Security hardening + code-review fixes

Outcome of a full multi-agent code review. Touches TLS, credential storage,
API versioning, networking correctness, concurrency/lifecycle, and the release
build. See CHANGELOG.md for the full list and the items to port to the iOS app.

Security
- Remove untrusted-TLS support: delete ServerTrustPolicy.AllowSelfSignedForHost
  and its trust-all X509TrustManager; drop the self-signed Settings toggle.
- Enforce HTTPS in normalizedBaseUrl (reject http + embedded credentials);
  add network_security_config (no cleartext, system CAs only) + allowBackup=false.
- Never persist passwords at rest: remember-me stores email only; no password
  pre-fill; clear creds on sign-out / when remember-me is off.
- Match CSRF host lookup to OkHttp's host parsing; stop leaking raw exception text.

Correctness
- Fix API versioning: hardcode v1/v3 per endpoint (docs Sec.4) instead of one
  broken global apiVersion; remove the version plumbing + Settings field.
- Treat "warning" status as success (committed write); fail-fast on a missing
  pagination cursor; close Response on cancellation; tolerant JSON parse; User-Agent.
- Firmware isCompatible fails closed + extra acknowledgment for a non-compatible image.

Concurrency / lifecycle
- Run network I/O on Dispatchers.IO; stale-result generation guards + rethrow
  CancellationException in all loads; host AppState in a ViewModel (survive config
  change); thread-safe cookie jar; reset/upgrade re-entry guard; wire list Retry.

Build
- Enable R8 minify+shrink with kotlinx.serialization keep rules; drop unused
  navigation-compose; add the missing .gitignore.

NOTE: built/verified by static review only (no Android SDK on the dev machine) —
run :app:assembleDebug and a release build before shipping.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/build.gradle.kts

@@ -31,7 +31,8 @@ android {
 
     buildTypes {
         release {
-            isMinifyEnabled = false
+            isMinifyEnabled = true
+            isShrinkResources = true
             proguardFiles(getDefaultProguardFile("proguard-android-optimize.txt"), "proguard-rules.pro")
         }
     }
@@ -51,7 +52,6 @@ dependencies {
     implementation("androidx.activity:activity-compose:1.9.2")
     implementation("androidx.lifecycle:lifecycle-viewmodel-compose:2.8.6")
     implementation("androidx.lifecycle:lifecycle-runtime-compose:2.8.6")
-    implementation("androidx.navigation:navigation-compose:2.8.1")
 
     implementation("com.squareup.okhttp3:okhttp:4.12.0")
     implementation("org.jetbrains.kotlinx:kotlinx-serialization-json:1.7.1")

app/proguard-rules.pro

@@ -1,4 +1,35 @@
-# Keep kotlinx.serialization metadata.
+# ─── kotlinx.serialization ───────────────────────────────────────────────────
+# R8 must not strip the generated $$serializer classes / serializer() methods or
+# the @Serializable config (ApiConfiguration, ServerTrustPolicy) fails to (de)serialize.
 -keepattributes *Annotation*, InnerClasses
 -dontnote kotlinx.serialization.**
 -keepclassmembers class kotlinx.serialization.json.** { *; }
+
+# Keep `serializer()` and the synthetic Companion for every @Serializable type.
+-if @kotlinx.serialization.Serializable class **
+-keepclassmembers class <1> {
+    static <1>$Companion Companion;
+}
+-if @kotlinx.serialization.Serializable class ** {
+    static **$* *;
+}
+-keepclassmembers class <2>$<3> {
+    kotlinx.serialization.KSerializer serializer(...);
+}
+
+# Keep this app's serializable models and their generated serializers explicitly.
+-keep,includedescriptorclasses class no.svorka.mcms.**$$serializer { *; }
+-keepclassmembers class no.svorka.mcms.** {
+    *** Companion;
+}
+-keepclasseswithmembers class no.svorka.mcms.** {
+    kotlinx.serialization.KSerializer serializer(...);
+}
+
+# ─── OkHttp / Okio ───────────────────────────────────────────────────────────
+# OkHttp ships its own consumer rules; silence the optional-dependency warnings.
+-dontwarn okhttp3.**
+-dontwarn okio.**
+-dontwarn org.conscrypt.**
+-dontwarn org.bouncycastle.**
+-dontwarn org.openjsse.**

app/src/main/AndroidManifest.xml

@@ -5,12 +5,14 @@
     <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE" />
 
     <application
-        android:allowBackup="true"
+        android:allowBackup="false"
         android:icon="@mipmap/ic_launcher"
         android:roundIcon="@mipmap/ic_launcher_round"
         android:label="@string/app_name"
+        android:networkSecurityConfig="@xml/network_security_config"
         android:supportsRtl="true"
-        android:theme="@style/Theme.MCMS">
+        android:theme="@style/Theme.MCMS"
+        android:usesCleartextTraffic="false">
         <activity
             android:name=".MainActivity"
             android:exported="true"

app/src/main/java/no/svorka/mcms/MainActivity.kt

@@ -1,9 +1,12 @@
 package no.svorka.mcms
 
+import android.app.Application
 import android.os.Bundle
 import androidx.activity.ComponentActivity
 import androidx.activity.compose.BackHandler
 import androidx.activity.compose.setContent
+import androidx.lifecycle.AndroidViewModel
+import androidx.lifecycle.viewmodel.compose.viewModel
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.padding
 import androidx.compose.material.icons.Icons
@@ -28,11 +31,20 @@ import no.svorka.mcms.core.OltStateDoc
 import no.svorka.mcms.core.OnuStateDoc
 import no.svorka.mcms.ui.*
 
+/**
+ * Holds [AppState] in a ViewModel so it (and its in-memory session/cookie jar)
+ * survives configuration changes — rotation/dark-mode no longer rebuilds the
+ * connection and bounces the user back to the login screen.
+ */
+class AppViewModel(application: Application) : AndroidViewModel(application) {
+    val state = AppState(application.applicationContext)
+}
+
 class MainActivity : ComponentActivity() {
     override fun onCreate(savedInstanceState: Bundle?) {
         super.onCreate(savedInstanceState)
         setContent {
-            val app = remember { AppState(applicationContext) }
+            val app = viewModel<AppViewModel>().state
             PonGoTheme { RootApp(app) }
         }
     }

app/src/main/java/no/svorka/mcms/core/ApiClient.kt

@@ -1,6 +1,8 @@
 package no.svorka.mcms.core
 
+import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.withContext
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonNull
 import kotlinx.serialization.json.buildJsonObject
@@ -17,13 +19,18 @@ import okhttp3.Response
 import java.io.IOException
 import java.util.concurrent.TimeUnit
 import javax.net.ssl.SSLException
-import kotlin.coroutines.resume
 import kotlin.coroutines.resumeWithException
 
+private fun Response.closeQuietly() { runCatching { close() } }
+
 /** Suspend bridge for an OkHttp call, with coroutine cancellation. */
 suspend fun Call.await(): Response = suspendCancellableCoroutine { cont ->
     enqueue(object : Callback {
-        override fun onResponse(call: Call, response: Response) { cont.resume(response) }
+        override fun onResponse(call: Call, response: Response) {
+            // If the continuation was already cancelled, resume() is a no-op and the
+            // Response would otherwise leak — close it via the onCancellation handler.
+            cont.resume(response) { _ -> response.closeQuietly() }
+        }
         override fun onFailure(call: Call, e: IOException) {
             if (!cont.isCancelled) cont.resumeWithException(e)
         }
@@ -32,9 +39,10 @@ suspend fun Call.await(): Response = suspendCancellableCoroutine { cont ->
 }
 
 /**
- * Transport for the MCMS REST API. Builds versioned requests, injects auth
- * headers, unwraps the `{status,data}` envelope, and maps status codes to
- * [ApiError]. Returns raw [JsonElement] trees that the repositories wrap.
+ * Transport for the MCMS REST API. Builds requests, injects auth headers, unwraps
+ * the `{status,data}` envelope, and maps status codes to [ApiError]. Returns raw
+ * [JsonElement] trees that the repositories wrap. Endpoint versions are fixed per
+ * endpoint in [McmsEndpoint.path].
  */
 class ApiClient(
     private val config: ApiConfiguration,
@@ -51,28 +59,30 @@ class ApiClient(
         ServerTrust.apply(this, config.trustPolicy)
     }.build()
 
-    suspend fun getElement(endpoint: McmsEndpoint, query: ApiQuery = ApiQuery.EMPTY, version: String? = null): JsonElement =
-        unwrapData(perform("GET", endpoint, query, null, version))
+    suspend fun getElement(endpoint: McmsEndpoint, query: ApiQuery = ApiQuery.EMPTY): JsonElement =
+        unwrapData(perform("GET", endpoint, query, null))
 
-    suspend fun getList(endpoint: McmsEndpoint, query: ApiQuery = ApiQuery.EMPTY, version: String? = null): List<JsonElement> =
-        getElement(endpoint, query, version).array ?: emptyList()
+    suspend fun getList(endpoint: McmsEndpoint, query: ApiQuery = ApiQuery.EMPTY): List<JsonElement> =
+        getElement(endpoint, query).array ?: emptyList()
 
     /** Raw body, bypassing the envelope — for the bare-array CPE helper. */
-    suspend fun getRaw(endpoint: McmsEndpoint, version: String? = null): JsonElement {
-        val resp = perform("GET", endpoint, ApiQuery.EMPTY, null, version)
-        return if (resp.body.isBlank()) JsonNull else MCMSJson.parseToJsonElement(resp.body)
+    suspend fun getRaw(endpoint: McmsEndpoint): JsonElement {
+        val resp = perform("GET", endpoint, ApiQuery.EMPTY, null)
+        if (resp.body.isBlank()) return JsonNull
+        return runCatching { MCMSJson.parseToJsonElement(resp.body) }
+            .getOrElse { throw ApiError.Decoding(it.message ?: "invalid JSON in response") }
     }
 
-    suspend fun send(method: String, endpoint: McmsEndpoint, body: JsonElement, wrapInData: Boolean = true, version: String? = null): JsonElement {
+    suspend fun send(method: String, endpoint: McmsEndpoint, body: JsonElement, wrapInData: Boolean = true): JsonElement {
         val payload = if (wrapInData) buildJsonObject { put("data", body) } else body
-        return unwrapData(perform(method, endpoint, ApiQuery.EMPTY, payload.toString(), version))
+        return unwrapData(perform(method, endpoint, ApiQuery.EMPTY, payload.toString()))
     }
 
-    suspend fun action(method: String, endpoint: McmsEndpoint, version: String? = null): JsonElement =
-        unwrapData(perform(method, endpoint, ApiQuery.EMPTY, null, version))
+    suspend fun action(method: String, endpoint: McmsEndpoint): JsonElement =
+        unwrapData(perform(method, endpoint, ApiQuery.EMPTY, null))
 
-    suspend fun delete(endpoint: McmsEndpoint, version: String? = null) {
-        perform("DELETE", endpoint, ApiQuery.EMPTY, null, version)
+    suspend fun delete(endpoint: McmsEndpoint) {
+        perform("DELETE", endpoint, ApiQuery.EMPTY, null)
     }
 
     /** Paginates by the `next` cursor; page size 100 (field guide §3.4). */
@@ -80,33 +90,37 @@ class ApiClient(
         endpoint: McmsEndpoint,
         baseQuery: ApiQuery = ApiQuery.EMPTY,
         pageLimit: Int = 100,
-        version: String? = null,
         idOf: (JsonElement) -> String?,
     ): List<JsonElement> {
         val all = mutableListOf<JsonElement>()
         var cursor: String? = null
         do {
             val q = baseQuery.copy(limit = pageLimit, next = cursor)
-            val page = getList(endpoint, q, version)
+            val page = getList(endpoint, q)
             all += page
-            cursor = if (page.size == pageLimit) page.lastOrNull()?.let(idOf) else null
+            cursor = if (page.size == pageLimit) {
+                // A full page with no usable cursor would silently truncate the result —
+                // fail loudly instead of returning a partial fleet as if it were complete.
+                page.lastOrNull()?.let(idOf)
+                    ?: throw ApiError.Decoding("pagination cursor missing on a full page; cannot guarantee a complete result")
+            } else null
         } while (cursor != null)
         return all
     }
 
     private data class Resp(val code: Int, val body: String)
 
-    private fun buildUrl(endpoint: McmsEndpoint, query: ApiQuery, version: String?): HttpUrl {
+    private fun buildUrl(endpoint: McmsEndpoint, query: ApiQuery): HttpUrl {
         val base = config.baseUrl.toHttpUrlOrNull() ?: throw ApiError.InvalidUrl
         val builder = base.newBuilder()
         // Raw ids; addPathSegments encodes once and keeps ':' in MAC ids raw.
-        builder.addPathSegments(endpoint.path(version ?: config.apiVersion).removePrefix("/"))
+        builder.addPathSegments(endpoint.path().removePrefix("/"))
         for ((name, value) in query.items()) builder.addQueryParameter(name, value)
         return builder.build()
     }
 
-    private suspend fun perform(method: String, endpoint: McmsEndpoint, query: ApiQuery, bodyJson: String?, version: String?): Resp {
-        val url = buildUrl(endpoint, query, version)
+    private suspend fun perform(method: String, endpoint: McmsEndpoint, query: ApiQuery, bodyJson: String?): Resp {
+        val url = buildUrl(endpoint, query)
         val reqBody = when {
             bodyJson != null -> bodyJson.toRequestBody(jsonMedia)
             method == "POST" || method == "PUT" || method == "PATCH" -> ByteArray(0).toRequestBody()
@@ -114,21 +128,26 @@ class ApiClient(
         }
         val builder = Request.Builder().url(url)
             .header("Accept", "application/json")
+            .header("User-Agent", USER_AGENT)   // §3.1: an empty UA is rejected
             .header("Referer", config.refererValue)
             .method(method, reqBody)
         if (bodyJson != null) builder.header("Content-Type", "application/json")
         if (method != "GET") session.csrfToken()?.let { builder.header("X-CSRFToken", it) }
+        val request = builder.build()
 
-        val response = try {
-            client.newCall(builder.build()).await()
-        } catch (e: SSLException) {
-            throw ApiError.ServerTrust
-        } catch (e: IOException) {
-            throw ApiError.Transport(e.message ?: "request failed")
+        // The blocking socket read (and connect) runs off the main thread; the
+        // status mapping + onAuthExpired callback resume on the caller (Main) so the
+        // Compose-state write in onAuthExpired stays on the main thread.
+        val (code, body) = withContext(Dispatchers.IO) {
+            val response = try {
+                client.newCall(request).await()
+            } catch (e: SSLException) {
+                throw ApiError.ServerTrust
+            } catch (e: IOException) {
+                throw ApiError.Transport(e.message ?: "request failed")
+            }
+            response.use { it.code to (it.body?.string() ?: "") }
         }
-        val code = response.code
-        val body = response.body?.string() ?: ""
-        response.close()
 
         if (code !in 200..299) {
             val details = runCatching { MCMSJson.parseToJsonElement(body)["details"] }.getOrNull()
@@ -141,11 +160,18 @@ class ApiClient(
 
     private fun unwrapData(resp: Resp): JsonElement {
         if (resp.body.isBlank()) return JsonNull
-        val root = MCMSJson.parseToJsonElement(resp.body)
+        val root = runCatching { MCMSJson.parseToJsonElement(resp.body) }
+            .getOrElse { throw ApiError.Decoding(it.message ?: "invalid JSON in response") }
         val status = root["status"].string
-        if (status != null && !status.equals("success", ignoreCase = true)) {
+        // MCMS treats "warning" as success (the write committed; only a schema
+        // mismatch is reported in `details`) — see MCMS_API.md §3.5.
+        if (status != null && !status.equals("success", ignoreCase = true) && !status.equals("warning", ignoreCase = true)) {
             throw ApiError.ApiFailure(root["details"])
         }
         return root["data"] ?: JsonNull
     }
+
+    private companion object {
+        const val USER_AGENT = "PONGo-Android/1.0"
+    }
 }

app/src/main/java/no/svorka/mcms/core/ApiConfiguration.kt

@@ -1,33 +1,34 @@
 package no.svorka.mcms.core
 
 import kotlinx.serialization.Serializable
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import java.net.URI
 
 /** How to evaluate the server's TLS certificate. */
 @Serializable
 sealed class ServerTrustPolicy {
-    /** Default platform trust evaluation. */
+    /** Default platform trust evaluation (system CA store). The only default. */
     @Serializable
     data object System : ServerTrustPolicy()
 
-    /** Accept any certificate presented by this exact host (self-signed lab boxes). */
-    @Serializable
-    data class AllowSelfSignedForHost(val host: String) : ServerTrustPolicy()
-
-    /** Trust only if the leaf public-key SHA-256 (base64) matches one of these. */
+    /**
+     * Trust only if the leaf public-key SHA-256 (base64) matches one of these.
+     * This is the secure way to talk to a known box with a private/self-signed
+     * cert: pin its key rather than disabling validation. No UI wires this up
+     * yet — set it programmatically if a deployment needs it.
+     */
     @Serializable
     data class PinPublicKeySha256(val pins: List<String>, val host: String) : ServerTrustPolicy()
 }
 
 /**
  * Connection configuration for the MCMS REST API. URL-driven so the same build
- * works direct or via reverse proxy. `baseUrl` includes the `/api` prefix, e.g.
- * `https://mcms.lab.svorka.net/api`.
+ * works direct or via reverse proxy. `baseUrl` includes the `/api` prefix and is
+ * always HTTPS, e.g. `https://mcms.lab.svorka.net/api`.
  */
 @Serializable
 data class ApiConfiguration(
     val baseUrl: String,
-    val apiVersion: String = "v1",
     val databaseId: String? = null,
     val refererOverride: String? = null,
     val sessionCookieName: String = "sessionid",
@@ -36,24 +37,36 @@ data class ApiConfiguration(
     val timeoutSeconds: Long = 30,
 ) {
     val refererValue: String get() = refererOverride ?: baseUrl
-    val host: String? get() = runCatching { URI(baseUrl).host }.getOrNull()
+
+    /**
+     * Host as OkHttp parses it — must match the cookie jar's `HttpUrl.host` so the
+     * CSRF/session cookie lookup in [SessionStore] resolves against the same key.
+     */
+    val host: String? get() = baseUrl.toHttpUrlOrNull()?.host
 
     companion object {
         /**
-         * Normalises a user-entered URL: requires scheme + host, trims a trailing
-         * slash, and defaults the path to `/api` when none is given. Returns null
-         * if it isn't a usable URL.
+         * Normalises a user-entered URL and **enforces HTTPS**: defaults a missing
+         * scheme to `https`, rejects anything that isn't `https`, rejects embedded
+         * credentials, trims a trailing slash, and defaults the path to `/api` when
+         * none is given. Returns null if it isn't a usable HTTPS URL.
          */
         fun normalizedBaseUrl(raw: String): String? {
             val trimmed = raw.trim()
-            val uri = runCatching { URI(trimmed) }.getOrNull() ?: return null
-            val scheme = uri.scheme ?: return null
+            if (trimmed.isEmpty()) return null
+            // Default to https:// when the user omits the scheme (e.g. "mcms.lab/api").
+            val withScheme =
+                if (Regex("^[a-zA-Z][a-zA-Z0-9+.-]*://").containsMatchIn(trimmed)) trimmed
+                else "https://$trimmed"
+            val uri = runCatching { URI(withScheme) }.getOrNull() ?: return null
+            if (uri.scheme?.lowercase() != "https") return null   // TLS only
+            if (uri.userInfo != null) return null                 // no credentials in the URL
             val host = uri.host?.takeIf { it.isNotEmpty() } ?: return null
             var path = uri.path ?: ""
             while (path.endsWith("/")) path = path.dropLast(1)
             if (path.isEmpty()) path = "/api"
             val port = if (uri.port >= 0) ":${uri.port}" else ""
-            return "$scheme://$host$port$path"
+            return "https://$host$port$path"
         }
     }
 }

app/src/main/java/no/svorka/mcms/core/Firmware.kt

@@ -17,12 +17,20 @@ class FirmwareFile(val raw: JsonElement) {
     val sizeBytes: Double? get() = raw["length"].double
     val uploadDate: String? get() = raw["uploadDate"].string
 
-    /** Manufacturer must match the ONU vendor and the equipment id must be an
-     *  exact (not substring) member of Compatible Model. */
+    /**
+     * Fail CLOSED: a file counts as compatible only when we can positively confirm
+     * it. The ONU's vendor and equipment id must be known, the file must declare a
+     * matching manufacturer, and the equipment id must be an exact (not substring)
+     * member of Compatible Model. Unknown identity or missing metadata ⇒ not
+     * compatible-by-default (such files are still reachable via "Show all firmware",
+     * but staging one requires an explicit extra acknowledgment in the UI).
+     * Mis-flashing the wrong image can brick an ONU, so we never guess.
+     */
     fun isCompatible(vendor: String?, equipmentId: String?): Boolean {
-        val mfg = manufacturer
-        if (vendor != null && !mfg.isNullOrEmpty() && !mfg.equals(vendor, ignoreCase = true)) return false
-        if (equipmentId == null || models.isEmpty()) return true
+        if (vendor == null || equipmentId == null) return false
+        val mfg = manufacturer ?: return false
+        if (!mfg.equals(vendor, ignoreCase = true)) return false
+        if (models.isEmpty()) return false
         return models.any { it.equals(equipmentId, ignoreCase = true) }
     }
 }

app/src/main/java/no/svorka/mcms/core/McmsEndpoint.kt

@@ -5,6 +5,10 @@ package no.svorka.mcms.core
  * URL builder in [ApiClient] percent-encodes the whole path exactly once.
  * Pre-encoding double-encoded MAC colons (`:` → `%3A` → `%253A`), which MCMS
  * rejected as an invalid id.
+ *
+ * The `/v1` vs `/v3` prefix is fixed per endpoint per docs/MCMS_API.md §4 — the
+ * two versions serve different resources and are NOT interchangeable, so there is
+ * no global version switch. Endpoints not in the §4 table are marked "inferred".
  */
 sealed class McmsEndpoint {
     data object Authenticate : McmsEndpoint()
@@ -37,38 +41,35 @@ sealed class McmsEndpoint {
     data object OnuFirmwareFiles : McmsEndpoint()
     data class OnuCpe(val id: String) : McmsEndpoint()   // versionless web helper
 
-    fun path(version: String): String {
-        val v = "/$version"
-        return when (this) {
-            Authenticate -> "$v/users/authenticate/"
-            Logout -> "$v/users/logout/"
-            DatabaseSelection -> "$v/databases/selection/"
-            Version -> "$v/ponmgr/version/"
+    fun path(): String = when (this) {
+        Authenticate -> "/v1/users/authenticate/"            // §4
+        Logout -> "/v1/users/logout/"                        // §4
+        DatabaseSelection -> "/v1/databases/selection/"      // §4
+        Version -> "/v1/ponmgr/version/"                     // inferred (probe)
 
-            ControllerConfigs -> "$v/controllers/configs/"
-            is ControllerConfig -> "$v/controllers/configs/$id/"
-            is ControllerStats -> "$v/controllers/stats/$id/"
-            is ControllerLogs -> "$v/controllers/logs/$id/"
+        ControllerConfigs -> "/v1/controllers/configs/"      // inferred (non-fatal, runCatching)
+        is ControllerConfig -> "/v1/controllers/configs/$id/"
+        is ControllerStats -> "/v1/controllers/stats/$id/"
+        is ControllerLogs -> "/v1/controllers/logs/$id/"
 
-            OltConfigs -> "$v/olts/configs/"
-            is OltConfig -> "$v/olts/configs/$id/"
-            OltStates -> "$v/olts/states/"
-            is OltState -> "$v/olts/states/$id/"
-            is OltStats -> "$v/olts/stats/$id/"
-            is OltLogs -> "$v/olts/logs/$id/"
-            is OltReset -> "$v/olts/$id/reset/"
+        OltConfigs -> "/v3/olts/configs/"                    // inferred: configs-list family is v3 (cf. ONU)
+        is OltConfig -> "/v1/olts/configs/$id/"              // inferred: single config is v1 (cf. ONU)
+        OltStates -> "/v3/olts/states/"                      // §4
+        is OltState -> "/v3/olts/states/$id/"                // inferred: states family is v3
+        is OltStats -> "/v1/olts/stats/$id/"                 // §4
+        is OltLogs -> "/v1/olts/logs/$id/"                   // §4
+        is OltReset -> "/v1/olts/$id/reset/"                 // inferred (prior default)
 
-            OnuConfigs -> "$v/onus/configs/"
-            is OnuConfig -> "$v/onus/configs/$id/"
-            OnuStates -> "$v/onus/states/"
-            is OnuState -> "$v/onus/states/$id/"
-            is OnuStats -> "$v/onus/stats/$id/"
-            is OnuLogs -> "$v/onus/logs/$id/"
-            OnuAlarmHistories -> "$v/onus/alarm-histories/"
-            OnuCpeStates -> "$v/onus/cpe-states/"
-            is OnuReset -> "$v/onus/$id/reset/"
-            OnuFirmwareFiles -> "$v/files/onu-firmware/"
-            is OnuCpe -> "/cpe/onu/$id/"
-        }
+        OnuConfigs -> "/v3/onus/configs/"                    // §4
+        is OnuConfig -> "/v1/onus/configs/$id/"              // §4
+        OnuStates -> "/v3/onus/states/"                      // §4
+        is OnuState -> "/v3/onus/states/$id/"                // §4
+        is OnuStats -> "/v1/onus/stats/$id/"                 // §4
+        is OnuLogs -> "/v1/onus/logs/$id/"                   // §4
+        OnuAlarmHistories -> "/v1/onus/alarm-histories/"     // inferred (non-fatal, runCatching)
+        OnuCpeStates -> "/v1/onus/cpe-states/"               // §4
+        is OnuReset -> "/v1/onus/$id/reset/"                 // inferred (prior default)
+        OnuFirmwareFiles -> "/v1/files/onu-firmware/"        // §4
+        is OnuCpe -> "/cpe/onu/$id/"                          // versionless web helper
     }
 }

app/src/main/java/no/svorka/mcms/core/Networking.kt

@@ -4,18 +4,18 @@ import okhttp3.Cookie
 import okhttp3.CookieJar
 import okhttp3.HttpUrl
 import okhttp3.OkHttpClient
-import java.security.SecureRandom
-import java.security.cert.X509Certificate
-import javax.net.ssl.SSLContext
-import javax.net.ssl.X509TrustManager
 
 /**
  * In-memory cookie jar (per host), so we can both replay cookies and read the
  * CSRF cookie value. Sessions are discarded on logout/app-kill.
+ *
+ * OkHttp invokes the jar from its background dispatcher threads, so every access
+ * to [store] is synchronised on this instance.
  */
 class SessionCookieJar : CookieJar {
     private val store = mutableMapOf<String, MutableList<Cookie>>()
 
+    @Synchronized
     override fun saveFromResponse(url: HttpUrl, cookies: List<Cookie>) {
         val list = store.getOrPut(url.host) { mutableListOf() }
         cookies.forEach { c ->
@@ -24,15 +24,19 @@ class SessionCookieJar : CookieJar {
         }
     }
 
+    @Synchronized
     override fun loadForRequest(url: HttpUrl): List<Cookie> =
         store[url.host]?.filter { it.matches(url) } ?: emptyList()
 
+    @Synchronized
     fun valueMatching(host: String, base: String): String? =
         store[host]?.firstOrNull { matches(it.name, base) }?.value
 
+    @Synchronized
     fun hasCookie(host: String, base: String): Boolean =
         store[host]?.any { matches(it.name, base) } == true
 
+    @Synchronized
     fun clear(host: String) { store.remove(host) }
 
     // Modern MCMS builds emit `__Host-`/`__Secure-` prefixed cookies; accept either.
@@ -64,21 +68,9 @@ class SessionStore(private val config: ApiConfiguration) {
 object ServerTrust {
     fun apply(builder: OkHttpClient.Builder, policy: ServerTrustPolicy) {
         when (policy) {
-            is ServerTrustPolicy.System -> Unit // default platform trust
-            is ServerTrustPolicy.AllowSelfSignedForHost -> {
-                // Accept ANY certificate, but the hostname verifier restricts it to
-                // the one allowed host (matches the iOS self-signed escape hatch).
-                val trustAll = object : X509TrustManager {
-                    override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
-                    override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
-                    override fun getAcceptedIssuers(): Array<X509Certificate> = emptyArray()
-                }
-                val ctx = SSLContext.getInstance("TLS").apply {
-                    init(null, arrayOf<javax.net.ssl.TrustManager>(trustAll), SecureRandom())
-                }
-                builder.sslSocketFactory(ctx.socketFactory, trustAll)
-                builder.hostnameVerifier { hostname, _ -> hostname.equals(policy.host, ignoreCase = true) }
-            }
+            // Default platform trust (system CA store). Untrusted/self-signed
+            // certificates are intentionally NOT accepted — pin instead.
+            is ServerTrustPolicy.System -> Unit
             is ServerTrustPolicy.PinPublicKeySha256 -> {
                 val pinner = okhttp3.CertificatePinner.Builder().apply {
                     policy.pins.forEach { add(policy.host, "sha256/$it") }

app/src/main/java/no/svorka/mcms/ui/AppState.kt

@@ -50,20 +50,19 @@ class AppState(context: Context) {
     }
 
     val savedEmail: String? get() = keychain.get("email")
-    val savedPassword: String? get() = keychain.get("password")
 
     suspend fun signIn(email: String, password: String, remember: Boolean) {
         val conn = connection ?: throw ApiError.Transport("No connection configured")
         conn.auth.login(email, password)
-        if (remember) {
-            keychain.set("email", email)
-            keychain.set("password", password)
-        }
+        // Remember-me persists the email only; the password is never stored at rest.
+        if (remember) keychain.set("email", email) else keychain.delete("email")
+        keychain.delete("password")   // clear any password persisted by an older build
         isAuthenticated = true
     }
 
     suspend fun signOut() {
-        connection?.auth?.logout()
+        runCatching { connection?.auth?.logout() }
+        keychain.delete("password")   // defence-in-depth: never leave a password behind
         isAuthenticated = false
     }
 

app/src/main/java/no/svorka/mcms/ui/AuthScreens.kt

@@ -16,13 +16,14 @@ import androidx.compose.ui.text.input.PasswordVisualTransformation
 import androidx.compose.ui.unit.dp
 import kotlinx.coroutines.launch
 import no.svorka.mcms.core.ApiConfiguration
-import no.svorka.mcms.core.ServerTrustPolicy
 
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
 fun LoginScreen(app: AppState, onOpenSettings: () -> Unit) {
     var email by rememberSaveable { mutableStateOf(app.savedEmail ?: "") }
-    var password by rememberSaveable { mutableStateOf(app.savedPassword ?: "") }
+    // Plain remember (not rememberSaveable) and never pre-filled: keep the password
+    // out of the on-disk saved-instance Bundle and off a potentially shared screen.
+    var password by remember { mutableStateOf("") }
     var remember by rememberSaveable { mutableStateOf(true) }
     var phase by remember { mutableStateOf<LoadPhase>(LoadPhase.Idle) }
     val scope = rememberCoroutineScope()
@@ -79,11 +80,7 @@ fun LoginScreen(app: AppState, onOpenSettings: () -> Unit) {
 @Composable
 fun SettingsScreen(app: AppState, initialSetup: Boolean, onClose: () -> Unit) {
     var url by rememberSaveable { mutableStateOf(app.configuration?.baseUrl ?: "https://") }
-    var apiVersion by rememberSaveable { mutableStateOf(app.configuration?.apiVersion ?: "v1") }
     var dbId by rememberSaveable { mutableStateOf(app.configuration?.databaseId ?: "") }
-    var allowSelfSigned by rememberSaveable {
-        mutableStateOf(app.configuration?.trustPolicy is ServerTrustPolicy.AllowSelfSignedForHost)
-    }
     var testPhase by remember { mutableStateOf<LoadPhase>(LoadPhase.Idle) }
     var testResult by remember { mutableStateOf<String?>(null) }
     var saveError by remember { mutableStateOf<String?>(null) }
@@ -91,15 +88,9 @@ fun SettingsScreen(app: AppState, initialSetup: Boolean, onClose: () -> Unit) {
 
     fun makeConfig(): ApiConfiguration? {
         val base = ApiConfiguration.normalizedBaseUrl(url) ?: return null
-        val host = ApiConfiguration(baseUrl = base).host
-        val policy = if (allowSelfSigned && host != null) ServerTrustPolicy.AllowSelfSignedForHost(host)
-        else ServerTrustPolicy.System
-        return ApiConfiguration(
-            baseUrl = base, apiVersion = apiVersion.trim(),
-            databaseId = dbId.ifBlank { null }, trustPolicy = policy,
-        )
+        return ApiConfiguration(baseUrl = base, databaseId = dbId.ifBlank { null })
     }
-    val canSave = ApiConfiguration.normalizedBaseUrl(url) != null && apiVersion.isNotBlank()
+    val canSave = ApiConfiguration.normalizedBaseUrl(url) != null
 
     Scaffold(topBar = {
         TopAppBar(
@@ -110,7 +101,7 @@ fun SettingsScreen(app: AppState, initialSetup: Boolean, onClose: () -> Unit) {
                     enabled = canSave,
                     onClick = {
                         val config = makeConfig()
-                        if (config == null) { saveError = "Enter a valid URL including scheme (https://)." }
+                        if (config == null) { saveError = "Enter a valid https:// URL." }
                         else { saveError = null; app.configure(config); if (!initialSetup) onClose() }
                     },
                 ) { Text("Save") }
@@ -122,24 +113,15 @@ fun SettingsScreen(app: AppState, initialSetup: Boolean, onClose: () -> Unit) {
             verticalArrangement = Arrangement.spacedBy(12.dp),
         ) {
             OutlinedTextField(
-                value = url, onValueChange = { url = it }, label = { Text("Server URL") }, singleLine = true,
-                supportingText = { Text("Host or origin, e.g. https://mcms.lab.svorka.net — “/api” is appended automatically.") },
+                value = url, onValueChange = { url = it }, label = { Text("Server URL (HTTPS)") }, singleLine = true,
+                supportingText = { Text("Host or origin, e.g. mcms.lab.svorka.net — HTTPS is required and “/api” is appended automatically.") },
                 keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri),
                 modifier = Modifier.fillMaxWidth(),
             )
-            OutlinedTextField(
-                value = apiVersion, onValueChange = { apiVersion = it }, label = { Text("API version") }, singleLine = true,
-                modifier = Modifier.fillMaxWidth(),
-            )
             OutlinedTextField(
                 value = dbId, onValueChange = { dbId = it }, label = { Text("Database ID (optional)") }, singleLine = true,
                 modifier = Modifier.fillMaxWidth(),
             )
-            Row(verticalAlignment = Alignment.CenterVertically) {
-                Switch(checked = allowSelfSigned, onCheckedChange = { allowSelfSigned = it })
-                Spacer(Modifier.width(8.dp))
-                Text("Allow self-signed certificate")
-            }
 
             Button(
                 enabled = canSave && testPhase != LoadPhase.Loading,

app/src/main/java/no/svorka/mcms/ui/DashboardScreen.kt

@@ -15,6 +15,7 @@ import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.delay
 import no.svorka.mcms.core.*
 
@@ -31,30 +32,46 @@ class DashboardModel(private val connection: McmsConnection) {
     var lasersOff by mutableStateOf<List<OltStateDoc>>(emptyList())
     var opticalAvailable by mutableStateOf(false)
 
+    // Monotonic load id: a slower earlier load must not overwrite a newer one's data.
+    private var loadGen = 0
+
     suspend fun load(extraStats: Boolean) {
+        val gen = ++loadGen
         phase = LoadPhase.Loading
         try {
+            // Fetch into locals, then commit atomically once we confirm we're still current.
             val olts = connection.olt.allStates()
-            oltCount = olts.size
             val reg = OltRepository.registrationMap(olts)
-            onuTotal = reg.size
-            onuCounts = reg.values.groupingBy { it }.eachCount().toList().sortedByDescending { it.second }
-            totalDownBps = olts.mapNotNull { it.txRateBps }.sum()
-            totalUpBps = olts.mapNotNull { it.rxRateBps }.sum()
-            lasersOff = olts.filter { it.isLaserOff }
-            controllerCount = runCatching { connection.controller.allConfigs().size }.getOrDefault(0)
+            val counts = reg.values.groupingBy { it }.eachCount().toList().sortedByDescending { it.second }
+            val down = olts.mapNotNull { it.txRateBps }.sum()
+            val up = olts.mapNotNull { it.rxRateBps }.sum()
+            val lasers = olts.filter { it.isLaserOff }
+            val ctrl = runCatching { connection.controller.allConfigs().size }.getOrDefault(0)
             val alarms = runCatching { connection.onu.alarmHistories() }.getOrDefault(emptyList())
-            severityCounts = alarms.groupingBy { it.severity }.eachCount().toList().sortedBy { it.first.rank }
-            if (extraStats) {
+            val sev = alarms.groupingBy { it.severity }.eachCount().toList().sortedBy { it.first.rank }
+            val (optAvail, abnormal) = if (extraStats) {
                 val onus = connection.onu.allStates()
-                opticalAvailable = onus.any { it.rxOpticalDBm != null }
-                abnormalRx = onus.filter { val rx = it.rxOpticalDBm; rx != null && (rx < -28 || rx > -10) }
+                onus.any { it.rxOpticalDBm != null } to
+                    onus.filter { val rx = it.rxOpticalDBm; rx != null && (rx < -28 || rx > -10) }
             } else {
-                opticalAvailable = false; abnormalRx = emptyList()
+                false to emptyList<OnuStateDoc>()
             }
+            if (gen != loadGen) return   // a newer load superseded us — drop stale results
+            oltCount = olts.size
+            onuTotal = reg.size
+            onuCounts = counts
+            totalDownBps = down
+            totalUpBps = up
+            lasersOff = lasers
+            controllerCount = ctrl
+            severityCounts = sev
+            opticalAvailable = optAvail
+            abnormalRx = abnormal
             phase = LoadPhase.Loaded
+        } catch (e: CancellationException) {
+            throw e   // cancellation is not a failure
         } catch (e: Throwable) {
-            phase = LoadPhase.Failed(e.uiMessage())
+            if (gen == loadGen) phase = LoadPhase.Failed(e.uiMessage())
         }
     }
 }
@@ -102,7 +119,8 @@ fun DashboardScreen(
         Box(Modifier.padding(padding).fillMaxSize()) {
             when (val p = model.phase) {
                 is LoadPhase.Idle, is LoadPhase.Loading -> if (model.onuTotal == 0 && model.oltCount == 0) LoadingView("Loading network…") else content(model, openAbnormalRx, openLaserOff)
-                is LoadPhase.Failed -> ErrorState(p.message)
+                // Keep showing the last good data if a background refresh fails.
+                is LoadPhase.Failed -> if (model.onuTotal == 0 && model.oltCount == 0) ErrorState(p.message) else content(model, openAbnormalRx, openLaserOff)
                 is LoadPhase.Loaded -> content(model, openAbnormalRx, openLaserOff)
             }
         }

app/src/main/java/no/svorka/mcms/ui/OltScreens.kt

@@ -12,6 +12,7 @@ import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.launch
 import no.svorka.mcms.core.*
 
@@ -27,16 +28,23 @@ class OltListModel(private val connection: McmsConnection) {
             return olts.filter { it.id.contains(q, true) || (it.resolvedName?.contains(q, true) == true) }
         }
 
+    private var loadGen = 0
+
     suspend fun load() {
+        val gen = ++loadGen
         phase = LoadPhase.Loading
         try {
             val fetched = connection.olt.allStates()
             val names = runCatching { connection.olt.nameMap() }.getOrDefault(emptyMap())
             fetched.forEach { it.resolvedName = names[it.id] }
-            olts = fetched.sortedBy { it.displayName.lowercase() }
+            val sorted = fetched.sortedBy { it.displayName.lowercase() }
+            if (gen != loadGen) return
+            olts = sorted
             phase = LoadPhase.Loaded
+        } catch (e: CancellationException) {
+            throw e
         } catch (e: Throwable) {
-            phase = LoadPhase.Failed(e.uiMessage())
+            if (gen == loadGen) phase = LoadPhase.Failed(e.uiMessage())
         }
     }
 }
@@ -45,6 +53,7 @@ class OltListModel(private val connection: McmsConnection) {
 @Composable
 fun OltListScreen(connection: McmsConnection, openOlt: (String, String) -> Unit) {
     val model = remember(connection) { OltListModel(connection) }
+    val scope = rememberCoroutineScope()
     LaunchedEffect(connection) { if (model.phase is LoadPhase.Idle) model.load() }
 
     Scaffold(topBar = { TopAppBar(title = { Text("OLTs") }) }) { padding ->
@@ -56,7 +65,7 @@ fun OltListScreen(connection: McmsConnection, openOlt: (String, String) -> Unit)
             )
             when (val p = model.phase) {
                 is LoadPhase.Idle, is LoadPhase.Loading -> if (model.olts.isEmpty()) LoadingView("Loading OLTs…") else OltList(model.filtered, openOlt)
-                is LoadPhase.Failed -> ErrorState(p.message)
+                is LoadPhase.Failed -> ErrorState(p.message) { scope.launch { model.load() } }
                 is LoadPhase.Loaded -> OltList(model.filtered, openOlt)
             }
         }
@@ -92,16 +101,30 @@ class OltDetailModel(private val connection: McmsConnection, val oltId: String)
     var actionMessage by mutableStateOf<String?>(null)
     var busy by mutableStateOf(false)
 
+    private var loadGen = 0
+
     suspend fun load() {
+        val gen = ++loadGen
         phase = LoadPhase.Loading
-        try { olt = connection.olt.state(oltId); phase = LoadPhase.Loaded }
-        catch (e: Throwable) { phase = LoadPhase.Failed(e.uiMessage()) }
+        try {
+            val v = connection.olt.state(oltId)
+            if (gen != loadGen) return
+            olt = v
+            phase = LoadPhase.Loaded
+        } catch (e: CancellationException) {
+            throw e
+        } catch (e: Throwable) {
+            if (gen == loadGen) phase = LoadPhase.Failed(e.uiMessage())
+        }
     }
 
     suspend fun reset() {
+        if (busy) return
         busy = true; actionMessage = null
-        try { connection.olt.reset(oltId); actionMessage = "Reset requested." } catch (e: Throwable) { actionMessage = e.uiMessage() }
-        busy = false
+        try { connection.olt.reset(oltId); actionMessage = "Reset requested." }
+        catch (e: CancellationException) { throw e }
+        catch (e: Throwable) { actionMessage = e.uiMessage() }
+        finally { busy = false }
     }
 }
 

app/src/main/java/no/svorka/mcms/ui/OnuScreens.kt

@@ -16,6 +16,7 @@ import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
+import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.launch
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonElement
@@ -39,17 +40,24 @@ class OnuListModel(private val connection: McmsConnection) {
             }
         }
 
+    private var loadGen = 0
+
     suspend fun load() {
+        val gen = ++loadGen
         phase = LoadPhase.Loading
         try {
             val fetched = connection.onu.allStates()
             val reg = runCatching { connection.olt.registrationMap() }.getOrDefault(emptyMap())
             val names = runCatching { connection.onu.nameMap() }.getOrDefault(emptyMap())
             fetched.forEach { it.resolvedLifecycle = reg[it.id]; it.resolvedName = names[it.id] }
-            onus = fetched.sortedBy { it.displayName.lowercase() }
+            val sorted = fetched.sortedBy { it.displayName.lowercase() }
+            if (gen != loadGen) return
+            onus = sorted
             phase = LoadPhase.Loaded
+        } catch (e: CancellationException) {
+            throw e
         } catch (e: Throwable) {
-            phase = LoadPhase.Failed(e.uiMessage())
+            if (gen == loadGen) phase = LoadPhase.Failed(e.uiMessage())
         }
     }
 }
@@ -58,6 +66,7 @@ class OnuListModel(private val connection: McmsConnection) {
 @Composable
 fun OnuListScreen(connection: McmsConnection, openOnu: (String) -> Unit) {
     val model = remember(connection) { OnuListModel(connection) }
+    val scope = rememberCoroutineScope()
     LaunchedEffect(connection) { if (model.phase is LoadPhase.Idle) model.load() }
 
     Scaffold(topBar = { TopAppBar(title = { Text("ONUs") }) }) { padding ->
@@ -69,7 +78,7 @@ fun OnuListScreen(connection: McmsConnection, openOnu: (String) -> Unit) {
             )
             when (val p = model.phase) {
                 is LoadPhase.Idle, is LoadPhase.Loading -> if (model.onus.isEmpty()) LoadingView("Loading ONUs…") else OnuList(model.filtered, openOnu)
-                is LoadPhase.Failed -> ErrorState(p.message) { /* retry */ }
+                is LoadPhase.Failed -> ErrorState(p.message) { scope.launch { model.load() } }
                 is LoadPhase.Loaded -> OnuList(model.filtered, openOnu)
             }
         }
@@ -116,40 +125,56 @@ class OnuDetailModel(private val connection: McmsConnection, val onuId: String)
     var actionMessage by mutableStateOf<String?>(null)
     var busy by mutableStateOf(false)
 
+    // Monotonic load id so a slow fetch for a tab the user already left can't
+    // clobber the newer tab's phase/data.
+    private var loadGen = 0
+
     suspend fun loadTab() { phase = LoadPhase.Loading; reload() }
     suspend fun refresh() { reload() }
     private suspend fun reload() {
+        val gen = ++loadGen
         try {
             when (tab) {
-                0 -> liveState = connection.onu.state(onuId)
-                1 -> cpes = connection.onu.cpes(onuId)
-                2 -> logs = connection.onu.logs(onuId)
-                3 -> config = connection.onu.config(onuId)
+                0 -> { val v = connection.onu.state(onuId); if (gen != loadGen) return; liveState = v }
+                1 -> { val v = connection.onu.cpes(onuId); if (gen != loadGen) return; cpes = v }
+                2 -> { val v = connection.onu.logs(onuId); if (gen != loadGen) return; logs = v }
+                3 -> { val v = connection.onu.config(onuId); if (gen != loadGen) return; config = v }
             }
+            if (gen != loadGen) return
             phase = LoadPhase.Loaded
+        } catch (e: CancellationException) {
+            throw e
         } catch (e: Throwable) {
-            phase = LoadPhase.Failed(e.uiMessage())
+            if (gen == loadGen) phase = LoadPhase.Failed(e.uiMessage())
         }
     }
 
     suspend fun loadFirmware() {
         firmwareError = null
-        try { firmwareFiles = connection.onu.firmwareFiles() } catch (e: Throwable) { firmwareError = e.uiMessage() }
+        try { firmwareFiles = connection.onu.firmwareFiles() }
+        catch (e: CancellationException) { throw e }
+        catch (e: Throwable) { firmwareError = e.uiMessage() }
     }
 
     suspend fun reset() {
+        if (busy) return
         busy = true; actionMessage = null
-        try { connection.onu.reset(onuId); actionMessage = "Reset requested." } catch (e: Throwable) { actionMessage = e.uiMessage() }
-        busy = false
+        try { connection.onu.reset(onuId); actionMessage = "Reset requested." }
+        catch (e: CancellationException) { throw e }
+        catch (e: Throwable) { actionMessage = e.uiMessage() }
+        finally { busy = false }
     }
 
     suspend fun upgrade(file: FirmwareFile) {
+        if (busy) return
         busy = true; actionMessage = null
         try {
             val slot = connection.onu.upgradeFirmware(onuId, file)
             actionMessage = "Firmware ${file.version ?: "image"} staged to bank $slot. The ONU starts it after its next reboot."
-        } catch (e: Throwable) { actionMessage = e.uiMessage() }
-        busy = false
+        }
+        catch (e: CancellationException) { throw e }
+        catch (e: Throwable) { actionMessage = e.uiMessage() }
+        finally { busy = false }
     }
 }
 
@@ -438,12 +463,32 @@ private fun FirmwareDialog(model: OnuDetailModel, onDismiss: () -> Unit) {
     )
 
     pending?.let { file ->
+        val isCompatible = file.isCompatible(state?.vendor, state?.equipmentId)
+        var ack by remember(file) { mutableStateOf(false) }
         AlertDialog(
             onDismissRequest = { pending = null },
             title = { Text("Stage firmware?") },
-            text = { Text("Stage ${file.version ?: "this image"} on ${model.onuId} in the standby bank. It becomes active after the ONU's next reboot — this is service-affecting.") },
+            text = {
+                Column {
+                    Text("Stage ${file.version ?: "this image"} on ${model.onuId} in the standby bank. It becomes active after the ONU's next reboot — this is service-affecting.")
+                    if (!isCompatible) {
+                        Spacer(Modifier.height(12.dp))
+                        Text(
+                            "⚠ This image is not confirmed compatible with this ONU (vendor/model mismatch or missing metadata). Flashing an incompatible image can leave the ONU unusable.",
+                            color = MaterialTheme.colorScheme.error, style = MaterialTheme.typography.bodySmall,
+                        )
+                        Row(verticalAlignment = Alignment.CenterVertically) {
+                            Checkbox(checked = ack, onCheckedChange = { ack = it })
+                            Text("I understand this image may be incompatible")
+                        }
+                    }
+                }
+            },
             confirmButton = {
-                TextButton(onClick = { pending = null; onDismiss(); scope.launch { model.upgrade(file) } }) {
+                TextButton(
+                    enabled = isCompatible || ack,
+                    onClick = { pending = null; onDismiss(); scope.launch { model.upgrade(file) } },
+                ) {
                     Text("Download ${file.version ?: "firmware"}", color = MaterialTheme.colorScheme.error)
                 }
             },

app/src/main/java/no/svorka/mcms/ui/Types.kt

@@ -2,6 +2,7 @@ package no.svorka.mcms.ui
 
 import androidx.compose.ui.graphics.Color
 import no.svorka.mcms.core.AlarmSeverity
+import no.svorka.mcms.core.ApiError
 import no.svorka.mcms.core.OnuLifecycleState
 
 /** Screen load state. */
@@ -31,5 +32,9 @@ fun AlarmSeverity.color(): Color = when (this) {
     AlarmSeverity.UNKNOWN -> Color(0xFF9E9E9E)
 }
 
-/** Maps a thrown error to a user message. */
-fun Throwable.uiMessage(): String = message ?: "Something went wrong"
+/**
+ * Maps a thrown error to a user message. [ApiError] messages are written to be
+ * user-facing; anything else is unexpected and could leak library internals, so
+ * it collapses to a generic line.
+ */
+fun Throwable.uiMessage(): String = (this as? ApiError)?.message ?: "Something went wrong. Please try again."

app/src/main/res/xml/network_security_config.xml

@@ -0,0 +1,14 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  Transport security policy. Cleartext is never permitted, and only the system CA
+  store is trusted — user-installed CAs are not, which closes the "malicious profile"
+  MITM vector. To reach a box with a private/self-signed cert, install its CA in the
+  device system store or pin it via ServerTrustPolicy.PinPublicKeySha256.
+-->
+<network-security-config>
+    <base-config cleartextTrafficPermitted="false">
+        <trust-anchors>
+            <certificates src="system" />
+        </trust-anchors>
+    </base-config>
+</network-security-config>