const Settings: Component<SettingsProps> = (props) => {
                   class="w-full p-2 rounded-md text-gray-500 hover:bg-gray-100 dark:hover:bg-gray-800 transition-colors"
                   aria-label="Expand sidebar"
                 >
-                  <svg class="w-5 h-5 mx-auto" fill="none" viewBox="0 0 24 24" stroke="currentColor">
-                    <path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M13 5l7 7-7 7M5 5l7 7-7 7" />
+                  <svg
+                    class="w-5 h-5 mx-auto"
+                    fill="none"
+                    viewBox="0 0 24 24"
+                    stroke="currentColor"
+                  >
+                    <path
+                      stroke-linecap="round"
+                      stroke-linejoin="round"
+                      stroke-width="2"
+                      d="M13 5l7 7-7 7M5 5l7 7-7 7"
+                    />
                   </svg>
                 </button>
               </Show>
@@ -2005,31 +2117,31 @@ const Settings: Component<SettingsProps> = (props) => {
                           {(item) => {
                             const isActive = () => activeTab() === item.id;
                             return (
-                            <button
-                              type="button"
-                              aria-current={isActive() ? 'page' : undefined}
-                              disabled={item.disabled}
-                              class={`flex w-full items-center ${sidebarCollapsed() ? 'justify-center' : 'gap-2.5'} rounded-md ${
-                                sidebarCollapsed() ? 'px-2 py-2.5' : 'px-3 py-2'
-                              } text-sm font-medium transition-colors ${
-                                item.disabled
-                                  ? 'opacity-60 cursor-not-allowed text-gray-400 dark:text-gray-600'
-                                  : isActive()
-                                    ? 'bg-blue-50 text-blue-600 dark:bg-blue-900/30 dark:text-blue-200'
-                                    : 'text-gray-600 hover:bg-gray-100 hover:text-gray-900 dark:text-gray-300 dark:hover:bg-gray-700/60 dark:hover:text-gray-100'
-                              }`}
-                              onClick={() => {
-                                if (item.disabled) return;
-                                setActiveTab(item.id);
-                              }}
-                              title={sidebarCollapsed() ? item.label : undefined}
-                            >
-                              {item.icon}
-                              <Show when={!sidebarCollapsed()}>
-                                <span class="truncate">{item.label}</span>
-                              </Show>
-                            </button>
-                          );
+                              <button
+                                type="button"
+                                aria-current={isActive() ? 'page' : undefined}
+                                disabled={item.disabled}
+                                class={`flex w-full items-center ${sidebarCollapsed() ? 'justify-center' : 'gap-2.5'} rounded-md ${
+                                  sidebarCollapsed() ? 'px-2 py-2.5' : 'px-3 py-2'
+                                } text-sm font-medium transition-colors ${
+                                  item.disabled
+                                    ? 'opacity-60 cursor-not-allowed text-gray-400 dark:text-gray-600'
+                                    : isActive()
+                                      ? 'bg-blue-50 text-blue-600 dark:bg-blue-900/30 dark:text-blue-200'
+                                      : 'text-gray-600 hover:bg-gray-100 hover:text-gray-900 dark:text-gray-300 dark:hover:bg-gray-700/60 dark:hover:text-gray-100'
+                                }`}
+                                onClick={() => {
+                                  if (item.disabled) return;
+                                  setActiveTab(item.id);
+                                }}
+                                title={sidebarCollapsed() ? item.label : undefined}
+                              >
+                                {item.icon}
+                                <Show when={!sidebarCollapsed()}>
+                                  <span class="truncate">{item.label}</span>
+                                </Show>
+                              </button>
+                            );
                           }}
                         </For>
                       </div>
@@ -2043,7 +2155,10 @@ const Settings: Component<SettingsProps> = (props) => {
           <div class="flex-1 overflow-hidden">
             <Show when={flatTabs.length > 0}>
               <div class="lg:hidden border-b border-gray-200 dark:border-gray-700">
-                <div class="flex gap-1 px-2 py-1 w-full overflow-x-auto scrollbar-hide" style="-webkit-overflow-scrolling: touch;">
+                <div
+                  class="flex gap-1 px-2 py-1 w-full overflow-x-auto scrollbar-hide"
+                  style="-webkit-overflow-scrolling: touch;"
+                >
                   <For each={flatTabs}>
                     {(tab) => {
                       const isActive = activeTab() === tab.id;
@@ -2074,28 +2189,30 @@ const Settings: Component<SettingsProps> = (props) => {
             </Show>
 
             <div class="p-6 lg:p-8">
-                <Show when={activeTab() === 'proxmox'}>
-                  <SettingsSectionNav
-                    current={selectedAgent()}
-                    onSelect={handleSelectAgent}
-                    class="mb-6"
-                  />
-                </Show>
-                {/* PVE Nodes Tab */}
-                <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pve'}>
-                  <div class="space-y-6 mt-6">
-                    <div class="space-y-4">
-                      <Show when={!initialLoadComplete()}>
-                        <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
-                          Loading configuration...
-                        </div>
-                      </Show>
-                      <Show when={initialLoadComplete()}>
-                        <Card padding="lg">
-                          <div class="space-y-4">
-                            <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
-                              <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">Proxmox VE nodes</h4>
-                              <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
+              <Show when={activeTab() === 'proxmox'}>
+                <SettingsSectionNav
+                  current={selectedAgent()}
+                  onSelect={handleSelectAgent}
+                  class="mb-6"
+                />
+              </Show>
+              {/* PVE Nodes Tab */}
+              <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pve'}>
+                <div class="space-y-6 mt-6">
+                  <div class="space-y-4">
+                    <Show when={!initialLoadComplete()}>
+                      <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
+                        Loading configuration...
+                      </div>
+                    </Show>
+                    <Show when={initialLoadComplete()}>
+                      <Card padding="lg">
+                        <div class="space-y-4">
+                          <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
+                            <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">
+                              Proxmox VE nodes
+                            </h4>
+                            <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
                               {/* Discovery toggle */}
                               <div
                                 class="flex items-center gap-2 sm:gap-3"
@@ -2107,7 +2224,10 @@ const Settings: Component<SettingsProps> = (props) => {
                                 <Toggle
                                   checked={discoveryEnabled()}
                                   onChange={async (e: ToggleChangeEvent) => {
-                                    if (envOverrides().discoveryEnabled || savingDiscoverySettings()) {
+                                    if (
+                                      envOverrides().discoveryEnabled ||
+                                      savingDiscoverySettings()
+                                    ) {
                                       e.preventDefault();
                                       return;
                                     }
@@ -2211,168 +2331,174 @@ const Settings: Component<SettingsProps> = (props) => {
                               <div class="rounded-full bg-gray-100 dark:bg-gray-800 p-4 mb-4">
                                 <Server class="h-8 w-8 text-gray-400 dark:text-gray-500" />
                               </div>
-                              <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">No PVE nodes configured</p>
-                              <p class="text-sm text-gray-500 dark:text-gray-400">Add a Proxmox VE node to start monitoring your infrastructure</p>
+                              <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">
+                                No PVE nodes configured
+                              </p>
+                              <p class="text-sm text-gray-500 dark:text-gray-400">
+                                Add a Proxmox VE node to start monitoring your infrastructure
+                              </p>
                             </div>
                           </Show>
-                          </div>
-                        </Card>
-                      </Show>
+                        </div>
+                      </Card>
+                    </Show>
 
-                      {/* Discovered PVE nodes - only show when discovery is enabled */}
-                      <Show when={discoveryEnabled()}>
-                        <div class="space-y-3">
-                          <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
-                            <Show when={discoveryScanStatus().scanning}>
-                              <span class="flex items-center gap-2">
-                                <Loader class="h-4 w-4 animate-spin" />
-                                <span>Scanning your network for Proxmox VE servers…</span>
-                              </span>
-                            </Show>
+                    {/* Discovered PVE nodes - only show when discovery is enabled */}
+                    <Show when={discoveryEnabled()}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
+                          <Show when={discoveryScanStatus().scanning}>
+                            <span class="flex items-center gap-2">
+                              <Loader class="h-4 w-4 animate-spin" />
+                              <span>Scanning your network for Proxmox VE servers…</span>
+                            </span>
+                          </Show>
+                          <Show
+                            when={
+                              !discoveryScanStatus().scanning &&
+                              (discoveryScanStatus().lastResultAt ||
+                                discoveryScanStatus().lastScanStartedAt)
+                            }
+                          >
+                            <span>
+                              Last scan{' '}
+                              {formatRelativeTime(
+                                discoveryScanStatus().lastResultAt ??
+                                  discoveryScanStatus().lastScanStartedAt,
+                              )}
+                            </span>
+                          </Show>
+                        </div>
+                        <Show
+                          when={
+                            discoveryScanStatus().errors && discoveryScanStatus().errors!.length
+                          }
+                        >
+                          <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
+                            <span class="font-medium">Discovery issues:</span>
+                            <ul class="list-disc ml-4 mt-1 space-y-0.5">
+                              <For each={discoveryScanStatus().errors || []}>
+                                {(err) => <li>{err}</li>}
+                              </For>
+                            </ul>
                             <Show
                               when={
-                                !discoveryScanStatus().scanning &&
-                                (discoveryScanStatus().lastResultAt ||
-                                  discoveryScanStatus().lastScanStartedAt)
+                                discoveryMode() === 'auto' &&
+                                (discoveryScanStatus().errors || []).some((err) =>
+                                  /timed out|timeout/i.test(err),
+                                )
                               }
                             >
-                              <span>
-                                Last scan{' '}
-                                {formatRelativeTime(
-                                  discoveryScanStatus().lastResultAt ??
-                                    discoveryScanStatus().lastScanStartedAt,
-                                )}
-                              </span>
+                              <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
+                                Large networks can time out in auto mode. Switch to a custom subnet
+                                for faster, targeted scans.
+                              </p>
                             </Show>
                           </div>
-                          <Show
-                            when={
-                              discoveryScanStatus().errors && discoveryScanStatus().errors!.length
-                            }
-                          >
-                            <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
-                              <span class="font-medium">Discovery issues:</span>
-                              <ul class="list-disc ml-4 mt-1 space-y-0.5">
-                                <For each={discoveryScanStatus().errors || []}>
-                                  {(err) => <li>{err}</li>}
-                                </For>
-                              </ul>
-                              <Show
-                                when={
-                                  discoveryMode() === 'auto' &&
-                                  (discoveryScanStatus().errors || []).some((err) =>
-                                    /timed out|timeout/i.test(err),
-                                  )
-                                }
-                              >
-                                <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
-                                  Large networks can time out in auto mode. Switch to a custom subnet
-                                  for faster, targeted scans.
-                                </p>
-                              </Show>
-                            </div>
-                          </Show>
-                          <Show
-                            when={
-                              discoveryScanStatus().scanning &&
-                              discoveredNodes().filter((n) => n.type === 'pve').length === 0
-                            }
-                          >
-                            <div class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
-                              <Loader class="h-4 w-4 animate-spin" />
-                              <span>
-                                Waiting for responses… this can take up to a minute depending on your
-                                network size.
-                              </span>
-                            </div>
-                          </Show>
-                          <For each={discoveredNodes().filter((n) => n.type === 'pve')}>
-                            {(server) => (
-                              <div
-                                class="bg-gray-50/50 dark:bg-gray-700/30 rounded-lg p-4 border border-gray-200/50 dark:border-gray-600/50 opacity-75 hover:opacity-100 transition-opacity cursor-pointer"
-                                onClick={() => {
-                                  // Pre-fill the modal with discovered server info
-                                  setEditingNode({
-                                    id: '',
-                                    type: 'pve',
-                                    name: server.hostname || `pve-${server.ip}`,
-                                    host: `https://${server.ip}:${server.port}`,
-                                    user: '',
-                                    tokenName: '',
-                                    tokenValue: '',
-                                    verifySSL: false,
-                                    monitorVMs: true,
-                                    monitorContainers: true,
-                                    monitorStorage: true,
-                                    monitorBackups: true,
-                                    monitorPhysicalDisks: false,
-                                    status: 'pending',
-                                  } as NodeConfigWithStatus);
-                                  setCurrentNodeType('pve');
-                                  setShowNodeModal(true);
-                                }}
-                              >
-                                <div class="flex flex-col sm:flex-row sm:items-start sm:justify-between gap-2">
-                                  <div class="flex-1 min-w-0">
-                                    <div class="flex items-start gap-3">
-                                      <div class="flex-shrink-0 w-3 h-3 mt-1.5 rounded-full bg-gray-400 animate-pulse"></div>
-                                      <div class="flex-1 min-w-0">
-                                        <h4 class="font-medium text-gray-700 dark:text-gray-300">
-                                          {server.hostname || `Proxmox VE at ${server.ip}`}
-                                        </h4>
-                                        <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
-                                          {server.ip}:{server.port}
-                                        </p>
-                                        <div class="flex items-center gap-2 mt-2">
-                                          <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
-                                            Discovered
-                                          </span>
-                                          <span class="text-xs text-gray-500 dark:text-gray-400">
-                                            Click to configure
-                                          </span>
-                                        </div>
+                        </Show>
+                        <Show
+                          when={
+                            discoveryScanStatus().scanning &&
+                            discoveredNodes().filter((n) => n.type === 'pve').length === 0
+                          }
+                        >
+                          <div class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                            <Loader class="h-4 w-4 animate-spin" />
+                            <span>
+                              Waiting for responses… this can take up to a minute depending on your
+                              network size.
+                            </span>
+                          </div>
+                        </Show>
+                        <For each={discoveredNodes().filter((n) => n.type === 'pve')}>
+                          {(server) => (
+                            <div
+                              class="bg-gray-50/50 dark:bg-gray-700/30 rounded-lg p-4 border border-gray-200/50 dark:border-gray-600/50 opacity-75 hover:opacity-100 transition-opacity cursor-pointer"
+                              onClick={() => {
+                                // Pre-fill the modal with discovered server info
+                                setEditingNode({
+                                  id: '',
+                                  type: 'pve',
+                                  name: server.hostname || `pve-${server.ip}`,
+                                  host: `https://${server.ip}:${server.port}`,
+                                  user: '',
+                                  tokenName: '',
+                                  tokenValue: '',
+                                  verifySSL: false,
+                                  monitorVMs: true,
+                                  monitorContainers: true,
+                                  monitorStorage: true,
+                                  monitorBackups: true,
+                                  monitorPhysicalDisks: false,
+                                  status: 'pending',
+                                } as NodeConfigWithStatus);
+                                setCurrentNodeType('pve');
+                                setShowNodeModal(true);
+                              }}
+                            >
+                              <div class="flex flex-col sm:flex-row sm:items-start sm:justify-between gap-2">
+                                <div class="flex-1 min-w-0">
+                                  <div class="flex items-start gap-3">
+                                    <div class="flex-shrink-0 w-3 h-3 mt-1.5 rounded-full bg-gray-400 animate-pulse"></div>
+                                    <div class="flex-1 min-w-0">
+                                      <h4 class="font-medium text-gray-700 dark:text-gray-300">
+                                        {server.hostname || `Proxmox VE at ${server.ip}`}
+                                      </h4>
+                                      <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
+                                        {server.ip}:{server.port}
+                                      </p>
+                                      <div class="flex items-center gap-2 mt-2">
+                                        <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
+                                          Discovered
+                                        </span>
+                                        <span class="text-xs text-gray-500 dark:text-gray-400">
+                                          Click to configure
+                                        </span>
                                       </div>
                                     </div>
                                   </div>
-                                  <svg
-                                    width="20"
-                                    height="20"
-                                    viewBox="0 0 24 24"
-                                    fill="none"
-                                    class="text-gray-400 mt-1"
-                                  >
-                                    <path
-                                      d="M12 5v14m-7-7h14"
-                                      stroke="currentColor"
-                                      stroke-width="2"
-                                      stroke-linecap="round"
-                                    />
-                                  </svg>
                                 </div>
+                                <svg
+                                  width="20"
+                                  height="20"
+                                  viewBox="0 0 24 24"
+                                  fill="none"
+                                  class="text-gray-400 mt-1"
+                                >
+                                  <path
+                                    d="M12 5v14m-7-7h14"
+                                    stroke="currentColor"
+                                    stroke-width="2"
+                                    stroke-linecap="round"
+                                  />
+                                </svg>
                               </div>
-                            )}
-                          </For>
-                        </div>
-                      </Show>
-                    </div>
+                            </div>
+                          )}
+                        </For>
+                      </div>
+                    </Show>
                   </div>
-                </Show>
+                </div>
+              </Show>
 
-                {/* PBS Nodes Tab */}
-                <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pbs'}>
-                  <div class="space-y-6 mt-6">
-                    <div class="space-y-4">
-                      <Show when={!initialLoadComplete()}>
-                        <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
-                          Loading configuration...
-                        </div>
-                      </Show>
-                      <Show when={initialLoadComplete()}>
-                        <Card padding="lg">
-                          <div class="space-y-4">
-                            <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
-                              <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">Proxmox Backup Server nodes</h4>
-                              <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
+              {/* PBS Nodes Tab */}
+              <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pbs'}>
+                <div class="space-y-6 mt-6">
+                  <div class="space-y-4">
+                    <Show when={!initialLoadComplete()}>
+                      <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
+                        Loading configuration...
+                      </div>
+                    </Show>
+                    <Show when={initialLoadComplete()}>
+                      <Card padding="lg">
+                        <div class="space-y-4">
+                          <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
+                            <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">
+                              Proxmox Backup Server nodes
+                            </h4>
+                            <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
                               {/* Discovery toggle */}
                               <div
                                 class="flex items-center gap-2 sm:gap-3"
@@ -2384,7 +2510,10 @@ const Settings: Component<SettingsProps> = (props) => {
                                 <Toggle
                                   checked={discoveryEnabled()}
                                   onChange={async (e: ToggleChangeEvent) => {
-                                    if (envOverrides().discoveryEnabled || savingDiscoverySettings()) {
+                                    if (
+                                      envOverrides().discoveryEnabled ||
+                                      savingDiscoverySettings()
+                                    ) {
                                       e.preventDefault();
                                       return;
                                     }
@@ -2488,168 +2617,174 @@ const Settings: Component<SettingsProps> = (props) => {
                               <div class="rounded-full bg-gray-100 dark:bg-gray-800 p-4 mb-4">
                                 <HardDrive class="h-8 w-8 text-gray-400 dark:text-gray-500" />
                               </div>
-                              <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">No PBS nodes configured</p>
-                              <p class="text-sm text-gray-500 dark:text-gray-400">Add a Proxmox Backup Server to monitor your backup infrastructure</p>
+                              <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">
+                                No PBS nodes configured
+                              </p>
+                              <p class="text-sm text-gray-500 dark:text-gray-400">
+                                Add a Proxmox Backup Server to monitor your backup infrastructure
+                              </p>
                             </div>
                           </Show>
-                          </div>
-                        </Card>
-                      </Show>
+                        </div>
+                      </Card>
+                    </Show>
 
-                      {/* Discovered PBS nodes - only show when discovery is enabled */}
-                      <Show when={discoveryEnabled()}>
-                        <div class="space-y-3">
-                          <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
-                            <Show when={discoveryScanStatus().scanning}>
-                              <span class="flex items-center gap-2">
-                                <Loader class="h-4 w-4 animate-spin" />
-                                <span>Scanning your network for Proxmox Backup Servers…</span>
-                              </span>
-                            </Show>
+                    {/* Discovered PBS nodes - only show when discovery is enabled */}
+                    <Show when={discoveryEnabled()}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
+                          <Show when={discoveryScanStatus().scanning}>
+                            <span class="flex items-center gap-2">
+                              <Loader class="h-4 w-4 animate-spin" />
+                              <span>Scanning your network for Proxmox Backup Servers…</span>
+                            </span>
+                          </Show>
+                          <Show
+                            when={
+                              !discoveryScanStatus().scanning &&
+                              (discoveryScanStatus().lastResultAt ||
+                                discoveryScanStatus().lastScanStartedAt)
+                            }
+                          >
+                            <span>
+                              Last scan{' '}
+                              {formatRelativeTime(
+                                discoveryScanStatus().lastResultAt ??
+                                  discoveryScanStatus().lastScanStartedAt,
+                              )}
+                            </span>
+                          </Show>
+                        </div>
+                        <Show
+                          when={
+                            discoveryScanStatus().errors && discoveryScanStatus().errors!.length
+                          }
+                        >
+                          <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
+                            <span class="font-medium">Discovery issues:</span>
+                            <ul class="list-disc ml-4 mt-1 space-y-0.5">
+                              <For each={discoveryScanStatus().errors || []}>
+                                {(err) => <li>{err}</li>}
+                              </For>
+                            </ul>
                             <Show
                               when={
-                                !discoveryScanStatus().scanning &&
-                                (discoveryScanStatus().lastResultAt ||
-                                  discoveryScanStatus().lastScanStartedAt)
+                                discoveryMode() === 'auto' &&
+                                (discoveryScanStatus().errors || []).some((err) =>
+                                  /timed out|timeout/i.test(err),
+                                )
                               }
                             >
-                              <span>
-                                Last scan{' '}
-                                {formatRelativeTime(
-                                  discoveryScanStatus().lastResultAt ??
-                                    discoveryScanStatus().lastScanStartedAt,
-                                )}
-                              </span>
+                              <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
+                                Large networks can time out in auto mode. Switch to a custom subnet
+                                for faster, targeted scans.
+                              </p>
                             </Show>
                           </div>
-                          <Show
-                            when={
-                              discoveryScanStatus().errors && discoveryScanStatus().errors!.length
-                            }
-                          >
-                            <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
-                              <span class="font-medium">Discovery issues:</span>
-                              <ul class="list-disc ml-4 mt-1 space-y-0.5">
-                                <For each={discoveryScanStatus().errors || []}>
-                                  {(err) => <li>{err}</li>}
-                                </For>
-                              </ul>
-                              <Show
-                                when={
-                                  discoveryMode() === 'auto' &&
-                                  (discoveryScanStatus().errors || []).some((err) =>
-                                    /timed out|timeout/i.test(err),
-                                  )
-                                }
-                              >
-                                <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
-                                  Large networks can time out in auto mode. Switch to a custom subnet
-                                  for faster, targeted scans.
-                                </p>
-                              </Show>
-                            </div>
-                          </Show>
-                          <Show
-                            when={
-                              discoveryScanStatus().scanning &&
-                              discoveredNodes().filter((n) => n.type === 'pbs').length === 0
-                            }
-                          >
-                            <div class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
-                              <Loader class="h-4 w-4 animate-spin" />
-                              <span>
-                                Waiting for responses… this can take up to a minute depending on your
-                                network size.
-                              </span>
-                            </div>
-                          </Show>
-                          <For each={discoveredNodes().filter((n) => n.type === 'pbs')}>
-                            {(server) => (
-                              <div
-                                class="bg-gray-50/50 dark:bg-gray-700/30 rounded-lg p-4 border border-gray-200/50 dark:border-gray-600/50 opacity-75 hover:opacity-100 transition-opacity cursor-pointer"
-                                onClick={() => {
-                                  // Pre-fill the modal with discovered server info
-                                  setEditingNode({
-                                    id: '',
-                                    type: 'pbs',
-                                    name: server.hostname || `pbs-${server.ip}`,
-                                    host: `https://${server.ip}:${server.port}`,
-                                    user: '',
-                                    tokenName: '',
-                                    tokenValue: '',
-                                    verifySSL: false,
-                                    monitorDatastores: true,
-                                    monitorSyncJobs: true,
-                                    monitorVerifyJobs: true,
-                                    monitorPruneJobs: true,
-                                    monitorGarbageJobs: true,
-                                    status: 'pending',
-                                  } as NodeConfigWithStatus);
-                                  setCurrentNodeType('pbs');
-                                  setShowNodeModal(true);
-                                }}
-                              >
-                                <div class="flex flex-col sm:flex-row sm:items-start sm:justify-between gap-2">
-                                  <div class="flex-1 min-w-0">
-                                    <div class="flex items-start gap-3">
-                                      <div class="flex-shrink-0 w-3 h-3 mt-1.5 rounded-full bg-gray-400 animate-pulse"></div>
-                                      <div class="flex-1 min-w-0">
-                                        <h4 class="font-medium text-gray-700 dark:text-gray-300">
-                                          {server.hostname || `Backup Server at ${server.ip}`}
-                                        </h4>
-                                        <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
-                                          {server.ip}:{server.port}
-                                        </p>
-                                        <div class="flex items-center gap-2 mt-2">
-                                          <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
-                                            Discovered
-                                          </span>
-                                          <span class="text-xs text-gray-500 dark:text-gray-400">
-                                            Click to configure
-                                          </span>
-                                        </div>
+                        </Show>
+                        <Show
+                          when={
+                            discoveryScanStatus().scanning &&
+                            discoveredNodes().filter((n) => n.type === 'pbs').length === 0
+                          }
+                        >
+                          <div class="flex items-center gap-2 text-xs text-gray-500 dark:text-gray-400">
+                            <Loader class="h-4 w-4 animate-spin" />
+                            <span>
+                              Waiting for responses… this can take up to a minute depending on your
+                              network size.
+                            </span>
+                          </div>
+                        </Show>
+                        <For each={discoveredNodes().filter((n) => n.type === 'pbs')}>
+                          {(server) => (
+                            <div
+                              class="bg-gray-50/50 dark:bg-gray-700/30 rounded-lg p-4 border border-gray-200/50 dark:border-gray-600/50 opacity-75 hover:opacity-100 transition-opacity cursor-pointer"
+                              onClick={() => {
+                                // Pre-fill the modal with discovered server info
+                                setEditingNode({
+                                  id: '',
+                                  type: 'pbs',
+                                  name: server.hostname || `pbs-${server.ip}`,
+                                  host: `https://${server.ip}:${server.port}`,
+                                  user: '',
+                                  tokenName: '',
+                                  tokenValue: '',
+                                  verifySSL: false,
+                                  monitorDatastores: true,
+                                  monitorSyncJobs: true,
+                                  monitorVerifyJobs: true,
+                                  monitorPruneJobs: true,
+                                  monitorGarbageJobs: true,
+                                  status: 'pending',
+                                } as NodeConfigWithStatus);
+                                setCurrentNodeType('pbs');
+                                setShowNodeModal(true);
+                              }}
+                            >
+                              <div class="flex flex-col sm:flex-row sm:items-start sm:justify-between gap-2">
+                                <div class="flex-1 min-w-0">
+                                  <div class="flex items-start gap-3">
+                                    <div class="flex-shrink-0 w-3 h-3 mt-1.5 rounded-full bg-gray-400 animate-pulse"></div>
+                                    <div class="flex-1 min-w-0">
+                                      <h4 class="font-medium text-gray-700 dark:text-gray-300">
+                                        {server.hostname || `Backup Server at ${server.ip}`}
+                                      </h4>
+                                      <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
+                                        {server.ip}:{server.port}
+                                      </p>
+                                      <div class="flex items-center gap-2 mt-2">
+                                        <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
+                                          Discovered
+                                        </span>
+                                        <span class="text-xs text-gray-500 dark:text-gray-400">
+                                          Click to configure
+                                        </span>
                                       </div>
                                     </div>
                                   </div>
-                                  <svg
-                                    width="20"
-                                    height="20"
-                                    viewBox="0 0 24 24"
-                                    fill="none"
-                                    class="text-gray-400 mt-1"
-                                  >
-                                    <path
-                                      d="M12 5v14m-7-7h14"
-                                      stroke="currentColor"
-                                      stroke-width="2"
-                                      stroke-linecap="round"
-                                    />
-                                  </svg>
                                 </div>
+                                <svg
+                                  width="20"
+                                  height="20"
+                                  viewBox="0 0 24 24"
+                                  fill="none"
+                                  class="text-gray-400 mt-1"
+                                >
+                                  <path
+                                    d="M12 5v14m-7-7h14"
+                                    stroke="currentColor"
+                                    stroke-width="2"
+                                    stroke-linecap="round"
+                                  />
+                                </svg>
                               </div>
-                            )}
-                          </For>
-                        </div>
-                      </Show>
-                    </div>
+                            </div>
+                          )}
+                        </For>
+                      </div>
+                    </Show>
                   </div>
-                </Show>
-{/* PMG Nodes Tab */}
-                <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pmg'}>
-                  <div class="space-y-6 mt-6">
-                    <div class="space-y-4">
-                      <Show when={!initialLoadComplete()}>
-                        <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
-                          Loading configuration...
-                        </div>
-                      </Show>
+                </div>
+              </Show>
+              {/* PMG Nodes Tab */}
+              <Show when={activeTab() === 'proxmox' && selectedAgent() === 'pmg'}>
+                <div class="space-y-6 mt-6">
+                  <div class="space-y-4">
+                    <Show when={!initialLoadComplete()}>
+                      <div class="flex items-center justify-center rounded-lg border border-dashed border-gray-300 dark:border-gray-700 bg-gray-50 dark:bg-gray-800/40 py-12 text-sm text-gray-500 dark:text-gray-400">
+                        Loading configuration...
+                      </div>
+                    </Show>
 
-                      <Show when={initialLoadComplete()}>
-                        <Card padding="lg">
-                          <div class="space-y-4">
-                            <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
-                              <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">Proxmox Mail Gateway nodes</h4>
-                              <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
+                    <Show when={initialLoadComplete()}>
+                      <Card padding="lg">
+                        <div class="space-y-4">
+                          <div class="flex flex-col sm:flex-row sm:items-center sm:justify-between gap-3">
+                            <h4 class="text-base font-semibold text-gray-900 dark:text-gray-100">
+                              Proxmox Mail Gateway nodes
+                            </h4>
+                            <div class="flex flex-wrap items-center justify-start gap-2 sm:justify-end">
                               {/* Discovery toggle */}
                               <div
                                 class="flex items-center gap-2 sm:gap-3"
@@ -2661,7 +2796,10 @@ const Settings: Component<SettingsProps> = (props) => {
                                 <Toggle
                                   checked={discoveryEnabled()}
                                   onChange={async (e: ToggleChangeEvent) => {
-                                    if (envOverrides().discoveryEnabled || savingDiscoverySettings()) {
+                                    if (
+                                      envOverrides().discoveryEnabled ||
+                                      savingDiscoverySettings()
+                                    ) {
                                       e.preventDefault();
                                       return;
                                     }
@@ -2698,7 +2836,14 @@ const Settings: Component<SettingsProps> = (props) => {
                                   class="px-2 sm:px-4 py-1.5 sm:py-2 text-xs sm:text-sm bg-gray-600 text-white rounded-lg hover:bg-gray-700 transition-colors flex items-center gap-1"
                                   title="Refresh discovered servers"
                                 >
-                                  <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                  <svg
+                                    width="16"
+                                    height="16"
+                                    viewBox="0 0 24 24"
+                                    fill="none"
+                                    stroke="currentColor"
+                                    stroke-width="2"
+                                  >
                                     <polyline points="23 4 23 10 17 10"></polyline>
                                     <polyline points="1 20 1 14 7 14"></polyline>
                                     <path d="M3.51 9a9 9 0 0 1 14.85-3.36L23 10M1 14l4.64 4.36A9 9 0 0 0 20.49 15"></path>
@@ -2717,7 +2862,14 @@ const Settings: Component<SettingsProps> = (props) => {
                                 }}
                                 class="px-2 sm:px-4 py-1.5 sm:py-2 text-xs sm:text-sm bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors flex items-center gap-1"
                               >
-                                <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2">
+                                <svg
+                                  width="16"
+                                  height="16"
+                                  viewBox="0 0 24 24"
+                                  fill="none"
+                                  stroke="currentColor"
+                                  stroke-width="2"
+                                >
                                   <line x1="12" y1="5" x2="12" y2="19"></line>
                                   <line x1="5" y1="12" x2="19" y2="12"></line>
                                 </svg>
@@ -2747,606 +2899,1262 @@ const Settings: Component<SettingsProps> = (props) => {
                               <div class="rounded-full bg-gray-100 dark:bg-gray-800 p-4 mb-4">
                                 <Mail class="h-8 w-8 text-gray-400 dark:text-gray-500" />
                               </div>
-                              <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">No PMG nodes configured</p>
-                              <p class="text-sm text-gray-500 dark:text-gray-400">Add a Proxmox Mail Gateway to monitor mail queue and quarantine metrics</p>
+                              <p class="text-base font-medium text-gray-900 dark:text-gray-100 mb-1">
+                                No PMG nodes configured
+                              </p>
+                              <p class="text-sm text-gray-500 dark:text-gray-400">
+                                Add a Proxmox Mail Gateway to monitor mail queue and quarantine
+                                metrics
+                              </p>
                             </div>
                           </Show>
-                          </div>
-                        </Card>
-                      </Show>
+                        </div>
+                      </Card>
+                    </Show>
 
-                      {/* Discovered PMG nodes - only show when discovery is enabled */}
-                      <Show when={discoveryEnabled()}>
-                        <div class="space-y-3">
-                          <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
-                            <Show when={discoveryScanStatus().scanning}>
-                              <span class="flex items-center gap-2">
-                                <Loader class="h-4 w-4 animate-spin" />
-                                Scanning network...
-                              </span>
-                            </Show>
+                    {/* Discovered PMG nodes - only show when discovery is enabled */}
+                    <Show when={discoveryEnabled()}>
+                      <div class="space-y-3">
+                        <div class="flex items-center gap-2 text-xs text-gray-600 dark:text-gray-400">
+                          <Show when={discoveryScanStatus().scanning}>
+                            <span class="flex items-center gap-2">
+                              <Loader class="h-4 w-4 animate-spin" />
+                              Scanning network...
+                            </span>
+                          </Show>
+                          <Show
+                            when={
+                              !discoveryScanStatus().scanning &&
+                              (discoveryScanStatus().lastResultAt ||
+                                discoveryScanStatus().lastScanStartedAt)
+                            }
+                          >
+                            <span>
+                              Last scan{' '}
+                              {formatRelativeTime(
+                                discoveryScanStatus().lastResultAt ??
+                                  discoveryScanStatus().lastScanStartedAt,
+                              )}
+                            </span>
+                          </Show>
+                        </div>
+                        <Show
+                          when={
+                            discoveryScanStatus().errors && discoveryScanStatus().errors!.length
+                          }
+                        >
+                          <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
+                            <span class="font-medium">Discovery issues:</span>
+                            <ul class="list-disc ml-4 mt-1 space-y-0.5">
+                              <For each={discoveryScanStatus().errors || []}>
+                                {(err) => <li>{err}</li>}
+                              </For>
+                            </ul>
                             <Show
                               when={
-                                !discoveryScanStatus().scanning &&
-                                (discoveryScanStatus().lastResultAt ||
-                                  discoveryScanStatus().lastScanStartedAt)
+                                discoveryMode() === 'auto' &&
+                                (discoveryScanStatus().errors || []).some((err) =>
+                                  /timed out|timeout/i.test(err),
+                                )
                               }
                             >
-                              <span>
-                                Last scan{' '}
-                                {formatRelativeTime(
-                                  discoveryScanStatus().lastResultAt ??
-                                    discoveryScanStatus().lastScanStartedAt,
-                                )}
-                              </span>
+                              <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
+                                Large networks can time out in auto mode. Switch to a custom subnet
+                                for faster, targeted scans.
+                              </p>
                             </Show>
                           </div>
-                          <Show
-                            when={
-                              discoveryScanStatus().errors && discoveryScanStatus().errors!.length
-                            }
-                          >
-                            <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-2">
-                              <span class="font-medium">Discovery issues:</span>
-                              <ul class="list-disc ml-4 mt-1 space-y-0.5">
-                                <For each={discoveryScanStatus().errors || []}>
-                                  {(err) => <li>{err}</li>}
-                                </For>
-                              </ul>
-                              <Show
-                                when={
-                                  discoveryMode() === 'auto' &&
-                                  (discoveryScanStatus().errors || []).some((err) =>
-                                    /timed out|timeout/i.test(err),
-                                  )
-                                }
-                              >
-                                <p class="mt-2 text-[0.7rem] font-medium text-amber-700 dark:text-amber-300">
-                                  Large networks can time out in auto mode. Switch to a custom subnet
-                                  for faster, targeted scans.
-                                </p>
-                              </Show>
-                            </div>
-                          </Show>
-                          <Show
-                            when={
-                              discoveryScanStatus().scanning &&
-                              discoveredNodes().filter((n) => n.type === 'pmg').length === 0
-                            }
-                          >
-                            <div class="text-center py-6 text-gray-500 dark:text-gray-400 bg-gray-50 dark:bg-gray-800/50 rounded-lg border-2 border-dashed border-gray-300 dark:border-gray-600">
-                              <svg
-                                class="h-8 w-8 mx-auto mb-2 animate-pulse text-purple-500"
-                                viewBox="0 0 24 24"
-                                fill="none"
-                                stroke="currentColor"
-                                stroke-width="2"
-                              >
-                                <circle cx="11" cy="11" r="8" />
-                                <path d="m21 21-4.35-4.35" />
-                              </svg>
-                              <p class="text-sm">Scanning for PMG servers...</p>
-                            </div>
-                          </Show>
-                          <For each={discoveredNodes().filter((n) => n.type === 'pmg')}>
-                            {(server) => (
-                              <div
-                                class="bg-gradient-to-r from-purple-50 to-transparent dark:from-purple-900/20 dark:to-transparent border-l-4 border-purple-500 rounded-lg p-4 cursor-pointer hover:shadow-md transition-all"
-                                onClick={() => {
-                                  setEditingNode(null);
-                                  setCurrentNodeType('pmg');
-                                  setModalResetKey((prev) => prev + 1);
-                                  setShowNodeModal(true);
-                                  setTimeout(() => {
-                                    const hostInput = document.querySelector(
-                                      'input[placeholder*="192.168"]',
-                                    ) as HTMLInputElement;
-                                    if (hostInput) {
-                                      hostInput.value = server.ip;
-                                      hostInput.dispatchEvent(new Event('input', { bubbles: true }));
-                                    }
-                                  }, 50);
-                                }}
-                              >
-                                <div class="flex items-start justify-between">
-                                  <div class="flex items-start gap-3 flex-1 min-w-0">
-                                    <svg
-                                      width="24"
-                                      height="24"
-                                      viewBox="0 0 24 24"
-                                      fill="none"
-                                      stroke="currentColor"
-                                      stroke-width="2"
-                                      class="text-purple-500 flex-shrink-0 mt-0.5"
-                                    >
-                                      <path d="M4 4h16c1.1 0 2 .9 2 2v12c0 1.1-.9 2-2 2H4c-1.1 0-2-.9-2-2V6c0-1.1.9-2 2-2z"></path>
-                                      <polyline points="22,6 12,13 2,6"></polyline>
-                                    </svg>
-                                    <div class="flex-1 min-w-0">
-                                      <h4 class="font-medium text-gray-900 dark:text-gray-100 truncate">
-                                        {server.hostname || `PMG at ${server.ip}`}
-                                      </h4>
-                                      <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
-                                        {server.ip}:{server.port}
-                                      </p>
-                                      <div class="flex items-center gap-2 mt-2">
-                                        <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
-                                          Discovered
-                                        </span>
-                                        <span class="text-xs text-gray-500 dark:text-gray-400">
-                                          Click to configure
-                                        </span>
-                                      </div>
-                                    </div>
-                                  </div>
-                                  <svg
-                                    width="20"
-                                    height="20"
-                                    viewBox="0 0 24 24"
-                                    fill="none"
-                                    class="text-gray-400 mt-1"
-                                  >
-                                    <path
-                                      d="M12 5v14m-7-7h14"
-                                      stroke="currentColor"
-                                      stroke-width="2"
-                                      stroke-linecap="round"
-                                    />
-                                  </svg>
-                                </div>
-                              </div>
-                            )}
-                          </For>
-                        </div>
-                      </Show>
-                    </div>
-                  </div>
-                </Show>
-{/* Docker Tab */}
-            <Show when={activeTab() === 'proxmox' && selectedAgent() === 'docker'}>
-              <div class="space-y-6 mt-6">
-                <DockerAgents />
-              </div>
-            </Show>
-
-            {/* Docker Platform Tab */}
-            <Show when={activeTab() === 'docker'}>
-              <DockerAgents />
-            </Show>
-
-            {/* Servers Platform Tab */}
-            <Show when={activeTab() === 'hosts'}>
-              <HostAgents />
-            </Show>
-
-            {/* Host Agents */}
-            <Show when={activeTab() === 'proxmox' && selectedAgent() === 'host'}>
-              <div class="space-y-6 mt-6">
-                <HostAgents />
-              </div>
-            </Show>
-
-            {/* System General Tab */}
-            <Show when={activeTab() === 'system-general'}>
-              <div class="space-y-6">
-                <Card
-                  padding="none"
-                  class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                  border={false}
-                >
-                  <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                    <div class="flex items-center gap-3">
-                      <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                        <Sliders class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
-                      </div>
-                      <SectionHeader
-                        title="General"
-                        description="Appearance and display preferences"
-                        size="sm"
-                        class="flex-1"
-                      />
-                    </div>
-                  </div>
-                  <div class="p-6 space-y-5">
-                    <div class="flex items-center justify-between gap-3">
-                      <div class="text-sm text-gray-600 dark:text-gray-400">
-                        <p class="font-medium text-gray-900 dark:text-gray-100">Dark mode</p>
-                        <p class="text-xs text-gray-500 dark:text-gray-400">
-                          Toggle to match your environment. Pulse remembers this preference on each browser.
-                        </p>
-                      </div>
-                      <Toggle
-                        checked={props.darkMode()}
-                        onChange={(event) => {
-                          const desired = (event.currentTarget as HTMLInputElement).checked;
-                          if (desired !== props.darkMode()) {
-                            props.toggleDarkMode();
+                        </Show>
+                        <Show
+                          when={
+                            discoveryScanStatus().scanning &&
+                            discoveredNodes().filter((n) => n.type === 'pmg').length === 0
                           }
-                        }}
-                      />
-                    </div>
-                  </div>
-                </Card>
-              </div>
-            </Show>
-
-            {/* System Network Tab */}
-            <Show when={activeTab() === 'system-network'}>
-              <div class="space-y-6">
-                <Card
-                  tone="info"
-                  padding="md"
-                  border={false}
-                  class="border border-blue-200 dark:border-blue-800"
-                >
-                  <div class="flex items-start gap-3">
-                    <svg
-                      class="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0"
-                      fill="none"
-                      stroke="currentColor"
-                      viewBox="0 0 24 24"
-                    >
-                      <path
-                        stroke-linecap="round"
-                        stroke-linejoin="round"
-                        stroke-width="2"
-                        d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                      />
-                    </svg>
-                    <div class="text-sm text-blue-800 dark:text-blue-200">
-                      <p class="font-medium mb-1">Configuration Priority</p>
-                      <ul class="space-y-1">
-                        <li>• Some env vars override settings (API_TOKENS, legacy API_TOKEN, PORTS, AUTH)</li>
-                        <li>• Changes made here are saved to system.json immediately</li>
-                        <li>• Settings persist unless overridden by env vars</li>
-                      </ul>
-                    </div>
-                  </div>
-                </Card>
-                <Card
-                  padding="none"
-                  class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                  border={false}
-                >
-                  <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                    <div class="flex items-center gap-3">
-                      <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                        <Network class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
-                      </div>
-                      <SectionHeader
-                        title="Network"
-                        description="Discovery, CORS, and embedding settings"
-                        size="sm"
-                        class="flex-1"
-                      />
-                    </div>
-                  </div>
-                  <div class="p-6 space-y-8">
-                  <section class="space-y-5">
-                  <SectionHeader
-                    title="Network discovery"
-                    description="Control how Pulse scans for Proxmox services on your network."
-                    size="sm"
-                    align="left"
-                  />
-                  <div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
-                    <div class="text-sm text-gray-600 dark:text-gray-400">
-                      <p class="font-medium text-gray-900 dark:text-gray-100">Automatic scanning</p>
-                      <p class="text-xs text-gray-500 dark:text-gray-400">
-                        Enable discovery to surface Proxmox VE, PBS, and PMG endpoints automatically.
-                      </p>
-                    </div>
-                    <Toggle
-                      checked={discoveryEnabled()}
-                      onChange={async (e: ToggleChangeEvent) => {
-                        if (envOverrides().discoveryEnabled || savingDiscoverySettings()) {
-                          e.preventDefault();
-                          return;
-                        }
-                        const success = await handleDiscoveryEnabledChange(e.currentTarget.checked);
-                        if (!success) {
-                          e.currentTarget.checked = discoveryEnabled();
-                        }
-                      }}
-                      disabled={envOverrides().discoveryEnabled || savingDiscoverySettings()}
-                      containerClass="gap-2"
-                      label={
-                        <span class="text-xs font-medium text-gray-600 dark:text-gray-400">
-                          {discoveryEnabled() ? 'On' : 'Off'}
-                        </span>
-                      }
-                    />
-                  </div>
-
-                  <Show when={discoveryEnabled()}>
-                    <div class="space-y-4 rounded-lg border border-gray-200 bg-white/40 p-3 dark:border-gray-600 dark:bg-gray-800/40">
-                      <fieldset class="space-y-2">
-                        <legend class="text-xs font-medium text-gray-700 dark:text-gray-300">
-                          Scan scope
-                        </legend>
-                        <div class="space-y-2">
-                          <label
-                            class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${
-                              discoveryMode() === 'auto'
-                                ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
-                                : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
-                            }`}
-                          >
-                            <input
-                              type="radio"
-                              name="discoveryMode"
-                              value="auto"
-                              checked={discoveryMode() === 'auto'}
-                              onChange={async () => {
-                                if (discoveryMode() !== 'auto') {
-                                  await handleDiscoveryModeChange('auto');
-                                }
-                              }}
-                              disabled={envOverrides().discoverySubnet || savingDiscoverySettings()}
-                              class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
-                            />
-                            <div class="space-y-1">
-                              <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                Auto (slower, full scan)
-                              </p>
-                              <p class="text-xs text-gray-500 dark:text-gray-400">
-                                Scans container, local, and gateway networks. Large networks may time
-                                out after two minutes.
-                              </p>
-                            </div>
-                          </label>
-
-                          <label
-                            class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${
-                              discoveryMode() === 'custom'
-                                ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
-                                : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
-                            }`}
-                          >
-                            <input
-                              type="radio"
-                              name="discoveryMode"
-                              value="custom"
-                              checked={discoveryMode() === 'custom'}
-                              onChange={() => {
-                                if (discoveryMode() !== 'custom') {
-                                  handleDiscoveryModeChange('custom');
-                                }
-                              }}
-                              disabled={envOverrides().discoverySubnet || savingDiscoverySettings()}
-                              class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
-                            />
-                            <div class="space-y-1">
-                              <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                Custom subnet (faster)
-                              </p>
-                              <p class="text-xs text-gray-500 dark:text-gray-400">
-                                Limit discovery to one or more CIDR ranges to finish faster on large networks.
-                              </p>
-                            </div>
-                          </label>
-                          <Show when={discoveryMode() === 'custom'}>
-                            <div class="flex flex-wrap items-center gap-2 pl-9 pr-2">
-                              <span class="text-[0.68rem] uppercase tracking-wide text-gray-500 dark:text-gray-400">
-                                Common networks:
-                              </span>
-                              <For each={COMMON_DISCOVERY_SUBNETS}>
-                                {(preset) => {
-                                  const baseValue = currentDraftSubnetValue();
-                                  const currentSelections = parseSubnetList(baseValue);
-                                  const isActive = currentSelections.includes(preset);
-                                  return (
-                                    <button
-                                      type="button"
-                                      class={`rounded border px-2.5 py-1 text-[0.7rem] transition-colors ${
-                                        isActive
-                                          ? 'border-blue-500 bg-blue-600 text-white dark:border-blue-400 dark:bg-blue-500'
-                                          : 'border-gray-300 text-gray-700 hover:border-blue-400 hover:bg-blue-50 dark:border-gray-600 dark:text-gray-300 dark:hover:border-blue-500 dark:hover:bg-blue-900/30'
-                                      }`}
-                                      onClick={async () => {
-                                        if (envOverrides().discoverySubnet) {
-                                          return;
-                                        }
-                                        let selections = [...currentSelections];
-                                        if (isActive) {
-                                          selections = selections.filter((item) => item !== preset);
-                                        } else {
-                                          selections.push(preset);
-                                        }
-
-                                        if (selections.length === 0) {
-                                          setDiscoverySubnetDraft('');
-                                          setLastCustomSubnet('');
-                                          setDiscoverySubnetError(
-                                            'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)',
-                                          );
-                                          return;
-                                        }
-
-                                        const updatedValue = normalizeSubnetList(selections.join(', '));
-                                        setDiscoveryMode('custom');
-                                        setDiscoverySubnetDraft(updatedValue);
-                                        setLastCustomSubnet(updatedValue);
-                                        setDiscoverySubnetError(undefined);
-                                        await commitDiscoverySubnet(updatedValue);
-                                      }}
-                                      disabled={envOverrides().discoverySubnet}
-                                      classList={{
-                                        'cursor-not-allowed opacity-60': envOverrides().discoverySubnet,
-                                      }}
-                                    >
-                                      {preset}
-                                    </button>
-                                  );
-                                }}
-                              </For>
-                            </div>
-                          </Show>
-                        </div>
-                      </fieldset>
-
-                      <div class="space-y-2">
-                        <div class="flex items-center justify-between gap-2">
-                          <label
-                            for="discoverySubnetInput"
-                            class="text-xs font-medium text-gray-700 dark:text-gray-300"
-                          >
-                            Discovery subnet
-                          </label>
-                          <span
-                            class="text-gray-400 hover:text-gray-500 dark:text-gray-500 dark:hover:text-gray-300 cursor-help"
-                            title="Use CIDR notation (comma-separated for multiple), e.g. 192.168.1.0/24, 10.0.0.0/24. Smaller ranges keep scans quick."
-                          >
+                        >
+                          <div class="text-center py-6 text-gray-500 dark:text-gray-400 bg-gray-50 dark:bg-gray-800/50 rounded-lg border-2 border-dashed border-gray-300 dark:border-gray-600">
                             <svg
-                              class="h-4 w-4"
+                              class="h-8 w-8 mx-auto mb-2 animate-pulse text-purple-500"
                               viewBox="0 0 24 24"
                               fill="none"
                               stroke="currentColor"
                               stroke-width="2"
                             >
-                              <circle cx="12" cy="12" r="10"></circle>
-                              <path d="M12 16v-4"></path>
-                              <path d="M12 8h.01"></path>
+                              <circle cx="11" cy="11" r="8" />
+                              <path d="m21 21-4.35-4.35" />
                             </svg>
-                          </span>
+                            <p class="text-sm">Scanning for PMG servers...</p>
+                          </div>
+                        </Show>
+                        <For each={discoveredNodes().filter((n) => n.type === 'pmg')}>
+                          {(server) => (
+                            <div
+                              class="bg-gradient-to-r from-purple-50 to-transparent dark:from-purple-900/20 dark:to-transparent border-l-4 border-purple-500 rounded-lg p-4 cursor-pointer hover:shadow-md transition-all"
+                              onClick={() => {
+                                setEditingNode(null);
+                                setCurrentNodeType('pmg');
+                                setModalResetKey((prev) => prev + 1);
+                                setShowNodeModal(true);
+                                setTimeout(() => {
+                                  const hostInput = document.querySelector(
+                                    'input[placeholder*="192.168"]',
+                                  ) as HTMLInputElement;
+                                  if (hostInput) {
+                                    hostInput.value = server.ip;
+                                    hostInput.dispatchEvent(new Event('input', { bubbles: true }));
+                                  }
+                                }, 50);
+                              }}
+                            >
+                              <div class="flex items-start justify-between">
+                                <div class="flex items-start gap-3 flex-1 min-w-0">
+                                  <svg
+                                    width="24"
+                                    height="24"
+                                    viewBox="0 0 24 24"
+                                    fill="none"
+                                    stroke="currentColor"
+                                    stroke-width="2"
+                                    class="text-purple-500 flex-shrink-0 mt-0.5"
+                                  >
+                                    <path d="M4 4h16c1.1 0 2 .9 2 2v12c0 1.1-.9 2-2 2H4c-1.1 0-2-.9-2-2V6c0-1.1.9-2 2-2z"></path>
+                                    <polyline points="22,6 12,13 2,6"></polyline>
+                                  </svg>
+                                  <div class="flex-1 min-w-0">
+                                    <h4 class="font-medium text-gray-900 dark:text-gray-100 truncate">
+                                      {server.hostname || `PMG at ${server.ip}`}
+                                    </h4>
+                                    <p class="text-sm text-gray-500 dark:text-gray-500 mt-1">
+                                      {server.ip}:{server.port}
+                                    </p>
+                                    <div class="flex items-center gap-2 mt-2">
+                                      <span class="text-xs px-2 py-1 bg-green-100 dark:bg-green-900/30 text-green-700 dark:text-green-400 rounded">
+                                        Discovered
+                                      </span>
+                                      <span class="text-xs text-gray-500 dark:text-gray-400">
+                                        Click to configure
+                                      </span>
+                                    </div>
+                                  </div>
+                                </div>
+                                <svg
+                                  width="20"
+                                  height="20"
+                                  viewBox="0 0 24 24"
+                                  fill="none"
+                                  class="text-gray-400 mt-1"
+                                >
+                                  <path
+                                    d="M12 5v14m-7-7h14"
+                                    stroke="currentColor"
+                                    stroke-width="2"
+                                    stroke-linecap="round"
+                                  />
+                                </svg>
+                              </div>
+                            </div>
+                          )}
+                        </For>
+                      </div>
+                    </Show>
+                  </div>
+                </div>
+              </Show>
+              {/* Docker Tab */}
+              <Show when={activeTab() === 'proxmox' && selectedAgent() === 'docker'}>
+                <div class="space-y-6 mt-6">
+                  <DockerAgents />
+                </div>
+              </Show>
+
+              {/* Docker Platform Tab */}
+              <Show when={activeTab() === 'docker'}>
+                <DockerAgents />
+              </Show>
+
+              {/* Servers Platform Tab */}
+              <Show when={activeTab() === 'hosts'}>
+                <HostAgents />
+              </Show>
+
+              {/* Host Agents */}
+              <Show when={activeTab() === 'proxmox' && selectedAgent() === 'host'}>
+                <div class="space-y-6 mt-6">
+                  <HostAgents />
+                </div>
+              </Show>
+
+              {/* System General Tab */}
+              <Show when={activeTab() === 'system-general'}>
+                <div class="space-y-6">
+                  <Card
+                    padding="none"
+                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                    border={false}
+                  >
+                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+                      <div class="flex items-center gap-3">
+                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                          <Sliders
+                            class="w-5 h-5 text-blue-600 dark:text-blue-300"
+                            strokeWidth={2}
+                          />
                         </div>
-                        <input
-                          id="discoverySubnetInput"
-                          ref={(el) => {
-                            discoverySubnetInputRef = el;
-                          }}
-                          type="text"
-                          value={discoverySubnetDraft()}
-                          placeholder={
-                            discoveryMode() === 'auto'
-                              ? 'auto (scan every network phase)'
-                              : '192.168.1.0/24, 10.0.0.0/24'
-                          }
-                          class={`w-full rounded-lg border px-3 py-2 text-sm transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 ${
-                            envOverrides().discoverySubnet
-                              ? 'border-amber-300 bg-amber-50 text-amber-800 dark:border-amber-600 dark:bg-amber-900/20 dark:text-amber-200 cursor-not-allowed opacity-60'
-                              : 'border-gray-300 bg-white dark:border-gray-600 dark:bg-gray-900/70'
-                          }`}
-                          disabled={envOverrides().discoverySubnet}
-                          onInput={(e) => {
-                            if (envOverrides().discoverySubnet) {
-                              return;
-                            }
-                            const rawValue = e.currentTarget.value;
-                            setDiscoverySubnetDraft(rawValue);
-                            if (discoveryMode() !== 'custom') {
-                              setDiscoveryMode('custom');
-                            }
-                            setLastCustomSubnet(rawValue);
-                            const trimmed = rawValue.trim();
-                            if (!trimmed) {
-                              setDiscoverySubnetError(undefined);
-                              return;
-                            }
-                            if (!isValidCIDR(trimmed)) {
-                              setDiscoverySubnetError('Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)');
-                            } else {
-                              setDiscoverySubnetError(undefined);
-                            }
-                          }}
-                          onBlur={async (e) => {
-                            if (envOverrides().discoverySubnet || discoveryMode() !== 'custom') {
-                              return;
-                            }
-                            const rawValue = e.currentTarget.value;
-                            setDiscoverySubnetDraft(rawValue);
-                            const trimmed = rawValue.trim();
-                            if (!trimmed) {
-                              setDiscoverySubnetError(
-                                'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)',
-                              );
-                              return;
-                            }
-                            if (!isValidCIDR(trimmed)) {
-                              setDiscoverySubnetError('Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)');
-                              return;
-                            }
-                            setDiscoverySubnetError(undefined);
-                            await commitDiscoverySubnet(rawValue);
-                          }}
-                          onKeyDown={(e) => {
-                            if (e.key === 'Enter') {
-                              e.preventDefault();
-                              (e.currentTarget as HTMLInputElement).blur();
+                        <SectionHeader
+                          title="General"
+                          description="Appearance and display preferences"
+                          size="sm"
+                          class="flex-1"
+                        />
+                      </div>
+                    </div>
+                    <div class="p-6 space-y-5">
+                      <div class="flex items-center justify-between gap-3">
+                        <div class="text-sm text-gray-600 dark:text-gray-400">
+                          <p class="font-medium text-gray-900 dark:text-gray-100">Dark mode</p>
+                          <p class="text-xs text-gray-500 dark:text-gray-400">
+                            Toggle to match your environment. Pulse remembers this preference on
+                            each browser.
+                          </p>
+                        </div>
+                        <Toggle
+                          checked={props.darkMode()}
+                          onChange={(event) => {
+                            const desired = (event.currentTarget as HTMLInputElement).checked;
+                            if (desired !== props.darkMode()) {
+                              props.toggleDarkMode();
                             }
                           }}
                         />
-                        <Show when={discoverySubnetError()}>
-                          <p class="text-xs text-red-600 dark:text-red-400">
-                            {discoverySubnetError()}
-                          </p>
-                        </Show>
-                        <Show when={!discoverySubnetError() && discoveryMode() === 'auto'}>
-                          <p class="text-xs text-gray-500 dark:text-gray-400">
-                            Auto scans every reachable network phase. Large networks may time out —
-                            switch to custom subnets to narrow the search.
-                          </p>
-                        </Show>
-                        <Show when={!discoverySubnetError() && discoveryMode() === 'custom'}>
-                          <p class="text-xs text-gray-500 dark:text-gray-400">
-                            Example: 192.168.1.0/24, 10.0.0.0/24 (comma-separated). Smaller ranges finish faster and avoid timeouts.
-                          </p>
-                        </Show>
                       </div>
                     </div>
-                  </Show>
+                  </Card>
+                </div>
+              </Show>
 
-                  <Show when={envOverrides().discoveryEnabled || envOverrides().discoverySubnet}>
-                    <div class="rounded-lg border border-amber-200 bg-amber-100/80 p-3 text-xs text-amber-800 dark:border-amber-700 dark:bg-amber-900/20 dark:text-amber-200">
-                      Discovery settings are locked by environment variables. Update the service
-                      configuration and restart Pulse to change them here.
-                    </div>
-                  </Show>
-                  </section>
-
-                  <section class="space-y-3">
-                      <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
-                        <svg
-                          width="16"
-                          height="16"
-                          viewBox="0 0 24 24"
-                          fill="none"
-                          stroke="currentColor"
+              {/* System Network Tab */}
+              <Show when={activeTab() === 'system-network'}>
+                <div class="space-y-6">
+                  <Card
+                    tone="info"
+                    padding="md"
+                    border={false}
+                    class="border border-blue-200 dark:border-blue-800"
+                  >
+                    <div class="flex items-start gap-3">
+                      <svg
+                        class="w-5 h-5 text-blue-600 dark:text-blue-400 mt-0.5 flex-shrink-0"
+                        fill="none"
+                        stroke="currentColor"
+                        viewBox="0 0 24 24"
+                      >
+                        <path
+                          stroke-linecap="round"
+                          stroke-linejoin="round"
                           stroke-width="2"
-                        >
-                          <circle cx="12" cy="12" r="10"></circle>
-                          <path d="M2 12h20M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10 15.3 15.3 0 01-4-10 15.3 15.3 0 014-10z"></path>
-                        </svg>
-                        Network Settings
-                      </h4>
-                      <div class="space-y-2">
-                        <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                          CORS Allowed Origins
-                        </label>
-                        <p class="text-xs text-gray-600 dark:text-gray-400">
-                          For reverse proxy setups (* = allow all, empty = same-origin only)
-                        </p>
-                        <div class="relative">
-                          <input
-                            type="text"
-                            value={allowedOrigins()}
-                            onChange={(e) => {
-                              if (!envOverrides().allowedOrigins) {
-                                setAllowedOrigins(e.currentTarget.value);
-                                setHasUnsavedChanges(true);
+                          d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+                        />
+                      </svg>
+                      <div class="text-sm text-blue-800 dark:text-blue-200">
+                        <p class="font-medium mb-1">Configuration Priority</p>
+                        <ul class="space-y-1">
+                          <li>
+                            • Some env vars override settings (API_TOKENS, legacy API_TOKEN, PORTS,
+                            AUTH)
+                          </li>
+                          <li>• Changes made here are saved to system.json immediately</li>
+                          <li>• Settings persist unless overridden by env vars</li>
+                        </ul>
+                      </div>
+                    </div>
+                  </Card>
+                  <Card
+                    padding="none"
+                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                    border={false}
+                  >
+                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+                      <div class="flex items-center gap-3">
+                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                          <Network
+                            class="w-5 h-5 text-blue-600 dark:text-blue-300"
+                            strokeWidth={2}
+                          />
+                        </div>
+                        <SectionHeader
+                          title="Network"
+                          description="Discovery, CORS, and embedding settings"
+                          size="sm"
+                          class="flex-1"
+                        />
+                      </div>
+                    </div>
+                    <div class="p-6 space-y-8">
+                      <section class="space-y-5">
+                        <SectionHeader
+                          title="Network discovery"
+                          description="Control how Pulse scans for Proxmox services on your network."
+                          size="sm"
+                          align="left"
+                        />
+                        <div class="flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between">
+                          <div class="text-sm text-gray-600 dark:text-gray-400">
+                            <p class="font-medium text-gray-900 dark:text-gray-100">
+                              Automatic scanning
+                            </p>
+                            <p class="text-xs text-gray-500 dark:text-gray-400">
+                              Enable discovery to surface Proxmox VE, PBS, and PMG endpoints
+                              automatically.
+                            </p>
+                          </div>
+                          <Toggle
+                            checked={discoveryEnabled()}
+                            onChange={async (e: ToggleChangeEvent) => {
+                              if (envOverrides().discoveryEnabled || savingDiscoverySettings()) {
+                                e.preventDefault();
+                                return;
+                              }
+                              const success = await handleDiscoveryEnabledChange(
+                                e.currentTarget.checked,
+                              );
+                              if (!success) {
+                                e.currentTarget.checked = discoveryEnabled();
                               }
                             }}
-                            disabled={envOverrides().allowedOrigins}
-                            placeholder="* or https://example.com"
-                            class={`w-full px-3 py-1.5 text-sm border rounded-lg ${
-                              envOverrides().allowedOrigins
-                                ? 'border-amber-300 dark:border-amber-600 bg-amber-50 dark:bg-amber-900/20 cursor-not-allowed opacity-75'
-                                : 'border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800'
-                            }`}
+                            disabled={envOverrides().discoveryEnabled || savingDiscoverySettings()}
+                            containerClass="gap-2"
+                            label={
+                              <span class="text-xs font-medium text-gray-600 dark:text-gray-400">
+                                {discoveryEnabled() ? 'On' : 'Off'}
+                              </span>
+                            }
                           />
-                          {envOverrides().allowedOrigins && (
-                            <div class="mt-2 p-2 bg-amber-100 dark:bg-amber-900/30 border border-amber-300 dark:border-amber-700 rounded text-xs text-amber-800 dark:text-amber-200">
-                              <div class="flex items-center gap-1">
+                        </div>
+
+                        <Show when={discoveryEnabled()}>
+                          <div class="space-y-4 rounded-lg border border-gray-200 bg-white/40 p-3 dark:border-gray-600 dark:bg-gray-800/40">
+                            <fieldset class="space-y-2">
+                              <legend class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                                Scan scope
+                              </legend>
+                              <div class="space-y-2">
+                                <label
+                                  class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${
+                                    discoveryMode() === 'auto'
+                                      ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
+                                      : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
+                                  }`}
+                                >
+                                  <input
+                                    type="radio"
+                                    name="discoveryMode"
+                                    value="auto"
+                                    checked={discoveryMode() === 'auto'}
+                                    onChange={async () => {
+                                      if (discoveryMode() !== 'auto') {
+                                        await handleDiscoveryModeChange('auto');
+                                      }
+                                    }}
+                                    disabled={
+                                      envOverrides().discoverySubnet || savingDiscoverySettings()
+                                    }
+                                    class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
+                                  />
+                                  <div class="space-y-1">
+                                    <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                      Auto (slower, full scan)
+                                    </p>
+                                    <p class="text-xs text-gray-500 dark:text-gray-400">
+                                      Scans container, local, and gateway networks. Large networks
+                                      may time out after two minutes.
+                                    </p>
+                                  </div>
+                                </label>
+
+                                <label
+                                  class={`flex items-start gap-3 rounded-lg border p-2 transition-colors ${
+                                    discoveryMode() === 'custom'
+                                      ? 'border-blue-200 bg-blue-50/80 dark:border-blue-700 dark:bg-blue-900/20'
+                                      : 'border-transparent hover:border-gray-200 dark:hover:border-gray-600'
+                                  }`}
+                                >
+                                  <input
+                                    type="radio"
+                                    name="discoveryMode"
+                                    value="custom"
+                                    checked={discoveryMode() === 'custom'}
+                                    onChange={() => {
+                                      if (discoveryMode() !== 'custom') {
+                                        handleDiscoveryModeChange('custom');
+                                      }
+                                    }}
+                                    disabled={
+                                      envOverrides().discoverySubnet || savingDiscoverySettings()
+                                    }
+                                    class="mt-1 h-4 w-4 border-gray-300 text-blue-600 focus:ring-blue-500"
+                                  />
+                                  <div class="space-y-1">
+                                    <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                      Custom subnet (faster)
+                                    </p>
+                                    <p class="text-xs text-gray-500 dark:text-gray-400">
+                                      Limit discovery to one or more CIDR ranges to finish faster on
+                                      large networks.
+                                    </p>
+                                  </div>
+                                </label>
+                                <Show when={discoveryMode() === 'custom'}>
+                                  <div class="flex flex-wrap items-center gap-2 pl-9 pr-2">
+                                    <span class="text-[0.68rem] uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                      Common networks:
+                                    </span>
+                                    <For each={COMMON_DISCOVERY_SUBNETS}>
+                                      {(preset) => {
+                                        const baseValue = currentDraftSubnetValue();
+                                        const currentSelections = parseSubnetList(baseValue);
+                                        const isActive = currentSelections.includes(preset);
+                                        return (
+                                          <button
+                                            type="button"
+                                            class={`rounded border px-2.5 py-1 text-[0.7rem] transition-colors ${
+                                              isActive
+                                                ? 'border-blue-500 bg-blue-600 text-white dark:border-blue-400 dark:bg-blue-500'
+                                                : 'border-gray-300 text-gray-700 hover:border-blue-400 hover:bg-blue-50 dark:border-gray-600 dark:text-gray-300 dark:hover:border-blue-500 dark:hover:bg-blue-900/30'
+                                            }`}
+                                            onClick={async () => {
+                                              if (envOverrides().discoverySubnet) {
+                                                return;
+                                              }
+                                              let selections = [...currentSelections];
+                                              if (isActive) {
+                                                selections = selections.filter(
+                                                  (item) => item !== preset,
+                                                );
+                                              } else {
+                                                selections.push(preset);
+                                              }
+
+                                              if (selections.length === 0) {
+                                                setDiscoverySubnetDraft('');
+                                                setLastCustomSubnet('');
+                                                setDiscoverySubnetError(
+                                                  'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)',
+                                                );
+                                                return;
+                                              }
+
+                                              const updatedValue = normalizeSubnetList(
+                                                selections.join(', '),
+                                              );
+                                              setDiscoveryMode('custom');
+                                              setDiscoverySubnetDraft(updatedValue);
+                                              setLastCustomSubnet(updatedValue);
+                                              setDiscoverySubnetError(undefined);
+                                              await commitDiscoverySubnet(updatedValue);
+                                            }}
+                                            disabled={envOverrides().discoverySubnet}
+                                            classList={{
+                                              'cursor-not-allowed opacity-60':
+                                                envOverrides().discoverySubnet,
+                                            }}
+                                          >
+                                            {preset}
+                                          </button>
+                                        );
+                                      }}
+                                    </For>
+                                  </div>
+                                </Show>
+                              </div>
+                            </fieldset>
+
+                            <div class="space-y-2">
+                              <div class="flex items-center justify-between gap-2">
+                                <label
+                                  for="discoverySubnetInput"
+                                  class="text-xs font-medium text-gray-700 dark:text-gray-300"
+                                >
+                                  Discovery subnet
+                                </label>
+                                <span
+                                  class="text-gray-400 hover:text-gray-500 dark:text-gray-500 dark:hover:text-gray-300 cursor-help"
+                                  title="Use CIDR notation (comma-separated for multiple), e.g. 192.168.1.0/24, 10.0.0.0/24. Smaller ranges keep scans quick."
+                                >
+                                  <svg
+                                    class="h-4 w-4"
+                                    viewBox="0 0 24 24"
+                                    fill="none"
+                                    stroke="currentColor"
+                                    stroke-width="2"
+                                  >
+                                    <circle cx="12" cy="12" r="10"></circle>
+                                    <path d="M12 16v-4"></path>
+                                    <path d="M12 8h.01"></path>
+                                  </svg>
+                                </span>
+                              </div>
+                              <input
+                                id="discoverySubnetInput"
+                                ref={(el) => {
+                                  discoverySubnetInputRef = el;
+                                }}
+                                type="text"
+                                value={discoverySubnetDraft()}
+                                placeholder={
+                                  discoveryMode() === 'auto'
+                                    ? 'auto (scan every network phase)'
+                                    : '192.168.1.0/24, 10.0.0.0/24'
+                                }
+                                class={`w-full rounded-lg border px-3 py-2 text-sm transition-colors focus:outline-none focus:ring-2 focus:ring-blue-500 ${
+                                  envOverrides().discoverySubnet
+                                    ? 'border-amber-300 bg-amber-50 text-amber-800 dark:border-amber-600 dark:bg-amber-900/20 dark:text-amber-200 cursor-not-allowed opacity-60'
+                                    : 'border-gray-300 bg-white dark:border-gray-600 dark:bg-gray-900/70'
+                                }`}
+                                disabled={envOverrides().discoverySubnet}
+                                onInput={(e) => {
+                                  if (envOverrides().discoverySubnet) {
+                                    return;
+                                  }
+                                  const rawValue = e.currentTarget.value;
+                                  setDiscoverySubnetDraft(rawValue);
+                                  if (discoveryMode() !== 'custom') {
+                                    setDiscoveryMode('custom');
+                                  }
+                                  setLastCustomSubnet(rawValue);
+                                  const trimmed = rawValue.trim();
+                                  if (!trimmed) {
+                                    setDiscoverySubnetError(undefined);
+                                    return;
+                                  }
+                                  if (!isValidCIDR(trimmed)) {
+                                    setDiscoverySubnetError(
+                                      'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)',
+                                    );
+                                  } else {
+                                    setDiscoverySubnetError(undefined);
+                                  }
+                                }}
+                                onBlur={async (e) => {
+                                  if (
+                                    envOverrides().discoverySubnet ||
+                                    discoveryMode() !== 'custom'
+                                  ) {
+                                    return;
+                                  }
+                                  const rawValue = e.currentTarget.value;
+                                  setDiscoverySubnetDraft(rawValue);
+                                  const trimmed = rawValue.trim();
+                                  if (!trimmed) {
+                                    setDiscoverySubnetError(
+                                      'Enter at least one subnet in CIDR format (e.g., 192.168.1.0/24)',
+                                    );
+                                    return;
+                                  }
+                                  if (!isValidCIDR(trimmed)) {
+                                    setDiscoverySubnetError(
+                                      'Use CIDR format such as 192.168.1.0/24 (comma-separated for multiple)',
+                                    );
+                                    return;
+                                  }
+                                  setDiscoverySubnetError(undefined);
+                                  await commitDiscoverySubnet(rawValue);
+                                }}
+                                onKeyDown={(e) => {
+                                  if (e.key === 'Enter') {
+                                    e.preventDefault();
+                                    (e.currentTarget as HTMLInputElement).blur();
+                                  }
+                                }}
+                              />
+                              <Show when={discoverySubnetError()}>
+                                <p class="text-xs text-red-600 dark:text-red-400">
+                                  {discoverySubnetError()}
+                                </p>
+                              </Show>
+                              <Show when={!discoverySubnetError() && discoveryMode() === 'auto'}>
+                                <p class="text-xs text-gray-500 dark:text-gray-400">
+                                  Auto scans every reachable network phase. Large networks may time
+                                  out — switch to custom subnets to narrow the search.
+                                </p>
+                              </Show>
+                              <Show when={!discoverySubnetError() && discoveryMode() === 'custom'}>
+                                <p class="text-xs text-gray-500 dark:text-gray-400">
+                                  Example: 192.168.1.0/24, 10.0.0.0/24 (comma-separated). Smaller
+                                  ranges finish faster and avoid timeouts.
+                                </p>
+                              </Show>
+                            </div>
+                          </div>
+                        </Show>
+
+                        <Show
+                          when={envOverrides().discoveryEnabled || envOverrides().discoverySubnet}
+                        >
+                          <div class="rounded-lg border border-amber-200 bg-amber-100/80 p-3 text-xs text-amber-800 dark:border-amber-700 dark:bg-amber-900/20 dark:text-amber-200">
+                            Discovery settings are locked by environment variables. Update the
+                            service configuration and restart Pulse to change them here.
+                          </div>
+                        </Show>
+                      </section>
+
+                      <section class="space-y-3">
+                        <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+                          <svg
+                            width="16"
+                            height="16"
+                            viewBox="0 0 24 24"
+                            fill="none"
+                            stroke="currentColor"
+                            stroke-width="2"
+                          >
+                            <circle cx="12" cy="12" r="10"></circle>
+                            <path d="M2 12h20M12 2a15.3 15.3 0 014 10 15.3 15.3 0 01-4 10 15.3 15.3 0 01-4-10 15.3 15.3 0 014-10z"></path>
+                          </svg>
+                          Network Settings
+                        </h4>
+                        <div class="space-y-2">
+                          <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                            CORS Allowed Origins
+                          </label>
+                          <p class="text-xs text-gray-600 dark:text-gray-400">
+                            For reverse proxy setups (* = allow all, empty = same-origin only)
+                          </p>
+                          <div class="relative">
+                            <input
+                              type="text"
+                              value={allowedOrigins()}
+                              onChange={(e) => {
+                                if (!envOverrides().allowedOrigins) {
+                                  setAllowedOrigins(e.currentTarget.value);
+                                  setHasUnsavedChanges(true);
+                                }
+                              }}
+                              disabled={envOverrides().allowedOrigins}
+                              placeholder="* or https://example.com"
+                              class={`w-full px-3 py-1.5 text-sm border rounded-lg ${
+                                envOverrides().allowedOrigins
+                                  ? 'border-amber-300 dark:border-amber-600 bg-amber-50 dark:bg-amber-900/20 cursor-not-allowed opacity-75'
+                                  : 'border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800'
+                              }`}
+                            />
+                            {envOverrides().allowedOrigins && (
+                              <div class="mt-2 p-2 bg-amber-100 dark:bg-amber-900/30 border border-amber-300 dark:border-amber-700 rounded text-xs text-amber-800 dark:text-amber-200">
+                                <div class="flex items-center gap-1">
+                                  <svg
+                                    class="w-4 h-4"
+                                    fill="none"
+                                    stroke="currentColor"
+                                    viewBox="0 0 24 24"
+                                  >
+                                    <path
+                                      stroke-linecap="round"
+                                      stroke-linejoin="round"
+                                      stroke-width="2"
+                                      d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                                    />
+                                  </svg>
+                                  <span>Overridden by ALLOWED_ORIGINS environment variable</span>
+                                </div>
+                                <div class="mt-1 text-amber-700 dark:text-amber-300">
+                                  Remove the env var and restart to enable UI configuration
+                                </div>
+                              </div>
+                            )}
+                          </div>
+                        </div>
+                      </section>
+
+                      <section class="space-y-3">
+                        <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+                          <svg
+                            width="16"
+                            height="16"
+                            viewBox="0 0 24 24"
+                            fill="none"
+                            stroke="currentColor"
+                            stroke-width="2"
+                          >
+                            <rect x="3" y="4" width="18" height="14" rx="2"></rect>
+                            <path d="M7 20h10"></path>
+                          </svg>
+                          Embedding
+                        </h4>
+                        <p class="text-xs text-gray-600 dark:text-gray-400">
+                          Allow Pulse to be embedded in iframes (e.g., Homepage dashboard)
+                        </p>
+                        <div class="space-y-3">
+                          <div class="flex items-center gap-2">
+                            <input
+                              type="checkbox"
+                              id="allowEmbedding"
+                              checked={allowEmbedding()}
+                              onChange={(e) => {
+                                setAllowEmbedding(e.currentTarget.checked);
+                                setHasUnsavedChanges(true);
+                              }}
+                              class="rounded border-gray-300 dark:border-gray-600 text-blue-600 focus:ring-blue-500"
+                            />
+                            <label
+                              for="allowEmbedding"
+                              class="text-sm text-gray-700 dark:text-gray-300"
+                            >
+                              Allow iframe embedding
+                            </label>
+                          </div>
+
+                          <Show when={allowEmbedding()}>
+                            <div class="space-y-2">
+                              <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                                Allowed Embed Origins (optional)
+                              </label>
+                              <p class="text-xs text-gray-600 dark:text-gray-400">
+                                Comma-separated list of origins that can embed Pulse (leave empty
+                                for same-origin only)
+                              </p>
+                              <input
+                                type="text"
+                                value={allowedEmbedOrigins()}
+                                onChange={(e) => {
+                                  setAllowedEmbedOrigins(e.currentTarget.value);
+                                  setHasUnsavedChanges(true);
+                                }}
+                                placeholder="https://my.domain, https://dashboard.example.com"
+                                class="w-full px-3 py-1.5 text-sm border rounded-lg border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800"
+                              />
+                              <p class="text-xs text-gray-500 dark:text-gray-400">
+                                Example: If Pulse is at <code>pulse.my.domain</code> and your
+                                dashboard is at <code>my.domain</code>, add{' '}
+                                <code>https://my.domain</code> here.
+                              </p>
+                            </div>
+                          </Show>
+                        </div>
+                      </section>
+
+                      <Card
+                        tone="warning"
+                        padding="sm"
+                        border={false}
+                        class="border border-amber-200 dark:border-amber-800"
+                      >
+                        <p class="text-xs text-amber-800 dark:text-amber-200 mb-2">
+                          <strong>Port Configuration:</strong> Use{' '}
+                          <code class="font-mono bg-amber-100 dark:bg-amber-800 px-1 rounded">
+                            systemctl edit pulse
+                          </code>
+                        </p>
+                        <p class="text-xs text-amber-700 dark:text-amber-300 font-mono">
+                          [Service]
+                          <br />
+                          Environment="FRONTEND_PORT=8080"
+                          <br />
+                          <span class="text-xs text-amber-600 dark:text-amber-400">
+                            Then restart: sudo systemctl restart pulse
+                          </span>
+                        </p>
+                      </Card>
+                    </div>
+                  </Card>
+                </div>
+              </Show>
+
+              {/* System Updates Tab */}
+              <Show when={activeTab() === 'system-updates'}>
+                <div class="space-y-6">
+                  <Card
+                    padding="none"
+                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                    border={false}
+                  >
+                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+                      <div class="flex items-center gap-3">
+                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                          <RefreshCw
+                            class="w-5 h-5 text-blue-600 dark:text-blue-300"
+                            strokeWidth={2}
+                          />
+                        </div>
+                        <SectionHeader
+                          title="Updates"
+                          description="Version checking and automatic update configuration"
+                          size="sm"
+                          class="flex-1"
+                        />
+                      </div>
+                    </div>
+                    <div class="p-6 space-y-6">
+                      <section class="space-y-4">
+                        <div class="space-y-4">
+                          <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                            <div>
+                              <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                Current Version
+                              </label>
+                              <p class="text-xs text-gray-600 dark:text-gray-400">
+                                {versionInfo()?.version || 'Loading...'}
+                                {versionInfo()?.isDevelopment && ' (Development)'}
+                                {versionInfo()?.isDocker && ' - Docker'}
+                              </p>
+                            </div>
+                            <button
+                              type="button"
+                              onClick={checkForUpdates}
+                              disabled={
+                                checkingForUpdates() ||
+                                versionInfo()?.isDocker ||
+                                versionInfo()?.isSourceBuild
+                              }
+                              class={`px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-2 ${
+                                versionInfo()?.isDocker || versionInfo()?.isSourceBuild
+                                  ? 'bg-gray-100 dark:bg-gray-700 text-gray-400 dark:text-gray-500 cursor-not-allowed'
+                                  : 'bg-blue-600 text-white hover:bg-blue-700'
+                              }`}
+                            >
+                              {checkingForUpdates() ? (
+                                <>
+                                  <div class="animate-spin h-4 w-4 border-2 border-white border-t-transparent rounded-full"></div>
+                                  Checking...
+                                </>
+                              ) : (
+                                <>Check for Updates</>
+                              )}
+                            </button>
+                          </div>
+
+                          <Show when={versionInfo()?.isDocker && !updateInfo()?.available}>
+                            <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
+                              <p class="text-xs text-blue-800 dark:text-blue-200">
+                                <strong>Docker Installation:</strong> Updates are managed through
+                                Docker. Pull the latest image to update.
+                              </p>
+                            </div>
+                          </Show>
+
+                          <Show when={versionInfo()?.isSourceBuild}>
+                            <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
+                              <p class="text-xs text-blue-800 dark:text-blue-200">
+                                <strong>Built from source:</strong> Pull the latest code from git
+                                and rebuild to update.
+                              </p>
+                            </div>
+                          </Show>
+
+                          <Show when={Boolean(updateInfo()?.warning)}>
+                            <div class="p-3 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-700 rounded-lg">
+                              <p class="text-xs text-amber-800 dark:text-amber-200">
+                                {updateInfo()?.warning}
+                              </p>
+                            </div>
+                          </Show>
+
+                          <Show when={updateInfo()?.available}>
+                            <div class="p-3 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded-lg space-y-3">
+                              <div>
+                                <p class="text-sm font-medium text-green-800 dark:text-green-200">
+                                  Update Available: {updateInfo()?.latestVersion}
+                                </p>
+                                <p class="text-xs text-green-700 dark:text-green-300 mt-1">
+                                  Released:{' '}
+                                  {updateInfo()?.releaseDate
+                                    ? new Date(updateInfo()!.releaseDate).toLocaleDateString()
+                                    : 'Unknown'}
+                                </p>
+                              </div>
+
+                              <div class="p-2 bg-green-100 dark:bg-green-900/40 rounded space-y-2">
+                                <p class="text-xs font-medium text-green-800 dark:text-green-200">
+                                  How to update:
+                                </p>
+                                <Show when={versionInfo()?.deploymentType === 'proxmoxve'}>
+                                  <p class="text-xs text-green-700 dark:text-green-300">
+                                    Type{' '}
+                                    <code class="px-1 py-0.5 bg-green-200 dark:bg-green-800 rounded">
+                                      update
+                                    </code>{' '}
+                                    in the LXC console
+                                  </p>
+                                </Show>
+                                <Show when={versionInfo()?.deploymentType === 'docker'}>
+                                  <div class="text-xs text-green-700 dark:text-green-300 space-y-1">
+                                    <p>Run these commands:</p>
+                                    <code class="block p-1 bg-green-200 dark:bg-green-800 rounded text-xs">
+                                      docker pull rcourtman/pulse:latest
+                                      <br />
+                                      docker restart pulse
+                                    </code>
+                                  </div>
+                                </Show>
+                                <Show
+                                  when={
+                                    versionInfo()?.deploymentType === 'systemd' ||
+                                    versionInfo()?.deploymentType === 'manual'
+                                  }
+                                >
+                                  <div class="text-xs text-green-700 dark:text-green-300 space-y-1">
+                                    <p>Run the install script:</p>
+                                    <code class="block p-1 bg-green-200 dark:bg-green-800 rounded text-xs">
+                                      curl -fsSL
+                                      https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh
+                                      | bash
+                                    </code>
+                                  </div>
+                                </Show>
+                                <Show when={versionInfo()?.deploymentType === 'development'}>
+                                  <p class="text-xs text-green-700 dark:text-green-300">
+                                    Pull latest changes and rebuild
+                                  </p>
+                                </Show>
+                                <Show
+                                  when={!versionInfo()?.deploymentType && versionInfo()?.isDocker}
+                                >
+                                  <p class="text-xs text-green-700 dark:text-green-300">
+                                    Pull the latest Pulse Docker image and recreate your container.
+                                  </p>
+                                </Show>
+                              </div>
+
+                              <Show when={updateInfo()?.releaseNotes}>
+                                <details class="mt-1">
+                                  <summary class="text-xs text-green-700 dark:text-green-300 cursor-pointer">
+                                    Release Notes
+                                  </summary>
+                                  <pre class="mt-2 text-xs text-green-600 dark:text-green-400 whitespace-pre-wrap font-mono bg-green-100 dark:bg-green-900/30 p-2 rounded">
+                                    {updateInfo()?.releaseNotes}
+                                  </pre>
+                                </details>
+                              </Show>
+                            </div>
+                          </Show>
+
+                          <div class="border-t border-gray-200 dark:border-gray-600 pt-4 space-y-4">
+                            <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                              <div>
+                                <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                  Update Channel
+                                </label>
+                                <p class="text-xs text-gray-600 dark:text-gray-400">
+                                  Choose between stable and release candidate versions
+                                </p>
+                              </div>
+                              <select
+                                value={updateChannel()}
+                                onChange={(e) => {
+                                  setUpdateChannel(e.currentTarget.value as 'stable' | 'rc');
+                                  setHasUnsavedChanges(true);
+                                }}
+                                disabled={versionInfo()?.isDocker}
+                                class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                              >
+                                <option value="stable">Stable</option>
+                                <option value="rc">Release Candidate</option>
+                              </select>
+                            </div>
+
+                            <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                              <div>
+                                <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                  Update Checks
+                                </label>
+                                <p class="text-xs text-gray-600 dark:text-gray-400">
+                                  Automatically check for updates (installation is manual)
+                                </p>
+                              </div>
+                              <label class="relative inline-flex items-center cursor-pointer">
+                                <input
+                                  type="checkbox"
+                                  checked={autoUpdateEnabled()}
+                                  onChange={(e) => {
+                                    setAutoUpdateEnabled(e.currentTarget.checked);
+                                    setHasUnsavedChanges(true);
+                                  }}
+                                  disabled={versionInfo()?.isDocker}
+                                  class="sr-only peer"
+                                />
+                                <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
+                              </label>
+                            </div>
+
+                            <Show when={autoUpdateEnabled()}>
+                              <div class="space-y-4 rounded-md border border-gray-200 dark:border-gray-600 p-3">
+                                <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                                  <div>
+                                    <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                      Check Interval
+                                    </label>
+                                    <p class="text-xs text-gray-600 dark:text-gray-400">
+                                      How often to check for updates
+                                    </p>
+                                  </div>
+                                  <select
+                                    value={autoUpdateCheckInterval()}
+                                    onChange={(e) => {
+                                      setAutoUpdateCheckInterval(parseInt(e.currentTarget.value));
+                                      setHasUnsavedChanges(true);
+                                    }}
+                                    class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
+                                  >
+                                    <option value="6">Every 6 hours</option>
+                                    <option value="12">Every 12 hours</option>
+                                    <option value="24">Daily</option>
+                                    <option value="168">Weekly</option>
+                                  </select>
+                                </div>
+
+                                <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                                  <div>
+                                    <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                      Check Time
+                                    </label>
+                                    <p class="text-xs text-gray-600 dark:text-gray-400">
+                                      Preferred time to check for updates
+                                    </p>
+                                  </div>
+                                  <input
+                                    type="time"
+                                    value={autoUpdateTime()}
+                                    onChange={(e) => {
+                                      setAutoUpdateTime(e.currentTarget.value);
+                                      setHasUnsavedChanges(true);
+                                    }}
+                                    class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
+                                  />
+                                </div>
+                              </div>
+                            </Show>
+                          </div>
+                        </div>
+                      </section>
+                    </div>
+                  </Card>
+                </div>
+              </Show>
+
+              {/* System Backups Tab */}
+              <Show when={activeTab() === 'system-backups'}>
+                <div class="space-y-6">
+                  <Card
+                    padding="none"
+                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                    border={false}
+                  >
+                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+                      <div class="flex items-center gap-3">
+                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                          <Clock class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+                        </div>
+                        <SectionHeader
+                          title="Backups"
+                          description="Backup polling and configuration management"
+                          size="sm"
+                          class="flex-1"
+                        />
+                      </div>
+                    </div>
+                    <div class="p-6 space-y-8">
+                      <section class="space-y-3">
+                        <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
+                          <svg
+                            width="16"
+                            height="16"
+                            viewBox="0 0 24 24"
+                            fill="none"
+                            stroke="currentColor"
+                          >
+                            <circle cx="12" cy="12" r="9" stroke-width="2" />
+                            <path
+                              d="M12 7v5l3 3"
+                              stroke-width="2"
+                              stroke-linecap="round"
+                              stroke-linejoin="round"
+                            />
+                          </svg>
+                          Backup polling
+                        </h4>
+                        <p class="text-xs text-gray-600 dark:text-gray-400">
+                          Control how often Pulse queries Proxmox backup tasks, datastore contents,
+                          and guest snapshots. Longer intervals reduce disk activity and API load.
+                        </p>
+                        <div class="space-y-3">
+                          <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                            <div>
+                              <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                Enable backup polling
+                              </p>
+                              <p class="text-xs text-gray-600 dark:text-gray-400">
+                                Required for dashboard backup status, storage snapshots, and
+                                alerting.
+                              </p>
+                            </div>
+                            <label class="relative inline-flex items-center cursor-pointer">
+                              <input
+                                type="checkbox"
+                                class="sr-only peer"
+                                checked={backupPollingEnabled()}
+                                disabled={backupPollingEnvLocked()}
+                                onChange={(e) => {
+                                  setBackupPollingEnabled(e.currentTarget.checked);
+                                  if (!backupPollingEnvLocked()) {
+                                    setHasUnsavedChanges(true);
+                                  }
+                                }}
+                              />
+                              <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
+                            </label>
+                          </div>
+
+                          <Show when={backupPollingEnabled()}>
+                            <div class="space-y-3 rounded-md border border-gray-200 dark:border-gray-600 p-3">
+                              <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
+                                <div>
+                                  <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
+                                    Polling interval
+                                  </label>
+                                  <p class="text-xs text-gray-600 dark:text-gray-400">
+                                    {backupIntervalSummary()}
+                                  </p>
+                                </div>
+                                <select
+                                  value={backupIntervalSelectValue()}
+                                  disabled={backupPollingEnvLocked()}
+                                  onChange={(e) => {
+                                    const value = e.currentTarget.value;
+                                    if (value === 'custom') {
+                                      const minutes = Math.max(1, backupPollingCustomMinutes());
+                                      setBackupPollingInterval(minutes * 60);
+                                    } else {
+                                      const seconds = parseInt(value, 10);
+                                      if (!Number.isNaN(seconds)) {
+                                        setBackupPollingInterval(seconds);
+                                        if (seconds > 0) {
+                                          setBackupPollingCustomMinutes(
+                                            Math.max(1, Math.round(seconds / 60)),
+                                          );
+                                        }
+                                      }
+                                    }
+                                    if (!backupPollingEnvLocked()) {
+                                      setHasUnsavedChanges(true);
+                                    }
+                                  }}
+                                  class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                                >
+                                  <For each={BACKUP_INTERVAL_OPTIONS}>
+                                    {(option) => (
+                                      <option value={String(option.value)}>{option.label}</option>
+                                    )}
+                                  </For>
+                                  <option value="custom">Custom interval…</option>
+                                </select>
+                              </div>
+
+                              <Show when={backupIntervalSelectValue() === 'custom'}>
+                                <div class="space-y-2">
+                                  <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
+                                    Custom interval (minutes)
+                                  </label>
+                                  <div class="flex items-center gap-3">
+                                    <input
+                                      type="number"
+                                      min="1"
+                                      max={BACKUP_INTERVAL_MAX_MINUTES}
+                                      value={backupPollingCustomMinutes()}
+                                      disabled={backupPollingEnvLocked()}
+                                      onInput={(e) => {
+                                        const value = Number(e.currentTarget.value);
+                                        if (Number.isNaN(value)) {
+                                          return;
+                                        }
+                                        const clamped = Math.max(
+                                          1,
+                                          Math.min(BACKUP_INTERVAL_MAX_MINUTES, Math.floor(value)),
+                                        );
+                                        setBackupPollingCustomMinutes(clamped);
+                                        setBackupPollingInterval(clamped * 60);
+                                        if (!backupPollingEnvLocked()) {
+                                          setHasUnsavedChanges(true);
+                                        }
+                                      }}
+                                      class="w-24 px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                                    />
+                                    <span class="text-xs text-gray-500 dark:text-gray-400">
+                                      1 – {BACKUP_INTERVAL_MAX_MINUTES} minutes (≈7 days max)
+                                    </span>
+                                  </div>
+                                </div>
+                              </Show>
+                            </div>
+                          </Show>
+
+                          <Show when={backupPollingEnvLocked()}>
+                            <div class="flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 dark:border-amber-700 dark:bg-amber-900/20 p-3 text-xs text-amber-700 dark:text-amber-200">
+                              <svg
+                                class="w-4 h-4 flex-shrink-0 mt-0.5"
+                                fill="none"
+                                stroke="currentColor"
+                                viewBox="0 0 24 24"
+                              >
+                                <path
+                                  stroke-linecap="round"
+                                  stroke-linejoin="round"
+                                  stroke-width="2"
+                                  d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                                />
+                              </svg>
+                              <div>
+                                <p class="font-medium">Environment override detected</p>
+                                <p class="mt-1">
+                                  The <code class="font-mono">ENABLE_BACKUP_POLLING</code> or{' '}
+                                  <code class="font-mono">BACKUP_POLLING_INTERVAL</code> environment
+                                  variables are set. Remove them and restart Pulse to manage backup
+                                  polling here.
+                                </p>
+                              </div>
+                            </div>
+                          </Show>
+                        </div>
+                      </section>
+
+                      <SectionHeader
+                        title="Backup & restore"
+                        description="Backup your node configurations and credentials or restore from a previous backup."
+                        size="md"
+                        class="mb-4"
+                      />
+
+                      <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
+                        {/* Export Section */}
+                        <div class="border border-gray-200 dark:border-gray-700 rounded-lg p-4">
+                          <div class="flex items-start gap-3">
+                            <div class="flex-shrink-0 w-10 h-10 bg-blue-100 dark:bg-blue-900/30 rounded-lg flex items-center justify-center">
+                              <svg
+                                class="w-5 h-5 text-blue-600 dark:text-blue-400"
+                                fill="none"
+                                stroke="currentColor"
+                                viewBox="0 0 24 24"
+                              >
+                                <path
+                                  stroke-linecap="round"
+                                  stroke-linejoin="round"
+                                  stroke-width="2"
+                                  d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M9 19l3 3m0 0l3-3m-3 3V10"
+                                />
+                              </svg>
+                            </div>
+                            <div class="flex-1">
+                              <h4 class="text-sm font-medium text-gray-900 dark:text-gray-100 mb-1">
+                                Export Configuration
+                              </h4>
+                              <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
+                                Download an encrypted backup of all nodes and settings
+                              </p>
+                              <button
+                                type="button"
+                                onClick={() => {
+                                  // Default to custom passphrase if no auth is configured
+                                  setUseCustomPassphrase(!securityStatus()?.hasAuthentication);
+                                  setShowExportDialog(true);
+                                }}
+                                class="px-3 py-1.5 bg-blue-600 text-white text-sm rounded-md hover:bg-blue-700 transition-colors inline-flex items-center gap-2"
+                              >
                                 <svg
                                   class="w-4 h-4"
                                   fill="none"
@@ -3357,531 +4165,227 @@ const Settings: Component<SettingsProps> = (props) => {
                                     stroke-linecap="round"
                                     stroke-linejoin="round"
                                     stroke-width="2"
-                                    d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                                    d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"
                                   />
                                 </svg>
-                                <span>Overridden by ALLOWED_ORIGINS environment variable</span>
-                              </div>
-                              <div class="mt-1 text-amber-700 dark:text-amber-300">
-                                Remove the env var and restart to enable UI configuration
-                              </div>
+                                Export Backup
+                              </button>
                             </div>
-                          )}
-                        </div>
-                      </div>
-                    </section>
-
-                    <section class="space-y-3">
-                      <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
-                        <svg
-                          width="16"
-                          height="16"
-                          viewBox="0 0 24 24"
-                          fill="none"
-                          stroke="currentColor"
-                          stroke-width="2"
-                        >
-                          <rect x="3" y="4" width="18" height="14" rx="2"></rect>
-                          <path d="M7 20h10"></path>
-                        </svg>
-                        Embedding
-                      </h4>
-                      <p class="text-xs text-gray-600 dark:text-gray-400">
-                        Allow Pulse to be embedded in iframes (e.g., Homepage dashboard)
-                      </p>
-                      <div class="space-y-3">
-                        <div class="flex items-center gap-2">
-                          <input
-                            type="checkbox"
-                            id="allowEmbedding"
-                            checked={allowEmbedding()}
-                            onChange={(e) => {
-                              setAllowEmbedding(e.currentTarget.checked);
-                              setHasUnsavedChanges(true);
-                            }}
-                            class="rounded border-gray-300 dark:border-gray-600 text-blue-600 focus:ring-blue-500"
-                          />
-                          <label
-                            for="allowEmbedding"
-                            class="text-sm text-gray-700 dark:text-gray-300"
-                          >
-                            Allow iframe embedding
-                          </label>
+                          </div>
                         </div>
 
-                        <Show when={allowEmbedding()}>
-                          <div class="space-y-2">
-                            <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
-                              Allowed Embed Origins (optional)
-                            </label>
-                            <p class="text-xs text-gray-600 dark:text-gray-400">
-                              Comma-separated list of origins that can embed Pulse (leave empty for
-                              same-origin only)
-                            </p>
-                            <input
-                              type="text"
-                              value={allowedEmbedOrigins()}
-                              onChange={(e) => {
-                                setAllowedEmbedOrigins(e.currentTarget.value);
-                                setHasUnsavedChanges(true);
-                              }}
-                              placeholder="https://my.domain, https://dashboard.example.com"
-                              class="w-full px-3 py-1.5 text-sm border rounded-lg border-gray-300 dark:border-gray-600 bg-white dark:bg-gray-800"
-                            />
-                            <p class="text-xs text-gray-500 dark:text-gray-400">
-                              Example: If Pulse is at <code>pulse.my.domain</code> and your
-                              dashboard is at <code>my.domain</code>, add{' '}
-                              <code>https://my.domain</code> here.
-                            </p>
-                          </div>
-                        </Show>
-                      </div>
-                    </section>
-
-                    <Card
-                      tone="warning"
-                      padding="sm"
-                      border={false}
-                      class="border border-amber-200 dark:border-amber-800"
-                    >
-                      <p class="text-xs text-amber-800 dark:text-amber-200 mb-2">
-                        <strong>Port Configuration:</strong> Use{' '}
-                        <code class="font-mono bg-amber-100 dark:bg-amber-800 px-1 rounded">
-                          systemctl edit pulse
-                        </code>
-                      </p>
-                      <p class="text-xs text-amber-700 dark:text-amber-300 font-mono">
-                        [Service]
-                        <br />
-                        Environment="FRONTEND_PORT=8080"
-                        <br />
-                        <span class="text-xs text-amber-600 dark:text-amber-400">
-                          Then restart: sudo systemctl restart pulse
-                        </span>
-                      </p>
-                    </Card>
-                  </div>
-                </Card>
-              </div>
-            </Show>
-
-            {/* System Updates Tab */}
-            <Show when={activeTab() === 'system-updates'}>
-              <div class="space-y-6">
-                <Card
-                  padding="none"
-                  class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                  border={false}
-                >
-                  <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                    <div class="flex items-center gap-3">
-                      <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                        <RefreshCw class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
-                      </div>
-                      <SectionHeader
-                        title="Updates"
-                        description="Version checking and automatic update configuration"
-                        size="sm"
-                        class="flex-1"
-                      />
-                    </div>
-                  </div>
-                  <div class="p-6 space-y-6">
-                    <section class="space-y-4">
-                      <div class="space-y-4">
-                        <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                          <div>
-                            <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                              Current Version
-                            </label>
-                            <p class="text-xs text-gray-600 dark:text-gray-400">
-                              {versionInfo()?.version || 'Loading...'}
-                              {versionInfo()?.isDevelopment && ' (Development)'}
-                              {versionInfo()?.isDocker && ' - Docker'}
-                            </p>
-                          </div>
-                          <button
-                            type="button"
-                            onClick={checkForUpdates}
-                            disabled={
-                              checkingForUpdates() ||
-                              versionInfo()?.isDocker ||
-                              versionInfo()?.isSourceBuild
-                            }
-                            class={`px-4 py-2 text-sm rounded-lg transition-colors flex items-center gap-2 ${
-                              versionInfo()?.isDocker || versionInfo()?.isSourceBuild
-                                ? 'bg-gray-100 dark:bg-gray-700 text-gray-400 dark:text-gray-500 cursor-not-allowed'
-                                : 'bg-blue-600 text-white hover:bg-blue-700'
-                            }`}
-                          >
-                            {checkingForUpdates() ? (
-                              <>
-                                <div class="animate-spin h-4 w-4 border-2 border-white border-t-transparent rounded-full"></div>
-                                Checking...
-                              </>
-                            ) : (
-                              <>Check for Updates</>
-                            )}
-                          </button>
-                        </div>
-
-                        <Show when={versionInfo()?.isDocker && !updateInfo()?.available}>
-                          <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
-                            <p class="text-xs text-blue-800 dark:text-blue-200">
-                              <strong>Docker Installation:</strong> Updates are managed through
-                              Docker. Pull the latest image to update.
-                            </p>
-                          </div>
-                        </Show>
-
-                        <Show when={versionInfo()?.isSourceBuild}>
-                          <div class="p-3 bg-blue-50 dark:bg-blue-900/20 border border-blue-200 dark:border-blue-800 rounded-lg">
-                            <p class="text-xs text-blue-800 dark:text-blue-200">
-                              <strong>Built from source:</strong> Pull the latest code from git and
-                              rebuild to update.
-                            </p>
-                          </div>
-                        </Show>
-
-                        <Show when={Boolean(updateInfo()?.warning)}>
-                          <div class="p-3 bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-700 rounded-lg">
-                            <p class="text-xs text-amber-800 dark:text-amber-200">
-                              {updateInfo()?.warning}
-                            </p>
-                          </div>
-                        </Show>
-
-                        <Show when={updateInfo()?.available}>
-                          <div class="p-3 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded-lg space-y-3">
-                            <div>
-                              <p class="text-sm font-medium text-green-800 dark:text-green-200">
-                                Update Available: {updateInfo()?.latestVersion}
-                              </p>
-                              <p class="text-xs text-green-700 dark:text-green-300 mt-1">
-                                Released:{' '}
-                                {updateInfo()?.releaseDate
-                                  ? new Date(updateInfo()!.releaseDate).toLocaleDateString()
-                                  : 'Unknown'}
-                              </p>
-                            </div>
-
-                            <div class="p-2 bg-green-100 dark:bg-green-900/40 rounded space-y-2">
-                              <p class="text-xs font-medium text-green-800 dark:text-green-200">
-                                How to update:
-                              </p>
-                              <Show when={versionInfo()?.deploymentType === 'proxmoxve'}>
-                                <p class="text-xs text-green-700 dark:text-green-300">
-                                  Type{' '}
-                                  <code class="px-1 py-0.5 bg-green-200 dark:bg-green-800 rounded">
-                                    update
-                                  </code>{' '}
-                                  in the LXC console
-                                </p>
-                              </Show>
-                              <Show when={versionInfo()?.deploymentType === 'docker'}>
-                                <div class="text-xs text-green-700 dark:text-green-300 space-y-1">
-                                  <p>Run these commands:</p>
-                                  <code class="block p-1 bg-green-200 dark:bg-green-800 rounded text-xs">
-                                    docker pull rcourtman/pulse:latest
-                                    <br />
-                                    docker restart pulse
-                                  </code>
-                                </div>
-                              </Show>
-                              <Show
-                                when={
-                                  versionInfo()?.deploymentType === 'systemd' ||
-                                  versionInfo()?.deploymentType === 'manual'
-                                }
+                        {/* Import Section */}
+                        <div class="border border-gray-200 dark:border-gray-700 rounded-lg p-4">
+                          <div class="flex items-start gap-3">
+                            <div class="flex-shrink-0 w-10 h-10 bg-gray-100 dark:bg-gray-700 rounded-lg flex items-center justify-center">
+                              <svg
+                                class="w-5 h-5 text-gray-600 dark:text-gray-400"
+                                fill="none"
+                                stroke="currentColor"
+                                viewBox="0 0 24 24"
                               >
-                                <div class="text-xs text-green-700 dark:text-green-300 space-y-1">
-                                  <p>Run the install script:</p>
-                                  <code class="block p-1 bg-green-200 dark:bg-green-800 rounded text-xs">
-                                    curl -fsSL
-                                    https://raw.githubusercontent.com/rcourtman/Pulse/main/install.sh
-                                    | bash
-                                  </code>
-                                </div>
-                              </Show>
-                              <Show when={versionInfo()?.deploymentType === 'development'}>
-                                <p class="text-xs text-green-700 dark:text-green-300">
-                                  Pull latest changes and rebuild
-                                </p>
-                              </Show>
-                              <Show
-                                when={!versionInfo()?.deploymentType && versionInfo()?.isDocker}
-                              >
-                                <p class="text-xs text-green-700 dark:text-green-300">
-                                  Pull the latest Pulse Docker image and recreate your container.
-                                </p>
-                              </Show>
-                            </div>
-
-                            <Show when={updateInfo()?.releaseNotes}>
-                              <details class="mt-1">
-                                <summary class="text-xs text-green-700 dark:text-green-300 cursor-pointer">
-                                  Release Notes
-                                </summary>
-                                <pre class="mt-2 text-xs text-green-600 dark:text-green-400 whitespace-pre-wrap font-mono bg-green-100 dark:bg-green-900/30 p-2 rounded">
-                                  {updateInfo()?.releaseNotes}
-                                </pre>
-                              </details>
-                            </Show>
-                          </div>
-                        </Show>
-
-                        <div class="border-t border-gray-200 dark:border-gray-600 pt-4 space-y-4">
-                          <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                            <div>
-                              <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                Update Channel
-                              </label>
-                              <p class="text-xs text-gray-600 dark:text-gray-400">
-                                Choose between stable and release candidate versions
-                              </p>
-                            </div>
-                            <select
-                              value={updateChannel()}
-                              onChange={(e) => {
-                                setUpdateChannel(e.currentTarget.value as 'stable' | 'rc');
-                                setHasUnsavedChanges(true);
-                              }}
-                              disabled={versionInfo()?.isDocker}
-                              class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
-                            >
-                              <option value="stable">Stable</option>
-                              <option value="rc">Release Candidate</option>
-                            </select>
-                          </div>
-
-                          <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                            <div>
-                              <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                Update Checks
-                              </label>
-                              <p class="text-xs text-gray-600 dark:text-gray-400">
-                                Automatically check for updates (installation is manual)
-                              </p>
-                            </div>
-                            <label class="relative inline-flex items-center cursor-pointer">
-                              <input
-                                type="checkbox"
-                                checked={autoUpdateEnabled()}
-                                onChange={(e) => {
-                                  setAutoUpdateEnabled(e.currentTarget.checked);
-                                  setHasUnsavedChanges(true);
-                                }}
-                                disabled={versionInfo()?.isDocker}
-                                class="sr-only peer"
-                              />
-                              <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
-                            </label>
-                          </div>
-
-                          <Show when={autoUpdateEnabled()}>
-                            <div class="space-y-4 rounded-md border border-gray-200 dark:border-gray-600 p-3">
-                              <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                                <div>
-                                  <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                    Check Interval
-                                  </label>
-                                  <p class="text-xs text-gray-600 dark:text-gray-400">
-                                    How often to check for updates
-                                  </p>
-                                </div>
-                                <select
-                                  value={autoUpdateCheckInterval()}
-                                  onChange={(e) => {
-                                    setAutoUpdateCheckInterval(parseInt(e.currentTarget.value));
-                                    setHasUnsavedChanges(true);
-                                  }}
-                                  class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
-                                >
-                                  <option value="6">Every 6 hours</option>
-                                  <option value="12">Every 12 hours</option>
-                                  <option value="24">Daily</option>
-                                  <option value="168">Weekly</option>
-                                </select>
-                              </div>
-
-                              <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                                <div>
-                                  <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                    Check Time
-                                  </label>
-                                  <p class="text-xs text-gray-600 dark:text-gray-400">
-                                    Preferred time to check for updates
-                                  </p>
-                                </div>
-                                <input
-                                  type="time"
-                                  value={autoUpdateTime()}
-                                  onChange={(e) => {
-                                    setAutoUpdateTime(e.currentTarget.value);
-                                    setHasUnsavedChanges(true);
-                                  }}
-                                  class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800"
+                                <path
+                                  stroke-linecap="round"
+                                  stroke-linejoin="round"
+                                  stroke-width="2"
+                                  d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M15 13l-3-3m0 0l-3 3m3-3v12"
                                 />
-                              </div>
+                              </svg>
                             </div>
-                          </Show>
-                        </div>
-                      </div>
-                    </section>
-                  </div>
-                </Card>
-              </div>
-            </Show>
-
-            {/* System Backups Tab */}
-            <Show when={activeTab() === 'system-backups'}>
-              <div class="space-y-6">
-                <Card
-                  padding="none"
-                  class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                  border={false}
-                >
-                  <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                    <div class="flex items-center gap-3">
-                      <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                        <Clock class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
-                      </div>
-                      <SectionHeader
-                        title="Backups"
-                        description="Backup polling and configuration management"
-                        size="sm"
-                        class="flex-1"
-                      />
-                    </div>
-                  </div>
-                  <div class="p-6 space-y-8">
-                    <section class="space-y-3">
-                      <h4 class="flex items-center gap-2 text-sm font-medium text-gray-700 dark:text-gray-300">
-                        <svg width="16" height="16" viewBox="0 0 24 24" fill="none" stroke="currentColor">
-                          <circle cx="12" cy="12" r="9" stroke-width="2" />
-                          <path d="M12 7v5l3 3" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" />
-                        </svg>
-                        Backup polling
-                      </h4>
-                      <p class="text-xs text-gray-600 dark:text-gray-400">
-                        Control how often Pulse queries Proxmox backup tasks, datastore contents, and guest snapshots.
-                        Longer intervals reduce disk activity and API load.
-                      </p>
-                      <div class="space-y-3">
-                        <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                          <div>
-                            <p class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                              Enable backup polling
-                            </p>
-                            <p class="text-xs text-gray-600 dark:text-gray-400">
-                              Required for dashboard backup status, storage snapshots, and alerting.
-                            </p>
-                          </div>
-                          <label class="relative inline-flex items-center cursor-pointer">
-                            <input
-                              type="checkbox"
-                              class="sr-only peer"
-                              checked={backupPollingEnabled()}
-                              disabled={backupPollingEnvLocked()}
-                              onChange={(e) => {
-                                setBackupPollingEnabled(e.currentTarget.checked);
-                                if (!backupPollingEnvLocked()) {
-                                  setHasUnsavedChanges(true);
-                                }
-                              }}
-                            />
-                            <div class="w-11 h-6 bg-gray-200 peer-focus:outline-none rounded-full peer dark:bg-gray-700 peer-checked:after:translate-x-full peer-checked:after:border-white after:content-[''] after:absolute after:top-[2px] after:left-[2px] after:bg-white after:rounded-full after:h-5 after:w-5 after:transition-all peer-checked:bg-blue-600 peer-disabled:opacity-50"></div>
-                          </label>
-                        </div>
-
-                        <Show when={backupPollingEnabled()}>
-                          <div class="space-y-3 rounded-md border border-gray-200 dark:border-gray-600 p-3">
-                            <div class="flex flex-col gap-3 sm:flex-row sm:items-center sm:justify-between">
-                              <div>
-                                <label class="text-sm font-medium text-gray-900 dark:text-gray-100">
-                                  Polling interval
-                                </label>
-                                <p class="text-xs text-gray-600 dark:text-gray-400">
-                                  {backupIntervalSummary()}
-                                </p>
-                              </div>
-                              <select
-                                value={backupIntervalSelectValue()}
-                                disabled={backupPollingEnvLocked()}
-                                onChange={(e) => {
-                                  const value = e.currentTarget.value;
-                                  if (value === 'custom') {
-                                    const minutes = Math.max(1, backupPollingCustomMinutes());
-                                    setBackupPollingInterval(minutes * 60);
-                                  } else {
-                                    const seconds = parseInt(value, 10);
-                                    if (!Number.isNaN(seconds)) {
-                                      setBackupPollingInterval(seconds);
-                                      if (seconds > 0) {
-                                        setBackupPollingCustomMinutes(Math.max(1, Math.round(seconds / 60)));
-                                      }
-                                    }
-                                  }
-                                  if (!backupPollingEnvLocked()) {
-                                    setHasUnsavedChanges(true);
-                                  }
-                                }}
-                                class="px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                            <div class="flex-1">
+                              <h4 class="text-sm font-medium text-gray-900 dark:text-gray-100 mb-1">
+                                Restore Configuration
+                              </h4>
+                              <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
+                                Upload a backup file to restore nodes and settings
+                              </p>
+                              <button
+                                type="button"
+                                onClick={() => setShowImportDialog(true)}
+                                class="px-3 py-1.5 bg-gray-600 text-white text-sm rounded-md hover:bg-gray-700 transition-colors inline-flex items-center gap-2"
                               >
-                                <For each={BACKUP_INTERVAL_OPTIONS}>
-                                  {(option) => (
-                                    <option value={String(option.value)}>{option.label}</option>
-                                  )}
-                                </For>
-                                <option value="custom">Custom interval…</option>
-                              </select>
-                            </div>
-
-                            <Show when={backupIntervalSelectValue() === 'custom'}>
-                              <div class="space-y-2">
-                                <label class="text-xs font-medium text-gray-700 dark:text-gray-300">
-                                  Custom interval (minutes)
-                                </label>
-                                <div class="flex items-center gap-3">
-                                  <input
-                                    type="number"
-                                    min="1"
-                                    max={BACKUP_INTERVAL_MAX_MINUTES}
-                                    value={backupPollingCustomMinutes()}
-                                    disabled={backupPollingEnvLocked()}
-                                    onInput={(e) => {
-                                      const value = Number(e.currentTarget.value);
-                                      if (Number.isNaN(value)) {
-                                        return;
-                                      }
-                                      const clamped = Math.max(
-                                        1,
-                                        Math.min(BACKUP_INTERVAL_MAX_MINUTES, Math.floor(value)),
-                                      );
-                                      setBackupPollingCustomMinutes(clamped);
-                                      setBackupPollingInterval(clamped * 60);
-                                      if (!backupPollingEnvLocked()) {
-                                        setHasUnsavedChanges(true);
-                                      }
-                                    }}
-                                    class="w-24 px-3 py-1.5 text-sm border border-gray-300 dark:border-gray-600 rounded-lg bg-white dark:bg-gray-800 disabled:opacity-50"
+                                <svg
+                                  class="w-4 h-4"
+                                  fill="none"
+                                  stroke="currentColor"
+                                  viewBox="0 0 24 24"
+                                >
+                                  <path
+                                    stroke-linecap="round"
+                                    stroke-linejoin="round"
+                                    stroke-width="2"
+                                    d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"
                                   />
-                                  <span class="text-xs text-gray-500 dark:text-gray-400">
-                                    1 – {BACKUP_INTERVAL_MAX_MINUTES} minutes (≈7 days max)
-                                  </span>
-                                </div>
-                              </div>
-                            </Show>
+                                </svg>
+                                Restore Backup
+                              </button>
+                            </div>
                           </div>
-                        </Show>
+                        </div>
+                      </div>
 
-                        <Show when={backupPollingEnvLocked()}>
-                          <div class="flex items-start gap-2 rounded-md border border-amber-200 bg-amber-50 dark:border-amber-700 dark:bg-amber-900/20 p-3 text-xs text-amber-700 dark:text-amber-200">
+                      <div class="mt-4 p-3 bg-amber-50 dark:bg-amber-900/20 rounded-lg border border-amber-200 dark:border-amber-800">
+                        <div class="flex gap-2">
+                          <svg
+                            class="w-4 h-4 text-amber-600 dark:text-amber-400 flex-shrink-0 mt-0.5"
+                            fill="none"
+                            stroke="currentColor"
+                            viewBox="0 0 24 24"
+                          >
+                            <path
+                              stroke-linecap="round"
+                              stroke-linejoin="round"
+                              stroke-width="2"
+                              d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
+                            />
+                          </svg>
+                          <div class="text-xs text-amber-700 dark:text-amber-300">
+                            <p class="font-medium mb-1">Important Notes</p>
+                            <ul class="space-y-0.5 text-amber-600 dark:text-amber-400">
+                              <li>• Backups contain encrypted credentials and sensitive data</li>
+                              <li>• Use a strong passphrase to protect your backup</li>
+                              <li>• Store backup files securely and never share the passphrase</li>
+                            </ul>
+                          </div>
+                        </div>
+                      </div>
+                    </div>
+                  </Card>
+                </div>
+              </Show>
+
+              {/* API Access */}
+              <Show when={activeTab() === 'api'}>
+                <div class="space-y-6">
+                  <Card
+                    padding="none"
+                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                    border={false}
+                  >
+                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+                      <div class="flex items-center gap-3">
+                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                          <ApiIcon class="w-5 h-5 text-blue-600 dark:text-blue-300" />
+                        </div>
+                        <SectionHeader
+                          title="API Access"
+                          description="Generate scoped tokens for agents and automation"
+                          size="sm"
+                          class="flex-1"
+                        />
+                      </div>
+                    </div>
+                    <div class="p-6 space-y-3">
+                      <p class="text-sm text-gray-600 dark:text-gray-400">
+                        Generate scoped tokens for Docker agents, host agents, and automation
+                        pipelines. Tokens are shown once—store them securely and rotate when
+                        infrastructure changes.
+                      </p>
+                      <a
+                        href="https://github.com/rcourtman/Pulse/blob/main/docs/CONFIGURATION.md#token-scopes"
+                        target="_blank"
+                        rel="noreferrer"
+                        class="inline-flex w-fit items-center gap-2 rounded-md border border-blue-200 bg-blue-50 px-3 py-1.5 text-xs font-semibold text-blue-700 transition-colors hover:bg-blue-100 dark:border-blue-700 dark:bg-blue-900/30 dark:text-blue-200"
+                      >
+                        View scope reference
+                      </a>
+                    </div>
+                  </Card>
+
+                  <APITokenManager
+                    currentTokenHint={securityStatus()?.apiTokenHint}
+                    onTokensChanged={() => {
+                      void loadSecurityStatus();
+                    }}
+                    refreshing={securityStatusLoading()}
+                  />
+                </div>
+              </Show>
+
+              {/* Security Overview Tab */}
+              <Show when={activeTab() === 'security-overview'}>
+                <div class="space-y-6">
+                  <Show when={!securityStatusLoading() && securityStatus()}>
+                    <SecurityPostureSummary status={securityStatus()!} />
+                  </Show>
+
+                  <Show when={!securityStatusLoading() && securityStatus()?.hasProxyAuth}>
+                    <Card
+                      padding="sm"
+                      class="border border-blue-200 dark:border-blue-800 bg-blue-50 dark:bg-blue-900/20"
+                    >
+                      <div class="flex flex-col gap-2 text-xs text-blue-800 dark:text-blue-200">
+                        <div class="flex items-center gap-2">
+                          <svg
+                            class="w-4 h-4 flex-shrink-0"
+                            fill="none"
+                            stroke="currentColor"
+                            viewBox="0 0 24 24"
+                          >
+                            <path
+                              stroke-linecap="round"
+                              stroke-linejoin="round"
+                              stroke-width="2"
+                              d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
+                            />
+                          </svg>
+                          <span class="font-semibold text-blue-900 dark:text-blue-100">
+                            Proxy authentication detected
+                          </span>
+                        </div>
+                        <p>
+                          Requests are validated by an upstream proxy. The current proxied user is
+                          {securityStatus()?.proxyAuthUsername
+                            ? ` ${securityStatus()?.proxyAuthUsername}`
+                            : ' available once a request is received'}
+                          .
+                          {securityStatus()?.proxyAuthIsAdmin ? ' Admin privileges confirmed.' : ''}
+                          <Show when={securityStatus()?.proxyAuthLogoutURL}>
+                            {' '}
+                            <a
+                              class="underline font-medium"
+                              href={securityStatus()?.proxyAuthLogoutURL}
+                            >
+                              Proxy logout
+                            </a>
+                          </Show>
+                        </p>
+                        <p>
+                          Need configuration tips? Review the proxy auth guide in the docs.{' '}
+                          <a
+                            class="underline font-medium"
+                            href="https://github.com/rcourtman/Pulse/blob/main/docs/PROXY_AUTH.md"
+                            target="_blank"
+                            rel="noreferrer"
+                          >
+                            Read proxy auth guide →
+                          </a>
+                        </p>
+                      </div>
+                    </Card>
+                  </Show>
+                </div>
+              </Show>
+
+              {/* Security Authentication Tab */}
+              <Show when={activeTab() === 'security-auth'}>
+                <div class="space-y-6">
+                  {/* Show message when auth is disabled */}
+                  <Show when={!securityStatus()?.hasAuthentication}>
+                    <Card
+                      padding="none"
+                      class="overflow-hidden border border-amber-200 dark:border-amber-800"
+                      border={false}
+                    >
+                      {/* Header */}
+                      <div class="bg-gradient-to-r from-amber-50 to-amber-50 dark:from-amber-900/20 dark:to-amber-900/20 px-6 py-4 border-b border-amber-200 dark:border-amber-700">
+                        <div class="flex items-center gap-3">
+                          <div class="p-2 bg-amber-100 dark:bg-amber-900/50 rounded-lg">
                             <svg
-                              class="w-4 h-4 flex-shrink-0 mt-0.5"
+                              class="w-5 h-5 text-amber-600 dark:text-amber-400"
                               fill="none"
-                              stroke="currentColor"
                               viewBox="0 0 24 24"
+                              stroke="currentColor"
                             >
                               <path
                                 stroke-linecap="round"
@@ -3890,287 +4394,150 @@ const Settings: Component<SettingsProps> = (props) => {
                                 d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
                               />
                             </svg>
-                            <div>
-                              <p class="font-medium">Environment override detected</p>
-                              <p class="mt-1">
-                                The <code class="font-mono">ENABLE_BACKUP_POLLING</code> or{' '}
-                                <code class="font-mono">BACKUP_POLLING_INTERVAL</code> environment
-                                variables are set. Remove them and restart Pulse to manage backup polling here.
-                              </p>
-                            </div>
+                          </div>
+                          <SectionHeader title="Authentication disabled" size="sm" class="flex-1" />
+                          <Show
+                            when={!authDisabledByEnv()}
+                            fallback={
+                              <span class="px-3 py-1.5 text-xs font-semibold rounded-lg border border-amber-300 text-amber-800 bg-amber-100/60 dark:border-amber-700 dark:text-amber-100 dark:bg-amber-900/40 whitespace-nowrap">
+                                Controlled by DISABLE_AUTH
+                              </span>
+                            }
+                          >
+                            <button
+                              type="button"
+                              onClick={() => setShowQuickSecuritySetup(!showQuickSecuritySetup())}
+                              class="px-3 py-1.5 text-xs font-medium rounded-lg border border-amber-300 text-amber-800 bg-amber-100/50 hover:bg-amber-100 transition-colors dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 dark:hover:bg-amber-900/40 whitespace-nowrap"
+                            >
+                              Setup
+                            </button>
+                          </Show>
+                        </div>
+                      </div>
+
+                      {/* Content */}
+                      <div class="p-6">
+                        <p class="text-sm text-amber-700 dark:text-amber-300 mb-4">
+                          <Show
+                            when={authDisabledByEnv()}
+                            fallback={
+                              <>
+                                Authentication is currently disabled. Set up password authentication
+                                to protect your Pulse instance.
+                              </>
+                            }
+                          >
+                            Authentication settings are locked by the legacy{' '}
+                            <code class="font-mono text-xs text-amber-800 dark:text-amber-200">
+                              DISABLE_AUTH
+                            </code>{' '}
+                            environment variable. Remove it from your deployment and restart Pulse
+                            before enabling security from this page.
+                          </Show>
+                        </p>
+
+                        <Show when={showQuickSecuritySetup() && !authDisabledByEnv()}>
+                          <QuickSecuritySetup
+                            onConfigured={() => {
+                              setShowQuickSecuritySetup(false);
+                              loadSecurityStatus();
+                            }}
+                          />
+                        </Show>
+                      </div>
+                    </Card>
+                  </Show>
+
+                  {/* Authentication */}
+                  <Show
+                    when={
+                      !securityStatusLoading() &&
+                      (securityStatus()?.hasAuthentication || securityStatus()?.apiTokenConfigured)
+                    }
+                  >
+                    <Card
+                      padding="none"
+                      class="overflow-hidden border border-gray-200 dark:border-gray-700"
+                      border={false}
+                    >
+                      {/* Header */}
+                      <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
+                        <div class="flex items-center gap-3">
+                          <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
+                            <Lock
+                              class="w-5 h-5 text-blue-600 dark:text-blue-300"
+                              strokeWidth={2}
+                            />
+                          </div>
+                          <SectionHeader
+                            title="Authentication"
+                            description="Password management and credential rotation"
+                            size="sm"
+                            class="flex-1"
+                          />
+                        </div>
+                      </div>
+
+                      {/* Content */}
+                      <div class="p-6">
+                        <div class="flex flex-wrap items-center gap-3">
+                          <button
+                            type="button"
+                            onClick={(e) => {
+                              e.preventDefault();
+                              e.stopPropagation();
+                              setShowPasswordModal(true);
+                            }}
+                            class="px-4 py-2 text-sm font-medium bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
+                          >
+                            Change password
+                          </button>
+                          <Show
+                            when={!authDisabledByEnv()}
+                            fallback={
+                              <span class="px-4 py-2 text-sm font-semibold border border-amber-300 text-amber-800 bg-amber-50 dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 rounded-lg">
+                                Remove DISABLE_AUTH to rotate credentials
+                              </span>
+                            }
+                          >
+                            <button
+                              type="button"
+                              onClick={() => setShowQuickSecurityWizard(!showQuickSecurityWizard())}
+                              class="px-4 py-2 text-sm font-medium border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 rounded-lg hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors"
+                            >
+                              Rotate credentials
+                            </button>
+                          </Show>
+                          <div class="flex-1"></div>
+                          <div class="text-xs text-gray-600 dark:text-gray-400">
+                            <span class="font-medium text-gray-800 dark:text-gray-200">User:</span>{' '}
+                            {securityStatus()?.authUsername || 'Not configured'}
+                          </div>
+                        </div>
+
+                        <Show when={!authDisabledByEnv() && showQuickSecurityWizard()}>
+                          <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700">
+                            <QuickSecuritySetup
+                              mode="rotate"
+                              defaultUsername={securityStatus()?.authUsername || 'admin'}
+                              onConfigured={() => {
+                                setShowQuickSecurityWizard(false);
+                                loadSecurityStatus();
+                              }}
+                            />
                           </div>
                         </Show>
                       </div>
-                    </section>
+                    </Card>
+                  </Show>
 
-                    <SectionHeader
-                      title="Backup & restore"
-                      description="Backup your node configurations and credentials or restore from a previous backup."
-                      size="md"
-                      class="mb-4"
-                    />
-
-                  <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
-                    {/* Export Section */}
-                    <div class="border border-gray-200 dark:border-gray-700 rounded-lg p-4">
-                      <div class="flex items-start gap-3">
-                        <div class="flex-shrink-0 w-10 h-10 bg-blue-100 dark:bg-blue-900/30 rounded-lg flex items-center justify-center">
+                  {/* Show pending restart message if configured but not loaded */}
+                  <Show when={securityStatus()?.configuredButPendingRestart}>
+                    <div class="bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-4">
+                      <div class="flex items-start space-x-3">
+                        <div class="flex-shrink-0">
                           <svg
-                            class="w-5 h-5 text-blue-600 dark:text-blue-400"
-                            fill="none"
-                            stroke="currentColor"
-                            viewBox="0 0 24 24"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M9 19l3 3m0 0l3-3m-3 3V10"
-                            />
-                          </svg>
-                        </div>
-                        <div class="flex-1">
-                          <h4 class="text-sm font-medium text-gray-900 dark:text-gray-100 mb-1">
-                            Export Configuration
-                          </h4>
-                          <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
-                            Download an encrypted backup of all nodes and settings
-                          </p>
-                          <button
-                            type="button"
-                            onClick={() => {
-                              // Default to custom passphrase if no auth is configured
-                              setUseCustomPassphrase(!securityStatus()?.hasAuthentication);
-                              setShowExportDialog(true);
-                            }}
-                            class="px-3 py-1.5 bg-blue-600 text-white text-sm rounded-md hover:bg-blue-700 transition-colors inline-flex items-center gap-2"
-                          >
-                            <svg
-                              class="w-4 h-4"
-                              fill="none"
-                              stroke="currentColor"
-                              viewBox="0 0 24 24"
-                            >
-                              <path
-                                stroke-linecap="round"
-                                stroke-linejoin="round"
-                                stroke-width="2"
-                                d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-4l-4 4m0 0l-4-4m4 4V4"
-                              />
-                            </svg>
-                            Export Backup
-                          </button>
-                        </div>
-                      </div>
-                    </div>
-
-                    {/* Import Section */}
-                    <div class="border border-gray-200 dark:border-gray-700 rounded-lg p-4">
-                      <div class="flex items-start gap-3">
-                        <div class="flex-shrink-0 w-10 h-10 bg-gray-100 dark:bg-gray-700 rounded-lg flex items-center justify-center">
-                          <svg
-                            class="w-5 h-5 text-gray-600 dark:text-gray-400"
-                            fill="none"
-                            stroke="currentColor"
-                            viewBox="0 0 24 24"
-                          >
-                            <path
-                              stroke-linecap="round"
-                              stroke-linejoin="round"
-                              stroke-width="2"
-                              d="M7 16a4 4 0 01-.88-7.903A5 5 0 1115.9 6L16 6a5 5 0 011 9.9M15 13l-3-3m0 0l-3 3m3-3v12"
-                            />
-                          </svg>
-                        </div>
-                        <div class="flex-1">
-                          <h4 class="text-sm font-medium text-gray-900 dark:text-gray-100 mb-1">
-                            Restore Configuration
-                          </h4>
-                          <p class="text-xs text-gray-600 dark:text-gray-400 mb-3">
-                            Upload a backup file to restore nodes and settings
-                          </p>
-                          <button
-                            type="button"
-                            onClick={() => setShowImportDialog(true)}
-                            class="px-3 py-1.5 bg-gray-600 text-white text-sm rounded-md hover:bg-gray-700 transition-colors inline-flex items-center gap-2"
-                          >
-                            <svg
-                              class="w-4 h-4"
-                              fill="none"
-                              stroke="currentColor"
-                              viewBox="0 0 24 24"
-                            >
-                              <path
-                                stroke-linecap="round"
-                                stroke-linejoin="round"
-                                stroke-width="2"
-                                d="M4 16v1a3 3 0 003 3h10a3 3 0 003-3v-1m-4-8l-4-4m0 0L8 8m4-4v12"
-                              />
-                            </svg>
-                            Restore Backup
-                          </button>
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-
-                  <div class="mt-4 p-3 bg-amber-50 dark:bg-amber-900/20 rounded-lg border border-amber-200 dark:border-amber-800">
-                    <div class="flex gap-2">
-                      <svg
-                        class="w-4 h-4 text-amber-600 dark:text-amber-400 flex-shrink-0 mt-0.5"
-                        fill="none"
-                        stroke="currentColor"
-                        viewBox="0 0 24 24"
-                      >
-                        <path
-                          stroke-linecap="round"
-                          stroke-linejoin="round"
-                          stroke-width="2"
-                          d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                        />
-                      </svg>
-                      <div class="text-xs text-amber-700 dark:text-amber-300">
-                        <p class="font-medium mb-1">Important Notes</p>
-                        <ul class="space-y-0.5 text-amber-600 dark:text-amber-400">
-                          <li>• Backups contain encrypted credentials and sensitive data</li>
-                          <li>• Use a strong passphrase to protect your backup</li>
-                          <li>• Store backup files securely and never share the passphrase</li>
-                        </ul>
-                      </div>
-                    </div>
-                  </div>
-                  </div>
-                </Card>
-              </div>
-            </Show>
-
-            {/* API Access */}
-            <Show when={activeTab() === 'api'}>
-              <div class="space-y-6">
-                <Card
-                  padding="none"
-                  class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                  border={false}
-                >
-                  <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                    <div class="flex items-center gap-3">
-                      <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                        <ApiIcon class="w-5 h-5 text-blue-600 dark:text-blue-300" />
-                      </div>
-                      <SectionHeader
-                        title="API Access"
-                        description="Generate scoped tokens for agents and automation"
-                        size="sm"
-                        class="flex-1"
-                      />
-                    </div>
-                  </div>
-                  <div class="p-6 space-y-3">
-                    <p class="text-sm text-gray-600 dark:text-gray-400">
-                      Generate scoped tokens for Docker agents, host agents, and automation pipelines.
-                      Tokens are shown once—store them securely and rotate when infrastructure changes.
-                    </p>
-                    <a
-                      href="https://github.com/rcourtman/Pulse/blob/main/docs/CONFIGURATION.md#token-scopes"
-                      target="_blank"
-                      rel="noreferrer"
-                      class="inline-flex w-fit items-center gap-2 rounded-md border border-blue-200 bg-blue-50 px-3 py-1.5 text-xs font-semibold text-blue-700 transition-colors hover:bg-blue-100 dark:border-blue-700 dark:bg-blue-900/30 dark:text-blue-200"
-                    >
-                      View scope reference
-                    </a>
-                  </div>
-                </Card>
-
-                <APITokenManager
-                  currentTokenHint={securityStatus()?.apiTokenHint}
-                  onTokensChanged={() => {
-                    void loadSecurityStatus();
-                  }}
-                  refreshing={securityStatusLoading()}
-                />
-              </div>
-            </Show>
-
-            {/* Security Overview Tab */}
-            <Show when={activeTab() === 'security-overview'}>
-              <div class="space-y-6">
-                <Show when={!securityStatusLoading() && securityStatus()}>
-                  <SecurityPostureSummary status={securityStatus()!} />
-                </Show>
-
-                <Show when={!securityStatusLoading() && securityStatus()?.hasProxyAuth}>
-                  <Card
-                    padding="sm"
-                    class="border border-blue-200 dark:border-blue-800 bg-blue-50 dark:bg-blue-900/20"
-                  >
-                    <div class="flex flex-col gap-2 text-xs text-blue-800 dark:text-blue-200">
-                      <div class="flex items-center gap-2">
-                        <svg
-                          class="w-4 h-4 flex-shrink-0"
-                          fill="none"
-                          stroke="currentColor"
-                          viewBox="0 0 24 24"
-                        >
-                          <path
-                            stroke-linecap="round"
-                            stroke-linejoin="round"
-                            stroke-width="2"
-                            d="M13 16h-1v-4h-1m1-4h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"
-                          />
-                        </svg>
-                        <span class="font-semibold text-blue-900 dark:text-blue-100">
-                          Proxy authentication detected
-                        </span>
-                      </div>
-                      <p>
-                        Requests are validated by an upstream proxy. The current proxied user is
-                        {securityStatus()?.proxyAuthUsername
-                          ? ` ${securityStatus()?.proxyAuthUsername}`
-                          : ' available once a request is received'}
-                        .{securityStatus()?.proxyAuthIsAdmin ? ' Admin privileges confirmed.' : ''}
-                        <Show when={securityStatus()?.proxyAuthLogoutURL}>
-                          {' '}
-                          <a
-                            class="underline font-medium"
-                            href={securityStatus()?.proxyAuthLogoutURL}
-                          >
-                            Proxy logout
-                          </a>
-                        </Show>
-                      </p>
-                      <p>
-                        Need configuration tips? Review the proxy auth guide in the docs.{' '}
-                        <a
-                          class="underline font-medium"
-                          href="https://github.com/rcourtman/Pulse/blob/main/docs/PROXY_AUTH.md"
-                          target="_blank"
-                          rel="noreferrer"
-                        >
-                          Read proxy auth guide →
-                        </a>
-                      </p>
-                    </div>
-                  </Card>
-                </Show>
-              </div>
-            </Show>
-
-            {/* Security Authentication Tab */}
-            <Show when={activeTab() === 'security-auth'}>
-              <div class="space-y-6">
-                {/* Show message when auth is disabled */}
-                <Show when={!securityStatus()?.hasAuthentication}>
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-amber-200 dark:border-amber-800"
-                    border={false}
-                  >
-                    {/* Header */}
-                    <div class="bg-gradient-to-r from-amber-50 to-amber-50 dark:from-amber-900/20 dark:to-amber-900/20 px-6 py-4 border-b border-amber-200 dark:border-amber-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-amber-100 dark:bg-amber-900/50 rounded-lg">
-                          <svg
-                            class="w-5 h-5 text-amber-600 dark:text-amber-400"
+                            class="h-6 w-6 text-amber-600 dark:text-amber-400"
                             fill="none"
                             viewBox="0 0 24 24"
                             stroke="currentColor"
@@ -4183,1165 +4550,1226 @@ const Settings: Component<SettingsProps> = (props) => {
                             />
                           </svg>
                         </div>
-                        <SectionHeader title="Authentication disabled" size="sm" class="flex-1" />
-                        <Show
-                          when={!authDisabledByEnv()}
-                          fallback={
-                            <span class="px-3 py-1.5 text-xs font-semibold rounded-lg border border-amber-300 text-amber-800 bg-amber-100/60 dark:border-amber-700 dark:text-amber-100 dark:bg-amber-900/40 whitespace-nowrap">
-                              Controlled by DISABLE_AUTH
-                            </span>
-                          }
-                        >
-                          <button
-                            type="button"
-                            onClick={() => setShowQuickSecuritySetup(!showQuickSecuritySetup())}
-                            class="px-3 py-1.5 text-xs font-medium rounded-lg border border-amber-300 text-amber-800 bg-amber-100/50 hover:bg-amber-100 transition-colors dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 dark:hover:bg-amber-900/40 whitespace-nowrap"
-                          >
-                            Setup
-                          </button>
-                        </Show>
-                      </div>
-                    </div>
+                        <div class="flex-1">
+                          <h4 class="text-sm font-semibold text-amber-900 dark:text-amber-100">
+                            Security Configured - Restart Required
+                          </h4>
+                          <p class="text-xs text-amber-700 dark:text-amber-300 mt-1">
+                            Security settings have been configured but the service needs to be
+                            restarted to activate them.
+                          </p>
+                          <p class="text-xs text-amber-600 dark:text-amber-400 mt-2">
+                            After restarting, you'll need to log in with your saved credentials.
+                          </p>
 
-                    {/* Content */}
-                    <div class="p-6">
-                      <p class="text-sm text-amber-700 dark:text-amber-300 mb-4">
-                        <Show
-                          when={authDisabledByEnv()}
-                          fallback={
-                            <>
-                              Authentication is currently disabled. Set up password authentication to protect your Pulse instance.
-                            </>
-                          }
-                        >
-                          Authentication settings are locked by the legacy{' '}
-                          <code class="font-mono text-xs text-amber-800 dark:text-amber-200">
-                            DISABLE_AUTH
-                          </code>{' '}
-                          environment variable. Remove it from your deployment and restart Pulse before enabling security from this page.
-                        </Show>
-                      </p>
+                          <div class="mt-4 bg-white dark:bg-gray-800 rounded-lg p-3 border border-amber-200 dark:border-amber-700">
+                            <p class="text-xs font-semibold text-gray-900 dark:text-gray-100 mb-2">
+                              How to restart Pulse:
+                            </p>
 
-                      <Show when={showQuickSecuritySetup() && !authDisabledByEnv()}>
-                        <QuickSecuritySetup
-                          onConfigured={() => {
-                            setShowQuickSecuritySetup(false);
-                            loadSecurityStatus();
-                          }}
-                        />
-                      </Show>
-                    </div>
-                  </Card>
-                </Show>
+                            <Show when={versionInfo()?.deploymentType === 'proxmoxve'}>
+                              <div class="space-y-2">
+                                <p class="text-xs text-gray-700 dark:text-gray-300">
+                                  Type{' '}
+                                  <code class="px-1 py-0.5 bg-gray-100 dark:bg-gray-700 rounded">
+                                    update
+                                  </code>{' '}
+                                  in your ProxmoxVE console
+                                </p>
+                                <p class="text-xs text-gray-600 dark:text-gray-400 italic">
+                                  Or restart manually with:{' '}
+                                  <code class="text-xs">systemctl restart pulse</code>
+                                </p>
+                              </div>
+                            </Show>
 
-                {/* Authentication */}
-                <Show
-                  when={
-                    !securityStatusLoading() &&
-                    (securityStatus()?.hasAuthentication || securityStatus()?.apiTokenConfigured)
-                  }
-                >
-                  <Card
-                    padding="none"
-                    class="overflow-hidden border border-gray-200 dark:border-gray-700"
-                    border={false}
-                  >
-                    {/* Header */}
-                    <div class="bg-gradient-to-r from-blue-50 to-indigo-50 dark:from-blue-900/20 dark:to-indigo-900/20 px-6 py-4 border-b border-gray-200 dark:border-gray-700">
-                      <div class="flex items-center gap-3">
-                        <div class="p-2 bg-blue-100 dark:bg-blue-900/40 rounded-lg">
-                          <Lock class="w-5 h-5 text-blue-600 dark:text-blue-300" strokeWidth={2} />
+                            <Show when={versionInfo()?.deploymentType === 'docker'}>
+                              <div class="space-y-1">
+                                <p class="text-xs text-gray-700 dark:text-gray-300">
+                                  Restart your Docker container:
+                                </p>
+                                <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
+                                  docker restart pulse
+                                </code>
+                              </div>
+                            </Show>
+
+                            <Show
+                              when={
+                                versionInfo()?.deploymentType === 'systemd' ||
+                                versionInfo()?.deploymentType === 'manual'
+                              }
+                            >
+                              <div class="space-y-1">
+                                <p class="text-xs text-gray-700 dark:text-gray-300">
+                                  Restart the service:
+                                </p>
+                                <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
+                                  sudo systemctl restart pulse
+                                </code>
+                              </div>
+                            </Show>
+
+                            <Show when={versionInfo()?.deploymentType === 'development'}>
+                              <div class="space-y-1">
+                                <p class="text-xs text-gray-700 dark:text-gray-300">
+                                  Restart the development server:
+                                </p>
+                                <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
+                                  sudo systemctl restart pulse-hot-dev
+                                </code>
+                              </div>
+                            </Show>
+
+                            <Show when={!versionInfo()?.deploymentType}>
+                              <div class="space-y-1">
+                                <p class="text-xs text-gray-700 dark:text-gray-300">
+                                  Restart Pulse using your deployment method
+                                </p>
+                              </div>
+                            </Show>
+                          </div>
+
+                          <div class="mt-3 p-2 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded">
+                            <p class="text-xs text-green-700 dark:text-green-300">
+                              💡 <strong>Tip:</strong> Make sure you've saved your credentials
+                              before restarting!
+                            </p>
+                          </div>
                         </div>
-                        <SectionHeader
-                          title="Authentication"
-                          description="Password management and credential rotation"
-                          size="sm"
-                          class="flex-1"
-                        />
                       </div>
                     </div>
+                  </Show>
+                </div>
+              </Show>
 
-                    {/* Content */}
-                    <div class="p-6">
-                      <div class="flex flex-wrap items-center gap-3">
+              {/* Security Single Sign-On Tab */}
+              <Show when={activeTab() === 'security-sso'}>
+                <div class="space-y-6">
+                  <OIDCPanel onConfigUpdated={loadSecurityStatus} />
+                </div>
+              </Show>
+
+              {/* Diagnostics Tab */}
+              <Show when={activeTab() === 'diagnostics'}>
+                <div class="space-y-6">
+                  <div>
+                    <SectionHeader title="System diagnostics" size="md" class="mb-4" />
+
+                    <div class="space-y-4">
+                      {/* Live Connection Diagnostics */}
+                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
+                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
+                          Connection Diagnostics
+                        </h4>
+                        <p class="text-xs text-gray-600 dark:text-gray-400 mb-4">
+                          Test all configured node connections and view detailed status
+                        </p>
                         <button
                           type="button"
-                          onClick={(e) => {
-                            e.preventDefault();
-                            e.stopPropagation();
-                            setShowPasswordModal(true);
+                          onClick={() => {
+                            void runDiagnostics();
                           }}
-                          class="px-4 py-2 text-sm font-medium bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
+                          disabled={runningDiagnostics()}
+                          class="px-4 py-2 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
                         >
-                          Change password
+                          {runningDiagnostics() ? 'Running...' : 'Run Diagnostics'}
                         </button>
-                        <Show
-                          when={!authDisabledByEnv()}
-                          fallback={
-                            <span class="px-4 py-2 text-sm font-semibold border border-amber-300 text-amber-800 bg-amber-50 dark:border-amber-700 dark:text-amber-200 dark:bg-amber-900/30 rounded-lg">
-                              Remove DISABLE_AUTH to rotate credentials
-                            </span>
-                          }
-                        >
-                          <button
-                            type="button"
-                            onClick={() => setShowQuickSecurityWizard(!showQuickSecurityWizard())}
-                            class="px-4 py-2 text-sm font-medium border border-gray-300 dark:border-gray-600 text-gray-700 dark:text-gray-300 rounded-lg hover:bg-gray-50 dark:hover:bg-gray-800 transition-colors"
-                          >
-                            Rotate credentials
-                          </button>
-                        </Show>
-                        <div class="flex-1"></div>
-                        <div class="text-xs text-gray-600 dark:text-gray-400">
-                          <span class="font-medium text-gray-800 dark:text-gray-200">User:</span>{' '}
-                          {securityStatus()?.authUsername || 'Not configured'}
-                        </div>
-                      </div>
 
-                      <Show when={!authDisabledByEnv() && showQuickSecurityWizard()}>
-                        <div class="mt-4 pt-4 border-t border-gray-200 dark:border-gray-700">
-                          <QuickSecuritySetup
-                            mode="rotate"
-                            defaultUsername={securityStatus()?.authUsername || 'admin'}
-                            onConfigured={() => {
-                              setShowQuickSecurityWizard(false);
-                              loadSecurityStatus();
-                            }}
-                          />
-                        </div>
-                      </Show>
-                    </div>
-                  </Card>
-                </Show>
-
-                {/* Show pending restart message if configured but not loaded */}
-                <Show when={securityStatus()?.configuredButPendingRestart}>
-                  <div class="bg-amber-50 dark:bg-amber-900/20 border border-amber-200 dark:border-amber-800 rounded-lg p-4">
-                    <div class="flex items-start space-x-3">
-                      <div class="flex-shrink-0">
-                        <svg
-                          class="h-6 w-6 text-amber-600 dark:text-amber-400"
-                          fill="none"
-                          viewBox="0 0 24 24"
-                          stroke="currentColor"
-                        >
-                          <path
-                            stroke-linecap="round"
-                            stroke-linejoin="round"
-                            stroke-width="2"
-                            d="M12 9v2m0 4h.01m-6.938 4h13.856c1.54 0 2.502-1.667 1.732-3L13.732 4c-.77-1.333-2.694-1.333-3.464 0L3.34 16c-.77 1.333.192 3 1.732 3z"
-                          />
-                        </svg>
-                      </div>
-                      <div class="flex-1">
-                        <h4 class="text-sm font-semibold text-amber-900 dark:text-amber-100">
-                          Security Configured - Restart Required
-                        </h4>
-                        <p class="text-xs text-amber-700 dark:text-amber-300 mt-1">
-                          Security settings have been configured but the service needs to be
-                          restarted to activate them.
-                        </p>
-                        <p class="text-xs text-amber-600 dark:text-amber-400 mt-2">
-                          After restarting, you'll need to log in with your saved credentials.
-                        </p>
-
-                        <div class="mt-4 bg-white dark:bg-gray-800 rounded-lg p-3 border border-amber-200 dark:border-amber-700">
-                          <p class="text-xs font-semibold text-gray-900 dark:text-gray-100 mb-2">
-                            How to restart Pulse:
-                          </p>
-
-                          <Show when={versionInfo()?.deploymentType === 'proxmoxve'}>
-                            <div class="space-y-2">
-                              <p class="text-xs text-gray-700 dark:text-gray-300">
-                                Type{' '}
-                                <code class="px-1 py-0.5 bg-gray-100 dark:bg-gray-700 rounded">
-                                  update
-                                </code>{' '}
-                                in your ProxmoxVE console
-                              </p>
-                              <p class="text-xs text-gray-600 dark:text-gray-400 italic">
-                                Or restart manually with:{' '}
-                                <code class="text-xs">systemctl restart pulse</code>
-                              </p>
-                            </div>
-                          </Show>
-
-                          <Show when={versionInfo()?.deploymentType === 'docker'}>
-                            <div class="space-y-1">
-                              <p class="text-xs text-gray-700 dark:text-gray-300">
-                                Restart your Docker container:
-                              </p>
-                              <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
-                                docker restart pulse
-                              </code>
-                            </div>
-                          </Show>
-
-                          <Show
-                            when={
-                              versionInfo()?.deploymentType === 'systemd' ||
-                              versionInfo()?.deploymentType === 'manual'
-                            }
-                          >
-                            <div class="space-y-1">
-                              <p class="text-xs text-gray-700 dark:text-gray-300">
-                                Restart the service:
-                              </p>
-                              <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
-                                sudo systemctl restart pulse
-                              </code>
-                            </div>
-                          </Show>
-
-                          <Show when={versionInfo()?.deploymentType === 'development'}>
-                            <div class="space-y-1">
-                              <p class="text-xs text-gray-700 dark:text-gray-300">
-                                Restart the development server:
-                              </p>
-                              <code class="block text-xs bg-gray-100 dark:bg-gray-700 p-2 rounded mt-1">
-                                sudo systemctl restart pulse-hot-dev
-                              </code>
-                            </div>
-                          </Show>
-
-                          <Show when={!versionInfo()?.deploymentType}>
-                            <div class="space-y-1">
-                              <p class="text-xs text-gray-700 dark:text-gray-300">
-                                Restart Pulse using your deployment method
-                              </p>
-                            </div>
-                          </Show>
-                        </div>
-
-                        <div class="mt-3 p-2 bg-green-50 dark:bg-green-900/20 border border-green-200 dark:border-green-800 rounded">
-                          <p class="text-xs text-green-700 dark:text-green-300">
-                            💡 <strong>Tip:</strong> Make sure you've saved your credentials before
-                            restarting!
-                          </p>
-                        </div>
-                      </div>
-                    </div>
-                  </div>
-                </Show>
-              </div>
-            </Show>
-
-            {/* Security Single Sign-On Tab */}
-            <Show when={activeTab() === 'security-sso'}>
-              <div class="space-y-6">
-                <OIDCPanel onConfigUpdated={loadSecurityStatus} />
-              </div>
-            </Show>
-
-            {/* Diagnostics Tab */}
-            <Show when={activeTab() === 'diagnostics'}>
-              <div class="space-y-6">
-                <div>
-                  <SectionHeader title="System diagnostics" size="md" class="mb-4" />
-
-                  <div class="space-y-4">
-                    {/* Live Connection Diagnostics */}
-                    <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                      <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                        Connection Diagnostics
-                      </h4>
-                      <p class="text-xs text-gray-600 dark:text-gray-400 mb-4">
-                        Test all configured node connections and view detailed status
-                      </p>
-                      <button
-                        type="button"
-                        onClick={() => {
-                          void runDiagnostics();
-                        }}
-                        disabled={runningDiagnostics()}
-                        class="px-4 py-2 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-                      >
-                        {runningDiagnostics() ? 'Running...' : 'Run Diagnostics'}
-                      </button>
-
-                      <Show when={diagnosticsData()}>
-                        <div class="mt-4 space-y-3">
-                          {/* System Info */}
-                          <Card padding="sm">
-                            <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                              System
-                            </h5>
-                            <div class="text-xs space-y-1 text-gray-600 dark:text-gray-400">
-                              <div>Version: {diagnosticsData()?.version || 'Unknown'}</div>
-                              <div>Runtime: {diagnosticsData()?.runtime || 'Unknown'}</div>
-                              <div>
-                                Uptime: {formatUptime(diagnosticsData()?.uptime || 0)}
-                              </div>
-                              <div>
-                                OS / Arch:{' '}
-                                {diagnosticsData()?.system?.os
-                                  ? `${diagnosticsData()?.system?.os} / ${diagnosticsData()?.system?.arch || 'Unknown'}`
-                                  : 'Unknown'}
-                              </div>
-                              <div>Go runtime: {diagnosticsData()?.system?.goVersion || 'Unknown'}</div>
-                              <div>
-                                CPU cores: {diagnosticsData()?.system?.numCPU ?? 'Unknown'}
-                              </div>
-                              <div>
-                                Goroutines: {diagnosticsData()?.system?.numGoroutine ?? 'Unknown'}
-                              </div>
-                              <div>
-                                Memory: {diagnosticsData()?.system?.memoryMB ?? 0}{' '}
-                                MB
-                              </div>
-                            </div>
-                          </Card>
-
-                          {/* Temperature proxy guidance */}
-                          <Show when={diagnosticsData()?.temperatureProxy}>
-                            {(temp) => (
-                              <Card padding="sm">
-                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                  Temperature proxy
-                                </h5>
-                                <div class="text-xs space-y-1 text-gray-600 dark:text-gray-400">
-                                  <div class="flex items-center justify-between">
-                                    <span>Proxy socket</span>
-                                    <span
-                                      class={`px-2 py-0.5 rounded text-white text-xs ${
-                                        temp().socketFound ? 'bg-green-500' : 'bg-red-500'
-                                      }`}
-                                    >
-                                      {temp().socketFound ? 'Detected' : 'Missing'}
-                                    </span>
-                                  </div>
-                                  <div class="flex items-center justify-between">
-                                    <span>Daemon</span>
-                                    <span
-                                      class={`px-2 py-0.5 rounded text-white text-xs ${
-                                        temp().proxyReachable ? 'bg-green-500' : 'bg-yellow-500'
-                                      }`}
-                                    >
-                                      {temp().proxyReachable ? 'Responding' : 'No response'}
-                                    </span>
-                                  </div>
-                                  <Show when={temp().socketPath}>
-                                    <div>Socket path: {temp().socketPath}</div>
-                                  </Show>
-                                  <Show when={temp().socketPermissions}>
-                                    <div>Permissions: {temp().socketPermissions}</div>
-                                  </Show>
-                                  <Show when={temp().socketOwner || temp().socketGroup}>
-                                    <div>
-                                      Owner:{' '}
-                                      {[temp().socketOwner, temp().socketGroup]
-                                        .filter(Boolean)
-                                        .join(' / ') || 'Unknown'}
-                                    </div>
-                                  </Show>
-                                  <Show when={temp().proxyVersion}>
-                                    <div>Proxy version: {temp().proxyVersion}</div>
-                                  </Show>
-                                  <Show when={temp().proxySshDirectory}>
-                                    <div>SSH directory: {temp().proxySshDirectory}</div>
-                                  </Show>
-                                  <Show when={temp().proxyPublicKeySha256}>
-                                    <div>Key fingerprint: {temp().proxyPublicKeySha256}</div>
-                                  </Show>
-                                  <Show when={typeof temp().legacySshKeyCount === 'number'}>
-                                    <div>
-                                      Legacy SSH keys:{' '}
-                                      {temp().legacySshKeyCount ?? 0}
-                                    </div>
-                                  </Show>
-                                  <Show when={temp().legacySSHDetected}>
-                                    <div class="text-red-500">
-                                      Legacy SSH temperature collection detected
-                                    </div>
-                                  </Show>
-                                </div>
-                                <div class="mt-3 flex flex-wrap gap-2">
-                                  <button
-                                    type="button"
-                                    onClick={() => {
-                                      if (!proxyActionLoading()) {
-                                        void handleRegisterProxyNodes();
-                                      }
-                                    }}
-                                    disabled={proxyActionLoading() !== null}
-                                    class="px-3 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-                                  >
-                                    {proxyActionLoading() === 'register-nodes'
-                                      ? 'Checking nodes...'
-                                      : 'Check proxy nodes'}
-                                  </button>
-                                </div>
-                                <Show when={proxyRegisterSummary() && proxyRegisterSummary()!.length > 0}>
-                                  <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-1">
-                                    <div>Proxy node connectivity:</div>
-                                    <ul class="list-disc pl-4 space-y-0.5">
-                                      <For each={proxyRegisterSummary() || []}>
-                                        {(node) => (
-                                          <li>
-                                            <span class={node.sshReady ? 'text-green-600 dark:text-green-400' : 'text-red-600 dark:text-red-400'}>
-                                              {node.name}: {node.sshReady ? 'reachable' : 'unreachable'}
-                                            </span>
-                                            <Show when={node.error}>
-                                              <span class="ml-1 text-gray-500 dark:text-gray-400">
-                                                ({node.error})
-                                              </span>
-                                            </Show>
-                                          </li>
-                                        )}
-                                      </For>
-                                    </ul>
-                                  </div>
-                                </Show>
-                                <Show when={temp().notes && temp().notes!.length > 0}>
-                                  <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                    <For each={temp().notes || []}>
-                                      {(note) => <li>{note}</li>}
-                                    </For>
-                                  </ul>
-                                </Show>
-                              </Card>
-                            )}
-                          </Show>
-
-                          {/* API token adoption */}
-                          <Show when={diagnosticsData()?.apiTokens}>
-                            {(apiDiag) => (
-                              <Card padding="sm">
-                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                  API tokens
-                                </h5>
-                                <div class="text-xs space-y-2 text-gray-600 dark:text-gray-400">
-                                  <div class="flex flex-wrap gap-2">
-                                    <span
-                                      class={`px-2 py-0.5 rounded text-xs ${
-                                        apiDiag().enabled ? 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100' : 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                      }`}
-                                    >
-                                      {apiDiag().enabled ? 'Token auth enabled' : 'Token auth disabled'}
-                                    </span>
-                                    <Show when={apiDiag().hasEnvTokens}>
-                                      <span class="px-2 py-0.5 rounded text-xs bg-orange-100 text-orange-700 dark:bg-orange-700/40 dark:text-orange-100">
-                                        Env override detected
-                                      </span>
-                                    </Show>
-                                    <Show when={apiDiag().hasLegacyToken}>
-                                      <span class="px-2 py-0.5 rounded text-xs bg-red-100 text-red-700 dark:bg-red-700/40 dark:text-red-100">
-                                        Legacy token present
-                                      </span>
-                                    </Show>
-                                  </div>
-                              <div class="grid grid-cols-2 gap-2">
-                                <div>Configured tokens: {apiDiag().tokenCount}</div>
-                                <div>
-                                  Rotation needed:{' '}
-                                  {apiDiag().recommendTokenRotation ? 'Yes' : 'No'}
-                                </div>
-                                <div>
-                                  Docker hosts on shared token:{' '}
-                                  {apiDiag().legacyDockerHostCount ?? 0}
-                                </div>
-                                <div>
-                                  Unused tokens:{' '}
-                                  {apiDiag().unusedTokenCount ?? 0}
-                                </div>
-                              </div>
-                            </div>
-                            <Show when={apiDiag().tokens && apiDiag().tokens!.length > 0}>
-                              <div class="mt-3 border border-gray-200 dark:border-gray-700 rounded-md divide-y divide-gray-200 dark:divide-gray-700">
-                                <For each={apiDiag().tokens || []}>
-                                      {(token) => (
-                                        <div class="p-2 text-xs text-gray-600 dark:text-gray-400 flex flex-wrap justify-between gap-2">
-                                          <div class="flex-1 min-w-[140px]">
-                                            <div class="font-medium text-gray-700 dark:text-gray-200">
-                                              {token.name || 'Unnamed token'}
-                                            </div>
-                                            <div class="text-2xs text-gray-500 dark:text-gray-400">
-                                              {token.hint || 'No hint available'}
-                                              <Show when={token.source}>
-                                                <span class="ml-2 uppercase tracking-wide">
-                                                  ({token.source})
-                                                </span>
-                                              </Show>
-                                            </div>
-                                          </div>
-                                          <div class="text-right min-w-[160px]">
-                                            <div>
-                                              Created:{' '}
-                                              {token.createdAt
-                                                ? new Date(token.createdAt).toLocaleString()
-                                                : 'Unknown'}
-                                            </div>
-                                            <div>
-                                              Last used:{' '}
-                                              {token.lastUsedAt
-                                                ? formatRelativeTime(
-                                                    new Date(token.lastUsedAt).getTime(),
-                                                  )
-                                                : 'Never'}
-                                            </div>
-                                          </div>
-                                        </div>
-                                      )}
-                                    </For>
-                                  </div>
-                                </Show>
-                                <Show when={apiDiag().usage && apiDiag().usage!.length > 0}>
-                                  <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-1">
-                                    <div class="font-semibold text-gray-700 dark:text-gray-200">Token usage</div>
-                                    <ul class="list-disc pl-4 space-y-1">
-                                      <For each={apiDiag().usage || []}>
-                                        {(usage) => (
-                                          <li>
-                                            {usage.tokenId}: {usage.hostCount}{' '}
-                                            {usage.hostCount === 1 ? 'host' : 'hosts'}
-                                            <Show when={usage.hosts && usage.hosts!.length > 0}>
-                                              <span class="ml-1 text-gray-500 dark:text-gray-400">
-                                                ({usage.hosts!.join(', ')})
-                                              </span>
-                                            </Show>
-                                          </li>
-                                        )}
-                                      </For>
-                                    </ul>
-                                  </div>
-                                </Show>
-                                <Show when={apiDiag().notes && apiDiag().notes!.length > 0}>
-                                  <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                    <For each={apiDiag().notes || []}>
-                                      {(note) => <li>{note}</li>}
-                                    </For>
-                                  </ul>
-                                </Show>
-                              </Card>
-                            )}
-                          </Show>
-
-                          {/* Docker agent adoption */}
-                          <Show when={diagnosticsData()?.dockerAgents}>
-                            {(dockerDiag) => (
-                              <Card padding="sm">
-                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                  Docker agents
-                                </h5>
-                                <Show when={dockerDiag().hostsTotal > 0}>
-                                  <div class="text-xs text-gray-600 dark:text-gray-400 grid grid-cols-2 gap-2">
-                                    <div>Total hosts: {dockerDiag().hostsTotal}</div>
-                                    <div>Online: {dockerDiag().hostsOnline}</div>
-                                    <div>
-                                      With dedicated tokens: {dockerDiag().hostsWithTokenBinding}
-                                    </div>
-                                    <div>
-                                      Attention required: {dockerDiag().hostsNeedingAttention}
-                                    </div>
-                                    <div>
-                                      Missing version: {dockerDiag().hostsWithoutVersion ?? 0}
-                                    </div>
-                                    <div>
-                                      Outdated agents: {dockerDiag().hostsOutdatedVersion ?? 0}
-                                    </div>
-                                    <div>
-                                      Stale commands: {dockerDiag().hostsWithStaleCommand ?? 0}
-                                    </div>
-                                    <div>
-                                      Pending uninstall: {dockerDiag().hostsPendingUninstall ?? 0}
-                                    </div>
-                                  </div>
-                                  <Show when={dockerDiag().recommendedAgentVersion}>
-                                    <div class="mt-2 text-xs text-gray-500 dark:text-gray-400">
-                                      Recommended agent version: {dockerDiag().recommendedAgentVersion}
-                                    </div>
-                                  </Show>
-                                </Show>
-                                <Show when={dockerDiag().attention && dockerDiag().attention!.length > 0}>
-                                  <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 divide-y divide-gray-200 dark:divide-gray-700 border border-gray-200 dark:border-gray-700 rounded-md">
-                                    <For each={dockerDiag().attention || []}>
-                                      {(entry) => (
-                                        <div class="p-2 space-y-1">
-                                          <div class="flex items-center justify-between">
-                                            <span class="font-medium text-gray-700 dark:text-gray-200">
-                                              {entry.name}
-                                            </span>
-                                            <span
-                                              class={`px-2 py-0.5 rounded text-xs ${
-                                                entry.status === 'online'
-                                                  ? 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                                  : 'bg-red-100 text-red-700 dark:bg-red-700/40 dark:text-red-100'
-                                              }`}
-                                            >
-                                              {entry.status || 'unknown'}
-                                            </span>
-                                          </div>
-                                          <div class="text-2xs text-gray-500 dark:text-gray-400 space-x-2">
-                                            <Show when={entry.agentVersion}>
-                                              <span>Agent {entry.agentVersion}</span>
-                                            </Show>
-                                            <Show when={entry.tokenHint}>
-                                              <span>Token {entry.tokenHint}</span>
-                                            </Show>
-                                            <Show when={entry.lastSeen}>
-                                              <span>
-                                                Seen{' '}
-                                                {formatRelativeTime(
-                                                  new Date(entry.lastSeen!).getTime(),
-                                                )}
-                                              </span>
-                                            </Show>
-                                          </div>
-                                          <ul class="list-disc pl-4 space-y-1 text-gray-600 dark:text-gray-400">
-                                            <For each={entry.issues}>
-                                              {(issue) => <li>{issue}</li>}
-                                            </For>
-                                          </ul>
-                                          <div class="mt-2 flex flex-wrap gap-2">
-                                            <button
-                                              type="button"
-                                              onClick={() => {
-                                                if (dockerActionLoading() !== entry.hostId) {
-                                                  void handleDockerPrepareToken(entry.hostId);
-                                                }
-                                              }}
-                                              disabled={dockerActionLoading() === entry.hostId}
-                                              class="px-3 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
-                                            >
-                                              {dockerActionLoading() === entry.hostId
-                                                ? 'Preparing token...'
-                                                : 'Generate dedicated token'}
-                                            </button>
-                                          </div>
-                                          <Show when={dockerMigrationResults()[entry.hostId]}>
-                                            <div class="mt-3 w-full space-y-2 bg-gray-100 dark:bg-gray-800/60 border border-gray-200 dark:border-gray-700 rounded p-3 text-xs text-gray-700 dark:text-gray-200">
-                                              {(() => {
-                                                const migration = dockerMigrationResults()[entry.hostId]!;
-                                                return (
-                                                  <>
-                                                    <div class="font-semibold text-gray-800 dark:text-gray-100">
-                                                      Install command
-                                                    </div>
-                                                    <pre class="whitespace-pre-wrap break-all bg-gray-900/80 text-gray-100 rounded p-2 text-[11px]">
-                                                      {migration.installCommand}
-                                                    </pre>
-                                                    <button
-                                                      type="button"
-                                                      class="px-2 py-1 text-xs bg-slate-700 text-white rounded hover:bg-slate-800 transition-colors"
-                                                      onClick={() => void handleCopy(migration.installCommand, 'Install command copied')}
-                                                    >
-                                                      Copy install command
-                                                    </button>
-                                                    <div class="font-semibold text-gray-800 dark:text-gray-100 mt-2">
-                                                      Systemd snippet
-                                                    </div>
-                                                    <pre class="whitespace-pre-wrap break-all bg-gray-900/80 text-gray-100 rounded p-2 text-[11px]">
-                                                      {migration.systemdServiceSnippet}
-                                                    </pre>
-                                                    <button
-                                                      type="button"
-                                                      class="px-2 py-1 text-xs bg-slate-700 text-white rounded hover:bg-slate-800 transition-colors"
-                                                      onClick={() => void handleCopy(migration.systemdServiceSnippet, 'Service snippet copied')}
-                                                    >
-                                                      Copy service snippet
-                                                    </button>
-                                                    <div class="text-gray-600 dark:text-gray-400">
-                                                      Target URL: {migration.pulseURL}
-                                                    </div>
-                                                  </>
-                                                );
-                                              })()}
-                                            </div>
-                                          </Show>
-                                        </div>
-                                      )}
-                                    </For>
-                                  </div>
-</Show>
-                                <Show when={dockerDiag().notes && dockerDiag().notes!.length > 0}>
-                                  <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                    <For each={dockerDiag().notes || []}>
-                                      {(note) => <li>{note}</li>}
-                                    </For>
-                                  </ul>
-                                </Show>
-                              </Card>
-                            )}
-                          </Show>
-
-                          {/* Alerts configuration */}
-                          <Show when={diagnosticsData()?.alerts}>
-                            {(alerts) => (
-                              <Card padding="sm">
-                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                  Alerts configuration
-                                </h5>
-                                <div class="text-xs text-gray-600 dark:text-gray-400 space-y-2">
-                                  <div class="flex flex-wrap gap-2">
-                                    <span
-                                      class={`px-2 py-0.5 rounded text-xs ${
-                                        alerts().legacyThresholdsDetected
-                                          ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                      }`}
-                                    >
-                                      Legacy thresholds {alerts().legacyThresholdsDetected ? 'detected' : 'migrated'}
-                                    </span>
-                                    <span
-                                      class={`px-2 py-0.5 rounded text-xs ${
-                                        alerts().missingCooldown
-                                          ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                      }`}
-                                    >
-                                      Cooldown {alerts().missingCooldown ? 'missing' : 'configured'}
-                                    </span>
-                                    <span
-                                      class={`px-2 py-0.5 rounded text-xs ${
-                                        alerts().missingGroupingWindow
-                                          ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
-                                          : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
-                                      }`}
-                                    >
-                                      Grouping window {alerts().missingGroupingWindow ? 'disabled' : 'enabled'}
-                                    </span>
-                                  </div>
-                                  <Show when={alerts().legacyThresholdSources && alerts().legacyThresholdSources!.length > 0}>
-                                    <div>
-                                      Legacy sources: {alerts().legacyThresholdSources!.join(', ')}
-                                    </div>
-                                  </Show>
-                                  <Show when={alerts().legacyScheduleSettings && alerts().legacyScheduleSettings!.length > 0}>
-                                    <div>
-                                      Legacy schedule settings: {alerts().legacyScheduleSettings!.join(', ')}
-                                    </div>
-                                  </Show>
-                                </div>
-                                <Show when={alerts().notes && alerts().notes!.length > 0}>
-                                  <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
-                                    <For each={alerts().notes || []}>
-                                      {(note) => <li>{note}</li>}
-                                    </For>
-                                  </ul>
-                                </Show>
-                              </Card>
-                            )}
-                          </Show>
-
-                          {/* Nodes Status */}
-                          <Show
-                            when={diagnosticsData()?.nodes && diagnosticsData()!.nodes.length > 0}
-                          >
+                        <Show when={diagnosticsData()}>
+                          <div class="mt-4 space-y-3">
+                            {/* System Info */}
                             <Card padding="sm">
                               <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                PVE Nodes
+                                System
                               </h5>
-                              <For each={diagnosticsData()?.nodes || []}>
-                                {(node) => (
-                                  <div class="text-xs border-t dark:border-gray-700 pt-2 mt-2 first:border-0 first:pt-0 first:mt-0">
-                                    <div class="flex justify-between items-center mb-1">
-                                      <span class="font-medium text-gray-700 dark:text-gray-300">
-                                        {node.name}
-                                      </span>
+                              <div class="text-xs space-y-1 text-gray-600 dark:text-gray-400">
+                                <div>Version: {diagnosticsData()?.version || 'Unknown'}</div>
+                                <div>Runtime: {diagnosticsData()?.runtime || 'Unknown'}</div>
+                                <div>Uptime: {formatUptime(diagnosticsData()?.uptime || 0)}</div>
+                                <div>
+                                  OS / Arch:{' '}
+                                  {diagnosticsData()?.system?.os
+                                    ? `${diagnosticsData()?.system?.os} / ${diagnosticsData()?.system?.arch || 'Unknown'}`
+                                    : 'Unknown'}
+                                </div>
+                                <div>
+                                  Go runtime: {diagnosticsData()?.system?.goVersion || 'Unknown'}
+                                </div>
+                                <div>
+                                  CPU cores: {diagnosticsData()?.system?.numCPU ?? 'Unknown'}
+                                </div>
+                                <div>
+                                  Goroutines: {diagnosticsData()?.system?.numGoroutine ?? 'Unknown'}
+                                </div>
+                                <div>Memory: {diagnosticsData()?.system?.memoryMB ?? 0} MB</div>
+                              </div>
+                            </Card>
+
+                            <Show when={diagnosticsData()?.discovery}>
+                              {(discovery) => {
+                                const lastScanAbsolute = () =>
+                                  formatIsoDateTime(discovery().lastScanStartedAt) || 'Never';
+                                const lastScanRelative = () =>
+                                  formatIsoRelativeTime(discovery().lastScanStartedAt);
+                                const lastResultAbsolute = () =>
+                                  formatIsoDateTime(discovery().lastResultTimestamp) || 'Never';
+                                const lastResultRelative = () =>
+                                  formatIsoRelativeTime(discovery().lastResultTimestamp);
+                                const blocklist = () => discovery().subnetBlocklist || [];
+                                const allowlist = () => discovery().subnetAllowlist || [];
+                                return (
+                                  <Card padding="sm">
+                                    <div class="flex items-start justify-between gap-3">
+                                      <div>
+                                        <h5 class="text-sm font-semibold text-gray-700 dark:text-gray-300">
+                                          Network discovery
+                                        </h5>
+                                        <p class="text-xs text-gray-600 dark:text-gray-400">
+                                          Active scan configuration and recent discovery results.
+                                        </p>
+                                      </div>
                                       <span
-                                        class={`px-2 py-0.5 rounded text-white text-xs ${
-                                          node.connected ? 'bg-green-500' : 'bg-red-500'
-                                        }`}
+                                        class="rounded-full px-2 py-1 text-[0.65rem] font-medium uppercase tracking-wide"
+                                        classList={{
+                                          'bg-green-100 text-green-700 dark:bg-green-900/30 dark:text-green-300':
+                                            discovery().enabled,
+                                          'bg-gray-200 text-gray-700 dark:bg-gray-700 dark:text-gray-300':
+                                            !discovery().enabled,
+                                        }}
                                       >
-                                        {node.connected ? 'Connected' : 'Failed'}
+                                        {discovery().enabled ? 'Enabled' : 'Disabled'}
                                       </span>
                                     </div>
-                                    <div class="text-gray-600 dark:text-gray-400">
-                                      <div>Host: {node.host}</div>
-                                      <div>Auth: {node.authMethod?.replace('_', ' ')}</div>
-                                      <Show when={node.error}>
-                                        <div class="text-red-500 mt-1 break-words">
-                                          {node.error}
+
+                                    <div class="mt-3 grid gap-1 text-xs text-gray-600 dark:text-gray-400">
+                                      <div>
+                                        Configured subnet:{' '}
+                                        <code class="rounded bg-gray-100 px-1.5 py-0.5 text-[0.7rem] font-mono dark:bg-gray-700 dark:text-gray-200">
+                                          {discovery().configuredSubnet || 'auto'}
+                                        </code>
+                                      </div>
+                                      <Show
+                                        when={
+                                          discovery().activeSubnet &&
+                                          discovery().activeSubnet !== discovery().configuredSubnet
+                                        }
+                                      >
+                                        <div>
+                                          Active subnet:{' '}
+                                          <code class="rounded bg-blue-50 px-1.5 py-0.5 text-[0.7rem] font-mono text-blue-700 dark:bg-blue-900/30 dark:text-blue-200">
+                                            {discovery().activeSubnet}
+                                          </code>
+                                        </div>
+                                      </Show>
+                                      <Show when={discovery().environmentOverride}>
+                                        <div>
+                                          Environment override:{' '}
+                                          <span class="font-medium text-gray-700 dark:text-gray-300">
+                                            {discovery().environmentOverride}
+                                          </span>
+                                        </div>
+                                      </Show>
+                                      <div>
+                                        Scan interval:{' '}
+                                        <span class="font-medium text-gray-700 dark:text-gray-300">
+                                          {discovery().scanInterval || 'default'}
+                                        </span>
+                                        <Show when={discovery().scanning}>
+                                          <span class="ml-2 inline-flex items-center gap-1 text-[0.65rem] text-blue-600 dark:text-blue-300">
+                                            <span class="h-1.5 w-1.5 animate-pulse rounded-full bg-blue-500" />
+                                            scanning
+                                          </span>
+                                        </Show>
+                                      </div>
+                                    </div>
+
+                                    <div class="mt-4 space-y-3">
+                                      <div>
+                                        <div class="text-[0.65rem] font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                          Blocked subnets
+                                        </div>
+                                        <Show
+                                          when={blocklist().length > 0}
+                                          fallback={
+                                            <div class="mt-1 text-xs text-gray-500 dark:text-gray-400">
+                                              None
+                                            </div>
+                                          }
+                                        >
+                                          <div class="mt-1 flex flex-wrap gap-2">
+                                            <For each={blocklist()}>
+                                              {(cidr) => (
+                                                <span class="rounded bg-gray-100 px-2 py-1 text-[0.7rem] font-mono text-gray-700 dark:bg-gray-700 dark:text-gray-200">
+                                                  {cidr}
+                                                </span>
+                                              )}
+                                            </For>
+                                          </div>
+                                        </Show>
+                                      </div>
+
+                                      <Show when={allowlist().length > 0}>
+                                        <div>
+                                          <div class="text-[0.65rem] font-semibold uppercase tracking-wide text-gray-500 dark:text-gray-400">
+                                            Allowlist overrides
+                                          </div>
+                                          <div class="mt-1 flex flex-wrap gap-2">
+                                            <For each={allowlist()}>
+                                              {(cidr) => (
+                                                <span class="rounded bg-blue-50 px-2 py-1 text-[0.7rem] font-mono text-blue-700 dark:bg-blue-900/30 dark:text-blue-200">
+                                                  {cidr}
+                                                </span>
+                                              )}
+                                            </For>
+                                          </div>
                                         </div>
                                       </Show>
                                     </div>
-                                  </div>
-                                )}
-                              </For>
-                            </Card>
-                          </Show>
 
-                          {/* PBS Status */}
-                          <Show when={diagnosticsData()?.pbs && diagnosticsData()!.pbs.length > 0}>
-                            <Card padding="sm">
-                              <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
-                                PBS Instances
-                              </h5>
-                              <For each={diagnosticsData()?.pbs || []}>
-                                {(pbs) => (
-                                  <div class="text-xs border-t dark:border-gray-700 pt-2 mt-2 first:border-0 first:pt-0 first:mt-0">
-                                    <div class="flex justify-between items-center mb-1">
-                                      <span class="font-medium text-gray-700 dark:text-gray-300">
-                                        {pbs.name}
-                                      </span>
+                                    <div class="mt-4 grid gap-1 text-[0.7rem] text-gray-500 dark:text-gray-400">
+                                      <div>
+                                        Last scan:{' '}
+                                        <span class="text-gray-700 dark:text-gray-300">
+                                          {lastScanAbsolute()}
+                                        </span>
+                                        <Show when={lastScanRelative()}>
+                                          {(relative) => (
+                                            <span class="ml-2 text-[0.65rem] text-gray-400 dark:text-gray-500">
+                                              ({relative()})
+                                            </span>
+                                          )}
+                                        </Show>
+                                      </div>
+                                      <div>
+                                        Last result:{' '}
+                                        <span class="text-gray-700 dark:text-gray-300">
+                                          {lastResultAbsolute()}
+                                        </span>
+                                        <Show when={lastResultRelative()}>
+                                          {(relative) => (
+                                            <span class="ml-2 text-[0.65rem] text-gray-400 dark:text-gray-500">
+                                              ({relative()})
+                                            </span>
+                                          )}
+                                        </Show>
+                                      </div>
+                                      <div>
+                                        Servers found:{' '}
+                                        <span class="text-gray-700 dark:text-gray-300">
+                                          {discovery().lastResultServers ?? 0}
+                                        </span>
+                                        <span class="ml-3">
+                                          Errors:{' '}
+                                          <span class="text-gray-700 dark:text-gray-300">
+                                            {discovery().lastResultErrors ?? 0}
+                                          </span>
+                                        </span>
+                                      </div>
+                                    </div>
+                                  </Card>
+                                );
+                              }}
+                            </Show>
+
+                            {/* Temperature proxy guidance */}
+                            <Show when={diagnosticsData()?.temperatureProxy}>
+                              {(temp) => (
+                                <Card padding="sm">
+                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
+                                    Temperature proxy
+                                  </h5>
+                                  <div class="text-xs space-y-1 text-gray-600 dark:text-gray-400">
+                                    <div class="flex items-center justify-between">
+                                      <span>Proxy socket</span>
                                       <span
                                         class={`px-2 py-0.5 rounded text-white text-xs ${
-                                          pbs.connected ? 'bg-green-500' : 'bg-red-500'
+                                          temp().socketFound ? 'bg-green-500' : 'bg-red-500'
                                         }`}
                                       >
-                                        {pbs.connected ? 'Connected' : 'Failed'}
+                                        {temp().socketFound ? 'Detected' : 'Missing'}
                                       </span>
                                     </div>
-                                    <Show when={pbs.error}>
-                                      <div class="text-red-500 break-words">{pbs.error}</div>
+                                    <div class="flex items-center justify-between">
+                                      <span>Daemon</span>
+                                      <span
+                                        class={`px-2 py-0.5 rounded text-white text-xs ${
+                                          temp().proxyReachable ? 'bg-green-500' : 'bg-yellow-500'
+                                        }`}
+                                      >
+                                        {temp().proxyReachable ? 'Responding' : 'No response'}
+                                      </span>
+                                    </div>
+                                    <Show when={temp().socketPath}>
+                                      <div>Socket path: {temp().socketPath}</div>
+                                    </Show>
+                                    <Show when={temp().socketPermissions}>
+                                      <div>Permissions: {temp().socketPermissions}</div>
+                                    </Show>
+                                    <Show when={temp().socketOwner || temp().socketGroup}>
+                                      <div>
+                                        Owner:{' '}
+                                        {[temp().socketOwner, temp().socketGroup]
+                                          .filter(Boolean)
+                                          .join(' / ') || 'Unknown'}
+                                      </div>
+                                    </Show>
+                                    <Show when={temp().proxyVersion}>
+                                      <div>Proxy version: {temp().proxyVersion}</div>
+                                    </Show>
+                                    <Show when={temp().proxySshDirectory}>
+                                      <div>SSH directory: {temp().proxySshDirectory}</div>
+                                    </Show>
+                                    <Show when={temp().proxyPublicKeySha256}>
+                                      <div>Key fingerprint: {temp().proxyPublicKeySha256}</div>
+                                    </Show>
+                                    <Show when={typeof temp().legacySshKeyCount === 'number'}>
+                                      <div>Legacy SSH keys: {temp().legacySshKeyCount ?? 0}</div>
+                                    </Show>
+                                    <Show when={temp().legacySSHDetected}>
+                                      <div class="text-red-500">
+                                        Legacy SSH temperature collection detected
+                                      </div>
                                     </Show>
                                   </div>
-                                )}
-                              </For>
-                            </Card>
-                          </Show>
-                        </div>
-                      </Show>
-                    </div>
-                    {/* System Information */}
-                    <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                      <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                        System Information
-                      </h4>
-                      <div class="space-y-2 text-sm">
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">Version:</span>
-                          <span class="font-medium">2.0.0</span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">Backend:</span>
-                          <span class="font-medium">Go 1.21</span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">Frontend:</span>
-                          <span class="font-medium">SolidJS + TypeScript</span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">WebSocket Status:</span>
-                          <span
-                            class={`font-medium ${connected() ? 'text-green-600' : 'text-red-600'}`}
-                          >
-                            {connected() ? 'Connected' : 'Disconnected'}
-                          </span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">Server Port:</span>
-                          <span class="font-medium">
-                            {window.location.port ||
-                              (window.location.protocol === 'https:' ? '443' : '80')}
-                          </span>
+                                  <div class="mt-3 flex flex-wrap gap-2">
+                                    <button
+                                      type="button"
+                                      onClick={() => {
+                                        if (!proxyActionLoading()) {
+                                          void handleRegisterProxyNodes();
+                                        }
+                                      }}
+                                      disabled={proxyActionLoading() !== null}
+                                      class="px-3 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                                    >
+                                      {proxyActionLoading() === 'register-nodes'
+                                        ? 'Checking nodes...'
+                                        : 'Check proxy nodes'}
+                                    </button>
+                                  </div>
+                                  <Show
+                                    when={
+                                      proxyRegisterSummary() && proxyRegisterSummary()!.length > 0
+                                    }
+                                  >
+                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-1">
+                                      <div>Proxy node connectivity:</div>
+                                      <ul class="list-disc pl-4 space-y-0.5">
+                                        <For each={proxyRegisterSummary() || []}>
+                                          {(node) => (
+                                            <li>
+                                              <span
+                                                class={
+                                                  node.sshReady
+                                                    ? 'text-green-600 dark:text-green-400'
+                                                    : 'text-red-600 dark:text-red-400'
+                                                }
+                                              >
+                                                {node.name}:{' '}
+                                                {node.sshReady ? 'reachable' : 'unreachable'}
+                                              </span>
+                                              <Show when={node.error}>
+                                                <span class="ml-1 text-gray-500 dark:text-gray-400">
+                                                  ({node.error})
+                                                </span>
+                                              </Show>
+                                            </li>
+                                          )}
+                                        </For>
+                                      </ul>
+                                    </div>
+                                  </Show>
+                                  <Show when={temp().notes && temp().notes!.length > 0}>
+                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
+                                      <For each={temp().notes || []}>
+                                        {(note) => <li>{note}</li>}
+                                      </For>
+                                    </ul>
+                                  </Show>
+                                </Card>
+                              )}
+                            </Show>
+
+                            {/* API token adoption */}
+                            <Show when={diagnosticsData()?.apiTokens}>
+                              {(apiDiag) => (
+                                <Card padding="sm">
+                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
+                                    API tokens
+                                  </h5>
+                                  <div class="text-xs space-y-2 text-gray-600 dark:text-gray-400">
+                                    <div class="flex flex-wrap gap-2">
+                                      <span
+                                        class={`px-2 py-0.5 rounded text-xs ${
+                                          apiDiag().enabled
+                                            ? 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
+                                            : 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
+                                        }`}
+                                      >
+                                        {apiDiag().enabled
+                                          ? 'Token auth enabled'
+                                          : 'Token auth disabled'}
+                                      </span>
+                                      <Show when={apiDiag().hasEnvTokens}>
+                                        <span class="px-2 py-0.5 rounded text-xs bg-orange-100 text-orange-700 dark:bg-orange-700/40 dark:text-orange-100">
+                                          Env override detected
+                                        </span>
+                                      </Show>
+                                      <Show when={apiDiag().hasLegacyToken}>
+                                        <span class="px-2 py-0.5 rounded text-xs bg-red-100 text-red-700 dark:bg-red-700/40 dark:text-red-100">
+                                          Legacy token present
+                                        </span>
+                                      </Show>
+                                    </div>
+                                    <div class="grid grid-cols-2 gap-2">
+                                      <div>Configured tokens: {apiDiag().tokenCount}</div>
+                                      <div>
+                                        Rotation needed:{' '}
+                                        {apiDiag().recommendTokenRotation ? 'Yes' : 'No'}
+                                      </div>
+                                      <div>
+                                        Docker hosts on shared token:{' '}
+                                        {apiDiag().legacyDockerHostCount ?? 0}
+                                      </div>
+                                      <div>Unused tokens: {apiDiag().unusedTokenCount ?? 0}</div>
+                                    </div>
+                                  </div>
+                                  <Show when={apiDiag().tokens && apiDiag().tokens!.length > 0}>
+                                    <div class="mt-3 border border-gray-200 dark:border-gray-700 rounded-md divide-y divide-gray-200 dark:divide-gray-700">
+                                      <For each={apiDiag().tokens || []}>
+                                        {(token) => (
+                                          <div class="p-2 text-xs text-gray-600 dark:text-gray-400 flex flex-wrap justify-between gap-2">
+                                            <div class="flex-1 min-w-[140px]">
+                                              <div class="font-medium text-gray-700 dark:text-gray-200">
+                                                {token.name || 'Unnamed token'}
+                                              </div>
+                                              <div class="text-2xs text-gray-500 dark:text-gray-400">
+                                                {token.hint || 'No hint available'}
+                                                <Show when={token.source}>
+                                                  <span class="ml-2 uppercase tracking-wide">
+                                                    ({token.source})
+                                                  </span>
+                                                </Show>
+                                              </div>
+                                            </div>
+                                            <div class="text-right min-w-[160px]">
+                                              <div>
+                                                Created:{' '}
+                                                {token.createdAt
+                                                  ? new Date(token.createdAt).toLocaleString()
+                                                  : 'Unknown'}
+                                              </div>
+                                              <div>
+                                                Last used:{' '}
+                                                {token.lastUsedAt
+                                                  ? formatRelativeTime(
+                                                      new Date(token.lastUsedAt).getTime(),
+                                                    )
+                                                  : 'Never'}
+                                              </div>
+                                            </div>
+                                          </div>
+                                        )}
+                                      </For>
+                                    </div>
+                                  </Show>
+                                  <Show when={apiDiag().usage && apiDiag().usage!.length > 0}>
+                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 space-y-1">
+                                      <div class="font-semibold text-gray-700 dark:text-gray-200">
+                                        Token usage
+                                      </div>
+                                      <ul class="list-disc pl-4 space-y-1">
+                                        <For each={apiDiag().usage || []}>
+                                          {(usage) => (
+                                            <li>
+                                              {usage.tokenId}: {usage.hostCount}{' '}
+                                              {usage.hostCount === 1 ? 'host' : 'hosts'}
+                                              <Show when={usage.hosts && usage.hosts!.length > 0}>
+                                                <span class="ml-1 text-gray-500 dark:text-gray-400">
+                                                  ({usage.hosts!.join(', ')})
+                                                </span>
+                                              </Show>
+                                            </li>
+                                          )}
+                                        </For>
+                                      </ul>
+                                    </div>
+                                  </Show>
+                                  <Show when={apiDiag().notes && apiDiag().notes!.length > 0}>
+                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
+                                      <For each={apiDiag().notes || []}>
+                                        {(note) => <li>{note}</li>}
+                                      </For>
+                                    </ul>
+                                  </Show>
+                                </Card>
+                              )}
+                            </Show>
+
+                            {/* Docker agent adoption */}
+                            <Show when={diagnosticsData()?.dockerAgents}>
+                              {(dockerDiag) => (
+                                <Card padding="sm">
+                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
+                                    Docker agents
+                                  </h5>
+                                  <Show when={dockerDiag().hostsTotal > 0}>
+                                    <div class="text-xs text-gray-600 dark:text-gray-400 grid grid-cols-2 gap-2">
+                                      <div>Total hosts: {dockerDiag().hostsTotal}</div>
+                                      <div>Online: {dockerDiag().hostsOnline}</div>
+                                      <div>
+                                        With dedicated tokens: {dockerDiag().hostsWithTokenBinding}
+                                      </div>
+                                      <div>
+                                        Attention required: {dockerDiag().hostsNeedingAttention}
+                                      </div>
+                                      <div>
+                                        Missing version: {dockerDiag().hostsWithoutVersion ?? 0}
+                                      </div>
+                                      <div>
+                                        Outdated agents: {dockerDiag().hostsOutdatedVersion ?? 0}
+                                      </div>
+                                      <div>
+                                        Stale commands: {dockerDiag().hostsWithStaleCommand ?? 0}
+                                      </div>
+                                      <div>
+                                        Pending uninstall: {dockerDiag().hostsPendingUninstall ?? 0}
+                                      </div>
+                                    </div>
+                                    <Show when={dockerDiag().recommendedAgentVersion}>
+                                      <div class="mt-2 text-xs text-gray-500 dark:text-gray-400">
+                                        Recommended agent version:{' '}
+                                        {dockerDiag().recommendedAgentVersion}
+                                      </div>
+                                    </Show>
+                                  </Show>
+                                  <Show
+                                    when={
+                                      dockerDiag().attention && dockerDiag().attention!.length > 0
+                                    }
+                                  >
+                                    <div class="mt-3 text-xs text-gray-600 dark:text-gray-400 divide-y divide-gray-200 dark:divide-gray-700 border border-gray-200 dark:border-gray-700 rounded-md">
+                                      <For each={dockerDiag().attention || []}>
+                                        {(entry) => (
+                                          <div class="p-2 space-y-1">
+                                            <div class="flex items-center justify-between">
+                                              <span class="font-medium text-gray-700 dark:text-gray-200">
+                                                {entry.name}
+                                              </span>
+                                              <span
+                                                class={`px-2 py-0.5 rounded text-xs ${
+                                                  entry.status === 'online'
+                                                    ? 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
+                                                    : 'bg-red-100 text-red-700 dark:bg-red-700/40 dark:text-red-100'
+                                                }`}
+                                              >
+                                                {entry.status || 'unknown'}
+                                              </span>
+                                            </div>
+                                            <div class="text-2xs text-gray-500 dark:text-gray-400 space-x-2">
+                                              <Show when={entry.agentVersion}>
+                                                <span>Agent {entry.agentVersion}</span>
+                                              </Show>
+                                              <Show when={entry.tokenHint}>
+                                                <span>Token {entry.tokenHint}</span>
+                                              </Show>
+                                              <Show when={entry.lastSeen}>
+                                                <span>
+                                                  Seen{' '}
+                                                  {formatRelativeTime(
+                                                    new Date(entry.lastSeen!).getTime(),
+                                                  )}
+                                                </span>
+                                              </Show>
+                                            </div>
+                                            <ul class="list-disc pl-4 space-y-1 text-gray-600 dark:text-gray-400">
+                                              <For each={entry.issues}>
+                                                {(issue) => <li>{issue}</li>}
+                                              </For>
+                                            </ul>
+                                            <div class="mt-2 flex flex-wrap gap-2">
+                                              <button
+                                                type="button"
+                                                onClick={() => {
+                                                  if (dockerActionLoading() !== entry.hostId) {
+                                                    void handleDockerPrepareToken(entry.hostId);
+                                                  }
+                                                }}
+                                                disabled={dockerActionLoading() === entry.hostId}
+                                                class="px-3 py-1 text-xs bg-blue-600 text-white rounded hover:bg-blue-700 transition-colors disabled:opacity-50 disabled:cursor-not-allowed"
+                                              >
+                                                {dockerActionLoading() === entry.hostId
+                                                  ? 'Preparing token...'
+                                                  : 'Generate dedicated token'}
+                                              </button>
+                                            </div>
+                                            <Show when={dockerMigrationResults()[entry.hostId]}>
+                                              <div class="mt-3 w-full space-y-2 bg-gray-100 dark:bg-gray-800/60 border border-gray-200 dark:border-gray-700 rounded p-3 text-xs text-gray-700 dark:text-gray-200">
+                                                {(() => {
+                                                  const migration =
+                                                    dockerMigrationResults()[entry.hostId]!;
+                                                  return (
+                                                    <>
+                                                      <div class="font-semibold text-gray-800 dark:text-gray-100">
+                                                        Install command
+                                                      </div>
+                                                      <pre class="whitespace-pre-wrap break-all bg-gray-900/80 text-gray-100 rounded p-2 text-[11px]">
+                                                        {migration.installCommand}
+                                                      </pre>
+                                                      <button
+                                                        type="button"
+                                                        class="px-2 py-1 text-xs bg-slate-700 text-white rounded hover:bg-slate-800 transition-colors"
+                                                        onClick={() =>
+                                                          void handleCopy(
+                                                            migration.installCommand,
+                                                            'Install command copied',
+                                                          )
+                                                        }
+                                                      >
+                                                        Copy install command
+                                                      </button>
+                                                      <div class="font-semibold text-gray-800 dark:text-gray-100 mt-2">
+                                                        Systemd snippet
+                                                      </div>
+                                                      <pre class="whitespace-pre-wrap break-all bg-gray-900/80 text-gray-100 rounded p-2 text-[11px]">
+                                                        {migration.systemdServiceSnippet}
+                                                      </pre>
+                                                      <button
+                                                        type="button"
+                                                        class="px-2 py-1 text-xs bg-slate-700 text-white rounded hover:bg-slate-800 transition-colors"
+                                                        onClick={() =>
+                                                          void handleCopy(
+                                                            migration.systemdServiceSnippet,
+                                                            'Service snippet copied',
+                                                          )
+                                                        }
+                                                      >
+                                                        Copy service snippet
+                                                      </button>
+                                                      <div class="text-gray-600 dark:text-gray-400">
+                                                        Target URL: {migration.pulseURL}
+                                                      </div>
+                                                    </>
+                                                  );
+                                                })()}
+                                              </div>
+                                            </Show>
+                                          </div>
+                                        )}
+                                      </For>
+                                    </div>
+                                  </Show>
+                                  <Show when={dockerDiag().notes && dockerDiag().notes!.length > 0}>
+                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
+                                      <For each={dockerDiag().notes || []}>
+                                        {(note) => <li>{note}</li>}
+                                      </For>
+                                    </ul>
+                                  </Show>
+                                </Card>
+                              )}
+                            </Show>
+
+                            {/* Alerts configuration */}
+                            <Show when={diagnosticsData()?.alerts}>
+                              {(alerts) => (
+                                <Card padding="sm">
+                                  <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
+                                    Alerts configuration
+                                  </h5>
+                                  <div class="text-xs text-gray-600 dark:text-gray-400 space-y-2">
+                                    <div class="flex flex-wrap gap-2">
+                                      <span
+                                        class={`px-2 py-0.5 rounded text-xs ${
+                                          alerts().legacyThresholdsDetected
+                                            ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
+                                            : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
+                                        }`}
+                                      >
+                                        Legacy thresholds{' '}
+                                        {alerts().legacyThresholdsDetected
+                                          ? 'detected'
+                                          : 'migrated'}
+                                      </span>
+                                      <span
+                                        class={`px-2 py-0.5 rounded text-xs ${
+                                          alerts().missingCooldown
+                                            ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
+                                            : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
+                                        }`}
+                                      >
+                                        Cooldown{' '}
+                                        {alerts().missingCooldown ? 'missing' : 'configured'}
+                                      </span>
+                                      <span
+                                        class={`px-2 py-0.5 rounded text-xs ${
+                                          alerts().missingGroupingWindow
+                                            ? 'bg-yellow-100 text-yellow-700 dark:bg-yellow-700/40 dark:text-yellow-100'
+                                            : 'bg-green-100 text-green-700 dark:bg-green-700/40 dark:text-green-100'
+                                        }`}
+                                      >
+                                        Grouping window{' '}
+                                        {alerts().missingGroupingWindow ? 'disabled' : 'enabled'}
+                                      </span>
+                                    </div>
+                                    <Show
+                                      when={
+                                        alerts().legacyThresholdSources &&
+                                        alerts().legacyThresholdSources!.length > 0
+                                      }
+                                    >
+                                      <div>
+                                        Legacy sources:{' '}
+                                        {alerts().legacyThresholdSources!.join(', ')}
+                                      </div>
+                                    </Show>
+                                    <Show
+                                      when={
+                                        alerts().legacyScheduleSettings &&
+                                        alerts().legacyScheduleSettings!.length > 0
+                                      }
+                                    >
+                                      <div>
+                                        Legacy schedule settings:{' '}
+                                        {alerts().legacyScheduleSettings!.join(', ')}
+                                      </div>
+                                    </Show>
+                                  </div>
+                                  <Show when={alerts().notes && alerts().notes!.length > 0}>
+                                    <ul class="mt-3 text-xs text-gray-600 dark:text-gray-400 list-disc pl-4 space-y-1">
+                                      <For each={alerts().notes || []}>
+                                        {(note) => <li>{note}</li>}
+                                      </For>
+                                    </ul>
+                                  </Show>
+                                </Card>
+                              )}
+                            </Show>
+
+                            {/* Nodes Status */}
+                            <Show
+                              when={diagnosticsData()?.nodes && diagnosticsData()!.nodes.length > 0}
+                            >
+                              <Card padding="sm">
+                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
+                                  PVE Nodes
+                                </h5>
+                                <For each={diagnosticsData()?.nodes || []}>
+                                  {(node) => (
+                                    <div class="text-xs border-t dark:border-gray-700 pt-2 mt-2 first:border-0 first:pt-0 first:mt-0">
+                                      <div class="flex justify-between items-center mb-1">
+                                        <span class="font-medium text-gray-700 dark:text-gray-300">
+                                          {node.name}
+                                        </span>
+                                        <span
+                                          class={`px-2 py-0.5 rounded text-white text-xs ${
+                                            node.connected ? 'bg-green-500' : 'bg-red-500'
+                                          }`}
+                                        >
+                                          {node.connected ? 'Connected' : 'Failed'}
+                                        </span>
+                                      </div>
+                                      <div class="text-gray-600 dark:text-gray-400">
+                                        <div>Host: {node.host}</div>
+                                        <div>Auth: {node.authMethod?.replace('_', ' ')}</div>
+                                        <Show when={node.error}>
+                                          <div class="text-red-500 mt-1 break-words">
+                                            {node.error}
+                                          </div>
+                                        </Show>
+                                      </div>
+                                    </div>
+                                  )}
+                                </For>
+                              </Card>
+                            </Show>
+
+                            {/* PBS Status */}
+                            <Show
+                              when={diagnosticsData()?.pbs && diagnosticsData()!.pbs.length > 0}
+                            >
+                              <Card padding="sm">
+                                <h5 class="text-sm font-semibold mb-2 text-gray-700 dark:text-gray-300">
+                                  PBS Instances
+                                </h5>
+                                <For each={diagnosticsData()?.pbs || []}>
+                                  {(pbs) => (
+                                    <div class="text-xs border-t dark:border-gray-700 pt-2 mt-2 first:border-0 first:pt-0 first:mt-0">
+                                      <div class="flex justify-between items-center mb-1">
+                                        <span class="font-medium text-gray-700 dark:text-gray-300">
+                                          {pbs.name}
+                                        </span>
+                                        <span
+                                          class={`px-2 py-0.5 rounded text-white text-xs ${
+                                            pbs.connected ? 'bg-green-500' : 'bg-red-500'
+                                          }`}
+                                        >
+                                          {pbs.connected ? 'Connected' : 'Failed'}
+                                        </span>
+                                      </div>
+                                      <Show when={pbs.error}>
+                                        <div class="text-red-500 break-words">{pbs.error}</div>
+                                      </Show>
+                                    </div>
+                                  )}
+                                </For>
+                              </Card>
+                            </Show>
+                          </div>
+                        </Show>
+                      </div>
+                      {/* System Information */}
+                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
+                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
+                          System Information
+                        </h4>
+                        <div class="space-y-2 text-sm">
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">Version:</span>
+                            <span class="font-medium">2.0.0</span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">Backend:</span>
+                            <span class="font-medium">Go 1.21</span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">Frontend:</span>
+                            <span class="font-medium">SolidJS + TypeScript</span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">WebSocket Status:</span>
+                            <span
+                              class={`font-medium ${connected() ? 'text-green-600' : 'text-red-600'}`}
+                            >
+                              {connected() ? 'Connected' : 'Disconnected'}
+                            </span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">Server Port:</span>
+                            <span class="font-medium">
+                              {window.location.port ||
+                                (window.location.protocol === 'https:' ? '443' : '80')}
+                            </span>
+                          </div>
                         </div>
                       </div>
-                    </div>
 
-                    {/* Connection Status */}
-                    <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                      <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                        Connection Status
-                      </h4>
-                      <div class="space-y-2 text-sm">
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">PVE Nodes:</span>
-                          <span class="font-medium">
-                            {pveNodes().length}
-                          </span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">PBS Nodes:</span>
-                          <span class="font-medium">
-                            {pbsNodes().length}
-                          </span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">Total VMs:</span>
-                          <span class="font-medium">{state.vms?.length || 0}</span>
-                        </div>
-                        <div class="flex justify-between">
-                          <span class="text-gray-600 dark:text-gray-400">Total Containers:</span>
-                          <span class="font-medium">{state.containers?.length || 0}</span>
+                      {/* Connection Status */}
+                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
+                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
+                          Connection Status
+                        </h4>
+                        <div class="space-y-2 text-sm">
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">PVE Nodes:</span>
+                            <span class="font-medium">{pveNodes().length}</span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">PBS Nodes:</span>
+                            <span class="font-medium">{pbsNodes().length}</span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">Total VMs:</span>
+                            <span class="font-medium">{state.vms?.length || 0}</span>
+                          </div>
+                          <div class="flex justify-between">
+                            <span class="text-gray-600 dark:text-gray-400">Total Containers:</span>
+                            <span class="font-medium">{state.containers?.length || 0}</span>
+                          </div>
                         </div>
                       </div>
-                    </div>
 
-                    {/* Export Diagnostics */}
-                    <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
-                      <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
-                        Export Diagnostics
-                      </h4>
-                      <p class="text-xs text-gray-600 dark:text-gray-400 mb-4">
-                        Export system diagnostics data for troubleshooting
-                      </p>
+                      {/* Export Diagnostics */}
+                      <div class="bg-gray-50 dark:bg-gray-700/50 rounded-lg p-4">
+                        <h4 class="text-sm font-medium text-gray-700 dark:text-gray-300 mb-4">
+                          Export Diagnostics
+                        </h4>
+                        <p class="text-xs text-gray-600 dark:text-gray-400 mb-4">
+                          Export system diagnostics data for troubleshooting
+                        </p>
 
-                      {/* Helper function to sanitize sensitive data */}
-                      {(() => {
-                        const sanitizeForGitHub = (data: Record<string, unknown>) => {
-                          // Deep clone the data
-                        const sanitized = JSON.parse(JSON.stringify(data)) as Record<
-                          string,
-                          unknown
-                        >;
+                        {/* Helper function to sanitize sensitive data */}
+                        {(() => {
+                          const sanitizeForGitHub = (data: Record<string, unknown>) => {
+                            // Deep clone the data
+                            const sanitized = JSON.parse(JSON.stringify(data)) as Record<
+                              string,
+                              unknown
+                            >;
 
-                        const connectionKeyMap = new Map<string, string>();
-                        const instanceKeyMap = new Map<string, string>();
+                            const connectionKeyMap = new Map<string, string>();
+                            const instanceKeyMap = new Map<string, string>();
 
-                        const getSanitizedInstance = (instance: string) => {
-                          if (!instance) return instance;
-                          if (instanceKeyMap.has(instance)) {
-                            return instanceKeyMap.get(instance)!;
-                          }
-                          const suffixMatch = instance.match(/\.(lan|local|home|internal)$/);
-                          const suffix = suffixMatch ? suffixMatch[0] : '';
-                          const label = `instance-REDACTED${suffix}`;
-                          instanceKeyMap.set(instance, label);
-                          return label;
-                        };
-
-                          // Sanitize IP addresses (keep first octet for network type identification)
-                          const sanitizeIP = (ip: string) => {
-                            if (!ip) return ip;
-                            const parts = ip.split('.');
-                            if (parts.length === 4) {
-                              return `${parts[0]}.xxx.xxx.xxx`;
-                            }
-                            return 'xxx.xxx.xxx.xxx';
-                          };
-
-                          // Sanitize hostname but keep domain suffix for context
-                          const sanitizeHostname = (hostname: string) => {
-                            if (!hostname) return hostname;
-                            // Keep common suffixes like .lan, .local, .home
-                            const suffixMatch = hostname.match(/\.(lan|local|home|internal)$/);
-                            const suffix = suffixMatch ? suffixMatch[0] : '';
-                            return `node-REDACTED${suffix}`;
-                          };
-
-                          const sanitizeText = (text: string | undefined) => {
-                            if (!text) return text;
-                            return text
-                              .replace(/https?:\/\/[^"'\s]+/g, 'https://REDACTED')
-                              .replace(/\b\d{1,3}(?:\.\d{1,3}){3}\b/g, 'xxx.xxx.xxx.xxx');
-                          };
-
-                          const sanitizeNotesArray = (notes: unknown) => {
-                            if (!Array.isArray(notes)) return notes;
-                            return notes.map((note) => {
-                              if (typeof note !== 'string') return note;
-                              const sanitizedNote = sanitizeText(note);
-                              return sanitizedNote ?? note;
-                            });
-                          };
-
-                          const sanitizeNodeSnapshots = (
-                            snapshots: Array<Record<string, unknown>>,
-                          ) =>
-                            snapshots.map((snapshot, index: number) => {
-                              const sanitizedSnapshot = { ...snapshot };
-                              const originalNode =
-                                typeof sanitizedSnapshot.node === 'string'
-                                  ? (sanitizedSnapshot.node as string)
-                                  : '';
-                              if (originalNode) {
-                                sanitizedSnapshot.node =
-                                  connectionKeyMap.get(originalNode) ||
-                                  sanitizeHostname(originalNode);
+                            const getSanitizedInstance = (instance: string) => {
+                              if (!instance) return instance;
+                              if (instanceKeyMap.has(instance)) {
+                                return instanceKeyMap.get(instance)!;
                               }
+                              const suffixMatch = instance.match(/\.(lan|local|home|internal)$/);
+                              const suffix = suffixMatch ? suffixMatch[0] : '';
+                              const label = `instance-REDACTED${suffix}`;
+                              instanceKeyMap.set(instance, label);
+                              return label;
+                            };
 
-                              const originalInstance =
-                                typeof sanitizedSnapshot.instance === 'string'
-                                  ? (sanitizedSnapshot.instance as string)
-                                  : '';
-                              if (originalInstance) {
-                                sanitizedSnapshot.instance = getSanitizedInstance(originalInstance);
+                            // Sanitize IP addresses (keep first octet for network type identification)
+                            const sanitizeIP = (ip: string) => {
+                              if (!ip) return ip;
+                              const parts = ip.split('.');
+                              if (parts.length === 4) {
+                                return `${parts[0]}.xxx.xxx.xxx`;
                               }
+                              return 'xxx.xxx.xxx.xxx';
+                            };
 
-                              if (
-                                typeof sanitizedSnapshot.id === 'string' &&
-                                sanitizedSnapshot.id
-                              ) {
-                                sanitizedSnapshot.id = `node-snapshot-${index}`;
-                              }
+                            // Sanitize hostname but keep domain suffix for context
+                            const sanitizeHostname = (hostname: string) => {
+                              if (!hostname) return hostname;
+                              // Keep common suffixes like .lan, .local, .home
+                              const suffixMatch = hostname.match(/\.(lan|local|home|internal)$/);
+                              const suffix = suffixMatch ? suffixMatch[0] : '';
+                              return `node-REDACTED${suffix}`;
+                            };
 
-                              return sanitizedSnapshot;
-                            });
+                            const sanitizeText = (text: string | undefined) => {
+                              if (!text) return text;
+                              return text
+                                .replace(/https?:\/\/[^"'\s]+/g, 'https://REDACTED')
+                                .replace(/\b\d{1,3}(?:\.\d{1,3}){3}\b/g, 'xxx.xxx.xxx.xxx');
+                            };
 
-                          const sanitizeGuestSnapshots = (
-                            snapshots: Array<Record<string, unknown>>,
-                          ) =>
-                            snapshots.map((snapshot, index: number) => {
-                              const sanitizedSnapshot = { ...snapshot };
-                              const originalNode =
-                                typeof sanitizedSnapshot.node === 'string'
-                                  ? (sanitizedSnapshot.node as string)
-                                  : '';
-                              if (originalNode) {
-                                sanitizedSnapshot.node =
-                                  connectionKeyMap.get(originalNode) ||
-                                  sanitizeHostname(originalNode);
-                              }
+                            const sanitizeNotesArray = (notes: unknown) => {
+                              if (!Array.isArray(notes)) return notes;
+                              return notes.map((note) => {
+                                if (typeof note !== 'string') return note;
+                                const sanitizedNote = sanitizeText(note);
+                                return sanitizedNote ?? note;
+                              });
+                            };
 
-                              const originalInstance =
-                                typeof sanitizedSnapshot.instance === 'string'
-                                  ? (sanitizedSnapshot.instance as string)
-                                  : '';
-                              if (originalInstance) {
-                                sanitizedSnapshot.instance = getSanitizedInstance(originalInstance);
-                              }
-
-                              if (typeof sanitizedSnapshot.name === 'string') {
-                                sanitizedSnapshot.name = 'vm-REDACTED';
-                              }
-
-                              if (typeof sanitizedSnapshot.vmid === 'number') {
-                                sanitizedSnapshot.vmid = index + 1;
-                              } else if (typeof sanitizedSnapshot.vmid === 'string') {
-                                sanitizedSnapshot.vmid = `vm-${index + 1}`;
-                              }
-
-                              if (Array.isArray(sanitizedSnapshot.notes)) {
-                                sanitizedSnapshot.notes = sanitizeNotesArray(
-                                  sanitizedSnapshot.notes,
-                                );
-                              }
-
-                              return sanitizedSnapshot;
-                            });
-
-                          // Sanitize nodes
-                          if (sanitized.nodes) {
-                            sanitized.nodes = (
-                              sanitized.nodes as Array<Record<string, unknown>>
-                            ).map((node, index: number) => {
-                              const nodeType =
-                                typeof node.type === 'string' ? (node.type as string) : 'node';
-                              const nodeName =
-                                typeof node.name === 'string' ? (node.name as string) : '';
-                              const nodeHost =
-                                typeof node.host === 'string' ? (node.host as string) : '';
-                              const tokenName =
-                                typeof node.tokenName === 'string'
-                                  ? (node.tokenName as string)
-                                  : undefined;
-                              const clusterName =
-                                typeof node.clusterName === 'string'
-                                  ? (node.clusterName as string)
-                                  : undefined;
-                              const clusterEndpoints = Array.isArray(node.clusterEndpoints)
-                                ? (node.clusterEndpoints as Array<Record<string, unknown>>).map(
-                                    (ep, epIndex: number) => ({
-                                      ...ep,
-                                      NodeName: `node-${epIndex + 1}`,
-                                      Host: `node-${epIndex + 1}`,
-                                      IP: sanitizeIP(typeof ep.IP === 'string' ? ep.IP : ''),
-                                    }),
-                                  )
-                                : node.clusterEndpoints;
-
-                              const sanitizedId = `${nodeType}-${index}`;
-                              connectionKeyMap.set(nodeName, sanitizedId);
-
-                              // Sanitize nested physical disks data if present
-                              const physicalDisks = node.physicalDisks as Record<
-                                string,
-                                unknown
-                              > | undefined;
-                              if (physicalDisks && Array.isArray(physicalDisks.nodeResults)) {
-                                physicalDisks.nodeResults = (
-                                  physicalDisks.nodeResults as Array<Record<string, unknown>>
-                                ).map((result) => ({
-                                  ...result,
-                                  nodeName: sanitizeHostname(
-                                    typeof result.nodeName === 'string' ? result.nodeName : '',
-                                  ),
-                                  apiResponse:
-                                    sanitizeText(
-                                      typeof result.apiResponse === 'string'
-                                        ? result.apiResponse
-                                        : undefined,
-                                    ) ?? result.apiResponse,
-                                  error:
-                                    sanitizeText(
-                                      typeof result.error === 'string' ? result.error : undefined,
-                                    ) ?? result.error,
-                                }));
-                              }
-
-                              // Sanitize nested VM disk check data if present
-                              const vmDiskCheck = node.vmDiskCheck as Record<
-                                string,
-                                unknown
-                              > | undefined;
-                              if (vmDiskCheck) {
-                                if (typeof vmDiskCheck.testVMName === 'string') {
-                                  vmDiskCheck.testVMName = 'vm-REDACTED';
+                            const sanitizeNodeSnapshots = (
+                              snapshots: Array<Record<string, unknown>>,
+                            ) =>
+                              snapshots.map((snapshot, index: number) => {
+                                const sanitizedSnapshot = { ...snapshot };
+                                const originalNode =
+                                  typeof sanitizedSnapshot.node === 'string'
+                                    ? (sanitizedSnapshot.node as string)
+                                    : '';
+                                if (originalNode) {
+                                  sanitizedSnapshot.node =
+                                    connectionKeyMap.get(originalNode) ||
+                                    sanitizeHostname(originalNode);
                                 }
-                                if (typeof vmDiskCheck.testResult === 'string') {
-                                  vmDiskCheck.testResult = sanitizeText(vmDiskCheck.testResult);
+
+                                const originalInstance =
+                                  typeof sanitizedSnapshot.instance === 'string'
+                                    ? (sanitizedSnapshot.instance as string)
+                                    : '';
+                                if (originalInstance) {
+                                  sanitizedSnapshot.instance =
+                                    getSanitizedInstance(originalInstance);
                                 }
-                                if (Array.isArray(vmDiskCheck.problematicVMs)) {
-                                  vmDiskCheck.problematicVMs = (
-                                    vmDiskCheck.problematicVMs as Array<Record<string, unknown>>
-                                  ).map((problem) => ({
-                                    ...problem,
-                                    name: 'vm-REDACTED',
-                                    issue:
+
+                                if (
+                                  typeof sanitizedSnapshot.id === 'string' &&
+                                  sanitizedSnapshot.id
+                                ) {
+                                  sanitizedSnapshot.id = `node-snapshot-${index}`;
+                                }
+
+                                return sanitizedSnapshot;
+                              });
+
+                            const sanitizeGuestSnapshots = (
+                              snapshots: Array<Record<string, unknown>>,
+                            ) =>
+                              snapshots.map((snapshot, index: number) => {
+                                const sanitizedSnapshot = { ...snapshot };
+                                const originalNode =
+                                  typeof sanitizedSnapshot.node === 'string'
+                                    ? (sanitizedSnapshot.node as string)
+                                    : '';
+                                if (originalNode) {
+                                  sanitizedSnapshot.node =
+                                    connectionKeyMap.get(originalNode) ||
+                                    sanitizeHostname(originalNode);
+                                }
+
+                                const originalInstance =
+                                  typeof sanitizedSnapshot.instance === 'string'
+                                    ? (sanitizedSnapshot.instance as string)
+                                    : '';
+                                if (originalInstance) {
+                                  sanitizedSnapshot.instance =
+                                    getSanitizedInstance(originalInstance);
+                                }
+
+                                if (typeof sanitizedSnapshot.name === 'string') {
+                                  sanitizedSnapshot.name = 'vm-REDACTED';
+                                }
+
+                                if (typeof sanitizedSnapshot.vmid === 'number') {
+                                  sanitizedSnapshot.vmid = index + 1;
+                                } else if (typeof sanitizedSnapshot.vmid === 'string') {
+                                  sanitizedSnapshot.vmid = `vm-${index + 1}`;
+                                }
+
+                                if (Array.isArray(sanitizedSnapshot.notes)) {
+                                  sanitizedSnapshot.notes = sanitizeNotesArray(
+                                    sanitizedSnapshot.notes,
+                                  );
+                                }
+
+                                return sanitizedSnapshot;
+                              });
+
+                            // Sanitize nodes
+                            if (sanitized.nodes) {
+                              sanitized.nodes = (
+                                sanitized.nodes as Array<Record<string, unknown>>
+                              ).map((node, index: number) => {
+                                const nodeType =
+                                  typeof node.type === 'string' ? (node.type as string) : 'node';
+                                const nodeName =
+                                  typeof node.name === 'string' ? (node.name as string) : '';
+                                const nodeHost =
+                                  typeof node.host === 'string' ? (node.host as string) : '';
+                                const tokenName =
+                                  typeof node.tokenName === 'string'
+                                    ? (node.tokenName as string)
+                                    : undefined;
+                                const clusterName =
+                                  typeof node.clusterName === 'string'
+                                    ? (node.clusterName as string)
+                                    : undefined;
+                                const clusterEndpoints = Array.isArray(node.clusterEndpoints)
+                                  ? (node.clusterEndpoints as Array<Record<string, unknown>>).map(
+                                      (ep, epIndex: number) => ({
+                                        ...ep,
+                                        NodeName: `node-${epIndex + 1}`,
+                                        Host: `node-${epIndex + 1}`,
+                                        IP: sanitizeIP(typeof ep.IP === 'string' ? ep.IP : ''),
+                                      }),
+                                    )
+                                  : node.clusterEndpoints;
+
+                                const sanitizedId = `${nodeType}-${index}`;
+                                connectionKeyMap.set(nodeName, sanitizedId);
+
+                                // Sanitize nested physical disks data if present
+                                const physicalDisks = node.physicalDisks as
+                                  | Record<string, unknown>
+                                  | undefined;
+                                if (physicalDisks && Array.isArray(physicalDisks.nodeResults)) {
+                                  physicalDisks.nodeResults = (
+                                    physicalDisks.nodeResults as Array<Record<string, unknown>>
+                                  ).map((result) => ({
+                                    ...result,
+                                    nodeName: sanitizeHostname(
+                                      typeof result.nodeName === 'string' ? result.nodeName : '',
+                                    ),
+                                    apiResponse:
                                       sanitizeText(
-                                        typeof problem.issue === 'string' ? problem.issue : undefined,
-                                      ) ?? problem.issue,
+                                        typeof result.apiResponse === 'string'
+                                          ? result.apiResponse
+                                          : undefined,
+                                      ) ?? result.apiResponse,
+                                    error:
+                                      sanitizeText(
+                                        typeof result.error === 'string' ? result.error : undefined,
+                                      ) ?? result.error,
                                   }));
                                 }
-                                if (Array.isArray(vmDiskCheck.recommendations)) {
-                                  vmDiskCheck.recommendations = (
-                                    vmDiskCheck.recommendations as Array<string>
-                                  ).map((rec) => sanitizeText(rec) ?? rec);
+
+                                // Sanitize nested VM disk check data if present
+                                const vmDiskCheck = node.vmDiskCheck as
+                                  | Record<string, unknown>
+                                  | undefined;
+                                if (vmDiskCheck) {
+                                  if (typeof vmDiskCheck.testVMName === 'string') {
+                                    vmDiskCheck.testVMName = 'vm-REDACTED';
+                                  }
+                                  if (typeof vmDiskCheck.testResult === 'string') {
+                                    vmDiskCheck.testResult = sanitizeText(vmDiskCheck.testResult);
+                                  }
+                                  if (Array.isArray(vmDiskCheck.problematicVMs)) {
+                                    vmDiskCheck.problematicVMs = (
+                                      vmDiskCheck.problematicVMs as Array<Record<string, unknown>>
+                                    ).map((problem) => ({
+                                      ...problem,
+                                      name: 'vm-REDACTED',
+                                      issue:
+                                        sanitizeText(
+                                          typeof problem.issue === 'string'
+                                            ? problem.issue
+                                            : undefined,
+                                        ) ?? problem.issue,
+                                    }));
+                                  }
+                                  if (Array.isArray(vmDiskCheck.recommendations)) {
+                                    vmDiskCheck.recommendations = (
+                                      vmDiskCheck.recommendations as Array<string>
+                                    ).map((rec) => sanitizeText(rec) ?? rec);
+                                  }
                                 }
+
+                                return {
+                                  ...node,
+                                  id: sanitizedId,
+                                  name: sanitizeHostname(nodeName),
+                                  host: nodeHost
+                                    ? nodeHost.replace(/https?:\/\/[^:\/]+/, 'https://REDACTED')
+                                    : nodeHost,
+                                  tokenName: tokenName ? 'token-REDACTED' : tokenName,
+                                  clusterName: clusterName ? 'cluster-REDACTED' : clusterName,
+                                  clusterEndpoints,
+                                  physicalDisks,
+                                  vmDiskCheck,
+                                };
+                              });
+                            }
+
+                            if (Array.isArray(sanitized.nodeSnapshots)) {
+                              sanitized.nodeSnapshots = sanitizeNodeSnapshots(
+                                sanitized.nodeSnapshots as Array<Record<string, unknown>>,
+                              );
+                            }
+
+                            if (Array.isArray(sanitized.guestSnapshots)) {
+                              sanitized.guestSnapshots = sanitizeGuestSnapshots(
+                                sanitized.guestSnapshots as Array<Record<string, unknown>>,
+                              );
+                            }
+
+                            if (
+                              sanitized.temperatureProxy &&
+                              typeof sanitized.temperatureProxy === 'object'
+                            ) {
+                              const proxyDiag = sanitized.temperatureProxy as Record<
+                                string,
+                                unknown
+                              >;
+                              if (typeof proxyDiag.socketPath === 'string') {
+                                proxyDiag.socketPath = proxyDiag.socketPath.includes(
+                                  'pulse-sensor-proxy',
+                                )
+                                  ? '/mnt/pulse-proxy/pulse-sensor-proxy.sock'
+                                  : 'proxy-socket';
+                              }
+                              if (Array.isArray(proxyDiag.notes)) {
+                                proxyDiag.notes = sanitizeNotesArray(proxyDiag.notes);
                               }
-
-                              return {
-                                ...node,
-                                id: sanitizedId,
-                                name: sanitizeHostname(nodeName),
-                                host: nodeHost
-                                  ? nodeHost.replace(/https?:\/\/[^:\/]+/, 'https://REDACTED')
-                                  : nodeHost,
-                                tokenName: tokenName ? 'token-REDACTED' : tokenName,
-                                clusterName: clusterName ? 'cluster-REDACTED' : clusterName,
-                                clusterEndpoints,
-                                physicalDisks,
-                                vmDiskCheck,
-                              };
-                            });
-                          }
-
-                          if (Array.isArray(sanitized.nodeSnapshots)) {
-                            sanitized.nodeSnapshots = sanitizeNodeSnapshots(
-                              sanitized.nodeSnapshots as Array<Record<string, unknown>>,
-                            );
-                          }
-
-                          if (Array.isArray(sanitized.guestSnapshots)) {
-                            sanitized.guestSnapshots = sanitizeGuestSnapshots(
-                              sanitized.guestSnapshots as Array<Record<string, unknown>>,
-                            );
-                          }
-
-                          if (
-                            sanitized.temperatureProxy &&
-                            typeof sanitized.temperatureProxy === 'object'
-                          ) {
-                            const proxyDiag = sanitized.temperatureProxy as Record<string, unknown>;
-                            if (typeof proxyDiag.socketPath === 'string') {
-                              proxyDiag.socketPath = proxyDiag.socketPath.includes(
-                                'pulse-sensor-proxy',
-                              )
-                                ? '/mnt/pulse-proxy/pulse-sensor-proxy.sock'
-                                : 'proxy-socket';
                             }
-                            if (Array.isArray(proxyDiag.notes)) {
-                              proxyDiag.notes = sanitizeNotesArray(proxyDiag.notes);
-                            }
-                          }
 
-                          if (sanitized.apiTokens && typeof sanitized.apiTokens === 'object') {
-                            const apiTokens = sanitized.apiTokens as Record<string, unknown>;
-                            const tokenIdMap = new Map<string, string>();
-                            if (Array.isArray(apiTokens.tokens)) {
-                              apiTokens.tokens = (apiTokens.tokens as Array<Record<string, unknown>>).map(
-                                (token, tokenIndex: number) => {
+                            if (sanitized.apiTokens && typeof sanitized.apiTokens === 'object') {
+                              const apiTokens = sanitized.apiTokens as Record<string, unknown>;
+                              const tokenIdMap = new Map<string, string>();
+                              if (Array.isArray(apiTokens.tokens)) {
+                                apiTokens.tokens = (
+                                  apiTokens.tokens as Array<Record<string, unknown>>
+                                ).map((token, tokenIndex: number) => {
                                   const sanitizedToken = { ...token } as Record<string, unknown>;
                                   const originalId =
                                     typeof token.id === 'string' ? (token.id as string) : '';
@@ -5355,899 +5783,926 @@ const Settings: Component<SettingsProps> = (props) => {
                                     sanitizedToken.hint = 'token-REDACTED';
                                   }
                                   return sanitizedToken;
-                                },
-                              );
-                            }
-                            if (Array.isArray(apiTokens.usage)) {
-                              apiTokens.usage = (apiTokens.usage as Array<Record<string, unknown>>).map(
-                                (usage, usageIndex: number) => {
+                                });
+                              }
+                              if (Array.isArray(apiTokens.usage)) {
+                                apiTokens.usage = (
+                                  apiTokens.usage as Array<Record<string, unknown>>
+                                ).map((usage, usageIndex: number) => {
                                   const sanitizedUsage = { ...usage } as Record<string, unknown>;
                                   const originalTokenId =
-                                    typeof usage.tokenId === 'string' ? (usage.tokenId as string) : '';
+                                    typeof usage.tokenId === 'string'
+                                      ? (usage.tokenId as string)
+                                      : '';
                                   const mappedId =
                                     tokenIdMap.get(originalTokenId) ?? `token-${usageIndex + 1}`;
                                   sanitizedUsage.tokenId = mappedId;
                                   if (Array.isArray(sanitizedUsage.hosts)) {
-                                    sanitizedUsage.hosts = (sanitizedUsage.hosts as Array<string>).map(
-                                      (host, hostIndex) =>
-                                        sanitizeHostname(
-                                          typeof host === 'string' ? host : `host-${hostIndex + 1}`,
-                                        ),
+                                    sanitizedUsage.hosts = (
+                                      sanitizedUsage.hosts as Array<string>
+                                    ).map((host, hostIndex) =>
+                                      sanitizeHostname(
+                                        typeof host === 'string' ? host : `host-${hostIndex + 1}`,
+                                      ),
                                     );
                                   }
                                   return sanitizedUsage;
-                                },
-                              );
-                            }
-                            if (Array.isArray(apiTokens.notes)) {
-                              apiTokens.notes = sanitizeNotesArray(apiTokens.notes);
-                            }
-                          }
-
-                          if (sanitized.dockerAgents && typeof sanitized.dockerAgents === 'object') {
-                            const dockerDiag = sanitized.dockerAgents as Record<string, unknown>;
-                            if (Array.isArray(dockerDiag.attention)) {
-                              dockerDiag.attention = (
-                                dockerDiag.attention as Array<Record<string, unknown>>
-                              ).map((entry, index: number) => {
-                                const sanitizedEntry = { ...entry };
-                                sanitizedEntry.hostId = `docker-host-${index + 1}`;
-                                sanitizedEntry.name = `docker-host-${index + 1}`;
-                                if (typeof sanitizedEntry.tokenHint === 'string') {
-                                  sanitizedEntry.tokenHint = 'token-REDACTED';
-                                }
-                                if (Array.isArray(sanitizedEntry.issues)) {
-                                  sanitizedEntry.issues = sanitizeNotesArray(
-                                    sanitizedEntry.issues,
-                                  );
-                                }
-                                return sanitizedEntry;
-                              });
-                            }
-                            if (Array.isArray(dockerDiag.notes)) {
-                              dockerDiag.notes = sanitizeNotesArray(dockerDiag.notes);
-                            }
-                          }
-
-                          if (sanitized.alerts && typeof sanitized.alerts === 'object') {
-                            const alerts = sanitized.alerts as Record<string, unknown>;
-                            if (Array.isArray(alerts.legacyThresholdSources)) {
-                              alerts.legacyThresholdSources = (alerts.legacyThresholdSources as string[]).map((source) => sanitizeText(source) ?? source);
-                            }
-                            if (Array.isArray(alerts.legacyScheduleSettings)) {
-                              alerts.legacyScheduleSettings = (alerts.legacyScheduleSettings as string[]).map((setting) => sanitizeText(setting) ?? setting);
-                            }
-                            if (Array.isArray(alerts.notes)) {
-                              alerts.notes = sanitizeNotesArray(alerts.notes);
-                            }
-                          }
-
-                          // Sanitize backend diagnostics (if present)
-                          if (
-                            sanitized.backendDiagnostics &&
-                            typeof sanitized.backendDiagnostics === 'object'
-                          ) {
-                            const backend = sanitized.backendDiagnostics as Record<string, unknown>;
-
-                            if (Array.isArray(backend.nodeSnapshots)) {
-                              backend.nodeSnapshots = sanitizeNodeSnapshots(
-                                backend.nodeSnapshots as Array<Record<string, unknown>>,
-                              );
+                                });
+                              }
+                              if (Array.isArray(apiTokens.notes)) {
+                                apiTokens.notes = sanitizeNotesArray(apiTokens.notes);
+                              }
                             }
 
-                            if (Array.isArray(backend.guestSnapshots)) {
-                              backend.guestSnapshots = sanitizeGuestSnapshots(
-                                backend.guestSnapshots as Array<Record<string, unknown>>,
-                              );
-                            }
-
-                            if (Array.isArray(backend.nodes)) {
-                              backend.nodes = backend.nodes.map((rawNode, index: number) => {
-                                const node = rawNode as Record<string, unknown>;
-                                const originalName = typeof node.name === 'string' ? node.name : '';
-                                const sanitizedId = `diagnostic-node-${index}`;
-                                connectionKeyMap.set(originalName, sanitizedId);
-
-                                const vmDiskCheck = node.vmDiskCheck as Record<string, unknown> | undefined;
-                                const physicalDisks = node.physicalDisks as Record<
-                                  string,
-                                  unknown
-                                > | undefined;
-
-                                if (vmDiskCheck) {
-                                  if (typeof vmDiskCheck.testVMName === 'string') {
-                                    vmDiskCheck.testVMName = 'vm-REDACTED';
+                            if (
+                              sanitized.dockerAgents &&
+                              typeof sanitized.dockerAgents === 'object'
+                            ) {
+                              const dockerDiag = sanitized.dockerAgents as Record<string, unknown>;
+                              if (Array.isArray(dockerDiag.attention)) {
+                                dockerDiag.attention = (
+                                  dockerDiag.attention as Array<Record<string, unknown>>
+                                ).map((entry, index: number) => {
+                                  const sanitizedEntry = { ...entry };
+                                  sanitizedEntry.hostId = `docker-host-${index + 1}`;
+                                  sanitizedEntry.name = `docker-host-${index + 1}`;
+                                  if (typeof sanitizedEntry.tokenHint === 'string') {
+                                    sanitizedEntry.tokenHint = 'token-REDACTED';
                                   }
-                                  if (typeof vmDiskCheck.testResult === 'string') {
-                                    const sanitizedResult = sanitizeText(
-                                      vmDiskCheck.testResult as string,
+                                  if (Array.isArray(sanitizedEntry.issues)) {
+                                    sanitizedEntry.issues = sanitizeNotesArray(
+                                      sanitizedEntry.issues,
                                     );
-                                    vmDiskCheck.testResult = sanitizedResult ?? vmDiskCheck.testResult;
                                   }
-                                  if (Array.isArray(vmDiskCheck.problematicVMs)) {
-                                    vmDiskCheck.problematicVMs = (
-                                      vmDiskCheck.problematicVMs as Array<Record<string, unknown>>
-                                    ).map((problem) => {
-                                      const issueText = sanitizeText(
-                                        typeof problem.issue === 'string' ? problem.issue : undefined,
-                                      );
-                                      return {
-                                        ...problem,
-                                        name: 'vm-REDACTED',
-                                        issue: issueText ?? problem.issue,
-                                      };
-                                    });
-                                  }
-                                  if (Array.isArray(vmDiskCheck.recommendations)) {
-                                    vmDiskCheck.recommendations = (
-                                      vmDiskCheck.recommendations as Array<string>
-                                    ).map((rec) => sanitizeText(rec) ?? rec);
-                                  }
-                                }
-
-                                if (physicalDisks) {
-                                  if (typeof physicalDisks.testResult === 'string') {
-                                    const sanitizedResult = sanitizeText(
-                                      physicalDisks.testResult as string,
-                                    );
-                                    physicalDisks.testResult = sanitizedResult ?? physicalDisks.testResult;
-                                  }
-                                  if (Array.isArray(physicalDisks.nodeResults)) {
-                                    physicalDisks.nodeResults = (
-                                      physicalDisks.nodeResults as Array<Record<string, unknown>>
-                                    ).map((result) => ({
-                                      ...result,
-                                      nodeName: sanitizeHostname(
-                                        typeof result.nodeName === 'string' ? result.nodeName : '',
-                                      ),
-                                      apiResponse:
-                                        sanitizeText(
-                                          typeof result.apiResponse === 'string'
-                                            ? result.apiResponse
-                                            : undefined,
-                                        ) ?? result.apiResponse,
-                                      error:
-                                        sanitizeText(
-                                          typeof result.error === 'string'
-                                            ? result.error
-                                            : undefined,
-                                        ) ?? result.error,
-                                    }));
-                                  }
-                                }
-
-                                return {
-                                  ...node,
-                                  id: sanitizedId,
-                                  name: sanitizeHostname(originalName),
-                                  host:
-                                    typeof node.host === 'string'
-                                      ? (node.host as string).replace(
-                                          /https?:\/\/[^:\/]+/,
-                                          'https://REDACTED',
-                                        )
-                                      : node.host,
-                                  error:
-                                    sanitizeText(
-                                      typeof node.error === 'string' ? node.error : undefined,
-                                    ) ?? node.error,
-                                  vmDiskCheck,
-                                  physicalDisks,
-                                };
-                              });
+                                  return sanitizedEntry;
+                                });
+                              }
+                              if (Array.isArray(dockerDiag.notes)) {
+                                dockerDiag.notes = sanitizeNotesArray(dockerDiag.notes);
+                              }
                             }
 
-                            if (Array.isArray(backend.pbs)) {
-                              backend.pbs = backend.pbs.map((rawPbs, index: number) => {
-                                const pbsNode = rawPbs as Record<string, unknown>;
-                                const originalName =
-                                  typeof pbsNode.name === 'string' ? pbsNode.name : '';
-                                const sanitizedId = `diagnostic-pbs-${index}`;
-                                connectionKeyMap.set(originalName, sanitizedId);
-
-                                return {
-                                  ...pbsNode,
-                                  id: sanitizedId,
-                                  name: sanitizeHostname(originalName),
-                                  host:
-                                    typeof pbsNode.host === 'string'
-                                      ? (pbsNode.host as string).replace(
-                                          /https?:\/\/[^:\/]+/,
-                                          'https://REDACTED',
-                                        )
-                                      : pbsNode.host,
-                                  error:
-                                    sanitizeText(
-                                      typeof pbsNode.error === 'string' ? pbsNode.error : undefined,
-                                    ) ?? pbsNode.error,
-                                };
-                              });
-                            }
-                          }
-
-                          // Sanitize storage
-                          if (sanitized.storage) {
-                            sanitized.storage = (
-                              sanitized.storage as Array<Record<string, unknown>>
-                            ).map((s, index: number) => {
-                              const storageNode = typeof s.node === 'string' ? s.node : '';
-                              return {
-                                ...s,
-                                id: `storage-${index}`,
-                                node: sanitizeHostname(storageNode),
-                                name: `storage-${index}`,
-                              };
-                            });
-                          }
-
-                          // Sanitize backups
-                          const backups = sanitized.backups as Record<string, unknown> | undefined;
-                          if (backups) {
-                            // Sanitize PVE backup tasks
-                            if (Array.isArray(backups.pveBackupTasks)) {
-                              backups.pveBackupTasks = (
-                                backups.pveBackupTasks as Array<Record<string, unknown>>
-                              ).map((b, index: number) => {
-                                const backupNode = typeof b.node === 'string' ? b.node : '';
-                                const backupVmid = typeof b.vmid === 'number' ? b.vmid : undefined;
-                                return {
-                                  ...b,
-                                  node: sanitizeHostname(backupNode),
-                                  storage: `storage-${index}`,
-                                  vmid: backupVmid !== undefined ? `vm-${backupVmid}` : backupVmid,
-                                };
-                              });
+                            if (sanitized.alerts && typeof sanitized.alerts === 'object') {
+                              const alerts = sanitized.alerts as Record<string, unknown>;
+                              if (Array.isArray(alerts.legacyThresholdSources)) {
+                                alerts.legacyThresholdSources = (
+                                  alerts.legacyThresholdSources as string[]
+                                ).map((source) => sanitizeText(source) ?? source);
+                              }
+                              if (Array.isArray(alerts.legacyScheduleSettings)) {
+                                alerts.legacyScheduleSettings = (
+                                  alerts.legacyScheduleSettings as string[]
+                                ).map((setting) => sanitizeText(setting) ?? setting);
+                              }
+                              if (Array.isArray(alerts.notes)) {
+                                alerts.notes = sanitizeNotesArray(alerts.notes);
+                              }
                             }
 
-                            // Sanitize PVE storage backups
-                            if (Array.isArray(backups.pveStorageBackups)) {
-                              backups.pveStorageBackups = (
-                                backups.pveStorageBackups as Array<Record<string, unknown>>
-                              ).map((b, index: number) => {
-                                const backupNode = typeof b.node === 'string' ? b.node : '';
-                                const backupVmid = typeof b.vmid === 'number' ? b.vmid : undefined;
-                                const volid = typeof b.volid === 'string' ? b.volid : undefined;
-                                return {
-                                  ...b,
-                                node: sanitizeHostname(backupNode),
-                                storage: `storage-${index}`,
-                                vmid: backupVmid !== undefined ? `vm-${backupVmid}` : backupVmid,
-                                volid: volid ? 'vol-REDACTED' : volid,
-                              };
-                            });
-                          }
+                            // Sanitize backend diagnostics (if present)
+                            if (
+                              sanitized.backendDiagnostics &&
+                              typeof sanitized.backendDiagnostics === 'object'
+                            ) {
+                              const backend = sanitized.backendDiagnostics as Record<
+                                string,
+                                unknown
+                              >;
 
-                            // Sanitize PBS backups
-                            if (Array.isArray(backups.pbsBackups)) {
-                              backups.pbsBackups = (
-                                backups.pbsBackups as Array<Record<string, unknown>>
-                              ).map((b, index: number) => {
-                                const backupId =
-                                  typeof b.backupId === 'string' ? b.backupId : undefined;
-                                const vmName = typeof b.vmName === 'string' ? b.vmName : undefined;
-                                return {
-                                  ...b,
-                                  datastore: `datastore-${index}`,
-                                  backupId: backupId ? `backup-${index}` : backupId,
-                                  vmName: vmName ? 'vm-REDACTED' : vmName,
-                                };
-                              });
-                            }
-                          }
+                              if (Array.isArray(backend.nodeSnapshots)) {
+                                backend.nodeSnapshots = sanitizeNodeSnapshots(
+                                  backend.nodeSnapshots as Array<Record<string, unknown>>,
+                                );
+                              }
 
-                          // Sanitize active alerts
-                          const activeAlerts = sanitized.activeAlerts as
-                            | Array<Record<string, unknown>>
-                            | undefined;
-                          if (activeAlerts) {
-                            sanitized.activeAlerts = activeAlerts.map((alert) => {
-                              const alertNode = typeof alert.node === 'string' ? alert.node : '';
-                              const details =
-                                typeof alert.details === 'string' ? alert.details : undefined;
-                              return {
-                                ...alert,
-                                node: sanitizeHostname(alertNode),
-                                details: details
-                                  ? details.replace(
-                                      /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/g,
-                                      'xxx.xxx.xxx.xxx',
-                                    )
-                                  : details,
-                              };
-                            });
-                          }
+                              if (Array.isArray(backend.guestSnapshots)) {
+                                backend.guestSnapshots = sanitizeGuestSnapshots(
+                                  backend.guestSnapshots as Array<Record<string, unknown>>,
+                                );
+                              }
 
-                          // Sanitize websocket URL
-                          const websocketInfo = sanitized.websocket as
-                            | Record<string, unknown>
-                            | undefined;
-                          if (websocketInfo && typeof websocketInfo.url === 'string') {
-                            websocketInfo.url = websocketInfo.url.replace(
-                              /\/\/[^\/]+/,
-                              '//REDACTED',
-                            );
-                          }
+                              if (Array.isArray(backend.nodes)) {
+                                backend.nodes = backend.nodes.map((rawNode, index: number) => {
+                                  const node = rawNode as Record<string, unknown>;
+                                  const originalName =
+                                    typeof node.name === 'string' ? node.name : '';
+                                  const sanitizedId = `diagnostic-node-${index}`;
+                                  connectionKeyMap.set(originalName, sanitizedId);
 
-                          if (
-                            sanitized.connectionHealth &&
-                            typeof sanitized.connectionHealth === 'object'
-                          ) {
-                            const newConnectionHealth: Record<string, unknown> = {};
-                            let index = 1;
-                            Object.entries(
-                              sanitized.connectionHealth as Record<string, unknown>,
-                            ).forEach(([key, value]) => {
-                              const mappedKey = connectionKeyMap.get(key) || `resource-${index}`;
-                              newConnectionHealth[mappedKey] = value;
-                              index += 1;
-                            });
-                            sanitized.connectionHealth = newConnectionHealth;
-                          }
+                                  const vmDiskCheck = node.vmDiskCheck as
+                                    | Record<string, unknown>
+                                    | undefined;
+                                  const physicalDisks = node.physicalDisks as
+                                    | Record<string, unknown>
+                                    | undefined;
 
-                          // Add sanitization notice
-                          sanitized._notice =
-                            'This diagnostic data has been sanitized for sharing on GitHub. IP addresses, hostnames, and tokens have been redacted.';
-
-                          return sanitized;
-                        };
-
-                        const exportDiagnostics = (sanitize: boolean) => {
-                          let diagnostics: Record<string, unknown> = {
-                            timestamp: new Date().toISOString(),
-                            version: '2.1.0',
-                            pulseVersion: state.stats?.version || 'unknown',
-                            environment: {
-                              userAgent: navigator.userAgent,
-                              platform: navigator.platform,
-                              language: navigator.language,
-                              screenResolution: `${window.screen.width}x${window.screen.height}`,
-                              windowSize: `${window.innerWidth}x${window.innerHeight}`,
-                              timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
-                            },
-                            websocket: {
-                              connected: connected(),
-                              url: `${window.location.protocol === 'https:' ? 'wss:' : 'ws:'}//${window.location.host}/ws`,
-                            },
-                            // Include backend diagnostics if available
-                            backendDiagnostics: diagnosticsData() || null,
-                            nodes:
-                              nodes()?.map((n) => ({
-                                ...n,
-                                status:
-                                  state.nodes?.find((sn) => sn.id === n.id)?.status || 'unknown',
-                                online:
-                                  state.nodes?.find((sn) => sn.id === n.id)?.status === 'online',
-                              })) || [],
-                            state: {
-                              nodesCount: state.nodes?.length || 0,
-                              nodesOnline:
-                                state.nodes?.filter((n) => n.status === 'online').length || 0,
-                              nodesOffline:
-                                state.nodes?.filter((n) => n.status !== 'online').length || 0,
-                              vmsCount: state.vms?.length || 0,
-                              containersCount: state.containers?.length || 0,
-                              storageCount: state.storage?.length || 0,
-                              physicalDisksCount: state.physicalDisks?.length || 0,
-                              pbsCount: state.pbs?.length || 0,
-                              pbsBackupsCount: pbsBackupsState()?.length || 0,
-                              pveBackups: {
-                                backupTasksCount: pveBackupsState()?.backupTasks?.length || 0,
-                                storageBackupsCount: pveBackupsState()?.storageBackups?.length || 0,
-                                guestSnapshotsCount: pveBackupsState()?.guestSnapshots?.length || 0,
-                              },
-                            },
-                            // Node status details
-                            nodeStatus:
-                              state.nodes?.map((n) => ({
-                                id: n.id,
-                                name: n.name,
-                                status: n.status,
-                                online: n.status === 'online',
-                                cpu: n.cpu,
-                                memory: n.memory,
-                                uptime: n.uptime,
-                                version: n.pveVersion ?? n.kernelVersion,
-                              })) || [],
-                            storage:
-                              state.storage?.map((s) => ({
-                                id: s.id,
-                                node: s.node,
-                                name: s.name,
-                                type: s.type,
-                                status: s.status,
-                                enabled: s.enabled,
-                                content: s.content,
-                                shared: s.shared,
-                                used: s.used,
-                                total: s.total,
-                                zfsPool: s.zfsPool
-                                  ? {
-                                      state: s.zfsPool.state,
-                                      readErrors: s.zfsPool.readErrors,
-                                      writeErrors: s.zfsPool.writeErrors,
-                                      checksumErrors: s.zfsPool.checksumErrors,
-                                      deviceCount: s.zfsPool.devices?.length || 0,
+                                  if (vmDiskCheck) {
+                                    if (typeof vmDiskCheck.testVMName === 'string') {
+                                      vmDiskCheck.testVMName = 'vm-REDACTED';
                                     }
-                                  : undefined,
-                                hasBackups:
-                                  (pveBackupsState()?.storageBackups ?? []).filter(
-                                    (b) => b.storage === s.name,
-                                  ).length > 0,
-                              })) || [],
-                            // Physical disks - critical for troubleshooting
-                            physicalDisks:
-                              state.physicalDisks?.map((d) => ({
-                                node: d.node,
-                                device: d.device || d.devPath,
-                                model: d.model,
-                                size: d.size,
-                                type: d.type,
-                                health: d.health,
-                                wearout: d.wearout,
-                                rpm: d.rpm,
-                                smart: d.smart ?? null,
-                              })) || [],
-                            backups: {
-                              pveBackupTasks: pveBackupsState()?.backupTasks?.slice(0, 10) || [],
-                              pveStorageBackups:
-                                pveBackupsState()?.storageBackups?.slice(0, 10) || [],
-                              pbsBackups: pbsBackupsState()?.slice(0, 10) || [],
-                            },
-                            connectionHealth: state.connectionHealth || {},
-                            performance: {
-                              lastPollDuration: state.performance?.lastPollDuration || 0,
-                              totalApiCalls: state.performance?.totalApiCalls || 0,
-                              failedApiCalls: state.performance?.failedApiCalls || 0,
-                              apiCallDuration: state.performance?.apiCallDuration || {},
-                            },
-                            activeAlerts: state.activeAlerts?.slice(0, 20) || [],
-                            settings: {},
+                                    if (typeof vmDiskCheck.testResult === 'string') {
+                                      const sanitizedResult = sanitizeText(
+                                        vmDiskCheck.testResult as string,
+                                      );
+                                      vmDiskCheck.testResult =
+                                        sanitizedResult ?? vmDiskCheck.testResult;
+                                    }
+                                    if (Array.isArray(vmDiskCheck.problematicVMs)) {
+                                      vmDiskCheck.problematicVMs = (
+                                        vmDiskCheck.problematicVMs as Array<Record<string, unknown>>
+                                      ).map((problem) => {
+                                        const issueText = sanitizeText(
+                                          typeof problem.issue === 'string'
+                                            ? problem.issue
+                                            : undefined,
+                                        );
+                                        return {
+                                          ...problem,
+                                          name: 'vm-REDACTED',
+                                          issue: issueText ?? problem.issue,
+                                        };
+                                      });
+                                    }
+                                    if (Array.isArray(vmDiskCheck.recommendations)) {
+                                      vmDiskCheck.recommendations = (
+                                        vmDiskCheck.recommendations as Array<string>
+                                      ).map((rec) => sanitizeText(rec) ?? rec);
+                                    }
+                                  }
+
+                                  if (physicalDisks) {
+                                    if (typeof physicalDisks.testResult === 'string') {
+                                      const sanitizedResult = sanitizeText(
+                                        physicalDisks.testResult as string,
+                                      );
+                                      physicalDisks.testResult =
+                                        sanitizedResult ?? physicalDisks.testResult;
+                                    }
+                                    if (Array.isArray(physicalDisks.nodeResults)) {
+                                      physicalDisks.nodeResults = (
+                                        physicalDisks.nodeResults as Array<Record<string, unknown>>
+                                      ).map((result) => ({
+                                        ...result,
+                                        nodeName: sanitizeHostname(
+                                          typeof result.nodeName === 'string'
+                                            ? result.nodeName
+                                            : '',
+                                        ),
+                                        apiResponse:
+                                          sanitizeText(
+                                            typeof result.apiResponse === 'string'
+                                              ? result.apiResponse
+                                              : undefined,
+                                          ) ?? result.apiResponse,
+                                        error:
+                                          sanitizeText(
+                                            typeof result.error === 'string'
+                                              ? result.error
+                                              : undefined,
+                                          ) ?? result.error,
+                                      }));
+                                    }
+                                  }
+
+                                  return {
+                                    ...node,
+                                    id: sanitizedId,
+                                    name: sanitizeHostname(originalName),
+                                    host:
+                                      typeof node.host === 'string'
+                                        ? (node.host as string).replace(
+                                            /https?:\/\/[^:\/]+/,
+                                            'https://REDACTED',
+                                          )
+                                        : node.host,
+                                    error:
+                                      sanitizeText(
+                                        typeof node.error === 'string' ? node.error : undefined,
+                                      ) ?? node.error,
+                                    vmDiskCheck,
+                                    physicalDisks,
+                                  };
+                                });
+                              }
+
+                              if (Array.isArray(backend.pbs)) {
+                                backend.pbs = backend.pbs.map((rawPbs, index: number) => {
+                                  const pbsNode = rawPbs as Record<string, unknown>;
+                                  const originalName =
+                                    typeof pbsNode.name === 'string' ? pbsNode.name : '';
+                                  const sanitizedId = `diagnostic-pbs-${index}`;
+                                  connectionKeyMap.set(originalName, sanitizedId);
+
+                                  return {
+                                    ...pbsNode,
+                                    id: sanitizedId,
+                                    name: sanitizeHostname(originalName),
+                                    host:
+                                      typeof pbsNode.host === 'string'
+                                        ? (pbsNode.host as string).replace(
+                                            /https?:\/\/[^:\/]+/,
+                                            'https://REDACTED',
+                                          )
+                                        : pbsNode.host,
+                                    error:
+                                      sanitizeText(
+                                        typeof pbsNode.error === 'string'
+                                          ? pbsNode.error
+                                          : undefined,
+                                      ) ?? pbsNode.error,
+                                  };
+                                });
+                              }
+                            }
+
+                            // Sanitize storage
+                            if (sanitized.storage) {
+                              sanitized.storage = (
+                                sanitized.storage as Array<Record<string, unknown>>
+                              ).map((s, index: number) => {
+                                const storageNode = typeof s.node === 'string' ? s.node : '';
+                                return {
+                                  ...s,
+                                  id: `storage-${index}`,
+                                  node: sanitizeHostname(storageNode),
+                                  name: `storage-${index}`,
+                                };
+                              });
+                            }
+
+                            // Sanitize backups
+                            const backups = sanitized.backups as
+                              | Record<string, unknown>
+                              | undefined;
+                            if (backups) {
+                              // Sanitize PVE backup tasks
+                              if (Array.isArray(backups.pveBackupTasks)) {
+                                backups.pveBackupTasks = (
+                                  backups.pveBackupTasks as Array<Record<string, unknown>>
+                                ).map((b, index: number) => {
+                                  const backupNode = typeof b.node === 'string' ? b.node : '';
+                                  const backupVmid =
+                                    typeof b.vmid === 'number' ? b.vmid : undefined;
+                                  return {
+                                    ...b,
+                                    node: sanitizeHostname(backupNode),
+                                    storage: `storage-${index}`,
+                                    vmid:
+                                      backupVmid !== undefined ? `vm-${backupVmid}` : backupVmid,
+                                  };
+                                });
+                              }
+
+                              // Sanitize PVE storage backups
+                              if (Array.isArray(backups.pveStorageBackups)) {
+                                backups.pveStorageBackups = (
+                                  backups.pveStorageBackups as Array<Record<string, unknown>>
+                                ).map((b, index: number) => {
+                                  const backupNode = typeof b.node === 'string' ? b.node : '';
+                                  const backupVmid =
+                                    typeof b.vmid === 'number' ? b.vmid : undefined;
+                                  const volid = typeof b.volid === 'string' ? b.volid : undefined;
+                                  return {
+                                    ...b,
+                                    node: sanitizeHostname(backupNode),
+                                    storage: `storage-${index}`,
+                                    vmid:
+                                      backupVmid !== undefined ? `vm-${backupVmid}` : backupVmid,
+                                    volid: volid ? 'vol-REDACTED' : volid,
+                                  };
+                                });
+                              }
+
+                              // Sanitize PBS backups
+                              if (Array.isArray(backups.pbsBackups)) {
+                                backups.pbsBackups = (
+                                  backups.pbsBackups as Array<Record<string, unknown>>
+                                ).map((b, index: number) => {
+                                  const backupId =
+                                    typeof b.backupId === 'string' ? b.backupId : undefined;
+                                  const vmName =
+                                    typeof b.vmName === 'string' ? b.vmName : undefined;
+                                  return {
+                                    ...b,
+                                    datastore: `datastore-${index}`,
+                                    backupId: backupId ? `backup-${index}` : backupId,
+                                    vmName: vmName ? 'vm-REDACTED' : vmName,
+                                  };
+                                });
+                              }
+                            }
+
+                            // Sanitize active alerts
+                            const activeAlerts = sanitized.activeAlerts as
+                              | Array<Record<string, unknown>>
+                              | undefined;
+                            if (activeAlerts) {
+                              sanitized.activeAlerts = activeAlerts.map((alert) => {
+                                const alertNode = typeof alert.node === 'string' ? alert.node : '';
+                                const details =
+                                  typeof alert.details === 'string' ? alert.details : undefined;
+                                return {
+                                  ...alert,
+                                  node: sanitizeHostname(alertNode),
+                                  details: details
+                                    ? details.replace(
+                                        /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/g,
+                                        'xxx.xxx.xxx.xxx',
+                                      )
+                                    : details,
+                                };
+                              });
+                            }
+
+                            // Sanitize websocket URL
+                            const websocketInfo = sanitized.websocket as
+                              | Record<string, unknown>
+                              | undefined;
+                            if (websocketInfo && typeof websocketInfo.url === 'string') {
+                              websocketInfo.url = websocketInfo.url.replace(
+                                /\/\/[^\/]+/,
+                                '//REDACTED',
+                              );
+                            }
+
+                            if (
+                              sanitized.connectionHealth &&
+                              typeof sanitized.connectionHealth === 'object'
+                            ) {
+                              const newConnectionHealth: Record<string, unknown> = {};
+                              let index = 1;
+                              Object.entries(
+                                sanitized.connectionHealth as Record<string, unknown>,
+                              ).forEach(([key, value]) => {
+                                const mappedKey = connectionKeyMap.get(key) || `resource-${index}`;
+                                newConnectionHealth[mappedKey] = value;
+                                index += 1;
+                              });
+                              sanitized.connectionHealth = newConnectionHealth;
+                            }
+
+                            // Add sanitization notice
+                            sanitized._notice =
+                              'This diagnostic data has been sanitized for sharing on GitHub. IP addresses, hostnames, and tokens have been redacted.';
+
+                            return sanitized;
                           };
 
-                          if (sanitize) {
-                            diagnostics = sanitizeForGitHub(diagnostics);
+                          const exportDiagnostics = (sanitize: boolean) => {
+                            let diagnostics: Record<string, unknown> = {
+                              timestamp: new Date().toISOString(),
+                              version: '2.1.0',
+                              pulseVersion: state.stats?.version || 'unknown',
+                              environment: {
+                                userAgent: navigator.userAgent,
+                                platform: navigator.platform,
+                                language: navigator.language,
+                                screenResolution: `${window.screen.width}x${window.screen.height}`,
+                                windowSize: `${window.innerWidth}x${window.innerHeight}`,
+                                timeZone: Intl.DateTimeFormat().resolvedOptions().timeZone,
+                              },
+                              websocket: {
+                                connected: connected(),
+                                url: `${window.location.protocol === 'https:' ? 'wss:' : 'ws:'}//${window.location.host}/ws`,
+                              },
+                              // Include backend diagnostics if available
+                              backendDiagnostics: diagnosticsData() || null,
+                              nodes:
+                                nodes()?.map((n) => ({
+                                  ...n,
+                                  status:
+                                    state.nodes?.find((sn) => sn.id === n.id)?.status || 'unknown',
+                                  online:
+                                    state.nodes?.find((sn) => sn.id === n.id)?.status === 'online',
+                                })) || [],
+                              state: {
+                                nodesCount: state.nodes?.length || 0,
+                                nodesOnline:
+                                  state.nodes?.filter((n) => n.status === 'online').length || 0,
+                                nodesOffline:
+                                  state.nodes?.filter((n) => n.status !== 'online').length || 0,
+                                vmsCount: state.vms?.length || 0,
+                                containersCount: state.containers?.length || 0,
+                                storageCount: state.storage?.length || 0,
+                                physicalDisksCount: state.physicalDisks?.length || 0,
+                                pbsCount: state.pbs?.length || 0,
+                                pbsBackupsCount: pbsBackupsState()?.length || 0,
+                                pveBackups: {
+                                  backupTasksCount: pveBackupsState()?.backupTasks?.length || 0,
+                                  storageBackupsCount:
+                                    pveBackupsState()?.storageBackups?.length || 0,
+                                  guestSnapshotsCount:
+                                    pveBackupsState()?.guestSnapshots?.length || 0,
+                                },
+                              },
+                              // Node status details
+                              nodeStatus:
+                                state.nodes?.map((n) => ({
+                                  id: n.id,
+                                  name: n.name,
+                                  status: n.status,
+                                  online: n.status === 'online',
+                                  cpu: n.cpu,
+                                  memory: n.memory,
+                                  uptime: n.uptime,
+                                  version: n.pveVersion ?? n.kernelVersion,
+                                })) || [],
+                              storage:
+                                state.storage?.map((s) => ({
+                                  id: s.id,
+                                  node: s.node,
+                                  name: s.name,
+                                  type: s.type,
+                                  status: s.status,
+                                  enabled: s.enabled,
+                                  content: s.content,
+                                  shared: s.shared,
+                                  used: s.used,
+                                  total: s.total,
+                                  zfsPool: s.zfsPool
+                                    ? {
+                                        state: s.zfsPool.state,
+                                        readErrors: s.zfsPool.readErrors,
+                                        writeErrors: s.zfsPool.writeErrors,
+                                        checksumErrors: s.zfsPool.checksumErrors,
+                                        deviceCount: s.zfsPool.devices?.length || 0,
+                                      }
+                                    : undefined,
+                                  hasBackups:
+                                    (pveBackupsState()?.storageBackups ?? []).filter(
+                                      (b) => b.storage === s.name,
+                                    ).length > 0,
+                                })) || [],
+                              // Physical disks - critical for troubleshooting
+                              physicalDisks:
+                                state.physicalDisks?.map((d) => ({
+                                  node: d.node,
+                                  device: d.device || d.devPath,
+                                  model: d.model,
+                                  size: d.size,
+                                  type: d.type,
+                                  health: d.health,
+                                  wearout: d.wearout,
+                                  rpm: d.rpm,
+                                  smart: d.smart ?? null,
+                                })) || [],
+                              backups: {
+                                pveBackupTasks: pveBackupsState()?.backupTasks?.slice(0, 10) || [],
+                                pveStorageBackups:
+                                  pveBackupsState()?.storageBackups?.slice(0, 10) || [],
+                                pbsBackups: pbsBackupsState()?.slice(0, 10) || [],
+                              },
+                              connectionHealth: state.connectionHealth || {},
+                              performance: {
+                                lastPollDuration: state.performance?.lastPollDuration || 0,
+                                totalApiCalls: state.performance?.totalApiCalls || 0,
+                                failedApiCalls: state.performance?.failedApiCalls || 0,
+                                apiCallDuration: state.performance?.apiCallDuration || {},
+                              },
+                              activeAlerts: state.activeAlerts?.slice(0, 20) || [],
+                              settings: {},
+                            };
 
-                            // Rebuild nodeStatus from sanitized nodes to avoid leaking real names
-                            // Both arrays are built in the same order, so we can match by index
-                            if (
-                              Array.isArray(diagnostics.nodes) &&
-                              Array.isArray(diagnostics.nodeStatus)
-                            ) {
-                              const sanitizedNodes = diagnostics.nodes as Array<
-                                Record<string, unknown>
-                              >;
-                              const originalNodeStatus = diagnostics.nodeStatus as Array<
-                                Record<string, unknown>
-                              >;
+                            if (sanitize) {
+                              diagnostics = sanitizeForGitHub(diagnostics);
 
-                              diagnostics.nodeStatus = sanitizedNodes.map((sanitizedNode, index) => {
-                                // Get corresponding runtime data using same index
-                                const originalStatus = originalNodeStatus[index];
+                              // Rebuild nodeStatus from sanitized nodes to avoid leaking real names
+                              // Both arrays are built in the same order, so we can match by index
+                              if (
+                                Array.isArray(diagnostics.nodes) &&
+                                Array.isArray(diagnostics.nodeStatus)
+                              ) {
+                                const sanitizedNodes = diagnostics.nodes as Array<
+                                  Record<string, unknown>
+                                >;
+                                const originalNodeStatus = diagnostics.nodeStatus as Array<
+                                  Record<string, unknown>
+                                >;
 
-                                // Use sanitized node name/id but preserve runtime metrics
-                                return {
-                                  id: sanitizedNode.id,
-                                  name: sanitizedNode.name, // Already sanitized
-                                  status: originalStatus?.status || 'unknown',
-                                  online: originalStatus?.online || false,
-                                  cpu: originalStatus?.cpu,
-                                  memory: originalStatus?.memory,
-                                  uptime: originalStatus?.uptime,
-                                  version: originalStatus?.version,
-                                };
-                              });
+                                diagnostics.nodeStatus = sanitizedNodes.map(
+                                  (sanitizedNode, index) => {
+                                    // Get corresponding runtime data using same index
+                                    const originalStatus = originalNodeStatus[index];
+
+                                    // Use sanitized node name/id but preserve runtime metrics
+                                    return {
+                                      id: sanitizedNode.id,
+                                      name: sanitizedNode.name, // Already sanitized
+                                      status: originalStatus?.status || 'unknown',
+                                      online: originalStatus?.online || false,
+                                      cpu: originalStatus?.cpu,
+                                      memory: originalStatus?.memory,
+                                      uptime: originalStatus?.uptime,
+                                      version: originalStatus?.version,
+                                    };
+                                  },
+                                );
+                              }
+
+                              // Sanitize storage entries that have nodes arrays or instance fields
+                              if (Array.isArray(diagnostics.storage)) {
+                                diagnostics.storage = (
+                                  diagnostics.storage as Array<Record<string, unknown>>
+                                ).map((storageItem, index) => {
+                                  const sanitizedItem = { ...storageItem };
+
+                                  // Sanitize storage name field (original Proxmox storage name)
+                                  // This field often contains node names (e.g., "pbs-delly")
+                                  if (
+                                    typeof sanitizedItem.storage === 'string' &&
+                                    sanitizedItem.storage
+                                  ) {
+                                    sanitizedItem.storage = `storage-${index}`;
+                                  }
+
+                                  // Sanitize nodes array if present (cluster storage has this)
+                                  if (Array.isArray(sanitizedItem.nodes)) {
+                                    sanitizedItem.nodes = (
+                                      sanitizedItem.nodes as Array<string>
+                                    ).map(() => 'node-REDACTED');
+                                  }
+
+                                  // Sanitize nodeIds array if present
+                                  if (Array.isArray(sanitizedItem.nodeIds)) {
+                                    sanitizedItem.nodeIds = (
+                                      sanitizedItem.nodeIds as Array<string>
+                                    ).map(() => 'node-REDACTED');
+                                  }
+
+                                  // Sanitize instance field if present
+                                  if (
+                                    typeof sanitizedItem.instance === 'string' &&
+                                    sanitizedItem.instance
+                                  ) {
+                                    const instanceMatch = (sanitizedItem.instance as string).match(
+                                      /\.(lan|local|home|internal)$/,
+                                    );
+                                    const suffix = instanceMatch ? instanceMatch[0] : '';
+                                    sanitizedItem.instance = `instance-REDACTED${suffix}`;
+                                  }
+
+                                  return sanitizedItem;
+                                });
+                              }
+
+                              // Sanitize activeAlerts resourceName field
+                              if (Array.isArray(diagnostics.activeAlerts)) {
+                                diagnostics.activeAlerts = (
+                                  diagnostics.activeAlerts as Array<Record<string, unknown>>
+                                ).map((alert, index) => {
+                                  const sanitizedAlert = { ...alert };
+
+                                  // Sanitize resourceName if present
+                                  if (
+                                    typeof sanitizedAlert.resourceName === 'string' &&
+                                    sanitizedAlert.resourceName
+                                  ) {
+                                    const hostnameMatch = (
+                                      sanitizedAlert.resourceName as string
+                                    ).match(/\.(lan|local|home|internal)$/);
+                                    const suffix = hostnameMatch ? hostnameMatch[0] : '';
+                                    sanitizedAlert.resourceName = `resource-REDACTED${suffix}`;
+                                  }
+
+                                  // Sanitize node field if present
+                                  if (
+                                    typeof sanitizedAlert.node === 'string' &&
+                                    sanitizedAlert.node
+                                  ) {
+                                    sanitizedAlert.node = 'node-REDACTED';
+                                  }
+
+                                  // Sanitize instance field if present
+                                  if (
+                                    typeof sanitizedAlert.instance === 'string' &&
+                                    sanitizedAlert.instance
+                                  ) {
+                                    const instanceMatch = (sanitizedAlert.instance as string).match(
+                                      /\.(lan|local|home|internal)$/,
+                                    );
+                                    const suffix = instanceMatch ? instanceMatch[0] : '';
+                                    sanitizedAlert.instance = `instance-REDACTED${suffix}`;
+                                  }
+
+                                  // Sanitize resourceId (e.g., "delly.lan-delly" → "alert-resource-0")
+                                  if (
+                                    typeof sanitizedAlert.resourceId === 'string' &&
+                                    sanitizedAlert.resourceId
+                                  ) {
+                                    sanitizedAlert.resourceId = `alert-resource-${index}`;
+                                  }
+
+                                  // Sanitize id field (e.g., "delly.lan-delly-temperature" → "alert-0-temperature")
+                                  if (typeof sanitizedAlert.id === 'string' && sanitizedAlert.id) {
+                                    // Extract the alert type from the end (e.g., "temperature")
+                                    const idParts = (sanitizedAlert.id as string).split('-');
+                                    const alertType = idParts[idParts.length - 1];
+                                    sanitizedAlert.id = `alert-${index}-${alertType}`;
+                                  }
+
+                                  return sanitizedAlert;
+                                });
+                              }
                             }
 
-                            // Sanitize storage entries that have nodes arrays or instance fields
-                            if (Array.isArray(diagnostics.storage)) {
-                              diagnostics.storage = (
-                                diagnostics.storage as Array<Record<string, unknown>>
-                              ).map((storageItem, index) => {
-                                const sanitizedItem = { ...storageItem };
+                            const blob = new Blob([JSON.stringify(diagnostics, null, 2)], {
+                              type: 'application/json',
+                            });
+                            const url = URL.createObjectURL(blob);
+                            const a = document.createElement('a');
+                            a.href = url;
+                            const type = sanitize ? 'sanitized' : 'full';
+                            a.download = `pulse-diagnostics-${type}-${new Date().toISOString().split('T')[0]}.json`;
+                            document.body.appendChild(a);
+                            a.click();
+                            document.body.removeChild(a);
+                            URL.revokeObjectURL(url);
+                          };
 
-                                // Sanitize storage name field (original Proxmox storage name)
-                                // This field often contains node names (e.g., "pbs-delly")
-                                if (
-                                  typeof sanitizedItem.storage === 'string' &&
-                                  sanitizedItem.storage
-                                ) {
-                                  sanitizedItem.storage = `storage-${index}`;
-                                }
-
-                                // Sanitize nodes array if present (cluster storage has this)
-                                if (Array.isArray(sanitizedItem.nodes)) {
-                                  sanitizedItem.nodes = (
-                                    sanitizedItem.nodes as Array<string>
-                                  ).map(() => 'node-REDACTED');
-                                }
-
-                                // Sanitize nodeIds array if present
-                                if (Array.isArray(sanitizedItem.nodeIds)) {
-                                  sanitizedItem.nodeIds = (
-                                    sanitizedItem.nodeIds as Array<string>
-                                  ).map(() => 'node-REDACTED');
-                                }
-
-                                // Sanitize instance field if present
-                                if (
-                                  typeof sanitizedItem.instance === 'string' &&
-                                  sanitizedItem.instance
-                                ) {
-                                  const instanceMatch = (
-                                    sanitizedItem.instance as string
-                                  ).match(/\.(lan|local|home|internal)$/);
-                                  const suffix = instanceMatch ? instanceMatch[0] : '';
-                                  sanitizedItem.instance = `instance-REDACTED${suffix}`;
-                                }
-
-                                return sanitizedItem;
-                              });
-                            }
-
-                            // Sanitize activeAlerts resourceName field
-                            if (Array.isArray(diagnostics.activeAlerts)) {
-                              diagnostics.activeAlerts = (
-                                diagnostics.activeAlerts as Array<Record<string, unknown>>
-                              ).map((alert, index) => {
-                                const sanitizedAlert = { ...alert };
-
-                                // Sanitize resourceName if present
-                                if (
-                                  typeof sanitizedAlert.resourceName === 'string' &&
-                                  sanitizedAlert.resourceName
-                                ) {
-                                  const hostnameMatch = (
-                                    sanitizedAlert.resourceName as string
-                                  ).match(/\.(lan|local|home|internal)$/);
-                                  const suffix = hostnameMatch ? hostnameMatch[0] : '';
-                                  sanitizedAlert.resourceName = `resource-REDACTED${suffix}`;
-                                }
-
-                                // Sanitize node field if present
-                                if (
-                                  typeof sanitizedAlert.node === 'string' &&
-                                  sanitizedAlert.node
-                                ) {
-                                  sanitizedAlert.node = 'node-REDACTED';
-                                }
-
-                                // Sanitize instance field if present
-                                if (
-                                  typeof sanitizedAlert.instance === 'string' &&
-                                  sanitizedAlert.instance
-                                ) {
-                                  const instanceMatch = (
-                                    sanitizedAlert.instance as string
-                                  ).match(/\.(lan|local|home|internal)$/);
-                                  const suffix = instanceMatch ? instanceMatch[0] : '';
-                                  sanitizedAlert.instance = `instance-REDACTED${suffix}`;
-                                }
-
-                                // Sanitize resourceId (e.g., "delly.lan-delly" → "alert-resource-0")
-                                if (
-                                  typeof sanitizedAlert.resourceId === 'string' &&
-                                  sanitizedAlert.resourceId
-                                ) {
-                                  sanitizedAlert.resourceId = `alert-resource-${index}`;
-                                }
-
-                                // Sanitize id field (e.g., "delly.lan-delly-temperature" → "alert-0-temperature")
-                                if (typeof sanitizedAlert.id === 'string' && sanitizedAlert.id) {
-                                  // Extract the alert type from the end (e.g., "temperature")
-                                  const idParts = (sanitizedAlert.id as string).split('-');
-                                  const alertType = idParts[idParts.length - 1];
-                                  sanitizedAlert.id = `alert-${index}-${alertType}`;
-                                }
-
-                                return sanitizedAlert;
-                              });
-                            }
-                          }
-
-                          const blob = new Blob([JSON.stringify(diagnostics, null, 2)], {
-                            type: 'application/json',
-                          });
-                          const url = URL.createObjectURL(blob);
-                          const a = document.createElement('a');
-                          a.href = url;
-                          const type = sanitize ? 'sanitized' : 'full';
-                          a.download = `pulse-diagnostics-${type}-${new Date().toISOString().split('T')[0]}.json`;
-                          document.body.appendChild(a);
-                          a.click();
-                          document.body.removeChild(a);
-                          URL.revokeObjectURL(url);
-                        };
-
-                        return (
-                          <div class="space-y-3">
-                            <Show when={!diagnosticsData()}>
-                              <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 rounded p-2">
-                                💡 Run diagnostics first for more comprehensive export data
+                          return (
+                            <div class="space-y-3">
+                              <Show when={!diagnosticsData()}>
+                                <div class="text-xs text-amber-600 dark:text-amber-400 bg-amber-50 dark:bg-amber-900/20 rounded p-2">
+                                  💡 Run diagnostics first for more comprehensive export data
+                                </div>
+                              </Show>
+                              <div class="flex gap-2">
+                                <button
+                                  type="button"
+                                  onClick={() => exportDiagnostics(false)}
+                                  class="px-4 py-2 text-sm bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
+                                >
+                                  Export Full
+                                </button>
+                                <button
+                                  type="button"
+                                  onClick={() => exportDiagnostics(true)}
+                                  class="px-4 py-2 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700 transition-colors"
+                                >
+                                  Export for GitHub
+                                </button>
                               </div>
-                            </Show>
-                            <div class="flex gap-2">
-                              <button
-                                type="button"
-                                onClick={() => exportDiagnostics(false)}
-                                class="px-4 py-2 text-sm bg-blue-600 text-white rounded-lg hover:bg-blue-700 transition-colors"
-                              >
-                                Export Full
-                              </button>
-                              <button
-                                type="button"
-                                onClick={() => exportDiagnostics(true)}
-                                class="px-4 py-2 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700 transition-colors"
-                              >
-                                Export for GitHub
-                              </button>
                             </div>
-                          </div>
-                        );
-                      })()}
+                          );
+                        })()}
 
-                      <p class="text-xs text-gray-500 dark:text-gray-400 mt-3">
-                        <strong>Export Full:</strong> Complete data for private troubleshooting
-                        <br />
-                        <strong>Export for GitHub:</strong> Sanitized data safe for public sharing
-                      </p>
+                        <p class="text-xs text-gray-500 dark:text-gray-400 mt-3">
+                          <strong>Export Full:</strong> Complete data for private troubleshooting
+                          <br />
+                          <strong>Export for GitHub:</strong> Sanitized data safe for public sharing
+                        </p>
+                      </div>
                     </div>
                   </div>
                 </div>
-              </div>
-            </Show>
+              </Show>
+            </div>
           </div>
-        </div>
-      </Card>
-
+        </Card>
       </div>
 
-        {/* Delete Node Modal */}
-        <Show when={showDeleteNodeModal()}>
-          <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
-            <Card padding="lg" class="w-full max-w-lg space-y-5">
-              <SectionHeader
-                title={`Remove ${nodePendingDeleteLabel()}`}
-                size="md"
-                class="mb-1"
-              />
-              <div class="space-y-3 text-sm text-gray-600 dark:text-gray-300">
-                <p>
-                  Removing this {nodePendingDeleteTypeLabel().toLowerCase()} also scrubs the Pulse
-                  footprint on the host — the proxy service, SSH key, API token, and bind mount are
-                  all cleaned up automatically.
-                </p>
-                <div class="rounded-lg border border-blue-200 bg-blue-50 p-3 text-sm leading-relaxed dark:border-blue-800 dark:bg-blue-900/20 dark:text-blue-100">
-                  <p class="font-medium text-blue-900 dark:text-blue-100">What happens next</p>
-                  <ul class="mt-2 list-disc space-y-1 pl-4 text-blue-800 dark:text-blue-200 text-sm">
-                    <li>Pulse removes the node entry and clears related alerts.</li>
+      {/* Delete Node Modal */}
+      <Show when={showDeleteNodeModal()}>
+        <div class="fixed inset-0 z-50 flex items-center justify-center bg-black/50 p-4">
+          <Card padding="lg" class="w-full max-w-lg space-y-5">
+            <SectionHeader title={`Remove ${nodePendingDeleteLabel()}`} size="md" class="mb-1" />
+            <div class="space-y-3 text-sm text-gray-600 dark:text-gray-300">
+              <p>
+                Removing this {nodePendingDeleteTypeLabel().toLowerCase()} also scrubs the Pulse
+                footprint on the host — the proxy service, SSH key, API token, and bind mount are
+                all cleaned up automatically.
+              </p>
+              <div class="rounded-lg border border-blue-200 bg-blue-50 p-3 text-sm leading-relaxed dark:border-blue-800 dark:bg-blue-900/20 dark:text-blue-100">
+                <p class="font-medium text-blue-900 dark:text-blue-100">What happens next</p>
+                <ul class="mt-2 list-disc space-y-1 pl-4 text-blue-800 dark:text-blue-200 text-sm">
+                  <li>Pulse removes the node entry and clears related alerts.</li>
+                  <li>
+                    {nodePendingDeleteHost() ? (
+                      <>
+                        The host <span class="font-semibold">{nodePendingDeleteHost()}</span> loses
+                        the proxy service, SSH key, and API token.
+                      </>
+                    ) : (
+                      'The host loses the proxy service, SSH key, and API token.'
+                    )}
+                  </li>
+                  <li>
+                    If the host comes back later, rerunning the setup script reinstalls everything
+                    with a fresh key.
+                  </li>
+                  <Show when={nodePendingDeleteType() === 'pbs'}>
                     <li>
-                      {nodePendingDeleteHost() ? (
-                        <>
-                          The host{' '}
-                          <span class="font-semibold">{nodePendingDeleteHost()}</span> loses the
-                          proxy service, SSH key, and API token.
-                        </>
-                      ) : (
-                        'The host loses the proxy service, SSH key, and API token.'
-                      )}
+                      Backup user tokens on the PBS are removed, so jobs referencing them will no
+                      longer authenticate until the node is re-added.
                     </li>
+                  </Show>
+                  <Show when={nodePendingDeleteType() === 'pmg'}>
                     <li>
-                      If the host comes back later, rerunning the setup script reinstalls everything
-                      with a fresh key.
+                      Mail gateway tokens are removed as part of the cleanup; re-enroll to restore
+                      outbound telemetry.
                     </li>
-                    <Show when={nodePendingDeleteType() === 'pbs'}>
-                      <li>
-                        Backup user tokens on the PBS are removed, so jobs referencing them will no
-                        longer authenticate until the node is re-added.
-                      </li>
-                    </Show>
-                    <Show when={nodePendingDeleteType() === 'pmg'}>
-                      <li>
-                        Mail gateway tokens are removed as part of the cleanup; re-enroll to restore
-                        outbound telemetry.
-                      </li>
-                    </Show>
-                  </ul>
-                </div>
+                  </Show>
+                </ul>
               </div>
+            </div>
 
-              <div class="flex items-center justify-end gap-3 pt-2">
-                <button
-                  type="button"
-                  onClick={cancelDeleteNode}
-                  class="rounded-md border border-gray-300 px-4 py-2 text-sm font-medium text-gray-700 transition-colors hover:bg-gray-100 dark:border-gray-600 dark:text-gray-300 dark:hover:bg-gray-700"
-                  disabled={deleteNodeLoading()}
-                >
-                  Keep node
-                </button>
-                <button
-                  type="button"
-                  onClick={deleteNode}
-                  disabled={deleteNodeLoading()}
-                  class="rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-red-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-red-500 dark:hover:bg-red-400"
-                >
-                  {deleteNodeLoading() ? 'Removing…' : 'Remove node'}
-                </button>
-              </div>
-            </Card>
-          </div>
-        </Show>
+            <div class="flex items-center justify-end gap-3 pt-2">
+              <button
+                type="button"
+                onClick={cancelDeleteNode}
+                class="rounded-md border border-gray-300 px-4 py-2 text-sm font-medium text-gray-700 transition-colors hover:bg-gray-100 dark:border-gray-600 dark:text-gray-300 dark:hover:bg-gray-700"
+                disabled={deleteNodeLoading()}
+              >
+                Keep node
+              </button>
+              <button
+                type="button"
+                onClick={deleteNode}
+                disabled={deleteNodeLoading()}
+                class="rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white transition-colors hover:bg-red-700 disabled:cursor-not-allowed disabled:opacity-60 dark:bg-red-500 dark:hover:bg-red-400"
+              >
+                {deleteNodeLoading() ? 'Removing…' : 'Remove node'}
+              </button>
+            </div>
+          </Card>
+        </div>
+      </Show>
+
+      {/* Node Modal - Use separate modals for PVE and PBS to ensure clean state */}
+      <Show when={showNodeModal() && currentNodeType() === 'pve'}>
+        <NodeModal
+          isOpen={true}
+          resetKey={modalResetKey()}
+          onClose={() => {
+            setShowNodeModal(false);
+            setEditingNode(null);
+            // Increment resetKey to force form reset on next open
+            setModalResetKey((prev) => prev + 1);
+          }}
+          nodeType="pve"
+          editingNode={editingNode()?.type === 'pve' ? (editingNode() ?? undefined) : undefined}
+          securityStatus={securityStatus() ?? undefined}
+          onSave={async (nodeData) => {
+            try {
+              if (editingNode() && editingNode()!.id) {
+                // Update existing node (only if it has a valid ID)
+                await NodesAPI.updateNode(editingNode()!.id, nodeData as NodeConfig);
+
+                // Update local state
+                setNodes(
+                  nodes().map((n) =>
+                    n.id === editingNode()!.id
+                      ? {
+                          ...n,
+                          ...nodeData,
+                          // Update hasPassword/hasToken based on whether credentials were provided
+                          hasPassword: nodeData.password ? true : n.hasPassword,
+                          hasToken: nodeData.tokenValue ? true : n.hasToken,
+                          status: 'pending',
+                        }
+                      : n,
+                  ),
+                );
+                showSuccess('Node updated successfully');
+              } else {
+                // Add new node
+                await NodesAPI.addNode(nodeData as NodeConfig);
+
+                // Reload nodes to get the new ID
+                const nodesList = await NodesAPI.getNodes();
+                const nodesWithStatus = nodesList.map((node) => ({
+                  ...node,
+                  // Use the hasPassword/hasToken from the API if available, otherwise check local fields
+                  hasPassword: node.hasPassword ?? !!node.password,
+                  hasToken: node.hasToken ?? !!node.tokenValue,
+                  status: node.status || ('pending' as const),
+                }));
+                setNodes(nodesWithStatus);
+                showSuccess('Node added successfully');
+              }
 
-        {/* Node Modal - Use separate modals for PVE and PBS to ensure clean state */}
-        <Show when={showNodeModal() && currentNodeType() === 'pve'}>
-          <NodeModal
-            isOpen={true}
-            resetKey={modalResetKey()}
-            onClose={() => {
               setShowNodeModal(false);
               setEditingNode(null);
-              // Increment resetKey to force form reset on next open
-              setModalResetKey((prev) => prev + 1);
-            }}
-            nodeType="pve"
-            editingNode={editingNode()?.type === 'pve' ? (editingNode() ?? undefined) : undefined}
-            securityStatus={securityStatus() ?? undefined}
-            onSave={async (nodeData) => {
-              try {
-                if (editingNode() && editingNode()!.id) {
-                  // Update existing node (only if it has a valid ID)
-                  await NodesAPI.updateNode(editingNode()!.id, nodeData as NodeConfig);
+            } catch (error) {
+              showError(error instanceof Error ? error.message : 'Operation failed');
+            }
+          }}
+        />
+      </Show>
 
-                  // Update local state
-                  setNodes(
-                    nodes().map((n) =>
-                      n.id === editingNode()!.id
-                        ? {
-                            ...n,
-                            ...nodeData,
-                            // Update hasPassword/hasToken based on whether credentials were provided
-                            hasPassword: nodeData.password ? true : n.hasPassword,
-                            hasToken: nodeData.tokenValue ? true : n.hasToken,
-                            status: 'pending',
-                          }
-                        : n,
-                    ),
-                  );
-                  showSuccess('Node updated successfully');
-                } else {
-                  // Add new node
-                  await NodesAPI.addNode(nodeData as NodeConfig);
+      {/* PBS Node Modal - Separate instance to prevent contamination */}
+      <Show when={showNodeModal() && currentNodeType() === 'pbs'}>
+        <NodeModal
+          isOpen={true}
+          resetKey={modalResetKey()}
+          onClose={() => {
+            setShowNodeModal(false);
+            setEditingNode(null);
+            // Increment resetKey to force form reset on next open
+            setModalResetKey((prev) => prev + 1);
+          }}
+          nodeType="pbs"
+          editingNode={editingNode()?.type === 'pbs' ? (editingNode() ?? undefined) : undefined}
+          securityStatus={securityStatus() ?? undefined}
+          onSave={async (nodeData) => {
+            try {
+              if (editingNode() && editingNode()!.id) {
+                // Update existing node (only if it has a valid ID)
+                await NodesAPI.updateNode(editingNode()!.id, nodeData as NodeConfig);
 
-                  // Reload nodes to get the new ID
-                  const nodesList = await NodesAPI.getNodes();
-                  const nodesWithStatus = nodesList.map((node) => ({
-                    ...node,
-                    // Use the hasPassword/hasToken from the API if available, otherwise check local fields
-                    hasPassword: node.hasPassword ?? !!node.password,
-                    hasToken: node.hasToken ?? !!node.tokenValue,
-                    status: node.status || ('pending' as const),
-                  }));
-                  setNodes(nodesWithStatus);
-                  showSuccess('Node added successfully');
-                }
+                // Update local state
+                setNodes(
+                  nodes().map((n) =>
+                    n.id === editingNode()!.id
+                      ? {
+                          ...n,
+                          ...nodeData,
+                          hasPassword: nodeData.password ? true : n.hasPassword,
+                          hasToken: nodeData.tokenValue ? true : n.hasToken,
+                          status: 'pending',
+                        }
+                      : n,
+                  ),
+                );
+                showSuccess('Node updated successfully');
+              } else {
+                // Add new node
+                await NodesAPI.addNode(nodeData as NodeConfig);
 
-                setShowNodeModal(false);
-                setEditingNode(null);
-              } catch (error) {
-                showError(error instanceof Error ? error.message : 'Operation failed');
+                // Reload the nodes list to get the latest state
+                const nodesList = await NodesAPI.getNodes();
+                const nodesWithStatus = nodesList.map((node) => ({
+                  ...node,
+                  // Use the hasPassword/hasToken from the API if available, otherwise check local fields
+                  hasPassword: node.hasPassword ?? !!node.password,
+                  hasToken: node.hasToken ?? !!node.tokenValue,
+                  status: node.status || ('pending' as const),
+                }));
+                setNodes(nodesWithStatus);
+                showSuccess('Node added successfully');
               }
-            }}
-          />
-        </Show>
 
-        {/* PBS Node Modal - Separate instance to prevent contamination */}
-        <Show when={showNodeModal() && currentNodeType() === 'pbs'}>
-          <NodeModal
-            isOpen={true}
-            resetKey={modalResetKey()}
-            onClose={() => {
               setShowNodeModal(false);
               setEditingNode(null);
-              // Increment resetKey to force form reset on next open
-              setModalResetKey((prev) => prev + 1);
-            }}
-            nodeType="pbs"
-            editingNode={editingNode()?.type === 'pbs' ? (editingNode() ?? undefined) : undefined}
-            securityStatus={securityStatus() ?? undefined}
-            onSave={async (nodeData) => {
-              try {
-                if (editingNode() && editingNode()!.id) {
-                  // Update existing node (only if it has a valid ID)
-                  await NodesAPI.updateNode(editingNode()!.id, nodeData as NodeConfig);
+            } catch (error) {
+              showError(error instanceof Error ? error.message : 'Operation failed');
+            }
+          }}
+        />
+      </Show>
 
-                  // Update local state
-                  setNodes(
-                    nodes().map((n) =>
-                      n.id === editingNode()!.id
-                        ? {
-                            ...n,
-                            ...nodeData,
-                            hasPassword: nodeData.password ? true : n.hasPassword,
-                            hasToken: nodeData.tokenValue ? true : n.hasToken,
-                            status: 'pending',
-                          }
-                        : n,
-                    ),
-                  );
-                  showSuccess('Node updated successfully');
-                } else {
-                  // Add new node
-                  await NodesAPI.addNode(nodeData as NodeConfig);
-
-                  // Reload the nodes list to get the latest state
-                  const nodesList = await NodesAPI.getNodes();
-                  const nodesWithStatus = nodesList.map((node) => ({
-                    ...node,
-                    // Use the hasPassword/hasToken from the API if available, otherwise check local fields
-                    hasPassword: node.hasPassword ?? !!node.password,
-                    hasToken: node.hasToken ?? !!node.tokenValue,
-                    status: node.status || ('pending' as const),
-                  }));
-                  setNodes(nodesWithStatus);
-                  showSuccess('Node added successfully');
-                }
-
-                setShowNodeModal(false);
-                setEditingNode(null);
-              } catch (error) {
-                showError(error instanceof Error ? error.message : 'Operation failed');
+      {/* PMG Node Modal */}
+      <Show when={showNodeModal() && currentNodeType() === 'pmg'}>
+        <NodeModal
+          isOpen={true}
+          resetKey={modalResetKey()}
+          onClose={() => {
+            setShowNodeModal(false);
+            setEditingNode(null);
+            setModalResetKey((prev) => prev + 1);
+          }}
+          nodeType="pmg"
+          editingNode={editingNode()?.type === 'pmg' ? (editingNode() ?? undefined) : undefined}
+          securityStatus={securityStatus() ?? undefined}
+          onSave={async (nodeData) => {
+            try {
+              if (editingNode() && editingNode()!.id) {
+                await NodesAPI.updateNode(editingNode()!.id, nodeData as NodeConfig);
+                setNodes(
+                  nodes().map((n) =>
+                    n.id === editingNode()!.id
+                      ? {
+                          ...n,
+                          ...nodeData,
+                          hasPassword: nodeData.password ? true : n.hasPassword,
+                          hasToken: nodeData.tokenValue ? true : n.hasToken,
+                          status: 'pending',
+                        }
+                      : n,
+                  ),
+                );
+                showSuccess('Node updated successfully');
+              } else {
+                await NodesAPI.addNode(nodeData as NodeConfig);
+                const nodesList = await NodesAPI.getNodes();
+                const nodesWithStatus = nodesList.map((node) => ({
+                  ...node,
+                  hasPassword: node.hasPassword ?? !!node.password,
+                  hasToken: node.hasToken ?? !!node.tokenValue,
+                  status: node.status || ('pending' as const),
+                }));
+                setNodes(nodesWithStatus);
+                showSuccess('Node added successfully');
               }
-            }}
-          />
-        </Show>
 
-        {/* PMG Node Modal */}
-        <Show when={showNodeModal() && currentNodeType() === 'pmg'}>
-          <NodeModal
-            isOpen={true}
-            resetKey={modalResetKey()}
-            onClose={() => {
               setShowNodeModal(false);
               setEditingNode(null);
-              setModalResetKey((prev) => prev + 1);
-            }}
-            nodeType="pmg"
-            editingNode={editingNode()?.type === 'pmg' ? (editingNode() ?? undefined) : undefined}
-            securityStatus={securityStatus() ?? undefined}
-            onSave={async (nodeData) => {
-              try {
-                if (editingNode() && editingNode()!.id) {
-                  await NodesAPI.updateNode(editingNode()!.id, nodeData as NodeConfig);
-                  setNodes(
-                    nodes().map((n) =>
-                      n.id === editingNode()!.id
-                        ? {
-                            ...n,
-                            ...nodeData,
-                            hasPassword: nodeData.password ? true : n.hasPassword,
-                            hasToken: nodeData.tokenValue ? true : n.hasToken,
-                            status: 'pending',
-                          }
-                        : n,
-                    ),
-                  );
-                  showSuccess('Node updated successfully');
-                } else {
-                  await NodesAPI.addNode(nodeData as NodeConfig);
-                  const nodesList = await NodesAPI.getNodes();
-                  const nodesWithStatus = nodesList.map((node) => ({
-                    ...node,
-                    hasPassword: node.hasPassword ?? !!node.password,
-                    hasToken: node.hasToken ?? !!node.tokenValue,
-                    status: node.status || ('pending' as const),
-                  }));
-                  setNodes(nodesWithStatus);
-                  showSuccess('Node added successfully');
-                }
-
-                setShowNodeModal(false);
-                setEditingNode(null);
-              } catch (error) {
-                showError(error instanceof Error ? error.message : 'Operation failed');
-              }
-            }}
-          />
-        </Show>
+            } catch (error) {
+              showError(error instanceof Error ? error.message : 'Operation failed');
+            }
+          }}
+        />
+      </Show>
       {/* Export Dialog */}
       <Show when={showExportDialog()}>
         <div class="fixed inset-0 bg-black bg-opacity-50 flex items-center justify-center z-50">
diff --git a/frontend-modern/src/components/Settings/__tests__/DockerAgents.test.tsx b/frontend-modern/src/components/Settings/__tests__/DockerAgents.test.tsx
new file mode 100644
index 0000000..4d8e95f
--- /dev/null
+++ b/frontend-modern/src/components/Settings/__tests__/DockerAgents.test.tsx
@@ -0,0 +1,218 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { render, fireEvent, screen, waitFor, cleanup } from '@solidjs/testing-library';
+import { createStore } from 'solid-js/store';
+import { DockerAgents } from '../DockerAgents';
+import type { DockerHost, RemovedDockerHost } from '@/types/api';
+
+let mockWsStore: {
+  state: { dockerHosts: DockerHost[]; removedDockerHosts: RemovedDockerHost[] };
+  connected: () => boolean;
+  reconnecting: () => boolean;
+  activeAlerts: unknown[];
+};
+
+const allowDockerHostReenrollMock = vi.fn();
+const deleteDockerHostMock = vi.fn();
+const unhideDockerHostMock = vi.fn();
+const notificationSuccessMock = vi.fn();
+const notificationErrorMock = vi.fn();
+const fetchMock = vi.fn();
+
+vi.mock('@/App', () => ({
+  useWebSocket: () => mockWsStore,
+}));
+
+vi.mock('@/api/monitoring', () => ({
+  MonitoringAPI: {
+    allowDockerHostReenroll: (...args: unknown[]) => allowDockerHostReenrollMock(...args),
+    deleteDockerHost: (...args: unknown[]) => deleteDockerHostMock(...args),
+    unhideDockerHost: (...args: unknown[]) => unhideDockerHostMock(...args),
+  },
+}));
+
+vi.mock('@/api/security', () => ({
+  SecurityAPI: {
+    createToken: vi.fn(),
+  },
+}));
+
+vi.mock('@/stores/notifications', () => ({
+  notificationStore: {
+    success: (...args: unknown[]) => notificationSuccessMock(...args),
+    error: (...args: unknown[]) => notificationErrorMock(...args),
+  },
+}));
+
+const createDockerHost = (overrides?: Partial<DockerHost>): DockerHost => ({
+  id: 'host-1',
+  agentId: 'agent-1',
+  hostname: 'host-1.local',
+  displayName: 'Host One',
+  cpus: 4,
+  totalMemoryBytes: 8 * 1024 * 1024 * 1024,
+  uptimeSeconds: 12_345,
+  status: 'online',
+  lastSeen: Date.now(),
+  intervalSeconds: 30,
+  containers: [],
+  ...overrides,
+});
+
+const createRemovedHost = (overrides?: Partial<RemovedDockerHost>): RemovedDockerHost => ({
+  id: 'host-removed',
+  hostname: 'retired-node.local',
+  displayName: 'Retired Node',
+  removedAt: Date.now() - 60_000,
+  ...overrides,
+});
+
+const setupComponent = (hosts: DockerHost[], removedHosts: RemovedDockerHost[] = []) => {
+  const [state] = createStore({
+    dockerHosts: hosts,
+    removedDockerHosts: removedHosts,
+  });
+
+  mockWsStore = {
+    state,
+    connected: () => true,
+    reconnecting: () => false,
+    activeAlerts: [],
+  };
+
+  return render(() => <DockerAgents />);
+};
+
+beforeEach(() => {
+  allowDockerHostReenrollMock.mockReset();
+  deleteDockerHostMock.mockReset();
+  unhideDockerHostMock.mockReset();
+  notificationSuccessMock.mockReset();
+  notificationErrorMock.mockReset();
+  fetchMock.mockReset();
+  fetchMock.mockResolvedValue(
+    new Response(JSON.stringify({ requiresAuth: true, apiTokenConfigured: false }), {
+      status: 200,
+      headers: { 'Content-Type': 'application/json' },
+    }),
+  );
+  vi.stubGlobal('fetch', fetchMock);
+});
+
+afterEach(() => {
+  cleanup();
+  vi.unstubAllGlobals();
+});
+
+describe('DockerAgents removed hosts', () => {
+  it('renders removed hosts card and triggers allow/copy actions', async () => {
+    allowDockerHostReenrollMock.mockResolvedValue(undefined);
+    const clipboardSpy = vi.fn().mockResolvedValue(undefined);
+
+    vi.stubGlobal('navigator', { clipboard: { writeText: clipboardSpy } } as Navigator);
+
+    setupComponent([], [createRemovedHost()]);
+
+    expect(screen.getByText('Recently removed Docker hosts')).toBeInTheDocument();
+    const allowButton = screen.getByRole('button', { name: 'Allow re-enroll' });
+    fireEvent.click(allowButton);
+
+    await waitFor(() => expect(allowDockerHostReenrollMock).toHaveBeenCalledWith('host-removed'), { interval: 0 });
+
+    const copyButton = screen.getByRole('button', { name: 'Copy curl command' });
+    fireEvent.click(copyButton);
+
+    await waitFor(() => expect(clipboardSpy).toHaveBeenCalledTimes(1), { interval: 0 });
+    const copiedCommand = clipboardSpy.mock.calls.at(-1)?.[0];
+    expect(typeof copiedCommand).toBe('string');
+    expect(copiedCommand).toContain('/api/agents/docker/hosts/host-removed/allow-reenroll');
+
+    expect(notificationSuccessMock).toHaveBeenCalled();
+    expect(notificationErrorMock).not.toHaveBeenCalled();
+  });
+
+  it('shows progress stepper for an in-progress removal command', async () => {
+    const now = Date.now();
+    const host = createDockerHost({
+      command: {
+        id: 'cmd-1',
+        type: 'stop',
+        status: 'acknowledged',
+        createdAt: now - 60_000,
+        updatedAt: now - 20_000,
+        dispatchedAt: now - 40_000,
+        acknowledgedAt: now - 10_000,
+      },
+    });
+
+    setupComponent([host]);
+
+    const removeButton = screen.getByRole('button', { name: 'Remove' });
+    fireEvent.click(removeButton);
+
+    await screen.findByText('Remove Docker host "Host One"');
+    expect(screen.getByText('acknowledged')).toBeInTheDocument();
+
+    const progressHeading = screen.getByText('Progress');
+    const progressCard = progressHeading.parentElement?.parentElement;
+    if (!progressCard) {
+      throw new Error('Progress card not found');
+    }
+
+    const steps = Array.from(progressCard.querySelectorAll('li'));
+    expect(steps).toHaveLength(4);
+
+    expect(steps[0]).toHaveTextContent('Stop command queued');
+    expect(steps[1]).toHaveTextContent('Instruction delivered to the agent');
+    expect(steps[2]).toHaveTextContent('Agent acknowledged the stop request');
+    expect(steps[3]).toHaveTextContent('Agent disabled the service and removed autostart');
+
+    const indicators = steps.map((step) => step.querySelector('span'));
+    expect(indicators[0]?.className).toContain('bg-blue-500');
+    expect(indicators[1]?.className).toContain('bg-blue-500');
+    expect(indicators[2]?.className).toContain('animate-pulse');
+    expect(indicators[3]?.className).toContain('bg-gray-300');
+  });
+
+  it('shows waiting message once the agent has already stopped', async () => {
+    const host = createDockerHost({
+      status: 'online',
+      pendingUninstall: true,
+      command: undefined,
+      lastSeen: Date.now() - 45_000,
+    });
+
+    setupComponent([host]);
+
+    const viewButton = await screen.findByRole('button', { name: 'View progress' });
+    fireEvent.click(viewButton);
+
+    await screen.findByText('Pulse is waiting for', { exact: false });
+
+    const stopButton = screen.getByRole('button', { name: 'Waiting for host…' });
+    expect(stopButton).toBeDisabled();
+    expect(screen.queryByText('Progress')).not.toBeInTheDocument();
+  });
+
+  it('shows confirmation while waiting for the agent to acknowledge the stop command', async () => {
+    deleteDockerHostMock.mockResolvedValue({});
+    const host = createDockerHost();
+
+    setupComponent([host]);
+
+    const removeButton = screen.getByRole('button', { name: 'Remove' });
+    fireEvent.click(removeButton);
+
+    await screen.findByText('Remove Docker host "Host One"');
+
+    const stopButton = screen.getByRole('button', { name: 'Stop agent now' });
+    fireEvent.click(stopButton);
+
+    await waitFor(() => expect(deleteDockerHostMock).toHaveBeenCalledWith('host-1'), { interval: 0 });
+
+    const waitingButton = await screen.findByRole('button', { name: 'Waiting for agent…' });
+    expect(waitingButton).toBeDisabled();
+
+    expect(screen.getByText('Stop command sent.')).toBeInTheDocument();
+    expect(notificationSuccessMock).toHaveBeenCalledWith('Stop command sent to Host One', 3500);
+  });
+});
diff --git a/frontend-modern/src/components/Settings/__tests__/HostAgents.test.tsx b/frontend-modern/src/components/Settings/__tests__/HostAgents.test.tsx
index 2277c3d..d5d418e 100644
--- a/frontend-modern/src/components/Settings/__tests__/HostAgents.test.tsx
+++ b/frontend-modern/src/components/Settings/__tests__/HostAgents.test.tsx
@@ -13,6 +13,11 @@ let mockWsStore: {
 
 const lookupMock = vi.fn();
 const createTokenMock = vi.fn();
+const deleteHostAgentMock = vi.fn();
+const notificationSuccessMock = vi.fn();
+const notificationErrorMock = vi.fn();
+const notificationInfoMock = vi.fn();
+const clipboardSpy = vi.fn();
 
 vi.mock('@/App', () => ({
   useWebSocket: () => mockWsStore,
@@ -21,6 +26,7 @@ vi.mock('@/App', () => ({
 vi.mock('@/api/monitoring', () => ({
   MonitoringAPI: {
     lookupHost: (...args: unknown[]) => lookupMock(...args),
+    deleteHostAgent: (...args: unknown[]) => deleteHostAgentMock(...args),
   },
 }));
 
@@ -30,6 +36,14 @@ vi.mock('@/api/security', () => ({
   },
 }));
 
+vi.mock('@/stores/notifications', () => ({
+  notificationStore: {
+    success: (...args: unknown[]) => notificationSuccessMock(...args),
+    error: (...args: unknown[]) => notificationErrorMock(...args),
+    info: (...args: unknown[]) => notificationInfoMock(...args),
+  },
+}));
+
 const createHost = (overrides?: Partial<Host>): Host => ({
   id: 'host-1',
   hostname: 'host-1.local',
@@ -69,9 +83,29 @@ const createHost = (overrides?: Partial<Host>): Host => ({
 
 const stubFetchSuccess = vi.fn();
 
+const setupComponent = (hosts: Host[]) => {
+  const [state] = createStore({
+    hosts,
+    connectionHealth: {},
+  });
+
+  mockWsStore = {
+    state,
+    connected: () => true,
+    reconnecting: () => false,
+    activeAlerts: [],
+  };
+
+  return render(() => <HostAgents />);
+};
+
 beforeEach(() => {
   lookupMock.mockReset();
   createTokenMock.mockReset();
+  deleteHostAgentMock.mockReset();
+  notificationSuccessMock.mockReset();
+  notificationErrorMock.mockReset();
+  notificationInfoMock.mockReset();
   stubFetchSuccess.mockImplementation(
     async () =>
       new Response(JSON.stringify({ requiresAuth: true, apiTokenConfigured: false }), {
@@ -80,6 +114,8 @@ beforeEach(() => {
       }),
   );
   vi.stubGlobal('fetch', stubFetchSuccess);
+  clipboardSpy.mockReset();
+  vi.stubGlobal('navigator', { clipboard: { writeText: clipboardSpy } } as unknown as Navigator);
 });
 
 afterEach(() => {
@@ -88,22 +124,6 @@ afterEach(() => {
 });
 
 describe('HostAgents lookup flow', () => {
-  const setupComponent = (hosts: Host[]) => {
-    const [state] = createStore({
-      hosts,
-      connectionHealth: {},
-    });
-
-    mockWsStore = {
-      state,
-      connected: () => true,
-      reconnecting: () => false,
-      activeAlerts: [],
-    };
-
-    return render(() => <HostAgents />);
-  };
-
   it('highlights a host after a successful lookup and clears highlight after timeout', async () => {
     const host = createHost();
     setupComponent([host]);
@@ -204,3 +224,93 @@ describe('HostAgents lookup flow', () => {
     expect(row.classList.contains('ring-2')).toBe(false);
   });
 });
+
+describe('Host removal modal', () => {
+  it('removes a host while it is still reporting and explains the impact', async () => {
+    deleteHostAgentMock.mockResolvedValue(undefined);
+    const host = createHost({
+      lastSeen: Date.now(),
+      status: 'online',
+    });
+
+    setupComponent([host]);
+
+    const removeButton = screen.getByRole('button', { name: 'Remove' });
+    fireEvent.click(removeButton);
+
+    await screen.findByText('Remove host "Host One"');
+
+    const copyButton = screen.getByRole('button', { name: 'Copy command' });
+    fireEvent.click(copyButton);
+    await waitFor(() => expect(clipboardSpy).toHaveBeenCalled(), { interval: 0 });
+
+    const confirmButton = await screen.findByRole('button', { name: 'I ran this command' });
+    fireEvent.click(confirmButton);
+
+    expect(
+      screen.getByText("Pulse revokes the host's API token", {
+        exact: false,
+      }),
+    ).toBeInTheDocument();
+
+    const removeHostButton = screen.getByRole('button', { name: 'Remove host' });
+    expect(removeHostButton).toBeEnabled();
+    fireEvent.click(removeHostButton);
+
+    await waitFor(() => expect(deleteHostAgentMock).toHaveBeenCalledWith('host-1'), { interval: 0 });
+    await waitFor(() => expect(notificationSuccessMock).toHaveBeenCalledWith('Host "Host One" removed', 4000), {
+      interval: 0,
+    });
+    await waitFor(() => expect(screen.queryByText('Remove host "Host One"')).not.toBeInTheDocument(), {
+      interval: 0,
+    });
+  });
+
+  it('removes a stale host without forcing', async () => {
+    deleteHostAgentMock.mockResolvedValue(undefined);
+    const host = createHost({
+      lastSeen: Date.now() - 5 * 60_000,
+      status: 'offline',
+    });
+
+    setupComponent([host]);
+
+    const removeButton = screen.getByRole('button', { name: 'Remove' });
+    fireEvent.click(removeButton);
+
+    await screen.findByText('Remove host "Host One"');
+
+    const copyButton = screen.getByRole('button', { name: 'Copy command' });
+    fireEvent.click(copyButton);
+    await waitFor(() => expect(clipboardSpy).toHaveBeenCalled(), { interval: 0 });
+
+    const confirmButton = await screen.findByRole('button', { name: 'I ran this command' });
+    fireEvent.click(confirmButton);
+
+    const removeHostButton = screen.getByRole('button', { name: 'Remove host' });
+    fireEvent.click(removeHostButton);
+
+    await waitFor(() => expect(deleteHostAgentMock).toHaveBeenCalledWith('host-1'), { interval: 0 });
+    await waitFor(() => expect(notificationSuccessMock).toHaveBeenCalledWith('Host "Host One" removed', 4000), {
+      interval: 0,
+    });
+    await waitFor(() => expect(screen.queryByText('Remove host "Host One"')).not.toBeInTheDocument(), {
+      interval: 0,
+    });
+  });
+
+  it('shows macOS-specific uninstall guidance', async () => {
+    const host = createHost({
+      platform: 'macos',
+    });
+
+    setupComponent([host]);
+
+    const removeButton = screen.getByRole('button', { name: 'Remove' });
+    fireEvent.click(removeButton);
+
+    await screen.findByText('Remove host "Host One"');
+    expect(screen.getByText('launchctl unload', { exact: false })).toBeInTheDocument();
+    expect(screen.getByText('Unloads the launch agent, removes the plist, deletes the binary, and clears the local log.')).toBeInTheDocument();
+  });
+});
diff --git a/frontend-modern/src/pages/Alerts.tsx b/frontend-modern/src/pages/Alerts.tsx
index 184f3df..5778f9d 100644
--- a/frontend-modern/src/pages/Alerts.tsx
+++ b/frontend-modern/src/pages/Alerts.tsx
@@ -320,7 +320,7 @@ export const extractTriggerValues = (
   const result: Record<string, number> = {};
   Object.entries(thresholds).forEach(([key, value]) => {
     // Skip non-threshold fields
-    if (key === 'disabled' || key === 'disableConnectivity' || key === 'poweredOffSeverity') return;
+    if (key === 'disabled' || key === 'disableConnectivity' || key === 'poweredOffSeverity' || key === 'note') return;
     if (typeof value === 'string') return;
     result[key] = getTriggerValue(value);
   });
diff --git a/frontend-modern/src/types/alerts.ts b/frontend-modern/src/types/alerts.ts
index 6ea69f2..2b6c19a 100644
--- a/frontend-modern/src/types/alerts.ts
+++ b/frontend-modern/src/types/alerts.ts
@@ -32,6 +32,7 @@ export type RawOverrideConfig = AlertThresholds & {
   disabled?: boolean;
   disableConnectivity?: boolean;
   poweredOffSeverity?: 'warning' | 'critical';
+  note?: string;
   // NOTE: To disable individual metrics, set threshold to -1
 };
 
diff --git a/frontend-modern/src/types/api.ts b/frontend-modern/src/types/api.ts
index d8f1c37..d4475aa 100644
--- a/frontend-modern/src/types/api.ts
+++ b/frontend-modern/src/types/api.ts
@@ -5,6 +5,7 @@ export interface State {
   vms: VM[];
   containers: Container[];
   dockerHosts: DockerHost[];
+  removedDockerHosts?: RemovedDockerHost[];
   hosts: Host[];
   replicationJobs: ReplicationJob[];
   storage: Storage[];
@@ -25,6 +26,13 @@ export interface State {
   lastUpdate: string;
 }
 
+export interface RemovedDockerHost {
+  id: string;
+  hostname?: string;
+  displayName?: string;
+  removedAt: number;
+}
+
 export interface Node {
   id: string;
   name: string;
@@ -271,6 +279,8 @@ export interface DockerContainerNetwork {
 export interface DockerContainerBlockIO {
   readBytes?: number;
   writeBytes?: number;
+  readRateBytesPerSecond?: number;
+  writeRateBytesPerSecond?: number;
 }
 
 export interface DockerContainerMount {
diff --git a/go.mod b/go.mod
index 5265cc1..46d5c16 100644
--- a/go.mod
+++ b/go.mod
@@ -42,6 +42,7 @@ require (
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
diff --git a/internal/alerts/alerts.go b/internal/alerts/alerts.go
index fe99602..1395393 100644
--- a/internal/alerts/alerts.go
+++ b/internal/alerts/alerts.go
@@ -167,6 +167,7 @@ type ThresholdConfig struct {
 	NetworkOut          *HysteresisThreshold `json:"networkOut,omitempty"`
 	Usage               *HysteresisThreshold `json:"usage,omitempty"`       // For storage devices
 	Temperature         *HysteresisThreshold `json:"temperature,omitempty"` // For node CPU temperature
+	Note                *string              `json:"note,omitempty"`
 	// Legacy fields for backward compatibility
 	CPULegacy        *float64 `json:"cpuLegacy,omitempty"`
 	MemoryLegacy     *float64 `json:"memoryLegacy,omitempty"`
@@ -7015,6 +7016,14 @@ func cloneThreshold(threshold *HysteresisThreshold) *HysteresisThreshold {
 	return &clone
 }
 
+func cloneStringPtr(value *string) *string {
+	if value == nil {
+		return nil
+	}
+	copy := *value
+	return &copy
+}
+
 func cloneThresholdConfig(cfg ThresholdConfig) ThresholdConfig {
 	clone := cfg
 	clone.CPU = cloneThreshold(cfg.CPU)
@@ -7026,6 +7035,7 @@ func cloneThresholdConfig(cfg ThresholdConfig) ThresholdConfig {
 	clone.NetworkOut = cloneThreshold(cfg.NetworkOut)
 	clone.Temperature = cloneThreshold(cfg.Temperature)
 	clone.Usage = cloneThreshold(cfg.Usage)
+	clone.Note = cloneStringPtr(cfg.Note)
 	return clone
 }
 
@@ -7089,6 +7099,16 @@ func (m *Manager) applyThresholdOverride(base ThresholdConfig, override Threshol
 		result.Usage = ensureHysteresisThreshold(cloneThreshold(override.Usage))
 	}
 
+	if override.Note != nil {
+		note := strings.TrimSpace(*override.Note)
+		if note == "" {
+			result.Note = nil
+		} else {
+			noteCopy := note
+			result.Note = &noteCopy
+		}
+	}
+
 	return result
 }
 
diff --git a/internal/api/diagnostics.go b/internal/api/diagnostics.go
index a4a6cc2..5201261 100644
--- a/internal/api/diagnostics.go
+++ b/internal/api/diagnostics.go
@@ -38,6 +38,7 @@ type DiagnosticsInfo struct {
 	Nodes            []NodeDiagnostic            `json:"nodes"`
 	PBS              []PBSDiagnostic             `json:"pbs"`
 	System           SystemDiagnostic            `json:"system"`
+	Discovery        *DiscoveryDiagnostic        `json:"discovery,omitempty"`
 	TemperatureProxy *TemperatureProxyDiagnostic `json:"temperatureProxy,omitempty"`
 	APITokens        *APITokenDiagnostic         `json:"apiTokens,omitempty"`
 	DockerAgents     *DockerAgentDiagnostic      `json:"dockerAgents,omitempty"`
@@ -51,6 +52,36 @@ type DiagnosticsInfo struct {
 	MemorySources []MemorySourceStat `json:"memorySources,omitempty"`
 }
 
+// DiscoveryDiagnostic summarizes discovery configuration and recent activity.
+type DiscoveryDiagnostic struct {
+	Enabled             bool     `json:"enabled"`
+	ConfiguredSubnet    string   `json:"configuredSubnet,omitempty"`
+	ActiveSubnet        string   `json:"activeSubnet,omitempty"`
+	EnvironmentOverride string   `json:"environmentOverride,omitempty"`
+	SubnetAllowlist     []string `json:"subnetAllowlist"`
+	SubnetBlocklist     []string `json:"subnetBlocklist"`
+	Scanning            bool     `json:"scanning"`
+	ScanInterval        string   `json:"scanInterval,omitempty"`
+	LastScanStartedAt   string   `json:"lastScanStartedAt,omitempty"`
+	LastResultTimestamp string   `json:"lastResultTimestamp,omitempty"`
+	LastResultServers   int      `json:"lastResultServers,omitempty"`
+	LastResultErrors    int      `json:"lastResultErrors,omitempty"`
+	History             []DiscoveryHistoryItem `json:"history,omitempty"`
+}
+
+// DiscoveryHistoryItem summarizes the outcome of a recent discovery scan.
+type DiscoveryHistoryItem struct {
+	StartedAt       string `json:"startedAt"`
+	CompletedAt     string `json:"completedAt"`
+	Duration        string `json:"duration"`
+	DurationMs      int64  `json:"durationMs"`
+	Subnet          string `json:"subnet"`
+	ServerCount     int    `json:"serverCount"`
+	ErrorCount      int    `json:"errorCount"`
+	BlocklistLength int    `json:"blocklistLength"`
+	Status          string `json:"status"`
+}
+
 // MemorySourceStat aggregates memory-source usage per instance.
 type MemorySourceStat struct {
 	Instance    string `json:"instance"`
@@ -475,6 +506,8 @@ func (r *Router) computeDiagnostics(ctx context.Context) DiagnosticsInfo {
 	diag.DockerAgents = buildDockerAgentDiagnostic(r.monitor, diag.Version)
 	diag.Alerts = buildAlertsDiagnostic(r.monitor)
 
+	diag.Discovery = buildDiscoveryDiagnostic(r.config, r.monitor)
+
 	if r.monitor != nil {
 		snapshots := r.monitor.GetDiagnosticSnapshots()
 		if len(snapshots.Nodes) > 0 {
@@ -536,6 +569,90 @@ func (r *Router) computeDiagnostics(ctx context.Context) DiagnosticsInfo {
 	return diag
 }
 
+func copyStringSlice(values []string) []string {
+	if len(values) == 0 {
+		return []string{}
+	}
+	return append([]string(nil), values...)
+}
+
+func buildDiscoveryDiagnostic(cfg *config.Config, monitor *monitoring.Monitor) *DiscoveryDiagnostic {
+	if cfg == nil {
+		return nil
+	}
+
+	discovery := &DiscoveryDiagnostic{
+		Enabled:             cfg.DiscoveryEnabled,
+		ConfiguredSubnet:    strings.TrimSpace(cfg.DiscoverySubnet),
+		EnvironmentOverride: strings.TrimSpace(cfg.Discovery.EnvironmentOverride),
+		SubnetAllowlist:     copyStringSlice(cfg.Discovery.SubnetAllowlist),
+		SubnetBlocklist:     copyStringSlice(cfg.Discovery.SubnetBlocklist),
+	}
+
+	if discovery.ConfiguredSubnet == "" {
+		discovery.ConfiguredSubnet = "auto"
+	}
+	if discovery.SubnetAllowlist == nil {
+		discovery.SubnetAllowlist = []string{}
+	}
+	if discovery.SubnetBlocklist == nil {
+		discovery.SubnetBlocklist = []string{}
+	}
+
+	if monitor != nil {
+		if svc := monitor.GetDiscoveryService(); svc != nil {
+			status := svc.GetStatus()
+
+			if val, ok := status["subnet"].(string); ok {
+				discovery.ActiveSubnet = val
+			}
+			if val, ok := status["is_scanning"].(bool); ok {
+				discovery.Scanning = val
+			}
+			if val, ok := status["interval"].(string); ok {
+				discovery.ScanInterval = val
+			}
+			if val, ok := status["last_scan"].(time.Time); ok && !val.IsZero() {
+				discovery.LastScanStartedAt = val.UTC().Format(time.RFC3339)
+			}
+
+			if result, updated := svc.GetCachedResult(); result != nil {
+				discovery.LastResultServers = len(result.Servers)
+				if len(result.StructuredErrors) > 0 {
+					discovery.LastResultErrors = len(result.StructuredErrors)
+				} else if len(result.Errors) > 0 {
+					discovery.LastResultErrors = len(result.Errors)
+				}
+				if !updated.IsZero() {
+					discovery.LastResultTimestamp = updated.UTC().Format(time.RFC3339)
+				}
+			}
+
+			history := svc.GetHistory(10)
+			if len(history) > 0 {
+				items := make([]DiscoveryHistoryItem, 0, len(history))
+				for _, entry := range history {
+					item := DiscoveryHistoryItem{
+						StartedAt:       entry.startedAt.UTC().Format(time.RFC3339),
+						CompletedAt:     entry.completedAt.UTC().Format(time.RFC3339),
+						Duration:        entry.duration.Truncate(time.Millisecond).String(),
+						DurationMs:      entry.duration.Milliseconds(),
+						Subnet:          entry.subnet,
+						ServerCount:     entry.serverCount,
+						ErrorCount:      entry.errorCount,
+						BlocklistLength: entry.blocklistLength,
+						Status:          entry.status,
+					}
+					items = append(items, item)
+				}
+				discovery.History = items
+			}
+		}
+	}
+
+	return discovery
+}
+
 func buildTemperatureProxyDiagnostic(cfg *config.Config, legacyDetected, recommendProxy bool) *TemperatureProxyDiagnostic {
 	diag := &TemperatureProxyDiagnostic{
 		LegacySSHDetected:     legacyDetected,
diff --git a/internal/api/router.go b/internal/api/router.go
index f72c15f..d1e1e3e 100644
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -3197,10 +3197,35 @@ func (r *Router) handleDownloadAgent(w http.ResponseWriter, req *http.Request) {
 		if candidate == "" {
 			continue
 		}
-		if info, err := os.Stat(candidate); err == nil && !info.IsDir() {
-			http.ServeFile(w, req, candidate)
-			return
+
+		info, err := os.Stat(candidate)
+		if err != nil || info.IsDir() {
+			continue
 		}
+
+		file, err := os.Open(candidate)
+		if err != nil {
+			log.Error().Err(err).Str("path", candidate).Msg("Failed to open docker agent binary for download")
+			continue
+		}
+
+		hasher := sha256.New()
+		if _, err := io.Copy(hasher, file); err != nil {
+			file.Close()
+			log.Error().Err(err).Str("path", candidate).Msg("Failed to hash docker agent binary")
+			continue
+		}
+
+		if _, err := file.Seek(0, io.SeekStart); err != nil {
+			file.Close()
+			log.Error().Err(err).Str("path", candidate).Msg("Failed to rewind docker agent binary")
+			continue
+		}
+
+		w.Header().Set("X-Checksum-Sha256", hex.EncodeToString(hasher.Sum(nil)))
+		http.ServeContent(w, req, filepath.Base(candidate), info.ModTime(), file)
+		file.Close()
+		return
 	}
 
 	http.Error(w, "Agent binary not found", http.StatusNotFound)
diff --git a/internal/discovery/service.go b/internal/discovery/service.go
index b7ca660..5537fa2 100644
--- a/internal/discovery/service.go
+++ b/internal/discovery/service.go
@@ -6,6 +6,7 @@ import (
 	"sync"
 	"time"
 
+	"github.com/prometheus/client_golang/prometheus"
 	"github.com/rcourtman/pulse-go-rewrite/internal/config"
 	"github.com/rcourtman/pulse-go-rewrite/internal/websocket"
 	pkgdiscovery "github.com/rcourtman/pulse-go-rewrite/pkg/discovery"
@@ -14,17 +15,20 @@ import (
 
 // Service handles background network discovery
 type Service struct {
-	scanner    *pkgdiscovery.Scanner
-	wsHub      *websocket.Hub
-	cache      *DiscoveryCache
-	interval   time.Duration
-	subnet     string
-	mu         sync.RWMutex
-	lastScan   time.Time
-	isScanning bool
-	stopChan   chan struct{}
-	ctx        context.Context
-	cfgProvider func() config.DiscoveryConfig
+	scanner        discoveryScanner
+	wsHub          *websocket.Hub
+	cache          *DiscoveryCache
+	interval       time.Duration
+	subnet         string
+	mu             sync.RWMutex
+	lastScan       time.Time
+	isScanning     bool
+	stopChan       chan struct{}
+	ctx            context.Context
+	cfgProvider    func() config.DiscoveryConfig
+	history        []historyEntry
+	historyLimit   int
+	scannerFactory scannerFactory
 }
 
 // DiscoveryCache stores the latest discovery results
@@ -34,6 +38,66 @@ type DiscoveryCache struct {
 	updated time.Time
 }
 
+type historyEntry struct {
+	startedAt       time.Time
+	completedAt     time.Time
+	subnet          string
+	serverCount     int
+	errorCount      int
+	duration        time.Duration
+	blocklistLength int
+	status          string
+}
+
+const defaultHistoryLimit = 20
+
+type discoveryScanner interface {
+	DiscoverServersWithCallbacks(ctx context.Context, subnet string, serverCallback pkgdiscovery.ServerCallback, progressCallback pkgdiscovery.ProgressCallback) (*pkgdiscovery.DiscoveryResult, error)
+}
+
+type scannerFactory func(config.DiscoveryConfig) (discoveryScanner, error)
+
+var (
+	discoveryScanResults = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Namespace: "pulse",
+			Subsystem: "discovery",
+			Name:      "scans_total",
+			Help:      "Total number of discovery scans by result status.",
+		},
+		[]string{"result"},
+	)
+	discoveryScanDuration = prometheus.NewHistogram(
+		prometheus.HistogramOpts{
+			Namespace: "pulse",
+			Subsystem: "discovery",
+			Name:      "scan_duration_seconds",
+			Help:      "Duration of discovery scans in seconds.",
+			Buckets:   []float64{5, 10, 20, 30, 45, 60, 90, 120, 180},
+		},
+	)
+	discoveryScanServers = prometheus.NewGauge(
+		prometheus.GaugeOpts{
+			Namespace: "pulse",
+			Subsystem: "discovery",
+			Name:      "last_scan_servers",
+			Help:      "Number of servers found in the most recent discovery scan.",
+		},
+	)
+	discoveryScanErrors = prometheus.NewGauge(
+		prometheus.GaugeOpts{
+			Namespace: "pulse",
+			Subsystem: "discovery",
+			Name:      "last_scan_errors",
+			Help:      "Number of errors encountered in the most recent discovery scan.",
+		},
+	)
+)
+
+func init() {
+	prometheus.MustRegister(discoveryScanResults, discoveryScanDuration, discoveryScanServers, discoveryScanErrors)
+}
+
 // NewService creates a new discovery service
 func NewService(wsHub *websocket.Hub, interval time.Duration, subnet string, cfgProvider func() config.DiscoveryConfig) *Service {
 	if interval == 0 {
@@ -48,13 +112,18 @@ func NewService(wsHub *websocket.Hub, interval time.Duration, subnet string, cfg
 	}
 
 	return &Service{
-		scanner:  pkgdiscovery.NewScanner(),
-		wsHub:    wsHub,
-		cache:    &DiscoveryCache{},
-		interval: interval,
-		subnet:   subnet,
-		stopChan: make(chan struct{}),
-		cfgProvider: cfgProvider,
+		scanner:      pkgdiscovery.NewScanner(),
+		wsHub:        wsHub,
+		cache:        &DiscoveryCache{},
+		interval:     interval,
+		subnet:       subnet,
+		stopChan:     make(chan struct{}),
+		cfgProvider:  cfgProvider,
+		history:      make([]historyEntry, 0, defaultHistoryLimit),
+		historyLimit: defaultHistoryLimit,
+		scannerFactory: func(cfg config.DiscoveryConfig) (discoveryScanner, error) {
+			return BuildScanner(cfg)
+		},
 	}
 }
 
@@ -97,8 +166,46 @@ func (s *Service) scanLoop() {
 	}
 }
 
+func (s *Service) appendHistory(entry historyEntry) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	if s.historyLimit <= 0 {
+		s.historyLimit = defaultHistoryLimit
+	}
+
+	s.history = append(s.history, entry)
+	if len(s.history) > s.historyLimit {
+		offset := len(s.history) - s.historyLimit
+		s.history = append([]historyEntry(nil), s.history[offset:]...)
+	}
+}
+
+// GetHistory returns up to limit recent discovery history entries (most recent first).
+func (s *Service) GetHistory(limit int) []historyEntry {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	if limit <= 0 || limit > len(s.history) {
+		limit = len(s.history)
+	}
+	if limit == 0 {
+		return nil
+	}
+
+	result := make([]historyEntry, 0, limit)
+	for i := len(s.history) - 1; i >= 0 && len(result) < limit; i-- {
+		result = append(result, s.history[i])
+	}
+	return result
+}
+
 // performScan executes a network scan
 func (s *Service) performScan() {
+	startTime := time.Now()
+	var scanErr error
+	var blocklistLength int
+
 	s.mu.Lock()
 	if s.isScanning {
 		s.mu.Unlock()
@@ -111,16 +218,54 @@ func (s *Service) performScan() {
 	var result *pkgdiscovery.DiscoveryResult
 
 	defer func() {
+		duration := time.Since(startTime)
+		completedAt := time.Now()
+		serverCount := 0
+		errorCount := 0
+		status := "success"
+		if result != nil {
+			serverCount = len(result.Servers)
+			if len(result.StructuredErrors) > 0 {
+				errorCount = len(result.StructuredErrors)
+			} else {
+				errorCount = len(result.Errors)
+			}
+		}
+
+		if scanErr != nil {
+			if result == nil || serverCount == 0 {
+				status = "failure"
+			} else {
+				status = "partial"
+			}
+		}
+
+		discoveryScanDuration.Observe(duration.Seconds())
+		discoveryScanServers.Set(float64(serverCount))
+		discoveryScanErrors.Set(float64(errorCount))
+		discoveryScanResults.WithLabelValues(status).Inc()
+
+		s.appendHistory(historyEntry{
+			startedAt:       startTime,
+			completedAt:     completedAt,
+			subnet:          s.subnet,
+			serverCount:     serverCount,
+			errorCount:      errorCount,
+			duration:        duration,
+			blocklistLength: blocklistLength,
+			status:          status,
+		})
+
 		s.mu.Lock()
 		s.isScanning = false
-		s.lastScan = time.Now()
+		s.lastScan = completedAt
 		s.mu.Unlock()
 
 		// Send scan complete notification
 		if s.wsHub != nil {
 			data := map[string]interface{}{
 				"scanning":  false,
-				"timestamp": time.Now().Unix(),
+				"timestamp": completedAt.Unix(),
 			}
 			if result != nil && result.Environment != nil {
 				data["environment"] = result.Environment
@@ -155,12 +300,25 @@ func (s *Service) performScan() {
 	if s.cfgProvider != nil {
 		cfg = config.NormalizeDiscoveryConfig(config.CloneDiscoveryConfig(s.cfgProvider()))
 	}
+	blocklistLength = len(cfg.SubnetBlocklist)
 
-	newScanner, err := BuildScanner(cfg)
+	var (
+		newScanner discoveryScanner
+		err        error
+	)
+	if s.scannerFactory != nil {
+		newScanner, err = s.scannerFactory(cfg)
+	} else {
+		newScanner, err = BuildScanner(cfg)
+	}
 	if err != nil {
 		log.Warn().Err(err).Msg("Environment detection failed during discovery; falling back to default scanner configuration")
 		newScanner = pkgdiscovery.NewScanner()
 	}
+	if newScanner == nil {
+		log.Warn().Msg("Discovery scanner factory returned nil; using default scanner configuration")
+		newScanner = pkgdiscovery.NewScanner()
+	}
 	s.mu.Lock()
 	s.scanner = newScanner
 	s.mu.Unlock()
@@ -199,6 +357,7 @@ func (s *Service) performScan() {
 	}
 
 	result, err = newScanner.DiscoverServersWithCallbacks(scanCtx, s.subnet, serverCallback, progressCallback)
+	scanErr = err
 	if err != nil {
 		// Even if scan timed out, we might have partial results
 		if result == nil || (len(result.Servers) == 0 && !errors.Is(err, context.DeadlineExceeded)) {
@@ -235,7 +394,7 @@ func (s *Service) performScan() {
 		if s.wsHub != nil {
 			data := map[string]interface{}{
 				"servers":           result.Servers,
-				"errors":            result.Errors,            // Legacy format (deprecated)
+				"errors":            result.Errors,           // Legacy format (deprecated)
 				"structured_errors": result.StructuredErrors, // New structured format
 				"scanning":          false,
 				"timestamp":         time.Now().Unix(),
@@ -256,11 +415,11 @@ func (s *Service) GetCachedResult() (*pkgdiscovery.DiscoveryResult, time.Time) {
 	s.cache.mu.RLock()
 	defer s.cache.mu.RUnlock()
 
- if s.cache.result == nil {
- 	return &pkgdiscovery.DiscoveryResult{
- 		Servers: []pkgdiscovery.DiscoveredServer{},
- 		Errors:  []string{},
- 	}, time.Time{}
+	if s.cache.result == nil {
+		return &pkgdiscovery.DiscoveryResult{
+			Servers: []pkgdiscovery.DiscoveredServer{},
+			Errors:  []string{},
+		}, time.Time{}
 	}
 
 	return s.cache.result, s.cache.updated
diff --git a/internal/discovery/service_test.go b/internal/discovery/service_test.go
new file mode 100644
index 0000000..4601fa6
--- /dev/null
+++ b/internal/discovery/service_test.go
@@ -0,0 +1,155 @@
+package discovery
+
+import (
+	"context"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus/testutil"
+
+	"github.com/rcourtman/pulse-go-rewrite/internal/config"
+	pkgdiscovery "github.com/rcourtman/pulse-go-rewrite/pkg/discovery"
+)
+
+type fakeScanner struct {
+	result *pkgdiscovery.DiscoveryResult
+	err    error
+}
+
+func (f *fakeScanner) DiscoverServersWithCallbacks(ctx context.Context, subnet string, serverCallback pkgdiscovery.ServerCallback, progressCallback pkgdiscovery.ProgressCallback) (*pkgdiscovery.DiscoveryResult, error) {
+	if serverCallback != nil && f.result != nil {
+		for _, server := range f.result.Servers {
+			serverCallback(server, "test-phase")
+		}
+	}
+	if progressCallback != nil {
+		progressCallback(pkgdiscovery.ScanProgress{
+			CurrentPhase: "test-phase",
+			PhaseNumber:  1,
+			TotalPhases:  1,
+		})
+	}
+
+	return f.result, f.err
+}
+
+func TestPerformScanRecordsHistoryAndMetrics(t *testing.T) {
+	t.Parallel()
+
+	service := NewService(nil, time.Minute, "192.168.1.0/24", func() config.DiscoveryConfig {
+		cfg := config.DefaultDiscoveryConfig()
+		cfg.SubnetBlocklist = []string{"10.0.0.0/24", "172.16.0.0/24"}
+		return cfg
+	})
+	service.ctx = context.Background()
+
+	scanner := &fakeScanner{
+		result: &pkgdiscovery.DiscoveryResult{
+			Servers: []pkgdiscovery.DiscoveredServer{
+				{IP: "192.168.1.10", Port: 8006, Type: "pve"},
+				{IP: "192.168.1.11", Port: 8007, Type: "pbs"},
+			},
+			StructuredErrors: []pkgdiscovery.DiscoveryError{
+				{Phase: "test-phase", ErrorType: "timeout"},
+			},
+		},
+	}
+
+	beforeSuccess := testutil.ToFloat64(discoveryScanResults.WithLabelValues("success"))
+	service.scannerFactory = func(config.DiscoveryConfig) (discoveryScanner, error) {
+		return scanner, nil
+	}
+
+	service.performScan()
+
+	afterSuccess := testutil.ToFloat64(discoveryScanResults.WithLabelValues("success"))
+	if afterSuccess != beforeSuccess+1 {
+		t.Fatalf("expected success counter to increment by 1; before=%f after=%f", beforeSuccess, afterSuccess)
+	}
+
+	if got := testutil.ToFloat64(discoveryScanServers); got != float64(len(scanner.result.Servers)) {
+		t.Fatalf("expected discoveryScanServers gauge to equal %d, got %f", len(scanner.result.Servers), got)
+	}
+
+	if got := testutil.ToFloat64(discoveryScanErrors); got != float64(len(scanner.result.StructuredErrors)) {
+		t.Fatalf("expected discoveryScanErrors gauge to equal %d, got %f", len(scanner.result.StructuredErrors), got)
+	}
+
+	history := service.GetHistory(5)
+	if len(history) != 1 {
+		t.Fatalf("expected 1 history entry, got %d", len(history))
+	}
+
+	entry := history[0]
+	if entry.status != "success" {
+		t.Fatalf("expected history status success, got %s", entry.status)
+	}
+	if entry.serverCount != len(scanner.result.Servers) {
+		t.Fatalf("expected serverCount %d, got %d", len(scanner.result.Servers), entry.serverCount)
+	}
+	if entry.errorCount != len(scanner.result.StructuredErrors) {
+		t.Fatalf("expected errorCount %d, got %d", len(scanner.result.StructuredErrors), entry.errorCount)
+	}
+	if entry.blocklistLength != 2 {
+		t.Fatalf("expected blocklist length 2, got %d", entry.blocklistLength)
+	}
+	if entry.duration <= 0 {
+		t.Fatalf("expected positive duration, got %v", entry.duration)
+	}
+	if entry.startedAt.IsZero() || entry.completedAt.IsZero() {
+		t.Fatalf("expected timestamps to be populated, got startedAt=%v completedAt=%v", entry.startedAt, entry.completedAt)
+	}
+}
+
+func TestPerformScanRecordsPartialFailure(t *testing.T) {
+	t.Parallel()
+
+	service := NewService(nil, time.Minute, "auto", func() config.DiscoveryConfig {
+		cfg := config.DefaultDiscoveryConfig()
+		return cfg
+	})
+	service.ctx = context.Background()
+
+	scanner := &fakeScanner{
+		result: &pkgdiscovery.DiscoveryResult{
+			Servers: []pkgdiscovery.DiscoveredServer{
+				{IP: "192.168.2.20", Port: 8006, Type: "pve"},
+			},
+			StructuredErrors: []pkgdiscovery.DiscoveryError{
+				{Phase: "phase-one", ErrorType: "timeout"},
+				{Phase: "phase-two", ErrorType: "connection_refused"},
+			},
+		},
+		err: errors.New("scan timeout"),
+	}
+
+	beforePartial := testutil.ToFloat64(discoveryScanResults.WithLabelValues("partial"))
+
+	service.scannerFactory = func(config.DiscoveryConfig) (discoveryScanner, error) {
+		return scanner, nil
+	}
+
+	service.performScan()
+
+	afterPartial := testutil.ToFloat64(discoveryScanResults.WithLabelValues("partial"))
+	if afterPartial != beforePartial+1 {
+		t.Fatalf("expected partial counter to increment by 1; before=%f after=%f", beforePartial, afterPartial)
+	}
+
+	history := service.GetHistory(5)
+	if len(history) == 0 {
+		t.Fatalf("expected history entry to be recorded")
+	}
+
+	entry := history[0]
+	if entry.status != "partial" {
+		t.Fatalf("expected status partial, got %s", entry.status)
+	}
+	if entry.serverCount != len(scanner.result.Servers) {
+		t.Fatalf("expected serverCount %d, got %d", len(scanner.result.Servers), entry.serverCount)
+	}
+	if entry.errorCount != len(scanner.result.StructuredErrors) {
+		t.Fatalf("expected errorCount %d, got %d", len(scanner.result.StructuredErrors), entry.errorCount)
+	}
+}
diff --git a/internal/dockeragent/agent.go b/internal/dockeragent/agent.go
index 73f1fbc..df8cb38 100644
--- a/internal/dockeragent/agent.go
+++ b/internal/dockeragent/agent.go
@@ -3,12 +3,16 @@ package dockeragent
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
+	"crypto/sha256"
 	"crypto/tls"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
 	"io"
 	"math"
+	"math/big"
 	"net/http"
 	"os"
 	"os/exec"
@@ -267,12 +271,22 @@ func (a *Agent) Run(ctx context.Context) error {
 	ticker := time.NewTicker(interval)
 	defer ticker.Stop()
 
-	// Check for updates on startup
-	go a.checkForUpdates(ctx)
+	const (
+		updateInterval        = 24 * time.Hour
+		startupJitterWindow   = 2 * time.Minute
+		recurringJitterWindow = 5 * time.Minute
+	)
 
-	// Check for updates daily
-	updateTicker := time.NewTicker(24 * time.Hour)
-	defer updateTicker.Stop()
+	initialDelay := 5*time.Second + randomDuration(startupJitterWindow)
+	updateTimer := time.NewTimer(initialDelay)
+	defer func() {
+		if !updateTimer.Stop() {
+			select {
+			case <-updateTimer.C:
+			default:
+			}
+		}
+	}()
 
 	if err := a.collectOnce(ctx); err != nil {
 		if errors.Is(err, ErrStopRequested) {
@@ -284,6 +298,12 @@ func (a *Agent) Run(ctx context.Context) error {
 	for {
 		select {
 		case <-ctx.Done():
+			if !updateTimer.Stop() {
+				select {
+				case <-updateTimer.C:
+				default:
+				}
+			}
 			return ctx.Err()
 		case <-ticker.C:
 			if err := a.collectOnce(ctx); err != nil {
@@ -292,8 +312,13 @@ func (a *Agent) Run(ctx context.Context) error {
 				}
 				a.logger.Error().Err(err).Msg("Failed to send docker report")
 			}
-		case <-updateTicker.C:
+		case <-updateTimer.C:
 			go a.checkForUpdates(ctx)
+			nextDelay := updateInterval + randomDuration(recurringJitterWindow)
+			if nextDelay <= 0 {
+				nextDelay = updateInterval
+			}
+			updateTimer.Reset(nextDelay)
 		}
 	}
 }
@@ -644,7 +669,20 @@ func (a *Agent) sendReportToTarget(ctx context.Context, target TargetConfig, pay
 	defer resp.Body.Close()
 
 	if resp.StatusCode >= 300 {
-		return fmt.Errorf("target %s: pulse responded with status %s", target.URL, resp.Status)
+		bodyBytes, _ := io.ReadAll(resp.Body)
+		if hostRemoved := detectHostRemovedError(bodyBytes); hostRemoved != "" {
+			a.logger.Warn().
+				Str("hostID", a.hostID).
+				Str("pulseURL", target.URL).
+				Str("detail", hostRemoved).
+				Msg("Pulse rejected docker report because this host was previously removed. Allow the host to re-enroll from the Pulse UI or rerun the installer with a docker:manage token.")
+			return ErrStopRequested
+		}
+		errMsg := strings.TrimSpace(string(bodyBytes))
+		if errMsg == "" {
+			errMsg = resp.Status
+		}
+		return fmt.Errorf("target %s: pulse responded %s: %s", target.URL, resp.Status, errMsg)
 	}
 
 	body, err := io.ReadAll(resp.Body)
@@ -745,10 +783,14 @@ func disableSystemdService(ctx context.Context, service string) error {
 	if err != nil {
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			exitCode := exitErr.ExitCode()
-			lowerOutput := strings.ToLower(string(output))
+			trimmedOutput := strings.TrimSpace(string(output))
+			lowerOutput := strings.ToLower(trimmedOutput)
 			if exitCode == 5 || strings.Contains(lowerOutput, "could not be found") || strings.Contains(lowerOutput, "not-found") {
 				return nil
 			}
+			if strings.Contains(lowerOutput, "access denied") || strings.Contains(lowerOutput, "permission denied") {
+				return fmt.Errorf("systemctl disable %s: access denied. Run 'sudo systemctl disable --now %s' or rerun the installer with sudo so it can install the polkit rule (systemctl output: %s)", service, service, trimmedOutput)
+			}
 		}
 		return fmt.Errorf("systemctl disable %s: %w (%s)", service, err, strings.TrimSpace(string(output)))
 	}
@@ -770,11 +812,15 @@ func stopSystemdService(ctx context.Context, service string) error {
 	if err != nil {
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			exitCode := exitErr.ExitCode()
-			lowerOutput := strings.ToLower(string(output))
+			trimmedOutput := strings.TrimSpace(string(output))
+			lowerOutput := strings.ToLower(trimmedOutput)
 			// Ignore "not found" errors since the service might already be stopped
 			if exitCode == 5 || strings.Contains(lowerOutput, "could not be found") || strings.Contains(lowerOutput, "not-found") {
 				return nil
 			}
+			if strings.Contains(lowerOutput, "access denied") || strings.Contains(lowerOutput, "permission denied") {
+				return fmt.Errorf("systemctl stop %s: access denied. Run 'sudo systemctl stop %s' or rerun the installer with sudo so it can install the polkit rule (systemctl output: %s)", service, service, trimmedOutput)
+			}
 		}
 		return fmt.Errorf("systemctl stop %s: %w (%s)", service, err, strings.TrimSpace(string(output)))
 	}
@@ -982,6 +1028,40 @@ func readSystemUptime() int64 {
 	return int64(seconds)
 }
 
+func randomDuration(max time.Duration) time.Duration {
+	if max <= 0 {
+		return 0
+	}
+
+	n, err := rand.Int(rand.Reader, big.NewInt(int64(max)))
+	if err != nil {
+		return 0
+	}
+
+	return time.Duration(n.Int64())
+}
+
+func detectHostRemovedError(body []byte) string {
+	if len(body) == 0 {
+		return ""
+	}
+
+	var payload struct {
+		Error string `json:"error"`
+		Code  string `json:"code"`
+	}
+	if err := json.Unmarshal(body, &payload); err != nil {
+		return ""
+	}
+	if strings.ToLower(payload.Code) != "invalid_report" {
+		return ""
+	}
+	if !strings.Contains(strings.ToLower(payload.Error), "was removed") {
+		return ""
+	}
+	return payload.Error
+}
+
 // checkForUpdates checks if a newer version is available and performs self-update if needed
 func (a *Agent) checkForUpdates(ctx context.Context) {
 	// Skip updates if disabled via config
@@ -1170,6 +1250,8 @@ func (a *Agent) selfUpdate(ctx context.Context) error {
 	}
 	defer resp.Body.Close()
 
+	checksumHeader := strings.TrimSpace(resp.Header.Get("X-Checksum-Sha256"))
+
 	// Create temporary file
 	tmpFile, err := os.CreateTemp("", "pulse-docker-agent-*.tmp")
 	if err != nil {
@@ -1179,11 +1261,26 @@ func (a *Agent) selfUpdate(ctx context.Context) error {
 	defer os.Remove(tmpPath) // Clean up if something goes wrong
 
 	// Write downloaded binary to temp file
-	if _, err := tmpFile.ReadFrom(resp.Body); err != nil {
+	hasher := sha256.New()
+	if _, err := io.Copy(tmpFile, io.TeeReader(resp.Body, hasher)); err != nil {
 		tmpFile.Close()
 		return fmt.Errorf("failed to write downloaded binary: %w", err)
 	}
-	tmpFile.Close()
+	if err := tmpFile.Close(); err != nil {
+		return fmt.Errorf("failed to close temp file: %w", err)
+	}
+
+	downloadChecksum := hex.EncodeToString(hasher.Sum(nil))
+	if checksumHeader != "" {
+		expected := strings.ToLower(strings.TrimSpace(checksumHeader))
+		actual := strings.ToLower(downloadChecksum)
+		if expected != actual {
+			return fmt.Errorf("checksum verification failed: expected %s, got %s", expected, actual)
+		}
+		a.logger.Debug().Str("checksum", downloadChecksum).Msg("Self-update: checksum verified")
+	} else {
+		a.logger.Warn().Msg("Self-update: checksum header missing; skipping verification")
+	}
 
 	// Make temp file executable
 	if err := os.Chmod(tmpPath, 0755); err != nil {
diff --git a/internal/dockeragent/agent_integration_test.go b/internal/dockeragent/agent_integration_test.go
new file mode 100644
index 0000000..947e684
--- /dev/null
+++ b/internal/dockeragent/agent_integration_test.go
@@ -0,0 +1,162 @@
+package dockeragent
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+
+	agentsdocker "github.com/rcourtman/pulse-go-rewrite/pkg/agents/docker"
+	"github.com/rs/zerolog"
+)
+
+func TestSendReportIntegration(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu          sync.Mutex
+		requests    []agentsdocker.Report
+		tokenValues []string
+		userAgents  []string
+	)
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.Method != http.MethodPost {
+			t.Fatalf("unexpected method %s", r.Method)
+		}
+		if r.URL.Path != "/api/agents/docker/report" {
+			t.Fatalf("unexpected path %s", r.URL.Path)
+		}
+
+		body, err := io.ReadAll(r.Body)
+		if err != nil {
+			t.Fatalf("failed to read request body: %v", err)
+		}
+		_ = r.Body.Close()
+
+		var report agentsdocker.Report
+		if err := json.Unmarshal(body, &report); err != nil {
+			t.Fatalf("failed to unmarshal report: %v", err)
+		}
+
+		mu.Lock()
+		requests = append(requests, report)
+		tokenValues = append(tokenValues, r.Header.Get("X-API-Token"))
+		userAgents = append(userAgents, r.Header.Get("User-Agent"))
+		mu.Unlock()
+
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"commands":[]}`))
+	}))
+	defer server.Close()
+
+	client := server.Client()
+
+	agent := &Agent{
+		cfg: Config{
+			Targets: []TargetConfig{{
+				URL:   server.URL,
+				Token: "secret-token",
+			}},
+		},
+		httpClients: map[bool]*http.Client{
+			false: client,
+		},
+		logger: zerolog.New(io.Discard),
+		targets: []TargetConfig{{
+			URL:   server.URL,
+			Token: "secret-token",
+		}},
+	}
+
+	report := agentsdocker.Report{
+		Agent: agentsdocker.AgentInfo{
+			IntervalSeconds: 30,
+		},
+		Host: agentsdocker.HostInfo{
+			Hostname: "stub-host",
+		},
+		Containers: []agentsdocker.Container{
+			{ID: "container-1"},
+		},
+	}
+
+	if err := agent.sendReport(context.Background(), report); err != nil {
+		t.Fatalf("sendReport returned error: %v", err)
+	}
+
+	mu.Lock()
+	defer mu.Unlock()
+
+	if got := len(requests); got != 1 {
+		t.Fatalf("expected 1 request, got %d", got)
+	}
+
+	if tokenValues[0] != "secret-token" {
+		t.Fatalf("expected token %q, got %q", "secret-token", tokenValues[0])
+	}
+
+	if requests[0].Host.Hostname != "stub-host" {
+		t.Fatalf("expected hostname stub-host, got %s", requests[0].Host.Hostname)
+	}
+
+	if len(requests[0].Containers) != 1 {
+		t.Fatalf("expected 1 container reported, got %d", len(requests[0].Containers))
+	}
+
+	if userAgents[0] == "" {
+		t.Fatalf("missing user-agent header")
+	}
+	if !strings.HasPrefix(userAgents[0], "pulse-docker-agent/") {
+		t.Fatalf("unexpected user-agent header: %s", userAgents[0])
+	}
+}
+
+func TestSendReportHostRemoved(t *testing.T) {
+	t.Parallel()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusBadRequest)
+		_, _ = w.Write([]byte(`{"error":"docker host \"5316f5e1\" was removed at 2025-11-02T13:45:15Z and cannot report again","code":"invalid_report"}`))
+	}))
+	defer server.Close()
+
+	agent := &Agent{
+		cfg: Config{
+			Targets: []TargetConfig{{
+				URL:   server.URL,
+				Token: "secret-token",
+			}},
+		},
+		httpClients: map[bool]*http.Client{
+			false: server.Client(),
+		},
+		logger: zerolog.New(io.Discard),
+		targets: []TargetConfig{{
+			URL:   server.URL,
+			Token: "secret-token",
+		}},
+		hostID: "5316f5e1",
+	}
+
+	report := agentsdocker.Report{
+		Agent: agentsdocker.AgentInfo{
+			IntervalSeconds: 30,
+		},
+		Host: agentsdocker.HostInfo{
+			Hostname: "homeassistant",
+		},
+	}
+
+	err := agent.sendReport(context.Background(), report)
+	if !errors.Is(err, ErrStopRequested) {
+		t.Fatalf("expected ErrStopRequested, got %v", err)
+	}
+}
diff --git a/internal/models/converters.go b/internal/models/converters.go
index b6b9e73..fcb3418 100644
--- a/internal/models/converters.go
+++ b/internal/models/converters.go
@@ -280,6 +280,16 @@ func (d DockerHost) ToFrontend() DockerHostFrontend {
 	return h
 }
 
+// ToFrontend converts a RemovedDockerHost to its frontend representation.
+func (r RemovedDockerHost) ToFrontend() RemovedDockerHostFrontend {
+	return RemovedDockerHostFrontend{
+		ID:          r.ID,
+		Hostname:    r.Hostname,
+		DisplayName: r.DisplayName,
+		RemovedAt:   r.RemovedAt.Unix() * 1000,
+	}
+}
+
 // ToFrontend converts a Host to HostFrontend.
 func (h Host) ToFrontend() HostFrontend {
 	host := HostFrontend{
@@ -401,8 +411,10 @@ func (c DockerContainer) ToFrontend() DockerContainerFrontend {
 
 	if c.BlockIO != nil {
 		container.BlockIO = &DockerContainerBlockIOFrontend{
-			ReadBytes:  c.BlockIO.ReadBytes,
-			WriteBytes: c.BlockIO.WriteBytes,
+			ReadBytes:               c.BlockIO.ReadBytes,
+			WriteBytes:              c.BlockIO.WriteBytes,
+			ReadRateBytesPerSecond:  c.BlockIO.ReadRateBytesPerSecond,
+			WriteRateBytesPerSecond: c.BlockIO.WriteRateBytesPerSecond,
 		}
 	}
 
diff --git a/internal/models/models.go b/internal/models/models.go
index 703f8e2..7f3c365 100644
--- a/internal/models/models.go
+++ b/internal/models/models.go
@@ -9,29 +9,30 @@ import (
 
 // State represents the current state of all monitored resources
 type State struct {
-	mu               sync.RWMutex
-	Nodes            []Node           `json:"nodes"`
-	VMs              []VM             `json:"vms"`
-	Containers       []Container      `json:"containers"`
-	DockerHosts      []DockerHost     `json:"dockerHosts"`
-	Hosts            []Host           `json:"hosts"`
-	Storage          []Storage        `json:"storage"`
-	CephClusters     []CephCluster    `json:"cephClusters"`
-	PhysicalDisks    []PhysicalDisk   `json:"physicalDisks"`
-	PBSInstances     []PBSInstance    `json:"pbs"`
-	PMGInstances     []PMGInstance    `json:"pmg"`
-	PBSBackups       []PBSBackup      `json:"pbsBackups"`
-	PMGBackups       []PMGBackup      `json:"pmgBackups"`
-	Backups          Backups          `json:"backups"`
-	ReplicationJobs  []ReplicationJob `json:"replicationJobs"`
-	Metrics          []Metric         `json:"metrics"`
-	PVEBackups       PVEBackups       `json:"pveBackups"`
-	Performance      Performance      `json:"performance"`
-	ConnectionHealth map[string]bool  `json:"connectionHealth"`
-	Stats            Stats            `json:"stats"`
-	ActiveAlerts     []Alert          `json:"activeAlerts"`
-	RecentlyResolved []ResolvedAlert  `json:"recentlyResolved"`
-	LastUpdate       time.Time        `json:"lastUpdate"`
+	mu                 sync.RWMutex
+	Nodes              []Node              `json:"nodes"`
+	VMs                []VM                `json:"vms"`
+	Containers         []Container         `json:"containers"`
+	DockerHosts        []DockerHost        `json:"dockerHosts"`
+	RemovedDockerHosts []RemovedDockerHost `json:"removedDockerHosts"`
+	Hosts              []Host              `json:"hosts"`
+	Storage            []Storage           `json:"storage"`
+	CephClusters       []CephCluster       `json:"cephClusters"`
+	PhysicalDisks      []PhysicalDisk      `json:"physicalDisks"`
+	PBSInstances       []PBSInstance       `json:"pbs"`
+	PMGInstances       []PMGInstance       `json:"pmg"`
+	PBSBackups         []PBSBackup         `json:"pbsBackups"`
+	PMGBackups         []PMGBackup         `json:"pmgBackups"`
+	Backups            Backups             `json:"backups"`
+	ReplicationJobs    []ReplicationJob    `json:"replicationJobs"`
+	Metrics            []Metric            `json:"metrics"`
+	PVEBackups         PVEBackups          `json:"pveBackups"`
+	Performance        Performance         `json:"performance"`
+	ConnectionHealth   map[string]bool     `json:"connectionHealth"`
+	Stats              Stats               `json:"stats"`
+	ActiveAlerts       []Alert             `json:"activeAlerts"`
+	RecentlyResolved   []ResolvedAlert     `json:"recentlyResolved"`
+	LastUpdate         time.Time           `json:"lastUpdate"`
 }
 
 // Alert represents an active alert (simplified for State)
@@ -224,6 +225,14 @@ type DockerHost struct {
 	Command           *DockerHostCommandStatus `json:"command,omitempty"`
 }
 
+// RemovedDockerHost tracks a docker host that was deliberately removed and blocked from reporting.
+type RemovedDockerHost struct {
+	ID          string    `json:"id"`
+	Hostname    string    `json:"hostname,omitempty"`
+	DisplayName string    `json:"displayName,omitempty"`
+	RemovedAt   time.Time `json:"removedAt"`
+}
+
 // DockerContainer represents the state of a Docker container on a monitored host.
 type DockerContainer struct {
 	ID                  string                       `json:"id"`
@@ -268,8 +277,10 @@ type DockerContainerNetworkLink struct {
 
 // DockerContainerBlockIO captures aggregate block IO usage for a container.
 type DockerContainerBlockIO struct {
-	ReadBytes  uint64 `json:"readBytes,omitempty"`
-	WriteBytes uint64 `json:"writeBytes,omitempty"`
+	ReadBytes               uint64   `json:"readBytes,omitempty"`
+	WriteBytes              uint64   `json:"writeBytes,omitempty"`
+	ReadRateBytesPerSecond  *float64 `json:"readRateBytesPerSecond,omitempty"`
+	WriteRateBytesPerSecond *float64 `json:"writeRateBytesPerSecond,omitempty"`
 }
 
 // DockerContainerMount describes a mount exposed to a container.
@@ -1231,6 +1242,52 @@ func (s *State) GetDockerHosts() []DockerHost {
 	return hosts
 }
 
+// AddRemovedDockerHost records a removed docker host entry.
+func (s *State) AddRemovedDockerHost(entry RemovedDockerHost) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	replaced := false
+	for i, existing := range s.RemovedDockerHosts {
+		if existing.ID == entry.ID {
+			s.RemovedDockerHosts[i] = entry
+			replaced = true
+			break
+		}
+	}
+	if !replaced {
+		s.RemovedDockerHosts = append(s.RemovedDockerHosts, entry)
+	}
+	sort.Slice(s.RemovedDockerHosts, func(i, j int) bool {
+		return s.RemovedDockerHosts[i].RemovedAt.After(s.RemovedDockerHosts[j].RemovedAt)
+	})
+	s.LastUpdate = time.Now()
+}
+
+// RemoveRemovedDockerHost deletes a removed docker host entry by ID.
+func (s *State) RemoveRemovedDockerHost(hostID string) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+
+	for i, entry := range s.RemovedDockerHosts {
+		if entry.ID == hostID {
+			s.RemovedDockerHosts = append(s.RemovedDockerHosts[:i], s.RemovedDockerHosts[i+1:]...)
+			s.LastUpdate = time.Now()
+			break
+		}
+	}
+}
+
+// GetRemovedDockerHosts returns a copy of removed docker host entries.
+func (s *State) GetRemovedDockerHosts() []RemovedDockerHost {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
+
+	entries := make([]RemovedDockerHost, len(s.RemovedDockerHosts))
+	copy(entries, s.RemovedDockerHosts)
+	return entries
+}
+
 // UpsertHost inserts or updates a generic host in state.
 func (s *State) UpsertHost(host Host) {
 	s.mu.Lock()
diff --git a/internal/models/models_frontend.go b/internal/models/models_frontend.go
index 45a5cea..0e21db4 100644
--- a/internal/models/models_frontend.go
+++ b/internal/models/models_frontend.go
@@ -130,6 +130,14 @@ type DockerHostFrontend struct {
 	Command           *DockerHostCommandFrontend `json:"command,omitempty"`
 }
 
+// RemovedDockerHostFrontend represents a blocked docker host entry for the frontend.
+type RemovedDockerHostFrontend struct {
+	ID          string `json:"id"`
+	Hostname    string `json:"hostname,omitempty"`
+	DisplayName string `json:"displayName,omitempty"`
+	RemovedAt   int64  `json:"removedAt"`
+}
+
 // DockerContainerFrontend represents a Docker container for the frontend
 type DockerContainerFrontend struct {
 	ID                  string                           `json:"id"`
@@ -174,8 +182,10 @@ type DockerContainerNetworkFrontend struct {
 
 // DockerContainerBlockIOFrontend exposes aggregate block IO counters.
 type DockerContainerBlockIOFrontend struct {
-	ReadBytes  uint64 `json:"readBytes,omitempty"`
-	WriteBytes uint64 `json:"writeBytes,omitempty"`
+	ReadBytes               uint64   `json:"readBytes,omitempty"`
+	WriteBytes              uint64   `json:"writeBytes,omitempty"`
+	ReadRateBytesPerSecond  *float64 `json:"readRateBytesPerSecond,omitempty"`
+	WriteRateBytesPerSecond *float64 `json:"writeRateBytesPerSecond,omitempty"`
 }
 
 // DockerContainerMountFrontend represents a container mount for the UI.
@@ -392,25 +402,26 @@ type ReplicationJobFrontend struct {
 
 // StateFrontend represents the state with frontend-friendly field names
 type StateFrontend struct {
-	Nodes            []NodeFrontend           `json:"nodes"`
-	VMs              []VMFrontend             `json:"vms"`
-	Containers       []ContainerFrontend      `json:"containers"`
-	DockerHosts      []DockerHostFrontend     `json:"dockerHosts"`
-	Hosts            []HostFrontend           `json:"hosts"`
-	Storage          []StorageFrontend        `json:"storage"`
-	CephClusters     []CephClusterFrontend    `json:"cephClusters"`
-	PhysicalDisks    []PhysicalDisk           `json:"physicalDisks"`
-	PBS              []PBSInstance            `json:"pbs"` // Keep as is
-	PMG              []PMGInstance            `json:"pmg"`
-	PBSBackups       []PBSBackup              `json:"pbsBackups"`
-	PMGBackups       []PMGBackup              `json:"pmgBackups"`
-	Backups          Backups                  `json:"backups"`
-	ReplicationJobs  []ReplicationJobFrontend `json:"replicationJobs"`
-	ActiveAlerts     []Alert                  `json:"activeAlerts"`     // Active alerts
-	Metrics          map[string]any           `json:"metrics"`          // Empty object for now
-	PVEBackups       PVEBackups               `json:"pveBackups"`       // Keep as is
-	Performance      map[string]any           `json:"performance"`      // Empty object for now
-	ConnectionHealth map[string]bool          `json:"connectionHealth"` // Keep as is
-	Stats            map[string]any           `json:"stats"`            // Empty object for now
-	LastUpdate       int64                    `json:"lastUpdate"`       // Unix timestamp
+	Nodes              []NodeFrontend              `json:"nodes"`
+	VMs                []VMFrontend                `json:"vms"`
+	Containers         []ContainerFrontend         `json:"containers"`
+	DockerHosts        []DockerHostFrontend        `json:"dockerHosts"`
+	RemovedDockerHosts []RemovedDockerHostFrontend `json:"removedDockerHosts"`
+	Hosts              []HostFrontend              `json:"hosts"`
+	Storage            []StorageFrontend           `json:"storage"`
+	CephClusters       []CephClusterFrontend       `json:"cephClusters"`
+	PhysicalDisks      []PhysicalDisk              `json:"physicalDisks"`
+	PBS                []PBSInstance               `json:"pbs"` // Keep as is
+	PMG                []PMGInstance               `json:"pmg"`
+	PBSBackups         []PBSBackup                 `json:"pbsBackups"`
+	PMGBackups         []PMGBackup                 `json:"pmgBackups"`
+	Backups            Backups                     `json:"backups"`
+	ReplicationJobs    []ReplicationJobFrontend    `json:"replicationJobs"`
+	ActiveAlerts       []Alert                     `json:"activeAlerts"`     // Active alerts
+	Metrics            map[string]any              `json:"metrics"`          // Empty object for now
+	PVEBackups         PVEBackups                  `json:"pveBackups"`       // Keep as is
+	Performance        map[string]any              `json:"performance"`      // Empty object for now
+	ConnectionHealth   map[string]bool             `json:"connectionHealth"` // Keep as is
+	Stats              map[string]any              `json:"stats"`            // Empty object for now
+	LastUpdate         int64                       `json:"lastUpdate"`       // Unix timestamp
 }
diff --git a/internal/models/state_snapshot.go b/internal/models/state_snapshot.go
index 954750b..215c0a3 100644
--- a/internal/models/state_snapshot.go
+++ b/internal/models/state_snapshot.go
@@ -4,28 +4,29 @@ import "time"
 
 // StateSnapshot represents a snapshot of the state without mutex
 type StateSnapshot struct {
-	Nodes            []Node           `json:"nodes"`
-	VMs              []VM             `json:"vms"`
-	Containers       []Container      `json:"containers"`
-	DockerHosts      []DockerHost     `json:"dockerHosts"`
-	Hosts            []Host           `json:"hosts"`
-	Storage          []Storage        `json:"storage"`
-	CephClusters     []CephCluster    `json:"cephClusters"`
-	PhysicalDisks    []PhysicalDisk   `json:"physicalDisks"`
-	PBSInstances     []PBSInstance    `json:"pbs"`
-	PMGInstances     []PMGInstance    `json:"pmg"`
-	PBSBackups       []PBSBackup      `json:"pbsBackups"`
-	PMGBackups       []PMGBackup      `json:"pmgBackups"`
-	Backups          Backups          `json:"backups"`
-	ReplicationJobs  []ReplicationJob `json:"replicationJobs"`
-	Metrics          []Metric         `json:"metrics"`
-	PVEBackups       PVEBackups       `json:"pveBackups"`
-	Performance      Performance      `json:"performance"`
-	ConnectionHealth map[string]bool  `json:"connectionHealth"`
-	Stats            Stats            `json:"stats"`
-	ActiveAlerts     []Alert          `json:"activeAlerts"`
-	RecentlyResolved []ResolvedAlert  `json:"recentlyResolved"`
-	LastUpdate       time.Time        `json:"lastUpdate"`
+	Nodes              []Node              `json:"nodes"`
+	VMs                []VM                `json:"vms"`
+	Containers         []Container         `json:"containers"`
+	DockerHosts        []DockerHost        `json:"dockerHosts"`
+	RemovedDockerHosts []RemovedDockerHost `json:"removedDockerHosts"`
+	Hosts              []Host              `json:"hosts"`
+	Storage            []Storage           `json:"storage"`
+	CephClusters       []CephCluster       `json:"cephClusters"`
+	PhysicalDisks      []PhysicalDisk      `json:"physicalDisks"`
+	PBSInstances       []PBSInstance       `json:"pbs"`
+	PMGInstances       []PMGInstance       `json:"pmg"`
+	PBSBackups         []PBSBackup         `json:"pbsBackups"`
+	PMGBackups         []PMGBackup         `json:"pmgBackups"`
+	Backups            Backups             `json:"backups"`
+	ReplicationJobs    []ReplicationJob    `json:"replicationJobs"`
+	Metrics            []Metric            `json:"metrics"`
+	PVEBackups         PVEBackups          `json:"pveBackups"`
+	Performance        Performance         `json:"performance"`
+	ConnectionHealth   map[string]bool     `json:"connectionHealth"`
+	Stats              Stats               `json:"stats"`
+	ActiveAlerts       []Alert             `json:"activeAlerts"`
+	RecentlyResolved   []ResolvedAlert     `json:"recentlyResolved"`
+	LastUpdate         time.Time           `json:"lastUpdate"`
 }
 
 // GetSnapshot returns a snapshot of the current state without mutex
@@ -43,18 +44,19 @@ func (s *State) GetSnapshot() StateSnapshot {
 
 	// Create a snapshot without mutex
 	snapshot := StateSnapshot{
-		Nodes:         append([]Node{}, s.Nodes...),
-		VMs:           append([]VM{}, s.VMs...),
-		Containers:    append([]Container{}, s.Containers...),
-		DockerHosts:   append([]DockerHost{}, s.DockerHosts...),
-		Hosts:         append([]Host{}, s.Hosts...),
-		Storage:       append([]Storage{}, s.Storage...),
-		CephClusters:  append([]CephCluster{}, s.CephClusters...),
-		PhysicalDisks: append([]PhysicalDisk{}, s.PhysicalDisks...),
-		PBSInstances:  append([]PBSInstance{}, s.PBSInstances...),
-		PMGInstances:  append([]PMGInstance{}, s.PMGInstances...),
-		PBSBackups:    pbsBackups,
-		PMGBackups:    pmgBackups,
+		Nodes:              append([]Node{}, s.Nodes...),
+		VMs:                append([]VM{}, s.VMs...),
+		Containers:         append([]Container{}, s.Containers...),
+		DockerHosts:        append([]DockerHost{}, s.DockerHosts...),
+		RemovedDockerHosts: append([]RemovedDockerHost{}, s.RemovedDockerHosts...),
+		Hosts:              append([]Host{}, s.Hosts...),
+		Storage:            append([]Storage{}, s.Storage...),
+		CephClusters:       append([]CephCluster{}, s.CephClusters...),
+		PhysicalDisks:      append([]PhysicalDisk{}, s.PhysicalDisks...),
+		PBSInstances:       append([]PBSInstance{}, s.PBSInstances...),
+		PMGInstances:       append([]PMGInstance{}, s.PMGInstances...),
+		PBSBackups:         pbsBackups,
+		PMGBackups:         pmgBackups,
 		Backups: Backups{
 			PVE: pveBackups,
 			PBS: pbsBackups,
@@ -104,6 +106,11 @@ func (s StateSnapshot) ToFrontend() StateFrontend {
 		dockerHosts[i] = host.ToFrontend()
 	}
 
+	removedDockerHosts := make([]RemovedDockerHostFrontend, len(s.RemovedDockerHosts))
+	for i, entry := range s.RemovedDockerHosts {
+		removedDockerHosts[i] = entry.ToFrontend()
+	}
+
 	hosts := make([]HostFrontend, len(s.Hosts))
 	for i, host := range s.Hosts {
 		hosts[i] = host.ToFrontend()
@@ -127,26 +134,27 @@ func (s StateSnapshot) ToFrontend() StateFrontend {
 	}
 
 	return StateFrontend{
-		Nodes:            nodes,
-		VMs:              vms,
-		Containers:       containers,
-		DockerHosts:      dockerHosts,
-		Hosts:            hosts,
-		Storage:          storage,
-		CephClusters:     cephClusters,
-		PhysicalDisks:    s.PhysicalDisks,
-		PBS:              s.PBSInstances,
-		PMG:              s.PMGInstances,
-		PBSBackups:       s.PBSBackups,
-		PMGBackups:       s.PMGBackups,
-		Backups:          s.Backups,
-		ReplicationJobs:  replicationJobs,
-		ActiveAlerts:     s.ActiveAlerts,
-		Metrics:          make(map[string]any),
-		PVEBackups:       s.PVEBackups,
-		Performance:      make(map[string]any),
-		ConnectionHealth: s.ConnectionHealth,
-		Stats:            make(map[string]any),
-		LastUpdate:       s.LastUpdate.Unix() * 1000, // JavaScript timestamp
+		Nodes:              nodes,
+		VMs:                vms,
+		Containers:         containers,
+		DockerHosts:        dockerHosts,
+		RemovedDockerHosts: removedDockerHosts,
+		Hosts:              hosts,
+		Storage:            storage,
+		CephClusters:       cephClusters,
+		PhysicalDisks:      s.PhysicalDisks,
+		PBS:                s.PBSInstances,
+		PMG:                s.PMGInstances,
+		PBSBackups:         s.PBSBackups,
+		PMGBackups:         s.PMGBackups,
+		Backups:            s.Backups,
+		ReplicationJobs:    replicationJobs,
+		ActiveAlerts:       s.ActiveAlerts,
+		Metrics:            make(map[string]any),
+		PVEBackups:         s.PVEBackups,
+		Performance:        make(map[string]any),
+		ConnectionHealth:   s.ConnectionHealth,
+		Stats:              make(map[string]any),
+		LastUpdate:         s.LastUpdate.Unix() * 1000, // JavaScript timestamp
 	}
 }
diff --git a/internal/monitoring/docker_commands_test.go b/internal/monitoring/docker_commands_test.go
index 4f57dc0..60a26fe 100644
--- a/internal/monitoring/docker_commands_test.go
+++ b/internal/monitoring/docker_commands_test.go
@@ -205,3 +205,30 @@ func TestCleanupRemovedDockerHosts(t *testing.T) {
 		t.Fatalf("expected fresh host removal entry to remain")
 	}
 }
+
+func TestAllowDockerHostReenrollNoopWhenHostNotBlocked(t *testing.T) {
+	t.Parallel()
+
+	monitor := newTestMonitorForCommands(t)
+
+	host := models.DockerHost{
+		ID:          "host-not-blocked",
+		Hostname:    "not-blocked",
+		DisplayName: "Not Blocked",
+		Status:      "online",
+	}
+	monitor.state.UpsertDockerHost(host)
+
+	if err := monitor.AllowDockerHostReenroll(host.ID); err != nil {
+		t.Fatalf("allow reenroll for non-blocked host returned error: %v", err)
+	}
+
+	if _, exists := monitor.removedDockerHosts[host.ID]; exists {
+		t.Fatalf("non-blocked host should not be added to removal map")
+	}
+
+	stateHost := findDockerHost(t, monitor, host.ID)
+	if stateHost.ID != host.ID {
+		t.Fatalf("expected host to remain in state; got %+v", stateHost)
+	}
+}
diff --git a/internal/monitoring/monitor.go b/internal/monitoring/monitor.go
index bb8c582..a8b811f 100644
--- a/internal/monitoring/monitor.go
+++ b/internal/monitoring/monitor.go
@@ -29,6 +29,7 @@ import (
 	"github.com/rcourtman/pulse-go-rewrite/internal/mock"
 	"github.com/rcourtman/pulse-go-rewrite/internal/models"
 	"github.com/rcourtman/pulse-go-rewrite/internal/notifications"
+	"github.com/rcourtman/pulse-go-rewrite/internal/types"
 	"github.com/rcourtman/pulse-go-rewrite/internal/websocket"
 	agentsdocker "github.com/rcourtman/pulse-go-rewrite/pkg/agents/docker"
 	agentshost "github.com/rcourtman/pulse-go-rewrite/pkg/agents/host"
@@ -519,6 +520,13 @@ func safeFloat(val float64) float64 {
 	return val
 }
 
+func clampUint64ToInt64(val uint64) int64 {
+	if val > math.MaxInt64 {
+		return math.MaxInt64
+	}
+	return int64(val)
+}
+
 func cloneStringFloatMap(src map[string]float64) map[string]float64 {
 	if len(src) == 0 {
 		return nil
@@ -852,14 +860,23 @@ func (m *Monitor) RemoveDockerHost(hostID string) (models.DockerHost, error) {
 	}
 
 	// Track removal to prevent resurrection from cached reports
+	removedAt := time.Now()
+
 	m.mu.Lock()
-	m.removedDockerHosts[hostID] = time.Now()
+	m.removedDockerHosts[hostID] = removedAt
 	if cmd, ok := m.dockerCommands[hostID]; ok {
 		delete(m.dockerCommandIndex, cmd.status.ID)
 	}
 	delete(m.dockerCommands, hostID)
 	m.mu.Unlock()
 
+	m.state.AddRemovedDockerHost(models.RemovedDockerHost{
+		ID:          hostID,
+		Hostname:    host.Hostname,
+		DisplayName: host.DisplayName,
+		RemovedAt:   removedAt,
+	})
+
 	m.state.RemoveConnectionHealth(dockerConnectionPrefix + hostID)
 	if m.alertManager != nil {
 		m.alertManager.HandleDockerHostRemoved(host)
@@ -1003,9 +1020,13 @@ func (m *Monitor) AllowDockerHostReenroll(hostID string) error {
 	defer m.mu.Unlock()
 
 	if _, exists := m.removedDockerHosts[hostID]; !exists {
-		log.Debug().
-			Str("dockerHostID", hostID).
-			Msg("Allow re-enroll requested for docker host that was not blocked")
+		host, found := m.GetDockerHost(hostID)
+		event := log.Info().
+			Str("dockerHostID", hostID)
+		if found {
+			event = event.Str("dockerHost", host.Hostname)
+		}
+		event.Msg("Allow re-enroll requested but host was not blocked; ignoring")
 		return nil
 	}
 
@@ -1015,6 +1036,7 @@ func (m *Monitor) AllowDockerHostReenroll(hostID string) error {
 		delete(m.dockerCommands, hostID)
 	}
 	m.state.SetDockerHostCommand(hostID, nil)
+	m.state.RemoveRemovedDockerHost(hostID)
 
 	log.Info().
 		Str("dockerHostID", hostID).
@@ -1437,6 +1459,27 @@ func (m *Monitor) ApplyDockerReport(report agentsdocker.Report, tokenRecord *con
 				ReadBytes:  payload.BlockIO.ReadBytes,
 				WriteBytes: payload.BlockIO.WriteBytes,
 			}
+
+			containerIdentifier := payload.ID
+			if strings.TrimSpace(containerIdentifier) == "" {
+				containerIdentifier = payload.Name
+			}
+			if strings.TrimSpace(containerIdentifier) != "" {
+				metrics := types.IOMetrics{
+					DiskRead:  clampUint64ToInt64(payload.BlockIO.ReadBytes),
+					DiskWrite: clampUint64ToInt64(payload.BlockIO.WriteBytes),
+					Timestamp: timestamp,
+				}
+				readRate, writeRate, _, _ := m.rateTracker.CalculateRates(fmt.Sprintf("docker:%s:%s", identifier, containerIdentifier), metrics)
+				if readRate >= 0 {
+					value := readRate
+					container.BlockIO.ReadRateBytesPerSecond = &value
+				}
+				if writeRate >= 0 {
+					value := writeRate
+					container.BlockIO.WriteRateBytesPerSecond = &value
+				}
+			}
 		}
 
 		if len(payload.Mounts) > 0 {
@@ -1771,6 +1814,7 @@ func (m *Monitor) cleanupRemovedDockerHosts(now time.Time) {
 	for hostID, removedAt := range m.removedDockerHosts {
 		if now.Sub(removedAt) > removedDockerHostsTTL {
 			delete(m.removedDockerHosts, hostID)
+			m.state.RemoveRemovedDockerHost(hostID)
 			log.Debug().
 				Str("dockerHostID", hostID).
 				Time("removedAt", removedAt).
diff --git a/internal/monitoring/monitor_docker_test.go b/internal/monitoring/monitor_docker_test.go
index b6fe8a1..4685066 100644
--- a/internal/monitoring/monitor_docker_test.go
+++ b/internal/monitoring/monitor_docker_test.go
@@ -17,6 +17,7 @@ func newTestMonitor(t *testing.T) *Monitor {
 		state:              models.NewState(),
 		alertManager:       alerts.NewManager(),
 		removedDockerHosts: make(map[string]time.Time),
+		rateTracker:        NewRateTracker(),
 	}
 }
 
@@ -171,6 +172,9 @@ func TestApplyDockerReportIncludesContainerDiskDetails(t *testing.T) {
 	if container.BlockIO.ReadBytes != 123456 || container.BlockIO.WriteBytes != 654321 {
 		t.Fatalf("unexpected block IO values: %+v", container.BlockIO)
 	}
+	if container.BlockIO.ReadRateBytesPerSecond != nil || container.BlockIO.WriteRateBytesPerSecond != nil {
+		t.Fatalf("expected block IO rates to be unset on first sample: %+v", container.BlockIO)
+	}
 
 	if len(container.Mounts) != 1 {
 		t.Fatalf("expected mounts to be preserved, got %d", len(container.Mounts))
diff --git a/internal/monitoring/temperature.go b/internal/monitoring/temperature.go
index eb35475..f6e1dd9 100644
--- a/internal/monitoring/temperature.go
+++ b/internal/monitoring/temperature.go
@@ -600,8 +600,8 @@ func (tc *TemperatureCollector) shouldDisableProxy(err error) bool {
 	var proxyErr *tempproxy.ProxyError
 	if errors.As(err, &proxyErr) {
 		switch proxyErr.Type {
-		case tempproxy.ErrorTypeTransport, tempproxy.ErrorTypeTimeout, tempproxy.ErrorTypeSSH:
-			return true
+	case tempproxy.ErrorTypeTransport, tempproxy.ErrorTypeTimeout:
+		return true
 		default:
 			return false
 		}
diff --git a/scripts/hot-dev.sh b/scripts/hot-dev.sh
index 66d0e2f..739ac10 100755
--- a/scripts/hot-dev.sh
+++ b/scripts/hot-dev.sh
@@ -48,10 +48,25 @@ export FRONTEND_DEV_HOST FRONTEND_DEV_PORT
 export PULSE_DEV_API_HOST PULSE_DEV_API_PORT PULSE_DEV_API_URL PULSE_DEV_WS_URL
 
 # Auto-detect pulse-sensor-proxy socket if available
+HOST_PROXY_SOCKET="/mnt/pulse-proxy/pulse-sensor-proxy.sock"
+CONTAINER_PROXY_SOCKET="/run/pulse-sensor-proxy/pulse-sensor-proxy.sock"
+
 if [[ -z ${PULSE_SENSOR_PROXY_SOCKET:-} ]]; then
-    if [[ -S /mnt/pulse-proxy/pulse-sensor-proxy.sock ]]; then
-        export PULSE_SENSOR_PROXY_SOCKET=/mnt/pulse-proxy/pulse-sensor-proxy.sock
+    if [[ -S "${HOST_PROXY_SOCKET}" ]]; then
+        export PULSE_SENSOR_PROXY_SOCKET="${HOST_PROXY_SOCKET}"
         printf "[hot-dev] Detected pulse-sensor-proxy socket at %s\n" "${PULSE_SENSOR_PROXY_SOCKET}"
+    elif [[ -S "${CONTAINER_PROXY_SOCKET}" ]]; then
+        export PULSE_SENSOR_PROXY_SOCKET="${CONTAINER_PROXY_SOCKET}"
+        printf "[hot-dev] WARNING: Using container-local pulse-sensor-proxy socket at %s\n" "${PULSE_SENSOR_PROXY_SOCKET}"
+        printf "[hot-dev] WARNING: Host proxy is missing; temperatures will not reach Pulse until it is reinstalled.\n"
+    else
+        printf "[hot-dev] WARNING: No pulse-sensor-proxy socket detected. Temperatures will be unavailable.\n"
+    fi
+else
+    if [[ ! -S "${PULSE_SENSOR_PROXY_SOCKET}" ]]; then
+        printf "[hot-dev] WARNING: Configured pulse-sensor-proxy socket not found at %s\n" "${PULSE_SENSOR_PROXY_SOCKET}"
+    elif [[ "${PULSE_SENSOR_PROXY_SOCKET}" == "${CONTAINER_PROXY_SOCKET}" && ! -S "${HOST_PROXY_SOCKET}" ]]; then
+        printf "[hot-dev] WARNING: Using container-local proxy socket; reinstall host pulse-sensor-proxy for real telemetry.\n"
     fi
 fi
 
diff --git a/scripts/install-docker-agent-v2.sh b/scripts/install-docker-agent-v2.sh
index 2397500..1bddb2a 100755
--- a/scripts/install-docker-agent-v2.sh
+++ b/scripts/install-docker-agent-v2.sh
@@ -697,6 +697,7 @@ download_agent_binary() {
     fi
 
     if http::download "${download_args[@]}"; then
+        AGENT_DOWNLOAD_SOURCE="${primary_url}"
         return 0
     fi
 
@@ -711,6 +712,7 @@ download_agent_binary() {
             download_args+=(--insecure)
         fi
         if http::download "${download_args[@]}"; then
+            AGENT_DOWNLOAD_SOURCE="${fallback_url}"
             return 0
         fi
 
@@ -722,6 +724,8 @@ download_agent_binary() {
     return 1
 }
 
+unset AGENT_DOWNLOAD_SOURCE
+
 if download_agent_binary "$DOWNLOAD_URL" "$DOWNLOAD_URL_BASE"; then
     :
 else
@@ -730,6 +734,103 @@ else
     exit 1
 fi
 
+fetch_checksum_header() {
+    local url="$1"
+    local header=""
+
+    if command -v curl &> /dev/null; then
+        local curl_args=(-fsSI "$url")
+        if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+            curl_args=(-k "${curl_args[@]}")
+        fi
+        header=$(curl "${curl_args[@]}" 2>/dev/null || true)
+    elif command -v wget &> /dev/null; then
+        local tmp
+        tmp=$(mktemp)
+        if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+            wget --spider --no-check-certificate --server-response "$url" >/dev/null 2>"$tmp" || true
+        else
+            wget --spider --server-response "$url" >/dev/null 2>"$tmp" || true
+        fi
+        header=$(cat "$tmp" 2>/dev/null || true)
+        rm -f "$tmp"
+    fi
+
+    if [[ -z "$header" ]]; then
+        return 1
+    fi
+
+    local checksum_line
+    checksum_line=$(printf '%s\n' "$header" | awk 'BEGIN{IGNORECASE=1} /^ *X-Checksum-Sha256:/{print $0; exit}')
+    if [[ -z "$checksum_line" ]]; then
+        return 1
+    fi
+
+    local value
+    value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); print $2}')
+    value=$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')
+    if [[ -z "$value" ]]; then
+        return 1
+    fi
+
+    FETCHED_CHECKSUM="$value"
+    return 0
+}
+
+calculate_sha256() {
+    local file="$1"
+    local hash=""
+
+    if command -v sha256sum &> /dev/null; then
+        hash=$(sha256sum "$file" | awk '{print $1}')
+    elif command -v shasum &> /dev/null; then
+        hash=$(shasum -a 256 "$file" | awk '{print $1}')
+    fi
+
+    if [[ -z "$hash" ]]; then
+        return 1
+    fi
+
+    CALCULATED_CHECKSUM=$(printf '%s' "$hash" | tr '[:upper:]' '[:lower:]')
+    return 0
+}
+
+verify_agent_checksum() {
+    local url="$1"
+
+    if common::is_dry_run; then
+        log_info '[dry-run] Skipping checksum verification'
+        return 0
+    fi
+
+    if ! fetch_checksum_header "$url"; then
+        log_warn 'Agent download did not include X-Checksum-Sha256 header; skipping verification'
+        return 0
+    fi
+
+    if ! calculate_sha256 "$AGENT_PATH"; then
+        log_warn 'Unable to calculate sha256 checksum locally; skipping verification'
+        return 0
+    fi
+
+    if [[ "$FETCHED_CHECKSUM" != "$CALCULATED_CHECKSUM" ]]; then
+        rm -f "$AGENT_PATH"
+        log_error "Checksum mismatch. Expected $FETCHED_CHECKSUM but downloaded $CALCULATED_CHECKSUM"
+        return 1
+    fi
+
+    log_success 'Checksum verified for agent binary'
+    unset FETCHED_CHECKSUM CALCULATED_CHECKSUM
+    return 0
+}
+
+if [[ -n "${AGENT_DOWNLOAD_SOURCE:-}" ]]; then
+    if ! verify_agent_checksum "$AGENT_DOWNLOAD_SOURCE"; then
+        log_error 'Agent download failed checksum verification'
+        exit 1
+    fi
+fi
+
 if ! common::is_dry_run; then
     chmod +x "$AGENT_PATH"
 fi
@@ -841,8 +942,8 @@ SYSTEMD_ENV_INSECURE_LINE="Environment=\"PULSE_INSECURE_SKIP_VERIFY=$PRIMARY_INS
 systemd::create_service "$SERVICE_PATH" <<EOF
 [Unit]
 Description=Pulse Docker Agent
-After=network-online.target docker.service
-Wants=network-online.target
+After=network-online.target docker.socket docker.service
+Wants=network-online.target docker.socket
 
 [Service]
 Type=simple
@@ -854,6 +955,22 @@ ExecStart=$AGENT_PATH --url "$PRIMARY_URL" --interval "$INTERVAL"$NO_AUTO_UPDATE
 Restart=on-failure
 RestartSec=5s
 User=root
+ProtectSystem=full
+ProtectHome=read-only
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectKernelLogs=yes
+UMask=0077
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+PrivateTmp=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/run/docker.sock
+ProtectHostname=yes
+ProtectClock=yes
 
 [Install]
 WantedBy=multi-user.target
diff --git a/scripts/install-docker-agent.sh b/scripts/install-docker-agent.sh
index a2b5767..92dfe68 100755
--- a/scripts/install-docker-agent.sh
+++ b/scripts/install-docker-agent.sh
@@ -343,6 +343,193 @@ resolve_agent_path_for_uninstall() {
     printf '%s' "$DEFAULT_AGENT_PATH"
 }
 
+ensure_service_user() {
+    SERVICE_USER_ACTUAL="$SERVICE_USER"
+    SERVICE_GROUP_ACTUAL="$SERVICE_GROUP"
+    SERVICE_USER_AVAILABLE="true"
+
+    if [[ "$SERVICE_USER" == "root" ]]; then
+        SERVICE_GROUP_ACTUAL="root"
+        SERVICE_USER_AVAILABLE="false"
+        return
+    fi
+
+    if id -u "$SERVICE_USER" >/dev/null 2>&1; then
+        if getent group "$SERVICE_GROUP" >/dev/null 2>&1; then
+            SERVICE_GROUP_ACTUAL="$SERVICE_GROUP"
+        else
+            SERVICE_GROUP_ACTUAL="$(id -gn "$SERVICE_USER")"
+        fi
+        return
+    fi
+
+    if command -v useradd >/dev/null 2>&1; then
+        if useradd --system --home-dir "$SERVICE_HOME" --shell /usr/sbin/nologin "$SERVICE_USER" >/dev/null 2>&1; then
+            SERVICE_USER_CREATED="true"
+        fi
+    elif command -v adduser >/dev/null 2>&1; then
+        if adduser --system --home "$SERVICE_HOME" --shell /usr/sbin/nologin "$SERVICE_USER" >/dev/null 2>&1; then
+            SERVICE_USER_CREATED="true"
+        fi
+    else
+        log_warn "Unable to create dedicated service user; running agent as root"
+        SERVICE_USER_ACTUAL="root"
+        SERVICE_GROUP_ACTUAL="root"
+        SERVICE_USER_AVAILABLE="false"
+        return
+    fi
+
+    if id -u "$SERVICE_USER" >/dev/null 2>&1; then
+        SERVICE_USER_ACTUAL="$SERVICE_USER"
+        if getent group "$SERVICE_GROUP" >/dev/null 2>&1; then
+            SERVICE_GROUP_ACTUAL="$SERVICE_GROUP"
+        else
+            SERVICE_GROUP_ACTUAL="$(id -gn "$SERVICE_USER")"
+        fi
+        if [[ "$SERVICE_USER_CREATED" == "true" ]]; then
+            log_success "Created service user: $SERVICE_USER"
+        fi
+        return
+    fi
+
+    log_warn "Failed to create service user; falling back to root"
+    SERVICE_USER_ACTUAL="root"
+    SERVICE_GROUP_ACTUAL="root"
+    SERVICE_USER_AVAILABLE="false"
+}
+
+ensure_service_home() {
+    if [[ "$SERVICE_USER_ACTUAL" == "root" ]]; then
+        return
+    fi
+
+    if [[ -z "$SERVICE_HOME" ]]; then
+        return
+    fi
+
+    if [[ ! -d "$SERVICE_HOME" ]]; then
+        mkdir -p "$SERVICE_HOME"
+    fi
+
+    chown "$SERVICE_USER_ACTUAL":"$SERVICE_GROUP_ACTUAL" "$SERVICE_HOME" >/dev/null 2>&1 || true
+    chmod 750 "$SERVICE_HOME" >/dev/null 2>&1 || true
+}
+
+ensure_docker_group_membership() {
+    SYSTEMD_SUPPLEMENTARY_GROUPS_LINE=""
+    if [[ "$SERVICE_USER_ACTUAL" == "root" ]]; then
+        return
+    fi
+
+    if getent group docker >/dev/null 2>&1; then
+        DOCKER_GROUP_PRESENT="true"
+        if ! id -nG "$SERVICE_USER_ACTUAL" 2>/dev/null | tr ' ' '\n' | grep -Fxq "docker"; then
+            if command -v usermod >/dev/null 2>&1; then
+                usermod -a -G docker "$SERVICE_USER_ACTUAL" >/dev/null 2>&1 || log_warn "Failed to add $SERVICE_USER_ACTUAL to docker group; adjust socket permissions manually."
+            elif command -v adduser >/dev/null 2>&1; then
+                adduser "$SERVICE_USER_ACTUAL" docker >/dev/null 2>&1 || log_warn "Failed to add $SERVICE_USER_ACTUAL to docker group; adjust socket permissions manually."
+            else
+                log_warn "Unable to manage docker group membership; ensure $SERVICE_USER_ACTUAL can access /var/run/docker.sock"
+            fi
+        fi
+
+        if id -nG "$SERVICE_USER_ACTUAL" 2>/dev/null | tr ' ' '\n' | grep -Fxq "docker"; then
+            SYSTEMD_SUPPLEMENTARY_GROUPS_LINE="SupplementaryGroups=docker"
+            log_success "Ensured docker group access for $SERVICE_USER_ACTUAL"
+        else
+            log_warn "Service user $SERVICE_USER_ACTUAL is not in docker group; ensure the Docker socket ACL grants access."
+        fi
+    else
+        log_warn "docker group not found; ensure the agent user can access /var/run/docker.sock"
+    fi
+}
+
+write_env_file() {
+    local target="$ENV_FILE"
+    local dir
+    dir=$(dirname "$target")
+    mkdir -p "$dir"
+
+    local tmp
+    tmp=$(mktemp "${target}.XXXXXX")
+    chmod 600 "$tmp"
+
+    {
+        if [[ -n "$PRIMARY_URL" ]]; then
+            printf 'PULSE_URL=%q\n' "$PRIMARY_URL"
+        fi
+        if [[ -n "$PRIMARY_TOKEN" ]]; then
+            printf 'PULSE_TOKEN=%q\n' "$PRIMARY_TOKEN"
+        fi
+        if [[ -n "$JOINED_TARGETS" ]]; then
+            printf 'PULSE_TARGETS=%q\n' "$JOINED_TARGETS"
+        fi
+        if [[ -n "$PRIMARY_INSECURE" ]]; then
+            printf 'PULSE_INSECURE_SKIP_VERIFY=%q\n' "$PRIMARY_INSECURE"
+        fi
+        if [[ -n "$INTERVAL" ]]; then
+            printf 'PULSE_INTERVAL=%q\n' "$INTERVAL"
+        fi
+        if [[ -n "$NO_AUTO_UPDATE_FLAG" ]]; then
+            printf 'PULSE_NO_AUTO_UPDATE=true\n'
+        fi
+    } > "$tmp"
+
+    chown root:root "$tmp"
+    chmod 600 "$tmp"
+    mv "$tmp" "$target"
+    log_success "Wrote environment file: $target"
+}
+
+configure_polkit_rule() {
+    if [[ "$SERVICE_USER_ACTUAL" == "root" ]]; then
+        return
+    fi
+
+    local polkit_dir="/etc/polkit-1/rules.d"
+    if [[ ! -d "$polkit_dir" ]]; then
+        log_warn "polkit not detected; remote stop commands may require manual sudo access"
+        return
+    fi
+
+    local rule_path="${polkit_dir}/90-pulse-docker-agent.rules"
+    local tmp
+    tmp=$(mktemp "${rule_path}.XXXXXX")
+    cat > "$tmp" <<EOF
+// Pulse Docker agent installer managed rule
+polkit.addRule(function(action, subject) {
+  if ((action.id == "org.freedesktop.systemd1.manage-units" ||
+       action.id == "org.freedesktop.systemd1.manage-unit-files") &&
+      subject.user == "$SERVICE_USER_ACTUAL") {
+    return polkit.Result.YES;
+  }
+});
+EOF
+
+    chown root:root "$tmp" 2>/dev/null || true
+    chmod 0644 "$tmp"
+
+    if [[ -f "$rule_path" ]]; then
+        if command -v cmp >/dev/null 2>&1 && cmp -s "$tmp" "$rule_path" 2>/dev/null; then
+            rm -f "$tmp"
+            log_info "polkit rule already present for $SERVICE_USER_ACTUAL"
+            return
+        fi
+    fi
+
+    mv "$tmp" "$rule_path"
+    log_success "Configured polkit rule allowing $SERVICE_USER_ACTUAL to manage pulse-docker-agent service"
+}
+
+remove_polkit_rule() {
+    local polkit_dir="/etc/polkit-1/rules.d"
+    local rule_path="${polkit_dir}/90-pulse-docker-agent.rules"
+    if [[ -f "$rule_path" ]] && grep -q 'Pulse Docker agent installer managed rule' "$rule_path" 2>/dev/null; then
+        rm -f "$rule_path"
+        log_success "Removed polkit rule: $rule_path"
+    fi
+}
+
 # Pulse Docker Agent Installer/Uninstaller
 # Install (single target):
 #   curl -fsSL http://pulse.example.com/install-docker-agent.sh | bash -s -- --url http://pulse.example.com --token <api-token>
@@ -370,6 +557,7 @@ DEFAULT_AGENT_PATH_WRITABLE="unknown"
 EXISTING_AGENT_PATH=""
 AGENT_PATH=""
 SERVICE_PATH="/etc/systemd/system/pulse-docker-agent.service"
+ENV_FILE="/etc/pulse/pulse-docker-agent.env"
 UNRAID_STARTUP="/boot/config/go.d/pulse-docker-agent.sh"
 LOG_PATH="/var/log/pulse-docker-agent.log"
 INTERVAL="30s"
@@ -385,6 +573,15 @@ PRIMARY_TOKEN=""
 PRIMARY_INSECURE="false"
 JOINED_TARGETS=""
 ORIGINAL_ARGS=("$@")
+SERVICE_USER="pulse-docker"
+SERVICE_GROUP="$SERVICE_USER"
+SERVICE_HOME="/var/lib/pulse-docker-agent"
+SERVICE_USER_ACTUAL="$SERVICE_USER"
+SERVICE_GROUP_ACTUAL="$SERVICE_GROUP"
+SERVICE_USER_CREATED="false"
+SERVICE_USER_AVAILABLE="true"
+DOCKER_GROUP_PRESENT="false"
+SYSTEMD_SUPPLEMENTARY_GROUPS_LINE=""
 
 # Parse arguments
 while [[ $# -gt 0 ]]; do
@@ -687,6 +884,11 @@ if [ "$UNINSTALL" = true ]; then
         log_warn "systemctl not found; skipping service disable"
     fi
 
+    if [ -f "$ENV_FILE" ]; then
+        rm -f "$ENV_FILE"
+        log_success "Removed environment file: $ENV_FILE"
+    fi
+
     if pgrep -f pulse-docker-agent > /dev/null 2>&1; then
         log_info "Stopping running agent processes"
         pkill -f pulse-docker-agent 2>/dev/null || true
@@ -705,6 +907,8 @@ if [ "$UNINSTALL" = true ]; then
         log_success "Removed Unraid startup script: $UNRAID_STARTUP"
     fi
 
+    remove_polkit_rule
+
     if [ "$PURGE" = true ]; then
         if [ -f "$LOG_PATH" ]; then
             rm -f "$LOG_PATH"
@@ -712,6 +916,10 @@ if [ "$UNINSTALL" = true ]; then
         else
             log_info "Agent log file already absent: $LOG_PATH"
         fi
+        if [[ -d "$SERVICE_HOME" ]]; then
+            rm -rf "$SERVICE_HOME"
+            log_success "Removed service home directory: $SERVICE_HOME"
+        fi
     elif [ -f "$LOG_PATH" ]; then
         log_info "Preserving agent log file at $LOG_PATH (use --purge to remove)"
     fi
@@ -946,16 +1154,109 @@ download_agent_from_url() {
     return 1
 }
 
+fetch_checksum_header() {
+    local url="$1"
+    local header=""
+
+    if command -v curl &> /dev/null; then
+        local curl_args=(-fsSI "$url")
+        if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+            curl_args=(-k "${curl_args[@]}")
+        fi
+        header=$(curl "${curl_args[@]}" 2>/dev/null || true)
+    elif command -v wget &> /dev/null; then
+        local tmp
+        tmp=$(mktemp)
+        if [[ "$PRIMARY_INSECURE" == "true" ]]; then
+            wget --spider --no-check-certificate --server-response "$url" >/dev/null 2>"$tmp" || true
+        else
+            wget --spider --server-response "$url" >/dev/null 2>"$tmp" || true
+        fi
+        header=$(cat "$tmp" 2>/dev/null || true)
+        rm -f "$tmp"
+    fi
+
+    if [[ -z "$header" ]]; then
+        return 1
+    fi
+
+    local checksum_line
+    checksum_line=$(printf '%s\n' "$header" | awk 'BEGIN{IGNORECASE=1} /^ *X-Checksum-Sha256:/{print $0; exit}')
+    if [[ -z "$checksum_line" ]]; then
+        return 1
+    fi
+
+    local value
+    value=$(printf '%s\n' "$checksum_line" | awk -F':' '{sub(/^[[:space:]]*/,"",$2); print $2}')
+    value=$(printf '%s' "$value" | tr '[:upper:]' '[:lower:]')
+    if [[ -z "$value" ]]; then
+        return 1
+    fi
+
+    FETCHED_CHECKSUM="$value"
+    return 0
+}
+
+calculate_sha256() {
+    local file="$1"
+    local hash=""
+
+    if command -v sha256sum &> /dev/null; then
+        hash=$(sha256sum "$file" | awk '{print $1}')
+    elif command -v shasum &> /dev/null; then
+        hash=$(shasum -a 256 "$file" | awk '{print $1}')
+    fi
+
+    if [[ -z "$hash" ]]; then
+        return 1
+    fi
+
+    CALCULATED_CHECKSUM=$(printf '%s' "$hash" | tr '[:upper:]' '[:lower:]')
+    return 0
+}
+
+verify_agent_checksum() {
+    local url="$1"
+    if ! fetch_checksum_header "$url"; then
+        log_warn 'Agent download did not include X-Checksum-Sha256 header; skipping verification'
+        return 0
+    fi
+
+    if ! calculate_sha256 "$AGENT_PATH"; then
+        log_warn 'Unable to calculate sha256 checksum locally; skipping verification'
+        return 0
+    fi
+
+    if [[ "$FETCHED_CHECKSUM" != "$CALCULATED_CHECKSUM" ]]; then
+        rm -f "$AGENT_PATH"
+        log_error "Checksum mismatch. Expected $FETCHED_CHECKSUM but downloaded $CALCULATED_CHECKSUM"
+        return 1
+    fi
+
+    log_success 'Checksum verified for agent binary'
+    unset FETCHED_CHECKSUM CALCULATED_CHECKSUM
+    return 0
+}
+
+DOWNLOAD_SUCCESS_URL=""
 if download_agent_from_url "$DOWNLOAD_URL"; then
-    :
+    DOWNLOAD_SUCCESS_URL="$DOWNLOAD_URL"
 elif [[ "$DOWNLOAD_URL" != "$DOWNLOAD_URL_BASE" ]] && download_agent_from_url "$DOWNLOAD_URL_BASE"; then
     log_info 'Falling back to server default agent binary'
+    DOWNLOAD_SUCCESS_URL="$DOWNLOAD_URL_BASE"
 else
     log_warn 'Failed to download agent binary'
     log_warn "Ensure the Pulse server is reachable at $PRIMARY_URL"
     exit 1
 fi
 
+if [[ -n "$DOWNLOAD_SUCCESS_URL" ]]; then
+    if ! verify_agent_checksum "$DOWNLOAD_SUCCESS_URL"; then
+        log_error 'Agent download failed checksum verification'
+        exit 1
+    fi
+fi
+
 chmod +x "$AGENT_PATH"
 log_success "Agent binary installed"
 
@@ -991,9 +1292,11 @@ allow_reenroll_if_needed() {
     fi
 
     if [[ "$success" == "true" ]]; then
-        log_success "Cleared any previous stop block for host"
+        log_success "Cleared previous removal block via Pulse API"
     else
-        log_warn "Unable to confirm removal block clearance (continuing)"
+        log_warn 'Pulse still considers this host removed.'
+        log_warn 'If you just reinstalled, visit Pulse → Docker → Removed Hosts and allow re-enroll,'
+        log_warn 'or rerun this installer with an API token that includes the docker:manage scope.'
     fi
 
     return 0
@@ -1070,31 +1373,49 @@ if [[ -n "$NO_AUTO_UPDATE_FLAG" ]]; then
 fi
 fi
 
+log_header 'Preparing service environment'
+ensure_service_user
+ensure_service_home
+ensure_docker_group_membership
+write_env_file
+configure_polkit_rule
+
 # Create systemd service
 log_header 'Configuring systemd service'
-SYSTEMD_ENV_TARGETS_LINE=""
-if [[ -n "$JOINED_TARGETS" ]]; then
-SYSTEMD_ENV_TARGETS_LINE="Environment=\"PULSE_TARGETS=$JOINED_TARGETS\""
-fi
-SYSTEMD_ENV_URL_LINE="Environment=\"PULSE_URL=$PRIMARY_URL\""
-SYSTEMD_ENV_TOKEN_LINE="Environment=\"PULSE_TOKEN=$PRIMARY_TOKEN\""
-SYSTEMD_ENV_INSECURE_LINE="Environment=\"PULSE_INSECURE_SKIP_VERIFY=$PRIMARY_INSECURE\""
 cat > "$SERVICE_PATH" << EOF
 [Unit]
 Description=Pulse Docker Agent
-After=network-online.target docker.service
-Wants=network-online.target
+After=network-online.target docker.socket docker.service
+Wants=network-online.target docker.socket
 
 [Service]
 Type=simple
-$SYSTEMD_ENV_URL_LINE
-$SYSTEMD_ENV_TOKEN_LINE
-$SYSTEMD_ENV_TARGETS_LINE
-$SYSTEMD_ENV_INSECURE_LINE
+EnvironmentFile=-$ENV_FILE
 ExecStart=$AGENT_PATH --url "$PRIMARY_URL" --interval "$INTERVAL"$NO_AUTO_UPDATE_FLAG
 Restart=on-failure
 RestartSec=5s
-User=root
+StartLimitIntervalSec=120
+StartLimitBurst=5
+User=$SERVICE_USER_ACTUAL
+Group=$SERVICE_GROUP_ACTUAL
+$SYSTEMD_SUPPLEMENTARY_GROUPS_LINE
+UMask=0077
+NoNewPrivileges=yes
+RestrictSUIDSGID=yes
+RestrictRealtime=yes
+PrivateTmp=yes
+ProtectSystem=full
+ProtectHome=read-only
+ProtectControlGroups=yes
+ProtectKernelModules=yes
+ProtectKernelTunables=yes
+ProtectKernelLogs=yes
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
+ReadWritePaths=/var/run/docker.sock
+ProtectHostname=yes
+ProtectClock=yes
 
 [Install]
 WantedBy=multi-user.target
diff --git a/scripts/install-host-agent.sh b/scripts/install-host-agent.sh
index cdc59b0..5c1837a 100755
--- a/scripts/install-host-agent.sh
+++ b/scripts/install-host-agent.sh
@@ -67,6 +67,10 @@ INTERVAL="30s"
 UNINSTALL="false"
 PLATFORM=""
 FORCE=false
+KEYCHAIN_ENABLED=true
+KEYCHAIN_OPT_OUT=false
+KEYCHAIN_OPT_OUT_REASON=""
+USE_KEYCHAIN=false
 
 while [[ $# -gt 0 ]]; do
     case "$1" in
@@ -94,6 +98,12 @@ while [[ $# -gt 0 ]]; do
             FORCE=true
             shift
             ;;
+        --no-keychain)
+            KEYCHAIN_ENABLED=false
+            KEYCHAIN_OPT_OUT=true
+            KEYCHAIN_OPT_OUT_REASON="flag"
+            shift
+            ;;
         *)
             echo "Unknown option: $1"
             exit 1
@@ -136,6 +146,10 @@ fi
 
 print_header
 
+if [[ "$FORCE" == true ]]; then
+    log_warn "--force enabled: skipping interactive confirmations and accepting secure defaults."
+fi
+
 # Interactive prompts if parameters not provided (unless --force is used)
 if [[ -z "$PULSE_URL" ]]; then
     if [[ "$FORCE" == false ]]; then
@@ -148,7 +162,10 @@ fi
 
 if [[ -z "$PULSE_URL" ]]; then
     log_error "Pulse URL is required"
-    echo "Usage: $0 --url <pulse-url> --token <api-token> [--interval 30s] [--platform linux|darwin|windows] [--force]"
+    echo "Usage: $0 --url <pulse-url> --token <api-token> [--interval 30s] [--platform linux|darwin|windows] [--force] [--no-keychain]"
+    echo ""
+    echo "  --force       Skip interactive prompts and accept secure defaults (including Keychain storage)."
+    echo "  --no-keychain Disable Keychain storage and embed the token in the launch agent plist instead."
     exit 1
 fi
 
@@ -416,8 +433,32 @@ elif [[ "$PLATFORM" == "darwin" ]] && command -v launchctl &> /dev/null; then
     mkdir -p "$MACOS_LOG_DIR"
     mkdir -p "$HOME/Library/LaunchAgents"
 
+    if [[ -n "$PULSE_TOKEN" && "$KEYCHAIN_ENABLED" == true && "$FORCE" == false ]]; then
+        echo ""
+        log_info "It is recommended to store the token in your Keychain so it never lands on disk."
+        KEYCHAIN_PROMPTED=false
+        if [[ -t 0 ]]; then
+            read -r -p "Store the token in the macOS Keychain? [Y/n]: " KEYCHAIN_RESPONSE
+            KEYCHAIN_PROMPTED=true
+        elif [[ -r /dev/tty ]]; then
+            read -r -p "Store the token in the macOS Keychain? [Y/n]: " KEYCHAIN_RESPONSE </dev/tty
+            KEYCHAIN_PROMPTED=true
+        else
+            log_warn "No interactive terminal detected; defaulting to Keychain storage. Use --no-keychain to opt out."
+        fi
+        if [[ "$KEYCHAIN_PROMPTED" == true && "$KEYCHAIN_RESPONSE" =~ ^[Nn] ]]; then
+            KEYCHAIN_ENABLED=false
+            KEYCHAIN_OPT_OUT=true
+            KEYCHAIN_OPT_OUT_REASON="prompt"
+        fi
+        echo ""
+    fi
+
     # Store token in macOS Keychain for better security
-    if [[ -n "$PULSE_TOKEN" ]]; then
+    if [[ -n "$PULSE_TOKEN" && "$KEYCHAIN_ENABLED" == true ]]; then
+        log_info "For security, the token is stored in your macOS Keychain so it never lands on disk."
+        log_info "macOS may ask to allow access the first time the agent runs."
+        log_info "Use --no-keychain to opt out (the token will be embedded in the launchd plist instead)."
         log_info "Storing token in macOS Keychain..."
 
         # Delete existing keychain entry if it exists
@@ -429,12 +470,13 @@ elif [[ "$PLATFORM" == "darwin" ]] && command -v launchctl &> /dev/null; then
 
         KEYCHAIN_APPS=(
             "/usr/local/bin/pulse-host-agent"
-            "/usr/local/bin/pulse-host-agent-wrapper.sh"
             "/usr/bin/security"
         )
         KEYCHAIN_ARGS=()
         for app in "${KEYCHAIN_APPS[@]}"; do
-            KEYCHAIN_ARGS+=(-T "$app")
+            if [[ -e "$app" ]]; then
+                KEYCHAIN_ARGS+=(-T "$app")
+            fi
         done
 
         if security add-generic-password \
@@ -456,6 +498,17 @@ elif [[ "$PLATFORM" == "darwin" ]] && command -v launchctl &> /dev/null; then
             log_info "You may need to grant Keychain access permissions"
             USE_KEYCHAIN=false
         fi
+    elif [[ -n "$PULSE_TOKEN" ]]; then
+        if [[ "$KEYCHAIN_OPT_OUT" == true ]]; then
+            if [[ "$KEYCHAIN_OPT_OUT_REASON" == "flag" ]]; then
+                log_warn "Keychain storage disabled via --no-keychain; token will be embedded in the launchd plist."
+            elif [[ "$KEYCHAIN_OPT_OUT_REASON" == "prompt" ]]; then
+                log_warn "Keychain storage skipped at user prompt; token will be embedded in the launchd plist."
+            fi
+        else
+            log_warn "Keychain storage disabled; token will be embedded in the launchd plist."
+        fi
+        USE_KEYCHAIN=false
     else
         USE_KEYCHAIN=false
     fi
diff --git a/scripts/install-sensor-proxy.sh b/scripts/install-sensor-proxy.sh
index b0bbe94..039f1bb 100755
--- a/scripts/install-sensor-proxy.sh
+++ b/scripts/install-sensor-proxy.sh
@@ -67,12 +67,19 @@ SOCKET_PATH="${RUNTIME_DIR}/pulse-sensor-proxy.sock"
 WORK_DIR="/var/lib/pulse-sensor-proxy"
 SSH_DIR="${WORK_DIR}/ssh"
 CONFIG_DIR="/etc/pulse-sensor-proxy"
+CTID_FILE="${CONFIG_DIR}/ctid"
 CLEANUP_SCRIPT_PATH="/usr/local/bin/pulse-sensor-cleanup.sh"
 CLEANUP_PATH_UNIT="/etc/systemd/system/pulse-sensor-cleanup.path"
 CLEANUP_SERVICE_UNIT="/etc/systemd/system/pulse-sensor-cleanup.service"
 CLEANUP_REQUEST_PATH="${WORK_DIR}/cleanup-request.json"
 SERVICE_USER="pulse-sensor-proxy"
 LOG_DIR="/var/log/pulse/sensor-proxy"
+SHARE_DIR="/usr/local/share/pulse"
+STORED_INSTALLER="${SHARE_DIR}/install-sensor-proxy.sh"
+SELFHEAL_SCRIPT="/usr/local/bin/pulse-sensor-proxy-selfheal.sh"
+SELFHEAL_SERVICE_UNIT="/etc/systemd/system/pulse-sensor-proxy-selfheal.service"
+SELFHEAL_TIMER_UNIT="/etc/systemd/system/pulse-sensor-proxy-selfheal.timer"
+SCRIPT_SOURCE="$(readlink -f "${BASH_SOURCE[0]:-$0}" 2>/dev/null || printf '%s' "${BASH_SOURCE[0]:-$0}")"
 
 cleanup_local_authorized_keys() {
     local auth_keys_file="/root/.ssh/authorized_keys"
@@ -198,6 +205,34 @@ EOF
         print_success "Removed cleanup service unit ${CLEANUP_SERVICE_UNIT}"
     fi
 
+    if [[ -f "$SELFHEAL_TIMER_UNIT" ]]; then
+        systemctl stop pulse-sensor-proxy-selfheal.timer 2>/dev/null || true
+        systemctl disable pulse-sensor-proxy-selfheal.timer 2>/dev/null || true
+        rm -f "$SELFHEAL_TIMER_UNIT"
+        print_success "Removed self-heal timer ${SELFHEAL_TIMER_UNIT}"
+    fi
+
+    if [[ -f "$SELFHEAL_SERVICE_UNIT" ]]; then
+        systemctl stop pulse-sensor-proxy-selfheal.service 2>/dev/null || true
+        systemctl disable pulse-sensor-proxy-selfheal.service 2>/dev/null || true
+        rm -f "$SELFHEAL_SERVICE_UNIT"
+        print_success "Removed self-heal service ${SELFHEAL_SERVICE_UNIT}"
+    fi
+
+    if [[ -f "$SELFHEAL_SCRIPT" ]]; then
+        rm -f "$SELFHEAL_SCRIPT"
+        print_success "Removed self-heal helper ${SELFHEAL_SCRIPT}"
+    fi
+
+    if [[ -f "$STORED_INSTALLER" ]]; then
+        rm -f "$STORED_INSTALLER"
+        print_success "Removed cached installer ${STORED_INSTALLER}"
+    fi
+
+    if [[ -f "$CTID_FILE" ]]; then
+        rm -f "$CTID_FILE"
+    fi
+
     if command -v systemctl >/dev/null 2>&1; then
         systemctl daemon-reload 2>/dev/null || true
     fi
@@ -558,6 +593,11 @@ install -d -o pulse-sensor-proxy -g pulse-sensor-proxy -m 0700 "$SSH_DIR"
 install -m 0600 -o pulse-sensor-proxy -g pulse-sensor-proxy /dev/null "$SSH_DIR/known_hosts"
 install -d -o pulse-sensor-proxy -g pulse-sensor-proxy -m 0755 /etc/pulse-sensor-proxy
 
+if [[ -n "$CTID" ]]; then
+    echo "$CTID" > "$CTID_FILE"
+    chmod 0644 "$CTID_FILE"
+fi
+
 # Create config file with ACL for Docker containers (standalone mode)
 if [[ "$STANDALONE" == true ]]; then
     print_info "Creating config file with Docker container ACL..."
@@ -946,7 +986,7 @@ LimitNOFILE=1024
 SERVICE_EOF
 
 # Enable and start the path unit
-systemctl daemon-reload
+systemctl daemon-reload || true
 systemctl enable pulse-sensor-cleanup.path
 systemctl start pulse-sensor-cleanup.path
 
@@ -1261,7 +1301,7 @@ for key_type in id_rsa id_dsa id_ecdsa id_ed25519; do
             print_warn "Found legacy SSH key: /root/.ssh/$key_type"
         fi
         pct exec "$CTID" -- rm -f "/root/.ssh/$key_type" "/root/.ssh/${key_type}.pub"
-        print_info "  Removed /root/.ssh/$key_type"
+    print_info "  Removed /root/.ssh/$key_type"
     fi
 done
 
@@ -1272,6 +1312,88 @@ if [ "$LEGACY_KEYS_FOUND" = true ] && [ "$QUIET" != true ]; then
 fi
 fi  # End of container-specific configuration
 
+# Install self-heal safeguards to keep proxy available
+print_info "Configuring self-heal safeguards..."
+if [[ -n "$SCRIPT_SOURCE" && -f "$SCRIPT_SOURCE" ]]; then
+    install -d "$SHARE_DIR"
+    cp "$SCRIPT_SOURCE" "$STORED_INSTALLER"
+    chmod 0755 "$STORED_INSTALLER"
+else
+    print_warn "Unable to cache installer script for self-heal (source path unavailable)"
+fi
+
+cat > "$SELFHEAL_SCRIPT" <<'EOF'
+#!/bin/bash
+set -euo pipefail
+
+SERVICE="pulse-sensor-proxy"
+INSTALLER="/usr/local/share/pulse/install-sensor-proxy.sh"
+CTID_FILE="/etc/pulse-sensor-proxy/ctid"
+LOG_TAG="pulse-sensor-proxy-selfheal"
+
+log() {
+    logger -t "$LOG_TAG" "$1"
+}
+
+if ! command -v systemctl >/dev/null 2>&1; then
+    exit 0
+fi
+
+if ! systemctl list-unit-files | grep -q "^${SERVICE}\\.service"; then
+    if [[ -x "$INSTALLER" && -f "$CTID_FILE" ]]; then
+        log "Service unit missing; attempting reinstall"
+        bash "$INSTALLER" --ctid "$(cat "$CTID_FILE")" --skip-restart --quiet || log "Reinstall attempt failed"
+    fi
+    exit 0
+fi
+
+if ! systemctl is-active --quiet "${SERVICE}.service"; then
+    systemctl start "${SERVICE}.service" || true
+    sleep 2
+fi
+
+if ! systemctl is-active --quiet "${SERVICE}.service"; then
+    if [[ -x "$INSTALLER" && -f "$CTID_FILE" ]]; then
+        log "Service failed to start; attempting reinstall"
+        bash "$INSTALLER" --ctid "$(cat "$CTID_FILE")" --skip-restart --quiet || log "Reinstall attempt failed"
+        systemctl start "${SERVICE}.service" || true
+    fi
+fi
+EOF
+chmod 0755 "$SELFHEAL_SCRIPT"
+
+cat > "$SELFHEAL_SERVICE_UNIT" <<'EOF'
+[Unit]
+Description=Pulse Sensor Proxy Self-Heal
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/bin/pulse-sensor-proxy-selfheal.sh
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+cat > "$SELFHEAL_TIMER_UNIT" <<'EOF'
+[Unit]
+Description=Ensure pulse-sensor-proxy stays installed and running
+
+[Timer]
+OnBootSec=5min
+OnUnitActiveSec=30min
+Unit=pulse-sensor-proxy-selfheal.service
+
+[Install]
+WantedBy=timers.target
+EOF
+
+systemctl daemon-reload
+systemctl enable --now pulse-sensor-proxy-selfheal.timer >/dev/null 2>&1 || true
+
 if [ "$QUIET" = true ]; then
     print_success "pulse-sensor-proxy installed and running"
 else