[feat](trx-rs): configurable DIG sideband for SDR (auto/USB/LSB)

DIG has no inherent sideband; on the SDR backend it was always demodulated as USB. Make it resolve to USB or LSB via a policy that defaults to the amateur SSB/data convention (USB at/above 10 MHz, LSB below) and can be overridden globally from the advanced radio controls or per-bookmark. Design: the logical DIG mode is kept in RigState (display, decoder gating) while the SDR pipeline is handed a concrete USB/LSB demodulator resolved from (policy, dial frequency). Resolution happens at the boundary — the rig for the primary channel and the virtual-channel manager for vchans — so the hot DSP/demod path is untouched. The resolved sideband is only re-pushed when it actually changes (e.g. tuning DIG/Auto across 10 MHz), keeping ordinary tuning glitch-free. Core/protocol: - New `DigSidebandPolicy { Auto, Usb, Lsb }` with `resolve(freq)` and an `effective_demod_mode()` helper (trx-core), re-exported at the crate root. - `RigCommand::SetSdrDigSideband`, `RigSdr::set_sdr_dig_sideband`, and a `RigFilterState.sdr_dig_sideband` field for state sync; wired through the ClientCommand mapping. Config: `[rig.sdr] dig_sideband = "auto"` (regenerated trx-rs.toml.example). SDR backend: the vchan manager owns the shared policy (atomic); the rig applies it to the primary channel and, on `set_sdr_dig_sideband`, re-resolves all DIG virtual channels. Frontend: a mode-gated "DIG sideband" selector in the SDR advanced controls (POST /set_sdr_dig_sideband), reflecting server state; bookmarks gain an optional `dig_sideband` field (form selector shown only for DIG) that, on apply, sets the global policy before switching to DIG. The scheduler honours it for automated bookmark activation too. Tests: policy resolution / effective-mode / u8+parse round-trips (trx-core); a vchan integration test asserting a DIG channel resolves to LSB below 10 MHz, flips with the policy, and still lists as DIG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UiK871ht2uPFBHtMbxy3wD Signed-off-by: Stan Grams <sjg@haxx.space>
[fix](trx-wefax): stop fragmenting one transmission into many images
2026-08-16 00:26:45 +02:00 · 2026-08-15 23:35:09 +02:00 · 2026-08-13 02:16:59 +02:00 · 2026-08-11 22:47:55 +02:00 · 2026-08-11 18:36:33 +02:00 · 2026-08-11 16:04:51 +02:00
91 changed files with 8911 additions and 753 deletions
@@ -56,6 +56,7 @@ src/
      trx-backend-ft450d/   # Yaesu FT-450D ASCII CAT
      trx-backend-soapysdr/ # SoapySDR RX with full DSP pipeline (~5,000+ LOC)
  trx-client/         # Client binary: remote connection, frontend spawning (~1,500 LOC)
+    trx-logbook/      # Station log: QSO record, ADIF reader/writer, append-only store
    trx-frontend/     # Frontend trait (FrontendSpawner), runtime context
      trx-frontend-http/      # Web UI: REST API, SSE, WebSocket audio, session auth
      trx-frontend-http-json/ # JSON-over-TCP control frontend
@@ -316,6 +316,18 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"

+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -345,6 +357,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bindgen"
 version = "0.66.1"
@@ -395,6 +413,24 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"

+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.12.0"
@@ -525,7 +561,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
 "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.3.0",
 "rand_core 0.10.1",
 ]

@@ -721,6 +757,15 @@ dependencies = [
 "windows",
 ]

+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -739,6 +784,16 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.2.1"
@@ -799,15 +854,26 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
 [[package]]
 name = "digest"
 version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
 dependencies = [
- "block-buffer",
+ "block-buffer 0.12.0",
 "const-oid",
- "crypto-common",
+ "crypto-common 0.2.1",
 ]

 [[package]]
@@ -1019,6 +1085,16 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1890,6 +1966,17 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "peeking_take_while"
 version = "0.1.2"
@@ -2492,8 +2579,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
 "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
 ]

 [[package]]
@@ -3215,9 +3302,11 @@ version = "0.1.0"
 dependencies = [
 "actix-web",
 "actix-ws",
+ "argon2",
 "base64",
 "brotli 7.0.0",
 "bytes",
+ "chrono",
 "dirs",
 "flate2",
 "futures-util",
@@ -3226,11 +3315,13 @@ dependencies = [
 "rand 0.8.6",
 "serde",
 "serde_json",
+ "tempfile",
 "tokio",
 "tokio-stream",
 "tracing",
 "trx-core",
 "trx-frontend",
+ "trx-logbook",
 "trx-protocol",
 "ts-rs",
 "uuid",
@@ -3269,6 +3360,19 @@ dependencies = [
 "rustfft",
 ]

+[[package]]
+name = "trx-logbook"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "dirs",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "tracing",
+ "uuid",
+]
+
 [[package]]
 name = "trx-protocol"
 version = "0.1.0"
@@ -26,6 +26,7 @@ members = [
    "src/trx-server/trx-backend/trx-backend-ft450d",
    "src/trx-server/trx-backend/trx-backend-soapysdr",
    "src/trx-client",
+    "src/trx-client/trx-logbook",
    "src/trx-client/trx-frontend",
    "src/trx-client/trx-frontend/trx-frontend-http",
    "src/trx-client/trx-frontend/trx-frontend-http-json",
@@ -925,9 +925,14 @@ main

 ### HTTP Frontend Auth

- Optional token or HTTP Basic Auth middleware
- Configured in `[frontends.http.auth]`
- Rate limiting supported
+- Optional Argon2id-backed managed accounts with HttpOnly session cookies
+- An exclusive Guest role plus composable Read, Control, Transmit, Write, and Administrator roles, with policy shared by middleware and handlers
+- Guest sessions receive read-only station access but no account-control endpoints or panels
+- Transmit separately gates PTT, TX audio frames, and TX power-limit changes
+- Atomic JSON persistence with migration from the legacy single-role schema
+- Account enable/disable, administrator CRUD, self-service password changes, and session revocation on security changes
+- A database invariant always preserves at least one enabled administrator
+- Per-IP login rate limiting; configured in `[frontends.http.auth]`

 ### Transport Security

@@ -1043,7 +1048,7 @@ The `FrontendRuntimeContext` struct in `trx-frontend/src/lib.rs` is decomposed i
 |-----------|---------|------------|
 | `AudioContext` | Audio streaming channels | `rx`, `tx`, `info`, `decode_rx`, `clients` |
 | `DecodeHistoryContext` | Decode history for all types | `ais`, `vdes`, `aprs`, `hf_aprs`, `cw`, `ft8`, `ft4`, `ft2`, `wspr` |
-| `HttpAuthConfig` | HTTP auth settings | `enabled`, `rx_passphrase`, `session_ttl_secs`, `tokens` |
+| `HttpAuthConfig` | HTTP auth settings | `enabled`, `users_file`, bootstrap admin/read accounts, `session_ttl_secs`, `tokens` |
 | `HttpUiConfig` | HTTP UI display config | `show_sdr_gain_control`, `initial_map_zoom`, `spectrum_*` |
 | `RigRoutingContext` | Remote rig state & routing | `active_rig_id`, `remote_rigs`, `rig_states`, `server_connected` |
 | `OwnerInfo` | Station metadata | `callsign`, `website_url`, `ais_vessel_url_base` |
@@ -453,25 +453,31 @@ put in the exchange there is nothing for it to write.
 | `RigState` | `FREQ`, `BAND`, `MODE`/`SUBMODE`, and the rig id a QSO was made on | watch channel already in the frontend context |
 | Client config `general.callsign` | `STATION_CALLSIGN`, and the default `OPERATOR` | already surfaced as `owner_callsign` in frontend meta |
 | The QSO's own rig, and its position | `MY_GRIDSQUARE` | per-rig latitude and longitude already carried in the rig list |
-| Server clock | `QSO_DATE`, `TIME_ON` in UTC | new `GET /logbook/now`, which also feeds the browser-clock check |
+| Server clock | `QSO_DATE`, `TIME_ON` in UTC | new `GET /api/logbook/now`, which also feeds the browser-clock check |
 | Decoder panels and map | a pre-filled entry: callsign, grid, and the report to offer | existing decode history; no new plumbing |
 | `bandForHz` | `BAND` from a frequency | exists in `map-core.ts`; move to a shared module |

 #### HTTP API

+Under `/api/logbook`, as the recorder's endpoints are, because `/logbook` itself is the page:
+the `/bookmarks` API and the bookmarks page already share a path, and whichever is registered
+first wins.
+
 | Method | Path | Purpose |
 |--------|------|---------|
-| `GET` | `/logbook` | Query: filters, paging |
-| `POST` | `/logbook` | Add a QSO |
-| `PUT` | `/logbook/{id}` | Edit |
-| `DELETE` | `/logbook/{id}` | Delete |
-| `GET` | `/logbook/export.adi` | ADIF export, honouring the current filter |
-| `GET` | `/logbook/export.cbr` | Cabrillo export of a contest selection |
-| `POST` | `/logbook/import` | Import, answering with counts: added, duplicate, rejected |
-| `GET` | `/logbook/worked/{call}` | Worked-before: bands and modes |
-| `GET` | `/logbook/now` | The server's UTC clock, for stamping entries and checking the browser's |
+| `GET` | `/api/logbook` | Query: filters, paging |
+| `POST` | `/api/logbook` | Add a QSO |
+| `PUT` | `/api/logbook/{id}` | Edit |
+| `DELETE` | `/api/logbook/{id}` | Delete |
+| `GET` | `/api/logbook/export.adi` | ADIF export, honouring the current filter |
+| `GET` | `/api/logbook/export.cbr` | Cabrillo export of a contest selection |
+| `POST` | `/api/logbook/import` | Import, answering with counts: added, duplicate, rejected |
+| `GET` | `/api/logbook/worked/{call}` | Worked-before: bands and modes |
+| `GET` | `/api/logbook/statistics` | Contacts, stations and confirmations, per band |
+| `GET` | `/api/logbook/now` | The server's UTC clock, for checking the browser's |
+| `GET` | `/api/logbook/prefill` | The six fields an entry opens with |

-Writes require the control role, as the rig endpoints do.
+Writes require the admin role, as the rig endpoints do.

 ### Frontend

@@ -505,14 +511,22 @@ task and the rig is the instrument.

 ### Phases

+All five are implemented.
+
 | Phase | Lands |
 |-------|-------|
 | 1 | `trx-logbook`: `Qso`, the ADI reader and writer, round-trip tests against files from other loggers |
-| 2 | Store, dedupe, and the HTTP API behind the control role |
+| 2 | Store, dedupe, and the HTTP API behind the admin role |
 | 3 | Logbook tab: entry, table, filters, import, export |
 | 4 | Ham layout, pre-filled entry from a decode row or the map, worked-before |
 | 5 | Contest exchange fields and Cabrillo export; QSL and LoTW/eQSL fields; per-band worked/confirmed statistics |

+Two decisions phase 5 settled. The Cabrillo header cannot be derived from a log — how many
+operators, how much power, what the score is claimed to be — so it comes from the operator,
+with `SINGLE-OP`, `LOW`, `ALL` and `MIXED` behind it. And a confirmation counts from whichever
+bureau answered: an award wants one card or one electronic match, not one of each, so a log
+that counted them separately would tell the operator they were short of what they have.
+
 ### Decisions

 **One station log, not one per rig.** Awards and uploads are per station callsign — DXCC, WAS
@@ -527,8 +541,8 @@ setting, which is also what LoTW's station locations expect.
 rotate operators through one station callsign, which is why contest loggers record it per QSO.
 It is stored per QSO, defaulted from the configured callsign so a single operator never touches
 it, and changed on the station line at the top of the panel where it sticks for the session.
-It cannot be taken from the session's identity: the auth roles are `control` and `rx`, with no
-notion of who is logged in.
+It cannot be inferred from the session's identity: an account username need not be an operator
+callsign, and operational accounts may be shared.

 **Server clock, and the log says so.** The server is the machine at the radio; the browser may
 be on a phone in another timezone with a clock nobody has checked. QSO times are UTC from the
@@ -121,13 +121,14 @@ The spectrum panel uses `<canvas>` elements (WebGL renderer optional) and offers
 When auth is enabled, an **auth gate** blocks the UI with:

 - Title: "Access Required"
- Subtitle: "Enter passphrase to continue"
- Password input + Login button (green accent, full-width)
- Optional "Continue as Guest" button (shown when RX passphrase is not set)
+- Subtitle: "Sign in to continue"
+- Username and password inputs + Login button (green accent, full-width)
 - Error message area (red `#ff6b6b`)
 - Role badge display

-Two roles: **Rx** (read-only) and **Control** (full access including TX/PTT).
+**Guest** provides read-only station access and is exclusive. Non-Guest accounts
+may combine **Read**, **Control**, **Transmit**, **Write**, and **Administrator** roles.
+Administrator implies all permissions.

 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.

@@ -336,25 +337,31 @@ Logo and favicon are embedded at compile time via `include_bytes!`. The logo ima

 ### 7.1 Route Access Classification

-Routes are classified into three tiers:
+Routes are classified into access tiers:

 | Tier | Examples | Requirement |
 |---|---|---|
-| **Public** | `/`, `/index.html`, `/map`, `/auth/*`, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Rx or Control role |
-| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Control role only |
+| **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Guest, Read, Control, Transmit, or Administrator role |
+| **Control** | `/set_freq`, `/set_mode`, `/toggle_power`, receive-side radio-control POST routes | Control or Administrator role |
+| **Transmit** | `/set_ptt`, `/set_tx_limit`, outbound `/audio` frames | Transmit or Administrator role |
+| **Write** | Logbook access and bookmark mutations | Write or Administrator role |

 ### 7.2 Session Management

 - Sessions are 128-bit random hex tokens stored in HttpOnly cookies
 - Configurable TTL (default from TOML config)
 - Expired sessions auto-pruned on access
- Constant-time passphrase comparison to mitigate timing attacks
+- Passwords are verified against salted Argon2id hashes

-### 7.3 TX Access Control
+### 7.3 User Management

-An additional `tx_access_control_enabled` flag can restrict transmit-related actions even
-for Control-role users, providing an extra safety layer.
+Every authenticated non-Guest account gets a Settings > Account tab for changing
+its own password. Guest sees neither Account nor Users and both account-control
+APIs deny Guest sessions. Only administrators get Settings > Users, where accounts can be
+created, enabled/disabled, assigned multiple roles, given a new password, or
+removed. The final enabled administrator cannot be disabled, removed, or
+demoted. Account security changes revoke every active session for that account.

 ---

@@ -66,8 +66,7 @@ both:
 |------------|----------|----------|
 | `[listen.auth].tokens` | `tokens_file` | one token per line |
 | `[[remotes]].auth.token` | `token_file` | the token |
-| `[frontends.http.auth].rx_passphrase` | `rx_passphrase_file` | the passphrase |
-| `[frontends.http.auth].control_passphrase` | `control_passphrase_file` | the passphrase |
+| `[frontends.http.auth].bootstrap_admin_password` | `bootstrap_admin_password_file` | the initial administrator password |
 | `[frontends.http_json.auth].tokens` | `tokens_file` | one token per line |

 Blank lines and `#` comments are ignored in the list files. A config that holds
@@ -350,17 +349,20 @@ A name in any of those maps that no remote answers to is a config error.

 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enabled` | bool | `false` | Require a passphrase |
-| `rx_passphrase` | string | — | Passphrase granting receive-only access |
-| `rx_passphrase_file` | string | — | Read it from this file instead |
-| `control_passphrase` | string | — | Passphrase granting full control |
-| `control_passphrase_file` | string | — | Read it from this file instead |
-| `tx_access_control_enabled` | bool | `true` | Hide TX from unauthenticated users |
+| `enabled` | bool | `false` | Enable the user/password ACL |
+| `users_file` | string | `"trx-http-users.json"` | Persistent managed user database |
+| `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
+| `bootstrap_admin_password` | string | — | First administrator password |
+| `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
+| `bootstrap_read_enabled` | bool | `true` | Create the default Guest account when the database is absent |
+| `bootstrap_read_username` | string | `"guest"` | Initial Guest username |
+| `bootstrap_read_password` | string | `"guest"` | Initial Guest password |
 | `session_ttl_min` | u64 | `480` | Session lifetime |
 | `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
 | `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |

-With `enabled = true`, at least one passphrase must be set.
+When enabling ACL for the first time, configure both bootstrap fields. After
+the database exists, remove the bootstrap credentials from configuration.

 #### `[frontends.rigctl]`

@@ -477,6 +479,81 @@ Each browser tab keeps its own selection, so two tabs can watch two rigs.

 ---

+## Logbook
+
+The **Logbook** tab keeps the station's contacts and speaks ADIF, so a log can
+be uploaded to LoTW, eQSL, Club Log or QRZ, or moved to another logger.
+
+An entry opens pre-filled with six fields and no more: the frequency, mode and
+name of the rig you are on, the time from the server's clock, and — when the
+entry was started from a decode or a map station — that station's callsign and
+locator. Signal reports, name, comment and the rest are yours to fill in; a
+report in particular is never guessed, because an FT8 SNR is not what was sent.
+
+Your own callsign and locator are not per-contact fields. They are station
+identity: the callsign comes from `[trx-client.general].callsign`, the locator
+from the rig's position, and both are shown once at the top of the panel. The
+operator defaults to the station callsign and can be changed for the session,
+which is what a multi-operator station needs.
+
+**Times are the server's**, in UTC — the server is the machine at the radio. If
+the browser's clock disagrees by more than a second the entry says so rather
+than logging a time you did not expect.
+
+**A decode is not a contact.** The decoders are receive-only, so a **Log**
+button on an FT8 or APRS row opens an entry with what was heard in it and logs
+nothing by itself. Digital QSOs made in WSJT-X come in through Import ADIF, the
+way every other logger takes them.
+
+| Action | What it does |
+|--------|--------------|
+| Log contact | Writes the entry and opens a fresh one |
+| Export ADIF | Downloads the log — filtered, if a filter is set |
+| Import ADIF | Reads a file, skipping contacts already held and reporting what could not be read |
+| Worked before | Shows, as you type a callsign, which bands and modes it has been worked on |
+
+Two contacts are treated as the same when the callsign, band and mode match and
+the times are within two minutes: two loggers rarely stamp a QSO to the same
+minute, one recording when it started and the other when it was typed.
+
+The log is a JSON Lines file, appended one contact at a time so a crash costs at
+most the contact being written. It lives in your data directory by default;
+`[trx-client.logbook].path` moves it, for a station that keeps its log on a
+backed-up volume.
+
+### Contests
+
+The **Contest exchange** block on the entry holds the contest's name and the
+serials — sent and received. Both stay between contacts, because they belong to
+the session rather than to the contact just logged, and the serial sent counts
+on by itself so it is not retyped forty times an hour. An exchange that is a
+zone, a section or a name rather than a number is kept as written.
+
+**Contest entry (Cabrillo)** exports the entry sponsors accept. Only the
+contacts of the contest named there are included. The header — operator
+category, power, claimed score — cannot be worked out from a log, so it is
+yours to fill in; the defaults are single operator, low power, all bands, mixed
+mode.
+
+### Confirmations
+
+The **QSL** column shows a tick when the other station has confirmed, and the
+**Confirm** button on a row records a card that has arrived. A confirmation
+counts from wherever it came: a paper card, LoTW or eQSL. An award wants one of
+them, not all three, so the log does not ask for all three.
+
+**Bands worked** counts, per band, the contacts made, the distinct stations
+worked, and how many of those contacts are confirmed.
+
+### Ham radio layout
+
+The **Ham radio** operator layout opens on the logbook with the transceiver
+controls around it — the arrangement for working the bands, where logging the
+contact is the task and the radio is the instrument. It is offered only where
+the selected rig can transmit; a receiver has no contacts to log.
+
+---
+
 ## Tune Links

 Every page of the web UI carries what the radio is doing in its address, so the
@@ -503,7 +580,7 @@ The link button in the top bar copies the current link to the clipboard. The
 address bar itself is updated as you tune, using `replaceState`, so sweeping
 the dial does not fill the browser's history.

-Applying a link changes the radio, so it needs the `control` role; an `rx`
+Applying a link changes the radio, so it needs the `Control` role; a `Read`
 session opens the page and says the link was not applied. Links describe the
 rig's own dial — while a tab is listening to a virtual channel the address is
 left as it was, rather than publishing a frequency the rig is not on.
@@ -512,53 +589,72 @@ left as it was, rather than publishing a frequency the rig is not on.

 ## Authentication

-The HTTP frontend supports optional passphrase-based authentication with two
-roles:
+The HTTP frontend supports an optional user/password ACL:

- **rx** — read-only access (monitoring, audio, decode streams)
- **control** — full access (frequency, mode, PTT, and all settings)
+- **Guest** — read-only station access with no Account or Users controls; Guest cannot be combined with another role
+- **Read** — monitoring, audio, decode streams, and bookmark reads
+- **Control** — tuning, mode, power, and receive-side radio controls
+- **Transmit** — PTT, transmitted audio, and TX power-limit controls
+- **Write** — logbook access and bookmark changes
+- **Administrator** — user management and all other permissions

 ### Configuration

 ```toml
 [frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-only-passphrase"
-control_passphrase = "full-control-passphrase"
-tx_access_control_enabled = true
+users_file = "trx-http-users.json"
+bootstrap_admin_username = "admin"
+bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false      # true if served via HTTPS
 cookie_same_site = "Lax"   # Strict|Lax|None
 ```

 When `enabled = false` (the default), all auth is bypassed and the UI behaves
-as before. When enabled, at least one passphrase must be set.
+as before. When enabling it for the first time, bootstrap credentials create
+the initial administrator (with every non-Guest role), the default `guest`/`guest` Guest
+account, and the Argon2id-hashed user database. Change or disable the guest
+credentials in configuration before first startup on an exposed deployment.

 ### Behaviour

 - On login, the server issues an `HttpOnly` session cookie.
 - Sessions are in-memory; a server restart invalidates all sessions.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
- When `tx_access_control_enabled = true`, TX/PTT controls are hidden and
-  rejected for unauthenticated or `rx`-role users.
+- User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
+- Non-Guest roles are independent; for example, an account may have Read and Write without Control.
+- Guest accounts have no account-control panels and cannot call account-control endpoints.
+- Every non-Guest signed-in user can change their own password in Settings > Account. This signs out all of their sessions.
+- Administrators can add, enable/disable, or remove users and change roles/passwords in Settings > Users.
+- At least one enabled administrator must always remain and cannot be disabled, removed, or demoted.
+- Disabling/removing an account or changing its password/roles revokes all of its sessions.
+- Existing account files migrate automatically: legacy accounts are enabled by default and legacy `user`/`admin` roles become Read/all roles.

 ### Routes

 | Endpoint | Method | Description |
 |----------|--------|-------------|
-| `/auth/login` | POST | Submit `{ "passphrase": "..." }` |
+| `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
-| `/auth/session` | GET | Check current session/role |
+| `/auth/session` | GET | Check current session/roles |
+| `/auth/account/password` | PATCH | Change a non-Guest user's password after verifying the current password |
+| `/auth/users` | GET/POST | List or add users (admin only) |
+| `/auth/users/{username}` | PATCH/DELETE | Change enabled state/password/roles or remove user (administrator only) |

-Protected routes require at least `rx` role. Control routes (set frequency,
-mode, PTT, etc.) require `control` role.
+Read routes accept Guest or require Read. Tuning and receive-side radio mutations
+require Control. PTT, transmitted audio, and TX limit changes require Transmit.
+Logbook access and bookmark mutations require Write. Administrator grants every permission.

 ### Frontend Flow

 1. On load, the UI calls `/auth/session`.
 2. If unauthenticated, a login screen is shown.
 3. On successful login, the normal UI loads.
-4. `rx` users see a read-only interface; `control` users get full controls.
+4. The interface enables controls according to the account's roles.
 5. If a session expires mid-use, streams stop and the login screen returns.

 ### Transport Security
@@ -45,8 +45,20 @@ impl WefaxConfig {
        60.0 / lpm as f32
    }

-    /// Samples per line at the internal sample rate.
+    /// Samples per line at the internal sample rate (rounded to an integer;
+    /// use [`Self::samples_per_line_f64`] for drift-free line slicing).
    pub fn samples_per_line(lpm: u16, sample_rate: u32) -> usize {
        (Self::line_duration_s(lpm) * sample_rate as f32).round() as usize
    }
+
+    /// Exact (fractional) samples per line at the internal sample rate.
+    ///
+    /// The line period rarely lands on an integer number of samples
+    /// (e.g. 120 LPM at 11 025 Hz is 5512.5 samples). Slicing on the rounded
+    /// integer accumulates a fractional-sample error every line, which shows
+    /// up as a slow horizontal slant over a tall image. Line boundaries are
+    /// instead computed from this exact value so the error never accumulates.
+    pub fn samples_per_line_f64(lpm: u16, sample_rate: u32) -> f64 {
+        60.0 / f64::from(lpm) * f64::from(sample_rate)
+    }
 }
@@ -38,10 +38,24 @@ const SIGNAL_DETECT_WINDOWS: u32 = 6;
 /// Real WEFAX content typically shows r > 0.5 between adjacent lines.
 const LINE_CORR_NOISE_THRESHOLD: f32 = 0.2;

-/// Number of consecutive uncorrelated scan lines that trigger auto-finalize
-/// while receiving. At 120 LPM this is 15 s; at 60 LPM it's 30 s. Modelled on
-/// fldigi's line-to-line correlation check for automatic stop.
-const LINE_CORR_NOISE_LINES: u32 = 30;
+/// Number of consecutive uncorrelated scan lines that mark the end of a
+/// transmission (carrier truly gone) and trigger auto-finalize. This must be
+/// long enough to ride through ordinary HF fading (QSB), which routinely
+/// decorrelates adjacent lines for several seconds without the transmission
+/// having ended. At 120 LPM this is ~60 s; at 60 LPM ~120 s.
+///
+/// A short window here is what previously chopped a single chart into many
+/// PNG "chunks": a 15 s fade tripped the watchdog, the image was finalized,
+/// and the still-present carrier immediately re-started a fresh image. Real
+/// WEFAX decoders (fldigi) keep one continuous image per APT cycle up to a
+/// large line cap and only stop on the APT stop tone or genuine signal loss.
+const LINE_CORR_NOISE_LINES: u32 = 120;
+
+/// Hard cap on lines in a single image. A 120 LPM chart runs ~10 min
+/// (~1200 lines); this cap (≈25 min at 120 LPM) only bounds memory if a
+/// session is left running on an open carrier. On reaching it the image is
+/// finalized and the decoder waits for a fresh APT start.
+const MAX_IMAGE_LINES: u32 = 3000;

 /// Maximum number of scan-line-equivalent sample windows to wait for phasing
 /// lock before falling through to Receiving. Typical WEFAX phasing lasts
@@ -107,6 +121,12 @@ pub struct WefaxDecoder {
    /// the decoder falls through to Receiving so a noisy or partial
    /// phasing signal doesn't wedge the state machine.
    phasing_samples: u64,
+    /// Whether a reception has already been auto-started from bare signal
+    /// variance during this session. After the first image, a new one is only
+    /// started by an APT start tone — this stops the trailing noise / carrier
+    /// that follows one chart from immediately auto-starting another image
+    /// (the mechanism that fragmented a transmission into many chunks).
+    auto_start_used: bool,
    /// Current rig dial frequency in Hz (for image filenames).
    freq_hz: u64,
    /// Current rig mode name (for image filenames).
@@ -135,6 +155,7 @@ impl WefaxDecoder {
            signal_detect_buf: Vec::with_capacity(INTERNAL_RATE as usize / 2),
            low_corr_lines: 0,
            phasing_samples: 0,
+            auto_start_used: false,
            freq_hz: 0,
            mode: String::new(),
        }
@@ -204,7 +225,13 @@ impl WefaxDecoder {
                // Fallback: detect active WEFAX signal by luminance variance.
                // Like fldigi's "strong image signal" detection — if we see
                // sustained modulated signal, auto-start receiving with defaults.
-                if self.state == State::Idle {
+                //
+                // Only ever taken once per session: it exists to catch a user
+                // tuning in mid-image with no APT start. After the first image,
+                // a new reception requires an APT start tone, so the residual
+                // carrier / noise that trails a finished chart cannot silently
+                // spawn a second image (which is what produced many chunks).
+                if self.state == State::Idle && !self.auto_start_used {
                    self.signal_detect_buf.extend_from_slice(&luminance);
                    let window_size = INTERNAL_RATE as usize / 2;
                    while self.signal_detect_buf.len() >= window_size {
@@ -340,6 +367,14 @@ impl WefaxDecoder {
                                break;
                            }

+                            // Bound memory on an open carrier: finalize and wait
+                            // for a fresh APT start rather than growing forever.
+                            if count >= MAX_IMAGE_LINES {
+                                debug!(lines = count, "WEFAX: max image lines — finalizing");
+                                carrier_lost = true;
+                                break;
+                            }
+
                            // Emit progress event.
                            if self.config.emit_progress && count % PROGRESS_INTERVAL == 0 {
                                let line_data =
@@ -402,6 +437,7 @@ impl WefaxDecoder {
        self.signal_detect_buf.clear();
        self.low_corr_lines = 0;
        self.phasing_samples = 0;
+        self.auto_start_used = false;
        events
    }

@@ -434,6 +470,7 @@ impl WefaxDecoder {
    fn transition_to_start_detected(&mut self, ioc: u16) -> WefaxEvent {
        let ioc = self.config.ioc.unwrap_or(ioc);
        debug!(ioc, "WEFAX: APT start detected");
+        self.auto_start_used = true;
        self.state = State::StartDetected { ioc };
        self.reception_start_ms = Some(
            std::time::SystemTime::now()
@@ -463,6 +500,7 @@ impl WefaxDecoder {
        self.image = Some(ImageAssembler::new(ppl));
        self.tone_detector.reset();
        self.low_corr_lines = 0;
+        self.auto_start_used = true;
        self.state = State::Receiving { ioc, lpm };
        self.state_event("Receiving", ioc, lpm)
    }
@@ -596,4 +634,47 @@ mod tests {
        dec.reset();
        assert_eq!(dec.state, State::Idle);
    }
+
+    /// Regression test for the over-chunking bug: once a session has produced
+    /// an image, the trailing carrier / noise must not silently auto-start a
+    /// second image. Only an APT start tone (or an explicit reset) may begin a
+    /// new reception after the first.
+    #[test]
+    fn variance_auto_start_only_fires_once_per_session() {
+        let mut dec = WefaxDecoder::new(11025, WefaxConfig::default());
+
+        // A transition rate that matches no APT tone → drives the variance
+        // based "strong signal" auto-start rather than a tone detection.
+        let strong = generate_apt_start(100.0, 11025, 4.0);
+        dec.process_samples(&strong);
+        assert!(
+            matches!(dec.state, State::Receiving { .. }),
+            "strong signal should auto-start one image, got {:?}",
+            dec.state
+        );
+        assert!(dec.auto_start_used);
+
+        // Simulate the image ending on carrier loss / stop (finalize → idle)
+        // WITHOUT an operator reset.
+        dec.transition_to_idle();
+        assert_eq!(dec.state, State::Idle);
+
+        // The still-present carrier must NOT spawn a second image.
+        dec.process_samples(&generate_apt_start(100.0, 11025, 4.0));
+        assert_eq!(
+            dec.state,
+            State::Idle,
+            "trailing signal must not re-auto-start a fresh image"
+        );
+
+        // An explicit reset re-arms mid-image auto-start.
+        dec.reset();
+        assert!(!dec.auto_start_used);
+        dec.process_samples(&generate_apt_start(100.0, 11025, 4.0));
+        assert!(
+            matches!(dec.state, State::Receiving { .. }),
+            "reset should re-arm variance auto-start, got {:?}",
+            dec.state
+        );
+    }
 }
@@ -12,8 +12,8 @@ use crate::config::WefaxConfig;

 /// Line slicer for WEFAX image assembly.
 pub struct LineSlicer {
-    /// Samples per line at the internal sample rate.
-    samples_per_line: usize,
+    /// Exact (fractional) samples per line at the internal sample rate.
+    samples_per_line: f64,
    /// Pixels per line (IOC × π).
    pixels_per_line: usize,
    /// Phase offset in samples from the phasing detector.
@@ -22,22 +22,37 @@ pub struct LineSlicer {
    buffer: Vec<f32>,
    /// Whether we have aligned to the phase offset yet.
    aligned: bool,
+    /// Index of the next line to emit. Boundaries are derived from this
+    /// against the exact fractional line length so rounding never accumulates.
+    line_index: u64,
 }

 impl LineSlicer {
    pub fn new(lpm: u16, ioc: u16, sample_rate: u32, phase_offset: usize) -> Self {
-        let samples_per_line = WefaxConfig::samples_per_line(lpm, sample_rate);
+        let samples_per_line = WefaxConfig::samples_per_line_f64(lpm, sample_rate);
        let pixels_per_line = WefaxConfig::pixels_per_line(ioc) as usize;

        Self {
            samples_per_line,
            pixels_per_line,
            phase_offset,
-            buffer: Vec::with_capacity(samples_per_line * 2),
+            buffer: Vec::with_capacity(samples_per_line as usize * 2),
            aligned: false,
+            line_index: 0,
        }
    }

+    /// Number of samples in line `n`, from the exact fractional line length.
+    ///
+    /// Boundaries are `round(n · spl)`; the per-line length is the difference
+    /// of successive boundaries, so lengths alternate (e.g. 5513/5512 for
+    /// 120 LPM at 11 025 Hz) with no cumulative drift.
+    fn line_len(&self, n: u64) -> usize {
+        let start = (n as f64 * self.samples_per_line).round() as u64;
+        let end = ((n + 1) as f64 * self.samples_per_line).round() as u64;
+        (end - start) as usize
+    }
+
    /// Feed luminance samples and extract complete image lines.
    ///
    /// Returns a vector of completed lines, each as a `Vec<u8>` of
@@ -56,12 +71,18 @@ impl LineSlicer {
        }

        // Extract complete lines (single drain at the end to avoid O(n²)).
+        // Line boundaries follow the exact fractional line length so the
+        // sample clock stays locked over a tall image (no accumulating slant).
        let mut offset = 0;
-        while offset + self.samples_per_line <= self.buffer.len() {
-            let line_samples = &self.buffer[offset..offset + self.samples_per_line];
-            let pixels = self.resample_line(line_samples);
-            lines.push(pixels);
-            offset += self.samples_per_line;
+        loop {
+            let len = self.line_len(self.line_index);
+            if offset + len > self.buffer.len() {
+                break;
+            }
+            let line_samples = &self.buffer[offset..offset + len];
+            lines.push(self.resample_line(line_samples));
+            offset += len;
+            self.line_index += 1;
        }
        if offset > 0 {
            self.buffer.drain(..offset);
@@ -77,6 +98,7 @@ impl LineSlicer {
    pub fn reset(&mut self) {
        self.buffer.clear();
        self.aligned = false;
+        self.line_index = 0;
    }

    /// Resample a line's worth of luminance samples to the target pixel count
@@ -129,6 +151,29 @@ mod tests {
        assert!(lines[0].iter().all(|&p| p == 255));
    }

+    #[test]
+    fn slicer_no_cumulative_drift() {
+        // 120 LPM at 11 025 Hz is 5512.5 samples/line — not an integer. Slicing
+        // on the rounded value (5513) would lose a line every ~11 000 lines and
+        // slant the image; the fractional boundaries must not accumulate error.
+        let lpm = 120;
+        let ioc = 576;
+        let sr = 11025;
+        let spl = WefaxConfig::samples_per_line_f64(lpm, sr);
+        assert_ne!(spl.fract(), 0.0, "test premise: spl is fractional");
+
+        let mut slicer = LineSlicer::new(lpm, ioc, sr, 0);
+        let total = (spl * 1000.0).round() as usize;
+        let samples = vec![1.0f32; total];
+        let lines = slicer.process(&samples);
+        assert_eq!(
+            lines.len(),
+            1000,
+            "exactly 1000 lines should fit in {} samples with no drift",
+            total
+        );
+    }
+
    #[test]
    fn slicer_linear_interpolation() {
        let lpm = 120;
@@ -78,7 +78,11 @@ pub struct ToneDetector {
 impl ToneDetector {
    pub fn new(sample_rate: u32) -> Self {
        let window_size = (sample_rate / 2) as usize; // ~0.5 s window
-        let min_sustain_s = 1.0; // fldigi uses 2 consecutive half-second windows
+        // APT start/stop tones are transmitted for ~5 s (WMO), so requiring a
+        // 2 s sustain costs no real detection latency while sharply cutting
+        // false positives from busy image content that momentarily produces a
+        // 300/450/675-transitions-per-second rate.
+        let min_sustain_s = 2.0;
        let window_duration_s = window_size as f32 / sample_rate as f32;
        let min_sustain_windows = (min_sustain_s / window_duration_s).ceil() as u32;

@@ -252,11 +252,17 @@ async fn async_init() -> DynResult<AppState> {

    // Set HTTP frontend authentication config
    frontend_runtime.http_auth.enabled = cfg.frontends.http.auth.enabled;
-    frontend_runtime.http_auth.rx_passphrase = cfg.frontends.http.auth.rx_passphrase.clone();
-    frontend_runtime.http_auth.control_passphrase =
-        cfg.frontends.http.auth.control_passphrase.clone();
-    frontend_runtime.http_auth.tx_access_control_enabled =
-        cfg.frontends.http.auth.tx_access_control_enabled;
+    frontend_runtime.http_auth.users_file = cfg.frontends.http.auth.users_file.clone();
+    frontend_runtime.http_auth.bootstrap_admin_username =
+        cfg.frontends.http.auth.bootstrap_admin_username.clone();
+    frontend_runtime.http_auth.bootstrap_admin_password =
+        cfg.frontends.http.auth.bootstrap_admin_password.clone();
+    frontend_runtime.http_auth.bootstrap_read_enabled =
+        cfg.frontends.http.auth.bootstrap_read_enabled;
+    frontend_runtime.http_auth.bootstrap_read_username =
+        cfg.frontends.http.auth.bootstrap_read_username.clone();
+    frontend_runtime.http_auth.bootstrap_read_password =
+        cfg.frontends.http.auth.bootstrap_read_password.clone();
    frontend_runtime.http_auth.session_ttl_secs = cfg.frontends.http.auth.session_ttl().as_secs();
    frontend_runtime.http_auth.cookie_secure = cfg.frontends.http.auth.cookie_secure;
    frontend_runtime.http_auth.cookie_same_site = match cfg.frontends.http.auth.cookie_same_site {
@@ -279,6 +285,10 @@ async fn async_init() -> DynResult<AppState> {
        .http
        .decode_history_retention_min_by_rig
        .clone();
+    frontend_runtime.http_ui.logbook_path = cfg.logbook.path.clone();
+    // The callsign the station is on the air with, which every contact is
+    // logged under and which the operator defaults to.
+    frontend_runtime.http_ui.station_callsign = cfg.general.callsign.clone();

    // Resolve remote entries: CLI --url > [[remotes]] > legacy [remote] > error
    let resolved_remotes: Vec<RemoteEntry> = if let Some(ref url) = cli.url {
@@ -257,9 +257,12 @@ impl Default for DecodeHistoryContext {
 /// HTTP authentication configuration.
 pub struct HttpAuthConfig {
    pub enabled: bool,
-    pub rx_passphrase: Option<String>,
-    pub control_passphrase: Option<String>,
-    pub tx_access_control_enabled: bool,
+    pub users_file: String,
+    pub bootstrap_admin_username: Option<String>,
+    pub bootstrap_admin_password: Option<String>,
+    pub bootstrap_read_enabled: bool,
+    pub bootstrap_read_username: String,
+    pub bootstrap_read_password: Option<String>,
    pub session_ttl_secs: u64,
    pub cookie_secure: bool,
    pub cookie_same_site: String,
@@ -271,9 +274,12 @@ impl Default for HttpAuthConfig {
    fn default() -> Self {
        Self {
            enabled: false,
-            rx_passphrase: None,
-            control_passphrase: None,
-            tx_access_control_enabled: true,
+            users_file: "trx-http-users.json".to_string(),
+            bootstrap_admin_username: None,
+            bootstrap_admin_password: None,
+            bootstrap_read_enabled: true,
+            bootstrap_read_username: "guest".to_string(),
+            bootstrap_read_password: Some("guest".to_string()),
            session_ttl_secs: 480 * 60,
            cookie_secure: false,
            cookie_same_site: "Lax".to_string(),
@@ -292,6 +298,10 @@ pub struct HttpUiConfig {
    pub bandplan_region: String,
    pub decode_history_retention_min: u64,
    pub decode_history_retention_min_by_rig: HashMap<String, u64>,
+    /// Where the station log is kept; `None` takes the default.
+    pub logbook_path: Option<String>,
+    /// The callsign contacts are logged under, and the operator by default.
+    pub station_callsign: Option<String>,
 }

 impl Default for HttpUiConfig {
@@ -305,6 +315,8 @@ impl Default for HttpUiConfig {
            bandplan_region: "iaru_r1".to_string(),
            decode_history_retention_min: 24 * 60,
            decode_history_retention_min_by_rig: HashMap::new(),
+            logbook_path: None,
+            station_callsign: None,
        }
    }
 }
@@ -11,6 +11,8 @@ build = "build.rs"
 [dependencies]
 trx-core = { path = "../../../trx-core" }
 trx-frontend = { path = ".." }
+trx-logbook = { path = "../../trx-logbook" }
+chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
 trx-protocol = { path = "../../../../src/trx-protocol" }
 tokio = { workspace = true, features = ["full"] }
 serde = { workspace = true, features = ["derive"] }
@@ -26,7 +28,11 @@ flate2 = { workspace = true }
 brotli = "7"
 rand = "0.8"
 hex = "0.4"
+argon2 = "0.5"
 pickledb = "0.5"
 dirs = "6"
 uuid = { workspace = true }
 ts-rs = "12.0.1"
+
+[dev-dependencies]
+tempfile = "3"
@@ -1,3 +1,20 @@
+import {
+  AUTH_ADMIN_ROLES,
+  AUTH_ROLES,
+  AUTH_ROLE_LABELS,
+  changeOwnPassword,
+  createUser,
+  deleteUser,
+  fetchAuthSession,
+  hasAccountControls,
+  hasAuthRole,
+  listUsers,
+  login,
+  logout,
+  normalizeAuthRoles,
+  updateUser
+} from "./chunk-PISLBJGN.js";
+
 // src/webgl-renderer.ts
 (function initTrxWebGl(global) {
  "use strict";
@@ -633,9 +650,12 @@ function elementById(id) {
    compact: { label: "Compact", advanced: false, audio: false, scheduler: false, preferredTab: "main" },
    broadcast: { label: "Broadcast", unavailable: "Broadcast requires an enumerated WFM-capable receiver", advanced: false, audio: true, scheduler: false, preferredTab: "main", capability: "broadcast" },
    digital: { label: "Digital", unavailable: "Digital requires a compatible rig mode and an available decoder", advanced: false, audio: false, scheduler: false, preferredTab: "digital-modes", capability: "digital" },
-    full: { label: "Full controls", advanced: true, audio: true, scheduler: true, preferredTab: "main" }
+    full: { label: "Full controls", advanced: true, audio: true, scheduler: true, preferredTab: "main" },
+    // Working the bands: the log is the task and the radio is the instrument,
+    // so this one opens on the logbook with the controls a keystroke away.
+    ham: { label: "Ham radio", unavailable: "Ham radio needs a rig that can transmit", advanced: true, audio: true, scheduler: false, preferredTab: "logbook", capability: "ham" }
  };
-  const layoutCapabilities = { broadcast: false, digital: false };
+  const layoutCapabilities = { broadcast: false, digital: false, ham: false };
  let activeRigId = null;
  const layoutSections = [
    { id: "advanced-radio-controls", key: "advanced" },
@@ -1311,60 +1331,6 @@ async function loadDecoderRegistry(onLoaded) {
 bridge.decoderRegistry = decoderRegistry;
 bridge.onDecoderRegistryReady = onDecoderRegistryReady;

-// src/api/auth.ts
-function decodeAuthSession(value) {
-  if (typeof value !== "object" || value === null) {
-    throw new TypeError("The authentication response is malformed");
-  }
-  const session = value;
-  if (typeof session.authenticated !== "boolean") {
-    throw new TypeError("The authentication response has no authenticated flag");
-  }
-  if (session.role !== void 0 && session.role !== "rx" && session.role !== "control") {
-    throw new TypeError("The authentication response has an invalid role");
-  }
-  if (session.auth_disabled !== void 0 && typeof session.auth_disabled !== "boolean") {
-    throw new TypeError("The authentication response has an invalid auth_disabled flag");
-  }
-  const decoded = { authenticated: session.authenticated };
-  if (session.role !== void 0) decoded.role = session.role;
-  if (session.auth_disabled !== void 0) decoded.auth_disabled = session.auth_disabled;
-  return decoded;
-}
-var authDisabledSession = {
-  authenticated: true,
-  role: "control",
-  auth_disabled: true
-};
-async function fetchAuthSession() {
-  try {
-    const response = await fetch("/auth/session");
-    if (response.status === 404) return authDisabledSession;
-    if (!response.ok) return { authenticated: false };
-    return decodeAuthSession(await response.json());
-  } catch (error) {
-    console.error("Auth check failed:", error);
-    return { authenticated: false };
-  }
-}
-async function login(passphrase) {
-  const response = await fetch("/auth/login", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ passphrase })
-  });
-  if (response.status === 404) return authDisabledSession;
-  if (!response.ok) {
-    const message = await response.text();
-    throw new Error(message || "Login failed");
-  }
-  return decodeAuthSession(await response.json());
-}
-async function logout() {
-  const response = await fetch("/auth/logout", { method: "POST" });
-  if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
-}
-
 // src/core/format.ts
 function formatDuration(milliseconds) {
  const seconds = Math.floor(milliseconds / 1e3);
@@ -1530,6 +1496,7 @@ function decodeCbor(buffer) {
 var TAB_ORDER = [
  "main",
  "bookmarks",
+  "logbook",
  "digital-modes",
  "map",
  "satellites",
@@ -1541,6 +1508,7 @@ var TAB_ORDER = [
 var TAB_PATHS = {
  main: "/",
  bookmarks: "/bookmarks",
+  logbook: "/logbook",
  "digital-modes": "/digital-modes",
  map: "/map",
  satellites: "/satellites",
@@ -1764,6 +1732,7 @@ var pluginGroups = {
  satellites: ["/satellite-predictions.js"],
  statistics: ["/map-core.js"],
  bookmarks: ["/bookmarks.js"],
+  logbook: ["/logbook.js"],
  recorder: [],
  settings: ["/vchan.js", "/scheduler.js"]
 };
@@ -1788,7 +1757,7 @@ async function loadPlugins(group) {
  for (const path of pluginGroups[group]) await loadPlugin(path);
 }
 async function loadEagerPlugins() {
-  await Promise.all(["digital-modes", "bookmarks", "settings"].map(loadPlugins));
+  await Promise.all(["digital-modes", "bookmarks", "logbook", "settings"].map(loadPlugins));
 }
 async function loadPluginsForTab(tab) {
  await loadPlugins(tab);
@@ -1856,33 +1825,67 @@ function isVchanRdsEntry(value) {
  return isRecord2(value) && typeof value.id === "string" && (value.rds === void 0 || value.rds === null || isRdsData(value.rds)) && (value.signal_db === void 0 || value.signal_db === null || typeof value.signal_db === "number");
 }
 void loadDecoderRegistry(refreshOperatorLayoutCapabilities);
-var authRole = null;
+var authRoles = [];
+var authUsername = null;
 var authEnabled = true;
+function setAuthRoles(roles) {
+  authRoles = normalizeAuthRoles(roles);
+}
+function hasAuthRole2(role) {
+  return hasAuthRole(authRoles, role);
+}
+function buildRoleChoices(selected) {
+  const element = document.createElement("span");
+  element.className = "auth-role-choices";
+  const inputs = AUTH_ROLES.map((value) => {
+    const label = document.createElement("label");
+    label.className = "auth-role-choice";
+    const input = document.createElement("input");
+    input.type = "checkbox";
+    input.value = value;
+    input.checked = selected.includes(value);
+    label.append(input, ` ${AUTH_ROLE_LABELS[value]}`);
+    element.append(label);
+    return { input, value };
+  });
+  inputs.forEach(({ input, value }) => {
+    input.addEventListener("change", () => {
+      if (!input.checked) return;
+      if (value === "guest") {
+        const administrator = inputs.find((choice) => choice.value === "administrator");
+        if (administrator) administrator.input.checked = false;
+      } else if (value === "administrator") {
+        const guest = inputs.find((choice) => choice.value === "guest");
+        if (guest) guest.input.checked = false;
+      }
+    });
+  });
+  return { element, inputs };
+}
 async function checkAuthStatus() {
  return fetchAuthSession();
 }
-async function authLogin(passphrase) {
-  return login(passphrase);
+async function authLogin(username, password) {
+  return login(username, password);
 }
 async function authLogout() {
  try {
    await logout();
-    authRole = null;
+    setAuthRoles([]);
+    authUsername = null;
    disconnect();
    setDecodeHistoryOverlayVisible(false);
    requiredElement("content").style.display = "none";
    requiredElement("loading").style.display = "none";
-    requiredElement("auth-passphrase").value = "";
+    requiredElement("auth-password").value = "";
    updateAuthUI();
-    const authStatus = await checkAuthStatus();
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  } catch (e) {
    console.error("Logout failed:", e);
    showAuthError("Logout failed");
  }
 }
-function showAuthGate(allowGuest = false) {
+function showAuthGate() {
  if (!authEnabled) return;
  setDecodeHistoryOverlayVisible(false);
  requiredElement("loading").style.display = "none";
@@ -1899,10 +1902,6 @@ function showAuthGate(allowGuest = false) {
  document.querySelectorAll(".tab-panel").forEach((panel) => {
    panel.style.display = "none";
  });
-  const guestBtn2 = document.getElementById("auth-guest-btn");
-  if (guestBtn2) {
-    guestBtn2.style.display = allowGuest ? "block" : "none";
-  }
  document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
    btn.classList.toggle("active", btn.dataset.tab === "main");
  });
@@ -1938,20 +1937,30 @@ function updateAuthUI() {
  const badge = document.getElementById("auth-badge");
  const badgeRole = document.getElementById("auth-role-badge");
  const headerAuthBtn2 = document.getElementById("header-auth-btn");
+  const accountTab = document.getElementById("settings-account-tab");
  if (!authEnabled) {
    if (badge) badge.style.display = "none";
    if (headerAuthBtn2) headerAuthBtn2.style.display = "none";
+    if (accountTab) accountTab.style.display = "none";
    syncTopBarAccess();
    return;
  }
-  if (authRole) {
+  if (authRoles.length > 0) {
+    const canManageAccount = hasAccountControls(authRoles);
+    if (accountTab) accountTab.style.display = canManageAccount ? "" : "none";
+    if (!canManageAccount && accountTab?.classList.contains("active")) {
+      const panel = document.getElementById("subtab-settings-account");
+      if (panel) panel.style.display = "none";
+      document.querySelector('[data-subtab="settings-scheduler"]')?.click();
+    }
    if (badge) badge.style.display = "block";
-    if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
+    if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map((role) => AUTH_ROLE_LABELS[role]).join(", ")}`;
    if (headerAuthBtn2) {
      headerAuthBtn2.textContent = "Logout";
      headerAuthBtn2.style.display = "block";
    }
  } else {
+    if (accountTab) accountTab.style.display = "none";
    if (badge) badge.style.display = "none";
    if (headerAuthBtn2) {
      headerAuthBtn2.textContent = "Login";
@@ -1961,31 +1970,34 @@ function updateAuthUI() {
  syncTopBarAccess();
 }
 function applyAuthRestrictions() {
-  if (!authRole) return;
-  if (authRole === "rx") {
+  if (authRoles.length === 0) return;
+  if (!hasAuthRole2("transmit")) {
    const pttBtn2 = document.getElementById("ptt-btn");
+    const txLimitInput2 = document.getElementById("tx-limit");
+    const txLimitBtn2 = document.getElementById("tx-limit-btn");
+    const txAudioBtn2 = document.getElementById("tx-audio-btn");
+    const txLimitRow2 = document.getElementById("tx-limit-row");
+    if (pttBtn2) pttBtn2.disabled = true;
+    if (txAudioBtn2) txAudioBtn2.disabled = true;
+    if (txLimitBtn2) txLimitBtn2.disabled = true;
+    if (txLimitInput2) txLimitInput2.disabled = true;
+    if (txLimitRow2) txLimitRow2.style.opacity = "0.5";
+  }
+  if (!hasAuthRole2("control")) {
    const powerBtn2 = document.getElementById("power-btn");
    const lockBtn2 = document.getElementById("lock-btn");
    const freqInput = document.getElementById("freq");
    const centerFreqInput = document.getElementById("center-freq");
    const modeSelect = document.getElementById("mode");
-    const txLimitInput2 = document.getElementById("tx-limit");
-    const txLimitBtn2 = document.getElementById("tx-limit-btn");
-    const txAudioBtn2 = document.getElementById("tx-audio-btn");
-    const txLimitRow2 = document.getElementById("tx-limit-row");
    const jogUp = document.getElementById("jog-up");
    const jogDown = document.getElementById("jog-down");
    const jogButtons = document.querySelectorAll(".jog-step button");
    const vfoButtons = document.querySelectorAll("#vfo-picker button");
-    if (pttBtn2) pttBtn2.disabled = true;
    if (powerBtn2) powerBtn2.disabled = true;
    if (lockBtn2) lockBtn2.disabled = true;
-    if (txAudioBtn2) txAudioBtn2.disabled = true;
-    if (txLimitBtn2) txLimitBtn2.disabled = true;
    if (freqInput) freqInput.disabled = true;
    if (centerFreqInput) centerFreqInput.disabled = true;
    if (modeSelect) modeSelect.disabled = true;
-    if (txLimitInput2) txLimitInput2.disabled = true;
    vfoButtons.forEach((btn) => btn.disabled = true);
    const jogWheel2 = document.getElementById("jog-wheel");
    if (jogUp) jogUp.disabled = true;
@@ -2022,7 +2034,6 @@ function applyAuthRestrictions() {
        btn.disabled = true;
      }
    });
-    if (txLimitRow2) txLimitRow2.style.opacity = "0.5";
  }
 }
 function applyCapabilities(caps) {
@@ -2252,20 +2263,21 @@ window.applyDecodeHistoryRetention = function() {
  }
 };
 function syncTopBarAccess() {
-  const loggedOut = authEnabled && !authRole;
+  const loggedOut = authEnabled && authRoles.length === 0;
  const tabBar = document.getElementById("tab-bar");
  const rigSwitch = document.querySelector(".header-rig-switch");
  if (tabBar) tabBar.style.display = "";
  document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
    const isMain = btn.dataset.tab === "main";
-    btn.style.display = !loggedOut || isMain ? "" : "none";
+    const lacksLogbookAccess = authEnabled && btn.dataset.tab === "logbook" && !hasAuthRole2("write");
+    btn.style.display = (!loggedOut || isMain) && !lacksLogbookAccess ? "" : "none";
    btn.disabled = false;
  });
  if (rigSwitch) {
    rigSwitch.style.display = loggedOut ? "none" : "";
  }
  if (headerRigSwitchSelect) {
-    headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
+    headerRigSwitchSelect.disabled = loggedOut || !hasAuthRole2("control") || lastRigIds.length === 0;
  }
 }
 var overviewDrawPending = false;
@@ -2901,7 +2913,7 @@ function applyRigList(activeRigId, rigIds, displayNames) {
  }
  const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
  const rigListChanged = prevKey !== nextKey;
-  const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
+  const disableSwitch = lastRigIds.length === 0 || !hasAuthRole2("control");
  populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
  updateRigSubtitle(lastActiveRigId);
  window.trxUi?.setActiveRig(lastActiveRigId);
@@ -2950,7 +2962,10 @@ function refreshOperatorLayoutCapabilities() {
  ));
  window.trxUi?.setLayoutCapabilities({
    broadcast: rigModes.some((modes) => modes.includes("WFM")),
-    digital: decoderModes.size > 0 && rigModes.some((modes) => modes.some((mode) => decoderModes.has(mode)))
+    digital: decoderModes.size > 0 && rigModes.some((modes) => modes.some((mode) => decoderModes.has(mode))),
+    // A logbook is for contacts made, so the layout built around it is offered
+    // where a rig can transmit.
+    ham: serverRigs.some((rig) => rig?.tx === true)
  });
 }
 function showHint(msg, duration) {
@@ -4236,9 +4251,16 @@ function formatSignal(sUnits) {
  return overDb === 0 ? `${sigUnit("S")}9` : `${sigUnit("S")}9+${overDb}${sigUnit("dB")}`;
 }
 function setDisabled(disabled) {
-  [freqEl, centerFreqEl, modeEl, pttBtn, powerBtn, txLimitInput, txLimitBtn, lockBtn].forEach((el) => {
-    if (el) el.disabled = disabled;
+  const controlDisabled = disabled || authEnabled && !hasAuthRole2("control");
+  const transmitDisabled = disabled || authEnabled && !hasAuthRole2("transmit");
+  [freqEl, centerFreqEl, modeEl, powerBtn, lockBtn].forEach((el) => {
+    if (el) el.disabled = controlDisabled;
  });
+  [pttBtn, txLimitInput, txLimitBtn].forEach((el) => {
+    if (el) el.disabled = transmitDisabled;
+  });
+  const transmitAudio = document.getElementById("tx-audio-btn");
+  if (transmitAudio) transmitAudio.disabled = transmitDisabled || !hasWebCodecs;
  syncModePicker();
 }
 var serverVersion = null;
@@ -4501,7 +4523,7 @@ function scheduleTuneLinkSync() {
 async function applyTuneLink(link) {
  const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
  if (!wanted) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole2("control")) {
    showHint("Read-only session — link not applied", 2500);
    return;
  }
@@ -4736,6 +4758,13 @@ function render(update) {
        }
      }
    }
+    if (typeof update.filter.sdr_dig_sideband === "string") {
+      sdrDigSidebandSupported = true;
+      if (sdrDigSidebandEl && document.activeElement !== sdrDigSidebandEl) {
+        sdrDigSidebandEl.value = update.filter.sdr_dig_sideband;
+      }
+      updateWfmControls();
+    }
  }
  if (typeof update.show_sdr_gain_control === "boolean") {
    if (sdrSettingsRowEl) sdrSettingsRowEl.style.display = update.show_sdr_gain_control ? "" : "none";
@@ -5219,7 +5248,7 @@ async function postPath(path, options = {}) {
  }
  const resp = await fetch(path, { method: "POST" });
  if (authEnabled && resp.status === 401) {
-    authRole = null;
+    setAuthRoles([]);
    if (es) es.close();
    showAuthGate();
    throw new Error("Authentication required");
@@ -5244,7 +5273,7 @@ async function switchRigFromSelect(selectEl) {
    showHint("No rig selected", 1500);
    return;
  }
-  if (authRole === "rx") {
+  if (!hasAuthRole2("control")) {
    showHint("Control role required", 1500);
    return;
  }
@@ -5858,8 +5887,13 @@ function navigateToTab(name, options = {}) {
  window.trxUi?.closeMobileOverlays?.();
  const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
  const { updateHistory = true, replaceHistory = false } = options;
-  if (authEnabled && !authRole && name !== "main") {
-    showAuthGate(false);
+  if (authEnabled && authRoles.length === 0 && name !== "main") {
+    showAuthGate();
+    return;
+  }
+  if (authEnabled && name === "logbook" && !hasAuthRole2("write")) {
+    showHint("Write role required for logbook access", 2500);
+    navigateToTab("main", options);
    return;
  }
  const btn = document.querySelector(`.tab-bar .tab[data-tab="${name}"]`);
@@ -5972,11 +6006,11 @@ window.addEventListener("resize", () => {
  scheduleSpectrumLayout();
 });
 async function initializeApp() {
-  showAuthGate(false);
+  showAuthGate();
  const authStatus = await checkAuthStatus();
  authEnabled = !authStatus.auth_disabled;
  if (!authEnabled) {
-    authRole = "control";
+    setAuthRoles(AUTH_ADMIN_ROLES);
    hideAuthGate();
    updateAuthUI();
    connect();
@@ -5987,7 +6021,8 @@ async function initializeApp() {
    return;
  }
  if (authStatus.authenticated) {
-    authRole = authStatus.role ?? null;
+    setAuthRoles(authStatus.roles);
+    authUsername = authStatus.username ?? null;
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -5997,32 +6032,191 @@ async function initializeApp() {
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } else {
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  }
 }
 var settingsUiReady = false;
 function initSettingsUI() {
  settingsUiReady = true;
-  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRole);
+  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRoles);
  window.trx.modules.scheduler?.wireEvents();
  if (window.trx.modules.backgroundDecode) {
-    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
+    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRoles);
    window.trx.modules.backgroundDecode.wireEvents();
  }
+  void refreshUserManagement();
 }
+async function refreshUserManagement() {
+  const section = document.getElementById("user-management");
+  const tab = document.getElementById("settings-users-tab");
+  if (!section || !tab) return;
+  const canManageUsers = authEnabled && hasAuthRole2("administrator");
+  tab.style.display = canManageUsers ? "" : "none";
+  if (!canManageUsers) {
+    const panel = document.getElementById("subtab-settings-users");
+    if (panel) panel.style.display = "none";
+    if (tab.classList.contains("active")) {
+      document.querySelector('[data-subtab="settings-scheduler"]')?.click();
+    }
+    return;
+  }
+  const list = requiredElement("user-list");
+  try {
+    const users = await listUsers();
+    const enabledAdminCount = users.filter((user) => user.enabled && hasAuthRole(user.roles, "administrator")).length;
+    list.replaceChildren(...users.map((user) => {
+      const row = document.createElement("div");
+      row.className = "sch-row";
+      row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
+      const name = document.createElement("strong");
+      name.textContent = user.username;
+      name.style.minWidth = "10rem";
+      if (!user.enabled) name.textContent += " (disabled)";
+      const { element: roles, inputs: roleInputs } = buildRoleChoices(user.roles);
+      const enabledLabel = document.createElement("label");
+      enabledLabel.className = "auth-role-choice";
+      const enabled = document.createElement("input");
+      enabled.type = "checkbox";
+      enabled.checked = user.enabled;
+      enabled.disabled = user.username === authUsername;
+      if (enabled.disabled) enabled.title = "You cannot disable your current account";
+      enabledLabel.append(enabled, " Enabled");
+      const isOnlyAdmin = user.enabled && hasAuthRole(user.roles, "administrator") && enabledAdminCount === 1;
+      const administratorInput = roleInputs.find((item) => item.value === "administrator")?.input;
+      const guestInput = roleInputs.find((item) => item.value === "guest")?.input;
+      if (isOnlyAdmin && administratorInput) {
+        administratorInput.disabled = true;
+        administratorInput.title = "The final administrator cannot be demoted";
+      }
+      if (isOnlyAdmin && guestInput) {
+        guestInput.disabled = true;
+        guestInput.title = "The final administrator cannot become a Guest";
+      }
+      if (isOnlyAdmin) {
+        enabled.disabled = true;
+        enabled.title = "The final enabled administrator cannot be disabled";
+      }
+      const password = document.createElement("input");
+      password.type = "password";
+      password.placeholder = "New password (8+ characters)";
+      password.autocomplete = "new-password";
+      password.className = "auth-input";
+      password.minLength = 8;
+      password.maxLength = 1024;
+      const syncPasswordAccess = () => {
+        const guestActive = guestInput?.checked === true;
+        password.disabled = guestActive;
+        password.title = guestActive ? "Password changes are unavailable while the Guest role is active" : "";
+        if (guestActive) password.value = "";
+      };
+      roleInputs.forEach(({ input }) => input.addEventListener("change", syncPasswordAccess));
+      syncPasswordAccess();
+      const save = document.createElement("button");
+      save.type = "button";
+      save.textContent = "Save";
+      save.addEventListener("click", async () => {
+        const changes = {
+          roles: roleInputs.filter(({ input }) => input.checked).map(({ value }) => value),
+          enabled: enabled.checked
+        };
+        if (password.value) changes.password = password.value;
+        await runUserOperation(() => updateUser(user.username, changes));
+      });
+      const remove = document.createElement("button");
+      remove.type = "button";
+      remove.textContent = "Remove";
+      remove.className = "danger";
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
+      remove.addEventListener("click", async () => {
+        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
+          await runUserOperation(() => deleteUser(user.username));
+        }
+      });
+      row.append(name, enabledLabel, roles, password, save, remove);
+      return row;
+    }));
+  } catch (error) {
+    showUserManagementError(error);
+  }
+}
+function showUserManagementError(error) {
+  const element = document.getElementById("user-management-error");
+  if (!element) return;
+  element.textContent = error instanceof Error ? error.message : String(error);
+  element.style.display = "block";
+}
+async function runUserOperation(operation) {
+  try {
+    await operation();
+    const error = document.getElementById("user-management-error");
+    if (error) error.style.display = "none";
+    await refreshUserManagement();
+  } catch (reason) {
+    showUserManagementError(reason);
+  }
+}
+var createRoleContainer = document.getElementById("user-create-roles");
+if (createRoleContainer) {
+  const { element } = buildRoleChoices(["read"]);
+  element.id = createRoleContainer.id;
+  createRoleContainer.replaceWith(element);
+}
+document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const username = requiredElement("user-create-username");
+  const password = requiredElement("user-create-password");
+  const enabled = requiredElement("user-create-enabled");
+  const roles = Array.from(document.querySelectorAll("#user-create-roles input[type=checkbox]"));
+  void runUserOperation(async () => {
+    await createUser(username.value, password.value, roles.filter((input) => input.checked).map((input) => input.value), enabled.checked);
+    username.value = "";
+    password.value = "";
+    enabled.checked = true;
+    roles.forEach((input) => {
+      input.checked = input.value === "read";
+    });
+  });
+});
+document.getElementById("account-password-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const form = event.currentTarget;
+  const currentPassword = requiredElement("account-current-password");
+  const newPassword = requiredElement("account-new-password");
+  const confirmPassword = requiredElement("account-confirm-password");
+  const error = requiredElement("account-password-error");
+  const submit = form.querySelector('button[type="submit"]');
+  if (newPassword.value !== confirmPassword.value) {
+    error.textContent = "New passwords do not match";
+    error.style.display = "block";
+    return;
+  }
+  if (submit) submit.disabled = true;
+  void changeOwnPassword(currentPassword.value, newPassword.value).then(async () => {
+    form.reset();
+    error.style.display = "none";
+    await authLogout();
+    showHint("Password changed. Sign in again.", 3e3);
+  }).catch((reason) => {
+    error.textContent = reason instanceof Error ? reason.message : String(reason);
+    error.style.display = "block";
+  }).finally(() => {
+    if (submit) submit.disabled = false;
+  });
+});
 requiredElement("auth-form").addEventListener("submit", async (e) => {
  e.preventDefault();
-  const passphraseEl = requiredElement("auth-passphrase");
-  const passphrase = passphraseEl.value;
+  const usernameEl = requiredElement("auth-username");
+  const passwordEl = requiredElement("auth-password");
  const btn = requiredElement("auth-form").querySelector("button[type=submit]");
  if (!btn) return;
  btn.disabled = true;
  btn.textContent = "Logging in...";
  try {
-    const result = await authLogin(passphrase);
-    authRole = result.role ?? null;
-    passphraseEl.value = "";
+    const result = await authLogin(usernameEl.value, passwordEl.value);
+    setAuthRoles(result.roles);
+    authUsername = result.username ?? usernameEl.value;
+    passwordEl.value = "";
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -6032,37 +6226,22 @@ requiredElement("auth-form").addEventListener("submit", async (e) => {
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } catch (err) {
-    showAuthError("Invalid passphrase");
+    showAuthError("Invalid username or password");
    console.error("Login error:", err);
  } finally {
    btn.disabled = false;
    btn.textContent = "Login";
  }
 });
-var guestBtn = document.getElementById("auth-guest-btn");
-if (guestBtn) {
-  guestBtn.addEventListener("click", () => {
-    authRole = "rx";
-    requiredElement("auth-passphrase").value = "";
-    hideAuthGate();
-    updateAuthUI();
-    applyAuthRestrictions();
-    connect();
-    connectDecode();
-    initSettingsUI();
-    resizeHeaderSignalCanvas();
-    startHeaderSignalSampling();
-  });
-}
 var headerAuthBtn = document.getElementById("header-auth-btn");
 if (headerAuthBtn) {
  headerAuthBtn.addEventListener("click", async () => {
-    if (authRole) {
+    if (authRoles.length > 0) {
      if (await window.trxUi.confirm({ title: "Log out?", message: "Audio and control access for this browser session will end.", confirmLabel: "Log out", danger: false })) {
        await authLogout();
      }
    } else {
-      showAuthGate(false);
+      showAuthGate();
    }
  });
 }
@@ -6100,8 +6279,8 @@ Object.defineProperties(trxState, {
  authEnabled: { get() {
    return authEnabled;
  } },
-  authRole: { get() {
-    return authRole;
+  authRoles: { get() {
+    return authRoles;
  } },
  decoderRegistry: { get() {
    return decoderRegistry;
@@ -6452,6 +6631,9 @@ var sdrNbThresholdControlsEl = document.getElementById("sdr-nb-threshold-control
 var sdrNbThresholdEl = document.getElementById("sdr-nb-threshold");
 var sdrNbThresholdSetBtn = document.getElementById("sdr-nb-threshold-set");
 var sdrNbSupported = false;
+var sdrDigSidebandWrapEl = document.getElementById("sdr-dig-sideband-wrap");
+var sdrDigSidebandEl = document.getElementById("sdr-dig-sideband");
+var sdrDigSidebandSupported = false;
 fetch("/audio", { method: "GET" }).then((r) => {
  if (r.status === 404) audioRow.style.display = "none";
 }).catch(() => {
@@ -6847,11 +7029,26 @@ if (sdrNbThresholdEl) {
    }
  });
 }
+function submitSdrDigSideband() {
+  if (!sdrDigSidebandSupported || !sdrDigSidebandEl) return;
+  const policy = sdrDigSidebandEl.value || "auto";
+  if (policy !== "auto" && policy !== "usb" && policy !== "lsb") return;
+  postPath(`/set_sdr_dig_sideband?policy=${encodeURIComponent(policy)}`).catch(() => {
+  });
+}
+if (sdrDigSidebandEl) {
+  sdrDigSidebandEl.addEventListener("change", () => {
+    submitSdrDigSideband();
+  });
+}
 function updateWfmControls() {
  const mode = (modeEl && modeEl.value ? modeEl.value : "").toUpperCase();
  if (wfmControlsCol) wfmControlsCol.style.display = mode === "WFM" ? "" : "none";
  if (samControlsCol) samControlsCol.style.display = mode === "SAM" ? "" : "none";
  if (modeControlsRow) modeControlsRow.style.display = mode === "WFM" || mode === "SAM" ? "" : "none";
+  if (sdrDigSidebandWrapEl) {
+    sdrDigSidebandWrapEl.style.display = sdrDigSidebandSupported && mode === "DIG" ? "" : "none";
+  }
 }
 if (!hasWebCodecs) {
  rxAudioBtn.disabled = true;
@@ -7173,6 +7370,10 @@ function startTxAudio() {
    void stopTxAudio();
    return;
  }
+  if (authEnabled && !hasAuthRole2("transmit")) {
+    audioStatus.textContent = "Transmit role required";
+    return;
+  }
  if (!hasWebCodecs) {
    audioStatus.textContent = "Audio requires Chrome/Edge";
    return;
@@ -4,7 +4,7 @@ import {
  collapseAprsDuplicates,
  normalizeAprsPacket,
  renderAprsPacketRow
-} from "./chunk-OPEIVJGD.js";
+} from "./chunk-REYSUJQ4.js";
 import {
  forActiveRig,
  isActiveRigDecode
@@ -139,6 +139,9 @@ function renderAprsRow(pkt, isFresh) {
    },
    onCopy: (text) => {
      void copyAprsCoords(text);
+    },
+    onLog: (call, gridsquare) => {
+      aprsWindow.logContact?.({ call, gridsquare: gridsquare ?? void 0, decoder: "aprs" });
    }
  });
 }
@@ -1,3 +1,6 @@
+import {
+  hasAuthRole
+} from "./chunk-PISLBJGN.js";
 import {
  hostState
 } from "./chunk-KL66PICH.js";
@@ -13,7 +16,7 @@ var bgdWindow = window;
      return d.id;
    });
  }
-  let backgroundDecodeRole = null;
+  let backgroundDecodeRoles = [];
  let currentRigId = null;
  let currentConfig = null;
  let bookmarkList = [];
@@ -21,8 +24,8 @@ var bgdWindow = window;
  let bgdDirty = false;
  let statusByBookmark = /* @__PURE__ */ new Map();
  let lastStatus = null;
-  function initBackgroundDecode(rigId, role) {
-    backgroundDecodeRole = role;
+  function initBackgroundDecode(rigId, roles) {
+    backgroundDecodeRoles = roles;
    currentRigId = rigId || hostState.lastActiveRigId || null;
    if (currentRigId) loadBackgroundDecode();
    startStatusPolling();
@@ -358,7 +361,7 @@ var bgdWindow = window;
    btn.title = bgdDirty ? "Apply these bookmarks to the background decoder" : "No changes to save";
  }
  function isControlRole() {
-    return backgroundDecodeRole === "control" || hostState.authEnabled === false;
+    return hasAuthRole(backgroundDecodeRoles, "control") || hostState.authEnabled === false;
  }
  function showToast(msg, isError) {
    const el = document.getElementById("background-decode-toast");
@@ -1,3 +1,6 @@
+import {
+  hasAuthRole
+} from "./chunk-PISLBJGN.js";
 import {
  hostCore,
  hostState
@@ -42,7 +45,7 @@ function bmEsc(str) {
  return d.innerHTML;
 }
 function bmCanControl() {
-  return !hostState.authEnabled || hostState.authRole === "control";
+  return !hostState.authEnabled || hasAuthRole(hostState.authRoles, "write");
 }
 function bmSyncAccess() {
  const canCtrl = bmCanControl();
@@ -211,6 +214,12 @@ function bmBuildDecoderCheckboxes() {
    container.appendChild(label);
  });
 }
+function bmSyncDigSidebandVisibility() {
+  const label = bmOptionalEl("bm-dig-sideband-label");
+  if (!label) return;
+  const mode = (bmEl("bm-mode").value || "").trim().toUpperCase();
+  label.style.display = mode === "DIG" ? "" : "none";
+}
 function bmOpenForm(bm) {
  const wrap = bmEl("bm-form-wrap");
  if (!wrap) return;
@@ -224,7 +233,9 @@ function bmOpenForm(bm) {
  bmEl("bm-locator").value = bm ? bm.locator || "" : "";
  bmEl("bm-category-input").value = bm ? bm.category || "" : "";
  bmEl("bm-comment").value = bm ? bm.comment || "" : "";
+  bmEl("bm-dig-sideband").value = bm ? bm.dig_sideband || "" : "";
  bmWriteDecoders(bm?.decoders ?? []);
+  bmSyncDigSidebandVisibility();
  bmEl("bm-form-title").textContent = bm ? "Edit Bookmark" : "Add Bookmark";
  wrap.style.display = "flex";
  bmEl("bm-name").focus();
@@ -260,6 +271,7 @@ async function bmSave(e) {
  const category = bmEl("bm-category-input").value.trim();
  const comment = bmEl("bm-comment").value.trim();
  const decoders = bmReadDecoders();
+  const dig_sideband = mode.toUpperCase() === "DIG" ? bmEl("bm-dig-sideband").value || null : null;
  const formError = bmEl("bm-form-error");
  if (formError) formError.textContent = "";
  if (!name || !Number.isFinite(freq_hz) || !mode) {
@@ -276,7 +288,8 @@ async function bmSave(e) {
    locator: locator || null,
    category,
    comment,
-    decoders
+    decoders,
+    dig_sideband
  };
  try {
    let resp;
@@ -341,6 +354,12 @@ function bmApply(bm) {
    }
    const tunePromise = (async () => {
      await bridge.trx.modules.vchan?.takeSchedulerControl();
+      if ((bm.mode || "").toUpperCase() === "DIG" && bm.dig_sideband) {
+        const p = bm.dig_sideband.toLowerCase();
+        if (p === "auto" || p === "usb" || p === "lsb") {
+          await hostCore.postPath("/set_sdr_dig_sideband?policy=" + encodeURIComponent(p));
+        }
+      }
      const onVirtual = await bridge.trx.modules.vchan?.interceptMode(bm.mode) ?? false;
      if (!onVirtual) {
        await hostCore.postPath("/set_mode?mode=" + encodeURIComponent(bm.mode));
@@ -593,6 +612,7 @@ function bmPopulateScopePicker() {
  bmEl("bm-form").addEventListener("submit", (event) => {
    void bmSave(event);
  });
+  bmEl("bm-mode").addEventListener("input", bmSyncDigSidebandVisibility);
  bmEl("bm-form-cancel").addEventListener("click", bmCloseForm);
  const formWrap = bmEl("bm-form-wrap");
  if (formWrap) {
@@ -0,0 +1,136 @@
+// src/api/auth.ts
+var AUTH_ROLES = ["guest", "read", "control", "transmit", "write", "administrator"];
+var AUTH_ADMIN_ROLES = AUTH_ROLES.filter((role) => role !== "guest");
+var AUTH_ROLE_LABELS = {
+  guest: "Guest",
+  read: "Read",
+  control: "Control",
+  transmit: "Transmit",
+  write: "Write",
+  administrator: "Administrator"
+};
+function isAuthRole(value) {
+  return typeof value === "string" && AUTH_ROLES.includes(value);
+}
+function normalizeAuthRoles(roles) {
+  return AUTH_ROLES.filter((role) => roles.includes(role));
+}
+function hasAuthRole(roles, required) {
+  return roles.includes("administrator") || roles.includes(required) || required === "read" && roles.includes("guest") || required === "read" && (roles.includes("control") || roles.includes("transmit"));
+}
+function hasAccountControls(roles) {
+  return roles.length > 0 && !roles.includes("guest");
+}
+function decodeRoles(value, context) {
+  if (!Array.isArray(value) || !value.every(isAuthRole)) {
+    throw new TypeError(`${context} has invalid roles`);
+  }
+  return normalizeAuthRoles(value);
+}
+function decodeAuthSession(value) {
+  if (typeof value !== "object" || value === null) {
+    throw new TypeError("The authentication response is malformed");
+  }
+  const session = value;
+  if (typeof session.authenticated !== "boolean") {
+    throw new TypeError("The authentication response has no authenticated flag");
+  }
+  if (session.auth_disabled !== void 0 && typeof session.auth_disabled !== "boolean") {
+    throw new TypeError("The authentication response has an invalid auth_disabled flag");
+  }
+  const decoded = {
+    authenticated: session.authenticated,
+    roles: decodeRoles(session.roles, "The authentication response")
+  };
+  if (session.username !== void 0) {
+    if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
+    decoded.username = session.username;
+  }
+  if (session.auth_disabled !== void 0) decoded.auth_disabled = session.auth_disabled;
+  return decoded;
+}
+var authDisabledSession = {
+  authenticated: true,
+  roles: [...AUTH_ADMIN_ROLES],
+  auth_disabled: true
+};
+async function fetchAuthSession() {
+  try {
+    const response = await fetch("/auth/session");
+    if (response.status === 404) return authDisabledSession;
+    if (!response.ok) return { authenticated: false, roles: [] };
+    return decodeAuthSession(await response.json());
+  } catch (error) {
+    console.error("Auth check failed:", error);
+    return { authenticated: false, roles: [] };
+  }
+}
+async function login(username, password) {
+  const response = await fetch("/auth/login", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username, password })
+  });
+  if (response.status === 404) return authDisabledSession;
+  if (!response.ok) {
+    const message = await response.text();
+    throw new Error(message || "Login failed");
+  }
+  return decodeAuthSession(await response.json());
+}
+async function userRequest(path, init) {
+  const response = await fetch(path, init);
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({}));
+    throw new Error(payload.error || `User operation failed (${response.status})`);
+  }
+  return response;
+}
+async function listUsers() {
+  const value = await userRequest("/auth/users").then((response) => response.json());
+  if (!Array.isArray(value) || !value.every((user) => {
+    if (typeof user !== "object" || user === null) return false;
+    const record = user;
+    return typeof record.username === "string" && typeof record.enabled === "boolean" && Array.isArray(record.roles) && record.roles.every(isAuthRole);
+  })) {
+    throw new TypeError("The user list response is malformed");
+  }
+  return value.map((user) => ({ ...user, roles: normalizeAuthRoles(user.roles) }));
+}
+async function createUser(username, password, roles, enabled = true) {
+  await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, roles, enabled }) });
+}
+async function updateUser(username, changes) {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
+}
+async function changeOwnPassword(currentPassword, newPassword) {
+  await userRequest("/auth/account/password", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ current_password: currentPassword, new_password: newPassword })
+  });
+}
+async function deleteUser(username) {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
+}
+async function logout() {
+  const response = await fetch("/auth/logout", { method: "POST" });
+  if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
+}
+
+export {
+  AUTH_ROLES,
+  AUTH_ADMIN_ROLES,
+  AUTH_ROLE_LABELS,
+  normalizeAuthRoles,
+  hasAuthRole,
+  hasAccountControls,
+  fetchAuthSession,
+  login,
+  listUsers,
+  createUser,
+  updateUser,
+  changeOwnPassword,
+  deleteUser,
+  logout
+};
@@ -214,6 +214,16 @@ function summarizeAprsPayload(packet) {
  const text = info.replace(/^[>;<?]/, "").trim();
  return text.length ? text : null;
 }
+function maidenheadForLatLon(lat, lon) {
+  const adjustedLon = lon + 180;
+  const adjustedLat = lat + 90;
+  const field = String.fromCharCode(65 + Math.floor(adjustedLon / 20)) + String.fromCharCode(65 + Math.floor(adjustedLat / 10));
+  const square = String(Math.floor(adjustedLon % 20 / 2)) + String(Math.floor(adjustedLat % 10));
+  const subLon = adjustedLon % 2 * 60 / 5;
+  const subLat = adjustedLat % 1 * 60 / 2.5;
+  const sub = String.fromCharCode(97 + Math.floor(subLon)) + String.fromCharCode(97 + Math.floor(subLat));
+  return `${field}${square}${sub}`.toUpperCase();
+}
 function renderAprsPacketRow(packet, options = {}) {
  const row = document.createElement("details");
  row.className = "aprs-packet";
@@ -224,7 +234,7 @@ function renderAprsPacketRow(packet, options = {}) {
  const summary = summarizeAprsPayload(packet);
  const hasPosition = packet.lat != null && packet.lon != null;
  const qrzHref = `https://qrzcq.com/call/${encodeURIComponent(packet.srcCall || "")}`;
-  row.innerHTML = `<summary class="decode-line"><span class="aprs-time">${escapeAprsHtml(time)}</span>` + (options.badge ? `<span class="aprs-badge aprs-badge-band">${escapeAprsHtml(options.badge)}</span>` : "") + renderAprsSymbolSlot(packet, escapeAprsHtml) + `<span class="aprs-call">${escapeAprsHtml(packet.srcCall ?? "")}</span><span class="aprs-badge aprs-badge-type aprs-badge-type-${category}">${escapeAprsHtml(aprsCategoryLabel(category))}</span><span class="decode-line-summary">${summary ? escapeAprsHtml(summary) : renderAprsInfo(packet)}</span>` + (packet.crcOk ? "" : '<span class="aprs-badge aprs-badge-crc">CRC</span>') + (options.distance ? `<span class="decode-line-distance">${escapeAprsHtml(options.distance)}</span>` : "") + `</summary><div class="decode-expanded"><div class="decode-expanded-meta"><span>&gt;${escapeAprsHtml(packet.destCall || "--")}</span><span>${escapeAprsHtml(packet.path || "no path")}</span><span>${escapeAprsHtml(aprsAgeText(packet._tsMs))}</span><span>CRC ${packet.crcOk ? "ok" : "failed"}</span>` + (hasPosition ? `<a class="aprs-pos" href="javascript:void(0)" data-aprs-map="${packet.lat},${packet.lon}">${packet.lat?.toFixed(5)}, ${packet.lon?.toFixed(5)}</a>` : "") + `</div><div class="decode-expanded-raw">${renderAprsInfo(packet)}</div>` + (packet.info_bytes?.length ? `<div class="decode-expanded-bytes">${escapeAprsHtml(aprsHexBytes(packet.info_bytes))}</div>` : "") + `<div class="aprs-row-actions">` + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-map="${packet.lat},${packet.lon}">Map</button>` : "") + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-copy="${packet.lat},${packet.lon}">Copy Coords</button>` : "") + `<a class="aprs-inline-btn" href="${qrzHref}" target="_blank" rel="noopener">QRZ</a></div></div>`;
+  row.innerHTML = `<summary class="decode-line"><span class="aprs-time">${escapeAprsHtml(time)}</span>` + (options.badge ? `<span class="aprs-badge aprs-badge-band">${escapeAprsHtml(options.badge)}</span>` : "") + renderAprsSymbolSlot(packet, escapeAprsHtml) + `<span class="aprs-call">${escapeAprsHtml(packet.srcCall ?? "")}</span><span class="aprs-badge aprs-badge-type aprs-badge-type-${category}">${escapeAprsHtml(aprsCategoryLabel(category))}</span><span class="decode-line-summary">${summary ? escapeAprsHtml(summary) : renderAprsInfo(packet)}</span>` + (packet.crcOk ? "" : '<span class="aprs-badge aprs-badge-crc">CRC</span>') + (options.distance ? `<span class="decode-line-distance">${escapeAprsHtml(options.distance)}</span>` : "") + `</summary><div class="decode-expanded"><div class="decode-expanded-meta"><span>&gt;${escapeAprsHtml(packet.destCall || "--")}</span><span>${escapeAprsHtml(packet.path || "no path")}</span><span>${escapeAprsHtml(aprsAgeText(packet._tsMs))}</span><span>CRC ${packet.crcOk ? "ok" : "failed"}</span>` + (hasPosition ? `<a class="aprs-pos" href="javascript:void(0)" data-aprs-map="${packet.lat},${packet.lon}">${packet.lat?.toFixed(5)}, ${packet.lon?.toFixed(5)}</a>` : "") + `</div><div class="decode-expanded-raw">${renderAprsInfo(packet)}</div>` + (packet.info_bytes?.length ? `<div class="decode-expanded-bytes">${escapeAprsHtml(aprsHexBytes(packet.info_bytes))}</div>` : "") + `<div class="aprs-row-actions">` + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-map="${packet.lat},${packet.lon}">Map</button>` : "") + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-copy="${packet.lat},${packet.lon}">Copy Coords</button>` : "") + `<a class="aprs-inline-btn" href="${qrzHref}" target="_blank" rel="noopener">QRZ</a>` + (options.onLog && packet.srcCall ? '<button class="aprs-inline-btn" type="button" data-aprs-log="1">Log</button>' : "") + `</div></div>`;
  row.querySelectorAll("[data-aprs-map]").forEach((element) => {
    element.addEventListener("click", (event) => {
      event.preventDefault();
@@ -233,6 +243,15 @@ function renderAprsPacketRow(packet, options = {}) {
      if (Number.isFinite(lat) && Number.isFinite(lon)) options.onMap?.(lat, lon);
    });
  });
+  const logButton = row.querySelector("[data-aprs-log]");
+  if (logButton) {
+    logButton.addEventListener("click", (event) => {
+      event.preventDefault();
+      event.stopPropagation();
+      const grid = packet.lat != null && packet.lon != null ? maidenheadForLatLon(packet.lat, packet.lon) : null;
+      options.onLog?.(packet.srcCall ?? "", grid);
+    });
+  }
  const copyButton = row.querySelector("[data-aprs-copy]");
  if (copyButton) {
    copyButton.addEventListener("click", (event) => {
@@ -152,6 +152,24 @@ function initializeFtxDecoder(config) {
      second: "2-digit"
    });
    row.innerHTML = `<span class="ft8-time">${time}</span><span class="ft8-snr">${snr?.toFixed(1) ?? "--"}</span><span class="ft8-dt">${delta?.toFixed(2) ?? "--"}</span><span class="ft8-freq">${frequency?.toFixed(0) ?? "--"}</span><span class="ft8-msg">${renderMessage(raw)}</span>`;
+    const station = bridge.ft8ExtractLikelyCallsign?.(raw) ?? extractFtxCallsign(raw);
+    if (station) {
+      const log = document.createElement("button");
+      log.type = "button";
+      log.className = "ft8-log-btn";
+      log.textContent = "Log";
+      log.title = `Start a log entry for ${station}`;
+      log.addEventListener("click", (event) => {
+        event.stopPropagation();
+        const details = bridge.ft8ExtractLocatorDetails?.(raw) ?? extractFtxLocatorDetails(raw);
+        bridge.logContact?.({
+          call: station,
+          gridsquare: details.find((detail) => detail.station === station)?.grid,
+          decoder: id
+        });
+      });
+      row.appendChild(log);
+    }
    return row;
  };
  const render = () => {
@@ -1,6 +1,6 @@
 import {
  initializeFtxDecoder
-} from "./chunk-PJ5Q7CWJ.js";
+} from "./chunk-WU5EWJX4.js";
 import "./chunk-S57W63QN.js";
 import "./chunk-KL66PICH.js";

@@ -1,6 +1,6 @@
 import {
  initializeFtxDecoder
-} from "./chunk-PJ5Q7CWJ.js";
+} from "./chunk-WU5EWJX4.js";
 import "./chunk-S57W63QN.js";
 import "./chunk-KL66PICH.js";

@@ -2,7 +2,7 @@ import {
  initializeFt8FamilyBar,
  initializeFtxDecoder,
  installFtxCompatibilityHelpers
-} from "./chunk-PJ5Q7CWJ.js";
+} from "./chunk-WU5EWJX4.js";
 import "./chunk-S57W63QN.js";
 import "./chunk-KL66PICH.js";

@@ -4,7 +4,7 @@ import {
  collapseAprsDuplicates,
  normalizeAprsPacket,
  renderAprsPacketRow
-} from "./chunk-OPEIVJGD.js";
+} from "./chunk-REYSUJQ4.js";
 import {
  forActiveRig,
  isActiveRigDecode
@@ -0,0 +1,449 @@
+import {
+  hasAuthRole
+} from "./chunk-PISLBJGN.js";
+import {
+  hostCore,
+  hostState
+} from "./chunk-KL66PICH.js";
+
+// src/plugins/logbook.ts
+var bridge = window;
+var el = (id) => document.getElementById(id);
+var form = el("log-entry-form");
+var callInput = el("log-call");
+var freqInput = el("log-freq");
+var modeInput = el("log-mode");
+var rstSentInput = el("log-rst-sent");
+var rstRcvdInput = el("log-rst-rcvd");
+var gridInput = el("log-grid");
+var nameInput = el("log-name");
+var commentInput = el("log-comment");
+var operatorInput = el("log-operator");
+var rowsBody = el("log-rows");
+var summaryEl = el("log-summary");
+var workedEl = el("log-worked-before");
+var clockEl = el("log-clock");
+var stationCallEl = el("log-station-callsign");
+var stationRigEl = el("log-station-rig-name");
+var stationGridEl = el("log-station-grid");
+var filterCall = el("log-filter-call");
+var filterBand = el("log-filter-band");
+var filterMode = el("log-filter-mode");
+var importBtn = el("log-import-btn");
+var importFile = el("log-import-file");
+var exportLink = el("log-export-btn");
+var clearBtn = el("log-clear-btn");
+var saveBtn = el("log-save-btn");
+var contestIdInput = el("log-contest-id");
+var stxInput = el("log-stx");
+var srxInput = el("log-srx");
+var statisticsRows = el("log-statistics-rows");
+var cabrilloContest = el("log-cbr-contest");
+var cabrilloCallsign = el("log-cbr-callsign");
+var cabrilloOperator = el("log-cbr-operator");
+var cabrilloPower = el("log-cbr-power");
+var cabrilloScore = el("log-cbr-score");
+var cabrilloExport = el("log-cbr-export");
+var entryStartedAt = null;
+var entryRigId = null;
+var entryRigName = null;
+var entryGrid = null;
+var qsos = [];
+var workedRequest = 0;
+function canWriteLogbook() {
+  return !hostState.authEnabled || hasAuthRole(hostState.authRoles, "write");
+}
+function notify(message, kind) {
+  if (bridge.trxUi.notify) bridge.trxUi.notify(message, kind ? { kind } : void 0);
+  else hostCore.showHint(message, 2e3);
+}
+async function getJson(path) {
+  const response = await fetch(path);
+  if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+  return await response.json();
+}
+function formatFreq(hz) {
+  if (!Number.isFinite(hz) || hz <= 0) return "";
+  return String(Number((hz / 1e6).toFixed(6)));
+}
+function parseFreq(text) {
+  const value = Number(text.trim().replace(/\s+/g, "").replace(",", "."));
+  if (!Number.isFinite(value) || value <= 0) return null;
+  return value < 1e5 ? Math.round(value * 1e6) : Math.round(value);
+}
+function numberOrNull(text) {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) return null;
+  const value = Number(trimmed);
+  return Number.isSafeInteger(value) ? value : null;
+}
+function utcDate(iso) {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
+}
+function utcTime(iso) {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(11, 19);
+}
+async function openEntry(seed = {}) {
+  const params = new URLSearchParams();
+  if (hostState.lastActiveRigId) params.set("remote", hostState.lastActiveRigId);
+  if (seed.decoder) params.set("decoder", seed.decoder);
+  if (seed.call) params.set("call", seed.call);
+  if (seed.gridsquare) params.set("gridsquare", seed.gridsquare);
+  try {
+    const prefill = await getJson(`/api/logbook/prefill?${params.toString()}`);
+    applyPrefill(prefill);
+  } catch (error) {
+    console.error("logbook prefill failed", error);
+  }
+}
+function applyPrefill(prefill) {
+  entryStartedAt = prefill.started_at;
+  entryRigId = prefill.rig_id;
+  entryRigName = prefill.my_rig;
+  if (freqInput) freqInput.value = formatFreq(prefill.freq_hz);
+  if (modeInput) modeInput.value = prefill.submode ?? prefill.mode;
+  if (callInput && prefill.call) callInput.value = prefill.call;
+  if (gridInput && prefill.gridsquare) gridInput.value = prefill.gridsquare;
+  if (stationRigEl) stationRigEl.textContent = prefill.my_rig ?? "no rig";
+  showClock(prefill);
+  updateWorkedBefore();
+}
+function showClock(prefill) {
+  if (!clockEl) return;
+  const time = utcTime(prefill.started_at);
+  const drift = Math.abs(Date.now() - prefill.epoch_ms);
+  clockEl.textContent = drift > 1e3 ? `${time}Z · your clock is ${(drift / 1e3).toFixed(0)}s out` : `${time}Z`;
+  clockEl.classList.toggle("is-adrift", drift > 1e3);
+}
+function resetEntry() {
+  for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput, srxInput]) {
+    if (input) input.value = "";
+  }
+  if (workedEl) workedEl.textContent = "";
+  void openEntry();
+}
+async function submitEntry(event) {
+  event.preventDefault();
+  const call = callInput?.value.trim() ?? "";
+  if (!call) {
+    notify("A contact needs a callsign", "error");
+    callInput?.focus();
+    return;
+  }
+  const freqHz = parseFreq(freqInput?.value ?? "");
+  if (freqHz == null) {
+    notify("A contact needs a frequency", "error");
+    freqInput?.focus();
+    return;
+  }
+  const typedMode = (modeInput?.value ?? "").trim().toUpperCase();
+  const isSideband = typedMode === "USB" || typedMode === "LSB";
+  const body = {
+    // The server stamps the time; this is the one it gave when the entry
+    // opened, so a contact logged five minutes later keeps the time it started.
+    started_at: entryStartedAt,
+    call,
+    freq_hz: freqHz,
+    mode: isSideband ? "SSB" : typedMode,
+    submode: isSideband ? typedMode : null,
+    rst_sent: rstSentInput?.value ?? null,
+    rst_rcvd: rstRcvdInput?.value ?? null,
+    gridsquare: gridInput?.value ?? null,
+    name: nameInput?.value ?? null,
+    comment: commentInput?.value ?? null,
+    contest_id: contestIdInput?.value ?? null,
+    // The exchange is a number when it is a serial and a word when it is a
+    // zone or a section; both are kept, and the log writes whichever it has.
+    stx: numberOrNull(stxInput?.value),
+    stx_string: numberOrNull(stxInput?.value) == null ? stxInput?.value ?? null : null,
+    srx: numberOrNull(srxInput?.value),
+    srx_string: numberOrNull(srxInput?.value) == null ? srxInput?.value ?? null : null,
+    station_callsign: stationCallEl?.textContent?.trim() ?? null,
+    operator: operatorInput?.value ?? null,
+    my_gridsquare: entryGrid,
+    my_rig: entryRigName,
+    rig_id: entryRigId
+  };
+  if (saveBtn) saveBtn.disabled = true;
+  try {
+    const response = await fetch("/api/logbook", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const detail = await response.json().catch(() => ({}));
+      throw new Error(detail.error ?? `HTTP ${String(response.status)}`);
+    }
+    notify(`${call} logged`);
+    const sent = numberOrNull(stxInput?.value);
+    resetEntry();
+    if (stxInput && sent != null) stxInput.value = String(sent + 1);
+    await refreshLog();
+  } catch (error) {
+    notify(`Could not log: ${error instanceof Error ? error.message : String(error)}`, "error");
+  } finally {
+    if (saveBtn) saveBtn.disabled = false;
+  }
+}
+function updateWorkedBefore() {
+  if (!workedEl) return;
+  const call = callInput?.value.trim() ?? "";
+  if (call.length < 3) {
+    workedEl.textContent = "";
+    return;
+  }
+  const request = ++workedRequest;
+  void getJson(
+    `/api/logbook/worked/${encodeURIComponent(call)}`
+  ).then((answer) => {
+    if (request !== workedRequest || !workedEl) return;
+    if (answer.worked.length === 0) {
+      workedEl.textContent = "Not worked before";
+      workedEl.classList.remove("is-worked");
+      return;
+    }
+    const where = answer.worked.map((entry) => `${entry.band} ${entry.mode}`).join(", ");
+    workedEl.textContent = `Worked before: ${where}`;
+    workedEl.classList.add("is-worked");
+  }).catch(() => {
+  });
+}
+function currentQuery() {
+  const params = new URLSearchParams();
+  const call = filterCall?.value.trim();
+  if (call) params.set("call", call);
+  if (filterBand?.value) params.set("band", filterBand.value);
+  if (filterMode?.value) params.set("mode", filterMode.value);
+  return params.toString();
+}
+async function refreshLog() {
+  try {
+    const query = currentQuery();
+    const answer = await getJson(
+      `/api/logbook${query ? `?${query}` : ""}`
+    );
+    qsos = answer.qsos;
+    renderRows();
+    renderFilterOptions();
+    if (summaryEl) {
+      summaryEl.textContent = query ? `${String(qsos.length)} of ${String(answer.total)} contacts` : `${String(answer.total)} contact${answer.total === 1 ? "" : "s"}`;
+    }
+    if (exportLink) exportLink.href = `/api/logbook/export.adi${query ? `?${query}` : ""}`;
+    await refreshStatistics();
+  } catch (error) {
+    console.error("logbook read failed", error);
+  }
+}
+async function refreshStatistics() {
+  if (!statisticsRows) return;
+  try {
+    const answer = await getJson("/api/logbook/statistics");
+    if (answer.bands.length === 0) {
+      statisticsRows.innerHTML = '<tr><td colspan="4" class="log-empty">Nothing worked yet.</td></tr>';
+      return;
+    }
+    const fragment = document.createDocumentFragment();
+    for (const band of answer.bands) {
+      const row = document.createElement("tr");
+      for (const value of [band.band, band.contacts, band.stations, band.confirmed]) {
+        const cell = document.createElement("td");
+        cell.textContent = String(value);
+        row.appendChild(cell);
+      }
+      fragment.appendChild(row);
+    }
+    statisticsRows.replaceChildren(fragment);
+  } catch (error) {
+    console.error("logbook statistics failed", error);
+  }
+}
+function syncCabrilloLink() {
+  if (!cabrilloExport) return;
+  const params = new URLSearchParams();
+  const contest = cabrilloContest?.value.trim();
+  if (contest) {
+    params.set("contest", contest);
+  }
+  const callsign = cabrilloCallsign?.value.trim() || (stationCallEl?.textContent?.trim() ?? "");
+  if (callsign) params.set("callsign", callsign);
+  if (cabrilloOperator?.value) params.set("category_operator", cabrilloOperator.value);
+  if (cabrilloPower?.value) params.set("category_power", cabrilloPower.value);
+  const score = numberOrNull(cabrilloScore?.value);
+  if (score != null) params.set("claimed_score", String(score));
+  const operator = operatorInput?.value.trim();
+  if (operator) params.set("operators", operator);
+  cabrilloExport.href = `/api/logbook/export.cbr?${params.toString()}`;
+}
+function renderRows() {
+  if (!rowsBody) return;
+  if (qsos.length === 0) {
+    rowsBody.innerHTML = '<tr><td colspan="10" class="log-empty">No contacts yet. Work someone and log them here, or bring a log in with Import ADIF.</td></tr>';
+    return;
+  }
+  const fragment = document.createDocumentFragment();
+  for (const qso of qsos) {
+    const row = document.createElement("tr");
+    row.dataset.qsoId = qso.id;
+    const cells = [
+      utcDate(qso.started_at),
+      utcTime(qso.started_at),
+      qso.call,
+      qso.band ?? "",
+      qso.submode ?? qso.mode,
+      qso.rst_sent ?? "",
+      qso.rst_rcvd ?? "",
+      qso.gridsquare ?? "",
+      qso.my_rig ?? "",
+      qso.confirmed ? "✓" : ""
+    ];
+    for (const [index, value] of cells.entries()) {
+      const cell = document.createElement("td");
+      cell.textContent = value ?? "";
+      if (index === 2) cell.className = "log-cell-call";
+      row.appendChild(cell);
+    }
+    const actions = document.createElement("td");
+    if (!canWriteLogbook()) {
+      row.appendChild(actions);
+      fragment.appendChild(row);
+      continue;
+    }
+    const confirm = document.createElement("button");
+    confirm.type = "button";
+    confirm.className = "log-row-btn";
+    confirm.textContent = qso.confirmed ? "Unconfirm" : "Confirm";
+    confirm.title = qso.confirmed ? "Mark this contact as not confirmed" : "Mark this contact confirmed by QSL";
+    confirm.addEventListener("click", () => {
+      void setConfirmed(qso, !qso.confirmed);
+    });
+    actions.appendChild(confirm);
+    const remove = document.createElement("button");
+    remove.type = "button";
+    remove.className = "log-row-btn";
+    remove.textContent = "Delete";
+    remove.setAttribute("aria-label", `Delete the contact with ${qso.call}`);
+    remove.addEventListener("click", () => {
+      void deleteQso(qso);
+    });
+    actions.appendChild(remove);
+    row.appendChild(actions);
+    fragment.appendChild(row);
+  }
+  rowsBody.replaceChildren(fragment);
+}
+function renderFilterOptions() {
+  for (const [select, values] of [
+    [filterBand, [...new Set(qsos.map((q) => q.band).filter((b) => !!b))]],
+    [filterMode, [...new Set(qsos.map((q) => q.submode ?? q.mode).filter(Boolean))]]
+  ]) {
+    if (!select) continue;
+    const chosen = select.value;
+    const known = new Set([...select.options].map((option) => option.value));
+    for (const value of [...values].sort()) {
+      if (known.has(value)) continue;
+      select.add(new Option(value, value));
+    }
+    select.value = chosen;
+  }
+}
+async function setConfirmed(qso, confirmed) {
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ...qso,
+        // A card is a card: this is the paper one, and an electronic
+        // confirmation the log already holds is left where it is.
+        qsl_rcvd: confirmed ? "Y" : "N"
+      })
+    });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error) {
+    notify(`Could not update: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+async function deleteQso(qso) {
+  const confirmed = await bridge.trxUi.confirm({
+    title: "Delete this contact?",
+    message: `${qso.call} on ${qso.band ?? formatFreq(qso.freq_hz)} will be removed from the log.`,
+    confirmLabel: "Delete"
+  });
+  if (!confirmed) return;
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, { method: "DELETE" });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error) {
+    notify(`Could not delete: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+async function importAdif(file) {
+  try {
+    const response = await fetch("/api/logbook/import", { method: "POST", body: await file.arrayBuffer() });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    const outcome = await response.json();
+    const parts = [`${String(outcome.added)} added`];
+    if (outcome.duplicate > 0) parts.push(`${String(outcome.duplicate)} already held`);
+    if (outcome.rejected.length > 0) parts.push(`${String(outcome.rejected.length)} not readable`);
+    notify(parts.join(", "));
+    await refreshLog();
+  } catch (error) {
+    notify(`Import failed: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+function renderStation() {
+  const callsign = hostState.ownerCallsign ?? "";
+  if (stationCallEl) stationCallEl.textContent = callsign || "no callsign set";
+  if (operatorInput && !operatorInput.value) operatorInput.value = callsign;
+  if (stationGridEl) {
+    const grid = hostState.serverLat != null && hostState.serverLon != null ? hostCore.latLonToMaidenhead(hostState.serverLat, hostState.serverLon) : "";
+    entryGrid = grid || null;
+    stationGridEl.textContent = grid;
+  }
+}
+form?.addEventListener("submit", (event) => {
+  void submitEntry(event);
+});
+clearBtn?.addEventListener("click", resetEntry);
+callInput?.addEventListener("input", updateWorkedBefore);
+for (const control of [filterCall, filterBand, filterMode]) {
+  control?.addEventListener("input", () => {
+    void refreshLog();
+  });
+  control?.addEventListener("change", () => {
+    void refreshLog();
+  });
+}
+for (const control of [cabrilloContest, cabrilloCallsign, cabrilloOperator, cabrilloPower, cabrilloScore]) {
+  control?.addEventListener("input", syncCabrilloLink);
+  control?.addEventListener("change", syncCabrilloLink);
+}
+importBtn?.addEventListener("click", () => {
+  importFile?.click();
+});
+importFile?.addEventListener("change", () => {
+  const file = importFile.files?.[0];
+  if (file) void importAdif(file);
+  importFile.value = "";
+});
+if (canWriteLogbook()) {
+  bridge.logContact = (seed) => {
+    bridge.navigateToTab?.("logbook");
+    void openEntry(seed).then(() => callInput?.focus());
+  };
+} else {
+  if (form) form.style.display = "none";
+  if (importBtn) importBtn.style.display = "none";
+}
+renderStation();
+if (cabrilloCallsign && !cabrilloCallsign.value) {
+  cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
+}
+syncCabrilloLink();
+if (canWriteLogbook()) void openEntry();
+void refreshLog();
@@ -1,6 +1,6 @@
 import {
  aprsSymbolSprite
-} from "./chunk-OPEIVJGD.js";
+} from "./chunk-REYSUJQ4.js";

 // src/map-core.ts
 function mapEl(id) {
@@ -1,3 +1,6 @@
+import {
+  hasAuthRole
+} from "./chunk-PISLBJGN.js";
 import {
  hostState
 } from "./chunk-KL66PICH.js";
@@ -15,7 +18,7 @@ function schedulerOptionalEl(id) {
 }
 (function() {
  "use strict";
-  let schedulerRole = null;
+  let schedulerRoles = [];
  let currentRigId = null;
  let currentConfig = null;
  let currentSchedulerStatus = null;
@@ -25,8 +28,8 @@ function schedulerOptionalEl(id) {
  let schedulerStepPending = false;
  let schEntryEditIdx = null;
  let schedulerDirty = false;
-  function initScheduler(rigId, role) {
-    schedulerRole = role;
+  function initScheduler(rigId, roles) {
+    schedulerRoles = roles;
    currentRigId = rigId || null;
    if (currentRigId) loadScheduler();
    startStatusPolling();
@@ -272,7 +275,7 @@ function schedulerOptionalEl(id) {
    const nextBtn = schedulerEl("scheduler-next-btn");
    if (!prevBtn || !nextBtn) return;
    const state = schedulerInterleaveState(currentConfig);
-    const enabled = schedulerRole === "control" && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
+    const enabled = hasAuthRole(schedulerRoles, "control") && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
    prevBtn.disabled = !enabled;
    nextBtn.disabled = !enabled;
    const hint = enabled ? "Select a different active scheduler entry" : "Available only when multiple scheduler entries are active";
@@ -354,7 +357,7 @@ function schedulerOptionalEl(id) {
    const panel = schedulerEl("scheduler-panel");
    if (!panel) return;
    const mode = currentConfig && currentConfig.mode || "disabled";
-    const isControl = schedulerRole === "control";
+    const isControl = hasAuthRole(schedulerRoles, "control");
    setSelected("scheduler-mode-select", mode);
    const satEnabled = currentConfig && currentConfig.satellites && currentConfig.satellites.enabled;
    const controlRow = document.querySelector(".scheduler-control-row");
@@ -1220,8 +1223,8 @@ function schedulerOptionalEl(id) {
    markDirty: markSchedulerDirty
  };
  schedulerWindow.trx.modules.scheduler = schedulerService;
-  if (hostState.authRole != null) {
-    initScheduler(hostState.lastActiveRigId, hostState.authRole);
+  if (!hostState.authEnabled || hostState.authRoles.length > 0) {
+    initScheduler(hostState.lastActiveRigId, hostState.authRoles);
    wireSchedulerEvents();
  }
 })();
@@ -22,6 +22,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
  <svg xmlns="http://www.w3.org/2000/svg" style="display:none">
    <symbol id="icon-home" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M2.8 7 8 2.9 13.2 7"/><path d="M4.3 5.9V13h7.4V5.9"/><path d="M6.8 13V9.3h2.4V13"/></symbol>
    <symbol id="icon-bookmark" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M4 2h8v12l-4-2.5L4 14V2z"/></symbol>
+    <symbol id="icon-logbook" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3.5 2h8a1 1 0 0 1 1 1v10a1 1 0 0 1-1 1h-8a1 1 0 0 1-1-1V3a1 1 0 0 1 1-1z"/><path d="M5.5 2v12"/><path d="M7.5 5.5h3M7.5 8h3M7.5 10.5h2"/></symbol>
    <symbol id="icon-digital" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M1 11.5h2.6V4.5h3.2v7h3.2v-7h3.2v7H15"/></symbol>
    <symbol id="icon-map" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M8 2a4 4 0 0 1 4 4c0 3-4 8-4 8S4 9 4 6a4 4 0 0 1 4-4z"/><circle cx="8" cy="6" r="1.2" fill="currentColor" stroke="none"/></symbol>
    <symbol id="icon-satellite" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M2 13.2 5.6 9.6"/><path d="M4.2 8.2a3.4 3.4 0 0 1 4.8 4.8z"/><path d="M9.2 6.6a3.2 3.2 0 0 1 2.6 2.6"/><path d="M9.8 3.6a6.2 6.2 0 0 1 5.2 5.2"/></symbol>
@@ -53,6 +54,10 @@ SPDX-License-Identifier: GPL-2.0-or-later
            <svg class="tab-icon" aria-hidden="true"><use href="#icon-bookmark"/></svg>
            <span class="tab-label">Bookmarks</span>
          </button>
+          <button class="tab" data-tab="logbook">
+            <svg class="tab-icon" aria-hidden="true"><use href="#icon-logbook"/></svg>
+            <span class="tab-label">Logbook</span>
+          </button>
          <button class="tab" data-tab="digital-modes" aria-label="Digital modes">
            <svg class="tab-icon" aria-hidden="true"><use href="#icon-digital"/></svg>
            <span class="tab-label">Digital modes</span>
@@ -118,13 +123,13 @@ SPDX-License-Identifier: GPL-2.0-or-later
    <div id="auth-gate" class="auth-gate" style="display:none;">
      <div class="auth-gate-head">
        <div class="auth-gate-title">Access Required</div>
-        <div class="auth-gate-sub">Enter passphrase to continue</div>
+        <div class="auth-gate-sub">Sign in to continue</div>
      </div>
      <form id="auth-form" class="auth-form">
-        <input type="password" id="auth-passphrase" class="auth-input" placeholder="Passphrase" autocomplete="off" />
+        <input type="text" id="auth-username" class="auth-input" placeholder="Username" autocomplete="username" required />
+        <input type="password" id="auth-password" class="auth-input" placeholder="Password" autocomplete="current-password" maxlength="1024" required />
        <button type="submit" class="auth-submit">Login</button>
      </form>
-      <button id="auth-guest-btn" type="button" class="auth-guest" style="display: none;">Continue as Guest</button>
      <div id="auth-error" class="auth-error" style="display: none;"></div>
      <div id="auth-role" class="auth-role" style="display: none;"></div>
    </div>
@@ -380,6 +385,14 @@ SPDX-License-Identifier: GPL-2.0-or-later
                  </label>
                  <button id="sdr-nb-threshold-set" type="button" class="wfm-inline-btn">Set</button>
                </div>
+                <label class="wfm-control" id="sdr-dig-sideband-wrap" style="display:none;">
+                  <span class="wfm-control-label" title="Sideband used to demodulate DIG. Auto = USB &ge; 10 MHz, LSB below.">DIG sideband</span>
+                  <select id="sdr-dig-sideband" class="status-input">
+                    <option value="auto">Auto (by band)</option>
+                    <option value="usb">USB</option>
+                    <option value="lsb">LSB</option>
+                  </select>
+                </label>
              </div>
            </div>
            <div class="full-row label-below-row" id="vchan-row">
@@ -480,6 +493,192 @@ SPDX-License-Identifier: GPL-2.0-or-later
    </div>
    </div>
    </div>
+    <div id="tab-logbook" class="tab-panel" style="display:none;">
+      <div id="logbook-panel" class="log-panel">
+        <!-- Station: who the contacts are logged under, and from where. Shown
+             once rather than typed into every entry. -->
+        <div class="log-station">
+          <div class="log-station-identity">
+            <span class="log-station-call" id="log-station-callsign">--</span>
+            <label class="log-station-operator">
+              <span>Operator</span>
+              <input type="text" id="log-operator" class="status-input" autocomplete="off"
+                     spellcheck="false" aria-label="Operator callsign" />
+            </label>
+          </div>
+          <div class="log-station-rig">
+            <span id="log-station-rig-name">--</span>
+            <span id="log-station-grid" class="log-station-grid"></span>
+            <span id="log-clock" class="log-clock" aria-live="polite"></span>
+          </div>
+        </div>
+
+        <!-- Entry: opens pre-filled with the six fields the radio and the clock
+             can answer for. Everything else is the operator's. -->
+        <form id="log-entry-form" class="log-entry" autocomplete="off">
+          <div class="log-entry-grid">
+            <label class="log-field log-field-call">
+              <span>Callsign</span>
+              <input type="text" id="log-call" class="status-input" required
+                     spellcheck="false" aria-describedby="log-worked-before" />
+            </label>
+            <label class="log-field">
+              <span>Frequency</span>
+              <input type="text" id="log-freq" class="status-input" inputmode="decimal" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>Mode</span>
+              <input type="text" id="log-mode" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>RST sent</span>
+              <input type="text" id="log-rst-sent" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>RST rcvd</span>
+              <input type="text" id="log-rst-rcvd" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>Locator</span>
+              <input type="text" id="log-grid" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field">
+              <span>Name</span>
+              <input type="text" id="log-name" class="status-input" />
+            </label>
+            <label class="log-field">
+              <span>Comment</span>
+              <input type="text" id="log-comment" class="status-input" />
+            </label>
+          </div>
+          <details class="log-contest" id="log-contest-block">
+            <summary>Contest exchange</summary>
+            <div class="log-entry-grid">
+              <label class="log-field">
+                <span>Contest</span>
+                <input type="text" id="log-contest-id" class="status-input" spellcheck="false"
+                       placeholder="CQ-WW-SSB" />
+              </label>
+              <label class="log-field log-field-narrow">
+                <span>Serial sent</span>
+                <input type="text" id="log-stx" class="status-input" inputmode="numeric" />
+              </label>
+              <label class="log-field log-field-narrow">
+                <span>Received</span>
+                <input type="text" id="log-srx" class="status-input" />
+              </label>
+            </div>
+          </details>
+          <div class="log-entry-actions">
+            <span id="log-worked-before" class="log-worked" aria-live="polite"></span>
+            <span class="log-entry-buttons">
+              <button type="button" id="log-clear-btn" class="log-secondary-btn">Clear</button>
+              <button type="submit" id="log-save-btn" class="log-primary-btn">Log contact</button>
+            </span>
+          </div>
+        </form>
+
+        <!-- The log itself. -->
+        <div class="log-list-toolbar">
+          <input type="text" id="log-filter-call" class="status-input" placeholder="Callsign&hellip;"
+                 aria-label="Filter by callsign" />
+          <select id="log-filter-band" class="status-input" aria-label="Filter by band">
+            <option value="">All bands</option>
+          </select>
+          <select id="log-filter-mode" class="status-input" aria-label="Filter by mode">
+            <option value="">All modes</option>
+          </select>
+          <span class="log-toolbar-spacer"></span>
+          <a id="log-export-btn" class="log-secondary-btn" href="/api/logbook/export.adi"
+             download>Export ADIF</a>
+          <button type="button" id="log-import-btn" class="log-secondary-btn">Import ADIF</button>
+          <input type="file" id="log-import-file" accept=".adi,.adif,text/plain" hidden />
+        </div>
+        <div class="log-table-wrap">
+          <table class="log-table">
+            <thead>
+              <tr>
+                <th scope="col">Date</th>
+                <th scope="col">Time</th>
+                <th scope="col">Callsign</th>
+                <th scope="col">Band</th>
+                <th scope="col">Mode</th>
+                <th scope="col">Sent</th>
+                <th scope="col">Rcvd</th>
+                <th scope="col">Locator</th>
+                <th scope="col">Rig</th>
+                <th scope="col">QSL</th>
+                <th scope="col"><span class="visually-hidden">Actions</span></th>
+              </tr>
+            </thead>
+            <tbody id="log-rows"></tbody>
+          </table>
+        </div>
+        <div id="log-summary" class="log-summary" aria-live="polite"></div>
+
+        <details class="log-report" id="log-statistics-block">
+          <summary>Bands worked</summary>
+          <div class="log-table-wrap">
+            <table class="log-table">
+              <thead>
+                <tr>
+                  <th scope="col">Band</th>
+                  <th scope="col">Contacts</th>
+                  <th scope="col">Stations</th>
+                  <th scope="col">Confirmed</th>
+                </tr>
+              </thead>
+              <tbody id="log-statistics-rows"></tbody>
+            </table>
+          </div>
+        </details>
+
+        <details class="log-report" id="log-contest-export-block">
+          <summary>Contest entry (Cabrillo)</summary>
+          <p class="log-report-note">
+            Contest logs are submitted in Cabrillo and rejected in anything else.
+            Only the contacts of the contest named here go into the entry.
+          </p>
+          <div class="log-entry-grid">
+            <label class="log-field">
+              <span>Contest</span>
+              <input type="text" id="log-cbr-contest" class="status-input" spellcheck="false"
+                     placeholder="CQ-WW-SSB" />
+            </label>
+            <label class="log-field">
+              <span>Callsign</span>
+              <input type="text" id="log-cbr-callsign" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field">
+              <span>Operators</span>
+              <select id="log-cbr-operator" class="status-input">
+                <option value="SINGLE-OP">Single operator</option>
+                <option value="MULTI-OP">Multi operator</option>
+                <option value="CHECKLOG">Checklog</option>
+              </select>
+            </label>
+            <label class="log-field">
+              <span>Power</span>
+              <select id="log-cbr-power" class="status-input">
+                <option value="LOW">Low</option>
+                <option value="HIGH">High</option>
+                <option value="QRP">QRP</option>
+              </select>
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>Claimed score</span>
+              <input type="text" id="log-cbr-score" class="status-input" inputmode="numeric" />
+            </label>
+          </div>
+          <div class="log-entry-actions">
+            <span class="log-entry-buttons">
+              <a id="log-cbr-export" class="log-secondary-btn" href="/api/logbook/export.cbr"
+                 download>Export Cabrillo</a>
+            </span>
+          </div>
+        </details>
+      </div>
+    </div>
    <div id="tab-bookmarks" class="tab-panel" style="display:none;">
      <div class="bm-toolbar">
        <select id="bm-scope-picker" class="status-input" aria-label="Bookmark scope">
@@ -530,6 +729,14 @@ SPDX-License-Identifier: GPL-2.0-or-later
            <label class="bm-label">Bandwidth (Hz)
              <input type="number" id="bm-bw" class="status-input" min="0" placeholder="optional" />
            </label>
+            <label class="bm-label" id="bm-dig-sideband-label" style="display:none;">DIG sideband
+              <select id="bm-dig-sideband" class="status-input">
+                <option value="">Global setting</option>
+                <option value="auto">Auto (by band)</option>
+                <option value="usb">USB</option>
+                <option value="lsb">LSB</option>
+              </select>
+            </label>
            <label class="bm-label">Locator
              <input type="text" id="bm-locator" class="status-input" maxlength="6" placeholder="e.g. JO93" />
            </label>
@@ -1270,6 +1477,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
        <button class="sub-tab" data-subtab="settings-background-decode">Background Decode</button>
        <button class="sub-tab" data-subtab="settings-bandplan">Bandplan</button>
        <button class="sub-tab" data-subtab="settings-history">History</button>
+        <button id="settings-account-tab" class="sub-tab" data-subtab="settings-account" style="display:none;">Account</button>
+        <button id="settings-users-tab" class="sub-tab" data-subtab="settings-users" style="display:none;">Users</button>
      </div>
      <div id="subtab-settings-scheduler" class="sub-tab-panel">
        <div id="scheduler-panel" class="sch-panel">
@@ -1559,6 +1768,34 @@ SPDX-License-Identifier: GPL-2.0-or-later
          </div>
        </div>
      </div>
+      <div id="subtab-settings-account" class="sub-tab-panel" style="display:none;">
+        <div class="settings-card">
+          <h3>Change password</h3>
+          <form id="account-password-form" class="sch-row" style="flex-wrap:wrap; gap:.5rem;">
+            <input id="account-current-password" class="auth-input" type="password" placeholder="Current password" autocomplete="current-password" maxlength="1024" required />
+            <input id="account-new-password" class="auth-input" type="password" placeholder="New password (8+ characters)" autocomplete="new-password" minlength="8" maxlength="1024" required />
+            <input id="account-confirm-password" class="auth-input" type="password" placeholder="Confirm new password" autocomplete="new-password" minlength="8" maxlength="1024" required />
+            <button type="submit" class="auth-submit">Change password</button>
+          </form>
+          <div id="account-password-error" class="auth-error" role="alert" aria-live="polite" style="display:none;"></div>
+          <p class="settings-note">Changing your password signs out every session for this account.</p>
+        </div>
+      </div>
+      <div id="subtab-settings-users" class="sub-tab-panel" style="display:none;">
+        <div id="user-management">
+        <div class="settings-card">
+          <form id="user-create-form" class="sch-row" style="flex-wrap:wrap; gap:.5rem;">
+            <input id="user-create-username" class="auth-input" placeholder="Username" autocomplete="off" required />
+            <input id="user-create-password" class="auth-input" type="password" placeholder="Password (8+ characters)" autocomplete="new-password" minlength="8" maxlength="1024" required />
+            <span id="user-create-roles" class="auth-role-choices"></span>
+            <label class="auth-role-choice"><input id="user-create-enabled" type="checkbox" checked /> Enabled</label>
+            <button type="submit" class="auth-submit">Add user</button>
+          </form>
+          <div id="user-management-error" class="auth-error" style="display:none;"></div>
+          <div id="user-list" style="margin-top:.75rem;"></div>
+        </div>
+        </div>
+      </div>
    </div>
    <div id="tab-about" class="tab-panel" style="display:none;">
      <h2 class="section-heading">About</h2>
@@ -196,8 +196,7 @@ body {
  font-size: var(--fs-base);
  box-sizing: border-box;
 }
-.auth-submit,
-.auth-guest {
+.auth-submit {
  width: 100%;
  padding: 0.65rem 0.75rem;
  border-radius: var(--radius-md);
@@ -213,16 +212,14 @@ body {
  font-weight: 700;
 }
 .auth-submit:hover:not(:disabled) { background: var(--accent-green-hover); }
-.auth-guest {
-  background: var(--btn-bg);
-  color: var(--text);
-  border: 1px solid var(--border-light);
-  font-weight: 600;
-  margin-top: var(--space-4);
-}
-.auth-guest:hover:not(:disabled) { background: var(--btn-hover-bg); }
 .auth-error { color: var(--accent-red); font-size: var(--fs-sm); margin-top: var(--space-4); }
 .auth-role { margin-top: var(--space-4); color: var(--text-muted); font-size: var(--fs-sm); }
+#user-management .auth-input { width: auto; min-width: 9rem; flex: 1 1 10rem; margin-bottom: 0; }
+#user-management .auth-submit { width: auto; }
+#user-management .auth-role-choices { display: flex; align-items: center; gap: .6rem; flex-wrap: wrap; }
+#user-management .auth-role-choice { display: inline-flex; align-items: center; gap: .2rem; white-space: nowrap; }
+.settings-note { color: var(--text-muted); font-size: .85rem; margin: .75rem 0 0; }
+#user-management button { padding: 0.55rem 0.75rem; }

 .label { color: var(--text-muted); font-size: 0.9rem; margin-bottom: 6px; display: block; }
 #tab-main .label > span {
@@ -6388,3 +6385,280 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
 }

 #tab-statistics > .section-heading { margin-bottom: 0; }
+
+/* =========================================================================
+   Logbook
+   ========================================================================= */
+.log-panel {
+  padding: 1rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.85rem;
+}
+/* Who the contacts are logged under, and from where: shown once, not typed
+   into every entry. */
+.log-station {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  padding: 0.6rem 0.85rem;
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+  background: var(--bg-secondary);
+}
+.log-station-identity {
+  display: flex;
+  align-items: center;
+  gap: 0.85rem;
+  min-width: 0;
+}
+.log-station-call {
+  font-size: 1.05rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  color: var(--text);
+}
+.log-station-operator {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-size: 0.78rem;
+  color: var(--text-muted);
+}
+.log-station-operator input {
+  width: 7rem;
+  text-transform: uppercase;
+}
+.log-station-rig {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  font-size: 0.82rem;
+  color: var(--text-muted);
+  min-width: 0;
+}
+.log-station-grid {
+  font-variant-numeric: tabular-nums;
+}
+.log-clock {
+  font-variant-numeric: tabular-nums;
+  padding: 0.1rem 0.45rem;
+  border-radius: 0.3rem;
+  background: color-mix(in srgb, var(--card-bg) 70%, transparent);
+}
+/* A browser clock that disagrees with the radio's is worth saying out loud:
+   the times in a log are the one thing that cannot be corrected later. */
+.log-clock.is-adrift {
+  color: var(--accent-yellow, #b7791f);
+  font-weight: 600;
+}
+.log-entry {
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+  padding: 0.85rem;
+  background: var(--bg-secondary);
+}
+.log-entry-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(8.5rem, 1fr));
+  gap: 0.6rem 0.75rem;
+}
+.log-field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+  min-width: 0;
+  font-size: 0.75rem;
+  color: var(--text-muted);
+}
+.log-field input {
+  min-width: 0;
+}
+.log-field-call {
+  grid-column: span 2;
+}
+.log-field-call input {
+  font-size: 1.05rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+.log-field-narrow {
+  max-width: 10rem;
+}
+.log-entry-actions {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-top: 0.75rem;
+}
+.log-entry-buttons {
+  display: inline-flex;
+  gap: 0.5rem;
+  margin-left: auto;
+}
+.log-worked {
+  font-size: 0.8rem;
+  color: var(--text-muted);
+}
+.log-worked.is-worked {
+  color: var(--accent-green);
+  font-weight: 600;
+}
+.log-primary-btn {
+  background: var(--accent-green);
+  color: #fff;
+  border: none;
+  border-radius: 0.35rem;
+  padding: 0.4rem 1.1rem;
+  font-weight: 600;
+  cursor: pointer;
+}
+.log-secondary-btn {
+  display: inline-flex;
+  align-items: center;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-light);
+  border-radius: 0.35rem;
+  color: var(--text-muted);
+  padding: 0.35rem 0.75rem;
+  font-size: 0.82rem;
+  text-decoration: none;
+  cursor: pointer;
+}
+.log-secondary-btn:hover {
+  background: var(--card-bg);
+  color: var(--text);
+}
+.log-list-toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.5rem;
+}
+.log-list-toolbar .status-input {
+  max-width: 11rem;
+}
+.log-toolbar-spacer {
+  flex: 1 1 auto;
+}
+.log-table-wrap {
+  overflow-x: auto;
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+}
+.log-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.83rem;
+}
+.log-table th {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  text-align: left;
+  padding: 0.5rem 0.65rem;
+  background: var(--bg-secondary);
+  border-bottom: 1px solid var(--border-light);
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+.log-table td {
+  padding: 0.4rem 0.65rem;
+  border-bottom: 1px solid color-mix(in srgb, var(--border-light) 60%, transparent);
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+}
+.log-table tr:last-child td {
+  border-bottom: none;
+}
+.log-table tbody tr:hover {
+  background: color-mix(in srgb, var(--card-bg) 60%, transparent);
+}
+.log-cell-call {
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  font-variant-numeric: normal;
+}
+.log-row-btn {
+  background: transparent;
+  border: 1px solid var(--border-light);
+  border-radius: 0.3rem;
+  color: var(--text-muted);
+  font-size: 0.75rem;
+  padding: 0.15rem 0.5rem;
+  cursor: pointer;
+}
+.log-row-btn:hover {
+  color: var(--text);
+  background: var(--card-bg);
+}
+.log-empty {
+  padding: 1.5rem 0.75rem;
+  text-align: center;
+  color: var(--text-muted);
+  white-space: normal;
+}
+.log-summary {
+  color: var(--text-muted);
+  font-size: 0.8rem;
+}
+/* The ham layout works the bands: the broadcast furniture goes, and the entry
+   form is the thing the panel opens on. */
+body[data-operator-layout="ham"] .controls-col-wfm { display: none !important; }
+body[data-operator-layout="ham"] #rds-panel { display: none !important; }
+@media (max-width: 700px) {
+  .log-station,
+  .log-entry-actions {
+    flex-direction: column;
+    align-items: stretch;
+  }
+  .log-entry-buttons {
+    margin-left: 0;
+  }
+  .log-field-call {
+    grid-column: span 2;
+  }
+  .log-list-toolbar .status-input {
+    max-width: none;
+    flex: 1 1 8rem;
+  }
+}
+/* Contest exchange and the reports below the log: folded away, because most
+   operating is not a contest and most sessions do not export one. */
+.log-contest,
+.log-report {
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+  background: var(--bg-secondary);
+  padding: 0.5rem 0.85rem;
+}
+.log-contest {
+  margin-top: 0.75rem;
+}
+.log-contest > summary,
+.log-report > summary {
+  cursor: pointer;
+  font-size: 0.78rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--text-muted);
+}
+.log-contest[open] > summary,
+.log-report[open] > summary {
+  margin-bottom: 0.65rem;
+}
+.log-report-note {
+  margin: 0 0 0.65rem;
+  max-width: 62ch;
+  color: var(--text-muted);
+  font-size: 0.8rem;
+  line-height: 1.45;
+}
@@ -12,9 +12,12 @@ use trx_core::rig::{
    RigAccessMethod, RigCapabilities, RigInfo, RigRxStatus, RigStatus, RigTxStatus, RigVfo,
    RigVfoEntry,
 };
-use trx_core::{DecoderConfig, RdsData, RigFilterState, RigMode, RigSnapshot, WfmDenoiseLevel};
+use trx_core::{
+    DecoderConfig, DigSidebandPolicy, RdsData, RigFilterState, RigMode, RigSnapshot, WfmDenoiseLevel,
+};
 use trx_frontend_http::server::api::rig::{RigListItem, RigListResponse};
 use trx_frontend_http::server::api::FrontendMeta;
+use trx_frontend_http::server::auth::AuthRole;
 use trx_protocol::{DecoderActivation, DecoderDescriptor};
 use ts_rs::{Config, TS};

@@ -48,6 +51,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
    export!(RigStatus);
    export!(DecoderConfig);
    export!(WfmDenoiseLevel);
+    export!(DigSidebandPolicy);
    export!(RigFilterState);
    export!(RdsData);
    export!(SpectrumData);
@@ -56,6 +60,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
    export!(RigListItem);
    export!(RigListResponse);
    export!(FrontendMeta);
+    export!(AuthRole);
    export!(DecoderActivation);
    export!(DecoderDescriptor);

@@ -33,6 +33,7 @@ await build({
    "satellite-predictions": path.join(sourceDir, "plugins", "satellite-predictions.ts"),
    vchan: path.join(sourceDir, "plugins", "vchan.ts"),
    bookmarks: path.join(sourceDir, "plugins", "bookmarks.ts"),
+    logbook: path.join(sourceDir, "plugins", "logbook.ts"),
    scheduler: path.join(sourceDir, "plugins", "scheduler.ts"),
    "map-core": path.join(sourceDir, "map-core.ts"),
    screenshot: path.join(sourceDir, "screenshot.ts"),
@@ -12,7 +12,7 @@
    "typecheck": "tsc --project tsconfig.json && tsc --project tsconfig.worker.json",
    "lint": "eslint \"src/**/*.ts\" \"tests/**/*.mjs\" build.mjs --no-error-on-unmatched-pattern",
    "test": "node --test tests/*.test.mjs",
-    "test:browser": "node tests/browser-smoke.mjs && node tests/spectrum-layout.mjs && node tests/decode-flow.mjs && node tests/tune-links.mjs && node tests/mobile-layout.mjs && node tests/satellite-predictions.mjs && node tests/background-decode.mjs",
+    "test:browser": "node tests/browser-smoke.mjs && node tests/spectrum-layout.mjs && node tests/decode-flow.mjs && node tests/tune-links.mjs && node tests/mobile-layout.mjs && node tests/satellite-predictions.mjs && node tests/background-decode.mjs && node tests/logbook.mjs && node tests/account-management.mjs && node tests/transmit-role.mjs",
    "verify-generated": "npm run generate-types && npm run build && git diff --exit-code -- ../assets/web/generated src/api/generated.ts"
  },
  "devDependencies": {
@@ -2,11 +2,51 @@
 //
 // SPDX-License-Identifier: GPL-2.0-or-later

-export type AuthRole = "rx" | "control";
+import type { AuthRole } from "./generated.js";
+
+export type { AuthRole };
+
+export const AUTH_ROLES: readonly AuthRole[] = ["guest", "read", "control", "transmit", "write", "administrator"];
+export const AUTH_ADMIN_ROLES: readonly AuthRole[] = AUTH_ROLES.filter(role => role !== "guest");
+export const AUTH_ROLE_LABELS: Readonly<Record<AuthRole, string>> = {
+  guest: "Guest",
+  read: "Read",
+  control: "Control",
+  transmit: "Transmit",
+  write: "Write",
+  administrator: "Administrator",
+};
+
+export function isAuthRole(value: unknown): value is AuthRole {
+  return typeof value === "string" && (AUTH_ROLES as readonly string[]).includes(value);
+}
+
+export function normalizeAuthRoles(roles: readonly AuthRole[]): AuthRole[] {
+  return AUTH_ROLES.filter(role => roles.includes(role));
+}
+
+export function hasAuthRole(roles: readonly AuthRole[], required: AuthRole): boolean {
+  return roles.includes("administrator")
+    || roles.includes(required)
+    || required === "read" && roles.includes("guest")
+    || required === "read" && (roles.includes("control") || roles.includes("transmit"));
+}
+
+export function hasAccountControls(roles: readonly AuthRole[]): boolean {
+  return roles.length > 0 && !roles.includes("guest");
+}
+
+function decodeRoles(value: unknown, context: string): AuthRole[] {
+  if (!Array.isArray(value) || !value.every(isAuthRole)) {
+    throw new TypeError(`${context} has invalid roles`);
+  }
+  return normalizeAuthRoles(value);
+}

 export interface AuthSession {
  authenticated: boolean;
-  role?: AuthRole;
+  roles: AuthRole[];
+  username?: string;
  auth_disabled?: boolean;
 }

@@ -18,21 +58,24 @@ function decodeAuthSession(value: unknown): AuthSession {
  if (typeof session.authenticated !== "boolean") {
    throw new TypeError("The authentication response has no authenticated flag");
  }
-  if (session.role !== undefined && session.role !== "rx" && session.role !== "control") {
-    throw new TypeError("The authentication response has an invalid role");
-  }
  if (session.auth_disabled !== undefined && typeof session.auth_disabled !== "boolean") {
    throw new TypeError("The authentication response has an invalid auth_disabled flag");
  }
-  const decoded: AuthSession = { authenticated: session.authenticated };
-  if (session.role !== undefined) decoded.role = session.role;
+  const decoded: AuthSession = {
+    authenticated: session.authenticated,
+    roles: decodeRoles(session.roles, "The authentication response"),
+  };
+  if (session.username !== undefined) {
+    if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
+    decoded.username = session.username;
+  }
  if (session.auth_disabled !== undefined) decoded.auth_disabled = session.auth_disabled;
  return decoded;
 }

 const authDisabledSession: AuthSession = {
  authenticated: true,
-  role: "control",
+  roles: [...AUTH_ADMIN_ROLES],
  auth_disabled: true,
 };

@@ -40,19 +83,19 @@ export async function fetchAuthSession(): Promise<AuthSession> {
  try {
    const response = await fetch("/auth/session");
    if (response.status === 404) return authDisabledSession;
-    if (!response.ok) return { authenticated: false };
+    if (!response.ok) return { authenticated: false, roles: [] };
    return decodeAuthSession(await response.json());
  } catch (error: unknown) {
    console.error("Auth check failed:", error);
-    return { authenticated: false };
+    return { authenticated: false, roles: [] };
  }
 }

-export async function login(passphrase: string): Promise<AuthSession> {
+export async function login(username: string, password: string): Promise<AuthSession> {
  const response = await fetch("/auth/login", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ passphrase }),
+    body: JSON.stringify({ username, password }),
  });
  if (response.status === 404) return authDisabledSession;
  if (!response.ok) {
@@ -62,6 +105,52 @@ export async function login(passphrase: string): Promise<AuthSession> {
  return decodeAuthSession(await response.json());
 }

+export interface ManagedUser { username: string; roles: AuthRole[]; enabled: boolean }
+
+async function userRequest(path: string, init?: RequestInit): Promise<Response> {
+  const response = await fetch(path, init);
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({})) as { error?: string };
+    throw new Error(payload.error || `User operation failed (${response.status})`);
+  }
+  return response;
+}
+
+export async function listUsers(): Promise<ManagedUser[]> {
+  const value: unknown = await userRequest("/auth/users").then(response => response.json());
+  if (!Array.isArray(value) || !value.every((user: unknown) => {
+    if (typeof user !== "object" || user === null) return false;
+    const record = user as Record<string, unknown>;
+    return typeof record.username === "string"
+      && typeof record.enabled === "boolean"
+      && Array.isArray(record.roles)
+      && record.roles.every(isAuthRole);
+  })) {
+    throw new TypeError("The user list response is malformed");
+  }
+  return (value as ManagedUser[]).map(user => ({ ...user, roles: normalizeAuthRoles(user.roles) }));
+}
+
+export async function createUser(username: string, password: string, roles: AuthRole[], enabled = true): Promise<void> {
+  await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, roles, enabled }) });
+}
+
+export async function updateUser(username: string, changes: { password?: string; roles?: AuthRole[]; enabled?: boolean }): Promise<void> {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
+}
+
+export async function changeOwnPassword(currentPassword: string, newPassword: string): Promise<void> {
+  await userRequest("/auth/account/password", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ current_password: currentPassword, new_password: newPassword }),
+  });
+}
+
+export async function deleteUser(username: string): Promise<void> {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
+}
+
 export async function logout(): Promise<void> {
  const response = await fetch("/auth/logout", { method: "POST" });
  if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
@@ -55,7 +55,14 @@ export type DecoderConfig = { aprs_decode_enabled: boolean, hf_aprs_decode_enabl

 export type WfmDenoiseLevel = "off" | "auto" | "low" | "medium" | "high";

-export type RigFilterState = { bandwidth_hz: number, cw_center_hz: number, sdr_gain_db?: number | null, sdr_lna_gain_db?: number | null, sdr_agc_enabled?: boolean | null, sdr_squelch_enabled?: boolean | null, sdr_squelch_threshold_db?: number | null, sdr_nb_enabled?: boolean | null, sdr_nb_threshold?: number | null, wfm_deemphasis_us: number, wfm_stereo: boolean, wfm_stereo_detected: boolean, wfm_denoise: WfmDenoiseLevel, 
+export type DigSidebandPolicy = "auto" | "usb" | "lsb";
+
+export type RigFilterState = { bandwidth_hz: number, cw_center_hz: number, sdr_gain_db?: number | null, sdr_lna_gain_db?: number | null, sdr_agc_enabled?: boolean | null, sdr_squelch_enabled?: boolean | null, sdr_squelch_threshold_db?: number | null, sdr_nb_enabled?: boolean | null, sdr_nb_threshold?: number | null, 
+/**
+ * Current DIG sideband policy (SDR backends only). Surfaces in the UI as
+ * the advanced-controls "DIG sideband" selector.
+ */
+sdr_dig_sideband?: DigSidebandPolicy | null, wfm_deemphasis_us: number, wfm_stereo: boolean, wfm_stereo_detected: boolean, wfm_denoise: WfmDenoiseLevel, 
 /**
 * Co-Channel Interference level (0–100 scale).
 */
@@ -123,6 +130,8 @@ export type RigListResponse = { active_remote: string | null, rigs: Array<RigLis

 export type FrontendMeta = { clients: number, rigctl_clients: number, audio_clients: number, rigctl_addr: string | null, active_remote: string | null, remotes: Array<string>, owner_callsign: string | null, owner_website_url: string | null, owner_website_name: string | null, ais_vessel_url_base: string | null, show_sdr_gain_control: boolean, initial_map_zoom: number, spectrum_coverage_margin_hz: number, spectrum_usable_span_ratio: number, bandplan_enabled: boolean, bandplan_region: string, decode_history_retention_min: bigint, server_connected: boolean, };

+export type AuthRole = "guest" | "read" | "control" | "transmit" | "write" | "administrator";
+
 export type DecoderActivation = "mode_bound" | "toggle";

 export type DecoderDescriptor = { 
@@ -21,6 +21,17 @@ import {
  fetchAuthSession,
  login,
  logout,
+  listUsers,
+  createUser,
+  updateUser,
+  deleteUser,
+  changeOwnPassword,
+  AUTH_ADMIN_ROLES,
+  AUTH_ROLES,
+  AUTH_ROLE_LABELS,
+  hasAccountControls,
+  hasAuthRole as rolesInclude,
+  normalizeAuthRoles,
 } from "./api/auth.js";
 import {
  formatByteSize as recorderFormatSize,
@@ -189,8 +200,8 @@ interface TrxModules {
    reverseGeocodeLocation(lat: number, lon: number, grid: string): void;
    bandForHz(frequencyHz: number): unknown;
  };
-  scheduler?: { initialize(rigId: string | null, role: AuthRole | null): void; setRig(rigId: string | null): void; wireEvents(): void };
-  backgroundDecode?: { initialize(rigId: string | null, role: AuthRole | null): void; setRig(rigId: string | null): void; wireEvents(): void };
+  scheduler?: { initialize(rigId: string | null, roles: readonly AuthRole[]): void; setRig(rigId: string | null): void; wireEvents(): void };
+  backgroundDecode?: { initialize(rigId: string | null, roles: readonly AuthRole[]): void; setRig(rigId: string | null): void; wireEvents(): void };
  bookmarks?: {
    readonly overlayList: readonly Bookmark[];
    readonly overlayRevision: number;
@@ -226,7 +237,7 @@ interface TrxState {
  readonly initialMapZoom: number;
  readonly decodeHistoryRetentionMin: number;
  readonly authEnabled: boolean;
-  readonly authRole: AuthRole | null;
+  readonly authRoles: readonly AuthRole[];
  readonly decoderRegistry: typeof decoderRegistry;
  readonly sseSessionId: string | null;
  readonly primaryRds: RdsData | null;
@@ -265,7 +276,7 @@ interface TrxUi {
  confirm(options?: { title?: string; message?: string; confirmLabel?: string; danger?: boolean }): Promise<boolean>;
  notify(message: string, options?: { kind?: "info" | "error" | "success" | "warning"; duration?: number; action?: { label?: string; run(): void } | null }): HTMLDivElement;
  setActiveRig(rigId: string | null): void;
-  setLayoutCapabilities(capabilities?: Partial<Record<"broadcast" | "digital", boolean>>): void;
+  setLayoutCapabilities(capabilities?: Partial<Record<"broadcast" | "digital" | "ham", boolean>>): void;
  setButtonState(element: HTMLButtonElement | null, options?: { active?: boolean; activeLabel?: string; inactiveLabel?: string; busy?: boolean; disabled?: boolean }): void;
  closeMobileOverlays?(restoreFocus?: boolean): void;
  syncSelectedTab(container: HTMLElement | null, selected: Element): void;
@@ -406,40 +417,76 @@ declare global {
 void loadDecoderRegistry(refreshOperatorLayoutCapabilities);

 // --- Authentication ---
-let authRole: AuthRole | null = null;
+let authRoles: AuthRole[] = [];
+let authUsername: string | null = null;
 let authEnabled = true;

+function setAuthRoles(roles: readonly AuthRole[]) {
+  authRoles = normalizeAuthRoles(roles);
+}
+
+function hasAuthRole(role: AuthRole) {
+  return rolesInclude(authRoles, role);
+}
+
+function buildRoleChoices(selected: readonly AuthRole[]) {
+  const element = document.createElement("span");
+  element.className = "auth-role-choices";
+  const inputs = AUTH_ROLES.map((value) => {
+    const label = document.createElement("label");
+    label.className = "auth-role-choice";
+    const input = document.createElement("input");
+    input.type = "checkbox";
+    input.value = value;
+    input.checked = selected.includes(value);
+    label.append(input, ` ${AUTH_ROLE_LABELS[value]}`);
+    element.append(label);
+    return { input, value };
+  });
+  inputs.forEach(({ input, value }) => {
+    input.addEventListener("change", () => {
+      if (!input.checked) return;
+      if (value === "guest") {
+        const administrator = inputs.find(choice => choice.value === "administrator");
+        if (administrator) administrator.input.checked = false;
+      } else if (value === "administrator") {
+        const guest = inputs.find(choice => choice.value === "guest");
+        if (guest) guest.input.checked = false;
+      }
+    });
+  });
+  return { element, inputs };
+}
+
 async function checkAuthStatus() {
  return fetchAuthSession();
 }

-async function authLogin(passphrase: string) {
-  return login(passphrase);
+async function authLogin(username: string, password: string) {
+  return login(username, password);
 }

 async function authLogout() {
  try {
    await logout();
-    authRole = null;
+    setAuthRoles([]);
+    authUsername = null;
    // Disconnect and show auth gate without page reload
    disconnect();
    setDecodeHistoryOverlayVisible(false);
    requiredElement("content").style.display = "none";
    requiredElement("loading").style.display = "none";
-    requiredElement<HTMLInputElement>("auth-passphrase").value = "";
+    requiredElement<HTMLInputElement>("auth-password").value = "";
    updateAuthUI();

-    // Check if guest mode is available after logout
-    const authStatus = await checkAuthStatus();
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  } catch (e) {
    console.error("Logout failed:", e);
    showAuthError("Logout failed");
  }
 }

-function showAuthGate(allowGuest = false) {
+function showAuthGate() {
  if (!authEnabled) return;
  setDecodeHistoryOverlayVisible(false);
  requiredElement("loading").style.display = "none";
@@ -459,12 +506,6 @@ function showAuthGate(allowGuest = false) {
    panel.style.display = "none";
  });

-  // Show guest button if guest mode is available
-  const guestBtn = document.getElementById("auth-guest-btn");
-  if (guestBtn) {
-    guestBtn.style.display = allowGuest ? "block" : "none";
-  }
-
  document.querySelectorAll<HTMLElement>(".tab-bar .tab").forEach((btn) => {
    btn.classList.toggle("active", btn.dataset.tab === "main");
  });
@@ -506,22 +547,32 @@ function updateAuthUI() {
  const badge = document.getElementById("auth-badge");
  const badgeRole = document.getElementById("auth-role-badge");
  const headerAuthBtn = document.getElementById("header-auth-btn");
+  const accountTab = document.getElementById("settings-account-tab");

  if (!authEnabled) {
    if (badge) badge.style.display = "none";
    if (headerAuthBtn) headerAuthBtn.style.display = "none";
+    if (accountTab) accountTab.style.display = "none";
    syncTopBarAccess();
    return;
  }

-  if (authRole) {
+  if (authRoles.length > 0) {
+    const canManageAccount = hasAccountControls(authRoles);
+    if (accountTab) accountTab.style.display = canManageAccount ? "" : "none";
+    if (!canManageAccount && accountTab?.classList.contains("active")) {
+      const panel = document.getElementById("subtab-settings-account");
+      if (panel) panel.style.display = "none";
+      document.querySelector<HTMLButtonElement>('[data-subtab="settings-scheduler"]')?.click();
+    }
    if (badge) badge.style.display = "block";
-    if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
+    if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map(role => AUTH_ROLE_LABELS[role]).join(", ")}`;
    if (headerAuthBtn) {
      headerAuthBtn.textContent = "Logout";
      headerAuthBtn.style.display = "block";
    }
  } else {
+    if (accountTab) accountTab.style.display = "none";
    if (badge) badge.style.display = "none";
    if (headerAuthBtn) {
      headerAuthBtn.textContent = "Login";
@@ -532,37 +583,40 @@ function updateAuthUI() {
 }

 function applyAuthRestrictions() {
-  if (!authRole) return;
+  if (authRoles.length === 0) return;

-  // Disable TX/PTT/frequency/mode/VFO controls for rx role
-  if (authRole === "rx") {
+  if (!hasAuthRole("transmit")) {
    const pttBtn = document.getElementById("ptt-btn") as HTMLButtonElement | null;
+    const txLimitInput = document.getElementById("tx-limit") as HTMLInputElement | null;
+    const txLimitBtn = document.getElementById("tx-limit-btn") as HTMLButtonElement | null;
+    const txAudioBtn = document.getElementById("tx-audio-btn") as HTMLButtonElement | null;
+    const txLimitRow = document.getElementById("tx-limit-row");
+    if (pttBtn) pttBtn.disabled = true;
+    if (txAudioBtn) txAudioBtn.disabled = true;
+    if (txLimitBtn) txLimitBtn.disabled = true;
+    if (txLimitInput) txLimitInput.disabled = true;
+    if (txLimitRow) txLimitRow.style.opacity = "0.5";
+  }
+
+  // General tuning and receive-side controls require Control.
+  if (!hasAuthRole("control")) {
    const powerBtn = document.getElementById("power-btn") as HTMLButtonElement | null;
    const lockBtn = document.getElementById("lock-btn") as HTMLButtonElement | null;
    const freqInput = document.getElementById("freq") as HTMLInputElement | null;
    const centerFreqInput = document.getElementById("center-freq") as HTMLInputElement | null;
    const modeSelect = document.getElementById("mode") as HTMLSelectElement | null;
-    const txLimitInput = document.getElementById("tx-limit") as HTMLInputElement | null;
-    const txLimitBtn = document.getElementById("tx-limit-btn") as HTMLButtonElement | null;
-    const txAudioBtn = document.getElementById("tx-audio-btn") as HTMLButtonElement | null;
-    const txLimitRow = document.getElementById("tx-limit-row");
    const jogUp = document.getElementById("jog-up") as HTMLButtonElement | null;
    const jogDown = document.getElementById("jog-down") as HTMLButtonElement | null;
    const jogButtons = document.querySelectorAll<HTMLButtonElement>(".jog-step button");
    const vfoButtons = document.querySelectorAll<HTMLButtonElement>("#vfo-picker button");

-    // Disable TX buttons
-    if (pttBtn) pttBtn.disabled = true;
    if (powerBtn) powerBtn.disabled = true;
    if (lockBtn) lockBtn.disabled = true;
-    if (txAudioBtn) txAudioBtn.disabled = true;
-    if (txLimitBtn) txLimitBtn.disabled = true;

    // Disable frequency/mode inputs
    if (freqInput) freqInput.disabled = true;
    if (centerFreqInput) centerFreqInput.disabled = true;
    if (modeSelect) modeSelect.disabled = true;
-    if (txLimitInput) txLimitInput.disabled = true;

    // Disable VFO selector
    vfoButtons.forEach(btn => btn.disabled = true);
@@ -606,9 +660,6 @@ function applyAuthRestrictions() {
        btn.disabled = true;
      }
    });
-
-    // Hide TX-specific UI but keep controls visible (disabled)
-    if (txLimitRow) txLimitRow.style.opacity = "0.5";
  }
 }

@@ -867,14 +918,15 @@ window.applyDecodeHistoryRetention = function() {
 };

 function syncTopBarAccess() {
-  const loggedOut = authEnabled && !authRole;
+  const loggedOut = authEnabled && authRoles.length === 0;
  const tabBar = document.getElementById("tab-bar");
  const rigSwitch = document.querySelector<HTMLElement>(".header-rig-switch");
  if (tabBar) tabBar.style.display = "";

  document.querySelectorAll<HTMLButtonElement>(".tab-bar .tab").forEach((btn) => {
    const isMain = btn.dataset.tab === "main";
-    btn.style.display = !loggedOut || isMain ? "" : "none";
+    const lacksLogbookAccess = authEnabled && btn.dataset.tab === "logbook" && !hasAuthRole("write");
+    btn.style.display = (!loggedOut || isMain) && !lacksLogbookAccess ? "" : "none";
    btn.disabled = false;
  });

@@ -883,7 +935,7 @@ function syncTopBarAccess() {
  }

  if (headerRigSwitchSelect) {
-    headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
+    headerRigSwitchSelect.disabled = loggedOut || !hasAuthRole("control") || lastRigIds.length === 0;
  }
 }

@@ -1464,7 +1516,7 @@ function applyRigList(activeRigId: string | null, rigIds: string[], displayNames
  }
  const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
  const rigListChanged = prevKey !== nextKey;
-  const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
+  const disableSwitch = lastRigIds.length === 0 || !hasAuthRole("control");
  populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
  updateRigSubtitle(lastActiveRigId);
  window.trxUi?.setActiveRig(lastActiveRigId);
@@ -1522,6 +1574,9 @@ function refreshOperatorLayoutCapabilities() {
  window.trxUi?.setLayoutCapabilities({
    broadcast: rigModes.some((modes) => modes.includes("WFM")),
    digital: decoderModes.size > 0 && rigModes.some((modes) => modes.some((mode) => decoderModes.has(mode))),
+    // A logbook is for contacts made, so the layout built around it is offered
+    // where a rig can transmit.
+    ham: serverRigs.some((rig) => rig?.tx === true),
  });
 }

@@ -3026,9 +3081,16 @@ function formatSignal(sUnits: number) {
 }

 function setDisabled(disabled: boolean) {
-  [freqEl, centerFreqEl, modeEl, pttBtn, powerBtn, txLimitInput, txLimitBtn, lockBtn].forEach((el) => {
-    if (el) el.disabled = disabled;
+  const controlDisabled = disabled || (authEnabled && !hasAuthRole("control"));
+  const transmitDisabled = disabled || (authEnabled && !hasAuthRole("transmit"));
+  [freqEl, centerFreqEl, modeEl, powerBtn, lockBtn].forEach((el) => {
+    if (el) el.disabled = controlDisabled;
  });
+  [pttBtn, txLimitInput, txLimitBtn].forEach((el) => {
+    if (el) el.disabled = transmitDisabled;
+  });
+  const transmitAudio = document.getElementById("tx-audio-btn") as HTMLButtonElement | null;
+  if (transmitAudio) transmitAudio.disabled = transmitDisabled || !hasWebCodecs;
  syncModePicker();
 }

@@ -3349,7 +3411,7 @@ function scheduleTuneLinkSync() {
 async function applyTuneLink(link: TuneLink) {
  const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
  if (!wanted) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
    showHint("Read-only session — link not applied", 2500);
    return;
  }
@@ -3619,6 +3681,13 @@ function render(update: AppUpdate) {
        }
      }
    }
+    if (typeof update.filter.sdr_dig_sideband === "string") {
+      sdrDigSidebandSupported = true;
+      if (sdrDigSidebandEl && document.activeElement !== sdrDigSidebandEl) {
+        sdrDigSidebandEl.value = update.filter.sdr_dig_sideband;
+      }
+      updateWfmControls();
+    }
  }
  if (typeof update.show_sdr_gain_control === "boolean") {
    if (sdrSettingsRowEl) sdrSettingsRowEl.style.display = update.show_sdr_gain_control ? "" : "none";
@@ -4159,7 +4228,7 @@ async function postPath(path: string, options: PostOptions = {}) {
  const resp = await fetch(path, { method: "POST" });
  if (authEnabled && resp.status === 401) {
    // Not authenticated - return to login
-    authRole = null;
+    setAuthRoles([]);
    if (es) es.close();
    showAuthGate();
    throw new Error("Authentication required");
@@ -4188,7 +4257,7 @@ async function switchRigFromSelect(selectEl: HTMLSelectElement) {
    showHint("No rig selected", 1500);
    return;
  }
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
    showHint("Control role required", 1500);
    return;
  }
@@ -4871,8 +4940,13 @@ function navigateToTab(name: TabName, options: { updateHistory?: boolean; replac
  window.trxUi?.closeMobileOverlays?.();
  const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
  const { updateHistory = true, replaceHistory = false } = options;
-  if (authEnabled && !authRole && name !== "main") {
-    showAuthGate(false);
+  if (authEnabled && authRoles.length === 0 && name !== "main") {
+    showAuthGate();
+    return;
+  }
+  if (authEnabled && name === "logbook" && !hasAuthRole("write")) {
+    showHint("Write role required for logbook access", 2500);
+    navigateToTab("main", options);
    return;
  }
  const btn = document.querySelector<HTMLElement>(`.tab-bar .tab[data-tab="${name}"]`);
@@ -5005,12 +5079,12 @@ window.addEventListener("resize", () => { scheduleSpectrumLayout(); });

 // --- Auth startup sequence ---
 async function initializeApp() {
-  showAuthGate(false);
+  showAuthGate();
  const authStatus = await checkAuthStatus();
  authEnabled = !authStatus.auth_disabled;

  if (!authEnabled) {
-    authRole = "control";
+    setAuthRoles(AUTH_ADMIN_ROLES);
    hideAuthGate();
    updateAuthUI();
    connect();
@@ -5023,7 +5097,8 @@ async function initializeApp() {

  if (authStatus.authenticated) {
    // User has valid session
-    authRole = authStatus.role ?? null;
+    setAuthRoles(authStatus.roles);
+    authUsername = authStatus.username ?? null;
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -5033,10 +5108,7 @@ async function initializeApp() {
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } else {
-    // No valid session - show auth gate
-    // Guest button is shown if guest mode is available (role granted without auth)
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  }
 }

@@ -5046,28 +5118,186 @@ let settingsUiReady = false;

 function initSettingsUI() {
  settingsUiReady = true;
-  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRole);
+  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRoles);
  window.trx.modules.scheduler?.wireEvents();
  if (window.trx.modules.backgroundDecode) {
-    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
+    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRoles);
    window.trx.modules.backgroundDecode.wireEvents();
  }
+  void refreshUserManagement();
 }

+async function refreshUserManagement() {
+  const section = document.getElementById("user-management");
+  const tab = document.getElementById("settings-users-tab");
+  if (!section || !tab) return;
+  const canManageUsers = authEnabled && hasAuthRole("administrator");
+  tab.style.display = canManageUsers ? "" : "none";
+  if (!canManageUsers) {
+    const panel = document.getElementById("subtab-settings-users");
+    if (panel) panel.style.display = "none";
+    if (tab.classList.contains("active")) {
+      document.querySelector<HTMLButtonElement>('[data-subtab="settings-scheduler"]')?.click();
+    }
+    return;
+  }
+  const list = requiredElement("user-list");
+  try {
+    const users = await listUsers();
+    const enabledAdminCount = users.filter(user => user.enabled && rolesInclude(user.roles, "administrator")).length;
+    list.replaceChildren(...users.map((user) => {
+      const row = document.createElement("div");
+      row.className = "sch-row";
+      row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
+      const name = document.createElement("strong");
+      name.textContent = user.username;
+      name.style.minWidth = "10rem";
+      if (!user.enabled) name.textContent += " (disabled)";
+      const { element: roles, inputs: roleInputs } = buildRoleChoices(user.roles);
+      const enabledLabel = document.createElement("label");
+      enabledLabel.className = "auth-role-choice";
+      const enabled = document.createElement("input");
+      enabled.type = "checkbox";
+      enabled.checked = user.enabled;
+      enabled.disabled = user.username === authUsername;
+      if (enabled.disabled) enabled.title = "You cannot disable your current account";
+      enabledLabel.append(enabled, " Enabled");
+      const isOnlyAdmin = user.enabled
+        && rolesInclude(user.roles, "administrator")
+        && enabledAdminCount === 1;
+      const administratorInput = roleInputs.find(item => item.value === "administrator")?.input;
+      const guestInput = roleInputs.find(item => item.value === "guest")?.input;
+      if (isOnlyAdmin && administratorInput) {
+        administratorInput.disabled = true;
+        administratorInput.title = "The final administrator cannot be demoted";
+      }
+      if (isOnlyAdmin && guestInput) {
+        guestInput.disabled = true;
+        guestInput.title = "The final administrator cannot become a Guest";
+      }
+      if (isOnlyAdmin) {
+        enabled.disabled = true;
+        enabled.title = "The final enabled administrator cannot be disabled";
+      }
+      const password = document.createElement("input");
+      password.type = "password"; password.placeholder = "New password (8+ characters)"; password.autocomplete = "new-password"; password.className = "auth-input"; password.minLength = 8; password.maxLength = 1024;
+      const syncPasswordAccess = () => {
+        const guestActive = guestInput?.checked === true;
+        password.disabled = guestActive;
+        password.title = guestActive ? "Password changes are unavailable while the Guest role is active" : "";
+        if (guestActive) password.value = "";
+      };
+      roleInputs.forEach(({ input }) => input.addEventListener("change", syncPasswordAccess));
+      syncPasswordAccess();
+      const save = document.createElement("button"); save.type = "button"; save.textContent = "Save";
+      save.addEventListener("click", async () => {
+        const changes: { roles?: AuthRole[]; password?: string; enabled?: boolean } = {
+          roles: roleInputs.filter(({ input }) => input.checked).map(({ value }) => value),
+          enabled: enabled.checked,
+        };
+        if (password.value) changes.password = password.value;
+        await runUserOperation(() => updateUser(user.username, changes));
+      });
+      const remove = document.createElement("button"); remove.type = "button"; remove.textContent = "Remove"; remove.className = "danger";
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
+      remove.addEventListener("click", async () => {
+        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
+          await runUserOperation(() => deleteUser(user.username));
+        }
+      });
+      row.append(name, enabledLabel, roles, password, save, remove);
+      return row;
+    }));
+  } catch (error) {
+    showUserManagementError(error);
+  }
+}
+
+function showUserManagementError(error: unknown) {
+  const element = document.getElementById("user-management-error");
+  if (!element) return;
+  element.textContent = error instanceof Error ? error.message : String(error);
+  element.style.display = "block";
+}
+
+async function runUserOperation(operation: () => Promise<void>) {
+  try {
+    await operation();
+    const error = document.getElementById("user-management-error");
+    if (error) error.style.display = "none";
+    await refreshUserManagement();
+  } catch (reason) {
+    showUserManagementError(reason);
+  }
+}
+
+const createRoleContainer = document.getElementById("user-create-roles");
+if (createRoleContainer) {
+  const { element } = buildRoleChoices(["read"]);
+  element.id = createRoleContainer.id;
+  createRoleContainer.replaceWith(element);
+}
+
+document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const username = requiredElement<HTMLInputElement>("user-create-username");
+  const password = requiredElement<HTMLInputElement>("user-create-password");
+  const enabled = requiredElement<HTMLInputElement>("user-create-enabled");
+  const roles = Array.from(document.querySelectorAll<HTMLInputElement>("#user-create-roles input[type=checkbox]"));
+  void runUserOperation(async () => {
+    await createUser(username.value, password.value, roles.filter(input => input.checked).map(input => input.value as AuthRole), enabled.checked);
+    username.value = ""; password.value = "";
+    enabled.checked = true;
+    roles.forEach(input => { input.checked = input.value === "read"; });
+  });
+});
+
+document.getElementById("account-password-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const form = event.currentTarget as HTMLFormElement;
+  const currentPassword = requiredElement<HTMLInputElement>("account-current-password");
+  const newPassword = requiredElement<HTMLInputElement>("account-new-password");
+  const confirmPassword = requiredElement<HTMLInputElement>("account-confirm-password");
+  const error = requiredElement("account-password-error");
+  const submit = form.querySelector<HTMLButtonElement>('button[type="submit"]');
+  if (newPassword.value !== confirmPassword.value) {
+    error.textContent = "New passwords do not match";
+    error.style.display = "block";
+    return;
+  }
+  if (submit) submit.disabled = true;
+  void changeOwnPassword(currentPassword.value, newPassword.value)
+    .then(async () => {
+      form.reset();
+      error.style.display = "none";
+      await authLogout();
+      showHint("Password changed. Sign in again.", 3000);
+    })
+    .catch((reason: unknown) => {
+      error.textContent = reason instanceof Error ? reason.message : String(reason);
+      error.style.display = "block";
+    })
+    .finally(() => {
+      if (submit) submit.disabled = false;
+    });
+});
+
 // Setup auth form
 requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (e) => {
  e.preventDefault();
-  const passphraseEl = requiredElement<HTMLInputElement>("auth-passphrase");
-  const passphrase = passphraseEl.value;
+  const usernameEl = requiredElement<HTMLInputElement>("auth-username");
+  const passwordEl = requiredElement<HTMLInputElement>("auth-password");
  const btn = requiredElement<HTMLFormElement>("auth-form").querySelector<HTMLButtonElement>("button[type=submit]");
  if (!btn) return;
  btn.disabled = true;
  btn.textContent = "Logging in...";

  try {
-    const result = await authLogin(passphrase);
-    authRole = result.role ?? null;
-    passphraseEl.value = "";
+    const result = await authLogin(usernameEl.value, passwordEl.value);
+    setAuthRoles(result.roles);
+    authUsername = result.username ?? usernameEl.value;
+    passwordEl.value = "";
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -5077,7 +5307,7 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } catch (err) {
-    showAuthError("Invalid passphrase");
+    showAuthError("Invalid username or password");
    console.error("Login error:", err);
  } finally {
    btn.disabled = false;
@@ -5085,35 +5315,18 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
  }
 });

-// Setup guest button
-const guestBtn = document.getElementById("auth-guest-btn") as HTMLButtonElement | null;
-if (guestBtn) {
-  guestBtn.addEventListener("click", () => {
-    authRole = "rx";
-    requiredElement<HTMLInputElement>("auth-passphrase").value = "";
-    hideAuthGate();
-    updateAuthUI();
-    applyAuthRestrictions();
-    connect();
-    connectDecode();
-    initSettingsUI();
-    resizeHeaderSignalCanvas();
-    startHeaderSignalSampling();
-  });
-}
-
 // Setup header auth button (Login/Logout)
 const headerAuthBtn = document.getElementById("header-auth-btn") as HTMLButtonElement | null;
 if (headerAuthBtn) {
  headerAuthBtn.addEventListener("click", async () => {
-    if (authRole) {
+    if (authRoles.length > 0) {
      // Logged in - show logout confirmation
      if (await window.trxUi.confirm({ title: "Log out?", message: "Audio and control access for this browser session will end.", confirmLabel: "Log out", danger: false })) {
        await authLogout();
      }
    } else {
      // Not logged in - show auth gate
-      showAuthGate(false);
+      showAuthGate();
    }
  });
 }
@@ -5135,7 +5348,7 @@ Object.defineProperties(trxState, {
  initialMapZoom:         { get() { return initialMapZoom;         } },
  decodeHistoryRetentionMin: { get() { return decodeHistoryRetentionMin; } },
  authEnabled:            { get() { return authEnabled;            } },
-  authRole:               { get() { return authRole;               } },
+  authRoles:              { get() { return authRoles;              } },
  decoderRegistry:        { get() { return decoderRegistry;        } },
  sseSessionId:           { get() { return sseSessionId;           } },
  primaryRds:             { get() { return primaryRds;             } },
@@ -5405,6 +5618,9 @@ const sdrNbThresholdControlsEl = document.getElementById("sdr-nb-threshold-contr
 const sdrNbThresholdEl = document.getElementById("sdr-nb-threshold") as HTMLInputElement | null;
 const sdrNbThresholdSetBtn = document.getElementById("sdr-nb-threshold-set") as HTMLButtonElement | null;
 let sdrNbSupported = false;
+const sdrDigSidebandWrapEl = document.getElementById("sdr-dig-sideband-wrap");
+const sdrDigSidebandEl = document.getElementById("sdr-dig-sideband") as HTMLSelectElement | null;
+let sdrDigSidebandSupported = false;

 // Hide audio row if audio is not configured on the server
 fetch("/audio", { method: "GET" }).then((r) => {
@@ -5856,6 +6072,17 @@ if (sdrNbThresholdEl) {
    }
  });
 }
+function submitSdrDigSideband() {
+  if (!sdrDigSidebandSupported || !sdrDigSidebandEl) return;
+  const policy = sdrDigSidebandEl.value || "auto";
+  if (policy !== "auto" && policy !== "usb" && policy !== "lsb") return;
+  postPath(`/set_sdr_dig_sideband?policy=${encodeURIComponent(policy)}`).catch(() => {});
+}
+if (sdrDigSidebandEl) {
+  sdrDigSidebandEl.addEventListener("change", () => {
+    submitSdrDigSideband();
+  });
+}
 function updateWfmControls() {
  const mode = (modeEl && modeEl.value ? modeEl.value : "").toUpperCase();
  if (wfmControlsCol) wfmControlsCol.style.display = mode === "WFM" ? "" : "none";
@@ -5863,6 +6090,11 @@ function updateWfmControls() {
  // The row holds only these two, so it goes with them — an empty one would
  // still take a track and a gap in the tray, and draw its divider.
  if (modeControlsRow) modeControlsRow.style.display = (mode === "WFM" || mode === "SAM") ? "" : "none";
+  // DIG sideband selector is only meaningful in DIG mode on an SDR backend.
+  if (sdrDigSidebandWrapEl) {
+    sdrDigSidebandWrapEl.style.display =
+      sdrDigSidebandSupported && mode === "DIG" ? "" : "none";
+  }
 }

 // Show compatibility warning for non-Chromium browsers
@@ -6180,6 +6412,10 @@ function stopRxAudio() {

 function startTxAudio() {
  if (txActive) { void stopTxAudio(); return; }
+  if (authEnabled && !hasAuthRole("transmit")) {
+    audioStatus.textContent = "Transmit role required";
+    return;
+  }
  if (!hasWebCodecs) {
    audioStatus.textContent = "Audio requires Chrome/Edge";
    return;
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 export const TAB_ORDER = [
-  "main", "bookmarks", "digital-modes", "map", "satellites", "statistics", "recorder", "settings", "about",
+  "main", "bookmarks", "logbook", "digital-modes", "map", "satellites", "statistics", "recorder", "settings", "about",
 ] as const;

 export type TabName = typeof TAB_ORDER[number];
@@ -11,6 +11,7 @@ export type TabName = typeof TAB_ORDER[number];
 export const TAB_PATHS: Readonly<Record<TabName, string>> = {
  main: "/",
  bookmarks: "/bookmarks",
+  logbook: "/logbook",
  "digital-modes": "/digital-modes",
  map: "/map",
  satellites: "/satellites",
@@ -4,7 +4,7 @@

 type PluginGroup =
  | "digital-modes" | "map-data" | "map" | "satellites" | "statistics"
-  | "bookmarks" | "recorder" | "settings";
+  | "bookmarks" | "logbook" | "recorder" | "settings";

 const pluginGroups: Readonly<Record<PluginGroup, readonly string[]>> = {
  // AIS, VDES and the two APRS decoders have panels on this tab, so they load
@@ -20,6 +20,7 @@ const pluginGroups: Readonly<Record<PluginGroup, readonly string[]>> = {
  satellites: ["/satellite-predictions.js"],
  statistics: ["/map-core.js"],
  bookmarks: ["/bookmarks.js"],
+  logbook: ["/logbook.js"],
  recorder: [],
  settings: ["/vchan.js", "/scheduler.js"],
 };
@@ -47,7 +48,7 @@ async function loadPlugins(group: string): Promise<void> {
 }

 export async function loadEagerPlugins(): Promise<void> {
-  await Promise.all(["digital-modes", "bookmarks", "settings"].map(loadPlugins));
+  await Promise.all(["digital-modes", "bookmarks", "logbook", "settings"].map(loadPlugins));
 }

 export async function loadPluginsForTab(tab: string): Promise<void> {
@@ -324,6 +324,21 @@ export interface AprsRowOptions {
  onMap?: (lat: number, lon: number) => void;
  /** Puts a frame's coordinates on the clipboard. */
  onCopy?: (text: string, button: HTMLElement) => void;
+  /** Opens a log entry for the station that sent the frame. */
+  onLog?: (call: string, gridsquare: string | null) => void;
+}
+
+/** A position as a six-character locator, which is what a log wants. */
+function maidenheadForLatLon(lat: number, lon: number): string {
+  const adjustedLon = lon + 180;
+  const adjustedLat = lat + 90;
+  const field = String.fromCharCode(65 + Math.floor(adjustedLon / 20))
+    + String.fromCharCode(65 + Math.floor(adjustedLat / 10));
+  const square = String(Math.floor((adjustedLon % 20) / 2)) + String(Math.floor(adjustedLat % 10));
+  const subLon = ((adjustedLon % 2) * 60) / 5;
+  const subLat = ((adjustedLat % 1) * 60) / 2.5;
+  const sub = String.fromCharCode(97 + Math.floor(subLon)) + String.fromCharCode(97 + Math.floor(subLat));
+  return `${field}${square}${sub}`.toUpperCase();
 }

 export function renderAprsPacketRow(packet: AprsPacket, options: AprsRowOptions = {}): HTMLElement {
@@ -370,6 +385,7 @@ export function renderAprsPacketRow(packet: AprsPacket, options: AprsRowOptions
        (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-map="${packet.lat},${packet.lon}">Map</button>` : "") +
        (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-copy="${packet.lat},${packet.lon}">Copy Coords</button>` : "") +
        `<a class="aprs-inline-btn" href="${qrzHref}" target="_blank" rel="noopener">QRZ</a>` +
+        (options.onLog && packet.srcCall ? '<button class="aprs-inline-btn" type="button" data-aprs-log="1">Log</button>' : "") +
      `</div>` +
    `</div>`;

@@ -381,6 +397,17 @@ export function renderAprsPacketRow(packet: AprsPacket, options: AprsRowOptions
      if (Number.isFinite(lat) && Number.isFinite(lon)) options.onMap?.(lat as number, lon as number);
    });
  });
+  const logButton = row.querySelector<HTMLElement>("[data-aprs-log]");
+  if (logButton) {
+    logButton.addEventListener("click", (event) => {
+      event.preventDefault();
+      event.stopPropagation();
+      const grid = packet.lat != null && packet.lon != null
+        ? maidenheadForLatLon(packet.lat, packet.lon)
+        : null;
+      options.onLog?.(packet.srcCall ?? "", grid);
+    });
+  }
  const copyButton = row.querySelector<HTMLElement>("[data-aprs-copy]");
  if (copyButton) {
    copyButton.addEventListener("click", (event) => {
@@ -23,6 +23,7 @@ interface AprsBridge {
  aprsMapAddStation?: (call: string, lat: number, lon: number, info: string, symbolTable: string | null | undefined, symbolCode: string | null | undefined, packet: AprsPacket) => void;
  getDecodeRigMeta?: () => unknown;
  trxUi: { confirm(options: { title: string; message: string; confirmLabel: string }): Promise<boolean> };
+  logContact?: (seed: { call?: string; gridsquare?: string | undefined; decoder?: string }) => void;
  updateAprsBar?: () => void;
  clearAprsBar?: () => void;
  closeAprsBar?: () => void;
@@ -164,6 +165,9 @@ function renderAprsRow(pkt: AprsPacket, isFresh: boolean): HTMLElement {
    distance: aprsDistanceText(pkt),
    onMap: (lat, lon) => { aprsWindow.navigateToAprsMap?.(lat, lon); },
    onCopy: (text) => { void copyAprsCoords(text); },
+    onLog: (call, gridsquare) => {
+      aprsWindow.logContact?.({ call, gridsquare: gridsquare ?? undefined, decoder: "aprs" });
+    },
  });
 }

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import { hostState } from "./host.js";
+import { hasAuthRole, type AuthRole } from "../api/auth.js";

 export {};

@@ -44,7 +45,7 @@ interface BackgroundBridge {
  trx?: { modules?: { backgroundDecode?: BackgroundDecodeService } };
 }
 interface BackgroundDecodeService {
-  initialize(rigId: string | null, role: string | null): void;
+  initialize(rigId: string | null, roles: readonly AuthRole[]): void;
  wireEvents(): void;
  setRig(rigId: string | null): void;
 }
@@ -60,7 +61,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
      .map(function (d) { return d.id; });
  }

-  let backgroundDecodeRole: string | null = null;
+  let backgroundDecodeRoles: readonly AuthRole[] = [];
  let currentRigId: string | null = null;
  let currentConfig: BackgroundDecodeConfig | null = null;
  let bookmarkList: Bookmark[] = [];
@@ -70,8 +71,8 @@ const bgdWindow = window as unknown as BackgroundBridge;
  let statusByBookmark = new Map<string, BackgroundStatusEntry>();
  let lastStatus: BackgroundDecodeStatus | null = null;

-  function initBackgroundDecode(rigId: string | null, role: string | null): void {
-    backgroundDecodeRole = role;
+  function initBackgroundDecode(rigId: string | null, roles: readonly AuthRole[]): void {
+    backgroundDecodeRoles = roles;
    // The panel used to take whatever rig it was handed at load and wait to be
    // told again.  Loading before the rig list arrives handed it null, and the
    // next telling only came when the operator switched rigs, so the panel sat
@@ -468,7 +469,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
  }

  function isControlRole(): boolean {
-    return backgroundDecodeRole === "control" || hostState.authEnabled === false;
+    return hasAuthRole(backgroundDecodeRoles, "control") || hostState.authEnabled === false;
  }

  function showToast(msg: string, isError: boolean): void {
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import { hostCore, hostState } from "./host.js";
+import { hasAuthRole } from "../api/auth.js";

 export {};

@@ -18,6 +19,8 @@ interface Bookmark {
  category?: string | null;
  comment?: string | null;
  decoders?: string[];
+  /** DIG sideband override: "auto" | "usb" | "lsb". Empty/absent = global. */
+  dig_sideband?: string | null;
  scope?: string;
 }

@@ -100,7 +103,8 @@ function bmEsc(str: unknown): string {
 }

 function bmCanControl() {
-  return !hostState.authEnabled || hostState.authRole === "control";
+  return !hostState.authEnabled
+    || hasAuthRole(hostState.authRoles, "write");
 }

 // Show/hide the Add Bookmark / Select All buttons based on the current auth role.
@@ -319,6 +323,14 @@ function bmBuildDecoderCheckboxes() {
    });
 }

+/** Show the DIG-sideband override selector only when the mode field is DIG. */
+function bmSyncDigSidebandVisibility(): void {
+  const label = bmOptionalEl("bm-dig-sideband-label");
+  if (!label) return;
+  const mode = (bmEl("bm-mode").value || "").trim().toUpperCase();
+  label.style.display = mode === "DIG" ? "" : "none";
+}
+
 function bmOpenForm(bm: Bookmark | null): void {
  const wrap = bmEl("bm-form-wrap");
  if (!wrap) return;
@@ -336,7 +348,9 @@ function bmOpenForm(bm: Bookmark | null): void {
  bmEl("bm-locator").value = bm ? (bm.locator || "") : "";
  bmEl("bm-category-input").value = bm ? (bm.category || "") : "";
  bmEl("bm-comment").value = bm ? (bm.comment || "") : "";
+  bmEl("bm-dig-sideband").value = bm ? (bm.dig_sideband || "") : "";
  bmWriteDecoders(bm?.decoders ?? []);
+  bmSyncDigSidebandVisibility();
  bmEl("bm-form-title").textContent = bm ? "Edit Bookmark" : "Add Bookmark";

  wrap.style.display = "flex";
@@ -381,6 +395,9 @@ async function bmSave(e: Event): Promise<void> {
  const category = bmEl("bm-category-input").value.trim();
  const comment = bmEl("bm-comment").value.trim();
  const decoders = bmReadDecoders();
+  // Only meaningful for DIG; stored empty otherwise so it never overrides.
+  const dig_sideband =
+    mode.toUpperCase() === "DIG" ? (bmEl("bm-dig-sideband").value || null) : null;

  const formError = bmEl("bm-form-error");
  if (formError) formError.textContent = "";
@@ -401,6 +418,7 @@ async function bmSave(e: Event): Promise<void> {
    category,
    comment,
    decoders,
+    dig_sideband,
  };

  try {
@@ -475,6 +493,16 @@ function bmApply(bm: Bookmark): void {
    const tunePromise = (async () => {
      await bridge.trx.modules.vchan?.takeSchedulerControl();

+      // For a DIG bookmark carrying a sideband override, set the global DIG
+      // policy first so the backend resolves the intended sideband when DIG is
+      // applied. "auto" is honoured explicitly; an empty override is left alone.
+      if ((bm.mode || "").toUpperCase() === "DIG" && bm.dig_sideband) {
+        const p = bm.dig_sideband.toLowerCase();
+        if (p === "auto" || p === "usb" || p === "lsb") {
+          await hostCore.postPath("/set_sdr_dig_sideband?policy=" + encodeURIComponent(p));
+        }
+      }
+
      const onVirtual = await bridge.trx.modules.vchan?.interceptMode(bm.mode) ?? false;
      if (!onVirtual) {
        await hostCore.postPath("/set_mode?mode=" + encodeURIComponent(bm.mode));
@@ -768,6 +796,9 @@ function bmPopulateScopePicker() {
  // Form submit
  bmEl("bm-form").addEventListener("submit", (event) => { void bmSave(event); });

+  // Reveal the DIG-sideband override only while the mode field reads DIG.
+  bmEl("bm-mode").addEventListener("input", bmSyncDigSidebandVisibility);
+
  // Form cancel
  bmEl("bm-form-cancel").addEventListener("click", bmCloseForm);

@@ -49,6 +49,8 @@ interface FtxBridge {
  updateFt8Bar?: () => void;
  registerFt8FamilyBarRenderer?: (decoder: FtxDecoderId, renderer: () => BarFrames) => void;
  takeSchedulerControlForDecoderDisable?: (button: HTMLElement) => Promise<void>;
+  /** Opens a log entry from a decode. Pre-fills it; never logs by itself. */
+  logContact?: (seed: { call?: string; gridsquare?: string | undefined; decoder?: string }) => void;
  trxUi: ConfirmApi;
  clearFt8Bar?: () => void;
  closeFt8Bar?: () => void;
@@ -224,6 +226,26 @@ export function initializeFtxDecoder(config: FtxConfig): void {
      hour: "2-digit", minute: "2-digit", second: "2-digit",
    });
    row.innerHTML = `<span class="ft8-time">${time}</span><span class="ft8-snr">${snr?.toFixed(1) ?? "--"}</span><span class="ft8-dt">${delta?.toFixed(2) ?? "--"}</span><span class="ft8-freq">${frequency?.toFixed(0) ?? "--"}</span><span class="ft8-msg">${renderMessage(raw)}</span>`;
+    // A decode is not a contact: this opens an entry with what was heard in it
+    // and leaves the logging to the operator.
+    const station = bridge.ft8ExtractLikelyCallsign?.(raw) ?? extractFtxCallsign(raw);
+    if (station) {
+      const log = document.createElement("button");
+      log.type = "button";
+      log.className = "ft8-log-btn";
+      log.textContent = "Log";
+      log.title = `Start a log entry for ${station}`;
+      log.addEventListener("click", (event) => {
+        event.stopPropagation();
+        const details = bridge.ft8ExtractLocatorDetails?.(raw) ?? extractFtxLocatorDetails(raw);
+        bridge.logContact?.({
+          call: station,
+          gridsquare: details.find((detail) => detail.station === station)?.grid,
+          decoder: id,
+        });
+      });
+      row.appendChild(log);
+    }
    return row;
  };
  const render = (): void => {
@@ -11,6 +11,8 @@
 // feature bundles from re-deriving it — and from drifting back to bare `window`
 // properties, which the module graph no longer publishes.

+import type { AuthRole } from "../api/auth.js";
+
 export interface HostDecoderDescriptor {
  id: string;
  label: string;
@@ -22,8 +24,10 @@ export interface HostDecoderDescriptor {
 export interface HostState {
  readonly serverLat: number | null;
  readonly serverLon: number | null;
+  /** The callsign this station is on the air with, from the client config. */
+  readonly ownerCallsign: string | null;
  readonly authEnabled: boolean;
-  readonly authRole: string | null;
+  readonly authRoles: readonly AuthRole[];
  readonly lastActiveRigId: string | null;
  readonly lastRigIds: string[];
  readonly lastRigDisplayNames: Record<string, string>;
@@ -43,6 +47,7 @@ export interface HostCore {
  armOptimisticFrequency(frequencyHz: number): void;
  escapeMapHtml(value: string): string;
  haversineKm(lat1: number, lon1: number, lat2: number, lon2: number): number;
+  latLonToMaidenhead(lat: number, lon: number): string;
  showHint(message: string, durationMs?: number): void;
  formatFreqForStep(frequencyHz: number, stepHz: number): string;
  refreshFreqDisplay(): void;
@@ -0,0 +1,577 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+// The station log: one panel that opens an entry, keeps the log, and takes
+// ADIF in and out.
+//
+// Times come from the server, never from here. The browser may be a phone in
+// another timezone with a clock nobody has checked, and a log is only worth
+// keeping if the times in it are the radio's.
+
+import { hostCore, hostState } from "./host.js";
+import { hasAuthRole } from "../api/auth.js";
+
+export {};
+
+interface Qso {
+  id: string;
+  started_at: string;
+  call: string;
+  freq_hz: number;
+  band?: string | null;
+  mode: string;
+  submode?: string | null;
+  rst_sent?: string | null;
+  rst_rcvd?: string | null;
+  gridsquare?: string | null;
+  name?: string | null;
+  qth?: string | null;
+  comment?: string | null;
+  station_callsign?: string | null;
+  operator?: string | null;
+  my_gridsquare?: string | null;
+  my_rig?: string | null;
+  rig_id?: string | null;
+  contest_id?: string | null;
+  stx?: number | null;
+  srx?: number | null;
+  srx_string?: string | null;
+  qsl_rcvd?: string | null;
+  lotw_qsl_rcvd?: string | null;
+  confirmed?: boolean;
+}
+
+interface BandStatistics {
+  band: string;
+  contacts: number;
+  stations: number;
+  confirmed: number;
+}
+
+interface Prefill {
+  started_at: string;
+  epoch_ms: number;
+  freq_hz: number;
+  band: string | null;
+  mode: string;
+  submode: string | null;
+  rig_id: string | null;
+  my_rig: string | null;
+  call: string | null;
+  gridsquare: string | null;
+}
+
+interface LogbookBridge {
+  trxUi: {
+    confirm(options: { title: string; message: string; confirmLabel: string }): Promise<boolean>;
+    notify?(message: string, options?: { kind?: string }): void;
+  };
+  navigateToTab?: (name: string) => void;
+  /** Opens the panel with an entry started from a decode. */
+  logContact?: (seed: { call?: string; gridsquare?: string | undefined; decoder?: string }) => void;
+}
+
+const bridge = window as unknown as LogbookBridge;
+
+const el = <T extends HTMLElement>(id: string): T | null => document.getElementById(id) as T | null;
+
+const form = el<HTMLFormElement>("log-entry-form");
+const callInput = el<HTMLInputElement>("log-call");
+const freqInput = el<HTMLInputElement>("log-freq");
+const modeInput = el<HTMLInputElement>("log-mode");
+const rstSentInput = el<HTMLInputElement>("log-rst-sent");
+const rstRcvdInput = el<HTMLInputElement>("log-rst-rcvd");
+const gridInput = el<HTMLInputElement>("log-grid");
+const nameInput = el<HTMLInputElement>("log-name");
+const commentInput = el<HTMLInputElement>("log-comment");
+const operatorInput = el<HTMLInputElement>("log-operator");
+const rowsBody = el<HTMLTableSectionElement>("log-rows");
+const summaryEl = el("log-summary");
+const workedEl = el("log-worked-before");
+const clockEl = el("log-clock");
+const stationCallEl = el("log-station-callsign");
+const stationRigEl = el("log-station-rig-name");
+const stationGridEl = el("log-station-grid");
+const filterCall = el<HTMLInputElement>("log-filter-call");
+const filterBand = el<HTMLSelectElement>("log-filter-band");
+const filterMode = el<HTMLSelectElement>("log-filter-mode");
+const importBtn = el<HTMLButtonElement>("log-import-btn");
+const importFile = el<HTMLInputElement>("log-import-file");
+const exportLink = el<HTMLAnchorElement>("log-export-btn");
+const clearBtn = el<HTMLButtonElement>("log-clear-btn");
+const saveBtn = el<HTMLButtonElement>("log-save-btn");
+const contestIdInput = el<HTMLInputElement>("log-contest-id");
+const stxInput = el<HTMLInputElement>("log-stx");
+const srxInput = el<HTMLInputElement>("log-srx");
+const statisticsRows = el<HTMLTableSectionElement>("log-statistics-rows");
+const cabrilloContest = el<HTMLInputElement>("log-cbr-contest");
+const cabrilloCallsign = el<HTMLInputElement>("log-cbr-callsign");
+const cabrilloOperator = el<HTMLSelectElement>("log-cbr-operator");
+const cabrilloPower = el<HTMLSelectElement>("log-cbr-power");
+const cabrilloScore = el<HTMLInputElement>("log-cbr-score");
+const cabrilloExport = el<HTMLAnchorElement>("log-cbr-export");
+
+/** The time the open entry was started, as the server gave it. */
+let entryStartedAt: string | null = null;
+/** The rig the open entry belongs to, likewise. */
+let entryRigId: string | null = null;
+let entryRigName: string | null = null;
+let entryGrid: string | null = null;
+let qsos: Qso[] = [];
+let workedRequest = 0;
+
+function canWriteLogbook(): boolean {
+  return !hostState.authEnabled
+    || hasAuthRole(hostState.authRoles, "write");
+}
+
+function notify(message: string, kind?: string): void {
+  if (bridge.trxUi.notify) bridge.trxUi.notify(message, kind ? { kind } : undefined);
+  else hostCore.showHint(message, 2000);
+}
+
+async function getJson<T>(path: string): Promise<T> {
+  const response = await fetch(path);
+  if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+  return await response.json() as T;
+}
+
+function formatFreq(hz: number): string {
+  if (!Number.isFinite(hz) || hz <= 0) return "";
+  // Through Number, not a trailing-zero trim: trimming "20.000000" as a string
+  // walks back through the point and leaves "2".
+  return String(Number((hz / 1e6).toFixed(6)));
+}
+
+/** What the operator typed, in Hz: MHz unless it is plainly already Hz. */
+function parseFreq(text: string): number | null {
+  const value = Number(text.trim().replace(/\s+/g, "").replace(",", "."));
+  if (!Number.isFinite(value) || value <= 0) return null;
+  return value < 100_000 ? Math.round(value * 1e6) : Math.round(value);
+}
+
+/** A serial, or null when the exchange is a word rather than a number. */
+function numberOrNull(text: string | undefined): number | null {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) return null;
+  const value = Number(trimmed);
+  return Number.isSafeInteger(value) ? value : null;
+}
+
+function utcDate(iso: string): string {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
+}
+
+function utcTime(iso: string): string {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(11, 19);
+}
+
+// ── The entry ───────────────────────────────────────────────────────────────
+
+/** Open an entry, pre-filled with the six fields the radio and clock answer. */
+async function openEntry(
+  seed: { call?: string; gridsquare?: string | undefined; decoder?: string } = {},
+): Promise<void> {
+  const params = new URLSearchParams();
+  if (hostState.lastActiveRigId) params.set("remote", hostState.lastActiveRigId);
+  if (seed.decoder) params.set("decoder", seed.decoder);
+  if (seed.call) params.set("call", seed.call);
+  if (seed.gridsquare) params.set("gridsquare", seed.gridsquare);
+  try {
+    const prefill = await getJson<Prefill>(`/api/logbook/prefill?${params.toString()}`);
+    applyPrefill(prefill);
+  } catch (error: unknown) {
+    console.error("logbook prefill failed", error);
+  }
+}
+
+function applyPrefill(prefill: Prefill): void {
+  entryStartedAt = prefill.started_at;
+  entryRigId = prefill.rig_id;
+  entryRigName = prefill.my_rig;
+  if (freqInput) freqInput.value = formatFreq(prefill.freq_hz);
+  if (modeInput) modeInput.value = prefill.submode ?? prefill.mode;
+  if (callInput && prefill.call) callInput.value = prefill.call;
+  if (gridInput && prefill.gridsquare) gridInput.value = prefill.gridsquare;
+  if (stationRigEl) stationRigEl.textContent = prefill.my_rig ?? "no rig";
+  showClock(prefill);
+  updateWorkedBefore();
+}
+
+/** The entry's time, and whether this browser agrees with it. */
+function showClock(prefill: Prefill): void {
+  if (!clockEl) return;
+  const time = utcTime(prefill.started_at);
+  const drift = Math.abs(Date.now() - prefill.epoch_ms);
+  clockEl.textContent = drift > 1000
+    ? `${time}Z · your clock is ${(drift / 1000).toFixed(0)}s out`
+    : `${time}Z`;
+  clockEl.classList.toggle("is-adrift", drift > 1000);
+}
+
+/** Clear the entry and open a fresh one. */
+function resetEntry(): void {
+  // The contest and the serial sent stay: they belong to the session, not to
+  // the contact just logged.
+  for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput, srxInput]) {
+    if (input) input.value = "";
+  }
+  if (workedEl) workedEl.textContent = "";
+  void openEntry();
+}
+
+async function submitEntry(event: Event): Promise<void> {
+  event.preventDefault();
+  const call = callInput?.value.trim() ?? "";
+  if (!call) {
+    notify("A contact needs a callsign", "error");
+    callInput?.focus();
+    return;
+  }
+  const freqHz = parseFreq(freqInput?.value ?? "");
+  if (freqHz == null) {
+    notify("A contact needs a frequency", "error");
+    freqInput?.focus();
+    return;
+  }
+  const typedMode = (modeInput?.value ?? "").trim().toUpperCase();
+  // USB and LSB are how a rig says SSB; the log wants the mode with the
+  // sideband beside it, which is what other loggers read.
+  const isSideband = typedMode === "USB" || typedMode === "LSB";
+  const body = {
+    // The server stamps the time; this is the one it gave when the entry
+    // opened, so a contact logged five minutes later keeps the time it started.
+    started_at: entryStartedAt,
+    call,
+    freq_hz: freqHz,
+    mode: isSideband ? "SSB" : typedMode,
+    submode: isSideband ? typedMode : null,
+    rst_sent: rstSentInput?.value ?? null,
+    rst_rcvd: rstRcvdInput?.value ?? null,
+    gridsquare: gridInput?.value ?? null,
+    name: nameInput?.value ?? null,
+    comment: commentInput?.value ?? null,
+    contest_id: contestIdInput?.value ?? null,
+    // The exchange is a number when it is a serial and a word when it is a
+    // zone or a section; both are kept, and the log writes whichever it has.
+    stx: numberOrNull(stxInput?.value),
+    stx_string: numberOrNull(stxInput?.value) == null ? stxInput?.value ?? null : null,
+    srx: numberOrNull(srxInput?.value),
+    srx_string: numberOrNull(srxInput?.value) == null ? srxInput?.value ?? null : null,
+    station_callsign: stationCallEl?.textContent?.trim() ?? null,
+    operator: operatorInput?.value ?? null,
+    my_gridsquare: entryGrid,
+    my_rig: entryRigName,
+    rig_id: entryRigId,
+  };
+  if (saveBtn) saveBtn.disabled = true;
+  try {
+    const response = await fetch("/api/logbook", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+      const detail = await response.json().catch(() => ({})) as { error?: string };
+      throw new Error(detail.error ?? `HTTP ${String(response.status)}`);
+    }
+    notify(`${call} logged`);
+    // A contest runs on serials: the next one is this one plus one, so it is
+    // not retyped forty times an hour.
+    const sent = numberOrNull(stxInput?.value);
+    resetEntry();
+    if (stxInput && sent != null) stxInput.value = String(sent + 1);
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Could not log: ${error instanceof Error ? error.message : String(error)}`, "error");
+  } finally {
+    if (saveBtn) saveBtn.disabled = false;
+  }
+}
+
+/** Whether this station has been worked, and on what. */
+function updateWorkedBefore(): void {
+  if (!workedEl) return;
+  const call = callInput?.value.trim() ?? "";
+  if (call.length < 3) {
+    workedEl.textContent = "";
+    return;
+  }
+  const request = ++workedRequest;
+  void getJson<{ worked: { band: string; mode: string }[] }>(
+    `/api/logbook/worked/${encodeURIComponent(call)}`,
+  ).then((answer) => {
+    // A slower answer to an earlier callsign must not overwrite a later one.
+    if (request !== workedRequest || !workedEl) return;
+    if (answer.worked.length === 0) {
+      workedEl.textContent = "Not worked before";
+      workedEl.classList.remove("is-worked");
+      return;
+    }
+    const where = answer.worked.map((entry) => `${entry.band} ${entry.mode}`).join(", ");
+    workedEl.textContent = `Worked before: ${where}`;
+    workedEl.classList.add("is-worked");
+  }).catch(() => { /* the log will still take the contact */ });
+}
+
+// ── The log ─────────────────────────────────────────────────────────────────
+
+function currentQuery(): string {
+  const params = new URLSearchParams();
+  const call = filterCall?.value.trim();
+  if (call) params.set("call", call);
+  if (filterBand?.value) params.set("band", filterBand.value);
+  if (filterMode?.value) params.set("mode", filterMode.value);
+  return params.toString();
+}
+
+async function refreshLog(): Promise<void> {
+  try {
+    const query = currentQuery();
+    const answer = await getJson<{ total: number; qsos: Qso[] }>(
+      `/api/logbook${query ? `?${query}` : ""}`,
+    );
+    qsos = answer.qsos;
+    renderRows();
+    renderFilterOptions();
+    if (summaryEl) {
+      summaryEl.textContent = query
+        ? `${String(qsos.length)} of ${String(answer.total)} contacts`
+        : `${String(answer.total)} contact${answer.total === 1 ? "" : "s"}`;
+    }
+    if (exportLink) exportLink.href = `/api/logbook/export.adi${query ? `?${query}` : ""}`;
+    await refreshStatistics();
+  } catch (error: unknown) {
+    console.error("logbook read failed", error);
+  }
+}
+
+/** What has been worked and confirmed, band by band. */
+async function refreshStatistics(): Promise<void> {
+  if (!statisticsRows) return;
+  try {
+    const answer = await getJson<{ bands: BandStatistics[] }>("/api/logbook/statistics");
+    if (answer.bands.length === 0) {
+      statisticsRows.innerHTML = '<tr><td colspan="4" class="log-empty">Nothing worked yet.</td></tr>';
+      return;
+    }
+    const fragment = document.createDocumentFragment();
+    for (const band of answer.bands) {
+      const row = document.createElement("tr");
+      for (const value of [band.band, band.contacts, band.stations, band.confirmed]) {
+        const cell = document.createElement("td");
+        cell.textContent = String(value);
+        row.appendChild(cell);
+      }
+      fragment.appendChild(row);
+    }
+    statisticsRows.replaceChildren(fragment);
+  } catch (error: unknown) {
+    console.error("logbook statistics failed", error);
+  }
+}
+
+/** The Cabrillo link, carrying the header the operator filled in. */
+function syncCabrilloLink(): void {
+  if (!cabrilloExport) return;
+  const params = new URLSearchParams();
+  const contest = cabrilloContest?.value.trim();
+  if (contest) {
+    // Only that contest's contacts belong in the entry.
+    params.set("contest", contest);
+  }
+  const callsign = cabrilloCallsign?.value.trim() || (stationCallEl?.textContent?.trim() ?? "");
+  if (callsign) params.set("callsign", callsign);
+  if (cabrilloOperator?.value) params.set("category_operator", cabrilloOperator.value);
+  if (cabrilloPower?.value) params.set("category_power", cabrilloPower.value);
+  const score = numberOrNull(cabrilloScore?.value);
+  if (score != null) params.set("claimed_score", String(score));
+  const operator = operatorInput?.value.trim();
+  if (operator) params.set("operators", operator);
+  cabrilloExport.href = `/api/logbook/export.cbr?${params.toString()}`;
+}
+
+function renderRows(): void {
+  if (!rowsBody) return;
+  if (qsos.length === 0) {
+    rowsBody.innerHTML =
+      '<tr><td colspan="10" class="log-empty">No contacts yet. Work someone and log them here,'
+      + " or bring a log in with Import ADIF.</td></tr>";
+    return;
+  }
+  const fragment = document.createDocumentFragment();
+  for (const qso of qsos) {
+    const row = document.createElement("tr");
+    row.dataset.qsoId = qso.id;
+    const cells: (string | null | undefined)[] = [
+      utcDate(qso.started_at),
+      utcTime(qso.started_at),
+      qso.call,
+      qso.band ?? "",
+      qso.submode ?? qso.mode,
+      qso.rst_sent ?? "",
+      qso.rst_rcvd ?? "",
+      qso.gridsquare ?? "",
+      qso.my_rig ?? "",
+      qso.confirmed ? "✓" : "",
+    ];
+    for (const [index, value] of cells.entries()) {
+      const cell = document.createElement("td");
+      cell.textContent = value ?? "";
+      if (index === 2) cell.className = "log-cell-call";
+      row.appendChild(cell);
+    }
+    const actions = document.createElement("td");
+    if (!canWriteLogbook()) {
+      row.appendChild(actions);
+      fragment.appendChild(row);
+      continue;
+    }
+    // Confirming is the commonest edit a log gets, so it is a button rather
+    // than a form: a card arrives, and the contact counts towards an award.
+    const confirm = document.createElement("button");
+    confirm.type = "button";
+    confirm.className = "log-row-btn";
+    confirm.textContent = qso.confirmed ? "Unconfirm" : "Confirm";
+    confirm.title = qso.confirmed
+      ? "Mark this contact as not confirmed"
+      : "Mark this contact confirmed by QSL";
+    confirm.addEventListener("click", () => { void setConfirmed(qso, !qso.confirmed); });
+    actions.appendChild(confirm);
+    const remove = document.createElement("button");
+    remove.type = "button";
+    remove.className = "log-row-btn";
+    remove.textContent = "Delete";
+    remove.setAttribute("aria-label", `Delete the contact with ${qso.call}`);
+    remove.addEventListener("click", () => { void deleteQso(qso); });
+    actions.appendChild(remove);
+    row.appendChild(actions);
+    fragment.appendChild(row);
+  }
+  rowsBody.replaceChildren(fragment);
+}
+
+/** Bands and modes the log actually holds, so the filters offer only those. */
+function renderFilterOptions(): void {
+  for (const [select, values] of [
+    [filterBand, [...new Set(qsos.map((q) => q.band).filter((b): b is string => !!b))]],
+    [filterMode, [...new Set(qsos.map((q) => q.submode ?? q.mode).filter(Boolean))]],
+  ] as const) {
+    if (!select) continue;
+    const chosen = select.value;
+    const known = new Set([...select.options].map((option) => option.value));
+    for (const value of [...values].sort()) {
+      if (known.has(value)) continue;
+      select.add(new Option(value, value));
+    }
+    select.value = chosen;
+  }
+}
+
+/** Record, or withdraw, the other station's confirmation. */
+async function setConfirmed(qso: Qso, confirmed: boolean): Promise<void> {
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ...qso,
+        // A card is a card: this is the paper one, and an electronic
+        // confirmation the log already holds is left where it is.
+        qsl_rcvd: confirmed ? "Y" : "N",
+      }),
+    });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Could not update: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+
+async function deleteQso(qso: Qso): Promise<void> {
+  const confirmed = await bridge.trxUi.confirm({
+    title: "Delete this contact?",
+    message: `${qso.call} on ${qso.band ?? formatFreq(qso.freq_hz)} will be removed from the log.`,
+    confirmLabel: "Delete",
+  });
+  if (!confirmed) return;
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, { method: "DELETE" });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Could not delete: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+
+async function importAdif(file: File): Promise<void> {
+  try {
+    const response = await fetch("/api/logbook/import", { method: "POST", body: await file.arrayBuffer() });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    const outcome = await response.json() as { added: number; duplicate: number; rejected: string[] };
+    const parts = [`${String(outcome.added)} added`];
+    if (outcome.duplicate > 0) parts.push(`${String(outcome.duplicate)} already held`);
+    if (outcome.rejected.length > 0) parts.push(`${String(outcome.rejected.length)} not readable`);
+    notify(parts.join(", "));
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Import failed: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+
+// ── Station line ────────────────────────────────────────────────────────────
+
+function renderStation(): void {
+  const callsign = hostState.ownerCallsign ?? "";
+  if (stationCallEl) stationCallEl.textContent = callsign || "no callsign set";
+  if (operatorInput && !operatorInput.value) operatorInput.value = callsign;
+  if (stationGridEl) {
+    const grid = hostState.serverLat != null && hostState.serverLon != null
+      ? hostCore.latLonToMaidenhead(hostState.serverLat, hostState.serverLon)
+      : "";
+    entryGrid = grid || null;
+    stationGridEl.textContent = grid;
+  }
+}
+
+// ── Wiring ──────────────────────────────────────────────────────────────────
+
+form?.addEventListener("submit", (event) => { void submitEntry(event); });
+clearBtn?.addEventListener("click", resetEntry);
+callInput?.addEventListener("input", updateWorkedBefore);
+for (const control of [filterCall, filterBand, filterMode]) {
+  control?.addEventListener("input", () => { void refreshLog(); });
+  control?.addEventListener("change", () => { void refreshLog(); });
+}
+for (const control of [cabrilloContest, cabrilloCallsign, cabrilloOperator, cabrilloPower, cabrilloScore]) {
+  control?.addEventListener("input", syncCabrilloLink);
+  control?.addEventListener("change", syncCabrilloLink);
+}
+importBtn?.addEventListener("click", () => { importFile?.click(); });
+importFile?.addEventListener("change", () => {
+  const file = importFile.files?.[0];
+  if (file) void importAdif(file);
+  importFile.value = "";
+});
+
+/** Start an entry from a decode, and show the operator where it went. */
+if (canWriteLogbook()) {
+  bridge.logContact = (seed) => {
+    bridge.navigateToTab?.("logbook");
+    void openEntry(seed).then(() => callInput?.focus());
+  };
+} else {
+  if (form) form.style.display = "none";
+  if (importBtn) importBtn.style.display = "none";
+}
+
+renderStation();
+if (cabrilloCallsign && !cabrilloCallsign.value) {
+  cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
+}
+syncCabrilloLink();
+if (canWriteLogbook()) void openEntry();
+void refreshLog();
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import type { SatelliteScheduleConfig, SatelliteSchedulerApi } from "./satellite-types.js";
+import type { AuthRole } from "../api/auth.js";

 export type SchedulerMode = "disabled" | "grayline" | "time_span";

@@ -60,7 +61,7 @@ export interface SchedulerStatus {
 }

 export interface SchedulerService {
-  initialize(rigId: string | null, role: string | null): void;
+  initialize(rigId: string | null, roles: readonly AuthRole[]): void;
  destroy(): void;
  setRig(rigId: string | null): void;
  wireEvents(): void;
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import { hostState } from "./host.js";
+import { hasAuthRole, type AuthRole } from "../api/auth.js";

 import type {
  ScheduleEntry,
@@ -43,7 +44,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
  // -------------------------------------------------------------------------
  // State
  // -------------------------------------------------------------------------
-  let schedulerRole: string | null = null;
+  let schedulerRoles: readonly AuthRole[] = [];
  let currentRigId: string | null = null;
  let currentConfig: SchedulerConfig | null = null;
  let currentSchedulerStatus: SchedulerStatus | null = null;
@@ -58,8 +59,8 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
  // -------------------------------------------------------------------------
  // Init
  // -------------------------------------------------------------------------
-  function initScheduler(rigId: string | null, role: string | null): void {
-    schedulerRole = role;
+  function initScheduler(rigId: string | null, roles: readonly AuthRole[]): void {
+    schedulerRoles = roles;
    currentRigId = rigId || null;
    if (currentRigId) loadScheduler();
    startStatusPolling();
@@ -356,7 +357,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
    if (!prevBtn || !nextBtn) return;
    const state = schedulerInterleaveState(currentConfig);
    const enabled =
-      schedulerRole === "control" &&
+      hasAuthRole(schedulerRoles, "control") &&
      !!currentRigId &&
      !schedulerStepPending &&
      state.activeEntries.length > 1;
@@ -466,7 +467,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
    if (!panel) return;

    const mode = (currentConfig && currentConfig.mode) || "disabled";
-    const isControl = schedulerRole === "control";
+    const isControl = hasAuthRole(schedulerRoles, "control");

    // Mode selector
    setSelected("scheduler-mode-select", mode);
@@ -1574,8 +1575,8 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
  // When loaded eagerly, initSettingsUI() in app.js calls initScheduler();
  // when loaded lazily (e.g. settings tab click after boot), the app has
  // already passed that point, so we must self-initialize here.
-  if (hostState.authRole != null) {
-    initScheduler(hostState.lastActiveRigId, hostState.authRole);
+  if (!hostState.authEnabled || hostState.authRoles.length > 0) {
+    initScheduler(hostState.lastActiveRigId, hostState.authRoles);
    wireSchedulerEvents();
  }
 })();
@@ -24,8 +24,8 @@ interface ButtonStateOptions {
  disabled?: boolean;
 }
 type TabKind = "primary" | "secondary";
-type LayoutCapability = "broadcast" | "digital";
-type LayoutName = "compact" | "broadcast" | "digital" | "full";
+type LayoutCapability = "broadcast" | "digital" | "ham";
+type LayoutName = "compact" | "broadcast" | "digital" | "full" | "ham";
 interface OperatorLayout {
  label: string;
  unavailable?: string;
@@ -191,8 +191,11 @@ function elementById<T extends HTMLElement>(id: string): T {
    broadcast: { label: "Broadcast", unavailable: "Broadcast requires an enumerated WFM-capable receiver", advanced: false, audio: true, scheduler: false, preferredTab: "main", capability: "broadcast" },
    digital: { label: "Digital", unavailable: "Digital requires a compatible rig mode and an available decoder", advanced: false, audio: false, scheduler: false, preferredTab: "digital-modes", capability: "digital" },
    full: { label: "Full controls", advanced: true, audio: true, scheduler: true, preferredTab: "main" },
+    // Working the bands: the log is the task and the radio is the instrument,
+    // so this one opens on the logbook with the controls a keystroke away.
+    ham: { label: "Ham radio", unavailable: "Ham radio needs a rig that can transmit", advanced: true, audio: true, scheduler: false, preferredTab: "logbook", capability: "ham" },
  };
-  const layoutCapabilities: Record<LayoutCapability, boolean> = { broadcast: false, digital: false };
+  const layoutCapabilities: Record<LayoutCapability, boolean> = { broadcast: false, digital: false, ham: false };
  let activeRigId: string | null = null;

  // A layout seeds the collapsible sections; it does not hold them there.
@@ -0,0 +1,102 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+/* global document */
+
+const ALL_ROLES = ["read", "control", "transmit", "write", "administrator"];
+const fixture = await startWebFixture({
+  authSession: {
+    authenticated: true,
+    username: "admin",
+    roles: ALL_ROLES,
+    auth_disabled: false,
+  },
+  users: [
+    { username: "admin", roles: ALL_ROLES, enabled: true },
+    { username: "guest", roles: ["guest"], enabled: true },
+    { username: "listener", roles: ["read"], enabled: false },
+  ],
+});
+const { browser, page, runtimeErrors } = await startBrowser(chromium);
+
+try {
+  await page.goto(`${fixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await page.locator("#tab-settings").waitFor({ state: "visible" });
+  await page.locator("#settings-account-tab").waitFor({ state: "visible" });
+  await page.locator("#settings-users-tab").waitFor({ state: "visible" });
+
+  await page.locator("#settings-account-tab").click();
+  assert.equal(await page.locator("#account-password-form").isVisible(), true);
+  assert.equal(await page.locator("#subtab-settings-users").isVisible(), false);
+
+  await page.locator("#settings-users-tab").click();
+  await page.locator("#user-list").getByText("listener (disabled)").waitFor();
+  assert.equal(await page.locator("#user-create-form").isVisible(), true);
+
+  const state = await page.evaluate(() => {
+    const rows = [...document.querySelectorAll("#user-list > .sch-row")];
+    const rowFor = (username) => rows.find((row) => row.querySelector("strong")?.textContent.startsWith(username));
+    const admin = rowFor("admin");
+    const guest = rowFor("guest");
+    const listener = rowFor("listener");
+    const role = (row, value) => row?.querySelector(`input[value="${value}"]`);
+    return {
+      createRoles: [...document.querySelectorAll("#user-create-roles input")].map((input) => input.value),
+      adminEnabledLocked: admin?.querySelector('input[type="checkbox"]')?.disabled,
+      adminRoleLocked: role(admin, "administrator")?.disabled,
+      adminGuestLocked: role(admin, "guest")?.disabled,
+      adminRemoveLocked: admin?.querySelector("button.danger")?.disabled,
+      guestPasswordLocked: guest?.querySelector('input[type="password"]')?.disabled,
+      listenerEnabled: listener?.querySelector('input[type="checkbox"]')?.checked,
+      listenerRead: role(listener, "read")?.checked,
+    };
+  });
+  assert.deepEqual(state.createRoles, ["guest", ...ALL_ROLES]);
+  assert.equal(state.adminEnabledLocked, true);
+  assert.equal(state.adminRoleLocked, true);
+  assert.equal(state.adminGuestLocked, true);
+  assert.equal(state.adminRemoveLocked, true);
+  assert.equal(state.guestPasswordLocked, true);
+  assert.equal(state.listenerEnabled, false);
+  assert.equal(state.listenerRead, true);
+
+  const listenerRow = page.locator("#user-list > .sch-row").filter({ hasText: "listener" });
+  const listenerPassword = listenerRow.locator('input[type="password"]');
+  await listenerRow.locator('input[value="guest"]').check();
+  assert.equal(await listenerPassword.isDisabled(), true);
+  assert.equal(await listenerRow.locator('input[value="read"]').isChecked(), true);
+  await listenerRow.locator('input[value="control"]').check();
+  assert.equal(await listenerRow.locator('input[value="guest"]').isChecked(), true);
+  assert.equal(await listenerPassword.isDisabled(), true);
+  await listenerRow.locator('input[value="guest"]').uncheck();
+  assert.equal(await listenerPassword.isDisabled(), false);
+  assert.deepEqual(runtimeErrors, []);
+} finally {
+  await browser.close();
+  await fixture.close();
+}
+
+const guestFixture = await startWebFixture({
+  authSession: {
+    authenticated: true,
+    username: "guest",
+    roles: ["guest"],
+    auth_disabled: false,
+  },
+});
+const guestBrowser = await startBrowser(chromium);
+try {
+  await guestBrowser.page.goto(`${guestFixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await guestBrowser.page.locator("#tab-settings").waitFor({ state: "visible" });
+  assert.equal(await guestBrowser.page.locator("#settings-account-tab").isVisible(), false);
+  assert.equal(await guestBrowser.page.locator("#settings-users-tab").isVisible(), false);
+  assert.deepEqual(guestBrowser.runtimeErrors, []);
+} finally {
+  await guestBrowser.browser.close();
+  await guestFixture.close();
+}
@@ -0,0 +1,61 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import vm from "node:vm";
+import { bundleEntry } from "./bundle-entry.mjs";
+
+const source = await bundleEntry(new URL("../src/api/auth.ts", import.meta.url), "AuthApi");
+
+function loadAuth(fetch) {
+  const context = vm.createContext({ fetch, console });
+  new vm.Script(source).runInContext(context);
+  return context.AuthApi;
+}
+
+test("role policy centralizes Guest and separates Control from Transmit", () => {
+  const auth = loadAuth(async () => { throw new Error("unused"); });
+  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "transmit", "write", "administrator"]);
+  assert.equal(auth.hasAuthRole(["guest"], "read"), true);
+  assert.equal(auth.hasAccountControls(["guest"]), false);
+  assert.equal(auth.hasAccountControls(["read"]), true);
+  assert.equal(auth.hasAuthRole(["control"], "read"), true);
+  assert.equal(auth.hasAuthRole(["transmit"], "read"), true);
+  assert.equal(auth.hasAuthRole(["control"], "transmit"), false);
+  assert.equal(auth.hasAuthRole(["control"], "write"), false);
+  assert.equal(auth.hasAuthRole(["administrator"], "write"), true);
+});
+
+test("auth responses normalize roles and require the managed-account lifecycle state", async () => {
+  const replies = new Map([
+    ["/auth/session", { authenticated: true, roles: ["write", "read", "write"], username: "alice" }],
+    ["/auth/users", [{ username: "alice", roles: ["write", "read"], enabled: false }]],
+  ]);
+  const auth = loadAuth(async (url) => ({
+    ok: true,
+    status: 200,
+    json: async () => replies.get(String(url)),
+  }));
+
+  assert.deepEqual(Array.from((await auth.fetchAuthSession()).roles), ["read", "write"]);
+  assert.deepEqual(Array.from((await auth.listUsers())[0].roles), ["read", "write"]);
+  assert.equal((await auth.listUsers())[0].enabled, false);
+});
+
+test("changing a password sends current and replacement credentials", async () => {
+  let request;
+  const auth = loadAuth(async (url, init) => {
+    request = { url, init };
+    return { ok: true, status: 200, json: async () => ({}) };
+  });
+
+  await auth.changeOwnPassword("old-password", "new-password");
+  assert.equal(request.url, "/auth/account/password");
+  assert.equal(request.init.method, "PATCH");
+  assert.deepEqual(JSON.parse(request.init.body), {
+    current_password: "old-password",
+    new_password: "new-password",
+  });
+});
@@ -40,7 +40,7 @@ test("background decode loads configuration for the explicitly selected rig", as
  const source = await bundleEntry(new URL("../src/plugins/background-decode.ts", import.meta.url));
  new vm.Script(source).runInContext(context);

-  window.trx.modules.backgroundDecode.initialize("rig/a", "control");
+  window.trx.modules.backgroundDecode.initialize("rig/a", ["administrator"]);
  await new Promise((resolve) => setTimeout(resolve, 0));
  assert.ok(requested.includes("/background-decode/rig%2Fa"));
  assert.ok(requested.includes("/bookmarks"));
@@ -32,7 +32,7 @@ function hostFixture(overrides = {}) {
  const calls = { postPath: [], setRigFrequency: [], armOptimisticFrequency: [], applyLocalTunedFrequency: [], syncBandwidthInput: [], scheduleSpectrumDraw: 0, syncModePicker: 0 };
  const state = {
    authEnabled: false,
-    authRole: "control",
+    authRoles: ["read", "control", "transmit", "write", "administrator"],
    lastActiveRigId: null,
    lastRigIds: [],
    lastRigDisplayNames: {},
@@ -157,7 +157,7 @@ test("bookmark controls follow the host authentication state", async () => {
    if (!elements.has(id)) elements.set(id, new ElementFixture());
    return elements.get(id);
  };
-  const { window } = hostFixture({ authEnabled: true, authRole: "rx" });
+  const { window } = hostFixture({ authEnabled: true, authRoles: ["read"] });
  const context = vm.createContext({
    window,
    document: documentFixture(element),
@@ -171,7 +171,7 @@ test("bookmark controls follow the host authentication state", async () => {

  assert.equal(element("bm-add-btn").style.display, "none");

-  window.trx.state.authRole = "control";
+  window.trx.state.authRoles = ["read", "write"];
  await window.trx.modules.bookmarks.fetch("");
  assert.equal(element("bm-add-btn").style.display, "");
 });
@@ -19,7 +19,7 @@ export function createHost({ state = {}, core = {}, modules = {} } = {}) {
        serverLat: null,
        serverLon: null,
        authEnabled: false,
-        authRole: "control",
+        authRoles: ["read", "control", "transmit", "write", "administrator"],
        lastActiveRigId: null,
        lastRigIds: [],
        lastRigDisplayNames: {},
@@ -0,0 +1,225 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+// The station log: the panel opens an entry pre-filled from the radio and the
+// server's clock, writes a contact, keeps it, and says whether the station has
+// been worked before. And the ham layout, which is offered only where a rig can
+// transmit -- a log is of contacts made.
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+/* global document, window, location */
+
+const HELD = [
+  {
+    id: "q1", started_at: "2026-08-06T14:22:00Z", call: "DL3ABC", freq_hz: 14_074_000,
+    band: "20m", mode: "FT8", rst_sent: "-07", rst_rcvd: "-12", gridsquare: "JO31",
+    my_rig: "Primary fixture",
+  },
+  {
+    id: "q2", started_at: "2026-08-06T13:05:00Z", call: "SP9XYZ", freq_hz: 7_120_000,
+    band: "40m", mode: "SSB", submode: "LSB", rst_sent: "59", rst_rcvd: "57",
+    gridsquare: "JO90", my_rig: "Primary fixture",
+  },
+];
+
+const fixture = await startWebFixture({ spectrum: true, tx: true, logbook: [...HELD] });
+const { browser, page, runtimeErrors } = await startBrowser(chromium);
+
+const readPanel = () => page.evaluate(() => ({
+  rows: [...(document.getElementById("log-rows")?.children ?? [])].map((row) => ({
+    call: row.querySelector(".log-cell-call")?.textContent ?? "",
+    cells: [...row.querySelectorAll("td")].map((cell) => cell.textContent),
+  })),
+  summary: document.getElementById("log-summary")?.textContent ?? "",
+  freq: document.getElementById("log-freq")?.value ?? "",
+  mode: document.getElementById("log-mode")?.value ?? "",
+  call: document.getElementById("log-call")?.value ?? "",
+  grid: document.getElementById("log-grid")?.value ?? "",
+  rig: document.getElementById("log-station-rig-name")?.textContent ?? "",
+  clock: document.getElementById("log-clock")?.textContent ?? "",
+  worked: document.getElementById("log-worked-before")?.textContent ?? "",
+}));
+
+try {
+  await page.setViewportSize({ width: 1400, height: 950 });
+  await page.goto(`${fixture.origin}/logbook`, { waitUntil: "domcontentloaded" });
+  await page.locator("#tab-logbook").waitFor({ state: "visible" });
+  await page.waitForTimeout(2500);
+
+  // The log is there, newest first, with the band and mode of each contact.
+  const opened = await readPanel();
+  assert.deepEqual(opened.rows.map((row) => row.call), ["DL3ABC", "SP9XYZ"]);
+  assert.equal(opened.summary, "2 contacts");
+  // A phone contact shows the sideband it was worked on, not just "SSB".
+  assert.ok(opened.rows[1].cells.includes("LSB"), `the row reads ${JSON.stringify(opened.rows[1].cells)}`);
+
+  // The entry opened pre-filled: frequency and mode from the rig, the rig's
+  // name, and the time from the server.
+  assert.equal(opened.freq, "100", `the frequency pre-filled as "${opened.freq}"`);
+  assert.equal(opened.mode, "USB", `the mode pre-filled as "${opened.mode}"`);
+  assert.equal(opened.rig, "Primary fixture");
+  assert.match(opened.clock, /^\d{2}:\d{2}:\d{2}Z$/, `the clock reads "${opened.clock}"`);
+  // ...and nothing else was: a report is the operator's to give.
+  assert.equal(opened.call, "");
+  assert.equal(await page.evaluate(() => document.getElementById("log-rst-sent")?.value), "");
+
+  // Worked-before answers as the callsign is typed.
+  await page.locator("#log-call").fill("DL3ABC");
+  await page.waitForTimeout(600);
+  assert.match((await readPanel()).worked, /Worked before: 20m FT8/);
+  await page.locator("#log-call").fill("OZ1NEW");
+  await page.waitForTimeout(600);
+  assert.match((await readPanel()).worked, /Not worked before/);
+
+  // Logging writes the contact and clears the entry for the next one.
+  await page.locator("#log-rst-sent").fill("59");
+  await page.locator("#log-rst-rcvd").fill("57");
+  await page.locator("#log-save-btn").click();
+  await page.waitForTimeout(900);
+  const afterLogging = await readPanel();
+  assert.deepEqual(afterLogging.rows.map((row) => row.call), ["OZ1NEW", "DL3ABC", "SP9XYZ"]);
+  assert.equal(afterLogging.summary, "3 contacts");
+  assert.equal(afterLogging.call, "", "the entry kept the callsign after logging it");
+  assert.equal(afterLogging.freq, "100", "the entry did not re-open pre-filled");
+
+  // A decode row starts an entry rather than logging one: what was heard goes
+  // into the form, and the operator finishes it.
+  await page.evaluate(() => { window.navigateToTab("digital-modes"); });
+  await page.waitForTimeout(800);
+  await page.locator('#tab-digital-modes .sub-tab[data-subtab="ft8"]').click();
+  await page.waitForTimeout(400);
+  await page.evaluate(() => {
+    window.trxPluginRuntime.dispatch("ft8", {
+      message: "CQ SP2SJG JO94", snr_db: -7, dt_s: 0.2, freq_hz: 1200,
+      ts_ms: Date.now(), rig_id: "rig-a",
+    });
+  });
+  await page.waitForTimeout(600);
+  await page.locator("#ft8-messages .ft8-log-btn").first().click();
+  await page.waitForTimeout(900);
+  const fromDecode = await page.evaluate(() => ({
+    path: location.pathname,
+    call: document.getElementById("log-call")?.value ?? "",
+    grid: document.getElementById("log-grid")?.value ?? "",
+    mode: document.getElementById("log-mode")?.value ?? "",
+    rows: document.getElementById("log-rows")?.children.length ?? 0,
+  }));
+  assert.equal(fromDecode.path, "/logbook", `the Log button landed on ${fromDecode.path}`);
+  assert.equal(fromDecode.call, "SP2SJG", "the heard callsign did not reach the entry");
+  assert.equal(fromDecode.grid, "JO94", "the heard locator did not reach the entry");
+  // The decoder answers for the mode, because a rig in DIG cannot.
+  assert.equal(fromDecode.mode, "FT8", `the mode came through as "${fromDecode.mode}"`);
+  assert.equal(fromDecode.rows, 3, "a decode logged itself instead of opening an entry");
+
+  // The ham layout is on offer, because this rig can transmit.
+  const layouts = await page.evaluate(() =>
+    [...document.querySelectorAll("#operator-layout-select option")].map((option) => option.value));
+  assert.ok(layouts.includes("ham"), `the layouts are ${JSON.stringify(layouts)}`);
+  // Choosing it the way the picker does. The <select> itself measures zero
+  // wide in a headless window, so Playwright will not click it; the change
+  // event is what the picker is wired to either way.
+  await page.evaluate(() => { window.navigateToTab("main"); });
+  await page.waitForTimeout(600);
+  await page.evaluate(() => {
+    const select = document.getElementById("operator-layout-select");
+    select.value = "ham";
+    select.dispatchEvent(new Event("change", { bubbles: true }));
+  });
+  await page.waitForTimeout(900);
+  const inHamLayout = await page.evaluate(() => ({
+    layout: document.body.dataset.operatorLayout,
+    path: location.pathname,
+  }));
+  assert.equal(inHamLayout.layout, "ham");
+  assert.equal(inHamLayout.path, "/logbook", "the ham layout opened somewhere else");
+
+  // ── Contest working ─────────────────────────────────────────────────────
+  // The exchange belongs to the session: the contest and the serial sent stay
+  // between contacts, and the serial counts on by itself.
+  await page.evaluate(() => { window.navigateToTab("logbook"); });
+  await page.waitForTimeout(600);
+  await page.locator("#log-contest-block > summary").click();
+  await page.locator("#log-contest-id").fill("CQ-WW-SSB");
+  await page.locator("#log-stx").fill("1");
+  await page.locator("#log-call").fill("DL9CON");
+  await page.locator("#log-srx").fill("014");
+  await page.locator("#log-rst-sent").fill("59");
+  await page.locator("#log-rst-rcvd").fill("59");
+  await page.locator("#log-save-btn").click();
+  await page.waitForTimeout(900);
+  const afterContest = await page.evaluate(() => ({
+    contest: document.getElementById("log-contest-id")?.value ?? "",
+    stx: document.getElementById("log-stx")?.value ?? "",
+    srx: document.getElementById("log-srx")?.value ?? "",
+    call: document.getElementById("log-call")?.value ?? "",
+  }));
+  assert.equal(afterContest.contest, "CQ-WW-SSB", "the contest was cleared with the contact");
+  assert.equal(afterContest.stx, "2", `the serial sent went to "${afterContest.stx}"`);
+  assert.equal(afterContest.srx, "", "the received exchange was kept for the next station");
+  assert.equal(afterContest.call, "");
+
+  // The Cabrillo link carries the header, and names the contest so that only
+  // its contacts are entered.
+  await page.locator("#log-contest-export-block > summary").click();
+  await page.locator("#log-cbr-contest").fill("CQ-WW-SSB");
+  await page.locator("#log-cbr-score").fill("4242");
+  await page.waitForTimeout(300);
+  const cabrillo = await page.evaluate(() =>
+    document.getElementById("log-cbr-export")?.getAttribute("href") ?? "");
+  assert.match(cabrillo, /contest=CQ-WW-SSB/, `the Cabrillo link reads "${cabrillo}"`);
+  assert.match(cabrillo, /claimed_score=4242/, `the Cabrillo link reads "${cabrillo}"`);
+  const entry = await page.evaluate(async (href) => {
+    const response = await fetch(href);
+    return await response.text();
+  }, cabrillo);
+  assert.match(entry, /^START-OF-LOG: 3\.0/, entry);
+  assert.match(entry, /DL9CON/, "the contest contact is not in the entry");
+  assert.ok(!entry.includes("OZ1NEW"), "a contact outside the contest was entered");
+
+  // ── Confirmations ───────────────────────────────────────────────────────
+  // A card arrives: the contact is marked confirmed, and the per-band report
+  // counts it.
+  const confirmRow = page.locator("#log-rows tr", { hasText: "DL9CON" }).first();
+  await confirmRow.getByRole("button", { name: "Confirm" }).click();
+  await page.waitForTimeout(800);
+  await page.locator("#log-statistics-block > summary").click();
+  await page.waitForTimeout(400);
+  const confirmed = await page.evaluate(() => ({
+    marks: [...document.querySelectorAll("#log-rows tr")]
+      .map((row) => [...row.querySelectorAll("td")].at(-2)?.textContent ?? ""),
+    bands: [...document.querySelectorAll("#log-statistics-rows tr")]
+      .map((row) => [...row.querySelectorAll("td")].map((cell) => cell.textContent)),
+  }));
+  assert.equal(confirmed.marks.filter((mark) => mark === "✓").length, 1,
+    `the QSL column reads ${JSON.stringify(confirmed.marks)}`);
+  const twenty = confirmed.bands.find((band) => band[0] === "20m");
+  assert.ok(twenty, `the bands are ${JSON.stringify(confirmed.bands)}`);
+  assert.equal(twenty[3], "1", `20m shows ${twenty[3]} confirmed`);
+
+  assert.deepEqual(runtimeErrors, []);
+} finally {
+  await browser.close();
+  await fixture.close();
+}
+
+// Without a transmitter there is nothing to log, so the layout is not offered.
+const listenerFixture = await startWebFixture({ spectrum: true, tx: false });
+const listener = await startBrowser(chromium);
+try {
+  await listener.page.setViewportSize({ width: 1400, height: 950 });
+  await listener.page.goto(`${listenerFixture.origin}/`, { waitUntil: "domcontentloaded" });
+  await listener.page.locator("#content").waitFor({ state: "visible" });
+  await listener.page.waitForTimeout(2000);
+  const layouts = await listener.page.evaluate(() =>
+    [...document.querySelectorAll("#operator-layout-select option")].map((option) => option.value));
+  assert.ok(!layouts.includes("ham"), `a receiver was offered the ham layout: ${JSON.stringify(layouts)}`);
+} finally {
+  await listener.browser.close();
+  await listenerFixture.close();
+}
+
+console.log("logbook tests passed");
@@ -11,7 +11,7 @@ import { bundleEntry } from "./bundle-entry.mjs";
 test("scheduler registers a typed module service without lifecycle globals", async () => {
  // No role known yet: the entry registers its service and waits for the
  // application to drive initialization.
-  const window = { ...createHost({ state: { authRole: null } }), trxUi: { confirm: async () => true } };
+  const window = { ...createHost({ state: { authEnabled: true, authRoles: [] } }), trxUi: { confirm: async () => true } };
  const context = vm.createContext({
    window,
    document: {
@@ -76,7 +76,7 @@ test("scheduler self-initializes for the active rig when a role is already known
    return elements.get(id);
  };
  const window = {
-    ...createHost({ state: { authRole: "control", lastActiveRigId: "sdr" } }),
+    ...createHost({ state: { authRoles: ["administrator"], lastActiveRigId: "sdr" } }),
    trxUi: { confirm: async () => true },
  };
  const context = vm.createContext({
@@ -9,6 +9,7 @@ import { readFile } from "node:fs/promises";
 const indexPath = new URL("../../assets/web/index.html", import.meta.url);
 const pluginLoaderPath = new URL("../src/plugin-loader.ts", import.meta.url);
 const mapCorePath = new URL("../src/map-core.ts", import.meta.url);
+const appPath = new URL("../src/app.ts", import.meta.url);

 test("index loads one first-party application bootstrap", async () => {
  const html = await readFile(indexPath, "utf8");
@@ -30,6 +31,30 @@ test("startup has no remote script or stylesheet dependencies", async () => {
  );
 });

+test("administrator user management is a dedicated Settings sub-tab", async () => {
+  const [html, app] = await Promise.all([
+    readFile(indexPath, "utf8"),
+    readFile(appPath, "utf8"),
+  ]);
+  assert.match(html, /data-subtab="settings-users"/);
+  assert.match(html, /id="subtab-settings-users" class="sub-tab-panel"/);
+  assert.match(app, /authEnabled && hasAuthRole\("administrator"\)/);
+  assert.match(app, /settings-users-tab/);
+});
+
+test("account lifecycle controls include self-service passwords and enable state", async () => {
+  const [html, app] = await Promise.all([
+    readFile(indexPath, "utf8"),
+    readFile(appPath, "utf8"),
+  ]);
+  assert.match(html, /data-subtab="settings-account"/);
+  assert.match(html, /id="account-password-form"/);
+  assert.match(html, /id="user-create-enabled"/);
+  assert.match(app, /changeOwnPassword/);
+  assert.match(app, /hasAccountControls\(authRoles\)/);
+  assert.match(app, /enabledAdminCount/);
+});
+
 test("lazy frontend features use modules and local map symbols", async () => {
  const [loader, map] = await Promise.all([
    readFile(pluginLoaderPath, "utf8"),
@@ -0,0 +1,53 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+async function controlState(page) {
+  return {
+    frequency: await page.locator("#freq").isDisabled(),
+    ptt: await page.locator("#ptt-btn").isDisabled(),
+    txAudio: await page.locator("#tx-audio-btn").isDisabled(),
+    txLimit: await page.locator("#tx-limit-btn").isDisabled(),
+  };
+}
+
+async function inspectRole(roles) {
+  const fixture = await startWebFixture({
+    tx: true,
+    authSession: {
+      authenticated: true,
+      username: "operator",
+      roles,
+      auth_disabled: false,
+    },
+  });
+  const session = await startBrowser(chromium);
+  try {
+    await session.page.goto(`${fixture.origin}/`, { waitUntil: "domcontentloaded" });
+    await session.page.locator("#content").waitFor({ state: "visible" });
+    await session.page.waitForTimeout(1200);
+    assert.deepEqual(session.runtimeErrors, []);
+    return await controlState(session.page);
+  } finally {
+    await session.browser.close();
+    await fixture.close();
+  }
+}
+
+assert.deepEqual(await inspectRole(["control"]), {
+  frequency: false,
+  ptt: true,
+  txAudio: true,
+  txLimit: true,
+});
+
+assert.deepEqual(await inspectRole(["transmit"]), {
+  frequency: true,
+  ptt: false,
+  txAudio: false,
+  txLimit: false,
+});
@@ -140,10 +140,13 @@ export async function startWebFixture({
  history = {},
  bookmarks = [],
  backgroundDecode = null,
+  logbook = [],
  bandplan = {},
  bandplanEnabled = false,
  bandplanUnauthorizedFirst = false,
  satPasses = null,
+  authSession = { authenticated: true, roles: ["read", "control", "transmit", "write", "administrator"], auth_disabled: true },
+  users = [],
 } = {}) {
  const rigItems = ["rig-a", "rig-b"].map((remote) => ({
    remote,
@@ -231,7 +234,8 @@ export async function startWebFixture({
  };

  const jsonRoutes = new Map([
-    ["/auth/session", { authenticated: true, role: "control", auth_disabled: true }],
+    ["/auth/session", authSession],
+    ["/auth/users", users],
    ["/decoders", DECODER_REGISTRY],
    ["/rigs", rigsResponse],
    ["/status", status],
@@ -279,6 +283,130 @@ export async function startWebFixture({
      response.writeHead(200).end();
      return;
    }
+    // The logbook: an in-memory station log, enough for the panel to open an
+    // entry, write it, read it back and export it.
+    if (url.pathname.startsWith("/api/logbook")) {
+      const tail = url.pathname.slice("/api/logbook".length);
+      if (tail === "/prefill") {
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({
+          started_at: new Date().toISOString(),
+          epoch_ms: Date.now(),
+          freq_hz: status.status.freq.hz,
+          band: "20m",
+          mode: url.searchParams.get("decoder") === "ft8" ? "FT8" : "SSB",
+          submode: url.searchParams.get("decoder") === "ft8" ? null : "USB",
+          rig_id: url.searchParams.get("remote") ?? "rig-a",
+          my_rig: "Primary fixture",
+          call: url.searchParams.get("call"),
+          gridsquare: url.searchParams.get("gridsquare"),
+        }));
+        return;
+      }
+      if (tail.startsWith("/worked/")) {
+        const call = decodeURIComponent(tail.slice("/worked/".length)).toUpperCase();
+        const worked = logbook
+          .filter((qso) => qso.call === call)
+          .map((qso) => ({ band: qso.band, mode: qso.mode }));
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({ call, worked }));
+        return;
+      }
+      if (tail === "/statistics") {
+        const bands = new Map();
+        for (const qso of logbook) {
+          const entry = bands.get(qso.band) ?? { band: qso.band, contacts: 0, stations: 0, confirmed: 0, calls: new Set() };
+          entry.contacts += 1;
+          entry.calls.add(qso.call);
+          if (qso.confirmed || qso.qsl_rcvd === "Y" || qso.lotw_qsl_rcvd === "Y") entry.confirmed += 1;
+          bands.set(qso.band, entry);
+        }
+        const list = [...bands.values()].map(({ calls, ...rest }) => ({ ...rest, stations: calls.size }));
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({
+          contacts: logbook.length,
+          confirmed: list.reduce((total, band) => total + band.confirmed, 0),
+          bands: list,
+        }));
+        return;
+      }
+      if (tail === "/export.cbr") {
+        const contest = url.searchParams.get("contest");
+        const entered = contest ? logbook.filter((qso) => qso.contest_id === contest) : logbook;
+        response.writeHead(200, { "content-type": "text/plain" });
+        response.end(`START-OF-LOG: 3.0\nCONTEST: ${contest ?? ""}\n`
+          + entered.map((qso) => `QSO: 14200 PH ${qso.call}\n`).join("")
+          + "END-OF-LOG:\n");
+        return;
+      }
+      if (request.method === "PUT") {
+        const raw = await new Promise((resolve) => {
+          let text = "";
+          request.on("data", (chunk) => { text += chunk; });
+          request.on("end", () => resolve(text));
+        });
+        const input = JSON.parse(raw);
+        const id = tail.replace("/", "");
+        const held = logbook.find((qso) => qso.id === id);
+        if (held) {
+          Object.assign(held, input, { id, confirmed: input.qsl_rcvd === "Y" });
+        }
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify(held ?? {}));
+        return;
+      }
+      if (tail === "/export.adi") {
+        const body = logbook
+          .map((qso) => `<CALL:${qso.call.length}>${qso.call}<EOR>\n`)
+          .join("");
+        response.writeHead(200, { "content-type": "text/plain" });
+        response.end(body);
+        return;
+      }
+      if (request.method === "POST" && tail === "") {
+        const raw = await new Promise((resolve) => {
+          let text = "";
+          request.on("data", (chunk) => { text += chunk; });
+          request.on("end", () => resolve(text));
+        });
+        const input = JSON.parse(raw);
+        const qso = {
+          id: `qso-${String(logbook.length + 1)}`,
+          started_at: input.started_at ?? new Date().toISOString(),
+          call: String(input.call).toUpperCase(),
+          freq_hz: input.freq_hz,
+          band: "20m",
+          mode: input.mode,
+          submode: input.submode,
+          rst_sent: input.rst_sent,
+          rst_rcvd: input.rst_rcvd,
+          gridsquare: input.gridsquare ? String(input.gridsquare).toUpperCase() : null,
+          my_rig: input.my_rig,
+          operator: input.operator,
+          contest_id: input.contest_id ?? null,
+          stx: input.stx ?? null,
+          srx: input.srx ?? null,
+          confirmed: input.qsl_rcvd === "Y" || input.lotw_qsl_rcvd === "Y",
+        };
+        logbook.unshift(qso);
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify(qso));
+        return;
+      }
+      if (request.method === "DELETE") {
+        const id = tail.replace("/", "");
+        const index = logbook.findIndex((qso) => qso.id === id);
+        if (index >= 0) logbook.splice(index, 1);
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({ deleted: index >= 0 }));
+        return;
+      }
+      const wanted = (url.searchParams.get("call") ?? "").toUpperCase();
+      const matching = wanted ? logbook.filter((qso) => qso.call.includes(wanted)) : logbook;
+      response.writeHead(200, { "content-type": "application/json" });
+      response.end(JSON.stringify({ total: logbook.length, qsos: matching }));
+      return;
+    }
    // Background decode: the panel reads its config, its status, and the
    // bookmark list, and writes the config back.
    if (url.pathname.startsWith("/background-decode/")) {
@@ -138,6 +138,17 @@ pub(crate) async fn statistics_index(req: HttpRequest) -> impl Responder {
    )
 }

+#[get("/logbook")]
+pub(crate) async fn logbook_index(req: HttpRequest) -> impl Responder {
+    let c = gz_index_html();
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
+}
+
 #[get("/satellites")]
 pub(crate) async fn satellites_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
@@ -9,7 +9,7 @@ use std::sync::Arc;
 use actix_web::Error;
 use actix_web::{delete, get, post, put, web, HttpRequest, HttpResponse};

-use super::{no_cache_response, request_accepts_html, require_control};
+use super::{no_cache_response, request_accepts_html, require_write};
 use crate::server::status;

 // ============================================================================
@@ -37,6 +37,7 @@ pub struct BookmarkInput {
    pub comment: Option<String>,
    pub category: Option<String>,
    pub decoders: Option<Vec<String>>,
+    pub dig_sideband: Option<String>,
 }

 /// A bookmark with its owning scope tag for the list response.
@@ -88,6 +89,17 @@ fn normalize_bookmark_locator(locator: Option<String>) -> Option<String> {
    })
 }

+/// Normalize a DIG sideband override to `auto`/`usb`/`lsb`, or `None` when
+/// absent or unrecognized (leaves the current policy untouched on apply).
+fn normalize_dig_sideband(value: Option<String>) -> Option<String> {
+    value.and_then(|v| match v.trim().to_lowercase().as_str() {
+        "auto" => Some("auto".to_string()),
+        "usb" => Some("usb".to_string()),
+        "lsb" => Some("lsb".to_string()),
+        _ => None,
+    })
+}
+
 // ============================================================================
 // Endpoints
 // ============================================================================
@@ -165,7 +177,7 @@ pub async fn create_bookmark(
    body: web::Json<BookmarkInput>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    if store.freq_taken(body.freq_hz, None) {
        return Err(actix_web::error::ErrorConflict(
@@ -182,6 +194,7 @@ pub async fn create_bookmark(
        comment: body.comment.clone().unwrap_or_default(),
        category: body.category.clone().unwrap_or_default(),
        decoders: body.decoders.clone().unwrap_or_default(),
+        dig_sideband: normalize_dig_sideband(body.dig_sideband.clone()),
    };
    if store.insert(&bm) {
        Ok(HttpResponse::Created().json(bm))
@@ -201,7 +214,7 @@ pub async fn update_bookmark(
    body: web::Json<BookmarkInput>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let id = path.into_inner();
    if store.freq_taken(body.freq_hz, Some(&id)) {
@@ -219,6 +232,7 @@ pub async fn update_bookmark(
        comment: body.comment.clone().unwrap_or_default(),
        category: body.category.clone().unwrap_or_default(),
        decoders: body.decoders.clone().unwrap_or_default(),
+        dig_sideband: normalize_dig_sideband(body.dig_sideband.clone()),
    };
    if store.upsert(&id, &bm) {
        Ok(HttpResponse::Ok().json(bm))
@@ -235,7 +249,7 @@ pub async fn delete_bookmark(
    query: web::Query<BookmarkScopeQuery>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let id = path.into_inner();
    if store.remove(&id) {
@@ -253,7 +267,7 @@ pub async fn batch_delete_bookmarks(
    query: web::Query<BookmarkScopeQuery>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let mut deleted = 0usize;
    for id in &body.ids {
@@ -272,7 +286,7 @@ pub async fn batch_move_bookmarks(
    query: web::Query<BookmarkScopeQuery>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let from_store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let to_store = resolve_bookmark_store(Some(body.to.as_str()), store_map.get_ref());
    let mut moved = 0usize;
@@ -0,0 +1,456 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! The logbook over HTTP: read, write, import, export, and the clock a contact
+//! is stamped from.
+
+use std::sync::Arc;
+
+use actix_web::http::header;
+use actix_web::{delete, get, post, put, web, HttpRequest, HttpResponse, Responder};
+use chrono::Utc;
+use serde::{Deserialize, Serialize};
+
+use trx_logbook::qso::{adif_mode_for_rig_mode, band_for_hz, mode_for_decoder};
+use trx_logbook::{LogQuery, Logbook, Qso};
+
+use super::{active_rig_id_from_context, require_write};
+use crate::server::auth::AuthState;
+
+/// What a contact looks like on the wire.
+///
+/// The band is sent although it is derived, because every reader of the log
+/// wants it and none of them should have to carry the band plan to get it.
+#[derive(Debug, Serialize)]
+struct QsoView {
+    #[serde(flatten)]
+    qso: Qso,
+    band: Option<&'static str>,
+    /// Whether the other station has confirmed, from whichever bureau answered.
+    confirmed: bool,
+}
+
+impl From<Qso> for QsoView {
+    fn from(qso: Qso) -> Self {
+        Self {
+            band: qso.band(),
+            confirmed: qso.is_confirmed(),
+            qso,
+        }
+    }
+}
+
+/// A contact as the panel sends it.
+///
+/// Times come from the server (`started_at` omitted means "now"), so a browser
+/// with a wrong clock cannot write a wrong time into the log.
+#[derive(Debug, Deserialize)]
+struct QsoInput {
+    #[serde(default)]
+    id: Option<String>,
+    #[serde(default)]
+    started_at: Option<chrono::DateTime<Utc>>,
+    #[serde(default)]
+    ended_at: Option<chrono::DateTime<Utc>>,
+    call: String,
+    freq_hz: u64,
+    mode: String,
+    #[serde(default)]
+    submode: Option<String>,
+    #[serde(default)]
+    rst_sent: Option<String>,
+    #[serde(default)]
+    rst_rcvd: Option<String>,
+    #[serde(default)]
+    gridsquare: Option<String>,
+    #[serde(default)]
+    name: Option<String>,
+    #[serde(default)]
+    qth: Option<String>,
+    #[serde(default)]
+    comment: Option<String>,
+    #[serde(default)]
+    tx_pwr_w: Option<f64>,
+    #[serde(default)]
+    station_callsign: Option<String>,
+    #[serde(default)]
+    operator: Option<String>,
+    #[serde(default)]
+    my_gridsquare: Option<String>,
+    #[serde(default)]
+    my_rig: Option<String>,
+    #[serde(default)]
+    rig_id: Option<String>,
+    #[serde(default)]
+    contest_id: Option<String>,
+    #[serde(default)]
+    stx: Option<u32>,
+    #[serde(default)]
+    stx_string: Option<String>,
+    #[serde(default)]
+    srx: Option<u32>,
+    #[serde(default)]
+    srx_string: Option<String>,
+    #[serde(default)]
+    cqz: Option<u8>,
+    #[serde(default)]
+    ituz: Option<u8>,
+    #[serde(default)]
+    qsl_sent: Option<String>,
+    #[serde(default)]
+    qsl_rcvd: Option<String>,
+    #[serde(default)]
+    lotw_qsl_sent: Option<String>,
+    #[serde(default)]
+    lotw_qsl_rcvd: Option<String>,
+    #[serde(default)]
+    eqsl_qsl_sent: Option<String>,
+    #[serde(default)]
+    eqsl_qsl_rcvd: Option<String>,
+}
+
+/// ADIF's QSL states are single letters. Anything else is refused rather than
+/// written, or a log would grow states no other program can read.
+fn qsl_state(value: Option<String>) -> Option<String> {
+    let state = blank_to_none(value)?.to_uppercase();
+    matches!(state.as_str(), "Y" | "N" | "R" | "I" | "Q" | "V").then_some(state)
+}
+
+fn blank_to_none(value: Option<String>) -> Option<String> {
+    value
+        .map(|text| text.trim().to_string())
+        .filter(|text| !text.is_empty())
+}
+
+impl QsoInput {
+    fn into_qso(self, existing: Option<Qso>) -> Result<Qso, String> {
+        let call = self.call.trim();
+        if call.is_empty() {
+            return Err("a contact needs a callsign".to_string());
+        }
+        if self.mode.trim().is_empty() {
+            return Err("a contact needs a mode".to_string());
+        }
+        let started_at = self
+            .started_at
+            .or(existing.as_ref().map(|q| q.started_at))
+            .unwrap_or_else(Utc::now);
+        let mut qso = Qso::new(
+            self.id
+                .or(existing.as_ref().map(|q| q.id.clone()))
+                .unwrap_or_else(trx_logbook::new_id),
+            started_at,
+            call,
+            self.freq_hz,
+            &self.mode,
+        );
+        qso.ended_at = self.ended_at;
+        qso.submode = blank_to_none(self.submode).map(|s| s.to_uppercase());
+        qso.rst_sent = blank_to_none(self.rst_sent);
+        qso.rst_rcvd = blank_to_none(self.rst_rcvd);
+        qso.gridsquare = blank_to_none(self.gridsquare).map(|g| g.to_uppercase());
+        qso.name = blank_to_none(self.name);
+        qso.qth = blank_to_none(self.qth);
+        qso.comment = blank_to_none(self.comment);
+        qso.tx_pwr_w = self.tx_pwr_w;
+        qso.station_callsign = blank_to_none(self.station_callsign).map(|c| c.to_uppercase());
+        qso.operator = blank_to_none(self.operator).map(|c| c.to_uppercase());
+        qso.my_gridsquare = blank_to_none(self.my_gridsquare).map(|g| g.to_uppercase());
+        qso.my_rig = blank_to_none(self.my_rig);
+        qso.rig_id = blank_to_none(self.rig_id);
+        qso.contest_id = blank_to_none(self.contest_id).map(|c| c.to_uppercase());
+        qso.stx = self.stx;
+        qso.stx_string = blank_to_none(self.stx_string);
+        qso.srx = self.srx;
+        qso.srx_string = blank_to_none(self.srx_string);
+        qso.cqz = self.cqz;
+        qso.ituz = self.ituz;
+        qso.qsl_sent = qsl_state(self.qsl_sent);
+        qso.qsl_rcvd = qsl_state(self.qsl_rcvd);
+        qso.lotw_qsl_sent = qsl_state(self.lotw_qsl_sent);
+        qso.lotw_qsl_rcvd = qsl_state(self.lotw_qsl_rcvd);
+        qso.eqsl_qsl_sent = qsl_state(self.eqsl_qsl_sent);
+        qso.eqsl_qsl_rcvd = qsl_state(self.eqsl_qsl_rcvd);
+        // Whatever an imported contact carried that this application does not
+        // model stays with it through an edit.
+        if let Some(existing) = existing {
+            qso.extra = existing.extra;
+        }
+        Ok(qso)
+    }
+}
+
+fn book(logbook: &web::Data<Arc<Logbook>>) -> Arc<Logbook> {
+    logbook.get_ref().clone()
+}
+
+/// The rig's name as the operator knows it, which is what belongs in the log —
+/// falling back to its id, since a log entry naming nothing is worse.
+fn rig_display_name(context: &trx_frontend::FrontendRuntimeContext, rig_id: &str) -> String {
+    context
+        .routing
+        .remote_rigs
+        .lock()
+        .ok()
+        .and_then(|rigs| {
+            rigs.iter()
+                .find(|rig| rig.rig_id == rig_id)
+                .and_then(|rig| rig.display_name.clone())
+        })
+        .unwrap_or_else(|| rig_id.to_string())
+}
+
+/// `GET /api/logbook` — contacts, newest first, filtered.
+#[get("/api/logbook")]
+pub async fn list_qsos(
+    query: web::Query<LogQuery>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let query = query.into_inner();
+    let total = book(&logbook).count();
+    let qsos: Vec<QsoView> = book(&logbook)
+        .query(&query)
+        .into_iter()
+        .map(QsoView::from)
+        .collect();
+    HttpResponse::Ok().json(serde_json::json!({ "total": total, "qsos": qsos }))
+}
+
+/// `POST /api/logbook` — write a contact.
+#[post("/api/logbook")]
+pub async fn add_qso(
+    req: HttpRequest,
+    input: web::Json<QsoInput>,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    let qso = match input.into_inner().into_qso(None) {
+        Ok(qso) => qso,
+        Err(reason) => {
+            return Ok(HttpResponse::BadRequest().json(serde_json::json!({ "error": reason })))
+        }
+    };
+    match book(&logbook).put(qso) {
+        Ok(saved) => Ok(HttpResponse::Ok().json(QsoView::from(saved))),
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `PUT /api/logbook/{id}` — change a contact.
+#[put("/api/logbook/{id}")]
+pub async fn edit_qso(
+    req: HttpRequest,
+    path: web::Path<String>,
+    input: web::Json<QsoInput>,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    let id = path.into_inner();
+    let Some(existing) = book(&logbook).get(&id) else {
+        return Ok(HttpResponse::NotFound().json(serde_json::json!({ "error": "no such contact" })));
+    };
+    let mut input = input.into_inner();
+    input.id = Some(id);
+    let qso = match input.into_qso(Some(existing)) {
+        Ok(qso) => qso,
+        Err(reason) => {
+            return Ok(HttpResponse::BadRequest().json(serde_json::json!({ "error": reason })))
+        }
+    };
+    match book(&logbook).put(qso) {
+        Ok(saved) => Ok(HttpResponse::Ok().json(QsoView::from(saved))),
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `DELETE /api/logbook/{id}` — forget a contact.
+#[delete("/api/logbook/{id}")]
+pub async fn delete_qso(
+    req: HttpRequest,
+    path: web::Path<String>,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    match book(&logbook).delete(&path.into_inner()) {
+        Ok(true) => Ok(HttpResponse::Ok().json(serde_json::json!({ "deleted": true }))),
+        Ok(false) => {
+            Ok(HttpResponse::NotFound().json(serde_json::json!({ "error": "no such contact" })))
+        }
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `GET /api/logbook/export.adi` — ADIF, honouring the same filters as a read.
+#[get("/api/logbook/export.adi")]
+pub async fn export_adi(
+    query: web::Query<LogQuery>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let text = book(&logbook).export_adi(&query.into_inner(), env!("CARGO_PKG_VERSION"));
+    let filename = format!("trx-rs-log-{}.adi", Utc::now().format("%Y%m%d"));
+    HttpResponse::Ok()
+        .insert_header((header::CONTENT_TYPE, "text/plain; charset=utf-8"))
+        .insert_header((
+            header::CONTENT_DISPOSITION,
+            format!("attachment; filename=\"{filename}\""),
+        ))
+        .body(text)
+}
+
+/// `POST /api/logbook/import` — take an ADIF file, skipping what is already held.
+#[post("/api/logbook/import")]
+pub async fn import_adi(
+    req: HttpRequest,
+    body: web::Bytes,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    match book(&logbook).import_adi(&body) {
+        Ok(outcome) => Ok(HttpResponse::Ok().json(outcome)),
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `GET /api/logbook/export.cbr` — a contest entry, in the only format sponsors
+/// take.
+///
+/// The header cannot be worked out from the log — how many operators, how much
+/// power — so it comes as query parameters from the operator.
+#[get("/api/logbook/export.cbr")]
+pub async fn export_cabrillo(
+    query: web::Query<LogQuery>,
+    header: web::Query<trx_logbook::CabrilloHeader>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let text = book(&logbook).export_cabrillo(&query.into_inner(), &header.into_inner());
+    let filename = format!("trx-rs-contest-{}.cbr", Utc::now().format("%Y%m%d"));
+    HttpResponse::Ok()
+        .insert_header((header::CONTENT_TYPE, "text/plain; charset=utf-8"))
+        .insert_header((
+            header::CONTENT_DISPOSITION,
+            format!("attachment; filename=\"{filename}\""),
+        ))
+        .body(text)
+}
+
+/// `GET /api/logbook/statistics` — what has been worked and confirmed, per band.
+#[get("/api/logbook/statistics")]
+pub async fn statistics(logbook: web::Data<Arc<Logbook>>) -> impl Responder {
+    let bands = book(&logbook).band_statistics();
+    let contacts: usize = bands.iter().map(|band| band.contacts).sum();
+    let confirmed: usize = bands.iter().map(|band| band.confirmed).sum();
+    HttpResponse::Ok().json(serde_json::json!({
+        "contacts": contacts,
+        "confirmed": confirmed,
+        "bands": bands,
+    }))
+}
+
+/// `GET /api/logbook/worked/{call}` — which bands and modes this station has been
+/// worked on.
+#[get("/api/logbook/worked/{call}")]
+pub async fn worked_before(
+    path: web::Path<String>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let call = path.into_inner();
+    let worked: Vec<serde_json::Value> = book(&logbook)
+        .worked_before(&call)
+        .into_iter()
+        .map(|(band, mode)| serde_json::json!({ "band": band, "mode": mode }))
+        .collect();
+    HttpResponse::Ok().json(serde_json::json!({
+        "call": trx_logbook::qso::normalize_call(&call),
+        "worked": worked,
+    }))
+}
+
+/// `GET /api/logbook/now` — the clock a contact is stamped from.
+///
+/// The panel shows the operator when their browser disagrees with it, rather
+/// than logging a time nobody expected.
+#[get("/api/logbook/now")]
+pub async fn server_now() -> impl Responder {
+    let now = Utc::now();
+    HttpResponse::Ok().json(serde_json::json!({
+        "utc": now.to_rfc3339(),
+        "epoch_ms": now.timestamp_millis(),
+    }))
+}
+
+/// `GET /api/logbook/prefill` — the six fields an entry opens with.
+///
+/// Worked out on the server because that is where the rig state, the station
+/// identity and the clock all are; the panel would otherwise have to assemble
+/// them from three places and would still not have the clock.
+#[derive(Debug, Deserialize)]
+pub struct PrefillQuery {
+    /// The rig the entry is for.
+    #[serde(default)]
+    pub remote: Option<String>,
+    /// The decoder a decode row came from, which answers for the mode when the
+    /// rig only says `DIG`.
+    #[serde(default)]
+    pub decoder: Option<String>,
+    /// A callsign and locator carried over from a decode row.
+    #[serde(default)]
+    pub call: Option<String>,
+    #[serde(default)]
+    pub gridsquare: Option<String>,
+}
+
+#[get("/api/logbook/prefill")]
+pub async fn prefill(
+    query: web::Query<PrefillQuery>,
+    context: web::Data<Arc<trx_frontend::FrontendRuntimeContext>>,
+    state: web::Data<tokio::sync::watch::Receiver<trx_core::RigState>>,
+) -> impl Responder {
+    let query = query.into_inner();
+    let rig_id = query
+        .remote
+        .clone()
+        .filter(|id| !id.is_empty())
+        .or_else(|| active_rig_id_from_context(context.get_ref()));
+    let rig_state = rig_id
+        .as_deref()
+        .and_then(|id| context.rig_state_rx(id))
+        .unwrap_or_else(|| state.get_ref().clone())
+        .borrow()
+        .clone();
+
+    let freq_hz = rig_state.status.freq.hz;
+    let rig_mode = format!("{:?}", rig_state.status.mode);
+    // The rig cannot answer for DIG: a rig in DIG is in FT8 or FT4 depending on
+    // which decoder is running, so the decoder is asked first when there is one.
+    let (mode, submode) = query
+        .decoder
+        .as_deref()
+        .and_then(mode_for_decoder)
+        .or_else(|| adif_mode_for_rig_mode(&rig_mode))
+        .map_or((String::new(), None), |(mode, submode)| {
+            (mode.to_string(), submode.map(str::to_string))
+        });
+
+    let now = Utc::now();
+    HttpResponse::Ok().json(serde_json::json!({
+        "started_at": now.to_rfc3339(),
+        "epoch_ms": now.timestamp_millis(),
+        "freq_hz": freq_hz,
+        "band": band_for_hz(freq_hz),
+        "mode": mode,
+        "submode": submode,
+        "rig_id": rig_id,
+        "my_rig": rig_id.as_deref().map(|id| rig_display_name(context.get_ref(), id)),
+        "call": query.call.map(|c| trx_logbook::qso::normalize_call(&c)),
+        "gridsquare": query.gridsquare.map(|g| g.trim().to_uppercase()),
+    }))
+}
@@ -7,6 +7,7 @@
 mod assets;
 mod bookmarks;
 mod decoder;
+mod logbook;
 pub mod recorder;
 pub mod rig;
 mod sse;
@@ -390,16 +391,20 @@ fn gz_cache_entry(src: &[u8], name: &str) -> GzCacheEntry {
    GzCacheEntry { gz, br, etag }
 }

-fn require_control(
+fn require_write(
    req: &HttpRequest,
    auth_state: &crate::server::auth::AuthState,
 ) -> Result<(), actix_web::Error> {
-    if !auth_state.config.enabled {
-        return Ok(());
-    }
-    match crate::server::auth::get_session_role(req, auth_state) {
-        Some(crate::server::auth::AuthRole::Control) => Ok(()),
-        _ => Err(actix_web::error::ErrorForbidden("control role required")),
+    if !auth_state.config.enabled
+        || crate::server::auth::session_grants(
+            req,
+            auth_state,
+            crate::server::auth::AuthRole::Write,
+        )
+    {
+        Ok(())
+    } else {
+        Err(actix_web::error::ErrorForbidden("write role required"))
    }
 }

@@ -590,6 +595,7 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
        .service(rig::set_sdr_agc)
        .service(rig::set_sdr_squelch)
        .service(rig::set_sdr_noise_blanker)
+        .service(rig::set_sdr_dig_sideband)
        .service(rig::set_wfm_deemphasis)
        .service(rig::set_wfm_stereo)
        .service(rig::set_wfm_denoise)
@@ -664,6 +670,7 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
        .service(assets::recorder_index)
        .service(assets::settings_index)
        .service(assets::about_index)
+        .service(assets::logbook_index)
        .service(assets::satellites_index)
        .service(assets::statistics_index)
        .service(assets::bookmarks_index)
@@ -706,7 +713,24 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
        // Auth endpoints
        .service(crate::server::auth::login)
        .service(crate::server::auth::logout)
-        .service(crate::server::auth::session_status);
+        .service(crate::server::auth::session_status)
+        .service(crate::server::auth::change_own_password)
+        .service(crate::server::auth::list_users)
+        .service(crate::server::auth::create_user)
+        .service(crate::server::auth::update_user)
+        .service(crate::server::auth::delete_user)
+        // Logbook
+        .service(logbook::list_qsos)
+        .service(logbook::add_qso)
+        .service(logbook::edit_qso)
+        .service(logbook::delete_qso)
+        .service(logbook::export_adi)
+        .service(logbook::export_cabrillo)
+        .service(logbook::statistics)
+        .service(logbook::import_adi)
+        .service(logbook::worked_before)
+        .service(logbook::server_now)
+        .service(logbook::prefill);
 }

 #[cfg(test)]
@@ -935,6 +959,334 @@ mod tests {
        );
    }

+    /// Auth off: every session may write without an account.
+    fn auth_state_disabled() -> crate::server::auth::AuthState {
+        crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
+            false,
+            std::path::PathBuf::from("unused-users.json"),
+            None,
+            None,
+            std::time::Duration::from_secs(3600),
+            false,
+            crate::server::auth::SameSite::Lax,
+        ))
+        .unwrap()
+    }
+
+    /// Auth on with no session presented, which is what a listener is.
+    fn auth_state_locked() -> crate::server::auth::AuthState {
+        let directory = tempfile::tempdir().unwrap();
+        crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
+            true,
+            directory.path().join("users.json"),
+            Some(crate::server::auth::BootstrapAccount::new(
+                "admin".to_string(),
+                "password123".to_string(),
+            )),
+            None,
+            std::time::Duration::from_secs(3600),
+            false,
+            crate::server::auth::SameSite::Lax,
+        ))
+        .unwrap()
+    }
+
+    /// A contact written over HTTP comes back out of the log, and out of an
+    /// ADIF export that another logger could read.
+    #[actix_web::test]
+    async fn a_contact_written_over_http_is_kept_and_exported() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook.clone()))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso)
+                .service(logbook::list_qsos)
+                .service(logbook::export_adi)
+                .service(logbook::worked_before),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .set_json(serde_json::json!({
+                    "call": "sp2sjg",
+                    "freq_hz": 14_074_000_u64,
+                    "mode": "FT8",
+                    "rst_sent": "-07",
+                    "gridsquare": "jo94",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), 200);
+        let written: serde_json::Value = actix_test::read_body_json(response).await;
+        // Normalised on the way in, and the band worked out from the dial.
+        assert_eq!(written["call"], "SP2SJG");
+        assert_eq!(written["gridsquare"], "JO94");
+        assert_eq!(written["band"], "20m");
+
+        let listed: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook")
+                .to_request(),
+        )
+        .await;
+        assert_eq!(listed["total"], 1);
+        assert_eq!(listed["qsos"][0]["call"], "SP2SJG");
+
+        let worked: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/worked/SP2SJG")
+                .to_request(),
+        )
+        .await;
+        assert_eq!(worked["worked"][0]["band"], "20m");
+
+        let exported = actix_test::call_and_read_body(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/export.adi")
+                .to_request(),
+        )
+        .await;
+        let text = String::from_utf8_lossy(&exported);
+        assert!(text.contains("<CALL:6>SP2SJG"), "{text}");
+        assert!(text.contains("<BAND:3>20m"), "{text}");
+        assert!(text.contains("<EOR>"), "{text}");
+    }
+
+    /// A contest entry comes out in Cabrillo, holding that contest's contacts
+    /// and no others, with the header the operator gave.
+    #[actix_web::test]
+    async fn a_contest_entry_is_exported_as_cabrillo() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook.clone()))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso)
+                .service(logbook::export_cabrillo)
+                .service(logbook::statistics),
+        )
+        .await;
+
+        for (call, contest, serial, confirmed) in [
+            ("DL1AB", Some("CQ-WW-SSB"), 1, true),
+            ("OZ2CD", Some("CQ-WW-SSB"), 2, false),
+            ("SP3EF", None, 0, false),
+        ] {
+            let response = actix_test::call_service(
+                &app,
+                actix_test::TestRequest::post()
+                    .uri("/api/logbook")
+                    .set_json(serde_json::json!({
+                        "call": call,
+                        "freq_hz": 14_200_000_u64,
+                        "mode": "SSB",
+                        "rst_sent": "59",
+                        "rst_rcvd": "59",
+                        "station_callsign": "SP0TRX",
+                        "contest_id": contest,
+                        "stx": serial,
+                        "srx": serial,
+                        "lotw_qsl_rcvd": if confirmed { "Y" } else { "N" },
+                    }))
+                    .to_request(),
+            )
+            .await;
+            assert_eq!(response.status(), 200);
+        }
+
+        let entry = actix_test::call_and_read_body(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/export.cbr?contest=CQ-WW-SSB&callsign=SP0TRX&claimed_score=42")
+                .to_request(),
+        )
+        .await;
+        let text = String::from_utf8_lossy(&entry);
+        assert!(text.starts_with("START-OF-LOG: 3.0"), "{text}");
+        assert!(text.contains("CONTEST: CQ-WW-SSB"), "{text}");
+        assert!(text.contains("CLAIMED-SCORE: 42"), "{text}");
+        assert_eq!(
+            text.lines().filter(|line| line.starts_with("QSO:")).count(),
+            2,
+            "the entry holds contacts from outside the contest: {text}"
+        );
+        assert!(!text.contains("SP3EF"), "{text}");
+
+        // And the statistics count the station once per band, with the
+        // confirmation counted wherever it came from.
+        let stats: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/statistics")
+                .to_request(),
+        )
+        .await;
+        assert_eq!(stats["contacts"], 3);
+        assert_eq!(stats["confirmed"], 1);
+        assert_eq!(stats["bands"][0]["band"], "20m");
+        assert_eq!(stats["bands"][0]["stations"], 3);
+    }
+
+    /// A QSL state that is not one of ADIF's letters is dropped rather than
+    /// written, or the log grows states nothing else can read.
+    #[actix_web::test]
+    async fn a_qsl_state_outside_the_enumeration_is_not_written() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso),
+        )
+        .await;
+        let written: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .set_json(serde_json::json!({
+                    "call": "SP1AA", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                    "qsl_rcvd": "maybe", "lotw_qsl_rcvd": "y",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert!(written.get("qsl_rcvd").is_none(), "{written}");
+        // ...but a lowercase letter that is in the enumeration is taken.
+        assert_eq!(written["lotw_qsl_rcvd"], "Y");
+        assert_eq!(written["confirmed"], true);
+    }
+
+    /// A read-only session may read the log and may not write to it.
+    #[actix_web::test]
+    async fn a_read_only_session_cannot_write_to_the_log() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let auth_state = auth_state_locked();
+        let session_id = auth_state.store.create(
+            "reader".to_string(),
+            [crate::server::auth::AuthRole::Read].into_iter().collect(),
+            std::time::Duration::from_secs(3600),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state))
+                .service(logbook::add_qso)
+                .service(logbook::list_qsos),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new(
+                    "trx_http_sid",
+                    session_id.clone(),
+                ))
+                .set_json(serde_json::json!({
+                    "call": "SP2SJG", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert!(
+            response.status().is_client_error(),
+            "a listener wrote to the log: {}",
+            response.status()
+        );
+        let listed: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new("trx_http_sid", session_id))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(listed["total"], 0);
+    }
+
+    #[actix_web::test]
+    async fn a_write_session_can_write_to_the_log() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let auth_state = auth_state_locked();
+        let session_id = auth_state.store.create(
+            "writer".to_string(),
+            [crate::server::auth::AuthRole::Write].into_iter().collect(),
+            std::time::Duration::from_secs(3600),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state))
+                .service(logbook::add_qso),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new("trx_http_sid", session_id))
+                .set_json(serde_json::json!({
+                    "call": "SP2SJG", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), actix_web::http::StatusCode::OK);
+    }
+
+    /// A contact needs a callsign; the panel is not the only thing that has to
+    /// insist on it.
+    #[actix_web::test]
+    async fn a_contact_without_a_callsign_is_refused() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso),
+        )
+        .await;
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .set_json(serde_json::json!({
+                    "call": "   ", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), 400);
+    }
+
    /// GET /status returns 200 with valid JSON containing rig snapshot fields.
    #[actix_web::test]
    async fn test_status_endpoint_returns_json() {
@@ -14,7 +14,7 @@ use uuid::Uuid;

 use trx_core::radio::freq::Freq;
 use trx_core::rig::state::WfmDenoiseLevel;
-use trx_core::{RigCommand, RigRequest, RigState};
+use trx_core::{DigSidebandPolicy, RigCommand, RigRequest, RigState};
 use trx_frontend::{FrontendRuntimeContext, RemoteRigEntry};
 use trx_protocol::parse_mode;

@@ -299,6 +299,23 @@ pub async fn set_sdr_noise_blanker(
    .await
 }

+#[derive(serde::Deserialize)]
+pub struct SdrDigSidebandQuery {
+    /// `auto`, `usb`, or `lsb`.
+    pub policy: DigSidebandPolicy,
+    pub remote: Option<String>,
+}
+
+/// Set how the SDR backend resolves DIG mode to a sideband.
+#[post("/set_sdr_dig_sideband")]
+pub async fn set_sdr_dig_sideband(
+    query: web::Query<SdrDigSidebandQuery>,
+    rig_tx: web::Data<mpsc::Sender<RigRequest>>,
+) -> Result<HttpResponse, Error> {
+    let q = query.into_inner();
+    send_command(&rig_tx, RigCommand::SetSdrDigSideband(q.policy), q.remote).await
+}
+
 // ============================================================================
 // WFM / SAM settings
 // ============================================================================
@@ -737,6 +737,7 @@ pub async fn audio_ws(
    body: web::Payload,
    query: web::Query<AudioQuery>,
    context: web::Data<Arc<FrontendRuntimeContext>>,
+    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
    let Some(tx_sender) = context.audio.tx.as_ref().cloned() else {
        return Ok(HttpResponse::NotFound().body("audio not enabled"));
@@ -746,6 +747,7 @@ pub async fn audio_ws(
    if !req.headers().contains_key("upgrade") {
        return Ok(HttpResponse::NoContent().finish());
    }
+    let tx_session_id = crate::server::auth::extract_session_id(&req);

    // If a channel_id is specified, subscribe to the per-channel broadcaster.
    // The entry is created asynchronously when AUDIO_MSG_VCHAN_ALLOCATED arrives
@@ -880,6 +882,16 @@ pub async fn audio_ws(
                msg = msg_stream.recv() => {
                    match msg {
                        Some(Ok(Message::Binary(data))) => {
+                            let can_transmit = !auth_state.config.enabled
+                                || crate::server::auth::session_id_grants(
+                                    tx_session_id.as_ref(),
+                                    &auth_state,
+                                    crate::server::auth::AuthRole::Transmit,
+                                );
+                            if !can_transmit {
+                                warn!("Audio WS: closing after unauthorized TX frame");
+                                break;
+                            }
                            let _ = tx_sender.send(Bytes::from(data.to_vec())).await;
                        }
                        Some(Ok(Message::Close(_))) => break,
@@ -21,6 +21,10 @@ pub struct Bookmark {
    pub comment: String,
    pub category: String,
    pub decoders: Vec<String>,
+    /// For `DIG` bookmarks, the sideband policy to apply on tune: `auto`,
+    /// `usb`, or `lsb`. `None` (or non-DIG) leaves the current policy alone.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub dig_sideband: Option<String>,
 }

 pub struct BookmarkStore {
@@ -592,6 +592,21 @@ async fn apply_scheduler_target(
    )
    .await?;

+    // Apply any DIG sideband override before switching to DIG so the SDR
+    // backend resolves the intended sideband for this bookmark.
+    if let Some(policy) = bookmark
+        .dig_sideband
+        .as_deref()
+        .and_then(trx_core::DigSidebandPolicy::parse)
+    {
+        scheduler_send(
+            rig_tx,
+            RigCommand::SetSdrDigSideband(policy),
+            remote.to_string(),
+        )
+        .await?;
+    }
+
    scheduler_send(
        rig_tx,
        RigCommand::SetMode(trx_protocol::parse_mode(&bookmark.mode)),
@@ -106,6 +106,39 @@ async fn serve(
        activity_log_map.clone(),
    );

+    // The log is opened once and shared: it is one station's log, not one per
+    // rig or per session.
+    let logbook_path = context
+        .http_ui
+        .logbook_path
+        .clone()
+        .map(std::path::PathBuf::from)
+        .unwrap_or_else(trx_logbook::default_log_path);
+    let logbook = match trx_logbook::Logbook::open(&logbook_path) {
+        Ok(logbook) => {
+            tracing::info!(
+                "Logbook: {} contact(s) in {}",
+                logbook.count(),
+                logbook_path.display()
+            );
+            Arc::new(logbook)
+        }
+        Err(err) => {
+            // A log that cannot be opened must not stop the radio working, but
+            // it must be said loudly: contacts made now will not be kept.
+            tracing::error!(
+                "Logbook at {} could not be opened ({err}); logging is unavailable",
+                logbook_path.display()
+            );
+            Arc::new(
+                trx_logbook::Logbook::open(std::path::Path::new(
+                    &std::env::temp_dir().join("trx-rs-logbook.jsonl"),
+                ))
+                .unwrap_or_else(|e| panic!("logbook fallback in the temp directory failed: {e}")),
+            )
+        }
+    };
+
    let background_decode_path = BackgroundDecodeStore::default_path();
    let background_decode_store = Arc::new(BackgroundDecodeStore::open(&background_decode_path));
    let vchan_mgr = Arc::new(ClientChannelManager::new(
@@ -164,6 +197,7 @@ async fn serve(
        session_rig_mgr,
        background_decode_mgr,
        recorder_mgr,
+        logbook,
    )?;
    let handle = server.handle();
    tokio::spawn(async move {
@@ -192,6 +226,7 @@ fn build_server(
    session_rig_mgr: Arc<api::SessionRigManager>,
    background_decode_mgr: Arc<BackgroundDecodeManager>,
    recorder_mgr: Arc<RecorderManager>,
+    logbook: Arc<trx_logbook::Logbook>,
 ) -> Result<Server, actix_web::Error> {
    let state_data = web::Data::new(state_rx);
    let rig_tx = web::Data::new(rig_tx);
@@ -209,6 +244,7 @@ fn build_server(
    let session_rig_mgr = web::Data::new(session_rig_mgr);
    let background_decode_mgr = web::Data::new(background_decode_mgr);
    let recorder_mgr = web::Data::new(recorder_mgr);
+    let logbook = web::Data::new(logbook);

    // Extract auth config values before moving context
    let same_site = match context.http_auth.cookie_same_site.as_str() {
@@ -216,11 +252,31 @@ fn build_server(
        "None" => SameSite::None,
        _ => SameSite::Lax, // default
    };
+    let bootstrap_admin = auth::BootstrapAccount::from_parts(
+        context.http_auth.bootstrap_admin_username.clone(),
+        context.http_auth.bootstrap_admin_password.clone(),
+    );
+    let bootstrap_read = context
+        .http_auth
+        .bootstrap_read_enabled
+        .then(|| {
+            context
+                .http_auth
+                .bootstrap_read_password
+                .clone()
+                .map(|password| {
+                    auth::BootstrapAccount::new(
+                        context.http_auth.bootstrap_read_username.clone(),
+                        password,
+                    )
+                })
+        })
+        .flatten();
    let auth_config = AuthConfig::new(
        context.http_auth.enabled,
-        context.http_auth.rx_passphrase.clone(),
-        context.http_auth.control_passphrase.clone(),
-        context.http_auth.tx_access_control_enabled,
+        context.http_auth.users_file.clone().into(),
+        bootstrap_admin,
+        bootstrap_read,
        Duration::from_secs(context.http_auth.session_ttl_secs),
        context.http_auth.cookie_secure,
        same_site,
@@ -237,7 +293,9 @@ fn build_server(
    }

    let context_data = web::Data::new(context);
-    let auth_state = web::Data::new(AuthState::new(auth_config.clone()));
+    let auth_state = web::Data::new(
+        AuthState::new(auth_config.clone()).map_err(actix_web::error::ErrorInternalServerError)?,
+    );

    // Spawn session cleanup task if auth is enabled
    if auth_config.enabled {
@@ -267,6 +325,7 @@ fn build_server(
            .app_data(session_rig_mgr.clone())
            .app_data(background_decode_mgr.clone())
            .app_data(recorder_mgr.clone())
+            .app_data(logbook.clone())
            .wrap(Compress::default())
            .wrap(
                DefaultHeaders::new()
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+[package]
+name = "trx-logbook"
+version.workspace = true
+edition = "2021"
+
+[dependencies]
+chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
+dirs = "6"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+tracing = { workspace = true }
+uuid = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"
@@ -0,0 +1,466 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! ADIF, the format every other logger reads.
+//!
+//! ADI is a tagged text format: `<FIELD:length>value`, where the length counts
+//! the bytes of the value that follows, records end at `<EOR>`, an optional
+//! header ends at `<EOH>`, and anything outside a tag is ignored — which is how
+//! files carry human notes between records.
+//!
+//! The reader is deliberately forgiving. Files in the wild have lowercase tags,
+//! CRLF line endings, no header at all, type indicators on some fields and not
+//! others, and fields this application has never heard of. None of that is a
+//! reason to refuse someone's log. The writer, by contrast, is strict: what
+//! leaves here has to be read by software that is not.
+
+use std::collections::BTreeMap;
+
+use chrono::Utc;
+
+use crate::qso::{
+    adif_date, adif_time, freq_mhz_string, hz_from_mhz_string, normalize_call, parse_adif_datetime,
+    Qso,
+};
+
+/// Fields the [`Qso`] models itself. Everything else an import carries is kept
+/// in `extra` under its own name, so a round trip does not strip it.
+const MODELLED: &[&str] = &[
+    "CALL",
+    "QSO_DATE",
+    "TIME_ON",
+    "QSO_DATE_OFF",
+    "TIME_OFF",
+    "FREQ",
+    "BAND",
+    "MODE",
+    "SUBMODE",
+    "RST_SENT",
+    "RST_RCVD",
+    "GRIDSQUARE",
+    "NAME",
+    "QTH",
+    "COMMENT",
+    "TX_PWR",
+    "STATION_CALLSIGN",
+    "OPERATOR",
+    "MY_GRIDSQUARE",
+    "MY_RIG",
+    "CONTEST_ID",
+    "STX",
+    "STX_STRING",
+    "SRX",
+    "SRX_STRING",
+    "CQZ",
+    "ITUZ",
+    "QSL_SENT",
+    "QSL_RCVD",
+    "LOTW_QSL_SENT",
+    "LOTW_QSL_RCVD",
+    "EQSL_QSL_SENT",
+    "EQSL_QSL_RCVD",
+];
+
+/// ADIF's QSL states are single letters; anything else in that field is a
+/// misunderstanding on the writer's part and is not carried into ours.
+fn qsl_state(value: Option<&str>) -> Option<String> {
+    let state = value?.trim().to_uppercase();
+    matches!(state.as_str(), "Y" | "N" | "R" | "I" | "Q" | "V").then_some(state)
+}
+
+/// What a file gave up, and what it could not.
+#[derive(Debug, Default, Clone)]
+pub struct ParseReport {
+    /// Records that became a QSO.
+    pub qsos: Vec<Qso>,
+    /// Records that did not, and why — one line each, for showing the operator.
+    pub rejected: Vec<String>,
+}
+
+/// One `<NAME:LEN[:TYPE]>value` field.
+struct Field {
+    name: String,
+    value: String,
+}
+
+/// Reads the next tag starting at `from`, returning it and where it ended.
+///
+/// Returns `None` at the end of input or on a tag that never closes, which is
+/// how a truncated file stops rather than looping.
+fn next_field(bytes: &[u8], from: usize) -> Option<(Field, usize)> {
+    let open = bytes[from..].iter().position(|b| *b == b'<')? + from;
+    let close = bytes[open..].iter().position(|b| *b == b'>')? + open;
+    let spec = String::from_utf8_lossy(&bytes[open + 1..close]).to_string();
+    let mut parts = spec.split(':');
+    let name = parts.next().unwrap_or_default().trim().to_uppercase();
+
+    // <EOR> and <EOH> carry no length and no value.
+    let Some(length_text) = parts.next() else {
+        return Some((
+            Field {
+                name,
+                value: String::new(),
+            },
+            close + 1,
+        ));
+    };
+    let length: usize = length_text.trim().parse().unwrap_or(0);
+    let value_start = close + 1;
+    // A length that runs off the end is a truncated file, not a reason to lose
+    // everything before it: take what is there.
+    let value_end = value_start.saturating_add(length).min(bytes.len());
+    let value = String::from_utf8_lossy(&bytes[value_start..value_end]).to_string();
+    Some((Field { name, value }, value_end))
+}
+
+/// Read an ADI file.
+///
+/// Never fails as a whole: a record that cannot be made into a QSO is reported
+/// on [`ParseReport::rejected`] and the rest of the file is still read.
+pub fn parse_adi(input: &[u8]) -> ParseReport {
+    let mut report = ParseReport::default();
+    let mut position = 0usize;
+    let mut fields: Vec<Field> = Vec::new();
+    let mut in_header = looks_like_header(input);
+    let mut record_number = 0usize;
+
+    while let Some((field, next)) = next_field(input, position) {
+        position = next;
+        match field.name.as_str() {
+            "EOH" => {
+                in_header = false;
+                fields.clear();
+            }
+            "EOR" => {
+                record_number += 1;
+                if in_header {
+                    // A file with no <EOH> but an <EOR>: the header guess was
+                    // wrong, so treat what we have as a record.
+                    in_header = false;
+                }
+                match qso_from_fields(&fields) {
+                    Ok(qso) => report.qsos.push(qso),
+                    Err(reason) => report
+                        .rejected
+                        .push(format!("record {record_number}: {reason}")),
+                }
+                fields.clear();
+            }
+            _ => fields.push(field),
+        }
+    }
+
+    // A last record without its <EOR> is still a record someone wrote.
+    if !fields.is_empty() && !in_header {
+        record_number += 1;
+        match qso_from_fields(&fields) {
+            Ok(qso) => report.qsos.push(qso),
+            Err(reason) => report
+                .rejected
+                .push(format!("record {record_number}: {reason}")),
+        }
+    }
+    report
+}
+
+/// Whether the file opens with a header, i.e. anything before the first tag.
+///
+/// ADIF says a file whose first character is not `<` has a header. Plenty of
+/// exporters write no header at all, so the first `<EOR>` un-guesses this.
+fn looks_like_header(input: &[u8]) -> bool {
+    match input.iter().position(|b| !b.is_ascii_whitespace()) {
+        Some(first) => input[first] != b'<',
+        None => false,
+    }
+}
+
+fn find<'a>(fields: &'a [Field], name: &str) -> Option<&'a str> {
+    fields
+        .iter()
+        .find(|f| f.name == name)
+        .map(|f| f.value.trim())
+        .filter(|value| !value.is_empty())
+}
+
+fn qso_from_fields(fields: &[Field]) -> Result<Qso, String> {
+    let call = find(fields, "CALL").ok_or("no CALL")?;
+    let date = find(fields, "QSO_DATE").ok_or("no QSO_DATE")?;
+    let started_at = parse_adif_datetime(date, find(fields, "TIME_ON"))
+        .ok_or("QSO_DATE or TIME_ON unreadable")?;
+
+    // FREQ is authoritative; BAND is the fallback for logs that record only the
+    // band, and its midpoint is the honest answer for "where in the band".
+    let freq_hz = match find(fields, "FREQ").and_then(hz_from_mhz_string) {
+        Some(hz) => hz,
+        None => find(fields, "BAND")
+            .and_then(band_midpoint_hz)
+            .ok_or("neither FREQ nor a known BAND")?,
+    };
+    let mode = find(fields, "MODE").unwrap_or("SSB").to_uppercase();
+
+    let ended_at = find(fields, "TIME_OFF").and_then(|time| {
+        let off_date = find(fields, "QSO_DATE_OFF").unwrap_or(date);
+        parse_adif_datetime(off_date, Some(time))
+    });
+
+    let mut extra = BTreeMap::new();
+    for field in fields {
+        if MODELLED.contains(&field.name.as_str()) {
+            continue;
+        }
+        if field.value.trim().is_empty() {
+            continue;
+        }
+        extra.insert(field.name.clone(), field.value.trim().to_string());
+    }
+
+    Ok(Qso {
+        id: crate::new_id(),
+        started_at,
+        ended_at,
+        call: normalize_call(call),
+        freq_hz,
+        mode,
+        submode: find(fields, "SUBMODE").map(|s| s.to_uppercase()),
+        rst_sent: find(fields, "RST_SENT").map(str::to_string),
+        rst_rcvd: find(fields, "RST_RCVD").map(str::to_string),
+        gridsquare: find(fields, "GRIDSQUARE").map(|g| g.to_uppercase()),
+        name: find(fields, "NAME").map(str::to_string),
+        qth: find(fields, "QTH").map(str::to_string),
+        comment: find(fields, "COMMENT").map(str::to_string),
+        tx_pwr_w: find(fields, "TX_PWR").and_then(|p| p.parse().ok()),
+        station_callsign: find(fields, "STATION_CALLSIGN").map(normalize_call),
+        operator: find(fields, "OPERATOR").map(normalize_call),
+        my_gridsquare: find(fields, "MY_GRIDSQUARE").map(|g| g.to_uppercase()),
+        my_rig: find(fields, "MY_RIG").map(str::to_string),
+        rig_id: None,
+        contest_id: find(fields, "CONTEST_ID").map(|c| c.to_uppercase()),
+        stx: find(fields, "STX").and_then(|value| value.parse().ok()),
+        stx_string: find(fields, "STX_STRING").map(str::to_string),
+        srx: find(fields, "SRX").and_then(|value| value.parse().ok()),
+        srx_string: find(fields, "SRX_STRING").map(str::to_string),
+        cqz: find(fields, "CQZ").and_then(|value| value.parse().ok()),
+        ituz: find(fields, "ITUZ").and_then(|value| value.parse().ok()),
+        qsl_sent: qsl_state(find(fields, "QSL_SENT")),
+        qsl_rcvd: qsl_state(find(fields, "QSL_RCVD")),
+        lotw_qsl_sent: qsl_state(find(fields, "LOTW_QSL_SENT")),
+        lotw_qsl_rcvd: qsl_state(find(fields, "LOTW_QSL_RCVD")),
+        eqsl_qsl_sent: qsl_state(find(fields, "EQSL_QSL_SENT")),
+        eqsl_qsl_rcvd: qsl_state(find(fields, "EQSL_QSL_RCVD")),
+        extra,
+    })
+}
+
+/// The middle of a named band, for logs that recorded a band and no frequency.
+fn band_midpoint_hz(band: &str) -> Option<u64> {
+    crate::qso::band_midpoint_for_name(band)
+}
+
+fn write_field(out: &mut String, name: &str, value: &str) {
+    if value.is_empty() {
+        return;
+    }
+    out.push_str(&format!("<{}:{}>{}", name, value.len(), value));
+}
+
+/// Write QSOs as an ADI file, header and all.
+pub fn write_adi(qsos: &[Qso], program_version: &str) -> String {
+    let mut out = String::with_capacity(qsos.len() * 256 + 256);
+    let now = Utc::now();
+    out.push_str("ADIF export from trx-rs\n");
+    write_field(&mut out, "ADIF_VER", "3.1.4");
+    write_field(&mut out, "PROGRAMID", "trx-rs");
+    write_field(&mut out, "PROGRAMVERSION", program_version);
+    write_field(
+        &mut out,
+        "CREATED_TIMESTAMP",
+        &format!("{} {}", adif_date(&now), adif_time(&now)),
+    );
+    out.push_str("<EOH>\n");
+
+    for qso in qsos {
+        write_field(&mut out, "CALL", &qso.call);
+        write_field(&mut out, "QSO_DATE", &adif_date(&qso.started_at));
+        write_field(&mut out, "TIME_ON", &adif_time(&qso.started_at));
+        if let Some(ended) = qso.ended_at {
+            write_field(&mut out, "QSO_DATE_OFF", &adif_date(&ended));
+            write_field(&mut out, "TIME_OFF", &adif_time(&ended));
+        }
+        write_field(&mut out, "FREQ", &freq_mhz_string(qso.freq_hz));
+        if let Some(band) = qso.band() {
+            write_field(&mut out, "BAND", band);
+        }
+        write_field(&mut out, "MODE", &qso.mode);
+        if let Some(submode) = &qso.submode {
+            write_field(&mut out, "SUBMODE", submode);
+        }
+        for (name, value) in [
+            ("RST_SENT", &qso.rst_sent),
+            ("RST_RCVD", &qso.rst_rcvd),
+            ("GRIDSQUARE", &qso.gridsquare),
+            ("NAME", &qso.name),
+            ("QTH", &qso.qth),
+            ("COMMENT", &qso.comment),
+            ("STATION_CALLSIGN", &qso.station_callsign),
+            ("OPERATOR", &qso.operator),
+            ("MY_GRIDSQUARE", &qso.my_gridsquare),
+            ("MY_RIG", &qso.my_rig),
+            ("CONTEST_ID", &qso.contest_id),
+            ("STX_STRING", &qso.stx_string),
+            ("SRX_STRING", &qso.srx_string),
+            ("QSL_SENT", &qso.qsl_sent),
+            ("QSL_RCVD", &qso.qsl_rcvd),
+            ("LOTW_QSL_SENT", &qso.lotw_qsl_sent),
+            ("LOTW_QSL_RCVD", &qso.lotw_qsl_rcvd),
+            ("EQSL_QSL_SENT", &qso.eqsl_qsl_sent),
+            ("EQSL_QSL_RCVD", &qso.eqsl_qsl_rcvd),
+        ] {
+            if let Some(value) = value {
+                write_field(&mut out, name, value);
+            }
+        }
+        for (name, value) in [
+            ("STX", qso.stx),
+            ("SRX", qso.srx),
+            ("CQZ", qso.cqz.map(u32::from)),
+            ("ITUZ", qso.ituz.map(u32::from)),
+        ] {
+            if let Some(value) = value {
+                write_field(&mut out, name, &value.to_string());
+            }
+        }
+        if let Some(power) = qso.tx_pwr_w {
+            write_field(&mut out, "TX_PWR", &format!("{power}"));
+        }
+        // Whatever another logger wrote and this one does not model leaves as
+        // it arrived.
+        for (name, value) in &qso.extra {
+            write_field(&mut out, name, value);
+        }
+        out.push_str("<EOR>\n");
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_written_log_reads_back_the_same() {
+        let mut qso = Qso::new(
+            "id-1".into(),
+            parse_adif_datetime("20260807", Some("121530")).expect("time"),
+            "sp2sjg",
+            14_074_000,
+            "FT8",
+        );
+        qso.rst_sent = Some("-07".into());
+        qso.rst_rcvd = Some("-12".into());
+        qso.gridsquare = Some("JO94".into());
+        qso.station_callsign = Some("SP0TRX".into());
+        qso.operator = Some("SP0TRX".into());
+        qso.my_gridsquare = Some("JO91".into());
+        qso.my_rig = Some("Shack SDR".into());
+
+        let text = write_adi(&[qso.clone()], "0.1.0");
+        let report = parse_adi(text.as_bytes());
+        assert!(report.rejected.is_empty(), "{:?}", report.rejected);
+        assert_eq!(report.qsos.len(), 1);
+        let back = &report.qsos[0];
+
+        assert_eq!(back.call, "SP2SJG");
+        assert_eq!(back.freq_hz, qso.freq_hz);
+        assert_eq!(back.mode, "FT8");
+        assert_eq!(back.started_at, qso.started_at);
+        assert_eq!(back.rst_sent, qso.rst_sent);
+        assert_eq!(back.gridsquare, qso.gridsquare);
+        assert_eq!(back.my_rig, qso.my_rig);
+    }
+
+    /// Files from other loggers are irregular in ways that are not errors.
+    #[test]
+    fn a_file_from_another_logger_is_read_as_it_comes() {
+        let text = concat!(
+            "Generated by SomeLogger 4.2\r\n",
+            "<adif_ver:5>3.1.0<programid:10>SomeLogger<eoh>\r\n",
+            // lowercase tags, CRLF, a type indicator, no seconds on the time
+            "<call:6>W1AW/4<qso_date:8>20260101<time_on:4>1200<band:3>20m",
+            "<mode:3>SSB<rst_sent:2>59<rst_rcvd:2>59<my_antenna:6>Dipole<eor>\r\n",
+            // a record with the fields in another order and a full frequency
+            "<qso_date:8>20260102<time_on:6>235959<call:5>DL1AB<freq:6>7.0301",
+            "<mode:2>CW<eor>\r\n",
+        );
+        let report = parse_adi(text.as_bytes());
+        assert!(report.rejected.is_empty(), "{:?}", report.rejected);
+        assert_eq!(report.qsos.len(), 2);
+
+        let first = &report.qsos[0];
+        assert_eq!(first.call, "W1AW/4");
+        assert_eq!(first.mode, "SSB");
+        // No FREQ, so the band gives the frequency, and the band comes back.
+        assert_eq!(first.band(), Some("20m"));
+        // A field we do not model is kept, and comes back out on export.
+        assert_eq!(
+            first.extra.get("MY_ANTENNA").map(String::as_str),
+            Some("Dipole")
+        );
+        let exported = write_adi(&report.qsos, "0.1.0");
+        assert!(exported.contains("<MY_ANTENNA:6>Dipole"), "{exported}");
+
+        let second = &report.qsos[1];
+        assert_eq!(second.call, "DL1AB");
+        assert_eq!(second.freq_hz, 7_030_100);
+        assert_eq!(adif_time(&second.started_at), "235959");
+    }
+
+    #[test]
+    fn a_record_that_cannot_be_a_qso_is_reported_and_the_rest_still_read() {
+        let text = concat!(
+            "<call:5>NOCAL<eor>",                                  // no date
+            "<qso_date:8>20260101<time_on:4>1200<mode:3>SSB<eor>", // no call
+            "<call:5>SP1AB<qso_date:8>20260101<time_on:4>1200<freq:6>14.074<mode:3>FT8<eor>",
+        );
+        let report = parse_adi(text.as_bytes());
+        assert_eq!(report.qsos.len(), 1);
+        assert_eq!(report.qsos[0].call, "SP1AB");
+        assert_eq!(report.rejected.len(), 2);
+        assert!(
+            report.rejected[0].contains("QSO_DATE"),
+            "{:?}",
+            report.rejected
+        );
+        assert!(report.rejected[1].contains("CALL"), "{:?}", report.rejected);
+    }
+
+    /// The declared length is the length, even when the value looks longer:
+    /// ADIF values may contain `<`, so the count is the only thing that can be
+    /// trusted to end them.
+    #[test]
+    fn the_declared_length_wins_over_what_the_value_looks_like() {
+        let text = "<call:5>SP1AB<qso_date:8>20260101<time_on:4>1200<freq:6>14.074<mode:3>FT8\
+                    <comment:11>see <notes><eor>";
+        let report = parse_adi(text.as_bytes());
+        assert_eq!(report.qsos.len(), 1);
+        assert_eq!(report.qsos[0].comment.as_deref(), Some("see <notes>"));
+    }
+
+    #[test]
+    fn a_truncated_file_gives_up_what_it_has() {
+        // The length says 20 bytes of callsign; the file ends after five.
+        let text = "<call:20>SP1AB";
+        let report = parse_adi(text.as_bytes());
+        // No date, so it is rejected -- but the parser returned rather than
+        // running off the end or looping.
+        assert_eq!(report.qsos.len(), 0);
+        assert_eq!(report.rejected.len(), 1);
+    }
+
+    #[test]
+    fn a_file_with_no_header_is_still_a_file() {
+        let text = "<call:5>SP1AB<qso_date:8>20260101<time_on:4>1200<freq:6>14.074<mode:3>FT8<eor>";
+        let report = parse_adi(text.as_bytes());
+        assert_eq!(report.qsos.len(), 1);
+    }
+}
@@ -0,0 +1,304 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Cabrillo 3.0, the format contest logs are submitted in.
+//!
+//! ADIF cannot do this job: sponsors take Cabrillo and reject everything else.
+//! It is export-only and narrower on purpose — a header naming the entrant and
+//! the category, then one fixed-shape `QSO:` line per contact carrying the
+//! frequency, the mode, the time, and both stations' calls, reports and
+//! exchanges. Everything a log holds beyond that is left behind, which is why
+//! this complements ADIF rather than replacing it.
+
+use serde::Deserialize;
+
+use crate::qso::Qso;
+
+/// The header of a contest entry.
+///
+/// Sponsors want the entrant's own answers here — how many operators, how much
+/// power, which bands — and no log can work them out for itself, so they come
+/// from the operator with sane defaults behind them.
+#[derive(Debug, Clone, Deserialize)]
+pub struct CabrilloHeader {
+    /// The contest's Cabrillo name, e.g. `CQ-WW-SSB`.
+    #[serde(default)]
+    pub contest: Option<String>,
+    /// The callsign the entry is submitted under.
+    #[serde(default)]
+    pub callsign: Option<String>,
+    #[serde(default)]
+    pub category_operator: Option<String>,
+    #[serde(default)]
+    pub category_power: Option<String>,
+    #[serde(default)]
+    pub category_band: Option<String>,
+    #[serde(default)]
+    pub category_mode: Option<String>,
+    #[serde(default)]
+    pub claimed_score: Option<u64>,
+    #[serde(default)]
+    pub operators: Option<String>,
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub email: Option<String>,
+    #[serde(default)]
+    pub soapbox: Option<String>,
+}
+
+impl Default for CabrilloHeader {
+    fn default() -> Self {
+        Self {
+            contest: None,
+            callsign: None,
+            category_operator: Some("SINGLE-OP".to_string()),
+            category_power: Some("LOW".to_string()),
+            category_band: Some("ALL".to_string()),
+            category_mode: Some("MIXED".to_string()),
+            claimed_score: None,
+            operators: None,
+            name: None,
+            email: None,
+            soapbox: None,
+        }
+    }
+}
+
+/// The mode letters Cabrillo uses, which are not ADIF's names.
+fn cabrillo_mode(qso: &Qso) -> &'static str {
+    match qso.mode.trim().to_uppercase().as_str() {
+        "CW" | "CWR" => "CW",
+        "SSB" | "USB" | "LSB" | "AM" | "FM" | "SAM" | "WFM" | "PHONE" => {
+            // FM has a letter of its own; the rest of phone is PH.
+            if matches!(qso.mode.trim().to_uppercase().as_str(), "FM" | "WFM") {
+                "FM"
+            } else {
+                "PH"
+            }
+        }
+        "RTTY" => "RY",
+        _ => "DG",
+    }
+}
+
+/// Band designators above 30 MHz, where Cabrillo names the band rather than
+/// the frequency.
+const VHF_DESIGNATORS: &[(u64, u64, &str)] = &[
+    (50_000_000, 54_000_000, "50"),
+    (70_000_000, 71_000_000, "70"),
+    (144_000_000, 148_000_000, "144"),
+    (222_000_000, 225_000_000, "222"),
+    (420_000_000, 450_000_000, "432"),
+    (902_000_000, 928_000_000, "902"),
+    (1_240_000_000, 1_300_000_000, "1.2G"),
+    (2_300_000_000, 2_450_000_000, "2.3G"),
+    (3_300_000_000, 3_500_000_000, "3.4G"),
+    (5_650_000_000, 5_925_000_000, "5.7G"),
+    (10_000_000_000, 10_500_000_000, "10G"),
+];
+
+/// The frequency field: kilohertz below 30 MHz, a band designator above it.
+fn cabrillo_frequency(hz: u64) -> String {
+    if hz < 30_000_000 {
+        return (hz / 1000).to_string();
+    }
+    VHF_DESIGNATORS
+        .iter()
+        .find(|(low, high, _)| hz >= *low && hz <= *high)
+        .map_or_else(
+            || (hz / 1000).to_string(),
+            |(_, _, name)| (*name).to_string(),
+        )
+}
+
+fn header_line(out: &mut String, key: &str, value: Option<&str>) {
+    if let Some(value) = value {
+        let value = value.trim();
+        if !value.is_empty() {
+            out.push_str(&format!("{key}: {value}\n"));
+        }
+    }
+}
+
+/// Write a Cabrillo 3.0 entry for `qsos`.
+///
+/// The caller decides which contacts belong to the entry; this writes what it
+/// is given, in the order it is given, oldest first as sponsors expect.
+pub fn write_cabrillo(qsos: &[Qso], header: &CabrilloHeader) -> String {
+    let mut out = String::with_capacity(qsos.len() * 96 + 512);
+    out.push_str("START-OF-LOG: 3.0\n");
+    header_line(&mut out, "CREATED-BY", Some("trx-rs"));
+    header_line(&mut out, "CONTEST", header.contest.as_deref());
+    header_line(&mut out, "CALLSIGN", header.callsign.as_deref());
+    header_line(
+        &mut out,
+        "CATEGORY-OPERATOR",
+        header.category_operator.as_deref(),
+    );
+    header_line(&mut out, "CATEGORY-BAND", header.category_band.as_deref());
+    header_line(&mut out, "CATEGORY-MODE", header.category_mode.as_deref());
+    header_line(&mut out, "CATEGORY-POWER", header.category_power.as_deref());
+    if let Some(score) = header.claimed_score {
+        header_line(&mut out, "CLAIMED-SCORE", Some(&score.to_string()));
+    }
+    header_line(&mut out, "OPERATORS", header.operators.as_deref());
+    header_line(&mut out, "NAME", header.name.as_deref());
+    header_line(&mut out, "EMAIL", header.email.as_deref());
+    header_line(&mut out, "SOAPBOX", header.soapbox.as_deref());
+
+    // Oldest first: a contest log is read as it was worked.
+    let mut ordered: Vec<&Qso> = qsos.iter().collect();
+    ordered.sort_by_key(|qso| qso.started_at);
+
+    let station = header
+        .callsign
+        .clone()
+        .or_else(|| qsos.first().and_then(|qso| qso.station_callsign.clone()))
+        .unwrap_or_else(|| "UNKNOWN".to_string());
+
+    for qso in ordered {
+        let sent = qso.exchange_sent().unwrap_or_default();
+        let received = qso.exchange_received().unwrap_or_default();
+        out.push_str(&format!(
+            "QSO: {freq:>5} {mode:2} {date} {time} {mine:<13} {rst_sent:>3} {exch_sent:<6} {theirs:<13} {rst_rcvd:>3} {exch_rcvd:<6}\n",
+            freq = cabrillo_frequency(qso.freq_hz),
+            mode = cabrillo_mode(qso),
+            date = qso.started_at.format("%Y-%m-%d"),
+            time = qso.started_at.format("%H%M"),
+            mine = qso.station_callsign.as_deref().unwrap_or(&station),
+            rst_sent = qso.rst_sent.as_deref().unwrap_or(""),
+            exch_sent = sent,
+            theirs = qso.call,
+            rst_rcvd = qso.rst_rcvd.as_deref().unwrap_or(""),
+            exch_rcvd = received,
+        ));
+    }
+    out.push_str("END-OF-LOG:\n");
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn contest_qso(call: &str, hz: u64, mode: &str, time: &str, sent: u32, rcvd: u32) -> Qso {
+        let mut qso = Qso::new(
+            format!("{call}-{time}"),
+            parse_adif_datetime("20260807", Some(time)).expect("time"),
+            call,
+            hz,
+            mode,
+        );
+        qso.station_callsign = Some("SP0TRX".into());
+        qso.rst_sent = Some("59".into());
+        qso.rst_rcvd = Some("59".into());
+        qso.stx = Some(sent);
+        qso.srx = Some(rcvd);
+        qso.contest_id = Some("CQ-WW-SSB".into());
+        qso
+    }
+
+    #[test]
+    fn an_entry_has_the_header_a_sponsor_expects() {
+        let header = CabrilloHeader {
+            contest: Some("CQ-WW-SSB".into()),
+            callsign: Some("SP0TRX".into()),
+            claimed_score: Some(1234),
+            ..CabrilloHeader::default()
+        };
+        let text = write_cabrillo(
+            &[contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 42)],
+            &header,
+        );
+        assert!(text.starts_with("START-OF-LOG: 3.0\n"), "{text}");
+        assert!(text.contains("CONTEST: CQ-WW-SSB\n"), "{text}");
+        assert!(text.contains("CALLSIGN: SP0TRX\n"), "{text}");
+        assert!(text.contains("CATEGORY-OPERATOR: SINGLE-OP\n"), "{text}");
+        assert!(text.contains("CLAIMED-SCORE: 1234\n"), "{text}");
+        assert!(text.trim_end().ends_with("END-OF-LOG:"), "{text}");
+        // A header field nobody filled in is left out, not written empty.
+        assert!(!text.contains("SOAPBOX:"), "{text}");
+    }
+
+    #[test]
+    fn a_qso_line_carries_both_sides_of_the_exchange() {
+        let text = write_cabrillo(
+            &[contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 42)],
+            &CabrilloHeader::default(),
+        );
+        let line = text
+            .lines()
+            .find(|line| line.starts_with("QSO:"))
+            .expect("a QSO line");
+        // Frequency in kHz on HF, the phone mode letter, the date and UTC time,
+        // then mine, my report and my serial, then theirs.
+        assert!(line.contains("14200"), "{line}");
+        assert!(line.contains(" PH "), "{line}");
+        assert!(line.contains("2026-08-07 1200"), "{line}");
+        assert!(line.contains("SP0TRX"), "{line}");
+        assert!(line.contains("DL1AB"), "{line}");
+        assert!(line.contains("001"), "{line}");
+        assert!(line.contains("042"), "{line}");
+    }
+
+    /// Above 30 MHz Cabrillo names the band rather than the frequency.
+    #[test]
+    fn vhf_and_up_are_written_as_band_designators() {
+        assert_eq!(cabrillo_frequency(14_200_000), "14200");
+        assert_eq!(cabrillo_frequency(7_030_000), "7030");
+        assert_eq!(cabrillo_frequency(144_300_000), "144");
+        assert_eq!(cabrillo_frequency(432_100_000), "432");
+        assert_eq!(cabrillo_frequency(1_296_000_000), "1.2G");
+        assert_eq!(cabrillo_frequency(50_313_000), "50");
+    }
+
+    #[test]
+    fn the_mode_letters_are_cabrillos_not_adifs() {
+        let cw = contest_qso("DL1AB", 7_030_000, "CW", "120000", 1, 1);
+        let phone = contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 1);
+        let fm = contest_qso("DL1AB", 145_500_000, "FM", "120000", 1, 1);
+        let digital = contest_qso("DL1AB", 14_074_000, "FT8", "120000", 1, 1);
+        assert_eq!(cabrillo_mode(&cw), "CW");
+        assert_eq!(cabrillo_mode(&phone), "PH");
+        assert_eq!(cabrillo_mode(&fm), "FM");
+        assert_eq!(cabrillo_mode(&digital), "DG");
+    }
+
+    #[test]
+    fn contacts_are_written_oldest_first_however_they_arrive() {
+        let text = write_cabrillo(
+            &[
+                contest_qso("LATER", 14_200_000, "SSB", "130000", 2, 2),
+                contest_qso("EARLIER", 14_200_000, "SSB", "120000", 1, 1),
+            ],
+            &CabrilloHeader::default(),
+        );
+        let calls: Vec<&str> = text
+            .lines()
+            .filter(|line| line.starts_with("QSO:"))
+            .map(|line| {
+                if line.contains("EARLIER") {
+                    "EARLIER"
+                } else {
+                    "LATER"
+                }
+            })
+            .collect();
+        assert_eq!(calls, vec!["EARLIER", "LATER"]);
+    }
+
+    /// A word exchange -- a zone, a section, a name -- rather than a serial.
+    #[test]
+    fn an_exchange_that_is_not_a_number_is_written_as_it_was() {
+        let mut qso = contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 1);
+        qso.stx_string = Some("14".into());
+        qso.srx_string = Some("BAVARIA".into());
+        let text = write_cabrillo(&[qso], &CabrilloHeader::default());
+        let line = text.lines().find(|l| l.starts_with("QSO:")).expect("line");
+        assert!(line.contains("BAVARIA"), "{line}");
+        assert!(!line.contains("001"), "{line}");
+    }
+}
@@ -0,0 +1,191 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Telling one contact from two.
+//!
+//! Two programs rarely stamp the same QSO to the same minute — one records when
+//! the contact started, another when the operator finished typing — so matching
+//! on an exact time duplicates half of what an import is asked to merge. The
+//! key is therefore the callsign, the band and the mode, with the time compared
+//! as a window.
+//!
+//! Two minutes is the window. It is wide enough for the disagreement between
+//! loggers and narrow enough to keep a legitimate re-work: contest rules forbid
+//! a second contact with the same station on the same band and mode, so a
+//! repeat inside two minutes is the same contact written twice, while the same
+//! station on another band an hour later is a different QSO and keys differently
+//! anyway.
+
+use std::collections::HashMap;
+
+use chrono::Duration;
+
+use crate::qso::Qso;
+
+/// How far apart two records of the same contact may be stamped.
+pub const MATCH_WINDOW_MINUTES: i64 = 2;
+
+/// Modes as they are compared, not as they are written.
+///
+/// A log that stored `USB` and one that stored `SSB` describe the same contact;
+/// without this an import from either would duplicate every phone QSO in the
+/// other.
+fn normalized_mode(qso: &Qso) -> String {
+    match qso.mode.trim().to_uppercase().as_str() {
+        "USB" | "LSB" | "SSB" => "SSB".to_string(),
+        "CWR" => "CW".to_string(),
+        "SAM" => "AM".to_string(),
+        "WFM" => "FM".to_string(),
+        other => other.to_string(),
+    }
+}
+
+fn key(qso: &Qso) -> (String, String, String) {
+    (
+        qso.call.clone(),
+        qso.band().unwrap_or("").to_string(),
+        normalized_mode(qso),
+    )
+}
+
+/// An index over an existing log, for asking whether an incoming record is
+/// already held.
+pub struct DuplicateIndex {
+    by_key: HashMap<(String, String, String), Vec<chrono::DateTime<chrono::Utc>>>,
+}
+
+impl DuplicateIndex {
+    pub fn build(existing: &[Qso]) -> Self {
+        let mut by_key: HashMap<_, Vec<_>> = HashMap::new();
+        for qso in existing {
+            by_key.entry(key(qso)).or_default().push(qso.started_at);
+        }
+        Self { by_key }
+    }
+
+    /// Whether this contact is already in the log.
+    pub fn contains(&self, candidate: &Qso) -> bool {
+        let window = Duration::minutes(MATCH_WINDOW_MINUTES);
+        self.by_key.get(&key(candidate)).is_some_and(|times| {
+            times
+                .iter()
+                // Compared as instants, so a contact either side of
+                // midnight matches rather than falling into two days.
+                .any(|held| (*held - candidate.started_at).abs() <= window)
+        })
+    }
+
+    /// Remember a contact, so a file that repeats itself does not import twice.
+    pub fn insert(&mut self, qso: &Qso) {
+        self.by_key
+            .entry(key(qso))
+            .or_default()
+            .push(qso.started_at);
+    }
+}
+
+/// Which bands and modes a callsign has been worked on.
+pub fn worked_before(existing: &[Qso], call: &str) -> Vec<(String, String)> {
+    let wanted = crate::qso::normalize_call(call);
+    let mut seen: Vec<(String, String)> = existing
+        .iter()
+        .filter(|qso| qso.call == wanted)
+        .map(|qso| (qso.band().unwrap_or("").to_string(), normalized_mode(qso)))
+        .collect();
+    seen.sort();
+    seen.dedup();
+    seen
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn qso(call: &str, hz: u64, mode: &str, time: &str) -> Qso {
+        Qso::new(
+            format!("{call}-{time}"),
+            parse_adif_datetime("20260807", Some(time)).expect("time"),
+            call,
+            hz,
+            mode,
+        )
+    }
+
+    #[test]
+    fn the_same_contact_stamped_a_minute_apart_is_one_contact() {
+        let held = vec![qso("SP1AA", 14_074_000, "FT8", "120000")];
+        let index = DuplicateIndex::build(&held);
+        assert!(index.contains(&qso("SP1AA", 14_074_000, "FT8", "120100")));
+        assert!(index.contains(&qso("SP1AA", 14_074_000, "FT8", "115900")));
+        // Beyond the window it is another contact.
+        assert!(!index.contains(&qso("SP1AA", 14_074_000, "FT8", "120300")));
+    }
+
+    #[test]
+    fn phone_matches_however_the_other_logger_spelled_it() {
+        let held = vec![qso("SP1AA", 14_200_000, "SSB", "120000")];
+        let index = DuplicateIndex::build(&held);
+        assert!(index.contains(&qso("SP1AA", 14_200_000, "USB", "120000")));
+        assert!(index.contains(&qso("SP1AA", 14_200_000, "LSB", "120030")));
+    }
+
+    #[test]
+    fn another_band_or_another_mode_is_another_contact() {
+        let held = vec![qso("SP1AA", 14_074_000, "FT8", "120000")];
+        let index = DuplicateIndex::build(&held);
+        // Same station, same minute, 40 m: a band change during a QSO happens.
+        assert!(!index.contains(&qso("SP1AA", 7_074_000, "FT8", "120000")));
+        assert!(!index.contains(&qso("SP1AA", 14_074_000, "CW", "120000")));
+        assert!(!index.contains(&qso("SP2BB", 14_074_000, "FT8", "120000")));
+    }
+
+    #[test]
+    fn a_contact_either_side_of_midnight_still_matches() {
+        let before = Qso::new(
+            "1".into(),
+            parse_adif_datetime("20260807", Some("235930")).expect("time"),
+            "SP1AA",
+            14_074_000,
+            "FT8",
+        );
+        let after = Qso::new(
+            "2".into(),
+            parse_adif_datetime("20260808", Some("000030")).expect("time"),
+            "SP1AA",
+            14_074_000,
+            "FT8",
+        );
+        let index = DuplicateIndex::build(&[before]);
+        assert!(index.contains(&after));
+    }
+
+    #[test]
+    fn a_file_that_repeats_itself_imports_once() {
+        let mut index = DuplicateIndex::build(&[]);
+        let first = qso("SP1AA", 14_074_000, "FT8", "120000");
+        assert!(!index.contains(&first));
+        index.insert(&first);
+        assert!(index.contains(&qso("SP1AA", 14_074_000, "FT8", "120030")));
+    }
+
+    #[test]
+    fn worked_before_answers_by_band_and_mode() {
+        let held = vec![
+            qso("SP1AA", 14_074_000, "FT8", "120000"),
+            qso("SP1AA", 7_030_000, "CW", "130000"),
+            qso("SP1AA", 14_074_000, "FT8", "140000"),
+            qso("SP2BB", 14_200_000, "USB", "150000"),
+        ];
+        let worked = worked_before(&held, "sp1aa");
+        assert_eq!(
+            worked,
+            vec![
+                ("20m".to_string(), "FT8".to_string()),
+                ("40m".to_string(), "CW".to_string()),
+            ]
+        );
+        assert!(worked_before(&held, "SP9ZZ").is_empty());
+    }
+}
@@ -0,0 +1,510 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! The station logbook: contacts, the file they live in, and ADIF in and out.
+//!
+//! One log per station rather than one per rig. Awards and uploads count the
+//! callsign, not the radio — a station worked on the second rig is still worked
+//! — so the rig is recorded on the contact instead of dividing the log by it.
+//! Where a rig stands does follow the contact, though: `my_gridsquare` comes
+//! from the rig that made it, because rigs can be in different places.
+
+pub mod adif;
+pub mod cabrillo;
+pub mod dedupe;
+pub mod qso;
+pub mod store;
+
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex};
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+pub use cabrillo::{write_cabrillo, CabrilloHeader};
+pub use dedupe::{worked_before, DuplicateIndex, MATCH_WINDOW_MINUTES};
+pub use qso::Qso;
+pub use store::LogStore;
+
+/// A fresh contact identity.
+pub fn new_id() -> String {
+    uuid::Uuid::new_v4().to_string()
+}
+
+/// Where the log lives when the configuration does not say.
+///
+/// The data directory, not the config directory the bookmarks use and not the
+/// cache directory the decode logs use: a log is neither a setting nor
+/// disposable, and cache directories get swept by cleaners.
+pub fn default_log_path() -> PathBuf {
+    dirs::data_dir()
+        .map(|dir| dir.join("trx-rs").join("logbook.jsonl"))
+        .unwrap_or_else(|| PathBuf::from("logbook.jsonl"))
+}
+
+/// What a filtered read asks for.
+#[derive(Debug, Default, Clone, Deserialize)]
+pub struct LogQuery {
+    /// Substring of the callsign, case-insensitive.
+    #[serde(default)]
+    pub call: Option<String>,
+    /// Only contacts in this contest.
+    #[serde(default)]
+    pub contest: Option<String>,
+    /// Only contacts the other station has confirmed, or only those they have
+    /// not.
+    #[serde(default)]
+    pub confirmed: Option<bool>,
+    #[serde(default)]
+    pub band: Option<String>,
+    #[serde(default)]
+    pub mode: Option<String>,
+    /// Inclusive bounds on the contact's time.
+    #[serde(default)]
+    pub from: Option<DateTime<Utc>>,
+    #[serde(default)]
+    pub to: Option<DateTime<Utc>>,
+    #[serde(default)]
+    pub limit: Option<usize>,
+    #[serde(default)]
+    pub offset: Option<usize>,
+}
+
+/// One band's worth of the log.
+#[derive(Debug, Clone, Serialize)]
+pub struct BandStatistics {
+    pub band: String,
+    pub contacts: usize,
+    /// Distinct callsigns, which is the number an award counts.
+    pub stations: usize,
+    pub confirmed: usize,
+}
+
+/// What an import did.
+#[derive(Debug, Default, Clone, Serialize)]
+pub struct ImportOutcome {
+    pub added: usize,
+    /// Already held, by callsign, band, mode and the two-minute window.
+    pub duplicate: usize,
+    /// Records that could not be read as contacts, with the reason.
+    pub rejected: Vec<String>,
+}
+
+/// The logbook, shared by whoever serves it.
+#[derive(Clone)]
+pub struct Logbook {
+    store: Arc<Mutex<LogStore>>,
+}
+
+impl Logbook {
+    pub fn open(path: &std::path::Path) -> std::io::Result<Self> {
+        Ok(Self {
+            store: Arc::new(Mutex::new(LogStore::open(path)?)),
+        })
+    }
+
+    fn with_store<T>(&self, f: impl FnOnce(&mut LogStore) -> T) -> T {
+        // A poisoned lock means a panic while holding it, not a corrupt log --
+        // the file is on disk either way -- so carry on with what is there.
+        let mut store = self.store.lock().unwrap_or_else(|e| e.into_inner());
+        f(&mut store)
+    }
+
+    pub fn path(&self) -> PathBuf {
+        self.with_store(|store| store.path().to_path_buf())
+    }
+
+    pub fn count(&self) -> usize {
+        self.with_store(|store| store.len())
+    }
+
+    /// Contacts matching `query`, newest first.
+    pub fn query(&self, query: &LogQuery) -> Vec<Qso> {
+        self.with_store(|store| {
+            let call = query.call.as_deref().map(str::to_uppercase);
+            let band = query.band.as_deref().map(str::to_lowercase);
+            let mode = query.mode.as_deref().map(str::to_uppercase);
+            let contest = query.contest.clone();
+            let matching: Vec<Qso> = store
+                .all()
+                .into_iter()
+                .filter(|qso| {
+                    call.as_ref().is_none_or(|c| qso.call.contains(c.as_str()))
+                        && band
+                            .as_ref()
+                            .is_none_or(|b| qso.band().is_some_and(|found| found == b))
+                        && mode.as_ref().is_none_or(|m| qso.mode == *m)
+                        && query.from.is_none_or(|from| qso.started_at >= from)
+                        && query.to.is_none_or(|to| qso.started_at <= to)
+                        && contest.as_ref().is_none_or(|wanted| {
+                            qso.contest_id
+                                .as_deref()
+                                .is_some_and(|held| held.eq_ignore_ascii_case(wanted))
+                        })
+                        && query
+                            .confirmed
+                            .is_none_or(|wanted| qso.is_confirmed() == wanted)
+                })
+                .collect();
+            let offset = query.offset.unwrap_or(0).min(matching.len());
+            let end = query
+                .limit
+                .map_or(matching.len(), |limit| (offset + limit).min(matching.len()));
+            matching[offset..end].to_vec()
+        })
+    }
+
+    pub fn get(&self, id: &str) -> Option<Qso> {
+        self.with_store(|store| store.get(id).cloned())
+    }
+
+    /// Add a contact, or replace one with the same id.
+    pub fn put(&self, qso: Qso) -> std::io::Result<Qso> {
+        self.with_store(|store| store.put(qso.clone()))?;
+        Ok(qso)
+    }
+
+    pub fn delete(&self, id: &str) -> std::io::Result<bool> {
+        self.with_store(|store| store.delete(id))
+    }
+
+    /// Which bands and modes a callsign has been worked on.
+    pub fn worked_before(&self, call: &str) -> Vec<(String, String)> {
+        self.with_store(|store| dedupe::worked_before(&store.all(), call))
+    }
+
+    /// Export as Cabrillo, for submitting a contest entry.
+    pub fn export_cabrillo(&self, query: &LogQuery, header: &CabrilloHeader) -> String {
+        cabrillo::write_cabrillo(&self.query(query), header)
+    }
+
+    /// What has been worked, and what has been confirmed, band by band.
+    ///
+    /// One confirmation counts wherever it came from: an award wants a card or
+    /// an electronic match, not one of each.
+    pub fn band_statistics(&self) -> Vec<BandStatistics> {
+        self.with_store(|store| {
+            let mut by_band: std::collections::HashMap<String, BandStatistics> =
+                std::collections::HashMap::new();
+            let mut stations: std::collections::HashMap<String, std::collections::HashSet<String>> =
+                std::collections::HashMap::new();
+            for qso in store.all() {
+                let band = qso.band().unwrap_or("other").to_string();
+                let entry = by_band
+                    .entry(band.clone())
+                    .or_insert_with(|| BandStatistics {
+                        band: band.clone(),
+                        contacts: 0,
+                        stations: 0,
+                        confirmed: 0,
+                    });
+                entry.contacts += 1;
+                if qso.is_confirmed() {
+                    entry.confirmed += 1;
+                }
+                stations.entry(band).or_default().insert(qso.call.clone());
+            }
+            let mut all: Vec<BandStatistics> = by_band
+                .into_values()
+                .map(|mut entry| {
+                    entry.stations = stations
+                        .get(&entry.band)
+                        .map_or(0, std::collections::HashSet::len);
+                    entry
+                })
+                .collect();
+            // Ordered by wavelength, longest first, as a band plan reads.
+            all.sort_by_key(|entry| qso::band_order(&entry.band));
+            all
+        })
+    }
+
+    /// Export as ADIF, honouring the same filters as a read.
+    pub fn export_adi(&self, query: &LogQuery, program_version: &str) -> String {
+        adif::write_adi(&self.query(query), program_version)
+    }
+
+    /// Import an ADIF file, skipping contacts already held.
+    pub fn import_adi(&self, input: &[u8]) -> std::io::Result<ImportOutcome> {
+        let report = adif::parse_adi(input);
+        let mut outcome = ImportOutcome {
+            rejected: report.rejected,
+            ..ImportOutcome::default()
+        };
+        self.with_store(|store| {
+            let mut index = DuplicateIndex::build(&store.all());
+            let mut fresh = Vec::new();
+            for qso in report.qsos {
+                if index.contains(&qso) {
+                    outcome.duplicate += 1;
+                    continue;
+                }
+                index.insert(&qso);
+                fresh.push(qso);
+            }
+            outcome.added = fresh.len();
+            store.put_all(fresh)
+        })?;
+        Ok(outcome)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn new_book() -> (tempfile::TempDir, Logbook) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let book = Logbook::open(&dir.path().join("logbook.jsonl")).expect("open");
+        (dir, book)
+    }
+
+    fn qso(call: &str, hz: u64, mode: &str, time: &str) -> Qso {
+        Qso::new(
+            new_id(),
+            parse_adif_datetime("20260807", Some(time)).expect("time"),
+            call,
+            hz,
+            mode,
+        )
+    }
+
+    #[test]
+    fn a_log_answers_the_filters_it_is_asked() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+        book.put(qso("SP2BB", 7_030_000, "CW", "130000"))
+            .expect("put");
+        book.put(qso("DL3CC", 14_200_000, "SSB", "140000"))
+            .expect("put");
+
+        assert_eq!(book.count(), 3);
+        assert_eq!(book.query(&LogQuery::default()).len(), 3);
+        // Newest first.
+        assert_eq!(book.query(&LogQuery::default())[0].call, "DL3CC");
+
+        let by_band = LogQuery {
+            band: Some("20m".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&by_band).len(), 2);
+
+        let by_call = LogQuery {
+            call: Some("sp".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&by_call).len(), 2);
+
+        let by_mode = LogQuery {
+            mode: Some("cw".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&by_mode)[0].call, "SP2BB");
+
+        let paged = LogQuery {
+            limit: Some(1),
+            offset: Some(1),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&paged).len(), 1);
+        // Newest first, so offset 1 is the middle contact.
+        assert_eq!(book.query(&paged)[0].call, "SP2BB");
+    }
+
+    #[test]
+    fn an_import_skips_what_is_already_held_and_says_so() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+
+        let file = concat!(
+            // the one already held, a minute out, as another logger stamped it
+            "<call:5>SP1AA<qso_date:8>20260807<time_on:6>120100<freq:6>14.074<mode:3>FT8<eor>\n",
+            // a new one
+            "<call:5>DL2XY<qso_date:8>20260807<time_on:6>121500<freq:6>14.074<mode:3>FT8<eor>\n",
+            // and something that is not a contact
+            "<call:5>NODAT<eor>\n",
+        );
+        let outcome = book.import_adi(file.as_bytes()).expect("import");
+        assert_eq!(outcome.added, 1);
+        assert_eq!(outcome.duplicate, 1);
+        assert_eq!(outcome.rejected.len(), 1);
+        assert_eq!(book.count(), 2);
+
+        // And importing the same file again adds nothing.
+        let again = book.import_adi(file.as_bytes()).expect("import again");
+        assert_eq!(again.added, 0);
+        assert_eq!(again.duplicate, 2);
+        assert_eq!(book.count(), 2);
+    }
+
+    #[test]
+    fn an_export_can_be_imported_into_an_empty_log() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+        book.put(qso("DL3CC", 14_200_000, "SSB", "140000"))
+            .expect("put");
+        let exported = book.export_adi(&LogQuery::default(), "0.1.0");
+
+        let (_other_dir, other) = new_book();
+        let outcome = other.import_adi(exported.as_bytes()).expect("import");
+        assert_eq!(outcome.added, 2);
+        assert_eq!(other.count(), 2);
+        assert_eq!(other.query(&LogQuery::default())[0].call, "DL3CC");
+    }
+
+    #[test]
+    fn worked_before_reads_through_the_log() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+        book.put(qso("SP1AA", 7_030_000, "CW", "130000"))
+            .expect("put");
+        assert_eq!(book.worked_before("sp1aa").len(), 2);
+        assert!(book.worked_before("SP9ZZ").is_empty());
+    }
+
+    #[test]
+    fn statistics_count_stations_and_confirmations_band_by_band() {
+        let (_dir, book) = new_book();
+        let mut first = qso("SP1AA", 14_074_000, "FT8", "120000");
+        first.lotw_qsl_rcvd = Some("Y".into());
+        book.put(first).expect("put");
+        // The same station again on the same band: one station, two contacts.
+        book.put(qso("SP1AA", 14_100_000, "SSB", "121000"))
+            .expect("put");
+        let mut third = qso("DL2BB", 7_030_000, "CW", "130000");
+        third.qsl_rcvd = Some("Y".into());
+        book.put(third).expect("put");
+        book.put(qso("OZ3CC", 7_040_000, "CW", "131000"))
+            .expect("put");
+
+        let stats = book.band_statistics();
+        // Longest wavelength first, as a band plan reads.
+        assert_eq!(
+            stats.iter().map(|s| s.band.as_str()).collect::<Vec<_>>(),
+            vec!["40m", "20m"]
+        );
+        let forty = &stats[0];
+        assert_eq!((forty.contacts, forty.stations, forty.confirmed), (2, 2, 1));
+        let twenty = &stats[1];
+        assert_eq!(
+            (twenty.contacts, twenty.stations, twenty.confirmed),
+            (2, 1, 1)
+        );
+    }
+
+    #[test]
+    fn a_contest_entry_holds_only_that_contest() {
+        let (_dir, book) = new_book();
+        for (call, contest, serial) in [
+            ("SP1AA", Some("CQ-WW-SSB"), 1),
+            ("DL2BB", Some("CQ-WW-SSB"), 2),
+            ("OZ3CC", None, 0),
+        ] {
+            let mut entry = qso(call, 14_200_000, "SSB", "120000");
+            entry.contest_id = contest.map(str::to_string);
+            entry.stx = Some(serial);
+            entry.station_callsign = Some("SP0TRX".into());
+            entry.rst_sent = Some("59".into());
+            entry.rst_rcvd = Some("59".into());
+            book.put(entry).expect("put");
+        }
+        let query = LogQuery {
+            contest: Some("cq-ww-ssb".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(
+            book.query(&query).len(),
+            2,
+            "the contest filter is case-sensitive"
+        );
+
+        let text = book.export_cabrillo(
+            &query,
+            &CabrilloHeader {
+                contest: Some("CQ-WW-SSB".into()),
+                callsign: Some("SP0TRX".into()),
+                ..CabrilloHeader::default()
+            },
+        );
+        let lines: Vec<&str> = text
+            .lines()
+            .filter(|line| line.starts_with("QSO:"))
+            .collect();
+        assert_eq!(lines.len(), 2, "{text}");
+        assert!(
+            !text.contains("OZ3CC"),
+            "a contact outside the contest was submitted"
+        );
+    }
+
+    #[test]
+    fn confirmations_come_from_whichever_bureau_answered() {
+        let (_dir, book) = new_book();
+        let mut card = qso("SP1AA", 14_074_000, "FT8", "120000");
+        card.qsl_rcvd = Some("Y".into());
+        let mut lotw = qso("DL2BB", 14_074_000, "FT8", "121000");
+        lotw.lotw_qsl_rcvd = Some("Y".into());
+        let mut requested = qso("OZ3CC", 14_074_000, "FT8", "122000");
+        requested.qsl_rcvd = Some("R".into());
+        for entry in [card, lotw, requested] {
+            book.put(entry).expect("put");
+        }
+        let confirmed = LogQuery {
+            confirmed: Some(true),
+            ..LogQuery::default()
+        };
+        let calls: Vec<String> = book.query(&confirmed).into_iter().map(|q| q.call).collect();
+        assert_eq!(calls.len(), 2, "{calls:?}");
+        assert!(calls.contains(&"SP1AA".to_string()) && calls.contains(&"DL2BB".to_string()));
+        // Requested is not confirmed.
+        let outstanding = LogQuery {
+            confirmed: Some(false),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&outstanding)[0].call, "OZ3CC");
+    }
+
+    #[test]
+    fn the_contest_and_qsl_fields_survive_a_trip_through_adif() {
+        let (_dir, book) = new_book();
+        let mut entry = qso("SP1AA", 14_200_000, "SSB", "120000");
+        entry.contest_id = Some("CQ-WW-SSB".into());
+        entry.stx = Some(7);
+        entry.srx_string = Some("BAVARIA".into());
+        entry.cqz = Some(15);
+        entry.qsl_sent = Some("Y".into());
+        entry.lotw_qsl_rcvd = Some("Y".into());
+        book.put(entry).expect("put");
+
+        let exported = book.export_adi(&LogQuery::default(), "0.1.0");
+        let (_other_dir, other) = new_book();
+        other.import_adi(exported.as_bytes()).expect("import");
+        let back = &other.query(&LogQuery::default())[0];
+        assert_eq!(back.contest_id.as_deref(), Some("CQ-WW-SSB"));
+        assert_eq!(back.stx, Some(7));
+        assert_eq!(back.srx_string.as_deref(), Some("BAVARIA"));
+        assert_eq!(back.cqz, Some(15));
+        assert_eq!(back.qsl_sent.as_deref(), Some("Y"));
+        assert!(back.is_confirmed());
+    }
+
+    #[test]
+    fn a_contact_can_be_changed_and_forgotten() {
+        let (_dir, book) = new_book();
+        let mut entry = qso("SP1AA", 14_074_000, "FT8", "120000");
+        let id = entry.id.clone();
+        book.put(entry.clone()).expect("put");
+        entry.rst_rcvd = Some("-11".into());
+        book.put(entry).expect("edit");
+        assert_eq!(book.get(&id).and_then(|q| q.rst_rcvd), Some("-11".into()));
+        assert!(book.delete(&id).expect("delete"));
+        assert!(book.get(&id).is_none());
+        assert_eq!(book.count(), 0);
+    }
+}
@@ -0,0 +1,465 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! The record a contact is kept as, and the translations between what the radio
+//! says and what a log file wants.
+
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, Datelike, NaiveDate, NaiveDateTime, NaiveTime, Timelike, Utc};
+use serde::{Deserialize, Serialize};
+
+/// One contact.
+///
+/// The named fields are the ones the application fills, reads or filters on.
+/// Everything else an imported file carried is kept in [`Qso::extra`] under its
+/// ADIF field name, so a log that came from another program leaves with what it
+/// arrived with rather than what this one happens to understand.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct Qso {
+    /// Stable identity, ours, not from the file.
+    pub id: String,
+    /// UTC, always: the log is kept in the radio's time, not a browser's.
+    pub started_at: DateTime<Utc>,
+    /// Present once the operator records the end of a contact.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ended_at: Option<DateTime<Utc>>,
+    /// The station worked.
+    pub call: String,
+    /// Dial frequency in Hz. The band is derived from it rather than stored
+    /// twice and allowed to disagree.
+    pub freq_hz: u64,
+    /// ADIF mode, e.g. `SSB`, `CW`, `FT8`.
+    pub mode: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub submode: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rst_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rst_rcvd: Option<String>,
+    /// The worked station's Maidenhead locator.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub gridsquare: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub qth: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub comment: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tx_pwr_w: Option<f64>,
+    /// The callsign this station was on the air with.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub station_callsign: Option<String>,
+    /// The person at the key, which is not always the station.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub operator: Option<String>,
+    /// Our locator *for this contact*: rigs can stand in different places.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub my_gridsquare: Option<String>,
+    /// The rig it was worked on, by display name (ADIF `MY_RIG`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub my_rig: Option<String>,
+    /// Which rig of this client, by id — ours, not ADIF's.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rig_id: Option<String>,
+    /// The contest this contact counts towards, by its Cabrillo name.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub contest_id: Option<String>,
+    /// Serial sent. Kept as text as well as a number, because plenty of
+    /// exchanges are neither — a zone, a section, a name, a power.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stx: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stx_string: Option<String>,
+    /// Serial received, likewise.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub srx: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub srx_string: Option<String>,
+    /// CQ and ITU zones of the station worked.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cqz: Option<u8>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ituz: Option<u8>,
+    /// Paper QSL, and the two card-less bureaux, as ADIF's single letters:
+    /// `Y` yes, `N` no, `R` requested, `I` ignore, `Q` queued, `V` verified.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub qsl_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub qsl_rcvd: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lotw_qsl_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lotw_qsl_rcvd: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub eqsl_qsl_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub eqsl_qsl_rcvd: Option<String>,
+    /// ADIF fields this application does not model, kept verbatim.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub extra: BTreeMap<String, String>,
+}
+
+impl Qso {
+    /// A contact with only the fields every log needs.
+    pub fn new(
+        id: String,
+        started_at: DateTime<Utc>,
+        call: &str,
+        freq_hz: u64,
+        mode: &str,
+    ) -> Self {
+        Self {
+            id,
+            started_at,
+            ended_at: None,
+            call: normalize_call(call),
+            freq_hz,
+            mode: mode.trim().to_uppercase(),
+            submode: None,
+            rst_sent: None,
+            rst_rcvd: None,
+            gridsquare: None,
+            name: None,
+            qth: None,
+            comment: None,
+            tx_pwr_w: None,
+            station_callsign: None,
+            operator: None,
+            my_gridsquare: None,
+            my_rig: None,
+            rig_id: None,
+            contest_id: None,
+            stx: None,
+            stx_string: None,
+            srx: None,
+            srx_string: None,
+            cqz: None,
+            ituz: None,
+            qsl_sent: None,
+            qsl_rcvd: None,
+            lotw_qsl_sent: None,
+            lotw_qsl_rcvd: None,
+            eqsl_qsl_sent: None,
+            eqsl_qsl_rcvd: None,
+            extra: BTreeMap::new(),
+        }
+    }
+
+    /// The ADIF band name for the frequency, if it falls in an amateur band.
+    pub fn band(&self) -> Option<&'static str> {
+        band_for_hz(self.freq_hz)
+    }
+
+    /// Whether the other station has confirmed this contact, anywhere.
+    ///
+    /// One confirmation is a confirmation: an award needs one card or one
+    /// electronic match, not all three, and a log that counted them separately
+    /// would tell the operator they were three contacts short of what they have.
+    pub fn is_confirmed(&self) -> bool {
+        [&self.qsl_rcvd, &self.lotw_qsl_rcvd, &self.eqsl_qsl_rcvd]
+            .into_iter()
+            .flatten()
+            .any(|state| {
+                let state = state.trim().to_uppercase();
+                state == "Y" || state == "V"
+            })
+    }
+
+    /// The exchange as it goes into a contest log: what was sent, or received.
+    pub fn exchange_sent(&self) -> Option<String> {
+        self.stx_string
+            .clone()
+            .or_else(|| self.stx.map(|serial| format!("{serial:03}")))
+    }
+
+    pub fn exchange_received(&self) -> Option<String> {
+        self.srx_string
+            .clone()
+            .or_else(|| self.srx.map(|serial| format!("{serial:03}")))
+    }
+
+    /// What two logs have to agree on to be describing the same contact.
+    ///
+    /// Not the time: that is compared as a window by [`crate::dedupe`], because
+    /// two programs rarely stamp the same QSO to the same minute.
+    pub fn match_key(&self) -> (String, String, String) {
+        (
+            self.call.clone(),
+            self.band().unwrap_or("").to_string(),
+            self.mode.clone(),
+        )
+    }
+}
+
+/// Callsigns are compared, sorted and deduplicated, so they are held one way:
+/// upper case, without the spaces a hurried operator leaves behind.
+pub fn normalize_call(call: &str) -> String {
+    call.trim().to_uppercase()
+}
+
+/// Amateur bands by their ADIF names, as frequency ranges in Hz.
+///
+/// Ranges are the widest any region allows, since a log records what was heard
+/// rather than what a licence permits, and a QSO on a band edge must not fall
+/// out of the log because one region stops earlier than another.
+const BANDS: &[(&str, u64, u64)] = &[
+    ("2190m", 135_700, 137_800),
+    ("630m", 472_000, 479_000),
+    ("560m", 501_000, 504_000),
+    ("160m", 1_800_000, 2_000_000),
+    ("80m", 3_500_000, 4_000_000),
+    ("60m", 5_060_000, 5_450_000),
+    ("40m", 7_000_000, 7_300_000),
+    ("30m", 10_100_000, 10_150_000),
+    ("20m", 14_000_000, 14_350_000),
+    ("17m", 18_068_000, 18_168_000),
+    ("15m", 21_000_000, 21_450_000),
+    ("12m", 24_890_000, 24_990_000),
+    ("10m", 28_000_000, 29_700_000),
+    ("8m", 40_000_000, 45_000_000),
+    ("6m", 50_000_000, 54_000_000),
+    ("5m", 54_000_001, 69_900_000),
+    ("4m", 70_000_000, 71_000_000),
+    ("2m", 144_000_000, 148_000_000),
+    ("1.25m", 222_000_000, 225_000_000),
+    ("70cm", 420_000_000, 450_000_000),
+    ("33cm", 902_000_000, 928_000_000),
+    ("23cm", 1_240_000_000, 1_300_000_000),
+    ("13cm", 2_300_000_000, 2_450_000_000),
+    ("9cm", 3_300_000_000, 3_500_000_000),
+    ("6cm", 5_650_000_000, 5_925_000_000),
+    ("3cm", 10_000_000_000, 10_500_000_000),
+];
+
+/// The ADIF band a frequency falls in, or `None` outside the amateur bands —
+/// a broadcast or utility frequency has no band name, and inventing one would
+/// put a lie in the log.
+pub fn band_for_hz(hz: u64) -> Option<&'static str> {
+    BANDS
+        .iter()
+        .find(|(_, low, high)| hz >= *low && hz <= *high)
+        .map(|(name, _, _)| *name)
+}
+
+/// The middle of a named band.
+///
+/// A log that recorded `20m` and no frequency knows the band and not the dial;
+/// the midpoint is the honest reading of that, and the band name it exports
+/// comes back the same.
+pub fn band_midpoint_for_name(band: &str) -> Option<u64> {
+    let wanted = band.trim().to_lowercase();
+    BANDS
+        .iter()
+        .find(|(name, _, _)| *name == wanted)
+        .map(|(_, low, high)| low + (high - low) / 2)
+}
+
+/// Where a band sits in the table, for ordering a report by wavelength.
+///
+/// Anything not in the table sorts last, which is where "other" belongs.
+pub fn band_order(band: &str) -> usize {
+    let wanted = band.trim().to_lowercase();
+    BANDS
+        .iter()
+        .position(|(name, _, _)| *name == wanted)
+        .unwrap_or(BANDS.len())
+}
+
+/// The frequency in MHz, as ADIF writes it.
+pub fn freq_mhz_string(hz: u64) -> String {
+    // Six decimals is 1 Hz, which is finer than any dial reports and is what
+    // other loggers write. The zeros are then dropped from the fraction only:
+    // trimming the whole string would turn 20.000000 into 2, since the run of
+    // trailing zeros reaches back through the point into the integer.
+    let text = format!("{:.6}", hz as f64 / 1e6);
+    match text.split_once('.') {
+        Some((whole, fraction)) => {
+            let fraction = fraction.trim_end_matches('0');
+            if fraction.is_empty() {
+                whole.to_string()
+            } else {
+                format!("{whole}.{fraction}")
+            }
+        }
+        None => text,
+    }
+}
+
+/// ADIF's MHz back to Hz.
+pub fn hz_from_mhz_string(text: &str) -> Option<u64> {
+    let mhz: f64 = text.trim().parse().ok()?;
+    if !mhz.is_finite() || mhz < 0.0 {
+        return None;
+    }
+    Some((mhz * 1e6).round() as u64)
+}
+
+/// What a rig mode becomes in a log.
+///
+/// A rig reports what it is demodulating; a log records what the contact was
+/// made on, and the two are not the same word. `DIG` is deliberately absent:
+/// a rig in `DIG` is in FT8 or FT4 or something else depending on which decoder
+/// is running, so the caller has to say which — see [`mode_for_decoder`].
+pub fn adif_mode_for_rig_mode(rig_mode: &str) -> Option<(&'static str, Option<&'static str>)> {
+    match rig_mode.trim().to_uppercase().as_str() {
+        "USB" => Some(("SSB", Some("USB"))),
+        "LSB" => Some(("SSB", Some("LSB"))),
+        "CW" | "CWR" => Some(("CW", None)),
+        "AM" | "SAM" => Some(("AM", None)),
+        "FM" | "WFM" => Some(("FM", None)),
+        "PKT" => Some(("PKT", None)),
+        // AIS and VDES are maritime, not amateur: nothing on them is a QSO.
+        // DIG says nothing on its own, and Other(..) is whatever a backend
+        // called it, which is the operator's to confirm rather than ours to
+        // guess into the log.
+        _ => None,
+    }
+}
+
+/// What a decoder's contacts are logged as.
+///
+/// WSPR is absent on purpose: it is a beacon mode. Hearing a beacon is not a
+/// contact, so a WSPR spot never opens a log entry.
+pub fn mode_for_decoder(decoder_id: &str) -> Option<(&'static str, Option<&'static str>)> {
+    match decoder_id.trim().to_lowercase().as_str() {
+        "ft8" => Some(("FT8", None)),
+        // FT4 is a submode of MFSK in ADIF, which is how WSJT-X logs it.
+        "ft4" => Some(("MFSK", Some("FT4"))),
+        "ft2" => Some(("MFSK", Some("FT2"))),
+        "cw" => Some(("CW", None)),
+        "aprs" | "hf-aprs" | "hf_aprs" => Some(("PKT", None)),
+        _ => None,
+    }
+}
+
+/// ADIF writes dates as `YYYYMMDD`, always UTC.
+pub fn adif_date(at: &DateTime<Utc>) -> String {
+    format!("{:04}{:02}{:02}", at.year(), at.month(), at.day())
+}
+
+/// ADIF writes times as `HHMMSS`, always UTC.
+pub fn adif_time(at: &DateTime<Utc>) -> String {
+    format!("{:02}{:02}{:02}", at.hour(), at.minute(), at.second())
+}
+
+/// ADIF's date and time back to an instant.
+///
+/// Times come as `HHMMSS` or `HHMM`; both are in the wild, and a missing time
+/// is treated as midnight rather than rejecting the record, because a log with
+/// a date and no time is still a log.
+pub fn parse_adif_datetime(date: &str, time: Option<&str>) -> Option<DateTime<Utc>> {
+    let date = date.trim();
+    if date.len() != 8 || !date.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    let year: i32 = date[0..4].parse().ok()?;
+    let month: u32 = date[4..6].parse().ok()?;
+    let day: u32 = date[6..8].parse().ok()?;
+    let date = NaiveDate::from_ymd_opt(year, month, day)?;
+
+    let time = time.map(str::trim).filter(|t| !t.is_empty());
+    let time = match time {
+        None => NaiveTime::from_hms_opt(0, 0, 0)?,
+        Some(text) if text.len() == 6 || text.len() == 4 => {
+            if !text.bytes().all(|b| b.is_ascii_digit()) {
+                return None;
+            }
+            let hour: u32 = text[0..2].parse().ok()?;
+            let minute: u32 = text[2..4].parse().ok()?;
+            let second: u32 = if text.len() == 6 {
+                text[4..6].parse().ok()?
+            } else {
+                0
+            };
+            NaiveTime::from_hms_opt(hour, minute, second)?
+        }
+        Some(_) => return None,
+    };
+    Some(NaiveDateTime::new(date, time).and_utc())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bands_are_named_from_the_dial() {
+        assert_eq!(band_for_hz(14_074_000), Some("20m"));
+        assert_eq!(band_for_hz(7_030_000), Some("40m"));
+        assert_eq!(band_for_hz(144_300_000), Some("2m"));
+        // A band edge is in the band: a QSO at 14.350 is a 20 m QSO.
+        assert_eq!(band_for_hz(14_350_000), Some("20m"));
+        // Broadcast and utility frequencies have no band, and must not be given
+        // one -- a log that says 49m would be wrong, not merely unhelpful.
+        assert_eq!(band_for_hz(6_075_000), None);
+        assert_eq!(band_for_hz(162_025_000), None);
+    }
+
+    #[test]
+    fn frequencies_survive_the_trip_through_megahertz() {
+        for hz in [
+            14_074_000_u64,
+            7_030_000,
+            1_840_000,
+            432_100_000,
+            10_138_700,
+            20_000_000,
+            100_000_000,
+        ] {
+            let text = freq_mhz_string(hz);
+            assert_eq!(
+                hz_from_mhz_string(&text),
+                Some(hz),
+                "{text} came back wrong"
+            );
+        }
+        assert_eq!(freq_mhz_string(14_074_000), "14.074");
+        assert_eq!(freq_mhz_string(14_000_000), "14");
+        // A whole number of MHz ending in a zero: trimming the string rather
+        // than the fraction turned 20 MHz into 2 MHz, and 100 into 1.
+        assert_eq!(freq_mhz_string(20_000_000), "20");
+        assert_eq!(freq_mhz_string(100_000_000), "100");
+        assert_eq!(freq_mhz_string(10_000_000), "10");
+        assert_eq!(freq_mhz_string(50_313_000), "50.313");
+    }
+
+    #[test]
+    fn a_rig_mode_is_not_an_adif_mode() {
+        assert_eq!(adif_mode_for_rig_mode("USB"), Some(("SSB", Some("USB"))));
+        assert_eq!(adif_mode_for_rig_mode("lsb"), Some(("SSB", Some("LSB"))));
+        assert_eq!(adif_mode_for_rig_mode("CWR"), Some(("CW", None)));
+        assert_eq!(adif_mode_for_rig_mode("SAM"), Some(("AM", None)));
+        // The rig cannot answer for DIG, and must not be allowed to guess.
+        assert_eq!(adif_mode_for_rig_mode("DIG"), None);
+        // Nor are the maritime modes contacts at all.
+        assert_eq!(adif_mode_for_rig_mode("AIS"), None);
+        assert_eq!(adif_mode_for_rig_mode("VDES"), None);
+    }
+
+    #[test]
+    fn a_decoder_answers_for_the_digital_modes() {
+        assert_eq!(mode_for_decoder("ft8"), Some(("FT8", None)));
+        assert_eq!(mode_for_decoder("ft4"), Some(("MFSK", Some("FT4"))));
+        assert_eq!(mode_for_decoder("aprs"), Some(("PKT", None)));
+        // Hearing a beacon is not a contact.
+        assert_eq!(mode_for_decoder("wspr"), None);
+    }
+
+    #[test]
+    fn adif_times_are_read_in_both_widths_and_written_in_one() {
+        let with_seconds = parse_adif_datetime("20260807", Some("121530")).expect("HHMMSS");
+        let without = parse_adif_datetime("20260807", Some("1215")).expect("HHMM");
+        assert_eq!(adif_date(&with_seconds), "20260807");
+        assert_eq!(adif_time(&with_seconds), "121530");
+        assert_eq!(adif_time(&without), "121500");
+        // A date with no time is still a log entry.
+        assert!(parse_adif_datetime("20260807", None).is_some());
+        // Nonsense is not.
+        assert!(parse_adif_datetime("2026080", Some("1215")).is_none());
+        assert!(parse_adif_datetime("20261307", Some("1215")).is_none());
+        assert!(parse_adif_datetime("20260807", Some("12:15")).is_none());
+    }
+}
@@ -0,0 +1,330 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Where the log lives.
+//!
+//! One JSON Lines file, appended to and never rewritten in place. A log is the
+//! one thing in this application that cannot be regenerated: a bookmark can be
+//! typed again and a decode will come round again, but a contact happened once.
+//! So every write is an append of a single line — atomic as far as a crash is
+//! concerned, since a torn last line loses only the record being written and is
+//! skipped on the next load — rather than a dump of the whole file, which at
+//! forty thousand QSOs would rewrite megabytes to log one contact and lose all
+//! of them if the power went halfway.
+//!
+//! An edit appends a new revision of the same id and a delete appends a
+//! tombstone; the load keeps the last word on each id. Compaction rewrites the
+//! file, through a temporary and a rename, once the superseded records outnumber
+//! the live ones.
+
+use std::collections::HashMap;
+use std::fs::{create_dir_all, File, OpenOptions};
+use std::io::{BufRead, BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+use crate::qso::Qso;
+
+/// One line of the file.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "op", rename_all = "snake_case")]
+enum Entry {
+    /// A contact, as it stands after this line.
+    Qso(Box<Qso>),
+    /// This id is gone.
+    Delete { id: String },
+}
+
+/// Compact once more than this share of the file is superseded.
+const COMPACT_WHEN_STALE_RATIO: f64 = 0.5;
+/// ...but not while the file is still trivially small.
+const COMPACT_MIN_LINES: usize = 256;
+
+pub struct LogStore {
+    path: PathBuf,
+    /// Live records by id. The log is small enough to hold: forty thousand
+    /// QSOs is a few tens of megabytes, and every read wants it in memory.
+    qsos: HashMap<String, Qso>,
+    /// Lines in the file, live or not, for deciding when to compact.
+    lines_written: usize,
+}
+
+impl LogStore {
+    /// Open the log at `path`, creating it and its directory if need be.
+    ///
+    /// A line that cannot be read is skipped and counted rather than failing the
+    /// open: a half-written last line from a crash must not cost the operator
+    /// the rest of the log.
+    pub fn open(path: &Path) -> std::io::Result<Self> {
+        if let Some(parent) = path.parent() {
+            create_dir_all(parent)?;
+        }
+        let mut store = Self {
+            path: path.to_path_buf(),
+            qsos: HashMap::new(),
+            lines_written: 0,
+        };
+        if path.exists() {
+            let file = File::open(path)?;
+            let mut damaged = 0usize;
+            for line in BufReader::new(file).lines() {
+                let line = line?;
+                if line.trim().is_empty() {
+                    continue;
+                }
+                store.lines_written += 1;
+                match serde_json::from_str::<Entry>(&line) {
+                    Ok(Entry::Qso(qso)) => {
+                        store.qsos.insert(qso.id.clone(), *qso);
+                    }
+                    Ok(Entry::Delete { id }) => {
+                        store.qsos.remove(&id);
+                    }
+                    Err(_) => damaged += 1,
+                }
+            }
+            if damaged > 0 {
+                tracing::warn!(
+                    "logbook: skipped {damaged} unreadable line(s) in {}",
+                    path.display()
+                );
+            }
+        }
+        Ok(store)
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub fn len(&self) -> usize {
+        self.qsos.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.qsos.is_empty()
+    }
+
+    /// Every contact, newest first.
+    pub fn all(&self) -> Vec<Qso> {
+        let mut all: Vec<Qso> = self.qsos.values().cloned().collect();
+        all.sort_by(|a, b| b.started_at.cmp(&a.started_at).then(a.id.cmp(&b.id)));
+        all
+    }
+
+    pub fn get(&self, id: &str) -> Option<&Qso> {
+        self.qsos.get(id)
+    }
+
+    /// Write a contact, new or changed.
+    pub fn put(&mut self, qso: Qso) -> std::io::Result<()> {
+        self.append(&Entry::Qso(Box::new(qso.clone())))?;
+        self.qsos.insert(qso.id.clone(), qso);
+        self.compact_if_needed()
+    }
+
+    /// Write several contacts, appending them in one open of the file.
+    pub fn put_all(&mut self, qsos: Vec<Qso>) -> std::io::Result<()> {
+        if qsos.is_empty() {
+            return Ok(());
+        }
+        let mut file = BufWriter::new(
+            OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&self.path)?,
+        );
+        for qso in &qsos {
+            let line = serde_json::to_string(&Entry::Qso(Box::new(qso.clone())))
+                .map_err(std::io::Error::other)?;
+            writeln!(file, "{line}")?;
+            self.lines_written += 1;
+        }
+        file.flush()?;
+        for qso in qsos {
+            self.qsos.insert(qso.id.clone(), qso);
+        }
+        self.compact_if_needed()
+    }
+
+    /// Forget a contact. `Ok(false)` if there was nothing to forget.
+    pub fn delete(&mut self, id: &str) -> std::io::Result<bool> {
+        if !self.qsos.contains_key(id) {
+            return Ok(false);
+        }
+        self.append(&Entry::Delete { id: id.to_string() })?;
+        self.qsos.remove(id);
+        self.compact_if_needed()?;
+        Ok(true)
+    }
+
+    fn append(&mut self, entry: &Entry) -> std::io::Result<()> {
+        let line = serde_json::to_string(entry).map_err(std::io::Error::other)?;
+        let mut file = OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&self.path)?;
+        writeln!(file, "{line}")?;
+        file.flush()?;
+        self.lines_written += 1;
+        Ok(())
+    }
+
+    fn compact_if_needed(&mut self) -> std::io::Result<()> {
+        if self.lines_written < COMPACT_MIN_LINES {
+            return Ok(());
+        }
+        let live = self.qsos.len();
+        let stale = self.lines_written.saturating_sub(live);
+        if (stale as f64) < (self.lines_written as f64) * COMPACT_WHEN_STALE_RATIO {
+            return Ok(());
+        }
+        self.compact()
+    }
+
+    /// Rewrite the file with one line per live contact.
+    ///
+    /// Through a temporary and a rename, so an interrupted compaction leaves
+    /// the old file whole rather than a half-written new one.
+    pub fn compact(&mut self) -> std::io::Result<()> {
+        let temporary = self.path.with_extension("jsonl.compacting");
+        {
+            let mut file = BufWriter::new(File::create(&temporary)?);
+            for qso in self.all() {
+                let line = serde_json::to_string(&Entry::Qso(Box::new(qso)))
+                    .map_err(std::io::Error::other)?;
+                writeln!(file, "{line}")?;
+            }
+            file.flush()?;
+        }
+        std::fs::rename(&temporary, &self.path)?;
+        self.lines_written = self.qsos.len();
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn qso(id: &str, call: &str, minute: u32) -> Qso {
+        Qso::new(
+            id.to_string(),
+            parse_adif_datetime("20260807", Some(&format!("12{minute:02}00"))).expect("time"),
+            call,
+            14_074_000,
+            "FT8",
+        )
+    }
+
+    #[test]
+    fn a_log_survives_being_closed_and_opened() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        store.put(qso("a", "SP1AA", 0)).expect("put");
+        store.put(qso("b", "SP2BB", 1)).expect("put");
+        drop(store);
+
+        let store = LogStore::open(&path).expect("reopen");
+        assert_eq!(store.len(), 2);
+        assert_eq!(store.get("a").map(|q| q.call.as_str()), Some("SP1AA"));
+        // Newest first.
+        assert_eq!(store.all()[0].call, "SP2BB");
+    }
+
+    #[test]
+    fn the_last_word_on_an_id_is_the_one_that_counts() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        store.put(qso("a", "SP1AA", 0)).expect("put");
+        let mut edited = qso("a", "SP1AA", 0);
+        edited.rst_sent = Some("-05".into());
+        store.put(edited).expect("edit");
+        store.put(qso("b", "SP2BB", 1)).expect("put");
+        assert!(store.delete("b").expect("delete"));
+        assert!(!store.delete("b").expect("delete again"));
+        drop(store);
+
+        let store = LogStore::open(&path).expect("reopen");
+        assert_eq!(store.len(), 1);
+        assert_eq!(
+            store.get("a").and_then(|q| q.rst_sent.clone()),
+            Some("-05".into())
+        );
+    }
+
+    /// A crash mid-write leaves a torn line. It costs that record and nothing
+    /// else — the point of appending one line at a time.
+    #[test]
+    fn a_torn_last_line_costs_only_itself() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        store.put(qso("a", "SP1AA", 0)).expect("put");
+        store.put(qso("b", "SP2BB", 1)).expect("put");
+        drop(store);
+
+        let mut text = std::fs::read_to_string(&path).expect("read");
+        text.push_str("{\"op\":\"qso\",\"id\":\"c\",\"call\":\"SP3");
+        std::fs::write(&path, text).expect("write");
+
+        let store = LogStore::open(&path).expect("reopen past the tear");
+        assert_eq!(store.len(), 2);
+        assert!(store.get("a").is_some() && store.get("b").is_some());
+    }
+
+    #[test]
+    fn compaction_keeps_the_log_and_shortens_the_file() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        // One live record, rewritten until compaction triggers.
+        for index in 0..COMPACT_MIN_LINES + 10 {
+            let mut entry = qso("a", "SP1AA", 0);
+            entry.comment = Some(format!("revision {index}"));
+            store.put(entry).expect("put");
+        }
+        let lines = std::fs::read_to_string(&path)
+            .expect("read")
+            .lines()
+            .count();
+        assert_eq!(store.len(), 1);
+        // Compacted along the way: the file holds the revisions written since,
+        // not the two hundred and sixty-six that were written.
+        assert!(
+            lines < COMPACT_MIN_LINES,
+            "the file kept {lines} lines for one contact"
+        );
+        assert_eq!(
+            store.get("a").and_then(|q| q.comment.clone()),
+            Some(format!("revision {}", COMPACT_MIN_LINES + 9))
+        );
+
+        // And the compacted file still reads.
+        drop(store);
+        let store = LogStore::open(&path).expect("reopen");
+        assert_eq!(store.len(), 1);
+    }
+
+    #[test]
+    fn an_import_appends_in_one_pass() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+        let mut store = LogStore::open(&path).expect("open");
+        store
+            .put_all(vec![qso("a", "SP1AA", 0), qso("b", "SP2BB", 1)])
+            .expect("put_all");
+        assert_eq!(store.len(), 2);
+        drop(store);
+        assert_eq!(LogStore::open(&path).expect("reopen").len(), 2);
+    }
+}
@@ -34,6 +34,23 @@ pub struct ClientConfig {
    pub remotes: Vec<RemoteEntry>,
    /// Frontend configurations
    pub frontends: FrontendsConfig,
+    /// Station logbook
+    pub logbook: LogbookConfig,
+}
+
+/// Station logbook settings.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(default)]
+pub struct LogbookConfig {
+    /// Where the log is kept.
+    ///
+    /// Defaults to `logbook.jsonl` in the user's data directory — not the
+    /// config directory the bookmarks use, and not the cache directory the
+    /// decode logs use: a log of contacts is neither a setting nor disposable,
+    /// and cache directories are swept by cleaners. Configurable because a
+    /// station that keeps its log on a synced or backed-up volume has to be
+    /// able to say so.
+    pub path: Option<String>,
 }

 /// General application settings.
@@ -251,18 +268,21 @@ impl AsRef<str> for CookieSameSite {
 pub struct HttpAuthConfig {
    /// Enable HTTP frontend authentication
    pub enabled: bool,
-    /// Passphrase for read-only access (rx role)
-    pub rx_passphrase: Option<String>,
-    /// Read the rx passphrase from this file instead.
+    /// JSON file containing the managed user database.
+    pub users_file: String,
+    /// Username used to create the first administrator when the database is absent.
+    pub bootstrap_admin_username: Option<String>,
+    /// Password used to create the first administrator when the database is absent.
+    pub bootstrap_admin_password: Option<String>,
+    /// Read the bootstrap administrator password from this file instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub rx_passphrase_file: Option<String>,
-    /// Passphrase for full control access (control role)
-    pub control_passphrase: Option<String>,
-    /// Read the control passphrase from this file instead.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub control_passphrase_file: Option<String>,
-    /// Enforce TX/PTT access control (hide from unauthenticated/rx users)
-    pub tx_access_control_enabled: bool,
+    pub bootstrap_admin_password_file: Option<String>,
+    /// Create a Guest account when bootstrapping a new database.
+    pub bootstrap_read_enabled: bool,
+    /// Username for the Guest bootstrap account.
+    pub bootstrap_read_username: String,
+    /// Password for the Guest bootstrap account.
+    pub bootstrap_read_password: Option<String>,
    /// Session time-to-live in minutes
    pub session_ttl_min: u64,
    /// Set Secure flag on session cookie (required for HTTPS)
@@ -275,11 +295,13 @@ impl Default for HttpAuthConfig {
    fn default() -> Self {
        Self {
            enabled: false,
-            rx_passphrase: None,
-            rx_passphrase_file: None,
-            control_passphrase: None,
-            control_passphrase_file: None,
-            tx_access_control_enabled: true,
+            users_file: "trx-http-users.json".to_string(),
+            bootstrap_admin_username: None,
+            bootstrap_admin_password: None,
+            bootstrap_admin_password_file: None,
+            bootstrap_read_enabled: true,
+            bootstrap_read_username: "guest".to_string(),
+            bootstrap_read_password: Some("guest".to_string()),
            session_ttl_min: 480,
            cookie_secure: false,
            cookie_same_site: CookieSameSite::Lax,
@@ -785,14 +807,9 @@ impl ClientConfig {
            )?;
        }
        resolve_secret(
-            &mut self.frontends.http.auth.rx_passphrase,
-            &self.frontends.http.auth.rx_passphrase_file,
-            "[frontends.http.auth].rx_passphrase",
-        )?;
-        resolve_secret(
-            &mut self.frontends.http.auth.control_passphrase,
-            &self.frontends.http.auth.control_passphrase_file,
-            "[frontends.http.auth].control_passphrase",
+            &mut self.frontends.http.auth.bootstrap_admin_password,
+            &self.frontends.http.auth.bootstrap_admin_password_file,
+            "[frontends.http.auth].bootstrap_admin_password",
        )?;
        resolve_secret_list(
            &mut self.frontends.http_json.auth.tokens,
@@ -802,7 +819,7 @@ impl ClientConfig {

        if let Some(path) = config_path {
            if self.has_inline_secrets() {
-                crate::secrets::warn_if_group_readable(path, "tokens/passphrases");
+                crate::secrets::warn_if_group_readable(path, "tokens/passwords");
            }
        }
        Ok(())
@@ -815,10 +832,22 @@ impl ClientConfig {
                .remotes
                .iter()
                .any(|r| r.auth.token_file.is_none() && r.auth.token.is_some())
-            || self.frontends.http.auth.rx_passphrase_file.is_none()
-                && self.frontends.http.auth.rx_passphrase.is_some()
-            || self.frontends.http.auth.control_passphrase_file.is_none()
-                && self.frontends.http.auth.control_passphrase.is_some()
+            || self
+                .frontends
+                .http
+                .auth
+                .bootstrap_admin_password_file
+                .is_none()
+                && self.frontends.http.auth.bootstrap_admin_password.is_some()
+            || self.frontends.http.auth.enabled
+                && self.frontends.http.auth.bootstrap_read_enabled
+                && self
+                    .frontends
+                    .http
+                    .auth
+                    .bootstrap_read_password
+                    .as_deref()
+                    .is_some_and(|password| password != "guest")
            || self.frontends.http_json.auth.tokens_file.is_none()
                && !self.frontends.http_json.auth.tokens.is_empty()
    }
@@ -888,11 +917,13 @@ impl ClientConfig {
                    decode_history_retention_min_by_rig: HashMap::new(),
                    auth: HttpAuthConfig {
                        enabled: false,
-                        rx_passphrase: Some("rx-passphrase-example".to_string()),
-                        rx_passphrase_file: None,
-                        control_passphrase: Some("control-passphrase-example".to_string()),
-                        control_passphrase_file: None,
-                        tx_access_control_enabled: true,
+                        users_file: "trx-http-users.json".to_string(),
+                        bootstrap_admin_username: Some("admin".to_string()),
+                        bootstrap_admin_password: Some("change-this-password".to_string()),
+                        bootstrap_admin_password_file: None,
+                        bootstrap_read_enabled: true,
+                        bootstrap_read_username: "guest".to_string(),
+                        bootstrap_read_password: Some("guest".to_string()),
                        session_ttl_min: 480,
                        cookie_secure: false,
                        cookie_same_site: CookieSameSite::Lax,
@@ -907,6 +938,7 @@ impl ClientConfig {
                http_json: HttpJsonFrontendConfig::default(),
                audio: AudioClientConfig::default(),
            },
+            logbook: LogbookConfig { path: None },
        }
    }

@@ -930,27 +962,34 @@ fn validate_http_auth(auth: &HttpAuthConfig) -> Result<(), String> {
        return Ok(());
    }

-    // If enabled, require at least one passphrase
-    if auth.rx_passphrase.is_none() && auth.control_passphrase.is_none() {
+    if auth.users_file.trim().is_empty() {
+        return Err("[frontends.http.auth].users_file must not be empty".to_string());
+    }
+    if auth.bootstrap_admin_username.is_some() != auth.bootstrap_admin_password.is_some() {
+        return Err("[frontends.http.auth] bootstrap_admin_username and bootstrap_admin_password must be set together".to_string());
+    }
+    if auth
+        .bootstrap_admin_username
+        .as_deref()
+        .is_some_and(|v| v.trim().is_empty())
+        || auth
+            .bootstrap_admin_password
+            .as_deref()
+            .is_some_and(|v| v.is_empty())
+    {
        return Err(
-            "[frontends.http.auth] enabled=true requires at least one passphrase \
-             (rx_passphrase and/or control_passphrase)"
+            "[frontends.http.auth] bootstrap administrator credentials must not be empty"
                .to_string(),
        );
    }
-
-    // Validate passphrases are not empty strings
-    if let Some(rx) = &auth.rx_passphrase {
-        if rx.trim().is_empty() {
-            return Err("[frontends.http.auth].rx_passphrase must not be empty if set".to_string());
-        }
-    }
-    if let Some(ctrl) = &auth.control_passphrase {
-        if ctrl.trim().is_empty() {
-            return Err(
-                "[frontends.http.auth].control_passphrase must not be empty if set".to_string(),
-            );
-        }
+    if auth.bootstrap_read_enabled
+        && (auth.bootstrap_read_username.trim().is_empty()
+            || auth
+                .bootstrap_read_password
+                .as_deref()
+                .is_none_or(str::is_empty))
+    {
+        return Err("[frontends.http.auth] enabled bootstrap Guest account requires a non-empty username and password".to_string());
    }

    // Session TTL must be > 0
@@ -1220,42 +1259,34 @@ home-hf = "audio://10.0.0.5:4600"
    }

    #[test]
-    fn test_validate_rejects_http_auth_enabled_without_passphrases() {
+    fn test_validate_accepts_http_auth_with_user_database() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_accepts_bootstrap_admin_pair() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_rejects_incomplete_bootstrap_admin_pair() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
        assert!(config.validate().is_err());
    }

    #[test]
-    fn test_validate_accepts_http_auth_with_rx_passphrase() {
+    fn test_validate_rejects_empty_users_file() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_accepts_http_auth_with_control_passphrase() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_accepts_http_auth_with_both_passphrases() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
-        config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_rejects_empty_rx_passphrase() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("".to_string());
+        config.frontends.http.auth.users_file.clear();
        assert!(config.validate().is_err());
    }

@@ -1263,16 +1294,27 @@ home-hf = "audio://10.0.0.5:4600"
    fn test_validate_rejects_zero_session_ttl() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
        config.frontends.http.auth.session_ttl_min = 0;
        assert!(config.validate().is_err());
    }

    #[test]
-    fn test_validate_auth_disabled_ignores_passphrases() {
+    fn test_validate_allows_disabling_read_bootstrap_credentials() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
+        config.frontends.http.auth.bootstrap_read_enabled = false;
+        config.frontends.http.auth.bootstrap_read_username.clear();
+        config.frontends.http.auth.bootstrap_read_password = None;
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_auth_disabled_ignores_user_settings() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = false;
-        config.frontends.http.auth.rx_passphrase = Some("".to_string());
+        config.frontends.http.auth.users_file.clear();
        assert!(config.validate().is_ok());
    }

@@ -1280,9 +1322,12 @@ home-hf = "audio://10.0.0.5:4600"
    fn test_http_auth_config_default() {
        let auth = HttpAuthConfig::default();
        assert!(!auth.enabled);
-        assert!(auth.rx_passphrase.is_none());
-        assert!(auth.control_passphrase.is_none());
-        assert!(auth.tx_access_control_enabled);
+        assert_eq!(auth.users_file, "trx-http-users.json");
+        assert!(auth.bootstrap_admin_username.is_none());
+        assert!(auth.bootstrap_admin_password.is_none());
+        assert!(auth.bootstrap_read_enabled);
+        assert_eq!(auth.bootstrap_read_username, "guest");
+        assert_eq!(auth.bootstrap_read_password.as_deref(), Some("guest"));
        assert_eq!(auth.session_ttl_min, 480);
        assert!(!auth.cookie_secure);
        assert!(matches!(auth.cookie_same_site, CookieSameSite::Lax));
@@ -1584,15 +1629,21 @@ spectrum_interval_ms = 0
    }

    #[test]
-    fn test_passphrase_file_fills_passphrase() {
+    fn test_bootstrap_password_file_fills_password() {
        let f = secret_file("hunter2\n");
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.control_passphrase_file =
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password_file =
            Some(f.path().to_str().unwrap().to_string());
        config.resolve_secrets(None).unwrap();
        assert_eq!(
-            config.frontends.http.auth.control_passphrase.as_deref(),
+            config
+                .frontends
+                .http
+                .auth
+                .bootstrap_admin_password
+                .as_deref(),
            Some("hunter2")
        );
        assert!(config.validate().is_ok());
@@ -111,8 +111,8 @@ const SECTION_COMMENTS: &[(&str, &str)] = &[
    ),
    (
        "trx-client.frontends.http.auth",
-        "Passphrase login for the web UI.  rx_passphrase_file and\n\
-         control_passphrase_file keep the secrets out of this file.",
+        "Optional user/password ACL for the web UI. Administrators manage\n\
+         accounts stored in users_file.",
    ),
    (
        "trx-client.frontends.rigctl",
@@ -130,6 +130,10 @@ const SECTION_COMMENTS: &[(&str, &str)] = &[
        "trx-client.frontends.audio.bridge",
        "Play RX audio on a local sound device and capture TX from one.",
    ),
+    (
+        "trx-client.logbook",
+        "Station log of contacts.  path defaults to logbook.jsonl in the user's\n         data directory; set it to keep the log on a backed-up volume.",
+    ),
 ];

 /// Render the combined `trx-rs.toml.example` contents.
@@ -19,7 +19,7 @@ use crate::shared::{check_socket_conflicts, validate_log_level, validate_tokens,
 use serde::{Deserialize, Serialize};
 pub use trx_decode_log::DecodeLogsConfig;

-use trx_core::rig::state::RigMode;
+use trx_core::rig::state::{DigSidebandPolicy, RigMode};

 /// Every decoder the server knows how to run, by config name.
 ///
@@ -393,6 +393,10 @@ pub struct SdrConfig {
    pub squelch: SdrSquelchConfig,
    /// Noise blanker for impulse noise suppression on IQ samples.
    pub noise_blanker: SdrNoiseBlankerConfig,
+    /// How DIG mode picks a sideband: `auto` (USB ≥ 10 MHz, LSB below),
+    /// `usb`, or `lsb`. Overridable at runtime and per-bookmark.
+    #[serde(default)]
+    pub dig_sideband: DigSidebandPolicy,
    /// Virtual receiver channels (at least one required when SDR backend is active).
    pub channels: Vec<SdrChannelConfig>,
    /// Maximum number of simultaneous virtual channels (including the primary).
@@ -433,6 +437,7 @@ impl Default for SdrConfig {
            gain: SdrGainConfig::default(),
            squelch: SdrSquelchConfig::default(),
            noise_blanker: SdrNoiseBlankerConfig::default(),
+            dig_sideband: DigSidebandPolicy::default(),
            channels: Vec::new(),
            max_virtual_channels: default_max_virtual_channels(),
            spectrum_fft_size: default_spectrum_fft_size(),
@@ -17,6 +17,6 @@ pub use rig::request::RigRequest;
 pub use rig::response::{RigError, RigResult};
 pub use rig::state::{
    DecoderConfig, DecoderResetSeqs, RdsData, RigFilterState, RigMode, RigSnapshot, RigState,
-    WfmDenoiseLevel,
+    DigSidebandPolicy, WfmDenoiseLevel,
 };
 pub use rig::AudioSource;
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 use crate::radio::freq::Freq;
-use crate::rig::state::WfmDenoiseLevel;
+use crate::rig::state::{DigSidebandPolicy, WfmDenoiseLevel};
 use crate::RigMode;

 /// Internal command handled by the rig task.
@@ -50,6 +50,8 @@ pub enum RigCommand {
    SetSdrAgc(bool),
    SetSdrSquelch { enabled: bool, threshold_db: f64 },
    SetSdrNoiseBlanker { enabled: bool, threshold: f64 },
+    /// Set how the SDR backend resolves DIG mode to a sideband (SDR only).
+    SetSdrDigSideband(DigSidebandPolicy),
    SetWfmDeemphasis(u32),
    SetWfmStereo(bool),
    SetWfmDenoise(WfmDenoiseLevel),
@@ -470,6 +470,7 @@ pub fn command_from_rig_command(cmd: RigCommand) -> Box<dyn RigCommandHandler> {
        | RigCommand::SetSdrAgc(_)
        | RigCommand::SetSdrSquelch { .. }
        | RigCommand::SetSdrNoiseBlanker { .. }
+        | RigCommand::SetSdrDigSideband(_)
        | RigCommand::SetWfmDeemphasis(_)
        | RigCommand::SetWfmStereo(_)
        | RigCommand::SetWfmDenoise(_)
@@ -260,6 +260,17 @@ pub trait RigSdr: Send {
        )))
    }

+    /// Set how DIG mode resolves to a sideband (SDR backends only).
+    fn set_sdr_dig_sideband<'a>(
+        &'a mut self,
+        _policy: crate::rig::state::DigSidebandPolicy,
+    ) -> Pin<Box<dyn Future<Output = DynResult<()>> + Send + 'a>> {
+        Box::pin(std::future::ready(Err(
+            Box::new(response::RigError::not_supported("set_sdr_dig_sideband"))
+                as Box<dyn std::error::Error + Send + Sync>,
+        )))
+    }
+
    fn set_wfm_stereo<'a>(
        &'a mut self,
        _enabled: bool,
@@ -338,6 +338,10 @@ pub struct RigFilterState {
    pub sdr_nb_enabled: Option<bool>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub sdr_nb_threshold: Option<f64>,
+    /// Current DIG sideband policy (SDR backends only). Surfaces in the UI as
+    /// the advanced-controls "DIG sideband" selector.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub sdr_dig_sideband: Option<DigSidebandPolicy>,
    #[serde(default = "default_wfm_deemphasis_us")]
    pub wfm_deemphasis_us: u32,
    #[serde(default = "default_wfm_stereo")]
@@ -370,6 +374,89 @@ pub enum WfmDenoiseLevel {
    High,
 }

+/// How the SDR backend resolves the [`RigMode::DIG`] mode to a concrete
+/// sideband when demodulating.
+///
+/// DIG (data / digital) has no inherent sideband; by ham-radio convention it
+/// follows the SSB convention for the band. `Auto` applies that convention
+/// (USB at/above 10 MHz, LSB below); `Usb`/`Lsb` force a fixed sideband. The
+/// setting is a global SDR control (see advanced radio controls) and may be
+/// overridden per-bookmark.
+#[derive(Debug, Clone, Copy, Default, Serialize, Deserialize, PartialEq, Eq, TS)]
+#[serde(rename_all = "lowercase")]
+pub enum DigSidebandPolicy {
+    /// Pick USB or LSB from the dial frequency (USB ≥ 10 MHz, LSB below).
+    #[default]
+    Auto,
+    /// Always demodulate DIG as upper sideband.
+    Usb,
+    /// Always demodulate DIG as lower sideband.
+    Lsb,
+}
+
+impl DigSidebandPolicy {
+    /// Frequency boundary used by [`DigSidebandPolicy::Auto`]: at or above this
+    /// dial frequency DIG is upper sideband, below it is lower sideband. This is
+    /// the standard amateur SSB/data convention.
+    pub const AUTO_THRESHOLD_HZ: u64 = 10_000_000;
+
+    /// Resolve this policy to a concrete sideband mode ([`RigMode::USB`] or
+    /// [`RigMode::LSB`]) for the given dial frequency.
+    pub fn resolve(self, freq_hz: u64) -> RigMode {
+        match self {
+            DigSidebandPolicy::Usb => RigMode::USB,
+            DigSidebandPolicy::Lsb => RigMode::LSB,
+            DigSidebandPolicy::Auto => {
+                if freq_hz >= Self::AUTO_THRESHOLD_HZ {
+                    RigMode::USB
+                } else {
+                    RigMode::LSB
+                }
+            }
+        }
+    }
+
+    /// Compact encoding for storage in an atomic (e.g. shared runtime state).
+    pub fn to_u8(self) -> u8 {
+        match self {
+            DigSidebandPolicy::Auto => 0,
+            DigSidebandPolicy::Usb => 1,
+            DigSidebandPolicy::Lsb => 2,
+        }
+    }
+
+    /// Inverse of [`DigSidebandPolicy::to_u8`]; unknown values decode to `Auto`.
+    pub fn from_u8(v: u8) -> Self {
+        match v {
+            1 => DigSidebandPolicy::Usb,
+            2 => DigSidebandPolicy::Lsb,
+            _ => DigSidebandPolicy::Auto,
+        }
+    }
+
+    /// Parse a case-insensitive `auto`/`usb`/`lsb` string; `None` if unknown.
+    pub fn parse(s: &str) -> Option<Self> {
+        match s.trim().to_ascii_lowercase().as_str() {
+            "auto" => Some(DigSidebandPolicy::Auto),
+            "usb" => Some(DigSidebandPolicy::Usb),
+            "lsb" => Some(DigSidebandPolicy::Lsb),
+            _ => None,
+        }
+    }
+}
+
+/// Resolve a channel's effective demodulation mode. For [`RigMode::DIG`] this
+/// applies the sideband `policy` at the given dial frequency; every other mode
+/// is returned unchanged. Callers hand the result to the DSP while keeping the
+/// logical `DIG` mode for display and decoder gating.
+pub fn effective_demod_mode(logical: &RigMode, policy: DigSidebandPolicy, freq_hz: u64) -> RigMode {
+    if *logical == RigMode::DIG {
+        policy.resolve(freq_hz)
+    } else {
+        logical.clone()
+    }
+}
+
 fn default_wfm_deemphasis_us() -> u32 {
    75
 }
@@ -506,3 +593,61 @@ pub struct RigSnapshot {
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub vchan_rds: Option<Vec<VchanRdsEntry>>,
 }
+
+#[cfg(test)]
+mod dig_sideband_tests {
+    use super::{effective_demod_mode, DigSidebandPolicy, RigMode};
+
+    #[test]
+    fn auto_follows_ssb_band_convention() {
+        // Below 10 MHz → LSB; at/above 10 MHz → USB.
+        assert_eq!(DigSidebandPolicy::Auto.resolve(7_074_000), RigMode::LSB);
+        assert_eq!(DigSidebandPolicy::Auto.resolve(3_580_000), RigMode::LSB);
+        assert_eq!(DigSidebandPolicy::Auto.resolve(9_999_999), RigMode::LSB);
+        assert_eq!(DigSidebandPolicy::Auto.resolve(10_000_000), RigMode::USB);
+        assert_eq!(DigSidebandPolicy::Auto.resolve(14_074_000), RigMode::USB);
+    }
+
+    #[test]
+    fn forced_policies_ignore_frequency() {
+        assert_eq!(DigSidebandPolicy::Usb.resolve(3_580_000), RigMode::USB);
+        assert_eq!(DigSidebandPolicy::Lsb.resolve(14_074_000), RigMode::LSB);
+    }
+
+    #[test]
+    fn effective_mode_only_rewrites_dig() {
+        // Non-DIG modes pass through untouched regardless of policy/frequency.
+        assert_eq!(
+            effective_demod_mode(&RigMode::USB, DigSidebandPolicy::Lsb, 3_580_000),
+            RigMode::USB
+        );
+        assert_eq!(
+            effective_demod_mode(&RigMode::FM, DigSidebandPolicy::Usb, 3_580_000),
+            RigMode::FM
+        );
+        // DIG resolves by policy + frequency.
+        assert_eq!(
+            effective_demod_mode(&RigMode::DIG, DigSidebandPolicy::Auto, 7_074_000),
+            RigMode::LSB
+        );
+        assert_eq!(
+            effective_demod_mode(&RigMode::DIG, DigSidebandPolicy::Auto, 14_074_000),
+            RigMode::USB
+        );
+    }
+
+    #[test]
+    fn u8_roundtrips_and_parses() {
+        for p in [
+            DigSidebandPolicy::Auto,
+            DigSidebandPolicy::Usb,
+            DigSidebandPolicy::Lsb,
+        ] {
+            assert_eq!(DigSidebandPolicy::from_u8(p.to_u8()), p);
+        }
+        assert_eq!(DigSidebandPolicy::from_u8(200), DigSidebandPolicy::Auto);
+        assert_eq!(DigSidebandPolicy::parse("USB"), Some(DigSidebandPolicy::Usb));
+        assert_eq!(DigSidebandPolicy::parse(" lsb "), Some(DigSidebandPolicy::Lsb));
+        assert_eq!(DigSidebandPolicy::parse("nonsense"), None);
+    }
+}
@@ -343,6 +343,7 @@ mod tests {
                sdr_squelch_threshold_db: None,
                sdr_nb_enabled: None,
                sdr_nb_threshold: None,
+                sdr_dig_sideband: None,
                wfm_deemphasis_us: 75,
                wfm_stereo: true,
                wfm_stereo_detected: false,
@@ -391,6 +392,7 @@ mod tests {
                sdr_squelch_threshold_db: None,
                sdr_nb_enabled: None,
                sdr_nb_threshold: None,
+                sdr_dig_sideband: None,
                wfm_deemphasis_us: 50,
                wfm_stereo: true,
                wfm_stereo_detected: true,
@@ -146,6 +146,7 @@ define_command_mapping! {
        SetSdrGain            { gain_db }        <=> SetSdrGain,
        SetSdrLnaGain         { gain_db }        <=> SetSdrLnaGain,
        SetSdrAgc             { enabled }        <=> SetSdrAgc,
+        SetSdrDigSideband     { policy }         <=> SetSdrDigSideband,
        SetWfmDeemphasis      { deemphasis_us }  <=> SetWfmDeemphasis,
        SetWfmStereo          { enabled }        <=> SetWfmStereo,
        SetWfmDenoise         { level }          <=> SetWfmDenoise,
@@ -7,7 +7,7 @@
 use serde::{Deserialize, Serialize};

 use trx_core::rig::state::RigSnapshot;
-use trx_core::WfmDenoiseLevel;
+use trx_core::{DigSidebandPolicy, WfmDenoiseLevel};

 /// Command received from network clients (JSON).
 #[derive(Debug, Serialize, Deserialize)]
@@ -106,6 +106,9 @@ pub enum ClientCommand {
        enabled: bool,
        threshold: f64,
    },
+    SetSdrDigSideband {
+        policy: DigSidebandPolicy,
+    },
    SetWfmDeemphasis {
        deemphasis_us: u32,
    },
@@ -360,6 +360,7 @@ fn build_sdr_rig_from_instance(rig_cfg: &RigInstanceConfig) -> SdrRigBuildResult
        max_virtual_channels: rig_cfg.sdr.max_virtual_channels,
        nb_enabled: rig_cfg.sdr.noise_blanker.enabled,
        nb_threshold: rig_cfg.sdr.noise_blanker.threshold,
+        dig_sideband: rig_cfg.sdr.dig_sideband,
        spectrum_fft_size: rig_cfg.sdr.spectrum_fft_size,
    })?;

@@ -774,6 +774,18 @@ async fn process_command(
            let _ = ctx.state_tx.send(ctx.state.clone());
            return snapshot_from(ctx.state);
        }
+        RigCommand::SetSdrDigSideband(policy) => {
+            if let Some(sdr) = ctx.rig.as_sdr() {
+                if let Err(e) = sdr.set_sdr_dig_sideband(policy).await {
+                    return Err(RigError::communication(format!("set_sdr_dig_sideband: {e}")));
+                }
+            } else {
+                return Err(RigError::not_supported("set_sdr_dig_sideband"));
+            }
+            ctx.state.filter = ctx.rig.as_sdr_ref().and_then(|s| s.filter_state());
+            let _ = ctx.state_tx.send(ctx.state.clone());
+            return snapshot_from(ctx.state);
+        }
        RigCommand::SetWfmDeemphasis(deemphasis_us) => {
            if let Some(sdr) = ctx.rig.as_sdr() {
                if let Err(e) = sdr.set_wfm_deemphasis(deemphasis_us).await {
@@ -13,7 +13,10 @@ use std::sync::atomic::Ordering;
 use std::sync::{Arc, Mutex};
 use trx_core::radio::freq::{Band, Freq};
 use trx_core::rig::response::RigError;
-use trx_core::rig::state::{RigFilterState, SpectrumData, VchanRdsEntry, WfmDenoiseLevel};
+use trx_core::rig::state::{
+    effective_demod_mode, DigSidebandPolicy, RigFilterState, SpectrumData, VchanRdsEntry,
+    WfmDenoiseLevel,
+};
 use trx_core::rig::{
    AudioSource, Rig, RigAccessMethod, RigCapabilities, RigCat, RigInfo, RigSdr, RigStatusFuture,
 };
@@ -73,6 +76,8 @@ pub struct SoapySdrConfig {
    pub nb_enabled: bool,
    /// Noise blanker impulse threshold multiplier.
    pub nb_threshold: f64,
+    /// How DIG mode resolves to a sideband (auto/usb/lsb).
+    pub dig_sideband: DigSidebandPolicy,
    /// FFT bin count for the spectrum display; a power of two.
    ///
    /// Fewer bins cost less DSP and put fewer bytes on the network per frame,
@@ -104,6 +109,7 @@ impl Default for SoapySdrConfig {
            max_virtual_channels: 4,
            nb_enabled: false,
            nb_threshold: 10.0,
+            dig_sideband: DigSidebandPolicy::Auto,
            spectrum_fft_size: 1024,
        }
    }
@@ -157,7 +163,12 @@ pub struct SoapySdrRig {
    /// Hidden AIS decoder channels (A and B) when available.
    ais_channel_indices: Option<(usize, usize)>,
    /// Virtual channel manager shared with external consumers (e.g. RigHandle).
+    /// Also owns the shared DIG-sideband policy.
    channel_manager: Arc<vchan_impl::SdrVirtualChannelManager>,
+    /// Concrete demodulation mode last pushed to the primary channel DSP. For
+    /// DIG this is the resolved USB/LSB; used to avoid rebuilding filters on
+    /// every tune step when the resolved sideband hasn't actually changed.
+    applied_primary_mode: RigMode,
 }

 impl SoapySdrRig {
@@ -200,6 +211,7 @@ impl SoapySdrRig {
        let max_virtual_channels = config.max_virtual_channels;
        let nb_enabled = config.nb_enabled;
        let nb_threshold = config.nb_threshold;
+        let dig_sideband = config.dig_sideband;
        let spectrum_fft_size = config.spectrum_fft_size;
        tracing::info!(
            "initialising SoapySDR backend (args={:?}, gain_mode={:?}, gain_db={}, max_gain_db={:?})",
@@ -364,8 +376,15 @@ impl SoapySdrRig {
            pipeline.clone(),
            fixed_slot_count,
            max_virtual_channels,
+            dig_sideband,
        ));

+        // Concrete demod mode the primary channel starts in. For DIG this
+        // resolves the configured sideband policy against the initial dial
+        // frequency so the very first image/audio uses the right sideband.
+        let initial_primary_mode = effective_demod_mode(&initial_mode, dig_sideband, initial_freq.hz);
+        let initial_is_dig = initial_mode == RigMode::DIG;
+
        let rig = Self {
            info,
            freq: initial_freq,
@@ -392,7 +411,17 @@ impl SoapySdrRig {
            nb_threshold,
            ais_channel_indices: Some((primary_channel_count, primary_channel_count + 1)),
            channel_manager,
+            applied_primary_mode: initial_primary_mode.clone(),
        };
+        // If the primary channel starts in DIG, its DSP was created with the
+        // logical DIG demodulator (upper sideband); push the resolved sideband
+        // so an Auto/LSB start is honoured immediately.
+        if initial_is_dig {
+            let dsps = rig.pipeline.channel_dsps.read().unwrap();
+            if let Some(dsp_arc) = dsps.get(rig.primary_channel_idx) {
+                dsp_arc.lock().unwrap().set_mode(&initial_primary_mode);
+            }
+        }
        rig.apply_ais_channel_activity();
        Ok(rig)
    }
@@ -448,6 +477,7 @@ impl SoapySdrRig {
            max_virtual_channels,
            nb_enabled,
            nb_threshold,
+            dig_sideband: DigSidebandPolicy::default(),
        })
    }

@@ -619,6 +649,21 @@ impl RigCat for SoapySdrRig {
                    }
                }
            }
+            // In DIG/Auto, tuning across the 10 MHz boundary flips the
+            // sideband. Rebuild the demodulator only when it actually changes,
+            // so ordinary tuning stays glitch-free.
+            if self.mode == RigMode::DIG {
+                let effective = self.channel_manager.dig_policy().resolve(self.freq.hz);
+                if effective != self.applied_primary_mode {
+                    let dsps = self.pipeline.channel_dsps.read().unwrap();
+                    if let Some(dsp_arc) = dsps.get(self.primary_channel_idx) {
+                        let mut dsp = dsp_arc.lock().unwrap();
+                        dsp.set_mode(&effective);
+                        dsp.set_filter(self.bandwidth_hz);
+                    }
+                    self.applied_primary_mode = effective;
+                }
+            }
            self.update_ais_channel_offsets();
            Ok(())
        })
@@ -632,12 +677,17 @@ impl RigCat for SoapySdrRig {
            tracing::debug!("SoapySdrRig: set_mode -> {:?}", mode);
            self.mode = mode.clone();
            self.bandwidth_hz = Self::default_bandwidth_for_mode(&mode);
+            // DIG carries no inherent sideband: resolve it to a concrete
+            // USB/LSB demodulator from the policy + dial frequency. The logical
+            // DIG mode is kept in `self.mode` (and RigState) for display.
+            let effective = effective_demod_mode(&self.mode, self.channel_manager.dig_policy(), self.freq.hz);
+            self.applied_primary_mode = effective.clone();
            // Update the primary channel's demodulator in the live pipeline.
            {
                let dsps = self.pipeline.channel_dsps.read().unwrap();
                if let Some(dsp_arc) = dsps.get(self.primary_channel_idx) {
                    let mut dsp = dsp_arc.lock().unwrap();
-                    dsp.set_mode(&mode);
+                    dsp.set_mode(&effective);
                    dsp.set_filter(self.bandwidth_hz);
                }
            }
@@ -956,6 +1006,30 @@ impl RigSdr for SoapySdrRig {
        })
    }

+    fn set_sdr_dig_sideband<'a>(
+        &'a mut self,
+        policy: DigSidebandPolicy,
+    ) -> Pin<Box<dyn std::future::Future<Output = DynResult<()>> + Send + 'a>> {
+        Box::pin(async move {
+            // Update the shared policy (also re-resolves DIG virtual channels).
+            self.channel_manager.set_dig_policy(policy);
+            // Re-apply to the primary channel when it is currently DIG.
+            if self.mode == RigMode::DIG {
+                let effective = policy.resolve(self.freq.hz);
+                if effective != self.applied_primary_mode {
+                    let dsps = self.pipeline.channel_dsps.read().unwrap();
+                    if let Some(dsp_arc) = dsps.get(self.primary_channel_idx) {
+                        let mut dsp = dsp_arc.lock().unwrap();
+                        dsp.set_mode(&effective);
+                        dsp.set_filter(self.bandwidth_hz);
+                    }
+                    self.applied_primary_mode = effective;
+                }
+            }
+            Ok(())
+        })
+    }
+
    fn set_wfm_stereo<'a>(
        &'a mut self,
        enabled: bool,
@@ -1049,6 +1123,7 @@ impl RigSdr for SoapySdrRig {
            sdr_squelch_threshold_db: Some(self.squelch_threshold_db as f64),
            sdr_nb_enabled: Some(self.nb_enabled),
            sdr_nb_threshold: Some(self.nb_threshold),
+            sdr_dig_sideband: Some(self.channel_manager.dig_policy()),
            wfm_deemphasis_us: self.wfm_deemphasis_us,
            wfm_stereo: self.wfm_stereo,
            wfm_stereo_detected,
@@ -22,12 +22,12 @@
 //! updates every `ChannelDsp` in place and pauses out-of-span channels instead
 //! of destroying them.

-use std::sync::atomic::{AtomicI64, Ordering};
+use std::sync::atomic::{AtomicI64, AtomicU8, Ordering};
 use std::sync::{Arc, RwLock};

 use num_complex::Complex;
 use tokio::sync::broadcast;
-use trx_core::rig::state::{RigMode, VchanRdsEntry};
+use trx_core::rig::state::{effective_demod_mode, DigSidebandPolicy, RigMode, VchanRdsEntry};
 use uuid::Uuid;

 use crate::dsp::SdrPipeline;
@@ -59,7 +59,12 @@ fn default_bandwidth_hz(mode: &RigMode) -> u32 {
 struct ManagedChannel {
    id: Uuid,
    freq_hz: u64,
+    /// Logical mode requested by the user (e.g. `DIG`), shown in listings.
    mode: RigMode,
+    /// Concrete demod mode last pushed to the DSP. For `DIG` this is the
+    /// resolved USB/LSB; tracked so a frequency change only rebuilds the
+    /// demodulator when the resolved sideband actually flips.
+    applied_mode: RigMode,
    /// `broadcast::Sender` kept alive so new subscribers can join at any time.
    pcm_tx: broadcast::Sender<Vec<f32>>,
    /// IQ tap sender (kept alive; external consumers may subscribe).
@@ -91,6 +96,9 @@ pub struct SdrVirtualChannelManager {
    channels: RwLock<Vec<ManagedChannel>>,
    /// Fires whenever a channel is explicitly destroyed.
    destroyed_tx: broadcast::Sender<Uuid>,
+    /// Shared DIG-sideband policy ([`DigSidebandPolicy`] encoded via `to_u8`).
+    /// Read when resolving any DIG channel's demodulator.
+    dig_sideband: AtomicU8,
 }

 impl SdrVirtualChannelManager {
@@ -100,7 +108,12 @@ impl SdrVirtualChannelManager {
    /// - `fixed_slot_count`: number of fixed pipeline slots (primary + AIS),
    ///   i.e. the index of the first slot available for virtual channels.
    /// - `max_total`: maximum total channels including primary (e.g. 4).
-    pub fn new(pipeline: Arc<SdrPipeline>, fixed_slot_count: usize, max_total: usize) -> Self {
+    pub fn new(
+        pipeline: Arc<SdrPipeline>,
+        fixed_slot_count: usize,
+        max_total: usize,
+        dig_sideband: DigSidebandPolicy,
+    ) -> Self {
        // Seed the channel list with a synthetic primary-channel entry.
        // We use the first PCM sender from the pipeline (index 0).
        let primary_pcm_tx = pipeline
@@ -118,6 +131,7 @@ impl SdrVirtualChannelManager {
            id: Uuid::new_v4(),
            freq_hz: 0, // actual freq kept by SoapySdrRig; manager treats ch-0 as opaque
            mode: RigMode::USB,
+            applied_mode: RigMode::USB,
            pcm_tx: primary_pcm_tx,
            iq_tx: primary_iq_tx,
            pipeline_slot: 0,
@@ -134,6 +148,7 @@ impl SdrVirtualChannelManager {
            max_total: max_total.max(1),
            channels: RwLock::new(vec![primary]),
            destroyed_tx,
+            dig_sideband: AtomicU8::new(dig_sideband.to_u8()),
        }
    }

@@ -141,6 +156,36 @@ impl SdrVirtualChannelManager {
        self.destroyed_tx.clone()
    }

+    /// Current shared DIG-sideband policy.
+    pub fn dig_policy(&self) -> DigSidebandPolicy {
+        DigSidebandPolicy::from_u8(self.dig_sideband.load(Ordering::Relaxed))
+    }
+
+    /// Update the shared DIG-sideband policy and re-resolve every DIG virtual
+    /// channel's demodulator (the primary channel is handled by `SoapySdrRig`).
+    pub fn set_dig_policy(&self, policy: DigSidebandPolicy) {
+        self.dig_sideband.store(policy.to_u8(), Ordering::Relaxed);
+        let mut channels = self.channels.write().unwrap();
+        let dsps = self.pipeline.channel_dsps.read().unwrap();
+        for ch in channels
+            .iter_mut()
+            .filter(|c| !c.permanent && c.mode == RigMode::DIG)
+        {
+            let effective = policy.resolve(ch.freq_hz);
+            if effective != ch.applied_mode {
+                ch.applied_mode = effective.clone();
+                if let Some(dsp_arc) = dsps.get(ch.pipeline_slot) {
+                    dsp_arc.lock().unwrap().set_mode(&effective);
+                }
+            }
+        }
+    }
+
+    /// Resolve a channel's effective demod mode under the current policy.
+    fn resolve_mode(&self, logical: &RigMode, freq_hz: u64) -> RigMode {
+        effective_demod_mode(logical, self.dig_policy(), freq_hz)
+    }
+
    fn half_span_hz(&self) -> i64 {
        i64::from(self.pipeline.sdr_sample_rate) / 2
    }
@@ -172,10 +217,13 @@ impl SdrVirtualChannelManager {
            });
        }

+        // Bandwidth follows the logical mode; the DSP demodulator follows the
+        // resolved sideband (DIG → USB/LSB by policy + frequency).
        let bandwidth_hz = default_bandwidth_hz(mode);
-        let (pcm_tx, iq_tx) = self
-            .pipeline
-            .add_virtual_channel(if_hz as f64, mode, bandwidth_hz);
+        let applied_mode = self.resolve_mode(mode, freq_hz);
+        let (pcm_tx, iq_tx) =
+            self.pipeline
+                .add_virtual_channel(if_hz as f64, &applied_mode, bandwidth_hz);

        let pipeline_slot = self
            .pipeline
@@ -190,6 +238,7 @@ impl SdrVirtualChannelManager {
            id,
            freq_hz,
            mode: mode.clone(),
+            applied_mode,
            pcm_tx,
            iq_tx,
            pipeline_slot,
@@ -314,9 +363,18 @@ impl VirtualChannelManager for SdrVirtualChannelManager {
            .ok_or(VChanError::NotFound)?;

        ch.freq_hz = freq_hz;
+        // A DIG/Auto channel flips sideband across the 10 MHz boundary; rebuild
+        // the demodulator only when the resolved sideband actually changes.
+        let effective = self.resolve_mode(&ch.mode, freq_hz);
+        let mode_changed = effective != ch.applied_mode;
+        ch.applied_mode = effective.clone();
        let dsps = self.pipeline.channel_dsps.read().unwrap();
        if let Some(dsp_arc) = dsps.get(ch.pipeline_slot) {
-            dsp_arc.lock().unwrap().set_channel_if_hz(if_hz as f64);
+            let mut dsp = dsp_arc.lock().unwrap();
+            dsp.set_channel_if_hz(if_hz as f64);
+            if mode_changed {
+                dsp.set_mode(&effective);
+            }
        }
        Ok(())
    }
@@ -329,9 +387,11 @@ impl VirtualChannelManager for SdrVirtualChannelManager {
            .ok_or(VChanError::NotFound)?;

        ch.mode = mode.clone();
+        let effective = self.resolve_mode(mode, ch.freq_hz);
+        ch.applied_mode = effective.clone();
        let dsps = self.pipeline.channel_dsps.read().unwrap();
        if let Some(dsp_arc) = dsps.get(ch.pipeline_slot) {
-            dsp_arc.lock().unwrap().set_mode(mode);
+            dsp_arc.lock().unwrap().set_mode(&effective);
        }
        Ok(())
    }
@@ -425,6 +485,7 @@ impl VirtualChannelManager for SdrVirtualChannelManager {
 #[cfg(test)]
 mod tests {
    use super::*;
+    use crate::demod::Demodulator;
    use crate::dsp::{MockIqSource, NoiseBlankerConfig, SdrPipeline};

    fn make_pipeline() -> Arc<SdrPipeline> {
@@ -446,7 +507,7 @@ mod tests {
    #[test]
    fn add_and_list() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 4);
+        let mgr = SdrVirtualChannelManager::new(p, 1, 4, DigSidebandPolicy::Auto);
        // Set center to 14.1 MHz so that 14.074 MHz is within ±960 kHz.
        mgr.update_center_hz(14_100_000);
        assert_eq!(mgr.channels().len(), 1); // primary only
@@ -462,7 +523,7 @@ mod tests {
    #[test]
    fn remove_virtual_channel() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 4);
+        let mgr = SdrVirtualChannelManager::new(p, 1, 4, DigSidebandPolicy::Auto);
        mgr.update_center_hz(14_100_000);
        let (id, _) = mgr.add_channel(14_074_000, &RigMode::USB).unwrap();
        mgr.remove_channel(id).unwrap();
@@ -472,7 +533,7 @@ mod tests {
    #[test]
    fn cannot_remove_primary() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 4);
+        let mgr = SdrVirtualChannelManager::new(p, 1, 4, DigSidebandPolicy::Auto);
        let primary_id = mgr.channels()[0].id;
        let err = mgr.remove_channel(primary_id).unwrap_err();
        assert!(matches!(err, VChanError::Permanent));
@@ -481,7 +542,7 @@ mod tests {
    #[test]
    fn cap_enforced() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 2); // primary + 1 virtual max
+        let mgr = SdrVirtualChannelManager::new(p, 1, 2, DigSidebandPolicy::Auto); // primary + 1 virtual max
        mgr.update_center_hz(14_100_000);
        mgr.add_channel(14_074_000, &RigMode::USB).unwrap();
        let err = mgr.add_channel(14_075_000, &RigMode::USB).unwrap_err();
@@ -491,7 +552,7 @@ mod tests {
    #[test]
    fn out_of_bandwidth() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 4);
+        let mgr = SdrVirtualChannelManager::new(p, 1, 4, DigSidebandPolicy::Auto);
        // center_hz = 0, half_span = 960_000 Hz — 10 MHz is way out
        let err = mgr.add_channel(10_000_000, &RigMode::USB).unwrap_err();
        assert!(matches!(err, VChanError::OutOfBandwidth { .. }));
@@ -500,7 +561,7 @@ mod tests {
    #[test]
    fn hidden_background_channels_are_outside_visible_cap() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 2); // primary + 1 visible max
+        let mgr = SdrVirtualChannelManager::new(p, 1, 2, DigSidebandPolicy::Auto); // primary + 1 visible max
        mgr.update_center_hz(14_100_000);

        mgr.add_channel(14_074_000, &RigMode::USB).unwrap();
@@ -513,10 +574,46 @@ mod tests {
        assert!(visible.iter().all(|channel| channel.id != hidden_id));
    }

+    #[test]
+    fn dig_channel_resolves_sideband_and_tracks_policy() {
+        let p = make_pipeline();
+        let mgr = SdrVirtualChannelManager::new(p.clone(), 1, 6, DigSidebandPolicy::Auto);
+        mgr.update_center_hz(7_100_000);
+
+        // The virtual channel occupies pipeline slot 1 (slot 0 is the primary).
+        let demod_at_slot1 = || {
+            p.channel_dsps.read().unwrap()[1]
+                .lock()
+                .unwrap()
+                .demodulator
+                .clone()
+        };
+
+        // DIG below 10 MHz under Auto → lower sideband.
+        let (_id, _rx) = mgr.add_channel(7_074_000, &RigMode::DIG).unwrap();
+        assert_eq!(demod_at_slot1(), Demodulator::Lsb);
+
+        // Forcing USB re-resolves the live channel.
+        mgr.set_dig_policy(DigSidebandPolicy::Usb);
+        assert_eq!(demod_at_slot1(), Demodulator::Usb);
+
+        // Back to Auto (still below 10 MHz) → lower sideband again.
+        mgr.set_dig_policy(DigSidebandPolicy::Auto);
+        assert_eq!(demod_at_slot1(), Demodulator::Lsb);
+
+        // The listing keeps the logical DIG mode for display.
+        let ch = mgr
+            .channels()
+            .into_iter()
+            .find(|c| !c.permanent)
+            .expect("virtual channel");
+        assert_eq!(ch.mode, "DIG");
+    }
+
    #[test]
    fn retune_keeps_virtual_channel_allocated() {
        let p = make_pipeline();
-        let mgr = SdrVirtualChannelManager::new(p, 1, 4);
+        let mgr = SdrVirtualChannelManager::new(p, 1, 4, DigSidebandPolicy::Auto);
        mgr.update_center_hz(14_100_000);
        let mut destroyed_rx = mgr.subscribe_destroyed();

@@ -118,6 +118,7 @@ sample_rate = 1920000
 bandwidth = 1500000
 wfm_deemphasis_us = 50
 center_offset_hz = 100000
+dig_sideband = "auto"
 channels = []
 max_virtual_channels = 4
 spectrum_fft_size = 1024
@@ -203,13 +204,16 @@ decode_history_retention_min = 1440

 [trx-client.frontends.http.decode_history_retention_min_by_rig]

-# Passphrase login for the web UI.  rx_passphrase_file and
-# control_passphrase_file keep the secrets out of this file.
+# Optional user/password ACL for the web UI. Administrators manage
+# accounts stored in users_file.
 [trx-client.frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-passphrase-example"
-control_passphrase = "control-passphrase-example"
-tx_access_control_enabled = true
+users_file = "trx-http-users.json"
+bootstrap_admin_username = "admin"
+bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false
 cookie_same_site = "Lax"
@@ -246,3 +250,7 @@ enabled = false
 bitrate_bps = 192000
 rx_gain = 1.0
 tx_gain = 1.0
+
+# Station log of contacts.  path defaults to logbook.jsonl in the user's
+# data directory; set it to keep the log on a backed-up volume.
+[trx-client.logbook]
Author	SHA1	Message	Date
sjgandClaude Opus 4.8	df7483fe30	[feat](trx-rs): configurable DIG sideband for SDR (auto/USB/LSB) CI / frontend (push) Successful in 5m41s Details CI / lint (push) Failing after 4s Details CI / test (push) Successful in 10m37s Details CI / reuse (push) Successful in 5s Details DIG has no inherent sideband; on the SDR backend it was always demodulated as USB. Make it resolve to USB or LSB via a policy that defaults to the amateur SSB/data convention (USB at/above 10 MHz, LSB below) and can be overridden globally from the advanced radio controls or per-bookmark. Design: the logical DIG mode is kept in RigState (display, decoder gating) while the SDR pipeline is handed a concrete USB/LSB demodulator resolved from (policy, dial frequency). Resolution happens at the boundary — the rig for the primary channel and the virtual-channel manager for vchans — so the hot DSP/demod path is untouched. The resolved sideband is only re-pushed when it actually changes (e.g. tuning DIG/Auto across 10 MHz), keeping ordinary tuning glitch-free. Core/protocol: - New `DigSidebandPolicy { Auto, Usb, Lsb }` with `resolve(freq)` and an `effective_demod_mode()` helper (trx-core), re-exported at the crate root. - `RigCommand::SetSdrDigSideband`, `RigSdr::set_sdr_dig_sideband`, and a `RigFilterState.sdr_dig_sideband` field for state sync; wired through the ClientCommand mapping. Config: `[rig.sdr] dig_sideband = "auto"` (regenerated trx-rs.toml.example). SDR backend: the vchan manager owns the shared policy (atomic); the rig applies it to the primary channel and, on `set_sdr_dig_sideband`, re-resolves all DIG virtual channels. Frontend: a mode-gated "DIG sideband" selector in the SDR advanced controls (POST /set_sdr_dig_sideband), reflecting server state; bookmarks gain an optional `dig_sideband` field (form selector shown only for DIG) that, on apply, sets the global policy before switching to DIG. The scheduler honours it for automated bookmark activation too. Tests: policy resolution / effective-mode / u8+parse round-trips (trx-core); a vchan integration test asserting a DIG channel resolves to LSB below 10 MHz, flips with the policy, and still lists as DIG. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UiK871ht2uPFBHtMbxy3wD Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-16 00:26:45 +02:00
sjgandClaude Opus 4.8	fe3b414fba	[fix](trx-wefax): stop fragmenting one transmission into many images The WEFAX decoder decoded content but chopped a single chart into many short PNG "chunks". Two heuristics fought each other: in State::Receiving the carrier-loss watchdog finalized the image after only 30 low-correlation scan lines (~15 s at 120 LPM), and the Idle variance auto-start then re-triggered on the still-present carrier ~3 s later, starting a fresh image. Ordinary HF fading (QSB) of 5-20 s therefore split every chart into a stream of tiny images. Reference decoders (fldigi) keep one continuous image per APT cycle up to a large line cap and only stop on the APT stop tone or genuine signal loss. Align with that model: - Raise the end-of-transmission watchdog to 120 low-correlation lines (~60 s at 120 LPM) so normal fades ride through within one image. - Gate the variance-based auto-start to fire at most once per session (auto_start_used). After the first image a new one starts only on an APT start tone or an explicit reset, so trailing carrier/noise can no longer spawn a second image. reset() re-arms it. - Cap a single image at 3000 lines to bound memory on an open carrier. - Require a 2 s (was 1 s) APT tone sustain, cutting false Stop detections on busy image content that momentarily hits ~450 transitions/s. Also make line slicing drift-free: 120 LPM at 11025 Hz is 5512.5 samples per line, and slicing on the rounded integer accumulated a fractional-sample error every line (slow horizontal slant). Boundaries are now derived from the exact fractional line length (samples_per_line_f64) so the error never accumulates. Adds regression tests for the single-auto-start invariant and zero slicer drift over 1000 lines. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UiK871ht2uPFBHtMbxy3wD Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-15 23:35:09 +02:00
sjg	1829e3d17b	[fix](trx-frontend-http): make Guest role composable CI / lint (pull_request) Successful in 2m25s Details CI / test (pull_request) Successful in 9m16s Details CI / frontend (pull_request) Successful in 5m22s Details CI / reuse (pull_request) Successful in 6s Details CI / lint (push) Successful in 2m23s Details CI / test (push) Successful in 8m11s Details CI / frontend (push) Successful in 4m24s Details CI / reuse (push) Successful in 4s Details	2026-08-13 02:16:59 +02:00
sjg	b037225a05	[fix](trx-frontend-http): block Guest password changes CI / lint (pull_request) Successful in 2m25s Details CI / test (pull_request) Successful in 9m5s Details CI / frontend (pull_request) Successful in 5m23s Details CI / reuse (pull_request) Successful in 5s Details CI / lint (push) Successful in 2m24s Details CI / test (push) Successful in 9m11s Details CI / frontend (push) Successful in 5m22s Details CI / reuse (push) Successful in 5s Details	2026-08-11 22:47:55 +02:00
sjg	e978cf8a84	[feat](trx-frontend-http): separate transmit permission CI / frontend (pull_request) Successful in 5m21s Details CI / lint (pull_request) Successful in 2m24s Details CI / test (pull_request) Successful in 9m11s Details CI / test (push) Successful in 8m16s Details CI / frontend (push) Successful in 4m24s Details CI / reuse (push) Successful in 5s Details CI / reuse (pull_request) Successful in 5s Details CI / lint (push) Successful in 2m25s Details Assisted-By: Codex (GPT-5) Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-11 18:36:33 +02:00
sjg	44870bc941	[feat](trx-frontend-http): add restricted Guest role CI / lint (pull_request) Successful in 2m24s Details CI / test (pull_request) Successful in 8m16s Details CI / frontend (pull_request) Successful in 4m17s Details CI / reuse (pull_request) Successful in 5s Details Assisted-By: Codex (GPT-5) Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-11 16:04:51 +02:00
sjg	5e9dae02c7	Complete managed account lifecycle CI / test (push) Successful in 8m12s Details CI / frontend (push) Successful in 4m15s Details CI / reuse (push) Successful in 5s Details CI / lint (pull_request) Successful in 2m24s Details CI / test (pull_request) Successful in 9m6s Details CI / frontend (pull_request) Successful in 5m17s Details CI / reuse (pull_request) Successful in 5s Details CI / lint (push) Successful in 2m26s Details	2026-08-11 07:49:53 +02:00
sjg	34507ffa17	Add composable HTTP access roles CI / lint (pull_request) Successful in 2m24s Details CI / test (pull_request) Successful in 9m24s Details CI / frontend (pull_request) Successful in 5m12s Details CI / reuse (pull_request) Successful in 6s Details CI / lint (push) Successful in 2m24s Details CI / test (push) Successful in 8m8s Details CI / frontend (push) Successful in 4m15s Details CI / reuse (push) Successful in 5s Details	2026-08-11 01:06:57 +02:00
sjg	36c1e56efa	Protect the final administrator	2026-08-11 00:39:25 +02:00
sjg	e4cce9a004	Add Users settings tab	2026-08-11 00:37:59 +02:00
sjg	3c3fc69542	Refactor HTTP account system CI / frontend (pull_request) Successful in 5m13s Details CI / reuse (pull_request) Successful in 29s Details CI / frontend (push) Successful in 4m15s Details CI / reuse (push) Successful in 5s Details CI / lint (pull_request) Successful in 2m25s Details CI / test (pull_request) Successful in 9m24s Details CI / lint (push) Successful in 2m23s Details CI / test (push) Successful in 8m19s Details	2026-08-10 23:47:51 +02:00
sjgandClaude Opus 5	d539ff96e5	[docs](trx-rs): write down how a contest and a confirmation are worked CI / frontend (pull_request) Successful in 5m12s Details CI / reuse (pull_request) Successful in 5s Details CI / test (push) Successful in 8m0s Details CI / lint (pull_request) Successful in 2m22s Details CI / test (pull_request) Successful in 8m57s Details CI / lint (push) Successful in 2m32s Details CI / frontend (push) Successful in 4m13s Details CI / reuse (push) Successful in 6s Details The manual gains the contest exchange, the Cabrillo entry and the confirmations. The plan marks all five phases done, corrects the API paths to the /api/logbook they were built under -- /logbook is the page, and the bookmarks API already shadows its own page that way -- and records the two decisions phase 5 settled: that the Cabrillo header comes from the operator because no log can derive it, and that a confirmation counts from whichever bureau answered. The plan itself travels with this branch: it was written on a branch of its own that was never proposed for merge, and the earlier attempts to update it from the implementation branches were silent no-ops, because the edits did not assert that they had found what they were replacing. Refs #54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-07 21:31:06 +02:00
sjgandClaude Opus 5	ca5cd65c85	[docs](trx-rs): settle the logbook's remaining questions The clock is the server's, as asked: it is the machine at the radio, where the browser may be a phone in another timezone with a clock nobody checked. When the two disagree by more than a second the panel says so, rather than logging a time the operator did not expect. The rest, decided against how logging is actually done: One station log, not one per rig. DXCC, WAS and LoTW count the callsign, not the radio, and a station worked on the second rig is still worked. The rig goes on the QSO as MY_RIG. Station location does follow the rig, though — these rigs can be in different places, so MY_GRIDSQUARE comes from the one that made the contact, which is what LoTW's station locations expect too. The operator is a per-QSO field set once per session. ADIF separates the callsign used on the air from the person at the key, and multi-operator stations rotate people through one station callsign. It defaults from the configured callsign, so a single operator never touches it. It cannot come from the session: the auth roles are control and rx, with nobody's name on them. The log file is configurable, defaulting to the user's data directory. Bookmarks sit in the config directory because they are settings and decode logs in the cache directory because they are disposable; a QSO log is irreplaceable, and cache directories get swept. Import collisions match on callsign, band, mode and a two-minute window. Loggers rarely agree to the second on the same QSO — one stamps the contact, the other the entry — so an exact-minute key duplicates half of what it is asked to merge. Two minutes absorbs that without swallowing a legitimate re-work, since contest rules forbid a second contact on the same band and mode. Times compare as instants so midnight matches, and modes are normalised or an imported SSB would miss our USB. That normalisation is now written down: a rig mode is not an ADIF mode. DIG is the one the rig cannot answer — a rig in DIG is in FT8 or FT4 depending on what is decoding — and WSPR never opens an entry at all, because hearing a beacon is not a contact. Refs #54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-07 21:30:10 +02:00
sjgandClaude Opus 5	a9e1e86fdc	[docs](trx-rs): settle the logbook's panel, its prefill, and its formats Three answers from the issue, folded into the proposal. The logbook is a panel of its own rather than a strip on the radio page, and it stands in every layout: a log can be kept without adopting the ham layout, and read while another is selected. The ham layout is then the arrangement that starts from it, with the radio controls around it. Prefill is exactly six fields — frequency, mode, rig name, time, callsign and locator — and nothing else. A signal report in particular stays empty: an FT8 SNR is not what was sent, and prefilling one would put a number in the log that nobody exchanged. The station's own callsign and locator are not per-entry fields at all; they are station identity, shown once at the top of the panel and written into the QSO from configuration. The file format was left to me. ADIF stays, because it is not one option among several: LoTW, eQSL, Club Log, QRZ and every other logger read it and nothing else, so a log that cannot write it cannot be uploaded, confirmed or moved. Nothing on disk is ADI regardless — the store is JSON Lines. The second format is Cabrillo 3.0, which ADIF cannot replace: contest logs are submitted in it and rejected in anything else. It lands with the contest exchange fields, since without a serial or a zone it has nothing to write. Refs #54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-07 21:30:10 +02:00
sjgandClaude Opus 5	76e33a91bb	[docs](trx-rs): propose the logbook and the ham radio layout Issue #54 asks for a ham radio layout and an ADIF logbook, with no detail behind either. This is what they would be: what the logbook has to hold, how it is stored, where ADIF is read and written, and which of the existing parts each half hangs off. Two things it settles before any code is written. The log is append-only JSON Lines rather than the whole-file dump the bookmarks use, because a station with forty thousand QSOs would rewrite megabytes to log one contact and lose the lot if the power went mid-dump. And a decode is not a QSO: the decoders only ever heard something, so a decoded callsign pre-fills an entry and never writes one. The layout is a fifth entry in the operator layouts that already exist, gated on the rig being able to transmit. Refs #54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-07 21:30:10 +02:00
sjgandClaude Opus 5	ee185b98bc	[feat](trx-logbook): work a contest, and record what came back Phase 5 of the logbook: the exchange, the entry sponsors take, and the confirmations an award counts. Contest fields go on the contact — the contest, the serials both ways as numbers and as words, and the zones — because an exchange is not always a number: a zone, a section or a name goes in as written. The serial sent and the contest stay between contacts, since they belong to the session and not to the contact just logged, and the serial counts on by itself rather than being retyped forty times an hour. Cabrillo 3.0 is written because ADIF cannot do this job: sponsors take Cabrillo and reject everything else. Its shape is not ADIF's either — the frequency is kilohertz below 30 MHz and a band designator above it, the modes are CW, PH, FM, RY and DG, and the contacts go oldest first, as a contest log is read. The header cannot be derived from a log — how many operators, how much power, what the score is claimed to be — so it comes from the operator, with single-op, low power, all bands and mixed behind it. QSL, LoTW and eQSL states are held as ADIF's single letters, and anything else is refused rather than written: a log that grew states of its own would be one no other program could read. A contact is confirmed when any one of the three says so — an award wants a card or an electronic match, not one of each, and counting them separately would tell the operator they were short of what they have. The bands report counts contacts, distinct stations and confirmations per band, ordered by wavelength as a band plan reads. Closes #54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-07 21:28:40 +02:00
sjgandClaude Opus 5	18b2d0efe6	[feat](trx-rs): keep a station log, and a layout to work the bands from CI / lint (pull_request) Successful in 2m23s Details CI / frontend (pull_request) Successful in 5m52s Details CI / reuse (pull_request) Successful in 6s Details CI / test (pull_request) Successful in 9m12s Details The logbook of issue #54, in the shape the proposal settled on. A new crate, trx-logbook, holds the contact, the ADIF reader and writer, the file, and the rules for telling one contact from two. ADIF because it is the only thing the ecosystem reads: LoTW, eQSL, Club Log, QRZ and every other logger take it and nothing else, so a log that cannot write .adi cannot be uploaded, confirmed or moved. The reader is forgiving in the ways real files are irregular -- lowercase tags, CRLF, missing header, unknown fields, a declared length that is the only thing ending a value -- and carries what it does not model through to the export, so a round trip does not strip what another program wrote. The file is JSON Lines, appended one line per contact. A log is the one thing here that cannot be regenerated, and the bookmark store's whole-file dump would rewrite megabytes to log one contact and lose all of them if the power went halfway; an append costs the record being written and no more, which a test tears a line in half to prove. Edits append revisions, deletes append tombstones, and the file compacts when the superseded outnumber the live. The panel is its own tab and stands in every layout. An entry opens with six fields and no more -- frequency, mode, rig name, time, and the callsign and locator of whatever decode it was started from. A report stays empty: an FT8 SNR is not what was sent. Times come from the server, because the browser may be a phone in another timezone, and the panel says so when the two disagree by more than a second. Worked-before answers as a callsign is typed. A decode is not a contact, so the Log button on an FT8 or APRS row opens an entry and logs nothing by itself. The ham layout is the fifth operator layout, opening on the logbook with the radio controls around it, offered only where the rig can transmit. Two bugs found on the way, both in code written here: a frequency of a whole number of megahertz ending in a zero rendered as a tenth of itself, in Rust and in TypeScript alike, because trimming trailing zeros from "20.000000" walks back through the point. The API also sits under /api/logbook rather than /logbook, so it cannot shadow its own page the way /bookmarks does. Closes #54 Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SyX26FCpMQxiBoC7r5K1A7 Signed-off-by: Stan Grams <sjg@haxx.space>	2026-08-07 21:12:03 +02:00