make container builds reproducible

Commit Cargo.lock, copy it into the Docker build stage, and align the Docker Rust base/MSRV with the toolchain required by the locked dependency graph.
fix docker build toolchain selection
2026-05-24 13:53:10 -04:00 · 2026-05-24 13:49:09 -04:00 · 2026-05-24 13:45:35 -04:00 · 2026-05-24 13:10:40 -04:00 · 2026-05-21 02:13:08 -04:00 · 2026-05-06 22:35:11 -04:00
64 changed files with 6806 additions and 1297 deletions
@@ -1,5 +1,4 @@
 /target
-Cargo.lock
 data/isos/*.iso
 data/isos/*.partial
 data/isos/*.meta.json
@@ -11,3 +10,4 @@ data/work/
 # settings.local.json is your personal allowlist history and shouldn't be).
 .claude/settings.local.json
 .claude/worktrees/
+.claude/scheduled_tasks.lock
@@ -8,16 +8,16 @@ members = [
    "crates/iso-store",
    "crates/ipxe-assets",
    "crates/webui",
-    "crates/pxeforge",
+    "crates/openpxe",
 ]

 [workspace.package]
-version = "0.2.0"
+version = "0.4.1"
 edition = "2021"
-rust-version = "1.80"
+rust-version = "1.95"
 license = "MIT OR Apache-2.0"
-repository = "https://github.com/casperadmin/PXEForge"
-authors = ["PXEForge contributors"]
+repository = "https://gitea.milesward.dev/mward4/OpenPXE"
+authors = ["OpenPXE contributors"]

 [workspace.dependencies]
 tokio = { version = "1.40", features = ["full"] }
@@ -53,17 +53,18 @@ uuid = { version = "1.10", features = ["v4", "serde"] }
 time = { version = "0.3", features = ["serde", "serde-human-readable", "formatting", "macros"] }
 sha2 = "0.10"
 hex = "0.4"
+bcrypt = "0.15"
 once_cell = "1.19"
 parking_lot = "0.12"
 rust-embed = { version = "8.5", features = ["include-exclude"] }

-pxeforge-core = { path = "crates/core" }
-pxeforge-dhcp-proxy = { path = "crates/dhcp-proxy" }
-pxeforge-tftp = { path = "crates/tftp" }
-pxeforge-http-api = { path = "crates/http-api" }
-pxeforge-iso-store = { path = "crates/iso-store" }
-pxeforge-ipxe-assets = { path = "crates/ipxe-assets" }
-pxeforge-webui = { path = "crates/webui" }
+openpxe-core = { path = "crates/core" }
+openpxe-dhcp-proxy = { path = "crates/dhcp-proxy" }
+openpxe-tftp = { path = "crates/tftp" }
+openpxe-http-api = { path = "crates/http-api" }
+openpxe-iso-store = { path = "crates/iso-store" }
+openpxe-ipxe-assets = { path = "crates/ipxe-assets" }
+openpxe-webui = { path = "crates/webui" }

 [workspace.lints.rust]
 unsafe_code = "deny"
@@ -1,16 +1,16 @@
-# PXEForge
+# OpenPXE

 Container-native PXE boot server. A Rust reimplementation of
 [iVentoy (ventoy/PXE)](https://github.com/ventoy/PXE), designed from scratch
 for Docker/OCI and OpenShift. Upload `.iso` files via the web UI; network
 clients PXE-boot them.

-> **Status:** v0.2.0 / pre-beta. Phases 1–5 complete: full PXE stack,
-> Gated Deployment queue, NFS-share ISO sources, live tracing log + an
-> operator terminal, per-MAC host bindings (Tinkerbell-style),
-> Prometheus `/metrics`, light/dark theme toggle, animated anvil
-> imaging-progress widget. **66 tests passing**, clippy clean. Ready
-> for real-hardware validation.
+> **Status:** v0.4.1 / pre-beta. Phases 1–5 complete: full PXE stack,
+> Queued Deployment queue, NFS-share ISO sources, live tracing log + an
+> operator terminal, per-MAC host bindings, Prometheus `/metrics`,
+> light/dark theme toggle, animated OpenPXE imaging-progress widget,
+> chunked ISO uploads, and per-ISO boot passwords. The test suite and
+> clippy are part of the release checklist. Ready for real-hardware validation.

 ## Design non-negotiables

@@ -38,27 +38,26 @@ clients PXE-boot them.
   ```
   Default        > Boot from Local HDD
   Installers     > Linux Installers  / Windows Installers
-   Tools          > Utilities / PXEForge Shell / Network Card Info
-   Gated Deployment
+   Tools          > Utilities / OpenPXE Shell / Network Card Info
+   Queued Deployment
   ```
-6. **Gated Deployment queue** — the "horse race gate" flow. A client that
-   selects *Gated Deployment* gets a numbered position and waits. The
+6. **Queued Deployment queue** — the coordinated launch flow. A client that
+   selects *Queued Deployment* gets a numbered position and waits. The
   operator picks an ISO in the web UI and fires it to every waiting
   client simultaneously.
-7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Forge
-   Gate / Storage / Hosts / Terminal / About), light + dark themes
-   (toggle top-right or press `T`), animated anvil "forge progress"
+7. **Web UI** (Netbox-style): sidebar nav (Dashboard / Network / Queue /
+   Storage / Hosts / Terminal / About), light + dark themes
+   (toggle top-right or press `T`), animated OpenPXE progress
   widget when devices are imaging. All assets served from the binary —
   no external requests.
 8. **Per-MAC host bindings.** Pin a MAC to a boot target and the client
-   skips the menu, chains straight through. Inspired by Tinkerbell's
-   `smee` MAC-prepended URL pattern.
+   skips the menu, chains straight through.
 9. **Prometheus metrics** at `/metrics` — DHCP replies by arch, TFTP
-   transfer counts and bytes, HTTP request counts by route, gate /
+   transfer counts and bytes, HTTP request counts by route, queue /
   imaging gauges, uptime, build info. Plain text exposition format,
   no external metrics framework dependency.
 8. **Settings API** lets you change the default boot-menu timeout (default
-   600s), the timeout action (stay / Local HDD / Gated Deployment), and
+   600s), the timeout action (stay / Local HDD / Queued Deployment), and
   feature toggles like Windows ISO support. The iPXE scripts regenerate
   on every request using current settings.

@@ -81,17 +80,17 @@ skip TFTP and respond with an HTTP URL.
 ./scripts/fetch-ipxe.sh

 # 2. Build the container image (~3 min first time).
-docker buildx build -f deploy/docker/Dockerfile -t pxeforge:0.1.0 --load .
+docker buildx build -f deploy/docker/Dockerfile -t openpxe:0.4.1 --load .

 # 3. Run it on the box plugged into your PXE network. Set PUBLIC_IP to
 #    this host's LAN address so advertised iPXE URLs are reachable.
-docker run -d --name pxeforge \
+docker run -d --name openpxe \
  --network host \
-  -e PXEFORGE_PUBLIC_IP=10.0.0.5 \
-  -e PXEFORGE_DHCP_MODE=proxy \
-  -v $PWD/data/isos:/var/lib/pxeforge/isos \
-  -v $PWD/data/work:/var/lib/pxeforge/work \
-  pxeforge:0.1.0
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  -e OPENPXE_DHCP_MODE=proxy \
+  -v $PWD/data/isos:/var/lib/openpxe/isos \
+  -v $PWD/data/work:/var/lib/openpxe/work \
+  openpxe:0.4.1

 # 4. Open the UI and drop an ISO in.
 open http://10.0.0.5
@@ -99,16 +98,16 @@ open http://10.0.0.5

 Host networking is required in proxy mode so the container sees DHCPDISCOVER
 broadcasts from the PXE VLAN. On macOS/Windows hosts Docker runs in a Linux
-VM, so "host" means the VM — use `pxeforge-dev` in `docker-compose.yml` for
+VM, so "host" means the VM — use `openpxe-dev` in `docker-compose.yml` for
 API-only testing on a laptop.

 ### Quick start — docker compose

 ```bash
 # MVP / API testing on a laptop (no DHCP, high ports):
-PXEFORGE_PUBLIC_IP=127.0.0.1 docker compose up pxeforge-dev
+OPENPXE_PUBLIC_IP=127.0.0.1 docker compose up openpxe-dev
 # Real PXE deployment on a Linux host (host network, DHCP proxy on):
-PXEFORGE_PUBLIC_IP=10.0.0.5  docker compose up pxeforge
+OPENPXE_PUBLIC_IP=10.0.0.5  docker compose up openpxe
 ```

 ### Multi-arch build + push
@@ -117,12 +116,12 @@ For deploying to x86_64 servers, build both arches in one manifest:

 ```bash
 # One-time: bootstrap a multi-arch builder.
-docker buildx create --name pxeforge-multi --driver docker-container --use
+docker buildx create --name openpxe-multi --driver docker-container --use

 # Build + push both linux/amd64 and linux/arm64 under one tag.
-docker buildx build --builder pxeforge-multi \
+docker buildx build --builder openpxe-multi \
  --platform linux/amd64,linux/arm64 \
-  -t ghcr.io/YOUR-ORG/pxeforge:0.1.0 \
+  -t ghcr.io/YOUR-ORG/openpxe:0.4.1 \
  --push \
  -f deploy/docker/Dockerfile .
 ```
@@ -153,31 +152,31 @@ same pipeline the web UI uses (introspection + boot-entry generation):
 ```bash
 docker run --rm \
  -v /my/iso-library:/seed:ro \
-  -v pxeforge-data:/var/lib/pxeforge/isos \
-  -e PXEFORGE_PUBLIC_IP=10.0.0.5 \
-  pxeforge:0.1.0 seed --from /seed
+  -v openpxe-data:/var/lib/openpxe/isos \
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  openpxe:0.4.1 seed --from /seed

 # Dry run first to see what would be imported:
-docker run --rm -v /my/iso-library:/seed:ro pxeforge:0.1.0 seed --from /seed --dry-run
+docker run --rm -v /my/iso-library:/seed:ro openpxe:0.4.1 seed --from /seed --dry-run
 ```

 ### Environment overrides

 | Var                    | Default                     | Meaning                                |
 |------------------------|-----------------------------|----------------------------------------|
-| `PXEFORGE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
-| `PXEFORGE_TFTP_PORT`   | `69`                        | TFTP port                              |
-| `PXEFORGE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
-| `PXEFORGE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
-| `PXEFORGE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
-| `PXEFORGE_ISO_DIR`     | `/var/lib/pxeforge/isos`    | Where uploaded ISOs live               |
-| `PXEFORGE_WORK_DIR`    | `/var/lib/pxeforge/work`    | Scratch + runtime settings             |
-| `PXEFORGE_LOG`         | `info,pxeforge=debug`       | `tracing` filter                       |
+| `OPENPXE_HTTP_PORT`   | `80`                        | Web UI + boot script HTTP port         |
+| `OPENPXE_TFTP_PORT`   | `69`                        | TFTP port                              |
+| `OPENPXE_DHCP_PORT`   | `67`                        | DHCP server-side port                  |
+| `OPENPXE_DHCP_MODE`   | `proxy`                     | `proxy` or `disabled`                  |
+| `OPENPXE_PUBLIC_IP`   | auto-detect                 | Advertised IP for clients. Startup **fails** if unset and auto-detect returns loopback. |
+| `OPENPXE_ISO_DIR`     | `/var/lib/openpxe/isos`    | Where uploaded ISOs live               |
+| `OPENPXE_WORK_DIR`    | `/var/lib/openpxe/work`    | Scratch + runtime settings             |
+| `OPENPXE_LOG`         | `info,openpxe=debug`       | `tracing` filter                       |

 ## What the boot menu looks like on a real client

 ```
-                        PXEForge - network boot menu
+                        OpenPXE - network boot menu

 ------------------------- Default -------------------------
 Boot from Local HDD
@@ -188,14 +187,14 @@ docker run --rm -v /my/iso-library:/seed:ro pxeforge:0.1.0 seed --from /seed --d
 Tools              >                Utilities / Shell /
                                     NIC Info / Reboot /
                                     Exit and continue BIOS
- ---------------------- Gated Deployment ------------------
- Gated Deployment   (join queue)
+ ---------------------- Queued Deployment ------------------
+ Queued Deployment   (join queue)
 ```

 Linux/Windows submenus show file sizes iVentoy-style:

 ```
-                   PXEForge - Linux Installers
+                   OpenPXE - Linux Installers

 [  4376 MB]  CentOS-7-x86_64-DVD-1810
 [  2002 MB]  Fedora-Workstation-Live-x86_64-38-1.6
@@ -210,8 +209,8 @@ ISOs you upload via drag-and-drop in the web UI plus toggles in Settings.

 ```bash
 oc apply -f deploy/openshift/
-oc -n pxeforge get all
-oc -n pxeforge get route pxeforge -o jsonpath='{.spec.host}'
+oc -n openpxe get all
+oc -n openpxe get route openpxe -o jsonpath='{.spec.host}'
 ```

 ### Why a custom SCC?
@@ -219,7 +218,7 @@ oc -n pxeforge get route pxeforge -o jsonpath='{.spec.host}'
 The default `restricted-v2` blocks `hostNetwork` and all capabilities. PXE
 cannot work without host network (CNI overlays don't deliver L2 broadcast
 into pod netns), and we need `NET_BIND_SERVICE` to bind <1024. The custom
-`pxeforge-scc` grants exactly those two and nothing else. No raw sockets,
+`openpxe-scc` grants exactly those two and nothing else. No raw sockets,
 no privileged mode — proxy-mode DHCP sidesteps the usual requirements.

 ### What's on host ports
@@ -239,7 +238,7 @@ the node's host IP directly for UDP.
 Enabled by toggling **Windows ISO support** under Settings. The flow:

 1. Upload a stock Microsoft Windows install ISO (vanilla, no pre-processing).
-2. On upload, PXEForge extracts the ISO and uses `wimlib-imagex` to rewrite
+2. On upload, OpenPXE extracts the ISO and uses `wimlib-imagex` to rewrite
   image index 2 (WinPE) of `sources/boot.wim`. It injects exactly two
   plain-text files:
   - `Windows/System32/winpeshl.ini` — tells WinPE to run `startnet.cmd`.
@@ -271,22 +270,23 @@ operational constraints inherited from the design:
 - Hardware with NICs/storage controllers missing from WinPE's bundled
  drivers will need a driver-pack injection step (not yet implemented).

-## Gated Deployment
+## Queued Deployment

-The "horse race gate" flow, end to end:
+The coordinated launch flow, end to end:

-1. A client boots and picks **Gated Deployment** in the PXE menu (or falls
+1. A client boots and picks **Queued Deployment** in the PXE menu (or falls
   through on timeout with the default `timeout_action`).
-2. The client joins the queue, gets a numbered gate position, and enters a
+2. The client joins the queue, gets a numbered queue position, and enters a
   long-poll loop (25s per request, auto-renewed).
-3. In the web UI's **Gated Deployment** tab, the operator sees each waiting
+3. In the web UI's **Queued Deployment** tab, the operator sees each waiting
   client with its MAC, IP, arch, and position.
 4. The operator selects an image and clicks **Launch for all waiting**.
-   The server broadcasts the assignment to every gated client via a
+   The server broadcasts the assignment to every queued client via a
   `tokio::sync::Notify`; each client's next poll returns the boot script
   for the chosen image.
-5. Every client chains the same image at effectively the same moment — the
-   gate opens and the horses run together.
+5. Every client chains the same image at effectively the same moment. The
+   queue stays visible until the operator releases entries, which keeps a
+   useful audit trail during hardware testing.

 No user-facing iPXE anywhere in this flow. The client only ever runs
 scripts we generate; the operator only interacts with the web UI.
@@ -1,10 +1,10 @@
 [package]
-name = "pxeforge-core"
+name = "openpxe-core"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "Shared types, config, and arch detection for PXEForge"
+description = "Shared types, config, and arch detection for OpenPXE"

 [lints]
 workspace = true
@@ -126,7 +126,10 @@ mod tests {
    fn bootfile_names_stable() {
        assert_eq!(ClientArch::LegacyX86.ipxe_bootfile(), Some("undionly.kpxe"));
        assert_eq!(ClientArch::X64Uefi.ipxe_bootfile(), Some("snponly.efi"));
-        assert_eq!(ClientArch::Arm64Uefi.ipxe_bootfile(), Some("snponly-arm64.efi"));
+        assert_eq!(
+            ClientArch::Arm64Uefi.ipxe_bootfile(),
+            Some("snponly-arm64.efi")
+        );
        assert_eq!(ClientArch::Unknown(0xFFFF).ipxe_bootfile(), None);
    }

@@ -0,0 +1,249 @@
+//! Boot-event log — "who installed what, when, from where".
+//!
+//! Each `/boot/<entry>.ipxe` fetch that actually goes on to serve a boot
+//! script lands an entry here. The log is bounded in memory (newest-first,
+//! ring-buffered at [`BootLog::CAP`]) and is mirrored append-only to
+//! `<work_dir>/boot_log.jsonl`. Mirrors `HostBindings`'s "in-memory is
+//! authoritative, disk is a cache" policy — a corrupt log file should
+//! never block PXE for the network.
+//!
+//! We deliberately don't push these onto the `LogBus` (the operator
+//! terminal stream). The terminal already shows the http traces; the
+//! Host log is a curated, persistent, easy-to-scan view of "what got
+//! imaged on what hardware" and conflating the two would be noisy.
+
+use parking_lot::RwLock;
+use serde::{Deserialize, Serialize};
+use std::collections::VecDeque;
+use std::io::Write;
+use std::net::IpAddr;
+use std::path::PathBuf;
+use std::sync::Arc;
+use time::OffsetDateTime;
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct BootEvent {
+    #[serde(with = "time::serde::rfc3339")]
+    pub timestamp: OffsetDateTime,
+    /// Lowercase, colon-separated. `None` when iPXE didn't supply
+    /// `?mac=${mac}` in the chain URL (older bookmarks, custom scripts).
+    pub mac: Option<String>,
+    /// Connecting peer's IP — taken from the TCP socket when available
+    /// (PXE clients connect direct, no reverse proxy), and falls back to
+    /// `X-Forwarded-For` for the rare case where one is present.
+    pub ip: Option<IpAddr>,
+    /// `BootEntry::id` — the same id used in `/boot/<id>.ipxe`.
+    pub target_id: String,
+    /// Human-friendly label: the ISO's filename / volume label / entry
+    /// title. Pre-resolved at log time so the UI can render without
+    /// joining against the ISO store (and so "what image was installed?"
+    /// survives the operator deleting the ISO later).
+    pub target_title: String,
+}
+
+/// In-memory ring + disk-backed append log of boot events. Cheap to
+/// clone; the inner state is `Arc<RwLock<_>>`.
+#[derive(Debug, Clone)]
+pub struct BootLog {
+    path: Arc<PathBuf>,
+    inner: Arc<RwLock<VecDeque<BootEvent>>>,
+}
+
+impl BootLog {
+    /// Newest entries we retain in memory. Past this, the oldest gets
+    /// evicted — the on-disk JSONL keeps the full history for offline
+    /// inspection. 500 covers a typical install-day's worth without
+    /// turning the Hosts tab into a wall of text.
+    pub const CAP: usize = 500;
+
+    /// Load up to `CAP` newest events from `<work_dir>/boot_log.jsonl`,
+    /// or start empty if the file is missing / unreadable.
+    #[must_use]
+    pub fn load_or_default(work_dir: &std::path::Path) -> Self {
+        let path = work_dir.join("boot_log.jsonl");
+        let mut events = VecDeque::with_capacity(Self::CAP);
+        if let Ok(text) = std::fs::read_to_string(&path) {
+            for line in text.lines() {
+                if line.trim().is_empty() {
+                    continue;
+                }
+                match serde_json::from_str::<BootEvent>(line) {
+                    Ok(ev) => {
+                        if events.len() == Self::CAP {
+                            events.pop_front();
+                        }
+                        events.push_back(ev);
+                    }
+                    Err(e) => {
+                        tracing::warn!(
+                            target: "openpxe::boot_log",
+                            "skipping unparseable boot_log line: {e}"
+                        );
+                    }
+                }
+            }
+        }
+        Self {
+            path: Arc::new(path),
+            inner: Arc::new(RwLock::new(events)),
+        }
+    }
+
+    /// Append an event. Persistence is best-effort and never blocks the
+    /// caller on a failed write (the in-memory copy is the source of
+    /// truth for the live UI; the JSONL is just for crash survival).
+    pub fn record(&self, ev: &BootEvent) {
+        // Push into the ring first so a slow / failing disk doesn't lose
+        // events for the live UI.
+        {
+            let mut g = self.inner.write();
+            if g.len() == Self::CAP {
+                g.pop_front();
+            }
+            g.push_back(ev.clone());
+        }
+        tracing::info!(
+            target: "openpxe::boot_log",
+            mac = ev.mac.as_deref().unwrap_or("?"),
+            ip = ev.ip.map(|i| i.to_string()).as_deref().unwrap_or("?"),
+            target = %ev.target_id,
+            "boot event"
+        );
+        // Append to disk. We tolerate write failures — they'd show up as
+        // missing entries on the next restart only.
+        let mut line = match serde_json::to_string(ev) {
+            Ok(s) => s,
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "serialize boot event: {e}");
+                return;
+            }
+        };
+        line.push('\n');
+        if let Some(parent) = self.path.parent() {
+            let _ = std::fs::create_dir_all(parent);
+        }
+        match std::fs::OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(self.path.as_path())
+        {
+            Ok(mut f) => {
+                if let Err(e) = f.write_all(line.as_bytes()) {
+                    tracing::warn!(target: "openpxe::boot_log", "append boot_log.jsonl: {e}");
+                }
+            }
+            Err(e) => {
+                tracing::warn!(target: "openpxe::boot_log", "open boot_log.jsonl: {e}");
+            }
+        }
+    }
+
+    /// Newest-first snapshot, up to `CAP` entries.
+    #[must_use]
+    pub fn list(&self) -> Vec<BootEvent> {
+        let g = self.inner.read();
+        // VecDeque preserves insertion order; reverse so newest is first.
+        g.iter().rev().cloned().collect()
+    }
+
+    #[must_use]
+    pub fn len(&self) -> usize {
+        self.inner.read().len()
+    }
+
+    #[must_use]
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    /// Wipe in-memory + the on-disk file. Used by the `terminal clear`
+    /// equivalent or future operator action; not currently wired to a UI
+    /// button but exposed for completeness.
+    pub fn clear(&self) {
+        self.inner.write().clear();
+        let _ = std::fs::remove_file(self.path.as_path());
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use tempfile::tempdir;
+
+    fn ev(target: &str, mac: Option<&str>) -> BootEvent {
+        BootEvent {
+            timestamp: OffsetDateTime::now_utc(),
+            mac: mac.map(str::to_string),
+            ip: Some("10.0.0.42".parse().unwrap()),
+            target_id: target.into(),
+            target_title: format!("{target}.iso"),
+        }
+    }
+
+    #[test]
+    fn record_then_list_is_newest_first() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert!(log.is_empty());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", Some("aa:bb:cc:00:00:02")));
+        let list = log.list();
+        assert_eq!(list.len(), 2);
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+    }
+
+    #[test]
+    fn round_trip_through_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", Some("aa:bb:cc:00:00:01")));
+        log.record(&ev("beta", None));
+        drop(log);
+        let log2 = BootLog::load_or_default(dir.path());
+        assert_eq!(log2.len(), 2);
+        let list = log2.list();
+        assert_eq!(list[0].target_id, "beta");
+        assert_eq!(list[1].target_id, "alpha");
+        assert!(list[0].mac.is_none());
+        assert_eq!(list[1].mac.as_deref(), Some("aa:bb:cc:00:00:01"));
+    }
+
+    #[test]
+    fn ring_evicts_oldest_past_cap() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        for i in 0..(BootLog::CAP + 5) {
+            log.record(&ev(&format!("e{i}"), None));
+        }
+        assert_eq!(log.len(), BootLog::CAP);
+        let list = log.list();
+        // Newest first; the most recent push is the last index inserted.
+        assert_eq!(list[0].target_id, format!("e{}", BootLog::CAP + 4));
+        // Oldest in-memory should be the 6th push (0..5 were evicted).
+        assert_eq!(list[BootLog::CAP - 1].target_id, "e5");
+    }
+
+    #[test]
+    fn clear_wipes_memory_and_disk() {
+        let dir = tempdir().unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        log.record(&ev("alpha", None));
+        log.clear();
+        assert!(log.is_empty());
+        let log2 = BootLog::load_or_default(dir.path());
+        assert!(log2.is_empty());
+    }
+
+    #[test]
+    fn corrupt_disk_lines_are_skipped_not_fatal() {
+        // Write a file with one valid + one garbage line; loader should
+        // surface the valid one and skip the garbage.
+        let dir = tempdir().unwrap();
+        let path = dir.path().join("boot_log.jsonl");
+        let valid = serde_json::to_string(&ev("ok", Some("aa:bb:cc:00:00:09"))).unwrap();
+        std::fs::write(&path, format!("{valid}\nNOT_JSON\n{valid}\n")).unwrap();
+        let log = BootLog::load_or_default(dir.path());
+        assert_eq!(log.len(), 2);
+    }
+}
@@ -56,19 +56,25 @@ impl ClientRegistry {
    ) {
        let mut guard = self.inner.write();
        let now = OffsetDateTime::now_utc();
-        let entry = guard.entry(mac.to_string()).or_insert_with(|| ClientSnapshot {
-            mac: mac.to_string(),
-            last_ip: ip,
-            arch,
-            hostname: None,
-            first_seen: now,
-            last_seen: now,
-            events: Vec::new(),
-            selected_target: None,
-        });
+        let entry = guard
+            .entry(mac.to_string())
+            .or_insert_with(|| ClientSnapshot {
+                mac: mac.to_string(),
+                last_ip: ip,
+                arch,
+                hostname: None,
+                first_seen: now,
+                last_seen: now,
+                events: Vec::new(),
+                selected_target: None,
+            });
        entry.last_seen = now;
-        if ip.is_some() { entry.last_ip = ip; }
-        if arch.is_some() { entry.arch = arch; }
+        if ip.is_some() {
+            entry.last_ip = ip;
+        }
+        if arch.is_some() {
+            entry.arch = arch;
+        }
        entry.events.push((now, event));
        // Cap event history per client to keep memory bounded.
        const MAX_EVENTS: usize = 64;
@@ -54,7 +54,7 @@ pub enum DhcpMode {
    #[default]
    Proxy,
    /// Disabled — rely on an external DHCP server that has been manually
-    /// configured with `next-server` / `filename`. PXEForge only serves TFTP
+    /// configured with `next-server` / `filename`. OpenPXE only serves TFTP
    /// + HTTP in this mode. Useful for home routers that can be pre-set.
    Disabled,
 }
@@ -68,11 +68,11 @@ pub struct Paths {
    pub work_dir: PathBuf,
    /// Directory containing bundled iPXE binaries (undionly.kpxe, snponly.efi, ...).
    pub ipxe_dir: PathBuf,
-    /// Path to the wimboot binary for Windows ISOs (optional — feature-gated).
+    /// Path to the wimboot binary for Windows ISOs (optional — feature-controlled).
    pub wimboot_path: Option<PathBuf>,
    /// Directory under which Windows ISOs are extracted and served via SMB.
    /// Only used when `settings.windows_enabled = true`. Defaults to
-    /// `/var/lib/pxeforge/smb` in the container image.
+    /// `/var/lib/openpxe/smb` in the container image.
    pub smb_dir: PathBuf,
 }

@@ -104,11 +104,11 @@ impl Default for NetworkConfig {
 impl Default for Paths {
    fn default() -> Self {
        Self {
-            iso_dir: PathBuf::from("/var/lib/pxeforge/isos"),
-            work_dir: PathBuf::from("/var/lib/pxeforge/work"),
-            ipxe_dir: PathBuf::from("/usr/share/pxeforge/ipxe"),
+            iso_dir: PathBuf::from("/var/lib/openpxe/isos"),
+            work_dir: PathBuf::from("/var/lib/openpxe/work"),
+            ipxe_dir: PathBuf::from("/usr/share/openpxe/ipxe"),
            wimboot_path: None,
-            smb_dir: PathBuf::from("/var/lib/pxeforge/smb"),
+            smb_dir: PathBuf::from("/var/lib/openpxe/smb"),
        }
    }
 }
@@ -124,38 +124,46 @@ impl Config {
    }

    /// Apply environment variable overrides. Env var names follow the pattern
-    /// `PXEFORGE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
+    /// `OPENPXE_<SECTION>_<FIELD>`, uppercase. Unknown vars are ignored.
    /// Call this after loading the TOML file so env takes precedence.
    pub fn apply_env(&mut self) {
-        if let Ok(v) = std::env::var("PXEFORGE_HTTP_PORT") {
-            if let Ok(p) = v.parse() { self.server.http_port = p; }
+        if let Ok(v) = std::env::var("OPENPXE_HTTP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.server.http_port = p;
+            }
        }
-        if let Ok(v) = std::env::var("PXEFORGE_TFTP_PORT") {
-            if let Ok(p) = v.parse() { self.server.tftp_port = p; }
+        if let Ok(v) = std::env::var("OPENPXE_TFTP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.server.tftp_port = p;
+            }
        }
-        if let Ok(v) = std::env::var("PXEFORGE_DHCP_PORT") {
-            if let Ok(p) = v.parse() { self.network.dhcp_port = p; }
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_PORT") {
+            if let Ok(p) = v.parse() {
+                self.network.dhcp_port = p;
+            }
        }
-        if let Ok(v) = std::env::var("PXEFORGE_PUBLIC_IP") {
-            if let Ok(ip) = v.parse() { self.server.public_ip = Some(ip); }
+        if let Ok(v) = std::env::var("OPENPXE_PUBLIC_IP") {
+            if let Ok(ip) = v.parse() {
+                self.server.public_ip = Some(ip);
+            }
        }
-        if let Ok(v) = std::env::var("PXEFORGE_DHCP_MODE") {
+        if let Ok(v) = std::env::var("OPENPXE_DHCP_MODE") {
            self.network.dhcp_mode = match v.to_ascii_lowercase().as_str() {
                "proxy" => DhcpMode::Proxy,
                "disabled" | "off" | "none" => DhcpMode::Disabled,
                _ => self.network.dhcp_mode,
            };
        }
-        if let Ok(v) = std::env::var("PXEFORGE_ISO_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_ISO_DIR") {
            self.paths.iso_dir = PathBuf::from(v);
        }
-        if let Ok(v) = std::env::var("PXEFORGE_WORK_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_WORK_DIR") {
            self.paths.work_dir = PathBuf::from(v);
        }
-        if let Ok(v) = std::env::var("PXEFORGE_IPXE_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_IPXE_DIR") {
            self.paths.ipxe_dir = PathBuf::from(v);
        }
-        if let Ok(v) = std::env::var("PXEFORGE_SMB_DIR") {
+        if let Ok(v) = std::env::var("OPENPXE_SMB_DIR") {
            self.paths.smb_dir = PathBuf::from(v);
        }
    }
@@ -1,10 +1,9 @@
 //! Per-MAC host bindings.
 //!
-//! Inspired by the Tinkerbell `smee` "MAC-prepended URL" pattern: an
-//! operator can attach a preferred boot target (a `BootEntry::id`) to a
-//! specific MAC address. When a client with that MAC arrives, the
-//! top-level boot script chains straight to that target instead of
-//! showing the interactive menu.
+//! Operators can attach a preferred boot target (a `BootEntry::id`) to a
+//! specific MAC address. When a client with that MAC arrives, the top-level
+//! boot script chains straight to that target instead of showing the
+//! interactive menu.
 //!
 //! Use cases:
 //! - "This rack of Dell servers always images with Ubuntu Server 24.04"
@@ -29,7 +28,7 @@ pub struct HostBinding {
    /// don't have to worry about case.
    pub mac: String,
    /// Preferred boot entry id (matches a `BootEntry::id` in the iso
-    /// store) OR one of the reserved menu names: `_local`, `_gate`,
+    /// store) OR one of the reserved menu names: `_local`, `_queue`,
    /// `_tools_menu`. Empty string falls back to the menu.
    pub target: String,
    /// Optional human-readable label shown in the UI (`"Tom's laptop"`,
@@ -73,7 +72,7 @@ impl HostBindings {
                }
                Err(e) => {
                    tracing::warn!(
-                        target: "pxeforge::hosts",
+                        target: "openpxe::hosts",
                        "hosts.json present but unreadable ({e}); starting empty"
                    );
                    Inner::default()
@@ -149,7 +148,7 @@ impl HostBindings {
        let body = match serde_json::to_vec_pretty(&items) {
            Ok(b) => b,
            Err(e) => {
-                tracing::warn!(target: "pxeforge::hosts", "serialize hosts.json: {e}");
+                tracing::warn!(target: "openpxe::hosts", "serialize hosts.json: {e}");
                return;
            }
        };
@@ -158,11 +157,11 @@ impl HostBindings {
            let _ = std::fs::create_dir_all(parent);
        }
        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "pxeforge::hosts", "write hosts.json tmp: {e}");
+            tracing::warn!(target: "openpxe::hosts", "write hosts.json tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, self.path.as_path()) {
-            tracing::warn!(target: "pxeforge::hosts", "rename hosts.json: {e}");
+            tracing::warn!(target: "openpxe::hosts", "rename hosts.json: {e}");
        }
    }
 }
@@ -1,23 +1,25 @@
-//! PXEForge shared core: config, arch detection, client state registry,
-//! runtime settings, and the Gated Deployment queue.
+//! OpenPXE shared core: config, arch detection, client state registry,
+//! runtime settings, and the Queued Deployment queue.
 #![forbid(unsafe_code)]

 pub mod arch;
+pub mod boot_log;
 pub mod client;
 pub mod config;
 pub mod error;
-pub mod gate;
 pub mod host_bindings;
 pub mod log_bus;
 pub mod metrics;
+pub mod queue;
 pub mod settings;

 pub use arch::{ClientArch, FirmwareClass};
+pub use boot_log::{BootEvent, BootLog};
 pub use client::{ClientEvent, ClientRegistry, ClientSnapshot};
 pub use config::{Config, DhcpMode, NetworkConfig, Paths, ServerConfig};
 pub use error::{Error, Result};
-pub use gate::{Gate, GateQueue};
 pub use host_bindings::{normalize_mac, HostBinding, HostBindings};
 pub use log_bus::{LogBus, LogBusLayer, LogLine};
 pub use metrics::{HttpRoute, Metrics};
+pub use queue::{DeploymentQueue, QueueEntry};
 pub use settings::{Settings, SettingsStore, TimeoutAction};
@@ -38,7 +38,7 @@ impl LogLine {
    /// Compact one-line "tail -f"-style render.
    #[must_use]
    pub fn render(&self) -> String {
-        // 2026-04-29T12:34:56Z [info]  pxeforge::http: HTTP listening on 0.0.0.0:80
+        // 2026-04-29T12:34:56Z [info]  openpxe::http: HTTP listening on 0.0.0.0:80
        let ts = self
            .timestamp
            .format(&time::format_description::well_known::Rfc3339)
@@ -1,21 +1,21 @@
 //! Tiny lock-free Prometheus-compatible metrics.
 //!
 //! We don't pull in `prometheus` or `metrics-rs` for this — they bring
-//! their own runtime, registry, and complexity. PXEForge has a fixed,
+//! their own runtime, registry, and complexity. OpenPXE has a fixed,
 //! tiny set of counters/gauges and the exposition format is plain text.
 //! A handful of `AtomicU64`s and a `Display` impl gets us everything
 //! Prometheus / Grafana / VictoriaMetrics needs to scrape:
 //!
-//!   pxeforge_dhcp_replies_total       counter (per arch label)
-//!   pxeforge_tftp_transfers_total     counter (per status label)
-//!   pxeforge_tftp_bytes_total         counter
-//!   pxeforge_http_requests_total      counter (per route label)
-//!   pxeforge_iso_count                gauge
-//!   pxeforge_client_count             gauge
-//!   pxeforge_gate_count               gauge
-//!   pxeforge_gate_imaging             gauge
-//!   pxeforge_uptime_seconds           gauge
-//!   pxeforge_build_info{version}      gauge (always 1)
+//!   openpxe_dhcp_replies_total       counter (per arch label)
+//!   openpxe_tftp_transfers_total     counter (per status label)
+//!   openpxe_tftp_bytes_total         counter
+//!   openpxe_http_requests_total      counter (per route label)
+//!   openpxe_iso_count                gauge
+//!   openpxe_client_count             gauge
+//!   openpxe_queue_count               gauge
+//!   openpxe_queue_imaging             gauge
+//!   openpxe_uptime_seconds           gauge
+//!   openpxe_build_info{version}      gauge (always 1)
 //!
 //! Cheap to clone — internal state is a couple of arcs. Counters use
 //! `Relaxed` ordering: we don't synchronise across counters, just need
@@ -47,8 +47,8 @@ struct Inner {
    // Gauges (set explicitly; not cumulative)
    iso_count: AtomicU64,
    client_count: AtomicU64,
-    gate_count: AtomicU64,
-    gate_imaging: AtomicU64,
+    queue_count: AtomicU64,
+    queue_imaging: AtomicU64,
    nfs_mounts_active: AtomicU64,
 }

@@ -87,7 +87,9 @@ impl Metrics {
    }

    pub fn record_tftp_err(&self) {
-        self.inner.tftp_transfers_err.fetch_add(1, Ordering::Relaxed);
+        self.inner
+            .tftp_transfers_err
+            .fetch_add(1, Ordering::Relaxed);
    }

    // ── HTTP ───────────────────────────────────────────────────────────
@@ -113,9 +115,9 @@ impl Metrics {
        self.inner.client_count.store(n, Ordering::Relaxed);
    }

-    pub fn set_gate_counts(&self, total: u64, imaging: u64) {
-        self.inner.gate_count.store(total, Ordering::Relaxed);
-        self.inner.gate_imaging.store(imaging, Ordering::Relaxed);
+    pub fn set_queue_counts(&self, total: u64, imaging: u64) {
+        self.inner.queue_count.store(total, Ordering::Relaxed);
+        self.inner.queue_imaging.store(imaging, Ordering::Relaxed);
    }

    pub fn set_nfs_active(&self, n: u64) {
@@ -151,58 +153,64 @@ impl Metrics {
        };

        // Counters with one HELP/TYPE per metric name and per-label rows.
-        let _ = writeln!(out, "# HELP pxeforge_dhcp_replies_total Number of proxyDHCP replies sent, by client architecture.");
-        let _ = writeln!(out, "# TYPE pxeforge_dhcp_replies_total counter");
+        let _ = writeln!(out, "# HELP openpxe_dhcp_replies_total Number of proxyDHCP replies sent, by client architecture.");
+        let _ = writeln!(out, "# TYPE openpxe_dhcp_replies_total counter");
        let _ = writeln!(
            out,
-            "pxeforge_dhcp_replies_total{{arch=\"bios\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"bios\"}} {}",
            i.dhcp_replies_legacy.load(Ordering::Relaxed)
        );
        let _ = writeln!(
            out,
-            "pxeforge_dhcp_replies_total{{arch=\"uefi\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"uefi\"}} {}",
            i.dhcp_replies_uefi.load(Ordering::Relaxed)
        );
        let _ = writeln!(
            out,
-            "pxeforge_dhcp_replies_total{{arch=\"arm64\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"arm64\"}} {}",
            i.dhcp_replies_arm64.load(Ordering::Relaxed)
        );
        let _ = writeln!(
            out,
-            "pxeforge_dhcp_replies_total{{arch=\"unknown\"}} {}",
+            "openpxe_dhcp_replies_total{{arch=\"unknown\"}} {}",
            i.dhcp_replies_unknown.load(Ordering::Relaxed)
        );
        write_counter(
            &mut out,
-            "pxeforge_dhcp_declined_total",
+            "openpxe_dhcp_declined_total",
            "DHCP requests we saw but did not reply to (mac filter, arch unsupported, etc).",
            i.dhcp_declined.load(Ordering::Relaxed),
            "",
        );

-        let _ = writeln!(out, "# HELP pxeforge_tftp_transfers_total TFTP transfers, by status.");
-        let _ = writeln!(out, "# TYPE pxeforge_tftp_transfers_total counter");
        let _ = writeln!(
            out,
-            "pxeforge_tftp_transfers_total{{status=\"ok\"}} {}",
+            "# HELP openpxe_tftp_transfers_total TFTP transfers, by status."
+        );
+        let _ = writeln!(out, "# TYPE openpxe_tftp_transfers_total counter");
+        let _ = writeln!(
+            out,
+            "openpxe_tftp_transfers_total{{status=\"ok\"}} {}",
            i.tftp_transfers_ok.load(Ordering::Relaxed)
        );
        let _ = writeln!(
            out,
-            "pxeforge_tftp_transfers_total{{status=\"err\"}} {}",
+            "openpxe_tftp_transfers_total{{status=\"err\"}} {}",
            i.tftp_transfers_err.load(Ordering::Relaxed)
        );
        write_counter(
            &mut out,
-            "pxeforge_tftp_bytes_total",
+            "openpxe_tftp_bytes_total",
            "Total bytes successfully delivered over TFTP.",
            i.tftp_bytes.load(Ordering::Relaxed),
            "",
        );

-        let _ = writeln!(out, "# HELP pxeforge_http_requests_total HTTP requests served, by route family.");
-        let _ = writeln!(out, "# TYPE pxeforge_http_requests_total counter");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_http_requests_total HTTP requests served, by route family."
+        );
+        let _ = writeln!(out, "# TYPE openpxe_http_requests_total counter");
        for (label, counter) in [
            ("boot_script", &i.http_boot_script),
            ("iso_range", &i.http_iso_range),
@@ -212,22 +220,61 @@ impl Metrics {
        ] {
            let _ = writeln!(
                out,
-                "pxeforge_http_requests_total{{route=\"{label}\"}} {}",
+                "openpxe_http_requests_total{{route=\"{label}\"}} {}",
                counter.load(Ordering::Relaxed)
            );
        }

        // Gauges.
-        write_gauge(&mut out, "pxeforge_iso_count", "ISOs currently registered (local + NFS).", i.iso_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_client_count", "PXE clients seen this process lifetime.", i.client_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_gate_count", "Clients currently waiting at the deployment gate.", i.gate_count.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_gate_imaging", "Clients currently imaging (gate + assigned target).", i.gate_imaging.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_nfs_mounts_active", "NFS shares currently mounted.", i.nfs_mounts_active.load(Ordering::Relaxed), "");
-        write_gauge(&mut out, "pxeforge_uptime_seconds", "Seconds since this PXEForge instance started.", uptime_secs, "");
+        write_gauge(
+            &mut out,
+            "openpxe_iso_count",
+            "ISOs currently registered (local + NFS).",
+            i.iso_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_client_count",
+            "PXE clients seen this process lifetime.",
+            i.client_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_count",
+            "Clients currently waiting at the deployment queue.",
+            i.queue_count.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_queue_imaging",
+            "Clients currently imaging (queue + assigned target).",
+            i.queue_imaging.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_nfs_mounts_active",
+            "NFS shares currently mounted.",
+            i.nfs_mounts_active.load(Ordering::Relaxed),
+            "",
+        );
+        write_gauge(
+            &mut out,
+            "openpxe_uptime_seconds",
+            "Seconds since this OpenPXE instance started.",
+            uptime_secs,
+            "",
+        );

-        let _ = writeln!(out, "# HELP pxeforge_build_info Build metadata. Always 1; the version is in the label.");
-        let _ = writeln!(out, "# TYPE pxeforge_build_info gauge");
-        let _ = writeln!(out, "pxeforge_build_info{{version=\"{version}\"}} 1");
+        let _ = writeln!(
+            out,
+            "# HELP openpxe_build_info Build metadata. Always 1; the version is in the label."
+        );
+        let _ = writeln!(out, "# TYPE openpxe_build_info gauge");
+        let _ = writeln!(out, "openpxe_build_info{{version=\"{version}\"}} 1");

        out
    }
@@ -259,16 +306,20 @@ mod tests {
        m.record_http(HttpRoute::Api);
        m.set_iso_count(3);
        let out = m.render("0.2.0", 42);
-        assert_eq!(out.matches("# TYPE pxeforge_dhcp_replies_total counter").count(), 1);
-        assert_eq!(out.matches("# TYPE pxeforge_iso_count gauge").count(), 1);
-        assert!(out.contains("pxeforge_dhcp_replies_total{arch=\"uefi\"} 1"));
-        assert!(out.contains("pxeforge_dhcp_replies_total{arch=\"bios\"} 1"));
-        assert!(out.contains("pxeforge_tftp_transfers_total{status=\"ok\"} 1"));
-        assert!(out.contains("pxeforge_tftp_bytes_total 1024"));
-        assert!(out.contains("pxeforge_http_requests_total{route=\"api\"} 1"));
-        assert!(out.contains("pxeforge_iso_count 3"));
-        assert!(out.contains("pxeforge_uptime_seconds 42"));
-        assert!(out.contains("pxeforge_build_info{version=\"0.2.0\"} 1"));
+        assert_eq!(
+            out.matches("# TYPE openpxe_dhcp_replies_total counter")
+                .count(),
+            1
+        );
+        assert_eq!(out.matches("# TYPE openpxe_iso_count gauge").count(), 1);
+        assert!(out.contains("openpxe_dhcp_replies_total{arch=\"uefi\"} 1"));
+        assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 1"));
+        assert!(out.contains("openpxe_tftp_transfers_total{status=\"ok\"} 1"));
+        assert!(out.contains("openpxe_tftp_bytes_total 1024"));
+        assert!(out.contains("openpxe_http_requests_total{route=\"api\"} 1"));
+        assert!(out.contains("openpxe_iso_count 3"));
+        assert!(out.contains("openpxe_uptime_seconds 42"));
+        assert!(out.contains("openpxe_build_info{version=\"0.2.0\"} 1"));
    }

    #[test]
@@ -278,6 +329,6 @@ mod tests {
        a.record_dhcp_reply("bios");
        b.record_dhcp_reply("bios");
        let out = a.render("test", 0);
-        assert!(out.contains("pxeforge_dhcp_replies_total{arch=\"bios\"} 2"));
+        assert!(out.contains("openpxe_dhcp_replies_total{arch=\"bios\"} 2"));
    }
 }
@@ -1,16 +1,16 @@
-//! Gated Deployment queue.
+//! Queued Deployment queue.
 //!
-//! When a client selects "Gated Deployment" at the PXE menu, iPXE POSTs to
-//! `/api/gate/join` and receives a gate position. It then enters a poll
-//! loop hitting `/api/gate/poll/<id>`; the server holds the request open
+//! When a client selects "Queued Deployment" at the PXE menu, iPXE POSTs to
+//! `/api/queue/join` and receives a queue position. It then enters a poll
+//! loop hitting `/api/queue/poll/<id>`; the server holds the request open
 //! until either (a) the operator assigns an ISO from the WebUI, in which
 //! case the poll returns an iPXE `chain` URL, or (b) the poll times out
 //! (iPXE's HTTP client has its own timeout), in which case iPXE re-POSTs.
 //!
-//! The WebUI shows the queue (`GET /api/gate`) and issues
-//! `POST /api/gate/assign { iso_id, gate_ids: [...] }` to launch a single
-//! ISO across many gated clients at once. This is the "horse-race gate"
-//! UX the user asked for — every horse leaves the line simultaneously.
+//! The WebUI shows the queue (`GET /api/queue`) and issues
+//! `POST /api/queue/assign { iso_id, entry_ids: [...] }` to launch a single
+//! ISO across many queued clients at once. Every waiting machine receives
+//! the assignment without operator visits at the rack.

 use parking_lot::RwLock;
 use serde::{Deserialize, Serialize};
@@ -23,11 +23,11 @@ use uuid::Uuid;

 use crate::ClientArch;

-/// Per-gate state visible to the WebUI.
+/// Per-client queue state visible to the WebUI.
 #[derive(Debug, Clone, Serialize, Deserialize)]
-pub struct Gate {
+pub struct QueueEntry {
    pub id: String,
-    /// 1-based race-gate position — position 1 is whoever got there first.
+    /// 1-based queue position — position 1 is whoever got there first.
    pub position: u32,
    pub mac: String,
    pub ip: Option<IpAddr>,
@@ -40,7 +40,7 @@ pub struct Gate {
 }

 #[derive(Debug)]
-struct GateInner {
+struct QueueEntryInner {
    id: String,
    position: u32,
    mac: String,
@@ -54,9 +54,9 @@ struct GateInner {
    notify: Arc<Notify>,
 }

-impl GateInner {
-    fn snapshot(&self) -> Gate {
-        Gate {
+impl QueueEntryInner {
+    fn snapshot(&self) -> QueueEntry {
+        QueueEntry {
            id: self.id.clone(),
            position: self.position,
            mac: self.mac.clone(),
@@ -70,34 +70,38 @@ impl GateInner {
 }

 #[derive(Debug, Default)]
-pub struct GateQueue {
-    inner: RwLock<HashMap<String, GateInner>>,
+pub struct DeploymentQueue {
+    inner: RwLock<HashMap<String, QueueEntryInner>>,
 }

-impl GateQueue {
+impl DeploymentQueue {
    #[must_use]
    pub fn new() -> Arc<Self> {
        Arc::new(Self::default())
    }

-    /// Add a client to the gate. Returns the new `Gate` snapshot. If the
-    /// MAC is already queued, the existing gate is returned unchanged —
+    /// Add a client to the queue. Returns the current queue snapshot. If the
+    /// MAC is already queued, the existing entry is returned unchanged —
    /// retrying iPXE clients don't duplicate their slot.
-    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> Gate {
+    pub fn join(&self, mac: &str, ip: Option<IpAddr>, arch: Option<ClientArch>) -> QueueEntry {
        let now = OffsetDateTime::now_utc();
        let mut guard = self.inner.write();

        if let Some(existing) = guard.values_mut().find(|g| g.mac == mac) {
            existing.last_poll_at = now;
-            if ip.is_some() { existing.ip = ip; }
-            if arch.is_some() { existing.arch = arch; }
+            if ip.is_some() {
+                existing.ip = ip;
+            }
+            if arch.is_some() {
+                existing.arch = arch;
+            }
            return existing.snapshot();
        }

-        // Race position = max(position) + 1, or 1 if empty.
+        // Queue position = max(position) + 1, or 1 if empty.
        let next_pos = guard.values().map(|g| g.position).max().unwrap_or(0) + 1;
        let id = Uuid::new_v4().to_string();
-        let inner = GateInner {
+        let inner = QueueEntryInner {
            id: id.clone(),
            position: next_pos,
            mac: mac.to_string(),
@@ -113,29 +117,29 @@ impl GateQueue {
        snap
    }

-    /// Look up the `Notify` primitive for a given gate id, for long-polling.
+    /// Look up the `Notify` primitive for a given queue entry id, for long-polling.
    #[must_use]
-    pub fn notifier(&self, gate_id: &str) -> Option<Arc<Notify>> {
-        self.inner.read().get(gate_id).map(|g| g.notify.clone())
+    pub fn notifier(&self, entry_id: &str) -> Option<Arc<Notify>> {
+        self.inner.read().get(entry_id).map(|g| g.notify.clone())
    }

-    /// Update the last-poll timestamp (keeps the gate's "live" indicator
+    /// Update the last-poll timestamp (keeps the queue's "live" indicator
    /// fresh in the UI) and return the current snapshot. Returns None if
-    /// the gate was released/expired between requests.
-    pub fn touch(&self, gate_id: &str) -> Option<Gate> {
+    /// the entry was released/expired between requests.
+    pub fn touch(&self, entry_id: &str) -> Option<QueueEntry> {
        let mut guard = self.inner.write();
-        let g = guard.get_mut(gate_id)?;
+        let g = guard.get_mut(entry_id)?;
        g.last_poll_at = OffsetDateTime::now_utc();
        Some(g.snapshot())
    }

-    /// Operator assigns an ISO entry (boot_entry id) to one or more gates.
-    /// Returns the number of gates that were updated. Gates not in the
+    /// Operator assigns an ISO entry (boot_entry id) to one or more clients.
+    /// Returns the number of queue entries that were updated. Entries not in the
    /// queue are silently skipped.
-    pub fn assign(&self, gate_ids: &[String], target: &str) -> usize {
+    pub fn assign(&self, entry_ids: &[String], target: &str) -> usize {
        let mut guard = self.inner.write();
        let mut updated = 0;
-        for id in gate_ids {
+        for id in entry_ids {
            if let Some(g) = guard.get_mut(id) {
                g.assigned_target = Some(target.to_string());
                g.notify.notify_waiters();
@@ -145,11 +149,11 @@ impl GateQueue {
        updated
    }

-    /// Remove a gate and return its final snapshot. Called after the client
+    /// Remove a queue entry and return its final snapshot. Called after the client
    /// has successfully chained onto its assignment.
-    pub fn release(&self, gate_id: &str) -> Option<Gate> {
+    pub fn release(&self, entry_id: &str) -> Option<QueueEntry> {
        let mut guard = self.inner.write();
-        let g = guard.remove(gate_id)?;
+        let g = guard.remove(entry_id)?;
        g.notify.notify_waiters();
        // Renumber positions so the display stays contiguous (1..N). This
        // is O(N) but the queue is expected to be small (dozens of hosts).
@@ -162,9 +166,9 @@ impl GateQueue {
    }

    #[must_use]
-    pub fn list(&self) -> Vec<Gate> {
+    pub fn list(&self) -> Vec<QueueEntry> {
        let guard = self.inner.read();
-        let mut v: Vec<_> = guard.values().map(GateInner::snapshot).collect();
+        let mut v: Vec<_> = guard.values().map(QueueEntryInner::snapshot).collect();
        v.sort_by_key(|g| g.position);
        v
    }
@@ -186,7 +190,7 @@ mod tests {

    #[test]
    fn join_assigns_sequential_positions() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
        let g1 = q.join("aa:bb:cc:00:00:01", None, None);
        let g2 = q.join("aa:bb:cc:00:00:02", None, None);
        let g3 = q.join("aa:bb:cc:00:00:03", None, None);
@@ -197,7 +201,7 @@ mod tests {

    #[test]
    fn rejoining_same_mac_is_idempotent() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
        let g1 = q.join("aa:bb:cc:00:00:01", None, None);
        let g2 = q.join("aa:bb:cc:00:00:01", None, None);
        assert_eq!(g1.id, g2.id);
@@ -207,7 +211,7 @@ mod tests {

    #[test]
    fn assign_broadcasts_target() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
        let g1 = q.join("aa:bb:cc:00:00:01", None, None);
        let g2 = q.join("aa:bb:cc:00:00:02", None, None);
        let n = q.assign(&[g1.id.clone(), g2.id.clone()], "ubuntu-24-04-linux");
@@ -219,7 +223,7 @@ mod tests {

    #[test]
    fn release_renumbers() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
        let a = q.join("aa:00:00:00:00:01", None, None);
        let _b = q.join("aa:00:00:00:00:02", None, None);
        let c = q.join("aa:00:00:00:00:03", None, None);
@@ -234,7 +238,7 @@ mod tests {

    #[tokio::test]
    async fn assign_wakes_waiter() {
-        let q = GateQueue::new();
+        let q = DeploymentQueue::new();
        let g = q.join("aa:00:00:00:00:01", None, None);
        let notify = q.notifier(&g.id).unwrap();

@@ -47,13 +47,13 @@ pub struct Settings {
    /// `timeout_action = LocalHdd`).
    pub default_local_hdd: bool,

-    /// When a client hits the Gated Deployment item, how long (seconds) to
-    /// hold it at the gate before giving up and falling back to the menu.
+    /// When a client hits the Queued Deployment item, how long (seconds) to
+    /// hold it in queue before giving up and falling back to the menu.
    /// 0 = forever.
-    pub gate_wait_max_secs: u32,
+    pub queue_wait_max_secs: u32,

    /// Optional DNS server advertised on the Network tab. Purely
-    /// informational today — PXEForge does not run a DNS server, but
+    /// informational today — OpenPXE does not run a DNS server, but
    /// operators expect to be able to record what the upstream DNS is.
    /// Empty string = unset (UI shows placeholder).
    pub dns_server: String,
@@ -66,21 +66,22 @@ pub enum TimeoutAction {
    Stay,
    /// Chain the "Boot from Local HDD" entry.
    LocalHdd,
-    /// Put the client into the gate queue, waiting for operator assignment.
+    /// Put the client into the deployment queue, waiting for operator
+    /// assignment.
    #[default]
-    GatedDeployment,
+    QueuedDeployment,
 }

 impl Default for Settings {
    fn default() -> Self {
        Self {
            boot_menu_timeout_secs: 600,
-            timeout_action: TimeoutAction::GatedDeployment,
+            timeout_action: TimeoutAction::QueuedDeployment,
            windows_enabled: false,
            smb_host_override: String::new(),
            extra_kernel_args: String::new(),
            default_local_hdd: true,
-            gate_wait_max_secs: 0,
+            queue_wait_max_secs: 0,
            dns_server: String::new(),
        }
    }
@@ -103,7 +104,7 @@ impl SettingsStore {
                Ok(s) => s,
                Err(e) => {
                    tracing::warn!(
-                        target: "pxeforge::settings",
+                        target: "openpxe::settings",
                        "settings.json present but unreadable ({e}); falling back to defaults"
                    );
                    Settings::default()
@@ -111,7 +112,10 @@ impl SettingsStore {
            },
            Err(_) => Settings::default(),
        };
-        Arc::new(Self { path, inner: RwLock::new(initial) })
+        Arc::new(Self {
+            path,
+            inner: RwLock::new(initial),
+        })
    }

    #[must_use]
@@ -130,7 +134,7 @@ impl SettingsStore {
        }
        let snap = self.snapshot();
        if let Err(e) = self.persist(&snap) {
-            tracing::warn!(target: "pxeforge::settings", "failed to persist settings: {e}");
+            tracing::warn!(target: "openpxe::settings", "failed to persist settings: {e}");
        }
    }

@@ -157,7 +161,7 @@ mod tests {
        let store = SettingsStore::load_or_default(dir.path());
        let s = store.snapshot();
        assert_eq!(s.boot_menu_timeout_secs, 600);
-        assert_eq!(s.timeout_action, TimeoutAction::GatedDeployment);
+        assert_eq!(s.timeout_action, TimeoutAction::QueuedDeployment);
        assert!(!s.windows_enabled);
    }

@@ -177,6 +181,12 @@ mod tests {
        assert!(s.windows_enabled);
    }

+    #[test]
+    fn settings_serialize_queue_naming() {
+        let text = serde_json::to_string(&Settings::default()).unwrap();
+        assert!(text.contains("queue_wait_max_secs"));
+    }
+
    #[test]
    fn corrupt_file_falls_back_to_default() {
        let dir = tempdir().unwrap();
@@ -1,16 +1,16 @@
 [package]
-name = "pxeforge-dhcp-proxy"
+name = "openpxe-dhcp-proxy"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "DHCP proxy (RFC 4578) for PXEForge — serves boot info, does not lease IPs"
+description = "DHCP proxy (RFC 4578) for OpenPXE — serves boot info, does not lease IPs"

 [lints]
 workspace = true

 [dependencies]
-pxeforge-core.workspace = true
+openpxe-core.workspace = true
 tokio.workspace = true
 socket2.workspace = true
 dhcproto.workspace = true
@@ -9,7 +9,7 @@
 //!     pass, or the HTTP URL of the boot script once iPXE has chained.

 use dhcproto::v4::{DhcpOption, Message, MessageType, Opcode, OptionCode};
-use pxeforge_core::{ClientArch, FirmwareClass};
+use openpxe_core::{ClientArch, FirmwareClass};
 use std::net::Ipv4Addr;

 /// Where the reply directs the client next.
@@ -56,11 +56,17 @@ pub fn decide(ctx: &ReplyContext<'_>) -> BootDirective {
            // it'll then do the same script-fetch the iPXE path does.
            let name = ctx.arch.ipxe_bootfile().unwrap_or("snponly.efi");
            BootDirective::HttpScript {
-                url: format!("{}/ipxe/{}", ctx.public_base_url.trim_end_matches('/'), name),
+                url: format!(
+                    "{}/ipxe/{}",
+                    ctx.public_base_url.trim_end_matches('/'),
+                    name
+                ),
            }
        }
        FirmwareClass::PxeClient => match ctx.arch.ipxe_bootfile() {
-            Some(name) => BootDirective::TftpIpxe { filename: name.to_string() },
+            Some(name) => BootDirective::TftpIpxe {
+                filename: name.to_string(),
+            },
            None => BootDirective::Ignore,
        },
        FirmwareClass::Other => BootDirective::Ignore,
@@ -107,12 +113,16 @@ pub fn build_reply(ctx: &ReplyContext<'_>, directive: &BootDirective) -> Option<

    match directive {
        BootDirective::TftpIpxe { filename } => {
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
            opts.insert(DhcpOption::BootfileName(filename.as_bytes().to_vec()));
        }
        BootDirective::HttpScript { url } => {
            opts.insert(DhcpOption::BootfileName(url.as_bytes().to_vec()));
-            opts.insert(DhcpOption::TFTPServerName(ctx.our_ip.to_string().into_bytes()));
+            opts.insert(DhcpOption::TFTPServerName(
+                ctx.our_ip.to_string().into_bytes(),
+            ));
        }
        BootDirective::Ignore => return None,
    }
@@ -4,9 +4,7 @@
 use crate::reply::{build_reply, decide, BootDirective, ReplyContext};
 use dhcproto::v4::{DhcpOption, Message, OptionCode};
 use dhcproto::{Decodable, Decoder, Encodable, Encoder};
-use pxeforge_core::{
-    ClientArch, ClientEvent, ClientRegistry, FirmwareClass,
-};
+use openpxe_core::{ClientArch, ClientEvent, ClientRegistry, FirmwareClass};
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, Ipv4Addr, SocketAddr, SocketAddrV4};
 use std::sync::Arc;
@@ -19,7 +17,7 @@ pub struct DhcpProxyServer {
    our_ip: Ipv4Addr,
    public_base_url: String,
    clients: Arc<ClientRegistry>,
-    metrics: pxeforge_core::Metrics,
+    metrics: openpxe_core::Metrics,
 }

 impl DhcpProxyServer {
@@ -30,7 +28,7 @@ impl DhcpProxyServer {
        our_ip: Ipv4Addr,
        public_base_url: String,
        clients: Arc<ClientRegistry>,
-        metrics: pxeforge_core::Metrics,
+        metrics: openpxe_core::Metrics,
    ) -> Self {
        Self {
            bind,
@@ -47,7 +45,7 @@ impl DhcpProxyServer {
        let dhcp_sock = bind_udp(self.bind, self.dhcp_port, true)?;
        let pxe_sock = bind_udp(self.bind, self.pxe_port, false)?;
        tracing::info!(
-            target: "pxeforge::dhcp",
+            target: "openpxe::dhcp",
            "DHCP proxy listening on {}:{} and :{}",
            self.bind, self.dhcp_port, self.pxe_port
        );
@@ -67,12 +65,12 @@ impl DhcpProxyServer {
            let (n, from) = match sock.recv_from(&mut buf).await {
                Ok(v) => v,
                Err(e) => {
-                    tracing::warn!(target: "pxeforge::dhcp", port=label, "recv error: {e}");
+                    tracing::warn!(target: "openpxe::dhcp", port=label, "recv error: {e}");
                    continue;
                }
            };
            if let Err(e) = self.handle_datagram(&sock, &buf[..n], from, label).await {
-                tracing::warn!(target: "pxeforge::dhcp", port=label, "handle error: {e}");
+                tracing::warn!(target: "openpxe::dhcp", port=label, "handle error: {e}");
            }
        }
    }
@@ -86,11 +84,22 @@ impl DhcpProxyServer {
    ) -> anyhow::Result<()> {
        let request = Message::decode(&mut Decoder::new(data))?;

-        let vendor_class = request.opts().get(OptionCode::ClassIdentifier).and_then(|o| {
-            if let DhcpOption::ClassIdentifier(v) = o { Some(v.as_slice()) } else { None }
-        });
+        let vendor_class = request
+            .opts()
+            .get(OptionCode::ClassIdentifier)
+            .and_then(|o| {
+                if let DhcpOption::ClassIdentifier(v) = o {
+                    Some(v.as_slice())
+                } else {
+                    None
+                }
+            });
        let user_class = request.opts().get(OptionCode::UserClass).and_then(|o| {
-            if let DhcpOption::UserClass(v) = o { Some(v.as_slice()) } else { None }
+            if let DhcpOption::UserClass(v) = o {
+                Some(v.as_slice())
+            } else {
+                None
+            }
        });
        let class = FirmwareClass::classify(vendor_class, user_class);
        if matches!(class, FirmwareClass::Other) {
@@ -128,21 +137,23 @@ impl DhcpProxyServer {
        if matches!(directive, BootDirective::Ignore) {
            self.metrics.record_dhcp_decline();
            tracing::debug!(
-                target: "pxeforge::dhcp",
+                target: "openpxe::dhcp",
                mac=%mac, arch=?arch, "ignoring — no bootfile for arch"
            );
            return Ok(());
        }
        self.metrics.record_dhcp_reply(arch.as_str());

-        let Some(reply) = build_reply(&ctx, &directive) else { return Ok(()); };
+        let Some(reply) = build_reply(&ctx, &directive) else {
+            return Ok(());
+        };
        let mut out = Vec::with_capacity(512);
        reply.encode(&mut Encoder::new(&mut out))?;

        let dest = reply_destination(&request, from);
        sock.send_to(&out, dest).await?;
        tracing::info!(
-            target: "pxeforge::dhcp",
+            target: "openpxe::dhcp",
            mac=%mac, arch=arch.as_str(), class=?class, dest=%dest, directive=?directive,
            "PXE reply sent"
        );
@@ -203,7 +214,10 @@ fn bind_udp(bind: IpAddr, port: u16, broadcast: bool) -> anyhow::Result<UdpSocke

 fn format_mac(chaddr: &[u8]) -> String {
    let take = chaddr.iter().take(6).copied().collect::<Vec<_>>();
-    take.iter().map(|b| format!("{b:02x}")).collect::<Vec<_>>().join(":")
+    take.iter()
+        .map(|b| format!("{b:02x}"))
+        .collect::<Vec<_>>()
+        .join(":")
 }

 /// Walk raw DHCP options looking for option 93 (Client System Architecture)
@@ -217,10 +231,17 @@ fn extract_raw_arch(packet: &[u8]) -> Option<u16> {
    let mut i = 0;
    while i < opts.len() {
        let code = opts[i];
-        if code == 0xff { return None; }     // END
-        if code == 0x00 { i += 1; continue; } // PAD
+        if code == 0xff {
+            return None;
+        } // END
+        if code == 0x00 {
+            i += 1;
+            continue;
+        } // PAD
        i += 1;
-        if i >= opts.len() { return None; }
+        if i >= opts.len() {
+            return None;
+        }
        let len = opts[i] as usize;
        i += 1;
        if code == 93 && len >= 2 && i + 2 <= opts.len() {
@@ -240,7 +261,7 @@ mod tests {
        // Minimal BOOTP header + magic cookie + option 93 (arch)=0x0007 + END.
        let mut pkt = vec![0u8; 240];
        pkt[236..240].copy_from_slice(&[99, 130, 83, 99]); // magic cookie
-        pkt.extend_from_slice(&[53, 1, 1]);  // option 53 DHCPDISCOVER
+        pkt.extend_from_slice(&[53, 1, 1]); // option 53 DHCPDISCOVER
        pkt.extend_from_slice(&[93, 2, 0x00, 0x07]);
        pkt.push(0xff);
        assert_eq!(extract_raw_arch(&pkt), Some(0x0007));
@@ -1,5 +1,5 @@
 [package]
-name = "pxeforge-http-api"
+name = "openpxe-http-api"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,10 +10,10 @@ description = "HTTP server: ISO uploads, iPXE script generation, ISO streaming"
 workspace = true

 [dependencies]
-pxeforge-core.workspace = true
-pxeforge-iso-store.workspace = true
-pxeforge-ipxe-assets.workspace = true
-pxeforge-webui.workspace = true
+openpxe-core.workspace = true
+openpxe-iso-store.workspace = true
+openpxe-ipxe-assets.workspace = true
+openpxe-webui.workspace = true
 tokio.workspace = true
 tokio-util.workspace = true
 tokio-stream.workspace = true
@@ -31,6 +31,7 @@ bytes.workspace = true
 futures.workspace = true
 mime.workspace = true
 mime_guess.workspace = true
+uuid.workspace = true

 [dev-dependencies]
 tokio = { workspace = true, features = ["macros", "rt", "rt-multi-thread", "time"] }
@@ -8,12 +8,12 @@
 //!     > Boot from Local HDD
 //!   Installers
 //!     > Linux Installers   -> submenu of Linux ISOs
-//!     > Windows Installers -> submenu of Windows ISOs  (gated by Settings::windows_enabled)
+//!     > Windows Installers -> submenu of Windows ISOs  (controlled by Settings::windows_enabled)
 //!   Tools
 //!     > Utilities          -> memtest, etc. (embedded assets only)
-//!     > PXEForge Shell     -> drop to iPXE shell with branded prompt
+//!     > OpenPXE Shell     -> drop to iPXE shell with branded prompt
 //!     > Network Card Info  -> ifstat / config / route dump
-//!   Gated Deployment       -> join the gate queue
+//!   Queued Deployment       -> join the deployment queue
 //! ```
 //!
 //! ## iPXE is entirely backend — users do not see or write iPXE
@@ -22,12 +22,12 @@
 //! those knobs into iPXE primitives (chain, menu, item, choose, etc.).
 //! There is intentionally no UI path to upload a custom `.ipxe` script.

-use pxeforge_core::{Settings, TimeoutAction};
-use pxeforge_iso_store::{BootEntry, BootKind, IsoMeta};
-use pxeforge_iso_store::introspect::DistroFamily;
+use openpxe_core::{Settings, TimeoutAction};
+use openpxe_iso_store::introspect::DistroFamily;
+use openpxe_iso_store::{BootEntry, BootKind, IsoMeta};
 use std::fmt::Write as _;

-/// Top-level PXEForge boot menu. Serialized identically for BIOS and UEFI
+/// Top-level OpenPXE boot menu. Serialized identically for BIOS and UEFI
 /// clients because iPXE normalises the menu primitives across firmwares.
 #[must_use]
 pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> String {
@@ -35,7 +35,7 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    let base = base_url.trim_end_matches('/');
    let timeout_ms = settings.boot_menu_timeout_secs.saturating_mul(1000);
    let default_item = match settings.timeout_action {
-        TimeoutAction::GatedDeployment => "gate",
+        TimeoutAction::QueuedDeployment => "queue",
        // Stay -> iPXE's `--timeout 0` is "no timeout". Pick any default
        // label; the client waits for keypress. We use the same label as
        // LocalHdd to keep the menu's pre-highlight stable.
@@ -43,15 +43,21 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    };

    let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# PXEForge top-level menu - auto-generated, do not edit");
+    let _ = writeln!(s, "# OpenPXE top-level menu - auto-generated, do not edit");
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, "set esc:hex 1b");
    let _ = writeln!(s, "set cls ${{esc:string}}[2J");
    let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - network boot menu");
-    let _ = writeln!(s, "item --gap -- ------------------------- Default -------------------------");
+    let _ = writeln!(s, "menu OpenPXE - network boot menu");
+    let _ = writeln!(
+        s,
+        "item --gap -- ------------------------- Default -------------------------"
+    );
    let _ = writeln!(s, "item local            Boot from Local HDD");
-    let _ = writeln!(s, "item --gap -- ----------------------- Installers -----------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- ----------------------- Installers -----------------------"
+    );
    if has_family(isos, is_linux_family) {
        let _ = writeln!(s, "item linux            Linux Installers  >");
    } else {
@@ -64,28 +70,55 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
    } else {
        let _ = writeln!(s, "item --gap -- (Windows support disabled in Settings)");
    }
-    let _ = writeln!(s, "item --gap -- -------------------------- Tools --------------------------");
+    let _ = writeln!(
+        s,
+        "item --gap -- -------------------------- Tools --------------------------"
+    );
    let _ = writeln!(s, "item tools            Tools  >");
-    let _ = writeln!(s, "item --gap -- ---------------------- Gated Deployment ---------------------");
-    let _ = writeln!(s, "item gate             Gated Deployment  (join queue)");
+    let _ = writeln!(
+        s,
+        "item --gap -- ---------------------- Queued Deployment ---------------------"
+    );
+    let _ = writeln!(s, "item queue            Queued Deployment  (join queue)");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --key x exit     Exit iPXE");

    if matches!(settings.timeout_action, TimeoutAction::Stay) {
        let _ = writeln!(s, "choose --default {default_item} target || goto menu");
    } else {
-        let _ = writeln!(s, "choose --default {default_item} --timeout {timeout_ms} target || goto menu");
+        let _ = writeln!(
+            s,
+            "choose --default {default_item} --timeout {timeout_ms} target || goto menu"
+        );
    }

    // iPXE's `||` is strict about what follows. Each test uses `goto menu`
    // as the fallthrough target so the parser never sees a bare `||` with
    // trailing whitespace — some iPXE builds reject that.
-    let _ = writeln!(s, "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} gate    && chain {base}/boot/_gate.ipxe         || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} exit    && exit                                 || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} local   && chain {base}/boot/_local.ipxe        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} linux   && chain {base}/boot/_linux_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} windows && chain {base}/boot/_windows_menu.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} tools   && chain {base}/boot/_tools_menu.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} queue   && chain {base}/boot/_queue.ipxe         || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} exit    && exit                                 || goto menu"
+    );
    let _ = writeln!(s, "goto menu");
    s
 }
@@ -95,25 +128,44 @@ pub fn render_menu(isos: &[IsoMeta], settings: &Settings, base_url: &str) -> Str
 #[must_use]
 pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) -> String {
    let base = base_url.trim_end_matches('/');
-    let title = if is_windows { "Windows Installers" } else { "Linux Installers" };
+    let title = if is_windows {
+        "Windows Installers"
+    } else {
+        "Linux Installers"
+    };
    let label = if is_windows { "windows" } else { "linux" };
    let mut s = String::new();
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - {title}");
-    let filter: fn(DistroFamily) -> bool =
-        if is_windows { is_windows_family } else { is_linux_family };
+    let _ = writeln!(s, "menu OpenPXE - {title}");
+    let filter: fn(DistroFamily) -> bool = if is_windows {
+        is_windows_family
+    } else {
+        is_linux_family
+    };
    let mut count = 0;
    for iso in isos {
-        if !filter(iso.introspection.family) { continue; }
+        if !filter(iso.introspection.family) {
+            continue;
+        }
        for entry in &iso.boot_entries {
            let size_label = fmt_size_mib(iso.size_bytes);
            let key = hotkey_for_index(count);
+            // Visual hint: a leading `*` marks password-protected entries.
+            // ASCII only — iPXE's menu console mangles non-ASCII on some
+            // firmwares.
+            let lock = if iso.is_password_protected() {
+                "*"
+            } else {
+                " "
+            };
            let _ = writeln!(
-                s, "item {}{} [{:>6}] {}",
+                s,
+                "item {}{} {}[{:>6}] {}",
                key,
                entry.id,
+                lock,
                size_label,
                escape_label(&entry.title),
            );
@@ -126,8 +178,18 @@ pub fn render_family_menu(isos: &[IsoMeta], base_url: &str, is_windows: bool) ->
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --key b back   < Back to main menu");
    let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu");
-    let _ = writeln!(s, "chain {base}/boot/${{target}}.ipxe || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot.ipxe || goto menu"
+    );
+    // Pass `?mac=${mac}` so the per-entry handler can record the booting
+    // client into the Host log. iPXE substitutes `${mac}` before
+    // the HTTP fetch; if the firmware can't resolve it the literal
+    // `${mac}` is sent and the server treats it as "unknown".
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/${{target}}.ipxe?mac=${{mac}} || goto menu"
+    );
    s
 }

@@ -156,9 +218,9 @@ pub fn render_tools_menu(base_url: &str) -> String {
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, "set base-url {base}");
    let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - Tools");
+    let _ = writeln!(s, "menu OpenPXE - Tools");
    let _ = writeln!(s, "item --key u util     Utilities  (memtest, ...)");
-    let _ = writeln!(s, "item --key s shell    PXEForge Shell");
+    let _ = writeln!(s, "item --key s shell    OpenPXE Shell");
    let _ = writeln!(s, "item --key n nic      Network Card Info");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --key r reboot   Reboot Computer");
@@ -166,12 +228,30 @@ pub fn render_tools_menu(base_url: &str) -> String {
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item --key b back     < Back to main menu");
    let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} reboot   && reboot                        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} firmware && exit 0                        || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} util     && chain {base}/boot/_util.ipxe  || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} shell    && chain {base}/boot/_shell.ipxe || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} nic      && chain {base}/boot/_nic.ipxe   || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} reboot   && reboot                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} firmware && exit 0                        || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back     && chain {base}/boot.ipxe        || goto menu"
+    );
    let _ = writeln!(s, "goto menu");
    s
 }
@@ -185,8 +265,15 @@ pub fn render_local_hdd(base_url: &str) -> String {
    let mut s = String::new();
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, "# Boot from Local HDD - platform-sensitive");
-    let _ = writeln!(s, "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || ");
-    let _ = writeln!(s, "# UEFI path: fall through to the firmware's next boot entry");
+    let _ = writeln!(
+        s,
+        "iseq ${{platform}} pcbios && sanboot --no-describe --drive 0x80 || goto uefi"
+    );
+    let _ = writeln!(s, ":uefi");
+    let _ = writeln!(
+        s,
+        "# UEFI path: fall through to the firmware's next boot entry"
+    );
    let _ = writeln!(s, "exit 0");
    let _ = writeln!(s, "# If the above exit returns, loop back to the main menu");
    let _ = writeln!(s, "chain {base}/boot.ipxe");
@@ -202,25 +289,31 @@ pub fn render_util(base_url: &str) -> String {
    let mut s = String::new();
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, ":menu");
-    let _ = writeln!(s, "menu PXEForge - Utilities");
+    let _ = writeln!(s, "menu OpenPXE - Utilities");
    let _ = writeln!(s, "item memtest      MemTest86+ (RAM diagnostic)");
    let _ = writeln!(s, "item --gap");
    let _ = writeln!(s, "item back         < Back");
    let _ = writeln!(s, "choose target || goto menu");
-    let _ = writeln!(s, "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || ");
-    let _ = writeln!(s, "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || ");
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} memtest && chain {base}/ipxe/memtest.bin || goto menu"
+    );
+    let _ = writeln!(
+        s,
+        "iseq ${{target}} back && chain {base}/boot/_tools_menu.ipxe || goto menu"
+    );
    let _ = writeln!(s, "goto menu");
    s
 }

-/// "PXEForge Shell" — iPXE shell, branded.
+/// "OpenPXE Shell" — iPXE shell, branded.
 #[must_use]
 pub fn render_shell(base_url: &str) -> String {
    let base = base_url.trim_end_matches('/');
    let mut s = String::new();
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, "echo ==========================================");
-    let _ = writeln!(s, "echo   PXEForge Shell");
+    let _ = writeln!(s, "echo   OpenPXE Shell");
    let _ = writeln!(s, "echo   'exit' returns to the main menu");
    let _ = writeln!(s, "echo ==========================================");
    let _ = writeln!(s, "shell");
@@ -247,20 +340,23 @@ pub fn render_nic_info(base_url: &str) -> String {
    s
 }

-/// Gated Deployment entry point. Joins the queue, then enters a long-poll
+/// Queued Deployment entry point. Joins the queue, then enters a long-poll
 /// loop (iPXE repeats the chain on 3xx redirects / HTTP errors until a
 /// real script comes back).
 #[must_use]
-pub fn render_gate_entry(base_url: &str) -> String {
+pub fn render_queue_entry(base_url: &str) -> String {
    let base = base_url.trim_end_matches('/');
    let mut s = String::new();
    let _ = writeln!(s, "#!ipxe");
-    let _ = writeln!(s, "# Gated Deployment - join the queue and wait for operator");
-    let _ = writeln!(s, "echo Joining gate queue...");
+    let _ = writeln!(
+        s,
+        "# Queued Deployment - join the queue and wait for operator"
+    );
+    let _ = writeln!(s, "echo Joining deployment queue...");
    // imgfetch writes the body to a file in iPXE's transient FS; we read
-    // the gate id out of the Location-style header by asking the server
+    // the queue entry id out of the Location-style header by asking the server
    // to put it in the response body as a single token.
-    let _ = writeln!(s, "chain --replace {base}/api/gate/join?mac=${{mac}}");
+    let _ = writeln!(s, "chain --replace {base}/api/queue/join?mac=${{mac}}");
    s
 }

@@ -272,7 +368,11 @@ pub fn render_entry(entry: &BootEntry, settings: &Settings, base_url: &str) -> S
    let _ = writeln!(s, "#!ipxe");
    let _ = writeln!(s, "set base-url {base}");
    match &entry.kind {
-        BootKind::LinuxKernel { kernel_url, initrd_urls, args } => {
+        BootKind::LinuxKernel {
+            kernel_url,
+            initrd_urls,
+            args,
+        } => {
            let mut cmdline = args.cmdline.replace("${base-url}", base);
            if !settings.extra_kernel_args.trim().is_empty() {
                cmdline.push(' ');
@@ -323,5 +423,129 @@ fn has_family(isos: &[IsoMeta], pred: fn(DistroFamily) -> bool) -> bool {
 }

 fn escape_label(s: &str) -> String {
-    s.chars().map(|c| match c { '\n' | '\r' => ' ', c => c }).collect()
+    s.chars()
+        .map(|c| match c {
+            '\n' | '\r' => ' ',
+            c => c,
+        })
+        .collect()
+}
+
+/// Render the password-prompt script for a protected boot entry.
+///
+/// Flow on the client:
+///   1. iPXE clears any leftover ${password}, prints a banner naming the
+///      ISO so the operator knows what they're being asked for.
+///   2. `read --secret password` accepts input without echoing it to
+///      the screen.
+///   3. An empty input bails back to the main menu (lets the operator
+///      back out of a misclick).
+///   4. Otherwise the script chains the same /boot/<id>.ipxe URL but
+///      with `?token=${password:uristring}`. iPXE's `:uristring`
+///      modifier URL-encodes the value so `&`, `?`, `=`, spaces, etc.
+///      survive transport.
+///   5. The server replies with either the boot script (correct
+///      password) or [`render_password_failed`] (wrong password). On
+///      transport failure we fall back to the main menu.
+#[must_use]
+pub fn render_password_prompt(entry_id: &str, iso_filename: &str, base_url: &str) -> String {
+    let base = base_url.trim_end_matches('/');
+    let label = escape_label(iso_filename);
+    let mut s = String::new();
+    let _ = writeln!(s, "#!ipxe");
+    let _ = writeln!(s, "# OpenPXE password prompt for {label}");
+    let _ = writeln!(s, "echo");
+    let _ = writeln!(s, "echo ==========================================");
+    let _ = writeln!(s, "echo   This image requires a password");
+    let _ = writeln!(s, "echo   {label}");
+    let _ = writeln!(s, "echo   (enter alone returns to main menu)");
+    let _ = writeln!(s, "echo ==========================================");
+    let _ = writeln!(s, "set password ");
+    let _ = writeln!(s, "read --secret password");
+    let _ = writeln!(
+        s,
+        "iseq ${{password}} \"\" && chain {base}/boot.ipxe || goto submit"
+    );
+    let _ = writeln!(s, ":submit");
+    let _ = writeln!(s, "echo Verifying...");
+    // Carry `mac=${mac}` alongside the token so a successful unlock
+    // records the actual client MAC into the Host log. On
+    // older iPXE that can't resolve `${mac}` the server just stores it
+    // as "unknown" rather than refusing to boot.
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe?token=${{password:uristring}}&mac=${{mac}} \
+         || chain {base}/boot.ipxe"
+    );
+    s
+}
+
+/// Render the "wrong password" script. Tells the operator, sleeps for
+/// two seconds (gives the eye time to register the message and dampens
+/// brute-force rate without help from the server), and chains back to
+/// the same entry — which sends them through the prompt flow again.
+#[must_use]
+pub fn render_password_failed(entry_id: &str, base_url: &str) -> String {
+    let base = base_url.trim_end_matches('/');
+    let mut s = String::new();
+    let _ = writeln!(s, "#!ipxe");
+    let _ = writeln!(s, "echo");
+    let _ = writeln!(s, "echo Wrong password.");
+    let _ = writeln!(s, "sleep 2");
+    let _ = writeln!(
+        s,
+        "chain {base}/boot/{entry_id}.ipxe || chain {base}/boot.ipxe"
+    );
+    s
+}
+
+#[cfg(test)]
+mod password_tests {
+    use super::*;
+
+    #[test]
+    fn prompt_uses_secret_read_and_uri_escape() {
+        let s = render_password_prompt("alpha-linux", "Alpha Test.iso", "http://10.0.0.5");
+        assert!(s.starts_with("#!ipxe\n"));
+        assert!(s.contains("read --secret password"));
+        assert!(s.contains("Alpha Test.iso"));
+        // URI-string modifier on the var so passwords with `&`/spaces survive.
+        assert!(s.contains("token=${password:uristring}"));
+        // Empty enter sends back to the main menu, not back into the prompt
+        // (avoids a wedged client if the operator chose by mistake).
+        assert!(s.contains("&& chain http://10.0.0.5/boot.ipxe || goto submit"));
+        // Never log/echo the value.
+        assert!(!s.contains("echo ${password"));
+    }
+
+    #[test]
+    fn failed_chains_back_to_entry() {
+        let s = render_password_failed("alpha-linux", "http://10.0.0.5");
+        assert!(s.contains("Wrong password."));
+        // Re-target the entry so the prompt flow runs again.
+        assert!(s.contains("chain http://10.0.0.5/boot/alpha-linux.ipxe"));
+    }
+
+    #[test]
+    fn generated_scripts_do_not_emit_bare_or_trailing_fallbacks() {
+        let settings = Settings::default();
+        let scripts = [
+            render_menu(&[], &settings, "http://10.0.0.5"),
+            render_tools_menu("http://10.0.0.5"),
+            render_local_hdd("http://10.0.0.5"),
+            render_util("http://10.0.0.5"),
+            render_shell("http://10.0.0.5"),
+            render_nic_info("http://10.0.0.5"),
+            render_queue_entry("http://10.0.0.5"),
+            render_password_failed("alpha-linux", "http://10.0.0.5"),
+        ];
+        for script in scripts {
+            for line in script.lines() {
+                assert!(
+                    !line.trim_end().ends_with("||"),
+                    "bare iPXE fallback operator in line: {line}\nscript:\n{script}"
+                );
+            }
+        }
+    }
 }
@@ -31,7 +31,9 @@ pub fn lookup(iso_path: &Path, in_iso_path: &str) -> Option<FileLocation> {
        .split('/')
        .filter(|c| !c.is_empty())
        .collect();
-    if components.is_empty() { return None; }
+    if components.is_empty() {
+        return None;
+    }
    walk(&mut f, root.offset, root.length, &components)
 }

@@ -40,11 +42,16 @@ fn read_root_directory(f: &mut std::fs::File) -> Option<FileLocation> {
    let mut pvd = [0u8; 2048];
    f.seek(SeekFrom::Start(16 * SECTOR)).ok()?;
    f.read_exact(&mut pvd).ok()?;
-    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" { return None; }
+    if pvd[0] != 0x01 || &pvd[1..6] != b"CD001" {
+        return None;
+    }
    // Root directory record is at offset 156, length 34.
    let rec = &pvd[156..156 + 34];
    let (offset, length) = parse_dir_record_ext(rec)?;
-    Some(FileLocation { offset: offset * SECTOR, length })
+    Some(FileLocation {
+        offset: offset * SECTOR,
+        length,
+    })
 }

 /// Walk components down the directory tree starting at `dir_offset`.
@@ -66,21 +73,29 @@ fn walk(
        if len == 0 {
            // Padding to sector boundary.
            let next = (i / SECTOR as usize + 1) * SECTOR as usize;
-            if next <= i { break; }
+            if next <= i {
+                break;
+            }
            i = next;
            continue;
        }
-        if i + len > dir.len() { break; }
+        if i + len > dir.len() {
+            break;
+        }
        let rec = &dir[i..i + len];
        let name = dir_record_name(rec);
        let is_dir = (rec.get(25).copied().unwrap_or(0) & 0x02) != 0;
        // Skip "." (0x00) and ".." (0x01) pseudo-entries.
-        let is_pseudo = matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x00)
+        let is_pseudo = matches!(rec.get(32).copied(), Some(1))
+            && rec.get(33).copied() == Some(0x00)
            || matches!(rec.get(32).copied(), Some(1)) && rec.get(33).copied() == Some(0x01);
        if !is_pseudo && name.eq_ignore_ascii_case(target) {
            let (child_off, child_len) = parse_dir_record_ext(rec)?;
            if rest.is_empty() && !is_dir {
-                return Some(FileLocation { offset: child_off * SECTOR, length: child_len });
+                return Some(FileLocation {
+                    offset: child_off * SECTOR,
+                    length: child_len,
+                });
            } else if !rest.is_empty() && is_dir {
                return walk(f, child_off * SECTOR, child_len, rest);
            }
@@ -94,7 +109,9 @@ fn walk(
 /// Layout per ISO9660: bytes 2..10 extent LBA (LE+BE duplicate), 10..18
 /// data length (LE+BE duplicate). We trust the little-endian copy.
 fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
-    if rec.len() < 34 { return None; }
+    if rec.len() < 34 {
+        return None;
+    }
    let lba = u32::from_le_bytes(rec[2..6].try_into().ok()?) as u64;
    let len = u32::from_le_bytes(rec[10..14].try_into().ok()?) as u64;
    Some((lba, len))
@@ -104,9 +121,15 @@ fn parse_dir_record_ext(rec: &[u8]) -> Option<(u64, u64)> {
 /// `;1` version suffix.
 fn dir_record_name(rec: &[u8]) -> String {
    let name_len = *rec.get(32).unwrap_or(&0) as usize;
-    if name_len == 0 || rec.len() < 33 + name_len { return String::new(); }
+    if name_len == 0 || rec.len() < 33 + name_len {
+        return String::new();
+    }
    let raw = &rec[33..33 + name_len];
    let s = String::from_utf8_lossy(raw).to_string();
    // Strip `;N` version suffix.
-    if let Some(i) = s.rfind(';') { s[..i].to_string() } else { s }
+    if let Some(i) = s.rfind(';') {
+        s[..i].to_string()
+    } else {
+        s
+    }
 }
@@ -1,5 +1,5 @@
 //! HTTP server — single axum app that serves:
-//!   - `/`                   the web UI (static assets from `pxeforge-webui`)
+//!   - `/`                   the web UI (static assets from `openpxe-webui`)
 //!   - `/api/*`              JSON API for the web UI
 //!   - `/boot.ipxe`          the generated top-level iPXE boot menu
 //!   - `/boot/<entry>.ipxe`  per-entry iPXE scripts (one per boot target)
@@ -19,6 +19,7 @@ pub mod iso_fs;
 pub mod log_stream;
 pub mod state;
 pub mod terminal;
+pub mod uploads;

 pub use app::build_router;
 pub use state::AppState;
@@ -12,7 +12,7 @@ use axum::{
    Json,
 };
 use futures::stream::{Stream, StreamExt};
-use pxeforge_core::LogLine;
+use openpxe_core::LogLine;
 use serde_json::json;
 use std::convert::Infallible;
 use std::time::Duration;
@@ -36,9 +36,11 @@ pub async fn stream(
    let rx = state.log_bus.subscribe();
    let live = BroadcastStream::new(rx).map(|res| match res {
        Ok(line) => Ok(Event::default().data(line_json(&line))),
-        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => Ok(Event::default()
-            .event("lagged")
-            .data(json!({ "skipped": n }).to_string())),
+        Err(tokio_stream::wrappers::errors::BroadcastStreamRecvError::Lagged(n)) => {
+            Ok(Event::default()
+                .event("lagged")
+                .data(json!({ "skipped": n }).to_string()))
+        }
    });

    Sse::new(recent_stream.chain(live))
@@ -55,9 +57,11 @@ pub async fn recent(State(state): State<AppState>) -> Json<serde_json::Value> {
 /// keep streaming new lines as they arrive).
 pub async fn clear(State(state): State<AppState>) -> Json<serde_json::Value> {
    state.log_bus.clear();
-    state
-        .log_bus
-        .push("info", "pxeforge::terminal", "log buffer cleared by operator");
+    state.log_bus.push(
+        "info",
+        "openpxe::terminal",
+        "log buffer cleared by operator",
+    );
    Json(json!({ "ok": true }))
 }

@@ -1,5 +1,8 @@
-use pxeforge_core::{ClientRegistry, GateQueue, HostBindings, LogBus, Metrics, SettingsStore};
-use pxeforge_iso_store::{IsoStore, NfsManager, SmbManager};
+use crate::uploads::UploadSessions;
+use openpxe_core::{
+    BootLog, ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore,
+};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
 use std::sync::Arc;
 use time::OffsetDateTime;

@@ -8,11 +11,15 @@ pub struct AppState {
    pub iso_store: IsoStore,
    pub clients: Arc<ClientRegistry>,
    pub settings: Arc<SettingsStore>,
-    pub gates: Arc<GateQueue>,
+    pub queue: Arc<DeploymentQueue>,
    /// Per-MAC iPXE script overrides. When a client matching one of
    /// these MACs requests `/boot.ipxe`, we chain straight to the
    /// configured target instead of rendering the menu.
    pub hosts: HostBindings,
+    /// Persistent boot-event log surfaced under the Hosts tab. Records
+    /// every `/boot/<entry>.ipxe` chain that goes on to serve a script
+    /// (i.e. an image actually starting to install on a machine).
+    pub boot_log: BootLog,
    /// Lock-free metrics counters surfaced at `/metrics` in Prometheus
    /// text format. Cheap to clone (handles to atomics).
    pub metrics: Metrics,
@@ -25,6 +32,10 @@ pub struct AppState {
    /// available in the runtime image. Surfaces errors per-mount rather
    /// than failing the global state.
    pub nfs: NfsManager,
+    /// Browser chunked upload state. Multipart uploads still go straight
+    /// through `IsoStore`, but the UI uses sessions so large ISO transfers
+    /// can show deterministic progress and leave visible partial files.
+    pub uploads: UploadSessions,
    /// Live log bus consumed by the Terminal tab via SSE. Operator-issued
    /// terminal commands also push synthetic lines onto it so the tail
    /// shows them inline.
@@ -31,12 +31,17 @@ pub async fn run_command(
 ) -> impl IntoResponse {
    let line = req.command.trim();
    if line.is_empty() {
-        return (StatusCode::OK, Json(json!({ "output": HELP_TEXT, "ok": true })));
+        return (
+            StatusCode::OK,
+            Json(json!({ "output": HELP_TEXT, "ok": true })),
+        );
    }

    // Echo the typed command into the live log so the Terminal tab shows
    // operator activity in-band with server-emitted log lines.
-    state.log_bus.push("info", "pxeforge::terminal", format!("> {line}"));
+    state
+        .log_bus
+        .push("info", "openpxe::terminal", format!("> {line}"));

    let argv = shell_split(line);
    if argv.is_empty() {
@@ -55,14 +60,18 @@ pub async fn run_command(
    // so reading the live tail tells the same story as scrolling the
    // terminal pane.
    let mirror = if output.len() > 1024 {
-        format!("{}\n... ({} bytes truncated)", &output[..1024], output.len() - 1024)
+        format!(
+            "{}\n... ({} bytes truncated)",
+            &output[..1024],
+            output.len() - 1024
+        )
    } else {
        output.clone()
    };
    if ok {
-        state.log_bus.push("info", "pxeforge::terminal", mirror);
+        state.log_bus.push("info", "openpxe::terminal", mirror);
    } else {
-        state.log_bus.push("warn", "pxeforge::terminal", mirror);
+        state.log_bus.push("warn", "openpxe::terminal", mirror);
    }

    (StatusCode::OK, Json(json!({ "output": output, "ok": ok })))
@@ -73,12 +82,12 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
    let tail = &argv[1..];
    match head {
        "help" | "?" => Ok(HELP_TEXT.to_string()),
-        "version" => Ok(format!("pxeforge {}", env!("CARGO_PKG_VERSION"))),
+        "version" => Ok(format!("openpxe {}", env!("CARGO_PKG_VERSION"))),
        "uptime" => Ok(uptime_string(state)),
        "status" => Ok(status_text(state)),
        "isos" | "images" => Ok(isos_text(state)),
        "clients" => Ok(clients_text(state)),
-        "gate" => gate_command(state, tail).await,
+        "queue" => queue_command(state, tail).await,
        "nfs" => nfs_command(state, tail).await,
        "smb" => smb_command(state, tail).await,
        "log" => log_command(state, tail),
@@ -96,29 +105,39 @@ async fn dispatch(state: &AppState, argv: &[String]) -> Result<String, String> {
 fn status_text(s: &AppState) -> String {
    let isos = s.iso_store.list();
    let clients = s.clients.list();
-    let gates = s.gates.list();
+    let queue_entries = s.queue.list();
    let smb = s.smb.as_ref().map(|m| m.snapshot());
    let nfs = s.nfs.list();
    let nfs_active = nfs.iter().filter(|m| m.mounted).count();
    format!(
-        "PXEForge {ver}\n\
+        "OpenPXE {ver}\n\
         base url:     {base}\n\
         interface:    {nic}\n\
         uptime:       {up}\n\
         isos:         {n_isos}  (local: {n_local}, nfs: {n_nfs})\n\
         clients:      {n_clients}\n\
-         gates:        {n_gates}\n\
+         queue:        {n_entries}\n\
         smb:          {smb}\n\
         nfs mounts:   {n_total} configured ({n_active} active)\n",
        ver = env!("CARGO_PKG_VERSION"),
        base = s.public_base_url,
-        nic = if s.nic_name.is_empty() { "?" } else { s.nic_name.as_str() },
+        nic = if s.nic_name.is_empty() {
+            "?"
+        } else {
+            s.nic_name.as_str()
+        },
        up = uptime_string(s),
        n_isos = isos.len(),
-        n_local = isos.iter().filter(|i| matches!(i.source, pxeforge_iso_store::IsoSource::Local)).count(),
-        n_nfs = isos.iter().filter(|i| !matches!(i.source, pxeforge_iso_store::IsoSource::Local)).count(),
+        n_local = isos
+            .iter()
+            .filter(|i| matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
+        n_nfs = isos
+            .iter()
+            .filter(|i| !matches!(i.source, openpxe_iso_store::IsoSource::Local))
+            .count(),
        n_clients = clients.len(),
-        n_gates = gates.len(),
+        n_entries = queue_entries.len(),
        smb = smb.map_or_else(|| "(disabled)".into(), |s| format!("{s:?}")),
        n_total = nfs.len(),
        n_active = nfs_active,
@@ -138,8 +157,8 @@ fn isos_text(s: &AppState) -> String {
    );
    for i in isos {
        let src = match i.source {
-            pxeforge_iso_store::IsoSource::Local => "local".to_string(),
-            pxeforge_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
+            openpxe_iso_store::IsoSource::Local => "local".to_string(),
+            openpxe_iso_store::IsoSource::Nfs { mount_id, .. } => format!("nfs:{mount_id}"),
        };
        let _ = writeln!(
            out,
@@ -159,11 +178,7 @@ fn clients_text(s: &AppState) -> String {
        return "(no clients yet)".into();
    }
    let mut out = String::new();
-    let _ = writeln!(
-        out,
-        "{:<19} {:<16} {:<8} LAST SEEN",
-        "MAC", "IP", "EVENTS"
-    );
+    let _ = writeln!(out, "{:<19} {:<16} {:<8} LAST SEEN", "MAC", "IP", "EVENTS");
    for c in clients {
        let ip = c.last_ip.map_or_else(|| "-".into(), |i| i.to_string());
        let _ = writeln!(
@@ -180,35 +195,35 @@ fn clients_text(s: &AppState) -> String {
    out
 }

-// ── gate ───────────────────────────────────────────────────────────────
+// ── queue ──────────────────────────────────────────────────────────────

-// `async` for symmetry with the other dispatch helpers — gate operations
+// `async` for symmetry with the other dispatch helpers — queue operations
 // are sync today but might grow to await on a database in a future phase.
 #[allow(clippy::unused_async)]
-async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
+async fn queue_command(s: &AppState, args: &[String]) -> Result<String, String> {
    match args.first().map(String::as_str) {
        None | Some("list") => {
-            let gs = s.gates.list();
-            if gs.is_empty() {
-                return Ok("(no gates)".into());
+            let entries = s.queue.list();
+            if entries.is_empty() {
+                return Ok("(queue empty)".into());
            }
            let mut out = String::new();
-            for g in gs {
+            for entry in entries {
                let _ = writeln!(
                    out,
                    "#{:<3} {:<19} {:<16} target={}",
-                    g.position,
-                    g.mac,
-                    g.id,
-                    g.assigned_target.unwrap_or_else(|| "-".into())
+                    entry.position,
+                    entry.mac,
+                    entry.id,
+                    entry.assigned_target.unwrap_or_else(|| "-".into())
                );
            }
            Ok(out)
        }
        Some("assign-all") => {
-            let target = args.get(1).ok_or_else(|| {
-                "usage: gate assign-all <iso_boot_entry_id>".to_string()
-            })?;
+            let target = args
+                .get(1)
+                .ok_or_else(|| "usage: queue assign-all <iso_boot_entry_id>".to_string())?;
            let found = s
                .iso_store
                .list()
@@ -217,32 +232,34 @@ async fn gate_command(s: &AppState, args: &[String]) -> Result<String, String> {
            if !found {
                return Err(format!("no such boot entry: {target}"));
            }
-            let ids: Vec<_> = s.gates.list().into_iter().map(|g| g.id).collect();
-            let n = s.gates.assign(&ids, target);
-            Ok(format!("assigned {n} gates -> {target}"))
+            let ids: Vec<_> = s.queue.list().into_iter().map(|g| g.id).collect();
+            let n = s.queue.assign(&ids, target);
+            Ok(format!("assigned {n} queue entries -> {target}"))
        }
        Some("assign") => {
-            let gate_id = args
+            let entry_id = args
                .get(1)
-                .ok_or_else(|| "usage: gate assign <gate_id> <iso_boot_entry_id>".to_string())?;
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
            let target = args
                .get(2)
-                .ok_or_else(|| "usage: gate assign <gate_id> <iso_boot_entry_id>".to_string())?;
-            let n = s.gates.assign(std::slice::from_ref(gate_id), target);
+                .ok_or_else(|| "usage: queue assign <entry_id> <iso_boot_entry_id>".to_string())?;
+            let n = s.queue.assign(std::slice::from_ref(entry_id), target);
            if n == 0 {
-                return Err(format!("no such gate: {gate_id}"));
+                return Err(format!("no such queue entry: {entry_id}"));
            }
-            Ok(format!("assigned 1 gate -> {target}"))
+            Ok(format!("assigned 1 queue entry -> {target}"))
        }
        Some("release") => {
-            let gate_id = args.get(1).ok_or_else(|| "usage: gate release <gate_id>".to_string())?;
-            match s.gates.release(gate_id) {
-                Some(_) => Ok(format!("released {gate_id}")),
-                None => Err(format!("no such gate: {gate_id}")),
+            let entry_id = args
+                .get(1)
+                .ok_or_else(|| "usage: queue release <entry_id>".to_string())?;
+            match s.queue.release(entry_id) {
+                Some(_) => Ok(format!("released {entry_id}")),
+                None => Err(format!("no such queue entry: {entry_id}")),
            }
        }
        Some(other) => Err(format!(
-            "unknown gate subcommand: {other}\ntry: gate [list|assign-all|assign|release]"
+            "unknown queue subcommand: {other}\ntry: queue [list|assign-all|assign|release]"
        )),
    }
 }
@@ -269,8 +286,8 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                    "{:<24} {:<6} {:<7} {:<6} {}:{}",
                    truncate(&m.id, 24),
                    match m.version {
-                        pxeforge_iso_store::NfsVersion::V3 => "v3",
-                        pxeforge_iso_store::NfsVersion::V41 => "v4.1",
+                        openpxe_iso_store::NfsVersion::V3 => "v3",
+                        openpxe_iso_store::NfsVersion::V41 => "v4.1",
                    },
                    status,
                    m.iso_count,
@@ -292,12 +309,14 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
                .split_once(':')
                .ok_or_else(|| "target must be 'server:/export'".to_string())?;
            let version = match args.get(2).map(String::as_str) {
-                Some("v3") => pxeforge_iso_store::NfsVersion::V3,
-                Some("v41") | None => pxeforge_iso_store::NfsVersion::V41,
-                Some(other) => return Err(format!("unknown nfs version: {other} (expect v3 or v41)")),
+                Some("v3") => openpxe_iso_store::NfsVersion::V3,
+                Some("v41") | None => openpxe_iso_store::NfsVersion::V41,
+                Some(other) => {
+                    return Err(format!("unknown nfs version: {other} (expect v3 or v41)"))
+                }
            };
            let read_only = !matches!(args.get(3).map(String::as_str), Some("rw"));
-            let req = pxeforge_iso_store::NfsAddRequest {
+            let req = openpxe_iso_store::NfsAddRequest {
                server: server.to_string(),
                export: export.to_string(),
                version,
@@ -309,14 +328,18 @@ async fn nfs_command(s: &AppState, args: &[String]) -> Result<String, String> {
            }
        }
        Some("unmount") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs unmount <id>".to_string())?;
            match s.nfs.remove(id).await {
                Ok(()) => Ok(format!("unmounted {id}")),
                Err(e) => Err(format!("unmount failed: {e}")),
            }
        }
        Some("scan") => {
-            let id = args.get(1).ok_or_else(|| "usage: nfs scan <id>".to_string())?;
+            let id = args
+                .get(1)
+                .ok_or_else(|| "usage: nfs scan <id>".to_string())?;
            match s.nfs.rescan(id).await {
                Ok(n) => Ok(format!("re-scanned {id}: {n} isos")),
                Err(e) => Err(format!("scan failed: {e}")),
@@ -368,10 +391,7 @@ fn log_command(s: &AppState, args: &[String]) -> Result<String, String> {
            Ok("log buffer cleared".into())
        }
        Some("tail") => {
-            let n: usize = args
-                .get(1)
-                .and_then(|v| v.parse().ok())
-                .unwrap_or(20);
+            let n: usize = args.get(1).and_then(|v| v.parse().ok()).unwrap_or(20);
            let lines = s.log_bus.recent();
            let start = lines.len().saturating_sub(n);
            let mut out = String::new();
@@ -453,7 +473,7 @@ pub fn shell_split(input: &str) -> Vec<String> {
 }

 const HELP_TEXT: &str = "\
-PXEForge terminal — available commands:
+OpenPXE terminal — available commands:

  help                              show this help
  version                           print server version
@@ -462,10 +482,10 @@ PXEForge terminal — available commands:

  isos                              list registered ISOs
  clients                           list PXE clients seen this session
-  gate list                         list gated-deployment queue
-  gate assign <gate_id> <target>    assign one gate to a boot entry
-  gate assign-all <target>          assign every waiting gate
-  gate release <gate_id>            release one gate
+  queue list                        list queued clients
+  queue assign <entry_id> <target>   assign one queued client to a boot entry
+  queue assign-all <target>         assign every waiting client
+  queue release <entry_id>           release one queued client

  nfs list                          list NFS mounts
  nfs mount <s>:<e> [v3|v41] [ro|rw]  add and mount an NFS share
@@ -521,4 +541,10 @@ mod tests {
        assert_eq!(truncate("hi", 10), "hi");
        assert_eq!(truncate("longerthanfive", 5), "long…");
    }
+
+    #[test]
+    fn help_uses_queue_language() {
+        assert!(HELP_TEXT.contains("queue list"));
+        assert!(HELP_TEXT.contains("queued clients"));
+    }
 }
@@ -0,0 +1,180 @@
+//! Chunked upload sessions for browser-driven ISO uploads.
+//!
+//! The legacy multipart endpoint still exists for simple API clients, but
+//! browsers get a better failure mode with raw chunks: progress advances after
+//! each acknowledged write, partial files appear in the ISO directory
+//! immediately, and reverse proxies are less likely to buffer an entire DVD
+//! image before OpenPXE sees byte one.
+
+use bytes::Bytes;
+use openpxe_core::{Error, Result};
+use openpxe_iso_store::{IsoMeta, IsoStore, UploadHandle};
+use serde::Serialize;
+use std::collections::HashMap;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use uuid::Uuid;
+
+const DEFAULT_CHUNK_SIZE: u64 = 8 * 1024 * 1024;
+
+#[derive(Clone, Default)]
+pub struct UploadSessions {
+    inner: Arc<Mutex<HashMap<String, Arc<Mutex<UploadSession>>>>>,
+}
+
+struct UploadSession {
+    filename: String,
+    expected_size: Option<u64>,
+    offset: u64,
+    handle: Option<UploadHandle>,
+}
+
+#[derive(Debug, Clone, Serialize)]
+pub struct UploadStarted {
+    pub upload_id: String,
+    pub iso_id: String,
+    pub filename: String,
+    pub offset: u64,
+    pub chunk_size: u64,
+}
+
+#[derive(Debug, Clone, Serialize)]
+#[serde(rename_all = "snake_case")]
+pub enum UploadAppend {
+    Progress { offset: u64 },
+    Complete { offset: u64, iso: Box<IsoMeta> },
+}
+
+impl UploadSessions {
+    pub async fn begin(
+        &self,
+        store: &IsoStore,
+        filename: &str,
+        expected_size: Option<u64>,
+    ) -> Result<UploadStarted> {
+        if !filename.to_ascii_lowercase().ends_with(".iso") {
+            return Err(Error::Invalid("only .iso uploads accepted".to_string()));
+        }
+
+        let handle = store.begin_upload(filename).await?;
+        let iso_id = handle.id.clone();
+        let upload_id = Uuid::new_v4().to_string();
+        let session = UploadSession {
+            filename: filename.to_string(),
+            expected_size,
+            offset: 0,
+            handle: Some(handle),
+        };
+
+        self.inner
+            .lock()
+            .await
+            .insert(upload_id.clone(), Arc::new(Mutex::new(session)));
+
+        Ok(UploadStarted {
+            upload_id,
+            iso_id,
+            filename: filename.to_string(),
+            offset: 0,
+            chunk_size: DEFAULT_CHUNK_SIZE,
+        })
+    }
+
+    pub async fn append(
+        &self,
+        store: &IsoStore,
+        upload_id: &str,
+        offset: u64,
+        chunk: Bytes,
+        complete: bool,
+    ) -> Result<UploadAppend> {
+        let Some(session_lock) = self.inner.lock().await.get(upload_id).cloned() else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+
+        let mut session = session_lock.lock().await;
+        if session.offset != offset {
+            return Err(Error::Invalid(format!(
+                "expected offset {}, got {offset}",
+                session.offset
+            )));
+        }
+
+        let new_offset = session
+            .offset
+            .checked_add(chunk.len() as u64)
+            .ok_or_else(|| Error::Invalid("upload offset overflow".to_string()))?;
+
+        if let Some(expected) = session.expected_size {
+            if new_offset > expected {
+                return Err(Error::Invalid(format!(
+                    "chunk exceeds declared upload size {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.as_mut() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        if let Err(e) = handle.write_chunk(&chunk).await {
+            let handle = session.handle.take();
+            drop(session);
+            self.inner.lock().await.remove(upload_id);
+            if let Some(handle) = handle {
+                let _ = handle.abort().await;
+            }
+            return Err(e);
+        }
+
+        session.offset = new_offset;
+        if !complete {
+            return Ok(UploadAppend::Progress { offset: new_offset });
+        }
+
+        if let Some(expected) = session.expected_size {
+            if new_offset != expected {
+                return Err(Error::Invalid(format!(
+                    "final chunk ended at {new_offset}, expected {expected}"
+                )));
+            }
+        }
+
+        let Some(handle) = session.handle.take() else {
+            return Err(Error::Invalid("upload already completed".to_string()));
+        };
+        let filename = session.filename.clone();
+        drop(session);
+
+        tracing::info!(
+            target: "openpxe::http::upload",
+            upload_id,
+            filename = %filename,
+            received_bytes = new_offset,
+            "chunked upload body complete; introspecting"
+        );
+
+        let meta = match handle.finish(store).await {
+            Ok(meta) => meta,
+            Err(e) => {
+                self.inner.lock().await.remove(upload_id);
+                return Err(e);
+            }
+        };
+        self.inner.lock().await.remove(upload_id);
+        Ok(UploadAppend::Complete {
+            offset: new_offset,
+            iso: Box::new(meta),
+        })
+    }
+
+    pub async fn abort(&self, upload_id: &str) -> Result<()> {
+        let Some(session_lock) = self.inner.lock().await.remove(upload_id) else {
+            return Err(Error::Invalid(format!("no such upload '{upload_id}'")));
+        };
+        let mut session = session_lock.lock().await;
+        if let Some(handle) = session.handle.take() {
+            handle.abort().await?;
+        }
+        Ok(())
+    }
+}
@@ -3,7 +3,7 @@
 //! Spins up the real axum router against a temp ISO store + settings store,
 //! then walks an imaginary iPXE client through: dashboard status → upload
 //! ISO → fetch top-level boot menu → fetch per-entry script → Range-GET the
-//! ISO. Also drives the Gated Deployment flow end-to-end: two clients join,
+//! ISO. Also drives the Queued Deployment flow end-to-end: two clients join,
 //! operator assigns, both polls return the chain script with retry fallback.
 //!
 //! This is the closest we can get to "real PXE client" without QEMU; the
@@ -12,9 +12,9 @@

 use axum::body::Body;
 use axum::http::{header, Request, StatusCode};
-use pxeforge_core::{ClientRegistry, GateQueue, HostBindings, LogBus, Metrics, SettingsStore};
-use pxeforge_http_api::{build_router, AppState};
-use pxeforge_iso_store::{IsoStore, NfsManager};
+use openpxe_core::{ClientRegistry, DeploymentQueue, HostBindings, LogBus, Metrics, SettingsStore};
+use openpxe_http_api::{build_router, AppState};
+use openpxe_iso_store::{IsoStore, NfsManager};
 use tempfile::tempdir;
 use tower::ServiceExt;

@@ -38,13 +38,12 @@ fn fake_alpine_iso() -> Vec<u8> {
 }

 fn multipart_iso_body(filename: &str, bytes: &[u8]) -> (String, Vec<u8>) {
-    let boundary = "----PxeForgeTestBoundary1234";
+    let boundary = "----OpenPxeTestBoundary1234";
    let mut body = Vec::new();
    body.extend_from_slice(format!("--{boundary}\r\n").as_bytes());
    body.extend_from_slice(
-        format!(
-            "Content-Disposition: form-data; name=\"file\"; filename=\"{filename}\"\r\n"
-        ).as_bytes(),
+        format!("Content-Disposition: form-data; name=\"file\"; filename=\"{filename}\"\r\n")
+            .as_bytes(),
    );
    body.extend_from_slice(b"Content-Type: application/octet-stream\r\n\r\n");
    body.extend_from_slice(bytes);
@@ -60,7 +59,10 @@ async fn get(router: &axum::Router, path: &str) -> (StatusCode, Vec<u8>) {
        .await
        .unwrap();
    let status = res.status();
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX).await.unwrap().to_vec();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
    (status, body)
 }

@@ -78,7 +80,10 @@ async fn post_json(router: &axum::Router, path: &str, body: &str) -> (StatusCode
        .await
        .unwrap();
    let status = res.status();
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX).await.unwrap().to_vec();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap()
+        .to_vec();
    (status, body)
 }

@@ -87,22 +92,25 @@ async fn build_state() -> (AppState, tempfile::TempDir) {
    let iso_store = IsoStore::new(dir.path().join("isos"));
    iso_store.ensure_dirs().await.unwrap();
    let clients = ClientRegistry::new();
-    let gates = GateQueue::new();
+    let queue = DeploymentQueue::new();
    let settings = SettingsStore::load_or_default(dir.path());
    let nfs = NfsManager::new(dir.path(), iso_store.clone());
    iso_store.set_nfs_root(nfs.mount_root());
    let log_bus = LogBus::new(64);
    let hosts = HostBindings::load_or_default(dir.path());
+    let boot_log = openpxe_core::BootLog::load_or_default(dir.path());
    let metrics = Metrics::new();
    let state = AppState {
        iso_store,
        clients,
-        gates,
+        queue,
        settings,
        hosts,
+        boot_log,
        metrics,
        smb: None,
        nfs,
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus,
        started_at: time::OffsetDateTime::now_utc(),
        public_base_url: "http://127.0.0.1".into(),
@@ -153,13 +161,21 @@ async fn upload_introspects_and_generates_boot_entry() {
    // Confirm the ISO shows up in the menu.
    let (_, menu) = get(&app, "/boot.ipxe").await;
    let menu = String::from_utf8(menu).unwrap();
-    assert!(menu.contains("Linux Installers"), "menu missing Linux submenu:\n{menu}");
+    assert!(
+        menu.contains("Linux Installers"),
+        "menu missing Linux submenu:\n{menu}"
+    );

    let (_, linux) = get(&app, "/boot/_linux_menu.ipxe").await;
    let linux = String::from_utf8(linux).unwrap();
-    assert!(linux.contains("fake-alpine-linux"), "linux submenu missing entry:\n{linux}");
-    assert!(linux.contains("[ 0 MB]") || linux.contains("[  0 MB]"),
-        "size label missing in {linux}");
+    assert!(
+        linux.contains("fake-alpine-linux"),
+        "linux submenu missing entry:\n{linux}"
+    );
+    assert!(
+        linux.contains("[ 0 MB]") || linux.contains("[  0 MB]"),
+        "size label missing in {linux}"
+    );

    // Per-entry boot script should include kernel + initrd URLs + boot.
    let (_, entry) = get(&app, "/boot/fake-alpine-linux.ipxe").await;
@@ -178,9 +194,14 @@ async fn iso_range_request_slices_correctly() {
    app.clone()
        .oneshot(
            Request::builder()
-                .method("POST").uri("/api/isos")
+                .method("POST")
+                .uri("/api/isos")
                .header("content-type", ct)
-                .body(Body::from(body)).unwrap()).await.unwrap();
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();

    // Range bytes=0x8000-0x8005 should return the PVD signature byte.
    let res = app
@@ -189,43 +210,61 @@ async fn iso_range_request_slices_correctly() {
            Request::builder()
                .uri("/iso/fake-alpine.iso")
                .header(header::RANGE, "bytes=32768-32773")
-                .body(Body::empty()).unwrap())
-        .await.unwrap();
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
    assert_eq!(res.status(), StatusCode::PARTIAL_CONTENT);
-    let slice = axum::body::to_bytes(res.into_body(), usize::MAX).await.unwrap();
+    let slice = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
    assert_eq!(slice[0], 0x01); // PVD type
    assert_eq!(&slice[1..6], b"CD001");
 }

 #[tokio::test]
-async fn gated_deployment_full_flow() {
+async fn queued_deployment_full_flow() {
    let (state, _dir) = build_state().await;
    let app = build_router(state.clone());

    // Upload an ISO so the target exists.
    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
    app.clone()
-        .oneshot(Request::builder().method("POST").uri("/api/isos")
-            .header("content-type", ct).body(Body::from(body)).unwrap())
-        .await.unwrap();
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();

    // Two clients join.
-    let (_, join1) = get(&app, "/api/gate/join?mac=aa:bb:cc:00:00:01").await;
-    let (_, join2) = get(&app, "/api/gate/join?mac=aa:bb:cc:00:00:02").await;
+    let (_, join1) = get(&app, "/api/queue/join?mac=aa:bb:cc:00:00:01").await;
+    let (_, join2) = get(&app, "/api/queue/join?mac=aa:bb:cc:00:00:02").await;
    let s1 = String::from_utf8(join1).unwrap();
    let s2 = String::from_utf8(join2).unwrap();
-    assert!(s1.contains("Gate Position 1"));
-    assert!(s2.contains("Gate Position 2"));
+    assert!(s1.contains("Queue Position 1"));
+    assert!(s2.contains("Queue Position 2"));

-    let gate1_id = s1.lines().find_map(|l| l.strip_prefix("chain http://127.0.0.1/api/gate/poll/"))
-        .unwrap().to_string();
-    let gate2_id = s2.lines().find_map(|l| l.strip_prefix("chain http://127.0.0.1/api/gate/poll/"))
-        .unwrap().to_string();
+    let queue1_id = s1
+        .lines()
+        .find_map(|l| l.strip_prefix("chain http://127.0.0.1/api/queue/poll/"))
+        .unwrap()
+        .to_string();
+    let queue2_id = s2
+        .lines()
+        .find_map(|l| l.strip_prefix("chain http://127.0.0.1/api/queue/poll/"))
+        .unwrap()
+        .to_string();

    // Kick off a long-poll for client 1 in the background. Then assign.
    let app2 = app.clone();
    let poll_future = tokio::spawn(async move {
-        let uri = format!("/api/gate/poll/{gate1_id}");
+        let uri = format!("/api/queue/poll/{queue1_id}");
        get(&app2, &uri).await
    });

@@ -233,15 +272,18 @@ async fn gated_deployment_full_flow() {
    tokio::time::sleep(std::time::Duration::from_millis(50)).await;

    // Operator assigns.
-    let body = format!(r#"{{"target":"fake-alpine-linux","gate_ids":["{gate2_id}"]}}"#);
-    let (s, b) = post_json(&app, "/api/gate/assign", &body).await;
+    let body = format!(r#"{{"target":"fake-alpine-linux","entry_ids":["{queue2_id}"]}}"#);
+    let (s, b) = post_json(&app, "/api/queue/assign", &body).await;
    assert_eq!(s, StatusCode::OK);
    let assign_json = String::from_utf8(b).unwrap();
-    assert!(assign_json.contains(r#""assigned":1"#), "assign response: {assign_json}");
+    assert!(
+        assign_json.contains(r#""assigned":1"#),
+        "assign response: {assign_json}"
+    );

-    // Now assign to gate 1 too so the background poll wakes.
-    let body = r#"{"target":"fake-alpine-linux","gate_ids":[]}"#;
-    post_json(&app, "/api/gate/assign", body).await;
+    // Now assign to queue entry 1 too so the background poll wakes.
+    let body = r#"{"target":"fake-alpine-linux","entry_ids":[]}"#;
+    post_json(&app, "/api/queue/assign", body).await;

    let (poll_status, poll_body) = poll_future.await.unwrap();
    assert_eq!(poll_status, StatusCode::OK);
@@ -251,14 +293,23 @@ async fn gated_deployment_full_flow() {
        "poll response should chain the boot script:\n{poll_s}"
    );
    // Retry-on-error fallback must be present.
-    assert!(poll_s.contains("|| chain http://127.0.0.1/api/gate/poll/"),
-        "retry fallback missing");
+    assert!(
+        poll_s.contains("|| chain http://127.0.0.1/api/queue/poll/"),
+        "retry fallback missing"
+    );

    // Bad target must be rejected.
-    let (_, bad) = post_json(&app, "/api/gate/assign",
-        r#"{"target":"does-not-exist","gate_ids":[]}"#).await;
+    let (_, bad) = post_json(
+        &app,
+        "/api/queue/assign",
+        r#"{"target":"does-not-exist","entry_ids":[]}"#,
+    )
+    .await;
    let bad_s = String::from_utf8(bad).unwrap();
-    assert!(bad_s.contains(r#""ok":false"#), "expected rejection: {bad_s}");
+    assert!(
+        bad_s.contains(r#""ok":false"#),
+        "expected rejection: {bad_s}"
+    );
 }

 #[tokio::test]
@@ -272,8 +323,9 @@ async fn settings_put_persists_across_reads() {
        "smb_host_override": "",
        "extra_kernel_args": "console=ttyS0",
        "default_local_hdd": true,
-        "gate_wait_max_secs": 0
-    }).to_string();
+        "queue_wait_max_secs": 0
+    })
+    .to_string();

    let res = app
        .clone()
@@ -283,7 +335,8 @@ async fn settings_put_persists_across_reads() {
                .uri("/api/settings")
                .header("content-type", "application/json")
                .body(Body::from(body))
-                .unwrap())
+                .unwrap(),
+        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::NO_CONTENT);
@@ -297,10 +350,14 @@ async fn settings_put_persists_across_reads() {
    // And the menu should now use the new timeout.
    let (_, menu) = get(&app, "/boot.ipxe").await;
    let menu = String::from_utf8(menu).unwrap();
-    assert!(menu.contains("--timeout 42000"),
-        "menu should reflect 42s timeout:\n{menu}");
-    assert!(menu.contains("--default local"),
-        "menu should default to local:\n{menu}");
+    assert!(
+        menu.contains("--timeout 42000"),
+        "menu should reflect 42s timeout:\n{menu}"
+    );
+    assert!(
+        menu.contains("--default local"),
+        "menu should default to local:\n{menu}"
+    );
 }

 #[tokio::test]
@@ -309,14 +366,22 @@ async fn reboot_and_firmware_exit_in_tools_menu() {
    let app = build_router(state);
    let (_, tools) = get(&app, "/boot/_tools_menu.ipxe").await;
    let tools = String::from_utf8(tools).unwrap();
-    assert!(tools.contains("Reboot Computer"),
-        "tools menu missing Reboot item:\n{tools}");
-    assert!(tools.contains("Exit and continue BIOS boot"),
-        "tools menu missing firmware-exit item:\n{tools}");
-    assert!(tools.contains("&& reboot"),
-        "reboot command not wired:\n{tools}");
-    assert!(tools.contains("&& exit 0"),
-        "firmware exit command not wired:\n{tools}");
+    assert!(
+        tools.contains("Reboot Computer"),
+        "tools menu missing Reboot item:\n{tools}"
+    );
+    assert!(
+        tools.contains("Exit and continue BIOS boot"),
+        "tools menu missing firmware-exit item:\n{tools}"
+    );
+    assert!(
+        tools.contains("&& reboot"),
+        "reboot command not wired:\n{tools}"
+    );
+    assert!(
+        tools.contains("&& exit 0"),
+        "firmware exit command not wired:\n{tools}"
+    );
 }

 #[tokio::test]
@@ -329,16 +394,20 @@ async fn ui_assets_served_offline() {
        ("/assets/app.js", "application/javascript"),
        ("/assets/app.css", "text/css"),
        ("/assets/logo.svg", "image/svg+xml"),
-        ("/assets/anvil-forge.svg", "image/svg+xml"),
+        ("/assets/loader.svg", "image/svg+xml"),
    ] {
        let res = app
            .clone()
            .oneshot(Request::builder().uri(path).body(Body::empty()).unwrap())
-            .await.unwrap();
+            .await
+            .unwrap();
        assert_eq!(res.status(), StatusCode::OK, "{path} not 200");
-        let got = res.headers()
-            .get(header::CONTENT_TYPE).unwrap()
-            .to_str().unwrap();
+        let got = res
+            .headers()
+            .get(header::CONTENT_TYPE)
+            .unwrap()
+            .to_str()
+            .unwrap();
        assert!(got.starts_with(ct), "{path} ct={got}, expected {ct}");
    }
 }
@@ -348,20 +417,38 @@ async fn no_external_urls_in_generated_ipxe() {
    // Sanity check that nothing we serve points off-server.
    let (state, _dir) = build_state().await;
    let app = build_router(state);
-    for path in ["/boot.ipxe", "/boot/_tools_menu.ipxe", "/boot/_linux_menu.ipxe",
-                 "/boot/_shell.ipxe", "/boot/_nic.ipxe", "/boot/_local.ipxe"] {
+    for path in [
+        "/boot.ipxe",
+        "/boot/_tools_menu.ipxe",
+        "/boot/_linux_menu.ipxe",
+        "/boot/_shell.ipxe",
+        "/boot/_nic.ipxe",
+        "/boot/_local.ipxe",
+    ] {
        let (_, body) = get(&app, path).await;
        let s = String::from_utf8(body).unwrap();
        // The only URLs we should emit are relative to our own public_base_url.
-        for url in ["github.com", "googleapis", "cdn.", "cdnjs", "unpkg", "jsdelivr"] {
-            assert!(!s.contains(url), "{path} references external host {url}:\n{s}");
+        for url in [
+            "github.com",
+            "googleapis",
+            "cdn.",
+            "cdnjs",
+            "unpkg",
+            "jsdelivr",
+        ] {
+            assert!(
+                !s.contains(url),
+                "{path} references external host {url}:\n{s}"
+            );
        }
        // Confirm URLs are all ours.
        for line in s.lines() {
            if let Some(idx) = line.find("http://") {
                let rest = &line[idx..];
-                assert!(rest.starts_with("http://127.0.0.1"),
-                    "{path} references non-public-base URL: {line}");
+                assert!(
+                    rest.starts_with("http://127.0.0.1"),
+                    "{path} references non-public-base URL: {line}"
+                );
            }
        }
    }
@@ -384,7 +471,10 @@ async fn nfs_add_with_bad_export_is_rejected() {
    .await;
    assert_eq!(s, StatusCode::BAD_REQUEST);
    let msg = String::from_utf8_lossy(&b);
-    assert!(msg.contains("export"), "expected validation hint, got: {msg}");
+    assert!(
+        msg.contains("export"),
+        "expected validation hint, got: {msg}"
+    );
 }

 #[tokio::test]
@@ -406,14 +496,17 @@ async fn terminal_help_and_status_round_trip() {
    let (s, b) = post_json(&app, "/api/terminal", r#"{"command":""}"#).await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
-    assert!(v["output"].as_str().unwrap().contains("PXEForge terminal"));
+    assert!(v["output"].as_str().unwrap().contains("OpenPXE terminal"));

    // status -> contains the version banner.
    let (s, b) = post_json(&app, "/api/terminal", r#"{"command":"status"}"#).await;
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
    let out = v["output"].as_str().unwrap();
-    assert!(out.starts_with("PXEForge"), "unexpected status output: {out}");
+    assert!(
+        out.starts_with("OpenPXE"),
+        "unexpected status output: {out}"
+    );
    assert!(out.contains("isos:"), "status missing iso line: {out}");

    // Unknown command -> ok=false plus help hint.
@@ -434,7 +527,10 @@ async fn log_recent_returns_buffered_lines() {
    assert_eq!(s, StatusCode::OK);
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
    let lines = v["lines"].as_array().expect("lines array");
-    assert!(!lines.is_empty(), "log buffer should have at least one line");
+    assert!(
+        !lines.is_empty(),
+        "log buffer should have at least one line"
+    );
    // Every entry should have the canonical timestamp/level/target/message.
    for l in lines {
        for k in ["timestamp", "level", "target", "message"] {
@@ -477,9 +573,9 @@ async fn windows_iso_renders_clean_wimboot_script_with_no_trust_store_writes() {
                .uri("/api/settings")
                .header("content-type", "application/json")
                .body(Body::from(
-                    r#"{"boot_menu_timeout_secs":600,"timeout_action":"gated_deployment",
+                    r#"{"boot_menu_timeout_secs":600,"timeout_action":"queued_deployment",
                       "windows_enabled":false,"smb_host_override":"","extra_kernel_args":"",
-                       "default_local_hdd":true,"gate_wait_max_secs":0,"dns_server":""}"#
+                       "default_local_hdd":true,"queue_wait_max_secs":0,"dns_server":""}"#
                        .to_string(),
                ))
                .unwrap(),
@@ -504,7 +600,9 @@ async fn windows_iso_renders_clean_wimboot_script_with_no_trust_store_writes() {
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::CREATED);
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX).await.unwrap();
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
    let meta: serde_json::Value = serde_json::from_slice(&body).unwrap();
    assert_eq!(meta["introspection"]["family"], "windows_pe");
    assert!(
@@ -534,7 +632,10 @@ async fn windows_iso_renders_clean_wimboot_script_with_no_trust_store_writes() {
    assert_eq!(s, StatusCode::OK);
    let script = String::from_utf8(body).unwrap();
    assert!(script.contains("kernel "), "missing kernel line:\n{script}");
-    assert!(script.contains("ipxe/wimboot"), "missing wimboot loader:\n{script}");
+    assert!(
+        script.contains("ipxe/wimboot"),
+        "missing wimboot loader:\n{script}"
+    );
    for tag in ["bootmgr", "bootmgr.efi", "bcd", "boot.sdi", "boot.wim"] {
        assert!(
            script.contains(&format!("initrd --name {tag}")),
@@ -544,8 +645,12 @@ async fn windows_iso_renders_clean_wimboot_script_with_no_trust_store_writes() {
    // Hard guarantees we never want to see in any client-facing script.
    let lower = script.to_lowercase();
    for forbidden in [
-        "bcdedit", "testsigning", "certutil", "test-signed",
-        "httpdisk", "/set testsigning",
+        "bcdedit",
+        "testsigning",
+        "certutil",
+        "test-signed",
+        "httpdisk",
+        "/set testsigning",
    ] {
        assert!(
            !lower.contains(forbidden),
@@ -610,33 +715,39 @@ async fn metrics_endpoint_emits_prometheus_format() {

    let res = app
        .clone()
-        .oneshot(Request::builder().uri("/metrics").body(Body::empty()).unwrap())
+        .oneshot(
+            Request::builder()
+                .uri("/metrics")
+                .body(Body::empty())
+                .unwrap(),
+        )
        .await
        .unwrap();
    assert_eq!(res.status(), StatusCode::OK);
-    let ct = res.headers().get(header::CONTENT_TYPE).unwrap().to_str().unwrap();
-    assert!(
-        ct.starts_with("text/plain"),
-        "wrong content-type: {ct}"
-    );
-    let body = axum::body::to_bytes(res.into_body(), usize::MAX).await.unwrap();
+    let ct = res
+        .headers()
+        .get(header::CONTENT_TYPE)
+        .unwrap()
+        .to_str()
+        .unwrap();
+    assert!(ct.starts_with("text/plain"), "wrong content-type: {ct}");
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
    let body = String::from_utf8(body.to_vec()).unwrap();
    // Spot-check the must-have metric families.
    for name in [
-        "pxeforge_dhcp_replies_total",
-        "pxeforge_tftp_transfers_total",
-        "pxeforge_http_requests_total",
-        "pxeforge_iso_count",
-        "pxeforge_uptime_seconds",
-        "pxeforge_build_info",
+        "openpxe_dhcp_replies_total",
+        "openpxe_tftp_transfers_total",
+        "openpxe_http_requests_total",
+        "openpxe_iso_count",
+        "openpxe_uptime_seconds",
+        "openpxe_build_info",
    ] {
        assert!(body.contains(name), "missing metric {name} in:\n{body}");
    }
    // Each name appears exactly once as a `# TYPE` declaration.
-    for name in [
-        "pxeforge_dhcp_replies_total",
-        "pxeforge_iso_count",
-    ] {
+    for name in ["openpxe_dhcp_replies_total", "openpxe_iso_count"] {
        let count = body.matches(&format!("# TYPE {name}")).count();
        assert_eq!(count, 1, "{name} TYPE line appears {count} times");
    }
@@ -672,3 +783,421 @@ async fn network_endpoint_exposes_dns_round_trip() {
    let v: serde_json::Value = serde_json::from_slice(&b).unwrap();
    assert_eq!(v["dns_server"], "10.0.0.1");
 }
+
+// ─── Per-ISO password prompt ──────────────────────────────────────────────
+
+#[tokio::test]
+async fn iso_password_prompt_blocks_until_correct_token() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    // Upload a synthetic Alpine ISO so we have a real boot entry id to
+    // protect. Upload filename "fake-alpine.iso" -> id "fake-alpine",
+    // boot entry id "fake-alpine-linux".
+    let iso = fake_alpine_iso();
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &iso);
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::CREATED);
+
+    // 1. With NO password set, /boot/<id>.ipxe returns the boot script
+    //    immediately and the lock indicator is NOT in the menu.
+    let (_, body) = get(&app, "/boot/fake-alpine-linux.ipxe").await;
+    let s = String::from_utf8(body).unwrap();
+    assert!(s.contains("kernel "), "expected boot script, got:\n{s}");
+    let (_, lm) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let lm = String::from_utf8(lm).unwrap();
+    assert!(lm.contains("fake-alpine-linux"));
+    assert!(
+        !lm.contains("fake-alpine-linux *["),
+        "expected no lock marker in menu before password set:\n{lm}"
+    );
+
+    // 2. Set a password.
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri("/api/isos/fake-alpine/password")
+                .header("content-type", "application/json")
+                .body(Body::from(r#"{"password":"hunter2"}"#))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+    // The menu now shows the lock marker (`*` prefix on the size box).
+    let (_, lm) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let lm = String::from_utf8(lm).unwrap();
+    assert!(
+        lm.contains("fake-alpine-linux *["),
+        "expected lock marker in menu after password set:\n{lm}"
+    );
+
+    // 3. Without a token, /boot/<id>.ipxe now returns the password
+    //    PROMPT script (read --secret), not the boot script.
+    let (_, body) = get(&app, "/boot/fake-alpine-linux.ipxe").await;
+    let s = String::from_utf8(body).unwrap();
+    assert!(
+        s.contains("read --secret password"),
+        "expected prompt script with no token, got:\n{s}"
+    );
+    assert!(!s.contains("kernel "), "should not include kernel line yet");
+
+    // 4. Wrong token -> "Wrong password." script that chains back to the entry.
+    let (_, body) = get(&app, "/boot/fake-alpine-linux.ipxe?token=wrongpw").await;
+    let s = String::from_utf8(body).unwrap();
+    assert!(
+        s.contains("Wrong password."),
+        "expected auth-fail script, got:\n{s}"
+    );
+    assert!(s.contains("/boot/fake-alpine-linux.ipxe"));
+    assert!(!s.contains("kernel "));
+    // Critical: the WRONG token must NEVER be echoed back in the script.
+    assert!(
+        !s.contains("wrongpw"),
+        "wrong token must not appear in response"
+    );
+
+    // 5. Correct token -> real boot script.
+    let (_, body) = get(&app, "/boot/fake-alpine-linux.ipxe?token=hunter2").await;
+    let s = String::from_utf8(body).unwrap();
+    assert!(
+        s.contains("kernel "),
+        "expected boot script with correct token, got:\n{s}"
+    );
+    // Don't echo the password into the boot script either.
+    assert!(
+        !s.contains("hunter2"),
+        "correct password must not leak into boot script"
+    );
+
+    // 6. Clear the password (DELETE).
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("DELETE")
+                .uri("/api/isos/fake-alpine/password")
+                .body(Body::empty())
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NO_CONTENT);
+
+    // Boot is open again, no lock indicator.
+    let (_, body) = get(&app, "/boot/fake-alpine-linux.ipxe").await;
+    let s = String::from_utf8(body).unwrap();
+    assert!(
+        s.contains("kernel "),
+        "expected boot script after clear, got:\n{s}"
+    );
+    let (_, lm) = get(&app, "/boot/_linux_menu.ipxe").await;
+    let lm = String::from_utf8(lm).unwrap();
+    assert!(!lm.contains("fake-alpine-linux *["));
+}
+
+#[tokio::test]
+async fn iso_password_set_then_clear_via_null_body() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    // Upload + set + clear via `{"password": null}` (alternative to DELETE).
+    let iso = fake_alpine_iso();
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &iso);
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::CREATED);
+
+    for body in [
+        r#"{"password":"x"}"#,
+        r#"{"password":null}"#,
+        r#"{"password":""}"#,
+    ] {
+        let res = app
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("PUT")
+                    .uri("/api/isos/fake-alpine/password")
+                    .header("content-type", "application/json")
+                    .body(Body::from(body.to_string()))
+                    .unwrap(),
+            )
+            .await
+            .unwrap();
+        assert_eq!(res.status(), StatusCode::NO_CONTENT, "body={body}");
+    }
+    // After the empty string, the entry should be unprotected.
+    let (_, b) = get(&app, "/boot/fake-alpine-linux.ipxe").await;
+    let s = String::from_utf8(b).unwrap();
+    assert!(
+        s.contains("kernel "),
+        "should be unprotected after empty pw, got:\n{s}"
+    );
+}
+
+#[tokio::test]
+async fn set_password_for_unknown_iso_returns_404() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let res = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri("/api/isos/does-not-exist/password")
+                .header("content-type", "application/json")
+                .body(Body::from(r#"{"password":"x"}"#))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::NOT_FOUND);
+}
+
+#[tokio::test]
+async fn boot_log_records_entry_serve_with_mac() {
+    // End-to-end: upload an ISO, fetch the entry's boot script with a
+    // MAC query param, then GET /api/boot-log and assert the event is
+    // there with the supplied mac.
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let (ct, body) = multipart_iso_body("fake-alpine.iso", &fake_alpine_iso());
+    let upload = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(upload.status(), StatusCode::CREATED);
+
+    // Fetch the per-entry script with ?mac=...
+    let (s, _) = get(&app, "/boot/fake-alpine-linux.ipxe?mac=AA:BB:CC:00:00:09").await;
+    assert_eq!(s, StatusCode::OK);
+
+    // The boot log should now contain exactly one entry, with the
+    // normalized MAC and our target id.
+    let (s, body) = get(&app, "/api/boot-log").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let events = v["events"].as_array().expect("events");
+    assert_eq!(events.len(), 1);
+    let ev = &events[0];
+    assert_eq!(ev["target_id"], "fake-alpine-linux");
+    assert_eq!(ev["mac"], "aa:bb:cc:00:00:09"); // normalized
+                                                // Title should include the filename and entry title.
+    let title = ev["target_title"].as_str().unwrap();
+    assert!(title.contains("fake-alpine.iso"), "title was {title}");
+}
+
+#[tokio::test]
+async fn boot_log_endpoint_empty_when_no_boots() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (s, body) = get(&app, "/api/boot-log").await;
+    assert_eq!(s, StatusCode::OK);
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(v["events"].as_array().unwrap().is_empty());
+}
+
+#[tokio::test]
+async fn boot_log_does_not_record_reserved_menu_targets() {
+    // Reserved targets (_local, _queue, …) are operator console actions,
+    // not imaging events. The Hosts log skips them so it stays focused
+    // on "what got installed where".
+    let (state, _dir) = build_state().await;
+    let app = build_router(state.clone());
+
+    // Bind a MAC to the _local shortcut and hit /boot.ipxe.
+    let body = r#"{"mac":"aa:bb:cc:00:00:11","target":"_local","label":"q"}"#;
+    let (s, _) = post_json(&app, "/api/hosts", body).await;
+    assert_eq!(s, StatusCode::CREATED);
+    let (s, _) = get(&app, "/boot.ipxe?mac=aa:bb:cc:00:00:11").await;
+    assert_eq!(s, StatusCode::OK);
+
+    let (_, body) = get(&app, "/api/boot-log").await;
+    let v: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(
+        v["events"].as_array().unwrap().is_empty(),
+        "reserved targets should not appear in boot log; got {v}"
+    );
+}
+
+#[tokio::test]
+async fn upload_rejects_non_iso_filename_with_clear_message() {
+    // Sanity for the upload-logging path: a wrong extension should land
+    // a 400 with the human message rather than silently being eaten by
+    // the multipart loop. (No iso ends up in the store either.)
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+    let (ct, body) = multipart_iso_body("not-an-iso.txt", b"hello world");
+    let res = app
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/isos")
+                .header("content-type", ct)
+                .body(Body::from(body))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(res.status(), StatusCode::BAD_REQUEST);
+    let body = axum::body::to_bytes(res.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = std::str::from_utf8(&body).unwrap();
+    assert!(text.contains("only .iso uploads accepted"), "got: {text}");
+}
+
+#[tokio::test]
+async fn chunked_upload_writes_progressively_and_finishes_iso() {
+    let (state, dir) = build_state().await;
+    let app = build_router(state);
+    let iso = fake_alpine_iso();
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"chunked-alpine.iso","size_bytes":65536}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let split = 8192usize;
+    let first = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "0")
+                .body(Body::from(iso[..split].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(first.status(), StatusCode::ACCEPTED);
+    let body = axum::body::to_bytes(first.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let progress: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert_eq!(progress["offset"].as_u64().unwrap(), split as u64);
+    assert!(!progress["complete"].as_bool().unwrap());
+    assert!(
+        dir.path().join("isos/chunked-alpine.partial").exists(),
+        "chunked upload should leave a visible partial file while in progress"
+    );
+
+    let final_chunk = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", split.to_string())
+                .header("x-openpxe-upload-complete", "true")
+                .body(Body::from(iso[split..].to_vec()))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(final_chunk.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(final_chunk.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let finished: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    assert!(finished["complete"].as_bool().unwrap());
+    assert_eq!(finished["iso"]["id"], "chunked-alpine");
+    assert!(dir.path().join("isos/chunked-alpine.iso").exists());
+    assert!(!dir.path().join("isos/chunked-alpine.partial").exists());
+}
+
+#[tokio::test]
+async fn chunked_upload_rejects_offset_mismatch_without_advancing() {
+    let (state, _dir) = build_state().await;
+    let app = build_router(state);
+
+    let start = app
+        .clone()
+        .oneshot(
+            Request::builder()
+                .method("POST")
+                .uri("/api/uploads")
+                .header("content-type", "application/json")
+                .body(Body::from(
+                    r#"{"filename":"offset-test.iso","size_bytes":16}"#,
+                ))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(start.status(), StatusCode::CREATED);
+    let body = axum::body::to_bytes(start.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let started: serde_json::Value = serde_json::from_slice(&body).unwrap();
+    let upload_id = started["upload_id"].as_str().unwrap();
+
+    let mismatch = app
+        .oneshot(
+            Request::builder()
+                .method("PUT")
+                .uri(format!("/api/uploads/{upload_id}"))
+                .header("x-openpxe-upload-offset", "8")
+                .body(Body::from(vec![1, 2, 3, 4]))
+                .unwrap(),
+        )
+        .await
+        .unwrap();
+    assert_eq!(mismatch.status(), StatusCode::CONFLICT);
+    let body = axum::body::to_bytes(mismatch.into_body(), usize::MAX)
+        .await
+        .unwrap();
+    let text = String::from_utf8(body.to_vec()).unwrap();
+    assert!(text.contains("expected offset 0"), "got: {text}");
+}
@@ -1,16 +1,16 @@
 [package]
-name = "pxeforge-ipxe-assets"
+name = "openpxe-ipxe-assets"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "Bundled iPXE binaries and default chain scripts for PXEForge"
+description = "Bundled iPXE binaries and default chain scripts for OpenPXE"

 [lints]
 workspace = true

 [dependencies]
-pxeforge-core.workspace = true
+openpxe-core.workspace = true
 rust-embed.workspace = true
 tracing.workspace = true
 thiserror.workspace = true
@@ -1,7 +1,7 @@
 //! Bundled iPXE boot binaries and default chain script.
 //!
 //! At build time, we expect the iPXE binaries to live at `assets/ipxe/` at
-//! the workspace root. They are embedded into the PXEForge binary via
+//! the workspace root. They are embedded into the OpenPXE binary via
 //! `rust-embed` so the container image is self-contained. If a binary is
 //! missing, that architecture simply won't have PXE support — we log at
 //! startup and serve what we have.
@@ -16,7 +16,7 @@
 //!   - `wimboot`             — Windows boot shim (fetched separately for WIM chains)
 #![forbid(unsafe_code)]

-use pxeforge_core::ClientArch;
+use openpxe_core::ClientArch;
 use rust_embed::Embed;

 #[derive(Embed)]
@@ -51,7 +51,9 @@ pub fn asset_slice(name: &str) -> Option<std::borrow::Cow<'static, [u8]>> {
 /// Enumerate embedded asset filenames. Useful for startup logging so the
 /// operator can immediately tell which architectures will work.
 pub fn list_assets() -> Vec<String> {
-    IpxeAssets::iter().map(std::borrow::Cow::into_owned).collect()
+    IpxeAssets::iter()
+        .map(std::borrow::Cow::into_owned)
+        .collect()
 }

 /// Log at startup which iPXE binaries are present and which are missing.
@@ -66,10 +68,10 @@ pub fn log_availability() {
    ];
    for (arch, name) in needed {
        if have.contains(name) {
-            tracing::info!(target: "pxeforge::ipxe", "bundled iPXE for {}: {}", arch.as_str(), name);
+            tracing::info!(target: "openpxe::ipxe", "bundled iPXE for {}: {}", arch.as_str(), name);
        } else {
            tracing::warn!(
-                target: "pxeforge::ipxe",
+                target: "openpxe::ipxe",
                "MISSING iPXE binary for {}: {} — clients of this arch will not PXE boot",
                arch.as_str(), name
            );
@@ -1,16 +1,16 @@
 [package]
-name = "pxeforge-iso-store"
+name = "openpxe-iso-store"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "ISO upload, storage, introspection, and boot-entry generation for PXEForge"
+description = "ISO upload, storage, introspection, and boot-entry generation for OpenPXE"

 [lints]
 workspace = true

 [dependencies]
-pxeforge-core.workspace = true
+openpxe-core.workspace = true
 tokio = { workspace = true }
 tokio-util = { workspace = true }
 serde.workspace = true
@@ -20,6 +20,7 @@ thiserror.workspace = true
 anyhow.workspace = true
 sha2.workspace = true
 hex.workspace = true
+bcrypt.workspace = true
 uuid.workspace = true
 time.workspace = true
 parking_lot.workspace = true
@@ -49,7 +49,7 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
    };

    let Ok(mut f) = std::fs::File::open(path) else {
-        tracing::warn!(target: "pxeforge::iso", "cannot open ISO for introspection: {}", path.display());
+        tracing::warn!(target: "openpxe::iso", "cannot open ISO for introspection: {}", path.display());
        return report;
    };

@@ -78,7 +78,9 @@ pub fn introspect(path: &Path) -> IntrospectionReport {
    let mut haystack = Vec::with_capacity(scan_bytes.min(32 * 1024 * 1024));
    while read_total < scan_bytes {
        let n = f.read(&mut buf).unwrap_or(0);
-        if n == 0 { break; }
+        if n == 0 {
+            break;
+        }
        haystack.extend_from_slice(&buf[..n]);
        read_total += n;
    }
@@ -107,8 +109,11 @@ fn family_from_label(label: &str) -> DistroFamily {
    let l = label.to_ascii_lowercase();
    if l.contains("ubuntu") || l.contains("debian") || l.contains("mint") {
        DistroFamily::DebianUbuntu
-    } else if l.contains("rhel") || l.contains("centos") || l.contains("fedora")
-        || l.contains("rocky") || l.contains("alma")
+    } else if l.contains("rhel")
+        || l.contains("centos")
+        || l.contains("fedora")
+        || l.contains("rocky")
+        || l.contains("alma")
    {
        DistroFamily::RhelFedora
    } else if l.contains("suse") || l.contains("opensuse") {
@@ -127,17 +132,30 @@ fn family_from_label(label: &str) -> DistroFamily {
 fn guess_kernel_initrd(family: DistroFamily) -> (Option<&'static str>, Vec<&'static str>) {
    match family {
        DistroFamily::DebianUbuntu => (Some("/casper/vmlinuz"), vec!["/casper/initrd"]),
-        DistroFamily::RhelFedora => (Some("/images/pxeboot/vmlinuz"), vec!["/images/pxeboot/initrd.img"]),
-        DistroFamily::OpenSuse => (Some("/boot/x86_64/loader/linux"), vec!["/boot/x86_64/loader/initrd"]),
-        DistroFamily::Arch => (Some("/arch/boot/x86_64/vmlinuz-linux"), vec!["/arch/boot/x86_64/initramfs-linux.img"]),
+        DistroFamily::RhelFedora => (
+            Some("/images/pxeboot/vmlinuz"),
+            vec!["/images/pxeboot/initrd.img"],
+        ),
+        DistroFamily::OpenSuse => (
+            Some("/boot/x86_64/loader/linux"),
+            vec!["/boot/x86_64/loader/initrd"],
+        ),
+        DistroFamily::Arch => (
+            Some("/arch/boot/x86_64/vmlinuz-linux"),
+            vec!["/arch/boot/x86_64/initramfs-linux.img"],
+        ),
        DistroFamily::Alpine => (Some("/boot/vmlinuz-lts"), vec!["/boot/initramfs-lts"]),
        DistroFamily::WindowsPe | DistroFamily::Unknown => (None, Vec::new()),
    }
 }

 fn contains_ascii(haystack: &[u8], needle: &[u8]) -> bool {
-    if needle.is_empty() || haystack.len() < needle.len() { return false; }
-    haystack.windows(needle.len()).any(|w| w.eq_ignore_ascii_case(needle))
+    if needle.is_empty() || haystack.len() < needle.len() {
+        return false;
+    }
+    haystack
+        .windows(needle.len())
+        .any(|w| w.eq_ignore_ascii_case(needle))
 }

 #[cfg(test)]
@@ -146,9 +164,18 @@ mod tests {

    #[test]
    fn label_matching() {
-        assert_eq!(family_from_label("Ubuntu 24.04"), DistroFamily::DebianUbuntu);
-        assert_eq!(family_from_label("Rocky-9-x86_64-dvd"), DistroFamily::RhelFedora);
-        assert_eq!(family_from_label("openSUSE-Leap-15.6"), DistroFamily::OpenSuse);
+        assert_eq!(
+            family_from_label("Ubuntu 24.04"),
+            DistroFamily::DebianUbuntu
+        );
+        assert_eq!(
+            family_from_label("Rocky-9-x86_64-dvd"),
+            DistroFamily::RhelFedora
+        );
+        assert_eq!(
+            family_from_label("openSUSE-Leap-15.6"),
+            DistroFamily::OpenSuse
+        );
        assert_eq!(family_from_label("ARCH_202604"), DistroFamily::Arch);
        assert_eq!(family_from_label("weird-custom"), DistroFamily::Unknown);
    }
@@ -27,5 +27,7 @@ pub use entry::{BootEntry, BootKind, KernelArgs};
 pub use introspect::{DistroFamily, IntrospectionReport};
 pub use nfs::{NfsAddRequest, NfsManager, NfsMount, NfsVersion};
 pub use smb::{extract_windows_iso, SmbManager, SmbState};
-pub use store::{generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle};
+pub use store::{
+    generate_boot_entries_for, slugify_str, IsoMeta, IsoSource, IsoStore, UploadHandle,
+};
 pub use windows::{WimPatcher, WinPatchState};
@@ -36,8 +36,8 @@

 use crate::introspect::{introspect, IntrospectionReport};
 use crate::store::{generate_boot_entries_for, slugify_str, IsoSource, IsoStore};
+use openpxe_core::{Error, Result};
 use parking_lot::Mutex;
-use pxeforge_core::{Error, Result};
 use serde::{Deserialize, Serialize};
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
@@ -76,7 +76,7 @@ pub struct NfsMount {
    pub export: String,
    pub version: NfsVersion,
    /// Read-only by default — most ISO libraries are. Operators that need
-    /// write can flip this off but PXEForge itself never writes.
+    /// write can flip this off but OpenPXE itself never writes.
    pub read_only: bool,
    /// Local mount point under `<work_dir>/nfs/`.
    pub local_path: PathBuf,
@@ -168,7 +168,7 @@ impl NfsManager {
            self.inner.lock().mounts.insert(m.id.clone(), m.clone());
            if let Err(e) = self.try_mount(&m.id).await {
                tracing::warn!(
-                    target: "pxeforge::nfs",
+                    target: "openpxe::nfs",
                    id = %m.id, error = %e,
                    "could not remount NFS share on startup"
                );
@@ -299,7 +299,7 @@ impl NfsManager {
        match output {
            Ok(out) if out.status.success() => {
                tracing::info!(
-                    target: "pxeforge::nfs",
+                    target: "openpxe::nfs",
                    id = %id, server = %m.server, export = %m.export,
                    version = ?m.version,
                    "NFS mount succeeded"
@@ -315,13 +315,13 @@ impl NfsManager {
                    out.status.code().unwrap_or(-1),
                    String::from_utf8_lossy(&out.stderr).trim()
                );
-                tracing::warn!(target: "pxeforge::nfs", id = %id, "{err}");
+                tracing::warn!(target: "openpxe::nfs", id = %id, "{err}");
                self.update_status(id, false, Some(err.clone()), now);
                Err(Error::Invalid(err))
            }
            Err(e) => {
                let err = format!("could not exec /bin/mount: {e}");
-                tracing::error!(target: "pxeforge::nfs", id = %id, "{err}");
+                tracing::error!(target: "openpxe::nfs", id = %id, "{err}");
                self.update_status(id, false, Some(err.clone()), now);
                Err(Error::Invalid(err))
            }
@@ -403,14 +403,8 @@ impl NfsManager {
                mount_id: m.id.clone(),
                relative_path: filename.clone(),
            };
-            self.iso_store.register_external(
-                id,
-                filename,
-                size,
-                report,
-                boot_entries,
-                source,
-            );
+            self.iso_store
+                .register_external(id, filename, size, report, boot_entries, source);
            count += 1;
        }
        Ok(count)
@@ -442,7 +436,7 @@ impl NfsManager {
        let body = match serde_json::to_vec_pretty(&mounts) {
            Ok(b) => b,
            Err(e) => {
-                tracing::warn!(target: "pxeforge::nfs", "serialize NFS state: {e}");
+                tracing::warn!(target: "openpxe::nfs", "serialize NFS state: {e}");
                return;
            }
        };
@@ -450,11 +444,11 @@ impl NfsManager {
            let _ = std::fs::create_dir_all(parent);
        }
        if let Err(e) = std::fs::write(&tmp, body) {
-            tracing::warn!(target: "pxeforge::nfs", "write NFS state tmp: {e}");
+            tracing::warn!(target: "openpxe::nfs", "write NFS state tmp: {e}");
            return;
        }
        if let Err(e) = std::fs::rename(&tmp, path) {
-            tracing::warn!(target: "pxeforge::nfs", "rename NFS state: {e}");
+            tracing::warn!(target: "openpxe::nfs", "rename NFS state: {e}");
        }
    }
 }
@@ -20,16 +20,16 @@
 //!   - SMB2 minimum (no SMB1 legacy, not needed for WinPE).
 //!   - Bound to 0.0.0.0:445; operator MUST put this on a trusted install
 //!     VLAN — guest SMB is not for the general internet.
-//!   - smbd runs as the same non-root uid as pxeforge (10001).
+//!   - smbd runs as the same non-root uid as openpxe (10001).
 //!   - If `smbd` isn't on PATH (e.g. lightweight container build without
 //!     Samba), we return `SmbState::SmbdMissing` and the UI surfaces the
 //!     gap. No panics, no retries, no silent failure.

+use parking_lot::Mutex;
 use serde::{Deserialize, Serialize};
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 use std::sync::Arc;
-use parking_lot::Mutex;

 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "snake_case", tag = "state")]
@@ -72,7 +72,9 @@ impl SmbManager {
    /// ISO under `smb_dir/<slug>/` becomes a share named `<slug>`. Returns
    /// the sorted list.
    pub fn discover_shares(&self) -> Vec<String> {
-        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else { return vec![]; };
+        let Ok(rd) = std::fs::read_dir(&self.smb_dir) else {
+            return vec![];
+        };
        let mut out: Vec<String> = rd
            .flatten()
            .filter(|e| e.path().is_dir())
@@ -100,7 +102,7 @@ impl SmbManager {
                conf,
                "\n[{name}]\n\
                 path = {}\n\
-                 comment = PXEForge Windows install media ({name})\n\
+                 comment = OpenPXE Windows install media ({name})\n\
                 read only = yes\n\
                 guest ok = yes\n\
                 guest only = yes\n\
@@ -130,7 +132,9 @@ impl SmbManager {
        let shares = match self.write_conf() {
            Ok(v) => v,
            Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                *self.state.lock() = s.clone();
                return s;
            }
@@ -139,7 +143,8 @@ impl SmbManager {
            .args([
                "--foreground",
                "--no-process-group",
-                "--configfile", self.conf_path.to_str().unwrap_or(""),
+                "--configfile",
+                self.conf_path.to_str().unwrap_or(""),
                "--log-stdout",
            ])
            .stdin(Stdio::null())
@@ -152,11 +157,13 @@ impl SmbManager {
                *g = Some(c);
                let s = SmbState::Running { pid, shares };
                *self.state.lock() = s.clone();
-                tracing::info!(target: "pxeforge::smb", pid, shares=?self.state.lock(), "smbd started");
+                tracing::info!(target: "openpxe::smb", pid, shares=?self.state.lock(), "smbd started");
                s
            }
            Err(e) => {
-                let s = SmbState::Failed { reason: format!("spawn smbd: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("spawn smbd: {e}"),
+                };
                *self.state.lock() = s.clone();
                s
            }
@@ -168,11 +175,15 @@ impl SmbManager {
    #[allow(unsafe_code)]
    pub fn reconcile(&self) -> SmbState {
        let mut g = self.child.lock();
-        if g.is_none() { return self.state.lock().clone(); }
+        if g.is_none() {
+            return self.state.lock().clone();
+        }
        let shares = match self.write_conf() {
            Ok(v) => v,
            Err(e) => {
-                let s = SmbState::Failed { reason: format!("write smb.conf: {e}") };
+                let s = SmbState::Failed {
+                    reason: format!("write smb.conf: {e}"),
+                };
                *self.state.lock() = s.clone();
                return s;
            }
@@ -191,8 +202,13 @@ impl SmbManager {
            // covers this is `nix`, which pulls ~40 transitive deps for a
            // single signal send. One documented unsafe call is the better
            // tradeoff for a container-first project.
-            unsafe { libc::kill(pid, libc::SIGHUP); }
-            let s = SmbState::Running { pid: pid as u32, shares };
+            unsafe {
+                libc::kill(pid, libc::SIGHUP);
+            }
+            let s = SmbState::Running {
+                pid: pid as u32,
+                shares,
+            };
            *self.state.lock() = s.clone();
            s
        } else {
@@ -212,15 +228,19 @@ impl SmbManager {
 }

 fn smbd_present() -> bool {
-    let Ok(paths) = std::env::var("PATH") else { return false; };
+    let Ok(paths) = std::env::var("PATH") else {
+        return false;
+    };
    for dir in std::env::split_paths(&paths) {
-        if dir.join("smbd").is_file() { return true; }
+        if dir.join("smbd").is_file() {
+            return true;
+        }
    }
    false
 }

 const SMB_CONF_GLOBAL: &str = r"[global]
-workgroup = PXEFORGE
+workgroup = OPENPXE
 server min protocol = SMB2
 smb ports = 445
 log level = 1
@@ -235,6 +255,15 @@ lock directory = /tmp
 state directory = /tmp
 cache directory = /tmp
 pid directory = /tmp
+# WinPE reconnect hardening. Windows Setup can reboot mid-install and
+# reconnect from the same IP; stale sessions/oplocks otherwise cause
+# intermittent `net use` failures on the second stage.
+reset on zero vc = yes
+oplocks = no
+kernel oplocks = no
+level2 oplocks = no
+strict locking = no
+deadtime = 1
 ";

 /// Extract a Windows ISO at `iso_path` into `smb_dir/<slug>/`. Uses
@@ -245,10 +274,14 @@ pid directory = /tmp
 /// Idempotent: if the target dir already contains `sources/boot.wim`, we
 /// skip extraction. Callers who want a forced re-extract should remove the
 /// dir first.
-pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::io::Result<PathBuf> {
+pub fn extract_windows_iso(
+    iso_path: &Path,
+    smb_dir: &Path,
+    slug: &str,
+) -> std::io::Result<PathBuf> {
    let target = smb_dir.join(slug);
    if target.join("sources").join("boot.wim").is_file() {
-        tracing::debug!(target: "pxeforge::smb", slug, "ISO already extracted, skipping");
+        tracing::debug!(target: "openpxe::smb", slug, "ISO already extracted, skipping");
        return Ok(target);
    }
    std::fs::create_dir_all(&target)?;
@@ -263,9 +296,11 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
            .stdout(Stdio::null())
            .stderr(Stdio::piped())
            .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
        tracing::warn!(
-            target: "pxeforge::smb",
+            target: "openpxe::smb",
            stderr=%String::from_utf8_lossy(&out.stderr),
            "7z extract failed, trying bsdtar"
        );
@@ -278,7 +313,9 @@ pub fn extract_windows_iso(iso_path: &Path, smb_dir: &Path, slug: &str) -> std::
            .args(["-C"])
            .arg(&target)
            .output()?;
-        if out.status.success() { return Ok(target); }
+        if out.status.success() {
+            return Ok(target);
+        }
        return Err(std::io::Error::other(format!(
            "bsdtar failed: {}",
            String::from_utf8_lossy(&out.stderr)
@@ -294,7 +331,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
    let paths = std::env::var_os("PATH")?;
    for dir in std::env::split_paths(&paths) {
        let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
    }
    None
 }
@@ -315,12 +354,14 @@ mod tests {
    fn start_without_smbd_reports_missing() {
        // Drop smbd from PATH for this test.
        let saved = std::env::var_os("PATH");
-        std::env::set_var("PATH", "/usr/nowhere-pxeforge-test");
+        std::env::set_var("PATH", "/usr/nowhere-openpxe-test");
        let dir = tempdir().unwrap();
        let m = SmbManager::new(dir.path().into());
        let st = m.start();
        // Restore PATH before asserting so any subsequent failure is legible.
-        if let Some(p) = saved { std::env::set_var("PATH", p); }
+        if let Some(p) = saved {
+            std::env::set_var("PATH", p);
+        }
        assert_eq!(st, SmbState::SmbdMissing);
    }

@@ -347,5 +388,27 @@ mod tests {
        assert!(conf.contains("guest ok = yes"));
        assert!(conf.contains("read only = yes"));
        assert!(conf.contains("server min protocol = SMB2"));
+        assert!(conf.contains("workgroup = OPENPXE"));
+    }
+
+    #[test]
+    fn write_conf_includes_winpe_reconnect_tuning() {
+        let dir = tempdir().unwrap();
+        let m = SmbManager::new(dir.path().into());
+        m.write_conf().unwrap();
+        let conf = std::fs::read_to_string(dir.path().join("smb.conf")).unwrap();
+        for expected in [
+            "reset on zero vc = yes",
+            "oplocks = no",
+            "kernel oplocks = no",
+            "level2 oplocks = no",
+            "strict locking = no",
+            "deadtime = 1",
+        ] {
+            assert!(
+                conf.contains(expected),
+                "missing Windows reconnect Samba option {expected} in:\n{conf}"
+            );
+        }
    }
 }
@@ -3,8 +3,8 @@
 use crate::entry::{BootEntry, BootKind, KernelArgs};
 use crate::introspect::{introspect, DistroFamily, IntrospectionReport};
 use bytes::Bytes;
+use openpxe_core::{Error, Result};
 use parking_lot::RwLock;
-use pxeforge_core::{Error, Result};
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
 use std::collections::HashMap;
@@ -48,6 +48,25 @@ pub struct IsoMeta {
    /// Old `meta.json` files without this field deserialize as `Local`.
    #[serde(default)]
    pub source: IsoSource,
+    /// Optional bcrypt hash of an operator-set password. When present,
+    /// `/boot/<entry>.ipxe` returns a `read --secret` prompt instead of
+    /// the boot script until the client chains back with the correct
+    /// `?token=...`. We never store, log, or transmit the plaintext.
+    /// Skipped on serialize when None to keep meta.json clean for
+    /// the common no-password case.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub password_hash: Option<String>,
+}
+
+impl IsoMeta {
+    /// Convenience predicate the HTTP layer + UI can both use.
+    #[must_use]
+    pub fn is_password_protected(&self) -> bool {
+        self.password_hash
+            .as_deref()
+            .map(str::trim)
+            .is_some_and(|h| !h.is_empty())
+    }
 }

 pub struct UploadHandle {
@@ -94,6 +113,7 @@ impl UploadHandle {
            introspection,
            boot_entries,
            source: IsoSource::Local,
+            password_hash: None,
        };
        store.persist_meta(&meta).await?;
        store.insert(meta.clone());
@@ -150,7 +170,9 @@ impl IsoStore {
        let mut entries = tokio::fs::read_dir(self.iso_dir.as_path()).await?;
        while let Some(e) = entries.next_entry().await? {
            let p = e.path();
-            if p.extension().and_then(|s| s.to_str()) != Some("json") { continue; }
+            if p.extension().and_then(|s| s.to_str()) != Some("json") {
+                continue;
+            }
            if !p
                .file_name()
                .and_then(|s| s.to_str())
@@ -194,6 +216,9 @@ impl IsoStore {
            return Err(Error::Invalid(format!("iso '{id}' already exists")));
        }
        let partial_path = self.iso_dir.join(format!("{id}.partial"));
+        if partial_path.exists() {
+            return Err(Error::Invalid(format!("iso '{id}' is already uploading")));
+        }
        let file = tokio::fs::File::create(&partial_path).await?;
        Ok(UploadHandle {
            id,
@@ -256,7 +281,10 @@ impl IsoStore {
    /// share or unmount the NFS share entirely.
    pub async fn delete(&self, id: &str) -> Result<()> {
        let meta = self.get(id);
-        let is_local = matches!(meta.as_ref().map(|m| &m.source), Some(IsoSource::Local) | None);
+        let is_local = matches!(
+            meta.as_ref().map(|m| &m.source),
+            Some(IsoSource::Local) | None
+        );
        if is_local {
            let iso = self.iso_path(id);
            let meta_path = self.meta_path(id);
@@ -289,6 +317,7 @@ impl IsoStore {
            introspection,
            boot_entries,
            source,
+            password_hash: None,
        };
        self.inner.write().isos.insert(id, meta);
    }
@@ -298,9 +327,69 @@ impl IsoStore {
    /// to clean out stale entries.
    pub fn drop_external_source(&self, mount_id: &str) {
        let mut g = self.inner.write();
-        g.isos.retain(|_, m| {
-            !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id)
-        });
+        g.isos.retain(
+            |_, m| !matches!(&m.source, IsoSource::Nfs { mount_id: mid, .. } if mid == mount_id),
+        );
+    }
+
+    /// Set or clear an ISO's boot password.
+    ///
+    /// `Some("plaintext")` hashes via bcrypt (cost 10 — fast enough for
+    /// an interactive iPXE prompt, slow enough to be hostile to brute
+    /// force on a leaked meta.json) and persists.
+    ///
+    /// `None` removes the password — the next /boot/<id>.ipxe request
+    /// returns the script directly without a prompt.
+    ///
+    /// We never store, log, or transmit the plaintext.
+    pub async fn set_password(&self, id: &str, password: Option<&str>) -> Result<()> {
+        let new_hash = match password {
+            None => None,
+            Some(pw) => {
+                let pw = pw.trim();
+                if pw.is_empty() {
+                    None
+                } else {
+                    let h = bcrypt::hash(pw, bcrypt::DEFAULT_COST)
+                        .map_err(|e| Error::Other(e.into()))?;
+                    Some(h)
+                }
+            }
+        };
+
+        // Update in-memory + grab a clone for persistence outside the lock.
+        let updated = {
+            let mut g = self.inner.write();
+            let m = g
+                .isos
+                .get_mut(id)
+                .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+            m.password_hash = new_hash;
+            m.clone()
+        };
+        // NFS-sourced ISOs have no on-disk meta.json — skip persistence
+        // for them (the password lives in memory until the manager
+        // re-scans the share, then it's gone). Document this in the API
+        // handler so the operator knows.
+        if matches!(updated.source, IsoSource::Local) {
+            self.persist_meta(&updated).await?;
+        }
+        Ok(())
+    }
+
+    /// Verify a candidate password against the stored bcrypt hash.
+    /// Returns:
+    /// - `Ok(true)`   — match (or the ISO has no password set; boot is open)
+    /// - `Ok(false)`  — mismatch
+    /// - `Err(_)`     — id not found, or bcrypt error
+    pub fn verify_password(&self, id: &str, candidate: &str) -> Result<bool> {
+        let meta = self
+            .get(id)
+            .ok_or_else(|| Error::Invalid(format!("no such iso '{id}'")))?;
+        let Some(hash) = meta.password_hash else {
+            return Ok(true); // no password set — anyone can boot
+        };
+        bcrypt::verify(candidate, &hash).map_err(|e| Error::Other(e.into()))
    }
 }

@@ -346,7 +435,10 @@ pub fn generate_boot_entries_for(
 /// Build `BootEntry`s from the introspection report. URLs are relative —
 /// the HTTP layer rewrites them with the public base URL per request.
 fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> Vec<BootEntry> {
-    let title = r.volume_label.clone().unwrap_or_else(|| filename.to_string());
+    let title = r
+        .volume_label
+        .clone()
+        .unwrap_or_else(|| filename.to_string());
    match r.family {
        DistroFamily::WindowsPe if r.has_boot_wim => {
            // Standard wimboot chain. Paths are in-ISO; the HTTP layer maps
@@ -370,12 +462,22 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
        fam if r.kernel_path.is_some() => {
            let base = format!("iso/{id}");
            let kernel_url = format!("{base}{}", r.kernel_path.as_deref().unwrap_or(""));
-            let initrd_urls = r.initrd_paths.iter().map(|p| format!("{base}{p}")).collect();
-            let args = KernelArgs { cmdline: linux_cmdline(fam, id) };
+            let initrd_urls = r
+                .initrd_paths
+                .iter()
+                .map(|p| format!("{base}{p}"))
+                .collect();
+            let args = KernelArgs {
+                cmdline: linux_cmdline(fam, id),
+            };
            vec![BootEntry {
                id: format!("{id}-linux"),
                title,
-                kind: BootKind::LinuxKernel { kernel_url, initrd_urls, args },
+                kind: BootKind::LinuxKernel {
+                    kernel_url,
+                    initrd_urls,
+                    args,
+                },
            }]
        }
        _ => {
@@ -384,7 +486,9 @@ fn generate_boot_entries(id: &str, filename: &str, r: &IntrospectionReport) -> V
            vec![BootEntry {
                id: format!("{id}-sanboot"),
                title: format!("{title} (SAN boot — may fail for >1GiB ISOs)"),
-                kind: BootKind::SanBootIso { iso_url: format!("iso/{id}.iso") },
+                kind: BootKind::SanBootIso {
+                    iso_url: format!("iso/{id}.iso"),
+                },
            }]
        }
    }
@@ -416,6 +520,8 @@ fn linux_cmdline(family: DistroFamily, id: &str) -> String {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::introspect::{DistroFamily, IntrospectionReport};
+    use tempfile::tempdir;

    #[test]
    fn slugify_basic() {
@@ -427,4 +533,100 @@ mod tests {
        // If a path sneaks in, file_stem strips the directory — OK, not a hazard.
        assert_eq!(slugify("/etc/passwd"), "passwd");
    }
+
+    fn fake_meta(id: &str) -> IsoMeta {
+        IsoMeta {
+            id: id.into(),
+            filename: format!("{id}.iso"),
+            size_bytes: 0,
+            sha256_hex: None,
+            uploaded_at: OffsetDateTime::now_utc(),
+            introspection: IntrospectionReport {
+                family: DistroFamily::Unknown,
+                volume_label: None,
+                kernel_path: None,
+                initrd_paths: vec![],
+                has_boot_wim: false,
+            },
+            boot_entries: vec![],
+            source: IsoSource::Local,
+            password_hash: None,
+        }
+    }
+
+    #[tokio::test]
+    async fn password_round_trip_set_verify_clear() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        store
+            .inner
+            .write()
+            .isos
+            .insert("alpha".into(), fake_meta("alpha"));
+
+        // No password set — verify_password returns Ok(true) for any input.
+        assert!(store.verify_password("alpha", "anything").unwrap());
+        assert!(!store.get("alpha").unwrap().is_password_protected());
+
+        // Set a password.
+        store.set_password("alpha", Some("hunter2")).await.unwrap();
+        let m = store.get("alpha").unwrap();
+        assert!(m.is_password_protected());
+        assert!(m.password_hash.unwrap().starts_with("$2"));
+
+        // Verify correct + wrong.
+        assert!(store.verify_password("alpha", "hunter2").unwrap());
+        assert!(!store.verify_password("alpha", "wrong").unwrap());
+        assert!(!store.verify_password("alpha", "").unwrap());
+
+        // Clear by passing None or an empty string.
+        store.set_password("alpha", None).await.unwrap();
+        assert!(!store.get("alpha").unwrap().is_password_protected());
+        store.set_password("alpha", Some("again")).await.unwrap();
+        store.set_password("alpha", Some("   ")).await.unwrap();
+        assert!(!store.get("alpha").unwrap().is_password_protected());
+    }
+
+    #[tokio::test]
+    async fn set_password_for_unknown_id_errors() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        let r = store.set_password("does-not-exist", Some("pw")).await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[tokio::test]
+    async fn begin_upload_rejects_existing_partial_file() {
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        tokio::fs::write(dir.path().join("ubuntu.partial"), b"in-flight")
+            .await
+            .unwrap();
+
+        let r = store.begin_upload("ubuntu.iso").await;
+        assert!(matches!(r, Err(Error::Invalid(_))));
+    }
+
+    #[tokio::test]
+    async fn password_persists_via_meta_json_for_local_isos() {
+        // Hash makes it onto disk so it survives a restart.
+        let dir = tempdir().unwrap();
+        let store = IsoStore::new(dir.path().to_path_buf());
+        store.ensure_dirs().await.unwrap();
+        let meta = fake_meta("alpha");
+        store.persist_meta(&meta).await.unwrap();
+        store.insert(meta);
+        store.set_password("alpha", Some("s3cret")).await.unwrap();
+
+        // Re-load from disk and confirm the hash came back.
+        let store2 = IsoStore::new(dir.path().to_path_buf());
+        store2.load_from_disk().await.unwrap();
+        let reloaded = store2.get("alpha").expect("reloaded");
+        assert!(reloaded.is_password_protected());
+        assert!(store2.verify_password("alpha", "s3cret").unwrap());
+        assert!(!store2.verify_password("alpha", "wrong").unwrap());
+    }
 }
@@ -54,7 +54,10 @@ pub struct WimPatcher {
 impl WimPatcher {
    #[must_use]
    pub fn new(smb_host: String, smb_share: String) -> Self {
-        Self { smb_host, smb_share }
+        Self {
+            smb_host,
+            smb_share,
+        }
    }

    /// Apply WinPE patches to `boot.wim` inside `extracted_iso_dir`. Returns
@@ -72,31 +75,40 @@ impl WimPatcher {

        let work = match tempfile::tempdir() {
            Ok(d) => d,
-            Err(e) => return WinPatchState::Failed { reason: format!("tempdir: {e}") },
+            Err(e) => {
+                return WinPatchState::Failed {
+                    reason: format!("tempdir: {e}"),
+                }
+            }
        };

        // Stage the two files we want present at /Windows/System32/.
        let staging = work.path().join("stage/Windows/System32");
        if let Err(e) = std::fs::create_dir_all(&staging) {
-            return WinPatchState::Failed { reason: format!("staging mkdir: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("staging mkdir: {e}"),
+            };
        }
        if let Err(e) = std::fs::write(staging.join("winpeshl.ini"), WINPESHL_INI) {
-            return WinPatchState::Failed { reason: format!("write winpeshl.ini: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write winpeshl.ini: {e}"),
+            };
        }
        let startnet = render_startnet(&self.smb_host, &self.smb_share);
        if let Err(e) = std::fs::write(staging.join("startnet.cmd"), startnet) {
-            return WinPatchState::Failed { reason: format!("write startnet.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write startnet.cmd: {e}"),
+            };
        }

        // Build a wimlib update command file:
        //   add <stage>/Windows/System32 /Windows/System32
        let update_file = work.path().join("update.cmd");
-        let update_cmd = format!(
-            "add \"{}\" \"/Windows/System32\"\n",
-            staging.display()
-        );
+        let update_cmd = format!("add \"{}\" \"/Windows/System32\"\n", staging.display());
        if let Err(e) = std::fs::write(&update_file, update_cmd) {
-            return WinPatchState::Failed { reason: format!("write update.cmd: {e}") };
+            return WinPatchState::Failed {
+                reason: format!("write update.cmd: {e}"),
+            };
        }

        // Run wimlib-imagex update against image index 2 (WinPE).
@@ -120,7 +132,9 @@ impl WimPatcher {
                    String::from_utf8_lossy(&o.stderr)
                ),
            },
-            Err(e) => WinPatchState::Failed { reason: format!("spawn wimlib-imagex: {e}") },
+            Err(e) => WinPatchState::Failed {
+                reason: format!("spawn wimlib-imagex: {e}"),
+            },
        }
    }
 }
@@ -133,7 +147,9 @@ fn which(cmd: &str) -> Option<PathBuf> {
    let paths = std::env::var_os("PATH")?;
    for dir in std::env::split_paths(&paths) {
        let p = dir.join(cmd);
-        if p.is_file() { return Some(p); }
+        if p.is_file() {
+            return Some(p);
+        }
    }
    None
 }
@@ -160,7 +176,7 @@ fn render_startnet(host: &str, share: &str) -> String {
    // Bootimus v0.1.58 lesson: surface `net use` errors instead of
    // tight-looping on a blind retry. We retry but log every miss.
    s.push_str("@echo off\r\n");
-    s.push_str("echo PXEForge WinPE bootstrap\r\n");
+    s.push_str("echo OpenPXE WinPE bootstrap\r\n");
    s.push_str("wpeinit\r\n");
    // v0.1.58: explicitly start Workstation before mapping the share —
    // `net use` otherwise lazily inits SMB-client and races wpeinit.
@@ -174,7 +190,11 @@ fn render_startnet(host: &str, share: &str) -> String {
    )
    .unwrap();
    s.push_str(":havenet\r\n");
-    writeln!(s, "echo Mapping install media from \\\\{host}\\{share}...\r").unwrap();
+    writeln!(
+        s,
+        "echo Mapping install media from \\\\{host}\\{share}...\r"
+    )
+    .unwrap();
    writeln!(
        s,
        ":mapshare\r\nnet use Z: \\\\{host}\\{share} /user:guest \"\" /persistent:no && goto mapped\r\n\
@@ -205,6 +225,23 @@ mod tests {
        assert!(s.contains("setup.exe"));
    }

+    #[test]
+    fn startnet_primes_workstation_and_surfaces_mapping_errors() {
+        let s = render_startnet("10.0.0.5", "win11");
+        assert!(
+            s.contains("net start Workstation"),
+            "WinPE should explicitly start the SMB client before net use:\n{s}"
+        );
+        let net_use_line = s
+            .lines()
+            .find(|line| line.contains("net use Z:"))
+            .expect("net use line");
+        assert!(
+            !net_use_line.contains(">nul"),
+            "net use errors must remain visible in WinPE console: {net_use_line}"
+        );
+    }
+
    #[test]
    fn patcher_reports_wimlib_missing_gracefully() {
        // We don't assume wimlib is present in CI; this checks the missing
@@ -1,5 +1,5 @@
 [package]
-name = "pxeforge"
+name = "openpxe"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,16 +10,16 @@ description = "Container-native PXE boot server — a lightweight Rust clone of
 workspace = true

 [[bin]]
-name = "pxeforge"
+name = "openpxe"
 path = "src/main.rs"

 [dependencies]
-pxeforge-core.workspace = true
-pxeforge-dhcp-proxy.workspace = true
-pxeforge-tftp.workspace = true
-pxeforge-http-api.workspace = true
-pxeforge-iso-store.workspace = true
-pxeforge-ipxe-assets.workspace = true
+openpxe-core.workspace = true
+openpxe-dhcp-proxy.workspace = true
+openpxe-tftp.workspace = true
+openpxe-http-api.workspace = true
+openpxe-iso-store.workspace = true
+openpxe-ipxe-assets.workspace = true
 tokio.workspace = true
 axum.workspace = true
 tracing.workspace = true
@@ -1,27 +1,27 @@
-//! PXEForge entry point. Wires the three protocol servers (DHCP proxy,
+//! OpenPXE entry point. Wires the three protocol servers (DHCP proxy,
 //! TFTP, HTTP) to the shared ISO store and client registry, then runs
 //! them concurrently.

 use clap::{Parser, Subcommand};
-use pxeforge_core::{
-    ClientRegistry, Config, DhcpMode, GateQueue, HostBindings, LogBus, LogBusLayer, Metrics,
+use openpxe_core::{
+    ClientRegistry, Config, DeploymentQueue, DhcpMode, HostBindings, LogBus, LogBusLayer, Metrics,
    SettingsStore,
 };
-use pxeforge_dhcp_proxy::DhcpProxyServer;
-use pxeforge_http_api::{build_router, AppState};
-use pxeforge_iso_store::{IsoStore, NfsManager, SmbManager};
-use std::sync::Arc;
-use pxeforge_tftp::TftpServer;
+use openpxe_dhcp_proxy::DhcpProxyServer;
+use openpxe_http_api::{build_router, AppState};
+use openpxe_iso_store::{IsoStore, NfsManager, SmbManager};
+use openpxe_tftp::TftpServer;
 use std::net::{Ipv4Addr, SocketAddr};
 use std::path::PathBuf;
+use std::sync::Arc;
 use tokio::io::AsyncReadExt;

 #[derive(Debug, Parser)]
-#[command(name = "pxeforge", about = "Container-native PXE boot server", version)]
+#[command(name = "openpxe", about = "Container-native PXE boot server", version)]
 struct Cli {
    /// Path to a TOML config file. All fields have sensible defaults and can
-    /// also be overridden with env vars (PXEFORGE_*).
-    #[arg(long, env = "PXEFORGE_CONFIG")]
+    /// also be overridden with env vars (OPENPXE_*).
+    #[arg(long, env = "OPENPXE_CONFIG")]
    config: Option<PathBuf>,

    #[command(subcommand)]
@@ -38,8 +38,8 @@ enum Command {
    /// Example:
    ///   docker run --rm \
    ///     -v /my/isos:/seed:ro \
-    ///     -v pxeforge-data:/var/lib/pxeforge/isos \
-    ///     pxeforge:0.1.0 seed --from /seed
+    ///     -v openpxe-data:/var/lib/openpxe/isos \
+    ///     openpxe:0.4.1 seed --from /seed
    Seed {
        /// Source directory containing one or more `.iso` files.
        #[arg(long)]
@@ -70,7 +70,7 @@ async fn main() -> anyhow::Result<()> {
        return run_command(cmd, config).await;
    }

-    pxeforge_ipxe_assets::log_availability();
+    openpxe_ipxe_assets::log_availability();

    let our_ip = match config.server.public_ip {
        Some(ip) => {
@@ -88,7 +88,7 @@ async fn main() -> anyhow::Result<()> {
                // message instead of serving a broken deployment.
                anyhow::bail!(
                    "could not detect a non-loopback IPv4 address for this host. \
-                     Set PXEFORGE_PUBLIC_IP=<your-ip> (e.g. `-e PXEFORGE_PUBLIC_IP=10.0.0.5` \
+                     Set OPENPXE_PUBLIC_IP=<your-ip> (e.g. `-e OPENPXE_PUBLIC_IP=10.0.0.5` \
                     in docker, or the env block in OpenShift Deployment) to advertise \
                     a specific IP to PXE clients."
                );
@@ -100,9 +100,10 @@ async fn main() -> anyhow::Result<()> {
    let iso_store = IsoStore::new(config.paths.iso_dir.clone());
    iso_store.load_from_disk().await?;
    let clients = ClientRegistry::new();
-    let gates = GateQueue::new();
+    let queue = DeploymentQueue::new();
    let settings = SettingsStore::load_or_default(&config.paths.work_dir);
    let hosts = HostBindings::load_or_default(&config.paths.work_dir);
+    let boot_log = openpxe_core::BootLog::load_or_default(&config.paths.work_dir);
    let metrics = Metrics::new();

    // Build the SMB manager unconditionally — it starts/stops on the
@@ -120,7 +121,7 @@ async fn main() -> anyhow::Result<()> {
    let nfs = NfsManager::new(&config.paths.work_dir, iso_store.clone());
    iso_store.set_nfs_root(nfs.mount_root());
    if let Err(e) = nfs.load_and_remount().await {
-        tracing::warn!(target: "pxeforge::nfs", "could not reload NFS mounts: {e}");
+        tracing::warn!(target: "openpxe::nfs", "could not reload NFS mounts: {e}");
    }

    // Sniff network details for the Network tab. None of these are
@@ -129,7 +130,7 @@ async fn main() -> anyhow::Result<()> {
    // own gateway.
    let net = detect_network_info(our_ip);
    tracing::info!(
-        target: "pxeforge::net",
+        target: "openpxe::net",
        nic = %net.nic_name, mask = %net.subnet_mask, gateway = %net.gateway,
        "network info"
    );
@@ -138,11 +139,13 @@ async fn main() -> anyhow::Result<()> {
        iso_store: iso_store.clone(),
        clients: clients.clone(),
        settings: settings.clone(),
-        gates: gates.clone(),
+        queue: queue.clone(),
        hosts: hosts.clone(),
+        boot_log: boot_log.clone(),
        metrics: metrics.clone(),
        smb: Some(smb.clone()),
        nfs: nfs.clone(),
+        uploads: openpxe_http_api::uploads::UploadSessions::default(),
        log_bus: log_bus.clone(),
        started_at: time::OffsetDateTime::now_utc(),
        public_base_url: public_base_url.clone(),
@@ -155,8 +158,16 @@ async fn main() -> anyhow::Result<()> {
    let router = build_router(state);
    let http_task = tokio::spawn(async move {
        let listener = tokio::net::TcpListener::bind(http_addr).await?;
-        tracing::info!(target: "pxeforge::http", "HTTP listening on {http_addr}");
-        axum::serve(listener, router).await?;
+        tracing::info!(target: "openpxe::http", "HTTP listening on {http_addr}");
+        // `into_make_service_with_connect_info` is required so per-request
+        // `ConnectInfo<SocketAddr>` extractors can resolve the peer IP —
+        // used by `/boot/<entry>.ipxe` to record the booting client's
+        // address into the Host log. Without this the extractor 500s.
+        axum::serve(
+            listener,
+            router.into_make_service_with_connect_info::<std::net::SocketAddr>(),
+        )
+        .await?;
        Ok::<_, anyhow::Error>(())
    });

@@ -182,7 +193,7 @@ async fn main() -> anyhow::Result<()> {
            tokio::spawn(s.run())
        }
        DhcpMode::Disabled => {
-            tracing::info!(target: "pxeforge::dhcp", "DHCP disabled — external DHCP must set next-server + filename");
+            tracing::info!(target: "openpxe::dhcp", "DHCP disabled — external DHCP must set next-server + filename");
            tokio::spawn(async { futures_forever().await })
        }
    };
@@ -210,7 +221,11 @@ async fn run_command(cmd: Command, config: Config) -> anyhow::Result<()> {
 /// Reuses `IsoStore::begin_upload` / `finish` so the resulting meta on disk
 /// is identical to a web upload — same slug rules, same introspection, same
 /// sha256.
-async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) -> anyhow::Result<()> {
+async fn seed_from_dir(
+    src: &std::path::Path,
+    config: &Config,
+    dry_run: bool,
+) -> anyhow::Result<()> {
    let store = IsoStore::new(config.paths.iso_dir.clone());
    store.load_from_disk().await?;
    let mut entries = tokio::fs::read_dir(src).await?;
@@ -218,7 +233,12 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
    let mut skipped = 0u32;
    while let Some(entry) = entries.next_entry().await? {
        let p = entry.path();
-        if p.extension().and_then(|e| e.to_str()).map(str::to_ascii_lowercase).as_deref() != Some("iso") {
+        if p.extension()
+            .and_then(|e| e.to_str())
+            .map(str::to_ascii_lowercase)
+            .as_deref()
+            != Some("iso")
+        {
            continue;
        }
        let filename = p
@@ -226,12 +246,18 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
            .and_then(|s| s.to_str())
            .ok_or_else(|| anyhow::anyhow!("non-utf8 filename: {}", p.display()))?
            .to_string();
-        println!("  {} ({} bytes)", filename, tokio::fs::metadata(&p).await?.len());
-        if dry_run { continue; }
+        println!(
+            "  {} ({} bytes)",
+            filename,
+            tokio::fs::metadata(&p).await?.len()
+        );
+        if dry_run {
+            continue;
+        }

        let mut handle = match store.begin_upload(&filename).await {
            Ok(h) => h,
-            Err(pxeforge_core::Error::Invalid(e)) => {
+            Err(openpxe_core::Error::Invalid(e)) => {
                eprintln!("    skip: {e}");
                skipped += 1;
                continue;
@@ -242,15 +268,23 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
        let mut buf = vec![0u8; 1024 * 1024];
        loop {
            let n = file.read(&mut buf).await?;
-            if n == 0 { break; }
+            if n == 0 {
+                break;
+            }
            let chunk: bytes::Bytes = buf[..n].to_vec().into();
            handle.write_chunk(&chunk).await?;
        }
        let meta = handle.finish(&store).await?;
-        println!("    -> id={} family={:?}", meta.id, meta.introspection.family);
+        println!(
+            "    -> id={} family={:?}",
+            meta.id, meta.introspection.family
+        );
        imported += 1;
    }
-    println!("\nimported={imported}  skipped={skipped}  {}", if dry_run { "(dry run)" } else { "" });
+    println!(
+        "\nimported={imported}  skipped={skipped}  {}",
+        if dry_run { "(dry run)" } else { "" }
+    );
    Ok(())
 }

@@ -258,7 +292,7 @@ async fn seed_from_dir(src: &std::path::Path, config: &Config, dry_run: bool) ->
 /// detection fails — callers should fail startup rather than silently using
 /// a loopback address (which would give every PXE client an unreachable
 /// `http://127.0.0.1/...`). Users in multi-homed setups should set
-/// `PXEFORGE_PUBLIC_IP` explicitly.
+/// `OPENPXE_PUBLIC_IP` explicitly.
 fn detect_primary_ipv4() -> Option<Ipv4Addr> {
    // First try: route to the public internet. `UdpSocket::connect` to a
    // well-known external address causes the OS to populate `local_addr`
@@ -294,15 +328,14 @@ fn hostname() -> std::io::Result<String> {
    if let Ok(h) = std::fs::read_to_string("/proc/sys/kernel/hostname") {
        return Ok(h.trim().to_string());
    }
-    std::env::var("HOSTNAME").map_err(|_| std::io::Error::new(
-        std::io::ErrorKind::NotFound, "no hostname",
-    ))
+    std::env::var("HOSTNAME")
+        .map_err(|_| std::io::Error::new(std::io::ErrorKind::NotFound, "no hostname"))
 }

 fn init_tracing(bus: Arc<LogBus>) {
    use tracing_subscriber::{fmt, prelude::*, EnvFilter};
-    let filter = EnvFilter::try_from_env("PXEFORGE_LOG")
-        .unwrap_or_else(|_| EnvFilter::new("info,pxeforge=debug"));
+    let filter = EnvFilter::try_from_env("OPENPXE_LOG")
+        .unwrap_or_else(|_| EnvFilter::new("info,openpxe=debug"));
    tracing_subscriber::registry()
        .with(filter)
        .with(fmt::layer().with_target(true))
@@ -328,7 +361,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {

    // `ip -o -f inet addr show` lists every interface with its
    // `inet a.b.c.d/mask`. We match the line that mentions our IP.
-    if let Ok(out) = Command::new("ip").args(["-o", "-f", "inet", "addr", "show"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["-o", "-f", "inet", "addr", "show"])
+        .output()
+    {
        if let Ok(text) = String::from_utf8(out.stdout) {
            for line in text.lines() {
                if !line.contains(&our_ip.to_string()) {
@@ -353,7 +389,10 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {
    }

    // `ip route show default` -> "default via 10.0.0.1 dev enp1s0 ..."
-    if let Ok(out) = Command::new("ip").args(["route", "show", "default"]).output() {
+    if let Ok(out) = Command::new("ip")
+        .args(["route", "show", "default"])
+        .output()
+    {
        if let Ok(text) = String::from_utf8(out.stdout) {
            if let Some(line) = text.lines().next() {
                let mut parts = line.split_whitespace();
@@ -374,7 +413,11 @@ fn detect_network_info(our_ip: Ipv4Addr) -> NetworkInfo {

 fn prefix_to_dotted(prefix: u8) -> String {
    let prefix = prefix.min(32);
-    let mask: u32 = if prefix == 0 { 0 } else { u32::MAX << (32 - prefix) };
+    let mask: u32 = if prefix == 0 {
+        0
+    } else {
+        u32::MAX << (32 - prefix)
+    };
    format!(
        "{}.{}.{}.{}",
        (mask >> 24) & 0xff,
@@ -1,5 +1,5 @@
 [package]
-name = "pxeforge-tftp"
+name = "openpxe-tftp"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
@@ -10,8 +10,8 @@ description = "TFTP server (RFC 1350/2347/2348/2349/7440) for iPXE chainload"
 workspace = true

 [dependencies]
-pxeforge-core.workspace = true
-pxeforge-ipxe-assets.workspace = true
+openpxe-core.workspace = true
+openpxe-ipxe-assets.workspace = true
 tokio.workspace = true
 socket2.workspace = true
 tracing.workspace = true
@@ -7,12 +7,12 @@
 //! `tftpd`/`in.tftpd` works and is why TFTP is awkward behind stateful NAT:
 //! the ephemeral ports must be reachable from the client.
 //!
-//! We only serve files from `pxeforge_ipxe_assets::asset_bytes` — that is,
+//! We only serve files from `openpxe_ipxe_assets::asset_bytes` — that is,
 //! the bundled iPXE binaries and wimboot. No filesystem is ever opened, so
 //! `../` path traversal attempts simply return ENOENT.

-use pxeforge_core::{ClientEvent, ClientRegistry};
-use pxeforge_ipxe_assets::asset_bytes;
+use openpxe_core::{ClientEvent, ClientRegistry};
+use openpxe_ipxe_assets::asset_bytes;
 use socket2::{Domain, Protocol, Socket, Type};
 use std::net::{IpAddr, SocketAddr};
 use std::sync::Arc;
@@ -35,7 +35,7 @@ pub struct TftpServer {
    bind: IpAddr,
    port: u16,
    clients: Arc<ClientRegistry>,
-    metrics: pxeforge_core::Metrics,
+    metrics: openpxe_core::Metrics,
 }

 impl TftpServer {
@@ -43,14 +43,19 @@ impl TftpServer {
        bind: IpAddr,
        port: u16,
        clients: Arc<ClientRegistry>,
-        metrics: pxeforge_core::Metrics,
+        metrics: openpxe_core::Metrics,
    ) -> Self {
-        Self { bind, port, clients, metrics }
+        Self {
+            bind,
+            port,
+            clients,
+            metrics,
+        }
    }

    pub async fn run(self) -> anyhow::Result<()> {
        let sock = bind_udp(self.bind, self.port)?;
-        tracing::info!(target: "pxeforge::tftp", "TFTP listening on {}:{}", self.bind, self.port);
+        tracing::info!(target: "openpxe::tftp", "TFTP listening on {}:{}", self.bind, self.port);
        let clients = self.clients.clone();
        let metrics = self.metrics.clone();
        let mut buf = vec![0u8; 2048];
@@ -58,7 +63,7 @@ impl TftpServer {
            let (n, from) = match sock.recv_from(&mut buf).await {
                Ok(v) => v,
                Err(e) => {
-                    tracing::warn!(target: "pxeforge::tftp", "recv error: {e}");
+                    tracing::warn!(target: "openpxe::tftp", "recv error: {e}");
                    continue;
                }
            };
@@ -69,7 +74,7 @@ impl TftpServer {
            tokio::spawn(async move {
                if let Err(e) = handle_rrq(data, from, bind_ip, clients, metrics.clone()).await {
                    metrics.record_tftp_err();
-                    tracing::warn!(target: "pxeforge::tftp", peer=%from, "handler error: {e}");
+                    tracing::warn!(target: "openpxe::tftp", peer=%from, "handler error: {e}");
                }
            });
        }
@@ -81,30 +86,34 @@ async fn handle_rrq(
    peer: SocketAddr,
    bind_ip: IpAddr,
    clients: Arc<ClientRegistry>,
-    metrics: pxeforge_core::Metrics,
+    metrics: openpxe_core::Metrics,
 ) -> anyhow::Result<()> {
    let Some(req) = parse_rrq(&packet) else {
        return Ok(());
    };
-    let Request { filename, options, .. } = req;
+    let Request {
+        filename, options, ..
+    } = req;

    // Per-transfer ephemeral socket.
    let sock = bind_udp(bind_ip, 0)?;

    let Some(file_bytes) = asset_bytes(&filename) else {
        let _ = send_error(&sock, peer, ERR_FILE_NOT_FOUND, "no such file").await;
-        tracing::info!(target: "pxeforge::tftp", peer=%peer, file=%filename, "404");
+        tracing::info!(target: "openpxe::tftp", peer=%peer, file=%filename, "404");
        clients.record(
            &peer.ip().to_string(),
            Some(peer.ip()),
            None,
-            ClientEvent::TftpRead { file: filename.clone() },
+            ClientEvent::TftpRead {
+                file: filename.clone(),
+            },
        );
        return Ok(());
    };

    tracing::info!(
-        target: "pxeforge::tftp",
+        target: "openpxe::tftp",
        peer=%peer, file=%filename, size=file_bytes.len(),
        "serving"
    );
@@ -112,7 +121,9 @@ async fn handle_rrq(
        &peer.ip().to_string(),
        Some(peer.ip()),
        None,
-        ClientEvent::TftpRead { file: filename.clone() },
+        ClientEvent::TftpRead {
+            file: filename.clone(),
+        },
    );

    // Negotiate options.
@@ -173,7 +184,9 @@ async fn handle_rrq(

        // Send one window worth of DATA.
        for _ in 0..window {
-            if offset >= total { break; }
+            if offset >= total {
+                break;
+            }
            let end = (offset + blksize).min(total);
            let chunk = &file_bytes[offset..end];
            let pkt = encode_data(block_no, chunk);
@@ -200,7 +213,7 @@ async fn handle_rrq(
                    tries += 1;
                    if tries > 5 {
                        tracing::warn!(
-                            target: "pxeforge::tftp",
+                            target: "openpxe::tftp",
                            peer=%peer, last_block=last_block_in_window,
                            "timeout after {tries} retries, aborting transfer"
                        );
@@ -241,7 +254,7 @@ async fn handle_rrq(
        let _ = tokio::time::timeout(Duration::from_secs(3), recv_ack(&sock, peer)).await;
    }

-    tracing::debug!(target: "pxeforge::tftp", peer=%peer, bytes=total, "transfer complete");
+    tracing::debug!(target: "openpxe::tftp", peer=%peer, bytes=total, "transfer complete");
    metrics.record_tftp_ok(total as u64);
    Ok(())
 }
@@ -255,20 +268,30 @@ struct Request {
 }

 fn parse_rrq(pkt: &[u8]) -> Option<Request> {
-    if pkt.len() < 4 { return None; }
+    if pkt.len() < 4 {
+        return None;
+    }
    let op = u16::from_be_bytes([pkt[0], pkt[1]]);
-    if op != OP_RRQ { return None; }
+    if op != OP_RRQ {
+        return None;
+    }
    let mut rest = &pkt[2..];
    let filename = read_cstr(&mut rest)?;
    let mode = read_cstr(&mut rest)?;
    let mut options = Vec::new();
    while !rest.is_empty() {
        let Some(k) = read_cstr(&mut rest) else { break };
-        if k.is_empty() { break; }
+        if k.is_empty() {
+            break;
+        }
        let v = read_cstr(&mut rest).unwrap_or_default();
        options.push((k.to_ascii_lowercase(), v));
    }
-    Some(Request { filename, mode, options })
+    Some(Request {
+        filename,
+        mode,
+        options,
+    })
 }

 fn read_cstr(buf: &mut &[u8]) -> Option<String> {
@@ -316,8 +339,12 @@ async fn recv_ack(sock: &UdpSocket, peer: SocketAddr) -> anyhow::Result<u16> {
    let mut buf = [0u8; 32];
    loop {
        let (n, from) = sock.recv_from(&mut buf).await?;
-        if from.ip() != peer.ip() { continue; }
-        if n < 4 { continue; }
+        if from.ip() != peer.ip() {
+            continue;
+        }
+        if n < 4 {
+            continue;
+        }
        let op = u16::from_be_bytes([buf[0], buf[1]]);
        match op {
            OP_ACK => return Ok(u16::from_be_bytes([buf[2], buf[3]])),
@@ -344,14 +371,19 @@ async fn wait_for_ack(
            Ok(Ok(_)) => {}
            Ok(Err(_)) | Err(_) => {
                tries += 1;
-                if tries > 5 { return Ok(false); }
+                if tries > 5 {
+                    return Ok(false);
+                }
            }
        }
    }
 }

 fn bind_udp(bind: IpAddr, port: u16) -> anyhow::Result<UdpSocket> {
-    let domain = match bind { IpAddr::V4(_) => Domain::IPV4, IpAddr::V6(_) => Domain::IPV6 };
+    let domain = match bind {
+        IpAddr::V4(_) => Domain::IPV4,
+        IpAddr::V6(_) => Domain::IPV6,
+    };
    let sock = Socket::new(domain, Type::DGRAM, Some(Protocol::UDP))?;
    sock.set_reuse_address(true)?;
    sock.set_nonblocking(true)?;
@@ -382,7 +414,9 @@ pub fn plan_window(
    let mut o = offset;
    let mut b = starting_block;
    for _ in 0..window {
-        if o >= total { break; }
+        if o >= total {
+            break;
+        }
        let end = (o + blksize).min(total);
        out.push((b, end - o));
        o = end;
@@ -453,7 +487,7 @@ mod tests {
        assert_eq!(p, vec![(65534, 1024), (65535, 1024)]);
        let p2 = plan_window(2048, 2048, 1024, 2, 0);
        assert!(p2.is_empty()); // nothing past EOF
-        // And a cross-boundary case:
+                                // And a cross-boundary case:
        let p3 = plan_window(3072, 0, 1024, 3, 65535);
        assert_eq!(p3, vec![(65535, 1024), (0, 1024), (1, 1024)]);
    }
@@ -1,10 +1,10 @@
 [package]
-name = "pxeforge-webui"
+name = "openpxe-webui"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
 authors.workspace = true
-description = "Embedded single-file web UI for PXEForge"
+description = "Embedded single-file web UI for OpenPXE"

 [lints]
 workspace = true
@@ -1,81 +0,0 @@
-<svg viewBox="0 0 200 200" xmlns="http://www.w3.org/2000/svg" fill="none">
-  <title>PXEForge — forging</title>
-  <defs>
-    <linearGradient id="afBody" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#aab3c2"/>
-      <stop offset="55%" stop-color="#7d8696"/>
-      <stop offset="100%" stop-color="#525a6b"/>
-    </linearGradient>
-    <linearGradient id="afFace" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#cdd5e1"/>
-      <stop offset="100%" stop-color="#9aa3b3"/>
-    </linearGradient>
-    <linearGradient id="afBase" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#3b4252"/>
-      <stop offset="100%" stop-color="#252a36"/>
-    </linearGradient>
-    <radialGradient id="afSpark" cx="50%" cy="50%" r="50%">
-      <stop offset="0%" stop-color="#fff5b8" stop-opacity="1"/>
-      <stop offset="40%" stop-color="#ff9a3a" stop-opacity="0.9"/>
-      <stop offset="100%" stop-color="#ff5a18" stop-opacity="0"/>
-    </radialGradient>
-    <radialGradient id="afEmber" cx="50%" cy="50%" r="50%">
-      <stop offset="0%" stop-color="#ffd47a" stop-opacity="1"/>
-      <stop offset="100%" stop-color="#ff7322" stop-opacity="0"/>
-    </radialGradient>
-  </defs>
-
-  <!-- Anvil shifted down so sparks have room to rise above -->
-  <g transform="translate(0,40)">
-    <!-- Horn + face -->
-    <path d="M14 36 L72 30 L162 30 L162 46 L72 46 Z"
-          fill="url(#afFace)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-    <!-- Body / waist -->
-    <path d="M70 46 L160 46 L142 70 L88 70 Z"
-          fill="url(#afBody)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-    <!-- Pillar -->
-    <rect x="92" y="70" width="46" height="26" fill="url(#afBody)"
-          stroke="#1d2330" stroke-width="2.4"/>
-    <!-- Base -->
-    <path d="M62 96 L168 96 L160 110 L70 110 Z"
-          fill="url(#afBase)" stroke="#0d1018" stroke-width="2.4" stroke-linejoin="round"/>
-    <line x1="74" y1="34" x2="158" y2="34" stroke="#e6ecf5" stroke-width="1.2" opacity="0.7"/>
-    <!-- Soft underglow on top face where the sparks land -->
-    <ellipse cx="115" cy="33" rx="42" ry="6" fill="url(#afEmber)" opacity="0.55">
-      <animate attributeName="opacity" values="0.35;0.7;0.35"
-               dur="1.6s" repeatCount="indefinite"/>
-    </ellipse>
-  </g>
-
-  <!-- Sparks. SMIL animations only — no JS, no CSS needed. Each spark
-       rises, fades, restarts at a staggered delay for an organic feel. -->
-  <g class="sparks">
-    <circle cx="116" cy="62" r="3.4" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="14" dur="1.4s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="116;112;120;116" dur="1.4s" repeatCount="indefinite"/>
-      <animate attributeName="r" values="2;3.6;1.4" dur="1.4s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.4s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="105" cy="62" r="2.4" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="22" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="105;101;108;104" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-      <animate attributeName="r" values="1.6;2.8;1" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.7s" begin="0.25s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="125" cy="62" r="2.8" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="6" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="125;130;121;127" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-      <animate attributeName="r" values="1.8;3.2;1.2" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.9s" begin="0.55s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="113" cy="62" r="2" fill="url(#afEmber)" opacity="0">
-      <animate attributeName="cy" from="62" to="32" dur="1.2s" begin="0.9s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;0.9;0" dur="1.2s" begin="0.9s" repeatCount="indefinite"/>
-    </circle>
-    <circle cx="132" cy="62" r="2.2" fill="url(#afSpark)" opacity="0">
-      <animate attributeName="cy" from="62" to="20" dur="1.5s" begin="1.2s" repeatCount="indefinite"/>
-      <animate attributeName="cx" values="132;138;128" dur="1.5s" begin="1.2s" repeatCount="indefinite"/>
-      <animate attributeName="opacity" values="0;1;0" dur="1.5s" begin="1.2s" repeatCount="indefinite"/>
-    </circle>
-  </g>
-</svg>
@@ -1,4 +1,4 @@
-/* PXEForge web UI — Netbox-style minimal layout, fully offline.
+/* OpenPXE web UI — Netbox-style minimal layout, fully offline.
 *
 * Theme tokens live on `:root` (dark default) and `:root[data-theme=light]`.
 * Both palettes share variable *names*, so component CSS uses
@@ -8,23 +8,26 @@
 * CSS lands). */

 :root {
-  /* Dark palette (default). */
-  --bg:           #0b1018;
-  --bg-panel:    #121826;
-  --bg-panel-2:  #1a2334;
-  --bg-elev:     #223047;
-  --fg:           #e4e8ef;
-  --fg-dim:      #8a94a7;
-  --fg-dimmer:   #5a6379;
-  --accent:       #00d4b4;   /* Netbox-ish teal */
+  /* Jet-black dark palette (default). Modelled on Netbox Labs's
+     near-black product chrome, with surfaces stepping subtly upward
+     rather than the previous blue-tinted ramp, so the UI reads as a
+     genuine "dark" rather than "dim navy". */
+  --bg:           #030303;
+  --bg-panel:    #0a0a0a;
+  --bg-panel-2:  #141414;
+  --bg-elev:     #1c1c1c;
+  --fg:           #e8eaed;
+  --fg-dim:      #9aa0a6;
+  --fg-dimmer:   #6b7077;
+  --accent:       #00d4b4;   /* Netbox-ish teal — kept for brand */
  --accent-dim:  #07a38c;
  --warn:         #ffb347;
  --err:          #ef6e6e;
  --ok:           #4ade80;
-  --border:       #223047;
-  --border-soft: #172033;
-  --terminal-bg: #06090e;
-  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.25);
+  --border:       #1f1f1f;
+  --border-soft: #141414;
+  --terminal-bg: #050505;
+  --shadow-card: 0 1px 0 rgba(255,255,255,0.02), 0 8px 24px rgba(0,0,0,0.55);
  --radius:      6px;
  --radius-lg:  10px;
  --sidebar-w:  240px;
@@ -38,7 +41,7 @@
     consistency. Designed against Netbox Labs's reference screenshot:
     near-white surfaces, soft grey dividers, dark text. */
  --bg:           #f6f8fb;
-  --bg-panel:    #ffffff;
+  --bg-panel:    #fbfcfe;
  --bg-panel-2:  #f0f3f8;
  --bg-elev:     #e6ebf2;
  --fg:           #1c2330;
@@ -113,10 +116,30 @@ code, kbd { font-family: var(--mono); font-size: 12.5px;
 }
 .sidebar nav a.active .count { background: var(--accent); color: #002923; }
 .sidebar .footer {
-  padding: 10px 18px; border-top: 1px solid var(--border);
+  padding: 12px 18px; border-top: 1px solid var(--border);
  color: var(--fg-dimmer); font-size: 11px;
+  display: flex; flex-direction: column; gap: 4px;
 }
-.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0; }
+.sidebar .footer code { background: transparent; color: var(--fg-dim); padding: 0;
+  font-size: 11px; word-break: break-all; }
+.sidebar .footer .status-row {
+  display: flex; align-items: center; gap: 8px;
+  margin-bottom: 4px;
+}
+.sidebar .footer .status-row .dot {
+  width: 8px; height: 8px; border-radius: 50%; display: inline-block;
+  background: var(--fg-dimmer); flex: none;
+}
+.sidebar .footer .status-row .dot.ok   { background: var(--ok);
+  box-shadow: 0 0 6px color-mix(in srgb, var(--ok) 60%, transparent); }
+.sidebar .footer .status-row .dot.err  { background: var(--err); }
+.sidebar .footer .status-row .dot.warn { background: var(--warn); }
+.sidebar .footer .status-label { color: var(--fg-dim); }
+.sidebar .footer .status-value { color: var(--fg); font-weight: 600; }
+.sidebar .footer .status-value.ok   { color: var(--ok); }
+.sidebar .footer .status-value.err  { color: var(--err); }
+.sidebar .footer .status-value.warn { color: var(--warn); }
+.sidebar .footer .footer-sub { color: var(--fg-dimmer); margin-top: 2px; }

 /* ── Top bar ───────────────────────────────────────────────────────── */

@@ -230,7 +253,7 @@ button, .btn {
  cursor: pointer;
  transition: background 0.12s ease;
 }
-button:hover, .btn:hover { background: var(--accent-dim); color: #fff; }
+button:hover, .btn:hover { background: var(--accent-dim); color: #f4fffd; }
 button.ghost { background: transparent; color: var(--fg); border: 1px solid var(--border); }
 button.ghost:hover { background: var(--bg-panel-2); color: var(--fg); }
 button.danger { background: transparent; color: var(--err); border: 1px solid color-mix(in srgb, var(--err) 35%, transparent); }
@@ -279,35 +302,34 @@ label.check input { accent-color: var(--accent); }
 .progress.active { display: block; }
 .progress .bar { height: 100%; width: 0%; background: var(--accent); transition: width .25s; }

-/* ── Forge progress widget ─────────────────────────────────────────
-   Anvil-with-sparks animation paired with a horizontal progress bar.
-   Used on the Forge Gate tab to give a sense of the "in-flight"
-   imaging count without having to read a number. */
-.forge-progress {
+/* ── Imaging progress widget ───────────────────────────────────────
+   Animated brand mark paired with a horizontal progress bar; surfaces
+   on Dashboard and the Queue tab. */
+.queue-progress {
  display: flex; align-items: center; gap: 16px;
  padding: 16px;
 }
-.forge-progress .anvil {
-  width: 64px; height: 64px; flex: none;
-  background: url("/assets/anvil-forge.svg") no-repeat center / contain;
-  filter: drop-shadow(0 0 14px color-mix(in srgb, var(--warn) 40%, transparent));
+.queue-progress .mark {
+  width: 56px; height: 56px; flex: none; border-radius: 50%;
+  background: url("/assets/loader.svg") no-repeat center / contain;
+  filter: drop-shadow(0 0 16px rgba(255, 255, 255, 0.10));
 }
-.forge-progress .info { flex: 1; min-width: 0; }
-.forge-progress .info .label {
+.queue-progress .info { flex: 1; min-width: 0; }
+.queue-progress .info .label {
  font-size: 12.5px; color: var(--fg-dim); margin-bottom: 6px;
 }
-.forge-progress .bar-track {
+.queue-progress .bar-track {
  height: 8px; background: var(--bg-elev); border-radius: 4px;
  overflow: hidden; position: relative;
 }
-.forge-progress .bar-fill {
+.queue-progress .bar-fill {
  height: 100%;
-  background: linear-gradient(90deg, var(--warn), var(--accent));
+  background: linear-gradient(90deg, var(--accent-dim), var(--accent));
  width: 0%;
  transition: width 0.4s ease;
  position: relative;
 }
-.forge-progress .bar-fill::after {
+.queue-progress .bar-fill::after {
  /* Subtle moving sheen so the bar feels alive even at 0% movement. */
  content: ""; position: absolute; inset: 0;
  background: linear-gradient(
@@ -315,24 +337,24 @@ label.check input { accent-color: var(--accent); }
    rgba(255,255,255,0) 0%,
    rgba(255,255,255,0.18) 50%,
    rgba(255,255,255,0) 100%);
-  animation: forge-sheen 1.6s linear infinite;
+  animation: queue-sheen 1.6s linear infinite;
 }
-@keyframes forge-sheen {
+@keyframes queue-sheen {
  from { transform: translateX(-100%); }
  to   { transform: translateX(100%); }
 }
-.forge-progress.idle .anvil { filter: none; opacity: 0.45; }
-.forge-progress.idle .bar-fill::after { animation: none; }
+.queue-progress.idle .mark { filter: grayscale(0.85) opacity(0.55); }
+.queue-progress.idle .bar-fill::after { animation: none; }

-/* ── Page-load anvil ──────────────────────────────────────────────── */
+/* ── Page-load loader ────────────────────────────────────────────── */
 .loader {
  display: flex; flex-direction: column; align-items: center; gap: 12px;
  padding: 40px 20px;
  color: var(--fg-dim);
 }
-.loader .anvil {
-  width: 110px; height: 110px;
-  background: url("/assets/anvil-forge.svg") no-repeat center / contain;
+.loader .mark {
+  width: 96px; height: 96px;
+  background: url("/assets/loader.svg") no-repeat center / contain;
 }

 /* ── Top bar readiness chip ──────────────────────────────────────── */
@@ -380,23 +402,23 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .form-row { display: grid; grid-template-columns: repeat(4, 1fr); gap: 10px 14px; }
@media (max-width: 900px) { .form-row { grid-template-columns: 1fr; } }

-/* ── Gate queue "horse race" visual ──────────────────────────────── */
-.gate-track {
+/* ── Queued deployment visual ────────────────────────────────────── */
+.queue-track {
  display: grid; gap: 6px;
  padding: 10px 0;
 }
-.gate-row {
+.queue-row {
  display: grid; grid-template-columns: 32px 1fr auto auto; align-items: center;
  gap: 14px;
  padding: 8px 14px;
  background: var(--bg-panel-2); border-radius: var(--radius);
  border-left: 3px solid var(--accent);
 }
-.gate-row.assigned { border-left-color: var(--ok); }
-.gate-row .pos { font-family: var(--mono); font-size: 15px; color: var(--accent); font-weight: 600; }
-.gate-row.assigned .pos { color: var(--ok); }
-.gate-row .mac { font-family: var(--mono); font-size: 13px; }
-.gate-row .meta { color: var(--fg-dim); font-size: 12px; }
+.queue-row.assigned { border-left-color: var(--ok); }
+.queue-row .pos { font-family: var(--mono); font-size: 15px; color: var(--accent); font-weight: 600; }
+.queue-row.assigned .pos { color: var(--ok); }
+.queue-row .mac { font-family: var(--mono); font-size: 13px; }
+.queue-row .meta { color: var(--fg-dim); font-size: 12px; }

 .empty { color: var(--fg-dim); padding: 30px; text-align: center; }
 .msg { color: var(--fg-dim); font-size: 12.5px; margin-top: 8px; }
@@ -432,29 +454,29 @@ tr.unbootable td:first-child { border-left: 3px solid var(--warn); }
 .terminal .input-row {
  display: flex; align-items: center; gap: 8px;
  padding: 8px 14px;
-  background: #0a0e15;
-  border-top: 1px solid #1d2330;
+  background: #050505;
+  border-top: 1px solid #181818;
 }
 .terminal .input-row .prompt { color: var(--accent); font-family: var(--mono); }
 .terminal .input-row input {
-  flex: 1; background: transparent; border: 0; color: #e4e8ef;
+  flex: 1; background: transparent; border: 0; color: var(--fg);
  font: inherit; font-family: var(--mono); font-size: 13px;
  outline: none; padding: 4px 0;
 }
 .terminal .toolbar {
  display: flex; gap: 8px; align-items: center;
  padding: 8px 14px;
-  background: #0a0e15;
-  border-bottom: 1px solid #1d2330;
-  font-size: 12px; color: #8a94a7;
+  background: #050505;
+  border-bottom: 1px solid #181818;
+  font-size: 12px; color: var(--fg-dim);
 }
 .terminal .toolbar .right { margin-left: auto; display: flex; gap: 6px; }
 .terminal .toolbar button {
  padding: 3px 9px; font-size: 11px;
-  background: transparent; color: #8a94a7; border: 1px solid #1d2330;
+  background: transparent; color: var(--fg-dim); border: 1px solid #181818;
  font-weight: 500;
 }
-.terminal .toolbar button:hover { color: #e4e8ef; background: #1d2330; }
+.terminal .toolbar button:hover { color: var(--fg); background: #181818; }

 /* ── About card ─────────────────────────────────────────────────── */
 .about-hero { padding: 20px 24px; }
@@ -1,7 +1,7 @@
-// PXEForge web UI — vanilla JS, no build step, no framework, no network
+// OpenPXE web UI — vanilla JS, no build step, no framework, no network
 // dependencies. Uses fetch() + EventSource only.
 //
-// Tabs (Phase 4): Dashboard / Network / Forge Gate / Storage / Terminal /
+// Tabs (Phase 4): Dashboard / Network / Queue / Storage / Terminal /
 // About. The shell swaps a single view into #view-root.
 //
 // Keep this readable — nobody wants to debug a clever vanilla-JS
@@ -75,19 +75,19 @@
    return fetch(url, {method:'POST', headers:{'Content-Type':'application/json'}, body: JSON.stringify(body)});
  }

-  // Animated "anvil + progress bar" widget. Built once here and inlined
-  // wherever a card wants to convey "an image is being forged onto the
-  // bench right now." Used on the dashboard and on the Forge Gate.
-  function forgeProgressWidget(imaging, gateTotal) {
-    const total = Math.max(gateTotal, imaging, 1);
+  // Animated brand-mark + progress bar widget. Built once here and inlined
+  // wherever a card wants to convey "an image is being deployed onto a
+  // queued client right now." Used on the Dashboard and the Queue tab.
+  function queueProgressWidget(imaging, queueTotal) {
+    const total = Math.max(queueTotal, imaging, 1);
    const pct = imaging > 0 ? Math.round((imaging / total) * 100) : 0;
-    const root = el('div', {class: 'forge-progress' + (imaging === 0 ? ' idle' : '')}, [
-      el('div', {class: 'anvil', 'aria-hidden': 'true'}),
+    const root = el('div', {class: 'queue-progress' + (imaging === 0 ? ' idle' : '')}, [
+      el('div', {class: 'mark', 'aria-hidden': 'true'}),
      el('div', {class: 'info'}, [
        el('div', {class: 'label'},
          imaging === 0
            ? 'No active imaging'
-            : (imaging + ' of ' + total + ' device' + (total === 1 ? '' : 's') + ' being forged')),
+            : (imaging + ' of ' + total + ' device' + (total === 1 ? '' : 's') + ' deploying')),
        el('div', {class: 'bar-track'},
          el('div', {class: 'bar-fill', style: 'width:' + pct + '%'})),
      ]),
@@ -120,7 +120,7 @@
      const status = await getJSON('/api/status');
      const isos = await getJSON('/api/isos');
      const clients = (await getJSON('/api/clients')).clients || [];
-      const gates = (await getJSON('/api/gate')).gates || [];
+      const entries = (await getJSON('/api/queue')).entries || [];

      const ipxeOk = (status.ipxe_assets || []).length > 0;
      const stats = el('div', {class: 'statstrip'}, [
@@ -136,9 +136,9 @@
          el('div', {class: 'stat', style: 'padding-bottom:0'}, [
            el('div', {class: 'label'}, 'Imaging now'),
            el('div', {class: 'value'}, String(status.imaging_count || 0)),
-            el('div', {class: 'trend'}, (status.waiting_count || 0) + ' waiting at gate'),
+            el('div', {class: 'trend'}, (status.waiting_count || 0) + ' waiting in queue'),
          ]),
-          forgeProgressWidget(status.imaging_count || 0, status.gate_count || 0),
+          queueProgressWidget(status.imaging_count || 0, status.queue_count || 0),
        ]),
        el('div', {class: 'card'}, el('div', {class: 'stat'}, [
          el('div', {class: 'label'}, 'Images available'),
@@ -151,7 +151,7 @@
        el('div', {class: 'card'}, el('div', {class: 'stat'}, [
          el('div', {class: 'label'}, 'Uptime'),
          el('div', {class: 'value', style: 'font-size:22px'}, fmtUptime(status.uptime_secs)),
-          el('div', {class: 'trend'}, 'PXEForge ' + status.version),
+          el('div', {class: 'trend'}, 'OpenPXE ' + status.version),
        ])),
      ]);

@@ -159,10 +159,10 @@
      // boot" log. Use last_seen desc (already sorted by API).
      const recent = clients.slice(0, 8);
      const recentRows = recent.map(c => {
-        const g = gates.find(g => g.mac === c.mac);
+        const g = entries.find(g => g.mac === c.mac);
        let status = el('span', {class: 'tag ok'}, 'active');
        if (g && g.assigned_target) status = el('span', {class:'tag ok'}, 'assigned: ' + g.assigned_target);
-        else if (g) status = el('span', {class:'tag accent'}, '#' + g.position + ' at gate');
+        else if (g) status = el('span', {class:'tag accent'}, '#' + g.position + ' in queue');
        return el('tr', {}, [
          el('td', {class: 'mono'}, c.mac),
          el('td', {}, c.last_ip ? String(c.last_ip) : '-'),
@@ -229,13 +229,13 @@
          ]),
          el('p', {class:'msg'},
            'Server IP, NIC, mask, and gateway are auto-detected at startup. ' +
-            'To change them, set PXEFORGE_PUBLIC_IP and restart — editing them ' +
+            'To change them, set OPENPXE_PUBLIC_IP and restart — editing them ' +
            'from a hot UI would silently break PXE for every client mid-boot.'),
          el('label', {class:'field', style:'margin-top:18px'}, [
            el('span', {class:'name'}, 'DNS server (optional, informational)'),
            dns,
            el('span', {class:'hint'},
-              'PXEForge does not run a DNS server itself; this field records ' +
+              'OpenPXE does not run a DNS server itself; this field records ' +
              'what your upstream DNS is so you don\'t have to dig it out at ' +
              '3 AM during a deployment.'),
          ]),
@@ -246,9 +246,9 @@
      return el('div', {class:'grid'}, [networkCard]);
    },

-    gate: async () => {
-      const [{ gates = [] }, isos] = await Promise.all([
-        getJSON('/api/gate'), getJSON('/api/isos'),
+    queue: async () => {
+      const [{ entries = [] }, isos] = await Promise.all([
+        getJSON('/api/queue'), getJSON('/api/isos'),
      ]);
      const targets = isos.flatMap(i => i.boot_entries.map(e => ({
        id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family)
@@ -261,18 +261,18 @@
      const msg = el('div', {class:'msg'});
      launch.onclick = async () => {
        if (!pick.value) { msg.textContent = 'Pick an image first.'; msg.className='msg err'; return; }
-        const r = await postJSON('/api/gate/assign', { target: pick.value, gate_ids: [] });
+        const r = await postJSON('/api/queue/assign', { target: pick.value, entry_ids: [] });
        if (!r.ok) { msg.textContent = 'Assign failed: ' + r.status; msg.className='msg err'; return; }
        const j = await r.json();
        if (!j.ok) { msg.textContent = 'Assign failed: ' + (j.error || 'unknown'); msg.className='msg err'; return; }
        msg.textContent = 'Launched ' + j.assigned + ' client' + (j.assigned===1?'':'s') + ' → ' + j.target;
        msg.className = 'msg ok';
-        render('gate');
+        render('queue');
      };

-      const track = gates.length
-        ? el('div', {class:'gate-track'},
-            gates.map(g => el('div', {class:'gate-row' + (g.assigned_target ? ' assigned' : '')}, [
+      const track = entries.length
+        ? el('div', {class:'queue-track'},
+            entries.map(g => el('div', {class:'queue-row' + (g.assigned_target ? ' assigned' : '')}, [
              el('div', {class:'pos'}, '#' + g.position),
              el('div', {}, [
                el('div', {class:'mac'}, g.mac),
@@ -283,23 +283,23 @@
                ? el('span', {class:'tag ok'}, '→ ' + g.assigned_target)
                : el('span', {class:'tag accent'}, 'waiting')),
              el('button', {class:'ghost', onclick: async () => {
-                await fetch('/api/gate/' + encodeURIComponent(g.id), {method:'DELETE'});
-                render('gate');
+                await fetch('/api/queue/' + encodeURIComponent(g.id), {method:'DELETE'});
+                render('queue');
              }}, 'Release'),
            ]))
          )
        : el('div', {class:'empty'},
-            'No clients at the gate. Boot a client and choose "Gated Deployment" in the PXE menu.');
+            'No clients queued. Boot a client and choose "Queued Deployment" in the PXE menu.');

-      const imaging = gates.filter(g => g.assigned_target).length;
+      const imaging = entries.filter(g => g.assigned_target).length;

      return el('div', {class:'grid'}, [
        el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Forge')),
-          forgeProgressWidget(imaging, gates.length),
+          el('header', {}, el('h2', {}, 'Status')),
+          queueProgressWidget(imaging, entries.length),
        ]),
        el('div', {class:'card'}, [
-          el('header', {}, el('h2', {}, 'Launch an image across the gate')),
+          el('header', {}, el('h2', {}, 'Launch image for queued clients')),
          el('div', {class:'body'}, [
            el('label', {class:'field'}, [
              el('span', {class:'name'}, 'Target image'),
@@ -312,8 +312,8 @@
        ]),
        el('div', {class:'card'}, [
          el('header', {}, [
-            el('h2', {}, 'Gate positions'),
-            el('span', {class:'sub'}, gates.length + ' waiting'),
+            el('h2', {}, 'Queue positions'),
+            el('span', {class:'sub'}, entries.length + ' waiting'),
          ]),
          el('div', {class:'body'}, track),
        ]),
@@ -346,38 +346,180 @@
      });
      file.onchange = () => { if (file.files[0]) upload(file.files[0]); };

-      function upload(f) {
-        upMsg.textContent = 'Uploading ' + f.name + ' (' + fmtBytes(f.size) + ')…';
-        upMsg.className = 'msg';
+      // Chunked upload telemetry. The old browser path posted one huge
+      // multipart body, which left operators staring at 0% when a reverse
+      // proxy buffered or rejected the request before OpenPXE saw it. This
+      // path writes small raw chunks; each acknowledged chunk advances the
+      // bar and leaves a visible .partial file in the ISO directory.
+      async function upload(f) {
+        const started = Date.now();
+        const bar = $('#bar');
+        const setStatus = (text, cls) => { upMsg.textContent = text; upMsg.className = 'msg ' + (cls || ''); };
+        const update = (loaded, total, phase) => {
+          const pct = total > 0 ? Math.min(100, (loaded / total) * 100) : 100;
+          bar.style.width = pct.toFixed(1) + '%';
+          const elapsed = Math.max(0.001, (Date.now() - started) / 1000);
+          const rate = loaded > 0 ? loaded / elapsed : 0;
+          const remain = rate > 0 ? (total - loaded) / rate : 0;
+          setStatus(
+            phase + ' ' + f.name + ' - ' +
+            fmtBytes(loaded) + ' of ' + fmtBytes(total) +
+            ' (' + pct.toFixed(1) + '%, ' + fmtBytes(rate) + '/s' +
+            (remain > 0 ? ', ' + Math.ceil(remain) + 's left' : '') + ')');
+        };
+        const failText = async (r) => {
+          const text = (await r.text()).slice(0, 240);
+          let hint = '';
+          if (r.status === 413)      hint = ' - body too large. A proxy likely rejected this chunk.';
+          else if (r.status === 502) hint = ' - bad gateway. Proxy lost the upstream mid-stream.';
+          else if (r.status === 504) hint = ' - gateway timeout. Try the LAN IP directly.';
+          else if (r.status === 409) hint = ' - name conflict or offset mismatch. Remove the old ISO and retry.';
+          return 'HTTP ' + r.status + ' ' + text + hint;
+        };
+
+        let uploadId = null;
+        setStatus('Preparing upload for ' + f.name + ' (' + fmtBytes(f.size) + ')');
        prog.classList.add('active');
-        const fd = new FormData(); fd.append('file', f);
-        const xhr = new XMLHttpRequest();
-        xhr.upload.onprogress = e => {
-          if (e.lengthComputable) $('#bar').style.width = (e.loaded/e.total*100).toFixed(1) + '%';
-        };
-        xhr.onload = () => {
-          prog.classList.remove('active');
-          $('#bar').style.width = '0';
-          if (xhr.status >= 200 && xhr.status < 300) {
-            upMsg.textContent = 'Uploaded & analyzed.'; upMsg.className = 'msg ok';
-            render('storage');
-          } else {
-            upMsg.textContent = 'Upload failed: ' + xhr.status + ' ' + xhr.responseText;
-            upMsg.className = 'msg err';
+        bar.style.width = '1%';
+
+        try {
+          const begin = await postJSON('/api/uploads', {
+            filename: f.name,
+            size_bytes: f.size,
+          });
+          if (!begin.ok) throw new Error(await failText(begin));
+          const session = await begin.json();
+          uploadId = session.upload_id;
+          const chunkSize = Math.max(1024 * 1024, Number(session.chunk_size || 8 * 1024 * 1024));
+
+          let offset = Number(session.offset || 0);
+          let finished = null;
+          do {
+            const end = Math.min(offset + chunkSize, f.size);
+            const complete = end >= f.size;
+            const r = await fetch('/api/uploads/' + encodeURIComponent(uploadId), {
+              method: 'PUT',
+              headers: {
+                'x-openpxe-upload-offset': String(offset),
+                'x-openpxe-upload-complete': complete ? 'true' : 'false',
+              },
+              body: f.slice(offset, end),
+            });
+            if (!r.ok) throw new Error(await failText(r));
+            const j = await r.json();
+            offset = Number(j.offset || end);
+            update(offset, f.size, complete ? 'Analyzing' : 'Uploading');
+            if (j.complete) finished = j.iso || true;
+          } while (!finished);
+
+          setStatus('Uploaded and analyzed: ' + f.name + ' (' + fmtBytes(f.size) + ')', 'ok');
+          render('storage');
+        } catch (err) {
+          if (uploadId) {
+            try { await fetch('/api/uploads/' + encodeURIComponent(uploadId), {method: 'DELETE'}); }
+            catch {}
          }
-        };
-        xhr.onerror = () => { upMsg.textContent = 'Network error.'; upMsg.className = 'msg err'; };
-        xhr.open('POST', '/api/isos');
-        xhr.send(fd);
+          setStatus('Upload failed: ' + (err && err.message ? err.message : String(err)), 'err');
+        } finally {
+          prog.classList.remove('active');
+          if (!upMsg.className.includes('ok')) bar.style.width = '0';
+        }
      }

      // ── ISO table (mixed local + NFS) ──
-      const rows = isos.map(i => {
+      // Each row gets a "Password" cell that toggles a small inline
+      // editor (a checkbox + a password field + Save button) inside the
+      // *next* row of the table. Keeps the markup flat and avoids the
+      // overhead of a real modal.
+      const rowsAndEditors = [];
+      isos.forEach(i => {
        const b = bootability(i, settings);
        const isNfs = i.source && i.source.kind === 'nfs';
+        const protectedNow = !!i.password_hash;
+
+        // The inline editor row is hidden by default; the Password
+        // button toggles its `display`. Pre-built so toggle is cheap.
+        const pwCheck = el('input', {type:'checkbox'});
+        pwCheck.checked = protectedNow;
+        const pwInput = el('input', {
+          type: 'password', spellcheck: 'false',
+          autocomplete: 'new-password', autocapitalize: 'off',
+          placeholder: protectedNow ? '(unchanged — type to replace)' : 'choose a password',
+        });
+        const pwInputWrap = el('label', {class:'field', style:'flex:1;margin:0'}, [
+          el('span', {class:'name'}, 'Password'),
+          pwInput,
+        ]);
+        // Toggle the password field's visibility off when the checkbox
+        // is unchecked, so the operator's intent is unambiguous on Save.
+        const refreshFieldVisibility = () => {
+          pwInputWrap.style.display = pwCheck.checked ? '' : 'none';
+        };
+        pwCheck.onchange = refreshFieldVisibility;
+        const pwMsg = el('div', {class:'msg', style:'margin-top:6px'});
+        const pwSave = el('button', {style:'flex:none', onclick: async () => {
+          let resp;
+          if (pwCheck.checked) {
+            // Empty input + previously protected = keep the old password
+            // (operator just toggled the box on but didn't type). We
+            // detect this by sending the API only when the field has
+            // content; otherwise no-op + show hint.
+            if (!pwInput.value && !protectedNow) {
+              pwMsg.textContent = 'Enter a password to enable.';
+              pwMsg.className = 'msg err';
+              return;
+            }
+            if (!pwInput.value && protectedNow) {
+              pwMsg.textContent = 'Password unchanged.';
+              pwMsg.className = 'msg ok';
+              return;
+            }
+            resp = await putJSON(
+              '/api/isos/' + encodeURIComponent(i.id) + '/password',
+              { password: pwInput.value });
+          } else {
+            resp = await fetch(
+              '/api/isos/' + encodeURIComponent(i.id) + '/password',
+              {method: 'DELETE'});
+          }
+          if (resp.ok || resp.status === 204) {
+            // Wipe the input field before re-rendering so the
+            // plaintext doesn't sit in DOM longer than necessary.
+            pwInput.value = '';
+            render('storage');
+          } else {
+            const t = await resp.text();
+            pwMsg.textContent = 'Save failed: ' + t;
+            pwMsg.className = 'msg err';
+          }
+        }}, 'Save password');
+
+        const editorCells = el('td', {colspan: '7', style:'background:var(--bg-panel-2);padding:14px 18px'}, [
+          el('div', {style:'display:flex;align-items:flex-end;gap:14px;flex-wrap:wrap'}, [
+            el('label', {class:'check', style:'flex:none;margin:0'}, [
+              pwCheck,
+              el('span', {}, 'Password protect this image'),
+            ]),
+            pwInputWrap,
+            pwSave,
+          ]),
+          el('div', {class:'msg', style:'margin-top:8px;font-size:11.5px'},
+            'Operators booting this ISO will be prompted on the PXE client. ' +
+            'Stored bcrypt-hashed; the plaintext never leaves the request.'),
+          pwMsg,
+        ]);
+        const editorRow = el('tr', {style:'display:none'}, editorCells);
+        refreshFieldVisibility();
+
        const tr = el('tr', b.ok ? {} : {class: 'unbootable'}, [
          el('td', {}, [
-            el('div', {}, i.filename),
+            el('div', {style:'display:flex;align-items:center;gap:8px'}, [
+              protectedNow ? el('span', {
+                title: 'Password protected',
+                style:'color:var(--accent);font-size:13px'
+              }, '🔒') : null,
+              el('span', {}, i.filename),
+            ]),
            !b.ok ? el('div', {class:'row-warn'}, '⚠ ' + b.reason)
                  : (b.warn ? el('div', {class:'row-warn'}, '⚠ ' + b.warn) : null),
          ]),
@@ -386,26 +528,35 @@
          el('td', {},
            el('span', {class:'src-badge' + (isNfs ? ' nfs' : '')},
              isNfs ? ('nfs:' + i.source.mount_id) : 'local')),
+          el('td', {},
+            protectedNow
+              ? el('span', {class:'tag accent'}, 'protected')
+              : el('span', {class:'tag', style:'opacity:.55'}, 'open')),
          el('td', {}, fmtAgo(i.uploaded_at)),
-          el('td', {style:'text-align:right'},
+          el('td', {style:'text-align:right;white-space:nowrap'}, [
+            el('button', {class:'ghost', style:'margin-right:6px', onclick: () => {
+              editorRow.style.display = (editorRow.style.display === 'none') ? '' : 'none';
+            }}, protectedNow ? 'Password ✎' : 'Set password'),
            isNfs
-              ? el('span', {class:'tag', style:'opacity:.6'}, 'manage on NFS share')
+              ? el('span', {class:'tag', style:'opacity:.6'}, 'on NFS')
              : el('button', {class:'danger', onclick: async () => {
                  if (!confirm('Remove this image?')) return;
                  await fetch('/api/isos/' + encodeURIComponent(i.id), {method:'DELETE'});
                  render('storage');
-                }}, 'Remove')),
+                }}, 'Remove'),
+          ]),
        ]);
-        return tr;
+        rowsAndEditors.push(tr, editorRow);
      });
      const isoTable = isos.length
        ? el('table', {}, [
            el('thead', {}, el('tr', {}, [
              el('th',{},'Name'), el('th',{},'Type'),
              el('th',{class:'num'},'Size'),
-              el('th',{},'Source'), el('th',{},'Uploaded'), el('th',{},''),
+              el('th',{},'Source'), el('th',{},'Auth'),
+              el('th',{},'Uploaded'), el('th',{},''),
            ])),
-            el('tbody', {}, rows),
+            el('tbody', {}, rowsAndEditors),
          ])
        : el('div', {class:'empty'}, 'No images yet. Upload an ISO or mount an NFS share.');

@@ -506,9 +657,11 @@
    },

    hosts: async () => {
-      const [{ hosts = [] }, isos] = await Promise.all([
+      const [{ hosts = [] }, isos, bootLogRes] = await Promise.all([
        getJSON('/api/hosts'), getJSON('/api/isos'),
+        getJSON('/api/boot-log').catch(() => ({ events: [] })),
      ]);
+      const bootEvents = bootLogRes.events || [];
      const targets = isos.flatMap(i => i.boot_entries.map(e => ({
        id: e.id, title: e.title + '  — ' + familyLabel(i.introspection.family),
      })));
@@ -516,7 +669,7 @@
      // Reserved menu shortcuts that the operator might want to bind.
      const reserved = [
        {id: '_local',        title: '↳ Boot from Local HDD (built-in)'},
-        {id: '_gate',         title: '↳ Gated Deployment (built-in)'},
+        {id: '_queue',         title: '↳ Queued Deployment (built-in)'},
        {id: '_tools_menu',   title: '↳ Tools menu (built-in)'},
      ];

@@ -583,9 +736,8 @@
            ]),
            upsertBtn, msg,
            el('p', {class:'msg', style:'margin-top:14px'},
-              'When a client with a bound MAC requests boot.ipxe, PXEForge ' +
-              'short-circuits past the interactive menu and chains directly. ' +
-              'Inspired by Tinkerbell smee\'s MAC-prepended URL pattern.'),
+              'When a client with a bound MAC requests boot.ipxe, OpenPXE ' +
+              'short-circuits past the interactive menu and chains directly.'),
          ]),
        ]),
        el('div', {class:'card'}, [
@@ -595,6 +747,37 @@
          ]),
          table,
        ]),
+        el('div', {class:'card'}, [
+          el('header', {}, [
+            el('h2', {}, 'Host log'),
+            el('span', {class:'sub'},
+              bootEvents.length + ' event' + (bootEvents.length === 1 ? '' : 's')),
+          ]),
+          bootEvents.length
+            ? el('table', {}, [
+                el('thead', {}, el('tr', {}, [
+                  el('th', {}, 'Time'),
+                  el('th', {}, 'MAC'),
+                  el('th', {}, 'IP'),
+                  el('th', {}, 'Image'),
+                ])),
+                el('tbody', {},
+                  bootEvents.map(e => el('tr', {}, [
+                    el('td', {}, fmtAgo(e.timestamp)),
+                    el('td', {class:'mono'}, e.mac || el('span', {class:'tag'}, '(unknown)')),
+                    el('td', {class:'mono'}, e.ip ? String(e.ip) : '—'),
+                    el('td', {}, [
+                      el('span', {style:'font-weight:600'}, e.target_title || e.target_id),
+                      el('div', {class:'meta',
+                        style:'color:var(--fg-dim);font-size:11.5px;margin-top:2px'},
+                        e.target_id),
+                    ]),
+                  ]))),
+              ])
+            : el('div', {class:'empty'},
+                'No boot events yet. When a PXE client chains a boot entry, ' +
+                'it lands here with the MAC, IP, and image it received.'),
+        ]),
      ]);
    },

@@ -629,7 +812,7 @@
        const ts = (line.timestamp || new Date().toISOString()).replace(/\.\d+/, '').replace('T', ' ').replace('Z', '');
        const span = el('span', {class: 'lvl-' + lvl}, [
          el('span', {class:'ts'}, ts + '  '),
-          el('span', {class:'tg'}, '[' + (line.target || 'pxeforge') + '] '),
+          el('span', {class:'tg'}, '[' + (line.target || 'openpxe') + '] '),
          line.message,
          '\n',
        ]);
@@ -647,7 +830,7 @@
        const r = await getJSON('/api/log/recent');
        for (const l of (r.lines || [])) append(l);
      } catch (e) {
-        append({timestamp: new Date().toISOString(), level:'warn', target:'pxeforge::ui',
+        append({timestamp: new Date().toISOString(), level:'warn', target:'openpxe::ui',
                message: 'failed to load recent logs: ' + e.message});
      }

@@ -655,12 +838,12 @@
      const es = new EventSource('/api/log/stream');
      es.onmessage = (ev) => {
        try { append(JSON.parse(ev.data)); }
-        catch { append({timestamp: new Date().toISOString(), level:'debug', target:'pxeforge::ui', message: ev.data}); }
+        catch { append({timestamp: new Date().toISOString(), level:'debug', target:'openpxe::ui', message: ev.data}); }
      };
      es.addEventListener('lagged', (ev) => {
        const j = JSON.parse(ev.data || '{}');
        append({timestamp: new Date().toISOString(), level:'warn',
-                target:'pxeforge::ui',
+                target:'openpxe::ui',
                message: 'log stream lagged: ' + (j.skipped || '?') + ' lines skipped'});
      });
      es.onerror = () => {
@@ -668,7 +851,7 @@
        // We only append once, on transition from connected → erroring.
        if (!term._notedErr) {
          term._notedErr = true;
-          append({timestamp: new Date().toISOString(), level:'warn', target:'pxeforge::ui',
+          append({timestamp: new Date().toISOString(), level:'warn', target:'openpxe::ui',
                  message: 'log stream connection lost — auto-reconnecting'});
          setTimeout(() => { term._notedErr = false; }, 5000);
        }
@@ -701,7 +884,7 @@
                    target: 'terminal-output', message: out});
          } catch (err) {
            append({timestamp: new Date().toISOString(), level:'error',
-                    target:'pxeforge::ui', message: 'command failed: ' + err.message});
+                    target:'openpxe::ui', message: 'command failed: ' + err.message});
          }
        } else if (e.key === 'ArrowUp') {
          if (history.length === 0) return;
@@ -716,7 +899,7 @@
      });

      // Welcome banner.
-      append({timestamp: new Date().toISOString(), level:'info', target:'pxeforge::terminal',
+      append({timestamp: new Date().toISOString(), level:'info', target:'openpxe::terminal',
              message: 'Connected. Type "help" for available commands.'});

      // Focus the input on next tick (after view swap completes).
@@ -729,7 +912,7 @@
      const status = await getJSON('/api/status');
      return el('div', {class:'card'}, [
        el('div', {class:'about-hero'}, [
-          el('h2', {}, 'PXEForge'),
+          el('h2', {}, 'OpenPXE'),
          el('p', {class:'lead'},
            'Air-gapped network PXE boot, container-native, that anyone can run. ' +
            'No CDN calls, no telemetry, no surprise external dependencies — ship ' +
@@ -758,7 +941,7 @@
  const viewTitles = {
    dashboard: 'Dashboard',
    network: 'Network',
-    gate: 'Forge Gate',
+    queue: 'Queue',
    storage: 'Storage',
    hosts: 'Hosts',
    terminal: 'Terminal',
@@ -769,7 +952,7 @@
  // script in index.html before paint; we just flip it here and persist.
  function applyTheme(theme) {
    document.documentElement.setAttribute('data-theme', theme);
-    try { localStorage.setItem('pxeforge-theme', theme); } catch {}
+    try { localStorage.setItem('openpxe-theme', theme); } catch {}
  }
  function currentTheme() {
    return document.documentElement.getAttribute('data-theme') === 'light' ? 'light' : 'dark';
@@ -801,12 +984,12 @@
      try { currentBody._cleanup(); } catch (e) { /* ignore */ }
    }
    root.innerHTML = '';
-    // Animated anvil loader. Replaces the old text "Loading…" so the
-    // user gets a sense of "the forge is heating up" instead of a flat
-    // spinner. The SVG itself drives all animation via SMIL, no JS.
+    // Animated rainbow-mark loader replacing the old plain-text
+    // \"Loading…\". The SVG drives all animation via SMIL — no JS, no
+    // CSS keyframes.
    root.appendChild(el('div', {class:'loader'}, [
-      el('div', {class:'anvil'}),
-      el('div', {}, 'Heating the forge…'),
+      el('div', {class:'mark'}),
+      el('div', {}, 'Loading…'),
    ]));
    try {
      const body = await views[view]();
@@ -819,6 +1002,24 @@
    }
  }

+  // Set the sidebar footer "Service status:" line. The chip itself moved
+  // off the topbar in v0.4.x: operators wanted readiness, advertised
+  // URL, and the boot IP grouped together as the bottom-left summary.
+  function setReady(state) {
+    const dot = $('[data-bind=ready_dot]');
+    const lbl = $('[data-bind=ready_label]');
+    if (!dot || !lbl) return;
+    const map = {
+      ready:       { cls: 'ok',  text: 'Ready' },
+      notready:    { cls: 'err', text: 'Not ready' },
+      unreachable: { cls: 'err', text: 'Unreachable' },
+    };
+    const m = map[state] || { cls: 'warn', text: 'Checking…' };
+    dot.className = 'dot ' + m.cls;
+    lbl.className = 'status-value ' + m.cls;
+    lbl.textContent = m.text;
+  }
+
  async function refreshChips() {
    try {
      const s = await getJSON('/api/status');
@@ -826,16 +1027,11 @@
      $$('[data-bind=version]').forEach(n => n.textContent = s.version);
      $$('[data-bind=iso_count],[data-bind=iso_count2]').forEach(n => n.textContent = String(s.iso_count));
      $$('[data-bind=client_count],[data-bind=client_count2]').forEach(n => n.textContent = String(s.client_count));
-      $$('[data-bind=gate_count],[data-bind=gate_count2]').forEach(n => n.textContent = String(s.gate_count));
+      $$('[data-bind=queue_count],[data-bind=queue_count2]').forEach(n => n.textContent = String(s.queue_count));
      $$('[data-bind=host_count]').forEach(n => n.textContent = String(s.host_bindings || 0));
-      const chip = $('[data-bind=ready_chip]');
-      if (chip) {
-        if (r.ok) { chip.textContent = '● ready'; chip.className = 'chip ready'; }
-        else      { chip.textContent = '● not ready'; chip.className = 'chip notready'; }
-      }
+      setReady(r.ok ? 'ready' : 'notready');
    } catch {
-      const chip = $('[data-bind=ready_chip]');
-      if (chip) { chip.textContent = '● unreachable'; chip.className = 'chip notready'; }
+      setReady('unreachable');
    }
  }

@@ -4,7 +4,7 @@
  <meta charset="utf-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1" />
  <meta name="color-scheme" content="dark light" />
-  <title>PXEForge</title>
+  <title>OpenPXE</title>
  <link rel="stylesheet" href="/assets/app.css" />
  <link rel="icon" type="image/svg+xml" href="/assets/logo.svg" />
  <!-- Theme is read from localStorage *before* paint to avoid the
@@ -13,7 +13,7 @@
  <script>
    (function() {
      try {
-        var stored = localStorage.getItem('pxeforge-theme');
+        var stored = localStorage.getItem('openpxe-theme');
        var theme = stored || (matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark');
        document.documentElement.setAttribute('data-theme', theme);
      } catch (e) {
@@ -28,16 +28,16 @@
    <div class="brand">
      <img src="/assets/logo.svg" alt="" />
      <div>
-        <strong>PXEForge</strong>
-        <div class="sub">v<span data-bind="version">0.2.0</span></div>
+        <strong>OpenPXE</strong>
+        <div class="sub">v<span data-bind="version">0.4.1</span></div>
      </div>
    </div>
    <nav>
      <a data-view="dashboard" class="active">Dashboard</a>
      <a data-view="network">Network</a>
-      <a data-view="gate">
-        Forge Gate
-        <span class="count" data-bind="gate_count">0</span>
+      <a data-view="queue">
+        Queue
+        <span class="count" data-bind="queue_count">0</span>
      </a>
      <a data-view="storage">
        Storage
@@ -51,7 +51,12 @@
      <a data-view="about">About</a>
    </nav>
    <div class="footer">
-      Advertised to clients<br/>
+      <div class="status-row">
+        <span class="dot" data-bind="ready_dot" title="Server readiness"></span>
+        <span class="status-label">Service status:</span>
+        <span class="status-value" data-bind="ready_label">checking…</span>
+      </div>
+      <div class="footer-sub">Advertised to clients</div>
      <code>{{BASE_URL}}</code>
    </div>
  </aside>
@@ -59,10 +64,9 @@
  <header class="topbar">
    <h1 data-bind="view_title">Dashboard</h1>
    <div class="spacer"></div>
-    <span class="chip" data-bind="ready_chip" title="Server readiness">checking…</span>
    <span class="chip"><strong data-bind="iso_count2">0</strong>&nbsp;images</span>
    <span class="chip"><strong data-bind="client_count2">0</strong>&nbsp;clients</span>
-    <span class="chip"><strong data-bind="gate_count2">0</strong>&nbsp;at gate</span>
+    <span class="chip"><strong data-bind="queue_count2">0</strong>&nbsp;in queue</span>
    <button id="theme-toggle" class="theme-toggle" type="button"
            aria-label="Toggle light/dark theme" title="Toggle theme (T)">
      <!-- Two glyphs; CSS shows whichever matches the active theme. -->
@@ -1,7 +1,7 @@
 //! Offline-only web UI. Everything the browser needs (HTML, CSS, JS, SVG
 //! logo) is embedded in the compiled binary via `include_str!` /
 //! `include_bytes!`. No CDN, no external fonts, no remote images —
-//! PXEForge renders identically on an air-gapped network.
+//! OpenPXE renders identically on an air-gapped network.
 //!
 //! Layout follows the Netbox Labs pattern: dark left sidebar with primary
 //! nav, top bar with secondary tabs, card-dense content panels.
@@ -15,22 +15,30 @@ pub fn index_html(base_url: &str) -> String {
 }

 #[must_use]
-pub fn app_js() -> &'static str { APP_JS }
+pub fn app_js() -> &'static str {
+    APP_JS
+}

 #[must_use]
-pub fn app_css() -> &'static str { APP_CSS }
+pub fn app_css() -> &'static str {
+    APP_CSS
+}

 #[must_use]
-pub fn logo_svg() -> &'static str { LOGO_SVG }
+pub fn logo_svg() -> &'static str {
+    LOGO_SVG
+}

-/// Animated forging anvil — sparks rise + glow pulse. Used for the
-/// imaging-progress widget and any "I'm working" loading state. Pure
-/// SVG + SMIL, no JS, no GIF.
+/// Larger, faster-cycling rainbow disc — used for the page-load
+/// transition and the imaging-progress widget on Dashboard / Queue.
+/// Pure SVG + SMIL, no JS, no GIF.
 #[must_use]
-pub fn anvil_forge_svg() -> &'static str { ANVIL_FORGE_SVG }
+pub fn loader_svg() -> &'static str {
+    LOADER_SVG
+}

-const INDEX_HTML: &str       = include_str!("index.html");
-const APP_CSS: &str          = include_str!("app.css");
-const APP_JS: &str           = include_str!("app.js");
-const LOGO_SVG: &str         = include_str!("logo.svg");
-const ANVIL_FORGE_SVG: &str  = include_str!("anvil-forge.svg");
+const INDEX_HTML: &str = include_str!("index.html");
+const APP_CSS: &str = include_str!("app.css");
+const APP_JS: &str = include_str!("app.js");
+const LOGO_SVG: &str = include_str!("logo.svg");
+const LOADER_SVG: &str = include_str!("loader.svg");
@@ -0,0 +1,36 @@
+<svg viewBox="0 0 64 64" xmlns="http://www.w3.org/2000/svg">
+  <title>OpenPXE — loading</title>
+  <!-- Larger, bolder version of the brand mark for "I'm working" states:
+       page transitions, the imaging-progress widget on Dashboard / Queue.
+       The gradient slide is faster (3s) and we add a subtle scale pulse
+       so the disc looks alive even when paired with a static progress bar.
+       White inner glow keeps the colours legible against the panel bg. -->
+  <defs>
+    <linearGradient id="opxRainbowLg" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%"     stop-color="#330f1f"/>
+      <stop offset="12.56%" stop-color="#c83228"/>
+      <stop offset="25.06%" stop-color="#fb8841"/>
+      <stop offset="37.56%" stop-color="#d3dd92"/>
+      <stop offset="50.06%" stop-color="#59824f"/>
+      <stop offset="62.06%" stop-color="#002414"/>
+      <stop offset="74.06%" stop-color="#00143d"/>
+      <stop offset="86.06%" stop-color="#2874d7"/>
+      <stop offset="100%"   stop-color="#99c2ff"/>
+      <animate attributeName="x1" values="0;-1;0" dur="3s" repeatCount="indefinite"/>
+      <animate attributeName="x2" values="1;0;1"  dur="3s" repeatCount="indefinite"/>
+    </linearGradient>
+    <radialGradient id="opxGlow" cx="50%" cy="50%" r="50%">
+      <stop offset="0%"   stop-color="rgba(255,255,255,0.6)"/>
+      <stop offset="60%"  stop-color="rgba(255,255,255,0.05)"/>
+      <stop offset="100%" stop-color="rgba(255,255,255,0)"/>
+    </radialGradient>
+  </defs>
+  <g>
+    <circle cx="32" cy="32" r="26" fill="url(#opxRainbowLg)"
+            stroke="rgba(0,0,0,0.2)" stroke-width="1.2">
+      <animate attributeName="r" values="25;27;25" dur="2.4s" repeatCount="indefinite"/>
+    </circle>
+    <!-- Inner highlight to give the disc a hint of dimensionality. -->
+    <circle cx="28" cy="26" r="14" fill="url(#opxGlow)"/>
+  </g>
+</svg>
@@ -1,32 +1,25 @@
-<svg viewBox="0 0 200 130" xmlns="http://www.w3.org/2000/svg" fill="none">
-  <title>PXEForge</title>
+<svg viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <title>OpenPXE</title>
+  <!-- Brand mark to match openpxe.com: a circular medallion filled with
+       the "rainbow-horizon" gradient, sliding 200% across to give a slow
+       hue rotation. Subtle stroke + drop shadow for legibility on either
+       theme. SMIL keeps it self-driving with no JS or CSS dependency. -->
  <defs>
-    <linearGradient id="anvilBody" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#aab3c2"/>
-      <stop offset="55%" stop-color="#7d8696"/>
-      <stop offset="100%" stop-color="#525a6b"/>
-    </linearGradient>
-    <linearGradient id="anvilFace" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#cdd5e1"/>
-      <stop offset="100%" stop-color="#9aa3b3"/>
-    </linearGradient>
-    <linearGradient id="anvilBase" x1="0" y1="0" x2="0" y2="1">
-      <stop offset="0%" stop-color="#3b4252"/>
-      <stop offset="100%" stop-color="#252a36"/>
+    <linearGradient id="opxRainbow" x1="0" y1="0" x2="1" y2="0">
+      <stop offset="0%"     stop-color="#330f1f"/>
+      <stop offset="12.56%" stop-color="#c83228"/>
+      <stop offset="25.06%" stop-color="#fb8841"/>
+      <stop offset="37.56%" stop-color="#d3dd92"/>
+      <stop offset="50.06%" stop-color="#59824f"/>
+      <stop offset="62.06%" stop-color="#002414"/>
+      <stop offset="74.06%" stop-color="#00143d"/>
+      <stop offset="86.06%" stop-color="#2874d7"/>
+      <stop offset="100%"   stop-color="#99c2ff"/>
+      <animate attributeName="x1" values="0;-1;0" dur="12s" repeatCount="indefinite"/>
+      <animate attributeName="x2" values="1;0;1"  dur="12s" repeatCount="indefinite"/>
    </linearGradient>
  </defs>
-  <!-- Horn (left point) + face (top) -->
-  <path d="M14 36 L72 30 L162 30 L162 46 L72 46 Z"
-        fill="url(#anvilFace)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-  <!-- Body / waist -->
-  <path d="M70 46 L160 46 L142 70 L88 70 Z"
-        fill="url(#anvilBody)" stroke="#1d2330" stroke-width="2.4" stroke-linejoin="round"/>
-  <!-- Base plinth -->
-  <path d="M62 96 L168 96 L160 110 L70 110 Z"
-        fill="url(#anvilBase)" stroke="#0d1018" stroke-width="2.4" stroke-linejoin="round"/>
-  <!-- Pillar between body and base -->
-  <rect x="92" y="70" width="46" height="26" fill="url(#anvilBody)"
-        stroke="#1d2330" stroke-width="2.4"/>
-  <!-- Highlight along top face -->
-  <line x1="74" y1="34" x2="158" y2="34" stroke="#e6ecf5" stroke-width="1.2" opacity="0.7"/>
+  <!-- Outer hairline ring softens the edge in light mode; subtle in dark. -->
+  <circle cx="12" cy="12" r="10.5" fill="url(#opxRainbow)"
+          stroke="rgba(0,0,0,0.18)" stroke-width="0.6"/>
 </svg>
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.7
 #
-# PXEForge — multi-stage build.
+# OpenPXE — multi-stage build.
 #
 # Design:
 #   - stage `fetch`: runs scripts/fetch-ipxe.sh to pull official iPXE binaries
@@ -8,13 +8,13 @@
 #   - stage `build`: compiles the workspace with cargo in release mode.
 #   - stage `runtime`: Debian slim image with setcap for NET_BIND_SERVICE,
 #     running as a non-root UID. No shell in PATH for the service user;
-#     attacker surface is just the pxeforge binary + libc.
+#     attacker surface is just the openpxe binary + libc.
 #
 # Why not distroless? We want setcap support and easy debug (`oc rsh`).
 # Debian slim at ~75 MB + binary ~25 MB is fine for a PXE server that
 # spends most of its life idle.

-ARG RUST_VERSION=1.82
+ARG RUST_VERSION=1.95

 ########## fetch iPXE binaries ##########
 FROM debian:12-slim AS fetch
@@ -24,7 +24,7 @@ WORKDIR /src
 COPY scripts/fetch-ipxe.sh scripts/fetch-ipxe.sh
 RUN mkdir -p assets/ipxe && bash scripts/fetch-ipxe.sh

-########## build pxeforge ##########
+########## build openpxe ##########
 FROM rust:${RUST_VERSION}-bookworm AS build
 WORKDIR /src

@@ -33,7 +33,12 @@ WORKDIR /src
 # to silently serve stale stub binaries when cargo's fingerprint didn't
 # notice the source swap. A single build is ~1.5 min longer on cold cache
 # but guarantees the binary reflects the sources we copied.
-COPY Cargo.toml rust-toolchain.toml ./
+# Do not copy rust-toolchain.toml into the image. The local workspace pins
+# developer tooling, but inside Docker we intentionally use the Rust version
+# selected by the base image. Copying rust-toolchain.toml with
+# `channel = "stable"` makes rustup download a second full toolchain during
+# `cargo build`, which is slow and can exhaust small Colima/CI disks.
+COPY Cargo.toml Cargo.lock ./
 COPY crates/ crates/
 COPY --from=fetch /src/assets/ipxe /src/assets/ipxe

@@ -43,9 +48,9 @@ COPY --from=fetch /src/assets/ipxe /src/assets/ipxe
 RUN --mount=type=cache,target=/usr/local/cargo/registry \
    --mount=type=cache,target=/src/target,sharing=locked \
    find crates -name '*.rs' -exec touch {} + && \
-    cargo build --release --bin pxeforge && \
-    cp target/release/pxeforge /pxeforge && \
-    ls -l /pxeforge
+    cargo build --release --bin openpxe && \
+    cp target/release/openpxe /openpxe && \
+    ls -l /openpxe

 ########## runtime ##########
 FROM debian:12-slim AS runtime
@@ -54,13 +59,13 @@ RUN apt-get update \
        ca-certificates libcap2-bin tini gosu iproute2 \
        wimtools samba nfs-common \
 && rm -rf /var/lib/apt/lists/* \
- && useradd --system --uid 10001 --home-dir /var/lib/pxeforge --shell /usr/sbin/nologin pxeforge \
- && mkdir -p /var/lib/pxeforge/isos /var/lib/pxeforge/work /var/lib/pxeforge/smb \
- && chown -R pxeforge:pxeforge /var/lib/pxeforge
+ && useradd --system --uid 10001 --home-dir /var/lib/openpxe --shell /usr/sbin/nologin openpxe \
+ && mkdir -p /var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb \
+ && chown -R openpxe:openpxe /var/lib/openpxe
 # Runtime deps explained:
 #   wimtools  - provides `wimlib-imagex`, used to inject startnet.cmd into boot.wim.
 #   samba     - `smbd` serves extracted Windows install media on :445 for WinPE
-#               to `net use`. Guest read-only, scoped to /var/lib/pxeforge/smb.
+#               to `net use`. Guest read-only, scoped to /var/lib/openpxe/smb.
 #   nfs-common - provides `mount.nfs` / `mount.nfs4` for the Storage tab's
 #               NFS share manager. Mount also requires the container to run
 #               with CAP_SYS_ADMIN — without it, mount(2) returns EPERM and
@@ -74,23 +79,23 @@ RUN apt-get update \
 #               bind-mount ownership (common OpenShift/Docker UX issue).
 # Windows-specific tools only activate when the WebUI toggle is on.

-COPY --from=build /pxeforge /usr/local/bin/pxeforge
+COPY --from=build /openpxe /usr/local/bin/openpxe
 COPY deploy/docker/entrypoint.sh /usr/local/bin/entrypoint.sh
 RUN chmod +x /usr/local/bin/entrypoint.sh

 # Grant the binary the ability to bind <1024 ports as a non-root user.
-# This is the only capability PXEForge needs for proxy-mode DHCP + TFTP + HTTP.
-RUN setcap cap_net_bind_service=+ep /usr/local/bin/pxeforge
+# This is the only capability OpenPXE needs for proxy-mode DHCP + TFTP + HTTP.
+RUN setcap cap_net_bind_service=+ep /usr/local/bin/openpxe

-# IMPORTANT: we do NOT `USER pxeforge` here. The entrypoint runs as root,
-# chowns the mounted data dirs, then execs the binary via gosu as pxeforge.
+# IMPORTANT: we do NOT `USER openpxe` here. The entrypoint runs as root,
+# chowns the mounted data dirs, then execs the binary via gosu as openpxe.
 # OpenShift ignores USER directives anyway (it injects its own uid), and
 # there entrypoint.sh's non-root branch just execs directly.
-WORKDIR /var/lib/pxeforge
+WORKDIR /var/lib/openpxe

-ENV PXEFORGE_ISO_DIR=/var/lib/pxeforge/isos \
-    PXEFORGE_WORK_DIR=/var/lib/pxeforge/work \
-    PXEFORGE_LOG=info,pxeforge=info
+ENV OPENPXE_ISO_DIR=/var/lib/openpxe/isos \
+    OPENPXE_WORK_DIR=/var/lib/openpxe/work \
+    OPENPXE_LOG=info,openpxe=info

 EXPOSE 67/udp 69/udp 4011/udp 80/tcp 445/tcp

@@ -2,9 +2,9 @@
 # Container entrypoint that handles the common bind-mount-as-root case.
 #
 # When volumes are bind-mounted into the container (e.g. `-v ./data/isos:...`),
-# they come up owned by the host uid:gid — often root:root. The pxeforge
+# they come up owned by the host uid:gid — often root:root. The openpxe
 # binary runs as uid 10001 and can't write there. This script, when started
-# as root, chowns the two state dirs to the pxeforge user, then drops
+# as root, chowns the two state dirs to the openpxe user, then drops
 # privileges via gosu before execing the binary.
 #
 # If the container is already running as non-root (OpenShift does this via
@@ -13,20 +13,20 @@
 # or the operator is on their own for permissions.
 set -e

-PXEFORGE_UID=${PXEFORGE_UID:-10001}
-PXEFORGE_GID=${PXEFORGE_GID:-10001}
-DATA_DIRS="/var/lib/pxeforge/isos /var/lib/pxeforge/work /var/lib/pxeforge/smb"
+OPENPXE_UID=${OPENPXE_UID:-10001}
+OPENPXE_GID=${OPENPXE_GID:-10001}
+DATA_DIRS="/var/lib/openpxe/isos /var/lib/openpxe/work /var/lib/openpxe/smb"

 if [ "$(id -u)" = "0" ]; then
    for d in $DATA_DIRS; do
        if [ -d "$d" ]; then
-            chown -R "${PXEFORGE_UID}:${PXEFORGE_GID}" "$d" 2>/dev/null || true
+            chown -R "${OPENPXE_UID}:${OPENPXE_GID}" "$d" 2>/dev/null || true
        fi
    done
-    # Re-exec ourselves under the pxeforge user so the binary inherits a
+    # Re-exec ourselves under the openpxe user so the binary inherits a
    # clean process environment and a predictable umask.
-    exec gosu "${PXEFORGE_UID}:${PXEFORGE_GID}" /usr/local/bin/pxeforge "$@"
+    exec gosu "${OPENPXE_UID}:${OPENPXE_GID}" /usr/local/bin/openpxe "$@"
 fi

 # Non-root: straight exec, no chown attempt.
-exec /usr/local/bin/pxeforge "$@"
+exec /usr/local/bin/openpxe "$@"
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: pxeforge
+  name: openpxe
  labels:
    # Allow privileged pods (host-network) in this namespace only. The pod
    # itself still runs non-root with only NET_BIND_SERVICE — privileged
@@ -1,5 +1,5 @@
 ---
-# Custom SCC for PXEForge.
+# Custom SCC for OpenPXE.
 #
 # The default `restricted-v2` SCC blocks host network and all capabilities,
 # which PXE cannot tolerate: DHCPDISCOVER is an L2 broadcast that CNI overlays
@@ -19,10 +19,10 @@
 apiVersion: security.openshift.io/v1
 kind: SecurityContextConstraints
 metadata:
-  name: pxeforge-scc
+  name: openpxe-scc
  annotations:
    kubernetes.io/description: >-
-      Minimal SCC for PXEForge: host network + NET_BIND_SERVICE only, no raw
+      Minimal SCC for OpenPXE: host network + NET_BIND_SERVICE only, no raw
      sockets, no privileged mode.
 allowPrivilegedContainer: false
 allowPrivilegeEscalation: false
@@ -54,27 +54,27 @@ volumes:
 users: []
 groups: []
 ---
-# Bind the SCC to the pxeforge service account.
+# Bind the SCC to the openpxe service account.
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: pxeforge-scc-use
+  name: openpxe-scc-use
 rules:
  - apiGroups: ["security.openshift.io"]
    resources: ["securitycontextconstraints"]
-    resourceNames: ["pxeforge-scc"]
+    resourceNames: ["openpxe-scc"]
    verbs: ["use"]
 ---
 kind: RoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
-  name: pxeforge-scc-use
-  namespace: pxeforge
+  name: openpxe-scc-use
+  namespace: openpxe
 roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
-  name: pxeforge-scc-use
+  name: openpxe-scc-use
 subjects:
  - kind: ServiceAccount
-    name: pxeforge
-    namespace: pxeforge
+    name: openpxe
+    namespace: openpxe
@@ -2,29 +2,29 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: pxeforge-config
-  namespace: pxeforge
+  name: openpxe-config
+  namespace: openpxe
 data:
  # Toggle DHCP proxy on or off. "proxy" = answer PXE clients alongside an
  # existing DHCP server. "disabled" = require operator to point an external
  # DHCP at us via next-server/filename.
-  PXEFORGE_DHCP_MODE: "proxy"
+  OPENPXE_DHCP_MODE: "proxy"
  # Override if auto-detection picks the wrong NIC in multi-homed pods.
  # Leave unset to auto-detect from the node's primary IPv4.
-  # PXEFORGE_PUBLIC_IP: "10.0.0.5"
-  PXEFORGE_LOG: "info,pxeforge=info"
+  # OPENPXE_PUBLIC_IP: "10.0.0.5"
+  OPENPXE_LOG: "info,openpxe=info"
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pxeforge-isos
-  namespace: pxeforge
+  name: openpxe-isos
+  namespace: openpxe
 spec:
  # ReadWriteOnce is fine — we deploy as a single replica since DHCP proxy
  # coordination across replicas is not useful (clients hit whichever node
@@ -2,10 +2,10 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
  labels:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
 spec:
  # Single replica by design (see PVC comment). If HA is needed later, split
  # the HTTP/web plane (scalable, stateless) from the DHCP-proxy/TFTP plane
@@ -15,13 +15,13 @@ spec:
    type: Recreate
  selector:
    matchLabels:
-      app.kubernetes.io/name: pxeforge
+      app.kubernetes.io/name: openpxe
  template:
    metadata:
      labels:
-        app.kubernetes.io/name: pxeforge
+        app.kubernetes.io/name: openpxe
    spec:
-      serviceAccountName: pxeforge
+      serviceAccountName: openpxe
      # L2 broadcast (DHCPDISCOVER) does not cross most CNI overlays into
      # pod netns. Host network is the working path.
      hostNetwork: true
@@ -33,8 +33,8 @@ spec:
        runAsUser: 10001
        fsGroup: 10001
      containers:
-        - name: pxeforge
-          image: ghcr.io/casperadmin/pxeforge:0.1.0
+        - name: openpxe
+          image: gitea.milesward.dev/mward4/openpxe:0.4.1
          imagePullPolicy: IfNotPresent
          ports:
            - name: dhcp
@@ -59,7 +59,7 @@ spec:
              protocol: TCP
          envFrom:
            - configMapRef:
-                name: pxeforge-config
+                name: openpxe-config
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -70,9 +70,9 @@ spec:
              add: ["NET_BIND_SERVICE"]
          volumeMounts:
            - name: isos
-              mountPath: /var/lib/pxeforge/isos
+              mountPath: /var/lib/openpxe/isos
            - name: work
-              mountPath: /var/lib/pxeforge/work
+              mountPath: /var/lib/openpxe/work
            - name: tmp
              mountPath: /tmp
          readinessProbe:
@@ -97,7 +97,7 @@ spec:
      volumes:
        - name: isos
          persistentVolumeClaim:
-            claimName: pxeforge-isos
+            claimName: openpxe-isos
        - name: work
          emptyDir: {}
        - name: tmp
@@ -5,14 +5,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
  labels:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
 spec:
  type: ClusterIP
  selector:
-    app.kubernetes.io/name: pxeforge
+    app.kubernetes.io/name: openpxe
  ports:
    - name: http
      port: 80
@@ -29,12 +29,12 @@ spec:
 apiVersion: route.openshift.io/v1
 kind: Route
 metadata:
-  name: pxeforge
-  namespace: pxeforge
+  name: openpxe
+  namespace: openpxe
 spec:
  to:
    kind: Service
-    name: pxeforge
+    name: openpxe
    weight: 100
  port:
    targetPort: http
@@ -1,12 +1,12 @@
-# PXEForge on Unraid
+# OpenPXE on Unraid

 Three paths from "I have an Unraid box with Gitea on it" to "PXE clients
-boot from PXEForge". Pick the one that matches what you have.
+boot from OpenPXE". Pick the one that matches what you have.

 ## Path A — build on Unraid, push to Gitea registry, pull by tag

 Recommended once you've done it once. Image is published to
-`gitea.milesward.dev/mward4/pxeforge:0.1.0` (or your equivalent) and
+`gitea.milesward.dev/mward4/openpxe:0.4.1` (or your equivalent) and
 every Unraid template / docker-compose just references the tag.

 Pre-flight:
@@ -24,12 +24,12 @@ Run on the Unraid host (Settings → Terminal, or `ssh root@unraid`):
 GITEA_TOKEN=<your-token>
 curl -fsSL \
  -H "Authorization: token $GITEA_TOKEN" \
-  http://localhost:3000/mward4/PXEForge/raw/branch/main/scripts/build-and-publish-unraid.sh \
-  -o /tmp/pxeforge-publish.sh
+  http://localhost:3000/mward4/OpenPXE/raw/branch/main/scripts/build-and-publish-unraid.sh \
+  -o /tmp/openpxe-publish.sh

 # Run it. ~6 min on Unraid hardware (native amd64, no QEMU).
-chmod +x /tmp/pxeforge-publish.sh
-GITEA_TOKEN=$GITEA_TOKEN /tmp/pxeforge-publish.sh
+chmod +x /tmp/openpxe-publish.sh
+GITEA_TOKEN=$GITEA_TOKEN /tmp/openpxe-publish.sh
 ```

 What it does:
@@ -40,24 +40,24 @@ What it does:
 3. `docker build` against `deploy/docker/Dockerfile`.
 4. `docker login gitea.milesward.dev:3000` using a temp `DOCKER_CONFIG`
   so the credential never lands in your real `~/.docker/config.json`.
-5. `docker push` both `:0.1.0` and `:latest`.
+5. `docker push` both `:0.4.1` and `:latest`.
 6. Logout, scrub the temp config, delete the workspace.

 After it finishes, in Unraid → Docker → Add Container, set:

 | Field      | Value                                           |
 |------------|-------------------------------------------------|
-| Repository | `gitea.milesward.dev/mward4/pxeforge:0.1.0`     |
+| Repository | `gitea.milesward.dev/mward4/openpxe:0.4.1`     |
 | Network    | `host`                                          |
 | Extra args | `--cap-add=NET_BIND_SERVICE`                    |

 Volume mounts (paths inside container in **bold**):

- **`/var/lib/pxeforge/isos`** ↔ `/mnt/user/appdata/pxeforge/isos`
- **`/var/lib/pxeforge/work`** ↔ `/mnt/user/appdata/pxeforge/work`
- **`/var/lib/pxeforge/smb`**  ↔ `/mnt/user/appdata/pxeforge/smb`
+- **`/var/lib/openpxe/isos`** ↔ `/mnt/user/appdata/openpxe/isos`
+- **`/var/lib/openpxe/work`** ↔ `/mnt/user/appdata/openpxe/work`
+- **`/var/lib/openpxe/smb`**  ↔ `/mnt/user/appdata/openpxe/smb`

-Or skip the manual UI by dropping `pxeforge.xml` (in this directory)
+Or skip the manual UI by dropping `openpxe.xml` (in this directory)
 into `/boot/config/plugins/dockerMan/templates-user/` and Unraid will
 list it as a one-click template.

@@ -70,15 +70,15 @@ Skip the registry entirely. Useful for "hack on it locally" iterations.
 ```bash
 ssh root@unraid
 cd /mnt/user/appdata
-git clone http://localhost:3000/mward4/PXEForge.git pxeforge-src
-cd pxeforge-src
+git clone http://localhost:3000/mward4/OpenPXE.git openpxe-src
+cd openpxe-src
 bash scripts/fetch-ipxe.sh
-docker compose -f docker-compose.yml up -d --build pxeforge
+docker compose -f docker-compose.yml up -d --build openpxe
 ```

 The bundled `docker-compose.yml` already wires host networking, the
 right cap_add, and bind-mounts to `./data/`. Edit those bind-mount
-paths if you want them under `/mnt/user/appdata/pxeforge/`.
+paths if you want them under `/mnt/user/appdata/openpxe/`.

 ## Path C — `docker load` from a tarball I built off-box

@@ -88,14 +88,14 @@ then:

 ```bash
 # On the build host
-docker save pxeforge:0.1.0 | gzip > pxeforge-0.1.0.tar.gz
+docker save openpxe:0.4.1 | gzip > openpxe-0.4.1.tar.gz

 # Transfer (rsync / scp / SMB / ZFS-replicate / sneakernet)
-scp pxeforge-0.1.0.tar.gz root@unraid:/tmp/
+scp openpxe-0.4.1.tar.gz root@unraid:/tmp/

 # On Unraid
-gunzip -c /tmp/pxeforge-0.1.0.tar.gz | docker load
-docker tag pxeforge:0.1.0 gitea.milesward.dev/mward4/pxeforge:0.1.0
+gunzip -c /tmp/openpxe-0.4.1.tar.gz | docker load
+docker tag openpxe:0.4.1 gitea.milesward.dev/mward4/openpxe:0.4.1
 ```

 If you want it pullable by tag from other Unraid templates, push to
@@ -119,16 +119,16 @@ show up in the Dashboard's "Recent connections" table within seconds.
 ## Common gotchas

 - **DHCP collision.** Don't run two PXE _proxies_ on the same broadcast
-  domain. PXEForge runs in proxy mode and never offers IP leases, so
+  domain. OpenPXE runs in proxy mode and never offers IP leases, so
  it coexists with whatever DHCP server is already on the network —
  but two proxies racing each other will whichever-wins at random.
 - **Host networking only.** Bridge mode containers don't see broadcast
  DHCP. There's no working bridge-mode config for a PXE server.
- **Permissions on `/mnt/user/appdata/pxeforge`.** The container runs
+- **Permissions on `/mnt/user/appdata/openpxe`.** The container runs
  as uid 10001 by default. The entrypoint chowns the bind mounts to
  10001 on first start, but only if the container itself has root —
  `--user=root` isn't needed; the multi-stage Dockerfile starts as
-  root, fixes perms, then drops to pxeforge via gosu.
+  root, fixes perms, then drops to openpxe via gosu.
 - **NFS mounts in the Storage tab.** Mounting NFS inside the container
  needs `CAP_SYS_ADMIN`. To enable, add `--cap-add=SYS_ADMIN` to the
  Unraid template's "Extra args" — but understand that's a meaningful
@@ -1,12 +1,12 @@
 <?xml version="1.0"?>
 <!--
-  Unraid Docker template for PXEForge.
+  Unraid Docker template for OpenPXE.

  Drop this file into /boot/config/plugins/dockerMan/templates-user/
  on your Unraid box (or import via the Docker tab → "Add Container" →
  "Template Repositories" if you publish it on a Gitea raw URL).

-  IMPORTANT: PXEForge needs host networking for DHCP/TFTP raw broadcasts.
+  IMPORTANT: OpenPXE needs host networking for DHCP/TFTP raw broadcasts.
  Bridge mode will NOT work — clients can't see broadcast DHCP from a
  bridged container. The template forces NetworkType=host below.

@@ -21,21 +21,21 @@
  Web UI: http://<unraid-ip>/  (port 80)
 -->
 <Container version="2">
-  <Name>PXEForge</Name>
-  <Repository>gitea.milesward.dev/mward4/pxeforge:latest</Repository>
-  <Registry>https://gitea.milesward.dev/mward4/-/packages/container/pxeforge</Registry>
+  <Name>OpenPXE</Name>
+  <Repository>gitea.milesward.dev/mward4/openpxe:latest</Repository>
+  <Registry>https://gitea.milesward.dev/mward4/-/packages/container/openpxe</Registry>
  <Network>host</Network>
  <MyIP/>
  <Shell>sh</Shell>
  <Privileged>false</Privileged>
-  <Support>https://gitea.milesward.dev/mward4/PXEForge/issues</Support>
-  <Project>https://gitea.milesward.dev/mward4/PXEForge</Project>
+  <Support>https://gitea.milesward.dev/mward4/OpenPXE/issues</Support>
+  <Project>https://gitea.milesward.dev/mward4/OpenPXE</Project>
  <Overview>
    Air-gapped network PXE boot server. Container-native Rust
    implementation — DHCP proxy + TFTP + iPXE chainload + HTTP ISO
    streaming, all in one process. Web UI for ISO upload, NFS share
-    mounting, and Gated Deployment ("horse-race" simultaneous launch
-    of one ISO across many waiting clients).
+    mounting, and Queued Deployment for coordinated launch of one ISO
+    across many waiting clients.

    NEVER touches the client OS trust store: no test-signed drivers,
    no testsigning toggle, no httpdisk.sys. Windows boot uses vanilla
@@ -44,7 +44,7 @@
  <Category>Network:Other Network:Management</Category>
  <WebUI>http://[IP]/</WebUI>
  <TemplateURL/>
-  <Icon>https://gitea.milesward.dev/mward4/PXEForge/raw/branch/main/crates/webui/src/logo.svg</Icon>
+  <Icon>https://gitea.milesward.dev/mward4/OpenPXE/raw/branch/main/crates/webui/src/logo.svg</Icon>
  <ExtraParams>--cap-add=NET_BIND_SERVICE</ExtraParams>
  <PostArgs/>
  <CPUset/>
@@ -53,23 +53,23 @@
  <DonateLink/>
  <Requires>
    Host networking. Unraid&#39;s built-in DHCP server (if any) must
-    not collide with a network that already has DHCP — PXEForge runs
+    not collide with a network that already has DHCP — OpenPXE runs
    in proxy mode and coexists, but only one DHCP _proxy_ should reply
    per broadcast domain.
  </Requires>
-  <Config Name="ISOs" Target="/var/lib/pxeforge/isos" Default="/mnt/user/appdata/pxeforge/isos"
+  <Config Name="ISOs" Target="/var/lib/openpxe/isos" Default="/mnt/user/appdata/openpxe/isos"
          Mode="rw" Description="Where uploaded and seeded .iso files live."
-          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/pxeforge/isos</Config>
-  <Config Name="Work dir" Target="/var/lib/pxeforge/work" Default="/mnt/user/appdata/pxeforge/work"
+          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/openpxe/isos</Config>
+  <Config Name="Work dir" Target="/var/lib/openpxe/work" Default="/mnt/user/appdata/openpxe/work"
          Mode="rw" Description="Settings, NFS state, and runtime scratch. Persisted across restarts."
-          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/pxeforge/work</Config>
-  <Config Name="SMB share root" Target="/var/lib/pxeforge/smb" Default="/mnt/user/appdata/pxeforge/smb"
+          Type="Path" Display="always" Required="true" Mask="false">/mnt/user/appdata/openpxe/work</Config>
+  <Config Name="SMB share root" Target="/var/lib/openpxe/smb" Default="/mnt/user/appdata/openpxe/smb"
          Mode="rw" Description="Where extracted Windows install media lives. Only used when Windows toggle is on."
-          Type="Path" Display="advanced" Required="false" Mask="false">/mnt/user/appdata/pxeforge/smb</Config>
-  <Config Name="Public IP" Target="PXEFORGE_PUBLIC_IP" Default=""
+          Type="Path" Display="advanced" Required="false" Mask="false">/mnt/user/appdata/openpxe/smb</Config>
+  <Config Name="Public IP" Target="OPENPXE_PUBLIC_IP" Default=""
          Mode="" Description="IP advertised to PXE clients. Leave blank to auto-detect; set explicitly on multi-homed Unraid hosts."
          Type="Variable" Display="always" Required="false" Mask="false"></Config>
-  <Config Name="Log filter" Target="PXEFORGE_LOG" Default="info,pxeforge=debug"
+  <Config Name="Log filter" Target="OPENPXE_LOG" Default="info,openpxe=debug"
          Mode="" Description="tracing-subscriber EnvFilter expression."
-          Type="Variable" Display="advanced" Required="false" Mask="false">info,pxeforge=debug</Config>
+          Type="Variable" Display="advanced" Required="false" Mask="false">info,openpxe=debug</Config>
 </Container>
@@ -5,13 +5,13 @@
 #   1. Local MVP test — host network, proxy-DHCP off (don't fight your
 #      existing DHCP server on the LAN), TFTP + HTTP exposed on the host:
 #
-#         docker compose up pxeforge-dev
+#         docker compose up openpxe-dev
 #
 #   2. Real PXE deployment — host network, proxy-DHCP on, runs on a box
 #      plugged into the PXE network:
 #
-#         # First set PXEFORGE_PUBLIC_IP to this host's LAN address in .env
-#         docker compose up pxeforge
+#         # First set OPENPXE_PUBLIC_IP to this host's LAN address in .env
+#         docker compose up openpxe
 #
 # On Linux hosts, `network_mode: host` gives the container direct access to
 # the physical NIC — required for DHCP proxy because CNI overlays and Docker
@@ -19,13 +19,13 @@
 #
 # On macOS / Windows hosts, `network_mode: host` is limited — the daemon
 # runs in a Linux VM (Colima/Docker Desktop) so the "host" network is the
-# VM, not your Mac. Proxy-DHCP is not feasible on macOS; use `pxeforge-dev`
+# VM, not your Mac. Proxy-DHCP is not feasible on macOS; use `openpxe-dev`
 # with published ports and set DHCP-MODE=disabled.

 services:
  # Real PXE deployment (Linux hosts).
-  pxeforge:
-    image: pxeforge:0.1.0
+  openpxe:
+    image: openpxe:0.1.0
    build:
      context: .
      dockerfile: deploy/docker/Dockerfile
@@ -34,33 +34,33 @@ services:
    environment:
      # REQUIRED on multi-homed hosts. Set to this machine's LAN IP so the
      # advertised iPXE URLs actually resolve from the PXE clients. Without
-      # this, PXEForge will refuse to start rather than advertise a
+      # this, OpenPXE will refuse to start rather than advertise a
      # loopback address that can't be reached.
-      PXEFORGE_PUBLIC_IP: ${PXEFORGE_PUBLIC_IP:?set this to the host LAN IP}
-      PXEFORGE_DHCP_MODE: proxy
-      PXEFORGE_LOG: info
+      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:?set this to the host LAN IP}
+      OPENPXE_DHCP_MODE: proxy
+      OPENPXE_LOG: info
    volumes:
-      - ./data/isos:/var/lib/pxeforge/isos
-      - ./data/work:/var/lib/pxeforge/work
+      - ./data/isos:/var/lib/openpxe/isos
+      - ./data/work:/var/lib/openpxe/work

  # Dev / MVP container: published ports, DHCP disabled, HTTP on 8080.
  # Use this on laptops where you want to curl the API or UI without
  # running an actual PXE chain.
-  pxeforge-dev:
-    image: pxeforge:0.1.0
+  openpxe-dev:
+    image: openpxe:0.1.0
    build:
      context: .
      dockerfile: deploy/docker/Dockerfile
    environment:
-      PXEFORGE_PUBLIC_IP: ${PXEFORGE_PUBLIC_IP:-127.0.0.1}
-      PXEFORGE_DHCP_MODE: disabled
-      PXEFORGE_HTTP_PORT: "8080"
-      PXEFORGE_TFTP_PORT: "6969"
-      PXEFORGE_DHCP_PORT: "6767"
-      PXEFORGE_LOG: info,pxeforge=debug
+      OPENPXE_PUBLIC_IP: ${OPENPXE_PUBLIC_IP:-127.0.0.1}
+      OPENPXE_DHCP_MODE: disabled
+      OPENPXE_HTTP_PORT: "8080"
+      OPENPXE_TFTP_PORT: "6969"
+      OPENPXE_DHCP_PORT: "6767"
+      OPENPXE_LOG: info,openpxe=debug
    ports:
      - "8080:8080/tcp"
      - "6969:6969/udp"
    volumes:
-      - ./data/isos:/var/lib/pxeforge/isos
-      - ./data/work:/var/lib/pxeforge/work
+      - ./data/isos:/var/lib/openpxe/isos
+      - ./data/work:/var/lib/openpxe/work
@@ -0,0 +1,156 @@
+# Phase 6 — recommendations
+
+The v0.4.1 cut leaves OpenPXE in a state where the entire protocol stack
+and operator UI are exercised by the automated test suite, the container is
+multi-arch buildable, and the image ships at ~97 MB. What's left before
+this looks and feels like a 1.0 product is mostly **real-hardware
+validation** plus a small batch of features that can only sensibly be
+designed once we've watched real machines image.
+
+This doc is a punch list, ordered by what I'd do first if I had a week.
+
+## Tier 1 — must-do before we call anything "stable"
+
+### 1. Real-hardware validation matrix
+
+We have CI tests for every protocol leg, but no end-to-end PXE on real
+firmware. Build a small matrix:
+
+| client                              | firmware  | OS family  | pass criteria             |
+|-------------------------------------|-----------|------------|---------------------------|
+| any 10-y-old mini-PC                | Legacy BIOS | Ubuntu Server 24.04 | gets to GRUB / installer   |
+| Intel NUC / similar                 | UEFI x64  | Windows 11 | reaches "where do you want to install" |
+| Raspberry Pi 4                      | UEFI ARM64 | Raspberry Pi OS    | gets to login prompt       |
+| Dell / HP business laptop          | UEFI x64  | Fedora     | one of: kernel boot or wimboot |
+
+Add a `docs/HARDWARE_VALIDATION.md` checklist that records what worked,
+firmware versions, and any quirks. Anything weird gets a regression
+test in the relevant crate.
+
+### 2. Boot menu hotkey + UI accessibility audit
+
+The iPXE menu has number-key + letter hotkeys but no documentation on
+what they map to. Generate a printable cheat-sheet from
+`crates/http-api/src/ipxe_script.rs` so operators don't have to read
+the source. Run a screen-reader pass over the web UI — most of it
+should be fine since we're mostly tables + form labels, but the
+Terminal pane and the SSE log output need explicit `aria-live`
+regions.
+
+### 3. Boot.wim re-patch detection
+
+Bootimus v0.1.62's "fingerprint of patched inputs + Save & Re-patch"
+pattern is a small but high-value feature: when an operator changes
+the SMB host override or upgrades wimboot, the existing patched
+boot.wim is silently stale. We should:
+
+- Hash the inputs (smb_host, smb_share, startnet.cmd content,
+  wimboot binary digest) into the IsoMeta;
+- Surface a "needs re-patch" warning on the Storage tab when the
+  hash drifts;
+- Add a "Re-patch SMB" button that re-runs the WimPatcher.
+
+## Tier 2 — features that round out pre-beta
+
+### 4. Auto-install file library
+
+iVentoy and Bootimus both support attaching `autounattend.xml` /
+`preseed.cfg` / `kickstart.cfg` to an image. The mechanics are
+straightforward: store files under `<work_dir>/autoinstall/<distro>/`,
+expose CRUD via `/api/autoinstall-files`, and modify the WimPatcher
+ Linux kernel cmdline to fetch + apply the right file. Placeholders
+worth supporting (Bootimus pattern): `{{MAC}}`, `{{HOSTNAME}}`,
+`{{IP}}`, `{{SERVER_ADDR}}`, `{{IMAGE_FILENAME}}`, substituted
+serve-side per request.
+
+### 5. Wake-on-LAN trigger
+
+A natural pair with per-MAC host bindings: bind a MAC to an image,
+then click "Wake & Image" to send the magic packet and let OpenPXE
+do the rest. Implementation is small (`udp/9` broadcast, magic packet
+construction) but it makes the bound-host workflow feel instant.
+
+### 6. Distro profile manifest
+
+Today, distro detection lives as Rust match arms in `introspect.rs`
+and the kernel cmdline templates live in `store.rs`. Bootimus extracts
+this into a JSON manifest that ships embedded in the binary AND is
+overridable by the operator at runtime — so a new distro can be added
+without rebuilding the container. Worth porting; it'd let community
+contributions land as PRs to a single JSON file.
+
+### 7. Syslog receiver
+
+`smee` ships one. The use case: WinPE / Linux installers can be
+configured to syslog over the network to the PXE server; if we have
+an endpoint and a place in the UI to view per-client diagnostics,
+post-mortem on a failed install gets dramatically easier.
+
+### 8. UEFI HTTP Boot validation
+
+Option 60 = `HTTPClient` is wired up in `decide()` already, but
+we've never tested it on real firmware. Some Dell + Lenovo UEFIs
+prefer it over PXE-via-TFTP. A quick check on a real machine
+(disable TFTP boot in firmware, force HTTP boot) and a regression
+test would be nice.
+
+## Tier 3 — bigger lifts, only if there's demand
+
+### 9. Pure-Rust SMB server
+
+`smbd` from Samba is ~80 MB of the runtime image. There are pure-Rust
+SMB2 server crates (`smbd-server`, `smb-rs`) of varying maturity.
+Replacing the dep would slim the image by ~40% and remove the
+`CAP_SYS_ADMIN` requirement for SMB. Worth a spike, not necessarily
+landable in Phase 6.
+
+### 10. IPv6 / DHCPv6
+
+PXE-over-IPv6 is real (RFC 5970). Some sites are v6-only. Worth
+implementing once we know we have one. Until then, IPv4-only is the
+right default — flipping the bit on v6 without v6 testing is asking
+for silent breakage.
+
+### 11. Multi-replica deployment
+
+The current design assumes one OpenPXE per broadcast domain. Two
+proxies on the same L2 will race; the deployment queue is in-memory, etc.
+For HA we'd need to:
+- Externalize the deployment queue (Redis, etcd) or lean into "the menu is
+  cheap to refetch if a replica dies";
+- Ensure DHCP proxy replies are deterministic so a client always
+  gets the same answer regardless of which replica replied;
+- Document the L2 collision domain story.
+
+This is a large lift and should only happen if someone's actually
+asking for it.
+
+### 12. Pi 4 / SBC quirks
+
+Raspberry Pi netboot uses a specific DHCP option-43 vendor field +
+TFTP path layout that OpenPXE doesn't currently special-case. There's
+a spec; the work is small once we have a Pi to test on.
+
+## What I'd skip
+
+- **A custom DHCP server (not proxy).** The proxy mode is the right
+  abstraction; full DHCP would need raw sockets + a lot of corner-case
+  handling for problems no operator wants us to solve.
+- **A pluggable backend abstraction à la Tinkerbell.** Tinkerbell does
+  it because they integrate with k8s CRDs. OpenPXE's "the file system
+  IS the database" model is simpler and good enough for the target
+  audience. Don't add a Backend trait until something asks for it.
+- **Multiple language UIs.** Bootimus added these in v0.1.62 and the
+  translations are LLM-generated. Skip until we have real users
+  asking for non-English.
+
+## Quick wins (could land in a single afternoon)
+
+- Add a Grafana dashboard JSON to `deploy/grafana/` driven off the
+  new `/metrics` endpoint.
+- A `openpxe bench` subcommand that runs a 10-second internal load
+  test (synthetic queue joins) so an operator can sanity-check tuning.
+- Ship a basic `docker-compose.yml` for the Unraid path that demos
+  the new themes / progress widget.
+- Generate a printable single-page operator runbook from the README
+  + architecture.md (e.g. `cargo xtask runbook`).
@@ -1,4 +1,4 @@
-# PXEForge architecture
+# OpenPXE architecture

 ## Protocol stack

@@ -8,7 +8,7 @@ Client firmware PXE ROM
        │ DHCPDISCOVER (UDP/67 broadcast, option 60 "PXEClient", option 93 arch)
        ▼
 ┌─────────────────────────────────────────────────────────────────────────┐
-│  PXEForge                                                               │
+│  OpenPXE                                                               │
 │                                                                         │
 │    ┌──────────────┐     ┌──────────────┐      ┌──────────────────────┐  │
 │    │ DHCP proxy   │     │ TFTP server  │      │  HTTP server (axum)  │  │
@@ -33,7 +33,7 @@ Client runs iPXE
        │
        │ DHCPDISCOVER with option 77 "iPXE"
        ▼
-PXEForge sees user-class "iPXE" → replies with HTTP URL: /boot.ipxe
+OpenPXE sees user-class "iPXE" → replies with HTTP URL: /boot.ipxe
        │
        │ HTTP GET /boot.ipxe  (iPXE menu, auto-generated from IsoStore)
        ▼
@@ -48,14 +48,14 @@ Kernel boots with distro-specific args pointing back at /iso/<id>.iso

 | Crate               | Responsibility                                                    |
 |---------------------|-------------------------------------------------------------------|
-| `pxeforge-core`     | Shared types: `Config`, `ClientArch`, `FirmwareClass`, `ClientRegistry` |
-| `pxeforge-ipxe-assets` | Embeds bundled iPXE binaries via `rust-embed`                 |
-| `pxeforge-iso-store`   | On-disk ISO store, introspection, boot-entry generation        |
-| `pxeforge-dhcp-proxy`  | UDP listener + `dhcproto` reply builder; pure `decide()` unit-testable |
-| `pxeforge-tftp`        | RFC 1350 + OACK (blksize / tsize / windowsize). Serves only embedded assets — no filesystem |
-| `pxeforge-http-api`    | `axum` router: web UI, API, iPXE script generation, ISO streaming |
-| `pxeforge-webui`       | Single `index.html` served as static string                    |
-| `pxeforge` (bin)       | Wires everything together, runs the three servers concurrently |
+| `openpxe-core`     | Shared types: `Config`, `ClientArch`, `FirmwareClass`, `ClientRegistry` |
+| `openpxe-ipxe-assets` | Embeds bundled iPXE binaries via `rust-embed`                 |
+| `openpxe-iso-store`   | On-disk ISO store, introspection, boot-entry generation        |
+| `openpxe-dhcp-proxy`  | UDP listener + `dhcproto` reply builder; pure `decide()` unit-testable |
+| `openpxe-tftp`        | RFC 1350 + OACK (blksize / tsize / windowsize). Serves only embedded assets — no filesystem |
+| `openpxe-http-api`    | `axum` router: web UI, API, iPXE script generation, ISO streaming |
+| `openpxe-webui`       | Single `index.html` served as static string                    |
+| `openpxe` (bin)       | Wires everything together, runs the three servers concurrently |

 ## Key decisions and why

@@ -75,11 +75,11 @@ so plain `SOCK_DGRAM` is enough.

 1. Firmware PXE ROM sends DHCPDISCOVER with option 60 = `PXEClient`,
   option 93 = arch.
-2. PXEForge replies with TFTP server + arch-specific iPXE binary
+2. OpenPXE replies with TFTP server + arch-specific iPXE binary
   (`undionly.kpxe` for Legacy BIOS, `snponly.efi` for x86_64 UEFI, etc.).
 3. Client TFTPs the iPXE binary and runs it.
 4. iPXE does its own DHCP, setting option 77 (user-class) to `iPXE`.
-5. PXEForge detects the user-class and this time replies with an HTTP URL
+5. OpenPXE detects the user-class and this time replies with an HTTP URL
   in option 67 pointing at `/boot.ipxe`.
 6. iPXE fetches and executes that script, which chains the selected OS.

@@ -105,7 +105,7 @@ Whatever we do for Windows, we never:
 - instruct users to enable `bcdedit /set testsigning on`
 - install any certificate into the target's root/trust store

-iVentoy's `httpdisk.sys` approach broke this rule. PXEForge doesn't.
+iVentoy's `httpdisk.sys` approach broke this rule. OpenPXE doesn't.

 ### Linux ISO boot uses kernel+initrd extraction, not sanboot

@@ -157,13 +157,13 @@ release:
  root-owned" problem that breaks ISO upload on standard Docker hosts.
 - `/healthz` and `/readyz` split from `/api/status` — readyz fails if no
  iPXE binaries are bundled, giving K8s probes a real signal.
- Startup aborts with a clear error if `PXEFORGE_PUBLIC_IP` can't be
+- Startup aborts with a clear error if `OPENPXE_PUBLIC_IP` can't be
  auto-detected (no more silent `127.0.0.1` advertisement).
 - `scripts/fetch-ipxe.sh` fails non-zero if zero binaries download; the
  Dockerfile uses arch-scoped paths (`x86_64-efi/snponly.efi` etc.).

 **Windows boot plumbing** (new):
- `pxeforge-iso-store::smb::SmbManager` supervises `smbd` on the Windows
+- `openpxe-iso-store::smb::SmbManager` supervises `smbd` on the Windows
  toggle: `start` → spawn + write `smb.conf`; `reconcile` → SIGHUP on
  share changes; `stop` → SIGTERM. `SmbState` surfaced to the UI for
  visibility.
@@ -177,32 +177,32 @@ release:
 - ISO sizes in menu labels (`[ 4376 MB]`), iVentoy format.
 - `Reboot Computer` + `Exit and continue BIOS boot` in Tools menu.
 - Number-key hotkeys (1..9) on boot entries, letter hotkeys on tools.
- Clients tab cross-joins the gate queue so an operator sees "at gate #2"
+- Clients tab cross-joins the deployment queue so an operator sees "in queue #2"
  or "assigned: ubuntu-linux" status inline.

 **Developer ergonomics** (new):
- `pxeforge seed --from <path>` CLI to import ISOs from a directory.
+- `openpxe seed --from <path>` CLI to import ISOs from a directory.
  Same pipeline as web upload (slug, sha256, introspection, boot-entry).
- `docker-compose.yml` with `pxeforge` (host network, real PXE) and
-  `pxeforge-dev` (published ports, DHCP disabled, for API testing).
+- `docker-compose.yml` with `openpxe` (host network, real PXE) and
+  `openpxe-dev` (published ports, DHCP disabled, for API testing).

 **API cleanliness**:
 - All timestamps now serialized as RFC 3339 strings (the `time` crate's
  default 9-tuple broke browser `Date` parsing).
- Gate poll retains assignment until the operator releases it; if the
+- Queue poll retains assignment until the operator releases it; if the
  client's chain fails, it reuses the assignment instead of falling back
  to the menu.

 ## Phase 4 — UI restructure + remote storage

-The web UI was rebuilt around six tabs (Dashboard / Network / Forge Gate /
+The web UI was rebuilt around six tabs (Dashboard / Network / Queue /
 Storage / Terminal / About) inspired by the iVentoy layout the user
 attached and Netbox Labs's compact-card pattern. The old hierarchical
 "Monitoring / Content / Configuration" sidebar grouping is gone — every
 tab is one click from the brand bar.

 **NFS share manager** (`crates/iso-store/src/nfs.rs`):
- Operators add a remote share via Storage → NFS shares; PXEForge mounts
+- Operators add a remote share via Storage → NFS shares; OpenPXE mounts
  it under `<work_dir>/nfs/<id>/` and walks it for `*.iso` files.
 - Each ISO found is registered with `IsoStore::register_external` using
  a new `IsoSource::Nfs { mount_id, relative_path }` variant. The store
@@ -227,7 +227,7 @@ tab is one click from the brand bar.
  followed by live updates. Slow clients see a `lagged` event rather
  than dropping the stream.
 - `/api/terminal` accepts a single command line and dispatches to a
-  whitelist (`status`, `isos`, `clients`, `gate {list,assign,release}`,
+  whitelist (`status`, `isos`, `clients`, `queue {list,assign,release}`,
  `nfs {list,mount,unmount,scan}`, `smb {status,start,stop,reload}`,
  `log {clear,tail}`). Output is mirrored onto the LogBus so reading the
  live tail tells the same story as scrolling the terminal pane.
@@ -240,7 +240,7 @@ tab is one click from the brand bar.
  read-only by design — silently changing the public IP on a hot UI
  would break PXE for every client mid-boot.
 - The only writable network field is `dns_server`, an optional
-  informational hint stored in `Settings`. PXEForge does not run a DNS
+  informational hint stored in `Settings`. OpenPXE does not run a DNS
  server; the field exists so operators don't have to dig out the
  upstream DNS at 3 AM.

@@ -252,7 +252,7 @@ tab is one click from the brand bar.
  warning.
 - Dashboard surfaces a "Images that won't boot" panel reusing the same
  predicate, so the operator sees the problem before they pick the ISO
-  in the gate.
+  in the queue.
 - Streaming uploads are already in place via axum multipart; the v0.1.62
  fix to "502 on big upload" doesn't apply.

@@ -260,15 +260,14 @@ tab is one click from the brand bar.

 **Per-MAC host bindings** (`crates/core/src/host_bindings.rs`):
 - New `HostBindings` registry maps a MAC → preferred `BootEntry::id`
-  (or one of the reserved menu shortcuts `_local`, `_gate`,
+  (or one of the reserved menu shortcuts (`_local`, `_queue``,
  `_tools_menu`).
 - Persisted to `<work_dir>/hosts.json`. Like `SettingsStore`, in-memory
  is authoritative — disk corruption falls back to empty rather than
  failing startup.
- Inspired by Tinkerbell `smee`'s MAC-prepended URL pattern. The DHCP
-  reply now embeds `?mac=${mac}` in the boot.ipxe URL; iPXE substitutes
-  the literal MAC client-side, so the HTTP layer can short-circuit
-  past the menu when a binding exists.
+- The DHCP reply embeds `?mac=${mac}` in the boot.ipxe URL; iPXE
+  substitutes the literal MAC client-side, so the HTTP layer can
+  short-circuit past the menu when a binding exists.
 - `/api/hosts` GET / POST / DELETE drives the **Hosts** tab.

 **Prometheus metrics** (`crates/core/src/metrics.rs`):
@@ -278,7 +277,7 @@ tab is one click from the brand bar.
 - Counters: DHCP replies (per arch label), DHCP declined, TFTP
  transfers (per status label), TFTP bytes, HTTP requests (per route
  label).
- Gauges: ISO count, client count, gate count, gate-imaging count,
+- Gauges: ISO count, client count, queue count, queue-imaging count,
  NFS active mounts, uptime, build info.
 - Exposed as plain Prometheus text at `/metrics`.

@@ -288,18 +287,17 @@ warning-free. Replaced `format!()`-into-`String` with
 `Reverse`, fixed `map_or(false, …)` → `is_some_and`, and a handful of
 other idiom fixes.

-**UI overhaul** for the v0.2.0 pre-beta milestone:
+**UI overhaul** for the pre-beta milestone:
 - Light + dark themes via `:root[data-theme=light]` token swap.
  Toggled by a top-right button or the `T` key. Persisted in
  localStorage; pre-paint inline script avoids dark→light flash.
- New SVG logos: a refined anvil (`logo.svg`) and a SMIL-animated
-  `anvil-forge.svg` (rising sparks + pulsing underglow). Pure SVG —
-  no GIFs, no CSS keyframes for the sparks.
- "Forge progress" widget on the Dashboard and Forge Gate: animated
-  anvil paired with a `linear-gradient(warn → accent)` progress bar
+- New SVG logos: a refined OpenPXE mark (`logo.svg`) and a compact
+  SMIL-animated loader (`loader.svg`). Pure SVG, embedded in the binary.
+- Deployment progress widget on the Dashboard and Queue: animated
+  OpenPXE mark paired with a `linear-gradient(warn → accent)` progress bar
  with a moving sheen. Goes idle (greyscale, no sheen) at zero
  imaging load.
- Loader replaced "Loading…" text with the same anvil.
+- Loader replaced "Loading..." text with the same OpenPXE mark.
 - Sidebar gains a **Hosts** tab.

 **Windows boot validation**:
@@ -317,7 +315,8 @@ other idiom fixes.
  fixes: explicit `net start Workstation` before `net use`, surfaces
  errors instead of blind retries.

-**Test count**: 66 → up from 56 in v0.1.0.
+**Test posture**: protocol, HTTP, ISO-store, Windows script, queue, metrics,
+and UI-offline checks all run in the workspace test suite.

 ## What's deferred to Phase 6

@@ -0,0 +1,403 @@
+# Runbook: Boot a Linux machine from an ISO over the network
+
+End-to-end walkthrough: spin up OpenPXE, load an Ubuntu (or any
+Linux) ISO into it, target a specific bare-metal or VM client by its
+MAC address, and have that machine PXE-boot the installer over the
+LAN — no USB stick, no console babysitting.
+
+This runbook assumes:
+
+- You have **one Linux host** to run the OpenPXE container (any
+  distro with Docker / Podman; 2 GB RAM, ~50 GB disk for the ISO
+  library).
+- That host sits on the **same broadcast domain / VLAN** as the
+  client you want to boot. PXE is L2-broadcast — routed/VLAN’d
+  networks need a DHCP relay and are out of scope here.
+- An **existing DHCP server** is already handing out IP leases on
+  that VLAN (your home router, OPNsense, Windows Server, etc.).
+  OpenPXE runs as a *DHCP proxy* — it never leases IPs, it only
+  layers the boot information on top of the existing DHCP exchange.
+- The target client is configured to **PXE-boot** in BIOS/UEFI
+  firmware (usually `F12` boot menu → Network, or set as first boot
+  device).
+
+If those don’t hold, stop and read [troubleshooting.md](troubleshooting.md)
+or [docs/architecture.md](../docs/architecture.md) first.
+
+---
+
+## 0. Pick your host’s LAN IP
+
+You need the IPv4 address OpenPXE will advertise to clients. From
+the host:
+
+```bash
+ip -4 -o addr show | awk '{print $2, $4}'
+```
+
+Pick the address on the interface that faces the PXE VLAN — for
+example `10.0.0.5/24` on `eno1`. From here on we call it
+`PXE_HOST_IP`.
+
+> **Why this matters.** Every URL handed to clients (TFTP server,
+> iPXE chain URL, ISO URL) is built from this IP. If OpenPXE
+> auto-detects the wrong interface or loopback, clients will fetch
+> from an unreachable address and silently fail. The startup will
+> *fail loudly* if it can only auto-detect a loopback address.
+
+---
+
+## 1. Run OpenPXE
+
+The MVP path is a single `docker run` against the published image,
+with `--network host` so the container can see DHCP broadcasts on
+the LAN.
+
+```bash
+mkdir -p ~/openpxe/isos ~/openpxe/work
+
+docker run -d --name openpxe \
+  --restart unless-stopped \
+  --network host \
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  -e OPENPXE_DHCP_MODE=proxy \
+  -v ~/openpxe/isos:/var/lib/openpxe/isos \
+  -v ~/openpxe/work:/var/lib/openpxe/work \
+  ghcr.io/YOUR-ORG/openpxe:0.2.0
+```
+
+Substitute your `OPENPXE_PUBLIC_IP`, of course. If you’re building
+from this repo instead of pulling, see the
+[README quick start](../README.md#quick-start--mvp-container-recommended).
+
+### Verify it’s alive
+
+```bash
+curl -fsS http://10.0.0.5/healthz   # → 200 ok
+curl -fsS http://10.0.0.5/readyz    # → 200 ready  (iPXE binaries present)
+curl -fsS http://10.0.0.5/api/status | jq .
+```
+
+If `/readyz` is **not** 200, your container is missing iPXE binaries.
+Fix that before going further — clients have nothing to boot
+otherwise. See [README — Container health probes](../README.md#container-health-probes).
+
+### Check the listening ports
+
+OpenPXE holds three privileged UDP/TCP ports. From another shell on
+the host:
+
+```bash
+sudo ss -lnup | grep -E ':(67|69|4011)\b'   # DHCP proxy + TFTP
+sudo ss -lntp | grep ':80\b'                # HTTP UI / boot scripts
+```
+
+All four should be present. If port 67 is taken by `dnsmasq` or the
+host’s own DHCP, stop that service or run OpenPXE on a separate box —
+two listeners on `:67` will fight.
+
+---
+
+## 2. Load the ISO
+
+Two options. Pick one.
+
+### 2a. Web UI upload (recommended for one-offs)
+
+1. Open `http://10.0.0.5/` in a browser.
+2. Sidebar → **Storage**.
+3. Click **Upload ISO**, pick e.g. `ubuntu-24.04.1-live-server-amd64.iso`.
+4. Wait for upload + introspection. The row turns into a card showing:
+   - Distro family (`debian_ubuntu`)
+   - Volume label
+   - Detected kernel/initrd paths (`/casper/vmlinuz`, `/casper/initrd`)
+   - File size and SHA-256
+
+Big ISOs stream — there is no 2 GB limit, but expect upload to be
+throttled by your browser ↔ host link. The UI shows a progress bar; the
+animated OpenPXE mark on the Dashboard tab fires up while imaging is in
+flight.
+
+### 2b. Bulk seed from a directory (recommended for fresh deploys / CI)
+
+If you already have a folder of ISOs on the host, skip the browser:
+
+```bash
+# Dry run first — see what would be imported, no writes:
+docker exec openpxe openpxe seed \
+  --from /seed \
+  --dry-run
+
+# For real, mount the source dir read-only into the container:
+docker run --rm \
+  -v /my/iso-library:/seed:ro \
+  -v ~/openpxe/isos:/var/lib/openpxe/isos \
+  -v ~/openpxe/work:/var/lib/openpxe/work \
+  -e OPENPXE_PUBLIC_IP=10.0.0.5 \
+  ghcr.io/YOUR-ORG/openpxe:0.2.0 seed --from /seed
+```
+
+Each `*.iso` in `/seed` runs through the same upload pipeline as the
+web UI: copy → introspection → boot-entry generation → metadata
+sidecar. Re-running is idempotent.
+
+### Confirm the ISO is registered
+
+```bash
+curl -fsS http://10.0.0.5/api/isos | jq '.[] | {id, name, family, size}'
+```
+
+You should see something like:
+
+```json
+{
+  "id": "ubuntu-24-04-1-live-server-amd64",
+  "name": "ubuntu-24.04.1-live-server-amd64.iso",
+  "family": "debian_ubuntu",
+  "size": 2748000000
+}
+```
+
+The `id` is the **slug**. Remember it — you’ll bind a MAC to it in
+the next step.
+
+---
+
+## 3. Find the target machine’s MAC address
+
+You need the MAC of the **NIC that will PXE**, not the OS’s
+loopback or wifi.
+
+### 3a. From the target itself (if it’s already running an OS)
+
+```bash
+ip -o link | awk '/ether/ {print $2, $17}'    # Linux
+```
+
+Pick the line for the wired NIC plugged into the PXE VLAN.
+
+### 3b. From the firmware (if it’s a fresh box)
+
+Most BIOS/UEFI screens display the NIC MAC during the network-boot
+attempt — usually as `MAC: AA-BB-CC-DD-EE-FF` flashing on the splash
+right before "PXE-E53: No boot filename received". Write it down.
+
+### 3c. By letting it boot once and watching OpenPXE
+
+Easiest if the box is in front of you:
+
+1. Power on, hit `F12`, pick **Network boot**.
+2. Without any binding configured, the client will land on the
+   OpenPXE menu (Default / Installers / Tools / Queued Deployment).
+3. Don’t pick anything. On your laptop:
+   ```bash
+   curl -fsS http://10.0.0.5/api/clients | jq .
+   ```
+4. The most-recent entry is your target. Copy its `mac`.
+
+From here on we call this MAC `TARGET_MAC` (e.g. `aa:bb:cc:dd:ee:ff`).
+Hyphens vs colons, upper vs lower case — OpenPXE normalizes both.
+
+---
+
+## 4. Pin that machine to the Ubuntu ISO
+
+This is the **per-MAC host binding**. With it set, the client won’t
+see the menu at all — it goes straight to the bound boot entry,
+Tinkerbell-style.
+
+### 4a. Via the web UI
+
+1. Sidebar → **Hosts**.
+2. **Add binding**:
+   - **MAC**: `aa:bb:cc:dd:ee:ff`
+   - **Target**: pick `ubuntu-24-04-1-live-server-amd64` from the dropdown.
+   - **Label**: free-form, e.g. `lab-rack3-node07`.
+3. Save.
+
+### 4b. Via the API
+
+```bash
+curl -fsS -X POST http://10.0.0.5/api/hosts \
+  -H 'content-type: application/json' \
+  -d '{
+    "mac":    "aa:bb:cc:dd:ee:ff",
+    "target": "ubuntu-24-04-1-live-server-amd64",
+    "label":  "lab-rack3-node07"
+  }' | jq .
+```
+
+The binding is persisted to `~/openpxe/work/hosts.json` and survives
+container restart.
+
+### Confirm
+
+```bash
+curl -fsS http://10.0.0.5/api/hosts | jq '.[] | select(.mac=="aa:bb:cc:dd:ee:ff")'
+```
+
+You should see your entry with `created_at` and `updated_at`
+timestamps.
+
+---
+
+## 5. Trigger the network boot on the target
+
+Now actually boot the machine.
+
+### 5a. Boot order
+
+In firmware setup, set the wired NIC as the **first** boot device
+(or hold `F12` / `F9` / `Esc` — vendor-specific — to pick "Network
+Boot" interactively).
+
+### 5b. What you should see on the target screen
+
+In order, with timing:
+
+| Stage | Approximate duration | What appears |
+|-------|---------------------:|--------------|
+| Firmware DHCPDISCOVER | ~1 s   | `Start PXE over IPv4` / `Station IP address …` |
+| TFTP iPXE binary fetch | ~1 s  | `TFTP… snponly.efi` (or `undionly.kpxe` for legacy BIOS) |
+| iPXE banner            | ~1 s  | The blue iPXE splash, version string |
+| iPXE second-stage DHCP | ~1 s  | `Configuring (net0 …)` then `ok` |
+| HTTP boot script fetch | <1 s  | `http://10.0.0.5/boot.ipxe?mac=…` |
+| Per-MAC chain          | <1 s  | `OpenPXE: per-MAC binding -> ubuntu-24-04-1-…` |
+| Kernel + initrd HTTP   | 5–30 s | Two 200-OK fetches against `/iso/<id>/casper/vmlinuz` and `…/initrd` |
+| Kernel boot            | 5–10 s | Kernel banner, then the Ubuntu/cloud-init splash |
+| Installer comes up     | 30–60 s | The distro’s normal Live/installer environment |
+
+If everything works, you’re looking at the Ubuntu Server installer
+welcome screen end-to-end **without ever touching a USB stick**.
+
+### 5c. Watch it from the server
+
+In a third shell, tail the live log:
+
+```bash
+curl -N http://10.0.0.5/api/log/stream
+```
+
+You’ll see each protocol step as it happens:
+
+```
+INFO openpxe::dhcp: reply mac=aa:bb:cc:dd:ee:ff arch=X8664Uefi target=tftp/snponly.efi
+INFO openpxe::tftp: RRQ snponly.efi blksize=1468 windowsize=8 → 982 KiB in 412 ms
+INFO openpxe::dhcp: reply mac=aa:bb:cc:dd:ee:ff (iPXE) target=http/boot.ipxe
+INFO openpxe::http: GET /boot.ipxe?mac=aa:bb:cc:dd:ee:ff → host binding hit
+INFO openpxe::http: GET /iso/ubuntu-…/casper/vmlinuz Range=bytes=0- 200 OK 14 MiB
+INFO openpxe::http: GET /iso/ubuntu-…/casper/initrd  Range=bytes=0- 200 OK 75 MiB
+```
+
+The **Terminal** tab in the web UI shows the same thing live, plus a
+short whitelisted command palette (`status`, `clients`, `queue`,
+`hosts`, `log`).
+
+### 5d. Internet-side ISO sources
+
+The runbook title says “via the internet” — the **client** itself
+boots from your LAN, but the underlying ISO can come from anywhere
+your *host* can reach:
+
+- **Direct upload** from a remote workstation via the web UI (HTTPS
+  reverse-proxied if you put OpenPXE behind nginx/Caddy).
+- **NFS mount** of a remote share — Sidebar → **Storage** → **NFS** →
+  `nfs://files.lab.example.com/exports/isos`. Mounted ISOs show up in
+  the same list and are PXE-bootable directly without copying.
+- **Pre-seed** from a CI job that `curl`s a vendor mirror and runs
+  `openpxe seed --from`.
+
+OpenPXE itself never reaches out to the internet at boot time — all
+client traffic stays on the LAN, served from the host.
+
+---
+
+## 6. After the install
+
+Once Ubuntu has finished installing to the target’s disk, you want
+the next reboot to come up off the new local disk, **not** PXE
+again. Two ways:
+
+### 6a. One-shot — release the binding
+
+```bash
+curl -fsS -X DELETE http://10.0.0.5/api/hosts/aa:bb:cc:dd:ee:ff
+```
+
+Without a binding, the client either gets the menu (BIOS still set
+to PXE first) or boots local disk normally.
+
+### 6b. Permanent — pin to local disk
+
+Re-bind to the reserved local-boot target:
+
+```bash
+curl -fsS -X POST http://10.0.0.5/api/hosts \
+  -H 'content-type: application/json' \
+  -d '{ "mac": "aa:bb:cc:dd:ee:ff", "target": "_local", "label": "lab-rack3-node07 (installed)" }'
+```
+
+Now if anyone hits `F12 → Network` by accident, OpenPXE replies
+with a script that says *"chain back to local HDD"* and the box
+boots its real OS instead of re-imaging itself. This is the safest
+default for production hardware.
+
+---
+
+## 7. Re-imaging — the “Queued Deployment” flow
+
+Different scenario: you have **a rack of 30 servers** to image
+identically, all at once. Don’t bind 30 MACs by hand. Use the queue.
+
+1. **Don’t** create host bindings.
+2. PXE-boot every machine. They land on the menu.
+3. On each: select **Queued Deployment**. They get position #1, #2,
+   …, #30 and start long-polling.
+4. In the UI: **Queue** tab shows all 30 lined up. Pick the
+   ISO, click **Assign to all waiting**.
+5. Every client’s open long-poll wakes up at the same instant and
+   chains the same boot script. They all start imaging
+   simultaneously.
+
+The animated OpenPXE progress widget on the Dashboard runs while any client is
+still in the kernel-fetch phase.
+
+---
+
+## Cheat sheet
+
+| Goal | Command |
+|------|---------|
+| Health check | `curl http://$IP/healthz` |
+| List ISOs | `curl http://$IP/api/isos \| jq .` |
+| List clients seen | `curl http://$IP/api/clients \| jq .` |
+| Bind MAC → ISO | `POST /api/hosts` with `{mac,target,label}` |
+| Bind MAC → local disk | same with `target=_local` |
+| Release binding | `DELETE /api/hosts/<mac>` |
+| Live log | `curl -N http://$IP/api/log/stream` |
+| Prometheus metrics | `curl http://$IP/metrics` |
+| Bulk import folder | `openpxe seed --from /path` |
+
+---
+
+## Where to look when things break
+
+- **Client gets `PXE-E53: No boot filename received`** — DHCP proxy
+  isn’t replying. Check `:67` is bound (`ss -lnup`), check
+  `--network host`, check the host firewall on UDP 67/69/4011.
+- **iPXE shows `No more network devices`** — firmware NIC isn’t in
+  PXE mode, or VLAN tagging is wrong.
+- **iPXE prints `Connection timed out (http://…)`** — `OPENPXE_PUBLIC_IP`
+  is wrong. Clients can’t reach that IP. Check `/api/status` →
+  `public_base_url` and `ping` it from the client subnet.
+- **Kernel panics during initrd load** — corrupt ISO upload. Check
+  `/api/isos`, compare the SHA-256 to the vendor’s, re-upload.
+- **Boot menu shows but the bound entry doesn’t fire** — the binding
+  target slug doesn’t match any ISO `id`. Recheck
+  `GET /api/hosts` against `GET /api/isos`. The binding falls back
+  to the menu on miss (by design — never lock a client out).
+- **General confusion** — Terminal tab → `status`, then `log`. That
+  tells you what protocol stages have run and which haven’t.
+
+For deeper protocol-level debugging, see
+[docs/architecture.md](../docs/architecture.md).
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# build-and-publish-unraid.sh — one-shot: clone PXEForge, build the image,
+# build-and-publish-unraid.sh — one-shot: clone OpenPXE, build the image,
 # push it to your local Gitea container registry. Run this ON the Unraid
 # box (or any host that can reach Gitea on http://localhost:3000 or its
 # LAN IP). No Cloudflare in the way; the proxy doesn't matter for this
@@ -10,31 +10,31 @@
 #   GITEA_HOST      default: localhost:3000  (use 192.168.1.49:3000 if
 #                   you're on the LAN but not on the Unraid host)
 #   GITEA_OWNER     default: mward4
-#   GITEA_REPO      default: PXEForge
+#   GITEA_REPO      default: OpenPXE
 #   IMAGE_TAG       default: 0.1.0  (also tagged :latest)
 #   PLATFORM        default: linux/amd64  (Unraid is x86_64)
-#   WORKDIR         default: /tmp/pxeforge-build  (deleted on success)
+#   WORKDIR         default: /tmp/openpxe-build  (deleted on success)
 #
 # What it does:
-#   1. git clone <gitea>/mward4/PXEForge.git into WORKDIR
+#   1. git clone <gitea>/mward4/OpenPXE.git into WORKDIR
 #   2. fetch iPXE binaries (scripts/fetch-ipxe.sh)
-#   3. docker build deploy/docker/Dockerfile -> pxeforge:$TAG (and :latest)
+#   3. docker build deploy/docker/Dockerfile -> openpxe:$TAG (and :latest)
 #   4. docker login to GITEA_HOST using the token
-#   5. docker push to <gitea>/<owner>/pxeforge:<tag> and :latest
+#   5. docker push to <gitea>/<owner>/openpxe:<tag> and :latest
 #   6. docker logout, scrub creds, clean WORKDIR
 #
 # After this, on any Unraid Docker template, set:
-#   Repository: <gitea>/mward4/pxeforge:0.1.0    (or :latest)
+#   Repository: <gitea>/mward4/openpxe:0.1.0    (or :latest)
 #   Network:    host                             (DHCP/TFTP need raw L2)

 set -euo pipefail

 GITEA_HOST=${GITEA_HOST:-localhost:3000}
 GITEA_OWNER=${GITEA_OWNER:-mward4}
-GITEA_REPO=${GITEA_REPO:-PXEForge}
+GITEA_REPO=${GITEA_REPO:-OpenPXE}
 IMAGE_TAG=${IMAGE_TAG:-0.1.0}
 PLATFORM=${PLATFORM:-linux/amd64}
-WORKDIR=${WORKDIR:-/tmp/pxeforge-build}
+WORKDIR=${WORKDIR:-/tmp/openpxe-build}

 # Lowercase the image name — OCI distribution rejects uppercase paths.
 IMAGE_NAME="$(printf '%s' "$GITEA_REPO" | tr '[:upper:]' '[:lower:]')"
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Fetch prebuilt iPXE binaries from the official distribution at
 # https://boot.ipxe.org/ and place them under assets/ipxe/ with the filenames
-# PXEForge's arch mapping expects.
+# OpenPXE's arch mapping expects.
 #
 # Why not build from source?
 #   - Building iPXE requires the toolchain + several megabytes of source, and
Author	SHA1	Message	Date
Miles Ward	a171331a7a	make container builds reproducible Commit Cargo.lock, copy it into the Docker build stage, and align the Docker Rust base/MSRV with the toolchain required by the locked dependency graph.	2026-05-24 13:53:10 -04:00
Miles Ward	fe4a127422	fix docker build toolchain selection Do not copy rust-toolchain.toml into the Docker build stage so the release image uses the Rust toolchain provided by the base image instead of downloading latest stable inside the container.	2026-05-24 13:49:09 -04:00
Miles Ward	2c1c80a7ca	v0.4.1: harden ISO uploads and beta UI polish Add browser-safe chunked ISO uploads with progress, partial-file visibility, offset validation, and abort cleanup while keeping the legacy multipart endpoint for API clients. Record host-log validation coverage, keep the queue/status UI copy clean, move release docs to 0.4.1, and tighten the dark theme to a near-black Netbox-style palette.	2026-05-24 13:45:35 -04:00
Miles WardandClaude Opus 4.7	ec171ede47	v0.4.0: upload telemetry, host log, jet-black UI - Upload reliability + diagnostics: - api_upload_iso now distinguishes clean EOF from mid-stream errors; a truncated multipart body (proxy buffer cap, network drop) returns 400 with the cause and a "try the LAN IP" hint instead of silently finalising a partial file. - Per-stage tracing (begin/MB-watermark/finish/abort) so a stuck upload is debuggable from the Terminal tab. - Web upload UI surfaces bytes/total, percent, throughput, ETA, and maps 413/502/504/network-drop to actionable hints. - New BootLog feature under Hosts: - openpxe-core::BootLog — bounded in-memory ring (500) + append-only JSONL on disk, recording (timestamp, mac, ip, target_id, target_title) every time a boot entry script is served. - iPXE per-entry chain URLs grow ?mac=${mac}; password prompt submission carries it through; host-binding short-circuit uses the bound MAC. ConnectInfo<SocketAddr> wired for peer IP capture (with optional fallback so tower::oneshot in tests still works). - GET /api/boot-log endpoint + Host log table under the Hosts tab. - UI changes: - Queue card header "Forge" → "Status". - Removed Tinkerbell attribution sentence from Hosts tab. - Topbar readiness chip moved into the sidebar footer as "Service status: Ready / Advertised to clients / <url>", grouping advertised PXE URL with operator-relevant status. - Jet-black dark palette (#000 / #0a0a0a / #141414 / #1c1c1c) replacing the blue-tinted ramp; terminal toolbar/input recoloured to match. - 89 tests passing (was 85 in v0.3.2); cargo clippy --workspace --all-targets clean. Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>	2026-05-24 13:10:40 -04:00
Miles Ward	115ba779da	Name update	2026-05-21 02:13:08 -04:00
Miles Ward	91848e02e3	v0.3.1: per-ISO boot password gate Operators can now lock individual ISOs behind a password set in the WebUI. Picking a locked image at the PXE menu prompts the operator on the client console; the boot script is only released after a correct match. The plaintext never leaves the request — server stores bcrypt hashes, scripts never echo the candidate. ## Backend - New optional `password_hash: Option<String>` on `IsoMeta`. Skipped during serialize when None, so existing meta.json files don't grow a noisy `null` field. - `IsoStore::set_password(id, Some("pw"))` hashes via bcrypt `DEFAULT_COST` (10 — fast enough for an interactive iPXE prompt, expensive enough to be hostile to brute force on a leaked meta.json). `set_password(id, None)` and `set_password(id, Some(""))` both clear. - `IsoStore::verify_password` returns Ok(true) when no password is set, so the gate stays open for the common case. - `IsoMeta::is_password_protected()` predicate the HTTP layer + UI share. - NFS-sourced ISOs persist their hash in memory only — the share is the source of truth for those, and it doesn't carry hash sidecars. ## HTTP API - `PUT /api/isos/:id/password` body `{ "password": "..." }` to set, `{ "password": null }` (or empty string) to clear. - `DELETE /api/isos/:id/password` for the explicit clear. - Both 204 on success, 404 for unknown ids. - `/boot/<entry>.ipxe` now intercepts: - no `?token=` -> render password-prompt script - `?token=<wrong>` -> render auth-fail script (sleeps 2s, chains back to the entry which re-prompts) - `?token=<correct>` -> render the real boot script - ISO without password ignores token entirely (per-MAC bookmarks still work without changes). ## iPXE prompt `render_password_prompt`: - `set password ` then `read --secret password` — accepts input without echoing. - Empty input chains back to the main menu (lets the operator back out of a misclick). - Submit chains `?token=${password:uristring}`. The `:uristring` modifier URL-encodes the value, so passwords with `&`, `?`, `=`, spaces, etc. survive transport. `render_password_failed`: - Single line saying so + 2s sleep, then re-chains the entry. - Server-side WARN log records the entry id only, never the candidate value (verified in smoke test). ## UI Storage tab's image table grows an `Auth` column showing `protected` / `open`, plus a 🔒 next to the filename when locked. Per-row "Set password" / "Password ✎" button toggles an inline editor in the next table row containing: - a "Password protect this image" checkbox - a `<input type=password autocomplete=new-password>` (hidden when the checkbox is off) - a Save button Save calls PUT or DELETE on `/api/isos/:id/password` based on the checkbox state and clears the input field before re-rendering, so the plaintext doesn't sit in the DOM longer than needed. ## Menu indicator `render_family_menu` adds a `` prefix immediately before the size box on protected entries — ASCII only because some firmware menu consoles mangle non-ASCII glyphs. Looks like: item --key 1 win11_test-winpe [ 5234 MB] Windows 11 Test ISO ## Tests 74 passing across the workspace (was 66 in v0.3.0): - 3 new store unit tests (bcrypt round-trip, unknown-id error, meta.json persistence across restart) - 2 new ipxe_script unit tests (prompt/auth-fail invariants: read --secret, uristring, no candidate echo) - 3 new HTTP integration tests (full gate flow upload-set-prompt- fail-success-clear, null/empty bodies, 404 on unknown id) cargo clippy --workspace --all-targets clean. Local smoke verified upload + lock + prompt + auth-fail + correct + menu indicator + log scrub on a real release binary. ## Operational notes - HTTP, not HTTPS — token rides in the query string. Acceptable on a trusted boot VLAN; do NOT expose OpenPXE to untrusted networks with this feature relied on for security. Reverse-proxy in front of OpenPXE will end up with the token in access logs. - bcrypt cost is `DEFAULT_COST` (10). One verify takes ~50ms on modern x86, which is the worst-case latency added to a correct boot. Tunable via the bcrypt crate if needed.	2026-05-06 22:35:11 -04:00
Miles Ward	4e88305101	Name update	2026-05-06 14:14:09 -04:00
Miles Ward	20c585e3ed	Name update	2026-05-06 14:13:38 -04:00
503432756	e1b7154b51	docs: add Linux network-boot runbook	2026-04-30 11:35:47 -04:00
Miles Ward	40064906de	Name update	2026-04-30 02:30:05 -04:00