fix(#308 ): handle placeholder presets without panicking

The ST10's /presets response after a factory reset emits self-closing <preset/> entries with no ContentItem child. cmd/soundtouch-cli's getPresets() handled the missing ContentItem in GetDisplayName() but then dereferenced preset.ContentItem.Source on the next line, panicking with "invalid memory address or nil pointer dereference" the moment the loop reached the first empty entry. A second placeholder shape was observed on healthy devices that were never reset: <preset id="0"><ContentItem source="INVALID_SOURCE" isPresetable="true"/></preset>. ContentItem is non-nil here, so the previous "ContentItem != nil" guard at other call sites still let these placeholders through into listings and into the AfterTouch datastore. Fix shape: pkg/models/presets.go - extend Preset.IsEmpty() to recognise both shapes (ContentItem == nil, OR Source == "" / "INVALID_SOURCE"). HasPresets, GetEmptyPresetSlots and GetUsedPresetSlots become honest about which slots actually carry playable content. cmd/soundtouch-cli/cmd_info.go (the crash site) - filter the slice via IsEmpty before the print loop, and switch the still-printed fields to the existing nil-safe Get* helpers. pkg/service/setup/setup.go - upgrade syncPresets's "ContentItem == nil" continue-guard to IsEmpty so Shape B placeholders don't get persisted in the AfterTouch datastore and then surface as junk rows in the admin web UI. cmd/soundtouch-cli/cmd_events.go, cmd/websocket-demo/main.go - same nil-guard upgrade. These already nil-checked so were crash-safe; the change is for consistency and to stop printing "Preset 0: (INVALID_SOURCE)" demo lines. examples/preset-management/main.go - had the same latent crash as cmd_info.go; same fix shape. Regression tests in pkg/models/presets_test.go cover both shapes using the exact XML observed in the wild: the reporter's three <preset/> placeholders plus the three INVALID_SOURCE entries from a live device. The reporter XML test walks every preset through the same accessor path the CLI used and asserts no panic. The soundtouch-web Go code does not deref preset.ContentItem.X anywhere - presets flow through as JSON - so no separate crash trap exists there. The web frontend will pick up the cleaner data once syncPresets stops persisting placeholders. Closes #308 Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
refactor(soundtouch-web): make DeviceConnection.Status atomically swappable
2026-08-24 14:47:23 +00:00 · 2026-05-17 11:36:55 +02:00 · 2026-05-17 11:14:17 +02:00 · 2026-05-17 11:14:17 +02:00 · 2026-05-17 11:14:17 +02:00 · 2026-05-17 10:30:25 +02:00
388 changed files with 59566 additions and 3850 deletions
@@ -0,0 +1,5 @@
+# Files intentionally not linked in docs/SUMMARY.md.
+# Paths are relative to the docs/ directory.
+# Lines starting with # and blank lines are ignored.
+
+#analysis/bose-soundtouch-community-tools.md
@@ -3,6 +3,7 @@

 # Docker/Service Settings
 SOUNDTOUCH_HOSTNAME=soundtouch.local
+SOUNDTOUCH_VERSION=latest

 # Discovery Settings
 DISCOVERY_TIMEOUT=5s
@@ -28,6 +28,21 @@
    },
    {
      "pattern": "^\\.\\./images/(dashboard-home|account-creation|account-dashboard|usb-remote-services|device-discovery|device-registration|account-migration|migration-setup|migration-progress|migration-health|migration-complete|backup-setup)\\.png$"
+    },
+    {
+      "pattern": "https://www.contributor-covenant.org/version/2/0/code_of_conduct.html"
+    },
+    {
+      "pattern": "https://www.apkmirror.com/apk/bose-corporation/bose-soundtouch/"
+    },
+    {
+      "pattern": "https://apkpure.com/bose-soundtouch/com.bose.soundtouch"
+    },
+    {
+      "pattern": "^https://bose\\.fandom\\.com/"
+    },
+    {
+      "pattern": "^https://www\\.reddit\\.com/"
    }
  ],
  "replacementPatterns": [
@@ -17,15 +17,15 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

      - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cache/go-build
@@ -34,6 +34,9 @@ jobs:
          restore-keys: |
            ${{ runner.os }}-go-

+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev
+
      - name: Download dependencies
        run: go mod download

@@ -43,8 +46,14 @@ jobs:
      - name: Run tests
        run: go test -v -race -coverprofile=coverage.out ./...

+      - name: Build service
+        run: make build-service
+
+      - name: Run HTTP client integration tests
+        run: make test-http-client
+
      - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
        with:
          file: ./coverage.out
          flags: unittests
@@ -57,15 +66,18 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev
+
      - name: Run golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
        with:
          version: latest
          args: --timeout=5m
@@ -74,39 +86,76 @@ jobs:
    name: Build
    runs-on: ubuntu-latest
    strategy:
+      fail-fast: false
      matrix:
-        goos: [linux, darwin, windows]
-        goarch: [amd64, arm64]
-        exclude:
-          # Windows ARM64 builds are experimental
-          - goos: windows
+        include:
+          - goos: linux
+            goarch: amd64
+          - goos: linux
            goarch: arm64
+          - goos: linux
+            goarch: arm
+            goarm: 7
+          - goos: darwin
+            goarch: amd64
+          - goos: darwin
+            goarch: arm64
+          - goos: windows
+            goarch: amd64
+          - goos: freebsd
+            goarch: amd64

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

-      - name: Build CLI
+      - name: Cache Go modules
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        with:
+          path: |
+            ~/.cache/go-build
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-${{ hashFiles('**/go.mod') }}-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-
+
+      - name: Build binaries
        env:
          GOOS: ${{ matrix.goos }}
          GOARCH: ${{ matrix.goarch }}
+          GOARM: ${{ matrix.goarm }}
+          CGO_ENABLED: 0
        run: |
-          output_name="soundtouch-cli-${{ matrix.goos }}-${{ matrix.goarch }}"
-          if [ "${{ matrix.goos }}" = "windows" ]; then
-            output_name="${output_name}.exe"
+          ARCH_SUFFIX="${{ matrix.goos }}-${{ matrix.goarch }}"
+          if [[ -n "${{ matrix.goarm }}" ]]; then
+            ARCH_SUFFIX="${ARCH_SUFFIX}v${{ matrix.goarm }}"
          fi
-          go build -o "$output_name" ./cmd/soundtouch-cli
+
+          EXT=""
+          if [[ "${{ matrix.goos }}" == "windows" ]]; then
+            EXT=".exe"
+          fi
+
+          mkdir -p build
+
+          for binary in soundtouch-cli soundtouch-service soundtouch-web soundtouch-backup; do
+            OUTPUT="build/${binary}-${ARCH_SUFFIX}${EXT}"
+            echo "Building $OUTPUT"
+            go build -trimpath -ldflags="-s -w" -o "$OUTPUT" "./cmd/$binary"
+          done
+
+          ls -la build/

      - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
-          name: soundtouch-cli-${{ matrix.goos }}-${{ matrix.goarch }}
-          path: soundtouch-cli-*
+          name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.goarm }}
+          path: build/

  security:
    name: Basic Security Check
@@ -114,13 +163,16 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev
+
      - name: Run basic vulnerability check
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
@@ -138,14 +190,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Check documentation links
-        uses: gaurav-nelson/github-action-markdown-link-check@v1
-        with:
-          use-quiet-mode: "yes"
-          use-verbose-mode: "yes"
-          config-file: ".github/markdown-link-check.json"
+        run: |
+          npm install -g markdown-link-check
+          find . -name "*.md" -not -path "./tests/*" -not -path "./node_modules/*" -print0 | xargs -0 -n1 markdown-link-check -q -v -c .github/markdown-link-check.json

      - name: Warn on pending images
        run: |
@@ -198,16 +248,16 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

      - name: Test CLI build and help
        run: |
-          go build -o soundtouch-cli ./cmd/soundtouch-cli
+          go build -trimpath -ldflags="-s -w" -o soundtouch-cli ./cmd/soundtouch-cli
          ./soundtouch-cli -help

      - name: Test library imports
@@ -253,39 +303,116 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Determine push eligibility
+        id: push-check
+        run: |
+          # Push on main, and on same-repo PRs (forks can't push to GHCR via GITHUB_TOKEN).
+          SHOULD_PUSH="false"
+          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref }}" == "refs/heads/main" ]]; then
+            SHOULD_PUSH="true"
+          elif [[ "${{ github.event_name }}" == "pull_request" && \
+                  "${{ github.event.pull_request.head.repo.full_name }}" == "${{ github.repository }}" ]]; then
+            SHOULD_PUSH="true"
+          fi
+          echo "should-push=$SHOULD_PUSH" >> "$GITHUB_OUTPUT"
+          echo "Will push: $SHOULD_PUSH"

      - name: Log in to GitHub Container Registry
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: docker/login-action@v4
+        if: steps.push-check.outputs.should-push == 'true'
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v6
+      - name: Extract metadata (tags, labels) for soundtouch-service
+        id: meta-service
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' }}
-            type=ref,event=pr
+            type=ref,event=pr,prefix=preview-pr-
+            type=sha,prefix=preview-sha-,format=short,enable=${{ github.event_name == 'pull_request' }}
+            type=ref,event=branch,prefix=preview-branch-,enable=${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}

-      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+      - name: Build and push soundtouch-service Docker image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
+          target: soundtouch-service
          platforms: linux/amd64,linux/arm64,linux/arm64/v8,linux/arm/v7
-          push: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          push: ${{ steps.push-check.outputs.should-push == 'true' }}
+          tags: ${{ steps.meta-service.outputs.tags }}
+          labels: ${{ steps.meta-service.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

+      - name: Extract metadata (tags, labels) for soundtouch-web
+        id: meta-web
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        with:
+          images: ghcr.io/${{ github.repository }}-web
+          tags: |
+            type=raw,value=edge,enable=${{ github.ref == 'refs/heads/main' }}
+            type=ref,event=pr,prefix=preview-pr-
+            type=sha,prefix=preview-sha-,format=short,enable=${{ github.event_name == 'pull_request' }}
+            type=ref,event=branch,prefix=preview-branch-,enable=${{ github.event_name == 'push' && github.ref != 'refs/heads/main' }}
+
+      - name: Build and push soundtouch-web Docker image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          target: soundtouch-web
+          platforms: linux/amd64,linux/arm64,linux/arm64/v8,linux/arm/v7
+          push: ${{ steps.push-check.outputs.should-push == 'true' }}
+          tags: ${{ steps.meta-web.outputs.tags }}
+          labels: ${{ steps.meta-web.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Summarize published images
+        if: steps.push-check.outputs.should-push == 'true'
+        env:
+          SERVICE_TAGS: ${{ steps.meta-service.outputs.tags }}
+          WEB_TAGS: ${{ steps.meta-web.outputs.tags }}
+          EVENT_NAME: ${{ github.event_name }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          {
+            echo "## 🐳 Published Docker Images"
+            echo ""
+            if [[ "$EVENT_NAME" == "pull_request" ]]; then
+              echo "**Preview** images for PR #${PR_NUMBER}. These are not release builds."
+            elif [[ "$REF_NAME" == "main" ]]; then
+              echo "**Edge** images from \`main\`."
+            else
+              echo "**Preview** images from branch \`${REF_NAME}\`. These are not release builds."
+            fi
+            echo ""
+            echo "### soundtouch-service"
+            echo ""
+            echo '```bash'
+            while IFS= read -r tag; do
+              [[ -n "$tag" ]] && echo "docker pull $tag"
+            done <<< "$SERVICE_TAGS"
+            echo '```'
+            echo ""
+            echo "### soundtouch-web"
+            echo ""
+            echo '```bash'
+            while IFS= read -r tag; do
+              [[ -n "$tag" ]] && echo "docker pull $tag"
+            done <<< "$WEB_TAGS"
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+
  notify:
    name: Notify Status
    runs-on: ubuntu-latest
@@ -320,7 +447,7 @@ jobs:

      - name: Update commit status
        if: always()
-        uses: actions/github-script@v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            try {
@@ -20,18 +20,18 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
      - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
        with:
          source: 'docs/'
          destination: '_site'
      - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
        with:
          path: '_site'
      - name: Deploy to GitHub Pages
        id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
@@ -28,7 +28,7 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

@@ -64,10 +64,13 @@ jobs:
          fi

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: ${{ env.GO_VERSION_FILE }}

+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev
+
      - name: Run tests before release
        run: |
          echo "Running final tests before release..."
@@ -99,15 +102,15 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: ${{ env.GO_VERSION_FILE }}

      - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
        with:
          path: |
            ~/.cache/go-build
@@ -148,6 +151,7 @@ jobs:
            rm -f "$OUTPUT_NAME" "$OUTPUT_NAME.sha256" "$OUTPUT_NAME.sha512"

            if ! go build \
+              -trimpath \
              -ldflags="-s -w" \
              -o "$OUTPUT_NAME" \
              "$CMD_PATH"; then
@@ -165,12 +169,20 @@ jobs:

          # Build Service
          build_binary "soundtouch-service" "./cmd/soundtouch-service"
+
+          # Build Web
+          build_binary "soundtouch-web" "./cmd/soundtouch-web"
+
+          # Build Backup
+          build_binary "soundtouch-backup" "./cmd/soundtouch-backup"
        id: build

      - name: Generate individual checksums
        run: |
          CLI_NAME="${{ steps.build.outputs.soundtouch-cli }}"
          SVC_NAME="${{ steps.build.outputs.soundtouch-service }}"
+          WEB_NAME="${{ steps.build.outputs.soundtouch-web }}"
+          BCK_NAME="${{ steps.build.outputs.soundtouch-backup }}"

          # Use atomic operations to avoid conflicts
          TEMP_DIR=$(mktemp -d)
@@ -186,18 +198,22 @@ jobs:

          generate_checksums "$CLI_NAME"
          generate_checksums "$SVC_NAME"
+          generate_checksums "$WEB_NAME"
+          generate_checksums "$BCK_NAME"

          # Cleanup
          rm -rf "$TEMP_DIR"
          echo "✅ Checksums generated successfully"

      - name: Upload build artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: binaries-${{ matrix.goos }}-${{ matrix.goarch }}${{ matrix.goarm }}
          path: |
            build/soundtouch-cli-v*
            build/soundtouch-service-v*
+            build/soundtouch-web-v*
+            build/soundtouch-backup-v*
          retention-days: 1

  checksums:
@@ -207,7 +223,7 @@ jobs:

    steps:
      - name: Download binary artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          pattern: binaries-*
          path: ./binaries
@@ -224,7 +240,7 @@ jobs:
          mkdir -p release-files

          # Move all files from subdirectories to the collection directory
-          find . -mindepth 2 -type f \( -name "soundtouch-cli-*" -o -name "soundtouch-service-*" \) -exec mv {} release-files/ \;
+          find . -mindepth 2 -type f \( -name "soundtouch-cli-*" -o -name "soundtouch-service-*" -o -name "soundtouch-web-*" -o -name "soundtouch-backup-*" \) -exec mv {} release-files/ \;

          # Remove empty directories
          find . -type d -empty -delete
@@ -239,14 +255,14 @@ jobs:
          # Generate combined checksums (exclude individual .sha256/.sha512 files)
          if ls soundtouch-* 1> /dev/null 2>&1; then
            # Only checksum the actual binaries, not the .sha256/.sha512 files
-            ls soundtouch-* | grep -v '\.sha256$' | grep -v '\.sha512$' | xargs sha256sum > checksums.sha256
-            ls soundtouch-* | grep -v '\.sha256$' | grep -v '\.sha512$' | xargs sha512sum > checksums.sha512
+            ls soundtouch-cli-* soundtouch-service-* soundtouch-web-* soundtouch-backup-* | grep -v '\.sha256$' | grep -v '\.sha512$' | xargs sha256sum > checksums.sha256
+            ls soundtouch-cli-* soundtouch-service-* soundtouch-web-* soundtouch-backup-* | grep -v '\.sha256$' | grep -v '\.sha512$' | xargs sha512sum > checksums.sha512

            echo "📋 Generated combined checksums:"
            cat checksums.sha256

            # Verify all expected files are present (binaries only, not checksum files)
-            EXPECTED_COUNT=14  # 7 platforms * 2 binaries
+            EXPECTED_COUNT=28  # 7 platforms * 4 binaries
            ACTUAL_COUNT=$(ls soundtouch-* | grep -v '\.sha256$' | grep -v '\.sha512$' | wc -l)

            if [[ $ACTUAL_COUNT -ne $EXPECTED_COUNT ]]; then
@@ -264,7 +280,7 @@ jobs:
          fi

      - name: Upload checksums
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: checksums
          path: |
@@ -275,7 +291,7 @@ jobs:
          retention-days: 1

      - name: Upload all release assets
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: release-assets
          path: binaries/release-files/
@@ -289,12 +305,12 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0

      - name: Download release assets
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-assets
          path: ./release-assets
@@ -377,6 +393,18 @@ jobs:
          ./soundtouch-service
          \`\`\`

+          ### SoundTouch Web
+          \`\`\`bash
+          # Start the web app
+          ./soundtouch-web
+          \`\`\`
+
+          ### SoundTouch Backup
+          \`\`\`bash
+          # Back up cloud account and all paired speakers in one go
+          ./soundtouch-backup all
+          \`\`\`
+
          ## 🧪 Tested Hardware

          - Bose SoundTouch 10
@@ -395,7 +423,7 @@ jobs:
          - Windows (amd64)
          - FreeBSD (amd64)

-          Both `soundtouch-cli` and `soundtouch-service` are included.
+          `soundtouch-cli`, `soundtouch-service`, `soundtouch-web`, and `soundtouch-backup` are included.

          ## 🔐 Checksums

@@ -440,7 +468,7 @@ jobs:
          echo "release_notes_file=release_notes.md" >> $GITHUB_OUTPUT

      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ github.event.inputs.tag }}
          name: "Bose SoundTouch Go Library ${{ github.event.inputs.tag }}"
@@ -450,6 +478,8 @@ jobs:
          files: |
            release-assets/soundtouch-cli-v*
            release-assets/soundtouch-service-v*
+            release-assets/soundtouch-web-v*
+            release-assets/soundtouch-backup-v*
            release-assets/checksums.sha256
            release-assets/checksums.sha512
          fail_on_unmatched_files: true
@@ -464,18 +494,20 @@ jobs:

    steps:
      - name: Download release assets
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          name: release-assets
          path: ./release-assets

      - name: Upload additional assets to existing release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
        with:
          tag_name: ${{ github.event.release.tag_name }}
          files: |
            release-assets/soundtouch-cli-v*
            release-assets/soundtouch-service-v*
+            release-assets/soundtouch-web-v*
+            release-assets/soundtouch-backup-v*
            release-assets/checksums.sha256
            release-assets/checksums.sha512
          fail_on_unmatched_files: true
@@ -489,21 +521,21 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

-      - name: Extract metadata (tags, labels) for Docker
-        id: meta
-        uses: docker/metadata-action@v6
+      - name: Extract metadata (tags, labels) for soundtouch-service
+        id: meta-service
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
@@ -511,14 +543,37 @@ jobs:
            type=semver,pattern={{major}}.{{minor}},value=v${{ needs.validate.outputs.version }}
            type=raw,value=latest,enable=${{ needs.validate.outputs.is_prerelease == 'false' }}

-      - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+      - name: Build and push soundtouch-service Docker image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          context: .
+          target: soundtouch-service
          platforms: linux/amd64,linux/arm64,linux/arm64/v8,linux/arm/v7
          push: true
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
+          tags: ${{ steps.meta-service.outputs.tags }}
+          labels: ${{ steps.meta-service.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Extract metadata (tags, labels) for soundtouch-web
+        id: meta-web
+        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
+        with:
+          images: ghcr.io/${{ github.repository }}-web
+          tags: |
+            type=semver,pattern={{version}},value=v${{ needs.validate.outputs.version }}
+            type=semver,pattern={{major}}.{{minor}},value=v${{ needs.validate.outputs.version }}
+            type=raw,value=latest,enable=${{ needs.validate.outputs.is_prerelease == 'false' }}
+
+      - name: Build and push soundtouch-web Docker image
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          target: soundtouch-web
+          platforms: linux/amd64,linux/arm64,linux/arm64/v8,linux/arm/v7
+          push: true
+          tags: ${{ steps.meta-web.outputs.tags }}
+          labels: ${{ steps.meta-web.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

@@ -532,7 +587,7 @@ jobs:
      - name: Notify success
        run: |
          echo "🎉 Release ${{ needs.validate.outputs.version }} completed successfully!"
-          echo "📦 Binaries built for 7 platforms (CLI and Service)"
+          echo "📦 Binaries built for 7 platforms (CLI, Service, Web, and Backup)"
          echo "🐳 Docker image published to ghcr.io"
          echo "🔐 Checksums generated and verified"
          echo "📋 Release notes automatically generated"
@@ -19,13 +19,16 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev
+
      - name: Install security scanning tools
        run: |
          go install golang.org/x/vuln/cmd/govulncheck@latest
@@ -45,7 +48,7 @@ jobs:

      - name: Upload vulnerability scan results
        if: failure()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: vulnerability-scan-results
          path: |
@@ -60,13 +63,16 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
        with:
          go-version-file: "go.mod"

+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev
+
      - name: Install static analysis tools
        run: |
          go install honnef.co/go/tools/cmd/staticcheck@latest
@@ -78,7 +84,7 @@ jobs:
          echo "::endgroup::"

      - name: Run Semgrep security analysis
-        uses: semgrep/semgrep-action@v1
+        uses: semgrep/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d # v1 (no v1.x.y semver tag exists)
        with:
          config: >-
            p/security-audit
@@ -89,7 +95,7 @@ jobs:

      - name: Upload Semgrep SARIF results
        if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
        with:
          sarif_file: semgrep.sarif
        continue-on-error: true
@@ -104,19 +110,22 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Install libpcap
+        run: sudo apt-get install -y libpcap-dev

      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
        with:
          languages: go
          config-file: ./.github/codeql-config.yml

      - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4

      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
        with:
          category: "/language:go"

@@ -129,10 +138,10 @@ jobs:

    steps:
      - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Dependency Review
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
        with:
          fail-on-severity: moderate
          allow-ghsas: GHSA-xxxx-xxxx-xxxx  # Add specific allowlisted advisories if needed
@@ -12,14 +12,18 @@ dist/
 #example-upnp

 # Root-level binary executables (exclude built binaries in root)
+/soundtouch-backup
 /soundtouch-cli
 /soundtouch-service
+/soundtouch-web
+/dummy-speaker
 /example-mdns
 /example-upnp
 /example-unified
 /mdns-scanner
 /websocket-demo
 /main
+/screenshots

 # Environment configuration
 .env
@@ -56,6 +60,15 @@ vendor/
 ehthumbs.db
 Thumbs.db

+# Android MITM setup — downloaded/generated artefacts, not committed
+scripts/android/bose.apk
+scripts/android/frida-server
+scripts/android/frida-server.xz
+scripts/android/frida/
+scripts/android/frida-venv/
+scripts/android/captures/
+scripts/android/mitm/
+
 # Temporary files
 *.tmp
 *.temp
@@ -1,5 +1,5 @@
 # Build stage
-FROM --platform=$BUILDPLATFORM golang:1.26.1-alpine AS builder
+FROM --platform=$BUILDPLATFORM golang:1.26.3-alpine AS builder

 # Declare automatic platform ARGs to make them available in build stage
 # See https://docs.docker.com/reference/dockerfile#automatic-platform-args-in-the-global-scope
@@ -24,31 +24,47 @@ RUN if [ "${TARGETARCH}" = "arm" ] && [ -n "${TARGETVARIANT}" ]; then \
      CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /soundtouch-service ./cmd/soundtouch-service; \
    fi

-# Final stage
-FROM alpine:3.23
+# Build the soundtouch-web
+RUN if [ "${TARGETARCH}" = "arm" ] && [ -n "${TARGETVARIANT}" ]; then \
+      CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} GOARM=${TARGETVARIANT#v} go build -o /soundtouch-web ./cmd/soundtouch-web; \
+    else \
+      CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} go build -o /soundtouch-web ./cmd/soundtouch-web; \
+    fi
+
+# soundtouch-service image
+FROM alpine:3.23 AS soundtouch-service

-# Install necessary runtime dependencies
 RUN apk add --no-cache ca-certificates tzdata

 WORKDIR /app

-# Copy the binary from the builder stage
 COPY --from=builder /soundtouch-service /app/soundtouch-service

 # Verify the binary works on the target platform
 RUN /app/soundtouch-service version || echo "Binary verification complete"

-# Create data directory for persistence
 RUN mkdir -p /app/data

-# Set environment variables with defaults
 ENV PORT=8000
 ENV DATA_DIR=/app/data
 ENV LOG_PROXY_BODY=false
 ENV REDACT_PROXY_LOGS=true

-# Expose the service port
 EXPOSE 8000

-# Run the service
 ENTRYPOINT ["/app/soundtouch-service"]
+
+# soundtouch-web image
+FROM alpine:3.23 AS soundtouch-web
+
+RUN apk add --no-cache ca-certificates tzdata
+
+WORKDIR /app
+
+COPY --from=builder /soundtouch-web /app/soundtouch-web
+
+ENV PORT=8080
+
+EXPOSE 8080
+
+ENTRYPOINT ["/app/soundtouch-web"]
@@ -1,4 +1,4 @@
-.PHONY: all build build-cli test test-coverage check fmt vet lint clean dev help
+.PHONY: all build build-cli test test-coverage check fmt vet lint clean dev help screenshots

 # Go parameters
 GOCMD=go
@@ -14,77 +14,109 @@ BINARY_NAME=soundtouch-cli
 BINARY_PATH=./cmd/$(BINARY_NAME)
 SERVICE_NAME=soundtouch-service
 SERVICE_PATH=./cmd/$(SERVICE_NAME)
+WEB_NAME=soundtouch-web
+WEB_PATH=./cmd/$(WEB_NAME)
 EXAMPLE_MDNS_NAME=example-mdns
 EXAMPLE_MDNS_PATH=./cmd/$(EXAMPLE_MDNS_NAME)
 EXAMPLE_UPNP_NAME=example-upnp
 EXAMPLE_UPNP_PATH=./cmd/$(EXAMPLE_UPNP_NAME)
 SCANNER_NAME=mdns-scanner
 SCANNER_PATH=./cmd/$(SCANNER_NAME)
+FAVICON_GEN_NAME=favicon-gen
+FAVICON_GEN_PATH=./cmd/$(FAVICON_GEN_NAME)
+BACKUP_NAME=soundtouch-backup
+BACKUP_PATH=./cmd/$(BACKUP_NAME)
 BUILD_DIR=./build

-# Version info
-# No ldflags needed - using debug.BuildInfo since Go 1.18
+# Build flags: strip debug info/DWARF for smaller binaries, remove local paths for reproducibility
+BUILDFLAGS=-trimpath -ldflags="-s -w"

 all: check build

-build: build-cli build-service build-examples
+build: build-cli build-service build-web build-examples build-favicon-gen build-backup

 build-cli:
 	@echo "Building $(BINARY_NAME)..."
 	@mkdir -p $(BUILD_DIR)
-	$(GOBUILD) -o $(BUILD_DIR)/$(BINARY_NAME) $(BINARY_PATH)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME) $(BINARY_PATH)

 build-service:
 	@echo "Building $(SERVICE_NAME)..."
 	@mkdir -p $(BUILD_DIR)
-	$(GOBUILD) -o $(BUILD_DIR)/$(SERVICE_NAME) $(SERVICE_PATH)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SERVICE_NAME) $(SERVICE_PATH)
+
+build-web:
+	@echo "Building $(WEB_NAME)..."
+	@mkdir -p $(BUILD_DIR)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(WEB_NAME) $(WEB_PATH)

 build-examples:
 	@echo "Building $(EXAMPLE_MDNS_NAME)..."
 	@mkdir -p $(BUILD_DIR)
-	$(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME) $(EXAMPLE_MDNS_PATH)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME) $(EXAMPLE_MDNS_PATH)
 	@echo "Building $(EXAMPLE_UPNP_NAME)..."
-	$(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME) $(EXAMPLE_UPNP_PATH)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME) $(EXAMPLE_UPNP_PATH)
 	@echo "Building $(SCANNER_NAME)..."
-	$(GOBUILD) -o $(BUILD_DIR)/$(SCANNER_NAME) $(SCANNER_PATH)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SCANNER_NAME) $(SCANNER_PATH)

-build-all: build-linux build-darwin build-windows build-examples-all
+build-favicon-gen:
+	@echo "Building $(FAVICON_GEN_NAME)..."
+	@mkdir -p $(BUILD_DIR)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(FAVICON_GEN_NAME) $(FAVICON_GEN_PATH)
+
+build-backup:
+	@echo "Building $(BACKUP_NAME)..."
+	@mkdir -p $(BUILD_DIR)
+	$(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BACKUP_NAME) $(BACKUP_PATH)
+
+build-all: build-linux build-linux-armv7 build-darwin build-windows build-examples-all

 build-linux:
 	@echo "Building for Linux..."
 	@mkdir -p $(BUILD_DIR)
-	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 $(BINARY_PATH)
-	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(SERVICE_NAME)-linux-amd64 $(SERVICE_PATH)
+	GOOS=linux GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-amd64 $(BINARY_PATH)
+	GOOS=linux GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SERVICE_NAME)-linux-amd64 $(SERVICE_PATH)
+	GOOS=linux GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BACKUP_NAME)-linux-amd64 $(BACKUP_PATH)
+
+build-linux-armv7:
+	@echo "Building for Linux ARMv7 (CGO_ENABLED=0 for kernel 3.14+ compatibility)..."
+	@mkdir -p $(BUILD_DIR)
+	GOOS=linux GOARCH=arm GOARM=7 CGO_ENABLED=0 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SERVICE_NAME)-linux-armv7 $(SERVICE_PATH)
+	GOOS=linux GOARCH=arm GOARM=7 CGO_ENABLED=0 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-linux-armv7 $(BINARY_PATH)
+	GOOS=linux GOARCH=arm GOARM=7 CGO_ENABLED=0 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BACKUP_NAME)-linux-armv7 $(BACKUP_PATH)

 build-darwin:
 	@echo "Building for macOS..."
 	@mkdir -p $(BUILD_DIR)
-	GOOS=darwin GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-amd64 $(BINARY_PATH)
-	GOOS=darwin GOARCH=arm64 $(GOBUILD) -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-arm64 $(BINARY_PATH)
-	GOOS=darwin GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(SERVICE_NAME)-darwin-amd64 $(SERVICE_PATH)
-	GOOS=darwin GOARCH=arm64 $(GOBUILD) -o $(BUILD_DIR)/$(SERVICE_NAME)-darwin-arm64 $(SERVICE_PATH)
+	GOOS=darwin GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-amd64 $(BINARY_PATH)
+	GOOS=darwin GOARCH=arm64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-darwin-arm64 $(BINARY_PATH)
+	GOOS=darwin GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SERVICE_NAME)-darwin-amd64 $(SERVICE_PATH)
+	GOOS=darwin GOARCH=arm64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SERVICE_NAME)-darwin-arm64 $(SERVICE_PATH)
+	GOOS=darwin GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BACKUP_NAME)-darwin-amd64 $(BACKUP_PATH)
+	GOOS=darwin GOARCH=arm64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BACKUP_NAME)-darwin-arm64 $(BACKUP_PATH)

 build-windows:
 	@echo "Building for Windows..."
 	@mkdir -p $(BUILD_DIR)
-	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe $(BINARY_PATH)
-	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(SERVICE_NAME)-windows-amd64.exe $(SERVICE_PATH)
+	GOOS=windows GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BINARY_NAME)-windows-amd64.exe $(BINARY_PATH)
+	GOOS=windows GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SERVICE_NAME)-windows-amd64.exe $(SERVICE_PATH)
+	GOOS=windows GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(BACKUP_NAME)-windows-amd64.exe $(BACKUP_PATH)

 build-examples-all:
 	@echo "Building examples for all platforms..."
 	@mkdir -p $(BUILD_DIR)
-	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-linux-amd64 $(EXAMPLE_MDNS_PATH)
-	GOOS=darwin GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-darwin-amd64 $(EXAMPLE_MDNS_PATH)
-	GOOS=darwin GOARCH=arm64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-darwin-arm64 $(EXAMPLE_MDNS_PATH)
-	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-windows-amd64.exe $(EXAMPLE_MDNS_PATH)
-	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-linux-amd64 $(EXAMPLE_UPNP_PATH)
-	GOOS=darwin GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-darwin-amd64 $(EXAMPLE_UPNP_PATH)
-	GOOS=darwin GOARCH=arm64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-darwin-arm64 $(EXAMPLE_UPNP_PATH)
-	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-windows-amd64.exe $(EXAMPLE_UPNP_PATH)
-	GOOS=linux GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(SCANNER_NAME)-linux-amd64 $(SCANNER_PATH)
-	GOOS=darwin GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(SCANNER_NAME)-darwin-amd64 $(SCANNER_PATH)
-	GOOS=darwin GOARCH=arm64 $(GOBUILD) -o $(BUILD_DIR)/$(SCANNER_NAME)-darwin-arm64 $(SCANNER_PATH)
-	GOOS=windows GOARCH=amd64 $(GOBUILD) -o $(BUILD_DIR)/$(SCANNER_NAME)-windows-amd64.exe $(SCANNER_PATH)
+	GOOS=linux GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-linux-amd64 $(EXAMPLE_MDNS_PATH)
+	GOOS=darwin GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-darwin-amd64 $(EXAMPLE_MDNS_PATH)
+	GOOS=darwin GOARCH=arm64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-darwin-arm64 $(EXAMPLE_MDNS_PATH)
+	GOOS=windows GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_MDNS_NAME)-windows-amd64.exe $(EXAMPLE_MDNS_PATH)
+	GOOS=linux GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-linux-amd64 $(EXAMPLE_UPNP_PATH)
+	GOOS=darwin GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-darwin-amd64 $(EXAMPLE_UPNP_PATH)
+	GOOS=darwin GOARCH=arm64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-darwin-arm64 $(EXAMPLE_UPNP_PATH)
+	GOOS=windows GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(EXAMPLE_UPNP_NAME)-windows-amd64.exe $(EXAMPLE_UPNP_PATH)
+	GOOS=linux GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SCANNER_NAME)-linux-amd64 $(SCANNER_PATH)
+	GOOS=darwin GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SCANNER_NAME)-darwin-amd64 $(SCANNER_PATH)
+	GOOS=darwin GOARCH=arm64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SCANNER_NAME)-darwin-arm64 $(SCANNER_PATH)
+	GOOS=windows GOARCH=amd64 $(GOBUILD) $(BUILDFLAGS) -o $(BUILD_DIR)/$(SCANNER_NAME)-windows-amd64.exe $(SCANNER_PATH)

 test:
 	@echo "Running tests..."
@@ -96,7 +128,58 @@ test-coverage:
 	$(GOCMD) tool cover -html=coverage.out -o coverage.html
 	@echo "Coverage report generated: coverage.html"

-check: fmt vet test
+check: fmt vet test test-http-client
+
+test-http-client:
+	@echo "Starting services with docker compose..."
+	@docker compose -f docker-compose.yml -f docker-compose.ci.yml up -d --build
+	@echo "Waiting for services to start..."
+	@sleep 10
+	@echo "Running .http tests..."
+	@docker run --rm --network soundtouch-test-net \
+		-v "$(PWD)/tests/integration/http-client:/workdir" \
+		jetbrains/intellij-http-client:2026.1 \
+		--env-file /workdir/http-client.env.json \
+		--env ci \
+		/workdir/spotify_registration.http \
+		/workdir/amazon_registration.http \
+		/workdir/create_account.http \
+		/workdir/register_device.http \
+		/workdir/spotify_full_flow.http \
+		/workdir/customer_support.http \
+		/workdir/power_on.http \
+		/workdir/get_bmx_services.http \
+		/workdir/get_sourceproviders.http \
+		/workdir/get_software_update.http \
+		/workdir/get_soundtouch_updates.http \
+		/workdir/get_streaming_token.http \
+		/workdir/post_oauth_token.http \
+		/workdir/post_oauth_token_amazon.http \
+		/workdir/get_provider_settings.http \
+		/workdir/tunein_playback_station.http \
+		/workdir/set_preset_6.http \
+		/workdir/get_presets.http \
+		/workdir/delete_preset_6.http \
+		/workdir/set_preset_5.http \
+		/workdir/post_recent.http \
+		/workdir/get_recents.http \
+		/workdir/get_account_presets.http \
+		/workdir/get_account_devices.http \
+		/workdir/get_account_sources.http \
+		/workdir/get_api_versions.http \
+		/workdir/post_musicprovider_is_eligible.http \
+		/workdir/get_full_account.http \
+		/workdir/create_group.http \
+		/workdir/get_group.http \
+		/workdir/rename_device.http \
+		/workdir/unregister_device.http \
+		--report; \
+	EXIT_CODE=$$?; \
+	docker compose -f docker-compose.yml -f docker-compose.ci.yml logs soundtouch-service; \
+	docker compose -f docker-compose.yml -f docker-compose.ci.yml logs spotify-mock; \
+	docker compose -f docker-compose.yml -f docker-compose.ci.yml logs amazon-mock; \
+	docker compose -f docker-compose.yml -f docker-compose.ci.yml down; \
+	exit $$EXIT_CODE

 fmt:
 	@echo "Formatting code..."
@@ -187,10 +270,44 @@ dev-scan-http: build-examples
 	@echo "Scanning for HTTP mDNS services..."
 	$(BUILD_DIR)/$(SCANNER_NAME) -service _http._tcp -v

-install: build-cli build-service
+dev-web: build-web
+	@echo "Starting web UI (default port 8080)..."
+	cd cmd/soundtouch-web && ../../$(BUILD_DIR)/$(WEB_NAME)
+
+dev-web-port: build-web
+	@echo "Starting web UI on custom port..."
+	@if [ -z "$(PORT)" ]; then \
+		echo "Usage: make dev-web-port PORT=8888"; \
+		exit 1; \
+	fi
+	cd cmd/soundtouch-web && ../../$(BUILD_DIR)/$(WEB_NAME) -port $(PORT)
+
+dev-backup: build-backup
+	@echo "Running backup tool..."
+	$(BUILD_DIR)/$(BACKUP_NAME) --help
+
+dev-backup-cloud: build-backup
+	@echo "Running cloud backup..."
+	$(BUILD_DIR)/$(BACKUP_NAME) cloud
+
+dev-backup-local: build-backup
+	@echo "Running local backup (auto-discover)..."
+	$(BUILD_DIR)/$(BACKUP_NAME) local --discover
+
+dev-web-host: build-web
+	@echo "Starting web UI with specific host..."
+	@if [ -z "$(HOST)" ]; then \
+		echo "Usage: make dev-web-host HOST=192.168.1.10"; \
+		exit 1; \
+	fi
+	cd cmd/soundtouch-web && ../../$(BUILD_DIR)/$(WEB_NAME) -host $(HOST)
+
+install: build-cli build-service build-web build-backup
 	@echo "Installing binaries to $(GOPATH)/bin..."
 	cp $(BUILD_DIR)/$(BINARY_NAME) $(GOPATH)/bin/
 	cp $(BUILD_DIR)/$(SERVICE_NAME) $(GOPATH)/bin/
+	cp $(BUILD_DIR)/$(WEB_NAME) $(GOPATH)/bin/
+	cp $(BUILD_DIR)/$(BACKUP_NAME) $(GOPATH)/bin/

 clean:
 	@echo "Cleaning..."
@@ -210,7 +327,7 @@ release: clean check build-all

 docker-build:
 	@echo "Building Docker image..."
-	docker build -t soundtouch-service .
+	docker build --target soundtouch-service -t soundtouch-service .

 docker-run-host:
 	@echo "Running Docker container..."
@@ -221,13 +338,20 @@ docker-run-ports:
 	@echo "Running Docker container with port mapping (discovery will be manual)..."
 	docker run --rm -it -p 8000:8000 -v $$(pwd)/data:/app/data soundtouch-service

+screenshots:
+	@echo "Capturing documentation screenshots..."
+	@bash scripts/screenshots/run.sh
+
 help:
 	@echo "Available targets:"
 	@echo "  build         - Build the CLI tool, service, and examples"
 	@echo "  build-cli     - Build only the CLI tool"
 	@echo "  build-service - Build only the service"
+	@echo "  build-backup  - Build only the backup tool"
+	@echo "  build-favicon-gen - Build the favicon generator"
 	@echo "  build-examples - Build only the example programs"
 	@echo "  build-all     - Build for all platforms"
+	@echo "  build-linux-armv7 - Build for Linux ARMv7 (kernel 3.14+ compatible, CGO_ENABLED=0)"
 	@echo "  test          - Run tests"
 	@echo "  test-coverage - Run tests with coverage report"
 	@echo "  check         - Run fmt, vet, and tests"
@@ -238,6 +362,7 @@ help:
 	@echo "  dev           - Build and show CLI help"
 	@echo "  dev-service   - Build and run service locally"
 	@echo "  dev-service-proxy - Build and run service with proxy (PROXY_URL=url required)"
+	@echo "  screenshots   - Capture documentation screenshots (headless Chrome via chromedp)"
 	@echo "  dev-discover  - Build and run device discovery"
 	@echo "  dev-info      - Build and get device info (HOST=ip required)"
 	@echo "  dev-mdns      - Build and run mDNS discovery example"
@@ -249,6 +374,12 @@ help:
 	@echo "  dev-scan-all     - Scan all mDNS services on network"
 	@echo "  dev-scan-soundtouch - Scan specifically for SoundTouch mDNS services"
 	@echo "  dev-scan-http    - Scan for HTTP mDNS services"
+	@echo "  dev-backup       - Build and show backup tool help"
+	@echo "  dev-backup-cloud - Build and run cloud backup (prompts for credentials)"
+	@echo "  dev-backup-local - Build and run local backup (auto-discover speakers)"
+	@echo "  dev-web          - Build and run web UI (default port 8080)"
+	@echo "  dev-web-port     - Build and run web UI on custom port (PORT=8888)"
+	@echo "  dev-web-host     - Build and run web UI with specific device (HOST=ip)"
 	@echo "  install       - Install binaries to GOPATH/bin"
 	@echo "  clean         - Clean build artifacts"
 	@echo "  release       - Create release binaries"
@@ -270,5 +401,8 @@ help:
 	@echo "  make dev-upnp-timeout TIMEOUT=10s"
 	@echo "  make dev-scan-all"
 	@echo "  make dev-scan-soundtouch"
+	@echo "  make dev-web"
+	@echo "  make dev-web-port PORT=8888"
+	@echo "  make dev-web-host HOST=192.168.1.10"
 	@echo "  make test"
 	@echo "  make build-all"
@@ -1,549 +1,129 @@
 # Bose SoundTouch Toolkit

-A comprehensive solution for controlling and preserving Bose SoundTouch devices, including a Go library, CLI tool, and a local service for cloud emulation.
-
 [![Go Reference](https://pkg.go.dev/badge/github.com/gesellix/bose-soundtouch.svg)](https://pkg.go.dev/github.com/gesellix/bose-soundtouch)
 [![Go Report Card](https://goreportcard.com/badge/github.com/gesellix/bose-soundtouch)](https://goreportcard.com/report/github.com/gesellix/bose-soundtouch)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)

-> **Note**: This is an independent project based on the [official Bose SoundTouch Web API documentation](https://assets.bosecreative.com/m/496577402d128874/original/SoundTouch-Web-API.pdf). Not affiliated with or endorsed by Bose Corporation.
+> Independent project. Not affiliated with or endorsed by Bose Corporation.

-## Features
+## Context: Cloud Shutdown

- ✅ **Complete API Coverage**: All available SoundTouch Web API endpoints implemented
- 🎵 **Media Control**: Play, pause, stop, volume, bass, balance, source selection
- 🔔 **Smart Notifications**: TTS messages, URL audio content, notification beeps (ST-10)
- 🏠 **Multiroom Support**: Create and manage zones across multiple speakers
- ⚡ **Real-time Events**: WebSocket connection for live device state monitoring
- 🔍 **Device Discovery**: Automatic discovery via UPnP/SSDP and mDNS
- 📻 **Content Navigation**: Browse and search TuneIn, Pandora, Spotify, local music
- 📻 **Custom Radio**: Play any stream URL via [flexible proxying](docs/guides/CLI-REFERENCE.md#custom-radio-selection-via-soundtouch-service)
- 📻 **RadioBrowser**: Access thousands of internet radio stations via [radio-browser.info](docs/reference/radio-browser.md)
- 🎙️ **Station Management**: Add and play radio stations without presets
- 🖥️ **CLI Tool**: Comprehensive command-line interface
- 🌐 **SoundTouch Service**: Emulate Bose cloud services for offline device operation
- 🔧 **Service Migration**: Migrate devices to use local services instead of Bose cloud (XML, Hosts, or DNS redirection)
- 🔍 **DNS Discovery & Interception**: Dynamic DNS server for intercepting and logging Bose service queries (requires port 53)
- 📊 **DNS Discovery Analysis**: Track and deduplicate all device DNS queries to discover hidden hostnames
- 📊 **Traffic Analysis**: Proxy and log device communications
- 📝 **HTTP Recording**: Persist interactions as re-playable `.http` files
- 🔄 **Endpoint Mirroring**: Asynchronously mirror local requests to Bose cloud for parity testing
- ⚖️ **Parity Logging**: Detect and record discrepancies between local and official Bose responses
- 🧹 **Session Management**: Manage and cleanup recorded interaction sessions
- 🔒 **Production Ready**: Extensive testing with real SoundTouch hardware
- 🌐 **Cross-Platform**: Windows, macOS, Linux support
+Bose is shutting down SoundTouch cloud services on **May 6, 2026**. After that, music service browsing, preset sync, and the official SoundTouch app stop working. This toolkit lets you keep your speakers fully functional.

-## Quick Start
+See the [Survival Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SURVIVAL-GUIDE.html) for the full picture.

-### Installation
+---
+
+## Tools
+
+### soundtouch-service — AfterTouch
+
+A local server that replaces the Bose cloud ("AfterTouch"). Once your speaker is redirected to it, you have full control without any Bose cloud dependency. The built-in web UI at `http://localhost:8000` handles all setup — no config files needed to get started.
+
+If you want to run a server for this - no problem. The service is small enough to run on the SoundTouch itself. See the [On-Device Installer](./scripts/on-device-install/README.md) for instructions.
+
+**Two scenarios:**
+
+**Before shutdown — migrate your existing setup**
+While the Bose cloud is still running, use `soundtouch-backup` to save your account data. The local service web UI then helps with the migration so your speaker keeps its presets and credentials.
+
+**After shutdown or factory reset — start fresh**
+Create a local account, configure your speakers, and start using them immediately. No Bose infrastructure required.
+
+**Redirecting your speaker**
+
+The service needs a stable address on your local network (e.g. `soundtouch.fritz.box` or `soundtouch.local`). The speaker must then be redirected to resolve the Bose cloud hostnames to that address. Two supported methods:
+
+| Method       | How it works                        | Notes                                                        |
+|--------------|-------------------------------------|--------------------------------------------------------------|
+| XML redirect | Upload a config XML via the Web API | Surgical; covers only registered endpoints; best for testing |
+| DNS/DHCP     | Serve custom DNS on your network    | Covers all devices at once; requires port 53 and TLS         |
+
+The web UI walks you through each method. DNS redirect requires HTTPS — the service manages its own CA certificate and the web UI guides you through trusting it on each speaker.
+
+> **Note:** A hosts-file method (direct SSH edits to `/etc/hosts`) also exists in the codebase but is deprecated and not exposed in the web UI.
+
+**Enabling SSH via USB stick**
+
+Some setup steps require SSH access to the speaker. Enable it once per device: create a file named `remote_services` on a FAT-formatted USB drive (the drive may need its bootable flag set — see [SoundCork issue #172](https://github.com/deborahgu/soundcork/issues/172)), and insert it while the speaker is powered on. After reboot, root SSH is available with no password.
+
+See [Device Initial Setup](https://gesellix.github.io/Bose-SoundTouch/guides/DEVICE-INITIAL-SETUP.html) and [Migration Guide](https://gesellix.github.io/Bose-SoundTouch/guides/MIGRATION-GUIDE.html) for step-by-step instructions.
+
+---
+
+### soundtouch-backup
+
+Backs up your Bose cloud account (presets, paired devices, music sources) and each speaker's local state before the shutdown. Run `soundtouch-backup all` to capture everything in one step; it authenticates with the Bose cloud, then polls each paired speaker over the local network.
+
+See the [soundtouch-backup README](cmd/soundtouch-backup/README.md) for usage.
+
+---
+
+### soundtouch-cli
+
+Command-line control of any SoundTouch device: play/pause/volume, presets, source selection, multiroom zones, device discovery, and more. Works entirely over the local network — no cloud dependency. Well-suited for scripting and home automation.
+
+See the [CLI Reference](https://gesellix.github.io/Bose-SoundTouch/guides/CLI-REFERENCE.html) for full usage.
+
+---
+
+### soundtouch-web
+
+A standalone web UI for device control — play, pause, volume, preset selection, real-time status — served from a local Go binary. Complements `soundtouch-service` when you want a dedicated device-control interface separate from the setup/admin UI.
+
+See the [soundtouch-web README](cmd/soundtouch-web/README.md) for usage.
+
+---
+
+### Go library
+
+`pkg/client` provides a Go API for all SoundTouch device endpoints: media control, volume, presets, sources, zones, real-time WebSocket events, and device discovery. Use it to build your own integrations.

-#### Install CLI and Service Tools
-```bash
-go install github.com/gesellix/bose-soundtouch/cmd/soundtouch-cli@latest
-go install github.com/gesellix/bose-soundtouch/cmd/soundtouch-service@latest
 ```
-
-#### Add Library to Your Project
-```bash
 go get github.com/gesellix/bose-soundtouch
 ```

-### CLI Usage
+See the [API Reference](https://gesellix.github.io/Bose-SoundTouch/reference/API-ENDPOINTS.html) and [pkg.go.dev](https://pkg.go.dev/github.com/gesellix/bose-soundtouch) for documentation.

-Find SoundTouch devices on your network:
-```bash
-soundtouch-cli discover devices
-```
-
-Control a device (replace `192.168.1.100` with your speaker's IP):
-```bash
-# Basic information
-soundtouch-cli --host 192.168.1.100 info
-
-# Media controls
-soundtouch-cli --host 192.168.1.100 play start
-soundtouch-cli --host 192.168.1.100 volume set --level 50
-
-# Preset management
-soundtouch-cli --host 192.168.1.100 preset list
-```
-
-For full CLI documentation, see the [CLI Reference](https://gesellix.github.io/Bose-SoundTouch/guides/CLI-REFERENCE.html).
-
-### SoundTouch Service (Cloud Shutdown Protection)
-
-The `soundtouch-service` is a local server that emulates Bose's cloud services. This is critical for keeping your speakers functional after the **Bose Cloud Shutdown in May 2026**.
-
-#### Key Features:
- **🏠 Local Emulation**: BMX and Marge service implementation
- **🔌 Easy Setup**: Activate SSH via USB stick (`remote_services` file)
- **🔧 Device Migration**: Seamlessly transition devices to local control
- **🌐 Web Management UI**: Easy browser-based setup and management
- **💾 Persistent Data**: Store presets, recents, and sources locally
- **🔄 Endpoint Mirroring**: Asynchronously mirror local requests to Bose cloud for parity testing
- **⚖️ Parity Logging**: Detect and record discrepancies between local and official Bose responses
- **📝 HTTP Recording**: Persist all interactions as re-playable `.http` files
- **🧹 Session Management**: Manage and cleanup recorded interaction sessions
-
-#### Quick Start:
-```bash
-# Start the service
-soundtouch-service
-```
-Open `http://localhost:8000` in your browser to manage your devices. Documentation is also available directly through the web interface.
-
-For a comprehensive guide on transitioning your system, see the [Bose Cloud Shutdown: Survival Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SURVIVAL-GUIDE.html).
-
-Detailed service configuration and Docker instructions can be found in [SoundTouch Service Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SOUNDTOUCH-SERVICE.html).
-
-For professional migration tips and safety measures, see the [Migration & Safety Guide](https://gesellix.github.io/Bose-SoundTouch/guides/MIGRATION-SAFETY.html).
-
-### Library Usage
-
-#### Basic Control
-```go
-package main
-
-import (
-    "fmt"
-    "log"
-
-    "github.com/gesellix/bose-soundtouch/pkg/client"
-)
-
-func main() {
-    // Connect to your SoundTouch device
-    c := client.NewClient(&client.Config{
-        Host: "192.168.1.100",
-        Port: 8090,
-    })
-
-    // Get device information
-    info, err := c.GetDeviceInfo()
-    if err != nil {
-        log.Fatal(err)
-    }
-    fmt.Printf("Device: %s\n", info.Name)
-
-    // Control playback
-    err = c.Play()
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Set volume
-    err = c.SetVolume(50)
-    if err != nil {
-        log.Fatal(err)
-    }
-}
-```
-
-#### Device Discovery
-```go
-package main
-
-import (
-    "context"
-    "fmt"
-    "log"
-    "time"
-
-    "github.com/gesellix/bose-soundtouch/pkg/discovery"
-)
-
-func main() {
-    // Discover SoundTouch devices
-    service := discovery.NewService(5 * time.Second)
-    devices, err := service.DiscoverDevices(context.Background())
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    for _, device := range devices {
-        fmt.Printf("Found: %s at %s:%d\n",
-            device.Name, device.Host, device.Port)
-    }
-}
-```
-
-#### Real-time Events
-```go
-package main
-
-import (
-    "context"
-    "fmt"
-    "log"
-
-    "github.com/gesellix/bose-soundtouch/pkg/client"
-    "github.com/gesellix/bose-soundtouch/pkg/models"
-)
-
-func main() {
-    c := client.NewClient(&client.Config{
-        Host: "192.168.1.100",
-        Port: 8090,
-    })
-
-    // Subscribe to device events
-    events, err := c.SubscribeToEvents(context.Background())
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    for event := range events {
-        switch e := event.(type) {
-        case *models.NowPlayingUpdated:
-            fmt.Printf("Now playing: %s by %s\n", e.Track, e.Artist)
-        case *models.VolumeUpdated:
-            fmt.Printf("Volume changed to: %d\n", e.ActualVolume)
-        case *models.ConnectionStateUpdated:
-            fmt.Printf("Connection state: %s\n", e.State)
-        }
-    }
-}
-```
-
-#### Preset Management
-```go
-package main
-
-import (
-    "fmt"
-    "log"
-
-    "github.com/gesellix/bose-soundtouch/pkg/client"
-    "github.com/gesellix/bose-soundtouch/pkg/models"
-)
-
-func main() {
-    c := client.NewClient(&client.Config{
-        Host: "192.168.1.100",
-        Port: 8090,
-    })
-
-    // Get current presets
-    presets, err := c.GetPresets()
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    fmt.Printf("Found %d presets\n", len(presets.Preset))
-
-    // Store currently playing content as preset 1
-    err = c.StoreCurrentAsPreset(1)
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Store Spotify playlist as preset 2
-    spotifyContent := &models.ContentItem{
-        Source:        "SPOTIFY",
-        Type:          "uri",
-        Location:      "spotify:playlist:37i9dQZF1DXcBWIGoYBM5M",
-        SourceAccount: "your_username",
-        IsPresetable:  true,
-        ItemName:      "Today's Top Hits",
-    }
-    err = c.StorePreset(2, spotifyContent)
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Store radio station as preset 3
-    radioContent := &models.ContentItem{
-        Source:       "TUNEIN",
-        Type:         "stationurl",
-        Location:     "/v1/playbook/station/s33828",
-        IsPresetable: true,
-        ItemName:     "K-LOVE Radio",
-    }
-    err = c.StorePreset(3, radioContent)
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Select preset 1
-    err = c.SelectPreset(1)
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    fmt.Println("Preset management complete!")
-}
-```
-
-#### Multiroom Zones
-```go
-package main
-
-import (
-    "log"
-
-    "github.com/gesellix/bose-soundtouch/pkg/client"
-    "github.com/gesellix/bose-soundtouch/pkg/models"
-)
-
-func main() {
-    master := client.NewClient(&client.Config{
-        Host: "192.168.1.100", // Master speaker
-        Port: 8090,
-    })
-
-    // Create a multiroom zone
-    zone := &models.Zone{
-        Master: "192.168.1.100",
-        Members: []models.ZoneMember{
-            {IPAddress: "192.168.1.101"}, // Living room
-            {IPAddress: "192.168.1.102"}, // Kitchen
-        },
-    }
-
-    err := master.SetZone(zone)
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    fmt.Println("Multiroom zone created!")
-}
-```
-
-#### Speaker Notifications (ST-10 only)
-```go
-package main
-
-import (
-    "log"
-
-    "github.com/gesellix/bose-soundtouch/pkg/client"
-)
-
-func main() {
-    c := client.NewClient(&client.Config{
-        Host: "192.168.1.100",
-        Port: 8090,
-    })
-
-    // Play Text-to-Speech message (language code "EN", "DE", etc.)
-    err := c.PlayTTS("Welcome home!", "your-app-key", "EN", 70)
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Play audio content from URL
-    err = c.PlayURL(
-        "https://example.com/doorbell.mp3",
-        "your-app-key",
-        "Doorbell",
-        "Front Door",
-        "Visitor Alert",
-        80,
-    )
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    // Play notification beep
-    err = c.PlayNotificationBeep()
-    if err != nil {
-        log.Fatal(err)
-    }
-
-    fmt.Println("Notifications sent!")
-}
-```
-
-## Supported Devices
-
-This library supports all Bose SoundTouch-compatible devices, including:
-
- SoundTouch 10, 20, 30 series
- SoundTouch Portable
- Wave SoundTouch music system
- SoundTouch-enabled Bose speakers
-
-**Tested Hardware**:
- ✅ SoundTouch 10
- ✅ SoundTouch 20
-
-## API Coverage
-
-| Feature | Status | Description |
-|---------|--------|-------------|
-| Device Info | ✅ Complete | Device details, name, capabilities |
-| Media Control | ✅ Complete | Play/pause/stop, track navigation |
-| Volume & Audio | ✅ Complete | Volume, bass, balance control |
-| Source Selection | ✅ Complete | Spotify, Bluetooth, AUX, etc. |
-| Content Navigation | ✅ Complete | Browse music libraries, radio stations |
-| Station Management | ✅ Complete | Search, add, remove stations |
-| Preset Management | ✅ Complete | Store, select, remove presets |
-| Real-time Events | ✅ Complete | WebSocket event streaming |
-| Multiroom Zones | ✅ Complete | Zone creation and management |
-| Speaker Notifications | ✅ Complete | TTS, URL audio, beep alerts (ST-10) |
-| System Settings | ✅ Complete | Clock, display, network info |
-| Advanced Audio | ✅ Complete | DSP controls, tone controls |
-
-**API Limitations**: None - all documented SoundTouch Web API functionality is implemented, including endpoints discovered via the comprehensive [SoundTouch Plus Wiki](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API).
+---

 ## Documentation

- 📖 [Contributing Guide](CONTRIBUTING.md) - How to contribute to the project
- - 📚 [API Reference](https://gesellix.github.io/Bose-SoundTouch/reference/API-ENDPOINTS.html) - Complete endpoint documentation
- 🔧 [CLI Reference](https://gesellix.github.io/Bose-SoundTouch/guides/CLI-REFERENCE.html) - Command-line tool guide
- 🌐 [SoundTouch Service Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SOUNDTOUCH-SERVICE.html) - Local service setup and migration
- 🎯 [Getting Started](https://gesellix.github.io/Bose-SoundTouch/guides/GETTING-STARTED.html) - Detailed setup and usage
- 📻 [Preset Quick Start](https://gesellix.github.io/Bose-SoundTouch/PRESET-QUICKSTART.md) - Favorite content management
- 🧭 [Navigation Guide](https://gesellix.github.io/Bose-SoundTouch/NAVIGATION-GUIDE.md) - Content browsing and station management
- 📋 [Navigation API Reference](https://gesellix.github.io/Bose-SoundTouch/API-NAVIGATION-REFERENCE.md) - Navigation API documentation
- ⚙️ [Advanced Features](https://gesellix.github.io/Bose-SoundTouch/reference/SYSTEM-ENDPOINTS.html) - Advanced functionality
- 🏠 [Multiroom Setup](https://gesellix.github.io/Bose-SoundTouch/reference/ZONE-MANAGEMENT.html) - Zone configuration guide
- ⚡ [WebSocket Events](https://gesellix.github.io/Bose-SoundTouch/reference/WEBSOCKET-EVENTS.html) - Real-time event handling
- 🔔 [Speaker Notifications](https://gesellix.github.io/Bose-SoundTouch/reference/SPEAKER-ENDPOINT.html) - TTS and audio notifications guide
- 🔍 [Device Discovery](https://gesellix.github.io/Bose-SoundTouch/reference/DISCOVERY.html) - Discovery configuration
- 🛠️ [Troubleshooting](https://gesellix.github.io/Bose-SoundTouch/guides/TROUBLESHOOTING.html) - Common issues and solutions
+- [Getting Started](https://gesellix.github.io/Bose-SoundTouch/guides/GETTING-STARTED.html)
+- [Survival Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SURVIVAL-GUIDE.html)
+- [Migration Guide](https://gesellix.github.io/Bose-SoundTouch/guides/MIGRATION-GUIDE.html)
+- [Device Initial Setup](https://gesellix.github.io/Bose-SoundTouch/guides/DEVICE-INITIAL-SETUP.html)
+- [Migration & Safety Guide](https://gesellix.github.io/Bose-SoundTouch/guides/MIGRATION-SAFETY.html)
+- [CLI Reference](https://gesellix.github.io/Bose-SoundTouch/guides/CLI-REFERENCE.html)
+- [SoundTouch Service Guide](https://gesellix.github.io/Bose-SoundTouch/guides/SOUNDTOUCH-SERVICE.html)
+- [HTTPS & CA Setup](https://gesellix.github.io/Bose-SoundTouch/guides/HTTPS-SETUP.html)
+- [API Reference](https://gesellix.github.io/Bose-SoundTouch/reference/API-ENDPOINTS.html)

-## Development
+---

-### Prerequisites
- Go 1.25.6 or later
- Optional: SoundTouch device for testing
+## Related projects

-### Building from Source
-```bash
-# Clone the repository
-git clone https://github.com/gesellix/bose-soundtouch.git
-cd Bose-SoundTouch
+- **[SoundCork](https://github.com/deborahgu/soundcork)** (Deborah Kaplan et al.) — Python service interception; pioneered the cloud emulation approach this project builds on
+- **[SoundCork Stockholm App](https://github.com/krahl/soundcork-stockholm-app)** — Companion app for SoundCork
+- **[SoundTouch Plus](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus)** (Todd Lucas) — Home Assistant integration; extensive undocumented API documentation
+- **[ÜberBöse API](https://github.com/julius-d/ueberboese-api)** (Julius) — API research and advanced endpoint discovery
+- **[Bose SoundTouch Hook](https://github.com/CodeFinder2/bose-soundtouch-hook)** (Adrian Böckenkamp) — `LD_PRELOAD` hooking for reverse engineering device internals

-# Install dependencies
-go mod download
-
-# Build CLI tool
-make build
-
-# Run tests
-make test
-
-# Install CLI locally
-go install ./cmd/soundtouch-cli
-```
-
-### Contributing
-
-We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) for details on:
-
- Setting up your development environment
- Coding guidelines and best practices
- Testing with real devices
- Submitting pull requests
-
-## Examples
-
-Check out the [examples/](examples/) directory for more usage patterns:
-
- **Basic HTTP Client**: Simple device control
- **Preset Management**: Store and manage favorite content
- **Navigation & Stations**: Browse content and manage radio stations
- **WebSocket Events**: Real-time monitoring
- **Device Discovery**: Finding devices on your network
- **Multiroom Management**: Zone operations
- **Advanced Audio**: DSP and tone controls
-
-## License
-
-This project is licensed under the MIT License - see the [LICENSE](LICENSE) file for details.
-
-## Disclaimer
-
-This is an independent project based on the official Bose SoundTouch Web API documentation provided by Bose Corporation. It is not affiliated with, endorsed by, or supported by Bose Corporation. Use at your own risk.
-
-SoundTouch is a trademark of Bose Corporation.
-
-## SoundTouch End of Life Notice
-
-**Important:** Bose has announced that [SoundTouch cloud support will end on May 6, 2026](https://www.bose.com/soundtouch-end-of-life).
-
-**What will continue to work:**
- ✅ Local API control (this library's primary functionality)
- ✅ Bluetooth, AirPlay, Spotify Connect, and AUX streaming
- ✅ Remote control features (Play, Pause, Skip, Volume)
- ✅ Multiroom grouping
-
-**What will stop working:**
- ❌ Cloud-based preset sync between devices and SoundTouch app
- ❌ Browsing music services directly from the SoundTouch app
- ❌ Cloud-based features and updates
-
-**What continues to work:**
- ✅ Local preset management via this API client (store, select, remove)
- ✅ Direct content playback (stations, playlists, etc.)
-
-This Go library will continue to work as it uses the local Web API for direct device control, which is unaffected by the cloud service discontinuation. The local preset management functionality implemented in this library (discovered through the [SoundTouch Plus Wiki](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API)) provides an alternative to the cloud-based preset features that will be discontinued.
-
-**Community Alternatives**: See the [Related Projects](#related-projects) section below for additional tools like SoundCork that provide cloud service alternatives and the SoundTouch Plus project that offers comprehensive Home Assistant integration.
-
-## Related Projects & Credits
-
-This project builds upon the excellent work of several community projects:
-
-### SoundCork 🍾
- **Project**: [SoundCork - SoundTouch API Intercept](https://github.com/deborahgu/soundcork)
- **Authors**: Deborah Kaplan and contributors
- **Our Implementation**: The `soundtouch-service` in this project is heavily inspired by SoundCork's Python implementation. SoundCork pioneered the approach of intercepting and emulating Bose's cloud services, providing the foundation for offline SoundTouch operation.
- **Key Contributions**: Service emulation architecture, BMX/Marge endpoint discovery, device migration strategies
- **License**: MIT License
-
-### ÜberBöse API 🎵
- **Project**: [ÜberBöse API](https://github.com/julius-d/ueberboese-api)
- **Author**: Julius
- **Our Implementation**: This project provided valuable insights into advanced SoundTouch API endpoints and helped make our implementation more complete, particularly for content navigation and advanced device features.
- **Key Contributions**: Extended API endpoint documentation, advanced feature discovery
- **License**: MIT License
-
-### SoundTouch Plus 🏠
- **Project**: [SoundTouch Plus Home Assistant Component](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus)
- **Wiki**: [SoundTouch WebServices API Documentation](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus/wiki/SoundTouch-WebServices-API)
- **Author**: Todd Lucas
- **Our Implementation**: The comprehensive API documentation in the SoundTouch Plus Wiki provided invaluable insights into undocumented endpoints beyond the official API, enabling our preset management and content navigation features.
- **Key Contributions**: Extensive API endpoint documentation, real-world usage patterns
- **License**: MIT License
-
-### SoundTouch Hook 🪝
- **Project**: [Bose SoundTouch Hook](https://github.com/CodeFinder2/bose-soundtouch-hook)
- **Author**: Adrian Böckenkamp
- **Our Implementation**: This project provides a powerful framework for intercepting and hooking into internal device processes using `LD_PRELOAD`. It was instrumental in verifying internal function calls and understanding how the device validates cloud domains.
- **Key Contributions**: Reverse engineering framework, process hooking, cross-compilation toolchain
- **License**: GPL-3.0 License
-
-### Community Ecosystem
-
-These projects together form a comprehensive ecosystem for SoundTouch device management:
-
- **This Project**: Go library + CLI + service for programmatic control and offline operation
- **SoundCork**: Python-based service interception and cloud replacement
- **SoundTouch Plus**: Home Assistant integration with extensive device support
- **ÜberBöse**: API research and advanced endpoint discovery
- **SoundTouch Hook**: Advanced reverse engineering and process instrumentation
-
-We are grateful to these projects and their maintainers for paving the way and providing the foundation that made this comprehensive Go implementation possible. The SoundTouch community's collaborative approach to reverse engineering and documentation has been invaluable.
-
-### Contributing Back
-
-If you discover new endpoints, features, or improvements through this library, please consider contributing back to these projects as well. The stronger our community ecosystem becomes, the better we can support SoundTouch devices beyond Bose's official support timeline.
+---

 ## Support

- 🐛 **Bug Reports**: [Create an issue](https://github.com/gesellix/bose-soundtouch/issues/new)
- 💡 **Feature Requests**: [Start a discussion](https://github.com/gesellix/bose-soundtouch/discussions)
- ❓ **Questions**: Check [existing discussions](https://github.com/gesellix/bose-soundtouch/discussions)
- 📖 **Documentation**: [Online Documentation](https://gesellix.github.io/Bose-SoundTouch/)
- 🔍 **New Discoveries**: [Undocumented Community Features](https://gesellix.github.io/Bose-SoundTouch/UNDOCUMENTED-COMMUNITY-FEATURES.md)
- 🌐 **Upstream Analysis**: [Upstream URLs & Domains](https://gesellix.github.io/Bose-SoundTouch/analysis/UPSTREAM-URLS.html)
- 🔧 **Redirection Guide**: [Device Redirect Methods](https://gesellix.github.io/Bose-SoundTouch/analysis/DEVICE-REDIRECT-METHODS.html)
- 🐣 **Initial Setup**: [Device Initial Setup Variants](https://gesellix.github.io/Bose-SoundTouch/guides/DEVICE-INITIAL-SETUP.html)
- 📜 **Logging & Debugging**: [Device Logging Guide](https://gesellix.github.io/Bose-SoundTouch/DEVICE-LOGGING.md)
- 🔒 **HTTPS & CA Setup**: [HTTPS & Custom CA Guide](https://gesellix.github.io/Bose-SoundTouch/guides/HTTPS-SETUP.html)
+- Bug reports: [GitHub Issues](https://github.com/gesellix/bose-soundtouch/issues/new)
+- Questions & discussions: [GitHub Discussions](https://github.com/gesellix/bose-soundtouch/discussions)

 ---

 **Star this project** ⭐ if you find it useful!
+
+---
+
+## License
+
+MIT — see [LICENSE](LICENSE).
+
+SoundTouch is a trademark of Bose Corporation.
@@ -0,0 +1,107 @@
+// Command dummy-speaker runs an HTTP-only fake SoundTouch speaker and
+// optionally registers it with a running soundtouch-service so the web UI
+// has a device to display.
+//
+// Intended for documentation screenshots and local UI smoke checks. Do not
+// use against a real network — the fixture payload is synthetic and would
+// confuse other tooling that expects live device data.
+//
+// Example:
+//
+//	dummy-speaker --port 8090 --register http://localhost:8000
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/pkg/service/testing/fakespeaker"
+)
+
+func main() {
+	listen := flag.String("listen", "127.0.0.1:8090", "bind address for the fake speaker's HTTP API")
+	telnetListen := flag.String("telnet-listen", "127.0.0.1:17000", "bind address for the fake speaker's telnet diagnostic shell (empty to disable)")
+	register := flag.String("register", "", "service base URL (e.g. http://localhost:8000) to self-register with via POST /setup/devices")
+	registerAs := flag.String("register-as", "", "address to send to /setup/devices (defaults to --listen)")
+
+	flag.Parse()
+
+	s, err := fakespeaker.Start(fakespeaker.Config{
+		HTTPListen:   *listen,
+		TelnetListen: *telnetListen,
+	})
+	if err != nil {
+		log.Fatalf("start fake speaker: %v", err)
+	}
+
+	log.Printf("fake speaker HTTP listening on http://%s", s.HTTPAddr())
+
+	if addr := s.TelnetAddr(); addr != "" {
+		log.Printf("fake speaker telnet listening on tcp://%s", addr)
+	}
+
+	if *register != "" {
+		target := *registerAs
+		if target == "" {
+			target = s.HTTPAddr()
+		}
+
+		if err := registerWithService(*register, target); err != nil {
+			log.Printf("self-register failed: %v (continuing anyway)", err)
+		} else {
+			log.Printf("registered %s with service at %s", target, *register)
+		}
+	}
+
+	sig := make(chan os.Signal, 1)
+	signal.Notify(sig, syscall.SIGINT, syscall.SIGTERM)
+	<-sig
+
+	log.Printf("shutting down")
+
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+
+	if err := s.Stop(ctx); err != nil {
+		log.Printf("stop: %v", err)
+	}
+}
+
+func registerWithService(serviceURL, deviceAddr string) error {
+	body, err := json.Marshal(map[string]string{"ip": deviceAddr})
+	if err != nil {
+		return err
+	}
+
+	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+	defer cancel()
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, serviceURL+"/setup/devices", bytes.NewReader(body))
+	if err != nil {
+		return err
+	}
+
+	req.Header.Set("Content-Type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		return err
+	}
+
+	defer func() { _ = resp.Body.Close() }()
+
+	if resp.StatusCode >= 300 {
+		return fmt.Errorf("service responded %s", resp.Status)
+	}
+
+	return nil
+}
@@ -0,0 +1,152 @@
+// Package main provides a utility to generate PNG and ICO favicons from SVG source files.
+package main
+
+import (
+	"bufio"
+	"bytes"
+	"encoding/binary"
+	"fmt"
+	"image"
+	"image/png"
+	"log"
+	"os"
+	"path/filepath"
+
+	"github.com/srwiley/oksvg"
+	"github.com/srwiley/rasterx"
+)
+
+func main() {
+	mediaDir := "pkg/service/handlers/web/img"
+	files := []string{"favicon-braille", "favicon-morse"}
+
+	for _, name := range files {
+		svgPath := filepath.Join(mediaDir, name+".svg")
+		pngPath := filepath.Join(mediaDir, name+".png")
+		icoPath := filepath.Join(mediaDir, name+".ico")
+
+		fmt.Printf("Processing %s...\n", name)
+
+		// 1. Render SVG to PNG
+		img, err := renderSVG(svgPath, 32, 32)
+		if err != nil {
+			log.Fatalf("Failed to render %s: %v", svgPath, err)
+		}
+
+		f, err := os.Create(pngPath)
+		if err != nil {
+			log.Fatalf("Failed to create %s: %v", pngPath, err)
+		}
+
+		if err := png.Encode(f, img); err != nil {
+			f.Close()
+			log.Fatalf("Failed to encode PNG %s: %v", pngPath, err)
+		}
+
+		f.Close()
+		fmt.Printf("Created %s\n", pngPath)
+
+		// 2. Create ICO (containing multiple sizes)
+		sizes := []int{16, 32, 48}
+
+		var images []image.Image
+
+		for _, s := range sizes {
+			m, err := renderSVG(svgPath, s, s)
+			if err != nil {
+				log.Fatalf("Failed to render %s at size %d: %v", svgPath, s, err)
+			}
+
+			images = append(images, m)
+		}
+
+		if err := writeICO(icoPath, images); err != nil {
+			log.Fatalf("Failed to write ICO %s: %v", icoPath, err)
+		}
+
+		fmt.Printf("Created %s\n", icoPath)
+	}
+}
+
+func renderSVG(path string, w, h int) (image.Image, error) {
+	in, err := os.Open(path)
+	if err != nil {
+		return nil, err
+	}
+	defer in.Close()
+
+	icon, err := oksvg.ReadIconStream(in)
+	if err != nil {
+		return nil, err
+	}
+
+	icon.SetTarget(0, 0, float64(w), float64(h))
+	rgba := image.NewRGBA(image.Rect(0, 0, w, h))
+	gv := rasterx.NewScannerGV(w, h, rgba, rgba.Bounds())
+	dasher := rasterx.NewDasher(w, h, gv)
+	icon.Draw(dasher, 1.0)
+
+	return rgba, nil
+}
+
+// Simple ICO encoder that wraps PNGs
+func writeICO(path string, images []image.Image) error {
+	f, err := os.Create(path)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	bw := bufio.NewWriter(f)
+	defer bw.Flush()
+
+	// ICONDIR header
+	// Reserved (2), Type (2), Count (2)
+	binary.Write(bw, binary.LittleEndian, uint16(0))
+	binary.Write(bw, binary.LittleEndian, uint16(1)) // 1 = ICO
+	binary.Write(bw, binary.LittleEndian, uint16(len(images)))
+
+	var pngData [][]byte
+
+	for _, img := range images {
+		var buf bytes.Buffer
+		if err := png.Encode(&buf, img); err != nil {
+			return err
+		}
+
+		pngData = append(pngData, buf.Bytes())
+	}
+
+	offset := uint32(6 + len(images)*16)
+	for i, img := range images {
+		b := img.Bounds()
+
+		width := uint8(b.Dx())
+		if b.Dx() >= 256 {
+			width = 0
+		}
+
+		height := uint8(b.Dy())
+		if b.Dy() >= 256 {
+			height = 0
+		}
+
+		// ICONDIRENTRY
+		bw.WriteByte(width)
+		bw.WriteByte(height)
+		bw.WriteByte(0)                                   // Color count
+		bw.WriteByte(0)                                   // Reserved
+		binary.Write(bw, binary.LittleEndian, uint16(1))  // Planes (1)
+		binary.Write(bw, binary.LittleEndian, uint16(32)) // Bits per pixel (32)
+		binary.Write(bw, binary.LittleEndian, uint32(len(pngData[i])))
+		binary.Write(bw, binary.LittleEndian, offset)
+
+		offset += uint32(len(pngData[i]))
+	}
+
+	for _, data := range pngData {
+		bw.Write(data)
+	}
+
+	return nil
+}
@@ -0,0 +1,23 @@
+// Package main provides a mock Amazon LWA server for testing purposes.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/gesellix/bose-soundtouch/pkg/testutils/amazon"
+)
+
+func main() {
+	port := flag.Int("port", 8080, "Port to listen on")
+
+	flag.Parse()
+
+	log.Printf("Starting mock Amazon LWA server on port %d", *port)
+
+	if err := http.ListenAndServe(fmt.Sprintf(":%d", *port), amazon.NewAmazonHandler()); err != nil {
+		log.Fatal(err)
+	}
+}
@@ -0,0 +1,23 @@
+// Package main provides a mock Spotify server for testing purposes.
+package main
+
+import (
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+
+	"github.com/gesellix/bose-soundtouch/pkg/testutils/spotify"
+)
+
+func main() {
+	port := flag.Int("port", 8080, "Port to listen on")
+
+	flag.Parse()
+
+	log.Printf("Starting mock Spotify server on port %d", *port)
+
+	if err := http.ListenAndServe(fmt.Sprintf(":%d", *port), spotify.NewSpotifyHandler()); err != nil {
+		log.Fatal(err)
+	}
+}
@@ -0,0 +1,212 @@
+# soundtouch-backup
+
+A standalone tool for backing up Bose SoundTouch data — both your **cloud account** (presets, devices, sources) and the **local filesystem** of each speaker — before the Bose cloud services shut down on May 6, 2026.
+
+## Overview
+
+| Subcommand | What it backs up                                                                                   |
+|------------|----------------------------------------------------------------------------------------------------|
+| `all`      | Cloud account **and** all paired speakers in one step — the recommended starting point             |
+| `cloud`    | Bose account profile, paired devices, cloud presets, music service sources                         |
+| `local`    | Speaker HTTP API data (presets, sources, volume, …) and optionally device filesystem files via SSH |
+
+Output is a single `.tar.gz` archive (or `.zip`) with a dated root directory.
+
+## Building
+
+```bash
+make build-backup
+# binary: ./build/soundtouch-backup
+```
+
+Or install alongside the other tools:
+
+```bash
+make install
+```
+
+## Usage
+
+### Combined backup (recommended)
+
+The `all` command is the simplest way to capture everything: it authenticates with the Bose cloud, backs up your account data, then reads the IP addresses from `devices.xml` and backs up each reachable speaker over HTTP.
+
+```bash
+# Interactive — prompts for email and password
+soundtouch-backup all
+
+# Non-interactive
+soundtouch-backup all --email you@example.com --password secret
+
+# Include SSH filesystem backup for each speaker
+soundtouch-backup all --ssh
+
+# Environment variables
+BOSE_EMAIL=you@example.com BOSE_PASSWORD=secret soundtouch-backup all --ssh
+```
+
+**Flags**
+
+| Flag         | Short  | Default                               | Description                                            |
+|--------------|--------|---------------------------------------|--------------------------------------------------------|
+| `--email`    | `-e`   | —                                     | Bose account email (`$BOSE_EMAIL`)                     |
+| `--password` | `--pw` | —                                     | Bose account password (`$BOSE_PASSWORD`)               |
+| `--ssh`      |        | on                                    | Also capture filesystem files via SSH for each speaker |
+| `--output`   | `-o`   | `soundtouch-backup-YYYY-MM-DD.tar.gz` | Output archive path                                    |
+| `--format`   |        | `tar.gz`                              | Archive format: `tar.gz` or `zip`                      |
+
+Speakers that are offline or unreachable at the time of backup are skipped with a `✗` warning; the cloud data is still saved.
+
+---
+
+### Cloud backup
+
+Backs up data from your Bose account at `streaming.bose.com`. Credentials are prompted interactively if not supplied as flags.
+
+```bash
+# Interactive — prompts for email, masked password input
+soundtouch-backup cloud
+
+# Non-interactive
+soundtouch-backup cloud --email you@example.com --password secret
+
+# Environment variables (avoids secrets in shell history)
+BOSE_EMAIL=you@example.com BOSE_PASSWORD=secret soundtouch-backup cloud
+
+# Zip output
+soundtouch-backup cloud --format zip --output my-bose-cloud.zip
+```
+
+**Flags**
+
+| Flag         | Short  | Default                               | Description                                       |
+|--------------|--------|---------------------------------------|---------------------------------------------------|
+| `--email`    | `-e`   | —                                     | Bose account email (`$BOSE_EMAIL`)                |
+| `--password` | `--pw` | —                                     | Bose account password (`$BOSE_PASSWORD`)          |
+| `--output`   | `-o`   | `soundtouch-backup-YYYY-MM-DD.tar.gz` | Output archive path (`$SOUNDTOUCH_BACKUP_OUTPUT`) |
+| `--format`   |        | `tar.gz`                              | Archive format: `tar.gz` or `zip`                 |
+
+**What gets fetched**
+
+| File in archive          | Source endpoint                                                                 |
+|--------------------------|---------------------------------------------------------------------------------|
+| `cloud/emailaddress.xml` | `GET /streaming/account/{id}/emailaddress`                                      |
+| `cloud/devices.xml`      | `GET /streaming/account/{id}/devices`                                           |
+| `cloud/sources.xml`      | `GET /streaming/account/{id}/sources`                                           |
+| `cloud/presets.xml`      | `GET /streaming/account/{id}/presets/all`                                       |
+| `cloud/full.xml`         | `GET /streaming/account/{id}/full` (may overlap with the above; skipped if 4xx) |
+
+---
+
+### Local backup
+
+Backs up each speaker over its HTTP API on port 8090. With `--ssh`, also captures key filesystem files via SSH.
+
+```bash
+# Auto-discover all speakers on the local network
+soundtouch-backup local
+
+# Specific speaker
+soundtouch-backup local --host 192.168.178.28
+
+# Multiple speakers
+soundtouch-backup local --host 192.168.178.28 --host 192.168.178.35
+
+# Include SSH filesystem backup
+soundtouch-backup local --ssh
+
+# Longer discovery window on busy networks
+soundtouch-backup local --discover-timeout 10s
+```
+
+**Flags**
+
+| Flag                 | Short | Default                               | Description                                      |
+|----------------------|-------|---------------------------------------|--------------------------------------------------|
+| `--host`             | `-H`  | —                                     | Speaker host/IP, repeatable (`$SOUNDTOUCH_HOST`) |
+| `--port`             | `-p`  | `8090`                                | Speaker HTTP port (`$SOUNDTOUCH_PORT`)           |
+| `--discover`         | `-d`  | auto                                  | Force mDNS/UPnP discovery                        |
+| `--discover-timeout` |       | `5s`                                  | Discovery timeout                                |
+| `--ssh`              |       | on                                    | Also capture filesystem files via SSH            |
+| `--output`           | `-o`  | `soundtouch-backup-YYYY-MM-DD.tar.gz` | Output archive path                              |
+| `--format`           |       | `tar.gz`                              | Archive format: `tar.gz` or `zip`                |
+
+**What gets fetched via HTTP**
+
+| File                | Device endpoint |
+|---------------------|-----------------|
+| `info.xml`          | `/info`         |
+| `name.xml`          | `/name`         |
+| `presets.xml`       | `/presets`      |
+| `sources.xml`       | `/sources`      |
+| `now_playing.xml`   | `/now_playing`  |
+| `volume.xml`        | `/volume`       |
+| `bass.xml`          | `/bass`         |
+| `balance.xml`       | `/balance`      |
+| `capabilities.xml`  | `/capabilities` |
+| `network_info.xml`  | `/networkInfo`  |
+| `clock_display.xml` | `/clockDisplay` |
+| `zone.xml`          | `/getZone`      |
+
+Endpoints that return HTTP 4xx (not supported on the device model) are silently skipped.
+
+**What gets fetched via SSH** (`--ssh`)
+
+SSH connects as `root@<host>:22` with an empty password, which is the default for SoundTouch firmware.
+
+Individual files:
+
+| Remote path               | Notes                                      |
+|---------------------------|--------------------------------------------|
+| `/etc/hosts`              | DNS redirect state                         |
+| `/etc/resolv.conf`        | DNS resolver configuration                 |
+| `/etc/remote_services`    | Service registration (post-migration only) |
+| `/mnt/nv/remote_services` | Alternative location for remote services   |
+
+Directories (all regular files recursively):
+
+| Remote path                      | Contents                                                                   |
+|----------------------------------|----------------------------------------------------------------------------|
+| `/opt/Bose/etc/`                 | Full Bose configuration directory, including `SoundTouchSdkPrivateCfg.xml` |
+| `/mnt/nv/BoseApp-Persistence/1/` | Persisted app state                                                        |
+
+Missing files and directories are silently skipped with a `⚠` warning.
+
+---
+
+## Archive structure
+
+Both subcommands write into a single dated archive:
+
+```
+soundtouch-backup-2026-05-02/
+├── cloud/
+│   ├── emailaddress.xml
+│   ├── devices.xml
+│   ├── sources.xml
+│   └── presets.xml
+└── local/
+    ├── A_Sound_Machine/
+    │   ├── info.xml
+    │   ├── presets.xml
+    │   ├── sources.xml
+    │   ├── volume.xml
+    │   ├── …
+    │   └── ssh/
+    │       ├── etc/
+    │       │   ├── hosts
+    │       │   └── resolv.conf
+    │       ├── opt/Bose/etc/
+    │       │   └── SoundTouchSdkPrivateCfg.xml
+    │       └── mnt/nv/BoseApp-Persistence/1/
+    └── Sound_Machinechen/
+        └── …
+```
+
+Running `cloud` and `local` separately produces two archives. To combine them, use the same `--output` path for both invocations — each adds its own subdirectory so they won't collide (`.tar.gz` does not support appending; use `--format zip` if you need a single archive from two runs, or just keep them separate).
+
+## See also
+
+- [Cloud Shutdown Survival Guide](../../docs/guides/SURVIVAL-GUIDE.md) — full migration context
+- [`soundtouch-cli`](../soundtouch-cli/) — live device control
+- [`soundtouch-service`](../soundtouch-service/) — local cloud replacement
@@ -0,0 +1,119 @@
+package main
+
+import (
+	"encoding/xml"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/urfave/cli/v2"
+)
+
+func allCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "all",
+		Usage: "Back up cloud account then all paired speakers in one go",
+		Description: "Authenticates with the Bose cloud, backs up account data, then reads" +
+			" the device IP addresses from the cloud device list and backs up each reachable" +
+			" speaker over HTTP (and optionally SSH).",
+		Flags: append(outputFlags,
+			&cli.StringFlag{
+				Name:    "email",
+				Aliases: []string{"e"},
+				Usage:   "Bose account email",
+				EnvVars: []string{"BOSE_EMAIL"},
+			},
+			&cli.StringFlag{
+				Name:    "password",
+				Aliases: []string{"pw"},
+				Usage:   "Bose account password",
+				EnvVars: []string{"BOSE_PASSWORD"},
+			},
+			&cli.BoolFlag{
+				Name:  "ssh",
+				Usage: "Also back up device filesystem files via SSH (root@host:22, no password required)",
+				Value: true,
+			},
+		),
+		Action: runAllBackup,
+	}
+}
+
+func runAllBackup(c *cli.Context) error {
+	doSSH := c.Bool("ssh")
+	output := resolveOutputPath(c.String("output"), c.String("format"))
+	format := c.String("format")
+
+	// 1. Cloud backup
+	client, err := setupCloudClient(c.String("email"), c.String("password"))
+	if err != nil {
+		return err
+	}
+
+	root := archiveRoot()
+	files := collectCloudFiles(client, root)
+
+	if len(files) == 0 {
+		return fmt.Errorf("no cloud data fetched")
+	}
+
+	// 2. Resolve speakers from devices.xml, then back each one up
+	devicesData := files[root+"/cloud/devices.xml"]
+	if devicesData == nil {
+		printWarn("devices.xml not available — skipping local backup")
+	} else {
+		targets := parseDevicesXML(devicesData)
+		if len(targets) == 0 {
+			printWarn("no device IP addresses found in devices.xml")
+		} else {
+			fmt.Printf("Found %d device(s) in cloud account, attempting local backup...\n", len(targets))
+		}
+
+		hc := &http.Client{Timeout: 10 * time.Second}
+
+		for k, v := range collectLocalFiles(hc, targets, root, doSSH) {
+			files[k] = v
+		}
+	}
+
+	if err := writeArchive(output, format, files); err != nil {
+		return fmt.Errorf("writing archive: %w", err)
+	}
+
+	fmt.Printf("Archive written: %s (%d files)\n", output, len(files))
+
+	return nil
+}
+
+type xmlDevice struct {
+	Name      string `xml:"name"`
+	IPAddress string `xml:"ipaddress"`
+}
+
+type xmlDevices struct {
+	XMLName xml.Name    `xml:"devices"`
+	Devices []xmlDevice `xml:"device"`
+}
+
+// parseDevicesXML extracts speaker targets from a devices.xml cloud response.
+func parseDevicesXML(data []byte) []speakerTarget {
+	var d xmlDevices
+
+	if err := xml.Unmarshal(data, &d); err != nil {
+		return nil
+	}
+
+	var targets []speakerTarget
+
+	for _, dev := range d.Devices {
+		if dev.IPAddress == "" {
+			continue
+		}
+
+		// Pass name as a hint for error messages; backupSpeakerHTTP re-fetches
+		// from /info to get the current name and include info.xml in the archive.
+		targets = append(targets, speakerTarget{host: dev.IPAddress, port: 8090, name: dev.Name})
+	}
+
+	return targets
+}
@@ -0,0 +1,252 @@
+package main
+
+import (
+	"bytes"
+	"encoding/xml"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"time"
+
+	"github.com/urfave/cli/v2"
+)
+
+const (
+	streamingBase  = "https://streaming.bose.com"
+	streamingCT    = "application/vnd.bose.streaming-v1.1+xml"
+	stockholmVer   = "27.0.13-4277+8963611.epdbuild.develop.hepdswbld04.2025-10-02T13:17:00"
+	nativeFrameVer = "27.0.2 -3353+4ae7c78.epdbuild.HEAD.ssgbld02.2023-10-12T15:10Z"
+	protocolVer    = "67"
+	appGUID        = "b94dedd1-a61b-492b-b86b-2bc32c9261f4"
+	appUserAgent   = "Mozilla/5.0 (Linux; Android 13; Android SDK built for arm64 Build/TE1A.220922.034; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/101.0.4951.61 Mobile Safari/537.36 Manufacturer/unknown DeviceModel/Android-SDK-built-for-arm64 SOUNDTOUCH_MOBILE_APP/" + appGUID
+)
+
+func cloudCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "cloud",
+		Usage: "Back up your Bose SoundTouch cloud account (devices, presets, sources)",
+		Flags: append(outputFlags,
+			&cli.StringFlag{
+				Name:    "email",
+				Aliases: []string{"e"},
+				Usage:   "Bose account email",
+				EnvVars: []string{"BOSE_EMAIL"},
+			},
+			&cli.StringFlag{
+				Name:    "password",
+				Aliases: []string{"pw"},
+				Usage:   "Bose account password",
+				EnvVars: []string{"BOSE_PASSWORD"},
+			},
+		),
+		Action: runCloudBackup,
+	}
+}
+
+func runCloudBackup(c *cli.Context) error {
+	output := resolveOutputPath(c.String("output"), c.String("format"))
+	format := c.String("format")
+
+	client, err := setupCloudClient(c.String("email"), c.String("password"))
+	if err != nil {
+		return err
+	}
+
+	root := archiveRoot()
+	files := collectCloudFiles(client, root)
+
+	if len(files) == 0 {
+		return fmt.Errorf("no data fetched")
+	}
+
+	if err := writeArchive(output, format, files); err != nil {
+		return fmt.Errorf("writing archive: %w", err)
+	}
+
+	fmt.Printf("Archive written: %s (%d files)\n", output, len(files))
+
+	return nil
+}
+
+// setupCloudClient prompts for missing credentials, then authenticates with the Bose cloud.
+func setupCloudClient(email, password string) (*cloudClient, error) {
+	if email == "" || password == "" {
+		var err error
+
+		email, password, err = promptCredentials(email)
+		if err != nil {
+			return nil, fmt.Errorf("credentials: %w", err)
+		}
+	}
+
+	if email == "" || password == "" {
+		return nil, fmt.Errorf("email and password are required")
+	}
+
+	fmt.Printf("Authenticating as %s...\n", email)
+
+	client, err := loginToCloud(email, password)
+	if err != nil {
+		return nil, fmt.Errorf("authentication failed: %w", err)
+	}
+
+	printOK(fmt.Sprintf("Authenticated (account ID: %s)", client.accountID))
+
+	return client, nil
+}
+
+// collectCloudFiles fetches all cloud account data and returns a files map ready for
+// archiving. Keys are prefixed with root (e.g. "soundtouch-backup-2026-05-02/cloud/").
+func collectCloudFiles(client *cloudClient, root string) map[string][]byte {
+	type cloudEndpoint struct {
+		label    string
+		filename string
+		fetch    func(*cloudClient) ([]byte, error)
+	}
+
+	endpoints := []cloudEndpoint{
+		{"email address", "emailaddress.xml", fetchEmailAddress},
+		{"devices", "devices.xml", fetchDevices},
+		{"sources", "sources.xml", fetchSources},
+		{"presets", "presets.xml", fetchPresets},
+		{"full account", "full.xml", fetchFull},
+	}
+
+	files := make(map[string][]byte)
+
+	for _, ep := range endpoints {
+		data, err := ep.fetch(client)
+		if err != nil {
+			printFail(fmt.Sprintf("%s: %v", ep.label, err))
+
+			continue
+		}
+
+		files[root+"/cloud/"+ep.filename] = data
+		printOK(fmt.Sprintf("%s (%d bytes)", ep.label, len(data)))
+	}
+
+	return files
+}
+
+type cloudClient struct {
+	http      *http.Client
+	accountID string
+	token     string
+}
+
+type loginXML struct {
+	XMLName  xml.Name `xml:"login"`
+	Username string   `xml:"username"`
+	Password string   `xml:"password"`
+}
+
+var accountIDRe = regexp.MustCompile(`<account\s+id="([^"]+)"`)
+
+func loginToCloud(email, password string) (*cloudClient, error) {
+	loginBody, err := xml.Marshal(loginXML{Username: email, Password: password})
+	if err != nil {
+		return nil, err
+	}
+
+	body := []byte(`<?xml version="1.0" encoding="UTF-8"?>`)
+	body = append(body, loginBody...)
+
+	req, err := http.NewRequest("POST", streamingBase+"/streaming/account/login", bytes.NewReader(body))
+	if err != nil {
+		return nil, err
+	}
+
+	setStreamingHeaders(req, "")
+
+	hc := &http.Client{Timeout: 30 * time.Second}
+
+	resp, err := hc.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+
+	token := resp.Header.Get("credentials")
+	if token == "" {
+		return nil, fmt.Errorf("no credentials in response — check your email and password")
+	}
+
+	data, err := io.ReadAll(io.LimitReader(resp.Body, 64*1024))
+	if err != nil {
+		return nil, err
+	}
+
+	m := accountIDRe.FindSubmatch(data)
+	if len(m) < 2 {
+		return nil, fmt.Errorf("could not extract account ID from login response")
+	}
+
+	return &cloudClient{http: hc, accountID: string(m[1]), token: token}, nil
+}
+
+func setStreamingHeaders(req *http.Request, token string) {
+	req.Header.Set("content-type", streamingCT)
+	req.Header.Set("accept", streamingCT)
+	req.Header.Set("clienttype", "SOUNDTOUCH_MOBILE_APP")
+	req.Header.Set("version_stockholmversion", stockholmVer)
+	req.Header.Set("version_nativeframeversion", nativeFrameVer)
+	req.Header.Set("version_protocolversion", protocolVer)
+	req.Header.Set("user-agent", appUserAgent)
+	req.Header.Set("guid", appGUID)
+	req.Header.Set("x-requested-with", "com.bose.soundtouch")
+	req.Header.Set("pragma", "no-cache")
+	req.Header.Set("cache-control", "no-cache")
+
+	if token != "" {
+		req.Header.Set("authorization", token)
+	}
+}
+
+func (c *cloudClient) get(path string) ([]byte, error) {
+	url := fmt.Sprintf("%s%s?_=%d", streamingBase, path, time.Now().UnixMilli())
+
+	req, err := http.NewRequest("GET", url, nil)
+	if err != nil {
+		return nil, err
+	}
+
+	setStreamingHeaders(req, c.token)
+
+	resp, err := c.http.Do(req)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+
+	return io.ReadAll(io.LimitReader(resp.Body, 2*1024*1024))
+}
+
+func fetchEmailAddress(c *cloudClient) ([]byte, error) {
+	return c.get("/streaming/account/" + c.accountID + "/emailaddress")
+}
+
+func fetchDevices(c *cloudClient) ([]byte, error) {
+	return c.get("/streaming/account/" + c.accountID + "/devices")
+}
+
+func fetchSources(c *cloudClient) ([]byte, error) {
+	return c.get("/streaming/account/" + c.accountID + "/sources")
+}
+
+func fetchPresets(c *cloudClient) ([]byte, error) {
+	return c.get("/streaming/account/" + c.accountID + "/presets/all")
+}
+
+func fetchFull(c *cloudClient) ([]byte, error) {
+	return c.get("/streaming/account/" + c.accountID + "/full")
+}
@@ -0,0 +1,288 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"net/http"
+	"regexp"
+	"strings"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/pkg/config"
+	"github.com/gesellix/bose-soundtouch/pkg/discovery"
+	"github.com/gesellix/bose-soundtouch/pkg/ssh"
+	"github.com/urfave/cli/v2"
+)
+
+var localEndpoints = []struct {
+	path string
+	file string
+}{
+	{"/info", "info.xml"},
+	{"/name", "name.xml"},
+	{"/presets", "presets.xml"},
+	{"/sources", "sources.xml"},
+	{"/now_playing", "now_playing.xml"},
+	{"/volume", "volume.xml"},
+	{"/bass", "bass.xml"},
+	{"/balance", "balance.xml"},
+	{"/capabilities", "capabilities.xml"},
+	{"/networkInfo", "network_info.xml"},
+	{"/clockDisplay", "clock_display.xml"},
+	{"/getZone", "zone.xml"},
+}
+
+// sshFiles lists individual device filesystem paths captured via SSH.
+// Paths that may not exist on all devices are silently skipped.
+var sshFiles = []string{
+	"/etc/hosts",
+	"/etc/resolv.conf",
+	"/etc/remote_services",
+	"/mnt/nv/remote_services",
+}
+
+// sshDirs lists device directories whose contents are recursively captured via SSH.
+var sshDirs = []string{
+	"/opt/Bose/etc",
+	"/mnt/nv/BoseApp-Persistence/1",
+}
+
+func localCommand() *cli.Command {
+	return &cli.Command{
+		Name:  "local",
+		Usage: "Back up one or more SoundTouch speakers on your local network",
+		Flags: append(outputFlags,
+			&cli.StringSliceFlag{
+				Name:    "host",
+				Aliases: []string{"H"},
+				Usage:   "Speaker host/IP (repeatable for multiple speakers)",
+				EnvVars: []string{"SOUNDTOUCH_HOST"},
+			},
+			&cli.IntFlag{
+				Name:    "port",
+				Aliases: []string{"p"},
+				Usage:   "Speaker HTTP port",
+				Value:   8090,
+				EnvVars: []string{"SOUNDTOUCH_PORT"},
+			},
+			&cli.BoolFlag{
+				Name:    "discover",
+				Aliases: []string{"d"},
+				Usage:   "Auto-discover speakers on the local network",
+			},
+			&cli.DurationFlag{
+				Name:  "discover-timeout",
+				Usage: "Discovery timeout",
+				Value: 5 * time.Second,
+			},
+			&cli.BoolFlag{
+				Name:  "ssh",
+				Usage: "Also back up device filesystem files via SSH (root@host:22, no password required)",
+				Value: true,
+			},
+		),
+		Action: runLocalBackup,
+	}
+}
+
+type speakerTarget struct {
+	host string
+	port int
+	name string
+}
+
+func runLocalBackup(c *cli.Context) error {
+	hosts := c.StringSlice("host")
+	port := c.Int("port")
+	doDiscover := c.Bool("discover") || len(hosts) == 0
+	discoverTimeout := c.Duration("discover-timeout")
+	doSSH := c.Bool("ssh")
+	output := resolveOutputPath(c.String("output"), c.String("format"))
+	format := c.String("format")
+
+	var targets []speakerTarget
+
+	if doDiscover {
+		fmt.Printf("Discovering speakers (timeout: %s)...\n", discoverTimeout)
+
+		ctx, cancel := context.WithTimeout(c.Context, discoverTimeout)
+		defer cancel()
+
+		cfg, _ := config.LoadFromEnv()
+		svc := discovery.NewUnifiedDiscoveryService(cfg)
+
+		found, discErr := svc.DiscoverDevices(ctx)
+		if discErr != nil {
+			printWarn(fmt.Sprintf("Discovery failed: %v", discErr))
+		}
+
+		for _, d := range found {
+			targets = append(targets, speakerTarget{host: d.Host, port: d.Port, name: d.Name})
+			printOK(fmt.Sprintf("Found: %s (%s:%d)", d.Name, d.Host, d.Port))
+		}
+	}
+
+	for _, h := range hosts {
+		targets = append(targets, speakerTarget{host: h, port: port})
+	}
+
+	if len(targets) == 0 {
+		return fmt.Errorf("no speakers found — use --host <ip> or --discover")
+	}
+
+	hc := &http.Client{Timeout: 10 * time.Second}
+	root := archiveRoot()
+	files := collectLocalFiles(hc, targets, root, doSSH)
+
+	if len(files) == 0 {
+		return fmt.Errorf("no data collected")
+	}
+
+	if err := writeArchive(output, format, files); err != nil {
+		return fmt.Errorf("writing archive: %w", err)
+	}
+
+	fmt.Printf("Archive written: %s (%d files)\n", output, len(files))
+
+	return nil
+}
+
+// collectLocalFiles backs up all targets over HTTP (and optionally SSH) and returns
+// a files map ready for archiving. Keys are prefixed with root.
+func collectLocalFiles(hc *http.Client, targets []speakerTarget, root string, doSSH bool) map[string][]byte {
+	files := make(map[string][]byte)
+
+	for _, t := range targets {
+		name, entries, err := backupSpeakerHTTP(hc, t)
+		if err != nil {
+			printFail(fmt.Sprintf("%s:%d — %v", t.host, t.port, err))
+
+			continue
+		}
+
+		dir := root + "/local/" + sanitizeName(name) + "/"
+
+		for filename, data := range entries {
+			files[dir+filename] = data
+		}
+
+		printOK(fmt.Sprintf("%s: %d files via HTTP", name, len(entries)))
+
+		if doSSH {
+			sshEntries := backupSpeakerSSH(t.host, name)
+
+			for filename, data := range sshEntries {
+				files[dir+filename] = data
+			}
+
+			if len(sshEntries) > 0 {
+				printOK(fmt.Sprintf("%s: %d files via SSH", name, len(sshEntries)))
+			}
+		}
+	}
+
+	return files
+}
+
+func backupSpeakerHTTP(hc *http.Client, t speakerTarget) (name string, files map[string][]byte, err error) {
+	base := fmt.Sprintf("http://%s:%d", t.host, t.port)
+	files = make(map[string][]byte)
+	name = t.name
+	infoFetched := false
+
+	if name == "" {
+		data, ferr := fetchRaw(hc, base+"/info")
+		if ferr != nil {
+			return "", nil, fmt.Errorf("cannot reach %s: %w", base, ferr)
+		}
+
+		files["info.xml"] = data
+		infoFetched = true
+
+		if extracted := xmlFirst(data, "name"); extracted != "" {
+			name = extracted
+		} else {
+			name = t.host
+		}
+	}
+
+	for _, ep := range localEndpoints {
+		if ep.path == "/info" && infoFetched {
+			continue
+		}
+
+		data, ferr := fetchRaw(hc, base+ep.path)
+		if ferr != nil {
+			printWarn(fmt.Sprintf("%s: skipped %s (%v)", name, ep.file, ferr))
+			continue
+		}
+
+		files[ep.file] = data
+	}
+
+	return name, files, nil
+}
+
+// backupSpeakerSSH connects to the device via SSH and reads the key filesystem paths.
+// Files that don't exist on the device are silently skipped.
+// Returned map keys are relative paths within the device backup directory (e.g. "ssh/etc/hosts").
+func backupSpeakerSSH(host, deviceName string) map[string][]byte {
+	client := ssh.NewClient(host)
+	files := make(map[string][]byte)
+
+	for _, remotePath := range sshFiles {
+		data, err := client.ReadFile(remotePath)
+		if err != nil {
+			// Most missing files are expected (e.g. /etc/remote_services only exists post-migration)
+			printWarn(fmt.Sprintf("%s: SSH skipped %s (%v)", deviceName, remotePath, err))
+
+			continue
+		}
+
+		if len(data) == 0 {
+			printWarn(fmt.Sprintf("%s: SSH empty file %s", deviceName, remotePath))
+		}
+
+		files["ssh"+remotePath] = data
+	}
+
+	for _, remoteDir := range sshDirs {
+		dirFiles, err := client.ReadDir(remoteDir)
+		if err != nil {
+			printWarn(fmt.Sprintf("%s: SSH skipped dir %s (%v)", deviceName, remoteDir, err))
+			continue
+		}
+
+		for path, data := range dirFiles {
+			files["ssh"+path] = data
+		}
+	}
+
+	return files
+}
+
+func fetchRaw(hc *http.Client, url string) ([]byte, error) {
+	resp, err := hc.Get(url)
+	if err != nil {
+		return nil, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode >= 400 {
+		return nil, fmt.Errorf("HTTP %d", resp.StatusCode)
+	}
+
+	return io.ReadAll(io.LimitReader(resp.Body, 1024*1024))
+}
+
+func xmlFirst(data []byte, field string) string {
+	re := regexp.MustCompile(`<` + regexp.QuoteMeta(field) + `[^>]*>([^<]+)</` + regexp.QuoteMeta(field) + `>`)
+
+	m := re.FindSubmatch(data)
+	if len(m) >= 2 {
+		return strings.TrimSpace(string(m[1]))
+	}
+
+	return ""
+}
@@ -0,0 +1,172 @@
+package main
+
+import (
+	"archive/tar"
+	"archive/zip"
+	"bufio"
+	"compress/gzip"
+	"fmt"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/urfave/cli/v2"
+	"golang.org/x/term"
+)
+
+const (
+	FormatTarGz = "tar.gz"
+	FormatZip   = "zip"
+)
+
+var outputFlags = []cli.Flag{
+	&cli.StringFlag{
+		Name:    "output",
+		Aliases: []string{"o"},
+		Usage:   "Output archive file (default: soundtouch-backup-YYYY-MM-DD.tar.gz)",
+		EnvVars: []string{"SOUNDTOUCH_BACKUP_OUTPUT"},
+	},
+	&cli.StringFlag{
+		Name:  "format",
+		Usage: "Archive format: tar.gz or zip",
+		Value: FormatTarGz,
+	},
+}
+
+func resolveOutputPath(output, format string) string {
+	date := time.Now().Format("2006-01-02")
+
+	ext := ".tar.gz"
+	if format == FormatZip {
+		ext = ".zip"
+	}
+
+	filename := "soundtouch-backup-" + date + ext
+
+	if output == "" {
+		return filename
+	}
+
+	if info, err := os.Stat(output); err == nil && info.IsDir() {
+		return output + string(os.PathSeparator) + filename
+	}
+
+	return output
+}
+
+func archiveRoot() string {
+	return "soundtouch-backup-" + time.Now().Format("2006-01-02")
+}
+
+func writeArchive(outputPath, format string, files map[string][]byte) error {
+	if format == FormatZip {
+		return writeZip(outputPath, files)
+	}
+
+	return writeTarGz(outputPath, files)
+}
+
+func writeTarGz(outputPath string, files map[string][]byte) error {
+	f, err := os.Create(outputPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	gz := gzip.NewWriter(f)
+	defer gz.Close()
+
+	tw := tar.NewWriter(gz)
+	defer tw.Close()
+
+	now := time.Now()
+	for name, data := range files {
+		hdr := &tar.Header{
+			Name:     name,
+			Mode:     0644,
+			Size:     int64(len(data)),
+			ModTime:  now,
+			Typeflag: tar.TypeReg,
+		}
+		if err := tw.WriteHeader(hdr); err != nil {
+			return fmt.Errorf("tar header %s: %w", name, err)
+		}
+
+		if _, err := tw.Write(data); err != nil {
+			return fmt.Errorf("tar write %s: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+func writeZip(outputPath string, files map[string][]byte) error {
+	f, err := os.Create(outputPath)
+	if err != nil {
+		return err
+	}
+	defer f.Close()
+
+	zw := zip.NewWriter(f)
+	defer zw.Close()
+
+	for name, data := range files {
+		w, err := zw.Create(name)
+		if err != nil {
+			return fmt.Errorf("zip entry %s: %w", name, err)
+		}
+
+		if _, err := w.Write(data); err != nil {
+			return fmt.Errorf("zip write %s: %w", name, err)
+		}
+	}
+
+	return nil
+}
+
+func promptCredentials(emailHint string) (email, password string, err error) {
+	r := bufio.NewReader(os.Stdin)
+
+	if emailHint != "" {
+		email = emailHint
+	} else {
+		fmt.Print("Bose account email: ")
+
+		email, err = r.ReadString('\n')
+		if err != nil {
+			return
+		}
+
+		email = strings.TrimSpace(email)
+	}
+
+	fmt.Print("Password: ")
+
+	raw, termErr := term.ReadPassword(int(os.Stdin.Fd()))
+
+	fmt.Println()
+
+	if termErr != nil {
+		err = fmt.Errorf("reading password: %w (tip: use --password flag or BOSE_PASSWORD env var)", termErr)
+		return
+	}
+
+	password = string(raw)
+
+	return
+}
+
+func sanitizeName(name string) string {
+	r := strings.NewReplacer(
+		"/", "_", "\\", "_", ":", "_",
+		"*", "_", "?", "_", "\"", "_",
+		"<", "_", ">", "_", "|", "_",
+		" ", "_",
+	)
+
+	return r.Replace(name)
+}
+
+func printOK(msg string)   { fmt.Printf("  ✓ %s\n", msg) }
+func printFail(msg string) { fmt.Printf("  ✗ %s\n", msg) }
+func printWarn(msg string) { fmt.Printf("  ⚠ %s\n", msg) }
@@ -0,0 +1,37 @@
+// Package main implements the soundtouch-backup tool for backing up Bose SoundTouch
+// cloud account data and local speaker filesystem files.
+package main
+
+import (
+	"log"
+	"os"
+	"runtime/debug"
+
+	"github.com/urfave/cli/v2"
+)
+
+var version = "dev"
+
+func init() {
+	if info, ok := debug.ReadBuildInfo(); ok {
+		if info.Main.Version != "" && info.Main.Version != "(devel)" {
+			version = info.Main.Version
+		}
+	}
+}
+
+func main() {
+	app := &cli.App{
+		Name:    "soundtouch-backup",
+		Usage:   "Back up Bose SoundTouch account and speaker data",
+		Version: version,
+		Commands: []*cli.Command{
+			allCommand(),
+			cloudCommand(),
+			localCommand(),
+		},
+	}
+	if err := app.Run(os.Args); err != nil {
+		log.Fatal(err)
+	}
+}
@@ -652,6 +652,73 @@ func listMusicServiceAccounts(c *cli.Context) error {
 	return nil
 }

+// pairDevice triggers the Stockholm registration flow via WebSocket
+func pairDevice(c *cli.Context) error {
+	clientConfig := GetClientConfig(c)
+
+	client, err := CreateSoundTouchClient(clientConfig)
+	if err != nil {
+		return err
+	}
+
+	accountID := c.String("id")
+	token := c.String("token")
+
+	PrintDeviceHeader("Pairing device with Marge account", clientConfig.Host, clientConfig.Port)
+	fmt.Printf("  Account ID: %s\n", accountID)
+
+	// We need a WebSocket client for this
+	ws := client.NewWebSocketClient(nil)
+
+	err = ws.Connect()
+	if err != nil {
+		return fmt.Errorf("failed to connect to device WebSocket: %w", err)
+	}
+
+	defer func() { _ = ws.Disconnect() }()
+
+	err = ws.PairWithAccount(accountID, token)
+	if err != nil {
+		return fmt.Errorf("failed to send pairing request: %w", err)
+	}
+
+	PrintSuccess("Pairing request sent successfully")
+	fmt.Println("💡 The device will now register itself with the cloud service.")
+
+	return nil
+}
+
+// unpairDevice triggers the Stockholm unregistration flow via WebSocket
+func unpairDevice(c *cli.Context) error {
+	clientConfig := GetClientConfig(c)
+
+	client, err := CreateSoundTouchClient(clientConfig)
+	if err != nil {
+		return err
+	}
+
+	PrintDeviceHeader("Unpairing device from Marge account", clientConfig.Host, clientConfig.Port)
+
+	// We need a WebSocket client for this
+	ws := client.NewWebSocketClient(nil)
+
+	err = ws.Connect()
+	if err != nil {
+		return fmt.Errorf("failed to connect to device WebSocket: %w", err)
+	}
+
+	defer func() { _ = ws.Disconnect() }()
+
+	err = ws.UnPairFromAccount()
+	if err != nil {
+		return fmt.Errorf("failed to send unpairing request: %w", err)
+	}
+
+	PrintSuccess("Unpairing request sent successfully")
+
+	return nil
+}
+
 // getServiceDisplayName returns a user-friendly display name for a service
 func getServiceDisplayName(source string) string {
 	switch source {
@@ -157,6 +157,33 @@ func setClockTimeNow(c *cli.Context) error {
 	return nil
 }

+// setClockDisplayTimezone POSTs only the timezoneInfo attribute,
+// leaving format/brightness untouched. Useful after a clock now to
+// make the speaker's logs and front-panel display tick in local time
+// instead of UTC.
+func setClockDisplayTimezone(c *cli.Context) error {
+	clientConfig := GetClientConfig(c)
+	tz := c.String("tz")
+
+	PrintDeviceHeader(fmt.Sprintf("Setting clock timezone to %s", tz), clientConfig.Host, clientConfig.Port)
+
+	client, err := CreateSoundTouchClient(clientConfig)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to create client: %v", err))
+		return err
+	}
+
+	request := models.NewClockDisplayRequest().SetTimeZone(tz)
+	if err := client.SetClockDisplay(request); err != nil {
+		PrintError(fmt.Sprintf("Failed to set timezone: %v", err))
+		return err
+	}
+
+	PrintSuccess(fmt.Sprintf("Timezone set to %s", tz))
+
+	return nil
+}
+
 // getClockDisplay retrieves the current clock display settings
 func getClockDisplay(c *cli.Context) error {
 	clientConfig := GetClientConfig(c)
@@ -23,6 +23,12 @@ func eventSubscribe(c *cli.Context) error {
 	filterStr := c.String("filter")
 	filters := parseEventFilters(filterStr)

+	debugMode, err := parseDebugMode(c.String("debug"))
+	if err != nil {
+		PrintError(err.Error())
+		return err
+	}
+
 	// Parse duration
 	duration := c.Duration("duration")
 	verbose := c.Bool("verbose")
@@ -60,6 +66,10 @@ func eventSubscribe(c *cli.Context) error {
 	// Set up event handlers
 	setupEventHandlers(wsClient, filters, verbose)

+	if debugMode != debugOff {
+		installDebugHook(wsClient, debugMode)
+	}
+
 	// Connect to WebSocket
 	fmt.Println("🔌 Connecting to WebSocket...")

@@ -127,11 +137,78 @@ func eventSubscribe(c *cli.Context) error {
 	return nil
 }

+// debugMode controls when the WebSocket subscribe loop prints raw frames
+// to stderr. "off" disables debug output entirely (the production default
+// when --debug is unset).
+type debugMode int
+
+const (
+	debugOff debugMode = iota
+	debugAll
+	debugUnknown
+	debugErrors
+)
+
+func parseDebugMode(s string) (debugMode, error) {
+	switch strings.TrimSpace(s) {
+	case "":
+		return debugOff, nil
+	case "all":
+		return debugAll, nil
+	case "unknown":
+		return debugUnknown, nil
+	case "errors":
+		return debugErrors, nil
+	default:
+		return debugOff, fmt.Errorf("invalid --debug value %q (want one of: all, unknown, errors)", s)
+	}
+}
+
+// installDebugHook wires an OnRawMessage handler that prints the raw
+// frame to stderr based on the chosen mode. Stays out of stdout so
+// debug output can be filtered/grep'd independently of normal events.
+func installDebugHook(ws *client.WebSocketClient, mode debugMode) {
+	ws.OnRawMessage(func(data []byte, parseErr error) {
+		switch mode {
+		case debugAll:
+			printRawFrame(data, parseErr, "all")
+		case debugErrors:
+			if parseErr != nil {
+				printRawFrame(data, parseErr, "errors")
+			}
+		case debugUnknown:
+			// "Unknown" = parsed successfully but no known event types
+			// matched. Parse errors also qualify, since they're frames
+			// the client couldn't interpret either.
+			if parseErr != nil {
+				printRawFrame(data, parseErr, "unknown:parse-error")
+				return
+			}
+
+			ev, err := models.ParseWebSocketEvent(data)
+			if err != nil || len(ev.GetEventTypes()) == 0 {
+				printRawFrame(data, err, "unknown")
+			}
+		case debugOff:
+			// nothing
+		}
+	})
+}
+
+func printRawFrame(data []byte, parseErr error, tag string) {
+	prefix := "[ws-debug:" + tag + "]"
+	if parseErr != nil {
+		fmt.Fprintf(os.Stderr, "%s parse-error: %v\n", prefix, parseErr)
+	}
+
+	fmt.Fprintf(os.Stderr, "%s %s\n", prefix, string(data))
+}
+
 // parseEventFilters validates and parses the filter string
 func parseEventFilters(eventFilter string) map[string]bool {
 	validFilters := map[string]bool{
 		"nowPlaying": true, "volume": true, "connection": true,
-		"preset": true, "zone": true, "bass": true,
+		"preset": true, "zone": true, "group": true, "bass": true,
 		"sdkInfo": true, "userActivity": true,
 	}

@@ -217,6 +294,13 @@ func setupEventHandlers(wsClient *client.WebSocketClient, filters map[string]boo
 		})
 	}

+	// Stereo-pair (group) events — ST-10 only
+	if filters == nil || filters["group"] {
+		wsClient.OnGroupUpdated(func(event *models.GroupUpdatedEvent) {
+			handleGroupEvent(event)
+		})
+	}
+
 	// Bass events
 	if filters == nil || filters["bass"] {
 		wsClient.OnBassUpdated(func(event *models.BassUpdatedEvent) {
@@ -329,9 +413,11 @@ func handlePresetEvent(event *models.PresetUpdatedEvent, verbose bool) {
 	for _, preset := range presets.Preset {
 		fmt.Printf("  📻 Preset %d:", preset.ID)

-		if preset.ContentItem != nil {
-			fmt.Printf(" %s", preset.ContentItem.ItemName)
-			fmt.Printf(" (%s)", preset.ContentItem.Source)
+		// IsEmpty catches both <preset/> and INVALID_SOURCE
+		// placeholders; using the nil-safe helpers below means the
+		// inner Printf never dereferences a nil ContentItem.
+		if !preset.IsEmpty() {
+			fmt.Printf(" %s (%s)", preset.GetDisplayName(), preset.GetSource())
 		}

 		fmt.Println()
@@ -358,6 +444,34 @@ func handleZoneEvent(event *models.ZoneUpdatedEvent) {
 	}
 }

+func handleGroupEvent(event *models.GroupUpdatedEvent) {
+	group := &event.Group
+	fmt.Printf("\n🎧 Stereo-Pair Update [%s]:\n", event.DeviceID)
+
+	if group.IsEmpty() {
+		fmt.Println("  ⛓️‍💥 Pair dissolved (no group configured)")
+		return
+	}
+
+	fmt.Printf("  🆔 ID:     %s\n", group.ID)
+	fmt.Printf("  📛 Name:   %s\n", group.Name)
+	fmt.Printf("  👑 Master: %s\n", group.MasterDeviceID)
+
+	if group.Status != "" {
+		fmt.Printf("  ✅ Status: %s\n", group.Status)
+	}
+
+	for _, r := range group.Roles.Roles {
+		fmt.Printf("  %-5s     %s", r.Role, r.DeviceID)
+
+		if r.IPAddress != "" {
+			fmt.Printf(" (IP: %s)", r.IPAddress)
+		}
+
+		fmt.Println()
+	}
+}
+
 func handleBassEvent(event *models.BassUpdatedEvent) {
 	bass := &event.Bass
 	fmt.Printf("\n🎵 Bass Update [%s]:\n", event.DeviceID)
@@ -0,0 +1,315 @@
+package main
+
+import (
+	"fmt"
+	"net"
+	"sync"
+
+	"github.com/gesellix/bose-soundtouch/pkg/client"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/gesellix/bose-soundtouch/pkg/speaker"
+	"github.com/urfave/cli/v2"
+)
+
+// getGroupStatus retrieves and prints the device's current stereo-pair state.
+func getGroupStatus(c *cli.Context) error {
+	clientConfig := GetClientConfig(c)
+	PrintDeviceHeader("Getting group information", clientConfig.Host, clientConfig.Port)
+
+	client, err := CreateSoundTouchClient(clientConfig)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to create client: %v", err))
+		return err
+	}
+
+	group, err := client.GetGroup()
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to get group: %v", err))
+		return err
+	}
+
+	if group.IsEmpty() {
+		fmt.Println("Device is not in a stereo pair")
+		return nil
+	}
+
+	printGroup(group)
+
+	return nil
+}
+
+// createGroup forms a stereo pair by POSTing /addGroup to both speakers in
+// parallel. LEFT is the master. Addressing each speaker directly (instead of
+// only the master and letting it propagate via marge) sidesteps the
+// inter-device round-trip that surfaced as client timeouts in #252.
+func createGroup(c *cli.Context) error {
+	leftIP := c.String("left")
+	rightIP := c.String("right")
+	name := c.String("name")
+
+	if net.ParseIP(leftIP) == nil {
+		PrintError(fmt.Sprintf("Invalid left IP address: %s", leftIP))
+		return fmt.Errorf("invalid left IP: %s", leftIP)
+	}
+
+	if net.ParseIP(rightIP) == nil {
+		PrintError(fmt.Sprintf("Invalid right IP address: %s", rightIP))
+		return fmt.Errorf("invalid right IP: %s", rightIP)
+	}
+
+	PrintDeviceHeader(fmt.Sprintf("Creating stereo pair: LEFT=%s RIGHT=%s", leftIP, rightIP), leftIP, speaker.HTTPPort)
+
+	leftInfo, err := fetchDeviceInfo(c, leftIP)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to read LEFT device info: %v", err))
+		return err
+	}
+
+	rightInfo, err := fetchDeviceInfo(c, rightIP)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to read RIGHT device info: %v", err))
+		return err
+	}
+
+	if name == "" {
+		name = fmt.Sprintf("%s + %s", leftInfo.Name, rightInfo.Name)
+	}
+
+	req := &models.Group{
+		Name:           name,
+		MasterDeviceID: leftInfo.DeviceID,
+		Roles: models.GroupRoles{
+			Roles: []models.GroupRole{
+				{DeviceID: leftInfo.DeviceID, Role: "LEFT", IPAddress: leftIP},
+				{DeviceID: rightInfo.DeviceID, Role: "RIGHT", IPAddress: rightIP},
+			},
+		},
+		// SenderIPAddress is intentionally omitted on the base request.
+		// propagateAddGroup adds it to the slave's copy only — see comment there.
+	}
+
+	leftClient, err := clientForHost(c, leftIP)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to create client for LEFT: %v", err))
+		return err
+	}
+
+	rightClient, err := clientForHost(c, rightIP)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to create client for RIGHT: %v", err))
+		return err
+	}
+
+	leftOut, rightOut := propagateAddGroup(leftClient, rightClient, leftIP, rightIP, req)
+
+	if leftOut.err != nil {
+		PrintError(fmt.Sprintf("LEFT (%s) /addGroup failed: %v", leftIP, leftOut.err))
+	}
+
+	if rightOut.err != nil {
+		PrintError(fmt.Sprintf("RIGHT (%s) /addGroup failed: %v", rightIP, rightOut.err))
+	}
+
+	if leftOut.err != nil || rightOut.err != nil {
+		if (leftOut.err == nil) != (rightOut.err == nil) {
+			succeeded := leftIP
+			if leftOut.err != nil {
+				succeeded = rightIP
+			}
+
+			PrintError(fmt.Sprintf("Partial group state on %s — clean up with `soundtouch-cli --host %s group remove`", succeeded, succeeded))
+		}
+
+		return fmt.Errorf("/addGroup propagation failed")
+	}
+
+	// The LEFT (master) response carries the assigned group ID; use it for display.
+	PrintSuccess(fmt.Sprintf("Stereo pair created (id=%s)", leftOut.group.ID))
+	printGroup(leftOut.group)
+
+	return nil
+}
+
+// addGroupOutcome is the per-speaker result of a parallel /addGroup call.
+type addGroupOutcome struct {
+	host  string
+	group *models.Group
+	err   error
+}
+
+// propagateAddGroup POSTs /addGroup to both speakers concurrently and returns
+// the (LEFT, RIGHT) outcomes. A non-GROUP_OK Status in the response is
+// reported as an error so callers don't have to re-inspect the body.
+//
+// The two POSTs carry different payloads: the master (LEFT) receives the base
+// request with no senderIPAddress so its state machine forms the group as the
+// master, while the slave (RIGHT) receives a copy with senderIPAddress set to
+// the master's IP so its state machine joins as the slave. Sending the same
+// payload to both makes both speakers think they're the slave — they enter
+// AddingSlave, wait for a master that never confirms, time out after 5 s, and
+// revert (issue #252).
+func propagateAddGroup(left, right *client.Client, leftIP, rightIP string, req *models.Group) (addGroupOutcome, addGroupOutcome) {
+	masterReq := *req
+	masterReq.SenderIPAddress = ""
+
+	slaveReq := *req
+	slaveReq.SenderIPAddress = leftIP
+
+	var (
+		wg                sync.WaitGroup
+		leftOut, rightOut addGroupOutcome
+	)
+
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+
+		leftOut = postAddGroup(left, leftIP, &masterReq)
+	}()
+
+	go func() {
+		defer wg.Done()
+
+		rightOut = postAddGroup(right, rightIP, &slaveReq)
+	}()
+
+	wg.Wait()
+
+	return leftOut, rightOut
+}
+
+func postAddGroup(cli *client.Client, host string, req *models.Group) addGroupOutcome {
+	out := addGroupOutcome{host: host}
+
+	g, err := cli.AddGroup(req)
+	if err != nil {
+		out.err = err
+		return out
+	}
+
+	out.group = g
+
+	if g != nil && g.Status != "" && g.Status != "GROUP_OK" {
+		out.err = fmt.Errorf("device returned status %q (want GROUP_OK)", g.Status)
+	}
+
+	return out
+}
+
+// renameGroup updates the name of the existing stereo pair. The device
+// requires the full structure on every update, so we fetch the current
+// state first.
+func renameGroup(c *cli.Context) error {
+	clientConfig := GetClientConfig(c)
+	newName := c.String("name")
+
+	if newName == "" {
+		PrintError("--name is required")
+		return fmt.Errorf("name is required")
+	}
+
+	PrintDeviceHeader(fmt.Sprintf("Renaming stereo pair to %q", newName), clientConfig.Host, clientConfig.Port)
+
+	stClient, err := CreateSoundTouchClient(clientConfig)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to create client: %v", err))
+		return err
+	}
+
+	current, err := stClient.GetGroup()
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to read current group: %v", err))
+		return err
+	}
+
+	if current.IsEmpty() {
+		PrintError("Device is not in a stereo pair — nothing to rename")
+		return fmt.Errorf("no group configured")
+	}
+
+	// Status is read-only on the device side; don't echo it back.
+	current.Status = ""
+	current.Name = newName
+
+	result, err := stClient.UpdateGroup(current)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to rename group: %v", err))
+		return err
+	}
+
+	PrintSuccess(fmt.Sprintf("Stereo pair renamed to %q", result.Name))
+	printGroup(result)
+
+	return nil
+}
+
+// removeGroup tears down the device's stereo pair.
+func removeGroup(c *cli.Context) error {
+	clientConfig := GetClientConfig(c)
+	PrintDeviceHeader("Removing stereo pair", clientConfig.Host, clientConfig.Port)
+
+	stClient, err := CreateSoundTouchClient(clientConfig)
+	if err != nil {
+		PrintError(fmt.Sprintf("Failed to create client: %v", err))
+		return err
+	}
+
+	if err := stClient.RemoveGroup(); err != nil {
+		PrintError(fmt.Sprintf("Failed to remove group: %v", err))
+		return err
+	}
+
+	PrintSuccess("Stereo pair removed")
+
+	return nil
+}
+
+// fetchDeviceInfo builds a one-off client for the given IP and reads /info.
+// Reused for both halves of a `create` invocation so the caller doesn't have
+// to babysit two host/port pairs.
+func fetchDeviceInfo(c *cli.Context, host string) (*models.DeviceInfo, error) {
+	stClient, err := clientForHost(c, host)
+	if err != nil {
+		return nil, err
+	}
+
+	return stClient.GetDeviceInfo()
+}
+
+// clientForHost mirrors CreateSoundTouchClient but overrides the host so we
+// can talk to a speaker other than the one named in --host.
+func clientForHost(c *cli.Context, host string) (*client.Client, error) {
+	cfg, err := loadConfig(c.Duration("timeout"))
+	if err != nil {
+		return nil, fmt.Errorf("failed to load config: %w", err)
+	}
+
+	return client.NewClient(&client.Config{
+		Host:      host,
+		Port:      speaker.HTTPPort,
+		Timeout:   cfg.HTTPTimeout,
+		UserAgent: cfg.UserAgent,
+	}), nil
+}
+
+func printGroup(g *models.Group) {
+	fmt.Println("Stereo Pair Configuration:")
+	fmt.Printf("  ID:        %s\n", g.ID)
+	fmt.Printf("  Name:      %s\n", g.Name)
+	fmt.Printf("  Master:    %s\n", g.MasterDeviceID)
+
+	if g.Status != "" {
+		fmt.Printf("  Status:    %s\n", g.Status)
+	}
+
+	for _, r := range g.Roles.Roles {
+		fmt.Printf("  %-5s     %s", r.Role, r.DeviceID)
+
+		if r.IPAddress != "" {
+			fmt.Printf(" (IP: %s)", r.IPAddress)
+		}
+
+		fmt.Println()
+	}
+}
@@ -0,0 +1,184 @@
+package main
+
+import (
+	"encoding/xml"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/client"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+)
+
+// happyAddGroupServer fakes a speaker's /addGroup that echoes the request
+// with an assigned ID and GROUP_OK status, matching real hardware behaviour.
+func happyAddGroupServer(t *testing.T, assignedID string) (*httptest.Server, *[]string) {
+	t.Helper()
+
+	bodies := make([]string, 0)
+
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path != "/addGroup" || r.Method != http.MethodPost {
+			t.Errorf("unexpected request: %s %s", r.Method, r.URL.Path)
+			http.NotFound(w, r)
+
+			return
+		}
+
+		body, _ := io.ReadAll(r.Body)
+		bodies = append(bodies, string(body))
+
+		var got models.Group
+		if err := xml.Unmarshal(body, &got); err != nil {
+			t.Fatalf("decode request body: %v", err)
+		}
+
+		got.ID = assignedID
+		got.Status = "GROUP_OK"
+
+		w.Header().Set("Content-Type", "application/xml")
+
+		enc, _ := xml.Marshal(&got)
+		_, _ = w.Write(enc)
+	}))
+
+	return srv, &bodies
+}
+
+func newTestGroupClient(serverURL string) *client.Client {
+	return client.NewClientFromHost(serverURL)
+}
+
+func sampleGroupRequest(leftIP, rightIP string) *models.Group {
+	return &models.Group{
+		Name:           "Living Room",
+		MasterDeviceID: "9070658C9D4A",
+		Roles: models.GroupRoles{
+			Roles: []models.GroupRole{
+				{DeviceID: "9070658C9D4A", Role: "LEFT", IPAddress: leftIP},
+				{DeviceID: "F45EAB3115DA", Role: "RIGHT", IPAddress: rightIP},
+			},
+		},
+		// senderIPAddress is intentionally not set here; propagateAddGroup
+		// adds it to the slave's copy only.
+	}
+}
+
+func TestPropagateAddGroup_BothSucceed(t *testing.T) {
+	leftSrv, leftBodies := happyAddGroupServer(t, "9999999")
+	defer leftSrv.Close()
+
+	rightSrv, rightBodies := happyAddGroupServer(t, "9999999")
+	defer rightSrv.Close()
+
+	leftClient := newTestGroupClient(leftSrv.URL)
+	rightClient := newTestGroupClient(rightSrv.URL)
+
+	req := sampleGroupRequest("192.168.1.131", "192.168.1.134")
+
+	leftOut, rightOut := propagateAddGroup(leftClient, rightClient, "192.168.1.131", "192.168.1.134", req)
+
+	if leftOut.err != nil {
+		t.Errorf("LEFT err = %v, want nil", leftOut.err)
+	}
+
+	if rightOut.err != nil {
+		t.Errorf("RIGHT err = %v, want nil", rightOut.err)
+	}
+
+	if leftOut.group == nil || leftOut.group.ID != "9999999" || leftOut.group.Status != "GROUP_OK" {
+		t.Errorf("LEFT group = %+v, want id=9999999 status=GROUP_OK", leftOut.group)
+	}
+
+	if rightOut.group == nil || rightOut.group.Status != "GROUP_OK" {
+		t.Errorf("RIGHT group = %+v, want status=GROUP_OK", rightOut.group)
+	}
+
+	// Both speakers must have received the roles, but only the slave's payload
+	// carries senderIPAddress — see propagateAddGroup for the why.
+	for label, bodies := range map[string]*[]string{"LEFT": leftBodies, "RIGHT": rightBodies} {
+		if len(*bodies) != 1 {
+			t.Fatalf("%s: expected exactly one POST, got %d", label, len(*bodies))
+		}
+
+		body := (*bodies)[0]
+		for _, want := range []string{"<role>LEFT</role>", "<role>RIGHT</role>"} {
+			if !strings.Contains(body, want) {
+				t.Errorf("%s body missing %q\nbody:\n%s", label, want, body)
+			}
+		}
+	}
+
+	leftBody := (*leftBodies)[0]
+	if strings.Contains(leftBody, "<senderIPAddress>") {
+		t.Errorf("LEFT (master) body must NOT carry <senderIPAddress>, otherwise the master flips into slave mode (issue #252)\nbody:\n%s", leftBody)
+	}
+
+	rightBody := (*rightBodies)[0]
+	if !strings.Contains(rightBody, "<senderIPAddress>192.168.1.131</senderIPAddress>") {
+		t.Errorf("RIGHT (slave) body must carry <senderIPAddress>192.168.1.131</senderIPAddress>\nbody:\n%s", rightBody)
+	}
+}
+
+func TestPropagateAddGroup_RightFails(t *testing.T) {
+	leftSrv, _ := happyAddGroupServer(t, "9999999")
+	defer leftSrv.Close()
+
+	rightSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		http.Error(w, "boom", http.StatusInternalServerError)
+	}))
+	defer rightSrv.Close()
+
+	leftClient := newTestGroupClient(leftSrv.URL)
+	rightClient := newTestGroupClient(rightSrv.URL)
+
+	req := sampleGroupRequest("192.168.1.131", "192.168.1.134")
+
+	leftOut, rightOut := propagateAddGroup(leftClient, rightClient, "192.168.1.131", "192.168.1.134", req)
+
+	if leftOut.err != nil {
+		t.Errorf("LEFT err = %v, want nil", leftOut.err)
+	}
+
+	if rightOut.err == nil {
+		t.Error("RIGHT err = nil, want non-nil")
+	}
+}
+
+func TestPostAddGroup_StatusOtherThanGroupOKIsError(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/xml")
+		_, _ = w.Write([]byte(`<group><status>GROUP_NOT_READY</status></group>`))
+	}))
+	defer srv.Close()
+
+	out := postAddGroup(newTestGroupClient(srv.URL), "test", sampleGroupRequest("1.1.1.1", "2.2.2.2"))
+
+	if out.err == nil {
+		t.Fatal("expected error for non-GROUP_OK status")
+	}
+
+	if !strings.Contains(out.err.Error(), "GROUP_NOT_READY") {
+		t.Errorf("error %q does not mention returned status", out.err)
+	}
+}
+
+func TestPostAddGroup_EmptyStatusIsAccepted(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.Header().Set("Content-Type", "application/xml")
+		_, _ = w.Write([]byte(`<group id="42"><name>n</name></group>`))
+	}))
+	defer srv.Close()
+
+	out := postAddGroup(newTestGroupClient(srv.URL), "test", sampleGroupRequest("1.1.1.1", "2.2.2.2"))
+
+	if out.err != nil {
+		t.Errorf("err = %v, want nil for empty status (some firmware omits it)", out.err)
+	}
+
+	if out.group == nil || out.group.ID != "42" {
+		t.Errorf("group = %+v, want id=42", out.group)
+	}
+}
@@ -177,23 +177,36 @@ func getPresets(c *cli.Context) error {

 	fmt.Printf("Device Presets:\n")

-	if len(presets.Preset) == 0 {
+	// Filter out placeholder presets the firmware emits for unconfigured
+	// slots (issue #308): self-closing <preset/> after factory reset,
+	// or <ContentItem source="INVALID_SOURCE"/> on healthy devices.
+	// IsEmpty covers both shapes; accessing fields like ContentItem.Source
+	// directly on the first shape panics.
+	configured := make([]models.Preset, 0, len(presets.Preset))
+
+	for _, p := range presets.Preset {
+		if !p.IsEmpty() {
+			configured = append(configured, p)
+		}
+	}
+
+	if len(configured) == 0 {
 		fmt.Printf("  No presets configured\n")
 		return nil
 	}

 	fmt.Printf("  Configured Presets:\n")

-	for _, preset := range presets.Preset {
+	for _, preset := range configured {
 		fmt.Printf("    %d. %s\n", preset.ID, preset.GetDisplayName())
-		fmt.Printf("       Source: %s\n", preset.ContentItem.Source)
+		fmt.Printf("       Source: %s\n", preset.GetSource())

-		if preset.ContentItem.SourceAccount != "" && preset.ContentItem.SourceAccount != preset.ContentItem.Source {
-			fmt.Printf("       Account: %s\n", preset.ContentItem.SourceAccount)
+		if account := preset.GetSourceAccount(); account != "" && account != preset.GetSource() {
+			fmt.Printf("       Account: %s\n", account)
 		}

-		if preset.ContentItem.Location != "" {
-			fmt.Printf("       Location: %s\n", preset.ContentItem.Location)
+		if location := preset.GetLocation(); location != "" {
+			fmt.Printf("       Location: %s\n", location)
 		}

 		// Show preset creation time if available
@@ -0,0 +1,310 @@
+package main
+
+import (
+	"bytes"
+	"io"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/gesellix/bose-soundtouch/pkg/service/setup"
+)
+
+// captureStdout runs fn and returns whatever it wrote to os.Stdout.
+// renderSourceTable prints directly via fmt.Print* — this lets us assert
+// on its output without restructuring the renderer to take an io.Writer.
+func captureStdout(t *testing.T, fn func()) string {
+	t.Helper()
+
+	orig := os.Stdout
+
+	r, w, err := os.Pipe()
+	if err != nil {
+		t.Fatalf("pipe: %v", err)
+	}
+
+	os.Stdout = w
+
+	done := make(chan struct{})
+	buf := &bytes.Buffer{}
+
+	go func() {
+		_, _ = io.Copy(buf, r)
+		close(done)
+	}()
+
+	fn()
+	_ = w.Close()
+
+	os.Stdout = orig
+	<-done
+
+	return buf.String()
+}
+
+func TestRenderSourceTable_AlignsColumnsAndDedupsDisplayName(t *testing.T) {
+	items := []models.SourceItem{
+		// displayName != account → kept as "AUX (AUX IN)"
+		{Source: "AUX", SourceAccount: "AUX", DisplayName: "AUX IN", Status: "READY", IsLocal: true, MultiroomAllowed: true},
+		// displayName == account → dropped (would otherwise duplicate the next column)
+		{Source: "AMAZON", SourceAccount: "amzn1.account.AFKTQOUNVZL7ODQCF4STPAAMVMPA", DisplayName: "amzn1.account.AFKTQOUNVZL7ODQCF4STPAAMVMPA", Status: "READY", MultiroomAllowed: true},
+		// No displayName at all, no account
+		{Source: "BLUETOOTH", Status: "UNAVAILABLE", IsLocal: true, MultiroomAllowed: true},
+		// Long source name, no catalog entry → provider#?
+		{Source: "STORED_MUSIC_MEDIA_RENDERER", SourceAccount: "StoredMusicUserName", DisplayName: "StoredMusicUserName", Status: "UNAVAILABLE", MultiroomAllowed: true},
+	}
+
+	out := captureStdout(t, func() { renderSourceTable(items) })
+
+	lines := strings.Split(strings.TrimRight(out, "\n"), "\n")
+	if len(lines) != 4 {
+		t.Fatalf("got %d output lines, want 4:\n%s", len(lines), out)
+	}
+
+	// (1) AUX keeps "(AUX IN)" because it differs from both source and account.
+	if !strings.Contains(lines[0], "AUX (AUX IN)") {
+		t.Errorf("AUX line should keep displayName parenthesis: %q", lines[0])
+	}
+
+	// (2) AMAZON drops "(amzn1…)" because displayName equals sourceAccount.
+	if strings.Contains(lines[1], "(amzn1.account") {
+		t.Errorf("AMAZON line should drop displayName when it duplicates account: %q", lines[1])
+	}
+
+	// (3) provider#? for the uncatalogued source.
+	if !strings.Contains(lines[3], "provider#?") {
+		t.Errorf("uncatalogued source should be tagged provider#?: %q", lines[3])
+	}
+
+	// (4) Column starts must align across all rows — find the column index
+	//     where "status=" appears in each line; they should all match.
+	statusCols := make([]int, len(lines))
+	for i, l := range lines {
+		statusCols[i] = strings.Index(l, "status=")
+		if statusCols[i] < 0 {
+			t.Fatalf("line %d missing status= column: %q", i, l)
+		}
+	}
+
+	for i := 1; i < len(statusCols); i++ {
+		if statusCols[i] != statusCols[0] {
+			t.Errorf("status= column misaligned: line 0 at col %d, line %d at col %d\n%s",
+				statusCols[0], i, statusCols[i], out)
+		}
+	}
+
+	// (5) account= column should likewise align across all rows.
+	accountCols := make([]int, len(lines))
+	for i, l := range lines {
+		accountCols[i] = strings.Index(l, "account=")
+		if accountCols[i] < 0 {
+			t.Fatalf("line %d missing account= column: %q", i, l)
+		}
+	}
+
+	for i := 1; i < len(accountCols); i++ {
+		if accountCols[i] != accountCols[0] {
+			t.Errorf("account= column misaligned: line 0 at col %d, line %d at col %d\n%s",
+				accountCols[0], i, accountCols[i], out)
+		}
+	}
+}
+
+func TestRenderSourceTable_EmptyShowsNonePlaceholder(t *testing.T) {
+	out := captureStdout(t, func() { renderSourceTable(nil) })
+	if !strings.Contains(out, "(none)") {
+		t.Errorf("expected (none) placeholder for empty list, got: %q", out)
+	}
+}
+
+func TestRecommendMigrationMethod_PrefersTelnet(t *testing.T) {
+	method, reason := recommendMigrationMethod("http://aftertouch.local:8000", &setup.MigrationSummary{
+		TelnetReachable: true,
+		SSHSuccess:      true,
+	})
+
+	if method != setup.MigrationMethodTelnet {
+		t.Errorf("method = %q, want telnet (simplest path when telnet works)", method)
+	}
+
+	if !strings.Contains(reason, "Telnet") {
+		t.Errorf("reason should mention Telnet: %q", reason)
+	}
+}
+
+func TestRecommendMigrationMethod_HTTPSAddsCaveatToTelnet(t *testing.T) {
+	_, reason := recommendMigrationMethod("https://aftertouch.local:8443", &setup.MigrationSummary{
+		TelnetReachable: true,
+	})
+
+	if !strings.Contains(reason, "install-ca") {
+		t.Errorf("HTTPS service URL should flag the CA-install caveat in the reason: %q", reason)
+	}
+}
+
+func TestRecommendMigrationMethod_FallsBackToResolvWhenTelnetDown(t *testing.T) {
+	method, _ := recommendMigrationMethod("http://aftertouch.local:8000", &setup.MigrationSummary{
+		TelnetReachable: false,
+		SSHSuccess:      true,
+	})
+
+	if method != setup.MigrationMethodResolvConf {
+		t.Errorf("method = %q, want resolv (DNS redirect via SSH)", method)
+	}
+}
+
+func TestRecommendMigrationMethod_EmptyWhenNoTransport(t *testing.T) {
+	method, _ := recommendMigrationMethod("http://aftertouch.local:8000", &setup.MigrationSummary{
+		TelnetReachable: false,
+		SSHSuccess:      false,
+	})
+
+	if method != "" {
+		t.Errorf("method = %q, want empty when no transport works", method)
+	}
+}
+
+func TestBuildPlanSteps_NoOpWhenAlreadyMigratedAndPaired(t *testing.T) {
+	summary := &setup.MigrationSummary{IsMigrated: true, IsPaired: true, TelnetMigrated: true}
+	inspect := &setup.InspectReport{Info: &setup.DeviceInfoXML{DeviceID: "AABBCCDDEEFF"}}
+
+	steps := buildPlanSteps("192.168.1.42", "http://aftertouch.local:8000", "", true, false, inspect, summary)
+
+	if len(steps) != 0 {
+		t.Errorf("expected no steps for fully-set-up device, got %d:\n%v", len(steps), steps)
+	}
+}
+
+func TestBuildPlanSteps_RecommendsPairWhenMigratedButUnpaired(t *testing.T) {
+	summary := &setup.MigrationSummary{IsMigrated: true, IsPaired: false, TelnetMigrated: true, TelnetReachable: true}
+	inspect := &setup.InspectReport{Info: &setup.DeviceInfoXML{DeviceID: "AABBCCDDEEFF"}}
+
+	steps := buildPlanSteps("192.168.1.42", "http://aftertouch.local:8000", "", true, false, inspect, summary)
+
+	if len(steps) != 1 {
+		t.Fatalf("expected exactly the pair step, got %d:\n%v", len(steps), steps)
+	}
+
+	if !strings.Contains(steps[0].cmd, "setup pair") {
+		t.Errorf("expected pair command, got %q", steps[0].cmd)
+	}
+}
+
+func TestBuildPlanSteps_MigrateRebootThenPairWhenFresh(t *testing.T) {
+	summary := &setup.MigrationSummary{TelnetReachable: true, SSHSuccess: false, IsPaired: false}
+	inspect := &setup.InspectReport{Info: &setup.DeviceInfoXML{DeviceID: "AABBCCDDEEFF"}}
+
+	steps := buildPlanSteps("192.168.1.42", "http://aftertouch.local:8000", "", true, false, inspect, summary)
+
+	// migrate → reboot → pair. The reboot step exists because envswitch's
+	// parallel-persistence layer only fully wins on the next boot, and we
+	// want the new URLs locked in before pairing posts to the speaker.
+	if len(steps) != 3 {
+		t.Fatalf("expected migrate+reboot+pair, got %d steps:\n%v", len(steps), steps)
+	}
+
+	if !strings.Contains(steps[0].cmd, "setup migrate") || !strings.Contains(steps[0].cmd, "method=telnet") {
+		t.Errorf("step 1 should be telnet migrate, got %q", steps[0].cmd)
+	}
+
+	if !strings.Contains(steps[1].cmd, "setup reboot") {
+		t.Errorf("step 2 should be reboot, got %q", steps[1].cmd)
+	}
+
+	if !strings.Contains(steps[2].cmd, "setup pair") {
+		t.Errorf("step 3 should be pair, got %q", steps[2].cmd)
+	}
+}
+
+func TestBuildPlanSteps_DNSMethodPrependsCAInstall(t *testing.T) {
+	// Telnet down, SSH up, CA not yet trusted → plan must install-ca
+	// before applying the resolv migration.
+	summary := &setup.MigrationSummary{
+		TelnetReachable: false,
+		SSHSuccess:      true,
+		CACertTrusted:   false,
+		IsPaired:        false,
+	}
+	inspect := &setup.InspectReport{Info: &setup.DeviceInfoXML{DeviceID: "X"}}
+
+	steps := buildPlanSteps("192.168.1.42", "http://aftertouch.local:8000", "", false, false, inspect, summary)
+
+	if len(steps) < 2 {
+		t.Fatalf("expected at least install-ca + migrate, got %d steps:\n%v", len(steps), steps)
+	}
+
+	if !strings.Contains(steps[0].cmd, "install-ca") {
+		t.Errorf("install-ca should come first when DNS method is chosen and CA is not trusted, got %q", steps[0].cmd)
+	}
+
+	if !strings.Contains(steps[1].cmd, "method=resolv") {
+		t.Errorf("step 2 should be resolv migrate, got %q", steps[1].cmd)
+	}
+}
+
+func TestBuildPlanSteps_ResetModeIncludesManualNetworkSwitches(t *testing.T) {
+	inspect := &setup.InspectReport{
+		Info: &setup.DeviceInfoXML{DeviceID: "506583DE4803"},
+		Network: &models.NetworkInformation{
+			Interfaces: models.NetworkInterfaces{
+				Interfaces: []models.NetworkInterface{
+					{Type: "WIFI_INTERFACE", SSID: "MyHomeNetwork"},
+				},
+			},
+		},
+	}
+	summary := &setup.MigrationSummary{IsMigrated: true, IsPaired: true} // doesn't matter in reset mode
+
+	steps := buildPlanSteps("192.168.1.42", "http://aftertouch.local:8000", "", true, true, inspect, summary)
+
+	// Expected sequence in --reset mode:
+	//   factory-reset, manual AP switch, wait-ap, wifi-push, manual home switch,
+	//   wait-online, migrate, pair (8 steps).
+	if len(steps) < 7 {
+		t.Fatalf("expected at least 7 steps in --reset mode, got %d:\n%v", len(steps), steps)
+	}
+
+	manualCount := 0
+	for _, s := range steps {
+		if s.manual {
+			manualCount++
+		}
+	}
+
+	if manualCount < 2 {
+		t.Errorf("expected at least 2 manual steps for the Wi-Fi switches, got %d", manualCount)
+	}
+
+	if !strings.Contains(steps[0].cmd, "factory-reset") {
+		t.Errorf("step 1 must be factory-reset, got %q", steps[0].cmd)
+	}
+
+	// wifi-push step should default to the inspected SSID
+	foundWiFi := false
+
+	for _, s := range steps {
+		if strings.Contains(s.cmd, "wifi-push") && strings.Contains(s.cmd, "MyHomeNetwork") {
+			foundWiFi = true
+			break
+		}
+	}
+
+	if !foundWiFi {
+		t.Errorf("expected wifi-push step to default to inspected SSID 'MyHomeNetwork'")
+	}
+
+	// wait-online --match should use the deviceID suffix
+	foundMatch := false
+
+	for _, s := range steps {
+		if strings.Contains(s.cmd, "wait-online") && strings.Contains(s.cmd, "--match=DE4803") {
+			foundMatch = true
+			break
+		}
+	}
+
+	if !foundMatch {
+		t.Errorf("expected wait-online step to use --match=DE4803 from deviceID suffix")
+	}
+}
@@ -196,7 +196,7 @@ var httpClient = &http.Client{
 }

 func fetchTuneInMetadata(url string) (*Metadata, error) {
-	if !strings.Contains(url, "tunein.com/radio/") {
+	if !strings.Contains(url, "tunein.com/radio/") && !strings.Contains(url, "127.0.0.1") && !strings.Contains(url, "localhost") {
 		return nil, fmt.Errorf("url is not a TuneIn radio URL")
 	}

@@ -256,7 +256,7 @@ func fetchTuneInMetadata(url string) (*Metadata, error) {
 }

 func fetchSpotifyMetadata(url string) (*Metadata, error) {
-	if !strings.Contains(url, "open.spotify.com/") {
+	if !strings.Contains(url, "open.spotify.com/") && !strings.Contains(url, "127.0.0.1") && !strings.Contains(url, "localhost") {
 		return nil, fmt.Errorf("url is not a Spotify URL")
 	}

@@ -7,7 +7,7 @@ import (
 )

 func TestFetchTuneInMetadata(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		html := `
 <!doctype html>
 <html>
@@ -30,23 +30,23 @@ func TestFetchTuneInMetadata(t *testing.T) {

 	defer func() { httpClient = oldClient }()

-	metadata, err := fetchTuneInMetadata("https://tunein.com/radio/WDR-2-Rheinland-1004-s213886/")
+	metadata, err := fetchTuneInMetadata(ts.URL + "/radio/WDR-2-Rheinland-1004-s213886/")
 	if err != nil {
 		t.Fatalf("fetchTuneInMetadata() error = %v", err)
 	}

 	if metadata == nil {
 		t.Fatal("fetchTuneInMetadata() returned nil metadata")
-	}
+	} else {
+		expectedName := "WDR 2 Rheinland"
+		if metadata.Name != expectedName {
+			t.Errorf("metadata.Name = %v, want %v", metadata.Name, expectedName)
+		}

-	expectedName := "WDR 2 Rheinland"
-	if metadata.Name != expectedName {
-		t.Errorf("metadata.Name = %v, want %v", metadata.Name, expectedName)
-	}
-
-	expectedArtwork := "https://cdn-radiotime-logos.tunein.com/s213886g.png"
-	if metadata.Artwork != expectedArtwork {
-		t.Errorf("metadata.Artwork = %v, want %v", metadata.Artwork, expectedArtwork)
+		expectedArtwork := "https://cdn-radiotime-logos.tunein.com/s213886g.png"
+		if metadata.Artwork != expectedArtwork {
+			t.Errorf("metadata.Artwork = %v, want %v", metadata.Artwork, expectedArtwork)
+		}
 	}
 }

@@ -162,7 +162,7 @@ func TestResolveLocationSpotify(t *testing.T) {
 }

 func TestFetchSpotifyMetadata(t *testing.T) {
-	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		html := `
 <!doctype html>
 <html>
@@ -185,22 +185,22 @@ func TestFetchSpotifyMetadata(t *testing.T) {

 	defer func() { httpClient = oldClient }()

-	metadata, err := fetchSpotifyMetadata("https://open.spotify.com/album/7F50uh7oGitmAEScRKV6pD")
+	metadata, err := fetchSpotifyMetadata(ts.URL + "/album/7F50uh7oGitmAEScRKV6pD")
 	if err != nil {
 		t.Fatalf("fetchSpotifyMetadata() error = %v", err)
 	}

 	if metadata == nil {
 		t.Fatal("fetchSpotifyMetadata() returned nil metadata")
-	}
+	} else {
+		expectedName := "Terminal Caribe - Album by Santi & Tuğçe"
+		if metadata.Name != expectedName {
+			t.Errorf("metadata.Name = %v, want %v", metadata.Name, expectedName)
+		}

-	expectedName := "Terminal Caribe - Album by Santi & Tuğçe"
-	if metadata.Name != expectedName {
-		t.Errorf("metadata.Name = %v, want %v", metadata.Name, expectedName)
-	}
-
-	expectedArtwork := "https://i.scdn.co/image/ab67616d0000b273f0e55478f4a15182405bcb47"
-	if metadata.Artwork != expectedArtwork {
-		t.Errorf("metadata.Artwork = %v, want %v", metadata.Artwork, expectedArtwork)
+		expectedArtwork := "https://i.scdn.co/image/ab67616d0000b273f0e55478f4a15182405bcb47"
+		if metadata.Artwork != expectedArtwork {
+			t.Errorf("metadata.Artwork = %v, want %v", metadata.Artwork, expectedArtwork)
+		}
 	}
 }
@@ -1312,6 +1312,19 @@ func main() {
 								},
 								Before: RequireHost,
 							},
+							{
+								Name:   "timezone",
+								Usage:  "Set display timezone (IANA zone, e.g. Europe/Berlin)",
+								Action: setClockDisplayTimezone,
+								Flags: []cli.Flag{
+									&cli.StringFlag{
+										Name:     "tz",
+										Usage:    "IANA timezone identifier (e.g. Europe/Berlin, America/New_York)",
+										Required: true,
+									},
+								},
+								Before: RequireHost,
+							},
 						},
 					},
 				},
@@ -1478,6 +1491,64 @@ func main() {
 					},
 				},
 			},
+			// Stereo-pair (group) commands — ST-10 only
+			{
+				Name:    "group",
+				Aliases: []string{"g"},
+				Usage:   "ST-10 stereo-pair management (left/right channel pairing)",
+				Subcommands: []*cli.Command{
+					{
+						Name:   "status",
+						Usage:  "Show the device's current stereo-pair configuration",
+						Action: getGroupStatus,
+						Before: RequireHost,
+					},
+					{
+						Name:   "create",
+						Usage:  "Form a stereo pair (LEFT speaker becomes master)",
+						Action: createGroup,
+						Flags: []cli.Flag{
+							&cli.StringFlag{
+								Name:     "left",
+								Aliases:  []string{"l"},
+								Usage:    "IP address of the LEFT speaker (will be master)",
+								Required: true,
+							},
+							&cli.StringFlag{
+								Name:     "right",
+								Aliases:  []string{"r"},
+								Usage:    "IP address of the RIGHT speaker",
+								Required: true,
+							},
+							&cli.StringFlag{
+								Name:    "name",
+								Aliases: []string{"n"},
+								Usage:   "Pair name (defaults to \"<left> + <right>\")",
+							},
+						},
+					},
+					{
+						Name:   "rename",
+						Usage:  "Rename the existing stereo pair on the device",
+						Action: renameGroup,
+						Flags: []cli.Flag{
+							&cli.StringFlag{
+								Name:     "name",
+								Aliases:  []string{"n"},
+								Usage:    "New pair name",
+								Required: true,
+							},
+						},
+						Before: RequireHost,
+					},
+					{
+						Name:   "remove",
+						Usage:  "Dissolve the device's stereo pair",
+						Action: removeGroup,
+						Before: RequireHost,
+					},
+				},
+			},
 			// Advanced Audio commands
 			{
 				Name:    "audio",
@@ -2038,6 +2109,30 @@ func main() {
 							},
 						},
 					},
+					{
+						Name:   "pair",
+						Usage:  "Pair the device with a Marge cloud account (Stockholm registration)",
+						Action: pairDevice,
+						Before: RequireHost,
+						Flags: []cli.Flag{
+							&cli.StringFlag{
+								Name:     "id",
+								Usage:    "Marge account ID (e.g., 1234567)",
+								Required: true,
+							},
+							&cli.StringFlag{
+								Name:     "token",
+								Usage:    "User authorization token",
+								Required: true,
+							},
+						},
+					},
+					{
+						Name:   "unpair",
+						Usage:  "Unpair the device from its Marge cloud account",
+						Action: unpairDevice,
+						Before: RequireHost,
+					},
 				},
 			},
 			// Token commands
@@ -2069,7 +2164,7 @@ func main() {
 							&cli.StringFlag{
 								Name:    "filter",
 								Aliases: []string{"f"},
-								Usage:   "Filter events by type (comma-separated): nowPlaying,volume,connection,preset,zone,bass,sdkInfo,userActivity",
+								Usage:   "Filter events by type (comma-separated): nowPlaying,volume,connection,preset,zone,group,bass,sdkInfo,userActivity",
 							},
 							&cli.DurationFlag{
 								Name:    "duration",
@@ -2081,6 +2176,10 @@ func main() {
 								Name:  "no-reconnect",
 								Usage: "Disable automatic reconnection on connection loss",
 							},
+							&cli.StringFlag{
+								Name:  "debug",
+								Usage: "Print raw WebSocket frames to stderr — one of: all, unknown, errors",
+							},
 							&cli.BoolFlag{
 								Name:    "verbose",
 								Aliases: []string{"v"},
@@ -2093,6 +2192,10 @@ func main() {
 		},
 	}

+	// Speaker provisioning (factory-reset, Wi-Fi, URL rewrite, pairing).
+	// Defined in cmd_setup.go to keep the top-level command list readable.
+	app.Commands = append(app.Commands, setupCommand())
+
 	// Sort commands alphabetically (including subcommands and flags recursively)
 	sortCommands(app.Commands)

@@ -19,6 +19,7 @@ import (
 	"time"

 	"github.com/gesellix/bose-soundtouch/pkg/discovery"
+	"github.com/gesellix/bose-soundtouch/pkg/service/amazon"
 	"github.com/gesellix/bose-soundtouch/pkg/service/certmanager"
 	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
 	"github.com/gesellix/bose-soundtouch/pkg/service/handlers"
@@ -34,10 +35,15 @@ var (
 	version = "dev"
 	commit  = "unknown"
 	date    = "unknown"
+	repoURL = "https://github.com/gesellix/bose-soundtouch"
 )

 func updateBuildInfo() {
 	if info, ok := debug.ReadBuildInfo(); ok {
+		if info.Main.Path != "" {
+			repoURL = "https://" + info.Main.Path
+		}
+
 		if info.Main.Version != "" && info.Main.Version != "(devel)" {
 			version = info.Main.Version
 		}
@@ -48,13 +54,124 @@ func updateBuildInfo() {
 				commit = setting.Value
 			case "vcs.time":
 				if t, err := time.Parse(time.RFC3339, setting.Value); err == nil {
-					date = t.Format("2006-01-02_15:04:05")
+					date = t.Format("2006-01-02 15:04:05")
 				}
 			}
 		}
 	}
 }

+func initializeDefaultSources(ds *datastore.DataStore) {
+	// Ensure default sources exist for all known devices on startup
+	allDevices, _ := ds.ListAllDevices()
+	for i := range allDevices {
+		dev := &allDevices[i]
+		if sources, errGet := ds.GetConfiguredSources(dev.AccountID, dev.DeviceID); errGet == nil {
+			log.Printf("Initializing default Sources.xml for existing device %s", dev.DeviceID)
+
+			// Find default sources and merge them if missing or outdated tokens.
+			// claimed tracks which stored sources have already been matched by a default,
+			// so two defaults with the same SourceKeyType but different SourceProviderIDs
+			// (e.g. INTERNET_RADIO/2 and INTERNET_RADIO/39) are treated as distinct entries.
+			defaults := ds.GetDefaultSources()
+			modified := false
+			claimed := make(map[int]bool)
+
+			for i := range defaults {
+				def := defaults[i]
+				foundIdx := -1
+
+				for j := range sources {
+					if claimed[j] || sources[j].SourceKeyType != def.SourceKeyType {
+						continue
+					}
+					// When both sides have a providerID, require it to match.
+					if def.SourceProviderID != "" && sources[j].SourceProviderID != "" && sources[j].SourceProviderID != def.SourceProviderID {
+						continue
+					}
+
+					foundIdx = j
+
+					break
+				}
+
+				if foundIdx >= 0 {
+					claimed[foundIdx] = true
+
+					if sources[foundIdx].Secret == "" && def.Secret != "" {
+						log.Printf("Initializing missing token for source %s on device %s", def.SourceKeyType, dev.DeviceID)
+						sources[foundIdx].Secret = def.Secret
+						sources[foundIdx].SecretType = def.SecretType
+						modified = true
+					}
+				} else {
+					log.Printf("Adding missing default source %s (providerID=%s) to device %s", def.SourceKeyType, def.SourceProviderID, dev.DeviceID)
+					sources = append(sources, def)
+					modified = true
+				}
+			}
+
+			if modified {
+				if errSave := ds.SaveConfiguredSources(dev.AccountID, dev.DeviceID, sources); errSave != nil {
+					log.Printf("Failed to save updated sources for %s: %v", dev.DeviceID, errSave)
+				}
+			}
+		}
+	}
+}
+
+func initMusicServices(config serviceConfig, server *handlers.Server) {
+	if config.spotifyClientID != "" {
+		spotifyService := spotify.NewSpotifyService(
+			config.spotifyClientID,
+			config.spotifyClientSecret,
+			config.spotifyRedirectURI,
+			config.dataDir,
+		)
+		if config.spotifyTokenURL != "" || config.spotifyAPIBase != "" {
+			spotifyService.SetEndpoints(config.spotifyTokenURL, config.spotifyAPIBase)
+		}
+
+		if err := spotifyService.Load(); err != nil {
+			log.Printf("[Spotify] Failed to load accounts: %v", err)
+		}
+
+		server.SetSpotifyService(spotifyService)
+
+		clientIDPrefix := config.spotifyClientID
+		if len(clientIDPrefix) > 8 {
+			clientIDPrefix = clientIDPrefix[:8]
+		}
+
+		log.Printf("Spotify service initialized (client ID: %s...)", clientIDPrefix)
+	}
+
+	if config.amazonClientID != "" {
+		amazonService := amazon.NewAmazonService(
+			config.amazonClientID,
+			config.amazonClientSecret,
+			config.amazonRedirectURI,
+			config.dataDir,
+		)
+		if config.amazonTokenURL != "" || config.amazonProfileURL != "" {
+			amazonService.SetEndpoints(config.amazonTokenURL, config.amazonProfileURL)
+		}
+
+		if err := amazonService.Load(); err != nil {
+			log.Printf("[Amazon] Failed to load accounts: %v", err)
+		}
+
+		server.SetAmazonService(amazonService)
+
+		clientIDPrefix := config.amazonClientID
+		if len(clientIDPrefix) > 8 {
+			clientIDPrefix = clientIDPrefix[:8]
+		}
+
+		log.Printf("Amazon Music service initialized (client ID: %s...)", clientIDPrefix)
+	}
+}
+
 func main() {
 	updateBuildInfo()

@@ -123,6 +240,12 @@ func main() {
 				Value:   true,
 				EnvVars: []string{"RECORD_INTERACTIONS"},
 			},
+			&cli.BoolFlag{
+				Name:    "discovery-enabled",
+				Usage:   "Enable periodic device discovery",
+				Value:   true,
+				EnvVars: []string{"DISCOVERY_ENABLED"},
+			},
 			&cli.StringFlag{
 				Name:    "discovery-interval",
 				Usage:   "Device discovery interval",
@@ -158,10 +281,44 @@ func main() {
 			},
 			&cli.StringFlag{
 				Name:    "spotify-redirect-uri",
-				Usage:   "Spotify OAuth redirect URI",
-				Value:   "ueberboese-login://spotify",
+				Usage:   "Spotify OAuth redirect URI (defaults to <server-url>/mgmt/spotify/callback)",
 				EnvVars: []string{"SPOTIFY_REDIRECT_URI"},
 			},
+			&cli.StringFlag{
+				Name:    "spotify-token-url",
+				Usage:   "Spotify OAuth token URL (for testing)",
+				EnvVars: []string{"SPOTIFY_TOKEN_URL"},
+			},
+			&cli.StringFlag{
+				Name:    "spotify-api-base",
+				Usage:   "Spotify API base URL (for testing)",
+				EnvVars: []string{"SPOTIFY_API_BASE"},
+			},
+			&cli.StringFlag{
+				Name:    "amazon-client-id",
+				Usage:   "Amazon LWA OAuth client ID",
+				EnvVars: []string{"AMAZON_CLIENT_ID"},
+			},
+			&cli.StringFlag{
+				Name:    "amazon-client-secret",
+				Usage:   "Amazon LWA OAuth client secret",
+				EnvVars: []string{"AMAZON_CLIENT_SECRET"},
+			},
+			&cli.StringFlag{
+				Name:    "amazon-redirect-uri",
+				Usage:   "Amazon LWA OAuth redirect URI (defaults to <server-url>/mgmt/amazon/callback)",
+				EnvVars: []string{"AMAZON_REDIRECT_URI"},
+			},
+			&cli.StringFlag{
+				Name:    "amazon-token-url",
+				Usage:   "Amazon LWA token URL (for testing)",
+				EnvVars: []string{"AMAZON_TOKEN_URL"},
+			},
+			&cli.StringFlag{
+				Name:    "amazon-profile-url",
+				Usage:   "Amazon LWA profile URL (for testing)",
+				EnvVars: []string{"AMAZON_PROFILE_URL"},
+			},
 			&cli.StringFlag{
 				Name:    "mgmt-username",
 				Usage:   "Management API username for HTTP Basic Auth",
@@ -189,6 +346,11 @@ func main() {
 				Usage:   "Endpoints to mirror to Bose Cloud (comma-separated or multiple flags)",
 				EnvVars: []string{"MIRROR_ENDPOINTS"},
 			},
+			&cli.StringSliceFlag{
+				Name:    "skip-mirror-endpoints",
+				Usage:   "Endpoints to skip mirroring to Bose Cloud (comma-separated or multiple flags)",
+				EnvVars: []string{"SKIP_MIRROR_ENDPOINTS"},
+			},
 			&cli.StringSliceFlag{
 				Name:    "internal-paths",
 				Usage:   "Paths for internal requests (comma-separated or multiple flags)",
@@ -231,37 +393,23 @@ func main() {

 			config.domains = getDomains(config.serverURL, config.httpsServerURL, hostname)

-			cm := initCertificateManager(config.dataDir)
+			cm := initCertificateManager(config.dataDir, config.hostname)
 			sm := setup.NewManager(config.serverURL, ds, cm)
 			sm.MgmtUsername = config.mgmtUsername
 			sm.MgmtPassword = config.mgmtPassword
 			server := handlers.NewServer(ds, sm, config.serverURL, config.redact, config.logBody, config.record)
 			sm.GetDNSRunning = server.GetDNSRunning
 			server.SetHTTPServerURL(config.httpsServerURL)
-			server.SetVersionInfo(version, commit, date)
-			server.SetDiscoverySettings(config.discoveryInterval, persisted.DiscoveryEnabled)
+			server.SetVersionInfo(version, commit, date, repoURL)
+			server.SetDiscoverySettings(config.discoveryInterval, config.discoveryEnabled)
 			server.SetDNSSettings(persisted.DNSEnabled, strings.Join(persisted.DNSUpstream, ","), persisted.DNSBindAddr)
-			server.SetMirrorSettings(persisted.MirrorEnabled, persisted.MirrorEndpoints, persisted.PreferredSource)
+			server.SetMirrorSettings(persisted.MirrorEnabled, persisted.MirrorEndpoints, persisted.SkipMirrorEndpoints, persisted.PreferredSource)
 			server.SetInternalPaths(persisted.InternalPaths)
 			server.SetSpotifyConfig(config.spotifyClientID, config.spotifyClientSecret, config.spotifyRedirectURI)
+			server.SetAmazonConfig(config.amazonClientID, config.amazonClientSecret, config.amazonRedirectURI)
 			server.SetMgmtConfig(config.mgmtUsername, config.mgmtPassword)

-			if config.spotifyClientID != "" {
-				spotifyService := spotify.NewSpotifyService(
-					config.spotifyClientID,
-					config.spotifyClientSecret,
-					config.spotifyRedirectURI,
-					config.dataDir,
-				)
-				server.SetSpotifyService(spotifyService)
-
-				clientIDPrefix := config.spotifyClientID
-				if len(clientIDPrefix) > 8 {
-					clientIDPrefix = clientIDPrefix[:8]
-				}
-
-				log.Printf("Spotify service initialized (client ID: %s...)", clientIDPrefix)
-			}
+			initMusicServices(config, server)

 			// Load and set initial DNS discoveries
 			dnsDiscoveries, err := ds.LoadDNSDiscoveries()
@@ -316,10 +464,7 @@ func main() {

 			server.SetRecorder(recorder)

-			tlsConfig, err := cm.GetServerTLSConfig(config.domains)
-			if err != nil {
-				log.Printf("Warning: Failed to setup TLS: %v", err)
-			}
+			initializeDefaultSources(ds)

 			startDeviceDiscovery(server)

@@ -327,9 +472,21 @@ func main() {

 			log.Printf("Go service starting on %s", config.serverURL)

-			if tlsConfig != nil {
+			// TLS cert generation can be slow on constrained hardware; run it in the
+			// background so the HTTP server is available immediately.
+			log.Printf("HTTPS setup running in background; %s will be available shortly", config.httpsServerURL)
+
+			go func() {
+				tlsConfig, err := cm.GetServerTLSConfig(config.domains)
+				if err != nil {
+					log.Printf("Warning: Failed to setup TLS: %v", err)
+					return
+				}
+
 				startHTTPSServer(config.httpsAddr, r, tlsConfig, config.httpsServerURL)
-			}
+
+				runHTTPSPreflight(config.httpsServerURL, config.serverURL, config.dnsEnabled, server.ResolveServerURLIPForPreflight)
+			}()

 			return http.ListenAndServe(config.addr, r)
 		},
@@ -363,6 +520,7 @@ type serviceConfig struct {
 	bindAddr            string
 	addr                string
 	dataDir             string
+	hostname            string
 	serverURL           string
 	httpsServerURL      string
 	httpsAddr           string
@@ -374,12 +532,21 @@ type serviceConfig struct {
 	dnsBind             string
 	mirrorEnabled       bool
 	mirrorEndpoints     []string
+	skipMirrorEndpoints []string
 	internalPaths       []string
+	discoveryEnabled    bool
 	discoveryInterval   time.Duration
 	domains             []string
 	spotifyClientID     string
 	spotifyClientSecret string
 	spotifyRedirectURI  string
+	spotifyTokenURL     string
+	spotifyAPIBase      string
+	amazonClientID      string
+	amazonClientSecret  string
+	amazonRedirectURI   string
+	amazonTokenURL      string
+	amazonProfileURL    string
 	mgmtUsername        string
 	mgmtPassword        string
 	migrationEnabled    bool
@@ -432,6 +599,7 @@ func loadConfig(c *cli.Context) serviceConfig {
 	dnsUpstream := c.String("dns-upstream")
 	dnsBind := c.String("dns-bind")

+	discoveryEnabled := c.Bool("discovery-enabled")
 	discoveryIntervalStr := c.String("discovery-interval")

 	discoveryInterval, err := time.ParseDuration(discoveryIntervalStr)
@@ -444,10 +612,18 @@ func loadConfig(c *cli.Context) serviceConfig {
 	spotifyClientID := c.String("spotify-client-id")
 	spotifyClientSecret := c.String("spotify-client-secret")
 	spotifyRedirectURI := c.String("spotify-redirect-uri")
+	spotifyTokenURL := c.String("spotify-token-url")
+	spotifyAPIBase := c.String("spotify-api-base")
+	amazonClientID := c.String("amazon-client-id")
+	amazonClientSecret := c.String("amazon-client-secret")
+	amazonRedirectURI := c.String("amazon-redirect-uri")
+	amazonTokenURL := c.String("amazon-token-url")
+	amazonProfileURL := c.String("amazon-profile-url")
 	mgmtUsername := c.String("mgmt-username")
 	mgmtPassword := c.String("mgmt-password")
 	mirrorEnabled := c.Bool("mirror-enabled")
 	mirrorEndpoints := c.StringSlice("mirror-endpoints")
+	skipMirrorEndpoints := c.StringSlice("skip-mirror-endpoints")
 	internalPaths := c.StringSlice("internal-paths")
 	migrationEnabled := c.Bool("migration-enabled")
 	migrationDryRun := c.Bool("migration-dry-run")
@@ -458,6 +634,7 @@ func loadConfig(c *cli.Context) serviceConfig {
 		bindAddr:            bindAddr,
 		addr:                addr,
 		dataDir:             dataDir,
+		hostname:            hostname,
 		serverURL:           serverURL,
 		httpsServerURL:      httpsServerURL,
 		httpsAddr:           httpsAddr,
@@ -469,12 +646,21 @@ func loadConfig(c *cli.Context) serviceConfig {
 		dnsBind:             dnsBind,
 		mirrorEnabled:       mirrorEnabled,
 		mirrorEndpoints:     mirrorEndpoints,
+		skipMirrorEndpoints: skipMirrorEndpoints,
 		internalPaths:       internalPaths,
+		discoveryEnabled:    discoveryEnabled,
 		discoveryInterval:   discoveryInterval,
 		domains:             domains,
 		spotifyClientID:     spotifyClientID,
 		spotifyClientSecret: spotifyClientSecret,
 		spotifyRedirectURI:  spotifyRedirectURI,
+		spotifyTokenURL:     spotifyTokenURL,
+		spotifyAPIBase:      spotifyAPIBase,
+		amazonClientID:      amazonClientID,
+		amazonClientSecret:  amazonClientSecret,
+		amazonRedirectURI:   amazonRedirectURI,
+		amazonTokenURL:      amazonTokenURL,
+		amazonProfileURL:    amazonProfileURL,
 		mgmtUsername:        mgmtUsername,
 		mgmtPassword:        mgmtPassword,
 		migrationEnabled:    migrationEnabled,
@@ -500,6 +686,7 @@ func getDomains(serverURL, httpsServerURL, hostname string) []string {
 		"bose.io":                 true,
 		"bose-prod.apigee.net":    true,
 		"bose-test.apigee.net":    true,
+		"downloads.bose.com":      true,
 		// Local service domains
 		setup.TestDomain: true,
 		hostname:         true,
@@ -544,6 +731,7 @@ func applyPersistedSettings(ds *datastore.DataStore, config *serviceConfig) data
 		config.httpsServerURL = persisted.HTTPServerURL
 	}

+	config.discoveryEnabled = persisted.DiscoveryEnabled
 	if persisted.DiscoveryInterval != "" {
 		if d, durErr := time.ParseDuration(persisted.DiscoveryInterval); durErr == nil {
 			config.discoveryInterval = d
@@ -565,28 +753,61 @@ func applyPersistedSettings(ds *datastore.DataStore, config *serviceConfig) data

 	config.mirrorEnabled = persisted.MirrorEnabled
 	config.mirrorEndpoints = persisted.MirrorEndpoints
+	config.skipMirrorEndpoints = persisted.SkipMirrorEndpoints
 	config.preferredSource = persisted.PreferredSource
 	config.internalPaths = persisted.InternalPaths

+	// CLI/env args take precedence; only apply persisted credentials when not set via CLI.
+	applyPersistedMusicServiceCredentials(config, persisted)
+
 	return persisted
 }

+// applyPersistedMusicServiceCredentials fills in music service credentials from persisted
+// settings when they have not been supplied via CLI flags or environment variables.
+func applyPersistedMusicServiceCredentials(config *serviceConfig, persisted datastore.Settings) {
+	if config.spotifyClientID == "" {
+		config.spotifyClientID = persisted.SpotifyClientID
+	}
+
+	if config.spotifyClientSecret == "" {
+		config.spotifyClientSecret = persisted.SpotifyClientSecret
+	}
+
+	if config.spotifyRedirectURI == "" {
+		config.spotifyRedirectURI = persisted.SpotifyRedirectURI
+	}
+
+	if config.amazonClientID == "" {
+		config.amazonClientID = persisted.AmazonClientID
+	}
+
+	if config.amazonClientSecret == "" {
+		config.amazonClientSecret = persisted.AmazonClientSecret
+	}
+
+	if config.amazonRedirectURI == "" {
+		config.amazonRedirectURI = persisted.AmazonRedirectURI
+	}
+}
+
 func createDefaultSettings(ds *datastore.DataStore, config serviceConfig) datastore.Settings {
 	settings := datastore.Settings{
-		ServerURL:          config.serverURL,
-		HTTPServerURL:      config.httpsServerURL,
-		RedactLogs:         config.redact,
-		LogBodies:          config.logBody,
-		RecordInteractions: config.record,
-		DiscoveryInterval:  config.discoveryInterval.String(),
-		DiscoveryEnabled:   true,
-		DNSEnabled:         config.dnsEnabled,
-		DNSUpstream:        strings.Split(config.dnsUpstream, ","),
-		DNSBindAddr:        config.dnsBind,
-		MirrorEnabled:      config.mirrorEnabled,
-		MirrorEndpoints:    config.mirrorEndpoints,
-		PreferredSource:    config.preferredSource,
-		InternalPaths:      config.internalPaths,
+		ServerURL:           config.serverURL,
+		HTTPServerURL:       config.httpsServerURL,
+		RedactLogs:          config.redact,
+		LogBodies:           config.logBody,
+		RecordInteractions:  config.record,
+		DiscoveryEnabled:    config.discoveryEnabled,
+		DiscoveryInterval:   config.discoveryInterval.String(),
+		DNSEnabled:          config.dnsEnabled,
+		DNSUpstream:         strings.Split(config.dnsUpstream, ","),
+		DNSBindAddr:         config.dnsBind,
+		MirrorEnabled:       config.mirrorEnabled,
+		MirrorEndpoints:     config.mirrorEndpoints,
+		SkipMirrorEndpoints: config.skipMirrorEndpoints,
+		PreferredSource:     config.preferredSource,
+		InternalPaths:       config.internalPaths,
 		Shortcuts: map[string]int{
 			"/.well-known/appspecific/com.chrome.devtools.json": http.StatusNotFound,
 			"/sw.js": http.StatusNotFound,
@@ -607,8 +828,10 @@ func initDataStore(dataDir string) *datastore.DataStore {
 	return ds
 }

-func initCertificateManager(dataDir string) *certmanager.CertificateManager {
+func initCertificateManager(dataDir, hostname string) *certmanager.CertificateManager {
 	cm := certmanager.NewCertificateManager(filepath.Join(dataDir, "certs"))
+
+	cm.CommonName = hostname
 	if err := cm.EnsureCA(); err != nil {
 		log.Printf("Warning: Failed to ensure CA: %v", err)
 	}
@@ -631,90 +854,184 @@ func startDeviceDiscovery(server *handlers.Server) {

 func setupRouter(server *handlers.Server) *chi.Mux {
 	r := chi.NewRouter()
+
+	// TrustedRealIP must run before any handler that reads r.RemoteAddr —
+	// SnapshotMiddleware captures the request, and several handlers
+	// (HandleMargePowerOn, etc.) inspect the source IP. The middleware is
+	// gated on Settings.TrustForwardedHeaders; when off (the safe default),
+	// it returns nil and we skip Use'ing it entirely.
+	if mw := server.TrustedRealIPMiddleware(); mw != nil {
+		r.Use(mw)
+	}
+
 	r.Use(server.SnapshotMiddleware)
 	r.Use(server.OriginMiddleware)
 	r.Use(middleware.Recoverer)
+	r.Use(server.PeerObserverMiddleware)
 	r.Use(server.ShortcutMiddleware)
 	r.Use(server.MirrorMiddleware)
 	r.Use(server.RecordMiddleware)

 	r.Get("/", server.HandleRoot)
 	r.Get("/health", server.HandleHealth)
+	// Passive peer-reachability probe. Registers a device IP with the
+	// in-process observer, nudges :8090/swUpdateCheck, and waits for
+	// any inbound from that IP. Used post-migration where the daemon
+	// caches its swUpdateUrl at boot and the active round-trip can't
+	// reach it without a reboot.
+	r.Post("/setup/peer-probe/{deviceId}", server.HandlePeerProbe)
 	r.Get("/favicon.ico", func(w http.ResponseWriter, r *http.Request) {
 		r.URL.Path = "/media/favicon-braille.svg"
 		server.HandleMedia()(w, r)
 	})

 	r.Get("/media/*", server.HandleMedia())
+	r.Get("/bmx-icons/*", server.HandleBmxIcons())
+	r.Get("/ced/*", server.HandleCedStatic())
 	r.Get("/web/*", server.HandleWeb())
+	r.Post("/alexa/certificate", server.HandleAlexaCertificate)
 	r.Get("/docs/*", server.HandleDocs)

 	r.Route("/bmx", func(r chi.Router) {
 		r.Get("/registry/v1/services", server.HandleBMXRegistry)
-		r.Get("/tunein/v1/playback/station/{stationID}", server.HandleTuneInPlayback)
-		r.Get("/tunein/v1/playback/episodes/{podcastID}", server.HandleTuneInPodcastInfo)
-		r.Get("/tunein/v1/playback/episode/{podcastID}", server.HandleTuneInPlaybackPodcast)
-		r.Post("/orion/v1/playback/station/{data}", server.HandleOrionPlayback)
+		r.Get("/registry/v1/servicesAvailability", server.HandleBMXServicesAvailability)
+
+		r.Route("/tunein", func(r chi.Router) {
+			r.Get("/v1/playback/station/{stationID}", server.HandleTuneInPlayback)
+			r.Get("/v1/playback/episodes/{podcastID}", server.HandleTuneInPodcastInfo)
+			r.Get("/v1/playback/episode/{podcastID}", server.HandleTuneInPlaybackPodcast)
+			r.Post("/v1/token", server.HandleTuneInToken)
+			r.Post("/v1/report", server.HandleTuneInReport)
+			r.Get("/v1/navigate", server.HandleTuneInNavigate)
+			r.Get("/v1/navigate/*", server.HandleTuneInNavigate)
+			r.Get("/v1/search", server.HandleTuneInSearch)
+			r.Post("/v1/favorite/{stationID}", server.HandleTuneInFavorite)
+			r.Delete("/v1/favorite/{stationID}", server.HandleTuneInDeleteFavorite)
+		})
 	})

-	// Legacy or direct domain calls without /bmx prefix
-	r.Get("/registry/v1/services", server.HandleBMXRegistry)
-	r.Get("/tunein/v1/playback/station/{stationID}", server.HandleTuneInPlayback)
-	r.Get("/tunein/v1/playback/episodes/{podcastID}", server.HandleTuneInPodcastInfo)
-	r.Get("/tunein/v1/playback/episode/{podcastID}", server.HandleTuneInPlaybackPodcast)
-	r.Post("/orion/v1/playback/station/{data}", server.HandleOrionPlayback)
+	// Orion (LOCAL_INTERNET_RADIO) lives at the top level — the BMX registry
+	// advertises baseUrl `{BMX_SERVER}/core02/svc-bmx-adapter-orion/prod/orion`
+	// (no `/bmx/` prefix; verified against the upstream capture in
+	// pkg/service/handlers/static/bmx_services_ustream.json), so speakers
+	// reach the token + station endpoints at exactly these paths under
+	// either DNS-interception or URL-flip migration.
+	r.Post("/core02/svc-bmx-adapter-orion/prod/orion/token", server.HandleOrionToken)
+	r.Get("/core02/svc-bmx-adapter-orion/prod/orion/station", server.HandleOrionPlayback)
+
 	r.Get("/custom/v1/playback/{encodedURL}", server.HandleCustomPlayback)

-	streamingRoutes := func(r chi.Router) {
+	r.Route("/streaming", func(r chi.Router) {
 		r.Get("/sourceproviders", server.HandleMargeSourceProviders)
-		r.Get("/account/{account}/device/{device}/recent", server.HandleMargeRecents)
-		r.Post("/account/{account}/device/{device}/recent", server.HandleMargeAddRecent)
-		r.Get("/account/{account}/device/{device}/presets", server.HandleMargePresets)
-		r.Post("/account/{account}/device/{device}/presets/{presetNumber}", server.HandleMargeUpdatePreset)
-		r.Post("/support/power_on", server.HandleMargePowerOn)
-		r.Get("/account/{account}/provider_settings", server.HandleMargeProviderSettings)
+		r.Post("/account", server.HandleMargeCreateAccount)
+		r.Post("/account/login", server.HandleMargeLogin)
+		r.Post("/account/{account}/source", server.HandleMargeAddSource)
+
+		r.Route("/account/{account}", func(r chi.Router) {
+			r.Get("/emailaddress", server.HandleMargeGetEmailAddress)
+			r.Get("/full", server.HandleMargeAccountFull)
+			r.Get("/sources", server.HandleMargeAccountSources)
+			r.Get("/devices", server.HandleMargeAccountDevices)
+			r.Get("/presets", server.HandleMargeAccountPresets)
+			r.Get("/presets/all", server.HandleMargeAccountPresets)
+			r.Get("/provider_settings", server.HandleMargeProviderSettings)
+
+			// All `/device` routes share one chi subrouter. Two
+			// overlapping subrouters (`/device` + `/device/{device}`)
+			// caused chi's radix-tree resolver to bind a runtime
+			// request to the more-specific prefix even when only the
+			// less-specific subrouter had a matching method handler,
+			// producing the [UNHANDLED] → upstream-proxy fall-through
+			// behind issue #285's first-attempted fix. One subrouter
+			// keeps every device-scoped path resolvable; see
+			// TestPUTRenameRoutesToLocalHandler for the regression
+			// against the production router.
+			r.Route("/device", func(r chi.Router) {
+				r.Post("/", server.HandleMargeAddDevice)
+				r.Post("/{device}", server.HandleMargeAddDevice)
+				// PUT is the rename / update path — speakers fire
+				// this against PUT /streaming/account/{a}/device/{d}
+				// when the user renames via Bose App or
+				// `soundtouch-cli name set`. Issue #285.
+				r.Put("/{device}", server.HandleMargeUpdateDevice)
+				r.Delete("/{device}", server.HandleMargeRemoveDevice)
+
+				r.Get("/{device}/presets", server.HandleMargePresets)
+				r.Post("/{device}/presets/{presetNumber}", server.HandleMargeUpdatePreset)
+				r.Put("/{device}/preset/{presetNumber}", server.HandleMargeUpdatePreset)
+				r.Delete("/{device}/preset/{presetNumber}", server.HandleMargeRemovePreset)
+				r.Get("/{device}/recent", server.HandleMargeRecents)
+				r.Get("/{device}/recents", server.HandleMargeRecents)
+				r.Post("/{device}/recent", server.HandleMargeAddRecent)
+
+				r.Get("/{device}/group", server.HandleMargeDeviceGroup)
+				r.Get("/{device}/group/", server.HandleMargeDeviceGroup)
+				r.Get("/{device}/group/server", server.HandleMargeDeviceGroupServer)
+				r.Get("/{device}/group/member", server.HandleMargeDeviceGroupMember)
+			})
+
+			// Speakers POST to /group/ (with trailing slash) when forwarding
+			// the addGroup payload to Marge during stereo-pair formation --
+			// see issue #252. Register both forms so chi accepts either.
+			r.Post("/group", server.HandleMargeAddGroup)
+			r.Post("/group/", server.HandleMargeAddGroup)
+			r.Post("/group/{groupId}", server.HandleMargeModifyGroup)
+			r.Delete("/group/{groupId}", server.HandleMargeDeleteGroup)
+		})
+
 		r.Get("/device/{device}/streaming_token", server.HandleMargeStreamingToken)
-		r.Post("/support/customersupport", server.HandleMargeCustomerSupport)
+
 		r.Get("/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeGetDeviceSettings)
-		r.Get("/account/{account}/device/{device}/group", server.HandleMargeDeviceGroup)
-		r.Get("/account/{account}/device/{device}/group/", server.HandleMargeDeviceGroup)
-		r.Get("/account/{account}/device/{device}/group/server", server.HandleMargeDeviceGroupServer)
-		r.Get("/account/{account}/device/{device}/group/member", server.HandleMargeDeviceGroupMember)
 		r.Post("/device_setting/account/{account}/device/{device}/device_settings", server.HandleMargeUpdateDeviceSettings)
-		r.Get("/account/{account}/emailaddress", server.HandleMargeGetEmailAddress)
-		r.Get("/account/{account}/full", server.HandleMargeAccountFull)
+
 		r.Get("/software/update/account/{account}", server.HandleMargeSoftwareUpdate)

+		r.Route("/support", func(r chi.Router) {
+			r.Post("/power_on", server.HandleMargePowerOn)
+			r.Post("/customersupport", server.HandleMargeCustomerSupport)
+		})
+
 		r.Route("/stats", func(r chi.Router) {
 			r.Post("/usage", server.HandleUsageStats)
 			r.Post("/error", server.HandleErrorStats)
 		})
-	}

-	accountsRoutes := func(r chi.Router) {
-		r.Get("/{account}/full", server.HandleMargeAccountFull)
-		r.Get("/{account}/devices/{device}/presets", server.HandleMargePresets)
-		r.Post("/{account}/devices/{device}/presets/{presetNumber}", server.HandleMargeUpdatePreset)
-		r.Get("/{account}/devices/{device}/recents", server.HandleMargeRecents)
-		r.Post("/{account}/devices/{device}/recents", server.HandleMargeAddRecent)
-		r.Post("/{account}/devices", server.HandleMargeAddDevice)
-		r.Delete("/{account}/devices/{device}", server.HandleMargeRemoveDevice)
-		r.Get("/{account}/devices/{device}/group", server.HandleMargeDeviceGroup)
-		r.Get("/{account}/devices/{device}/group/", server.HandleMargeDeviceGroup)
-		r.Get("/{account}/devices/{device}/group/server", server.HandleMargeDeviceGroupServer)
-		r.Get("/{account}/devices/{device}/group/member", server.HandleMargeDeviceGroupMember)
-	}
+		r.Route("/music", func(r chi.Router) {
+			r.Route("/musicprovider/{providerID}", func(r chi.Router) {
+				r.Post("/is_eligible", server.HandleMusicProviderIsEligible)
+				r.Post("/trial/is_eligible", server.HandleMusicProviderIsEligible)
+			})
+		})

-	r.Route("/marge", func(r chi.Router) {
-		r.Route("/streaming", streamingRoutes)
-		r.Route("/accounts", accountsRoutes)
+		r.Get("/resources/api_versions.xml", server.HandleMargeAPIVersions)
+	})

-		r.Get("/updates/soundtouch", server.HandleMargeSoftwareUpdate)
+	r.Route("/accounts", func(r chi.Router) {
+		r.Route("/{account}", func(r chi.Router) {
+			r.Get("/full", server.HandleMargeAccountFull)
+			r.Get("/sources", server.HandleMargeAccountSources)
+			r.Get("/devices", server.HandleMargeAccountDevices)
+
+			r.Post("/devices", server.HandleMargeAddDevice)
+
+			r.Delete("/devices/{device}", server.HandleMargeRemoveDevice)
+			r.Get("/devices/{device}/group", server.HandleMargeDeviceGroup)
+			r.Get("/devices/{device}/group/", server.HandleMargeDeviceGroup)
+			r.Get("/devices/{device}/group/server", server.HandleMargeDeviceGroupServer)
+			r.Get("/devices/{device}/group/member", server.HandleMargeDeviceGroupMember)
+
+			r.Post("/group", server.HandleMargeAddGroup)
+			r.Post("/group/", server.HandleMargeAddGroup)
+			r.Post("/group/{groupId}", server.HandleMargeModifyGroup)
+			r.Delete("/group/{groupId}", server.HandleMargeDeleteGroup)
+			r.Get("/devices/{device}/presets", server.HandleMargePresets)
+			r.Get("/devices/{device}/recents", server.HandleMargeRecents)
+
+			r.Post("/devices/{device}/presets/{presetNumber}", server.HandleMargeUpdatePreset)
+			r.Post("/devices/{device}/recents", server.HandleMargeAddRecent)
+		})
 	})

-	// Legacy or direct domain calls without /marge prefix
-	r.Route("/streaming", streamingRoutes)
-	r.Route("/accounts", accountsRoutes)
 	r.Get("/updates/soundtouch", server.HandleMargeSoftwareUpdate)

 	r.Route("/customer", func(r chi.Router) {
@@ -724,33 +1041,59 @@ func setupRouter(server *handlers.Server) *chi.Mux {
 	})

 	r.Route("/oauth", func(r chi.Router) {
-		r.Post("/device/{deviceID}/music/musicprovider/15/token/cs3", server.HandleBoseSpotifyToken)
-		r.Post("/device/{deviceID}/music/musicprovider/15/token", server.HandleBoseSpotifyLegacyToken)
+		r.Post("/device/{deviceID}/music/musicprovider/{sourceID}/token", server.HandleBoseLegacyToken)
+		r.Post("/account/{account}/music/musicprovider/{sourceID}/token/cs", server.HandleBoseAccountToken)
+		r.Post("/device/{deviceID}/music/musicprovider/{sourceID}/token/cs1", server.HandleBoseToken)
+		r.Post("/device/{deviceID}/music/musicprovider/{sourceID}/token/cs3", server.HandleBoseToken)
 		r.HandleFunc("/*", server.HandleBoseProxy)
 	})

 	r.Route("/v1", func(r chi.Router) {
 		r.Post("/stapp/{deviceId}", server.HandleAppEvents)
 		r.Post("/scmudc/{deviceId}", server.HandleAppEvents)
+		// Return 405 Method Not Allowed as the upstream behavior also returns 405
+		r.Get("/blacklist/{deviceId}", func(w http.ResponseWriter, _ *http.Request) {
+			w.WriteHeader(http.StatusMethodNotAllowed)
+		})
 	})

 	r.Route("/mgmt", func(r chi.Router) {
-		// Browser OAuth callback — no auth required (Spotify redirects the
+		// Browser OAuth callbacks — no auth required (provider redirects the
 		// user's browser here directly). The authorization code is single-use,
 		// short-lived, and useless without the client_secret.
 		r.Get("/spotify/callback", server.HandleMgmtSpotifyCallback)
+		r.Get("/amazon/callback", server.HandleMgmtAmazonCallback)

 		// All other management endpoints require Basic Auth.
 		r.Group(func(r chi.Router) {
 			r.Use(server.BasicAuthMgmt())
-			r.Get("/accounts/{accountId}/speakers", server.HandleMgmtListSpeakers)
+
+			r.Route("/accounts", func(r chi.Router) {
+				r.Get("/", server.HandleMgmtListAccounts)
+				r.Get("/{accountId}", server.HandleMgmtAccountDetails)
+				r.Post("/{accountId}/language", server.HandleMgmtUpdateAccountLanguage)
+				r.Post("/{accountId}/provider-settings", server.HandleMgmtUpdateAccountProviderSetting)
+				r.Get("/{accountId}/speakers", server.HandleMgmtListSpeakers)
+			})
+
+			r.Route("/spotify", func(r chi.Router) {
+				r.Post("/init", server.HandleMgmtSpotifyInit)
+				r.Post("/confirm", server.HandleMgmtSpotifyConfirm)
+				r.Get("/accounts", server.HandleMgmtSpotifyAccounts)
+				r.Get("/token", server.HandleMgmtSpotifyToken)
+				r.Post("/entity", server.HandleMgmtSpotifyEntity)
+				r.Post("/prime", server.HandleMgmtPrimeDevice)
+			})
+
+			r.Route("/amazon", func(r chi.Router) {
+				r.Post("/init", server.HandleMgmtAmazonInit)
+				r.Post("/confirm", server.HandleMgmtAmazonConfirm)
+				r.Get("/accounts", server.HandleMgmtAmazonAccounts)
+				r.Get("/token", server.HandleMgmtAmazonToken)
+				r.Post("/prime", server.HandleMgmtPrimeDeviceAmazon)
+			})
+
 			r.Get("/devices/{deviceId}/events", server.HandleMgmtDeviceEvents)
-			r.Post("/spotify/init", server.HandleMgmtSpotifyInit)
-			r.Post("/spotify/confirm", server.HandleMgmtSpotifyConfirm)
-			r.Get("/spotify/accounts", server.HandleMgmtSpotifyAccounts)
-			r.Get("/spotify/token", server.HandleMgmtSpotifyToken)
-			r.Post("/spotify/entity", server.HandleMgmtSpotifyEntity)
-			r.Post("/spotify/prime", server.HandleMgmtPrimeDevice)
 		})
 	})

@@ -769,6 +1112,8 @@ func setupRouter(server *handlers.Server) *chi.Mux {
 		r.Post("/migrate/{deviceId}", server.HandleMigrateDevice)
 		r.Post("/revert/{deviceId}", server.HandleRevertMigration)
 		r.Post("/reboot/{deviceId}", server.HandleRebootDevice)
+		r.Get("/account-id-suggestions/{deviceId}", server.HandleAccountIDSuggestions)
+		r.Post("/pair-account/{deviceId}", server.HandlePairAccount)
 		r.Post("/trust-ca/{deviceId}", server.HandleTrustCACert)
 		r.Post("/ensure-remote-services/{deviceId}", server.HandleEnsureRemoteServices)
 		r.Post("/remove-remote-services/{deviceId}", server.HandleRemoveRemoteServices)
@@ -859,6 +1204,45 @@ func startHTTPSServer(httpsAddr string, r http.Handler, tlsConfig *tls.Config, h
 	}()
 }

+// runHTTPSPreflight checks whether speakers' implicit :443 target reaches
+// AfterTouch. Runs after the HTTPS listener has had a moment to come up; if
+// the listener is already on :443 the check is skipped. Emits a single WARN
+// log line with actionable guidance when either probe fails.
+//
+// Only runs when dnsEnabled is true: the :443 reachability only matters when
+// speakers are reaching AfterTouch via intercepted Bose hostnames (i.e. the
+// DNS migration method). For direct SDK-override migration the speaker
+// connects to the configured https-port directly, so :443 is irrelevant.
+// Users with external DNS interception (Pi-hole, router rules) can still see
+// the live result on /setup/settings even when this startup warn is silent.
+func runHTTPSPreflight(httpsServerURL, serverURL string, dnsEnabled bool, resolver func(string) (string, error)) {
+	if !dnsEnabled {
+		return
+	}
+
+	port := handlers.PortFromHTTPSServerURL(httpsServerURL)
+	if port == 0 {
+		// Can't determine the listener port — be silent rather than misleading.
+		return
+	}
+
+	// Give the listener a head start so a successful bind beats the probe.
+	time.Sleep(2 * time.Second)
+
+	res := handlers.Check443Reachability(port, serverURL, resolver, handlers.ProbeDialTimeoutStartup)
+
+	guidance := handlers.FormatPreflightGuidance(port, res)
+	if guidance == "" {
+		if !res.Skipped {
+			log.Printf("HTTPS pre-flight: :443 reachable at localhost and %s ✓", res.LANHost)
+		}
+
+		return
+	}
+
+	log.Print(guidance)
+}
+
 // matchesDomain checks if a certificate domain (which may be a wildcard) matches a server name
 func matchesDomain(certDomain, serverName string) bool {
 	if certDomain == serverName {
@@ -0,0 +1,159 @@
+package main
+
+import (
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"reflect"
+	"runtime"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/service/datastore"
+	"github.com/gesellix/bose-soundtouch/pkg/service/handlers"
+	"github.com/go-chi/chi/v5"
+)
+
+func TestPrintRoutes(t *testing.T) {
+	// Initialize a minimal server to get the router
+	server := handlers.NewServer(nil, nil, "http://localhost:8000", true, true, true)
+	r := setupRouter(server)
+
+	var routes []string
+	walkFunc := func(method string, route string, handler http.Handler, middlewares ...func(http.Handler) http.Handler) error {
+		route = strings.ReplaceAll(route, "/*/", "/")
+		handlerName := runtime.FuncForPC(reflect.ValueOf(handler).Pointer()).Name()
+		// Clean up the handler name (remove package path)
+		// For example, "github.com/gesellix/bose-soundtouch/cmd/soundtouch-service.setupRouter.func1"
+		// or "command-line-arguments.setupRouter.func1"
+		// or "main.setupRouter.func1"
+		parts := strings.Split(handlerName, "/")
+		if len(parts) > 0 {
+			handlerName = parts[len(parts)-1]
+		}
+		// Now we might have "soundtouch-service.setupRouter.func1"
+		// or "command-line-arguments.setupRouter.func1"
+		// or "main.setupRouter.func1"
+		// Let's remove the first part if it's a known varying package name
+		if idx := strings.Index(handlerName, "setupRouter"); idx != -1 {
+			handlerName = handlerName[idx:]
+		}
+		// In case it's not setupRouter but still has a package prefix
+		for {
+			dotIdx := strings.Index(handlerName, ".")
+			if dotIdx == -1 {
+				break
+			}
+			prefix := handlerName[:dotIdx]
+			if prefix == "main" || prefix == "command-line-arguments" || strings.Contains(prefix, "soundtouch-service") {
+				handlerName = handlerName[dotIdx+1:]
+			} else {
+				break
+			}
+		}
+
+		// Also remove any ".funcN" suffix if it's an anonymous function
+		if idx := strings.Index(handlerName, ".func"); idx != -1 {
+			handlerName = handlerName[:idx]
+		}
+
+		routes = append(routes, fmt.Sprintf("%-8s %-60s %s", method, route, handlerName))
+		return nil
+	}
+
+	if err := chi.Walk(r, walkFunc); err != nil {
+		t.Fatalf("Failed to walk routes: %v", err)
+	}
+
+	sort.Strings(routes)
+
+	output := strings.Join(routes, "\n") + "\n"
+
+	// Define snapshot path
+	snapshotPath := "testdata/router_routes.txt"
+	actualPath := "testdata/router_routes.actual.txt"
+
+	// Always write the current (actual) routes to a file
+	if err := os.WriteFile(actualPath, []byte(output), 0644); err != nil {
+		t.Fatalf("Failed to write actual routes: %v", err)
+	}
+
+	// Check if snapshot exists
+	if _, err := os.Stat(snapshotPath); os.IsNotExist(err) {
+		// Create testdata directory if it doesn't exist
+		if err := os.MkdirAll("testdata", 0755); err != nil {
+			t.Fatalf("Failed to create testdata directory: %v", err)
+		}
+		// Initial snapshot creation
+		if err := os.WriteFile(snapshotPath, []byte(output), 0644); err != nil {
+			t.Fatalf("Failed to write snapshot: %v", err)
+		}
+		t.Logf("Initial snapshot created at %s", snapshotPath)
+		return
+	}
+
+	// Read existing snapshot
+	existingOutput, err := os.ReadFile(snapshotPath)
+	if err != nil {
+		t.Fatalf("Failed to read snapshot: %v", err)
+	}
+
+	if string(existingOutput) != output {
+		t.Errorf("Router routes changed! Diff the snapshot at %s with %s", snapshotPath, actualPath)
+	}
+}
+
+// TestPUTRenameRoutesToLocalHandler reproduces the runtime routing
+// behaviour the user saw on their deployed v0.80.0: a PUT to
+// /streaming/account/{a}/device/{d} should land on
+// HandleMargeUpdateDevice, not fall through to the [UNHANDLED]
+// proxy. The handlers-package test (TestIssue285_*) uses a simplified
+// router that doesn't have the overlapping `/device` and
+// `/device/{device}` route groups, so it can't catch a chi radix-
+// tree resolution that prefers the more-specific subrouter.
+//
+// This test exercises the actual production setupRouter so a
+// regression in the route topology is caught against the same chi
+// behaviour speakers will see.
+func TestPUTRenameRoutesToLocalHandler(t *testing.T) {
+	tempDir, err := os.MkdirTemp("", "router-rename-")
+	if err != nil {
+		t.Fatalf("mkdir temp: %v", err)
+	}
+	defer os.RemoveAll(tempDir)
+
+	ds := datastore.NewDataStore(tempDir)
+	_ = ds.Initialize()
+
+	server := handlers.NewServer(ds, nil, "http://localhost:8000", false, false, false)
+	r := setupRouter(server)
+	ts := httptest.NewServer(r)
+	defer ts.Close()
+
+	body := `<?xml version="1.0" encoding="UTF-8" ?><device deviceid="A81B6A536A98"><name>Sound Machinechen</name><macaddress>A81B6A536A98</macaddress></device>`
+
+	req, err := http.NewRequest(http.MethodPut,
+		ts.URL+"/streaming/account/1111111/device/A81B6A536A98",
+		strings.NewReader(body))
+	if err != nil {
+		t.Fatalf("build request: %v", err)
+	}
+
+	req.Header.Set("Content-Type", "application/xml")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("PUT: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+
+	// 200 means our local HandleMargeUpdateDevice handled it.
+	// 401 / 502 / anything else means the request fell through to
+	// the [UNHANDLED] proxy and got the upstream response — which
+	// is exactly the failure mode #285 was supposed to fix.
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("PUT status = %d, want 200 (local handler). Anything else means the request fell through to [UNHANDLED] proxy — chi is routing to a different subrouter than the PUT registration intended.", resp.StatusCode)
+	}
+}
@@ -0,0 +1 @@
+*.actual.txt
@@ -0,0 +1,161 @@
+CONNECT  /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+DELETE   /accounts/{account}/devices/{device}                         handlers.(*Server).HandleMargeRemoveDevice-fm
+DELETE   /accounts/{account}/group/{groupId}                          handlers.(*Server).HandleMargeDeleteGroup-fm
+DELETE   /bmx/tunein/v1/favorite/{stationID}                          handlers.(*Server).HandleTuneInDeleteFavorite-fm
+DELETE   /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+DELETE   /setup/devices/{deviceId}                                    handlers.(*Server).HandleRemoveDevice-fm
+DELETE   /setup/dns-discoveries                                       handlers.(*Server).HandleClearDNSDiscoveries-fm
+DELETE   /setup/interactions/sessions                                 handlers.(*Server).HandleCleanupSessions-fm
+DELETE   /setup/interactions/sessions/{session}                       handlers.(*Server).HandleDeleteSession-fm
+DELETE   /setup/parity-mismatches                                     handlers.(*Server).HandleClearParityMismatches-fm
+DELETE   /streaming/account/{account}/device/{device}                 handlers.(*Server).HandleMargeRemoveDevice-fm
+DELETE   /streaming/account/{account}/device/{device}/preset/{presetNumber} handlers.(*Server).HandleMargeRemovePreset-fm
+DELETE   /streaming/account/{account}/group/{groupId}                 handlers.(*Server).HandleMargeDeleteGroup-fm
+GET      /                                                            handlers.(*Server).HandleRoot-fm
+GET      /accounts/{account}/devices                                  handlers.(*Server).HandleMargeAccountDevices-fm
+GET      /accounts/{account}/devices/{device}/group                   handlers.(*Server).HandleMargeDeviceGroup-fm
+GET      /accounts/{account}/devices/{device}/group/                  handlers.(*Server).HandleMargeDeviceGroup-fm
+GET      /accounts/{account}/devices/{device}/group/member            handlers.(*Server).HandleMargeDeviceGroupMember-fm
+GET      /accounts/{account}/devices/{device}/group/server            handlers.(*Server).HandleMargeDeviceGroupServer-fm
+GET      /accounts/{account}/devices/{device}/presets                 handlers.(*Server).HandleMargePresets-fm
+GET      /accounts/{account}/devices/{device}/recents                 handlers.(*Server).HandleMargeRecents-fm
+GET      /accounts/{account}/full                                     handlers.(*Server).HandleMargeAccountFull-fm
+GET      /accounts/{account}/sources                                  handlers.(*Server).HandleMargeAccountSources-fm
+GET      /bmx-icons/*                                                 handlers.(*Server).HandleBmxIcons
+GET      /bmx/registry/v1/services                                    handlers.(*Server).HandleBMXRegistry-fm
+GET      /bmx/registry/v1/servicesAvailability                        handlers.(*Server).HandleBMXServicesAvailability-fm
+GET      /bmx/tunein/v1/navigate                                      handlers.(*Server).HandleTuneInNavigate-fm
+GET      /bmx/tunein/v1/navigate/*                                    handlers.(*Server).HandleTuneInNavigate-fm
+GET      /bmx/tunein/v1/playback/episode/{podcastID}                  handlers.(*Server).HandleTuneInPlaybackPodcast-fm
+GET      /bmx/tunein/v1/playback/episodes/{podcastID}                 handlers.(*Server).HandleTuneInPodcastInfo-fm
+GET      /bmx/tunein/v1/playback/station/{stationID}                  handlers.(*Server).HandleTuneInPlayback-fm
+GET      /bmx/tunein/v1/search                                        handlers.(*Server).HandleTuneInSearch-fm
+GET      /ced/*                                                       handlers.(*Server).HandleCedStatic
+GET      /core02/svc-bmx-adapter-orion/prod/orion/station             handlers.(*Server).HandleOrionPlayback-fm
+GET      /custom/v1/playback/{encodedURL}                             handlers.(*Server).HandleCustomPlayback-fm
+GET      /customer/account/{account}                                  handlers.(*Server).HandleMargeAccountProfile-fm
+GET      /docs/*                                                      handlers.(*Server).HandleDocs-fm
+GET      /favicon.ico                                                 setupRouter
+GET      /health                                                      handlers.(*Server).HandleHealth-fm
+GET      /media/*                                                     handlers.(*Server).HandleMedia
+GET      /mgmt/accounts/                                              handlers.(*Server).HandleMgmtListAccounts-fm
+GET      /mgmt/accounts/{accountId}                                   handlers.(*Server).HandleMgmtAccountDetails-fm
+GET      /mgmt/accounts/{accountId}/speakers                          handlers.(*Server).HandleMgmtListSpeakers-fm
+GET      /mgmt/amazon/accounts                                        handlers.(*Server).HandleMgmtAmazonAccounts-fm
+GET      /mgmt/amazon/callback                                        handlers.(*Server).HandleMgmtAmazonCallback-fm
+GET      /mgmt/amazon/token                                           handlers.(*Server).HandleMgmtAmazonToken-fm
+GET      /mgmt/devices/{deviceId}/events                              handlers.(*Server).HandleMgmtDeviceEvents-fm
+GET      /mgmt/spotify/accounts                                       handlers.(*Server).HandleMgmtSpotifyAccounts-fm
+GET      /mgmt/spotify/callback                                       handlers.(*Server).HandleMgmtSpotifyCallback-fm
+GET      /mgmt/spotify/token                                          handlers.(*Server).HandleMgmtSpotifyToken-fm
+GET      /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+GET      /proxy/*                                                     handlers.(*Server).HandleProxyRequest-fm
+GET      /setup/account-id-suggestions/{deviceId}                     handlers.(*Server).HandleAccountIDSuggestions-fm
+GET      /setup/ca.crt                                                handlers.(*Server).HandleGetCACert-fm
+GET      /setup/devices                                               handlers.(*Server).HandleListDiscoveredDevices-fm
+GET      /setup/devices/{deviceId}/events                             handlers.(*Server).HandleGetDeviceEvents-fm
+GET      /setup/discovery-status                                      handlers.(*Server).HandleGetDiscoveryStatus-fm
+GET      /setup/dns-discoveries                                       handlers.(*Server).HandleGetDNSDiscoveries-fm
+GET      /setup/dns-discoveries/download                              handlers.(*Server).HandleDownloadDNSDiscoveries-fm
+GET      /setup/info/{deviceId}                                       handlers.(*Server).HandleGetDeviceInfo-fm
+GET      /setup/interaction-content                                   handlers.(*Server).HandleGetInteractionContent-fm
+GET      /setup/interaction-stats                                     handlers.(*Server).HandleGetInteractionStats-fm
+GET      /setup/interactions                                          handlers.(*Server).HandleListInteractions-fm
+GET      /setup/interactions/sessions/{session}/download              handlers.(*Server).HandleDownloadSession-fm
+GET      /setup/parity-mismatches                                     handlers.(*Server).HandleListParityMismatches-fm
+GET      /setup/proxy-settings                                        handlers.(*Server).HandleGetProxySettings-fm
+GET      /setup/settings                                              handlers.(*Server).HandleGetSettings-fm
+GET      /setup/summary/{deviceId}                                    handlers.(*Server).HandleGetMigrationSummary-fm
+GET      /setup/version                                               handlers.(*Server).HandleGetVersionInfo-fm
+GET      /streaming/account/{account}/device/{device}/group           handlers.(*Server).HandleMargeDeviceGroup-fm
+GET      /streaming/account/{account}/device/{device}/group/          handlers.(*Server).HandleMargeDeviceGroup-fm
+GET      /streaming/account/{account}/device/{device}/group/member    handlers.(*Server).HandleMargeDeviceGroupMember-fm
+GET      /streaming/account/{account}/device/{device}/group/server    handlers.(*Server).HandleMargeDeviceGroupServer-fm
+GET      /streaming/account/{account}/device/{device}/presets         handlers.(*Server).HandleMargePresets-fm
+GET      /streaming/account/{account}/device/{device}/recent          handlers.(*Server).HandleMargeRecents-fm
+GET      /streaming/account/{account}/device/{device}/recents         handlers.(*Server).HandleMargeRecents-fm
+GET      /streaming/account/{account}/devices                         handlers.(*Server).HandleMargeAccountDevices-fm
+GET      /streaming/account/{account}/emailaddress                    handlers.(*Server).HandleMargeGetEmailAddress-fm
+GET      /streaming/account/{account}/full                            handlers.(*Server).HandleMargeAccountFull-fm
+GET      /streaming/account/{account}/presets                         handlers.(*Server).HandleMargeAccountPresets-fm
+GET      /streaming/account/{account}/presets/all                     handlers.(*Server).HandleMargeAccountPresets-fm
+GET      /streaming/account/{account}/provider_settings               handlers.(*Server).HandleMargeProviderSettings-fm
+GET      /streaming/account/{account}/sources                         handlers.(*Server).HandleMargeAccountSources-fm
+GET      /streaming/device/{device}/streaming_token                   handlers.(*Server).HandleMargeStreamingToken-fm
+GET      /streaming/device_setting/account/{account}/device/{device}/device_settings handlers.(*Server).HandleMargeGetDeviceSettings-fm
+GET      /streaming/resources/api_versions.xml                        handlers.(*Server).HandleMargeAPIVersions-fm
+GET      /streaming/software/update/account/{account}                 handlers.(*Server).HandleMargeSoftwareUpdate-fm
+GET      /streaming/sourceproviders                                   handlers.(*Server).HandleMargeSourceProviders-fm
+GET      /updates/soundtouch                                          handlers.(*Server).HandleMargeSoftwareUpdate-fm
+GET      /v1/blacklist/{deviceId}                                     setupRouter
+GET      /web/*                                                       setupRouter.(*Server).HandleWeb
+HEAD     /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+OPTIONS  /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+PATCH    /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+POST     /accounts/{account}/devices                                  handlers.(*Server).HandleMargeAddDevice-fm
+POST     /accounts/{account}/devices/{device}/presets/{presetNumber}  handlers.(*Server).HandleMargeUpdatePreset-fm
+POST     /accounts/{account}/devices/{device}/recents                 handlers.(*Server).HandleMargeAddRecent-fm
+POST     /accounts/{account}/group                                    handlers.(*Server).HandleMargeAddGroup-fm
+POST     /accounts/{account}/group/                                   handlers.(*Server).HandleMargeAddGroup-fm
+POST     /accounts/{account}/group/{groupId}                          handlers.(*Server).HandleMargeModifyGroup-fm
+POST     /alexa/certificate                                           handlers.(*Server).HandleAlexaCertificate-fm
+POST     /bmx/tunein/v1/favorite/{stationID}                          handlers.(*Server).HandleTuneInFavorite-fm
+POST     /bmx/tunein/v1/report                                        handlers.(*Server).HandleTuneInReport-fm
+POST     /bmx/tunein/v1/token                                         handlers.(*Server).HandleTuneInToken-fm
+POST     /core02/svc-bmx-adapter-orion/prod/orion/token               handlers.(*Server).HandleOrionToken-fm
+POST     /customer/account/{account}                                  handlers.(*Server).HandleMargeUpdateAccountProfile-fm
+POST     /customer/account/{account}/password                         handlers.(*Server).HandleMargeChangePassword-fm
+POST     /mgmt/accounts/{accountId}/language                          handlers.(*Server).HandleMgmtUpdateAccountLanguage-fm
+POST     /mgmt/accounts/{accountId}/provider-settings                 handlers.(*Server).HandleMgmtUpdateAccountProviderSetting-fm
+POST     /mgmt/amazon/confirm                                         handlers.(*Server).HandleMgmtAmazonConfirm-fm
+POST     /mgmt/amazon/init                                            handlers.(*Server).HandleMgmtAmazonInit-fm
+POST     /mgmt/amazon/prime                                           handlers.(*Server).HandleMgmtPrimeDeviceAmazon-fm
+POST     /mgmt/spotify/confirm                                        handlers.(*Server).HandleMgmtSpotifyConfirm-fm
+POST     /mgmt/spotify/entity                                         handlers.(*Server).HandleMgmtSpotifyEntity-fm
+POST     /mgmt/spotify/init                                           handlers.(*Server).HandleMgmtSpotifyInit-fm
+POST     /mgmt/spotify/prime                                          handlers.(*Server).HandleMgmtPrimeDevice-fm
+POST     /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+POST     /oauth/account/{account}/music/musicprovider/{sourceID}/token/cs handlers.(*Server).HandleBoseAccountToken-fm
+POST     /oauth/device/{deviceID}/music/musicprovider/{sourceID}/token handlers.(*Server).HandleBoseLegacyToken-fm
+POST     /oauth/device/{deviceID}/music/musicprovider/{sourceID}/token/cs1 handlers.(*Server).HandleBoseToken-fm
+POST     /oauth/device/{deviceID}/music/musicprovider/{sourceID}/token/cs3 handlers.(*Server).HandleBoseToken-fm
+POST     /setup/backup/{deviceId}                                     handlers.(*Server).HandleBackupConfig-fm
+POST     /setup/devices                                               handlers.(*Server).HandleAddManualDevice-fm
+POST     /setup/discover                                              handlers.(*Server).HandleTriggerDiscovery-fm
+POST     /setup/ensure-remote-services/{deviceId}                     handlers.(*Server).HandleEnsureRemoteServices-fm
+POST     /setup/migrate/{deviceId}                                    handlers.(*Server).HandleMigrateDevice-fm
+POST     /setup/pair-account/{deviceId}                               handlers.(*Server).HandlePairAccount-fm
+POST     /setup/peer-probe/{deviceId}                                 handlers.(*Server).HandlePeerProbe-fm
+POST     /setup/proxy-settings                                        handlers.(*Server).HandleUpdateProxySettings-fm
+POST     /setup/reboot/{deviceId}                                     handlers.(*Server).HandleRebootDevice-fm
+POST     /setup/remove-remote-services/{deviceId}                     handlers.(*Server).HandleRemoveRemoteServices-fm
+POST     /setup/revert/{deviceId}                                     handlers.(*Server).HandleRevertMigration-fm
+POST     /setup/settings                                              handlers.(*Server).HandleUpdateSettings-fm
+POST     /setup/sync/{deviceId}                                       handlers.(*Server).HandleInitialSync-fm
+POST     /setup/test-connection/{deviceId}                            handlers.(*Server).HandleTestConnection-fm
+POST     /setup/test-dns/{deviceId}                                   handlers.(*Server).HandleTestDNSRedirection-fm
+POST     /setup/test-hosts/{deviceId}                                 handlers.(*Server).HandleTestHostsRedirection-fm
+POST     /setup/trust-ca/{deviceId}                                   handlers.(*Server).HandleTrustCACert-fm
+POST     /streaming/account                                           handlers.(*Server).HandleMargeCreateAccount-fm
+POST     /streaming/account/login                                     handlers.(*Server).HandleMargeLogin-fm
+POST     /streaming/account/{account}/device/                         handlers.(*Server).HandleMargeAddDevice-fm
+POST     /streaming/account/{account}/device/{device}                 handlers.(*Server).HandleMargeAddDevice-fm
+POST     /streaming/account/{account}/device/{device}/presets/{presetNumber} handlers.(*Server).HandleMargeUpdatePreset-fm
+POST     /streaming/account/{account}/device/{device}/recent          handlers.(*Server).HandleMargeAddRecent-fm
+POST     /streaming/account/{account}/group                           handlers.(*Server).HandleMargeAddGroup-fm
+POST     /streaming/account/{account}/group/                          handlers.(*Server).HandleMargeAddGroup-fm
+POST     /streaming/account/{account}/group/{groupId}                 handlers.(*Server).HandleMargeModifyGroup-fm
+POST     /streaming/account/{account}/source                          handlers.(*Server).HandleMargeAddSource-fm
+POST     /streaming/device_setting/account/{account}/device/{device}/device_settings handlers.(*Server).HandleMargeUpdateDeviceSettings-fm
+POST     /streaming/music/musicprovider/{providerID}/is_eligible      handlers.(*Server).HandleMusicProviderIsEligible-fm
+POST     /streaming/music/musicprovider/{providerID}/trial/is_eligible handlers.(*Server).HandleMusicProviderIsEligible-fm
+POST     /streaming/stats/error                                       handlers.(*Server).HandleErrorStats-fm
+POST     /streaming/stats/usage                                       handlers.(*Server).HandleUsageStats-fm
+POST     /streaming/support/customersupport                           handlers.(*Server).HandleMargeCustomerSupport-fm
+POST     /streaming/support/power_on                                  handlers.(*Server).HandleMargePowerOn-fm
+POST     /v1/scmudc/{deviceId}                                        handlers.(*Server).HandleAppEvents-fm
+POST     /v1/stapp/{deviceId}                                         handlers.(*Server).HandleAppEvents-fm
+PUT      /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
+PUT      /streaming/account/{account}/device/{device}                 handlers.(*Server).HandleMargeUpdateDevice-fm
+PUT      /streaming/account/{account}/device/{device}/preset/{presetNumber} handlers.(*Server).HandleMargeUpdatePreset-fm
+TRACE    /oauth/*                                                     handlers.(*Server).HandleBoseProxy-fm
@@ -0,0 +1,2 @@
+soundtouch-web
+soundtouch-web-test
@@ -0,0 +1,276 @@
+# SoundTouch Web Implementation
+
+## Overview
+
+The `soundtouch-web` tool provides a modern single-page application (SPA) for controlling Bose SoundTouch devices. Built with a JSON API backend and client-side JavaScript rendering, it offers superior performance and eliminates template rendering issues.
+
+## Architecture
+
+### Single-Page Application Design
+
+The architecture eliminates Go template dependencies and provides:
+- **JSON API Backend**: Pure Go server returning only JSON responses
+- **Client-Side Rendering**: JavaScript handles all HTML generation
+- **WebSocket Real-time**: Bi-directional communication for live updates
+- **Better Performance**: No server-side template processing
+- **Easier Development**: Clear separation of frontend/backend concerns
+
+### Core Components
+
+#### 1. Main Application (`main.go`)
+- **Entry Point**: Handles command-line arguments and application initialization
+- **SPA Routing**: Serves static HTML file for all non-API routes
+- **Device Discovery**: Automatic discovery of SoundTouch devices using unified discovery service
+- **JSON API Server**: Configures API routes and serves the SPA
+- **Context Management**: Proper context handling for timeouts and cancellation
+
+#### 2. HTTP Handlers (`handlers/handlers.go`)
+- **WebApp Structure**: Central application state management
+- **JSON API Endpoints**: RESTful API returning only JSON responses
+- **Device Control**: Device control with proper validation and error handling
+- **Modular Design**: Separated control actions into focused functions
+
+#### 3. WebSocket Support (`handlers/websocket.go`)
+- **Real-time Updates**: Live device status streaming to web clients
+- **Device WebSocket Connections**: Maintains persistent connections to SoundTouch devices
+- **Event Handling**: Processes nowPlaying, volume, and connection state updates
+- **Status Synchronization**: Keeps device status current across all connected clients
+
+#### 4. Type Definitions (`webtypes/types.go`)
+- **Device Management**: Structures for device connections and status
+- **API Responses**: Standardized JSON response format
+- **WebSocket Messages**: Real-time message types
+- **Template Data**: HTML template data structures
+
+### Key Features Implemented
+
+#### Device Discovery & Management
+- **Auto-discovery**: Finds SoundTouch devices on local network using mDNS/UPnP
+- **Multi-device Support**: Manages multiple devices simultaneously
+- **Connection Tracking**: Monitors device availability and connection status
+- **Device Information**: Displays device details (name, type, IP address)
+
+#### Real-time Control Interface
+- **Now Playing**: Live track information with artwork display
+- **Playback Controls**: Play/pause/stop/next/previous with visual feedback
+- **Volume Control**: Real-time volume slider with mute functionality
+- **Bass Adjustment**: Bass level control for supported devices
+- **Preset Management**: Quick access to saved presets (1-6)
+- **Source Selection**: Input switching (Spotify, TuneIn, Bluetooth, AUX, etc.)
+
+#### Web Interface
+- **Single-Page Application**: Self-contained HTML file with embedded CSS and JavaScript
+- **Responsive Design**: Bootstrap 5-based UI optimized for desktop and mobile
+- **Client-Side Routing**: JavaScript handles page navigation without page reloads
+- **Dynamic Rendering**: All HTML generated client-side from JSON data
+- **Real-time Updates**: WebSocket-powered live status updates
+- **Performance Optimized**: Fast loading and no template rendering delays
+
+#### API Endpoints
+```
+GET  /                          # SPA - serves static/index.html
+GET  /api/devices              # List all devices (JSON)
+GET  /api/device/{id}          # Get device info (JSON)
+POST /api/discover             # Trigger device discovery
+GET  /api/control/{id}/play    # Playback control
+GET  /api/control/{id}/pause   # Pause playback
+GET  /api/control/{id}/stop    # Stop playback
+GET  /api/control/{id}/next    # Next track
+GET  /api/control/{id}/previous # Previous track
+POST /api/control/{id}/volume  # Set volume (JSON body)
+GET  /api/control/{id}/mute    # Toggle mute
+POST /api/control/{id}/bass    # Set bass level (JSON body)
+GET  /api/control/{id}/preset?id=N # Select preset
+GET  /api/control/{id}/source?name=X # Select source
+```
+
+#### WebSocket Events
+- **Connection**: `ws://localhost:8080/ws`
+- **Device Updates**: Real-time device list changes
+- **Status Updates**: Live playback and volume changes
+- **Connection Monitoring**: Device availability status
+
+## Technical Implementation
+
+### Frontend Architecture
+- **Single HTML File**: Complete application in `static/index.html`
+- **Embedded CSS**: Bootstrap 5 with custom Bose-inspired styling
+- **Vanilla JavaScript**: No framework dependencies, fast performance
+- **Client-Side Routing**: JavaScript manages page state without reloads
+- **Dynamic Components**: HTML elements generated from JSON API responses
+
+### Error Handling & Validation
+- **Input Validation**: Proper bounds checking for volume (0-100) and bass (-9 to 9)
+- **HTTP Status Codes**: Appropriate response codes for different error conditions
+- **JSON Error Responses**: Structured error messages for API consumers
+- **Client-Side Error Display**: JavaScript toast notifications for user feedback
+
+### Code Quality
+- **golangci-lint Compliance**: Passes all configured lint checks
+- **Context Handling**: Proper context propagation and timeout management
+- **Error Checking**: All JSON encoding/decoding operations checked
+- **Type Safety**: Strong typing with dedicated type package
+- **Test Coverage**: Comprehensive unit tests for handlers and types
+
+### WebSocket Integration
+- **Gabbo Protocol**: Native SoundTouch WebSocket protocol implementation
+- **Event Processing**: Handles all documented SoundTouch WebSocket events
+- **Connection Management**: Automatic reconnection and health monitoring
+- **Bi-directional Communication**: Both status monitoring and device control
+
+## Dependencies
+
+### Core Libraries
+- **chi v5**: HTTP router (inherited from existing codebase)
+- **gorilla/websocket**: WebSocket implementation
+- **Go standard library**: html/template, net/http, encoding/json
+
+### Project Dependencies
+- **pkg/client**: SoundTouch HTTP and WebSocket client library
+- **pkg/discovery**: Device discovery service (mDNS/UPnP)
+- **pkg/models**: XML/JSON data structures for SoundTouch API
+- **pkg/config**: Configuration management
+
+### Frontend Dependencies
+- **Bootstrap 5**: CSS framework for responsive design
+- **Bootstrap Icons**: Icon library for UI elements
+- **Vanilla JavaScript**: No external JS frameworks, pure WebSocket implementation
+
+## Build & Testing
+
+### Build Commands
+```bash
+# Build the web application
+cd cmd/soundtouch-web
+go build -o soundtouch-web
+
+# Build all project components (includes soundtouch-web)
+make build
+
+# Cross-platform builds
+make build-all
+```
+
+### Testing
+```bash
+# Run unit tests
+go test ./cmd/soundtouch-web/...
+
+# Run with coverage
+go test -cover ./cmd/soundtouch-web/...
+
+# Lint checking
+golangci-lint run cmd/soundtouch-web/...
+```
+
+### Development Server
+```bash
+# Run development server
+cd cmd/soundtouch-web
+go run main.go -port 8080
+
+# Access the web interface
+open http://localhost:8080
+```
+
+## Configuration
+
+### Command Line Options
+```bash
+soundtouch-web [options]
+
+Options:
+  -port string    Web server port (default "8080")
+  -host string    Specific device host for single-device mode (optional)
+```
+
+### File Structure
+```
+cmd/soundtouch-web/
+├── main.go                    # Application entry point
+├── soundtouch-web            # Built binary
+├── handlers/
+│   ├── handlers.go           # HTTP request handlers
+│   ├── handlers_test.go      # Handler tests
+│   └── websocket.go          # WebSocket functionality
+├── webtypes/
+│   ├── types.go              # Type definitions
+│   └── types_test.go         # Type tests
+├── templates/
+│   ├── layout.html           # Base HTML layout
+│   ├── index.html            # Device list page
+│   └── device.html           # Device control page
+├── static/
+│   └── style.css             # Additional CSS styles
+└── README.md                 # User documentation
+```
+
+## Browser Compatibility
+
+### Supported Browsers
+- **Chrome 80+** (recommended)
+- **Firefox 75+**
+- **Safari 13+**
+- **Edge 80+**
+
+### Required Features
+- WebSocket support
+- CSS Grid and Flexbox
+- ES6 JavaScript features
+- JSON API support
+
+## Security Considerations
+
+### Design Principles
+- **Local Network Only**: Designed for trusted local network environments
+- **No Authentication**: Assumes local network security
+- **CORS Policy**: Restricted to same-origin requests
+- **Input Validation**: All user inputs validated on server side
+
+### Network Security
+- **Port Usage**: Uses standard HTTP port (configurable)
+- **WebSocket Security**: Same-origin WebSocket connections only
+- **No External Dependencies**: All resources served locally
+
+## Performance Characteristics
+
+### Resource Usage
+- **Memory**: Minimal footprint, scales with number of discovered devices
+- **CPU**: Low usage, event-driven architecture
+- **Network**: Efficient WebSocket connections, HTTP REST for control
+
+### Scalability
+- **Device Limits**: Designed for typical home networks (5-20 devices)
+- **Concurrent Users**: Multiple browser sessions supported
+- **Update Frequency**: Real-time updates without polling
+
+## Future Enhancements
+
+### Potential Features
+- **Zone Management**: Multi-room audio control
+- **Preset Programming**: Advanced preset configuration
+- **Mobile PWA**: Progressive Web App for mobile installation
+- **Theme Support**: Additional UI themes
+- **Device Grouping**: Logical device organization
+
+### Technical Improvements
+- **Caching**: Enhanced device status caching
+- **Compression**: WebSocket message compression
+- **Persistence**: Device settings persistence
+- **Metrics**: Usage analytics and performance monitoring
+
+## Integration with Main Project
+
+### Project Alignment
+- **Consistent Architecture**: Follows established project patterns
+- **Shared Libraries**: Leverages existing pkg/ modules
+- **Build Integration**: Included in main Makefile targets
+- **Documentation**: Consistent with project documentation standards
+
+### Migration Path
+- **Cloud Replacement**: Serves as local alternative to Bose cloud services
+- **API Compatibility**: Maintains compatibility with existing SoundTouch APIs
+- **User Experience**: Familiar interface for existing SoundTouch app users
+- **Long-term Support**: Designed for continued operation post-2026
+
+This implementation provides a robust, feature-complete web interface for SoundTouch device control, ensuring continued functionality beyond the official app's lifecycle while maintaining high code quality and user experience standards.
@@ -0,0 +1,330 @@
+# SoundTouch Web UI
+
+A modern single-page web application (SPA) for controlling Bose SoundTouch devices. Built with a JSON API backend and client-side JavaScript rendering for superior performance and maintainability.
+
+## Architecture
+
+```
+Browser → Static HTML → JavaScript → JSON API → Go Server
+                     ↓
+               Client-Side Rendering
+```
+
+### Key Benefits
+- **Better Performance**: No server-side template processing overhead
+- **Improved Maintainability**: Clear separation between frontend (JavaScript) and backend (Go)
+- **Real-time Experience**: Smooth client-side updates without page reloads
+- **Mobile Ready**: The JSON API can power both this web interface and mobile applications
+
+## Features
+
+Based on captured WebSocket interactions and device API capabilities, this web UI provides:
+
+### Device Management
+- **Auto-discovery** of SoundTouch devices on the network
+- **Real-time status monitoring** via WebSocket connections
+- **Multi-device support** with centralized control
+- **Connection status** indicators and health monitoring
+
+### Playback Control
+- **Play/Pause/Stop/Next/Previous** controls
+- **Now playing information** with artwork, track details, and progress
+- **Real-time updates** of playback state changes
+- **Source selection** from available inputs (Spotify, TuneIn, Bluetooth, AUX, etc.)
+
+### Audio Controls
+- **Volume control** with real-time slider updates
+- **Mute/Unmute** functionality
+- **Bass adjustment** (on supported models)
+- **Audio level monitoring** and statistics
+
+### Preset Management
+- **6 preset buttons** with visual feedback
+- **Preset content display** showing station/playlist names
+- **One-click preset selection**
+
+### Advanced Features
+- **WebSocket real-time updates** for instant state synchronization
+- **Responsive design** optimized for desktop and mobile
+- **Dark mode support** (auto-detects system preference)
+- **Accessibility features** (keyboard navigation, screen reader support)
+- **Network statistics** and device health monitoring
+
+## Screenshots
+
+### Main Device Overview
+The main page shows all discovered devices with their current status, now-playing information, and quick controls.
+
+### Detailed Device Control
+Individual device pages provide full control over:
+- Detailed now-playing information with artwork
+- Comprehensive audio controls (volume, bass)
+- Full preset and source selection
+- Real-time status updates
+
+## Installation
+
+### Prerequisites
+- Go 1.21 or later
+- Access to SoundTouch devices on the same network
+- Modern web browser with WebSocket support
+
+### Building
+```bash
+# From project root
+make build
+
+# Or manually
+cd cmd/soundtouch-web
+go build -o soundtouch-web
+```
+
+### Running
+```bash
+# Run with default settings (port 8080)
+./soundtouch-web
+
+# Specify custom port
+./soundtouch-web -port 8888
+
+# Connect to specific device
+./soundtouch-web -host 192.168.1.100
+```
+
+### Command Line Options
+```
+-port string    Web server port (default "8080")
+-host string    Specific SoundTouch device host (optional, enables single-device mode)
+-help          Show help information
+```
+
+## Usage
+
+### Accessing the Interface
+1. Start the application
+2. Open your web browser and navigate to `http://localhost:8080`
+3. Click "Discover Devices" to find SoundTouch devices on your network
+4. Click on any device for detailed control, or use quick controls from the main page
+
+### Device Discovery
+The application automatically discovers SoundTouch devices using:
+- **mDNS discovery** for local network devices
+- **UPnP/SSDP discovery** as fallback
+- **Manual device addition** via IP address
+
+### Real-time Updates
+The interface maintains WebSocket connections to each device for instant updates of:
+- Now playing information and artwork
+- Volume and audio settings changes
+- Playback status (play/pause/stop)
+- Connection status and device health
+
+### Responsive Design
+- **Desktop**: Full-featured interface with side-by-side panels
+- **Tablet**: Optimized layout with touch-friendly controls
+- **Mobile**: Stacked interface with gesture support
+
+## API Endpoints
+
+The web UI exposes a REST API for programmatic control:
+
+### Device Management
+```
+GET  /api/devices           # List all discovered devices
+GET  /api/device/{id}       # Get specific device info
+POST /api/discover          # Trigger device discovery
+```
+
+### Device Control
+```
+GET  /api/control/{id}/play        # Start playback
+GET  /api/control/{id}/pause       # Pause playback
+GET  /api/control/{id}/stop        # Stop playback
+GET  /api/control/{id}/next        # Next track
+GET  /api/control/{id}/previous    # Previous track
+POST /api/control/{id}/volume      # Set volume (body: {"level": 50})
+GET  /api/control/{id}/mute        # Mute audio
+GET  /api/control/{id}/unmute      # Unmute audio
+POST /api/control/{id}/bass        # Set bass (body: {"level": 0})
+GET  /api/control/{id}/preset?id=1 # Select preset
+GET  /api/control/{id}/source?name=SPOTIFY # Select source
+```
+
+### WebSocket Events
+Connect to `/ws` for real-time updates:
+```javascript
+const ws = new WebSocket('ws://localhost:8080/ws');
+ws.onmessage = function(event) {
+    const data = JSON.parse(event.data);
+    // Handle device updates, status changes, etc.
+};
+```
+
+## Architecture
+
+### Single-Page Application Architecture
+- **JSON API Backend**: Go server providing RESTful endpoints
+- **Client-Side Rendering**: JavaScript handles all UI rendering
+- **WebSocket Real-time**: Bi-directional real-time communication
+- **No Template Dependencies**: Eliminates server-side template issues
+
+### Backend Components
+- **Discovery Service**: Finds and manages SoundTouch devices
+- **WebSocket Manager**: Maintains real-time connections to devices
+- **JSON API Server**: RESTful interface returning only JSON
+- **Device Manager**: Tracks device state and health
+
+### Frontend Components
+- **Bootstrap 5**: Modern responsive UI framework
+- **Vanilla JavaScript**: No framework dependencies, fast loading
+- **WebSocket Client**: Real-time bidirectional communication
+- **Dynamic Rendering**: Client-side HTML generation from JSON
+
+### Communication Flow
+1. **SPA Loading**: Single HTML file with embedded CSS and JavaScript
+2. **JSON API**: Device discovery and control via REST endpoints
+3. **WebSocket (Device)**: Real-time status updates from SoundTouch devices
+4. **WebSocket (Browser)**: Real-time UI updates to web clients
+5. **Client Rendering**: JavaScript dynamically creates all UI elements
+
+## Development
+
+### Project Structure
+```
+cmd/soundtouch-web/
+├── main.go              # Application entry point and SPA routing
+├── handlers/            # HTTP and WebSocket handlers
+│   ├── handlers.go     # JSON API endpoints
+│   └── websocket.go    # WebSocket management
+├── webtypes/           # Type definitions
+│   └── types.go        # Request/response types
+├── static/             # Static assets
+│   ├── index.html      # Single-page application
+│   └── js/             # Legacy JS files (reference)
+├── templates/          # Legacy templates (unused in SPA)
+└── README.md          # This file
+```
+
+### Adding New Features
+1. **API Endpoints**: Add new JSON routes in `setupRoutes()` and `handlers.go`
+2. **WebSocket Events**: Extend event handlers in WebSocket client
+3. **UI Components**: Add JavaScript rendering functions in `static/index.html`
+4. **Device Controls**: Implement new control commands and update client-side handlers
+
+### Testing
+```bash
+# Unit tests
+go test ./...
+
+# Manual testing with multiple devices
+./soundtouch-web -port 8080
+
+# API testing
+curl http://localhost:8080/api/devices
+```
+
+## WebSocket Protocol Analysis
+
+This UI is based on extensive analysis of captured SoundTouch WebSocket interactions, including:
+
+### Message Types Implemented
+- **SoundTouchSdkInfo**: Initial handshake and version info
+- **nowPlayingUpdated**: Real-time track information
+- **volumeUpdated**: Audio level changes
+- **recentsUpdated**: Recently played items
+- **userActivityUpdate**: User interaction notifications
+
+### Request/Response Patterns
+- **Device Information**: System details and capabilities
+- **Audio Controls**: Volume, bass, mute controls
+- **Playback Control**: Play/pause/stop/skip commands
+- **Source Selection**: Input switching (Spotify, TuneIn, etc.)
+- **Preset Management**: Saved station/playlist access
+
+### Gabbo Protocol Features
+- **Persistent Connections**: Maintains long-lived WebSocket connections
+- **Request Correlation**: Uses request IDs for response matching
+- **Real-time Events**: Instant updates for all device state changes
+- **Bi-directional Control**: Both status monitoring and device control
+
+## Browser Compatibility
+
+### Supported Browsers
+- **Chrome 80+** (recommended)
+- **Firefox 75+**
+- **Safari 13+**
+- **Edge 80+**
+
+### Required Features
+- WebSocket support
+- CSS Grid and Flexbox
+- ES6 JavaScript features
+- Responsive CSS media queries
+
+## Security Considerations
+
+- **Local Network Only**: Designed for local network device control
+- **No Authentication**: Assumes trusted local network environment
+- **CORS Policy**: Restricted to same-origin requests
+- **WebSocket Security**: Uses same-origin WebSocket connections
+
+## Troubleshooting
+
+### Common Issues
+
+**Devices Not Found**
+- Ensure devices are on the same network
+- Check firewall settings (ports 8090, 8080)
+- Click "Discover Devices" button to trigger discovery
+
+**WebSocket Connection Failed**
+- Verify device supports WebSocket connections
+- Check browser console for connection errors
+- Refresh the page to reconnect WebSocket
+
+**Control Commands Not Working**
+- Check device is powered on and connected
+- Verify device is not in exclusive mode (e.g., Spotify Connect active)
+- Look for error notifications in the UI
+
+**Page Shows Template Errors**
+- This has been fixed in the SPA implementation
+- Ensure you're accessing the correct URL (localhost:8080)
+- Clear browser cache if you see old template-based content
+
+### Debug Mode
+Add verbose logging by setting environment variable:
+```bash
+export DEBUG=true
+./soundtouch-web
+```
+
+## Contributing
+
+This web UI is part of the larger SoundTouch Go library project. See the main project README for contribution guidelines.
+
+### Architecture Benefits
+The new SPA approach provides:
+- **Better Performance**: No server-side template rendering
+- **Easier Development**: Clear separation of frontend/backend
+- **Mobile Ready**: Same JSON API can power mobile apps
+- **Scalable**: Single-page app architecture
+
+### Feature Requests
+Based on WebSocket interaction analysis, potential future features:
+- Zone/multi-room management
+- Clock display control
+- Software update management
+- Advanced preset programming
+- Progressive Web App (PWA) features
+
+## License
+
+Same as the parent project - see main repository LICENSE file.
+
+## Acknowledgments
+
+- Built on the comprehensive SoundTouch Go library
+- UI design inspired by modern audio control interfaces
+- WebSocket protocol reverse-engineered from captured device interactions
+- Bootstrap and Bootstrap Icons for responsive design components
@@ -0,0 +1,739 @@
+// Package handlers contains HTTP handlers for the SoundTouch web UI.
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/webtypes"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	bmxpkg "github.com/gesellix/bose-soundtouch/pkg/service/bmx"
+	"github.com/go-chi/chi/v5"
+	"github.com/gorilla/websocket"
+)
+
+// WebApp holds the application state and dependencies.
+//
+// The device registry (devices map + devicesMu) is encapsulated:
+// callers go through GetDevice / DeviceSnapshot / AddDevice /
+// TouchDevice / DeviceCount instead of touching the map directly.
+// This prevents the concurrent-map-read/write panic that would
+// otherwise be reachable any time an HTTP handler runs while
+// discovery or the /api/discover endpoint is registering devices.
+type WebApp struct {
+	devicesMu sync.RWMutex
+	devices   map[string]*webtypes.DeviceConnection
+
+	Upgrader  websocket.Upgrader
+	WSClients map[*websocket.Conn]bool
+	WSMutex   sync.RWMutex
+}
+
+// DeviceEntry pairs a device id with its connection. Used by
+// DeviceSnapshot so callers can iterate without holding the lock.
+type DeviceEntry struct {
+	ID     string
+	Device *webtypes.DeviceConnection
+}
+
+// NewWebApp creates a new WebApp instance for SPA mode
+func NewWebApp() *WebApp {
+	return &WebApp{
+		devices:   make(map[string]*webtypes.DeviceConnection),
+		WSClients: make(map[*websocket.Conn]bool),
+		Upgrader: websocket.Upgrader{
+			CheckOrigin: func(_ *http.Request) bool { return true },
+		},
+	}
+}
+
+// GetDevice returns the device for id and whether it exists.
+func (app *WebApp) GetDevice(id string) (*webtypes.DeviceConnection, bool) {
+	app.devicesMu.RLock()
+	defer app.devicesMu.RUnlock()
+
+	device, ok := app.devices[id]
+
+	return device, ok
+}
+
+// DeviceSnapshot returns a list of (id, *DeviceConnection) pairs taken
+// under a single read lock. Callers can iterate the result without
+// holding any registry lock. Devices added or removed after the call
+// are not reflected; the pointers themselves remain valid because
+// nothing deletes from the underlying map today.
+func (app *WebApp) DeviceSnapshot() []DeviceEntry {
+	app.devicesMu.RLock()
+	defer app.devicesMu.RUnlock()
+
+	out := make([]DeviceEntry, 0, len(app.devices))
+	for id, device := range app.devices {
+		out = append(out, DeviceEntry{ID: id, Device: device})
+	}
+
+	return out
+}
+
+// DeviceCount returns the number of registered devices at call time.
+func (app *WebApp) DeviceCount() int {
+	app.devicesMu.RLock()
+	defer app.devicesMu.RUnlock()
+
+	return len(app.devices)
+}
+
+// AddDevice atomically registers conn under id when id is not already
+// known. If id existed, its LastSeen is bumped and AddDevice returns
+// false (the caller should discard conn). Returns true if conn was
+// inserted.
+func (app *WebApp) AddDevice(id string, conn *webtypes.DeviceConnection) bool {
+	app.devicesMu.Lock()
+	defer app.devicesMu.Unlock()
+
+	if existing, ok := app.devices[id]; ok {
+		existing.LastSeen = time.Now()
+		return false
+	}
+
+	app.devices[id] = conn
+
+	return true
+}
+
+// TouchDevice bumps LastSeen for id if it exists; returns true if
+// found. Use this as a fast-path check before doing the network work
+// needed to construct a new DeviceConnection.
+func (app *WebApp) TouchDevice(id string) bool {
+	app.devicesMu.Lock()
+	defer app.devicesMu.Unlock()
+
+	existing, ok := app.devices[id]
+	if !ok {
+		return false
+	}
+
+	existing.LastSeen = time.Now()
+
+	return true
+}
+
+// HandleAPIDevices returns all devices as JSON
+func (app *WebApp) HandleAPIDevices(w http.ResponseWriter, _ *http.Request) {
+	w.Header().Set("Content-Type", "application/json")
+
+	// Return all devices as JSON
+	snapshot := app.DeviceSnapshot()
+	devices := make(map[string]interface{}, len(snapshot))
+
+	for _, entry := range snapshot {
+		devices[entry.ID] = map[string]interface{}{
+			"info":     entry.Device.DeviceInfo,
+			"status":   entry.Device.Status(),
+			"lastSeen": entry.Device.LastSeen,
+		}
+	}
+
+	response := webtypes.APIResponse{
+		Success: true,
+		Data:    devices,
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// HandleAPIDevice returns a specific device as JSON
+func (app *WebApp) HandleAPIDevice(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+	if deviceID == "" {
+		app.sendError(w, "Device ID required", http.StatusBadRequest)
+		return
+	}
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	// Update device status to get fresh power state
+	app.UpdateDeviceStatus(deviceID, device)
+
+	// Connect WebSocket for real-time updates if not already connected
+	if device.WebSocket == nil {
+		go app.ConnectDeviceWebSocket(deviceID, device)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	response := webtypes.APIResponse{
+		Success: true,
+		Data: map[string]interface{}{
+			"info":   device.DeviceInfo,
+			"status": device.Status(),
+		},
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// HandleAPIControl handles device control commands
+func (app *WebApp) HandleAPIControl(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+	action := chi.URLParam(r, "action")
+
+	if deviceID == "" {
+		app.sendError(w, "Device ID required", http.StatusBadRequest)
+		return
+	}
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	// Connect WebSocket for real-time updates if not already connected
+	if device.WebSocket == nil {
+		go app.ConnectDeviceWebSocket(deviceID, device)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	app.handleControlAction(w, r, action, device)
+}
+
+// handleControlAction processes different control actions
+func (app *WebApp) handleControlAction(w http.ResponseWriter, r *http.Request, action string, device *webtypes.DeviceConnection) {
+	switch action {
+	case "play":
+		if device.Client == nil {
+			app.sendError(w, "Device client not available", http.StatusInternalServerError)
+			return
+		}
+
+		err := device.Client.Play()
+		app.sendControlResponse(w, err, "Started playback")
+	case "pause":
+		if device.Client == nil {
+			app.sendError(w, "Device client not available", http.StatusInternalServerError)
+			return
+		}
+
+		err := device.Client.Pause()
+		app.sendControlResponse(w, err, "Paused playback")
+	case "stop":
+		if device.Client == nil {
+			app.sendError(w, "Device client not available", http.StatusInternalServerError)
+			return
+		}
+
+		err := device.Client.Stop()
+		app.sendControlResponse(w, err, "Stopped playback")
+	case "next":
+		if device.Client == nil {
+			app.sendError(w, "Device client not available", http.StatusInternalServerError)
+			return
+		}
+
+		err := device.Client.NextTrack()
+		app.sendControlResponse(w, err, "Next track")
+	case "previous":
+		if device.Client == nil {
+			app.sendError(w, "Device client not available", http.StatusInternalServerError)
+			return
+		}
+
+		err := device.Client.PrevTrack()
+		app.sendControlResponse(w, err, "Previous track")
+	case "volume":
+		app.handleVolumeControl(w, r, device)
+	case "mute":
+		if device.Client == nil {
+			app.sendError(w, "Device client not available", http.StatusInternalServerError)
+			return
+		}
+
+		err := device.Client.SendKey(models.KeyMute)
+		app.sendControlResponse(w, err, "Toggled mute")
+	case "preset":
+		app.handlePresetControl(w, r, device)
+	case "bass":
+		app.handleBassControl(w, r, device)
+	case "source":
+		app.handleSourceControl(w, r, device)
+	default:
+		app.sendError(w, "Unknown action", http.StatusBadRequest)
+	}
+}
+
+// handleVolumeControl processes volume control requests
+func (app *WebApp) handleVolumeControl(w http.ResponseWriter, r *http.Request, device *webtypes.DeviceConnection) {
+	if r.Method != http.MethodPost {
+		app.sendError(w, "POST required for volume control", http.StatusMethodNotAllowed)
+		return
+	}
+
+	var volumeReq webtypes.VolumeRequest
+	if err := json.NewDecoder(r.Body).Decode(&volumeReq); err != nil {
+		app.sendError(w, "Invalid volume data", http.StatusBadRequest)
+		return
+	}
+
+	if volumeReq.Level < 0 || volumeReq.Level > 100 {
+		app.sendError(w, "Volume must be between 0 and 100", http.StatusBadRequest)
+		return
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	err := device.Client.SetVolume(volumeReq.Level)
+	app.sendControlResponse(w, err, fmt.Sprintf("Volume set to %d", volumeReq.Level))
+}
+
+// handlePresetControl processes preset control requests
+func (app *WebApp) handlePresetControl(w http.ResponseWriter, r *http.Request, device *webtypes.DeviceConnection) {
+	presetParam := r.URL.Query().Get("id")
+	if presetParam == "" {
+		app.sendError(w, "Preset ID required", http.StatusBadRequest)
+		return
+	}
+
+	presetID, err := strconv.Atoi(presetParam)
+	if err != nil {
+		app.sendError(w, "Invalid preset ID", http.StatusBadRequest)
+		return
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	err = device.Client.SelectPreset(presetID)
+	app.sendControlResponse(w, err, fmt.Sprintf("Selected preset %d", presetID))
+}
+
+// handleBassControl processes bass control requests
+func (app *WebApp) handleBassControl(w http.ResponseWriter, r *http.Request, device *webtypes.DeviceConnection) {
+	if r.Method != http.MethodPost {
+		app.sendError(w, "POST required for bass control", http.StatusMethodNotAllowed)
+		return
+	}
+
+	var bassReq webtypes.BassRequest
+	if err := json.NewDecoder(r.Body).Decode(&bassReq); err != nil {
+		app.sendError(w, "Invalid bass data", http.StatusBadRequest)
+		return
+	}
+
+	if bassReq.Level < -9 || bassReq.Level > 9 {
+		app.sendError(w, "Bass must be between -9 and 9", http.StatusBadRequest)
+		return
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	err := device.Client.SetBass(bassReq.Level)
+	app.sendControlResponse(w, err, fmt.Sprintf("Bass set to %d", bassReq.Level))
+}
+
+// handleSourceControl processes source control requests
+func (app *WebApp) handleSourceControl(w http.ResponseWriter, r *http.Request, device *webtypes.DeviceConnection) {
+	sourceParam := r.URL.Query().Get("name")
+	if sourceParam == "" {
+		app.sendError(w, "Source name required", http.StatusBadRequest)
+		return
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	err := device.Client.SelectSource(sourceParam, "")
+	app.sendControlResponse(w, err, fmt.Sprintf("Selected source %s", sourceParam))
+}
+
+// sendControlResponse sends a control command response
+func (app *WebApp) sendControlResponse(w http.ResponseWriter, err error, successMessage string) {
+	if err != nil {
+		app.sendError(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	response := webtypes.APIResponse{
+		Success: true,
+		Data:    map[string]string{"message": successMessage},
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// sendError sends an error response
+func (app *WebApp) sendError(w http.ResponseWriter, message string, statusCode int) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(statusCode)
+
+	response := webtypes.APIResponse{
+		Success: false,
+		Error:   message,
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		http.Error(w, "Failed to encode error response", http.StatusInternalServerError)
+	}
+}
+
+// HandleDeviceKey handles sending key commands to devices
+func (app *WebApp) HandleDeviceKey(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+	key := chi.URLParam(r, "key")
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	// Connect WebSocket for real-time updates if not already connected
+	if device.WebSocket == nil {
+		go app.ConnectDeviceWebSocket(deviceID, device)
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	err := device.Client.SendKey(key)
+	app.sendControlResponse(w, err, fmt.Sprintf("Sent key command: %s", key))
+}
+
+// HandleDirectVolumeControl handles direct volume setting via URL parameter
+func (app *WebApp) HandleDirectVolumeControl(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+
+	volumeLevel, err := strconv.Atoi(chi.URLParam(r, "volume"))
+	if err != nil || volumeLevel < 0 || volumeLevel > 100 {
+		app.sendError(w, "Invalid volume level (0-100)", http.StatusBadRequest)
+		return
+	}
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	// Connect WebSocket for real-time updates if not already connected
+	if device.WebSocket == nil {
+		go app.ConnectDeviceWebSocket(deviceID, device)
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	err = device.Client.SetVolume(volumeLevel)
+	app.sendControlResponse(w, err, fmt.Sprintf("Volume set to %d", volumeLevel))
+}
+
+// HandleDevicePower handles power toggle commands for devices
+func (app *WebApp) HandleDevicePower(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	// Connect WebSocket for real-time updates if not already connected
+	if device.WebSocket == nil {
+		go app.ConnectDeviceWebSocket(deviceID, device)
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	// Send POWER key command to toggle device power
+	err := device.Client.SendKey("POWER")
+	app.sendControlResponse(w, err, "Power toggle command sent")
+}
+
+// HandleDevicePowerStatus handles lightweight power status check
+func (app *WebApp) HandleDevicePowerStatus(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	if device.Client == nil {
+		app.sendError(w, "Device client not available", http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	// Quick power status check by getting now playing
+	nowPlaying, err := device.Client.GetNowPlaying()
+	if err != nil {
+		app.sendControlResponse(w, err, "Failed to get power status")
+		return
+	}
+
+	isPoweredOn := nowPlaying != nil && nowPlaying.Source != "STANDBY"
+
+	response := webtypes.APIResponse{
+		Success: true,
+		Data: map[string]interface{}{
+			"deviceId":    deviceID,
+			"isPoweredOn": isPoweredOn,
+			"source":      nowPlaying.Source,
+		},
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// BroadcastDeviceList sends updated device list to all connected WebSocket clients
+func (app *WebApp) BroadcastDeviceList() {
+	app.WSMutex.RLock()
+	defer app.WSMutex.RUnlock()
+
+	snapshot := app.DeviceSnapshot()
+	devices := make(map[string]interface{}, len(snapshot))
+
+	for _, entry := range snapshot {
+		devices[entry.ID] = map[string]interface{}{
+			"info":     entry.Device.DeviceInfo,
+			"status":   entry.Device.Status(),
+			"lastSeen": entry.Device.LastSeen,
+		}
+	}
+
+	message := webtypes.WebSocketMessage{
+		Type: "devices",
+		Data: devices,
+	}
+
+	// Send to all connected clients
+	var failedClients []*websocket.Conn
+
+	for client := range app.WSClients {
+		if err := client.WriteJSON(message); err != nil {
+			log.Printf("Failed to send device update to WebSocket client: %v", err)
+			// Mark for removal to avoid modifying map during iteration
+			failedClients = append(failedClients, client)
+		}
+	}
+
+	// Remove failed clients
+	for _, client := range failedClients {
+		delete(app.WSClients, client)
+		client.Close()
+	}
+}
+
+// BroadcastDiscoveryStatus sends discovery progress updates to all connected WebSocket clients
+func (app *WebApp) BroadcastDiscoveryStatus(status string, deviceCount int) {
+	app.WSMutex.RLock()
+	defer app.WSMutex.RUnlock()
+
+	message := webtypes.WebSocketMessage{
+		Type: "discovery_status",
+		Data: map[string]interface{}{
+			"status":      status,
+			"deviceCount": deviceCount,
+		},
+	}
+
+	// Send to all connected clients
+	var failedClients []*websocket.Conn
+
+	for client := range app.WSClients {
+		if err := client.WriteJSON(message); err != nil {
+			log.Printf("Failed to send discovery status to WebSocket client: %v", err)
+			// Mark for removal to avoid modifying map during iteration
+			failedClients = append(failedClients, client)
+		}
+	}
+
+	// Remove failed clients
+	for _, client := range failedClients {
+		delete(app.WSClients, client)
+		client.Close()
+	}
+}
+
+// HandleTuneInSearch handles TuneIn search requests, proxying directly to the bmx package.
+func (app *WebApp) HandleTuneInSearch(w http.ResponseWriter, r *http.Request) {
+	query := r.URL.Query().Get("q")
+	if query == "" {
+		app.sendError(w, "query parameter 'q' is required", http.StatusBadRequest)
+		return
+	}
+
+	resp, err := bmxpkg.TuneInSearch(query)
+	if err != nil {
+		app.sendError(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if encErr := json.NewEncoder(w).Encode(webtypes.APIResponse{Success: true, Data: resp}); encErr != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// HandleTuneInNavigate handles TuneIn browse/navigate requests, proxying directly to the bmx package.
+// Supported path suffixes (relative to /api/tunein/navigate):
+//   - (empty)                             → top-level browse
+//   - /{encodedURI}                       → browse the given TuneIn URI
+//   - /sub/{n}/{encodedURI}               → single subsection
+//   - /profiles/{type}/{id}/{encodedURI}  → artist/program profile
+func (app *WebApp) HandleTuneInNavigate(w http.ResponseWriter, r *http.Request) {
+	wildcard := chi.URLParam(r, "*")
+
+	var (
+		resp interface{}
+		err  error
+	)
+
+	if wildcard == "" {
+		resp, err = bmxpkg.TuneInNavigate("", nil)
+	} else {
+		firstSlash := strings.Index(wildcard, "/")
+		if firstSlash == -1 {
+			resp, err = bmxpkg.TuneInNavigate(wildcard, nil)
+		} else {
+			pfx := wildcard[:firstSlash]
+			rest := wildcard[firstSlash+1:]
+
+			switch pfx {
+			case "sub":
+				secondSlash := strings.Index(rest, "/")
+				if secondSlash == -1 {
+					resp, err = bmxpkg.TuneInNavigate(rest, nil)
+				} else {
+					n, parseErr := strconv.Atoi(rest[:secondSlash])
+					if parseErr != nil {
+						resp, err = bmxpkg.TuneInNavigate(wildcard, nil)
+					} else {
+						resp, err = bmxpkg.TuneInNavigate(rest[secondSlash+1:], &n)
+					}
+				}
+			case "profiles":
+				parts := strings.SplitN(rest, "/", 3)
+				if len(parts) < 3 {
+					resp, err = bmxpkg.TuneInNavigate(wildcard, nil)
+				} else {
+					resp, err = bmxpkg.TuneInNavigateProfile(parts[2])
+				}
+			default:
+				resp, err = bmxpkg.TuneInNavigate(wildcard, nil)
+			}
+		}
+	}
+
+	if err != nil {
+		app.sendError(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if encErr := json.NewEncoder(w).Encode(webtypes.APIResponse{Success: true, Data: resp}); encErr != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// HandlePlayTuneIn plays a TuneIn content item on a specific device via POST /select.
+func (app *WebApp) HandlePlayTuneIn(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+	if deviceID == "" {
+		app.sendError(w, "Device ID required", http.StatusBadRequest)
+		return
+	}
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		app.sendError(w, fmt.Sprintf("Device '%s' not found", deviceID), http.StatusNotFound)
+		return
+	}
+
+	var req struct {
+		Location     string `json:"location"`
+		Name         string `json:"name"`
+		Type         string `json:"type"`
+		ContainerArt string `json:"containerArt"`
+	}
+
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		app.sendError(w, "Invalid request body", http.StatusBadRequest)
+		return
+	}
+
+	if req.Location == "" {
+		app.sendError(w, "location is required", http.StatusBadRequest)
+		return
+	}
+
+	itemType := req.Type
+	if itemType == "" {
+		itemType = "stationurl"
+	}
+
+	contentItem := &models.ContentItem{
+		Source:       "TUNEIN",
+		Type:         itemType,
+		Location:     req.Location,
+		ItemName:     req.Name,
+		IsPresetable: true,
+		ContainerArt: req.ContainerArt,
+	}
+
+	if err := device.Client.SelectContentItem(contentItem); err != nil {
+		app.sendError(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+
+	if encErr := json.NewEncoder(w).Encode(webtypes.APIResponse{Success: true, Data: map[string]string{"message": "Playing " + req.Name}}); encErr != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
@@ -0,0 +1,578 @@
+// Package handlers contains tests for HTTP handlers.
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/webtypes"
+	"github.com/gesellix/bose-soundtouch/pkg/client"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/go-chi/chi/v5"
+)
+
+func createTestApp() *WebApp {
+	app := NewWebApp()
+
+	// Add test device with minimal data
+	deviceInfo := &models.DeviceInfo{
+		Name: "Test Speaker",
+		Type: "SoundTouch 30",
+		NetworkInfo: []models.NetworkInfo{
+			{MacAddress: "TEST123", IPAddress: "192.168.1.100"},
+		},
+	}
+
+	device := webtypes.NewDeviceConnection(nil, deviceInfo)
+	device.SetStatus(&webtypes.DeviceStatus{
+		Volume:       &models.Volume{ActualVolume: 50, MuteEnabled: false},
+		Bass:         &models.Bass{ActualBass: 0},
+		IsConnected:  true,
+		LastActivity: time.Now(),
+	})
+
+	app.AddDevice("test-device", device)
+	return app
+}
+
+func withChiParams(r *http.Request, params map[string]string) *http.Request {
+	rctx := chi.NewRouteContext()
+	for k, v := range params {
+		rctx.URLParams.Add(k, v)
+	}
+	return r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, rctx))
+}
+
+func TestNewWebApp(t *testing.T) {
+	app := NewWebApp()
+
+	// Use require-style checks that satisfy static analyzer
+	if app == nil {
+		t.Fatal("NewWebApp returned nil")
+	}
+
+	if count := app.DeviceCount(); count != 0 {
+		t.Errorf("Expected empty device registry, got %d devices", count)
+	}
+}
+
+func TestHandleAPIDevices(t *testing.T) {
+	app := createTestApp()
+
+	req := httptest.NewRequest("GET", "/api/devices", nil)
+	w := httptest.NewRecorder()
+
+	app.HandleAPIDevices(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d", w.Code)
+	}
+
+	contentType := w.Header().Get("Content-Type")
+	if !strings.Contains(contentType, "application/json") {
+		t.Errorf("Expected JSON content type, got %s", contentType)
+	}
+
+	var response webtypes.APIResponse
+	if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+		t.Fatalf("Failed to decode response: %v", err)
+	}
+
+	if !response.Success {
+		t.Errorf("Expected success=true, got false")
+	}
+
+	// Check that devices data is present
+	data, ok := response.Data.(map[string]interface{})
+	if !ok {
+		t.Fatalf("Expected data to be map[string]interface{}")
+	}
+
+	if _, exists := data["test-device"]; !exists {
+		t.Errorf("Expected 'test-device' in response data")
+	}
+}
+
+func TestHandleAPIDevice(t *testing.T) {
+	app := createTestApp()
+
+	tests := []struct {
+		name           string
+		path           string
+		chiID          string
+		expectedStatus int
+		expectSuccess  bool
+	}{
+		{
+			name:           "valid device",
+			path:           "/api/device/test-device",
+			chiID:          "test-device",
+			expectedStatus: http.StatusOK,
+			expectSuccess:  true,
+		},
+		{
+			name:           "missing device ID",
+			path:           "/api/device/",
+			chiID:          "",
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+		{
+			name:           "unknown device",
+			path:           "/api/device/unknown",
+			chiID:          "unknown",
+			expectedStatus: http.StatusNotFound,
+			expectSuccess:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.path, nil)
+			if tt.chiID != "" {
+				req = withChiParams(req, map[string]string{"id": tt.chiID})
+			}
+			w := httptest.NewRecorder()
+
+			app.HandleAPIDevice(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			contentType := w.Header().Get("Content-Type")
+			if !strings.Contains(contentType, "application/json") {
+				t.Errorf("Expected JSON content type, got %s", contentType)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Fatalf("Failed to decode response: %v", err)
+			}
+
+			if response.Success != tt.expectSuccess {
+				t.Errorf("Expected success=%v, got %v", tt.expectSuccess, response.Success)
+			}
+		})
+	}
+}
+
+func TestHandleAPIControl_InvalidDevice(t *testing.T) {
+	app := createTestApp()
+
+	req := httptest.NewRequest("GET", "/api/control/unknown-device/play", nil)
+	req = withChiParams(req, map[string]string{"id": "unknown-device", "action": "play"})
+	w := httptest.NewRecorder()
+
+	app.HandleAPIControl(w, req)
+
+	if w.Code != http.StatusNotFound {
+		t.Errorf("Expected status 404, got %d", w.Code)
+	}
+
+	var response webtypes.APIResponse
+	if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+		t.Fatalf("Failed to decode response: %v", err)
+	}
+
+	if response.Success {
+		t.Errorf("Expected success=false, got true")
+	}
+
+	if response.Error != "Device not found" {
+		t.Errorf("Expected 'Device not found' error, got '%s'", response.Error)
+	}
+}
+
+func TestHandleAPIControl_InvalidPath(t *testing.T) {
+	app := createTestApp()
+
+	tests := []struct {
+		name string
+		path string
+	}{
+		{"missing action", "/api/control/test-device"},
+		{"missing device and action", "/api/control/"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.path, nil)
+			w := httptest.NewRecorder()
+
+			app.HandleAPIControl(w, req)
+
+			if w.Code != http.StatusBadRequest {
+				t.Errorf("Expected status 400, got %d", w.Code)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Fatalf("Failed to decode response: %v", err)
+			}
+
+			if response.Success {
+				t.Errorf("Expected success=false, got true")
+			}
+		})
+	}
+}
+
+func TestHandleAPIControl_VolumeValidation(t *testing.T) {
+	app := createTestApp()
+
+	tests := []struct {
+		name           string
+		method         string
+		body           string
+		expectedStatus int
+		expectSuccess  bool
+	}{
+		{
+			name:           "invalid method",
+			method:         "GET",
+			body:           "",
+			expectedStatus: http.StatusMethodNotAllowed,
+			expectSuccess:  false,
+		},
+		{
+			name:           "invalid JSON",
+			method:         "POST",
+			body:           `invalid json`,
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+		{
+			name:           "volume too low",
+			method:         "POST",
+			body:           `{"level": -1}`,
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+		{
+			name:           "volume too high",
+			method:         "POST",
+			body:           `{"level": 101}`,
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var req *http.Request
+			if tt.body != "" {
+				req = httptest.NewRequest(tt.method, "/api/control/test-device/volume", strings.NewReader(tt.body))
+			} else {
+				req = httptest.NewRequest(tt.method, "/api/control/test-device/volume", nil)
+			}
+			req = withChiParams(req, map[string]string{"id": "test-device", "action": "volume"})
+			req.Header.Set("Content-Type", "application/json")
+
+			w := httptest.NewRecorder()
+			app.HandleAPIControl(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Fatalf("Failed to decode response: %v", err)
+			}
+
+			if response.Success != tt.expectSuccess {
+				t.Errorf("Expected success=%v, got %v", tt.expectSuccess, response.Success)
+			}
+		})
+	}
+}
+
+func TestHandleAPIControl_BassValidation(t *testing.T) {
+	app := createTestApp()
+
+	tests := []struct {
+		name           string
+		method         string
+		body           string
+		expectedStatus int
+		expectSuccess  bool
+	}{
+		{
+			name:           "bass too low",
+			method:         "POST",
+			body:           `{"level": -10}`,
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+		{
+			name:           "bass too high",
+			method:         "POST",
+			body:           `{"level": 10}`,
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, "/api/control/test-device/bass", strings.NewReader(tt.body))
+			req = withChiParams(req, map[string]string{"id": "test-device", "action": "bass"})
+			req.Header.Set("Content-Type", "application/json")
+
+			w := httptest.NewRecorder()
+			app.HandleAPIControl(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Fatalf("Failed to decode response: %v", err)
+			}
+
+			if response.Success != tt.expectSuccess {
+				t.Errorf("Expected success=%v, got %v", tt.expectSuccess, response.Success)
+			}
+		})
+	}
+}
+
+func TestHandleAPIControl_PresetValidation(t *testing.T) {
+	app := createTestApp()
+
+	tests := []struct {
+		name           string
+		query          string
+		expectedStatus int
+		expectSuccess  bool
+	}{
+		{
+			name:           "missing preset ID",
+			query:          "",
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+		{
+			name:           "invalid preset ID",
+			query:          "?id=abc",
+			expectedStatus: http.StatusBadRequest,
+			expectSuccess:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", "/api/control/test-device/preset"+tt.query, nil)
+			req = withChiParams(req, map[string]string{"id": "test-device", "action": "preset"})
+			w := httptest.NewRecorder()
+
+			app.HandleAPIControl(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Fatalf("Failed to decode response: %v", err)
+			}
+
+			if response.Success != tt.expectSuccess {
+				t.Errorf("Expected success=%v, got %v", tt.expectSuccess, response.Success)
+			}
+		})
+	}
+}
+
+func TestHandleAPIControl_SourceValidation(t *testing.T) {
+	app := createTestApp()
+
+	req := httptest.NewRequest("GET", "/api/control/test-device/source", nil)
+	req = withChiParams(req, map[string]string{"id": "test-device", "action": "source"})
+	w := httptest.NewRecorder()
+
+	app.HandleAPIControl(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected status 400, got %d", w.Code)
+	}
+
+	var response webtypes.APIResponse
+	if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+		t.Fatalf("Failed to decode response: %v", err)
+	}
+
+	if response.Success {
+		t.Errorf("Expected success=false, got true")
+	}
+
+	if response.Error != "Source name required" {
+		t.Errorf("Expected 'Source name required' error, got '%s'", response.Error)
+	}
+}
+
+func TestHandleAPIDiscover(t *testing.T) {
+	app := createTestApp()
+
+	tests := []struct {
+		name           string
+		method         string
+		expectedStatus int
+		expectSuccess  bool
+	}{
+		{
+			name:           "valid POST request",
+			method:         "POST",
+			expectedStatus: http.StatusOK,
+			expectSuccess:  true,
+		},
+		{
+			name:           "invalid GET request",
+			method:         "GET",
+			expectedStatus: http.StatusMethodNotAllowed,
+			expectSuccess:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, "/api/discover", nil)
+			w := httptest.NewRecorder()
+
+			app.HandleAPIDiscover(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Fatalf("Failed to decode response: %v", err)
+			}
+
+			if response.Success != tt.expectSuccess {
+				t.Errorf("Expected success=%v, got %v", tt.expectSuccess, response.Success)
+			}
+		})
+	}
+}
+
+func TestSendError(t *testing.T) {
+	app := createTestApp()
+
+	w := httptest.NewRecorder()
+	app.sendError(w, "Test error", http.StatusBadRequest)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected status 400, got %d", w.Code)
+	}
+
+	var response webtypes.APIResponse
+	if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+		t.Fatalf("Failed to decode response: %v", err)
+	}
+
+	if response.Success {
+		t.Errorf("Expected success=false, got true")
+	}
+
+	if response.Error != "Test error" {
+		t.Errorf("Expected 'Test error', got '%s'", response.Error)
+	}
+
+	contentType := w.Header().Get("Content-Type")
+	if contentType != "application/json" {
+		t.Errorf("Expected Content-Type 'application/json', got '%s'", contentType)
+	}
+}
+
+func TestHandleWebSocket_InvalidUpgrade(t *testing.T) {
+	app := createTestApp()
+
+	// Test without proper WebSocket headers (should fail gracefully)
+	req := httptest.NewRequest("GET", "/ws", nil)
+	w := httptest.NewRecorder()
+
+	// This will fail because it's not a real WebSocket upgrade, but should not panic
+	app.HandleWebSocket(w, req)
+
+	// We're just checking that the handler doesn't panic
+	// The actual upgrade will fail in test environment without proper headers
+}
+
+func TestHandleAPIControl_UnsupportedAction(t *testing.T) {
+	app := createTestApp()
+
+	req := httptest.NewRequest("GET", "/api/control/test-device/unsupported", nil)
+	req = withChiParams(req, map[string]string{"id": "test-device", "action": "unsupported"})
+	w := httptest.NewRecorder()
+
+	app.HandleAPIControl(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected status 400, got %d", w.Code)
+	}
+
+	var response webtypes.APIResponse
+	if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+		t.Fatalf("Failed to decode response: %v", err)
+	}
+
+	if response.Success {
+		t.Errorf("Expected success=false, got true")
+	}
+
+	if response.Error != "Unknown action" {
+		t.Errorf("Expected 'Unknown action' error, got '%s'", response.Error)
+	}
+}
+
+// Benchmark tests
+func BenchmarkHandleAPIDevices(b *testing.B) {
+	app := createTestApp()
+
+	// Add more devices for realistic benchmarking
+	for i := 0; i < 10; i++ {
+		deviceID := "device-" + string(rune('0'+i))
+		conn := webtypes.NewDeviceConnection(&client.Client{}, &models.DeviceInfo{Name: "Test Device " + deviceID})
+		conn.SetStatus(&webtypes.DeviceStatus{IsConnected: true})
+		app.AddDevice(deviceID, conn)
+	}
+
+	req := httptest.NewRequest("GET", "/api/devices", nil)
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		w := httptest.NewRecorder()
+		app.HandleAPIDevices(w, req)
+	}
+}
+
+func BenchmarkHandleAPIDevice(b *testing.B) {
+	app := createTestApp()
+	req := httptest.NewRequest("GET", "/api/device/test-device", nil)
+	req = withChiParams(req, map[string]string{"id": "test-device"})
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		w := httptest.NewRecorder()
+		app.HandleAPIDevice(w, req)
+	}
+}
+
+func BenchmarkSendError(b *testing.B) {
+	app := createTestApp()
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		w := httptest.NewRecorder()
+		app.sendError(w, "Test error", http.StatusBadRequest)
+	}
+}
@@ -0,0 +1,194 @@
+// Package handlers contains tests for the device registry API on
+// WebApp (GetDevice, AddDevice, TouchDevice, DeviceSnapshot,
+// DeviceCount).
+package handlers
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/webtypes"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+)
+
+func newRegistryDevice(name string) *webtypes.DeviceConnection {
+	conn := webtypes.NewDeviceConnection(nil, &models.DeviceInfo{Name: name})
+	conn.SetStatus(&webtypes.DeviceStatus{IsConnected: true})
+
+	return conn
+}
+
+func TestAddDevice_Inserts(t *testing.T) {
+	app := NewWebApp()
+	conn := newRegistryDevice("first")
+
+	if !app.AddDevice("host-1", conn) {
+		t.Fatal("AddDevice returned false on first insert")
+	}
+
+	got, ok := app.GetDevice("host-1")
+	if !ok {
+		t.Fatal("GetDevice did not find the device after AddDevice")
+	}
+
+	if got != conn {
+		t.Errorf("GetDevice returned a different pointer than inserted")
+	}
+}
+
+func TestAddDevice_RejectsDuplicateAndBumpsLastSeen(t *testing.T) {
+	app := NewWebApp()
+	original := newRegistryDevice("first")
+	app.AddDevice("host-1", original)
+
+	originalSeen := original.LastSeen
+	replacement := newRegistryDevice("second")
+
+	if app.AddDevice("host-1", replacement) {
+		t.Fatal("AddDevice returned true on duplicate; expected false")
+	}
+
+	got, _ := app.GetDevice("host-1")
+	if got != original {
+		t.Error("Duplicate AddDevice replaced the existing device pointer")
+	}
+
+	if !got.LastSeen.After(originalSeen) {
+		t.Error("Duplicate AddDevice did not bump LastSeen on existing device")
+	}
+}
+
+func TestTouchDevice(t *testing.T) {
+	app := NewWebApp()
+
+	if app.TouchDevice("missing") {
+		t.Error("TouchDevice returned true for unknown id")
+	}
+
+	conn := newRegistryDevice("first")
+	app.AddDevice("host-1", conn)
+	seenBefore := conn.LastSeen
+
+	if !app.TouchDevice("host-1") {
+		t.Fatal("TouchDevice returned false for known id")
+	}
+
+	if !conn.LastSeen.After(seenBefore) {
+		t.Error("TouchDevice did not bump LastSeen")
+	}
+}
+
+func TestDeviceSnapshotAndCount(t *testing.T) {
+	app := NewWebApp()
+
+	if got := app.DeviceCount(); got != 0 {
+		t.Errorf("DeviceCount on empty app = %d; want 0", got)
+	}
+
+	if snap := app.DeviceSnapshot(); len(snap) != 0 {
+		t.Errorf("DeviceSnapshot on empty app = %v; want []", snap)
+	}
+
+	for i := 0; i < 5; i++ {
+		app.AddDevice(fmt.Sprintf("host-%d", i), newRegistryDevice(fmt.Sprintf("n%d", i)))
+	}
+
+	if got := app.DeviceCount(); got != 5 {
+		t.Errorf("DeviceCount after 5 adds = %d; want 5", got)
+	}
+
+	snap := app.DeviceSnapshot()
+	if len(snap) != 5 {
+		t.Errorf("DeviceSnapshot len = %d; want 5", len(snap))
+	}
+
+	// Spot-check that the snapshot ids match what we inserted.
+	seen := map[string]bool{}
+	for _, entry := range snap {
+		seen[entry.ID] = true
+	}
+
+	for i := 0; i < 5; i++ {
+		id := fmt.Sprintf("host-%d", i)
+		if !seen[id] {
+			t.Errorf("DeviceSnapshot missing %s", id)
+		}
+	}
+}
+
+// TestRegistryConcurrent exercises the registry from many goroutines
+// at once. Before the introduction of devicesMu this would either
+// panic with "fatal error: concurrent map read and map write" or be
+// flagged by the race detector. The test runs under `go test -race`
+// in CI so a future regression that re-exposes the underlying map
+// without locking would be caught here.
+func TestRegistryConcurrent(t *testing.T) {
+	app := NewWebApp()
+
+	const workers = 16
+
+	const opsPerWorker = 200
+
+	var wg sync.WaitGroup
+	wg.Add(workers * 4)
+
+	// Writers: insert distinct ids across workers.
+	for w := 0; w < workers; w++ {
+		go func(worker int) {
+			defer wg.Done()
+
+			for i := 0; i < opsPerWorker; i++ {
+				id := fmt.Sprintf("w%d-%d", worker, i)
+				app.AddDevice(id, newRegistryDevice(id))
+			}
+		}(w)
+	}
+
+	// Touchers: bump LastSeen on a shared id (which may or may not
+	// exist yet — both branches are exercised).
+	for w := 0; w < workers; w++ {
+		go func() {
+			defer wg.Done()
+
+			for i := 0; i < opsPerWorker; i++ {
+				app.TouchDevice("shared")
+			}
+		}()
+	}
+
+	// Readers via snapshot.
+	for w := 0; w < workers; w++ {
+		go func() {
+			defer wg.Done()
+
+			for i := 0; i < opsPerWorker; i++ {
+				_ = app.DeviceSnapshot()
+			}
+		}()
+	}
+
+	// Readers via direct lookup.
+	for w := 0; w < workers; w++ {
+		go func() {
+			defer wg.Done()
+
+			for i := 0; i < opsPerWorker; i++ {
+				_, _ = app.GetDevice("shared")
+				_ = app.DeviceCount()
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	// Sanity check: every writer inserted opsPerWorker devices, plus
+	// the "shared" entry was never AddDevice'd so should be absent.
+	if got, want := app.DeviceCount(), workers*opsPerWorker; got != want {
+		t.Errorf("DeviceCount after concurrent inserts = %d; want %d", got, want)
+	}
+
+	if _, ok := app.GetDevice("shared"); ok {
+		t.Error("shared device should not exist (only TouchDevice was called for it)")
+	}
+}
@@ -0,0 +1,360 @@
+// Package handlers contains WebSocket handlers for real-time communication.
+package handlers
+
+import (
+	"encoding/json"
+	"log"
+	"net/http"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/webtypes"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/go-chi/chi/v5"
+	"github.com/gorilla/websocket"
+)
+
+// HandleWebSocket handles WebSocket connections for real-time updates
+func (app *WebApp) HandleWebSocket(w http.ResponseWriter, r *http.Request) {
+	conn, err := app.Upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Printf("WebSocket upgrade failed: %v", err)
+		return
+	}
+
+	defer func() {
+		// Unregister client
+		app.WSMutex.Lock()
+		delete(app.WSClients, conn)
+		app.WSMutex.Unlock()
+		conn.Close()
+	}()
+
+	// Register client
+	app.WSMutex.Lock()
+	app.WSClients[conn] = true
+	app.WSMutex.Unlock()
+
+	// Send initial device list
+	snapshot := app.DeviceSnapshot()
+	devices := make(map[string]interface{}, len(snapshot))
+
+	for _, entry := range snapshot {
+		devices[entry.ID] = map[string]interface{}{
+			"info":     entry.Device.DeviceInfo,
+			"status":   entry.Device.Status(),
+			"lastSeen": entry.Device.LastSeen,
+		}
+	}
+
+	initialMessage := webtypes.WebSocketMessage{
+		Type: "devices",
+		Data: devices,
+	}
+
+	if err := conn.WriteJSON(initialMessage); err != nil {
+		log.Printf("Failed to send initial data: %v", err)
+		return
+	}
+
+	// Keep connection alive and send updates
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	// Set up ping handler to detect client disconnects
+	conn.SetPongHandler(func(string) error {
+		conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+		return nil
+	})
+
+	// Set initial read deadline
+	conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+
+	// Handle incoming messages in a separate goroutine
+	go func() {
+		defer conn.Close()
+
+		for {
+			if _, _, err := conn.NextReader(); err != nil {
+				log.Printf("WebSocket read error: %v", err)
+				return
+			}
+		}
+	}()
+
+	// Main loop for sending periodic updates
+	for range ticker.C {
+		// Send ping to check if client is still connected
+		if err := conn.WriteMessage(websocket.PingMessage, []byte{}); err != nil {
+			log.Printf("Failed to send ping: %v", err)
+			return
+		}
+
+		// Send periodic status updates
+		for _, entry := range app.DeviceSnapshot() {
+			status := entry.Device.Status()
+			if status.IsConnected {
+				statusMessage := webtypes.WebSocketMessage{
+					Type:     "status_update",
+					DeviceID: entry.ID,
+					Data:     status,
+				}
+
+				if err := conn.WriteJSON(statusMessage); err != nil {
+					log.Printf("Failed to send status update: %v", err)
+					return
+				}
+			}
+		}
+	}
+}
+
+// HandleAPIDiscover triggers device discovery
+func (app *WebApp) HandleAPIDiscover(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		app.sendError(w, "Method not allowed", http.StatusMethodNotAllowed)
+		return
+	}
+
+	// Discovery will be triggered by the main app
+	w.Header().Set("Content-Type", "application/json")
+
+	response := webtypes.APIResponse{
+		Success: true,
+		Data:    map[string]string{"message": "Discovery started"},
+	}
+
+	if err := json.NewEncoder(w).Encode(response); err != nil {
+		http.Error(w, "Failed to encode response", http.StatusInternalServerError)
+	}
+}
+
+// ConnectDeviceWebSocket establishes a WebSocket connection to a device
+func (app *WebApp) ConnectDeviceWebSocket(deviceID string, conn *webtypes.DeviceConnection) {
+	// Skip WebSocket connection if client is not available (e.g., in tests)
+	if conn.Client == nil {
+		return
+	}
+
+	wsClient := conn.Client.NewWebSocketClient(nil)
+
+	// Setup event handlers. Each handler funnels its change through
+	// UpdateStatus so concurrent events and the periodic poller
+	// (UpdateDeviceStatus) cannot lose each other's writes.
+	wsClient.OnNowPlaying(func(event *models.NowPlayingUpdatedEvent) {
+		conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+			s.NowPlaying = &event.NowPlaying
+			s.LastActivity = time.Now()
+		})
+	})
+
+	wsClient.OnVolumeUpdated(func(event *models.VolumeUpdatedEvent) {
+		conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+			s.Volume = &event.Volume
+			s.LastActivity = time.Now()
+		})
+	})
+
+	wsClient.OnConnectionState(func(event *models.ConnectionStateUpdatedEvent) {
+		conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+			s.IsConnected = event.ConnectionState.IsConnected()
+			s.LastActivity = time.Now()
+		})
+	})
+
+	wsClient.OnPresetUpdated(func(event *models.PresetUpdatedEvent) {
+		conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+			s.Presets = &event.Presets
+			s.LastActivity = time.Now()
+		})
+	})
+
+	// Connect WebSocket
+	if err := wsClient.Connect(); err != nil {
+		log.Printf("Failed to connect WebSocket for device %s: %v", deviceID, err)
+		return
+	}
+
+	conn.WebSocket = wsClient
+
+	conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+		s.IsConnected = true
+	})
+
+	log.Printf("WebSocket connected for device %s", deviceID)
+
+	// Wait for disconnection
+	wsClient.Wait()
+
+	conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+		s.IsConnected = false
+	})
+
+	log.Printf("WebSocket disconnected for device %s", deviceID)
+}
+
+// UpdateDeviceStatus fetches current status from the device.
+//
+// Network calls run outside the atomic merge so the CAS loop in
+// UpdateStatus stays fast and doesn't retry slow IO. WebSocket event
+// handlers running concurrently are not lost: their UpdateStatus
+// runs against whichever snapshot they observe, and the merge below
+// sees their changes when it CAS-loops onto the latest status.
+func (app *WebApp) UpdateDeviceStatus(_ string, conn *webtypes.DeviceConnection) {
+	// Skip status update if client is not available (e.g., in tests)
+	if conn.Client == nil {
+		return
+	}
+
+	// Phase 1: slow network fetches. Local vars only, no shared state
+	// is touched yet. Errors are recorded so the merge below can tell
+	// "field N stayed unchanged" apart from "field N got refreshed".
+	nowPlaying, nowPlayingErr := conn.Client.GetNowPlaying()
+	volume, volumeErr := conn.Client.GetVolume()
+	presets, presetsErr := conn.Client.GetPresets()
+	sources, sourcesErr := conn.Client.GetSources()
+	bass, bassErr := conn.Client.GetBass()
+
+	// Phase 2: fast merge. Only fields we successfully fetched
+	// overwrite; everything else keeps the value other goroutines may
+	// have just written.
+	conn.UpdateStatus(func(s *webtypes.DeviceStatus) {
+		statusUpdated := false
+
+		if nowPlayingErr == nil {
+			s.NowPlaying = nowPlaying
+			statusUpdated = true
+		}
+
+		if volumeErr == nil {
+			s.Volume = volume
+			statusUpdated = true
+		}
+
+		if presetsErr == nil {
+			s.Presets = presets
+			statusUpdated = true
+		}
+
+		if sourcesErr == nil {
+			s.Sources = sources
+			statusUpdated = true
+		}
+
+		if bassErr == nil {
+			s.Bass = bass
+			statusUpdated = true
+		}
+
+		// Mark as connected if we successfully got at least one
+		// status from this round. Mirrors prior behaviour.
+		s.IsConnected = statusUpdated
+		s.LastActivity = time.Now()
+	})
+}
+
+// HandleDeviceWebSocket handles individual device WebSocket connections for real-time device-specific updates
+func (app *WebApp) HandleDeviceWebSocket(w http.ResponseWriter, r *http.Request) {
+	deviceID := chi.URLParam(r, "id")
+	if deviceID == "" {
+		http.Error(w, "Device ID required", http.StatusBadRequest)
+		return
+	}
+
+	device, exists := app.GetDevice(deviceID)
+	if !exists {
+		http.Error(w, "Device not found", http.StatusNotFound)
+		return
+	}
+
+	conn, err := app.Upgrader.Upgrade(w, r, nil)
+	if err != nil {
+		log.Printf("Device WebSocket upgrade failed for %s: %v", deviceID, err)
+		return
+	}
+	defer conn.Close()
+
+	log.Printf("Device WebSocket connected for %s", deviceID)
+
+	// Send initial device status
+	initialMessage := webtypes.WebSocketMessage{
+		Type:     "device_status",
+		DeviceID: deviceID,
+		Data: map[string]interface{}{
+			"info":   device.DeviceInfo,
+			"status": device.Status(),
+		},
+	}
+
+	if err := conn.WriteJSON(initialMessage); err != nil {
+		log.Printf("Failed to send initial device status: %v", err)
+		return
+	}
+
+	// Set up ping handler to detect client disconnects
+	conn.SetPongHandler(func(string) error {
+		conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+		return nil
+	})
+
+	// Set initial read deadline
+	conn.SetReadDeadline(time.Now().Add(60 * time.Second))
+
+	// Handle incoming messages in a separate goroutine
+	go func() {
+		defer conn.Close()
+
+		for {
+			if _, _, err := conn.NextReader(); err != nil {
+				log.Printf("Device WebSocket read error for %s: %v", deviceID, err)
+				return
+			}
+		}
+	}()
+
+	// Send periodic device status updates
+	ticker := time.NewTicker(10 * time.Second)
+	defer ticker.Stop()
+
+	for range ticker.C {
+		// Send ping to check if client is still connected
+		if err := conn.WriteMessage(websocket.PingMessage, []byte{}); err != nil {
+			log.Printf("Failed to send ping to device WebSocket %s: %v", deviceID, err)
+			return
+		}
+
+		// Send device status update
+		status := device.Status()
+		statusMessage := webtypes.WebSocketMessage{
+			Type:     "device_status",
+			DeviceID: deviceID,
+			Data: map[string]interface{}{
+				"info":   device.DeviceInfo,
+				"status": status,
+			},
+		}
+
+		if err := conn.WriteJSON(statusMessage); err != nil {
+			log.Printf("Failed to send device status update for %s: %v", deviceID, err)
+			return
+		}
+
+		// If device has active WebSocket connection to SoundTouch device,
+		// also send any real-time updates from that connection
+		if device.WebSocket != nil && status.IsConnected {
+			realtimeMessage := webtypes.WebSocketMessage{
+				Type:     "device_realtime",
+				DeviceID: deviceID,
+				Data: map[string]interface{}{
+					"nowPlaying": status.NowPlaying,
+					"volume":     status.Volume,
+					"timestamp":  time.Now(),
+				},
+			}
+
+			if err := conn.WriteJSON(realtimeMessage); err != nil {
+				log.Printf("Failed to send realtime update for %s: %v", deviceID, err)
+				return
+			}
+		}
+	}
+}
@@ -0,0 +1,331 @@
+// Package main provides a web UI for controlling Bose SoundTouch devices.
+package main
+
+import (
+	"context"
+	"embed"
+	"fmt"
+	"io/fs"
+	"log"
+	"net"
+	"net/http"
+	"os"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/handlers"
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/webtypes"
+	"github.com/gesellix/bose-soundtouch/pkg/client"
+	"github.com/gesellix/bose-soundtouch/pkg/config"
+	"github.com/gesellix/bose-soundtouch/pkg/discovery"
+	"github.com/go-chi/chi/v5"
+	"github.com/urfave/cli/v2"
+)
+
+//go:embed static
+var staticFS embed.FS
+
+func main() {
+	app := &cli.App{
+		Name:  "soundtouch-web",
+		Usage: "Web UI for controlling Bose SoundTouch devices",
+		Flags: []cli.Flag{
+			&cli.StringFlag{
+				Name:    "port",
+				Aliases: []string{"p"},
+				Usage:   "HTTP port to listen on",
+				Value:   "8080",
+				EnvVars: []string{"PORT"},
+			},
+			&cli.StringFlag{
+				Name:    "bind",
+				Usage:   "Address for the HTTP listener: host, IP, or local interface name (e.g. eth0). Leave empty to listen on all interfaces",
+				EnvVars: []string{"BIND_ADDR"},
+			},
+			&cli.StringFlag{
+				Name:    "interface",
+				Usage:   "Network interface name (e.g. eth0) for mDNS and UPnP device discovery. Defaults to the --bind interface name when one was given; leave empty otherwise to auto-pick",
+				EnvVars: []string{"DISCOVERY_INTERFACE"},
+			},
+			&cli.StringSliceFlag{
+				Name:    "devices",
+				Usage:   "SoundTouch device IP address(es) to add manually (can be specified multiple times)",
+				EnvVars: []string{"SOUNDTOUCH_DEVICES"},
+			},
+		},
+		Action: func(c *cli.Context) error {
+			port := c.String("port")
+			rawBind := c.String("bind")
+
+			bindAddr, err := resolveBindAddr(rawBind)
+			if err != nil {
+				log.Fatal(err)
+			}
+
+			if rawBind != "" && bindAddr != rawBind {
+				log.Printf("Resolved --bind %q to %s", rawBind, bindAddr)
+			}
+
+			rawIface := c.String("interface")
+			manualHosts := c.StringSlice("devices")
+
+			ifaceName := defaultDiscoveryInterface(rawIface, rawBind, bindAddr)
+			if rawIface == "" && ifaceName != "" {
+				log.Printf("Defaulting --interface to %q from --bind", ifaceName)
+			}
+
+			addr := ":" + port
+			if bindAddr != "" {
+				addr = bindAddr + ":" + port
+			}
+
+			// Create web app without templates (SPA mode)
+			webApp := handlers.NewWebApp()
+
+			// Initialize discovery service
+			cfg, err := config.LoadFromEnv()
+			if err != nil {
+				log.Printf("Failed to load config: %v, using defaults", err)
+
+				cfg = config.DefaultConfig()
+			}
+
+			cfg.DiscoveryTimeout = 10 * time.Second
+			cfg.CacheEnabled = true
+
+			if ifaceName != "" {
+				cfg.DiscoveryInterface = ifaceName
+			}
+
+			discoveryService := discovery.NewUnifiedDiscoveryService(cfg)
+
+			// Discover devices on startup
+			go func() {
+				ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+				defer cancel()
+
+				webApp.BroadcastDiscoveryStatus("starting", webApp.DeviceCount())
+
+				for _, host := range manualHosts {
+					addDevice(webApp, host, 8090, "manual")
+				}
+
+				discoverDevices(ctx, webApp, discoveryService)
+
+				webApp.BroadcastDiscoveryStatus("completed", webApp.DeviceCount())
+				webApp.BroadcastDeviceList()
+			}()
+
+			r := setupRoutes(webApp, discoveryService)
+
+			log.Printf("SoundTouch Web UI starting on http://%s", addr)
+
+			return http.ListenAndServe(addr, r)
+		},
+	}
+
+	if err := app.Run(os.Args); err != nil {
+		log.Fatal(err)
+	}
+}
+
+// defaultDiscoveryInterface picks the interface name to use for mDNS/UPnP
+// discovery. An explicit --interface always wins; otherwise, when --bind was
+// given an interface name (i.e. resolveBindAddr substituted an IP for it),
+// that name is reused so the common single-interface case "just works".
+// Returns the empty string when there is nothing to propagate, leaving the
+// discovery service to auto-pick.
+func defaultDiscoveryInterface(rawInterface, rawBind, resolvedBind string) string {
+	if rawInterface != "" {
+		return rawInterface
+	}
+
+	if rawBind != "" && rawBind != resolvedBind {
+		return rawBind
+	}
+
+	return ""
+}
+
+// resolveBindAddr returns the address to bind the HTTP listener to.
+//
+// If bindAddr names a local network interface, the interface's single IPv4
+// address is returned. When no IPv4 is present, the function falls back to the
+// interface's single non-link-local IPv6 address (wrapped in brackets so it
+// composes correctly with ":port"). Ambiguous interfaces (multiple addresses
+// in the chosen family) or interfaces with no usable address produce an error,
+// so misconfiguration surfaces immediately instead of becoming an obscure DNS
+// lookup failure at listen time.
+//
+// If bindAddr is not an interface name — including the empty string, a host
+// name, or a literal IP — it is returned unchanged.
+func resolveBindAddr(bindAddr string) (string, error) {
+	// A lookup failure here just means bindAddr isn't an interface name
+	// (it's a host, IP, or empty); fall through to pass-through.
+	iface, _ := net.InterfaceByName(bindAddr)
+	if iface == nil {
+		return bindAddr, nil
+	}
+
+	addrs, err := iface.Addrs()
+	if err != nil {
+		return "", fmt.Errorf("--bind %q: failed to list addresses for interface: %w", bindAddr, err)
+	}
+
+	var ipv4, ipv6 []net.IP
+
+	for _, addr := range addrs {
+		var ip net.IP
+
+		switch v := addr.(type) {
+		case *net.IPNet:
+			ip = v.IP
+		case *net.IPAddr:
+			ip = v.IP
+		}
+
+		if ip == nil {
+			continue
+		}
+
+		if v4 := ip.To4(); v4 != nil {
+			ipv4 = append(ipv4, v4)
+		} else if !ip.IsLinkLocalUnicast() {
+			// Skip IPv6 link-local (fe80::); it requires a zone ID and
+			// can't be used as a plain "[ip]:port" listen address.
+			ipv6 = append(ipv6, ip)
+		}
+	}
+
+	switch {
+	case len(ipv4) == 1:
+		return ipv4[0].String(), nil
+	case len(ipv4) > 1:
+		return "", fmt.Errorf("--bind %q: interface has multiple IPv4 addresses (%v); specify one directly", bindAddr, ipv4)
+	case len(ipv6) == 1:
+		return "[" + ipv6[0].String() + "]", nil
+	case len(ipv6) > 1:
+		return "", fmt.Errorf("--bind %q: interface has multiple IPv6 addresses (%v); specify one directly", bindAddr, ipv6)
+	default:
+		return "", fmt.Errorf("--bind %q: interface has no usable IPv4 or IPv6 address", bindAddr)
+	}
+}
+
+// addDevice registers a SoundTouch device with the WebApp by fetching
+// its /info and creating a DeviceConnection. The source label
+// ("manual" or "discovered") appears in log lines so the operator can
+// tell apart entries that came from --devices from those found via
+// mDNS/UPnP. If the host is already known, the existing entry's
+// LastSeen is bumped and the function returns without re-fetching.
+func addDevice(app *handlers.WebApp, host string, port int, source string) {
+	// Fast path: skip the network call if we already know this host.
+	if app.TouchDevice(host) {
+		return
+	}
+
+	c := client.NewClient(&client.Config{
+		Host:    host,
+		Port:    port,
+		Timeout: 10 * time.Second,
+	})
+
+	info, err := c.GetDeviceInfo()
+	if err != nil {
+		log.Printf("Failed to fetch device info from %s (%s): %v", host, source, err)
+		return
+	}
+
+	conn := webtypes.NewDeviceConnection(c, info)
+	if !app.AddDevice(host, conn) {
+		// Lost a race — another goroutine inserted the same host
+		// between TouchDevice and AddDevice. AddDevice bumped LastSeen
+		// on the existing entry; discard our conn.
+		return
+	}
+
+	go app.UpdateDeviceStatus(host, conn)
+
+	log.Printf("Added %s device %s (%s) at %s:%d", source, info.Name, info.Type, host, port)
+}
+
+func setupRoutes(app *handlers.WebApp, discoveryService *discovery.UnifiedDiscoveryService) *chi.Mux {
+	r := chi.NewRouter()
+
+	// Static assets (embedded in binary)
+	subFS, _ := fs.Sub(staticFS, "static")
+	r.Get("/static/*", http.StripPrefix("/static", http.FileServer(http.FS(subFS))).ServeHTTP)
+
+	// Serve index.html for SPA routes
+	serveIndex := func(w http.ResponseWriter, _ *http.Request) {
+		data, _ := staticFS.ReadFile("static/index.html")
+
+		w.Header().Set("Content-Type", "text/html")
+		_, _ = w.Write(data)
+	}
+
+	// WebSocket endpoint
+	r.Get("/ws", app.HandleWebSocket)
+
+	// API endpoints
+	r.Get("/api/devices", app.HandleAPIDevices)
+	r.Get("/api/device/{id}", app.HandleAPIDevice)
+	r.Post("/api/discover", func(w http.ResponseWriter, r *http.Request) {
+		app.HandleAPIDiscover(w, r)
+		// Trigger discovery
+		//nolint:contextcheck // Context is created within goroutine
+		go func() {
+			ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
+			defer cancel()
+
+			// Broadcast discovery start
+			app.BroadcastDiscoveryStatus("starting", app.DeviceCount())
+
+			discoverDevices(ctx, app, discoveryService)
+
+			// Broadcast discovery completion and updated device list
+			app.BroadcastDiscoveryStatus("completed", app.DeviceCount())
+			app.BroadcastDeviceList()
+		}()
+	})
+
+	// Device control endpoints (GET for most actions, POST for volume/bass)
+	r.Get("/api/control/{id}/{action}", app.HandleAPIControl)
+	r.Post("/api/control/{id}/{action}", app.HandleAPIControl)
+
+	// TuneIn browse, search, and playback
+	r.Get("/api/tunein/search", app.HandleTuneInSearch)
+	r.Get("/api/tunein/navigate", app.HandleTuneInNavigate)
+	r.Get("/api/tunein/navigate/*", app.HandleTuneInNavigate)
+	r.Post("/api/tunein/play/{id}", app.HandlePlayTuneIn)
+
+	// Enhanced device control endpoints
+	r.Post("/api/device-key/{id}/{key}", app.HandleDeviceKey)
+	r.Post("/api/device-volume/{id}/{volume}", app.HandleDirectVolumeControl)
+	r.Post("/api/device-power/{id}", app.HandleDevicePower)
+	r.Get("/api/device-power-status/{id}", app.HandleDevicePowerStatus)
+	r.Get("/api/device-ws/{id}", app.HandleDeviceWebSocket)
+
+	// SPA routes - serve index.html for client-side routing
+	r.Get("/", serveIndex)
+	r.Get("/devices", serveIndex)
+	r.Get("/device/*", serveIndex)
+
+	return r
+}
+
+func discoverDevices(ctx context.Context, app *handlers.WebApp, discoveryService *discovery.UnifiedDiscoveryService) {
+	log.Println("Starting device discovery...")
+
+	devices, err := discoveryService.DiscoverDevices(ctx)
+	if err != nil {
+		log.Printf("Discovery failed: %v", err)
+		app.BroadcastDiscoveryStatus("failed", app.DeviceCount())
+
+		return
+	}
+
+	log.Printf("Found %d devices", len(devices))
+
+	for _, device := range devices {
+		addDevice(app, device.Host, device.Port, "discovered")
+	}
+}
@@ -0,0 +1,162 @@
+package main
+
+import (
+	"net"
+	"strings"
+	"testing"
+)
+
+func TestResolveBindAddr_PassThrough(t *testing.T) {
+	// Inputs that don't match any local interface name must be returned
+	// unchanged: empty string, hostnames, IPv4/IPv6 literals, and bogus
+	// strings the user might have typed.
+	tests := []string{
+		"",
+		"localhost",
+		"127.0.0.1",
+		"192.168.1.5",
+		"::1",
+		"definitely-not-an-iface-xyz",
+	}
+
+	for _, input := range tests {
+		t.Run(quoted(input), func(t *testing.T) {
+			got, err := resolveBindAddr(input)
+			if err != nil {
+				t.Fatalf("unexpected error: %v", err)
+			}
+
+			if got != input {
+				t.Errorf("got %q, want %q (input should pass through unchanged)", got, input)
+			}
+		})
+	}
+}
+
+func TestResolveBindAddr_LoopbackInterface(t *testing.T) {
+	loopback, expected, ok := findLoopbackWithSingleIPv4(t)
+	if !ok {
+		t.Skipf("no loopback interface with exactly one IPv4 address found")
+	}
+
+	got, err := resolveBindAddr(loopback)
+	if err != nil {
+		t.Fatalf("unexpected error resolving %q: %v", loopback, err)
+	}
+
+	if got != expected {
+		t.Errorf("got %q, want %q for loopback interface %q", got, expected, loopback)
+	}
+}
+
+// findLoopbackWithSingleIPv4 returns the name of a loopback interface and the
+// single IPv4 address attached to it. If the host has multiple loopback
+// interfaces or the loopback has zero or several IPv4 addresses, it returns
+// ok=false so the caller can skip the test rather than fail on an environment
+// quirk.
+func findLoopbackWithSingleIPv4(t *testing.T) (name, addr string, ok bool) {
+	t.Helper()
+
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		t.Fatalf("net.Interfaces: %v", err)
+	}
+
+	for _, iface := range ifaces {
+		if iface.Flags&net.FlagLoopback == 0 {
+			continue
+		}
+
+		addrs, addrErr := iface.Addrs()
+		if addrErr != nil {
+			continue
+		}
+
+		var ipv4s []string
+
+		for _, a := range addrs {
+			if ipnet, isIPNet := a.(*net.IPNet); isIPNet {
+				if v4 := ipnet.IP.To4(); v4 != nil {
+					ipv4s = append(ipv4s, v4.String())
+				}
+			}
+		}
+
+		if len(ipv4s) == 1 {
+			return iface.Name, ipv4s[0], true
+		}
+	}
+
+	return "", "", false
+}
+
+func TestDefaultDiscoveryInterface(t *testing.T) {
+	tests := []struct {
+		name         string
+		rawInterface string
+		rawBind      string
+		resolvedBind string
+		want         string
+	}{
+		{
+			name:         "explicit interface wins over bind-derived default",
+			rawInterface: "eth1",
+			rawBind:      "eth0",
+			resolvedBind: "192.168.1.5",
+			want:         "eth1",
+		},
+		{
+			name:         "derive from --bind when --bind was an interface name",
+			rawInterface: "",
+			rawBind:      "eth0",
+			resolvedBind: "192.168.1.5",
+			want:         "eth0",
+		},
+		{
+			name:         "no derivation when --bind was an IP literal",
+			rawInterface: "",
+			rawBind:      "192.168.1.5",
+			resolvedBind: "192.168.1.5",
+			want:         "",
+		},
+		{
+			name:         "no derivation when --bind was a hostname (pass-through)",
+			rawInterface: "",
+			rawBind:      "localhost",
+			resolvedBind: "localhost",
+			want:         "",
+		},
+		{
+			name:         "both empty stays empty (auto-pick)",
+			rawInterface: "",
+			rawBind:      "",
+			resolvedBind: "",
+			want:         "",
+		},
+		{
+			name:         "explicit interface alone, --bind empty",
+			rawInterface: "eth1",
+			rawBind:      "",
+			resolvedBind: "",
+			want:         "eth1",
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got := defaultDiscoveryInterface(tc.rawInterface, tc.rawBind, tc.resolvedBind)
+			if got != tc.want {
+				t.Errorf("got %q, want %q (rawInterface=%q rawBind=%q resolvedBind=%q)",
+					got, tc.want, tc.rawInterface, tc.rawBind, tc.resolvedBind)
+			}
+		})
+	}
+}
+
+func quoted(s string) string {
+	if s == "" {
+		return "(empty)"
+	}
+
+	return strings.ReplaceAll(s, "/", "_")
+}
@@ -0,0 +1,363 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/handlers"
+	"github.com/gesellix/bose-soundtouch/cmd/soundtouch-web/webtypes"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+	"github.com/go-chi/chi/v5"
+)
+
+func withChiParams(r *http.Request, params map[string]string) *http.Request {
+	rctx := chi.NewRouteContext()
+	for k, v := range params {
+		rctx.URLParams.Add(k, v)
+	}
+	return r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, rctx))
+}
+
+func TestSPARouting(t *testing.T) {
+	tests := []struct {
+		name           string
+		path           string
+		expectedStatus int
+		expectedHTML   bool
+	}{
+		{
+			name:           "root path serves HTML",
+			path:           "/",
+			expectedStatus: http.StatusOK,
+			expectedHTML:   true,
+		},
+		{
+			name:           "device path serves HTML",
+			path:           "/device/test-device",
+			expectedStatus: http.StatusOK,
+			expectedHTML:   true,
+		},
+		{
+			name:           "arbitrary path serves HTML",
+			path:           "/some/random/path",
+			expectedStatus: http.StatusOK,
+			expectedHTML:   true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest("GET", tt.path, nil)
+			w := httptest.NewRecorder()
+
+			// Simulate SPA routing handler
+			spaHandler := func(w http.ResponseWriter, r *http.Request) {
+				// If it's an API route, let it pass through
+				if strings.HasPrefix(r.URL.Path, "/api/") || strings.HasPrefix(r.URL.Path, "/static/") || strings.HasPrefix(r.URL.Path, "/ws") {
+					http.NotFound(w, r)
+					return
+				}
+
+				// Serve the SPA index.html content (simulated)
+				w.Header().Set("Content-Type", "text/html")
+				w.WriteHeader(http.StatusOK)
+				w.Write([]byte(`<!doctype html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8" />
+    <title>SoundTouch Control Center</title>
+</head>
+<body>
+    <div id="app">SPA Content</div>
+</body>
+</html>`))
+			}
+
+			spaHandler(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			if tt.expectedHTML {
+				contentType := w.Header().Get("Content-Type")
+				if !strings.Contains(contentType, "text/html") {
+					t.Errorf("Expected HTML content type, got %s", contentType)
+				}
+
+				body := w.Body.String()
+				if !strings.Contains(body, "<!doctype html>") {
+					t.Errorf("Expected HTML content, got: %s", body)
+				}
+			}
+		})
+	}
+}
+
+func TestAPIEndpoints(t *testing.T) {
+	app := handlers.NewWebApp()
+
+	tests := []struct {
+		name           string
+		path           string
+		method         string
+		expectedStatus int
+		expectedJSON   bool
+	}{
+		{
+			name:           "devices API returns JSON",
+			path:           "/api/devices",
+			method:         "GET",
+			expectedStatus: http.StatusOK,
+			expectedJSON:   true,
+		},
+		{
+			name:           "discover API accepts POST",
+			path:           "/api/discover",
+			method:         "POST",
+			expectedStatus: http.StatusOK,
+			expectedJSON:   true,
+		},
+		{
+			name:           "device API with ID",
+			path:           "/api/device/test-device",
+			method:         "GET",
+			expectedStatus: http.StatusNotFound, // Device won't exist in test
+			expectedJSON:   true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := httptest.NewRequest(tt.method, tt.path, nil)
+			w := httptest.NewRecorder()
+
+			switch tt.path {
+			case "/api/devices":
+				app.HandleAPIDevices(w, req)
+			case "/api/discover":
+				app.HandleAPIDiscover(w, req)
+			default:
+				if strings.HasPrefix(tt.path, "/api/device/") {
+					deviceID := strings.TrimPrefix(tt.path, "/api/device/")
+					req = withChiParams(req, map[string]string{"id": deviceID})
+					app.HandleAPIDevice(w, req)
+				}
+			}
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Expected status %d, got %d", tt.expectedStatus, w.Code)
+			}
+
+			if tt.expectedJSON {
+				contentType := w.Header().Get("Content-Type")
+				if !strings.Contains(contentType, "application/json") {
+					t.Errorf("Expected JSON content type, got %s", contentType)
+				}
+
+				// Validate JSON response structure
+				var response webtypes.APIResponse
+				if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+					t.Errorf("Invalid JSON response: %v", err)
+				}
+			}
+		})
+	}
+}
+
+func TestAPIResponseFormat(t *testing.T) {
+	app := handlers.NewWebApp()
+
+	req := httptest.NewRequest("GET", "/api/devices", nil)
+	w := httptest.NewRecorder()
+
+	app.HandleAPIDevices(w, req)
+
+	var response webtypes.APIResponse
+	if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+		t.Fatalf("Failed to decode JSON response: %v", err)
+	}
+
+	// Check API response structure
+	if !response.Success {
+		t.Errorf("Expected success=true, got success=%v", response.Success)
+	}
+
+	if response.Data == nil {
+		t.Errorf("Expected data field to be present")
+	}
+
+	// Data should be an empty map for no devices
+	dataMap, ok := response.Data.(map[string]interface{})
+	if !ok {
+		t.Errorf("Expected data to be a map, got %T", response.Data)
+	}
+
+	if len(dataMap) != 0 {
+		t.Errorf("Expected empty device map, got %d devices", len(dataMap))
+	}
+}
+
+func TestControlAPIValidation(t *testing.T) {
+	app := handlers.NewWebApp()
+
+	tests := []struct {
+		name           string
+		path           string
+		method         string
+		body           string
+		expectedStatus int
+		chiParams      map[string]string
+	}{
+		{
+			name:           "missing device ID",
+			path:           "/api/control//play",
+			method:         "GET",
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name:           "invalid control path",
+			path:           "/api/control/device",
+			method:         "GET",
+			expectedStatus: http.StatusBadRequest,
+		},
+		{
+			name:           "unknown action",
+			path:           "/api/control/nonexistent/invalid",
+			method:         "GET",
+			expectedStatus: http.StatusNotFound,
+			chiParams:      map[string]string{"id": "nonexistent", "action": "invalid"},
+		},
+		{
+			name:           "nonexistent device",
+			path:           "/api/control/nonexistent/play",
+			method:         "GET",
+			expectedStatus: http.StatusNotFound,
+			chiParams:      map[string]string{"id": "nonexistent", "action": "play"},
+		},
+		{
+			name:           "unknown action with valid device",
+			path:           "/api/control/testdevice/unknownaction",
+			method:         "GET",
+			expectedStatus: http.StatusBadRequest,
+			chiParams:      map[string]string{"id": "testdevice", "action": "unknownaction"},
+		},
+	}
+
+	// Add a mock device for testing unknown action validation
+	mockDevice := webtypes.NewDeviceConnection(nil, &models.DeviceInfo{Name: "Test Device"})
+	mockDevice.SetStatus(&webtypes.DeviceStatus{IsConnected: true})
+	app.AddDevice("testdevice", mockDevice)
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var req *http.Request
+			if tt.body != "" {
+				req = httptest.NewRequest(tt.method, tt.path, strings.NewReader(tt.body))
+				req.Header.Set("Content-Type", "application/json")
+			} else {
+				req = httptest.NewRequest(tt.method, tt.path, nil)
+			}
+			if tt.chiParams != nil {
+				req = withChiParams(req, tt.chiParams)
+			}
+
+			w := httptest.NewRecorder()
+			app.HandleAPIControl(w, req)
+
+			if w.Code != tt.expectedStatus {
+				t.Errorf("Test %s: Expected status %d, got %d. Response: %s", tt.name, tt.expectedStatus, w.Code, w.Body.String())
+			}
+
+			// Validate error response format
+			contentType := w.Header().Get("Content-Type")
+			if !strings.Contains(contentType, "application/json") {
+				t.Errorf("Expected JSON content type, got %s", contentType)
+			}
+
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Errorf("Invalid JSON response: %v", err)
+			}
+
+			if response.Success {
+				t.Errorf("Expected success=false for error case, got success=true")
+			}
+
+			if response.Error == "" {
+				t.Errorf("Expected error message, got empty string")
+			}
+		})
+	}
+}
+
+func TestWebSocketUpgrade(t *testing.T) {
+	app := handlers.NewWebApp()
+
+	// Test WebSocket upgrade request
+	req := httptest.NewRequest("GET", "/ws", nil)
+	req.Header.Set("Connection", "upgrade")
+	req.Header.Set("Upgrade", "websocket")
+	req.Header.Set("Sec-WebSocket-Key", "dGhlIHNhbXBsZSBub25jZQ==")
+	req.Header.Set("Sec-WebSocket-Version", "13")
+
+	w := httptest.NewRecorder()
+
+	// The actual WebSocket upgrade will fail in test environment,
+	// but we can check that the handler exists and accepts the request
+	app.HandleWebSocket(w, req)
+
+	// In a real test environment, this would fail with a websocket upgrade error
+	// We're just checking the handler doesn't panic and processes the request
+}
+
+func TestJSONAPIConsistency(t *testing.T) {
+	app := handlers.NewWebApp()
+
+	endpoints := []string{
+		"/api/devices",
+		"/api/device/test",
+	}
+
+	for _, endpoint := range endpoints {
+		t.Run("JSON consistency for "+endpoint, func(t *testing.T) {
+			req := httptest.NewRequest("GET", endpoint, nil)
+			w := httptest.NewRecorder()
+
+			switch endpoint {
+			case "/api/devices":
+				app.HandleAPIDevices(w, req)
+			default:
+				if strings.HasPrefix(endpoint, "/api/device/") {
+					deviceID := strings.TrimPrefix(endpoint, "/api/device/")
+					req = withChiParams(req, map[string]string{"id": deviceID})
+					app.HandleAPIDevice(w, req)
+				}
+			}
+
+			// All API endpoints should return JSON
+			contentType := w.Header().Get("Content-Type")
+			if !strings.Contains(contentType, "application/json") {
+				t.Errorf("Endpoint %s should return JSON, got %s", endpoint, contentType)
+			}
+
+			// All responses should follow APIResponse structure
+			var response webtypes.APIResponse
+			if err := json.NewDecoder(w.Body).Decode(&response); err != nil {
+				t.Errorf("Endpoint %s returned invalid JSON: %v", endpoint, err)
+			}
+
+			// Response should have either data or error
+			if response.Success && response.Data == nil {
+				t.Errorf("Endpoint %s: success response should have data", endpoint)
+			}
+			if !response.Success && response.Error == "" {
+				t.Errorf("Endpoint %s: error response should have error message", endpoint)
+			}
+		})
+	}
+}
@@ -0,0 +1,200 @@
+<!doctype html>
+<html lang="en">
+    <head>
+        <meta charset="UTF-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>SoundTouch Control Center</title>
+        <link
+            href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/css/bootstrap.min.css"
+            rel="stylesheet"
+        />
+        <link
+            href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.10.0/font/bootstrap-icons.css"
+            rel="stylesheet"
+        />
+        <link href="/static/css/app.css" rel="stylesheet" />
+    </head>
+    <body>
+        <nav class="navbar navbar-expand-lg navbar-dark">
+            <div class="container">
+                <a class="navbar-brand" href="#" onclick="showPage('devices')">
+                    <i class="bi bi-speaker"></i>
+                    SoundTouch Control
+                </a>
+                <div class="navbar-nav ms-auto">
+                    <a
+                        class="nav-link"
+                        href="#"
+                        onclick="showPage('devices')"
+                        title="Home"
+                    >
+                        <i class="bi bi-house"></i>
+                    </a>
+                    <a
+                        class="nav-link tunein-nav-link"
+                        href="#"
+                        onclick="showPage('tunein')"
+                        title="TuneIn Browse"
+                    >
+                        <img
+                            src="/static/img/tunein-mono.svg"
+                            alt="TuneIn"
+                            class="tunein-nav-icon"
+                        />
+                    </a>
+                    <a
+                        class="nav-link"
+                        href="#"
+                        onclick="discoverDevices()"
+                        title="Discover Devices"
+                    >
+                        <i class="bi bi-search"></i>
+                    </a>
+                    <button
+                        class="theme-toggle nav-link"
+                        onclick="toggleTheme()"
+                        title="Toggle Dark Mode"
+                    >
+                        <i id="theme-icon" class="bi bi-moon"></i>
+                    </button>
+                </div>
+            </div>
+        </nav>
+
+        <div class="container mt-4">
+            <!-- Device List Page -->
+            <div id="devices-page" class="page active">
+                <div
+                    class="d-flex justify-content-between align-items-center mb-4"
+                >
+                    <h2>Your SoundTouch Devices</h2>
+                    <button class="btn btn-primary" onclick="discoverDevices()">
+                        <i class="bi bi-search"></i>
+                        Discover Devices
+                    </button>
+                </div>
+
+                <div id="devices-loading" class="loading-spinner"></div>
+
+                <div id="devices-list" class="row">
+                    <!-- Device cards will be inserted here by JavaScript -->
+                </div>
+
+                <div
+                    id="no-devices"
+                    style="display: none"
+                    class="text-center py-5"
+                >
+                    <i class="bi bi-speaker display-1 text-muted"></i>
+                    <h4 class="mt-3">No Devices Found</h4>
+                    <p class="text-muted">
+                        Click "Discover Devices" to search for SoundTouch
+                        speakers on your network.
+                    </p>
+                    <button class="btn btn-primary" onclick="discoverDevices()">
+                        <i class="bi bi-search"></i>
+                        Start Discovery
+                    </button>
+                </div>
+            </div>
+
+            <!-- TuneIn Browse Page -->
+            <div id="tunein-page" class="page">
+                <div class="d-flex justify-content-between align-items-center mb-3">
+                    <h2><img src="/static/img/tunein-dark.svg" alt="TuneIn" class="tunein-heading-icon me-2" />TuneIn Browse</h2>
+                </div>
+
+                <div class="tunein-search-bar mb-3">
+                    <div class="input-group">
+                        <input
+                            type="text"
+                            id="tunein-search-input"
+                            class="form-control"
+                            placeholder="Search stations, podcasts..."
+                        />
+                        <button
+                            class="btn btn-primary"
+                            onclick="tuneInSearch(document.getElementById('tunein-search-input').value)"
+                        >
+                            <i class="bi bi-search"></i>
+                            Search
+                        </button>
+                        <button
+                            class="btn btn-outline-secondary"
+                            onclick="tuneInBrowse()"
+                            title="Browse top level"
+                        >
+                            <i class="bi bi-house"></i>
+                        </button>
+                    </div>
+                </div>
+
+                <nav id="tunein-breadcrumb" class="mb-3" style="display: none">
+                    <!-- filled by JavaScript -->
+                </nav>
+
+                <div id="tunein-results">
+                    <!-- filled by JavaScript -->
+                </div>
+            </div>
+
+            <!-- Device Control Page -->
+            <div id="device-page" class="page">
+                <div class="back-button">
+                    <button
+                        class="btn btn-outline-secondary"
+                        onclick="showPage('devices')"
+                    >
+                        <i class="bi bi-arrow-left"></i>
+                        Back to Devices
+                    </button>
+                </div>
+
+                <div id="device-content">
+                    <!-- Device control content will be inserted here by JavaScript -->
+                </div>
+            </div>
+        </div>
+
+        <footer class="footer">
+            <div class="container text-center">
+                <small>
+                    SoundTouch Web Control Interface -
+                    <a
+                        href="https://github.com/gesellix/Bose-SoundTouch"
+                        target="_blank"
+                        class="text-decoration-none"
+                    >
+                        Open Source Project
+                    </a>
+                </small>
+            </div>
+        </footer>
+
+        <!-- Toast container for notifications -->
+        <div class="toast-container"></div>
+
+        <!-- Device picker for TuneIn playback -->
+        <div class="modal fade" id="devicePickerModal" tabindex="-1" aria-labelledby="devicePickerLabel" aria-hidden="true">
+            <div class="modal-dialog modal-sm">
+                <div class="modal-content">
+                    <div class="modal-header py-2">
+                        <h6 class="modal-title" id="devicePickerLabel">
+                            <i class="bi bi-speaker me-2"></i>Play on device
+                        </h6>
+                        <button type="button" class="btn-close" data-bs-dismiss="modal"></button>
+                    </div>
+                    <div class="modal-body p-2" id="devicePickerList">
+                        <!-- device buttons filled by JavaScript -->
+                    </div>
+                </div>
+            </div>
+        </div>
+
+        <!-- Bootstrap JS -->
+        <script src="https://cdn.jsdelivr.net/npm/bootstrap@5.3.0/dist/js/bootstrap.bundle.min.js"></script>
+
+        <!-- Application JavaScript -->
+        <script src="/static/js/app.js"></script>
+    </body>
+</html>
@@ -0,0 +1,197 @@
+// Package webtypes tests for the atomic Status API on DeviceConnection
+// (Status, SetStatus, UpdateStatus, NewDeviceConnection).
+package webtypes
+
+import (
+	"fmt"
+	"sync"
+	"testing"
+
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+)
+
+func TestNewDeviceConnection_InitialStatus(t *testing.T) {
+	conn := NewDeviceConnection(nil, &models.DeviceInfo{Name: "test"})
+
+	status := conn.Status()
+	if status == nil {
+		t.Fatal("Status() returned nil from a NewDeviceConnection")
+	}
+
+	if status.IsConnected {
+		t.Error("IsConnected should default to false")
+	}
+
+	if status.LastActivity.IsZero() {
+		t.Error("LastActivity should be initialised, got zero time")
+	}
+}
+
+func TestSetStatus_ReplacesEntireStatus(t *testing.T) {
+	conn := NewDeviceConnection(nil, &models.DeviceInfo{Name: "test"})
+	conn.SetStatus(&DeviceStatus{
+		Volume:      &models.Volume{ActualVolume: 42},
+		IsConnected: true,
+	})
+
+	got := conn.Status()
+	if got.Volume == nil || got.Volume.ActualVolume != 42 {
+		t.Errorf("Volume not stored: got %+v", got.Volume)
+	}
+
+	// Setting a sparser status should wipe previously-set fields.
+	conn.SetStatus(&DeviceStatus{IsConnected: false})
+
+	got = conn.Status()
+	if got.Volume != nil {
+		t.Error("SetStatus did not wipe previously-set Volume")
+	}
+
+	if got.IsConnected {
+		t.Error("SetStatus did not wipe IsConnected")
+	}
+}
+
+func TestUpdateStatus_AppliesMutator(t *testing.T) {
+	conn := NewDeviceConnection(nil, &models.DeviceInfo{Name: "test"})
+
+	conn.UpdateStatus(func(s *DeviceStatus) {
+		s.IsConnected = true
+		s.Volume = &models.Volume{ActualVolume: 30}
+	})
+
+	got := conn.Status()
+	if !got.IsConnected {
+		t.Error("UpdateStatus did not set IsConnected")
+	}
+
+	if got.Volume == nil || got.Volume.ActualVolume != 30 {
+		t.Errorf("UpdateStatus did not set Volume: %+v", got.Volume)
+	}
+}
+
+func TestUpdateStatus_PreservesUnchangedFields(t *testing.T) {
+	conn := NewDeviceConnection(nil, &models.DeviceInfo{Name: "test"})
+	conn.SetStatus(&DeviceStatus{
+		Volume:      &models.Volume{ActualVolume: 10},
+		Bass:        &models.Bass{ActualBass: 3},
+		IsConnected: true,
+	})
+
+	// Only touch Volume; Bass and IsConnected must survive.
+	conn.UpdateStatus(func(s *DeviceStatus) {
+		s.Volume = &models.Volume{ActualVolume: 99}
+	})
+
+	got := conn.Status()
+	if got.Volume.ActualVolume != 99 {
+		t.Errorf("Volume = %d, want 99", got.Volume.ActualVolume)
+	}
+
+	if got.Bass == nil || got.Bass.ActualBass != 3 {
+		t.Errorf("Bass not preserved: %+v", got.Bass)
+	}
+
+	if !got.IsConnected {
+		t.Error("IsConnected not preserved")
+	}
+}
+
+func TestStatusSnapshotIsolation(t *testing.T) {
+	// A snapshot returned by Status() must NOT change when a later
+	// UpdateStatus replaces a pointer field. This proves the atomic
+	// store gives readers a stable view (so long as the writer
+	// follows the docstring contract of replacing nested pointers).
+	conn := NewDeviceConnection(nil, &models.DeviceInfo{Name: "test"})
+	conn.SetStatus(&DeviceStatus{Volume: &models.Volume{ActualVolume: 1}})
+
+	first := conn.Status()
+
+	conn.UpdateStatus(func(s *DeviceStatus) {
+		s.Volume = &models.Volume{ActualVolume: 2}
+	})
+
+	if first.Volume.ActualVolume != 1 {
+		t.Errorf("Snapshot mutated after later UpdateStatus: got %d, want 1",
+			first.Volume.ActualVolume)
+	}
+
+	if conn.Status().Volume.ActualVolume != 2 {
+		t.Errorf("Current status not updated: got %d, want 2",
+			conn.Status().Volume.ActualVolume)
+	}
+}
+
+// TestStatusConcurrent runs many UpdateStatus writers alongside many
+// Status() readers. Before atomic.Pointer[DeviceStatus] this pattern
+// would be flagged by the race detector (writers mutate
+// conn.Status.X while readers copy conn.Status). With the atomic
+// pointer it must run clean under `go test -race`.
+func TestStatusConcurrent(t *testing.T) {
+	conn := NewDeviceConnection(nil, &models.DeviceInfo{Name: "concurrent"})
+
+	const writers = 16
+
+	const readersPerKind = 16
+
+	const opsPerGoroutine = 200
+
+	var wg sync.WaitGroup
+	wg.Add(writers + 2*readersPerKind)
+
+	// Writers: each goroutine replaces NowPlaying with a fresh struct
+	// carrying its worker id. Replacement (not in-place mutation)
+	// is what the UpdateStatus contract requires for nested
+	// pointers.
+	for w := 0; w < writers; w++ {
+		go func(worker int) {
+			defer wg.Done()
+
+			for i := 0; i < opsPerGoroutine; i++ {
+				conn.UpdateStatus(func(s *DeviceStatus) {
+					s.NowPlaying = &models.NowPlaying{
+						Track: fmt.Sprintf("w%d-%d", worker, i),
+					}
+					s.IsConnected = true
+				})
+			}
+		}(w)
+	}
+
+	// Readers via Status() — full snapshot.
+	for r := 0; r < readersPerKind; r++ {
+		go func() {
+			defer wg.Done()
+
+			for i := 0; i < opsPerGoroutine; i++ {
+				_ = conn.Status()
+			}
+		}()
+	}
+
+	// Readers that deref a single field. Tests the common
+	// "device.Status().IsConnected" pattern.
+	for r := 0; r < readersPerKind; r++ {
+		go func() {
+			defer wg.Done()
+
+			for i := 0; i < opsPerGoroutine; i++ {
+				_ = conn.Status().IsConnected
+			}
+		}()
+	}
+
+	wg.Wait()
+
+	// After all writers finish, IsConnected should be true (every
+	// writer sets it). The exact NowPlaying value is whichever
+	// writer landed last, but it must be a valid non-nil pointer.
+	final := conn.Status()
+	if !final.IsConnected {
+		t.Error("IsConnected should be true after writers ran")
+	}
+
+	if final.NowPlaying == nil {
+		t.Error("NowPlaying should be non-nil after writers ran")
+	}
+}
@@ -0,0 +1,141 @@
+// Package webtypes contains type definitions for the SoundTouch web UI.
+package webtypes
+
+import (
+	"sync/atomic"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/pkg/client"
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+)
+
+// SoundTouchClient defines the interface for SoundTouch client operations
+type SoundTouchClient interface {
+	Play() error
+	Pause() error
+	Stop() error
+	NextTrack() error
+	PrevTrack() error
+	SetVolume(level int) error
+	SetBass(level int) error
+	SelectPreset(id int) error
+	SelectSource(source, account string) error
+	SendKey(key string) error
+	GetDeviceInfo() (*models.DeviceInfo, error)
+	GetNowPlaying() (*models.NowPlaying, error)
+	GetVolume() (*models.Volume, error)
+	GetPresets() (*models.Presets, error)
+	GetSources() (*models.Sources, error)
+	GetBass() (*models.Bass, error)
+	NewWebSocketClient(config interface{}) *client.WebSocketClient
+}
+
+// DeviceConnection wraps a SoundTouch client with WebSocket connection.
+//
+// The Status field is stored behind atomic.Pointer so concurrent
+// readers (HTTP handlers, WebSocket broadcasters) never observe a
+// torn struct while a writer (UpdateDeviceStatus, WebSocket event
+// handlers) is mid-update. Access status through Status / SetStatus
+// / UpdateStatus rather than the private field; construct connections
+// via NewDeviceConnection to guarantee the status is initialised.
+type DeviceConnection struct {
+	Client     *client.Client
+	WebSocket  *client.WebSocketClient
+	DeviceInfo *models.DeviceInfo
+	LastSeen   time.Time
+
+	status atomic.Pointer[DeviceStatus]
+}
+
+// DeviceStatus represents the current device state
+type DeviceStatus struct {
+	NowPlaying   *models.NowPlaying `json:"nowPlaying,omitempty"`
+	Volume       *models.Volume     `json:"volume,omitempty"`
+	Presets      *models.Presets    `json:"presets,omitempty"`
+	Sources      *models.Sources    `json:"sources,omitempty"`
+	Bass         *models.Bass       `json:"bass,omitempty"`
+	IsConnected  bool               `json:"isConnected"`
+	LastActivity time.Time          `json:"lastActivity"`
+}
+
+// NewDeviceConnection creates a fully-initialised connection. The
+// status starts with IsConnected=false and LastActivity set to now;
+// real values arrive via UpdateStatus once the device responds.
+func NewDeviceConnection(c *client.Client, info *models.DeviceInfo) *DeviceConnection {
+	conn := &DeviceConnection{
+		Client:     c,
+		DeviceInfo: info,
+		LastSeen:   time.Now(),
+	}
+	conn.status.Store(&DeviceStatus{
+		IsConnected:  false,
+		LastActivity: time.Now(),
+	})
+
+	return conn
+}
+
+// Status returns a snapshot of the current device status. The returned
+// pointer is read-only from the caller's perspective; mutating the
+// pointed-to struct has no effect on the stored status. Use
+// UpdateStatus or SetStatus to apply changes. Never returns nil for
+// connections built via NewDeviceConnection.
+func (c *DeviceConnection) Status() *DeviceStatus {
+	return c.status.Load()
+}
+
+// SetStatus atomically replaces the entire status. Use sparingly —
+// UpdateStatus is the preferred entry point because it preserves
+// concurrent changes from other goroutines.
+func (c *DeviceConnection) SetStatus(s *DeviceStatus) {
+	c.status.Store(s)
+}
+
+// UpdateStatus atomically applies mut to a copy of the current status
+// and stores the result. If another goroutine updates the status while
+// mut runs, UpdateStatus retries with the newer status — so concurrent
+// writers cannot silently lose each other's changes.
+//
+// The copy mut receives is a shallow value copy of the previous status.
+// Nested pointer fields (NowPlaying, Volume, Presets, Sources, Bass)
+// share their backing struct with the previous version: callers MUST
+// REPLACE these pointers (s.Volume = &models.Volume{...}) rather than
+// mutate through them (s.Volume.ActualVolume++ would race with any
+// reader still holding the previous snapshot). Production callers
+// receive these values fresh from the device API, so this is the
+// natural shape.
+func (c *DeviceConnection) UpdateStatus(mut func(*DeviceStatus)) {
+	for {
+		old := c.status.Load()
+		next := *old
+		mut(&next)
+
+		if c.status.CompareAndSwap(old, &next) {
+			return
+		}
+	}
+}
+
+// APIResponse is a standard JSON response wrapper
+type APIResponse struct {
+	Success bool        `json:"success"`
+	Data    interface{} `json:"data,omitempty"`
+	Error   string      `json:"error,omitempty"`
+}
+
+// VolumeRequest represents a volume control request
+type VolumeRequest struct {
+	Level int `json:"level"`
+}
+
+// BassRequest represents a bass control request
+type BassRequest struct {
+	Level int `json:"level"`
+}
+
+// WebSocketMessage represents messages sent over WebSocket
+type WebSocketMessage struct {
+	Type     string      `json:"type"`
+	DeviceID string      `json:"deviceId,omitempty"`
+	Data     interface{} `json:"data,omitempty"`
+}
@@ -0,0 +1,279 @@
+// Package types contains tests for type definitions.
+package webtypes
+
+import (
+	"testing"
+	"time"
+
+	"github.com/gesellix/bose-soundtouch/pkg/models"
+)
+
+func TestAPIResponse(t *testing.T) {
+	tests := []struct {
+		name     string
+		response APIResponse
+		wantJSON string
+	}{
+		{
+			name: "success response",
+			response: APIResponse{
+				Success: true,
+				Data:    map[string]string{"message": "OK"},
+			},
+			wantJSON: `{"success":true,"data":{"message":"OK"}}`,
+		},
+		{
+			name: "error response",
+			response: APIResponse{
+				Success: false,
+				Error:   "Something went wrong",
+			},
+			wantJSON: `{"success":false,"error":"Something went wrong"}`,
+		},
+		{
+			name: "success with nil data",
+			response: APIResponse{
+				Success: true,
+			},
+			wantJSON: `{"success":true}`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// Test that the struct fields are correctly set
+			if tt.response.Success != (tt.name == "success response" || tt.name == "success with nil data") {
+				t.Errorf("Expected success to match test case")
+			}
+		})
+	}
+}
+
+func TestVolumeRequest(t *testing.T) {
+	tests := []struct {
+		name  string
+		req   VolumeRequest
+		level int
+	}{
+		{"zero volume", VolumeRequest{Level: 0}, 0},
+		{"mid volume", VolumeRequest{Level: 50}, 50},
+		{"max volume", VolumeRequest{Level: 100}, 100},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.req.Level != tt.level {
+				t.Errorf("Expected level %d, got %d", tt.level, tt.req.Level)
+			}
+		})
+	}
+}
+
+func TestBassRequest(t *testing.T) {
+	tests := []struct {
+		name  string
+		req   BassRequest
+		level int
+	}{
+		{"min bass", BassRequest{Level: -9}, -9},
+		{"neutral bass", BassRequest{Level: 0}, 0},
+		{"max bass", BassRequest{Level: 9}, 9},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.req.Level != tt.level {
+				t.Errorf("Expected level %d, got %d", tt.level, tt.req.Level)
+			}
+		})
+	}
+}
+
+func TestWebSocketMessage(t *testing.T) {
+	tests := []struct {
+		name     string
+		msg      WebSocketMessage
+		wantType string
+	}{
+		{
+			name: "devices message",
+			msg: WebSocketMessage{
+				Type: "devices",
+				Data: map[string]interface{}{"device1": "data"},
+			},
+			wantType: "devices",
+		},
+		{
+			name: "status update message",
+			msg: WebSocketMessage{
+				Type:     "status_update",
+				DeviceID: "device1",
+				Data:     DeviceStatus{IsConnected: true},
+			},
+			wantType: "status_update",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.msg.Type != tt.wantType {
+				t.Errorf("Expected type %s, got %s", tt.wantType, tt.msg.Type)
+			}
+		})
+	}
+}
+
+func TestDeviceConnection(t *testing.T) {
+	deviceInfo := &models.DeviceInfo{
+		Name: "Test Speaker",
+		Type: "SoundTouch 30",
+		NetworkInfo: []models.NetworkInfo{
+			{MacAddress: "TEST123", IPAddress: "192.168.1.100"},
+		},
+	}
+
+	nowPlaying := &models.NowPlaying{
+		Track:      "Test Track",
+		Artist:     "Test Artist",
+		Album:      "Test Album",
+		PlayStatus: models.PlayStatusPlaying,
+		Source:     "SPOTIFY",
+	}
+
+	volume := &models.Volume{
+		ActualVolume: 50,
+		MuteEnabled:  false,
+	}
+
+	conn := NewDeviceConnection(nil, deviceInfo)
+	conn.SetStatus(&DeviceStatus{
+		NowPlaying:   nowPlaying,
+		Volume:       volume,
+		IsConnected:  true,
+		LastActivity: time.Now(),
+	})
+
+	t.Run("device connection fields", func(t *testing.T) {
+		if conn.DeviceInfo.Name != "Test Speaker" {
+			t.Errorf("Expected device name 'Test Speaker', got '%s'", conn.DeviceInfo.Name)
+		}
+
+		status := conn.Status()
+
+		if status.NowPlaying.Track != "Test Track" {
+			t.Errorf("Expected track 'Test Track', got '%s'", status.NowPlaying.Track)
+		}
+
+		if status.Volume.ActualVolume != 50 {
+			t.Errorf("Expected volume 50, got %d", status.Volume.ActualVolume)
+		}
+
+		if !status.IsConnected {
+			t.Error("Expected device to be connected")
+		}
+	})
+}
+
+func TestDeviceStatus(t *testing.T) {
+	status := DeviceStatus{
+		NowPlaying: &models.NowPlaying{
+			Track:      "Test Track",
+			PlayStatus: models.PlayStatusPlaying,
+		},
+		Volume: &models.Volume{
+			ActualVolume: 75,
+			MuteEnabled:  false,
+		},
+		Bass: &models.Bass{
+			ActualBass: 3,
+		},
+		IsConnected:  true,
+		LastActivity: time.Now(),
+	}
+
+	t.Run("device status fields", func(t *testing.T) {
+		if status.NowPlaying == nil {
+			t.Error("Expected now playing to be set")
+		}
+
+		if status.Volume == nil {
+			t.Error("Expected volume to be set")
+		}
+
+		if status.Bass == nil {
+			t.Error("Expected bass to be set")
+		}
+
+		if !status.IsConnected {
+			t.Error("Expected device to be connected")
+		}
+
+		if status.LastActivity.IsZero() {
+			t.Error("Expected last activity to be set")
+		}
+	})
+
+	t.Run("nil fields", func(t *testing.T) {
+		emptyStatus := DeviceStatus{}
+
+		if emptyStatus.NowPlaying != nil {
+			t.Error("Expected now playing to be nil")
+		}
+
+		if emptyStatus.Volume != nil {
+			t.Error("Expected volume to be nil")
+		}
+
+		if emptyStatus.IsConnected {
+			t.Error("Expected device to be disconnected by default")
+		}
+	})
+}
+
+// Benchmark tests
+func BenchmarkAPIResponse(b *testing.B) {
+	response := APIResponse{
+		Success: true,
+		Data:    map[string]string{"message": "OK"},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = response.Success
+		_ = response.Data
+	}
+}
+
+func BenchmarkDeviceStatus(b *testing.B) {
+	status := DeviceStatus{
+		NowPlaying:   &models.NowPlaying{Track: "Test Track"},
+		Volume:       &models.Volume{ActualVolume: 50},
+		IsConnected:  true,
+		LastActivity: time.Now(),
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = status.IsConnected
+		_ = status.NowPlaying.Track
+		_ = status.Volume.ActualVolume
+	}
+}
+
+func BenchmarkWebSocketMessage(b *testing.B) {
+	msg := WebSocketMessage{
+		Type:     "status_update",
+		DeviceID: "device1",
+		Data: DeviceStatus{
+			IsConnected:  true,
+			LastActivity: time.Now(),
+		},
+	}
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		_ = msg.Type
+		_ = msg.DeviceID
+		_ = msg.Data
+	}
+}
@@ -355,9 +355,11 @@ func handlePreset(event *models.PresetUpdatedEvent, verbose bool) {
 	for _, preset := range presets.Preset {
 		fmt.Printf("  📻 Preset %d:", preset.ID)

-		if preset.ContentItem != nil {
-			fmt.Printf(" %s", preset.ContentItem.ItemName)
-			fmt.Printf(" (%s)", preset.ContentItem.Source)
+		// IsEmpty catches both <preset/> and INVALID_SOURCE
+		// placeholders; using the nil-safe helpers below means the
+		// inner Printf never dereferences a nil ContentItem.
+		if !preset.IsEmpty() {
+			fmt.Printf(" %s (%s)", preset.GetDisplayName(), preset.GetSource())
 		}

 		fmt.Println()
@@ -0,0 +1,46 @@
+services:
+  soundtouch-service:
+    build:
+      context: .
+      target: soundtouch-service
+    networks:
+      - soundtouch-test-net
+    volumes:
+      - ./tests/integration/testdata:/app/data
+    environment:
+      - SPOTIFY_CLIENT_ID=mock-id
+      - SPOTIFY_CLIENT_SECRET=mock-secret
+      - SPOTIFY_TOKEN_URL=http://spotify-mock:8080/api/token
+      - SPOTIFY_API_BASE=http://spotify-mock:8080
+      - AMAZON_CLIENT_ID=mock-amazon-id
+      - AMAZON_CLIENT_SECRET=mock-amazon-secret
+      - AMAZON_TOKEN_URL=http://amazon-mock:8080/auth/o2/token
+      - AMAZON_PROFILE_URL=http://amazon-mock:8080/user/profile
+
+  spotify-mock:
+    image: golang:1.26.3-alpine
+    container_name: spotify-mock
+    working_dir: /app
+    volumes:
+      - .:/app
+    command: go run ./cmd/mock-spotify/main.go -port 8080
+    ports:
+      - "8081:8080"
+    networks:
+      - soundtouch-test-net
+
+  amazon-mock:
+    image: golang:1.26.3-alpine
+    container_name: amazon-mock
+    working_dir: /app
+    volumes:
+      - .:/app
+    command: go run ./cmd/mock-amazon/main.go -port 8080
+    ports:
+      - "8082:8080"
+    networks:
+      - soundtouch-test-net
+
+networks:
+  soundtouch-test-net:
+    name: soundtouch-test-net
@@ -1,6 +1,6 @@
 services:
  soundtouch-service:
-    image: ghcr.io/gesellix/bose-soundtouch:latest
+    image: ghcr.io/gesellix/bose-soundtouch:${SOUNDTOUCH_VERSION:-latest}
    # build: .
    container_name: soundtouch-service
    # Linux only, required for discovery. Swarm requires host network at the task level.
@@ -48,6 +48,12 @@ logread -f | grep -Ei '(marge|preset)'
 ```
 This is particularly useful for debugging preset synchronization and service redirection issues.

+For HTTPS / connection-refused debugging (e.g. `Curl 7, http 0`), drop the speaker's loopback chatter so only outbound calls remain visible:
+```bash
+logread -f | grep -v '127.0.0.1'
+```
+The speaker generates a steady stream of localhost-to-localhost HTTP traffic between its internal services; filtering it out makes the actual cloud / AfterTouch attempts (the ones that matter when diagnosing redirect or TLS issues) easy to read in real time.
+
 ---

 ## 2. Traffic Logging & Interception
@@ -0,0 +1,114 @@
+# Bose SoundTouch Device Setup Flow
+
+This document details the multi-step process required to fully set up a Bose SoundTouch device, as derived from the Stockholm firmware (`setup/js/`) analysis.
+
+A complete setup flow involves a sequence of local (WebSocket) and cloud (HTTP) actions that move the device from a factory-reset state to a fully registered, functional system.
+
+## 1. Local Coordination Stage (WebSocket)
+
+Before a device can be controlled, it must be configured on the local network and named. These actions occur via a WebSocket connection to the device on port 8080.
+
+### 1.1 Language Configuration (Optional)
+If the device is in a factory-reset state, the UI typically ensures the device language matches the user's choice.
+- **WebSocket Action**: `set_language`
+- **Internal Logic**: `SetupWizard.js` handles this via `set_device_language`.
+
+### 1.2 Network Configuration (WiFi)
+Configures the device to connect to a specific wireless access point.
+- **File Reference**: `setup/js/workflow_wifi_setup.js`
+- **Logic**: Triggers a site survey, then sends SSID and credentials.
+- **WebSocket Command**: `set_WIFI_OLED` or similar internal method calls to configure the network profile.
+
+### 1.3 Device Naming (Rename Step)
+Assigns a user-friendly name (e.g., "Living Room") to the device.
+- **File Reference**: `setup/js/workflow_rename.js`
+- **WebSocket Action**: `name`
+- **XML Payload**:
+    ```xml
+    <name>Living Room</name>
+    ```
+- **Implementation**: The `RenameDevices.do_rename_devices()` function sends this to the device. The device then updates its local name and mDNS/SSDP broadcasts.
+
+## 2. Cloud Interaction Stage (HTTP)
+
+The device needs to be linked to a Bose "Marge" account to enable cloud-based features and music services.
+
+### 2.1 Account Creation (Registration)
+If a user doesn't have an account, the setup client creates one.
+- **File Reference**: `setup/js/workflow_marge.js`
+- **Cloud Endpoint**: `POST https://streaming.bose.com/streaming/account`
+- **Payload**: XML containing name, email, password, and country.
+- **Content-Type**: `application/vnd.bose.customer-v1.0+xml`
+
+### 2.2 Cloud Authentication (Login)
+The setup client must obtain a valid `accountId` and `userAuthToken` to pair the device.
+- **File Reference**: `setup/js/workflow_marge.js`
+- **Cloud Endpoint**: `POST https://streaming.bose.com/streaming/account/login`
+- **Payload**: XML containing username and password.
+- **Content-Type**: `application/vnd.bose.streaming-v1.2+xml`
+- **Result**: Returns a session token in the `Credentials` response header and the user's `account ID` in the XML body.
+
+## 3. Registration Bridge (WebSocket to Cloud)
+
+This is the final "pairing" step where the client tells the device which account it belongs to.
+
+### 3.1 Device Registration (The "Pair" Step)
+The client sends the user's credentials to the device, which then registers itself with the cloud.
+- **File Reference**: `setup/js/workflow_add_devices.js`
+- **WebSocket Action**: `setMargeAccount`
+- **XML Payload**:
+    ```xml
+    <PairDeviceWithAccount>
+        <accountId>12345</accountId>
+        <userAuthToken>jGwE... (truncated)</userAuthToken>
+    </PairDeviceWithAccount>
+    ```
+- **Device Reaction**: Upon receiving this, the device makes its own outbound HTTP POST to the Marge service:
+    `POST https://streaming.bose.com/{accountId}/devices`
+
+## 4. Finalization
+
+Once the registration is complete, the setup application (Stockholm) performs final cleanup. It's important to distinguish between **App State** (the Stockholm UI's persistent settings) and **Device State** (the physical speaker's configuration).
+
+### 4.1 Exiting Setup Mode (App Settings)
+The Stockholm app communicates with its "native container" (the WebView bridge on iOS/Android/Windows/macOS) using a `setData` command in **JSON format**. This is an internal message to the application's persistent storage, **not a network command sent to the physical speaker**.
+
+This command tells the Stockholm app which page to load on startup, effectively marking the setup as complete in the UI.
+
+- **Internal Command**: `setData`
+- **Parameter**: `startupPage`
+- **Normal Value**: `index.html` (Normal mode)
+- **Setup Value**: `setup/index.html` (Setup mode)
+
+**JSON Payload (Internal to Stockholm App)**:
+```json
+{
+    "method": "setData",
+    "params": {
+        "name": "startupPage",
+        "value": "index.html"
+    }
+}
+```
+
+**Other Common Internal Parameters**:
+- `changeStartupPage`: Set to `false` after a successful setup or update.
+- `tipsEnabled`: Set to `false` to suppress the "Getting Started" tutorials.
+- `promptUpdate`: Set to `true` if a firmware update was deferred during setup.
+
+### 4.2 Device Finalization
+The physical speaker considers the setup "done" once it successfully processes the `<PairDeviceWithAccount>` XML message and completes its own handshake with the Marge cloud. There is no specific "Finalize" XML command sent to the speaker; the successful registration is the signal.
+
+The `SetupWizard.js` calls `single_device_setup_done()` to trigger the internal `setData` updates described above. If these are not saved in the app's local storage, the Stockholm UI may return to the setup flow on next launch, even if the speaker is already paired.
+
+---
+
+## Summary of Scriptable Requirements
+
+To automate a device setup using a custom tool (like `soundtouch-cli`), you must perform the following:
+1.  **Configure WiFi**: (Assumed if device is reachable over IP).
+2.  **Set Name**: Send the `<name>` WebSocket message (XML) to update the device identity.
+3.  **Obtain Token**: Authenticate against the cloud service (Marge) via HTTP.
+4.  **Pair Device**: Send the `<PairDeviceWithAccount>` WebSocket message (XML) with the account ID and token.
+
+**Note**: The JSON `setData` commands are only necessary if you are building/controlling a version of the Stockholm UI itself. They are not required to configure the physical hardware.
@@ -0,0 +1,66 @@
+# Technical Proposal: External Service Provider Abstraction
+
+This document outlines a strategy to refactor the SoundTouch Service's content handling into a modular provider-based system.
+
+## 1. Problem Statement
+Currently, content handling for BMX (Bose Media Exchange) services like TuneIn or RadioBrowser is deeply intertwined with the HTTP handlers and XML models. Adding a new content provider (e.g., Local Media, Podcast RSS) requires modifying several files and duplicating boilerplate code for HTTP requests and error handling.
+
+## 2. Proposed Architecture
+
+### 2.1 The Provider Interface
+We define a generic `ContentProvider` interface that abstracts away the source-specific logic (API calls, data parsing).
+
+```go
+package provider
+
+import "github.com/gesellix/bose-soundtouch/pkg/models"
+
+type ContentProvider interface {
+    // ID returns the unique identifier for this provider (e.g. "RADIO_BROWSER")
+    ID() string
+
+    // Resolve returns playback details for a given content identifier
+    Resolve(id string) (*models.BmxPlaybackResponse, error)
+
+    // Search allows finding content within this provider
+    Search(query string) ([]models.ContentItem, error)
+}
+```
+
+### 2.2 Provider Registry
+A central registry in `soundtouch-service` manages the lifecycle and selection of providers.
+
+```go
+type Registry struct {
+    providers map[string]ContentProvider
+}
+
+func (r *Registry) Register(p ContentProvider) { ... }
+func (r *Registry) Get(id string) ContentProvider { ... }
+```
+
+## 3. Implementation Plan
+
+### 3.1 Phase 1: Modularize RadioBrowser
+1.  **Extract Logic**: Move current RadioBrowser logic from `bmx.go` into a new package `pkg/service/providers/radiobrowser`.
+2.  **Add Failover**: Implement the **API Failover** logic inspired by OpenCloudTouch.
+    -   Maintain a list of active RadioBrowser mirrors (e.g., `de1.api.radio-browser.info`, `nl1.api.radio-browser.info`).
+    -   Implement a round-robin or health-based selection strategy.
+3.  **Implements Interface**: Ensure the new package satisfies the `ContentProvider` interface.
+
+### 3.2 Phase 2: Refactor BMX Handlers
+-   Update `HandleTuneInPlayback` and `HandleOrionPlayback` to use the registry.
+-   The handlers will look up the provider based on the request context or URL parameters and delegate the resolution.
+
+### 3.3 Phase 3: Dynamic Service Advertising
+-   Modify `HandleBMXRegistry` to dynamically generate the `bmx_services.json` content based on the currently registered and enabled providers.
+
+## 4. Benefits
+-   **Resilience**: Centralized error handling and failover strategies for all external APIs.
+-   **Extensibility**: New services can be added by simply implementing the interface and registering them at startup.
+-   **Testability**: Providers can be unit-tested in isolation without mocking the entire HTTP server stack.
+-   **Unified UI**: A future Web UI can query the registry to show available content sources and their statuses.
+
+## 5. Next Steps
+1.  Refine the `ContentProvider` interface to include metadata (icons, user-friendly names).
+2.  Create a prototype for the `radiobrowser` provider with failover support.
@@ -3,10 +3,19 @@
 This document summarizes the improvements made to the **Marge service** to improve parity with the upstream Bose SoundTouch service, along with open issues and proposed next steps.

 #### ✅ Completed Improvements (Marge Service)
-*   **Mapped Preset `buttonNumber`**: Correctly mapped the internal `ServicePreset.ID` to the `buttonNumber` XML attribute in the `/full` response.
+*   **Mapped Preset `buttonNumber`**: Correctly mapped the internal `ServicePreset.ID` or `ButtonNumber` to the `buttonNumber` XML attribute in the `/full` response and ensured it is persisted in the local datastore.
+*   **High-Fidelity Device Metadata**: Improved the datastore to correctly extract, persist, and report detailed device `<components>` (e.g., `LIGHTSWITCH`, `SMSC`) and their firmware versions from upstream responses.
+*   **Standardized Preferred Language**: Updated the default `preferredLanguage` to `de` in the `/full` response and added synchronization to persist it from upstream responses.
+*   **Persisted Provider Settings**: Added support for persisting and echoing back `providerSettings` (e.g., `STREAMING_QUALITY`, `ELIGIBLE_FOR_TRIAL`) from the `/full` response.
 *   **Populated `contentItemType`**: The `contentItemType` (e.g., `tracklisturl`) is now correctly synchronized from upstream, persisted in the local datastore, and returned in the `/full` response for both presets and recents.
 *   **Standardized Credential Types**: Adjusted the logic for Spotify to use the correct `token_version_3` type when a token is present in the `/full` response, improving parity with the upstream service. The service now respects existing `credential_type` values from `Sources.xml` (e.g., `token_version_3` for Spotify) while providing sensible defaults for new or incomplete sources.
+*   **Structured Sources (Sources.xml)**: Refactored `Sources.xml` to use an attribute-based structure (`sourceid`, `source`, `status`, `sourceAccount`, etc.) matching the real device's output. Removed redundant nested tags like `<sourcename>`, `<username>`, and `<name>`.
+*   **Nested Recents (Recents.xml)**: Implemented a nested `<contentItem>` structure within `<recent>` entries in `Recents.xml`, maintaining exact parity with the device's persistence format while supporting legacy flat formats for backward compatibility.
 *   **Inconsistent `serialNumber` Casing**: Fixed the casing mismatch in the `/full` response where the upstream uses camelCase `<serialNumber>` in the top-level `<device>` and lowercase `<serialnumber>` in the nested `<attachedProduct>`. Local responses now correctly mirror this inconsistency.
+*   **Attribute-level Parity**:
+    *   Ensured `sourceAccount=""` is preserved in XML even when empty, matching device behavior for sources like TUNEIN.
+    *   Fixed casing for attributes like `deviceID` and `utcTime` in `Recents.xml`.
+    *   Correctly mapped and persisted preset and recent `id` attributes during "Initial Data Sync".
 *   **Device Name Consistency**: Fixed an issue where the device `<name>` was empty in some local `/full` responses by ensuring it is correctly populated from the datastore and synchronized from upstream.
 *   **Improved XML Parity**: Empty `<name>` tags in the `/full` response are now self-closing (`<name/>`), matching upstream behavior.
 *   **Timestamp-based ID Generation**: Implemented a 9-digit ID schema (`YYMMDD` + 3-digit counter) for `recent` items, ensuring IDs are large, unique, and stay within the 32-bit integer range.
@@ -37,19 +46,21 @@ This document summarizes the improvements made to the **Marge service** to impro

 #### 🛠️ Open Issues and Next Steps

-Based on the latest `parity_mismatches`, here are the recommended areas for further work:
+Based on the latest `parity_mismatches` and the high-fidelity `/full` account response comparison (diff14), here are the recommended areas for further work:

 #### 1. BMX / TuneIn Playback Parity (Medium)
 Current mismatches in `/bmx/tunein/v1/playback/station/...` show differences in reporting URLs and missing links:
-*   **Mismatched Parameters**: Local reporting URLs use `listen_id=3432432423`, while upstream uses a different session-based ID.
+*   **Mismatched Parameters**: Local reporting URLs use `listen_id=1234567890`, while upstream uses a different session-based ID.
 *   **Missing Links**: Some upstream responses include additional `_links` or metadata that are currently omitted in local responses.
 *   **Action**: Improve the `HandleTuneInPlayback` logic to better mirror the upstream response structure and parameter generation.

-#### 2. Presets and Recents Parity (Medium)
-Further align the standalone `GET /presets` and `GET /recents` endpoints with the refined structural improvements introduced for the `/full` account response:
-*   **Source Nesting**: Ensure the standalone responses also use the specialized nested `<source>` structure instead of mixed attributes when appropriate.
-*   **Field Completeness**: Verify all metadata fields (e.g., `<contentItemType>`, `<lastplayedat>`) are consistently populated across all access paths.
-*   **Action**: Evaluate if the specialized `FullResponsePreset` and `FullResponseRecent` models should be shared or mirrored in the standalone handlers.
+#### 2. `/full` Account Response Data Gaps (Medium)
+While structural parity for the `/full` response is high, several value-level gaps remain as shown in `diff14`:
+*   **Timestamp Formats**: Upstream uses ISO-8601 with milliseconds (e.g., `2024-06-23T07:40:36.000+00:00`), whereas some local fields still use Unix epoch integers (e.g., `1234567890`).
+*   **Provider Settings**: The `providerSettings` block in the local response currently lacks crucial values like `keyName`, `providerId`, and `boseId` (appearing as empty tags).
+*   **Component Metadata**: Local component types are sometimes empty (`type=""`) compared to upstream values like `LIGHTSWITCH` or `SMSC`.
+*   **Source/Preset Identifiers**: Local IDs (e.g., `100004`) differ from upstream IDs (e.g., `1234567`), though this may be expected due to different account/device environments.
+*   **Action**: Update the mapping logic in `marge.go` and `setup.go` to ensure all fields in the `/full` response are correctly populated with high-fidelity values and standard ISO-8601 timestamps.

 #### 3. OAuth / Spotify Token Noise (Low/Medium)
 The `/oauth/device/.../token` endpoint frequently reports mismatches because tokens are naturally different between local and upstream.
@@ -68,19 +79,10 @@ Analysis of device reboot logs revealed several data requirements:
 *   **Power-On Details Tracking**: Implemented extraction and persistence of detailed device information (serial numbers, firmware version, product details, and MAC addresses) from the `POST /streaming/support/power_on` request. This data is now stored in the local datastore, improving our ability to respond accurately to subsequent management requests.
 *   **Source Provider Mapping**: Synchronized local source provider IDs and timestamps with upstream data. The `RADIO_BROWSER` provider is included in the public `/streaming/sourceproviders` list to maintain internal functionality while acknowledging it as a parity gap.

-#### 7. Account Full Response (/full) Structural & Value Parity (In Progress)
-Based on `_/diffs/diff7/`, several structural and value gaps remain in the `/full` account response:
+#### 7. Account Full Response (/full) Structural & Value Parity (Completed)
+Structural and value gaps in the `/full` account response have been addressed:

-**Remaining Findings:**
-    *   **Nested Source Inconsistency in Recents**: The `<source>` element within `<recent>` entries still frequently points to a generic fallback (ID `9330201`) instead of the specific source (e.g., Spotify ID `10863533`).
-    *   Missing/empty `<username>` at the `<preset>` level.
-*   **Values**:
-    *   **Empty Device `<name>`**: Locally, the device `<name>` is empty in the response even when available in the datastore or upstream.
-    *   **Empty `<contentItemType>`**: Local responses have empty `<contentItemType>` in presets and recents, whereas upstream has `tracklisturl` or `stationurl`.
-    *   `preferredLanguage` mismatch (`en` vs `de`).
-
-**Next Implementation Steps (Proposals):**
-1.  **Fix Device `<name>` Population**: Investigate why `CreateAccountDevice` or `AccountFullToXML` is not correctly returning the device name even if it's synchronized.
-2.  **Refine Source Association in Recents**: Improve the matching logic in `mapRecentsToFullResponse` to correctly link recents to their specific `ConfiguredSource` (e.g., by matching `sourceid` attribute).
-3.  **Populate `contentItemType`**: Update the internal models and `SyncFromAccountFull` to correctly extract, persist, and echo back `contentItemType` (e.g., `tracklisturl`).
-4.  **Handle Account Metadata**: Synchronize `preferredLanguage` from the upstream `/full` response to the local account state.
+**Key Fixes:**
+*   **Structural**:
+    *   **Nested Source Association**: Improved the matching logic in `mapRecentsToFullResponse` to correctly link recents to their specific `ConfiguredSource` (e.g., by matching `sourceid` attribute).
+    *   **XML Tag Formatting**: Standardized self-closing tags and element formatting to match upstream's multi-line or empty-element formatting in various contexts.
@@ -0,0 +1,45 @@
+# Parity Analysis: Bose-SoundTouch (Go) vs. OpenCloudTouch (Python)
+
+This document provides a comparative analysis of the current Go implementation and the `scheilch/opencloudtouch` project, identifying functional gaps and potential improvements.
+
+## 1. Core Architecture and Language
+- **Bose-SoundTouch (Go)**: A high-performance, strongly typed backend with a CLI and background service. Focuses on full API coverage, parity testing, and robust hardware control (DSP, zones).
+- **OpenCloudTouch (OCT)**: A modern full-stack application (FastAPI + React/TypeScript). Prioritizes user experience with a web-based setup wizard and a clean abstraction for internet radio.
+
+## 2. Functional Comparison
+
+| Feature                 | Bose-SoundTouch (Go)                                       | OpenCloudTouch (Python)                                                 |
+|:------------------------|:-----------------------------------------------------------|:------------------------------------------------------------------------|
+| **Setup Experience**    | CLI-driven or manual API calls for migration (SSH, XML).   | Web-based **Setup Wizard** guides through SSH, backup, and redirection. |
+| **Radio Support**       | Static integration of **RadioBrowser** and TuneIn.         | Dynamic **RadioBrowserAdapter** with automatic **API Failover**.        |
+| **Commercial Services** | Deep integration (Spotify priming, Pandora, Deezer, etc.). | Basic support, focus is on local content and radio.                     |
+| **Hardware Control**    | Extensive (Bass, Treble, Soundbar levels, Clock display).  | Basic playback and zone controls.                                       |
+| **Cloud Emulation**     | High-fidelity parity (mirroring, discrepancy logging).     | Functional emulation for local preset/recent persistence.               |
+| **Notifications**       | Built-in **TTS** and custom URL audio alerts.              | Not a primary focus.                                                    |
+
+## 3. Key Strengths of OpenCloudTouch
+- **Guided Onboarding**: The setup wizard reduces the entry barrier for non-technical users significantly.
+- **Resilient Radio**: The API failover for RadioBrowser ensures continuous service even if specific community-hosted API instances go offline.
+- **Modern API Stack**: Uses OpenAPI and generated TypeScript types for a seamless frontend integration.
+- **Provider Abstraction**: A cleaner internal separation between the "Bose World" (XML/BMX) and external content providers (RadioBrowser).
+
+## 4. Suggested Improvements for Bose-SoundTouch
+
+### A. Web-based Setup Wizard (High Priority)
+- Implement a state-driven wizard in the `soundtouch-service` to handle:
+  - SSH activation (checking `/remote_services` via USB).
+  - Automated backup of speaker configuration.
+  - Verification of DNS/Hosts redirection.
+- Expose this via a simple embedded Web UI (using Go's `embed` package).
+
+### B. RadioBrowser Failover (Medium Priority)
+- Adapt the failover logic from OCT:
+  - Periodically refresh the list of available RadioBrowser API servers.
+  - Implement a retry mechanism that switches servers on 5xx errors or timeouts.
+
+### C. External Service Abstraction (Medium Priority)
+- Refactor the hardcoded BMX logic into a more modular **Provider System** (see `EXTERNAL-SERVICES-ABSTRACTION.md`).
+- This will allow easier addition of new sources (e.g., local DLNA, generic M3U playlists) without touching the core BMX handlers.
+
+## 5. Summary
+While our Go project provides the most complete technical coverage of SoundTouch hardware and commercial services, OpenCloudTouch sets a higher standard for **user onboarding** and **service resilience** for community-driven content. Integrating a setup wizard and a more robust radio backend would make our project significantly more accessible and reliable.
@@ -0,0 +1,57 @@
+# Parity Analysis: Bose-SoundTouch (Go) vs. SoundCork (Python)
+
+This document provides a comparative analysis of the current Go implementation and the `deborahgu/soundcork` project, identifying functional gaps and potential improvements.
+
+## 1. Core Architecture and Language
+- **Bose-SoundTouch (Go)**: Uses `chi` for routing and `encoding/xml` for data. High performance, strong typing, and precise MIME type handling (`application/vnd.bose.streaming-v1.2+xml`).
+- **SoundCork (Python)**: Uses `FastAPI` and `xml.etree.ElementTree`. Prioritizes flexibility and rapid prototyping of streaming service mocks.
+
+## 2. Functional Comparison
+
+| Feature              | Bose-SoundTouch (Go)                                                                                                  | SoundCork (Python)                                                                      |
+|:---------------------|:----------------------------------------------------------------------------------------------------------------------|:----------------------------------------------------------------------------------------|
+| **Group Management** | Full CRUD: `POST /group`, `POST /group/{id}`, `DELETE /group/{id}` with XML datastore persistence (`Group_{id}.xml`). | Active group management (`groups.py`), supporting `/addGroup` and stereo pairing logic. |
+| **ZeroConf Priming** | Full DH key exchange + encrypted blob; fallback to `tokenType=accesstoken` for older firmware.                        | Simple `tokenType=accesstoken` push only; token expires after ~60 minutes.              |
+| **BMX Services**     | Supports TuneIn, Orion, and custom streams.                                                                           | More modular `bmx_services.json` registry with broader mock support.                    |
+| **Persistence**      | Mixed JSON/XML datastore.                                                                                             | Pure XML-based persistence per device/account.                                          |
+| **Admin UI**         | CLI-based (`soundtouch-cli`) or API-driven.                                                                           | Draft Web UI for device discovery and account management (`admin.py`).                  |
+| **Discovery**        | Integrated setup tools and SSDP/MDNS awareness.                                                                       | Leverages `bosesoundtouchapi` Python library for active discovery.                      |
+
+## 3. Key Strengths of SoundCork
+- **Group Pairing Logic**: Includes logic to manage master/slave relationships for SoundTouch 10 stereo pairs.
+- **Service Extensibility**: JSON-based registry for BMX services makes it easier to mock multiple providers (SiriusXM, Spotify) without code changes.
+- ~~**Mock Coverage**: Better coverage of "dummy" endpoints that respond with plausible XML (e.g., `customerSupport`).~~ **Addressed**: AfterTouch's `HandleNotFound` (registered via `r.NotFound`) logs every unimplemented endpoint as `[UNHANDLED]` and forwards the request to the Bose upstream via `HandleBoseProxy`. This provides at least the same coverage as static dummy responses, while also aiding discovery of new endpoints.
+
+## 4. Suggested Implementation Steps for Bose-SoundTouch
+
+### ✅ A. Implement Full Group Support (Completed)
+- `POST /group`, `POST /group/{id}`, `DELETE /group/{id}` implemented in `pkg/service/handlers/handlers_marge.go`.
+- Group CRUD persisted in XML datastore (`Group_{id}.xml`) via `pkg/service/datastore/datastore.go`.
+- `GET /group` on device registration reads the group the device belongs to.
+
+### ✅ B. Proper ZeroConf Spotify Blob (Completed)
+- Full Spotify Connect ZeroConf protocol implemented in `pkg/service/spotify/zeroconf.go`.
+- Flow: `getInfo` (fetch speaker DH public key) → 768-bit DH key exchange → AES-128-CTR encrypted `LoginCredentials` protobuf blob → `addUser`.
+- Speaker can self-refresh credentials independently; no periodic re-priming needed for token expiry.
+- Automatic fallback to `tokenType=accesstoken` if `getInfo` fails (older firmware without DH support).
+- See `docs/concepts/spotify-priming-strategy.md` for full protocol details.
+- **Remaining gap**: Background watchdog to re-prime devices that lose their session (reboot / power loss). Not required for token expiry on modern firmware; only needed for the "speaker rebooted and lost state" recovery path and for older firmware on the fallback path (~45 min token expiry).
+
+### C. Modularize BMX Registry (Medium Priority)
+- Extract the hardcoded service list in `HandleBMXRegistry` into an external `bmx-services.json` file.
+- Allow users to customize which mocked services are advertised to the speaker.
+
+### D. Enhanced Source Management (Medium Priority)
+- Refine source learning logic to ensure all `sourceAccount` and `sourceName` metadata is correctly captured during synchronization, using patterns from `soundcork`'s `learnSource`.
+
+### E. Basic Admin Web UI (Low Priority)
+- Develop a minimal internal status page to list active accounts and connected devices, improving usability over raw API calls.
+
+## 5. Summary
+
+Group support and ZeroConf Spotify priming are now feature-complete in AfterTouch. The Go implementation is structurally more consistent with recent reference recordings (e.g., `buttonNumber`, detailed `components`). SoundCork's remaining functional advantages are:
+
+- **BMX service extensibility**: the `bmx_services.json` registry makes it trivial to add or mock new streaming providers without code changes (step C above).
+- **Group pairing logic**: master/slave relationship management for SoundTouch 10 stereo pairs goes beyond the CRUD AfterTouch implements.
+
+For the broader ecosystem context (feature matrix across all community projects, AfterTouch open tasks, and cross-project observations) see [docs/analysis/bose-soundtouch-community-tools.md](analysis/bose-soundtouch-community-tools.md).
@@ -35,7 +35,7 @@ soundtouch-cli --host 192.168.1.100 preset store \
 soundtouch-cli --host 192.168.1.100 preset store \
  --slot 3 \
  --source TUNEIN \
-  --location "/v1/playbook/station/s33828" \
+  --location "/v1/playback/station/s33828" \
  --name "K-LOVE Radio"
 ```

@@ -103,7 +103,7 @@ Just replace `https://open.spotify.com/` with `spotify:` and `/` with `:`.
 ### Radio Stations
 ```bash
 # TuneIn Radio
--source TUNEIN --location "/v1/playbook/station/s33828"
+--source TUNEIN --location "/v1/playback/station/s33828"

 # Internet Radio Stream
 --source LOCAL_INTERNET_RADIO --location "https://stream.example.com/jazz"
@@ -249,7 +249,7 @@ soundtouch-cli --host 192.168.1.100 preset store \
 # Kids' bedtime stories
 soundtouch-cli --host 192.168.1.100 preset store \
  --slot 3 --source TUNEIN \
-  --location "/v1/playbook/station/bedtime-stories" \
+  --location "/v1/playback/station/bedtime-stories" \
  --name "Bedtime Stories"
 ```

@@ -21,7 +21,7 @@ This document describes the most important patterns for the Bose SoundTouch API

 **Key Aspects:**
 - **Native Builds**: Full API functionality for CLI and server
- **WASM Builds**: Browser-compatible subset functionality  
+- **WASM Builds**: Browser-compatible subset functionality
 - **Cross-Platform**: Linux, macOS, Windows support
 - **Embedded Assets**: Web UI directly embedded in binary

@@ -66,7 +66,7 @@ func (c *Client) GetNowPlaying() (*models.NowPlaying, error) {
        return nil, err
    }
    defer resp.Body.Close()
-    
+
    var nowPlaying models.NowPlaying
    err = xml.NewDecoder(resp.Body).Decode(&nowPlaying)
    return &nowPlaying, err
@@ -77,7 +77,7 @@ func (c *Client) GetNowPlaying() (*models.NowPlaying, error) {
 ```go
 func (c *Client) SendKey(key models.Key) error {
    keyXML := fmt.Sprintf(`<key state="press" sender="GoClient">%s</key>`, key)
-    
+
    resp, err := c.httpClient.Post(
        c.baseURL+"/key",
        "application/xml",
@@ -117,14 +117,14 @@ func (d *DiscoveryService) DiscoverDevices() ([]Device, error) {
        return nil, err
    }
    defer conn.Close()
-    
+
    // Send M-SEARCH request
    searchRequest := "M-SEARCH * HTTP/1.1\r\n" +
        "HOST: 239.255.255.250:1900\r\n" +
        "MAN: \"ssdp:discover\"\r\n" +
        "ST: urn:schemas-upnp-org:device:MediaRenderer:1\r\n" +
        "MX: 3\r\n\r\n"
-    
+
    // Implementation details...
    return devices, nil
 }
@@ -158,13 +158,13 @@ func (e *EventClient) Subscribe(eventType string, handler EventHandler) {

 func (e *EventClient) Start() error {
    u := url.URL{Scheme: "ws", Host: e.client.host + ":8090", Path: "/"}
-    
+
    conn, _, err := websocket.DefaultDialer.Dial(u.String(), nil)
    if err != nil {
        return err
    }
    e.conn = conn
-    
+
    go e.eventLoop()
    return nil
 }
@@ -184,7 +184,7 @@ func (e *EventClient) eventLoop() {
                }
                return
            }
-            
+
            if handler, exists := e.handlers[event.Type]; exists {
                go handler(event)
            }
@@ -220,7 +220,7 @@ func wasmDiscoverDevices(this js.Value, args []js.Value) interface{} {
    handler := js.FuncOf(func(this js.Value, args []js.Value) interface{} {
        go func() {
            devices, err := discovery.NewDiscoveryService(5*time.Second).DiscoverDevices()
-            
+
            result := make(map[string]interface{})
            if err != nil {
                result["error"] = err.Error()
@@ -228,13 +228,13 @@ func wasmDiscoverDevices(this js.Value, args []js.Value) interface{} {
                devicesJSON, _ := json.Marshal(devices)
                result["devices"] = string(devicesJSON)
            }
-            
+
            // Call JavaScript callback
            args[0].Invoke(js.ValueOf(result))
        }()
        return nil
    })
-    
+
    return handler
 }
 ```
@@ -280,7 +280,7 @@ func main() {
                    if err != nil {
                        return err
                    }
-                    
+
                    for i, device := range devices {
                        fmt.Printf("%d: %s (%s)\n", i+1, device.Name, device.Host)
                    }
@@ -300,7 +300,7 @@ func main() {
            },
        },
    }
-    
+
    app.Run(os.Args)
 }

@@ -311,7 +311,7 @@ func getClientFromContext(c *cli.Context) *client.Client {
        devices, _ := discovery.DiscoverDevices()
        deviceHost = selectDeviceInteractive(devices)
    }
-    
+
    return client.NewClient(deviceHost, 8090)
 }
 ```
@@ -327,34 +327,34 @@ var webAssets embed.FS

 func main() {
    mux := http.NewServeMux()
-    
+
    // Embedded web assets
    webFS, err := fs.Sub(webAssets, "web")
    if err != nil {
        log.Fatal(err)
    }
-    
+
    // SPA routing
    mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
        if r.URL.Path != "/" {
            http.FileServer(http.FS(webFS)).ServeHTTP(w, r)
            return
        }
-        
+
        data, err := webAssets.ReadFile("web/index.html")
        if err != nil {
            http.Error(w, "Not found", http.StatusNotFound)
            return
        }
-        
+
        w.Header().Set("Content-Type", "text/html")
        w.Write(data)
    })
-    
+
    // API endpoints
    mux.HandleFunc("/api/devices", handleDeviceDiscovery)
    mux.HandleFunc("/api/client/", handleClientProxy)
-    
+
    log.Println("SoundTouch Web UI starting on :8080")
    log.Fatal(http.ListenAndServe(":8080", mux))
 }
@@ -370,36 +370,36 @@ func handleClientProxy(w http.ResponseWriter, r *http.Request) {
        http.Error(w, "Invalid path", http.StatusBadRequest)
        return
    }
-    
+
    deviceIP := pathParts[3]
    apiPath := "/" + strings.Join(pathParts[4:], "/")
-    
+
    // Proxy request to SoundTouch device
    targetURL := fmt.Sprintf("http://%s:8090%s", deviceIP, apiPath)
-    
+
    proxyReq, err := http.NewRequest(r.Method, targetURL, r.Body)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
-    
+
    // Copy headers
    for k, v := range r.Header {
        proxyReq.Header[k] = v
    }
-    
+
    resp, err := http.DefaultClient.Do(proxyReq)
    if err != nil {
        http.Error(w, err.Error(), http.StatusInternalServerError)
        return
    }
    defer resp.Body.Close()
-    
+
    // Enable CORS
    w.Header().Set("Access-Control-Allow-Origin", "*")
    w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
    w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
-    
+
    // Copy response
    w.WriteHeader(resp.StatusCode)
    io.Copy(w, resp.Body)
@@ -448,7 +448,7 @@ func (p *PlayStatus) UnmarshalXML(d *xml.Decoder, start xml.StartElement) error
    if err := d.DecodeElement(&s, &start); err != nil {
        return err
    }
-    
+
    switch s {
    case string(PlayStatusPlaying), string(PlayStatusPaused), string(PlayStatusStopped):
        *p = PlayStatus(s)
@@ -469,41 +469,41 @@ type Config struct {
    // Server configuration
    WebPort      int           `env:"WEB_PORT" default:"8080"`
    APITimeout   time.Duration `env:"API_TIMEOUT" default:"10s"`
-    
+
    // Discovery configuration
    DiscoveryTimeout time.Duration `env:"DISCOVERY_TIMEOUT" default:"5s"`
    CacheDevices     bool          `env:"CACHE_DEVICES" default:"true"`
-    
+
    // CORS configuration (for web proxy)
    CORSOrigins []string `env:"CORS_ORIGINS" default:"*"`
-    
+
    // Logging
    LogLevel string `env:"LOG_LEVEL" default:"info"`
 }

 func Load() Config {
    var cfg Config
-    
+
    // Load from .env file
    loadDotEnv()
-    
+
    // Parse environment variables with reflection
    parseEnvVars(&cfg)
-    
+
    return cfg
 }

 func parseEnvVars(cfg interface{}) {
    v := reflect.ValueOf(cfg).Elem()
    t := v.Type()
-    
+
    for i := 0; i < v.NumField(); i++ {
        field := v.Field(i)
        fieldType := t.Field(i)
-        
+
        envTag := fieldType.Tag.Get("env")
        defaultTag := fieldType.Tag.Get("default")
-        
+
        if envTag != "" {
            if envValue := os.Getenv(envTag); envValue != "" {
                setFieldValue(field, envValue)
@@ -545,11 +545,11 @@ func (m *MockClient) GetNowPlaying() (*models.NowPlaying, error) {
    if err, exists := m.errors["now_playing"]; exists {
        return nil, err
    }
-    
+
    if resp, exists := m.responses["now_playing"]; exists {
        return resp.(*models.NowPlaying), nil
    }
-    
+
    return &models.NowPlaying{
        Track:  "Mock Track",
        Artist: "Mock Artist",
@@ -577,8 +577,8 @@ CMD ["go", "test", "-v", "./..."]
 ```bash
 # Makefile test target
 test-integration:
-	docker-compose -f test/docker-compose.yml up --build --abort-on-container-exit
-	docker-compose -f test/docker-compose.yml down
+	docker compose -f test/docker-compose.yml up --build --abort-on-container-exit
+	docker compose -f test/docker-compose.yml down
 ```

 ## Recommended Project Structure
@@ -741,7 +741,7 @@ type APIError struct {
    Message string `xml:",innerxml"`
 }

-// pkg/models/device.go  
+// pkg/models/device.go
 type DeviceInfo struct {
    XMLResponse
    Name     string `xml:"name"`
@@ -773,7 +773,7 @@ func main() {
            },
        },
    }
-    
+
    app.Run(os.Args)
 }
 ```
@@ -802,4 +802,4 @@ func main() {

 ## Conclusion

-This pattern collection enables the development of robust API clients for hardware devices that function both as native tools and as web applications. The combination of Go's type safety, WASM support, and a structured build system makes it possible to use a single codebase for various deployment scenarios.
+This pattern collection enables the development of robust API clients for hardware devices that function both as native tools and as web applications. The combination of Go's type safety, WASM support, and a structured build system makes it possible to use a single codebase for various deployment scenarios.
@@ -8,8 +8,9 @@ Welcome to the documentation for the Bose SoundTouch Toolkit. This comprehensive
 - **[Complete Migration Guide](guides/MIGRATION-GUIDE.md)** - Step-by-step guide from Bose Cloud to local control
 - **[Getting Started](guides/GETTING-STARTED.md)** - Quick introduction to the toolkit

-### For Existing Users  
+### For Existing Users
 - **[Cloud Shutdown Survival Guide](guides/SURVIVAL-GUIDE.md)** - Prepare for the May 2026 shutdown
+- **[Backup Tool](../cmd/soundtouch-backup/README.md)** - Back up your cloud account and speaker data before shutdown
 - **[SoundTouch Service Guide](guides/SOUNDTOUCH-SERVICE.md)** - Advanced service configuration

 ## 📋 Essential Documentation
@@ -17,7 +18,7 @@ Welcome to the documentation for the Bose SoundTouch Toolkit. This comprehensive
 The documentation is organized into three main categories:

 ### 1. **User Guides** - For everyday users migrating and managing devices
-### 2. **Technical Reference** - For developers and advanced configuration  
+### 2. **Technical Reference** - For developers and advanced configuration
 ### 3. **Concept Documentation** - For contributors and system architects

 ## 🗂 Documentation Structure
@@ -40,6 +41,7 @@ The documentation is organized into three main categories:
 ### Advanced Features
 - [MAC Address Mapping](guides/MAC-ADDRESS-MAPPING.md) - Device identification
 - [CLI Reference](guides/CLI-REFERENCE.md) - Command-line tools
+- [Backup Tool](../cmd/soundtouch-backup/README.md) - Cloud account and speaker data backup
 - [IoT Implementation Guide](guides/IOT-IMPLEMENTATION-GUIDE.md) - IoT integrations
 - [MQTT Integration Design](guides/MQTT-INTEGRATION-DESIGN.md) - MQTT setup

@@ -47,6 +49,7 @@ The documentation is organized into three main categories:

 ### API Documentation
 - [API Endpoints](reference/API-ENDPOINTS.md) - REST API reference
+- [Spotify Account Addition](reference/spotify-account-addition.md) - Technical requests for Spotify
 - [WebSocket Events](reference/WEBSOCKET-EVENTS.md) - Real-time events
 - [Zone Management](reference/ZONE-MANAGEMENT.md) - Multi-room control
 - [Preset Management](reference/PRESET-MANAGEMENT.md) - Preset operations
@@ -4,11 +4,17 @@

 ## User Guides
 * [Cloud Shutdown Survival Guide](guides/SURVIVAL-GUIDE.md)
+* [Self-Hosting AfterTouch](guides/SELF-HOSTING.md)
+* [Connecting Music Services](guides/MUSIC-SERVICES.md)
 * [Migration & Safety Guide](guides/MIGRATION-SAFETY.md)
 * [CLI Reference](guides/CLI-REFERENCE.md)
+* [Backup Tool](../cmd/soundtouch-backup/README.md)
 * [Getting Started](guides/GETTING-STARTED.md)
 * [SoundTouch Service](guides/SOUNDTOUCH-SERVICE.md)
 * [Initial Device Setup](guides/DEVICE-INITIAL-SETUP.md)
+* [Capture Device Pairing Traffic](guides/CAPTURE-DEVICE-PAIRING.md)
+* [Capture Migration Traffic](guides/CAPTURE-MIGRATION-TRAFFIC.md)
+* [Device Setup Flow](DEVICE-SETUP.md)
 * [MAC Address Mapping](guides/MAC-ADDRESS-MAPPING.md)
 * [HTTPS Setup](guides/HTTPS-SETUP.md)
 * [Deployment](guides/DEPLOYMENT.md)
@@ -28,10 +34,12 @@
 ## Technical Reference
 * [API Cookbook](reference/API-COOKBOOK.md)
 * [API Endpoints](reference/API-ENDPOINTS.md)
+* [Spotify Account Addition](reference/spotify-account-addition.md)
 * [Cloud API Emulation](reference/CLOUD-API.md)
 * [System Endpoints](reference/SYSTEM-ENDPOINTS.md)
 * [Speaker Endpoint](reference/SPEAKER-ENDPOINT.md)
 * [WebSocket Events](reference/WEBSOCKET-EVENTS.md)
+* [Device Pairing Flow](reference/DEVICE-PAIRING-FLOW.md)
 * [Discovery](reference/DISCOVERY.md)
 * [Zone Management](reference/ZONE-MANAGEMENT.md)
 * [Preset Management](reference/PRESET-MANAGEMENT.md)
@@ -46,6 +54,7 @@
 * [Request Recording](REQUEST_RECORDING_CONCEPT.md)
 * [Spotify Priming Strategy](concepts/spotify-priming-strategy.md)
 * [Spotify OAuth](concepts/spotify-oauth.md)
+* [soundtouch-web Roadmap](soundtouch-web-roadmap.md)

 ## Analysis & Research
 * [API Coverage Analysis](analysis/API-COVERAGE.md)
@@ -53,11 +62,25 @@
 * [Upstream URLs](analysis/UPSTREAM-URLS.md)
 * [Anonymization Summary](analysis/ANONYMIZATION-SUMMARY.md)
 * [Device Redirect Methods](analysis/DEVICE-REDIRECT-METHODS.md)
+* [Telnet (Port 17000) Migration Method](analysis/TELNET-MIGRATION-METHOD.md)
+* [Telnet Command Reference](analysis/TELNET-COMMAND-REFERENCE.md)
+* [Setup WebSocket Experiment](analysis/SETUP-WEBSOCKET-EXPERIMENT.md)
+* [Factory Reset Protocol](analysis/FACTORY-RESET-PROTOCOL.md)
 * [Wiki API Comparison](analysis/WIKI-COMPARISON.md)
 * [IoT Config Summary](analysis/IOT-CONFIG-SUMMARY.md)
 * [IoT Configuration Analysis](analysis/IOT-CONFIGURATION-ANALYSIS.md)
+* [Bose Lab Runbook](analysis/BOSE-LAB-RUNBOOK.md)
+* [Missing Routes Spotify](analysis/MISSING-ROUTES-SPOTIFY.md)
+* [Bose App ADB Emulator](analysis/BOSE-APP-ADB-Emulator.md)
+* [Community Tools](analysis/bose-soundtouch-community-tools.md)
+
+## Parity Analysis
+* [Parity Improvements](PARITY-IMPROVEMENTS.md)
+* [Parity SoundCork](PARITY-SOUNDCORK.md)
+* [Parity OpenCloudTouch](PARITY-OPENCLOUDTOUCH.md)

 ## Appendix (Other Documents)
+* [External Services Abstraction](EXTERNAL-SERVICES-ABSTRACTION.md)
 * [API Navigation Reference](API-NAVIGATION-REFERENCE.md)
 * [Claude Instructions](CLAUDE.md)
 * [Content Selection Implementation](CONTENT-SELECTION-IMPLEMENTATION.md)
@@ -81,3 +104,4 @@
 * [Power On Implementation Guide](power-on-implementation-guide.md)
 * [SCMUDC Events Analysis](scmudc-events-analysis.md)
 * [Parity Improvements](PARITY-IMPROVEMENTS.md)
+* [Parity SoundCork](PARITY-SOUNDCORK.md)
@@ -0,0 +1,24 @@
+{%- comment -%}
+Render Mermaid diagrams in docs pages.
+
+Markdown ```mermaid fenced blocks are emitted by Kramdown as
+<pre><code class="language-mermaid">…</code></pre>, but Mermaid only
+auto-renders elements with class="mermaid". This snippet rewrites the
+pre/code nodes into div.mermaid before initialising the library.
+
+Loaded as an ES module from the jsDelivr CDN so we don't have to vendor
+the library into the repo. Pinned to a major version for cache stability.
+{%- endcomment -%}
+<script type="module">
+  import mermaid from 'https://cdn.jsdelivr.net/npm/mermaid@11/dist/mermaid.esm.min.mjs';
+
+  document.querySelectorAll('pre > code.language-mermaid').forEach((code) => {
+    const div = document.createElement('div');
+    div.className = 'mermaid';
+    div.textContent = code.textContent;
+    code.parentElement.replaceWith(div);
+  });
+
+  mermaid.initialize({ startOnLoad: false, securityLevel: 'strict' });
+  mermaid.run();
+</script>
@@ -0,0 +1,364 @@
+# Bose SoundTouch Traffic Interception Runbook
+
+Intercept HTTPS/WebSocket traffic from the Bose SoundTouch Android app using an Android emulator, mitmproxy, and Frida. Tested on Apple Silicon (ARM64) Mac.
+
+## Automated Setup
+
+The steps in this document are scripted for reproducibility:
+
+```bash
+scripts/android/setup-mitm-avd.sh   # one-time: create AVD, install cert & APK, save snapshot
+scripts/android/start-mitm-session.sh  # per-session: restore snapshot, refresh proxy, start frida-server
+```
+
+Read on for the full manual walkthrough and the rationale behind each step.
+
+> **Note:** The manual steps below use `/tmp/` for intermediate files and reflect the original approach. The automated scripts supersede them — use the scripts for day-to-day use and refer here only to understand how things work.
+
+---
+
+## Prerequisites
+
+- Android Studio installed (for SDK tools and emulator)
+- Docker installed
+- mitmproxy installed (`pip install mitmproxy` or via your preferred method)
+- The Bose SoundTouch APK (extracted from a real device, see below)
+
+> **BLE limitation**: Android emulators do not expose Bluetooth hardware. The Bose app's default setup path (BLE Wi-Fi provisioning) therefore cannot be used to configure a factory-reset speaker from the emulator. Use **AP mode** instead: provision the speaker's Wi-Fi credentials via the Mac command line first (see [DEVICE-INITIAL-SETUP.md § 6](../guides/DEVICE-INITIAL-SETUP.md)), then the app can discover the already-networked speaker via mDNS/SSDP without BLE.
+
+> **Emulator ↔ local network**: The emulator routes all traffic through the Mac's active network interface. Once the speaker is on the same LAN as the Mac, the emulator can reach it at its normal LAN IP (e.g. `192.168.1.50`) — no extra routing is needed. Use `adb shell ping 192.168.1.50` to confirm reachability.
+
+Add Android SDK tools to your PATH (add to `~/.zshrc`):
+
+```bash
+export PATH=$PATH:~/Library/Android/sdk/emulator
+export PATH=$PATH:~/Library/Android/sdk/platform-tools
+```
+
+---
+
+## 1. Extract APK from Real Device
+
+Connect your Android device via USB with USB debugging enabled.
+
+```bash
+adb devices
+# note your device ID, e.g. "ABC123"
+
+adb -s ABC123 shell pm path com.bose.soundtouch
+# output e.g.: package:/data/app/~~xyz/com.bose.soundtouch-abc/base.apk
+
+adb -s ABC123 pull /data/app/~~xyz/com.bose.soundtouch-abc/base.apk bose.apk
+```
+
+---
+
+## 2. Create Android Emulator (ARM64, API 33)
+
+On Apple Silicon you need an ARM64 image. Use the `avdmanager` and `sdkmanager` CLI tools.
+
+```bash
+# Install the system image
+~/Library/Android/sdk/cmdline-tools/latest/bin/sdkmanager \
+  "system-images;android-33;google_apis;arm64-v8a"
+
+# Create the AVD
+~/Library/Android/sdk/cmdline-tools/latest/bin/avdmanager create avd \
+  -n Pixel_6_API33 \
+  -k "system-images;android-33;google_apis;arm64-v8a" \
+  -d "pixel_6"
+```
+
+Alternatively create the AVD via Android Studio Device Manager (choose "Google APIs", arm64-v8a, API 33).
+
+---
+
+## 3. Start Emulator with Writable System
+
+```bash
+# List available AVDs
+~/Library/Android/sdk/emulator/emulator -list-avds
+
+# Start with writable system partition
+~/Library/Android/sdk/emulator/emulator -avd Pixel_6_API33 -writable-system
+```
+
+Wait until the emulator has fully booted, then:
+
+```bash
+adb -s emulator-5554 root
+adb -s emulator-5554 shell avbctl disable-verification
+adb -s emulator-5554 reboot
+
+# After reboot:
+adb -s emulator-5554 root
+```
+
+---
+
+## 4. Install Bose APK
+
+```bash
+adb -s emulator-5554 install bose.apk
+```
+
+---
+
+## 5. Set Up mitmproxy
+
+```bash
+# Start mitmproxy (generates CA cert on first run)
+# Use the native macOS app — Docker mitmproxy does not work (NAT blocks emulator traffic)
+mitmweb --listen-port 8080 --mode regular -w bose_traffic.mitm
+```
+
+Extract the CA certificate (without private key):
+
+```bash
+openssl x509 -in ~/.mitmproxy/mitmproxy-ca.pem -out ~/.mitmproxy/mitmproxy-ca-cert.pem
+
+# Verify it's the mitmproxy cert, not another cert:
+openssl x509 -in ~/.mitmproxy/mitmproxy-ca-cert.pem -noout -issuer
+# should show: issuer= /CN=mitmproxy/O=mitmproxy
+```
+
+---
+
+## 6. Install mitmproxy CA Certificate in Emulator
+
+```bash
+HASH=$(openssl x509 -inform PEM -subject_hash_old \
+  -in ~/.mitmproxy/mitmproxy-ca-cert.pem | head -1)
+
+adb -s emulator-5554 push ~/.mitmproxy/mitmproxy-ca-cert.pem /data/local/tmp/mitmproxy.pem
+
+adb -s emulator-5554 shell su 0 mkdir -p /data/misc/user/0/cacerts-added
+
+adb -s emulator-5554 shell su 0 \
+  cp /data/local/tmp/mitmproxy.pem /data/misc/user/0/cacerts-added/${HASH}.0
+
+adb -s emulator-5554 shell su 0 \
+  chmod 644 /data/misc/user/0/cacerts-added/${HASH}.0
+```
+
+---
+
+## 7. Set System Proxy in Emulator
+
+Find your Mac's local IP:
+
+```bash
+ipconfig getifaddr en0
+# e.g. 192.168.1.123
+```
+
+Set the proxy:
+
+```bash
+adb -s emulator-5554 shell settings put global http_proxy 192.168.1.123:8080
+```
+
+---
+
+## 8. Set Up Frida (via Python venv)
+
+```bash
+python3 -m venv /tmp/frida-venv
+/tmp/frida-venv/bin/pip install frida==17.9.1 frida-tools==14.8.1
+```
+
+Download the frida-server binary for ARM64 Android:
+
+```bash
+FRIDA_VERSION=17.9.1
+
+curl -L "https://github.com/frida/frida/releases/download/${FRIDA_VERSION}/frida-server-${FRIDA_VERSION}-android-arm64.xz" \
+  -o /tmp/frida-server.xz
+
+unxz /tmp/frida-server.xz
+mv /tmp/frida-server-${FRIDA_VERSION}-android-arm64 /tmp/frida-server
+```
+
+Push to emulator and start:
+
+```bash
+adb -s emulator-5554 push /tmp/frida-server /data/local/tmp/frida-server
+adb -s emulator-5554 shell su 0 chmod 755 /data/local/tmp/frida-server
+adb -s emulator-5554 shell su 0 /data/local/tmp/frida-server &
+```
+
+---
+
+## 9. Download SSL Bypass Scripts
+
+```bash
+BASE=https://raw.githubusercontent.com/httptoolkit/frida-interception-and-unpinning/main
+
+curl -L "${BASE}/config.js" -o /tmp/config.js
+curl -L "${BASE}/android/android-system-certificate-injection.js" \
+  -o /tmp/android-system-certificate-injection.js
+curl -L "${BASE}/android/android-proxy-override.js" \
+  -o /tmp/android-proxy-override.js
+curl -L "${BASE}/android/android-certificate-unpinning.js" \
+  -o /tmp/android-certificate-unpinning.js
+curl -L "${BASE}/android/android-certificate-unpinning-fallback.js" \
+  -o /tmp/android-certificate-unpinning-fallback.js
+```
+
+---
+
+## 10. Configure config.js
+
+Edit `/tmp/config.js` and set:
+
+```javascript
+const CERT_PEM = `<contents of ~/.mitmproxy/mitmproxy-ca-cert.pem>`;
+
+const PROXY_HOST = '192.168.1.123';  // your Mac IP
+const PROXY_PORT = 8080;
+```
+
+Insert the full PEM content (from `-----BEGIN CERTIFICATE-----` to `-----END CERTIFICATE-----`) between the backticks.
+
+Quick check that the right cert is in place:
+
+```bash
+# The issuer inside config.js should be mitmproxy, not SoundTouch
+grep -A3 "CERT_PEM" /tmp/config.js | head -5
+```
+
+---
+
+## 11. Start Interception
+
+Make sure mitmweb is running, then:
+
+```bash
+scripts/android/frida-venv/bin/frida \
+  -U \
+  -f com.bose.soundtouch \
+  -l scripts/android/frida/config.js \
+  -l scripts/android/frida/native-connect-hook.js \
+  -l scripts/android/frida/android/android-system-certificate-injection.js \
+  -l scripts/android/frida/android/android-proxy-override.js \
+  -l scripts/android/frida/android/android-certificate-unpinning.js \
+  -l scripts/android/frida/android/android-certificate-unpinning-fallback.js
+```
+
+> `native-connect-hook.js` is required — the Bose app uses native networking that bypasses Java proxy settings.
+
+Expected output in the Frida REPL:
+
+```
+== System certificate trust injected ==
+== Proxy system configuration overridden to 192.168.1.123:8080 ==
+== Proxy configuration overridden to 192.168.1.123:8080 ==
+== Certificate unpinning completed ==
+== Unpinning fallback auto-patcher installed ==
+```
+
+Open mitmweb at `http://127.0.0.1:8081` to observe traffic live.
+
+---
+
+## 12. Save & Replay Recordings
+
+Traffic is saved to `bose_traffic.mitm` (set via `-w` flag in step 5).
+
+```bash
+# Replay/analyse a saved recording:
+mitmweb -r bose_traffic.mitm
+```
+
+---
+
+## Cleanup
+
+```bash
+# Remove proxy setting from emulator
+adb -s emulator-5554 shell settings delete global http_proxy
+
+# Remove venv
+rm -rf /tmp/frida-venv /tmp/frida-server /tmp/frida-server.xz
+rm /tmp/config.js /tmp/android-*.js
+
+# Stop emulator
+adb -s emulator-5554 emu kill
+```
+
+---
+
+## Troubleshooting
+
+| Symptom                                 | Cause                                            | Fix                                                                            |
+|-----------------------------------------|--------------------------------------------------|--------------------------------------------------------------------------------|
+| `remount failed`                        | ARM64 emulator doesn't support overlayfs remount | Use `/data/misc/user/0/cacerts-added/` method instead                          |
+| `TLS: Trust anchor not found`           | Wrong certificate in config.js                   | Check issuer: must be mitmproxy, not SoundTouch                                |
+| `Chain validation failed`               | Private key included in cert                     | Re-extract with `openssl x509 -in mitmproxy-ca.pem -out mitmproxy-ca-cert.pem` |
+| `frida-server: connection refused`      | frida-server not running                         | Re-run `adb shell su 0 /data/local/tmp/frida-server &`                         |
+| frida and frida-server version mismatch | Versions must be identical                       | Pin both to same version (e.g. `17.9.1`)                                       |
+| `emulator: multiple AVDs` error         | Emulator already running                         | Kill first: `adb emu kill`, then restart with `-writable-system`               |
+
+---
+
+## App Automation Options
+
+For most traffic-recording purposes, manually operating the app while mitmproxy captures is sufficient. If you need to automate specific interactions (e.g. to repeatably capture the requests triggered by startup or a particular action), the following tools are available.
+
+### Starting the App
+
+```bash
+# Via app drawer: swipe up on the home screen and tap "Bose SoundTouch"
+
+# Via adb monkey (simplest)
+adb -s emulator-5554 shell monkey -p com.bose.soundtouch 1
+
+# Via explicit intent (if the activity name is known)
+adb -s emulator-5554 shell am start -n com.bose.soundtouch/.MainActivity
+
+# Look up all activities if the name is unknown
+adb -s emulator-5554 shell dumpsys package com.bose.soundtouch | grep Activity
+```
+
+### adb — sufficient for simple cases
+
+```bash
+# Tap at screen coordinates
+adb shell input tap 540 960
+
+# Swipe
+adb shell input swipe 540 1500 540 500
+
+# Type text
+adb shell input text "mytext"
+
+# Take a screenshot
+adb shell screencap /sdcard/screen.png && adb pull /sdcard/screen.png
+```
+
+### UIAutomator2 — inspect UI elements
+
+```bash
+# Dump the current UI hierarchy to find element IDs
+adb shell uiautomator dump /sdcard/ui.xml
+adb pull /sdcard/ui.xml
+```
+
+Open `ui.xml` to find element resource IDs, then target them precisely in scripts.
+
+### Appium — full scripted automation
+
+```python
+from appium import webdriver
+
+driver = webdriver.Remote('http://localhost:4723/wd/hub', {
+    'platformName': 'Android',
+    'appPackage': 'com.bose.soundtouch',
+    'appActivity': '.MainActivity',
+})
+
+# Find an element by resource ID and tap it
+driver.find_element('id', 'com.bose.soundtouch:id/play_button').click()
+```
+
+> **Note:** `monkey` is a stress-test tool that sends random events — use it only to launch the app, not to drive specific interactions.
@@ -0,0 +1,892 @@
+# Bose SoundTouch – Traffic Analysis Runbook
+
+> **Goal:** Set up a Raspberry Pi as a transparent access point to fully observe the traffic of the Bose SoundTouch app – specifically the pairing flow with the Bose Cloud. This serves as a basis for later reverse engineering / simulation of the cloud endpoints.
+
+---
+
+## Prerequisites
+
+| Component          | Details                                                          |
+|--------------------|------------------------------------------------------------------|
+| Raspberry Pi       | Pi 3 or newer, Raspberry Pi OS (Bullseye, Bookworm, Trixie)      |
+| Network interfaces | `eth0` → LAN cable to FritzBox, `wlan0` → own Access Point       |
+| FritzBox           | Unchanged, assigns an IP to the Pi via DHCP on eth0              |
+| Custom DNS Server  | Already present (or see Appendix A), incl. custom CA certificate |
+| Phone              | Android, connects to the Pi's Wi-Fi                              |
+
+### Network Architecture
+
+```
+Internet
+    ↓
+FritzBox  (existing, unchanged)
+    ↓  LAN cable (eth0)
+Raspberry Pi
+  ├── DNS Server       → selective logging / redirection
+  ├── hostapd          → custom Wi-Fi Access Point ("Bose-Lab")
+  ├── dnsmasq          → DHCP for clients, DNS to custom server
+  ├── iptables         → NAT, Forwarding eth0 ↔ wlan0
+  ├── tcpdump          → full traffic capture
+  └── (optional) mitmproxy → HTTPS decryption
+    ↓  Wi-Fi ("Bose-Lab")
+Android Phone
+  └── Bose SoundTouch App
+```
+
+---
+
+## Step 1 – Install Packages
+
+```bash
+sudo apt update && sudo apt install -y \
+  hostapd \          # Wi-Fi Access Point daemon
+  dnsmasq \          # DHCP + DNS forwarding
+  nftables \         # Modern NAT / firewall / forwarding
+  tcpdump \          # Packet capture at all levels
+  wireshark-common   # tshark CLI (optional, for live analysis)
+```
+
+---
+
+## Step 2 – Enable IP Forwarding
+
+The Pi must forward packets between `wlan0` (phone) and `eth0` (FritzBox).
+
+```bash
+# Active immediately (no reboot required)
+sudo sysctl -w net.ipv4.ip_forward=1
+
+# Permanent (survives reboots)
+# On modern Debian, using a dedicated file in sysctl.d/ is more reliable:
+echo "net.ipv4.ip_forward=1" | sudo tee /etc/sysctl.d/99-ip-forward.conf
+
+# Apply changes immediately
+sudo sysctl --system
+```
+
+**Verify:**
+```bash
+# After a reboot, ensure it is still '1'
+cat /proc/sys/net/ipv4/ip_forward
+```
+
+---
+
+## Step 3 – Static IP on wlan0 (systemd-networkd)
+
+On modern Debian (Bookworm/Trixie), `dhcpcd` is replaced by `systemd-networkd`.
+
+```bash
+# Create network configuration
+sudo tee /etc/systemd/network/08-wlan0.network << 'EOF'
+[Match]
+Name=wlan0
+
+[Network]
+Address=192.168.10.1/24
+IPForward=yes
+ConfigureWithoutCarrier=yes
+DHCP=no
+IPv6AcceptRA=no
+EOF
+
+# Restart service
+sudo systemctl enable systemd-networkd
+sudo systemctl restart systemd-networkd
+
+# Ensure wpa_supplicant and NetworkManager don't interfere
+sudo nmcli device set wlan0 managed no
+sudo systemctl stop wpa_supplicant@wlan0
+sudo systemctl mask wpa_supplicant@wlan0
+```
+
+**Verify:**
+```bash
+ip addr show wlan0
+# Expected: ONLY inet 192.168.10.1/24 (NO second DHCP IP)
+```
+
+---
+
+## Step 4 – hostapd (Access Point)
+
+```bash
+sudo tee /etc/hostapd/hostapd.conf << 'EOF'
+interface=wlan0
+driver=nl80211
+ssid=Bose-Lab
+hw_mode=b
+#hw_mode=g
+channel=1
+#channel=6
+wmm_enabled=0
+auth_algs=1
+wpa=2
+wpa_passphrase=secret123
+wpa_key_mgmt=WPA-PSK
+wpa_pairwise=CCMP
+EOF
+
+# The modern way is to just use hostapd.service which defaults to /etc/hostapd/hostapd.conf
+sudo systemctl unmask hostapd
+sudo systemctl enable --now hostapd
+```
+
+**Verify:**
+```bash
+sudo systemctl status hostapd
+# Expected: active (running)
+```
+
+---
+
+## Step 5 – dnsmasq (DHCP + DNS)
+
+dnsmasq gives the phone an IP and forwards DNS queries to the custom DNS server.
+
+```bash
+# Back up original config
+sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.bak
+
+sudo tee /etc/dnsmasq.conf << 'EOF'
+interface=wlan0
+dhcp-range=192.168.10.100,192.168.10.200,24h
+dhcp-option=3,192.168.10.1
+dhcp-option=6,192.168.10.1
+
+# DNS Upstream: custom server on localhost (adjust port if necessary)
+server=127.0.0.1#5353    # Example: custom server on port 5353
+# Alternatively: server=1.1.1.1 if DNS server runs directly on port 53
+
+# Log all DNS queries (for initial analysis)
+log-queries
+log-facility=/var/log/dnsmasq.log
+EOF
+
+sudo systemctl restart dnsmasq
+```
+
+**Observe DNS log live:**
+```bash
+sudo tail -f /var/log/dnsmasq.log
+```
+
+---
+
+## Step 6 – NAT and Forwarding (nftables)
+
+On modern Debian (Bookworm/Trixie), `nftables` is the default and recommended way to manage NAT and traffic forwarding.
+
+```bash
+# Define the NAT and Forwarding rules
+sudo tee /etc/nftables.conf << 'EOF'
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+    chain forward {
+        type filter hook forward priority 0; policy drop;
+
+        # Allow traffic from phone (wlan0) to internet (eth0)
+        iifname "wlan0" oifname "eth0" accept
+
+        # Allow established/related traffic back to the phone
+        iifname "eth0" oifname "wlan0" ct state established,related accept
+    }
+}
+
+table ip nat {
+    chain posterouting {
+        type nat hook postrouting priority 100; policy accept;
+
+        # MASQUERADE outgoing packets on eth0
+        oifname "eth0" masquerade
+    }
+}
+EOF
+
+# Enable and start nftables
+sudo systemctl enable nftables
+sudo systemctl restart nftables
+```
+
+**Verify:**
+```bash
+sudo nft list ruleset
+# Expected: ruleset showing the forward and nat chains
+```
+
+### WiFi "Bose-Lab" not visible?
+
+If you cannot see the `Bose-Lab` SSID on your phone:
+
+1.  **Check hostapd status:** `sudo systemctl status hostapd`. If it failed with "nl80211: Driver does not support configured mode", try changing `hw_mode=g` to `hw_mode=b`.
+2.  **Interface blocking:** Ensure `rfkill` hasn't blocked WiFi: `sudo rfkill unblock wlan`.
+3.  **Country Code:** Some systems require a country code in `hostapd.conf` to enable the radio. Add `country_code=DE` (or your country) to the top of `/etc/hostapd/hostapd.conf` and restart hostapd: `sudo systemctl restart hostapd`.
+4.  **Local Radio Check:** You can verify that the radio is actually configured as an AP: `iw dev wlan0 info`. Look for `type AP` and your SSID.
+    > **Note:** Do NOT rely on `iw dev wlan0 scan` for your own SSID; many WiFi drivers cannot "scan" and "broadcast" simultaneously.
+5.  **Debug Mode:** If the scan still returns nothing, stop the service and run hostapd in the foreground to see real-time errors:
+    ```bash
+    sudo systemctl stop hostapd
+    sudo hostapd -dd /etc/hostapd/hostapd.conf
+    ```
+    Look for messages like `nl80211: Failed to set interface wlan0 into AP mode`. This usually means the hardware is busy or doesn't support the current `hw_mode` / `channel` combination.
+6.  **Conflicting Services:** Ensure nothing else is managing `wlan0`. NetworkManager is common on modern Debian:
+    ```bash
+    sudo nmcli device set wlan0 managed no
+    ```
+7.  **Ghost IP Conflict:** If `ip addr show wlan0` shows both `192.168.10.1` and another IP (like `192.168.178.x`), `hostapd` will fail. This is usually caused by NetworkManager managing the interface. Ensure you've run:
+    ```bash
+    sudo nmcli device set wlan0 managed no
+    # If the ghost IP is still there, remove it manually:
+    sudo ip addr del 192.168.178.X/24 dev wlan0
+    ```
+
+---
+
+## Step 7 – Install Custom CA Certificate on the Phone
+
+Since a custom DNS server with a custom CA certificate is used, it must be trusted on the phone – otherwise, the app will block HTTPS connections to redirected domains.
+
+### Copy CA Certificate to the Pi (if not already there)
+
+If you haven't created a CA yet, follow **Appendix A** first.
+
+```bash
+# Certificate is located e.g. at /etc/my-dns-ca/ca.crt
+# Temporarily make reachable via HTTP for easy download:
+cd /etc/my-dns-ca/
+python3 -m http.server 8080
+# → Reachable at http://192.168.10.1:8080/ca.crt
+```
+
+### Install on Android
+
+1. Connect phone to `Bose-Lab`
+2. Open browser → `http://192.168.10.1:8080/ca.crt`
+3. Download certificate
+4. **Settings → Security → Credentials → Install CA Certificate**
+5. Select certificate and confirm
+
+> **Note:** Android distinguishes between system CAs and user CAs. User-installed CAs are accepted by many apps, but apps with certificate pinning (hardcoded certificate hashes) ignore them. Whether Bose uses pinning will be visible in the capture (Connection Reset after TLS ClientHello).
+
+### Android 14+ Special Case
+
+From Android 14 onwards, apps do not trust user CAs by default unless explicitly declared in the manifest. If the Bose app rejects the CA certificate:
+
+```bash
+# Option A: Root + Magisk module "MagiskTrustUserCerts"
+#   → moves user CAs to the system store
+
+# Option B: Root + manually copy to system CA directory
+adb push ca.crt /system/etc/security/cacerts/
+adb shell chmod 644 /system/etc/security/cacerts/ca.crt
+```
+
+---
+
+## Step 8 – Capture Traffic
+
+### All at once (recommended)
+
+```bash
+# Full capture of all protocols on wlan0
+# Filename with timestamp for multiple sessions
+sudo tcpdump -i wlan0 \
+  -w /tmp/bose-$(date +%Y%m%d-%H%M%S).pcap \
+  -s 0        # full packet length (no truncation)
+
+# End session: Ctrl+C
+```
+
+### Targeted by protocol
+
+```bash
+# DNS only (Port 53) – shows if app uses standard DNS
+sudo tcpdump -i wlan0 -n port 53
+
+# HTTPS only – TLS connections to Bose Cloud
+sudo tcpdump -i wlan0 -n 'tcp port 443'
+
+# mDNS (ZeroConf) – device discovery in LAN
+# Multicast group 224.0.0.1, Port 5353
+sudo tcpdump -i wlan0 -n 'udp port 5353'
+
+# SSDP/UPnP – alternative device discovery
+sudo tcpdump -i wlan0 -n 'udp port 1900'
+
+# Everything except DNS (reduces noise)
+sudo tcpdump -i wlan0 -n 'not port 53' -w /tmp/bose-nodns.pcap
+
+# Traffic of a specific host only (filter by phone IP)
+# Read phone IP from dnsmasq.leases beforehand (see below)
+sudo tcpdump -i wlan0 -n host 192.168.10.101
+```
+
+### Read SNI from TLS Traffic (without decryption)
+
+```bash
+# Extract domains from TLS ClientHello (SNI is unencrypted)
+sudo tcpdump -i wlan0 -n 'tcp port 443' -A 2>/dev/null \
+  | grep -oP '(?<=\x00)([a-zA-Z0-9.-]+\.(?:com|net|io|cloud|bose\.com))'
+```
+
+### Readable mDNS Announcements output
+
+```bash
+# tshark decodes mDNS directly
+sudo tshark -i wlan0 -f 'udp port 5353' -T fields \
+  -e dns.qry.name \
+  -e dns.resp.name \
+  -e dns.a
+```
+
+---
+
+## Step 9 – Analysis with Wireshark (on PC)
+
+Transfer `.pcap` files from the Pi to the PC:
+
+```bash
+# From the PC (scp)
+scp pi@192.168.10.1:/tmp/bose-*.pcap ~/Desktop/
+```
+
+**Important Wireshark Filters:**
+
+```
+# DNS only
+dns
+
+# HTTPS only
+tcp.port == 443
+
+# WebSocket connections (HTTP Upgrade)
+websocket
+
+# mDNS
+mdns
+
+# TLS Handshakes (SNI visible)
+tls.handshake.extensions_server_name
+
+# Traffic of a specific domain (resolve by IP)
+http.host contains "bose"
+
+# WebSocket frames
+websocket.payload
+```
+
+> **Tip:** Wireshark decodes WebSocket frames automatically if it sees the HTTP Upgrade handshake in the same capture. For the pairing flow: filtering for `tls.handshake.extensions_server_name` shows all domains the app contacts, even without decryption.
+
+---
+
+## Step 10 – mitmproxy (optional, for HTTPS content)
+
+Only useful if the CA certificate on the phone is trusted and no certificate pinning is active. `mitmproxy` acts as a Man-in-the-Middle by generating fake, on-the-fly certificates for any domain (e.g., `global.api.bose.io`) using your custom CA.
+
+### 1. Configure mitmproxy to use your Custom CA
+
+By default, `mitmproxy` creates its own CA in `~/.mitmproxy/`. To ensure the phone (which already trusts your `ca.crt`) accepts the traffic, you must tell `mitmproxy` to use your existing CA:
+
+```bash
+# mitmproxy expects the CA in a specific PEM format (cert + key in one file)
+sudo mkdir -p ~/.mitmproxy
+sudo cat /etc/my-dns-ca/ca.crt /etc/my-dns-ca/ca.key | sudo tee ~/.mitmproxy/mitmproxy-ca.pem > /dev/null
+```
+
+### 2. Install and Start mitmproxy
+
+```bash
+# Install mitmproxy binary (stable version for aarch64)
+cd /tmp
+wget https://downloads.mitmproxy.org/12.2.1/mitmproxy-12.2.1-linux-aarch64.tar.gz
+tar -xzf mitmproxy-12.2.1-linux-aarch64.tar.gz
+sudo mv mitmproxy mitmdump mitmweb /usr/local/bin/
+rm mitmproxy-12.2.1-linux-aarch64.tar.gz
+
+mitmproxy --version
+
+# Transparent proxy on port 8080
+# It will now use the CA from ~/.mitmproxy/mitmproxy-ca.pem
+mitmproxy --mode transparent --listen-port 8080
+
+# Alternatively: mitmdump for automatic logging to file
+# mitmdump --mode transparent --listen-port 8080 -w /tmp/bose-https.mitm
+```
+
+### 3. Troubleshooting: TLS Handshake Failures
+
+If you see `Client TLS handshake failed. The client does not trust the proxy's certificate for www.google.com` (or other domains) in the `mitmproxy` logs:
+
+1.  **HSTS and Pre-installed Pinning:** High-security sites like `www.google.com` use **HSTS (HTTP Strict Transport Security)** and have their certificates hardcoded (pinned) into browsers like Chrome and the Android system. **These will always fail with a User-installed CA.**
+2.  **User vs. System CA Store:** On Android 7.0+, apps **do not trust User-installed CAs by default**. They only trust the "System" store.
+    *   **The Bose app:** If it fails, it's because it only trusts the System store or uses its own certificate pinning.
+    *   **The Fix (Rooted Phone):** Use a Magisk module like `AlwaysTrustUserCerts` or manually move your `ca.crt` to `/system/etc/security/cacerts/` (see Step 7).
+3.  **The "Golden Rule" - Verify the Proxy is Working:**
+    To confirm your CA and `mitmproxy` are correctly configured, test with a non-HSTS site on the phone's browser (e.g., `http://neverssl.com`). Once redirected to HTTPS, **inspect the certificate**. It should say it was issued by your "Bose-Lab Root CA" (or "SoundTouch Root CA").
+
+    *   **If this works:** Your "factory" (mitmproxy + CA) is 100% correct. Any failure in the Bose app is due to its own security policy (ignore User Store or Pinning).
+    *   **If this fails:** Your CA is not trusted by the browser or `mitmproxy` is not using your PEM file.
+
+    Alternatively, use `curl` from a terminal emulator on the phone:
+    ```bash
+    # This should work if the CA is in the user store and curl is told to use it
+    curl -v --cacert /path/to/ca.crt https://example.com
+    ```
+4.  **Check mitmproxy CA:** Ensure `mitmproxy` is actually using your CA. When it starts, it should NOT generate a new CA in `~/.mitmproxy/mitmproxy-ca.pem` if you've already placed yours there.
+
+---
+
+**nftables rule: redirect HTTPS traffic to mitmproxy**
+
+```bash
+# Create a temporary file for the redirection rule
+sudo nft add table ip mitm
+sudo nft add chain ip mitm prerouting { type nat hook prerouting priority -100 \; }
+sudo nft add rule ip mitm prerouting iifname "wlan0" tcp dport 443 redirect to :8080
+```
+
+**Remove rule when no longer needed:**
+
+```bash
+sudo nft delete table ip mitm
+```
+
+> **Detecting Certificate Pinning:** If the app immediately disconnects after mitmproxy redirection (connection reset directly after TLS ClientHello), pinning is active. In this case, Frida + root is needed to patch the pinning.
+
+---
+
+## Step 11 – Bypassing Android Trust Restrictions
+
+If `neverssl.com` works in the browser but the Bose app shows `TLS handshake failed` in `mitmproxy`, the app is either ignoring the **User CA store** (common on Android 7+) or using **Certificate Pinning**.
+
+### Option A: Move CA to System Store (Requires Root/Magisk)
+
+This is the most reliable way to make apps trust your CA without modifying the app itself.
+
+1.  **Using Magisk (Recommended):**
+    Install the **"AlwaysTrustUserCerts"** or **"Move Certificates"** module in Magisk. It automatically mirrors all certificates from the User store to the System store on every boot.
+
+2.  **Manual Move (via ADB):**
+    Android system certificates are stored in `/system/etc/security/cacerts/` and must be named using the hash of the certificate.
+
+    ```bash
+    # 1. Get the hash of your certificate
+    hash=$(openssl x509 -inform PEM -subject_hash_old -in ca.crt | head -1)
+
+    # 2. Rename the certificate locally
+    cp ca.crt ${hash}.0
+
+    # 3. Push to the phone (requires remounting /system as read-write)
+    adb push ${hash}.0 /sdcard/
+    adb shell
+    su
+    mount -o rw,remount /
+    cp /sdcard/${hash}.0 /system/etc/security/cacerts/
+    chmod 644 /system/etc/security/cacerts/${hash}.0
+    chown root:root /system/etc/security/cacerts/${hash}.0
+    reboot
+    ```
+
+### Option B: Patching the App (No Root Required)
+
+If you cannot root your phone, you can modify the app's APK to trust user-installed certificates. This involves obtaining the APK, decompiling it, adding a network security configuration, and then repackaging and signing it.
+
+#### 0. How to get the .apk file?
+
+You have two main ways to get the official Bose SoundTouch APK:
+
+**Method 1: Extract from your phone (Safest)**
+If the app is already installed on your phone, you can pull it using `adb`:
+```bash
+# 1. Find the package name (usually com.bose.soundtouch)
+adb shell pm list packages | grep bose
+
+# 2. Get the full path to the APK on the phone
+adb shell pm path com.bose.soundtouch
+# Output: package:/data/app/~~...==/com.bose.soundtouch-.../base.apk
+
+# 3. Pull the file to your computer
+adb pull /data/app/~~...==/com.bose.soundtouch-.../base.apk Bose-SoundTouch.apk
+```
+
+**Method 2: Download from a Mirror (Easiest)**
+You can download the APK from reputable third-party sites.
+> **Warning:** Always verify the site's reputation.
+*   [APKMirror](https://www.apkmirror.com/apk/bose-corporation/bose-soundtouch/)
+*   [APKPure](https://apkpure.com/bose-soundtouch/com.bose.soundtouch)
+
+#### 1. Automated Method: apk-mitm (Recommended)
+The easiest way is to use `apk-mitm`, which automates the entire process including fixing common certificate pinning libraries.
+
+```bash
+# Requires Node.js installed on your PC
+npx apk-mitm Bose-SoundTouch.apk
+```
+This will produce a `Bose-SoundTouch-patched.apk` which you can install on your phone.
+
+#### 2. Manual Method: Network Security Config
+If you prefer to do it manually:
+
+1.  **Decompile the APK:**
+    ```bash
+    apktool d Bose-SoundTouch.apk
+    ```
+2.  **Create/Modify `res/xml/network_security_config.xml`:**
+    ```xml
+    <?xml version="1.0" encoding="utf-8"?>
+    <network-security-config>
+        <base-config>
+            <trust-anchors>
+                <certificates src="system" />
+                <certificates src="user" />
+            </trust-anchors>
+        </base-config>
+    </network-security-config>
+    ```
+3.  **Update `AndroidManifest.xml`:**
+    Ensure the `<application>` tag includes: `android:networkSecurityConfig="@xml/network_security_config"`.
+4.  **Repackage and Sign:**
+    ```bash
+    apktool b Bose-SoundTouch -o Bose-SoundTouch-patched.apk
+    # Sign with your own key
+    # 1. Generate a keystore (if you don't have one)
+    # Note: You can use ANY name/values here. The phone does not need to "know" or "trust" this key beforehand.
+    # It only needs the APK to be digitally signed so the Android installer accepts it.
+    keytool -genkey -v -keystore my-release-key.keystore -alias alias_name -keyalg RSA -keysize 2048 -validity 10000
+
+    # 2. Sign the APK
+    apksigner sign --ks my-release-key.keystore --out Bose-SoundTouch-patched-signed.apk Bose-SoundTouch-patched.apk
+
+    # Alternatively, use uber-apk-signer (recommended for simplicity)
+    # It handles zipalign and signing automatically.
+    java -jar uber-apk-signer.jar --apk Bose-SoundTouch-patched.apk
+    ```
+
+#### 3. Install the Patched APK
+
+Once you have your `Bose-SoundTouch-patched.apk` (and it is signed), you need to install it on your phone.
+
+**Important:** You must **uninstall the original Bose app first**. Android will not allow you to "update" the official app with your patched version because the digital signatures won't match.
+
+**Method 1: via ADB (Recommended)**
+```bash
+# 1. Uninstall the original app
+adb uninstall com.bose.soundtouch
+
+# 2. Install your patched version
+adb install Bose-SoundTouch-patched.apk
+```
+
+**Method 2: Manual Transfer**
+1.  Copy the `Bose-SoundTouch-patched.apk` to your phone's storage (via USB, Google Drive, or the Pi's HTTP server).
+2.  On the phone, use a File Manager to open the APK.
+3.  If prompted, allow "Install from Unknown Sources" for your File Manager.
+
+### Option C: Using the macOS Bose SoundTouch App (No Root/Patching Required)
+
+If you have a Mac, using the macOS version of the Bose SoundTouch app is often a good alternative. However, because the app is built on an **older version of Qt (5.7.0)**, it has specific trust and TLS compatibility issues that require extra steps.
+
+#### 1. Install the Custom CA in macOS Keychain
+
+1.  Open **Keychain Access** on your Mac.
+2.  Select the **System** keychain (or **login** if System is locked).
+3.  Drag and drop your `ca.crt` file into the list.
+4.  Double-click the newly added certificate (e.g., "Bose-Lab Root CA").
+5.  Expand the **Trust** section.
+6.  Set "When using this certificate" to **Always Trust**.
+7.  Close the window and authenticate with your Mac password.
+
+#### 2. Configure the Proxy
+
+You can either configure the macOS system proxy manually or use `mitmproxy`'s automatic interception.
+
+**Method 1: System Proxy (Manual)**
+1.  Go to **System Settings → Network → Wi-Fi → Details... → Proxies**.
+2.  Enable **HTTP Proxy** and **HTTPS Proxy**.
+3.  Set Server to your Pi's IP (`192.168.10.1`) and Port to `8080`.
+4.  Click **OK** and **Apply**.
+
+**Method 2: mitmproxy Local Redirect (Automatic)**
+If you are running `mitmproxy` directly on your Mac (instead of the Pi), you can use the modern "Local Redirect" mode which doesn't require proxy settings:
+```bash
+# Install mitmproxy via Homebrew
+brew install mitmproxy
+
+# Start mitmproxy in local redirect mode
+# This uses a macOS Network Extension to intercept traffic from specific apps
+mitmproxy --mode local
+```
+
+#### 3. Special Troubleshooting: Legacy Qt 5.7.0 SSL Failures
+
+If you see `SSL handshake failed` in the `mitmproxy` logs or the app's internal log (`log.txt`), the app's older networking stack is rejecting the connection. This is common because Qt 5.7.0 (2016) lacks support for **TLS 1.3** and many modern root certificates (like Let's Encrypt's **ISRG Root X1**).
+
+**The Solution: Launch with SSL Bypass Flags**
+
+Since the Bose macOS app is a hybrid of **Qt/Chromium** and **Node.js**, you must bypass the trust checks for both engines by launching the app from the terminal:
+
+```bash
+# 1. Bypass QtWebEngine/Chromium (Qt 5.7) trust
+export QTWEBENGINE_CHROMIUM_FLAGS="--ignore-certificate-errors"
+
+# 2. Bypass Node.js (SoundTouch Music Server) trust
+export NODE_TLS_REJECT_UNAUTHORIZED=0
+
+# 3. (Optional) Provide your custom CA directly to Node.js
+export NODE_EXTRA_CA_CERTS="/path/to/your/ca.crt"
+
+# 4. Launch the application
+"/Applications/SoundTouch/SoundTouch.app/Contents/MacOS/SoundTouch"
+```
+
+#### 4. Verify and Capture
+
+1.  Open Safari and visit `https://neverssl.com`. Verify the certificate is issued by your custom CA.
+2.  Launch the Bose app using the terminal command above.
+3.  Watch the traffic flow in `mitmproxy`.
+
+> **Note:** Even on macOS, **Certificate Pinning** is still possible if Bose implemented it specifically in the desktop app code. However, it is much less common on desktop apps than on mobile apps. If it works, you've saved yourself hours of Android patching!
+
+### Option D: Patching the App with Frida (Requires Root)
+
+If the app uses **Certificate Pinning** (hardcoded hashes), even moving the CA to the System store won't work. You must disable the pinning check in the app's code.
+
+1.  **Install Frida** on your PC and `frida-server` on the rooted phone.
+2.  **Use a universal bypass script:**
+    ```bash
+    frida -U -f com.bose.soundtouch -l https://codeshare.frida.re/@pcipolloni/universal-android-ssl-pinning-bypass-with-frida/ --no-pause
+    ```
+    *(Replace `com.bose.soundtouch` with the actual package name if different).*
+
+## Step 12 – Alternative: Regular HTTP Proxy Mode
+
+If the **Transparent AP** setup (Steps 1–6) is too complex or you are experiencing routing issues, you can use `mitmproxy` as a **Regular HTTP Proxy**.
+
+### 1. How it works
+In this mode, the Pi acts as a simple server on port 8080. You tell your phone's Wi-Fi settings to send all traffic to `192.168.10.1:8080`.
+
+*   **Pros:** No complex `nftables` or NAT rules required.
+*   **Cons:** Many Android apps (and background processes) ignore system-wide proxy settings. **HTTPS still requires a trusted CA for decryption.**
+
+### 2. Start mitmproxy in Regular Mode
+```bash
+# Stop transparent mode first if it's running
+# No special flags needed for regular mode
+mitmproxy --listen-port 8080
+```
+
+### 3. Configure the Phone
+1.  Go to **Settings → Wi-Fi → Bose-Lab**.
+2.  Select **Modify Network** (or the "i" icon).
+3.  Set **Proxy** to **Manual**.
+4.  **Proxy hostname:** `192.168.10.1`
+5.  **Proxy port:** `8080`
+6.  Save and try to browse a site.
+
+---
+
+## Step 13 – Extracting for soundtouch-service
+
+You can extract interactions (especially unencrypted WebSockets on port 8090) from a `.pcap` and format them for use in `soundtouch-service`.
+
+### 1. Extract Traffic using Go
+
+A helper script is provided in `scripts/extract-ws.go`. It automatically detects, unmasks, and decompresses (GZIP) WebSocket frames, and also extracts DNS, MDNS, and SSDP traffic.
+
+```bash
+# Install dependencies
+go get github.com/google/gopacket
+
+# Run extraction (outputs multiple files: .ws.http, .dns.txt, .mdns.txt, .ssdp.txt)
+# The results will be saved beside your .pcap file
+go run scripts/extract-ws.go your_capture.pcap [filter_ip]
+
+# Example: Filter for a specific speaker's IP in WebSocket messages
+go run scripts/extract-ws.go capture.pcap 192.168.100.1
+```
+
+### 2. Manual Extraction with tshark
+
+If you only need a quick look at the payloads:
+
+```bash
+# Extract all WebSocket text payloads
+tshark -r your_capture.pcap -Y "websocket.payload.text" -T fields -e websocket.payload.text
+```
+
+---
+
+## Step 14 – Extracting from Internal App Logs (macOS)
+
+If you are using the macOS app and cannot decrypt the cloud traffic due to pinning, you can still extract the JSON/XML messages from the app's internal communication log.
+
+A helper script is provided in `scripts/extract-log-interactions.go`. It parses the interleaved "Native" and "Network" calls to reconstruct the application's internal state and cloud requests.
+
+```bash
+# Run extraction from the log file
+# Outputs a chronological record of internal events and network URLs
+go run scripts/extract-log-interactions.go path/to/log.txt > extracted-interactions.http
+```
+
+**What this shows:**
+- **TO NETWORK:** The URLs the app is about to call (intercepted before encryption).
+- **FROM NATIVE:** Data being returned from the OS or Cloud to the UI.
+- **TO NATIVE:** Commands being sent from the UI to the underlying engines.
+
+This is a powerful "Plan B" when HTTPS decryption is blocked, as the app essentially logs its own decrypted data for you.
+
+---
+
+## Helper Commands / Troubleshooting
+
+After a Pi reboot, everything should come up automatically. If not:
+
+```bash
+# Restart and enable all core services
+sudo systemctl restart systemd-networkd
+sudo systemctl enable --now hostapd
+sudo systemctl enable --now dnsmasq
+sudo systemctl restart nftables
+
+# Verify the unmanaged state of wlan0 (nmcli)
+sudo nmcli device set wlan0 managed no
+```
+
+---
+
+## What to Expect
+
+| Protocol             | Port       | Tool                     | Visibility                                     |
+|----------------------|------------|--------------------------|------------------------------------------------|
+| DNS (Standard)       | UDP 53     | tcpdump, dnsmasq log     | Full, plaintext                                |
+| HTTPS / REST         | TCP 443    | tcpdump (SNI), mitmproxy | SNI without decryption, content with mitmproxy |
+| WebSockets           | TCP 443/80 | Wireshark                | Frames decoded if TLS is broken                |
+| mDNS / ZeroConf      | UDP 5353   | tcpdump, tshark          | Full, plaintext                                |
+| SSDP / UPnP          | UDP 1900   | tcpdump                  | Full, plaintext                                |
+| SoundTouch local API | TCP 8090   | tcpdump                  | Full, plaintext (no TLS)                       |
+
+> **Expectation for Bose SoundTouch:** The app likely uses standard DNS (older app generation), REST/HTTPS for the pairing flow with the cloud, WebSockets for push events from the device, and mDNS for local device discovery. The local device API on port 8090 is HTTP without TLS – this traffic is always readable.
+
+---
+
+## Next Steps After Analysis
+
+1. Extract domains from DNS log and SNI → List of all Bose endpoints
+2. HTTP methods and paths from mitmproxy log → Reconstruct API structure
+3. Document auth flow (OAuth2? Proprietary? Token format?)
+4. Build a minimal mock server simulating the critical endpoints
+5. Testing: App against mock server → does pairing work offline?
+
+---
+
+## Appendix A – Generating a Custom CA Certificate
+
+If you don't have a custom DNS server with a CA yet, you can create one directly on the Pi. Alternatively, if you are already using the `soundtouch-service` from this repository, you can reuse its CA certificate located in the `data/certs/` directory.
+
+### 0. (Optional) Copy an Existing CA from another host
+
+If you are already using the `soundtouch-service` on another machine (e.g., your notebook), you can copy the existing CA to the Pi instead of generating a new one:
+
+```bash
+# On your Pi:
+sudo mkdir -p /etc/my-dns-ca
+sudo chown $USER:$USER /etc/my-dns-ca
+
+# Run this on your notebook (replace hostnames and paths):
+# Note: This is easiest if your SSH key is added to the Pi and soundtouch-service host.
+# If you run into permission issues with sudo, ensure the source user has passwordless sudo for 'cat'.
+
+# Step A: Download from source to your notebook
+ssh soundtouch-service "sudo cat /var/lib/soundtouch-service/certs/ca.crt" > ca.crt
+ssh soundtouch-service "sudo cat /var/lib/soundtouch-service/certs/ca.key" > ca.key
+
+# Step B: Upload from notebook to the Pi
+scp ca.crt ca.key soundtouch-access-point:/tmp/
+ssh soundtouch-access-point "sudo mv /tmp/ca.crt /tmp/ca.key /etc/my-dns-ca/ && sudo chown root:root /etc/my-dns-ca/ca.*"
+rm ca.crt ca.key
+```
+
+### 1. Create CA Key and Certificate
+
+```bash
+sudo mkdir -p /etc/my-dns-ca
+cd /etc/my-dns-ca
+
+# Generate CA private key
+sudo openssl genrsa -out ca.key 4096
+
+# Generate Root CA certificate
+# Note: we explicitly add basicConstraints=CA:TRUE for modern TLS clients
+sudo openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
+  -out ca.crt \
+  -subj "/C=DE/O=Bose-Lab/CN=Bose-Lab Root CA" \
+  -addext "basicConstraints=critical,CA:TRUE" \
+  -addext "keyUsage=critical,keyCertSign,cRLSign"
+```
+
+### 2. Generate a Certificate for Interception (Example)
+
+To intercept `global.api.bose.io`, you need a certificate for it, signed by your CA:
+
+```bash
+# Generate server key
+sudo openssl genrsa -out bose.key 2048
+
+# Create CSR (Certificate Signing Request) configuration
+sudo tee bose.ext << 'EOF'
+authorityKeyIdentifier=keyid,issuer
+basicConstraints=CA:FALSE
+keyUsage = digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
+subjectAltName = @alt_names
+
+[alt_names]
+DNS.1 = global.api.bose.io
+DNS.2 = *.bose.io
+EOF
+
+# Generate CSR
+sudo openssl req -new -key bose.key -out bose.csr \
+  -subj "/C=DE/O=Bose-Lab/CN=global.api.bose.io"
+
+# Sign the certificate with your CA
+sudo openssl x509 -req -in bose.csr -CA ca.crt -CAkey ca.key \
+  -CAcreateserial -out bose.crt -days 365 -sha256 -extfile bose.ext
+```
+
+### 3. Usage in your DNS/HTTPS Server
+
+Your custom server (e.g., a small Go or Python script) would then use `bose.crt` and `bose.key` to serve HTTPS traffic for those domains.
+
+## Appendix B – Helpful Commands
+
+```bash
+# Which IPs did the phone receive?
+cat /var/lib/misc/dnsmasq.leases
+
+# Is the access point active?
+sudo systemctl status hostapd
+
+# Is dnsmasq active?
+sudo systemctl status dnsmasq
+
+# Check interfaces and IPs
+ip addr show
+
+# Check routing table
+ip route show
+
+# Show active nftables rules
+sudo nft list ruleset
+
+# All running tcpdump processes
+pgrep -a tcpdump
+
+# Test the Pi's own DNS resolution
+dig @127.0.0.1 -p 5353 global.api.bose.io
+
+# Check network connectivity from the phone (from the Pi)
+ping 192.168.10.101   # Phone IP from dnsmasq.leases
+```
@@ -2,6 +2,8 @@

 To enable offline operation or use custom services like **SoundCork** or **ÜberBöse API**, SoundTouch devices must be redirected from Bose's official cloud endpoints to a local or custom server. This document outlines the three known methods to achieve this, gathered from community reverse-engineering efforts in the **SoundCork** and **ÜberBöse API** projects.

+> A fourth, **SSH-free** path — driving the device's diagnostic shell on TCP port 17000 — is being added as a peer to the XML and DNS methods. See **[TELNET-MIGRATION-METHOD.md](TELNET-MIGRATION-METHOD.md)** for the use cases, community findings, and feasibility analysis. The `/etc/hosts` method documented below is now deprecated and will not be exposed in the web UI.
+
 ## Overview of Redirection Targets

 SoundTouch devices primarily communicate with the following domains:
@@ -32,19 +34,25 @@ The most robust and granular method involves modifying the device's private conf
 Requires SSH access to the device.
 ```xml
 <SoundTouchSdkPrivateCfg>
-  <margeServerUrl>http://192.168.1.10:8000/marge</margeServerUrl>
+  <margeServerUrl>http://192.168.1.10:8000</margeServerUrl>
  <statsServerUrl>http://192.168.1.10:8000</statsServerUrl>
  <swUpdateUrl>http://192.168.1.10:8000/updates/soundtouch</swUpdateUrl>
  <bmxRegistryUrl>http://192.168.1.10:8000/bmx/registry/v1/services</bmxRegistryUrl>
 </SoundTouchSdkPrivateCfg>
 ```

+> **Note on `margeServerUrl`** — `soundtouch-service` mounts the marge endpoints
+> at the **root** of port 8000, so the URL has no `/marge` suffix.
+> [`deborahgu/soundcork`](https://github.com/deborahgu/soundcork) routes marge
+> under a `/marge` sub-path, so users redirecting to soundcork must append it
+> (`http://192.168.1.10:8000/marge`).
+
 ### Pros & Cons
-| Pros | Cons |
-| :--- | :--- |
-| **Granular Control**: Redirect specific services while leaving others (e.g., updates) intact. | **Requires SSH**: Must have root/SSH access to the device. |
-| **Persistent**: Survives software updates (usually). | **Syntax Sensitive**: Errors in XML can cause boot issues or service failures. |
-| **Native**: Uses the device's built-in configuration mechanism. | |
+| Pros                                                                                          | Cons                                                                           |
+|:----------------------------------------------------------------------------------------------|:-------------------------------------------------------------------------------|
+| **Granular Control**: Redirect specific services while leaving others (e.g., updates) intact. | **Requires SSH**: Must have root/SSH access to the device.                     |
+| **Persistent**: Survives software updates (usually).                                          | **Syntax Sensitive**: Errors in XML can cause boot issues or service failures. |
+| **Native**: Uses the device's built-in configuration mechanism.                               |                                                                                |

 ---

@@ -66,11 +74,11 @@ Requires SSH access. Add entries for the target domains:
 ```

 ### Pros & Cons
-| Pros | Cons |
-| :--- | :--- |
-| **Simple**: Easy to understand and implement. | **Requires SSH**: Must have root access. |
+| Pros                                                                                  | Cons                                                                                                                                                                |
+|:--------------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| **Simple**: Easy to understand and implement.                                         | **Requires SSH**: Must have root access.                                                                                                                            |
 | **Universal**: Affects all processes on the device attempting to reach those domains. | **HTTPS Issues**: Redirecting HTTPS domains to a local IP will cause SSL certificate errors unless the device is patched to skip verification or trust a custom CA. |
-| | **Brittle**: Some firmware versions may overwrite `/etc/hosts` on reboot. |
+|                                                                                       | **Brittle**: Some firmware versions may overwrite `/etc/hosts` on reboot.                                                                                           |

 ---

@@ -104,12 +112,12 @@ sed "s#\^https:....bose.\+apigee..net..#http[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 4. Restore execution permissions and reboot.

 ### Pros & Cons
-| Pros | Cons |
-| :--- | :--- |
-| **Bypass Config**: Works even if the firmware ignores XML settings. | **High Risk**: Modifying binaries can lead to permanent bricks or boot loops. |
+| Pros                                                                                | Cons                                                                                  |
+|:------------------------------------------------------------------------------------|:--------------------------------------------------------------------------------------|
+| **Bypass Config**: Works even if the firmware ignores XML settings.                 | **High Risk**: Modifying binaries can lead to permanent bricks or boot loops.         |
 | **Hardcoded Redirects**: Can catch URLs that aren't exposed in configuration files. | **Length Constraint**: Custom URLs must fit within the space of the original strings. |
-| | **Firmware Specific**: Patches must be reapplied after every software update. |
-| | **Complexity**: Requires understanding of binary structures and potential checksums. |
+|                                                                                     | **Firmware Specific**: Patches must be reapplied after every software update.         |
+|                                                                                     | **Complexity**: Requires understanding of binary structures and potential checksums.  |

 ---

@@ -117,11 +125,11 @@ sed "s#\^https:....bose.\+apigee..net..#http[aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

 ### Summary Table

-| Method | Primary Use Case | Ease | Safety | Persistence | Granularity |
-| :--- | :--- | :---: | :---: | :---: | :---: |
-| **XML Config** | Logical service redirection | ⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐ | ⭐⭐⭐⭐⭐ |
-| **`/etc/hosts`** | Quick global DNS override | ⭐⭐⭐⭐⭐ | ⭐⭐⭐ | ⭐⭐ | ⭐⭐ |
-| **Binary Patch** | Bypassing hardcoded checks | ⭐ | ⭐ | ⭐ | ⭐⭐⭐ |
+| Method           | Primary Use Case            | Ease  | Safety | Persistence | Granularity |
+|:-----------------|:----------------------------|:-----:|:------:|:-----------:|:-----------:|
+| **XML Config**   | Logical service redirection | ⭐⭐⭐⭐  |  ⭐⭐⭐⭐  |    ⭐⭐⭐⭐     |    ⭐⭐⭐⭐⭐    |
+| **`/etc/hosts`** | Quick global DNS override   | ⭐⭐⭐⭐⭐ |  ⭐⭐⭐   |     ⭐⭐      |     ⭐⭐      |
+| **Binary Patch** | Bypassing hardcoded checks  |   ⭐   |   ⭐    |      ⭐      |     ⭐⭐⭐     |

 ---

@@ -176,9 +184,10 @@ As suggested by community members, you can configure the device to trust your ow
    - **Method B (Symlinks)**: Add the certificate to `/etc/ssl/certs/` and create a hash symlink using `c_rehash` (if available) or manual mapping.

 **Pros & Cons**:
-| Pros | Cons |
-| :--- | :--- |
-| **Secure**: Maintains end-to-end encryption. | **Requires SSH**: Must have root access to modify the trust store. |
+
+| Pros                                                   | Cons                                                                   |
+|:-------------------------------------------------------|:-----------------------------------------------------------------------|
+| **Secure**: Maintains end-to-end encryption.           | **Requires SSH**: Must have root access to modify the trust store.     |
 | **Clean**: No binary patching required for SSL bypass. | **Update Risk**: Firmware updates might overwrite the `ca-bundle.crt`. |

 ### Option 2: SSL Verification Bypass
@@ -0,0 +1,136 @@
+# What a SoundTouch speaker does during factory reset
+
+Observed live on ST10 firmware `27.0.6.46330.5043500` (build `epdbuild.trunk.hepdswbld04.2022-08-04`) on 2026-05-12, by running `soundtouch-cli setup factory-reset` and tailing the speaker's `logread` over SSH. The trace is preserved at `_/logs/factory-reset.txt` for reference.
+
+## Sequence
+
+1. **Telnet receives `sys factorydefault`.** The diagnostic shell on port 17000 accepts the command and acknowledges. Some firmwares close the socket as part of the reboot — our CLI's `setup factory-reset` tolerates that as success.
+
+2. **Speaker DELETEs itself from its marge account.** Before wiping anything, the firmware does:
+   ```
+   [MargeStateAssociated] HandleRemoveDeviceRequest - Removing this device from the user's Marge account
+   [MargeClient]          RemoveDevice calling Marge Server with https://streaming.bose.com/streaming/account/{accountId}/device/{deviceId}
+   [MargeClient]          RemoveDeviceCB - Device removed from the user's Marge account
+   [MargeStateAssociated] HandleRemoveDeviceRequestSuccessCB, Marge returned: {"ok": true}
+   ```
+   AfterTouch already handles this — `HandleMargeRemoveDevice` (`pkg/service/handlers/handlers_marge.go:633`) routed via `r.Delete("/device/{device}", …)` in `cmd/soundtouch-service/main.go:955`. The handler calls `marge.RemoveDeviceFromAccount(s.ds, account, device)` and prunes the device from the datastore.
+
+3. **Speaker notifies its LAN peers.** Two HTTP POSTs to each known peer at `:8090/notification`:
+   ```
+   [NotificationSender] SendNotifyLisas_: URL: >>http://192.168.123.122:8090/notification<<, m_msgdata.size(58)
+   [SimpleURLFetcher]   multipart/form-data text/xml
+   ```
+   ~58 bytes of `multipart/form-data` carrying `text/xml`. "Lisas" is the firmware's internal term for LAN peers (devices on the same account on the same network segment). AfterTouch is **not** on this path — it's pure peer-to-peer over the LAN. Peers presumably refresh their account info as a result.
+
+4. **Local state teardown.** Bluetooth pairings cleared (`BTRemoteDeviceAccess::ClearPrevPairedList`), zone/group state torn down, all source proxies disconnected (`STSAccountProxy::Disconnect Requested` × many).
+
+5. **Persistence cleanup.** Logs, core dumps wiped (`FactoryDefault: Clearing the CoreDump and BoseLogs … rm -rf /mnt/nv/BoseLog/*`). Notably **NOT wiped**: `/mnt/nv/aftertouch.resolv.conf`, `/mnt/nv/rc.local`'s Aftertouch hook, and `/mnt/nv/BoseApp-Persistence/1/SystemConfigurationDB.xml`. The reset only touches log directories and account-specific persistence under the same `/mnt/nv/BoseApp-Persistence/1/` tree.
+
+6. **Reboot into setup mode.** Speaker drops Wi-Fi, comes back as its own AP `Bose SoundTouch XXXX` on 192.0.2.1.
+
+## Implications for migration ordering
+
+The DELETE in step 2 only reaches AfterTouch if the speaker's `margeURL` already points at AfterTouch *at the moment of reset*. A speaker still pointing at `streaming.bose.com` sends it into the void → AfterTouch keeps a stale `account/{id}/device/{id}` entry until someone manually prunes it.
+
+Therefore for a clean datastore lifecycle on an already-Bose-paired speaker:
+
+1. Migrate URLs first (`setup migrate --method=resolv` or `--method=telnet`).
+2. Reboot to apply.
+3. Factory reset.
+4. Re-provision.
+
+`soundtouch-cli setup plan --reset` currently runs factory-reset first (optimal for already-on-AfterTouch speakers); both `setup plan --reset` and `setup factory-reset` print a one-line note explaining the ordering tradeoff so users can pick the right sequence for their starting state.
+
+## Implications for AfterTouch behaviour
+
+- The DELETE handler is already correct; no changes needed.
+- AfterTouch is invisible to the LAN-peer notification step — that's just LAN HTTP between speakers.
+- If you build a "consolidate account" / "migrate fleet" feature later, the peer-notification channel is the propagation path the firmware uses internally; AfterTouch doesn't need to do anything analogous.
+- The persistence layer at `/mnt/nv/` is **factory-reset-resistant**. Our DNS-redirect migration (`setup migrate --method=resolv`) writes there specifically so AfterTouch routing survives a reset. This is intentional — the user can factory-reset a speaker freely without re-running migration.
+
+## Open questions
+
+- Are there other peer endpoints the firmware POSTs to besides `:8090/notification`? Worth checking on a 3-speaker LAN.
+- Does the `:8090/notification` payload format match the format used for play-as-notification audio pushes, or is it a distinct message shape? The "size(58)" byte count is too small for an audio URL but big enough for an XML envelope with an event type.
+
+If you want either of these answered, capture two synchronised `logread -f` streams from two LAN speakers while one is being reset.
+
+## Runbook — reset & re-provision an ST10 on AfterTouch
+
+End-to-end command sequence used during the 2026-05-12 bare-pairing experiment, recorded verbatim from the test session. Replace IPs, SSID, password, service URL, and account ID with your own. Two manual Wi-Fi switches happen between `factory-reset` and `wifi-push` (host joins the speaker's AP) and again between `wifi-push` and `wait-online` (host re-joins home Wi-Fi).
+
+```bash
+# === 1. Reconnaissance — confirm what state the speaker is in before touching it. ===
+
+# Identity, network, sources, presets.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup inspect
+
+# Green/red status across every migration axis (SSH, telnet, CA, pairing, …).
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup verify \
+  --service-url=https://soundtouch.fritz.box
+
+# What `setup plan --reset` would recommend, so you can preview the sequence.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup plan \
+  --service-url=https://soundtouch.fritz.box --reset
+
+
+# === 2. Reset and Wi-Fi re-provisioning. ===
+
+# Tell the speaker to wipe itself. Speaker drops Wi-Fi and reboots into AP mode.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup factory-reset
+
+# Manual: switch this host to the speaker's setup AP.
+#   macOS: networksetup -setairportnetwork en0 "Bose SoundTouch XXXX"
+
+# Poll 192.0.2.1:8090/info until the speaker answers (interval=2s, timeout=5m).
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup wait-ap
+
+# Push home Wi-Fi credentials. NOTE the single-quoted password: zsh expands `!`
+# inside double quotes as history-expansion and will refuse the command.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup wifi-push \
+  --ssid="wifi-name" --pass='a.secure!password'
+
+# Manual: switch host back to home Wi-Fi.
+#   macOS: networksetup -setairportnetwork en0 "wifi-name" 'a.secure!password'
+
+# mDNS-poll for the speaker on the home network, matched by deviceID suffix
+# (which survives the reset since it's the MAC). Returns the new IP.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup wait-online --match=536A98
+
+
+# === 3. Clock, migrate, pair. From here on use the new IP wait-online reported. ===
+
+# Set the speaker's wall-clock. `clock set --time=now` fails on FW 27;
+# `clock now` is the working subcommand.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 clock now
+
+# Reboot to clear any half-initialized resolver / NTP state from the wifi-push flap.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup reboot
+
+# Apply DNS-redirect migration: routes *.bose.com to AfterTouch and installs its CA.
+# Idempotent; safe to re-run.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup migrate \
+  --service-url=https://soundtouch.fritz.box --method=resolv
+
+# Reboot again so the envswitch parallel-persistence layer and the resolv hook
+# both take effect on the next boot.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup reboot
+
+# Pair the device with an AfterTouch account — bare experiment variant.
+# Drop --mode=bare and add --name=… / --language=… for the full state-machine variant.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup pair \
+  --mode=bare --account=1111111 --service-url='https://soundtouch.fritz.box'
+
+
+# === 4. Verify. ===
+
+# Reboot to verify persistence survives.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup reboot
+
+# Snapshot the result. margeAccountUUID should still equal --account, and Sources
+# should list ~14 entries (TUNEIN, RADIO_BROWSER, LOCAL_INTERNET_RADIO,
+# SPOTIFY slots, AIRPLAY, etc.) materialized by the firmware.
+go run ./cmd/soundtouch-cli --host 192.168.123.123 setup inspect
+```
+
+Total wall-clock for the above on this hardware: roughly 5 minutes including the two manual Wi-Fi switches and three reboots.
@@ -0,0 +1,43 @@
+# Spotify Account Addition Implementation Status
+
+To fully replace Bose cloud services for the Spotify account addition flow in the "Stockholm" SoundTouch application, the following routes have been implemented in the `soundtouch-service`:
+
+## 1. OAuth Token Exchange (Bose Cloud)
+
+The Stockholm background worker (in `worker_common.js` and `spotify_worker.js`) performs a token exchange using an authorization code.
+
+*   **Route**: `POST /oauth/account/{account}/music/musicprovider/{sourceID}/token/cs`
+*   **Purpose**: To exchange the Spotify authorization code for a Bose-mediated token.
+*   **Implementation**: `HandleBoseAccountToken` in `pkg/service/handlers/handlers_oauth.go`.
+*   **Registration**: Registered in `cmd/soundtouch-service/main.go` under the `/oauth` route group.
+
+## 2. Cloud Source Registration (Marge Service)
+
+The SoundTouch application registers a new music source (e.g., Spotify) with the Bose cloud profile.
+
+*   **Route**: `POST /streaming/account/{account}/source`
+*   **Purpose**: To add the new source (username, credentials, display name) to the user's emulated cloud profile.
+*   **Implementation**: `HandleMargeAddSource` in `pkg/service/handlers/handlers_marge.go`.
+*   **Registration**: Registered in `cmd/soundtouch-service/main.go` under the `/streaming` route group.
+*   **Payload Format**: XML `application/vnd.bose.streaming-v1.1+xml` containing `<source>` with `<username>`, `<sourceproviderid>`, and `<credential type="token_version_3">`.
+
+## 3. Redirect Handling (Browser to App)
+
+The `soundtouch://` deep link redirect URI is handled by the management interface which provides the OAuth callback.
+
+*   **Callback Route**: `GET /mgmt/spotify/callback`
+*   **Implementation**: `HandleMgmtSpotifyCallback` in `pkg/service/handlers/handlers_mgmt.go`.
+*   **Confirmation Route**: `POST /mgmt/spotify/confirm` (used by mobile apps for deep-link codes).
+*   **Implementation**: `HandleMgmtSpotifyConfirm` in `pkg/service/handlers/handlers_mgmt.go`.
+
+## Implementation Details
+
+1.  **Marge Add Source**:
+    *   `HandleMargeAddSource` in `pkg/service/handlers/handlers_marge.go` parses the incoming XML and persists the new source to the `DataStore` for the corresponding account.
+
+2.  **OAuth Account Token Exchange**:
+    *   `HandleBoseAccountToken` in `pkg/service/handlers/handlers_oauth.go` supports the `/oauth/account/.../token/cs` path.
+    *   It responds with a JSON payload including `access_token` and `token_type` "Bearer" after exchanging the code via `ExchangeCodeAndStore`.
+
+3.  **Router Registration**:
+    *   These paths are registered in `cmd/soundtouch-service/main.go` within the `/streaming`, `/oauth`, and `/mgmt` route blocks.
@@ -0,0 +1,215 @@
+# Experiment: Does bare `setMargeAccount` work outside the SETUP bracket?
+
+## Why we are doing this
+
+Our captured pairing flow (`docs/reference/DEVICE-PAIRING-FLOW.md`) shows the official Bose app always sends `setMargeAccount` *inside* a `SETUP_START` → `SETUP_ENTER` → `SETUP_LEAVE` state-machine bracket over WebSocket. The question this experiment answers:
+
+> If we open a WebSocket to a factory-reset speaker and send **only** `setMargeAccount` — no surrounding setupState messages — does the device honor it and write its persistence files (`SystemConfigurationDB.xml`, `Sources.xml`) cleanly?
+
+The answer determines the shape of `PairAccount`:
+
+- **If YES:** `PairAccount` becomes uniform: WebSocket-first, HTTP `/setMargeAccount` second, telnet `envswitch accountid set` third. One function, one ordering, all callers.
+- **If NO:** WebSocket pairing is only meaningful inside the full state machine. Factory-reset path uses the state machine; re-pair path keeps today's HTTP→telnet ordering.
+
+## Preconditions
+
+- A SoundTouch speaker that has been **factory-reset** and joined to the test Wi-Fi.
+- Speaker reachable on `:8090` (HTTP API) and `:8080` (WebSocket).
+- Speaker's runtime marge URL already points at AfterTouch (run the existing telnet URL rewrite first — otherwise the device's downstream POST will land on the dead Bose cloud and we will not be able to distinguish "WS message refused" from "downstream cloud failed").
+- A free 7-digit account ID — for example, generated via `setup.GenerateAccountID(nil)`.
+
+## Step 0 — Baseline
+
+```bash
+DEVICE=192.168.x.x
+curl -s http://$DEVICE:8090/info     | xmllint --format -
+curl -s http://$DEVICE:8090/sources  | xmllint --format -
+curl -s http://$DEVICE:8090/presets  | xmllint --format -
+```
+
+Record:
+
+- `<margeAccountUUID>` — expect empty on a factory-reset device.
+- `<margeURL>` — expect the AfterTouch URL (preflight already applied).
+- `<sources>` — expect a minimal list.
+- `<presets>` — expect `<presets/>`.
+
+## Step 1 — Send bare `setMargeAccount` over WebSocket
+
+Build the CLI once:
+
+```bash
+make build
+```
+
+Then run the bare path against the speaker:
+
+```bash
+DEVICE=192.168.x.x
+./build/soundtouch-cli setup pair --host=$DEVICE --account=1234567 --mode=bare
+```
+
+What it does:
+
+1. Reads `/info` to discover `deviceID`, logs the pre-state.
+2. Opens a WebSocket to `$DEVICE:8080` with the `gabbo` subprotocol.
+3. Sends exactly one frame — the `setMargeAccount` envelope — **without** any preceding `SETUP_START`/`SETUP_ENTER`.
+4. Reads frames for up to `--step-timeout=8s` (configurable), looking for an ack referencing our `requestID`.
+5. Closes the WebSocket, waits 2 s, re-reads `/info`, prints whether `margeAccountUUID` now equals our supplied ID.
+
+The exact frame sent (built by `setup.SetupSession.SetMargeAccount`):
+
+```xml
+<msg><header deviceID="DEVICE_ID" url="setMargeAccount" method="POST"><request requestID="1"/></header><body>
+  <PairDeviceWithAccount>
+    <accountId>1234567</accountId>
+    <userAuthToken>Bearer aftertouch</userAuthToken>
+  </PairDeviceWithAccount>
+</body></msg>
+```
+
+Outcomes the CLI will surface:
+
+- `Device accepted bare pairing.` (post-`/info` shows our ID) → **bare path works**.
+- `setMargeAccount: device rejected setMargeAccount: …` → device returned an `<error>` body → **bare path refused explicitly**.
+- `setMargeAccount: await ack for setMargeAccount: …` (timeout or EOF) → **bare path refused silently**.
+- `Device did NOT persist the pairing — bare path likely refused silently.` → ack received but persistence didn't follow.
+
+## Step 2 — Record outcome
+
+After step 1 (regardless of which branch happened):
+
+```bash
+sleep 2
+curl -s http://$DEVICE:8090/info | grep margeAccountUUID
+```
+
+| Observed result                                                              | Verdict                     |
+|------------------------------------------------------------------------------|-----------------------------|
+| `<margeAccountUUID>1234567</margeAccountUUID>` appears                       | **YES** — Option 1 wins     |
+| `<margeAccountUUID></margeAccountUUID>` still empty, no error frame received | Refused silently → **NO**   |
+| Error frame returned (e.g. `<error name="UNSUPPORTED_STATE"/>`)              | Refused explicitly → **NO** |
+| Device drops the WebSocket connection without replying                       | Refused → **NO**            |
+
+If verdict is YES, also verify the device wrote persistence cleanly. Reboot the device, then:
+
+```bash
+ssh root@$DEVICE 'cat /mnt/nv/BoseApp-Persistence/1/SystemConfigurationDB.xml'
+ssh root@$DEVICE 'cat /mnt/nv/BoseApp-Persistence/1/Sources.xml'
+curl -s http://$DEVICE:8090/info | grep margeAccountUUID
+```
+
+The UUID must still be present after reboot, and `SystemConfigurationDB.xml` must contain `<AccountUUID>1234567</AccountUUID>`. If it survives reboot, **YES** is confirmed.
+
+## Step 3 — Control: full state machine
+
+Factory-reset the same speaker again and run the full state machine — the same CLI, `--mode=full`:
+
+```bash
+./build/soundtouch-cli setup pair --host=$DEVICE --account=1234567 --mode=full
+```
+
+This drives `setup.Manager.ExecuteInitPlan` with `SkipURLRewrite=true`, which runs:
+
+```
+SETUP_START
+SETUP_IDENTIFY_DEVICE_ENTER
+language sysLanguage=2
+SETUP_ENTER
+SETUP_IDENTIFY_DEVICE_LEAVE
+setMargeAccount …
+SETUP_LEAVE
+pushCustomerSupportInfoToMarge
+```
+
+The CLI logs every step with status. Confirm `/info`, persistence, and reboot-survival checks pass. If the bare path failed but the full path succeeds, the SETUP bracket is load-bearing — a follow-up bisect (e.g. `SETUP_START + setMargeAccount + SETUP_LEAVE` only) tells us *which* surrounding messages the firmware actually requires.
+
+## Full reset-and-rebuild loop
+
+Once the bare/full question is decided, the loop for repeated experiments is:
+
+```bash
+# 0. Speaker is currently on home Wi-Fi at $DEVICE.
+#    Capture deviceID-suffix + current SSID first so wait-online and
+#    wifi-push have the right inputs.
+./build/soundtouch-cli setup inspect --host=$DEVICE
+./build/soundtouch-cli setup factory-reset --host=$DEVICE
+
+# 1. Manually switch this host to the speaker's AP (Bose SoundTouch XXXX).
+#    macOS: networksetup -setairportnetwork en0 "Bose SoundTouch XXXX"
+
+./build/soundtouch-cli setup wait-ap
+./build/soundtouch-cli setup wifi-push --ssid="$HOME_SSID" --pass="$HOME_PASS"
+
+# 2. Manually switch this host back to home Wi-Fi.
+
+./build/soundtouch-cli setup wait-online --match=DE4803          # deviceID suffix from /info before reset
+# (note the new IP from the "Speaker discovered" line)
+
+NEW_IP=192.168.x.y
+./build/soundtouch-cli setup migrate --host=$NEW_IP --service-url=http://aftertouch.local:8000   # default --method=telnet
+
+# Optional, if you want the DNS-redirect path instead of (or alongside) telnet envswitch:
+#   1. ./build/soundtouch-cli setup ssh-check --host=$NEW_IP            # USB-stick procedure if 22 is closed
+#   2. ./build/soundtouch-cli setup install-ca --host=$NEW_IP --service-url=http://aftertouch.local:8000
+#   3. ./build/soundtouch-cli setup migrate --host=$NEW_IP --service-url=http://aftertouch.local:8000 --method=resolv
+./build/soundtouch-cli setup pair --host=$NEW_IP --mode=bare   # or --mode=full
+```
+
+The two manual lines are user-side Wi-Fi switches that can't be automated portably. The `wait-ap` and `wait-online` subcommands poll for the corresponding network state, so timing them is hands-off.
+
+## Recording the result
+
+Append to this file under `## Results`:
+
+```
+- Date: YYYY-MM-DD
+- Firmware: 27.x.x
+- Model: ST10 / ST20 / ST30 / ST300
+- Bare setMargeAccount accepted: yes/no
+- Persistence written: yes/no
+- Survives reboot: yes/no
+- Notes: ...
+```
+
+One row per device tested. Once two devices on different firmware confirm the same verdict, we treat it as decided.
+
+## Results
+
+- Date: 2026-05-13
+- Firmware: 27.0.6.46330.5043500 (build epdbuild.trunk.hepdswbld04.2022-08-04T11:20:29)
+- Model: SoundTouch 10 (deviceID A81B6A536A98)
+- Bare setMargeAccount accepted: **yes** — pre-/info margeAccountUUID="" → post-/info margeAccountUUID="1111111"
+- Persistence written: **yes** — device materialized 14-entry Sources.xml on its own
+- Survives reboot: **yes** — `setup inspect` after `setup reboot` shows margeAccountUUID still 1111111
+- Notes: After bare pairing, the speaker did the full post-pairing handshake against AfterTouch (POST /streaming/support/power_on, GET /streaming/sourceproviders, GET /streaming/account/{id}/full, group/, provider_settings). No SETUP_START/SETUP_ENTER/SETUP_LEAVE was ever sent. Verdict: bare path is functionally equivalent to the full state machine on this firmware.
+
+### Implication for the codebase
+
+- `pkg/service/setup/setup_session.go` keeps the full state machine for completeness, but
+- `pkg/service/setup/init_plan.go`'s default could be simplified to "send setMargeAccount only" once we have one more confirming run on a different model.
+- The OCT issue-167 SSH-XML seeding workaround is **not required**.
+
+### Appendix — SystemConfigurationDB.xml comparison
+
+Post-experiment we compared the device-written `/mnt/nv/BoseApp-Persistence/1/SystemConfigurationDB.xml` from the bare-paired speaker against two SSH backups taken from speakers originally paired by the official Bose app (account 3230304, devices `A_Sound_Machine` and `Sound_Machinechen`). The diff is much smaller than expected — only two fields differ, and neither is set by the pairing protocol itself:
+
+| Field                    | Bare-paired (1111111)                      | Real-Bose-paired (3230304) | Set by                                                                                                    |
+|--------------------------|--------------------------------------------|----------------------------|-----------------------------------------------------------------------------------------------------------|
+| `DeviceName`             | `Bose SoundTouch 536A98` (factory default) | `Sound Machinechen`        | `name` WS message — only sent in `--mode=full`                                                            |
+| `AccountAssociatedEMail` | empty                                      | **empty**                  | Never populated, even by real Bose                                                                        |
+| `AccountUUID`            | `1111111`                                  | `3230304`                  | `setMargeAccount` — both paths set it                                                                     |
+| `Locale`                 | empty                                      | **empty**                  | Never populated, even by real Bose                                                                        |
+| `acctMode`               | `global`                                   | `global`                   | Firmware-default; no protocol path observed to change it                                                  |
+| `isMultiDeviceAccount`   | `false`                                    | `true`                     | Derived from the cloud's `/streaming/account/{id}/full` response — count of `<devices>` > 1 flips it true |
+| `margeAuthServerToken`   | empty                                      | **empty**                  | Never populated, even by real Bose                                                                        |
+| `Password`               | (encrypted blob)                           | (encrypted blob)           | Device-local key; expected to differ                                                                      |
+
+Three of the seven informational fields are empty even after a real-Bose pairing — the firmware simply doesn't populate `AccountAssociatedEMail`, `Locale`, or `margeAuthServerToken` from the pairing flow. So bare pairing isn't missing any field that real pairing fills.
+
+The two genuinely different fields:
+
+- **`DeviceName`** — pure UX. Settable any time post-pair via `name` POST (`soundtouch-cli name set --value=…`) or by sending the `name` WS message during `--mode=full` pairing.
+- **`isMultiDeviceAccount`** — not a pairing concern. It's derived from the account's device count on AfterTouch's side; flips to `true` automatically the next time the speaker refreshes account state if a second speaker has been paired to the same account.
+
+So the experiment's YES verdict stands unqualified: bare `setMargeAccount` produces a `SystemConfigurationDB.xml` functionally equivalent to one written by the official pairing flow.
@@ -0,0 +1,271 @@
+# Bose SoundTouch Telnet (Port 17000) Command Reference
+
+A consolidated reference for the diagnostic shell that listens on TCP port
+17000 across the SoundTouch line. Compiled from multiple community sources
+to give a single map of what's been observed in the wild — useful both for
+implementing automation against it (see
+[TELNET-MIGRATION-METHOD.md](TELNET-MIGRATION-METHOD.md)) and for manual
+recovery / WiFi setup.
+
+> **Important caveat.** The command set is firmware-dependent. Anything that
+> existed in firmware 1.x–7.x (`flarn2006`'s era) was progressively trimmed;
+> some commands listed here have been removed on firmware 27.x. Where a
+> command's availability is known to vary, the **Availability** column says so.
+
+### Telnet via Docker (when not installed locally)
+
+```shell
+docker run --rm --name telnet -it --env IP=192.168.123.123 alpine:edge ash -c 'apk add -U busybox-extras && telnet $IP 17000'
+```
+
+## Sources
+
+| #  | Source                                                                                                                                                                                                             | Era / focus                                                                                                                                                                                            |
+|----|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| S1 | [flarn2006: "Hacking the Bose SoundTouch and its Linux insides"](https://flarn2006.blogspot.com/2014/09/hacking-bose-soundtouch-and-its-linux.html) (2014)                                                         | Firmware 1.x–7.x; root shell discovery, codenames                                                                                                                                                      |
+| S2 | [Sam Hobbs: "Connect Bose SoundTouch 10 to WiFi using Linux Telnet"](https://samhobbs.co.uk/2016/01/connect-bose-soundtouch-10-wifi-using-linux-telnet) (2016)                                                     | ST 10 setup mode; `network`/`sys` families                                                                                                                                                             |
+| S3 | [izndgroup: "Connect Bose SoundTouch 10 to WiFi"](https://technical.izndgroup.com/2021/02/connect-bose-soundtouch-10-to-wifi.html) (2021)                                                                          | Reissue of S2 with later-firmware notes                                                                                                                                                                |
+| S4 | [sijeffrey/SoundTouch — `bose` script](https://github.com/sijeffrey/SoundTouch/blob/master/bose) (2017)                                                                                                            | `nc`-based remote-control script using `sys`/`ws`                                                                                                                                                      |
+| S5 | [r/bose "SoundTouch telnet probing"](https://www.reddit.com/r/bose/comments/1o5zkym/soundtouch_telnet_probing/)                                                                                                    | Recent (post-EOS) probing on ST 10 firmware `27.0.6.46330.5043500 epdbuild.trunk.hepdswbld04.2022-08-04T11:20:29`; comments mirrored in [#221](https://github.com/gesellix/Bose-SoundTouch/issues/221) |
+| S6 | Issue [#221](https://github.com/gesellix/Bose-SoundTouch/issues/221), [#236](https://github.com/gesellix/Bose-SoundTouch/issues/236), [deborahgu/soundcork#141](https://github.com/deborahgu/soundcork/issues/141) | The migration commands we already implement                                                                                                                                                            |
+
+---
+
+## Connecting to the shell
+
+### From an already-on-network device
+
+The shell binds to TCP port 17000 on every device family observed (ST 10/20/300, Wave III/IV, ST 520, SA-5 — see §"Firmware era notes" for caveats). No authentication.
+
+```bash
+# A no-op probe just to verify reach.
+echo '' | nc -w 2 <device-ip> 17000
+
+# Or interactively — works the same.
+telnet <device-ip> 17000
+```
+
+The `bose` script (S4) goes one level lower and writes commands directly to a `/dev/tcp/<ip>/17000` redirection target instead of using `nc`. That's the same wire protocol with no library between.
+
+### From a factory-fresh / WiFi-less device
+
+Per S2/S3 — newer firmware may have closed this on some models:
+
+1. **Enter setup mode.** Press and hold key **2** + **volume down** for 5 seconds until the WiFi LED turns amber.
+2. **Connect your laptop to the speaker's open access point.** The speaker becomes its own AP.
+3. **Telnet to `192.0.2.1` on port 17000.**
+
+Once you've added a WiFi profile (see `network wifi profiles add` below) the speaker reboots into station mode and the AP goes away.
+
+### Hardware key combinations on the device itself
+
+| Combo             | Effect                                   | Source |
+|-------------------|------------------------------------------|--------|
+| `1` + volume-down | Factory reset                            | S2, S3 |
+| `2` + volume-down | Setup mode (open WiFi AP at `192.0.2.1`) | S2, S3 |
+| `3` + volume-down | Toggle WiFi / Bluetooth                  | S2, S3 |
+| `4` + volume-down | Check for software updates               | S2, S3 |
+
+---
+
+## The `network` family — WiFi & interfaces
+
+| Command                                                    | Purpose                                                                                                                   | Availability               | Source |
+|------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------|----------------------------|--------|
+| `network wifi status`                                      | Current SSID, state (e.g. `WIFI_STATION_CONNECTED`), signal strength. Returns XML-like `<WiFiStatus SSID="…" state="…">`. | Wide                       | S2, S3 |
+| `network wifi scan [<maxresults>]`                         | Site survey.                                                                                                              | Wide                       | S2     |
+| `network wifi profiles info`                               | Lists stored WiFi profiles (passphrases shown encrypted).                                                                 | Wide                       | S2, S3 |
+| `network wifi profiles add <ssid> <security> [<password>]` | Adds a WiFi network. `<security>` ∈ `none` \| `wep` \| `wpa_or_wpa2`.                                                     | Wide; setup-mode workhorse | S2, S3 |
+| `network wifi profiles clear`                              | Wipes all stored profiles.                                                                                                | Wide                       | S2     |
+| `network status`                                           | All interfaces and IP addresses.                                                                                          | Wide                       | S2, S3 |
+| `network dhcp`                                             | Current DHCP interface info.                                                                                              | Wide                       | S2     |
+| `network mode auto\|wifioff\|wifisetup`                    | Switch radio / setup-AP state.                                                                                            | Wide                       | S2     |
+
+**Example session — adding a network from setup mode (S3):**
+
+```
+network wifi profiles add foobarHub wpa_or_wpa2 topsecret
+```
+
+The speaker stores the profile, drops the setup AP, and reboots into station mode.
+
+---
+
+## The `key` family — front-panel button emulation
+
+Each `key …` command emulates a press of a physical button on the speaker
+or remote. Confirmed working on ST 10 / FW `27.0.6.46330.5043500` (S5);
+also visible on the ST 20/300/Wave captures in #221. Different from the
+`sys presetkey N p` form (S4) — the `key prefix_N` shape on FW 27 is what
+the device's own remote sends.
+
+| Command                         | Effect                                                                                | Source |
+|---------------------------------|---------------------------------------------------------------------------------------|--------|
+| `key prefix_1` … `key prefix_6` | Triggers preset 1–6 (same as a remote preset press).                                  | S5     |
+| `key play`                      | Begin / resume playback.                                                              | S5     |
+| `key pause`                     | Pause playback.                                                                       | S5     |
+| `key stop`                      | Stop playback (does **not** terminate the underlying stream).                         | S5     |
+| `key prev`                      | Restart current song / previous track.                                                | S5     |
+| `key next`                      | Next track.                                                                           | S5     |
+| `key aux`                       | Toggle Bluetooth / AUX input.                                                         | S5     |
+| `key power`                     | Echoes "OK" but no observable effect on FW 27.x — possibly handled at a higher layer. | S5     |
+
+The S4 `bose` script's `sys presetkey N p` form still works, but `key prefix_N` is shorter and matches what the remote already does on FW 27.x.
+
+---
+
+## The `sys` family — system control & service URLs
+
+The `sys` family is the one our migration uses (see §"What we use during migration"). Two distinct sub-syntaxes coexist:
+
+- **Single-token verbs:** `sys reboot`, `sys volume`, `sys power`, etc.
+- **`sys configuration <key> <value>` setters** that modify persisted runtime configuration. Used for the four service URLs (margeServerUrl, statsServerUrl, swUpdateUrl, bmxRegistryUrl).
+
+| Command                                     | Purpose                                                                                                                                                                                       | Availability               | Source     |
+|---------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------|------------|
+| `sys reboot`                                | Restart the device.                                                                                                                                                                           | Wide                       | S2, S6     |
+| `sys factorydefault`                        | Reset to factory defaults.                                                                                                                                                                    | Wide                       | S1, S2     |
+| `sys ver`                                   | Firmware version string, e.g. `BoseApp version: 27.0.6.46330.5043500 …`.                                                                                                                      | Wide; confirmed on FW 27.x | S1, S5     |
+| `sys power`                                 | Toggle power. Confirmed working on older firmware via S2/S4; on FW 27.x ST 10 the response is `OK` but with **no observable effect** — power state may be controlled elsewhere on that build. | Varies                     | S2, S4, S5 |
+| `sys playpause`                             | Toggle playback.                                                                                                                                                                              | Wide                       | S2         |
+| `sys stop`, `sys pause`                     | Accepted (return `OK`) but **no observable effect** on FW 27.x ST 10 — the working stop/pause path on that firmware is `key stop` / `key pause`.                                              | Wide / no-op               | S5         |
+| `sys volume`                                | Print current volume. The S4 script parses the 5th token of the first line.                                                                                                                   | Wide                       | S2, S4, S5 |
+| `sys volume <int>`                          | Set absolute volume to `<int>`.                                                                                                                                                               | Wide                       | S5         |
+| `sys volume up <n>` / `sys volume down <n>` | Adjust volume by `<n>` (steps, not dB).                                                                                                                                                       | Wide                       | S4         |
+| `sys volume <value> updateDisplay`          | Set absolute volume and update the front-panel display.                                                                                                                                       | Wide                       | S2         |
+| `sys presetkey <1-6> p`                     | Trigger a preset (`p` = press). Older shape of `key prefix_<N>`.                                                                                                                              | Wide                       | S4         |
+| `sys timeout inactivity disable` (or `off`) | Stop the auto-shutoff timer. May need to be sent twice.                                                                                                                                       | Wide                       | S1, S2     |
+| `sys configuration` (no args)               | Returns the usage hint `sys configuration <XMLTag> <XMLValue>` — confirms the underlying setter is XML-tag-keyed.                                                                             | FW 27.x                    | S5         |
+| `sys configuration bmxRegistryUrl <url>`    | Set the Bose Media eXchange registry URL.                                                                                                                                                     | Wide; **migration**        | S6         |
+| `sys configuration statsServerUrl <url>`    | Set the telemetry/stats endpoint.                                                                                                                                                             | Wide; **migration**        | S6         |
+| `sys configuration margeServerUrl <url>`    | Set the marge / streaming endpoint.                                                                                                                                                           | Wide; **migration**        | S6         |
+| `sys configuration swUpdateUrl <url>`       | Set the software-update endpoint.                                                                                                                                                             | Wide; **migration**        | S6         |
+
+Each `sys configuration` setter is reported by users to return `OK` on success. Wait for that token between commands (S6, `foob61451`).
+
+---
+
+## The `envswitch` family — parallel persistence layer
+
+`envswitch` writes to a separate, lower-level persistence store that **wins on next reboot** if the corresponding `sys configuration` value differs. So our migration writes both — see TELNET-MIGRATION-METHOD.md §2.1.
+
+| Command                                           | Purpose                                                                                       | Source  |
+|---------------------------------------------------|-----------------------------------------------------------------------------------------------|---------|
+| `envswitch boseurls set <margeUrl> <swUpdateUrl>` | Persist the marge and update URLs. **Two arguments**, in that order.                          | S6      |
+| `envswitch accountid set <numeric-id>`            | Equivalent to the HTTP `/setMargeAccount` POST. Used as fallback in our `PairAccount` helper. | S6      |
+| `envswitch accountid get`                         | Plausible by symmetry but **not yet confirmed** across firmwares; we probe it best-effort.    | (probe) |
+
+---
+
+## The `getpdo` family — read persisted configuration
+
+`getpdo <selector>` prints the contents of a persisted-data-object. We use it as the verification step after writing URLs.
+
+| Selector                            | Purpose                                                                                                                                                               | Source |
+|-------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------|
+| `getpdo CurrentSystemConfiguration` | Echoes the resolved URL set, including margeServerUrl/bmxRegistryUrl/statsServerUrl/swUpdateUrl. We grep our targetURL out of this to confirm a successful migration. | S6     |
+
+---
+
+## The `scm` family — service control
+
+`scm` (System Control / Module manager) lets you inspect and restart internal services.
+
+| Command                 | Purpose                                                                                  | Availability   | Source                                                                       |
+|-------------------------|------------------------------------------------------------------------------------------|----------------|------------------------------------------------------------------------------|
+| `scm list`              | List running services.                                                                   | Older firmware | S1                                                                           |
+| `scm restart <service>` | Restart a service by name.                                                               | Older firmware | S1                                                                           |
+| `scm uboot_ver`         | Print bootloader version (`U-Boot 2013.01.01-…`). Confirmed working on SA-5 with FW 9.x. | Older firmware | [deborahgu/soundcork#141](https://github.com/deborahgu/soundcork/issues/141) |
+
+---
+
+## Shell-unlock commands
+
+These are the commands that gated SSH access on older firmware. Both have been progressively removed; on FW 27.x they generally do nothing useful.
+
+| Command                     | Purpose                                                                                                                                                                                  | Availability     | Source                                                                           |
+|-----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|------------------|----------------------------------------------------------------------------------|
+| `remote_services on`        | Enable SSH on port 22. Volatile (re-enter after reboot). Response: `remote services on`. **Removed in FW 7.x+**.                                                                         | Old              | S1                                                                               |
+| `local_services on`         | Alternative enablement; works on some firmware where `remote_services` was removed. SA-5 FW 9.x reports `local services on`, but this alone does not appear to grant SSH on most models. | Old, hit-or-miss | S1, [deborahgu/soundcork#141](https://github.com/deborahgu/soundcork/issues/141) |
+| `demo enter` / `mode enter` | Unlocks demo / button-test mode (used historically to recover bricked units).                                                                                                            | Old              | S1                                                                               |
+
+---
+
+## The `ws` and `swupdate` families
+
+| Command          | Purpose                                                                                                 | Availability | Source |
+|------------------|---------------------------------------------------------------------------------------------------------|--------------|--------|
+| `ws getpresets`  | Returns an XML list of presets — the S4 script parses the `<itemName>…<text>…` blocks to extract names. | Wide         | S4     |
+| `swupdate abort` | Cancel a software update in progress.                                                                   | Wide         | S1     |
+
+---
+
+## `help`
+
+Lists the commands available on the running firmware. **Frequently removed** on later firmware — returns `Command not found` on FW 27.x in many of the captures we have. Still worth probing once during preflight: a successful response is a quick way to enumerate what this specific build supports without trial-and-error.
+
+---
+
+## Device codenames (S1)
+
+These show up in `getpdo`, `network status`, and SSH-side hostnames. Useful for matching captures to hardware.
+
+| Codename | Hardware                                       |
+|----------|------------------------------------------------|
+| `lisa`   | Adapter (older speakers running Bose firmware) |
+| `spotty` | SoundTouch 20                                  |
+| `rhino`  | SoundTouch 10                                  |
+| `mojo`   | SoundTouch 30                                  |
+| `taigan` | SoundTouch Portable                            |
+
+---
+
+## Firmware era notes
+
+- **Firmware 1.x–7.x** (S1 era): everything — `help`, `remote_services on`, full `scm`, and an in-shell login prompt. `flarn2006` documents the original Linux insides.
+- **Firmware 8.x–14.x** (S2 era): `remote_services on` removed; `network`, `sys`, `envswitch`, `getpdo` still present. `local_services on` works on some Wave/SA-5 models.
+- **Firmware 27.x** (S5/S6 era — the long-lived "frozen" build that survived through EOS): `help`, `remote_services on`, and `sys ver` removed in some builds; `sys configuration …` and `envswitch …` confirmed working on ST 10, ST 20, ST 300, Wave III, Wave IV. **This is the firmware our migration targets**. The Portable on more recent firmware drops further commands and is the hardest target.
+
+  S5 enumerated the **top-level command roots** that don't return "Command not found" on a vanilla ST 10 (`rhino`) running `27.0.6.46330.5043500`:
+
+  ```
+  key
+  net
+  sys
+  getpdo
+  ```
+
+  Notably absent from that probe: `network`, `envswitch`, `scm`, `ws`, `swupdate`, `remote_services`, `local_services`, `demo`, `mode`, `help`. **However**, other captures on the same firmware family (S6, ST 20 / Wave III / Wave IV) accept `envswitch …`, suggesting either per-model variation in the shipped command table or an SSH/role gate the S5 author didn't trip. Implementations that use `envswitch` should treat its absence as a recoverable preflight outcome (we already do).
+
+  `net` is observed as a valid root by S5 but its sub-commands aren't enumerated; it may be a shorthand alias for `network` on FW 27.x ST 10.
+
+---
+
+## What we use during migration
+
+For quick reference, the exact sequence our `pkg/service/setup.migrateViaTelnet` issues, all on the same connection, in this order:
+
+```
+sys configuration bmxRegistryUrl <serverURL>/bmx/registry/v1/services
+sys configuration statsServerUrl <serverURL>
+sys configuration margeServerUrl <serverURL>
+sys configuration swUpdateUrl    <serverURL>/updates/soundtouch
+envswitch boseurls set <serverURL> <serverURL>/updates/soundtouch
+getpdo CurrentSystemConfiguration
+```
+
+Plus, when pairing a fresh device whose `:8090/setMargeAccount` is missing or wedged, the helper falls back to:
+
+```
+envswitch accountid set <7-digit-id>
+```
+
+Reboot is **not** part of these sequences — it stays a user-initiated action via the existing reboot button, which now accepts `?method=telnet|ssh` and sends `sys reboot` when telnet is picked.
+
+---
+
+## Out of scope here, but worth recording
+
+- **Setup-mode WiFi onboarding via 192.0.2.1.** The community uses this to add a fresh device to a network without the Bose app. Our `soundtouch-service` does not currently automate this, but `network wifi profiles add` is the entry point if we ever do.
+- **Direct preset / playback control via `sys`.** The S4 `bose` script demonstrates a viable headless remote-control path that does not need our marge emulation at all. Useful as a fallback for tooling on devices that refuse to talk to any cloud.
+- **`scm restart <service>`.** Not used today, but a possible recovery primitive on older firmware where a stuck service blocks streaming.
@@ -0,0 +1,730 @@
+# Telnet (Port 17000) Migration Method — Analysis
+
+This document captures the use cases, community findings, and feasibility analysis
+for adding a **Telnet/port 17000** migration path to `soundtouch-service` as a
+peer of the existing XML and DNS-based methods. The `/etc/hosts` method stays
+deprecated and is intentionally kept off the visible UI options.
+
+> **Sources** — community discussion synthesised from
+> [gesellix/Bose-SoundTouch#221](https://github.com/gesellix/Bose-SoundTouch/issues/221),
+> [gesellix/Bose-SoundTouch#236](https://github.com/gesellix/Bose-SoundTouch/issues/236),
+> [scheilch/opencloudtouch#167](https://github.com/scheilch/opencloudtouch/issues/167),
+> [deborahgu/soundcork#228](https://github.com/deborahgu/soundcork/issues/228),
+> [deborahgu/soundcork#141](https://github.com/deborahgu/soundcork/issues/141),
+> the post-EOS walkthrough PDF in `docs/`,
+> [Bose SoundTouch Telnet Probing thread](https://www.reddit.com/r/bose/comments/1o5zkym/soundtouch_telnet_probing/),
+> and [flarn2006's blog post on hacking SoundTouch](https://flarn2006.blogspot.com/2014/09/hacking-bose-soundtouch-and-its-linux.html).
+
+---
+
+## 1. Why a third method is needed
+
+The two currently shipped methods both have hard preconditions that block real
+users:
+
+| Method                                  | Preconditions                                                | Failure modes seen in the wild                                                                                                                                                         |
+|-----------------------------------------|--------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| **XML** (`SoundTouchSdkPrivateCfg.xml`) | SSH/root access — needs `remote_services` USB unlock first   | Some firmware revisions (e.g. SA-5, ST520, latest ST Portable) refuse the USB unlock entirely; `remote_services on` was removed from the telnet command set in firmware 7.x and later. |
+| **DNS** (`resolv.conf` priority hook)   | SSH/root access; service must own port 53 on the LAN gateway | Won't fit users behind ISP routers they can't reconfigure; still requires the device to be SSH-reachable to write the hook.                                                            |
+
+The community has demonstrated a **third path that needs no SSH at all**:
+the device's built-in **diagnostic Telnet shell on TCP port 17000** accepts
+configuration commands that change exactly the same fields the XML method would.
+
+### 1.1 Confirmed user reports (firmware 27.0.6.46330.5043500 unless noted)
+
+| Reporter           | Hardware                  | Outcome                                                                                                     |
+|--------------------|---------------------------|-------------------------------------------------------------------------------------------------------------|
+| `foob61451` (#221) | ST 10, ST 20 (non-rooted) | All four URLs persisted via `sys configuration …`; `envswitch boseurls set …` survived `sys reboot`.        |
+| `bveenker` (#221)  | Wave III                  | URLs accepted; presets work after pairing via `/setMargeAccount` (see §3).                                  |
+| `stephan48` (#221) | Wave IV                   | Telnet:1700 + USB stick `remote_services` did **not** work; **port 17000 telnet** worked for all four URLs. |
+| `mcdona1d` (#141)  | ST 20, ST 300             | Confirmed working with `sys configuration …` + `envswitch …` + `sys reboot`.                                |
+| `TJGigs` (#228)    | ST 20 ×2, ST 10           | Wraps telnet:17000 into an admin "Smart Inject" tool; uses `sys reboot` over telnet to nudge devices.       |
+
+So the method is plausible across **at least ST 10/20/300 and Wave III/IV** on
+the most common firmware that survived the EOS cut, **without the USB unlock
+dance** that newer firmware refuses.
+
+---
+
+## 2. The Telnet:17000 command set we rely on
+
+> For a broader catalogue of every telnet command the community has documented
+> across firmware eras (the `key`, `network`, `sys`, `envswitch`, `getpdo`,
+> `scm`, `ws`, `swupdate`, and shell-unlock families), see
+> **[TELNET-COMMAND-REFERENCE.md](TELNET-COMMAND-REFERENCE.md)**. This
+> section only lists the subset our migration actually drives.
+
+
+### 2.1 URL configuration (the migration payload)
+
+The sequence we send for `soundtouch-service` (community-validated in #221, #141):
+
+```
+sys configuration bmxRegistryUrl http://<service-host>:8000/bmx/registry/v1/services
+sys configuration statsServerUrl http://<service-host>:8000
+sys configuration margeServerUrl http://<service-host>:8000
+sys configuration swUpdateUrl    http://<service-host>:8000/updates/soundtouch
+envswitch boseurls set http://<service-host>:8000 http://<service-host>:8000/updates/soundtouch
+getpdo CurrentSystemConfiguration
+```
+
+`sys reboot` is **not** part of this sequence. The migration flow only writes
+configuration — the reboot is user-initiated via the existing reboot button in
+the web UI, mirroring what XML/DNS migration already does. See §6.2 for how
+that button gains a `?method=ssh|telnet` selector.
+
+Three important details from the discussion:
+
+1. **`sys configuration` alone is not enough.** `stephan48` reported that
+   without the `envswitch boseurls set …` line his typo in `bmxRegistryUrl` was
+   silently restored on reboot — i.e. there is a parallel "envswitch" persistence
+   layer that wins on next boot if you don't also write to it. **We must always
+   issue both.**
+2. **margeServerUrl path is bare for `soundtouch-service`.** We mount the marge
+   endpoints at the **root** of port 8000, matching what the existing XML
+   migration writes (`Manager.migrateViaXML` in `pkg/service/setup/setup.go`
+   sets `MargeServerUrl: targetURL` without any suffix). Some community
+   recipes appended `/marge` because they were targeting
+   [`deborahgu/soundcork`](https://github.com/deborahgu/soundcork), which
+   routes marge under that sub-path. **For our service: bare URL. For users
+   redirecting to soundcork: append `/marge`** to both `margeServerUrl` and
+   the first argument of `envswitch boseurls set`.
+3. **Each command must be sent one at a time, waiting for the device's `OK`
+   response** before sending the next one (`foob61451`'s explicit warning).
+
+### 2.2 Account pairing fallback
+
+`envswitch accountid set <numeric-id>` was reported by `bveenker` (#221) as an
+in-band equivalent to the HTTP `/setMargeAccount` call, useful when the
+`/setMargeAccount` endpoint is missing on the firmware (see §3).
+
+### 2.3 Probing / preflight
+
+- A bare TCP connect to `<deviceIP>:17000` answers (no auth) on devices we care
+  about.
+- Useful read-only verification command: `getpdo CurrentSystemConfiguration` —
+  prints the URLs after the changes have been applied so we can verify before
+  rebooting.
+- `sys reboot` is the trigger that re-reads both layers.
+
+### 2.4 What Telnet:17000 cannot do
+
+- It does **not** install a custom CA. So if a user wants HTTPS rather than HTTP
+  redirection to our service (the DNS-method scenario, where `resolv.conf`
+  redirection collides with the device's TLS validation unless our root CA is
+  trusted on the device), telnet alone won't cover it. This is fine for our
+  default flow, which uses plain `http://` URLs to the service's port 8000.
+- It does not give us a way to read or write `Sources.xml` (third-party
+  account credentials) — that still requires SSH, but for a migration we don't
+  actually need it.
+
+---
+
+## 3. The `/setMargeAccount` problem (issue #236, #228)
+
+### 3.1 What it is
+
+A factory-reset speaker has an empty `<margeAccountUUID/>` in `:8090/info`. The
+marge endpoints fail with 502 / unhandled until that field is populated, which
+is why several users (#221, #236) saw **everything except AUX** broken after
+migration:
+
+```
+POST http://<deviceIP>:8090/setMargeAccount
+Content-Type: application/xml
+
+<PairDeviceWithAccount>
+  <accountId>1234567</accountId>
+  <userAuthToken>soundcorkdoesntcare</userAuthToken>
+</PairDeviceWithAccount>
+```
+
+The values are not validated by the local service, so any numeric `accountId`
+will work — soundcork's runbook (#228) literally calls the token
+`soundcorkdoesntcare` to make the point.
+
+### 3.2 Why it's broken in practice
+
+There are **three independent failure modes** observed:
+
+| Symptom                                                         | Cause                                                                                                                 | Detection                                                                                                           |
+|-----------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------|
+| Endpoint returns 404 / "not implemented"                        | Newer firmware (e.g. some BST20 Portable, latest ST Portable) drops the endpoint entirely.                            | `GET /supportedURLs` does **not** list `/setMargeAccount` in `<URL location="…"/>`.                                 |
+| Endpoint hangs (no response / socket stays open)                | "Broken state" the user explicitly called out — endpoint advertised, but handler is wedged.                           | Caller has to time out; we currently have no timeout, so the request appears to hang the migration UI indefinitely. |
+| `POST /marge/streaming/support/power_on` → 502 unhandled (#236) | Device keeps polling marge after migration but no `margeAccountUUID` was ever assigned, so all subsequent calls fail. | `:8090/info` shows `<margeAccountUUID/>` empty after reboot.                                                        |
+
+### 3.3 Required handling
+
+Per the user's brief, the migration logic must:
+
+1. **Probe** `GET http://<deviceIP>:8090/supportedURLs` and check whether
+   `/setMargeAccount` is in the list **before** trying to POST it.
+2. **Time-bound** the POST aggressively (e.g. ≤5s connect + ≤10s read) and treat
+   anything over the budget as a failure rather than waiting indefinitely.
+3. On either failure mode, **fall back** to the telnet equivalent
+   `envswitch accountid set <id>` over the same `pkg/telnet` connection used
+   for the URL flip. Reboot stays a user-initiated action (§6.2).
+4. If telnet:17000 is **also** unreachable, surface a clear "your firmware does
+   not support unattended pairing — please pair manually via the official Bose
+   app *before* it goes EOS, or open SSH and use the XML method" error rather
+   than leaving the device in a half-migrated state.
+
+### 3.4 Where the `<id>` comes from
+
+The device's current account ID is already discoverable through endpoints we
+control:
+
+- **`GET :8090/info`** returns `<margeAccountUUID>…</margeAccountUUID>`. If it
+  is non-empty the device is already paired — **reuse that ID**, do not
+  reassign. Our local marge accepts any ID, so the existing one is fine.
+- If it is empty (factory reset), the user picks one in the UI:
+  1. **Pick from existing accounts.** The setup UI lists IDs returned by
+     `DataStore.ListAccounts()` so a user can re-attach a fresh device to an
+     account that already has presets/recents/sources.
+  2. **Enter manually.** Free-form text input, validated as **exactly 7
+     numeric digits** (the format every Bose-cloud-issued ID has had in the
+     captures we've seen, and the format the wider community uses in their
+     recipes).
+  3. **Randomize.** A "Generate" button that picks a 7-digit number and
+     re-rolls if it collides with an existing account in the local datastore.
+- **Telnet read-back (best-effort).** `envswitch accountid get` is plausible by
+  symmetry with `envswitch accountid set` (#221) but is not yet confirmed
+  across firmwares. We will probe it during preflight; if it returns a value
+  we cross-check it against `:8090/info` and warn on mismatch.
+
+This means the user is never *forced* to invent a number — the common path is
+"the device already has an ID, reuse it" — and the manual/randomize controls
+only show up when the device is genuinely fresh.
+
+---
+
+## 4. Port 17000 availability
+
+The diagnostic shell is gated by firmware build and product family. Anecdotally:
+
+- ST 10 / ST 20 / ST 300 / Wave III / Wave IV on FW 27.0.6 → **open**.
+- SA-5 with FW 9.x → some commands present (`local_services on`) but
+  **no `remote_services on`** and no SSH on FW 9.0.43.23466 (#141).
+- Modern firmware on some Portables → endpoint set has shrunk further.
+
+Because of this, we cannot assume port 17000 is reachable. The migration flow
+must:
+
+1. **Probe** with a TCP connect to `<deviceIP>:17000`, with a tight timeout
+   (≤2s). A successful TCP handshake is necessary but not sufficient — some
+   hardened firmware closes the port immediately.
+2. **Banner check.** After connecting, read whatever the device sends within
+   ~1s. The diagnostic shell prints a small banner (firmware-dependent); a
+   blank read or an immediate close means we should treat it as "telnet not
+   usable" and disable the option.
+3. **Capability check.** Issue a no-op like `getpdo CurrentSystemConfiguration`
+   and look for any non-empty response. If the device replies "Command not
+   found" we abort and suggest XML or DNS instead.
+4. **Surface state to the UI.** The migration form should grey out the Telnet
+   option when the probe fails and show *why* (closed, banner missing,
+   command rejected) instead of letting the user click into a dead end.
+
+---
+
+## 5. Implementation feasibility — Telnet client in Go
+
+This is a feasibility check only; no code is written yet.
+
+### 5.1 Protocol
+
+"Telnet" on port 17000 is effectively a line-oriented plain-TCP shell. The
+device prints a small prompt (`->` in the SA-5 captures from #141) and reads
+newline-terminated commands. There is **no** real Telnet option negotiation
+(no `IAC`/`DO`/`WILL` exchanges visible in the wild captures), so we don't
+need `golang.org/x/crypto/ssh`-class machinery.
+
+### 5.2 Standard-library only
+
+A minimal client is just `net.DialTimeout("tcp", host+":17000", 2*time.Second)` +
+`bufio.Scanner` + `time.Time`-based deadlines on `Conn`. No third-party Telnet
+library is needed; `github.com/reiver/go-telnet` would be overkill and adds
+maintenance surface for no benefit. This matches the project's KISS principle
+in `docs/CLAUDE.md` §3.
+
+### 5.3 Cross-platform compatibility
+
+`net.Dial` over TCP works identically on Windows, macOS, Linux and (with
+limitations on listening) WASM. WASM-side: `soundtouch-service` runs server-side
+anyway, so this only matters for `soundtouch-cli`, where TCP dial works in any
+target other than browser-WASM — an acceptable carve-out documented separately.
+
+### 5.4 Concurrency / safety
+
+Each migration is a single goroutine driving one device. The client must:
+
+- enforce per-command response deadlines so a wedged device cannot stall the
+  migration UI (mirrors the `/setMargeAccount` requirement);
+- abort the rest of the sequence on the first non-`OK` response so we don't
+  half-write configuration;
+- always close the socket on error.
+
+### 5.5 Testing strategy
+
+We can test without a real speaker by spinning up a `net.Listen("tcp", "127.0.0.1:0")`
+in the test, scripting it to consume our commands and emit canned `OK`/error
+responses. That gives us deterministic coverage for:
+
+- happy path (all four URLs accepted),
+- single-command failure → sequence aborts, no further commands sent,
+- "command not found" on `envswitch …` → fallback path exercised,
+- TCP closed mid-stream → migration aborts cleanly,
+- read deadline triggers when the device hangs (the broken-state simulation).
+
+The repo already follows the "real device responses preferred, mock servers
+otherwise" rule (see `docs/CLAUDE.md` §1, §8). The tests above are the mock-server
+half of that pattern.
+
+### 5.6 Where it lives
+
+The protocol client is **a standalone package**, not buried inside
+`pkg/service/setup`, so it can be reused from CLI tools, future setup wizards,
+and tests without dragging the migration manager in:
+
+```
+pkg/telnet/                        # NEW reusable package
+  client.go                        #   Dial / SendCommand / Probe / Close
+  client_test.go                   #   mock-server tests against a net.Listen
+
+pkg/service/setup/
+  telnet_migration.go              # NEW thin wrapper that imports pkg/telnet
+                                   # and runs the URL config sequence
+  marge_pairing.go                 # NEW /setMargeAccount probe + post + telnet
+                                   # `envswitch accountid set` fallback
+  setup.go                         # add MigrationMethodTelnet const + case
+```
+
+UI plumbing is `pkg/service/handlers/web/index.html` (option list) and
+`pkg/service/handlers/web/js/script.js` (`toggleMigrationMethod()`). The
+deprecated `hosts` option is already hidden from the dropdown when we ship
+this; we just add a `telnet` option next to `xml`/`resolv`.
+
+### 5.7 Verdict
+
+**Feasible and small.** Estimated scope: ~200 lines of client code in
+`pkg/telnet`, ~300 lines of tests, plus a `MigrationMethodTelnet` branch in
+`Manager.MigrateSpeaker`, plus the preflight probe described in §4 and the
+`/setMargeAccount` guarding described in §3.
+
+---
+
+## 6. Decisions made (was: open questions)
+
+1. **Account-ID generation.** Resolved — see §3.4. The migration form reads
+   `:8090/info` first; if `margeAccountUUID` is non-empty it is reused.
+   Otherwise the UI offers (a) pick from `DataStore.ListAccounts()`,
+   (b) manual entry validated as 7 numeric digits, (c) a "Generate" button
+   that randomizes a 7-digit number and re-rolls on collision.
+2. **Reboot policy.** Migration writes configuration only — it does **not**
+   issue `sys reboot` itself. Reboot stays user-initiated via the existing
+   reboot button in the web UI, the same way XML/DNS migration already works.
+   That button's endpoint (`POST /setup/reboot/{deviceId}`,
+   `Manager.Reboot(deviceIP)`) gains an optional `?method=ssh|telnet` query
+   parameter; default stays `ssh` so existing behavior is preserved. The
+   button itself uses a plain `confirm()` dialog before firing.
+3. **CA / HTTPS story.** Telnet has no way to install a custom CA. Documented
+   as an explicit limitation: telnet method = HTTP-only redirect to our
+   service. Users who need end-to-end TLS must use the XML or DNS method.
+   *Possible future enhancement* — a hybrid "install CA via SSH/XML, then drive
+   the URL flip via Telnet" path. Feasibility unknown; not in this iteration.
+
+---
+
+> **See §9 for the as-shipped state.** Section 7 below records the
+> original forecast; the wizard grew larger during implementation and
+> §9 documents what actually landed.
+
+## 7. Summary of what changes when this lands
+
+- **New reusable package `pkg/telnet`** — sibling of `pkg/ssh`, line-oriented
+  TCP client with `Dial`, `SendCommand`, `Probe`, `Close`, all deadline-driven.
+  No external dependencies, usable from CLI, service, and tests.
+- **New `MigrationMethodTelnet = "telnet"`** constant in `pkg/service/setup/setup.go`
+  plus a `migrateViaTelnet` branch in `Manager.MigrateSpeaker`.
+- **New `pkg/service/setup/telnet_migration.go`** orchestrating the URL
+  configuration sequence (§2.1) on top of `pkg/telnet`. Configuration only —
+  no `sys reboot` here.
+- **New `pkg/service/setup/marge_pairing.go`** with `PairAccount(deviceIP, id)`:
+  probes `/supportedURLs`, time-bounded `POST /setMargeAccount`, falls back to
+  telnet `envswitch accountid set <id>` on missing/wedged endpoint.
+- **`Manager.Reboot` and `HandleRebootDevice` gain a method selector** —
+  signature changes to `Reboot(deviceIP string, method RebootMethod) (string, error)`
+  with `RebootMethodSSH` (default, today's behavior) and `RebootMethodTelnet`
+  (sends `sys reboot` over a fresh `pkg/telnet` connection). Handler reads
+  `?method=ssh|telnet` from the query string.
+- **`MigrationSummary` gains** `TelnetReachable`, `TelnetBanner`,
+  `TelnetCommandsAccepted`, `SetMargeAccountSupported`, `CurrentAccountID`,
+  `KnownAccountIDs` so the UI can show preflight outcomes and offer reuse.
+- **UI** — `web/index.html` dropdown gets a `telnet` option (greyed out when
+  preflight fails) and a new pane for picking/entering/randomizing a 7-digit
+  account ID when `:8090/info` reports an empty `margeAccountUUID`. The
+  existing reboot button gets a method selector (radio or dropdown) wired to
+  the new query param, with `confirm()` before firing. The legacy `hosts`
+  option stays out of the dropdown (deprecated).
+
+---
+
+## 8. Device compatibility today
+
+What follows is the current best read on which devices our `migrateViaTelnet`
+flow handles end-to-end, derived from the same six sources catalogued in
+[TELNET-COMMAND-REFERENCE.md](TELNET-COMMAND-REFERENCE.md) plus the issue
+threads cited above. This is migration-outcome perspective; for per-command
+availability see the reference doc.
+
+### 8.1 Proven to work end-to-end
+
+All on the firmware-27.0.6 family, which is what survived through Bose's
+end-of-service cut. Multi-reporter agreement on every row.
+
+| Device   | Reporter(s)                 | Source           | Confirmed                                                                  |
+|----------|-----------------------------|------------------|----------------------------------------------------------------------------|
+| ST 10    | foob61451, TJGigs           | #221, #228       | All four URLs persist; `envswitch boseurls set` survives `sys reboot`      |
+| ST 20    | foob61451, mcdona1d, TJGigs | #221, #141, #228 | Same; multiple independent reports                                         |
+| ST 300   | mcdona1d                    | #141             | `sys configuration` + `envswitch` + `sys reboot` round-trip                |
+| Wave III | bveenker                    | #221             | URLs accepted; presets work after pairing fallback (§3)                    |
+| Wave IV  | stephan48                   | #221             | Port-17000 path **was the only one that worked** — USB-stick unlock failed |
+
+The exact sequence each reporter ran by hand is the sequence our migration
+sends (§2.1). So the migration's happy path is exercised against five
+hardware variants in independent captures.
+
+### 8.2 Proven to need the pairing fallback
+
+Migration of the URLs themselves works on these models, but
+`POST /setMargeAccount` is missing or wedged on the firmware build, so
+pairing has to go through the telnet `envswitch accountid set <id>` path
+that `setup.PairAccount` already implements.
+
+| Device                         | Reporter | Source                      | Why fallback is needed                                                                                                                                   |
+|--------------------------------|----------|-----------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------|
+| ST Portable / FW 27.0.6        | jmosen   | #236                        | After migration: `POST /marge/streaming/support/power_on` → 502; `<margeAccountUUID/>` empty. Time-bounded HTTP path fails; envswitch fallback succeeds. |
+| BST20 Portable (factory reset) | ubittner | scheilch/opencloudtouch#167 | `<margeAccountUUID/>` empty; `/setMargeAccount` not in `/supportedURLs`. HTTP path skipped entirely; only the telnet fallback works.                     |
+
+### 8.3 Likely to fail (but the failure is clean)
+
+Our preflight + abort-on-first-rejection design (`TestMigrateViaTelnet_CommandNotFoundAborts`)
+means none of these scenarios leave a device half-configured. The user is
+told what failed and pointed to the XML or DNS method.
+
+| Device                                     | Source          | Likely cause                                                                                                                                                                                                                             |
+|--------------------------------------------|-----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| **SA-5** (sound amplifier) on FW 9.0.43.x  | soundcork#141   | FW 9.x has a different shell generation: `->` prompt, `local_services on`, `scm uboot_ver`. **`sys configuration` and `envswitch` are not documented as working there.** Migration fails on command #1.                                  |
+| **Recent ST Portable** (post-27.0.6.46330) | #236 (indirect) | `/setMargeAccount` removal points to broader command-set shrinkage. If `envswitch accountid set` is also gone, both migration and pairing fallback fail; user is told to pair via the official Bose app before EOS, or use XML over SSH. |
+
+### 8.4 Unknown — would benefit from real-device verification
+
+| Device                     | Why unknown                                                         | What we'd want to confirm                                                |
+|----------------------------|---------------------------------------------------------------------|--------------------------------------------------------------------------|
+| **ST 30** (`mojo`)         | No concrete capture in any of the six sources                       | Almost certainly works — same FW family as ST 10/20/300 — but unverified |
+| **ST 520 / Home Cinema**   | USB-unlock reports failing (#141), no port-17000 capture either way | Whether `sys configuration` and `envswitch` are exposed at all           |
+| **Wave Music System I/II** | `flarn2006`-era hardware, not seen in 27.x reports                  | Whether port 17000 is even open on those models                          |
+
+### 8.5 The S5 "valid roots" tension
+
+S5 (the r/bose telnet-probing thread) lists only `key`, `net`, `sys`,
+`getpdo` as command roots that don't return "Command not found" on its
+ST 10 / FW 27.0.6 — which would seem to rule out `envswitch`. But foob61451
+on the same hardware/firmware ran `envswitch boseurls set` successfully
+(#221).
+
+The most plausible reading is that **S5 is a non-exhaustive probe**, not a
+negative claim: the author writes "I've made some educated guesses and come
+up with the following valid commands" and never says they tested
+`envswitch`. We do not down-weight `envswitch` availability on the strength
+of S5 alone — but if a real-device run ever shows `envswitch` rejected on
+an ST 10, our preflight catches it, the migration aborts on the first
+non-OK response, and the user gets a clear error rather than partial state.
+
+### 8.6 Failure-mode matrix
+
+What `migrateViaTelnet` does in each failure mode (verified by
+`pkg/telnet` and `pkg/service/setup` unit tests):
+
+| Failure                                        | Outcome                                                                                           | Test                                                                                                               |
+|------------------------------------------------|---------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------|
+| Port 17000 closed / TCP unreachable            | `Dial` errors before any command is sent; UI shows the error; nothing persisted                   | `TestMigrateViaTelnet_DialFailureReturnsError`                                                                     |
+| `sys configuration` rejected (cmd #1)          | Sequence aborts; verification not sent; rest of commands not attempted                            | `TestMigrateViaTelnet_CommandNotFoundAborts` (envswitch variant — generalises)                                     |
+| `envswitch boseurls set` rejected              | Sequence aborts; runtime-only `sys configuration` state reverts on reboot — no permanent damage   | `TestMigrateViaTelnet_CommandNotFoundAborts`                                                                       |
+| Verification mismatch (URLs not echoed back)   | Loud "verification failed" error; live state may persist until reboot but UI never claims success | `TestMigrateViaTelnet_VerifyMismatchFails`                                                                         |
+| `/setMargeAccount` 502 / hang                  | 5s connect + 12s total budget enforced; falls through to telnet `envswitch accountid set`         | `TestPairAccount_FallsBackWhenHTTPReturnsServerError`                                                              |
+| `/setMargeAccount` missing in `/supportedURLs` | HTTP path skipped; goes straight to telnet `envswitch accountid set`                              | `TestPairAccount_FallsBackWhenSetMargeAccountMissing`                                                              |
+| Both pairing paths unavailable                 | Structured error: "use the official Bose app before EOS, or open SSH and use the XML method"      | `TestPairAccount_NoTelnetAndHTTPMissingReturnsClearError`, `TestPairAccount_TelnetCommandNotFoundReportsBothPaths` |
+
+### 8.7 TL;DR
+
+- **Green light** — ST 10, ST 20, ST 300, Wave III, Wave IV on FW 27.0.6 (multi-reporter agreement).
+- **Yellow** — ST Portable and BST20 Portable: migration works, pairing needs our fallback (already implemented).
+- **Red, but fails cleanly** — SA-5 on FW 9.x, possibly newer ST Portable builds.
+- **Unverified but expected to work** — ST 30, ST 520, Wave Music System I/II.
+
+The most useful next verification step is touching a real ST 30 and ST 520
+— those are the two "expected to work" models with zero concrete captures.
+Beyond that, every behaviour the doc predicts is exercised by the unit
+tests in `pkg/telnet` and `pkg/service/setup`.
+
+---
+
+## 9. What actually shipped (post-implementation addendum)
+
+§7 forecast the surface area roughly; the wizard ended up larger. This
+section is the present-day map of the migration tab and the supporting
+backend pieces — kept appended rather than rewritten in place so the
+feasibility analysis above stays a faithful design record.
+
+### 9.1 Three-axis state model
+
+`MigrationSummary` now exposes the four mechanism-specific booleans
+that `checkIsMigrated` writes individually:
+
+- `XMLMigrated` — parsed SoundTouchSdkPrivateCfg.xml's URLs point at us.
+- `HostsMigrated` — `/etc/hosts` carries Bose-domain redirects (the
+  deprecated method, kept detectable for legacy speakers).
+- `ResolvMigrated` — the `/etc/resolv.conf` priority-nameserver hook
+  is in place (with CA trusted).
+- `TelnetMigrated` — `getpdo CurrentSystemConfiguration` reports the
+  service hostname.
+
+`IsMigrated` is the OR. Plus `IsPaired` from the live
+`:8090/info.margeAccountUUID` value.
+
+The frontend opens with a state card that surfaces three orthogonal
+axes derived from these flags:
+
+| Axis              | Verdict semantics                                                                                                     |
+|-------------------|-----------------------------------------------------------------------------------------------------------------------|
+| URL Configuration | URL flip active → ✅; original Bose URLs + DNS hook active → ✅ (intercepted); original + no DNS → ❌ (not intercepted). |
+| DNS Interception  | None / resolv.conf hook / /etc/hosts (with deprecated badge).                                                         |
+| CA / TLS          | Local root CA installed yes/no.                                                                                       |
+
+Plus a Preconditions row: `remote_services` persistence, account
+pairing state, XML config backup presence. Action affordances
+(`Trust CA Now`, `Download CA cert`) live inline next to their verdicts.
+
+### 9.2 Plan card with per-field URL editor
+
+Replaces the XML method's `self/proxied/original` dropdowns and the
+duplicate URL inputs that used to live inside the telnet method pane:
+
+- Target service URL input with `Save as default` (POSTs to
+  `/setup/settings`, preserving the `***` secret-unchanged convention).
+- Capabilities header: detected transports (SSH / Telnet:17000) and
+  the recipes AfterTouch can offer given those transports.
+- Service URLs table: four free-form URL inputs (Marge / Stats /
+  SwUpdate / BmxRegistry) with on-keystroke validation
+  (`validatePlanURLs`), a Soundcork-mode checkbox that flips `/marge`
+  on `margeServerUrl`, and a `Reset to defaults` button.
+- Account pairing section: ID input + Generate + datastore picker;
+  the implicit intent (`readPlanPairTarget`) queues a pair step at
+  Apply when the input differs from the current `account_id`.
+- Suggested plan box: one-click conservative default — XML + HTTP
+  when SSH works, Telnet + HTTP otherwise; "Already migrated" info
+  state when `IsMigrated` is already true.
+
+The per-field URLs feed both XML and Telnet migrations via the
+`marge_url` / `stats_url` / `sw_update_url` / `bmx_url` option family
+(see §9.6). Live preview rewrites `#planned-config` purely client-side
+on every keystroke — optimistic; the backend's perspective gates the
+write via §9.4's pre-flight.
+
+### 9.3 Customize three-axis form
+
+The `<details>` "Customize this migration" section replaces the old
+migration-method dropdown with three independent radio groups:
+
+1. **URL flip transport**: XML / Telnet:17000 / Skip.
+2. **DNS interception**: None / `/etc/resolv.conf` hook.
+3. **Local CA install**: checkbox.
+
+Each option carries a per-axis availability hint
+(`(SSH unreachable)`, `(already trusted)`, etc.) so users see *why*
+an option is disabled. `applyCustomPlan` orchestrates the chosen
+combination as a sequence of existing backend calls
+(`/setup/migrate?method=…` for each flip/resolv step plus
+`/setup/trust-ca` for standalone CA install, and the queued pair
+step from §9.2). Resolv already bundles a CA install, so a redundant
+standalone CA step is skipped. First failure aborts the rest.
+
+### 9.4 Pre-flight panel
+
+Both Apply paths run a visible pre-flight panel before any backend
+operation touches the speaker. Each check renders inline with the
+🕐 / ⟳ / ✅ / ❌ / — idiom. On all-green the panel holds for ~700ms so
+the success state registers, then auto-proceeds. On any failure the
+panel surfaces `Proceed Anyway` / `Cancel` buttons; default is to
+abort.
+
+Checks:
+
+| Check                                 | When                                                       | Backend route                  |
+|---------------------------------------|------------------------------------------------------------|--------------------------------|
+| Backend summary re-check              | always                                                     | `GET /setup/summary`           |
+| HTTPS connection from device          | `ssh_success && server_https_url`                          | `POST /setup/test-connection`  |
+| Reachability check (passive observer) | `telnet_reachable && is_migrated` (see §9.8)               | `POST /setup/peer-probe`       |
+| Round-trip skip explainer             | `telnet_reachable && !is_migrated` — runs after reboot     | _none_ (UI-side skip row)      |
+| DNS redirection from device           | `methods.includes("resolv") && ssh_success`                | `POST /setup/test-dns`         |
+
+The HTTPS check uses `use_explicit_ca=true` so it exercises the trust
+path even when CA install is part of the plan (i.e. forward-looking).
+The reachability skip row is explicit ("neither SSH nor Telnet:17000
+is reachable") rather than silently dropped, per the user's
+"feedback always visible" requirement.
+
+### 9.5 Telnet round-trip probe — the SSH-less reachability check
+
+> **REMOVED — see §9.8.** Empirical testing showed the swUpdate
+> daemon caches its target URL at boot and ignores live config
+> writes, so the active flip described below could never reach the
+> running daemon. The section is retained as a historical record of
+> what was tried; the running code uses the passive observer in §9.8.
+
+The reachability gap §7 left open for USB-unlock-refusing speakers is
+closed by `Manager.RunTelnetRoundTripProbe`
+(`pkg/service/setup/telnet_probe.go`). Sequence:
+
+1. Telnet `getpdo CurrentSystemConfiguration` to capture the
+   speaker's current `swUpdateUrl`.
+2. Generate a random 24-hex-char token; register a one-shot signal
+   channel under it on the new `probeRegistry` (sibling field on
+   `handlers.Server`).
+3. Telnet `sys configuration swUpdateUrl <targetURL>/probe/<token>`
+   — **runtime layer only, deliberately not `envswitch boseurls set
+   …`**. The persistence layer keeps the original URL, so a reboot
+   heals the device naturally if our restore step fails.
+4. `HTTP GET <deviceIP>:8090/swUpdateCheck` — the cleanest
+   `:8090` endpoint that triggers exactly one outbound to the
+   configured `swUpdateUrl`. Read-only on the cloud side
+   (doesn't initiate an update); independent of `margeAccountUUID`
+   so it works on factory-reset speakers.
+5. Wait on the registered channel up to `telnetProbeTimeout` (6s).
+6. Telnet `sys configuration swUpdateUrl <originalURL>` — deferred
+   restore so it runs even on the failure path.
+
+The new `/probe/{token}[/*]` catch-all on the root router signals the
+matching channel when the speaker's outbound lands. The response is
+a minimal `<swUpdateIndex/>` so the speaker's `swUpdateCheck`
+doesn't choke on a missing structure. The `/*` sub-path is
+registered because some firmware appends a path component to the
+configured `swUpdateUrl`.
+
+### 9.6 Backend additions worth knowing
+
+| Addition                                                               | Where                                        | Why                                                                                                                                                                          |
+|------------------------------------------------------------------------|----------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `applyURLOverrides(cfg, options)`                                      | `pkg/service/setup/setup.go`                 | Per-field literal `marge_url` / `stats_url` / `sw_update_url` / `bmx_url` overrides win over `applyProxyOptions`. Honored by both `GetMigrationSummary` and `migrateViaXML`. |
+| `telnetURLsFromOptions(targetURL, options)`                            | `pkg/service/setup/telnet_migration.go`      | Same option family as above, plus envswitch arg derivation rule (arg1 = final Marge verbatim; the soundcork-suffix case drops out).                                          |
+| Per-axis booleans + `IsPaired` + `Warnings`                            | `MigrationSummary`                           | Surfaces partial-state cells and SSH-XML ⇄ telnet-getpdo cross-check disagreements.                                                                                          |
+| `parseGetpdoConfig`                                                    | `pkg/service/setup/preflight_crosscheck.go`  | Parses the Protobuf-text-like nested-block reply (`key { text: "..." }`) FW 27.0.6 actually sends, plus the legacy `key=value` shape as a tolerance path.                    |
+| `peerObserver` + `RunPeerReachabilityProbe` + `/setup/peer-probe`      | `pkg/service/handlers` / `pkg/service/setup` | §9.8. Replaces the removed `probeRegistry` + `RunTelnetRoundTripProbe` + `/setup/telnet-probe` from §9.5.                                                                     |
+| `migrationOptionKeys` allow-list                                       | `pkg/service/handlers/migration_options.go`  | Unknown query keys never reach the manager. Both XML mode keys and `*_url` keys are recognised.                                                                              |
+| Telnet client default timeouts: dial 4s, read 7s, write 3s, idle 600ms | `pkg/telnet/telnet.go`                       | Bumped from the original 2s/5s/2s/400ms after observing transient i/o-timeout flakes on healthy speakers that recovered on retry.                                            |
+
+### 9.7 Future probe candidates
+
+- `:8090/pushCustomerSupportInfoToMarge` — flagged as a potential
+  "ask the device about itself" probe that could feed a richer
+  device-info pane (firmware build dates, hardware revisions). Not
+  implemented.
+- Running the round-trip probe on SSH-capable speakers too (as
+  additional validation alongside the curl-from-device HTTPS test),
+  not just as the SSH-less fallback it is today. **Subsumed by §9.8
+  — the round-trip probe is being removed; the passive observer is
+  transport-agnostic and replaces it for migrated speakers.**
+
+### 9.8 The swUpdate daemon-cache finding and removal of §9.5
+
+The §9.5 round-trip probe was retired after empirical testing on a
+fully-migrated speaker (FW 27.0.6) revealed that the `swUpdate`
+daemon **caches its target URL at boot and ignores live config
+writes**. The diagnostic sequence:
+
+1. Manual telnet flip of both layers — `sys configuration swUpdateUrl
+   <probe-url>` (runtime) **and** `envswitch boseurls set <marge>
+   <probe-url>` (persistence). `getpdo CurrentSystemConfiguration`
+   confirmed both writes stuck.
+2. HTTP GET `:8090/swUpdateCheck` to trigger fan-out.
+3. Service access log showed the device outbound landed on
+   `/updates/soundtouch` (the **previous** `swUpdateUrl` value, current
+   at the last daemon boot) and `/streaming/software/update/account/<id>`
+   (a separate Bose URL the daemon hits, routed to this service by DNS
+   interception). The probe URL was never dialed.
+
+This falsifies the original NEXT.md hypothesis that the persistence
+layer would override the runtime layer for the daemon's fan-out, and
+points instead at daemon-level URL caching. Two consequences:
+
+- **The §9.5 probe cannot work on migrated speakers without a
+  reboot.** The cached URL is set when the daemon starts; flipping
+  config after that point has no effect on what the daemon dials.
+- **The §9.5 probe likely cannot work on unmigrated speakers
+  either**, for the same reason — the daemon caches whatever URL it
+  read at startup, which on an unmigrated speaker is the Bose cloud
+  URL. We have no service running with the probe URL registered on
+  unmigrated speakers, so the original "it worked in testing" claim
+  has no empirical basis; it likely failed silently because nothing
+  was watching.
+
+The honest replacement is a **passive observer** (see
+`pkg/service/setup/peer_probe.go`):
+
+1. Register the device IP with an in-process observer
+   (`handlers.peerObserver`, wired via `PeerObserverMiddleware`).
+2. Nudge `:8090/swUpdateCheck` to make the daemon fan out *something*
+   sooner than its ~5min timer.
+3. Wait up to 30s for any inbound from that IP. On a migrated
+   speaker, DNS interception means the daemon's outbounds (update
+   fan-out, marge polls, BMX registry calls) all funnel through this
+   service regardless of which URL the daemon resolved internally —
+   so reachability reduces to *"did the device dial us at all."*
+
+Endpoint: `POST /setup/peer-probe/{deviceId}`. No device-state
+mutation; safe to re-run. Returns `{ok, result: {reached,
+observed_path, elapsed_ms}, error}` with the same UI keying as the
+old probe (`result.reached`).
+
+#### 9.8.1 The pre-flight panel branch
+
+The web UI's pre-flight orchestrator (`runApplyPreflight` in
+`script.js`) branches on `summary.is_migrated`:
+
+| Migration state                   | Reachability row                                                                                                             |
+|-----------------------------------|------------------------------------------------------------------------------------------------------------------------------|
+| Migrated (`is_migrated=true`)     | "Reachability check (passive observer)" — calls `POST /setup/peer-probe/{deviceId}`.                                         |
+| Not migrated (incl. partial)      | Skip row "Round-trip validation runs after Apply + reboot" with the rationale "daemon caches swUpdateUrl at boot".           |
+
+Per-axis booleans (`xml_migrated`, `hosts_migrated`, `resolv_migrated`,
+`telnet_migrated`) remain visible in the State card, so the user can
+see which parts of the migration are already in place even when the
+overall flag is false. The skip row does not attempt the active probe
+on unmigrated speakers — the canonical telnet flow is:
+
+```
+Apply telnet config → user-initiated reboot → re-run pre-flight on
+the now-migrated speaker → passive observer confirms fan-out.
+```
+
+#### 9.8.2 Removal trail
+
+Removed (or scheduled for removal in a follow-up commit) at the time
+of §9.8 landing:
+
+- `pkg/service/setup/telnet_probe.go` — `RunTelnetRoundTripProbe`,
+  `ProbeRegistrar`, `TelnetProbeResult`, `generateProbeToken`.
+- `pkg/service/handlers/handlers_telnet_probe.go` — `HandleTelnetProbe`,
+  `HandleProbeInbound`, `telnetProbeTimeout`, `telnetProbeResponse`.
+- `pkg/service/handlers/probe_registry.go` — `probeRegistry` + tests.
+- `Server.probes` field.
+- Routes `/probe/{token}`, `/probe/{token}/*`, `/setup/telnet-probe/{deviceId}`.
+- The `target_url` query-param plumbing on the deprecated endpoint.
+- `script.js` — `checkTelnetRoundTrip` (orchestrator call site removed
+  in the commit that added the branch; function itself removed later).
+
+`isCommandNotFound` and `parseGetpdoConfig` stay — they are also used
+by the migration writer (`telnet_migration.go`), preflight reader
+(`telnet_preflight.go`), pairing path (`marge_pairing.go`), and
+cross-check (`preflight_crosscheck.go`).
@@ -0,0 +1,297 @@
+# Bose SoundTouch — Community Tools for Post-EOL Preservation
+
+> **Context:** Bose announced the shutdown of SoundTouch cloud services, extended to **May 6, 2026**. On that date the official SoundTouch app will update to a local-only version. Bose has released the [SoundTouch Web API documentation](https://assets.bosecreative.com/m/496577402d128874/original/SoundTouch-Web-API.pdf) as open-source to enable community-driven development. This document surveys the active community projects, their feature coverage, and open development opportunities.
+
+---
+
+## What Bose Is Doing
+
+After the May 6, 2026 shutdown, the following will **continue to work**:
+
+- Streaming via Bluetooth, AirPlay, Spotify Connect, and AUX
+- Local device control and grouping via an updated SoundTouch app
+- Remote control features (play, pause, skip, volume)
+- HDMI/optical connections on soundbars
+
+The following will **stop working**:
+
+- Physical and app-based presets
+- In-app music service browsing (TuneIn, Pandora, etc.)
+- Stereo pairing for SoundTouch 10
+- Security and firmware updates
+
+---
+
+## Community Projects
+
+### 1. soundcork
+**[github.com/deborahgu/soundcork](https://github.com/deborahgu/soundcork)**
+| | |
+|---|---|
+| Language | Python |
+| License | MIT |
+| Stars | 111 |
+| Contributors | 8 |
+| Commits | 287 |
+| Status | Pre-alpha, actively developed |
+
+A reverse-engineered intercept API that replaces the Bose cloud servers locally. Works by redirecting the speaker's internal `SoundTouchSdkPrivateCfg.xml` to a self-hosted FastAPI server, emulating the `marge` server (required for basic network functionality) and the `bmx` server (required for TuneIn). Deployable as a Docker container or systemd daemon. The most community-engaged project, with a dedicated discussion thread tracking Bose cloud service status.
+
+---
+
+### 2. Überböse API
+**[github.com/julius-d/ueberboese-api](https://github.com/julius-d/ueberboese-api)**
+| | |
+|---|---|
+| Language | Java (Spring Boot) |
+| License | MIT |
+| Stars | 10 |
+| Contributors | 1 |
+| Commits | 224 |
+| Tags/Releases | 163 |
+| Documentation | [julius-d.github.io/ueberboese-api](https://julius-d.github.io/ueberboese-api/) |
+
+Reverse-engineers and rebuilds the Bose streaming HTTP API. Unique in publishing a machine-readable OpenAPI specification (`ueberboese-api.yaml`) and comprehensive request logging — making it the best research instrument for understanding what speakers actually call upstream. Implements Spotify OAuth integration and TuneIn. Companion to the Überböse App.
+
+---
+
+### 3. Überböse App
+**[github.com/julius-d/ueberboese-app](https://github.com/julius-d/ueberboese-app)**
+| | |
+|---|---|
+| Language | Flutter (Dart) |
+| License | MIT |
+| Latest version | 0.26.0 (March 2026) |
+| Distribution | [F-Droid](https://f-droid.org/en/packages/io.github.juliusd.ueberboese.app/) |
+| Platform | Android |
+
+The only native installable phone app in the ecosystem. Pairs with the Überböse API server. Features: preset view/play/reprogram, multi-room zone management, volume control, now-playing display, Spotify authentication setup. Controls speakers directly via the local SoundTouch WebServices API (no server required for basic control).
+
+---
+
+### 4. SoundTouch Hybrid 2026
+**[github.com/TJGigs/Bose-SoundTouch-Hybrid-2026](https://github.com/TJGigs/Bose-SoundTouch-Hybrid-2026)**
+| | |
+|---|---|
+| Language | Node.js (JavaScript) |
+| License | — |
+| Stars | 1 |
+| Commits | 3 (V1) / 12 (V3) |
+| Status | Experimental / testing |
+
+A self-hosted private cloud that emulates and replaces the Bose Cloud Service. Runs locally on a NAS or PC, intercepts the complex server handshakes needed to keep the SoundTouch infrastructure functional. Relies on **Music Assistant** for backend audio routing and provider aggregation. Features a setup wizard including USB config generation (`OverrideSdkPrivateCfg.xml`) and an on-screen Bose Cloud Emulation Setup guide. Targets users who want the broadest streaming provider support via Music Assistant's ecosystem.
+
+---
+
+### 5. OpenCloudTouch (OCT)
+**[github.com/scheilch/opencloudtouch](https://github.com/scheilch/opencloudtouch)**
+| | |
+|---|---|
+| Language | Python (FastAPI) + TypeScript (React) |
+| License | Apache 2.0 |
+| Stars | 9 |
+| Commits | 313 |
+| Latest release | v1.1.1 (April 12, 2026) |
+| Documentation | GitHub Wiki (EN/DE) |
+
+A single Docker container combining a FastAPI backend and React frontend. The most production-ready project in the ecosystem in terms of release discipline and deployment accessibility. Features: internet radio with full hardware preset support (buttons 1–6), responsive web UI, device discovery via SSDP/UPnP, multi-room zone management, BMX-compatible endpoints, TuneIn stream resolver, RadioBrowser as a built-in first-class search provider, and pre-built Raspberry Pi SD card images for Pi 3/4/5. Deployable on amd64, arm64, and arm/v7. Documented in English and German. Spotify and Music Assistant integration are on the roadmap.
+
+---
+
+### 6. AfterTouch
+**[github.com/gesellix/Bose-SoundTouch](https://github.com/gesellix/Bose-SoundTouch)** by gesellix
+| | |
+|---|---|
+| Language | Go |
+| License | MIT |
+| Stars | 16 |
+| Contributors | 2 |
+| Commits | 217 |
+| Releases | 51 (latest: v0.28.0, Feb 15, 2026) |
+| Documentation | [gesellix.github.io/Bose-SoundTouch](https://gesellix.github.io/Bose-SoundTouch/) |
+
+The most comprehensive single toolkit in the ecosystem. Comprises three components: a Go library (importable package), a CLI (`soundtouch-cli`), and a local cloud emulation service (`soundtouch-service`). Covers the widest range of dimensions of any single project. Implements the complete Bose Spotify OAuth relay including surrogate secret generation and token refresh proxy. Includes a built-in DNS server for device redirection without SSH, HTTPS/custom CA injection, HTTP session recording, traffic proxy/logging, and a web management UI. Tested on real SoundTouch 10 and 20 hardware. Has a Patreon for ongoing support.
+
+---
+
+### 7. soundcork-stockholm-app
+**[github.com/krahl/soundcork-stockholm-app](https://github.com/krahl/soundcork-stockholm-app)**
+| | |
+|---|---|
+| Language | Java |
+| License | — |
+| Stars | 2 |
+| Commits | 21 |
+| Status | Active development, bugs expected |
+
+A Java-based middleware that hosts the original Bose Stockholm frontend (extracted from the APK) in a local web browser at `http://127.0.0.1:8088/`. Bridges the Stockholm UI to local speakers via an HTTP proxy that resolves cross-origin issues, with SSDP-based device discovery and JSON state persistence. Unlike every other tool in the ecosystem, it runs the **official Bose UI** rather than a custom replacement — preserving the familiar Bose UX at the cost of requiring the Stockholm APK. Notable limitations: OAuth flows are unreliable, and WebSocket connections to speakers over HTTPS have blocking issues. Works alongside soundcork's backend for full cloud emulation.
+
+---
+
+### 8. jaas666/bose-soundtouch-web-api (Reference)
+**[github.com/jaas666/bose-soundtouch-web-api](https://github.com/jaas666/bose-soundtouch-web-api)**
+
+Community-maintained Markdown conversion of the official Bose SoundTouch Web API PDF (v1.0, January 7, 2026). Useful as a developer reference. Not a deployable tool.
+
+---
+
+## Feature Coverage Matrix
+
+Legend: ● Yes/complete · ◑ Partial/planned · ○ No
+
+| Dimension                                          | soundcork | Überböse API | Überböse App | ST Hybrid 2026 | OpenCloudTouch | AfterTouch | Stockholm App |
+|----------------------------------------------------|:---------:|:------------:|:------------:|:--------------:|:--------------:|:----------:|:-------------:|
+| **① App layer — local HTTP/WS control**            |           |              |              |                |                |            |               |
+| Playback control (play/pause/vol)                  |     ○     |      ○       |      ●       |       ●        |       ●        |     ●      |       ●       |
+| Preset view & trigger                              |     ○     |      ○       |      ●       |       ●        |       ●        |     ●      |       ●       |
+| Preset write / reprogram                           |     ○     |      ○       |      ●       |       ●        |       ◑        |     ●      |       ●       |
+| Multi-room zone management                         |     ○     |      ○       |      ●       |       ●        |       ●        |     ●      |       ●       |
+| Now playing / status display                       |     ○     |      ○       |      ●       |       ●        |       ●        |     ●      |       ●       |
+| Device discovery (SSDP/mDNS)                       |     ○     |      ○       |      ●       |       ○        |       ●        |     ●      |       ●       |
+| WebSocket real-time events                         |     ○     |      ○       |      ◑       |       ●        |       ◑        |     ●      |       ◑       |
+| **② Cloud/service layer — replaces Bose upstream** |           |              |              |                |                |            |               |
+| Marge server emulation                             |     ●     |      ●       |      ○       |       ●        |       ○        |     ●      |       ○       |
+| BMX / content registry                             |     ◑     |      ◑       |      ○       |       ●        |       ●        |     ●      |       ○       |
+| Account / OAuth token relay                        |     ○     |      ●       |      ○       |       ◑        |       ○        |     ●      |       ◑       |
+| Preset sync (cloud-side)                           |     ●     |      ●       |      ○       |       ●        |       ○        |     ●      |       ○       |
+| Recents sync                                       |     ●     |      ◑       |      ○       |       ◑        |       ○        |     ●      |       ○       |
+| Sources / device info persistence                  |     ●     |      ●       |      ○       |       ●        |       ○        |     ●      |       ○       |
+| Stereo group CRUD (ST10 pairs)                     |     ●     |      ○       |      ○       |       ○        |       ○        |     ●      |       ○       |
+| **③ Device redirection — USB/SSH setup**           |           |              |              |                |                |            |               |
+| Setup wizard / guided redirect                     |     ◑     |      ◑       |      ○       |       ●        |       ●        |     ●      |       ○       |
+| USB image / config generation                      |     ○     |      ○       |      ○       |       ●        |       ○        |     ◑      |       ○       |
+| HTTPS / custom CA support                          |     ○     |      ○       |      ○       |       ○        |       ○        |     ●      |       ○       |
+| **④ Streaming provider integration**               |           |              |              |                |                |            |               |
+| Internet radio (RadioBrowser)                      |     ○     |      ◑       |      ◑       |       ◑        |       ●        |     ◑      |       ○       |
+| TuneIn stream resolver                             |     ●     |      ●       |      ●       |       ●        |       ●        |     ●      |       ●       |
+| Spotify OAuth / Connect                            |     ○     |      ●       |      ●       |       ◑        |       ◑        |     ●      |       ◑       |
+| Pandora                                            |     ○     |      ○       |      ○       |       ○        |       ○        |     ●      |       ◑       |
+| Music Assistant backend                            |     ○     |      ○       |      ○       |       ●        |       ◑        |     ○      |       ○       |
+| **⑤ Mobile / native app**                          |           |              |              |                |                |            |               |
+| Android app (installable)                          |     ○     |      ○       |      ●       |       ○        |       ○        |     ○      |       ○       |
+| iOS app                                            |     ○     |      ○       |      ○       |       ○        |       ○        |     ○      |       ○       |
+| Mobile-responsive web UI                           |     ○     |      ○       |      ○       |       ●        |       ●        |     ●      |       ●       |
+| **⑥ Smart home / ecosystem integration**           |           |              |              |                |                |            |               |
+| Home Assistant integration                         |     ○     |      ○       |      ○       |       ○        |       ○        |     ◑      |       ○       |
+| Music Assistant integration                        |     ○     |      ○       |      ○       |       ●        |       ◑        |     ○      |       ○       |
+| **⑦ CLI / automation tools**                       |           |              |              |                |                |            |               |
+| CLI for scripting / automation                     |     ○     |      ○       |      ○       |       ○        |       ○        |     ●      |       ○       |
+| Traffic proxy / API logging                        |     ◑     |      ●       |      ○       |       ○        |       ○        |     ●      |       ◑       |
+| HTTP session recording                             |     ○     |      ○       |      ○       |       ○        |       ○        |     ●      |       ○       |
+| **⑧ Library / SDK**                                |           |              |              |                |                |            |               |
+| Importable library / package                       |     ○     |      ○       |      ○       |       ○        |       ○        |     ●      |       ○       |
+| Published API spec / docs                          |     ○     |      ●       |      ○       |       ○        |       ○        |     ●      |       ○       |
+| Docker deployment                                  |     ●     |      ●       |      ○       |       ●        |       ●        |     ●      |       ●       |
+| Raspberry Pi SD card image                         |     ○     |      ○       |      ○       |       ○        |       ●        |     ○      |       ○       |
+
+---
+
+## Making AfterTouch the One-Stop Solution — Open Tasks
+
+AfterTouch is the strongest single project across the service and developer layers. Its remaining gaps are on the consumer-facing and ecosystem-integration sides.
+
+### Priority 1 — PWA installability
+
+The web UI is already fully responsive — it has Bootstrap grid columns, `@media (max-width: 768px)` and `@media (max-width: 576px)` breakpoints, and a proper viewport meta tag. It works on iPhone and Android browsers today. What's missing is **installability**: no `manifest.json` and no service worker, so it cannot be added to the home screen as a standalone app. Adding these would close the iOS app gap ecosystem-wide (no project has an iOS app) at minimal effort.
+
+### Priority 2 — RadioBrowser as a first-class provider
+
+AfterTouch can proxy and play any stream URL, but there is no built-in station search. OpenCloudTouch's RadioBrowser integration is the reference. Tasks:
+- Wire the [RadioBrowser API](https://www.radio-browser.info/) into the `soundtouch-web` web UI as a browsable/searchable source.
+- Make discovered stations directly presetable to hardware buttons.
+- This is the most common replacement for TuneIn for users who listened to internet radio via presets.
+
+### Priority 3 — Raspberry Pi SD card image
+
+OpenCloudTouch ships a flashable Pi image and it dramatically lowers the barrier for the most common "always-on local server" deployment. AfterTouch already has Docker and a web management UI; this is largely a CI/packaging task:
+- Build a Pi image (using e.g. `pi-gen` or `rpi-imager`-compatible tooling) that boots directly into `soundtouch-service`.
+- Auto-starts on boot, auto-discovers devices, opens the web UI on a known port.
+- Target Pi 3/4/5 with amd64/arm64/arm/v7 variants (mirroring OCT's approach).
+
+### Priority 4 — USB config generation in the web UI
+
+AfterTouch modifies `SoundTouchSdkPrivateCfg.xml` via SSH (`pkg/service/setup/setup.go`) and documents the redirect process thoroughly, but does not yet generate the USB stick content for users without SSH access. A "prepare USB stick" button in the web UI would remove the last manual step:
+- Generate `OverrideSdkPrivateCfg.xml` pre-populated with the running server's URL.
+- Optionally include the custom CA certificate for HTTPS-capable devices.
+- Surface alongside the existing guided migration wizard.
+
+### Priority 5 — Music Assistant integration
+
+SoundTouch Hybrid 2026 uses Music Assistant as its streaming backend, giving access to Apple Music, Deezer, local libraries, and many other providers. A formal Music Assistant **player provider** for AfterTouch would give power users a path to sources beyond Spotify, TuneIn, Pandora, and RadioBrowser. The Music Assistant community has an open discussion thread on this ([#4766](https://github.com/orgs/music-assistant/discussions/4766)).
+
+### Priority 6 — DNS-based migration documentation
+
+AfterTouch includes a built-in DNS server (`ENABLE_DNS_DISCOVERY`, `DNS_BIND_ADDR`, `DNS_UPSTREAM`) that intercepts `*.bose.com` queries and forwards everything else upstream — no Pi-hole, AdGuard, or any other external tool required. The ResolvConf migration path already treats DNS as a first-class option. The remaining gap is awareness: users unfamiliar with the project may not realise no external DNS infrastructure is needed. Tasks:
+- Surface the built-in DNS server more prominently in the getting-started documentation.
+- Document Pi-hole / AdGuard Home as an *alternative* for users who already run those, not a requirement.
+
+### Priority 7 — MQTT integration
+
+A design document exists (`docs/guides/MQTT-INTEGRATION-DESIGN.md`) but no code has been written. Implementing it would unlock home automation use cases without requiring the full Home Assistant stack — enabling triggers like "play preset 1 when front door opens" via any MQTT-capable automation platform.
+
+---
+
+## soundcork ↔ AfterTouch
+
+soundcork and AfterTouch share the most functional overlap of any two projects in the ecosystem. For the implementation-level parity analysis and remaining tasks see [docs/PARITY-SOUNDCORK.md](../PARITY-SOUNDCORK.md).
+
+### Architectural differences (not gaps)
+
+These exist in soundcork but are deliberate architectural choices in AfterTouch, not missing features:
+
+| Area                     | soundcork                             | AfterTouch                                                |
+|--------------------------|---------------------------------------|-----------------------------------------------------------|
+| Web UI                   | FastAPI + Jinja2 miniapp and admin UI | Separate `soundtouch-web` component (Go + plain HTML/JS)  |
+| Direct device management | SSH/SCP access into speakers          | HTTP API only; no SSH                                     |
+| Device discovery client  | Python `upnpclient` library           | mDNS + UPnP in Go, with dedicated DNS interception server |
+| Token delivery           | Push (ZeroConf priming to port 8200)  | Pull (device calls back to fetch)                         |
+| Persistence format       | Flat files                            | XML flat files + atomic writes                            |
+
+### AfterTouch capabilities soundcork lacks
+
+| Feature                                   | Notes                                                           |
+|-------------------------------------------|-----------------------------------------------------------------|
+| DNS server for device redirect            | Intercepts Bose domain queries; no Pi-hole required             |
+| HTTPS / custom CA injection               | Full TLS with certificate generation and trust workflow         |
+| HTTP interaction recording & replay       | Captures real device traffic for debugging and regression tests |
+| Device migration (serial → MAC path)      | Handles legacy device ID formats automatically                  |
+| Transparent proxy mode with upstream sync | Can mirror to real Bose cloud while running locally             |
+| CLI (`soundtouch-cli`)                    | Scriptable control of speakers                                  |
+| Importable Go library                     | `github.com/gesellix/bose-soundtouch/pkg/client`                |
+
+---
+
+
+
+### Ecosystem fragmentation vs. convergence
+
+The community is currently covering different parts of the problem in parallel rather than converging. AfterTouch explicitly credits soundcork, Überböse, and SoundTouch Plus in its README and describes its `soundtouch-service` as "heavily inspired by SoundCork". There is an opportunity — and arguably a need — for these projects to formally coordinate: shared test fixtures, a common compatibility matrix against specific firmware versions, and agreed-on API contracts would all reduce duplicated effort.
+
+### Firmware version sensitivity
+
+The SoundTouch 10 is most dependent on Marge for basic network functionality; the 20 and 30 are somewhat more tolerant. Compatibility across firmware versions is not systematically documented anywhere. A community firmware compatibility matrix (model × firmware version × which emulation features work) would be high value and is currently missing.
+
+### Security posture
+
+All projects warn that speakers should only be used on a private, firewalled network after cloud shutdown. AfterTouch is the only project to implement HTTPS/custom CA, which matters if devices are ever on a network where traffic could be inspected. soundcork's SECURITY.md explicitly warns against running on open networks.
+
+### No iOS app — a structural gap
+
+The original SoundTouch app was iOS-first. Every community replacement is Android-only (Überböse App) or browser-based. This is the largest unaddressed user segment in the ecosystem.
+
+### Bose's open-source move as a precedent
+
+Bose's decision to release API documentation rather than simply shutting down is notable — it mirrors what Pebble users did themselves with Rebble after that shutdown, but here the manufacturer initiated it. This sets a useful precedent and gives the community a solid legal and technical foundation to build on.
+
+### Related community resources
+
+- [Bose SoundTouch Plus (Home Assistant component)](https://github.com/thlucas1/homeassistantcomponent_soundtouchplus) — comprehensive HA integration by Todd Lucas, extensive API wiki
+- [Bose SoundTouch Hook](https://github.com/CodeFinder2/bose-soundtouch-hook) — `LD_PRELOAD`-based reverse engineering framework used by AfterTouch for protocol research
+- [Bose SoundTouch Web API (community Markdown)](https://github.com/jaas666/bose-soundtouch-web-api) — official API PDF converted to Markdown
+- [Bose Wiki — SoundTouch App Alternatives](https://bose.fandom.com/wiki/SoundTouch_app_alternatives) — community-maintained living list of workarounds and projects
+- [Reddit megathread — Bose alternatives](https://www.reddit.com/r/bose) — ongoing community discussion
+- [Radio Browser](https://www.radio-browser.info/) — the free, community-maintained internet radio directory used as a TuneIn replacement
+
+---
+
+*Document compiled April 2026. Project details sourced directly from GitHub repositories and official documentation. Star counts, commit counts, and release dates reflect the state at time of writing and will change as projects evolve. soundcork-stockholm-app added April 2026.*
@@ -185,7 +185,7 @@ type NowPlaying struct {
 type PlayStatus string
 const (
    PlayStatusPlaying PlayStatus = "PLAY_STATE"
-    PlayStatusPaused  PlayStatus = "PAUSE_STATE" 
+    PlayStatusPaused  PlayStatus = "PAUSE_STATE"
    PlayStatusStopped PlayStatus = "STOP_STATE"
 )

@@ -277,19 +277,19 @@ type Config struct {
    // Server configuration
    WebPort      int           `env:"WEB_PORT" default:"8080"`
    APITimeout   time.Duration `env:"API_TIMEOUT" default:"10s"`
-    
-    // Discovery configuration  
+
+    // Discovery configuration
    DiscoveryTimeout time.Duration `env:"DISCOVERY_TIMEOUT" default:"5s"`
    CacheDevices     bool          `env:"CACHE_DEVICES" default:"true"`
    CacheTTL         time.Duration `env:"CACHE_TTL" default:"5m"`
-    
+
    // CORS configuration (for web proxy)
    CORSOrigins      []string `env:"CORS_ORIGINS" default:"*"`
-    
+
    // Logging
    LogLevel    string `env:"LOG_LEVEL" default:"info"`
    LogFormat   string `env:"LOG_FORMAT" default:"json"`
-    
+
    // Development
    DevMode     bool `env:"DEV_MODE" default:"false"`
 }
@@ -537,7 +537,7 @@ build-all: build-linux build-darwin build-windows
 dev-cli:
 	air -c .air-cli.toml

-dev-webapp: 
+dev-webapp:
 	air -c .air-webapp.toml

 dev-wasm:
@@ -556,7 +556,7 @@ check: fmt vet lint test

 # Docker development environment
 docker-dev:
-	docker-compose up --build
+	docker compose up --build

 # Release packaging
 release: build-all
@@ -596,7 +596,7 @@ import (
    "fmt"
    "log"
    "time"
-    
+
    "github.com/gesellix/bose-soundtouch/pkg/client"
    "github.com/gesellix/bose-soundtouch/pkg/discovery"
    "github.com/gesellix/bose-soundtouch/pkg/models"
@@ -609,36 +609,36 @@ func main() {
    if err != nil {
        log.Fatal(err)
    }
-    
+
    if len(devices) == 0 {
        log.Fatal("No SoundTouch devices found")
    }
-    
+
    // Create client for first device
    client := client.NewClient(client.ClientConfig{
        Host:    devices[0].Host,
        Port:    8090,
        Timeout: 10 * time.Second,
    })
-    
+
    // Get device info
    info, err := client.GetDeviceInfo()
    if err != nil {
        log.Fatal(err)
    }
    fmt.Printf("Connected to: %s\n", info.Name)
-    
+
    // Get current playback
    nowPlaying, err := client.GetNowPlaying()
    if err != nil {
        log.Fatal(err)
    }
-    
+
    if nowPlaying.PlayStatus == models.PlayStatusPlaying {
-        fmt.Printf("Playing: %s - %s (%s)\n", 
+        fmt.Printf("Playing: %s - %s (%s)\n",
            nowPlaying.Artist, nowPlaying.Track, nowPlaying.Album)
    }
-    
+
    // Control playback
    if nowPlaying.PlayStatus == models.PlayStatusPlaying {
        client.SendKey(models.KeyPause)
@@ -737,11 +737,11 @@ docker run -p 8080:8080 soundtouch-webapp
 ```bash
 # Local development with hot reload
 make dev-webapp    # Web app development
-make dev-wasm      # WASM development  
+make dev-wasm      # WASM development
 make dev-cli       # CLI development

 # Full development environment
-docker-compose up  # Mock devices + web app
+docker compose up  # Mock devices + web app
 ```

 ## Success Criteria
@@ -781,7 +781,7 @@ docker-compose up  # Mock devices + web app

 - [Bose SoundTouch Web API Documentation](https://assets.bosecreative.com/m/496577402d128874/original/SoundTouch-Web-API.pdf)
 - [Go WebAssembly](https://github.com/golang/go/wiki/WebAssembly)
- [UPnP Device Architecture](http://upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.0.pdf) 
+- [UPnP Device Architecture](http://upnp.org/specs/arch/UPnP-arch-DeviceArchitecture-v1.0.pdf)
 - [Go Embed Directive](https://pkg.go.dev/embed)
 - [Gorilla WebSocket](https://github.com/gorilla/websocket)
 - [PROJECT-PATTERNS.md](../PROJECT-PATTERNS.md) - Detailed pattern documentation
@@ -0,0 +1,369 @@
+# Amazon Music OAuth Integration
+
+This document describes the plan and specification for adding Amazon Music OAuth support to the SoundTouch service, enabling continued Amazon Music playback after the Bose cloud shutdown (May 2026).
+
+The implementation mirrors the [Spotify OAuth integration](spotify-oauth.md) closely. Read that document first — this one calls out only the differences.
+
+## Status
+
+**Infrastructure complete — streaming blocked by API access.**
+
+All eight implementation steps are done. The OAuth flow (account linking, token storage, token refresh) works end-to-end with a standard Login with Amazon app. Token exchange (`/oauth/device/.../token/cs1`) succeeds and the speaker receives a valid `Atza|` access token.
+
+However, real-world testing shows that the speaker then calls `https://music-api.amazon.com/` with that token and receives a `401 Unauthorized` (no redirect to a regional endpoint). This means the token does not carry the scopes required to access the Amazon Music streaming API.
+
+**Root cause (confirmed):** Amazon Music streaming requires the `amazon_music:access` scope, which is only available to **device client IDs** — a separate credential type obtained through Amazon's Music partner programme. Standard Login with Amazon application client IDs (`amzn1.application-oa2-client.*`) cannot request this scope: attempting to include it in the authorization URL returns `lwa-invalid-parameter-bad-scope` (HTTP 400) from the LWA authorization endpoint. Bose would have held a device client ID as a registered Amazon Music partner.
+
+**What still works:**
+- Account linking and token storage
+- Token refresh (the service correctly exchanges the refresh token for a fresh access token)
+- Marge source registration (the speaker sees Amazon Music as a configured source)
+
+**What does not work:**
+- Actual music playback — the speaker's `AmazonClient` cannot authenticate to `music-api.amazon.com` with a standard LWA token
+
+**Path forward:** Obtaining a device client ID requires registering with Amazon's Music partner programme. If such a credential is obtained, the only code change needed is swapping the `client_id`/`client_secret` for the device credentials and adding `amazon_music:access` to `AmazonScopes` in `pkg/service/amazon/service.go` — everything else is already in place. The `site_id` field is a secondary open question that may also affect regional routing once the scope issue is resolved.
+
+---
+
+## Secret Format (confirmed from a live Bose system)
+
+A real Amazon source entry from a migrated device's `Sources.xml`:
+
+```xml
+<source secretType="token">
+    <credential type="token">{"AmazonSecret":{"refresh_token":"Atzr|...","site_id":"1464855981"}}</credential>
+    <sourceKey type="AMAZON" account="user@example.com"/>
+</source>
+```
+
+Key observations:
+
+- **Secret envelope**: `{"AmazonSecret":{"refresh_token":"...","site_id":"..."}}` — JSON-encoded, HTML-entity-escaped in XML attributes, stored as the credential value.
+- **`Atzr|` prefix**: This is the standard Amazon LWA (Login with Amazon) refresh token prefix from the **authorization code grant** — confirming that Web OAuth is the correct flow, not CBL.
+- **`site_id`**: A numeric string (`"1464855981"`). Origin is not yet fully confirmed; candidates are:
+  - A static Bose partner identifier baked into the Bose app/firmware (same value for all users), or
+  - A per-user Amazon Music identifier returned by a Music API device registration call.
+  - Needs verification — possibly obtained by calling the Amazon Music API after initial authentication.
+- **`account` field**: The user's Amazon email address (obtained from the LWA `/user/profile` endpoint).
+
+When `HandleBoseAmazonToken` receives a refresh request from the speaker, it must:
+1. Parse the `AmazonSecret` JSON from the stored credential to extract `refresh_token`.
+2. Call the LWA token endpoint with a `refresh_token` grant.
+3. Return the fresh `access_token` to the speaker.
+4. Persist the rotated `refresh_token` back into the `AmazonSecret` envelope.
+
+---
+
+## How the Speaker Uses This
+
+When the SoundTouch firmware tries to play Amazon Music after migration, it sends a token refresh request to the local service:
+
+```
+POST /oauth/device/{deviceID}/music/musicprovider/20/token/cs1
+```
+
+The service must respond with a fresh Amazon access token. The speaker then uses that token directly with Amazon's playback infrastructure.
+
+The `cs1` suffix (credential schema 1) is Amazon-specific; Spotify uses `cs3`. This route is already registered.
+
+> **DNS note:** The speaker constructs the OAuth hostname by appending `oauth` to the streaming service subdomain. If the service is reachable at `myhost.local`, the speaker will call `myhostoauth.local`. A DNS alias pointing `myhostoauth.<domain>` to the same IP as the service is required.
+
+---
+
+## OAuth Flows
+
+### 1. Browser-based Flow
+
+```mermaid
+sequenceDiagram
+    participant Client as Client (curl/app)
+    participant Service as Service
+    participant Amazon as Amazon Auth Server (LWA)
+    participant Browser as User's Browser
+
+    Client->>Service: POST /mgmt/amazon/init [Basic Auth]
+    Service-->>Client: {"redirectUrl": "https://www.amazon.com/ap/oa?..."}
+
+    Client->>Browser: User opens URL
+    Browser->>Amazon: User logs in & grants access
+    Amazon-->>Browser: Redirect to /mgmt/amazon/callback?code=abc
+
+    Browser->>Service: GET /mgmt/amazon/callback?code=abc
+    Note over Service: No auth needed for callback
+
+    Service->>Amazon: POST /auth/o2/token (exchange code)
+    Amazon-->>Service: {access_token, refresh_token}
+
+    Service->>Amazon: GET /user/profile (fetch profile)
+    Amazon-->>Service: {user_id, name, email}
+
+    Note over Service: Store account to disk
+
+    Service-->>Browser: HTML: "Amazon Music Connected. You can close this window."
+```
+
+### 2. Mobile App Flow (ueberboese)
+
+```mermaid
+sequenceDiagram
+    participant App as ueberboese Flutter App
+    participant Service as Service
+    participant Amazon as Amazon Auth Server (LWA)
+
+    App->>Service: POST /mgmt/amazon/init [Basic Auth]
+    Service-->>App: {"redirectUrl": "https://www.amazon.com/ap/oa?..."}
+
+    App->>Amazon: Open in-app browser (User authorizes)
+    Amazon-->>App: Deep link redirect: ueberboese-login://amazon?code=abc
+
+    App->>Service: POST /mgmt/amazon/confirm?code=abc [Basic Auth]
+
+    Service->>Amazon: POST /auth/o2/token (exchange code)
+    Amazon-->>Service: {access_token, refresh_token}
+
+    Service->>Amazon: GET /user/profile (fetch profile)
+    Amazon-->>Service: {profile}
+
+    Service-->>App: {"ok": true}
+```
+
+### 3. Token Retrieval (Speaker Token Refresh)
+
+```mermaid
+sequenceDiagram
+    participant Speaker as SoundTouch Speaker
+    participant Service as Service
+    participant Amazon as Amazon Token API (LWA)
+
+    Speaker->>Service: POST /oauth/device/{deviceID}/music/musicprovider/20/token/cs1
+    Note over Service: Body contains stored AmazonSecret JSON;<br/>extract refresh_token from {"AmazonSecret":{...}}
+
+    alt Token expired or near expiry
+        Service->>Amazon: POST /auth/o2/token (refresh_token grant, body credentials)
+        Amazon-->>Service: {access_token, refresh_token, expires_in}
+        Note over Service: Persist rotated refresh_token back into AmazonSecret envelope
+    end
+
+    Service-->>Speaker: {"access_token": "...", "token_type": "Bearer", "expires_in": 3600}
+```
+
+---
+
+## Implementation Steps
+
+### Step 1 — Extract ZeroConf into a shared package
+
+**Why first:** The DH-blob encryption in `pkg/service/spotify/zeroconf.go` is entirely provider-agnostic. Extracting it to `pkg/service/zeroconf/` before adding Amazon avoids duplicating ~200 lines of crypto code.
+
+**What changes:**
+- Create `pkg/service/zeroconf/zeroconf.go` — move `generateDHKeyPair`, `computeSharedSecret`, `deriveKeys`, `buildCredentialsBlob`, `encryptBlob` and helpers. Expose `authType` as a parameter (Spotify and Amazon both use `AuthTypeOAuthToken = 4`, but this makes it explicit).
+- Update `pkg/service/spotify/zeroconf.go` — delete moved code; `PushSpotifyCredentials` becomes a one-line wrapper calling `zeroconf.PushCredentials(...)`.
+
+### Step 2 — Create `pkg/service/amazon/service.go`
+
+Mirror `pkg/service/spotify/service.go`. The `Account` struct is identical; copy it unchanged.
+
+**Amazon-specific differences:**
+
+| Item                      | Spotify                                  | Amazon                                          |
+|---------------------------|------------------------------------------|-------------------------------------------------|
+| Authorization URL         | `https://accounts.spotify.com/authorize` | `https://www.amazon.com/ap/oa`                  |
+| Token endpoint            | `https://accounts.spotify.com/api/token` | `https://api.amazon.com/auth/o2/token`          |
+| Profile endpoint          | `https://api.spotify.com/v1/me`          | `https://api.amazon.com/user/profile`           |
+| Token request credentials | HTTP Basic Auth (clientID:clientSecret)  | POST body fields `client_id` / `client_secret`  |
+| Profile fields            | `id`, `display_name`, `email`            | `user_id`, `name`, `email`                      |
+| Scopes                    | `streaming user-read-private ...`        | `profile` (expand to `music::*` when available) |
+| Entity resolution         | `ResolveEntity()` via Spotify API        | Not implemented (API in closed beta)            |
+
+Accounts persist to `{dataDir}/amazon/accounts.json`.
+
+The token request credential difference (body vs. Basic Auth) is the most important implementation detail.
+
+### Step 3 — Create `pkg/service/amazon/zeroconf.go`
+
+A single exported function `PushAmazonCredentials(zcBaseURL, username, accessToken string) error` delegating to the shared `zeroconf.PushCredentials(...)`.
+
+### Step 4 — Implement `HandleBoseAmazonToken`
+
+Replace the 501 stub in `pkg/service/handlers/handlers_oauth.go` with the full mirror of `HandleBoseSpotifyToken`:
+- Parse body for `refresh_token` / `code`
+- Look up account by BoseSecret; refresh and return token
+- Fall back to first account via `GetFreshToken()` if no matching account
+- Fall back to `HandleBoseProxy` if no Amazon service is configured
+- **Omit `scope` from the response** — Amazon Music scopes are undocumented; sending invented values risks firmware rejection
+
+### Step 5 — Add Amazon fields to `Server`
+
+In `pkg/service/handlers/server.go`, add alongside the Spotify fields:
+
+```go
+amazonClientID     string
+amazonClientSecret string
+amazonRedirectURI  string
+amazonService      *amazon.Service
+```
+
+Add methods: `SetAmazonConfig`, `SetAmazonService`, `IsAmazonConfigured`, `PrimeDeviceWithAmazon`.
+
+### Step 6 — Add management handlers
+
+In `pkg/service/handlers/handlers_mgmt.go`, add six handlers mirroring Spotify:
+
+| Handler                       | Notes                                   |
+|-------------------------------|-----------------------------------------|
+| `HandleMgmtAmazonInit`        | Returns LWA authorize URL               |
+| `HandleMgmtAmazonCallback`    | No auth; calls `bridgeAmazonToMarge`    |
+| `HandleMgmtAmazonConfirm`     | Basic Auth; calls `bridgeAmazonToMarge` |
+| `HandleMgmtAmazonAccounts`    | Returns account list (tokens stripped)  |
+| `HandleMgmtAmazonToken`       | Returns fresh access token              |
+| `HandleMgmtPrimeDeviceAmazon` | Pushes token to speaker via ZeroConf    |
+
+`bridgeAmazonToMarge` must encode the stored secret as `{"AmazonSecret":{"refresh_token":"<token>","site_id":"<id>"}}` and use `CredentialTypeToken` ("token") — **not** `CredentialTypeTokenV3`. Amazon uses `cs1` semantics.
+
+### Step 7 — Wire CLI flags and router
+
+**`main.go` flags** (env vars in parentheses):
+- `--amazon-client-id` (`AMAZON_CLIENT_ID`)
+- `--amazon-client-secret` (`AMAZON_CLIENT_SECRET`)
+- `--amazon-redirect-uri` (`AMAZON_REDIRECT_URI`, default: `ueberboese-login://amazon`)
+- `--amazon-token-url` (`AMAZON_TOKEN_URL`, for testing overrides)
+- `--amazon-profile-url` (`AMAZON_PROFILE_URL`, for testing overrides)
+
+**Router** (`setupRouter`): Add `/mgmt/amazon/*` sub-routes next to the Spotify block. The `/oauth/.../token/cs1` route is already registered and dispatches to `HandleBoseAmazonToken`.
+
+**`pkg/service/marge/marge.go`**: Extend the `AddSource` provider-label branch to map `AmazonProviderID (20) → "AMAZON"` so stored sources carry the correct type string rather than the raw numeric ID.
+
+**`pkg/models/account.go`**: Add `NewAmazonOAuthCredentials` with `Source: "AMAZON"`, `Version: "token"`.
+
+### Step 8 — Tests
+
+Mirror the Spotify test suite for the Amazon package:
+
+- `TestBuildAuthorizeURL` — verify LWA URL structure
+- `TestExchangeCodeAndStore` — mock token + profile servers; assert POST body credentials (not Basic Auth)
+- `TestRefreshAccessToken` — verify body credentials, token rotation
+- `TestGetFreshToken*` — copy Spotify variants verbatim
+- `TestSaveAndLoad` — verify persistence under `amazon/accounts.json`
+
+Add `pkg/testutils/amazon/handlers.go` and `tests/integration/mocks/amazon.go` mock servers mirroring the Spotify equivalents.
+
+Update `cmd/soundtouch-service/testdata/router_routes.txt` snapshot after wiring.
+
+---
+
+## Trying It Out
+
+### 1. Create a Login with Amazon (LWA) app
+
+Go to [developer.amazon.com](https://developer.amazon.com) → **Login with Amazon** → **Create a New Security Profile**.
+
+You will receive a **Client ID** and **Client Secret**. Under *Web Settings*, add an **Allowed Return URL** that matches `--amazon-redirect-uri`:
+
+- **Browser flow** (easiest to test): `http://<your-host>:8000/mgmt/amazon/callback`
+- **Mobile deep-link flow**: `ueberboese-login://amazon` (the default)
+
+The `profile` scope is sufficient — `music::` scopes are in closed beta and not required. The service only brokers tokens; the speaker communicates with Amazon's playback infrastructure directly.
+
+### 2. Start the service
+
+```bash
+./soundtouch-service \
+  --amazon-client-id  amzn1.application-oa2-client.xxx \
+  --amazon-client-secret yyy \
+  --amazon-redirect-uri http://<your-host>:8000/mgmt/amazon/callback
+```
+
+Or set the equivalent environment variables: `AMAZON_CLIENT_ID`, `AMAZON_CLIENT_SECRET`, `AMAZON_REDIRECT_URI`.
+
+### 3. Trigger the OAuth flow
+
+```bash
+# Get the LWA authorization URL
+curl -u admin:change_me! -X POST http://localhost:8000/mgmt/amazon/init
+# → {"redirectUrl":"https://www.amazon.com/ap/oa?client_id=...&scope=profile&..."}
+```
+
+Open the `redirectUrl` in a browser, log in with your Amazon account, and authorize the app. Amazon redirects back to `/mgmt/amazon/callback`, which responds with an HTML page saying "Amazon Music Connected".
+
+### 4. Verify the account is linked
+
+```bash
+curl -u admin:change_me! http://localhost:8000/mgmt/amazon/accounts
+# → {"accounts":[{"user_id":"amzn1.account.xxx","display_name":"Your Name","email":"you@example.com",...}]}
+```
+
+### 5. Prime a speaker
+
+```bash
+# Discover device IDs first
+curl -u admin:change_me! http://localhost:8000/mgmt/accounts/default/speakers
+
+# Push the token to a specific speaker via ZeroConf
+curl -u admin:change_me! -X POST \
+  "http://localhost:8000/mgmt/amazon/prime?deviceId=<deviceId>"
+# → {"status":"Priming triggered"}
+```
+
+### 6. Verify token refresh from the speaker
+
+Once a speaker has Amazon Music as a source, it will periodically POST to:
+
+```
+POST /oauth/device/{deviceID}/music/musicprovider/20/token/cs1
+```
+
+The service looks up the account by refresh token, refreshes it via LWA, and returns a fresh `access_token`. Check the service logs for `[Amazon]` entries confirming this flow.
+
+### DNS requirement
+
+The speaker derives the OAuth hostname by appending `oauth` to its configured streaming subdomain. If the service is at `myhost.local`, the speaker calls `myhostoauth.local`. A DNS alias pointing `myhostoauth.<domain>` to the same IP is required — the built-in DNS discovery server handles this automatically when `--dns-discovery` is enabled.
+
+### Open question: `site_id`
+
+The `AmazonSecret` credential envelope contains a `site_id` field (e.g. `"1464855981"` seen in a real migrated device). Its origin is unconfirmed — it may be a static Bose partner ID or a per-user Amazon Music identifier. The service currently stores an empty string.
+
+Real-world testing shows the device's `AmazonClient` calls `CheckBaseUrlRedirect` with empty `data` (the `site_id`) and then tries `https://music-api.amazon.com/` directly, receiving a 401 with no redirect to a regional endpoint (e.g. `music-api.amazon.de` for a German account). This suggests that:
+
+1. A correct `site_id` might cause the device to use the right regional endpoint instead of the US default.
+2. Even so, the token scope issue (see Status above) would still block playback — resolving `site_id` alone is not sufficient.
+
+`site_id` is likely secondary to the partner scope problem. It remains an open question for the post-scope-resolution phase.
+
+---
+
+## Endpoints
+
+| Method | Path                                                        | Auth  | Purpose                                            |
+|--------|-------------------------------------------------------------|-------|----------------------------------------------------|
+| `POST` | `/oauth/device/{deviceID}/music/musicprovider/20/token/cs1` | None  | Token refresh from speaker                         |
+| `GET`  | `/mgmt/amazon/callback`                                     | None  | Browser OAuth callback (redirect from Amazon LWA)  |
+| `POST` | `/mgmt/amazon/init`                                         | Basic | Start OAuth flow, returns authorization URL        |
+| `POST` | `/mgmt/amazon/confirm`                                      | Basic | Mobile app confirm (deep link delivers code)       |
+| `GET`  | `/mgmt/amazon/accounts`                                     | Basic | List linked Amazon accounts (tokens stripped)      |
+| `GET`  | `/mgmt/amazon/token`                                        | Basic | Get fresh access token (auto-refreshes if expired) |
+| `POST` | `/mgmt/amazon/prime`                                        | Basic | Push token to speaker via ZeroConf                 |
+
+## Security
+
+Same model as Spotify:
+- `/mgmt/amazon/callback` is intentionally outside Basic Auth to allow direct redirects from Amazon's authorization server.
+- All other `/mgmt/*` endpoints require Basic Auth.
+- Accounts persist to `{dataDir}/amazon/accounts.json` with `0600` permissions.
+- `GetAccounts` strips `AccessToken` and `RefreshToken` from responses.
+
+## Key Design Decisions
+
+**Secret is a JSON envelope, not a bare token.** The stored credential is `{"AmazonSecret":{"refresh_token":"Atzr|...","site_id":"..."}}`, HTML-entity-escaped when written to XML attributes. This was confirmed from a real migrated device's `Sources.xml`. `HandleBoseAmazonToken` must parse this structure to extract the `refresh_token`, and `bridgeAmazonToMarge` must produce it when storing after OAuth.
+
+**`site_id` origin is unconfirmed.** It may be a static Bose partner ID or a per-user Amazon Music identifier. Needs verification — likely obtained by calling the Amazon Music API or the LWA profile endpoint post-authentication.
+
+**Credential type is `token`, not `token_version_3`.** `CredentialTypeTokenV3` is Spotify-specific (`cs3`). Amazon uses `cs1`, which maps to the plain `CredentialTypeToken` ("token") constant. Do not upgrade Amazon credentials to v3 in `marge.go`.
+
+**POST body credentials, not Basic Auth.** The Amazon LWA token endpoint (`/auth/o2/token`) expects `client_id` and `client_secret` as POST body fields, not as an HTTP Basic Auth header. This is the single most important difference from the Spotify implementation.
+
+**No entity resolution.** `ResolveEntity()` is not implemented for Amazon — the Amazon Music API is in closed beta. Return HTTP 501 if an entity endpoint is ever requested.
+
+**`scope` omitted from token response.** The Spotify handler returns a hardcoded scope string. Amazon Music scopes for playback are undocumented; returning an empty or absent `scope` is safer than inventing values.
+
+**ZeroConf extraction is a prerequisite.** The DH-blob crypto in `spotify/zeroconf.go` should be extracted to a shared package before Amazon is added to avoid duplicating cryptographic code.
@@ -1,5 +1,10 @@
 # Spotify OAuth Integration

+> **New here?** Start with [spotify-overview.md](spotify-overview.md) for the
+> mental model (Spotify Connect vs OAuth-intercept, DNS rewrite gotcha,
+> end-to-end token lifecycle). This document zooms in on the OAuth flows and
+> management endpoints.
+
 The SoundTouch service supports Spotify OAuth integration to broker access tokens for SoundTouch speakers. This is particularly useful for maintaining Spotify Connect functionality after the Bose cloud shutdown (scheduled for May 2026).

 ## OAuth Flows
@@ -91,43 +96,23 @@ sequenceDiagram
    Note over Speaker: Speaker now has Spotify access
 ```

-## Boot Primer Script
+## Priming Speakers

-A boot primer script that uses these endpoints to feed Spotify tokens to speakers via ZeroConf is available in the `scripts/spotify/` directory: [spotify-boot-primer.sh](../../scripts/spotify/spotify-boot-primer.sh).
-
-This script can be installed on the speaker itself (which runs embedded Linux) to automatically prime Spotify Connect at boot time. See [README.md](../../scripts/spotify/README.md) and [INSTALL.md](../../scripts/spotify/INSTALL.md) for instructions.
-
-### Automated Installation via Service
-
-The SoundTouch service provides a dedicated management endpoint to automatically handle the installation of the Spotify boot primer on the speaker:
-`POST /mgmt/devices/{deviceId}/spotify/install-primer`
-
-### Automated Installation Steps
-When you run the Spotify primer installation, the service performs the following:
-1.  **Directories**: Creates `/mnt/nv/bin` and `/mnt/nv/BoseApp-Persistence/1` on the speaker.
-2.  **Binary**: Uploads the `spotify-boot-primer` script to the speaker.
-3.  **Configuration**: Automatically generates and uploads `spotify-primer.conf` containing the service's URL and management credentials.
-4.  **Boot Hook**: Injects a call to the primer in the speaker's `/mnt/nv/rc.local` using idempotent markers.
-5.  **Environment**: Updates `/mnt/nv/.profile` to include `/mnt/nv/bin` in the `PATH` for easier manual troubleshooting via SSH.
-
- **Idempotent Patching**: The service uses explicit markers to inject the hook, ensuring it doesn't corrupt existing content.
- **Coexistence**: The service-injected hook is designed to coexist with a manually installed `rc.local` (e.g., from the community gist). It only adds a call to `/mnt/nv/bin/spotify-boot-primer` if it's not already managed by a service-controlled block.
- **Markers**: Look for the following markers in your speaker's `/mnt/nv/rc.local`:
-  - `# --- Aftertouch Spotify hook START ---`
-  - `# --- Aftertouch Spotify hook END ---`
- **Cleanup**: Reverting a migration via the service will cleanly remove these marker-delimited blocks.
+> **Note:** The on-device boot-primer flow (installing `spotify-boot-primer.sh` onto the speaker's `/mnt/nv` and hooking it from `rc.local`) is **deprecated**. AfterTouch now uses a server-centric model: the service registers a `SPOTIFY` source in marge for the device's paired account and pushes credentials via ZeroConf from the server side, triggered on `power_on` and a manual "Prime" action. See [spotify-priming-strategy.md](spotify-priming-strategy.md) for the current model and rationale.
+>
+> The artifacts under `scripts/spotify/` are kept as historical reference for users who still rely on the on-device approach. There is no longer a `/mgmt/devices/{deviceId}/spotify/install-primer` endpoint.

 ## Endpoints

 | Method | Path                                              | Auth  | Purpose                                                               |
 |--------|---------------------------------------------------|-------|-----------------------------------------------------------------------|
-| POST   | `/mgmt/devices/{deviceId}/spotify/install-primer` | Basic | Install Spotify boot primer on speaker (deviceId or IP)               |
-| GET    | `/mgmt/spotify/callback`                          | None  | Browser OAuth callback (redirect from Spotify, returns HTML)          |
 | POST   | `/mgmt/spotify/init`                              | Basic | Start OAuth flow, returns authorization URL                           |
+| GET    | `/mgmt/spotify/callback`                          | None  | Browser OAuth callback (redirect from Spotify, returns HTML)          |
 | POST   | `/mgmt/spotify/confirm`                           | Basic | Mobile app confirm (ueberboese deep link delivers code, returns JSON) |
 | GET    | `/mgmt/spotify/accounts`                          | Basic | List linked Spotify accounts (tokens stripped)                        |
 | GET    | `/mgmt/spotify/token`                             | Basic | Get fresh access token (auto-refreshes if expired)                    |
 | POST   | `/mgmt/spotify/entity`                            | Basic | Resolve Spotify URI to name + image URL                               |
+| POST   | `/mgmt/spotify/prime`                             | Basic | Manually trigger server-side priming of a discovered speaker          |

 ## Security

@@ -0,0 +1,183 @@
+# Spotify on SoundTouch — Overview
+
+This is the entry point for understanding how Spotify works on a SoundTouch
+speaker behind AfterTouch. Read this first; the deeper docs assume you already
+have the mental model below.
+
+> **Premium likely required.** As far as we know, Spotify Connect on
+> SoundTouch only works with a Spotify Premium account — this matches our
+> testing and matches what other SoundTouch-replacement projects report, but
+> we have not exhaustively verified every account tier or region. None of the
+> workarounds in this document change Spotify's account-tier requirements.
+
+## Two completely separate Spotify paths
+
+These are routinely confused. They share a speaker and a Spotify account, but
+they ride on different infrastructure and fail for different reasons.
+
+### 1. Spotify Connect (speaker-native, independent of AfterTouch)
+
+- The speaker advertises itself on the LAN as a Spotify Connect endpoint
+  (mDNS service `_spotify-connect._tcp`).
+- You open the Spotify app on your phone or desktop, tap the Connect device
+  picker, and select the SoundTouch.
+- Audio streams directly from Spotify's CDN to the speaker. Token handling,
+  session setup, and playback all happen between Spotify and the speaker.
+- **AfterTouch is not involved.** It still works even if AfterTouch is
+  offline.
+
+This is the simplest path. If you only want to push playback from your phone,
+you do not need to link Spotify to AfterTouch at all — see [Manual kick-start
+alternative](#manual-kick-start-alternative) below.
+
+### 2. OAuth-intercept path (managed by AfterTouch)
+
+This is what enables features that originate **from the speaker**:
+
+- Spotify presets on the speaker's buttons.
+- Spotify playback from the Bose app's source picker.
+- "Resume Spotify" after a power cycle without touching the Spotify app.
+
+After Bose's cloud shutdown (May 2026), the speaker can no longer reach
+Bose's OAuth server for Spotify token refresh. AfterTouch intercepts those
+calls via DNS, brokers tokens with Spotify using your linked account, and
+hands them back to the speaker.
+
+The rest of this document describes that path.
+
+## Setup at a glance
+
+Full step-by-step is in
+[docs/guides/MUSIC-SERVICES.md](../guides/MUSIC-SERVICES.md). Summary:
+
+1. **Register a Spotify developer app** (one-time, by the AfterTouch operator).
+2. **Configure AfterTouch** with the Client ID, Client Secret, and Redirect
+   URI in the Settings tab.
+3. **Authorize your Spotify account** via the Local Account tab — completes
+   the OAuth flow and persists a long-lived refresh token to AfterTouch's
+   datastore.
+4. **Prime each speaker** so its source list and ZeroConf state know about
+   Spotify.
+
+After step 4, presets and Bose-app-initiated Spotify playback work.
+
+## The DNS rewrite — easy to miss, breaks everything
+
+Bose firmware does **not** read a separate OAuth server hostname from
+configuration. It derives the OAuth host from the marge host by inserting
+`oauth` into the first label:
+
+| Purpose         | Hostname                  |
+|-----------------|---------------------------|
+| Marge / sources | `streaming.bose.com`      |
+| OAuth refresh   | `streamingoauth.bose.com` |
+
+**Both hostnames must resolve to AfterTouch.** AfterTouch's DNS server hijacks
+both, but if you bypass that DNS server (e.g. by hard-coding only the marge
+hostname in `/etc/hosts`, or by routing only one through a custom resolver),
+token refresh will silently die while the speaker still pulls sources.
+Symptom: the speaker briefly streams Spotify after priming, then stops at the
+first token refresh ~1 hour later.
+
+If you self-host AfterTouch at e.g. `aftertouch.local`, you would equivalently
+need `aftertouchoauth.local` for the OAuth interception path.
+
+## End-to-end token lifecycle
+
+What actually happens, from priming to steady-state playback:
+
+1. **Operator links Spotify account.** OAuth flow stores
+   `{user_id, refresh_token, bose_secret}` in `spotify/accounts.json`. The
+   `bose_secret` is an opaque surrogate (e.g. `bs-deadbeef…`) that AfterTouch
+   issues; the speaker only ever sees this surrogate, never the real Spotify
+   refresh token.
+2. **Priming runs.** Either on speaker `power_on`, on discovery, or on a
+   manual `POST /mgmt/spotify/prime`. AfterTouch:
+   - Resolves the speaker's currently-paired account via live `:8090/info`
+     (`margeAccountUUID`).
+   - Writes a `SPOTIFY` `ConfiguredSource` into marge under that account with
+     `secret = bose_secret`, `secretType = token_version_3`.
+   - POSTs `<updates><sourcesUpdated/></updates>` to the speaker's
+     `:8090/notification`, causing the speaker to re-fetch
+     `/streaming/account/{account}/full` and pick up the new source.
+   - Optionally pushes a fresh access token to the speaker's ZeroConf
+     endpoint (`:8200/zc?action=addUser`). This is best-effort — see
+     [ZeroConf clientId and benign 404s](#zeroconf-clientid-and-benign-404s).
+3. **Speaker pulls sources.** It now has a SPOTIFY entry with the surrogate
+   as its credential. The speaker stores this; from its perspective the
+   surrogate is the refresh token.
+4. **Speaker uses Spotify.** When it needs a fresh access token (every ~1 h
+   on Spotify's clock), it POSTs to
+   `streamingoauth.bose.com/oauth/device/{deviceID}/music/musicprovider/15/token/cs3`
+   with the surrogate.
+5. **AfterTouch translates.** DNS hijack routes the request to AfterTouch,
+   which looks up the surrogate, performs the real refresh against Spotify
+   using the stored refresh token, and returns the resulting access token to
+   the speaker.
+6. **Speaker uses the access token** for Spotify Web API metadata calls
+   (artwork, track lookups, playback container resolution).
+
+Forensic details of the request shapes are in
+[docs/reference/spotify-account-addition.md](../reference/spotify-account-addition.md).
+The cryptographic specifics of the ZeroConf `addUser` blob are in
+[spotify-priming-strategy.md](spotify-priming-strategy.md).
+
+## ZeroConf clientId and benign 404s
+
+`GET http://<speaker>:8200/zc?action=getInfo` returns, among other fields:
+
+```json
+"clientID": "79ebcb219e8e4e9a892e796607931810"
+"tokenType": "accesstoken"
+"activeUser": "<spotify-user-id-or-empty>"
+```
+
+That `clientID` is **Bose's official Spotify Connect partner client_id**,
+baked into firmware. It is **not** the client_id of the developer app you
+registered for AfterTouch — those are two unrelated OAuth apps, by design.
+The Bose-baked one is what Spotify Connect uses when a Spotify mobile app
+discovers the speaker on the LAN. The AfterTouch-registered one is what
+brokers refresh tokens for the OAuth-intercept path. They never converge.
+
+**Implication:** an access token AfterTouch obtained under its own client_id
+is not directly usable as a Spotify Connect session token. Pushing it via
+ZeroConf `addUser` is best-effort, and the speaker may respond with a `404`
+and an empty body when its `activeUser` already matches the username being
+pushed — that is the firmware's idiomatic "no transition required" signal,
+not a failure. AfterTouch recognises this case (`zeroconf.ErrAddUserNoOp`)
+and logs it as an expected no-op rather than an error.
+
+A 404 **with a body**, or any other non-2xx, is treated as a real failure
+and logged loudly with the response headers and body so it can be
+diagnosed.
+
+## Manual kick-start alternative
+
+You can skip the OAuth setup entirely if you only want playback pushed from
+the Spotify app:
+
+1. Open the Spotify mobile/desktop app.
+2. Start any track.
+3. Open the Connect device picker, select the SoundTouch.
+
+The speaker now holds an in-memory Spotify Connect session and can play
+until next reboot. Presets and Bose-app-initiated Spotify playback will
+still not work — those require the OAuth-intercept path — but Spotify-app-
+initiated playback does.
+
+## Troubleshooting quick reference
+
+| Symptom                                            | Most likely cause                                                                              |
+|----------------------------------------------------|------------------------------------------------------------------------------------------------|
+| Preset stores then fails: "invalid SourceID"       | No `SPOTIFY` source in marge for the speaker's paired account. Re-run priming.                 |
+| Preset stores fine; playback dies after ~1 hour    | `streamingoauth.bose.com` not pointed at AfterTouch (DNS rewrite gap).                         |
+| Speaker has source but `Sources.xml` looks stale   | `<sourcesUpdated/>` notification did not reach the speaker. Re-run priming or POST it by hand. |
+| ZeroConf `addUser` returns 404, empty body         | Benign no-op; speaker already has `activeUser` set. Marge path is authoritative.               |
+| Spotify Connect device picker doesn't show speaker | Unrelated to AfterTouch; check the speaker's mDNS visibility on the LAN.                       |
+
+## Where to go next
+
+- **Setup walkthrough:** [docs/guides/MUSIC-SERVICES.md](../guides/MUSIC-SERVICES.md)
+- **OAuth flow details (browser + mobile + endpoint table):** [spotify-oauth.md](spotify-oauth.md)
+- **Priming strategy, ZeroConf DH protocol, deployment topologies:** [spotify-priming-strategy.md](spotify-priming-strategy.md)
+- **Forensic request/response analysis from the Stockholm app:** [docs/reference/spotify-account-addition.md](../reference/spotify-account-addition.md)
@@ -1,10 +1,38 @@
 # Spotify Priming Strategy

+> **New here?** Start with [spotify-overview.md](spotify-overview.md) for the
+> mental model. This document goes deep on the priming protocol, ZeroConf DH
+> exchange, and deployment topologies.
+
 This document outlines the strategy for ensuring Bose SoundTouch devices are correctly "primed" for Spotify Connect integration within the AfterTouch ecosystem.

 ## Overview

-To enable Spotify Connect for SoundTouch devices, especially for remote availability outside the local network, the speaker must be associated with a Spotify account via a process called "priming." This involves sending an `addUser` command to the speaker's ZeroConf API (port 8200) containing a valid Spotify username and OAuth access token.
+To enable Spotify Connect for SoundTouch devices, especially for remote availability outside the local network, the speaker must be associated with a Spotify account via a process called "priming." This involves a two-step exchange with the speaker's ZeroConf API (port 8200):
+
+1. **`getInfo`** — retrieve the speaker's Diffie-Hellman public key and device metadata.
+2. **`addUser`** — push encrypted Spotify credentials using the shared DH secret.
+
+This is the standard Spotify Connect ZeroConf protocol. Once the speaker holds a properly encrypted credential blob it can independently authenticate with Spotify's servers and refresh its own session without any further involvement from AfterTouch.
+
+### ZeroConf Protocol
+
+The current implementation follows the full Spotify Connect ZeroConf protocol (`pkg/service/spotify/zeroconf.go`):
+
+1. `GET http://{ip}:8200/zc?action=getInfo` → parse `publicKey` (base64 DH key, 768-bit Oakley Group 1 prime) from the response.
+2. Generate a client DH key pair using the same group parameters.
+3. Compute `sharedSecret = DH(clientPrivate, speakerPublicKey)`.
+4. Derive keys: `baseKey = SHA1(sharedSecret)[:16]`, then HMAC-SHA1 with labels `"encryption"` and `"checksum"`.
+5. Encrypt a protobuf-encoded `LoginCredentials` blob (username, `AUTHENTICATION_SPOTIFY_TOKEN=4`, access token) using AES-128-CTR + HMAC-SHA1 checksum.
+6. `POST http://{ip}:8200/zc?action=addUser` with `blob={encryptedBlob}`, `clientKey={clientPublicKeyBase64}`.
+
+The speaker decrypts the blob, stores long-lived credentials, and can handle token refresh with Spotify independently. No periodic re-priming is required for token expiry.
+
+The algorithm is based on [librespot](https://github.com/librespot-org/librespot) (Rust reference implementation).
+
+### Fallback for Older Firmware
+
+If `getInfo` fails (e.g. firmware that does not implement the DH exchange), `PushSpotifyCredentials` automatically falls back to the simplified `tokenType=accesstoken` approach: the raw OAuth access token is sent as the `blob` with an empty `clientKey`. This token expires after ~60 minutes and the speaker cannot self-refresh, so periodic re-priming is required in that case.

 AfterTouch adopts a **Server-Centric Hybrid Model** that prioritizes device cleanliness and user intent while providing automated self-healing.

@@ -14,7 +42,7 @@ AfterTouch adopts a **Server-Centric Hybrid Model** that prioritizes device clea
 AfterTouch replicates the native Bose "Add Source" experience. No Spotify priming occurs until a user explicitly links their Spotify account through the AfterTouch Management Dashboard. This ensures privacy and respects users who do not wish to use Spotify.

 ### 2. Device Cleanliness (Minimalist Footprint)
-We avoid invasive modifications to the speaker's filesystem. 
+We avoid invasive modifications to the speaker's filesystem.
 - **No On-Device Scripts:** We deprecate the use of internal boot-primer scripts.
 - **Native Communication:** We rely on the speaker's native ability to talk to Bose services, which are intercepted via DNS to point to the AfterTouch server.

@@ -53,6 +81,8 @@ The logic for account management and device interaction remains decoupled:
 4. AfterTouch pushes a fresh token from the Spotify Service.
 5. UI reflects that the device is "Managed by AfterTouch" and healthy.

+> **Note:** With the proper encrypted-blob flow now in place, the watchdog is only needed for the "speaker reboots and loses state" case — not for token expiry. Speakers running older firmware that trigger the `tokenType=accesstoken` fallback still require periodic re-priming (~45 min) because the raw access token expires.
+
 ### Manual Override
 Users can manually trigger a "Re-prime" or "Refresh Link" from the device list in the UI if they suspect the automated self-healing is delayed or if they want to force a specific account onto a device.

@@ -76,9 +106,11 @@ As AfterTouch moves to the Server-Centric model, we will:
 2.  **Consolidated Directory:** We maintain the `/mnt/nv/soundtouch-service/` base directory for other configuration needs (e.g., `aftertouch.resolv.conf`), but it will no longer contain Spotify-specific credentials or scripts.
 3.  **No On-Device Credentials:** The `/mnt/nv/soundtouch-service/spotify-primer.conf` will be removed, ensuring that no sensitive AfterTouch login details are stored on the speaker in plain text.

-## Implementation Roadmap (Conceptual)
+## Implementation Roadmap

-1. **Revert On-Device Migration:** Update the Setup Manager to remove legacy scripts and `rc.local` hooks.
-2. **Server-Side Priming Logic:** Implement a `PrimeDevice(ip)` method in the server that fetches a fresh token and calls the ZeroConf API.
-3. **Discovery Hook:** Integrate `PrimeDevice` into the discovery handler (`handleDiscoveredDevice`) with a check for unprimed state.
-4. **UI Enhancements:** Update the Speaker List to show "Spotify Linked" status and provide manual refresh buttons.
+1. ✅ **Server-Side Priming Logic:** `PrimeDeviceWithSpotify(ip)` and `pushSpotifyTokenToDevice` in `pkg/service/handlers/server.go`. Triggered on device registration (marge handlers) and via the manual `HandleMgmtPrimeDevice` endpoint.
+2. ✅ **Discovery Hook:** `handleDiscoveredDevice` calls `PrimeDeviceWithSpotify` when a speaker is found.
+3. ✅ **Proper ZeroConf Blob:** Full DH key exchange + AES-128-CTR encrypted `LoginCredentials` blob implemented in `pkg/service/spotify/zeroconf.go`. Automatically falls back to `tokenType=accesstoken` if `getInfo` fails (older firmware).
+4. ⬜ **Watchdog / Session Refresh:** Background timer to re-prime all known devices on a schedule. Only strictly needed for older firmware (fallback path) or "speaker lost state" recovery; not required for token expiry on modern firmware.
+5. ⬜ **Revert On-Device Migration:** Update the Setup Manager to remove legacy `spotify-boot-primer` scripts and `rc.local` hooks from the speakers.
+6. ⬜ **UI Enhancements:** Update the Speaker List to show "Spotify Linked" status and provide manual refresh buttons.
@@ -816,7 +816,7 @@ func TestAccountManager_CreateAccount(t *testing.T) {
            wantErr: true,
        },
    }
-    
+
    for _, tt := range tests {
        t.Run(tt.name, func(t *testing.T) {
            got, err := manager.CreateAccount(tt.input)
@@ -848,6 +848,18 @@ go test ./... -v -cover
 go test -bench=. ./...
 ```

+## Performance Requirements
+
+### Response Time Targets
+- Local API requests: < 100ms (95th percentile)
+- Mirror requests: < 200ms overhead (asynchronous)
+- Discovery time: < 5s for network scan
+
+### Resource Constraints
+- Memory usage: < 64MB for small deployments
+- CPU usage: < 5% on dual-core ARM systems (idle)
+- Storage: < 100MB for interaction logs (rotatable)
+
 ### Security Considerations

 #### Simple Security Model
@@ -949,12 +961,12 @@ func (s *Server) HandleHealthCheck(w http.ResponseWriter, r *http.Request) {
        Version:   version,
        Uptime:    time.Since(startTime).String(),
    }
-    
+
    // Simple checks
    if !s.canWriteToDataDir() {
        health.Status = "error"
    }
-    
+
    w.Header().Set("Content-Type", "application/json")
    json.NewEncoder(w).Encode(health)
 }
@@ -986,4 +998,4 @@ func (m *SimpleMetrics) Save(dataDir string) error {
 }
 ```

-This technical specification provides comprehensive details for implementing the enhanced state management system while maintaining compatibility with existing SoundTouch service functionality and meeting the performance requirements for small hardware deployments.
+This technical specification provides comprehensive details for implementing the enhanced state management system while maintaining compatibility with existing SoundTouch service functionality and meeting the performance requirements for small hardware deployments.
@@ -0,0 +1,432 @@
+# Capture Device Pairing Traffic
+
+Step-by-step runbook for factory-resetting a SoundTouch speaker, pairing it to a Bose cloud account, and capturing every cloud request via mitmproxy. Tested on Apple Silicon Mac.
+
+**Goal:** obtain a full `.mitm` recording of the account-pairing flow (streaming.bose.com) triggered by the official Android app.
+
+---
+
+## Overview
+
+```
+Phase 0  Pre-flight checks
+Phase 1  Factory reset speaker
+Phase 2  Provision speaker Wi-Fi (AP mode, console)
+Phase 3  Start mitmproxy + emulator + Frida
+Phase 4  Pair speaker via Bose app (adb-driven)
+Phase 5  Save & inspect recording
+```
+
+The Android emulator does not have Bluetooth, so the standard BLE setup path is unavailable. Instead:
+
+1. Provision Wi-Fi directly over the speaker's AP web server (Phase 2).
+2. Once the speaker is on the LAN, the Bose app discovers it via mDNS — no BLE needed.
+
+---
+
+## Phase 0 — Pre-flight
+
+The emulator setup is fully scripted. Run once per machine:
+
+```bash
+# Place the Bose APK at scripts/android/bose.apk first (see BOSE-APP-ADB-Emulator.md § 1)
+# Run mitmweb once to generate the CA: mitmweb --listen-port 8080 (Ctrl-C after it starts)
+
+scripts/android/setup-mitm-avd.sh
+```
+
+This installs the system image, creates an AVD named `bose-mitm`, installs the
+mitmproxy cert and Bose APK, and saves an emulator snapshot `mitm-ready` — so
+subsequent sessions never repeat the cert/reboot cycle.
+
+For subsequent sessions, Phase 3 below is replaced by a single command:
+
+```bash
+scripts/android/start-mitm-session.sh
+```
+
+Manual steps are only needed if you want to understand the internals; see
+[BOSE-APP-ADB-Emulator.md](../analysis/BOSE-APP-ADB-Emulator.md) for the
+full manual walkthrough.
+
+---
+
+## Phase 1 — Factory Reset Speaker
+
+Perform the reset for your model (see
+[DEVICE-INITIAL-SETUP.md § 5](DEVICE-INITIAL-SETUP.md) for full table):
+
+| Model                       | Sequence                                                                |
+|-----------------------------|-------------------------------------------------------------------------|
+| SoundTouch 10               | Power on; hold **Preset 1** + **Vol −** ~10 s → solid amber Wi-Fi LED   |
+| SoundTouch 20               | Power on; hold **Preset 1** + **Vol −** ~10 s → lights blink L→R, amber |
+| SoundTouch 20/30 Series III | Hold **Preset 1** + **Preset 6** ~10 s                                  |
+| SoundTouch 300              | Hold **Vol −** ~15 s until light bar blinks                             |
+
+Wait until the white LED sweep / restart animation completes (~30 s). The speaker
+is now in setup mode and broadcasting its own Wi-Fi AP.
+
+---
+
+## Phase 2 — Provision Speaker Wi-Fi (AP Mode)
+
+### 2.1 Connect Mac to Speaker AP
+
+```bash
+# Find the SSID — use System Settings → Wi-Fi or:
+#   sudo wdutil info   (macOS Sequoia+, airport command removed)
+
+# Connect (replace SSID with actual value)
+SPEAKER_SSID="Bose SoundTouch XXXX"
+networksetup -setairportnetwork en0 "$SPEAKER_SSID"
+
+# Confirm: speaker web UI reachable at 192.0.2.1 (client gets 192.0.2.2)
+curl -s --connect-timeout 5 http://192.0.2.1/ | head -3
+```
+
+### 2.2 Push Home Wi-Fi Credentials
+
+The setup UI at `http://192.0.2.1/` uses the SoundTouch API on **port 8090**. Push credentials directly:
+
+```bash
+HOME_SSID="MyHomeNetwork"
+HOME_PASS="MyPassword"
+
+# Optional: trigger a site survey first so the speaker finds your SSID
+curl -s -X POST http://192.0.2.1:8090/performWirelessSiteSurvey \
+  -H 'Content-Type: text/xml' \
+  --data-raw '<PerformWirelessSiteSurvey timeout="5"/>'
+
+curl -s -X POST http://192.0.2.1:8090/addWirelessProfile \
+  -H 'Content-Type: text/xml' \
+  --data-raw "<AddWirelessProfile><profile ssid=\"${HOME_SSID}\" password=\"${HOME_PASS}\" securityType=\"wpa_or_wpa2\" /></AddWirelessProfile>"
+```
+
+Expected response: `<AddWirelessProfileResponse />`
+
+### 2.3 Reconnect Mac to Home Network
+
+```bash
+HOME_SSID="MyHomeNetwork"
+HOME_PASS="MyPassword"
+
+networksetup -setairportnetwork en0 "$HOME_SSID" "$HOME_PASS"
+```
+
+### 2.4 Wait for Speaker to Join LAN
+
+```bash
+# Poll mDNS until the speaker appears (~15-30 s)
+echo "Waiting for speaker on LAN..."
+until dns-sd -B _soundtouch._tcp local 2>&1 | grep -m1 "Add"; do sleep 2; done
+echo "Speaker is online"
+
+# Resolve its IP
+dns-sd -L "$(dns-sd -B _soundtouch._tcp local 2>&1 | grep Add | awk '{print $7}')" \
+  _soundtouch._tcp local 2>&1 | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}'
+```
+
+Or just scan for open port 8090:
+
+```bash
+# Quick scan of your /24 subnet for port 8090
+SUBNET="192.168.1"   # adjust to your local subnet
+for i in $(seq 1 254); do
+  (ping -c1 -W1 ${SUBNET}.$i &>/dev/null && \
+   nc -z -w1 ${SUBNET}.$i 8090 2>/dev/null && \
+   echo "${SUBNET}.$i") &
+done
+wait
+```
+
+---
+
+## Phase 3 — Start mitmproxy, Emulator, Frida
+
+Run each block in a separate terminal tab.
+
+### 3.1 Start mitmweb (native macOS app)
+
+> **Note:** Docker mitmproxy does not work here — its NAT layer prevents the emulator from reaching it. Use the native macOS app instead (download: `https://downloads.mitmproxy.org/12.2.2/mitmproxy-12.2.2-macos-arm64.tar.gz`).
+
+```bash
+CAPTURE="bose-pairing-$(date +%Y%m%d-%H%M%S).mitm"
+/Applications/mitmproxy.app/Contents/MacOS/mitmweb \
+  --web-host 0.0.0.0 --listen-port 8080 --mode regular \
+  --set web_password=bose \
+  -w "scripts/android/captures/${CAPTURE}"
+# Captures → scripts/android/captures/
+# Web UI   → http://127.0.0.1:8081/?token=bose
+```
+
+### 3.2 Start Emulator
+
+```bash
+~/Library/Android/sdk/emulator/emulator -avd Pixel_6_API33 -writable-system &
+echo "Waiting for emulator boot..."
+adb wait-for-device
+adb -s emulator-5554 wait-for-device shell 'while [[ -z $(getprop sys.boot_completed) ]]; do sleep 1; done'
+echo "Emulator ready"
+```
+
+Enable root and install certificate (only needed once per emulator session):
+
+```bash
+adb -s emulator-5554 root
+adb -s emulator-5554 shell avbctl disable-verification
+adb -s emulator-5554 reboot
+adb -s emulator-5554 wait-for-device
+adb -s emulator-5554 root
+
+HASH=$(openssl x509 -inform PEM -subject_hash_old \
+  -in ~/.mitmproxy/mitmproxy-ca-cert.pem | head -1)
+
+adb -s emulator-5554 push ~/.mitmproxy/mitmproxy-ca-cert.pem /data/local/tmp/mitmproxy.pem
+adb -s emulator-5554 shell su 0 mkdir -p /data/misc/user/0/cacerts-added
+adb -s emulator-5554 shell su 0 \
+  cp /data/local/tmp/mitmproxy.pem /data/misc/user/0/cacerts-added/${HASH}.0
+adb -s emulator-5554 shell su 0 \
+  chmod 644 /data/misc/user/0/cacerts-added/${HASH}.0
+```
+
+Set proxy to Mac IP:
+
+```bash
+MAC_IP=$(ipconfig getifaddr en0)
+adb -s emulator-5554 shell settings put global http_proxy "${MAC_IP}:8080"
+echo "Proxy set to ${MAC_IP}:8080"
+```
+
+Confirm emulator can reach the speaker:
+
+```bash
+SPEAKER_IP=192.168.1.50   # adjust to your speaker's LAN IP
+adb -s emulator-5554 shell ping -c 3 "$SPEAKER_IP"
+```
+
+### 3.3 Start frida-server
+
+```bash
+adb -s emulator-5554 push scripts/android/frida-server /data/local/tmp/frida-server
+adb -s emulator-5554 shell su 0 chmod 755 /data/local/tmp/frida-server
+adb -s emulator-5554 shell su 0 "nohup /data/local/tmp/frida-server > /dev/null 2>&1 &"
+sleep 2
+echo "frida-server running"
+```
+
+### 3.4 Configure config.js
+
+`start-mitm-session.sh` patches `scripts/android/frida/config.js` automatically with the current Mac IP and mitmproxy cert. No manual step needed.
+
+### 3.5 Launch App with SSL Unpinning
+
+```bash
+scripts/android/frida-venv/bin/frida \
+  -U \
+  -f com.bose.soundtouch \
+  -l scripts/android/frida/config.js \
+  -l scripts/android/frida/native-connect-hook.js \
+  -l scripts/android/frida/android/android-system-certificate-injection.js \
+  -l scripts/android/frida/android/android-proxy-override.js \
+  -l scripts/android/frida/android/android-certificate-unpinning.js \
+  -l scripts/android/frida/android/android-certificate-unpinning-fallback.js
+```
+
+> `native-connect-hook.js` is required — the Bose app uses native networking that bypasses Java proxy settings.
+
+Expected Frida output:
+
+```
+== System certificate trust injected ==
+== Proxy system configuration overridden to <IP>:8080 ==
+== Proxy configuration overridden to <IP>:8080 ==
+== Certificate unpinning completed ==
+== Unpinning fallback auto-patcher installed ==
+```
+
+---
+
+## Phase 4 — Pair Speaker via App
+
+The Bose app should now be running in the emulator with all traffic going through mitmproxy.
+
+### 4.1 Inspect UI to Find Interactive Elements
+
+```bash
+# Dump current screen
+adb -s emulator-5554 shell uiautomator dump /sdcard/ui.xml
+adb -s emulator-5554 pull /sdcard/ui.xml /tmp/ui.xml
+
+# Helper: list all clickable elements with their text + bounds
+grep -o 'text="[^"]*" resource-id="[^"]*" \.\.\. clickable="true"[^/]*' /tmp/ui.xml \
+  || python3 -c "
+import xml.etree.ElementTree as ET
+tree = ET.parse('/tmp/ui.xml')
+for n in tree.iter('node'):
+    if n.get('clickable') == 'true' and n.get('text'):
+        print(n.get('bounds'), n.get('resource-id'), repr(n.get('text')))
+"
+```
+
+### 4.2 Navigate Setup Flow (adb)
+
+```bash
+# Take a screenshot at any point to see current state
+adb -s emulator-5554 shell screencap /sdcard/screen.png
+adb -s emulator-5554 pull /sdcard/screen.png /tmp/screen.png
+open /tmp/screen.png
+
+# Tap by resource-id (find IDs from ui.xml dump)
+adb -s emulator-5554 shell uiautomator runtest ... # or input tap
+
+# Tap by screen coordinates
+adb -s emulator-5554 shell input tap X Y
+
+# Type into the focused field
+adb -s emulator-5554 shell input text "your@email.com"
+
+# Press Enter / Next
+adb -s emulator-5554 shell input keyevent 66
+```
+
+### 4.3 Expected Setup Steps in the App
+
+Follow the on-screen flow; mitmproxy captures everything automatically.
+
+1. **Sign in** — enter email + password → triggers `POST /streaming/account/login`
+2. **Add speaker** — tap "Set Up a New Speaker" or equivalent
+3. **App discovers speaker** via mDNS on LAN (no BLE required)
+4. **Wi-Fi already configured** — app skips the Wi-Fi step since speaker is online
+5. **Name speaker** — type a name → WebSocket `name` message to speaker port 8080
+6. **Pairing** — app sends `setMargeAccount` WebSocket to speaker → speaker POSTs to `streaming.bose.com/{accountId}/devices`
+
+All cloud requests (steps 1, 6) will appear in mitmweb at `http://127.0.0.1:8081`.
+
+---
+
+## Phase 5 — Save & Inspect Recording
+
+```bash
+# Stop mitmweb (Ctrl-C in its terminal) — file is already written continuously
+
+# Inspect offline in the web UI
+mitmweb -r "$CAPTURE"
+
+# Filter to streaming.bose.com only
+mitmdump -r "$CAPTURE" --flow-filter '~u streaming.bose.com' -w bose-cloud-only.mitm
+
+# Quick text summary
+mitmdump -r "$CAPTURE" --flow-filter '~u streaming.bose.com' 2>/dev/null \
+  | grep -E "POST|GET" | head -30
+```
+
+### Convert to .http files (IntelliJ-compatible)
+
+Use `scripts/convert_mitm_script.py` to extract each flow as a `.http` file, organized by path:
+
+```bash
+NAME=$(basename "$CAPTURE" .mitm)
+OUT="scripts/android/mitm/${NAME}"
+
+/Applications/mitmproxy.app/Contents/MacOS/mitmdump \
+  -n -r "$CAPTURE" \
+  -s scripts/convert_mitm_script.py \
+  --set out_dir="${OUT}"
+```
+
+Output lands in `scripts/android/mitm/<name>/mirror/` as numbered `.http` files
+plus `*-websocket/` subdirectories for WebSocket frames. The directory is gitignored.
+
+---
+
+## Cleanup
+
+```bash
+# Remove proxy from emulator
+adb -s emulator-5554 shell settings delete global http_proxy
+
+# Kill emulator
+adb -s emulator-5554 emu kill
+```
+
+Frida artefacts live in `scripts/android/` (gitignored) and persist between sessions — no cleanup needed unless you want to force a fresh setup.
+
+---
+
+## Troubleshooting
+
+| Symptom                             | Likely cause                                     | Fix                                                                               |
+|-------------------------------------|--------------------------------------------------|-----------------------------------------------------------------------------------|
+| `curl http://192.0.2.1` times out   | Mac not on speaker AP                            | Re-run `networksetup -setairportnetwork`; speaker AP gateway is `192.0.2.1`       |
+| `addWirelessProfile` returns error  | Speaker not in AP mode or wrong IP               | Confirm speaker AP is active; use `http://192.0.2.1:8090/addWirelessProfile`      |
+| Speaker not found via mDNS          | Speaker still on AP (not home LAN yet)           | Wait ~30 s, retry; check router DHCP leases                                       |
+| Emulator can't ping speaker         | Different subnet or emulator proxy misconfigured | `adb shell ping` the Mac IP first; check proxy setting                            |
+| App shows "No speakers found"       | App not detecting mDNS                           | Ensure emulator is on same `/24` as speaker; disable emulator Wi-Fi and re-enable |
+| No traffic in mitmweb               | Frida not running or cert mismatch               | Check Frida output for `== Certificate unpinning ==`; verify issuer in config.js  |
+
+## See Also
+
+- [BOSE-APP-ADB-Emulator.md](../analysis/BOSE-APP-ADB-Emulator.md) — full MITM + Frida setup
+- [DEVICE-INITIAL-SETUP.md](DEVICE-INITIAL-SETUP.md) — factory reset sequences + AP mode detail
+- [DEVICE-SETUP.md](../DEVICE-SETUP.md) — WebSocket and cloud pairing protocol reference
+
+---
+
+## Session Trace (2026-05-02, ST10)
+
+Raw log of the first interactive run. To be cleaned up into the runbook above.
+
+### Setup
+- Ran `scripts/android/setup-mitm-avd.sh` — all 9 steps completed:
+  - Steps 1–5 were already done from a prior session (idempotent skips)
+  - Step 6: Docker image built, `frida-server` extracted to `scripts/android/frida-server`
+  - Steps 7–9: Emulator started fresh (`-no-snapshot-load`), AVB disabled, rebooted, cert + APK + frida-server installed, snapshot `mitm-ready` saved
+- Emulator running at `emulator-5554`
+
+### Factory Reset (ST10)
+- Correct sequence confirmed from official Bose guide (`firmware/FirmwareUpdateGuide/`):
+  **Power on → hold Preset 1 + Volume − for 10 s → Wi-Fi LED glows solid amber**
+- Note: original docs said "Vol− + Mute" — corrected in DEVICE-INITIAL-SETUP.md and this file
+
+### Pre-reset note
+- User inserted USB device containing `remote_services` before rebooting — device needs to be on home Wi-Fi before the USB config takes effect
+
+### Wi-Fi Provisioning (AP mode)
+- `airport` command not available on this macOS version (removed in recent releases)
+- Connect Mac to speaker AP via **System Settings → Wi-Fi** (SSID: "Bose SoundTouch XXXX")
+- Speaker AP gateway confirmed: `192.0.2.1` (client gets `192.0.2.2`), not `192.168.1.1` as previously assumed
+- `/gabbo_wifi` endpoint was hallucinated — actual endpoint verified from browser network capture (`_/device-reset/wifi-setup.txt`):
+  - Site survey: `POST http://192.0.2.1:8090/performWirelessSiteSurvey` with `<PerformWirelessSiteSurvey timeout="5"/>`
+  - Add profile: `POST http://192.0.2.1:8090/addWirelessProfile` with XML body, `securityType="wpa_or_wpa2"`
+  - Both use the standard SoundTouch API port 8090, same as normal device operation
+  - Response: `<AddWirelessProfileResponse />`
+- Reconnect Mac to home Wi-Fi; emulator stays running throughout (routes through Mac interface)
+
+### Wi-Fi Provisioning Result
+- `POST http://192.0.2.1:8090/addWirelessProfile` succeeded → `<AddWirelessProfileResponse />`
+- Speaker joined home LAN at `192.168.x.y`
+- SSH access confirmed: `ssh -oHostKeyAlgorithms=ssh-rsa root@192.168.x.y`
+- Device name: `Bose SoundTouch XXXXXX`
+- Network interfaces on device:
+  - `wlan0` → `192.168.x.y` (home LAN)
+  - `wlan1` → `192.0.2.1` (AP mode interface, stays up after provisioning)
+  - `usb0` → `203.0.113.1` (USB gadget — remote_services USB device inserted before reboot)
+
+### MITM Session Start
+- `start-mitm-session.sh` run: snapshot restored, proxy set, frida-server started, config.js patched
+- Issues encountered and fixed:
+  - frida-server start command hung (`adb shell su 0 ... &`) → fixed with `nohup ... > /dev/null 2>&1 &`
+  - Frida SSL scripts download via `curl` from GitHub timed out → moved to Dockerfile (extracted alongside frida-server)
+  - Python heredoc cert injection syntax error (multiline cert in string) → fixed using env vars + single-quoted `'PYEOF'` heredoc
+  - `mitmweb --port` deprecated → `--listen-port`
+  - frida script paths missing `android/` subdirectory → fixed in session script
+- Docker mitmproxy (`-p 8080:8080`) received no traffic from emulator — Docker NAT layer prevented the emulator reaching it
+- **Fix: use native macOS mitmproxy app** (`/Users/gesellix/Downloads/mitmproxy.app`) — binds directly to Mac's real network interfaces, traffic flows immediately
+- Android system traffic visible (connectivity checks to gstatic.com, www.google.com) — TLS failures for system processes expected since only Bose app has Frida cert injection
+
+### Capture Working
+- Full flow confirmed working with:
+  - Native mitmproxy app (`~/Downloads/mitmproxy.app`, v12.2.2)
+  - `native-connect-hook.js` added to Frida launch (required for Bose app's native networking)
+  - All 5 Frida scripts loaded: config.js, native-connect-hook.js, android-system-certificate-injection.js, android-proxy-override.js, android-certificate-unpinning.js, android-certificate-unpinning-fallback.js
+- Bose app traffic visible in mitmweb — pairing flow captured successfully
@@ -0,0 +1,378 @@
+# Capture Speaker Migration Traffic
+
+Runbook for migrating a SoundTouch speaker to `soundtouch-service` and capturing
+all traffic (App→Service and Speaker→Service) to identify unimplemented endpoints.
+
+**Goal:** obtain a complete picture of every cloud request a speaker and the Bose
+app make after migration, so missing endpoint implementations can be tracked down.
+
+**Pre-requisites:** the MITM pipeline is already set up and working. See
+[CAPTURE-DEVICE-PAIRING.md](CAPTURE-DEVICE-PAIRING.md) for the one-time AVD setup
+and the pairing capture runbook.
+
+---
+
+## Overview
+
+```
+Step 1  Start soundtouch-service locally (with interaction recording)
+Step 2  Start a fresh mitmproxy + Frida session (captures App traffic)
+Step 3  Discover or register the speaker in the service UI
+Step 4  Migrate the speaker (modifies SoundTouchSdkPrivateCfg.xml via SSH)
+Step 5  Operate the Bose app — everything now flows through local service
+Step 6  Inspect captured interactions for unimplemented endpoints
+Step 7  Revert (optional) / clean up
+```
+
+Traffic sources:
+- **App → Service** — captured by mitmproxy + Frida (same as pairing capture)
+- **Speaker → Service** — captured by the service's built-in interaction recorder
+
+---
+
+## Step 1 — Start soundtouch-service
+
+Build and start the service. Recording is on by default; add `--server-url` so the
+service knows its own public address (the speaker needs it for redirections).
+
+```bash
+# Determine Mac LAN IP first
+MAC_IP=$(ipconfig getifaddr en0)
+echo "Mac IP: ${MAC_IP}"
+
+# Build + run with explicit server-url so the service embeds the correct address
+make build-service
+./build/soundtouch-service \
+  --server-url "http://${MAC_IP}:8000" \
+  --record-interactions \
+  --log-bodies
+```
+
+Service listens on `:8000` by default. Web UI: `http://localhost:8000`
+
+> To also enable mirror mode (forward unhandled requests to official Bose servers
+> for comparison), add: `--mirror-enabled --mirror-endpoints /streaming/`
+
+---
+
+## Step 2 — Start mitmproxy + Frida (new capture)
+
+In a separate terminal:
+
+```bash
+scripts/android/start-mitm-session.sh
+```
+
+The script prints ready-to-run commands for mitmweb and Frida. Run each in its own
+terminal tab as instructed.
+
+New capture file lands in `scripts/android/captures/`.
+
+---
+
+## Step 3 — Discover the Speaker
+
+Open the service web UI at `http://localhost:8000`.
+
+The service discovers speakers via mDNS automatically on startup. If the speaker
+does not appear within ~30 s, add it manually:
+
+```bash
+# Via API (replace IP with speaker's current LAN IP)
+curl -s -X POST http://localhost:8000/setup/devices \
+  -H 'Content-Type: application/json' \
+  -d '{"ip": "192.168.x.y"}'
+
+# Confirm it's registered
+curl -s http://localhost:8000/setup/devices | python3 -m json.tool
+```
+
+Note the `device_id` from the response — you need it for migration.
+
+```bash
+# List all known devices and their IDs
+curl -s http://localhost:8000/setup/devices | python3 -m json.tool
+
+# Extract device_id for the speaker by matching its IP
+DEVICE_ID=$(curl -s http://localhost:8000/setup/devices \
+  | python3 -c "import sys,json; devs=json.load(sys.stdin); \
+    [print(d['device_id']) for d in devs if '35' in d.get('ip_address','')]")
+echo "Device ID: ${DEVICE_ID}"
+```
+
+---
+
+## Step 4 — Migrate the Speaker
+
+The migration modifies `SoundTouchSdkPrivateCfg.xml` on the speaker via SSH,
+redirecting `margeServerUrl` (and optionally other service URLs) to the local
+service.
+
+### 4.1 Review the Migration Plan
+
+```bash
+# Dry-run: see what will be changed
+curl -s "http://localhost:8000/setup/summary/${DEVICE_ID}" | python3 -m json.tool
+```
+
+Key fields to check:
+- `margeServerUrl` — should become `http://<MAC_IP>:8000/streaming`
+- `remoteServicesEnabled` — must be `true` for the speaker to make cloud calls
+- `is_migrated` — `false` before, `true` after
+
+### 4.2 Run Migration
+
+```bash
+MAC_IP=$(ipconfig getifaddr en0)
+TARGET_URL="http://${MAC_IP}:8000"
+
+curl -s -X POST \
+  "http://localhost:8000/setup/migrate/${DEVICE_ID}" \
+  -G --data-urlencode "target_url=${TARGET_URL}" \
+  | python3 -m json.tool
+```
+
+Expected response: `{"ok": true, "message": "Migration started", "output": "..."}`.
+The output field contains the SSH transcript of the changes made.
+
+### 4.3 Reboot the Speaker
+
+A reboot applies the new config:
+
+```bash
+curl -s -X POST "http://localhost:8000/setup/reboot/${DEVICE_ID}"
+```
+
+Wait ~30 s for the speaker to come back online. Verify it's back:
+
+```bash
+dns-sd -B _soundtouch._tcp local 2>&1 | grep Add
+# or
+curl -s http://192.168.x.y:8090/info | head -5
+```
+
+### 4.4 Verify Migration
+
+```bash
+# Check migration summary again — is_migrated should now be true
+curl -s "http://localhost:8000/setup/summary/${DEVICE_ID}" \
+  | python3 -c "import sys,json; s=json.load(sys.stdin); print('migrated:', s.get('is_migrated'))"
+```
+
+You should also see incoming connections from the speaker in the service logs once
+it resumes normal operation.
+
+---
+
+## Step 5 — Operate the Bose App
+
+With the speaker migrated and Frida running, every app action triggers traffic
+through the service:
+
+1. **Sign in** — `POST /streaming/account/login`
+2. **Speaker shows as linked** — speaker has called the service to register/sync
+3. **Play music** — BMX registry lookup, playback control
+4. **Set presets** — `POST /streaming/account/{id}/device/{id}/presets/{n}`
+5. **Adjust volume, switch source** — direct speaker API (port 8090, not cloud)
+6. **Check "Now Playing"** — speaker WebSocket events + marge sync
+
+For each action, both mitmweb and the service's recorder capture the request.
+
+---
+
+## Step 6 — Inspect Captured Interactions
+
+### 6.1 Service Interaction Recorder
+
+The service records all incoming requests to `data/interactions/` (configurable via
+`--data-dir`). Browse them via:
+
+```bash
+# List recorded sessions
+curl -s http://localhost:8000/setup/interactions | python3 -m json.tool
+
+# Download a session as HAR
+curl -s "http://localhost:8000/setup/interactions/sessions/<session>/download" \
+  -o session.har
+
+# Find 404/500 responses (unimplemented endpoints)
+curl -s "http://localhost:8000/setup/interaction-content" \
+  | python3 -c "
+import sys, json
+for entry in json.load(sys.stdin).get('entries', []):
+    status = entry.get('response', {}).get('status', 0)
+    if status >= 400:
+        print(status, entry.get('request', {}).get('method'), entry.get('request', {}).get('url'))
+"
+```
+
+### 6.2 mitmproxy Recording
+
+```bash
+# Inspect app→service traffic offline
+CAPTURE="scripts/android/captures/<filename>.mitm"
+mitmweb -r "${CAPTURE}"
+
+# Filter to local service only
+mitmdump -r "${CAPTURE}" \
+  --flow-filter "~u ${MAC_IP}:8000" \
+  2>/dev/null | grep -E "POST|GET"
+
+# Convert to .http files (IntelliJ-compatible, organized by path)
+NAME=$(basename "${CAPTURE}" .mitm)
+OUT="scripts/android/mitm/${NAME}"
+
+/Applications/mitmproxy.app/Contents/MacOS/mitmdump \
+  -n -r "${CAPTURE}" \
+  -s scripts/convert_mitm_script.py \
+  --set out_dir="${OUT}"
+# Output → scripts/android/mitm/<name>/mirror/
+```
+
+### 6.3 Identify Unimplemented Endpoints
+
+Endpoints the service doesn't handle return `404 Not Found`. Check:
+
+```bash
+# From service stats
+curl -s http://localhost:8000/setup/interaction-stats | python3 -m json.tool
+
+# List parity mismatches (local vs upstream divergence, if mirror enabled)
+curl -s http://localhost:8000/setup/parity-mismatches | python3 -m json.tool
+```
+
+---
+
+## Step 7 — Revert Migration (Optional)
+
+To restore the speaker to its original config (pointing back to Bose cloud):
+
+```bash
+curl -s -X POST "http://localhost:8000/setup/revert/${DEVICE_ID}" | python3 -m json.tool
+```
+
+Then reboot the speaker:
+
+```bash
+curl -s -X POST "http://localhost:8000/setup/reboot/${DEVICE_ID}"
+```
+
+---
+
+## Cleanup
+
+```bash
+# Stop mitmweb (Ctrl-C in its terminal)
+# Stop Frida (Ctrl-C in its terminal)
+# Stop soundtouch-service (Ctrl-C in its terminal)
+
+# Remove emulator proxy (if not running another session)
+adb -s emulator-5554 shell settings delete global http_proxy
+```
+
+---
+
+## Troubleshooting
+
+| Symptom                                   | Cause                                      | Fix                                                                       |
+|-------------------------------------------|--------------------------------------------|---------------------------------------------------------------------------|
+| Speaker not in service device list        | mDNS discovery hasn't fired yet            | Trigger manually: `POST /setup/discover` or add via `POST /setup/devices` |
+| Migration fails with SSH error            | Speaker SSH key not trusted                | Run `POST /setup/trust-ca/{deviceId}` first, or check SSH connectivity    |
+| Speaker can't reach service after reboot  | Firewall blocking port 8000 from LAN       | Allow inbound TCP 8000 on Mac firewall                                    |
+| `is_migrated: false` after migration      | Wrong `target_url` or config not written   | Check SSH output in migration response; re-run with `--method xml`        |
+| Service logs show no speaker requests     | `remote_services` not enabled on speaker   | Run `POST /setup/ensure-remote-services/{deviceId}` and reboot            |
+| App shows speaker offline after migration | Speaker config not pointing to correct URL | Check `margeServerUrl` via `GET /setup/summary/{deviceId}`                |
+
+---
+
+## Session Trace (2026-05-02, ST10)
+
+Raw log of the first interactive migration run.
+
+### Service Configuration
+
+Settings applied in the web UI before migration:
+
+| Setting             | Value                                                               |
+|---------------------|---------------------------------------------------------------------|
+| Target Domain       | `soundtouch.local` (resolvable from speaker to `192.168.x.z`)       |
+| DNS Discovery       | enabled                                                             |
+| Upstream DNS        | home Wi-Fi gateway                                                  |
+| Mirroring           | enabled (for tracing while Bose cloud is still up)                  |
+| Mirrored endpoints  | `/bmx/*`, `/streaming/*`, `/accounts/*`, `/v1/scmudc/*`, `/oauth/*` |
+| Proxy logging       | enabled, including bodies                                           |
+| Record interactions | enabled                                                             |
+| Skip recording      | `/setup/*`, `/web/*`                                                |
+
+Settings saved and service restarted.
+
+### Navigation Flow
+
+1. **Tab 1 — Settings**: entered all settings above, clicked **Save Settings**, restarted service
+2. **Tab 2 — Devices**: speaker appeared via mDNS discovery; clicked **Sync Data**
+3. **Tab 3 — Data Sync**: clicked **Start Sync** to pull account/device data from Bose cloud
+4. **Tab 2 — Devices**: clicked **Migrate** on the speaker entry
+5. In the Migrate panel: selected **Migration Method → `/etc/resolv.conf`**
+6. Ran pre-migration checks (see below)
+7. Ran migration steps (see below)
+8. Rebooted speaker
+9. Paired and configured speaker via the Bose app
+
+### Pre-Migration Checks
+
+All tests run from the **Devices → Migrate** panel after selecting the speaker (`192.168.x.y`, SoundTouch 10):
+
+- **HTTPS test (explicit CA.crt)**: ✅ passed (result not recorded in detail)
+- **HTTPS test (shared trust store)**: ✅ passed
+  - Speaker connected to `soundtouch.local:443` → `192.168.x.z`
+  - TLS: TLSv1.2 / ECDHE-RSA-AES128-GCM-SHA256, cert issued by `SoundTouch Local Root CA`
+  - CA already in speaker's system trust store (`/etc/pki/tls/certs/ca-bundle.crt`)
+- **Preliminary DNS Test**: ✅ passed
+  - Raw DNS query for `aftertouch.test` returned `192.168.x.z` via the service DNS at `192.168.x.z:53`
+- **Planned `/etc/resolv.conf`**:
+  ```
+  # Created by Aftertouch/SoundTouch-Service
+  # Priority nameserver for Bose service redirection
+  nameserver 192.168.x.z
+  ```
+
+### Migration Steps
+
+1. **Enable Persistent Remote Services** → `Successfully ensured remote services for SoundTouch 10 (192.168.x.y)`
+   - Note: `touch /etc/remote_services (with rw): sh: rw: command not found` — safe to ignore, `touch` succeeded
+2. Reloaded migration view by deselecting and reselecting the speaker in the dropdown
+3. **Backup Config Now** → `✅ Found .original config at /opt/Bose/etc/SoundTouchSdkPrivateCfg.xml.original`
+4. **Confirm Migration** → `Successfully started migration for SoundTouch 10 (192.168.x.y). Please reboot the device to activate the changes.`
+
+   Command output:
+   - Off-device backup created ✅
+   - Write access verified ✅
+   - `soundtouch.local` resolved to `192.168.x.z` ✅
+   - `/mnt/nv/soundtouch-service/aftertouch.resolv.conf` uploaded ✅
+   - `rc.local` already contains Aftertouch hook logic ✅
+   - `(rw || mount -o remount,rw /): sh: rw: command not found` — safe to ignore (same shell quirk as above)
+   - `/etc/udhcpc.d/50default` patched and verified ✅
+   - `/opt/Bose/udhcpc.script` patched and verified ✅
+   - CA certificate already trusted, skipping injection ✅
+
+5. **Reboot Speaker** → speaker came back online after ~30 s
+
+### Post-Migration
+
+- Paired speaker to Bose account via app — succeeded ✅
+- Set presets via app — worked ✅
+- Mirroring active and functional during session ✅
+- No visible errors in app behaviour; service logs and interaction recordings not yet reviewed in detail
+
+### Known Shell Warning (safe to ignore)
+
+Two commands produced `sh: rw: command not found`. This occurs because the service wraps commands with `(rw || ...)` as a fallback pattern, but the shell on the ST10 interprets `rw` as a bare command rather than a shell variable/flag. The primary command (`touch`, `mount`) still succeeds. This is a known cosmetic issue in the migration output.
+
+---
+
+## See Also
+
+- [CAPTURE-DEVICE-PAIRING.md](CAPTURE-DEVICE-PAIRING.md) — MITM setup and pairing capture
+- [MIGRATION-GUIDE.md](MIGRATION-GUIDE.md) — full migration reference
+- [SOUNDTOUCH-SERVICE.md](SOUNDTOUCH-SERVICE.md) — service architecture and configuration
+- [BOSE-APP-ADB-Emulator.md](../analysis/BOSE-APP-ADB-Emulator.md) — Frida + mitmproxy setup
@@ -139,7 +139,7 @@ soundtouch-cli --host 192.168.1.10 preset store \
 soundtouch-cli --host 192.168.1.10 preset store \
  --slot 2 \
  --source TUNEIN \
-  --location "/v1/playbook/station/s33828" \
+  --location "/v1/playback/station/s33828" \
  --name "K-LOVE Radio"

 # Store internet radio
@@ -956,7 +956,7 @@ soundtouch-cli --host 192.168.1.10 station add \
 # Remove a station (use location from browse/search results)
 soundtouch-cli --host 192.168.1.10 station remove \
  --source TUNEIN \
-  --location "/v1/playbook/station/s33828"
+  --location "/v1/playback/station/s33828"
 ```

 **Workflow Example - Discover and Play New Content:**
@@ -25,13 +25,17 @@ Used by most modern SoundTouch devices (ST-10, ST-20/30 Series III, SoundTouch 3
 The classic "failover" or "alternate" setup method.

 - **Mechanism**: The device creates its own Wi-Fi network (SSID: `Bose SoundTouch ...` or `Bose Home Speaker ...`).
- **IP Address**: Typically `192.168.1.1` or `10.0.0.1` (device-side).
+- **IP Address**: Typically `192.0.2.1` (device-side, verified on ST10).
 - **Web Interface**: The device hosts a web server on port 80.
 - **Process**:
  1. Connect a PC/Phone to the device's Wi-Fi.
-  2. Open a browser to `http://192.168.1.1`.
-  3. The device serves `setup.html`, which redirects to a setup wizard (`setup/index.html`).
-  4. Use the `gabbo_wifi` form to select a network and enter credentials.
+  2. Open a browser to `http://192.0.2.1`.
+  3. The device serves a Wi-Fi setup form — enter your home network SSID and password and click Submit.
+  4. The device disconnects from AP mode and joins your home network within ~15–30 seconds.
+
+![Speaker AP mode Wi-Fi setup page at 192.0.2.1](../images/speaker-ap-wifi-setup.png)
+
+For command-line provisioning (without a browser), see §6 below.

 ---

@@ -69,12 +73,97 @@ While the `soundtouch-service` focuses on migrating existing devices, a truly "c

 ---

+---
+
+## 5. Factory Reset Button Sequences
+
+A factory reset wipes Wi-Fi credentials, account pairing, and all presets, returning the device to out-of-box state. The exact sequence varies by hardware generation.
+
+> Sequences verified against official Bose reset guides in `firmware/FirmwareUpdateGuide/`. Confirm the reset succeeded by watching the status LEDs and by verifying the Wi-Fi indicator glows solid amber (setup mode).
+
+| Model                    | Factory Restore Sequence                                            | Confirm                            |
+|--------------------------|---------------------------------------------------------------------|------------------------------------|
+| SoundTouch 10            | Power on; hold **Preset 1** + **Volume −** for 10 s                 | Wi-Fi indicator glows solid amber  |
+| SoundTouch 20            | Power on; hold **Preset 1** + **Volume −** for 10 s                 | Lights blink L→R, then solid amber |
+| SoundTouch 20 Series III | Hold **Preset 1** + **Preset 6** simultaneously for ~10 s           | White LED sweep                    |
+| SoundTouch 30            | Power on; hold **Preset 1** + **Volume −** for 10 s (display counts down 10–1) | Display shows "Hold to restore factory settings", then restarts |
+| SoundTouch 30 Series III | Hold **Preset 1** + **Preset 6** simultaneously for ~10 s           | White LED sweep                    |
+| SoundTouch 300           | Hold **Volume −** until light bar blinks rapidly (~15 s)            | Rapid blink → off → on             |
+| SoundTouch 10 (alt)      | Press and hold the back recessed **Reset** pinhole for 10 s         | Status LED restarts                |
+| SoundTouch 20 (soft)     | Hold **AUX** for 15 s until display goes blank (settings preserved) | Display blanks                     |
+
+After factory restore the speaker enters setup mode automatically; no power-cycle is needed.
+
+---
+
+## 6. AP Mode Wi-Fi Provisioning via Console
+
+When BLE is unavailable (e.g. when using an Android emulator), use AP mode to push Wi-Fi credentials from the Mac command line.
+
+### 6.1 Connect Mac to Speaker AP
+
+After factory reset the speaker broadcasts an SSID like `Bose SoundTouch XXXX`. Connect the Mac to it:
+
+```bash
+# List nearby SSIDs — use System Settings → Wi-Fi (the airport command was removed in macOS Sequoia+)
+# Connect (replace with actual SSID)
+networksetup -setairportnetwork en0 "Bose SoundTouch XXXX"
+```
+
+The speaker's web UI gateway is at `192.0.2.1` (verified: ST10 assigns `192.0.2.2` to the client via DHCP).
+
+```bash
+# Confirm reachability
+curl -sv http://192.0.2.1/ 2>&1 | head -40
+```
+
+### 6.2 Trigger Wi-Fi Site Survey (Optional)
+
+The setup web UI at `http://192.0.2.1/` uses the SoundTouch API on **port 8090** — the same API as normal device operation. Trigger a network scan first so the speaker finds your SSID:
+
+```bash
+curl -s -X POST http://192.0.2.1:8090/performWirelessSiteSurvey \
+  -H 'Content-Type: text/xml' \
+  --data-raw '<PerformWirelessSiteSurvey timeout="5"/>'
+```
+
+### 6.3 Push Home Wi-Fi Credentials
+
+```bash
+HOME_SSID="MyHomeNetwork"
+HOME_PASS="MyPassword"
+
+curl -s -X POST http://192.0.2.1:8090/addWirelessProfile \
+  -H 'Content-Type: text/xml' \
+  --data-raw "<AddWirelessProfile><profile ssid=\"${HOME_SSID}\" password=\"${HOME_PASS}\" securityType=\"wpa_or_wpa2\" /></AddWirelessProfile>"
+```
+
+Expected response: `<?xml version="1.0" encoding="UTF-8" ?><AddWirelessProfileResponse />`
+
+The speaker will disconnect from AP mode and join the home network within ~15–30 s.
+
+### 6.4 Reconnect Mac to Home Network
+
+```bash
+networksetup -setairportnetwork en0 "MyHomeNetwork" "MyPassword"
+```
+
+Wait ~15 s for the speaker to join the home network, then verify:
+
+```bash
+# Discover the speaker's new IP via mDNS
+dns-sd -B _soundtouch._tcp local &
+sleep 5 ; kill %1
+```
+
+---
+
 ## Comparison: Initial Setup vs. Migration

-| Feature | Initial Setup | Migration (soundtouch-service) |
-| :--- | :--- | :--- |
-| **Connectivity** | BLE, AP Mode, USB, WAC | Ethernet/Wi-Fi (existing) |
-| **Credentials** | Required (SSID/Pass) | Not required (uses existing) |
-| **Access** | Web UI / App protocol | SSH (root) |
-| **Primary File** | `setup/index.html` | `SoundTouchSdkPrivateCfg.xml` |
-| **Use Case** | Out-of-the-box / Reset | Redirecting active devices |
+| Feature          | Initial Setup          | Migration (soundtouch-service) |
+|:-----------------|:-----------------------|:-------------------------------|
+| **Connectivity** | BLE, AP Mode, USB, WAC | Ethernet/Wi-Fi (existing)      |
+| **Credentials**  | Required (SSID/Pass)   | Not required (uses existing)   |
+| **Access**       | Web UI / App protocol  | SSH (root)                     |
+| **Primary File** | `setup/index.html`     | `SoundTouchSdkPrivateCfg.xml`  |
+| **Use Case**     | Out-of-the-box / Reset | Redirecting active devices     |
@@ -1,81 +1,103 @@
-# HTTPS Setup & Custom CA Certificate
+# HTTPS & Custom CA Certificate

-To use the `/etc/hosts` redirection method safely, SoundTouch devices must communicate over HTTPS. This requires the device to trust the AfterTouch Root CA certificate used by the local service.
+SoundTouch speakers communicate with cloud services over HTTPS. For the local service to work over HTTPS, speakers must trust the AfterTouch Root CA. The service manages this automatically — it generates a CA on first start and the web UI guides you through installing it on each speaker as part of the migration flow.

-## 1. Automated Migration (Hosts Method)
+> ### ⚠️ Speakers connect to `:443`, AfterTouch defaults to `:8443`
+>
+> Speakers build their target URLs from Bose hostnames *without* an explicit port, so they connect on the default HTTPS port **443**. AfterTouch's built-in HTTPS listener defaults to **8443** because port 443 is privileged on most Unix systems.
+>
+> **If you do nothing, speakers will fail with `Curl 7` / connection refused and nothing will appear in the AfterTouch HTTP log.**
+>
+> Pick one of the three options under [Binding to port 443](#binding-to-port-443) below. The settings page in the web UI shows a ✅ / ❌ indicator for `:443` reachability so you can confirm the routing is in place.

-The `soundtouch-service` can automatically configure a device to use the `/etc/hosts` method:
+---

-```bash
-curl -X POST "http://localhost:8000/setup/migrate/{deviceIP}?method=hosts"
+## How TLS works in AfterTouch
+
+The service includes a built-in HTTPS listener (default port `8443`) that presents a certificate covering all Bose cloud hostnames. The certificate is signed by the AfterTouch Root CA, which is generated automatically on first start and stored in `data/certs/`.
+
+**Domain coverage** — the certificate covers:
+- Wildcard: `*.api.bose.io`, `*.api.bosecm.com`
+- Specific: `streaming.bose.com`, `bmx.bose.com`, `stats.bose.com`, `updates.bose.com`, `worldwide.bose.com`, `bose-prod.apigee.net`, `media.bose.io`, `downloads.bose.com`, `voice.api.bose.io`, and more
+
+> **Note**: The hostname you configure as `HTTPS_SERVER_URL` (e.g. `https://soundtouch.fritz.box:8443`) is also added as a Subject Alternative Name, ensuring valid TLS for direct browser or API access.
+
+---
+
+## CA trust installation (via web UI)
+
+The migration flow in the web UI includes a CA trust step that:
+1. Uploads the Root CA to the speaker via SSH
+2. Appends it to the speaker's shared trust store (`/etc/pki/tls/certs/ca-bundle.crt`)
+3. Verifies connectivity over HTTPS
+
+This is handled automatically — you don't need to manage CA files manually unless you're doing an advanced or manual setup.
+
+---
+
+## Downloading the CA certificate
+
+You can download the Root CA for manual installation on other devices (phones, PCs, additional speakers):
+
+```
+http://<server>:8000/setup/ca.crt
 ```

-This command will:
-1.  Connect to the device via SSH.
-2.  Update `/etc/hosts` to point Bose domains to the service IP.
-3.  Inject the auto-generated AfterTouch Root CA into the device's trust store (`/etc/pki/tls/certs/ca-bundle.crt`).
-4.  Reboot the device.
+---

-## 2. Managing the Root CA
+## Binding to port 443

-The AfterTouch service automatically generates a Root CA when it first starts.
+Speakers expect HTTPS on the default port 443. Since binding to port 443 requires elevated privileges, you have three options:

- **CA Certificate**: `data/certs/ca.crt`
- **CA Private Key**: `data/certs/ca.key`
+1. **Port forwarding (recommended)**: Run the service on port 8443 and forward port 443 to it using `iptables` or your firewall/router. Inside an LXC/Docker container or on the host:

-### Downloading the CA Certificate
-You can download the CA certificate for manual installation on other devices (like your phone or PC) from:
-`http://<server-ip>:8000/setup/ca.crt`
+    ```bash
+    iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
+    iptables -t nat -A OUTPUT     -p tcp --dport 443 -j REDIRECT --to-port 8443
+    ```

-### 3. Built-in HTTPS Support
+    The first rule covers traffic arriving from speakers; the second covers loopback connections from the host itself (useful for the in-built pre-flight probe).

-The `soundtouch-service` now includes a built-in HTTPS listener. This simplifies the `/etc/hosts` redirection method by automatically presenting the correct certificates for Bose domains.
+2. **Capabilities**: Grant the binary permission to bind low ports and start the listener directly on `:443`:

- **HTTPS Port**: Configurable via `HTTPS_PORT` environment variable (defaults to `8443`).
- **HTTPS Server URL**: Configurable via `HTTPS_SERVER_URL` (e.g., `https://mysoundtouch.local:8443`). If not set, the service attempts to guess it using the system hostname.
- **Domain Coverage**: Automatically presents a certificate with comprehensive coverage using wildcard certificates (`*.api.bose.io`, `*.api.bosecm.com`) plus specific domains (`streaming.bose.com`, `updates.bose.com`, `stats.bose.com`, `bmx.bose.com`, `worldwide.bose.com`, `bose-prod.apigee.net`, etc.).
- **Wildcard Support**: Uses RFC-compliant wildcard certificates for automatic coverage of all API subdomains, including event analytics endpoints like `events.api.bosecm.com`, `eventsdev.api.bosecm.com`, and future API services.
- **TLS Error Logging**: Comprehensive logging of TLS handshake attempts, certificate matching, and connection failures for debugging DNS redirection issues.
- **Automatic Setup**: On first start, it generates a server certificate signed by your AfterTouch local Root CA.
+    ```bash
+    sudo setcap 'cap_net_bind_service=+ep' ./soundtouch-service
+    ./soundtouch-service --https-port=443
+    ```

-#### TLS Security & Debugging
+3. **Reverse proxy**: Use Nginx or Caddy on `:443` in front of the service (see below).

-The built-in HTTPS listener is configured to use modern and secure TLS settings while maintaining compatibility with SoundTouch devices (which support up to TLS 1.2 with OpenSSL 1.0.2).
+### Confirming `:443` is reachable

- **Minimum TLS Version**: TLS 1.2
- **Preferred Cipher Suites**:
-  - `ECDHE-RSA-AES128-GCM-SHA256`
- **TLS Debugging**: Detailed logging of:
-  - Certificate requests by domain (`[TLS] Certificate request for ServerName: events.api.bosecm.com`)
-  - Wildcard certificate matching (`[TLS] ✅ Serving certificate for events.api.bosecm.com (matched *.api.bosecm.com)`)
-  - Handshake failures (`[TLS] ❌ Handshake failed from 192.168.1.50: tls: certificate not found`)
-  - Successful connections (`[TLS] ✅ Successful connection from 192.168.1.50`)
-  - `ECDHE-RSA-AES256-GCM-SHA384`
-  - `ECDHE-RSA-CHACHA20-POLY1305`
-  - `RSA-AES128-GCM-SHA256` (Legacy support)
-  - `RSA-AES256-GCM-SHA384` (Legacy support)
+After applying any of the options above, open the AfterTouch web UI → **Settings**. The Target Domain row will show a second line:

-#### Binding to Port 443
-SoundTouch devices expect HTTPS on the default port 443. Since binding to port 443 usually requires root privileges, you have two options:
+* ✅ `:443 reachable on localhost and <IP> (forwarded to :8443)` — you're good.
+* ❌ `Speakers connect to :443 but AfterTouch listens on :8443.` — the routing is missing or not yet active.

-1.  **Port Forwarding (Recommended)**: Run the service on a high port (e.g., 8443) and use `iptables` or your firewall to forward traffic from 443 to 8443.
-2.  **Capabilities**: Grant the binary permission to bind to low ports: `sudo setcap 'cap_net_bind_service=+ep' ./soundtouch-service`.
-3.  **Reverse Proxy**: Use Nginx or Caddy as described below.
+A third line follows from the browser itself, which sits on the LAN exactly where the speakers do. The browser can't distinguish an untrusted-CA TLS error from a connection refusal, so it uses timing as a heuristic: a fast error means "no listener / firewall reset", a slower one means "something answered TCP". When the server-side and browser-side checks disagree, the UI flags it — that almost always means NAT, split-horizon DNS, or a host firewall sitting between AfterTouch and the LAN.

-### 4. Reverse Proxy (Optional)
+The same check runs once at service startup and prints a `[WARN]` log line if `:443` is unreachable, with the exact iptables/setcap commands for your current listener port.

-1.  **Generate a certificate** for the Bose domains signed by your Root CA.
-2.  **Configure Nginx** to use this certificate and proxy requests to `soundtouch-service`.
+#### When this check is shown
+
+The `:443` indicator is only displayed when **AfterTouch's DNS interception is enabled** (Settings → "Enable DNS Discovery Server"). The check is only meaningful for the **DNS migration method**, where speakers reach AfterTouch via intercepted Bose hostnames and therefore on the implicit `:443`. The other migration method — writing direct `https://<host>:8443/...` URLs into the speaker's private config via SSH — uses the port that's literally in the URL, so `:443` is irrelevant and the check would only add noise.
+
+If you intercept Bose hostnames **outside** AfterTouch (Pi-hole, router DNS rule, `/etc/hosts` on a gateway), the UI gate above will hide the indicator. The data is still in the `GET /setup/settings` JSON response (`https_443_localhost_reachable`, `https_443_lan_reachable`, `https_443_lan_host`) if you want to inspect it directly, or you can briefly enable AfterTouch's DNS server to see the indicator render.
+
+---
+
+## Reverse proxy (optional)
+
+If you prefer to use Nginx or another proxy for TLS termination:

 ```nginx
 server {
    listen 443 ssl;
    server_name streaming.bose.com bmx.bose.com stats.bose.com updates.bose.com;

-    ssl_certificate /path/to/generated-cert.crt;
-    ssl_certificate_key /path/to/generated-cert.key;
+    ssl_certificate /path/to/data/certs/server.crt;
+    ssl_certificate_key /path/to/data/certs/server.key;

-    # Secure TLS configuration (matches soundtouch-service defaults)
    ssl_protocols TLSv1.2;
    ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CHACHA20-POLY1305:AES128-GCM-SHA256:AES256-GCM-SHA384';

@@ -87,23 +109,41 @@ server {
 }
 ```

-## 5. Manual CA Injection (Legacy/Manual)
+> **Tell the service to honour `X-Real-IP`/`X-Forwarded-For`.** When deploying
+> behind a reverse proxy on the same host as above, set
+> `"trust_forwarded_headers": true` in `data/settings.json`. With that flag
+> on, the service rewrites `r.RemoteAddr` from the proxy-supplied headers,
+> so handlers that act on the source IP (e.g. the Spotify priming triggered
+> by `/marge/streaming/support/power_on`) see the speaker's real address
+> instead of the proxy's loopback peer.
+>
+> By default only `127.0.0.0/8` and `::1/128` are trusted to set those
+> headers. If your reverse proxy lives on a different host, list its CIDR(s)
+> in `"trusted_proxy_cidrs"` (e.g. `["10.0.0.0/8"]`). Do **not** enable
+> `trust_forwarded_headers` on a flat LAN deployment without a proxy: a
+> malicious speaker on the LAN can send the headers itself and spoof its
+> source IP.

-If you prefer to inject the CA certificate manually:
+---

-1.  Copy `ca.crt` to the device:
-    ```bash
-    scp data/certs/ca.crt root@{deviceIP}:/tmp/
-    ```
-2.  Append it to the trust store on the device:
-    ```bash
-    ssh root@{deviceIP} "(rw || mount -o remount,rw /) && cat /tmp/ca.crt >> /etc/pki/tls/certs/ca-bundle.crt"
-    ```
+## Manual CA injection (advanced)

-    ## 6. Verifying Connectivity
+If you need to inject the CA manually (e.g. without the web UI migration flow):

-    You can verify that your device can correctly reach the `soundtouch-service` over HTTPS using the management web UI.
+```bash
+# Copy the CA to the speaker
+scp data/certs/ca.crt root@<SPEAKER-IP>:/tmp/

-    In the **Migration Summary** for a device, you will find an **HTTPS Connection Test** section:
-    - **Test with Explicit CA.crt**: Uploads a temporary copy of the Root CA to the device and uses `curl --cacert` to verify the connection. Use this to verify your HTTPS setup *before* modifying the device's shared trust store.
-    - **Test with Shared Trust Store**: Uses the device's default trust store. Use this to verify that your CA injection was successful and the device now natively trusts your local server.
+# Make the filesystem writable and append the CA to the trust store
+ssh root@<SPEAKER-IP> "(rw || mount -o remount,rw /) && cat /tmp/ca.crt >> /etc/pki/tls/certs/ca-bundle.crt"
+```
+
+---
+
+## TLS compatibility
+
+SoundTouch speakers run OpenSSL 1.0.2, supporting up to TLS 1.2. The service is configured accordingly:
+
+- **Minimum TLS version**: TLS 1.2
+- **Preferred cipher suites**: `ECDHE-RSA-AES128-GCM-SHA256`, `ECDHE-RSA-AES256-GCM-SHA384`, `ECDHE-RSA-CHACHA20-POLY1305`
+- **Legacy support**: `RSA-AES128-GCM-SHA256`, `RSA-AES256-GCM-SHA384`
@@ -1,418 +1,300 @@
-# THIS IS A PLANNED TO BE THE MIGRATION GUIDE
+# Migration Guide: From Bose Cloud to AfterTouch

-> This migration guide is not finalized, yet.
-> We're using it as an orientation for the required implementation.
+This guide walks through the complete process of migrating your SoundTouch speakers from Bose's cloud services to **AfterTouch**, the local replacement provided by `soundtouch-service`. By the end, your speakers will work fully independently of Bose's servers.
+
+For a shorter overview, see the [Survival Guide](SURVIVAL-GUIDE.md). For safety considerations and rollback options, see the [Migration & Safety Guide](MIGRATION-SAFETY.md).

 ---

-# Complete Migration Guide - From Bose Cloud to Local SoundTouch Service
+## What you need

-## Overview
+- A machine that is **always on** (Raspberry Pi, NAS, home server, or similar) to run the service
+- A **USB drive** (FAT-formatted) to enable SSH on each speaker
+- Your speakers must be on the **same network** as the service host
+- About **15–30 minutes per speaker**

-This guide will walk you through migrating your Bose SoundTouch speakers from Bose's cloud services to AfterTouch, your own local SoundTouch service. By the end of this process, your speakers will be completely independent of Bose's servers while retaining all their functionality.
+---

-> **💡 Why Migrate?** Bose announced the shutdown of their SoundTouch cloud services in May 2026. This migration ensures your speakers continue working indefinitely with enhanced local control and monitoring.
+## Step 1: Install and start the service

-## What You'll Need
+Choose the option that fits your setup.

-### Hardware Requirements
- **Raspberry Pi 4 or similar** (minimum: Raspberry Pi Zero 2W)
- **MicroSD card** (16GB or larger)
- **USB drive** (for device preparation)
- **Network connection** for your Raspberry Pi
-
-### Before You Start
- **List all your SoundTouch devices** and their current locations
- **Note your current presets and favorites** (they will be preserved)
- **Ensure devices are on the same network** as your future SoundTouch service
- **Basic computer skills** (following instructions, using a web browser)
-
-### Time Estimate
- **Setup**: 30-60 minutes for the service installation
- **Per Device**: 10-15 minutes for each speaker migration
- **Total**: 1-3 hours depending on number of devices
-
-## Step 1: Install SoundTouch Service
-
-### Option A: Raspberry Pi Installation (Recommended)
-
-#### 1.1 Prepare Your Raspberry Pi
-
-1. **Flash Raspberry Pi OS** to your SD card using Raspberry Pi Imager (see the raspberrypi.com documentation)
-2. **Enable SSH** during imaging or create an empty `ssh` file on the boot partition
-3. **Boot your Pi** and connect it to your network
-4. **Find your Pi's IP address** (check your router or use `ping raspberrypi.local`)
-
-#### 1.2 Install SoundTouch Service
-
-Connect to your Pi via SSH and run:
+### Binary (go install)

 ```bash
-# Download and install
-curl -sSL https://github.com/gesellix/Bose-SoundTouch/releases/latest/download/install.sh | bash
-
-# Start the service
-sudo systemctl enable soundtouch-service
-sudo systemctl start soundtouch-service
+go install github.com/gesellix/bose-soundtouch/cmd/soundtouch-service@latest
+soundtouch-service
 ```

-#### 1.3 Verify Installation
+The service starts on port 8000. Open `http://localhost:8000` in your browser.

-1. Open your web browser
-2. Go to `http://[PI_IP_ADDRESS]:8000` (replace with your Pi's IP)
-3. You should see the **SoundTouch Service Dashboard**
+### Docker Compose (recommended for home servers and VMs)

-![SoundTouch Service Dashboard](../images/dashboard-home.png)
-*Example: SoundTouch Service main dashboard*
+The repository ships a `docker-compose.yml` ready for this use case. Clone or download it, copy the example config, then edit `.env` before starting:

-### Option B: Docker Installation
+```bash
+cp .env.example .env
+# Edit .env:
+#   SOUNDTOUCH_HOSTNAME=192.168.1.100   ← your server's address
+#   SOUNDTOUCH_VERSION=v0.70.0          ← pin to a release tag instead of 'latest'
+docker compose up -d
+```

-If you prefer Docker, run:
+`SOUNDTOUCH_HOSTNAME` is the address your speakers will use to reach the service — use a hostname or IP reachable from the speaker, not `localhost`.
+
+On **Linux** (Debian, Proxmox VE, Raspberry Pi OS, etc.) you can enable host networking for automatic speaker discovery. Uncomment the `network_mode: host` line in `docker-compose.yml` and remove the `ports:` section (they conflict with host networking). Without host networking, add your speakers by IP address in Step 4 instead.
+
+For local overrides (e.g. switching to `build: .` during development), create a `docker-compose.override.yml` — Docker Compose picks it up automatically and it is not tracked in version control.
+
+> **Note on `docker-compose.ci.yml`**: this file contains mock services used only for automated integration tests. It is not needed for your own deployment.
+
+### Docker run (Linux — with host networking for device discovery)

 ```bash
 docker run -d \
  --name soundtouch-service \
-  --restart unless-stopped \
-  -p 8000:8000 \
-  -p 8443:8443 \
-  -v soundtouch-data:/data \
-  gesellix/soundtouch-service:latest
+  --network host \
+  -v $(pwd)/data:/app/data \
+  ghcr.io/gesellix/bose-soundtouch:latest
 ```

-## Step 2: Create Your Account
+### Docker run (macOS / Windows — manual device IP required)

-### 2.1 Initial Setup
-
-1. **Open the dashboard** at `http://[SERVICE_IP]:8000`
-2. Click **"Create New Account"**
-3. **Fill in your details**:
-   - Account Name: `My Home Audio`
-   - Email: `your@email.com` (optional, for notifications)
-   - Migration Strategy: `Gradual` (recommended)
-
-![Account Creation](../images/account-creation.png)
-*Example: Account creation form*
-
-### 2.2 Account Configuration
-
-After creation, you'll see your **Account Dashboard**:
- **Account ID**: Unique identifier (e.g., `acc_home_audio_001`)
- **Status**: `Active - Ready for Migration`
- **Device Count**: Initially 0
- **Migration Status**: `Prepared`
-
-![Account Dashboard](../images/account-dashboard.png)
-*Example: Fresh account dashboard ready for device migration*
-
-### 2.3 Initial Settings
-
-Once your account is created, configure the global settings:
-1. **Settings**:
-   - Check **Target Domain**: Ensure it's reachable from the speaker (e.g., `soundtouch.fritz.box`).
-   - **DNS Discovery**: Enable DNS discovery on port `:53`. This is crucial for the DNS hook migration method.
-2. **Devices**:
-   - Go to the **"Device Discovery"** tab.
-   - Click **"Scan Network"** or manually add a speaker via IP address.
-   - Your devices should appear with **SSH Status**: `Enabled`.
-
-![Device Discovery](../images/device-discovery.png)
-*Example: Discovered devices with remote access enabled*
-
-## Step 3: Prepare Your Devices
-
-> **⚠️ Important**: This step temporarily enables SSH access on your speakers. SSH will be automatically disabled after migration unless you choose to keep it enabled.
-
-### 3.1 Enable Remote Services
-
-For each SoundTouch device:
-
-1. **Prepare a USB drive**:
-   - Format as FAT32
-   - Create an empty file named `remote_services` (no extension)
-   - (Optional) Firmware update/reset, see [Bose SoundTouch USB Update](https://downloads.bose.com/ced/soundtouch/soundtouch_usb/index.html)
-
-2. **Insert USB drive** into your SoundTouch speaker
-3. **Power cycle** the device (unplug for 10 seconds, then reconnect)
-
-![USB Preparation](../images/usb-remote-services.png)
-*Example: USB drive setup for enabling remote services*
-
-## Step 4: Discover and Register Devices
-
-### 4.1 Automatic Discovery
-
-The service automatically scans for SoundTouch devices every 5 minutes. To trigger immediate discovery:
-
-1. **Dashboard** → **"Devices"** → **"Discover Devices"**
-2. **Wait 30-60 seconds** for scan completion
-3. **Review discovered devices** in the list
-
-### 4.2 Register Devices to Your Account
-
-For each discovered device:
-
-1. **Click device name** in the discovery list
-2. **Verify device information**:
-   - Name: `Living Room Speaker`
-   - Model: `SoundTouch 30`
-   - MAC Address: `A8:1B:6A:53:6A:98`
-   - IP Address: `192.168.1.100`
-   - Status: `Discovered - Ready for Registration`
-
-3. **Click "Register to Account"**
-4. **Choose registration type**:
-   - **Fresh Setup**: For new or factory-reset devices
-   - **Migrate from Bose**: For devices with existing Bose account (recommended)
-
-![Device Registration](../images/device-registration.png)
-*Example: Device registration dialog with migration options*
-
-### 4.3 Device Registration Results
-
-After registration, you'll see:
- **Device Status**: `Registered - Active`
- **Account Association**: Your account name
- **Lifecycle State**: `Active`
- **Data Sources**: `Mirror Primary` (initially uses Bose, falls back to local)
-
-## Step 5: Migrate Individual Devices
-
-### 5.1 Step 3: Data Sync
-
-1. **Dashboard** → **"Devices"** → Select your device
-2. Click **"Data Sync"**
-3. This fetches configuration (presets, recents, sources) from the speaker to the SoundTouch service.
-
-### 5.2 Step 4: Migration
-
-Once data is synced, proceed to the migration tab for the device:
-
-1. **Backup XML**: Create an off-device backup of the current configuration.
-2. **Enable Persistent Remote Service**: This ensures SSH remains available after reboots.
-   - *Note*: If you see `'rw: command not found'`, you can safely ignore it.
-3. **CA Certificate Configuration**:
-   - **Test with explicit CA**: Verify the speaker can communicate using the local CA.
-   - **Trust CA now**: Inject the local Root CA into the speaker's trust store.
-   - **Test with shared trust store**: Verify general HTTPS communication.
-4. **Migration Method**:
-   - Select **"Redirect via DNS hook"**.
-   - **Test DNS Redirection**: Ensure the speaker correctly resolves the service domain.
-5. **Confirm Migration**: Apply the final changes to the speaker.
-
-#### Example Migration Output:
-```text
-Successfully created off-device backup of current configuration.
-Pre-flight: Write access verified.
-Resolved soundtouch.fritz.box to 192.168.1.100
-Uploaded /mnt/nv/soundtouch-service/aftertouch.resolv.conf
-/mnt/nv/rc.local already contains Aftertouch hook logic
-(rw || mount -o remount,rw /): sh: rw: command not found
-
-cp /etc/udhcpc.d/50default /etc/udhcpc.d/50default.original:
-Applied patch to /etc/udhcpc.d/50default
-Verified patch on /etc/udhcpc.d/50default
-cp /opt/Bose/udhcpc.script /opt/Bose/udhcpc.script.original:
-Applied patch to /opt/Bose/udhcpc.script
-Verified patch on /opt/Bose/udhcpc.script
-CA certificate already trusted, skipping injection
+```bash
+docker run -d \
+  --name soundtouch-service \
+  -p 8000:8000 -p 8443:8443 \
+  -v $(pwd)/data:/app/data \
+  --env SERVER_URL=http://soundtouch.local:8000 \
+  --env HTTPS_SERVER_URL=https://soundtouch.local:8443 \
+  ghcr.io/gesellix/bose-soundtouch:latest
 ```

-## Step 7: Complete Account Migration
+On macOS/Windows, device discovery via mDNS won't work inside the container — you'll add devices by IP address in Step 4.

-### 7.1 Migrate All Devices
-
-Repeat the migration process for each of your SoundTouch devices. You can migrate multiple devices simultaneously, but we recommend doing 1-2 at a time to monitor progress.
-
-**Migration Dashboard** shows overall progress:
- **Devices Migrated**: `2 of 4 completed`
- **Currently Migrating**: `Living Room Speaker, Kitchen Speaker`
- **Pending Migration**: `Bedroom Speaker, Office Speaker`
- **Estimated Completion**: `3 days remaining`
-
-![Account Migration Status](../images/account-migration.png)
-*Example: Account-wide migration progress*
-
-### 7.2 Verify Complete Migration
-
-When all devices are migrated:
-
-1. **Account Status**: `Active - Fully Migrated`
-2. **Bose Dependency**: `None`
-3. **Local Control**: `100%`
-4. **Device Health**: All devices show `Healthy - Local Only`
-
-![Migration Complete](../images/migration-complete.png)
-*Example: Completed migration dashboard*
-
-## Step 8: Post-Migration Tasks
-
-1. **Remove USB stick** from the speaker.
-2. **Reboot** the device to apply all changes.
-
-### 8.1 Disable Remote Services (Optional)
-
-For enhanced security, you can disable SSH on migrated devices. However, keeping it enabled allows for easier future maintenance or reverts.
-
-### 8.2 Configure Backups
-
-Set up automatic backups of your device configurations:
-
-1. **Dashboard** → **"Settings"** → **"Backup"**
-2. **Enable Automatic Backups**: ✅
-3. **Backup Schedule**: `Daily at 2 AM`
-4. **Retention**: `Keep 30 days`
-5. **Export Location**: `/data/backups` or external storage
-
-![Backup Configuration](../images/backup-setup.png)
-*Example: Backup configuration settings*
-
-### 8.3 Set Up Monitoring Alerts (Optional)
-
-Configure notifications for important events:
-
-1. **Dashboard** → **"Settings"** → **"Notifications"**
-2. **Email Notifications**: Enter your email
-3. **Alert Types**:
-   - ✅ Device goes offline
-   - ✅ Migration failures
-   - ✅ Service errors
-   - ✅ Daily health summary
-
-## Troubleshooting Common Issues
-
-### Device Not Discovered
-
-**Problem**: Device doesn't appear in discovery scan
-
-**Solutions**:
-1. **Check network**: Ensure device and service are on same network
-2. **Verify USB setup**: Confirm `remote_services` file was processed
-3. **Power cycle**: Unplug device for 30 seconds, reconnect
-4. **Manual add**: Dashboard → "Devices" → "Add Manually" with IP address
-
-### Migration Stuck
-
-**Problem**: Device stuck in "Migrating" status
-
-**Solutions**:
-1. **Check device health**: Dashboard → Device → "Health Status"
-2. **Review logs**: Dashboard → Device → "View Logs"
-3. **Restart migration**: Device → "Migration" → "Restart Process"
-4. **Rollback**: Device → "Migration" → "Rollback to Bose"
-
-### Presets Not Working
-
-**Problem**: Saved presets don't work after migration
-
-**Solutions**:
-1. **Verify sources**: Check configured sources are still available
-2. **Re-authenticate**: Re-login to music services (Spotify, etc.)
-3. **Rebuild presets**: Dashboard → Device → "Presets" → "Rebuild from Backup"
-
-### Service Unreachable
-
-**Problem**: Cannot access SoundTouch Service dashboard
-
-**Solutions**:
-1. **Check service status**: `sudo systemctl status soundtouch-service`
-2. **Restart service**: `sudo systemctl restart soundtouch-service`
-3. **Check network**: Verify Pi is connected and accessible
-4. **Check ports**: Ensure ports 8000 and 8443 are not blocked
-
-## Advanced Features
-
-### Multi-Zone Management
-
-After migration, your multi-zone setups work seamlessly:
-
-1. **Dashboard** → **"Zones"**
-2. **Create Zone**: Select primary device and slaves
-3. **Zone Control**: Play, pause, volume control for entire zone
-4. **Individual Control**: Override individual speakers in zone
-
-### Custom Sources
-
-Add custom streaming sources:
-
-1. **Dashboard** → **"Sources"** → **"Add Custom"**
-2. **Configure**:
-   - Name: `Local Radio Station`
-   - Stream URL: `http://stream.example.com:8000`
-   - Image URL: `http://example.com/logo.png`
-3. **Assign to devices**: Select which devices can access this source
-
-### API Access
-
-For developers and advanced users:
-
- **REST API**: `http://[SERVICE_IP]:8000/api/v1/`
- **Documentation**: `http://[SERVICE_IP]:8000/docs`
- **WebSocket Events**: Real-time device status updates
- **Export Data**: JSON/XML export of all device configurations
-
-## Maintenance and Monitoring
-
-### Daily Monitoring
-
-Check your **Dashboard Summary**:
- **All Devices Online**: ✅ Green indicators
- **Response Times**: < 100ms average
- **Error Rate**: < 1%
- **Storage Usage**: Monitor disk space
-
-### Weekly Tasks
-
-1. **Review Health Reports**: Check weekly device health summaries
-2. **Update Service**: Check for SoundTouch service updates
-3. **Backup Verification**: Ensure backups are completing successfully
-4. **Log Review**: Check for any recurring issues or warnings
-
-### Monthly Tasks
-
-1. **Full System Backup**: Export complete account and device data
-2. **Performance Review**: Analyze response times and error patterns
-3. **Security Update**: Update Raspberry Pi OS and service
-4. **Capacity Planning**: Monitor storage and consider expansion
-
-## Getting Help
-
-### Documentation Resources
-
- **Technical Reference**: `/docs/reference/` - Detailed API and configuration docs
- **Troubleshooting Guide**: `/docs/guides/TROUBLESHOOTING.md` - Common issues and solutions
- **Community Forum**: GitHub Discussions for community support
-
-### Diagnostic Information
-
-When seeking help, provide:
-
-1. **System Information**: Dashboard → "System" → "Download Diagnostic Report"
-2. **Device Logs**: Dashboard → Device → "Export Logs"
-3. **Migration History**: Dashboard → "Migration" → "Export Timeline"
-4. **Current Status**: Screenshot of main dashboard
-
-### Support Channels
-
- **GitHub Issues**: Technical bugs and feature requests
- **Community Discussions**: User questions and experiences
- **Documentation Updates**: Corrections and improvements
+See [Raspberry Pi Setup](RASPBERRY-PI.md) and the [SoundTouch Service Guide](SOUNDTOUCH-SERVICE.md) for more deployment options.

 ---

-## Summary
+## Step 2: Configure the service URL

-Congratulations! 🎉 You've successfully migrated your SoundTouch speakers to local control. Your devices are now:
+Open `http://<server>:8000` and go to the **Settings** tab.

- ✅ **Independent** of Bose cloud services
- ✅ **Fully functional** with all original features preserved
- ✅ **Enhanced** with better monitoring and control
- ✅ **Future-proof** against service shutdowns
+![AfterTouch Settings tab](../images/ui-settings.png)

-**What's Next?**
+Set the **Target Domain** to the address your speakers can reach — for example `https://soundtouch.fritz.box` or `http://192.168.1.100:8000`. This must be the host's address on your local network, not `localhost`.

- **Enjoy your music** with enhanced local control
- **Monitor your system** through the dashboard
- **Share your experience** with the community
- **Explore advanced features** as you become more comfortable
+If you plan to use DNS/DHCP redirect, enable the **DNS Discovery Server** and set the **DNS Bind Address** to `:53`. The upstream DNS should be your router's IP, not the service's own address.

-Your SoundTouch speakers will now continue working indefinitely, regardless of external service availability. Welcome to true audio independence! 🔊
+> **Tip**: If you change settings and they don't seem to take effect, check `data/settings.json` — settings saved in the UI take precedence over environment variables.
+
+---
+
+## Step 3: Enable shell access on each speaker
+
+The wizard supports **two transports** for talking to the speaker. Pick whichever your device exposes:
+
+### SSH (recommended — required for XML migration, DNS interception, and CA install)
+
+The XML migration writes updated configuration to the speaker's filesystem, which requires SSH access. Enable it once per device:
+
+1. Format a USB drive as FAT (FAT32). Some speakers require the **bootable flag** to be set on the partition — see [SoundCork issue #172](https://github.com/deborahgu/soundcork/issues/172) for details.
+2. Create an empty file named **`remote_services`** (no extension) in the root of the drive.
+3. Insert the drive into the speaker's USB port while it is powered on.
+4. Power-cycle the speaker (unplug the power cable, wait 10 seconds, reconnect).
+5. After boot, root SSH is available with no password: `ssh -oHostKeyAlgorithms=+ssh-rsa root@<SPEAKER-IP>`
+
+You only need to do this once per speaker. SSH can remain enabled for future maintenance or be disabled after migration — your choice.
+
+### Telnet:17000 (fallback when SSH isn't possible)
+
+If the USB-stick unlock doesn't work on your speaker (some firmware revisions refuse it — notably SA-5, ST520, and recent ST Portables), the wizard falls back to the speaker's **built-in diagnostic shell on TCP port 17000**. No setup required — most SoundTouch firmware exposes it automatically. The wizard detects which transports are available and picks the right one; you don't have to choose manually.
+
+Telnet-only migrations are limited to HTTP (no CA install possible without SSH). The wizard surfaces this clearly when it applies.
+
+---
+
+## Step 4: Add and sync your speaker
+
+### Discover
+
+The service scans for SoundTouch devices automatically every few minutes. Check the **Devices** tab in the web UI. If your speaker doesn't appear, click **Scan Again** to trigger an immediate scan, or enter the IP address manually and click **Add Device**.
+
+![AfterTouch Devices tab showing discovered speakers](../images/ui-devices.png)
+
+### Sync
+
+Once the speaker appears, click **Sync Data**. This connects to the speaker and pulls its current presets, recently played items, and configured sources into the local service's datastore. It also creates an off-device backup of the speaker's configuration.
+
+![Data Sync tab showing a successful sync](../images/ui-sync.png)
+
+If the Bose cloud is still running, Sync also fetches your account data from Bose's servers. This is your preservation step — do it before the cloud shuts down.
+
+---
+
+## Step 5: Migrate
+
+Click **Migrate** next to a device on the Devices tab to open the Migration tab. The tab opens with a **Migration Summary** that shows where your speaker currently stands, then offers a one-click suggested plan and a fully customizable form underneath.
+
+![Migration tab showing the state card and Plan card](../images/ui-migration.png)
+
+### What you see at the top — the state card
+
+Three rows tell you the speaker's current state at a glance:
+
+- **Transports** — whether SSH and Telnet:17000 are reachable. The wizard's choices are driven by these.
+- **Migration State** — three orthogonal axes:
+  - *URL Configuration* — original Bose URLs or AfterTouch URLs (with a special "intercepted via DNS" verdict when the resolv.conf hook is doing the redirect).
+  - *DNS Interception* — none, or `/etc/resolv.conf` hook active.
+  - *CA / TLS* — local root CA installed on the device, with `Trust CA Now` and `Download CA cert` actions inline.
+- **Preconditions** — `remote_services` persistence, account pairing state, and XML config backup presence.
+
+### The Plan card — the happy path
+
+Below the state card is the **Plan** card. For most users this is the only thing you'll touch:
+
+1. **Target service URL** — pre-filled from your Settings. Edit inline and click *Save as default* to update Settings without bouncing tabs.
+2. **Capabilities** — what transports the speaker exposes and what AfterTouch can offer given those.
+3. **Service URLs** — four URL inputs (margeServerUrl, statsServerUrl, swUpdateUrl, bmxRegistryUrl) pre-filled with canonical defaults. Most users leave them as-is; soundcork users tick the *Soundcork mode* checkbox to append `/marge` to `margeServerUrl`. URL validation runs on every keystroke.
+4. **Account pairing** — pre-filled with the speaker's current account ID. Leave it to keep the existing pairing, change it to re-pair, or click *Generate* to assign a new 7-digit ID on a factory-reset device.
+5. **Suggested plan** — one big green button: *Apply Suggested Plan*. The wizard picks the most conservative recipe for your speaker (XML over SSH with HTTP when SSH works; telnet URL flip with HTTP when only telnet works) and runs it.
+
+### What happens when you click Apply
+
+The wizard switches to a visible **Pre-flight checks** panel and runs every applicable verification before touching the speaker:
+
+- **Backend summary re-check** — confirms transports, hostname resolution, and that the URLs you plan to write match what the backend would produce.
+- **HTTPS connection from device** (SSH-capable speakers) — uploads a temporary CA and runs `curl` from the speaker to your service.
+- **Reachability check (passive observer)** (already-migrated speakers) — nudges `:8090/swUpdateCheck` on the device and watches for *any* request from the speaker to land on the service. Used when the speaker is already migrated and the service is the natural target of its outbounds.
+- **"Round-trip validation runs after Apply + reboot"** (not-yet-migrated speakers) — surfaced as a skip row with a rationale. The speaker's swUpdate daemon caches its URL at boot, so there is no useful no-reboot round-trip check pre-migration; the canonical telnet flow is Apply → reboot → re-run pre-flight on the migrated speaker.
+- **DNS redirection from device** — when DNS interception is part of the plan.
+
+On all-green, the wizard auto-proceeds. On any failure, it pauses with *Proceed Anyway* / *Cancel* buttons so you can override on a known-false-positive (slow DNS, etc.) or fix the underlying issue and retry.
+
+### Customize this migration — for mix-and-match
+
+Expand the `▸ Customize this migration` section to pick any combination of three independent axes:
+
+- **URL flip transport** — XML over SSH / Telnet (Port 17000) / Skip
+- **DNS interception** — None / `/etc/resolv.conf` hook
+- **Local CA install** — checkbox (SSH-only)
+
+Each option carries a per-axis availability hint (e.g. *(SSH unreachable)*, *(already trusted)*) so you see why an option is disabled before you pick. *Apply Custom Plan* runs the chosen combination as a sequence; the same pre-flight panel gates the execution.
+
+> **Note**: DNS interception bundles the CA install on the backend, so a standalone CA-install step is skipped automatically when DNS is part of the plan. The wizard handles this for you.
+
+---
+
+## Step 6: Reboot and verify
+
+After a successful Apply the wizard auto-expands the Customize section and highlights the **Reboot Speaker** button. Click it (or power-cycle the speaker manually) to apply all configuration changes. The reboot transport is picked automatically from your URL flip choice — telnet reboot for SSH-less speakers, SSH reboot otherwise.
+
+After reboot:
+- The speaker should appear as **migrated** in the Devices tab
+- The state card on the Migration tab should now show ✅ for URL Configuration (or "intercepted via DNS" if you used the resolv.conf hook)
+- Presets should load and play (served from the local service)
+- TuneIn browsing should work
+- Recently played items should appear
+
+If something doesn't work, check the **Interactions** tab in the web UI for failed requests, and the **Troubleshooting** section in the [SoundTouch Service Guide](SOUNDTOUCH-SERVICE.md).
+
+---
+
+## Repeat for each speaker
+
+Each speaker is migrated independently. You can run multiple migrations in parallel, but migrating one at a time makes it easier to diagnose issues.
+
+---
+
+## Alternative: CLI-driven factory-reset workflow
+
+If you prefer scripting the migration, or the wizard isn't an option (headless server, automation, batch onboarding of many speakers), `soundtouch-cli` exposes the same building blocks. The flow below is **not** an in-place migration — it factory-resets the speaker and brings it up fresh against AfterTouch, so any data Bose preserved on the device is wiped. Use this when:
+
+- You're starting from a factory-reset speaker anyway.
+- The wizard's in-place migration didn't take and you want a clean slate.
+- You're scripting setup for many speakers and want a reproducible recipe.
+
+### Prerequisites
+
+- AfterTouch service running and reachable at a stable URL (e.g., `https://soundtouch.local` from your `.env`).
+- The speaker reachable on its current IP (passed as `--host`).
+- For the AP-mode handover step, your laptop must be able to join the speaker's `Bose SoundTouch` Wi-Fi (you'll switch between home Wi-Fi and the speaker's AP).
+
+### The full sequence
+
+```bash
+# 1. Plan what the reset+pair pipeline will write (dry run, no changes yet).
+soundtouch-cli --host 192.168.1.50 setup plan \
+  --reset=true --include-pair=false \
+  --service-url='https://soundtouch.local'
+
+# 2. Trigger the factory reset. The speaker reboots into AP mode.
+soundtouch-cli --host 192.168.1.50 setup factory-reset
+
+# --- Manual step: join the speaker's Wi-Fi AP (SSID "Bose SoundTouch ...") ---
+
+# 3. Wait for the AP-mode endpoint to answer.
+soundtouch-cli setup wait-ap
+
+# 4. Push your home Wi-Fi credentials to the speaker.
+#    Run twice if the first attempt's ACK races the AP teardown — the second
+#    one is a no-op if the first succeeded.
+soundtouch-cli setup wifi-push --ssid="YourHomeSSID" --pass='your-wifi-password'
+
+# --- Manual step: switch your laptop back to the home Wi-Fi network ---
+
+# 5. Wait for the speaker to come back online on the home network.
+#    --match takes the last 4-6 hex chars of the speaker's MAC (visible on
+#    the bottom of the device).
+soundtouch-cli setup wait-online --match=42CAFE
+
+# 6. Pair the speaker with an AfterTouch account.
+#    --mode=full runs the canonical WebSocket SETUP sequence (matches the
+#    Bose app's flow); --account is the 7-digit account ID AfterTouch
+#    should attach the speaker to.
+soundtouch-cli --host 192.168.1.50 setup pair \
+  --mode=full --account=1111111 \
+  --service-url='https://soundtouch.local'
+```
+
+### Verifying the result
+
+After pairing completes:
+
+- The speaker should appear on the **Devices** tab in the web UI.
+- AUX should switch and play audio when selected.
+- Pressing presets should fetch their content from AfterTouch (the `[LOG]` rows on the service confirm).
+- TuneIn search and playback should work end-to-end.
+
+If any of these fail post-pair, see [Troubleshooting](TROUBLESHOOTING.md) — most commonly the speaker just needs a power cycle to pick up everything cleanly.
+
+### Differences vs the wizard
+
+| Aspect                              | Wizard (in-place migration)                             | CLI factory-reset workflow                              |
+|-------------------------------------|---------------------------------------------------------|---------------------------------------------------------|
+| Preserves speaker's existing state  | yes (Presets, recents, attached account)                | **no** — wipes everything                               |
+| Requires Wi-Fi-network switching    | no                                                      | yes (laptop joins speaker AP, then home network)        |
+| Scriptable / reproducible           | clickable, not scriptable                               | full bash recipe                                        |
+| Cloud-side data (Bose Marge backup) | preserved if Sync ran while cloud was alive             | not relevant — fresh account on AfterTouch              |
+| Best for                            | "I want this speaker to keep working with what's on it" | "I want a clean, reproducible setup against AfterTouch" |
+
+The wizard is still the recommended path for a one-off migration of an existing setup. The CLI workflow is the right choice when you're scripting, batching, or already starting from a reset.
+
+---
+
+## Rollback
+
+If you need to undo a migration:
+
+- **From the web UI**: Use the **Revert to Defaults** action on the device — this restores the `.original` backup files created on the speaker during the XML migration.
+- **Telnet-only migrations**: the wizard writes both the runtime configuration layer (`sys configuration …`) and the persistent layer (`envswitch boseurls set …`) so the migration survives reboot. If you want to revert quickly, the cleanest path is to re-run the wizard with the original Bose URLs in the URL editor.
+- **Via SSH**: The original XML config is backed up on the speaker with a `.original` suffix. Restore it manually if the UI is unreachable.
+- **Factory reset**: As a last resort, perform a factory reset (see [Device Initial Setup](DEVICE-INITIAL-SETUP.md) for button sequences). This wipes all configuration and returns the speaker to out-of-box state.
+
+---
+
+## Post-migration
+
+Once all speakers are migrated, the `data/` directory is the source of truth for your presets, recents, and device state. Back it up periodically. The web UI at `http://<server>:8000` is your management interface from this point on.
+
+For the Bose cloud backup you created in Step 4, keep the `.tar.gz` archive in case you need to restore credentials or presets later.
@@ -1,4 +1,4 @@
-### Professional Migration & Safety Guide
+# Migration & Safety Guide

 Starting a migration on real hardware requires a "Safety First" approach. This guide outlines the safety features implemented in the `soundtouch-service` and provides a checklist for a successful migration.

@@ -14,8 +14,8 @@ The following features are built into the `soundtouch-service` to ensure stabili

 Before you proceed with the actual migration, follow these steps:

-1.  **Enable SSH Access (Prerequisite)**: This toolkit requires SSH access to your speakers, which is not enabled by default. 
-    - Create an empty file named `remote_services` on a USB stick.
+1.  **Enable SSH Access (Prerequisite)**: This toolkit requires SSH access to your speakers, which is not enabled by default.
+    - Create a file named `remote_services` on a FAT-formatted USB drive. The drive may need its bootable flag set — see [SoundCork issue #172](https://github.com/deborahgu/soundcork/issues/172) for details.
    - Insert the USB stick into the SoundTouch speaker's **SERVICE** port.
    - Reboot the speaker (unplug and replug).
    - The speaker will now allow SSH connections as `root` with no password.
@@ -27,10 +27,11 @@ Before you proceed with the actual migration, follow these steps:
 4.  **Validate SSH Access**: Confirm the device responds to SSH without a password. 
    - In the Web UI **Migration** tab, select your speaker and verify that the "SSH Connection" status shows ✅ Success.
    - This toolkit automatically handles the necessary SSH parameters (ciphers and key exchanges) required by older Bose firmware.
-5.  **Migration Methods**: 
-    - **XML Migration (Default)**: Less invasive, only changes the application config. Best for simple redirection.
-    - **Hosts Migration**: Modifies `/etc/hosts` on the device. Good for system-wide redirection of specific domains.
-    - **ResolvConf Migration**: Points the device to the AfterTouch DNS server. Best for discovering unknown Bose endpoints and dynamic interception. **Note**: This method requires the DNS Discovery Server to be running on port 53. The service includes a pre-flight check to ensure the server is properly bound before allowing this migration.
+5.  **Migration Methods**:
+    - **XML redirect (default)**: Uploads a config file to the speaker via the Web API. Less invasive — only changes the application-level service URLs. Best for testing or single-device migration.
+    - **DNS/DHCP redirect**: Configures the speaker to use a custom DNS server that resolves Bose hostnames to the local service. Best for all-device coverage; requires the AfterTouch DNS server running on port 53. The service includes a pre-flight check before applying this method.
+    
+    The web UI walks you through both methods. Both require the CA certificate to be trusted on the speaker for HTTPS to work — the web UI handles this as part of the migration flow.
 6.  **Monitor Logs**: Run the `soundtouch-service` with `DEBUG` or `INFO` logging to see the step-by-step progress of the migration.

 #### 🔄 Rollback Strategy
@@ -0,0 +1,136 @@
+# Connecting Music Services (Spotify & Amazon Music)
+
+This guide explains how to link your Spotify or Amazon Music account to AfterTouch so your speakers can stream music from those services.
+
+> For Spotify, a higher-level mental model of how the integration works —
+> Spotify Connect vs. AfterTouch's OAuth-intercept path, the
+> `streamingoauth.bose.com` DNS gotcha, and the token lifecycle — is in
+> [docs/concepts/spotify-overview.md](../concepts/spotify-overview.md).
+> Read that if priming or playback isn't behaving as you'd expect.
+
+---
+
+## How it works
+
+Connecting a music service happens in three separate steps, each done once:
+
+1. **Register a developer app** with Spotify or Amazon (one-time setup by the person running AfterTouch).
+2. **Authorize your personal account** so AfterTouch can access your music library.
+3. **Prime your speaker** so the speaker itself learns about the source.
+
+Each step is described below. If someone else is hosting AfterTouch for you, step 1 may already be done — ask them.
+
+---
+
+## Who registers the developer app?
+
+The developer app is what allows AfterTouch to talk to Spotify's or Amazon's servers on behalf of users. It requires registering an account on a developer portal.
+
+**If you run AfterTouch for yourself only:** You register one app and use it yourself.
+
+**If you run AfterTouch for a group** (e.g., your household): You register one app, configure it in AfterTouch, and everyone who uses your AfterTouch instance shares it. They never see your app credentials — those stay on your server. However, they do need to trust you, since their music account tokens are stored by your AfterTouch installation.
+
+**If you don't trust the AfterTouch operator:** Run your own AfterTouch instance and register your own app. That way everything stays under your control.
+
+---
+
+## Spotify
+
+### Step 1: Register a Spotify developer app
+
+1. Go to [developer.spotify.com/dashboard](https://developer.spotify.com/dashboard) and log in with your Spotify account.
+2. Click **Create app**.
+3. Give it any name and description (e.g., "My AfterTouch").
+4. Under **Redirect URIs**, add:
+   ```
+   http://<your-aftertouch-ip>:8000/mgmt/spotify/callback
+   ```
+   Replace `<your-aftertouch-ip>:8000` with the address of your AfterTouch server.
+5. Save the app.
+6. Open the app's settings and note down the **Client ID** and **Client Secret**.
+
+### Step 2: Enter credentials in AfterTouch
+
+1. Open the AfterTouch web interface and go to the **Settings** tab.
+2. Scroll to **Spotify Integration**.
+3. Enter your **Client ID**, **Client Secret**, and the **Redirect URI** you registered above.
+4. Click **Save Settings**.
+
+The status should change to **Active**.
+
+### Step 3: Authorize your Spotify account
+
+1. Go to the **Local Account** tab (tab 7).
+2. Click **Connect Spotify to this Account**.
+3. A Spotify login window opens. Log in and grant permission.
+4. When the window closes, your account is linked. You should see your Spotify username appear.
+
+### Step 4: Prime your speaker
+
+After authorizing, each speaker needs to be told about the Spotify source.
+
+1. Go to the **Devices** tab (tab 2).
+2. Find your speaker and click **Prime Spotify**.
+3. The speaker will now show Spotify as an available source.
+
+Repeat step 4 for each speaker.
+
+---
+
+## Amazon Music
+
+> **Current status: account linking works, streaming does not.**
+>
+> The OAuth flow and token storage are fully functional. However, the speaker's `AmazonClient` contacts `music-api.amazon.com` directly with the access token and receives a 401. Amazon Music's streaming API requires scopes that are only available to registered Amazon Music partners — a standard Login with Amazon app does not qualify. The infrastructure is in place and will work if those scopes ever become available, but following these steps will not result in working Amazon Music playback today.
+
+### Step 1: Register an Amazon developer app (LWA)
+
+1. Go to [developer.amazon.com/loginwithamazon/console/site/lwa/overview.html](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html) and log in with your Amazon account.
+2. Click **Create a New Security Profile**.
+3. Give it any name and description (e.g., "My AfterTouch").
+4. In the security profile's **Web Settings**, add under **Allowed Return URLs**:
+   ```
+   http://<your-aftertouch-ip>:8000/mgmt/amazon/callback
+   ```
+   Replace `<your-aftertouch-ip>:8000` with the address of your AfterTouch server.
+5. Save and note down the **Client ID** and **Client Secret**.
+
+### Step 2: Enter credentials in AfterTouch
+
+1. Open the AfterTouch web interface and go to the **Settings** tab.
+2. Scroll to **Amazon Music Integration**.
+3. Enter your **Client ID**, **Client Secret**, and the **Redirect URI** you registered above.
+4. Click **Save Settings**.
+
+The status should change to **Active**.
+
+### Step 3: Authorize your Amazon account
+
+1. Go to the **Local Account** tab (tab 7).
+2. Click **Connect Amazon Music to this Account**.
+3. An Amazon login window opens. Log in and grant permission.
+4. When the window closes, your account is linked.
+
+### Step 4: Prime your speaker
+
+1. Go to the **Devices** tab (tab 2).
+2. Find your speaker and click **Prime Amazon**.
+3. The speaker will now show Amazon Music as an available source.
+
+Repeat step 4 for each speaker.
+
+---
+
+## Troubleshooting
+
+**"Failed to initialize" when clicking Connect:**
+The app credentials in Settings are missing or incorrect. Double-check the Client ID, Client Secret, and Redirect URI. The Redirect URI in AfterTouch must exactly match the one registered in the developer portal.
+
+**The login window opens but redirects to an error page:**
+The Redirect URI registered with Spotify/Amazon does not match what AfterTouch is sending. Make sure the address (including the port) is identical in both places.
+
+**The speaker doesn't show the new source after priming:**
+Try rebooting the speaker. It may take a minute to update its source list after priming.
+
+**The login window doesn't open (popup blocked):**
+Allow popups from the AfterTouch address in your browser settings, then try again. Alternatively, the status message will show a direct link you can click.
@@ -0,0 +1,132 @@
+# Self-Hosting AfterTouch
+
+This guide walks you through running AfterTouch on your own computer or server. No programming knowledge required.
+
+---
+
+## What is self-hosting?
+
+AfterTouch is software that runs on a computer in your home and takes over the role of Bose's cloud servers. Your speakers talk to it instead of Bose.
+
+For this to work, the computer running AfterTouch must be:
+
+- **Always on** (or at least on whenever you want to use your speakers)
+- **On the same local network** as your speakers
+- **Reachable by a stable IP address** (see [Stable IP Address](#stable-ip-address) below)
+
+Good choices: a Raspberry Pi, a NAS (like Synology or QNAP), an always-on PC or Mac, or a small server. A laptop that you close and put away is not ideal.
+
+---
+
+## Step 1: Get the software
+
+Go to the [AfterTouch releases page](https://github.com/gesellix/Bose-SoundTouch/releases) and download the latest release for your operating system:
+
+| Your system           | File to download                         |
+|-----------------------|------------------------------------------|
+| Raspberry Pi (64-bit) | `soundtouch-service_linux_arm64.tar.gz`  |
+| Raspberry Pi (32-bit) | `soundtouch-service_linux_arm.tar.gz`    |
+| Linux (64-bit PC)     | `soundtouch-service_linux_amd64.tar.gz`  |
+| macOS (Apple Silicon) | `soundtouch-service_darwin_arm64.tar.gz` |
+| macOS (Intel)         | `soundtouch-service_darwin_amd64.tar.gz` |
+| Windows               | `soundtouch-service_windows_amd64.zip`   |
+
+Extract the archive. You will find a single file called `soundtouch-service` (or `soundtouch-service.exe` on Windows).
+
+### Alternative: Docker
+
+If you already use Docker, you can run AfterTouch as a container instead. See the [Deployment Guide](DEPLOYMENT.md) for Docker instructions.
+
+---
+
+## Step 2: Run it
+
+Open a terminal (or Command Prompt on Windows), navigate to the folder where you extracted the file, and run:
+
+```
+./soundtouch-service
+```
+
+On Windows:
+```
+soundtouch-service.exe
+```
+
+You should see log output like:
+```
+Starting AfterTouch service on :8000
+```
+
+AfterTouch is now running on port 8000.
+
+---
+
+## Step 3: Open the web interface
+
+In a web browser on any device on your network, go to:
+
+```
+http://<your-server-ip>:8000
+```
+
+Replace `<your-server-ip>` with the actual IP address of the computer running AfterTouch. For example: `http://192.168.1.100:8000`.
+
+If you are on the same computer that is running AfterTouch, you can use `http://localhost:8000`.
+
+You should see the AfterTouch web interface with tabs: Overview, Settings, Devices, and so on.
+
+---
+
+## Step 4: Configure the server URL
+
+This is the most important setting. Go to the **Settings** tab and set the **Target Domain** to the full address of your AfterTouch server — the same address you used to open the web interface:
+
+```
+http://192.168.1.100:8000
+```
+
+Use the IP address of your server, **not** `localhost`. Your speakers need to reach this address over the network, and they cannot resolve `localhost`.
+
+Click **Save Settings**.
+
+---
+
+## Step 5: Proceed with migration
+
+You are now ready to migrate your speakers. Follow the main [Migration Guide](MIGRATION-GUIDE.md) for the remaining steps (discovering devices, syncing data, and redirecting your speakers to AfterTouch).
+
+---
+
+## Keeping AfterTouch running
+
+By default, AfterTouch stops when you close the terminal. To keep it running permanently:
+
+**Raspberry Pi / Linux:** See the [Raspberry Pi Guide](RASPBERRY-PI.md) for instructions on running AfterTouch as a background service using `systemd`.
+
+**NAS devices:** Most NAS systems support Docker. Use the Docker instructions in the [Deployment Guide](DEPLOYMENT.md).
+
+**macOS:** You can use `launchd` to run AfterTouch at login. Creating a `launchd` plist is beyond this guide, but the [Deployment Guide](DEPLOYMENT.md) has a systemd example you can adapt.
+
+**Windows:** You can use Task Scheduler to run AfterTouch at startup.
+
+---
+
+## Stable IP address
+
+AfterTouch must always be reachable at the same address, because your speakers will be configured to point to it. If the IP changes, your speakers will stop working until you reconfigure them.
+
+The easiest solution is to assign a **static (fixed) IP address** to the computer running AfterTouch in your router's settings. Look for "DHCP reservation" or "static IP" in your router's administration interface, and bind the server's MAC address to a fixed IP.
+
+---
+
+## Security note
+
+AfterTouch's web interface and management API have no login by default. On a typical home network this is fine, since only devices on your local network can reach it.
+
+If you want to restrict access — for example, on a shared network — start the service with a username and password:
+
+```
+./soundtouch-service --mgmt-username admin --mgmt-password yourpassword
+```
+
+This protects the Settings tab (where your Spotify and Amazon credentials are stored) from being read or changed by others on the network.
@@ -7,7 +7,7 @@ The `soundtouch-service` is a comprehensive local server that emulates Bose's cl
 The service provides:

 - **🏠 Local Service Emulation**: Complete BMX (Bose Media eXchange) and Marge service implementation
- **🔧 Device Migration**: Seamlessly migrate devices from Bose cloud to local services via XML config, `/etc/hosts`, or `/etc/resolv.conf`
+- **🔧 Device Migration**: Migrate devices from Bose cloud to local services via XML redirect or DNS/DHCP redirect
 - **🔍 DNS Discovery & Interception**: Built-in DNS server to discover unknown Bose endpoints and selectively intercept cloud traffic
 - **📊 Traffic Proxying**: Inspect and log all device communications for debugging
 - **🌐 Web Management UI**: Browser-based interface for device management
@@ -116,7 +116,7 @@ volumes:
 And run:

 ```bash
-docker-compose up -d
+docker compose up -d
 ```

 ## Quick Start
@@ -169,7 +169,7 @@ The service supports multiple ways to configure its behavior. When multiple sour
 | `DISCOVERY_INTERVAL`               | `--discovery-interval`     | Device discovery interval                                                                               | `5m`                      |
 | `ENABLE_DNS_DISCOVERY`             | `--dns-discovery`          | Enable DNS discovery server                                                                             | `false`                   |
 | `DNS_UPSTREAM`                     | `--dns-upstream`           | Upstream DNS server for non-Bose queries                                                                | `8.8.8.8`                 |
-| `DNS_BIND_ADDR`                    | `--dns-bind`               | Bind address for the DNS discovery server (standard port `:53` is required for `resolv.conf` migration) | `:53`                     |
+| `DNS_BIND_ADDR`                    | `--dns-bind`               | Bind address for the DNS discovery server (standard port `:53` is required for DNS/DHCP migration)      | `:53`                     |
 | `MIRROR_ENABLED`                   |                            | Enable background mirroring of specific endpoints to Bose cloud                                         | `false`                   |
 | `MIRROR_ENDPOINTS`                 |                            | Comma-separated list of path patterns to mirror (e.g., `/streaming/account/*/device/*/recent`)          | `[]`                      |
 | `INTERNAL_PATHS`                   | `--internal-paths`         | Paths for internal requests to exclude from recording (e.g., `/setup/*`, `/web/*`)                      | `[]`                      |
@@ -225,13 +225,21 @@ curl http://localhost:8000/setup/devices
 #### Advanced Migration Options

 ```bash
-# Migration with proxy fallback for original services
-curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?proxy_url=http://localhost:8000&marge=original&stats=original"
-
 # Migration with custom target URL
 curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?target_url=https://my-server.com:8000"
+
+# Per-field literal URL overrides (preferred — used by the web wizard)
+curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?method=xml&target_url=http://server:8000&marge_url=http://server:8000/marge"
+
+# SSH-less migration over the device's port-17000 diagnostic shell
+curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?method=telnet&target_url=http://server:8000"
+
+# Legacy proxy-fallback for selected fields (kept for API back-compat)
+curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?proxy_url=http://localhost:8000&marge=original&stats=original"
 ```

+See the full parameter reference at `POST /setup/migrate/{deviceIP}` below for `method`, `target_url`, `*_url`, and the legacy mode selectors.
+
 ### Post-Migration Verification

 After migration, verify the device is working correctly:
@@ -247,7 +255,7 @@ curl "http://192.168.1.100:8090/presets"
 curl "http://localhost:8000/events/192.168.1.100"
 ```

-#### ResolvConf Migration (DHCP-Aware DNS Redirection)
+#### DNS/DHCP Migration (DHCP-Aware DNS Redirection)

 The most robust and flexible DNS-based migration method. It utilizes the device's persistent `/mnt/nv/rc.local` script to inject a priority DNS hook into the system's DHCP configuration.

@@ -393,19 +401,80 @@ Analyzes device configuration and provides migration preview.
 Migrates device to use local services.

 **Query Parameters:**
- `target_url`: Custom service URL (optional)
- `proxy_url`: Proxy URL for fallback (optional)
- `marge`: Set to "original" to proxy Marge requests (optional)
- `stats`: Set to "original" to proxy stats requests (optional)
- `sw_update`: Set to "original" to proxy update requests (optional)
- `bmx`: Set to "original" to proxy BMX requests (optional)
+
+| Parameter    | Values                                                    | Notes                                                                                                                                                                                                                                                    |
+|--------------|-----------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `method`     | `xml` (default), `telnet`, `resolv`, `hosts` (deprecated) | Picks the redirect mechanism. `xml` writes `SoundTouchSdkPrivateCfg.xml` via SSH; `telnet` flips the four URLs via the device's port-17000 diagnostic shell; `resolv` installs the `/etc/resolv.conf` priority-nameserver hook and the local CA via SSH. |
+| `target_url` | Any URL, e.g. `http://soundtouch.local:8000`              | Service base URL the per-field defaults derive from. Falls back to the service's configured `ServerURL` when omitted.                                                                                                                                    |
+| `proxy_url`  | Any URL                                                   | Proxy base used when the legacy `marge=proxied` / `stats=proxied` / `sw_update=proxied` / `bmx=proxied` modes are set. Defaults to `target_url`.                                                                                                         |
+
+**Per-field implementation mode** (XML method's legacy semantics — kept for API back-compat, UI no longer sets them):
+
+| Parameter   | Values                                  | Effect on the matching `*ServerUrl` / `*RegistryUrl` field                                                                                        |
+|-------------|-----------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|
+| `marge`     | `self` (default), `proxied`, `original` | `self`: write `target_url` (canonical). `proxied`: write `<proxy_url>/proxy/<original-marge-url>`. `original`: keep the speaker's existing value. |
+| `stats`     | same                                    | same                                                                                                                                              |
+| `sw_update` | same                                    | same                                                                                                                                              |
+| `bmx`       | same                                    | same                                                                                                                                              |
+
+**Per-field literal URL overrides** (preferred — used by the wizard's Plan card; honored for both `xml` and `telnet` methods):
+
+| Parameter       | Effect                                                                                                                                                                |
+|-----------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `marge_url`     | Writes the exact URL to `<margeServerUrl>` regardless of `target_url` derivation or `marge` mode. Empty / missing → fall back to canonical default from `target_url`. |
+| `stats_url`     | Same shape for `<statsServerUrl>`.                                                                                                                                    |
+| `sw_update_url` | Same for `<swUpdateUrl>`.                                                                                                                                             |
+| `bmx_url`       | Same for `<bmxRegistryUrl>`.                                                                                                                                          |
+
+**Precedence**: `*_url` overrides win over the `marge / stats / sw_update / bmx` mode selectors. The setup package applies `applyProxyOptions` first, then `applyURLOverrides` clobbers any field where a literal `*_url` was supplied. So if you send both `marge=proxied&marge_url=http://x:8000/marge`, the literal `http://x:8000/marge` is written.
+
+**Soundcork redirect**: append `/marge` to `marge_url`. The telnet method derives `envswitch boseurls set <margeServerUrl> <swUpdateUrl>` from the final URLs verbatim, so the suffix propagates to the parallel persistence layer automatically — no separate flag needed.
+
+**Examples**:
+
+```bash
+# Canonical XML migration over SSH to the default service URL
+curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?method=xml"
+
+# Telnet migration with the soundcork redirect (only marge gets the /marge suffix)
+curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?method=telnet&target_url=http://soundcork.local:8000&marge_url=http://soundcork.local:8000/marge"
+
+# DNS interception (writes /etc/resolv.conf hook + installs CA) — *_url overrides are ignored
+curl -X POST "http://localhost:8000/setup/migrate/192.168.1.100?method=resolv&target_url=https://my-server.com:8443"
+```
+
+#### `POST /setup/telnet-probe/{deviceIP}`
+SSH-less reachability check. Temporarily flips the speaker's `swUpdateUrl` via the port-17000 diagnostic shell, triggers `:8090/swUpdateCheck` on the device, and observes whether the resulting outbound lands on this service's `/probe/{token}` handler within 6 s. Always attempts to restore the original `swUpdateUrl` even on failure.
+
+**Query Parameters:**
+- `target_url` (optional): defaults to the service's configured `ServerURL`. The probe URL written to the device is `<target_url>/probe/<token>`.
+
+**Response:**
+```json
+{
+  "ok": true,
+  "result": {
+    "reached": true,
+    "restored": true,
+    "original_url": "https://worldwide.bose.com/updates/soundtouch",
+    "probe_url": "http://soundtouch.local:8000/probe/abc123…",
+    "elapsed_ms": 412,
+    "logs": "…"
+  }
+}
+```
+
+`reached=true` means the device's outbound landed on our `/probe/{token}` route within the timeout. `restored=true` means the runtime `swUpdateUrl` was reverted to its captured original (the envswitch persistence layer is left untouched throughout, so a reboot heals the device naturally if our restore step fails).
+
+#### `GET /probe/{token}[/*]`
+Catch-all endpoint that signals the matching pre-flight probe channel. Used internally by `/setup/telnet-probe/{deviceIP}`; not intended to be called directly by API consumers. Returns a minimal `<swUpdateIndex/>` XML so the device's `swUpdateCheck` doesn't choke on a missing structure.

 ### BMX Services (Bose Media eXchange)

 #### `GET /bmx/registry/v1/services`
 Returns available media services for device registration.

-#### `GET /bmx/tunein/v1/playbook/station/{stationID}`
+#### `GET /bmx/tunein/v1/playback/station/{stationID}`
 Provides TuneIn station playback information.

 #### `GET /bmx/tunein/v1/podcast/{podcastID}`
@@ -665,7 +734,7 @@ find data/stats/ -name "*.json" -mtime +90 -delete
 - `GET /setup/discovery-status`: Check if a scan is currently in progress.
 - `POST /setup/sync/{deviceIP}`: Fetch presets, recents, and sources from a device.
 - `GET /setup/summary/{deviceIP}`: Get a detailed migration readiness summary.
- `POST /setup/migrate/{deviceIP}`: Migrate a device using the specified method (XML/Hosts).
+- `POST /setup/migrate/{deviceIP}`: Migrate a device using the specified method (XML or DNS).
 - `GET /setup/ca.crt`: Download the Root CA certificate for manual installation.

 #### `GET /setup/interactions`
@@ -836,6 +905,7 @@ fi
 - **SSH Access**: Migration requires SSH access to devices. Ensure your network security policies allow this.
 - **Proxy Logging**: Disable `REDACT_PROXY_LOGS` only in development environments.
 - **Data Protection**: The data directory contains device configurations and usage patterns. Secure appropriately.
+- **Spotify / Amazon Music credential push (zeroconf)**: outbound credential-push requests are restricted to literal IP hosts on local-network ranges (loopback, RFC1918 private, IPv4/IPv6 link-local). Hostname-style URLs (DNS, mDNS `*.local`) are rejected at runtime; if you have a hostname, resolve it first (`getent hosts <name>` or `dig +short <name>`) and pass the resolved IP. This guards against a malicious LAN-resident speaker pointing the credential push at a non-speaker host (server-side request forgery).

 ## Performance Tuning

@@ -1,85 +1,107 @@
-### Bose Cloud Shutdown: Survival Guide for SoundTouch
+# Bose Cloud Shutdown: Survival Guide

-With Bose's announcement of discontinuing cloud support for SoundTouch devices in May 2026, this project provides the necessary tools to keep your speakers fully functional using a local emulation service.
+Bose is shutting down SoundTouch cloud services on **May 6, 2026**. After that date, the following stop working:

-This guide explains how to set up the `soundtouch-service` to run your devices independently of Bose's servers.
+- Music service browsing (TuneIn, Spotify connect via app, etc.)
+- Preset and recently-played sync
+- The official SoundTouch app
+- Software update checks
+
+What **continues to work** regardless:
+- Local playback controls via `soundtouch-cli`, `soundtouch-web`, or any app that uses the local Web API
+- Bluetooth, AUX, and AirPlay inputs
+- Multiroom zones (local, peer-to-peer)
+
+**AfterTouch** — the `soundtouch-service` — restores everything in the first list by running a local replacement for the Bose cloud on your own network.

 ---

-### Supported Use Cases
+## How it works

-1.  **Local Service Emulation**: The service emulates Bose's BMX (Bose Media eXchange) and Marge services, which handle content registries, presets, recents, and software update checks.
-2.  **Traffic Redirection**: Tools are provided to redirect your speakers to this local service instead of `*.bose.com`.
-3.  **Offline Operation**: Once redirected, the speakers function without needing to reach Bose's servers.
-4.  **Preset & Recent Management**: Captures and stores presets and "recently played" items locally.
+The service emulates the Bose cloud endpoints that speakers call for music service browsing, device registration, preset sync, and update checks. Once a speaker is redirected to point at the local service instead of Bose's servers, it operates independently. The built-in web UI at `http://<server>:8000` handles all setup steps.

 ---

-### Setup Steps
+## Prerequisites

-To set up your SoundTouch system for local-only operation, follow these steps:
+### 1. A machine that's always on

-#### 1. Install and Start the Service
-Run the `soundtouch-service` on a machine that is always on (like a Raspberry Pi or a NAS) within your local network.
+The service must run on a host that's available whenever your speakers are in use — a Raspberry Pi, NAS, home server, or similar. The host needs a stable local address (e.g. `soundtouch.fritz.box` or a fixed IP) reachable from your speakers.

-```bash
-# Install the service
-go install github.com/gesellix/bose-soundtouch/cmd/soundtouch-service@latest
+See [Raspberry Pi Setup](RASPBERRY-PI.md) and the [SoundTouch Service Guide](SOUNDTOUCH-SERVICE.md) for deployment options, including Docker.

-# Start the service (defaults to http://localhost:8000)
-soundtouch-service
-```
+### 2. SSH access on your speakers (for migration)

-#### 2. Access the Management UI
-Open your web browser and navigate to the service's web interface:
-`http://<your-server-ip>:8000/`, e.g. `http://localhost:8000/`
+Redirecting a speaker's service URLs requires writing to its configuration. This is done via SSH. Enable it once per device:

-*Note: The service also supports a `/web/` path for management.*
+1. Create a file named `remote_services` on a FAT-formatted USB drive. The drive may need its bootable flag set — see [SoundCork issue #172](https://github.com/deborahgu/soundcork/issues/172) for details.
+2. Insert the drive into the speaker's USB port while it's powered on.
+3. Power-cycle the speaker (unplug and replug). After boot, root SSH is available with no password.

-#### 3. Enable SSH on Your Speakers
-To migrate your speakers, the service needs SSH access. You can enable it by:
-1. Creating an empty file named `remote_services` on a USB stick.
-2. Inserting the USB stick into the SoundTouch speaker's service port.
-3. Rebooting the speaker (unplug/replug).
-
-**Verify SSH Access:**
- Confirm the device responds to SSH without a password: `ssh -o HostKeyAlgorithms=+ssh-rsa -o PubkeyAcceptedAlgorithms=+ssh-rsa root@<IP>`
- Or use the **Migration** tab in the Web UI to see if the device shows a "✅ Success" status for SSH.
-Once enabled, you can log in as `root` (no password).
-
-#### 4. Setup Through the Web UI
-The web interface handles the entire process in a guided flow. Before proceeding, we strongly recommend reviewing the [Migration & Safety Guide](MIGRATION-SAFETY.md).
-
-*   **Step 1: Settings**: Configure your server's IP or domain. This ensures the speakers know where to find the local services.
-*   **Step 2: Devices**: The service automatically scans for SoundTouch devices on your network. If a device is not found, you can manually add its IP address.
-*   **Step 3: Data Sync**: Select your device and click "Start Sync". This will automatically fetch your presets, recents, and configured sources from the speaker and store them in the local `data/` directory.
-*   **Step 4: Migration**: Choose your redirection method (XML Recommended) and click "Confirm Migration". After the migration, reboot your speaker to apply the changes.
-
-#### 5. Verify Your Local Data
-Once migrated, your speaker will use the data captured during the Sync step.
-*   The service stores data in the `data/` directory, organized by device serial number (e.g., `data/default/devices/<SERIAL>/`).
-*   **Automatic Capture**: As you use the device (changing presets, playing new music), the service continues to "learn" and update your local files.
+You can leave SSH enabled for future maintenance, or disable it once migration is complete.

 ---

-### Comparison with other implementations (soundcork)
-Our implementation (`soundtouch-service`) is largely compatible with the Python-based `soundcork` project but offers several advantages:
- **Web UI**: Integrated management interface for discovery and migration.
- **Surgical Migration**: Uses XML-based redirection by default, which is less invasive than `/etc/hosts`.
- **Automated SSL**: Handles Root CA injection automatically for secure communication.
- **Proxy Support**: Can proxy requests to original Bose servers while "learning" your configuration.
+## Scenario A: Migrate before the shutdown
+
+Do this while the Bose cloud is still running. Your existing presets and listening history are preserved.
+
+**Step 1 — Back up your data.**
+Run `soundtouch-backup all` to save your Bose account data (presets, paired devices, music sources) and each speaker's local state. See the [soundtouch-backup README](../../cmd/soundtouch-backup/README.md) for usage.
+
+**Step 2 — Start the service and open the web UI** at `http://<server>:8000`.
+
+**Step 3 — Configure the server URL.**
+In the Settings tab, set the server URL to the address your speakers can reach (e.g. `http://soundtouch.fritz.box:8000`). If you plan to use DNS/DHCP redirect, also configure the HTTPS server URL.
+
+**Step 4 — Add your speaker.**
+The service discovers devices on your network automatically. If a speaker doesn't appear, add it manually by IP address.
+
+**Step 5 — Sync device data.**
+Click "Sync" on the device to pull its current presets, recents, and sources from the Bose cloud into the local service's datastore.
+
+**Step 6 — Migrate.**
+The web UI offers two redirect methods and walks you through each step:
+
+| Method       | How it works                                           | When to use                                              |
+|--------------|--------------------------------------------------------|----------------------------------------------------------|
+| XML redirect | Uploads a config file to the speaker via the Web API   | Testing; simpler setup; covers only registered endpoints |
+| DNS/DHCP     | Custom DNS resolves Bose hostnames to the local server | All devices at once; full coverage                       |
+
+Both methods require TLS when the speaker uses HTTPS to contact the service. The web UI guides you through installing the service's CA certificate on the speaker (requires SSH).
+
+**Step 7 — Reboot the speaker.**
+Power-cycle the speaker to apply the changes. After reboot it contacts the local service instead of Bose's cloud.

 ---

-### Alternative: DNS Redirection (No SSH)
-If you prefer not to modify your speakers via SSH, you can use a local DNS server (like Pi-hole, AdGuard Home, or Unbound) to point the following domains to your local server's IP:
+## Scenario B: Set up after the shutdown (or after a factory reset)

-*   `bmx.bose.com`
-*   `streaming.bose.com`
-*   `updates.bose.com`
-*   `stats.bose.com`
-*   `content.api.bose.io`
+If the Bose cloud is gone, or you've factory-reset a speaker, there's no existing account to migrate from. You start fresh with a local account.

-*Note: DNS redirection for HTTPS services requires the speakers to trust your local service's SSL certificate. The SSH-based migration handles this automatically by injecting the CA.*
+**Step 1 — Set up DNS/DHCP redirect first** (recommended).
+Configure your network's DNS to resolve the Bose cloud hostnames to the local service's address before the speaker tries to register. This way, when the speaker boots and attempts to register, it reaches AfterTouch automatically instead of failing to reach Bose.
+
+See the [SoundTouch Service Guide](SOUNDTOUCH-SERVICE.md) for the built-in DNS server configuration and the list of hostnames to redirect.
+
+**Step 2 — Connect the speaker to Wi-Fi.**
+Use the speaker's built-in AP mode or BLE setup flow. See [Device Initial Setup](DEVICE-INITIAL-SETUP.md) for factory reset button sequences and Wi-Fi provisioning.
+
+**Step 3 — Start the service and open the web UI** at `http://<server>:8000`.
+
+**Step 4 — Add the speaker.**
+After connecting to Wi-Fi, the speaker should appear in the web UI automatically (or add it manually by IP). If DNS redirect is already in place, the speaker is already communicating with AfterTouch.
+
+**Step 5 — Migrate** (if not already using DNS redirect).
+If you didn't set up DNS first, use the XML redirect method from the web UI to update the speaker's service URLs. The web UI walks you through the steps including CA certificate setup.
+
+**Step 6 — Reboot the speaker.**
+Power-cycle to ensure all changes take effect.

 ---
+
+## After migration
+
+Once migrated, your speaker uses the local service for music browsing, preset sync, and device registration. The web UI at `http://<server>:8000` is your management interface going forward. Back up the `data/` directory periodically in case you need to restore.
+
+For the complete step-by-step walkthrough with commands and troubleshooting, see the [Migration Guide](MIGRATION-GUIDE.md). For safety measures and rollback options, see the [Migration & Safety Guide](MIGRATION-SAFETY.md).
@@ -105,6 +105,110 @@ iperf3 -c 192.168.1.1  # If iperf server available

 ## 🌐 **Connection Issues**

+### ❌ Every cloud source shows `status="UNAVAILABLE"` / can't stream anything
+
+**Symptoms:**
+
+- The speaker's `/sources` (or the soundtouch-cli `source availability` output) lists every cloud-backed source — Spotify, TuneIn, Internet Radio, AirPlay, Amazon, Alexa — as `status="UNAVAILABLE"`.
+- Often only AUX shows `status="READY"`.
+- The speaker can be reached on the LAN (`:8090/info` works) but no Internet streaming source can be selected.
+
+This is a different failure mode from the [`Curl 7` case below](#-speaker-logs-curl-7-http-0-and-aftertouch-sees-no-http-requests): the speaker can reach AfterTouch but doesn't have the account state to authenticate any cloud surface, so every cloud handler 401s itself out.
+
+**Three-step diagnostic checklist** (in order — the cause is almost always one of these):
+
+#### 1. Is `:443` reachable on AfterTouch?
+
+The AfterTouch Settings tab now ships a preflight that flips ✅ / ❌ for whether the speaker can open a TLS handshake to AfterTouch's HTTPS listener. If `:443` is ❌, follow the steps in [HTTPS-SETUP.md → Binding to port 443](HTTPS-SETUP.md#binding-to-port-443).
+
+A failing preflight at this layer typically presents as `Curl 7, http 0` in the speaker's syslog (see the [`Curl 7` entry below](#-speaker-logs-curl-7-http-0-and-aftertouch-sees-no-http-requests) for the focused walkthrough).
+
+#### 2. Does the speaker have a `margeAccountUUID`?
+
+```bash
+curl -s http://<speaker-ip>:8090/info | xmllint --xpath '/info/margeAccountUUID/text()' -
+```
+
+If the element is empty (or you get no output), the speaker has no account token — every cloud surface that requires authentication will 401 itself out. The Migration tab in AfterTouch detects this and renders:
+
+> **Current: ❌ Not paired (factory-reset or never paired) — set an ID to pair as part of Apply**
+
+The Devices list also shows a `⚠ Not paired — re-pair` badge. To resolve, **open the Migration tab**, pick a previous account ID from the dropdown (or click **Generate**), and click **Apply** — same flow as the [factory-reset recovery](#-presets-flash-then-revert-to-select-a-preset-after-a-factory-reset) section below.
+
+#### 3. What does `logread` say while you trigger a failing source?
+
+SSH into the speaker (see [DEVICE-LOGGING.md](../DEVICE-LOGGING.md#1-accessing-system-logs-requires-root)) and capture:
+
+```bash
+logread -f | grep -v '127.0.0.1:'
+```
+
+…while you select a failing source in the SoundTouch app or via `soundtouch-cli`. The lines around the failed attempt usually name the failing host + protocol — TLS handshake error, token fetch 401, missing route, etc. — and that's enough to file an actionable issue.
+
+**Common outcomes:**
+
+- ❌ `:443` → fix HTTPS routing, sources transition to READY on the next refresh.
+- ❌ `margeAccountUUID` empty → run Migration → Apply, sources reappear after `<sourcesUpdated/>` triggers a `/sources` re-sync.
+- Everything looks right but sources still UNAVAILABLE → the `logread` snippet is the next signal; open an issue with it attached.
+
+> **Note on the firmware-internal placeholder sources.** The `<sourceItem source="SPOTIFY" sourceAccount="SpotifyConnectUserName" ...>`, `SpotifyAlexaUserName`, `UPNP/UPnPUserName`, `STORED_MUSIC_MEDIA_RENDERER/StoredMusicUserName`, and `QPLAY/QPlay{1,2}UserName` entries that appear in `/sources` even on a broken or unpaired speaker are *firmware-synthesized*. They show up regardless of AfterTouch's source list — their `status="UNAVAILABLE"` does not indicate an AfterTouch problem. Use the three checks above to diagnose the actual cause.
+
+### ❌ Speaker logs `Curl 7, http 0` and AfterTouch sees no HTTP requests
+
+**Symptoms:**
+
+In the speaker's log (see [DEVICE-LOGGING.md](../DEVICE-LOGGING.md#1-accessing-system-logs-requires-root) for the SSH/`logread` setup — the filtered command `logread -f | grep -v '127.0.0.1'` is what you want here):
+
+```
+SimpleURLFetcher: retry needed, Curl 7, http 0
+```
+
+In the AfterTouch service log: plenty of `[DNS] Intercepted query …` lines but **zero** HTTP requests after each DNS lookup.
+
+**Cause:** speakers connect to Bose hostnames over implicit HTTPS, i.e. port **443**. AfterTouch's built-in HTTPS listener defaults to **8443** because 443 is privileged. The speaker resolves the right IP, dials `:443`, and gets connection refused — which is what `Curl 7` reports.
+
+**Verify:**
+
+```bash
+curl -ksS -o /dev/null -w "443=%{http_code}\n"  https://localhost:443/
+curl -ksS -o /dev/null -w "8443=%{http_code}\n" https://localhost:8443/
+```
+
+Expected when the misconfiguration is present: `443=000` plus a `curl: (7) Failed to connect …` line, `8443=200` (or any 3-digit code).
+
+**Fix:** route `:443` to AfterTouch's HTTPS listener — see [HTTPS-SETUP.md → Binding to port 443](HTTPS-SETUP.md#binding-to-port-443). The AfterTouch settings page shows a ✅ / ❌ indicator for `:443` reachability once the routing is in place.
+
+### ❌ Presets flash then revert to "Select a preset" after a factory reset
+
+**Symptoms:**
+
+- You factory-reset a SoundTouch (Wave / 10 / 20 / 30 / …) that was previously migrated.
+- After reconnecting it to Wi-Fi, AfterTouch sees the speaker again, but pressing a preset on the device or in the app makes the display briefly show the preset name and then revert to *"Select a preset or explore music in the SoundTouch App"*.
+- Spotify presets show the same revert unless Spotify Connect is started from the mobile app first.
+- The speaker's `/sources` is missing TUNEIN / LOCAL_INTERNET_RADIO / DEEZER / your linked Spotify account — only AUX, BLUETOOTH, AIRPLAY, the SpotifyConnectUserName placeholder, NOTIFICATION, and QPLAY appear.
+
+**Cause:**
+
+A factory reset wipes `/mnt/nv/BoseApp-Persistence/1/Marge.xml` — the file that carries the speaker's auth token for the AfterTouch (or Bose) cloud service. The migrated URL configuration is preserved (it lives in `envswitch`), so the speaker keeps talking to AfterTouch, but with no token it can't authenticate for preset playback. Separately, the device's `/sources` cache is reduced until it receives a `<sourcesUpdated/>` notification.
+
+**Fix:**
+
+1. **Re-open the Migration tab** in the AfterTouch UI. The wizard reads `/info`, sees `margeAccountUUID` is empty, and renders:
+
+   > **Current: ❌ Not paired (factory-reset or never paired) — set an ID to pair as part of Apply**
+
+   The devices list now also shows a `⚠ Not paired — re-pair` badge next to such speakers, so you don't have to remember to open the Migration tab cold.
+
+2. **Pick the previously-used account ID** from the "pick from datastore" dropdown (if AfterTouch remembers it), or click **Generate** for a fresh one.
+
+3. **Click Apply.** The wizard runs `pair-account` along with the rest, recreating `Marge.xml` on the device with the chosen ID.
+
+4. **Click Data Sync** (Tab 3). AfterTouch persists the speaker's presets/recents/sources and posts a `<sourcesUpdated/>` notification to the device — the missing TUNEIN / LOCAL_INTERNET_RADIO / DEEZER / linked Spotify entries reappear in `/sources` automatically.
+
+5. Press a preset. It should play normally.
+
+If presets still won't play after step 5, capture `logread -f | grep -v '127.0.0.1:'` on the speaker (see [DEVICE-LOGGING.md](../DEVICE-LOGGING.md#1-accessing-system-logs-requires-root)) while pressing the preset and file an issue with the snippet — the lines around the failed playback name the deeper cause.
+
 ### ❌ "Connection refused"

 **Symptoms:**
@@ -279,6 +383,87 @@ client.SelectAux()

 ---

+## 🎶 **Music Service & Preset Issues**
+
+### ❌ Spotify preset fails with "Current content cannot be saved as preset"
+
+**Symptoms:**
+
+You push playback to the speaker via Spotify Connect from the Spotify mobile/desktop app. Audio plays fine. You try to store it as a preset and the CLI reports:
+
+```
+$ soundtouch-cli preset store-current --slot 2
+Storing current content as preset 2 from 192.168.x.y:8090...
+✗ Current content cannot be saved as preset
+  Content: <track name>
+  Source: SPOTIFY
+2026/05/16 09:13:10 current content cannot be preset
+```
+
+…and `soundtouch-cli play now` shows `Source Account: SpotifyConnectUserName`.
+
+**Cause:**
+
+The speaker firmware marks Spotify-Connect-pushed content as **non-presetable** at the NowPlaying layer:
+
+```xml
+<ContentItem source="SPOTIFY" type="DO_NOT_RESUME" ...
+             sourceAccount="SpotifyConnectUserName" isPresetable="false">
+```
+
+That `isPresetable="false"` means the firmware can't independently re-fetch the stream later — it only knows about the session token your phone pushed via the Spotify Connect protocol, which is ephemeral. The speaker refuses the preset *locally*, before any storePreset request reaches AfterTouch's marge.
+
+**Why an OAuth-linked Spotify account changes the answer:**
+
+When AfterTouch has a Spotify OAuth account linked (see [MUSIC-SERVICES.md](MUSIC-SERVICES.md)), the speaker has a *persistent* Spotify source it can use to resolve the content URI later — typically an album/playlist container. With that source available, the firmware rewrites the content item from `DO_NOT_RESUME` to `tracklisturl` at save time, flips `isPresetable` to `true`, and the preset goes through. The recall path then routes through AfterTouch's `/oauth/.../cs3` token broker, which returns a Spotify access token for your linked account.
+
+**Fix:**
+
+1. Set up Spotify OAuth in AfterTouch following [MUSIC-SERVICES.md](MUSIC-SERVICES.md). The high-level model (Spotify Connect vs the OAuth-intercept path, the `streamingoauth.bose.com` DNS rewrite, the token lifecycle) is in [spotify-overview.md](../concepts/spotify-overview.md).
+2. Make sure you're on **v0.84.0 or later** — earlier versions had a custom-OAuth-client bug that caused playback to hang at "Buffering".
+3. Re-prime the speaker (Migration tab → **Prime Spotify**, or wait for the watchdog), then retry the preset save with Connect-pushed playback.
+
+**What this won't fix:**
+
+A Connect-only setup with no OAuth account linked in AfterTouch — that's a firmware-level constraint we can't route around from the server side. The speaker simply doesn't have credentials it can use to replay the content later, so it refuses to preset.
+
+### ❌ TuneIn (or Internet Radio) missing from `/sources` after a factory reset
+
+**Symptoms:**
+
+- The speaker is happily migrated and reachable; most cloud sources work.
+- `curl http://<speaker-ip>:8090/sources` lists AUX, Bluetooth, Spotify Connect placeholders, etc. — but **no `TUNEIN` entry**.
+- `soundtouch-cli source content --source TUNEIN --type stationurl --location /v1/playback/station/<id> --name '<name>'` fails with `1005` (or playing a TuneIn preset silently does nothing).
+- Other devices on the same setup have `TUNEIN` in `/sources` and work fine.
+
+**Cause:**
+
+TuneIn is **not a default source** on a freshly factory-reset SoundTouch. The speaker only adds `TUNEIN` to its `Sources.xml` after the source has been played at least once. Until then, source-selection requests for `TUNEIN` are rejected as invalid.
+
+This is firmware behaviour — independent of AfterTouch — and is why one device can have `TUNEIN` and a sibling device (just reset) can be missing it. The same applies to `LOCAL_INTERNET_RADIO` if the speaker was reset before any LIR content was played.
+
+**Fix:**
+
+Play any TuneIn station once to register the source. Two equivalent paths:
+
+1. **Via the SoundTouch app** — open the app, pick TuneIn, play any station. The source appears in `/sources` after a few seconds.
+2. **Via `soundtouch-cli`** on a device that *does* still have TuneIn registered, or by first registering it with a known-working station:
+
+   ```bash
+   soundtouch-cli --host <speaker-ip> source content \
+     --source TUNEIN --type stationurl \
+     --location /v1/playback/station/s166521 \
+     --name 'SMOOTH JAZZ'
+   ```
+
+   (Station `s166521` is one that works for AfterTouch testing; any valid TuneIn station ID works.)
+
+Once the source plays once, it gets persisted to `/mnt/nv/BoseApp-Persistence/1/Sources.xml` and subsequent TuneIn requests succeed without needing the app.
+
+**For speakers without SSH:**
+
+If `soundtouch-cli source content --source TUNEIN ...` returns `1005` on a reset device that has never had TuneIn, the speaker is refusing because the source isn't registered yet — chicken-and-egg. The SoundTouch app is then the only practical path to register it; we can't write `Sources.xml` directly over telnet on most models.
+
 ## 🔊 **Volume & Audio Issues**

 ### ❌ "Volume control not working"
@@ -853,6 +1038,85 @@ cat data/accounts/3230304/devices/*/DeviceInfo.xml | grep macAddress

 ---

+## 🌐 **Hostname Resolution** {#hostname-resolution}
+
+### Why the service resolves the hostname from the device
+
+When you migrate a speaker using the resolv.conf method, the service needs to write a raw IP address into the speaker's network configuration. That IP must be the address the *speaker itself* can reach — which is not necessarily the same address your computer resolves.
+
+In environments with NAT, split-horizon DNS, or Docker/container networking, `soundtouch.local` (or whatever you set as `SERVER_URL`) may resolve to a different IP depending on who is asking. The service therefore resolves the hostname by running `ping -c 1 <hostname>` over SSH on the speaker and extracting the IP from the output. This is the authoritative result: it is exactly what the speaker would use.
+
+If that SSH ping fails, migration is aborted. Writing an unresolvable or incorrectly resolved hostname into `aftertouch.resolv.conf` would silently break the speaker's DNS config and prevent it from reaching the service after reboot.
+
+**The XML migration method is different.** It writes the full URL (e.g. `http://soundtouch.local:8000`) into `SoundTouchSdkPrivateCfg.xml`. The speaker resolves the hostname at connect time, not at migration time. This means migration can proceed even if the hostname is not yet reachable — for example, when the service will be deployed under that hostname but is not running yet. A warning is still shown in the UI so you are aware, but the Confirm Migration button remains enabled.
+
+### ❌ "Cannot resolve target hostname for migration"
+
+**Symptoms** (migration log or web UI warning):
+```
+cannot resolve target hostname for migration: cannot resolve "soundtouch.local":
+SSH ping from device failed and service-side DNS lookup also failed
+```
+or:
+```
+resolved "soundtouch.local" to 192.168.1.100 from service, not from device —
+result may be wrong if NAT or split-DNS is in use
+```
+
+**What this means:**
+
+The service could not confirm the IP by running `ping` on the speaker via SSH. Either:
+- the `ping` binary is not available or not in `$PATH` on this firmware, or
+- the hostname is not resolvable from the speaker's network context.
+
+**Diagnosis — run manually over SSH:**
+
+```bash
+# SSH into the speaker
+ssh root@<speaker-ip>
+
+# Try to resolve the service hostname
+ping -c 1 soundtouch.local
+# or use the IP directly to verify connectivity
+ping -c 1 192.168.1.100
+
+# Check the speaker's current DNS config
+cat /etc/resolv.conf
+
+# Check if ping is available
+which ping
+busybox ping --help
+```
+
+**Solutions:**
+
+#### 1. Use an IP address as SERVER_URL
+
+The most reliable fix. If the hostname cannot be resolved from the device, use a raw IP instead. Resolution is skipped entirely when `SERVER_URL` contains an IP.
+
+```bash
+# In your .env
+SERVER_URL=http://192.168.1.100:8000
+HTTPS_SERVER_URL=https://192.168.1.100:8443
+```
+
+HTTPS works correctly with IP addresses — the service certificate includes the IP as a Subject Alternative Name (SAN).
+
+#### 2. Ensure the hostname resolves on the speaker's network segment
+
+If you use `soundtouch.local`, verify mDNS is working from another device on the same subnet:
+
+```bash
+avahi-resolve -n soundtouch.local    # Linux
+dns-sd -G v4 soundtouch.local        # macOS
+```
+
+#### 3. Use the XML migration method
+
+Select the XML method in the migration UI. It writes the full URL and the speaker resolves it at connect time, so hostname resolution is not required during migration. This also allows migrating to a hostname that is not yet live.
+
+---
+
 ## 🛟 **Getting More Help**

 ### Information to Gather
@@ -1,90 +1,17 @@
-# Images for Migration Guide
+# docs/images

-This directory contains images, screenshots, and diagrams referenced in the migration guide and other documentation.
+Screenshots and diagrams referenced by the documentation.

-## Required Images for Migration Guide
+## Current screenshots

-The following images need to be created to complete the migration guide:
+| File | Shows | Used in |
+|------|-------|---------|
+| `ui-settings.png` | AfterTouch web UI — Settings tab (Target Domain, DNS Discovery, Mirroring) | Migration Guide |
+| `ui-devices.png` | AfterTouch web UI — Devices tab (discovered speakers with Sync/Migrate actions) | Migration Guide |
+| `ui-sync.png` | AfterTouch web UI — Data Sync tab (successful sync result) | Migration Guide |
+| `ui-migration.png` | AfterTouch web UI — Migration tab (HTTPS test, DNS test, method selector) | Migration Guide |
+| `speaker-ap-wifi-setup.png` | Speaker AP mode Wi-Fi setup page at `http://192.0.2.1` | Device Initial Setup |

-### Dashboard Screenshots
- **dashboard-home.png** - Main SoundTouch Service dashboard homepage
- **account-creation.png** - Account creation form with fields filled
- **account-dashboard.png** - Fresh account dashboard showing ready state
- **device-discovery.png** - Device discovery page showing found speakers
- **device-registration.png** - Device registration dialog with options
- **migration-setup.png** - Migration configuration dialog
- **migration-progress.png** - Migration progress tracker showing phases
- **migration-health.png** - Migration health monitoring dashboard
- **account-migration.png** - Account-wide migration progress overview
- **migration-complete.png** - Completed migration dashboard view
- **backup-setup.png** - Backup configuration settings page
+## Adding new screenshots

-### Setup and Preparation
- **usb-remote-services.png** - USB drive setup showing file structure
- **raspberry-pi-setup.png** - Raspberry Pi with connected cables (optional)
-
-### Process Diagrams
- **migration-flow-diagram.png** - Flow chart showing migration phases
- **network-topology.png** - Network diagram showing Pi, router, speakers
- **data-flow-diagram.png** - How data flows between components
-
-## Image Requirements
-
-### Technical Specifications
- **Format**: PNG preferred for screenshots, SVG for diagrams
- **Resolution**: Minimum 1200px width for screenshots
- **File Size**: Keep under 500KB when possible for fast loading
- **Naming**: Use descriptive kebab-case names as shown above
-
-### Content Guidelines
- **Clean Interface**: Show realistic but clean interface states
- **Consistent Styling**: Use consistent colors and styling across images
- **Readable Text**: Ensure all text in screenshots is legible
- **Example Data**: Use realistic example data (Living Room Speaker, etc.)
- **Status Indicators**: Show clear success/error states with appropriate colors
-
-### Placeholder Content
-Until real screenshots are available, consider:
- **Mockups**: Create simple mockups showing the expected interface
- **Wireframes**: Basic wireframes indicating layout and content
- **Diagrams**: Technical diagrams can be created immediately
- **Text Placeholders**: Use `[Image: Description]` in documentation
-
-## Creating the Images
-
-### For Dashboard Screenshots
-1. Set up the enhanced SoundTouch service
-2. Create sample account and register devices
-3. Take screenshots at key points in the migration process
-4. Edit for clarity (highlight important elements, add annotations)
-
-### For Diagrams
-1. Use tools like Lucidchart, draw.io, or similar
-2. Follow consistent color scheme:
-   - Blue: SoundTouch Service components
-   - Green: Healthy/successful states
-   - Orange: Warning/in-progress states
-   - Red: Error/problematic states
-   - Gray: External/third-party components
-
-### For Physical Setup
-1. Take photos of actual hardware setup
-2. Show USB drive preparation process
-3. Demonstrate network connections if helpful
-
-## Alternative Text Requirements
-
-Each image should have appropriate alt text for accessibility:
-
-```markdown
-![Alt text describing the image content](../images/image-name.png)
-*Caption: Additional context or explanation*
-```
-
-## Future Enhancements
-
-Consider adding:
- **Video Walkthroughs**: Screen recordings of key processes
- **Interactive Demos**: Web-based interactive guides
- **Troubleshooting Screenshots**: Common error states and solutions
- **Mobile Views**: How to access from mobile devices
+PNG format, 1200 px or wider. Use descriptive kebab-case names. Update this README when adding files.
--- a/Show More
+++ b/Show More