plc-checkweigher 1.22.0 → 1.24.0

package/bin/plc_checkweigher

@@ -1134,6 +1134,13 @@ update)
     echo ""
     need_sudo
 
+    # ── Update report log (pushed to SMB at the end) ──────────────────────────
+    ULOG_DIR="/home/pi/reports/logs"
+    mkdir -p "$ULOG_DIR" 2>/dev/null || true
+    ULOG="${ULOG_DIR}/update_$(date '+%Y%m%d_%H%M%S').log"
+    ulog() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*" >> "$ULOG"; }
+    ulog "=== Update started ==="
+
     # ── Warn if a batch is actively running ───────────────────────────────────
     _IS_RUNNING=0
     if [[ -f "/tmp/plc_live.json" ]]; then
@@ -1187,6 +1194,7 @@ update)
         exit 0
     fi
     spin_ok "Pulled  ${_PREV_SHORT} → ${_NEW_SHORT}"
+    ulog "GIT: pulled ${_PREV_SHORT} -> ${_NEW_SHORT}"
 
     # ── Show what changed ─────────────────────────────────────────────────────
     echo ""
@@ -1216,6 +1224,11 @@ update)
     else
         spin_warn "CLI install failed — still running previous version until next install"
     fi
+    # Also sync ~/.local/bin/ if a copy exists there (it takes PATH priority)
+    _LOCAL_CLI="/home/pi/.local/bin/plc_checkweigher"
+    if [[ -f "$_LOCAL_CLI" ]]; then
+        cp "${INSTALL_DIR}/bin/plc_checkweigher" "$_LOCAL_CLI" 2>/dev/null || true
+    fi
 
     # ── Update systemd unit files if they changed ─────────────────────────────
     _UNITS_UPDATED=0
@@ -1233,6 +1246,168 @@ update)
         spin_ok "systemd reloaded"
     fi
 
+    # ── Update Plymouth boot splash ───────────────────────────────────────────
+    _THEME_DIR="/usr/share/plymouth/themes/saismruth"
+    _LOGO_SRC="${INSTALL_DIR}/assets/logo.png"
+    _PLY_CHANGED=0
+
+    if [[ -f "$_LOGO_SRC" ]] && [[ -d "$_THEME_DIR" ]]; then
+        spin_start "Updating boot splash"
+        # Regenerate logo + pre-rendered text (idempotent)
+        "${PYTHON}" - << 'PYEOF' 2>/dev/null && _PLY_CHANGED=1 || true
+from PIL import Image, ImageDraw, ImageFont
+import os, hashlib
+
+THEME = "/usr/share/plymouth/themes/saismruth"
+LOGO  = os.path.join(os.path.dirname(os.path.abspath(
+            "/home/pi/plc_checkweigher/assets/logo.png")), "..", "assets", "logo.png")
+LOGO  = "/home/pi/plc_checkweigher/assets/logo.png"
+TEXT  = "Sai Samarth Engineering"
+
+changed = False
+
+# Logo 400x400
+img = Image.open(LOGO).convert("RGBA").resize((400, 400), Image.LANCZOS)
+logo_dst = os.path.join(THEME, "logo.png")
+import io; buf = io.BytesIO(); img.save(buf, "PNG"); new_bytes = buf.getvalue()
+old_bytes = open(logo_dst, "rb").read() if os.path.exists(logo_dst) else b""
+if new_bytes != old_bytes:
+    open(logo_dst, "wb").write(new_bytes); changed = True
+
+# Pre-rendered text
+FONTS = ["/usr/share/fonts/truetype/freefont/FreeSansBold.ttf",
+         "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf"]
+font = next((ImageFont.truetype(f, 30) for f in FONTS if os.path.exists(f)), ImageFont.load_default())
+bbox = font.getbbox(TEXT); pad = 10
+tw, th = bbox[2]-bbox[0], bbox[3]-bbox[1]
+canvas = Image.new("RGBA", (tw+pad*2, th+pad*2), (0,0,0,0))
+ImageDraw.Draw(canvas).text((pad-bbox[0], pad-bbox[1]), TEXT, fill=(255,255,255,255), font=font)
+text_dst = os.path.join(THEME, "text.png")
+buf2 = io.BytesIO(); canvas.save(buf2, "PNG"); new2 = buf2.getvalue()
+old2 = open(text_dst, "rb").read() if os.path.exists(text_dst) else b""
+if new2 != old2:
+    open(text_dst, "wb").write(new2); changed = True
+
+import sys; sys.exit(0 if changed else 99)
+PYEOF
+        _PLY_PY_EXIT=$?
+        [[ $_PLY_PY_EXIT -eq 99 ]] && _PLY_CHANGED=0  # exit 99 = no change
+
+        # Patch boot cmdline once (idempotent)
+        _CMDLINE="/boot/firmware/cmdline.txt"
+        if [[ -f "$_CMDLINE" ]]; then
+            if ! grep -q "logo.nologo" "$_CMDLINE"; then
+                sudo sed -i 's/$/ logo.nologo/' "$_CMDLINE" 2>/dev/null && _PLY_CHANGED=1
+            fi
+            if grep -q "loglevel=3" "$_CMDLINE"; then
+                sudo sed -i 's/loglevel=3/loglevel=1/' "$_CMDLINE" 2>/dev/null && _PLY_CHANGED=1
+            fi
+        fi
+        if ! grep -q "^disable_splash=1" /boot/firmware/config.txt 2>/dev/null; then
+            echo "disable_splash=1" | sudo tee -a /boot/firmware/config.txt >/dev/null && _PLY_CHANGED=1
+        fi
+
+        if [[ $_PLY_CHANGED -eq 1 ]]; then
+            spin_ok "Boot splash updated — rebuilding initramfs (~30 s)"
+            # Rebuild for the RUNNING kernel (plain -u may pick a different one)
+            _KVER="$(uname -r)"
+            sudo update-initramfs -u -k "${_KVER}" > /tmp/update_initramfs.log 2>&1 \
+                && ok "initramfs rebuilt for ${_KVER}" \
+                || warn "initramfs warnings — see /tmp/update_initramfs.log"
+            # Sync to the firmware partition — this is what actually boots
+            if [[ -f "/boot/initrd.img-${_KVER}" ]] \
+               && grep -q "initramfs initramfs8-rt" /boot/firmware/config.txt 2>/dev/null; then
+                sudo cp "/boot/initrd.img-${_KVER}" /boot/firmware/initramfs8-rt \
+                    && ok "initramfs8-rt synced — reboot to apply splash" \
+                    || warn "Could not sync initramfs8-rt"
+            fi
+            ulog "SPLASH: regenerated, initramfs rebuilt + synced (${_KVER})"
+        else
+            spin_ok "Boot splash already up to date"
+            ulog "SPLASH: up to date"
+        fi
+    fi
+
+    # ── Verify crucial system configuration ───────────────────────────────────
+    echo ""
+    echo -e "  ${B}▸ System Configuration Check${NC}"; hr; echo ""
+
+    # 1. RT kernel active in config.txt
+    spin_start "RT kernel boot config"
+    if grep -q "^kernel=kernel8-rt.img" /boot/firmware/config.txt 2>/dev/null \
+       && grep -q "^initramfs initramfs8-rt" /boot/firmware/config.txt 2>/dev/null; then
+        spin_ok "RT kernel + initramfs configured"
+        ulog "CONFIG: RT kernel boot entries OK"
+    else
+        spin_warn "RT kernel boot entries missing in config.txt!"
+        ulog "WARN: RT kernel boot entries missing"
+    fi
+
+    # 2. RT initramfs freshness — resync if the source initrd is newer
+    spin_start "RT initramfs freshness"
+    _RT_KVER="$(uname -r)"
+    _SRC_INITRD="/boot/initrd.img-${_RT_KVER}"
+    _FW_INITRD="/boot/firmware/initramfs8-rt"
+    if [[ -f "$_SRC_INITRD" && -f "$_FW_INITRD" ]] \
+       && [[ "$_SRC_INITRD" -nt "$_FW_INITRD" ]]; then
+        sudo cp "$_SRC_INITRD" "$_FW_INITRD" \
+            && spin_ok "initramfs8-rt was stale — resynced" \
+            || spin_warn "initramfs8-rt resync failed"
+        ulog "FIXED: stale initramfs8-rt resynced"
+    else
+        spin_ok "initramfs8-rt up to date"
+        ulog "CONFIG: initramfs8-rt fresh"
+    fi
+
+    # 3. Boot cmdline parameters
+    spin_start "Boot cmdline (quiet splash)"
+    _CMD_MISSING=""
+    for _param in "quiet" "splash" "logo.nologo" "systemd.show_status=0" \
+                  "plymouth.ignore-serial-consoles"; do
+        grep -q "$_param" /boot/firmware/cmdline.txt 2>/dev/null \
+            || _CMD_MISSING="${_CMD_MISSING} ${_param}"
+    done
+    if [[ -n "$_CMD_MISSING" ]]; then
+        for _param in $_CMD_MISSING; do
+            sudo sed -i "s/\$/ ${_param}/" /boot/firmware/cmdline.txt
+        done
+        spin_ok "Restored missing cmdline params:${_CMD_MISSING}"
+        ulog "FIXED: cmdline params restored:${_CMD_MISSING}"
+    else
+        spin_ok "All boot cmdline params present"
+        ulog "CONFIG: cmdline OK"
+    fi
+
+    # 4. Plymouth theme still set
+    spin_start "Plymouth theme"
+    _CUR_THEME=$(sudo plymouth-set-default-theme 2>/dev/null || echo "")
+    if [[ "$_CUR_THEME" != "saismruth" ]]; then
+        sudo plymouth-set-default-theme saismruth 2>/dev/null \
+            && spin_ok "Theme was '${_CUR_THEME:-none}' — reset to saismruth" \
+            || spin_warn "Could not set theme"
+        ulog "FIXED: plymouth theme reset (was: ${_CUR_THEME:-none})"
+    else
+        spin_ok "saismruth active"
+        ulog "CONFIG: plymouth theme OK"
+    fi
+
+    # 5. Non-essential services stay disabled (upgrades can re-enable them)
+    spin_start "Non-essential services"
+    _RE_DISABLED=""
+    for _svc in bluetooth avahi-daemon cups apt-daily.timer apt-daily-upgrade.timer man-db.timer; do
+        if systemctl is-enabled "$_svc" &>/dev/null; then
+            sudo systemctl disable --now "$_svc" &>/dev/null \
+                && _RE_DISABLED="${_RE_DISABLED} ${_svc}"
+        fi
+    done
+    if [[ -n "$_RE_DISABLED" ]]; then
+        spin_ok "Re-disabled:${_RE_DISABLED}"
+        ulog "FIXED: re-disabled services:${_RE_DISABLED}"
+    else
+        spin_ok "All non-essential services off"
+        ulog "CONFIG: services OK"
+    fi
+
     # ── Restart services ──────────────────────────────────────────────────────
     spin_start "Restarting services"
     sudo systemctl restart plc_watcher plc_web 2>/dev/null
@@ -1249,6 +1424,30 @@ update)
                                || echo -e "  ${R}✗${NC}  plc_web      ${_UWb}"
     echo ""
     ok "Update complete  (${_PREV_SHORT} → ${_NEW_SHORT})"
+    [[ $_PLY_CHANGED -eq 1 ]] && warn "Reboot required for boot splash changes to take effect."
+    ulog "SERVICES: plc_watcher=${_UW} plc_web=${_UWb}"
+    ulog "=== Update complete: ${_PREV_SHORT} -> ${_NEW_SHORT} ==="
+    info "Report: ${ULOG}"
+
+    # ── Push update report to SMB share ───────────────────────────────────────
+    _SMB_HOST=$(smb_get "SMB_HOST")
+    _SMB_SHARE=$(smb_get "SMB_SHARE")
+    _SMB_USER=$(smb_get "SMB_USERNAME")
+    _SMB_PASS=$(smb_get "SMB_PASSWORD")
+    _SMB_EN=$(grep "^SMB_ENABLED" "${SMB_CFG}" 2>/dev/null | grep -qi "true" && echo "1" || echo "0")
+
+    if [[ "$_SMB_EN" == "1" && -n "$_SMB_HOST" && -n "$_SMB_USER" ]] \
+       && command -v smbclient &>/dev/null; then
+        spin_start "Pushing update report to SMB share"
+        _ULOG_BASE="$(basename "$ULOG")"
+        if smbclient "//${_SMB_HOST}/${_SMB_SHARE}" \
+               -U "${_SMB_USER}%${_SMB_PASS}" \
+               -c "mkdir logs; put ${ULOG} logs/${_ULOG_BASE}" &>/dev/null 2>&1; then
+            spin_ok "Report pushed → //${_SMB_HOST}/${_SMB_SHARE}/logs/${_ULOG_BASE}"
+        else
+            spin_warn "SMB push failed — report saved locally at ${ULOG}"
+        fi
+    fi
     echo ""
     ;;
 
@@ -1468,7 +1667,7 @@ uninstall)
     echo "  ╔══════════════════════════════════════════════════════════╗"
     echo "  ║  Uninstall complete.                                     ║"
     echo "  ║                                                          ║"
-    echo "  ║  A reboot is needed to apply kernel revert.             ║"
+    echo "  ║  A reboot is needed to apply kernel revert.              ║"
     echo "  ╚══════════════════════════════════════════════════════════╝"
     echo -e "${NC}"
     [[ "${KEEP_REPORTS^^}" == "Y" ]] && info "PDFs still at: ${REPORTS_DIR}  (remove manually if needed)"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "plc-checkweigher",
-  "version": "1.22.0",
+  "version": "1.24.0",
   "description": "One-command installer for the PLC Check-Weigher system on Raspberry Pi (PREEMPT_RT kernel, Python stack, WiFi, SMB, systemd RT services)",
   "scripts": {
     "postinstall": "node bin/cli.js"

package/setup.sh

@@ -16,7 +16,7 @@
 #    7.  SMB       — enter host IP, share name, credentials  → smb_config.py
 #    8.  NetworkManager-wait-online
 #    9.  systemd services (plc_watcher + plc_web)
-#   10.  Boot logo — Plymouth theme with logo.png + "SAI SAMARTH ENGG"
+#   10.  Boot logo — Plymouth theme with logo.png + "Sai Samarth Engineering"
 #   11.  Display   — LightDM priority, CPU isolation, utmpx
 #  11b.  VS Code   — priority daemon: cores 0-2, Nice=-5
 #   12.  PREEMPT_RT kernel  ← installed last so only one reboot is needed
@@ -97,8 +97,11 @@ preflight() {
 
 # ── 1. System packages ────────────────────────────────────────────────────────
 install_system_packages() {
-    step "System packages ..."
+    step "System update + packages ..."
     DEBIAN_FRONTEND=noninteractive apt-get update -qq
+    echo "  Upgrading all packages to latest (this can take several minutes) ..."
+    DEBIAN_FRONTEND=noninteractive apt-get full-upgrade -y -qq
+    ok "System fully upgraded"
     DEBIAN_FRONTEND=noninteractive apt-get install -y -qq \
         git python3-venv python3-pip python3-dev \
         samba-client cifs-utils network-manager curl build-essential
@@ -158,6 +161,8 @@ install_cli() {
     if [[ -f "${CLI_SRC}" ]]; then
         chmod +x "${CLI_SRC}"
         cp "${CLI_SRC}" "${CLI_DEST}"
+        # Remove stale ~/.local/bin/ copy — it takes PATH priority and can shadow updates
+        rm -f "/home/pi/.local/bin/plc_checkweigher" 2>/dev/null || true
         ok "plc_checkweigher  →  ${CLI_DEST}"
         ok "Run: plc_checkweigher status   (full system diagnostic)"
     else
@@ -407,16 +412,45 @@ setup_boot_logo() {
     THEME_DIR="/usr/share/plymouth/themes/saismruth"
     mkdir -p "${THEME_DIR}"
 
-    # ── Logo: resize assets/logo.png to 256×256 and copy into theme ──────────
+    # ── Logo (400×400) + pre-rendered text PNG ───────────────────────────────
     LOGO_SRC="${INSTALL_DIR}/assets/logo.png"
     if [[ -f "${LOGO_SRC}" ]]; then
         "${VENV_DIR}/bin/python3" - << PYEOF
-from PIL import Image
+from PIL import Image, ImageDraw, ImageFont
+import os, sys
+
+THEME   = "${THEME_DIR}"
+TEXT    = "Sai Samarth Engineering"
+
+# Logo — 400×400 (more visible on HD display)
 img = Image.open("${LOGO_SRC}").convert("RGBA")
-img.thumbnail((256, 256), Image.LANCZOS)
-img.save("${THEME_DIR}/logo.png", "PNG")
+img = img.resize((400, 400), Image.LANCZOS)
+img.save(os.path.join(THEME, "logo.png"), "PNG")
+
+# Pre-rendered company name (white on transparent) — avoids font issues in initramfs
+FONT_PATHS = [
+    "/usr/share/fonts/truetype/freefont/FreeSansBold.ttf",
+    "/usr/share/fonts/truetype/dejavu/DejaVuSans-Bold.ttf",
+    "/usr/share/fonts/truetype/liberation/LiberationSans-Bold.ttf",
+]
+font = None
+for fp in FONT_PATHS:
+    if os.path.exists(fp):
+        font = ImageFont.truetype(fp, 30)
+        break
+if font is None:
+    font = ImageFont.load_default()
+
+bbox = font.getbbox(TEXT)
+tw, th = bbox[2] - bbox[0], bbox[3] - bbox[1]
+pad = 10
+canvas = Image.new("RGBA", (tw + pad * 2, th + pad * 2), (0, 0, 0, 0))
+ImageDraw.Draw(canvas).text((pad - bbox[0], pad - bbox[1]), TEXT,
+                             fill=(255, 255, 255, 255), font=font)
+canvas.save(os.path.join(THEME, "text.png"), "PNG")
+print("  logo 400x400, text", canvas.size)
 PYEOF
-        ok "Logo installed (256×256)  →  ${THEME_DIR}/logo.png"
+        ok "Logo + text images installed  →  ${THEME_DIR}/"
     else
         warn "assets/logo.png not found — splash will show text only"
     fi
@@ -424,8 +458,8 @@ PYEOF
     # ── Theme config file ─────────────────────────────────────────────────────
     cat > "${THEME_DIR}/saismruth.plymouth" << 'EOF'
 [Plymouth Theme]
-Name=SAI SAMARTH ENGG
-Description=PLC Check-Weigher Boot Screen — SAI SAMARTH ENGG
+Name=Sai Samarth Engineering
+Description=PLC Check-Weigher Boot Screen — Sai Samarth Engineering
 ModuleName=script
 
 [script]
@@ -433,30 +467,30 @@ ImageDir=/usr/share/plymouth/themes/saismruth
 ScriptFile=/usr/share/plymouth/themes/saismruth/saismruth.script
 EOF
 
-    # ── Plymouth script: logo centred, text below ─────────────────────────────
+    # ── Plymouth script: logo + pre-rendered text, both centred ──────────────
     cat > "${THEME_DIR}/saismruth.script" << 'EOF'
-# ── SAI SAMARTH ENGG — Boot Splash ────────────────────────────────────────────
+# Sai Samarth Engineering — Boot Splash
 Window.SetBackgroundTopColor(0.0, 0.0, 0.0);
 Window.SetBackgroundBottomColor(0.0, 0.0, 0.0);
 
 screen_w = Window.GetWidth();
 screen_h = Window.GetHeight();
 
-# ── Logo (centred, slightly above middle to leave room for text) ──────────────
+# Logo — centred, slightly above middle
 logo_img = Image("logo.png");
 logo_w   = logo_img.GetWidth();
 logo_h   = logo_img.GetHeight();
 logo_x   = (screen_w - logo_w) / 2;
-logo_y   = (screen_h - logo_h) / 2 - 40;
+logo_y   = (screen_h - logo_h) / 2 - 50;
 
 logo_sprite = Sprite(logo_img);
 logo_sprite.SetPosition(logo_x, logo_y, 0);
 
-# ── Company name centred below logo ───────────────────────────────────────────
-text_img = Image.Text("SAI SAMARTH ENGG", 1.0, 1.0, 1.0, 1.0, "Sans Bold 20");
+# Company name — pre-rendered PNG, centred below logo
+text_img = Image("text.png");
 text_w   = text_img.GetWidth();
 text_x   = (screen_w - text_w) / 2;
-text_y   = logo_y + logo_h + 22;
+text_y   = logo_y + logo_h + 24;
 
 text_sprite = Sprite(text_img);
 text_sprite.SetPosition(text_x, text_y, 1);
@@ -466,6 +500,26 @@ EOF
     plymouth-set-default-theme saismruth
     ok "Plymouth theme set  →  saismruth"
 
+    # ── Suppress all other boot visuals ──────────────────────────────────────
+    # Hide Pi firmware rainbow square
+    grep -q "^disable_splash=1" /boot/firmware/config.txt \
+        || echo "disable_splash=1" >> /boot/firmware/config.txt
+
+    # Hide kernel Tux logo + reduce loglevel so only our splash is visible
+    if ! grep -q "logo.nologo" /boot/firmware/cmdline.txt; then
+        sed -i 's/$/ logo.nologo/' /boot/firmware/cmdline.txt
+    fi
+    sed -i 's/loglevel=3/loglevel=1/' /boot/firmware/cmdline.txt 2>/dev/null || true
+    # Silence systemd service status lines + udev on the console.
+    # plymouth.ignore-serial-consoles is CRITICAL: with console=serial0 in
+    # cmdline, Plymouth falls back to text mode and no splash renders at all.
+    for _param in "systemd.show_status=0" "rd.systemd.show_status=0" \
+                  "udev.log_level=3" "plymouth.ignore-serial-consoles"; do
+        grep -q "$_param" /boot/firmware/cmdline.txt \
+            || sed -i "s/\$/ ${_param}/" /boot/firmware/cmdline.txt
+    done
+    ok "Boot cmdline patched  (logo.nologo, loglevel=1, silent systemd, disable_splash=1)"
+
     # Rebuild current initramfs so Plymouth is included.
     # The RT kernel's post-install will create its own initramfs with Plymouth
     # already installed, so initramfs8-rt will also carry the theme.
@@ -642,6 +696,43 @@ lock_source_files() {
 }
 
 # ── 12. RT kernel — installed LAST so only one reboot is needed ───────────────
+# ── 11d. System optimization — disable everything not needed by the tool ─────
+setup_system_optimize() {
+    step "System optimization  (disable non-essential services) ..."
+
+    # Services NOT used by: PLC stack, web UI, WiFi, SSH, SMB push (client-only),
+    # LightDM kiosk, VS Code, or Raspberry Pi Connect.
+    # KEEP: NetworkManager, ssh, lightdm, rpi-connect, systemd-timesyncd,
+    #       fstrim.timer (SD card health), e2scrub (fs health).
+    local _DISABLE=(
+        bluetooth              # no BT devices used
+        hciuart                # BT UART helper
+        ModemManager           # no cellular modem
+        triggerhappy           # hotkey daemon
+        avahi-daemon           # mDNS discovery — tool uses direct IPs
+        cups                   # no printing
+        cups-browsed
+        apt-daily.timer        # no background auto-update (manual: tool update)
+        apt-daily-upgrade.timer
+        man-db.timer           # man page reindexing
+        packagekit             # GUI package manager backend
+    )
+    for _svc in "${_DISABLE[@]}"; do
+        if systemctl list-unit-files "${_svc}"* 2>/dev/null | grep -q "${_svc}"; then
+            systemctl disable --now "${_svc}" &>/dev/null \
+                && ok "disabled  ${_svc}" \
+                || true
+        fi
+    done
+
+    # Power off the Bluetooth radio entirely at boot
+    grep -q "^dtoverlay=disable-bt" "${BOOT_FW}/config.txt" \
+        || echo "dtoverlay=disable-bt" >> "${BOOT_FW}/config.txt"
+    ok "Bluetooth radio disabled at boot  (dtoverlay=disable-bt)"
+
+    ok "System optimized — PLC stack, WiFi, SSH, Pi Connect untouched"
+}
+
 install_rt_kernel() {
     step "PREEMPT_RT kernel  (final step before reboot) ..."
 
@@ -746,10 +837,11 @@ main() {
     setup_smb                 # 7  — interactive SMB config → smb_config.py
     setup_network_online      # 8
     install_services          # 9
-    setup_boot_logo           # 10 — Plymouth: logo + "SAI SAMARTH ENGG"
+    setup_boot_logo           # 10 — Plymouth: logo + "Sai Samarth Engineering"
     setup_display             # 11 — LightDM priority, CPU isolation, utmpx
     setup_vscode_priority     # 11b — VS Code: cores 0-2, Nice=-5
     lock_source_files         # 11c — root:root on .py, pi:pi on data/
+    setup_system_optimize     # 11d — disable bluetooth/avahi/cups/apt-timers
     install_rt_kernel         # 12 — LAST, so only one reboot needed
     do_reboot                 # 12 — single reboot applies everything
 }