plc-checkweigher 1.0.0 → 1.1.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plc-checkweigher",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "One-command installer for the PLC Check-Weigher system on Raspberry Pi (PREEMPT_RT kernel, Python stack, WiFi, SMB, systemd RT services)",
   "bin": {
     "plc-checkweigher": "bin/cli.js"

package/setup.sh

@@ -1,57 +1,41 @@
 #!/usr/bin/env bash
 # =============================================================================
-#  PLC Check-Weigher — Full Stack Bootstrap Installer
+#  PLC Check-Weigher — Full Stack Installer  v1.1
 # =============================================================================
+#  Run on any fresh Raspberry Pi with ONE command:
 #
-#  One-liner (run this on any fresh Raspberry Pi):
+#    npx plc-checkweigher
 #
-#    sudo bash -c "$(curl -sSL https://raw.githubusercontent.com/Bibin-VR/plc-checkweigher/main/setup.sh)"
-#
-#  What it does (automatically, in order):
-#    1. Validates hardware / OS / arch
-#    2. Installs the PREEMPT_RT kernel (reboots once if needed, then resumes)
-#    3. Installs all system & Python dependencies
-#    4. Clones / updates this repo
-#    5. Configures WiFi (sai @samarth) with highest autoconnect priority
-#    6. Enables network-online guarantee before services start
-#    7. Creates /home/pi/reports directory
-#    8. Installs both systemd services with SCHED_FIFO real-time scheduling
-#    9. Starts & enables everything
-#   10. Verifies the full stack
-#
-#  Override defaults via env vars before the command:
-#    WIFI_PASS="secret" PI_USER="pi" sudo bash -c "$(curl -sSL ...)"
+#  What happens (all in one go, single reboot at the end):
+#    1.  Pre-flight checks
+#    2.  System packages  (git, python3-venv, samba-client …)
+#    3.  PREEMPT_RT kernel install + config (no reboot yet)
+#    4.  Clone / update the plc-checkweigher repo
+#    5.  Python venv + pip install (pinned versions)
+#    6.  Create /home/pi/reports directory
+#    7.  WiFi — interactive scan → pick from list → enter password
+#    8.  NetworkManager-wait-online (guarantees IP before services start)
+#    9.  plc_watcher.service  — SCHED_FIFO:50, IOClass=realtime, Core 3
+#   10.  plc_web.service      — Nice=-10
+#   11.  Enable + arm both services
+#   12.  REBOOT  (one-time, applies RT kernel + all config)
 # =============================================================================
 
 set -euo pipefail
 IFS=$'\n\t'
 
-# ── Configurable defaults ─────────────────────────────────────────────────────
+# ── Configurable ──────────────────────────────────────────────────────────────
 PI_USER="${PI_USER:-pi}"
-WIFI_SSID="${WIFI_SSID:-sai @samarth}"
-WIFI_PASS="${WIFI_PASS:-}"                    # prompted if empty and not connected
-SMB_HOST="${SMB_HOST:-192.168.0.140}"
-SMB_SHARE="${SMB_SHARE:-Reports}"
-SMB_USER="${SMB_USER:-plcreport}"
-SMB_PASS="${SMB_PASS:-plcreport}"
 REPO_URL="https://github.com/Bibin-VR/plc-checkweigher.git"
 REPO_BRANCH="main"
-
-# ── Derived paths ─────────────────────────────────────────────────────────────
 HOME_DIR="/home/${PI_USER}"
 INSTALL_DIR="${HOME_DIR}/plc_checkweigher"
 VENV_DIR="${HOME_DIR}/plc_env"
 REPORTS_DIR="${HOME_DIR}/reports"
 BOOT_FW="/boot/firmware"
-STATE_DIR="/var/lib/plc-setup"
-SELF_COPY="${STATE_DIR}/setup.sh"
-CONT_SVC="plc-setup-continue.service"
-
-# ── RT kernel package ─────────────────────────────────────────────────────────
 RT_PKG="linux-image-6.12.86+deb13-rt-arm64"
 RT_HDR="linux-headers-6.12.86+deb13-rt-arm64"
 
-# ── Python packages (pinned) ──────────────────────────────────────────────────
 PY_PKGS=(
     "Flask==3.1.3"
     "pymcprotocol==0.3.0"
@@ -63,254 +47,258 @@ PY_PKGS=(
     "scapy==2.7.0"
 )
 
-# ── Terminal colours ──────────────────────────────────────────────────────────
-R='\033[1;31m'; G='\033[0;32m'; B='\033[1;34m'; Y='\033[1;33m'; NC='\033[0m'
-banner()  { echo -e "\n${B}══════════════════════════════════════════════${NC}"; \
-            echo -e "${B}  $*${NC}"; \
-            echo -e "${B}══════════════════════════════════════════════${NC}"; }
-step()    { echo -e "\n${Y}[${1}]${NC} ${2}"; }
-ok()      { echo -e "    ${G}✓${NC}  ${1}"; }
-warn()    { echo -e "    ${Y}!${NC}  ${1}"; }
-die()     { echo -e "\n${R}FATAL:${NC} ${1}" >&2; exit 1; }
-
-# ── Guard: must be root ───────────────────────────────────────────────────────
-[[ "${EUID}" -eq 0 ]] || die "Run with sudo:  sudo bash -c \"\$(curl -sSL ...)\"  "
-
-# ── Guard: must be aarch64 ────────────────────────────────────────────────────
-ARCH="$(uname -m)"
-[[ "${ARCH}" == "aarch64" ]] || die "This installer targets 64-bit Raspberry Pi (aarch64). Got: ${ARCH}"
-
-# ── Guard: home dir must exist ────────────────────────────────────────────────
-[[ -d "${HOME_DIR}" ]] || die "User home ${HOME_DIR} not found. Set PI_USER= before running."
-
-mkdir -p "${STATE_DIR}"
+# ── Colours ───────────────────────────────────────────────────────────────────
+B='\033[1;34m'; G='\033[0;32m'; R='\033[1;31m'; Y='\033[1;33m'; C='\033[0;36m'; NC='\033[0m'
+
+banner()  { echo -e "\n${B}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+            echo -e "${B}  $*${NC}"
+            echo -e "${B}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"; }
+step()    { echo -e "\n${Y}▶ $*${NC}"; }
+ok()      { echo -e "  ${G}✓${NC}  $*"; }
+warn()    { echo -e "  ${Y}!${NC}  $*"; }
+info()    { echo -e "  ${C}i${NC}  $*"; }
+die()     { echo -e "\n${R}FATAL:${NC} $*" >&2; exit 1; }
+hr()      { echo -e "  ${B}$(printf '─%.0s' {1..48})${NC}"; }
+
+# ── 0. Pre-flight ─────────────────────────────────────────────────────────────
+preflight() {
+    banner "PLC Check-Weigher Installer  v1.1"
+
+    [[ "${EUID}" -eq 0 ]]        || die "Run via:  npx plc-checkweigher  (asks for sudo password)"
+    [[ "$(uname -m)" == "aarch64" ]] || die "Requires 64-bit Raspberry Pi (aarch64). Got: $(uname -m)"
+    [[ -d "${HOME_DIR}" ]]       || die "Home dir ${HOME_DIR} not found. Set PI_USER= to override."
+    command -v nmcli &>/dev/null || die "NetworkManager not found — install Raspberry Pi OS first."
+
+    info "Host   : $(hostname)"
+    info "Kernel : $(uname -r)"
+    info "User   : ${PI_USER}"
+    info "Repo   : ${REPO_URL}"
+}
 
-# =============================================================================
-#  PHASE 1 — Real-Time Kernel  (skipped when already running PREEMPT_RT)
-# =============================================================================
-is_rt_kernel() { grep -q "PREEMPT_RT" /proc/version 2>/dev/null; }
+# ── 1. System packages ────────────────────────────────────────────────────────
+install_system_packages() {
+    step "Installing system packages ..."
+    DEBIAN_FRONTEND=noninteractive apt-get update -qq
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
+        git python3-venv python3-pip python3-dev \
+        samba-client cifs-utils network-manager curl build-essential
+    ok "git, python3-venv, python3-dev, samba-client, cifs-utils"
+}
 
+# ── 2. RT kernel ──────────────────────────────────────────────────────────────
 install_rt_kernel() {
-    banner "Phase 1 — Installing PREEMPT_RT Kernel"
+    step "Setting up PREEMPT_RT kernel ..."
+
+    if grep -q "PREEMPT_RT" /proc/version 2>/dev/null; then
+        ok "Already running PREEMPT_RT kernel — skipping install"
+        return
+    fi
 
-    step "1a" "Backing up current kernel image ..."
+    # Backup
     if [[ ! -f "${BOOT_FW}/kernel8-stock.img" ]]; then
         cp "${BOOT_FW}/kernel8.img" "${BOOT_FW}/kernel8-stock.img"
-        ok "Backup → ${BOOT_FW}/kernel8-stock.img"
-    else
-        ok "Backup already exists — skipping"
+        ok "Stock kernel backed up → kernel8-stock.img"
     fi
 
     CHKSUM_BEFORE="$(md5sum "${BOOT_FW}/kernel8.img" | cut -d' ' -f1)"
-
-    step "1b" "Installing ${RT_PKG} ..."
-    DEBIAN_FRONTEND=noninteractive apt-get install -y "${RT_PKG}" "${RT_HDR}"
-    ok "RT kernel package installed"
-
-    # Detect whether post-install hook overwrote kernel8.img
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "${RT_PKG}" "${RT_HDR}"
     CHKSUM_AFTER="$(md5sum "${BOOT_FW}/kernel8.img" | cut -d' ' -f1)"
+
     if [[ "${CHKSUM_BEFORE}" != "${CHKSUM_AFTER}" ]]; then
-        # Hook replaced kernel8.img → move to kernel8-rt.img, restore stock
         cp "${BOOT_FW}/kernel8.img"       "${BOOT_FW}/kernel8-rt.img"
         cp "${BOOT_FW}/kernel8-stock.img" "${BOOT_FW}/kernel8.img"
-        ok "RT kernel → kernel8-rt.img  |  stock kernel restored as default"
+        ok "RT kernel → kernel8-rt.img  |  stock restored as fallback"
     else
-        # Hook did NOT copy — do it manually
         RT_VMLINUZ="$(ls /boot/vmlinuz-*rt-arm64 2>/dev/null | sort -V | tail -1)"
-        [[ -n "${RT_VMLINUZ}" ]] || die "Cannot find RT vmlinuz in /boot/"
+        [[ -n "${RT_VMLINUZ}" ]] || die "RT vmlinuz not found in /boot/"
         if file "${RT_VMLINUZ}" | grep -q gzip; then
             zcat "${RT_VMLINUZ}" > "${BOOT_FW}/kernel8-rt.img"
         else
             cp "${RT_VMLINUZ}" "${BOOT_FW}/kernel8-rt.img"
         fi
-        ok "RT kernel manually copied → ${BOOT_FW}/kernel8-rt.img"
+        ok "RT kernel manually copied → kernel8-rt.img"
     fi
 
-    # Copy RT initramfs if one was generated
+    # Copy RT initramfs if present
     RT_INITRD="$(ls /boot/initrd.img-*rt-arm64 2>/dev/null | sort -V | tail -1 || true)"
-    if [[ -n "${RT_INITRD}" ]]; then
-        cp "${RT_INITRD}" "${BOOT_FW}/initramfs8-rt"
-        ok "RT initramfs → ${BOOT_FW}/initramfs8-rt"
-    fi
+    [[ -n "${RT_INITRD}" ]] && cp "${RT_INITRD}" "${BOOT_FW}/initramfs8-rt" \
+        && ok "RT initramfs → initramfs8-rt"
 
-    step "1c" "Activating RT kernel in ${BOOT_FW}/config.txt ..."
-    # Remove any previous RT block we wrote
+    # Activate in config.txt (idempotent — removes any previous block first)
     sed -i '/### PLC-RT-BLOCK-START ###/,/### PLC-RT-BLOCK-END ###/d' \
         "${BOOT_FW}/config.txt"
-
-    cat >> "${BOOT_FW}/config.txt" << 'CFGEOF'
+    cat >> "${BOOT_FW}/config.txt" << 'EOF'
 
 ### PLC-RT-BLOCK-START ###
 # PREEMPT_RT kernel — installed by plc-checkweigher setup.sh
+# To revert: comment the two lines below and reboot.
 kernel=kernel8-rt.img
 initramfs initramfs8-rt followkernel
 ### PLC-RT-BLOCK-END ###
-CFGEOF
-    ok "config.txt updated — system will boot RT kernel after reboot"
-
-    step "1d" "Saving installer for post-reboot continuation ..."
-    # Save this very script so the continuation service can re-run it
-    if [[ -f "${SELF_COPY}" && "${BASH_SOURCE[0]}" != "${SELF_COPY}" ]]; then
-        : # already saved by a previous run
-    else
-        # If running via bash -c "$(curl ...)", BASH_SOURCE[0] is empty
-        # In that case, re-download from GitHub so we have a saved copy
-        if [[ -f "${BASH_SOURCE[0]:-}" ]]; then
-            cp "${BASH_SOURCE[0]}" "${SELF_COPY}"
-        else
-            curl -sSL \
-                "https://raw.githubusercontent.com/Bibin-VR/plc-checkweigher/${REPO_BRANCH}/setup.sh" \
-                -o "${SELF_COPY}"
-        fi
-    fi
-    chmod +x "${SELF_COPY}"
-
-    # Persist any env overrides so they survive across reboot
-    cat > "${STATE_DIR}/env" << ENVEOF
-PI_USER="${PI_USER}"
-WIFI_SSID="${WIFI_SSID}"
-WIFI_PASS="${WIFI_PASS}"
-SMB_HOST="${SMB_HOST}"
-SMB_SHARE="${SMB_SHARE}"
-SMB_USER="${SMB_USER}"
-SMB_PASS="${SMB_PASS}"
-ENVEOF
-    chmod 600 "${STATE_DIR}/env"
-
-    step "1e" "Creating post-reboot continuation service ..."
-    cat > "/etc/systemd/system/${CONT_SVC}" << SVCEOF
-[Unit]
-Description=PLC Check-Weigher Setup Continuation (post-RT-kernel reboot)
-After=network.target
-ConditionPathExists=${STATE_DIR}/env
-
-[Service]
-Type=oneshot
-EnvironmentFile=${STATE_DIR}/env
-ExecStart=/usr/bin/bash ${SELF_COPY}
-ExecStartPost=/bin/rm -f ${STATE_DIR}/env
-StandardOutput=journal+console
-StandardError=journal+console
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
-SVCEOF
-
-    systemctl daemon-reload
-    systemctl enable "${CONT_SVC}"
-    ok "Continuation service enabled — will auto-run phase 2 after reboot"
-
-    echo ""
-    echo -e "${G}╔═══════════════════════════════════════════════════╗${NC}"
-    echo -e "${G}║  RT kernel ready.  Rebooting in 5 seconds ...    ║${NC}"
-    echo -e "${G}║  Phase 2 will complete automatically on boot.     ║${NC}"
-    echo -e "${G}║  Watch progress: journalctl -u ${CONT_SVC} -f  ║${NC}"
-    echo -e "${G}╚═══════════════════════════════════════════════════╝${NC}"
-    sleep 5
-    reboot
+EOF
+    ok "config.txt updated — RT kernel activates after reboot"
 }
 
-# =============================================================================
-#  PHASE 2 — Full Application Setup  (runs on RT kernel)
-# =============================================================================
-setup_full() {
-    banner "Phase 2 — Full Application Setup  (PREEMPT_RT kernel confirmed)"
-
-    # ── 2.1  Update package list & install system deps ────────────────────────
-    step "2.1" "Installing system packages ..."
-    DEBIAN_FRONTEND=noninteractive apt-get update -q
-    DEBIAN_FRONTEND=noninteractive apt-get install -y \
-        git \
-        python3-venv \
-        python3-pip \
-        python3-dev \
-        samba-client \
-        cifs-utils \
-        network-manager \
-        curl \
-        build-essential
-    ok "System packages installed"
-
-    # ── 2.2  Clone or update repo ─────────────────────────────────────────────
-    step "2.2" "Setting up repository at ${INSTALL_DIR} ..."
+# ── 3. Clone / update repo ────────────────────────────────────────────────────
+setup_repo() {
+    step "Setting up repository ..."
     if [[ -d "${INSTALL_DIR}/.git" ]]; then
         sudo -u "${PI_USER}" git -C "${INSTALL_DIR}" pull --ff-only origin "${REPO_BRANCH}" \
-            && ok "Repo updated" || warn "git pull failed — using existing files"
+            && ok "Repo updated  →  ${INSTALL_DIR}" \
+            || warn "git pull failed — using existing files"
     else
         sudo -u "${PI_USER}" git clone --branch "${REPO_BRANCH}" \
             "${REPO_URL}" "${INSTALL_DIR}"
-        ok "Repo cloned → ${INSTALL_DIR}"
-    fi
-
-    # ── 2.3  Python virtual environment ───────────────────────────────────────
-    step "2.3" "Setting up Python venv at ${VENV_DIR} ..."
-    if [[ ! -d "${VENV_DIR}" ]]; then
-        sudo -u "${PI_USER}" python3 -m venv "${VENV_DIR}"
-        ok "venv created"
-    else
-        ok "venv already exists"
+        ok "Repo cloned  →  ${INSTALL_DIR}"
     fi
+}
 
-    # Upgrade pip silently, then install pinned packages
-    sudo -u "${PI_USER}" "${VENV_DIR}/bin/pip" install --quiet --upgrade pip
-    sudo -u "${PI_USER}" "${VENV_DIR}/bin/pip" install --quiet "${PY_PKGS[@]}"
-    ok "Python packages installed: ${PY_PKGS[*]}"
+# ── 4. Python venv ────────────────────────────────────────────────────────────
+setup_venv() {
+    step "Setting up Python environment ..."
+    [[ -d "${VENV_DIR}" ]] \
+        && ok "venv exists — skipping creation" \
+        || sudo -u "${PI_USER}" python3 -m venv "${VENV_DIR}"
+    sudo -u "${PI_USER}" "${VENV_DIR}/bin/pip" install -q --upgrade pip
+    sudo -u "${PI_USER}" "${VENV_DIR}/bin/pip" install -q "${PY_PKGS[@]}"
+    ok "Packages installed in ${VENV_DIR}"
+}
 
-    # ── 2.4  Runtime directories ──────────────────────────────────────────────
-    step "2.4" "Creating runtime directories ..."
+# ── 5. Directories ────────────────────────────────────────────────────────────
+setup_dirs() {
+    step "Creating runtime directories ..."
     mkdir -p "${REPORTS_DIR}"
     chown "${PI_USER}:${PI_USER}" "${REPORTS_DIR}"
     ok "${REPORTS_DIR}"
+}
+
+# ── 6. WiFi — interactive scan + pick ────────────────────────────────────────
+setup_wifi() {
+    step "WiFi Setup"
 
-    # ── 2.5  WiFi — ensure saved profile with autoconnect ────────────────────
-    step "2.5" "Configuring WiFi (SSID: ${WIFI_SSID}) ..."
-    # Find any existing profile with this SSID
-    EXISTING_PROFILE="$(nmcli -t -f NAME,TYPE con show | \
-        awk -F: '$2=="802-11-wireless"{print $1}' | head -1 || true)"
-
-    if nmcli device status | awk '$2=="wifi" && $3=="connected"' | grep -q .; then
-        ok "WiFi already connected — skipping profile creation"
-        EXISTING_PROFILE="$(nmcli -t -f NAME,DEVICE con show --active | \
-            grep ":wlan0" | cut -d: -f1 || true)"
-    elif [[ -n "${EXISTING_PROFILE}" ]]; then
-        ok "WiFi profile '${EXISTING_PROFILE}' already saved in NetworkManager"
+    # Check if wlan0 exists
+    if ! ip link show wlan0 &>/dev/null; then
+        warn "No wlan0 interface found — skipping WiFi setup."
+        return
+    fi
+
+    echo ""
+    echo -e "  ${C}Scanning for nearby networks ...${NC}"
+    nmcli dev wifi rescan ifname wlan0 2>/dev/null || true
+    sleep 3
+
+    # Build deduplicated, signal-sorted list  [SSID, SIGNAL, SECURITY]
+    mapfile -t RAW < <(
+        nmcli -t -f SSID,SIGNAL,SECURITY dev wifi list ifname wlan0 2>/dev/null \
+        | grep -v '^:' \
+        | awk -F: '$1!=""' \
+        | sort -t: -k2 -rn \
+        | awk -F: '!seen[$1]++'
+    )
+
+    if [[ ${#RAW[@]} -eq 0 ]]; then
+        warn "No networks found. Skipping WiFi setup."
+        return
+    fi
+
+    # ── Print menu ────────────────────────────────────────────────
+    echo ""
+    hr
+    printf "  ${B}%-4s %-28s %-10s %s${NC}\n" "#" "SSID" "Signal" "Security"
+    hr
+
+    declare -a SSIDS SIGNALS SECURITIES
+    for i in "${!RAW[@]}"; do
+        IFS=':' read -r SSID SIGNAL SECURITY <<< "${RAW[$i]}"
+        SSIDS[$i]="${SSID}"
+        SIGNALS[$i]="${SIGNAL}"
+        SECURITIES[$i]="${SECURITY}"
+
+        # Visual signal bar
+        SIG="${SIGNAL:-0}"
+        if   [[ $SIG -ge 80 ]]; then BAR="${G}▂▄▆█${NC}"
+        elif [[ $SIG -ge 60 ]]; then BAR="${G}▂▄▆${NC} "
+        elif [[ $SIG -ge 40 ]]; then BAR="${Y}▂▄${NC}  "
+        else                         BAR="${R}▂${NC}   "; fi
+
+        SEC="${SECURITY:---}"
+        printf "  %-4s %-28s %b %-4s%%  %s\n" \
+            "$((i+1)))" "${SSID}" "${BAR}" "${SIG}" "${SEC}"
+    done
+
+    hr
+    printf "  %-4s %s\n" "0)" "Skip WiFi setup"
+    echo ""
+
+    # ── Read choice ───────────────────────────────────────────────
+    while true; do
+        read -r -p "  Choose network [1-${#RAW[@]}] or 0 to skip: " CHOICE </dev/tty
+        [[ "$CHOICE" =~ ^[0-9]+$ ]] && \
+            [[ "$CHOICE" -ge 0 ]] && [[ "$CHOICE" -le "${#RAW[@]}" ]] && break
+        echo -e "  ${R}Invalid choice — enter a number between 0 and ${#RAW[@]}${NC}"
+    done
+
+    if [[ "$CHOICE" -eq 0 ]]; then
+        warn "WiFi setup skipped."
+        return
+    fi
+
+    IDX=$((CHOICE - 1))
+    SEL_SSID="${SSIDS[$IDX]}"
+    SEL_SEC="${SECURITIES[$IDX]}"
+
+    echo ""
+    ok "Selected: ${SEL_SSID}"
+
+    # ── Password prompt (skip for open networks) ──────────────────
+    WIFI_PASS=""
+    if [[ "${SEL_SEC}" != "--" && -n "${SEL_SEC}" ]]; then
+        while true; do
+            read -r -s -p "  Enter WiFi password: " WIFI_PASS </dev/tty
+            echo ""
+            [[ -n "${WIFI_PASS}" ]] && break
+            echo -e "  ${R}Password cannot be empty for a secured network.${NC}"
+        done
     else
-        # Need password — use WIFI_PASS env var or prompt
-        if [[ -z "${WIFI_PASS}" ]]; then
-            if [[ -t 0 ]]; then
-                read -r -s -p "    Enter WiFi password for '${WIFI_SSID}': " WIFI_PASS < /dev/tty
-                echo ""
-            else
-                warn "WiFi password not provided. Set WIFI_PASS= env var or configure manually."
-                warn "Skipping WiFi profile creation."
-                WIFI_PASS=""
-            fi
-        fi
-        if [[ -n "${WIFI_PASS}" ]]; then
-            nmcli connection add \
-                type wifi \
-                ifname wlan0 \
-                con-name "${WIFI_SSID}" \
-                ssid "${WIFI_SSID}" \
-                wifi-sec.key-mgmt wpa-psk \
-                wifi-sec.psk "${WIFI_PASS}" \
-                connection.autoconnect yes
-            ok "WiFi profile '${WIFI_SSID}' created"
-            EXISTING_PROFILE="${WIFI_SSID}"
-        fi
+        info "Open network — no password needed."
     fi
 
-    # Set high autoconnect priority on whichever profile is active
-    if [[ -n "${EXISTING_PROFILE}" ]]; then
-        nmcli connection modify "${EXISTING_PROFILE}" \
+    # ── Create / update the NM connection profile ─────────────────
+    # Remove any existing profile with this SSID to avoid conflicts
+    nmcli connection delete "${SEL_SSID}" 2>/dev/null || true
+
+    if [[ -n "${WIFI_PASS}" ]]; then
+        nmcli connection add \
+            type wifi ifname wlan0 \
+            con-name "${SEL_SSID}" \
+            ssid "${SEL_SSID}" \
+            wifi-sec.key-mgmt wpa-psk \
+            wifi-sec.psk "${WIFI_PASS}" \
+            connection.autoconnect yes \
+            connection.autoconnect-priority 200 2>/dev/null
+    else
+        nmcli connection add \
+            type wifi ifname wlan0 \
+            con-name "${SEL_SSID}" \
+            ssid "${SEL_SSID}" \
             connection.autoconnect yes \
-            connection.autoconnect-priority 200 2>/dev/null || true
-        ok "Autoconnect priority set to 200 for '${EXISTING_PROFILE}'"
+            connection.autoconnect-priority 200 2>/dev/null
     fi
 
-    # ── 2.6  NetworkManager-wait-online (guarantees IP before services start) ─
-    step "2.6" "Enabling NetworkManager-wait-online ..."
+    # Connect now so the rest of the setup (git pull, pip) works
+    echo -n "  Connecting ..."
+    if nmcli connection up "${SEL_SSID}" 2>/dev/null; then
+        echo ""
+        ok "Connected to '${SEL_SSID}'"
+    else
+        echo ""
+        warn "Could not connect now — will auto-connect on reboot."
+    fi
+}
+
+# ── 7. Network-online guarantee ───────────────────────────────────────────────
+setup_network_online() {
+    step "Enabling NetworkManager-wait-online (60 s timeout) ..."
     mkdir -p /etc/systemd/system/NetworkManager-wait-online.service.d/
     cat > /etc/systemd/system/NetworkManager-wait-online.service.d/timeout.conf << 'EOF'
 [Service]
@@ -318,10 +306,14 @@ ExecStart=
 ExecStart=/usr/lib/NetworkManager/nm-online -s -q --timeout=60
 EOF
     systemctl enable NetworkManager-wait-online.service 2>/dev/null || true
-    ok "NetworkManager-wait-online enabled (60 s timeout)"
+    ok "Services will wait up to 60 s for a network connection after boot"
+}
+
+# ── 8 & 9. systemd services ───────────────────────────────────────────────────
+install_services() {
+    step "Installing systemd services ..."
 
-    # ── 2.7  systemd service: plc_watcher (RT) ───────────────────────────────
-    step "2.7" "Installing plc_watcher.service (SCHED_FIFO:50, IOClass=realtime) ..."
+    # plc_watcher — SCHED_FIFO:50, IOClass=realtime, pinned to CPU core 3
     cat > /etc/systemd/system/plc_watcher.service << EOF
 [Unit]
 Description=PLC Check-Weigher Start Watcher
@@ -338,31 +330,19 @@ Restart=always
 RestartSec=5
 StandardOutput=journal
 StandardError=journal
-
-# ── Real-time scheduling ──────────────────────────────
-# SCHED_FIFO priority 50 preempts all SCHED_OTHER tasks.
-# CPUSchedulingResetOnFork=no (default) means plc_reader.py
-# subprocess inherits this RT policy via Popen automatically.
 CPUSchedulingPolicy=fifo
 CPUSchedulingPriority=50
 IOSchedulingClass=realtime
 IOSchedulingPriority=0
-# Pin to core 3 — isolated from general OS scheduling noise
 CPUAffinity=3
 Nice=-15
 
 [Install]
 WantedBy=multi-user.target
 EOF
+    ok "plc_watcher.service  (SCHED_FIFO:50 · IOClass=realtime · CPU core 3)"
 
-    # Mirror the service file back into the repo so git tracks it
-    cp /etc/systemd/system/plc_watcher.service \
-       "${INSTALL_DIR}/plc_watcher.service"
-    chown "${PI_USER}:${PI_USER}" "${INSTALL_DIR}/plc_watcher.service"
-    ok "plc_watcher.service installed"
-
-    # ── 2.8  systemd service: plc_web ─────────────────────────────────────────
-    step "2.8" "Installing plc_web.service ..."
+    # plc_web — elevated but not real-time
     cat > /etc/systemd/system/plc_web.service << EOF
 [Unit]
 Description=PLC Check-Weigher Report Viewer
@@ -385,106 +365,65 @@ Nice=-10
 [Install]
 WantedBy=multi-user.target
 EOF
-    ok "plc_web.service installed"
+    ok "plc_web.service       (Nice=-10)"
 
-    # ── 2.9  Enable + start services ──────────────────────────────────────────
-    step "2.9" "Enabling and starting services ..."
     systemctl daemon-reload
     systemctl enable plc_watcher.service plc_web.service
-    systemctl restart plc_watcher.service || true
-    sleep 2
-    systemctl restart plc_web.service || true
-    ok "Services enabled and started"
-
-    # ── 2.10  Disable continuation service (we're done) ──────────────────────
-    if systemctl is-enabled "${CONT_SVC}" &>/dev/null 2>&1; then
-        systemctl disable "${CONT_SVC}" 2>/dev/null || true
-        rm -f "/etc/systemd/system/${CONT_SVC}"
-        systemctl daemon-reload
-        ok "Continuation service cleaned up"
-    fi
+    ok "Both services enabled — will start automatically after reboot"
 
-    # ── 2.11  SMB connectivity check ─────────────────────────────────────────
-    step "2.11" "Verifying SMB share at //${SMB_HOST}/${SMB_SHARE} ..."
-    if ping -c 2 -W 2 "${SMB_HOST}" &>/dev/null; then
-        ok "Host ${SMB_HOST} reachable"
-        if smbclient "//${SMB_HOST}/${SMB_SHARE}" \
-               -U "${SMB_USER}%${SMB_PASS}" -c "ls" &>/dev/null 2>&1; then
-            ok "SMB auth success — PDF push is ready"
-        else
-            warn "SMB host reachable but auth failed — ensure the share is set up on the host"
-        fi
-    else
-        warn "SMB host ${SMB_HOST} not reachable — will retry at runtime"
-    fi
-
-    # ── Final verification report ─────────────────────────────────────────────
-    banner "Setup Complete — Verification"
+    # Mirror updated service file back into the repo
+    cp /etc/systemd/system/plc_watcher.service "${INSTALL_DIR}/plc_watcher.service"
+    chown "${PI_USER}:${PI_USER}" "${INSTALL_DIR}/plc_watcher.service"
+}
 
+# ── Summary + countdown reboot ────────────────────────────────────────────────
+do_reboot() {
     echo ""
-    echo "  Kernel:"
-    uname -r | sed 's/^/    /'
-    grep -o 'PREEMPT_RT' /proc/version 2>/dev/null \
-        && echo -e "    ${G}✓ PREEMPT_RT confirmed${NC}" \
-        || echo -e "    ${R}✗ PREEMPT_RT NOT detected${NC}"
-
+    banner "All Done — Summary"
     echo ""
-    echo "  Services:"
-    for svc in plc_watcher plc_web; do
-        STATE="$(systemctl is-active ${svc}.service 2>/dev/null || echo 'inactive')"
-        if [[ "${STATE}" == "active" ]]; then
-            echo -e "    ${G}✓${NC}  ${svc}  (${STATE})"
-        else
-            echo -e "    ${R}✗${NC}  ${svc}  (${STATE})"
-        fi
-    done
 
-    echo ""
-    echo "  RT scheduling (plc_watcher):"
-    PID="$(systemctl show -p MainPID --value plc_watcher.service 2>/dev/null || echo '')"
-    if [[ -n "${PID}" && "${PID}" != "0" ]]; then
-        chrt -p "${PID}" 2>/dev/null | sed 's/^/    /' || true
-        ionice -p "${PID}" 2>/dev/null | sed 's/^/    /' || true
-        taskset -cp "${PID}" 2>/dev/null | sed 's/^/    /' || true
-    else
-        echo "    (PID not yet available)"
-    fi
+    printf "  %-30s %s\n"  "RT kernel ready:"     "kernel8-rt.img  (activates on reboot)"
+    printf "  %-30s %s\n"  "Stock kernel fallback:" "kernel8-stock.img"
+    printf "  %-30s %s\n"  "Repo:"                "${INSTALL_DIR}"
+    printf "  %-30s %s\n"  "Python venv:"         "${VENV_DIR}"
+    printf "  %-30s %s\n"  "Reports output:"      "${REPORTS_DIR}"
+    printf "  %-30s %s\n"  "Web dashboard (after reboot):" \
+        "http://$(hostname -I | awk '{print $1}' 2>/dev/null || echo '<pi-ip>'):8080"
 
     echo ""
-    echo "  WiFi:"
-    nmcli -t -f NAME,DEVICE,STATE con show --active | grep wifi | sed 's/^/    /' \
-        || echo "    (no active WiFi)"
-
-    echo ""
-    echo "  Reports directory: ${REPORTS_DIR}"
-    echo "  Web dashboard:     http://$(hostname -I | awk '{print $1}'):8080"
-    echo ""
-    echo "  Useful commands:"
-    echo "    journalctl -u plc_watcher -f       # live watcher log"
-    echo "    journalctl -u plc_web -f           # live web log"
+    echo -e "  ${Y}After reboot, check services with:${NC}"
+    echo "    journalctl -u plc_watcher -f"
     echo "    sudo chrt -p \$(systemctl show -p MainPID --value plc_watcher)"
     echo ""
-}
 
-# =============================================================================
-#  Entry point — decide which phase to run
-# =============================================================================
-main() {
-    banner "PLC Check-Weigher Installer"
-    echo "  Repo  : ${REPO_URL}"
-    echo "  User  : ${PI_USER}"
-    echo "  Kernel: $(uname -r)"
+    echo -e "${G}"
+    echo "  ╔══════════════════════════════════════════════════════╗"
+    echo "  ║  Rebooting in 10 seconds to apply all changes.      ║"
+    echo "  ║  Press Ctrl+C to cancel — reboot manually later:    ║"
+    echo "  ║    sudo reboot                                       ║"
+    echo "  ╚══════════════════════════════════════════════════════╝"
+    echo -e "${NC}"
+
+    for i in $(seq 10 -1 1); do
+        printf "\r  Rebooting in %2d seconds ...  " "$i"
+        sleep 1
+    done
     echo ""
+    reboot
+}
 
-    if is_rt_kernel; then
-        ok "PREEMPT_RT kernel already running — proceeding directly to phase 2"
-        setup_full
-    else
-        warn "Standard kernel detected ($(uname -r))"
-        warn "Installing RT kernel — system will reboot once, then auto-complete setup."
-        install_rt_kernel
-        # install_rt_kernel reboots — execution never reaches here
-    fi
+# ── Main ──────────────────────────────────────────────────────────────────────
+main() {
+    preflight
+    install_system_packages
+    install_rt_kernel
+    setup_repo
+    setup_venv
+    setup_dirs
+    setup_wifi
+    setup_network_online
+    install_services
+    do_reboot
 }
 
 main "$@"