booklore v2: embed frontend, bump Java to 25, remove nginx

Upgrade Java from 21 to 25 and add embedding of the built frontend into the backend resources so the Spring Boot app serves static files. Build steps now skip tests (gradle -x test). Remove nginx install/configuration paths: install script no longer installs or configures nginx; update script disables and purges nginx if active. Add default SERVER_PORT=6060 to the .env (or append if missing). Update systemd unit ExecStart to include JVM tuning flags and reload systemd. Misc: adjust start/reload steps to reflect nginx removal and clean up previous backup dirs.

CHANGELOG.md

@@ -411,7 +411,30 @@ Exercise vigilance regarding copycat or coat-tailing sites that seek to exploit
 
 ### 🆕 New Scripts
 
-  - Frigate v16.4 [@MickLesk](https://github.com/MickLesk) ([#11887](https://github.com/community-scripts/ProxmoxVE/pull/11887))
+  - SparkyFitness ([#12185](https://github.com/community-scripts/ProxmoxVE/pull/12185))
+- Frigate v16.4 [@MickLesk](https://github.com/MickLesk) ([#11887](https://github.com/community-scripts/ProxmoxVE/pull/11887))
+
+### 🚀 Updated Scripts
+
+  - #### ✨ New Features
+
+    - core: Enhance signal handling, reported "status" and logs [@MickLesk](https://github.com/MickLesk) ([#12216](https://github.com/community-scripts/ProxmoxVE/pull/12216))
+
+### 💾 Core
+
+  - #### 🔧 Refactor
+
+    - core: Improve error handling and logging for LXC builds [@MickLesk](https://github.com/MickLesk) ([#12208](https://github.com/community-scripts/ProxmoxVE/pull/12208))
+
+### 🌐 Website
+
+  - #### 🐞 Bug Fixes
+
+    - calibre-web: update default credentials [@LaevaertK](https://github.com/LaevaertK) ([#12201](https://github.com/community-scripts/ProxmoxVE/pull/12201))
+
+  - #### 📝 Script Information
+
+    - chore: update Frigate documentation and website URLs [@JohnICB](https://github.com/JohnICB) ([#12218](https://github.com/community-scripts/ProxmoxVE/pull/12218))
 
 ## 2026-02-22
 

ct/booklore.sh

@@ -30,7 +30,7 @@ function update_script() {
   fi
 
   if check_for_gh_release "booklore" "booklore-app/BookLore"; then
-    JAVA_VERSION="21" setup_java
+    JAVA_VERSION="25" setup_java
     NODE_VERSION="22" setup_nodejs
     setup_mariadb
     setup_yq
@@ -60,11 +60,16 @@ function update_script() {
     $STD npm run build --configuration=production
     msg_ok "Built Frontend"
 
+    msg_info "Embedding Frontend into Backend"
+    mkdir -p /opt/booklore/booklore-api/src/main/resources/static
+    cp -r /opt/booklore/booklore-ui/dist/booklore/browser/* /opt/booklore/booklore-api/src/main/resources/static/
+    msg_ok "Embedded Frontend into Backend"
+
     msg_info "Building Backend"
     cd /opt/booklore/booklore-api
     APP_VERSION=$(get_latest_github_release "booklore-app/BookLore")
     yq eval ".app.version = \"${APP_VERSION}\"" -i src/main/resources/application.yaml
-    $STD ./gradlew clean build --no-daemon
+    $STD ./gradlew clean build -x test --no-daemon
     mkdir -p /opt/booklore/dist
     JAR_PATH=$(find /opt/booklore/booklore-api/build/libs -maxdepth 1 -type f -name "booklore-api-*.jar" ! -name "*plain*" | head -n1)
     if [[ -z "$JAR_PATH" ]]; then
@@ -74,9 +79,22 @@ function update_script() {
     cp "$JAR_PATH" /opt/booklore/dist/app.jar
     msg_ok "Built Backend"
 
+    if systemctl is-active --quiet nginx 2>/dev/null; then
+      msg_info "Removing Nginx (no longer needed)"
+      systemctl disable --now nginx
+      $STD apt-get purge -y nginx nginx-common
+      msg_ok "Removed Nginx"
+    fi
+
+    if ! grep -q "^SERVER_PORT=" /opt/booklore_storage/.env 2>/dev/null; then
+      echo "SERVER_PORT=6060" >>/opt/booklore_storage/.env
+    fi
+
+    sed -i 's|ExecStart=/usr/bin/java -jar|ExecStart=/usr/bin/java -XX:+UseG1GC -XX:+UseStringDeduplication -XX:+UseCompactObjectHeaders -jar|' /etc/systemd/system/booklore.service
+    systemctl daemon-reload
+
     msg_info "Starting Service"
     systemctl start booklore
-    systemctl reload nginx
     rm -rf /opt/booklore_bak
     msg_ok "Started Service"
     msg_ok "Updated successfully!"

ct/headers/sparkyfitness

@@ -0,0 +1,6 @@
+   _____                  __         _______ __                      
+  / ___/____  ____ ______/ /____  __/ ____(_) /_____  ___  __________
+  \__ \/ __ \/ __ `/ ___/ //_/ / / / /_  / / __/ __ \/ _ \/ ___/ ___/
+ ___/ / /_/ / /_/ / /  / ,< / /_/ / __/ / / /_/ / / /  __(__  |__  ) 
+/____/ .___/\__,_/_/  /_/|_|\__, /_/   /_/\__/_/ /_/\___/____/____/  
+    /_/                    /____/                                    

ct/sparkyfitness.sh

@@ -0,0 +1,83 @@
+#!/usr/bin/env bash
+source <(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/misc/build.func)
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Tom Frenzel (tomfrenzel)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/CodeWithCJ/SparkyFitness
+
+APP="SparkyFitness"
+var_tags="${var_tags:-health;fitness}"
+var_cpu="${var_cpu:-2}"
+var_ram="${var_ram:-2048}"
+var_disk="${var_disk:-4}"
+var_os="${var_os:-debian}"
+var_version="${var_version:-13}"
+var_unprivileged="${var_unprivileged:-1}"
+
+header_info "$APP"
+variables
+color
+catch_errors
+
+function update_script() {
+  header_info
+  check_container_storage
+  check_container_resources
+
+  if [[ ! -d /opt/sparkyfitness ]]; then
+    msg_error "No ${APP} Installation Found!"
+    exit
+  fi
+
+  NODE_VERSION="25" setup_nodejs
+
+  if check_for_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness"; then
+    msg_info "Stopping Services"
+    systemctl stop sparkyfitness-server nginx
+    msg_ok "Stopped Services"
+
+    msg_info "Backing up data"
+    mkdir -p /opt/sparkyfitness_backup
+    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/uploads ]]; then
+      cp -r /opt/sparkyfitness/SparkyFitnessServer/uploads /opt/sparkyfitness_backup/
+    fi
+    if [[ -d /opt/sparkyfitness/SparkyFitnessServer/backup ]]; then
+      cp -r /opt/sparkyfitness/SparkyFitnessServer/backup /opt/sparkyfitness_backup/
+    fi
+    msg_ok "Backed up data"
+
+    CLEAN_INSTALL=1 fetch_and_deploy_gh_release "sparkyfitness" "CodeWithCJ/SparkyFitness" "tarball"
+
+    msg_info "Updating Sparky Fitness Backend"
+    cd /opt/sparkyfitness/SparkyFitnessServer
+    $STD npm install
+    msg_ok "Updated Sparky Fitness Backend"
+
+    msg_info "Updating Sparky Fitness Frontend (Patience)"
+    cd /opt/sparkyfitness/SparkyFitnessFrontend
+    $STD npm install
+    $STD npm run build
+    cp -a /opt/sparkyfitness/SparkyFitnessFrontend/dist/. /var/www/sparkyfitness/
+    msg_ok "Updated Sparky Fitness Frontend"
+
+    msg_info "Restoring data"
+    cp -r /opt/sparkyfitness_backup/. /opt/sparkyfitness/SparkyFitnessServer/
+    rm -rf /opt/sparkyfitness_backup
+    msg_ok "Restored data"
+
+    msg_info "Starting Services"
+    $STD systemctl start sparkyfitness-server nginx
+    msg_ok "Started Services"
+    msg_ok "Updated successfully!"
+  fi
+  exit
+}
+
+start
+build_container
+description
+
+msg_ok "Completed successfully!\n"
+echo -e "${CREATING}${GN}${APP} setup has been successfully initialized!${CL}"
+echo -e "${INFO}${YW} Access it using the following URL:${CL}"
+echo -e "${TAB}${GATEWAY}${BGN}http://${IP}${CL}"

frontend/public/json/calibre-web.json

@@ -28,14 +28,10 @@
     }
   ],
   "default_credentials": {
-    "username": null,
-    "password": null
+    "username": "admin",
+    "password": "admin123"
   },
   "notes": [
-    {
-      "text": "No credentials are set by this script. Complete setup and create credentials in the first-run wizard.",
-      "type": "info"
-    },
     {
       "text": "Upload your Calibre library metadata.db during first setup wizard.",
       "type": "info"

frontend/public/json/frigate.json

@@ -10,8 +10,8 @@
   "privileged": false,
   "config_path": "/config/config.yml",
   "interface_port": 5000,
-  "documentation": "https://frigate.io/",
-  "website": "https://frigate.io/",
+  "documentation": "https://docs.frigate.video/",
+  "website": "https://frigate.video/",
   "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/frigate-light.webp",
   "description": "Frigate is a complete and local NVR (Network Video Recorder) with realtime AI object detection for CCTV cameras.",
   "install_methods": [

frontend/public/json/github-versions.json

@@ -1,5 +1,5 @@
 {
-  "generated": "2026-02-23T06:26:10Z",
+  "generated": "2026-02-23T12:14:19Z",
   "versions": [
     {
       "slug": "2fauth",
@@ -200,9 +200,9 @@
     {
       "slug": "cleanuparr",
       "repo": "Cleanuparr/Cleanuparr",
-      "version": "v2.7.0",
+      "version": "v2.7.1",
       "pinned": false,
-      "date": "2026-02-22T18:17:27Z"
+      "date": "2026-02-23T09:58:13Z"
     },
     {
       "slug": "cloudreve",
@@ -421,6 +421,13 @@
       "pinned": false,
       "date": "2026-01-25T18:20:14Z"
     },
+    {
+      "slug": "frigate",
+      "repo": "blakeblackshear/frigate",
+      "version": "v0.16.4",
+      "pinned": true,
+      "date": "2026-01-29T00:42:14Z"
+    },
     {
       "slug": "gatus",
       "repo": "TwiN/gatus",
@@ -578,9 +585,9 @@
     {
       "slug": "huntarr",
       "repo": "plexguide/Huntarr.io",
-      "version": "9.3.7",
+      "version": "9.4.1",
       "pinned": false,
-      "date": "2026-02-19T01:03:53Z"
+      "date": "2026-02-23T08:46:37Z"
     },
     {
       "slug": "immich-public-proxy",
@@ -1663,9 +1670,9 @@
     {
       "slug": "wanderer",
       "repo": "meilisearch/meilisearch",
-      "version": "v1.35.1",
+      "version": "v1.36.0",
       "pinned": false,
-      "date": "2026-02-16T17:01:17Z"
+      "date": "2026-02-23T08:13:32Z"
     },
     {
       "slug": "warracker",

frontend/public/json/sparkyfitness.json

@@ -0,0 +1,35 @@
+{
+  "name": "SparkyFitness",
+  "slug": "sparkyfitness",
+  "categories": [
+    9
+  ],
+  "date_created": "2026-02-23",
+  "type": "ct",
+  "updateable": true,
+  "privileged": false,
+  "interface_port": 80,
+  "documentation": "https://codewithcj.github.io/SparkyFitness",
+  "website": "https://github.com/CodeWithCJ/SparkyFitness",
+  "logo": "https://cdn.jsdelivr.net/gh/selfhst/icons@main/webp/sparkyfitness.webp",
+  "config_path": "/etc/sparkyfitness/.env",
+  "description": "A self-hosted, privacy-first alternative to MyFitnessPal. Track nutrition, exercise, body metrics, and health data while keeping full control of your data.",
+  "install_methods": [
+    {
+      "type": "default",
+      "script": "ct/sparkyfitness.sh",
+      "resources": {
+        "cpu": 2,
+        "ram": 2048,
+        "hdd": 4,
+        "os": "Debian",
+        "version": "13"
+      }
+    }
+  ],
+  "default_credentials": {
+    "username": null,
+    "password": null
+  },
+  "notes": []
+}

install/booklore-install.sh

@@ -13,11 +13,7 @@ setting_up_container
 network_check
 update_os
 
-msg_info "Installing Dependencies"
-$STD apt install -y nginx
-msg_ok "Installed Dependencies"
-
-JAVA_VERSION="21" setup_java
+JAVA_VERSION="25" setup_java
 NODE_VERSION="22" setup_nodejs
 setup_mariadb
 setup_yq
@@ -30,6 +26,11 @@ $STD npm install --force
 $STD npm run build --configuration=production
 msg_ok "Built Frontend"
 
+msg_info "Embedding Frontend into Backend"
+mkdir -p /opt/booklore/booklore-api/src/main/resources/static
+cp -r /opt/booklore/booklore-ui/dist/booklore/browser/* /opt/booklore/booklore-api/src/main/resources/static/
+msg_ok "Embedded Frontend into Backend"
+
 msg_info "Creating Environment"
 mkdir -p /opt/booklore_storage/{data,books,bookdrop}
 cat <<EOF >/opt/booklore_storage/.env
@@ -41,6 +42,7 @@ DATABASE_PASSWORD=${MARIADB_DB_PASS}
 # App Configuration (Spring Boot mapping from app.* properties)
 APP_PATH_CONFIG=/opt/booklore_storage/data
 APP_BOOKDROP_FOLDER=/opt/booklore_storage/bookdrop
+SERVER_PORT=6060
 EOF
 msg_ok "Created Environment"
 
@@ -48,7 +50,7 @@ msg_info "Building Backend"
 cd /opt/booklore/booklore-api
 APP_VERSION=$(get_latest_github_release "booklore-app/BookLore")
 yq eval ".app.version = \"${APP_VERSION}\"" -i src/main/resources/application.yaml
-$STD ./gradlew clean build --no-daemon
+$STD ./gradlew clean build -x test --no-daemon
 mkdir -p /opt/booklore/dist
 JAR_PATH=$(find /opt/booklore/booklore-api/build/libs -maxdepth 1 -type f -name "booklore-api-*.jar" ! -name "*plain*" | head -n1)
 if [[ -z "$JAR_PATH" ]]; then
@@ -58,16 +60,6 @@ fi
 cp "$JAR_PATH" /opt/booklore/dist/app.jar
 msg_ok "Built Backend"
 
-msg_info "Configuring Nginx"
-rm -rf /usr/share/nginx/html
-ln -s /opt/booklore/booklore-ui/dist/booklore/browser /usr/share/nginx/html
-rm -f /etc/nginx/sites-enabled/default
-cp /opt/booklore/nginx.conf /etc/nginx/nginx.conf
-sed -i 's/listen \${BOOKLORE_PORT};/listen 6060;/' /etc/nginx/nginx.conf
-sed -i 's/listen \[::\]:${BOOKLORE_PORT};/listen [::]:6060;/' /etc/nginx/nginx.conf
-systemctl restart nginx
-msg_ok "Configured Nginx"
-
 msg_info "Creating Service"
 cat <<EOF >/etc/systemd/system/booklore.service
 [Unit]
@@ -78,7 +70,7 @@ After=network.target mariadb.service
 Type=simple
 User=root
 WorkingDirectory=/opt/booklore/dist
-ExecStart=/usr/bin/java -jar /opt/booklore/dist/app.jar
+ExecStart=/usr/bin/java -XX:+UseG1GC -XX:+UseStringDeduplication -XX:+UseCompactObjectHeaders -jar /opt/booklore/dist/app.jar
 EnvironmentFile=/opt/booklore_storage/.env
 SuccessExitStatus=143
 TimeoutStopSec=10

install/frigate-install.sh

@@ -175,7 +175,10 @@ cp -a /opt/frigate/docker/main/rootfs/. /
 sed -i '/^.*unset DEBIAN_FRONTEND.*$/d' /opt/frigate/docker/main/install_deps.sh
 echo "libedgetpu1-max libedgetpu/accepted-eula boolean true" | debconf-set-selections
 echo "libedgetpu1-max libedgetpu/install-confirm-max boolean true" | debconf-set-selections
+# Allow Frigate's Intel media packages to overwrite files from system GPU driver packages
+echo 'force-overwrite' >/etc/dpkg/dpkg.cfg.d/force-overwrite
 $STD bash /opt/frigate/docker/main/install_deps.sh
+rm -f /etc/dpkg/dpkg.cfg.d/force-overwrite
 $STD pip3 install -U /wheels/*.whl
 ldconfig
 msg_ok "Installed HailoRT Runtime"

install/sparkyfitness-install.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Tom Frenzel (tomfrenzel)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://github.com/CodeWithCJ/SparkyFitness
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+msg_info "Installing Dependencies"
+$STD apt install -y nginx
+msg_ok "Installed Dependencies"
+
+NODE_VERSION="25" setup_nodejs
+PG_VERSION="18" setup_postgresql
+PG_DB_NAME="sparkyfitness" PG_DB_USER="sparky" PG_DB_GRANT_SUPERUSER="true" setup_postgresql_db
+
+fetch_and_deploy_gh_release sparkyfitness "CodeWithCJ/SparkyFitness" "tarball" "latest"
+
+msg_info "Configuring Sparky Fitness"
+mkdir -p "/etc/sparkyfitness" "/var/lib/sparkyfitness/uploads" "/var/lib/sparkyfitness/backup" "/var/www/sparkyfitness"
+cp "/opt/sparkyfitness/docker/.env.example" "/etc/sparkyfitness/.env"
+sed \
+  -i \
+  -e "s|^#\?SPARKY_FITNESS_DB_HOST=.*|SPARKY_FITNESS_DB_HOST=localhost|" \
+  -e "s|^#\?SPARKY_FITNESS_DB_PORT=.*|SPARKY_FITNESS_DB_PORT=5432|" \
+  -e "s|^SPARKY_FITNESS_DB_NAME=.*|SPARKY_FITNESS_DB_NAME=sparkyfitness|" \
+  -e "s|^SPARKY_FITNESS_DB_USER=.*|SPARKY_FITNESS_DB_USER=sparky|" \
+  -e "s|^SPARKY_FITNESS_DB_PASSWORD=.*|SPARKY_FITNESS_DB_PASSWORD=${PG_DB_PASS}|" \
+  -e "s|^SPARKY_FITNESS_APP_DB_USER=.*|SPARKY_FITNESS_APP_DB_USER=sparky_app|" \
+  -e "s|^SPARKY_FITNESS_APP_DB_PASSWORD=.*|SPARKY_FITNESS_APP_DB_PASSWORD=$(openssl rand -base64 24 | tr -dc 'a-zA-Z0-9' | head -c20)|" \
+  -e "s|^SPARKY_FITNESS_SERVER_HOST=.*|SPARKY_FITNESS_SERVER_HOST=localhost|" \
+  -e "s|^SPARKY_FITNESS_SERVER_PORT=.*|SPARKY_FITNESS_SERVER_PORT=3010|" \
+  -e "s|^SPARKY_FITNESS_FRONTEND_URL=.*|SPARKY_FITNESS_FRONTEND_URL=http://${LOCAL_IP}:80|" \
+  -e "s|^SPARKY_FITNESS_API_ENCRYPTION_KEY=.*|SPARKY_FITNESS_API_ENCRYPTION_KEY=$(openssl rand -hex 32)|" \
+  -e "s|^BETTER_AUTH_SECRET=.*|BETTER_AUTH_SECRET=$(openssl rand -hex 32)|" \
+  "/etc/sparkyfitness/.env"
+msg_ok "Configured Sparky Fitness"
+
+msg_info "Building Backend"
+cd /opt/sparkyfitness/SparkyFitnessServer
+$STD npm install
+msg_ok "Built Backend"
+
+msg_info "Building Frontend (Patience)"
+cd /opt/sparkyfitness/SparkyFitnessFrontend
+$STD npm install
+$STD npm run build
+cp -a /opt/sparkyfitness/SparkyFitnessFrontend/dist/. /var/www/sparkyfitness/
+msg_ok "Built Frontend"
+
+msg_info "Creating SparkyFitness Service"
+cat <<EOF >/etc/systemd/system/sparkyfitness-server.service
+[Unit]
+Description=SparkyFitness Backend Service
+After=network.target postgresql.service
+Requires=postgresql.service
+
+[Service]
+Type=simple
+WorkingDirectory=/opt/sparkyfitness/SparkyFitnessServer
+EnvironmentFile=/etc/sparkyfitness/.env
+ExecStart=/usr/bin/node SparkyFitnessServer.js
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+EOF
+systemctl enable -q --now sparkyfitness-server
+msg_ok "Created SparkyFitness Service"
+
+msg_info "Configuring Nginx"
+sed \
+  -e 's|${SPARKY_FITNESS_SERVER_HOST}|127.0.0.1|g' \
+  -e 's|${SPARKY_FITNESS_SERVER_PORT}|3010|g' \
+  -e 's|root /usr/share/nginx/html;|root /var/www/sparkyfitness;|g' \
+  -e 's|server_name localhost;|server_name _;|g' \
+  "/opt/sparkyfitness/docker/nginx.conf" >/etc/nginx/sites-available/sparkyfitness
+ln -sf /etc/nginx/sites-available/sparkyfitness /etc/nginx/sites-enabled/sparkyfitness
+rm -f /etc/nginx/sites-enabled/default
+$STD nginx -t
+$STD systemctl enable -q --now nginx
+$STD systemctl reload nginx
+msg_ok "Configured Nginx"
+
+motd_ssh
+customize
+cleanup_lxc

misc/api.func

@@ -350,6 +350,55 @@ get_error_text() {
   fi
 }
 
+# ------------------------------------------------------------------------------
+# get_full_log()
+#
+# - Returns the FULL installation log (build + install combined)
+# - Calls ensure_log_on_host() to pull container log if needed
+# - Strips ANSI escape codes and carriage returns
+# - Truncates to max_bytes (default: 120KB) to stay within API limits
+# - Used for the error telemetry field (full trace instead of 20 lines)
+# ------------------------------------------------------------------------------
+get_full_log() {
+  local max_bytes="${1:-122880}" # 120KB default
+  local logfile=""
+
+  # Ensure logs are available on host (pulls from container if needed)
+  if declare -f ensure_log_on_host >/dev/null 2>&1; then
+    ensure_log_on_host
+  fi
+
+  # Try combined log first (most complete)
+  if [[ -n "${CTID:-}" && -n "${SESSION_ID:-}" ]]; then
+    local combined_log="/tmp/${NSAPP:-lxc}-${CTID}-${SESSION_ID}.log"
+    if [[ -s "$combined_log" ]]; then
+      logfile="$combined_log"
+    fi
+  fi
+
+  # Fall back to INSTALL_LOG
+  if [[ -z "$logfile" || ! -s "$logfile" ]]; then
+    if [[ -n "${INSTALL_LOG:-}" && -s "${INSTALL_LOG}" ]]; then
+      logfile="$INSTALL_LOG"
+    fi
+  fi
+
+  # Fall back to BUILD_LOG
+  if [[ -z "$logfile" || ! -s "$logfile" ]]; then
+    if [[ -n "${BUILD_LOG:-}" && -s "${BUILD_LOG}" ]]; then
+      logfile="$BUILD_LOG"
+    fi
+  fi
+
+  if [[ -n "$logfile" && -s "$logfile" ]]; then
+    # Strip ANSI codes, carriage returns, and anonymize IP addresses (GDPR)
+    sed 's/\r$//' "$logfile" 2>/dev/null |
+      sed 's/\x1b\[[0-9;]*[a-zA-Z]//g' |
+      sed -E 's/([0-9]{1,3}\.)[0-9]{1,3}\.[0-9]{1,3}/\1x.x/g' |
+      head -c "$max_bytes"
+  fi
+}
+
 # ------------------------------------------------------------------------------
 # build_error_string()
 #
@@ -782,11 +831,15 @@ post_update_to_api() {
     else
       exit_code=1
     fi
-    # Get log lines and build structured error string
-    local error_text=""
-    error_text=$(get_error_text)
+    # Get full installation log for error field
+    local log_text=""
+    log_text=$(get_full_log 122880) || true # 120KB max
+    if [[ -z "$log_text" ]]; then
+      # Fallback to last 20 lines
+      log_text=$(get_error_text)
+    fi
     local full_error
-    full_error=$(build_error_string "$exit_code" "$error_text")
+    full_error=$(build_error_string "$exit_code" "$log_text")
     error=$(json_escape "$full_error")
     short_error=$(json_escape "$(explain_exit_code "$exit_code")")
     error_category=$(categorize_error "$exit_code")
@@ -807,7 +860,7 @@ post_update_to_api() {
 
   local http_code=""
 
-  # ── Attempt 1: Full payload with complete error text ──
+  # ── Attempt 1: Full payload with complete error text (includes full log) ──
   local JSON_PAYLOAD
   JSON_PAYLOAD=$(
     cat <<EOF
@@ -969,16 +1022,16 @@ categorize_error() {
   # Python environment errors
   # (already covered: 160-162 under dependency)
 
-  # Aborted by user
-  130) echo "aborted" ;;
+  # Aborted by user (SIGHUP=terminal closed, SIGINT=Ctrl+C, SIGTERM=killed)
+  129 | 130 | 143) echo "user_aborted" ;;
 
   # Resource errors (OOM, SIGKILL, SIGABRT)
   134 | 137) echo "resource" ;;
 
-  # Signal/Process errors (SIGTERM, SIGPIPE, SIGSEGV)
-  139 | 141 | 143) echo "signal" ;;
+  # Signal/Process errors (SIGPIPE, SIGSEGV)
+  139 | 141) echo "signal" ;;
 
-  # Shell errors (general error, syntax error)  
+  # Shell errors (general error, syntax error)
   1 | 2) echo "shell" ;;
 
   # Default - truly unknown

misc/build.func

@@ -3578,6 +3578,13 @@ build_container() {
   # DEV_MODE exports (optional, for debugging)
   export BUILD_LOG="$BUILD_LOG"
   export INSTALL_LOG="/root/.install-${SESSION_ID}.log"
+
+  # Keep host-side logging on BUILD_LOG (not exported — invisible to container)
+  # Without this, get_active_logfile() would return INSTALL_LOG (a container path)
+  # and all host msg_info/msg_ok/msg_error would write to /root/.install-SESSION.log
+  # on the HOST instead of BUILD_LOG, causing incomplete telemetry logs.
+  _HOST_LOGFILE="$BUILD_LOG"
+
   export dev_mode="${dev_mode:-}"
   export DEV_MODE_MOTD="${DEV_MODE_MOTD:-false}"
   export DEV_MODE_KEEP="${DEV_MODE_KEEP:-false}"
@@ -4052,11 +4059,19 @@ EOF'
   set +Eeuo pipefail # Disable ALL error handling temporarily
   trap - ERR         # Remove ERR trap completely
 
+  # Signal handlers use this flag to stop the container on abort (SIGHUP/SIGINT/SIGTERM)
+  # Without this, SSH disconnects leave the container running as an orphan process
+  # that sends "configuring" status AFTER the host already reported "failed"
+  export CONTAINER_INSTALLING=true
+
   lxc-attach -n "$CTID" -- bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/install/${var_install}.sh)"
   local lxc_exit=$?
 
-  set -Eeuo pipefail       # Re-enable error handling
-  trap 'error_handler' ERR # Restore ERR trap
+  unset CONTAINER_INSTALLING
+
+  # Keep error handling DISABLED during failure detection and recovery
+  # Re-enabling it here would cause any pct exec/pull failure to trigger
+  # error_handler() on the host, bypassing the recovery menu entirely
 
   # Check for error flag file in container (more reliable than lxc-attach exit code)
   local install_exit_code=0
@@ -4484,6 +4499,10 @@ EOF'
 
     exit $install_exit_code
   fi
+
+  # Re-enable error handling after successful install or recovery menu completion
+  set -Eeuo pipefail
+  trap 'error_handler' ERR
 }
 
 destroy_lxc() {
@@ -5561,9 +5580,13 @@ api_exit_script() {
     # ALWAYS send telemetry FIRST - ensure status is reported even if
     # ensure_log_on_host hangs (e.g. pct pull on dead container)
     post_update_to_api "failed" "$exit_code" 2>/dev/null || true
-    # Best-effort log collection with timeout (non-critical after telemetry is sent)
+    # Best-effort log collection (non-critical after telemetry is sent)
     if declare -f ensure_log_on_host >/dev/null 2>&1; then
-      timeout 10 bash -c 'ensure_log_on_host' 2>/dev/null || true
+      ensure_log_on_host 2>/dev/null || true
+    fi
+    # Stop orphaned container if we're in the install phase
+    if [[ "${CONTAINER_INSTALLING:-}" == "true" && -n "${CTID:-}" ]] && command -v pct &>/dev/null; then
+      pct stop "$CTID" 2>/dev/null || true
     fi
   elif [[ "${POST_TO_API_DONE:-}" == "true" && "${POST_UPDATE_DONE:-}" != "true" ]]; then
     # Script exited with 0 but never sent a completion status
@@ -5575,7 +5598,7 @@ api_exit_script() {
 if command -v pveversion >/dev/null 2>&1; then
   trap 'api_exit_script' EXIT
 fi
-trap 'local _ec=$?; if [[ $_ec -ne 0 ]]; then post_update_to_api "failed" "$_ec" 2>/dev/null || true; timeout 10 bash -c "ensure_log_on_host" 2>/dev/null || true; fi' ERR
-trap 'post_update_to_api "failed" "129" 2>/dev/null || true; timeout 10 bash -c "ensure_log_on_host" 2>/dev/null || true; exit 129' SIGHUP
-trap 'post_update_to_api "failed" "130" 2>/dev/null || true; timeout 10 bash -c "ensure_log_on_host" 2>/dev/null || true; exit 130' SIGINT
-trap 'post_update_to_api "failed" "143" 2>/dev/null || true; timeout 10 bash -c "ensure_log_on_host" 2>/dev/null || true; exit 143' SIGTERM
+trap 'local _ec=$?; if [[ $_ec -ne 0 ]]; then post_update_to_api "failed" "$_ec" 2>/dev/null || true; if declare -f ensure_log_on_host &>/dev/null; then ensure_log_on_host 2>/dev/null || true; fi; fi' ERR
+trap 'post_update_to_api "failed" "129" 2>/dev/null || true; if [[ -n "${CTID:-}" ]] && command -v pct &>/dev/null; then pct stop "$CTID" 2>/dev/null || true; fi; exit 129' SIGHUP
+trap 'post_update_to_api "failed" "130" 2>/dev/null || true; if [[ -n "${CTID:-}" ]] && command -v pct &>/dev/null; then pct stop "$CTID" 2>/dev/null || true; fi; exit 130' SIGINT
+trap 'post_update_to_api "failed" "143" 2>/dev/null || true; if [[ -n "${CTID:-}" ]] && command -v pct &>/dev/null; then pct stop "$CTID" 2>/dev/null || true; fi; exit 143' SIGTERM

misc/core.func

@@ -395,12 +395,20 @@ ssh_check() {
 # get_active_logfile()
 #
 # - Returns the appropriate log file based on execution context
-# - BUILD_LOG: Host operations (container creation)
+# - _HOST_LOGFILE: Override for host context (keeps host logging on BUILD_LOG
+#   even after INSTALL_LOG is exported for the container)
 # - INSTALL_LOG: Container operations (application installation)
+# - BUILD_LOG: Host operations (container creation)
 # - Fallback to BUILD_LOG if neither is set
 # ------------------------------------------------------------------------------
 get_active_logfile() {
-  if [[ -n "${INSTALL_LOG:-}" ]]; then
+  # Host override: _HOST_LOGFILE is set (not exported) in build.func to keep
+  # host-side logging in BUILD_LOG after INSTALL_LOG is exported for the container.
+  # Without this, all host msg_info/msg_ok/msg_error would write to
+  # /root/.install-SESSION.log (a container path) instead of BUILD_LOG.
+  if [[ -n "${_HOST_LOGFILE:-}" ]]; then
+    echo "$_HOST_LOGFILE"
+  elif [[ -n "${INSTALL_LOG:-}" ]]; then
     echo "$INSTALL_LOG"
   elif [[ -n "${BUILD_LOG:-}" ]]; then
     echo "$BUILD_LOG"
@@ -524,7 +532,8 @@ silent() {
     if [[ -s "$logfile" ]]; then
       echo -e "\n${TAB}--- Last 10 lines of log ---"
       tail -n 10 "$logfile"
-      echo -e "${TAB}-----------------------------------\n"
+      echo -e "${TAB}-----------------------------------"
+      echo -e "${TAB}📋 Full log: ${logfile}\n"
     fi
 
     exit "$rc"

misc/error_handler.func

@@ -208,6 +208,10 @@ error_handler() {
   # This ensures we capture failures that occur before/after container exists
   if declare -f post_update_to_api &>/dev/null; then
     post_update_to_api "failed" "$exit_code" 2>/dev/null || true
+  else
+    # Container context: post_update_to_api not available (api.func not sourced)
+    # Send status directly via curl so container failures are never lost
+    _send_abort_telemetry "$exit_code" 2>/dev/null || true
   fi
 
   # Use msg_error if available, fallback to echo
@@ -236,67 +240,54 @@ error_handler() {
     active_log="$SILENT_LOGFILE"
   fi
 
+  # If active_log points to a container-internal path that doesn't exist on host,
+  # fall back to BUILD_LOG (host-side log)
+  if [[ -n "$active_log" && ! -s "$active_log" && -n "${BUILD_LOG:-}" && -s "${BUILD_LOG}" ]]; then
+    active_log="$BUILD_LOG"
+  fi
+
+  # Show last log lines if available
   if [[ -n "$active_log" && -s "$active_log" ]]; then
     echo -e "\n${TAB}--- Last 20 lines of log ---"
     tail -n 20 "$active_log"
     echo -e "${TAB}-----------------------------------\n"
+  fi
 
-    # Detect context: Container (INSTALL_LOG set + /root exists) vs Host (BUILD_LOG)
-    if [[ -n "${INSTALL_LOG:-}" && -d /root ]]; then
-      # CONTAINER CONTEXT: Copy log and create flag file for host
-      local container_log="/root/.install-${SESSION_ID:-error}.log"
-      cp "$active_log" "$container_log" 2>/dev/null || true
+  # Detect context: Container (INSTALL_LOG set + inside container /root) vs Host
+  if [[ -n "${INSTALL_LOG:-}" && -f "${INSTALL_LOG:-}" && -d /root ]]; then
+    # CONTAINER CONTEXT: Copy log and create flag file for host
+    local container_log="/root/.install-${SESSION_ID:-error}.log"
+    cp "${INSTALL_LOG}" "$container_log" 2>/dev/null || true
 
-      # Create error flag file with exit code for host detection
-      echo "$exit_code" >"/root/.install-${SESSION_ID:-error}.failed" 2>/dev/null || true
-      # Log path is shown by host as combined log - no need to show container path
-    else
-      # HOST CONTEXT: Show local log path and offer container cleanup
+    # Create error flag file with exit code for host detection
+    echo "$exit_code" >"/root/.install-${SESSION_ID:-error}.failed" 2>/dev/null || true
+    # Log path is shown by host as combined log - no need to show container path
+  else
+    # HOST CONTEXT: Show local log path and offer container cleanup
+    if [[ -n "$active_log" && -s "$active_log" ]]; then
       if declare -f msg_custom >/dev/null 2>&1; then
         msg_custom "📋" "${YW}" "Full log: ${active_log}"
       else
         echo -e "${YW}Full log:${CL} ${BL}${active_log}${CL}"
       fi
+    fi
 
-      # Offer to remove container if it exists (build errors after container creation)
-      if [[ -n "${CTID:-}" ]] && command -v pct &>/dev/null && pct status "$CTID" &>/dev/null; then
-        echo ""
-        if declare -f msg_custom >/dev/null 2>&1; then
-          echo -en "${TAB}❓${TAB}${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
-        else
-          echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
-        fi
+    # Offer to remove container if it exists (build errors after container creation)
+    if [[ -n "${CTID:-}" ]] && command -v pct &>/dev/null && pct status "$CTID" &>/dev/null; then
+      echo ""
+      if declare -f msg_custom >/dev/null 2>&1; then
+        echo -en "${TAB}❓${TAB}${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
+      else
+        echo -en "${YW}Remove broken container ${CTID}? (Y/n) [auto-remove in 60s]: ${CL}"
+      fi
 
-        if read -t 60 -r response; then
-          if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
-            echo ""
-            if declare -f msg_info >/dev/null 2>&1; then
-              msg_info "Removing container ${CTID}"
-            else
-              echo -e "${YW}Removing container ${CTID}${CL}"
-            fi
-            pct stop "$CTID" &>/dev/null || true
-            pct destroy "$CTID" &>/dev/null || true
-            if declare -f msg_ok >/dev/null 2>&1; then
-              msg_ok "Container ${CTID} removed"
-            else
-              echo -e "${GN}✔${CL} Container ${CTID} removed"
-            fi
-          elif [[ "$response" =~ ^[Nn]$ ]]; then
-            echo ""
-            if declare -f msg_warn >/dev/null 2>&1; then
-              msg_warn "Container ${CTID} kept for debugging"
-            else
-              echo -e "${YW}Container ${CTID} kept for debugging${CL}"
-            fi
-          fi
-        else
-          # Timeout - auto-remove
+      if read -t 60 -r response; then
+        if [[ -z "$response" || "$response" =~ ^[Yy]$ ]]; then
           echo ""
           if declare -f msg_info >/dev/null 2>&1; then
-            msg_info "No response - removing container ${CTID}"
+            msg_info "Removing container ${CTID}"
           else
-            echo -e "${YW}No response - removing container ${CTID}${CL}"
+            echo -e "${YW}Removing container ${CTID}${CL}"
           fi
           pct stop "$CTID" &>/dev/null || true
           pct destroy "$CTID" &>/dev/null || true
@@ -305,13 +296,35 @@ error_handler() {
           else
             echo -e "${GN}✔${CL} Container ${CTID} removed"
           fi
+        elif [[ "$response" =~ ^[Nn]$ ]]; then
+          echo ""
+          if declare -f msg_warn >/dev/null 2>&1; then
+            msg_warn "Container ${CTID} kept for debugging"
+          else
+            echo -e "${YW}Container ${CTID} kept for debugging${CL}"
+          fi
         fi
+      else
+        # Timeout - auto-remove
+        echo ""
+        if declare -f msg_info >/dev/null 2>&1; then
+          msg_info "No response - removing container ${CTID}"
+        else
+          echo -e "${YW}No response - removing container ${CTID}${CL}"
+        fi
+        pct stop "$CTID" &>/dev/null || true
+        pct destroy "$CTID" &>/dev/null || true
+        if declare -f msg_ok >/dev/null 2>&1; then
+          msg_ok "Container ${CTID} removed"
+        else
+          echo -e "${GN}✔${CL} Container ${CTID} removed"
+        fi
+      fi
 
-        # Force one final status update attempt after cleanup
-        # This ensures status is updated even if the first attempt failed (e.g., HTTP 400)
-        if declare -f post_update_to_api &>/dev/null; then
-          post_update_to_api "failed" "$exit_code" "force"
-        fi
+      # Force one final status update attempt after cleanup
+      # This ensures status is updated even if the first attempt failed (e.g., HTTP 400)
+      if declare -f post_update_to_api &>/dev/null; then
+        post_update_to_api "failed" "$exit_code" "force"
       fi
     fi
   fi
@@ -320,40 +333,97 @@ error_handler() {
 }
 
 # ==============================================================================
-# SECTION 3: SIGNAL HANDLERS
+# SECTION 3: TELEMETRY & CLEANUP HELPERS FOR SIGNAL HANDLERS
+# ==============================================================================
+
+# ------------------------------------------------------------------------------
+# _send_abort_telemetry()
+#
+# - Sends failure/abort status to telemetry API
+# - Works in BOTH host context (post_update_to_api available) and
+#   container context (only curl available, api.func not sourced)
+# - Container context is critical: without this, container-side failures
+#   and signal exits are never reported, leaving records stuck in
+#   "installing" or "configuring" forever
+# - Arguments: $1 = exit_code
+# ------------------------------------------------------------------------------
+_send_abort_telemetry() {
+  local exit_code="${1:-1}"
+  # Try full API function first (host context - api.func sourced)
+  if declare -f post_update_to_api &>/dev/null; then
+    post_update_to_api "failed" "$exit_code" 2>/dev/null || true
+    return
+  fi
+  # Fallback: direct curl (container context - api.func NOT sourced)
+  # This is the ONLY way containers can report failures to telemetry
+  command -v curl &>/dev/null || return 0
+  [[ "${DIAGNOSTICS:-no}" == "no" ]] && return 0
+  [[ -z "${RANDOM_UUID:-}" ]] && return 0
+  curl -fsS -m 5 -X POST "${TELEMETRY_URL:-https://telemetry.community-scripts.org/telemetry}" \
+    -H "Content-Type: application/json" \
+    -d "{\"random_id\":\"${RANDOM_UUID}\",\"execution_id\":\"${EXECUTION_ID:-${RANDOM_UUID}}\",\"type\":\"${TELEMETRY_TYPE:-lxc}\",\"nsapp\":\"${NSAPP:-${app:-unknown}}\",\"status\":\"failed\",\"exit_code\":${exit_code}}" &>/dev/null || true
+}
+
+# ------------------------------------------------------------------------------
+# _stop_container_if_installing()
+#
+# - Stops the LXC container if we're in the install phase
+# - Prevents orphaned container processes when the host exits due to a signal
+#   (SSH disconnect, Ctrl+C, SIGTERM) — without this, the container keeps
+#   running and may send "configuring" status AFTER the host already sent
+#   "failed", leaving records permanently stuck in "configuring"
+# - Only acts when:
+#   * CONTAINER_INSTALLING flag is set (during lxc-attach in build_container)
+#   * CTID is set (container was created)
+#   * pct command is available (we're on the Proxmox host, not inside a container)
+# - Does NOT destroy the container — just stops it for potential debugging
+# ------------------------------------------------------------------------------
+_stop_container_if_installing() {
+  [[ "${CONTAINER_INSTALLING:-}" == "true" ]] || return 0
+  [[ -n "${CTID:-}" ]] || return 0
+  command -v pct &>/dev/null || return 0
+  pct stop "$CTID" 2>/dev/null || true
+}
+
+# ==============================================================================
+# SECTION 4: SIGNAL HANDLERS
 # ==============================================================================
 
 # ------------------------------------------------------------------------------
 # on_exit()
 #
-# - EXIT trap handler
-# - Cleans up lock files if lockfile variable is set
-# - Exits with captured exit code
-# - Always runs on script termination (success or failure)
-# - For signal exits (>128): sends telemetry FIRST before log collection
-#   to prevent pct pull hangs from blocking status updates
+# - EXIT trap handler — runs on EVERY script termination
+# - Catches orphaned "installing"/"configuring" records:
+#   * If post_to_api sent "installing" but post_update_to_api never ran
+#   * Reports final status to prevent records stuck forever
+# - Best-effort log collection for failed installs
+# - Stops orphaned container processes on failure
+# - Cleans up lock files
 # ------------------------------------------------------------------------------
 on_exit() {
   local exit_code=$?
+
   # Report orphaned "installing" records to telemetry API
-  # Catches ALL exit paths: errors (non-zero), signals, AND clean exits where
-  # post_to_api was called ("installing" sent) but post_update_to_api was never called
+  # Catches ALL exit paths: errors, signals, AND clean exits where
+  # post_to_api was called but post_update_to_api was never called
   if [[ "${POST_TO_API_DONE:-}" == "true" && "${POST_UPDATE_DONE:-}" != "true" ]]; then
-    if declare -f post_update_to_api >/dev/null 2>&1; then
-      # ALWAYS send telemetry FIRST - ensure status is reported even if
-      # ensure_log_on_host hangs (e.g. pct pull on dead/unresponsive container)
-      if [[ $exit_code -ne 0 ]]; then
-        post_update_to_api "failed" "$exit_code" 2>/dev/null || true
-      else
-        # exit_code=0 is never an error — report as success
-        post_update_to_api "done" "0" 2>/dev/null || true
-      fi
-      # Best-effort log collection with timeout (non-critical after telemetry is sent)
-      if declare -f ensure_log_on_host >/dev/null 2>&1; then
-        timeout 10 bash -c 'ensure_log_on_host' 2>/dev/null || true
-      fi
+    if [[ $exit_code -ne 0 ]]; then
+      _send_abort_telemetry "$exit_code"
+    elif declare -f post_update_to_api >/dev/null 2>&1; then
+      post_update_to_api "done" "0" 2>/dev/null || true
     fi
   fi
+
+  # Best-effort log collection on failure (non-critical, telemetry already sent)
+  if [[ $exit_code -ne 0 ]] && declare -f ensure_log_on_host >/dev/null 2>&1; then
+    ensure_log_on_host 2>/dev/null || true
+  fi
+
+  # Stop orphaned container if we're in the install phase and exiting with error
+  if [[ $exit_code -ne 0 ]]; then
+    _stop_container_if_installing
+  fi
+
   [[ -n "${lockfile:-}" && -e "$lockfile" ]] && rm -f "$lockfile"
   exit "$exit_code"
 }
@@ -362,22 +432,13 @@ on_exit() {
 # on_interrupt()
 #
 # - SIGINT (Ctrl+C) trap handler
-# - Reports to telemetry FIRST (time-critical: container may be dying)
-# - Displays "Interrupted by user" message
+# - Reports status FIRST (time-critical: container may be dying)
+# - Stops orphaned container to prevent "configuring" ghost records
 # - Exits with code 130 (128 + SIGINT=2)
-# - Output redirected to /dev/null fallback to prevent SIGPIPE on closed terminals
 # ------------------------------------------------------------------------------
 on_interrupt() {
-  # CRITICAL: Send telemetry FIRST before any cleanup or output
-  # If ensure_log_on_host hangs (e.g. pct pull on dying container),
-  # the status update would never be sent, leaving records stuck in "installing"
-  if declare -f post_update_to_api >/dev/null 2>&1; then
-    post_update_to_api "failed" "130" 2>/dev/null || true
-  fi
-  # Best-effort log collection with timeout (non-critical after telemetry is sent)
-  if declare -f ensure_log_on_host >/dev/null 2>&1; then
-    timeout 10 bash -c 'ensure_log_on_host' 2>/dev/null || true
-  fi
+  _send_abort_telemetry "130"
+  _stop_container_if_installing
   if declare -f msg_error >/dev/null 2>&1; then
     msg_error "Interrupted by user (SIGINT)" 2>/dev/null || true
   else
@@ -390,23 +451,13 @@ on_interrupt() {
 # on_terminate()
 #
 # - SIGTERM trap handler
-# - Reports to telemetry FIRST (time-critical: process being killed)
-# - Displays "Terminated by signal" message
+# - Reports status FIRST (time-critical: process being killed)
+# - Stops orphaned container to prevent "configuring" ghost records
 # - Exits with code 143 (128 + SIGTERM=15)
-# - Triggered by external process termination
-# - Output redirected to /dev/null fallback to prevent SIGPIPE on closed terminals
 # ------------------------------------------------------------------------------
 on_terminate() {
-  # CRITICAL: Send telemetry FIRST before any cleanup or output
-  # Same rationale as on_interrupt: ensure status gets reported even if
-  # ensure_log_on_host hangs or terminal is already closed
-  if declare -f post_update_to_api >/dev/null 2>&1; then
-    post_update_to_api "failed" "143" 2>/dev/null || true
-  fi
-  # Best-effort log collection with timeout (non-critical after telemetry is sent)
-  if declare -f ensure_log_on_host >/dev/null 2>&1; then
-    timeout 10 bash -c 'ensure_log_on_host' 2>/dev/null || true
-  fi
+  _send_abort_telemetry "143"
+  _stop_container_if_installing
   if declare -f msg_error >/dev/null 2>&1; then
     msg_error "Terminated by signal (SIGTERM)" 2>/dev/null || true
   else
@@ -415,8 +466,25 @@ on_terminate() {
   exit 143
 }
 
+# ------------------------------------------------------------------------------
+# on_hangup()
+#
+# - SIGHUP trap handler (SSH disconnect, terminal closed)
+# - CRITICAL: This was previously MISSING from catch_errors(), causing
+#   container processes to become orphans on SSH disconnect — the #1 cause
+#   of records stuck in "installing" and "configuring" states
+# - Reports status via direct curl (terminal is already closed, no output)
+# - Stops orphaned container to prevent ghost records
+# - Exits with code 129 (128 + SIGHUP=1)
+# ------------------------------------------------------------------------------
+on_hangup() {
+  _send_abort_telemetry "129"
+  _stop_container_if_installing
+  exit 129
+}
+
 # ==============================================================================
-# SECTION 4: INITIALIZATION
+# SECTION 5: INITIALIZATION
 # ==============================================================================
 
 # ------------------------------------------------------------------------------
@@ -428,10 +496,11 @@ on_terminate() {
 #   * set -o pipefail: Pipeline fails if any command fails
 #   * set -u: (optional) Exit on undefined variable (if STRICT_UNSET=1)
 # - Sets up traps:
-#   * ERR → error_handler
-#   * EXIT → on_exit
-#   * INT → on_interrupt
-#   * TERM → on_terminate
+#   * ERR  → error_handler (script errors)
+#   * EXIT → on_exit      (any termination — cleanup + orphan detection)
+#   * INT  → on_interrupt  (Ctrl+C)
+#   * TERM → on_terminate  (kill / systemd stop)
+#   * HUP  → on_hangup     (SSH disconnect / terminal closed)
 # - Call this function early in every script
 # ------------------------------------------------------------------------------
 catch_errors() {
@@ -444,4 +513,5 @@ catch_errors() {
   trap on_exit EXIT
   trap on_interrupt INT
   trap on_terminate TERM
+  trap on_hangup HUP
 }

misc/tools.func

@@ -3692,20 +3692,22 @@ _setup_intel_arc() {
     # Add non-free repos
     _add_debian_nonfree "$os_codename"
 
-    # Arc requires latest drivers - fetch from GitHub
-    # Order matters: libigdgmm first (dependency), then IGC, then compute-runtime
-    msg_info "Fetching Intel compute-runtime for Arc support"
+    # For Trixie/Sid: Fetch latest drivers from GitHub (Debian repo packages may be too old or missing)
+    # For Bookworm: Use repo packages (GitHub latest requires libstdc++6 >= 13.1, unavailable on Bookworm)
+    if [[ "$os_codename" == "trixie" || "$os_codename" == "sid" ]]; then
+      msg_info "Fetching Intel compute-runtime from GitHub for Arc support"
 
-    # libigdgmm - bundled in compute-runtime releases (Debian version often too old)
-    fetch_and_deploy_gh_release "libigdgmm12" "intel/compute-runtime" "binary" "latest" "" "libigdgmm12_*_amd64.deb" || true
+      # libigdgmm - bundled in compute-runtime releases
+      fetch_and_deploy_gh_release "libigdgmm12" "intel/compute-runtime" "binary" "latest" "" "libigdgmm12_*_amd64.deb" || true
 
-    # Intel Graphics Compiler (note: packages have -2 suffix)
-    fetch_and_deploy_gh_release "intel-igc-core" "intel/intel-graphics-compiler" "binary" "latest" "" "intel-igc-core-2_*_amd64.deb" || true
-    fetch_and_deploy_gh_release "intel-igc-opencl" "intel/intel-graphics-compiler" "binary" "latest" "" "intel-igc-opencl-2_*_amd64.deb" || true
+      # Intel Graphics Compiler (note: packages have -2 suffix)
+      fetch_and_deploy_gh_release "intel-igc-core" "intel/intel-graphics-compiler" "binary" "latest" "" "intel-igc-core-2_*_amd64.deb" || true
+      fetch_and_deploy_gh_release "intel-igc-opencl" "intel/intel-graphics-compiler" "binary" "latest" "" "intel-igc-opencl-2_*_amd64.deb" || true
 
-    # Compute Runtime (depends on IGC and gmmlib)
-    fetch_and_deploy_gh_release "intel-opencl-icd" "intel/compute-runtime" "binary" "latest" "" "intel-opencl-icd_*_amd64.deb" || true
-    fetch_and_deploy_gh_release "intel-level-zero-gpu" "intel/compute-runtime" "binary" "latest" "" "libze-intel-gpu1_*_amd64.deb" || true
+      # Compute Runtime (depends on IGC and gmmlib)
+      fetch_and_deploy_gh_release "intel-opencl-icd" "intel/compute-runtime" "binary" "latest" "" "intel-opencl-icd_*_amd64.deb" || true
+      fetch_and_deploy_gh_release "intel-level-zero-gpu" "intel/compute-runtime" "binary" "latest" "" "libze-intel-gpu1_*_amd64.deb" || true
+    fi
 
     $STD apt -y install \
       intel-media-va-driver-non-free \
@@ -3714,6 +3716,9 @@ _setup_intel_arc() {
       libmfx-gen1.2 \
       vainfo \
       intel-gpu-tools 2>/dev/null || msg_warn "Some Intel Arc packages failed"
+
+    # Bookworm has compatible versions of these packages in repos
+    [[ "$os_codename" == "bookworm" ]] && $STD apt -y install intel-opencl-icd libigdgmm12 2>/dev/null || true
   fi
 
   msg_ok "Intel Arc GPU configured"

vm/archlinux-vm.sh

@@ -63,8 +63,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/debian-13-vm.sh

@@ -63,8 +63,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/debian-vm.sh

@@ -63,8 +63,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/docker-vm.sh

@@ -37,8 +37,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 
 function error_handler() {
   local exit_code="$?"

vm/haos-vm.sh

@@ -67,8 +67,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/mikrotik-routeros.sh

@@ -64,8 +64,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/nextcloud-vm.sh

@@ -63,8 +63,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/openwrt-vm.sh

@@ -68,8 +68,9 @@ CLOUD="${TAB}☁️${TAB}${CL}"
 set -Eeo pipefail
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/opnsense-vm.sh

@@ -44,6 +44,9 @@ CROSS="${RD}✗${CL}"
 set -Eeo pipefail
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/owncloud-vm.sh

@@ -64,8 +64,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/pimox-haos-vm.sh

@@ -72,8 +72,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/truenas-vm.sh

@@ -62,8 +62,9 @@ CLOUD="${TAB}☁️${TAB}${CL}"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/ubuntu2204-vm.sh

@@ -60,8 +60,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/ubuntu2404-vm.sh

@@ -63,8 +63,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/ubuntu2504-vm.sh

@@ -62,8 +62,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"

vm/umbrel-os-vm.sh

@@ -62,8 +62,9 @@ THIN="discard=on,ssd=1,"
 set -e
 trap 'error_handler $LINENO "$BASH_COMMAND"' ERR
 trap cleanup EXIT
-trap 'post_update_to_api "failed" "INTERRUPTED"' SIGINT
-trap 'post_update_to_api "failed" "TERMINATED"' SIGTERM
+trap 'post_update_to_api "failed" "130"' SIGINT
+trap 'post_update_to_api "failed" "143"' SIGTERM
+trap 'post_update_to_api "failed" "129"; exit 129' SIGHUP
 function error_handler() {
   local exit_code="$?"
   local line_number="$1"