plc-checkweigher 1.1.0 → 1.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plc-checkweigher",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "One-command installer for the PLC Check-Weigher system on Raspberry Pi (PREEMPT_RT kernel, Python stack, WiFi, SMB, systemd RT services)",
   "bin": {
     "plc-checkweigher": "bin/cli.js"

package/setup.sh

@@ -1,24 +1,23 @@
 #!/usr/bin/env bash
 # =============================================================================
-#  PLC Check-Weigher — Full Stack Installer  v1.1
+#  PLC Check-Weigher — Full Stack Installer  v1.2
 # =============================================================================
-#  Run on any fresh Raspberry Pi with ONE command:
+#  Run on any fresh Raspberry Pi:
 #
 #    npx plc-checkweigher
 #
-#  What happens (all in one go, single reboot at the end):
+#  Steps (everything first, ONE reboot at the very end):
 #    1.  Pre-flight checks
-#    2.  System packages  (git, python3-venv, samba-client …)
-#    3.  PREEMPT_RT kernel install + config (no reboot yet)
-#    4.  Clone / update the plc-checkweigher repo
-#    5.  Python venv + pip install (pinned versions)
-#    6.  Create /home/pi/reports directory
-#    7.  WiFi — interactive scan → pick from list → enter password
-#    8.  NetworkManager-wait-online (guarantees IP before services start)
-#    9.  plc_watcher.service  — SCHED_FIFO:50, IOClass=realtime, Core 3
-#   10.  plc_web.service      — Nice=-10
-#   11.  Enable + arm both services
-#   12.  REBOOT  (one-time, applies RT kernel + all config)
+#    2.  System packages
+#    3.  Clone / update repo
+#    4.  Python venv + pip install
+#    5.  Create /home/<user>/reports
+#    6.  WiFi     — scan → pick from list → password
+#    7.  SMB      — enter host IP, share name, credentials  → smb_config.py
+#    8.  NetworkManager-wait-online
+#    9.  systemd services (plc_watcher + plc_web)
+#   10.  PREEMPT_RT kernel  ← installed last so only one reboot is needed
+#   11.  REBOOT
 # =============================================================================
 
 set -euo pipefail
@@ -48,100 +47,63 @@ PY_PKGS=(
 )
 
 # ── Colours ───────────────────────────────────────────────────────────────────
-B='\033[1;34m'; G='\033[0;32m'; R='\033[1;31m'; Y='\033[1;33m'; C='\033[0;36m'; NC='\033[0m'
-
-banner()  { echo -e "\n${B}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
-            echo -e "${B}  $*${NC}"
-            echo -e "${B}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"; }
-step()    { echo -e "\n${Y}▶ $*${NC}"; }
-ok()      { echo -e "  ${G}✓${NC}  $*"; }
-warn()    { echo -e "  ${Y}!${NC}  $*"; }
-info()    { echo -e "  ${C}i${NC}  $*"; }
-die()     { echo -e "\n${R}FATAL:${NC} $*" >&2; exit 1; }
-hr()      { echo -e "  ${B}$(printf '─%.0s' {1..48})${NC}"; }
+B='\033[1;34m'; G='\033[0;32m'; R='\033[1;31m'; Y='\033[1;33m'
+C='\033[0;36m'; D='\033[2m'; NC='\033[0m'
+
+banner() { echo -e "\n${B}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
+           echo -e "${B}  $*${NC}"
+           echo -e "${B}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"; }
+step()   { echo -e "\n${Y}▶ $*${NC}"; }
+ok()     { echo -e "  ${G}✓${NC}  $*"; }
+warn()   { echo -e "  ${Y}!${NC}  $*"; }
+info()   { echo -e "  ${C}i${NC}  $*"; }
+hr()     { echo -e "  ${D}$(printf '─%.0s' {1..50})${NC}"; }
+die()    { echo -e "\n${R}FATAL:${NC} $*" >&2; exit 1; }
+
+prompt() {
+    # prompt <varname> <display-label> [default]
+    local var="$1" label="$2" default="${3:-}"
+    local hint=""
+    [[ -n "$default" ]] && hint=" ${D}[${default}]${NC}"
+    printf "  %-28s%b: " "${label}" "${hint}"
+    read -r value </dev/tty
+    [[ -z "$value" && -n "$default" ]] && value="$default"
+    printf -v "$var" '%s' "$value"
+}
+
+prompt_secret() {
+    local var="$1" label="$2"
+    printf "  %-28s: " "${label}"
+    read -r -s value </dev/tty
+    echo ""
+    printf -v "$var" '%s' "$value"
+}
 
 # ── 0. Pre-flight ─────────────────────────────────────────────────────────────
 preflight() {
-    banner "PLC Check-Weigher Installer  v1.1"
-
-    [[ "${EUID}" -eq 0 ]]        || die "Run via:  npx plc-checkweigher  (asks for sudo password)"
-    [[ "$(uname -m)" == "aarch64" ]] || die "Requires 64-bit Raspberry Pi (aarch64). Got: $(uname -m)"
-    [[ -d "${HOME_DIR}" ]]       || die "Home dir ${HOME_DIR} not found. Set PI_USER= to override."
-    command -v nmcli &>/dev/null || die "NetworkManager not found — install Raspberry Pi OS first."
-
+    banner "PLC Check-Weigher Installer  v1.2"
+    [[ "${EUID}" -eq 0 ]]             || die "Run via npx plc-checkweigher (asks for sudo password)"
+    [[ "$(uname -m)" == "aarch64" ]]  || die "Requires 64-bit Raspberry Pi (aarch64). Got: $(uname -m)"
+    [[ -d "${HOME_DIR}" ]]            || die "Home ${HOME_DIR} not found. Set PI_USER= to override."
+    command -v nmcli &>/dev/null      || die "NetworkManager not found — install Raspberry Pi OS first."
     info "Host   : $(hostname)"
     info "Kernel : $(uname -r)"
     info "User   : ${PI_USER}"
-    info "Repo   : ${REPO_URL}"
 }
 
 # ── 1. System packages ────────────────────────────────────────────────────────
 install_system_packages() {
-    step "Installing system packages ..."
+    step "System packages ..."
     DEBIAN_FRONTEND=noninteractive apt-get update -qq
     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
         git python3-venv python3-pip python3-dev \
         samba-client cifs-utils network-manager curl build-essential
-    ok "git, python3-venv, python3-dev, samba-client, cifs-utils"
-}
-
-# ── 2. RT kernel ──────────────────────────────────────────────────────────────
-install_rt_kernel() {
-    step "Setting up PREEMPT_RT kernel ..."
-
-    if grep -q "PREEMPT_RT" /proc/version 2>/dev/null; then
-        ok "Already running PREEMPT_RT kernel — skipping install"
-        return
-    fi
-
-    # Backup
-    if [[ ! -f "${BOOT_FW}/kernel8-stock.img" ]]; then
-        cp "${BOOT_FW}/kernel8.img" "${BOOT_FW}/kernel8-stock.img"
-        ok "Stock kernel backed up → kernel8-stock.img"
-    fi
-
-    CHKSUM_BEFORE="$(md5sum "${BOOT_FW}/kernel8.img" | cut -d' ' -f1)"
-    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "${RT_PKG}" "${RT_HDR}"
-    CHKSUM_AFTER="$(md5sum "${BOOT_FW}/kernel8.img" | cut -d' ' -f1)"
-
-    if [[ "${CHKSUM_BEFORE}" != "${CHKSUM_AFTER}" ]]; then
-        cp "${BOOT_FW}/kernel8.img"       "${BOOT_FW}/kernel8-rt.img"
-        cp "${BOOT_FW}/kernel8-stock.img" "${BOOT_FW}/kernel8.img"
-        ok "RT kernel → kernel8-rt.img  |  stock restored as fallback"
-    else
-        RT_VMLINUZ="$(ls /boot/vmlinuz-*rt-arm64 2>/dev/null | sort -V | tail -1)"
-        [[ -n "${RT_VMLINUZ}" ]] || die "RT vmlinuz not found in /boot/"
-        if file "${RT_VMLINUZ}" | grep -q gzip; then
-            zcat "${RT_VMLINUZ}" > "${BOOT_FW}/kernel8-rt.img"
-        else
-            cp "${RT_VMLINUZ}" "${BOOT_FW}/kernel8-rt.img"
-        fi
-        ok "RT kernel manually copied → kernel8-rt.img"
-    fi
-
-    # Copy RT initramfs if present
-    RT_INITRD="$(ls /boot/initrd.img-*rt-arm64 2>/dev/null | sort -V | tail -1 || true)"
-    [[ -n "${RT_INITRD}" ]] && cp "${RT_INITRD}" "${BOOT_FW}/initramfs8-rt" \
-        && ok "RT initramfs → initramfs8-rt"
-
-    # Activate in config.txt (idempotent — removes any previous block first)
-    sed -i '/### PLC-RT-BLOCK-START ###/,/### PLC-RT-BLOCK-END ###/d' \
-        "${BOOT_FW}/config.txt"
-    cat >> "${BOOT_FW}/config.txt" << 'EOF'
-
-### PLC-RT-BLOCK-START ###
-# PREEMPT_RT kernel — installed by plc-checkweigher setup.sh
-# To revert: comment the two lines below and reboot.
-kernel=kernel8-rt.img
-initramfs initramfs8-rt followkernel
-### PLC-RT-BLOCK-END ###
-EOF
-    ok "config.txt updated — RT kernel activates after reboot"
+    ok "git  python3-venv  samba-client  cifs-utils  build-essential"
 }
 
-# ── 3. Clone / update repo ────────────────────────────────────────────────────
+# ── 2. Clone / update repo ────────────────────────────────────────────────────
 setup_repo() {
-    step "Setting up repository ..."
+    step "Repository ..."
     if [[ -d "${INSTALL_DIR}/.git" ]]; then
         sudo -u "${PI_USER}" git -C "${INSTALL_DIR}" pull --ff-only origin "${REPO_BRANCH}" \
             && ok "Repo updated  →  ${INSTALL_DIR}" \
@@ -153,41 +115,38 @@ setup_repo() {
     fi
 }
 
-# ── 4. Python venv ────────────────────────────────────────────────────────────
+# ── 3. Python venv ────────────────────────────────────────────────────────────
 setup_venv() {
-    step "Setting up Python environment ..."
+    step "Python environment ..."
     [[ -d "${VENV_DIR}" ]] \
         && ok "venv exists — skipping creation" \
         || sudo -u "${PI_USER}" python3 -m venv "${VENV_DIR}"
     sudo -u "${PI_USER}" "${VENV_DIR}/bin/pip" install -q --upgrade pip
     sudo -u "${PI_USER}" "${VENV_DIR}/bin/pip" install -q "${PY_PKGS[@]}"
-    ok "Packages installed in ${VENV_DIR}"
+    ok "Packages installed  →  ${VENV_DIR}"
 }
 
-# ── 5. Directories ────────────────────────────────────────────────────────────
+# ── 4. Directories ────────────────────────────────────────────────────────────
 setup_dirs() {
-    step "Creating runtime directories ..."
+    step "Runtime directories ..."
     mkdir -p "${REPORTS_DIR}"
     chown "${PI_USER}:${PI_USER}" "${REPORTS_DIR}"
     ok "${REPORTS_DIR}"
 }
 
-# ── 6. WiFi — interactive scan + pick ────────────────────────────────────────
+# ── 5. WiFi — scan → pick → password ─────────────────────────────────────────
 setup_wifi() {
     step "WiFi Setup"
 
-    # Check if wlan0 exists
     if ! ip link show wlan0 &>/dev/null; then
-        warn "No wlan0 interface found — skipping WiFi setup."
+        warn "No wlan0 found — skipping WiFi setup."
         return
     fi
 
-    echo ""
-    echo -e "  ${C}Scanning for nearby networks ...${NC}"
+    echo -e "\n  ${C}Scanning for networks ...${NC}"
     nmcli dev wifi rescan ifname wlan0 2>/dev/null || true
     sleep 3
 
-    # Build deduplicated, signal-sorted list  [SSID, SIGNAL, SECURITY]
     mapfile -t RAW < <(
         nmcli -t -f SSID,SIGNAL,SECURITY dev wifi list ifname wlan0 2>/dev/null \
         | grep -v '^:' \
@@ -197,65 +156,47 @@ setup_wifi() {
     )
 
     if [[ ${#RAW[@]} -eq 0 ]]; then
-        warn "No networks found. Skipping WiFi setup."
+        warn "No networks found — skipping WiFi setup."
         return
     fi
 
-    # ── Print menu ────────────────────────────────────────────────
     echo ""
     hr
     printf "  ${B}%-4s %-28s %-10s %s${NC}\n" "#" "SSID" "Signal" "Security"
     hr
-
     declare -a SSIDS SIGNALS SECURITIES
     for i in "${!RAW[@]}"; do
         IFS=':' read -r SSID SIGNAL SECURITY <<< "${RAW[$i]}"
-        SSIDS[$i]="${SSID}"
-        SIGNALS[$i]="${SIGNAL}"
-        SECURITIES[$i]="${SECURITY}"
-
-        # Visual signal bar
+        SSIDS[$i]="${SSID}"; SIGNALS[$i]="${SIGNAL}"; SECURITIES[$i]="${SECURITY}"
         SIG="${SIGNAL:-0}"
         if   [[ $SIG -ge 80 ]]; then BAR="${G}▂▄▆█${NC}"
-        elif [[ $SIG -ge 60 ]]; then BAR="${G}▂▄▆${NC} "
-        elif [[ $SIG -ge 40 ]]; then BAR="${Y}▂▄${NC}  "
-        else                         BAR="${R}▂${NC}   "; fi
-
-        SEC="${SECURITY:---}"
-        printf "  %-4s %-28s %b %-4s%%  %s\n" \
-            "$((i+1)))" "${SSID}" "${BAR}" "${SIG}" "${SEC}"
+        elif [[ $SIG -ge 60 ]]; then BAR="${G}▂▄▆ ${NC}"
+        elif [[ $SIG -ge 40 ]]; then BAR="${Y}▂▄  ${NC}"
+        else                         BAR="${R}▂   ${NC}"; fi
+        printf "  %-4s %-28s %b  %3s%%  %s\n" \
+            "$((i+1)))" "${SSID}" "${BAR}" "${SIG}" "${SECURITY:---}"
     done
-
     hr
     printf "  %-4s %s\n" "0)" "Skip WiFi setup"
     echo ""
 
-    # ── Read choice ───────────────────────────────────────────────
     while true; do
         read -r -p "  Choose network [1-${#RAW[@]}] or 0 to skip: " CHOICE </dev/tty
         [[ "$CHOICE" =~ ^[0-9]+$ ]] && \
-            [[ "$CHOICE" -ge 0 ]] && [[ "$CHOICE" -le "${#RAW[@]}" ]] && break
-        echo -e "  ${R}Invalid choice — enter a number between 0 and ${#RAW[@]}${NC}"
+            [[ "$CHOICE" -ge 0 && "$CHOICE" -le "${#RAW[@]}" ]] && break
+        echo -e "  ${R}Enter a number between 0 and ${#RAW[@]}${NC}"
     done
 
-    if [[ "$CHOICE" -eq 0 ]]; then
-        warn "WiFi setup skipped."
-        return
-    fi
+    [[ "$CHOICE" -eq 0 ]] && { warn "WiFi setup skipped."; return; }
 
     IDX=$((CHOICE - 1))
     SEL_SSID="${SSIDS[$IDX]}"
     SEL_SEC="${SECURITIES[$IDX]}"
 
-    echo ""
-    ok "Selected: ${SEL_SSID}"
-
-    # ── Password prompt (skip for open networks) ──────────────────
     WIFI_PASS=""
     if [[ "${SEL_SEC}" != "--" && -n "${SEL_SEC}" ]]; then
         while true; do
-            read -r -s -p "  Enter WiFi password: " WIFI_PASS </dev/tty
-            echo ""
+            prompt_secret WIFI_PASS "WiFi password"
             [[ -n "${WIFI_PASS}" ]] && break
             echo -e "  ${R}Password cannot be empty for a secured network.${NC}"
         done
@@ -263,42 +204,92 @@ setup_wifi() {
         info "Open network — no password needed."
     fi
 
-    # ── Create / update the NM connection profile ─────────────────
-    # Remove any existing profile with this SSID to avoid conflicts
     nmcli connection delete "${SEL_SSID}" 2>/dev/null || true
-
     if [[ -n "${WIFI_PASS}" ]]; then
-        nmcli connection add \
-            type wifi ifname wlan0 \
-            con-name "${SEL_SSID}" \
-            ssid "${SEL_SSID}" \
-            wifi-sec.key-mgmt wpa-psk \
-            wifi-sec.psk "${WIFI_PASS}" \
-            connection.autoconnect yes \
-            connection.autoconnect-priority 200 2>/dev/null
+        nmcli connection add type wifi ifname wlan0 con-name "${SEL_SSID}" \
+            ssid "${SEL_SSID}" wifi-sec.key-mgmt wpa-psk wifi-sec.psk "${WIFI_PASS}" \
+            connection.autoconnect yes connection.autoconnect-priority 200 2>/dev/null
     else
-        nmcli connection add \
-            type wifi ifname wlan0 \
-            con-name "${SEL_SSID}" \
-            ssid "${SEL_SSID}" \
-            connection.autoconnect yes \
+        nmcli connection add type wifi ifname wlan0 con-name "${SEL_SSID}" \
+            ssid "${SEL_SSID}" connection.autoconnect yes \
             connection.autoconnect-priority 200 2>/dev/null
     fi
 
-    # Connect now so the rest of the setup (git pull, pip) works
     echo -n "  Connecting ..."
     if nmcli connection up "${SEL_SSID}" 2>/dev/null; then
-        echo ""
-        ok "Connected to '${SEL_SSID}'"
+        echo ""; ok "Connected to '${SEL_SSID}'"
     else
+        echo ""; warn "Will connect automatically after reboot."
+    fi
+}
+
+# ── 6. SMB file sharing — interactive ────────────────────────────────────────
+setup_smb() {
+    step "SMB File Sharing Setup"
+    echo ""
+    echo -e "  ${C}PDF reports will be pushed to a shared folder on another PC.${NC}"
+    echo -e "  ${D}Leave blank to disable SMB push.${NC}"
+    echo ""
+    hr
+
+    prompt SMB_HOST     "Host IP address"   ""
+    if [[ -z "${SMB_HOST}" ]]; then
+        warn "SMB push disabled — no host entered."
+        # Write a disabled smb_config.py
+        cat > "${INSTALL_DIR}/smb_config.py" << 'EOF'
+# SMB push disabled during setup
+SMB_ENABLED  = False
+SMB_HOST     = ""
+SMB_SHARE    = ""
+SMB_USERNAME = ""
+SMB_PASSWORD = ""
+SMB_SUBDIR   = ""
+EOF
+        chown "${PI_USER}:${PI_USER}" "${INSTALL_DIR}/smb_config.py"
+        return
+    fi
+
+    prompt     SMB_SHARE    "Share name (folder)"     "Reports"
+    prompt     SMB_USERNAME "Username"                ""
+    prompt_secret SMB_PASSWORD "Password"
+    prompt     SMB_SUBDIR   "Subfolder (optional)"    ""
+
+    hr
+    echo ""
+
+    # Write smb_config.py (gitignored — credentials stay off GitHub)
+    cat > "${INSTALL_DIR}/smb_config.py" << EOF
+# SMB configuration — written by setup.sh, NOT committed to git.
+SMB_ENABLED  = True
+SMB_HOST     = "${SMB_HOST}"
+SMB_SHARE    = "${SMB_SHARE}"
+SMB_USERNAME = "${SMB_USERNAME}"
+SMB_PASSWORD = "${SMB_PASSWORD}"
+SMB_SUBDIR   = "${SMB_SUBDIR}"
+EOF
+    chown "${PI_USER}:${PI_USER}" "${INSTALL_DIR}/smb_config.py"
+    ok "SMB config saved  →  ${INSTALL_DIR}/smb_config.py"
+
+    # Test connectivity
+    echo -n "  Testing connection to ${SMB_HOST} ..."
+    if ping -c 2 -W 2 "${SMB_HOST}" &>/dev/null; then
         echo ""
-        warn "Could not connect now — will auto-connect on reboot."
+        ok "Host ${SMB_HOST} reachable"
+        echo -n "  Authenticating with share //${SMB_HOST}/${SMB_SHARE} ..."
+        if smbclient "//${SMB_HOST}/${SMB_SHARE}" \
+               -U "${SMB_USERNAME}%${SMB_PASSWORD}" -c "ls" &>/dev/null 2>&1; then
+            echo ""; ok "SMB share authenticated — PDF push is ready"
+        else
+            echo ""; warn "Auth failed — verify credentials and share name after reboot."
+        fi
+    else
+        echo ""; warn "${SMB_HOST} not reachable now — will retry at runtime."
     fi
 }
 
 # ── 7. Network-online guarantee ───────────────────────────────────────────────
 setup_network_online() {
-    step "Enabling NetworkManager-wait-online (60 s timeout) ..."
+    step "NetworkManager-wait-online ..."
     mkdir -p /etc/systemd/system/NetworkManager-wait-online.service.d/
     cat > /etc/systemd/system/NetworkManager-wait-online.service.d/timeout.conf << 'EOF'
 [Service]
@@ -306,14 +297,13 @@ ExecStart=
 ExecStart=/usr/lib/NetworkManager/nm-online -s -q --timeout=60
 EOF
     systemctl enable NetworkManager-wait-online.service 2>/dev/null || true
-    ok "Services will wait up to 60 s for a network connection after boot"
+    ok "Services will wait up to 60 s for network on each boot"
 }
 
-# ── 8 & 9. systemd services ───────────────────────────────────────────────────
+# ── 8. systemd services ───────────────────────────────────────────────────────
 install_services() {
-    step "Installing systemd services ..."
+    step "systemd services ..."
 
-    # plc_watcher — SCHED_FIFO:50, IOClass=realtime, pinned to CPU core 3
     cat > /etc/systemd/system/plc_watcher.service << EOF
 [Unit]
 Description=PLC Check-Weigher Start Watcher
@@ -342,7 +332,6 @@ WantedBy=multi-user.target
 EOF
     ok "plc_watcher.service  (SCHED_FIFO:50 · IOClass=realtime · CPU core 3)"
 
-    # plc_web — elevated but not real-time
     cat > /etc/systemd/system/plc_web.service << EOF
 [Unit]
 Description=PLC Check-Weigher Report Viewer
@@ -369,38 +358,88 @@ EOF
 
     systemctl daemon-reload
     systemctl enable plc_watcher.service plc_web.service
-    ok "Both services enabled — will start automatically after reboot"
+    ok "Both services enabled — start automatically after reboot"
 
-    # Mirror updated service file back into the repo
     cp /etc/systemd/system/plc_watcher.service "${INSTALL_DIR}/plc_watcher.service"
     chown "${PI_USER}:${PI_USER}" "${INSTALL_DIR}/plc_watcher.service"
 }
 
+# ── 9. RT kernel — installed LAST so only one reboot is needed ────────────────
+install_rt_kernel() {
+    step "PREEMPT_RT kernel  (final step before reboot) ..."
+
+    if grep -q "PREEMPT_RT" /proc/version 2>/dev/null; then
+        ok "Already running PREEMPT_RT — skipping kernel install"
+        return
+    fi
+
+    # Backup stock kernel
+    if [[ ! -f "${BOOT_FW}/kernel8-stock.img" ]]; then
+        cp "${BOOT_FW}/kernel8.img" "${BOOT_FW}/kernel8-stock.img"
+        ok "Stock kernel backed up  →  kernel8-stock.img"
+    fi
+
+    CHKSUM_BEFORE="$(md5sum "${BOOT_FW}/kernel8.img" | cut -d' ' -f1)"
+    DEBIAN_FRONTEND=noninteractive apt-get install -y -qq "${RT_PKG}" "${RT_HDR}"
+    CHKSUM_AFTER="$(md5sum "${BOOT_FW}/kernel8.img" | cut -d' ' -f1)"
+
+    if [[ "${CHKSUM_BEFORE}" != "${CHKSUM_AFTER}" ]]; then
+        cp "${BOOT_FW}/kernel8.img"       "${BOOT_FW}/kernel8-rt.img"
+        cp "${BOOT_FW}/kernel8-stock.img" "${BOOT_FW}/kernel8.img"
+        ok "RT kernel  →  kernel8-rt.img  |  stock restored as boot default"
+    else
+        RT_VMLINUZ="$(ls /boot/vmlinuz-*rt-arm64 2>/dev/null | sort -V | tail -1)"
+        [[ -n "${RT_VMLINUZ}" ]] || die "RT vmlinuz not found in /boot/"
+        if file "${RT_VMLINUZ}" | grep -q gzip; then
+            zcat "${RT_VMLINUZ}" > "${BOOT_FW}/kernel8-rt.img"
+        else
+            cp "${RT_VMLINUZ}" "${BOOT_FW}/kernel8-rt.img"
+        fi
+        ok "RT kernel manually copied  →  kernel8-rt.img"
+    fi
+
+    RT_INITRD="$(ls /boot/initrd.img-*rt-arm64 2>/dev/null | sort -V | tail -1 || true)"
+    [[ -n "${RT_INITRD}" ]] && cp "${RT_INITRD}" "${BOOT_FW}/initramfs8-rt" \
+        && ok "RT initramfs  →  initramfs8-rt"
+
+    # Activate in config.txt (idempotent)
+    sed -i '/### PLC-RT-BLOCK-START ###/,/### PLC-RT-BLOCK-END ###/d' \
+        "${BOOT_FW}/config.txt"
+    cat >> "${BOOT_FW}/config.txt" << 'EOF'
+
+### PLC-RT-BLOCK-START ###
+# PREEMPT_RT kernel — installed by plc-checkweigher setup.sh
+# To revert to stock: comment the two lines below and reboot.
+kernel=kernel8-rt.img
+initramfs initramfs8-rt followkernel
+### PLC-RT-BLOCK-END ###
+EOF
+    ok "config.txt updated — RT kernel activates on reboot"
+}
+
 # ── Summary + countdown reboot ────────────────────────────────────────────────
 do_reboot() {
     echo ""
-    banner "All Done — Summary"
+    banner "Setup Complete"
     echo ""
-
-    printf "  %-30s %s\n"  "RT kernel ready:"     "kernel8-rt.img  (activates on reboot)"
-    printf "  %-30s %s\n"  "Stock kernel fallback:" "kernel8-stock.img"
-    printf "  %-30s %s\n"  "Repo:"                "${INSTALL_DIR}"
-    printf "  %-30s %s\n"  "Python venv:"         "${VENV_DIR}"
-    printf "  %-30s %s\n"  "Reports output:"      "${REPORTS_DIR}"
-    printf "  %-30s %s\n"  "Web dashboard (after reboot):" \
+    printf "  ${G}%-32s${NC} %s\n"  "Repo:"                "${INSTALL_DIR}"
+    printf "  ${G}%-32s${NC} %s\n"  "Python venv:"         "${VENV_DIR}"
+    printf "  ${G}%-32s${NC} %s\n"  "Reports output:"      "${REPORTS_DIR}"
+    printf "  ${G}%-32s${NC} %s\n"  "RT kernel:"           "kernel8-rt.img  (active after reboot)"
+    printf "  ${G}%-32s${NC} %s\n"  "Stock kernel fallback:" "kernel8-stock.img"
+    printf "  ${G}%-32s${NC} %s\n"  "Web dashboard (after reboot):" \
         "http://$(hostname -I | awk '{print $1}' 2>/dev/null || echo '<pi-ip>'):8080"
-
     echo ""
-    echo -e "  ${Y}After reboot, check services with:${NC}"
-    echo "    journalctl -u plc_watcher -f"
-    echo "    sudo chrt -p \$(systemctl show -p MainPID --value plc_watcher)"
+    echo -e "  ${Y}After reboot:${NC}"
+    echo "    journalctl -u plc_watcher -f                    # live logs"
+    echo "    sudo chrt -p \$(systemctl show -p MainPID --value plc_watcher)   # verify RT"
     echo ""
 
     echo -e "${G}"
     echo "  ╔══════════════════════════════════════════════════════╗"
-    echo "  ║  Rebooting in 10 seconds to apply all changes.      ║"
-    echo "  ║  Press Ctrl+C to cancel — reboot manually later:    ║"
-    echo "  ║    sudo reboot                                       ║"
+    echo "  ║  All done. Rebooting in 10 seconds to apply all     ║"
+    echo "  ║  changes including the RT kernel.                   ║"
+    echo "  ║  Press Ctrl+C to cancel — then: sudo reboot         ║"
     echo "  ╚══════════════════════════════════════════════════════╝"
     echo -e "${NC}"
 
@@ -415,15 +454,16 @@ do_reboot() {
 # ── Main ──────────────────────────────────────────────────────────────────────
 main() {
     preflight
-    install_system_packages
-    install_rt_kernel
-    setup_repo
-    setup_venv
-    setup_dirs
-    setup_wifi
-    setup_network_online
-    install_services
-    do_reboot
+    install_system_packages   # 1
+    setup_repo                # 2
+    setup_venv                # 3
+    setup_dirs                # 4
+    setup_wifi                # 5  — interactive WiFi picker
+    setup_smb                 # 6  — interactive SMB config → smb_config.py
+    setup_network_online      # 7
+    install_services          # 8
+    install_rt_kernel         # 9  — LAST, so only one reboot needed
+    do_reboot                 # 10 — single reboot applies everything
 }
 
 main "$@"