diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9f0f8460..cb3ce1f3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,11 +24,11 @@ jobs:
     env:
       UV_PYTHON_DOWNLOADS: never  # use the setup-python 3.11; don't fetch another interpreter
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0  # full history so diff-cover can diff the PR against origin/develop (#286)
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: "Install uv (pinned — reproducible, hash-locked installs, #283)"
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -70,7 +70,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Build the dashboard test stage (installs package + runs the suite in-container)
@@ -90,7 +90,7 @@ jobs:
       matrix:
         service: [monero, p2pool, tor, xmrig-proxy, dashboard]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: docker build ./build/${{ matrix.service }}
@@ -112,7 +112,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Install hadolint (pinned + sha256-verified, #286)"
@@ -131,10 +131,10 @@ jobs:
     env:
       UV_PYTHON_DOWNLOADS: never
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install uv (pinned)
@@ -152,7 +152,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0  # full history so the scan covers every commit, not just the tip
@@ -171,10 +171,10 @@ jobs:
     env:
       UV_PYTHON_DOWNLOADS: never
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install uv (pinned)
@@ -190,7 +190,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Install shellcheck + shfmt (pinned + sha256-verified, #286)"
@@ -227,7 +227,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Validate docker-compose.yml interpolation + hardening invariants (#90)
@@ -240,13 +240,13 @@ jobs:
     env:
       UV_PYTHON_DOWNLOADS: never
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
       - name: Install uv (pinned)
diff --git a/.github/workflows/integration-mini-stack.yml b/.github/workflows/integration-mini-stack.yml
index c2601129..39f6a946 100644
--- a/.github/workflows/integration-mini-stack.yml
+++ b/.github/workflows/integration-mini-stack.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       # ubuntu-latest ships Docker with the Compose v2 plugin — no setup needed.
diff --git a/.github/workflows/lychee.yml b/.github/workflows/lychee.yml
index 3c37a27e..5df24b4b 100644
--- a/.github/workflows/lychee.yml
+++ b/.github/workflows/lychee.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Check links in Markdown
diff --git a/.github/workflows/release-gate.yml b/.github/workflows/release-gate.yml
index ae25de27..6bedc29c 100644
--- a/.github/workflows/release-gate.yml
+++ b/.github/workflows/release-gate.yml
@@ -49,7 +49,7 @@ jobs:
     # box; prefer an ephemeral / just-in-time runner in its own runner group.
     runs-on: [self-hosted, pithead-release]
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 24822d32..6fc0b966 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -9,6 +9,95 @@ Pithead ships as **one product, one version** — the version lives in the top-l
 [`VERSION`](VERSION) file and every released image is tagged with it. Releases are cut
 per the process in [`docs/dev/releasing.md`](docs/dev/releasing.md).
 
+## [Unreleased]
+
+## [1.11.0] - 2026-07-21
+
+### Added
+
+- **Confirm-gated config editing for operationally-disruptive settings** (#719). The dashboard
+  config editor can now commit a small set of disruptive-but-recoverable settings behind a
+  type-to-confirm, instead of refusing them outright: the four service data directories (a move
+  re-syncs), the stratum port (rigs must repoint), the Monero/Tari clearnet initial-sync toggles
+  (the host IP is exposed during IBD, then auto-reverts to Tor), and enabling Monero pruning. Each
+  renders editable with a "you'll type `APPLY` to confirm" affordance; the typed confirmation rides
+  to the host approval gate, which requires it before the change proceeds and records the apply in
+  the control audit log as a distinct `commit-confirmed` action.
+
+### Changed
+
+- **The control-channel security perimeter stays host-only** (#719). Type-to-confirm is UX
+  friction, not a security control — a compromised dashboard that can set a field can also fill the
+  confirm box — so the perimeter is unchanged: wallets and view keys, the dashboard login and onion
+  settings, the control channel itself, the Tor egress firewall, the stratum password, node
+  endpoints and credentials, and the per-rig hosts and tokens all remain refused from the dashboard,
+  as does the heavier direction of a confirm-gated key (disabling pruning forces a full re-sync).
+- **Dashboard-confirmed data-directory moves are allowlisted to the stack's data root** (#728).
+  #719 made the four `*_DATA_DIR` moves confirmable from the dashboard behind a typed `APPLY`, but
+  the destination was still checked only by the host-side blocklist (`assert_safe_dir`), which
+  passes any non-catastrophic absolute path. A confirmed move from the dashboard is now further
+  held to an allowlist: the new location must sit under the stack's own data root (the install
+  dir's `data/`) or a parent the stack already keeps data in, else the move is refused even with
+  the typed confirmation and stays host-CLI only. The host `./pithead apply` path keeps the wider
+  blocklist — a shell operator already has filesystem-wide reach; only the dashboard-reachable move
+  is tightened, closing the destination trust-escalation the confirm-gate opened.
+- **Opt-in local miner** (#593). A box that runs the stack 24/7 can mine with its spare CPU by
+  co-locating a RigForge worker on the stack host. `./pithead setup` now asks "Also mine on this
+  machine with its spare CPU?" (off by default; also the new `local_miner.enabled` config flag),
+  and setup/apply print the two values a RigForge install needs — the stack's own stratum URL
+  (loopback `127.0.0.1:3333`, or the configured `p2pool.stratum_bind`/`stratum_port`) and the
+  stratum secret already in `.env`. The co-located worker self-registers through the proxy like any
+  other rig. Pithead only declares the intent and hands off those values; RigForge owns all
+  host-level tuning (HugePages, GRUB, MSR, governor) and the miner service. See
+  [docs/workers.md](docs/workers.md#mine-on-the-stack-host-itself).
+- **Warm XvB donation state on a backup stack (#249).** On a two-host failover pair — same wallet,
+  workers listing both hosts in `pools[]` — the backup's XvB donation controller used to cold-start
+  when the fleet failed over to it: the closed-loop split restarted from the feedforward estimate
+  and re-ramped for hours, over- or under-shooting the credited tier until it reconverged. The
+  controller's commanded donation fraction is now persisted, so a plain restart resumes the warmed
+  split instead of re-seeding cold. A backup can also point `xvb.standby.source` at the primary
+  dashboard's new read-only `/api/xvb-standby` endpoint; it periodically pulls the primary's
+  controller state and holds it as standby (inspectable in `/api/state`), then adopts it the first
+  time it actually donates at failover — so the split resumes warm. One-way (backup pulls from
+  primary), inert unless configured, and never acted on while the primary is authoritative (an idle
+  backup has no workers, so its controller stays on P2Pool). The pull follows the dashboard's
+  privacy-safe egress rule: an `.onion` source, a public IP, or any hostname rides the bridge Tor
+  SOCKS (the primary sees a Tor exit, never the backup's IP); only a provably-private/loopback IP
+  literal dials direct as a LAN hop — so the pull never opens a clearnet path, and the Security
+  panel reports its route.
+- **Opt-in fail-closed miner hold on an unrecoverable dashboard health failure** (#490). New
+  `dashboard.fail_closed` toggle, default **off**. The dashboard is an observability layer, not the
+  mining datapath (`xmrig-proxy` → `p2pool` → `monerod` runs independently of it), so by default an
+  unhealthy condition only alerts (Telegram/Healthchecks/webhook) and shows a badge while mining
+  continues. Set it `true` and a genuinely unrecoverable failure — the SQLite database failing to
+  rebuild after its own auto-heal attempt (disk full, permissions), or the `dashboard` container
+  itself crash-looping past the #337 debounce — holds `p2pool` and `xmrig-proxy` using the same
+  #35 sync-gate stop/start mechanism, with a `Miner held (fail-closed)` badge. Unlike the sync
+  gate's one-way latch it re-checks every cycle and releases on its own once the condition clears.
+  A transient write blip, a slow query, or a single failed external fetch never trips it — those
+  still only alert. Gated by the #33 control-approval path like other `dashboard.*` toggles.
+- **`/api/state` exposure for three of the #196 telemetry-backbone series (Tier-1).** The backbone
+  PR (#600) added five persisted SQLite tables with capture, storage, and retention, but shipped
+  without surfacing them to the client. This slice exposes three — `blocks` (pool block-found
+  events), `disk_growth` (hourly monerod-DB-size + host-disk-usage samples), and `xvb_history`
+  (~5-min XvB-credited scalar samples) — as range-filtered arrays under those same keys, bounded
+  at the existing 700-point chart cap for the two higher-cadence series. `network_history` and
+  `worker_history` are a separate (Tier-2) slice, not touched here. No chart renders any of these
+  series yet — that's a further follow-up.
+
+### Security
+
+- **The out-of-band audit trail is now flood-capped per worker (#724).** The `rig-edit` audit
+  source (#530) reads a worker's reported change id off the unauthenticated LAN worker feed. The
+  #530 deterministic row id collapses *repeats* of one change id to a single row, but not *distinct*
+  ones — so a malicious or compromised device presenting as a worker could report a fresh random
+  change id every poll, writing a new permanent `audit_events` row each ~30s cycle and slowly
+  filling the dashboard database (the table has no pruning). New `rig-edit` rows are now capped per
+  worker per rolling hour; beyond the cap the extra rows are dropped behind a single `rate-limited`
+  marker row and a logged warning, so the flood stays visible instead of growing the table without
+  limit. A genuine occasional rig change still records normally, and the non-attacker-controllable
+  `host-edit` and mirrored `control.log` rows are unaffected.
+
 ## [1.10.2] - 2026-07-21
 
 ### Fixed
diff --git a/SECURITY.md b/SECURITY.md
index 206cf560..315e35a7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -65,14 +65,21 @@ The stack's defaults:
   API (over the stack's Tor SOCKS), refuses any mismatch or non-release tag, and limits attempts
   to one per 10 minutes — the container cannot choose an image, tag, or registry. Enabling the
   channel without a dashboard password is a validation error, on a published onion it additionally
-  requires Tor client authorization, and every mutation is audited host-side. Commits are default-denied against an explicit allowlist of
-  operational settings: a commit that changes any env key off that list — in every direction
-  (enabling, changing, or disabling) — is refused, as is anything the change preview flags
-  destructive. Wallets, dashboard auth and onion exposure, the control channel itself, the Tor
-  egress firewall, clearnet toggles, node endpoints, binds, and every credential are off the
-  list, and a key added in the future stays un-committable until deliberately listed. Those
-  edits must be applied from the host CLI; out-of-band approval is tracked in
-  [#338](https://github.com/p2pool-starter-stack/pithead/issues/338).
+  requires Tor client authorization, and every mutation is audited host-side. Commits are default-denied against an explicit allowlist. Low-risk
+  operational settings commit directly; a small set of operationally-disruptive ones — data-directory
+  moves, the stratum port, enabling clearnet initial sync, and enabling pruning — commit only behind
+  a typed confirmation in the dashboard, and only in that direction. A dashboard-confirmed
+  data-directory move is further held to an **allowlist** (#728): the new location must sit under the
+  stack's own data root (the install dir's `data/`) or a parent the stack already keeps data in;
+  a move to any other absolute path is refused even with the typed confirmation and stays host-CLI
+  only. The host CLI keeps its wider blocklist check — a shell operator already has filesystem-wide
+  reach. Everything else is refused in
+  every direction, as is anything the change preview flags destructive (including the heavy direction
+  of a confirm-gated key, e.g. disabling pruning, which forces a full re-sync). The security
+  perimeter — wallets and view keys, dashboard auth and onion exposure, the control channel itself,
+  the Tor egress firewall, node endpoints, binds, every credential, and the per-rig hosts and tokens —
+  is never dashboard-committable, with or without the typed confirmation. A key added in the
+  future stays un-committable until deliberately listed. Those edits must be applied from the host CLI.
 - Attack visibility (#349): Caddy writes a JSON access log for every dashboard vhost (LAN and
   onion), and the control channel's host-side audit log records who changed what (setting names
   only, never values). The dashboard surfaces both read-only — a burst of 401s is the
@@ -82,6 +89,18 @@ The stack's defaults:
   anonymous prober stored XSS against the operator. Both logs are size-bounded (Caddy's native
   rolling; a trim-before-append cap in the audit writer). Neither ever records a secret: Caddy
   redacts credential headers by default, and the audit writer logs key names only.
+- Out-of-band change detection (#530): the audit trail above only sees requests the dashboard
+  itself handled. Its poll loop separately watches for a `config.json` change with no matching
+  control-channel commit, and a worker control-API report for a change the dashboard never sent,
+  and appends both — `host-edit` / `rig-edit` — to the same trail, keys or worker names only. The
+  persisted trail (mirrored `control.log` rows plus these two out-of-band kinds) lives in the
+  dashboard's own database, not just the log tail, so the Security panel's hour/day/month grouping
+  covers more than `control.log`'s own trimmed window. The `rig-edit` source reads off the
+  unauthenticated worker feed, so it is rate-capped per worker (#724): a rig reporting distinct
+  change_ids on every poll can add at most a bounded number of rows per hour before the rest are
+  dropped behind a single `rate-limited` marker — one LAN device can't grow the database without
+  limit. The `host-edit` and mirrored `control.log` rows are not attacker-controllable and are not
+  capped.
 
 ### Telegram control commands (#338)
 
diff --git a/VERSION b/VERSION
index 5ad2491c..1cac385c 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.10.2
+1.11.0
diff --git a/build/dashboard/Dockerfile b/build/dashboard/Dockerfile
index feedab0b..0301345a 100644
--- a/build/dashboard/Dockerfile
+++ b/build/dashboard/Dockerfile
@@ -4,7 +4,7 @@
 # uv's own CVEs into image scans, #282). uv lives only in the build/test stages.
 # ==========================================================================
 # Pinned by digest (#135) so the python:3.11-slim tag can't be silently re-pointed.
-FROM python:3.11-slim@sha256:baf89808ec37adeaab83cec287adb4a2afa4a11c1d51e961c7ec737877e61af6 AS base
+FROM python:3.11-slim@sha256:db3ff2e1800a8581e2c48a27c3995339d47bdf046da21c7627accd3d51053a93 AS base
 
 # Run from a project venv on PATH (so entrypoint.sh's `python3` resolves to it); use the
 # digest-pinned base interpreter (never let uv download a different Python); compile bytecode and
diff --git a/build/dashboard/mining_dashboard/config/config.py b/build/dashboard/mining_dashboard/config/config.py
index 1408024b..aba598b8 100644
--- a/build/dashboard/mining_dashboard/config/config.py
+++ b/build/dashboard/mining_dashboard/config/config.py
@@ -429,6 +429,15 @@ def _nonneg(v):
     if c.strip()
 ]
 
+# Opt-in fail-closed miner hold on an UNRECOVERABLE health failure (#490), `dashboard.fail_closed`,
+# default false. The dashboard is an observability layer, not the mining datapath (xmrig-proxy ->
+# p2pool -> monerod is independent of it), so the default posture is alert-only: a cosmetic
+# dashboard fault must never idle the fleet. `true` reuses the #35 sync-gate's own mechanism
+# (stop/start SYNC_GATE_CONTAINERS) to hold the miner until the failure clears — see
+# DataService._apply_fail_closed_gate for what counts as "unrecoverable" (narrowly: DB recovery
+# itself failing, or the dashboard container crash-looping — never a transient blip).
+DASHBOARD_FAIL_CLOSED = os.environ.get("DASHBOARD_FAIL_CLOSED", "false").strip().lower() == "true"
+
 # Debounce: a node must be unreachable this long before it's declared DOWN, and reachable
 # this long before recovery — so a single transient timeout or a brief restart doesn't
 # kick every miner to their backups (and back) on a blip.
@@ -689,6 +698,21 @@ def _telegram_event_enabled(name, default=True):
 # Switching overhead (ms) to account for connection ramp-up time
 XVB_SWITCH_OVERHEAD_MS = 5000
 
+# --- XvB warm-standby, backup stack (#249, config.json: xvb.standby.source) ---
+# On a two-host failover pair (same wallet, workers list both in pools[]), the BACKUP points this at
+# the PRIMARY's dashboard so it can pull the primary's XvB controller state and hold it as standby —
+# so when workers fail over, the backup resumes the donation split warm instead of cold-ramping for
+# hours. Blank (the default) = off: an ordinary single stack never pulls. The value is the full URL
+# of the primary's read-only endpoint (e.g. https://<primary-onion>/api/xvb-standby, or a LAN
+# http://host:port/api/xvb-standby); an .onion source rides the bridge Tor SOCKS, a LAN source dials
+# direct — no new clearnet egress either way. It is a capability URL (it can carry the primary's
+# dashboard basic-auth as userinfo), so pithead renders it into the owner-only .env and masks it in
+# the control-channel config, exactly like the Healthchecks ping URL.
+XVB_STANDBY_SOURCE = os.environ.get("XVB_STANDBY_SOURCE", "").strip()
+# How often the backup re-pulls the primary's state (seconds). A code-level constant, not a knob:
+# the state moves slowly (the closed loop steps once per 10-min cycle), so a minute is ample.
+XVB_STANDBY_INTERVAL_S = 60
+
 # --- Data Retention Policies ---
 HISTORY_RETENTION_SEC = 30 * 24 * 3600  # 30 Days
 # How long an offline worker lingers in the live "Workers Alive" table before it falls off (#182).
diff --git a/build/dashboard/mining_dashboard/main.py b/build/dashboard/mining_dashboard/main.py
index 27fc0cb3..960f1061 100644
--- a/build/dashboard/mining_dashboard/main.py
+++ b/build/dashboard/mining_dashboard/main.py
@@ -15,6 +15,7 @@
 from mining_dashboard.service.data_service import DataService
 from mining_dashboard.service.storage_service import StateManager
 from mining_dashboard.service.telegram_commands import TelegramCommandBot
+from mining_dashboard.service.xvb_standby import XvbStandbyPuller
 from mining_dashboard.web.server import create_app
 
 logging.basicConfig(level=logging.INFO, format="%(asctime)s [%(levelname)s] %(message)s")
@@ -37,20 +38,29 @@ def build_app() -> web.Application:
     # On-demand Telegram command interface (#45). Reads the snapshot data_service already collects;
     # a no-op unless telegram.enabled + telegram.commands.enabled + bot_token + chat_id are set.
     telegram_bot = TelegramCommandBot(data_service)
+    # Backup-stack warm-standby puller (#249): pulls the primary's XvB controller state so a
+    # failover resumes warm. Inert unless xvb.standby.source is configured.
+    xvb_standby = XvbStandbyPuller(state_manager)
 
     async def start_background_tasks(app):
         """Initializes background services upon web application startup."""
         app["data_task"] = asyncio.create_task(data_service.run())
         app["algo_task"] = asyncio.create_task(algo_service.run())
         app["telegram_task"] = asyncio.create_task(telegram_bot.run())
+        app["xvb_standby_task"] = asyncio.create_task(xvb_standby.run())
 
     async def cleanup_background_tasks(app):
         """Stops background tasks and closes resources on shutdown."""
         app["data_task"].cancel()
         app["algo_task"].cancel()
         app["telegram_task"].cancel()
+        app["xvb_standby_task"].cancel()
         await asyncio.gather(
-            app["data_task"], app["algo_task"], app["telegram_task"], return_exceptions=True
+            app["data_task"],
+            app["algo_task"],
+            app["telegram_task"],
+            app["xvb_standby_task"],
+            return_exceptions=True,
         )
         if "state_manager" in app:
             app["state_manager"].close()
diff --git a/build/dashboard/mining_dashboard/service/alert_service.py b/build/dashboard/mining_dashboard/service/alert_service.py
index 9b100c5a..a40a68b1 100644
--- a/build/dashboard/mining_dashboard/service/alert_service.py
+++ b/build/dashboard/mining_dashboard/service/alert_service.py
@@ -765,6 +765,16 @@ async def process(self, **signals):
                 self._wallet_edges(signals.get("observed_wallet", ""))
             except Exception as exc:  # never let the tripwire break the data loop
                 logger.debug("Wallet baseline update failed (%s)", type(exc).__name__)
+            # Keep the container-health debounce state current even with every sink off (#490):
+            # `dashboard.fail_closed` reads `self.containers.is_confirmed_bad("dashboard")` off
+            # the same tracker this alerting path would otherwise be the only feeder for. No
+            # alert fires here — just the state update the alerting branch below does anyway.
+            containers = signals.get("containers")
+            if containers is not None:
+                try:
+                    self.containers.update(containers, now=signals.get("now"))
+                except Exception as exc:  # never let a tracker bug break the data loop
+                    logger.debug("Container-health update failed (%s)", type(exc).__name__)
             return []
         try:
             alerts = self.evaluate(**signals)
diff --git a/build/dashboard/mining_dashboard/service/algo_service.py b/build/dashboard/mining_dashboard/service/algo_service.py
index ab3ba7a2..6971b6e7 100644
--- a/build/dashboard/mining_dashboard/service/algo_service.py
+++ b/build/dashboard/mining_dashboard/service/algo_service.py
@@ -297,15 +297,53 @@ def _advance_controller(self, current_hr, target_hr, avg_1h, max_fraction):
         if current_hr <= 0:
             return
 
-        # Seed from the feedforward estimate so we converge from a sane point.
+        # Seed the closed-loop state on the first real cycle — warm if we can, cold otherwise.
         if self.donation_fraction is None:
-            self.donation_fraction = min(self._reference_hr(target_hr) / current_hr, max_fraction)
+            self.donation_fraction = self._seed_donation_fraction(
+                target_hr, current_hr, max_fraction
+            )
             return
 
         error = self._reference_hr(target_hr) - avg_1h
         self.donation_fraction += self.control_gain * error / current_hr
         self.donation_fraction = max(0.0, min(self.donation_fraction, max_fraction))
 
+    def _seed_donation_fraction(self, target_hr, current_hr, max_fraction):
+        """The starting donated fraction for the closed loop, warm when we can prove it (#249).
+
+        Precedence, highest first — each clamped to the VIP reserve (``max_fraction``):
+
+        1. **This host's own persisted commanded fraction.** Once the controller has steered and
+           persisted a non-zero fraction, a plain process restart resumes from it rather than
+           re-ramping cold. It also wins over standby: a stack that has been authoritative owns its
+           state, so a stale standby from a since-departed primary can't override it.
+        2. **Standby state pulled from the primary** (backup failover). The first time a backup
+           actually donates — its workers just failed over — it adopts the primary's last-known
+           commanded fraction so the split resumes warm instead of restarting from zero (the whole
+           point of #249). While idle the backup never steers, so its own persisted fraction stays
+           0.0 and this branch is what fires at handover.
+        3. **Feedforward estimate** (cold start). A fresh install with no history and no standby —
+           the original behaviour, converging from a sane point via the closed loop.
+        """
+        feedforward = min(self._reference_hr(target_hr) / current_hr, max_fraction)
+
+        own = (self.state_manager.get_xvb_stats() or {}).get("commanded_fraction", 0.0) or 0.0
+        if own > 0:
+            return min(own, max_fraction)
+
+        standby = self.state_manager.get_xvb_standby() or {}
+        standby_fraction = standby.get("commanded_fraction", 0.0) or 0.0
+        if standby_fraction > 0:
+            logger.info(
+                "Warm-resume: adopting primary's standby donation fraction %.3f on failover "
+                "(#249) instead of cold-seeding %.3f",
+                standby_fraction,
+                feedforward,
+            )
+            return min(standby_fraction, max_fraction)
+
+        return feedforward
+
     def _fraction_to_ms(self, fraction):
         """Convert a donated fraction of the cycle to a slice length (ms), adding
         the fixed switch/ramp-up overhead. Returns 0 for a non-positive fraction."""
@@ -447,10 +485,13 @@ async def run(self):
                 )
 
                 # Record the fraction of this cycle actually routed to XvB so the
-                # dashboard can show routed-vs-credited (the live credit factor).
+                # dashboard can show routed-vs-credited (the live credit factor), and persist
+                # the controller's own commanded fraction so a restart / backup failover resumes
+                # warm rather than re-seeding cold (#249).
                 await asyncio.to_thread(
                     self.state_manager.update_xvb_stats,
                     donation_fraction=self._routed_fraction(decision, xvb_duration),
+                    commanded_fraction=self.donation_fraction or 0.0,
                 )
 
                 if decision == "P2POOL":
diff --git a/build/dashboard/mining_dashboard/service/container_health.py b/build/dashboard/mining_dashboard/service/container_health.py
index deeca415..63a56f73 100644
--- a/build/dashboard/mining_dashboard/service/container_health.py
+++ b/build/dashboard/mining_dashboard/service/container_health.py
@@ -69,6 +69,17 @@ def __init__(
         #   ok_since        : when the current continuous-clean streak began
         self._containers = {}
 
+    def is_confirmed_bad(self, name):
+        """True only if `name`'s bad state was CONFIRMED by the debounce — a crash loop or a
+        continuous-unhealthy streak past ``unhealthy_after`` — i.e. it produced an alert edge
+        (``alerted``). A first-sighting silently-seeded baseline (already unhealthy/restarting at
+        the monitor's first look) is deliberately NOT confirmed: it skipped the debounce a KNOWN
+        container must pass, exactly as it skips the alert. `dashboard.fail_closed`'s miner hold
+        (#490) reads this rather than the raw level, so it holds the fleet only on a confirmed,
+        non-transient failure. Unknown/never-seen container reads as not bad."""
+        c = self._containers.get(name)
+        return bool(c and c["state"] == "bad" and c["alerted"])
+
     def update(self, states, now=None):
         """Feed this cycle's ``{name: state}`` snapshot; return the debounced edges."""
         now = self._clock() if now is None else now
diff --git a/build/dashboard/mining_dashboard/service/control_service.py b/build/dashboard/mining_dashboard/service/control_service.py
index 2b9e4147..9311be6f 100644
--- a/build/dashboard/mining_dashboard/service/control_service.py
+++ b/build/dashboard/mining_dashboard/service/control_service.py
@@ -38,6 +38,9 @@
     # A capability secret: pithead's describe_change already refuses to echo it, but read_config
     # was serving it in cleartext to the browser. Mask it too (#33 hardening).
     ("healthchecks", "ping_url"),
+    # The backup's primary-dashboard URL (#249) can carry the primary's dashboard basic-auth as
+    # userinfo — a capability secret, masked like the ping URL above.
+    ("xvb", "standby", "source"),
 ]
 SECRET_SENTINEL = {"__secret__": True}
 
@@ -105,6 +108,7 @@ def _deep_merge(base, override):
     "XVB_ENABLED": ("xvb.enabled",),
     "XVB_DONATION_LEVEL": ("xvb.donation_level",),
     "TARI_REQUIRED": ("dashboard.tari_required",),
+    "DASHBOARD_FAIL_CLOSED": ("dashboard.fail_closed",),
     "DASHBOARD_CHECK_UPDATES": ("dashboard.check_for_updates",),
     "DASHBOARD_TZ": ("dashboard.timezone",),
     "MONERO_MEM_LIMIT": ("monero.mem_limit",),
@@ -171,6 +175,48 @@ def _editable_paths():
     return sorted(paths)
 
 
+# Env-var -> config-path map for the CONFIRM-gated set (#719), mirroring pithead's
+# CONTROL_DASHBOARD_CONFIRM_KEYS the same way EDITABLE_ENV_KEY_PATHS mirrors the editable allowlist
+# (drift-guarded by test_confirm_keys_have_no_intra_repo_drift). These are operationally-disruptive
+# but NOT the security perimeter: the dashboard MAY commit them, but only behind a type-to-confirm.
+# Surfaced to the browser as ``_confirm_keys`` so the Configuration view renders them editable with
+# a "confirm to proceed" affordance instead of greying them out as host-only. The gate is still the
+# authority: describe_change decides per-DIRECTION whether a change is CONFIRM (a data-dir move, a
+# stratum-port repoint, a clearnet-sync ENABLE, a prune ENABLE) or stays a host-only DEST (prune
+# DISABLE, a TOR data-dir move), so a field here can still be refused at commit in its heavy
+# direction — the same edit-then-maybe-refuse tradeoff the issue accepts for MONERO_PRUNE.
+CONFIRM_ENV_KEY_PATHS = {
+    "MONERO_DATA_DIR": ("monero.data_dir",),
+    "TARI_DATA_DIR": ("tari.data_dir",),
+    "P2POOL_DATA_DIR": ("p2pool.data_dir",),
+    "DASHBOARD_DATA_DIR": ("dashboard.data_dir",),
+    "STRATUM_PORT": ("p2pool.stratum_port",),
+    "MONERO_CLEARNET_SYNC": ("monero.clearnet_initial_sync",),
+    "TARI_CLEARNET_SYNC": ("tari.clearnet_initial_sync",),
+    "MONERO_PRUNE": ("monero.prune",),
+}
+
+
+def _confirm_paths():
+    """Every config path the control gate will commit behind a type-to-confirm (#719)."""
+    return sorted({p for target in CONFIRM_ENV_KEY_PATHS.values() for p in target})
+
+
+def env_key_config_paths(env_key):
+    """The config-path prefixes a committed audit ``keys`` env-var name covers (#530).
+
+    The #33 audit log records a commit's WHAT-changed as env-var NAMES (control_approval_gate's
+    ``porcelain_keys``), while the out-of-band host-edit watcher diffs config.json PATHS — so
+    correlating "did a commit explain this changed key" needs this env->path bridge. Mirrors the
+    commit gate's own derivation: an allowlisted var maps through EDITABLE_ENV_KEY_PATHS, and the
+    synthetic ``DASHBOARD_ENERGY`` name (which the gate folds in for a dashboard.energy-only
+    commit, a config.json-only block that never renders to .env, #504) covers the whole energy
+    block by prefix. An unrecognised name maps to nothing, so it can never explain a diffed key."""
+    if env_key == "DASHBOARD_ENERGY":
+        return ("dashboard.energy",)
+    return EDITABLE_ENV_KEY_PATHS.get(env_key, ())
+
+
 def _load_core_keys():
     """The wizard's core-key shortlist (#502/#529), read from the SAME file ``./pithead setup``
     reads — the one shared artifact, not a second hand-maintained list. Degrades to an empty list
@@ -211,29 +257,38 @@ def read_config():
             _set(cfg, path, dict(SECRET_SENTINEL))
     cfg["_core_keys"] = _load_core_keys()
     cfg["_editable_keys"] = _editable_paths()
+    cfg["_confirm_keys"] = _confirm_paths()
     return cfg
 
 
-def submit(action, cfg=None, actor="", intent_id=None, version=None):
+def submit(action, cfg=None, actor="", intent_id=None, version=None, confirm=None):
     """Write one intent into the requests spool (atomic: temp + rename, so the runner never
     reads a half-written file). Returns the request id — always a UUID, because the id becomes
     a host-side filename and the runner rejects anything else. ``version`` rides only on the
     upgrade intent (#59): the version the operator confirmed, which the host re-verifies
-    against the GitHub release API — a proposal, never a target the container picks."""
+    against the GitHub release API — a proposal, never a target the container picks. ``confirm``
+    rides only on a commit intent (#719): the operator's typed confirmation for an in-scope
+    disruptive change, which the host gate requires before it lets a CONFIRM row proceed."""
     rid = str(uuid.UUID(intent_id)) if intent_id else str(uuid.uuid4())
     request = {"id": rid, "action": action, "actor": actor}
     if cfg is not None:
-        # read_config's own metadata injections (#529/#613) ride back with the editor's POST —
+        # read_config's own metadata injections (#529/#613/#719) ride back with the editor's POST —
         # both modes round-trip the fetched doc wholesale — and the host gate's closed-schema
         # check would refuse a commit carrying them (#679). Shed them at the one choke point
         # every config intent passes through; everything else unknown still fails closed host-side.
         # A non-dict cfg passes through untouched: the host runner already rejects it with its
         # own "config must be a JSON object" result, which the UI knows how to surface.
         if isinstance(cfg, dict):
-            cfg = {k: v for k, v in cfg.items() if k not in ("_core_keys", "_editable_keys")}
+            cfg = {
+                k: v
+                for k, v in cfg.items()
+                if k not in ("_core_keys", "_editable_keys", "_confirm_keys")
+            }
         request["config"] = cfg
     if version is not None:
         request["version"] = version
+    if confirm is not None:
+        request["confirm"] = confirm
     tmp = os.path.join(config.CONTROL_REQUESTS_DIR, f".{rid}.tmp")
     with open(tmp, "w") as f:
         json.dump(request, f)
diff --git a/build/dashboard/mining_dashboard/service/data_service.py b/build/dashboard/mining_dashboard/service/data_service.py
index 498a9c3d..b01270da 100644
--- a/build/dashboard/mining_dashboard/service/data_service.py
+++ b/build/dashboard/mining_dashboard/service/data_service.py
@@ -1,7 +1,10 @@
 import asyncio
+import json
 import logging
 import os
 import time
+import uuid
+from datetime import UTC, datetime
 
 from aiohttp import ClientSession
 
@@ -35,10 +38,12 @@
     get_load_average,
     get_memory_usage,
 )
+from mining_dashboard.config import config
 from mining_dashboard.config.config import (
     CHECK_FOR_UPDATES,
     CLEARNET_STATE_DIR,
     DASHBOARD_ENERGY,
+    DASHBOARD_FAIL_CLOSED,
     ENABLE_XVB,
     GITHUB_RELEASES_API,
     GITHUB_RIGFORGE_RELEASES_API,
@@ -67,8 +72,16 @@
     pplns_block_time,
     shares_in_pplns_window,
 )
+from mining_dashboard.service import audit_service
 from mining_dashboard.service.alert_service import AlertService
 from mining_dashboard.service.clearnet_sync import ClearnetSyncSupervisor
+from mining_dashboard.service.control_service import (
+    SECRET_PATHS,
+    SECRET_SENTINEL,
+    _get,
+    _set,
+    env_key_config_paths,
+)
 from mining_dashboard.service.degradation import DegradationMonitor
 from mining_dashboard.service.healthchecks import HealthchecksClient
 from mining_dashboard.service.metrics import build_metrics, share_reject_pct
@@ -117,6 +130,16 @@
 # like the capture cadences above.
 _XVB_WINNERS_SYNC_SEC = 1800
 
+# Per-worker flood cap on NEW rig-edit audit rows (#724). The enriched worker feed is
+# unauthenticated LAN input, so a rogue device presenting as a worker can report a fresh random
+# change_id every poll — each a distinct, permanent audit_events row (#530's deterministic id only
+# collapses REPEATS of one change_id, never distinct ones). At most _RIG_EDIT_CAP_PER_HOUR genuine
+# rig-edit rows per worker per rolling hour; beyond that, rows are dropped and a single
+# rate-limited marker is recorded + logged. A real fleet edits a rig a handful of times an hour at
+# most, so a legitimate cadence never trips it — only a flood does.
+_RIG_EDIT_CAP_PER_HOUR = 12
+_RIG_EDIT_WINDOW_SEC = 3600
+
 
 def _parse_proxy_list_worker(w):
     """Parse one xmrig-proxy 6.x positional row into a worker dict.
@@ -344,6 +367,79 @@ def _shares_to_record(last_known_total, current_total):
     return 0, last_known_total
 
 
+def _iso_now():
+    """UTC now, formatted to match the #33 audit writer's own ``ts`` (``control_audit`` in
+    ``pithead``) — same string shape both sources write, so the audit_events table sorts and
+    groups by hour/day/month with a plain string-prefix slice, no parsing needed at read time."""
+    return datetime.now(UTC).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _flatten_config_keys(cfg, out, prefix=""):
+    """Fill ``out`` with ``{dotted.path: leaf_value}`` for every leaf in nested dict ``cfg``. Only
+    ever used to compare/NAME keys (see ``_diff_config_keys``) — a leaf value is compared for
+    equality, never rendered; the source, ``config.HOST_CONFIG_PATH``, is already the host's
+    pre-masked copy (#440), so no secret is present to leak even here.
+
+    The masked secret sentinel (``control_service.SECRET_SENTINEL``, ``{"__secret__": True}``) is
+    treated as an opaque LEAF, not descended into — otherwise a secret being set/cleared would
+    name a synthetic ``...password.__secret__`` path instead of the real setting."""
+    if not isinstance(cfg, dict):
+        return
+    for k, v in cfg.items():
+        path = f"{prefix}.{k}" if prefix else k
+        if isinstance(v, dict) and v != SECRET_SENTINEL:
+            _flatten_config_keys(v, out, path)
+        else:
+            out[path] = v
+
+
+def _diff_config_keys(old, new):
+    """Dotted config-key paths added, removed, or changed between two config snapshots (#530),
+    sorted. Names only — the values feed only an equality check and are never returned, matching
+    the #33 audit contract (key names, never values)."""
+    old_flat, new_flat = {}, {}
+    _flatten_config_keys(old, old_flat)
+    _flatten_config_keys(new, new_flat)
+    changed = set(old_flat) ^ set(new_flat)  # added or removed entirely
+    changed |= {k for k in old_flat.keys() & new_flat.keys() if old_flat[k] != new_flat[k]}
+    return sorted(changed)
+
+
+def _parse_audit_ts(ts):
+    """Parse a #33 audit-log ``ts`` string (``%Y-%m-%dT%H:%M:%SZ``) to epoch seconds, or None for
+    anything else — a malformed/garbage ts (already length-capped and charset-stripped by
+    ``audit_service._clean``) must never crash the out-of-band watcher, just fail to "explain" a
+    change (the safe direction: an unparsable commit ts causes a spurious host-edit row, not a
+    swallowed one)."""
+    try:
+        return datetime.strptime(ts, "%Y-%m-%dT%H:%M:%SZ").replace(tzinfo=UTC).timestamp()
+    except (TypeError, ValueError):
+        return None
+
+
+def _read_host_config():
+    """The masked config.json (``config.HOST_CONFIG_PATH``, #440), or None if the mount isn't
+    ready / isn't valid JSON yet. A plain blocking function — ``_watch_host_config`` runs it via
+    ``asyncio.to_thread`` rather than opening the file directly in an ``async def``.
+
+    The mount is the host's PRE-MASKED copy already (docker-compose bind-mounts
+    ``control/masked/config.json``; the raw config.json never enters the container). We still
+    re-apply the SECRET_PATHS mask here — exactly the defense-in-depth pass ``control_service.
+    read_config`` runs — so a host-side masking regression can never leave a raw secret VALUE
+    resident in ``self._last_host_config`` across polls. The diff only ever compares/names keys,
+    but this keeps the one long-lived config dict secret-free regardless."""
+    try:
+        with open(config.HOST_CONFIG_PATH) as f:
+            cfg = json.load(f)
+    except (OSError, ValueError):
+        return None
+    for path in SECRET_PATHS:
+        found, value = _get(cfg, path)
+        if found and value:
+            _set(cfg, path, dict(SECRET_SENTINEL))
+    return cfg
+
+
 class WorkerLifecycle:
     """Dashboard-side per-worker connection tracking for the "Workers Alive" table (#169 / #182).
 
@@ -447,6 +543,27 @@ def __init__(self, state_manager, proxy_client, xvb_client):
         self._last_xvb_history_write = 0.0
         self._last_hourly_capture = 0.0
         self._last_worker_capture = 0.0
+        # Out-of-band audit watcher (#530): the last config.json snapshot this poll loop read
+        # (None until the first poll baselines it — never diff against nothing, same "re-baseline,
+        # never backfill" contract as every other watcher here) and the wall-clock of that read, so
+        # a later change can be checked against control.log entries that landed AFTER it.
+        self._last_host_config = None
+        self._last_host_check = 0.0
+        # (worker, change_id) pairs already recorded as a rig-edit this run, so a rig that keeps
+        # reporting the same terminal change_id in its /status mirror every poll is flagged ONCE,
+        # not on every ~30s cycle. In-memory only: the deterministic audit-row id below is what
+        # actually bounds the table across restarts (INSERT OR IGNORE); this just skips the
+        # redundant DB work in the steady state. Bounded by the count of distinct real rig edits.
+        self._flagged_rig_changes = set()
+        # Per-worker fixed-window flood cap on NEW rig-edit rows (#724): {worker: (window_start,
+        # count)}. Distinct change_ids clear #530's deterministic-id dedup, so a rogue rig can
+        # spam a permanent audit row every poll; this bounds them to _RIG_EDIT_CAP_PER_HOUR per
+        # worker per hour. In-memory like _flagged_rig_changes — a restart resets the window, which
+        # at worst grants one extra window's budget, still bounded per wall-hour.
+        # ponytail: a rogue device rotating the worker NAME each poll sidesteps a per-worker cap;
+        # that's the broader unauth-feed vector (#235), out of scope here — cap keyed on worker per
+        # the issue, so one rogue rig can't crowd genuine rig-edit history out.
+        self._rig_edit_window = {}
         # XvB raffle-winners mirror: wall-clock of the last successful winners-file read. Starts
         # at 0.0 so the first eligible poll reads it; NOT stamped on a failed fetch, so a failure
         # retries on the next 10th poll instead of waiting out the 30-min gate.
@@ -477,6 +594,7 @@ def __init__(self, state_manager, proxy_client, xvb_client):
             "workers_rejected": False,
             "miner_released": False,
             "miner_held": False,
+            "fail_closed_held": False,
             "timestamp": 0,
         }
 
@@ -545,6 +663,11 @@ def __init__(self, state_manager, proxy_client, xvb_client):
         self.miner_released = False
         self.miner_held = False
 
+        # Opt-in fail-closed miner hold on an UNRECOVERABLE health failure (#490), dashboard.
+        # fail_closed, default false — see `_apply_fail_closed_gate`. Transient like `miner_held`,
+        # not persisted: a restart re-derives it from the current health signals.
+        self.fail_closed_held = False
+
         # Restore persistent state from DB to prevent empty dashboard on service restart
         loaded_snapshot = self.state_manager.load_snapshot()
         if loaded_snapshot and isinstance(loaded_snapshot, dict):
@@ -595,6 +718,19 @@ async def _apply_worker_rejection(self, monero_down, tari_down):
             if await self.docker_control.start(REJECT_WORKERS_CONTAINER):
                 self.workers_rejected = False
 
+    async def _stop_gate_containers(self, quiet):
+        """Stop every ``SYNC_GATE_CONTAINERS`` container; shared by the #35 sync gate and the
+        #490 fail-closed gate, the two holds that stop the same container set."""
+        for container in SYNC_GATE_CONTAINERS:
+            await self.docker_control.stop(container, quiet=quiet)
+
+    async def _start_gate_containers(self):
+        """Start every ``SYNC_GATE_CONTAINERS`` container; True only if every start succeeded."""
+        ok = True
+        for container in SYNC_GATE_CONTAINERS:
+            ok = (await self.docker_control.start(container)) and ok
+        return ok
+
     async def _apply_sync_gate(self, gate_satisfied):
         """
         Hold p2pool + xmrig-proxy stopped until the required chain(s) have fully synced once,
@@ -619,10 +755,7 @@ async def _apply_sync_gate(self, gate_satisfied):
             return
 
         if gate_satisfied:
-            ok = True
-            for container in SYNC_GATE_CONTAINERS:
-                ok = (await self.docker_control.start(container)) and ok
-            if ok:
+            if await self._start_gate_containers():
                 self.miner_released = True
                 self.miner_held = False
                 logger.info(
@@ -633,8 +766,7 @@ async def _apply_sync_gate(self, gate_satisfied):
 
         # Still syncing: keep the miner held. Log the human-facing notice only on the first
         # cycle of a hold; the per-cycle re-assert stops are quiet to avoid flooding the log.
-        for container in SYNC_GATE_CONTAINERS:
-            await self.docker_control.stop(container, quiet=self.miner_held)
+        await self._stop_gate_containers(quiet=self.miner_held)
         if not self.miner_held:
             self.miner_held = True
             logger.info(
@@ -642,6 +774,53 @@ async def _apply_sync_gate(self, gate_satisfied):
                 f"until synced."
             )
 
+    async def _apply_fail_closed_gate(self, unrecoverable):
+        """
+        Opt-in (`dashboard.fail_closed`, default False) miner hold on an UNRECOVERABLE health
+        failure (#490) — reuses the #35 sync gate's own mechanism (stop/start
+        ``SYNC_GATE_CONTAINERS`` through ``docker_control``) rather than a new hold path.
+
+        "Unrecoverable" is scoped narrowly by the caller to genuine, non-transient failures: a DB
+        whose auto-heal rebuild itself failed (``StateManager.is_db_unrecoverable``), or the
+        dashboard container itself crash-looping / stuck unhealthy past the #337 debounce
+        (``AlertService.containers.is_confirmed_bad("dashboard")`` — a debounce-CONFIRMED verdict,
+        never a first-sighting seed). A transient write blip, a slow query, a single failed
+        external fetch, or a container merely reported unhealthy on one poll is never
+        "unrecoverable" — those already alert (#131/#337) and must never gate; a false positive
+        here idles the fleet and costs revenue.
+
+        Unlike the sync gate's one-way latch, this re-checks every cycle and releases once
+        ``unrecoverable`` clears — the failures it watches (disk full, a crash-looping container)
+        are the kind an operator fixes without a full stack restart, and the miner should resume
+        on its own once they do. Only engages once the sync gate has actually released the miner;
+        holding before that is already #35's job.
+
+        Default False is alert-only: `dashboard.fail_closed` off means these same signals keep
+        alerting (unchanged) but this method is a no-op, so a cosmetic dashboard fault never idles
+        the fleet — the mining datapath (xmrig-proxy -> p2pool -> monerod) is independent of the
+        dashboard by design.
+        """
+        if not DASHBOARD_FAIL_CLOSED or not self.miner_released:
+            return
+
+        if unrecoverable:
+            await self._stop_gate_containers(quiet=self.fail_closed_held)
+            if not self.fail_closed_held:
+                self.fail_closed_held = True
+                logger.error(
+                    f"Unrecoverable health failure with dashboard.fail_closed enabled — holding "
+                    f"{', '.join(SYNC_GATE_CONTAINERS)} until it clears."
+                )
+            return
+
+        if self.fail_closed_held and await self._start_gate_containers():
+            self.fail_closed_held = False
+            logger.info(
+                f"Unrecoverable health failure cleared — starting "
+                f"{', '.join(SYNC_GATE_CONTAINERS)}; mining can resume."
+            )
+        # On a partial-start failure stay held so the next cycle retries.
+
     async def _sync_xvb_stats(self):
         """
         Fetch XvB's reported averages (avg_1h/avg_24h/fail_count) over Tor and persist them.
@@ -858,25 +1037,219 @@ async def _sync_tari_payouts(self):
             )
             await self.alert_service.payout_confirmed_alert(chain, r["amount_atomic"], r["txid"])
 
-    async def _reconcile_worker_config(self, worker_results):
+    async def _record_audit_event(self, source, actor, action, status, keys, event_id=None):
+        """Write one out-of-band audit row (#530), through the SAME sanitizer #33's own audit
+        trail is served through (``audit_service._clean``) — defense in depth: ``actor``/``keys``
+        here are already schema-shaped (a validated worker name, dotted config-key paths), but
+        every field the Security panel serves gets the identical whitelist treatment regardless of
+        source, so a future caller can't accidentally skip it.
+
+        ``event_id`` lets a caller supply a DETERMINISTIC row id so ``INSERT OR IGNORE`` collapses
+        repeat reports of the SAME event to one row (rig-edit: a rig re-reports its last change_id
+        every poll). A host-edit passes None — each detection is a genuinely distinct event, so a
+        random id is right there."""
+        await asyncio.to_thread(
+            self.state_manager.add_audit_event,
+            id=event_id or f"{source}-{uuid.uuid4()}",
+            ts=_iso_now(),
+            source=audit_service._clean(source, 16),
+            actor=audit_service._clean(actor, 64),
+            action=audit_service._clean(action, 16),
+            status=audit_service._clean(status, 32),
+            keys=audit_service._clean(keys, 400),
+        )
+
+    async def _watch_host_config(self):
+        """Out-of-band HOST-EDIT detection (#530): config.json changed without a matching
+        control-channel commit.
+
+        Reads the same pre-masked copy the control channel itself prefills from
+        (``config.HOST_CONFIG_PATH``, #440 — already secret-free) each poll and diffs it against
+        the previous poll's snapshot. A changed key is "explained" — and stays quiet — only when
+        the #33 audit trail shows a ``commit``/``applied`` entry that both landed AFTER the last
+        time this watcher looked AND actually touched that key (the entry's env-var names are
+        bridged to config paths via ``env_key_config_paths``). Correlating by key, not merely by
+        time, is what stops a legit dashboard commit of key A from swallowing a concurrent
+        host-side hand-edit of key B. Any changed key no fresh commit covers (a hand-edit, a
+        `pithead apply` run outside the dashboard) is recorded as a ``host-edit`` audit row naming
+        the unexplained keys. First poll only baselines (no control
+        log exists yet to compare against, and every other watcher in this loop shares that
+        never-backfill contract). No-op with the control channel off — there is neither a masked
+        config mount nor an audit trail to compare against."""
+        if not config.DASHBOARD_CONTROL_ENABLED:
+            return
+        current = await asyncio.to_thread(_read_host_config)
+        if current is None:
+            return  # mount not ready yet — quiet no-op, the next poll retries
+        now = time.time()
+        if self._last_host_config is None:
+            self._last_host_config, self._last_host_check = current, now
+            return
+        changed_keys = _diff_config_keys(self._last_host_config, current)
+        if changed_keys:
+            # The audit log's ts is whole-second (_iso_now/control_audit both write
+            # "%Y-%m-%dT%H:%M:%SZ"), while `_last_host_check` is a sub-second time.time() — a
+            # commit landed in the SAME wall-clock second as the baseline poll would otherwise
+            # floor below it and be missed. One second of grace absorbs that truncation.
+            # ponytail: ≤1s correlation window — a control-channel commit up to 1s before the last
+            # poll could "explain" (suppress) an unrelated hand-edit detected in this poll. The
+            # honest ceiling of a timestamp correlation; tighten to id-based ("commits seen since
+            # last poll") only if a real false-negative shows up. Pinned by
+            # test_explained_window_is_at_most_one_second.
+            since = self._last_host_check - 1
+            # Correlate BY KEY, not just by time: a commit only "explains" the keys it actually
+            # touched. Fold every fresh commit's env-var names into the config paths they cover
+            # (env_key_config_paths bridges the audit log's env names to config.json paths), then
+            # record only the changed keys NO recent commit covers — the genuine out-of-band edits
+            # this watcher exists to catch. A concurrent dashboard commit of key A + a host
+            # hand-edit of key B no longer swallows B.
+            explained_paths = set()
+            for e in audit_service.recent_changes():
+                if (
+                    e.get("action") == "commit"
+                    and e.get("status") == "applied"
+                    and (ts := _parse_audit_ts(e.get("ts"))) is not None
+                    and ts >= since
+                ):
+                    for env_key in (e.get("keys") or "").split():
+                        explained_paths.update(env_key_config_paths(env_key))
+            # ponytail: env-var granularity — a var fed by >1 config path (e.g. P2POOL_FLAGS <-
+            # p2pool.pool + p2pool.clearnet) explains ALL its paths, so a commit touching one could
+            # still suppress a concurrent hand-edit of its sibling. Inherent to a name-only audit
+            # log; fix only if per-path audit keys ever land.
+            unexplained = [
+                k
+                for k in changed_keys
+                if not any(k == p or k.startswith(p + ".") for p in explained_paths)
+            ]
+            if unexplained:
+                await self._record_audit_event(
+                    "host-edit", "", "host-edit", "detected", " ".join(unexplained)
+                )
+        self._last_host_config, self._last_host_check = current, now
+
+    async def _mirror_control_audit(self):
+        """Copy the #33 control.log's recent entries into the durable ``audit_events`` table
+        (#530), so the Security panel's time-grouped view can drill deeper than the log's own
+        trimmed tail. ``audit_service.recent_changes()`` output is already sanitized (it's the SAME
+        read the panel used before this table existed); ``add_audit_event``'s ``INSERT OR IGNORE``
+        on the log's own ``id`` makes re-mirroring the same tail every poll a no-op. Entries with no
+        id (a handful of pre-auth "invalid"/"refused" rows, #33) are skipped — they're visible only
+        while still in the log tail, same as before this feature."""
+        if not config.DASHBOARD_CONTROL_ENABLED:
+            return
+        for e in audit_service.recent_changes():
+            if not e.get("id"):
+                continue
+            await asyncio.to_thread(
+                self.state_manager.add_audit_event,
+                id=e["id"],
+                ts=e.get("ts", ""),
+                source="control",
+                actor=e.get("actor", ""),
+                action=e.get("action", ""),
+                status=e.get("status", ""),
+                keys=e.get("keys", ""),
+            )
+
+    def _rig_edit_within_cap(self, worker, now):
+        """Per-worker fixed-window cap on NEW rig-edit audit rows (#724). Counts this rig-edit
+        against the worker's current hour window and returns ``(allowed, first_over)``: ``allowed``
+        is True while the worker is under ``_RIG_EDIT_CAP_PER_HOUR`` this window; ``first_over`` is
+        True only on the single call that tips it over, so the caller logs + records the
+        rate-limited marker exactly once per window rather than every poll. A handful of real edits
+        an hour never trips it; a rig spamming distinct change_ids does."""
+        start, count = self._rig_edit_window.get(worker, (now, 0))
+        if now - start >= _RIG_EDIT_WINDOW_SEC:
+            start, count = now, 0
+        self._rig_edit_window[worker] = (start, count + 1)
+        return count < _RIG_EDIT_CAP_PER_HOUR, count == _RIG_EDIT_CAP_PER_HOUR
+
+    async def _reconcile_worker_config(self, workers, worker_results):
         """Catch up any still-``accepted`` #185 worker-config history row whose change_id the rig
-        now reports terminal (#579).
+        now reports terminal (#579), and flag an out-of-band RIG-EDIT (#530).
 
         A rollback slower than the host runner's 20s status-poll deadline (#517/#543) is honestly
         recorded ``accepted`` and never revisited — this rides THIS poll's already-fetched enriched
-        bodies (``worker_results``, positionally aligned with the worker probes in ``run()``), so
-        there's no new dial and no host-runner change. A plain-xmrig rig, a rig still mid-change, or
-        an unreachable/offline rig (``{}``) all parse to ``None`` via ``parse_worker_control_status``
-        and are a quiet no-op — the row simply stays ``accepted`` until a later poll catches it."""
-        for extra_stats in worker_results:
+        bodies (``worker_results``, positionally aligned with ``workers`` and with the worker probes
+        in ``run()``), so there's no new dial and no host-runner change. A plain-xmrig rig, a rig
+        still mid-change, or an unreachable/offline rig (``{}``) all parse to ``None`` via
+        ``parse_worker_control_status`` and are a quiet no-op.
+
+        A TERMINAL report whose ``change_id`` this dashboard never spooled (``worker_config`` has no
+        row for it — checked via ``worker_config_change_known``) is a change the RIG applied on its
+        own: reconciling it would be a silent no-op anyway (the ``WHERE status='accepted'`` UPDATE
+        matches nothing), so instead it's recorded as a ``rig-edit`` audit row naming the worker.
+        RigForge's ``/status`` mirror carries only the outcome of a change, not a per-key diff, so
+        unlike host-edit's ``keys`` this can only name the change_id — a real limitation, not an
+        oversight; see the #530 PR notes.
+
+        A rig keeps reporting its last terminal change_id every poll, so this fires ONCE per
+        (worker, change_id): an in-memory guard skips the redundant work in the steady state, and
+        the audit row's deterministic id makes the write itself idempotent even across a restart
+        (when the guard is empty but a repeat report must still not duplicate the row). Both matter
+        — the id is the correctness bound (a rogue rig can't flood the permanent table with repeats
+        of one bogus change_id), the guard is the optimisation.
+
+        DISTINCT change_ids each clear that dedup, though, so a rogue rig on the unauthenticated
+        feed can still write one permanent row per poll (#724). ``_rig_edit_within_cap`` bounds NEW
+        rig-edit rows to ``_RIG_EDIT_CAP_PER_HOUR`` per worker per hour; beyond that the row is
+        dropped, but never silently — a single ``rate-limited`` marker is logged and recorded so the
+        flood stays visible in the Security panel. host-edit rows are unaffected (a different,
+        non-attacker-controlled path)."""
+        for w, extra_stats in zip(workers, worker_results, strict=False):
             ctrl = parse_worker_control_status(extra_stats) if extra_stats else None
-            if ctrl:
+            if not ctrl:
+                continue
+            known = await asyncio.to_thread(
+                self.state_manager.worker_config_change_known, ctrl["change_id"]
+            )
+            if known:
                 await asyncio.to_thread(
                     self.state_manager.reconcile_worker_config_status,
                     ctrl["change_id"],
                     ctrl["status"],
                     ctrl["reason"],
                 )
+            else:
+                worker = w.get("name", "")
+                guard_key = (worker, ctrl["change_id"])
+                if guard_key in self._flagged_rig_changes:
+                    continue
+                allowed, first_over = self._rig_edit_within_cap(worker, time.time())
+                if not allowed:
+                    # Over cap this window — drop the row (don't add to the guard set, so its size
+                    # stays bounded by what we actually record, not by the flood). Surface the cap
+                    # once per window: a warning plus one marker row, its deterministic id keyed to
+                    # this worker's window start so it's idempotent even if a restart re-trips
+                    # `first_over`, and a fresh window later gets its own distinct marker.
+                    if first_over:
+                        window_start = self._rig_edit_window[worker][0]
+                        logger.warning(
+                            "Worker %s exceeded %d rig-edit audit rows this hour (#724) — a rig "
+                            "reporting distinct change_ids on the unauthenticated feed; further "
+                            "rig-edit rows are dropped until the window resets.",
+                            worker,
+                            _RIG_EDIT_CAP_PER_HOUR,
+                        )
+                        await self._record_audit_event(
+                            "rig-edit",
+                            worker,
+                            "rate-limited",
+                            "dropped",
+                            f"rig-edit rows capped at {_RIG_EDIT_CAP_PER_HOUR}/hour",
+                            event_id=f"rig-edit-ratelimited-{worker}-{int(window_start)}",
+                        )
+                    continue
+                self._flagged_rig_changes.add(guard_key)
+                await self._record_audit_event(
+                    "rig-edit",
+                    worker,
+                    "rig-edit",
+                    ctrl["status"],
+                    f"change_id={ctrl['change_id']}",
+                    event_id=f"rig-edit-{worker}-{ctrl['change_id']}",
+                )
 
     def _on_clearnet_transition(self, name, ok):
         """Called by the supervisor after a clearnet→Tor flip attempt (#234)."""
@@ -947,8 +1320,16 @@ async def run(self):
                     worker_results = await asyncio.gather(*tasks)
 
                     # 3a. Reconcile any #185 history row a slow rig rollback left stuck 'accepted'
-                    # (#579) — rides this same poll's results, no new dial.
-                    await self._reconcile_worker_config(worker_results)
+                    # (#579), and flag a rig-side out-of-band edit (#530) — rides this same poll's
+                    # results, no new dial.
+                    await self._reconcile_worker_config(proxy_workers, worker_results)
+
+                    # 3a-2. Out-of-band audit (#530): a config.json change not made through the
+                    # control channel, plus mirroring the #33 log into the durable audit_events
+                    # table so the Security panel can group by hour/day/month. Both are no-ops with
+                    # the control channel off.
+                    await self._watch_host_config()
+                    await self._mirror_control_audit()
 
                     current_mode = self.state_manager.get_xvb_stats().get("current_mode", "P2POOL")
                     # Determine active pool port for UI badges based on current Algo mode
@@ -1111,9 +1492,14 @@ async def run(self):
                     )
                     # Per-container restart/health snapshot for the crash-loop/unhealthy alert
                     # (#337) — 9 inspect calls against the read-only docker-proxy, skipped
-                    # entirely while Telegram is off (same cost discipline as alert_metrics).
+                    # entirely while Telegram is off AND dashboard.fail_closed is off (same cost
+                    # discipline as alert_metrics). fail_closed needs it even with Telegram off:
+                    # it's the only source for "is the dashboard container itself crash-looping"
+                    # (#490).
                     container_states = (
-                        await get_container_health() if self.alert_service.enabled else {}
+                        await get_container_health()
+                        if (self.alert_service.enabled or DASHBOARD_FAIL_CLOSED)
+                        else {}
                     )
                     await self.alert_service.process(
                         monero_down=monero_down,
@@ -1164,6 +1550,14 @@ async def run(self):
                         # the read-only docker-proxy.
                         containers=container_states,
                     )
+                    # 5b. Fail-closed miner hold (#490), opt-in via dashboard.fail_closed. Reads
+                    # the DB auto-heal outcome and the dashboard's OWN crash-loop state — both
+                    # narrow, non-transient "unrecoverable" signals — off the trackers `process`
+                    # above just fed (see `_apply_fail_closed_gate` for what counts and why).
+                    await self._apply_fail_closed_gate(
+                        self.state_manager.is_db_unrecoverable()
+                        or self.alert_service.containers.is_confirmed_bad("dashboard")
+                    )
                     # Once-daily status digest, reusing the metrics built above (only when the bot
                     # is on, which is also the only time maybe_daily_summary would send).
                     await self.alert_service.maybe_daily_summary(
@@ -1212,6 +1606,7 @@ async def run(self):
                             "workers_rejected": self.workers_rejected,
                             "miner_released": self.miner_released,
                             "miner_held": self.miner_held,
+                            "fail_closed_held": self.fail_closed_held,
                             "clearnet_sync": self.clearnet_sync_state,
                             "system": {
                                 "disk": disk_usage,
diff --git a/build/dashboard/mining_dashboard/service/egress.py b/build/dashboard/mining_dashboard/service/egress.py
index ab171600..89fc998d 100644
--- a/build/dashboard/mining_dashboard/service/egress.py
+++ b/build/dashboard/mining_dashboard/service/egress.py
@@ -10,7 +10,7 @@
   subnet — so a container's clearnet route can't actually leave while it's on.
 * It does **not** cover the **host-networked dashboard** (``network_mode: host``), whose own egress
   (XvB stats fetch, update check, Healthchecks ping, Telegram bot, price feed, webhook/ntfy alert
-  sinks) bypasses ``DOCKER-USER`` entirely. Those rely solely on their SOCKS config — a clearnet
+  sinks, #249 XvB standby pull) bypasses ``DOCKER-USER`` entirely. Those rely solely on their SOCKS config — a clearnet
   route there is a real leak regardless of the firewall. (All are Tor-routed by default, so none
   leak.)
 
@@ -48,6 +48,28 @@ def _notify_route(enabled, tor, private):
     return LOCAL if private else CLEARNET
 
 
+def _xvb_standby_route(source):
+    """Route of the #249 backup→primary standby pull, derived from ``xvb.standby.source`` alone.
+
+    Same #160 reasoning as ``_sinks_all_private``: only an IP literal can be *proven* to stay on your
+    network without a DNS lookup. So an ``.onion`` or any public/non-private source rides Tor (the
+    puller's ``_proxies`` sends it socks5h, like every other dashboard read); a private/loopback IP
+    literal is a LAN hop (``local``); an unset source is ``inactive``. A hostname can't be proven
+    private, so it routes over Tor — never a silent clearnet beacon. The puller reads this exact
+    route (``XvbStandbyPuller._proxies``), so the panel can't disagree with where the pull goes."""
+    source = (source or "").strip()
+    if not source:
+        return INACTIVE
+    host = (urlsplit(source).hostname or "").lower()
+    if host.endswith(".onion"):
+        return TOR
+    try:
+        ip = ipaddress.ip_address(host)
+    except ValueError:  # not an IP literal (a hostname) — unprovable, route over Tor
+        return TOR
+    return LOCAL if (ip.is_private or ip.is_loopback or ip.is_link_local) else TOR
+
+
 def _sinks_all_private(urls):
     """True when every configured sink URL targets a private/loopback IP literal — the LAN
     carve-out proof. A hostname can't be verified without a DNS lookup (which a pure config
@@ -81,10 +103,12 @@ def compute_egress_posture(
     notify_sinks_enabled=False,
     notify_tor=True,
     notify_sinks_private=False,
+    xvb_standby_source="",
 ):
     """Pure derivation of the egress posture from config knobs. Returns ``{components, summary}``."""
     xvb = _xvb_route(xvb_enabled, xvb_tor)
     sinks = _notify_route(notify_sinks_enabled, notify_tor, notify_sinks_private)
+    standby = _xvb_standby_route(xvb_standby_source)
 
     # ``firewalled``: is this component's egress on the container subnet the #270 firewall guards?
     # The dashboard is host-networked, so its own outbound traffic is NOT covered.
@@ -153,6 +177,10 @@ def compute_egress_posture(
                 # Webhook/ntfy alert sinks (#380) — Tor by default; ``notifications.tor: false``
                 # to an all-private-IP endpoint set is the LAN carve-out (local, not a leak).
                 {"to": "alert sinks (webhook / ntfy)", "route": sinks},
+                # XvB standby pull (#249) — a backup pulls the primary's controller state. onion or
+                # any non-private source rides Tor (like every read above); only a private-IP-literal
+                # primary is a LAN hop (local). Never clearnet, so it can't leak the backup's IP.
+                {"to": "XvB standby pull (backup ← primary)", "route": standby},
             ],
         },
         {
@@ -207,6 +235,7 @@ def egress_posture_from_config():
         healthchecks_enabled=bool(config.HEALTHCHECKS_PING_URL),
         telegram_enabled=config.TELEGRAM_ENABLED,
         price_feed_enabled=config.DASHBOARD_ENERGY["price_feed"],
+        xvb_standby_source=config.XVB_STANDBY_SOURCE,
         **_notify_knobs(),
     )
 
@@ -274,6 +303,7 @@ def compute_topology(
     notify_sinks_enabled=False,
     notify_tor=True,
     notify_sinks_private=False,
+    xvb_standby_source="",
 ):
     """Pure derivation of the stack topology. Returns ``{nodes, edges, summary}``.
 
@@ -295,9 +325,11 @@ def compute_topology(
         notify_sinks_enabled=notify_sinks_enabled,
         notify_tor=notify_tor,
         notify_sinks_private=notify_sinks_private,
+        xvb_standby_source=xvb_standby_source,
     )
     xvb = _xvb_route(xvb_enabled, xvb_tor)
     sinks = _notify_route(notify_sinks_enabled, notify_tor, notify_sinks_private)
+    standby = _xvb_standby_route(xvb_standby_source)
     sidechain = CLEARNET if p2pool_clearnet else TOR
     rpc = CLEARNET if remote_monero else LOCAL
 
@@ -346,6 +378,14 @@ def compute_topology(
             if sinks != LOCAL
             else []
         ),
+        # XvB standby pull (#249) — onion/public source rides the tor hub; a private-IP primary is a
+        # LAN hop with no placeable node (like the alert-sink LAN carve-out), so it draws no edge.
+        # The route is never clearnet, so it can never bypass the hub to the internet node.
+        *(
+            [_edge("dashboard", _ext(standby), standby, "XvB standby", "egress")]
+            if standby != LOCAL
+            else []
+        ),
         # The Tor hub to the network: SOCKS egress for every daemon + onion-service ingress.
         _edge("tor", "internet", TOR, "SOCKS + onion circuits", "p2p"),
         # Internal mesh (hidden until expanded).
@@ -390,5 +430,6 @@ def topology_from_config():
         healthchecks_enabled=bool(config.HEALTHCHECKS_PING_URL),
         telegram_enabled=config.TELEGRAM_ENABLED,
         price_feed_enabled=config.DASHBOARD_ENERGY["price_feed"],
+        xvb_standby_source=config.XVB_STANDBY_SOURCE,
         **_notify_knobs(),
     )
diff --git a/build/dashboard/mining_dashboard/service/storage_service.py b/build/dashboard/mining_dashboard/service/storage_service.py
index c2abf2a7..289a585d 100644
--- a/build/dashboard/mining_dashboard/service/storage_service.py
+++ b/build/dashboard/mining_dashboard/service/storage_service.py
@@ -89,6 +89,12 @@ def __init__(self, db_path: str = None):
                 # (routed) next to what XvB *credits* (avg_1h/24h) — the live
                 # credit-factor signal (Issue #70).
                 "donation_fraction": 0.0,
+                # The controller's own last-COMMANDED donation fraction — the closed-loop
+                # integrator state (AlgoService.donation_fraction), distinct from the routed
+                # fraction above. Persisted so a restart resumes the warmed-up split instead of
+                # re-seeding cold from the feedforward estimate, and so a backup stack can hand it
+                # off on failover (#249). 0.0 until the controller first steers.
+                "commanded_fraction": 0.0,
             },
             # Initialize state with default values from configuration
             "tiers": TIER_DEFAULTS.copy(),
@@ -117,6 +123,14 @@ def __init__(self, db_path: str = None):
             None  # {"ts", "reason", "quarantine"} of the most recent reset, for the alert
         )
 
+        # True only when the auto-heal RECOVERY ITSELF just failed (disk full, permissions) —
+        # distinct from ``db_healthy``, which also flips false on an ordinary transient write
+        # error (a locked DB, a momentary I/O hiccup) that must never be treated as unrecoverable.
+        # This is the narrow signal `dashboard.fail_closed` (#490) gates on: a DB that a corruption
+        # was DETECTED for and whose rebuild then failed, not merely "a write failed once". Cleared
+        # on the next recovery attempt that succeeds.
+        self.db_unrecoverable = False
+
         # Per-table "last successful write" health signal for the v1.7 telemetry backbone (#196
         # Wave-0), mirroring db_healthy above but per table: DataService's whole poll loop is one
         # big try/except, so a capture hook that starts silently raising would otherwise stop
@@ -219,6 +233,7 @@ def _recover_corrupt_db(self, reason: str):
                 self._conn.row_factory = sqlite3.Row
                 self._apply_schema()
             self.db_healthy = True
+            self.db_unrecoverable = False  # a later successful attempt clears an earlier failure
             self.db_reset_count += 1
             self.last_db_reset = {"ts": time.time(), "reason": reason, "quarantine": quarantine}
             self.logger.error(
@@ -228,7 +243,9 @@ def _recover_corrupt_db(self, reason: str):
                 quarantine or "(in-memory, nothing to quarantine)",
             )
         except (sqlite3.Error, OSError) as e:
-            # Recovery itself failed (disk full, permissions) — leave persistence flagged unhealthy.
+            # Recovery itself failed (disk full, permissions) — this is the unrecoverable case
+            # #490's fail-closed gate watches for, distinct from an ordinary transient write error.
+            self.db_unrecoverable = True
             self._db_error("DB Recovery Error", e)
 
     def _prune_quarantined(self):
@@ -260,6 +277,12 @@ def is_db_healthy(self) -> bool:
         """True unless a DB init or write has failed — drives the dashboard persistence badge (#131)."""
         return self.db_healthy
 
+    def is_db_unrecoverable(self) -> bool:
+        """True only when the auto-heal rebuild itself just failed (#489/#490) — narrower than
+        ``is_db_healthy() is False``, which also covers an ordinary transient write error. Feeds
+        `dashboard.fail_closed`'s miner hold; a transient blip must never trip it."""
+        return self.db_unrecoverable
+
     def _create_tables(self):
         """Creates necessary tables if they don't exist."""
         # Per-window hashrate columns (#168) are appended so a fresh DB starts with them; existing
@@ -353,6 +376,21 @@ def _create_tables(self):
             "CREATE TABLE IF NOT EXISTS worker_history "
             "(ts REAL, name TEXT, h15 REAL, accepted INTEGER, rejected INTEGER)"
         )
+        # audit_events (#530): the durable backing store for the Security panel's audit trail. The
+        # #33 control.log is host-owned, read-only from this container, and the writers already trim
+        # it — so it can't back a month-level drill-down on its own. This table mirrors each
+        # control.log row (source="control", `id` reused as the primary key — INSERT OR IGNORE makes
+        # the mirror idempotent) AND records the two kinds this dashboard detects itself:
+        # source="host-edit" (config.json changed without a matching control-channel commit) and
+        # source="rig-edit" (a rig's control-apply outcome carries a change_id this dashboard never
+        # issued). `keys` is names only — never a value — the same contract as control.log itself.
+        # Permanent, no pruning, like blocks/payouts/disk_growth: these are human-paced admin events,
+        # not a hot metrics series.
+        self._conn.execute(
+            "CREATE TABLE IF NOT EXISTS audit_events "
+            "(id TEXT PRIMARY KEY, ts TEXT, source TEXT, actor TEXT, action TEXT, status TEXT, "
+            "keys TEXT)"
+        )
 
     def _create_indexes(self):
         """Creates indexes. Called after migrations so the indexed columns are guaranteed to
@@ -370,6 +408,7 @@ def _create_indexes(self):
         )
         self._conn.execute("CREATE INDEX IF NOT EXISTS idx_disk_growth_ts ON disk_growth(ts)")
         self._conn.execute("CREATE INDEX IF NOT EXISTS idx_worker_history_ts ON worker_history(ts)")
+        self._conn.execute("CREATE INDEX IF NOT EXISTS idx_audit_events_ts ON audit_events(ts)")
 
     def _migrate_db(self):
         """Handles schema migrations for existing databases."""
@@ -864,6 +903,65 @@ def reconcile_worker_config_status(
         except sqlite3.Error as e:
             self._db_error("Worker Config Reconcile Error", e)
 
+    def worker_config_change_known(self, change_id: str) -> bool:
+        """Whether ``change_id`` was ever spooled by THIS dashboard (#530): a row exists in
+        ``worker_config`` — the table only ``add_worker_config_version`` writes to, one row per
+        change the dashboard itself sent. A rig reporting a terminal outcome for a change_id NOT
+        found here is reporting something it applied on its own — an out-of-band rig edit."""
+        if not change_id:
+            return False
+        try:
+            with self._db_lock:
+                if not self._conn:
+                    return False
+                cursor = self._conn.cursor()
+                cursor.execute(
+                    "SELECT 1 FROM worker_config WHERE change_id = ? LIMIT 1", (change_id,)
+                )
+                return cursor.fetchone() is not None
+        except sqlite3.Error as e:
+            self.logger.error(f"Worker Config Lookup Error: {e}")
+            return True  # fail toward NOT flagging a false rig-edit on a DB read hiccup
+
+    def add_audit_event(
+        self, id: str, ts: str, source: str, actor: str, action: str, status: str, keys: str
+    ) -> None:
+        """Record one audit-trail row (#530) — mirrored from the #33 control.log (``source`` =
+        "control", the log's own ``id`` reused as the primary key) or detected out-of-band
+        ("host-edit" / "rig-edit"). ``INSERT OR IGNORE`` makes both idempotent: a re-mirrored
+        control.log row and a re-detected out-of-band event are no-ops. ``keys`` is names only —
+        the caller is responsible for the same no-values contract the log itself holds to."""
+        try:
+            with self._db_lock:
+                if not self._conn:
+                    return
+                self._conn.execute(
+                    "INSERT OR IGNORE INTO audit_events "
+                    "(id, ts, source, actor, action, status, keys) VALUES (?, ?, ?, ?, ?, ?, ?)",
+                    (id, ts, source, actor, action, status, keys),
+                )
+                self._conn.commit()
+        except sqlite3.Error as e:
+            self._db_error("Audit Event Write Error", e)
+
+    def get_audit_events(self, limit: int = 1000) -> list[dict[str, Any]]:
+        """Every persisted audit row (#530), newest first by ``ts`` — the merged, durable
+        backing store for the Security panel's time-grouped view."""
+        try:
+            with self._db_lock:
+                if not self._conn:
+                    return []
+                cursor = self._conn.cursor()
+                cursor.execute(
+                    "SELECT id, ts, source, actor, action, status, keys FROM audit_events "
+                    "ORDER BY ts DESC LIMIT ?",
+                    (limit,),
+                )
+                return [dict(row) for row in cursor.fetchall()]
+        except sqlite3.Error as e:
+            self.logger.error(f"Audit Event Read Error: {e}")
+            return []
+
     def get_last_applied_worker_config(self, worker: str) -> dict[str, Any]:
         """The merged writable config the dashboard last successfully applied to ``worker`` — the
         best prefill for the editor, since the rig's enriched feed does not expose the writable config
@@ -1239,6 +1337,30 @@ def get_xvb_stats(self) -> dict[str, Any]:
         with self._lock:
             return self.state["xvb"].copy()
 
+    def set_xvb_standby(self, standby: dict[str, Any]):
+        """Store the XvB controller state last pulled from the PRIMARY stack (#249). Held as
+        standby only — never folded into the live controller until this host takes over on
+        failover, and never acted on while the primary is authoritative (this host has no workers
+        then, so the controller stays on P2Pool regardless). Persisted (kv_store) so the standby
+        survives a backup restart. A JSON blob, mirroring ``save_snapshot``."""
+        try:
+            self.set_kv("xvb_standby", json.dumps(standby))
+        except (TypeError, ValueError) as e:
+            self._db_error("XvB Standby Serialization Error", e)
+
+    def get_xvb_standby(self) -> dict[str, Any] | None:
+        """The last-pulled primary XvB controller state (#249), or None if a backup source was
+        never configured / has not fetched yet. Inspectable via ``/api/state`` so an operator can
+        confirm the backup is warm before a failover."""
+        raw = self.get_kv("xvb_standby")
+        if not raw:
+            return None
+        try:
+            val = json.loads(raw)
+            return val if isinstance(val, dict) else None
+        except (json.JSONDecodeError, TypeError):
+            return None
+
     def get_xvb_reward_estimates(self) -> dict[str, Any]:
         """The cached XvB per-tier reward estimates (#118): ``{"estimates": {...}, "last_update": ts}``."""
         with self._lock:
diff --git a/build/dashboard/mining_dashboard/service/xvb_standby.py b/build/dashboard/mining_dashboard/service/xvb_standby.py
new file mode 100644
index 00000000..1d59412f
--- /dev/null
+++ b/build/dashboard/mining_dashboard/service/xvb_standby.py
@@ -0,0 +1,138 @@
+"""Backup-stack XvB warm-standby puller (#249).
+
+Two full Pithead hosts sharing one Monero/Tari wallet run as a failover pair: workers list both in
+``pools[]`` (primary first), and on a primary outage they fail over to the backup. The backup's XvB
+donation controller would otherwise cold-start — it restarts the donation split from the feedforward
+estimate and re-ramps for hours — so its credited tier over/under-shoots until the closed loop
+reconverges.
+
+This service closes that gap on the **backup**: when ``xvb.standby.source`` names the primary's
+dashboard, it periodically pulls the primary's read-only ``/api/xvb-standby`` and holds the result as
+*standby* state (``StateManager.set_xvb_standby``). It is never acted on while the primary is
+authoritative — the backup has no workers then, so its controller stays on P2Pool regardless. The
+adoption happens only at failover, inside ``AlgoService._seed_donation_fraction``, when the backup
+first actually donates.
+
+One-way, backup-pulls-from-primary; inert unless configured (blank source = off). The pull follows
+the dashboard's #160-safe egress rule (``_proxies`` / ``egress._xvb_standby_route``): an ``.onion``
+source, a public IP, or any hostname rides the bridge Tor SOCKS — so the primary sees a Tor exit,
+never the backup's real IP — and only a provably-private/loopback IP *literal* dials direct as a LAN
+hop. It never opens a clearnet path. Every failure is silent — a missed pull just keeps the
+last-held standby, and a backup with no standby yet simply cold-starts as before.
+"""
+
+import asyncio
+import logging
+import time
+
+import requests
+
+from mining_dashboard.config.config import (
+    TOR_SOCKS_PROXY,
+    XVB_STANDBY_INTERVAL_S,
+    XVB_STANDBY_SOURCE,
+)
+from mining_dashboard.helper.http import bounded_get
+from mining_dashboard.service.egress import LOCAL, _xvb_standby_route
+
+logger = logging.getLogger("XvbStandby")
+
+
+def parse_standby(payload):
+    """The minimal warm state from a primary's ``/api/xvb-standby`` body, or ``None`` when the
+    payload is unusable. Pure + unit-tested. Coerces the numeric fields defensively — the source is
+    another stack's API, trusted but still validated so a malformed body degrades to "no pull"
+    rather than poisoning the held standby."""
+    if not isinstance(payload, dict):
+        return None
+    try:
+        commanded = float(payload.get("commanded_fraction", 0.0) or 0.0)
+        avg_1h = float(payload.get("avg_1h", 0.0) or 0.0)
+        avg_24h = float(payload.get("avg_24h", 0.0) or 0.0)
+    except (TypeError, ValueError):
+        return None
+    return {
+        "commanded_fraction": commanded,
+        "avg_1h": avg_1h,
+        "avg_24h": avg_24h,
+        "donation_level": str(payload.get("donation_level", "")),
+        "mode": str(payload.get("mode", "")),
+    }
+
+
+class XvbStandbyPuller:
+    """Periodically pulls the primary's XvB controller state into standby (#249).
+
+    Inert unless ``source`` is set. ``fetch_once`` does one blocking HTTP read (call via
+    ``asyncio.to_thread`` or straight in a test); ``run`` is the throttled loop wired into main."""
+
+    def __init__(self, state_manager, source=XVB_STANDBY_SOURCE, interval=XVB_STANDBY_INTERVAL_S):
+        self.state_manager = state_manager
+        self.source = (source or "").strip()
+        self.interval = interval
+
+    @property
+    def enabled(self):
+        return bool(self.source)
+
+    def _proxies(self):
+        """Route the pull the way the whole dashboard reads clearnet: an ``.onion`` OR any public /
+        not-provably-private source rides the bridge Tor SOCKS (DNS resolved proxy-side), so the
+        primary sees a Tor exit — never the backup's real IP (#160/#249). Only a provably-private,
+        loopback, or link-local IP *literal* dials direct, as a LAN hop. A hostname can't be proven
+        private without DNS, so it goes over Tor. This mirrors ``egress._xvb_standby_route`` exactly
+        (``local`` there == direct here), so the Security panel reports where this pull truly goes."""
+        return (
+            None
+            if _xvb_standby_route(self.source) == LOCAL
+            else {
+                "http": TOR_SOCKS_PROXY,
+                "https": TOR_SOCKS_PROXY,
+            }
+        )
+
+    def fetch_once(self):
+        """Pull the primary's ``/api/xvb-standby`` once and store it as standby. Returns the stored
+        blob, or ``None`` on any failure (kept silent — the last-held standby stands)."""
+        if not self.enabled:
+            return None
+        try:
+            resp = bounded_get(
+                self.source,
+                timeout=15,
+                proxies=self._proxies(),
+                headers={"User-Agent": "pithead-dashboard"},
+            )
+            if resp.status_code != 200:
+                logger.debug("Standby pull got HTTP %s (kept silent)", resp.status_code)
+                return None
+            standby = parse_standby(resp.json())
+        except (requests.RequestException, ValueError) as e:
+            logger.debug("Standby pull failed (kept silent): %s", e)
+            return None
+        if standby is None:
+            return None
+        standby["pulled_at"] = time.time()
+        self.state_manager.set_xvb_standby(standby)
+        logger.info(
+            "Pulled primary XvB standby: commanded %.3f, 1h %.0f / 24h %.0f, tier %s",
+            standby["commanded_fraction"],
+            standby["avg_1h"],
+            standby["avg_24h"],
+            standby["donation_level"] or "auto",
+        )
+        return standby
+
+    async def run(self):
+        """Poll the primary on ``interval`` while configured. A no-op forever when the source is
+        blank, so an ordinary single-stack install pays nothing."""
+        if not self.enabled:
+            logger.info("XvB standby puller idle (no xvb.standby.source configured).")
+            return
+        # Log only the enabled state, never the source URL — it can embed basic-auth userinfo, a
+        # capability secret that must not land in stdout/docker logs (mirrors healthchecks.py, which
+        # logs "enabled" and never the ping_url).
+        logger.info("Service Started: XvB standby puller (enabled).")
+        while True:
+            await asyncio.to_thread(self.fetch_once)
+            await asyncio.sleep(self.interval)
diff --git a/build/dashboard/mining_dashboard/sim/donation_model.py b/build/dashboard/mining_dashboard/sim/donation_model.py
index 49c859ed..e7bc5965 100644
--- a/build/dashboard/mining_dashboard/sim/donation_model.py
+++ b/build/dashboard/mining_dashboard/sim/donation_model.py
@@ -54,7 +54,9 @@
 
 
 class _FixedTiers:
-    """Minimal StateManager stand-in: the controller only needs `get_tiers()`."""
+    """Minimal StateManager stand-in for the closed-loop sim: `get_tiers()`, plus the cold
+    warm-resume reads (#249) so the controller seeds from feedforward — the simulator models a
+    fresh cold start, never a restart or failover, so both return the "no warm state" values."""
 
     def __init__(self, tiers=None):
         self._tiers = dict(tiers or TIER_DEFAULTS)
@@ -62,6 +64,12 @@ def __init__(self, tiers=None):
     def get_tiers(self):
         return dict(self._tiers)
 
+    def get_xvb_stats(self):
+        return {"commanded_fraction": 0.0}
+
+    def get_xvb_standby(self):
+        return None
+
 
 def make_algo_controller(algo, p2pool_difficulty=0) -> Controller:
     """Adapt a real `AlgoService` into a `decide(...) -> fraction` callable.
diff --git a/build/dashboard/mining_dashboard/web/server.py b/build/dashboard/mining_dashboard/web/server.py
index a5b3158c..04a18559 100644
--- a/build/dashboard/mining_dashboard/web/server.py
+++ b/build/dashboard/mining_dashboard/web/server.py
@@ -55,6 +55,31 @@ async def handle_state(request):
         return web.json_response({"error": "Failed to build dashboard state."}, status=500)
 
 
+async def handle_xvb_standby(request):
+    """The XvB controller state a BACKUP stack pulls to warm its donation split (#249).
+
+    Read-only, behind the same Caddy auth + loopback bind as ``/api/state`` — no new trust boundary
+    or egress class. The payload is the minimal warm state: the controller's commanded donation
+    fraction, XvB's credited 1h/24h averages (already public per-wallet), the target tier, and the
+    current mode. Always registered; on a stack with no backup nothing ever pulls it."""
+    state_mgr = request.app["state_manager"]
+    try:
+        xvb = state_mgr.get_xvb_stats()
+        return web.json_response(
+            {
+                "commanded_fraction": xvb.get("commanded_fraction", 0.0),
+                "avg_1h": xvb.get("avg_1h", 0.0),
+                "avg_24h": xvb.get("avg_24h", 0.0),
+                "mode": xvb.get("current_mode", ""),
+                "donation_level": config.XVB_DONATION_LEVEL,
+                "ts": xvb.get("last_update", 0.0),
+            }
+        )
+    except Exception:
+        logger.exception("Error building XvB standby state")
+        return web.json_response({"error": "Failed to build XvB standby state."}, status=500)
+
+
 async def handle_metrics(request):
     """Prometheus text exposition (#379), rendered from the same ``build_metrics`` snapshot
     ``/api/state`` uses — live gauges only, no history. Same trust boundary as the state API:
@@ -148,7 +173,12 @@ async def handle_control_commit(request):
     try:
         body = await request.json()
         rid = control_service.submit(
-            "commit", actor=request.headers.get("X-Auth-User", ""), intent_id=body.get("id")
+            "commit",
+            actor=request.headers.get("X-Auth-User", ""),
+            intent_id=body.get("id"),
+            # #719: the operator's typed confirmation for an in-scope disruptive change. It is
+            # friction, not a secret — the host gate requires it before a CONFIRM row proceeds.
+            confirm=body.get("confirm"),
         )
     except Exception:
         raise web.HTTPBadRequest(text="Body must be JSON with a valid intent 'id'.") from None
@@ -308,11 +338,35 @@ async def handle_control_result(request):
 # charset) before it reaches the browser — log content is attacker-influenceable input.
 
 
+def _merged_audit_entries(state_mgr):
+    """The Security panel's full audit feed (#530): the #33 log's live tail (read directly, so a
+    commit that landed since the last poll cycle shows immediately — no mirror lag) UNION the
+    durable ``audit_events`` table (the mirrored log history PLUS the out-of-band host-edit/rig-edit
+    detections, which never appear in control.log at all). Deduplicated by ``id`` — a control.log
+    row already mirrored to the DB is identical either way, so the DB copy wins and the direct log
+    read is skipped for it. Entries with no ``id`` (a handful of pre-auth "invalid"/"refused" rows,
+    #33) are never mirrored and so appear only while still in the log's own tail — a disclosed, minor
+    gap, not a bug. Sorted newest first by ``ts`` (both sources share one string format, so this is a
+    plain lexical sort, no parsing)."""
+    merged = {e["id"]: e for e in state_mgr.get_audit_events() if e.get("id")}
+    for e in audit_service.recent_changes():
+        eid = e.get("id")
+        if eid and eid not in merged:
+            merged[eid] = {**e, "source": "control"}
+        elif not eid:
+            # No stable id to dedupe on — always shown live from the log tail (never mirrored).
+            merged[f"log-{id(e)}"] = {**e, "source": "control"}
+    return sorted(merged.values(), key=lambda e: e.get("ts", ""), reverse=True)
+
+
 async def handle_audit_log(request):
-    """Recent config-change audit entries, from the read-only /control/audit mount. Registered
-    only alongside the control channel — the log is a #33 artifact."""
+    """Config-change audit entries — the #33 control-channel log plus the out-of-band host-edit /
+    rig-edit detections (#530), merged and persisted so the Security panel can group by hour/day/
+    month deeper than the log's own trimmed tail. Registered only alongside the control channel —
+    the log is a #33 artifact and the out-of-band watchers only run when it's on."""
     try:
-        return web.json_response({"entries": audit_service.recent_changes()})
+        state_mgr = request.app["state_manager"]
+        return web.json_response({"entries": _merged_audit_entries(state_mgr)})
     except Exception:
         logger.exception("Error reading the control audit log")
         return web.json_response({"error": "Failed to read the audit log."}, status=500)
@@ -371,6 +425,9 @@ def create_app(state_manager, latest_data_ref):
         [
             web.get("/", handle_index),
             web.get("/api/state", handle_state),
+            # Warm-standby state a backup stack pulls on failover (#249). Read-only, same auth as
+            # /api/state; harmless (and unread) on a stack with no backup.
+            web.get("/api/xvb-standby", handle_xvb_standby),
             web.get("/metrics", handle_metrics),
             web.get("/api/access", handle_access_log),
         ]
diff --git a/build/dashboard/mining_dashboard/web/static/configlogic.mjs b/build/dashboard/mining_dashboard/web/static/configlogic.mjs
index de4707c9..19c938fa 100644
--- a/build/dashboard/mining_dashboard/web/static/configlogic.mjs
+++ b/build/dashboard/mining_dashboard/web/static/configlogic.mjs
@@ -127,7 +127,9 @@ export const LOGICAL_GROUPS = [
       "p2pool.clearnet",
       "proxy",
       "xvb",
+      "local_miner",
       "dashboard.tari_required",
+      "dashboard.fail_closed",
     ],
   },
   { name: "Workers", prefixes: ["workers"] },
@@ -286,11 +288,20 @@ export function nestSection(section) {
 // CONTROL_DASHBOARD_EDITABLE_KEYS). A missing/empty set fails CLOSED — nothing is marked
 // editable — rather than defaulting to "everything editable" and silently reintroducing the
 // edit-then-reject problem this feature exists to remove.
-export function markEditable(sections, editableKeys) {
+//
+// `confirmKeys` is `_confirm_keys` (#719): the operationally-disruptive paths the gate WILL commit,
+// but only behind a type-to-confirm. They render editable (not greyed) and carry `confirm: true` so
+// the field can show a "confirm to proceed" affordance instead of the "host-only" one. A key on
+// both lists is treated as freely editable (editable wins); the gate is still the authority.
+export function markEditable(sections, editableKeys, confirmKeys) {
   const editable = new Set(editableKeys || []);
+  const confirm = new Set(confirmKeys || []);
   return sections.map((s) => ({
     name: s.name,
-    fields: s.fields.map((f) => ({ ...f, editable: editable.has(f.key) })),
+    fields: s.fields.map((f) => {
+      const isConfirm = !editable.has(f.key) && confirm.has(f.key);
+      return { ...f, editable: editable.has(f.key) || isConfirm, confirm: isConfirm };
+    }),
   }));
 }
 
diff --git a/build/dashboard/mining_dashboard/web/static/configview.mjs b/build/dashboard/mining_dashboard/web/static/configview.mjs
index a34ef4d0..1501cb25 100644
--- a/build/dashboard/mining_dashboard/web/static/configview.mjs
+++ b/build/dashboard/mining_dashboard/web/static/configview.mjs
@@ -73,6 +73,9 @@ async function pollResult(id, skip, max = POLL_MAX) {
 }
 
 const HOST_ONLY_TITLE = "Host-only — edit config.json and run ./pithead apply";
+// #719: an in-scope confirm-gated field IS editable, but committing it is disruptive — the review
+// modal makes you type APPLY. The tooltip sets that expectation up front.
+const CONFIRM_TITLE = "Editable — this change is disruptive; you'll type APPLY to confirm at Save";
 
 // `full` (#529): the pinned Core card mixes fields from several sections, so its rows need the
 // FULL dotted key ("monero.wallet_address") to stay unambiguous. A natural section keeps the
@@ -90,7 +93,7 @@ const Field = ({ field, edits, onEdit, full }) => {
   const editable = field.editable !== false;
   const value = field.key in edits ? edits[field.key] : field.value;
   const label = full ? field.key : field.path.slice(1).join(".") || field.path[0];
-  const title = editable ? undefined : HOST_ONLY_TITLE;
+  const title = !editable ? HOST_ONLY_TITLE : field.confirm ? CONFIRM_TITLE : undefined;
   const change = editable ? (e) => onEdit(field.key, e.target.value) : undefined;
   let input;
   if (field.type === "boolean") {
@@ -133,10 +136,13 @@ export const PreviewModal = ({
             changes.length === 0
               ? html`<p class="text-muted">No configuration changes detected.</p>`
               : html`<ul class="config-preview-list">
-                  ${changes.map(
-                    (c) => html`<li class=${c.flag === "DEST" ? "config-preview-dest" : ""}>
-                        ${c.flag === "DEST" ? "⚠ " : ""}${c.msg}</li>`,
-                  )}
+                  ${changes.map((c) => {
+                    // #719: CONFIRM rows (in-scope disruptive, confirm-gated) get the same warning
+                    // treatment as DEST — both are "disruptive" and both arm the type-APPLY box.
+                    const disruptive = c.flag === "DEST" || c.flag === "CONFIRM";
+                    return html`<li class=${disruptive ? "config-preview-dest" : ""}>
+                        ${disruptive ? "⚠ " : ""}${c.msg}</li>`;
+                  })}
               </ul>`
           }
           ${
@@ -166,6 +172,7 @@ export class ConfigView extends Component {
       sections: [],
       coreKeys: [],
       editableKeys: [], // #613: config paths the control gate will actually commit
+      confirmKeys: [], // #719: config paths the gate commits behind a type-to-confirm
       edits: {},
       mode: loadPref("dashboardConfigMode", ["form", "json"], "form"), // form | json (#529, persisted #658)
       editText: "",
@@ -201,6 +208,7 @@ export class ConfigView extends Component {
         sections: buildSections(cfg),
         coreKeys: cfg._core_keys || [],
         editableKeys: cfg._editable_keys || [],
+        confirmKeys: cfg._confirm_keys || [],
         edits: {},
         editText: JSON.stringify(cfg, null, 2),
         jsonError: null,
@@ -276,10 +284,15 @@ export class ConfigView extends Component {
     const id = this.state.preview.id;
     this.setState({ phase: "committing" });
     try {
+      // #719: an in-scope disruptive change (preview.destructive) rides its typed confirmation to
+      // the host gate, which requires it before a CONFIRM row proceeds. Friction, not a secret.
+      const body = this.state.preview.destructive
+        ? { id, confirm: this.state.confirmText }
+        : { id };
       const res = await fetch("/api/control/commit", {
         method: "POST",
         headers: CONTROL_HEADERS,
-        body: JSON.stringify({ id }),
+        body: JSON.stringify(body),
       });
       if (!res.ok && res.status !== 202) throw new Error(`HTTP ${res.status}`);
       let out = await res.json();
@@ -351,6 +364,7 @@ export class ConfigView extends Component {
       sections,
       coreKeys,
       editableKeys,
+      confirmKeys,
       edits,
       mode,
       editText,
@@ -394,7 +408,10 @@ export class ConfigView extends Component {
     const busy = phase === "previewing" || phase === "committing";
     const dirty = Object.keys(edits).length > 0;
     const canSave = mode === "json" ? !jsonError : dirty;
-    const { core, sections: groups } = regroupCore(markEditable(sections, editableKeys), coreKeys);
+    const { core, sections: groups } = regroupCore(
+      markEditable(sections, editableKeys, confirmKeys),
+      coreKeys,
+    );
     return html`<div class="config-view">
         ${error ? html`<div class="card"><p class="status-bad">${error}</p></div>` : null}
         <div class="toggle-group mb-1" role="group" aria-label="Config editor mode">
diff --git a/build/dashboard/mining_dashboard/web/static/dashboard.css b/build/dashboard/mining_dashboard/web/static/dashboard.css
index 97e59c1c..7aabc07a 100644
--- a/build/dashboard/mining_dashboard/web/static/dashboard.css
+++ b/build/dashboard/mining_dashboard/web/static/dashboard.css
@@ -419,6 +419,26 @@ tr:last-child td {
   white-space: nowrap;
 }
 
+/* The audit trail's title + its hour/day/month grouping select (#530), side by side. */
+.card-header-row {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 12px;
+  margin-bottom: 8px;
+}
+.card-header-row h3 {
+  margin: 0;
+}
+
+/* Audit-trail time-bucket header row (#530), between groups when the operator picks
+ * hour/day/month grouping. A raised, muted divider — readable, not another data row. */
+.audit-group-header td {
+  background: var(--elevated);
+  color: var(--text-muted);
+  font-weight: 600;
+}
+
 /* Components */
 .status-ok {
   color: var(--ok);
diff --git a/build/dashboard/mining_dashboard/web/static/securityview.mjs b/build/dashboard/mining_dashboard/web/static/securityview.mjs
index 992bc753..b79cad92 100644
--- a/build/dashboard/mining_dashboard/web/static/securityview.mjs
+++ b/build/dashboard/mining_dashboard/web/static/securityview.mjs
@@ -1,8 +1,9 @@
 // Security panel (#349): recent dashboard accesses (Caddy's access log, read-only) and the
-// config-change audit trail (the #33 host-side audit log, read-only). Both APIs serve
-// server-sanitized fields — the backend whitelists every character before it leaves the host
-// logs — and everything here renders through Preact text nodes, never markup, so a hostile log
-// line stays inert even if the server-side filter regressed.
+// config-change audit trail (the #33 host-side audit log, read-only, plus the #530 out-of-band
+// host-edit/rig-edit detections and their persisted history). Both APIs serve server-sanitized
+// fields — the backend whitelists every character before it leaves the host logs — and everything
+// here renders through Preact text nodes, never markup, so a hostile log line stays inert even if
+// the server-side filter regressed.
 //
 // The operator story: over Tor there is no source IP, so the attack signal is the RATE of 401s.
 // A burst of failed logins shows a rotate nudge — change the password, or mint a fresh onion
@@ -12,6 +13,36 @@ import { Component, html } from "./preact.mjs";
 
 const ACCESS_LIMIT_SHOWN = 20;
 
+// Audit entries share one ts format across every source (control.log's own writer and the #530
+// watchers both emit "YYYY-MM-DDTHH:MM:SSZ", see data_service._iso_now), so a bucket key is a
+// plain string slice — no date parsing, no timezone math.
+export function bucketKey(ts, granularity) {
+  if (typeof ts !== "string") return "";
+  if (granularity === "hour") return ts.slice(0, 13);
+  if (granularity === "month") return ts.slice(0, 7);
+  return ts.slice(0, 10); // "day"
+}
+
+// Group already newest-first ``entries`` into contiguous {bucket, entries} runs for
+// ``granularity`` ("hour"|"day"|"month"), or one ungrouped run for "flat"/anything else — the
+// drill: pick "month" to scan a year at a glance, "hour" to pin down one incident.
+export function groupAuditEntries(entries, granularity) {
+  if (granularity !== "hour" && granularity !== "day" && granularity !== "month") {
+    return [{ bucket: null, entries }];
+  }
+  const groups = [];
+  let current = null;
+  for (const e of entries) {
+    const key = bucketKey(e.ts, granularity);
+    if (!current || current.bucket !== key) {
+      current = { bucket: key, entries: [] };
+      groups.push(current);
+    }
+    current.entries.push(e);
+  }
+  return groups;
+}
+
 // Epoch seconds -> local "YYYY-MM-DD HH:MM:SS"-style string; blank for a missing/zero ts.
 export function fmtEpoch(ts) {
   if (!Number.isFinite(ts) || ts <= 0) return "";
@@ -63,11 +94,33 @@ const AccessCard = ({ access }) => {
   </div>`;
 };
 
-const AuditCard = ({ audit }) => {
+// Outcome values a "detected" (never applied/rejected) out-of-band row never has, so it keeps its
+// own neutral styling instead of picking up the "applied" green.
+const AuditRow = (e) => html`<tr>
+    <td>${e.ts}</td>
+    <td>${e.actor}</td>
+    <td>${e.action}</td>
+    <td class=${e.status === "applied" ? "status-ok" : ""}>${e.status}</td>
+    <td class="font-mono">${e.keys}</td>
+</tr>`;
+
+const AuditCard = ({ audit, group, onGroupChange }) => {
   // null = control channel off (the /api/audit route 404s) — no card at all.
   if (!audit) return null;
   return html`<div class="card">
-      <h3>Recent config changes</h3>
+      <div class="card-header-row">
+          <h3>Recent config changes</h3>
+          ${
+            audit.length > 0
+              ? html`<select aria-label="Group audit trail by" value=${group} onChange=${(e) => onGroupChange(e.target.value)}>
+                  <option value="flat">All (newest first)</option>
+                  <option value="hour">Group by hour</option>
+                  <option value="day">Group by day</option>
+                  <option value="month">Group by month</option>
+              </select>`
+              : null
+          }
+      </div>
       ${
         audit.length === 0
           ? html`<p class="text-muted">No config changes have gone through the dashboard yet.</p>`
@@ -75,15 +128,14 @@ const AuditCard = ({ audit }) => {
               <table>
                   <thead><tr><th>Time (UTC)</th><th>User</th><th>Action</th><th>Outcome</th><th>Settings</th></tr></thead>
                   <tbody>
-                      ${audit.map(
-                        (e) => html`<tr>
-                            <td>${e.ts}</td>
-                            <td>${e.actor}</td>
-                            <td>${e.action}</td>
-                            <td class=${e.status === "applied" ? "status-ok" : ""}>${e.status}</td>
-                            <td class="font-mono">${e.keys}</td>
-                        </tr>`,
-                      )}
+                      ${groupAuditEntries(audit, group).flatMap((g) => [
+                        g.bucket !== null
+                          ? html`<tr class="audit-group-header">
+                              <td colspan="5">${g.bucket} (${g.entries.length})</td>
+                          </tr>`
+                          : null,
+                        ...g.entries.map(AuditRow),
+                      ])}
                   </tbody>
               </table>
           </div>`
@@ -94,7 +146,10 @@ const AuditCard = ({ audit }) => {
 export class SecurityPanel extends Component {
   constructor(props) {
     super(props);
-    this.state = { access: null, audit: null, error: null };
+    // auditGroup: "flat" (today's plain newest-first list) is the default so existing behavior
+    // doesn't change until the operator opts into grouping (#530).
+    this.state = { access: null, audit: null, auditGroup: "flat", error: null };
+    this.setAuditGroup = (group) => this.setState({ auditGroup: group });
   }
 
   async componentDidMount() {
@@ -110,11 +165,11 @@ export class SecurityPanel extends Component {
   }
 
   render() {
-    const { access, audit, error } = this.state;
+    const { access, audit, auditGroup, error } = this.state;
     if (error) return html`<div class="card"><p class="status-bad">${error}</p></div>`;
     return html`<div class="grid">
         <${AccessCard} access=${access} />
-        <${AuditCard} audit=${audit} />
+        <${AuditCard} audit=${audit} group=${auditGroup} onGroupChange=${this.setAuditGroup} />
     </div>`;
   }
 }
diff --git a/build/dashboard/mining_dashboard/web/views.py b/build/dashboard/mining_dashboard/web/views.py
index d3921f8b..4acd31a9 100644
--- a/build/dashboard/mining_dashboard/web/views.py
+++ b/build/dashboard/mining_dashboard/web/views.py
@@ -335,6 +335,77 @@ def _window_reject_pct(rows, seconds):
     return "—" if pct is None else f"{pct:.2f}%"
 
 
+# --------------------------------------------------------------------------------------
+# #196 Tier-1 telemetry backbone: blocks / disk_growth / xvb_history surfaced on /api/state.
+# The backbone (capture + storage + retention, PR #600) shipped without this exposure step —
+# these three formatters are it. network_history and worker_history are Tier-2 (a separate
+# slice of the epic) and are not exposed here.
+# --------------------------------------------------------------------------------------
+
+
+def _downsample_gauge_rows(rows, value_cols, target=_MAX_CHART_POINTS):
+    """Bucket-average arbitrary point-in-time (gauge) columns down to ``target`` points.
+
+    Mirrors ``_downsample_share_stats``, but averages instead of summing: these rows are
+    periodic READINGS (disk size, XvB credited averages), not per-interval deltas, so summing
+    them would inflate the series instead of thinning it. A no-op when already at/under target."""
+    if len(rows) <= target:
+        return rows
+    chunk_size = len(rows) / target
+    out = []
+    for i in range(target):
+        chunk = rows[int(i * chunk_size) : int((i + 1) * chunk_size)]
+        if not chunk:
+            continue
+        bucket = {"ts": chunk[len(chunk) // 2]["ts"]}
+        for col in value_cols:
+            vals = [r.get(col, 0) or 0 for r in chunk]
+            bucket[col] = round(sum(vals) / len(vals), 2)
+        out.append(bucket)
+    return out
+
+
+def build_blocks(blocks, range_arg, window=None):
+    """Persisted P2Pool block-found events (#196) as chart-ready points, restricted to the
+    selected range/window (``_filter_events`` bounds any ts-keyed list, so this table reuses
+    it as-is). A handful of rows a week — no downsampling needed."""
+    return [
+        {
+            "x": int(b["ts"] * 1000),
+            "height": b.get("height", 0),
+            "difficulty": b.get("difficulty", 0),
+        }
+        for b in _filter_events(blocks, range_arg, window)
+    ]
+
+
+def _gauge_series(rows, range_arg, window, value_cols):
+    """Shared shape for a persisted gauge series (#196): filter to the selected range/window,
+    bucket-average past ``_MAX_CHART_POINTS`` like ``share_stats``, and key each row's own
+    ``value_cols`` under ``x`` (ms epoch). ``build_disk_growth``/``build_xvb_history`` are this
+    with their own column set — the only thing that differs between them."""
+    filtered = _downsample_gauge_rows(_filter_events(rows, range_arg, window), value_cols)
+    return [{"x": int(r["ts"] * 1000), **{c: r.get(c, 0) for c in value_cols}} for r in filtered]
+
+
+def build_disk_growth(rows, range_arg, window=None):
+    """Persisted hourly monerod-DB-size + host-disk-usage samples (#196) as chart-ready points —
+    the table keeps every row (no retention prune), so a long-lived install can otherwise pass
+    the chart-point cap ``_gauge_series`` bounds it at."""
+    return _gauge_series(
+        rows, range_arg, window, ("monero_db_bytes", "disk_used_gb", "disk_total_gb")
+    )
+
+
+def build_xvb_history(rows, range_arg, window=None):
+    """Persisted ~5-minute XvB-credited scalar samples (#196) as chart-ready points — the 30-day
+    retention at this cadence is ~8.6k rows, well past the chart-point cap ``_gauge_series``
+    bounds it at."""
+    return _gauge_series(
+        rows, range_arg, window, ("avg_1h", "avg_24h", "fail_count", "donation_fraction")
+    )
+
+
 def _window_duration(filtered_history, range_arg, window):
     """Seconds the chart currently spans — drives adaptive resolution/smoothing. From the
     window if zoomed, else the preset length, else (``all``/unknown) the actual data extent."""
@@ -1224,6 +1295,17 @@ def build_badges(data, metrics, mode_variant, db_healthy=True, wallet_change=Non
                 "title": "p2pool and xmrig-proxy are held until the required chains finish syncing",
             }
         )
+    # Fail-closed miner hold on an unrecoverable health failure (Issue #490), opt-in via
+    # dashboard.fail_closed. Distinct from the sync-gate badge above — this fires post-sync.
+    if data.get("fail_closed_held"):
+        badges.append(
+            {
+                "text": "Miner held (fail-closed)",
+                "variant": "bad",
+                "title": "dashboard.fail_closed is on and an unrecoverable health failure is "
+                "holding p2pool and xmrig-proxy until it clears",
+            }
+        )
     # Non-blocking Tari (Issue #51): stay operational, surface a top-bar badge with the live
     # percentage once known (omitted early so it isn't a stale "0%").
     if data.get("tari_syncing_passive"):
@@ -1703,6 +1785,10 @@ def build_state(data, state_mgr, range_arg, window=None, avg_window=DEFAULT_HASH
             xvb_day=xvb_current_tier_reward_day(metrics, state_mgr),
         ),
         "xvb_calc": build_xvb_calc(metrics, state_mgr),
+        # On a backup stack, the XvB controller state last pulled from the primary (#249) — held as
+        # standby, adopted only at failover. None on a single stack (nothing pulls). Inspectable so
+        # an operator can confirm the backup is warm before it takes over.
+        "xvb_standby": state_mgr.get_xvb_standby(),
         "tari": build_tari(data),
         "workers": build_workers(data.get("workers", []), data.get("rigforge_release")),
         # Fleet power draw / efficiency and (once a price is set) net profit after power (#260),
@@ -1713,6 +1799,12 @@ def build_state(data, state_mgr, range_arg, window=None, avg_window=DEFAULT_HASH
         # proxy_summary so its (cumulative) shape stays unchanged for existing clients.
         "share_stats": build_share_stats(share_stats, range_arg, window),
         "reject_pct_24h": _window_reject_pct(share_stats, 24 * 3600),
+        # #196 Tier-1 telemetry backbone exposure: block-found events, hourly disk-growth
+        # samples, and ~5-min XvB-credited samples. No chart renders these yet — that's the
+        # deliberate next slice — the payload just carries the persisted series.
+        "blocks": build_blocks(state_mgr.get_blocks(), range_arg, window),
+        "disk_growth": build_disk_growth(state_mgr.get_disk_growth(), range_arg, window),
+        "xvb_history": build_xvb_history(state_mgr.get_xvb_history(), range_arg, window),
         "egress": egress,
         "topology": topology,
         "chart": build_chart(
diff --git a/build/dashboard/pyproject.toml b/build/dashboard/pyproject.toml
index f56d129d..0a89cadb 100644
--- a/build/dashboard/pyproject.toml
+++ b/build/dashboard/pyproject.toml
@@ -7,13 +7,13 @@ name = "mining-dashboard"
 # Keep in lockstep with the top-level VERSION file — the single source of truth for the stack version
 # (#44). A shell test (tests/stack/run.sh) fails if these drift; the dashboard *displays* the version
 # from VERSION (baked in as PITHEAD_VERSION, #58), so this is packaging metadata only.
-version = "1.10.2"
+version = "1.11.0"
 description = "Monitoring dashboard and XvB switching engine for Pithead"
 readme = "README.md"
 requires-python = ">=3.11"
 license = { text = "MIT" }
 dependencies = [
-  "aiohttp>=3.10.11",
+  "aiohttp>=3.14.2",
   # [socks] pulls in PySocks so the XvB stats fetch can route over the Tor SOCKS proxy (#163).
   "requests[socks]>=2.34.2",
   # grpcio/protobuf floors are dictated by the checked-in Tari gRPC stubs
@@ -34,11 +34,11 @@ test = [
   # diff-cover (#286): patch-coverage gate — new/changed lines must be >=90% covered.
   "diff-cover>=9",
   # hypothesis (#284): property-based tests asserting invariants on the money/numeric logic.
-  "hypothesis>=6.156.6",
+  "hypothesis>=6.158.0",
 ]
 # Developer tooling (Wave 7, #280). Pinned so local, pre-commit, and CI all run the SAME ruff
 # — lint output is version-sensitive, so a floor would let CI and a contributor disagree.
-dev = ["ruff==0.15.21", "pre-commit>=4"]
+dev = ["ruff==0.15.22", "pre-commit>=4"]
 
 [tool.setuptools.packages.find]
 include = ["mining_dashboard*"]
diff --git a/build/dashboard/tests/config/test_config.py b/build/dashboard/tests/config/test_config.py
index 34e59d8d..75aebdc0 100644
--- a/build/dashboard/tests/config/test_config.py
+++ b/build/dashboard/tests/config/test_config.py
@@ -41,6 +41,19 @@ def test_monero_prune_accepts_falsy_forms(self):
             with patch.dict(os.environ, {"MONERO_PRUNE": v}):
                 assert _reload_config().MONERO_PRUNE is False, f"{v!r} should be full"
 
+    def test_fail_closed_defaults_off(self):
+        # #490: the dashboard is an observability layer, so a cosmetic fault must never idle the
+        # fleet by default — absent DASHBOARD_FAIL_CLOSED must read False.
+        with patch.dict(os.environ, {}, clear=False):
+            os.environ.pop("DASHBOARD_FAIL_CLOSED", None)
+            assert _reload_config().DASHBOARD_FAIL_CLOSED is False
+
+    def test_fail_closed_env_override(self):
+        with patch.dict(os.environ, {"DASHBOARD_FAIL_CLOSED": "true"}):
+            assert _reload_config().DASHBOARD_FAIL_CLOSED is True
+        with patch.dict(os.environ, {"DASHBOARD_FAIL_CLOSED": "false"}):
+            assert _reload_config().DASHBOARD_FAIL_CLOSED is False
+
     def test_update_interval_tolerates_bad_values(self):
         # A malformed override must fall back to the default, not crash the dashboard at import.
         for v, expected in [("2", 2), ("2.5", 2), ("", 30), ("nonsense", 30)]:
diff --git a/build/dashboard/tests/frontend/configlogic.test.mjs b/build/dashboard/tests/frontend/configlogic.test.mjs
index 47ea74d0..44eebfdb 100644
--- a/build/dashboard/tests/frontend/configlogic.test.mjs
+++ b/build/dashboard/tests/frontend/configlogic.test.mjs
@@ -314,6 +314,25 @@ test("markEditable: host-only fields (e.g. dashboard.auth.password, a security/s
   assert.equal(password.editable, false);
 });
 
+// --- Confirm-gated set (#719) -------------------------------------------------------------------
+
+const fieldsByKey = (sections) =>
+  Object.fromEntries(sections.flatMap((s) => s.fields).map((f) => [f.key, f]));
+
+test("markEditable: a confirm-gated key is editable AND flagged confirm; host-only stays neither", () => {
+  const byKey = fieldsByKey(markEditable(buildSections(CFG), [], ["monero.prune"]));
+  assert.equal(byKey["monero.prune"].editable, true); // editable...
+  assert.equal(byKey["monero.prune"].confirm, true); // ...but confirm-to-proceed
+  assert.equal(byKey["monero.wallet_address"].editable, false); // host-only untouched
+  assert.equal(byKey["monero.wallet_address"].confirm, false);
+});
+
+test("markEditable: editable wins over confirm — a key on both lists is freely editable, not gated", () => {
+  const byKey = fieldsByKey(markEditable(buildSections(CFG), ["monero.prune"], ["monero.prune"]));
+  assert.equal(byKey["monero.prune"].editable, true);
+  assert.equal(byKey["monero.prune"].confirm, false); // no needless friction on a freely-editable key
+});
+
 // --- JSON mode's whole-config parse (#529) ----------------------------------------------------
 
 test("parseConfigJson: valid JSON builds the same staged config shape applyEdits does", () => {
diff --git a/build/dashboard/tests/frontend/configview.test.mjs b/build/dashboard/tests/frontend/configview.test.mjs
index d6b85715..4f6e238c 100644
--- a/build/dashboard/tests/frontend/configview.test.mjs
+++ b/build/dashboard/tests/frontend/configview.test.mjs
@@ -192,6 +192,37 @@ test("an empty preview leaves Confirm disabled", () => {
   assert.match(out, /disabled/); // nothing to commit
 });
 
+// --- Confirm-gated disruptive change in the modal (#719) --------------------------------------
+//
+// An in-scope disruptive change previews as destructive (a CONFIRM row). The modal must warn (⚠),
+// show the type-APPLY box, and keep Confirm disabled until the operator types the literal APPLY.
+const CONFIRM_PREVIEW = {
+  changes: [
+    { flag: "CONFIRM", key: "monero.clearnet_initial_sync", msg: "Clearnet initial sync ENABLED — host IP exposed during IBD." },
+  ],
+  destructive: true,
+};
+
+test("a CONFIRM change warns and gates Confirm behind the typed APPLY (#719)", () => {
+  const notYet = renderToString(
+    PreviewModal({ preview: CONFIRM_PREVIEW, confirmText: "", busy: false }),
+  );
+  assert.match(notYet, /⚠/); // the disruptive row is warned
+  assert.match(notYet, /host IP exposed during IBD/);
+  assert.match(notYet, /Type <code>APPLY<\/code> to confirm/); // the type-to-confirm box is shown
+  // Confirm is still disabled — the confirm-apply button carries `disabled` until APPLY is typed.
+  const btnNotYet = notYet.match(/<button class="btn-toggle active"[^>]*>/)[0];
+  assert.match(btnNotYet, /disabled/);
+});
+
+test("a CONFIRM change arms Confirm once APPLY is typed (#719)", () => {
+  const armed = renderToString(
+    PreviewModal({ preview: CONFIRM_PREVIEW, confirmText: "APPLY", busy: false }),
+  );
+  const btnArmed = armed.match(/<button class="btn-toggle active"[^>]*>/)[0];
+  assert.doesNotMatch(btnArmed, /disabled/); // now committable
+});
+
 // --- Core-vs-sections regroup + two edit modes (#529, RATIFIED Wave-0) -----------------------
 //
 // The form/JSON split and the collapse-by-default sections, driven by ConfigView.state directly —
@@ -324,6 +355,18 @@ test("form mode: a field IN the editable set renders enabled, no host-only toolt
   assert.doesNotMatch(poolField[0], /disabled/);
 });
 
+test("form mode: a confirm-gated field renders enabled with the confirm-to-proceed tooltip, not host-only (#719)", () => {
+  const inst = readyView();
+  inst.state.editableKeys = []; // nothing freely editable
+  inst.state.confirmKeys = ["monero.prune"]; // ...but prune is confirm-gated
+  const out = renderToString(inst.render());
+  const pruneField = out.match(/<label[^>]*>\s*<span class="config-field-name">[^<]*prune<\/span>.*?<\/label>/s);
+  assert.ok(pruneField, "expected to find the monero.prune field");
+  assert.doesNotMatch(pruneField[0], /disabled/); // editable, not greyed
+  assert.doesNotMatch(pruneField[0], /Host-only/); // not the host-only tooltip
+  assert.match(pruneField[0], /you'll type APPLY to confirm/); // the confirm affordance
+});
+
 test("form mode: an empty editable set (host not yet reporting _editable_keys) greys out every field", () => {
   const inst = readyView();
   inst.state.editableKeys = [];
diff --git a/build/dashboard/tests/frontend/securityview.test.mjs b/build/dashboard/tests/frontend/securityview.test.mjs
index bd49fb64..a8bff9ed 100644
--- a/build/dashboard/tests/frontend/securityview.test.mjs
+++ b/build/dashboard/tests/frontend/securityview.test.mjs
@@ -11,14 +11,19 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 
-import { fmtEpoch, SecurityPanel } from "../../mining_dashboard/web/static/securityview.mjs";
+import {
+  bucketKey,
+  fmtEpoch,
+  groupAuditEntries,
+  SecurityPanel,
+} from "../../mining_dashboard/web/static/securityview.mjs";
 import { renderToString } from "./helpers/render.mjs";
 
 // Render the panel with its state pre-set (the render probe runs no effects, so the fetches in
 // componentDidMount never fire — state is injected directly, like the configview tests).
 function renderPanel(state) {
   const panel = new SecurityPanel({});
-  panel.state = { access: null, audit: null, error: null, ...state };
+  panel.state = { access: null, audit: null, auditGroup: "flat", error: null, ...state };
   return renderToString(panel.render());
 }
 
@@ -100,3 +105,92 @@ test("fetch error surfaces as a message, not a blank panel", () => {
   const out = renderPanel({ error: "TypeError: fetch failed" });
   assert.match(out, /fetch failed/);
 });
+
+// #530: hour/day/month grouping for the audit trail.
+
+test("bucketKey: hour/day/month slice the shared ts format; unknown granularity ignored by the caller", () => {
+  const ts = "2026-07-20T14:35:00Z";
+  assert.equal(bucketKey(ts, "hour"), "2026-07-20T14");
+  assert.equal(bucketKey(ts, "day"), "2026-07-20");
+  assert.equal(bucketKey(ts, "month"), "2026-07");
+  assert.equal(bucketKey(42, "day"), ""); // non-string ts never throws
+});
+
+test("groupAuditEntries: flat/unknown granularity returns one ungrouped run", () => {
+  const entries = [{ ts: "2026-07-20T00:00:00Z" }, { ts: "2026-07-19T00:00:00Z" }];
+  assert.deepEqual(groupAuditEntries(entries, "flat"), [{ bucket: null, entries }]);
+  assert.deepEqual(groupAuditEntries(entries, undefined), [{ bucket: null, entries }]);
+});
+
+test("groupAuditEntries: contiguous same-day entries collapse into one bucket", () => {
+  const entries = [
+    { ts: "2026-07-20T14:00:00Z", actor: "a" },
+    { ts: "2026-07-20T09:00:00Z", actor: "b" },
+    { ts: "2026-07-19T23:00:00Z", actor: "c" },
+  ];
+  const groups = groupAuditEntries(entries, "day");
+  assert.equal(groups.length, 2);
+  assert.equal(groups[0].bucket, "2026-07-20");
+  assert.equal(groups[0].entries.length, 2);
+  assert.equal(groups[1].bucket, "2026-07-19");
+  assert.equal(groups[1].entries.length, 1);
+});
+
+test("groupAuditEntries: month grouping spans multiple days in one bucket", () => {
+  const entries = [
+    { ts: "2026-07-20T00:00:00Z" },
+    { ts: "2026-07-01T00:00:00Z" },
+    { ts: "2026-06-30T00:00:00Z" },
+  ];
+  const groups = groupAuditEntries(entries, "month");
+  assert.deepEqual(
+    groups.map((g) => [g.bucket, g.entries.length]),
+    [
+      ["2026-07", 2],
+      ["2026-06", 1],
+    ],
+  );
+});
+
+test("audit card: default flat grouping shows no group-header row (unchanged row output)", () => {
+  const out = renderPanel({
+    access: { available: true, entries: [] },
+    audit: [{ ts: "2026-07-20T12:00:00Z", actor: "admin", action: "commit", status: "applied", keys: "XVB_ENABLED" }],
+  });
+  assert.doesNotMatch(out, /audit-group-header/);
+  assert.match(out, /XVB_ENABLED/);
+});
+
+test("audit card: grouping select appears once there are entries, with the current group selected", () => {
+  const out = renderPanel({
+    access: { available: true, entries: [] },
+    audit: [{ ts: "2026-07-20T12:00:00Z", actor: "admin", action: "commit", status: "applied", keys: "XVB_ENABLED" }],
+    auditGroup: "day",
+  });
+  assert.match(out, /<select/);
+  assert.match(out, /Group by day/);
+  // Accessibility parity (#530 review): a bare <select> with no associated <label> has no
+  // accessible name for a screen reader — every other select/group control in this codebase
+  // carries one (role=group aria-label, or a <label for>, see xvb-tier-select).
+  assert.match(out, /aria-label="Group audit trail by"/);
+});
+
+test("audit card: day grouping renders one header row per distinct day, spanning the table", () => {
+  const out = renderPanel({
+    access: { available: true, entries: [] },
+    auditGroup: "day",
+    audit: [
+      { ts: "2026-07-20T12:00:00Z", actor: "admin", action: "commit", status: "applied", keys: "A" },
+      { ts: "2026-07-19T08:00:00Z", actor: "admin", action: "commit", status: "applied", keys: "B" },
+    ],
+  });
+  assert.match(out, /class="audit-group-header"/);
+  assert.match(out, /colspan="5"/);
+  assert.match(out, /2026-07-20 \(1\)/);
+  assert.match(out, /2026-07-19 \(1\)/);
+});
+
+test("audit card: empty list shows no grouping select (nothing to group)", () => {
+  const out = renderPanel({ access: { available: true, entries: [] }, audit: [] });
+  assert.doesNotMatch(out, /<select/);
+});
diff --git a/build/dashboard/tests/service/test_alert_service.py b/build/dashboard/tests/service/test_alert_service.py
index 14625585..42fbc59a 100644
--- a/build/dashboard/tests/service/test_alert_service.py
+++ b/build/dashboard/tests/service/test_alert_service.py
@@ -672,6 +672,44 @@ async def test_disabled_notifier_still_persists_wallet_baseline(self):
         assert store["payout_wallet_prev8"] == _W_A[:8]
         assert float(store["payout_wallet_changed_ts"]) > 0
 
+    async def test_disabled_notifier_still_updates_container_health_tracker(self):
+        # #490: dashboard.fail_closed reads svc.containers.is_confirmed_bad("dashboard") off the
+        # SAME tracker this alerting path would otherwise be the only feeder for — it must stay fed
+        # every cycle even with every sink off (the default stack), or a fail_closed operator with
+        # Telegram off would never see the dashboard crash/unhealthy signal used to gate the hold.
+        # `now` rides the signals through to containers.update, so a healthy→unhealthy streak past
+        # the 120s debounce confirms through the disabled path — proving it's genuinely fed (a
+        # never-fed tracker would stay not-confirmed).
+        svc = _svc(notifier=_FakeNotifier(enabled=False))
+        base = dict(
+            monero_down=False,
+            tari_down=False,
+            tari_required=True,
+            miner_released=True,
+            workers=[],
+            workers_expected=False,
+        )
+
+        def snap(health, now):
+            return dict(
+                base,
+                now=now,
+                containers={
+                    "dashboard": {
+                        "running": True,
+                        "restarting": False,
+                        "restart_count": 0,
+                        "health": health,
+                    }
+                },
+            )
+
+        await svc.process(**snap("healthy", 1000))  # known, healthy baseline
+        await svc.process(**snap("unhealthy", 1000))  # streak starts
+        assert svc.containers.is_confirmed_bad("dashboard") is False  # too young to gate
+        await svc.process(**snap("unhealthy", 1130))  # past 120s -> confirmed
+        assert svc.containers.is_confirmed_bad("dashboard") is True
+
     async def test_disabled_path_swallows_wallet_baseline_error(self):
         # A broken kv store must not break the data loop, Telegram on or off.
         def boom(_k, _v=None):
@@ -689,6 +727,29 @@ def boom(_k, _v=None):
         )
         assert out == []
 
+    async def test_disabled_path_swallows_container_health_update_error(self):
+        # Same "never break the data loop" contract as the wallet baseline above, for the #490
+        # container-health feed.
+        svc = _svc(notifier=_FakeNotifier(enabled=False))
+        svc.containers.update = lambda *_a, **_kw: (_ for _ in ()).throw(RuntimeError("boom"))
+        out = await svc.process(
+            monero_down=False,
+            tari_down=False,
+            tari_required=True,
+            miner_released=True,
+            workers=[],
+            workers_expected=False,
+            containers={
+                "dashboard": {
+                    "running": True,
+                    "restarting": False,
+                    "restart_count": 0,
+                    "health": None,
+                }
+            },
+        )
+        assert out == []
+
     async def test_enabled_notifier_dispatches(self):
         notifier = _FakeNotifier()
         svc = _svc(notifier=notifier)
diff --git a/build/dashboard/tests/service/test_algo_service.py b/build/dashboard/tests/service/test_algo_service.py
index 3921d4b8..7b7544b0 100644
--- a/build/dashboard/tests/service/test_algo_service.py
+++ b/build/dashboard/tests/service/test_algo_service.py
@@ -18,6 +18,10 @@
 def algo():
     state_manager = MagicMock()
     state_manager.get_tiers.return_value = dict(TIER_DEFAULTS)
+    # Cold controller by default (#249): no persisted commanded fraction, no standby held — so
+    # the warm-resume seed falls through to feedforward. Warm-resume tests override these.
+    state_manager.get_xvb_stats.return_value = {"commanded_fraction": 0.0}
+    state_manager.get_xvb_standby.return_value = None
     proxy_client = MagicMock()  # called via asyncio.to_thread -> sync methods
     data_service = MagicMock()
     data_service.workers_rejected = False  # not rejecting workers (Issue #31 guard off)
@@ -645,3 +649,53 @@ async def test_run_skips_switching_while_workers_rejected(self, algo):
             with pytest.raises(Exception):
                 await algo.run()
         assert not algo.switch_miners.called
+
+
+class TestWarmResume:
+    """Warm-resume of the closed-loop state on restart / backup failover (#249).
+
+    The seed precedence is: this host's own persisted commanded fraction (a restart, or a stack
+    that has already steered) beats the primary's standby (a first failover), which beats the cold
+    feedforward estimate (a fresh install with no history)."""
+
+    def test_seed_prefers_own_persisted_fraction(self, algo):
+        # Own state wins over standby: an authoritative stack owns its steering, so a stale standby
+        # from a departed primary can't override it.
+        algo.state_manager.get_xvb_stats.return_value = {"commanded_fraction": 0.4}
+        algo.state_manager.get_xvb_standby.return_value = {"commanded_fraction": 0.9}
+        assert algo._seed_donation_fraction(1000, 2000, 0.85) == 0.4
+
+    def test_seed_adopts_standby_when_no_own_state(self, algo):
+        # The failover case: an idle backup never steered (own fraction 0.0), so at handover it
+        # adopts the primary's last-known commanded fraction.
+        algo.state_manager.get_xvb_stats.return_value = {"commanded_fraction": 0.0}
+        algo.state_manager.get_xvb_standby.return_value = {"commanded_fraction": 0.3}
+        assert algo._seed_donation_fraction(1000, 2000, 0.85) == 0.3
+
+    def test_seed_clamps_standby_to_vip_reserve(self, algo):
+        algo.state_manager.get_xvb_stats.return_value = {"commanded_fraction": 0.0}
+        algo.state_manager.get_xvb_standby.return_value = {"commanded_fraction": 0.99}
+        assert algo._seed_donation_fraction(1000, 2000, 0.5) == 0.5
+
+    def test_seed_cold_start_uses_feedforward_when_no_state(self, algo):
+        # Fresh install: no own state, no standby -> the original feedforward seed, unchanged.
+        algo.state_manager.get_xvb_stats.return_value = {"commanded_fraction": 0.0}
+        algo.state_manager.get_xvb_standby.return_value = None
+        # reference = 1000 + min(1000*0.03, 1000) = 1030; feedforward = 1030 / current_hr.
+        assert algo._seed_donation_fraction(1000, 2000, 0.85) == pytest.approx(1030 / 2000)
+
+    def test_get_decision_seeds_from_standby_on_failover(self, algo):
+        # Integration: the first real donating cycle on a warm backup adopts the standby fraction
+        # rather than cold-ramping from feedforward.
+        algo.state_manager.get_xvb_stats.return_value = {"commanded_fraction": 0.0}
+        algo.state_manager.get_xvb_standby.return_value = {"commanded_fraction": 0.35}
+        assert algo.donation_fraction is None
+        algo.get_decision(
+            2000,
+            2000,
+            POOL_STATS,
+            P2P_MAIN,
+            {"avg_1h": 500, "last_update": _fresh_ts()},
+            RECENT_SHARES,
+        )
+        assert algo.donation_fraction == pytest.approx(0.35)
diff --git a/build/dashboard/tests/service/test_container_health.py b/build/dashboard/tests/service/test_container_health.py
index 33a59eaf..0cc20ab0 100644
--- a/build/dashboard/tests/service/test_container_health.py
+++ b/build/dashboard/tests/service/test_container_health.py
@@ -230,3 +230,55 @@ def test_stop_while_unhealthy_pending_resets_the_streak(self):
         clock.advance(120)
         # Back up and unhealthy again: the streak starts fresh, so no immediate edge.
         assert m.update({"monerod": _s(health="unhealthy")}) == []
+
+
+class TestIsConfirmedBad:
+    """Confirmed-level read (#490) — dashboard.fail_closed gates on a debounce-CONFIRMED bad
+    verdict, never on a first-sighting seed that skipped the debounce. A false positive here idles
+    the fleet, so the bar is the same 120s / crash-loop debounce a KNOWN container must pass."""
+
+    def test_unknown_container_is_not_confirmed_bad(self):
+        m, _clock = _monitor()
+        assert m.is_confirmed_bad("dashboard") is False
+
+    def test_first_sighting_unhealthy_seed_is_not_confirmed(self):
+        # The seed sets state="bad" silently (no alert edge) — it must ALSO not read as confirmed,
+        # or fail_closed would hold the fleet on a container the debounce never vetted (#490 F1).
+        m, _clock = _monitor()
+        m.update({"dashboard": _s(health="unhealthy")})
+        assert m.is_confirmed_bad("dashboard") is False
+
+    def test_transient_unhealthy_on_known_container_not_confirmed_before_debounce(self):
+        # A KNOWN (healthy-first) container reported unhealthy on a single poll must NOT confirm
+        # until the streak clears unhealthy_after (120s) — the transient-never-gates property.
+        m, clock = _monitor()
+        m.update({"dashboard": _s(health="healthy")})  # known, healthy baseline
+        clock.advance(30)
+        assert m.update({"dashboard": _s(health="unhealthy")}) == []
+        assert m.is_confirmed_bad("dashboard") is False  # streak too young to gate
+        clock.advance(60)  # 90s total < 120s
+        m.update({"dashboard": _s(health="unhealthy")})
+        assert m.is_confirmed_bad("dashboard") is False
+
+    def test_unhealthy_past_debounce_is_confirmed(self):
+        m, clock = _monitor()
+        m.update({"dashboard": _s(health="healthy")})
+        m.update({"dashboard": _s(health="unhealthy")})
+        clock.advance(121)  # past unhealthy_after
+        assert m.update({"dashboard": _s(health="unhealthy")}) == [("dashboard", "unhealthy")]
+        assert m.is_confirmed_bad("dashboard") is True
+
+    def test_crash_loop_is_confirmed_until_recovered(self):
+        m, clock = _monitor()
+        m.update({"dashboard": _s(restart_count=0)})
+        clock.advance(60)
+        m.update({"dashboard": _s(restart_count=1)})
+        clock.advance(60)
+        m.update({"dashboard": _s(restart_count=2)})
+        clock.advance(60)
+        assert m.update({"dashboard": _s(restart_count=3)}) == [("dashboard", "crash_loop")]
+        assert m.is_confirmed_bad("dashboard") is True
+        # Clean streak past recovery_after clears it.
+        clock.advance(121)
+        m.update({"dashboard": _s(restart_count=3)})
+        assert m.is_confirmed_bad("dashboard") is False
diff --git a/build/dashboard/tests/service/test_control_service.py b/build/dashboard/tests/service/test_control_service.py
index 8fb999fb..21f31f3f 100644
--- a/build/dashboard/tests/service/test_control_service.py
+++ b/build/dashboard/tests/service/test_control_service.py
@@ -121,16 +121,32 @@ def test_garbage_intent_id_rejected(self, spool):
 
     def test_read_config_metadata_stripped_from_the_intent(self, spool):
         # The editor round-trips the fetched doc wholesale, so read_config's own metadata
-        # injections (_core_keys/_editable_keys) ride back with the POST; the host gate's
-        # closed-schema check refuses a commit carrying them (#679). submit is the choke point.
+        # injections (_core_keys/_editable_keys/_confirm_keys) ride back with the POST; the host
+        # gate's closed-schema check refuses a commit carrying them (#679). submit is the choke point.
         rid = control_service.submit(
             "preview",
-            {"p2pool": {"pool": "main"}, "_core_keys": ["a"], "_editable_keys": ["b"]},
+            {
+                "p2pool": {"pool": "main"},
+                "_core_keys": ["a"],
+                "_editable_keys": ["b"],
+                "_confirm_keys": ["c"],
+            },
             actor="admin",
         )
         req = json.loads((spool / "requests" / f"{rid}.json").read_text())
         assert req["config"] == {"p2pool": {"pool": "main"}}
 
+    def test_commit_carries_the_typed_confirmation(self, spool):
+        # #719: an in-scope disruptive commit rides its typed confirmation; the host gate requires
+        # the exact literal before a CONFIRM row proceeds. A commit without it omits the field.
+        intent = str(uuid.uuid4())
+        rid = control_service.submit("commit", actor="admin", intent_id=intent, confirm="APPLY")
+        req = json.loads((spool / "requests" / f"{rid}.json").read_text())
+        assert req["confirm"] == "APPLY"
+        rid2 = control_service.submit("commit", actor="admin", intent_id=str(uuid.uuid4()))
+        req2 = json.loads((spool / "requests" / f"{rid2}.json").read_text())
+        assert "confirm" not in req2
+
     def test_non_dict_config_passes_through_for_the_host_to_reject(self, spool):
         # Malformed client payloads keep their host-side rejection ("config must be a JSON
         # object") instead of dying in the container on the metadata strip.
@@ -309,6 +325,68 @@ def test_editable_keys_have_no_intra_repo_drift():
     assert set(control_service.EDITABLE_ENV_KEY_PATHS.keys()) == pithead_keys
 
 
+class TestConfirmKeys:
+    """read_config's ``_confirm_keys`` field (#719): the operationally-disruptive config paths the
+    control gate commits behind a type-to-confirm, mirroring pithead's CONTROL_DASHBOARD_CONFIRM_KEYS
+    the same underscore-metadata way ``_editable_keys`` mirrors the editable allowlist. The UI marks
+    these editable-with-confirm instead of greying them host-only."""
+
+    def test_confirm_keys_served_on_read_config(self, spool):
+        cfg = control_service.read_config()
+        for path in (
+            "monero.data_dir",
+            "tari.data_dir",
+            "p2pool.data_dir",
+            "dashboard.data_dir",
+            "p2pool.stratum_port",
+            "monero.clearnet_initial_sync",
+            "tari.clearnet_initial_sync",
+            "monero.prune",
+        ):
+            assert path in cfg["_confirm_keys"], path
+        assert cfg["_confirm_keys"] == sorted(cfg["_confirm_keys"])  # stable, deterministic order
+
+    def test_perimeter_stays_out_of_the_confirm_set(self, spool):
+        # The confirm-gated set is strictly the "expensive but recoverable" class — never the
+        # security perimeter, and never a plain editable key (that would demand needless friction).
+        cfg = control_service.read_config()
+        for path in (
+            "monero.wallet_address",
+            "monero.view_key",
+            "dashboard.auth.password",
+            "network.tor_egress_firewall",
+            "dashboard.control.enabled",
+            "tor.data_dir",  # only the four SERVICE data dirs are in scope, not tor's
+            "p2pool.pool",  # a freely-editable key, not confirm-gated
+        ):
+            assert path not in cfg["_confirm_keys"], path
+
+    def test_confirm_and_editable_sets_are_disjoint(self, spool):
+        # A key is either free-to-commit or confirm-gated, never both — the UI picks one affordance.
+        cfg = control_service.read_config()
+        assert not (set(cfg["_confirm_keys"]) & set(cfg["_editable_keys"]))
+
+
+def test_confirm_keys_have_no_intra_repo_drift():
+    """#719 (mirrors the #613 EDITABLE_ENV_KEY_PATHS check): CONFIRM_ENV_KEY_PATHS is a second copy
+    of pithead's CONTROL_DASHBOARD_CONFIRM_KEYS, kept in sync only by this test. Drift means the
+    dashboard either greys out a field the gate would confirm-commit, or shows one editable-with-
+    confirm that the gate silently refuses at Save."""
+    import re
+    from pathlib import Path
+
+    here = Path(__file__).resolve()
+    pithead_path = next((p / "pithead" for p in here.parents if (p / "pithead").is_file()), None)
+    if pithead_path is None:
+        pytest.skip("pithead CLI not present in this test context (dashboard-only image)")
+    pithead = pithead_path.read_text()
+    m = re.search(r"CONTROL_DASHBOARD_CONFIRM_KEYS='([^']*)'", pithead)
+    assert m, "could not find CONTROL_DASHBOARD_CONFIRM_KEYS in pithead"
+    pithead_keys = set(m.group(1).split())
+    assert pithead_keys, "extracted an empty confirm allowlist — the regex likely stopped matching"
+    assert set(control_service.CONFIRM_ENV_KEY_PATHS.keys()) == pithead_keys
+
+
 class TestWorkerApply:
     """Worker config-apply spooling + validation (#185). The intent carries only the worker name +
     writable-key changes — never a host, port, or token (those stay host-side, #440)."""
diff --git a/build/dashboard/tests/service/test_data_service.py b/build/dashboard/tests/service/test_data_service.py
index 3c404a62..a1a17a8f 100644
--- a/build/dashboard/tests/service/test_data_service.py
+++ b/build/dashboard/tests/service/test_data_service.py
@@ -1,4 +1,5 @@
 import asyncio
+import json
 import time
 from unittest.mock import AsyncMock, MagicMock, patch
 
@@ -19,12 +20,16 @@
     WorkerLifecycle,
     _aggregate_hashrate,
     _aggregate_window_hashrates,
+    _diff_config_keys,
+    _iso_now,
     _merge_direct_stats,
     _merge_proxy_summary,
     _normalize_proxy_workers,
+    _parse_audit_ts,
     _parse_legacy_dict_worker,
     _parse_proxy_list_worker,
     _parse_proxy_summary,
+    _read_host_config,
     _shares_to_record,
     _summary_deltas,
 )
@@ -706,6 +711,148 @@ async def test_rehold_stops_quietly_after_first_cycle(self):
         assert second.kwargs.get("quiet") is True
 
 
+class TestFailClosedGate:
+    """Opt-in (dashboard.fail_closed, #490) miner hold on an unrecoverable health failure —
+    reuses the #35 sync gate's own stop/start mechanism over SYNC_GATE_CONTAINERS, but (unlike
+    the sync gate) is not a one-way latch: it re-checks every cycle and releases once the
+    unrecoverable condition clears."""
+
+    def _svc(self, released=True):
+        sm = MagicMock()
+        sm.load_snapshot.return_value = None
+        svc = DataService(sm, MagicMock(), MagicMock())
+        svc.docker_control = MagicMock()
+        svc.docker_control.stop = AsyncMock(return_value=True)
+        svc.docker_control.start = AsyncMock(return_value=True)
+        svc.miner_released = released
+        return svc
+
+    def _enabled(self, on=True):
+        return patch.object(ds_mod, "DASHBOARD_FAIL_CLOSED", on)
+
+    async def test_default_off_never_touches_containers(self):
+        # dashboard.fail_closed defaults False — an unrecoverable failure must only ever alert
+        # (elsewhere), never hold. A cosmetic dashboard fault must not idle the fleet.
+        svc = self._svc()
+        with (
+            self._enabled(False),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+        ):
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+        svc.docker_control.stop.assert_not_called()
+        svc.docker_control.start.assert_not_called()
+        assert svc.fail_closed_held is False
+
+    async def test_noop_before_sync_gate_releases_the_miner(self):
+        # Holding before the sync gate has released is already #35's job — engaging here too
+        # would just be a second, redundant hold path.
+        svc = self._svc(released=False)
+        with self._enabled(True), patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool"]):
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+        svc.docker_control.stop.assert_not_called()
+        assert svc.fail_closed_held is False
+
+    async def test_holds_when_enabled_and_unrecoverable(self):
+        svc = self._svc()
+        with (
+            self._enabled(True),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+        ):
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+        stopped = {c.args[0] for c in svc.docker_control.stop.await_args_list}
+        assert stopped == {"p2pool", "xmrig-proxy"}
+        svc.docker_control.start.assert_not_called()
+        assert svc.fail_closed_held is True
+
+    async def test_rehold_stops_quietly_after_first_cycle(self):
+        svc = self._svc()
+        with self._enabled(True), patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool"]):
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+        first, second = svc.docker_control.stop.await_args_list
+        assert first.kwargs.get("quiet") is False
+        assert second.kwargs.get("quiet") is True
+
+    async def test_releases_once_condition_clears(self):
+        # Unlike the sync gate's one-way latch, this must release on its own once the
+        # unrecoverable condition clears (an operator fix + restart, no full stack restart).
+        svc = self._svc()
+        svc.fail_closed_held = True
+        with (
+            self._enabled(True),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+        ):
+            await svc._apply_fail_closed_gate(unrecoverable=False)
+        started = {c.args[0] for c in svc.docker_control.start.await_args_list}
+        assert started == {"p2pool", "xmrig-proxy"}
+        svc.docker_control.stop.assert_not_called()
+        assert svc.fail_closed_held is False
+
+    async def test_partial_start_failure_stays_held(self):
+        svc = self._svc()
+        svc.fail_closed_held = True
+        svc.docker_control.start = AsyncMock(side_effect=[True, False])
+        with (
+            self._enabled(True),
+            patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool", "xmrig-proxy"]),
+        ):
+            await svc._apply_fail_closed_gate(unrecoverable=False)
+        assert svc.fail_closed_held is True  # next cycle retries
+
+    async def test_not_a_one_way_latch_can_rehold_after_release(self):
+        # The defining difference from the #35 sync gate: a later unrecoverable condition (a
+        # second DB-recovery failure) must be able to hold again after an earlier release.
+        svc = self._svc()
+        with self._enabled(True), patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool"]):
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+            assert svc.fail_closed_held is True
+            await svc._apply_fail_closed_gate(unrecoverable=False)
+            assert svc.fail_closed_held is False
+            await svc._apply_fail_closed_gate(unrecoverable=True)
+            assert svc.fail_closed_held is True
+
+    async def test_healthy_and_never_held_is_a_noop(self):
+        svc = self._svc()
+        with self._enabled(True), patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool"]):
+            await svc._apply_fail_closed_gate(unrecoverable=False)
+        svc.docker_control.start.assert_not_called()
+        svc.docker_control.stop.assert_not_called()
+
+    async def test_real_trigger_a_transient_unhealthy_dashboard_does_not_gate(self):
+        # #490 F1/F2: wire the ACTUAL trigger expression the run loop computes
+        # (is_db_unrecoverable OR containers.is_confirmed_bad("dashboard")) from real objects, and
+        # prove a first-sighting-unhealthy dashboard (a seed, unvetted by the 120s debounce) does
+        # NOT hold the fleet. The hardcoded-bool gate tests above cover the mechanism; this covers
+        # the classification that feeds it.
+        from mining_dashboard.service.storage_service import StateManager
+
+        svc = self._svc()
+        sm = StateManager(db_path=":memory:")
+        try:
+            svc.state_manager = sm
+            svc.alert_service.containers.update(
+                {
+                    "dashboard": {
+                        "running": True,
+                        "restarting": False,
+                        "restart_count": 0,
+                        "health": "unhealthy",
+                    }
+                }
+            )
+            assert sm.is_db_unrecoverable() is False  # healthy DB
+            trigger = sm.is_db_unrecoverable() or svc.alert_service.containers.is_confirmed_bad(
+                "dashboard"
+            )
+            assert trigger is False  # seed is not confirmed -> no gate
+            with self._enabled(True), patch.object(ds_mod, "SYNC_GATE_CONTAINERS", ["p2pool"]):
+                await svc._apply_fail_closed_gate(trigger)
+            svc.docker_control.stop.assert_not_called()
+            assert svc.fail_closed_held is False
+        finally:
+            sm.close()
+
+
 class TestRunIteration:
     async def test_single_iteration_aggregates(self):
         svc, sm, proxy = _make_service()
@@ -1793,7 +1940,11 @@ class TestReconcileWorkerConfig:
     rollback left stuck 'accepted', once the rig's enriched feed mirrors a terminal outcome for
     that change_id (rigforge.control). Real StateManager (not a mock) throughout — every assertion
     reads back the actual stored row, so a reverted WHERE-clause guard or a dropped reconcile call
-    fails these tests, not just a mock's call count."""
+    fails these tests, not just a mock's call count.
+
+    #530 extends the same poll: a TERMINAL report for a change_id this dashboard never spooled is
+    a rig-side out-of-band edit, recorded to ``audit_events`` instead of silently reconciling
+    nothing."""
 
     def _svc_with_real_storage(self):
         from mining_dashboard.service.storage_service import StateManager
@@ -1810,6 +1961,9 @@ def _status_of(self, sm, worker="rig1", change_id="cid-1"):
         assert len(rows) == 1
         return rows[0]
 
+    def _workers(self, *names):
+        return [{"name": n} for n in names]
+
     def test_terminal_report_reconciles_accepted_row(self):
         # The main revert-proof case: a real 'accepted' row becomes 'rolled_back' once the rig's
         # enriched feed mirrors that outcome for the matching change_id.
@@ -1827,10 +1981,12 @@ def test_terminal_report_reconciles_accepted_row(self):
                     }
                 }
             ]
-            asyncio.run(svc._reconcile_worker_config(worker_results))
+            asyncio.run(svc._reconcile_worker_config(self._workers("rig1"), worker_results))
             row = self._status_of(sm)
             assert row["status"] == "rolled_back"
             assert row["reason"] == "miner did not return to a live hashrate"
+            # A known change_id reconciles quietly — no audit row for the dashboard's own change.
+            assert sm.get_audit_events() == []
         finally:
             sm.close()
 
@@ -1841,7 +1997,7 @@ def test_terminal_row_is_never_overwritten(self):
             worker_results = [
                 {"rigforge": {"control": {"change_id": "cid-1", "status": "rolled_back"}}}
             ]
-            asyncio.run(svc._reconcile_worker_config(worker_results))
+            asyncio.run(svc._reconcile_worker_config(self._workers("rig1"), worker_results))
             assert self._status_of(sm)["status"] == "applied"
         finally:
             sm.close()
@@ -1852,7 +2008,7 @@ def test_offline_rig_leaves_row_accepted(self):
         svc, sm = self._svc_with_real_storage()
         try:
             self._seed(sm, "accepted")
-            asyncio.run(svc._reconcile_worker_config([{}]))
+            asyncio.run(svc._reconcile_worker_config(self._workers("rig1"), [{}]))
             assert self._status_of(sm)["status"] == "accepted"
         finally:
             sm.close()
@@ -1862,7 +2018,7 @@ def test_missing_change_id_leaves_row_accepted(self):
         try:
             self._seed(sm, "accepted")
             worker_results = [{"rigforge": {"control": {"status": "rolled_back"}}}]
-            asyncio.run(svc._reconcile_worker_config(worker_results))
+            asyncio.run(svc._reconcile_worker_config(self._workers("rig1"), worker_results))
             assert self._status_of(sm)["status"] == "accepted"
         finally:
             sm.close()
@@ -1874,7 +2030,7 @@ def test_still_in_flight_report_leaves_row_accepted(self):
             worker_results = [
                 {"rigforge": {"control": {"change_id": "cid-1", "status": "accepted"}}}
             ]
-            asyncio.run(svc._reconcile_worker_config(worker_results))
+            asyncio.run(svc._reconcile_worker_config(self._workers("rig1"), worker_results))
             assert self._status_of(sm)["status"] == "accepted"
         finally:
             sm.close()
@@ -1896,7 +2052,7 @@ def test_multiple_workers_reconciled_independently(self):
                     }
                 },
             ]
-            asyncio.run(svc._reconcile_worker_config(worker_results))
+            asyncio.run(svc._reconcile_worker_config(self._workers("rig1", "rig2"), worker_results))
             assert self._status_of(sm, worker="rig1", change_id="cid-1")["status"] == "applied"
             row2 = self._status_of(sm, worker="rig2", change_id="cid-2")
             assert row2["status"] == "rejected"
@@ -1905,6 +2061,177 @@ def test_multiple_workers_reconciled_independently(self):
             sm.close()
 
 
+class TestRigEditDetection:
+    """#530: a rig's control-status mirror reports a TERMINAL outcome for a change_id this
+    dashboard never spooled into ``worker_config`` — the rig applied it on its own. That gets
+    recorded as a ``rig-edit`` audit row naming the worker, instead of the silent no-op a
+    ``reconcile_worker_config_status`` UPDATE would be against a change_id with no matching row."""
+
+    def _svc_with_real_storage(self):
+        from mining_dashboard.service.storage_service import StateManager
+
+        sm = StateManager(db_path=":memory:")
+        svc = DataService(sm, MagicMock(), MagicMock())
+        return svc, sm
+
+    def test_unknown_change_id_records_rig_edit(self):
+        svc, sm = self._svc_with_real_storage()
+        try:
+            worker_results = [
+                {
+                    "rigforge": {
+                        "control": {
+                            "change_id": "rig-local-cid",
+                            "status": "applied",
+                            "reason": None,
+                        }
+                    }
+                }
+            ]
+            asyncio.run(svc._reconcile_worker_config([{"name": "rig1"}], worker_results))
+            events = sm.get_audit_events()
+            assert len(events) == 1
+            assert events[0]["source"] == "rig-edit"
+            assert events[0]["actor"] == "rig1"
+            assert events[0]["status"] == "applied"
+            assert "rig-local-cid" in events[0]["keys"]
+            # Nothing to reconcile — no #185 row existed for this change_id.
+            assert sm.get_worker_config_history("rig1") == []
+        finally:
+            sm.close()
+
+    def test_known_change_id_never_flagged(self):
+        svc, sm = self._svc_with_real_storage()
+        try:
+            sm.add_worker_config_version("rig1", "cid-1", "accepted", {"max_temp_c": 80}, None)
+            worker_results = [
+                {"rigforge": {"control": {"change_id": "cid-1", "status": "applied"}}}
+            ]
+            asyncio.run(svc._reconcile_worker_config([{"name": "rig1"}], worker_results))
+            assert sm.get_audit_events() == []
+        finally:
+            sm.close()
+
+    def test_multiple_workers_only_the_unknown_one_flagged(self):
+        svc, sm = self._svc_with_real_storage()
+        try:
+            sm.add_worker_config_version("rig1", "cid-known", "accepted", {}, None)
+            worker_results = [
+                {"rigforge": {"control": {"change_id": "cid-known", "status": "applied"}}},
+                {"rigforge": {"control": {"change_id": "cid-unknown", "status": "rejected"}}},
+            ]
+            asyncio.run(
+                svc._reconcile_worker_config([{"name": "rig1"}, {"name": "rig2"}], worker_results)
+            )
+            events = sm.get_audit_events()
+            assert len(events) == 1
+            assert events[0]["actor"] == "rig2"
+            assert events[0]["status"] == "rejected"
+        finally:
+            sm.close()
+
+    def test_same_change_id_across_polls_records_exactly_one_row(self):
+        # The flood guard (HIGH #530 review): a rig re-reports its last terminal change_id every
+        # poll. Deterministic row id + in-memory guard must collapse that to ONE audit row, not a
+        # new row per ~30s cycle for a permanent, never-pruned table.
+        svc, sm = self._svc_with_real_storage()
+        try:
+            worker_results = [
+                {"rigforge": {"control": {"change_id": "rig-local-cid", "status": "applied"}}}
+            ]
+            for _ in range(3):  # three consecutive polls, same report
+                asyncio.run(svc._reconcile_worker_config([{"name": "rig1"}], worker_results))
+            assert len(sm.get_audit_events()) == 1
+        finally:
+            sm.close()
+
+    def test_repeat_report_after_a_restart_still_dedups_via_the_deterministic_id(self):
+        # The in-memory guard is empty on a fresh DataService (restart), but the SAME rig report
+        # must still not duplicate the row — the deterministic id + INSERT OR IGNORE is the bound.
+        from mining_dashboard.service.storage_service import StateManager
+
+        sm = StateManager(db_path=":memory:")
+        try:
+            worker_results = [
+                {"rigforge": {"control": {"change_id": "rig-local-cid", "status": "applied"}}}
+            ]
+            svc1 = DataService(sm, MagicMock(), MagicMock())
+            asyncio.run(svc1._reconcile_worker_config([{"name": "rig1"}], worker_results))
+            svc2 = DataService(sm, MagicMock(), MagicMock())  # "restart": fresh empty guard set
+            asyncio.run(svc2._reconcile_worker_config([{"name": "rig1"}], worker_results))
+            assert len(sm.get_audit_events()) == 1
+        finally:
+            sm.close()
+
+    def _flood(self, svc, worker, change_ids):
+        for cid in change_ids:
+            wr = [{"rigforge": {"control": {"change_id": cid, "status": "applied"}}}]
+            asyncio.run(svc._reconcile_worker_config([{"name": worker}], wr))
+
+    def test_distinct_change_id_flood_is_bounded_per_worker(self):
+        # #724: a rogue rig on the unauthenticated feed reports a NEW change_id every poll. Each
+        # clears #530's deterministic-id dedup, so without a cap every poll writes a permanent row.
+        # The per-worker hourly cap bounds rig-edit rows to _RIG_EDIT_CAP_PER_HOUR, plus exactly one
+        # rate-limited marker so the flood stays visible — not silently swallowed.
+        svc, sm = self._svc_with_real_storage()
+        try:
+            cap = ds_mod._RIG_EDIT_CAP_PER_HOUR
+            self._flood(svc, "rig1", [f"cid-{i}" for i in range(cap + 8)])
+            events = sm.get_audit_events()
+            rig_edits = [e for e in events if e["action"] == "rig-edit"]
+            markers = [e for e in events if e["action"] == "rate-limited"]
+            assert len(rig_edits) == cap
+            assert len(markers) == 1
+            assert markers[0]["source"] == "rig-edit"
+            assert markers[0]["actor"] == "rig1"
+            assert markers[0]["status"] == "dropped"
+        finally:
+            sm.close()
+
+    def test_normal_cadence_is_never_rate_limited(self):
+        # A real operator edits a rig a handful of times an hour — well under the cap. Every genuine
+        # change_id records and no rate-limited marker is ever written.
+        svc, sm = self._svc_with_real_storage()
+        try:
+            self._flood(svc, "rig1", ["real-0", "real-1", "real-2"])
+            events = sm.get_audit_events()
+            assert len(events) == 3
+            assert all(e["action"] == "rig-edit" for e in events)
+        finally:
+            sm.close()
+
+    def test_cap_is_per_worker_a_flood_does_not_starve_another_rig(self):
+        # The cap is keyed on the worker (not global), so one rogue rig flooding distinct change_ids
+        # never drops a genuine rig-edit — nor any host-edit — from a different, well-behaved source.
+        svc, sm = self._svc_with_real_storage()
+        try:
+            self._flood(
+                svc, "rogue", [f"flood-{i}" for i in range(ds_mod._RIG_EDIT_CAP_PER_HOUR + 5)]
+            )
+            self._flood(svc, "goodrig", ["honest-cid"])
+            goodrig = [e for e in sm.get_audit_events() if e["actor"] == "goodrig"]
+            assert len(goodrig) == 1
+            assert goodrig[0]["action"] == "rig-edit"
+        finally:
+            sm.close()
+
+    def test_cap_resets_after_the_window_elapses(self, monkeypatch):
+        # Fixed in-memory window: once an hour passes the worker's budget refreshes, so a later
+        # genuine change_id records normally again — the cap throttles a flood, it doesn't ban a rig.
+        svc, sm = self._svc_with_real_storage()
+        clock = {"t": 1000.0}
+        monkeypatch.setattr(ds_mod.time, "time", lambda: clock["t"])
+        try:
+            cap = ds_mod._RIG_EDIT_CAP_PER_HOUR
+            self._flood(svc, "rig1", [f"cid-{i}" for i in range(cap + 3)])
+            assert len([e for e in sm.get_audit_events() if e["action"] == "rig-edit"]) == cap
+            clock["t"] += ds_mod._RIG_EDIT_WINDOW_SEC + 1  # next window
+            self._flood(svc, "rig1", ["post-window"])
+            assert [e for e in sm.get_audit_events() if "post-window" in e["keys"]]
+        finally:
+            sm.close()
+
+
 class TestTariPayoutSync:
     """Tari on-chain payout confirmation poll (#462): persist to the shared table with chain="tari",
     alert once, no replay — the Tari sibling of TestPayoutSync. The Tari client is async, so
@@ -2160,3 +2487,427 @@ async def test_enabled_feed_surfaces_prices(self):
         svc.price_feed.maybe_fetch.return_value = prices
         await svc._sync_prices()
         assert svc.latest_data["prices"] == prices
+
+
+class TestDiffConfigKeys:
+    """#530: dotted-path config diff — names only, the out-of-band host-edit detector's sole
+    correctness surface. A value is compared for equality but never returned."""
+
+    def test_no_change_is_empty(self):
+        cfg = {"xvb": {"enabled": True}}
+        assert _diff_config_keys(cfg, dict(cfg)) == []
+
+    def test_changed_leaf_named(self):
+        old = {"xvb": {"donation_level": "auto"}}
+        new = {"xvb": {"donation_level": "vip"}}
+        assert _diff_config_keys(old, new) == ["xvb.donation_level"]
+
+    def test_added_and_removed_keys_named(self):
+        assert _diff_config_keys({"a": 1}, {"b": 2}) == ["a", "b"]
+
+    def test_nested_paths_use_dotted_names(self):
+        old = {"telegram": {"events": {"node_down": True}}}
+        new = {"telegram": {"events": {"node_down": False}}}
+        assert _diff_config_keys(old, new) == ["telegram.events.node_down"]
+
+    def test_secret_sentinel_change_detected_without_a_value(self):
+        # The masked config's secret leaves are {"__secret__": True} sentinels (#440) — clearing or
+        # setting one changes dict-presence, detectable by equality alone; no real secret is ever
+        # compared or returned by this function.
+        old = {"dashboard": {"auth": {"password": {"__secret__": True}}}}
+        new = {"dashboard": {"auth": {}}}
+        assert _diff_config_keys(old, new) == ["dashboard.auth.password"]
+
+    def test_unrelated_keys_untouched(self):
+        assert _diff_config_keys({"a": 1, "b": 2}, {"a": 1, "b": 3}) == ["b"]
+
+    def test_non_dict_input_is_treated_as_empty(self):
+        # A malformed config.json (top-level not an object) must never crash the watcher — every
+        # key on the OTHER side just reads as added/removed.
+        assert _diff_config_keys("not-a-dict", {"a": 1}) == ["a"]
+        assert _diff_config_keys(None, None) == []
+
+
+class TestAuditTsHelpers:
+    """#530: the shared ts format between control.log's own writer and this dashboard's
+    detections — a plain string round-trips through both directions."""
+
+    def test_iso_now_round_trips_through_parse_audit_ts(self):
+        parsed = _parse_audit_ts(_iso_now())
+        assert parsed is not None
+        assert abs(parsed - time.time()) < 5
+
+    def test_parse_audit_ts_rejects_garbage(self):
+        assert _parse_audit_ts("not-a-timestamp") is None
+        assert _parse_audit_ts(None) is None
+        assert _parse_audit_ts(123) is None
+
+
+class TestWatchHostConfig:
+    """#530: config.json changed without a matching control-channel commit -> a ``host-edit``
+    audit row. Real StateManager throughout, like TestReconcileWorkerConfig — every assertion
+    reads back the persisted row."""
+
+    def _svc(self):
+        from mining_dashboard.service.storage_service import StateManager
+
+        sm = StateManager(db_path=":memory:")
+        svc = DataService(sm, MagicMock(), MagicMock())
+        return svc, sm
+
+    def _write_config(self, path, doc):
+        path.write_text(json.dumps(doc))
+
+    async def test_control_disabled_is_a_noop(self, monkeypatch):
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", False)
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()
+            assert sm.get_audit_events() == []
+            assert svc._last_host_config is None
+        finally:
+            sm.close()
+
+    async def test_first_poll_only_baselines(self, tmp_path, monkeypatch):
+        cfg = tmp_path / "config.json"
+        self._write_config(cfg, {"xvb": {"enabled": True}})
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()
+            assert sm.get_audit_events() == []
+            assert svc._last_host_config == {"xvb": {"enabled": True}}
+        finally:
+            sm.close()
+
+    async def test_unexplained_change_is_recorded_host_edit(self, tmp_path, monkeypatch):
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        self._write_config(cfg, {"xvb": {"enabled": True}})
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()  # baseline
+            self._write_config(cfg, {"xvb": {"enabled": False}})  # changed out of band
+            await svc._watch_host_config()
+            events = sm.get_audit_events()
+            assert len(events) == 1
+            assert events[0]["source"] == "host-edit"
+            assert events[0]["keys"] == "xvb.enabled"
+            assert events[0]["status"] == "detected"
+        finally:
+            sm.close()
+
+    async def test_change_explained_by_a_fresh_commit_is_quiet(self, tmp_path, monkeypatch):
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        self._write_config(cfg, {"xvb": {"enabled": True}})
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()  # baseline
+            self._write_config(cfg, {"xvb": {"enabled": False}})
+            # A commit landed AFTER the baseline check — it explains the change.
+            log.write_text(
+                json.dumps(
+                    {
+                        "ts": _iso_now(),
+                        "id": "11111111-1111-4111-8111-111111111111",
+                        "actor": "admin",
+                        "action": "commit",
+                        "status": "applied",
+                        "keys": "XVB_ENABLED",
+                    }
+                )
+                + "\n"
+            )
+            await svc._watch_host_config()
+            assert sm.get_audit_events() == []
+        finally:
+            sm.close()
+
+    async def test_commit_of_one_key_does_not_swallow_a_concurrent_host_edit(
+        self, tmp_path, monkeypatch
+    ):
+        # #530 review MEDIUM: correlate BY KEY, not just by time. A fresh dashboard commit of key A
+        # landing in the same window as a host-side hand-edit of key B must NOT suppress B — the
+        # out-of-band change the feature exists to catch. Fails on the old time-only `explained =
+        # any(...)` logic, which swallowed the whole diff on ANY fresh commit.
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        # A: xvb.enabled (committable, maps to XVB_ENABLED). B: dashboard.tari_required (maps to
+        # TARI_REQUIRED) — hand-edited on the host, NOT named by the commit below.
+        self._write_config(cfg, {"xvb": {"enabled": True}, "dashboard": {"tari_required": True}})
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()  # baseline
+            # Both keys change; only A was actually committed through the dashboard.
+            self._write_config(
+                cfg, {"xvb": {"enabled": False}, "dashboard": {"tari_required": False}}
+            )
+            log.write_text(
+                json.dumps(
+                    {
+                        "ts": _iso_now(),
+                        "id": "11111111-1111-4111-8111-111111111111",
+                        "actor": "admin",
+                        "action": "commit",
+                        "status": "applied",
+                        "keys": "XVB_ENABLED",
+                    }
+                )
+                + "\n"
+            )
+            await svc._watch_host_config()
+            events = sm.get_audit_events()
+            # B is recorded out-of-band; A (explained by the commit) is NOT double-recorded.
+            assert len(events) == 1
+            assert events[0]["source"] == "host-edit"
+            assert events[0]["keys"] == "dashboard.tari_required"
+        finally:
+            sm.close()
+
+    async def test_energy_commit_explains_an_energy_subkey_by_prefix(self, tmp_path, monkeypatch):
+        # #530: dashboard.energy.* is config.json-only and audits under the synthetic
+        # DASHBOARD_ENERGY name, which env_key_config_paths maps to the whole `dashboard.energy`
+        # block by prefix — so a committed energy sub-key change stays quiet even though its dotted
+        # diff path (dashboard.energy.cost_per_kwh) isn't the literal committed name.
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        self._write_config(cfg, {"dashboard": {"energy": {"cost_per_kwh": 0.10}}})
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()  # baseline
+            self._write_config(cfg, {"dashboard": {"energy": {"cost_per_kwh": 0.20}}})
+            log.write_text(
+                json.dumps(
+                    {
+                        "ts": _iso_now(),
+                        "id": "11111111-1111-4111-8111-111111111111",
+                        "actor": "admin",
+                        "action": "commit",
+                        "status": "applied",
+                        "keys": "DASHBOARD_ENERGY",
+                    }
+                )
+                + "\n"
+            )
+            await svc._watch_host_config()
+            assert sm.get_audit_events() == []
+        finally:
+            sm.close()
+
+    async def test_stale_commit_before_the_last_check_does_not_explain(self, tmp_path, monkeypatch):
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        self._write_config(cfg, {"xvb": {"enabled": True}})
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            # An old commit, already accounted for before this watcher ever ran, then a NEW
+            # out-of-band change — the stale commit must not explain it away.
+            log.write_text(
+                json.dumps(
+                    {
+                        "ts": "2020-01-01T00:00:00Z",
+                        "id": "11111111-1111-4111-8111-111111111111",
+                        "actor": "admin",
+                        "action": "commit",
+                        "status": "applied",
+                        "keys": "XVB_ENABLED",
+                    }
+                )
+                + "\n"
+            )
+            await svc._watch_host_config()  # baseline
+            self._write_config(cfg, {"xvb": {"enabled": False}})
+            await svc._watch_host_config()
+            events = sm.get_audit_events()
+            assert len(events) == 1
+            assert events[0]["source"] == "host-edit"
+        finally:
+            sm.close()
+
+    async def test_missing_mount_is_a_quiet_noop(self, monkeypatch):
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", "/nonexistent/config.json")
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()
+            assert sm.get_audit_events() == []
+        finally:
+            sm.close()
+
+    async def test_a_raw_secret_value_never_reaches_the_audit_row(self, tmp_path, monkeypatch):
+        # Defense-in-depth (#530 review MEDIUM): even if the host masking regressed and left a RAW
+        # secret in the mounted copy, the re-mask keeps its value out of the persisted snapshot and
+        # out of any audit row. Change a non-secret key alongside the raw secret; the row names the
+        # non-secret key only, and the secret value appears nowhere.
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        self._write_config(
+            cfg, {"dashboard": {"auth": {"password": "s3cr3t-raw"}}, "xvb": {"enabled": True}}
+        )
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._watch_host_config()  # baseline (secret already masked in the snapshot)
+            assert svc._last_host_config["dashboard"]["auth"]["password"] == {"__secret__": True}
+            self._write_config(
+                cfg,
+                {"dashboard": {"auth": {"password": "s3cr3t-changed"}}, "xvb": {"enabled": False}},
+            )
+            await svc._watch_host_config()
+            events = sm.get_audit_events()
+            assert len(events) == 1
+            assert events[0]["keys"] == "xvb.enabled"  # the secret masks to a sentinel both sides
+            blob = json.dumps(events) + json.dumps(svc._last_host_config)
+            assert "s3cr3t-raw" not in blob and "s3cr3t-changed" not in blob
+        finally:
+            sm.close()
+
+    async def test_explained_window_is_at_most_one_second(self, tmp_path, monkeypatch):
+        # Boundary (#530 review LOW): the "explained by a fresh commit" check floors `since` to
+        # `_last_host_check - 1` to absorb the audit log's whole-second ts truncation. That grace
+        # is exactly 1s wide — a commit 1s before the last check still explains (truncation), one
+        # 2s before does not. Pinned here so the honest ceiling can't silently widen.
+        cfg, log = tmp_path / "config.json", tmp_path / "control.log"
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        check_epoch = _parse_audit_ts("2026-07-20T12:00:05Z")
+
+        async def _run_with_commit_ts(commit_ts):
+            svc, sm = self._svc()
+            svc._last_host_config = {"xvb": {"enabled": True}}
+            svc._last_host_check = check_epoch
+            self._write_config(cfg, {"xvb": {"enabled": False}})
+            log.write_text(
+                json.dumps(
+                    {
+                        "ts": commit_ts,
+                        "id": "11111111-1111-4111-8111-111111111111",
+                        "actor": "admin",
+                        "action": "commit",
+                        "status": "applied",
+                        "keys": "XVB_ENABLED",
+                    }
+                )
+                + "\n"
+            )
+            try:
+                await svc._watch_host_config()
+                return len(sm.get_audit_events())
+            finally:
+                sm.close()
+
+        # 1s before the last check: still explains (truncation grace) -> no host-edit row.
+        assert await _run_with_commit_ts("2026-07-20T12:00:04Z") == 0
+        # 2s before: outside the grace, correctly NOT explained -> host-edit recorded.
+        assert await _run_with_commit_ts("2026-07-20T12:00:03Z") == 1
+
+
+class TestReadHostConfig:
+    """#530 review MEDIUM: the mounted copy is pre-masked host-side, but _read_host_config
+    re-applies the SECRET_PATHS mask (like control_service.read_config) so a host masking
+    regression can't leave a raw secret resident in the long-lived config snapshot."""
+
+    def test_secret_value_is_remasked(self, tmp_path, monkeypatch):
+        cfg = tmp_path / "config.json"
+        cfg.write_text(json.dumps({"dashboard": {"auth": {"password": "leaked"}}}))
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(cfg))
+        out = _read_host_config()
+        assert out["dashboard"]["auth"]["password"] == {"__secret__": True}
+
+    def test_missing_or_bad_file_is_none(self, tmp_path, monkeypatch):
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", "/nonexistent/config.json")
+        assert _read_host_config() is None
+        bad = tmp_path / "config.json"
+        bad.write_text("{not json")
+        monkeypatch.setattr(ds_mod.config, "HOST_CONFIG_PATH", str(bad))
+        assert _read_host_config() is None
+
+
+class TestMirrorControlAudit:
+    """#530: opportunistically copies the #33 log's recent entries into the durable
+    ``audit_events`` table so the Security panel can group deeper than the log's own trimmed
+    tail. ``audit_service.recent_changes()`` output is already sanitized — nothing new to clean
+    here, only to persist."""
+
+    def _svc(self):
+        from mining_dashboard.service.storage_service import StateManager
+
+        sm = StateManager(db_path=":memory:")
+        svc = DataService(sm, MagicMock(), MagicMock())
+        return svc, sm
+
+    def _log_line(self, **over):
+        entry = {
+            "ts": "2026-07-10T12:00:00Z",
+            "id": "11111111-1111-4111-8111-111111111111",
+            "actor": "admin",
+            "action": "commit",
+            "status": "applied",
+            "keys": "XVB_ENABLED",
+        }
+        entry.update(over)
+        return json.dumps(entry)
+
+    async def test_disabled_is_a_noop(self, monkeypatch):
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", False)
+        svc, sm = self._svc()
+        try:
+            await svc._mirror_control_audit()
+            assert sm.get_audit_events() == []
+        finally:
+            sm.close()
+
+    async def test_mirrors_log_entries(self, tmp_path, monkeypatch):
+        log = tmp_path / "control.log"
+        log.write_text(self._log_line() + "\n")
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._mirror_control_audit()
+            events = sm.get_audit_events()
+            assert len(events) == 1
+            assert events[0]["source"] == "control"
+            assert events[0]["actor"] == "admin"
+            assert events[0]["keys"] == "XVB_ENABLED"
+        finally:
+            sm.close()
+
+    async def test_re_mirroring_is_idempotent(self, tmp_path, monkeypatch):
+        log = tmp_path / "control.log"
+        log.write_text(self._log_line() + "\n")
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._mirror_control_audit()
+            await svc._mirror_control_audit()
+            assert len(sm.get_audit_events()) == 1
+        finally:
+            sm.close()
+
+    async def test_entries_without_an_id_are_skipped(self, tmp_path, monkeypatch):
+        log = tmp_path / "control.log"
+        log.write_text(self._log_line(id="") + "\n")
+        monkeypatch.setattr(ds_mod.config, "DASHBOARD_CONTROL_ENABLED", True)
+        monkeypatch.setattr(ds_mod.audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        svc, sm = self._svc()
+        try:
+            await svc._mirror_control_audit()
+            assert sm.get_audit_events() == []
+        finally:
+            sm.close()
diff --git a/build/dashboard/tests/service/test_egress.py b/build/dashboard/tests/service/test_egress.py
index 919fd66a..72b7a1df 100644
--- a/build/dashboard/tests/service/test_egress.py
+++ b/build/dashboard/tests/service/test_egress.py
@@ -164,6 +164,39 @@ def test_sinks_all_private_requires_ip_literal_proof():
     assert _sinks_all_private(["not a url"]) is False
 
 
+def test_xvb_standby_route_classification():
+    # The #249 backup→primary pull: onion or any non-private source → Tor (socks5h, no IP leak);
+    # a private-IP-literal primary → local (LAN hop); unset → inactive. Never clearnet.
+    def route(src):
+        return _conn(_posture(xvb_standby_source=src), "dashboard", "XvB standby pull")["route"]
+
+    assert route("") == INACTIVE
+    assert route("http://abc.onion/api/xvb-standby") == TOR
+    assert route("http://192.168.1.5:8000/api/xvb-standby") == LOCAL
+    assert route("http://10.0.0.2/api/xvb-standby") == LOCAL
+    assert route("http://127.0.0.1:8000/api/xvb-standby") == LOCAL
+    assert route("http://[::1]/api/xvb-standby") == LOCAL
+    assert route("http://8.8.8.8:8000/api/xvb-standby") == TOR  # public IP — never direct (#160)
+    assert route("http://primary.example.com/api/xvb-standby") == TOR  # hostname — unprovable
+    # No source classification ever routes clearnet, so it can never count as a leak.
+    for src in ("", "http://abc.onion/x", "http://192.168.1.5/x", "http://8.8.8.8/x"):
+        assert _posture(xvb_standby_source=src)["summary"]["leaks"] == 0
+
+
+def test_xvb_standby_topology_edge_tracks_route():
+    # onion/public source → an edge into the tor hub (never the internet node); a private-IP
+    # primary is a LAN hop with no placeable node, so it draws no edge (like the alert-sink case).
+    def standby_edges(topo):
+        return [e for e in topo["edges"] if e["label"] == "XvB standby"]
+
+    tor = _topo(xvb_standby_source="http://8.8.8.8/api/xvb-standby")
+    assert standby_edges(tor)[0]["to"] == "tor" and standby_edges(tor)[0]["route"] == TOR
+    assert not any(e.get("leak") for e in tor["edges"])
+    assert standby_edges(_topo(xvb_standby_source="http://abc.onion/x"))[0]["route"] == TOR
+    assert standby_edges(_topo(xvb_standby_source=""))[0]["route"] == INACTIVE
+    assert standby_edges(_topo(xvb_standby_source="http://192.168.1.5/x")) == []  # LAN, no node
+
+
 def test_remote_monerod_rpc_is_clearnet():
     assert _conn(_posture(remote_monero=False), "p2pool", "monerod RPC")["route"] != CLEARNET
     assert _conn(_posture(remote_monero=True), "p2pool", "monerod RPC")["route"] == CLEARNET
diff --git a/build/dashboard/tests/service/test_storage_service.py b/build/dashboard/tests/service/test_storage_service.py
index e171cc65..641ae0af 100644
--- a/build/dashboard/tests/service/test_storage_service.py
+++ b/build/dashboard/tests/service/test_storage_service.py
@@ -22,6 +22,59 @@ def test_default_xvb_stats(self, state_manager):
         assert state_manager.get_xvb_stats()["fail_count"] == 0
 
 
+class TestXvbWarmStandby:
+    """Warm-resume persistence for the failover pair (#249)."""
+
+    def test_commanded_fraction_defaults_zero(self, state_manager):
+        assert state_manager.get_xvb_stats()["commanded_fraction"] == 0.0
+
+    def test_commanded_fraction_persists_across_restart(self, tmp_path):
+        # The controller's commanded fraction must outlive a dashboard recreate so a restart
+        # resumes the warmed split instead of re-seeding cold from feedforward.
+        db = str(tmp_path / "xvb.db")
+        sm = StateManager(db_path=db)
+        sm.update_xvb_stats(commanded_fraction=0.42)
+        sm.close()
+        sm2 = StateManager(db_path=db)
+        try:
+            assert sm2.get_xvb_stats()["commanded_fraction"] == 0.42
+        finally:
+            sm2.close()
+
+    def test_standby_roundtrip(self, state_manager):
+        blob = {"commanded_fraction": 0.3, "avg_1h": 1200.0, "mode": "SPLIT"}
+        state_manager.set_xvb_standby(blob)
+        assert state_manager.get_xvb_standby() == blob
+
+    def test_standby_persists_across_restart(self, tmp_path):
+        db = str(tmp_path / "standby.db")
+        sm = StateManager(db_path=db)
+        sm.set_xvb_standby({"commanded_fraction": 0.25, "avg_1h": 900.0})
+        sm.close()
+        sm2 = StateManager(db_path=db)
+        try:
+            assert sm2.get_xvb_standby()["commanded_fraction"] == 0.25
+        finally:
+            sm2.close()
+
+    def test_standby_none_when_unset(self, state_manager):
+        assert state_manager.get_xvb_standby() is None
+
+    def test_standby_unserializable_flags_unhealthy(self, state_manager):
+        # A blob json.dumps can't serialize is a persistent write failure — flag it like every
+        # other write path (#131) rather than raising into the puller.
+        assert state_manager.is_db_healthy() is True
+        state_manager.set_xvb_standby({"bad": {1, 2, 3}})  # set -> TypeError in json.dumps
+        assert state_manager.is_db_healthy() is False
+
+    def test_standby_bad_payload_reads_none(self, state_manager):
+        # A corrupt/non-dict blob degrades to "no standby" rather than raising into the seed path.
+        state_manager.set_kv("xvb_standby", "not-json{")
+        assert state_manager.get_xvb_standby() is None
+        state_manager.set_kv("xvb_standby", "[1, 2, 3]")  # valid JSON, wrong shape
+        assert state_manager.get_xvb_standby() is None
+
+
 class TestXvbStats:
     def test_partial_updates(self, state_manager):
         state_manager.update_xvb_stats(mode="XVB", avg_24h=1234.0, fail_count=2)
@@ -220,6 +273,37 @@ def test_transient_write_error_flags_unhealthy_without_reset(self, state_manager
         state_manager._db_error("History Update Error", sqlite3.OperationalError("disk I/O error"))
         assert state_manager.is_db_healthy() is False
         assert state_manager.db_reset_count == 0  # no reset for a transient error
+        # #490: a transient blip must never read as "unrecoverable" — that's the narrow signal
+        # dashboard.fail_closed gates the miner hold on, and this is exactly the false positive
+        # it must not trip on.
+        assert state_manager.is_db_unrecoverable() is False
+
+    def test_recovery_failure_marks_unrecoverable(self, monkeypatch):
+        # #490: the auto-heal REBUILD itself failing (disk full, permissions) is the narrow
+        # "unrecoverable" signal — distinct from db_healthy, which also flips false on an
+        # ordinary transient write error that must never gate the miner.
+        sm = StateManager(db_path=":memory:")
+        try:
+            monkeypatch.setattr(
+                sm, "_apply_schema", MagicMock(side_effect=sqlite3.OperationalError("disk full"))
+            )
+            sm._recover_corrupt_db("test: forced recovery failure")
+            assert sm.is_db_unrecoverable() is True
+            assert sm.is_db_healthy() is False
+        finally:
+            sm.close()
+
+    def test_successful_recovery_clears_unrecoverable_flag(self):
+        # A later recovery attempt that succeeds (e.g. the disk freed up) clears an earlier
+        # failure — fail_closed's hold must release once the DB is actually healthy again.
+        sm = StateManager(db_path=":memory:")
+        try:
+            sm.db_unrecoverable = True  # simulate a prior failed attempt
+            sm._recover_corrupt_db("test: retry succeeds")
+            assert sm.is_db_unrecoverable() is False
+            assert sm.is_db_healthy() is True
+        finally:
+            sm.close()
 
     def test_prune_keeps_only_recent_quarantines(self, tmp_path):
         import os
@@ -1315,3 +1399,134 @@ def test_write_error_flags_db_unhealthy(self, state_manager):
     def test_reads_and_writes_after_close_are_safe(self, state_manager):
         state_manager.close()
         state_manager.reconcile_worker_config_status("cid-1", "rolled_back")  # must not raise
+
+
+class TestWorkerConfigChangeKnown:
+    """#530: whether a change_id was ever spooled by THIS dashboard — the rig-edit detector's
+    only question. Only ``add_worker_config_version`` (the dashboard's own worker-apply write)
+    ever populates ``worker_config``, so an unknown change_id means the RIG applied it."""
+
+    def test_known_change_id_is_true(self, state_manager):
+        state_manager.add_worker_config_version("rig1", "cid-1", "accepted", {}, None)
+        assert state_manager.worker_config_change_known("cid-1") is True
+
+    def test_unknown_change_id_is_false(self, state_manager):
+        assert state_manager.worker_config_change_known("no-such-id") is False
+
+    def test_empty_change_id_is_false(self, state_manager):
+        assert state_manager.worker_config_change_known("") is False
+        assert state_manager.worker_config_change_known(None) is False
+
+    def test_after_close_is_false(self, state_manager):
+        state_manager.close()
+        assert state_manager.worker_config_change_known("cid-1") is False
+
+    def test_lookup_error_fails_open_true(self, state_manager):
+        # A DB hiccup during the lookup must not manufacture a false rig-edit report — fail toward
+        # treating the change_id as known (quiet), not toward flagging it.
+        with state_manager._db_lock:
+            state_manager._conn.execute("DROP TABLE worker_config")
+        assert state_manager.worker_config_change_known("cid-1") is True
+
+
+class TestAuditEvents:
+    """#530: the durable audit_events table backing the Security panel — mirrored control.log
+    rows plus the out-of-band host-edit/rig-edit detections."""
+
+    def test_add_and_get_round_trips(self, state_manager):
+        state_manager.add_audit_event(
+            id="ev-1",
+            ts="2026-07-20T12:00:00Z",
+            source="host-edit",
+            actor="",
+            action="host-edit",
+            status="detected",
+            keys="xvb.enabled",
+        )
+        events = state_manager.get_audit_events()
+        assert len(events) == 1
+        assert events[0]["id"] == "ev-1"
+        assert events[0]["source"] == "host-edit"
+        assert events[0]["keys"] == "xvb.enabled"
+
+    def test_insert_or_ignore_is_idempotent_on_id(self, state_manager):
+        # Re-mirroring the same control.log row (or re-detecting the same out-of-band event)
+        # must not duplicate it.
+        for _ in range(3):
+            state_manager.add_audit_event(
+                id="dup-1",
+                ts="2026-07-20T12:00:00Z",
+                source="control",
+                actor="admin",
+                action="commit",
+                status="applied",
+                keys="XVB_ENABLED",
+            )
+        assert len(state_manager.get_audit_events()) == 1
+
+    def test_newest_first_by_ts(self, state_manager):
+        state_manager.add_audit_event(
+            id="a",
+            ts="2026-07-01T00:00:00Z",
+            source="control",
+            actor="",
+            action="commit",
+            status="applied",
+            keys="",
+        )
+        state_manager.add_audit_event(
+            id="b",
+            ts="2026-07-20T00:00:00Z",
+            source="host-edit",
+            actor="",
+            action="host-edit",
+            status="detected",
+            keys="",
+        )
+        events = state_manager.get_audit_events()
+        assert [e["id"] for e in events] == ["b", "a"]
+
+    def test_limit_applies(self, state_manager):
+        for i in range(5):
+            state_manager.add_audit_event(
+                id=f"ev-{i}",
+                ts=f"2026-07-{i + 1:02d}T00:00:00Z",
+                source="control",
+                actor="",
+                action="commit",
+                status="applied",
+                keys="",
+            )
+        assert len(state_manager.get_audit_events(limit=2)) == 2
+
+    def test_write_error_flags_db_unhealthy(self, state_manager):
+        with state_manager._db_lock:
+            state_manager._conn.execute("DROP TABLE audit_events")
+        state_manager.add_audit_event(
+            id="x",
+            ts="2026-07-20T00:00:00Z",
+            source="control",
+            actor="",
+            action="commit",
+            status="applied",
+            keys="",
+        )
+        assert state_manager.is_db_healthy() is False
+
+    def test_reads_and_writes_after_close_are_safe(self, state_manager):
+        state_manager.close()
+        state_manager.add_audit_event(
+            id="x",
+            ts="2026-07-20T00:00:00Z",
+            source="control",
+            actor="",
+            action="commit",
+            status="applied",
+            keys="",
+        )  # must not raise
+        assert state_manager.get_audit_events() == []
+
+    def test_read_error_returns_empty_list(self, state_manager):
+        with state_manager._db_lock:
+            state_manager._conn.execute("DROP TABLE audit_events")
+        assert state_manager.get_audit_events() == []
diff --git a/build/dashboard/tests/service/test_xvb_standby.py b/build/dashboard/tests/service/test_xvb_standby.py
new file mode 100644
index 00000000..4d7e5e9a
--- /dev/null
+++ b/build/dashboard/tests/service/test_xvb_standby.py
@@ -0,0 +1,159 @@
+import asyncio
+from unittest.mock import MagicMock, patch
+
+import pytest
+import requests
+
+from mining_dashboard.config.config import TOR_SOCKS_PROXY
+from mining_dashboard.service.storage_service import StateManager
+from mining_dashboard.service.xvb_standby import XvbStandbyPuller, parse_standby
+
+
+class _Resp:
+    """Minimal bounded_get-style response for the puller tests."""
+
+    def __init__(self, status_code, payload):
+        self.status_code = status_code
+        self._payload = payload
+
+    def json(self):
+        return self._payload
+
+
+class TestParseStandby:
+    def test_valid_payload(self):
+        out = parse_standby(
+            {
+                "commanded_fraction": 0.3,
+                "avg_1h": 1200.0,
+                "avg_24h": 900.0,
+                "donation_level": "vip",
+                "mode": "SPLIT",
+            }
+        )
+        assert out == {
+            "commanded_fraction": 0.3,
+            "avg_1h": 1200.0,
+            "avg_24h": 900.0,
+            "donation_level": "vip",
+            "mode": "SPLIT",
+        }
+
+    def test_non_dict_is_none(self):
+        assert parse_standby([1, 2, 3]) is None
+        assert parse_standby(None) is None
+
+    def test_bad_numeric_is_none(self):
+        assert parse_standby({"commanded_fraction": "not-a-number"}) is None
+
+    def test_missing_fields_default(self):
+        out = parse_standby({})
+        assert out["commanded_fraction"] == 0.0
+        assert out["donation_level"] == ""
+        assert out["mode"] == ""
+
+
+class TestPuller:
+    def test_disabled_when_source_blank(self):
+        puller = XvbStandbyPuller(MagicMock(), source="")
+        assert puller.enabled is False
+        assert puller.fetch_once() is None  # never touches the network
+
+    def test_disabled_run_returns_immediately(self):
+        # An unconfigured single stack must pay nothing — run() exits instead of looping.
+        puller = XvbStandbyPuller(MagicMock(), source="")
+        asyncio.run(asyncio.wait_for(puller.run(), timeout=1))
+
+    def test_fetch_once_stores_standby(self):
+        sm = StateManager(db_path=":memory:")
+        try:
+            puller = XvbStandbyPuller(sm, source="http://10.0.0.2:8000/api/xvb-standby")
+            payload = {"commanded_fraction": 0.42, "avg_1h": 1500.0, "mode": "XVB"}
+            with patch(
+                "mining_dashboard.service.xvb_standby.bounded_get",
+                return_value=_Resp(200, payload),
+            ):
+                stored = puller.fetch_once()
+            assert stored["commanded_fraction"] == 0.42
+            assert "pulled_at" in stored
+            assert sm.get_xvb_standby()["commanded_fraction"] == 0.42
+        finally:
+            sm.close()
+
+    def test_fetch_once_non_200_keeps_last(self):
+        sm = MagicMock()
+        puller = XvbStandbyPuller(sm, source="http://10.0.0.2:8000/api/xvb-standby")
+        with patch("mining_dashboard.service.xvb_standby.bounded_get", return_value=_Resp(503, {})):
+            assert puller.fetch_once() is None
+        sm.set_xvb_standby.assert_not_called()
+
+    def test_fetch_once_network_error_kept_silent(self):
+        sm = MagicMock()
+        puller = XvbStandbyPuller(sm, source="http://10.0.0.2:8000/api/xvb-standby")
+        with patch(
+            "mining_dashboard.service.xvb_standby.bounded_get",
+            side_effect=requests.ConnectionError("boom"),
+        ):
+            assert puller.fetch_once() is None
+        sm.set_xvb_standby.assert_not_called()
+
+    def test_fetch_once_bad_payload_stores_nothing(self):
+        # A 200 with an unusable body (parse_standby -> None) keeps the last-held standby.
+        sm = MagicMock()
+        puller = XvbStandbyPuller(sm, source="http://10.0.0.2:8000/api/xvb-standby")
+        with patch(
+            "mining_dashboard.service.xvb_standby.bounded_get",
+            return_value=_Resp(200, {"commanded_fraction": "nope"}),
+        ):
+            assert puller.fetch_once() is None
+        sm.set_xvb_standby.assert_not_called()
+
+    async def test_run_polls_then_sleeps(self):
+        # One loop iteration: fetch runs (via to_thread), then the interval sleep — patched to
+        # break out so the otherwise-infinite loop terminates.
+        puller = XvbStandbyPuller(MagicMock(), source="http://x/api/xvb-standby", interval=0)
+        puller.fetch_once = MagicMock(return_value=None)
+        with patch("asyncio.sleep", side_effect=Exception("stop")):
+            with pytest.raises(Exception, match="stop"):
+                await puller.run()
+        puller.fetch_once.assert_called_once()
+
+    def test_onion_source_routes_over_tor(self):
+        puller = XvbStandbyPuller(MagicMock(), source="http://abc.onion/api/xvb-standby")
+        assert puller._proxies() == {"http": TOR_SOCKS_PROXY, "https": TOR_SOCKS_PROXY}
+
+    @pytest.mark.parametrize(
+        "host",
+        ["192.168.1.5:8000", "10.0.0.2:8000", "127.0.0.1:8000", "[::1]:8000", "[fc00::1]"],
+    )
+    def test_private_ip_source_dials_direct(self, host):
+        # Only a provably-private/loopback/link-local IP *literal* is a LAN hop — dial direct.
+        puller = XvbStandbyPuller(MagicMock(), source=f"http://{host}/api/xvb-standby")
+        assert puller._proxies() is None
+
+    def test_public_ip_source_routes_over_tor(self):
+        # A public IP literal is NOT provably private — it must ride Tor, not leak the backup's IP
+        # by dialing direct (#160). This is the clearnet-egress leak the review flagged.
+        puller = XvbStandbyPuller(MagicMock(), source="http://8.8.8.8:8000/api/xvb-standby")
+        assert puller._proxies() == {"http": TOR_SOCKS_PROXY, "https": TOR_SOCKS_PROXY}
+
+    def test_hostname_source_routes_over_tor(self):
+        # A hostname can't be proven private without a DNS lookup, so it rides Tor — never direct.
+        puller = XvbStandbyPuller(MagicMock(), source="http://primary.example.com/api/xvb-standby")
+        assert puller._proxies() == {"http": TOR_SOCKS_PROXY, "https": TOR_SOCKS_PROXY}
+
+    def test_startup_log_does_not_leak_source_url(self, caplog):
+        # The source URL can embed basic-auth userinfo (a capability secret) — the startup log must
+        # only announce enabled-state, never the URL/userinfo (mirrors healthchecks.py).
+        secret = "http://user:s3cr3t@primary.example.com/api/xvb-standby"
+        puller = XvbStandbyPuller(MagicMock(), source=secret, interval=0)
+        puller.fetch_once = MagicMock(return_value=None)  # no network in this test
+        with caplog.at_level("INFO", logger="XvbStandby"):
+            with patch("asyncio.sleep", side_effect=Exception("stop")):
+                with pytest.raises(Exception, match="stop"):
+                    asyncio.run(puller.run())
+        joined = " ".join(r.getMessage() for r in caplog.records)
+        assert "s3cr3t" not in joined
+        assert "user:" not in joined
+        assert secret not in joined
+        assert "primary.example.com" not in joined  # not even the bare host
diff --git a/build/dashboard/tests/web/test_server.py b/build/dashboard/tests/web/test_server.py
index 0d11747c..b79c1cca 100644
--- a/build/dashboard/tests/web/test_server.py
+++ b/build/dashboard/tests/web/test_server.py
@@ -496,6 +496,143 @@ async def test_audit_route_failure_is_sanitized(self, control_client, monkeypatc
         assert resp.status == 500
         assert "secret" not in json.dumps(await resp.json())
 
+    async def test_audit_route_merges_db_only_entries(self, control_client, monkeypatch):
+        # #530: an out-of-band host-edit/rig-edit row lives only in audit_events, never in
+        # control.log — it must still appear in the served feed.
+        monkeypatch.setattr(audit_service.config, "CONTROL_AUDIT_LOG", "/nonexistent/control.log")
+        state_mgr = control_client.app["state_manager"]
+        state_mgr.add_audit_event(
+            id="hostedit-1",
+            ts="2026-07-20T12:00:00Z",
+            source="host-edit",
+            actor="",
+            action="host-edit",
+            status="detected",
+            keys="xvb.enabled",
+        )
+        resp = await control_client.get("/api/audit")
+        assert resp.status == 200
+        entries = (await resp.json())["entries"]
+        assert len(entries) == 1
+        assert entries[0]["source"] == "host-edit"
+        assert entries[0]["keys"] == "xvb.enabled"
+
+    async def test_audit_route_shows_a_fresh_commit_before_it_is_mirrored(
+        self, control_client, tmp_path, monkeypatch
+    ):
+        # A commit that just landed in control.log, before the next poll cycle mirrors it to the
+        # DB, must still show up immediately — no regression from #530's DB merge.
+        log = tmp_path / "control.log"
+        log.write_text(
+            json.dumps(
+                {
+                    "ts": "2026-07-20T12:00:00Z",
+                    "id": "11111111-1111-4111-8111-111111111111",
+                    "actor": "admin",
+                    "action": "commit",
+                    "status": "applied",
+                    "keys": "XVB_ENABLED",
+                }
+            )
+            + "\n"
+        )
+        monkeypatch.setattr(audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        resp = await control_client.get("/api/audit")
+        entries = (await resp.json())["entries"]
+        assert len(entries) == 1
+        assert entries[0]["keys"] == "XVB_ENABLED"
+
+    async def test_audit_route_deduplicates_a_mirrored_row(
+        self, control_client, tmp_path, monkeypatch
+    ):
+        # The same control.log row, present both live (log tail) and mirrored (DB) — one row out,
+        # not two.
+        log = tmp_path / "control.log"
+        log.write_text(
+            json.dumps(
+                {
+                    "ts": "2026-07-20T12:00:00Z",
+                    "id": "22222222-2222-4222-8222-222222222222",
+                    "actor": "admin",
+                    "action": "commit",
+                    "status": "applied",
+                    "keys": "XVB_ENABLED",
+                }
+            )
+            + "\n"
+        )
+        monkeypatch.setattr(audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        state_mgr = control_client.app["state_manager"]
+        state_mgr.add_audit_event(
+            id="22222222-2222-4222-8222-222222222222",
+            ts="2026-07-20T12:00:00Z",
+            source="control",
+            actor="admin",
+            action="commit",
+            status="applied",
+            keys="XVB_ENABLED",
+        )
+        resp = await control_client.get("/api/audit")
+        entries = (await resp.json())["entries"]
+        assert len(entries) == 1
+
+    async def test_audit_route_sorts_newest_first_across_sources(
+        self, control_client, tmp_path, monkeypatch
+    ):
+        log = tmp_path / "control.log"
+        log.write_text(
+            json.dumps(
+                {
+                    "ts": "2026-07-01T00:00:00Z",
+                    "id": "33333333-3333-4333-8333-333333333333",
+                    "actor": "admin",
+                    "action": "commit",
+                    "status": "applied",
+                    "keys": "XVB_ENABLED",
+                }
+            )
+            + "\n"
+        )
+        monkeypatch.setattr(audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        state_mgr = control_client.app["state_manager"]
+        state_mgr.add_audit_event(
+            id="hostedit-2",
+            ts="2026-07-20T00:00:00Z",
+            source="host-edit",
+            actor="",
+            action="host-edit",
+            status="detected",
+            keys="xvb.enabled",
+        )
+        resp = await control_client.get("/api/audit")
+        entries = (await resp.json())["entries"]
+        assert [e["id"] for e in entries] == ["hostedit-2", "33333333-3333-4333-8333-333333333333"]
+
+    async def test_audit_route_shows_a_no_id_log_row_live(
+        self, control_client, tmp_path, monkeypatch
+    ):
+        # A pre-auth "invalid"/"refused" control.log row (#33) has no id — never mirrored to the
+        # DB, but still shown live from the log tail.
+        log = tmp_path / "control.log"
+        log.write_text(
+            json.dumps(
+                {
+                    "ts": "2026-07-20T12:00:00Z",
+                    "id": "",
+                    "actor": "",
+                    "action": "invalid",
+                    "status": "refused-oversize",
+                    "keys": "",
+                }
+            )
+            + "\n"
+        )
+        monkeypatch.setattr(audit_service.config, "CONTROL_AUDIT_LOG", str(log))
+        resp = await control_client.get("/api/audit")
+        entries = (await resp.json())["entries"]
+        assert len(entries) == 1
+        assert entries[0]["status"] == "refused-oversize"
+
 
 class TestSecurityHeaders:
     async def test_security_headers_present(self, client):
@@ -825,3 +962,36 @@ async def test_apply_pending_when_runner_silent(
         assert resp.status == 202
         assert (await resp.json())["status"] == "pending"
         assert worker_client.sm.get_worker_config_history("rig1") == []  # no terminal outcome yet
+
+
+class TestXvbStandbyApi:
+    """The read-only endpoint a backup stack pulls to warm its donation split (#249)."""
+
+    async def test_get_xvb_standby_ok_json(self, client):
+        resp = await client.get("/api/xvb-standby")
+        assert resp.status == 200
+        assert resp.content_type == "application/json"
+        body = await resp.json()
+        for key in ("commanded_fraction", "avg_1h", "avg_24h", "mode", "donation_level", "ts"):
+            assert key in body
+
+    async def test_error_is_sanitized_500(self, aiohttp_client, app_data):
+        sm = MagicMock()
+        sm.get_xvb_stats.side_effect = RuntimeError("boom")
+        cli = await aiohttp_client(create_app(sm, app_data))
+        resp = await cli.get("/api/xvb-standby")
+        assert resp.status == 500
+        body = await resp.json()
+        assert body == {"error": "Failed to build XvB standby state."}  # no internals leaked
+
+    async def test_reflects_controller_state(self, aiohttp_client, app_data):
+        sm = StateManager(db_path=":memory:")
+        sm.update_xvb_stats(mode="XVB", avg_1h=1500.0, commanded_fraction=0.37)
+        cli = await aiohttp_client(create_app(sm, app_data))
+        try:
+            body = await (await cli.get("/api/xvb-standby")).json()
+            assert body["commanded_fraction"] == 0.37
+            assert body["avg_1h"] == 1500.0
+            assert body["mode"] == "XVB"
+        finally:
+            sm.close()
diff --git a/build/dashboard/tests/web/test_views.py b/build/dashboard/tests/web/test_views.py
index 27e0dfc9..7ecceab9 100644
--- a/build/dashboard/tests/web/test_views.py
+++ b/build/dashboard/tests/web/test_views.py
@@ -30,8 +30,10 @@
     _target_points,
     _window_reject_pct,
     build_badges,
+    build_blocks,
     build_cadence,
     build_chart,
+    build_disk_growth,
     build_earnings,
     build_energy,
     build_hashrate,
@@ -46,6 +48,7 @@
     build_worker_detail,
     build_workers,
     build_xvb_calc,
+    build_xvb_history,
     canonical_window,
     get_shell_html,
     host_display_addr,
@@ -618,6 +621,16 @@ def test_miner_held(self):
         out = build_badges({"miner_held": True}, _metrics(global_syncing=True), "ok")
         assert "Miner held (sync)" in self._texts(out)
 
+    def test_fail_closed_held(self):
+        # #490: distinct badge from the sync-gate hold above — fires post-sync, only with
+        # dashboard.fail_closed on.
+        out = build_badges({"fail_closed_held": True}, _metrics(), "ok")
+        assert any(b["variant"] == "bad" and "Miner held (fail-closed)" in b["text"] for b in out)
+
+    def test_no_fail_closed_badge_by_default(self):
+        out = build_badges({}, _metrics(), "ok")
+        assert not any("fail-closed" in b["text"] for b in out)
+
     def test_passive_tari_with_and_without_percent(self):
         with_pct = build_badges(
             {"tari_syncing_passive": True}, _metrics(tari=_sync(percent=42)), "ok"
@@ -1394,6 +1407,137 @@ def test_short_series_is_untouched(self):
         assert len(pts) == 3  # under the cap -> native resolution, no bucketing
 
 
+class TestBlocksDiskGrowthXvbHistorySeries:
+    """#196 Tier-1: the persisted blocks/disk_growth/xvb_history backbone surfaced on
+    /api/state. network_history and worker_history are Tier-2 and out of scope here."""
+
+    def test_build_blocks_shape_and_ms_epoch(self):
+        now = time.time()
+        rows = [{"ts": now - 60, "height": 42, "difficulty": 123.0}]
+        pts = build_blocks(rows, "all")
+        assert pts == [{"x": int((now - 60) * 1000), "height": 42, "difficulty": 123.0}]
+
+    def test_build_blocks_range_filters_old_rows(self):
+        now = time.time()
+        rows = [
+            {"ts": now - 8 * 24 * 3600, "height": 1, "difficulty": 1.0},
+            {"ts": now - 60, "height": 2, "difficulty": 2.0},
+        ]
+        assert len(build_blocks(rows, "1w")) == 1
+
+    def test_build_blocks_empty(self):
+        assert build_blocks([], "all") == []
+
+    def test_build_disk_growth_shape_and_ms_epoch(self):
+        now = time.time()
+        rows = [
+            {
+                "ts": now - 3600,
+                "monero_db_bytes": 85_000_000_000,
+                "disk_used_gb": 120.5,
+                "disk_total_gb": 500.0,
+            }
+        ]
+        pts = build_disk_growth(rows, "all")
+        assert pts == [
+            {
+                "x": int((now - 3600) * 1000),
+                "monero_db_bytes": 85_000_000_000,
+                "disk_used_gb": 120.5,
+                "disk_total_gb": 500.0,
+            }
+        ]
+
+    def test_build_disk_growth_range_filters_old_rows(self):
+        now = time.time()
+        rows = [
+            {
+                "ts": now - 8 * 24 * 3600,
+                "monero_db_bytes": 1,
+                "disk_used_gb": 1,
+                "disk_total_gb": 1,
+            },
+            {"ts": now - 60, "monero_db_bytes": 2, "disk_used_gb": 2, "disk_total_gb": 2},
+        ]
+        assert len(build_disk_growth(rows, "1w")) == 1
+
+    def test_build_disk_growth_long_series_is_bounded_and_bucket_averaged(self):
+        # Hourly, permanent (no retention prune) -> a long-lived install can pass the cap.
+        now = time.time()
+        rows = [
+            {
+                "ts": now - i * 3600,
+                "monero_db_bytes": 100,
+                "disk_used_gb": 10.0,
+                "disk_total_gb": 500.0,
+            }
+            for i in range(10_000, 0, -1)  # ascending ts, like the DB returns them
+        ]
+        pts = build_disk_growth(rows, "all")
+        assert len(pts) <= _MAX_CHART_POINTS
+        # Every source row carries the same constant values, so the bucket average is exact.
+        assert all(p["monero_db_bytes"] == 100 and p["disk_used_gb"] == 10.0 for p in pts)
+
+    def test_build_xvb_history_shape_and_ms_epoch(self):
+        now = time.time()
+        rows = [
+            {
+                "ts": now - 300,
+                "avg_1h": 1000.0,
+                "avg_24h": 900.0,
+                "fail_count": 0,
+                "donation_fraction": 0.5,
+            }
+        ]
+        pts = build_xvb_history(rows, "all")
+        assert pts == [
+            {
+                "x": int((now - 300) * 1000),
+                "avg_1h": 1000.0,
+                "avg_24h": 900.0,
+                "fail_count": 0,
+                "donation_fraction": 0.5,
+            }
+        ]
+
+    def test_build_xvb_history_range_filters_old_rows(self):
+        now = time.time()
+        rows = [
+            {
+                "ts": now - 40 * 24 * 3600,
+                "avg_1h": 1,
+                "avg_24h": 1,
+                "fail_count": 0,
+                "donation_fraction": 0,
+            },
+            {
+                "ts": now - 300,
+                "avg_1h": 2,
+                "avg_24h": 2,
+                "fail_count": 0,
+                "donation_fraction": 0,
+            },
+        ]
+        assert len(build_xvb_history(rows, "1m")) == 1
+
+    def test_build_xvb_history_long_series_is_bounded_and_bucket_averaged(self):
+        # 30 days at ~5-min cadence is ~8.6k rows, well past the chart cap.
+        now = time.time()
+        rows = [
+            {
+                "ts": now - i * 300,
+                "avg_1h": 1000.0,
+                "avg_24h": 900.0,
+                "fail_count": 0,
+                "donation_fraction": 0.5,
+            }
+            for i in range(8_640, 0, -1)  # ascending ts, like the DB returns them
+        ]
+        pts = build_xvb_history(rows, "all")
+        assert len(pts) <= _MAX_CHART_POINTS
+        assert all(p["avg_1h"] == 1000.0 for p in pts)
+
+
 # --- pool/network passthrough ---------------------------------------------------------
 
 
@@ -1787,7 +1931,14 @@ def test_reward_day_none_when_estimate_absent(self):
 # ponytail: this _state_mgr()/_data() pair looks near-duplicated with the ones in test_metrics.py,
 # but the per-module defaults differ on purpose (e.g. tari_sync, the get_tiers/xvb shapes). A shared
 # builder would need enough params that it reads worse than the local copy — left duplicated.
-def _state_mgr(history=None, mode="P2POOL", share_stats=None):
+def _state_mgr(
+    history=None,
+    mode="P2POOL",
+    share_stats=None,
+    blocks=None,
+    disk_growth=None,
+    xvb_history=None,
+):
     sm = MagicMock()
     sm.get_history.return_value = history or []
     sm.get_xvb_stats.return_value = {"current_mode": mode}
@@ -1795,7 +1946,12 @@ def _state_mgr(history=None, mode="P2POOL", share_stats=None):
     sm.get_xvb_reward_estimates.return_value = {"estimates": {}, "last_update": 0.0}
     sm.get_share_stats.return_value = share_stats or []
     sm.get_raffle_wins.return_value = []
+    sm.get_xvb_standby.return_value = None  # no backup standby held (#249)
     sm.is_db_healthy.return_value = True
+    # #196 Tier-1 telemetry backbone exposure.
+    sm.get_blocks.return_value = blocks or []
+    sm.get_disk_growth.return_value = disk_growth or []
+    sm.get_xvb_history.return_value = xvb_history or []
     return sm
 
 
@@ -1842,6 +1998,9 @@ def test_has_all_sections(self):
             "proxy_summary",
             "share_stats",
             "reject_pct_24h",
+            "blocks",
+            "disk_growth",
+            "xvb_history",
             "egress",
             "topology",
             "chart",
@@ -1919,6 +2078,33 @@ def test_share_stats_series_and_24h_rate_surfaced(self):
         empty = build_state(_data(), _state_mgr(), "all")
         assert empty["share_stats"] == [] and empty["reject_pct_24h"] == "—"
 
+    def test_blocks_disk_growth_xvb_history_surfaced(self):
+        # #196 Tier-1: the three backbone series ride on /api/state, each sourced from its own
+        # StateManager getter.
+        now = time.time()
+        sm = _state_mgr(
+            blocks=[{"ts": now - 60, "height": 5, "difficulty": 10.0}],
+            disk_growth=[
+                {"ts": now - 60, "monero_db_bytes": 1, "disk_used_gb": 2.0, "disk_total_gb": 3.0}
+            ],
+            xvb_history=[
+                {
+                    "ts": now - 60,
+                    "avg_1h": 1,
+                    "avg_24h": 2,
+                    "fail_count": 0,
+                    "donation_fraction": 0.1,
+                }
+            ],
+        )
+        st = build_state(_data(), sm, "all")
+        assert st["blocks"][0]["height"] == 5
+        assert st["disk_growth"][0]["monero_db_bytes"] == 1
+        assert st["xvb_history"][0]["avg_1h"] == 1
+        # Fresh install -> empty series, not a crash.
+        empty = build_state(_data(), _state_mgr(), "all")
+        assert empty["blocks"] == [] and empty["disk_growth"] == [] and empty["xvb_history"] == []
+
     def test_db_unhealthy_surfaces_field_and_badge(self):
         # When persistence is broken, /api/state must carry db_healthy=False and a loud badge (#131).
         sm = _state_mgr()
diff --git a/build/dashboard/uv.lock b/build/dashboard/uv.lock
index 5c768638..34331651 100644
--- a/build/dashboard/uv.lock
+++ b/build/dashboard/uv.lock
@@ -22,7 +22,7 @@ wheels = [
 
 [[package]]
 name = "aiohttp"
-version = "3.14.1"
+version = "3.14.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "aiohappyeyeballs" },
@@ -34,108 +34,108 @@ dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.13'" },
     { name = "yarl" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/82/78/8ea7308cac6934de8c74a14f3d5f65d1c89287426688be79538d0e5c013d/aiohttp-3.14.1.tar.gz", hash = "sha256:307f2cff90a764d329e77040603fa032db89c5c24fdad50c4c15334cba744035", size = 7955794, upload-time = "2026-06-07T21:09:35.529Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/1d/cc/58f26f118d8099f84e009ce560b9148a3f803e63fa8473b57feb67241875/aiohttp-3.14.2.tar.gz", hash = "sha256:f96821eb2ae2f12b0dfa799eafbf221f5621a9220b457b4744a269a63a5f3a6c", size = 7969860, upload-time = "2026-07-20T19:53:26.881Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/26/dd/bf526e6f0a1120dd6f2df2e97bacfe4d358f13d17a0ff5847301a1375a51/aiohttp-3.14.1-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:aa00140699487bd435fde4342d85c94cb256b7cd3a5b9c3396c67f19922afda2", size = 765225, upload-time = "2026-06-07T21:06:07.957Z" },
-    { url = "https://files.pythonhosted.org/packages/8f/e1/a2872aa55495a70f61310d411541c6ee23812d9a884e000c716e1bc3edbf/aiohttp-3.14.1-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:1c1af67559445498b502030c35c59db59966f47041ca9de5b4e707f86bd10b5f", size = 518743, upload-time = "2026-06-07T21:06:09.749Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/e7/c60c7b209e509cc787de3cea0550a518538cfc08003e1c1e14c1c63fff71/aiohttp-3.14.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:d44ec478e713ee7f29b439f7eb8dc2b9d4079e11ae114d2c2ac3d5daf30516c8", size = 514139, upload-time = "2026-06-07T21:06:11.26Z" },
-    { url = "https://files.pythonhosted.org/packages/5b/8d/614ace2f579702c9840ab1e1447fd8509e35b0b904f7196418fa2f57b25d/aiohttp-3.14.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d3b1a184a9a8f548a6b73f1e26b96b052193e4b3175ed7342aaf1151a1f00a04", size = 1784088, upload-time = "2026-06-07T21:06:12.887Z" },
-    { url = "https://files.pythonhosted.org/packages/49/e0/726e90f99542bf292f81a96a12cc4847deb86f3ccf62c6f4014a201f4d33/aiohttp-3.14.1-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:5f2504bc0322437c9a1ff6d3333ca56c7477b727c995f036b976ae17b98372c8", size = 1737835, upload-time = "2026-06-07T21:06:14.564Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/4b/d176d5c4db9d33dacf0543102ea59503bc1d528af4cfd0b719949ca49389/aiohttp-3.14.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:73f05ea02013e02512c3bf42714f1208c57168c779cc6fe23516e4543089d0a6", size = 1842801, upload-time = "2026-06-07T21:06:16.228Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/d6/5a99b563690ea0cbed912ae94a2ce33993a5709a651a3a4fe761e7dd973a/aiohttp-3.14.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:797457503c2d426bee06eef808d07b31ede30b65e054444e7de64cad0061b7af", size = 1929992, upload-time = "2026-06-07T21:06:17.947Z" },
-    { url = "https://files.pythonhosted.org/packages/76/7f/a987b14a3859094b3cea3f4825219c3e5536242564af6e3f9c2f6c994eb2/aiohttp-3.14.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b821a1f7dedf7e37450654e620038ac3b2e81e8fa6ea269337e97101978ec730", size = 1786989, upload-time = "2026-06-07T21:06:19.677Z" },
-    { url = "https://files.pythonhosted.org/packages/f1/1a/420e5c85a3e73349372ed22ce0b6af86bfa6ce16a4b20a64a2e94608c781/aiohttp-3.14.1-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:4cd96b5ba05d67ed0cf00b5b405c8cd99586d8e3481e8ee0a831057591af7621", size = 1640129, upload-time = "2026-06-07T21:06:22.558Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/80/18a592ed3be0a402cc03670bd72ee1f8563ddbe1d8d5542dbf868f274136/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:1d459b98a932296c6f0e94f87511a0b1b90a8a02c30a50e60a297619cd5a58ee", size = 1756576, upload-time = "2026-06-07T21:06:24.8Z" },
-    { url = "https://files.pythonhosted.org/packages/ec/0b/8b3d5713373858ff71a617daf6e3b0e81ad63e79d09a3cf2f6b6b983939c/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:764457a7be60825fb770a644852ff717bcbb5042f189f2bd16df61a81b3f6573", size = 1754668, upload-time = "2026-06-07T21:06:26.528Z" },
-    { url = "https://files.pythonhosted.org/packages/9f/49/fd564575cf225821d7ba5a117cb8bc27213d8a7e1811162afb43ae077039/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f7a16ef45b081454ef844502d87a848876c490c4cb5c650c230f6ec79ed2c1e7", size = 1817019, upload-time = "2026-06-07T21:06:28.297Z" },
-    { url = "https://files.pythonhosted.org/packages/ed/1b/e850c9ae6fc91356552ae668bb6c51e93fa29c8aef13398a10b56678557f/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:2fbc3ed048b3475b9f0cbcb9978e9d2d3511acd91ead203af26ed9f0056004cf", size = 1631638, upload-time = "2026-06-07T21:06:30.242Z" },
-    { url = "https://files.pythonhosted.org/packages/eb/94/3c337ba72451a89806ace6f75bddc92bafc5b8d53d90115a512858024b63/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:bedb0cd073cc2dc035e30aeb99444389d3cd2113afe4ef9fcd23d439f5bade85", size = 1835660, upload-time = "2026-06-07T21:06:31.943Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/9c/9c18cf367a0498212d9ba7daf990b504a5e8ae064cda4b504e2647c89c03/aiohttp-3.14.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:b6feea921016eb3d4e04d65fc4e9ca402d1a3801f562aef94989f54694917af3", size = 1775698, upload-time = "2026-06-07T21:06:33.72Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/63/a251a9d2a6cb45065b2ddc0bde2b3dd10108740a9a42f632c66405a761a2/aiohttp-3.14.1-cp311-cp311-win32.whl", hash = "sha256:313701e488100074ce99850404ee36e741abf6330179fec908a1944ecf570126", size = 458386, upload-time = "2026-06-07T21:06:35.279Z" },
-    { url = "https://files.pythonhosted.org/packages/17/ca/69274c51dcd6e8947d77b2806cf47a4a15f2c846e2cbeb1882547d3da283/aiohttp-3.14.1-cp311-cp311-win_amd64.whl", hash = "sha256:03ab4530fdcb3a543a122ba4b65ac9919da9fe9f78a03d328a6e38ff962f7aa5", size = 483406, upload-time = "2026-06-07T21:06:36.824Z" },
-    { url = "https://files.pythonhosted.org/packages/2c/8a/c25904f77690c3688ec140f87591ef11a0cfe36bf3d5c0f1f38056fb62b3/aiohttp-3.14.1-cp311-cp311-win_arm64.whl", hash = "sha256:486f7d16ed54c39c2cbd7ca71fd8ba2b8bb7860df65bd7b6ed640bab96a38a8b", size = 452987, upload-time = "2026-06-07T21:06:38.371Z" },
-    { url = "https://files.pythonhosted.org/packages/1d/21/151624b51cd92553d95424daf4bf19f19ce9be9002d19253e7e7ce67197b/aiohttp-3.14.1-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:d35143e27778b4bb0fb189562d7f275bff79c62ab8e98459717c0ea617ff2480", size = 757402, upload-time = "2026-06-07T21:06:40.311Z" },
-    { url = "https://files.pythonhosted.org/packages/c2/82/280619e0bd7bf2454987e19282616e84762255dd9c8468f62382e8c191f1/aiohttp-3.14.1-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:bcfb80a2cc36fba2534e5e5b5264dc7ae6fcd9bf15256da3e53d2f499e6fa29d", size = 512310, upload-time = "2026-06-07T21:06:42.207Z" },
-    { url = "https://files.pythonhosted.org/packages/55/b2/2aac325583aaa1353045f96dffa586d8a34e8322e14a7ba49cffeb103ab4/aiohttp-3.14.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:27fd7c91e51729b4f7e1577865fa6d34c9adccbc39aabe9000285b48af9f0ec2", size = 512448, upload-time = "2026-06-07T21:06:43.813Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/72/a60607cb849faa8af8a356c9329ea2eb6f395d49e82cc82ccba1fd8deb8f/aiohttp-3.14.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:64c567bf9eaf664280116a8688f63016e6b32db2505908e2bdaca1b6438142f2", size = 1766854, upload-time = "2026-06-07T21:06:45.391Z" },
-    { url = "https://files.pythonhosted.org/packages/b5/d3/d9fe1c9ec7557ab4d0d82bebaa728c6418f0b93295ec2f4ab015f7710cc7/aiohttp-3.14.1-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:f5e6ff2bdbb8f4cd3fbe41f99e25bbcd58e3bf9f13d3dd31a11e7917251cc77a", size = 1740884, upload-time = "2026-06-07T21:06:47.413Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/dc/f2cecfaf9337ba3e63f181500814ff502aa3d00d9c7ec93a9d23d10a27b2/aiohttp-3.14.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2f73e01dc37122325caf079982621262f96d74823c179038a82fddfc50359264", size = 1810034, upload-time = "2026-06-07T21:06:50.165Z" },
-    { url = "https://files.pythonhosted.org/packages/66/d7/2ff65c5e65c0d7476daf7e15c032e0805e36811185b9623e3238ad6c763e/aiohttp-3.14.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:bb2c0c80d431c0d03f2c7dbf125150fedd4f0de17366a7ca33f7ccb822391842", size = 1904054, upload-time = "2026-06-07T21:06:52.035Z" },
-    { url = "https://files.pythonhosted.org/packages/20/9c/d445818389df371f56d141d881153ba23183c4735a03f7356ffb43f7757d/aiohttp-3.14.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:3e6fc1a85fa7194a1a7d19f44e8609180f4a8eb5fa4c7ed8b4355f080fad235c", size = 1790278, upload-time = "2026-06-07T21:06:54.049Z" },
-    { url = "https://files.pythonhosted.org/packages/4d/aa/bf04cb4d865fc6101c2229a294ad744973b72e513fdc5a6b791e6983d72a/aiohttp-3.14.1-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:686b6c0d3911ec387b444ddf5dc62fb7f7c0a7d5186a7861626496a5ab4aff95", size = 1591795, upload-time = "2026-06-07T21:06:55.911Z" },
-    { url = "https://files.pythonhosted.org/packages/dc/b4/4dac0038960427ba832f6609dfb4ea5437d7fd80c72001b9e48f834f428b/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:c6fa4dc7ad6f8109c70bb1499e589f76b0b792baf39f9b017eb92c8a81d0a199", size = 1728397, upload-time = "2026-06-07T21:06:57.777Z" },
-    { url = "https://files.pythonhosted.org/packages/2b/f9/7cd4e8ad7aa3b75f17d56bb5498dd604a93d4e6eece822ba0568c413fff0/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:87a5eea1b2a5e21e1ebdbb33ad4165359189327e63fc4e4894693e7f821ac817", size = 1766504, upload-time = "2026-06-07T21:07:00.009Z" },
-    { url = "https://files.pythonhosted.org/packages/f9/df/fc01d9fcad0f73fed3f3d361f1f94f975947b50dff82919f6dc2bf4316cc/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:1c1421eb01d4fd608d88cc8290211d177a58532b55ad94076fb349c5bf467f0a", size = 1777806, upload-time = "2026-06-07T21:07:02.064Z" },
-    { url = "https://files.pythonhosted.org/packages/41/09/47e2d090bddcc8fb4ccb4c314aadc32d7c5d9bb55f50f6ad1c92fc15d501/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:34b257ec41345c1e8f2df68fa908a7952f5de932723871eb633ecbbff396c9a4", size = 1580707, upload-time = "2026-06-07T21:07:03.942Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/36/f1a4ce904ae0b6930cfe9afc96d0896f7ec1a620c400405d63783bb95a9c/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:de538791a80e5d862addbc183f70f0158ac9b9bb872bb147f1fd2a683691e087", size = 1798121, upload-time = "2026-06-07T21:07:05.987Z" },
-    { url = "https://files.pythonhosted.org/packages/70/0a/e0075ce9ca0279ee1d4f0c0b85f54fea02ebc83c3007651a72bece658fec/aiohttp-3.14.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:6f71173be42d3241d428f760122febb748de0623f44308a6f120d0dd9ec572e3", size = 1767580, upload-time = "2026-06-07T21:07:07.873Z" },
-    { url = "https://files.pythonhosted.org/packages/3e/61/a0c0a8f327a9c52095cdd8e312391b00d3ed64ab6c72bb5c33d8ec251cf7/aiohttp-3.14.1-cp312-cp312-win32.whl", hash = "sha256:ec8dc383ee57ea3e883477dcca3f11b65d58199f1080acaf4cd6ad9a99698be4", size = 452771, upload-time = "2026-06-07T21:07:09.669Z" },
-    { url = "https://files.pythonhosted.org/packages/df/d9/ea367c75f16ac9c6cdc8febb25e8318fa21a2b1bc8d6514d4b2d890bface/aiohttp-3.14.1-cp312-cp312-win_amd64.whl", hash = "sha256:2aa92c87868cd13674989f9ee83e5f9f7ea4237589b728048e1f0c8f6caa3271", size = 479873, upload-time = "2026-06-07T21:07:11.538Z" },
-    { url = "https://files.pythonhosted.org/packages/03/64/8d96784a7851156db8a4c6c3f6f91042fdf39fb15a4cc38c8b3c14833c45/aiohttp-3.14.1-cp312-cp312-win_arm64.whl", hash = "sha256:2c840c90759922cb5e6dda94596e079a30fb5a5ba548e7e0dc00574703940847", size = 448073, upload-time = "2026-06-07T21:07:13.637Z" },
-    { url = "https://files.pythonhosted.org/packages/bc/97/bd137012dd97e1649162b099135a80e1fd59aaa807b2430fc448d1029aff/aiohttp-3.14.1-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:b3a03285a7f9c7b016324574a6d92a1c895da6b978cb8f1deee3ac72bc6da178", size = 506882, upload-time = "2026-06-07T21:07:15.501Z" },
-    { url = "https://files.pythonhosted.org/packages/ef/79/e5cc690e9d922a66887ceeaca53a8ffd5a7b0be3816142b7abc433742d89/aiohttp-3.14.1-cp313-cp313-android_21_x86_64.whl", hash = "sha256:2a73f487ab8ef5abbb24b7aa9b73e98eaba9e9e031804ff2416f02eca315ccaf", size = 515270, upload-time = "2026-06-07T21:07:17.53Z" },
-    { url = "https://files.pythonhosted.org/packages/fe/22/a73ccbf9dbd6e26dda0b24d5fd5db7da92ee3383a79f47677ffb834c5c5b/aiohttp-3.14.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:915fbb7b41b115192259f8c9ae58f3ddc444d2b5579917270211858e606a4afd", size = 485841, upload-time = "2026-06-07T21:07:19.555Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/b9/57ed8eaf596321c2ad747bd480fb1700dbd7177c60dfc9e4c187f629662e/aiohttp-3.14.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:7fb4bdf95b0561a79f259f9d28fbc109728c5ee7f27aff6391f0ca703a329abe", size = 492088, upload-time = "2026-06-07T21:07:21.581Z" },
-    { url = "https://files.pythonhosted.org/packages/78/c0/5ebe5270a7c140d7c6f79dcb018640225f14d406c149e4eec04a7d82fe71/aiohttp-3.14.1-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:1b9748363260121d2927704f5d4fc498150669ca3ae93625986ee89c8f80dcd4", size = 501564, upload-time = "2026-06-07T21:07:23.388Z" },
-    { url = "https://files.pythonhosted.org/packages/75/7f/8cdaa24fc7983865e0915153b96a9ac5bcdd3548d64c5a27d17cecccad2d/aiohttp-3.14.1-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:86a6dab78b0e43e2897a3bbe15745aa60dc5423ca437b7b0b164c069bf91b876", size = 751998, upload-time = "2026-06-07T21:07:25.046Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/f4/c4227aacfacc5cb0cc2d119b65301d177912a6842cd64e120c47af76064f/aiohttp-3.14.1-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:4dfd6e47d3c44c2279907607f73a4240b88c69eb8b90da7e2441a8045dfd21da", size = 510918, upload-time = "2026-06-07T21:07:27.28Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/01/a2d5f96cd4e74424864d30bc0a7e44d0a12dacdcfa91b5b2d1bd3dca6bf3/aiohttp-3.14.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:317acd9f8602858dc7d59679812c376c7f0b97bcbbf16e0d6237f54141d8a8a6", size = 508657, upload-time = "2026-06-07T21:07:29.252Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/ed/3c0fb5c500fdd8e7ebc10d1889c04384fffa1a9163eac1356088ca9da1b1/aiohttp-3.14.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:bd869c427324e5cb15195793de951295710db28be7d818247f3097b4ab5d4b96", size = 1757907, upload-time = "2026-06-07T21:07:31.03Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/ab/d4c924d9bd5be3050c226612413ce68cb54c70d2c31b661bfc8d9a5b6a70/aiohttp-3.14.1-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:93b032b5ec3255473c143627d21a69ac74ae12f7f33974cb587c564d11b1066f", size = 1737565, upload-time = "2026-06-07T21:07:33.031Z" },
-    { url = "https://files.pythonhosted.org/packages/19/2a/37326821ff779084020cdc33224d20b19f42f4183a500ff92022a739eda7/aiohttp-3.14.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:f234b4deb12f3ad59127e037bc57c40c21e45b45282df7d3a55a0f409f595296", size = 1799018, upload-time = "2026-06-07T21:07:35.003Z" },
-    { url = "https://files.pythonhosted.org/packages/b3/4f/6e947ba73e4ce09070761c05ed3a8ceb7c21f5e46798671d8b2aac0e4626/aiohttp-3.14.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:9af6779bfb46abf124068327abcdf9ce95c9ef8287a3e8da76ccf2d0f16c28fa", size = 1894416, upload-time = "2026-06-07T21:07:36.956Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/6e/dbf1d0625dc711fb2851f4f3c3055c39ed58bae92082d8c627dbe6013736/aiohttp-3.14.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:faccab372e66bc76d5731525e7f1143c922271725b9d38c9f97edcc66266b451", size = 1783881, upload-time = "2026-06-07T21:07:39.063Z" },
-    { url = "https://files.pythonhosted.org/packages/44/c2/5e25098a67268ed369483ae7d1a58bd0a13d03aab860d2a0e4a6eb25b046/aiohttp-3.14.1-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:f380468b09d2a81633ee863b0ec5648d364bd17bb8ecfb8c2f387f7ac1faf42c", size = 1587572, upload-time = "2026-06-07T21:07:41.058Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/bd/cf9cee17e140f942a3de73e658a543aa8fbf35a5fc67a9d2538d52d77f0b/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:97e704dcd26271f5bda3fa07c3ce0fb76d6d3f8659f4baa1a24442cc9ba177ca", size = 1722137, upload-time = "2026-06-07T21:07:43.014Z" },
-    { url = "https://files.pythonhosted.org/packages/89/6d/5684f8c59045c96f81a18cefbc1fbbd79d25b88f1c622f2a5c5c08fcb632/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:269b76ac5394092b95bc4a098f4fc6c191c083c3bd12775d1e30e663132f6a09", size = 1755953, upload-time = "2026-06-07T21:07:45.933Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/40/35caf3170f8359760740a7d9aa0fff2e344bef98e1d1186f5a0f6dec17e6/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:5c0b3e614340c889d575451696374c9d17affd54cd607ca0babed8f8c37b9397", size = 1766479, upload-time = "2026-06-07T21:07:48.047Z" },
-    { url = "https://files.pythonhosted.org/packages/6d/a1/b0c61e7a137f0d81de49a82023a6df73c3c16d6fefb0f8e4a93d21639002/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:5663ee9257cfa1add7253a7da3035a02f31b6600ec48261585e1800a81533080", size = 1580077, upload-time = "2026-06-07T21:07:50.069Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/41/194ea4623693009fcefebef7aef63c141754f153e9cd0d39d3b9e36c175c/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:603a2c834142172ffddc054067f5ec0ca65d57a0aa98a71bc81952573208e345", size = 1791688, upload-time = "2026-06-07T21:07:52.106Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/45/4de841f005cfe1fd63e2a2fe011262c515e2a62aa6994b15947e7d717ac9/aiohttp-3.14.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:cb21957bb8aca671c1765e32f58164cf0c50e6bf41c0bbbd16da20732ecaf588", size = 1761094, upload-time = "2026-06-07T21:07:54.113Z" },
-    { url = "https://files.pythonhosted.org/packages/e4/ae/dbce10533d3896d544d5053939ed75b7dc31a1b0973d959b1b5ae21028d6/aiohttp-3.14.1-cp313-cp313-win32.whl", hash = "sha256:e509a55f681e6158c20f70f102f9cf61fb20fbc382272bc6d94b7343f2582780", size = 452662, upload-time = "2026-06-07T21:07:56.06Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/d9/0bf1a19362c32f06229da5e7ddfcec91f93474d6307f7a2d3135e9c674dc/aiohttp-3.14.1-cp313-cp313-win_amd64.whl", hash = "sha256:1ac8531b638959718e18c2207fbfe297819875da46a740b29dfa29beba64355a", size = 479748, upload-time = "2026-06-07T21:07:58.319Z" },
-    { url = "https://files.pythonhosted.org/packages/22/0a/62e7232dc9484fbec112ceb32efb6a624cc7994ec6e2b019286f17c4e8f2/aiohttp-3.14.1-cp313-cp313-win_arm64.whl", hash = "sha256:250d14af67f6b6a1a4a811049b1afa69d61d617fca6bf33149b3ab1a6dbcf7b8", size = 447723, upload-time = "2026-06-07T21:08:00.154Z" },
-    { url = "https://files.pythonhosted.org/packages/c4/a1/5fafa04e1ca91ddb47608699d60649c1c6db3cf41c99e78fc4056f9513db/aiohttp-3.14.1-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:7c106c26852ca1c2047c6b80384f17100b4e439af276f21ef3d4e2f450ae7e15", size = 508531, upload-time = "2026-06-07T21:08:02.093Z" },
-    { url = "https://files.pythonhosted.org/packages/fa/2e/bfa02f699d87ffc86d5959270b28f1cb410add3ccaced8ed2e0b8a5238fc/aiohttp-3.14.1-cp314-cp314-android_24_x86_64.whl", hash = "sha256:20205f7f5ade7aaec9f4b500549bbc071b046453aed72f9c06dcab87896a83e8", size = 514718, upload-time = "2026-06-07T21:08:04.476Z" },
-    { url = "https://files.pythonhosted.org/packages/85/a5/9594ad6289eebbc97d167c44213d557807f90e59115caad24de21ad2c3b1/aiohttp-3.14.1-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:62a759436b29e677181a9e76bab8b8f689a29cb9c535f45f7c48c9c830d3f8c3", size = 487918, upload-time = "2026-06-07T21:08:06.377Z" },
-    { url = "https://files.pythonhosted.org/packages/b4/61/16a32c36c3c49edec122a3dc811f2057df2f94d3b14aa107c8017d981618/aiohttp-3.14.1-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:2964cbf553df4d7a57348da44d961d871895fc1ee4e8c322b2a95612c7b17fba", size = 494014, upload-time = "2026-06-07T21:08:08.263Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/89/3ebcf96ed99c05bec9c434aaac6963fd3cbab4a786ae739908a144d9ce44/aiohttp-3.14.1-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:237651caadc3a59badd39319c54642b5299e9cc98a3a194310e55d5bb9f5e397", size = 502398, upload-time = "2026-06-07T21:08:10.244Z" },
-    { url = "https://files.pythonhosted.org/packages/fd/3d/b74870a0c2d40c355928cd5b96c7a11fa821b8a40fc41365e64479b151fb/aiohttp-3.14.1-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:896e12dfdbbab9d8f7e16d2b28c6769a60126fa92095d1ebf9473d02593a2448", size = 758018, upload-time = "2026-06-07T21:08:12.447Z" },
-    { url = "https://files.pythonhosted.org/packages/d3/66/f42f5c984d99e49c6cff5f26f590750f2e2f7ef1fcfb99966ab5be1b632e/aiohttp-3.14.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d03f281ed22579314ba00821ce20115a7c0ac430660b4cc05704a3f818b3e004", size = 512462, upload-time = "2026-06-07T21:08:14.624Z" },
-    { url = "https://files.pythonhosted.org/packages/e9/a7/248e1aebe0c7810b0271e021a0f2a5eb6e78a051885b3c9df49f42a5802d/aiohttp-3.14.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:07eabb979d236335fed927e137a928c9adfb7df3b9ec7aa31726f133a62be983", size = 512824, upload-time = "2026-06-07T21:08:16.572Z" },
-    { url = "https://files.pythonhosted.org/packages/26/97/2aa0e5ba0727dc3bd5aaebb7ccbc510f7dfb7fb961ec87497cd496635ab1/aiohttp-3.14.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4fe1f1087cbadb280b5e1bb054a4f00d1423c74d6626c5e48400d871d34ecefe", size = 1749898, upload-time = "2026-06-07T21:08:18.635Z" },
-    { url = "https://files.pythonhosted.org/packages/00/8d/e97f6c96c891d457c8479d92a514ba194d0412f981d72c70341ee18488ed/aiohttp-3.14.1-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:367a9314fdc79dab0fac96e216cb41dd73c85bdca85306ce8999118ba7e0f333", size = 1710114, upload-time = "2026-06-07T21:08:20.892Z" },
-    { url = "https://files.pythonhosted.org/packages/6f/e6/aa8d7e863048c8fceb5cd6ce74017311cec3ead07847387e12265fb4444e/aiohttp-3.14.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a24f677ebe83749039e7bdf862ff0bbb16818ae4193d4ef96505e269375bcce0", size = 1802541, upload-time = "2026-06-07T21:08:23.044Z" },
-    { url = "https://files.pythonhosted.org/packages/83/a8/72193137de57fda4ebfae4563182d082c8856e3b6e9871d0b46f028fb369/aiohttp-3.14.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c83afe0ba876be7e943d2e0ba645809ad441575d2840c895c21ee5de93b9377a", size = 1875776, upload-time = "2026-06-07T21:08:25.288Z" },
-    { url = "https://files.pythonhosted.org/packages/a0/18/938441025db6769a3464596b2410af3afde0b21eb2f204c6f766f68af4bd/aiohttp-3.14.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:634e385930fb6d2d479cf3aa66515955863b77a5e3c2b5894ca259a25b308602", size = 1760329, upload-time = "2026-06-07T21:08:27.363Z" },
-    { url = "https://files.pythonhosted.org/packages/60/29/bf2496b4065e76e09fe48015aaffe5ce161d8f089b06ac6982070f653076/aiohttp-3.14.1-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:eeea07c4397bbc57719c4eed8f9c284874d4f175f9b6d57f7a1546b976d455ca", size = 1587293, upload-time = "2026-06-07T21:08:29.805Z" },
-    { url = "https://files.pythonhosted.org/packages/49/a2/2136674d52123b1354bd05dd5753c318db47dc0c927cc70b27bab3755456/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:335c0cc3e3545ce98dcb9cfcb836f40c3411f43fa03dab757597d80c89af8a35", size = 1714756, upload-time = "2026-06-07T21:08:32.094Z" },
-    { url = "https://files.pythonhosted.org/packages/a7/b9/e5fd2e6f915503081c0f9b1e8540947037929c70c191da2e4d54b31a21a1/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:ae6be797afdef264e8a84864a85b196ca06045586481b3df8a967322fd2fa844", size = 1721052, upload-time = "2026-06-07T21:08:34.167Z" },
-    { url = "https://files.pythonhosted.org/packages/63/5a/2833e324a2263e104e31e2e91bc5bbee81bc499afd32203faee048a883f0/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:8560b4d712474335d08907db7973f71912d3a9a8f1dee992ec06b5d2fe359496", size = 1766888, upload-time = "2026-06-07T21:08:36.95Z" },
-    { url = "https://files.pythonhosted.org/packages/57/fa/dea6511870913162f3b2e8c42a7614eb203a4540b8c2da43e0bfb0548f3c/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:2b7edd08e0a5deb1e8564a2fcd8f4561014a3f05252334671bbf55ddd47db0e5", size = 1581679, upload-time = "2026-06-07T21:08:39.292Z" },
-    { url = "https://files.pythonhosted.org/packages/14/bd/3cf0d55e71784b33534e9710a67d382d900598b4787fbce6cc7317f8c42a/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:b6ff7fcee63287ae57b5df3e4f5957ce032122802509246dec1a5bcc55904c95", size = 1782021, upload-time = "2026-06-07T21:08:41.407Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/af/14bb5843eccbe234f4dfb78ab73e549d99727247e62ae5d62cbd22eaf5b0/aiohttp-3.14.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:6ffbb2f4ec1ceaff7e07d43922954da26b223d188bf30658e561b98e23089444", size = 1742574, upload-time = "2026-06-07T21:08:43.795Z" },
-    { url = "https://files.pythonhosted.org/packages/f2/1e/fbeb7af9210a67ac0f9c9bec0f8f4568497924e33137a3d5b48e1cf85f3f/aiohttp-3.14.1-cp314-cp314-win32.whl", hash = "sha256:a9875b46d910cff3ea2f5962f9d266b465459fe634e22556ab9bd6fc1192eea0", size = 457773, upload-time = "2026-06-07T21:08:46.168Z" },
-    { url = "https://files.pythonhosted.org/packages/f0/2b/13e8d741a9ec5db7d900c060554cf8352ab85e44e2a4469ebb9d377bda17/aiohttp-3.14.1-cp314-cp314-win_amd64.whl", hash = "sha256:af8b4b81a960eeaf1234971ac3cd0ba5901f3cd42eae42a46b4d089a8b492719", size = 485001, upload-time = "2026-06-07T21:08:48.401Z" },
-    { url = "https://files.pythonhosted.org/packages/df/30/491acfa2c4d6c3ff59c49a14fc1b50be3241e25bbb0c84c09e2da4d11395/aiohttp-3.14.1-cp314-cp314-win_arm64.whl", hash = "sha256:cf4491381b1b57425c315a56a439251b1bdac07b2275f19a8c44bc57744532ec", size = 453809, upload-time = "2026-06-07T21:08:50.7Z" },
-    { url = "https://files.pythonhosted.org/packages/34/e3/19dbe1a1f4cc6230eb9e314de7fe68053b0992f9302b27d12141a0b5db53/aiohttp-3.14.1-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:819c054312f1af92947e6a55883d1b66feefab11531a7fc45e0fb9b63880b5c2", size = 793320, upload-time = "2026-06-07T21:08:52.775Z" },
-    { url = "https://files.pythonhosted.org/packages/7f/20/1b7182219ba1b108430d6e4dc53d25ae02dcfcf5a045b33af4e8c5167527/aiohttp-3.14.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:10ee9c1753a8f706345b22496c79fbddb5be0599e0823f3738b1534058e25340", size = 529077, upload-time = "2026-06-07T21:08:55Z" },
-    { url = "https://files.pythonhosted.org/packages/b9/c8/14ce60ec31a2e5f5274bb17d383a6f7a3aabca31ac04eee05585bbadab16/aiohttp-3.14.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:1601cc37baf5750ccacae618ec2daf020769581695550e3b654a911f859c563d", size = 532476, upload-time = "2026-06-07T21:08:57.176Z" },
-    { url = "https://files.pythonhosted.org/packages/7e/02/9ac85e081e53da2e061b02fa7758fe0a12d17b8ce2d1f5e6c7cb76730328/aiohttp-3.14.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4d6e0ac9da31c9c04c84e1c0182ad8d6df35965a85cae29cd71d089621b3ae94", size = 1922347, upload-time = "2026-06-07T21:08:59.563Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/3e/d3ba07a0ab38b5389e10bec4362d21e10a4f667cba2d79ba30837b3a5059/aiohttp-3.14.1-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:9e8f2d660c350b3d0e259c7a7e3d9b7fc8b41210cbcc3d4a7076ff0a5e5c2fdc", size = 1786465, upload-time = "2026-06-07T21:09:01.909Z" },
-    { url = "https://files.pythonhosted.org/packages/0b/cb/e2ee978a00cfb2df829704a69528b18154eba5939f45bc1efa8f33aee4c5/aiohttp-3.14.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:4691802dda97be727f79d86818acaad7eb8e9252626a1d6b519fedbb92d5e251", size = 1909423, upload-time = "2026-06-07T21:09:04.357Z" },
-    { url = "https://files.pythonhosted.org/packages/73/5d/1430334858b1022b58ae50399a918f0bd6fe8fa7fa183598d657ff61e040/aiohttp-3.14.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:c389c482a7e9b9dc3ee2701ac46c4125297a3818875b9c305ddb603c04828fd1", size = 2001906, upload-time = "2026-06-07T21:09:06.722Z" },
-    { url = "https://files.pythonhosted.org/packages/66/4e/560c7472d3d198a23aa5c8b19a5115bf6a9b77b7d3e4bb363da320430ad2/aiohttp-3.14.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:fc0cacab7ba4e56f0f81c82a98c09bed2f39c940107b03a34b168bdf7597edd3", size = 1877095, upload-time = "2026-06-07T21:09:09.011Z" },
-    { url = "https://files.pythonhosted.org/packages/0d/f1/4745806578d447db4a784a8591e2dae3afdfc2bcb96f8f81271b13df6543/aiohttp-3.14.1-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:979ed4717f59b8bb12e3963378fa285d93d367e15bcd66c721311826d3c44a6c", size = 1676222, upload-time = "2026-06-07T21:09:11.461Z" },
-    { url = "https://files.pythonhosted.org/packages/6a/c9/48255813cca749a229ef0ab476004ec623728ad79a9c0840616f6c076325/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:38e1e7daaea81df51c952e18483f323d878499a1e2bfe564790e0f9701d6f203", size = 1842922, upload-time = "2026-06-07T21:09:14.118Z" },
-    { url = "https://files.pythonhosted.org/packages/3d/c0/bbd054e2bee909f529523a5af3891052606af5143c09f5f183ec3b234676/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:4132e72c608fe9fecb8f409113567605915b83e9bdd3ea56538d2f9cd35002f1", size = 1825035, upload-time = "2026-06-07T21:09:16.447Z" },
-    { url = "https://files.pythonhosted.org/packages/a8/ae/90395d4376deceb74e09ec26b6adf7d2015a6f8802d6d84446af860fef04/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:eefd9cc9b6d4a2db5f00a26bc3e4f9acf71926a6ec557cd56c9c6f27c290b665", size = 1849512, upload-time = "2026-06-07T21:09:18.742Z" },
-    { url = "https://files.pythonhosted.org/packages/93/bd/fb25f3049957553d4ce0ba6ae480aa2f592a6985497fca590837d16c1be0/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:b165790117eea512d7f3fb22f1f6dad3d55a7189571993eb015591c1401276d1", size = 1668571, upload-time = "2026-06-07T21:09:21.458Z" },
-    { url = "https://files.pythonhosted.org/packages/3f/22/7f73303d64dd567ff3addca90b556690ed1233a47b8f55d242fb90af3681/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:ed09c7eb1c391271c2ed0314a51903e72a3acb653d5ccfc264cdf3ef11f8269d", size = 1881159, upload-time = "2026-06-07T21:09:23.813Z" },
-    { url = "https://files.pythonhosted.org/packages/44/be/0474c5a8b5640e1e4aa1923430a91f4151be82e511373fe764189b89aef5/aiohttp-3.14.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:99abd37084b82f5830c635fddd0b4993b9742a66eb746dacf433c8590e8f9e3c", size = 1841409, upload-time = "2026-06-07T21:09:26.207Z" },
-    { url = "https://files.pythonhosted.org/packages/7b/3c/bb4a7cba26956cb3da4553cc2056cf67be5b5ff6e6d8fa4fbdff73bfb7ae/aiohttp-3.14.1-cp314-cp314t-win32.whl", hash = "sha256:47ddf841cdecc810749921d25606dee45857d12d2ad5ddb7b5bd7eab12e4b365", size = 494166, upload-time = "2026-06-07T21:09:28.505Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/84/ec80c2c1f66a952555a9f86df6b33af65108a6febfa0471b69013a12f807/aiohttp-3.14.1-cp314-cp314t-win_amd64.whl", hash = "sha256:5e78b522b7a6e27e0b25d19b247b75039ac4c94f99823e3c9e53ae1603a9f7e9", size = 530255, upload-time = "2026-06-07T21:09:30.843Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/71/6e22be134a4061ada85a92951b842f2657f17d926b727f3f94c56ae963d6/aiohttp-3.14.1-cp314-cp314t-win_arm64.whl", hash = "sha256:90d53f1609c29ccc2193945ef732428382a28f78d0456ae4d3daf0d48b74f0f6", size = 469640, upload-time = "2026-06-07T21:09:33.028Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/4a/a6c1426d2fb3cddd901575436803733caaaeb7ac0a49aa72d1930d2e3ab6/aiohttp-3.14.2-cp311-cp311-macosx_10_9_universal2.whl", hash = "sha256:56432ee8f7abe47c97717cfbf5c32430463ea8a7138e12a87b7891fa6084c8ff", size = 764168, upload-time = "2026-07-20T19:50:07.389Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/62/88ae65afc3590719788cbff3b2e0f56e6850f53ca34114cbb371e677c543/aiohttp-3.14.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:6c244f7a65cbec04c830a301aae443c529d4dbca5fddfd4b19e5a179d896adfd", size = 516255, upload-time = "2026-07-20T19:50:08.84Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/bc/ad9b767785b014f2f57497a2ccf67e3d4316d153f7ed1c7715fbbd7573fe/aiohttp-3.14.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:1c05afdd28ecacce5a1f63275a2e3dce09efddd3a63d143ee9799fda83989c8d", size = 514670, upload-time = "2026-07-20T19:50:10.325Z" },
+    { url = "https://files.pythonhosted.org/packages/48/94/697aef63f15ef354f64723eaac6ccfb289d59b99699b3b7cb1ff663b2045/aiohttp-3.14.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a57f39d6ec155932853b6b0f130cbbafab3208240fa807f29a2c96ea52b77ae1", size = 1780650, upload-time = "2026-07-20T19:50:11.676Z" },
+    { url = "https://files.pythonhosted.org/packages/99/f9/6a1994c1bf138403cf10171cb618571a330ae5683a5803b1ef29b5723d7f/aiohttp-3.14.2-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:1fc31339824ec922cb7424d624b5b6c11d8942d077b2585e5bd602ca1a1e27ed", size = 1737710, upload-time = "2026-07-20T19:50:13.401Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/ba/abe8d5015148b2cd7189473789461058dcf88ae202d4cf1cbecaf291a7ef/aiohttp-3.14.2-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d93854e215dcc7c88e4f530827193c1a594e2662931d8dbe7cca3abf52a7082d", size = 1845568, upload-time = "2026-07-20T19:50:15.168Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/89/98a2688810f469f19f2d02a298426a37b6e1cc420230a8cc7d6c85af7a01/aiohttp-3.14.2-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:87c9b03be0c18c3b3587be979149830381e37ac4a6ca8557dbe72e44fcad66c3", size = 1928485, upload-time = "2026-07-20T19:50:16.922Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/fd/c980f64f5e5bff22f07968bcc6af1b64167dfd21dbbffda86f2d153fc802/aiohttp-3.14.2-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:bc1a0793dce8fa9bb6906411e57fb18a2f1c31357b04172541b92b30337362a7", size = 1786216, upload-time = "2026-07-20T19:50:18.598Z" },
+    { url = "https://files.pythonhosted.org/packages/da/80/c710ce9c7f22fcbb83366aa64a5ccf03dced35ab09a6e37545656a6df01e/aiohttp-3.14.2-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:2f1b9540d2d0f2f95590528a1effd0ba5370f6ec189ac925e70b5eecae02dc77", size = 1636921, upload-time = "2026-07-20T19:50:20.201Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/b2/56ce1b0c535d188ef94c05bccbf3f5b1aaea1231fcb073318977bdd917e9/aiohttp-3.14.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:c0a968b04fecf7c94e502015860ad1e2e112c6b761e97b6fdf65fbb374e22b73", size = 1753040, upload-time = "2026-07-20T19:50:21.857Z" },
+    { url = "https://files.pythonhosted.org/packages/86/61/4318a947139a21d4e1a40e7f5a92799d0fe28feffaca6640a4a165e62b0e/aiohttp-3.14.2-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:2d2eedae227cd5cbd0bccc5e759f71e1af2cd77b7f74ce413bb9a2b87f94a272", size = 1760811, upload-time = "2026-07-20T19:50:23.623Z" },
+    { url = "https://files.pythonhosted.org/packages/81/b0/2012165377d029ceb925c9e5f42b0b30a39d89cf7e494c4100f3ab8d27c6/aiohttp-3.14.2-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:9d3f4c68b2c2cd282b65e558cebf4b27c8b440ab511f2b938a643d3598df2ddb", size = 1819760, upload-time = "2026-07-20T19:50:25.34Z" },
+    { url = "https://files.pythonhosted.org/packages/16/e5/1de93ba3bc18edb87f71594326bedafdc38fe725da8118b7d36fd56610f8/aiohttp-3.14.2-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:d32a70b8bf8836fd80d4169d9e34eb032cd2a7cbccb0b9cf00eac1f40732467c", size = 1628145, upload-time = "2026-07-20T19:50:26.992Z" },
+    { url = "https://files.pythonhosted.org/packages/66/8f/adc9e8592449ee08f72fcce94b7f3f1a9bbf0591a46026e4d322e5a70d7a/aiohttp-3.14.2-cp311-cp311-musllinux_1_2_s390x.whl", hash = "sha256:386ce4e709b4cc40f9ef9a132ad8e672d2d164a65451305672df656e7794c68e", size = 1832577, upload-time = "2026-07-20T19:50:28.546Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/7f/700500700513b1b63967a24c4e189aad377e18f9d67b7387b3418d6213cb/aiohttp-3.14.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:bc0ed30b942c3bd755583d74bb00b90248c067d20b1f8301e4489a53a33aa65f", size = 1774814, upload-time = "2026-07-20T19:50:30.144Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/d6/580f9b2ab4c78d9fbf9d56c85fb7f7d4d22d667b27df8032ab9bf7140e37/aiohttp-3.14.2-cp311-cp311-win32.whl", hash = "sha256:b5ed2c7dacebf4950d6b4a1b22548e4d709bb15e0287e064a7cdb32ada65893a", size = 455968, upload-time = "2026-07-20T19:50:31.722Z" },
+    { url = "https://files.pythonhosted.org/packages/96/76/33665ae48e24e01c6dfa15ed14d9d9eec1349577cef497f3b26210621f0a/aiohttp-3.14.2-cp311-cp311-win_amd64.whl", hash = "sha256:bf7951959a8e89f2d4a1e719e60d3ea4e8fc26f011ee3aed09598ad786b112f7", size = 480978, upload-time = "2026-07-20T19:50:33.299Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/19/00963031da42bd23716032f57b2a8414c5355eb1abc41805b2b41173040c/aiohttp-3.14.2-cp311-cp311-win_arm64.whl", hash = "sha256:c167127a3b6089ef78ac2e33582c38040d51688ee28474b5053acf55f192187b", size = 452900, upload-time = "2026-07-20T19:50:35.049Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/99/8737b10b6fa447371541a3b2cdbf9703c31ecf3afff4998f2f0633646a57/aiohttp-3.14.2-cp312-cp312-macosx_10_13_universal2.whl", hash = "sha256:30e41662123806e4590a0440585122ac33c89a2465a8be81cc1b50656ca0e432", size = 754562, upload-time = "2026-07-20T19:50:36.672Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/e5/fd624b8b46d99dfd8f7f75111569b5ee21850539e914eed04ce39e4455ea/aiohttp-3.14.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:dbc45e2773c66d14fbd337754e9bf23932beef539bd539716a721f5b5f372034", size = 509386, upload-time = "2026-07-20T19:50:38.268Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/a8/473db85d08b862724c506b51af2b9c6327e9e95cbd297c4c6f33968be1a8/aiohttp-3.14.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:476cf7fac10619ad6d08e1df0225d07b5a8d57c04963a171ad845d5a349d47ef", size = 511905, upload-time = "2026-07-20T19:50:39.862Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/e8/aa5ebff13ac5e39ffae8add143757e936d1c2ceb726b82786e5f5cb9912c/aiohttp-3.14.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:40bedff39ea83185f3f98a41155dd9da28b365c432e5bd90e7be140bcef0b7f3", size = 1764968, upload-time = "2026-07-20T19:50:41.559Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/22/23ec6d3d3f24f5961c7be73d5127481c992d6c92ca213f336ed8f0ff1453/aiohttp-3.14.2-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:a26f14006883fc7662e21041b4311eac1acbc977a5c43aacb27ff17f8a4c28b2", size = 1740635, upload-time = "2026-07-20T19:50:43.363Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/7b/f8966d2d08f0582525ef02d5af007d2d2467cb733abf1d1f7849a02a6b98/aiohttp-3.14.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:673217cbc9370ebf8cd048b0889d7cbe922b7bb48f4e4c02d31cfefa140bd946", size = 1810447, upload-time = "2026-07-20T19:50:45.258Z" },
+    { url = "https://files.pythonhosted.org/packages/39/f5/239f2a828b033ac244237074db7b560ad3279bb1e934bb462dbde19f3877/aiohttp-3.14.2-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:b39dbdbe30a44958d63f3f8baa2af68f24ec8a631dcd18a33dd76dfa2a0eb917", size = 1905896, upload-time = "2026-07-20T19:50:47.022Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/6e/fb84b8dafc521026355aadbeed484fc1ec44a05aae927de309f204c1f0af/aiohttp-3.14.2-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d15f618255fcbe5f54689403aa4c2a90b6f2e6ebc96b295b1cb0e868c1c12384", size = 1792052, upload-time = "2026-07-20T19:50:48.683Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/c4/25b199009f164ee02599b9b0962d22e6533d212418e49df9f4fdb37fe2eb/aiohttp-3.14.2-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:7ae767b7dffd316cc2d0abf3e1f90132b4c1a2819a32d8bcb1ba749800ea6273", size = 1590939, upload-time = "2026-07-20T19:50:50.702Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/f5/96d7540a52620433db3822267008a1697fc816979c109a4f535855ac893c/aiohttp-3.14.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:3ec4b6501a076b2f73844256da17d6b7acb15bb74ee0e908a67feb9412371166", size = 1725039, upload-time = "2026-07-20T19:50:52.506Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/50/1a06abbeec14a2bcb46124ca6e281ed4ccb3e9006542ded6bc89a0ce5224/aiohttp-3.14.2-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:7e328d02fb46b9a8dbfa070d98967e8b7eaa1d9ee10ae03fb664bdf30d58ccf0", size = 1764748, upload-time = "2026-07-20T19:50:54.336Z" },
+    { url = "https://files.pythonhosted.org/packages/70/5d/b8821b362306627ea8ca11fe49ec47cba18e7c75d975fa5f6710ad93845c/aiohttp-3.14.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:c0c7f2e5fe10910d5ab76438f269cc41bb7e499fd48ded978e926360ab1790c8", size = 1777119, upload-time = "2026-07-20T19:50:56.306Z" },
+    { url = "https://files.pythonhosted.org/packages/81/e5/805d9d49e66c6358574ad70dd731031585d18fe95ae65b857bc378bccc9a/aiohttp-3.14.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:66de80888db2176655f8df0b705b817f5ae3834e6566cc2caa89360871d90195", size = 1580047, upload-time = "2026-07-20T19:50:58.316Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/fa/1536f272d5ad93bf8b75043b02b94c24bf4e6b55a849d3287553ad6da97e/aiohttp-3.14.2-cp312-cp312-musllinux_1_2_s390x.whl", hash = "sha256:f2f9950b2dd0fc896ab520ea2366b7df6484d3d164a65d5e9f28f7b0e5742d8a", size = 1796861, upload-time = "2026-07-20T19:51:00.373Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/f3/86dfd6152bb706351cf5c6b45f0f6a1818a4e559d1e88d899c4c673c23a8/aiohttp-3.14.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:cc4435b16dc246c5dfa7f2f8ee71b10a30765018a090ee36e99f356b1e9b75cc", size = 1768687, upload-time = "2026-07-20T19:51:02.214Z" },
+    { url = "https://files.pythonhosted.org/packages/57/af/14b98e07fcd1a2b37ebb2f950309821eaa56e0eac3d32fc23dc55227e49b/aiohttp-3.14.2-cp312-cp312-win32.whl", hash = "sha256:4ca802547f1128008addfc21b24959f5cbf30a8952d365e7daa078a0d884b242", size = 451437, upload-time = "2026-07-20T19:51:03.954Z" },
+    { url = "https://files.pythonhosted.org/packages/38/20/8478c05702a369b6d0800e40e0c5f9a289ff482d0921faec1eb17727339d/aiohttp-3.14.2-cp312-cp312-win_amd64.whl", hash = "sha256:e5efff8bfd27c44ce1bfdf92ce838362d9316ed8b2ed2f89f581dbe0bbe05acf", size = 476776, upload-time = "2026-07-20T19:51:05.705Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/d0/e550bb1cb4fc82de3bdbe2add061cc0cedb34f2e7f01ada78fba94493ca1/aiohttp-3.14.2-cp312-cp312-win_arm64.whl", hash = "sha256:0eb1c9fd51f231ac8dc9d5824d5c2efc45337d429db0123fa9d4c20f570fdfc3", size = 447928, upload-time = "2026-07-20T19:51:07.523Z" },
+    { url = "https://files.pythonhosted.org/packages/96/3a/8b8779f8e813d3a33cf16bc836a7ea7bf3c27b6588d42efa36b0c32fcb58/aiohttp-3.14.2-cp313-cp313-android_21_arm64_v8a.whl", hash = "sha256:17eecd6ee9bfc8e31b6003137d74f349f0ac3797111a2df87e23acb4a7a912ea", size = 506205, upload-time = "2026-07-20T19:51:09.215Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/73/2f45204b37ecc4ce2c54b8b67254d70a8ea3b629c4083d58f3e2d27991cb/aiohttp-3.14.2-cp313-cp313-android_21_x86_64.whl", hash = "sha256:ce8dfb58f012f76258f29951d38935ac928b32ae24a480f30761f2ed5036fa78", size = 515116, upload-time = "2026-07-20T19:51:10.914Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/22/8f4424de1f50df4fbb74ea32006f9cff798ae0d346ffa6be7b6f0caca719/aiohttp-3.14.2-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:4181d72e0e6d1735c1fae56381193c6ae211d584d06413980c00775b9b2a176a", size = 486244, upload-time = "2026-07-20T19:51:12.878Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/53/60de022260f5d2d31976bc5f50db708e10671f0ac5da515402adcc6b4d4d/aiohttp-3.14.2-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:0e56babe35076f69ec9327833b71439eeccd10f51fe56c1a533da8f24923f014", size = 492260, upload-time = "2026-07-20T19:51:14.555Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/6f/d3ccc31c15cd33888670b8f1bf1dc06f3239b4edd156fc818078e87ae628/aiohttp-3.14.2-cp313-cp313-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:6b63709e259e3b3d7922b235606564e91ed4c224e777cc0ca4cae04f5f559206", size = 502174, upload-time = "2026-07-20T19:51:16.3Z" },
+    { url = "https://files.pythonhosted.org/packages/40/20/52d21e485652f4708015ce27dd3029e63140e0bdb0dcc7bf72dc0bc3f4ad/aiohttp-3.14.2-cp313-cp313-macosx_10_13_universal2.whl", hash = "sha256:f7c10c4d0b33888a68c192d883d1390d4596c116a59bf689e6d352c6739b7940", size = 750878, upload-time = "2026-07-20T19:51:18.013Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/49/1220bdc73d568431cc3856667405d78c2e95eb57fed2b9ffa5e825932ab2/aiohttp-3.14.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:8f7b19e27b78a3a927b1932af93af7645806153e8f541cee8fe856426142503f", size = 508459, upload-time = "2026-07-20T19:51:19.876Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/f1/39177406ce0ae5cb2782b35e848c0edf6e09d6e082df636eeacdbdfa70bd/aiohttp-3.14.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:18fcc3a5cc7dde1d8f7903e309055294c28894c9434588645817e374f3b83d03", size = 509179, upload-time = "2026-07-20T19:51:21.719Z" },
+    { url = "https://files.pythonhosted.org/packages/87/f7/6d081c2ee838458492c7ae1062399bdd68f149811d257d4502e79a25b306/aiohttp-3.14.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:09d1b0deec698d1198eb0b8f910dd9432d856985abbfea3f06be8b296a6619b4", size = 1761346, upload-time = "2026-07-20T19:51:23.437Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/ed/0befea4ae533f09c3a60f0d10b923cd4a90027a1bf49dfafaa24eeee08b8/aiohttp-3.14.2-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:cabaaecb4c6888bd9abafac151051377534dad4c3859a386b6325f39d3732f99", size = 1735057, upload-time = "2026-07-20T19:51:25.512Z" },
+    { url = "https://files.pythonhosted.org/packages/de/03/c1d89fcd94907f93a08d4aadbb4e1d9bd3d7d6c9f94bc9c17689de38107b/aiohttp-3.14.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:114299c08cce8ad4ebb21fafe766378864109e88ad8cf63cf6acb384ff844a57", size = 1800389, upload-time = "2026-07-20T19:51:27.585Z" },
+    { url = "https://files.pythonhosted.org/packages/3a/8b/edbac4d1a1cde3571588a1e5b40637df5acee43158efdf3ae9a161fde8ab/aiohttp-3.14.2-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:6bea8451e26cd67645d9b2ee18232e438ddfc36cea35feecb4537f2359fc7030", size = 1895342, upload-time = "2026-07-20T19:51:29.794Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/31/2e9ca3b21c07ea8a001e2b142cb01401fd34fd07b248a0b95a04c3ebc4ec/aiohttp-3.14.2-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:46b8887aa303075c1e5b24123f314a1a7bbfa03d0213dff8bb70503b2148c853", size = 1789175, upload-time = "2026-07-20T19:51:31.744Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/91/b57d3d13a80fbf765b19ae0c38d783a3a23f35b1cb82ae3b22f91abe6c24/aiohttp-3.14.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:de3b04a3f7b40ad7f1bcd3540dd447cf9bd93d57a49969bca522cbcf01290f08", size = 1586845, upload-time = "2026-07-20T19:51:33.571Z" },
+    { url = "https://files.pythonhosted.org/packages/69/e8/a2f5f9f6219cd21190e9b50e2cbc978d12a2aab748d0aa7c6ee930db15c3/aiohttp-3.14.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:42372e1f1a8dca0dcd5daf922849004ec1120042d0e24f14c926f97d2275ca79", size = 1724839, upload-time = "2026-07-20T19:51:35.518Z" },
+    { url = "https://files.pythonhosted.org/packages/de/d4/a2b9442336051714dd8dbd419b9f4a1003c45bb850ee0f3af87f2743e867/aiohttp-3.14.2-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:7871c94f3400358530ac4906dd7a526c5a24099cd5c48f53ffc4b1cb5037d7d7", size = 1756306, upload-time = "2026-07-20T19:51:37.459Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/93/22c94a599b2c4ea6ab88f1b912d90883f1fba5235b587ea9f13b148e9a0f/aiohttp-3.14.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:f8f371794319a8185e61e15ba5e1be8407b986ebce1ade11856c02d24e090577", size = 1769133, upload-time = "2026-07-20T19:51:39.9Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/db/a4e4c207f7023e83c281a7cf3579f227bade48f1899cb6588c0ed6ae54de/aiohttp-3.14.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:af63ac06bad85191e6a0c4a733cb3c55adb99f8105bc7ce9913391561159a49a", size = 1578671, upload-time = "2026-07-20T19:51:42.418Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/6f/33746ba4947b8193652fc7ed0533e09f93b118e39777228f3029e5677c17/aiohttp-3.14.2-cp313-cp313-musllinux_1_2_s390x.whl", hash = "sha256:8c2cdb684c153f377157e856257ee8535c75d8478343e4bb1e83ca73bdfa3d31", size = 1791778, upload-time = "2026-07-20T19:51:44.298Z" },
+    { url = "https://files.pythonhosted.org/packages/06/41/323856cb0ec9076b1f9a135eb0684f5f984dd97989a087873768aa34ca2f/aiohttp-3.14.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:ceff4f84c1d928654faa6bcb0437ed095b279baae2a35fcfe5a3cbe0d8b9725d", size = 1768490, upload-time = "2026-07-20T19:51:46.279Z" },
+    { url = "https://files.pythonhosted.org/packages/39/f0/09e29e457b6fb49253cbb61354ed2541fdf23ac192bddbb57bb34bc93d9c/aiohttp-3.14.2-cp313-cp313-win32.whl", hash = "sha256:15292b08ce7dd45e268fce542228894b4735102e8ee77163bd665b35fc2b5598", size = 451064, upload-time = "2026-07-20T19:51:48.194Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/76/b44703eafcfe1446f4f975be1ef2406042955425eaf56450e71b50506c49/aiohttp-3.14.2-cp313-cp313-win_amd64.whl", hash = "sha256:fc2d8e7373ceba7e1c7e9dc00adac854c2701a6d443fd21d4af2e49342d727bd", size = 476140, upload-time = "2026-07-20T19:51:50.285Z" },
+    { url = "https://files.pythonhosted.org/packages/72/48/b095935c9e72a253439f80ec757b91d4733e0a9a98b63e108d84aaf39b08/aiohttp-3.14.2-cp313-cp313-win_arm64.whl", hash = "sha256:70570f50bda5037b416db8fcba595cf808ecf0fdce12d64e850b5ae1db7f64d4", size = 447585, upload-time = "2026-07-20T19:51:52.333Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/ca/716f720dccc3032e40dc80d0ab2d87a7365270a714976a85bdff73bc7254/aiohttp-3.14.2-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:7719cef2a9dc5e10cd5f476ec1744b25c5ac4da733a9a687d91c42de7d4afe30", size = 508899, upload-time = "2026-07-20T19:51:54.165Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/80/786166589e71b3f3cfce56b414170fe5008462d0bff100bd8837285632f6/aiohttp-3.14.2-cp314-cp314-android_24_x86_64.whl", hash = "sha256:3523ec0cc524a413699f25ec8340f3da368484bc9d5f2a1bf87f233ac20599bf", size = 514722, upload-time = "2026-07-20T19:51:56.208Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/b7/539961cf3e3d3f179ea4b20d456cbdb67d1163c68f2e95bf220438a5afd5/aiohttp-3.14.2-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:c8ab295ee58332ef8fbd62727df90540836dfcf7a61f545d0f2771223b80bf25", size = 488082, upload-time = "2026-07-20T19:51:58.293Z" },
+    { url = "https://files.pythonhosted.org/packages/60/34/c7708eac8edacca9c049a0d6f5fa610005ac3c5634c9ea4751134263bf4e/aiohttp-3.14.2-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:71501bc03ede681401269c569e6f9306c761c1c7d4296675e8e78dd07147070f", size = 494140, upload-time = "2026-07-20T19:52:00.158Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/e1/076b88de36b4ebea62d1c0b225e32bc8a452ee71b2aded82878fa5fa7c9e/aiohttp-3.14.2-cp314-cp314-ios_13_0_x86_64_iphonesimulator.whl", hash = "sha256:052478c7d01035d805302db50c2ef626b1c1ba0fe2f6d4a22ae6eaeb43bf2316", size = 502670, upload-time = "2026-07-20T19:52:02.097Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/71/7b7720ffe7e521aaa79a853ebff4c17937f4b5a3a586e9d13b0f38050b35/aiohttp-3.14.2-cp314-cp314-macosx_10_15_universal2.whl", hash = "sha256:b0d49be9d9a210b2c993bf32b1eda03f949f7bcda68fc4f718ae8085ae3fb4b8", size = 756406, upload-time = "2026-07-20T19:52:04.082Z" },
+    { url = "https://files.pythonhosted.org/packages/b9/9a/c67c7e22fff7d7b17387e718451b30eb89f55df6b8d13d2d7f91daba6505/aiohttp-3.14.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:5fe25c4c44ea5b56fd4512e2065e09384987fc8cc98e41bc8749efe12f653abb", size = 510106, upload-time = "2026-07-20T19:52:06.001Z" },
+    { url = "https://files.pythonhosted.org/packages/27/2a/3caebd640229663263585d4d31898331a3937752f2e1f5ec0af509fa31be/aiohttp-3.14.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:7e254b0d636957174a03ca210289e867a62bb9502081e1b44a8c2bb1f6266ecd", size = 512876, upload-time = "2026-07-20T19:52:08.036Z" },
+    { url = "https://files.pythonhosted.org/packages/27/04/86945210e491493f5cd025efe5e6d8fc8a9e8aaf36f943c40f52c34eda7e/aiohttp-3.14.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a6b0ce033d49dd3c6a2566b387e322a9f9029110d67902f0d64571c0fd4b73d8", size = 1750050, upload-time = "2026-07-20T19:52:09.998Z" },
+    { url = "https://files.pythonhosted.org/packages/11/d8/356c62552b4db60af5ad8cddeafa6f837788918201f1b5f2466565c986b5/aiohttp-3.14.2-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:41b5b66b1ac2c48b61e420691eb9741d17d9068f2bc23b5ee3e750faa564bc8f", size = 1707177, upload-time = "2026-07-20T19:52:12.39Z" },
+    { url = "https://files.pythonhosted.org/packages/77/2d/41bb20bed3df1d6dc7fc231ca4ffb72177fd151bf4205a4ade7a93e03501/aiohttp-3.14.2-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:30a5ed81f752f182961237414a3cd0af209c0f74f06d66f66f9fcb8964f4978d", size = 1803795, upload-time = "2026-07-20T19:52:14.705Z" },
+    { url = "https://files.pythonhosted.org/packages/63/21/ad9fe6786a1d2758bcfdae4dbc1d6869ffc7b1e0571530a508de3cdde09b/aiohttp-3.14.2-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:1b9251f43d78ff675c0ddfcd53ba61abecc1f74eedc6287bb6657f6c6a033fe7", size = 1876539, upload-time = "2026-07-20T19:52:16.965Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/cb/d213f4fd7af279d82c4b46d30de22db93a01296d77a8d8e535289637da54/aiohttp-3.14.2-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:cf7930e83a12801b2e253d41cc8bf5553f61c0cfabef182a72ae13472cc81803", size = 1761130, upload-time = "2026-07-20T19:52:19.127Z" },
+    { url = "https://files.pythonhosted.org/packages/46/4f/0792fe1a24c2b4b506d07350e980b0626c149fe73e68dd37dfb30ed89813/aiohttp-3.14.2-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:abb33120daba5e5643a757790ece44d638a5a11eb0598312e6e7ec2f1bd1a5a3", size = 1583576, upload-time = "2026-07-20T19:52:21.465Z" },
+    { url = "https://files.pythonhosted.org/packages/46/ad/551c302f534f9cd6105bd16902e69dc64c726aa729127203f47ed4bddb2a/aiohttp-3.14.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:983a68048a48f35ed08aadfcc1ba55de9a121aa91be48a764965c9ec532b94b5", size = 1714139, upload-time = "2026-07-20T19:52:23.636Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/cf/a3be8601d2e80ccf7bd4f79807629cede5425d72c02636f06b1ad6a8290a/aiohttp-3.14.2-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:fef094bfc2f4e991a998af066fc6e3956a409ef799f5cbad2365175357181f2e", size = 1724352, upload-time = "2026-07-20T19:52:26.043Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/b1/6b55f6448b43a3338749f37fc6a14e7ac7dad121d2d585f22c1dd3d324fe/aiohttp-3.14.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:2f7ca81d936d820ae479971a6b6214b1b867420b5b58e54a1e7157716a943754", size = 1770749, upload-time = "2026-07-20T19:52:28.467Z" },
+    { url = "https://files.pythonhosted.org/packages/39/58/b3f1cf6af47fa0b0d51c6e2b98b2bf0326b44a932d74915f3c0874413ea8/aiohttp-3.14.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:da4f142fa078fedbdb3f88d0542ad9315656224e167502ae274cbba818b90c90", size = 1577547, upload-time = "2026-07-20T19:52:30.658Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/e2/1d79f1ab35593d70dabed98936ae842ac90d12847c9a62bba4a19d6005a4/aiohttp-3.14.2-cp314-cp314-musllinux_1_2_s390x.whl", hash = "sha256:3d4238e50a378f5ac69a1e0162715c676bd082dede2e5c4f67ca7fd0014cb09d", size = 1781840, upload-time = "2026-07-20T19:52:33.021Z" },
+    { url = "https://files.pythonhosted.org/packages/01/73/770be856c6fc861563999081a5fe2d44e16b4255f5fd94b2217a2349ca65/aiohttp-3.14.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:03330676d8caa28bb33fa7104b0d542d9aac93350abcd91bf68e64abd531c320", size = 1745757, upload-time = "2026-07-20T19:52:35.541Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/0b/861fdbe3ff90b503a4d0a12276623f4afbe54c237ca876fc560125c270a3/aiohttp-3.14.2-cp314-cp314-win32.whl", hash = "sha256:43387429e4f2ec4047aaf9f935db003d4aa1268ea9021164877fd6b012b6396a", size = 455863, upload-time = "2026-07-20T19:52:37.634Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/03/cc8234d0f06fe4b0e1777c7ed313cc9014f078f72a9a0cbdc144965d1bd7/aiohttp-3.14.2-cp314-cp314-win_amd64.whl", hash = "sha256:e3a6302f47518dbf2ffd3cd518f02a1fbf53f85ffeed41a224fa4a6f6a62673b", size = 480986, upload-time = "2026-07-20T19:52:39.665Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/b0/ae17dd629e22160f453b9041a4aee80a8a917ba2f44d5b3e252cc501ed2c/aiohttp-3.14.2-cp314-cp314-win_arm64.whl", hash = "sha256:8d1f3802887f0e0dc07387a081dca3ad0b5758e32bdf5fb619b12ac22b8e9b56", size = 453588, upload-time = "2026-07-20T19:52:41.634Z" },
+    { url = "https://files.pythonhosted.org/packages/30/54/4bbcc00f04dbc380103ee669a56df30dea127c3686c8dc2ab86b05a1387b/aiohttp-3.14.2-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:9094262ae4f2902c7291c14ba915960db5567276690ef9195cdefe8b7cbb3acb", size = 791337, upload-time = "2026-07-20T19:52:43.821Z" },
+    { url = "https://files.pythonhosted.org/packages/e7/37/4f95edc1488580c63c0b5baaef429afbacadc7ccd9c47431cdcce90d9e5a/aiohttp-3.14.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:165b0dcc65960ffc9c99aa4ba1c3c76dbc7a34845c3c23a0bd3fbf33b3d12569", size = 526335, upload-time = "2026-07-20T19:52:45.903Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/ed/1d7ae73764d135638797a427cb637ae3d98f1fd61208c25891a9f26cdd67/aiohttp-3.14.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f518d75c03cd3f7f125eca1baadb56f8b94db94602278d2d0d19af6e177650a7", size = 532102, upload-time = "2026-07-20T19:52:47.994Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/12/da9816eee0d81506560259e7c0af93a4aa7df98acd0fe276958abd42d7c3/aiohttp-3.14.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:9b937d7864ca68f1e8a1c3a4eb2bac1de86a992f86d36492da10a135a482fab6", size = 1922727, upload-time = "2026-07-20T19:52:50.224Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/b9/d7ccbcde223a72c7b8f3458bdb08c2bacf5fc268a1fdd5cc29861eb0e4e2/aiohttp-3.14.2-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.manylinux_2_31_armv7l.whl", hash = "sha256:b155df7f572c73c6c4108b67be302c8639b96ae56fb02787eeae8cad0a1baf26", size = 1787202, upload-time = "2026-07-20T19:52:52.825Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/7c/39174069b7df18ea22b23a0fa9abffe4c091f0f86d53af83ddcbb5f44c8f/aiohttp-3.14.2-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:0bfea68a48c8071d49aabdf5cd9a6939dcb246db65730e8dc76295fe02f7c73c", size = 1912574, upload-time = "2026-07-20T19:52:55.007Z" },
+    { url = "https://files.pythonhosted.org/packages/21/ff/bd2b7473510caf352aef3f52a3d4fe10184ec22747df74ab658b4402020f/aiohttp-3.14.2-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.manylinux_2_28_s390x.whl", hash = "sha256:8241ee6c7fff3ebb1e6b237bccc1d90b46d07c06cf978e9f2ecad43e29dac67a", size = 2005478, upload-time = "2026-07-20T19:52:57.401Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/ee/db26af0acc994350b653b3a73dddf9ee9886bf2fdb68b23fc98705e76442/aiohttp-3.14.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ec64d1c4605d689ed537ba1e572138e2d4ff603a0cb2bbbfe61d4552c73d19e1", size = 1879709, upload-time = "2026-07-20T19:52:59.778Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/4d/592451fd40edca73fcb099d8718668cea36dc1dde873dd0f8e91a4081051/aiohttp-3.14.2-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:0fb26fcc5ebf765095fe0c6ab7501574d3108c57fca9a0d462be15a65c9deb8d", size = 1675699, upload-time = "2026-07-20T19:53:02.11Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/3e/c1ce4aa13fd1f910e437684843ea6cf6e0041f91d89a1b0389dce247ee59/aiohttp-3.14.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:ef710fbb770aefa4def5484eeddb606e70ab3492aa37390def61b35652f6820a", size = 1843542, upload-time = "2026-07-20T19:53:04.385Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/a4/3f9e22fda714cc38ef558166ff3326cd2f6f65c33da92ba00e3641cbea54/aiohttp-3.14.2-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:d813f54560b9e5bce170fff7b0adde54d88253928e4add447c36792f27f92125", size = 1827505, upload-time = "2026-07-20T19:53:07.072Z" },
+    { url = "https://files.pythonhosted.org/packages/37/9d/260c7b8a25c7cd74bee63ce957556a2d25839a321e9107a089d4da3a51af/aiohttp-3.14.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:1aa4f3b44563a88da4407cef8a13438e9e386967720a826a10a633493f69208f", size = 1853751, upload-time = "2026-07-20T19:53:10.012Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/d6/7c3cfa191e666bf7b48b4346815900b35b85b43ffff783fd0be52e45fe09/aiohttp-3.14.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:4610638d3135afaefadf179bffd1bbf3434d3dc7a5d0a4c4219b99fa976e944d", size = 1668850, upload-time = "2026-07-20T19:53:12.362Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/af/d9b8353aee9506dace04ca22c3c4e93b7375d9343c4780c8b512972fc6f9/aiohttp-3.14.2-cp314-cp314t-musllinux_1_2_s390x.whl", hash = "sha256:6e30743bd3ab6ad98e9abbad6ccb39c52bcf6f11f9e3d4b6df97afffe8df53f3", size = 1883642, upload-time = "2026-07-20T19:53:14.664Z" },
+    { url = "https://files.pythonhosted.org/packages/ed/29/ed64c0a013322570a02e5b0e359df2cfd30ae58ba045748dc78175f15826/aiohttp-3.14.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:68a6f7cd8d2c70869a2a5fe97a16e86a4e13a6ed6f0d9e6029aef7573e344cd6", size = 1844092, upload-time = "2026-07-20T19:53:16.995Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/74/ce6f229510fdd46ee7365fbb759ffaa3004e0bcc59fbd0ec51d8a8efc775/aiohttp-3.14.2-cp314-cp314t-win32.whl", hash = "sha256:205181d896f73436ac60cf6644e545544c759ab1c3ec8c34cc1e044689611361", size = 474098, upload-time = "2026-07-20T19:53:19.645Z" },
+    { url = "https://files.pythonhosted.org/packages/72/4c/877c07a6d97a1a0e5e25a06bab76dd7449b533ff8bb6c281c5af8b09c8d9/aiohttp-3.14.2-cp314-cp314t-win_amd64.whl", hash = "sha256:312d414c294a1e26aa12888e8fd37cd2e1131e9c48ddcf2a4c6b590290d52a49", size = 500480, upload-time = "2026-07-20T19:53:22.227Z" },
+    { url = "https://files.pythonhosted.org/packages/42/d8/d4c74bb7990da2ee6116fe262ace41cf376ebc6b0bda694c77eeaab5a509/aiohttp-3.14.2-cp314-cp314t-win_arm64.whl", hash = "sha256:63b840c03979732ec92e570f0bd6beb6311e2b5d19cacbfcd8cc7f6dd2693900", size = 469248, upload-time = "2026-07-20T19:53:24.622Z" },
 ]
 
 [[package]]
@@ -608,63 +608,63 @@ wheels = [
 
 [[package]]
 name = "hypothesis"
-version = "6.156.6"
+version = "6.158.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "sortedcontainers" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/20/83/8dbe89bdb8c6f25a7a52e7898af6d82fe35dfef08e5c702f6e33231ce6c6/hypothesis-6.156.6.tar.gz", hash = "sha256:96de02faefa3ce079873541da96f42595583bb001e8e4219294ed7d4501cc4cc", size = 476304, upload-time = "2026-07-10T20:56:49.96Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e6/ed/4c6cf6eaeeba141f31b56f5c046c5466470eda5e64beb24fee10db16312a/hypothesis-6.158.0.tar.gz", hash = "sha256:28de590146b445edb2a4976b7e9a257d24401eaa4fee699a90e98c1321c2184a", size = 482112, upload-time = "2026-07-21T08:32:58.063Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/1a/dc/0c2a851f06c91d5ac9ef0f3b9615efc1ed650411d2eee23b6334f491c85e/hypothesis-6.156.6-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:caf6a93d011c10972da111c38ceb34ced20feaa8581e2b350c0655b022e27875", size = 747998, upload-time = "2026-07-10T20:56:16.311Z" },
-    { url = "https://files.pythonhosted.org/packages/8e/f8/59203ca978ab51595d12d6bc7e7a63300d7373431ab42ca3f1742e45db68/hypothesis-6.156.6-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:07f2bc9df1aeba80e12029c1618e2ee54abc440068c305d7075ffd6b85251843", size = 743073, upload-time = "2026-07-10T20:55:36.825Z" },
-    { url = "https://files.pythonhosted.org/packages/68/d8/86a0023740434098d1b187a62bd5f99b198f098fb43e7fc58342283a8270/hypothesis-6.156.6-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:7baca17f4803ad4aa151732326f3990baf54c3127df44aa872ac5bdf8a98a9a6", size = 1070169, upload-time = "2026-07-10T20:55:49.47Z" },
-    { url = "https://files.pythonhosted.org/packages/9b/82/673453915fd0c67673f35a4876ba88f48c621335f293f3537d77b27d4286/hypothesis-6.156.6-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:8083806645f84243aade727f4978185caaa0b7190af4318673999ee15fdbf424", size = 1121760, upload-time = "2026-07-10T20:55:53.502Z" },
-    { url = "https://files.pythonhosted.org/packages/8a/c3/3a5557f52912f2fecc6ed59642dcf80dd8e89d0d9664502b68e23d66bf3d/hypothesis-6.156.6-cp310-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:a922eedcd8618f9c2e17b79fa7b3f3f0b2df34e201958611cc3f0f46cca33c10", size = 1111440, upload-time = "2026-07-10T20:55:43.054Z" },
-    { url = "https://files.pythonhosted.org/packages/38/a6/ae636d4ca7f996a1ccb4b3d5997d949f1718fba52b01559b3ab53b237b3f/hypothesis-6.156.6-cp310-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:5291bd33c4704d274d7c214d5c200e77f372a06644f5cbbe96dcbe53cb2fbf10", size = 1244944, upload-time = "2026-07-10T20:55:56.109Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/79/c425d22d734be0268ca60d120c6296299e4220a1783cb1a4cc76232807bb/hypothesis-6.156.6-cp310-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:55f3ec50161b4a95bae63bff2b5166e45935b493013d3be30ede279bf6192318", size = 1288808, upload-time = "2026-07-10T20:56:06.249Z" },
-    { url = "https://files.pythonhosted.org/packages/c5/3a/cc9f479d22cbdd36ddfc55a978378eddadd183b09339ebdb81be33bb18e7/hypothesis-6.156.6-cp310-abi3-win32.whl", hash = "sha256:e96570ca5cdd9a5f2ff9e80a6fb2fd5420ebf33b833d7de5b09b6ebb26a3eb6c", size = 634868, upload-time = "2026-07-10T20:55:37.959Z" },
-    { url = "https://files.pythonhosted.org/packages/d6/89/2008d287289841a936456cb13443ca89d88da6e4527d611d482e9544164d/hypothesis-6.156.6-cp310-abi3-win_amd64.whl", hash = "sha256:32710718c22fe8c5571464e898bb87d282837b02617d6ad68130abf7cb4843cb", size = 640382, upload-time = "2026-07-10T20:55:30.634Z" },
-    { url = "https://files.pythonhosted.org/packages/13/64/e4a0796190d8089e85f06731e21fdddd7e8edd3a4e562101527a048e21c4/hypothesis-6.156.6-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:5baec7943a14d106e982121dd4f74cfc5ef45e37c17f94fe49338d3d1377f38c", size = 748988, upload-time = "2026-07-10T20:56:48.22Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/a2/4a789b286cd2cced31992e1f683036b51dd6909b934ea007ffb43aa3a32f/hypothesis-6.156.6-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:b5f519905ddeb10e23b8ba2c254541a5b1a8f146fe0551be94d972f4a77226f4", size = 743754, upload-time = "2026-07-10T20:56:09.113Z" },
-    { url = "https://files.pythonhosted.org/packages/d2/f7/3dd36c1c03d24ae3ffc3c5b0eca8cc4ae90c07abc320f76509eceb37019a/hypothesis-6.156.6-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4c108655960b58ded3ca71b2dc5c69fb2ba7e9c723aeb6106facec3892d09087", size = 1070732, upload-time = "2026-07-10T20:56:28.738Z" },
-    { url = "https://files.pythonhosted.org/packages/57/51/befc4b816b471078034a875eb1ef69e0411ab84bcce582b4be173258785a/hypothesis-6.156.6-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7c8d37bebb6924729bc0bbf5852689df568842948abe4d93dd0ad3377adf76fa", size = 1121988, upload-time = "2026-07-10T20:56:07.676Z" },
-    { url = "https://files.pythonhosted.org/packages/05/b7/a796f5e3e4b7cb911ff346008d49720296d1f4073490b8bc1cce6b3fbb07/hypothesis-6.156.6-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:74137bef6d502305c3648b2ed1a9bb4bc05fb1025e96b30a2c092204c40fe097", size = 1245596, upload-time = "2026-07-10T20:55:50.662Z" },
-    { url = "https://files.pythonhosted.org/packages/37/65/849c4cba44a6f6cc888fd931124429b24180234ccc4883abab8cad5fcfcb/hypothesis-6.156.6-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:5e0afdf79cceed20fcf0a9fb80d4064a9b2b53d4d4eecbac0e21208a13f5a31b", size = 1289172, upload-time = "2026-07-10T20:55:58.915Z" },
-    { url = "https://files.pythonhosted.org/packages/13/03/7106a110df29eb631d66776e8aa8128f82f04a9dd2b6b22b612e6025e3a2/hypothesis-6.156.6-cp311-cp311-win_amd64.whl", hash = "sha256:84dc89caaf741a02f904ca7bd02b1af99650c75552868162290208aeecb70858", size = 640222, upload-time = "2026-07-10T20:56:10.396Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/45/9f009005b9c796f4a40424484ac7e70847bc088456fd940a937f96bb4b6d/hypothesis-6.156.6-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a2a728b514fceb81e3f0464508911d5220fd74dadc3270f859427a686b60c4cf", size = 748844, upload-time = "2026-07-10T20:56:38.036Z" },
-    { url = "https://files.pythonhosted.org/packages/02/2f/4d852bb8a9c73a68b18eca9b5b085285282122166e158f4d2a477639bfee/hypothesis-6.156.6-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:7489b9a8f9df8227edd6c7cd8b9ccfab2483bab24da6a474c175973ca2294f58", size = 741936, upload-time = "2026-07-10T20:55:27.539Z" },
-    { url = "https://files.pythonhosted.org/packages/74/89/b9968070ae042f9bf3149bb6ba6399d5f28f452e0fb7f638cafc69ff0b9a/hypothesis-6.156.6-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:42760873d6db1069d6edbaa355a61b9078a9950259efcfc72fc695741d7db7cd", size = 1069749, upload-time = "2026-07-10T20:56:43.017Z" },
-    { url = "https://files.pythonhosted.org/packages/00/a9/753806f5292b40aeab1d269e408e3a7e85be3c0d88828fb78ab4a34d6626/hypothesis-6.156.6-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b4e66aaa7385538a5d617174d47c198ee807f06de99e282a67c6cb724c69340d", size = 1120983, upload-time = "2026-07-10T20:56:25.424Z" },
-    { url = "https://files.pythonhosted.org/packages/85/88/8386d064d680be27e936eba94f1448bc93ef6fa05473ee5034139f1c4284/hypothesis-6.156.6-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:08796b674c0b31a5dd4119b2173823390055921588d13eb77324e861b00fd7f8", size = 1243911, upload-time = "2026-07-10T20:55:54.799Z" },
-    { url = "https://files.pythonhosted.org/packages/c1/8c/7524c1e5279e7728eb47c99f2357cbc5f08ae92e9bce49bf50118b53f9c9/hypothesis-6.156.6-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:4ca8cc26ea2d31d22cf7710e92951cfaa921f0f8aa1b6db33a5176335f583a4f", size = 1287806, upload-time = "2026-07-10T20:56:02.176Z" },
-    { url = "https://files.pythonhosted.org/packages/5a/b3/c347ad913e1c5f2988956fe17826c0400b4ce470b973e6c248e97b6a0acf/hypothesis-6.156.6-cp312-cp312-win_amd64.whl", hash = "sha256:c3363d3fb8015594636689572510bb6090602d8e8e838a5693c2d52d3b5b09d8", size = 637679, upload-time = "2026-07-10T20:55:39.056Z" },
-    { url = "https://files.pythonhosted.org/packages/70/5d/9583fe153573523dac27226c89e041a86ad4aeeae08c868160cbb93d39d2/hypothesis-6.156.6-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:59a8def90d9a5a9b67e1ac529e903a2363ceb6cf873c209da6b4284c5daab671", size = 749264, upload-time = "2026-07-10T20:56:46.118Z" },
-    { url = "https://files.pythonhosted.org/packages/86/35/e4113d06769b544f0fb77ffea9195b598b4c56a298905c21fd47c4eed388/hypothesis-6.156.6-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:c574c3224563d730848bc5d1ef1683c4f83993400c0167899fe328f4bfcd4725", size = 742095, upload-time = "2026-07-10T20:56:41.412Z" },
-    { url = "https://files.pythonhosted.org/packages/d8/5c/a47666ede10384e8978722cade7ab96a42df71d2ab577317092d0fed7c8a/hypothesis-6.156.6-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:01bb8270c46b3ef53b0c2d23ff613ea506d609d06f936d823ea57c58b66b05f7", size = 1069917, upload-time = "2026-07-10T20:56:04.845Z" },
-    { url = "https://files.pythonhosted.org/packages/79/93/75f6057dadd9dc0134f37c08d5d14d04d3cd7374debbcb0cc4569c6712f1/hypothesis-6.156.6-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:d4ea6559c13606e13b645927f2e0906e52b5ac5d99b40d3abaaeb2e8c7ceeb75", size = 1121204, upload-time = "2026-07-10T20:55:52.008Z" },
-    { url = "https://files.pythonhosted.org/packages/62/87/308efef08bc60d1e673d035e8ca8e9663f4b6b3ba519c3cdebf6583c2b76/hypothesis-6.156.6-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:2d47054d0230f0dd9b6868fc030126c7a6c25527144272ff376cc4e9c39f7540", size = 1244168, upload-time = "2026-07-10T20:55:40.288Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/66/de8fff5bd9a40a4056dafbe7f904887ef12632282bbbac90f1977c30dd3b/hypothesis-6.156.6-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:050c8c0815f88d47dd0875a92698d20d61639b7b721ee043a6d687c7f14ff7d8", size = 1288127, upload-time = "2026-07-10T20:56:00.541Z" },
-    { url = "https://files.pythonhosted.org/packages/cf/8d/794fb26e1fd3ff004978f8f18b7aa7e1c2270ba72e1f977b987a812064f8/hypothesis-6.156.6-cp313-cp313-win_amd64.whl", hash = "sha256:f0d73edab7b8a0051b3634f2d04d62b7e7282f8f274963b11188ee4957d672ef", size = 637954, upload-time = "2026-07-10T20:56:33.35Z" },
-    { url = "https://files.pythonhosted.org/packages/a5/be/5b4b27984cb43c60e95f570b069660335dad34cb67f7d226017c5d35d31e/hypothesis-6.156.6-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:34a70a7b8226e34d658072d8fb81d03f97f0a75ceb536329a321b94ce2232fd6", size = 749312, upload-time = "2026-07-10T20:55:46.902Z" },
-    { url = "https://files.pythonhosted.org/packages/31/11/709cceffc28666c9d4cb75ffc6df5ce30db8c7dd5cc2c8b38a2fd837427f/hypothesis-6.156.6-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:f1969646beead7d8cf6a2537d2765af89d73056e2cb218e7fae92b83802250a3", size = 742332, upload-time = "2026-07-10T20:56:30.254Z" },
-    { url = "https://files.pythonhosted.org/packages/84/52/cfc79b13d8dd3cd6de6b9df921c557efe8528a9c90a3a7cd93b37188d57e/hypothesis-6.156.6-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cbc2ec7b7d905e6b6ec1635f6340bfa52aaab718101c59f052bc012a6b486cd8", size = 1070109, upload-time = "2026-07-10T20:55:48.244Z" },
-    { url = "https://files.pythonhosted.org/packages/ca/ac/1da4def1f006b5ad01187ff96379e24c37439d659ec10c3e944c03436c0f/hypothesis-6.156.6-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9367ae25dfa6dc1af37904785e43c4f8fe1c4118cafdc2f06514154fbdd90992", size = 1121528, upload-time = "2026-07-10T20:56:39.665Z" },
-    { url = "https://files.pythonhosted.org/packages/68/47/744e4f5e3d635dea20dbedf3fa486e2a6fa5210e0a52a0d5c4da56babd84/hypothesis-6.156.6-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:455f09107ec07c78f2a83cb8fc19e23879c9d51cdc831de6f9cb6ec4059cb9af", size = 1244690, upload-time = "2026-07-10T20:56:31.854Z" },
-    { url = "https://files.pythonhosted.org/packages/25/8a/42252fcd5e521d140dac532f29c2a13ca8f22908cb545ffdd64b5e225680/hypothesis-6.156.6-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:c76634c45a3ceee4c4fdfed39aebd08b8b822ec8b0c556877ef82846fd777730", size = 1288519, upload-time = "2026-07-10T20:56:03.429Z" },
-    { url = "https://files.pythonhosted.org/packages/44/e7/176df9e47cf583d2b8d234b78c0aac3a47075ad5d147e60b2c21a1338bb1/hypothesis-6.156.6-cp314-cp314-pyemscripten_2026_0_wasm32.whl", hash = "sha256:eb7e9f8343bc6b948937e6ec12e6879ed25a17b53ceccbd2b84adadd3d511698", size = 586452, upload-time = "2026-07-10T20:56:22.285Z" },
-    { url = "https://files.pythonhosted.org/packages/8c/75/2c8a0411bbe76429f3ae738ef9a00107201bf6146d9534350014ce369d98/hypothesis-6.156.6-cp314-cp314-win_amd64.whl", hash = "sha256:f9631cd604ae6032c3edf99160dc1b9e33873f2e52762246b24f07fb758652ae", size = 637774, upload-time = "2026-07-10T20:56:34.97Z" },
-    { url = "https://files.pythonhosted.org/packages/2a/22/8115005e9aa72c8d63d90e9db5e0b8425fd8950fbc5d6e332805d4d32c9e/hypothesis-6.156.6-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:1f81163d36d3763b09ffaef7c3a71e88174ca3e6816201fca9d1d159f448fdb5", size = 747428, upload-time = "2026-07-10T20:56:44.611Z" },
-    { url = "https://files.pythonhosted.org/packages/e8/c2/66bfe9337f4a4b1f7754ee6d01d950280152a81d0d797e6c1d9eb0909750/hypothesis-6.156.6-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:556b905767e36147918634a64356aa05d8c956576f00aee01eb351678f193908", size = 740889, upload-time = "2026-07-10T20:55:57.656Z" },
-    { url = "https://files.pythonhosted.org/packages/95/3b/69f45af2d4f0950b7d1af3cdbdd800b88a6c2370331481eda79d6171fbe3/hypothesis-6.156.6-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:c3f2604b28d16d696aaaf4954d20f907b27e54034df98e64746a20c74c319f03", size = 1069270, upload-time = "2026-07-10T20:56:12.024Z" },
-    { url = "https://files.pythonhosted.org/packages/f8/43/6b2549885da08f5e50ba34fb8e0d0a60b2f190ffd516fac220f8db5b5869/hypothesis-6.156.6-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ffe012ad66dbe7b8e8ddef6f6992ab1b36719ea64430c2bf1ff7135521052a15", size = 1120409, upload-time = "2026-07-10T20:55:34.551Z" },
-    { url = "https://files.pythonhosted.org/packages/70/97/745c778c3eb29befa2367b1ded8437eecfbbe6932359d0f831275bc32170/hypothesis-6.156.6-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5bfa3c7b758f7278081c6bfec5f89b43c4eb075c0c9eb095323f7a9eb019b513", size = 1243111, upload-time = "2026-07-10T20:56:17.83Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/d7/c5ec6a442dc9b822f47064bda4b6d3e739dccdd1c5bf44c9a57fb6136830/hypothesis-6.156.6-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d0db1f4573800c618773622f03cb6533bb3377430ef938c9476ba10c39d22591", size = 1287262, upload-time = "2026-07-10T20:56:23.749Z" },
-    { url = "https://files.pythonhosted.org/packages/11/0c/c134d61710e14b68b010215dcf6bd57d2ec05cd169dff8bfab8fefc2d410/hypothesis-6.156.6-cp314-cp314t-win_amd64.whl", hash = "sha256:38cd0c4a7b9f809f1e23a4d15adfa9c5d99869b9afc327350a5e563350b78e48", size = 637862, upload-time = "2026-07-10T20:56:13.347Z" },
-    { url = "https://files.pythonhosted.org/packages/59/9c/b94f3a31665527b6181616b72990fcf8d6d5fa82b4187aab104ab5f548f0/hypothesis-6.156.6-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:8893b4da90e06828846c1b100c3414a7729d047a020d854c0899ae9339df0e70", size = 749575, upload-time = "2026-07-10T20:55:29.371Z" },
-    { url = "https://files.pythonhosted.org/packages/21/74/dcf695f79f526543ae5d0f8c1325508e9fe990a996c0e0853129a9a5d81d/hypothesis-6.156.6-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:b7fc0b7df9b28d028e4cc295b2ac8fbbbc22e090a23382c92fff5e37696be74f", size = 744351, upload-time = "2026-07-10T20:56:36.46Z" },
-    { url = "https://files.pythonhosted.org/packages/11/d3/5bff4c55c6995a6c43f66ec8e5866b56e34f03837fd0be0e4922f3bab168/hypothesis-6.156.6-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:38ed3178526382d392d04ad699ad7a2e53845e521a09d40f1cbbc1e1ff63ba48", size = 1070916, upload-time = "2026-07-10T20:56:19.256Z" },
-    { url = "https://files.pythonhosted.org/packages/ba/af/5ed42117a69221ea118caaff933d8212039a0ac0bc15afa915635f13984c/hypothesis-6.156.6-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:5ad94e28aabf4db0d479297d43b8a2a01e7caaa9bdfccfdac7a4a3717e05b993", size = 1122625, upload-time = "2026-07-10T20:56:14.758Z" },
-    { url = "https://files.pythonhosted.org/packages/3b/d3/02499badc6e3f3e980941021edf5fd780c895d8d08c9015e78516340ed83/hypothesis-6.156.6-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:983a5cfd955994bffc7eb02976241f7a1f3c2d94dbc3389430c45858fa5c1ae0", size = 640823, upload-time = "2026-07-10T20:55:45.461Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/94/23d6a665c01dcc4e18ccae7a74f4e5506f79d0429fd87421a2003c62a702/hypothesis-6.158.0-cp310-abi3-macosx_10_12_x86_64.whl", hash = "sha256:6463dcef7c689599702a8a60576401ccfa636d8d548fcb7e0cd17852cc135208", size = 763003, upload-time = "2026-07-21T08:31:20.267Z" },
+    { url = "https://files.pythonhosted.org/packages/18/ea/860fe643364921dcb3c1cad83f081fef9d591faebb2fc9666d7a54f1b92f/hypothesis-6.158.0-cp310-abi3-macosx_11_0_arm64.whl", hash = "sha256:d4d7a24ef1cce3e8283d7f1e48c4d4c9eadf9f0a7180cafe1f049daedf883f69", size = 758645, upload-time = "2026-07-21T08:32:54.073Z" },
+    { url = "https://files.pythonhosted.org/packages/25/1f/037d911ab724834160306ca4231f32e524f586d3737be88bb22469e2101e/hypothesis-6.158.0-cp310-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:04e1479783ea6d2ae66b87922f611a90a21b7d44c056c71b2132433f5cd26cd2", size = 1087830, upload-time = "2026-07-21T08:32:43.698Z" },
+    { url = "https://files.pythonhosted.org/packages/72/b5/2211931139c9592e8bbd00ec9398cf6f5666e6c555672ea1a3d31506b4d9/hypothesis-6.158.0-cp310-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7e9dbb5fff5bcc9a846d915aeb7e21bf04ee0057430e3221d8be81dd3eac9f45", size = 1137366, upload-time = "2026-07-21T08:31:24.383Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/11/3ac6e87d233b34f8dbb0bd1457aecad62320fea34ca04f7ce06bfc647f7f/hypothesis-6.158.0-cp310-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:0764a33f217213db9f291a3079fbcc096043f584752806d7b82641e8f05d4010", size = 1129454, upload-time = "2026-07-21T08:31:51.231Z" },
+    { url = "https://files.pythonhosted.org/packages/19/aa/842b35e034f9bf1c4d47d98a6ea41679afe5bf120bfb0cc07049ff947e73/hypothesis-6.158.0-cp310-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:e271cc58a725b5c193ef34c8eec732a271ccb4fc8e26c8733a47b5948b7b411c", size = 1261716, upload-time = "2026-07-21T08:32:08.222Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/4d/2038ce2ead1bc61fc7de08288e4a55f127fa8c18ff66d40fe0f7e6e1137f/hypothesis-6.158.0-cp310-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:d033b98e3c07e94a92bb71bd786d431c67e3840928a8c5f9dd845710bdf5728d", size = 1304332, upload-time = "2026-07-21T08:32:18.746Z" },
+    { url = "https://files.pythonhosted.org/packages/24/ca/dae12b31d4b324e04a4ada4cbb0831b35857b5a76d946ab0b414f1e605ec/hypothesis-6.158.0-cp310-abi3-win32.whl", hash = "sha256:818bc65c96ebc7c919cb423534a1e892ebac07eda4b7004b7d61cbd2f6b20db4", size = 648871, upload-time = "2026-07-21T08:31:17.96Z" },
+    { url = "https://files.pythonhosted.org/packages/38/c5/948d29157cc17711d763424e2f085d70d4b5f9314cb12a1c10310003050b/hypothesis-6.158.0-cp310-abi3-win_amd64.whl", hash = "sha256:737108d7f549f39d0df82e3cdbc27f23183babf38ea8187cf944ea375246d2d2", size = 655041, upload-time = "2026-07-21T08:31:40.716Z" },
+    { url = "https://files.pythonhosted.org/packages/02/54/3546b551986265fe5d1edcb66ecae163ef38c30664386d23bc7abf9a76b8/hypothesis-6.158.0-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:e81816c2ab2554cc37bfcd99cb4c91ee930c4b99facf87edd4cc895b206e6a7b", size = 763500, upload-time = "2026-07-21T08:31:34.771Z" },
+    { url = "https://files.pythonhosted.org/packages/52/1c/bba2b751ebd4c6ae673129a269e53a4afd854f2c64a21bd6254cbd6dba29/hypothesis-6.158.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:103f8a6fdeb5010d440a1698a535d86c3cd9e69e37be072bf2dc22f7bbb4bdc1", size = 759282, upload-time = "2026-07-21T08:31:45.772Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/aa/81529917e0abe3854857fb85b66da0a5e80d571ec491f6a966c78e2a937a/hypothesis-6.158.0-cp311-cp311-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:fffcd4ea3dbb6268ea75d3e9f4dde48eab0ce3d0d4d5019119f974835721e3b8", size = 1088185, upload-time = "2026-07-21T08:31:28.637Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/dc/f35581ef57e48b3b77afe604b80dab48d774f11311866ded190bb02cada8/hypothesis-6.158.0-cp311-cp311-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:04c94250ca7d38cdf7320914bed98af4fab5c4a3f32c231d0959654691169ab5", size = 1137655, upload-time = "2026-07-21T08:32:25.962Z" },
+    { url = "https://files.pythonhosted.org/packages/17/cd/fd02f654a816cc5e9189f220598955c2ddf768dba7cc6008510ff9af6c15/hypothesis-6.158.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:0cf564bee3da8716203dfa6ee4be43827f87ceee1c457562b3806faa5ccd2cb2", size = 1261957, upload-time = "2026-07-21T08:32:49.891Z" },
+    { url = "https://files.pythonhosted.org/packages/56/ed/8f9a1a147402d5117e42b9942b8e100f3e8b22a6aaea2553b2a99769f560/hypothesis-6.158.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f9650154c1d3c5747f279aa6c66224fc93ca93590248622395e954216e6a9a6d", size = 1304661, upload-time = "2026-07-21T08:31:31.652Z" },
+    { url = "https://files.pythonhosted.org/packages/07/24/d48c6f39de75b93303104f9d70a621caeceb540eb411684a3e1af8cb735b/hypothesis-6.158.0-cp311-cp311-win_amd64.whl", hash = "sha256:b0f271f47f4ee40362c2b8bac7d06647cfe6a9e93d39008a007039441863be96", size = 654727, upload-time = "2026-07-21T08:31:36.164Z" },
+    { url = "https://files.pythonhosted.org/packages/69/6b/de7043f98393b244dac8b840968f08c764221cfa93a1d3585f87ff1f7079/hypothesis-6.158.0-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:c5e2eead0270c5144aa69c81225a140b2e0f7c84da9497e957c57fef3172adf4", size = 764629, upload-time = "2026-07-21T08:32:47.63Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/1b/b0a49018a268e4d3d2f4fb781f8af9a1f2cb46b694c03bedf7eda5146b11/hypothesis-6.158.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:ab82549afe2b514e3bf01f4dd5bc17143376f4cdc496eed0dd81faf7da4d0a46", size = 756262, upload-time = "2026-07-21T08:31:37.637Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/7a/b1481cdf5eadda97ced31e0ad3972f3390d7ae6c893309c3f600b74f0212/hypothesis-6.158.0-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:8b087dd6e301d91db25b2f7647d6eb931126f608d54f79087d4892183959d768", size = 1086611, upload-time = "2026-07-21T08:31:30.123Z" },
+    { url = "https://files.pythonhosted.org/packages/fe/aa/953166c303ebe2ba53ee6250145489464c5c7489423d0732833f0f071c97/hypothesis-6.158.0-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:ebc4a11e324330ff84744a708e2c35bccae0807dd459fbc8ea8c33429f9b8980", size = 1136681, upload-time = "2026-07-21T08:31:57.633Z" },
+    { url = "https://files.pythonhosted.org/packages/c6/bd/039790614f942b85066e90c7ccfb3565d675748d56dad29f95e665892e9f/hypothesis-6.158.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:fa777442b00878c0102d7f7d4f61f9fe0482eab90b01011b4b42d68578a9c89f", size = 1259394, upload-time = "2026-07-21T08:32:04.927Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/b3/9cf3d28a4f4a18d6c56b4c1ddb243fbb7bb8fec71c9d8f59ef27a5dd557f/hypothesis-6.158.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:c05e31750b47152cb95b450b7a97d95652b214da24759060e8eeaa7114b67356", size = 1303672, upload-time = "2026-07-21T08:32:22.429Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/de/7b5cdb8391526eaa2ed9a81e9244655143c375c22caabc0649efb6cf56ef/hypothesis-6.158.0-cp312-cp312-win_amd64.whl", hash = "sha256:daf29de47ef4646c3cac1c4c6191bc60131d1efc0c23dc4aac6b734eeed2b616", size = 652164, upload-time = "2026-07-21T08:32:29.747Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/bb/db0f522e77384b099453712abbfea5c80c54d3cb75036a0049d9b4c62417/hypothesis-6.158.0-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:24c0691f6e81b0dbec794c56394065ff1aacf2990b0eda5e3e05ffee3b73230b", size = 764503, upload-time = "2026-07-21T08:31:27.129Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/97/069e1f48bbea2e0b51d6a69e7ac93f66a130bfe42244951ee8b6842bbcc5/hypothesis-6.158.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:5185b4eafc47854702b1fb82f4afba62bfccbfe88fb1817a175736146999ec3b", size = 756163, upload-time = "2026-07-21T08:32:11.985Z" },
+    { url = "https://files.pythonhosted.org/packages/46/c1/4750ae103a3092ede085582d5c5ec91f6f9d434261de6e91b9f8f0fc8b8d/hypothesis-6.158.0-cp313-cp313-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:ac71db149183070efa16255680db8a0f0700bf7017c765dac0ad798d61cb6713", size = 1086523, upload-time = "2026-07-21T08:31:56.069Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/6b/476db4392eb1204416cd468c192ab14ccb42f37b5dae4c3ae470d2773b78/hypothesis-6.158.0-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:3ee998b9568fc223276993f16349232b5e04f303acc747ef783d3837eb2660e3", size = 1136497, upload-time = "2026-07-21T08:31:59.475Z" },
+    { url = "https://files.pythonhosted.org/packages/11/62/1a163fbf1e047c1852e9c97a6d8d1bf28adb66f39b05c2d19e5ee84f425c/hypothesis-6.158.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:9262957d64ad7beb93d7dccfec239a23546a38896c96bd5f7439e561df502de0", size = 1259413, upload-time = "2026-07-21T08:32:01.109Z" },
+    { url = "https://files.pythonhosted.org/packages/db/e4/ab04fb53df2bd0976a054e124e53cbe0f9eae972fd5e59465df159377820/hypothesis-6.158.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e767be7d29251a85fa81a028054e844991db554a0d307c75ba2e63154b398acf", size = 1303393, upload-time = "2026-07-21T08:32:31.672Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/21/b626bfad3d5b7942fc5978f128ef9be52d9fda59b3664ffdd454b734afa4/hypothesis-6.158.0-cp313-cp313-win_amd64.whl", hash = "sha256:a691d14a2e704dba9cdee02cc8408f9959848195c18284aa3d1fba936f444b60", size = 652111, upload-time = "2026-07-21T08:31:23.089Z" },
+    { url = "https://files.pythonhosted.org/packages/32/ff/40effdf103b165c4d21c0be539e25776d7dbafc99a4d34c23e9b5e3734da/hypothesis-6.158.0-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:9319c552321a16547dfb35e4d06a3cc28718d42b2c85e233bb9ac4c27806443d", size = 764702, upload-time = "2026-07-21T08:32:16.895Z" },
+    { url = "https://files.pythonhosted.org/packages/12/97/8026d08ba6c5c9ddccc341b84a0340014f5c68a97b3bab6c5b1b31bc2859/hypothesis-6.158.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:9ad62e592b568ed347590eb67fc599335f6f48069679b736e031ab0867476f8b", size = 756312, upload-time = "2026-07-21T08:32:39.425Z" },
+    { url = "https://files.pythonhosted.org/packages/74/f6/b0603f2f7675d95fd106c9f82626d3388f56999e3f3f84a1f86bd545d31b/hypothesis-6.158.0-cp314-cp314-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:5cdac8cd8e585ed449f6e82a140eb8234d8afd956f4a39b2214cb35e27e0c4e3", size = 1087076, upload-time = "2026-07-21T08:32:27.899Z" },
+    { url = "https://files.pythonhosted.org/packages/25/7a/4a1b5acc30364bcc264035bba8c3fd6f5ab026e1eb356bb828a490555bd4/hypothesis-6.158.0-cp314-cp314-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:96d24255c36dd02c3c3556174500d0a1bef0e65f6b7c623830fc758d15c74ee2", size = 1136687, upload-time = "2026-07-21T08:31:49.658Z" },
+    { url = "https://files.pythonhosted.org/packages/d2/ec/17c0cc32c9adbe76621e4f1af4e0fc71cbe625f7ce220e93ef647831b7a8/hypothesis-6.158.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:33b1863a18b034c7365692ba7a58c95b10b4f7dbcb29f417e25a608faf2bff2e", size = 1259844, upload-time = "2026-07-21T08:31:42.415Z" },
+    { url = "https://files.pythonhosted.org/packages/13/11/cd068e62a0a57b4a4f497fe04184d8b7e4bb088b04fbcbb4adc8b393e80b/hypothesis-6.158.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:9fe2b9b4728441f0c896686fff162b6a2ead20a5812f91a523dbe905fcf01bc9", size = 1303709, upload-time = "2026-07-21T08:32:10.067Z" },
+    { url = "https://files.pythonhosted.org/packages/94/98/2bd1d151c5efec6941980f1124aef7014c39014a8b5946d7be4161521ba1/hypothesis-6.158.0-cp314-cp314-pyemscripten_2026_0_wasm32.whl", hash = "sha256:46e9935aadd404c46f9f0689cdabc3af30117d12e223627df9309eb136675d50", size = 596208, upload-time = "2026-07-21T08:32:33.391Z" },
+    { url = "https://files.pythonhosted.org/packages/03/d4/b772e937e1c6810163a7a2db7354e04e96f44d55b77e46e3d1ec5707f3dc/hypothesis-6.158.0-cp314-cp314-win_amd64.whl", hash = "sha256:da6eccd40a69afb219296dc96ed1b0f96c2af361c897ed311b3070a4b7b88911", size = 652050, upload-time = "2026-07-21T08:32:35.224Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/e9/17639f3177daabaf2cf925886f1652d9e23c6bf9a86823ed2a08be59bcf1/hypothesis-6.158.0-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:179fbc1392cf48d7fd8ce2edc16d68cabcb7f94ee3c8a15fb49a5de181e6c791", size = 763283, upload-time = "2026-07-21T08:31:21.87Z" },
+    { url = "https://files.pythonhosted.org/packages/88/b5/86ab00e8dec968f26c0ad8c1cf8331b80042811500a994e330c528e315d5/hypothesis-6.158.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:840a5370b2ae7cdcb9b4facb0f075205bb20f4a84e7ca478c30de7f4d302591f", size = 754781, upload-time = "2026-07-21T08:32:52.111Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/3b/19ee755ab7921cd983aa9d1a11a722b68400b73eaa3a4c38f65bf24440a3/hypothesis-6.158.0-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:afc3d8c285bb4212a3ab4b43eea0c5ee0238fc7fda9617936836267c2a5895ec", size = 1085637, upload-time = "2026-07-21T08:31:25.85Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/1c/07ef6541cc2e70bd19d4c33d6907895e3bfa26089082cda396d67315cd20/hypothesis-6.158.0-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:c4b0de456999b38c19dec86b72cde6a62a216117381709de7c167230b4ea6e2a", size = 1135562, upload-time = "2026-07-21T08:31:52.997Z" },
+    { url = "https://files.pythonhosted.org/packages/36/f8/50c24781b7d1742617328618f352a4bf62c0d5246225e8cad71969d4cbcc/hypothesis-6.158.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:8d741275841323b90ec10001c37d41e9c6726b63354949795331a9635f567de9", size = 1258055, upload-time = "2026-07-21T08:32:20.512Z" },
+    { url = "https://files.pythonhosted.org/packages/38/67/31c5c7dfc6a8d8cab2159f3260bce3c309ae37b4aafe4ce91685aaece340/hypothesis-6.158.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:4ca2ac733eebbfacbf6de277c153375def0555c3fc0aaa097339d54647135097", size = 1302447, upload-time = "2026-07-21T08:31:33.283Z" },
+    { url = "https://files.pythonhosted.org/packages/29/09/eefba6abb03a0045ed815e21b81069d2929d3440a5119261a8dee39502b0/hypothesis-6.158.0-cp314-cp314t-win_amd64.whl", hash = "sha256:2b752bd1e8ea42593bcd6c1997448c9f8c560e784f386bea6206a219e031f46d", size = 652211, upload-time = "2026-07-21T08:32:45.663Z" },
+    { url = "https://files.pythonhosted.org/packages/30/ec/5687248e0227301f6708907bc68e4d1a28dd1e3c2a46fab1cba376a406ad/hypothesis-6.158.0-pp311-pypy311_pp73-macosx_10_12_x86_64.whl", hash = "sha256:0042857f6d2ee003c66a5fda60e2a0e5292fa255ce1d8c7db823b8ae87ed63fb", size = 764442, upload-time = "2026-07-21T08:32:24.248Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/e3/079a600e264746cf6d7aa8bfe18bc5d5765d4f6df15015b9a3a223c0c3db/hypothesis-6.158.0-pp311-pypy311_pp73-macosx_11_0_arm64.whl", hash = "sha256:e50ce9d1a1d9eecff664cce87f7bf93add4a540f4c246934744c3b84bc9daaed", size = 760346, upload-time = "2026-07-21T08:32:56.192Z" },
+    { url = "https://files.pythonhosted.org/packages/57/80/d81670e90194b186644200b89fe5b3e92bb2ebf252d10e4f289a46d7de50/hypothesis-6.158.0-pp311-pypy311_pp73-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:d7161bbd0a5667a7d2efdb6e4bf17f2789c5eadd055192908f9c880dcaeaa716", size = 1089168, upload-time = "2026-07-21T08:31:44.346Z" },
+    { url = "https://files.pythonhosted.org/packages/77/2e/fb336218c7cd3ca93d6958bf51d4797d1477c1dbc7f2ddb3ee387fd76247/hypothesis-6.158.0-pp311-pypy311_pp73-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:61926f0c1ec12711d5fe1d2d3028aee5359576125e4306a8e999debf84d6f36b", size = 1138937, upload-time = "2026-07-21T08:32:02.939Z" },
+    { url = "https://files.pythonhosted.org/packages/24/91/63efab9ba92b1dd4f3b82ab1c1ec61a771f626ef7cfca1ea8e962ce06c11/hypothesis-6.158.0-pp311-pypy311_pp73-win_amd64.whl", hash = "sha256:29ba8b7cfe069cc65c2331758ffafe7366d9ad05c039210b28d7c4521dd01977", size = 655847, upload-time = "2026-07-21T08:31:39.197Z" },
 ]
 
 [[package]]
@@ -782,7 +782,7 @@ wheels = [
 
 [[package]]
 name = "mining-dashboard"
-version = "1.10.2"
+version = "1.11.0"
 source = { editable = "." }
 dependencies = [
     { name = "aiofiles" },
@@ -810,10 +810,10 @@ test = [
 [package.metadata]
 requires-dist = [
     { name = "aiofiles", specifier = ">=24.1" },
-    { name = "aiohttp", specifier = ">=3.10.11" },
+    { name = "aiohttp", specifier = ">=3.14.2" },
     { name = "diff-cover", marker = "extra == 'test'", specifier = ">=9" },
     { name = "grpcio", specifier = ">=1.82.1" },
-    { name = "hypothesis", marker = "extra == 'test'", specifier = ">=6.156.6" },
+    { name = "hypothesis", marker = "extra == 'test'", specifier = ">=6.158.0" },
     { name = "pre-commit", marker = "extra == 'dev'", specifier = ">=4" },
     { name = "protobuf", specifier = ">=6.31.1,<7" },
     { name = "pytest", marker = "extra == 'test'", specifier = ">=9.1.1" },
@@ -822,7 +822,7 @@ requires-dist = [
     { name = "pytest-cov", marker = "extra == 'test'", specifier = ">=5" },
     { name = "pytest-mock", marker = "extra == 'test'", specifier = ">=3.14" },
     { name = "requests", extras = ["socks"], specifier = ">=2.34.2" },
-    { name = "ruff", marker = "extra == 'dev'", specifier = "==0.15.21" },
+    { name = "ruff", marker = "extra == 'dev'", specifier = "==0.15.22" },
 ]
 provides-extras = ["test", "dev"]
 
@@ -1298,27 +1298,27 @@ socks = [
 
 [[package]]
 name = "ruff"
-version = "0.15.21"
+version = "0.15.22"
 source = { registry = "https://pypi.org/simple" }
-sdist = { url = "https://files.pythonhosted.org/packages/0f/36/6f65aa9989acdec45d417192d8f4e7921931d8a6cf87ac74bce3eed98a8e/ruff-0.15.21.tar.gz", hash = "sha256:d0cfc841c572283c36548f82664a54ce6565567f1b0d5b4cf2caac693d8b7500", size = 4769401, upload-time = "2026-07-09T20:01:34.005Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/3a/06/ae069393fc66e8ff33036d4b368003833bf6e88ccf182e17e7a2f1c754fd/ruff-0.15.22.tar.gz", hash = "sha256:3f15175b1fb580126f58285a5dae6b2ea89000136d980c64499211f116b54809", size = 4785063, upload-time = "2026-07-16T15:14:13.244Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/d0/c6/ede15cac6839f3dbce52565c8f5164a8210e669c7bc4decb03e5bdf47d0d/ruff-0.15.21-py3-none-linux_armv6l.whl", hash = "sha256:63ea0e965e5d73c90e95b2434beeafc70820536717f561b32ab6e777cb9bdf5d", size = 10854342, upload-time = "2026-07-09T20:00:53.998Z" },
-    { url = "https://files.pythonhosted.org/packages/28/9d/d825b07ee7ea9e2d61df92a860033c94e06e7300d50a1c2653aac27d24fe/ruff-0.15.21-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:0f212c5d7d54c01bbfe6dcab02b724a39300f3e34ed7acbe995ccb320a2c58bd", size = 11139539, upload-time = "2026-07-09T20:00:57.809Z" },
-    { url = "https://files.pythonhosted.org/packages/f5/de/3b107712e642f063c7a9e0887c427b22cb44097de5aab36c05f2e280670c/ruff-0.15.21-py3-none-macosx_11_0_arm64.whl", hash = "sha256:e6312e41bc96791299614995ea3a977c5857c3b5662b1ecef6755b02b87cb646", size = 10595437, upload-time = "2026-07-09T20:01:00.006Z" },
-    { url = "https://files.pythonhosted.org/packages/9a/6f/b4523cc90ba239ede441447a19d0c968846a3012e5a0b0c5b62831a3d5e3/ruff-0.15.21-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:01d65b4831c6b2a4ba8ee6faa84049d44d982b7a706e622c4094c509e51673be", size = 10990053, upload-time = "2026-07-09T20:01:02.187Z" },
-    { url = "https://files.pythonhosted.org/packages/92/cc/c6a9872a5375f0628875481cf2f66b13d7d865bf3ca2e57f91c7e762d976/ruff-0.15.21-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:2c5a913a589120ce67933d5d05fd6ddbcc2481c6a054980ee767f7414c72b4fd", size = 10666096, upload-time = "2026-07-09T20:01:04.299Z" },
-    { url = "https://files.pythonhosted.org/packages/ab/97/c621f7a17e097f1790fa3af6374138823b330b2d03fc38337945daca212c/ruff-0.15.21-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:5ef04b681d02ad4dc9620f00f83ac5c22f652d0e9a9cfe431d219b16ad5ccc41", size = 11537011, upload-time = "2026-07-09T20:01:06.771Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/51/d928727e476e25ccc57c6f449ffd80241a651a973ad949d39cfb2a771d28/ruff-0.15.21-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:16d090c0740916594157e75b80d666eab8e78083b39b3b0e1d698f4670a17b86", size = 12347101, upload-time = "2026-07-09T20:01:08.859Z" },
-    { url = "https://files.pythonhosted.org/packages/1e/88/8cd62026802b16018ad06931d87997cf795ba2a6239ab659606c87d96bf0/ruff-0.15.21-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:3a10e74757dd65004d779b73e2f3c5210156d9980b41224d50d2ebcf1db51e67", size = 11572001, upload-time = "2026-07-09T20:01:11.092Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/97/f63084cf55444fc110e8cb985ebfcc592af47f597d44453d778cb81bc156/ruff-0.15.21-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:bab0905d2f29e0d9fbc3c373ed23db0095edaa3f71f1f4f519ec15134d9e85c8", size = 11549239, upload-time = "2026-07-09T20:01:13.27Z" },
-    { url = "https://files.pythonhosted.org/packages/9d/77/f107da4a2874b7715914b03f09ba9c54424de3ff8a1cc5d015d3ee2ce0ac/ruff-0.15.21-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:00eca240af5789fec6fe7df74c088cc1f9644ed83027113468efba7c92b94075", size = 11535340, upload-time = "2026-07-09T20:01:15.206Z" },
-    { url = "https://files.pythonhosted.org/packages/d5/e9/601deb322d3303a7bf212b0100ead6f2ee3f6a044d89c30f2f92bf83c731/ruff-0.15.21-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:262ab31557a75141325e32d3357f3597645a7f084e732b6b054dde428ecd9341", size = 10964048, upload-time = "2026-07-09T20:01:17.723Z" },
-    { url = "https://files.pythonhosted.org/packages/ea/2e/0f2176d1e99c15192caea19c8c3a0a955246b4cb4de795042eeb616345cd/ruff-0.15.21-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:659c4e7a4212f83306045ec7c5e5a356d16d9a6ef4ae0c7a4d872914fc655d9d", size = 10667055, upload-time = "2026-07-09T20:01:19.73Z" },
-    { url = "https://files.pythonhosted.org/packages/48/60/abd74a02e0c4214f12a68becfd30af7165cfdcb0e661ecdc60bbb949c09a/ruff-0.15.21-py3-none-musllinux_1_2_i686.whl", hash = "sha256:9e866eab611a5f959d36df2d10e446973a3610bc42b0c15b31dc27977d59c233", size = 11242043, upload-time = "2026-07-09T20:01:21.947Z" },
-    { url = "https://files.pythonhosted.org/packages/b2/c6/583075d8ccabb4b229345edcaf1545eb3d8d6be90f686a479d7e94088bbf/ruff-0.15.21-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:e89bc93c0d3803ba870b55c29671bad9dc6d94bb1eb181b056b52eb05b52854f", size = 11648064, upload-time = "2026-07-09T20:01:24.023Z" },
-    { url = "https://files.pythonhosted.org/packages/3a/3c/37d0ecb729a7cc2d393ea7dce316fc585680f35d93b8d62139d7d0a3700c/ruff-0.15.21-py3-none-win32.whl", hash = "sha256:01f8d5be84823c172b389e123174f781f9daf86d6c58719d603f941932195cdd", size = 10896555, upload-time = "2026-07-09T20:01:26.941Z" },
-    { url = "https://files.pythonhosted.org/packages/c0/b8/e43466b2a6067ce91e669068f6e28d6c719a920f014b070d5c8731725de3/ruff-0.15.21-py3-none-win_amd64.whl", hash = "sha256:d4b8d9a2f0f12b816b50447f6eccb9f4bb01a6b82c86b50fb3b5354b458dc6d3", size = 12038772, upload-time = "2026-07-09T20:01:29.497Z" },
-    { url = "https://files.pythonhosted.org/packages/dd/75/e90ab9aeece218a9fc5a5bc3ec97d0ee6bb3c4ff95869463c1de58e29a1c/ruff-0.15.21-py3-none-win_arm64.whl", hash = "sha256:6e83115d4b9377c1cbc13abf0e051f069fab0ef815ea0504a8a008cee24dd0a8", size = 11375265, upload-time = "2026-07-09T20:01:31.772Z" },
+    { url = "https://files.pythonhosted.org/packages/23/18/ee54b7ae1e121be7a28ea6da4b67564ebb0530e183a54415ab7e3bcd2c4e/ruff-0.15.22-py3-none-linux_armv6l.whl", hash = "sha256:44423e73493737f5e7c5b41d475483898ff37afcdae38bc3da5085e29af1c2d8", size = 10781258, upload-time = "2026-07-16T15:13:19.452Z" },
+    { url = "https://files.pythonhosted.org/packages/2f/d2/2520cb14761ddbeaf57642a76942fc36adcbdbe53b4532241995f6fc485c/ruff-0.15.22-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:b82c6482946e9eda7ff2e091d25b8bad3f718684e1916d41bd56873cee05b697", size = 10999477, upload-time = "2026-07-16T15:13:23.318Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/10/74e53572aa758dfaa678c2a2646b5c5515d884b7ca56be4d2ce03ca4b560/ruff-0.15.22-py3-none-macosx_11_0_arm64.whl", hash = "sha256:11c1c715af53a09f714e011106bffc419751ec8232fcb5da42173284ea3fec6f", size = 10466716, upload-time = "2026-07-16T15:13:26.162Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/cc/44eaaf0844e028182f2d0a8f2190d0f359159aed0a9e5ab861d892f1ae2a/ruff-0.15.22-py3-none-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:742a29cf29bddb7c8327895d6a10e0e6c5b38a96dd407af9b5d0857f809c0576", size = 10892644, upload-time = "2026-07-16T15:13:29.229Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/21/8edf559014d2b0f82beea19cfb713993ad802ccda16868769979c6090a84/ruff-0.15.22-py3-none-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:72af58b951b0ae395935ae79763dc349bc0eb706319d28f7a33ad2cfb3cfc178", size = 10576719, upload-time = "2026-07-16T15:13:32.35Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/1e/3a13abd392a3b50b62e5938a831f9ab6e588358cacad5c18545b716d2182/ruff-0.15.22-py3-none-manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:62d425005c1835eb24e2ee4161cb90e8db263415f4a71c8c72c33abaa6c0c224", size = 11376494, upload-time = "2026-07-16T15:13:35.958Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/3e/422d3d95bcf04dd78e1aeac22184d4f9a8fb2c01865d39d44618484a0317/ruff-0.15.22-py3-none-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:e8b9b3f8779a4f08c969defc3c8c35abffaa757e601ed5ae66d6d1db6519969a", size = 12208370, upload-time = "2026-07-16T15:13:39.185Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/91/5d065a0e0a02bf4813f5119ad278462eed081d2b832eb7c021ade0ec9e65/ruff-0.15.22-py3-none-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:1e0dd1b2e4d3d585f897a0d137cbf4eaf6223bef4e8ce34d6bb12556c5f9249e", size = 11581098, upload-time = "2026-07-16T15:13:42.132Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/f9/a0d4871d12fae702eb1f41b686caf05f1f8b124dc6db6f784f53d74918fa/ruff-0.15.22-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:365523eb91d9224e1bcb03b022fbf0facb8f9e23792a2c53d9d4b3924bdbdebb", size = 11399422, upload-time = "2026-07-16T15:13:45.2Z" },
+    { url = "https://files.pythonhosted.org/packages/18/80/c843a5176cddbceb0b7e8dd41cf9993490796c1c469348d384f5a5c13c56/ruff-0.15.22-py3-none-manylinux_2_31_riscv64.whl", hash = "sha256:fabfd168afdf29fee5be98b831efa9683c94d7c5a3b58b9ce5a2e38444589a74", size = 11381683, upload-time = "2026-07-16T15:13:48.46Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/00/8485de0ae92239438a36cfc51350db9b9e85c9ebdfaea91b18e422706662/ruff-0.15.22-py3-none-musllinux_1_2_aarch64.whl", hash = "sha256:225dbf095a87f1d9f90f5fd7924d2613ee452a75a4308c63a8f50f761787aa7c", size = 10850295, upload-time = "2026-07-16T15:13:51.655Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/91/24977ec2ec72eaf15e4394ace2959fdff2dd1e14f03e005e838023407169/ruff-0.15.22-py3-none-musllinux_1_2_armv7l.whl", hash = "sha256:1877d63b9d24ed278744f1523fd11b85540566d54641f97c566d7d9dc5ca5296", size = 10579640, upload-time = "2026-07-16T15:13:54.79Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/47/9b51216951974df1f263ac19da550d34252e0ed7218c25f10c5ef9ed7517/ruff-0.15.22-py3-none-musllinux_1_2_i686.whl", hash = "sha256:a1606c510bd7215680d32efab38965f7cdec3ef69f5170a3f4791404ffdd5262", size = 11105077, upload-time = "2026-07-16T15:13:57.915Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/47/20e9d4a3b8016778acea5fc32bb50d35d207500a17ddb529ffa6996feef8/ruff-0.15.22-py3-none-musllinux_1_2_x86_64.whl", hash = "sha256:630479b18625f5ffc373f77603a22a9f8ac0acd7ff0501178b5db28ec71e9c64", size = 11490980, upload-time = "2026-07-16T15:14:01.032Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/76/3f72d8fc38c1cb77b38c56a70da9d0c17700cc1cc50f9649c9d3c8f5ba71/ruff-0.15.22-py3-none-win32.whl", hash = "sha256:e5ba0e4a13fd14abbed2a77b517a3911290c6c6c59ef67784328d1668fab76cf", size = 10789165, upload-time = "2026-07-16T15:14:04.16Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/46/4965251734c2b6fcdca1b1b187d20bcac3af0ee5b083b89c910bb961ce3a/ruff-0.15.22-py3-none-win_amd64.whl", hash = "sha256:9be63ba1eb936acd2d1342fb8337c356353706fce233b2a15a09a97037e6acde", size = 11938297, upload-time = "2026-07-16T15:14:07.316Z" },
+    { url = "https://files.pythonhosted.org/packages/57/c9/e69b1ff4c8b69093ef08b8919ab767af0569666865b39c30a8795d88d3c6/ruff-0.15.22-py3-none-win_arm64.whl", hash = "sha256:e1168075b72158510839f250027659cdd78476f40507dd517892304c41318661", size = 11298172, upload-time = "2026-07-16T15:14:10.51Z" },
 ]
 
 [[package]]
diff --git a/config.reference.json b/config.reference.json
index 6379f07c..70ec53c4 100644
--- a/config.reference.json
+++ b/config.reference.json
@@ -49,12 +49,19 @@
         "donate_level": 0
     },
 
+    "local_miner": {
+        "enabled": false
+    },
+
     "xvb": {
         "enabled": true,
         "url": "na.xmrvsbeast.com:4247",
         "donor_id": "auto",
         "donation_level": "auto",
-        "tor": true
+        "tor": true,
+        "standby": {
+            "source": ""
+        }
     },
 
     "xmrig_proxy": {
@@ -75,6 +82,7 @@
         "timezone": "auto",
         "data_dir": "auto",
         "tari_required": true,
+        "fail_closed": false,
         "check_for_updates": true,
         "hashrate_drop_threshold": 50,
         "hashrate_drop_minutes": 10,
diff --git a/docker-compose.yml b/docker-compose.yml
index 81236641..86ad8272 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -627,6 +627,9 @@ services:
       # Route XvB donation mining over Tor by default (#166); xvb.tor:false opts out.
       - XVB_TOR_ENABLED=${XVB_TOR_ENABLED:-true}
       - XVB_DONATION_LEVEL=${XVB_DONATION_LEVEL:-auto}
+      # Backup-stack warm-standby source (#249): the primary dashboard's read-only /api/xvb-standby
+      # URL. Blank (default) = off; only a failover pair's backup sets it.
+      - XVB_STANDBY_SOURCE=${XVB_STANDBY_SOURCE:-}
       # XvB raffle auto-registration endpoint (#263). Defaults to the real endpoint (in the dashboard
       # config) so registration just works. Override here to point at a different/test endpoint, or
       # set a disable sentinel (off/none/false/disabled) to turn auto-registration off while keeping
@@ -671,6 +674,12 @@ services:
       # miner waits for Tari's sync, and whether a Tari-only sync takes over the dashboard
       # (Issue #51). Set dashboard.tari_required:false to make Tari non-blocking.
       - TARI_REQUIRED=${TARI_REQUIRED:-true}
+      # Opt-in fail-closed miner hold on an unrecoverable dashboard health failure (#490,
+      # config.json: dashboard.fail_closed). Default OFF: these failures only alert, mining
+      # continues. ON reuses the #35 sync-gate hold (stop/start p2pool + xmrig-proxy) but only for
+      # a DB auto-heal rebuild that itself failed, or the dashboard container crash-looping —
+      # never a transient blip.
+      - DASHBOARD_FAIL_CLOSED=${DASHBOARD_FAIL_CLOSED:-false}
       # Healthchecks.io dead-man's switch (#79). A ping URL is the on/off switch (blank = off);
       # when set, the dashboard pings it each loop, so if the host dies the pings stop and
       # Healthchecks.io alerts externally — the one failure mode an in-stack notifier can't
diff --git a/docs/architecture.md b/docs/architecture.md
index f90114d4..4d534fc0 100644
--- a/docs/architecture.md
+++ b/docs/architecture.md
@@ -18,7 +18,7 @@ port forwarding is required.
 | 5 | **Tor** | Provides SOCKS5 proxies and hidden services (onion addresses) for the other containers. |
 | 6 | **Dashboard** | The web monitoring UI and the algorithmic switching engine. |
 | 7 | **Docker Proxy** | A **read-only** proxy onto the Docker socket so the dashboard can read container stats/logs — no write access. |
-| 8 | **Docker Control** | A second, minimal socket proxy scoped to **only** `start`/`stop` (nothing else — not create/kill/exec/reads), so the dashboard can reject workers when a node is down (Issue #31), hold p2pool + xmrig-proxy until the chains finish syncing (Issue #35), and switch a clearnet-syncing node back to Tor once it's synced (Issue #234). Kept separate so its write grant can't widen the read-only proxy. |
+| 8 | **Docker Control** | A second, minimal socket proxy scoped to **only** `start`/`stop` (nothing else — not create/kill/exec/reads), so the dashboard can reject workers when a node is down (Issue #31), hold p2pool + xmrig-proxy until the chains finish syncing (Issue #35), switch a clearnet-syncing node back to Tor once it's synced (Issue #234), and, opt-in via `dashboard.fail_closed`, hold p2pool + xmrig-proxy again on an unrecoverable dashboard health failure (Issue #490). Kept separate so its write grant can't widen the read-only proxy. |
 | 9 | **Caddy** | A reverse proxy that serves the dashboard over HTTPS (automatic local TLS) on the LAN. |
 
 ## High-level diagram
diff --git a/docs/configuration.md b/docs/configuration.md
index b5580950..7807966a 100644
--- a/docs/configuration.md
+++ b/docs/configuration.md
@@ -128,6 +128,7 @@ control channel will commit, are unaffected either way.
 | `xvb.donor_id` | `auto` | XvB donor id. `auto` = the first 8 characters of your Monero address. |
 | `xvb.donation_level` | `auto` | Donation tier to target: `auto` (the highest tier your hashrate can sustain) or a specific tier: `donor` (1 kH/s) / `vip` (10 kH/s) / `whale` (100 kH/s) / `mega` (1 MH/s), where the figure is the donation hashrate you must hold on both your 1h and 24h averages. A specific tier is honored even if your hashrate can't hold it; the dashboard shows a warning badge in that case. (The `vip` tier is a donation level, not the dashboard's separate Raffle Eligible status; see [Architecture › Algorithmic switching](architecture.md#algorithmic-switching).) |
 | `xvb.tor` | `true` | Privacy-relevant, default on (Tor). While donating, the proxy connects to `na.xmrvsbeast.com`, which would otherwise expose your home IP to XvB. Default (`true`) routes that connection through the bundled Tor proxy (a per-pool `socks5` on the XvB pool; DNS resolved proxy-side). Set `false` to dial direct over clearnet for maximum yield: stratum-over-Tor adds latency that can raise rejected shares (scales with hashrate). Only the XvB pool is affected; your local p2pool stratum is unaffected. Full threat model: [Privacy › XvB donation mining](privacy.md#xvb-donation-mining-166---tor-by-default). |
+| `xvb.standby.source` | `""` (off) | Backup-stack warm standby for a two-host failover pair (same wallet, workers listing both hosts in `pools[]`). Set this on the **backup** to the **primary** dashboard's read-only `/api/xvb-standby` URL (its onion, e.g. `https://<primary-onion>/api/xvb-standby`, or a LAN address like `http://192.168.1.10:8000/api/xvb-standby`). The backup periodically pulls the primary's XvB controller state and holds it as standby, so when your fleet fails over the donation split resumes warm instead of cold-ramping for hours. One-way and inert by default; the backup never donates while it has no workers. The URL may carry the primary's dashboard basic-auth (`https://user:pass@…`), so it is treated as a secret (owner-only `.env`, masked in the config editor). An `.onion` source is fetched over Tor and a LAN source dials direct — neither adds a new clearnet egress. |
 | `tor.data_dir` | `auto` | Where Tor's state (including onion keys) lives. `auto` = `./data/tor`. |
 | `tor.auto_heal` | `false` _(off)_ | Privacy-relevant, default off. Tor can bootstrap fully and then sit on a **failing guard**: circuits time out, so everything that exits Tor to the clearnet (Healthchecks pings, the Telegram bot, XvB stats) breaks at once while mining keeps working (#424). `true` lets the dashboard probe Tor clearnet egress every 5 minutes and restart the tor container once egress has been broken for 15 minutes, so Tor reselects guards — bounded to 3 restarts per outage, 30 minutes apart, each logged; if egress stays broken (Tor network overload) it stops restarting and keeps warning. Off by default because each restart drops **every** Tor circuit, mining onions included (they rebuild in minutes). The manual equivalent is `./pithead restart tor`. See [Operations › Troubleshooting](operations.md#troubleshooting). |
 | `dashboard.secure` | `true` | `true` serves the dashboard over HTTPS (Caddy `tls internal`); `false` uses plain HTTP. |
@@ -143,6 +144,7 @@ control channel will commit, are unaffected either way.
 | `dashboard.hashrate_drop_threshold` | `50` | Percent below the recent normal that counts as a hashrate drop for the `hashrate_loss` alert and its chart marker. `50` = fire when total fleet hashrate falls to half its baseline. Raise it to catch smaller dips, lower it to only flag near-total outages. |
 | `dashboard.hashrate_drop_minutes` | `10` | How many minutes the hashrate must stay below the threshold before the drop is reported — the debounce that keeps a brief blip from pinging you. |
 | `dashboard.tari_required` | `true` | How much a Tari problem holds up the rest of the stack. Monero is required to mine, so its behavior isn't configurable: a monerod outage always rejects workers (stops `xmrig-proxy` so miners fail over to their backup pools), and the miner is always held until monerod finishes syncing. Tari is only needed for merge-mining, so this one flag decides how much it blocks. `true` (default): a Tari outage also rejects workers, the miner waits for Tari's initial sync too, and a Tari-only (re)sync shows the full-screen Sync view. `false` (non-blocking): keep mining Monero through a Tari outage, start mining as soon as Monero is synced (Tari finishes in the background), and keep the normal dashboard, with a `Tari syncing` indicator, instead of the takeover screen. |
+| `dashboard.fail_closed` | `false` _(off)_ | Whether an **unrecoverable** dashboard health failure holds the miner, not just alerts (#490). The dashboard is an observability layer, not the mining datapath (`xmrig-proxy` → `p2pool` → `monerod` runs independently of it), so the default (`false`) is alert-only: a loud Telegram/Healthchecks alert plus a dashboard badge, and mining keeps running. `true` reuses the same hold the sync gate uses (stops `p2pool` and `xmrig-proxy`) the moment one of two narrow conditions hits, and starts them again once it clears — no restart needed: the dashboard's SQLite database failed to self-heal after its own auto-recovery attempt (disk full, permissions — see `db_reset` in [Dashboard › Node status & failover](dashboard.md#node-status--failover)), or the `dashboard` container itself is crash-looping. A transient write blip, a slow query, or a single failed external fetch never trips it — only these two genuinely non-transient failures do. Set it `true` only if a stale dashboard is a bigger risk to you than a held miner; a false positive here idles the fleet. |
 | `network.subnet` | `172.28.0.0/24` | The private Docker bridge the stack's containers run on. Change it only if install fails with `Pool overlaps with other one on this address space`, i.e. your host already uses `172.28.0.0/24` for another Docker network or interface. Must be a free `X.Y.Z.0/24` block (e.g. `"172.30.0.0/24"`); the services keep their fixed host octets (`.25`–`.31`) within it, so the structured addressing the dashboard and the worker SSRF guard rely on is preserved. |
 | `network.tor_egress_firewall` | `true` _(on)_ | Privacy-relevant, default on. Enforces "behind Tor" fail-closed: at `up`/`apply`, `pithead` installs host firewall rules (Docker's `DOCKER-USER` chain) that drop any direct clearnet dial from the mining containers (monerod/p2pool/tari/xmrig-proxy). Only the Tor container reaches the internet, so a misconfigured or buggy daemon can't leak your IP. Needs root (like the GRUB/HugePages steps); removed at `down`. Set `false` to skip it and rely on per-app Tor config only (e.g. a host where you manage egress yourself, or where `iptables` isn't available). Full detail: [Privacy › Enforced fail-closed](privacy.md#enforced-fail-closed-not-just-configured-270). |
 | `workers.api_auth` | `none` | How the dashboard reads each worker's xmrig API. Beyond what the proxy reports, the dashboard probes every connected miner's own xmrig HTTP API (`/1/summary`) for uptime and per-miner hashrate, one configured way, no auto-detection. `none` (default) expects an open, read-only API (xmrig `http.restricted` with no `access-token`), which is what a stock RigForge worker exposes. `name` sends the worker's stratum name as the Bearer token (for miners whose `access-token` equals their name). `token` sends a single shared `workers.api_token` for every worker. A worker whose probe fails isn't dropped: it keeps its proxy-reported hashrate and is flagged `api ⚠` on the dashboard, with one log line explaining why (so a misconfigured API is distinct from an offline miner). Upgrading from a build whose miners set an `access-token`? Set this to `name` (or reprovision the miners to drop the token), otherwise the default no-auth probe `401`s and every worker shows `api ⚠`. |
diff --git a/docs/dashboard.md b/docs/dashboard.md
index 1f550b0c..4ab4ef0d 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -154,6 +154,21 @@ a fresh database, and keeps running. A `db_reset` alert (Telegram and the other
 history before that point was cleared. Payout and XvB state rebuild from the chain and the live feed;
 only the historical charts reset.
 
+**Fail-closed miner hold.** By default, every health failure above — DB write failing, DB
+corruption, a crash-looping container — only alerts; the dashboard is an observability layer, and
+the mining datapath (`xmrig-proxy` → `p2pool` → `monerod`) runs independently of it. Set
+[`dashboard.fail_closed`](configuration.md#configuration-reference) to `true` to hold the miner
+instead, but only for genuinely **unrecoverable** failures: the DB self-heal above failing on its
+own rebuild attempt (not an ordinary write blip, which stays alert-only), or the `dashboard`
+container itself crash-looping. A red `Miner held (fail-closed)` badge shows while held, next to
+`p2pool` and `xmrig-proxy`, stopped the same way the [Sync Mode hold](#sync-mode) does; unlike that
+one-way sync gate, both containers start again on their own once the condition clears — no restart
+needed.
+The database also keeps three smaller series: pool block-found events, hourly monerod-DB-size and
+host-disk-usage samples, and XvB-credited scalar samples taken roughly every 5 minutes. `/api/state`
+serves them as `blocks`, `disk_growth`, and `xvb_history`, range-filtered the same way as
+`share_stats`. No chart reads them yet — this is persistence and API exposure only.
+
 While a node is down, the dashboard rejects workers so they fail over to the backup pools you've
 configured, rather than sitting idle on a stack that can't mine. A sustained outage stops the
 `xmrig-proxy` container (a `Workers rejected` badge shows) and a confirmed recovery restarts it.
@@ -612,10 +627,14 @@ Two edit modes build the same candidate config and submit it through the same pi
   A field the control gate wouldn't actually commit renders **greyed out**
   ([#613](https://github.com/p2pool-starter-stack/pithead/issues/613)): disabled, its value shown
   read-only, with a tooltip ("Host-only — edit `config.json` and run `./pithead apply`") instead of
-  letting you edit it and finding out only at Save. The editable set is derived from the same
-  allowlist the gate enforces (see below) and surfaced on `GET /api/config` as `_editable_keys`, so
-  it can't drift from what the gate actually accepts; a greyed field never enters the staged edit
-  set at all.
+  letting you edit it and finding out only at Save. A smaller set of operationally-disruptive
+  fields — the four service data directories, the stratum port, the clearnet initial-sync toggles,
+  and enabling Monero pruning — render **editable but confirm-gated**
+  ([#719](https://github.com/p2pool-starter-stack/pithead/issues/719)): editable, tooltipped
+  "you'll type `APPLY` to confirm at Save". Both sets are derived from the same allowlists the gate
+  enforces (see below) and surfaced on `GET /api/config` as `_editable_keys` and `_confirm_keys`,
+  so neither can drift from what the gate actually accepts; a greyed field never enters the staged
+  edit set at all.
 - **JSON** edits the whole fetched config as one text block, for operators who'd rather paste than
   click through fields. A **Load from file** control (`FileReader`, no upload) fills it from a
   saved `config.json`, the same pattern [Worker Inspect's JSON mode](#worker-inspect) uses. A
@@ -637,21 +656,41 @@ The flow mirrors the CLI's `apply` either way:
    error message; nothing is applied.
 3. Confirm. If the preview flags any change disruptive (⚠), you must type `APPLY` first. The
    commit runs `pithead apply -y` on the host and recreates only the containers whose config
-   changed.
+   changed. Your typed confirmation rides to the host gate, which requires it before a
+   confirm-gated change proceeds — a change confirmed this way is recorded in the audit log as a
+   `commit-confirmed` action, distinct from an ordinary commit.
 
 Most settings cannot be committed from the dashboard — the host-side runner holds an explicit
 allowlist of operational settings (pool tier, XvB enable and donation level, alert toggles,
 memory limits, time zone, the energy-calculator prices, …) and default-denies a change, in any
-direction, to anything else. Form mode's grey-out (above) is that SAME allowlist surfaced to the
-browser up front, not a separate approximation of it — so what renders editable is exactly what
-the gate will commit. The allowlist gates BOTH edit modes identically regardless — JSON mode is a
-different way to assemble the candidate config, not a different validation path, so it can't
-smuggle a change the form couldn't make:
-wallets, the dashboard login and onion settings, the control channel itself, the Tor egress
-firewall, clearnet toggles, node endpoints, and every credential. It likewise refuses anything
-the preview flags disruptive (⚠). Apply those from the host with `./pithead apply`; out-of-band
-approval from the dashboard is tracked in
-[#338](https://github.com/p2pool-starter-stack/pithead/issues/338).
+direction, to anything else. A second, confirm-gated allowlist
+([#719](https://github.com/p2pool-starter-stack/pithead/issues/719)) adds the
+operationally-disruptive-but-recoverable settings — a data-directory move (re-sync), a stratum-port
+change (rigs repoint), a clearnet initial-sync enable (host IP exposed during IBD, auto-reverts),
+enabling Monero pruning — which commit only behind the typed `APPLY`. Type-to-confirm here is
+friction, not a security control: a compromised dashboard that can set a field can also fill the
+confirm box, so the boundary stays where a breach would happen. Form mode's grey-out and
+confirm-gating (above) are those SAME allowlists surfaced to the browser up front, not a separate
+approximation of them — so what renders editable is exactly what the gate will commit. The
+allowlists gate BOTH edit modes identically regardless — JSON mode is a different way to assemble
+the candidate config, not a different validation path, so it can't smuggle a change the form
+couldn't make. The **security perimeter stays host-only** in every direction: wallets and view
+keys, the dashboard login and onion settings, the control channel itself, the Tor egress firewall,
+the stratum password, node endpoints and credentials, and the per-rig hosts and tokens. The gate
+also refuses the heavier direction of a confirm-gated key (disabling pruning forces a full re-sync,
+so it stays host-only). Apply those from the host with `./pithead apply`.
+
+A dashboard-confirmed data-directory move
+([#728](https://github.com/p2pool-starter-stack/pithead/issues/728)) is held to a tighter rule than
+the same move from the host CLI. The host guard is a blocklist — it refuses the catastrophic roots
+(`/`, `$HOME`, bare mounts) but lets a shell operator relocate data anywhere else, which is
+proportionate to shell trust. A confirmed move from the dashboard is instead held to an
+**allowlist**: the new location must sit under the stack's own data root (the install dir's
+`data/`) or a parent the stack already keeps its data in (a co-located data root, #455). A move to
+any other absolute path — another user's home, another service's volume — is refused even with the
+typed `APPLY` and stays host-CLI only. This is the one place a confirmed data-dir move differs from
+`./pithead apply`: the destination path is narrowed, because the move is now reachable at dashboard
+trust rather than shell trust.
 
 A pool switch (`p2pool.pool` main/mini/nano) carries its standing warning: p2pool re-syncs the new
 sidechain and your PPLNS window (and XvB shares) reset.
@@ -661,7 +700,9 @@ drops a typed JSON change request into `./data/control/requests/` — its only w
 spool — and a root systemd path unit (`pithead-control`) runs `pithead control-run-pending`, which
 validates the request, dry-runs or applies the staged copy, and writes the outcome to the
 read-only `results/` mount plus an audit line (timestamp, logged-in user, action, outcome, and
-the names of the changed settings) to `audit/control.log`. The container cannot forge results,
+the names of the changed settings) to `audit/control.log`. A dashboard-confirmed disruptive change
+records its action as `commit-confirmed`, so a confirm-gated apply reads distinctly from an
+ordinary commit in the log. The container cannot forge results,
 alter a staged config between preview and commit, or rewrite the audit log. A failed apply keeps
 the previous config at `config.json.bak-control` and surfaces pithead's error in the view.
 Operational details:
@@ -690,6 +731,36 @@ stripped to a safe character set before it is served. See
 [Operations › Watching for intruders](operations.md#watching-for-intruders) for the log paths,
 size bounds, and rotation steps.
 
+### Catching changes made outside the dashboard
+
+The audit trail above only sees requests that went through the control channel. Two things can
+change the stack without it: a hand-edit (or a `pithead apply` run from the host CLI) to
+`config.json`, and a config change applied directly to a rig's own control API instead of through
+Worker Inspect ([#530](https://github.com/p2pool-starter-stack/pithead/issues/530)). The dashboard
+watches for both on its normal poll cycle and appends them to the SAME audit trail:
+
+- **`host-edit`** — `config.json` changed since the last poll and no control-channel commit
+  explains it. The row names the changed setting paths (e.g. `xvb.donation_level`); it never
+  records a value.
+- **`rig-edit`** — a worker's control API reports a config change this dashboard never sent. The
+  row names the worker and the rig's own change id; RigForge's status feed reports only the
+  outcome of a change, not a per-key diff, so unlike `host-edit` this can't name which setting
+  moved — inspect the rig directly to see what changed. This one source reads off the
+  unauthenticated worker feed, so it is rate-capped per worker
+  ([#724](https://github.com/p2pool-starter-stack/pithead/issues/724)): a rig reporting a fresh
+  change id every poll can add only a bounded number of `rig-edit` rows per hour before the rest
+  are dropped behind a single `rate-limited` row. A real occasional rig change still records; only
+  a flood is capped.
+
+Either kind is worth treating like a rotate-now signal in the same spirit as
+[Operations › Watching for intruders](operations.md#watching-for-intruders): if you didn't make
+the change, someone or something with host or rig access did.
+
+The audit trail is no longer only a log tail: entries — both mirrored from `control.log` and the
+two out-of-band kinds above — persist to the dashboard's own database, so the card's grouping
+selector (hour/day/month) can drill back further than the log's own trimmed window. Pick "All" for
+the flat newest-first view, or a coarser grouping to scan a longer history at a glance.
+
 ## Upgrading from the dashboard
 
 With `dashboard.control.enabled: true` (the same flag as the Configuration view) and a newer
diff --git a/docs/dev/testing-strategy.md b/docs/dev/testing-strategy.md
index b4c738c9..bce8c1cf 100644
--- a/docs/dev/testing-strategy.md
+++ b/docs/dev/testing-strategy.md
@@ -71,6 +71,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | Double outage; readmit only when **both** healthy | both down → both up | 1 ✅ (added) · 3 ▶ |
 | #35 latch × #31 failover coexist after release | down post-release | 1 ✅ (added) · 3 ▶ |
 | Stop/start fails → retry next cycle (idempotent) | docker error | 1 ✅ |
+| `dashboard.fail_closed` (#490): default off never holds on an unrecoverable failure (alert-only); `true` holds (reusing #35's stop/start), releases once it clears (not a one-way latch), no-op before the sync gate releases | `is_db_unrecoverable() ∨ containers.is_confirmed_bad("dashboard")` | 1 ✅ · 3 ▶ |
 
 ### D. Container health verdicts (`pithead status`)
 
@@ -116,6 +117,7 @@ The deploy-time axes — each changes a real runtime path. Full table and assert
 | `doctor` runtime verdicts (#383): egress firewall, stratum listening, dashboard answers | real box | 1 ✅ (stubbed toolchain) · 4 ▶ (`--check`) |
 | Control channel (#33): `apply --dry-run` preview, runner claim/validate/commit, fail-closed flag, rw/ro spool mounts | spool files / sourced fns | 1 ✅ (shell + pytest + compose) · 4 (systemd path unit on a real box — not yet a matrix row) |
 | Audit + access logs (#349): key-names-not-values audit entries, bounded log growth, Caddyfile log block, hostile log content served inert | spool/log fixtures | 1 ✅ (shell + pytest + node) · 4 (real Caddy writes over Tor — covered by the same onion matrix row) |
+| Out-of-band audit detection + persistence (#530): a `config.json` change with no matching commit (`host-edit`) or a rig reporting a change_id the dashboard never spooled (`rig-edit`) both append to the durable `audit_events` table (mirrored `control.log` rows + these two kinds); Security panel hour/day/month grouping | poll-loop diff / real StateManager | 1 ✅ (`test_data_service.py::TestWatchHostConfig`/`TestRigEditDetection`/`TestMirrorControlAudit`, `test_storage_service.py::TestAuditEvents`, `securityview.test.mjs` grouping) · 4 (deferred — the underlying rig-side-edit-visible-in-the-enriched-feed mechanism is already proven live by the #516 row below; a real box producing a `host-edit`/`rig-edit` audit row end-to-end is not yet its own matrix leg) |
 
 ### H. Host / infrastructure (real-only)
 
diff --git a/docs/operations.md b/docs/operations.md
index 2672e6df..72948faf 100644
--- a/docs/operations.md
+++ b/docs/operations.md
@@ -194,6 +194,24 @@ change staged through the dashboard and who committed it. A change you didn't ma
 rotate-now signal. Secret rotation beyond the dashboard password is tracked in
 [#378](https://github.com/p2pool-starter-stack/pithead/issues/378).
 
+`control.log` only sees requests that went through the dashboard. The dashboard's own poll loop
+additionally watches for two changes it did NOT make and appends them to the same audit trail
+([#530](https://github.com/p2pool-starter-stack/pithead/issues/530),
+[details](dashboard.md#catching-changes-made-outside-the-dashboard)): a `config.json` edit with no
+matching commit (`host-edit`), and a worker's control API reporting a change the dashboard never
+sent (`rig-edit`). Both name only what changed — settings or a worker, never a secret value — and
+both are the same rotate-now signal as an unexplained `control.log` entry.
+
+Unlike `control.log`, which the writer trims to bound its size, the audit trail served by the
+dashboard persists to its own database — mirrored `control.log` rows plus the two out-of-band
+kinds above — so the Security panel's hour/day/month grouping can look back further than the log's
+own trimmed window. Because `rig-edit` reads off the unauthenticated worker feed, it is rate-capped
+per worker ([#724](https://github.com/p2pool-starter-stack/pithead/issues/724)): a rig reporting a
+fresh change_id every poll can add only a bounded number of `rig-edit` rows per hour before the
+rest are dropped behind a single `rate-limited` marker, so no one LAN device can grow the database
+without limit. A genuine occasional rig change still records normally; only a flood is capped, and
+the cap is visible — the marker names it, and the dashboard logs a warning.
+
 ---
 
 ## Updating the stack
diff --git a/docs/workers.md b/docs/workers.md
index a179a8da..a0747a67 100644
--- a/docs/workers.md
+++ b/docs/workers.md
@@ -385,6 +385,41 @@ See the [RigForge README](https://github.com/p2pool-starter-stack/rigforge) for
 including [worker hardware requirements](https://github.com/p2pool-starter-stack/rigforge#-hardware-requirements),
 kernel tuning, and verification.
 
+## Mine on the stack host itself
+
+A box that runs the stack 24/7 has spare CPU between syncs. You can put that CPU to work by
+co-locating a RigForge worker on the stack host, pointed at the stack's own stratum over loopback —
+no LAN exposure, no firewall rule, no Tor hop.
+
+Opt in during `./pithead setup` (the prompt "Also mine on this machine with its spare CPU?", off by
+default), or set it in `config.json`:
+
+```json
+{
+  "local_miner": {
+    "enabled": true
+  }
+}
+```
+
+Run `./pithead apply`. Setup and apply then print the two values a RigForge install needs — the pool
+URL (`127.0.0.1:3333` by default, or your `p2pool.stratum_bind` address and `p2pool.stratum_port`)
+and the stratum password (the `PROXY_STRATUM_PASSWORD` already in `.env`, shown only when
+`p2pool.stratum_password` is set). Install [RigForge](https://github.com/p2pool-starter-stack/rigforge)
+on the same host and enter those two values when it asks; the worker self-registers and appears in
+the dashboard's Workers Alive table like any other rig.
+
+Pithead does not install, run, or tune the miner. RigForge owns all host-level tuning — HugePages,
+GRUB, MSR, the CPU governor, and the miner service. Two things to know before enabling it:
+
+- **RigForge's tuning is host-global.** It sets a `performance` CPU governor and may reserve
+  HugePages box-wide, which affects every workload on the machine, not just the miner. That is fine
+  on a dedicated appliance; weigh it on a shared home server (see [deployment
+  models](getting-started.md)).
+- **The stack always wins.** Cap the miner's thread count in RigForge so mining never starves the
+  node's sync or share submission. The mining path is plain stratum over loopback, so it carries no
+  privacy impact.
+
 ---
 
 ## See also
diff --git a/pithead b/pithead
index 096d1187..de2a33f8 100755
--- a/pithead
+++ b/pithead
@@ -1034,6 +1034,37 @@ announce_dashboard_url() {
     fi
     announce_stratum_auth
     announce_stratum_tls # #261: prints the fingerprint rigs pin; no-op when TLS is off
+    announce_local_miner # #593: hand off the pool URL + secret for a co-located RigForge worker
+}
+
+# Local miner opt-in (#593). When the operator asked to also mine on this host with its spare CPU,
+# hand them the two values a RigForge install on this box would otherwise prompt for — the stack's
+# own stratum URL and the stratum secret — so a co-located worker self-registers with nothing to
+# copy by hand (the dashboard already discovers workers from the proxy). Pithead does NOT install
+# or tune the miner: RigForge owns HugePages/GRUB/MSR and the miner service. Prints nothing unless
+# local_miner.enabled is on.
+announce_local_miner() {
+    [ "$(config_bool '.local_miner.enabled' false 2>/dev/null || echo false)" = "true" ] || return 0
+    local bind port host secret
+    bind=$(env_get STRATUM_BIND 2>/dev/null || true)
+    [ -n "$bind" ] || bind="0.0.0.0"
+    port=$(stratum_port_effective)
+    # A port published on all interfaces (0.0.0.0) or on loopback is reachable at 127.0.0.1; a
+    # specific LAN bind (#593 edge case) is only reachable at that address, so target it directly
+    # rather than hardcoding loopback.
+    case "$bind" in
+    0.0.0.0 | 127.0.0.1) host="127.0.0.1" ;;
+    *) host="$bind" ;;
+    esac
+    secret=$(env_get PROXY_STRATUM_PASSWORD 2>/dev/null || true)
+    log "Local miner opt-in is ON (#593): point a RigForge install on THIS host at the stack's stratum:"
+    log "  • Pool URL:         $host:$port"
+    if [ -n "$secret" ]; then
+        log "  • Stratum password: $secret"
+    else
+        log "  • Stratum password: none set (any password is accepted)"
+    fi
+    log "  RigForge compiles/tunes XMRig and owns all host tuning (HugePages/GRUB/MSR) — Pithead does not. See docs/workers.md#mine-on-the-stack-host-itself."
 }
 
 # Surface the stratum access-password (#152) so the operator can configure each rig's 'pass'.
@@ -2288,6 +2319,15 @@ wizard_ask_shape() {
         read -r -p "Telegram bot token: " TELEGRAM_BOT_TOKEN || true
         read -r -p "Telegram chat id: " TELEGRAM_CHAT_ID || true
     fi
+
+    # Local miner opt-in (#593). A box that runs the stack 24/7 can mine with its spare CPU by
+    # co-locating a RigForge worker pointed at the stack's own loopback stratum. Off by default —
+    # this only records the intent; setup prints the two values a RigForge install needs (the pool
+    # URL and stratum secret) at the end. Pithead never installs or tunes the miner: RigForge owns
+    # all host tuning (HugePages/GRUB/MSR) and the miner service.
+    read -r -p "Also mine on this machine with its spare CPU (co-locate a RigForge worker)? (y/N): " IN_LOCAL_MINER || true
+    LOCAL_MINER=false
+    [[ "$IN_LOCAL_MINER" =~ ^[Yy] ]] && LOCAL_MINER=true
 }
 
 # Assembles config.json from the globals wizard_ask_core/wizard_ask_shape set, and writes it.
@@ -2328,6 +2368,10 @@ wizard_write_config() {
         cfg=$(jq --arg t "$TELEGRAM_BOT_TOKEN" --arg c "$TELEGRAM_CHAT_ID" '.telegram = {enabled: true, bot_token: $t, chat_id: $c}' <<<"$cfg")
     fi
 
+    if [ "${LOCAL_MINER:-false}" = true ]; then
+        cfg=$(jq '.local_miner = {enabled: true}' <<<"$cfg")
+    fi
+
     # Subshell umask (#368): the file must be owner-only from its FIRST byte — a chmod after the
     # write leaves a world-readable window under the default umask.
     (
@@ -2959,7 +3003,8 @@ readonly CONTROL_SECRET_PATHS='[
     ["monero","view_key"],
     ["tari","view_key"],
     ["p2pool","stratum_password"],
-    ["healthchecks","ping_url"]]'
+    ["healthchecks","ping_url"],
+    ["xvb","standby","source"]]'
 
 # #690: bound every host-runner curl so a hostile/MITM'd rig or release response can't stream an
 # unbounded body into memory ($( )) or onto disk (-o) inside the --max-time window. --max-filesize
@@ -3604,12 +3649,29 @@ render_env() {
     local tari_required
     tari_required=$(jq -r 'if .dashboard.tari_required != null then .dashboard.tari_required | tostring else "true" end' "$CONFIG_FILE")
 
+    # Opt-in fail-closed miner hold on an unrecoverable dashboard health failure (#490), default
+    # false. The dashboard is an observability layer, not the mining datapath, so the default is
+    # alert-only (loud Telegram/Healthchecks alert + badge; mining continues). true reuses the #35
+    # sync-gate's own hold to stop p2pool+xmrig-proxy until a DB-recovery failure or a
+    # crash-looping dashboard container clears — see build/dashboard .../service/data_service.py
+    # DataService._apply_fail_closed_gate for the exact "unrecoverable" set.
+    local fail_closed
+    fail_closed=$(normalize_bool "$(config_bool '.dashboard.fail_closed' false)")
+
     # Healthchecks.io dead-man's switch (#79). Optional external liveness monitor: a ping URL is the
     # on/off switch (blank = off), and the ping always rides Tor. The URL is a capability secret, so
     # it lives in the owner-only .env (chmod 600 below), never a world-readable file. docs/monitoring.md.
     local hc_ping_url
     hc_ping_url=$(jq -r '.healthchecks.ping_url // empty' "$CONFIG_FILE")
 
+    # XvB warm-standby source (#249). On a backup stack this is the PRIMARY dashboard's read-only
+    # /api/xvb-standby URL; the backup pulls it so a failover resumes the donation split warm.
+    # Blank (default) = off. A capability URL (it can carry the primary's dashboard basic-auth as
+    # userinfo), so like the ping URL above it lives in the owner-only .env, never a world-readable
+    # file. docs/configuration.md.
+    local xvb_standby_source
+    xvb_standby_source=$(jq -r '.xvb.standby.source // empty' "$CONFIG_FILE")
+
     # check_for_updates (#224, default TRUE): the dashboard checks GitHub for a newer release and shows
     # a header badge linking to it (notify-only — no upgrade). On by default because the check is
     # Tor-routed (socks5h), so it leaks neither the host IP nor a DNS lookup to GitHub; set false to opt
@@ -3820,9 +3882,11 @@ XVB_ENABLED=$xvb_enabled
 XVB_TOR_ENABLED=$xvb_tor
 XVB_DONATION_LEVEL=$xvb_donation_level
 TARI_REQUIRED=$tari_required
+DASHBOARD_FAIL_CLOSED=$fail_closed
 DASHBOARD_CHECK_UPDATES=$check_for_updates
 TARI_MEM_LIMIT=$tari_mem_limit
 HEALTHCHECKS_PING_URL=$hc_ping_url
+XVB_STANDBY_SOURCE=$xvb_standby_source
 TELEGRAM_ENABLED=$tg_enabled
 TELEGRAM_BOT_TOKEN=$tg_token
 TELEGRAM_CHAT_ID=$tg_chat
@@ -4333,8 +4397,19 @@ describe_change() {
     local key="$1" old="$2" new="$3" flag="INFO" msg
     case "$key" in
     MONERO_PRUNE)
-        flag=DEST
-        msg="Monero pruning ($old → $new) — enabling prunes existing blocks; disabling needs a full re-sync (pruned data can't be restored). Wipe the Monero data dir to fully re-sync."
+        # #719: ENABLE (off → on) is confirm-gated — it reclaims disk by pruning blocks, an
+        # operator-intent op with an expensive-but-recoverable cost. DISABLE (on → off) stays a
+        # host-only DEST: pruned data can't be restored, so it needs a full re-sync from a shell.
+        case "$new" in
+        true | 1)
+            flag=CONFIRM
+            msg="Monero pruning ENABLED ($old → $new) — prunes existing blocks to reclaim disk; monerod is recreated. Restoring the full chain later needs a wipe + re-sync."
+            ;;
+        *)
+            flag=DEST
+            msg="Monero pruning DISABLED ($old → $new) — pruned data can't be restored, so the full chain must RE-SYNC from scratch. Apply this from the host."
+            ;;
+        esac
         ;;
     COMPOSE_PROFILES)
         # #552: COMPOSE_PROFILES also carries payout_confirm/tari_payout_confirm (#381/#462), so an
@@ -4382,7 +4457,9 @@ describe_change() {
             # First render of the key (upgrade from a pre-#172 .env) — the port isn't changing.
             msg="Stratum port recorded (:$new) — no rig change needed."
         else
-            flag=DEST
+            # #719: confirm-gated — repointing every rig is disruptive but operator-intent, not a
+            # breach; the typed confirmation makes the operator acknowledge the fleet-wide repoint.
+            flag=CONFIRM
             msg="Stratum port: $old → $new (#172) — EVERY RIG must repoint at the new port (RigForge: pool.port) or it can't connect; the xmrig-proxy container is recreated."
         fi
         ;;
@@ -4412,10 +4489,18 @@ describe_change() {
         msg="xmrig-proxy dev-fee donation level: ${old:-0}% → ${new}% (#173) — the xmrig-proxy container is recreated (brief restart)."
         ;;
     DASHBOARD_DATA_DIR)
-        flag=DEST
+        # #719: confirm-gated — a data-dir move is operator-intent (an expensive re-home / re-sync),
+        # not a security boundary. Only the four service data dirs below are in scope.
+        flag=CONFIRM
         msg="$key: $old → $new — data at the old DEFAULT location (./data/dashboard) is moved there automatically (#455); any other old path is left in place."
         ;;
+    MONERO_DATA_DIR | TARI_DATA_DIR | P2POOL_DATA_DIR)
+        # #719: confirm-gated data-dir moves — the service re-syncs from the new (empty) dir.
+        flag=CONFIRM
+        msg="$key: $old → $new — the service will use the new (empty) directory and RE-SYNC from scratch; old data is left in place."
+        ;;
     *_DATA_DIR)
+        # Every OTHER data dir (e.g. TOR_DATA_DIR) stays host-only — not in the #719 in-scope set.
         flag=DEST
         msg="$key: $old → $new — the service will use the new (empty) directory and re-sync; old data is left in place."
         ;;
@@ -4438,6 +4523,13 @@ describe_change() {
             msg="Tari → non-blocking — keep mining Monero through a Tari outage, start as soon as Monero is synced, and keep the operational dashboard while Tari syncs."
         fi
         ;;
+    DASHBOARD_FAIL_CLOSED)
+        if [ "$new" == "true" ]; then
+            msg="Fail-closed ENABLED (#490) — an unrecoverable dashboard health failure (DB recovery itself failing, or the dashboard container crash-looping) now HOLDS p2pool and xmrig-proxy until it clears, instead of only alerting."
+        else
+            msg="Fail-closed DISABLED (#490) — an unrecoverable dashboard health failure now only alerts (Telegram/Healthchecks + badge); mining is never held for it."
+        fi
+        ;;
     DASHBOARD_CHECK_UPDATES)
         if [ "$new" == "true" ]; then
             msg="Dashboard update check ENABLED (#224) — the dashboard will check GitHub (over Tor) for a newer release and show a link badge; the dashboard container is recreated."
@@ -4595,16 +4687,19 @@ describe_change() {
         fi
         ;;
     MONERO_CLEARNET_SYNC)
-        flag=DEST
+        # #183/#719: ENABLING exposes the host IP during IBD (auto-reverts to Tor) — confirm-gated
+        # (CONFIRM), not host-only. DISABLING returns to Tor, a plain INFO change.
         if [ "$new" == "true" ]; then
+            flag=CONFIRM
             msg="⚠ Monero CLEARNET initial sync ENABLED (#183) — monerod P2P will run over CLEARNET (this host's IP becomes visible to the Monero P2P network) so the chain syncs fast. Transaction broadcast STAYS on Tor; wallets are never exposed. The dashboard switches monerod back to Tor automatically once the chain is synced (#234). monerod is recreated."
         else
             msg="Monero clearnet sync DISABLED (#183) — monerod P2P returns to Tor-only. monerod is recreated."
         fi
         ;;
     TARI_CLEARNET_SYNC)
-        flag=DEST
+        # #183/#719: ENABLING exposes the host IP during IBD (auto-reverts to Tor) — confirm-gated.
         if [ "$new" == "true" ]; then
+            flag=CONFIRM
             msg="⚠ Tari CLEARNET initial sync ENABLED (#183) — the Tari base node will sync over CLEARNET (TCP transport + seeds.tari.com DNS seed; this host's IP becomes visible to the Tari P2P network) so its large chain syncs fast. The dashboard switches Tari back to Tor automatically once the chain is synced (#234). tari is recreated."
         else
             msg="Tari clearnet sync DISABLED (#183) — the Tari base node returns to Tor-only transport. tari is recreated."
@@ -4713,7 +4808,8 @@ apply_dry_run() {
         [ -z "$msg" ] && continue # internal-only keys stay silent, same as apply
         if [ "$porcelain" -eq 1 ]; then
             printf '%s\t%s\t%s\n' "$flag" "$key" "$msg"
-        elif [ "$flag" == "DEST" ]; then
+        elif [ "$flag" == "DEST" ] || [ "$flag" == "CONFIRM" ]; then
+            # #719: CONFIRM is disruptive on the host too — warn, same as DEST.
             echo -e "  ${C_YELLOW}⚠ ${msg}${C_RESET}"
         else
             echo "  • ${msg}"
@@ -4786,7 +4882,9 @@ apply() {
             flag=${line%%$'\t'*}
             msg=${line#*$'\t'}
             [ -z "$msg" ] && continue # internal-only keys (e.g. the auth fingerprint) stay silent
-            if [ "$flag" == "DEST" ]; then
+            # CONFIRM (#719) is the dashboard's confirm-gated class, but on the HOST CLI it is just
+            # as disruptive as DEST — warn and fold it into the y/N confirmation, same as before.
+            if [ "$flag" == "DEST" ] || [ "$flag" == "CONFIRM" ]; then
                 echo -e "  ${C_YELLOW}⚠ ${msg}${C_RESET}"
                 destructive=1
             else
@@ -4993,7 +5091,7 @@ run_chain() {
 # the Telegram channel (the future #338 approval channel), so the dashboard must not silence
 # them. Space-separated exact env-key names.
 CONTROL_DASHBOARD_EDITABLE_KEYS='P2POOL_FLAGS P2POOL_PORT
-    XVB_ENABLED XVB_DONATION_LEVEL TARI_REQUIRED
+    XVB_ENABLED XVB_DONATION_LEVEL TARI_REQUIRED DASHBOARD_FAIL_CLOSED
     DASHBOARD_CHECK_UPDATES DASHBOARD_TZ
     MONERO_MEM_LIMIT TARI_MEM_LIMIT MONERO_PREP_THREADS
     HASHRATE_DROP_THRESHOLD_PCT HASHRATE_DROP_MINUTES TELEGRAM_DAILY_SUMMARY_TIME
@@ -5009,8 +5107,22 @@ CONTROL_DASHBOARD_EDITABLE_KEYS='P2POOL_FLAGS P2POOL_PORT
     TELEGRAM_EVENT_HIGH_REJECT_RATE TELEGRAM_EVENT_BLOCK_FOUND
     TELEGRAM_EVENT_PAYOUT_FOUND TELEGRAM_EVENT_PAYOUT_CONFIRMED TELEGRAM_EVENT_CONTAINER_UNHEALTHY'
 
-control_approval_gate() { # <staged-file>
-    local staged="$1" porcelain
+# The confirm-gated editable set (#719): operationally-disruptive env keys the dashboard MAY commit
+# behind a type-to-confirm — NOT the security perimeter (wallets, keys, credentials, onion,
+# tor_egress_firewall, dashboard.control.enabled, stratum password, per-rig hosts/tokens all stay
+# host-only DEST). Type-to-confirm is UX FRICTION, not a security control: a compromised dashboard
+# that can set a field can also fill the confirm box, so this set is strictly the "expensive but
+# recoverable, not a breach" class — a data-dir move (re-sync), a stratum-port repoint (rigs
+# reconnect), a clearnet-sync enable (host IP exposed during IBD, auto-reverts), a prune enable
+# (reclaims disk). describe_change flags each CONFIRM only in its in-scope DIRECTION — the flag
+# carries the direction (prune DISABLE, TOR data-dir move, etc. still emit DEST and stay refused);
+# this list is the static allowlist the gate's default-deny pass consults and the UI mirrors
+# (control_service.CONFIRM_ENV_KEY_PATHS, drift-guarded like CONTROL_DASHBOARD_EDITABLE_KEYS).
+CONTROL_DASHBOARD_CONFIRM_KEYS='MONERO_DATA_DIR TARI_DATA_DIR P2POOL_DATA_DIR DASHBOARD_DATA_DIR
+    STRATUM_PORT MONERO_CLEARNET_SYNC TARI_CLEARNET_SYNC MONERO_PRUNE'
+
+control_approval_gate() { # <staged-file> [confirm-token]
+    local staged="$1" confirm="${2:-}" porcelain
     # Fail closed if we cannot re-derive the change set (the staged config was validated at
     # preview, so a dry-run failure here means something changed — refuse).
     if ! porcelain=$(PITHEAD_CONFIG_FILE="$staged" "$0" apply --dry-run --porcelain 2>/dev/null); then
@@ -5070,18 +5182,78 @@ control_approval_gate() { # <staged-file>
     # flag says. Refusal keys off a violation COUNT, not the matched text, so a blank or
     # malformed porcelain row (empty KEY column) still refuses instead of slipping past an
     # emptiness test.
+    # The allowlist now spans BOTH the free-to-commit editable set and the confirm-gated set (#719):
+    # a change to any other key still fails closed here. The CONFIRM set only gets PAST this pass —
+    # it still has to clear the DEST perimeter and satisfy the typed-confirmation check below.
     local editable_re bad hit
-    editable_re=$(printf '%s' "$CONTROL_DASHBOARD_EDITABLE_KEYS" | tr -s ' \n' '|')
+    editable_re=$(printf '%s %s' "$CONTROL_DASHBOARD_EDITABLE_KEYS" "$CONTROL_DASHBOARD_CONFIRM_KEYS" | tr -s ' \n' '|')
     bad=$(printf '%s' "$porcelain" | awk -F'\t' 'NF' | cut -f2 | grep -cvxE "$editable_re" || true)
     if [ "${bad:-0}" -gt 0 ]; then
         hit=$(printf '%s' "$porcelain" | awk -F'\t' 'NF' | cut -f2 | grep -m1 -vxE "$editable_re" || true)
         printf 'this change alters a security-sensitive setting (%s) that is not committable from the dashboard. Edit config.json on the host and run `%s apply`.' "${hit:-unparseable change row}" "$0"
         return 1
     fi
+    # Perimeter: any DEST row is refused outright — the confirm-gate never covers a destructive
+    # host-only change. A data-dir MOVE is CONFIRM (below); a prune DISABLE or a TOR data-dir move
+    # still emits DEST and is caught here even though its key is on the confirm allowlist.
     if printf '%s\n' "$porcelain" | grep -qE $'^DEST\t'; then
         printf 'this change is destructive and cannot be committed from the dashboard. Edit config.json on the host and run `%s apply`.' "$0"
         return 1
     fi
+    # Data-dir destination allowlist (#728). #719 made the four *_DATA_DIR moves confirm-gated, so a
+    # dashboard operator who types APPLY can now RELOCATE a service's data dir. assert_safe_dir — the
+    # host-shell guard — is a BLOCKLIST: it refuses the catastrophic roots (/, $HOME, bare mounts, …)
+    # but passes any OTHER absolute path. At host-shell trust that is proportionate (a shell already
+    # has filesystem-wide reach); at dashboard trust it would let a confirmed move target another
+    # user's home or another service's data volume and have pithead mkdir/chown -R it and bind-mount
+    # it into a recreated container — a destination trust-escalation. This gate runs ONLY for
+    # dashboard commits (the host `apply` path never calls control_approval_gate), so it is exactly
+    # where the tighter, control-only rule belongs: for a control-channel move, narrow the
+    # DESTINATION from a blocklist to an ALLOWLIST — permit only a path under the stack's own data
+    # root ($PWD/data, the install dir's data/) or a parent the stack ALREADY keeps data in (each
+    # live *_DATA_DIR's parent — a root a host operator already opted into, which covers a co-located
+    # shared data root, #455). Anything else is refused EVEN with the APPLY token: that move stays
+    # host-CLI-only. Only EXPLICIT absolute paths are checked — "auto"/empty resolves to a stack
+    # default that is under a data root by construction. assert_safe_dir still runs at apply time.
+    local -a allowed_roots=("$PWD/data")
+    local dvar cur
+    for dvar in MONERO_DATA_DIR TARI_DATA_DIR P2POOL_DATA_DIR DASHBOARD_DATA_DIR; do
+        cur=$(env_get "$dvar")
+        [ -n "$cur" ] && allowed_roots+=("$(dirname "$cur")")
+    done
+    local ddpath dest root ok_root
+    for ddpath in monero.data_dir tari.data_dir p2pool.data_dir dashboard.data_dir; do
+        dest=$(jq -r --arg p "$ddpath" 'getpath($p/".") // empty' "$staged" 2>/dev/null)
+        # Skip only values resolve_default turns into an in-root stack default — its EXACT set,
+        # not a DYNAMIC_* wildcard (which would also swallow a bogus DYNAMIC_FOO that resolve_default
+        # passes through literally). A non-absolute/traversal dest never reaches here anyway:
+        # assert_safe_dir (called in the dry-run re-derivation at the top of this gate) refuses
+        # `..`/relative paths first — keep that ordering.
+        case "$dest" in "" | auto | DYNAMIC_DATA | DYNAMIC_HOST | DYNAMIC_ID) continue ;; esac
+        ok_root=0
+        # Trailing slash on both sides so a root prefix can't false-match a sibling (/data vs
+        # /database); an exact-root dest matches too (harmless — still the stack's own dir).
+        for root in "${allowed_roots[@]}"; do
+            case "$dest/" in "$root"/*) ok_root=1 && break ;; esac
+        done
+        if [ "$ok_root" -eq 0 ]; then
+            printf 'this move sends %s to %s, which is outside the stack data root(s) — a dashboard-confirmed data-dir move must stay under the stack data directory (%s) or a parent it already uses. Apply it from the host with `%s apply`.' "$ddpath" "$dest" "$PWD/data" "$0"
+            return 1
+        fi
+    done
+    # Confirm-gate (#719): an in-scope CONFIRM row PROCEEDS only with the operator's typed
+    # confirmation. The token is a fixed literal ("APPLY"), orthogonal to the value being set — it
+    # is friction that forces the operator to acknowledge an expensive/disruptive op, NOT a security
+    # control (the perimeter above is the boundary). control_commit records a confirmed change
+    # distinctly in the audit log via the marker file touched here.
+    if printf '%s\n' "$porcelain" | grep -qE $'^CONFIRM\t'; then
+        if [ "$confirm" != "APPLY" ]; then
+            hit=$(printf '%s\n' "$porcelain" | grep -m1 -E $'^CONFIRM\t' | cut -f3-)
+            printf 'this change is disruptive (%s) — type APPLY in the dashboard to confirm.' "${hit:-disruptive change}"
+            return 1
+        fi
+        touch "${staged}.confirmed" 2>/dev/null || true
+    fi
     # Approved: echo the changed key NAMES so the commit's audit entry can record WHAT changed
     # (#349) without a third dry-run. Names only, never values. dashboard.energy (#504) is
     # config.json-only, so it never appears in the env porcelain — fold a synthetic DASHBOARD_ENERGY
@@ -5185,7 +5357,8 @@ control_preview() { # <request-file> <id> <actor> <control-dir>
     if out=$(PITHEAD_CONFIG_FILE="$staged" "$0" apply --dry-run --porcelain 2>"$errf"); then
         result=$(printf '%s\n' "$out" | jq -R -s '
             [split("\n")[] | select(length > 0) | split("\t") | {flag: .[0], key: .[1], msg: (.[2:] | join("\t"))}]
-            | {status: "previewed", changes: ., destructive: (map(.flag == "DEST") | any), ts: (now | floor)}')
+            | {status: "previewed", changes: .,
+               destructive: (map(.flag == "DEST" or .flag == "CONFIRM") | any), ts: (now | floor)}')
         # #504: dashboard.energy is config.json-only (never rendered to .env), so an energy-only
         # edit produces no porcelain row. Surface it as a normal committable INFO change so the UI
         # arms Apply and the commit lands it in config.json. The approval gate allowlists exactly
@@ -5237,8 +5410,8 @@ control_reown_operator_files() {
 
 # Commit: apply the HOST-SIDE staged copy from the matching preview. A tampered second request
 # can't swap the config — commit carries only the id; the config it applies is the one previewed.
-control_commit() { # <id> <actor> <control-dir>
-    local id="$1" actor="$2" cdir="$3"
+control_commit() { # <id> <actor> <control-dir> [confirm-token]
+    local id="$1" actor="$2" cdir="$3" confirm="${4:-}"
     local staged="$cdir/staged/$id.json" logf="$cdir/staged/.$id.log" rc=0
     if [ ! -f "$staged" ]; then
         control_write_result "$cdir/results" "$id" "$(jq -n '{status:"rejected",error:"no staged intent for this id — preview first",ts:(now|floor)}')"
@@ -5254,14 +5427,23 @@ control_commit() { # <id> <actor> <control-dir>
     # On refusal the gate's stdout is the reason; on approval it is the changed key names, which
     # the audit entries below record — WHAT changed, by name only (#349).
     local gate_out keys=""
-    if ! gate_out=$(control_approval_gate "$staged"); then
+    if ! gate_out=$(control_approval_gate "$staged" "$confirm"); then
         [ -n "$gate_out" ] || gate_out="approval denied"
         control_write_result "$cdir/results" "$id" "$(jq -n --arg e "$gate_out" '{status:"rejected",error:$e,ts:(now|floor)}')"
-        rm -f "$staged"
+        rm -f "$staged" "${staged}.confirmed"
         control_audit "$cdir/audit/control.log" "$id" "$actor" "commit" "rejected"
         return 0
     fi
     keys="$gate_out"
+    # A confirm-gated destructive change (#719) is logged AS SUCH — the gate touches this marker
+    # when a typed confirmation carried an in-scope CONFIRM row past the perimeter. The distinct
+    # `commit-confirmed` action separates a dashboard-confirmed disruptive apply from an ordinary
+    # (INFO-only) dashboard commit in the tamper-evidence log. Host-CLI applies never reach this log.
+    local audit_action="commit"
+    if [ -f "${staged}.confirmed" ]; then
+        audit_action="commit-confirmed"
+        rm -f "${staged}.confirmed"
+    fi
     # Keep a pre-change backup; on failure it is named in the result and left in place. The
     # `apply -y` below re-renders the pre-masked prefill copy (#440), so the dashboard's editor
     # form reflects the committed config on the next load.
@@ -5271,14 +5453,14 @@ control_commit() { # <id> <actor> <control-dir>
     if [ "$rc" -eq 0 ]; then
         control_reown_operator_files # the root apply wrote .env/Caddyfile as root — give them back (#33)
         control_write_result "$cdir/results" "$id" "$(jq -n '{status:"applied",ts:(now|floor)}')"
-        control_audit "$cdir/audit/control.log" "$id" "$actor" "commit" "applied" "$keys"
+        control_audit "$cdir/audit/control.log" "$id" "$actor" "$audit_action" "applied" "$keys"
     else
         # apply's own .apply-incomplete marker handles the container-recreate retry; the config
         # backup lets the operator revert by hand if the new config itself is the problem.
         control_write_result "$cdir/results" "$id" "$(jq -n --arg e "$(tail -c 2000 "$logf")" --arg b "${CONFIG_FILE}.bak-control" '{status:"failed",error:$e,backup:$b,ts:(now|floor)}')"
-        control_audit "$cdir/audit/control.log" "$id" "$actor" "commit" "failed" "$keys"
+        control_audit "$cdir/audit/control.log" "$id" "$actor" "$audit_action" "failed" "$keys"
     fi
-    rm -f "$staged" "$logf"
+    rm -f "$staged" "$logf" "${staged}.confirmed"
 }
 
 # True when SemVer $1 is strictly newer than $2 (either may carry a leading `v`). Both arguments
@@ -5973,7 +6155,7 @@ control_process_request() { # <claimed-file> <control-dir>
         warn "Control request has a malformed id — discarded (no result can be addressed)."
         return 0
     fi
-    if [ "$(jq -r '[keys[] | select(. != "id" and . != "action" and . != "config" and . != "actor" and . != "version" and . != "worker" and . != "changes")] | length' "$file")" != "0" ]; then
+    if [ "$(jq -r '[keys[] | select(. != "id" and . != "action" and . != "config" and . != "actor" and . != "version" and . != "worker" and . != "changes" and . != "confirm")] | length' "$file")" != "0" ]; then
         control_write_result "$cdir/results" "$id" "$(jq -n '{status:"rejected",error:"unexpected keys in request",ts:(now|floor)}')"
         control_audit "$cdir/audit/control.log" "$id" "" "invalid" "rejected"
         return 0
@@ -5985,7 +6167,7 @@ control_process_request() { # <claimed-file> <control-dir>
     action=$(jq -r '.action // ""' "$file")
     case "$action" in
     preview) control_preview "$file" "$id" "$actor" "$cdir" ;;
-    commit) control_commit "$id" "$actor" "$cdir" ;;
+    commit) control_commit "$id" "$actor" "$cdir" "$(jq -r '.confirm // ""' "$file")" ;;
     upgrade) control_upgrade "$file" "$id" "$actor" "$cdir" ;;
     worker-apply) control_worker_apply "$file" "$id" "$actor" "$cdir" ;;
     worker-upgrade) control_worker_upgrade "$file" "$id" "$actor" "$cdir" ;;
diff --git a/tests/stack/run.sh b/tests/stack/run.sh
index 68071c0e..23e4256d 100755
--- a/tests/stack/run.sh
+++ b/tests/stack/run.sh
@@ -389,13 +389,17 @@ run_sourced "$SANDBOX" is_valid_host "$(printf 'a%.0s' $(seq 1 254))" >/dev/null
 assert_rc "rejects 254 chars, past the bound (#558)" "$?" "1"
 
 echo "== unit: describe_change =="
-assert_contains "prune is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_PRUNE 1 0)" "DEST"
+# Monero prune (#719): DISABLE (on → off) forces a full re-sync, host-only DEST; ENABLE (off → on)
+# reclaims disk, an operator-intent op — now confirm-gated (CONFIRM), not a flat host-only refuse.
+assert_contains "prune disable is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_PRUNE 1 0)" "DEST"
+assert_contains "prune enable is CONFIRM" "$(run_sourced "$SANDBOX" describe_change MONERO_PRUNE 0 1)" "CONFIRM"
 assert_contains "rpc lan is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_RPC_BIND 127.0.0.1 0.0.0.0)" "DEST"
 assert_contains "stratum open is DEST" "$(run_sourced "$SANDBOX" describe_change STRATUM_BIND 127.0.0.1 0.0.0.0)" "DEST"
 assert_contains "stratum lan is INFO" "$(run_sourced "$SANDBOX" describe_change STRATUM_BIND 0.0.0.0 127.0.0.1)" "INFO"
-# Stratum port (#172): changing it disconnects every rig until repointed — DEST; the key's first
-# appearance (an upgrade from a pre-#172 .env) is a no-op INFO row, never a scary repoint warning.
-assert_contains "stratum port change is DEST" "$(run_sourced "$SANDBOX" describe_change STRATUM_PORT 3333 4444)" "DEST"
+# Stratum port (#172/#719): changing it disconnects every rig until repointed — an operator-intent
+# repoint, now confirm-gated (CONFIRM); the key's first appearance (an upgrade from a pre-#172 .env)
+# is a no-op INFO row, never a scary repoint warning.
+assert_contains "stratum port change is CONFIRM" "$(run_sourced "$SANDBOX" describe_change STRATUM_PORT 3333 4444)" "CONFIRM"
 assert_contains "stratum port change says repoint" "$(run_sourced "$SANDBOX" describe_change STRATUM_PORT 3333 4444)" "repoint"
 assert_contains "stratum port first render is INFO" "$(run_sourced "$SANDBOX" describe_change STRATUM_PORT '' 3333)" "INFO"
 # Stratum access-password (#152): enabling/changing is DEST (rigs need the new pass), disabling is
@@ -411,6 +415,13 @@ esac
 assert_contains "tor auto-heal enable is INFO" "$(run_sourced "$SANDBOX" describe_change TOR_AUTO_HEAL false true)" "INFO"
 assert_contains "tor auto-heal enable names the cost" "$(run_sourced "$SANDBOX" describe_change TOR_AUTO_HEAL false true)" "drops ALL Tor circuits"
 assert_contains "tor auto-heal disable names the manual fix" "$(run_sourced "$SANDBOX" describe_change TOR_AUTO_HEAL true false)" "restart tor"
+# Fail-closed miner hold (#490): INFO either way (like TARI_REQUIRED) — it's on the dashboard
+# control-channel allowlist, so a DEST flag here would make control_approval_gate refuse every
+# commit that touches it, defeating the allowlisting.
+assert_contains "fail_closed enable is INFO" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_FAIL_CLOSED false true)" "INFO"
+assert_contains "fail_closed enable names the hold" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_FAIL_CLOSED false true)" "HOLDS p2pool and xmrig-proxy"
+assert_contains "fail_closed disable is INFO" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_FAIL_CLOSED true false)" "INFO"
+assert_contains "fail_closed disable names alert-only" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_FAIL_CLOSED true false)" "only alerts"
 # Dev-fee donate-level (#173): a brief restart (INFO), shown as a percentage.
 assert_contains "donate-level is INFO" "$(run_sourced "$SANDBOX" describe_change PROXY_DONATE_LEVEL 0 1)" "INFO"
 assert_contains "donate-level shows pct" "$(run_sourced "$SANDBOX" describe_change PROXY_DONATE_LEVEL 0 1)" "0% → 1%"
@@ -428,7 +439,11 @@ assert_contains "empty to local_node is a LOCAL switch" "$(run_sourced "$SANDBOX
 assert_contains "local_node to empty is a REMOTE switch" "$(run_sourced "$SANDBOX" describe_change COMPOSE_PROFILES local_node "")" "REMOTE Monero node"
 assert_contains "wallet is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_WALLET_ADDRESS a b)" "DEST"
 assert_contains "xvb url is INFO" "$(run_sourced "$SANDBOX" describe_change XVB_POOL_URL a b)" "INFO"
-assert_contains "data_dir is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_DATA_DIR /a /b)" "DEST"
+# Data-dir moves (#719): the four service dirs are confirm-gated (an expensive re-sync, not a
+# breach); every OTHER data dir (e.g. TOR_DATA_DIR) stays host-only DEST.
+assert_contains "monero data_dir is CONFIRM" "$(run_sourced "$SANDBOX" describe_change MONERO_DATA_DIR /a /b)" "CONFIRM"
+assert_contains "dashboard data_dir is CONFIRM" "$(run_sourced "$SANDBOX" describe_change DASHBOARD_DATA_DIR /a /b)" "CONFIRM"
+assert_contains "tor data_dir stays DEST" "$(run_sourced "$SANDBOX" describe_change TOR_DATA_DIR /a /b)" "DEST"
 assert_contains "tari mem is INFO" "$(run_sourced "$SANDBOX" describe_change TARI_MEM_LIMIT 2048m 4g)" "INFO"
 # Healthchecks.io (#79): the ping URL is the on/off switch AND a capability secret. Setting it says
 # ENABLED, clearing it says DISABLED — and the value must NEVER be echoed into the apply preview.
@@ -473,13 +488,14 @@ case "$tg_tok_msg" in
 esac
 assert_contains "monero mem is INFO" "$(run_sourced "$SANDBOX" describe_change MONERO_MEM_LIMIT 4g 6g)" "INFO"
 assert_contains "monero mem recreate note" "$(run_sourced "$SANDBOX" describe_change MONERO_MEM_LIMIT 4g 6g)" "monerod container is recreated"
-# Clearnet initial sync (#183): enabling OR disabling is DEST (the daemon is recreated), and enabling
-# must spell out the exposure so the apply confirmation is unambiguous.
-assert_contains "monero clearnet enable is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "DEST"
+# Clearnet initial sync (#183/#719): ENABLING exposes the host IP during IBD — confirm-gated
+# (CONFIRM), and the row must spell out the exposure. DISABLING keeps sync on Tor — a plain INFO
+# change, no confirm friction.
+assert_contains "monero clearnet enable is CONFIRM" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "CONFIRM"
 assert_contains "monero clearnet enable warns exposure" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "CLEARNET"
 assert_contains "monero clearnet keeps tx on Tor" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC false true)" "Tor"
-assert_contains "monero clearnet disable is DEST" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC true false)" "DEST"
-assert_contains "tari clearnet enable is DEST" "$(run_sourced "$SANDBOX" describe_change TARI_CLEARNET_SYNC false true)" "DEST"
+assert_contains "monero clearnet disable is INFO" "$(run_sourced "$SANDBOX" describe_change MONERO_CLEARNET_SYNC true false)" "INFO"
+assert_contains "tari clearnet enable is CONFIRM" "$(run_sourced "$SANDBOX" describe_change TARI_CLEARNET_SYNC false true)" "CONFIRM"
 assert_contains "tari clearnet enable warns exposure" "$(run_sourced "$SANDBOX" describe_change TARI_CLEARNET_SYNC false true)" "CLEARNET"
 
 echo "== unit: p2pool_outbound_flags — Tor-by-default for outbound P2P (#165) =="
@@ -3214,6 +3230,7 @@ assert_eq "P2POOL_URL keeps the internal :3333" "$(run_sourced "$V" env_get_file
 assert_eq "token preserved" "$(run_sourced "$V" env_get_file "$V/.env" PROXY_AUTH_TOKEN)" "ORIGINALTOKEN"
 assert_eq "onion preserved" "$(run_sourced "$V" env_get_file "$V/.env" P2POOL_ONION_ADDRESS)" "p2pa.onion"
 assert_eq "tari_required default" "$(run_sourced "$V" env_get_file "$V/.env" TARI_REQUIRED)" "true"
+assert_eq "fail_closed default off (#490)" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_FAIL_CLOSED)" "false"
 # The new-release check (#224) defaults ON when absent from config — it's Tor-routed, so it leaks
 # nothing, and an operator who wants zero GitHub contact sets check_for_updates:false to opt out.
 assert_eq "check_for_updates default on" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_CHECK_UPDATES)" "true"
@@ -3264,6 +3281,12 @@ printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","n
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "tari_required propagated false" "$(run_sourced "$V" env_get_file "$V/.env" TARI_REQUIRED)" "false"
 
+# Opt-in fail-closed (dashboard.fail_closed:true) propagates as DASHBOARD_FAIL_CLOSED=true (#490).
+seed_env
+printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p"}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan","fail_closed":true} }\n' "$WALLET" >"$V/config.json"
+out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
+assert_eq "fail_closed propagated true" "$(run_sourced "$V" env_get_file "$V/.env" DASHBOARD_FAIL_CLOSED)" "true"
+
 # Opting out (dashboard.check_for_updates:false) propagates as DASHBOARD_CHECK_UPDATES=false (#224) —
 # only an explicit false disables it (anything else, incl. absent, stays the default-on true).
 seed_env
@@ -3469,6 +3492,34 @@ sp1="$(run_sourced "$V" env_get_file "$V/.env" PROXY_STRATUM_PASSWORD)"
 case "$sp1" in ?*) ok "stratum_password auto generated a secret" ;; *) bad "stratum_password auto generated a secret" "got empty" ;; esac
 assert_eq "donate-level explicit propagated" "$(run_sourced "$V" env_get_file "$V/.env" PROXY_DONATE_LEVEL)" "1"
 assert_contains "stratum auth surfaced for rigs" "$(run_sourced "$V" announce_stratum_auth 2>&1)" "Stratum authentication is ON"
+
+echo "== unit: announce_local_miner hands off the stratum URL + secret only when opted in (#593) =="
+# The local-miner opt-in surfaces the two values a co-located RigForge install needs (pool URL +
+# stratum secret) and NOTHING else — off by default, loopback when the bind allows it, the bound
+# LAN address when it doesn't (the #593 stratum_bind edge case), and RigForge-owns-tuning stated.
+LM="$SANDBOX/lm"
+mkdir -p "$LM"
+printf 'STRATUM_BIND=0.0.0.0\nSTRATUM_PORT=3333\nPROXY_STRATUM_PASSWORD=s3cr3t\n' >"$LM/.env"
+# Opt-out (default): prints nothing at all.
+printf '{"local_miner":{"enabled":false}}' >"$LM/config.json"
+assert_eq "opt-out prints nothing" "$(run_sourced "$LM" announce_local_miner 2>&1)" ""
+# Absent block also prints nothing (default false).
+printf '{}' >"$LM/config.json"
+assert_eq "absent local_miner prints nothing" "$(run_sourced "$LM" announce_local_miner 2>&1)" ""
+# Opt-in, 0.0.0.0 bind: loopback URL + the secret + the RigForge-owns-tuning note.
+printf '{"local_miner":{"enabled":true}}' >"$LM/config.json"
+lm_out="$(run_sourced "$LM" announce_local_miner 2>&1)"
+assert_contains "opt-in surfaces loopback pool URL" "$lm_out" "127.0.0.1:3333"
+assert_contains "opt-in surfaces the stratum secret" "$lm_out" "s3cr3t"
+assert_contains "opt-in states RigForge owns host tuning" "$lm_out" "RigForge"
+# Custom port + specific LAN bind: target the bound address, not hardcoded loopback (#593 edge case).
+printf 'STRATUM_BIND=192.168.1.9\nSTRATUM_PORT=4444\nPROXY_STRATUM_PASSWORD=s3cr3t\n' >"$LM/.env"
+lm_out="$(run_sourced "$LM" announce_local_miner 2>&1)"
+assert_contains "LAN bind targets the bound address:port" "$lm_out" "192.168.1.9:4444"
+# No stratum password set: say so rather than printing a blank pass.
+printf 'STRATUM_BIND=0.0.0.0\nSTRATUM_PORT=3333\nPROXY_STRATUM_PASSWORD=\n' >"$LM/.env"
+assert_contains "no-password case is stated explicitly" "$(run_sourced "$LM" announce_local_miner 2>&1)" "none set"
+
 # Re-apply: an "auto" password must be STABLE (reused, not rotated) — like the proxy token.
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
 assert_eq "stratum_password auto stable across apply" "$(run_sourced "$V" env_get_file "$V/.env" PROXY_STRATUM_PASSWORD)" "$sp1"
@@ -3514,7 +3565,7 @@ assert_contains "tari default: DNS seeds empty" "$(cat "$V/build/tari/config.tom
 assert_contains "tari default: advertises onion" "$(cat "$V/build/tari/config.toml")" "/onion3/"
 
 # Monero clearnet ON (Tari left off): only the Monero flag flips; Tari stays Tor. The apply preview
-# must spell out the clearnet exposure (it's a DEST change).
+# must spell out the clearnet exposure (a CONFIRM change — disruptive, warned ⚠ on the host CLI).
 seed_env
 printf '{ "monero": {"mode":"local","wallet_address":"%s","node_username":"u","node_password":"p","clearnet_initial_sync":true}, "tari":{"wallet_address":"T"}, "p2pool":{"pool":"mini"}, "dashboard":{"secure":false,"host":"box.lan"} }\n' "$WALLET" >"$V/config.json"
 out="$(cd "$V" && DOCKER_LOG="$DOCKER_LOG" PATH="$V/bin:$PATH" ./pithead apply -y 2>&1)"
@@ -4827,25 +4878,127 @@ assert_not_contains "fully-configured control raises no telegram.control error"
 control_config main
 (cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
 
-echo "== black-box: approval gate fails closed on a destructive commit (#33 / #338) =="
+echo "== black-box: confirm-gate — an in-scope disruptive change needs a typed APPLY (#719) =="
 UUID3="33333333-3333-4333-8333-333333333333"
 # Clean baseline: pool mini, clearnet off, applied.
 control_config mini
 (cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
-# Candidate turns on Monero clearnet initial sync — describe_change flags this DEST (destructive).
+# Candidate turns on Monero clearnet initial sync — describe_change flags this CONFIRM (#719): an
+# in-scope disruptive change (host IP exposed during IBD), confirm-gated rather than host-only DEST.
+preview_clearnet() {
+    jq -n --arg w "$WALLET" --arg id "$UUID3" '{id:$id,action:"preview",actor:"admin",config:{
+        monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",clearnet_initial_sync:true},
+        tari:{wallet_address:"T"}, p2pool:{pool:"mini"},
+        dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},control:{enabled:true}}}}' >"$REQS/$UUID3.json"
+    run_pending >/dev/null
+}
+preview_clearnet
+assert_eq "confirm-gated candidate previews destructive:true" "$(jq -r '.destructive' "$RESULTS/$UUID3.json" 2>/dev/null)" "true"
+assert_contains "confirm-gated preview carries a CONFIRM row" "$(jq -r '.changes[].flag' "$RESULTS/$UUID3.json" 2>/dev/null)" "CONFIRM"
+# Commit WITHOUT the typed confirmation is refused — and points at the confirm step, NOT a flat
+# host-only #338 refusal. The in-scope change is NOT hard-refused; it just needs the acknowledgement.
+printf '{"id":"%s","action":"commit","actor":"admin"}\n' "$UUID3" >"$REQS/$UUID3.json"
+run_pending >/dev/null
+assert_eq "confirm-gated commit without a token is refused" "$(jq -r '.status' "$RESULTS/$UUID3.json" 2>/dev/null)" "rejected"
+assert_contains "refusal asks for the typed APPLY" "$(jq -r '.error' "$RESULTS/$UUID3.json" 2>/dev/null)" "type APPLY"
+assert_eq "unconfirmed commit did not touch config.json" "$(jq -r '.monero.clearnet_initial_sync // false' "$C/config.json")" "false"
+# A WRONG token is refused too — only the exact literal proceeds.
+preview_clearnet
+printf '{"id":"%s","action":"commit","actor":"admin","confirm":"apply"}\n' "$UUID3" >"$REQS/$UUID3.json"
+run_pending >/dev/null
+assert_eq "confirm-gated commit with the wrong token is refused" "$(jq -r '.status' "$RESULTS/$UUID3.json" 2>/dev/null)" "rejected"
+assert_eq "wrong-token commit did not touch config.json" "$(jq -r '.monero.clearnet_initial_sync // false' "$C/config.json")" "false"
+# Commit WITH the exact typed APPLY proceeds and lands the change.
+preview_clearnet
+printf '{"id":"%s","action":"commit","actor":"admin","confirm":"APPLY"}\n' "$UUID3" >"$REQS/$UUID3.json"
+run_pending >/dev/null
+assert_eq "confirm-gated commit with APPLY applies" "$(jq -r '.status' "$RESULTS/$UUID3.json" 2>/dev/null)" "applied"
+assert_eq "confirmed change landed in config.json" "$(jq -r '.monero.clearnet_initial_sync' "$C/config.json")" "true"
+# The audit log records it AS a dashboard-confirmed destructive change (#719): the distinct
+# commit-confirmed action, carrying the changed key NAME (never a value).
+assert_contains "confirmed commit audits as commit-confirmed with the key name" \
+    "$(grep '"action":"commit-confirmed","status":"applied"' "$AUDIT" | tail -n 1)" "MONERO_CLEARNET_SYNC"
+
+echo "== black-box: the typed APPLY does NOT unlock the perimeter — DEST stays host-only (#719) =="
+# Type-to-confirm is UX friction, not a security control: it must never carry a PERIMETER change.
+# (a) A perimeter key that never touches an allowlist (monero.rpc_lan_access -> MONERO_RPC_BIND,
+# DEST) is refused even WITH the token, on the security-sensitive gate.
 jq -n --arg w "$WALLET" --arg id "$UUID3" '{id:$id,action:"preview",actor:"admin",config:{
-    monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",clearnet_initial_sync:true},
+    monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",rpc_lan_access:true},
     tari:{wallet_address:"T"}, p2pool:{pool:"mini"},
     dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},control:{enabled:true}}}}' >"$REQS/$UUID3.json"
 run_pending >/dev/null
-assert_eq "destructive candidate previews destructive:true" "$(jq -r '.destructive' "$RESULTS/$UUID3.json" 2>/dev/null)" "true"
-printf '{"id":"%s","action":"commit","actor":"admin"}\n' "$UUID3" >"$REQS/$UUID3.json"
+printf '{"id":"%s","action":"commit","actor":"admin","confirm":"APPLY"}\n' "$UUID3" >"$REQS/$UUID3.json"
+run_pending >/dev/null
+assert_eq "perimeter RPC-LAN change is refused despite the APPLY token" "$(jq -r '.status' "$RESULTS/$UUID3.json" 2>/dev/null)" "rejected"
+assert_contains "perimeter refusal is the security-sensitive gate, not the confirm step" "$(jq -r '.error' "$RESULTS/$UUID3.json" 2>/dev/null)" "security-sensitive"
+assert_eq "perimeter change did not touch config.json" "$(jq -r '.monero.rpc_lan_access // false' "$C/config.json")" "false"
+# (b) A confirm-KEY in its HEAVY direction (monero.prune DISABLE → full re-sync) still emits DEST
+# and is refused even WITH the token — the confirm allowlist is not a blanket unlock for the key.
+jq -n --arg w "$WALLET" '{monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",prune:true},
+    tari:{wallet_address:"T"}, p2pool:{pool:"mini"},
+    dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},control:{enabled:true}}}' >"$C/config.json"
+(cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
+jq -n --arg w "$WALLET" --arg id "$UUID3" '{id:$id,action:"preview",actor:"admin",config:{
+    monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",prune:false},
+    tari:{wallet_address:"T"}, p2pool:{pool:"mini"},
+    dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},control:{enabled:true}}}}' >"$REQS/$UUID3.json"
+run_pending >/dev/null
+printf '{"id":"%s","action":"commit","actor":"admin","confirm":"APPLY"}\n' "$UUID3" >"$REQS/$UUID3.json"
 run_pending >/dev/null
-assert_eq "destructive commit is refused" "$(jq -r '.status' "$RESULTS/$UUID3.json" 2>/dev/null)" "rejected"
-assert_contains "destructive refusal names the host apply path, not stale #338 (#713)" "$(jq -r '.error' "$RESULTS/$UUID3.json" 2>/dev/null)" "Edit config.json on the host"
-assert_eq "refused destructive commit did not touch config.json" "$(jq -r '.monero.clearnet_initial_sync // false' "$C/config.json")" "false"
+assert_eq "prune DISABLE is refused despite the APPLY token" "$(jq -r '.status' "$RESULTS/$UUID3.json" 2>/dev/null)" "rejected"
+# #713 removed the stale #338 reference from the destructive refusal; it now names the host path.
+assert_contains "prune-disable refusal names the host apply path, not stale #338 (#713)" "$(jq -r '.error' "$RESULTS/$UUID3.json" 2>/dev/null)" "Edit config.json on the host"
+assert_eq "prune stays enabled after the refusal" "$(jq -r '.monero.prune' "$C/config.json")" "true"
 [ ! -f "$STAGED/$UUID3.json" ] && ok "refused destructive intent cleared from staged" || bad "refused destructive intent cleared from staged" "still staged"
-# A NON-destructive commit still proceeds (pool switch mini -> nano is INFO, not DEST).
+
+echo "== black-box: a dashboard-confirmed data-dir move is allowlisted to the stack data root (#728) =="
+# #719 made the four *_DATA_DIR moves confirm-gated. assert_safe_dir is a BLOCKLIST, so a
+# confirmed move could target any non-blocklisted absolute path (another user's home, another
+# service's volume). control_approval_gate now narrows the DESTINATION to an allowlist for
+# control-channel moves: only under the stack data root ($C/data) or a parent it already uses.
+# The host `apply` path keeps the blocklist — a shell operator is already trusted.
+UUID7="77777777-7777-4777-8777-777777777777"
+control_config mini
+(cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
+EVIL_DIR="$SANDBOX/other-service-vol/monero" # absolute, NOT blocklisted, NOT under $C/data
+preview_move() {                             # <monero.data_dir>
+    jq -n --arg w "$WALLET" --arg id "$UUID7" --arg dd "$1" '{id:$id,action:"preview",actor:"admin",config:{
+        monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",data_dir:$dd},
+        tari:{wallet_address:"T"}, p2pool:{pool:"mini"},
+        dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},control:{enabled:true}}}}' >"$REQS/$UUID7.json"
+    run_pending >/dev/null
+}
+# (1) A move UNDER the stack data root, confirmed with APPLY, is allowed and lands.
+preview_move "$C/data/monero-v2"
+assert_contains "in-root data-dir move previews a CONFIRM row" "$(jq -r '.changes[].flag' "$RESULTS/$UUID7.json" 2>/dev/null)" "CONFIRM"
+printf '{"id":"%s","action":"commit","actor":"admin","confirm":"APPLY"}\n' "$UUID7" >"$REQS/$UUID7.json"
+run_pending >/dev/null
+assert_eq "in-root data-dir move with APPLY applies" "$(jq -r '.status' "$RESULTS/$UUID7.json" 2>/dev/null)" "applied"
+assert_eq "in-root move landed in .env" "$(run_sourced "$C" env_get_file "$C/.env" MONERO_DATA_DIR)" "$C/data/monero-v2"
+# (2) A move to an arbitrary non-blocklisted, non-allowed path is refused EVEN with APPLY.
+preview_move "$EVIL_DIR"
+printf '{"id":"%s","action":"commit","actor":"admin","confirm":"APPLY"}\n' "$UUID7" >"$REQS/$UUID7.json"
+run_pending >/dev/null
+assert_eq "out-of-root data-dir move is refused despite the APPLY token" "$(jq -r '.status' "$RESULTS/$UUID7.json" 2>/dev/null)" "rejected"
+assert_contains "refusal names the data-root allowlist" "$(jq -r '.error' "$RESULTS/$UUID7.json" 2>/dev/null)" "outside the stack data root"
+# The refusal left config.json untouched — it still carries the previously-committed in-root value
+# (test 1), never the refused out-of-root path.
+assert_eq "refused move did not touch config.json" "$(jq -r '.monero.data_dir // empty' "$C/config.json")" "$C/data/monero-v2"
+[ ! -f "$STAGED/$UUID7.json" ] && ok "refused out-of-root move cleared from staged" || bad "refused out-of-root move cleared from staged" "still staged"
+# (3) The SAME path from the HOST shell still applies — the tighter rule is control-only.
+jq -n --arg w "$WALLET" --arg dd "$EVIL_DIR" '{monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p",data_dir:$dd},
+    tari:{wallet_address:"T"}, p2pool:{pool:"mini"},
+    dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},control:{enabled:true}}}' >"$C/config.json"
+(cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
+assert_rc "host-shell apply to the same out-of-root path succeeds" "$?" "0"
+assert_eq "host-shell apply rendered the out-of-root path (blocklist, not allowlist)" "$(run_sourced "$C" env_get_file "$C/.env" MONERO_DATA_DIR)" "$EVIL_DIR"
+
+echo "== black-box: a NON-destructive commit still proceeds with no token (#33) =="
+# Restore a clean baseline (prune off, clearnet off) then a pool switch mini -> nano is INFO, not
+# DEST/CONFIRM — it commits with no confirmation at all.
+control_config mini
+(cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
 jq -n --arg w "$WALLET" --arg id "$UUID3" '{id:$id,action:"preview",actor:"admin",config:{
     monero:{mode:"local",wallet_address:$w,node_username:"u",node_password:"p"},
     tari:{wallet_address:"T"}, p2pool:{pool:"nano"},
@@ -4870,10 +5023,16 @@ jq -n --arg w "$WALLET" \
     dashboard:{secure:true,host:"box.lan",auth:{username:"admin",password:"a control passphrase"},
                control:{enabled:true}}}' >"$C/config.json"
 (cd "$C" && DOCKER_LOG="$CTRL_LOG" PATH="$C/bin:$PATH" ./pithead apply -y >/dev/null 2>&1)
-gate_try() { # <candidate-json-file> — preview then commit via the spool; result lands in $RESULTS/$UUID5.json
+gate_try() { # <candidate-json-file> [confirm-token] — preview then commit via the spool; result lands in $RESULTS/$UUID5.json
+    # An optional second arg carries a typed confirmation ("APPLY") on the commit, so a PERIMETER case
+    # can prove the change stays refused EVEN WITH a valid token present. Omitted → token-less commit.
     jq --arg id "$UUID5" '{id:$id,action:"preview",actor:"admin",config:.}' "$1" >"$REQS/$UUID5.json"
     run_pending >/dev/null
-    printf '{"id":"%s","action":"commit","actor":"admin"}\n' "$UUID5" >"$REQS/$UUID5.json"
+    if [ -n "${2:-}" ]; then
+        printf '{"id":"%s","action":"commit","actor":"admin","confirm":"%s"}\n' "$UUID5" "$2" >"$REQS/$UUID5.json"
+    else
+        printf '{"id":"%s","action":"commit","actor":"admin"}\n' "$UUID5" >"$REQS/$UUID5.json"
+    fi
     run_pending >/dev/null
 }
 
@@ -4934,6 +5093,22 @@ jq '.healthchecks={ping_url:"https://attacker.example/ping"}' "$C/config.json" >
 gate_try "$C/cand.json"
 assert_eq "healthchecks ping-url repoint commit is refused" "$(jq -r '.status' "$RESULTS/$UUID5.json" 2>/dev/null)" "rejected"
 assert_eq "config.json keeps healthchecks unset" "$(jq -r '.healthchecks.ping_url // "unset"' "$C/config.json")" "unset"
+# The #719 perimeter, named explicitly: disabling the Tor egress firewall would let containers dial
+# clearnet — it is NOT in the confirm-gated set and stays host-only. Commit WITH a valid APPLY token
+# to prove the typed confirmation does not unlock the perimeter — the refusal fires before the token
+# is ever examined, so it stays refused just as it does token-less (#719).
+jq '.network={tor_egress_firewall:false}' "$C/config.json" >"$C/cand.json"
+gate_try "$C/cand.json" APPLY
+assert_eq "tor-egress-firewall disable commit is refused even with the APPLY token" "$(jq -r '.status' "$RESULTS/$UUID5.json" 2>/dev/null)" "rejected"
+assert_contains "tor-egress refusal is a host-only gate (the APPLY token did not unlock it)" "$(jq -r '.error' "$RESULTS/$UUID5.json" 2>/dev/null)" "security-sensitive"
+assert_eq "config.json keeps the tor egress firewall unset (defaults on)" "$(jq -r '.network.tor_egress_firewall // "unset"' "$C/config.json")" "unset"
+# Setting a Monero view key (the #381 payout-confirm secret) reveals every incoming amount — a
+# secret, host-only, never confirm-gated. Commit WITH a valid APPLY token: the perimeter gate must
+# still refuse it, proving the typed confirmation is UX friction, not a security bypass (#719).
+jq '.monero.view_key="deadbeef"' "$C/config.json" >"$C/cand.json"
+gate_try "$C/cand.json" APPLY
+assert_eq "monero view-key set commit is refused even with the APPLY token" "$(jq -r '.status' "$RESULTS/$UUID5.json" 2>/dev/null)" "rejected"
+assert_eq "config.json gains no view key" "$(jq -r '.monero.view_key // "unset"' "$C/config.json")" "unset"
 # XvB pool-URL repoint: redirects donated hashrate to an attacker's pool.
 jq '.xvb.url="attacker.example:4247"' "$C/config.json" >"$C/cand.json"
 gate_try "$C/cand.json"
@@ -5093,6 +5268,7 @@ roundtrip_key() { # <label> <jq-set> <jq-read> <expected>
 roundtrip_key "XVB_ENABLED" '.xvb.enabled=false' '.xvb.enabled' "false"
 roundtrip_key "XVB_DONATION_LEVEL" '.xvb.donation_level="whale"' '.xvb.donation_level' "whale"
 roundtrip_key "TARI_REQUIRED" '.dashboard.tari_required=false' '.dashboard.tari_required' "false"
+roundtrip_key "DASHBOARD_FAIL_CLOSED" '.dashboard.fail_closed=true' '.dashboard.fail_closed' "true"
 roundtrip_key "DASHBOARD_CHECK_UPDATES" '.dashboard.check_for_updates=false' '.dashboard.check_for_updates' "false"
 roundtrip_key "DASHBOARD_TZ" '.dashboard.timezone="Europe/Paris"' '.dashboard.timezone' "Europe/Paris"
 roundtrip_key "MONERO_MEM_LIMIT" '.monero.mem_limit="5g"' '.monero.mem_limit' "5g"
@@ -6644,7 +6820,7 @@ echo "== unit: wizard prompt count is pinned (#502 — a silently-added prompt f
 core_reads=$(awk '/^wizard_ask_core\(\) \{/,/^\}/' "$STACK" | grep -c '^\s*read -r')
 shape_reads=$(awk '/^wizard_ask_shape\(\) \{/,/^\}/' "$STACK" | grep -c '^\s*read -r')
 assert_eq "wizard_ask_core has exactly 12 read prompts (wallets, node config, pool tier, dashboard login)" "$core_reads" "12"
-assert_eq "wizard_ask_shape has exactly 5 read prompts (clearnet-sync, remote-access, alerts cluster)" "$shape_reads" "5"
+assert_eq "wizard_ask_shape has exactly 6 read prompts (clearnet-sync, remote-access, alerts cluster, local-miner opt-in)" "$shape_reads" "6"
 
 # A small helper so tests can drive the whole Q&A -> write in one sourced call, sharing the globals
 # wizard_ask_core/wizard_ask_shape set with wizard_write_config (each function's locals don't
@@ -6686,6 +6862,17 @@ assert_eq "defaults path: dashboard has only 'secure' — no auth/onion written"
 assert_eq "defaults path: no telegram block written" "$(jq -r 'has("telegram")' <<<"$w1_cfg")" "false"
 assert_eq "defaults path: no clearnet_initial_sync written (stays the reference default)" \
     "$(jq -r '.monero | has("clearnet_initial_sync")' <<<"$w1_cfg")" "false"
+assert_eq "defaults path: no local_miner block written (opt-in off, #593)" \
+    "$(jq -r 'has("local_miner")' <<<"$w1_cfg")" "false"
+
+# Opt-in to the local miner (#593): answering 'y' to the final shape prompt writes
+# local_miner.enabled=true; every other answer left blank so only that key appears.
+WLM="$SANDBOX/wizard-local-miner"
+mkdir -p "$WLM"
+printf '%s\n%s\n\n\n\n\n\n\n\ny\n' "$WALLET" "TARIWALLETLM" | run_sourced "$WLM" run_wizard >/dev/null 2>&1
+wlm_cfg="$(cat "$WLM/config.json" 2>/dev/null)"
+assert_eq "opt-in path: local_miner.enabled written true (#593)" "$(jq -r '.local_miner.enabled' <<<"$wlm_cfg")" "true"
+unset wlm_cfg
 
 echo "== unit: wizard — remote node branch is unchanged by the ask/write split (#502) =="
 # The remote-node prompts (host/RPC/ZMQ/auth) were only moved into wizard_ask_core, not touched —