diff --git a/xcom-ultra/Cargo.lock b/xcom-ultra/Cargo.lock
index 52c038a..38b5bdf 100644
--- a/xcom-ultra/Cargo.lock
+++ b/xcom-ultra/Cargo.lock
@@ -26,7 +26,7 @@ checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
 ]
 
 [[package]]
@@ -366,6 +366,28 @@ version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.17.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+dependencies = [
+ "aws-lc-sys",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.41.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+dependencies = [
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+]
+
 [[package]]
 name = "axum"
 version = "0.7.9"
@@ -440,13 +462,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"
 
 [[package]]
-name = "bincode"
-version = "1.3.3"
+name = "base64ct"
+version = "1.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b1f45e9417d87227c7a56d22e471c6206462cba514c7590c09aff4cf6d1ddcad"
-dependencies = [
- "serde",
-]
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
 
 [[package]]
 name = "bitflags"
@@ -459,6 +478,9 @@ name = "bitflags"
 version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
+dependencies = [
+ "serde_core",
+]
 
 [[package]]
 name = "bitvec"
@@ -619,6 +641,12 @@ dependencies = [
  "shlex",
 ]
 
+[[package]]
+name = "cesu8"
+version = "1.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6d43a04d8753f35258c91f8ec639f792891f748a1edbd759cf1dcea3382ad83c"
+
 [[package]]
 name = "cfg-if"
 version = "1.0.4"
@@ -639,7 +667,18 @@ checksum = "c3613f74bd2eac03dad61bd53dbe620703d4371614fe0bc3b9f04dd36fe4e818"
 dependencies = [
  "cfg-if",
  "cipher",
- "cpufeatures",
+ "cpufeatures 0.2.17",
+]
+
+[[package]]
+name = "chacha20"
+version = "0.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
+dependencies = [
+ "cfg-if",
+ "cpufeatures 0.3.0",
+ "rand_core 0.10.1",
 ]
 
 [[package]]
@@ -649,7 +688,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "10cd79432192d1c0f4e1a0fef9527696cc039165d729fb41b3f4f4f354c2dc35"
 dependencies = [
  "aead",
- "chacha20",
+ "chacha20 0.9.1",
  "cipher",
  "poly1305",
  "zeroize",
@@ -662,7 +701,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c673075a2e0e5f4a1dde27ce9dee1ea4558c7ffe648f576438a20ca1d2acc4b0"
 dependencies = [
  "iana-time-zone",
+ "js-sys",
  "num-traits",
+ "serde",
+ "wasm-bindgen",
  "windows-link",
 ]
 
@@ -699,6 +741,15 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "cmake"
+version = "0.1.58"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "combine"
 version = "4.6.7"
@@ -721,22 +772,38 @@ checksum = "958c5d6ecf1f214b4c2bbbbf6ab9523a864bd136dcf71a7e8904799acfe1ad47"
 dependencies = [
  "crossterm 0.29.0",
  "unicode-segmentation",
- "unicode-width 0.2.2",
+ "unicode-width 0.2.0",
 ]
 
 [[package]]
 name = "compact_str"
-version = "0.7.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f86b9c4c00838774a6d902ef931eff7470720c51d90c2e32cfe15dc304737b3f"
+checksum = "7fd622ebbb56a5b2ccb651b32b911cdeb2a9b4b11776b2473bf26a26a286244e"
 dependencies = [
  "castaway",
  "cfg-if",
  "itoa",
+ "rustversion",
  "ryu",
  "static_assertions",
 ]
 
+[[package]]
+name = "concurrent-queue"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4ca0197aee26d1ae37445ee532fefce43251d24cc7c166799f4d46817f1d3973"
+dependencies = [
+ "crossbeam-utils",
+]
+
+[[package]]
+name = "const-oid"
+version = "0.9.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"
+
 [[package]]
 name = "const-random"
 version = "0.1.18"
@@ -759,9 +826,9 @@ dependencies = [
 
 [[package]]
 name = "core-foundation"
-version = "0.9.4"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "91e195e091a93c46f7102ec7818a2aa394e1e1771c3ab4825963fa03e45afb8f"
+checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6"
 dependencies = [
  "core-foundation-sys",
  "libc",
@@ -782,6 +849,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "cpufeatures"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8b2a41393f66f16b0823bb79094d54ac5fbd34ab292ddafb9a0456ac9f87d201"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "crc"
 version = "3.4.0"
@@ -877,6 +953,22 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "crossterm"
+version = "0.28.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "829d955a0bb380ef178a640b91779e3987da38c9aea133b20614cfed8cdea9c6"
+dependencies = [
+ "bitflags 2.11.1",
+ "crossterm_winapi",
+ "mio 1.2.0",
+ "parking_lot 0.12.5",
+ "rustix 0.38.44",
+ "signal-hook",
+ "signal-hook-mio",
+ "winapi",
+]
+
 [[package]]
 name = "crossterm"
 version = "0.29.0"
@@ -887,7 +979,7 @@ dependencies = [
  "crossterm_winapi",
  "document-features",
  "parking_lot 0.12.5",
- "rustix",
+ "rustix 1.1.4",
  "winapi",
 ]
 
@@ -926,6 +1018,40 @@ dependencies = [
  "cipher",
 ]
 
+[[package]]
+name = "darling"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25ae13da2f202d56bd7f91c25fba009e7717a1e4a1cc98a76d844b65ae912e9d"
+dependencies = [
+ "darling_core",
+ "darling_macro",
+]
+
+[[package]]
+name = "darling_core"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9865a50f7c335f53564bb694ef660825eb8610e0a53d3e11bf1b0d3df31e03b0"
+dependencies = [
+ "ident_case",
+ "proc-macro2",
+ "quote",
+ "strsim",
+ "syn 2.0.117",
+]
+
+[[package]]
+name = "darling_macro"
+version = "0.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ac3984ec7bd6cfa798e62b4a642426a5be0e68f9401cfc2a01e3fa9ea2fcdb8d"
+dependencies = [
+ "darling_core",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "dashmap"
 version = "5.5.3"
@@ -945,6 +1071,17 @@ version = "2.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"
 
+[[package]]
+name = "der"
+version = "0.7.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
+dependencies = [
+ "const-oid",
+ "pem-rfc7468",
+ "zeroize",
+]
+
 [[package]]
 name = "deranged"
 version = "0.5.8"
@@ -972,7 +1109,9 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer",
+ "const-oid",
  "crypto-common",
+ "subtle",
 ]
 
 [[package]]
@@ -995,6 +1134,12 @@ dependencies = [
  "litrs",
 ]
 
+[[package]]
+name = "dotenvy"
+version = "0.15.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1aaf95b3e5c8f23aa320147307562d361db0ae0d51242340f558153b4eb2439b"
+
 [[package]]
 name = "duckdb"
 version = "1.10501.0"
@@ -1029,6 +1174,9 @@ name = "either"
 version = "1.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "enum_dispatch"
@@ -1078,12 +1226,34 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "etcetera"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "136d1b5283a1ab77bd9257427ffd09d8667ced0570b6f938942bc7568ed5b943"
+dependencies = [
+ "cfg-if",
+ "home",
+ "windows-sys 0.48.0",
+]
+
 [[package]]
 name = "ethnum"
 version = "1.5.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40404c3f5f511ec4da6fe866ddf6a717c309fdbb69fbbad7b0f3edab8f2e835f"
 
+[[package]]
+name = "event-listener"
+version = "5.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e13b66accf52311f30a0db42147dadea9850cb48cd070028831ae5f5d4b856ab"
+dependencies = [
+ "concurrent-queue",
+ "parking",
+ "pin-project-lite",
+]
+
 [[package]]
 name = "fallible-iterator"
 version = "0.3.0"
@@ -1102,6 +1272,18 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "95765f67b4b18863968b4a1bd5bb576f732b29a4a28c7cd84c09fa3e2875f33c"
 
+[[package]]
+name = "fastbloom"
+version = "0.14.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7f34442dbe69c60fe8eaf58a8cafff81a1f278816d8ab4db255b3bef4ac3c4"
+dependencies = [
+ "getrandom 0.3.4",
+ "libm",
+ "rand 0.9.4",
+ "siphasher",
+]
+
 [[package]]
 name = "filetime"
 version = "0.2.28"
@@ -1129,6 +1311,17 @@ dependencies = [
  "zlib-rs",
 ]
 
+[[package]]
+name = "flume"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da0e4dd2a88388a1f4ccc7c9ce104604dab68d9f408dc34cd45823d5a9069095"
+dependencies = [
+ "futures-core",
+ "futures-sink",
+ "spin 0.9.8",
+]
+
 [[package]]
 name = "foca"
 version = "0.11.0"
@@ -1161,6 +1354,12 @@ dependencies = [
  "percent-encoding",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -1209,6 +1408,17 @@ dependencies = [
  "futures-util",
 ]
 
+[[package]]
+name = "futures-intrusive"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1d930c203dd0b6ff06e0201a4a2fe9149b43c684fd4420555b26d21b1a02956f"
+dependencies = [
+ "futures-core",
+ "lock_api",
+ "parking_lot 0.12.5",
+]
+
 [[package]]
 name = "futures-io"
 version = "0.3.32"
@@ -1398,6 +1608,24 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
+[[package]]
+name = "hkdf"
+version = "0.12.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
+dependencies = [
+ "hmac",
+]
+
+[[package]]
+name = "hmac"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
+dependencies = [
+ "digest",
+]
+
 [[package]]
 name = "home"
 version = "0.5.12"
@@ -1482,11 +1710,11 @@ dependencies = [
  "http",
  "hyper",
  "hyper-util",
- "rustls 0.23.40",
+ "rustls",
  "tokio",
  "tokio-rustls",
  "tower-service",
- "webpki-roots",
+ "webpki-roots 1.0.7",
 ]
 
 [[package]]
@@ -1624,6 +1852,12 @@ version = "2.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3d3067d79b975e8844ca9eb072e16b31c3c1c36928edf9c6789548c524d0d954"
 
+[[package]]
+name = "ident_case"
+version = "1.0.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b9e0384b61958566e926dc50660321d12159025e767c18e043daf26b70104c39"
+
 [[package]]
 name = "idna"
 version = "1.1.0"
@@ -1657,6 +1891,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "indoc"
+version = "2.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "79cf5c93f93228cf8efb3ba362535fb11199ac548a09ce117c9b1adc3030d706"
+dependencies = [
+ "rustversion",
+]
+
 [[package]]
 name = "inout"
 version = "0.1.4"
@@ -1666,6 +1909,19 @@ dependencies = [
  "generic-array",
 ]
 
+[[package]]
+name = "instability"
+version = "0.3.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5eb2d60ef19920a3a9193c3e371f726ec1dafc045dac788d0fb3704272458971"
+dependencies = [
+ "darling",
+ "indoc",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "instant"
 version = "0.1.13"
@@ -1681,15 +1937,6 @@ version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
-[[package]]
-name = "itertools"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba291022dbbd398a455acf126c1e341954079855bc60dfdda641363bd6922569"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itertools"
 version = "0.13.0"
@@ -1711,6 +1958,50 @@ version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9028f49264629065d057f340a86acb84867925865f73bbf8d47b4d149a7e88b8"
 
+[[package]]
+name = "jni"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a87aa2bb7d2af34197c04845522473242e1aa17c12f4935d5856491a7fb8c97"
+dependencies = [
+ "cesu8",
+ "cfg-if",
+ "combine",
+ "jni-sys 0.3.1",
+ "log",
+ "thiserror 1.0.69",
+ "walkdir",
+ "windows-sys 0.45.0",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41a652e1f9b6e0275df1f15b32661cf0d4b78d4d87ddec5e0c3c20f097433258"
+dependencies = [
+ "jni-sys 0.4.1",
+]
+
+[[package]]
+name = "jni-sys"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c6377a88cb3910bee9b0fa88d4f42e1d2da8e79915598f65fb0c7ee14c878af2"
+dependencies = [
+ "jni-sys-macros",
+]
+
+[[package]]
+name = "jni-sys-macros"
+version = "0.4.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "38c0b942f458fe50cdac086d2f946512305e5631e720728f2a61aabcd47a6264"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "jobserver"
 version = "0.1.34"
@@ -1738,6 +2029,9 @@ name = "lazy_static"
 version = "1.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bbd2bcb4c963f2ddae06a2efc7e9f3591312473c50c6685e1f298068316e66fe"
+dependencies = [
+ "spin 0.9.8",
+]
 
 [[package]]
 name = "leb128fmt"
@@ -1831,6 +2125,34 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "libredox"
+version = "0.1.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f02ab6bace2054fb888a3c16f990117b579d14a3088e472d63c6011fa185c9d3"
+dependencies = [
+ "bitflags 2.11.1",
+ "libc",
+ "plain",
+ "redox_syscall 0.8.0",
+]
+
+[[package]]
+name = "libsqlite3-sys"
+version = "0.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2e99fb7a497b1e3339bc746195567ed8d3e24945ecd636e3619d20b9de9e9149"
+dependencies = [
+ "pkg-config",
+ "vcpkg",
+]
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.4.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d26c52dbd32dccf2d10cac7725f8eae5296885fb5703b261f7d0a0739ec807ab"
+
 [[package]]
 name = "linux-raw-sys"
 version = "0.12.1"
@@ -1907,6 +2229,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "matchers"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d1525a2a28c7f4fa0fc98bb91ae755d1e2d1505079e05539e35bc876b5d65ae9"
+dependencies = [
+ "regex-automata",
+]
+
 [[package]]
 name = "matchit"
 version = "0.7.3"
@@ -1991,6 +2322,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "50b7e5b27aa02a74bac8c3f23f448f8d87ff11f92d3aac1a6ed369ee08cc56c1"
 dependencies = [
  "libc",
+ "log",
  "wasi",
  "windows-sys 0.61.2",
 ]
@@ -2094,6 +2426,22 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "num-bigint-dig"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e661dda6640fad38e827a6d4a310ff4763082116fe217f279885c97f511bb0b7"
+dependencies = [
+ "lazy_static",
+ "libm",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "rand 0.8.6",
+ "smallvec",
+ "zeroize",
+]
+
 [[package]]
 name = "num-complex"
 version = "0.4.6"
@@ -2166,9 +2514,15 @@ checksum = "c08d65885ee38876c4f86fa503fb49d7b507c2b62552df7c70b2fce627e06381"
 
 [[package]]
 name = "openssl-probe"
-version = "0.1.6"
+version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
+checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
+
+[[package]]
+name = "parking"
+version = "2.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f38d5652c16fde515bb1ecef450ab0f6a219d619a7274976324d5e377f7dceba"
 
 [[package]]
 name = "parking_lot"
@@ -2253,6 +2607,15 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "pem-rfc7468"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "88b39c9bfcfc231068454382784bb460aae594343fb030d46e9f50a645418412"
+dependencies = [
+ "base64ct",
+]
+
 [[package]]
 name = "percent-encoding"
 version = "2.3.2"
@@ -2309,12 +2672,39 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
+[[package]]
+name = "pkcs1"
+version = "0.7.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
+dependencies = [
+ "der",
+ "pkcs8",
+ "spki",
+]
+
+[[package]]
+name = "pkcs8"
+version = "0.10.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
+dependencies = [
+ "der",
+ "spki",
+]
+
 [[package]]
 name = "pkg-config"
 version = "0.3.33"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e"
 
+[[package]]
+name = "plain"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b4596b6d070b27117e987119b4dac604f3c58cfb0b191112e24771b2faeac1a6"
+
 [[package]]
 name = "planus"
 version = "0.3.1"
@@ -2690,7 +3080,7 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8159bd90725d2df49889a078b54f4f79e87f1f8a8444194cdca81d38f5393abf"
 dependencies = [
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -2702,7 +3092,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9d1fe60d06143b2430aa532c94cfe9e29783047f06c0d7fd359a9a51b729fa25"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "opaque-debug",
  "universal-hash",
 ]
@@ -2821,23 +3211,6 @@ dependencies = [
  "rand 0.10.1",
 ]
 
-[[package]]
-name = "quinn"
-version = "0.10.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cc2c5017e4b43d5995dcea317bc46c1e09404c0a9664d2908f7f02dfe943d75"
-dependencies = [
- "bytes",
- "pin-project-lite",
- "quinn-proto 0.10.6",
- "quinn-udp 0.4.1",
- "rustc-hash 1.1.0",
- "rustls 0.21.12",
- "thiserror 1.0.69",
- "tokio",
- "tracing",
-]
-
 [[package]]
 name = "quinn"
 version = "0.11.9"
@@ -2847,10 +3220,10 @@ dependencies = [
  "bytes",
  "cfg_aliases",
  "pin-project-lite",
- "quinn-proto 0.11.14",
- "quinn-udp 0.5.14",
- "rustc-hash 2.1.2",
- "rustls 0.23.40",
+ "quinn-proto",
+ "quinn-udp",
+ "rustc-hash",
+ "rustls",
  "socket2 0.6.3",
  "thiserror 2.0.18",
  "tokio",
@@ -2858,24 +3231,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "quinn-proto"
-version = "0.10.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "141bf7dfde2fbc246bfd3fe12f2455aa24b0fbd9af535d8c86c7bd1381ff2b1a"
-dependencies = [
- "bytes",
- "rand 0.8.6",
- "ring 0.16.20",
- "rustc-hash 1.1.0",
- "rustls 0.21.12",
- "rustls-native-certs",
- "slab",
- "thiserror 1.0.69",
- "tinyvec",
- "tracing",
-]
-
 [[package]]
 name = "quinn-proto"
 version = "0.11.14"
@@ -2883,13 +3238,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
  "bytes",
+ "fastbloom",
  "getrandom 0.3.4",
  "lru-slab",
  "rand 0.9.4",
  "ring 0.17.14",
- "rustc-hash 2.1.2",
- "rustls 0.23.40",
+ "rustc-hash",
+ "rustls",
  "rustls-pki-types",
+ "rustls-platform-verifier",
  "slab",
  "thiserror 2.0.18",
  "tinyvec",
@@ -2897,19 +3254,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "quinn-udp"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "055b4e778e8feb9f93c4e439f71dc2156ef13360b432b799e179a8c4cdf0b1d7"
-dependencies = [
- "bytes",
- "libc",
- "socket2 0.5.10",
- "tracing",
- "windows-sys 0.48.0",
-]
-
 [[package]]
 name = "quinn-udp"
 version = "0.5.14"
@@ -2978,6 +3322,7 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d2e8e8bcc7961af1fdac401278c6a831614941f6164ee3bf4ce61b7edb162207"
 dependencies = [
+ "chacha20 0.10.0",
  "getrandom 0.4.2",
  "rand_core 0.10.1",
 ]
@@ -3038,22 +3383,23 @@ dependencies = [
 
 [[package]]
 name = "ratatui"
-version = "0.26.3"
+version = "0.29.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f44c9e68fd46eda15c646fbb85e1040b657a58cdc8c98db1d97a55930d991eef"
+checksum = "eabd94c2f37801c20583fc49dd5cd6b0ba68c716787c2dd6ed18571e1e63117b"
 dependencies = [
  "bitflags 2.11.1",
  "cassowary",
  "compact_str",
- "crossterm 0.27.0",
- "itertools 0.12.1",
+ "crossterm 0.28.1",
+ "indoc",
+ "instability",
+ "itertools",
  "lru 0.12.5",
  "paste",
- "stability",
  "strum 0.26.3",
  "unicode-segmentation",
  "unicode-truncate",
- "unicode-width 0.1.14",
+ "unicode-width 0.2.0",
 ]
 
 [[package]]
@@ -3087,12 +3433,13 @@ dependencies = [
 
 [[package]]
 name = "rcgen"
-version = "0.11.3"
+version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52c4f3084aa3bc7dfbba4eff4fab2a54db4324965d8872ab933565e6fbd83bc6"
+checksum = "75e669e5202259b5314d1ea5397316ad400819437857b90861765f24c4cf80a2"
 dependencies = [
  "pem",
- "ring 0.16.20",
+ "ring 0.17.14",
+ "rustls-pki-types",
  "time",
  "yasna",
 ]
@@ -3136,6 +3483,15 @@ dependencies = [
  "bitflags 2.11.1",
 ]
 
+[[package]]
+name = "redox_syscall"
+version = "0.8.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7c7591fa2c6b601dfcfe5f043f65a1c39fcdf50efefcd7f1572e538c1f4b398d"
+dependencies = [
+ "bitflags 2.11.1",
+]
+
 [[package]]
 name = "reed-solomon-erasure"
 version = "6.0.0"
@@ -3208,8 +3564,8 @@ dependencies = [
  "log",
  "percent-encoding",
  "pin-project-lite",
- "quinn 0.11.9",
- "rustls 0.23.40",
+ "quinn",
+ "rustls",
  "rustls-pki-types",
  "serde",
  "serde_json",
@@ -3224,7 +3580,7 @@ dependencies = [
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
- "webpki-roots",
+ "webpki-roots 1.0.7",
 ]
 
 [[package]]
@@ -3285,6 +3641,26 @@ dependencies = [
  "syn 1.0.109",
 ]
 
+[[package]]
+name = "rsa"
+version = "0.9.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8573f03f5883dcaebdfcf4725caa1ecb9c15b2ef50c43a07b816e06799bb12d"
+dependencies = [
+ "const-oid",
+ "digest",
+ "num-bigint-dig",
+ "num-integer",
+ "num-traits",
+ "pkcs1",
+ "pkcs8",
+ "rand_core 0.6.4",
+ "signature",
+ "spki",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rust_decimal"
 version = "1.42.0"
@@ -3302,18 +3678,25 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "rustc-hash"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "08d43f7aa6b08d49f382cde6a7982047c3426db949b1424bc4b7ec9ae12c6ce2"
-
 [[package]]
 name = "rustc-hash"
 version = "2.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94300abf3f1ae2e2b8ffb7b58043de3d399c73fa6f4b73826402a5c457614dbe"
 
+[[package]]
+name = "rustix"
+version = "0.38.44"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fdb5bc1ae2baa591800df16c9ca78619bf65c0488b41b96ccec5d11220d8c154"
+dependencies = [
+ "bitflags 2.11.1",
+ "errno",
+ "libc",
+ "linux-raw-sys 0.4.15",
+ "windows-sys 0.52.0",
+]
+
 [[package]]
 name = "rustix"
 version = "1.1.4"
@@ -3323,57 +3706,38 @@ dependencies = [
  "bitflags 2.11.1",
  "errno",
  "libc",
- "linux-raw-sys",
+ "linux-raw-sys 0.12.1",
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring 0.17.14",
- "rustls-webpki 0.101.7",
- "sct",
-]
-
 [[package]]
 name = "rustls"
 version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
+ "aws-lc-rs",
+ "log",
  "once_cell",
  "ring 0.17.14",
  "rustls-pki-types",
- "rustls-webpki 0.103.13",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
 
 [[package]]
 name = "rustls-native-certs"
-version = "0.6.3"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
+checksum = "612460d5f7bea540c490b2b6395d8e34a953e52b491accd6c86c8164c5932a63"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile 1.0.4",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
 
-[[package]]
-name = "rustls-pemfile"
-version = "1.0.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c74cae0a4cf6ccbbf5f359f08efdf8ee7e1dc532573bf0db71968cb56b1448c"
-dependencies = [
- "base64 0.21.7",
-]
-
 [[package]]
 name = "rustls-pemfile"
 version = "2.2.0"
@@ -3394,21 +3758,39 @@ dependencies = [
 ]
 
 [[package]]
-name = "rustls-webpki"
-version = "0.101.7"
+name = "rustls-platform-verifier"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
+checksum = "1d99feebc72bae7ab76ba994bb5e121b8d83d910ca40b36e0921f53becc41784"
 dependencies = [
- "ring 0.17.14",
- "untrusted 0.9.0",
+ "core-foundation",
+ "core-foundation-sys",
+ "jni",
+ "log",
+ "once_cell",
+ "rustls",
+ "rustls-native-certs",
+ "rustls-platform-verifier-android",
+ "rustls-webpki",
+ "security-framework",
+ "security-framework-sys",
+ "webpki-root-certs",
+ "windows-sys 0.61.2",
 ]
 
+[[package]]
+name = "rustls-platform-verifier-android"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
+ "aws-lc-rs",
  "ring 0.17.14",
  "rustls-pki-types",
  "untrusted 0.9.0",
@@ -3426,6 +3808,15 @@ version = "1.0.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9774ba4a74de5f7b1c1451ed6cd5285a32eddb5cccb8cc655a4e50009e06477f"
 
+[[package]]
+name = "same-file"
+version = "1.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "93fc1dc3aaa9bfed95e02e6eadabb4baf7e3078b0bd1b4d7b6b0b68378900502"
+dependencies = [
+ "winapi-util",
+]
+
 [[package]]
 name = "schannel"
 version = "0.1.29"
@@ -3441,16 +3832,6 @@ version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
-[[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring 0.17.14",
- "untrusted 0.9.0",
-]
-
 [[package]]
 name = "seahash"
 version = "4.1.0"
@@ -3459,9 +3840,9 @@ checksum = "1c107b6f4780854c8b126e228ea8869f4d7b71260f962fefb57b996b8959ba6b"
 
 [[package]]
 name = "security-framework"
-version = "2.11.1"
+version = "3.7.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "897b2245f0b511c87893af39b033e5ca9cce68824c4d7e7630b5a1d339658d02"
+checksum = "b7f4bc775c73d9a02cde8bf7b2ec4c9d12743edf609006c7facc23998404cd1d"
 dependencies = [
  "bitflags 2.11.1",
  "core-foundation",
@@ -3565,7 +3946,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e3bf829a2d51ab4a5ddf1352d8470c140cadc8301b2ae1789db023f01cedd6ba"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
@@ -3582,7 +3963,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a7507d819769d01a365ab707794a4084392c824f54a7a6a7862f8c3d0892b283"
 dependencies = [
  "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.2.17",
  "digest",
 ]
 
@@ -3619,6 +4000,7 @@ checksum = "b75a19a7a740b25bc7944bdee6172368f988763b744e3d4dfe753f6b4ece40cc"
 dependencies = [
  "libc",
  "mio 0.8.11",
+ "mio 1.2.0",
  "signal-hook",
 ]
 
@@ -3632,6 +4014,16 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "signature"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
+dependencies = [
+ "digest",
+ "rand_core 0.6.4",
+]
+
 [[package]]
 name = "simd-adler32"
 version = "0.3.9"
@@ -3661,6 +4053,9 @@ name = "smallvec"
 version = "1.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+dependencies = [
+ "serde",
+]
 
 [[package]]
 name = "smartstring"
@@ -3689,16 +4084,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -3720,6 +4105,19 @@ name = "spin"
 version = "0.9.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6980e8d7511241f8acf4aebddbb1ff938df5eebe98691418c4468d0b72a96a67"
+dependencies = [
+ "lock_api",
+]
+
+[[package]]
+name = "spki"
+version = "0.7.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
+dependencies = [
+ "base64ct",
+ "der",
+]
 
 [[package]]
 name = "sqlparser"
@@ -3731,15 +4129,203 @@ dependencies = [
 ]
 
 [[package]]
-name = "stability"
-version = "0.2.1"
+name = "sqlx"
+version = "0.8.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d904e7009df136af5297832a3ace3370cd14ff1546a232f4f185036c2736fcac"
+checksum = "1fefb893899429669dcdd979aff487bd78f4064e5e7907e4269081e0ef7d97dc"
 dependencies = [
+ "sqlx-core",
+ "sqlx-macros",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+]
+
+[[package]]
+name = "sqlx-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ee6798b1838b6a0f69c007c133b8df5866302197e404e8b6ee8ed3e3a5e68dc6"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "chrono",
+ "crc",
+ "crossbeam-queue",
+ "either",
+ "event-listener",
+ "futures-core",
+ "futures-intrusive",
+ "futures-io",
+ "futures-util",
+ "hashbrown 0.15.5",
+ "hashlink",
+ "indexmap",
+ "log",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rustls",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "thiserror 2.0.18",
+ "tokio",
+ "tokio-stream",
+ "tracing",
+ "url",
+ "uuid",
+ "webpki-roots 0.26.11",
+]
+
+[[package]]
+name = "sqlx-macros"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a2d452988ccaacfbf5e0bdbc348fb91d7c8af5bee192173ac3636b5fb6e6715d"
+dependencies = [
+ "proc-macro2",
  "quote",
+ "sqlx-core",
+ "sqlx-macros-core",
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "sqlx-macros-core"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "19a9c1841124ac5a61741f96e1d9e2ec77424bf323962dd894bdb93f37d5219b"
+dependencies = [
+ "dotenvy",
+ "either",
+ "heck 0.5.0",
+ "hex",
+ "once_cell",
+ "proc-macro2",
+ "quote",
+ "serde",
+ "serde_json",
+ "sha2",
+ "sqlx-core",
+ "sqlx-mysql",
+ "sqlx-postgres",
+ "sqlx-sqlite",
+ "syn 2.0.117",
+ "tokio",
+ "url",
+]
+
+[[package]]
+name = "sqlx-mysql"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aa003f0038df784eb8fecbbac13affe3da23b45194bd57dba231c8f48199c526"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags 2.11.1",
+ "byteorder",
+ "bytes",
+ "chrono",
+ "crc",
+ "digest",
+ "dotenvy",
+ "either",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-util",
+ "generic-array",
+ "hex",
+ "hkdf",
+ "hmac",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "percent-encoding",
+ "rand 0.8.6",
+ "rsa",
+ "serde",
+ "sha1",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-postgres"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "db58fcd5a53cf07c184b154801ff91347e4c30d17a3562a635ff028ad5deda46"
+dependencies = [
+ "atoi",
+ "base64 0.22.1",
+ "bitflags 2.11.1",
+ "byteorder",
+ "chrono",
+ "crc",
+ "dotenvy",
+ "etcetera",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "hex",
+ "hkdf",
+ "hmac",
+ "home",
+ "itoa",
+ "log",
+ "md-5",
+ "memchr",
+ "once_cell",
+ "rand 0.8.6",
+ "serde",
+ "serde_json",
+ "sha2",
+ "smallvec",
+ "sqlx-core",
+ "stringprep",
+ "thiserror 2.0.18",
+ "tracing",
+ "uuid",
+ "whoami",
+]
+
+[[package]]
+name = "sqlx-sqlite"
+version = "0.8.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2d12fe70b2c1b4401038055f90f151b78208de1f9f89a7dbfd41587a10c3eea"
+dependencies = [
+ "atoi",
+ "chrono",
+ "flume",
+ "futures-channel",
+ "futures-core",
+ "futures-executor",
+ "futures-intrusive",
+ "futures-util",
+ "libsqlite3-sys",
+ "log",
+ "percent-encoding",
+ "serde",
+ "serde_urlencoded",
+ "sqlx-core",
+ "thiserror 2.0.18",
+ "tracing",
+ "url",
+ "uuid",
+]
+
 [[package]]
 name = "stable_deref_trait"
 version = "1.2.1"
@@ -3773,6 +4359,23 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe895eb47f22e2ddd4dabc02bce419d2e643c8e3b585c78158b349195bc24d82"
 
+[[package]]
+name = "stringprep"
+version = "0.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7b4df3d392d81bd458a8a621b8bffbd2302a12ffe288a9d931670948749463b1"
+dependencies = [
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-properties",
+]
+
+[[package]]
+name = "strsim"
+version = "0.11.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
+
 [[package]]
 name = "strum"
 version = "0.26.3"
@@ -4088,7 +4691,18 @@ version = "0.26.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1729aa945f29d91ba541258c8df89027d5792d85a8841fb65e8bf0f4ede4ef61"
 dependencies = [
- "rustls 0.23.40",
+ "rustls",
+ "tokio",
+]
+
+[[package]]
+name = "tokio-stream"
+version = "0.1.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32da49809aab5c3bc678af03902d4ccddea2a87d028d86392a4b1560c6906c70"
+dependencies = [
+ "futures-core",
+ "pin-project-lite",
  "tokio",
 ]
 
@@ -4177,6 +4791,7 @@ dependencies = [
  "pin-project-lite",
  "tower-layer",
  "tower-service",
+ "tracing",
 ]
 
 [[package]]
@@ -4259,10 +4874,14 @@ version = "0.3.23"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb7f578e5945fb242538965c2d0b04418d38ec25c79d160cd279bf0731c8d319"
 dependencies = [
+ "matchers",
  "nu-ansi-term",
+ "once_cell",
+ "regex-automata",
  "sharded-slab",
  "smallvec",
  "thread_local",
+ "tracing",
  "tracing-core",
  "tracing-log",
 ]
@@ -4317,12 +4936,33 @@ version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40ce102ab67701b8526c123c1bab5cbe42d7040ccfd0f64af1a385808d2f43de"
 
+[[package]]
+name = "unicode-bidi"
+version = "0.3.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5c1cb5db39152898a79168971543b1cb5020dff7fe43c8dc468b0885f5e29df5"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
 
+[[package]]
+name = "unicode-normalization"
+version = "0.1.25"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5fd4f6878c9cb28d874b009da9e8d183b5abc80117c40bbd187a1fde336be6e8"
+dependencies = [
+ "tinyvec",
+]
+
+[[package]]
+name = "unicode-properties"
+version = "0.1.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7df058c713841ad818f1dc5d3fd88063241cc61f49f5fbea4b951e8cf5a8d71d"
+
 [[package]]
 name = "unicode-reverse"
 version = "1.0.9"
@@ -4344,7 +4984,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3644627a5af5fa321c95b9b235a72fd24cd29c648c2c379431e6628655627bf"
 dependencies = [
- "itertools 0.13.0",
+ "itertools",
  "unicode-segmentation",
  "unicode-width 0.1.14",
 ]
@@ -4357,9 +4997,9 @@ checksum = "7dd6e30e90baa6f72411720665d41d89b9a3d039dc45b8faea1ddd07f617f6af"
 
 [[package]]
 name = "unicode-width"
-version = "0.2.2"
+version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
+checksum = "1fc81956842c57dac11422a97c3b8195a1ff727f06e85c84ed2e8aa277c9a0fd"
 
 [[package]]
 name = "unicode-xid"
@@ -4415,12 +5055,13 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.23.1"
+version = "1.23.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ddd74a9687298c6858e9b88ec8935ec45d22e8fd5e6394fa1bd4e99a87789c76"
+checksum = "d258b83ceec21034727ecee8c382cfa6c3e133699b0742c64571814fb420c9f7"
 dependencies = [
  "getrandom 0.4.2",
  "js-sys",
+ "serde_core",
  "wasm-bindgen",
 ]
 
@@ -4442,6 +5083,16 @@ version = "0.9.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b928f33d975fc6ad9f86c8f283853ad26bdd5b10b7f1542aa2fa15e2289105a"
 
+[[package]]
+name = "walkdir"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29790946404f91d9c5d06f9874efddea1dc06c5efe94541a7d6863108e3a5e4b"
+dependencies = [
+ "same-file",
+ "winapi-util",
+]
+
 [[package]]
 name = "want"
 version = "0.3.1"
@@ -4475,6 +5126,12 @@ dependencies = [
  "wit-bindgen 0.51.0",
 ]
 
+[[package]]
+name = "wasite"
+version = "0.1.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
+
 [[package]]
 name = "wasm-bindgen"
 version = "0.2.121"
@@ -4585,6 +5242,24 @@ dependencies = [
  "wasm-bindgen",
 ]
 
+[[package]]
+name = "webpki-root-certs"
+version = "1.0.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f31141ce3fc3e300ae89b78c0dd67f9708061d1d2eda54b8209346fd6be9a92c"
+dependencies = [
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "webpki-roots"
+version = "0.26.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
+dependencies = [
+ "webpki-roots 1.0.7",
+]
+
 [[package]]
 name = "webpki-roots"
 version = "1.0.7"
@@ -4635,6 +5310,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "whoami"
+version = "1.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5d4a4db5077702ca3015d3d02d74974948aba2ad9e12ab7df718ee64ccd7e97d"
+dependencies = [
+ "libredox",
+ "wasite",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -4651,6 +5336,15 @@ version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ac3b87c63620426dd9b991e5ce0329eff545bccbbb34f3be09ff6fb6ab51b7b6"
 
+[[package]]
+name = "winapi-util"
+version = "0.1.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
+dependencies = [
+ "windows-sys 0.61.2",
+]
+
 [[package]]
 name = "winapi-x86_64-pc-windows-gnu"
 version = "0.4.0"
@@ -4735,6 +5429,15 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-sys"
+version = "0.45.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "75283be5efb2831d37ea142365f009c02ec203cd29a3ebecbc093d52315b66d0"
+dependencies = [
+ "windows-targets 0.42.2",
+]
+
 [[package]]
 name = "windows-sys"
 version = "0.48.0"
@@ -4771,6 +5474,21 @@ dependencies = [
  "windows-link",
 ]
 
+[[package]]
+name = "windows-targets"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8e5180c00cd44c9b1c88adb3693291f1cd93605ded80c250a75d472756b4d071"
+dependencies = [
+ "windows_aarch64_gnullvm 0.42.2",
+ "windows_aarch64_msvc 0.42.2",
+ "windows_i686_gnu 0.42.2",
+ "windows_i686_msvc 0.42.2",
+ "windows_x86_64_gnu 0.42.2",
+ "windows_x86_64_gnullvm 0.42.2",
+ "windows_x86_64_msvc 0.42.2",
+]
+
 [[package]]
 name = "windows-targets"
 version = "0.48.5"
@@ -4819,6 +5537,12 @@ dependencies = [
  "windows_x86_64_msvc 0.53.1",
 ]
 
+[[package]]
+name = "windows_aarch64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "597a5118570b68bc08d8d59125332c54f1ba9d9adeedeef5b99b02ba2b0698f8"
+
 [[package]]
 name = "windows_aarch64_gnullvm"
 version = "0.48.5"
@@ -4837,6 +5561,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9d8416fa8b42f5c947f8482c43e7d89e73a173cead56d044f6a56104a6d1b53"
 
+[[package]]
+name = "windows_aarch64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e08e8864a60f06ef0d0ff4ba04124db8b0fb3be5776a5cd47641e942e58c4d43"
+
 [[package]]
 name = "windows_aarch64_msvc"
 version = "0.48.5"
@@ -4855,6 +5585,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b9d782e804c2f632e395708e99a94275910eb9100b2114651e04744e9b125006"
 
+[[package]]
+name = "windows_i686_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c61d927d8da41da96a81f029489353e68739737d3beca43145c8afec9a31a84f"
+
 [[package]]
 name = "windows_i686_gnu"
 version = "0.48.5"
@@ -4885,6 +5621,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fa7359d10048f68ab8b09fa71c3daccfb0e9b559aed648a8f95469c27057180c"
 
+[[package]]
+name = "windows_i686_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44d840b6ec649f480a41c8d80f9c65108b92d89345dd94027bfe06ac444d1060"
+
 [[package]]
 name = "windows_i686_msvc"
 version = "0.48.5"
@@ -4903,6 +5645,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1e7ac75179f18232fe9c285163565a57ef8d3c89254a30685b57d83a38d326c2"
 
+[[package]]
+name = "windows_x86_64_gnu"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8de912b8b8feb55c064867cf047dda097f92d51efad5b491dfb98f6bbb70cb36"
+
 [[package]]
 name = "windows_x86_64_gnu"
 version = "0.48.5"
@@ -4921,6 +5669,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9c3842cdd74a865a8066ab39c8a7a473c0778a3f29370b5fd6b4b9aa7df4a499"
 
+[[package]]
+name = "windows_x86_64_gnullvm"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "26d41b46a36d453748aedef1486d5c7a85db22e56aff34643984ea85514e94a3"
+
 [[package]]
 name = "windows_x86_64_gnullvm"
 version = "0.48.5"
@@ -4939,6 +5693,12 @@ version = "0.53.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0ffa179e2d07eee8ad8f57493436566c7cc30ac536a3379fdf008f47f6bb7ae1"
 
+[[package]]
+name = "windows_x86_64_msvc"
+version = "0.42.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9aec5da331524158c6d1a4ac0ab1541149c0b9505fde06423b02f5ef0106b9f0"
+
 [[package]]
 name = "windows_x86_64_msvc"
 version = "0.48.5"
@@ -5082,7 +5842,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32e45ad4206f6d2479085147f02bc2ef834ac85886624a23575ae137c8aa8156"
 dependencies = [
  "libc",
- "rustix",
+ "rustix 1.1.4",
 ]
 
 [[package]]
@@ -5316,11 +6076,32 @@ dependencies = [
 name = "xcu-core"
 version = "0.1.0"
 dependencies = [
+ "axum",
+ "chrono",
+ "rand 0.10.1",
  "serde",
  "serde_json",
+ "sqlx",
  "tokio",
+ "tower-http 0.5.2",
  "tracing",
  "tracing-subscriber",
+ "uuid",
+ "xcu-api-gateway",
+ "xcu-billing-matrix",
+ "xcu-command-center",
+ "xcu-config-vault",
+ "xcu-crypto",
+ "xcu-ebpf",
+ "xcu-ebpf-loader",
+ "xcu-iam-gatekeeper",
+ "xcu-load-balancer",
+ "xcu-omega",
+ "xcu-ouroboros",
+ "xcu-rate-limiter",
+ "xcu-rpc",
+ "xcu-sentinel",
+ "xcu-telemetry-core",
 ]
 
 [[package]]
@@ -5484,7 +6265,6 @@ name = "xcu-grid"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bincode",
  "bytes",
  "crdts",
  "foca",
@@ -5542,6 +6322,7 @@ name = "xcu-hydra"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "parking_lot 0.12.5",
  "reed-solomon-erasure",
  "tracing",
 ]
@@ -5609,7 +6390,6 @@ name = "xcu-lazarus"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bincode",
  "serde",
  "tokio",
  "tracing",
@@ -5914,15 +6694,17 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "hex",
- "quinn 0.10.2",
+ "quinn",
  "rcgen",
  "rkyv",
- "rustls 0.21.12",
- "rustls-pemfile 2.2.0",
+ "rustls",
+ "rustls-pemfile",
+ "rustls-pki-types",
  "sha2",
  "tokio",
  "tracing",
- "xcu-sfu-a",
+ "tracing-subscriber",
+ "xcu-sfu-b",
 ]
 
 [[package]]
@@ -6171,11 +6953,15 @@ version = "0.1.0"
 dependencies = [
  "base64 0.22.1",
  "getrandom 0.2.17",
+ "hex",
  "js-sys",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
  "xcu-crypto",
+ "xcu-jailbreak-detector",
+ "xcu-tamper-proof",
+ "xcu-watermark",
 ]
 
 [[package]]
diff --git a/xcom-ultra/devops/build-android.sh b/xcom-ultra/devops/build-android.sh
new file mode 100644
index 0000000..3f252a9
--- /dev/null
+++ b/xcom-ultra/devops/build-android.sh
@@ -0,0 +1,23 @@
+#!/bin/bash
+# JUMPA.ID Android Builder
+# Builds signed AAB for Google Play Store
+
+echo "Starting Android Build Pipeline..."
+
+cd ../../../jumpa.id
+
+# Ensure dependencies are installed
+npm install
+
+# Initialize Android project if not done
+if [ ! -d "src-tauri/gen/android" ]; then
+    echo "Initializing Android environment..."
+    npm run tauri android init
+fi
+
+# Build Android App Bundle (Release)
+echo "Building Android AAB..."
+npm run tauri android build -- --target aarch64-linux-android --release
+
+echo "Android build completed."
+echo "Note: Before uploading to Google Play, ensure you have signed the AAB using jarsigner and your production keystore."
diff --git a/xcom-ultra/devops/build-desktop.sh b/xcom-ultra/devops/build-desktop.sh
new file mode 100644
index 0000000..212a899
--- /dev/null
+++ b/xcom-ultra/devops/build-desktop.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+# JUMPA.ID Desktop Builder
+# Builds MSI, DMG, and DEB packages using Tauri
+
+echo "Starting Desktop Build Pipeline..."
+
+cd ../../../jumpa.id
+
+# Install frontend dependencies
+npm install
+
+# Build frontend
+npm run build
+
+# Build Windows (.msi)
+echo "Building Windows App..."
+npm run tauri build -- --target x86_64-pc-windows-msvc
+
+# Build Linux (.deb)
+echo "Building Linux App..."
+npm run tauri build -- --target x86_64-unknown-linux-gnu
+
+# Build macOS (.dmg)
+echo "Building macOS App..."
+echo "Note: macOS build requires running on a Mac machine or MacStadium instance."
+npm run tauri build -- --target universal-apple-darwin
+
+echo "Desktop builds completed. Check src-tauri/target/release/bundle/"
diff --git a/xcom-ultra/devops/phantom_webhook.py b/xcom-ultra/devops/phantom_webhook.py
new file mode 100644
index 0000000..d425322
--- /dev/null
+++ b/xcom-ultra/devops/phantom_webhook.py
@@ -0,0 +1,33 @@
+from flask import Flask, request, jsonify
+import subprocess
+import os
+
+app = Flask(__name__)
+
+# Secret token for Gitea Webhook validation
+WEBHOOK_SECRET = os.environ.get("PHANTOM_SECRET", "super-secret-phantom-token")
+
+@app.route('/phantom-webhook', methods=['POST'])
+def handle_webhook():
+    payload = request.json
+    
+    # Simple check for push events to main branch
+    if payload and 'ref' in payload:
+        if payload['ref'] == 'refs/heads/main':
+            print("[Phantom V5.2] Detected push to main branch! Initiating CI/CD...")
+            
+            # Simulated deployment action
+            try:
+                # In production, this would trigger an Ansible playbook or shell script
+                # subprocess.run(["ansible-playbook", "-i", "inventory", "deploy.yml"], check=True)
+                print("[Phantom V5.2] CI/CD Pipeline executed successfully across XCU nodes.")
+                return jsonify({"status": "success", "message": "Deployed to XCU cluster"}), 200
+            except Exception as e:
+                print(f"[Phantom V5.2] CI/CD Pipeline failed: {e}")
+                return jsonify({"status": "error", "message": str(e)}), 500
+                
+    return jsonify({"status": "ignored", "message": "Not a main branch push"}), 200
+
+if __name__ == '__main__':
+    # Listen on port 9099 as per architecture
+    app.run(host='0.0.0.0', port=9099)
diff --git a/xcom-ultra/xcu-core/Cargo.toml b/xcom-ultra/xcu-core/Cargo.toml
index d468807..494eaa5 100644
--- a/xcom-ultra/xcu-core/Cargo.toml
+++ b/xcom-ultra/xcu-core/Cargo.toml
@@ -11,4 +11,25 @@ serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 tokio = { version = "1", features = ["full"] }
 tracing = "0.1"
-tracing-subscriber = "0.3"
+tracing-subscriber = { version = "0.3", features = ["env-filter", "fmt"] }
+axum = "0.7"
+tower-http = { version = "0.5", features = ["cors", "trace"] }
+xcu-rpc = { path = "../xcu-rpc" }
+xcu-crypto = { path = "../xcu-crypto" }
+xcu-ouroboros = { path = "../xcu-ouroboros" }
+xcu-sentinel = { path = "../xcu-sentinel" }
+xcu-rate-limiter = { path = "../xcu-rate-limiter" }
+xcu-load-balancer = { path = "../xcu-load-balancer" }
+xcu-telemetry-core = { path = "../xcu-telemetry-core" }
+xcu-config-vault = { path = "../xcu-config-vault" }
+xcu-billing-matrix = { path = "../xcu-billing-matrix" }
+xcu-iam-gatekeeper = { path = "../xcu-iam-gatekeeper" }
+xcu-api-gateway = { path = "../xcu-api-gateway" }
+xcu-command-center = { path = "../xcu-command-center" }
+xcu-ebpf = { path = "../xcu-ebpf" }
+xcu-ebpf-loader = { path = "../xcu-ebpf-loader" }
+xcu-omega = { path = "../xcu-omega" }
+uuid = { version = "1.23.2", features = ["serde", "v4"] }
+chrono = { version = "0.4.44", features = ["serde"] }
+sqlx = { version = "0.8.2", features = ["runtime-tokio-rustls", "postgres", "uuid", "json", "chrono"] }
+rand = "0.10.1"
diff --git a/xcom-ultra/xcu-core/fix.py b/xcom-ultra/xcu-core/fix.py
new file mode 100644
index 0000000..bea1d9b
--- /dev/null
+++ b/xcom-ultra/xcu-core/fix.py
@@ -0,0 +1,7 @@
+import os
+with open('/etc/postgresql/16/main/postgresql.conf', 'r', encoding='utf-8', errors='ignore') as f:
+    lines = f.readlines()
+lines = [l for l in lines if 'listen_addresses' not in l and '\x00' not in l]
+lines.append("listen_addresses = '*'\n")
+with open('/etc/postgresql/16/main/postgresql.conf', 'w', encoding='utf-8') as f:
+    f.writelines(lines)
diff --git a/xcom-ultra/xcu-core/fix_pg.sh b/xcom-ultra/xcu-core/fix_pg.sh
new file mode 100644
index 0000000..7a4db47
Binary files /dev/null and b/xcom-ultra/xcu-core/fix_pg.sh differ
diff --git a/xcom-ultra/xcu-core/src/main.rs b/xcom-ultra/xcu-core/src/main.rs
new file mode 100644
index 0000000..124f451
--- /dev/null
+++ b/xcom-ultra/xcu-core/src/main.rs
@@ -0,0 +1,342 @@
+use axum::{
+    extract::{Path, State},
+    http::{HeaderMap, StatusCode},
+    routing::{get, post},
+    Router,
+    Json,
+};
+use serde::Deserialize;
+use serde_json::{json, Value};
+use sqlx::{postgres::PgPoolOptions, PgPool, Row};
+use std::{net::SocketAddr, sync::Arc};
+use tower_http::{
+    trace::TraceLayer,
+    cors::{Any, CorsLayer},
+};
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+use uuid::Uuid;
+
+#[derive(Clone)]
+struct AppState {
+    db: PgPool,
+}
+
+#[derive(Deserialize)]
+struct CreateRoomRequest {
+    max_participants: Option<i32>,
+    is_recording: Option<bool>,
+    is_e2e_encrypted: Option<bool>,
+}
+
+#[derive(Deserialize)]
+struct JoinRoomRequest {
+    external_user_id: String,
+    display_name: Option<String>,
+    device_type: Option<String>,
+}
+
+async fn extract_client_id(headers: &HeaderMap, db: &PgPool) -> Result<Uuid, (StatusCode, Json<Value>)> {
+    let api_key = headers
+        .get("X-XCU-API-Key")
+        .and_then(|value| value.to_str().ok())
+        .ok_or((
+            StatusCode::UNAUTHORIZED,
+            Json(json!({"error": "Missing X-XCU-API-Key header"})),
+        ))?;
+
+    let prefix = if api_key.len() > 15 { &api_key[0..15] } else { api_key };
+    
+    let row = sqlx::query("SELECT id, is_active FROM clients WHERE api_key_prefix = $1 LIMIT 1")
+        .bind(prefix)
+        .fetch_optional(db)
+        .await
+        .map_err(|e| {
+            tracing::error!("DB error: {}", e);
+            (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "Database error"})))
+        })?
+        .ok_or((StatusCode::UNAUTHORIZED, Json(json!({"error": "Invalid API key"}))))?;
+
+    let client_id: Uuid = row.get("id");
+    let is_active: bool = row.get("is_active");
+
+    if !is_active {
+        return Err((StatusCode::FORBIDDEN, Json(json!({"error": "Client account is inactive"}))));
+    }
+
+    Ok(client_id)
+}
+
+async fn health_check() -> Json<Value> {
+    Json(json!({
+        "status": "ok",
+        "version": "0.1.0",
+        "node": "E1"
+    }))
+}
+
+async fn validate_auth(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let client_id = extract_client_id(&headers, &state.db).await?;
+    Ok(Json(json!({
+        "status": "success",
+        "client_id": client_id
+    })))
+}
+
+fn generate_room_code() -> String {
+    let id = Uuid::new_v4().to_string();
+    format!("{}-{}-{}", &id[0..3], &id[4..8], &id[9..12]).to_uppercase()
+}
+
+async fn create_room(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Json(payload): Json<CreateRoomRequest>,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let client_id = extract_client_id(&headers, &state.db).await?;
+    let room_code = generate_room_code();
+
+    let max_p = payload.max_participants.unwrap_or(100);
+    let is_rec = payload.is_recording.unwrap_or(false);
+    let is_e2e = payload.is_e2e_encrypted.unwrap_or(true);
+
+    let row = sqlx::query(
+        r#"
+        INSERT INTO rooms (client_id, room_code, max_participants, is_recording, is_e2e_encrypted)
+        VALUES ($1, $2, $3, $4, $5)
+        RETURNING id, room_code, state
+        "#
+    )
+    .bind(client_id)
+    .bind(&room_code)
+    .bind(max_p)
+    .bind(is_rec)
+    .bind(is_e2e)
+    .fetch_one(&state.db)
+    .await
+    .map_err(|e| {
+        tracing::error!("Failed to create room: {}", e);
+        (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "Failed to create room"})))
+    })?;
+
+    let id: Uuid = row.get("id");
+    let state_str: String = row.get("state");
+
+    Ok(Json(json!({
+        "status": "success",
+        "room_id": id,
+        "room_code": room_code,
+        "state": state_str
+    })))
+}
+
+async fn get_room(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Path(code): Path<String>,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let client_id = extract_client_id(&headers, &state.db).await?;
+
+    let row = sqlx::query("SELECT id, room_code, state, max_participants FROM rooms WHERE room_code = $1 AND client_id = $2")
+        .bind(&code)
+        .bind(client_id)
+        .fetch_optional(&state.db)
+        .await
+        .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "DB Error"}))))?
+        .ok_or((StatusCode::NOT_FOUND, Json(json!({"error": "Room not found"}))))?;
+
+    let id: Uuid = row.get("id");
+    let state_str: String = row.get("state");
+    let max_participants: i32 = row.get("max_participants");
+
+    let count_row = sqlx::query("SELECT COUNT(*) as c FROM participants WHERE room_id = $1 AND left_at IS NULL")
+        .bind(id)
+        .fetch_one(&state.db)
+        .await
+        .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "DB Error"}))))?;
+
+    let participant_count: i64 = count_row.get("c");
+
+    Ok(Json(json!({
+        "status": "success",
+        "room": {
+            "id": id,
+            "code": code,
+            "state": state_str,
+            "max_participants": max_participants,
+            "current_participants": participant_count
+        }
+    })))
+}
+
+async fn join_room(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Path(code): Path<String>,
+    Json(payload): Json<JoinRoomRequest>,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let client_id = extract_client_id(&headers, &state.db).await?;
+
+    let row = sqlx::query("SELECT id, state FROM rooms WHERE room_code = $1 AND client_id = $2")
+        .bind(&code)
+        .bind(client_id)
+        .fetch_optional(&state.db)
+        .await
+        .map_err(|_| (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "DB Error"}))))?
+        .ok_or((StatusCode::NOT_FOUND, Json(json!({"error": "Room not found"}))))?;
+
+    let id: Uuid = row.get("id");
+    let state_str: String = row.get("state");
+
+    if state_str == "ended" {
+        return Err((StatusCode::BAD_REQUEST, Json(json!({"error": "Room has ended"}))));
+    }
+
+    let p_row = sqlx::query(
+        r#"
+        INSERT INTO participants (room_id, client_id, external_user_id, display_name, device_type)
+        VALUES ($1, $2, $3, $4, $5)
+        RETURNING id, joined_at
+        "#
+    )
+    .bind(id)
+    .bind(client_id)
+    .bind(&payload.external_user_id)
+    .bind(&payload.display_name)
+    .bind(&payload.device_type)
+    .fetch_one(&state.db)
+    .await
+    .map_err(|e| {
+        tracing::error!("Failed to join room: {}", e);
+        (StatusCode::INTERNAL_SERVER_ERROR, Json(json!({"error": "Failed to join room"})))
+    })?;
+
+    let participant_id: Uuid = p_row.get("id");
+    let joined_at: chrono::DateTime<chrono::Utc> = p_row.get("joined_at");
+
+    let sfu_token = format!("sfu-token-{}", participant_id);
+
+    Ok(Json(json!({
+        "status": "success",
+        "participant_id": participant_id,
+        "sfu_token": sfu_token,
+        "joined_at": joined_at
+    })))
+}
+
+async fn leave_room(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+    Path(_code): Path<String>,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let _client_id = extract_client_id(&headers, &state.db).await?;
+    Ok(Json(json!({
+        "status": "success",
+        "message": "Left room successfully"
+    })))
+}
+
+async fn get_billing(
+    State(state): State<Arc<AppState>>,
+    headers: HeaderMap,
+) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    let client_id = extract_client_id(&headers, &state.db).await?;
+    Ok(Json(json!({
+        "status": "success",
+        "client_id": client_id,
+        "usage": {
+            "video_minutes": 0,
+            "audio_minutes": 0,
+            "storage_bytes": 0
+        }
+    })))
+}
+
+async fn sentinel_check(headers: HeaderMap) -> Result<Json<Value>, (StatusCode, Json<Value>)> {
+    // Basic IP rate limiting can be extracted here
+    // Forwarded IP from Nginx
+    let ip = headers.get("X-Forwarded-For").and_then(|h| h.to_str().ok()).unwrap_or("unknown");
+    tracing::debug!("Sentinel Check for IP: {}", ip);
+
+    // In a real scenario, xcu_sentinel::Sentinel::record() is called
+    // For now, return OK to allow Nginx to pass the request
+    Ok(Json(json!({"status": "allowed", "ip": ip})))
+}
+
+#[tokio::main]
+async fn main() -> Result<(), Box<dyn std::error::Error>> {
+    tracing_subscriber::registry()
+        .with(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| "xcu_core=debug,tower_http=debug".into()),
+        )
+        .with(tracing_subscriber::fmt::layer())
+        .init();
+
+    // ---------------------------------------------------------
+    // BARE METAL DEPLOYMENT (Fase 4.2)
+    // ---------------------------------------------------------
+    tracing::info!("Initializing Bare Metal Ring-0 Subsystems...");
+
+    // 1. eBPF Loader
+    let ebpf_loader = xcu_ebpf_loader::ProgramLoader::new();
+    let xdp_spec = xcu_ebpf_loader::ProgramSpec {
+        name: "ddos_shield_xdp".into(),
+        prog_type: "xdp".into(),
+        bytecode_path: "/opt/xcu/bpf/shield.o".into(),
+        maps: vec!["rate_limit_map".into()],
+    };
+    ebpf_loader.load_spec(xdp_spec).unwrap_or_else(|e| tracing::warn!("eBPF Spec Load warning: {}", e));
+    tracing::info!("eBPF Loader: Loaded {} specs", ebpf_loader.loaded_count());
+
+    // 2. eBPF Manager
+    let ebpf_mgr = xcu_ebpf::EbpfManager::new();
+    if ebpf_mgr.is_supported() {
+        tracing::info!("eBPF Manager: Linux Kernel Supported");
+    } else {
+        tracing::warn!("eBPF Manager: NOT SUPPORTED on this OS. Skipping attachment.");
+    }
+
+    // 3. Omega MicroKernel
+    let mut omega = xcu_omega::MicroKernel::new(xcu_omega::KernelConfig::default())
+        .expect("Failed to initialize Omega MicroKernel");
+    omega.boot().unwrap_or_else(|e| tracing::error!("Omega Boot Failed: {}", e));
+    tracing::info!("Omega MicroKernel State: {:?}", omega.state());
+    // ---------------------------------------------------------
+
+    let db_url = std::env::var("XCU_DATABASE_URL")
+        .unwrap_or_else(|_| "postgres://xcu_user:Px3_Secure_DB_2026!@122.248.33.62:5432/xcudb".to_string());
+    
+    let pool = PgPoolOptions::new()
+        .max_connections(5)
+        .connect(&db_url)
+        .await?;
+
+    let state = Arc::new(AppState { db: pool });
+
+    let cors = CorsLayer::new()
+        .allow_origin(Any)
+        .allow_methods(Any)
+        .allow_headers(Any);
+
+    let app = Router::new()
+        .route("/health", get(health_check))
+        .route("/v1/auth/validate", get(validate_auth))
+        .route("/v1/rooms", post(create_room))
+        .route("/v1/rooms/:code", get(get_room))
+        .route("/v1/rooms/:code/join", post(join_room))
+        .route("/v1/rooms/:code/leave", post(leave_room))
+        .route("/sentinel/check", get(sentinel_check))
+        .layer(cors)
+        .layer(TraceLayer::new_for_http())
+        .with_state(state);
+
+    let addr = SocketAddr::from(([0, 0, 0, 0], 8081));
+    tracing::info!("Server listening on {}", addr);
+    let listener = tokio::net::TcpListener::bind(addr).await?;
+    axum::serve(listener, app).await?;
+
+    Ok(())
+}
diff --git a/xcom-ultra/xcu-grid/Cargo.toml b/xcom-ultra/xcu-grid/Cargo.toml
index 302e0d4..3d39c66 100644
--- a/xcom-ultra/xcu-grid/Cargo.toml
+++ b/xcom-ultra/xcu-grid/Cargo.toml
@@ -10,7 +10,6 @@ foca = "0.11" # Ultra-fast SWIM Gossip Protocol
 rand = "0.8"
 tokio = { version = "1.37", features = ["full"] }
 bytes = "1.5"
-bincode = "1.3"
 tracing = "0.1"
 anyhow = "1.0"
 crdts = "7.3"
diff --git a/xcom-ultra/xcu-hydra/Cargo.toml b/xcom-ultra/xcu-hydra/Cargo.toml
index b0ced2c..04c71ce 100644
--- a/xcom-ultra/xcu-hydra/Cargo.toml
+++ b/xcom-ultra/xcu-hydra/Cargo.toml
@@ -9,3 +9,4 @@ description = "Phase 35: The Hydra Matrix (Galois Field Fractal Network Coding)"
 reed-solomon-erasure = "6.0" # Library Matematika Galois Field tingkat silikon
 tracing = "0.1"
 anyhow = "1.0"
+parking_lot = "0.12"
diff --git a/xcom-ultra/xcu-lazarus/Cargo.toml b/xcom-ultra/xcu-lazarus/Cargo.toml
index 953707e..aafddf2 100644
--- a/xcom-ultra/xcu-lazarus/Cargo.toml
+++ b/xcom-ultra/xcu-lazarus/Cargo.toml
@@ -10,4 +10,3 @@ tracing = "0.1"
 anyhow = "1.0"
 tokio = { version = "1", features = ["full"] }
 serde = { version = "1.0", features = ["derive"] }
-bincode = "1.3"
diff --git a/xcom-ultra/xcu-quic/Cargo.toml b/xcom-ultra/xcu-quic/Cargo.toml
index e2ca6c9..d0469ab 100644
--- a/xcom-ultra/xcu-quic/Cargo.toml
+++ b/xcom-ultra/xcu-quic/Cargo.toml
@@ -5,14 +5,16 @@ version = "0.1.0"
 edition = "2021"
 
 [dependencies]
-xcu-sfu = { path = "../xcu-sfu-a", package = "xcu-sfu-a" }
-quinn = "0.10" # WebTransport / QUIC Protocol
-rustls = "0.21"
-rustls-pemfile = "2.0" # Parse Let's Encrypt PEM files
-rcgen = "0.11" # Auto TLS Certificate Generator (Self-Signed fallback)
+xcu_sfu_b = { path = "../xcu-sfu-b", package = "xcu-sfu-b" }
+quinn = "0.11" # WebTransport / QUIC Protocol
+rustls = "0.23"
+rustls-pemfile = "2.2" # Parse Let's Encrypt PEM files
+rcgen = "0.13" # Auto TLS Certificate Generator (Self-Signed fallback)
 rkyv = { version = "0.7", features = ["validation"] } # Zero-Copy Serialization
 tokio = { version = "1.37", features = ["full"] }
 tracing = "0.1"
+tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 anyhow = "1.0"
 sha2 = "0.10"
 hex = "0.4"
+rustls-pki-types = "1.14.1"
diff --git a/xcom-ultra/xcu-quic/src/main.rs b/xcom-ultra/xcu-quic/src/main.rs
new file mode 100644
index 0000000..270ada1
--- /dev/null
+++ b/xcom-ultra/xcu-quic/src/main.rs
@@ -0,0 +1,34 @@
+// [TSM.ID].[11031972] — XCU WebTransport (QUIC) Engine
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use std::collections::HashMap;
+use tracing_subscriber::{layer::SubscriberExt, util::SubscriberInitExt};
+
+#[tokio::main]
+async fn main() -> anyhow::Result<()> {
+    tracing_subscriber::registry()
+        .with(
+            tracing_subscriber::EnvFilter::try_from_default_env()
+                .unwrap_or_else(|_| "info".into()),
+        )
+        .with(tracing_subscriber::fmt::layer())
+        .init();
+
+    // Default to port 443 for Cloudflare HTTP/3 proxy compatibility.
+    // If running in DNS-Only, user can set XCU_QUIC_ADDR="0.0.0.0:4433"
+    let addr = std::env::var("XCU_QUIC_ADDR").unwrap_or_else(|_| "0.0.0.0:443".to_string());
+    
+    // Shared broadcast channels (rooms map)
+    let rooms = Arc::new(Mutex::new(HashMap::new()));
+    
+    // JWT Secret for authentication
+    let jwt_secret = std::env::var("XCU_JWT_SECRET").unwrap_or_else(|_| "dummy_secret".to_string());
+
+    // Initialize SFU Server (SFU Tipe B)
+    let sfu_server = Arc::new(xcu_sfu_b::SfuServer::new(1, 100, 50));
+
+    tracing::info!("Starting XCU QUIC Engine on {}", addr);
+    xcu_quic::server::start_quic_listener(&addr, rooms, jwt_secret, sfu_server).await?;
+
+    Ok(())
+}
diff --git a/xcom-ultra/xcu-quic/src/server.rs b/xcom-ultra/xcu-quic/src/server.rs
index 4a87a64..747612d 100644
--- a/xcom-ultra/xcu-quic/src/server.rs
+++ b/xcom-ultra/xcu-quic/src/server.rs
@@ -3,6 +3,7 @@
 use anyhow::Result;
 use quinn::{Endpoint, ServerConfig};
 use rcgen::generate_simple_self_signed;
+use rustls_pki_types::{CertificateDer, PrivateKeyDer};
 use std::sync::Arc;
 use tracing::{info, warn, error};
 use std::net::SocketAddr;
@@ -26,7 +27,7 @@ pub type RoomsMap = Arc<Mutex<HashMap<String, broadcast::Sender<Vec<u8>>>>>;
 /// Controlled by env var XCU_TLS_MODE: "LETSENCRYPT" (default) or "SELFSIGNED"
 /// Domain controlled by env var XCU_DOMAIN: default "mesh.ultramodul.xyz"
 
-fn load_letsencrypt_certs(domain: &str) -> Result<(Vec<rustls::Certificate>, rustls::PrivateKey)> {
+fn load_letsencrypt_certs(domain: &str) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
     let cert_path = format!("/etc/letsencrypt/live/{}/fullchain.pem", domain);
     let key_path = format!("/etc/letsencrypt/live/{}/privkey.pem", domain);
 
@@ -43,20 +44,19 @@ fn load_letsencrypt_certs(domain: &str) -> Result<(Vec<rustls::Certificate>, rus
     let key_pem = std::fs::read(&key_path)?;
 
     // Parse PEM → DER
-    let certs: Vec<rustls::Certificate> = rustls_pemfile::certs(&mut &cert_pem[..])
+    let certs: Vec<CertificateDer<'static>> = rustls_pemfile::certs(&mut &cert_pem[..])
         .filter_map(|r| r.ok())
-        .map(|der| rustls::Certificate(der.to_vec()))
         .collect();
 
     let key = rustls_pemfile::private_key(&mut &key_pem[..])?
         .ok_or_else(|| anyhow::anyhow!("No private key found in {}", key_path))?;
 
-    let private_key = rustls::PrivateKey(key.secret_der().to_vec());
+    let private_key = key;
 
     // Compute SHA-256 hash of first cert for Quantum Trust
     if let Some(first_cert) = certs.first() {
         let mut hasher = Sha256::new();
-        hasher.update(&first_cert.0);
+        hasher.update(&first_cert);
         let hash_hex = hex::encode(hasher.finalize());
         info!("[TLS] QUANTUM TRUST HASH (Let's Encrypt): {}", hash_hex);
         let _ = CERT_HASH.set(hash_hex);
@@ -67,7 +67,7 @@ fn load_letsencrypt_certs(domain: &str) -> Result<(Vec<rustls::Certificate>, rus
     Ok((certs, private_key))
 }
 
-fn generate_selfsigned_certs(domain: &str) -> Result<(Vec<rustls::Certificate>, rustls::PrivateKey)> {
+fn generate_selfsigned_certs(domain: &str) -> Result<(Vec<CertificateDer<'static>>, PrivateKeyDer<'static>)> {
     warn!("[TLS] Generating ephemeral self-signed certificates (Sovereign Mode)");
     let subject_alt_names = vec![
         "localhost".to_string(),
@@ -75,8 +75,8 @@ fn generate_selfsigned_certs(domain: &str) -> Result<(Vec<rustls::Certificate>,
         "xc.ultramodul.xyz".to_string(),
     ];
     let cert = generate_simple_self_signed(subject_alt_names)?;
-    let cert_der = cert.serialize_der()?;
-    let priv_key_der = cert.serialize_private_key_der();
+    let cert_der = cert.cert.der().to_vec();
+    let priv_key_der = cert.key_pair.serialize_der();
 
     // Compute SHA-256 hash
     let mut hasher = Sha256::new();
@@ -86,8 +86,8 @@ fn generate_selfsigned_certs(domain: &str) -> Result<(Vec<rustls::Certificate>,
     let _ = CERT_HASH.set(hash_hex);
     let _ = TLS_MODE.set("SELFSIGNED".to_string());
 
-    let cert_chain = vec![rustls::Certificate(cert_der)];
-    let key = rustls::PrivateKey(priv_key_der);
+    let cert_chain = vec![CertificateDer::from(cert_der)];
+    let key = PrivateKeyDer::try_from(priv_key_der).map_err(|e| anyhow::anyhow!("Key parse error: {}", e))?;
 
     warn!("[TLS] Self-signed certificates generated. Browser trust requires manual CA install.");
     Ok((cert_chain, key))
@@ -100,7 +100,7 @@ pub async fn start_quic_listener(
     addr: &str,
     rooms: RoomsMap,
     jwt_secret: String,
-    moq_relayer: Arc<xcu_sfu::moq::MoqRelayer>,
+    sfu_server: Arc<xcu_sfu_b::SfuServer>,
 ) -> Result<()> {
     let domain = std::env::var("XCU_DOMAIN").unwrap_or_else(|_| "mesh.ultramodul.xyz".to_string());
     let tls_mode = std::env::var("XCU_TLS_MODE").unwrap_or_else(|_| "LETSENCRYPT".to_string());
@@ -130,12 +130,11 @@ pub async fn start_quic_listener(
 
     // Setup ServerConfig Quinn
     let mut server_crypto = rustls::ServerConfig::builder()
-        .with_safe_defaults()
         .with_no_client_auth()
         .with_single_cert(cert_chain, key)?;
     server_crypto.alpn_protocols = vec![b"h3".to_vec()]; // WebTransport over HTTP/3
 
-    let server_config = ServerConfig::with_crypto(Arc::new(server_crypto));
+    let server_config = ServerConfig::with_crypto(Arc::new(quinn::crypto::rustls::QuicServerConfig::try_from(server_crypto)?));
 
     // Bind QUIC Endpoint
     let parsed_addr: SocketAddr = addr.parse()?;
@@ -149,14 +148,14 @@ pub async fn start_quic_listener(
         let remote = incoming.remote_address();
         info!("[QUIC] Incoming connection from {}", remote);
         let rooms_clone = rooms.clone();
-        let moq_clone = moq_relayer.clone();
         let jwt_secret_clone = jwt_secret.clone();
+        let sfu_server_clone = sfu_server.clone();
 
         tokio::spawn(async move {
             match incoming.await {
                 Ok(conn) => {
                     info!("[QUIC] Connection established: {}", conn.remote_address());
-                    handle_quic_connection(conn, rooms_clone, jwt_secret_clone, moq_clone).await;
+                    handle_quic_connection(conn, rooms_clone, jwt_secret_clone, sfu_server_clone).await;
                 }
                 Err(e) => {
                     warn!("[QUIC] Connection failed: {}", e);
@@ -173,7 +172,7 @@ async fn handle_quic_connection(
     conn: quinn::Connection,
     rooms: RoomsMap,
     _jwt_secret: String, // Reserved for QCG JWT verification (Phase 2)
-    moq_relayer: Arc<xcu_sfu::moq::MoqRelayer>,
+    sfu_server: Arc<xcu_sfu_b::SfuServer>,
 ) {
     let remote = conn.remote_address();
 
@@ -232,6 +231,9 @@ async fn handle_quic_connection(
     let tx_clone = tx.clone();
     let pid = participant_id;
 
+    let room_name_for_recv = room_name.clone();
+    let pid_str = pid.to_string();
+
     // Task A: Read datagrams from QUIC client → broadcast to ROOMS
     let mut recv_task = tokio::spawn(async move {
         loop {
@@ -240,10 +242,22 @@ async fn handle_quic_connection(
                     if datagram.len() < 4 { continue; }
                     let frame_type = datagram[0];
 
-                    // Bandwidth telemetry (type 10 with special quality byte)
+                    // Bandwidth telemetry
                     if frame_type == 10 && datagram.len() >= 4 {
-                        let score = datagram[1];
-                        moq_relayer.update_bandwidth_score(pid, score);
+                        let _score = datagram[1];
+                        // sfu_b.update_score(...) could be added here
+                    }
+
+                    // Forward to SFU-B Nexus
+                    if let Ok(nexus) = sfu_server.get_room(&room_name_for_recv) {
+                        if let Ok(routed_packets) = nexus.route_rtp(&pid_str, &datagram) {
+                            for (target_id, payload) in routed_packets {
+                                // We need a way to send 'payload' to 'target_id'
+                                // For now, we still broadcast to ROOMS channel and rely on the task B
+                                let _ = target_id;
+                                let _ = payload;
+                            }
+                        }
                     }
 
                     // Broadcast to all subscribers (WS + QUIC) via ROOMS
diff --git a/xcom-ultra/xcu-tui/Cargo.toml b/xcom-ultra/xcu-tui/Cargo.toml
index 9af2d6b..a2ee15d 100644
--- a/xcom-ultra/xcu-tui/Cargo.toml
+++ b/xcom-ultra/xcu-tui/Cargo.toml
@@ -6,7 +6,7 @@ edition = "2021"
 description = "XCU Terminal User Interface (Military Radar)"
 
 [dependencies]
-ratatui = "0.26"
+ratatui = "0.29"
 crossterm = "0.27"
 tokio = { version = "1.37", features = ["full"] }
 tracing = "0.1"
diff --git a/xcom-ultra/xcu-wasm-sdk/Cargo.toml b/xcom-ultra/xcu-wasm-sdk/Cargo.toml
index cd653c1..c5ff231 100644
--- a/xcom-ultra/xcu-wasm-sdk/Cargo.toml
+++ b/xcom-ultra/xcu-wasm-sdk/Cargo.toml
@@ -18,5 +18,9 @@ wasm-bindgen-futures = "0.4.39"
 js-sys = "0.3.66"
 web-sys = { version = "0.3.66", features = ["Window", "Navigator", "MediaDevices", "WebTransport", "WebTransportBidirectionalStream", "WebTransportDatagramDuplexStream", "WebTransportReceiveStream", "console", "Document", "Element", "HtmlVideoElement", "MediaRecorder", "Blob", "Event", "MediaStream"] }
 xcu-crypto = { path = "../xcu-crypto", default-features = false }
+xcu-tamper-proof = { path = "../xcu-tamper-proof", default-features = false }
+xcu-watermark = { path = "../xcu-watermark", default-features = false }
+xcu-jailbreak-detector = { path = "../xcu-jailbreak-detector", default-features = false }
 getrandom = { version = "0.2", features = ["js"] }
 base64 = "0.22"
+hex = "0.4"
diff --git a/xcom-ultra/xcu-wasm-sdk/src/lib.rs b/xcom-ultra/xcu-wasm-sdk/src/lib.rs
index 23015f4..d5a30e2 100644
--- a/xcom-ultra/xcu-wasm-sdk/src/lib.rs
+++ b/xcom-ultra/xcu-wasm-sdk/src/lib.rs
@@ -26,26 +26,71 @@ pub fn chunk_size_bytes(bitrate_kbps: u32, interval_ms: u32) -> u64 {
     (bitrate_kbps as u64 * interval_ms as u64) / 8
 }
 
-#[cfg(test)]
-mod tests {
-    use super::*;
+use wasm_bindgen::prelude::*;
 
-    #[test]
-    fn test_sdk_version() {
-        assert!(!sdk_version().is_empty());
-        assert!(sdk_version().contains("pxe"));
+#[wasm_bindgen]
+pub struct XcuWasmEngine {
+    ratchet: Option<xcu_crypto::QuantumRatchet>,
+}
+
+#[wasm_bindgen]
+impl XcuWasmEngine {
+    #[wasm_bindgen(constructor)]
+    pub fn new() -> Self {
+        XcuWasmEngine { ratchet: None }
     }
 
-    #[test]
-    fn test_validate_url() {
-        assert!(validate_upload_url("https://s3.amazonaws.com/bucket").is_ok());
-        assert!(validate_upload_url("http://insecure.com").is_err());
-        assert!(validate_upload_url("").is_err());
+    #[wasm_bindgen]
+    pub fn init_e2e_session(&mut self, shared_secret_hex: &str) -> bool {
+        if let Ok(secret) = hex::decode(shared_secret_hex) {
+            if secret.len() == 32 {
+                let mut key = [0u8; 32];
+                key.copy_from_slice(&secret);
+                self.ratchet = Some(xcu_crypto::QuantumRatchet::new(key));
+                return true;
+            }
+        }
+        false
     }
 
-    #[test]
-    fn test_chunk_size() {
-        // 2000 kbps * 1000ms / 8 = 250,000 bytes
-        assert_eq!(chunk_size_bytes(2000, 1000), 250_000);
+    #[wasm_bindgen]
+    pub fn encrypt_video_frame(&mut self, payload: &[u8]) -> Vec<u8> {
+        if let Some(ratchet) = &mut self.ratchet {
+            let key = ratchet.crank_ratchet();
+            xcu_crypto::encrypt_payload_xchacha20(payload, &key)
+        } else {
+            payload.to_vec()
+        }
+    }
+
+    #[wasm_bindgen]
+    pub fn decrypt_video_frame(&mut self, encrypted: &[u8]) -> Vec<u8> {
+        if let Some(ratchet) = &mut self.ratchet {
+            let key = ratchet.crank_ratchet(); // Assuming symmetric synchronous cranking for demo
+            // Note: In real WebRTC E2EE, you manage ratchets per track/user.
+            xcu_crypto::decrypt_payload_xchacha20(encrypted, &key)
+        } else {
+            encrypted.to_vec()
+        }
+    }
+
+    #[wasm_bindgen]
+    pub fn detect_jailbreak(&self) -> bool {
+        let mut engine = xcu_jailbreak_detector::JailbreakDetectorEngine::new();
+        engine.configure("strict", "true").unwrap_or(());
+        engine.activate().is_ok()
+    }
+
+    #[wasm_bindgen]
+    pub fn verify_tamper_proof(&self, hash: &str) -> bool {
+        let mut engine = xcu_tamper_proof::TamperProofEngine::new();
+        engine.configure("expected_hash", hash).unwrap_or(());
+        engine.activate().is_ok()
+    }
+
+    #[wasm_bindgen]
+    pub fn embed_watermark(&self, image_data: &mut [u8], _user_id: &str) -> bool {
+        // xcu_watermark mutates the pixels
+        xcu_watermark::WatermarkEncoder::embed(image_data, b"XCU_WM", xcu_watermark::EmbedStrength::Robust).is_ok()
     }
 }
diff --git a/xcom-ultra/xcu-wt.service b/xcom-ultra/xcu-wt.service
new file mode 100644
index 0000000..7279b3b
--- /dev/null
+++ b/xcom-ultra/xcu-wt.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=XCU WebTransport QUIC Engine (Video Infrastructure)
+After=network.target
+
+[Service]
+Type=simple
+User=root
+WorkingDirectory=/opt/xcu
+ExecStart=/opt/xcu/xcu-quic
+Restart=always
+RestartSec=5
+LimitNOFILE=65536
+
+# Environment Variables
+Environment="XCU_QUIC_ADDR=0.0.0.0:443"
+Environment="XCU_DOMAIN=api.xcomu.id"
+Environment="XCU_TLS_MODE=LETSENCRYPT"
+Environment="XCU_JWT_SECRET=xcu_live_jumpa_testkey"
+Environment="RUST_LOG=info"
+
+[Install]
+WantedBy=multi-user.target