diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 0efc524..915356a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,9 +1,9 @@
 # Prova il codice e pubblica l'immagine Docker su GitHub Container Registry (ghcr.io).
 #
-# - Pull request: prova i test e la compilazione dell'immagine (amd64), senza pubblicare.
-# - Push su main: pubblica `latest` e `sha-<commit>` (solo amd64: è la compilazione veloce).
+# - Pull request: esegue i test Linux e Windows e compila il Dockerfile per amd64, senza pubblicare immagini.
+# - Push su main: pubblica `latest` e `sha-<commit>` per amd64 e arm64.
 # - Tag `vX.Y.Z` (per esempio `git tag v0.2.0 && git push --tags`): pubblica `X.Y.Z`, `X.Y` e
-#   `latest`, per amd64 e arm64 (l'arm64 gira sotto emulazione: richiede parecchi minuti).
+#   `latest`, per amd64 e arm64 (build nativi paralleli, senza QEMU).
 #
 # L'immagine: ghcr.io/<utente>/altkeeper. Se il repo è privato lo è anche il pacchetto: per
 # usarlo da un server serve `docker login ghcr.io` con un token che possa leggere i pacchetti,
@@ -28,6 +28,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
+      - name: Check localized web UI
+        run: node scripts/check-web-ui.cjs
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked
@@ -44,6 +46,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v7
+      - name: Check localized web UI
+        run: node scripts/check-web-ui.cjs
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@v2
       - run: cargo test --locked
@@ -60,43 +64,121 @@ jobs:
           $output = cargo run --locked -- --help
           if ($LASTEXITCODE -ne 0 -or -not ($output -match '^uso: altkeeper')) { throw "Italian CLI help failed: $output" }
 
-  image:
-    needs: test
+  build-pr:
+    if: github.event_name == 'pull_request'
+    needs: [test, test-windows]
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
     steps:
       - uses: actions/checkout@v7
-
-      - uses: docker/setup-qemu-action@v4
       - uses: docker/setup-buildx-action@v4
+      - uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: linux/amd64
+          push: false
+          cache-from: type=gha,scope=altkeeper-amd64
 
-      # Il login serve solo per pubblicare: le pull request non hanno il permesso di scrivere.
+  image:
+    # Build architectures concurrently on native runners for publishing.
+    if: github.event_name != 'pull_request'
+    needs: [test, test-windows]
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+          - arch: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@v7
+      # No QEMU: Rust is compiled natively for each target.
+      - uses: docker/setup-buildx-action@v4
       - uses: docker/login-action@v4
-        if: github.event_name != 'pull_request'
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - id: image-name
+        run: echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
+      - id: meta
+        uses: docker/metadata-action@v6
+        with:
+          images: ${{ steps.image-name.outputs.image }}
+      - id: build
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          platforms: ${{ matrix.platform }}
+          # Immutable per-arch pushes; only the final manifest receives tags.
+          outputs: type=image,name=${{ steps.image-name.outputs.image }},push-by-digest=true,name-canonical=true,push=true
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha,scope=altkeeper-${{ matrix.arch }}
+          cache-to: type=gha,scope=altkeeper-${{ matrix.arch }},mode=max
+      - name: Export image digest
+        run: |
+          mkdir -p "${RUNNER_TEMP}/digests"
+          digest="${{ steps.build.outputs.digest }}"
+          test -n "${digest}"
+          touch "${RUNNER_TEMP}/digests/${digest#sha256:}"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ matrix.arch }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
 
+  image-manifest:
+    # Publish tags only after both architecture builds succeed.
+    if: github.event_name != 'pull_request'
+    needs: [image]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+      - uses: docker/setup-buildx-action@v4
+      - uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - id: image-name
+        run: echo "image=ghcr.io/${GITHUB_REPOSITORY,,}" >> "$GITHUB_OUTPUT"
       - id: meta
         uses: docker/metadata-action@v6
         with:
-          images: ghcr.io/${{ github.repository }}
+          images: ${{ steps.image-name.outputs.image }}
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/v') }}
             type=sha
-
-      - uses: docker/build-push-action@v7
-        with:
-          context: .
-          # I tag di versione pubblicano anche arm64; il resto solo amd64 (più rapido).
-          platforms: ${{ startsWith(github.ref, 'refs/tags/v') && 'linux/amd64,linux/arm64' || 'linux/amd64' }}
-          push: ${{ github.event_name != 'pull_request' }}
-          tags: ${{ steps.meta.outputs.tags }}
-          labels: ${{ steps.meta.outputs.labels }}
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create multi-platform manifest
+        working-directory: ${{ runner.temp }}/digests
+        env:
+          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
+        run: |
+          # Never publish a partial multi-architecture manifest.
+          test "$(find . -maxdepth 1 -type f | wc -l)" -eq 2
+          docker buildx imagetools create \
+            $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
+            $(printf '${{ steps.image-name.outputs.image }}@sha256:%s ' *)
+      - name: Inspect published manifest
+        env:
+          DOCKER_METADATA_OUTPUT_JSON: ${{ steps.meta.outputs.json }}
+        run: |
+          docker buildx imagetools inspect "$(jq -r '.tags[0]' <<< "$DOCKER_METADATA_OUTPUT_JSON")"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..dfa1300
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,105 @@
+# Compila AltKeeper per Windows, Linux e macOS e pubblica tutto in una GitHub Release.
+#
+# - Windows: `altkeeper.exe` + `altkeeper.exe.sha256`. L'aggiornamento dall'icona nella barra di
+#   sistema scarica proprio questi due file: i nomi non vanno cambiati.
+# - Linux (x86-64 e arm64) e macOS (Apple Silicon e Intel): `altkeeper-<tag>-<sistema>-<arch>.tar.gz`
+#   con il suo `.sha256`. Sono download manuali: l'auto-aggiornamento è solo per Windows.
+#
+# Si lancia con un tag, per esempio: git tag v0.3.1 && git push origin v0.3.1
+# Il numero del tag deve coincidere con `version` in Cargo.toml.
+name: release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    strategy:
+      fail-fast: true
+      matrix:
+        include:
+          - name: windows
+            runner: windows-latest
+            test: true
+          # ubuntu-22.04: glibc 2.35, così il binario gira anche su distribuzioni non recentissime.
+          - name: linux-x86_64
+            runner: ubuntu-22.04
+            test: true
+          - name: linux-aarch64
+            runner: ubuntu-22.04-arm
+            test: true
+          - name: macos-aarch64
+            runner: macos-latest
+            test: false
+          - name: macos-x86_64
+            runner: macos-15-intel
+            test: false
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec # stable
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2
+      - name: Check that the tag matches Cargo.toml
+        run: |
+          version=$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)
+          if [ "v$version" != "${GITHUB_REF_NAME}" ]; then
+            echo "tag ${GITHUB_REF_NAME} != Cargo.toml v$version"; exit 1
+          fi
+      - name: Test
+        if: matrix.test
+        run: cargo test --locked
+      - run: cargo build --release --locked
+      - name: Package (Windows)
+        if: matrix.name == 'windows'
+        run: |
+          mkdir dist
+          cp target/release/altkeeper.exe dist/altkeeper.exe
+          cd dist
+          hash=$(sha256sum altkeeper.exe | cut -d' ' -f1)
+          printf '%s  altkeeper.exe' "$hash" > altkeeper.exe.sha256
+      - name: Package (Linux, macOS)
+        if: matrix.name != 'windows'
+        run: |
+          pkg="altkeeper-${GITHUB_REF_NAME}-${{ matrix.name }}"
+          mkdir -p "dist/$pkg"
+          cp target/release/altkeeper LICENSE README.md README.it.md "dist/$pkg/"
+          cp -r examples "dist/$pkg/examples"
+          cd dist
+          tar -czf "$pkg.tar.gz" "$pkg"
+          rm -rf "$pkg"
+          if command -v sha256sum >/dev/null; then
+            sha256sum "$pkg.tar.gz" > "$pkg.tar.gz.sha256"
+          else
+            shasum -a 256 "$pkg.tar.gz" > "$pkg.tar.gz.sha256"
+          fi
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: dist-${{ matrix.name }}
+          path: dist/*
+          if-no-files-found: error
+          retention-days: 1
+
+  publish:
+    # Una sola release, creata solo se tutte le build sono riuscite.
+    needs: [build]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        with:
+          path: dist
+          pattern: dist-*
+          merge-multiple: true
+      - name: List files
+        run: ls -l dist
+      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        with:
+          files: dist/*
+          fail_on_unmatched_files: true
diff --git a/.gitignore b/.gitignore
index f30d0ff..4ae32c4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -23,3 +23,6 @@ notify.conf
 renew.log
 .ultimo-errore
 /profili-salvati/
+altkeeper.log
+altkeeper.log.1
+altkeeper.new.exe
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c1550fe..ca11e1a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,8 +1,11 @@
 # Changelog
 
-## Unreleased
+## 0.3.0
 
 ### Fixed
+- **USB on Windows without configuration.** When `USBMUXD_SOCKET_ADDRESS` is not set, Windows now
+  uses the usbmuxd of iTunes / Apple Devices on `127.0.0.1:27015` instead of failing to find the
+  phone. Ported from the USB-fix branch.
 - **Install hung forever over USB on iOS 27.** On USB, installing an IPA now goes through AFC + installation_proxy via usbmuxd (same path as `pymobiledevice3 apps install`) instead of the CoreDeviceProxy software tunnel, and the profile client prefers the lockdown service too. App install and profile install now have timeouts, so a stuck phone produces an error instead of a silent hang. The status line says "over USB" or "over Wi-Fi" according to the real transport. Not compiled in this environment: please run `cargo build` and test.
 
 ### Changed
@@ -17,6 +20,20 @@
   unattended renewals (profiles + App IDs) work again.
 
 ### Added
+- **Windows tray icon (`altkeeper tray`, also what a double-click on `altkeeper.exe` starts).**
+  AltServer and the web page run without a terminal, with an icon next to the clock (AltKeeper
+  logo, grey while the iPhone is unreachable), a menu (*Open AltKeeper*, *Show logs*, *Start with
+  Windows*, *Check for updates*, *Quit*), a window with the web page (WebView2) and toast
+  notifications for renewed profiles, installed apps and failures. Ported from AltKeeperPlus.
+- **Updates from the tray and `release.yml`.** The icon checks the fork's GitHub releases once a
+  day; *Update now* verifies the SHA-256, restarts and rolls back if the new version does not
+  start. `release.yml` builds `altkeeper.exe` for Windows on a `v*` tag. Ported from AltKeeperPlus.
+- **Persistent logs.** Server lines (AltServer, web page, DNS-SD) carry a timestamp and are
+  also written to `altkeeper.log` (rotated at 5 MB) and shown in a new **Logs** section of the
+  web page (`/api/logs`). Ported from AltKeeperPlus.
+- **AltKeeper logo as the icon of `altkeeper.exe`** (embedded by the new `build.rs` on Windows builds, from `assets/altkeeper.ico`), besides the tray and window icons.
+- **App / App ID counters** next to "Your apps" in the web page (3 active apps and 10 App IDs for
+  a free account; an estimate from the profiles on the phone). Ported from the USB-fix branch.
 - **USB when the iPhone is plugged into the machine running AltKeeper.** Every connection (check, renew, sign and install, AltServer) first looks for an iPhone on USB through the local `usbmuxd` (or the one in `USBMUXD_SOCKET_ADDRESS`) and talks to it through the CoreDeviceProxy tunnel; if there is none, or it fails, it falls back to Wi-Fi as before. Much faster for installing IPAs. Needs the phone to already trust the computer (the usual "Trust" prompt), not the remote pairing. `--phone <ip:port>` forces Wi-Fi; `ALTKEEPER_NO_USB=1` turns USB off. In Docker the usbmuxd socket must be mounted into the container.
 - `ALTKEEPER_REVOKE_CERTS=1`: when installing an IPA from the web page fails with Apple error 7460 (the Apple ID already has a development certificate, e.g. from AltStore/SideStore), AltKeeper can revoke it and create its own. Off by default; without it you now get a clear explanation instead of a generic error.
 - **Windows support (native, no Docker).** `cargo build --release` on Windows 10/11 produces
diff --git a/Cargo.lock b/Cargo.lock
index 332f00a..14d24f6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -75,19 +75,40 @@ dependencies = [
 
 [[package]]
 name = "altkeeper"
-version = "0.2.0"
+version = "0.3.0"
 dependencies = [
  "axum",
+ "chrono",
  "idevice",
  "isideload",
  "mdns-sd",
  "plist",
+ "reqwest",
  "rpassword",
  "rustls",
  "serde",
  "serde_json",
+ "sha2 0.10.9",
+ "tao",
+ "tauri-winrt-notification",
+ "tempfile",
  "tokio",
  "tracing-subscriber",
+ "tray-icon",
+ "windows-sys 0.61.2",
+ "winreg",
+ "winresource",
+ "wry",
+ "zip",
+]
+
+[[package]]
+name = "android_system_properties"
+version = "0.1.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae221649c9976a6f6c56ae1facf410f3ddb33cc661c4b7b61020a912d4237fbc"
+dependencies = [
+ "libc",
 ]
 
 [[package]]
@@ -115,7 +136,7 @@ dependencies = [
  "sha2 0.10.9",
  "sha2 0.11.0",
  "spki 0.7.3",
- "thiserror",
+ "thiserror 2.0.20",
  "x509-cert 0.2.5",
 ]
 
@@ -131,7 +152,7 @@ dependencies = [
  "nom",
  "num-traits",
  "rusticata-macros",
- "thiserror",
+ "thiserror 2.0.20",
  "time",
 ]
 
@@ -214,11 +235,34 @@ dependencies = [
  "crc32fast",
  "futures-lite",
  "pin-project",
- "thiserror",
+ "thiserror 2.0.20",
  "tokio",
  "tokio-util",
 ]
 
+[[package]]
+name = "atk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "241b621213072e993be4f6f3a9e4b45f65b7e6faad43001be957184b7bb1824b"
+dependencies = [
+ "atk-sys",
+ "glib",
+ "libc",
+]
+
+[[package]]
+name = "atk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c5e48b684b0ca77d2bbadeef17424c2ea3c897d44d566a1617e7e8f30614d086"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -310,6 +354,21 @@ version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
+[[package]]
+name = "bit-set"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"
+dependencies = [
+ "bit-vec 0.8.0",
+]
+
+[[package]]
+name = "bit-vec"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"
+
 [[package]]
 name = "bit-vec"
 version = "0.9.1"
@@ -319,6 +378,12 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "bitflags"
+version = "1.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
+
 [[package]]
 name = "bitflags"
 version = "2.13.2"
@@ -361,6 +426,15 @@ dependencies = [
  "hybrid-array",
 ]
 
+[[package]]
+name = "block2"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdeb9d870516001442e364c5220d3574d2da8dc765554b4a617230d33fa58ef5"
+dependencies = [
+ "objc2",
+]
+
 [[package]]
 name = "bumpalo"
 version = "3.20.3"
@@ -379,6 +453,31 @@ version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fc652a48c352aef3ea3aed32080501cf3ef6ed5da78602a020c991775b0aff04"
 
+[[package]]
+name = "cairo-rs"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8ca26ef0159422fb77631dc9d17b102f253b876fe1586b03b803e63a309b4ee2"
+dependencies = [
+ "bitflags 2.13.2",
+ "cairo-sys-rs",
+ "glib",
+ "libc",
+ "once_cell",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "cairo-sys-rs"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "685c9fa8e590b8b3d678873528d83411db17242a73fccaed827770ea0fedda51"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
 [[package]]
 name = "cbc"
 version = "0.1.2"
@@ -407,6 +506,22 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
+[[package]]
+name = "cfg-expr"
+version = "0.15.8"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d067ad48b8650848b989a59a86c6c36a995d02d2bf778d45c3c5d57bc2718f02"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
 [[package]]
 name = "cfg-if"
 version = "1.0.5"
@@ -454,8 +569,10 @@ version = "0.4.45"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1aa79e62e7697b8e29b513a68abacf485adcd1fe8284a4316c5ae868e6633327"
 dependencies = [
+ "iana-time-zone",
  "num-traits",
  "serde",
+ "windows-link",
 ]
 
 [[package]]
@@ -558,6 +675,16 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a6ef517f0926dd24a1582492c791b6a4818a4d94e789a334894aa15b0d12f55c"
 
+[[package]]
+name = "cookie"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a373e3602691c3cdea496d2f0ee5935151e6168fe87739483c463db1b2f2f87"
+dependencies = [
+ "time",
+ "version_check",
+]
+
 [[package]]
 name = "core-foundation"
 version = "0.9.4"
@@ -584,6 +711,30 @@ version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"
 
+[[package]]
+name = "core-graphics"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "064badf302c3194842cf2c5d61f56cc88e54a759313879cdf03abdd27d0c3b97"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.10.1",
+ "core-graphics-types",
+ "foreign-types 0.5.0",
+ "libc",
+]
+
+[[package]]
+name = "core-graphics-types"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3d44a101f213f6c4cdc1853d4b78aef6db6bdfa3468798cc1d9912f4735013eb"
+dependencies = [
+ "bitflags 2.13.2",
+ "core-foundation 0.10.1",
+ "libc",
+]
+
 [[package]]
 name = "core_detect"
 version = "1.0.0"
@@ -623,6 +774,15 @@ dependencies = [
  "cfg-if",
 ]
 
+[[package]]
+name = "crossbeam-channel"
+version = "0.5.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "98b0cc327b5bc766e7fda9c9260cc0fa81b43a8e240440422dff70788e3f9ef1"
+dependencies = [
+ "crossbeam-utils",
+]
+
 [[package]]
 name = "crossbeam-deque"
 version = "0.8.8"
@@ -684,6 +844,29 @@ dependencies = [
  "rand_core 0.10.1",
 ]
 
+[[package]]
+name = "cssparser"
+version = "0.37.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8c9cdaae01d5ed7882b04d795e7f752f46ff52d2fa3b50a20d28c464510bba98"
+dependencies = [
+ "cssparser-macros",
+ "dtoa-short",
+ "itoa",
+ "phf",
+ "smallvec",
+]
+
+[[package]]
+name = "cssparser-macros"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d045de693cb712d0b22c6a64be5b953f67b3ce00ab5ad3dd5d8b441886ab8e1a"
+dependencies = [
+ "quote",
+ "syn 3.0.6",
+]
+
 [[package]]
 name = "ctr"
 version = "0.10.1"
@@ -735,6 +918,17 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4583a4551df46e2792f82ceeac45e850d2e2d5debba0b91f102385cda5b11f06"
 
+[[package]]
+name = "dbus"
+version = "0.9.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ab69f03cc8c4340c9c8e315114e1658e6775a9b16a04357973aa21cec22b32e"
+dependencies = [
+ "libc",
+ "libdbus-sys",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -803,6 +997,27 @@ version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7cd812cc2bc1d69d4764bd80df88b4317eaef9e773c75226407d9bc0876b211c"
 
+[[package]]
+name = "derive_more"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d751e9e49156b02b44f9c1815bcb94b984cdcc4396ecc32521c739452808b134"
+dependencies = [
+ "derive_more-impl",
+]
+
+[[package]]
+name = "derive_more-impl"
+version = "2.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "799a97264921d8623a957f6c3b9011f3b5492f557bbb7a5a19b7fa6d06ba8dcb"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "rustc_version",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "des"
 version = "0.9.0"
@@ -836,6 +1051,39 @@ dependencies = [
  "ctutils",
 ]
 
+[[package]]
+name = "dirs"
+version = "7.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8d57d423b3c82e89b9a24ca3091fee61f456a26edbd28d26c65906f4bc1dcd8f"
+dependencies = [
+ "dirs-sys",
+]
+
+[[package]]
+name = "dirs-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e01a3366d27ee9890022452ee61b2b63a67e6f13f58900b651ff5665f0bb1fab"
+dependencies = [
+ "libc",
+ "option-ext",
+ "redox_users",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "dispatch2"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "libc",
+ "objc2",
+]
+
 [[package]]
 name = "displaydoc"
 version = "0.2.7"
@@ -847,6 +1095,71 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "dlopen2"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5e2c5bd4158e66d1e215c49b837e11d62f3267b30c92f1d171c4d3105e3dc4d4"
+dependencies = [
+ "dlopen2_derive",
+ "libc",
+ "once_cell",
+ "winapi",
+]
+
+[[package]]
+name = "dlopen2_derive"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbbb781877580993a8707ec48672673ec7b81eeba04cfd2310bd28c08e47c8f"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "dom_query"
+version = "0.28.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fac5fca71e65e94cc718a6e2af65d6e0f9c6027751c2aa562fbb5087fda639bc"
+dependencies = [
+ "bit-set",
+ "cssparser",
+ "foldhash",
+ "html5ever",
+ "precomputed-hash",
+ "selectors",
+ "tendril",
+]
+
+[[package]]
+name = "dpi"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d8b14ccef22fc6f5a8f4d7d768562a182c04ce9a3b3157b91390b52ddfdf1a76"
+
+[[package]]
+name = "dtoa"
+version = "1.0.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4c3cf4824e2d5f025c7b531afcb2325364084a16806f6d47fbc1f5fbd9960590"
+
+[[package]]
+name = "dtoa-short"
+version = "0.3.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cd1511a7b6a56299bd043a9c167a6d2bfb37bf84a6dfceaba651168adfb43c87"
+dependencies = [
+ "dtoa",
+]
+
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "ed25519"
 version = "2.2.3"
@@ -915,12 +1228,31 @@ version = "2.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
 
+[[package]]
+name = "fdeflate"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e6853b52649d4ac5c0bd02320cddc5ba956bdb407c4b75a2c6b75bf51500f8c"
+dependencies = [
+ "simd-adler32",
+]
+
 [[package]]
 name = "fiat-crypto"
 version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "28dea519a9695b9977216879a3ebfddf92f1c08c05d984f8996aecd6ecdc811d"
 
+[[package]]
+name = "field-offset"
+version = "0.3.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38e2275cc4e4fc009b0669731a1e5ab7ebf11f469eaede2bab9309a5b4d6057f"
+dependencies = [
+ "memoffset",
+ "rustc_version",
+]
+
 [[package]]
 name = "find-msvc-tools"
 version = "0.1.13"
@@ -940,7 +1272,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6e634e2e0ebac1ee034020da1ca582e17ffe4e0f5e985823721e168928136dcb"
 dependencies = [
  "crc32fast",
- "miniz_oxide",
+ "miniz_oxide 0.9.1",
  "zlib-rs",
 ]
 
@@ -961,13 +1293,40 @@ version = "1.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3f9eec918d3f24069decb9af1554cad7c880e2da24a9afd88aca000531ab82c1"
 
+[[package]]
+name = "foldhash"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
+
 [[package]]
 name = "foreign-types"
 version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
 dependencies = [
- "foreign-types-shared",
+ "foreign-types-shared 0.1.1",
+]
+
+[[package]]
+name = "foreign-types"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
+dependencies = [
+ "foreign-types-macros",
+ "foreign-types-shared 0.3.1",
+]
+
+[[package]]
+name = "foreign-types-macros"
+version = "0.2.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ea5190182e6915eb873ddbc16e23b711b6eb1f9c00a0d0a3a91b5f6228475225"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -976,6 +1335,12 @@ version = "0.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
 
+[[package]]
+name = "foreign-types-shared"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa9a19cbb55df58761df49b23516a86d432839add4af60fc256da840f66ed35b"
+
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -1087,52 +1452,151 @@ dependencies = [
 ]
 
 [[package]]
-name = "generic-array"
-version = "0.14.7"
+name = "gdk"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+checksum = "d9f245958c627ac99d8e529166f9823fb3b838d1d41fd2b297af3075093c2691"
 dependencies = [
- "typenum",
- "version_check",
+ "cairo-rs",
+ "gdk-pixbuf",
+ "gdk-sys",
+ "gio",
+ "glib",
+ "libc",
+ "pango",
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.2.17"
+name = "gdk-pixbuf"
+version = "0.18.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+checksum = "50e1f5f1b0bfb830d6ccc8066d18db35c487b1b2b1e8589b5dfe9f07e8defaec"
 dependencies = [
- "cfg-if",
- "js-sys",
+ "gdk-pixbuf-sys",
+ "gio",
+ "glib",
  "libc",
- "wasi",
- "wasm-bindgen",
+ "once_cell",
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.3.4"
+name = "gdk-pixbuf-sys"
+version = "0.18.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+checksum = "3f9839ea644ed9c97a34d129ad56d38a25e6756f99f3a88e15cd39c20629caf7"
 dependencies = [
- "cfg-if",
- "js-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
  "libc",
- "r-efi 5.3.0",
- "wasip2",
- "wasm-bindgen",
+ "system-deps",
 ]
 
 [[package]]
-name = "getrandom"
-version = "0.4.3"
+name = "gdk-sys"
+version = "0.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+checksum = "5c2d13f38594ac1e66619e188c6d5a1adb98d11b2fcf7894fc416ad76aa2f3f7"
 dependencies = [
- "cfg-if",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
  "libc",
- "r-efi 6.0.0",
- "rand_core 0.10.1",
+ "pango-sys",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gdkwayland-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "140071d506d223f7572b9f09b5e155afbd77428cd5cc7af8f2694c41d98dfe69"
+dependencies = [
+ "gdk-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pkg-config",
+ "system-deps",
+]
+
+[[package]]
+name = "gdkx11"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3caa00e14351bebbc8183b3c36690327eb77c49abc2268dd4bd36b856db3fbfe"
+dependencies = [
+ "gdk",
+ "gdkx11-sys",
+ "gio",
+ "glib",
+ "libc",
+ "x11",
+]
+
+[[package]]
+name = "gdkx11-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e7445fe01ac26f11601db260dd8608fe172514eb63b3b5e261ea6b0f4428d"
+dependencies = [
+ "gdk-sys",
+ "glib-sys",
+ "libc",
+ "system-deps",
+ "x11",
+]
+
+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ff2abc00be7fca6ebc474524697ae276ad847ad0a6b3faa4bcb027e9a4614ad0"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "wasi",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "899def5c37c4fd7b2664648c28120ecec138e4d395b459e5ca34f9cce2dd77fd"
+dependencies = [
+ "cfg-if",
+ "js-sys",
+ "libc",
+ "r-efi 5.3.0",
+ "wasip2",
+ "wasm-bindgen",
+]
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi 6.0.0",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -1144,6 +1608,148 @@ dependencies = [
  "polyval",
 ]
 
+[[package]]
+name = "gio"
+version = "0.18.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d4fc8f532f87b79cbc51a79748f16a6828fb784be93145a322fa14d06d354c73"
+dependencies = [
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "gio-sys",
+ "glib",
+ "libc",
+ "once_cell",
+ "pin-project-lite",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "gio-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "37566df850baf5e4cb0dfb78af2e4b9898d817ed9263d1090a2df958c64737d2"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+ "winapi",
+]
+
+[[package]]
+name = "glib"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "233daaf6e83ae6a12a52055f568f9d7cf4671dabb78ff9560ab6da230ce00ee5"
+dependencies = [
+ "bitflags 2.13.2",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-task",
+ "futures-util",
+ "gio-sys",
+ "glib-macros",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "memchr",
+ "once_cell",
+ "smallvec",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "glib-macros"
+version = "0.18.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bb0228f477c0900c880fd78c8759b95c7636dbd7842707f49e132378aa2acdc"
+dependencies = [
+ "heck 0.4.1",
+ "proc-macro-crate 2.0.2",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "glib-sys"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "063ce2eb6a8d0ea93d2bf8ba1957e78dbab6be1c2220dd3daca57d5a9d869898"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gobject-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0850127b514d1c4a4654ead6dedadb18198999985908e6ffe4436f53c785ce44"
+dependencies = [
+ "glib-sys",
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fd56fb197bfc42bd5d2751f4f017d44ff59fbb58140c6b49f9b3b2bdab08506a"
+dependencies = [
+ "atk",
+ "cairo-rs",
+ "field-offset",
+ "futures-channel",
+ "gdk",
+ "gdk-pixbuf",
+ "gio",
+ "glib",
+ "gtk-sys",
+ "gtk3-macros",
+ "libc",
+ "pango",
+ "pkg-config",
+]
+
+[[package]]
+name = "gtk-sys"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f29a1c21c59553eb7dd40e918be54dccd60c52b049b75119d5d96ce6b624414"
+dependencies = [
+ "atk-sys",
+ "cairo-sys-rs",
+ "gdk-pixbuf-sys",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "pango-sys",
+ "system-deps",
+]
+
+[[package]]
+name = "gtk3-macros"
+version = "0.18.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "52ff3c5b21f14f0736fed6dcfc0bfb4225ebf5725f3c0209edeec181e4d73e9d"
+dependencies = [
+ "proc-macro-crate 1.3.1",
+ "proc-macro-error",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "h2"
 version = "0.4.19"
@@ -1175,6 +1781,18 @@ version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
+[[package]]
+name = "heck"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "95505c38b4572b2d910cecb0281560f54b440a19336cbbcb27bf6ce6adc6f5a8"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hex"
 version = "0.4.3"
@@ -1208,6 +1826,16 @@ dependencies = [
  "digest 0.11.3",
 ]
 
+[[package]]
+name = "html5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46a1761807faccc9a19e86944bbf40610014066306f96edcdedc2fb714bcb7b8"
+dependencies = [
+ "log",
+ "markup5ever",
+]
+
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -1340,6 +1968,30 @@ dependencies = [
  "windows-registry",
 ]
 
+[[package]]
+name = "iana-time-zone"
+version = "0.1.65"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e31bc9ad994ba00e440a8aa5c9ef0ec67d5cb5e5cb0cc7f8b744a35b389cc470"
+dependencies = [
+ "android_system_properties",
+ "core-foundation-sys",
+ "iana-time-zone-haiku",
+ "js-sys",
+ "log",
+ "wasm-bindgen",
+ "windows-core",
+]
+
+[[package]]
+name = "iana-time-zone-haiku"
+version = "0.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31827a206f56af32e590ba56d5d2d085f558508192593743f16b2306495269f"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "icu_collections"
 version = "2.3.0"
@@ -1454,7 +2106,7 @@ dependencies = [
  "sha1 0.10.7",
  "sha2 0.10.9",
  "siphasher",
- "thiserror",
+ "thiserror 2.0.20",
  "tokio",
  "tokio-rustls",
  "tracing",
@@ -1579,7 +2231,7 @@ dependencies = [
  "sha1 0.11.0",
  "sha2 0.11.0",
  "srp",
- "thiserror",
+ "thiserror 2.0.20",
  "tokio",
  "tokio-tungstenite",
  "tracing",
@@ -1609,7 +2261,7 @@ dependencies = [
  "rc2",
  "sha1 0.11.0",
  "sha2 0.11.0",
- "thiserror",
+ "thiserror 2.0.20",
  "x509-parser",
 ]
 
@@ -1625,6 +2277,29 @@ version = "1.0.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
 
+[[package]]
+name = "javascriptcore-rs"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca5671e9ffce8ffba57afc24070e906da7fc4b1ba66f2cabebf61bf2ea257fcc"
+dependencies = [
+ "bitflags 1.3.2",
+ "glib",
+ "javascriptcore-rs-sys",
+]
+
+[[package]]
+name = "javascriptcore-rs-sys"
+version = "1.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "af1be78d14ffa4b75b66df31840478fef72b51f8c2465d4ca7c194da9f7a5124"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
 [[package]]
 name = "jktcp"
 version = "0.1.7"
@@ -1640,6 +2315,22 @@ dependencies = [
  "wasmtimer",
 ]
 
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys 0.3.1",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
 [[package]]
 name = "jni"
 version = "0.22.4"
@@ -1649,10 +2340,10 @@ dependencies = [
  "cfg-if",
  "combine",
  "jni-macros",
- "jni-sys",
+ "jni-sys 0.4.1",
  "log",
  "simd_cesu8",
- "thiserror",
+ "thiserror 2.0.20",
  "walkdir",
  "windows-link",
 ]
@@ -1670,6 +2361,15 @@ dependencies = [
  "syn 2.0.119",
 ]
 
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
 [[package]]
 name = "jni-sys"
 version = "0.4.1"
@@ -1709,6 +2409,16 @@ dependencies = [
  "cpufeatures 0.2.17",
 ]
 
+[[package]]
+name = "keyboard-types"
+version = "0.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0fbe853b403ae61a04233030ae8a79d94975281ed9770a1f9e246732b534b28d"
+dependencies = [
+ "bitflags 2.13.2",
+ "serde",
+]
+
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -1718,18 +2428,70 @@ dependencies = [
  "spin",
 ]
 
+[[package]]
+name = "libappindicator"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03589b9607c868cc7ae54c0b2a22c8dc03dd41692d48f2d7df73615c6a95dc0a"
+dependencies = [
+ "glib",
+ "gtk",
+ "gtk-sys",
+ "libappindicator-sys",
+ "log",
+]
+
+[[package]]
+name = "libappindicator-sys"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e9ec52138abedcc58dc17a7c6c0c00a2bdb4f3427c7f63fa97fd0d859155caf"
+dependencies = [
+ "gtk-sys",
+ "libloading",
+ "once_cell",
+]
+
 [[package]]
 name = "libc"
 version = "0.2.189"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
 
+[[package]]
+name = "libdbus-sys"
+version = "0.2.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "328c4789d42200f1eeec05bd86c9c13c7f091d2ba9a6ea35acdf51f31bc0f043"
+dependencies = [
+ "pkg-config",
+]
+
+[[package]]
+name = "libloading"
+version = "0.7.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b67380fd3b2fbe7527a606e18729d21c6f3951633d0500574c4dc22d2d638b9f"
+dependencies = [
+ "cfg-if",
+ "winapi",
+]
+
 [[package]]
 name = "libm"
 version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "libredox"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61ff90caf6077a803a240f62fdbe88645a890bbca49ef8174c3cb0404362171d"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -1757,6 +2519,17 @@ version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
+[[package]]
+name = "markup5ever"
+version = "0.39.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7122d987ec5f704ee56f6e5b41a7d93722e9aae27ae07cafa4036c4d3f9757de"
+dependencies = [
+ "log",
+ "tendril",
+ "web_atoms",
+]
+
 [[package]]
 name = "matchers"
 version = "0.2.0"
@@ -1813,17 +2586,36 @@ dependencies = [
 ]
 
 [[package]]
-name = "mime"
-version = "0.3.17"
+name = "memoffset"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
-
-[[package]]
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
+[[package]]
+name = "mime"
+version = "0.3.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6877bb514081ee2a7ff5ef9de3281f14a4dd4bceac4c09388074a6b5df8a139a"
+
+[[package]]
 name = "minimal-lexical"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
+[[package]]
+name = "miniz_oxide"
+version = "0.8.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fa76a2c86f704bdb222d66965fb3d63269ce38518b83cb0575fca855ebb6316"
+dependencies = [
+ "adler2",
+ "simd-adler32",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.9.1"
@@ -1846,6 +2638,26 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "muda"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4340e89c178916e62879c5c36b7f699019369be413e496178a6983ce91b8bc03"
+dependencies = [
+ "crossbeam-channel",
+ "dpi",
+ "gtk",
+ "keyboard-types",
+ "libc",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "png",
+ "thiserror 2.0.20",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "multer"
 version = "3.1.0"
@@ -1907,6 +2719,42 @@ dependencies = [
  "tempfile",
 ]
 
+[[package]]
+name = "ndk"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3f42e7bbe13d351b6bead8286a43aac9534b82bd3cc43e47037f012ebfd62d4"
+dependencies = [
+ "bitflags 2.13.2",
+ "jni-sys 0.3.1",
+ "log",
+ "ndk-sys",
+ "num_enum",
+ "raw-window-handle",
+ "thiserror 1.0.69",
+]
+
+[[package]]
+name = "ndk-context"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "27b02d87554356db9e9a873add8782d4ea6e3e58ea071a9adb9a2e8ddb884a8b"
+
+[[package]]
+name = "ndk-sys"
+version = "0.6.0+11769913"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6cda3051665f1fb8d9e08fc35c96d5a244fb1be711a03b71118828afc9a873"
+dependencies = [
+ "jni-sys 0.3.1",
+]
+
+[[package]]
+name = "new_debug_unreachable"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086"
+
 [[package]]
 name = "nom"
 version = "7.1.3"
@@ -1987,6 +2835,222 @@ dependencies = [
  "libm",
 ]
 
+[[package]]
+name = "num_enum"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d0bca838442ec211fa11de3a8b0e0e8f3a4522575b5c4c06ed722e005036f26"
+dependencies = [
+ "num_enum_derive",
+ "rustversion",
+]
+
+[[package]]
+name = "num_enum_derive"
+version = "0.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "680998035259dcfcafe653688bf2aa6d3e2dc05e98be6ab46afb089dc84f1df8"
+dependencies = [
+ "proc-macro-crate 3.5.0",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "objc2"
+version = "0.6.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "08849bbd4767dfae9457696856ae1c84fe4e0281bbe4a7abff2d0e06fb7981f8"
+dependencies = [
+ "objc2-encode",
+ "objc2-exception-helper",
+]
+
+[[package]]
+name = "objc2-app-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-cloud-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "73ad74d880bb43877038da939b7427bba67e9dd42004a18b809ba7d87cee241c"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-data"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0b402a653efbb5e82ce4df10683b6b28027616a2715e90009947d50b8dd298fa"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2",
+]
+
+[[package]]
+name = "objc2-core-graphics"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e022c9d066895efa1345f8e33e584b9f958da2fd4cd116792e15e07e4720a807"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-io-surface",
+]
+
+[[package]]
+name = "objc2-core-image"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e5d563b38d2b97209f8e861173de434bd0214cf020e3423a52624cd1d989f006"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-location"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-core-text"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0cde0dfb48d25d2b4862161a4d5fcc0e3c24367869ad306b0c9ec0073bfed92d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+]
+
+[[package]]
+name = "objc2-encode"
+version = "4.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef25abbcd74fb2609453eb695bd2f860d389e457f67dc17cafc8b8cbc89d0c33"
+
+[[package]]
+name = "objc2-exception-helper"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c7a1c5fbb72d7735b076bb47b578523aedc40f3c439bea6dfd595c089d79d98a"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "objc2-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-io-surface"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "180788110936d59bab6bd83b6060ffdfffb3b922ba1396b312ae795e1de9d81d"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+]
+
+[[package]]
+name = "objc2-quartz-core"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "96c1358452b371bf9f104e21ec536d37a650eb10f7ee379fff67d2e08d537f1f"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-ui-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d87d638e33c06f577498cbcc50491496a3ed4246998a7fbba7ccb98b1e7eab22"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-cloud-kit",
+ "objc2-core-data",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-core-image",
+ "objc2-core-location",
+ "objc2-core-text",
+ "objc2-foundation",
+ "objc2-quartz-core",
+ "objc2-user-notifications",
+]
+
+[[package]]
+name = "objc2-user-notifications"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9df9128cbbfef73cda168416ccf7f837b62737d748333bfe9ab71c245d76613e"
+dependencies = [
+ "objc2",
+ "objc2-foundation",
+]
+
+[[package]]
+name = "objc2-web-kit"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b2e5aaab980c433cf470df9d7af96a7b46a9d892d521a2cbbb2f8a4c16751e7f"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+]
+
 [[package]]
 name = "oid-registry"
 version = "0.8.1"
@@ -2014,9 +3078,9 @@ version = "0.10.81"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "cfg-if",
- "foreign-types",
+ "foreign-types 0.3.2",
  "libc",
  "openssl-macros",
  "openssl-sys",
@@ -2051,6 +3115,37 @@ dependencies = [
  "vcpkg",
 ]
 
+[[package]]
+name = "option-ext"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "04744f49eae99ab78e0d5c0b603ab218f515ea8cfe5a456d7629ad883a3b6e7d"
+
+[[package]]
+name = "pango"
+version = "0.18.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ca27ec1eb0457ab26f3036ea52229edbdb74dee1edd29063f5b9b010e7ebee4"
+dependencies = [
+ "gio",
+ "glib",
+ "libc",
+ "once_cell",
+ "pango-sys",
+]
+
+[[package]]
+name = "pango-sys"
+version = "0.18.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "436737e391a843e5933d6d9aa102cb126d501e815b83601365a948a518555dc5"
+dependencies = [
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
 [[package]]
 name = "parking"
 version = "2.2.1"
@@ -2124,6 +3219,59 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "phf"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c1562dc717473dbaa4c1f85a36410e03c047b2e7df7f45ee938fbef64ae7fadf"
+dependencies = [
+ "phf_macros",
+ "phf_shared",
+ "serde",
+]
+
+[[package]]
+name = "phf_codegen"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "49aa7f9d80421bca176ca8dbfebe668cc7a2684708594ec9f3c0db0805d5d6e1"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_generator"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "135ace3a761e564ec88c03a77317a7c6b80bb7f7135ef2544dbe054243b89737"
+dependencies = [
+ "fastrand",
+ "phf_shared",
+]
+
+[[package]]
+name = "phf_macros"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "812f032b54b1e759ccd5f8b6677695d5268c588701effba24601f6932f8269ef"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "phf_shared"
+version = "0.13.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e57fef6bc5981e38c2ce2d63bfa546861309f875b8a75f092d1d54ae2d64f266"
+dependencies = [
+ "siphasher",
+]
+
 [[package]]
 name = "pin-project"
 version = "1.1.13"
@@ -2246,6 +3394,19 @@ dependencies = [
  "plist",
 ]
 
+[[package]]
+name = "png"
+version = "0.18.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60769b8b31b2a9f263dae2776c37b1b28ae246943cf719eb6946a1db05128a61"
+dependencies = [
+ "bitflags 2.13.2",
+ "crc32fast",
+ "fdeflate",
+ "flate2",
+ "miniz_oxide 0.8.9",
+]
+
 [[package]]
 name = "poly1305"
 version = "0.8.0"
@@ -2292,6 +3453,65 @@ dependencies = [
  "zerocopy",
 ]
 
+[[package]]
+name = "precomputed-hash"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "925383efa346730478fb4838dbe9137d2a47675ad789c546d150a6e1dd4ab31c"
+
+[[package]]
+name = "proc-macro-crate"
+version = "1.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7f4c021e1093a56626774e81216a4ce732a735e5bad4868a03f3ed65ca0c3919"
+dependencies = [
+ "once_cell",
+ "toml_edit 0.19.15",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b00f26d3400549137f92511a46ac1cd8ce37cb5598a96d382381458b992a5d24"
+dependencies = [
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "proc-macro-crate"
+version = "3.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e67ba7e9b2b56446f1d419b1d807906278ffa1a658a8a5d8a39dcb1f5a78614f"
+dependencies = [
+ "toml_edit 0.25.17+spec-1.1.0",
+]
+
+[[package]]
+name = "proc-macro-error"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da25490ff9892aab3fcf7c36f08cfb902dd3e71ca0f9f9517bea02a73a5ce38c"
+dependencies = [
+ "proc-macro-error-attr",
+ "proc-macro2",
+ "quote",
+ "syn 1.0.109",
+ "version_check",
+]
+
+[[package]]
+name = "proc-macro-error-attr"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1be40180e52ecc98ad80b184934baf3d0d29f979574e439af5a55274b35f869"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "version_check",
+]
+
 [[package]]
 name = "proc-macro2"
 version = "1.0.107"
@@ -2407,6 +3627,12 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "63b8176103e19a2643978565ca18b50549f6101881c443590420e4dc998a3c69"
 
+[[package]]
+name = "raw-window-handle"
+version = "0.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20675572f6f24e9e76ef639bc5552774ed45f1c30e2951e1e99c59888861c539"
+
 [[package]]
 name = "rayon"
 version = "1.12.0"
@@ -2456,7 +3682,17 @@ version = "0.5.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed2bf2547551a7053d6fdfafda3f938979645c44812fbfcda098faae3f1a362d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
+]
+
+[[package]]
+name = "redox_users"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "60dc65c0ff1a7ae1294b0c67b9f14baf70b644404010370171787bfac1038fc0"
+dependencies = [
+ "libredox",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -2485,7 +3721,9 @@ dependencies = [
  "base64 0.23.1",
  "bytes",
  "encoding_rs",
+ "futures-channel",
  "futures-core",
+ "futures-util",
  "h2",
  "http",
  "http-body",
@@ -2528,7 +3766,7 @@ dependencies = [
  "async-trait",
  "http",
  "reqwest",
- "thiserror",
+ "thiserror 2.0.20",
  "tower-service",
 ]
 
@@ -2640,7 +3878,7 @@ version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "errno",
  "libc",
  "linux-raw-sys",
@@ -2690,7 +3928,7 @@ checksum = "26d1e2536ce4f35f4846aa13bff16bd0ff40157cdb14cc056c7b14ba41233ba0"
 dependencies = [
  "core-foundation 0.10.1",
  "core-foundation-sys",
- "jni",
+ "jni 0.22.4",
  "log",
  "once_cell",
  "rustls",
@@ -2778,7 +4016,7 @@ version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "core-foundation 0.10.1",
  "core-foundation-sys",
  "libc",
@@ -2795,6 +4033,25 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "selectors"
+version = "0.38.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8adfa1c298912827b8a28b223b3b874357397ae706e6190acd9bf28cee99114d"
+dependencies = [
+ "bitflags 2.13.2",
+ "cssparser",
+ "derive_more",
+ "log",
+ "new_debug_unreachable",
+ "phf",
+ "phf_codegen",
+ "precomputed-hash",
+ "rustc-hash",
+ "servo_arc",
+ "smallvec",
+]
+
 [[package]]
 name = "semver"
 version = "1.0.28"
@@ -2855,6 +4112,24 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "1.1.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7523beb55eece201a2356bee0bbca0d1ab466c14c07703b2e0ee6d42cb0c2c"
+dependencies = [
+ "serde_core",
+]
+
 [[package]]
 name = "serdect"
 version = "0.4.3"
@@ -2865,6 +4140,15 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "servo_arc"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "170fb83ab34de17dc69aa7c67482b22218ddb85da56546f9bd6b929e32a05930"
+dependencies = [
+ "stable_deref_trait",
+]
+
 [[package]]
 name = "sha1"
 version = "0.10.7"
@@ -3015,6 +4299,32 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "soup3"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "471f924a40f31251afc77450e781cb26d55c0b650842efafc9c6cbd2f7cc4f9f"
+dependencies = [
+ "futures-channel",
+ "gio",
+ "glib",
+ "libc",
+ "soup3-sys",
+]
+
+[[package]]
+name = "soup3-sys"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7ebe8950a680a12f24f15ebe1bf70db7af98ad242d9db43596ad3108aab86c27"
+dependencies = [
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "libc",
+ "system-deps",
+]
+
 [[package]]
 name = "spin"
 version = "0.9.9"
@@ -3062,12 +4372,46 @@ version = "1.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6ce2be8dc25455e1f91df71bfa12ad37d7af1092ae736f3a6cd0e37bc7810596"
 
+[[package]]
+name = "string_cache"
+version = "0.9.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a18596f8c785a729f2819c0f6a7eae6ebeebdfffbfe4214ae6b087f690e31901"
+dependencies = [
+ "new_debug_unreachable",
+ "parking_lot",
+ "phf_shared",
+ "precomputed-hash",
+]
+
+[[package]]
+name = "string_cache_codegen"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "585635e46db231059f76c5849798146164652513eb9e8ab2685939dd90f29b69"
+dependencies = [
+ "phf_generator",
+ "phf_shared",
+ "proc-macro2",
+ "quote",
+]
+
 [[package]]
 name = "subtle"
 version = "2.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "13c2bddecc57b384dee18652358fb23172facb8a2c51ccc10d74c157bdea3292"
 
+[[package]]
+name = "syn"
+version = "1.0.109"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "72b64191b275b66ffe2469e8af2c1cfe3bafa67b529ead792a6d0160888b4237"
+dependencies = [
+ "proc-macro2",
+ "unicode-ident",
+]
+
 [[package]]
 name = "syn"
 version = "2.0.119"
@@ -3127,7 +4471,7 @@ version = "0.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a13f3d0daba03132c0aa9767f98351b3488edc2c100cda2d2ec2b04f3d8d3c8b"
 dependencies = [
- "bitflags",
+ "bitflags 2.13.2",
  "core-foundation 0.9.4",
  "system-configuration-sys",
 ]
@@ -3142,6 +4486,87 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "system-deps"
+version = "6.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a3e535eb8dded36d55ec13eddacd30dec501792ff23a0b1682c38601b8cf2349"
+dependencies = [
+ "cfg-expr",
+ "heck 0.5.0",
+ "pkg-config",
+ "toml 0.8.2",
+ "version-compare",
+]
+
+[[package]]
+name = "tao"
+version = "0.37.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d5777b06fe6435126ae8d816eba269e050e1e10d302cf5461e9c49eccabc3548"
+dependencies = [
+ "bitflags 2.13.2",
+ "block2",
+ "core-foundation 0.10.1",
+ "core-graphics",
+ "crossbeam-channel",
+ "dbus",
+ "dispatch2",
+ "dlopen2",
+ "dpi",
+ "gdkwayland-sys",
+ "gdkx11-sys",
+ "gtk",
+ "jni 0.21.1",
+ "libc",
+ "log",
+ "ndk",
+ "ndk-context",
+ "ndk-sys",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "parking_lot",
+ "percent-encoding",
+ "raw-window-handle",
+ "tao-macros",
+ "unicode-segmentation",
+ "url",
+ "windows",
+ "windows-core",
+ "windows-version",
+ "x11-dl",
+]
+
+[[package]]
+name = "tao-macros"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5f7eeb6d99155545da6150a1795945f16ac9c178deb2a5f2e74d776107bd5849"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.12.16"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "61c41af27dd6d1e27b1b16b489db798443478cef1f06a660c96db617ba5de3b1"
+
+[[package]]
+name = "tauri-winrt-notification"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f37a6c354fd28fc9e322ed9bd47e3959576dad28c9d58ea1cf888cce1c7ccb36"
+dependencies = [
+ "thiserror 2.0.20",
+ "windows",
+ "windows-version",
+]
+
 [[package]]
 name = "tempfile"
 version = "3.27.0"
@@ -3155,13 +4580,42 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "tendril"
+version = "0.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fed54709c5b3a53d09bb1c113ea4f5ceafd1e772ddcb0030a82e1d56c087b08"
+dependencies = [
+ "new_debug_unreachable",
+]
+
+[[package]]
+name = "thiserror"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b6aaf5339b578ea85b50e080feb250a3e8ae8cfcdff9a461c9ec2904bc923f52"
+dependencies = [
+ "thiserror-impl 1.0.69",
+]
+
 [[package]]
 name = "thiserror"
 version = "2.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
 dependencies = [
- "thiserror-impl",
+ "thiserror-impl 2.0.20",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.69"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4fee6c4efc90059e10f81e6d42c60a18f76588c3d74cb83a0b242a2b6c7504c1"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
 ]
 
 [[package]]
@@ -3324,6 +4778,102 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "185d8ab0dfbb35cf1399a6344d8484209c088f75f8f68230da55d48d95d43e3d"
+dependencies = [
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.3",
+ "toml_edit 0.20.2",
+]
+
+[[package]]
+name = "toml"
+version = "1.1.8+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "20489e00e4d8741d6be680764cc12e270655e375a20d1011e844a9c3379e678d"
+dependencies = [
+ "indexmap",
+ "serde_core",
+ "serde_spanned 1.1.2",
+ "toml_datetime 1.1.2+spec-1.1.0",
+ "toml_parser",
+ "toml_writer",
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7cda73e2f1397b1262d6dfdcef8aafae14d1de7748d66822d3bfeeb6d03e5e4b"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "1.1.2+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2b86d767906c6c42421dcba507eb9d203e779497710a47782a224bb871653053"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.19.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1b5bb770da30e5cbfde35a2d7b9b8a2c4b8ef89548a7a6aeab5c9a576e3e7421"
+dependencies = [
+ "indexmap",
+ "toml_datetime 0.6.3",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.20.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "396e4d48bbb2b7554c944bde63101b5ae446cff6ec4a24227428f15eb72ef338"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned 0.6.9",
+ "toml_datetime 0.6.3",
+ "winnow 0.5.40",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.25.17+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e3641d5bbb5349a79e1020a242d251efbc546ad8048d133958323ce9c40a9c9c"
+dependencies = [
+ "indexmap",
+ "toml_datetime 1.1.2+spec-1.1.0",
+ "toml_parser",
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_parser"
+version = "1.1.5+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baa693a8032d7e1cada7d0041e96126df243179ff061456783ac7f12bda4744c"
+dependencies = [
+ "winnow 1.0.4",
+]
+
+[[package]]
+name = "toml_writer"
+version = "1.1.3+spec-1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "06bdbd8cfc056b8d2e2e85f29b56a3bdbecb527cef81eb39e3e7b98af4652770"
+
 [[package]]
 name = "tower"
 version = "0.5.3"
@@ -3346,7 +4896,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4cfcf7e2740e6fc6d4d688b4ef00650406bb94adf4731e43c096c3a19fe40840"
 dependencies = [
  "async-compression",
- "bitflags",
+ "bitflags 2.13.2",
  "bytes",
  "futures-core",
  "futures-util",
@@ -3435,6 +4985,27 @@ dependencies = [
  "tracing-log",
 ]
 
+[[package]]
+name = "tray-icon"
+version = "0.26.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f5cc5858ecf9574ddd8f0032a2ff7ffd6f7724d2b81e48b9374984b3fd6ddc9"
+dependencies = [
+ "crossbeam-channel",
+ "dirs",
+ "libappindicator",
+ "muda",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-core-graphics",
+ "objc2-foundation",
+ "once_cell",
+ "png",
+ "thiserror 2.0.20",
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "triomphe"
 version = "0.1.16"
@@ -3462,7 +5033,7 @@ dependencies = [
  "rustls",
  "rustls-pki-types",
  "sha1 0.10.7",
- "thiserror",
+ "thiserror 2.0.20",
 ]
 
 [[package]]
@@ -3483,6 +5054,12 @@ version = "1.0.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
 
+[[package]]
+name = "unicode-segmentation"
+version = "1.13.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6f5d3c3b1bf09027a88a6bc961fc00497d651009560b5463668dc81b0fa87a8"
+
 [[package]]
 name = "universal-hash"
 version = "0.5.1"
@@ -3558,6 +5135,12 @@ version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
+[[package]]
+name = "version-compare"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "03c2856837ef78f57382f06b2b8563a2f512f7185d732608fd9176cb3b8edf0e"
+
 [[package]]
 name = "version_check"
 version = "0.9.5"
@@ -3686,6 +5269,62 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "web_atoms"
+version = "0.2.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba8b815c1b593dc0baf78dd0f4fc8fdb2de53198fb1163738093e9a311c33fb3"
+dependencies = [
+ "phf",
+ "phf_codegen",
+ "string_cache",
+ "string_cache_codegen",
+]
+
+[[package]]
+name = "webkit2gtk"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a1027150013530fb2eaf806408df88461ae4815a45c541c8975e61d6f2fc4793"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-rs",
+ "gdk",
+ "gdk-sys",
+ "gio",
+ "gio-sys",
+ "glib",
+ "glib-sys",
+ "gobject-sys",
+ "gtk",
+ "gtk-sys",
+ "javascriptcore-rs",
+ "libc",
+ "once_cell",
+ "soup3",
+ "webkit2gtk-sys",
+]
+
+[[package]]
+name = "webkit2gtk-sys"
+version = "2.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "916a5f65c2ef0dfe12fff695960a2ec3d4565359fdbb2e9943c974e06c734ea5"
+dependencies = [
+ "bitflags 1.3.2",
+ "cairo-sys-rs",
+ "gdk-sys",
+ "gio-sys",
+ "glib-sys",
+ "gobject-sys",
+ "gtk-sys",
+ "javascriptcore-rs-sys",
+ "libc",
+ "pkg-config",
+ "soup3-sys",
+ "system-deps",
+]
+
 [[package]]
 name = "webpki-root-certs"
 version = "1.0.9"
@@ -3713,6 +5352,56 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webview2-com"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f89fca7a704cee10dcb3654c1dbb8941d1783132f1917358af75bec37a7d7e6"
+dependencies = [
+ "webview2-com-macros",
+ "webview2-com-sys",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "webview2-com-macros"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67a921c1b6914c367b2b823cd4cde6f96beec77d30a939c8199bb377cf9b9b54"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "webview2-com-sys"
+version = "0.39.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b3a07132775117d6065853d9d1178157b8c90e228de47129d6bce2c7edebedfb"
+dependencies = [
+ "thiserror 2.0.20",
+ "windows",
+ "windows-core",
+]
+
+[[package]]
+name = "winapi"
+version = "0.3.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c839a674fcd7a98952e593242ea400abe93992746761e38641405d28b00f419"
+dependencies = [
+ "winapi-i686-pc-windows-gnu",
+ "winapi-x86_64-pc-windows-gnu",
+]
+
+[[package]]
+name = "winapi-i686-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
+
 [[package]]
 name = "winapi-util"
 version = "0.1.11"
@@ -3722,12 +5411,95 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "winapi-x86_64-pc-windows-gnu"
+version = "0.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "712e227841d057c1ee1cd2fb22fa7e5a5461ae8e48fa2ca79ec42cfc1931183f"
+
+[[package]]
+name = "windows"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
+dependencies = [
+ "windows-collections",
+ "windows-core",
+ "windows-future",
+ "windows-numerics",
+]
+
+[[package]]
+name = "windows-collections"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
+dependencies = [
+ "windows-core",
+]
+
+[[package]]
+name = "windows-core"
+version = "0.62.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
+dependencies = [
+ "windows-implement",
+ "windows-interface",
+ "windows-link",
+ "windows-result",
+ "windows-strings",
+]
+
+[[package]]
+name = "windows-future"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
+dependencies = [
+ "windows-core",
+ "windows-link",
+ "windows-threading",
+]
+
+[[package]]
+name = "windows-implement"
+version = "0.60.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "windows-interface"
+version = "0.59.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "windows-link"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
+[[package]]
+name = "windows-numerics"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
+dependencies = [
+ "windows-core",
+ "windows-link",
+]
+
 [[package]]
 name = "windows-registry"
 version = "0.6.1"
@@ -3757,13 +5529,22 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.52.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "282be5f36a8ce781fad8c8ae18fa3f9beff57ec1b52cb3de0789201425d9a33d"
 dependencies = [
- "windows-targets",
+ "windows-targets 0.52.6",
 ]
 
 [[package]]
@@ -3775,34 +5556,85 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b724f72796e036ab90c1021d4780d4d3d648aca59e491e6b98e725b84e99973"
 dependencies = [
- "windows_aarch64_gnullvm",
- "windows_aarch64_msvc",
- "windows_i686_gnu",
+ "windows_aarch64_gnullvm 0.52.6",
+ "windows_aarch64_msvc 0.52.6",
+ "windows_i686_gnu 0.52.6",
  "windows_i686_gnullvm",
- "windows_i686_msvc",
- "windows_x86_64_gnu",
- "windows_x86_64_gnullvm",
- "windows_x86_64_msvc",
+ "windows_i686_msvc 0.52.6",
+ "windows_x86_64_gnu 0.52.6",
+ "windows_x86_64_gnullvm 0.52.6",
+ "windows_x86_64_msvc 0.52.6",
+]
+
+[[package]]
+name = "windows-threading"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "windows-version"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4060a1da109b9d0326b7262c8e12c84df67cc0dbc9e33cf49e01ccc2eb63631"
+dependencies = [
+ "windows-link",
 ]
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32a4622180e7a0ec044bb555404c800bc9fd9ec262ec147edd5989ccd0c02cd3"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09ec2a7bb152e2252b53fa7803150007879548bc709c039df7627cabbd05d469"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.52.6"
@@ -3815,30 +5647,92 @@ version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0eee52d38c090b3caa76c563b86c3a4bd71ef1a819287c19d586d7334ae8ed66"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "240948bc05c5e7c6dabba28bf89d89ffce3e303022809e73deaefe4f6ec56c66"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "147a5c80aabfbf0c7d901cb5895d1de30ef2907eb21fbbab29ca94c5b08b1a78"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "24d5b23dc417412679681396f2b49f3de8c1473deb516bd34410872eff51ed0d"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.52.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
+[[package]]
+name = "winnow"
+version = "0.5.40"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f593a95398737aeed53e489c785df13f3618e41dbcd6718c6addbf1395aa6876"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winnow"
+version = "1.0.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "23b97319f7b8343df12cc98938e5c3eb436064524c8d2b4e30a1d3a36eecdf81"
+dependencies = [
+ "memchr",
+]
+
+[[package]]
+name = "winreg"
+version = "0.56.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d6f32a0ff4a9f6f01231eb2059cc85479330739333e0e58cadf03b6af2cca10"
+dependencies = [
+ "cfg-if",
+ "windows-sys 0.61.2",
+]
+
+[[package]]
+name = "winresource"
+version = "0.1.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2bc6d36480b829272a5bdabf08e6dca8004761c1da7e35efef800540c66221b"
+dependencies = [
+ "toml 1.1.8+spec-1.1.0",
+ "version_check",
+]
+
 [[package]]
 name = "wit-bindgen"
 version = "0.57.1"
@@ -3851,6 +5745,70 @@ version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3ad82d2a33cdc9674dc7465672f271e096168fcdbe0f799d9e6db8c5892679dc"
 
+[[package]]
+name = "wry"
+version = "0.57.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "759c50ddad0ef9913bb5496cb9d509a50433a3b78cb0238d61105526589cf0e9"
+dependencies = [
+ "base64 0.23.1",
+ "block2",
+ "cookie",
+ "crossbeam-channel",
+ "dirs",
+ "dom_query",
+ "dpi",
+ "dunce",
+ "gdkx11",
+ "gtk",
+ "http",
+ "javascriptcore-rs",
+ "jni 0.21.1",
+ "libc",
+ "ndk",
+ "objc2",
+ "objc2-app-kit",
+ "objc2-core-foundation",
+ "objc2-foundation",
+ "objc2-ui-kit",
+ "objc2-web-kit",
+ "percent-encoding",
+ "raw-window-handle",
+ "sha2 0.10.9",
+ "soup3",
+ "tao-macros",
+ "thiserror 2.0.20",
+ "url",
+ "webkit2gtk",
+ "webkit2gtk-sys",
+ "webview2-com",
+ "windows",
+ "windows-core",
+ "windows-version",
+ "x11-dl",
+]
+
+[[package]]
+name = "x11"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "502da5464ccd04011667b11c435cb992822c2c0dbde1770c988480d312a0db2e"
+dependencies = [
+ "libc",
+ "pkg-config",
+]
+
+[[package]]
+name = "x11-dl"
+version = "2.21.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38735924fedd5314a6e548792904ed8c6de6636285cb9fec04d5b1db85c1516f"
+dependencies = [
+ "libc",
+ "once_cell",
+ "pkg-config",
+]
+
 [[package]]
 name = "x25519-dalek"
 version = "2.0.1"
@@ -3902,7 +5860,7 @@ dependencies = [
  "oid-registry",
  "ring",
  "rusticata-macros",
- "thiserror",
+ "thiserror 2.0.20",
  "time",
 ]
 
@@ -3912,7 +5870,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5f6765e852b9b4dc8e2a76843e4d64d1cea8e79bcde0b6901aea8e7c7f08282"
 dependencies = [
- "bit-vec",
+ "bit-vec 0.9.1",
  "time",
 ]
 
diff --git a/Cargo.toml b/Cargo.toml
index b817b89..76ae2df 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,13 +1,14 @@
 [package]
 default-run = "altkeeper"
 name = "altkeeper"
-version = "0.2.0"
+version = "0.3.0"
 edition = "2021"
 description = "AltServer for iOS 17+ that runs on your home server (Docker): renews and installs sideloaded iPhone apps over Wi-Fi, no computer or VPN"
 license = "MIT"
 readme = "README.md"
 
 [dependencies]
+chrono = { version = "0.4", default-features = false, features = ["clock"] }
 axum = { version = "0.8.9", default-features = false, features = ["http1", "tokio", "json", "multipart"] }
 idevice = { version = "0.1.68", default-features = false, features = [
   "ring",
@@ -33,8 +34,23 @@ rustls = { version = "0.23", default-features = false, features = ["ring", "std"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
+tempfile = "3.27"
+zip = { version = "8.6", default-features = false, features = ["deflate"] }
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
+[target.'cfg(windows)'.build-dependencies]
+winresource = "0.1"
+
+[target.'cfg(windows)'.dependencies]
+tao = "0.37"
+sha2 = "0.10"
+tauri-winrt-notification = "0.8"
+reqwest = { version = "0.13", default-features = false, features = ["blocking", "json", "rustls-no-provider"] }
+tray-icon = "0.26"
+winreg = "0.56"
+windows-sys = { version = "0.61", features = ["Win32_Foundation", "Win32_System_Console", "Win32_System_Threading", "Win32_UI_WindowsAndMessaging"] }
+wry = "0.57"
+
 # La copia in vendor/ è isideload 0.4.6 (upstream 8ca39b62) con due modifiche locali:
 # gli accessor di AnisetteData usati dal ponte AltStore e il logging ALTKEEPER_DEBUG /
 # le impostazioni di trasporto HTTP/1.1 portate dalla vecchia copia 0.3.17.
diff --git a/Dockerfile b/Dockerfile
index 9b5fd76..36fa38e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,7 +15,7 @@ RUN cargo build --release --locked
 
 FROM debian:bookworm-slim
 RUN apt-get update \
- && apt-get install -y --no-install-recommends ca-certificates tzdata \
+ && apt-get install -y --no-install-recommends ca-certificates tzdata curl \
  && rm -rf /var/lib/apt/lists/*
 COPY --from=build /src/target/release/altkeeper /usr/local/bin/altkeeper
 WORKDIR /data
diff --git a/README.it.md b/README.it.md
index 09210c4..503c5b8 100644
--- a/README.it.md
+++ b/README.it.md
@@ -106,6 +106,15 @@ i JSON o la pagina web. I comandi del menu 2FA restano `d`, `r` (se disponibile)
 
 ### 1. Ottieni il programma
 
+**Già compilato:** ogni [release su GitHub](https://github.com/BartolomeoRusso9/altkeeper/releases) ha
+`altkeeper-<versione>-linux-x86_64.tar.gz`, `-linux-aarch64`, `-macos-aarch64` (Apple Silicon) e
+`-macos-x86_64` (Intel), ciascuno con il suo file `.sha256` (verifica con `sha256sum -c`). Decomprimi e
+usa il binario `altkeeper`. Le build Linux richiedono glibc 2.35 o più recente; su sistemi più vecchi
+o Alpine usa Docker o compila da te. Le build macOS non sono firmate: se Gatekeeper le blocca, lancia
+`xattr -d com.apple.quarantine altkeeper`. Si aggiorna da solo solo l'`.exe` di Windows.
+
+**Oppure compilalo tu:**
+
 ```sh
 git clone https://github.com/BartolomeoRusso9/altkeeper
 cd altkeeper
@@ -347,6 +356,25 @@ end-to-end.
    notifica d'errore al massimo una volta al giorno di `renew.sh`. Il PC deve essere acceso e non in
    sospensione a quell'ora.
 
+5. **Icona nella barra di sistema (senza terminale).** Fai doppio clic su `altkeeper.exe`, oppure
+   lancia `.\altkeeper.exe tray`: avvia AltServer e la pagina web come `serve --altserver`, ma con
+   un'icona accanto all'orologio (il logo di AltKeeper; grigio finché l'iPhone non è raggiungibile)
+   e senza finestra di console. Doppio clic sull'icona, oppure dal menu: *Open AltKeeper* (la pagina
+   in una finestra propria; chiuderla la nasconde soltanto), *Show logs*, *Start with Windows*
+   (attivo di default alla prima esecuzione), *Check for updates* e *Quit*. Le notifiche toast
+   avvisano quando i profili sono rinnovati, un'app è installata o qualcosa fallisce. La finestra
+   richiede il runtime Microsoft Edge WebView2, già presente in Windows 11 e nei Windows 10
+   recenti. `--console` tiene la console, `--dir` sceglie la cartella dei dati (di default quella
+   dell'`.exe`).
+
+   L'icona controlla anche, una volta al giorno, le release GitHub; *Update now* scarica il
+   nuovo `altkeeper.exe`, ne verifica lo SHA-256, si riavvia e torna alla versione vecchia se la
+   nuova non parte. Le release (Windows, Linux e macOS) le compila `.github/workflows/release.yml` quando pubblichi un tag
+   uguale alla `version` di `Cargo.toml` (per esempio `v0.3.0`).
+
+   Ogni riga del server (AltServer, pagina web, DNS-SD) viene scritta con data e ora anche in
+   `altkeeper.log` (ruotato a 5 MB) e mostrata nella sezione **Logs** della pagina web.
+
 Tutto il resto di questa guida (comandi, variabili d'ambiente, uso da fuori casa) vale uguale; cambia
 solo che i percorsi usano `\`, e che `cron` e `renew.sh` si sostituiscono con l'Utilità di
 pianificazione e `renew.ps1`.
@@ -518,6 +546,7 @@ quale nome sta chiedendo il telefono.
 | `serve [--bind ip:porta] [--pin PIN] [--dir cartella] [--phone ip:porta] [--altserver] [--altserver-port N]` | pagina web (e, con `--altserver`, AltServer) |
 | `profile-remove <uuid>` | toglie un profilo dal telefono, salvandone una copia in `profili-salvati/` |
 | `profile-restore <file>` | rimette un profilo salvato |
+| `tray [--dir cartella] [--phone ip:porta] [--console]` | solo Windows: AltServer + pagina web con icona nella barra di sistema, senza terminale (è quello che parte con il doppio clic sull'`.exe`) |
 
 `ALTKEEPER_PHONE=ip:porta` può sostituire `--phone`; senza nessuno dei due il telefono si trova da
 solo (vedi il passo 2). `ALTKEEPER_NO_MDNS=1` spegne Bonjour (reti che bloccano il multicast, o per
diff --git a/README.md b/README.md
index 28eb3c8..2e677c8 100644
--- a/README.md
+++ b/README.md
@@ -103,6 +103,15 @@ and server logs, **not** the HTML web page, protocol or JSON. The same 2FA menu
 
 ### 1. Get the program
 
+**Prebuilt:** each [GitHub release](https://github.com/BartolomeoRusso9/altkeeper/releases) has
+`altkeeper-<version>-linux-x86_64.tar.gz`, `-linux-aarch64`, `-macos-aarch64` (Apple Silicon) and
+`-macos-x86_64` (Intel), each with a `.sha256` file (check with `sha256sum -c`). Unpack it and use the
+`altkeeper` binary inside. The Linux builds need glibc 2.35 or newer; on older systems or Alpine, use
+Docker or build it yourself. The macOS builds are not signed: if Gatekeeper blocks it, run
+`xattr -d com.apple.quarantine altkeeper`. Only the Windows `.exe` updates itself.
+
+**Or build it yourself:**
+
 ```sh
 git clone https://github.com/BartolomeoRusso9/altkeeper
 cd altkeeper
@@ -200,6 +209,79 @@ answers with errors, wait before trying again instead of repeating it.
 `renew` looks at each app's newest profile, renews the ones with `--min-days` days left or fewer
 (default 3), and signs in to Apple **only if something is due**.
 
+**Installed-app safety filter (default for scheduled/CLI `renew` and web “Renew expiring apps”):**
+Before checking expiry, AltKeeper queries the phone's installed user apps through installation_proxy.
+Profiles that do not correspond to installed apps are skipped. **If that lookup fails (including
+a timeout), AltKeeper explicitly falls back to renewing *all* known profiles for the configured
+Apple team, ignoring the expiry threshold.** This fallback is logged as WARNING/FALLBACK.
+A successful lookup returning zero apps skips all renewals.
+
+To renew a specific app, use `altkeeper renew --bundle <bundle-id> --force` or the per-app
+**Renew** button on the web page. The manual `--force` and web “Renew all now” operations
+do not check installed apps; `--installed-only` can be used with CLI `--force` to opt in.
+No unattended schedule is enabled by merely running the Docker container (default: OFF).
+
+**Optional built-in scheduler in the web UI:** Use **Automatic renewal** to enable/disable a
+once-daily job and choose a time in **UTC**. The default clock
+time is 06:00 UTC and the switch is initially OFF. When enabled, AltKeeper runs
+the same installed-app-aware renewal as **Renew expiring apps**, with the documented
+all-profile fallback if installed-app listing fails. The server needs a saved
+Apple ID password, must be running, and the iPhone must be reachable.
+Only one scheduled *attempt* is made per UTC calendar day (including failures).
+A server that starts after the scheduled time on a day with no attempt will run
+that day's job when it starts; enabling or changing the scheduled time after
+today's slot does **not** trigger an immediate refresh. The next slot is tomorrow.
+The schedule and last attempted day are stored in `state/auto-renew.json` under
+the persistent `/data` volume, surviving Docker restarts. No host systemd,
+cron, privileged host socket, or extra package is needed. **Do not enable
+an external cron/systemd renewal job at the same time** unless deliberate.
+
+
+The web page also lists **individual provisioning profiles** (including older versions) with a
+**Delete profile** button. Every removal requires confirmation, is limited to the saved Apple team,
+and saves then verifies a private `profili-salvati/<uuid>.mobileprovision` backup before removal.
+Removing a profile currently needed by an installed app can prevent that app from opening.
+To restore a backup: `altkeeper profile-restore profili-salvati/<uuid>.mobileprovision`.
+Neither profile deletion nor renewal removes Apple Developer App IDs.
+
+**Grouped app management and retry controls:** The web UI groups extension profiles with
+their host app when their bundle ID contains the saved team's extension marker
+(e.g. `com.kdt.livecontainer.TEAM.LiveProcess` under `com.kdt.livecontainer`).
+The expandable **Your apps** card renews *every* member profile in a group, rather
+than only the selected host profile. Installed-app filtering also checks the
+host app for an extension; the earliest-expiring member determines when the entire
+group is due. The web preview lists groups that appear due, but the actual run
+performs a fresh phone check and may fall back to all team profiles if the
+installed-app inventory fails.
+
+The web scheduler's **renewal threshold** is adjustable from **1 to 6 days**,
+default **3 days**. On automatic renewal failure it retries up to **two** more
+times, **30 minutes apart** (up to 3 attempts in total). Authentication and
+rate-limit failures are not automatically retried. Enabling Discord failure
+notifications requires saving a webhook URL in the web UI. The secret is saved in
+the private `state/discord-webhook` file and is never returned to the browser;
+only a boolean indicates configuration. The Docker image includes `curl` to send
+an alert only after the last failed attempt (or a non-retryable failure).
+Successful automatic renewals do not send Discord messages.
+
+The web UI also lists previously saved profile backups and offers an explicit
+**Restore** action after confirmation. Restoration verifies the saved profile
+UUID and Apple Team ID and does not change its expiry date. The original file
+is retained. The app summary shows the last known per-group profile-install
+result from `state/app-renew-status.json`, and **Preview renewals** provides a
+non-authoritative overview without signing in to Apple.
+
+
+**Monthly backup cleanup:** When the web service (`serve`, including Docker `serve --altserver`)
+is running, it checks once a day whether a cleanup is due. Every **30 days after the last
+successful sweep** (including the first startup), it removes only saved `.mobileprovision`
+files whose embedded expiry date is at least **30 days in the past**. A verified UUID/file name
+match is required; malformed, unreadable, future-dated or unrelated files are preserved.
+A cleanup log line reports the number removed. The last successful sweep is recorded at
+`state/profile-backup-last-cleanup` so Docker restarts do not reset the schedule.
+No iPhone communication, Apple login, cron job, or new systemd timer is required.
+This cleanup does not touch live iPhone profiles or Apple Developer App IDs.
+
 ### 6. Automatic renewal (optional)
 
 A safety net that does not depend on the iPhone running AltStore.
@@ -260,6 +342,20 @@ The image holds nothing secret: pairing, account and state live in the `/data` v
 uses the host network, because it needs Bonjour to find the iPhone and to be found by AltStore;
 ports 8787 (web) and 49500 (AltServer) must be free.
 
+
+**Fast IPA upload over Wi-Fi (experimental):** After signing, AltKeeper repackages the
+signed `.app` (including any custom name/Bundle ID and selected extensions) into one
+temporary IPA, stages that file over AFC, then asks iOS to install it. This avoids
+thousands of remote AFC operations for apps with many small files. The temporary
+IPA is removed automatically; peak memory is bounded by streaming both packaging
+and upload. USB installs keep the existing directory-based path.
+
+For an immediate rollback on Linux, set `ALTKEEPER_INSTALL_MODE=directory` in the
+AltKeeper container's `environment:` in `docker-compose.yml`, then recreate
+the container. This restores the previous Wi-Fi directory-transfer behavior
+without re-signing existing apps. Test on a disposable app first; compatibility
+with a real iPhone must be confirmed before considering it production-verified.
+
 A GitHub Actions workflow (`.github/workflows/docker.yml`) runs the tests on Linux and Windows,
 checks `--help` in both CLI languages, and publishes the image to `ghcr.io/<user>/altkeeper` on
 pushes to `main` (amd64) and on `vX.Y.Z` tags (amd64 and arm64). If the repository is private, the
@@ -340,6 +436,24 @@ prove Windows 11, other shell hosts, AltServer installation or unattended renewa
    `renew.ps1` keeps the same `renew.log`, the same optional `notify.conf` (ntfy) and the same
    once-a-day error notification as `renew.sh`. It needs the PC to be on and awake at that time.
 
+5. **System tray icon (no terminal).** Double-click `altkeeper.exe`, or run
+   `.\altkeeper.exe tray`: it starts AltServer and the web page like `serve --altserver`, but
+   with an icon next to the clock (the AltKeeper logo; grey while the iPhone is not reachable)
+   and no console window. Double-click the icon, or use the menu: *Open AltKeeper* (the page in
+   its own window; closing it only hides it), *Show logs*, *Start with Windows* (on by default
+   the first time), *Check for updates* and *Quit*. Toast notifications tell you when profiles
+   are renewed, an app is installed or something fails. The window needs the Microsoft Edge
+   WebView2 runtime, which Windows 11 and recent Windows 10 already have. `--console` keeps the
+   console, `--dir` chooses the data folder (default: the folder of the `.exe`).
+
+   The icon also checks the GitHub releases once a day; *Update now* downloads the new
+   `altkeeper.exe`, verifies its SHA-256, restarts, and goes back to the old version if the new
+   one does not start. Releases (Windows, Linux and macOS) are built by `.github/workflows/release.yml` when you push a
+   tag equal to the `version` in `Cargo.toml` (for example `v0.3.0`).
+
+   Every server line (AltServer, web page, DNS-SD) is also written, with date and time, to
+   `altkeeper.log` (rotated at 5 MB) and shown in the **Logs** section of the web page.
+
 Everything else in this guide (commands, environment variables, outside-the-home setup) is the
 same; only the paths use `\`, and `cron` and `renew.sh` are replaced by the Task Scheduler and
 `renew.ps1`.
@@ -502,11 +616,12 @@ If it says it cannot find the server, watch the DNS with
 | `pair-usb [file]` | creates the remote pairing over USB (once) |
 | `login <apple-id>` | signs in with 2FA and saves the account |
 | `apps` | lists your App IDs and their expiry dates |
-| `renew [--dry-run] [--force] [--min-days N] [--phone ip:port]` | renews the profiles that are due |
+| `renew [--dry-run] [--force] [--min-days N] [--phone ip:port] [--bundle ID] [--installed-only]` | renews profiles, optionally one bundle or with installed-app filtering |
 | `altserver [--port N] [--dir folder] [--phone ip:port] [--dns-domain D --dns-address IP]` | acts as AltServer for AltStore |
 | `serve [--bind ip:port] [--pin PIN] [--dir folder] [--phone ip:port] [--altserver] [--altserver-port N]` | web page (and, with `--altserver`, AltServer) |
 | `profile-remove <uuid>` | takes one profile off the phone, saving a copy in `profili-salvati/` |
 | `profile-restore <file>` | puts a saved profile back |
+| `tray [--dir folder] [--phone ip:port] [--console]` | Windows only: AltServer + web page with a system tray icon, no terminal (the default when you double-click the `.exe`) |
 
 `ALTKEEPER_PHONE=ip:port` can replace `--phone`; without either the phone is found by itself (see
 step 2). `ALTKEEPER_NO_MDNS=1` turns Bonjour off (networks that block multicast, or to test the scan).
diff --git a/assets/altkeeper.ico b/assets/altkeeper.ico
new file mode 100644
index 0000000..3b5ae7a
Binary files /dev/null and b/assets/altkeeper.ico differ
diff --git a/assets/logo-32.rgba b/assets/logo-32.rgba
new file mode 100644
index 0000000..ff809b7
Binary files /dev/null and b/assets/logo-32.rgba differ
diff --git a/assets/logo-64.rgba b/assets/logo-64.rgba
new file mode 100644
index 0000000..269aa91
Binary files /dev/null and b/assets/logo-64.rgba differ
diff --git a/assets/logo-grey-32.rgba b/assets/logo-grey-32.rgba
new file mode 100644
index 0000000..3bc8306
Binary files /dev/null and b/assets/logo-grey-32.rgba differ
diff --git a/assets/logo.png b/assets/logo.png
new file mode 100644
index 0000000..17e730a
Binary files /dev/null and b/assets/logo.png differ
diff --git a/build.rs b/build.rs
new file mode 100644
index 0000000..a6b6f9b
--- /dev/null
+++ b/build.rs
@@ -0,0 +1,23 @@
+//! Su Windows incorpora il logo (assets/altkeeper.ico) nell'exe: è l'icona che si vede in
+//! Esplora file, sul desktop e nella barra delle applicazioni. Sugli altri sistemi non fa niente.
+
+fn main() {
+    println!("cargo:rerun-if-changed=build.rs");
+    println!("cargo:rerun-if-changed=assets/altkeeper.ico");
+
+    #[cfg(windows)]
+    {
+        // Compilare da Windows verso un altro sistema non richiede nessuna risorsa.
+        if std::env::var("CARGO_CFG_TARGET_OS").as_deref() != Ok("windows") {
+            return;
+        }
+        let mut res = winresource::WindowsResource::new();
+        res.set_icon("assets/altkeeper.ico");
+        res.set("ProductName", "AltKeeper");
+        res.set("FileDescription", "AltKeeper");
+        if let Err(e) = res.compile() {
+            // L'icona è solo estetica: se manca il compilatore di risorse (rc.exe) si va avanti.
+            println!("cargo:warning=icon not embedded in altkeeper.exe: {e}");
+        }
+    }
+}
diff --git a/docs/KOREAN_UI_REVIEW.md b/docs/KOREAN_UI_REVIEW.md
new file mode 100644
index 0000000..e4e0905
--- /dev/null
+++ b/docs/KOREAN_UI_REVIEW.md
@@ -0,0 +1,107 @@
+# AltKeeper 한국어 웹 UI 번역 — 제안
+
+> 상태: **미적용 번역 제안** — 아래 한국어 문구는 검토를 위한 제안이며, 현재 웹 UI는 영어로 표시됩니다.
+
+## 번역 원칙
+
+- UI의 **AltKeeper**, **Apple ID**, **Discord**, **IPA**, **UUID**, **UTC** 등 식별자와 제품명은 번역하지 않음.
+- `Renew`는 '갱신', `Install`은 '설치', `Provisioning profile`은 '프로비저닝 프로파일'로 통일.
+- 이 앱 목록은 휴대전화의 프로파일을 기반으로 하므로, 설치 앱 조회에 실패했을 때도 표시할 수 있음. 따라서 '설치된 앱' 대신 **앱 목록** 사용.
+- 실패 로그·Apple 원문 오류는 정확한 문제 진단을 위해 번역보다는 원문 유지 + 짧은 한국어 설명 병기를 권장.
+- 번역 적용 시 서버 API 및 영어 진단 로그 내용은 보존합니다.
+
+## 주요 UI 문구
+
+| 영어 원문 | 제안 한국어 |
+|---|---|
+| Keeps your iPhone apps alive by renewing their profiles. | 아이폰 앱의 프로파일을 갱신해 사용 기간을 유지합니다. |
+| iPhone | 아이폰 |
+| Checking… | 확인 중… |
+| iPhone reachable | 아이폰 연결됨 |
+| iPhone unreachable | 아이폰 연결 안 됨 |
+| Not checked yet | 아직 확인하지 않음 |
+| Check again | 다시 확인 |
+| Your apps | 앱 목록 |
+| Renew app | 이 앱 갱신 |
+| Details | 상세 정보 |
+| Less | 접기 |
+| Renew expiring apps | 만료 임박 앱 갱신 |
+| Renew all now | 전체 갱신 |
+| Preview renewals | 갱신 대상 미리보기 |
+| Automatic renewal | 자동 갱신 |
+| OFF | 꺼짐 |
+| ON | 켜짐 |
+| Automatic renewal disabled | 자동 갱신이 꺼져 있습니다 |
+| Daily time (UTC) | 매일 실행 시간 (UTC) |
+| Renew when days remaining | 만료까지 남은 기간이 |
+| 1 day / 2 days / … / 6 days | 1일 / 2일 / … / 6일 |
+| Enable auto-renew | 자동 갱신 켜기 |
+| Save settings | 설정 저장 |
+| Turn off | 끄기 |
+| Discord failure notifications | Discord 실패 알림 |
+| Not configured | 설정 안 됨 |
+| Configured | 설정됨 |
+| Save webhook | 웹훅 저장 |
+| Clear webhook | 웹훅 삭제 |
+| Send test notification | 테스트 알림 보내기 |
+| Test notification sent. Check your Discord channel. | 테스트 알림을 보냈습니다. Discord 채널을 확인하세요. |
+| Configure a Discord webhook first. | 먼저 Discord 웹훅을 설정하세요. |
+| Provisioning profiles on iPhone | 아이폰의 프로비저닝 프로파일 |
+| Delete profile | 프로파일 삭제 |
+| Show | 펼치기 |
+| Hide | 접기 |
+| Saved profile backups | 저장된 프로파일 백업 |
+| Restore | 복원 |
+| Install an app from this PC | 이 PC에서 IPA 설치 |
+| IPA file | IPA 파일 |
+| Sign and install | 서명 후 설치 |
+| Uploading… | 업로드 중… |
+| Apple ID (email) | Apple ID (이메일) |
+| Password | 비밀번호 |
+| Show password | 비밀번호 표시 |
+| Change account | 계정 변경 |
+| Sign in | 로그인 |
+| Code | 인증 코드 |
+| Submit code | 코드 확인 |
+| Resend code | 코드 다시 보내기 |
+| Recent renewals | 최근 갱신 기록 |
+| For use on your home network only. | 가정 내 네트워크에서만 사용하세요. |
+
+## 설명 문구 (의미 보존 필요)
+
+| 위치 | 제안 한국어 |
+|---|---|
+| 자동 갱신 안내 | 서버가 실행 중일 때 하루 한 번 만료가 임박한 앱을 갱신합니다. 설치된 앱을 조회하지 못하면 저장된 Apple Team의 모든 프로파일을 갱신 대상으로 사용합니다. 기본값은 꺼짐입니다. |
+| 자동 갱신 재시도 | 예약된 갱신에 실패하면 30분 간격으로 최대 2회 재시도합니다. 모든 시도가 실패했거나 재시도할 수 없는 인증 오류일 때만 Discord 알림을 보냅니다. |
+| Discord 알림 안내 | 자동 갱신이 최종 실패했을 때만 알림을 보냅니다. |
+| 프로파일 삭제 안내 | 갱신 후에도 이전 프로파일이 남을 수 있습니다. 사용 중인 프로파일을 삭제하면 앱이 실행되지 않을 수 있습니다. 삭제 전에 서버에 검증된 백업을 저장합니다. |
+| 프로파일 복원 안내 | UUID로 백업 프로파일을 복원합니다. 복원해도 원래 만료일은 연장되지 않으며, 백업 파일은 유지됩니다. |
+| IPA 설치 안내 | IPA를 선택하면 저장된 Apple ID로 서명한 뒤 Wi-Fi를 통해 아이폰에 설치합니다. Apple ID 비밀번호를 서버에 저장해야 합니다. 설치하는 동안 아이폰 화면을 잠금 해제한 상태로 유지하는 것을 권장합니다. |
+| Apple ID 저장 안내 | 자동 갱신을 위해 서버에 비밀번호를 저장합니다. 비밀번호는 접근이 제한된 서버 파일에 평문으로 저장됩니다. |
+| Apple 로그인 주의 | 한 번에 한 번만 로그인하세요. 반복된 실패는 Apple의 일시적인 로그인 제한을 유발할 수 있습니다. |
+| 최근 갱신 기록 없음 | 아직 기록이 없습니다. 자동 갱신을 설정하면 매일 지정된 시간에 실행됩니다. |
+| 페어링 누락 | 아이폰 페어링 정보가 없습니다. USB 연결로 페어링한 뒤 README 안내를 따르세요. |
+
+## 동적 상태 메시지 제안
+
+| 영어 문구 | 한국어 제안 |
+|---|---|
+| expires in 6 days | 6일 후 만료 |
+| expires today | 오늘 만료 |
+| expired 1 day ago | 1일 전 만료 |
+| 2 profiles | 프로파일 2개 |
+| Renewing… | 갱신 중… |
+| Another operation is in progress. | 다른 작업이 진행 중입니다. |
+| The iPhone must be reachable on Wi-Fi. | 아이폰이 Wi-Fi로 연결되어 있어야 합니다. |
+| Nothing to renew | 갱신할 항목이 없습니다 |
+| Installation completed. | 설치가 완료되었습니다. |
+| Error: Installation failed: … | 설치 실패: … (원본 오류 보존) |
+
+## 검수 결과 및 구현 참고
+
+1. '프로비저닝 프로파일'은 기술적으로 정확하지만 길어 UI에선 '프로파일'로 줄일지 여부.
+2. 한국어 기본 표시 vs 브라우저 언어 자동 감지 vs 수동 선택(영어로 다시 바꿀 수 있도록).
+3. '앱 목록'의 앱 표시는 프로파일 기반이며, 실제 설치 여부를 항상 확정하지 않는다는 설명을 보일지.
+4. 일본어/영어로 출력되는 기기 진단 로그는 **원문 보존**할지, 한국어 요약을 함께 제공할지.
+
+**정적·동적 웹 문구의 한국어 번역은 아직 적용되지 않았습니다.** 원본 진단 로그와 서버 오류 전문은 정확한 디버깅을 위해 보존할 것을 제안합니다. 현재 같은 버튼 영역의 버튼은 같은 너비로 배치되고 문구는 가운데 정렬됩니다. 좁은 화면에서도 버튼은 줄바꿈되지 않고 한 줄에 유지됩니다.
diff --git a/scripts/check-web-ui.cjs b/scripts/check-web-ui.cjs
new file mode 100644
index 0000000..653eca0
--- /dev/null
+++ b/scripts/check-web-ui.cjs
@@ -0,0 +1,210 @@
+"use strict";
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const vm = require("node:vm");
+const path = require("node:path");
+
+// This dashboard is shipped as include_str!(\"web/index.html\"), not a separate JS file.
+// Compile its exact embedded script to catch JavaScript regressions that cargo test misses.
+const html = fs.readFileSync(path.join(__dirname, "../src/web/index.html"), "utf8");
+const embedded = html.match(/<script>([\s\S]*?)<\/script>/);
+assert(embedded, "embedded dashboard JavaScript missing");
+new vm.Script(embedded[1], { filename: "src/web/index.html" });
+
+for (const snippet of [
+  '<html lang="en">',
+  'function profilesText(n)',
+  'data-i18n="Your apps"',
+  'data-i18n="Send test notification"',
+  'data-i18n="Sign and install"',
+  'data-i18n="Discord failure notifications"',
+  '.action-row { justify-content: flex-start; align-items: stretch; flex-wrap: nowrap; }',
+  'flex: 1 1 0; min-width: 0; max-width: 184px;',
+  '.action-row { gap: 6px; }',
+  'word-break: keep-all; overflow-wrap: anywhere;',
+  'justify-content: center; text-align: center;',
+  'class="row action-row"',
+  'id="extension-choice"',
+  'id="extension-list"',
+  'id="ext-confirm"',
+  'id="ext-all"',
+  'id="ext-none"',
+  '"/api/install/inspect?customize="',
+  'id="install-display-name"',
+  'id="install-bundle-id"',
+  'data-i18n="New app name (optional)"',
+  'data-i18n="New Bundle ID (optional)"',
+  '"/api/install/confirm"',
+  'function showExtensionOptions(info)',
+  'function updateExtensionSummary()',
+]) {
+  assert(html.includes(snippet), "Missing localized/responsive UI: " + snippet);
+}
+assert(!/[\u1100-\u11FF\u3130-\u318F\uAC00-\uD7A3]/.test(html), "dashboard must not contain Korean text");
+assert(!html.includes("language-select") && !html.includes("locale ==="), "language switcher was removed");
+for (const id of [
+  "btn-due", "btn-all", "btn-preview",
+  "auto-enable", "auto-disable",
+  "discord-save", "discord-clear", "discord-test",
+  "btn-install", "btn-login", "btn-code",
+]) {
+  assert(html.includes('id="' + id + '"'), "Missing control: " + id);
+}
+// Under 420px, action groups must stay on one row and divide the available
+// card width into three compact button slots without overflowing.
+const iphoneMiniContent = 375 - 2 * 16 - 2 * 16 - 2;
+assert((iphoneMiniContent - 2 * 6) / 3 > 90, "iPhone mini action buttons should fit 3 across");
+assert(html.includes('#code-form .row { justify-content: flex-start; flex-wrap: nowrap; gap: 8px; }'));
+assert(html.includes('<div class="row" style="margin-top:10px">'));
+
+// Safari icon and already-approved Discord test stay intact through localization.
+assert(html.includes('rel="apple-touch-icon"'));
+assert(html.includes('rel="icon"'));
+assert(html.includes('"/api/discord/test"'));
+console.log("Localized dashboard JavaScript syntax, actions, labels and layout OK");
+
+// Installation progress stays next to the IPA controls, including its final
+// failure/success. A later renewal moves the same panel back without copying
+// log nodes or losing the reader's scroll position.
+{
+  const nodes = { "app-job-slot": {}, "install-job-slot": {}, "job": { scrollTop: 42 } };
+  for (const id of ["app-job-slot", "install-job-slot"]) {
+    nodes[id].append = panel => { panel.parentElement = nodes[id]; };
+  }
+  nodes.job.parentElement = nodes["app-job-slot"];
+  const context = vm.createContext({ $: id => nodes[id], t: x => x, uploading: false });
+  for (const name of ["placeJob", "installHint"]) {
+    const fn = embedded[1].match(new RegExp("function " + name + "\\([^)]*\\) \\{[\\s\\S]*?\\r?\\n\\}"));
+    assert(fn, "missing installation UI helper: " + name);
+    vm.runInContext(fn[0], context);
+  }
+  vm.runInContext('placeJob({kind:"install",running:true})', context);
+  assert.equal(nodes.job.parentElement, nodes["install-job-slot"]);
+  vm.runInContext('placeJob({kind:"install",running:false,ok:false})', context);
+  assert.equal(nodes.job.parentElement, nodes["install-job-slot"]);
+  assert.equal(nodes.job.scrollTop, 42);
+  vm.runInContext('placeJob({kind:"renew",running:true})', context);
+  assert.equal(nodes.job.parentElement, nodes["app-job-slot"]);
+  const hint = vm.runInContext('installHint({busy:true,job:{kind:"install",running:true}})', context);
+  assert(hint.includes("Signing and installing"));
+  assert.equal(vm.runInContext('installHint({busy:true,job:{kind:"install",running:false}})', context), "Checking…");
+}
+
+// Exercise the actual dashboard functions with controlled responses. An edit
+// must survive polling, and a snapshot started before an action must not paint
+// over the newer state once another refresh has been requested.
+async function checkDashboardState() {
+  const controls = { "auto-time": { value: "" }, "auto-days": { value: "" } };
+  for (const control of Object.values(controls)) {
+    control.listeners = {};
+    control.addEventListener = (event, fn) => { control.listeners[event] = fn; };
+  }
+  const pending = [], rendered = [], timers = new Map();
+  let nextTimer = 0;
+  const context = vm.createContext({
+    document: { getElementById: id => controls[id] },
+    fetch: (_path, options) => new Promise((resolve, reject) => {
+      pending.push({ resolve, reject, signal: options.signal });
+      options.signal?.addEventListener("abort", () => reject(new Error("aborted")));
+    }),
+    AbortController,
+    setTimeout: (fn, delay) => { timers.set(++nextTimer, { fn, delay }); return nextTimer; },
+    clearTimeout: id => timers.delete(id),
+    render: s => rendered.push(s.version),
+    banner() {}, t: x => x,
+  });
+  const source = embedded[1];
+  // Run only the draft declaration/helper/listeners: the full browser render
+  // needs many unrelated DOM controls.
+  const helper = source.match(/function syncAutoRenewInputs\(auto\) \{[\s\S]*?\r?\n\}\r?\nfor \(const id of \["auto-time", "auto-days"\]\) \{[\s\S]*?\r?\n\}/);
+  assert(helper);
+  vm.runInContext('const $ = id => document.getElementById(id); let autoDraftDirty = false, autoSavePending = false;\n' + helper[0], context);
+  vm.runInContext('syncAutoRenewInputs({time:"21:17",min_days:3})', context);
+  controls["auto-time"].value = "22:30";
+  controls["auto-time"].listeners.input();
+  controls["auto-days"].value = "5";
+  controls["auto-days"].listeners.change();
+  vm.runInContext('syncAutoRenewInputs({time:"21:17",min_days:3})', context);
+  assert.equal(controls["auto-time"].value, "22:30");
+  assert.equal(controls["auto-days"].value, "5");
+  vm.runInContext('autoSavePending = true; syncAutoRenewInputs({time:"21:17",min_days:3})', context);
+  assert.equal(controls["auto-time"].value, "22:30", "an old response after save must not reset the draft");
+  vm.runInContext('syncAutoRenewInputs({time:"22:30",min_days:5})', context);
+  assert.equal(controls["auto-time"].value, "22:30");
+  assert.equal(vm.runInContext('autoDraftDirty', context), false, "server confirmation clears the draft");
+
+  const api = source.match(/async function api\(path, body, signal\) \{[\s\S]*?\r?\n\}/);
+  const refresh = source.match(/async function refresh\(\) \{[\s\S]*?\r?\n\}/);
+  assert(api && refresh);
+  vm.runInContext('let timer = null, refreshInFlight = false, refreshQueued = false;\n' + api[0] + '\n' + refresh[0], context);
+  const snapshot = version => ({ version, busy:false, phone:{checking:false}, login:{phase:""}, job:{running:false} });
+  const reply = (request, version) => request.resolve({ ok:true, json:async () => snapshot(version) });
+  const first = vm.runInContext('refresh()', context);
+  await vm.runInContext('refresh()', context);
+  assert.equal(pending.length, 1, "concurrent refresh should share one active request");
+  reply(pending[0], "older");
+  await first;
+  assert.deepEqual(rendered, [], "queued refresh must suppress the stale response");
+  const queued = [...timers.values()].find(t => t.delay === 0);
+  assert(queued, "queued refresh should start immediately");
+  queued.fn();
+  assert.equal(pending.length, 2);
+  reply(pending[1], "newer");
+  await new Promise(resolve => setImmediate(resolve));
+  assert.deepEqual(rendered, ["newer"]);
+  const nextPoll = [...timers.values()].find(t => t.delay === 15000);
+  assert(nextPoll, "polling should continue after a response");
+  nextPoll.fn();
+  assert.equal(pending.length, 3);
+  const timeout = [...timers.values()].find(t => t.delay === 10000);
+  assert(timeout, "status requests need a timeout");
+  timeout.fn();
+  await new Promise(resolve => setImmediate(resolve));
+  assert(pending[2].signal.aborted);
+  assert([...timers.values()].some(t => t.delay === 15000), "polling should recover after timeout");
+}
+checkDashboardState().catch(error => { console.error(error); process.exitCode = 1; });
+
+// A restarted server resets its sequence. Fetch its startup lines before
+// advancing the cursor, and keep the old cursor if that recovery request fails.
+async function checkLogPolling() {
+  const view = { textContent: "before restart", scrollTop: 0, clientHeight: 100, scrollHeight: 100 };
+  const requests = [], responses = [], timers = [];
+  const context = vm.createContext({
+    $: id => { assert.equal(id, "logs-view"); return view; },
+    api: async path => {
+      requests.push(path);
+      const response = responses.shift();
+      if (response instanceof Error) throw response;
+      assert(response, "unexpected log request");
+      return response;
+    },
+    setTimeout: (_fn, delay) => timers.push(delay),
+  });
+  const poll = embedded[1].match(/async function pollLogs\(\) \{[\s\S]*?\r?\n\}/);
+  assert(poll);
+  vm.runInContext('let logSeq = 100;\n' + poll[0], context);
+  responses.push({ seq: 2, lines: [] }, { seq: 3, lines: ["startup", "ready", "listening"] });
+  await vm.runInContext('pollLogs()', context);
+  assert.deepEqual(requests.splice(0), ["/api/logs?since=100", "/api/logs?since=0"]);
+  assert.equal(view.textContent, "before restart\nstartup\nready\nlistening");
+  assert.equal(vm.runInContext('logSeq', context), 3);
+  assert.equal(view.scrollTop, view.scrollHeight);
+
+  responses.push({ seq: 4, lines: ["next"] });
+  await vm.runInContext('pollLogs()', context);
+  assert.deepEqual(requests.splice(0), ["/api/logs?since=3"]);
+  assert(view.textContent.endsWith("\nnext"));
+
+  responses.push({ seq: 1, lines: [] }, new Error("temporarily offline"));
+  await vm.runInContext('pollLogs()', context);
+  assert.equal(vm.runInContext('logSeq', context), 4);
+  assert.deepEqual(requests.splice(0), ["/api/logs?since=4", "/api/logs?since=0"]);
+
+  responses.push({ seq: 0, lines: [] }, { seq: 0, lines: [] });
+  await vm.runInContext('pollLogs()', context);
+  assert.equal(vm.runInContext('logSeq', context), 0);
+  assert(view.textContent.endsWith("\nnext"));
+  assert.deepEqual(timers, [2000, 2000, 2000, 2000]);
+}
+checkLogPolling().catch(error => { console.error(error); process.exitCode = 1; });
diff --git a/src/altserver.rs b/src/altserver.rs
index 0656321..3d80e13 100644
--- a/src/altserver.rs
+++ b/src/altserver.rs
@@ -67,7 +67,7 @@ struct Ctx {
 }
 
 fn log(msg: &str) {
-    println!("[altserver] {msg}");
+    crate::log::line(&format!("[altserver] {msg}"));
 }
 
 // ---------------------------------------------------------------------------------------------
diff --git a/src/apple.rs b/src/apple.rs
index e9d74d6..de3c425 100644
--- a/src/apple.rs
+++ b/src/apple.rs
@@ -196,7 +196,7 @@ pub async fn anisette_for_altstore(dir: &Path) -> Result<serde_json::Value, Stri
     match anisette_for_altstore_once(dir).await {
         Err(e) if needs_reprovision(&e) => {
             if retire_anisette_state(dir)? {
-                println!("{}", crate::tr!(
+                crate::log::line(&crate::tr!(
                     format!("[anisette] il server non riconosce l'identità salvata ({e}); la metto da parte in state/anisette_state.stale e ne creo una nuova"),
                     format!("[anisette] server did not recognize the saved identity ({e}); moved it to state/anisette_state.stale and provisioning a new one")
                 ));
@@ -540,6 +540,9 @@ pub async fn sign_ipa(
     device_name: &str,
     udid: &str,
     ipa: &Path,
+    selected_extensions: Option<&[String]>,
+    display_name: Option<&str>,
+    custom_bundle_id: Option<&str>,
 ) -> Result<SignedApp, String> {
     let filename = ipa
         .file_name()
@@ -569,6 +572,9 @@ pub async fn sign_ipa(
             None::<fn(f32) -> std::future::Ready<()>>,
             None,
             None,
+            selected_extensions,
+            display_name,
+            custom_bundle_id,
         )
         .await
         .map_err(|e| {
@@ -580,7 +586,9 @@ pub async fn sign_ipa(
                     "App signing failed: this Apple ID already has a certificate (AltStore/SideStore). To replace it, set ALTKEEPER_REVOKE_CERTS=1 and retry; other apps will then need refreshing.".to_string()
                 )
             } else {
-                crate::tr!(format!("firma dell'app non riuscita: {e}"), format!("App signing failed: {e}"))
+                // Keep the complete report; its first line may only be a
+                // heading, with the useful cause on subsequent lines.
+                crate::tr!(format!("firma dell'app non riuscita: {detail}"), format!("App signing failed: {detail}"))
             }
         })?;
     Ok(SignedApp {
@@ -588,3 +596,4 @@ pub async fn sign_ipa(
         cleanup_dir,
     })
 }
+
diff --git a/src/dnssd.rs b/src/dnssd.rs
index 5bff58a..c2b29c0 100644
--- a/src/dnssd.rs
+++ b/src/dnssd.rs
@@ -195,7 +195,7 @@ pub fn start(zone: Zone, bind: SocketAddr) -> Result<u16, String> {
     let port = socket.local_addr().map_err(|e| e.to_string())?.port();
 
     // Quello che serve nel messaggio va letto ora: subito dopo `zone` passa al thread.
-    println!("{}", crate::tr!(
+    crate::log::line(&crate::tr!(
         format!("[dns-sd] porta {port}: pubblico {} -> {}:{}", zone.instance, zone.address, zone.port),
         format!("[dns-sd] port {port}: advertising {} -> {}:{}", zone.instance, zone.address, zone.port)
     ));
diff --git a/src/install_archive.rs b/src/install_archive.rs
new file mode 100644
index 0000000..230b208
--- /dev/null
+++ b/src/install_archive.rs
@@ -0,0 +1,254 @@
+//! Package a *signed* .app as one IPA before staging it over Wi-Fi.
+//! The old directory-based sideload path remains available as a rollback.
+use std::fs::{self, File, Metadata};
+use std::io::{Seek, Write};
+use std::path::Path;
+
+use idevice::{
+    RsdService,
+    afc::{AfcClient, opcode::AfcFopenMode},
+    installation_proxy::InstallationProxyClient,
+    rsd::RsdHandshake,
+    tcp::handle::AdapterHandle,
+};
+use tempfile::NamedTempFile;
+use tokio::io::AsyncReadExt;
+use zip::{CompressionMethod, ZipWriter, write::SimpleFileOptions};
+
+fn err(e: impl std::fmt::Display) -> String {
+    e.to_string()
+}
+
+/// On Linux, one IPA avoids thousands of remote AFC create/open/close operations.
+/// Windows uses the previous directory path until ZIP file permissions are verified there.
+pub(crate) fn use_archive_on_wifi() -> bool {
+    cfg!(unix)
+        && !std::env::var("ALTKEEPER_INSTALL_MODE")
+            .is_ok_and(|mode| mode.eq_ignore_ascii_case("directory"))
+}
+
+fn permissions(metadata: &Metadata, directory: bool) -> u32 {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let _ = directory;
+        metadata.permissions().mode() & 0o777
+    }
+    #[cfg(not(unix))]
+    {
+        let _ = metadata;
+        if directory { 0o755 } else { 0o644 }
+    }
+}
+
+fn write_tree<W: Write + Seek>(
+    zip: &mut ZipWriter<W>,
+    local: &Path,
+    archived: &str,
+) -> Result<(), String> {
+    let metadata = fs::symlink_metadata(local).map_err(err)?;
+    let mode = permissions(&metadata, metadata.is_dir());
+
+    if metadata.file_type().is_symlink() {
+        // Preserve relative framework links instead of following them or reading
+        // from outside the signed bundle. Apple extraction must retain these links.
+        let target = fs::read_link(local).map_err(err)?;
+        let target = target.to_str().ok_or("Non-UTF-8 symlink target in signed app")?;
+        zip.add_symlink(
+            archived,
+            target.replace('\\', "/"),
+            SimpleFileOptions::default().unix_permissions(mode),
+        ).map_err(err)?;
+    } else if metadata.is_dir() {
+        zip.add_directory(
+            format!("{archived}/"),
+            SimpleFileOptions::default()
+                .compression_method(CompressionMethod::Stored)
+                .unix_permissions(mode),
+        ).map_err(err)?;
+        let mut children: Vec<_> = fs::read_dir(local)
+            .map_err(err)?
+            .collect::<Result<_, _>>()
+            .map_err(err)?;
+        children.sort_by_key(|entry| entry.file_name());
+        for entry in children {
+            let name = entry.file_name();
+            let name = name.to_str().ok_or("Non-UTF-8 filename in signed app")?;
+            write_tree(zip, &entry.path(), &format!("{archived}/{name}"))?;
+        }
+    } else if metadata.is_file() {
+        zip.start_file(
+            archived,
+            SimpleFileOptions::default()
+                .compression_method(CompressionMethod::Deflated)
+                .compression_level(Some(1))
+                .unix_permissions(mode),
+        ).map_err(err)?;
+        let mut input = File::open(local).map_err(err)?;
+        std::io::copy(&mut input, zip).map_err(err)?;
+    } else {
+        return Err(format!("Unsupported file type in signed app: {}", local.display()));
+    }
+    Ok(())
+}
+
+/// Compress on disk with bounded memory, after signing and Bundle ID/name edits.
+/// tempfile deletes partial/successful archives when the install finishes.
+fn prepare_signed_app_archive(app_path: &Path) -> Result<NamedTempFile, String> {
+    let app_name = app_path.file_name()
+        .and_then(|name| name.to_str())
+        .ok_or("Signed app has no UTF-8 filename")?;
+    if !app_name.ends_with(".app") || !app_path.is_dir() {
+        return Err(format!("Expected a signed .app directory, got {}", app_path.display()));
+    }
+    let mut temporary = tempfile::Builder::new()
+        .prefix("altkeeper-install-")
+        .suffix(".ipa")
+        .tempfile()
+        .map_err(err)?;
+    {
+        let mut zip = ZipWriter::new(temporary.as_file_mut());
+        zip.add_directory(
+            "Payload/",
+            SimpleFileOptions::default()
+                .compression_method(CompressionMethod::Stored)
+                .unix_permissions(0o755),
+        ).map_err(err)?;
+        write_tree(&mut zip, app_path, &format!("Payload/{app_name}"))?;
+        zip.finish().map_err(err)?;
+    }
+    temporary.as_file_mut().flush().map_err(err)?;
+    Ok(temporary)
+}
+
+fn signed_bundle_id(app_path: &Path) -> Result<String, String> {
+    let info = plist::Value::from_file(app_path.join("Info.plist")).map_err(err)?;
+    info.as_dictionary()
+        .and_then(|values| values.get("CFBundleIdentifier"))
+        .and_then(plist::Value::as_string)
+        .filter(|id| !id.is_empty())
+        .map(str::to_owned)
+        .ok_or_else(|| format!("Signed app {} has no CFBundleIdentifier", app_path.display()))
+}
+
+/// Transfer a single IPA over AFC, then have installation_proxy unpack/install it.
+/// 0–70% reflects actual IPA bytes uploaded, 70–100% device installation.
+pub(crate) async fn install_signed_app_rsd(
+    adapter: &mut AdapterHandle,
+    handshake: &mut RsdHandshake,
+    app_path: &Path,
+    progress: &(impl Fn(u64) + Send + Sync),
+) -> Result<(), String> {
+    let bundle_id = signed_bundle_id(app_path)?;
+    let local_path = app_path.to_owned();
+    let archive = tokio::task::spawn_blocking(move || prepare_signed_app_archive(&local_path))
+        .await
+        .map_err(|e| format!("IPA packaging task failed: {e}"))??;
+
+    let name = archive.path().file_name()
+        .and_then(|name| name.to_str())
+        .ok_or("Temporary IPA filename is invalid")?;
+    let remote_path = format!("PublicStaging/{name}");
+
+    let mut afc = AfcClient::connect_rsd(adapter, handshake)
+        .await
+        .map_err(err)?;
+    // idevice's IPA helper creates PublicStaging if it does not exist.
+    if afc.get_file_info("PublicStaging").await.is_err() {
+        afc.mk_dir("PublicStaging").await.map_err(err)?;
+    }
+    let mut target = afc.open(remote_path.clone(), AfcFopenMode::WrOnly)
+        .await
+        .map_err(err)?;
+    let mut source = tokio::fs::File::open(archive.path()).await.map_err(err)?;
+    let total = source.metadata().await.map_err(err)?.len().max(1);
+    let mut sent = 0u64;
+    let mut chunk = vec![0u8; 1024 * 1024];
+    loop {
+        let count = source.read(&mut chunk).await.map_err(err)?;
+        if count == 0 { break; }
+        target.write_entire(&chunk[..count]).await.map_err(err)?;
+        sent += count as u64;
+        progress((sent.saturating_mul(70) / total).min(70));
+    }
+    target.close().await.map_err(err)?;
+
+    let mut install = InstallationProxyClient::connect_rsd(adapter, handshake)
+        .await
+        .map_err(err)?;
+    let mut options = plist::Dictionary::new();
+    // IPA installs use CFBundleIdentifier; PackageType=Developer is for a
+    // staged .app directory, not a compressed IPA package.
+    options.insert("CFBundleIdentifier".into(), plist::Value::String(bundle_id));
+    let result = install.install_with_callback(
+        remote_path.clone(),
+        Some(plist::Value::Dictionary(options)),
+        async |(percent, _)| { progress(70 + percent.min(100) * 30 / 100); },
+        (),
+    ).await.map_err(err);
+    // Do not retain a potentially large staged IPA on the phone after success
+    // or an iOS-reported installation failure. Cleanup errors must not mask
+    // the actual installation result.
+    let _ = afc.remove(remote_path).await;
+    result
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::io::Read;
+
+    #[test]
+    fn packages_signed_app_with_payload_and_nested_files() {
+        let root = tempfile::tempdir().unwrap();
+        let app = root.path().join("Renamed YouTube.app");
+        fs::create_dir_all(app.join("_CodeSignature")).unwrap();
+        fs::write(app.join("Info.plist"), b"updated bundle").unwrap();
+        fs::write(app.join("_CodeSignature/CodeResources"), b"signed").unwrap();
+        let archive = prepare_signed_app_archive(&app).unwrap();
+        let mut zip = zip::ZipArchive::new(File::open(archive.path()).unwrap()).unwrap();
+        assert!(zip.by_name("Payload/Renamed YouTube.app/").is_ok());
+        assert_eq!(zip.by_name("Payload/Renamed YouTube.app/Info.plist").unwrap().size(), 14);
+        assert!(zip.by_name("Payload/Renamed YouTube.app/_CodeSignature/CodeResources").is_ok());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn keeps_executable_permissions_and_symlinks() {
+        use std::os::unix::fs::{PermissionsExt, symlink};
+        let root = tempfile::tempdir().unwrap();
+        let app = root.path().join("Demo.app");
+        fs::create_dir(&app).unwrap();
+        let executable = app.join("Demo");
+        fs::write(&executable, b"binary").unwrap();
+        fs::set_permissions(&executable, fs::Permissions::from_mode(0o755)).unwrap();
+        symlink("Demo", app.join("Current")).unwrap();
+        let archive = prepare_signed_app_archive(&app).unwrap();
+        let mut zip = zip::ZipArchive::new(File::open(archive.path()).unwrap()).unwrap();
+        let mode = zip.by_name("Payload/Demo.app/Demo").unwrap().unix_mode().unwrap();
+        assert_eq!(mode & 0o111, 0o111);
+        let mut target = String::new();
+        zip.by_name("Payload/Demo.app/Current")
+            .unwrap().read_to_string(&mut target).unwrap();
+        assert_eq!(target, "Demo");
+    }
+
+    #[test]
+    fn uses_post_signing_bundle_id_for_ipa_install() {
+        let root = tempfile::tempdir().unwrap();
+        let app = root.path().join("Customized.app");
+        fs::create_dir(&app).unwrap();
+        let mut info = plist::Dictionary::new();
+        info.insert("CFBundleIdentifier".into(),
+            plist::Value::String("com.example.custom.TEAM1234".into()));
+        plist::Value::Dictionary(info)
+            .to_file_xml(app.join("Info.plist")).unwrap();
+        assert_eq!(signed_bundle_id(&app).unwrap(), "com.example.custom.TEAM1234");
+    }
+
+    #[test]
+    fn rejects_non_app_directories() {
+        let root = tempfile::tempdir().unwrap();
+        assert!(prepare_signed_app_archive(root.path()).is_err());
+    }
+}
diff --git a/src/log.rs b/src/log.rs
new file mode 100644
index 0000000..979d6d9
--- /dev/null
+++ b/src/log.rs
@@ -0,0 +1,161 @@
+// Righe di log del server (AltServer, pagina web, DNS-SD): ognuna con data e ora, scritta sul
+// terminale, in coda a `altkeeper.log` e in memoria per la scheda Logs della pagina.
+
+use std::collections::VecDeque;
+use std::fs::{File, OpenOptions};
+use std::io::Write;
+use std::path::{Path, PathBuf};
+use std::sync::Mutex;
+
+pub const FILE_NAME: &str = "altkeeper.log";
+const MAX_FILE: u64 = 5 * 1024 * 1024;
+const MAX_LINES: usize = 2000;
+
+struct Sink {
+    path: Option<PathBuf>,
+    file: Option<File>,
+    size: u64,
+    max_file: u64,
+    ring: VecDeque<(u64, String)>,
+    seq: u64,
+}
+
+impl Sink {
+    const fn new(max_file: u64) -> Self {
+        Sink { path: None, file: None, size: 0, max_file, ring: VecDeque::new(), seq: 0 }
+    }
+
+    fn open(&mut self, path: PathBuf) {
+        self.file = OpenOptions::new().create(true).append(true).open(&path).ok();
+        self.size = self.file.as_ref().and_then(|f| f.metadata().ok()).map_or(0, |m| m.len());
+        self.path = Some(path);
+    }
+
+    fn record(&mut self, line: &str) {
+        self.seq += 1;
+        self.ring.push_back((self.seq, line.to_string()));
+        if self.ring.len() > MAX_LINES {
+            self.ring.pop_front();
+        }
+        let len = line.len() as u64 + 1;
+        if self.file.is_some() && self.size + len > self.max_file {
+            self.rotate();
+        }
+        if let Some(f) = self.file.as_mut() {
+            if writeln!(f, "{line}").is_ok() {
+                self.size += len;
+            }
+        }
+    }
+
+    // Il file pieno diventa `altkeeper.log.1` (quello vecchio si perde) e se ne apre uno nuovo.
+    fn rotate(&mut self) {
+        let Some(path) = self.path.clone() else { return };
+        self.file = None;
+        let old = path.with_extension("log.1");
+        let _ = std::fs::remove_file(&old);
+        let _ = std::fs::rename(&path, &old);
+        self.open(path);
+    }
+
+    fn since(&self, seq: u64) -> (u64, Vec<String>) {
+        let lines = self.ring.iter().filter(|(s, _)| *s > seq).map(|(_, l)| l.clone()).collect();
+        (self.seq, lines)
+    }
+}
+
+static SINK: Mutex<Sink> = Mutex::new(Sink::new(MAX_FILE));
+
+fn sink() -> std::sync::MutexGuard<'static, Sink> {
+    SINK.lock().unwrap_or_else(|e| e.into_inner())
+}
+
+/// Da qui in poi le righe vanno anche in `dir/altkeeper.log`.
+pub fn init(dir: &Path) {
+    sink().open(dir.join(FILE_NAME));
+}
+
+pub fn stamp(now: chrono::DateTime<chrono::Local>, msg: &str) -> String {
+    format!("[{}] {msg}", now.format("%Y-%m-%d %H:%M:%S"))
+}
+
+pub fn line(msg: &str) {
+    let l = stamp(chrono::Local::now(), msg);
+    println!("{l}");
+    sink().record(&l);
+}
+
+// La usano solo il tray e gli aggiornamenti (Windows).
+#[cfg_attr(not(windows), allow(dead_code))]
+pub fn err(msg: &str) {
+    let l = stamp(chrono::Local::now(), msg);
+    eprintln!("{l}");
+    sink().record(&l);
+}
+
+/// Le righe dopo `seq`, e il numero dell'ultima.
+pub fn since(seq: u64) -> (u64, Vec<String>) {
+    sink().since(seq)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use chrono::TimeZone;
+
+    fn temp_dir(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("altkeeper-log-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn stamp_format() {
+        let t = chrono::Local.with_ymd_and_hms(2026, 10, 25, 14, 3, 22).unwrap();
+        assert_eq!(stamp(t, "x"), "[2026-10-25 14:03:22] x");
+    }
+
+    #[test]
+    fn ring_keeps_last_2000() {
+        let mut s = Sink::new(MAX_FILE);
+        for i in 1..=2005 {
+            s.record(&format!("line {i}"));
+        }
+        let (seq, lines) = s.since(0);
+        assert_eq!(seq, 2005);
+        assert_eq!(lines.len(), 2000);
+        assert_eq!(lines[0], "line 6");
+    }
+
+    #[test]
+    fn since_returns_only_new() {
+        let mut s = Sink::new(MAX_FILE);
+        s.record("a");
+        let (seq, _) = s.since(0);
+        s.record("b");
+        assert_eq!(s.since(seq), (2, vec!["b".to_string()]));
+        assert_eq!(s.since(2), (2, vec![]));
+    }
+
+    #[test]
+    fn rotates_when_full() {
+        let d = temp_dir("rotate");
+        let mut s = Sink::new(100);
+        s.open(d.join(FILE_NAME));
+        for _ in 0..10 {
+            s.record("0123456789012345678901234567890123456789");
+        }
+        assert!(d.join("altkeeper.log.1").exists());
+        assert!(std::fs::metadata(d.join(FILE_NAME)).unwrap().len() <= 100);
+    }
+
+    #[test]
+    fn log_survives_unwritable_file() {
+        let d = temp_dir("unwritable");
+        let mut s = Sink::new(MAX_FILE);
+        s.open(d.clone()); // una cartella non si apre come file
+        s.record("still fine");
+        assert_eq!(s.since(0).1, vec!["still fine".to_string()]);
+    }
+}
diff --git a/src/main.rs b/src/main.rs
index 7943bef..32410a9 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -5,7 +5,7 @@
 //!   altkeeper pair-usb [file]                     crea il pairing remoto via USB
 //!   altkeeper login <apple-id>                    accede e salva l'account
 //!   altkeeper apps                                elenca App ID e scadenze
-//!   altkeeper renew [--phone ip:porta] [--dry-run] [--force] [--min-days N]
+//!   altkeeper renew [--phone ip:porta] [--dry-run] [--force] [--min-days N] [--bundle ID] [--installed-only]
 //!   altkeeper profile-remove <uuid> [--phone ip:porta]   toglie un profilo (ne salva prima una copia)
 //!   altkeeper profile-restore <file> [--phone ip:porta]  rimette un profilo salvato
 //!   altkeeper serve [--bind ip:porta] [--pin PIN] [--dir cartella] [--phone ip:porta]
@@ -14,6 +14,9 @@
 //!   altkeeper altserver [--port N] [--dir cartella] [--phone ip:porta]
 //!                    [--dns-domain D --dns-address IP [--dns-port N]]
 //!                                                  fa da AltServer per AltStore (Refresh All e installazioni)
+//!   altkeeper tray [--dir cartella] [--phone ip:porta] [--console]
+//!                                                  (solo Windows) icona nella barra di sistema: come
+//!                                                  `serve --altserver` ma senza terminale
 //!
 //! Se non indichi il telefono (`--phone` o ALTKEEPER_PHONE) lo cerca in rete via Bonjour.
 //!
@@ -26,9 +29,15 @@ mod dnssd;
 mod env;
 mod fsperm;
 mod i18n;
+mod install_archive;
+mod log;
 mod phone;
 mod profile;
 mod terminal;
+#[cfg(windows)]
+mod tray;
+#[cfg(windows)]
+mod update;
 mod web;
 
 use std::net::SocketAddr;
@@ -229,6 +238,8 @@ async fn cmd_renew(
     dry_run: bool,
     force: bool,
     min_days: i64,
+    bundle_filter: Option<&str>,
+    installed_only: bool,
     say: &mut dyn FnMut(&str),
 ) -> Result<(), String> {
     let acc = apple::load_account(Path::new("."))?;
@@ -254,22 +265,84 @@ async fn cmd_renew(
     // scade più tardi, e si rinnova una volta sola (altrimenti ogni giro rifarebbe il rinnovo
     // finché il profilo vecchio non scade).
     let latest = profile::latest_by_bundle(mine);
+    let bundles: Vec<&str> = latest.iter().filter_map(|p| p.bundle_id.as_deref()).collect();
+    // Use the shortest remaining lifetime in each app/extension group, so an
+    // expiring extension triggers renewal for all related profiles.
+    let group_days: std::collections::HashMap<&str, i64> = {
+        let mut result = std::collections::HashMap::new();
+        for p in &latest {
+            if let Some(bundle) = p.bundle_id.as_deref() {
+                let root = profile::group_root(bundle, &bundles, &team_id);
+                result.entry(root).and_modify(|days: &mut i64| {
+                    *days = (*days).min(p.days_left().unwrap_or(-1));
+                }).or_insert_with(|| p.days_left().unwrap_or(-1));
+            }
+        }
+        result
+    };
+
+    // When the installed-app lookup fails, explicitly fall back to renewing ALL
+    // known team profiles. This is intentional and must be visible in logs.
+    let mut fallback_renew_all = false;
+    let installed = if installed_only {
+        match phone::with_timeout(
+            "Installed app lookup",
+            std::time::Duration::from_secs(30),
+            link.installed_app_ids(),
+        ).await {
+            Ok(apps) => {
+                say(&format!("Detected {} installed user apps on the iPhone.", apps.len()));
+                Some(apps)
+            }
+            Err(err) => {
+                fallback_renew_all = true;
+                say(&format!("WARNING: installed-app lookup failed: {err}"));
+                say("FALLBACK: renewing ALL known profiles for this Apple team, regardless of expiry.");
+                None
+            }
+        }
+    } else {
+        None
+    };
 
     // Si decide cosa rinnovare prima di parlare con Apple: se niente è in scadenza non si
     // accede affatto (meno login, meno rischio che Apple limiti le richieste).
     let mut due: Vec<(&str, i64)> = Vec::new();
-    for p in latest {
+    let mut requested_found = false;
+    for p in &latest {
         let Some(bundle) = p.bundle_id.as_deref() else {
             say(&format!("   {}: bundle ID cannot be read, skipping", p.name));
             continue;
         };
+        let root = profile::group_root(bundle, &bundles, &team_id);
+        if let Some(selected) = bundle_filter {
+            if selected != root { continue; }
+            requested_found = true;
+        }
+        if let Some(apps) = &installed {
+            // InstallationProxy may report either the signed (raw) Bundle ID
+            // or the unsuffixed app Bundle ID. Profiles, unlike installed
+            // apps, may carry a trailing ".{team}" in their Apple App ID.
+            let host_id = profile::profile_app_id(root, &team_id);
+            let member_id = profile::profile_app_id(bundle, &team_id);
+            if !apps.contains(root) && !apps.contains(host_id)
+                && !apps.contains(bundle) && !apps.contains(member_id)
+            {
+                say(&format!("   {bundle}: host app not installed, skipping"));
+                continue;
+            }
+        }
         let days = p.days_left().unwrap_or(-1);
-        if !force && days > min_days {
+        let group_left = *group_days.get(root).unwrap_or(&days);
+        if !force && !fallback_renew_all && group_left > min_days {
             say(&format!("   {bundle}: expires in {days} days, no renewal needed"));
             continue;
         }
         due.push((bundle, days));
     }
+    if bundle_filter.is_some() && !requested_found {
+        return Err("Selected app has no provisioning profile for the configured Apple team.".into());
+    }
     if due.is_empty() {
         say("Nothing to renew: skipping Apple sign-in.");
         return Ok(());
@@ -282,9 +355,12 @@ async fn cmd_renew(
     let ids = apple::app_ids(&mut sess, &team).await?;
 
     let mut done = 0;
+    let mut missing_app_ids = Vec::new();
     for (bundle, days) in due {
         let Some(app) = ids.iter().find(|a| a.identifier == bundle) else {
             say(&format!("   {bundle}: no matching App ID on Apple, skipping"));
+            say(&format!("MISSING_APP_ID {bundle}"));
+            missing_app_ids.push(bundle);
             continue;
         };
         if dry_run {
@@ -302,6 +378,7 @@ async fn cmd_renew(
         )
         .await?;
         say("      installed on the phone");
+        say(&format!("RENEWED {bundle}"));
         done += 1;
     }
 
@@ -312,36 +389,69 @@ async fn cmd_renew(
             say(&profile_line(p));
         }
     }
-    Ok(())
+    renewal_completion(&missing_app_ids, done)
+}
+
+/// A skipped due profile is still an incomplete renewal, even if other apps
+/// succeeded. Keep processing known IDs, then propagate failure to CLI/web
+/// callers so scheduled retries and the final failure notification still run.
+fn renewal_completion(missing_app_ids: &[&str], renewed: usize) -> Result<(), String> {
+    if missing_app_ids.is_empty() {
+        return Ok(());
+    }
+    Err(format!(
+        "Renewal incomplete: {} due profile(s) have no matching App ID on Apple; {} renewed. Missing: {}",
+        missing_app_ids.len(), renewed, missing_app_ids.join(", ")
+    ))
 }
 
 /// Toglie dal telefono il profilo con questo UUID, dopo averne salvato e riletto una copia in
 /// `profili-salvati/` (si rimette con `profile-restore`). Serve a capire se iOS accetta i
 /// profili nuovi per un'app installata con quello originale.
-async fn cmd_profile_remove(addr: Option<SocketAddr>, uuid: Option<String>) -> Result<(), String> {
-    let uuid = uuid.ok_or(crate::tr!("uso: altkeeper profile-remove <uuid>", "usage: altkeeper profile-remove <uuid>"))?;
-    let mut link = open_phone(addr, &mut |s| println!("{s}")).await?;
+/// Validate an exact UUID, back up its original bytes, then remove only that profile.
+/// The web endpoint also restricts deletion to the configured Apple team.
+async fn remove_profile_with_backup(
+    link: &mut phone::PhoneLink,
+    uuid: &str,
+    required_team: Option<&str>,
+) -> Result<profile::PhoneProfile, String> {
+    if uuid.is_empty() || uuid.len() > 64 || !uuid.bytes().all(|b| b.is_ascii_hexdigit() || b == b'-') {
+        return Err("Invalid profile UUID.".into());
+    }
     let raw = link.profiles().await?;
     let (found, parsed) = raw
         .iter()
         .find_map(|r| {
             profile::parse(r)
-                .filter(|p| p.uuid.eq_ignore_ascii_case(&uuid))
+                .filter(|p| p.uuid.eq_ignore_ascii_case(uuid))
                 .map(|p| (r, p))
         })
-        .ok_or(crate::tr!("profilo non trovato sul telefono", "profile not found on the phone"))?;
+        .ok_or("Profile not found on the iPhone.")?;
+    if let Some(team) = required_team {
+        if parsed.team_id.as_deref() != Some(team) || parsed.bundle_id.is_none() {
+            return Err("Refusing to remove a profile outside your Apple team.".into());
+        }
+    }
 
     std::fs::create_dir_all(SAVED_DIR).map_err(dbg)?;
     fsperm::restrict_dir(Path::new(SAVED_DIR)).map_err(dbg)?;
     let path = Path::new(SAVED_DIR).join(format!("{}.mobileprovision", parsed.uuid));
     fsperm::write_private(&path, found).map_err(dbg)?;
     if std::fs::read(&path).map_err(dbg)? != *found {
-        return Err(crate::tr!(format!("la copia in {} non coincide: non tolgo niente", path.display()), format!("saved copy at {} does not match; refusing to remove the profile", path.display())));
+        return Err("Profile backup verification failed; nothing was removed.".into());
     }
-    println!("{}", crate::tr!(format!("Copia salvata in {}", path.display()), format!("Copy saved to {}", path.display())));
-
     link.remove_profile(&parsed.uuid).await?;
-    println!("{}", crate::tr!(format!("Tolto dal telefono: {}  [{}]", parsed.name, parsed.uuid), format!("Removed from the phone: {}  [{}]", parsed.name, parsed.uuid)));
+    Ok(parsed)
+}
+
+async fn cmd_profile_remove(addr: Option<SocketAddr>, uuid: Option<String>) -> Result<(), String> {
+    let uuid = uuid.ok_or(crate::tr!("uso: altkeeper profile-remove <uuid>", "usage: altkeeper profile-remove <uuid>"))?;
+    let mut link = open_phone(addr, &mut |s| println!("{s}")).await?;
+    let parsed = remove_profile_with_backup(&mut link, &uuid, None).await?;
+    println!("{}", crate::tr!(
+        format!("Tolto dal telefono: {} [{}] (copia in {})", parsed.name, parsed.uuid, SAVED_DIR),
+        format!("Removed from the phone: {} [{}] (backup in {})", parsed.name, parsed.uuid, SAVED_DIR)
+    ));
     Ok(())
 }
 
@@ -416,6 +526,10 @@ async fn run() -> Result<(), String> {
         .init();
 
     let mut args: Vec<String> = std::env::args().skip(1).collect();
+    // Su Windows un doppio clic sull'exe (nessun argomento) apre la versione con l'icona.
+    if args.is_empty() && cfg!(windows) {
+        args.push("tray".into());
+    }
     if args.is_empty() {
         return Err(crate::tr!(USAGE, USAGE_EN).into());
     }
@@ -453,11 +567,18 @@ async fn run() -> Result<(), String> {
                 .map(|v| v.parse::<i64>().map_err(|e| crate::tr!(format!("--min-days non valido: {e}"), format!("invalid --min-days: {e}"))))
                 .transpose()?
                 .unwrap_or(3);
+            let bundle = opt("--bundle");
+            let force = flag("--force");
+            // Default CLI renewal (e.g. cron) and web "due" use installed-only.
+            // Explicit --force without --installed-only retains manual override behavior.
+            let installed_only = flag("--installed-only") || (!force && bundle.is_none());
             cmd_renew(
                 phone_addr(opt("--phone"))?,
                 flag("--dry-run"),
-                flag("--force"),
+                force,
                 min_days,
+                bundle.as_deref(),
+                installed_only,
                 &mut |s| println!("{s}"),
             )
             .await
@@ -474,6 +595,7 @@ async fn run() -> Result<(), String> {
             if let Some(dir) = opt("--dir") {
                 std::env::set_current_dir(&dir).map_err(|e| crate::tr!(format!("--dir {dir}: {e}"), format!("--dir {dir}: {e}")))?;
             }
+            log::init(Path::new("."));
             let phone = phone_addr(opt("--phone"))?;
             web::check_options(bind, &pin)?;
             apple::anisette_url(env::var("ANISETTE_URL").as_deref())?;
@@ -485,14 +607,69 @@ async fn run() -> Result<(), String> {
             }
             web::serve(bind, pin, phone).await
         }
+        #[cfg(windows)]
+        "tray" => {
+            // Senza --dir si usa la cartella dell'exe: all'avvio con Windows la cartella di
+            // lavoro è un'altra.
+            let dir = match opt("--dir") {
+                Some(d) => std::path::PathBuf::from(d),
+                None => std::env::current_exe()
+                    .map_err(dbg)?
+                    .parent()
+                    .ok_or(crate::tr!("cartella dell'exe non trovata", "cannot find the exe folder"))?
+                    .to_path_buf(),
+            };
+            std::env::set_current_dir(&dir).map_err(|e| format!("--dir {}: {e}", dir.display()))?;
+            let dir = std::env::current_dir().map_err(dbg)?;
+            log::init(&dir);
+            if !flag("--console") {
+                tray::hide_console();
+            }
+            // Avviato da un aggiornamento: prima si aspetta che la versione vecchia liberi le porte.
+            let replacing = opt("--replacing").and_then(|p| p.parse::<u32>().ok());
+            if let Some(pid) = replacing {
+                tray::wait_for_exit(pid);
+            }
+            let exe = std::env::current_exe().map_err(dbg)?;
+            let bind: SocketAddr = "127.0.0.1:8787".parse().map_err(dbg)?;
+            let phone = phone_addr(opt("--phone"))?;
+            let start = || -> Result<(), String> {
+                apple::anisette_url(env::var("ANISETTE_URL").as_deref())?;
+                let port = altserver::start(altserver_port(opt("--altserver-port"))?, phone)?;
+                start_dnssd(&opt, port)
+            };
+            if let Err(e) = start() {
+                log::err(&e);
+                // La versione nuova non parte: si rimette quella vecchia e si riavvia quella.
+                if replacing.is_some() && update::rollback(&exe) {
+                    log::err("[update] the new version did not start, going back to the old one");
+                    let _ = std::process::Command::new(&exe).arg("tray").arg("--dir").arg(&dir).spawn();
+                    return Err(e);
+                }
+                tray::message_box(&format!("AltKeeper cannot start:\n\n{e}"));
+                return Err(e);
+            }
+            update::cleanup(&exe);
+            let rt = tokio::runtime::Handle::current();
+            tokio::task::block_in_place(|| {
+                tray::run(bind, &dir, |proxy| {
+                    rt.spawn(async move {
+                        if let Err(e) = web::serve(bind, None, phone).await {
+                            let _ = proxy.send_event(tray::UserEvent::ServerFailed(e));
+                        }
+                    });
+                })
+            })
+        }
         "altserver" => {
             if let Some(dir) = opt("--dir") {
                 std::env::set_current_dir(&dir).map_err(|e| crate::tr!(format!("--dir {dir}: {e}"), format!("--dir {dir}: {e}")))?;
             }
+            log::init(Path::new("."));
             apple::anisette_url(env::var("ANISETTE_URL").as_deref())?;
             let port = altserver::start(altserver_port(opt("--port"))?, phone_addr(opt("--phone"))?)?;
             start_dnssd(&opt, port)?;
-            println!("{}", crate::tr!("AltServer attivo. Ctrl-C per fermarlo.", "AltServer running. Press Ctrl-C to stop."));
+            log::line(&crate::tr!("AltServer attivo. Ctrl-C per fermarlo.", "AltServer running. Press Ctrl-C to stop.").to_string());
             tokio::select! {
                 r = tokio::signal::ctrl_c() => r.map_err(dbg)?,
                 _ = terminated() => {}
@@ -514,6 +691,23 @@ async fn run() -> Result<(), String> {
 mod cli_tests {
     use super::save_password_confirmed;
 
+    #[test]
+    fn missing_due_app_ids_cannot_report_success() {
+        let missing = ["com.example.app.TEAM", "com.example.app.TEAM.extension"];
+        let error = super::renewal_completion(&missing, 0).unwrap_err();
+        assert!(error.contains("2 due profile(s)"));
+        assert!(error.contains("0 renewed"));
+        for bundle in missing { assert!(error.contains(bundle)); }
+        let partial = super::renewal_completion(&missing[..1], 2).unwrap_err();
+        assert!(partial.contains("2 renewed"));
+    }
+
+    #[test]
+    fn successful_and_no_op_renewals_remain_successful() {
+        assert!(super::renewal_completion(&[], 0).is_ok());
+        assert!(super::renewal_completion(&[], 3).is_ok());
+    }
+
     #[test]
     fn confirmation_accepts_italian_and_english_yes() {
         for yes in ["s", "S", "si", "SÌ", "y", "Y", "yes", "YES", " yes\r\n"] {
@@ -528,3 +722,4 @@ mod cli_tests {
         }
     }
 }
+
diff --git a/src/phone.rs b/src/phone.rs
index 5e3e6d1..2ddd1eb 100644
--- a/src/phone.rs
+++ b/src/phone.rs
@@ -2,6 +2,7 @@
 //! TLS-PSK, RSD e client misagent per i profili di provisioning.
 
 use std::any::Any;
+use std::collections::HashSet;
 use std::net::{IpAddr, SocketAddr};
 use std::path::Path;
 use std::time::{Duration, Instant};
@@ -137,6 +138,31 @@ impl PhoneLink {
         misagent.copy_all().await.map_err(dbg)
     }
 
+    /// Installed user-app bundle IDs, not Apple Developer App IDs or provisioning profiles.
+    /// Fail closed on a lookup error: unattended renewal must never guess.
+    pub async fn installed_app_ids(&mut self) -> Result<HashSet<String>, String> {
+        let apps = match self {
+            Self::Legacy { provider, .. }
+            | Self::Rsd {
+                usb: Some(provider),
+                ..
+            } => {
+                let mut client = InstallationProxyClient::connect(provider).await.map_err(dbg)?;
+                client.get_apps(Some("User"), None).await.map_err(dbg)?
+            }
+            Self::Rsd {
+                adapter,
+                hs,
+                usb: None,
+                ..
+            } => {
+                let mut client = InstallationProxyClient::connect_rsd(adapter, hs).await.map_err(dbg)?;
+                client.get_apps(Some("User"), None).await.map_err(dbg)?
+            }
+        };
+        Ok(apps.into_keys().collect())
+    }
+
     pub async fn install_profile(&mut self, profile: Vec<u8>) -> Result<(), String> {
         let misagent = match self {
             Self::Rsd { misagent, .. } | Self::Legacy { misagent, .. } => misagent,
@@ -211,9 +237,17 @@ impl PhoneLink {
                 hs,
                 usb: None,
                 ..
-            } => isideload::sideload::install::install_app_rsd(adapter, hs, app_path, progress)
-                .await
-                .map_err(|e| format!("Installation failed: {e}")),
+            } => {
+                if crate::install_archive::use_archive_on_wifi() {
+                    crate::install_archive::install_signed_app_rsd(adapter, hs, app_path, progress)
+                        .await
+                        .map_err(|e| format!("IPA installation failed: {e}"))
+                } else {
+                    isideload::sideload::install::install_app_rsd(adapter, hs, app_path, progress)
+                        .await
+                        .map_err(|e| format!("Installation failed: {e}"))
+                }
+            },
         }
     }
 
@@ -375,6 +409,23 @@ pub async fn connect(addr: SocketAddr, pairing_path: &str) -> Result<PhoneLink,
     })
 }
 
+/// Indirizzo di usbmuxd: `USBMUXD_SOCKET_ADDRESS` se c'è. Su Windows, senza la variabile, si usa
+/// il usbmuxd che Apple Devices / iTunes mette in ascolto su 127.0.0.1:27015, così la via USB
+/// funziona senza configurare niente.
+pub fn usbmuxd_addr() -> Result<UsbmuxdAddr, String> {
+    if let Ok(addr) = UsbmuxdAddr::from_env_var() {
+        return Ok(addr);
+    }
+    #[cfg(windows)]
+    {
+        Ok(UsbmuxdAddr::TcpSocket("127.0.0.1:27015".parse().unwrap()))
+    }
+    #[cfg(not(windows))]
+    {
+        UsbmuxdAddr::from_env_var().map_err(dbg)
+    }
+}
+
 /// Si collega via USB, se un iPhone è collegato alla macchina su cui gira AltKeeper (o a un
 /// usbmuxd raggiungibile con `USBMUXD_SOCKET_ADDRESS`). Usa il tunnel CoreDeviceProxy: serve
 /// solo che il telefono si fidi già del computer ("Registra"), non il pairing remoto.
@@ -383,7 +434,7 @@ pub async fn connect_usb(say: &mut impl FnMut(&str)) -> Result<Option<PhoneLink>
     if crate::env::is_set("NO_USB") {
         return Ok(None);
     }
-    let addr = UsbmuxdAddr::from_env_var().map_err(dbg)?;
+    let addr = usbmuxd_addr()?;
     let Ok(Ok(mut mux)) = tokio::time::timeout(Duration::from_secs(2), addr.connect(1)).await
     else {
         return Ok(None);
diff --git a/src/profile.rs b/src/profile.rs
index b5016a1..1e97816 100644
--- a/src/profile.rs
+++ b/src/profile.rs
@@ -1,7 +1,9 @@
 //! Lettura dei profili di provisioning (.mobileprovision) presenti sul telefono.
 
-use std::io::Cursor;
-use std::time::SystemTime;
+use std::fs;
+use std::io::{self, Cursor};
+use std::path::Path;
+use std::time::{Duration, SystemTime, UNIX_EPOCH};
 
 pub struct PhoneProfile {
     /// Per ora non usato: servirà a togliere dal telefono i profili sostituiti.
@@ -31,6 +33,51 @@ impl PhoneProfile {
     }
 }
 
+/// AltStore and other signers may insert their *original* ten-character
+/// Team ID into an extension bundle, even when the provisioned profile
+/// belongs to a different (current) developer team. Match only a complete
+/// parent + team-marker + nonempty extension suffix, not arbitrary prefixes.
+/// Apple provisioning App IDs may have a *second* Team ID suffix that
+/// the UI deliberately hides (e.g. host "com.foo.PXUL22799Q" is shown as
+/// "com.foo"). Keep the raw ID for Apple renewals, but ignore this final
+/// suffix while comparing parent and extension relationships.
+pub fn profile_app_id<'a>(bundle: &'a str, team: &str) -> &'a str {
+    if team.is_empty() { return bundle; }
+    bundle.strip_suffix(&format!(".{team}")).unwrap_or(bundle)
+}
+
+fn extension_of(bundle: &str, parent: &str, team: &str) -> bool {
+    let child_id = profile_app_id(bundle, team);
+    let parent_id = profile_app_id(parent, team);
+    let Some(suffix) = child_id.strip_prefix(parent_id).and_then(|s| s.strip_prefix('.')) else {
+        return false;
+    };
+    let Some((marker, extension_name)) = suffix.split_once('.') else {
+        return false;
+    };
+    !extension_name.is_empty() && (
+        marker == team ||
+        (marker.len() == 10 &&
+            marker.bytes().all(|b| b.is_ascii_uppercase() || b.is_ascii_digit()))
+    )
+}
+
+/// Resolve an extension to an *existing* host bundle: the longest valid
+/// parent wins to avoid matching adjacent/unrelated dotted app identifiers.
+pub fn group_root<'a>(bundle: &'a str, bundles: &[&'a str], team: &str) -> &'a str {
+    bundles.iter().copied()
+        .filter(|parent| *parent != bundle && extension_of(bundle, parent, team))
+        .max_by_key(|parent| parent.len())
+        .unwrap_or(bundle)
+}
+
+#[cfg(test)]
+pub fn members_of_group<'a>(root: &str, bundles: &'a [&'a str], team: &str) -> Vec<&'a str> {
+    bundles.iter().copied()
+        .filter(|b| group_root(b, bundles, team) == root)
+        .collect()
+}
+
 /// Per ogni bundle vale il profilo che scade più tardi: dopo un rinnovo quelli vecchi restano
 /// sul telefono. I profili senza bundle ID restano ciascuno per conto suo.
 pub fn latest_by_bundle<'a>(
@@ -88,6 +135,70 @@ pub fn parse(raw: &[u8]) -> Option<PhoneProfile> {
     })
 }
 
+const BACKUP_KEEP_AFTER_EXPIRY: Duration = Duration::from_secs(30 * 24 * 60 * 60);
+const CLEANUP_INTERVAL: Duration = Duration::from_secs(30 * 24 * 60 * 60);
+const CLEANUP_STAMP: &str = "state/profile-backup-last-cleanup";
+
+/// Remove only verified expired backup files matching their original UUID.
+/// An unreadable or malformed backup is retained, never guessed to be expired.
+/// Symlinks, subdirectories and unrelated files are not touched.
+pub fn cleanup_expired_backups(dir: &Path, now: SystemTime) -> io::Result<usize> {
+    let entries = match fs::read_dir(dir) {
+        Ok(entries) => entries,
+        Err(e) if e.kind() == io::ErrorKind::NotFound => return Ok(0),
+        Err(e) => return Err(e),
+    };
+    let mut removed = 0;
+    for entry in entries {
+        let entry = entry?;
+        if !entry.file_type()?.is_file() { continue; } // no symlink following
+        let path = entry.path();
+        if path.extension().and_then(|s| s.to_str()) != Some("mobileprovision") {
+            continue;
+        }
+        let Some(stem) = path.file_stem().and_then(|s| s.to_str()) else {
+            continue;
+        };
+        let Ok(data) = fs::read(&path) else {
+            continue;
+        };
+        let Some(p) = parse(&data) else {
+            continue;
+        };
+        // Never delete a file whose name does not match the embedded profile UUID.
+        if !p.uuid.eq_ignore_ascii_case(stem) { continue; }
+        let Some(expiry) = p.expires else { continue; };
+        let Ok(elapsed) = now.duration_since(SystemTime::from(expiry)) else {
+            continue;
+        };
+        if elapsed >= BACKUP_KEEP_AFTER_EXPIRY {
+            fs::remove_file(&path)?;
+            removed += 1;
+        }
+    }
+    Ok(removed)
+}
+
+/// Once per 30 days, clean backups that expired 30+ days ago.
+/// Store the last successful sweep in the persistent /data/state directory.
+pub fn cleanup_backups_if_due(now: SystemTime) -> io::Result<Option<usize>> {
+    let stamp = Path::new(CLEANUP_STAMP);
+    if let Ok(raw) = fs::read_to_string(stamp) {
+        if let Ok(last_seconds) = raw.trim().parse::<u64>() {
+            if let Some(last) = UNIX_EPOCH.checked_add(Duration::from_secs(last_seconds)) {
+                if now.duration_since(last).is_ok_and(|elapsed| elapsed < CLEANUP_INTERVAL) {
+                    return Ok(None);
+                }
+            }
+        }
+    }
+    let removed = cleanup_expired_backups(Path::new(crate::SAVED_DIR), now)?;
+    fs::create_dir_all("state")?;
+    let timestamp = now.duration_since(UNIX_EPOCH).unwrap_or_default().as_secs();
+    crate::fsperm::write_private(stamp, timestamp.to_string().as_bytes())?;
+    Ok(Some(removed))
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -127,6 +238,169 @@ mod tests {
         assert_eq!(latest_by_bundle(&all).len(), 2);
     }
 
+
+    fn backup_xml(uuid: &str, expires: Option<SystemTime>) -> Vec<u8> {
+        let mut d = plist::Dictionary::new();
+        d.insert("UUID".into(), plist::Value::String(uuid.into()));
+        if let Some(t) = expires {
+            d.insert("ExpirationDate".into(), plist::Value::Date(plist::Date::from(t)));
+        }
+        let mut out = Vec::new();
+        plist::to_writer_xml(&mut out, &plist::Value::Dictionary(d)).unwrap();
+        out
+    }
+
+    #[test]
+    fn cleanup_only_expired_over_30_days_after_expiration() {
+        let now = SystemTime::now();
+        let dir = std::env::temp_dir().join(format!(
+            "altkeeper-profile-cleanup-{}-{:?}", std::process::id(), std::thread::current().id()));
+        fs::create_dir_all(&dir).unwrap();
+
+        let old = dir.join("old.mobileprovision");
+        let recent = dir.join("recent.mobileprovision");
+        let active = dir.join("active.mobileprovision");
+        let corrupt = dir.join("corrupt.mobileprovision");
+        let mismatch = dir.join("mismatch.mobileprovision");
+        let no_expiry = dir.join("unknown.mobileprovision");
+        let unrelated = dir.join("notes.txt");
+        fs::write(&old, backup_xml("old", Some(now - Duration::from_secs(31 * 86400)))).unwrap();
+        fs::write(&recent, backup_xml("recent", Some(now - Duration::from_secs(29 * 86400)))).unwrap();
+        fs::write(&active, backup_xml("active", Some(now + Duration::from_secs(86400)))).unwrap();
+        fs::write(&corrupt, b"bad content").unwrap();
+        fs::write(&mismatch, backup_xml("another", Some(now - Duration::from_secs(60 * 86400)))).unwrap();
+        fs::write(&no_expiry, backup_xml("unknown", None)).unwrap();
+        fs::write(&unrelated, b"unrelated").unwrap();
+
+        assert_eq!(cleanup_expired_backups(&dir, now).unwrap(), 1);
+        assert!(!old.exists());
+        for file in [recent, active, corrupt, mismatch, no_expiry, unrelated] {
+            assert!(file.exists(), "unexpected deletion: {}", file.display());
+        }
+        fs::remove_dir_all(dir).unwrap();
+    }
+
+    #[test]
+    fn nonexistent_backup_folder_is_a_noop() {
+        let dir = std::env::temp_dir().join(format!(
+            "altkeeper-no-backups-{}-{:?}", std::process::id(), std::thread::current().id()));
+        assert_eq!(cleanup_expired_backups(&dir, SystemTime::now()).unwrap(), 0);
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn cleanup_retains_unreadable_backups_and_continues() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let dir = tempfile::tempdir().unwrap();
+        let now = SystemTime::now();
+        let unreadable = dir.path().join("unreadable.mobileprovision");
+        let expired = dir.path().join("expired.mobileprovision");
+        let expiry = Some(now - Duration::from_secs(31 * 86400));
+        fs::write(&unreadable, backup_xml("unreadable", expiry)).unwrap();
+        fs::write(&expired, backup_xml("expired", expiry)).unwrap();
+        fs::set_permissions(&unreadable, fs::Permissions::from_mode(0o000)).unwrap();
+        // Root bypasses mode bits, so it cannot exercise a permission-denied read.
+        if fs::read(&unreadable).is_ok() { return; }
+
+        assert_eq!(cleanup_expired_backups(dir.path(), now).unwrap(), 1);
+        assert!(unreadable.exists());
+        assert!(!expired.exists());
+    }
+
+    #[test]
+    fn extension_groups_do_not_swallow_unrelated_apps() {
+        let bundles = [
+            "com.google.ios.youtube",
+            "com.google.ios.youtube.TEAM.OpenYouTube.Extension",
+            "com.kdt.livecontainer",
+            "com.kdt.livecontainer.TEAM.LiveProcess",
+            "com.google.ios.youtube.another.app",
+        ];
+        assert_eq!(group_root(bundles[1], &bundles, "TEAM"), bundles[0]);
+        assert_eq!(group_root(bundles[3], &bundles, "TEAM"), bundles[2]);
+        assert_eq!(group_root(bundles[4], &bundles, "TEAM"), bundles[4]);
+        assert_eq!(members_of_group(bundles[2], &bundles, "TEAM").len(), 2);
+    }
+    #[test]
+    fn real_altstore_extension_bundles_group_even_if_embedded_team_differs() {
+        // Real bundle shapes seen on iOS; the embedded marker is the app's
+        // original signer, which need not equal this profile's Apple Team ID.
+        let bundles = [
+            "com.google.ios.youtube",
+            "com.google.ios.youtube.PXUL22799Q.OpenYouTube.Extension",
+            "com.kdt.livecontainer",
+            "com.kdt.livecontainer.PXUL22799Q.LaunchAppExtension",
+            "com.kdt.livecontainer.PXUL22799Q.LiveProcess",
+            "com.kdt.livecontainer.PXUL22799Q.ShareExtension",
+        ];
+        let profile_team = "DIFFERENT1";
+        assert_eq!(group_root(bundles[1], &bundles, profile_team), bundles[0]);
+        for extension in &bundles[3..] {
+            assert_eq!(group_root(extension, &bundles, profile_team), bundles[2]);
+        }
+        assert_eq!(members_of_group(bundles[0], &bundles, profile_team).len(), 2);
+        assert_eq!(members_of_group(bundles[2], &bundles, profile_team).len(), 4);
+    }
+
+    #[test]
+    fn real_provisioning_app_ids_include_trailing_team_suffix() {
+        // The web UI strips the final ".PXUL22799Q" from each raw profile
+        // bundle when it displays the names seen in the user screenshot.
+        // Previous tests used the displayed IDs and missed this failure.
+        let team = "PXUL22799Q";
+        let raw = [
+            "com.google.ios.youtube.PXUL22799Q",
+            "com.google.ios.youtube.PXUL22799Q.OpenYouTube.Extension.PXUL22799Q",
+            "com.kdt.livecontainer.PXUL22799Q",
+            "com.kdt.livecontainer.PXUL22799Q.LaunchAppExtension.PXUL22799Q",
+            "com.kdt.livecontainer.PXUL22799Q.LiveProcess.PXUL22799Q",
+            "com.kdt.livecontainer.PXUL22799Q.ShareExtension.PXUL22799Q",
+        ];
+        assert_eq!(profile_app_id(raw[0], team), "com.google.ios.youtube");
+        assert_eq!(
+            profile_app_id(raw[1], team),
+            "com.google.ios.youtube.PXUL22799Q.OpenYouTube.Extension"
+        );
+        assert_eq!(group_root(raw[1], &raw, team), raw[0]);
+        for ext in &raw[3..] {
+            assert_eq!(group_root(ext, &raw, team), raw[2]);
+        }
+        assert_eq!(members_of_group(raw[0], &raw, team).len(), 2);
+        assert_eq!(members_of_group(raw[2], &raw, team).len(), 4);
+    }
+
+    #[test]
+    fn trailing_suffix_must_match_current_profile_team_exactly() {
+        let raw = [
+            "com.example.app.AAAAAAAAAA",
+            "com.example.app.BBBBBBBBBB.Ext.AAAAAAAAAA",
+            "com.example.app.feature.other",
+        ];
+        assert_eq!(group_root(raw[1], &raw, "AAAAAAAAAA"), raw[0]);
+        assert_eq!(group_root(raw[2], &raw, "AAAAAAAAAA"), raw[2]);
+        assert_eq!(profile_app_id(raw[0], "BBBBBBBBBB"), raw[0]);
+    }
+
+    #[test]
+    fn malformed_team_markers_do_not_group_unrelated_bundles() {
+        let bundles = [
+            "com.example.app",
+            "com.example.app.feature.widget",
+            "com.example.app.short.Widget",
+            "com.example.app.PXUL22799Q",
+            "com.example.app.PXUL22799q.Widget",
+            "com.example.app.PXUL22799Q.Widget",
+            "com.example.app.PXUL22799Q.", // no extension name
+            "com.example.app.PXUL22799Q.Widget.More",
+        ];
+        for index in [1,2,3,4,6] {
+            assert_eq!(group_root(bundles[index], &bundles, "SAVEDTEAM1"), bundles[index]);
+        }
+        assert_eq!(group_root(bundles[5], &bundles, "SAVEDTEAM1"), bundles[0]);
+        assert_eq!(group_root(bundles[7], &bundles, "SAVEDTEAM1"), bundles[0]);
+    }
+
     #[test]
     fn senza_profili_non_c_e_niente() {
         assert!(latest_by_bundle(&[]).is_empty());
diff --git a/src/tray.rs b/src/tray.rs
new file mode 100644
index 0000000..d379356
--- /dev/null
+++ b/src/tray.rs
@@ -0,0 +1,554 @@
+//! Icona nella barra di sistema e finestra con la pagina web (solo Windows). Comando
+//! `altkeeper tray`: AltServer e la pagina girano come con `serve --altserver`, senza terminale.
+//! Chiudere la finestra la nasconde soltanto; il programma si ferma solo con "Quit".
+
+use std::io::{self, Read as _, Write as _};
+use std::net::{SocketAddr, TcpStream};
+use std::path::Path;
+use std::time::{Duration, Instant};
+
+use tao::event::{Event, WindowEvent};
+use tao::event_loop::{ControlFlow, EventLoopBuilder, EventLoopProxy, EventLoopWindowTarget};
+use tao::window::{Window, WindowBuilder};
+use tray_icon::menu::{CheckMenuItem, Menu, MenuEvent, MenuItem, PredefinedMenuItem};
+use tray_icon::{Icon, MouseButton, TrayIconBuilder, TrayIconEvent};
+use winreg::RegKey;
+use winreg::enums::HKEY_CURRENT_USER;
+use wry::{WebView, WebViewBuilder};
+
+const RUN_KEY: &str = r"Software\Microsoft\Windows\CurrentVersion\Run";
+const RUN_VALUE: &str = "AltKeeperPlus";
+const AUTOSTART_MARKER: &str = "autostart-initialised";
+
+pub enum UserEvent {
+    Tray(TrayIconEvent),
+    Menu(MenuEvent),
+    ServerFailed(String),
+    Status { reachable: bool, tip: String },
+    Updates(Option<crate::update::Release>),
+    Restart,
+    UpdateFailed(String),
+}
+
+/// Aspetta (al massimo 20 s) che il processo `pid` finisca: dopo un aggiornamento la versione
+/// vecchia deve liberare le porte prima che la nuova le apra.
+pub fn wait_for_exit(pid: u32) {
+    use windows_sys::Win32::Foundation::CloseHandle;
+    use windows_sys::Win32::System::Threading::{
+        OpenProcess, PROCESS_SYNCHRONIZE, WaitForSingleObject,
+    };
+    unsafe {
+        let h = OpenProcess(PROCESS_SYNCHRONIZE, 0, pid);
+        if !h.is_null() {
+            if WaitForSingleObject(h, 20_000) != 0 {
+                crate::log::err("[update] the previous version is still running after 20 s");
+            }
+            CloseHandle(h);
+        }
+    }
+}
+
+/// Controlla le release; `manual` = chiesto dal menu, quindi si risponde anche quando non c'è
+/// niente di nuovo.
+fn check_updates(proxy: &EventLoopProxy<UserEvent>, manual: bool) {
+    let latest = crate::update::check();
+    if let Err(e) = &latest {
+        crate::log::err(&format!("[update] {e}"));
+    }
+    if manual {
+        match &latest {
+            Ok(None) => toast(&format!("AltKeeperPlus {} is up to date.", env!("CARGO_PKG_VERSION"))),
+            Err(e) => toast(&format!("Update check failed: {e}")),
+            Ok(Some(_)) => {}
+        }
+    }
+    let latest = latest.ok().flatten();
+    let _ = proxy.send_event(UserEvent::Updates(latest));
+}
+
+/// Stacca il processo dal terminale: lanciato con un doppio clic, la finestra nera si chiude.
+pub fn hide_console() {
+    unsafe {
+        windows_sys::Win32::System::Console::FreeConsole();
+    }
+}
+
+pub fn message_box(text: &str) {
+    use windows_sys::Win32::UI::WindowsAndMessaging::{MB_ICONERROR, MB_OK, MessageBoxW};
+    let wide = |s: &str| s.encode_utf16().chain(Some(0)).collect::<Vec<u16>>();
+    let (text, title) = (wide(text), wide("AltKeeperPlus"));
+    unsafe {
+        MessageBoxW(std::ptr::null_mut(), text.as_ptr(), title.as_ptr(), MB_OK | MB_ICONERROR);
+    }
+}
+
+/// Logo di AltKeeper (assets/logo.png) già ridotto in RGBA grezzo: a colori quando il telefono
+/// è raggiungibile, in grigio quando non lo è.
+const LOGO_32: &[u8] = include_bytes!("../assets/logo-32.rgba");
+const LOGO_GREY_32: &[u8] = include_bytes!("../assets/logo-grey-32.rgba");
+const LOGO_64: &[u8] = include_bytes!("../assets/logo-64.rgba");
+
+pub fn logo(reachable: bool) -> Icon {
+    let rgba = if reachable { LOGO_32 } else { LOGO_GREY_32 };
+    Icon::from_rgba(rgba.to_vec(), 32, 32).expect("valid icon")
+}
+
+fn run_key() -> io::Result<RegKey> {
+    RegKey::predef(HKEY_CURRENT_USER).create_subkey(RUN_KEY).map(|(k, _)| k)
+}
+
+pub fn autostart_command(exe: &Path, dir: &Path) -> String {
+    format!("\"{}\" tray --dir \"{}\"", exe.display(), dir.display())
+}
+
+fn autostart_enabled_as(name: &str) -> bool {
+    run_key().and_then(|k| k.get_value::<String, _>(name)).is_ok()
+}
+
+fn set_autostart_as(name: &str, on: bool, exe: &Path, dir: &Path) -> io::Result<()> {
+    let key = run_key()?;
+    if on {
+        key.set_value(name, &autostart_command(exe, dir))
+    } else {
+        match key.delete_value(name) {
+            Err(e) if e.kind() == io::ErrorKind::NotFound => Ok(()),
+            r => r,
+        }
+    }
+}
+
+/// Alla prima esecuzione attiva l'avvio con Windows; dopo rispetta la scelta fatta dal menu.
+/// Se è attivo riscrive il comando, così vale anche se l'exe è stato spostato.
+fn ensure_autostart_default_as(name: &str, state_dir: &Path, exe: &Path, dir: &Path) {
+    let marker = state_dir.join(AUTOSTART_MARKER);
+    if !marker.exists() {
+        let _ = set_autostart_as(name, true, exe, dir);
+        let _ = std::fs::create_dir_all(state_dir);
+        let _ = std::fs::write(&marker, "");
+    } else if autostart_enabled_as(name) {
+        let _ = set_autostart_as(name, true, exe, dir);
+    }
+}
+
+/// Testo del tooltip: quante app e la scadenza più vicina (`days` = giorni rimasti per app).
+pub fn summary(days: &[i64]) -> String {
+    let Some(&min) = days.iter().min() else {
+        return "AltKeeperPlus: no apps".into();
+    };
+    let n = days.len();
+    let apps = if n == 1 { "1 app".to_string() } else { format!("{n} apps") };
+    let next = match min {
+        ..0 => "one has expired".to_string(),
+        0 => "one expires today".to_string(),
+        1 => "next expiry in 1 day".to_string(),
+        d => format!("next expiry in {d} days"),
+    };
+    format!("AltKeeperPlus: {apps}, {next}")
+}
+
+#[derive(Debug, PartialEq)]
+pub enum Note {
+    Renewed(Vec<String>),
+    Installed,
+    Failed(String),
+}
+
+/// Dalle righe di log, gli avvisi da mostrare. I profili installati di seguito diventano un
+/// avviso solo.
+pub fn notes(lines: &[String]) -> Vec<Note> {
+    let mut out = Vec::new();
+    for line in lines {
+        let msg = line.split_once("] ").map_or(line.as_str(), |(_, m)| m);
+        // Le righe di AltServer sono nella lingua della CLI (ALTKEEPER_LANG): si riconoscono entrambe.
+        if let Some(bundle) = msg
+            .strip_prefix("[altserver] profile installed: ")
+            .or_else(|| msg.strip_prefix("[altserver] profilo installato: "))
+        {
+            if let Some(Note::Renewed(v)) = out.last_mut() {
+                v.push(bundle.to_string());
+            } else {
+                out.push(Note::Renewed(vec![bundle.to_string()]));
+            }
+        } else if matches!(
+            msg,
+            "[altserver] app installed" | "[altserver] app installata" | "[web] Installation completed."
+        ) {
+            out.push(Note::Installed);
+        } else if let Some(e) = msg
+            .strip_prefix("[altserver] installation failed: ")
+            .or_else(|| msg.strip_prefix("[altserver] installazione non riuscita: "))
+            .or_else(|| msg.strip_prefix("[web] Error: "))
+        {
+            out.push(Note::Failed(e.to_string()));
+        }
+    }
+    out
+}
+
+/// Al massimo un avviso di errore ogni 10 minuti (AltStore riprova da solo).
+#[derive(Default)]
+pub struct FailGate {
+    last: Option<Instant>,
+}
+
+impl FailGate {
+    pub fn allow(&mut self, now: Instant) -> bool {
+        let ok = self.last.is_none_or(|t| now.duration_since(t) >= Duration::from_secs(600));
+        if ok {
+            self.last = Some(now);
+        }
+        ok
+    }
+}
+
+fn toast(text: &str) {
+    use tauri_winrt_notification::Toast;
+    let _ = Toast::new(Toast::POWERSHELL_APP_ID).title("AltKeeperPlus").text1(text).show();
+}
+
+/// Guarda le righe di log nuove e mostra gli avvisi.
+fn watch_log() {
+    let mut seq = crate::log::since(u64::MAX).0;
+    let mut gate = FailGate::default();
+    loop {
+        std::thread::sleep(Duration::from_secs(2));
+        let (latest, lines) = crate::log::since(seq);
+        seq = latest;
+        for note in notes(&lines) {
+            match note {
+                Note::Renewed(b) => toast(&format!("Profiles installed: {}", b.join(", "))),
+                Note::Installed => toast("App installed on the iPhone."),
+                Note::Failed(e) if gate.allow(Instant::now()) => toast(&format!("Failed: {e}")),
+                Note::Failed(_) => {}
+            }
+        }
+    }
+}
+
+/// GET minimale verso la pagina locale; `None` se non risponde.
+fn http_get(addr: SocketAddr, path: &str) -> Option<String> {
+    let mut s = TcpStream::connect_timeout(&addr, Duration::from_secs(5)).ok()?;
+    s.set_read_timeout(Some(Duration::from_secs(60))).ok()?;
+    write!(s, "GET {path} HTTP/1.0\r\nHost: {addr}\r\n\r\n").ok()?;
+    let mut body = String::new();
+    s.read_to_string(&mut body).ok()?;
+    body.split_once("\r\n\r\n").map(|(_, b)| b.to_string())
+}
+
+/// Ogni 5 minuti legge lo stato dalla pagina (che riguarda il telefono se il dato è vecchio)
+/// e aggiorna colore e tooltip dell'icona.
+fn watch_state(addr: SocketAddr, proxy: EventLoopProxy<UserEvent>) {
+    std::thread::sleep(Duration::from_secs(5));
+    for round in 0.. {
+        if let Some(v) = http_get(addr, "/api/state")
+            .and_then(|b| serde_json::from_str::<serde_json::Value>(&b).ok())
+        {
+            let reachable = v["phone"]["reachable"].as_bool() == Some(true);
+            let days: Vec<i64> = v["apps"]
+                .as_array()
+                .map(|a| a.iter().filter_map(|x| x["days"].as_i64()).collect())
+                .unwrap_or_default();
+            let _ = proxy.send_event(UserEvent::Status { reachable, tip: summary(&days) });
+        }
+        // Il primo controllo del telefono parte con la prima richiesta: si riguarda presto.
+        std::thread::sleep(Duration::from_secs(if round == 0 { 60 } else { 300 }));
+    }
+}
+
+fn show(
+    slot: &mut Option<(Window, WebView)>,
+    target: &EventLoopWindowTarget<UserEvent>,
+    url: &str,
+) {
+    if let Some((window, webview)) = slot {
+        if url.contains('#') {
+            let _ = webview.load_url(url);
+        }
+        window.set_visible(true);
+        window.set_minimized(false);
+        window.set_focus();
+        return;
+    }
+    let window = match WindowBuilder::new()
+        .with_title("AltKeeperPlus")
+        .with_inner_size(tao::dpi::LogicalSize::new(560.0, 860.0))
+        .with_window_icon(tao::window::Icon::from_rgba(LOGO_64.to_vec(), 64, 64).ok())
+        .build(target)
+    {
+        Ok(w) => w,
+        Err(e) => return crate::log::err(&format!("[tray] cannot open the window: {e}")),
+    };
+    match WebViewBuilder::new().with_url(url).build(&window) {
+        Ok(webview) => *slot = Some((window, webview)),
+        Err(e) => {
+            let msg = format!("Cannot show the page (is Microsoft Edge WebView2 installed?): {e}");
+            crate::log::err(&format!("[tray] {msg}"));
+            message_box(&format!("{msg}\n\nThe page is also at {url}"));
+        }
+    }
+}
+
+/// Avvia il ciclo degli eventi con l'icona; `start` riceve il proxy per segnalare errori del
+/// server. Non ritorna: "Quit" chiude il processo.
+pub fn run(bind: SocketAddr, dir: &Path, start: impl FnOnce(EventLoopProxy<UserEvent>)) -> ! {
+    let url = format!("http://{bind}/");
+    let event_loop = EventLoopBuilder::<UserEvent>::with_user_event().build();
+    let proxy = event_loop.create_proxy();
+    let p = proxy.clone();
+    TrayIconEvent::set_event_handler(Some(move |e| {
+        let _ = p.send_event(UserEvent::Tray(e));
+    }));
+    let p = proxy.clone();
+    MenuEvent::set_event_handler(Some(move |e| {
+        let _ = p.send_event(UserEvent::Menu(e));
+    }));
+
+    let exe = std::env::current_exe().unwrap_or_default();
+    ensure_autostart_default_as(RUN_VALUE, &dir.join("state"), &exe, dir);
+
+    let open = MenuItem::new("Open AltKeeper", true, None);
+    let logs = MenuItem::new("Show logs", true, None);
+    let autostart =
+        CheckMenuItem::new("Start with Windows", true, autostart_enabled_as(RUN_VALUE), None);
+    let check = MenuItem::new("Check for updates", true, None);
+    let update_now = MenuItem::new("Up to date", false, None);
+    let quit = MenuItem::new("Quit", true, None);
+    let menu = Menu::new();
+    let _ = menu.append_items(&[
+        &open,
+        &logs,
+        &PredefinedMenuItem::separator(),
+        &autostart,
+        &check,
+        &update_now,
+        &PredefinedMenuItem::separator(),
+        &quit,
+    ]);
+    // All'avvio con Windows l'area di notifica può non essere ancora pronta: si riprova per un
+    // minuto prima di arrendersi.
+    let build = || {
+        TrayIconBuilder::new()
+            .with_menu(Box::new(menu.clone()))
+            .with_menu_on_left_click(false)
+            .with_tooltip("AltKeeperPlus")
+            .with_icon(logo(false))
+            .build()
+    };
+    let tray = (0..30)
+        .find_map(|_| {
+            build().map_err(|_| std::thread::sleep(Duration::from_secs(2))).ok()
+        })
+        .unwrap_or_else(|| {
+            message_box("AltKeeperPlus cannot create its tray icon. Start it again.");
+            std::process::exit(1)
+        });
+
+    std::thread::spawn(watch_log);
+    let p = proxy.clone();
+    std::thread::spawn(move || watch_state(bind, p));
+    let p = proxy.clone();
+    std::thread::spawn(move || {
+        std::thread::sleep(Duration::from_secs(30));
+        loop {
+            check_updates(&p, false);
+            std::thread::sleep(Duration::from_secs(24 * 3600));
+        }
+    });
+    let check_proxy = proxy.clone();
+    let mut pending: Option<crate::update::Release> = None;
+    let mut staging = false;
+    let mut announced = String::new();
+    start(proxy);
+
+    let dir = dir.to_path_buf();
+    let mut slot: Option<(Window, WebView)> = None;
+    event_loop.run(move |event, target, control_flow| {
+        *control_flow = ControlFlow::Wait;
+        match event {
+            Event::UserEvent(UserEvent::Tray(TrayIconEvent::DoubleClick {
+                button: MouseButton::Left,
+                ..
+            })) => show(&mut slot, target, &url),
+            Event::UserEvent(UserEvent::Menu(e)) => {
+                if e.id == open.id() {
+                    show(&mut slot, target, &url);
+                } else if e.id == logs.id() {
+                    show(&mut slot, target, &format!("{url}#logs"));
+                } else if e.id == autostart.id() {
+                    let on = autostart.is_checked();
+                    if let Err(err) = set_autostart_as(RUN_VALUE, on, &exe, &dir) {
+                        crate::log::err(&format!("[tray] cannot change Start with Windows: {err}"));
+                        autostart.set_checked(!on);
+                    }
+                } else if e.id == check.id() {
+                    let p = check_proxy.clone();
+                    std::thread::spawn(move || check_updates(&p, true));
+                } else if e.id == update_now.id() && !staging {
+                    if let Some(r) = pending.clone() {
+                        staging = true;
+                        update_now.set_enabled(false);
+                        update_now.set_text("Downloading the update...");
+                        let (p, exe) = (check_proxy.clone(), exe.clone());
+                        std::thread::spawn(move || {
+                            let _ = p.send_event(match crate::update::stage(&r, &exe) {
+                                Ok(()) => UserEvent::Restart,
+                                Err(e) => UserEvent::UpdateFailed(e),
+                            });
+                        });
+                    }
+                } else if e.id == quit.id() {
+                    crate::altserver::stop();
+                    std::process::exit(0);
+                }
+            }
+            Event::UserEvent(UserEvent::Status { reachable, tip }) => {
+                let _ = tray.set_icon(Some(logo(reachable)));
+                let _ = tray.set_tooltip(Some(tip));
+            }
+            Event::UserEvent(UserEvent::Updates(latest)) if !staging => {
+                if let Some(r) = &latest {
+                    update_now.set_text(format!("Update now to {}", r.tag));
+                    update_now.set_enabled(true);
+                    if announced != r.tag {
+                        toast(&format!(
+                            "{} is available. Right-click the tray icon and choose Update now.",
+                            r.tag
+                        ));
+                        announced = r.tag.clone();
+                    }
+                }
+                pending = latest.or(pending.take());
+            }
+            Event::UserEvent(UserEvent::Restart) => {
+                crate::log::line("[update] restarting with the new version");
+                crate::altserver::stop();
+                let spawned = std::process::Command::new(&exe)
+                    .arg("tray")
+                    .arg("--dir")
+                    .arg(&dir)
+                    .arg("--replacing")
+                    .arg(std::process::id().to_string())
+                    .spawn();
+                match spawned {
+                    Ok(_) => std::process::exit(0),
+                    // AltServer è già fermo: meglio chiudere in modo visibile che restare
+                    // aperti senza servire AltStore.
+                    Err(e) => {
+                        crate::update::rollback(&exe);
+                        crate::log::err(&format!("[update] cannot start the new version: {e}"));
+                        message_box(&format!(
+                            "The update could not start ({e}). The previous version was kept.\n\n\
+                             Start AltKeeperPlus again."
+                        ));
+                        std::process::exit(1);
+                    }
+                }
+            }
+            Event::UserEvent(UserEvent::UpdateFailed(e)) => {
+                staging = false;
+                crate::log::err(&format!("[update] {e}"));
+                toast(&format!("Update failed: {e}"));
+                update_now.set_text("Update now (try again)");
+                update_now.set_enabled(true);
+            }
+            Event::UserEvent(UserEvent::ServerFailed(msg)) => {
+                crate::log::err(&msg);
+                message_box(&format!("AltKeeperPlus cannot start:\n\n{msg}"));
+                std::process::exit(1);
+            }
+            Event::WindowEvent { event: WindowEvent::CloseRequested, .. } => {
+                if let Some((window, _)) = &slot {
+                    window.set_visible(false);
+                }
+            }
+            _ => {}
+        }
+    })
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn summary_text() {
+        assert_eq!(summary(&[]), "AltKeeperPlus: no apps");
+        assert_eq!(summary(&[1]), "AltKeeperPlus: 1 app, next expiry in 1 day");
+        assert_eq!(summary(&[6, 4, 5]), "AltKeeperPlus: 3 apps, next expiry in 4 days");
+        assert_eq!(summary(&[0, 3]), "AltKeeperPlus: 2 apps, one expires today");
+        assert_eq!(summary(&[-2]), "AltKeeperPlus: 1 app, one has expired");
+    }
+
+    #[test]
+    fn notes_from_log_lines() {
+        let lines: Vec<String> = [
+            "[2026-10-25 10:00:00] [altserver] profile installed: com.a.T",
+            "[2026-10-25 10:00:01] [altserver] profile installed: com.b.T",
+            "[2026-10-25 10:00:02] [altserver] connected",
+            "[2026-10-25 10:00:03] [altserver] app installed",
+            "[2026-10-25 10:00:04] [altserver] installation failed: Socket(Kind(UnexpectedEof))",
+            "[2026-10-25 10:00:05] [web] Installation completed.",
+            "[2026-10-25 10:00:06] [web] Error: Apple ID sign-in failed: x",
+            "[2026-10-25 10:00:07] [altserver] profilo installato: com.c.T",
+            "[2026-10-25 10:00:08] [altserver] app installata",
+        ]
+        .map(String::from)
+        .to_vec();
+        assert_eq!(
+            notes(&lines),
+            vec![
+                Note::Renewed(vec!["com.a.T".into(), "com.b.T".into()]),
+                Note::Installed,
+                Note::Failed("Socket(Kind(UnexpectedEof))".into()),
+                Note::Installed,
+                Note::Failed("Apple ID sign-in failed: x".into()),
+                Note::Renewed(vec!["com.c.T".into()]),
+                Note::Installed,
+            ]
+        );
+    }
+
+    #[test]
+    fn failed_toast_rate_limited() {
+        let t0 = std::time::Instant::now();
+        let mut gate = FailGate::default();
+        assert!(gate.allow(t0));
+        assert!(!gate.allow(t0 + std::time::Duration::from_secs(60)));
+        assert!(gate.allow(t0 + std::time::Duration::from_secs(11 * 60)));
+    }
+
+    const TEST_VALUE: &str = "AltKeeperPlus-test";
+
+    fn temp_dir(name: &str) -> std::path::PathBuf {
+        let d = std::env::temp_dir().join(format!("altkeeper-tray-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        d
+    }
+
+    #[test]
+    fn autostart_command_is_quoted() {
+        let cmd = autostart_command(Path::new(r"C:\Alt Keeper\altkeeper.exe"), Path::new(r"C:\Alt Keeper"));
+        assert_eq!(cmd, r#""C:\Alt Keeper\altkeeper.exe" tray --dir "C:\Alt Keeper""#);
+    }
+
+    #[test]
+    fn autostart_roundtrip_and_default_only_once() {
+        let d = temp_dir("autostart");
+        let exe = d.join("altkeeper.exe");
+        let _ = set_autostart_as(TEST_VALUE, false, &exe, &d);
+
+        set_autostart_as(TEST_VALUE, true, &exe, &d).unwrap();
+        assert!(autostart_enabled_as(TEST_VALUE));
+        set_autostart_as(TEST_VALUE, false, &exe, &d).unwrap();
+        assert!(!autostart_enabled_as(TEST_VALUE));
+
+        // prima volta: si attiva
+        ensure_autostart_default_as(TEST_VALUE, &d.join("state"), &exe, &d);
+        assert!(autostart_enabled_as(TEST_VALUE));
+        // tolto dal menu: resta tolto
+        set_autostart_as(TEST_VALUE, false, &exe, &d).unwrap();
+        ensure_autostart_default_as(TEST_VALUE, &d.join("state"), &exe, &d);
+        assert!(!autostart_enabled_as(TEST_VALUE));
+    }
+}
diff --git a/src/update.rs b/src/update.rs
new file mode 100644
index 0000000..2bd380b
--- /dev/null
+++ b/src/update.rs
@@ -0,0 +1,245 @@
+//! Controllo e installazione degli aggiornamenti dalle release GitHub di AltKeeper.
+//! Solo Windows: lo usa l'icona nella barra di sistema.
+
+use std::path::Path;
+use std::time::Duration;
+
+use serde_json::Value;
+
+const LATEST: &str = "https://api.github.com/repos/BartolomeoRusso9/altkeeper/releases/latest";
+pub const EXE_ASSET: &str = "altkeeper.exe";
+pub const SHA_ASSET: &str = "altkeeper.exe.sha256";
+
+#[derive(Debug, Clone, PartialEq)]
+pub struct Release {
+    pub tag: String,
+    pub exe_url: String,
+    pub sha_url: String,
+    pub page: String,
+}
+
+/// `v0.2.0-plus.3` -> (0, 2, 0, 3); senza `-plus.N` il quarto numero è 0.
+fn version_key(v: &str) -> Option<(u64, u64, u64, u64)> {
+    let v = v.trim().trim_start_matches('v');
+    let (core, plus) = match v.split_once("-plus.") {
+        Some((c, p)) => (c, p.parse().ok()?),
+        None => (v, 0),
+    };
+    let mut it = core.split('.').map(|n| n.parse::<u64>());
+    let key = (it.next()?.ok()?, it.next()?.ok()?, it.next()?.ok()?, plus);
+    it.next().is_none().then_some(key)
+}
+
+pub fn newer(current: &str, latest_tag: &str) -> bool {
+    match (version_key(current), version_key(latest_tag)) {
+        (Some(c), Some(l)) => l > c,
+        _ => false,
+    }
+}
+
+pub fn parse_release(v: &Value) -> Option<Release> {
+    let asset = |name: &str| {
+        v["assets"].as_array()?.iter().find(|a| a["name"] == name)?["browser_download_url"]
+            .as_str()
+            .map(String::from)
+    };
+    Some(Release {
+        tag: v["tag_name"].as_str()?.to_string(),
+        exe_url: asset(EXE_ASSET)?,
+        sha_url: asset(SHA_ASSET)?,
+        page: v["html_url"].as_str()?.to_string(),
+    })
+}
+
+pub fn client() -> Result<reqwest::blocking::Client, String> {
+    reqwest::blocking::Client::builder()
+        .user_agent(concat!("AltKeeper/", env!("CARGO_PKG_VERSION")))
+        .timeout(Duration::from_secs(20))
+        .build()
+        .map_err(|e| e.to_string())
+}
+
+/// Il JSON all'indirizzo dato; `None` se GitHub risponde 404 (per esempio nessuna release).
+fn get_json(url: &str) -> Result<Option<Value>, String> {
+    let r = client()?.get(url).send().map_err(|e| format!("update check failed: {e}"))?;
+    if r.status() == reqwest::StatusCode::NOT_FOUND {
+        return Ok(None);
+    }
+    r.error_for_status()
+        .and_then(|r| r.json::<Value>())
+        .map(Some)
+        .map_err(|e| format!("update check failed: {e}"))
+}
+
+/// L'ultima release, se è più nuova di quella in uso.
+pub fn check() -> Result<Option<Release>, String> {
+    let v = get_json(LATEST)?;
+    Ok(v.as_ref()
+        .and_then(parse_release)
+        .filter(|r| newer(env!("CARGO_PKG_VERSION"), &r.tag)))
+}
+
+/// Nome dell'exe precedente dopo un aggiornamento, finché quello nuovo non parte bene.
+pub const OLD_EXE: &str = "altkeeper.old.exe";
+const NEW_EXE: &str = "altkeeper.new.exe";
+const FAILED_EXE: &str = "altkeeper.failed.exe";
+
+/// Il file `.sha256` (hash esadecimale, eventualmente seguito dal nome) corrisponde a `bytes`?
+pub fn verify(bytes: &[u8], sha_file: &str) -> bool {
+    use sha2::{Digest, Sha256};
+    let want = sha_file.split_whitespace().next().unwrap_or("").to_ascii_lowercase();
+    let got: String = Sha256::digest(bytes).iter().map(|b| format!("{b:02x}")).collect();
+    !want.is_empty() && want == got
+}
+
+/// Mette `bytes` al posto di `exe` (che può essere in esecuzione: Windows lo lascia rinominare)
+/// e tiene il vecchio come `altkeeper.old.exe`. Con un hash sbagliato non tocca niente.
+pub fn install_new(exe: &Path, bytes: &[u8], sha_file: &str) -> Result<(), String> {
+    if !verify(bytes, sha_file) {
+        return Err("the downloaded update does not match its SHA-256: nothing changed".into());
+    }
+    let (new, old) = (exe.with_file_name(NEW_EXE), exe.with_file_name(OLD_EXE));
+    std::fs::write(&new, bytes).map_err(|e| format!("cannot write {}: {e}", new.display()))?;
+    let _ = std::fs::remove_file(&old);
+    std::fs::rename(exe, &old).map_err(|e| format!("cannot move the current exe: {e}"))?;
+    if let Err(e) = std::fs::rename(&new, exe) {
+        let _ = std::fs::rename(&old, exe);
+        return Err(format!("cannot put the new exe in place: {e}"));
+    }
+    Ok(())
+}
+
+/// Scarica la release, la controlla e la mette al posto di `exe`.
+pub fn stage(rel: &Release, exe: &Path) -> Result<(), String> {
+    let c = client()?;
+    let get = |url: &str| {
+        c.get(url)
+            .timeout(Duration::from_secs(300))
+            .send()
+            .and_then(|r| r.error_for_status())
+            .and_then(|r| r.bytes())
+            .map_err(|e| format!("download failed: {e}"))
+    };
+    let sha = get(&rel.sha_url)?;
+    let bytes = get(&rel.exe_url)?;
+    install_new(exe, &bytes, &String::from_utf8_lossy(&sha))
+}
+
+/// Il nuovo exe non è partito: rimette quello vecchio. `false` se non c'era niente da rimettere.
+pub fn rollback(exe: &Path) -> bool {
+    let old = exe.with_file_name(OLD_EXE);
+    if !old.exists() {
+        return false;
+    }
+    let failed = exe.with_file_name(FAILED_EXE);
+    let _ = std::fs::remove_file(&failed);
+    let _ = std::fs::rename(exe, &failed);
+    std::fs::rename(&old, exe).is_ok()
+}
+
+/// Dopo un avvio riuscito i file dell'aggiornamento non servono più.
+pub fn cleanup(exe: &Path) {
+    for name in [OLD_EXE, FAILED_EXE, NEW_EXE] {
+        let _ = std::fs::remove_file(exe.with_file_name(name));
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use serde_json::json;
+    use std::path::PathBuf;
+
+    fn temp_exe(name: &str) -> PathBuf {
+        let d = std::env::temp_dir().join(format!("altkeeper-upd-{name}-{}", std::process::id()));
+        let _ = std::fs::remove_dir_all(&d);
+        std::fs::create_dir_all(&d).unwrap();
+        let exe = d.join("altkeeper.exe");
+        std::fs::write(&exe, b"old").unwrap();
+        exe
+    }
+
+    #[test]
+    fn verify_checks_the_sha256_file() {
+        // sha256("new")
+        let sha = "11507a0e2f5e69d5dfa40a62a1bd7b6ee57e6bcd85c67c9b8431b36fff21c437";
+        assert!(verify(b"new", &format!("{sha}  altkeeper.exe\n")));
+        assert!(verify(b"new", &sha.to_uppercase()));
+        assert!(!verify(b"tampered", sha));
+        assert!(!verify(b"new", ""));
+    }
+
+    #[test]
+    fn update_rejects_bad_hash() {
+        let exe = temp_exe("badhash");
+        assert!(install_new(&exe, b"new", "00").is_err());
+        assert_eq!(std::fs::read(&exe).unwrap(), b"old");
+        assert!(!exe.with_file_name(OLD_EXE).exists());
+    }
+
+    #[test]
+    fn update_offline_is_noop() {
+        rustls::crypto::ring::default_provider().install_default().ok();
+        let exe = temp_exe("offline");
+        let r = Release {
+            tag: "v9.9.9".into(),
+            exe_url: "http://127.0.0.1:9/altkeeper.exe".into(),
+            sha_url: "http://127.0.0.1:9/altkeeper.exe.sha256".into(),
+            page: String::new(),
+        };
+        assert!(stage(&r, &exe).is_err());
+        assert_eq!(std::fs::read(&exe).unwrap(), b"old");
+    }
+
+    #[test]
+    fn swap_and_rollback() {
+        let exe = temp_exe("swap");
+        let sha = "11507a0e2f5e69d5dfa40a62a1bd7b6ee57e6bcd85c67c9b8431b36fff21c437";
+        install_new(&exe, b"new", sha).unwrap();
+        assert_eq!(std::fs::read(&exe).unwrap(), b"new");
+        assert_eq!(std::fs::read(exe.with_file_name(OLD_EXE)).unwrap(), b"old");
+
+        assert!(rollback(&exe));
+        assert_eq!(std::fs::read(&exe).unwrap(), b"old");
+        assert!(!exe.with_file_name(OLD_EXE).exists());
+        assert!(!rollback(&exe)); // niente da rimettere
+    }
+
+    #[test]
+    fn version_ordering() {
+        assert!(newer("0.2.0-plus.1", "v0.2.0-plus.2"));
+        assert!(newer("0.2.0-plus.9", "v0.3.0"));
+        assert!(newer("0.2.0", "v0.2.0-plus.1"));
+        assert!(!newer("0.2.0-plus.1", "v0.2.0-plus.1"));
+        assert!(!newer("0.2.0-plus.2", "v0.2.0-plus.1"));
+        assert!(!newer("0.2.0-plus.1", "garbage"));
+        assert!(!newer("0.2.0-plus.1", "v1.2"));
+    }
+
+    #[test]
+    #[ignore = "network"]
+    fn live_check() {
+        rustls::crypto::ring::default_provider().install_default().ok();
+        println!("latest: {:?}", check());
+    }
+
+    #[test]
+    fn parse_release_json() {
+        let v = json!({
+            "tag_name": "v0.2.0-plus.2",
+            "html_url": "https://github.com/BartolomeoRusso9/altkeeper/releases/tag/v0.2.0-plus.2",
+            "assets": [
+                { "name": "altkeeper.exe", "browser_download_url": "https://x/altkeeper.exe" },
+                { "name": "altkeeper.exe.sha256", "browser_download_url": "https://x/altkeeper.exe.sha256" },
+            ],
+        });
+        let r = parse_release(&v).unwrap();
+        assert_eq!(r.tag, "v0.2.0-plus.2");
+        assert_eq!(r.exe_url, "https://x/altkeeper.exe");
+        assert_eq!(r.sha_url, "https://x/altkeeper.exe.sha256");
+
+        let mut missing = v.clone();
+        missing["assets"].as_array_mut().unwrap().pop();
+        assert_eq!(parse_release(&missing), None);
+    }
+}
diff --git a/src/web.rs b/src/web.rs
index ff6e532..b5b63af 100644
--- a/src/web.rs
+++ b/src/web.rs
@@ -19,20 +19,29 @@ use std::time::{Duration, SystemTime, UNIX_EPOCH};
 use axum::{
     Json, Router,
     extract::{DefaultBodyLimit, Multipart, Request, State},
-    http::{HeaderMap, HeaderValue, Method, StatusCode, header},
+    http::{HeaderMap, HeaderValue, Method, StatusCode, Uri, header},
     middleware::{self, Next},
     response::{Html, IntoResponse, Response},
     routing::{get, post},
 };
-use serde::Deserialize;
+use serde::{Deserialize, Serialize};
 use serde_json::{Value, json};
 
 use crate::{PAIRING_FILE, apple, phone, profile};
 
 const INDEX_HTML: &str = include_str!("web/index.html");
+const APPLE_TOUCH_ICON: &[u8] = include_bytes!("web/apple-touch-icon.png");
+const FAVICON_32: &[u8] = include_bytes!("web/favicon-32.png");
 const RENEW_LOG: &str = "renew.log";
+const AUTO_RENEW_CONFIG: &str = "state/auto-renew.json";
+const DISCORD_WEBHOOK_FILE: &str = "state/discord-webhook";
+const APP_STATUS_FILE: &str = "state/app-renew-status.json";
+const RETRY_SECONDS: u64 = 30 * 60;
+const MAX_RETRIES: u8 = 2;
+const DAY_SECS: u64 = 24 * 60 * 60;
 const MAX_JOB_LINES: usize = 300;
 const MAX_IPA_BYTES: usize = 1024 * 1024 * 1024;
+const PENDING_IPA_TTL: u64 = 15 * 60;
 
 // ---------------------------------------------------------------------------------------------
 // Stato condiviso
@@ -45,9 +54,11 @@ struct App {
     busy: AtomicBool,
     inner: Mutex<Inner>,
     tfa: Arc<apple::TfaChannel>,
+    auto_renew: Mutex<AutoRenewConfig>,
+    pending_ipa: Mutex<Option<PendingIpa>>,
 }
 
-#[derive(Default)]
+#[derive(Default, Clone)]
 struct Inner {
     snapshot: Snapshot,
     job: JobView,
@@ -64,6 +75,7 @@ struct Snapshot {
     detail: Option<String>,
     profiles_total: usize,
     apps: Vec<AppView>,
+    profiles: Vec<ProfileView>,
 }
 
 #[derive(Clone, PartialEq, Debug)]
@@ -73,6 +85,25 @@ struct AppView {
     days: i64,
     expires: String,
     level: &'static str,
+    members: Vec<MemberView>,
+}
+
+#[derive(Clone, PartialEq, Debug)]
+struct MemberView {
+    bundle: String,
+    label: String,
+    days: i64,
+    expires: String,
+}
+
+#[derive(Clone, PartialEq, Debug)]
+struct ProfileView {
+    uuid: String,
+    bundle: String,
+    root: String,
+    label: String,
+    days: i64,
+    expires: String,
 }
 
 #[derive(Default, Clone)]
@@ -96,6 +127,7 @@ impl App {
     }
 
     fn push_line(&self, s: &str) {
+        crate::log::line(&format!("[web] {s}"));
         let mut g = self.lock();
         g.job.lines.push(s.to_string());
         if g.job.lines.len() > MAX_JOB_LINES {
@@ -158,6 +190,198 @@ fn now() -> u64 {
     SystemTime::now().duration_since(UNIX_EPOCH).map(|d| d.as_secs()).unwrap_or(0)
 }
 
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+struct AutoRenewConfig {
+    enabled: bool,
+    /// HH:MM in UTC (no daylight saving), independent of container TZ.
+    time: String,
+    #[serde(default = "default_min_days")]
+    min_days: u8,
+    /// UTC calendar day of the most recent automatic attempt.
+    last_attempt_day: Option<u64>,
+    #[serde(default)]
+    retry_count: u8,
+    #[serde(default)]
+    retry_at: Option<u64>,
+    #[serde(default)]
+    last_error: Option<String>,
+}
+fn default_min_days() -> u8 { 3 }
+
+impl Default for AutoRenewConfig {
+    fn default() -> Self {
+        Self {
+            enabled: false,
+            time: "06:00".into(),
+            min_days: 3,
+            last_attempt_day: None,
+            retry_count: 0,
+            retry_at: None,
+            last_error: None,
+        }
+    }
+}
+
+fn parse_utc_time(value: &str) -> Option<u64> {
+    let (hh, mm) = value.split_once(':')?;
+    if hh.len() != 2 || mm.len() != 2 { return None; }
+    if !hh.bytes().chain(mm.bytes()).all(|b| b.is_ascii_digit()) { return None; }
+    let hour: u64 = hh.parse().ok()?;
+    let minute: u64 = mm.parse().ok()?;
+    (hour < 24 && minute < 60).then_some(hour * 3600 + minute * 60)
+}
+
+fn utc_day(now_secs: u64) -> u64 {
+    now_secs / DAY_SECS
+}
+
+fn utc_seconds_of_day(now_secs: u64) -> u64 {
+    now_secs % DAY_SECS
+}
+
+fn next_auto_run(config: &AutoRenewConfig, now_secs: u64) -> Option<u64> {
+    if !config.enabled { return None; }
+    if let Some(retry_at) = config.retry_at { return Some(retry_at); }
+    let target = parse_utc_time(&config.time)?;
+    let today = utc_day(now_secs);
+    let can_run_today = utc_seconds_of_day(now_secs) < target
+        && config.last_attempt_day != Some(today);
+    let scheduled_day = if can_run_today { today } else { today + 1 };
+    Some(scheduled_day * DAY_SECS + target)
+}
+
+fn load_auto_renew() -> AutoRenewConfig {
+    let raw = match std::fs::read_to_string(AUTO_RENEW_CONFIG) {
+        Ok(raw) => raw,
+        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return AutoRenewConfig::default(),
+        Err(e) => {
+            eprintln!("[auto-renew] Cannot read config ({e}); automatic renewal disabled");
+            return AutoRenewConfig::default();
+        }
+    };
+    match serde_json::from_str::<AutoRenewConfig>(&raw) {
+        Ok(config) if parse_utc_time(&config.time).is_some() && (1..=6).contains(&config.min_days) => config,
+        _ => {
+            eprintln!("[auto-renew] Invalid schedule config; automatic renewal disabled");
+            AutoRenewConfig::default()
+        }
+    }
+}
+
+fn save_auto_renew(config: &AutoRenewConfig) -> Result<(), String> {
+    std::fs::create_dir_all("state").map_err(crate::phone::dbg)?;
+    crate::fsperm::restrict_dir(Path::new("state")).map_err(crate::phone::dbg)?;
+    let data = serde_json::to_vec_pretty(config).map_err(crate::phone::dbg)?;
+    // Atomic write: avoid resetting the persistent on/off state after an interrupted write.
+    let tmp = Path::new("state/auto-renew.json.tmp");
+    crate::fsperm::write_private(tmp, &data).map_err(crate::phone::dbg)?;
+    std::fs::rename(tmp, AUTO_RENEW_CONFIG).map_err(crate::phone::dbg)
+}
+
+fn retryable_renew_error(err: &str) -> bool {
+    let lower = err.to_ascii_lowercase();
+    !["2fa", "incorrect password", "invalid password", "invalid credentials",
+      "unauthorized", "forbidden", "rate.limit", "too many requests", "429",
+      "apple id sign-in", "apple id login"].iter().any(|part| lower.contains(part))
+}
+
+fn validate_discord_webhook(url: &str) -> bool {
+    let prefixes = ["https://discord.com/api/webhooks/", "https://discordapp.com/api/webhooks/"];
+    let Some(rest) = prefixes.iter().find_map(|prefix| url.strip_prefix(prefix)) else {
+        return false;
+    };
+    let mut parts = rest.split('/');
+    let Some(id) = parts.next() else { return false };
+    let Some(token) = parts.next() else { return false };
+    parts.next().is_none() && id.len() >= 10 && token.len() >= 20
+        && id.bytes().all(|b| b.is_ascii_digit())
+        && token.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-' || b == b'_')
+}
+
+fn discord_configured() -> bool {
+    std::fs::read_to_string(DISCORD_WEBHOOK_FILE)
+        .ok().is_some_and(|url| validate_discord_webhook(url.trim()))
+}
+
+fn send_discord_failure(error: &str) -> Result<(), String> {
+    let message = format!("AltKeeper: automatic renewal failed after retries.\n{}",
+        error.chars().take(240).collect::<String>());
+    send_discord_message(&message)
+}
+
+fn send_discord_message(message: &str) -> Result<(), String> {
+    use std::io::Write;
+    let url = std::fs::read_to_string(DISCORD_WEBHOOK_FILE).map_err(crate::phone::dbg)?;
+    let url = url.trim();
+    if !validate_discord_webhook(url) { return Err("Invalid Discord webhook configuration".into()); }
+    // Pass the sensitive webhook URL via stdin (curl config), not process arguments.
+    let body = json!({ "content": message }).to_string();
+    let mut child = std::process::Command::new("curl")
+        .args(["--fail", "--silent", "--show-error", "--max-time", "12",
+            "--request", "POST", "--header", "Content-Type: application/json",
+            "--data-raw", &body, "--config", "-"])
+        .stdin(std::process::Stdio::piped())
+        .stdout(std::process::Stdio::null())
+        .stderr(std::process::Stdio::piped())
+        .spawn().map_err(crate::phone::dbg)?;
+    // Validated webhook has no quote/backslash/newline, so it is safe for curl config.
+    if let Some(mut stdin) = child.stdin.take() {
+        stdin.write_all(format!("url = \"{url}\"\n").as_bytes()).map_err(crate::phone::dbg)?;
+    }
+    let output = child.wait_with_output().map_err(crate::phone::dbg)?;
+    if output.status.success() { Ok(()) }
+    else { Err("Discord rejected webhook notification".into()) }
+}
+
+async fn auto_renew_loop(app: Arc<App>) {
+    loop {
+        let now_secs = now();
+        let guard = {
+            let config = app.auto_renew.lock().unwrap_or_else(|e| e.into_inner());
+            let retry_due = config.retry_at.is_some_and(|at| at <= now_secs);
+            let scheduled_due = parse_utc_time(&config.time)
+                .is_some_and(|target| utc_seconds_of_day(now_secs) >= target)
+                && config.last_attempt_day != Some(utc_day(now_secs));
+            if config.enabled && (retry_due || scheduled_due) { try_busy(&app) } else { None }
+        };
+        if let Some(guard) = guard {
+            let mut config = app.auto_renew.lock().unwrap_or_else(|e| e.into_inner());
+            if config.enabled {
+                let is_retry = config.retry_at.is_some_and(|t| t <= now_secs);
+                let is_new_day = config.last_attempt_day != Some(utc_day(now_secs))
+                    && config.retry_at.is_none();
+                if is_retry || is_new_day {
+                    let mut updated = config.clone();
+                    if is_retry {
+                        updated.retry_count = updated.retry_count.saturating_add(1);
+                    } else {
+                        updated.last_attempt_day = Some(utc_day(now_secs));
+                        updated.retry_count = 0;
+                    }
+                    updated.retry_at = None;
+                    if let Err(err) = save_auto_renew(&updated) {
+                        eprintln!("[auto-renew] Could not persist attempt: {err}");
+                    } else {
+                        let threshold = updated.min_days as i64;
+                        let attempt = updated.retry_count + 1;
+                        *config = updated;
+                        drop(config);
+                        app.lock().job = JobView {
+                            kind: "auto_renew".into(),
+                            running: true,
+                            lines: vec![format!("Scheduled renewal attempt {attempt}/3 (UTC).")],
+                            ok: None,
+                        };
+                        spawn_job(guard, move |app| run_renew(app, false, None, true, threshold, true));
+                    }
+                }
+            }
+        }
+        tokio::time::sleep(Duration::from_secs(30)).await;
+    }
+}
+
 // ---------------------------------------------------------------------------------------------
 // Avvio
 // ---------------------------------------------------------------------------------------------
@@ -182,6 +406,7 @@ pub async fn serve(
     phone: Option<SocketAddr>,
 ) -> Result<(), String> {
     check_options(bind, &pin)?;
+    cleanup_orphaned_ipa_uploads();
 
     let app = Arc::new(App {
         pin,
@@ -189,16 +414,31 @@ pub async fn serve(
         busy: AtomicBool::new(false),
         inner: Mutex::new(Inner::default()),
         tfa: Arc::new(apple::TfaChannel::default()),
+        auto_renew: Mutex::new(load_auto_renew()),
+        pending_ipa: Mutex::new(None),
     });
     let router = Router::new()
         .route("/", get(index))
+        .route("/apple-touch-icon.png", get(apple_touch_icon))
+        .route("/favicon-32.png", get(favicon_32))
         .route("/api/state", get(state))
+        .route("/api/logs", get(logs))
         .route("/api/check", post(check))
         .route("/api/renew", post(renew))
+        .route("/api/auto-renew", post(update_auto_renew))
+        .route("/api/discord", post(update_discord))
+        .route("/api/discord/test", post(test_discord))
+        .route("/api/profile/remove", post(remove_profile))
+        .route("/api/profile/restore", post(restore_profile))
         .route(
             "/api/install",
             post(install).layer(DefaultBodyLimit::max(MAX_IPA_BYTES + 1024 * 1024)),
         )
+        .route(
+            "/api/install/inspect",
+            post(inspect_install).layer(DefaultBodyLimit::max(MAX_IPA_BYTES + 1024 * 1024)),
+        )
+        .route("/api/install/confirm", post(confirm_install))
         .route("/api/login", post(login))
         .route("/api/login/code", post(login_code))
         .route("/api/login/resend", post(login_resend))
@@ -208,7 +448,7 @@ pub async fn serve(
     let listener = tokio::net::TcpListener::bind(bind)
         .await
         .map_err(|e| crate::tr!(format!("non riesco ad ascoltare su {bind}: {e}"), format!("cannot listen on {bind}: {e}")))?;
-    println!("{}", crate::tr!(
+    crate::log::line(&crate::tr!(
         format!("Interfaccia web su http://{bind} ({})", if app.pin.is_some() {
             "protetta da PIN: il nome utente può essere qualsiasi"
         } else { "raggiungibile solo da questo computer" }),
@@ -216,6 +456,22 @@ pub async fn serve(
             "PIN-protected: any username is accepted"
         } else { "only accessible from this computer" })
     ));
+    // Built-in scheduler; no systemd socket/host privileges or separate cron required.
+    tokio::spawn(auto_renew_loop(app.clone()));
+    // Runs independently of iPhone communications and renewal. Check daily but
+    // perform a sweep only if 30 days have passed since the last successful sweep.
+    tokio::spawn(async {
+        loop {
+            match profile::cleanup_backups_if_due(SystemTime::now()) {
+                Ok(Some(removed)) => crate::log::line(&format!(
+                    "[backup-cleanup] Monthly sweep: removed {removed} profiles expired over 30 days ago"
+                )),
+                Ok(None) => {}
+                Err(e) => crate::log::err(&format!("[backup-cleanup] Failed: {e}")),
+            }
+            tokio::time::sleep(Duration::from_secs(24 * 60 * 60)).await;
+        }
+    });
     axum::serve(listener, router).await.map_err(|e| format!("{e:?}"))
 }
 
@@ -224,11 +480,16 @@ pub async fn serve(
 // ---------------------------------------------------------------------------------------------
 
 async fn guard(State(app): State<Arc<App>>, req: Request, next: Next) -> Response {
-    if app.pin.is_none() && !host_is_local(req.headers()) {
+    // iOS Safari can fetch favorite icons separately from the authenticated tab,
+    // so only these two fixed, non-sensitive PNGs are served without the PIN.
+    let public_icon = req.method() == Method::GET
+        && matches!(req.uri().path(), "/apple-touch-icon.png" | "/favicon-32.png");
+    if !public_icon && app.pin.is_none() && !host_is_local(req.headers()) {
         return (StatusCode::FORBIDDEN, "host non ammesso").into_response();
     }
-    if let Some(pin) = &app.pin {
-        if !basic_password_ok(req.headers(), pin) {
+    if !public_icon {
+        if let Some(pin) = &app.pin {
+            if !basic_password_ok(req.headers(), pin) {
             // Rallenta chi prova PIN a caso.
             tokio::time::sleep(Duration::from_secs(1)).await;
             let mut res = (StatusCode::UNAUTHORIZED, "serve il PIN").into_response();
@@ -237,6 +498,7 @@ async fn guard(State(app): State<Arc<App>>, req: Request, next: Next) -> Respons
                 HeaderValue::from_static("Basic realm=\"altkeeper\""),
             );
             return res;
+            }
         }
     }
     if req.method() == Method::POST
@@ -246,14 +508,16 @@ async fn guard(State(app): State<Arc<App>>, req: Request, next: Next) -> Respons
     }
     let mut res = next.run(req).await;
     let h = res.headers_mut();
-    h.insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+    h.insert(header::CACHE_CONTROL, HeaderValue::from_static(
+        if public_icon { "public, max-age=86400" } else { "no-store" }
+    ));
     h.insert(header::X_CONTENT_TYPE_OPTIONS, HeaderValue::from_static("nosniff"));
     h.insert(header::X_FRAME_OPTIONS, HeaderValue::from_static("DENY"));
     h.insert(header::REFERRER_POLICY, HeaderValue::from_static("no-referrer"));
     h.insert(
         header::CONTENT_SECURITY_POLICY,
         HeaderValue::from_static(
-            "default-src 'none'; connect-src 'self'; style-src 'unsafe-inline'; \
+            "default-src 'none'; connect-src 'self'; img-src 'self' data:; style-src 'unsafe-inline'; \
              script-src 'unsafe-inline'; base-uri 'none'; form-action 'none'",
         ),
     );
@@ -335,6 +599,15 @@ async fn index() -> Html<&'static str> {
     Html(INDEX_HTML)
 }
 
+fn png_response(bytes: &'static [u8]) -> Response {
+    let mut response = Response::new(axum::body::Body::from(bytes));
+    response.headers_mut().insert(header::CONTENT_TYPE, HeaderValue::from_static("image/png"));
+    response
+}
+
+async fn apple_touch_icon() -> Response { png_response(APPLE_TOUCH_ICON) }
+async fn favicon_32() -> Response { png_response(FAVICON_32) }
+
 fn json_err(status: StatusCode, msg: &str) -> (StatusCode, Json<Value>) {
     (status, Json(json!({ "error": msg })))
 }
@@ -345,7 +618,19 @@ fn json_ok() -> (StatusCode, Json<Value>) {
 
 const BUSY_MSG: &str = "Another operation is already running: please wait for it to finish.";
 
+/// Le righe di log dopo `?since=N` (0 = tutte quelle in memoria), per la sezione Logs.
+async fn logs(uri: Uri) -> Json<Value> {
+    let since = uri
+        .query()
+        .and_then(|q| q.split('&').find_map(|kv| kv.strip_prefix("since=")))
+        .and_then(|v| v.parse().ok())
+        .unwrap_or(0);
+    let (seq, lines) = crate::log::since(since);
+    Json(json!({ "seq": seq, "lines": lines }))
+}
+
 async fn state(State(app): State<Arc<App>>) -> Json<Value> {
+    expire_pending_ipa(&app);
     let account = apple::read_account(Path::new("."));
     let pairing = Path::new(PAIRING_FILE).exists();
 
@@ -364,7 +649,11 @@ async fn state(State(app): State<Arc<App>>) -> Json<Value> {
     let history = std::fs::read_to_string(RENEW_LOG)
         .map(|t| parse_history(&t, 6))
         .unwrap_or_default();
-    let g = app.lock();
+    // Copy the view and release its mutex before reading the schedule. Never
+    // hold the UI and scheduler mutexes together (retry logging also uses UI).
+    let g = app.lock().clone();
+    let schedule = app.auto_renew.lock().unwrap_or_else(|e| e.into_inner()).clone();
+    let next_scheduled = next_auto_run(&schedule, now());
     let asking = app.tfa.asking.load(Ordering::SeqCst);
     let login_phase = if asking { "needs_code" } else { g.login.phase };
     let code_error = app.tfa.last_error.lock().ok().and_then(|e| e.clone());
@@ -373,6 +662,17 @@ async fn state(State(app): State<Arc<App>>) -> Json<Value> {
         "now": now(),
         "busy": app.busy.load(Ordering::SeqCst),
         "pairing": pairing,
+        "auto_renew": {
+            "enabled": schedule.enabled,
+            "time": schedule.time,
+            "min_days": schedule.min_days,
+            "retry_count": schedule.retry_count,
+            "retry_at": schedule.retry_at,
+            "last_error": schedule.last_error,
+            "discord_configured": discord_configured(),
+            "time_zone": "UTC",
+            "next_run": next_scheduled,
+        },
         "account": {
             "present": account.is_some(),
             "apple_id": account.as_ref().map(|a| a.apple_id.clone()),
@@ -388,9 +688,23 @@ async fn state(State(app): State<Arc<App>>) -> Json<Value> {
             "detail": g.snapshot.detail,
             "profiles_total": g.snapshot.profiles_total,
         },
+        "quotas": {
+            "installed_apps": g.snapshot.apps.len(),
+            "max_installed_apps": 3,
+            // Ogni profilo più recente per bundle (app principale + estensioni) è un App ID.
+            "app_ids_used": g.snapshot.apps.iter().map(|a| a.members.len()).sum::<usize>(),
+            "max_app_ids": 10,
+        },
         "apps": g.snapshot.apps.iter().map(|a| json!({
             "bundle": a.bundle, "label": a.label, "days": a.days,
             "expires": a.expires, "level": a.level,
+            "members": a.members.iter().map(|m| json!({
+                "bundle":m.bundle,"label":m.label,"days":m.days,"expires":m.expires
+            })).collect::<Vec<_>>(),
+        })).collect::<Vec<_>>(),
+        "profiles": g.snapshot.profiles.iter().map(|p| json!({
+            "uuid": p.uuid, "bundle": p.bundle, "root": p.root, "label": p.label,
+            "days": p.days, "expires": p.expires,
         })).collect::<Vec<_>>(),
         "job": {
             "kind": g.job.kind, "running": g.job.running,
@@ -402,6 +716,11 @@ async fn state(State(app): State<Arc<App>>) -> Json<Value> {
             "code_error": if asking { code_error } else { None },
         },
         "history": history,
+        "backups": account.as_ref().and_then(|a| a.team_id.as_deref())
+            .map(backup_views).unwrap_or_default(),
+        "app_status": std::fs::read_to_string(APP_STATUS_FILE).ok()
+            .and_then(|s| serde_json::from_str::<Value>(&s).ok())
+            .unwrap_or(json!({})),
     }))
 }
 
@@ -414,19 +733,206 @@ async fn check(State(app): State<Arc<App>>) -> (StatusCode, Json<Value>) {
     json_ok()
 }
 
+
+#[derive(Deserialize)]
+struct AutoRenewReq {
+    enabled: bool,
+    time: String,
+    #[serde(default = "default_min_days")]
+    min_days: u8,
+}
+
+async fn update_auto_renew(
+    State(app): State<Arc<App>>,
+    Json(req): Json<AutoRenewReq>,
+) -> (StatusCode, Json<Value>) {
+    let Some(target) = parse_utc_time(&req.time) else {
+        return json_err(StatusCode::BAD_REQUEST, "Use a valid 24-hour time (HH:MM).");
+    };
+    if !(1..=6).contains(&req.min_days) {
+        return json_err(StatusCode::BAD_REQUEST, "Renewal threshold must be 1-6 days.");
+    }
+    if req.enabled {
+        match apple::read_account(Path::new(".")) {
+            Some(acc) if !acc.password.is_empty() && acc.team_id.is_some() => {}
+            _ => return json_err(StatusCode::BAD_REQUEST,
+                "Save your Apple ID password before enabling automatic renewal."),
+        }
+    }
+    let mut config = app.auto_renew.lock().unwrap_or_else(|e| e.into_inner());
+    let mut updated = config.clone();
+    // Turning on or changing the clock time after today's scheduled time
+    // must NOT immediately trigger an unrequested refresh.
+    if req.enabled && (!config.enabled || config.time != req.time)
+        && utc_seconds_of_day(now()) >= target
+    {
+        updated.last_attempt_day = Some(utc_day(now()));
+    }
+    updated.enabled = req.enabled;
+    updated.time = req.time;
+    updated.min_days = req.min_days;
+    if !req.enabled {
+        updated.retry_at = None;
+        updated.retry_count = 0;
+    }
+    if let Err(err) = save_auto_renew(&updated) {
+        return json_err(StatusCode::INTERNAL_SERVER_ERROR, &format!("Cannot save schedule: {err}"));
+    }
+    *config = updated;
+    json_ok()
+}
+
+
+fn backup_views(team: &str) -> Vec<Value> {
+    let Ok(entries) = std::fs::read_dir(crate::SAVED_DIR) else { return Vec::new(); };
+    let mut result = Vec::new();
+    for entry in entries.flatten() {
+        if !entry.file_type().is_ok_and(|ft| ft.is_file()) { continue; }
+        let path = entry.path();
+        if path.extension().and_then(|s| s.to_str()) != Some("mobileprovision") { continue; }
+        let Ok(bytes) = std::fs::read(&path) else { continue; };
+        let Some(p) = profile::parse(&bytes) else { continue; };
+        if p.team_id.as_deref() != Some(team)
+            || path.file_stem().and_then(|s| s.to_str())
+                .is_none_or(|stem| !stem.eq_ignore_ascii_case(&p.uuid)) { continue; }
+        result.push(json!({
+            "uuid": p.uuid, "bundle": p.bundle_id, "expires":p.expires_text(),
+            "days": p.days_left()
+        }));
+    }
+    result.sort_by(|a,b| a["bundle"].as_str().cmp(&b["bundle"].as_str()));
+    result
+}
+
+#[derive(Deserialize)]
+struct DiscordReq {
+    #[serde(default)]
+    webhook: Option<String>,
+    #[serde(default)]
+    clear: bool,
+}
+
+async fn update_discord(
+    Json(req): Json<DiscordReq>,
+) -> (StatusCode, Json<Value>) {
+    if req.clear {
+        match std::fs::remove_file(DISCORD_WEBHOOK_FILE) {
+            Ok(()) => return json_ok(),
+            Err(e) if e.kind() == std::io::ErrorKind::NotFound => return json_ok(),
+            Err(_) => return json_err(StatusCode::INTERNAL_SERVER_ERROR, "Could not clear webhook"),
+        }
+    }
+    let Some(webhook) = req.webhook else {
+        return json_err(StatusCode::BAD_REQUEST, "Supply a Discord webhook URL.");
+    };
+    if !validate_discord_webhook(&webhook) {
+        return json_err(StatusCode::BAD_REQUEST, "Expected a valid Discord webhook URL.");
+    }
+    if std::fs::create_dir_all("state").is_err()
+        || crate::fsperm::restrict_dir(Path::new("state")).is_err()
+        || crate::fsperm::write_private(Path::new(DISCORD_WEBHOOK_FILE), webhook.as_bytes()).is_err()
+    {
+        return json_err(StatusCode::INTERNAL_SERVER_ERROR, "Could not save webhook");
+    }
+    json_ok()
+}
+
+/// User-initiated delivery check; never creates or renews a profile.
+async fn test_discord() -> (StatusCode, Json<Value>) {
+    if !discord_configured() {
+        return json_err(StatusCode::BAD_REQUEST, "Configure a Discord webhook first.");
+    }
+    // curl is synchronous; leave Tokio free while we wait for Discord.
+    let sent = tokio::task::spawn_blocking(|| {
+        send_discord_message(
+            "AltKeeper test notification: Discord webhook is working. No renewal was performed."
+        )
+    }).await;
+    match sent {
+        Ok(Ok(())) => json_ok(),
+        _ => json_err(StatusCode::BAD_GATEWAY, "Discord test delivery failed. Check webhook permissions and network access."),
+    }
+}
+
+#[derive(Deserialize)]
+struct RestoreReq {
+    uuid: String,
+}
+
+async fn restore_profile(
+    State(app): State<Arc<App>>,
+    Json(req): Json<RestoreReq>,
+) -> (StatusCode, Json<Value>) {
+    let team = apple::read_account(Path::new(".")).and_then(|a| a.team_id);
+    let Some(team) = team else {
+        return json_err(StatusCode::BAD_REQUEST, "Sign in before restoring profiles.");
+    };
+    if !backup_views(&team).iter().any(|p| p["uuid"].as_str() == Some(&req.uuid)) {
+        return json_err(StatusCode::NOT_FOUND, "Verified profile backup was not found.");
+    }
+    let Some(guard) = try_busy(&app) else {
+        return json_err(StatusCode::CONFLICT, BUSY_MSG);
+    };
+    app.lock().job = JobView {
+        kind:"restore_profile".into(), running:true, lines:Vec::new(), ok:None
+    };
+    spawn_job(guard, move |app| run_restore_profile(app, req.uuid, team));
+    json_ok()
+}
+
+async fn run_restore_profile(app: Arc<App>, uuid: String, team: String) {
+    let result: Result<String, String> = async {
+        // Only original verified UUID-named files for the configured Apple team.
+        if uuid.len() > 64 || uuid.is_empty()
+            || !uuid.bytes().all(|b| b.is_ascii_hexdigit() || b == b'-') {
+            return Err("Invalid profile UUID".into());
+        }
+        let path = Path::new(crate::SAVED_DIR).join(format!("{uuid}.mobileprovision"));
+        let bytes = std::fs::read(path).map_err(crate::phone::dbg)?;
+        let p = profile::parse(&bytes).ok_or("Invalid backup data")?;
+        if !p.uuid.eq_ignore_ascii_case(&uuid) || p.team_id.as_deref() != Some(&team) {
+            return Err("Backup does not belong to the configured Apple team".into());
+        }
+        let (_, mut link) = phone::connect_auto(app.phone, PAIRING_FILE, |_: &str| {}).await?;
+        phone::with_timeout("Profile restore", Duration::from_secs(60),
+            link.install_profile(bytes)).await?;
+        Ok(format!("Restored profile {}. Original backup retained.", uuid))
+    }.await;
+    let ok = result.is_ok();
+    match result {
+        Ok(line) => app.push_line(&line),
+        Err(e) => app.push_line(&format!("Error: {}", short_error(&e))),
+    }
+    {
+        let mut g=app.lock();
+        g.job.running=false; g.job.ok=Some(ok);
+    }
+    run_check(app).await;
+}
+
 #[derive(Deserialize)]
 struct RenewReq {
-    /// "due" rinnova solo le app in scadenza, "now" le rinnova tutte.
+    /// "due" renews expiring installed apps; "now" all profiles; "single" one bundle.
     mode: String,
+    bundle: Option<String>,
 }
 
 async fn renew(
     State(app): State<Arc<App>>,
     Json(req): Json<RenewReq>,
 ) -> (StatusCode, Json<Value>) {
-    let force = match req.mode.as_str() {
-        "now" => true,
-        "due" => false,
+    let (force, installed_only, bundle) = match req.mode.as_str() {
+        "now" => (true, false, None),
+        "due" => (false, true, None),
+        "single" => {
+            let Some(b) = req.bundle.filter(|b| !b.is_empty() && b.len() <= 255) else {
+                return json_err(StatusCode::BAD_REQUEST, "Select an app to renew.");
+            };
+            if !app.lock().snapshot.apps.iter().any(|a| a.bundle == b) {
+                return json_err(StatusCode::NOT_FOUND, "App is not in the current profile list.");
+            }
+            (true, false, Some(b))
+        }
         _ => return json_err(StatusCode::BAD_REQUEST, "Invalid mode"),
     };
     match apple::read_account(Path::new(".")) {
@@ -444,18 +950,77 @@ async fn renew(
     {
         let mut g = app.lock();
         g.job = JobView {
-            kind: if force { "renew_all".into() } else { "renew_due".into() },
+            kind: if bundle.is_some() { "renew_one".into() }
+                  else if force { "renew_all".into() } else { "renew_due".into() },
+            running: true,
+            lines: Vec::new(),
+            ok: None,
+        };
+    }
+    let threshold = app.auto_renew.lock().unwrap_or_else(|e| e.into_inner()).min_days as i64;
+    spawn_job(guard, move |app| run_renew(app, force, bundle, installed_only, threshold, false));
+    json_ok()
+}
+
+#[derive(Deserialize)]
+struct RemoveProfileReq {
+    uuid: String,
+}
+
+async fn remove_profile(
+    State(app): State<Arc<App>>,
+    Json(req): Json<RemoveProfileReq>,
+) -> (StatusCode, Json<Value>) {
+    if !app.lock().snapshot.profiles.iter().any(|p| p.uuid.eq_ignore_ascii_case(&req.uuid)) {
+        return json_err(StatusCode::NOT_FOUND, "Profile is not in your team's current list. Check again.");
+    }
+    let Some(guard) = try_busy(&app) else {
+        return json_err(StatusCode::CONFLICT, BUSY_MSG);
+    };
+    {
+        let mut g = app.lock();
+        g.job = JobView {
+            kind: "remove_profile".into(),
             running: true,
             lines: Vec::new(),
             ok: None,
         };
     }
-    spawn_job(guard, move |app| run_renew(app, force));
+    spawn_job(guard, move |app| run_remove_profile(app, req.uuid));
     json_ok()
 }
 
+/// Remove abandoned uploads from previous processes (the active process owns none at startup).
+fn cleanup_orphaned_ipa_uploads() {
+    let dir = Path::new("state/uploads");
+    let Ok(entries) = std::fs::read_dir(dir) else { return; };
+    for entry in entries.flatten() {
+        let name = entry.file_name();
+        let name = name.to_string_lossy();
+        if name.starts_with("install-") && name.ends_with(".ipa") {
+            let _ = std::fs::remove_file(entry.path());
+        }
+    }
+}
+
+fn expire_pending_ipa(app: &App) {
+    let mut pending = app.pending_ipa.lock().unwrap_or_else(|e| e.into_inner());
+    if pending.as_ref().is_some_and(|p| now().saturating_sub(p.created_at) > PENDING_IPA_TTL) {
+        *pending = None;
+    }
+}
+
 struct UploadedIpa(PathBuf);
 
+/// One preflight upload only, auto-expiring and deleted on replacement, abort or restart.
+struct PendingIpa {
+    upload: UploadedIpa,
+    extensions: Vec<isideload::sideload::application::IpaExtensionInfo>,
+    source_bundle_id: String,
+    token: String,
+    created_at: u64,
+}
+
 impl Drop for UploadedIpa {
     fn drop(&mut self) {
         let _ = std::fs::remove_file(&self.0);
@@ -596,7 +1161,145 @@ async fn install(
             ok: None,
         };
     }
-    spawn_job(guard, move |app| run_install(app, uploaded));
+    spawn_job(guard, move |app| run_install(app, uploaded, None, None));
+    json_ok()
+}
+
+/// Keep old clients' /api/install route intact. The web UI uses inspect/confirm
+/// to avoid signing or registering unwanted app extensions.
+async fn inspect_install(
+    State(app): State<Arc<App>>,
+    uri: axum::http::Uri,
+    mut multipart: Multipart,
+) -> (StatusCode, Json<Value>) {
+    match apple::read_account(Path::new(".")) {
+        Some(a) if !a.password.is_empty() && a.team_id.is_some() => {}
+        _ => return json_err(StatusCode::BAD_REQUEST, "Save an Apple ID account before installing."),
+    }
+    let Some(guard) = try_busy(&app) else {
+        return json_err(StatusCode::CONFLICT, BUSY_MSG);
+    };
+    let uploaded = match receive_ipa(&mut multipart).await {
+        Ok(file) => file,
+        Err((status, detail)) => return json_err(status, &detail),
+    };
+    // Cancel any previous selection as soon as a replacement IPA is accepted.
+    *app.pending_ipa.lock().unwrap_or_else(|e| e.into_inner()) = None;
+    let manifest = match isideload::sideload::application::inspect_ipa(&uploaded.0) {
+        Ok(entries) => entries,
+        Err(e) => return json_err(StatusCode::UNPROCESSABLE_ENTITY,
+            &format!("Cannot inspect the IPA: {e}")),
+    };
+    let customize = uri.query().is_some_and(|q|
+        q.split('&').any(|part| part == "customize=true"));
+    if manifest.extensions.is_empty() && !customize {
+        app.lock().job = JobView {
+            kind: "install".into(), running: true,
+            lines: vec!["IPA uploaded (no extensions). Signing and installing…".into()],
+            ok: None,
+        };
+        spawn_job(guard, move |app| run_install(app, uploaded, None, None));
+        return (StatusCode::OK, Json(json!({ "installing": true })));
+    }
+    // For the rare archive containing many extensions, cap the preview surface.
+    if manifest.extensions.len() > 100 {
+        return json_err(StatusCode::UNPROCESSABLE_ENTITY, "IPA contains too many extensions.");
+    }
+    let token = uploaded.0.file_stem()
+        .and_then(|s| s.to_str()).unwrap_or("").to_string();
+    let preview = manifest.extensions.iter().map(|ext| json!({
+        "bundle_id": ext.bundle_id, "name": ext.name,
+    })).collect::<Vec<_>>();
+    let mut pending = app.pending_ipa.lock().unwrap_or_else(|e| e.into_inner());
+    *pending = Some(PendingIpa {
+        upload: uploaded, extensions: manifest.extensions,
+        source_bundle_id: manifest.bundle_id.clone(),
+        token: token.clone(), created_at: now(),
+    });
+    (StatusCode::OK, Json(json!({
+        "needs_selection": true, "token": token, "extensions": preview,
+        "app_name": manifest.name, "bundle_id": manifest.bundle_id,
+        "max_app_ids": 1 + preview.len(),
+    })))
+}
+
+#[derive(Deserialize)]
+struct ConfirmInstallReq {
+    token: String,
+    keep_extensions: Vec<String>,
+    #[serde(default)]
+    display_name: Option<String>,
+    #[serde(default)]
+    bundle_id: Option<String>,
+}
+
+/// Overrides are only accepted for new installs, never a refresh.
+struct NewInstallIdentity {
+    display_name: Option<String>,
+    bundle_id: Option<String>,
+    source_bundle_id: String,
+}
+
+fn validated_install_identity(
+    name: Option<String>, bundle: Option<String>, original: &str,
+) -> Result<Option<NewInstallIdentity>, String> {
+    let name = name.map(|s| s.trim().to_string()).filter(|s| !s.is_empty());
+    let bundle = bundle.map(|s| s.trim().to_string()).filter(|s| !s.is_empty());
+    if name.as_ref().is_some_and(|n| n.chars().count() > 40 || n.chars().any(char::is_control)) {
+        return Err("App name must be at most 40 characters with no control characters.".into());
+    }
+    if bundle.as_ref().is_some_and(|id| !isideload::sideload::application::valid_custom_bundle_id(id)) {
+        return Err("Custom Bundle ID must be reverse-DNS format (e.g. com.example.clone).".into());
+    }
+    if bundle.as_deref() == Some(original) {
+        return Err("Custom Bundle ID must differ from the original ID.".into());
+    }
+    if name.is_none() && bundle.is_none() { return Ok(None); }
+    Ok(Some(NewInstallIdentity { display_name: name, bundle_id: bundle,
+        source_bundle_id: original.to_string() }))
+}
+
+async fn confirm_install(
+    State(app): State<Arc<App>>,
+    Json(req): Json<ConfirmInstallReq>,
+) -> (StatusCode, Json<Value>) {
+    let Some(guard) = try_busy(&app) else {
+        return json_err(StatusCode::CONFLICT, BUSY_MSG);
+    };
+    let mut pending = app.pending_ipa.lock().unwrap_or_else(|e| e.into_inner());
+    if pending.as_ref().is_some_and(|p| now().saturating_sub(p.created_at) > PENDING_IPA_TTL) {
+        *pending = None;
+    }
+    let Some(prepared) = pending.as_ref() else {
+        return json_err(StatusCode::GONE, "IPA selection expired. Upload it again.");
+    };
+    if prepared.token != req.token {
+        return json_err(StatusCode::BAD_REQUEST, "Invalid install selection.");
+    }
+    let allowed: std::collections::HashSet<&str> = prepared.extensions.iter()
+        .map(|e| e.bundle_id.as_str()).collect();
+    let mut unique = std::collections::HashSet::new();
+    if req.keep_extensions.iter().any(|id| !allowed.contains(id.as_str())
+        || !unique.insert(id.as_str()))
+    {
+        return json_err(StatusCode::BAD_REQUEST, "Unknown or duplicate extension selection.");
+    }
+    let identity = match validated_install_identity(
+        req.display_name, req.bundle_id, &prepared.source_bundle_id,
+    ) {
+        Ok(v) => v,
+        Err(msg) => return json_err(StatusCode::BAD_REQUEST, &msg),
+    };
+    let prepared = pending.take().expect("checked pending");
+    drop(pending);
+    app.lock().job = JobView {
+        kind: "install".into(), running: true,
+        lines: vec![format!("IPA uploaded. Keeping {} of {} extensions.",
+            req.keep_extensions.len(), prepared.extensions.len())],
+        ok: None,
+    };
+    spawn_job(guard, move |app| run_install(app, prepared.upload,
+        Some(req.keep_extensions), identity));
     json_ok()
 }
 
@@ -686,13 +1389,18 @@ async fn run_check(app: Arc<App>) {
             g.snapshot.detail = None;
             g.snapshot.profiles_total = profiles.len();
             g.snapshot.apps = team.as_deref().map(|t| app_views(&profiles, t)).unwrap_or_default();
+            g.snapshot.profiles = team.as_deref().map(|t| profile_views(&profiles, t)).unwrap_or_default();
         }
         Ok(Err(e)) => {
+            g.snapshot.apps.clear();
+            g.snapshot.profiles.clear();
             g.snapshot.reachable = Some(false);
             g.snapshot.error = Some(friendly_error(&e));
             g.snapshot.detail = Some(e.chars().take(400).collect());
         }
         Err(_) => {
+            g.snapshot.apps.clear();
+            g.snapshot.profiles.clear();
             g.snapshot.reachable = Some(false);
             g.snapshot.error = Some(friendly_error("non risponde"));
             g.snapshot.detail = Some("nessuna risposta entro 45 secondi".into());
@@ -700,13 +1408,16 @@ async fn run_check(app: Arc<App>) {
     }
 }
 
-async fn run_renew(app: Arc<App>, force: bool) {
+async fn run_renew(
+    app: Arc<App>, force: bool, bundle: Option<String>, installed_only: bool,
+    min_days: i64, automatic: bool,
+) {
     let mut say = |s: &str| app.push_line(&english_job_line(s));
-    let result = crate::cmd_renew(app.phone, false, force, 3, &mut say).await;
-
+    let result = crate::cmd_renew(app.phone, false, force, min_days, bundle.as_deref(), installed_only, &mut say).await;
     let ok = result.is_ok();
-    if let Err(e) = &result {
-        app.push_line(&format!("Error: {}", short_error(e)));
+    let error = result.as_ref().err().map(|err| short_error(err));
+    if let Some(err) = &error {
+        app.push_line(&format!("Error: {err}"));
     }
     let lines = {
         let mut g = app.lock();
@@ -715,12 +1426,122 @@ async fn run_renew(app: Arc<App>, force: bool) {
         g.job.lines.clone()
     };
     append_log(&lines, ok);
-    // Poi si aggiorna lo stato mostrato in pagina.
+    save_app_renew_status(&app, &lines, bundle.as_deref());
+
+    if automatic {
+        let mut config = app.auto_renew.lock().unwrap_or_else(|e| e.into_inner());
+        let mut updated = config.clone();
+        let mut notify = false;
+        let mut retry_message = None;
+        if ok {
+            updated.retry_count = 0;
+            updated.retry_at = None;
+            updated.last_error = None;
+        } else {
+            let err = error.as_deref().unwrap_or("Unknown renewal error");
+            updated.last_error = Some(err.to_owned());
+            if updated.enabled && updated.retry_count < MAX_RETRIES
+                && retryable_renew_error(err)
+            {
+                updated.retry_at = Some(now() + RETRY_SECONDS);
+                retry_message = Some(format!(
+                    "Automatic retry {}/{} in 30 minutes.",
+                    updated.retry_count + 1, MAX_RETRIES
+                ));
+            } else {
+                updated.retry_at = None;
+                notify = true;
+            }
+        }
+        if let Err(e) = save_auto_renew(&updated) {
+            eprintln!("[auto-renew] Could not persist retry state: {e}");
+            retry_message = None;
+        } else {
+            *config = updated;
+        }
+        drop(config);
+        // Only announce a persisted retry, after releasing the schedule lock.
+        if let Some(message) = retry_message {
+            app.push_line(&message);
+        }
+        if notify && discord_configured() {
+            let err = error.as_deref().unwrap_or("Unknown renewal error");
+            match send_discord_failure(err) {
+                Ok(()) => app.push_line("Discord failure notification sent."),
+                Err(e) => app.push_line(&format!("Discord notification failed: {e}")),
+            }
+        }
+    }
     run_check(app).await;
 }
 
-async fn run_install(app: Arc<App>, upload: UploadedIpa) {
-    let result = install_ipa(&app, &upload).await;
+fn app_renew_updates(
+    groups: Vec<AppView>, lines: &[String], selected: Option<&str>, at: u64,
+) -> serde_json::Map<String, Value> {
+    let renewed: std::collections::HashSet<&str> = lines.iter()
+        .filter_map(|line| line.strip_prefix("RENEWED ")).collect();
+    let missing: std::collections::HashSet<&str> = lines.iter()
+        .filter_map(|line| line.strip_prefix("MISSING_APP_ID ")).collect();
+    let attempted: std::collections::HashSet<&str> = lines.iter()
+        .filter_map(|line| line.trim().split_once(": expires in "))
+        .filter(|(_, tail)| tail.contains("downloading a new profile"))
+        .map(|(bundle,_)| bundle).collect();
+    let mut updates = serde_json::Map::new();
+    for group in groups {
+        if selected.is_some_and(|s| s != group.bundle) { continue; }
+        let in_group = group.members.iter().filter(|m| renewed.contains(m.bundle.as_str())).count();
+        let any_attempted = group.members.iter().any(|m|
+            attempted.contains(m.bundle.as_str()) || missing.contains(m.bundle.as_str()));
+        if in_group == 0 && !any_attempted && selected.is_none() { continue; }
+        let status = if in_group == group.members.len() { "success" }
+            else if in_group > 0 { "partial" } else { "failed" };
+        updates.insert(group.bundle, json!({"status":status,"at":at,"renewed":in_group,
+            "total":group.members.len()}));
+    }
+    updates
+}
+
+fn save_app_renew_status(app: &App, lines: &[String], selected: Option<&str>) {
+    let groups = app.lock().snapshot.apps.clone();
+    let mut existing = std::fs::read_to_string(APP_STATUS_FILE).ok()
+        .and_then(|s| serde_json::from_str::<serde_json::Map<String, Value>>(&s).ok())
+        .unwrap_or_default();
+    existing.extend(app_renew_updates(groups, lines, selected, now()));
+    if std::fs::create_dir_all("state").is_ok() {
+        if let Ok(bytes) = serde_json::to_vec(&existing) {
+            let _ = crate::fsperm::write_private(Path::new(APP_STATUS_FILE), &bytes);
+        }
+    }
+}
+
+async fn run_remove_profile(app: Arc<App>, uuid: String) {
+    let result: Result<(), String> = async {
+        let team = apple::read_account(Path::new("."))
+            .and_then(|a| a.team_id)
+            .ok_or("Sign in to select a team before removing profiles.")?;
+        let (_, mut link) = phone::connect_auto(app.phone, PAIRING_FILE, |_: &str| {}).await?;
+        let p = crate::remove_profile_with_backup(&mut link, &uuid, Some(&team)).await?;
+        app.push_line(&format!("Removed profile for {} [{}]. Backup saved in {}.",
+            p.bundle_id.as_deref().unwrap_or("?"), p.uuid, crate::SAVED_DIR));
+        Ok(())
+    }.await;
+    let ok = result.is_ok();
+    if let Err(e) = result {
+        app.push_line(&format!("Error: {}", short_error(&e)));
+    }
+    {
+        let mut g = app.lock();
+        g.job.running = false;
+        g.job.ok = Some(ok);
+    }
+    run_check(app).await;
+}
+
+async fn run_install(
+    app: Arc<App>, upload: UploadedIpa,
+    selected_extensions: Option<Vec<String>>, identity: Option<NewInstallIdentity>,
+) {
+    let result = install_ipa(&app, &upload, selected_extensions.as_deref(), identity.as_ref()).await;
     let ok = result.is_ok();
     if let Err(e) = result {
         app.push_line(&format!("Error: {}", short_error(&e)));
@@ -735,7 +1556,16 @@ async fn run_install(app: Arc<App>, upload: UploadedIpa) {
     run_check(app).await;
 }
 
-async fn install_ipa(app: &Arc<App>, upload: &UploadedIpa) -> Result<(), String> {
+/// Fail closed when a customized install could overwrite an existing app:
+/// iPhones can report either the original ID or the Apple-team-suffixed ID.
+fn install_identity_taken(installed: &std::collections::HashSet<String>, raw_id: &str, signed_id: &str) -> bool {
+    installed.contains(raw_id) || installed.contains(signed_id)
+}
+
+async fn install_ipa(
+    app: &Arc<App>, upload: &UploadedIpa, selected_extensions: Option<&[String]>,
+    identity: Option<&NewInstallIdentity>,
+) -> Result<(), String> {
     let account = apple::load_account(Path::new("."))?;
     let mut session = apple::open_session_web(
         Path::new("."),
@@ -745,6 +1575,11 @@ async fn install_ipa(app: &Arc<App>, upload: &UploadedIpa) -> Result<(), String>
     )
     .await?;
     let team = apple::pick_team(&mut session, account.team_id.as_deref(), false).await?;
+    let expected_ids = identity.map(|id| {
+        let raw = id.bundle_id.as_deref().unwrap_or(&id.source_bundle_id).to_string();
+        let signed = format!("{raw}.{}", team.team_id);
+        (raw, signed)
+    });
 
     app.push_line("Connecting to the iPhone to read its device identity…");
 
@@ -752,7 +1587,13 @@ async fn install_ipa(app: &Arc<App>, upload: &UploadedIpa) -> Result<(), String>
         let _work = crate::altserver::phone_lock();
 
         let (_, mut link) = phone::connect_auto(app.phone, PAIRING_FILE, |_: &str| {}).await?;
-
+        if let Some((raw, signed)) = expected_ids.as_ref() {
+            let installed = phone::with_timeout("Installed app lookup", std::time::Duration::from_secs(20),
+                link.installed_app_ids()).await?;
+            if install_identity_taken(&installed, raw, signed) {
+                return Err(format!("Cannot customize an installed app ({signed}). Choose a different Bundle ID for a separate new install."));
+            }
+        }
         link.device_identity()
             .await
             .map_err(|e| format!("Cannot query iPhone identity: {e}"))?
@@ -766,15 +1607,29 @@ async fn install_ipa(app: &Arc<App>, upload: &UploadedIpa) -> Result<(), String>
         &device_name,
         &udid,
         &upload.0,
+        selected_extensions,
+        identity.and_then(|i| i.display_name.as_deref()),
+        identity.and_then(|i| i.bundle_id.as_deref()),
     )
     .await?;
 
     let _work = crate::altserver::phone_lock();
     let (via, mut link) = phone::connect_auto(app.phone, PAIRING_FILE, |_: &str| {}).await?;
+    // Check once more immediately before installation to avoid replacing an app
+    // that appeared while the IPA was signing.
+    if let Some((raw, signed)) = expected_ids.as_ref() {
+        let installed = phone::with_timeout("Installed app lookup", std::time::Duration::from_secs(20),
+            link.installed_app_ids()).await?;
+        if install_identity_taken(&installed, raw, signed) {
+            return Err(format!("Custom install would replace an existing app ({signed}); blocked."));
+        }
+    }
     app.push_line(&if via == phone::Via::Usb {
         "Installing the signed app over USB…".to_string()
+    } else if crate::install_archive::use_archive_on_wifi() {
+        "Packing the signed app into an IPA and installing over Wi-Fi…".to_string()
     } else {
-        "Installing the signed app over Wi-Fi…".to_string()
+        "Installing the signed app over Wi-Fi (legacy directory mode)…".to_string()
     });
     // Il telefono manda decine di notifiche con la stessa percentuale: una riga ogni 10%.
     let last_logged = std::sync::atomic::AtomicI64::new(-1);
@@ -845,7 +1700,7 @@ async fn run_login(app: Arc<App>, apple_id: String, password: String, save: bool
 // ---------------------------------------------------------------------------------------------
 
 fn label_of(bundle: &str, team: &str) -> String {
-    bundle.strip_suffix(&format!(".{team}")).unwrap_or(bundle).to_string()
+    profile::profile_app_id(bundle, team).to_string()
 }
 
 fn level_for(days: i64) -> &'static str {
@@ -858,24 +1713,62 @@ fn level_for(days: i64) -> &'static str {
     }
 }
 
-/// Le app del team, una riga per bundle (il profilo più recente), dalla più urgente.
+/// Display one host app with all its latest extension profiles nested below.
 fn app_views(profiles: &[profile::PhoneProfile], team: &str) -> Vec<AppView> {
     let mine = profiles.iter().filter(|p| p.team_id.as_deref() == Some(team));
-    let mut views: Vec<AppView> = profile::latest_by_bundle(mine)
-        .into_iter()
+    let latest = profile::latest_by_bundle(mine);
+    let bundles: Vec<&str> = latest.iter().filter_map(|p| p.bundle_id.as_deref()).collect();
+    let mut groups: std::collections::BTreeMap<String, Vec<MemberView>> =
+        std::collections::BTreeMap::new();
+    for p in &latest {
+        let Some(bundle) = p.bundle_id.as_deref() else { continue; };
+        let root = profile::group_root(bundle, &bundles, team).to_owned();
+        groups.entry(root).or_default().push(MemberView {
+            bundle: bundle.to_owned(),
+            label: label_of(bundle, team),
+            days: p.days_left().unwrap_or(-1),
+            expires: p.expires_text(),
+        });
+    }
+    let mut views = Vec::new();
+    for (bundle, mut members) in groups {
+        members.sort_by(|a,b| a.bundle.cmp(&b.bundle));
+        let earliest = members.iter().min_by_key(|m| m.days).unwrap();
+        views.push(AppView {
+            label: label_of(&bundle, team),
+            bundle,
+            days: earliest.days,
+            expires: earliest.expires.clone(),
+            level: level_for(earliest.days),
+            members,
+        });
+    }
+    views.sort_by(|a,b| a.days.cmp(&b.days).then_with(|| a.label.cmp(&b.label)));
+    views
+}
+
+fn profile_views(profiles: &[profile::PhoneProfile], team: &str) -> Vec<ProfileView> {
+    let bundles: Vec<&str> = profiles.iter()
+        .filter(|p| p.team_id.as_deref() == Some(team))
+        .filter_map(|p| p.bundle_id.as_deref())
+        .collect();
+    let mut views: Vec<_> = profiles.iter()
+        .filter(|p| p.team_id.as_deref() == Some(team))
         .filter_map(|p| {
             let bundle = p.bundle_id.clone()?;
-            let days = p.days_left().unwrap_or(-1);
-            Some(AppView {
+            let root = profile::group_root(&bundle, &bundles, team).to_owned();
+            Some(ProfileView {
+                uuid: p.uuid.clone(),
                 label: label_of(&bundle, team),
                 bundle,
-                days,
+                root,
+                days: p.days_left().unwrap_or(-1),
                 expires: p.expires_text(),
-                level: level_for(days),
             })
         })
         .collect();
-    views.sort_by(|a, b| a.days.cmp(&b.days).then_with(|| a.label.cmp(&b.label)));
+    views.sort_by(|a,b| a.root.cmp(&b.root).then_with(|| a.label.cmp(&b.label))
+        .then_with(|| b.expires.cmp(&a.expires)));
     views
 }
 
@@ -901,6 +1794,15 @@ fn friendly_error(err: &str) -> String {
 }
 
 fn short_error(err: &str) -> String {
+    // Signing reports can start with an empty heading and put the actual
+    // certificate/IPA/App ID cause below it. Do not discard those lines.
+    let trimmed = err.trim_start();
+    if let Some(detail) = trimmed.strip_prefix("firma dell'app non riuscita:")
+        .or_else(|| trimmed.strip_prefix("App signing failed:"))
+    {
+        let detail = detail.split_whitespace().collect::<Vec<_>>().join(" ");
+        return format!("App signing failed: {detail}").chars().take(1200).collect();
+    }
     let one_line = err
         .lines()
         .map(str::trim)
@@ -1111,6 +2013,165 @@ fn append_log(lines: &[String], ok: bool) {
 
 #[cfg(test)]
 mod tests {
+    #[tokio::test]
+    async fn api_logs_returns_new_lines() {
+        let mine = |v: &Value| -> Vec<String> {
+            v["lines"]
+                .as_array()
+                .unwrap()
+                .iter()
+                .filter_map(|l| l.as_str())
+                .filter(|l| l.contains("logs-api-test"))
+                .map(String::from)
+                .collect()
+        };
+        let (before, _) = crate::log::since(u64::MAX);
+        crate::log::line("logs-api-test a");
+        crate::log::line("logs-api-test b");
+        let Json(v) = logs(format!("/api/logs?since={before}").parse().unwrap()).await;
+        let got = mine(&v);
+        assert_eq!(got.len(), 2);
+        assert!(got[0].ends_with("] logs-api-test a"));
+        let seq = v["seq"].as_u64().unwrap();
+        let Json(v) = logs(format!("/api/logs?since={seq}").parse().unwrap()).await;
+        assert!(mine(&v).is_empty());
+    }
+
+    #[test]
+    fn signing_error_keeps_cause_after_an_empty_first_line() {
+        let cause = "Failed to retrieve certificate identity: test cause";
+        for prefix in ["firma dell'app non riuscita:", "App signing failed:"] {
+            let error = short_error(&format!("{prefix} \r\n    {cause}\n"));
+            assert_eq!(error, format!("App signing failed: {cause}"));
+        }
+        assert_eq!(short_error(&format!("App signing failed:\n{}", "x".repeat(2000))).chars().count(), 1200);
+    }
+
+    #[test]
+    fn state_does_not_hold_ui_lock_while_waiting_for_schedule() {
+        let app = Arc::new(App {
+            pin: None, phone: None, busy: AtomicBool::new(true),
+            inner: Mutex::new(Inner::default()),
+            tfa: Arc::new(apple::TfaChannel::default()),
+            auto_renew: Mutex::new(AutoRenewConfig::default()),
+            pending_ipa: Mutex::new(None),
+        });
+        let schedule = app.auto_renew.lock().unwrap();
+        let (started_tx, started_rx) = std::sync::mpsc::channel();
+        let (done_tx, done_rx) = std::sync::mpsc::channel();
+        let reader = app.clone();
+        std::thread::spawn(move || {
+            let rt = tokio::runtime::Builder::new_current_thread().enable_all().build().unwrap();
+            started_tx.send(()).unwrap();
+            rt.block_on(state(State(reader)));
+            let _ = done_tx.send(());
+        });
+        started_rx.recv_timeout(Duration::from_secs(5)).unwrap();
+        // A state reader waiting for the scheduler must release the UI mutex.
+        // Brief contention while copying the snapshot is fine; sustained
+        // contention would block retry logging and recreate the deadlock.
+        let until = std::time::Instant::now() + Duration::from_millis(200);
+        let mut blocked_since = None;
+        let mut sustained_block = false;
+        while std::time::Instant::now() < until {
+            if app.inner.try_lock().is_ok() {
+                blocked_since = None;
+            } else {
+                let since = blocked_since.get_or_insert_with(std::time::Instant::now);
+                if since.elapsed() > Duration::from_millis(50) {
+                    sustained_block = true;
+                    break;
+                }
+            }
+            std::thread::yield_now();
+        }
+        // Release before asserting so even the old behavior cannot hang CI.
+        drop(schedule);
+        done_rx.recv_timeout(Duration::from_secs(5)).unwrap();
+        assert!(!sustained_block, "state held the UI mutex while waiting for the schedule");
+    }
+
+    #[test]
+    fn missing_ids_update_failed_and_partial_groups_without_tainting_successes() {
+        let profiles = vec![
+            profile("a", "TEAM", "com.example.a", 2),
+            profile("b", "TEAM", "com.example.b", 2),
+            profile("c", "TEAM", "com.example.c", 2),
+            profile("cx", "TEAM", "com.example.c.TEAM.extension", 2),
+            profile("d", "TEAM", "com.example.d", 6),
+        ];
+        let groups = app_views(&profiles, "TEAM");
+        let lines = vec![
+            "RENEWED com.example.a".into(),
+            "MISSING_APP_ID com.example.b".into(),
+            "RENEWED com.example.c".into(),
+            "MISSING_APP_ID com.example.c.TEAM.extension".into(),
+        ];
+        let updates = app_renew_updates(groups, &lines, None, 123);
+        assert_eq!(updates["com.example.a"]["status"], "success");
+        assert_eq!(updates["com.example.b"]["status"], "failed");
+        assert_eq!(updates["com.example.b"]["renewed"], 0);
+        assert_eq!(updates["com.example.c"]["status"], "partial");
+        assert_eq!(updates["com.example.c"]["total"], 2);
+        assert!(!updates.contains_key("com.example.d"));
+        let error = crate::renewal_completion(&["com.example.b"], 2).unwrap_err();
+        assert!(retryable_renew_error(&error));
+    }
+
+    #[test]
+    fn custom_identity_accepts_independent_name_or_bundle_and_rejects_invalid_ids() {
+        assert!(validated_install_identity(None, None, "com.example.app").unwrap().is_none());
+        let renamed = validated_install_identity(Some(" New name ".into()), None, "com.example.app")
+            .unwrap().unwrap();
+        assert_eq!(renamed.display_name.as_deref(), Some("New name"));
+        assert!(renamed.bundle_id.is_none());
+        let cloned = validated_install_identity(None, Some("com.example.clone".into()), "com.example.app")
+            .unwrap().unwrap();
+        assert_eq!(cloned.bundle_id.as_deref(), Some("com.example.clone"));
+        assert!(cloned.display_name.is_none());
+        assert!(validated_install_identity(None, Some("no_spaces allowed".into()), "com.example.app").is_err());
+        assert!(validated_install_identity(None, Some("com.example.app".into()), "com.example.app").is_err());
+        assert!(validated_install_identity(Some("x".repeat(41)), None, "com.example.app").is_err());
+    }
+
+    #[test]
+    fn custom_install_never_overwrites_installed_raw_or_team_suffixed_ids() {
+        let mut installed = std::collections::HashSet::new();
+        assert!(!install_identity_taken(&installed, "com.example.app", "com.example.app.TEAM"));
+        installed.insert("com.example.app".to_string());
+        assert!(install_identity_taken(&installed, "com.example.app", "com.example.app.TEAM"));
+        installed.clear();
+        installed.insert("com.example.app.TEAM".to_string());
+        assert!(install_identity_taken(&installed, "com.example.app", "com.example.app.TEAM"));
+    }
+
+    #[test]
+    fn auto_renew_utc_time_validation_and_next_run() {
+        assert_eq!(parse_utc_time("06:00"), Some(6 * 3600));
+        for invalid in ["24:00", "21:60", "9:01", "abc", "21:17:00"] {
+            assert_eq!(parse_utc_time(invalid), None);
+        }
+        // Day 20 in UTC: scheduled for 06:00, 05:00 currently.
+        let day = 20_u64;
+        let now_secs = day * DAY_SECS + 5 * 3600;
+        let mut conf = AutoRenewConfig { enabled: true, time: "06:00".into(), last_attempt_day: None, ..AutoRenewConfig::default() };
+        assert_eq!(next_auto_run(&conf, now_secs),
+            Some(day * DAY_SECS + 6 * 3600));
+        conf.last_attempt_day = Some(day);
+        assert_eq!(next_auto_run(&conf, now_secs),
+            Some((day + 1) * DAY_SECS + 6 * 3600));
+        conf.enabled = false;
+        assert_eq!(next_auto_run(&conf, now_secs), None);
+    }
+
+    #[test]
+    fn safari_icons_are_real_pngs() {
+        for icon in [APPLE_TOUCH_ICON, FAVICON_32] {
+            assert!(icon.starts_with(b"\x89PNG\r\n\x1a\n"));
+            assert!(icon.len() > 100);
+        }
+    }
+
     #[test]
     fn il_progresso_si_scrive_ogni_dieci_punti() {
         let mut last = -1;
@@ -1177,6 +2238,26 @@ mod tests {
         assert!(!host_is_local(&headers(&[])));
     }
 
+    #[test]
+    fn new_install_identity_validation_keeps_name_and_id_independent() {
+        assert!(validated_install_identity(None, None, "com.example.app").unwrap().is_none());
+        let renamed = validated_install_identity(Some("Cloned app".into()), None, "com.example.app")
+            .unwrap().unwrap();
+        assert_eq!(renamed.display_name.as_deref(), Some("Cloned app"));
+        assert!(renamed.bundle_id.is_none());
+        assert_eq!(renamed.source_bundle_id, "com.example.app");
+        let cloned = validated_install_identity(None, Some("com.example.clone".into()),
+            "com.example.app").unwrap().unwrap();
+        assert!(cloned.display_name.is_none());
+        assert_eq!(cloned.bundle_id.as_deref(), Some("com.example.clone"));
+        assert!(validated_install_identity(None, Some("com.example.app".into()),
+            "com.example.app").is_err());
+        assert!(validated_install_identity(None, Some("bad bundle id".into()),
+            "com.example.app").is_err());
+        assert!(validated_install_identity(Some("x".repeat(41)), None,
+            "com.example.app").is_err());
+    }
+
     #[test]
     fn etichette_e_livelli() {
         assert_eq!(label_of("com.spotify.client.TEAM", "TEAM"), "com.spotify.client");
@@ -1213,6 +2294,75 @@ mod tests {
         assert_eq!(v[0].days, 6);
         assert_eq!(v[1].label, "com.b");
         assert!(v.iter().all(|a| a.level == "ok"));
+        assert_eq!(v[0].members.len(), 1);
+    }
+
+    #[test]
+    fn hosts_group_extensions_and_take_earliest_expiration() {
+        let p = vec![
+            profile("a", "TEAM", "com.kdt.livecontainer", 6),
+            profile("b", "TEAM", "com.kdt.livecontainer.TEAM.LiveProcess", 1),
+            profile("c", "TEAM", "com.kdt.livecontainer.TEAM.ShareExtension", 5),
+            profile("d", "TEAM", "com.google.ios.youtube", 6),
+        ];
+        let apps = app_views(&p, "TEAM");
+        assert_eq!(apps.len(), 2);
+        let live = apps.iter().find(|a| a.bundle == "com.kdt.livecontainer").unwrap();
+        assert_eq!(live.members.len(), 3);
+        assert_eq!(live.days, 1);
+        let profiles = profile_views(&p, "TEAM");
+        assert!(profiles.iter().filter(|p| p.root == "com.kdt.livecontainer").count() == 3);
+    }
+
+    #[test]
+    fn production_bundle_names_render_as_two_apps_not_six_profiles() {
+        let team = "SAVEDTEAM1";
+        let all = vec![
+            profile("a", team, "com.google.ios.youtube", 6),
+            profile("b", team, "com.google.ios.youtube.PXUL22799Q.OpenYouTube.Extension", 5),
+            profile("c", team, "com.kdt.livecontainer", 6),
+            profile("d", team, "com.kdt.livecontainer.PXUL22799Q.LaunchAppExtension", 6),
+            profile("e", team, "com.kdt.livecontainer.PXUL22799Q.LiveProcess", 2),
+            profile("f", team, "com.kdt.livecontainer.PXUL22799Q.ShareExtension", 6),
+        ];
+        let apps = app_views(&all, team);
+        assert_eq!(apps.len(), 2);
+        let youtube = apps.iter().find(|a| a.bundle == "com.google.ios.youtube").unwrap();
+        assert_eq!(youtube.members.len(), 2);
+        assert_eq!(youtube.days, 5);
+        let live = apps.iter().find(|a| a.bundle == "com.kdt.livecontainer").unwrap();
+        assert_eq!(live.members.len(), 4);
+        assert_eq!(live.days, 2);
+        let views = profile_views(&all, team);
+        assert_eq!(views.iter().filter(|p| p.root == youtube.bundle).count(), 2);
+        assert_eq!(views.iter().filter(|p| p.root == live.bundle).count(), 4);
+    }
+
+    #[test]
+    fn real_raw_profile_ids_from_phone_display_as_two_grouped_apps() {
+        // Screenshots show these IDs after the UI has hidden the last
+        // ".PXUL22799Q". The phone's raw provisioning IDs contain that
+        // extra suffix; testing display-only names missed the regression.
+        let team = "PXUL22799Q";
+        let all = vec![
+            profile("a", team, "com.google.ios.youtube.PXUL22799Q", 6),
+            profile("b", team, "com.google.ios.youtube.PXUL22799Q.OpenYouTube.Extension.PXUL22799Q", 6),
+            profile("c", team, "com.kdt.livecontainer.PXUL22799Q", 6),
+            profile("d", team, "com.kdt.livecontainer.PXUL22799Q.LaunchAppExtension.PXUL22799Q", 6),
+            profile("e", team, "com.kdt.livecontainer.PXUL22799Q.LiveProcess.PXUL22799Q", 6),
+            profile("f", team, "com.kdt.livecontainer.PXUL22799Q.ShareExtension.PXUL22799Q", 6),
+        ];
+        let apps = app_views(&all, team);
+        assert_eq!(apps.len(), 2, "UI must show two apps, not six profiles");
+        let youtube = apps.iter().find(|a| a.label == "com.google.ios.youtube").unwrap();
+        assert_eq!(youtube.members.len(), 2);
+        assert_eq!(youtube.bundle, "com.google.ios.youtube.PXUL22799Q");
+        let live = apps.iter().find(|a| a.label == "com.kdt.livecontainer").unwrap();
+        assert_eq!(live.members.len(), 4);
+        assert_eq!(live.bundle, "com.kdt.livecontainer.PXUL22799Q");
+        let views = profile_views(&all, team);
+        assert_eq!(views.iter().filter(|p| p.root == youtube.bundle).count(), 2);
+        assert_eq!(views.iter().filter(|p| p.root == live.bundle).count(), 4);
     }
 
     #[test]
@@ -1293,3 +2443,4 @@ esito: 0
         assert!(parse_history("righe senza intestazione\n", 5).is_empty());
     }
 }
+
diff --git a/src/web/apple-touch-icon.png b/src/web/apple-touch-icon.png
new file mode 100644
index 0000000..7970386
Binary files /dev/null and b/src/web/apple-touch-icon.png differ
diff --git a/src/web/favicon-32.png b/src/web/favicon-32.png
new file mode 100644
index 0000000..b02dfd1
Binary files /dev/null and b/src/web/favicon-32.png differ
diff --git a/src/web/index.html b/src/web/index.html
index fe9a6c9..db4902d 100644
--- a/src/web/index.html
+++ b/src/web/index.html
@@ -5,7 +5,9 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <meta name="color-scheme" content="light dark">
 <title>AltKeeper</title>
-<link rel="icon" href="data:,">
+<meta name="theme-color" content="#0a6cff">
+<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
+<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32.png">
 <style>
   :root {
     --bg: #f4f5f7; --card: #ffffff; --text: #1b1f24; --muted: #5b6673; --line: #dfe3e8;
@@ -35,6 +37,49 @@
   }
   .card h2 { font-size: 1.05rem; margin: 0 0 10px; }
   .row { display: flex; align-items: center; gap: 10px; flex-wrap: wrap; }
+  .item-head { display: flex; align-items: center; gap: 10px; flex-wrap: nowrap; }
+  .item-head .item-info { align-self: center; }
+  /* Responsive action groups: keep labels centered, groups left-aligned. */
+  .action-row { justify-content: flex-start; align-items: stretch; flex-wrap: nowrap; }
+  .action-row > button {
+    flex: 1 1 0; min-width: 0; max-width: 184px; min-height: 54px;
+    padding: 6px 8px; text-align: center; white-space: normal;
+    word-break: keep-all; overflow-wrap: anywhere;
+  }
+  #btn-check, #btn-change, #btn-install, #btn-login, #btn-code, #btn-resend {
+    width: 184px; min-height: 54px; padding: 6px 10px;
+  }
+  #code-form .row { justify-content: flex-start; flex-wrap: nowrap; gap: 8px; }
+  #code-form .row > button { flex: 1 1 0; width: auto; min-width: 0; max-width: 184px; }
+
+  .item-head button { width: 106px; flex: 0 0 106px; }
+  .ext-option { display: flex; align-items: center; gap: 10px; padding: 10px 3px;
+    border-bottom: 1px solid var(--line); font-weight: 400; }
+  .ext-option input { width: 18px; height: 18px; }
+  .ext-option span { min-width: 0; overflow-wrap: anywhere; }
+  .ext-option small { display: block; color: var(--muted); font-size: .76rem; }
+  #extension-choice h3 { font-size: 1rem; margin: 0 0 8px; }
+
+  .app-name { overflow-wrap: anywhere; }
+  .item-info { flex: 1 1 0; min-width: 0; overflow-wrap: anywhere; }
+  .item-head button { white-space: nowrap; }
+  .nested { padding: 9px 12px; border-radius: 10px; background: var(--bg); margin-top: 9px; }
+  .nested > div + div { border-top: 1px solid var(--line); padding-top: 8px; margin-top: 8px; }
+  .mini { font-size: .82rem; padding: 7px 10px; }
+  select, input[type=time] { font: inherit; padding: 9px; border: 1px solid var(--line);
+    border-radius: 10px; background: var(--bg); color: var(--text); }
+  @media(max-width:420px) {
+    .item-head { gap: 6px; }
+    .item-head button { width: 90px; flex-basis: 90px; padding: 8px 3px; font-size: .77rem; white-space: normal; }
+    /* Three equal-width buttons still fit iPhone 13 mini's 375px viewport. */
+    .action-row { gap: 6px; }
+    .action-row > button {
+      flex: 1 1 0; width: auto; min-width: 0; max-width: 184px;
+      padding: 8px 4px; font-size: .8rem; line-height: 1.25;
+    }
+    #code-form .row > button { padding: 8px 5px; font-size: .85rem; }
+    #btn-check, #btn-change, #btn-install, #btn-login { max-width: 100%; }
+  }
   .grow { flex: 1 1 auto; }
   .pill {
     display: inline-block; padding: 3px 11px; border-radius: 999px; font-weight: 600;
@@ -59,7 +104,8 @@
   li.urgent .bar > span { background: var(--urgent); }
   li.soon .when { color: var(--soon); } li.urgent .when { color: var(--urgent); }
   button {
-    font: inherit; font-weight: 600; border-radius: 10px; padding: 10px 14px; cursor: pointer;
+    display: inline-flex; align-items: center; justify-content: center; text-align: center;
+    min-height: 42px; line-height: 1.25; font: inherit; font-weight: 600; border-radius: 10px; padding: 10px 12px; cursor: pointer;
     border: 1px solid var(--line); background: var(--card); color: var(--text);
   }
   button.primary { background: var(--accent); color: var(--accent-text); border-color: var(--accent); }
@@ -77,6 +123,15 @@
     max-height: 240px; overflow-y: auto; margin: 10px 0 0; white-space: pre-wrap; word-break: break-word;
   }
   .hist .ico { width: 1.4em; display: inline-block; }
+  pre.logs { max-height: 60vh; white-space: pre; }
+  .quotas-row { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+  .quota-badge {
+    display: inline-flex; align-items: center; padding: 3px 10px;
+    border-radius: 999px; font-size: .83rem; font-weight: 600;
+    background: var(--track); color: var(--muted); border: 1px solid var(--line);
+  }
+  .quota-badge.near-limit { background: var(--soon-bg); color: var(--soon); border-color: var(--soon); }
+  .quota-badge.at-limit { background: var(--urgent-bg); color: var(--urgent); border-color: var(--urgent); }
   [hidden] { display: none !important; }
   footer { color: var(--muted); font-size: .85rem; text-align: center; margin-top: 20px; }
 </style>
@@ -84,50 +139,139 @@
 <body>
 <main>
   <h1>AltKeeper</h1>
-  <p class="sub">Keeps your iPhone apps alive by renewing their profiles.</p>
+  <p class="sub" data-i18n="Keeps your iPhone apps alive by renewing their profiles.">Keeps your iPhone apps alive by renewing their profiles.</p>
 
   <div class="banner bad" id="no-pairing" hidden>
-    iPhone pairing is missing (<code>rp-pairing.plist</code>). Set it up once with a USB cable:
-    follow the guide in the README.
+    <span data-i18n="iPhone pairing is missing">iPhone pairing is missing</span> (<code>rp-pairing.plist</code>). <span data-i18n="Set it up once with a USB cable: follow the guide in the README.">Set it up once with a USB cable: follow the guide in the README.</span>
   </div>
 
   <section class="card" aria-live="polite">
-    <h2>iPhone</h2>
+    <h2 data-i18n="iPhone">iPhone</h2>
     <div class="row">
-      <span class="pill" id="phone-pill">Checking…</span>
+      <span class="pill" id="phone-pill" data-i18n="Checking…">Checking…</span>
       <span class="muted grow" id="phone-addr"></span>
-      <button id="btn-check" type="button">Check again</button>
+      <button id="btn-check" type="button" data-i18n="Check again">Check again</button>
     </div>
     <div class="banner bad" id="phone-error" hidden></div>
   </section>
 
   <section class="card">
-    <h2>Your apps</h2>
+    <div class="row" style="justify-content:space-between; margin-bottom: 8px;">
+      <h2 data-i18n="Your apps" style="margin:0">Your apps</h2>
+      <div class="quotas-row" id="quotas-row" hidden>
+        <span class="quota-badge" id="quota-apps"></span>
+        <span class="quota-badge" id="quota-appids"></span>
+      </div>
+    </div>
     <p class="muted" id="apps-empty" hidden></p>
     <ul class="plain" id="apps"></ul>
-    <div class="row" style="margin-top:14px">
-      <button class="primary" id="btn-due" type="button">Renew expiring apps</button>
-      <button id="btn-all" type="button">Renew all now</button>
+    <div class="row action-row" style="margin-top:14px">
+      <button class="primary" id="btn-due" type="button" data-i18n="Renew expiring apps">Renew expiring apps</button>
+      <button id="btn-all" type="button" data-i18n="Renew all now">Renew all now</button>
+      <button id="btn-preview" type="button" data-i18n="Preview renewals">Preview renewals</button>
     </div>
     <p class="muted" id="renew-hint" style="margin:8px 0 0"></p>
-    <div id="job" hidden>
-      <div class="banner" id="job-status"></div>
-      <pre class="log" id="job-log"></pre>
+    <div class="nested" id="renew-preview" hidden></div>
+    <div id="app-job-slot">
+      <div id="job" hidden>
+        <div class="banner" id="job-status"></div>
+        <pre class="log" id="job-log"></pre>
+      </div>
     </div>
   </section>
 
   <section class="card">
-    <h2>Install an app from this PC</h2>
-    <p class="muted">Choose an IPA. AltKeeper signs it with the configured Apple ID and installs it over Wi-Fi. The Apple ID password must be saved on the server.</p>
+    <h2 data-i18n="Automatic renewal">Automatic renewal</h2>
+    <p class="muted" data-i18n="Runs once daily while this server is online. Renews expiring installed apps. If installed-app lookup fails, it falls back to all saved-team profiles. Default is OFF.">Runs once daily while this server is online. Renews expiring installed apps. If installed-app lookup fails, it falls back to all saved-team profiles. Default is OFF.</p>
+    <div class="row">
+      <span class="pill" id="auto-pill" data-i18n="OFF">OFF</span>
+      <span class="muted grow" id="auto-next" data-i18n="Automatic renewal disabled">Automatic renewal disabled</span>
+    </div>
+    <div class="row">
+      <div>
+        <label for="auto-time" data-i18n="Daily time (UTC)">Daily time (UTC)</label>
+        <input type="time" id="auto-time" value="06:00" style="max-width:150px">
+      </div>
+      <div>
+        <label for="auto-days" data-i18n="Renew when days remaining">Renew when days remaining</label>
+        <select id="auto-days">
+          <option value="1" data-i18n="1 day">1 day</option><option value="2" data-i18n="2 days">2 days</option>
+          <option value="3" selected data-i18n="3 days">3 days</option><option value="4" data-i18n="4 days">4 days</option>
+          <option value="5" data-i18n="5 days">5 days</option><option value="6" data-i18n="6 days">6 days</option>
+        </select>
+      </div>
+    </div>
+    <p class="muted" data-i18n="If a scheduled renewal fails: retry after 30 minutes, up to twice more. Send Discord notification only after the final failure (or an unretryable authentication error).">If a scheduled renewal fails: retry after 30 minutes, up to twice more. Send Discord notification only after the final failure (or an unretryable authentication error).</p>
+    <div class="row action-row" style="margin-top:10px">
+      <button class="primary" id="auto-enable" type="button" data-i18n="Enable auto-renew">Enable auto-renew</button>
+      <button id="auto-disable" type="button" hidden data-i18n="Turn off">Turn off</button>
+    </div>
+    <div class="banner bad" id="auto-error" hidden></div>
+    <div class="divider"></div>
+    <label for="discord-webhook" data-i18n="Discord failure notifications">Discord failure notifications</label>
+    <div class="row">
+      <span class="pill" id="discord-pill" data-i18n="Not configured">Not configured</span>
+      <span class="muted" data-i18n="Only sent when automatic renewal fails after retries.">Only sent when automatic renewal fails after retries.</span>
+    </div>
+    <input type="password" id="discord-webhook" placeholder="https://discord.com/api/webhooks/..." autocomplete="off">
+    <div class="row action-row" style="margin-top:10px">
+      <button id="discord-save" type="button" data-i18n="Save webhook">Save webhook</button>
+      <button id="discord-clear" type="button" data-i18n="Clear webhook">Clear webhook</button>
+      <button id="discord-test" type="button" data-i18n="Send test notification">Send test notification</button>
+    </div>
+    <div class="banner bad" id="discord-error" hidden></div>
+    <div class="banner" id="discord-test-result" role="status" aria-live="polite" hidden></div>
+  </section>
+
+  <section class="card">
+    <h2 data-i18n="Provisioning profiles on iPhone">Provisioning profiles on iPhone</h2>
+    <p class="muted" data-i18n="Old profiles may remain after renewal. Deleting a profile still needed by an installed app can stop it opening. A verified server-side backup is saved before removal.">Old profiles may remain after renewal. Deleting a profile still needed by an installed app can stop it opening. A verified server-side backup is saved before removal.</p>
+    <p class="muted" id="profiles-empty" hidden></p>
+    <ul class="plain" id="profiles"></ul>
+  </section>
+
+  <section class="card">
+    <h2 data-i18n="Saved profile backups">Saved profile backups</h2>
+    <p class="muted" data-i18n="Restore a backed-up profile by UUID. Restoring does not extend its original expiry date. The backup is retained.">Restore a backed-up profile by UUID. Restoring does not extend its original expiry date. The backup is retained.</p>
+    <p class="muted" id="backups-empty"></p>
+    <ul class="plain" id="backups"></ul>
+  </section>
+
+  <section class="card">
+    <h2 data-i18n="Install an app from this PC">Install an app from this PC</h2>
+    <p class="muted" data-i18n="Choose an IPA. AltKeeper signs it with the configured Apple ID and installs it over Wi-Fi. The Apple ID password must be saved on the server.">Choose an IPA. AltKeeper signs it with the configured Apple ID and installs it over Wi-Fi. The Apple ID password must be saved on the server.</p>
     <form id="install-form">
-      <label for="ipa-file">IPA file</label>
+      <label for="ipa-file" data-i18n="IPA file">IPA file</label>
       <input id="ipa-file" type="file" accept=".ipa,application/octet-stream">
+      <label for="install-display-name" data-i18n="New app name (optional)">New app name (optional)</label>
+      <input id="install-display-name" type="text" maxlength="40" autocomplete="off"
+        placeholder="e.g. YouTube Clone">
+      <label for="install-bundle-id" data-i18n="New Bundle ID (optional)">New Bundle ID (optional)</label>
+      <input id="install-bundle-id" type="text" maxlength="160" autocapitalize="off" spellcheck="false"
+        autocomplete="off" placeholder="e.g. com.example.youtubeclone">
+      <p class="muted" data-i18n="These settings are for new installations only. Existing apps and automatic renewal are never modified. A new Bundle ID allows a separate copy; the Apple team suffix is added automatically.">These settings are for new installations only. Existing apps and automatic renewal are never modified. A new Bundle ID allows a separate copy; the Apple team suffix is added automatically.</p>
       <div class="row" style="margin-top:10px">
-        <button class="primary" id="btn-install" type="submit">Sign and install</button>
+        <button class="primary" id="btn-install" type="submit" data-i18n="Sign and install">Sign and install</button>
         <span class="muted" id="install-hint"></span>
       </div>
     </form>
+    <div class="nested" id="extension-choice" hidden>
+      <h3 data-i18n="Confirm new installation">Confirm new installation</h3>
+      <p class="muted" id="install-original" aria-live="polite"></p>
+      <div id="extension-options">
+        <p class="muted" data-i18n="Unchecked extensions are removed before signing. Some apps require extensions to function. All are selected by default.">Unchecked extensions are removed before signing. Some apps require extensions to function. All are selected by default.</p>
+        <div id="extension-list"></div>
+        <p class="muted" id="extension-summary" aria-live="polite"></p>
+        <p class="muted" data-i18n="App ID count is an upper bound; already-registered IDs may be reused. Live Apple quota is not checked here.">App ID count is an upper bound; already-registered IDs may be reused. Live Apple quota is not checked here.</p>
+      </div>
+      <div class="row action-row" style="margin-top:12px">
+        <button type="button" id="ext-all" data-i18n="Select all">Select all</button>
+        <button type="button" id="ext-none" data-i18n="Select none">Select none</button>
+        <button type="button" class="primary" id="ext-confirm" data-i18n="Sign and install selected">Sign and install selected</button>
+      </div>
+    </div>
     <div class="banner bad" id="install-error" hidden></div>
+    <div id="install-job-slot"></div>
   </section>
 
   <section class="card">
@@ -135,54 +279,71 @@ <h2>Apple ID</h2>
     <div id="account-info" hidden>
       <div class="row">
         <span class="grow"><strong id="acc-id"></strong><br><span class="muted" id="acc-pw"></span></span>
-        <button id="btn-change" type="button">Change account</button>
+        <button id="btn-change" type="button" data-i18n="Change account">Change account</button>
       </div>
     </div>
     <form id="login-form" autocomplete="off" hidden>
-      <label for="apple-id">Apple ID (email)</label>
+      <label for="apple-id" data-i18n="Apple ID (email)">Apple ID (email)</label>
       <input id="apple-id" type="email" autocomplete="username" inputmode="email" autocapitalize="off" spellcheck="false">
-      <label for="apple-pw">Password</label>
+      <label for="apple-pw" data-i18n="Password">Password</label>
       <input id="apple-pw" type="password" autocomplete="current-password" autocapitalize="off" spellcheck="false">
-      <label class="check"><input type="checkbox" id="show-pw"> Show password</label>
+      <label class="check"><input type="checkbox" id="show-pw"> <span data-i18n="Show password">Show password</span></label>
       <label class="check"><input type="checkbox" id="save-pw" checked>
-        <span>Save the password on this server for automatic renewals<br>
-        <span class="muted">It is stored as plain text in a private server file.</span></span></label>
-      <button class="primary" id="btn-login" type="submit">Sign in</button>
-      <p class="muted">Try only once at a time: repeated failures may cause Apple to block sign-ins temporarily.</p>
+        <span><span data-i18n="Save the password on this server for automatic renewals">Save the password on this server for automatic renewals</span>
+        <span class="muted" data-i18n="It is stored as plain text in a private server file.">It is stored as plain text in a private server file.</span></span></label>
+      <button class="primary" id="btn-login" type="submit" data-i18n="Sign in">Sign in</button>
+      <p class="muted" data-i18n="Try only once at a time: repeated failures may cause Apple to block sign-ins temporarily.">Try only once at a time: repeated failures may cause Apple to block sign-ins temporarily.</p>
     </form>
     <form id="code-form" autocomplete="off" hidden>
       <div class="banner good">Apple sent a 6-digit code to your devices.</div>
       <div class="banner bad" id="code-error" hidden></div>
-      <label for="code">Code</label>
+      <label for="code" data-i18n="Code">Code</label>
       <input id="code" class="code" type="text" inputmode="numeric" pattern="[0-9]*" maxlength="6" autocomplete="one-time-code">
       <div class="row" style="margin-top:10px">
-        <button class="primary" id="btn-code" type="submit">Submit code</button>
-        <button id="btn-resend" type="button">Resend code</button>
+        <button class="primary" id="btn-code" type="submit" data-i18n="Submit code">Submit code</button>
+        <button id="btn-resend" type="button" data-i18n="Resend code">Resend code</button>
       </div>
     </form>
     <div class="banner" id="login-msg" hidden></div>
   </section>
 
   <section class="card hist">
-    <h2>Recent renewals</h2>
-    <p class="muted" id="hist-empty">Nothing yet. Automatic renewal runs every evening when configured on the server.</p>
+    <h2 data-i18n="Recent renewals">Recent renewals</h2>
+    <p class="muted" id="hist-empty" data-i18n="Nothing yet. Automatic renewal runs every evening when configured on the server.">Nothing yet. Automatic renewal runs every evening when configured on the server.</p>
     <ul class="plain" id="hist"></ul>
   </section>
 
-  <footer>For use on your home network only.</footer>
+  <section class="card" id="logs">
+    <h2 data-i18n="Logs">Logs</h2>
+    <div class="row">
+      <span class="muted grow" data-i18n="Live server log, newest at the bottom.">Live server log, newest at the bottom.</span>
+      <button id="btn-logs-copy" type="button" data-i18n="Copy">Copy</button>
+      <button id="btn-logs-clear" type="button" data-i18n="Clear view">Clear view</button>
+    </div>
+    <pre class="log logs" id="logs-view"></pre>
+  </section>
+
+  <footer data-i18n="For use on your home network only.">For use on your home network only.</footer>
 </main>
 
 <script>
 "use strict";
 const $ = (id) => document.getElementById(id);
+function t(en) { return en; }
+
 let state = null, showForm = false, timer = null, sending = false, uploading = false;
+let pendingInstall = null;
+let expandedApps = new Set(), expandedProfiles = new Set(), showPreview = false;
+let autoDraftDirty = false, autoSavePending = false;
+let refreshInFlight = false, refreshQueued = false;
 
-async function api(path, body) {
+async function api(path, body, signal) {
   const opt = body === undefined ? {} : {
     method: "POST",
     headers: { "Content-Type": "application/json", "X-Requested-With": "altkeeper" },
     body: JSON.stringify(body),
   };
+  if (signal) opt.signal = signal;
   const r = await fetch(path, opt);
   let j = {};
   try { j = await r.json(); } catch (_) {}
@@ -195,6 +356,43 @@ <h2>Recent renewals</h2>
   if (n === 0) return "expires today";
   return "expires in " + n + (n === 1 ? " day" : " days");
 }
+function profilesText(n) { return n + " profiles"; }
+
+function placeJob(job) {
+  const panel = $("job");
+  const slot = $(job.kind === "install" ? "install-job-slot" : "app-job-slot");
+  if (panel.parentElement !== slot) slot.append(panel);
+}
+
+function installHint(s) {
+  if (uploading) return t("Analyzing IPA…");
+  if (s.busy && s.job.kind === "install") {
+    return s.job.running
+      ? t("Signing and installing the app. Keep this page open until it finishes…")
+      : t("Checking…");
+  }
+  if (!s.account.present) return t("Sign in with your Apple ID first.");
+  if (!s.account.password_saved) return t("Save the Apple ID password on the server to sign and install.");
+  if (s.phone.reachable !== true) return t("The iPhone must be reachable on Wi-Fi.");
+  return s.busy ? t("Another operation is in progress.") : t("The Apple ID is used to sign the app.");
+}
+
+function syncAutoRenewInputs(auto) {
+  if (autoDraftDirty) {
+    // After saving, an earlier state request may still report the old values.
+    // Keep the draft until the server reflects both saved settings.
+    if (!autoSavePending || auto.time !== $("auto-time").value
+        || Number(auto.min_days) !== Number($("auto-days").value)) return;
+    autoDraftDirty = false;
+    autoSavePending = false;
+  }
+  $("auto-time").value = auto.time || "06:00";
+  $("auto-days").value = String(auto.min_days || 3);
+}
+for (const id of ["auto-time", "auto-days"]) {
+  $(id).addEventListener("input", () => { autoDraftDirty = true; autoSavePending = false; });
+  $(id).addEventListener("change", () => { autoDraftDirty = true; autoSavePending = false; });
+}
 
 function li(cls, ...kids) {
   const e = document.createElement("li");
@@ -229,64 +427,220 @@ <h2>Recent renewals</h2>
 
   // iPhone
   const pill = $("phone-pill"), p = s.phone;
-  if (p.checking) { pill.textContent = "Checking…"; pill.className = "pill"; }
-  else if (p.reachable === true) { pill.textContent = "iPhone reachable"; pill.className = "pill ok"; }
-  else if (p.reachable === false) { pill.textContent = "iPhone unreachable"; pill.className = "pill bad"; }
-  else { pill.textContent = "Not checked yet"; pill.className = "pill"; }
+  if (p.checking) { pill.textContent = t("Checking…"); pill.className = "pill"; }
+  else if (p.reachable === true) { pill.textContent = t("iPhone reachable"); pill.className = "pill ok"; }
+  else if (p.reachable === false) { pill.textContent = t("iPhone unreachable"); pill.className = "pill bad"; }
+  else { pill.textContent = t("Not checked yet"); pill.className = "pill"; }
   $("phone-addr").textContent = p.reachable && p.address ? p.address : "";
   const err = p.reachable === false ? p.error : "";
   banner("phone-error", err, "bad");
   $("phone-error").title = p.detail || "";
 
-  // App
+  // Free-account limits: 3 active sideloaded apps, 10 App IDs per week.
+  const qRow = $("quotas-row");
+  if (s.quotas && s.account.present && p.reachable === true) {
+    qRow.hidden = false;
+    const appsUsed = s.quotas.installed_apps, maxApps = s.quotas.max_installed_apps || 3;
+    const idsUsed = s.quotas.app_ids_used, maxIds = s.quotas.max_app_ids || 10;
+    const qApps = $("quota-apps"), qAppIds = $("quota-appids");
+    qApps.textContent = appsUsed + "/" + maxApps + " " + t("Apps");
+    qApps.className = appsUsed >= maxApps ? "quota-badge at-limit" : appsUsed >= maxApps - 1 ? "quota-badge near-limit" : "quota-badge";
+    qApps.title = appsUsed + " / " + maxApps + " " + t("active sideloaded apps on this iPhone");
+    qAppIds.textContent = idsUsed + "/" + maxIds + " " + t("App IDs");
+    qAppIds.className = idsUsed >= maxIds ? "quota-badge at-limit" : idsUsed >= 7 ? "quota-badge near-limit" : "quota-badge";
+    qAppIds.title = idsUsed + " / " + maxIds + " " + t("App IDs in use (an estimate: Apple's live quota is not checked)");
+  } else {
+    qRow.hidden = true;
+  }
+
+  // One app per host bundle. Members are separate signing profiles.
+  const canRenew = s.account.present && s.account.password_saved && s.account.team && !s.busy;
   const ul = $("apps");
   ul.replaceChildren();
   s.apps.forEach((a) => {
+    const members = a.members || [{bundle:a.bundle,label:a.label,days:a.days,expires:a.expires}];
     const pct = Math.max(4, Math.min(100, Math.round((Math.max(a.days, 0) / 7) * 100)));
     const bar = div("bar", span(""));
     bar.firstChild.style.width = pct + "%";
-    ul.append(li(a.level,
+    const details = div("item-info",
       div("app-name", document.createTextNode(a.label)),
-      div("muted", span(days(a.days), "when"), document.createTextNode(" · " + a.expires.slice(0, 10))),
-      bar));
+      div("muted", span(days(a.days), "when"),
+        document.createTextNode(" · " + (a.expires || "").slice(0, 10) +
+        " · " + profilesText(members.length))));
+    const last = (s.app_status || {})[a.bundle];
+    if (last) {
+      const date = new Date(last.at * 1000).toLocaleString("en-US", {timeZone:"UTC"});
+      details.append(div("muted", document.createTextNode(t("Last profile install: ") +
+        last.status + " · " + date + " UTC (" + last.renewed + "/" + last.total + ")")));
+    }
+    const renewBtn = document.createElement("button");
+    renewBtn.type = "button";
+    renewBtn.className = "mini";
+    renewBtn.textContent = t("Renew app");
+    renewBtn.disabled = !canRenew;
+    renewBtn.onclick = () => {
+      if (confirm("Renew " + a.label + " and all " + members.length + " profiles now?")) {
+        act(() => api("/api/renew", {mode:"single",bundle:a.bundle}));
+      }
+    };
+    const expandBtn = document.createElement("button");
+    expandBtn.type = "button"; expandBtn.className = "mini";
+    expandBtn.textContent = expandedApps.has(a.bundle) ? t("Less ▲") : t("Details ▼");
+    expandBtn.onclick = () => {
+      if (expandedApps.has(a.bundle)) expandedApps.delete(a.bundle);
+      else expandedApps.add(a.bundle);
+      render(state);
+    };
+    const item = li(a.level,
+      div("item-head", details, renewBtn, expandBtn), bar);
+    if (expandedApps.has(a.bundle)) {
+      const nested = div("nested");
+      members.forEach(m => nested.append(div("",
+        div("app-name", document.createTextNode(m.label)),
+        div("muted", document.createTextNode(days(m.days) + " · " + m.bundle)))));
+      item.append(nested);
+    }
+    ul.append(item);
   });
   const empty = $("apps-empty");
-  if (!s.account.present) { empty.textContent = "Sign in with your Apple ID to see your apps."; empty.hidden = false; }
-  else if (p.reachable === false) { empty.textContent = "Apps cannot be read while the iPhone is unreachable."; empty.hidden = false; }
-  else if (!s.apps.length && p.reachable === true) { empty.textContent = "No apps found for this Apple ID."; empty.hidden = false; }
+  if (!s.account.present) { empty.textContent = t("Sign in with your Apple ID to see your apps."); empty.hidden = false; }
+  else if (p.reachable === false) { empty.textContent = t("Apps cannot be read while the iPhone is unreachable."); empty.hidden = false; }
+  else if (!s.apps.length && p.reachable === true) { empty.textContent = t("No apps found for this Apple ID."); empty.hidden = false; }
   else { empty.hidden = true; }
 
-  // Renewal buttons
-  const canRenew = s.account.present && s.account.password_saved && s.account.team && !s.busy;
   $("btn-due").disabled = !canRenew;
   $("btn-all").disabled = !canRenew;
   $("btn-check").disabled = s.busy;
-  $("renew-hint").textContent = !s.account.present ? "Sign in with your Apple ID first."
-    : !s.account.password_saved ? "The password must be saved to renew: sign in again and leave the checkbox selected."
-    : s.busy ? "Working…" : "";
+  $("renew-hint").textContent = !s.account.present ? t("Sign in with your Apple ID first.")
+    : !s.account.password_saved ? t("Save the Apple ID password to renew.")
+    : s.busy ? t("Working…") : "";
+  show("renew-preview", showPreview);
+  if (showPreview) {
+    const box = $("renew-preview");
+    box.replaceChildren(div("app-name", document.createTextNode(
+      ("Potential renewals (expires in " + (s.auto_renew.min_days || 3) + " days or less):"))));
+    const due = s.apps.filter(a => a.days <= (s.auto_renew.min_days || 3));
+    if (!due.length) box.append(div("muted", document.createTextNode(t("No profiles appear due."))));
+    due.forEach(a => box.append(div("muted",
+      document.createTextNode(a.label + " · " + profilesText(a.members.length) + " · " + days(a.days)))));
+    box.append(div("muted", document.createTextNode(
+      t("Preview only: final renewal also verifies installed apps on the iPhone. If installed-app lookup fails, all known team profiles are renewed."))));
+  }
+
+  // Persistent schedule and retry details
+  const auto = s.auto_renew || {enabled:false,time:"06:00",min_days:3,next_run:null};
+  $("auto-pill").textContent = auto.enabled ? t("ON") : t("OFF");
+  $("auto-pill").className = "pill " + (auto.enabled ? "ok" : "");
+  const next = auto.next_run
+    ? new Date(auto.next_run * 1000).toLocaleString("en-US", {
+        timeZone:"UTC", year:"numeric", month:"2-digit", day:"2-digit",
+        hour:"2-digit", minute:"2-digit", hour12:false
+      }) : null;
+  $("auto-next").textContent = auto.enabled ? (auto.retry_at ? t("Retry: ") : t("Next: ")) +
+    (next || t("checking")) + " UTC" : t("Automatic renewal disabled");
+  syncAutoRenewInputs(auto);
+  $("auto-enable").textContent = auto.enabled ? t("Save settings") : t("Enable auto-renew");
+  $("auto-enable").disabled = !s.account.password_saved || !s.account.team;
+  $("auto-disable").hidden = !auto.enabled;
+  $("discord-pill").textContent = auto.discord_configured ? t("Configured") : t("Not configured");
+  $("discord-pill").className = "pill" + (auto.discord_configured ? " ok" : "");
+  $("discord-clear").disabled = !auto.discord_configured;
+  $("discord-test").disabled = !auto.discord_configured;
+
+  // Show provisioning profiles only when expanded, without moving controls when labels wrap.
+  const pu = $("profiles");
+  pu.replaceChildren();
+  const grouped = new Map();
+  (s.profiles || []).forEach(profile => {
+    const root = profile.root || profile.bundle;
+    if (!grouped.has(root)) grouped.set(root, []);
+    grouped.get(root).push(profile);
+  });
+  grouped.forEach((profiles, root) => {
+    const label = (s.apps.find(a => a.bundle === root) || {}).label || root;
+    const details = div("item-info", div("app-name", document.createTextNode(label)),
+      div("muted", document.createTextNode((profiles.length + " saved-on-phone profiles"))));
+    const toggle = document.createElement("button");
+    toggle.type = "button"; toggle.className = "mini";
+    toggle.textContent = expandedProfiles.has(root) ? t("Hide ▲") : t("Show ▼");
+    toggle.onclick = () => {
+      if (expandedProfiles.has(root)) expandedProfiles.delete(root);
+      else expandedProfiles.add(root);
+      render(state);
+    };
+    const item = li("", div("item-head", details, toggle));
+    if (expandedProfiles.has(root)) {
+      const nested = div("nested");
+      profiles.forEach(prof => {
+        const info = div("item-info",
+          div("app-name", document.createTextNode(prof.label)),
+          div("muted", document.createTextNode(days(prof.days) + " · " + prof.expires.slice(0,10))),
+          div("muted", document.createTextNode(t("Profile ") + prof.uuid)));
+        const remove = document.createElement("button");
+        remove.type = "button"; remove.className = "mini";
+        remove.textContent = t("Delete profile");
+        remove.disabled = s.busy || s.phone.reachable !== true;
+        remove.onclick = () => {
+          if (confirm("Delete profile " + prof.uuid + "? An original verified backup will be saved first. " + "Removing an active profile may prevent the app from opening.")) {
+            act(() => api("/api/profile/remove", {uuid:prof.uuid}));
+          }
+        };
+        nested.append(div("item-head", info, remove));
+      });
+      item.append(nested);
+    }
+    pu.append(item);
+  });
+  const pempty = $("profiles-empty");
+  pempty.textContent = t("No provisioning profiles found for this Apple team.");
+  pempty.hidden = grouped.size > 0 || s.phone.reachable !== true;
+
+  const backups = $("backups");
+  backups.replaceChildren();
+  (s.backups || []).forEach(b => {
+    const info = div("item-info",
+      div("app-name", document.createTextNode(b.bundle || t("Unknown bundle"))),
+      div("muted", document.createTextNode(t("Profile ") + b.uuid)),
+      div("muted", document.createTextNode(t("Expires ") + b.expires.slice(0,10))));
+    const restore = document.createElement("button");
+    restore.type = "button"; restore.className = "mini";
+    restore.textContent = t("Restore");
+    restore.disabled = s.busy;
+    restore.onclick = () => {
+      if (confirm("Restore profile " + b.uuid + " to the iPhone? This does not renew the expiry.")) {
+        act(() => api("/api/profile/restore", {uuid:b.uuid}));
+      }
+    };
+    backups.append(li("", div("item-head", info, restore)));
+  });
+  $("backups-empty").hidden = (s.backups || []).length > 0;
+  $("backups-empty").textContent = t("No saved profile backups for this Apple team.");
 
   const canInstall = s.account.present && s.account.password_saved && s.account.team &&
                      p.reachable === true && !s.busy;
-  $("btn-install").disabled = !canInstall || uploading;
-  $("btn-install").textContent = uploading ? "Uploading…" : "Sign and install";
-  $("install-hint").textContent = !s.account.present ? "Sign in with your Apple ID first."
-    : !s.account.password_saved ? "Save the Apple ID password on the server to sign and install."
-    : p.reachable !== true ? "The iPhone must be reachable on Wi-Fi."
-    : s.busy ? "Another operation is in progress." : "The Apple ID is used to sign the app.";
+  $("btn-install").disabled = !canInstall || uploading || !!pendingInstall;
+  $("btn-install").textContent = uploading ? t("Analyzing IPA…") : t("Sign and install");
+  show("extension-choice", !!pendingInstall);
+  $("ext-confirm").disabled = !canInstall || uploading;
+  $("install-hint").textContent = installHint(s);
 
   // Lavoro in corso o appena finito
   const job = s.job;
+  placeJob(job);
   show("job", !!job.kind);
   if (job.kind) {
     const st = $("job-status");
     if (job.running) {
       st.className = "banner";
       st.textContent = job.kind === "install"
-        ? "Signing and installing the app. Keep this page open until it finishes…"
-        : "Renewal in progress. Keep this page open until it finishes…";
+        ? t("Signing and installing the app. Keep this page open until it finishes…")
+        : job.kind === "remove_profile"
+        ? t("Backing up and deleting the selected profile…")
+        : job.kind === "restore_profile" ? t("Restoring the selected profile…")
+        : t("Renewal in progress. Keep this page open until it finishes…");
     }
-    else if (job.ok) { st.className = "banner good"; st.textContent = job.kind === "install" ? "App installed." : "Done."; }
-    else { st.className = "banner bad"; st.textContent = "It did not complete successfully. Check the last line."; }
+    else if (job.ok) { st.className = "banner good"; st.textContent = job.kind === "install" ? t("App installed.") : job.kind === "remove_profile" ? t("Profile removed and backed up.") : job.kind === "restore_profile" ? t("Profile restored.") : t("Done."); }
+    else { st.className = "banner bad"; st.textContent = t("It did not complete successfully. Check the last line."); }
     const log = $("job-log");
     const atEnd = log.scrollTop + log.clientHeight >= log.scrollHeight - 8;
     log.textContent = job.lines.join("\n");
@@ -299,11 +653,11 @@ <h2>Recent renewals</h2>
   show("account-info", s.account.present && !showForm && !working && !needs);
   if (s.account.present) {
     $("acc-id").textContent = s.account.apple_id || "";
-    $("acc-pw").textContent = s.account.password_saved ? "Password saved for automatic renewals" : "Password not saved";
+    $("acc-pw").textContent = s.account.password_saved ? t("Password saved for automatic renewals") : t("Password not saved");
   }
   show("login-form", (!s.account.present || showForm || working || phase === "failed") && !needs);
   $("btn-login").disabled = working || sending || (s.busy && !working);
-  $("btn-login").textContent = working ? "Signing in…" : "Sign in";
+  $("btn-login").textContent = working ? t("Signing in…") : t("Sign in");
   show("code-form", needs);
   banner("code-error", needs ? s.login.code_error : "", "bad");
   banner("login-msg", phase === "done" || phase === "failed" ? s.login.message : "",
@@ -322,15 +676,31 @@ <h2>Recent renewals</h2>
 
 async function refresh() {
   clearTimeout(timer);
+  if (refreshInFlight) {
+    refreshQueued = true;
+    return;
+  }
+  refreshInFlight = true;
   let fast = false;
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 10000);
   try {
-    render(await api("/api/state"));
-    fast = state.busy || state.phone.checking || state.login.phase === "working" ||
-           state.login.phase === "needs_code" || state.job.running;
+    const latest = await api("/api/state", undefined, controller.signal);
+    // A user action requested a newer snapshot while this one was in flight.
+    if (!refreshQueued) {
+      render(latest);
+      fast = latest.busy || latest.phone.checking || latest.login.phase === "working" ||
+             latest.login.phase === "needs_code" || latest.job.running;
+    }
   } catch (e) {
-    banner("phone-error", "Cannot reach the server: " + e.message, "bad");
+    if (!refreshQueued) banner("phone-error", t("Cannot reach the server: ") + e.message, "bad");
+  } finally {
+    clearTimeout(timeout);
+    refreshInFlight = false;
+    const again = refreshQueued;
+    refreshQueued = false;
+    timer = setTimeout(refresh, again ? 0 : fast ? 1500 : 15000);
   }
-  timer = setTimeout(refresh, fast ? 1500 : 15000);
 }
 
 async function act(fn, errId) {
@@ -338,23 +708,140 @@ <h2>Recent renewals</h2>
   refresh();
 }
 
+$("auto-enable").onclick = () => {
+  banner("auto-error", "");
+  act(async () => {
+    await api("/api/auto-renew", {
+      enabled:true, time:$("auto-time").value, min_days:Number($("auto-days").value)
+    });
+    autoSavePending = true;
+  }, "auto-error");
+};
+$("auto-disable").onclick = () => {
+  banner("auto-error", "");
+  act(async () => {
+    await api("/api/auto-renew", {
+      enabled:false, time:$("auto-time").value, min_days:Number($("auto-days").value)
+    });
+    autoSavePending = true;
+  }, "auto-error");
+};
+$("discord-save").onclick = () => {
+  const url = $("discord-webhook").value.trim();
+  banner("discord-error", "");
+  if (!url) return banner("discord-error", t("Enter the Discord webhook URL."), "bad");
+  act(async () => {
+    await api("/api/discord", {webhook:url});
+    $("discord-webhook").value = "";
+  }, "discord-error");
+};
+$("discord-clear").onclick = () => {
+  if (confirm(t("Remove the saved Discord webhook?"))) {
+    act(() => api("/api/discord", {clear:true}), "discord-error");
+  }
+};
+$("discord-test").onclick = async () => {
+  banner("discord-test-result", "");
+  $("discord-test").disabled = true;
+  try {
+    await api("/api/discord/test", {});
+    banner("discord-test-result", t("Test notification sent. Check your Discord channel."), "good");
+  } catch (e) {
+    banner("discord-test-result", e.message, "bad");
+  } finally {
+    refresh();
+  }
+};
+$("btn-preview").onclick = () => {showPreview = !showPreview; if(state)render(state);};
 $("btn-check").onclick = () => act(() => api("/api/check", {}));
 $("btn-due").onclick = () => act(() => api("/api/renew", { mode: "due" }));
 $("btn-all").onclick = () => {
-  if (confirm("Renew all apps now? This takes about a minute and usually does not need to be done often.")) {
+  if (confirm(t("Renew all apps now? This takes about a minute and usually does not need to be done often."))) {
     act(() => api("/api/renew", { mode: "now" }));
   }
 };
+function updateExtensionSummary() {
+  if (!pendingInstall) return;
+  const selected = Array.from($("extension-list").querySelectorAll("input[type=checkbox]"))
+    .filter(input => input.checked).length;
+  const template = t("Up to {count} App IDs ({extensions} extensions)");
+  $("extension-summary").textContent = template.replace("{count}", String(selected + 1))
+    .replace("{extensions}", String(selected));
+}
+function showExtensionOptions(info) {
+  pendingInstall = info;
+  $("extension-options").hidden = info.extensions.length === 0;
+  $("install-original").textContent = (info.app_name || "App") + " · " + (info.bundle_id || "");
+  const list = $("extension-list");
+  list.replaceChildren();
+  info.extensions.forEach(ext => {
+    const input = document.createElement("input");
+    input.type = "checkbox";
+    input.checked = true;
+    input.value = ext.bundle_id;
+    input.onchange = updateExtensionSummary;
+    const label = document.createElement("label");
+    label.className = "ext-option";
+    const text = document.createElement("span");
+    const title = document.createElement("strong");
+    title.textContent = ext.name || ext.bundle_id;
+    const id = document.createElement("small");
+    id.textContent = ext.bundle_id;
+    text.append(title, id);
+    label.append(input, text);
+    list.append(label);
+  });
+  updateExtensionSummary();
+  if (state) render(state);
+}
+$("ext-all").onclick = () => {
+  $("extension-list").querySelectorAll("input[type=checkbox]")
+    .forEach(input => { input.checked = true; });
+  updateExtensionSummary();
+};
+$("ext-none").onclick = () => {
+  $("extension-list").querySelectorAll("input[type=checkbox]")
+    .forEach(input => { input.checked = false; });
+  updateExtensionSummary();
+};
+$("ext-confirm").onclick = async () => {
+  if (!pendingInstall) return;
+  $("ext-confirm").disabled = true;
+  const keep = Array.from($("extension-list").querySelectorAll("input[type=checkbox]"))
+    .filter(input => input.checked).map(input => input.value);
+  try {
+    await api("/api/install/confirm", {
+      token: pendingInstall.token, keep_extensions: keep,
+      display_name: $("install-display-name").value.trim() || null,
+      bundle_id: $("install-bundle-id").value.trim() || null,
+    });
+    pendingInstall = null;
+    $("install-display-name").value = "";
+    $("install-bundle-id").value = "";
+    banner("install-error", "");
+  } catch(e) {
+    banner("install-error", e.message, "bad");
+  } finally {
+    refresh();
+  }
+};
+$("ipa-file").onchange = () => {
+  pendingInstall = null;
+  banner("install-error", "");
+  if (state) render(state);
+};
+
 $("install-form").onsubmit = async (ev) => {
   ev.preventDefault();
   const file = $("ipa-file").files[0];
-  if (!file) { banner("install-error", "Choose an IPA file first.", "bad"); return; }
+  if (!file) { banner("install-error", t("Choose an IPA file first."), "bad"); return; }
   uploading = true;
   if (state) render(state);
   try {
     const form = new FormData();
     form.append("ipa", file);
-    const r = await fetch("/api/install", {
+    const customize = !!($("install-display-name").value.trim() || $("install-bundle-id").value.trim());
+    const r = await fetch("/api/install/inspect?customize=" + String(customize), {
       method: "POST",
       headers: { "X-Requested-With": "altkeeper" },
       body: form,
@@ -363,6 +850,11 @@ <h2>Recent renewals</h2>
     try { j = await r.json(); } catch (_) {}
     if (!r.ok) throw new Error(j.error || ("Error " + r.status));
     $("ipa-file").value = "";
+    if (j.needs_selection) showExtensionOptions(j);
+    else {
+      $("install-display-name").value = "";
+      $("install-bundle-id").value = "";
+    }
     $("install-error").hidden = true;
   } catch (e) {
     banner("install-error", e.message, "bad");
@@ -396,7 +888,30 @@ <h2>Recent renewals</h2>
 };
 $("btn-resend").onclick = () => act(() => api("/api/login/resend", {}), "code-error");
 
+// Logs: only new lines are fetched; the view keeps the last 2,000.
+let logSeq = 0;
+async function pollLogs() {
+  try {
+    let r = await api("/api/logs?since=" + logSeq);
+    if (r.seq < logSeq) r = await api("/api/logs?since=0");
+    if (r.lines.length) {
+      const v = $("logs-view");
+      const atEnd = v.scrollTop + v.clientHeight >= v.scrollHeight - 4;
+      const all = (v.textContent ? v.textContent + "\n" : "") + r.lines.join("\n");
+      v.textContent = all.split("\n").slice(-2000).join("\n");
+      if (atEnd) v.scrollTop = v.scrollHeight;
+    }
+    logSeq = r.seq;
+  } catch (_) {}
+  setTimeout(pollLogs, 2000);
+}
+$("btn-logs-copy").onclick = () => navigator.clipboard.writeText($("logs-view").textContent);
+$("btn-logs-clear").onclick = () => { $("logs-view").textContent = ""; };
+
 refresh();
+pollLogs();
+if (location.hash === "#logs") $("logs").scrollIntoView();
 </script>
 </body>
 </html>
+
diff --git a/tests/localized_identity.rs b/tests/localized_identity.rs
new file mode 100644
index 0000000..6450a35
--- /dev/null
+++ b/tests/localized_identity.rs
@@ -0,0 +1,41 @@
+#![cfg(unix)]
+
+use isideload::sideload::{application::Application, bundle::Bundle};
+use std::{fs, os::unix::fs::symlink};
+
+#[test]
+fn display_name_rewrite_skips_symlinks_and_non_regular_files() {
+    let temp = tempfile::tempdir().unwrap();
+    let app = temp.path().join("Test.app");
+    fs::create_dir(&app).unwrap();
+    let mut info = plist::Dictionary::new();
+    info.insert("CFBundleIdentifier".into(), "com.example.test".into());
+    info.insert("CFBundleName".into(), "Old".into());
+    plist::to_file_xml(app.join("Info.plist"), &info).unwrap();
+    let old = b"\"CFBundleDisplayName\" = \"Old\";\n";
+
+    let localized = app.join("en.lproj");
+    fs::create_dir(&localized).unwrap();
+    fs::write(localized.join("InfoPlist.strings"), old).unwrap();
+    let external_dir = temp.path().join("external");
+    fs::create_dir(&external_dir).unwrap();
+    fs::write(external_dir.join("InfoPlist.strings"), old).unwrap();
+    symlink(&external_dir, app.join("linked.lproj")).unwrap();
+    let linked_file_dir = app.join("fr.lproj");
+    fs::create_dir(&linked_file_dir).unwrap();
+    symlink(external_dir.join("InfoPlist.strings"), linked_file_dir.join("InfoPlist.strings")).unwrap();
+    fs::write(app.join("file.lproj"), b"not a directory").unwrap();
+    fs::create_dir_all(app.join("directory.lproj/InfoPlist.strings")).unwrap();
+    fs::create_dir(app.join("unrelated")).unwrap();
+    fs::write(app.join("unrelated/InfoPlist.strings"), old).unwrap();
+
+    let mut application = Application { bundle: Bundle::new(app.clone()).unwrap() };
+    application.apply_install_identity(Some("New"), None).unwrap();
+
+    assert!(fs::read_to_string(localized.join("InfoPlist.strings")).unwrap().contains("\"New\""));
+    assert_eq!(fs::read(external_dir.join("InfoPlist.strings")).unwrap(), old);
+    assert_eq!(fs::read(app.join("unrelated/InfoPlist.strings")).unwrap(), old);
+    assert!(fs::symlink_metadata(app.join("linked.lproj")).unwrap().is_symlink());
+    assert!(fs::symlink_metadata(linked_file_dir.join("InfoPlist.strings")).unwrap().is_symlink());
+    assert!(app.join("directory.lproj/InfoPlist.strings").is_dir());
+}
diff --git a/vendor/isideload/src/sideload/application.rs b/vendor/isideload/src/sideload/application.rs
index 49e1c58..9696b92 100644
--- a/vendor/isideload/src/sideload/application.rs
+++ b/vendor/isideload/src/sideload/application.rs
@@ -16,8 +16,9 @@ use rootcause::option_ext::OptionExt;
 use rootcause::prelude::*;
 use sha1::Digest;
 use sha2::Sha256;
-use std::io::Write;
-use std::path::PathBuf;
+use std::collections::HashSet;
+use std::io::{Read, Write};
+use std::path::{Path, PathBuf};
 use tracing::{info, warn};
 use zip::ZipArchive;
 
@@ -28,6 +29,166 @@ pub struct Application {
     //pub temp_path: PathBuf,
 }
 
+/// Installation metadata, read from IPA Info.plist files without unpacking the archive.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IpaExtensionInfo {
+    pub bundle_id: String,
+    pub name: String,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct IpaManifest {
+    pub bundle_id: String,
+    pub name: String,
+    pub extensions: Vec<IpaExtensionInfo>,
+}
+
+fn display_name(info: &plist::Dictionary, fallback: &str) -> String {
+    info.get("CFBundleDisplayName")
+        .or_else(|| info.get("CFBundleName"))
+        .and_then(|v| v.as_string())
+        .unwrap_or(fallback)
+        .to_string()
+}
+
+/// Read the main bundle identifier and extension manifests. This is read-only:
+/// neither signing nor Apple registration happens until the user confirms.
+pub fn inspect_ipa(path: &Path) -> Result<IpaManifest, Report> {
+    let file = File::open(path).context("Could not open IPA for inspection")?;
+    let mut archive = ZipArchive::new(file).context("IPA is not a valid ZIP archive")?;
+    let mut main = None;
+    let mut extensions = Vec::new();
+    let mut ids = HashSet::new();
+    for i in 0..archive.len() {
+        let mut entry = archive.by_index(i)?;
+        let entry_name = entry.name().to_owned();
+        let parts: Vec<_> = entry_name.split('/').collect();
+        let is_main = parts.len() == 3 && parts[0] == "Payload"
+            && parts[1].ends_with(".app") && parts[2] == "Info.plist";
+        let is_extension = parts.len() == 5 && parts[0] == "Payload"
+            && parts[1].ends_with(".app") && parts[2] == "PlugIns"
+            && parts[3].ends_with(".appex") && parts[4] == "Info.plist";
+        if !is_main && !is_extension { continue; }
+        if entry.size() > 512 * 1024 {
+            bail!(SideloadError::InvalidBundle("Info.plist exceeds 512 KiB".into()));
+        }
+        let mut bytes = Vec::new();
+        entry.read_to_end(&mut bytes)?;
+        let info: plist::Dictionary = plist::from_bytes(&bytes)
+            .context("Cannot parse Info.plist")?;
+        let bundle_id = info.get("CFBundleIdentifier")
+            .and_then(|v| v.as_string()).ok_or_report()
+            .context("Missing CFBundleIdentifier")?.to_string();
+        if !ids.insert(bundle_id.clone()) {
+            bail!(SideloadError::InvalidBundle("Duplicate bundle identifier".into()));
+        }
+        let name = display_name(&info, if is_main {
+            parts[1].trim_end_matches(".app")
+        } else {
+            parts[3].trim_end_matches(".appex")
+        });
+        if is_main {
+            if main.replace((bundle_id, name)).is_some() {
+                bail!(SideloadError::InvalidBundle("Multiple apps in IPA".into()));
+            }
+        } else {
+            extensions.push(IpaExtensionInfo { bundle_id, name });
+        }
+    }
+    let (bundle_id, name) = main.ok_or_report()
+        .context("IPA is missing Payload/*.app/Info.plist")?;
+    extensions.sort_by(|a, b| a.bundle_id.cmp(&b.bundle_id));
+    Ok(IpaManifest { bundle_id, name, extensions })
+}
+
+/// Replace quoted display-name values in OpenStep InfoPlist.strings without
+/// disturbing other localized strings. Binary plist is handled separately.
+fn replace_localized_display_name(text: &str, display_name: &str) -> String {
+    let quoted_name = display_name.replace('\\', "\\\\").replace('"', "\\\"");
+    let mut value = text.to_string();
+    for key in ["CFBundleDisplayName", "CFBundleName"] {
+        for prefix in [format!("\"{key}\""), key.to_string()] {
+            let mut cursor = 0;
+            while let Some(offset) = value[cursor..].find(&prefix) {
+                let end_key = cursor + offset + prefix.len();
+                let bytes = value.as_bytes();
+                let mut p = end_key;
+                while p < bytes.len() && bytes[p].is_ascii_whitespace() { p += 1; }
+                if bytes.get(p) != Some(&b'=') { cursor = end_key; continue; }
+                p += 1;
+                while p < bytes.len() && bytes[p].is_ascii_whitespace() { p += 1; }
+                if bytes.get(p) != Some(&b'"') { cursor = end_key; continue; }
+                let first = p + 1;
+                let mut last = first;
+                let mut escaped = false;
+                while last < bytes.len() {
+                    let current = bytes[last];
+                    if current == b'"' && !escaped { break; }
+                    if current == b'\\' && !escaped { escaped = true; }
+                    else { escaped = false; }
+                    last += 1;
+                }
+                if last == bytes.len() { cursor = end_key; continue; }
+                value.replace_range(first..last, &quoted_name);
+                cursor = first + quoted_name.len() + 1;
+            }
+        }
+    }
+    value
+}
+
+fn localized_name_bytes(original: &[u8], name: &str) -> Result<Vec<u8>, Report> {
+    if let Ok(mut dict) = plist::from_bytes::<plist::Dictionary>(original) {
+        for key in ["CFBundleDisplayName", "CFBundleName"] {
+            if dict.contains_key(key) {
+                dict.insert(key.into(), plist::Value::String(name.into()));
+            }
+        }
+        let mut result = Vec::new();
+        plist::to_writer_binary(&mut result, &dict)?;
+        return Ok(result);
+    }
+    let le = original.starts_with(&[0xff, 0xfe]);
+    let be = original.starts_with(&[0xfe, 0xff]);
+    let text = if le || be {
+        let mut chunks = original[2..].chunks_exact(2);
+        let words: Vec<u16> = chunks.by_ref().map(|c| if le {
+            u16::from_le_bytes([c[0], c[1]])
+        } else {
+            u16::from_be_bytes([c[0], c[1]])
+        }).collect();
+        if !chunks.remainder().is_empty() {
+            bail!(SideloadError::InvalidBundle("Invalid UTF-16 localization file".into()));
+        }
+        String::from_utf16(&words)?
+    } else {
+        String::from_utf8(original.to_vec())?
+    };
+    let updated = replace_localized_display_name(&text, name);
+    if updated == text { return Ok(original.to_vec()); }
+    if le || be {
+        let mut out = if le { vec![0xff, 0xfe] } else { vec![0xfe, 0xff] };
+        for c in updated.encode_utf16() {
+            let encoded = if le { c.to_le_bytes() } else { c.to_be_bytes() };
+            out.extend_from_slice(&encoded);
+        }
+        Ok(out)
+    } else {
+        Ok(updated.into_bytes())
+    }
+}
+
+/// Accept a conservative reverse-DNS identifier, without the signer-added team suffix.
+pub fn valid_custom_bundle_id(id: &str) -> bool {
+    if id.len() > 160 || id.len() < 3 || !id.contains('.') { return false; }
+    id.split('.').all(|part| {
+        !part.is_empty() && part.len() <= 63
+            && part.as_bytes()[0].is_ascii_alphanumeric()
+            && part.bytes().all(|b| b.is_ascii_alphanumeric() || b == b'-')
+    })
+}
+
+
 impl Application {
     pub fn new(path: PathBuf) -> Result<Self, Report> {
         if !isideload_vfs::fs::metadata(&path).is_ok() {
@@ -108,6 +269,79 @@ impl Application {
         })
     }
 
+    /// Exclude unchecked .appex bundles before registering App IDs or signing.
+    /// This mutates only the extracted temporary copy, never the original IPA.
+    pub fn retain_extensions(&mut self, keep_ids: &[String]) -> Result<(), Report> {
+        let keep: HashSet<&str> = keep_ids.iter().map(String::as_str).collect();
+        let known: HashSet<&str> = self.bundle.app_extensions().iter()
+            .filter_map(|e| e.bundle_identifier()).collect();
+        for id in &keep {
+            if !known.contains(id) {
+                bail!(SideloadError::InvalidBundle(
+                    format!("Selected extension is not present in the IPA: {id}"),
+                ));
+            }
+        }
+        let unwanted: Vec<PathBuf> = self.bundle.app_extensions().iter()
+            .filter(|e| !e.bundle_identifier().is_some_and(|id| keep.contains(id)))
+            .map(|e| e.bundle_dir.clone()).collect();
+        for path in &unwanted {
+            isideload_vfs::fs::remove_dir_all(path)
+                .context("Could not remove an excluded extension")?;
+        }
+        // Re-scan the bundle so removed extensions' nested frameworks and
+        // dylibs are not left in the signing tree.
+        self.bundle = Bundle::new(self.bundle.bundle_dir.clone())?;
+        Ok(())
+    }
+
+    /// Apply requested new-install identity before the existing team-ID signing rewrite.
+    /// The original IPA is untouched; this only edits the extracted temp bundle.
+    pub fn apply_install_identity(
+        &mut self,
+        display_name: Option<&str>,
+        custom_bundle_id: Option<&str>,
+    ) -> Result<(), Report> {
+        if let Some(custom_id) = custom_bundle_id {
+            if !valid_custom_bundle_id(custom_id) {
+                bail!(SideloadError::InvalidBundle("Invalid custom Bundle ID".into()));
+            }
+            let original = self.main_bundle_id()?;
+            if original != custom_id {
+                self.update_bundle_id(&original, custom_id)?;
+                for ext in self.bundle.app_extensions_mut() {
+                    ext.write_info()?;
+                }
+            }
+        }
+        if let Some(name) = display_name {
+            if name.is_empty() || name.chars().count() > 40 || name.chars().any(char::is_control) {
+                bail!(SideloadError::InvalidBundle("Invalid custom display name".into()));
+            }
+            self.bundle.app_info.insert("CFBundleDisplayName".into(), plist::Value::String(name.into()));
+            self.bundle.app_info.insert("CFBundleName".into(), plist::Value::String(name.into()));
+            // iOS prefers localized InfoPlist.strings names over CFBundleDisplayName.
+            // Update the temporary IPA extraction only, not any installed app.
+            for entry in isideload_vfs::fs::read_dir(&self.bundle.bundle_dir)? {
+                let entry = entry?;
+                let localized = entry.path();
+                if localized.extension().is_none_or(|ext| ext != "lproj") { continue; }
+                if !entry.metadata().is_ok_and(|meta| meta.is_dir()) { continue; }
+                let path = localized.join("InfoPlist.strings");
+                if !isideload_vfs::fs::symlink_metadata(&path).is_ok_and(|meta| meta.is_file()) { continue; }
+                let old = isideload_vfs::fs::read(&path)?;
+                if old.len() > 1024 * 1024 {
+                    bail!(SideloadError::InvalidBundle("Localized display-name file too large".into()));
+                }
+                let new = localized_name_bytes(&old, name)?;
+                if old != new {
+                    isideload_vfs::fs::write(&path, &new)?;
+                }
+            }
+        }
+        Ok(())
+    }
+
     pub fn get_special_app(&self) -> Option<SpecialApp> {
         let bundle_id = self.bundle.bundle_identifier().unwrap_or("");
         let special_app = match bundle_id {
diff --git a/vendor/isideload/src/sideload/sideloader.rs b/vendor/isideload/src/sideload/sideloader.rs
index e0b7934..f7789bd 100644
--- a/vendor/isideload/src/sideload/sideloader.rs
+++ b/vendor/isideload/src/sideload/sideloader.rs
@@ -75,6 +75,9 @@ impl<C: MaxCertsCallback> Sideloader<C> {
         progress_callback: Option<F>,
         pairing_file: Option<&[u8]>,
         device_udid: Option<&str>,
+        selected_extensions: Option<&[String]>,
+        display_name: Option<&str>,
+        custom_bundle_id: Option<&str>,
     ) -> Result<(PathBuf, Option<SpecialApp>), Report>
     where
         F: Fn(f32) -> Fut,
@@ -100,7 +103,15 @@ impl<C: MaxCertsCallback> Sideloader<C> {
         }
 
         let mut app = Application::new(app_path)?;
+        if let Some(selected) = selected_extensions {
+            app.retain_extensions(selected)?;
+        }
+        // Detect special app type before changing its identity.
         let special = app.get_special_app();
+        if custom_bundle_id.is_some() && special.is_some() {
+            bail!("Custom Bundle IDs are disabled for special apps (AltStore, SideStore, LiveContainer).");
+        }
+        app.apply_install_identity(display_name, custom_bundle_id)?;
 
         let main_bundle_id = app.main_bundle_id()?;
         let main_app_name = app.main_app_name()?;
@@ -273,6 +284,9 @@ impl<C: MaxCertsCallback> Sideloader<C> {
                 progress_callback,
                 pairing_file,
                 Some(&device_info.udid),
+                None,
+                None,
+                None,
             )
             .await?;