[feat](trx-frontend-http): add restricted Guest role

Assisted-By: Codex (GPT-5) Signed-off-by: Stan Grams <sjg@haxx.space>
Complete managed account lifecycle
2026-08-11 16:04:51 +02:00 · 2026-08-11 07:49:53 +02:00 · 2026-08-11 01:06:57 +02:00 · 2026-08-11 00:39:25 +02:00 · 2026-08-11 00:37:59 +02:00 · 2026-08-10 23:47:51 +02:00
75 changed files with 9383 additions and 1012 deletions
@@ -56,6 +56,7 @@ src/
      trx-backend-ft450d/   # Yaesu FT-450D ASCII CAT
      trx-backend-soapysdr/ # SoapySDR RX with full DSP pipeline (~5,000+ LOC)
  trx-client/         # Client binary: remote connection, frontend spawning (~1,500 LOC)
+    trx-logbook/      # Station log: QSO record, ADIF reader/writer, append-only store
    trx-frontend/     # Frontend trait (FrontendSpawner), runtime context
      trx-frontend-http/      # Web UI: REST API, SSE, WebSocket audio, session auth
      trx-frontend-http-json/ # JSON-over-TCP control frontend
@@ -316,6 +316,18 @@ version = "1.0.102"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"

+[[package]]
+name = "argon2"
+version = "0.5.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+dependencies = [
+ "base64ct",
+ "blake2",
+ "cpufeatures 0.2.17",
+ "password-hash",
+]
+
 [[package]]
 name = "atomic-waker"
 version = "1.1.2"
@@ -345,6 +357,12 @@ version = "0.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

+[[package]]
+name = "base64ct"
+version = "1.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2af50177e190e07a26ab74f8b1efbfe2ef87da2116221318cb1c2e82baf7de06"
+
 [[package]]
 name = "bindgen"
 version = "0.66.1"
@@ -395,6 +413,24 @@ version = "2.11.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"

+[[package]]
+name = "blake2"
+version = "0.10.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+dependencies = [
+ "digest 0.10.7",
+]
+
+[[package]]
+name = "block-buffer"
+version = "0.10.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"
+dependencies = [
+ "generic-array",
+]
+
 [[package]]
 name = "block-buffer"
 version = "0.12.0"
@@ -525,7 +561,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6f8d983286843e49675a4b7a2d174efe136dc93a18d69130dd18198a6c167601"
 dependencies = [
 "cfg-if",
- "cpufeatures",
+ "cpufeatures 0.3.0",
 "rand_core 0.10.1",
 ]

@@ -721,6 +757,15 @@ dependencies = [
 "windows",
 ]

+[[package]]
+name = "cpufeatures"
+version = "0.2.17"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "cpufeatures"
 version = "0.3.0"
@@ -739,6 +784,16 @@ dependencies = [
 "cfg-if",
 ]

+[[package]]
+name = "crypto-common"
+version = "0.1.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"
+dependencies = [
+ "generic-array",
+ "typenum",
+]
+
 [[package]]
 name = "crypto-common"
 version = "0.2.1"
@@ -799,15 +854,26 @@ dependencies = [
 "zeroize",
 ]

+[[package]]
+name = "digest"
+version = "0.10.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
+dependencies = [
+ "block-buffer 0.10.4",
+ "crypto-common 0.1.7",
+ "subtle",
+]
+
 [[package]]
 name = "digest"
 version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4850db49bf08e663084f7fb5c87d202ef91a3907271aff24a94eb97ff039153c"
 dependencies = [
- "block-buffer",
+ "block-buffer 0.12.0",
 "const-oid",
- "crypto-common",
+ "crypto-common 0.2.1",
 ]

 [[package]]
@@ -1019,6 +1085,16 @@ dependencies = [
 "slab",
 ]

+[[package]]
+name = "generic-array"
+version = "0.14.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85649ca51fd72272d7821adaf274ad91c288277713d9c18820d8499a7ff69e9a"
+dependencies = [
+ "typenum",
+ "version_check",
+]
+
 [[package]]
 name = "getrandom"
 version = "0.2.17"
@@ -1890,6 +1966,17 @@ dependencies = [
 "windows-link",
 ]

+[[package]]
+name = "password-hash"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+dependencies = [
+ "base64ct",
+ "rand_core 0.6.4",
+ "subtle",
+]
+
 [[package]]
 name = "peeking_take_while"
 version = "0.1.2"
@@ -2492,8 +2579,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "aacc4cc499359472b4abe1bf11d0b12e688af9a805fa5e3016f9a386dc2d0214"
 dependencies = [
 "cfg-if",
- "cpufeatures",
- "digest",
+ "cpufeatures 0.3.0",
+ "digest 0.11.2",
 ]

 [[package]]
@@ -3215,9 +3302,11 @@ version = "0.1.0"
 dependencies = [
 "actix-web",
 "actix-ws",
+ "argon2",
 "base64",
 "brotli 7.0.0",
 "bytes",
+ "chrono",
 "dirs",
 "flate2",
 "futures-util",
@@ -3226,11 +3315,13 @@ dependencies = [
 "rand 0.8.6",
 "serde",
 "serde_json",
+ "tempfile",
 "tokio",
 "tokio-stream",
 "tracing",
 "trx-core",
 "trx-frontend",
+ "trx-logbook",
 "trx-protocol",
 "ts-rs",
 "uuid",
@@ -3269,6 +3360,19 @@ dependencies = [
 "rustfft",
 ]

+[[package]]
+name = "trx-logbook"
+version = "0.1.0"
+dependencies = [
+ "chrono",
+ "dirs",
+ "serde",
+ "serde_json",
+ "tempfile",
+ "tracing",
+ "uuid",
+]
+
 [[package]]
 name = "trx-protocol"
 version = "0.1.0"
@@ -26,6 +26,7 @@ members = [
    "src/trx-server/trx-backend/trx-backend-ft450d",
    "src/trx-server/trx-backend/trx-backend-soapysdr",
    "src/trx-client",
+    "src/trx-client/trx-logbook",
    "src/trx-client/trx-frontend",
    "src/trx-client/trx-frontend/trx-frontend-http",
    "src/trx-client/trx-frontend/trx-frontend-http-json",
@@ -925,9 +925,13 @@ main

 ### HTTP Frontend Auth

- Optional token or HTTP Basic Auth middleware
- Configured in `[frontends.http.auth]`
- Rate limiting supported
+- Optional Argon2id-backed managed accounts with HttpOnly session cookies
+- An exclusive Guest role plus composable Read, Control, Write, and Administrator roles, with policy shared by middleware and handlers
+- Guest sessions receive read-only station access but no account-control endpoints or panels
+- Atomic JSON persistence with migration from the legacy single-role schema
+- Account enable/disable, administrator CRUD, self-service password changes, and session revocation on security changes
+- A database invariant always preserves at least one enabled administrator
+- Per-IP login rate limiting; configured in `[frontends.http.auth]`

 ### Transport Security

@@ -1043,7 +1047,7 @@ The `FrontendRuntimeContext` struct in `trx-frontend/src/lib.rs` is decomposed i
 |-----------|---------|------------|
 | `AudioContext` | Audio streaming channels | `rx`, `tx`, `info`, `decode_rx`, `clients` |
 | `DecodeHistoryContext` | Decode history for all types | `ais`, `vdes`, `aprs`, `hf_aprs`, `cw`, `ft8`, `ft4`, `ft2`, `wspr` |
-| `HttpAuthConfig` | HTTP auth settings | `enabled`, `rx_passphrase`, `session_ttl_secs`, `tokens` |
+| `HttpAuthConfig` | HTTP auth settings | `enabled`, `users_file`, bootstrap admin/read accounts, `session_ttl_secs`, `tokens` |
 | `HttpUiConfig` | HTTP UI display config | `show_sdr_gain_control`, `initial_map_zoom`, `spectrum_*` |
 | `RigRoutingContext` | Remote rig state & routing | `active_rig_id`, `remote_rigs`, `rig_states`, `server_connected` |
 | `OwnerInfo` | Station metadata | `callsign`, `website_url`, `ais_vessel_url_base` |
@@ -322,3 +322,269 @@ trx-configurator
 | `trx-app` | Config types and validation | Yes |
 | `serialport` | Serial port enumeration | Yes (transitive) |
 | `soapysdr` | SDR device enumeration (optional) | Yes (feature-gated) |
+
+---
+
+## Logbook and Ham Radio Layout
+
+Two halves of one feature ([#54](https://git.haxx.space/sjg/trx-rs/issues/54)): a station
+logbook in a panel of its own, and an operator layout that puts a transceiver's controls
+around it.
+
+Nothing in the application records a QSO today. The map's "QSO summary" cards describe
+contacts *between other stations*, reconstructed from decoded traffic; bookmarks are
+frequencies, not contacts. Neither is the operator's own log.
+
+### Requirements
+
+| ID | Description |
+|----|-------------|
+| REQ-LOG-001 | The system shall record QSOs the operator makes, each holding at minimum callsign, date, time, band, frequency, mode and both signal reports. |
+| REQ-LOG-002 | When starting a log entry, the system shall pre-fill exactly six fields: frequency, mode, rig name, time, callsign and locator. |
+| REQ-LOG-003 | The system shall leave every other field of a log entry empty for the operator to fill. |
+| REQ-LOG-004 | The system shall allow a logged QSO to be edited and deleted. |
+| REQ-LOG-005 | The system shall survive a crash without losing a QSO that was recorded before it. |
+| REQ-LOG-006 | The system shall list, search and filter the log by callsign, band, mode and date range. |
+| REQ-LOG-007 | Where a decoded station is on screen, the system shall offer to start a log entry from it, pre-filled, without logging it unattended. |
+| REQ-LOG-008 | The system shall show whether a callsign has been worked before, and on which bands. |
+| REQ-FMT-001 | The system shall export the log as an ADIF 3.1.x `.adi` file. |
+| REQ-FMT-002 | The system shall import ADIF `.adi` files produced by other logging software, preserving fields it does not itself use. |
+| REQ-FMT-003 | When importing, the system shall identify QSOs already held and shall not duplicate them. |
+| REQ-FMT-004 | The system shall export a filtered selection of the log as a Cabrillo 3.0 file for contest submission. |
+| REQ-LOG-009 | The system shall stamp QSO times from the server's clock in UTC, and shall tell the operator when the browser's clock disagrees with it by more than one second. |
+| REQ-LAY-001 | The system shall present the logbook in a panel of its own, reachable whatever layout is selected. |
+| REQ-LAY-002 | The system shall offer a "Ham radio" operator layout presenting the transceiver controls and that panel together. |
+| REQ-LAY-003 | Where the selected rig cannot transmit, the system shall not offer the ham layout. |
+
+### A decode is not a QSO
+
+The decoders are receive-only: FT8, CW, APRS and the rest report what was *heard*. A heard
+callsign is the beginning of a log entry, not a contact, and the logbook must never write one
+by itself — REQ-LOG-007 says offer and pre-fill, never auto-log. Digital QSOs made in
+WSJT-X or similar arrive the way every other logger takes them: through ADIF import.
+
+### What is pre-filled, and what is not
+
+Six fields, and no more (REQ-LOG-002, REQ-LOG-003):
+
+| Field | From | ADIF |
+|-------|------|------|
+| Frequency | the selected rig's dial | `FREQ`, with `BAND` derived from it |
+| Mode | the selected rig | `MODE`, and `SUBMODE` where the mode implies one |
+| Rig name | the rig's display name | `MY_RIG` |
+| Time | the server's clock, UTC, when the entry opens | `QSO_DATE`, `TIME_ON` |
+| Callsign | the decode row or map station the entry was started from, else empty | `CALL` |
+| Locator | that station's grid, where the decode carried one, else empty | `GRIDSQUARE` |
+
+Signal reports, power, name, QTH and the rest stay empty. A report in particular is the
+operator's to give: an FT8 SNR is not what was sent, and pre-filling one would put a number in
+the log that nobody exchanged.
+
+The station's own callsign and locator are not pre-filled per entry either — they are station
+identity, taken from configuration when the QSO is written (`STATION_CALLSIGN`, `OPERATOR`,
+`MY_GRIDSQUARE`), and shown once at the top of the panel rather than typed into every row.
+
+### Architecture
+
+#### New crate: `trx-logbook`
+
+```
+src/trx-client/
+  trx-logbook/
+    src/
+      lib.rs        # LogbookHandle: open, add, edit, delete, query, import, export
+      qso.rs        # Qso: the record, its ADIF field mapping, band/mode helpers
+      adif.rs       # ADI reader and writer (pure Rust, no new dependencies)
+      store.rs      # Append-only JSON Lines file, in-memory index, compaction
+      dedupe.rs     # Worked-before and import-collision rules
+```
+
+A library crate under `src/trx-client/`, beside `trx-frontend`, consumed by
+`trx-frontend-http`. The log belongs to the station rather than to a rig or a frontend, so it
+sits where any frontend can reach it.
+
+#### Storage: append-only, not a rewritten blob
+
+Bookmarks use `PickleDb` with `AutoDump`, which rewrites the whole file on every write. That
+is right for a few dozen bookmarks and wrong for a log: a station with 40 000 QSOs would
+rewrite several megabytes to log one contact, and lose the lot if the power went during the
+dump.
+
+The log is instead a JSON Lines file — the shape `trx-decode-log` already uses — appended one
+record per write and read into an in-memory index at startup. An edit or a delete appends a new revision of that record's id; the load
+keeps the last one, and a compaction pass rewrites the file when superseded records exceed a
+threshold. Appending is O(1) and atomic per line, so a crash costs at most the line being
+written.
+
+#### Two formats, for the two things a log is asked for
+
+The file formats were left open ("pick a well-known ham format"), so: **ADIF for interchange,
+Cabrillo for contest submission.** Both are implemented in-repo, in the way this project
+already implements its decoders, and neither adds a dependency.
+
+**ADIF has to stay.** It is not one option among several — it is the only thing the ecosystem
+reads. LoTW, eQSL, Club Log, QRZ.com and every other logger take ADIF and nothing else, so a
+log that cannot write `.adi` cannot be uploaded, confirmed, or moved to another program. That
+is a one-way door, and the interoperability is most of the point of keeping a log at all.
+Nothing on disk is ADI regardless: the store is JSON Lines, and ADIF is what comes out of an
+export.
+
+ADI is a tagged text format — `<FIELD:length>value`, records ended by `<EOR>`, a header ended
+by `<EOH>`, everything outside a tag ignored — small enough to implement exactly. The reader
+must be lenient in the ways real files are irregular (lowercase tags, CRLF, missing header,
+unknown fields, type indicators) and the writer strict. Unknown fields are carried through
+import to export unchanged, so a round trip through trx-rs does not quietly strip what another
+logger wrote. ADX, the XML serialisation of the same data model, is out of scope: it is part
+of the standard but almost nothing reads it.
+
+**Cabrillo is the second format, because ADIF cannot do its job.** Contest logs are submitted
+to sponsors in Cabrillo 3.0 and are rejected in anything else — a header of `CALLSIGN:`,
+`CONTEST:`, `CATEGORY-*` and `CLAIMED-SCORE:` lines, then one fixed-column `QSO:` line per
+contact carrying frequency in kHz, a mode code (`CW`, `PH`, `FM`, `RY`, `DG`), the UTC date and
+time, and both stations' calls, reports and exchanges. It is export-only and drops everything
+outside the contest's exchange, which is why it complements ADIF rather than replacing it.
+It arrives with the contest exchange fields in phase 5, since without a serial or a zone to
+put in the exchange there is nothing for it to write.
+
+#### Integration points
+
+| Source | What it gives the log | How |
+|--------|----------------------|-----|
+| `RigState` | `FREQ`, `BAND`, `MODE`/`SUBMODE`, and the rig id a QSO was made on | watch channel already in the frontend context |
+| Client config `general.callsign` | `STATION_CALLSIGN`, and the default `OPERATOR` | already surfaced as `owner_callsign` in frontend meta |
+| The QSO's own rig, and its position | `MY_GRIDSQUARE` | per-rig latitude and longitude already carried in the rig list |
+| Server clock | `QSO_DATE`, `TIME_ON` in UTC | new `GET /api/logbook/now`, which also feeds the browser-clock check |
+| Decoder panels and map | a pre-filled entry: callsign, grid, and the report to offer | existing decode history; no new plumbing |
+| `bandForHz` | `BAND` from a frequency | exists in `map-core.ts`; move to a shared module |
+
+#### HTTP API
+
+Under `/api/logbook`, as the recorder's endpoints are, because `/logbook` itself is the page:
+the `/bookmarks` API and the bookmarks page already share a path, and whichever is registered
+first wins.
+
+| Method | Path | Purpose |
+|--------|------|---------|
+| `GET` | `/api/logbook` | Query: filters, paging |
+| `POST` | `/api/logbook` | Add a QSO |
+| `PUT` | `/api/logbook/{id}` | Edit |
+| `DELETE` | `/api/logbook/{id}` | Delete |
+| `GET` | `/api/logbook/export.adi` | ADIF export, honouring the current filter |
+| `GET` | `/api/logbook/export.cbr` | Cabrillo export of a contest selection |
+| `POST` | `/api/logbook/import` | Import, answering with counts: added, duplicate, rejected |
+| `GET` | `/api/logbook/worked/{call}` | Worked-before: bands and modes |
+| `GET` | `/api/logbook/statistics` | Contacts, stations and confirmations, per band |
+| `GET` | `/api/logbook/now` | The server's UTC clock, for checking the browser's |
+| `GET` | `/api/logbook/prefill` | The six fields an entry opens with |
+
+Writes require the admin role, as the rig endpoints do.
+
+### Frontend
+
+The logbook is **its own panel**, not a strip bolted to the radio page: a `logbook` entry in
+the tab order beside Bookmarks, holding the entry form, the table with the filters of
+REQ-LOG-006, and import and export. It stands on its own in every layout, so a log can be kept
+without adopting the ham layout, and read while another layout is selected (REQ-LAY-001).
+
+The panel is three parts: the station line at the top (own callsign, locator, the rig a QSO
+would be logged against), the entry form beneath it opening with the six pre-filled fields,
+and the log itself under that, filtered as REQ-LOG-006 asks. Worked-before shows against
+the callsign as it is typed.
+
+The **ham layout** is a fifth entry in the operator layouts (`compact`, `broadcast`, `digital`,
+`full`), which already gate on capability, seed the disclosure sections and persist per rig:
+
+```ts
+ham: {
+  label: "Ham radio",
+  unavailable: "Ham radio needs a rig that can transmit",
+  advanced: true, audio: true, scheduler: false,
+  preferredTab: "logbook", capability: "ham",
+}
+```
+
+with the `ham` capability set from `RigCapabilities.tx`. It keeps frequency, VFO, mode, filter,
+PTT, power and the meters, and hides the broadcast furniture. What it adds over `full` is where
+it starts: the logbook panel, with the radio controls a keystroke away rather than the other
+way round — the layout an operator working the bands wants, where logging the contact is the
+task and the rig is the instrument.
+
+### Phases
+
+All five are implemented.
+
+| Phase | Lands |
+|-------|-------|
+| 1 | `trx-logbook`: `Qso`, the ADI reader and writer, round-trip tests against files from other loggers |
+| 2 | Store, dedupe, and the HTTP API behind the admin role |
+| 3 | Logbook tab: entry, table, filters, import, export |
+| 4 | Ham layout, pre-filled entry from a decode row or the map, worked-before |
+| 5 | Contest exchange fields and Cabrillo export; QSL and LoTW/eQSL fields; per-band worked/confirmed statistics |
+
+Two decisions phase 5 settled. The Cabrillo header cannot be derived from a log — how many
+operators, how much power, what the score is claimed to be — so it comes from the operator,
+with `SINGLE-OP`, `LOW`, `ALL` and `MIXED` behind it. And a confirmation counts from whichever
+bureau answered: an award wants one card or one electronic match, not one of each, so a log
+that counted them separately would tell the operator they were short of what they have.
+
+### Decisions
+
+**One station log, not one per rig.** Awards and uploads are per station callsign — DXCC, WAS
+and LoTW all count the callsign, not the radio — and a station worked on the second rig is
+still worked. The rig is recorded on the QSO (`MY_RIG`) rather than dividing the log by it.
+The station *location* fields do follow the rig, though: trx-rs rigs can be in different
+places, so `MY_GRIDSQUARE` is taken from the rig that made the QSO rather than from one global
+setting, which is also what LoTW's station locations expect.
+
+**The operator is a per-QSO field, set once per session.** ADIF separates `STATION_CALLSIGN`
+(the call used on the air) from `OPERATOR` (the person at the key); multi-operator stations
+rotate operators through one station callsign, which is why contest loggers record it per QSO.
+It is stored per QSO, defaulted from the configured callsign so a single operator never touches
+it, and changed on the station line at the top of the panel where it sticks for the session.
+It cannot be taken from the session's identity: the auth roles are `admin` and `user`, with no
+notion of who is logged in.
+
+**Server clock, and the log says so.** The server is the machine at the radio; the browser may
+be on a phone in another timezone with a clock nobody has checked. QSO times are UTC from the
+server, and when a browser's clock disagrees by more than a second the panel says so rather
+than silently logging a time the operator did not expect.
+
+**The log file is configurable, and defaults to the user's data directory.** Bookmarks live in
+the config directory because they are settings; decode logs live in the cache directory because
+they are disposable. A QSO log is neither — it is irreplaceable, and cache directories are
+swept by cleaners. `[logbook].path` in the client config, defaulting to
+`dirs::data_dir()/trx-rs/logbook.jsonl`, so a station that keeps its log on a synced or
+backed-up volume can say so.
+
+**Import collisions: callsign, band, mode and a two-minute window.** Two loggers rarely agree
+to the second on the same QSO — one records the time the contact started, another the time it
+was entered — so an exact-minute key duplicates half of what it is asked to merge. Two minutes
+absorbs that. It does not swallow legitimate re-works: contest rules forbid a second contact
+with the same station on the same band and mode, so a repeat inside two minutes is the same
+QSO. Times are compared as instants rather than date and time strings, so a QSO either side of
+midnight matches. Modes are normalised before comparison, or a log that stored `SSB` would fail
+to match ours that stored `USB`.
+
+### Rig modes to ADIF modes
+
+The rig reports what it is demodulating; ADIF wants what the contact was made on, which is not
+always the same word:
+
+| Rig mode | ADIF `MODE` | ADIF `SUBMODE` |
+|----------|-------------|----------------|
+| `USB`, `LSB` | `SSB` | `USB` / `LSB` |
+| `CW`, `CWR` | `CW` | — |
+| `AM`, `SAM` | `AM` | — |
+| `FM`, `WFM` | `FM` | — |
+| `PKT` | `PKT` | — |
+| `DIG` | decided by the decoder in use, not by the rig | |
+| `AIS`, `VDES` | none — not amateur modes, and these rigs do not log | |
+| `Other(..)` | passed through when it names an ADIF mode, else left for the operator | |
+
+`DIG` is the one that cannot come from the rig: a rig in `DIG` is in FT8, FT4 or something else
+depending on which decoder is running, and an entry started from an FT8 row logs `FT8` rather
+than the rig's word for it. WSPR never opens an entry at all — it is a beacon mode, and hearing
+a beacon is not a contact.
+
+The table is data in `qso.rs`, checked against the ADIF enumeration when it is written, with
+anything unrecognised left to the operator rather than guessed into the log.
@@ -121,13 +121,14 @@ The spectrum panel uses `<canvas>` elements (WebGL renderer optional) and offers
 When auth is enabled, an **auth gate** blocks the UI with:

 - Title: "Access Required"
- Subtitle: "Enter passphrase to continue"
- Password input + Login button (green accent, full-width)
- Optional "Continue as Guest" button (shown when RX passphrase is not set)
+- Subtitle: "Sign in to continue"
+- Username and password inputs + Login button (green accent, full-width)
 - Error message area (red `#ff6b6b`)
 - Role badge display

-Two roles: **Rx** (read-only) and **Control** (full access including TX/PTT).
+**Guest** provides read-only station access and is exclusive. Non-Guest accounts
+may combine **Read**, **Control**, **Write**, and **Administrator** roles.
+Administrator implies all permissions.

 Session cookie: `trx_http_sid`, HttpOnly, configurable Secure and SameSite attributes.

@@ -340,21 +341,26 @@ Routes are classified into three tiers:

 | Tier | Examples | Requirement |
 |---|---|---|
-| **Public** | `/`, `/index.html`, `/map`, `/auth/*`, static assets | None |
-| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Rx or Control role |
-| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, all other POST | Control role only |
+| **Public** | `/`, `/index.html`, `/map`, login/session endpoints, static assets | None |
+| **Read** | `/status`, `/events`, `/audio`, `/decode`, `/spectrum`, `/bookmarks` | Guest, Read, Control, or Administrator role |
+| **Control** | `/set_freq`, `/set_mode`, `/set_ptt`, `/toggle_power`, radio-control POST routes | Control or Administrator role |
+| **Write** | Logbook access and bookmark mutations | Write or Administrator role |

 ### 7.2 Session Management

 - Sessions are 128-bit random hex tokens stored in HttpOnly cookies
 - Configurable TTL (default from TOML config)
 - Expired sessions auto-pruned on access
- Constant-time passphrase comparison to mitigate timing attacks
+- Passwords are verified against salted Argon2id hashes

-### 7.3 TX Access Control
+### 7.3 User Management

-An additional `tx_access_control_enabled` flag can restrict transmit-related actions even
-for Control-role users, providing an extra safety layer.
+Every authenticated non-Guest account gets a Settings > Account tab for changing
+its own password. Guest sees neither Account nor Users and both account-control
+APIs deny Guest sessions. Only administrators get Settings > Users, where accounts can be
+created, enabled/disabled, assigned multiple roles, given a new password, or
+removed. The final enabled administrator cannot be disabled, removed, or
+demoted. Account security changes revoke every active session for that account.

 ---

@@ -66,8 +66,7 @@ both:
 |------------|----------|----------|
 | `[listen.auth].tokens` | `tokens_file` | one token per line |
 | `[[remotes]].auth.token` | `token_file` | the token |
-| `[frontends.http.auth].rx_passphrase` | `rx_passphrase_file` | the passphrase |
-| `[frontends.http.auth].control_passphrase` | `control_passphrase_file` | the passphrase |
+| `[frontends.http.auth].bootstrap_admin_password` | `bootstrap_admin_password_file` | the initial administrator password |
 | `[frontends.http_json.auth].tokens` | `tokens_file` | one token per line |

 Blank lines and `#` comments are ignored in the list files. A config that holds
@@ -350,17 +349,20 @@ A name in any of those maps that no remote answers to is a config error.

 | Field | Type | Default | Description |
 |-------|------|---------|-------------|
-| `enabled` | bool | `false` | Require a passphrase |
-| `rx_passphrase` | string | — | Passphrase granting receive-only access |
-| `rx_passphrase_file` | string | — | Read it from this file instead |
-| `control_passphrase` | string | — | Passphrase granting full control |
-| `control_passphrase_file` | string | — | Read it from this file instead |
-| `tx_access_control_enabled` | bool | `true` | Hide TX from unauthenticated users |
+| `enabled` | bool | `false` | Enable the user/password ACL |
+| `users_file` | string | `"trx-http-users.json"` | Persistent managed user database |
+| `bootstrap_admin_username` | string | — | First administrator, used only if the database is absent |
+| `bootstrap_admin_password` | string | — | First administrator password |
+| `bootstrap_admin_password_file` | string | — | Read the bootstrap password from this file instead |
+| `bootstrap_read_enabled` | bool | `true` | Create the default Guest account when the database is absent |
+| `bootstrap_read_username` | string | `"guest"` | Initial Guest username |
+| `bootstrap_read_password` | string | `"guest"` | Initial Guest password |
 | `session_ttl_min` | u64 | `480` | Session lifetime |
 | `cookie_secure` | bool | `false` | Set Secure on the session cookie (needs HTTPS) |
 | `cookie_same_site` | string | `"Lax"` | `Strict`, `Lax`, or `None` |

-With `enabled = true`, at least one passphrase must be set.
+When enabling ACL for the first time, configure both bootstrap fields. After
+the database exists, remove the bootstrap credentials from configuration.

 #### `[frontends.rigctl]`

@@ -464,7 +466,7 @@ and each page answers that differently:
 |------|-------|
 | Radio | The selected rig: its spectrum, its audio, and the mini decode views over the waterfall. |
 | Digital Modes | The selected rig: every decoder panel, its counts and its status line. |
-| Map | The whole station — every rig's positions, with the map's own rig filter to narrow it. |
+| Map | The whole station — every rig's positions, with the map's own rig filter to narrow it. HF APRS is a source of its own there, filtered apart from VHF APRS. |
 | Statistics | The whole station, including the per-rig comparison. |

 Switching rigs repaints the radio and digital modes pages for the rig now
@@ -477,6 +479,81 @@ Each browser tab keeps its own selection, so two tabs can watch two rigs.

 ---

+## Logbook
+
+The **Logbook** tab keeps the station's contacts and speaks ADIF, so a log can
+be uploaded to LoTW, eQSL, Club Log or QRZ, or moved to another logger.
+
+An entry opens pre-filled with six fields and no more: the frequency, mode and
+name of the rig you are on, the time from the server's clock, and — when the
+entry was started from a decode or a map station — that station's callsign and
+locator. Signal reports, name, comment and the rest are yours to fill in; a
+report in particular is never guessed, because an FT8 SNR is not what was sent.
+
+Your own callsign and locator are not per-contact fields. They are station
+identity: the callsign comes from `[trx-client.general].callsign`, the locator
+from the rig's position, and both are shown once at the top of the panel. The
+operator defaults to the station callsign and can be changed for the session,
+which is what a multi-operator station needs.
+
+**Times are the server's**, in UTC — the server is the machine at the radio. If
+the browser's clock disagrees by more than a second the entry says so rather
+than logging a time you did not expect.
+
+**A decode is not a contact.** The decoders are receive-only, so a **Log**
+button on an FT8 or APRS row opens an entry with what was heard in it and logs
+nothing by itself. Digital QSOs made in WSJT-X come in through Import ADIF, the
+way every other logger takes them.
+
+| Action | What it does |
+|--------|--------------|
+| Log contact | Writes the entry and opens a fresh one |
+| Export ADIF | Downloads the log — filtered, if a filter is set |
+| Import ADIF | Reads a file, skipping contacts already held and reporting what could not be read |
+| Worked before | Shows, as you type a callsign, which bands and modes it has been worked on |
+
+Two contacts are treated as the same when the callsign, band and mode match and
+the times are within two minutes: two loggers rarely stamp a QSO to the same
+minute, one recording when it started and the other when it was typed.
+
+The log is a JSON Lines file, appended one contact at a time so a crash costs at
+most the contact being written. It lives in your data directory by default;
+`[trx-client.logbook].path` moves it, for a station that keeps its log on a
+backed-up volume.
+
+### Contests
+
+The **Contest exchange** block on the entry holds the contest's name and the
+serials — sent and received. Both stay between contacts, because they belong to
+the session rather than to the contact just logged, and the serial sent counts
+on by itself so it is not retyped forty times an hour. An exchange that is a
+zone, a section or a name rather than a number is kept as written.
+
+**Contest entry (Cabrillo)** exports the entry sponsors accept. Only the
+contacts of the contest named there are included. The header — operator
+category, power, claimed score — cannot be worked out from a log, so it is
+yours to fill in; the defaults are single operator, low power, all bands, mixed
+mode.
+
+### Confirmations
+
+The **QSL** column shows a tick when the other station has confirmed, and the
+**Confirm** button on a row records a card that has arrived. A confirmation
+counts from wherever it came: a paper card, LoTW or eQSL. An award wants one of
+them, not all three, so the log does not ask for all three.
+
+**Bands worked** counts, per band, the contacts made, the distinct stations
+worked, and how many of those contacts are confirmed.
+
+### Ham radio layout
+
+The **Ham radio** operator layout opens on the logbook with the transceiver
+controls around it — the arrangement for working the bands, where logging the
+contact is the task and the radio is the instrument. It is offered only where
+the selected rig can transmit; a receiver has no contacts to log.
+
+---
+
 ## Tune Links

 Every page of the web UI carries what the radio is doing in its address, so the
@@ -503,7 +580,7 @@ The link button in the top bar copies the current link to the clipboard. The
 address bar itself is updated as you tune, using `replaceState`, so sweeping
 the dial does not fill the browser's history.

-Applying a link changes the radio, so it needs the `control` role; an `rx`
+Applying a link changes the radio, so it needs the `Control` role; a `Read`
 session opens the page and says the link was not applied. Links describe the
 rig's own dial — while a tab is listening to a virtual channel the address is
 left as it was, rather than publishing a frequency the rig is not on.
@@ -512,53 +589,70 @@ left as it was, rather than publishing a frequency the rig is not on.

 ## Authentication

-The HTTP frontend supports optional passphrase-based authentication with two
-roles:
+The HTTP frontend supports an optional user/password ACL:

- **rx** — read-only access (monitoring, audio, decode streams)
- **control** — full access (frequency, mode, PTT, and all settings)
+- **Guest** — read-only station access with no Account or Users controls; Guest cannot be combined with another role
+- **Read** — monitoring, audio, decode streams, and bookmark reads
+- **Control** — full radio receive/transmit controls
+- **Write** — logbook access and bookmark changes
+- **Administrator** — user management and all other permissions

 ### Configuration

 ```toml
 [frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-only-passphrase"
-control_passphrase = "full-control-passphrase"
-tx_access_control_enabled = true
+users_file = "trx-http-users.json"
+bootstrap_admin_username = "admin"
+bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false      # true if served via HTTPS
 cookie_same_site = "Lax"   # Strict|Lax|None
 ```

 When `enabled = false` (the default), all auth is bypassed and the UI behaves
-as before. When enabled, at least one passphrase must be set.
+as before. When enabling it for the first time, bootstrap credentials create
+the initial administrator (with every non-Guest role), the default `guest`/`guest` Guest
+account, and the Argon2id-hashed user database. Change or disable the guest
+credentials in configuration before first startup on an exposed deployment.

 ### Behaviour

 - On login, the server issues an `HttpOnly` session cookie.
 - Sessions are in-memory; a server restart invalidates all sessions.
 - Rate limiting is applied per IP to mitigate brute-force attempts.
- When `tx_access_control_enabled = true`, TX/PTT controls are hidden and
-  rejected for unauthenticated or `rx`-role users.
+- User records persist in `users_file`; passwords are stored as salted Argon2id hashes.
+- Non-Guest roles are independent; for example, an account may have Read and Write without Control.
+- Guest accounts have no account-control panels and cannot call account-control endpoints.
+- Every non-Guest signed-in user can change their own password in Settings > Account. This signs out all of their sessions.
+- Administrators can add, enable/disable, or remove users and change roles/passwords in Settings > Users.
+- At least one enabled administrator must always remain and cannot be disabled, removed, or demoted.
+- Disabling/removing an account or changing its password/roles revokes all of its sessions.
+- Existing account files migrate automatically: legacy accounts are enabled by default and legacy `user`/`admin` roles become Read/all roles.

 ### Routes

 | Endpoint | Method | Description |
 |----------|--------|-------------|
-| `/auth/login` | POST | Submit `{ "passphrase": "..." }` |
+| `/auth/login` | POST | Submit `{ "username": "...", "password": "..." }` |
 | `/auth/logout` | POST | Clear session |
-| `/auth/session` | GET | Check current session/role |
+| `/auth/session` | GET | Check current session/roles |
+| `/auth/account/password` | PATCH | Change a non-Guest user's password after verifying the current password |
+| `/auth/users` | GET/POST | List or add users (admin only) |
+| `/auth/users/{username}` | PATCH/DELETE | Change enabled state/password/roles or remove user (administrator only) |

-Protected routes require at least `rx` role. Control routes (set frequency,
-mode, PTT, etc.) require `control` role.
+Read routes accept Guest or require Read. Radio mutations require Control. Logbook access and
+bookmark mutations require Write. Administrator grants every permission.

 ### Frontend Flow

 1. On load, the UI calls `/auth/session`.
 2. If unauthenticated, a login screen is shown.
 3. On successful login, the normal UI loads.
-4. `rx` users see a read-only interface; `control` users get full controls.
+4. The interface enables controls according to the account's roles.
 5. If a session expires mid-use, streams stop and the login screen returns.

 ### Transport Security
@@ -252,11 +252,17 @@ async fn async_init() -> DynResult<AppState> {

    // Set HTTP frontend authentication config
    frontend_runtime.http_auth.enabled = cfg.frontends.http.auth.enabled;
-    frontend_runtime.http_auth.rx_passphrase = cfg.frontends.http.auth.rx_passphrase.clone();
-    frontend_runtime.http_auth.control_passphrase =
-        cfg.frontends.http.auth.control_passphrase.clone();
-    frontend_runtime.http_auth.tx_access_control_enabled =
-        cfg.frontends.http.auth.tx_access_control_enabled;
+    frontend_runtime.http_auth.users_file = cfg.frontends.http.auth.users_file.clone();
+    frontend_runtime.http_auth.bootstrap_admin_username =
+        cfg.frontends.http.auth.bootstrap_admin_username.clone();
+    frontend_runtime.http_auth.bootstrap_admin_password =
+        cfg.frontends.http.auth.bootstrap_admin_password.clone();
+    frontend_runtime.http_auth.bootstrap_read_enabled =
+        cfg.frontends.http.auth.bootstrap_read_enabled;
+    frontend_runtime.http_auth.bootstrap_read_username =
+        cfg.frontends.http.auth.bootstrap_read_username.clone();
+    frontend_runtime.http_auth.bootstrap_read_password =
+        cfg.frontends.http.auth.bootstrap_read_password.clone();
    frontend_runtime.http_auth.session_ttl_secs = cfg.frontends.http.auth.session_ttl().as_secs();
    frontend_runtime.http_auth.cookie_secure = cfg.frontends.http.auth.cookie_secure;
    frontend_runtime.http_auth.cookie_same_site = match cfg.frontends.http.auth.cookie_same_site {
@@ -279,6 +285,10 @@ async fn async_init() -> DynResult<AppState> {
        .http
        .decode_history_retention_min_by_rig
        .clone();
+    frontend_runtime.http_ui.logbook_path = cfg.logbook.path.clone();
+    // The callsign the station is on the air with, which every contact is
+    // logged under and which the operator defaults to.
+    frontend_runtime.http_ui.station_callsign = cfg.general.callsign.clone();

    // Resolve remote entries: CLI --url > [[remotes]] > legacy [remote] > error
    let resolved_remotes: Vec<RemoteEntry> = if let Some(ref url) = cli.url {
@@ -257,9 +257,12 @@ impl Default for DecodeHistoryContext {
 /// HTTP authentication configuration.
 pub struct HttpAuthConfig {
    pub enabled: bool,
-    pub rx_passphrase: Option<String>,
-    pub control_passphrase: Option<String>,
-    pub tx_access_control_enabled: bool,
+    pub users_file: String,
+    pub bootstrap_admin_username: Option<String>,
+    pub bootstrap_admin_password: Option<String>,
+    pub bootstrap_read_enabled: bool,
+    pub bootstrap_read_username: String,
+    pub bootstrap_read_password: Option<String>,
    pub session_ttl_secs: u64,
    pub cookie_secure: bool,
    pub cookie_same_site: String,
@@ -271,9 +274,12 @@ impl Default for HttpAuthConfig {
    fn default() -> Self {
        Self {
            enabled: false,
-            rx_passphrase: None,
-            control_passphrase: None,
-            tx_access_control_enabled: true,
+            users_file: "trx-http-users.json".to_string(),
+            bootstrap_admin_username: None,
+            bootstrap_admin_password: None,
+            bootstrap_read_enabled: true,
+            bootstrap_read_username: "guest".to_string(),
+            bootstrap_read_password: Some("guest".to_string()),
            session_ttl_secs: 480 * 60,
            cookie_secure: false,
            cookie_same_site: "Lax".to_string(),
@@ -292,6 +298,10 @@ pub struct HttpUiConfig {
    pub bandplan_region: String,
    pub decode_history_retention_min: u64,
    pub decode_history_retention_min_by_rig: HashMap<String, u64>,
+    /// Where the station log is kept; `None` takes the default.
+    pub logbook_path: Option<String>,
+    /// The callsign contacts are logged under, and the operator by default.
+    pub station_callsign: Option<String>,
 }

 impl Default for HttpUiConfig {
@@ -305,6 +315,8 @@ impl Default for HttpUiConfig {
            bandplan_region: "iaru_r1".to_string(),
            decode_history_retention_min: 24 * 60,
            decode_history_retention_min_by_rig: HashMap::new(),
+            logbook_path: None,
+            station_callsign: None,
        }
    }
 }
@@ -11,6 +11,8 @@ build = "build.rs"
 [dependencies]
 trx-core = { path = "../../../trx-core" }
 trx-frontend = { path = ".." }
+trx-logbook = { path = "../../trx-logbook" }
+chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
 trx-protocol = { path = "../../../../src/trx-protocol" }
 tokio = { workspace = true, features = ["full"] }
 serde = { workspace = true, features = ["derive"] }
@@ -26,7 +28,11 @@ flate2 = { workspace = true }
 brotli = "7"
 rand = "0.8"
 hex = "0.4"
+argon2 = "0.5"
 pickledb = "0.5"
 dirs = "6"
 uuid = { workspace = true }
 ts-rs = "12.0.1"
+
+[dev-dependencies]
+tempfile = "3"
@@ -1,3 +1,20 @@
+import {
+  AUTH_ADMIN_ROLES,
+  AUTH_ROLES,
+  AUTH_ROLE_LABELS,
+  changeOwnPassword,
+  createUser,
+  deleteUser,
+  fetchAuthSession,
+  hasAccountControls,
+  hasAuthRole,
+  listUsers,
+  login,
+  logout,
+  normalizeAuthRoles,
+  updateUser
+} from "./chunk-FT2RH7BL.js";
+
 // src/webgl-renderer.ts
 (function initTrxWebGl(global) {
  "use strict";
@@ -633,9 +650,12 @@ function elementById(id) {
    compact: { label: "Compact", advanced: false, audio: false, scheduler: false, preferredTab: "main" },
    broadcast: { label: "Broadcast", unavailable: "Broadcast requires an enumerated WFM-capable receiver", advanced: false, audio: true, scheduler: false, preferredTab: "main", capability: "broadcast" },
    digital: { label: "Digital", unavailable: "Digital requires a compatible rig mode and an available decoder", advanced: false, audio: false, scheduler: false, preferredTab: "digital-modes", capability: "digital" },
-    full: { label: "Full controls", advanced: true, audio: true, scheduler: true, preferredTab: "main" }
+    full: { label: "Full controls", advanced: true, audio: true, scheduler: true, preferredTab: "main" },
+    // Working the bands: the log is the task and the radio is the instrument,
+    // so this one opens on the logbook with the controls a keystroke away.
+    ham: { label: "Ham radio", unavailable: "Ham radio needs a rig that can transmit", advanced: true, audio: true, scheduler: false, preferredTab: "logbook", capability: "ham" }
  };
-  const layoutCapabilities = { broadcast: false, digital: false };
+  const layoutCapabilities = { broadcast: false, digital: false, ham: false };
  let activeRigId = null;
  const layoutSections = [
    { id: "advanced-radio-controls", key: "advanced" },
@@ -1311,60 +1331,6 @@ async function loadDecoderRegistry(onLoaded) {
 bridge.decoderRegistry = decoderRegistry;
 bridge.onDecoderRegistryReady = onDecoderRegistryReady;

-// src/api/auth.ts
-function decodeAuthSession(value) {
-  if (typeof value !== "object" || value === null) {
-    throw new TypeError("The authentication response is malformed");
-  }
-  const session = value;
-  if (typeof session.authenticated !== "boolean") {
-    throw new TypeError("The authentication response has no authenticated flag");
-  }
-  if (session.role !== void 0 && session.role !== "rx" && session.role !== "control") {
-    throw new TypeError("The authentication response has an invalid role");
-  }
-  if (session.auth_disabled !== void 0 && typeof session.auth_disabled !== "boolean") {
-    throw new TypeError("The authentication response has an invalid auth_disabled flag");
-  }
-  const decoded = { authenticated: session.authenticated };
-  if (session.role !== void 0) decoded.role = session.role;
-  if (session.auth_disabled !== void 0) decoded.auth_disabled = session.auth_disabled;
-  return decoded;
-}
-var authDisabledSession = {
-  authenticated: true,
-  role: "control",
-  auth_disabled: true
-};
-async function fetchAuthSession() {
-  try {
-    const response = await fetch("/auth/session");
-    if (response.status === 404) return authDisabledSession;
-    if (!response.ok) return { authenticated: false };
-    return decodeAuthSession(await response.json());
-  } catch (error) {
-    console.error("Auth check failed:", error);
-    return { authenticated: false };
-  }
-}
-async function login(passphrase) {
-  const response = await fetch("/auth/login", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ passphrase })
-  });
-  if (response.status === 404) return authDisabledSession;
-  if (!response.ok) {
-    const message = await response.text();
-    throw new Error(message || "Login failed");
-  }
-  return decodeAuthSession(await response.json());
-}
-async function logout() {
-  const response = await fetch("/auth/logout", { method: "POST" });
-  if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
-}
-
 // src/core/format.ts
 function formatDuration(milliseconds) {
  const seconds = Math.floor(milliseconds / 1e3);
@@ -1530,6 +1496,7 @@ function decodeCbor(buffer) {
 var TAB_ORDER = [
  "main",
  "bookmarks",
+  "logbook",
  "digital-modes",
  "map",
  "satellites",
@@ -1541,6 +1508,7 @@ var TAB_ORDER = [
 var TAB_PATHS = {
  main: "/",
  bookmarks: "/bookmarks",
+  logbook: "/logbook",
  "digital-modes": "/digital-modes",
  map: "/map",
  satellites: "/satellites",
@@ -1764,6 +1732,7 @@ var pluginGroups = {
  satellites: ["/satellite-predictions.js"],
  statistics: ["/map-core.js"],
  bookmarks: ["/bookmarks.js"],
+  logbook: ["/logbook.js"],
  recorder: [],
  settings: ["/vchan.js", "/scheduler.js"]
 };
@@ -1788,7 +1757,7 @@ async function loadPlugins(group) {
  for (const path of pluginGroups[group]) await loadPlugin(path);
 }
 async function loadEagerPlugins() {
-  await Promise.all(["digital-modes", "bookmarks", "settings"].map(loadPlugins));
+  await Promise.all(["digital-modes", "bookmarks", "logbook", "settings"].map(loadPlugins));
 }
 async function loadPluginsForTab(tab) {
  await loadPlugins(tab);
@@ -1856,33 +1825,68 @@ function isVchanRdsEntry(value) {
  return isRecord2(value) && typeof value.id === "string" && (value.rds === void 0 || value.rds === null || isRdsData(value.rds)) && (value.signal_db === void 0 || value.signal_db === null || typeof value.signal_db === "number");
 }
 void loadDecoderRegistry(refreshOperatorLayoutCapabilities);
-var authRole = null;
+var authRoles = [];
+var authUsername = null;
 var authEnabled = true;
+function setAuthRoles(roles) {
+  authRoles = normalizeAuthRoles(roles);
+}
+function hasAuthRole2(role) {
+  return hasAuthRole(authRoles, role);
+}
+function buildRoleChoices(selected) {
+  const element = document.createElement("span");
+  element.className = "auth-role-choices";
+  const inputs = AUTH_ROLES.map((value) => {
+    const label = document.createElement("label");
+    label.className = "auth-role-choice";
+    const input = document.createElement("input");
+    input.type = "checkbox";
+    input.value = value;
+    input.checked = selected.includes(value);
+    label.append(input, ` ${AUTH_ROLE_LABELS[value]}`);
+    element.append(label);
+    return { input, value };
+  });
+  inputs.forEach(({ input, value }) => {
+    input.addEventListener("change", () => {
+      if (!input.checked) return;
+      if (value === "guest") {
+        inputs.forEach((choice) => {
+          if (choice.value !== "guest") choice.input.checked = false;
+        });
+      } else {
+        const guest = inputs.find((choice) => choice.value === "guest");
+        if (guest) guest.input.checked = false;
+      }
+    });
+  });
+  return { element, inputs };
+}
 async function checkAuthStatus() {
  return fetchAuthSession();
 }
-async function authLogin(passphrase) {
-  return login(passphrase);
+async function authLogin(username, password) {
+  return login(username, password);
 }
 async function authLogout() {
  try {
    await logout();
-    authRole = null;
+    setAuthRoles([]);
+    authUsername = null;
    disconnect();
    setDecodeHistoryOverlayVisible(false);
    requiredElement("content").style.display = "none";
    requiredElement("loading").style.display = "none";
-    requiredElement("auth-passphrase").value = "";
+    requiredElement("auth-password").value = "";
    updateAuthUI();
-    const authStatus = await checkAuthStatus();
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  } catch (e) {
    console.error("Logout failed:", e);
    showAuthError("Logout failed");
  }
 }
-function showAuthGate(allowGuest = false) {
+function showAuthGate() {
  if (!authEnabled) return;
  setDecodeHistoryOverlayVisible(false);
  requiredElement("loading").style.display = "none";
@@ -1899,10 +1903,6 @@ function showAuthGate(allowGuest = false) {
  document.querySelectorAll(".tab-panel").forEach((panel) => {
    panel.style.display = "none";
  });
-  const guestBtn2 = document.getElementById("auth-guest-btn");
-  if (guestBtn2) {
-    guestBtn2.style.display = allowGuest ? "block" : "none";
-  }
  document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
    btn.classList.toggle("active", btn.dataset.tab === "main");
  });
@@ -1938,20 +1938,30 @@ function updateAuthUI() {
  const badge = document.getElementById("auth-badge");
  const badgeRole = document.getElementById("auth-role-badge");
  const headerAuthBtn2 = document.getElementById("header-auth-btn");
+  const accountTab = document.getElementById("settings-account-tab");
  if (!authEnabled) {
    if (badge) badge.style.display = "none";
    if (headerAuthBtn2) headerAuthBtn2.style.display = "none";
+    if (accountTab) accountTab.style.display = "none";
    syncTopBarAccess();
    return;
  }
-  if (authRole) {
+  if (authRoles.length > 0) {
+    const canManageAccount = hasAccountControls(authRoles);
+    if (accountTab) accountTab.style.display = canManageAccount ? "" : "none";
+    if (!canManageAccount && accountTab?.classList.contains("active")) {
+      const panel = document.getElementById("subtab-settings-account");
+      if (panel) panel.style.display = "none";
+      document.querySelector('[data-subtab="settings-scheduler"]')?.click();
+    }
    if (badge) badge.style.display = "block";
-    if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
+    if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map((role) => AUTH_ROLE_LABELS[role]).join(", ")}`;
    if (headerAuthBtn2) {
      headerAuthBtn2.textContent = "Logout";
      headerAuthBtn2.style.display = "block";
    }
  } else {
+    if (accountTab) accountTab.style.display = "none";
    if (badge) badge.style.display = "none";
    if (headerAuthBtn2) {
      headerAuthBtn2.textContent = "Login";
@@ -1961,8 +1971,8 @@ function updateAuthUI() {
  syncTopBarAccess();
 }
 function applyAuthRestrictions() {
-  if (!authRole) return;
-  if (authRole === "rx") {
+  if (authRoles.length === 0) return;
+  if (!hasAuthRole2("control")) {
    const pttBtn2 = document.getElementById("ptt-btn");
    const powerBtn2 = document.getElementById("power-btn");
    const lockBtn2 = document.getElementById("lock-btn");
@@ -2252,20 +2262,21 @@ window.applyDecodeHistoryRetention = function() {
  }
 };
 function syncTopBarAccess() {
-  const loggedOut = authEnabled && !authRole;
+  const loggedOut = authEnabled && authRoles.length === 0;
  const tabBar = document.getElementById("tab-bar");
  const rigSwitch = document.querySelector(".header-rig-switch");
  if (tabBar) tabBar.style.display = "";
  document.querySelectorAll(".tab-bar .tab").forEach((btn) => {
    const isMain = btn.dataset.tab === "main";
-    btn.style.display = !loggedOut || isMain ? "" : "none";
+    const lacksLogbookAccess = authEnabled && btn.dataset.tab === "logbook" && !hasAuthRole2("write");
+    btn.style.display = (!loggedOut || isMain) && !lacksLogbookAccess ? "" : "none";
    btn.disabled = false;
  });
  if (rigSwitch) {
    rigSwitch.style.display = loggedOut ? "none" : "";
  }
  if (headerRigSwitchSelect) {
-    headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
+    headerRigSwitchSelect.disabled = loggedOut || !hasAuthRole2("control") || lastRigIds.length === 0;
  }
 }
 var overviewDrawPending = false;
@@ -2901,13 +2912,13 @@ function applyRigList(activeRigId, rigIds, displayNames) {
  }
  const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
  const rigListChanged = prevKey !== nextKey;
-  const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
+  const disableSwitch = lastRigIds.length === 0 || !hasAuthRole2("control");
  populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
  updateRigSubtitle(lastActiveRigId);
  window.trxUi?.setActiveRig(lastActiveRigId);
+  window.trx.modules.scheduler?.setRig(lastActiveRigId);
+  window.trx.modules.backgroundDecode?.setRig(lastActiveRigId);
  if (rigListChanged) {
-    window.trx.modules.scheduler?.setRig(lastActiveRigId);
-    window.trx.modules.backgroundDecode?.setRig(lastActiveRigId);
    window.trx.modules.bookmarks?.populateScopePicker();
    void window.trx.modules.bookmarks?.fetch(document.getElementById("bm-category-filter")?.value || "");
  }
@@ -2950,7 +2961,10 @@ function refreshOperatorLayoutCapabilities() {
  ));
  window.trxUi?.setLayoutCapabilities({
    broadcast: rigModes.some((modes) => modes.includes("WFM")),
-    digital: decoderModes.size > 0 && rigModes.some((modes) => modes.some((mode) => decoderModes.has(mode)))
+    digital: decoderModes.size > 0 && rigModes.some((modes) => modes.some((mode) => decoderModes.has(mode))),
+    // A logbook is for contacts made, so the layout built around it is offered
+    // where a rig can transmit.
+    ham: serverRigs.some((rig) => rig?.tx === true)
  });
 }
 function showHint(msg, duration) {
@@ -4501,7 +4515,7 @@ function scheduleTuneLinkSync() {
 async function applyTuneLink(link) {
  const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
  if (!wanted) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole2("control")) {
    showHint("Read-only session — link not applied", 2500);
    return;
  }
@@ -5219,7 +5233,7 @@ async function postPath(path, options = {}) {
  }
  const resp = await fetch(path, { method: "POST" });
  if (authEnabled && resp.status === 401) {
-    authRole = null;
+    setAuthRoles([]);
    if (es) es.close();
    showAuthGate();
    throw new Error("Authentication required");
@@ -5244,7 +5258,7 @@ async function switchRigFromSelect(selectEl) {
    showHint("No rig selected", 1500);
    return;
  }
-  if (authRole === "rx") {
+  if (!hasAuthRole2("control")) {
    showHint("Control role required", 1500);
    return;
  }
@@ -5858,8 +5872,13 @@ function navigateToTab(name, options = {}) {
  window.trxUi?.closeMobileOverlays?.();
  const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
  const { updateHistory = true, replaceHistory = false } = options;
-  if (authEnabled && !authRole && name !== "main") {
-    showAuthGate(false);
+  if (authEnabled && authRoles.length === 0 && name !== "main") {
+    showAuthGate();
+    return;
+  }
+  if (authEnabled && name === "logbook" && !hasAuthRole2("write")) {
+    showHint("Write role required for logbook access", 2500);
+    navigateToTab("main", options);
    return;
  }
  const btn = document.querySelector(`.tab-bar .tab[data-tab="${name}"]`);
@@ -5889,6 +5908,7 @@ function navigateToTab(name, options = {}) {
  if (leavingSatellites) window.clearSatPredictionDom?.();
  void loadPluginsForTab(name).then(() => {
    if (name === "satellites") window.refreshSatPredictions?.();
+    flushPendingDecodeStats();
  }).catch((error) => {
    console.error(error);
  });
@@ -5971,11 +5991,11 @@ window.addEventListener("resize", () => {
  scheduleSpectrumLayout();
 });
 async function initializeApp() {
-  showAuthGate(false);
+  showAuthGate();
  const authStatus = await checkAuthStatus();
  authEnabled = !authStatus.auth_disabled;
  if (!authEnabled) {
-    authRole = "control";
+    setAuthRoles(AUTH_ADMIN_ROLES);
    hideAuthGate();
    updateAuthUI();
    connect();
@@ -5986,7 +6006,8 @@ async function initializeApp() {
    return;
  }
  if (authStatus.authenticated) {
-    authRole = authStatus.role ?? null;
+    setAuthRoles(authStatus.roles);
+    authUsername = authStatus.username ?? null;
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -5996,30 +6017,183 @@ async function initializeApp() {
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } else {
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  }
 }
+var settingsUiReady = false;
 function initSettingsUI() {
-  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRole);
+  settingsUiReady = true;
+  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRoles);
  window.trx.modules.scheduler?.wireEvents();
  if (window.trx.modules.backgroundDecode) {
-    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
+    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRoles);
    window.trx.modules.backgroundDecode.wireEvents();
  }
+  void refreshUserManagement();
 }
+async function refreshUserManagement() {
+  const section = document.getElementById("user-management");
+  const tab = document.getElementById("settings-users-tab");
+  if (!section || !tab) return;
+  const canManageUsers = authEnabled && hasAuthRole2("administrator");
+  tab.style.display = canManageUsers ? "" : "none";
+  if (!canManageUsers) {
+    const panel = document.getElementById("subtab-settings-users");
+    if (panel) panel.style.display = "none";
+    if (tab.classList.contains("active")) {
+      document.querySelector('[data-subtab="settings-scheduler"]')?.click();
+    }
+    return;
+  }
+  const list = requiredElement("user-list");
+  try {
+    const users = await listUsers();
+    const enabledAdminCount = users.filter((user) => user.enabled && hasAuthRole(user.roles, "administrator")).length;
+    list.replaceChildren(...users.map((user) => {
+      const row = document.createElement("div");
+      row.className = "sch-row";
+      row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
+      const name = document.createElement("strong");
+      name.textContent = user.username;
+      name.style.minWidth = "10rem";
+      if (!user.enabled) name.textContent += " (disabled)";
+      const { element: roles, inputs: roleInputs } = buildRoleChoices(user.roles);
+      const enabledLabel = document.createElement("label");
+      enabledLabel.className = "auth-role-choice";
+      const enabled = document.createElement("input");
+      enabled.type = "checkbox";
+      enabled.checked = user.enabled;
+      enabled.disabled = user.username === authUsername;
+      if (enabled.disabled) enabled.title = "You cannot disable your current account";
+      enabledLabel.append(enabled, " Enabled");
+      const isOnlyAdmin = user.enabled && hasAuthRole(user.roles, "administrator") && enabledAdminCount === 1;
+      const administratorInput = roleInputs.find((item) => item.value === "administrator")?.input;
+      const guestInput = roleInputs.find((item) => item.value === "guest")?.input;
+      if (isOnlyAdmin && administratorInput) {
+        administratorInput.disabled = true;
+        administratorInput.title = "The final administrator cannot be demoted";
+      }
+      if (isOnlyAdmin && guestInput) {
+        guestInput.disabled = true;
+        guestInput.title = "The final administrator cannot become a Guest";
+      }
+      if (isOnlyAdmin) {
+        enabled.disabled = true;
+        enabled.title = "The final enabled administrator cannot be disabled";
+      }
+      const password = document.createElement("input");
+      password.type = "password";
+      password.placeholder = "New password (8+ characters)";
+      password.autocomplete = "new-password";
+      password.className = "auth-input";
+      password.minLength = 8;
+      password.maxLength = 1024;
+      const save = document.createElement("button");
+      save.type = "button";
+      save.textContent = "Save";
+      save.addEventListener("click", async () => {
+        const changes = {
+          roles: roleInputs.filter(({ input }) => input.checked).map(({ value }) => value),
+          enabled: enabled.checked
+        };
+        if (password.value) changes.password = password.value;
+        await runUserOperation(() => updateUser(user.username, changes));
+      });
+      const remove = document.createElement("button");
+      remove.type = "button";
+      remove.textContent = "Remove";
+      remove.className = "danger";
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
+      remove.addEventListener("click", async () => {
+        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
+          await runUserOperation(() => deleteUser(user.username));
+        }
+      });
+      row.append(name, enabledLabel, roles, password, save, remove);
+      return row;
+    }));
+  } catch (error) {
+    showUserManagementError(error);
+  }
+}
+function showUserManagementError(error) {
+  const element = document.getElementById("user-management-error");
+  if (!element) return;
+  element.textContent = error instanceof Error ? error.message : String(error);
+  element.style.display = "block";
+}
+async function runUserOperation(operation) {
+  try {
+    await operation();
+    const error = document.getElementById("user-management-error");
+    if (error) error.style.display = "none";
+    await refreshUserManagement();
+  } catch (reason) {
+    showUserManagementError(reason);
+  }
+}
+var createRoleContainer = document.getElementById("user-create-roles");
+if (createRoleContainer) {
+  const { element } = buildRoleChoices(["read"]);
+  element.id = createRoleContainer.id;
+  createRoleContainer.replaceWith(element);
+}
+document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const username = requiredElement("user-create-username");
+  const password = requiredElement("user-create-password");
+  const enabled = requiredElement("user-create-enabled");
+  const roles = Array.from(document.querySelectorAll("#user-create-roles input[type=checkbox]"));
+  void runUserOperation(async () => {
+    await createUser(username.value, password.value, roles.filter((input) => input.checked).map((input) => input.value), enabled.checked);
+    username.value = "";
+    password.value = "";
+    enabled.checked = true;
+    roles.forEach((input) => {
+      input.checked = input.value === "read";
+    });
+  });
+});
+document.getElementById("account-password-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const form = event.currentTarget;
+  const currentPassword = requiredElement("account-current-password");
+  const newPassword = requiredElement("account-new-password");
+  const confirmPassword = requiredElement("account-confirm-password");
+  const error = requiredElement("account-password-error");
+  const submit = form.querySelector('button[type="submit"]');
+  if (newPassword.value !== confirmPassword.value) {
+    error.textContent = "New passwords do not match";
+    error.style.display = "block";
+    return;
+  }
+  if (submit) submit.disabled = true;
+  void changeOwnPassword(currentPassword.value, newPassword.value).then(async () => {
+    form.reset();
+    error.style.display = "none";
+    await authLogout();
+    showHint("Password changed. Sign in again.", 3e3);
+  }).catch((reason) => {
+    error.textContent = reason instanceof Error ? reason.message : String(reason);
+    error.style.display = "block";
+  }).finally(() => {
+    if (submit) submit.disabled = false;
+  });
+});
 requiredElement("auth-form").addEventListener("submit", async (e) => {
  e.preventDefault();
-  const passphraseEl = requiredElement("auth-passphrase");
-  const passphrase = passphraseEl.value;
+  const usernameEl = requiredElement("auth-username");
+  const passwordEl = requiredElement("auth-password");
  const btn = requiredElement("auth-form").querySelector("button[type=submit]");
  if (!btn) return;
  btn.disabled = true;
  btn.textContent = "Logging in...";
  try {
-    const result = await authLogin(passphrase);
-    authRole = result.role ?? null;
-    passphraseEl.value = "";
+    const result = await authLogin(usernameEl.value, passwordEl.value);
+    setAuthRoles(result.roles);
+    authUsername = result.username ?? usernameEl.value;
+    passwordEl.value = "";
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -6029,37 +6203,22 @@ requiredElement("auth-form").addEventListener("submit", async (e) => {
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } catch (err) {
-    showAuthError("Invalid passphrase");
+    showAuthError("Invalid username or password");
    console.error("Login error:", err);
  } finally {
    btn.disabled = false;
    btn.textContent = "Login";
  }
 });
-var guestBtn = document.getElementById("auth-guest-btn");
-if (guestBtn) {
-  guestBtn.addEventListener("click", () => {
-    authRole = "rx";
-    requiredElement("auth-passphrase").value = "";
-    hideAuthGate();
-    updateAuthUI();
-    applyAuthRestrictions();
-    connect();
-    connectDecode();
-    initSettingsUI();
-    resizeHeaderSignalCanvas();
-    startHeaderSignalSampling();
-  });
-}
 var headerAuthBtn = document.getElementById("header-auth-btn");
 if (headerAuthBtn) {
  headerAuthBtn.addEventListener("click", async () => {
-    if (authRole) {
+    if (authRoles.length > 0) {
      if (await window.trxUi.confirm({ title: "Log out?", message: "Audio and control access for this browser session will end.", confirmLabel: "Log out", danger: false })) {
        await authLogout();
      }
    } else {
-      showAuthGate(false);
+      showAuthGate();
    }
  });
 }
@@ -6097,8 +6256,8 @@ Object.defineProperties(trxState, {
  authEnabled: { get() {
    return authEnabled;
  } },
-  authRole: { get() {
-    return authRole;
+  authRoles: { get() {
+    return authRoles;
  } },
  decoderRegistry: { get() {
    return decoderRegistry;
@@ -6271,7 +6430,9 @@ Object.defineProperties(trxState, {
  } }
 });
 window.trx = Object.freeze({ state: trxState, core: trxCore, modules: trxModules });
-void loadEagerPlugins().catch((error) => {
+void loadEagerPlugins().then(() => {
+  if (settingsUiReady) initSettingsUI();
+}).catch((error) => {
  console.error(error);
 });
 void initializeApp();
@@ -7619,11 +7780,35 @@ var IMAGE_DECODE_KINDS = /* @__PURE__ */ new Set([
  "sstv",
  "sstv_progress"
 ]);
+var pendingDecodeStats = [];
+var PENDING_DECODE_STATS_MAX = 5e4;
+function recordDecodeStat(kind, rig, tsMs) {
+  const stats = window.trx.modules.map;
+  if (stats) {
+    stats.statsRecordDecode(kind, rig, tsMs);
+    return;
+  }
+  pendingDecodeStats.push({ kind, rig, tsMs });
+  if (pendingDecodeStats.length > PENDING_DECODE_STATS_MAX) {
+    pendingDecodeStats.splice(0, pendingDecodeStats.length - PENDING_DECODE_STATS_MAX);
+  }
+}
+function flushPendingDecodeStats() {
+  const stats = window.trx.modules.map;
+  if (!stats || pendingDecodeStats.length === 0) return;
+  for (const entry of pendingDecodeStats.splice(0)) {
+    stats.statsRecordDecode(entry.kind, entry.rig, entry.tsMs);
+  }
+  stats.scheduleStatsRender();
+}
+function scheduleStatsRenderIfLoaded() {
+  window.trx.modules.map?.scheduleStatsRender();
+}
 function dispatchDecodeMessage(msg, skipStats = false) {
  if (msg.type) window.trxPluginRuntime.dispatch(msg.type, msg);
  if (!skipStats && msg.type && !IMAGE_DECODE_KINDS.has(msg.type)) {
-    window.trx.modules.map?.statsRecordDecode(msg.type, msg.rig_id || msg.remote || null);
-    window.trx.modules.map?.scheduleStatsRender();
+    recordDecodeStat(msg.type, msg.rig_id || msg.remote || null);
+    scheduleStatsRenderIfLoaded();
  }
 }
 var DECODE_HISTORY_WORKER_GROUP_LIMIT = 512;
@@ -7669,9 +7854,9 @@ function restoreDecodeHistoryGroup(kind, messages) {
  if (!Array.isArray(messages) || messages.length === 0) return;
  if (!IMAGE_DECODE_KINDS.has(kind)) {
    for (const msg of messages) {
-      window.trx.modules.map?.statsRecordDecode(kind, msg.rig_id || msg.remote || null, msg.ts_ms || void 0);
+      recordDecodeStat(kind, msg.rig_id || msg.remote || null, msg.ts_ms || void 0);
    }
-    window.trx.modules.map?.scheduleStatsRender();
+    scheduleStatsRenderIfLoaded();
  }
  window.trxPluginRuntime.restore(kind, messages);
 }
@@ -4,7 +4,7 @@ import {
  collapseAprsDuplicates,
  normalizeAprsPacket,
  renderAprsPacketRow
-} from "./chunk-OPEIVJGD.js";
+} from "./chunk-REYSUJQ4.js";
 import {
  forActiveRig,
  isActiveRigDecode
@@ -139,6 +139,9 @@ function renderAprsRow(pkt, isFresh) {
    },
    onCopy: (text) => {
      void copyAprsCoords(text);
+    },
+    onLog: (call, gridsquare) => {
+      aprsWindow.logContact?.({ call, gridsquare: gridsquare ?? void 0, decoder: "aprs" });
    }
  });
 }
@@ -1,3 +1,6 @@
+import {
+  hasAuthRole
+} from "./chunk-FT2RH7BL.js";
 import {
  hostState
 } from "./chunk-KL66PICH.js";
@@ -13,15 +16,17 @@ var bgdWindow = window;
      return d.id;
    });
  }
-  let backgroundDecodeRole = null;
+  let backgroundDecodeRoles = [];
  let currentRigId = null;
  let currentConfig = null;
  let bookmarkList = [];
  let statusInterval = null;
  let bgdDirty = false;
-  function initBackgroundDecode(rigId, role) {
-    backgroundDecodeRole = role;
-    currentRigId = rigId || null;
+  let statusByBookmark = /* @__PURE__ */ new Map();
+  let lastStatus = null;
+  function initBackgroundDecode(rigId, roles) {
+    backgroundDecodeRoles = roles;
+    currentRigId = rigId || hostState.lastActiveRigId || null;
    if (currentRigId) loadBackgroundDecode();
    startStatusPolling();
  }
@@ -108,7 +113,7 @@ var bgdWindow = window;
    }
    setCheckbox("background-decode-enabled", currentConfig.enabled);
    renderBookmarkChecklist();
-    const isControl = backgroundDecodeRole === "control" || hostState.authEnabled === false;
+    const isControl = isControlRole();
    const panel = document.getElementById("background-decode-panel");
    if (panel) {
      panel.querySelectorAll("input, select, button.sch-write").forEach(function(el) {
@@ -119,6 +124,10 @@ var bgdWindow = window;
    const resetBtn = document.getElementById("background-decode-reset-btn");
    if (saveBtn) saveBtn.style.display = isControl ? "" : "none";
    if (resetBtn) resetBtn.style.display = isControl ? "" : "none";
+    syncSaveButton();
+  }
+  function currentFilterText() {
+    return document.getElementById("bgd-bookmark-filter")?.value ?? "";
  }
  function renderBookmarkChecklist(filterText = "") {
    const container = document.getElementById("bgd-bookmark-checklist");
@@ -134,20 +143,49 @@ var bgdWindow = window;
      return text.indexOf(filter) >= 0;
    }) : all;
    if (filtered.length === 0) {
-      container.innerHTML = '<div class="bgd-checklist-empty">' + (all.length === 0 ? "No supported bookmarks available." : "No bookmarks match filter.") + "</div>";
+      container.innerHTML = '<div class="bgd-checklist-empty">' + escHtml(emptyListText(all.length)) + "</div>";
+      renderSelectionSummary();
      return;
    }
    filtered.forEach(function(bookmark) {
      const row = document.createElement("label");
      row.className = "bgd-checklist-row";
+      row.dataset.bmId = bookmark.id;
      const decoders = bookmarkDecoderKinds(bookmark);
-      const checked = selectedIds.has(bookmark.id) ? " checked" : "";
-      row.innerHTML = '<input type="checkbox"' + checked + ' data-bm-id="' + escHtml(bookmark.id) + '" /><span class="bgd-checklist-name">' + escHtml(bookmark.name) + '</span><span class="bgd-checklist-meta">' + escHtml(formatFreq(bookmark.freq_hz) + " " + bookmark.mode + " · " + decoders.join("/").toUpperCase()) + "</span>";
+      const selected = selectedIds.has(bookmark.id);
+      if (selected) row.classList.add("is-selected");
+      row.innerHTML = '<input type="checkbox"' + (selected ? " checked" : "") + ' data-bm-id="' + escHtml(bookmark.id) + '" /><span class="bgd-checklist-name">' + escHtml(bookmark.name) + '</span><span class="bgd-checklist-meta">' + escHtml(formatFreq(bookmark.freq_hz)) + '<span class="bgd-checklist-mode">' + escHtml(bookmark.mode + " · " + decoders.join("/").toUpperCase()) + "</span></span>" + stateBadgeHtml(bookmark.id, selected);
      row.querySelector("input")?.addEventListener("change", function(e) {
        onChecklistToggle(bookmark.id, e.currentTarget.checked);
      });
      container.appendChild(row);
    });
+    renderSelectionSummary();
+  }
+  function emptyListText(supportedCount) {
+    if (supportedCount > 0) return "No bookmark matches that filter.";
+    if (bookmarkList.length > 0) {
+      return "None of your bookmarks name a decoder that can run in the background. Give one a decoder on the Bookmarks tab to list it here.";
+    }
+    return "No bookmarks yet. Save one on the Bookmarks tab and it can be decoded here.";
+  }
+  function stateBadgeHtml(bookmarkId, selected) {
+    if (!selected) return '<span class="bgd-state" data-state="unselected"></span>';
+    const entry = statusByBookmark.get(bookmarkId);
+    const state = entry?.state ?? (currentConfig?.enabled ? "pending" : "disabled");
+    return '<span class="bgd-state" data-state="' + escHtml(state) + '" title="' + escHtml(stateHelp(state)) + '"><span class="bgd-state-dot"></span>' + escHtml(prettyState(state)) + "</span>";
+  }
+  function renderSelectionSummary() {
+    const el = document.getElementById("bgd-selection-summary");
+    if (!el) return;
+    const selected = currentConfig?.bookmark_ids.length ?? 0;
+    if (selected === 0) {
+      el.textContent = "Nothing selected — background decoding is idle.";
+      return;
+    }
+    const active = [...statusByBookmark.values()].filter((entry) => entry.state === "active").length;
+    const noun = `${String(selected)} bookmark${selected === 1 ? "" : "s"} selected`;
+    el.textContent = currentConfig?.enabled ? `${noun}, ${String(active)} decoding now.` : `${noun}. Switch Enabled on to start decoding them.`;
  }
  function onChecklistToggle(bookmarkId, checked) {
    if (!currentConfig) {
@@ -182,7 +220,7 @@ var bgdWindow = window;
    }).catch(function(err) {
      showToast(`Save failed: ${errorMessage(err)}`, true);
    }).finally(function() {
-      if (btn) btn.disabled = false;
+      syncSaveButton();
    });
  }
  async function resetBackgroundDecode() {
@@ -210,59 +248,83 @@ var bgdWindow = window;
    });
  }
  function renderStatus(status) {
-    const card = document.getElementById("background-decode-status-card");
-    if (!card) return;
-    const entries = status.entries ?? [];
-    if (!entries.length) {
-      card.textContent = "No background decode bookmarks configured.";
+    lastStatus = status;
+    statusByBookmark = new Map(
+      (status.entries ?? []).filter((entry) => typeof entry.bookmark_id === "string" && entry.bookmark_id.length > 0).map((entry) => [entry.bookmark_id, entry])
+    );
+    renderSpanSummary();
+    renderBookmarkChecklist(currentFilterText());
+  }
+  function renderSpanSummary() {
+    const el = document.getElementById("bgd-span-summary");
+    if (!el) return;
+    const status = lastStatus;
+    if (!status) {
+      el.textContent = "";
      return;
    }
-    const summary = [];
-    if (status.active_rig) {
-      if (typeof status.center_hz === "number" && Number.isFinite(status.center_hz)) summary.push("Center " + formatFreq(status.center_hz));
-      if (typeof status.sample_rate === "number" && Number.isFinite(status.sample_rate) && status.sample_rate > 0) summary.push("Span ±" + formatFreq(status.sample_rate / 2));
-    } else {
-      summary.push("This rig is not currently selected for audio.");
+    if (!status.active_rig) {
+      el.textContent = "This rig is not the one playing audio.";
+      el.dataset.tone = "warn";
+      return;
+    }
+    const centre = typeof status.center_hz === "number" && Number.isFinite(status.center_hz) ? formatFreq(status.center_hz) : null;
+    const half = typeof status.sample_rate === "number" && Number.isFinite(status.sample_rate) && status.sample_rate > 0 ? formatFreq(status.sample_rate / 2) : null;
+    el.dataset.tone = "";
+    el.textContent = centre && half ? `Span ${centre} ±${half}` : centre ? `Centre ${centre}` : "";
+  }
+  function stateHelp(state) {
+    switch (state) {
+      case "active":
+        return "Decoding on a hidden channel.";
+      case "out_of_span":
+        return "Outside the span the rig is tuned across, so it cannot be heard from here.";
+      case "waiting_for_spectrum":
+        return "Waiting for the first spectrum frame from the rig.";
+      case "waiting_for_user":
+        return "Nobody is listening to this rig, so no audio is being pulled.";
+      case "missing_bookmark":
+        return "The bookmark this was selected from is gone.";
+      case "no_supported_decoders":
+        return "No decoder that runs in the background can decode this bookmark.";
+      case "disabled":
+        return "Background decoding is switched off.";
+      case "handled_by_scheduler":
+      case "scheduler_has_control":
+        return "The scheduler is running this bookmark instead.";
+      case "handled_by_virtual_channel":
+        return "A virtual channel is already on this frequency.";
+      case "pending":
+        return "Selected, and not started yet — save to apply.";
+      default:
+        return "Selected, but not decoding.";
    }
-    let html = summary.length ? '<div style="margin-bottom:0.8rem;color:var(--text-muted);">' + escHtml(summary.join(" · ")) + "</div>" : "";
-    html += '<div class="bgd-status-list">';
-    entries.forEach(function(entry) {
-      const name = entry.bookmark_name || entry.bookmark_id || "Unknown bookmark";
-      const parts = [];
-      if (typeof entry.freq_hz === "number" && Number.isFinite(entry.freq_hz)) parts.push(formatFreq(entry.freq_hz));
-      if (entry.mode) parts.push(entry.mode);
-      if (Array.isArray(entry.decoder_kinds) && entry.decoder_kinds.length) {
-        parts.push(entry.decoder_kinds.join("/").toUpperCase());
-      }
-      html += '<div class="bgd-status-row"><div><div class="bgd-status-name">' + escHtml(name) + '</div><div class="bgd-status-meta">' + escHtml(parts.join(" · ")) + '</div></div><div class="bgd-status-state" data-state="' + escHtml(entry.state || "inactive") + '"><svg class="bgd-state-dot" viewBox="0 0 8 8"><circle cx="4" cy="4" r="3.5"/></svg>' + escHtml(prettyState(entry.state)) + "</div></div>";
-    });
-    html += "</div>";
-    card.innerHTML = html;
  }
  function prettyState(state) {
    switch (state) {
      case "active":
-        return "✓ Active";
+        return "Decoding";
      case "out_of_span":
-        return "△ Out of span";
+        return "Out of span";
      case "waiting_for_spectrum":
-        return "△ Waiting";
+        return "Waiting for spectrum";
      case "waiting_for_user":
-        return "△ No user";
+        return "Nobody listening";
      case "missing_bookmark":
-        return "✗ Missing";
+        return "Bookmark gone";
      case "no_supported_decoders":
-        return "✗ Unsupported";
+        return "No decoder";
      case "disabled":
-        return "△ Disabled";
+        return "Off";
      case "handled_by_scheduler":
-        return "△ Scheduler";
      case "scheduler_has_control":
-        return "△ Scheduler";
+        return "Scheduler has it";
      case "handled_by_virtual_channel":
-        return "△ VChan";
+        return "On a channel";
+      case "pending":
+        return "Not saved";
      default:
-        return "△ Inactive";
+        return "Idle";
    }
  }
  function setCheckbox(id, value) {
@@ -285,13 +347,21 @@ var bgdWindow = window;
  function markBgdDirty() {
    if (bgdDirty) return;
    bgdDirty = true;
-    const btn = document.getElementById("background-decode-save-btn");
-    if (btn) btn.classList.add("sch-dirty");
+    syncSaveButton();
  }
  function clearBgdDirty() {
    bgdDirty = false;
+    syncSaveButton();
+  }
+  function syncSaveButton() {
    const btn = document.getElementById("background-decode-save-btn");
-    if (btn) btn.classList.remove("sch-dirty");
+    if (!btn) return;
+    btn.classList.toggle("sch-dirty", bgdDirty);
+    btn.disabled = !bgdDirty || !isControlRole();
+    btn.title = bgdDirty ? "Apply these bookmarks to the background decoder" : "No changes to save";
+  }
+  function isControlRole() {
+    return hasAuthRole(backgroundDecodeRoles, "control") || hostState.authEnabled === false;
  }
  function showToast(msg, isError) {
    const el = document.getElementById("background-decode-toast");
@@ -311,7 +381,7 @@ var bgdWindow = window;
      return bm.id;
    });
    currentConfig.bookmark_ids = ids;
-    renderBookmarkChecklist(document.getElementById("bgd-bookmark-filter")?.value);
+    renderBookmarkChecklist(currentFilterText());
    markBgdDirty();
  }
  function deselectAllBookmarks() {
@@ -319,7 +389,7 @@ var bgdWindow = window;
      currentConfig = { remote: currentRigId, enabled: false, bookmark_ids: [] };
    }
    currentConfig.bookmark_ids = [];
-    renderBookmarkChecklist(document.getElementById("bgd-bookmark-filter")?.value);
+    renderBookmarkChecklist(currentFilterText());
    markBgdDirty();
  }
  function wireBackgroundDecodeEvents() {
@@ -334,7 +404,9 @@ var bgdWindow = window;
    if (enabledCb && !enabledCb._wired) {
      enabledCb._wired = true;
      enabledCb.addEventListener("change", function() {
+        if (currentConfig) currentConfig.enabled = enabledCb.checked;
        markBgdDirty();
+        renderBookmarkChecklist(currentFilterText());
      });
    }
    const selectAllBtn = document.getElementById("bgd-select-all-btn");
@@ -1,3 +1,6 @@
+import {
+  hasAuthRole
+} from "./chunk-FT2RH7BL.js";
 import {
  hostCore,
  hostState
@@ -42,7 +45,7 @@ function bmEsc(str) {
  return d.innerHTML;
 }
 function bmCanControl() {
-  return !hostState.authEnabled || hostState.authRole === "control";
+  return !hostState.authEnabled || hasAuthRole(hostState.authRoles, "write");
 }
 function bmSyncAccess() {
  const canCtrl = bmCanControl();
@@ -0,0 +1,135 @@
+// src/api/auth.ts
+var AUTH_ROLES = ["guest", "read", "control", "write", "administrator"];
+var AUTH_ADMIN_ROLES = AUTH_ROLES.filter((role) => role !== "guest");
+var AUTH_ROLE_LABELS = {
+  guest: "Guest",
+  read: "Read",
+  control: "Control",
+  write: "Write",
+  administrator: "Administrator"
+};
+function isAuthRole(value) {
+  return typeof value === "string" && AUTH_ROLES.includes(value);
+}
+function normalizeAuthRoles(roles) {
+  return AUTH_ROLES.filter((role) => roles.includes(role));
+}
+function hasAuthRole(roles, required) {
+  return roles.includes("administrator") || roles.includes(required) || required === "read" && roles.includes("guest") || required === "read" && roles.includes("control");
+}
+function hasAccountControls(roles) {
+  return roles.length > 0 && !roles.includes("guest");
+}
+function decodeRoles(value, context) {
+  if (!Array.isArray(value) || !value.every(isAuthRole)) {
+    throw new TypeError(`${context} has invalid roles`);
+  }
+  return normalizeAuthRoles(value);
+}
+function decodeAuthSession(value) {
+  if (typeof value !== "object" || value === null) {
+    throw new TypeError("The authentication response is malformed");
+  }
+  const session = value;
+  if (typeof session.authenticated !== "boolean") {
+    throw new TypeError("The authentication response has no authenticated flag");
+  }
+  if (session.auth_disabled !== void 0 && typeof session.auth_disabled !== "boolean") {
+    throw new TypeError("The authentication response has an invalid auth_disabled flag");
+  }
+  const decoded = {
+    authenticated: session.authenticated,
+    roles: decodeRoles(session.roles, "The authentication response")
+  };
+  if (session.username !== void 0) {
+    if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
+    decoded.username = session.username;
+  }
+  if (session.auth_disabled !== void 0) decoded.auth_disabled = session.auth_disabled;
+  return decoded;
+}
+var authDisabledSession = {
+  authenticated: true,
+  roles: [...AUTH_ADMIN_ROLES],
+  auth_disabled: true
+};
+async function fetchAuthSession() {
+  try {
+    const response = await fetch("/auth/session");
+    if (response.status === 404) return authDisabledSession;
+    if (!response.ok) return { authenticated: false, roles: [] };
+    return decodeAuthSession(await response.json());
+  } catch (error) {
+    console.error("Auth check failed:", error);
+    return { authenticated: false, roles: [] };
+  }
+}
+async function login(username, password) {
+  const response = await fetch("/auth/login", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ username, password })
+  });
+  if (response.status === 404) return authDisabledSession;
+  if (!response.ok) {
+    const message = await response.text();
+    throw new Error(message || "Login failed");
+  }
+  return decodeAuthSession(await response.json());
+}
+async function userRequest(path, init) {
+  const response = await fetch(path, init);
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({}));
+    throw new Error(payload.error || `User operation failed (${response.status})`);
+  }
+  return response;
+}
+async function listUsers() {
+  const value = await userRequest("/auth/users").then((response) => response.json());
+  if (!Array.isArray(value) || !value.every((user) => {
+    if (typeof user !== "object" || user === null) return false;
+    const record = user;
+    return typeof record.username === "string" && typeof record.enabled === "boolean" && Array.isArray(record.roles) && record.roles.every(isAuthRole);
+  })) {
+    throw new TypeError("The user list response is malformed");
+  }
+  return value.map((user) => ({ ...user, roles: normalizeAuthRoles(user.roles) }));
+}
+async function createUser(username, password, roles, enabled = true) {
+  await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, roles, enabled }) });
+}
+async function updateUser(username, changes) {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
+}
+async function changeOwnPassword(currentPassword, newPassword) {
+  await userRequest("/auth/account/password", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ current_password: currentPassword, new_password: newPassword })
+  });
+}
+async function deleteUser(username) {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
+}
+async function logout() {
+  const response = await fetch("/auth/logout", { method: "POST" });
+  if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
+}
+
+export {
+  AUTH_ROLES,
+  AUTH_ADMIN_ROLES,
+  AUTH_ROLE_LABELS,
+  normalizeAuthRoles,
+  hasAuthRole,
+  hasAccountControls,
+  fetchAuthSession,
+  login,
+  listUsers,
+  createUser,
+  updateUser,
+  changeOwnPassword,
+  deleteUser,
+  logout
+};
@@ -214,6 +214,16 @@ function summarizeAprsPayload(packet) {
  const text = info.replace(/^[>;<?]/, "").trim();
  return text.length ? text : null;
 }
+function maidenheadForLatLon(lat, lon) {
+  const adjustedLon = lon + 180;
+  const adjustedLat = lat + 90;
+  const field = String.fromCharCode(65 + Math.floor(adjustedLon / 20)) + String.fromCharCode(65 + Math.floor(adjustedLat / 10));
+  const square = String(Math.floor(adjustedLon % 20 / 2)) + String(Math.floor(adjustedLat % 10));
+  const subLon = adjustedLon % 2 * 60 / 5;
+  const subLat = adjustedLat % 1 * 60 / 2.5;
+  const sub = String.fromCharCode(97 + Math.floor(subLon)) + String.fromCharCode(97 + Math.floor(subLat));
+  return `${field}${square}${sub}`.toUpperCase();
+}
 function renderAprsPacketRow(packet, options = {}) {
  const row = document.createElement("details");
  row.className = "aprs-packet";
@@ -224,7 +234,7 @@ function renderAprsPacketRow(packet, options = {}) {
  const summary = summarizeAprsPayload(packet);
  const hasPosition = packet.lat != null && packet.lon != null;
  const qrzHref = `https://qrzcq.com/call/${encodeURIComponent(packet.srcCall || "")}`;
-  row.innerHTML = `<summary class="decode-line"><span class="aprs-time">${escapeAprsHtml(time)}</span>` + (options.badge ? `<span class="aprs-badge aprs-badge-band">${escapeAprsHtml(options.badge)}</span>` : "") + renderAprsSymbolSlot(packet, escapeAprsHtml) + `<span class="aprs-call">${escapeAprsHtml(packet.srcCall ?? "")}</span><span class="aprs-badge aprs-badge-type aprs-badge-type-${category}">${escapeAprsHtml(aprsCategoryLabel(category))}</span><span class="decode-line-summary">${summary ? escapeAprsHtml(summary) : renderAprsInfo(packet)}</span>` + (packet.crcOk ? "" : '<span class="aprs-badge aprs-badge-crc">CRC</span>') + (options.distance ? `<span class="decode-line-distance">${escapeAprsHtml(options.distance)}</span>` : "") + `</summary><div class="decode-expanded"><div class="decode-expanded-meta"><span>&gt;${escapeAprsHtml(packet.destCall || "--")}</span><span>${escapeAprsHtml(packet.path || "no path")}</span><span>${escapeAprsHtml(aprsAgeText(packet._tsMs))}</span><span>CRC ${packet.crcOk ? "ok" : "failed"}</span>` + (hasPosition ? `<a class="aprs-pos" href="javascript:void(0)" data-aprs-map="${packet.lat},${packet.lon}">${packet.lat?.toFixed(5)}, ${packet.lon?.toFixed(5)}</a>` : "") + `</div><div class="decode-expanded-raw">${renderAprsInfo(packet)}</div>` + (packet.info_bytes?.length ? `<div class="decode-expanded-bytes">${escapeAprsHtml(aprsHexBytes(packet.info_bytes))}</div>` : "") + `<div class="aprs-row-actions">` + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-map="${packet.lat},${packet.lon}">Map</button>` : "") + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-copy="${packet.lat},${packet.lon}">Copy Coords</button>` : "") + `<a class="aprs-inline-btn" href="${qrzHref}" target="_blank" rel="noopener">QRZ</a></div></div>`;
+  row.innerHTML = `<summary class="decode-line"><span class="aprs-time">${escapeAprsHtml(time)}</span>` + (options.badge ? `<span class="aprs-badge aprs-badge-band">${escapeAprsHtml(options.badge)}</span>` : "") + renderAprsSymbolSlot(packet, escapeAprsHtml) + `<span class="aprs-call">${escapeAprsHtml(packet.srcCall ?? "")}</span><span class="aprs-badge aprs-badge-type aprs-badge-type-${category}">${escapeAprsHtml(aprsCategoryLabel(category))}</span><span class="decode-line-summary">${summary ? escapeAprsHtml(summary) : renderAprsInfo(packet)}</span>` + (packet.crcOk ? "" : '<span class="aprs-badge aprs-badge-crc">CRC</span>') + (options.distance ? `<span class="decode-line-distance">${escapeAprsHtml(options.distance)}</span>` : "") + `</summary><div class="decode-expanded"><div class="decode-expanded-meta"><span>&gt;${escapeAprsHtml(packet.destCall || "--")}</span><span>${escapeAprsHtml(packet.path || "no path")}</span><span>${escapeAprsHtml(aprsAgeText(packet._tsMs))}</span><span>CRC ${packet.crcOk ? "ok" : "failed"}</span>` + (hasPosition ? `<a class="aprs-pos" href="javascript:void(0)" data-aprs-map="${packet.lat},${packet.lon}">${packet.lat?.toFixed(5)}, ${packet.lon?.toFixed(5)}</a>` : "") + `</div><div class="decode-expanded-raw">${renderAprsInfo(packet)}</div>` + (packet.info_bytes?.length ? `<div class="decode-expanded-bytes">${escapeAprsHtml(aprsHexBytes(packet.info_bytes))}</div>` : "") + `<div class="aprs-row-actions">` + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-map="${packet.lat},${packet.lon}">Map</button>` : "") + (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-copy="${packet.lat},${packet.lon}">Copy Coords</button>` : "") + `<a class="aprs-inline-btn" href="${qrzHref}" target="_blank" rel="noopener">QRZ</a>` + (options.onLog && packet.srcCall ? '<button class="aprs-inline-btn" type="button" data-aprs-log="1">Log</button>' : "") + `</div></div>`;
  row.querySelectorAll("[data-aprs-map]").forEach((element) => {
    element.addEventListener("click", (event) => {
      event.preventDefault();
@@ -233,6 +243,15 @@ function renderAprsPacketRow(packet, options = {}) {
      if (Number.isFinite(lat) && Number.isFinite(lon)) options.onMap?.(lat, lon);
    });
  });
+  const logButton = row.querySelector("[data-aprs-log]");
+  if (logButton) {
+    logButton.addEventListener("click", (event) => {
+      event.preventDefault();
+      event.stopPropagation();
+      const grid = packet.lat != null && packet.lon != null ? maidenheadForLatLon(packet.lat, packet.lon) : null;
+      options.onLog?.(packet.srcCall ?? "", grid);
+    });
+  }
  const copyButton = row.querySelector("[data-aprs-copy]");
  if (copyButton) {
    copyButton.addEventListener("click", (event) => {
@@ -152,6 +152,24 @@ function initializeFtxDecoder(config) {
      second: "2-digit"
    });
    row.innerHTML = `<span class="ft8-time">${time}</span><span class="ft8-snr">${snr?.toFixed(1) ?? "--"}</span><span class="ft8-dt">${delta?.toFixed(2) ?? "--"}</span><span class="ft8-freq">${frequency?.toFixed(0) ?? "--"}</span><span class="ft8-msg">${renderMessage(raw)}</span>`;
+    const station = bridge.ft8ExtractLikelyCallsign?.(raw) ?? extractFtxCallsign(raw);
+    if (station) {
+      const log = document.createElement("button");
+      log.type = "button";
+      log.className = "ft8-log-btn";
+      log.textContent = "Log";
+      log.title = `Start a log entry for ${station}`;
+      log.addEventListener("click", (event) => {
+        event.stopPropagation();
+        const details = bridge.ft8ExtractLocatorDetails?.(raw) ?? extractFtxLocatorDetails(raw);
+        bridge.logContact?.({
+          call: station,
+          gridsquare: details.find((detail) => detail.station === station)?.grid,
+          decoder: id
+        });
+      });
+      row.appendChild(log);
+    }
    return row;
  };
  const render = () => {
@@ -168,19 +186,22 @@ function initializeFtxDecoder(config) {
    }
    messagesElement.replaceChildren(fragment);
  };
-  const normalize = (message) => {
+  const plotLocator = (message) => {
    const raw = message.message ?? "";
    const locatorDetails = bridge.ft8ExtractLocatorDetails?.(raw) ?? extractFtxLocatorDetails(raw);
    const grids = locatorDetails.length > 0 ? locatorDetails.map(({ grid }) => grid) : bridge.ft8ExtractAllGrids?.(raw) ?? extractFtxGrids(raw);
+    if (grids.length === 0) return;
    const station = bridge.ft8ExtractLikelyCallsign?.(raw) ?? extractFtxCallsign(raw);
    const frequency = displayFrequency(message.freq_hz);
-    if (grids.length > 0) {
-      bridge.mapAddLocator?.(raw, grids, id, station, {
-        ...message,
-        freq_hz: frequency ?? message.freq_hz,
-        locator_details: locatorDetails
-      });
-    }
+    bridge.mapAddLocator?.(raw, grids, id, station, {
+      ...message,
+      freq_hz: frequency ?? message.freq_hz,
+      locator_details: locatorDetails
+    });
+  };
+  const normalize = (message) => {
+    const frequency = displayFrequency(message.freq_hz);
+    plotLocator(message);
    return {
      // The rig that heard it, kept so the mini view can tell a decode of the
      // rig on screen from one a background rig made on another band.
@@ -240,6 +261,10 @@ function initializeFtxDecoder(config) {
    rerender: () => {
      bridge.updateFt8Bar?.();
      render();
+    },
+    // Oldest first, so the map builds the grids up in the order they were heard.
+    syncMap: () => {
+      for (const message of [...history].reverse()) plotLocator(message);
    }
  });
  bridge.registerFt8FamilyBarRenderer?.(id, barFrames);
@@ -1,6 +1,6 @@
 import {
  initializeFtxDecoder
-} from "./chunk-PAKFJPA2.js";
+} from "./chunk-WU5EWJX4.js";
 import "./chunk-S57W63QN.js";
 import "./chunk-KL66PICH.js";

@@ -1,6 +1,6 @@
 import {
  initializeFtxDecoder
-} from "./chunk-PAKFJPA2.js";
+} from "./chunk-WU5EWJX4.js";
 import "./chunk-S57W63QN.js";
 import "./chunk-KL66PICH.js";

@@ -2,7 +2,7 @@ import {
  initializeFt8FamilyBar,
  initializeFtxDecoder,
  installFtxCompatibilityHelpers
-} from "./chunk-PAKFJPA2.js";
+} from "./chunk-WU5EWJX4.js";
 import "./chunk-S57W63QN.js";
 import "./chunk-KL66PICH.js";

@@ -4,7 +4,7 @@ import {
  collapseAprsDuplicates,
  normalizeAprsPacket,
  renderAprsPacketRow
-} from "./chunk-OPEIVJGD.js";
+} from "./chunk-REYSUJQ4.js";
 import {
  forActiveRig,
  isActiveRigDecode
@@ -149,17 +149,32 @@ function resetHfAprsHistoryView() {
  if (hfAprsPacketsEl) hfAprsPacketsEl.innerHTML = "";
  hfAprsPacketHistory = [];
  renderHfAprsHistory();
+  hfAprsWindow.clearMapMarkersByType?.("hf_aprs");
 }
 function pruneHfAprsHistoryView() {
  pruneHfAprsPacketHistory();
  renderHfAprsHistory();
 }
+function plotHfAprsPacket(pkt) {
+  if (pkt.lat == null || pkt.lon == null || !hfAprsWindow.aprsMapAddStation) return;
+  hfAprsWindow.aprsMapAddStation(
+    pkt.srcCall ?? "",
+    pkt.lat,
+    pkt.lon,
+    pkt.info ?? "",
+    pkt.symbolTable,
+    pkt.symbolCode,
+    pkt,
+    "hf_aprs"
+  );
+}
 function addHfAprsPacket(pkt) {
  const tsMs = Number.isFinite(pkt.ts_ms) ? Number(pkt.ts_ms) : Date.now();
  pkt._tsMs = tsMs;
  pkt._ts = new Date(tsMs).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", second: "2-digit" });
  hfAprsPacketHistory.unshift(pkt);
  pruneHfAprsPacketHistory();
+  plotHfAprsPacket(pkt);
  scheduleHfAprsHistoryRender();
 }
 function normalizeServerHfAprsPacket(pkt) {
@@ -174,6 +189,7 @@ function onServerHfAprsBatch(packets) {
    const tsMs = Number.isFinite(next.ts_ms) ? Number(next.ts_ms) : Date.now();
    next._tsMs = tsMs;
    next._ts = new Date(tsMs).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", second: "2-digit" });
+    plotHfAprsPacket(next);
    normalized.push(next);
  }
  normalized.reverse();
@@ -248,5 +264,9 @@ window.trxPluginRuntime.registerDecoder({
  restore: onServerHfAprsBatch,
  reset: resetHfAprsHistoryView,
  prune: pruneHfAprsHistoryView,
-  rerender: renderHfAprsHistory
+  rerender: renderHfAprsHistory,
+  // Oldest first, so station tracks are rebuilt in the order they happened.
+  syncMap: () => {
+    for (const entry of [...hfAprsPacketHistory].reverse()) plotHfAprsPacket(entry);
+  }
 });
@@ -0,0 +1,449 @@
+import {
+  hasAuthRole
+} from "./chunk-FT2RH7BL.js";
+import {
+  hostCore,
+  hostState
+} from "./chunk-KL66PICH.js";
+
+// src/plugins/logbook.ts
+var bridge = window;
+var el = (id) => document.getElementById(id);
+var form = el("log-entry-form");
+var callInput = el("log-call");
+var freqInput = el("log-freq");
+var modeInput = el("log-mode");
+var rstSentInput = el("log-rst-sent");
+var rstRcvdInput = el("log-rst-rcvd");
+var gridInput = el("log-grid");
+var nameInput = el("log-name");
+var commentInput = el("log-comment");
+var operatorInput = el("log-operator");
+var rowsBody = el("log-rows");
+var summaryEl = el("log-summary");
+var workedEl = el("log-worked-before");
+var clockEl = el("log-clock");
+var stationCallEl = el("log-station-callsign");
+var stationRigEl = el("log-station-rig-name");
+var stationGridEl = el("log-station-grid");
+var filterCall = el("log-filter-call");
+var filterBand = el("log-filter-band");
+var filterMode = el("log-filter-mode");
+var importBtn = el("log-import-btn");
+var importFile = el("log-import-file");
+var exportLink = el("log-export-btn");
+var clearBtn = el("log-clear-btn");
+var saveBtn = el("log-save-btn");
+var contestIdInput = el("log-contest-id");
+var stxInput = el("log-stx");
+var srxInput = el("log-srx");
+var statisticsRows = el("log-statistics-rows");
+var cabrilloContest = el("log-cbr-contest");
+var cabrilloCallsign = el("log-cbr-callsign");
+var cabrilloOperator = el("log-cbr-operator");
+var cabrilloPower = el("log-cbr-power");
+var cabrilloScore = el("log-cbr-score");
+var cabrilloExport = el("log-cbr-export");
+var entryStartedAt = null;
+var entryRigId = null;
+var entryRigName = null;
+var entryGrid = null;
+var qsos = [];
+var workedRequest = 0;
+function canWriteLogbook() {
+  return !hostState.authEnabled || hasAuthRole(hostState.authRoles, "write");
+}
+function notify(message, kind) {
+  if (bridge.trxUi.notify) bridge.trxUi.notify(message, kind ? { kind } : void 0);
+  else hostCore.showHint(message, 2e3);
+}
+async function getJson(path) {
+  const response = await fetch(path);
+  if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+  return await response.json();
+}
+function formatFreq(hz) {
+  if (!Number.isFinite(hz) || hz <= 0) return "";
+  return String(Number((hz / 1e6).toFixed(6)));
+}
+function parseFreq(text) {
+  const value = Number(text.trim().replace(/\s+/g, "").replace(",", "."));
+  if (!Number.isFinite(value) || value <= 0) return null;
+  return value < 1e5 ? Math.round(value * 1e6) : Math.round(value);
+}
+function numberOrNull(text) {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) return null;
+  const value = Number(trimmed);
+  return Number.isSafeInteger(value) ? value : null;
+}
+function utcDate(iso) {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
+}
+function utcTime(iso) {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(11, 19);
+}
+async function openEntry(seed = {}) {
+  const params = new URLSearchParams();
+  if (hostState.lastActiveRigId) params.set("remote", hostState.lastActiveRigId);
+  if (seed.decoder) params.set("decoder", seed.decoder);
+  if (seed.call) params.set("call", seed.call);
+  if (seed.gridsquare) params.set("gridsquare", seed.gridsquare);
+  try {
+    const prefill = await getJson(`/api/logbook/prefill?${params.toString()}`);
+    applyPrefill(prefill);
+  } catch (error) {
+    console.error("logbook prefill failed", error);
+  }
+}
+function applyPrefill(prefill) {
+  entryStartedAt = prefill.started_at;
+  entryRigId = prefill.rig_id;
+  entryRigName = prefill.my_rig;
+  if (freqInput) freqInput.value = formatFreq(prefill.freq_hz);
+  if (modeInput) modeInput.value = prefill.submode ?? prefill.mode;
+  if (callInput && prefill.call) callInput.value = prefill.call;
+  if (gridInput && prefill.gridsquare) gridInput.value = prefill.gridsquare;
+  if (stationRigEl) stationRigEl.textContent = prefill.my_rig ?? "no rig";
+  showClock(prefill);
+  updateWorkedBefore();
+}
+function showClock(prefill) {
+  if (!clockEl) return;
+  const time = utcTime(prefill.started_at);
+  const drift = Math.abs(Date.now() - prefill.epoch_ms);
+  clockEl.textContent = drift > 1e3 ? `${time}Z · your clock is ${(drift / 1e3).toFixed(0)}s out` : `${time}Z`;
+  clockEl.classList.toggle("is-adrift", drift > 1e3);
+}
+function resetEntry() {
+  for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput, srxInput]) {
+    if (input) input.value = "";
+  }
+  if (workedEl) workedEl.textContent = "";
+  void openEntry();
+}
+async function submitEntry(event) {
+  event.preventDefault();
+  const call = callInput?.value.trim() ?? "";
+  if (!call) {
+    notify("A contact needs a callsign", "error");
+    callInput?.focus();
+    return;
+  }
+  const freqHz = parseFreq(freqInput?.value ?? "");
+  if (freqHz == null) {
+    notify("A contact needs a frequency", "error");
+    freqInput?.focus();
+    return;
+  }
+  const typedMode = (modeInput?.value ?? "").trim().toUpperCase();
+  const isSideband = typedMode === "USB" || typedMode === "LSB";
+  const body = {
+    // The server stamps the time; this is the one it gave when the entry
+    // opened, so a contact logged five minutes later keeps the time it started.
+    started_at: entryStartedAt,
+    call,
+    freq_hz: freqHz,
+    mode: isSideband ? "SSB" : typedMode,
+    submode: isSideband ? typedMode : null,
+    rst_sent: rstSentInput?.value ?? null,
+    rst_rcvd: rstRcvdInput?.value ?? null,
+    gridsquare: gridInput?.value ?? null,
+    name: nameInput?.value ?? null,
+    comment: commentInput?.value ?? null,
+    contest_id: contestIdInput?.value ?? null,
+    // The exchange is a number when it is a serial and a word when it is a
+    // zone or a section; both are kept, and the log writes whichever it has.
+    stx: numberOrNull(stxInput?.value),
+    stx_string: numberOrNull(stxInput?.value) == null ? stxInput?.value ?? null : null,
+    srx: numberOrNull(srxInput?.value),
+    srx_string: numberOrNull(srxInput?.value) == null ? srxInput?.value ?? null : null,
+    station_callsign: stationCallEl?.textContent?.trim() ?? null,
+    operator: operatorInput?.value ?? null,
+    my_gridsquare: entryGrid,
+    my_rig: entryRigName,
+    rig_id: entryRigId
+  };
+  if (saveBtn) saveBtn.disabled = true;
+  try {
+    const response = await fetch("/api/logbook", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body)
+    });
+    if (!response.ok) {
+      const detail = await response.json().catch(() => ({}));
+      throw new Error(detail.error ?? `HTTP ${String(response.status)}`);
+    }
+    notify(`${call} logged`);
+    const sent = numberOrNull(stxInput?.value);
+    resetEntry();
+    if (stxInput && sent != null) stxInput.value = String(sent + 1);
+    await refreshLog();
+  } catch (error) {
+    notify(`Could not log: ${error instanceof Error ? error.message : String(error)}`, "error");
+  } finally {
+    if (saveBtn) saveBtn.disabled = false;
+  }
+}
+function updateWorkedBefore() {
+  if (!workedEl) return;
+  const call = callInput?.value.trim() ?? "";
+  if (call.length < 3) {
+    workedEl.textContent = "";
+    return;
+  }
+  const request = ++workedRequest;
+  void getJson(
+    `/api/logbook/worked/${encodeURIComponent(call)}`
+  ).then((answer) => {
+    if (request !== workedRequest || !workedEl) return;
+    if (answer.worked.length === 0) {
+      workedEl.textContent = "Not worked before";
+      workedEl.classList.remove("is-worked");
+      return;
+    }
+    const where = answer.worked.map((entry) => `${entry.band} ${entry.mode}`).join(", ");
+    workedEl.textContent = `Worked before: ${where}`;
+    workedEl.classList.add("is-worked");
+  }).catch(() => {
+  });
+}
+function currentQuery() {
+  const params = new URLSearchParams();
+  const call = filterCall?.value.trim();
+  if (call) params.set("call", call);
+  if (filterBand?.value) params.set("band", filterBand.value);
+  if (filterMode?.value) params.set("mode", filterMode.value);
+  return params.toString();
+}
+async function refreshLog() {
+  try {
+    const query = currentQuery();
+    const answer = await getJson(
+      `/api/logbook${query ? `?${query}` : ""}`
+    );
+    qsos = answer.qsos;
+    renderRows();
+    renderFilterOptions();
+    if (summaryEl) {
+      summaryEl.textContent = query ? `${String(qsos.length)} of ${String(answer.total)} contacts` : `${String(answer.total)} contact${answer.total === 1 ? "" : "s"}`;
+    }
+    if (exportLink) exportLink.href = `/api/logbook/export.adi${query ? `?${query}` : ""}`;
+    await refreshStatistics();
+  } catch (error) {
+    console.error("logbook read failed", error);
+  }
+}
+async function refreshStatistics() {
+  if (!statisticsRows) return;
+  try {
+    const answer = await getJson("/api/logbook/statistics");
+    if (answer.bands.length === 0) {
+      statisticsRows.innerHTML = '<tr><td colspan="4" class="log-empty">Nothing worked yet.</td></tr>';
+      return;
+    }
+    const fragment = document.createDocumentFragment();
+    for (const band of answer.bands) {
+      const row = document.createElement("tr");
+      for (const value of [band.band, band.contacts, band.stations, band.confirmed]) {
+        const cell = document.createElement("td");
+        cell.textContent = String(value);
+        row.appendChild(cell);
+      }
+      fragment.appendChild(row);
+    }
+    statisticsRows.replaceChildren(fragment);
+  } catch (error) {
+    console.error("logbook statistics failed", error);
+  }
+}
+function syncCabrilloLink() {
+  if (!cabrilloExport) return;
+  const params = new URLSearchParams();
+  const contest = cabrilloContest?.value.trim();
+  if (contest) {
+    params.set("contest", contest);
+  }
+  const callsign = cabrilloCallsign?.value.trim() || (stationCallEl?.textContent?.trim() ?? "");
+  if (callsign) params.set("callsign", callsign);
+  if (cabrilloOperator?.value) params.set("category_operator", cabrilloOperator.value);
+  if (cabrilloPower?.value) params.set("category_power", cabrilloPower.value);
+  const score = numberOrNull(cabrilloScore?.value);
+  if (score != null) params.set("claimed_score", String(score));
+  const operator = operatorInput?.value.trim();
+  if (operator) params.set("operators", operator);
+  cabrilloExport.href = `/api/logbook/export.cbr?${params.toString()}`;
+}
+function renderRows() {
+  if (!rowsBody) return;
+  if (qsos.length === 0) {
+    rowsBody.innerHTML = '<tr><td colspan="10" class="log-empty">No contacts yet. Work someone and log them here, or bring a log in with Import ADIF.</td></tr>';
+    return;
+  }
+  const fragment = document.createDocumentFragment();
+  for (const qso of qsos) {
+    const row = document.createElement("tr");
+    row.dataset.qsoId = qso.id;
+    const cells = [
+      utcDate(qso.started_at),
+      utcTime(qso.started_at),
+      qso.call,
+      qso.band ?? "",
+      qso.submode ?? qso.mode,
+      qso.rst_sent ?? "",
+      qso.rst_rcvd ?? "",
+      qso.gridsquare ?? "",
+      qso.my_rig ?? "",
+      qso.confirmed ? "✓" : ""
+    ];
+    for (const [index, value] of cells.entries()) {
+      const cell = document.createElement("td");
+      cell.textContent = value ?? "";
+      if (index === 2) cell.className = "log-cell-call";
+      row.appendChild(cell);
+    }
+    const actions = document.createElement("td");
+    if (!canWriteLogbook()) {
+      row.appendChild(actions);
+      fragment.appendChild(row);
+      continue;
+    }
+    const confirm = document.createElement("button");
+    confirm.type = "button";
+    confirm.className = "log-row-btn";
+    confirm.textContent = qso.confirmed ? "Unconfirm" : "Confirm";
+    confirm.title = qso.confirmed ? "Mark this contact as not confirmed" : "Mark this contact confirmed by QSL";
+    confirm.addEventListener("click", () => {
+      void setConfirmed(qso, !qso.confirmed);
+    });
+    actions.appendChild(confirm);
+    const remove = document.createElement("button");
+    remove.type = "button";
+    remove.className = "log-row-btn";
+    remove.textContent = "Delete";
+    remove.setAttribute("aria-label", `Delete the contact with ${qso.call}`);
+    remove.addEventListener("click", () => {
+      void deleteQso(qso);
+    });
+    actions.appendChild(remove);
+    row.appendChild(actions);
+    fragment.appendChild(row);
+  }
+  rowsBody.replaceChildren(fragment);
+}
+function renderFilterOptions() {
+  for (const [select, values] of [
+    [filterBand, [...new Set(qsos.map((q) => q.band).filter((b) => !!b))]],
+    [filterMode, [...new Set(qsos.map((q) => q.submode ?? q.mode).filter(Boolean))]]
+  ]) {
+    if (!select) continue;
+    const chosen = select.value;
+    const known = new Set([...select.options].map((option) => option.value));
+    for (const value of [...values].sort()) {
+      if (known.has(value)) continue;
+      select.add(new Option(value, value));
+    }
+    select.value = chosen;
+  }
+}
+async function setConfirmed(qso, confirmed) {
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ...qso,
+        // A card is a card: this is the paper one, and an electronic
+        // confirmation the log already holds is left where it is.
+        qsl_rcvd: confirmed ? "Y" : "N"
+      })
+    });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error) {
+    notify(`Could not update: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+async function deleteQso(qso) {
+  const confirmed = await bridge.trxUi.confirm({
+    title: "Delete this contact?",
+    message: `${qso.call} on ${qso.band ?? formatFreq(qso.freq_hz)} will be removed from the log.`,
+    confirmLabel: "Delete"
+  });
+  if (!confirmed) return;
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, { method: "DELETE" });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error) {
+    notify(`Could not delete: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+async function importAdif(file) {
+  try {
+    const response = await fetch("/api/logbook/import", { method: "POST", body: await file.arrayBuffer() });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    const outcome = await response.json();
+    const parts = [`${String(outcome.added)} added`];
+    if (outcome.duplicate > 0) parts.push(`${String(outcome.duplicate)} already held`);
+    if (outcome.rejected.length > 0) parts.push(`${String(outcome.rejected.length)} not readable`);
+    notify(parts.join(", "));
+    await refreshLog();
+  } catch (error) {
+    notify(`Import failed: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+function renderStation() {
+  const callsign = hostState.ownerCallsign ?? "";
+  if (stationCallEl) stationCallEl.textContent = callsign || "no callsign set";
+  if (operatorInput && !operatorInput.value) operatorInput.value = callsign;
+  if (stationGridEl) {
+    const grid = hostState.serverLat != null && hostState.serverLon != null ? hostCore.latLonToMaidenhead(hostState.serverLat, hostState.serverLon) : "";
+    entryGrid = grid || null;
+    stationGridEl.textContent = grid;
+  }
+}
+form?.addEventListener("submit", (event) => {
+  void submitEntry(event);
+});
+clearBtn?.addEventListener("click", resetEntry);
+callInput?.addEventListener("input", updateWorkedBefore);
+for (const control of [filterCall, filterBand, filterMode]) {
+  control?.addEventListener("input", () => {
+    void refreshLog();
+  });
+  control?.addEventListener("change", () => {
+    void refreshLog();
+  });
+}
+for (const control of [cabrilloContest, cabrilloCallsign, cabrilloOperator, cabrilloPower, cabrilloScore]) {
+  control?.addEventListener("input", syncCabrilloLink);
+  control?.addEventListener("change", syncCabrilloLink);
+}
+importBtn?.addEventListener("click", () => {
+  importFile?.click();
+});
+importFile?.addEventListener("change", () => {
+  const file = importFile.files?.[0];
+  if (file) void importAdif(file);
+  importFile.value = "";
+});
+if (canWriteLogbook()) {
+  bridge.logContact = (seed) => {
+    bridge.navigateToTab?.("logbook");
+    void openEntry(seed).then(() => callInput?.focus());
+  };
+} else {
+  if (form) form.style.display = "none";
+  if (importBtn) importBtn.style.display = "none";
+}
+renderStation();
+if (cabrilloCallsign && !cabrilloCallsign.value) {
+  cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
+}
+syncCabrilloLink();
+if (canWriteLogbook()) void openEntry();
+void refreshLog();
@@ -1,6 +1,6 @@
 import {
  aprsSymbolSprite
-} from "./chunk-OPEIVJGD.js";
+} from "./chunk-REYSUJQ4.js";

 // src/map-core.ts
 function mapEl(id) {
@@ -60,7 +60,7 @@ var mapWindow = window;
  const decodeContactPaths = /* @__PURE__ */ new Map();
  let selectedMapQsoKey = null;
  const mapMarkers = /* @__PURE__ */ new Set();
-  const DEFAULT_MAP_SOURCE_FILTER = { ais: true, vdes: true, aprs: true, bookmark: false, ft8: true, ft4: true, ft2: true, wspr: true, sat: false };
+  const DEFAULT_MAP_SOURCE_FILTER = { ais: true, vdes: true, aprs: true, hf_aprs: true, bookmark: false, ft8: true, ft4: true, ft2: true, wspr: true, sat: false };
  const mapFilter = { ...DEFAULT_MAP_SOURCE_FILTER };
  const MAP_FILTER_ALL_KEY = "__all";
  const mapLocatorFilter = { phase: "band", bands: /* @__PURE__ */ new Set() };
@@ -128,6 +128,12 @@ var mapWindow = window;
    }
    return trimmed;
  }
+  function aprsEntrySource(entry) {
+    return entry?.type === "hf_aprs" ? "hf_aprs" : "aprs";
+  }
+  function aprsStationKey(call, source) {
+    return source === "aprs" ? call : `${source}:${call}`;
+  }
  function refreshAprsTrack(call, entry) {
    if (!entry) return;
    if (!Array.isArray(entry.trackPoints) || entry.trackPoints.length < 2) {
@@ -149,7 +155,7 @@ var mapWindow = window;
      lineJoin: "round",
      interactive: false
    });
-    track.__trxType = "aprs";
+    track.__trxType = aprsEntrySource(entry);
    track._aprsCall = call;
    entry.track = track;
  }
@@ -381,6 +387,7 @@ var mapWindow = window;
  }
  function mapSourceLabel(type) {
    if (type === "bookmark") return "Bookmarks";
+    if (type === "hf_aprs") return "HF APRS";
    return String(type || "").toUpperCase();
  }
  function locatorFilterColor(type) {
@@ -396,6 +403,7 @@ var mapWindow = window;
    if (type === "vdes") return "#a78bfa";
    if (type === "sat") return "#f59e0b";
    if (type === "aprs") return "#00d17f";
+    if (type === "hf_aprs") return "#fb7185";
    return locatorFilterColor(type);
  }
  function bandForHz(hz) {
@@ -931,10 +939,8 @@ var mapWindow = window;
      }
    }
    for (const entry of stationMarkers.values()) {
-      if (entry?.type === "aprs" && entry?.visibleInHistoryWindow) {
-        availableSources.add("aprs");
-        break;
-      }
+      if (!entry?.visibleInHistoryWindow) continue;
+      availableSources.add(aprsEntrySource(entry));
    }
    const bandMap = /* @__PURE__ */ new Map();
    for (const entry of locatorMarkers.values()) {
@@ -966,7 +972,7 @@ var mapWindow = window;
    for (const key of Array.from(mapLocatorFilter.bands)) {
      if (!bandMap.has(key)) mapLocatorFilter.bands.delete(key);
    }
-    const sourceItems = ["ais", "vdes", "aprs", "bookmark", "ft8", "ft4", "ft2", "wspr"].filter((key) => availableSources.has(key)).map((key) => ({
+    const sourceItems = ["ais", "vdes", "aprs", "hf_aprs", "bookmark", "ft8", "ft4", "ft2", "wspr"].filter((key) => availableSources.has(key)).map((key) => ({
      key,
      label: mapSourceLabel(key),
      color: mapSourceColor(key),
@@ -1028,9 +1034,10 @@ var mapWindow = window;
      }
      return parts.join(" ").toLowerCase();
    }
-    if (type === "aprs") {
-      const call = marker?._aprsCall ? String(marker._aprsCall) : "";
-      const entry = stationMarkers.get(call);
+    if (type === "aprs" || type === "hf_aprs") {
+      const key = marker?._aprsCall ? String(marker._aprsCall) : "";
+      const entry = stationMarkers.get(key);
+      const call = entry?.call ?? key;
      const info = entry?.info ? String(entry.info) : "";
      const pktRaw = entry?.pkt?.raw ? String(entry.pkt.raw) : "";
      return `${call} ${info} ${pktRaw}`.toLowerCase();
@@ -1200,9 +1207,10 @@ var mapWindow = window;
    }
  };
  mapWindow.clearMapMarkersByType = function(type) {
-    if (type === "aprs") {
+    if (type === "aprs" || type === "hf_aprs") {
      selectedAprsTrackCall = null;
-      stationMarkers.forEach((entry) => {
+      stationMarkers.forEach((entry, key) => {
+        if (aprsEntrySource(entry) !== type) return;
        if (entry && entry.marker) {
          if (aprsMap && aprsMap.hasLayer(entry.marker)) entry.marker.removeFrom(aprsMap);
          mapMarkers.delete(entry.marker);
@@ -1211,8 +1219,8 @@ var mapWindow = window;
          if (aprsMap && aprsMap.hasLayer(entry.track)) entry.track.removeFrom(aprsMap);
          mapMarkers.delete(entry.track);
        }
+        stationMarkers.delete(key);
      });
-      stationMarkers.clear();
      return;
    }
    if (type === "ais") {
@@ -1448,13 +1456,15 @@ var mapWindow = window;
        if (!ll) return;
        const entry = stationMarkers.get(marker._aprsCall);
        if (!entry) return;
-        e.popup.setContent(buildAprsPopupHtml(marker._aprsCall, ll.lat, ll.lng, entry.info || "", entry.pkt));
+        const source = aprsEntrySource(entry);
+        const call = entry.call ?? String(marker._aprsCall);
+        e.popup.setContent(buildAprsPopupHtml(call, ll.lat, ll.lng, entry.info || "", entry.pkt));
        refreshAprsTrack(String(marker._aprsCall), entry);
-        if (entry.track && aprsMap && mapFilter.aprs && !aprsMap.hasLayer(entry.track)) {
+        if (entry.track && aprsMap && mapFilter[source] && !aprsMap.hasLayer(entry.track)) {
          entry.track.addTo(aprsMap);
        }
        selectedAprsTrackCall = String(marker._aprsCall);
-        setMapRadioPathTo(ll.lat, ll.lng, mapSourceColor("aprs"), "aprs-radio-path", marker.__trxRigIds);
+        setMapRadioPathTo(ll.lat, ll.lng, mapSourceColor(source), "aprs-radio-path", marker.__trxRigIds);
        return;
      }
      if (marker._aisMmsi) {
@@ -1848,28 +1858,33 @@ var mapWindow = window;
    }
    return null;
  }
-  function _aprsAddMarkerToMap(call, entry) {
+  function _aprsAddMarkerToMap(key, entry) {
    if (!aprsMap || entry.lat == null || entry.lon == null) return;
-    refreshAprsTrack(call, entry);
+    refreshAprsTrack(key, entry);
+    const source = aprsEntrySource(entry);
+    const call = entry.call ?? key;
    const icon = aprsSymbolIcon(entry.symbolTable ?? "", entry.symbolCode ?? "");
    const popupContent = buildAprsPopupHtml(call, entry.lat, entry.lon, entry.info || "", entry.pkt);
+    const color = mapSourceColor(source);
    const marker = icon ? L.marker([entry.lat, entry.lon], { icon }).addTo(aprsMap).bindPopup(popupContent) : L.circleMarker([entry.lat, entry.lon], {
      radius: 6,
-      color: "#00d17f",
-      fillColor: "#00d17f",
+      color,
+      fillColor: color,
      fillOpacity: 0.8
    }).addTo(aprsMap).bindPopup(popupContent);
-    marker.__trxType = "aprs";
+    marker.__trxType = source;
    marker.__trxRigIds = entry.rigIds || /* @__PURE__ */ new Set();
-    marker._aprsCall = call;
+    marker._aprsCall = key;
    entry.marker = marker;
    mapMarkers.add(marker);
  }
-  mapWindow.aprsMapAddStation = function(call, lat, lon, info, symbolTable, symbolCode, pkt) {
+  mapWindow.aprsMapAddStation = function(call, lat, lon, info, symbolTable, symbolCode, pkt, source) {
    const nextPoint = [lat, lon];
    const tsMs = Number.isFinite(pkt?._tsMs) ? Number(pkt._tsMs) : Date.now();
    const msgRigId = pkt?.rig_id || T.lastActiveRigId;
-    const existing = stationMarkers.get(call);
+    const stationSource = source === "hf_aprs" ? "hf_aprs" : "aprs";
+    const key = aprsStationKey(call, stationSource);
+    const existing = stationMarkers.get(key);
    if (existing) {
      existing.pkt = pkt;
      existing.lat = lat;
@@ -1888,7 +1903,8 @@ var mapWindow = window;
      } else if (prevPoint) {
        prevPoint.tsMs = tsMs;
      }
-      pruneAprsEntry(call, existing, mapHistoryCutoffMs());
+      existing.call = call;
+      pruneAprsEntry(key, existing, mapHistoryCutoffMs());
      if (aprsMap && existing.marker && !T.decodeHistoryReplayActive) {
        existing.marker.setLatLng([lat, lon]);
        existing.marker.setPopupContent(buildAprsPopupHtml(call, lat, lon, info, pkt));
@@ -1899,7 +1915,8 @@ var mapWindow = window;
        track: null,
        trackHistory: [{ lat, lon, tsMs }],
        trackPoints: [nextPoint],
-        type: "aprs",
+        type: stationSource,
+        call,
        pkt,
        lat,
        lon,
@@ -1908,9 +1925,9 @@ var mapWindow = window;
        symbolCode,
        rigIds: new Set(msgRigId ? [msgRigId] : [])
      };
-      stationMarkers.set(call, entry);
-      pruneAprsEntry(call, entry, mapHistoryCutoffMs());
-      if (entry.visibleInHistoryWindow) ensureAprsMarker(call, entry);
+      stationMarkers.set(key, entry);
+      pruneAprsEntry(key, entry, mapHistoryCutoffMs());
+      if (entry.visibleInHistoryWindow) ensureAprsMarker(key, entry);
      if (aprsMap) scheduleDecodeMapMaintenance();
    }
  };
@@ -1,3 +1,6 @@
+import {
+  hasAuthRole
+} from "./chunk-FT2RH7BL.js";
 import {
  hostState
 } from "./chunk-KL66PICH.js";
@@ -15,7 +18,7 @@ function schedulerOptionalEl(id) {
 }
 (function() {
  "use strict";
-  let schedulerRole = null;
+  let schedulerRoles = [];
  let currentRigId = null;
  let currentConfig = null;
  let currentSchedulerStatus = null;
@@ -25,8 +28,8 @@ function schedulerOptionalEl(id) {
  let schedulerStepPending = false;
  let schEntryEditIdx = null;
  let schedulerDirty = false;
-  function initScheduler(rigId, role) {
-    schedulerRole = role;
+  function initScheduler(rigId, roles) {
+    schedulerRoles = roles;
    currentRigId = rigId || null;
    if (currentRigId) loadScheduler();
    startStatusPolling();
@@ -272,7 +275,7 @@ function schedulerOptionalEl(id) {
    const nextBtn = schedulerEl("scheduler-next-btn");
    if (!prevBtn || !nextBtn) return;
    const state = schedulerInterleaveState(currentConfig);
-    const enabled = schedulerRole === "control" && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
+    const enabled = hasAuthRole(schedulerRoles, "control") && !!currentRigId && !schedulerStepPending && state.activeEntries.length > 1;
    prevBtn.disabled = !enabled;
    nextBtn.disabled = !enabled;
    const hint = enabled ? "Select a different active scheduler entry" : "Available only when multiple scheduler entries are active";
@@ -354,7 +357,7 @@ function schedulerOptionalEl(id) {
    const panel = schedulerEl("scheduler-panel");
    if (!panel) return;
    const mode = currentConfig && currentConfig.mode || "disabled";
-    const isControl = schedulerRole === "control";
+    const isControl = hasAuthRole(schedulerRoles, "control");
    setSelected("scheduler-mode-select", mode);
    const satEnabled = currentConfig && currentConfig.satellites && currentConfig.satellites.enabled;
    const controlRow = document.querySelector(".scheduler-control-row");
@@ -1220,8 +1223,8 @@ function schedulerOptionalEl(id) {
    markDirty: markSchedulerDirty
  };
  schedulerWindow.trx.modules.scheduler = schedulerService;
-  if (hostState.authRole != null) {
-    initScheduler(hostState.lastActiveRigId, hostState.authRole);
+  if (!hostState.authEnabled || hostState.authRoles.length > 0) {
+    initScheduler(hostState.lastActiveRigId, hostState.authRoles);
    wireSchedulerEvents();
  }
 })();
@@ -95,6 +95,7 @@ function normalizeServerWsprMessage(msg) {
    rfHz,
    history: {
      rig_id: msg.rig_id ?? null,
+      _rfHz: rfHz,
      receiver: wsprWindow.getDecodeRigMeta ? wsprWindow.getDecodeRigMeta() : null,
      ts_ms: msg.ts_ms,
      snr_db: msg.snr_db,
@@ -110,12 +111,7 @@ function onServerWsprBatch(messages) {
  for (const msg of messages) {
    const next = normalizeServerWsprMessage(msg);
    if (wsprStatus && isActiveRigDecode(msg.rig_id)) wsprStatus.textContent = "Receiving";
-    if (next.grids.length > 0 && wsprWindow.mapAddLocator) {
-      wsprWindow.mapAddLocator(next.raw, next.grids, "wspr", next.station, {
-        ...msg,
-        ...next.rfHz === null ? {} : { freq_hz: next.rfHz }
-      });
-    }
+    plotWsprLocator(msg);
    next.history._tsMs = Number.isFinite(next.history.ts_ms) ? Number(next.history.ts_ms) : Date.now();
    normalized.push(next.history);
  }
@@ -255,15 +251,19 @@ document.getElementById("settings-clear-wspr-history")?.addEventListener("click"
    }
  })();
 });
+function plotWsprLocator(msg) {
+  const next = normalizeServerWsprMessage(msg);
+  if (next.grids.length === 0 || !wsprWindow.mapAddLocator) return;
+  const rfHz = finiteNumber(msg._rfHz) ?? next.rfHz;
+  wsprWindow.mapAddLocator(next.raw, next.grids, "wspr", next.station, {
+    ...msg,
+    ...rfHz === null ? {} : { freq_hz: rfHz }
+  });
+}
 function onServerWspr(msg) {
  if (wsprStatus && isActiveRigDecode(msg.rig_id)) wsprStatus.textContent = "Receiving";
  const next = normalizeServerWsprMessage(msg);
-  if (next.grids.length > 0 && wsprWindow.mapAddLocator) {
-    wsprWindow.mapAddLocator(next.raw, next.grids, "wspr", next.station, {
-      ...msg,
-      ...next.rfHz === null ? {} : { freq_hz: next.rfHz }
-    });
-  }
+  plotWsprLocator(msg);
  addWsprMessage(next.history);
 }
 wsprWindow.trxPluginRuntime.registerDecoder({
@@ -273,5 +273,9 @@ wsprWindow.trxPluginRuntime.registerDecoder({
  restore: onServerWsprBatch,
  prune: pruneWsprHistoryView,
  reset: resetWsprHistoryView,
-  rerender: renderWsprHistory
+  rerender: renderWsprHistory,
+  // Oldest first, so the map builds the grids up in the order they were heard.
+  syncMap: () => {
+    for (const message of [...wsprMessageHistory].reverse()) plotWsprLocator(message);
+  }
 });
@@ -22,6 +22,7 @@ SPDX-License-Identifier: GPL-2.0-or-later
  <svg xmlns="http://www.w3.org/2000/svg" style="display:none">
    <symbol id="icon-home" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M2.8 7 8 2.9 13.2 7"/><path d="M4.3 5.9V13h7.4V5.9"/><path d="M6.8 13V9.3h2.4V13"/></symbol>
    <symbol id="icon-bookmark" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M4 2h8v12l-4-2.5L4 14V2z"/></symbol>
+    <symbol id="icon-logbook" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M3.5 2h8a1 1 0 0 1 1 1v10a1 1 0 0 1-1 1h-8a1 1 0 0 1-1-1V3a1 1 0 0 1 1-1z"/><path d="M5.5 2v12"/><path d="M7.5 5.5h3M7.5 8h3M7.5 10.5h2"/></symbol>
    <symbol id="icon-digital" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M1 11.5h2.6V4.5h3.2v7h3.2v-7h3.2v7H15"/></symbol>
    <symbol id="icon-map" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"><path d="M8 2a4 4 0 0 1 4 4c0 3-4 8-4 8S4 9 4 6a4 4 0 0 1 4-4z"/><circle cx="8" cy="6" r="1.2" fill="currentColor" stroke="none"/></symbol>
    <symbol id="icon-satellite" viewBox="0 0 16 16" fill="none" stroke="currentColor" stroke-width="1.4" stroke-linecap="round" stroke-linejoin="round"><path d="M2 13.2 5.6 9.6"/><path d="M4.2 8.2a3.4 3.4 0 0 1 4.8 4.8z"/><path d="M9.2 6.6a3.2 3.2 0 0 1 2.6 2.6"/><path d="M9.8 3.6a6.2 6.2 0 0 1 5.2 5.2"/></symbol>
@@ -53,6 +54,10 @@ SPDX-License-Identifier: GPL-2.0-or-later
            <svg class="tab-icon" aria-hidden="true"><use href="#icon-bookmark"/></svg>
            <span class="tab-label">Bookmarks</span>
          </button>
+          <button class="tab" data-tab="logbook">
+            <svg class="tab-icon" aria-hidden="true"><use href="#icon-logbook"/></svg>
+            <span class="tab-label">Logbook</span>
+          </button>
          <button class="tab" data-tab="digital-modes" aria-label="Digital modes">
            <svg class="tab-icon" aria-hidden="true"><use href="#icon-digital"/></svg>
            <span class="tab-label">Digital modes</span>
@@ -118,13 +123,13 @@ SPDX-License-Identifier: GPL-2.0-or-later
    <div id="auth-gate" class="auth-gate" style="display:none;">
      <div class="auth-gate-head">
        <div class="auth-gate-title">Access Required</div>
-        <div class="auth-gate-sub">Enter passphrase to continue</div>
+        <div class="auth-gate-sub">Sign in to continue</div>
      </div>
      <form id="auth-form" class="auth-form">
-        <input type="password" id="auth-passphrase" class="auth-input" placeholder="Passphrase" autocomplete="off" />
+        <input type="text" id="auth-username" class="auth-input" placeholder="Username" autocomplete="username" required />
+        <input type="password" id="auth-password" class="auth-input" placeholder="Password" autocomplete="current-password" maxlength="1024" required />
        <button type="submit" class="auth-submit">Login</button>
      </form>
-      <button id="auth-guest-btn" type="button" class="auth-guest" style="display: none;">Continue as Guest</button>
      <div id="auth-error" class="auth-error" style="display: none;"></div>
      <div id="auth-role" class="auth-role" style="display: none;"></div>
    </div>
@@ -480,6 +485,192 @@ SPDX-License-Identifier: GPL-2.0-or-later
    </div>
    </div>
    </div>
+    <div id="tab-logbook" class="tab-panel" style="display:none;">
+      <div id="logbook-panel" class="log-panel">
+        <!-- Station: who the contacts are logged under, and from where. Shown
+             once rather than typed into every entry. -->
+        <div class="log-station">
+          <div class="log-station-identity">
+            <span class="log-station-call" id="log-station-callsign">--</span>
+            <label class="log-station-operator">
+              <span>Operator</span>
+              <input type="text" id="log-operator" class="status-input" autocomplete="off"
+                     spellcheck="false" aria-label="Operator callsign" />
+            </label>
+          </div>
+          <div class="log-station-rig">
+            <span id="log-station-rig-name">--</span>
+            <span id="log-station-grid" class="log-station-grid"></span>
+            <span id="log-clock" class="log-clock" aria-live="polite"></span>
+          </div>
+        </div>
+
+        <!-- Entry: opens pre-filled with the six fields the radio and the clock
+             can answer for. Everything else is the operator's. -->
+        <form id="log-entry-form" class="log-entry" autocomplete="off">
+          <div class="log-entry-grid">
+            <label class="log-field log-field-call">
+              <span>Callsign</span>
+              <input type="text" id="log-call" class="status-input" required
+                     spellcheck="false" aria-describedby="log-worked-before" />
+            </label>
+            <label class="log-field">
+              <span>Frequency</span>
+              <input type="text" id="log-freq" class="status-input" inputmode="decimal" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>Mode</span>
+              <input type="text" id="log-mode" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>RST sent</span>
+              <input type="text" id="log-rst-sent" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>RST rcvd</span>
+              <input type="text" id="log-rst-rcvd" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>Locator</span>
+              <input type="text" id="log-grid" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field">
+              <span>Name</span>
+              <input type="text" id="log-name" class="status-input" />
+            </label>
+            <label class="log-field">
+              <span>Comment</span>
+              <input type="text" id="log-comment" class="status-input" />
+            </label>
+          </div>
+          <details class="log-contest" id="log-contest-block">
+            <summary>Contest exchange</summary>
+            <div class="log-entry-grid">
+              <label class="log-field">
+                <span>Contest</span>
+                <input type="text" id="log-contest-id" class="status-input" spellcheck="false"
+                       placeholder="CQ-WW-SSB" />
+              </label>
+              <label class="log-field log-field-narrow">
+                <span>Serial sent</span>
+                <input type="text" id="log-stx" class="status-input" inputmode="numeric" />
+              </label>
+              <label class="log-field log-field-narrow">
+                <span>Received</span>
+                <input type="text" id="log-srx" class="status-input" />
+              </label>
+            </div>
+          </details>
+          <div class="log-entry-actions">
+            <span id="log-worked-before" class="log-worked" aria-live="polite"></span>
+            <span class="log-entry-buttons">
+              <button type="button" id="log-clear-btn" class="log-secondary-btn">Clear</button>
+              <button type="submit" id="log-save-btn" class="log-primary-btn">Log contact</button>
+            </span>
+          </div>
+        </form>
+
+        <!-- The log itself. -->
+        <div class="log-list-toolbar">
+          <input type="text" id="log-filter-call" class="status-input" placeholder="Callsign&hellip;"
+                 aria-label="Filter by callsign" />
+          <select id="log-filter-band" class="status-input" aria-label="Filter by band">
+            <option value="">All bands</option>
+          </select>
+          <select id="log-filter-mode" class="status-input" aria-label="Filter by mode">
+            <option value="">All modes</option>
+          </select>
+          <span class="log-toolbar-spacer"></span>
+          <a id="log-export-btn" class="log-secondary-btn" href="/api/logbook/export.adi"
+             download>Export ADIF</a>
+          <button type="button" id="log-import-btn" class="log-secondary-btn">Import ADIF</button>
+          <input type="file" id="log-import-file" accept=".adi,.adif,text/plain" hidden />
+        </div>
+        <div class="log-table-wrap">
+          <table class="log-table">
+            <thead>
+              <tr>
+                <th scope="col">Date</th>
+                <th scope="col">Time</th>
+                <th scope="col">Callsign</th>
+                <th scope="col">Band</th>
+                <th scope="col">Mode</th>
+                <th scope="col">Sent</th>
+                <th scope="col">Rcvd</th>
+                <th scope="col">Locator</th>
+                <th scope="col">Rig</th>
+                <th scope="col">QSL</th>
+                <th scope="col"><span class="visually-hidden">Actions</span></th>
+              </tr>
+            </thead>
+            <tbody id="log-rows"></tbody>
+          </table>
+        </div>
+        <div id="log-summary" class="log-summary" aria-live="polite"></div>
+
+        <details class="log-report" id="log-statistics-block">
+          <summary>Bands worked</summary>
+          <div class="log-table-wrap">
+            <table class="log-table">
+              <thead>
+                <tr>
+                  <th scope="col">Band</th>
+                  <th scope="col">Contacts</th>
+                  <th scope="col">Stations</th>
+                  <th scope="col">Confirmed</th>
+                </tr>
+              </thead>
+              <tbody id="log-statistics-rows"></tbody>
+            </table>
+          </div>
+        </details>
+
+        <details class="log-report" id="log-contest-export-block">
+          <summary>Contest entry (Cabrillo)</summary>
+          <p class="log-report-note">
+            Contest logs are submitted in Cabrillo and rejected in anything else.
+            Only the contacts of the contest named here go into the entry.
+          </p>
+          <div class="log-entry-grid">
+            <label class="log-field">
+              <span>Contest</span>
+              <input type="text" id="log-cbr-contest" class="status-input" spellcheck="false"
+                     placeholder="CQ-WW-SSB" />
+            </label>
+            <label class="log-field">
+              <span>Callsign</span>
+              <input type="text" id="log-cbr-callsign" class="status-input" spellcheck="false" />
+            </label>
+            <label class="log-field">
+              <span>Operators</span>
+              <select id="log-cbr-operator" class="status-input">
+                <option value="SINGLE-OP">Single operator</option>
+                <option value="MULTI-OP">Multi operator</option>
+                <option value="CHECKLOG">Checklog</option>
+              </select>
+            </label>
+            <label class="log-field">
+              <span>Power</span>
+              <select id="log-cbr-power" class="status-input">
+                <option value="LOW">Low</option>
+                <option value="HIGH">High</option>
+                <option value="QRP">QRP</option>
+              </select>
+            </label>
+            <label class="log-field log-field-narrow">
+              <span>Claimed score</span>
+              <input type="text" id="log-cbr-score" class="status-input" inputmode="numeric" />
+            </label>
+          </div>
+          <div class="log-entry-actions">
+            <span class="log-entry-buttons">
+              <a id="log-cbr-export" class="log-secondary-btn" href="/api/logbook/export.cbr"
+                 download>Export Cabrillo</a>
+            </span>
+          </div>
+        </details>
+      </div>
+    </div>
    <div id="tab-bookmarks" class="tab-panel" style="display:none;">
      <div class="bm-toolbar">
        <select id="bm-scope-picker" class="status-input" aria-label="Bookmark scope">
@@ -1270,6 +1461,8 @@ SPDX-License-Identifier: GPL-2.0-or-later
        <button class="sub-tab" data-subtab="settings-background-decode">Background Decode</button>
        <button class="sub-tab" data-subtab="settings-bandplan">Bandplan</button>
        <button class="sub-tab" data-subtab="settings-history">History</button>
+        <button id="settings-account-tab" class="sub-tab" data-subtab="settings-account" style="display:none;">Account</button>
+        <button id="settings-users-tab" class="sub-tab" data-subtab="settings-users" style="display:none;">Users</button>
      </div>
      <div id="subtab-settings-scheduler" class="sub-tab-panel">
        <div id="scheduler-panel" class="sch-panel">
@@ -1467,30 +1660,31 @@ SPDX-License-Identifier: GPL-2.0-or-later
      <div id="subtab-settings-background-decode" class="sub-tab-panel" style="display:none;">
        <div id="background-decode-panel" class="sch-panel">
          <div class="sch-toast" id="background-decode-toast" role="alert" aria-live="polite" style="display:none;"></div>
-          <!-- Now Playing status card (moved to top) -->
-          <div class="now-playing-card">
-            <div id="background-decode-status-card" class="sch-status-card">No background decode bookmarks configured.</div>
-          </div>
          <div class="sch-section">
-            <div class="sch-section-title">Configuration</div>
-            <div class="sch-row">
-              <label class="sch-label bgd-toggle-wrap">Background decode
-                <span class="bgd-toggle-row">
-                  <input type="checkbox" id="background-decode-enabled" />
-                  <span>Enable hidden background decoder channels</span>
-                </span>
+            <div class="sch-section-title">Background Decode</div>
+            <p class="bgd-intro">
+              Decodes saved bookmarks on hidden channels while you work another band.
+              Needs an SDR rig, and a bookmark is only decoded while it falls inside
+              the span the rig is tuned across.
+            </p>
+            <div class="bgd-controls">
+              <label class="bgd-enable">
+                <input type="checkbox" id="background-decode-enabled" />
+                <span>Enabled</span>
              </label>
+              <span id="bgd-span-summary" class="bgd-span" aria-live="polite"></span>
            </div>
-            <div class="sch-row" style="flex-direction:column;gap:0.5rem;">
-              <label class="sch-label" style="min-width:100%;">Bookmarks
-                <input type="text" id="bgd-bookmark-filter" class="bgd-checklist-filter" placeholder="Filter bookmarks..." />
-              </label>
+            <div class="bgd-list-toolbar">
+              <input type="text" id="bgd-bookmark-filter" class="bgd-checklist-filter"
+                     placeholder="Filter bookmarks&hellip;" aria-label="Filter bookmarks" />
              <div class="bgd-select-actions">
-                <button type="button" id="bgd-select-all-btn" class="bgd-select-btn" aria-label="Select all bookmarks">Select All</button>
-                <button type="button" id="bgd-deselect-all-btn" class="bgd-select-btn" aria-label="Deselect all bookmarks">Deselect All</button>
+                <button type="button" id="bgd-select-all-btn" class="bgd-select-btn" aria-label="Select every bookmark">All</button>
+                <button type="button" id="bgd-deselect-all-btn" class="bgd-select-btn" aria-label="Select no bookmarks">None</button>
              </div>
-              <div id="bgd-bookmark-checklist" class="bgd-checklist"></div>
            </div>
+            <div id="bgd-bookmark-checklist" class="bgd-checklist" role="group"
+                 aria-label="Bookmarks decoded in the background"></div>
+            <div id="bgd-selection-summary" class="bgd-summary" aria-live="polite"></div>
          </div>

          <div class="sch-actions">
@@ -1558,6 +1752,34 @@ SPDX-License-Identifier: GPL-2.0-or-later
          </div>
        </div>
      </div>
+      <div id="subtab-settings-account" class="sub-tab-panel" style="display:none;">
+        <div class="settings-card">
+          <h3>Change password</h3>
+          <form id="account-password-form" class="sch-row" style="flex-wrap:wrap; gap:.5rem;">
+            <input id="account-current-password" class="auth-input" type="password" placeholder="Current password" autocomplete="current-password" maxlength="1024" required />
+            <input id="account-new-password" class="auth-input" type="password" placeholder="New password (8+ characters)" autocomplete="new-password" minlength="8" maxlength="1024" required />
+            <input id="account-confirm-password" class="auth-input" type="password" placeholder="Confirm new password" autocomplete="new-password" minlength="8" maxlength="1024" required />
+            <button type="submit" class="auth-submit">Change password</button>
+          </form>
+          <div id="account-password-error" class="auth-error" role="alert" aria-live="polite" style="display:none;"></div>
+          <p class="settings-note">Changing your password signs out every session for this account.</p>
+        </div>
+      </div>
+      <div id="subtab-settings-users" class="sub-tab-panel" style="display:none;">
+        <div id="user-management">
+        <div class="settings-card">
+          <form id="user-create-form" class="sch-row" style="flex-wrap:wrap; gap:.5rem;">
+            <input id="user-create-username" class="auth-input" placeholder="Username" autocomplete="off" required />
+            <input id="user-create-password" class="auth-input" type="password" placeholder="Password (8+ characters)" autocomplete="new-password" minlength="8" maxlength="1024" required />
+            <span id="user-create-roles" class="auth-role-choices"></span>
+            <label class="auth-role-choice"><input id="user-create-enabled" type="checkbox" checked /> Enabled</label>
+            <button type="submit" class="auth-submit">Add user</button>
+          </form>
+          <div id="user-management-error" class="auth-error" style="display:none;"></div>
+          <div id="user-list" style="margin-top:.75rem;"></div>
+        </div>
+        </div>
+      </div>
    </div>
    <div id="tab-about" class="tab-panel" style="display:none;">
      <h2 class="section-heading">About</h2>
@@ -196,8 +196,7 @@ body {
  font-size: var(--fs-base);
  box-sizing: border-box;
 }
-.auth-submit,
-.auth-guest {
+.auth-submit {
  width: 100%;
  padding: 0.65rem 0.75rem;
  border-radius: var(--radius-md);
@@ -213,16 +212,14 @@ body {
  font-weight: 700;
 }
 .auth-submit:hover:not(:disabled) { background: var(--accent-green-hover); }
-.auth-guest {
-  background: var(--btn-bg);
-  color: var(--text);
-  border: 1px solid var(--border-light);
-  font-weight: 600;
-  margin-top: var(--space-4);
-}
-.auth-guest:hover:not(:disabled) { background: var(--btn-hover-bg); }
 .auth-error { color: var(--accent-red); font-size: var(--fs-sm); margin-top: var(--space-4); }
 .auth-role { margin-top: var(--space-4); color: var(--text-muted); font-size: var(--fs-sm); }
+#user-management .auth-input { width: auto; min-width: 9rem; flex: 1 1 10rem; margin-bottom: 0; }
+#user-management .auth-submit { width: auto; }
+#user-management .auth-role-choices { display: flex; align-items: center; gap: .6rem; flex-wrap: wrap; }
+#user-management .auth-role-choice { display: inline-flex; align-items: center; gap: .2rem; white-space: nowrap; }
+.settings-note { color: var(--text-muted); font-size: .85rem; margin: .75rem 0 0; }
+#user-management button { padding: 0.55rem 0.75rem; }

 .label { color: var(--text-muted); font-size: 0.9rem; margin-bottom: 6px; display: block; }
 #tab-main .label > span {
@@ -5589,18 +5586,6 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
 #sch-sat-form-cancel:hover {
  background: var(--border);
 }
-.bgd-toggle-wrap {
-  min-width: 18rem;
-  flex: 1 1 20rem;
-}
-.bgd-toggle-row {
-  display: inline-flex;
-  align-items: center;
-  gap: 0.55rem;
-  min-height: var(--control-height);
-  color: var(--text);
-  font-weight: 500;
-}
 .bgd-add-row {
  display: flex;
  gap: 0.55rem;
@@ -5624,48 +5609,6 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
  color: var(--text-muted);
  font-size: 0.78rem;
 }
-.bgd-status-list {
-  display: grid;
-  gap: 0.65rem;
-}
-.bgd-status-row {
-  display: flex;
-  justify-content: space-between;
-  gap: 1rem;
-  padding: 0.65rem 0.75rem;
-  border: 1px solid var(--border-light);
-  border-radius: 0.55rem;
-  background: color-mix(in srgb, var(--card-bg) 74%, transparent);
-}
-.bgd-status-name {
-  font-weight: 600;
-}
-.bgd-status-meta {
-  color: var(--text-muted);
-  font-size: 0.82rem;
-}
-.bgd-status-state {
-  align-self: center;
-  white-space: nowrap;
-  font-size: 0.78rem;
-  font-weight: 700;
-  letter-spacing: 0.05em;
-  text-transform: uppercase;
-  color: var(--accent-green);
-}
-.bgd-status-state[data-state="out_of_span"],
-.bgd-status-state[data-state="waiting_for_spectrum"],
-.bgd-status-state[data-state="waiting_for_user"],
-.bgd-status-state[data-state="scheduler_has_control"],
-.bgd-status-state[data-state="inactive"],
-.bgd-status-state[data-state="handled_by_scheduler"],
-.bgd-status-state[data-state="handled_by_virtual_channel"] {
-  color: var(--accent-yellow);
-}
-.bgd-status-state[data-state="missing_bookmark"],
-.bgd-status-state[data-state="no_supported_decoders"] {
-  color: var(--accent-red);
-}
 /* ── "Now Playing" status card (top of scheduler & bgd panels) ──── */
 .now-playing-card {
  border-left: 3px solid var(--accent-green);
@@ -5881,18 +5824,65 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
  color: var(--text-muted);
  opacity: 0.7;
 }
+.bgd-intro {
+  margin: 0 0 0.9rem;
+  max-width: 62ch;
+  color: var(--text-muted);
+  font-size: 0.85rem;
+  line-height: 1.45;
+}
+/* The switch and what the rig can hear, on one line: the second is the reason
+   a selected bookmark may not be decoding, so it belongs beside the first. */
+.bgd-controls {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-bottom: 0.9rem;
+}
+.bgd-enable {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  font-size: 0.9rem;
+  font-weight: 600;
+  color: var(--text);
+  cursor: pointer;
+}
+.bgd-span {
+  color: var(--text-muted);
+  font-size: 0.82rem;
+}
+.bgd-span[data-tone="warn"] {
+  color: var(--text-warn, #b7791f);
+}
+/* The filter and the bulk buttons sit on the list they act on, and stay on it
+   when the panel narrows. */
+.bgd-list-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+  margin-bottom: 0.5rem;
+}
+.bgd-list-toolbar .bgd-checklist-filter {
+  flex: 1 1 auto;
+  min-width: 0;
+}
 .bgd-checklist {
-  max-height: 16rem;
+  max-height: 22rem;
  overflow-y: auto;
  border: 1px solid var(--border-light);
  border-radius: 0.4rem;
  background: var(--bg-secondary);
 }
+/* One row per bookmark: pick it here, and read what it is doing here too. */
 .bgd-checklist-row {
-  display: flex;
+  display: grid;
+  grid-template-columns: auto minmax(6rem, 1fr) auto auto;
  align-items: center;
  gap: 0.55rem;
-  padding: 0.45rem 0.65rem;
+  padding: 0.5rem 0.65rem;
  border-bottom: 1px solid var(--border-light);
  cursor: pointer;
  font-size: 0.85rem;
@@ -5904,28 +5894,83 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
 .bgd-checklist-row:hover {
  background: color-mix(in srgb, var(--card-bg) 60%, transparent);
 }
+.bgd-checklist-row.is-selected {
+  background: color-mix(in srgb, var(--accent-green) 8%, transparent);
+}
 .bgd-checklist-row input[type="checkbox"] {
  flex-shrink: 0;
 }
 .bgd-checklist-name {
  font-weight: 600;
  color: var(--text);
-}
-.bgd-checklist-meta {
-  color: var(--text-muted);
-  font-size: 0.78rem;
-  margin-left: auto;
+  overflow: hidden;
+  text-overflow: ellipsis;
  white-space: nowrap;
 }
+.bgd-checklist-meta {
+  display: inline-flex;
+  align-items: baseline;
+  gap: 0.4rem;
+  color: var(--text-muted);
+  font-size: 0.78rem;
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+}
+.bgd-checklist-mode {
+  color: var(--text-muted);
+  opacity: 0.85;
+}
+/* A dot and a word. The dot carries the state, so the word can stay a word. */
+.bgd-state {
+  display: inline-flex;
+  align-items: center;
+  justify-content: flex-end;
+  gap: 0.35rem;
+  min-width: 9.5rem;
+  color: var(--text-muted);
+  font-size: 0.76rem;
+  white-space: nowrap;
+}
+.bgd-state-dot {
+  width: 0.5rem;
+  height: 0.5rem;
+  border-radius: 50%;
+  background: currentcolor;
+  opacity: 0.55;
+  flex-shrink: 0;
+}
+.bgd-state[data-state="active"] {
+  color: var(--accent-green);
+  font-weight: 600;
+}
+.bgd-state[data-state="active"] .bgd-state-dot {
+  opacity: 1;
+  box-shadow: 0 0 0 3px color-mix(in srgb, var(--accent-green) 22%, transparent);
+}
+.bgd-state[data-state="missing_bookmark"],
+.bgd-state[data-state="no_supported_decoders"] {
+  color: var(--color-error, #c0392b);
+}
+.bgd-state[data-state="unselected"] {
+  min-width: 0;
+}
 .bgd-checklist-empty {
-  padding: 0.75rem;
+  padding: 1rem 0.75rem;
  text-align: center;
  color: var(--text-muted);
  font-size: 0.85rem;
+  line-height: 1.5;
 }
-/* ── Select All / Deselect All buttons ────────────────────────────── */
+/* What the selection adds up to, under the list it describes. */
+.bgd-summary {
+  margin-top: 0.5rem;
+  color: var(--text-muted);
+  font-size: 0.8rem;
+}
+/* ── Select all / none buttons ─────────────────────────────────────── */
 .bgd-select-actions {
  display: flex;
+  flex-shrink: 0;
  gap: 0.5rem;
 }
 .bgd-select-btn {
@@ -5943,15 +5988,6 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
  background: var(--card-bg);
  color: var(--text);
 }
-/* ── SVG State Dot Badges ─────────────────────────────────────────── */
-.bgd-state-dot {
-  width: 8px;
-  height: 8px;
-  display: inline-block;
-  vertical-align: middle;
-  margin-right: 4px;
-  fill: currentColor;
-}
@media (max-width: 600px) {
  .channel-scheduler-controls {
    flex-direction: column;
@@ -5992,8 +6028,7 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
  .bm-page-summary {
    text-align: center;
  }
-  .bgd-add-row,
-  .bgd-status-row {
+  .bgd-add-row {
    flex-direction: column;
    align-items: stretch;
  }
@@ -6003,8 +6038,17 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
  .interleave-ring-label {
    max-width: 8rem;
  }
-  .bgd-checklist-meta {
-    margin-left: 0;
+  /* Two lines rather than four columns: the name and its state stay legible
+     when there is no room for the frequency beside them. */
+  .bgd-checklist-row {
+    grid-template-columns: auto minmax(0, 1fr);
+    row-gap: 0.2rem;
+  }
+  .bgd-checklist-meta,
+  .bgd-state {
+    grid-column: 2;
+    justify-content: flex-start;
+    min-width: 0;
    font-size: 0.75rem;
  }
 }
@@ -6341,3 +6385,280 @@ body[data-operator-layout="broadcast"] #cw-bar-overlay {
 }

 #tab-statistics > .section-heading { margin-bottom: 0; }
+
+/* =========================================================================
+   Logbook
+   ========================================================================= */
+.log-panel {
+  padding: 1rem;
+  display: flex;
+  flex-direction: column;
+  gap: 0.85rem;
+}
+/* Who the contacts are logged under, and from where: shown once, not typed
+   into every entry. */
+.log-station {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  padding: 0.6rem 0.85rem;
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+  background: var(--bg-secondary);
+}
+.log-station-identity {
+  display: flex;
+  align-items: center;
+  gap: 0.85rem;
+  min-width: 0;
+}
+.log-station-call {
+  font-size: 1.05rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  color: var(--text);
+}
+.log-station-operator {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.4rem;
+  font-size: 0.78rem;
+  color: var(--text-muted);
+}
+.log-station-operator input {
+  width: 7rem;
+  text-transform: uppercase;
+}
+.log-station-rig {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  font-size: 0.82rem;
+  color: var(--text-muted);
+  min-width: 0;
+}
+.log-station-grid {
+  font-variant-numeric: tabular-nums;
+}
+.log-clock {
+  font-variant-numeric: tabular-nums;
+  padding: 0.1rem 0.45rem;
+  border-radius: 0.3rem;
+  background: color-mix(in srgb, var(--card-bg) 70%, transparent);
+}
+/* A browser clock that disagrees with the radio's is worth saying out loud:
+   the times in a log are the one thing that cannot be corrected later. */
+.log-clock.is-adrift {
+  color: var(--accent-yellow, #b7791f);
+  font-weight: 600;
+}
+.log-entry {
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+  padding: 0.85rem;
+  background: var(--bg-secondary);
+}
+.log-entry-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(8.5rem, 1fr));
+  gap: 0.6rem 0.75rem;
+}
+.log-field {
+  display: flex;
+  flex-direction: column;
+  gap: 0.25rem;
+  min-width: 0;
+  font-size: 0.75rem;
+  color: var(--text-muted);
+}
+.log-field input {
+  min-width: 0;
+}
+.log-field-call {
+  grid-column: span 2;
+}
+.log-field-call input {
+  font-size: 1.05rem;
+  font-weight: 700;
+  letter-spacing: 0.06em;
+  text-transform: uppercase;
+}
+.log-field-narrow {
+  max-width: 10rem;
+}
+.log-entry-actions {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 0.75rem;
+  margin-top: 0.75rem;
+}
+.log-entry-buttons {
+  display: inline-flex;
+  gap: 0.5rem;
+  margin-left: auto;
+}
+.log-worked {
+  font-size: 0.8rem;
+  color: var(--text-muted);
+}
+.log-worked.is-worked {
+  color: var(--accent-green);
+  font-weight: 600;
+}
+.log-primary-btn {
+  background: var(--accent-green);
+  color: #fff;
+  border: none;
+  border-radius: 0.35rem;
+  padding: 0.4rem 1.1rem;
+  font-weight: 600;
+  cursor: pointer;
+}
+.log-secondary-btn {
+  display: inline-flex;
+  align-items: center;
+  background: var(--bg-secondary);
+  border: 1px solid var(--border-light);
+  border-radius: 0.35rem;
+  color: var(--text-muted);
+  padding: 0.35rem 0.75rem;
+  font-size: 0.82rem;
+  text-decoration: none;
+  cursor: pointer;
+}
+.log-secondary-btn:hover {
+  background: var(--card-bg);
+  color: var(--text);
+}
+.log-list-toolbar {
+  display: flex;
+  flex-wrap: wrap;
+  align-items: center;
+  gap: 0.5rem;
+}
+.log-list-toolbar .status-input {
+  max-width: 11rem;
+}
+.log-toolbar-spacer {
+  flex: 1 1 auto;
+}
+.log-table-wrap {
+  overflow-x: auto;
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+}
+.log-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.83rem;
+}
+.log-table th {
+  position: sticky;
+  top: 0;
+  z-index: 1;
+  text-align: left;
+  padding: 0.5rem 0.65rem;
+  background: var(--bg-secondary);
+  border-bottom: 1px solid var(--border-light);
+  font-size: 0.72rem;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--text-muted);
+  white-space: nowrap;
+}
+.log-table td {
+  padding: 0.4rem 0.65rem;
+  border-bottom: 1px solid color-mix(in srgb, var(--border-light) 60%, transparent);
+  white-space: nowrap;
+  font-variant-numeric: tabular-nums;
+}
+.log-table tr:last-child td {
+  border-bottom: none;
+}
+.log-table tbody tr:hover {
+  background: color-mix(in srgb, var(--card-bg) 60%, transparent);
+}
+.log-cell-call {
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  font-variant-numeric: normal;
+}
+.log-row-btn {
+  background: transparent;
+  border: 1px solid var(--border-light);
+  border-radius: 0.3rem;
+  color: var(--text-muted);
+  font-size: 0.75rem;
+  padding: 0.15rem 0.5rem;
+  cursor: pointer;
+}
+.log-row-btn:hover {
+  color: var(--text);
+  background: var(--card-bg);
+}
+.log-empty {
+  padding: 1.5rem 0.75rem;
+  text-align: center;
+  color: var(--text-muted);
+  white-space: normal;
+}
+.log-summary {
+  color: var(--text-muted);
+  font-size: 0.8rem;
+}
+/* The ham layout works the bands: the broadcast furniture goes, and the entry
+   form is the thing the panel opens on. */
+body[data-operator-layout="ham"] .controls-col-wfm { display: none !important; }
+body[data-operator-layout="ham"] #rds-panel { display: none !important; }
+@media (max-width: 700px) {
+  .log-station,
+  .log-entry-actions {
+    flex-direction: column;
+    align-items: stretch;
+  }
+  .log-entry-buttons {
+    margin-left: 0;
+  }
+  .log-field-call {
+    grid-column: span 2;
+  }
+  .log-list-toolbar .status-input {
+    max-width: none;
+    flex: 1 1 8rem;
+  }
+}
+/* Contest exchange and the reports below the log: folded away, because most
+   operating is not a contest and most sessions do not export one. */
+.log-contest,
+.log-report {
+  border: 1px solid var(--border-light);
+  border-radius: 0.5rem;
+  background: var(--bg-secondary);
+  padding: 0.5rem 0.85rem;
+}
+.log-contest {
+  margin-top: 0.75rem;
+}
+.log-contest > summary,
+.log-report > summary {
+  cursor: pointer;
+  font-size: 0.78rem;
+  font-weight: 700;
+  text-transform: uppercase;
+  letter-spacing: 0.05em;
+  color: var(--text-muted);
+}
+.log-contest[open] > summary,
+.log-report[open] > summary {
+  margin-bottom: 0.65rem;
+}
+.log-report-note {
+  margin: 0 0 0.65rem;
+  max-width: 62ch;
+  color: var(--text-muted);
+  font-size: 0.8rem;
+  line-height: 1.45;
+}
@@ -15,6 +15,7 @@ use trx_core::rig::{
 use trx_core::{DecoderConfig, RdsData, RigFilterState, RigMode, RigSnapshot, WfmDenoiseLevel};
 use trx_frontend_http::server::api::rig::{RigListItem, RigListResponse};
 use trx_frontend_http::server::api::FrontendMeta;
+use trx_frontend_http::server::auth::AuthRole;
 use trx_protocol::{DecoderActivation, DecoderDescriptor};
 use ts_rs::{Config, TS};

@@ -56,6 +57,7 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
    export!(RigListItem);
    export!(RigListResponse);
    export!(FrontendMeta);
+    export!(AuthRole);
    export!(DecoderActivation);
    export!(DecoderDescriptor);

@@ -33,6 +33,7 @@ await build({
    "satellite-predictions": path.join(sourceDir, "plugins", "satellite-predictions.ts"),
    vchan: path.join(sourceDir, "plugins", "vchan.ts"),
    bookmarks: path.join(sourceDir, "plugins", "bookmarks.ts"),
+    logbook: path.join(sourceDir, "plugins", "logbook.ts"),
    scheduler: path.join(sourceDir, "plugins", "scheduler.ts"),
    "map-core": path.join(sourceDir, "map-core.ts"),
    screenshot: path.join(sourceDir, "screenshot.ts"),
@@ -12,7 +12,7 @@
    "typecheck": "tsc --project tsconfig.json && tsc --project tsconfig.worker.json",
    "lint": "eslint \"src/**/*.ts\" \"tests/**/*.mjs\" build.mjs --no-error-on-unmatched-pattern",
    "test": "node --test tests/*.test.mjs",
-    "test:browser": "node tests/browser-smoke.mjs && node tests/spectrum-layout.mjs && node tests/decode-flow.mjs && node tests/tune-links.mjs && node tests/mobile-layout.mjs && node tests/satellite-predictions.mjs",
+    "test:browser": "node tests/browser-smoke.mjs && node tests/spectrum-layout.mjs && node tests/decode-flow.mjs && node tests/tune-links.mjs && node tests/mobile-layout.mjs && node tests/satellite-predictions.mjs && node tests/background-decode.mjs && node tests/logbook.mjs && node tests/account-management.mjs",
    "verify-generated": "npm run generate-types && npm run build && git diff --exit-code -- ../assets/web/generated src/api/generated.ts"
  },
  "devDependencies": {
@@ -2,11 +2,50 @@
 //
 // SPDX-License-Identifier: GPL-2.0-or-later

-export type AuthRole = "rx" | "control";
+import type { AuthRole } from "./generated.js";
+
+export type { AuthRole };
+
+export const AUTH_ROLES: readonly AuthRole[] = ["guest", "read", "control", "write", "administrator"];
+export const AUTH_ADMIN_ROLES: readonly AuthRole[] = AUTH_ROLES.filter(role => role !== "guest");
+export const AUTH_ROLE_LABELS: Readonly<Record<AuthRole, string>> = {
+  guest: "Guest",
+  read: "Read",
+  control: "Control",
+  write: "Write",
+  administrator: "Administrator",
+};
+
+export function isAuthRole(value: unknown): value is AuthRole {
+  return typeof value === "string" && (AUTH_ROLES as readonly string[]).includes(value);
+}
+
+export function normalizeAuthRoles(roles: readonly AuthRole[]): AuthRole[] {
+  return AUTH_ROLES.filter(role => roles.includes(role));
+}
+
+export function hasAuthRole(roles: readonly AuthRole[], required: AuthRole): boolean {
+  return roles.includes("administrator")
+    || roles.includes(required)
+    || required === "read" && roles.includes("guest")
+    || required === "read" && roles.includes("control");
+}
+
+export function hasAccountControls(roles: readonly AuthRole[]): boolean {
+  return roles.length > 0 && !roles.includes("guest");
+}
+
+function decodeRoles(value: unknown, context: string): AuthRole[] {
+  if (!Array.isArray(value) || !value.every(isAuthRole)) {
+    throw new TypeError(`${context} has invalid roles`);
+  }
+  return normalizeAuthRoles(value);
+}

 export interface AuthSession {
  authenticated: boolean;
-  role?: AuthRole;
+  roles: AuthRole[];
+  username?: string;
  auth_disabled?: boolean;
 }

@@ -18,21 +57,24 @@ function decodeAuthSession(value: unknown): AuthSession {
  if (typeof session.authenticated !== "boolean") {
    throw new TypeError("The authentication response has no authenticated flag");
  }
-  if (session.role !== undefined && session.role !== "rx" && session.role !== "control") {
-    throw new TypeError("The authentication response has an invalid role");
-  }
  if (session.auth_disabled !== undefined && typeof session.auth_disabled !== "boolean") {
    throw new TypeError("The authentication response has an invalid auth_disabled flag");
  }
-  const decoded: AuthSession = { authenticated: session.authenticated };
-  if (session.role !== undefined) decoded.role = session.role;
+  const decoded: AuthSession = {
+    authenticated: session.authenticated,
+    roles: decodeRoles(session.roles, "The authentication response"),
+  };
+  if (session.username !== undefined) {
+    if (typeof session.username !== "string") throw new TypeError("The authentication response has an invalid username");
+    decoded.username = session.username;
+  }
  if (session.auth_disabled !== undefined) decoded.auth_disabled = session.auth_disabled;
  return decoded;
 }

 const authDisabledSession: AuthSession = {
  authenticated: true,
-  role: "control",
+  roles: [...AUTH_ADMIN_ROLES],
  auth_disabled: true,
 };

@@ -40,19 +82,19 @@ export async function fetchAuthSession(): Promise<AuthSession> {
  try {
    const response = await fetch("/auth/session");
    if (response.status === 404) return authDisabledSession;
-    if (!response.ok) return { authenticated: false };
+    if (!response.ok) return { authenticated: false, roles: [] };
    return decodeAuthSession(await response.json());
  } catch (error: unknown) {
    console.error("Auth check failed:", error);
-    return { authenticated: false };
+    return { authenticated: false, roles: [] };
  }
 }

-export async function login(passphrase: string): Promise<AuthSession> {
+export async function login(username: string, password: string): Promise<AuthSession> {
  const response = await fetch("/auth/login", {
    method: "POST",
    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ passphrase }),
+    body: JSON.stringify({ username, password }),
  });
  if (response.status === 404) return authDisabledSession;
  if (!response.ok) {
@@ -62,6 +104,52 @@ export async function login(passphrase: string): Promise<AuthSession> {
  return decodeAuthSession(await response.json());
 }

+export interface ManagedUser { username: string; roles: AuthRole[]; enabled: boolean }
+
+async function userRequest(path: string, init?: RequestInit): Promise<Response> {
+  const response = await fetch(path, init);
+  if (!response.ok) {
+    const payload = await response.json().catch(() => ({})) as { error?: string };
+    throw new Error(payload.error || `User operation failed (${response.status})`);
+  }
+  return response;
+}
+
+export async function listUsers(): Promise<ManagedUser[]> {
+  const value: unknown = await userRequest("/auth/users").then(response => response.json());
+  if (!Array.isArray(value) || !value.every((user: unknown) => {
+    if (typeof user !== "object" || user === null) return false;
+    const record = user as Record<string, unknown>;
+    return typeof record.username === "string"
+      && typeof record.enabled === "boolean"
+      && Array.isArray(record.roles)
+      && record.roles.every(isAuthRole);
+  })) {
+    throw new TypeError("The user list response is malformed");
+  }
+  return (value as ManagedUser[]).map(user => ({ ...user, roles: normalizeAuthRoles(user.roles) }));
+}
+
+export async function createUser(username: string, password: string, roles: AuthRole[], enabled = true): Promise<void> {
+  await userRequest("/auth/users", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ username, password, roles, enabled }) });
+}
+
+export async function updateUser(username: string, changes: { password?: string; roles?: AuthRole[]; enabled?: boolean }): Promise<void> {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "PATCH", headers: { "Content-Type": "application/json" }, body: JSON.stringify(changes) });
+}
+
+export async function changeOwnPassword(currentPassword: string, newPassword: string): Promise<void> {
+  await userRequest("/auth/account/password", {
+    method: "PATCH",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({ current_password: currentPassword, new_password: newPassword }),
+  });
+}
+
+export async function deleteUser(username: string): Promise<void> {
+  await userRequest(`/auth/users/${encodeURIComponent(username)}`, { method: "DELETE" });
+}
+
 export async function logout(): Promise<void> {
  const response = await fetch("/auth/logout", { method: "POST" });
  if (response.status !== 404 && !response.ok) throw new Error("Logout failed");
@@ -123,6 +123,8 @@ export type RigListResponse = { active_remote: string | null, rigs: Array<RigLis

 export type FrontendMeta = { clients: number, rigctl_clients: number, audio_clients: number, rigctl_addr: string | null, active_remote: string | null, remotes: Array<string>, owner_callsign: string | null, owner_website_url: string | null, owner_website_name: string | null, ais_vessel_url_base: string | null, show_sdr_gain_control: boolean, initial_map_zoom: number, spectrum_coverage_margin_hz: number, spectrum_usable_span_ratio: number, bandplan_enabled: boolean, bandplan_region: string, decode_history_retention_min: bigint, server_connected: boolean, };

+export type AuthRole = "guest" | "read" | "control" | "write" | "administrator";
+
 export type DecoderActivation = "mode_bound" | "toggle";

 export type DecoderDescriptor = { 
@@ -21,6 +21,17 @@ import {
  fetchAuthSession,
  login,
  logout,
+  listUsers,
+  createUser,
+  updateUser,
+  deleteUser,
+  changeOwnPassword,
+  AUTH_ADMIN_ROLES,
+  AUTH_ROLES,
+  AUTH_ROLE_LABELS,
+  hasAccountControls,
+  hasAuthRole as rolesInclude,
+  normalizeAuthRoles,
 } from "./api/auth.js";
 import {
  formatByteSize as recorderFormatSize,
@@ -189,8 +200,8 @@ interface TrxModules {
    reverseGeocodeLocation(lat: number, lon: number, grid: string): void;
    bandForHz(frequencyHz: number): unknown;
  };
-  scheduler?: { initialize(rigId: string | null, role: AuthRole | null): void; setRig(rigId: string | null): void; wireEvents(): void };
-  backgroundDecode?: { initialize(rigId: string | null, role: AuthRole | null): void; setRig(rigId: string | null): void; wireEvents(): void };
+  scheduler?: { initialize(rigId: string | null, roles: readonly AuthRole[]): void; setRig(rigId: string | null): void; wireEvents(): void };
+  backgroundDecode?: { initialize(rigId: string | null, roles: readonly AuthRole[]): void; setRig(rigId: string | null): void; wireEvents(): void };
  bookmarks?: {
    readonly overlayList: readonly Bookmark[];
    readonly overlayRevision: number;
@@ -226,7 +237,7 @@ interface TrxState {
  readonly initialMapZoom: number;
  readonly decodeHistoryRetentionMin: number;
  readonly authEnabled: boolean;
-  readonly authRole: AuthRole | null;
+  readonly authRoles: readonly AuthRole[];
  readonly decoderRegistry: typeof decoderRegistry;
  readonly sseSessionId: string | null;
  readonly primaryRds: RdsData | null;
@@ -265,7 +276,7 @@ interface TrxUi {
  confirm(options?: { title?: string; message?: string; confirmLabel?: string; danger?: boolean }): Promise<boolean>;
  notify(message: string, options?: { kind?: "info" | "error" | "success" | "warning"; duration?: number; action?: { label?: string; run(): void } | null }): HTMLDivElement;
  setActiveRig(rigId: string | null): void;
-  setLayoutCapabilities(capabilities?: Partial<Record<"broadcast" | "digital", boolean>>): void;
+  setLayoutCapabilities(capabilities?: Partial<Record<"broadcast" | "digital" | "ham", boolean>>): void;
  setButtonState(element: HTMLButtonElement | null, options?: { active?: boolean; activeLabel?: string; inactiveLabel?: string; busy?: boolean; disabled?: boolean }): void;
  closeMobileOverlays?(restoreFocus?: boolean): void;
  syncSelectedTab(container: HTMLElement | null, selected: Element): void;
@@ -406,40 +417,75 @@ declare global {
 void loadDecoderRegistry(refreshOperatorLayoutCapabilities);

 // --- Authentication ---
-let authRole: AuthRole | null = null;
+let authRoles: AuthRole[] = [];
+let authUsername: string | null = null;
 let authEnabled = true;

+function setAuthRoles(roles: readonly AuthRole[]) {
+  authRoles = normalizeAuthRoles(roles);
+}
+
+function hasAuthRole(role: AuthRole) {
+  return rolesInclude(authRoles, role);
+}
+
+function buildRoleChoices(selected: readonly AuthRole[]) {
+  const element = document.createElement("span");
+  element.className = "auth-role-choices";
+  const inputs = AUTH_ROLES.map((value) => {
+    const label = document.createElement("label");
+    label.className = "auth-role-choice";
+    const input = document.createElement("input");
+    input.type = "checkbox";
+    input.value = value;
+    input.checked = selected.includes(value);
+    label.append(input, ` ${AUTH_ROLE_LABELS[value]}`);
+    element.append(label);
+    return { input, value };
+  });
+  inputs.forEach(({ input, value }) => {
+    input.addEventListener("change", () => {
+      if (!input.checked) return;
+      if (value === "guest") {
+        inputs.forEach(choice => { if (choice.value !== "guest") choice.input.checked = false; });
+      } else {
+        const guest = inputs.find(choice => choice.value === "guest");
+        if (guest) guest.input.checked = false;
+      }
+    });
+  });
+  return { element, inputs };
+}
+
 async function checkAuthStatus() {
  return fetchAuthSession();
 }

-async function authLogin(passphrase: string) {
-  return login(passphrase);
+async function authLogin(username: string, password: string) {
+  return login(username, password);
 }

 async function authLogout() {
  try {
    await logout();
-    authRole = null;
+    setAuthRoles([]);
+    authUsername = null;
    // Disconnect and show auth gate without page reload
    disconnect();
    setDecodeHistoryOverlayVisible(false);
    requiredElement("content").style.display = "none";
    requiredElement("loading").style.display = "none";
-    requiredElement<HTMLInputElement>("auth-passphrase").value = "";
+    requiredElement<HTMLInputElement>("auth-password").value = "";
    updateAuthUI();

-    // Check if guest mode is available after logout
-    const authStatus = await checkAuthStatus();
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  } catch (e) {
    console.error("Logout failed:", e);
    showAuthError("Logout failed");
  }
 }

-function showAuthGate(allowGuest = false) {
+function showAuthGate() {
  if (!authEnabled) return;
  setDecodeHistoryOverlayVisible(false);
  requiredElement("loading").style.display = "none";
@@ -459,12 +505,6 @@ function showAuthGate(allowGuest = false) {
    panel.style.display = "none";
  });

-  // Show guest button if guest mode is available
-  const guestBtn = document.getElementById("auth-guest-btn");
-  if (guestBtn) {
-    guestBtn.style.display = allowGuest ? "block" : "none";
-  }
-
  document.querySelectorAll<HTMLElement>(".tab-bar .tab").forEach((btn) => {
    btn.classList.toggle("active", btn.dataset.tab === "main");
  });
@@ -506,22 +546,32 @@ function updateAuthUI() {
  const badge = document.getElementById("auth-badge");
  const badgeRole = document.getElementById("auth-role-badge");
  const headerAuthBtn = document.getElementById("header-auth-btn");
+  const accountTab = document.getElementById("settings-account-tab");

  if (!authEnabled) {
    if (badge) badge.style.display = "none";
    if (headerAuthBtn) headerAuthBtn.style.display = "none";
+    if (accountTab) accountTab.style.display = "none";
    syncTopBarAccess();
    return;
  }

-  if (authRole) {
+  if (authRoles.length > 0) {
+    const canManageAccount = hasAccountControls(authRoles);
+    if (accountTab) accountTab.style.display = canManageAccount ? "" : "none";
+    if (!canManageAccount && accountTab?.classList.contains("active")) {
+      const panel = document.getElementById("subtab-settings-account");
+      if (panel) panel.style.display = "none";
+      document.querySelector<HTMLButtonElement>('[data-subtab="settings-scheduler"]')?.click();
+    }
    if (badge) badge.style.display = "block";
-    if (badgeRole) badgeRole.textContent = authRole === "control" ? "Control (full access)" : "RX (read-only)";
+    if (badgeRole) badgeRole.textContent = `${authUsername || "local"} — ${authRoles.map(role => AUTH_ROLE_LABELS[role]).join(", ")}`;
    if (headerAuthBtn) {
      headerAuthBtn.textContent = "Logout";
      headerAuthBtn.style.display = "block";
    }
  } else {
+    if (accountTab) accountTab.style.display = "none";
    if (badge) badge.style.display = "none";
    if (headerAuthBtn) {
      headerAuthBtn.textContent = "Login";
@@ -532,10 +582,10 @@ function updateAuthUI() {
 }

 function applyAuthRestrictions() {
-  if (!authRole) return;
+  if (authRoles.length === 0) return;

-  // Disable TX/PTT/frequency/mode/VFO controls for rx role
-  if (authRole === "rx") {
+  // Disable TX/PTT/frequency/mode/VFO controls for user role
+  if (!hasAuthRole("control")) {
    const pttBtn = document.getElementById("ptt-btn") as HTMLButtonElement | null;
    const powerBtn = document.getElementById("power-btn") as HTMLButtonElement | null;
    const lockBtn = document.getElementById("lock-btn") as HTMLButtonElement | null;
@@ -867,14 +917,15 @@ window.applyDecodeHistoryRetention = function() {
 };

 function syncTopBarAccess() {
-  const loggedOut = authEnabled && !authRole;
+  const loggedOut = authEnabled && authRoles.length === 0;
  const tabBar = document.getElementById("tab-bar");
  const rigSwitch = document.querySelector<HTMLElement>(".header-rig-switch");
  if (tabBar) tabBar.style.display = "";

  document.querySelectorAll<HTMLButtonElement>(".tab-bar .tab").forEach((btn) => {
    const isMain = btn.dataset.tab === "main";
-    btn.style.display = !loggedOut || isMain ? "" : "none";
+    const lacksLogbookAccess = authEnabled && btn.dataset.tab === "logbook" && !hasAuthRole("write");
+    btn.style.display = (!loggedOut || isMain) && !lacksLogbookAccess ? "" : "none";
    btn.disabled = false;
  });

@@ -883,7 +934,7 @@ function syncTopBarAccess() {
  }

  if (headerRigSwitchSelect) {
-    headerRigSwitchSelect.disabled = loggedOut || authRole === "rx" || lastRigIds.length === 0;
+    headerRigSwitchSelect.disabled = loggedOut || !hasAuthRole("control") || lastRigIds.length === 0;
  }
 }

@@ -1464,13 +1515,17 @@ function applyRigList(activeRigId: string | null, rigIds: string[], displayNames
  }
  const nextKey = lastRigIds.join("\0") + "|" + (lastActiveRigId || "");
  const rigListChanged = prevKey !== nextKey;
-  const disableSwitch = lastRigIds.length === 0 || !authRole || authRole === "rx";
+  const disableSwitch = lastRigIds.length === 0 || !hasAuthRole("control");
  populateRigPicker(headerRigSwitchSelect, lastRigIds, lastActiveRigId, disableSwitch);
  updateRigSubtitle(lastActiveRigId);
  window.trxUi?.setActiveRig(lastActiveRigId);
+  // Told every time, not only when the list changes: these modules load lazily
+  // and can miss the one telling there was, which left them holding no rig and
+  // showing an empty panel until the operator switched rigs. Both ignore a rig
+  // they already have.
+  window.trx.modules.scheduler?.setRig(lastActiveRigId);
+  window.trx.modules.backgroundDecode?.setRig(lastActiveRigId);
  if (rigListChanged) {
-    window.trx.modules.scheduler?.setRig(lastActiveRigId);
-    window.trx.modules.backgroundDecode?.setRig(lastActiveRigId);
    window.trx.modules.bookmarks?.populateScopePicker();
    void window.trx.modules.bookmarks?.fetch((document.getElementById("bm-category-filter") as HTMLSelectElement | null)?.value || "");
  }
@@ -1518,6 +1573,9 @@ function refreshOperatorLayoutCapabilities() {
  window.trxUi?.setLayoutCapabilities({
    broadcast: rigModes.some((modes) => modes.includes("WFM")),
    digital: decoderModes.size > 0 && rigModes.some((modes) => modes.some((mode) => decoderModes.has(mode))),
+    // A logbook is for contacts made, so the layout built around it is offered
+    // where a rig can transmit.
+    ham: serverRigs.some((rig) => rig?.tx === true),
  });
 }

@@ -3345,7 +3403,7 @@ function scheduleTuneLinkSync() {
 async function applyTuneLink(link: TuneLink) {
  const wanted = link.rig || link.mode || link.freqHz != null || link.bandwidthHz != null;
  if (!wanted) return;
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
    showHint("Read-only session — link not applied", 2500);
    return;
  }
@@ -4155,7 +4213,7 @@ async function postPath(path: string, options: PostOptions = {}) {
  const resp = await fetch(path, { method: "POST" });
  if (authEnabled && resp.status === 401) {
    // Not authenticated - return to login
-    authRole = null;
+    setAuthRoles([]);
    if (es) es.close();
    showAuthGate();
    throw new Error("Authentication required");
@@ -4184,7 +4242,7 @@ async function switchRigFromSelect(selectEl: HTMLSelectElement) {
    showHint("No rig selected", 1500);
    return;
  }
-  if (authRole === "rx") {
+  if (!hasAuthRole("control")) {
    showHint("Control role required", 1500);
    return;
  }
@@ -4867,8 +4925,13 @@ function navigateToTab(name: TabName, options: { updateHistory?: boolean; replac
  window.trxUi?.closeMobileOverlays?.();
  const leavingSatellites = _activeTab === "satellites" && name !== "satellites";
  const { updateHistory = true, replaceHistory = false } = options;
-  if (authEnabled && !authRole && name !== "main") {
-    showAuthGate(false);
+  if (authEnabled && authRoles.length === 0 && name !== "main") {
+    showAuthGate();
+    return;
+  }
+  if (authEnabled && name === "logbook" && !hasAuthRole("write")) {
+    showHint("Write role required for logbook access", 2500);
+    navigateToTab("main", options);
    return;
  }
  const btn = document.querySelector<HTMLElement>(`.tab-bar .tab[data-tab="${name}"]`);
@@ -4912,6 +4975,8 @@ function navigateToTab(name: TabName, options: { updateHistory?: boolean; replac
    // Passes go stale while the page is closed, so each visit reloads them.
    // The first visit is what imports the module, which renders on its own.
    if (name === "satellites") window.refreshSatPredictions?.();
+    // The map module owns the decode log; this is the moment it can exist.
+    flushPendingDecodeStats();
  }).catch((error: unknown) => { console.error(error); });
  if (name === "map") {
    _initMapWhenReady();
@@ -4999,12 +5064,12 @@ window.addEventListener("resize", () => { scheduleSpectrumLayout(); });

 // --- Auth startup sequence ---
 async function initializeApp() {
-  showAuthGate(false);
+  showAuthGate();
  const authStatus = await checkAuthStatus();
  authEnabled = !authStatus.auth_disabled;

  if (!authEnabled) {
-    authRole = "control";
+    setAuthRoles(AUTH_ADMIN_ROLES);
    hideAuthGate();
    updateAuthUI();
    connect();
@@ -5017,7 +5082,8 @@ async function initializeApp() {

  if (authStatus.authenticated) {
    // User has valid session
-    authRole = authStatus.role ?? null;
+    setAuthRoles(authStatus.roles);
+    authUsername = authStatus.username ?? null;
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -5027,36 +5093,188 @@ async function initializeApp() {
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } else {
-    // No valid session - show auth gate
-    // Guest button is shown if guest mode is available (role granted without auth)
-    const allowGuest = authStatus.role === "rx";
-    showAuthGate(allowGuest);
+    showAuthGate();
  }
 }

+// Whether the session got far enough to wire the settings panels up, so the
+// plugins can be wired again if they turn up after it did.
+let settingsUiReady = false;
+
 function initSettingsUI() {
-  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRole);
+  settingsUiReady = true;
+  window.trx.modules.scheduler?.initialize(lastActiveRigId, authRoles);
  window.trx.modules.scheduler?.wireEvents();
  if (window.trx.modules.backgroundDecode) {
-    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRole);
+    window.trx.modules.backgroundDecode.initialize(lastActiveRigId, authRoles);
    window.trx.modules.backgroundDecode.wireEvents();
  }
+  void refreshUserManagement();
 }

+async function refreshUserManagement() {
+  const section = document.getElementById("user-management");
+  const tab = document.getElementById("settings-users-tab");
+  if (!section || !tab) return;
+  const canManageUsers = authEnabled && hasAuthRole("administrator");
+  tab.style.display = canManageUsers ? "" : "none";
+  if (!canManageUsers) {
+    const panel = document.getElementById("subtab-settings-users");
+    if (panel) panel.style.display = "none";
+    if (tab.classList.contains("active")) {
+      document.querySelector<HTMLButtonElement>('[data-subtab="settings-scheduler"]')?.click();
+    }
+    return;
+  }
+  const list = requiredElement("user-list");
+  try {
+    const users = await listUsers();
+    const enabledAdminCount = users.filter(user => user.enabled && rolesInclude(user.roles, "administrator")).length;
+    list.replaceChildren(...users.map((user) => {
+      const row = document.createElement("div");
+      row.className = "sch-row";
+      row.style.cssText = "display:flex;align-items:center;gap:.5rem;flex-wrap:wrap;margin:.4rem 0";
+      const name = document.createElement("strong");
+      name.textContent = user.username;
+      name.style.minWidth = "10rem";
+      if (!user.enabled) name.textContent += " (disabled)";
+      const { element: roles, inputs: roleInputs } = buildRoleChoices(user.roles);
+      const enabledLabel = document.createElement("label");
+      enabledLabel.className = "auth-role-choice";
+      const enabled = document.createElement("input");
+      enabled.type = "checkbox";
+      enabled.checked = user.enabled;
+      enabled.disabled = user.username === authUsername;
+      if (enabled.disabled) enabled.title = "You cannot disable your current account";
+      enabledLabel.append(enabled, " Enabled");
+      const isOnlyAdmin = user.enabled
+        && rolesInclude(user.roles, "administrator")
+        && enabledAdminCount === 1;
+      const administratorInput = roleInputs.find(item => item.value === "administrator")?.input;
+      const guestInput = roleInputs.find(item => item.value === "guest")?.input;
+      if (isOnlyAdmin && administratorInput) {
+        administratorInput.disabled = true;
+        administratorInput.title = "The final administrator cannot be demoted";
+      }
+      if (isOnlyAdmin && guestInput) {
+        guestInput.disabled = true;
+        guestInput.title = "The final administrator cannot become a Guest";
+      }
+      if (isOnlyAdmin) {
+        enabled.disabled = true;
+        enabled.title = "The final enabled administrator cannot be disabled";
+      }
+      const password = document.createElement("input");
+      password.type = "password"; password.placeholder = "New password (8+ characters)"; password.autocomplete = "new-password"; password.className = "auth-input"; password.minLength = 8; password.maxLength = 1024;
+      const save = document.createElement("button"); save.type = "button"; save.textContent = "Save";
+      save.addEventListener("click", async () => {
+        const changes: { roles?: AuthRole[]; password?: string; enabled?: boolean } = {
+          roles: roleInputs.filter(({ input }) => input.checked).map(({ value }) => value),
+          enabled: enabled.checked,
+        };
+        if (password.value) changes.password = password.value;
+        await runUserOperation(() => updateUser(user.username, changes));
+      });
+      const remove = document.createElement("button"); remove.type = "button"; remove.textContent = "Remove"; remove.className = "danger";
+      remove.disabled = user.username === authUsername || isOnlyAdmin;
+      if (isOnlyAdmin) remove.title = "The final administrator cannot be removed";
+      remove.addEventListener("click", async () => {
+        if (await window.trxUi.confirm({ title: "Remove user?", message: `Remove ${user.username} and revoke their sessions?`, confirmLabel: "Remove", danger: true })) {
+          await runUserOperation(() => deleteUser(user.username));
+        }
+      });
+      row.append(name, enabledLabel, roles, password, save, remove);
+      return row;
+    }));
+  } catch (error) {
+    showUserManagementError(error);
+  }
+}
+
+function showUserManagementError(error: unknown) {
+  const element = document.getElementById("user-management-error");
+  if (!element) return;
+  element.textContent = error instanceof Error ? error.message : String(error);
+  element.style.display = "block";
+}
+
+async function runUserOperation(operation: () => Promise<void>) {
+  try {
+    await operation();
+    const error = document.getElementById("user-management-error");
+    if (error) error.style.display = "none";
+    await refreshUserManagement();
+  } catch (reason) {
+    showUserManagementError(reason);
+  }
+}
+
+const createRoleContainer = document.getElementById("user-create-roles");
+if (createRoleContainer) {
+  const { element } = buildRoleChoices(["read"]);
+  element.id = createRoleContainer.id;
+  createRoleContainer.replaceWith(element);
+}
+
+document.getElementById("user-create-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const username = requiredElement<HTMLInputElement>("user-create-username");
+  const password = requiredElement<HTMLInputElement>("user-create-password");
+  const enabled = requiredElement<HTMLInputElement>("user-create-enabled");
+  const roles = Array.from(document.querySelectorAll<HTMLInputElement>("#user-create-roles input[type=checkbox]"));
+  void runUserOperation(async () => {
+    await createUser(username.value, password.value, roles.filter(input => input.checked).map(input => input.value as AuthRole), enabled.checked);
+    username.value = ""; password.value = "";
+    enabled.checked = true;
+    roles.forEach(input => { input.checked = input.value === "read"; });
+  });
+});
+
+document.getElementById("account-password-form")?.addEventListener("submit", (event) => {
+  event.preventDefault();
+  const form = event.currentTarget as HTMLFormElement;
+  const currentPassword = requiredElement<HTMLInputElement>("account-current-password");
+  const newPassword = requiredElement<HTMLInputElement>("account-new-password");
+  const confirmPassword = requiredElement<HTMLInputElement>("account-confirm-password");
+  const error = requiredElement("account-password-error");
+  const submit = form.querySelector<HTMLButtonElement>('button[type="submit"]');
+  if (newPassword.value !== confirmPassword.value) {
+    error.textContent = "New passwords do not match";
+    error.style.display = "block";
+    return;
+  }
+  if (submit) submit.disabled = true;
+  void changeOwnPassword(currentPassword.value, newPassword.value)
+    .then(async () => {
+      form.reset();
+      error.style.display = "none";
+      await authLogout();
+      showHint("Password changed. Sign in again.", 3000);
+    })
+    .catch((reason: unknown) => {
+      error.textContent = reason instanceof Error ? reason.message : String(reason);
+      error.style.display = "block";
+    })
+    .finally(() => {
+      if (submit) submit.disabled = false;
+    });
+});
+
 // Setup auth form
 requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (e) => {
  e.preventDefault();
-  const passphraseEl = requiredElement<HTMLInputElement>("auth-passphrase");
-  const passphrase = passphraseEl.value;
+  const usernameEl = requiredElement<HTMLInputElement>("auth-username");
+  const passwordEl = requiredElement<HTMLInputElement>("auth-password");
  const btn = requiredElement<HTMLFormElement>("auth-form").querySelector<HTMLButtonElement>("button[type=submit]");
  if (!btn) return;
  btn.disabled = true;
  btn.textContent = "Logging in...";

  try {
-    const result = await authLogin(passphrase);
-    authRole = result.role ?? null;
-    passphraseEl.value = "";
+    const result = await authLogin(usernameEl.value, passwordEl.value);
+    setAuthRoles(result.roles);
+    authUsername = result.username ?? usernameEl.value;
+    passwordEl.value = "";
    hideAuthGate();
    updateAuthUI();
    applyAuthRestrictions();
@@ -5066,7 +5284,7 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
    resizeHeaderSignalCanvas();
    startHeaderSignalSampling();
  } catch (err) {
-    showAuthError("Invalid passphrase");
+    showAuthError("Invalid username or password");
    console.error("Login error:", err);
  } finally {
    btn.disabled = false;
@@ -5074,35 +5292,18 @@ requiredElement<HTMLFormElement>("auth-form").addEventListener("submit", async (
  }
 });

-// Setup guest button
-const guestBtn = document.getElementById("auth-guest-btn") as HTMLButtonElement | null;
-if (guestBtn) {
-  guestBtn.addEventListener("click", () => {
-    authRole = "rx";
-    requiredElement<HTMLInputElement>("auth-passphrase").value = "";
-    hideAuthGate();
-    updateAuthUI();
-    applyAuthRestrictions();
-    connect();
-    connectDecode();
-    initSettingsUI();
-    resizeHeaderSignalCanvas();
-    startHeaderSignalSampling();
-  });
-}
-
 // Setup header auth button (Login/Logout)
 const headerAuthBtn = document.getElementById("header-auth-btn") as HTMLButtonElement | null;
 if (headerAuthBtn) {
  headerAuthBtn.addEventListener("click", async () => {
-    if (authRole) {
+    if (authRoles.length > 0) {
      // Logged in - show logout confirmation
      if (await window.trxUi.confirm({ title: "Log out?", message: "Audio and control access for this browser session will end.", confirmLabel: "Log out", danger: false })) {
        await authLogout();
      }
    } else {
      // Not logged in - show auth gate
-      showAuthGate(false);
+      showAuthGate();
    }
  });
 }
@@ -5124,7 +5325,7 @@ Object.defineProperties(trxState, {
  initialMapZoom:         { get() { return initialMapZoom;         } },
  decodeHistoryRetentionMin: { get() { return decodeHistoryRetentionMin; } },
  authEnabled:            { get() { return authEnabled;            } },
-  authRole:               { get() { return authRole;               } },
+  authRoles:              { get() { return authRoles;              } },
  decoderRegistry:        { get() { return decoderRegistry;        } },
  sseSessionId:           { get() { return sseSessionId;           } },
  primaryRds:             { get() { return primaryRds;             } },
@@ -5187,7 +5388,15 @@ window.trx = Object.freeze({ state: trxState, core: trxCore, modules: trxModules

 // Load plugin scripts now that window.trx is populated.  Dynamic scripts are
 // async so they must not be created before the namespace they depend on exists.
-void loadEagerPlugins().catch((error: unknown) => { console.error(error); });
+//
+// Wire the settings panels again once they are here: the session can be up
+// before these modules finish importing, and the wiring at that point silently
+// skipped whichever had not arrived.  A panel that missed it had no rig, no
+// data, and dead buttons — for the rest of the session, since nothing came
+// back to it.  Both entry points are safe to run twice.
+void loadEagerPlugins()
+  .then(() => { if (settingsUiReady) initSettingsUI(); })
+  .catch((error: unknown) => { console.error(error); });

 // Start the app
 void initializeApp();
@@ -6597,11 +6806,49 @@ const IMAGE_DECODE_KINDS = new Set([
  "lrpt_image", "lrpt_progress", "wefax", "wefax_progress", "sstv", "sstv_progress",
 ]);

+// The decode log the Statistics page counts lives in the map module, which is
+// lazy: it arrives when the Map or Statistics tab is first opened, long after
+// the history replayed and the live decodes started coming.  Recording into a
+// module that is not there yet dropped every one of them, and nothing replayed
+// them afterwards -- so the page opened empty and only filled in from decodes
+// heard after it, which is why it took a reload (landing on the tab, so the
+// module loads at startup) to show the whole picture.  Hold them here until
+// the module arrives, then hand them over.
+interface PendingDecodeStat { kind: string; rig: string | null; tsMs: number | undefined }
+const pendingDecodeStats: PendingDecodeStat[] = [];
+// The module's own log keeps 50k entries; there is no point holding more here.
+const PENDING_DECODE_STATS_MAX = 50_000;
+
+function recordDecodeStat(kind: string, rig: string | null, tsMs?: number) {
+  const stats = window.trx.modules.map;
+  if (stats) {
+    stats.statsRecordDecode(kind, rig, tsMs);
+    return;
+  }
+  pendingDecodeStats.push({ kind, rig, tsMs });
+  if (pendingDecodeStats.length > PENDING_DECODE_STATS_MAX) {
+    pendingDecodeStats.splice(0, pendingDecodeStats.length - PENDING_DECODE_STATS_MAX);
+  }
+}
+
+function flushPendingDecodeStats() {
+  const stats = window.trx.modules.map;
+  if (!stats || pendingDecodeStats.length === 0) return;
+  for (const entry of pendingDecodeStats.splice(0)) {
+    stats.statsRecordDecode(entry.kind, entry.rig, entry.tsMs);
+  }
+  stats.scheduleStatsRender();
+}
+
+function scheduleStatsRenderIfLoaded() {
+  window.trx.modules.map?.scheduleStatsRender();
+}
+
 function dispatchDecodeMessage(msg: DecodeMessage, skipStats = false) {
  if (msg.type) window.trxPluginRuntime.dispatch(msg.type, msg);
  if (!skipStats && msg.type && !IMAGE_DECODE_KINDS.has(msg.type)) {
-    window.trx.modules.map?.statsRecordDecode(msg.type, msg.rig_id || msg.remote || null);
-    window.trx.modules.map?.scheduleStatsRender();
+    recordDecodeStat(msg.type, msg.rig_id || msg.remote || null);
+    scheduleStatsRenderIfLoaded();
  }
 }

@@ -6651,9 +6898,9 @@ function restoreDecodeHistoryGroup(kind: string, messages: DecodeMessage[]) {
  // Record statistics for restored history messages.
  if (!IMAGE_DECODE_KINDS.has(kind)) {
    for (const msg of messages) {
-      window.trx.modules.map?.statsRecordDecode(kind, msg.rig_id || msg.remote || null, msg.ts_ms || undefined);
+      recordDecodeStat(kind, msg.rig_id || msg.remote || null, msg.ts_ms || undefined);
    }
-    window.trx.modules.map?.scheduleStatsRender();
+    scheduleStatsRenderIfLoaded();
  }
  window.trxPluginRuntime.restore(kind, messages);
 }
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 export const TAB_ORDER = [
-  "main", "bookmarks", "digital-modes", "map", "satellites", "statistics", "recorder", "settings", "about",
+  "main", "bookmarks", "logbook", "digital-modes", "map", "satellites", "statistics", "recorder", "settings", "about",
 ] as const;

 export type TabName = typeof TAB_ORDER[number];
@@ -11,6 +11,7 @@ export type TabName = typeof TAB_ORDER[number];
 export const TAB_PATHS: Readonly<Record<TabName, string>> = {
  main: "/",
  bookmarks: "/bookmarks",
+  logbook: "/logbook",
  "digital-modes": "/digital-modes",
  map: "/map",
  satellites: "/satellites",
@@ -31,7 +31,7 @@ function mapEl(id: string): MapElement {
  return element as MapElement;
 }

-type DecoderSource = "ais" | "vdes" | "aprs" | "bookmark" | "ft8" | "ft4" | "ft2" | "wspr" | "sat";
+type DecoderSource = "ais" | "vdes" | "aprs" | "hf_aprs" | "bookmark" | "ft8" | "ft4" | "ft2" | "wspr" | "sat";
 interface TrackPoint { lat: number; lon: number; tsMs: number }
 interface DecodeDetail {
  station?: string | null; source?: string | null; target?: string | null;
@@ -83,6 +83,9 @@ interface MapEntry {
  bookmarks?: Array<Record<string, unknown>>;
  bounds?: Leaflet.LatLngBoundsExpression;
  symbolTable?: string; symbolCode?: string; bandLabel?: string | null;
+  /** Callsign as heard.  The map key qualifies it with the source, so that a
+   *  station worked on both 144 MHz and 30 m keeps one marker per band. */
+  call?: string;
  overlay?: TrxLayer | null; line?: TrxLayer | null; labelMarker?: TrxLayer | null;
  pathKey?: string; sourceGrid?: string; targetGrid?: string;
  from?: LatLon; to?: LatLon;
@@ -171,7 +174,7 @@ interface MapWindow {
  clearMapMarkersByType?(type: DecoderSource): void;
  navigateToAprsMap?(lat: number, lon: number): void;
  navigateToMapLocator?(grid: string, preferredType?: string | null): void;
-  aprsMapAddStation?(call: string, lat: number, lon: number, info: string, symbolTable: string, symbolCode: string, packet: MapMessage): void;
+  aprsMapAddStation?(call: string, lat: number, lon: number, info: string, symbolTable: string, symbolCode: string, packet: MapMessage, source?: "aprs" | "hf_aprs"): void;
  aisMapAddVessel?(message: MapMessage): void;
  vdesMapAddPoint?(message: MapMessage): void;
  syncBookmarkMapLocators?(bookmarks: Array<Record<string, unknown>>): void;
@@ -228,7 +231,7 @@ const mapWindow = window as unknown as MapWindow;
  const decodeContactPaths = new Map<string, MapEntry>();
  let selectedMapQsoKey: string | null = null;
  const mapMarkers = new Set<TrxLayer>();
-  const DEFAULT_MAP_SOURCE_FILTER: Record<MapFilterKey, boolean> = { ais: true, vdes: true, aprs: true, bookmark: false, ft8: true, ft4: true, ft2: true, wspr: true, sat: false };
+  const DEFAULT_MAP_SOURCE_FILTER: Record<MapFilterKey, boolean> = { ais: true, vdes: true, aprs: true, hf_aprs: true, bookmark: false, ft8: true, ft4: true, ft2: true, wspr: true, sat: false };
  const mapFilter: Record<MapFilterKey, boolean> = { ...DEFAULT_MAP_SOURCE_FILTER };
  /** Chip key that clears a selection rather than naming a band or a source. */
  const MAP_FILTER_ALL_KEY = "__all";
@@ -302,6 +305,18 @@ const mapWindow = window as unknown as MapWindow;
    return trimmed;
  }

+  /** The source a station marker belongs to, defaulting to VHF APRS for
+   *  entries stored before HF APRS had a source of its own. */
+  function aprsEntrySource(entry: MapEntry | null | undefined): DecoderSource {
+    return entry?.type === "hf_aprs" ? "hf_aprs" : "aprs";
+  }
+
+  /** Map key for a station: the callsign alone on VHF, source-qualified on HF,
+   *  so one station heard on both bands keeps a marker for each. */
+  function aprsStationKey(call: string, source: DecoderSource): string {
+    return source === "aprs" ? call : `${source}:${call}`;
+  }
+
  function refreshAprsTrack(call: string, entry: MapEntry): void {
    if (!entry) return;
    if (!Array.isArray(entry.trackPoints) || entry.trackPoints.length < 2) {
@@ -323,7 +338,7 @@ const mapWindow = window as unknown as MapWindow;
      lineJoin: "round",
      interactive: false,
    }) as unknown as TrxLayer;
-    track.__trxType = "aprs";
+    track.__trxType = aprsEntrySource(entry);
    track._aprsCall = call;
    entry.track = track;
  }
@@ -575,6 +590,7 @@ const mapWindow = window as unknown as MapWindow;

  function mapSourceLabel(type: DecoderSource): string {
    if (type === "bookmark") return "Bookmarks";
+    if (type === "hf_aprs") return "HF APRS";
    return String(type || "").toUpperCase();
  }

@@ -594,6 +610,8 @@ const mapWindow = window as unknown as MapWindow;
    if (type === "vdes") return "#a78bfa";
    if (type === "sat") return "#f59e0b";
    if (type === "aprs") return "#00d17f";
+    // Far enough from the VHF green to tell the two apart at a glance.
+    if (type === "hf_aprs") return "#fb7185";
    return locatorFilterColor(type);
  }

@@ -1188,10 +1206,8 @@ const mapWindow = window as unknown as MapWindow;
      }
    }
    for (const entry of stationMarkers.values()) {
-      if (entry?.type === "aprs" && entry?.visibleInHistoryWindow) {
-        availableSources.add("aprs");
-        break;
-      }
+      if (!entry?.visibleInHistoryWindow) continue;
+      availableSources.add(aprsEntrySource(entry));
    }
    const bandMap = new Map<string, FilterChip>();
    for (const entry of locatorMarkers.values()) {
@@ -1225,7 +1241,7 @@ const mapWindow = window as unknown as MapWindow;
      if (!bandMap.has(key)) mapLocatorFilter.bands.delete(key);
    }

-    const sourceItems: FilterChip[] = (["ais", "vdes", "aprs", "bookmark", "ft8", "ft4", "ft2", "wspr"] as DecoderSource[])
+    const sourceItems: FilterChip[] = (["ais", "vdes", "aprs", "hf_aprs", "bookmark", "ft8", "ft4", "ft2", "wspr"] as DecoderSource[])
      .filter((key) => availableSources.has(key))
      .map((key) => ({
        key,
@@ -1296,9 +1312,10 @@ const mapWindow = window as unknown as MapWindow;
      }
      return parts.join(" ").toLowerCase();
    }
-    if (type === "aprs") {
-      const call = marker?._aprsCall ? String(marker._aprsCall) : "";
-      const entry = stationMarkers.get(call);
+    if (type === "aprs" || type === "hf_aprs") {
+      const key = marker?._aprsCall ? String(marker._aprsCall) : "";
+      const entry = stationMarkers.get(key);
+      const call = entry?.call ?? key;
      const info = entry?.info ? String(entry.info) : "";
      const pktRaw = entry?.pkt?.raw ? String(entry.pkt.raw) : "";
      return `${call} ${info} ${pktRaw}`.toLowerCase();
@@ -1496,9 +1513,10 @@ const mapWindow = window as unknown as MapWindow;
  };

  mapWindow.clearMapMarkersByType = function(type) {
-    if (type === "aprs") {
+    if (type === "aprs" || type === "hf_aprs") {
      selectedAprsTrackCall = null;
-      stationMarkers.forEach((entry) => {
+      stationMarkers.forEach((entry, key) => {
+        if (aprsEntrySource(entry) !== type) return;
        if (entry && entry.marker) {
          if (aprsMap && aprsMap.hasLayer(entry.marker)) entry.marker.removeFrom(aprsMap);
          mapMarkers.delete(entry.marker);
@@ -1507,8 +1525,8 @@ const mapWindow = window as unknown as MapWindow;
          if (aprsMap && aprsMap.hasLayer(entry.track)) entry.track.removeFrom(aprsMap);
          mapMarkers.delete(entry.track);
        }
+        stationMarkers.delete(key);
      });
-      stationMarkers.clear();
      return;
    }

@@ -1781,13 +1799,15 @@ const mapWindow = window as unknown as MapWindow;
        if (!ll) return;
        const entry = stationMarkers.get(marker._aprsCall);
        if (!entry) return;
-        e.popup.setContent(buildAprsPopupHtml(marker._aprsCall, ll.lat, ll.lng, entry.info || "", entry.pkt));
+        const source = aprsEntrySource(entry);
+        const call = entry.call ?? String(marker._aprsCall);
+        e.popup.setContent(buildAprsPopupHtml(call, ll.lat, ll.lng, entry.info || "", entry.pkt));
        refreshAprsTrack(String(marker._aprsCall), entry);
-        if (entry.track && aprsMap && mapFilter.aprs && !aprsMap.hasLayer(entry.track)) {
+        if (entry.track && aprsMap && mapFilter[source] && !aprsMap.hasLayer(entry.track)) {
          entry.track.addTo(aprsMap);
        }
        selectedAprsTrackCall = String(marker._aprsCall);
-        setMapRadioPathTo(ll.lat, ll.lng, mapSourceColor("aprs"), "aprs-radio-path", marker.__trxRigIds);
+        setMapRadioPathTo(ll.lat, ll.lng, mapSourceColor(source), "aprs-radio-path", marker.__trxRigIds);
        return;
      }

@@ -2270,28 +2290,33 @@ const mapWindow = window as unknown as MapWindow;
    return null;
  }

-  function _aprsAddMarkerToMap(call: string, entry: MapEntry): void {
+  function _aprsAddMarkerToMap(key: string, entry: MapEntry): void {
    if (!aprsMap || entry.lat == null || entry.lon == null) return;
-    refreshAprsTrack(call, entry);
+    refreshAprsTrack(key, entry);
+    const source = aprsEntrySource(entry);
+    const call = entry.call ?? key;
    const icon = aprsSymbolIcon(entry.symbolTable ?? "", entry.symbolCode ?? "");
    const popupContent = buildAprsPopupHtml(call, entry.lat, entry.lon, entry.info || "", entry.pkt);
+    const color = mapSourceColor(source);
    const marker = (icon
      ? L.marker([entry.lat, entry.lon], { icon }).addTo(aprsMap).bindPopup(popupContent)
      : L.circleMarker([entry.lat, entry.lon], {
-          radius: 6, color: "#00d17f", fillColor: "#00d17f", fillOpacity: 0.8
+          radius: 6, color, fillColor: color, fillOpacity: 0.8
        }).addTo(aprsMap).bindPopup(popupContent)) as unknown as TrxLayer;
-    marker.__trxType = "aprs";
+    marker.__trxType = source;
    marker.__trxRigIds = entry.rigIds || new Set();
-    marker._aprsCall = call;
+    marker._aprsCall = key;
    entry.marker = marker;
    mapMarkers.add(marker);
  }

-  mapWindow.aprsMapAddStation = function(call, lat, lon, info, symbolTable, symbolCode, pkt) {
+  mapWindow.aprsMapAddStation = function(call, lat, lon, info, symbolTable, symbolCode, pkt, source) {
    const nextPoint: Leaflet.LatLngTuple = [lat, lon];
    const tsMs = Number.isFinite(pkt?._tsMs) ? Number(pkt._tsMs) : Date.now();
    const msgRigId = pkt?.rig_id || T.lastActiveRigId;
-    const existing = stationMarkers.get(call);
+    const stationSource: DecoderSource = source === "hf_aprs" ? "hf_aprs" : "aprs";
+    const key = aprsStationKey(call, stationSource);
+    const existing = stationMarkers.get(key);
    if (existing) {
      existing.pkt = pkt;
      existing.lat = lat;
@@ -2310,7 +2335,8 @@ const mapWindow = window as unknown as MapWindow;
      } else if (prevPoint) {
        prevPoint.tsMs = tsMs;
      }
-      pruneAprsEntry(call, existing, mapHistoryCutoffMs());
+      existing.call = call;
+      pruneAprsEntry(key, existing, mapHistoryCutoffMs());
      if (aprsMap && existing.marker && !T.decodeHistoryReplayActive) {
        existing.marker.setLatLng([lat, lon]);
        existing.marker.setPopupContent(buildAprsPopupHtml(call, lat, lon, info, pkt));
@@ -2321,7 +2347,8 @@ const mapWindow = window as unknown as MapWindow;
        track: null,
        trackHistory: [{ lat, lon, tsMs }],
        trackPoints: [nextPoint],
-        type: "aprs",
+        type: stationSource,
+        call,
        pkt,
        lat,
        lon,
@@ -2330,9 +2357,9 @@ const mapWindow = window as unknown as MapWindow;
        symbolCode,
        rigIds: new Set(msgRigId ? [msgRigId] : []),
      };
-      stationMarkers.set(call, entry);
-      pruneAprsEntry(call, entry, mapHistoryCutoffMs());
-      if (entry.visibleInHistoryWindow) ensureAprsMarker(call, entry);
+      stationMarkers.set(key, entry);
+      pruneAprsEntry(key, entry, mapHistoryCutoffMs());
+      if (entry.visibleInHistoryWindow) ensureAprsMarker(key, entry);
      if (aprsMap) scheduleDecodeMapMaintenance();
    }
  };
@@ -4,7 +4,7 @@

 type PluginGroup =
  | "digital-modes" | "map-data" | "map" | "satellites" | "statistics"
-  | "bookmarks" | "recorder" | "settings";
+  | "bookmarks" | "logbook" | "recorder" | "settings";

 const pluginGroups: Readonly<Record<PluginGroup, readonly string[]>> = {
  // AIS, VDES and the two APRS decoders have panels on this tab, so they load
@@ -20,6 +20,7 @@ const pluginGroups: Readonly<Record<PluginGroup, readonly string[]>> = {
  satellites: ["/satellite-predictions.js"],
  statistics: ["/map-core.js"],
  bookmarks: ["/bookmarks.js"],
+  logbook: ["/logbook.js"],
  recorder: [],
  settings: ["/vchan.js", "/scheduler.js"],
 };
@@ -47,7 +48,7 @@ async function loadPlugins(group: string): Promise<void> {
 }

 export async function loadEagerPlugins(): Promise<void> {
-  await Promise.all(["digital-modes", "bookmarks", "settings"].map(loadPlugins));
+  await Promise.all(["digital-modes", "bookmarks", "logbook", "settings"].map(loadPlugins));
 }

 export async function loadPluginsForTab(tab: string): Promise<void> {
@@ -324,6 +324,21 @@ export interface AprsRowOptions {
  onMap?: (lat: number, lon: number) => void;
  /** Puts a frame's coordinates on the clipboard. */
  onCopy?: (text: string, button: HTMLElement) => void;
+  /** Opens a log entry for the station that sent the frame. */
+  onLog?: (call: string, gridsquare: string | null) => void;
+}
+
+/** A position as a six-character locator, which is what a log wants. */
+function maidenheadForLatLon(lat: number, lon: number): string {
+  const adjustedLon = lon + 180;
+  const adjustedLat = lat + 90;
+  const field = String.fromCharCode(65 + Math.floor(adjustedLon / 20))
+    + String.fromCharCode(65 + Math.floor(adjustedLat / 10));
+  const square = String(Math.floor((adjustedLon % 20) / 2)) + String(Math.floor(adjustedLat % 10));
+  const subLon = ((adjustedLon % 2) * 60) / 5;
+  const subLat = ((adjustedLat % 1) * 60) / 2.5;
+  const sub = String.fromCharCode(97 + Math.floor(subLon)) + String.fromCharCode(97 + Math.floor(subLat));
+  return `${field}${square}${sub}`.toUpperCase();
 }

 export function renderAprsPacketRow(packet: AprsPacket, options: AprsRowOptions = {}): HTMLElement {
@@ -370,6 +385,7 @@ export function renderAprsPacketRow(packet: AprsPacket, options: AprsRowOptions
        (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-map="${packet.lat},${packet.lon}">Map</button>` : "") +
        (hasPosition ? `<button class="aprs-inline-btn" type="button" data-aprs-copy="${packet.lat},${packet.lon}">Copy Coords</button>` : "") +
        `<a class="aprs-inline-btn" href="${qrzHref}" target="_blank" rel="noopener">QRZ</a>` +
+        (options.onLog && packet.srcCall ? '<button class="aprs-inline-btn" type="button" data-aprs-log="1">Log</button>' : "") +
      `</div>` +
    `</div>`;

@@ -381,6 +397,17 @@ export function renderAprsPacketRow(packet: AprsPacket, options: AprsRowOptions
      if (Number.isFinite(lat) && Number.isFinite(lon)) options.onMap?.(lat as number, lon as number);
    });
  });
+  const logButton = row.querySelector<HTMLElement>("[data-aprs-log]");
+  if (logButton) {
+    logButton.addEventListener("click", (event) => {
+      event.preventDefault();
+      event.stopPropagation();
+      const grid = packet.lat != null && packet.lon != null
+        ? maidenheadForLatLon(packet.lat, packet.lon)
+        : null;
+      options.onLog?.(packet.srcCall ?? "", grid);
+    });
+  }
  const copyButton = row.querySelector<HTMLElement>("[data-aprs-copy]");
  if (copyButton) {
    copyButton.addEventListener("click", (event) => {
@@ -23,6 +23,7 @@ interface AprsBridge {
  aprsMapAddStation?: (call: string, lat: number, lon: number, info: string, symbolTable: string | null | undefined, symbolCode: string | null | undefined, packet: AprsPacket) => void;
  getDecodeRigMeta?: () => unknown;
  trxUi: { confirm(options: { title: string; message: string; confirmLabel: string }): Promise<boolean> };
+  logContact?: (seed: { call?: string; gridsquare?: string | undefined; decoder?: string }) => void;
  updateAprsBar?: () => void;
  clearAprsBar?: () => void;
  closeAprsBar?: () => void;
@@ -164,6 +165,9 @@ function renderAprsRow(pkt: AprsPacket, isFresh: boolean): HTMLElement {
    distance: aprsDistanceText(pkt),
    onMap: (lat, lon) => { aprsWindow.navigateToAprsMap?.(lat, lon); },
    onCopy: (text) => { void copyAprsCoords(text); },
+    onLog: (call, gridsquare) => {
+      aprsWindow.logContact?.({ call, gridsquare: gridsquare ?? undefined, decoder: "aprs" });
+    },
  });
 }

@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import { hostState } from "./host.js";
+import { hasAuthRole, type AuthRole } from "../api/auth.js";

 export {};

@@ -44,7 +45,7 @@ interface BackgroundBridge {
  trx?: { modules?: { backgroundDecode?: BackgroundDecodeService } };
 }
 interface BackgroundDecodeService {
-  initialize(rigId: string | null, role: string | null): void;
+  initialize(rigId: string | null, roles: readonly AuthRole[]): void;
  wireEvents(): void;
  setRig(rigId: string | null): void;
 }
@@ -60,16 +61,23 @@ const bgdWindow = window as unknown as BackgroundBridge;
      .map(function (d) { return d.id; });
  }

-  let backgroundDecodeRole: string | null = null;
+  let backgroundDecodeRoles: readonly AuthRole[] = [];
  let currentRigId: string | null = null;
  let currentConfig: BackgroundDecodeConfig | null = null;
  let bookmarkList: Bookmark[] = [];
  let statusInterval: ReturnType<typeof setInterval> | null = null;
  let bgdDirty = false;
+  /** Last polled state per bookmark, so a row can say what it is doing. */
+  let statusByBookmark = new Map<string, BackgroundStatusEntry>();
+  let lastStatus: BackgroundDecodeStatus | null = null;

-  function initBackgroundDecode(rigId: string | null, role: string | null): void {
-    backgroundDecodeRole = role;
-    currentRigId = rigId || null;
+  function initBackgroundDecode(rigId: string | null, roles: readonly AuthRole[]): void {
+    backgroundDecodeRoles = roles;
+    // The panel used to take whatever rig it was handed at load and wait to be
+    // told again.  Loading before the rig list arrives handed it null, and the
+    // next telling only came when the operator switched rigs, so the panel sat
+    // empty and silent.  The host knows the rig; ask it.
+    currentRigId = rigId || hostState.lastActiveRigId || null;
    if (currentRigId) loadBackgroundDecode();
    startStatusPolling();
  }
@@ -171,7 +179,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
    setCheckbox("background-decode-enabled", currentConfig.enabled);
    renderBookmarkChecklist();

-    const isControl = backgroundDecodeRole === "control" || hostState.authEnabled === false;
+    const isControl = isControlRole();
    const panel = document.getElementById("background-decode-panel");
    if (panel) {
        panel.querySelectorAll<HTMLInputElement | HTMLSelectElement | HTMLButtonElement>("input, select, button.sch-write").forEach(function (el) {
@@ -182,6 +190,11 @@ const bgdWindow = window as unknown as BackgroundBridge;
    const resetBtn = document.getElementById("background-decode-reset-btn");
    if (saveBtn) saveBtn.style.display = isControl ? "" : "none";
    if (resetBtn) resetBtn.style.display = isControl ? "" : "none";
+    syncSaveButton();
+  }
+
+  function currentFilterText(): string {
+    return (document.getElementById("bgd-bookmark-filter") as HTMLInputElement | null)?.value ?? "";
  }

  function renderBookmarkChecklist(filterText = ""): void {
@@ -203,26 +216,65 @@ const bgdWindow = window as unknown as BackgroundBridge;
      : all;

    if (filtered.length === 0) {
-      container.innerHTML = '<div class="bgd-checklist-empty">' +
-        (all.length === 0 ? "No supported bookmarks available." : "No bookmarks match filter.") +
-        '</div>';
+      container.innerHTML = '<div class="bgd-checklist-empty">' + escHtml(emptyListText(all.length)) + "</div>";
+      renderSelectionSummary();
      return;
    }

    filtered.forEach(function (bookmark) {
      const row = document.createElement("label");
      row.className = "bgd-checklist-row";
+      row.dataset.bmId = bookmark.id;
      const decoders = bookmarkDecoderKinds(bookmark);
-      const checked = selectedIds.has(bookmark.id) ? " checked" : "";
+      const selected = selectedIds.has(bookmark.id);
+      if (selected) row.classList.add("is-selected");
      row.innerHTML =
-        '<input type="checkbox"' + checked + ' data-bm-id="' + escHtml(bookmark.id) + '" />' +
+        '<input type="checkbox"' + (selected ? " checked" : "") + ' data-bm-id="' + escHtml(bookmark.id) + '" />' +
        '<span class="bgd-checklist-name">' + escHtml(bookmark.name) + '</span>' +
-        '<span class="bgd-checklist-meta">' + escHtml(formatFreq(bookmark.freq_hz) + " " + bookmark.mode + " · " + decoders.join("/").toUpperCase()) + '</span>';
+        '<span class="bgd-checklist-meta">'
+          + escHtml(formatFreq(bookmark.freq_hz)) + '<span class="bgd-checklist-mode">'
+          + escHtml(bookmark.mode + " · " + decoders.join("/").toUpperCase()) + '</span></span>'
+        + stateBadgeHtml(bookmark.id, selected);
      row.querySelector<HTMLInputElement>("input")?.addEventListener("change", function (e) {
        onChecklistToggle(bookmark.id, (e.currentTarget as HTMLInputElement).checked);
      });
      container.appendChild(row);
    });
+    renderSelectionSummary();
+  }
+
+  /** Why the list is empty, in the terms the operator can act on. */
+  function emptyListText(supportedCount: number): string {
+    if (supportedCount > 0) return "No bookmark matches that filter.";
+    if (bookmarkList.length > 0) {
+      return "None of your bookmarks name a decoder that can run in the background."
+        + " Give one a decoder on the Bookmarks tab to list it here.";
+    }
+    return "No bookmarks yet. Save one on the Bookmarks tab and it can be decoded here.";
+  }
+
+  /** The live state of a selected bookmark, as the row's own badge. */
+  function stateBadgeHtml(bookmarkId: string, selected: boolean): string {
+    if (!selected) return '<span class="bgd-state" data-state="unselected"></span>';
+    const entry = statusByBookmark.get(bookmarkId);
+    const state = entry?.state ?? (currentConfig?.enabled ? "pending" : "disabled");
+    return '<span class="bgd-state" data-state="' + escHtml(state) + '" title="' + escHtml(stateHelp(state)) + '">'
+      + '<span class="bgd-state-dot"></span>' + escHtml(prettyState(state)) + "</span>";
+  }
+
+  function renderSelectionSummary(): void {
+    const el = document.getElementById("bgd-selection-summary");
+    if (!el) return;
+    const selected = currentConfig?.bookmark_ids.length ?? 0;
+    if (selected === 0) {
+      el.textContent = "Nothing selected — background decoding is idle.";
+      return;
+    }
+    const active = [...statusByBookmark.values()].filter((entry) => entry.state === "active").length;
+    const noun = `${String(selected)} bookmark${selected === 1 ? "" : "s"} selected`;
+    el.textContent = currentConfig?.enabled
+      ? `${noun}, ${String(active)} decoding now.`
+      : `${noun}. Switch Enabled on to start decoding them.`;
  }

  function onChecklistToggle(bookmarkId: string, checked: boolean): void {
@@ -260,7 +312,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
        showToast(`Save failed: ${errorMessage(err)}`, true);
      })
      .finally(function () {
-        if (btn) btn.disabled = false;
+        syncSaveButton();
      });
  }

@@ -295,58 +347,77 @@ const bgdWindow = window as unknown as BackgroundBridge;
  }

  function renderStatus(status: BackgroundDecodeStatus): void {
-    const card = document.getElementById("background-decode-status-card");
-    if (!card) return;
-    const entries = status.entries ?? [];
-    if (!entries.length) {
-      card.textContent = "No background decode bookmarks configured.";
-      return;
-    }
-    const summary = [];
-    if (status.active_rig) {
-      if (typeof status.center_hz === "number" && Number.isFinite(status.center_hz)) summary.push("Center " + formatFreq(status.center_hz));
-      if (typeof status.sample_rate === "number" && Number.isFinite(status.sample_rate) && status.sample_rate > 0) summary.push("Span ±" + formatFreq(status.sample_rate / 2));
-    } else {
-      summary.push("This rig is not currently selected for audio.");
-    }
-    let html = summary.length ? '<div style="margin-bottom:0.8rem;color:var(--text-muted);">' + escHtml(summary.join(" · ")) + "</div>" : "";
-    html += '<div class="bgd-status-list">';
-    entries.forEach(function (entry) {
-      const name = entry.bookmark_name || entry.bookmark_id || "Unknown bookmark";
-      const parts = [];
-      if (typeof entry.freq_hz === "number" && Number.isFinite(entry.freq_hz)) parts.push(formatFreq(entry.freq_hz));
-      if (entry.mode) parts.push(entry.mode);
-      if (Array.isArray(entry.decoder_kinds) && entry.decoder_kinds.length) {
-        parts.push(entry.decoder_kinds.join("/").toUpperCase());
-      }
-      html +=
-        '<div class="bgd-status-row">' +
-          '<div>' +
-            '<div class="bgd-status-name">' + escHtml(name) + '</div>' +
-            '<div class="bgd-status-meta">' + escHtml(parts.join(" · ")) + '</div>' +
-          '</div>' +
-          '<div class="bgd-status-state" data-state="' + escHtml(entry.state || "inactive") + '">' +
-            '<svg class="bgd-state-dot" viewBox="0 0 8 8"><circle cx="4" cy="4" r="3.5"/></svg>' +
-            escHtml(prettyState(entry.state)) + '</div>' +
-        '</div>';
-    });
-    html += "</div>";
-    card.innerHTML = html;
+    lastStatus = status;
+    statusByBookmark = new Map(
+      (status.entries ?? [])
+        .filter((entry) => typeof entry.bookmark_id === "string" && entry.bookmark_id.length > 0)
+        .map((entry) => [entry.bookmark_id as string, entry]),
+    );
+    renderSpanSummary();
+    // Rows carry the state, so the list repaints — keeping the filter the
+    // operator typed and the selection they have not saved yet.
+    renderBookmarkChecklist(currentFilterText());
  }

+  /** What the rig is listening across, which is what decides whether a
+   *  selected bookmark can be decoded at all. */
+  function renderSpanSummary(): void {
+    const el = document.getElementById("bgd-span-summary");
+    if (!el) return;
+    const status = lastStatus;
+    if (!status) {
+      el.textContent = "";
+      return;
+    }
+    if (!status.active_rig) {
+      el.textContent = "This rig is not the one playing audio.";
+      el.dataset.tone = "warn";
+      return;
+    }
+    const centre = typeof status.center_hz === "number" && Number.isFinite(status.center_hz)
+      ? formatFreq(status.center_hz)
+      : null;
+    const half = typeof status.sample_rate === "number" && Number.isFinite(status.sample_rate) && status.sample_rate > 0
+      ? formatFreq(status.sample_rate / 2)
+      : null;
+    el.dataset.tone = "";
+    el.textContent = centre && half ? `Span ${centre} ±${half}` : centre ? `Centre ${centre}` : "";
+  }
+
+  /** The one-line reason behind a state, for the row's tooltip. */
+  function stateHelp(state: string | undefined): string {
+    switch (state) {
+      case "active": return "Decoding on a hidden channel.";
+      case "out_of_span": return "Outside the span the rig is tuned across, so it cannot be heard from here.";
+      case "waiting_for_spectrum": return "Waiting for the first spectrum frame from the rig.";
+      case "waiting_for_user": return "Nobody is listening to this rig, so no audio is being pulled.";
+      case "missing_bookmark": return "The bookmark this was selected from is gone.";
+      case "no_supported_decoders": return "No decoder that runs in the background can decode this bookmark.";
+      case "disabled": return "Background decoding is switched off.";
+      case "handled_by_scheduler":
+      case "scheduler_has_control": return "The scheduler is running this bookmark instead.";
+      case "handled_by_virtual_channel": return "A virtual channel is already on this frequency.";
+      case "pending": return "Selected, and not started yet — save to apply.";
+      default: return "Selected, but not decoding.";
+    }
+  }
+
+  // The dot beside the word already says whether this is running, so the
+  // words no longer carry a tick or a triangle of their own.
  function prettyState(state: string | undefined): string {
    switch (state) {
-      case "active": return "\u2713 Active";
-      case "out_of_span": return "\u25B3 Out of span";
-      case "waiting_for_spectrum": return "\u25B3 Waiting";
-      case "waiting_for_user": return "\u25B3 No user";
-      case "missing_bookmark": return "\u2717 Missing";
-      case "no_supported_decoders": return "\u2717 Unsupported";
-      case "disabled": return "\u25B3 Disabled";
-      case "handled_by_scheduler": return "\u25B3 Scheduler";
-      case "scheduler_has_control": return "\u25B3 Scheduler";
-      case "handled_by_virtual_channel": return "\u25B3 VChan";
-      default: return "\u25B3 Inactive";
+      case "active": return "Decoding";
+      case "out_of_span": return "Out of span";
+      case "waiting_for_spectrum": return "Waiting for spectrum";
+      case "waiting_for_user": return "Nobody listening";
+      case "missing_bookmark": return "Bookmark gone";
+      case "no_supported_decoders": return "No decoder";
+      case "disabled": return "Off";
+      case "handled_by_scheduler":
+      case "scheduler_has_control": return "Scheduler has it";
+      case "handled_by_virtual_channel": return "On a channel";
+      case "pending": return "Not saved";
+      default: return "Idle";
    }
  }

@@ -380,14 +451,25 @@ const bgdWindow = window as unknown as BackgroundBridge;
  function markBgdDirty() {
    if (bgdDirty) return;
    bgdDirty = true;
-    const btn = document.getElementById("background-decode-save-btn");
-    if (btn) btn.classList.add("sch-dirty");
+    syncSaveButton();
  }

  function clearBgdDirty() {
    bgdDirty = false;
-    const btn = document.getElementById("background-decode-save-btn");
-    if (btn) btn.classList.remove("sch-dirty");
+    syncSaveButton();
+  }
+
+  /** Save offers itself only when there is something to save. */
+  function syncSaveButton() {
+    const btn = document.getElementById("background-decode-save-btn") as HTMLButtonElement | null;
+    if (!btn) return;
+    btn.classList.toggle("sch-dirty", bgdDirty);
+    btn.disabled = !bgdDirty || !isControlRole();
+    btn.title = bgdDirty ? "Apply these bookmarks to the background decoder" : "No changes to save";
+  }
+
+  function isControlRole(): boolean {
+    return hasAuthRole(backgroundDecodeRoles, "control") || hostState.authEnabled === false;
  }

  function showToast(msg: string, isError: boolean): void {
@@ -407,7 +489,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
    }
    const ids = supportedBookmarks().map(function (bm) { return bm.id; });
    currentConfig.bookmark_ids = ids;
-    renderBookmarkChecklist((document.getElementById("bgd-bookmark-filter") as HTMLInputElement | null)?.value);
+    renderBookmarkChecklist(currentFilterText());
    markBgdDirty();
  }

@@ -416,7 +498,7 @@ const bgdWindow = window as unknown as BackgroundBridge;
      currentConfig = { remote: currentRigId, enabled: false, bookmark_ids: [] };
    }
    currentConfig.bookmark_ids = [];
-    renderBookmarkChecklist((document.getElementById("bgd-bookmark-filter") as HTMLInputElement | null)?.value);
+    renderBookmarkChecklist(currentFilterText());
    markBgdDirty();
  }

@@ -432,7 +514,11 @@ const bgdWindow = window as unknown as BackgroundBridge;
    const enabledCb = document.getElementById("background-decode-enabled") as (HTMLInputElement & WiredElement) | null;
    if (enabledCb && !enabledCb._wired) {
      enabledCb._wired = true;
-      enabledCb.addEventListener("change", function () { markBgdDirty(); });
+      enabledCb.addEventListener("change", function () {
+        if (currentConfig) currentConfig.enabled = enabledCb.checked;
+        markBgdDirty();
+        renderBookmarkChecklist(currentFilterText());
+      });
    }

    const selectAllBtn = document.getElementById("bgd-select-all-btn") as WiredElement | null;
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import { hostCore, hostState } from "./host.js";
+import { hasAuthRole } from "../api/auth.js";

 export {};

@@ -100,7 +101,8 @@ function bmEsc(str: unknown): string {
 }

 function bmCanControl() {
-  return !hostState.authEnabled || hostState.authRole === "control";
+  return !hostState.authEnabled
+    || hasAuthRole(hostState.authRoles, "write");
 }

 // Show/hide the Add Bookmark / Select All buttons based on the current auth role.
@@ -49,6 +49,8 @@ interface FtxBridge {
  updateFt8Bar?: () => void;
  registerFt8FamilyBarRenderer?: (decoder: FtxDecoderId, renderer: () => BarFrames) => void;
  takeSchedulerControlForDecoderDisable?: (button: HTMLElement) => Promise<void>;
+  /** Opens a log entry from a decode. Pre-fills it; never logs by itself. */
+  logContact?: (seed: { call?: string; gridsquare?: string | undefined; decoder?: string }) => void;
  trxUi: ConfirmApi;
  clearFt8Bar?: () => void;
  closeFt8Bar?: () => void;
@@ -224,6 +226,26 @@ export function initializeFtxDecoder(config: FtxConfig): void {
      hour: "2-digit", minute: "2-digit", second: "2-digit",
    });
    row.innerHTML = `<span class="ft8-time">${time}</span><span class="ft8-snr">${snr?.toFixed(1) ?? "--"}</span><span class="ft8-dt">${delta?.toFixed(2) ?? "--"}</span><span class="ft8-freq">${frequency?.toFixed(0) ?? "--"}</span><span class="ft8-msg">${renderMessage(raw)}</span>`;
+    // A decode is not a contact: this opens an entry with what was heard in it
+    // and leaves the logging to the operator.
+    const station = bridge.ft8ExtractLikelyCallsign?.(raw) ?? extractFtxCallsign(raw);
+    if (station) {
+      const log = document.createElement("button");
+      log.type = "button";
+      log.className = "ft8-log-btn";
+      log.textContent = "Log";
+      log.title = `Start a log entry for ${station}`;
+      log.addEventListener("click", (event) => {
+        event.stopPropagation();
+        const details = bridge.ft8ExtractLocatorDetails?.(raw) ?? extractFtxLocatorDetails(raw);
+        bridge.logContact?.({
+          call: station,
+          gridsquare: details.find((detail) => detail.station === station)?.grid,
+          decoder: id,
+        });
+      });
+      row.appendChild(log);
+    }
    return row;
  };
  const render = (): void => {
@@ -242,19 +264,28 @@ export function initializeFtxDecoder(config: FtxConfig): void {
    }
    messagesElement.replaceChildren(fragment);
  };
-  const normalize = (message: FtxMessage): FtxMessage => {
+  /** Hands a decode's grid squares to the map, if the map module is loaded yet.
+   *  Split out of normalize so a decode can be replayed onto a map that
+   *  arrived later: the module is lazy, and everything decoded before it
+   *  loaded had nowhere to go. */
+  const plotLocator = (message: FtxMessage): void => {
    const raw = message.message ?? "";
    const locatorDetails = bridge.ft8ExtractLocatorDetails?.(raw) ?? extractFtxLocatorDetails(raw);
    const grids = locatorDetails.length > 0
      ? locatorDetails.map(({ grid }) => grid)
      : bridge.ft8ExtractAllGrids?.(raw) ?? extractFtxGrids(raw);
+    if (grids.length === 0) return;
    const station = bridge.ft8ExtractLikelyCallsign?.(raw) ?? extractFtxCallsign(raw);
+    // Already an RF frequency on a replay, an audio offset on arrival; the
+    // conversion only fires below 100 kHz, so it is right either way.
    const frequency = displayFrequency(message.freq_hz);
-    if (grids.length > 0) {
-      bridge.mapAddLocator?.(raw, grids, id, station, {
-        ...message, freq_hz: frequency ?? message.freq_hz, locator_details: locatorDetails,
-      });
-    }
+    bridge.mapAddLocator?.(raw, grids, id, station, {
+      ...message, freq_hz: frequency ?? message.freq_hz, locator_details: locatorDetails,
+    });
+  };
+  const normalize = (message: FtxMessage): FtxMessage => {
+    const frequency = displayFrequency(message.freq_hz);
+    plotLocator(message);
    return {
      // The rig that heard it, kept so the mini view can tell a decode of the
      // rig on screen from one a background rig made on another band.
@@ -312,6 +343,8 @@ export function initializeFtxDecoder(config: FtxConfig): void {
    prune: () => { prune(); render(); },
    reset,
    rerender: () => { bridge.updateFt8Bar?.(); render(); },
+    // Oldest first, so the map builds the grids up in the order they were heard.
+    syncMap: () => { for (const message of [...history].reverse()) plotLocator(message); },
  });
  bridge.registerFt8FamilyBarRenderer?.(id, barFrames);

@@ -20,6 +20,12 @@ interface HfAprsBridge {
  getDecodeHistoryRetentionMs?: () => number;
  trxScheduleUiFrameJob?: (key: string, job: () => void) => void;
  navigateToAprsMap?: (lat: number, lon: number) => void;
+  aprsMapAddStation?: (
+    call: string, lat: number, lon: number, info: string,
+    symbolTable: string | null | undefined, symbolCode: string | null | undefined,
+    packet: AprsPacket, source: "aprs" | "hf_aprs",
+  ) => void;
+  clearMapMarkersByType?: (type: string) => void;
  getDecodeRigMeta?: () => unknown;
  takeSchedulerControlForDecoderDisable?: (button: HTMLElement) => Promise<unknown>;
  trxUi: { confirm(options: { title: string; message: string; confirmLabel: string }): Promise<boolean> };
@@ -177,6 +183,7 @@ function resetHfAprsHistoryView(): void {
  if (hfAprsPacketsEl) hfAprsPacketsEl.innerHTML = "";
  hfAprsPacketHistory = [];
  renderHfAprsHistory();
+  hfAprsWindow.clearMapMarkersByType?.("hf_aprs");
 }

 function pruneHfAprsHistoryView(): void {
@@ -184,6 +191,17 @@ function pruneHfAprsHistoryView(): void {
  renderHfAprsHistory();
 }

+/** Hands a positioned packet to the map, if the map module is loaded yet.
+ *  HF traffic goes on as its own source: it is a different band and a
+ *  different path, and the map filter offers it separately. */
+function plotHfAprsPacket(pkt: AprsPacket): void {
+  if (pkt.lat == null || pkt.lon == null || !hfAprsWindow.aprsMapAddStation) return;
+  hfAprsWindow.aprsMapAddStation(
+    pkt.srcCall ?? "", pkt.lat, pkt.lon, pkt.info ?? "",
+    pkt.symbolTable, pkt.symbolCode, pkt, "hf_aprs",
+  );
+}
+
 function addHfAprsPacket(pkt: AprsPacket): void {
  const tsMs = Number.isFinite(pkt.ts_ms) ? Number(pkt.ts_ms) : Date.now();
  pkt._tsMs = tsMs;
@@ -192,6 +210,8 @@ function addHfAprsPacket(pkt: AprsPacket): void {
  hfAprsPacketHistory.unshift(pkt);
  pruneHfAprsPacketHistory();

+  plotHfAprsPacket(pkt);
+
  scheduleHfAprsHistoryRender();
 }

@@ -209,6 +229,7 @@ function onServerHfAprsBatch(packets: AprsPacket[]): void {
    const tsMs = Number.isFinite(next.ts_ms) ? Number(next.ts_ms) : Date.now();
    next._tsMs = tsMs;
    next._ts = new Date(tsMs).toLocaleTimeString([], { hour: "2-digit", minute: "2-digit", second: "2-digit" });
+    plotHfAprsPacket(next);
    normalized.push(next);
  }
  normalized.reverse();
@@ -290,4 +311,6 @@ renderHfAprsHistory();
  reset: resetHfAprsHistoryView,
  prune: pruneHfAprsHistoryView,
  rerender: renderHfAprsHistory,
+  // Oldest first, so station tracks are rebuilt in the order they happened.
+  syncMap: () => { for (const entry of [...hfAprsPacketHistory].reverse()) plotHfAprsPacket(entry); },
 });
@@ -11,6 +11,8 @@
 // feature bundles from re-deriving it — and from drifting back to bare `window`
 // properties, which the module graph no longer publishes.

+import type { AuthRole } from "../api/auth.js";
+
 export interface HostDecoderDescriptor {
  id: string;
  label: string;
@@ -22,8 +24,10 @@ export interface HostDecoderDescriptor {
 export interface HostState {
  readonly serverLat: number | null;
  readonly serverLon: number | null;
+  /** The callsign this station is on the air with, from the client config. */
+  readonly ownerCallsign: string | null;
  readonly authEnabled: boolean;
-  readonly authRole: string | null;
+  readonly authRoles: readonly AuthRole[];
  readonly lastActiveRigId: string | null;
  readonly lastRigIds: string[];
  readonly lastRigDisplayNames: Record<string, string>;
@@ -43,6 +47,7 @@ export interface HostCore {
  armOptimisticFrequency(frequencyHz: number): void;
  escapeMapHtml(value: string): string;
  haversineKm(lat1: number, lon1: number, lat2: number, lon2: number): number;
+  latLonToMaidenhead(lat: number, lon: number): string;
  showHint(message: string, durationMs?: number): void;
  formatFreqForStep(frequencyHz: number, stepHz: number): string;
  refreshFreqDisplay(): void;
@@ -0,0 +1,577 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+// The station log: one panel that opens an entry, keeps the log, and takes
+// ADIF in and out.
+//
+// Times come from the server, never from here. The browser may be a phone in
+// another timezone with a clock nobody has checked, and a log is only worth
+// keeping if the times in it are the radio's.
+
+import { hostCore, hostState } from "./host.js";
+import { hasAuthRole } from "../api/auth.js";
+
+export {};
+
+interface Qso {
+  id: string;
+  started_at: string;
+  call: string;
+  freq_hz: number;
+  band?: string | null;
+  mode: string;
+  submode?: string | null;
+  rst_sent?: string | null;
+  rst_rcvd?: string | null;
+  gridsquare?: string | null;
+  name?: string | null;
+  qth?: string | null;
+  comment?: string | null;
+  station_callsign?: string | null;
+  operator?: string | null;
+  my_gridsquare?: string | null;
+  my_rig?: string | null;
+  rig_id?: string | null;
+  contest_id?: string | null;
+  stx?: number | null;
+  srx?: number | null;
+  srx_string?: string | null;
+  qsl_rcvd?: string | null;
+  lotw_qsl_rcvd?: string | null;
+  confirmed?: boolean;
+}
+
+interface BandStatistics {
+  band: string;
+  contacts: number;
+  stations: number;
+  confirmed: number;
+}
+
+interface Prefill {
+  started_at: string;
+  epoch_ms: number;
+  freq_hz: number;
+  band: string | null;
+  mode: string;
+  submode: string | null;
+  rig_id: string | null;
+  my_rig: string | null;
+  call: string | null;
+  gridsquare: string | null;
+}
+
+interface LogbookBridge {
+  trxUi: {
+    confirm(options: { title: string; message: string; confirmLabel: string }): Promise<boolean>;
+    notify?(message: string, options?: { kind?: string }): void;
+  };
+  navigateToTab?: (name: string) => void;
+  /** Opens the panel with an entry started from a decode. */
+  logContact?: (seed: { call?: string; gridsquare?: string | undefined; decoder?: string }) => void;
+}
+
+const bridge = window as unknown as LogbookBridge;
+
+const el = <T extends HTMLElement>(id: string): T | null => document.getElementById(id) as T | null;
+
+const form = el<HTMLFormElement>("log-entry-form");
+const callInput = el<HTMLInputElement>("log-call");
+const freqInput = el<HTMLInputElement>("log-freq");
+const modeInput = el<HTMLInputElement>("log-mode");
+const rstSentInput = el<HTMLInputElement>("log-rst-sent");
+const rstRcvdInput = el<HTMLInputElement>("log-rst-rcvd");
+const gridInput = el<HTMLInputElement>("log-grid");
+const nameInput = el<HTMLInputElement>("log-name");
+const commentInput = el<HTMLInputElement>("log-comment");
+const operatorInput = el<HTMLInputElement>("log-operator");
+const rowsBody = el<HTMLTableSectionElement>("log-rows");
+const summaryEl = el("log-summary");
+const workedEl = el("log-worked-before");
+const clockEl = el("log-clock");
+const stationCallEl = el("log-station-callsign");
+const stationRigEl = el("log-station-rig-name");
+const stationGridEl = el("log-station-grid");
+const filterCall = el<HTMLInputElement>("log-filter-call");
+const filterBand = el<HTMLSelectElement>("log-filter-band");
+const filterMode = el<HTMLSelectElement>("log-filter-mode");
+const importBtn = el<HTMLButtonElement>("log-import-btn");
+const importFile = el<HTMLInputElement>("log-import-file");
+const exportLink = el<HTMLAnchorElement>("log-export-btn");
+const clearBtn = el<HTMLButtonElement>("log-clear-btn");
+const saveBtn = el<HTMLButtonElement>("log-save-btn");
+const contestIdInput = el<HTMLInputElement>("log-contest-id");
+const stxInput = el<HTMLInputElement>("log-stx");
+const srxInput = el<HTMLInputElement>("log-srx");
+const statisticsRows = el<HTMLTableSectionElement>("log-statistics-rows");
+const cabrilloContest = el<HTMLInputElement>("log-cbr-contest");
+const cabrilloCallsign = el<HTMLInputElement>("log-cbr-callsign");
+const cabrilloOperator = el<HTMLSelectElement>("log-cbr-operator");
+const cabrilloPower = el<HTMLSelectElement>("log-cbr-power");
+const cabrilloScore = el<HTMLInputElement>("log-cbr-score");
+const cabrilloExport = el<HTMLAnchorElement>("log-cbr-export");
+
+/** The time the open entry was started, as the server gave it. */
+let entryStartedAt: string | null = null;
+/** The rig the open entry belongs to, likewise. */
+let entryRigId: string | null = null;
+let entryRigName: string | null = null;
+let entryGrid: string | null = null;
+let qsos: Qso[] = [];
+let workedRequest = 0;
+
+function canWriteLogbook(): boolean {
+  return !hostState.authEnabled
+    || hasAuthRole(hostState.authRoles, "write");
+}
+
+function notify(message: string, kind?: string): void {
+  if (bridge.trxUi.notify) bridge.trxUi.notify(message, kind ? { kind } : undefined);
+  else hostCore.showHint(message, 2000);
+}
+
+async function getJson<T>(path: string): Promise<T> {
+  const response = await fetch(path);
+  if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+  return await response.json() as T;
+}
+
+function formatFreq(hz: number): string {
+  if (!Number.isFinite(hz) || hz <= 0) return "";
+  // Through Number, not a trailing-zero trim: trimming "20.000000" as a string
+  // walks back through the point and leaves "2".
+  return String(Number((hz / 1e6).toFixed(6)));
+}
+
+/** What the operator typed, in Hz: MHz unless it is plainly already Hz. */
+function parseFreq(text: string): number | null {
+  const value = Number(text.trim().replace(/\s+/g, "").replace(",", "."));
+  if (!Number.isFinite(value) || value <= 0) return null;
+  return value < 100_000 ? Math.round(value * 1e6) : Math.round(value);
+}
+
+/** A serial, or null when the exchange is a word rather than a number. */
+function numberOrNull(text: string | undefined): number | null {
+  const trimmed = (text ?? "").trim();
+  if (!trimmed || !/^\d+$/.test(trimmed)) return null;
+  const value = Number(trimmed);
+  return Number.isSafeInteger(value) ? value : null;
+}
+
+function utcDate(iso: string): string {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(0, 10);
+}
+
+function utcTime(iso: string): string {
+  const date = new Date(iso);
+  return Number.isNaN(date.getTime()) ? "" : date.toISOString().slice(11, 19);
+}
+
+// ── The entry ───────────────────────────────────────────────────────────────
+
+/** Open an entry, pre-filled with the six fields the radio and clock answer. */
+async function openEntry(
+  seed: { call?: string; gridsquare?: string | undefined; decoder?: string } = {},
+): Promise<void> {
+  const params = new URLSearchParams();
+  if (hostState.lastActiveRigId) params.set("remote", hostState.lastActiveRigId);
+  if (seed.decoder) params.set("decoder", seed.decoder);
+  if (seed.call) params.set("call", seed.call);
+  if (seed.gridsquare) params.set("gridsquare", seed.gridsquare);
+  try {
+    const prefill = await getJson<Prefill>(`/api/logbook/prefill?${params.toString()}`);
+    applyPrefill(prefill);
+  } catch (error: unknown) {
+    console.error("logbook prefill failed", error);
+  }
+}
+
+function applyPrefill(prefill: Prefill): void {
+  entryStartedAt = prefill.started_at;
+  entryRigId = prefill.rig_id;
+  entryRigName = prefill.my_rig;
+  if (freqInput) freqInput.value = formatFreq(prefill.freq_hz);
+  if (modeInput) modeInput.value = prefill.submode ?? prefill.mode;
+  if (callInput && prefill.call) callInput.value = prefill.call;
+  if (gridInput && prefill.gridsquare) gridInput.value = prefill.gridsquare;
+  if (stationRigEl) stationRigEl.textContent = prefill.my_rig ?? "no rig";
+  showClock(prefill);
+  updateWorkedBefore();
+}
+
+/** The entry's time, and whether this browser agrees with it. */
+function showClock(prefill: Prefill): void {
+  if (!clockEl) return;
+  const time = utcTime(prefill.started_at);
+  const drift = Math.abs(Date.now() - prefill.epoch_ms);
+  clockEl.textContent = drift > 1000
+    ? `${time}Z · your clock is ${(drift / 1000).toFixed(0)}s out`
+    : `${time}Z`;
+  clockEl.classList.toggle("is-adrift", drift > 1000);
+}
+
+/** Clear the entry and open a fresh one. */
+function resetEntry(): void {
+  // The contest and the serial sent stay: they belong to the session, not to
+  // the contact just logged.
+  for (const input of [callInput, rstSentInput, rstRcvdInput, gridInput, nameInput, commentInput, srxInput]) {
+    if (input) input.value = "";
+  }
+  if (workedEl) workedEl.textContent = "";
+  void openEntry();
+}
+
+async function submitEntry(event: Event): Promise<void> {
+  event.preventDefault();
+  const call = callInput?.value.trim() ?? "";
+  if (!call) {
+    notify("A contact needs a callsign", "error");
+    callInput?.focus();
+    return;
+  }
+  const freqHz = parseFreq(freqInput?.value ?? "");
+  if (freqHz == null) {
+    notify("A contact needs a frequency", "error");
+    freqInput?.focus();
+    return;
+  }
+  const typedMode = (modeInput?.value ?? "").trim().toUpperCase();
+  // USB and LSB are how a rig says SSB; the log wants the mode with the
+  // sideband beside it, which is what other loggers read.
+  const isSideband = typedMode === "USB" || typedMode === "LSB";
+  const body = {
+    // The server stamps the time; this is the one it gave when the entry
+    // opened, so a contact logged five minutes later keeps the time it started.
+    started_at: entryStartedAt,
+    call,
+    freq_hz: freqHz,
+    mode: isSideband ? "SSB" : typedMode,
+    submode: isSideband ? typedMode : null,
+    rst_sent: rstSentInput?.value ?? null,
+    rst_rcvd: rstRcvdInput?.value ?? null,
+    gridsquare: gridInput?.value ?? null,
+    name: nameInput?.value ?? null,
+    comment: commentInput?.value ?? null,
+    contest_id: contestIdInput?.value ?? null,
+    // The exchange is a number when it is a serial and a word when it is a
+    // zone or a section; both are kept, and the log writes whichever it has.
+    stx: numberOrNull(stxInput?.value),
+    stx_string: numberOrNull(stxInput?.value) == null ? stxInput?.value ?? null : null,
+    srx: numberOrNull(srxInput?.value),
+    srx_string: numberOrNull(srxInput?.value) == null ? srxInput?.value ?? null : null,
+    station_callsign: stationCallEl?.textContent?.trim() ?? null,
+    operator: operatorInput?.value ?? null,
+    my_gridsquare: entryGrid,
+    my_rig: entryRigName,
+    rig_id: entryRigId,
+  };
+  if (saveBtn) saveBtn.disabled = true;
+  try {
+    const response = await fetch("/api/logbook", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(body),
+    });
+    if (!response.ok) {
+      const detail = await response.json().catch(() => ({})) as { error?: string };
+      throw new Error(detail.error ?? `HTTP ${String(response.status)}`);
+    }
+    notify(`${call} logged`);
+    // A contest runs on serials: the next one is this one plus one, so it is
+    // not retyped forty times an hour.
+    const sent = numberOrNull(stxInput?.value);
+    resetEntry();
+    if (stxInput && sent != null) stxInput.value = String(sent + 1);
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Could not log: ${error instanceof Error ? error.message : String(error)}`, "error");
+  } finally {
+    if (saveBtn) saveBtn.disabled = false;
+  }
+}
+
+/** Whether this station has been worked, and on what. */
+function updateWorkedBefore(): void {
+  if (!workedEl) return;
+  const call = callInput?.value.trim() ?? "";
+  if (call.length < 3) {
+    workedEl.textContent = "";
+    return;
+  }
+  const request = ++workedRequest;
+  void getJson<{ worked: { band: string; mode: string }[] }>(
+    `/api/logbook/worked/${encodeURIComponent(call)}`,
+  ).then((answer) => {
+    // A slower answer to an earlier callsign must not overwrite a later one.
+    if (request !== workedRequest || !workedEl) return;
+    if (answer.worked.length === 0) {
+      workedEl.textContent = "Not worked before";
+      workedEl.classList.remove("is-worked");
+      return;
+    }
+    const where = answer.worked.map((entry) => `${entry.band} ${entry.mode}`).join(", ");
+    workedEl.textContent = `Worked before: ${where}`;
+    workedEl.classList.add("is-worked");
+  }).catch(() => { /* the log will still take the contact */ });
+}
+
+// ── The log ─────────────────────────────────────────────────────────────────
+
+function currentQuery(): string {
+  const params = new URLSearchParams();
+  const call = filterCall?.value.trim();
+  if (call) params.set("call", call);
+  if (filterBand?.value) params.set("band", filterBand.value);
+  if (filterMode?.value) params.set("mode", filterMode.value);
+  return params.toString();
+}
+
+async function refreshLog(): Promise<void> {
+  try {
+    const query = currentQuery();
+    const answer = await getJson<{ total: number; qsos: Qso[] }>(
+      `/api/logbook${query ? `?${query}` : ""}`,
+    );
+    qsos = answer.qsos;
+    renderRows();
+    renderFilterOptions();
+    if (summaryEl) {
+      summaryEl.textContent = query
+        ? `${String(qsos.length)} of ${String(answer.total)} contacts`
+        : `${String(answer.total)} contact${answer.total === 1 ? "" : "s"}`;
+    }
+    if (exportLink) exportLink.href = `/api/logbook/export.adi${query ? `?${query}` : ""}`;
+    await refreshStatistics();
+  } catch (error: unknown) {
+    console.error("logbook read failed", error);
+  }
+}
+
+/** What has been worked and confirmed, band by band. */
+async function refreshStatistics(): Promise<void> {
+  if (!statisticsRows) return;
+  try {
+    const answer = await getJson<{ bands: BandStatistics[] }>("/api/logbook/statistics");
+    if (answer.bands.length === 0) {
+      statisticsRows.innerHTML = '<tr><td colspan="4" class="log-empty">Nothing worked yet.</td></tr>';
+      return;
+    }
+    const fragment = document.createDocumentFragment();
+    for (const band of answer.bands) {
+      const row = document.createElement("tr");
+      for (const value of [band.band, band.contacts, band.stations, band.confirmed]) {
+        const cell = document.createElement("td");
+        cell.textContent = String(value);
+        row.appendChild(cell);
+      }
+      fragment.appendChild(row);
+    }
+    statisticsRows.replaceChildren(fragment);
+  } catch (error: unknown) {
+    console.error("logbook statistics failed", error);
+  }
+}
+
+/** The Cabrillo link, carrying the header the operator filled in. */
+function syncCabrilloLink(): void {
+  if (!cabrilloExport) return;
+  const params = new URLSearchParams();
+  const contest = cabrilloContest?.value.trim();
+  if (contest) {
+    // Only that contest's contacts belong in the entry.
+    params.set("contest", contest);
+  }
+  const callsign = cabrilloCallsign?.value.trim() || (stationCallEl?.textContent?.trim() ?? "");
+  if (callsign) params.set("callsign", callsign);
+  if (cabrilloOperator?.value) params.set("category_operator", cabrilloOperator.value);
+  if (cabrilloPower?.value) params.set("category_power", cabrilloPower.value);
+  const score = numberOrNull(cabrilloScore?.value);
+  if (score != null) params.set("claimed_score", String(score));
+  const operator = operatorInput?.value.trim();
+  if (operator) params.set("operators", operator);
+  cabrilloExport.href = `/api/logbook/export.cbr?${params.toString()}`;
+}
+
+function renderRows(): void {
+  if (!rowsBody) return;
+  if (qsos.length === 0) {
+    rowsBody.innerHTML =
+      '<tr><td colspan="10" class="log-empty">No contacts yet. Work someone and log them here,'
+      + " or bring a log in with Import ADIF.</td></tr>";
+    return;
+  }
+  const fragment = document.createDocumentFragment();
+  for (const qso of qsos) {
+    const row = document.createElement("tr");
+    row.dataset.qsoId = qso.id;
+    const cells: (string | null | undefined)[] = [
+      utcDate(qso.started_at),
+      utcTime(qso.started_at),
+      qso.call,
+      qso.band ?? "",
+      qso.submode ?? qso.mode,
+      qso.rst_sent ?? "",
+      qso.rst_rcvd ?? "",
+      qso.gridsquare ?? "",
+      qso.my_rig ?? "",
+      qso.confirmed ? "✓" : "",
+    ];
+    for (const [index, value] of cells.entries()) {
+      const cell = document.createElement("td");
+      cell.textContent = value ?? "";
+      if (index === 2) cell.className = "log-cell-call";
+      row.appendChild(cell);
+    }
+    const actions = document.createElement("td");
+    if (!canWriteLogbook()) {
+      row.appendChild(actions);
+      fragment.appendChild(row);
+      continue;
+    }
+    // Confirming is the commonest edit a log gets, so it is a button rather
+    // than a form: a card arrives, and the contact counts towards an award.
+    const confirm = document.createElement("button");
+    confirm.type = "button";
+    confirm.className = "log-row-btn";
+    confirm.textContent = qso.confirmed ? "Unconfirm" : "Confirm";
+    confirm.title = qso.confirmed
+      ? "Mark this contact as not confirmed"
+      : "Mark this contact confirmed by QSL";
+    confirm.addEventListener("click", () => { void setConfirmed(qso, !qso.confirmed); });
+    actions.appendChild(confirm);
+    const remove = document.createElement("button");
+    remove.type = "button";
+    remove.className = "log-row-btn";
+    remove.textContent = "Delete";
+    remove.setAttribute("aria-label", `Delete the contact with ${qso.call}`);
+    remove.addEventListener("click", () => { void deleteQso(qso); });
+    actions.appendChild(remove);
+    row.appendChild(actions);
+    fragment.appendChild(row);
+  }
+  rowsBody.replaceChildren(fragment);
+}
+
+/** Bands and modes the log actually holds, so the filters offer only those. */
+function renderFilterOptions(): void {
+  for (const [select, values] of [
+    [filterBand, [...new Set(qsos.map((q) => q.band).filter((b): b is string => !!b))]],
+    [filterMode, [...new Set(qsos.map((q) => q.submode ?? q.mode).filter(Boolean))]],
+  ] as const) {
+    if (!select) continue;
+    const chosen = select.value;
+    const known = new Set([...select.options].map((option) => option.value));
+    for (const value of [...values].sort()) {
+      if (known.has(value)) continue;
+      select.add(new Option(value, value));
+    }
+    select.value = chosen;
+  }
+}
+
+/** Record, or withdraw, the other station's confirmation. */
+async function setConfirmed(qso: Qso, confirmed: boolean): Promise<void> {
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        ...qso,
+        // A card is a card: this is the paper one, and an electronic
+        // confirmation the log already holds is left where it is.
+        qsl_rcvd: confirmed ? "Y" : "N",
+      }),
+    });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Could not update: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+
+async function deleteQso(qso: Qso): Promise<void> {
+  const confirmed = await bridge.trxUi.confirm({
+    title: "Delete this contact?",
+    message: `${qso.call} on ${qso.band ?? formatFreq(qso.freq_hz)} will be removed from the log.`,
+    confirmLabel: "Delete",
+  });
+  if (!confirmed) return;
+  try {
+    const response = await fetch(`/api/logbook/${encodeURIComponent(qso.id)}`, { method: "DELETE" });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Could not delete: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+
+async function importAdif(file: File): Promise<void> {
+  try {
+    const response = await fetch("/api/logbook/import", { method: "POST", body: await file.arrayBuffer() });
+    if (!response.ok) throw new Error(`HTTP ${String(response.status)}`);
+    const outcome = await response.json() as { added: number; duplicate: number; rejected: string[] };
+    const parts = [`${String(outcome.added)} added`];
+    if (outcome.duplicate > 0) parts.push(`${String(outcome.duplicate)} already held`);
+    if (outcome.rejected.length > 0) parts.push(`${String(outcome.rejected.length)} not readable`);
+    notify(parts.join(", "));
+    await refreshLog();
+  } catch (error: unknown) {
+    notify(`Import failed: ${error instanceof Error ? error.message : String(error)}`, "error");
+  }
+}
+
+// ── Station line ────────────────────────────────────────────────────────────
+
+function renderStation(): void {
+  const callsign = hostState.ownerCallsign ?? "";
+  if (stationCallEl) stationCallEl.textContent = callsign || "no callsign set";
+  if (operatorInput && !operatorInput.value) operatorInput.value = callsign;
+  if (stationGridEl) {
+    const grid = hostState.serverLat != null && hostState.serverLon != null
+      ? hostCore.latLonToMaidenhead(hostState.serverLat, hostState.serverLon)
+      : "";
+    entryGrid = grid || null;
+    stationGridEl.textContent = grid;
+  }
+}
+
+// ── Wiring ──────────────────────────────────────────────────────────────────
+
+form?.addEventListener("submit", (event) => { void submitEntry(event); });
+clearBtn?.addEventListener("click", resetEntry);
+callInput?.addEventListener("input", updateWorkedBefore);
+for (const control of [filterCall, filterBand, filterMode]) {
+  control?.addEventListener("input", () => { void refreshLog(); });
+  control?.addEventListener("change", () => { void refreshLog(); });
+}
+for (const control of [cabrilloContest, cabrilloCallsign, cabrilloOperator, cabrilloPower, cabrilloScore]) {
+  control?.addEventListener("input", syncCabrilloLink);
+  control?.addEventListener("change", syncCabrilloLink);
+}
+importBtn?.addEventListener("click", () => { importFile?.click(); });
+importFile?.addEventListener("change", () => {
+  const file = importFile.files?.[0];
+  if (file) void importAdif(file);
+  importFile.value = "";
+});
+
+/** Start an entry from a decode, and show the operator where it went. */
+if (canWriteLogbook()) {
+  bridge.logContact = (seed) => {
+    bridge.navigateToTab?.("logbook");
+    void openEntry(seed).then(() => callInput?.focus());
+  };
+} else {
+  if (form) form.style.display = "none";
+  if (importBtn) importBtn.style.display = "none";
+}
+
+renderStation();
+if (cabrilloCallsign && !cabrilloCallsign.value) {
+  cabrilloCallsign.value = stationCallEl?.textContent?.trim() ?? "";
+}
+syncCabrilloLink();
+if (canWriteLogbook()) void openEntry();
+void refreshLog();
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import type { SatelliteScheduleConfig, SatelliteSchedulerApi } from "./satellite-types.js";
+import type { AuthRole } from "../api/auth.js";

 export type SchedulerMode = "disabled" | "grayline" | "time_span";

@@ -60,7 +61,7 @@ export interface SchedulerStatus {
 }

 export interface SchedulerService {
-  initialize(rigId: string | null, role: string | null): void;
+  initialize(rigId: string | null, roles: readonly AuthRole[]): void;
  destroy(): void;
  setRig(rigId: string | null): void;
  wireEvents(): void;
@@ -3,6 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later

 import { hostState } from "./host.js";
+import { hasAuthRole, type AuthRole } from "../api/auth.js";

 import type {
  ScheduleEntry,
@@ -43,7 +44,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
  // -------------------------------------------------------------------------
  // State
  // -------------------------------------------------------------------------
-  let schedulerRole: string | null = null;
+  let schedulerRoles: readonly AuthRole[] = [];
  let currentRigId: string | null = null;
  let currentConfig: SchedulerConfig | null = null;
  let currentSchedulerStatus: SchedulerStatus | null = null;
@@ -58,8 +59,8 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
  // -------------------------------------------------------------------------
  // Init
  // -------------------------------------------------------------------------
-  function initScheduler(rigId: string | null, role: string | null): void {
-    schedulerRole = role;
+  function initScheduler(rigId: string | null, roles: readonly AuthRole[]): void {
+    schedulerRoles = roles;
    currentRigId = rigId || null;
    if (currentRigId) loadScheduler();
    startStatusPolling();
@@ -356,7 +357,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
    if (!prevBtn || !nextBtn) return;
    const state = schedulerInterleaveState(currentConfig);
    const enabled =
-      schedulerRole === "control" &&
+      hasAuthRole(schedulerRoles, "control") &&
      !!currentRigId &&
      !schedulerStepPending &&
      state.activeEntries.length > 1;
@@ -466,7 +467,7 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
    if (!panel) return;

    const mode = (currentConfig && currentConfig.mode) || "disabled";
-    const isControl = schedulerRole === "control";
+    const isControl = hasAuthRole(schedulerRoles, "control");

    // Mode selector
    setSelected("scheduler-mode-select", mode);
@@ -1574,8 +1575,8 @@ function schedulerOptionalEl(id: string): SchedulerElement | null {
  // When loaded eagerly, initSettingsUI() in app.js calls initScheduler();
  // when loaded lazily (e.g. settings tab click after boot), the app has
  // already passed that point, so we must self-initialize here.
-  if (hostState.authRole != null) {
-    initScheduler(hostState.lastActiveRigId, hostState.authRole);
+  if (!hostState.authEnabled || hostState.authRoles.length > 0) {
+    initScheduler(hostState.lastActiveRigId, hostState.authRoles);
    wireSchedulerEvents();
  }
 })();
@@ -17,6 +17,9 @@ interface WsprMessage {
  dt_s?: number | undefined;
  freq_hz?: number | undefined;
  rig_id?: string | null | undefined;
+  /** RF frequency the spot was heard on, kept so a map replay does not
+   *  recompute it against wherever the dial has moved to since. */
+  _rfHz?: number | null | undefined;
  receiver?: unknown;
  [key: string]: unknown;
 }
@@ -135,6 +138,7 @@ function normalizeServerWsprMessage(msg: WsprMessage): { raw: string; grids: str
    rfHz,
    history: {
      rig_id: msg.rig_id ?? null,
+      _rfHz: rfHz,
      receiver: wsprWindow.getDecodeRigMeta ? wsprWindow.getDecodeRigMeta() : null,
      ts_ms: msg.ts_ms,
      snr_db: msg.snr_db,
@@ -152,12 +156,7 @@ function onServerWsprBatch(messages: WsprMessage[]): void {
    const next = normalizeServerWsprMessage(msg);
    // "Receiving" is the panel's own status, and the panel is the rig's.
    if (wsprStatus && isActiveRigDecode(msg.rig_id)) wsprStatus.textContent = "Receiving";
-    if (next.grids.length > 0 && wsprWindow.mapAddLocator) {
-      wsprWindow.mapAddLocator(next.raw, next.grids, "wspr", next.station, {
-        ...msg,
-        ...(next.rfHz === null ? {} : { freq_hz: next.rfHz }),
-      });
-    }
+    plotWsprLocator(msg);
    next.history._tsMs = Number.isFinite(next.history.ts_ms) ? Number(next.history.ts_ms) : Date.now();
    normalized.push(next.history);
  }
@@ -317,15 +316,24 @@ document.getElementById("settings-clear-wspr-history")?.addEventListener("click"
  })();
 });

+/** Hands a spot's grid squares to the map, if the map module is loaded yet.
+ *  The module is lazy, so a spot heard before it arrived has to be replayable. */
+function plotWsprLocator(msg: WsprMessage): void {
+  const next = normalizeServerWsprMessage(msg);
+  if (next.grids.length === 0 || !wsprWindow.mapAddLocator) return;
+  // A replayed spot carries the frequency it was heard on; a fresh one has it
+  // worked out from the dial it just arrived against.
+  const rfHz = finiteNumber(msg._rfHz) ?? next.rfHz;
+  wsprWindow.mapAddLocator(next.raw, next.grids, "wspr", next.station, {
+    ...msg,
+    ...(rfHz === null ? {} : { freq_hz: rfHz }),
+  });
+}
+
 function onServerWspr(msg: WsprMessage): void {
  if (wsprStatus && isActiveRigDecode(msg.rig_id)) wsprStatus.textContent = "Receiving";
  const next = normalizeServerWsprMessage(msg);
-  if (next.grids.length > 0 && wsprWindow.mapAddLocator) {
-    wsprWindow.mapAddLocator(next.raw, next.grids, "wspr", next.station, {
-      ...msg,
-      ...(next.rfHz === null ? {} : { freq_hz: next.rfHz }),
-    });
-  }
+  plotWsprLocator(msg);
  addWsprMessage(next.history);
 }

@@ -337,4 +345,6 @@ wsprWindow.trxPluginRuntime.registerDecoder({
  prune: pruneWsprHistoryView,
  reset: resetWsprHistoryView,
  rerender: renderWsprHistory,
+  // Oldest first, so the map builds the grids up in the order they were heard.
+  syncMap: () => { for (const message of [...wsprMessageHistory].reverse()) plotWsprLocator(message); },
 });
@@ -24,8 +24,8 @@ interface ButtonStateOptions {
  disabled?: boolean;
 }
 type TabKind = "primary" | "secondary";
-type LayoutCapability = "broadcast" | "digital";
-type LayoutName = "compact" | "broadcast" | "digital" | "full";
+type LayoutCapability = "broadcast" | "digital" | "ham";
+type LayoutName = "compact" | "broadcast" | "digital" | "full" | "ham";
 interface OperatorLayout {
  label: string;
  unavailable?: string;
@@ -191,8 +191,11 @@ function elementById<T extends HTMLElement>(id: string): T {
    broadcast: { label: "Broadcast", unavailable: "Broadcast requires an enumerated WFM-capable receiver", advanced: false, audio: true, scheduler: false, preferredTab: "main", capability: "broadcast" },
    digital: { label: "Digital", unavailable: "Digital requires a compatible rig mode and an available decoder", advanced: false, audio: false, scheduler: false, preferredTab: "digital-modes", capability: "digital" },
    full: { label: "Full controls", advanced: true, audio: true, scheduler: true, preferredTab: "main" },
+    // Working the bands: the log is the task and the radio is the instrument,
+    // so this one opens on the logbook with the controls a keystroke away.
+    ham: { label: "Ham radio", unavailable: "Ham radio needs a rig that can transmit", advanced: true, audio: true, scheduler: false, preferredTab: "logbook", capability: "ham" },
  };
-  const layoutCapabilities: Record<LayoutCapability, boolean> = { broadcast: false, digital: false };
+  const layoutCapabilities: Record<LayoutCapability, boolean> = { broadcast: false, digital: false, ham: false };
  let activeRigId: string | null = null;

  // A layout seeds the collapsible sections; it does not hold them there.
@@ -0,0 +1,87 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+/* global document */
+
+const ALL_ROLES = ["read", "control", "write", "administrator"];
+const fixture = await startWebFixture({
+  authSession: {
+    authenticated: true,
+    username: "admin",
+    roles: ALL_ROLES,
+    auth_disabled: false,
+  },
+  users: [
+    { username: "admin", roles: ALL_ROLES, enabled: true },
+    { username: "listener", roles: ["read"], enabled: false },
+  ],
+});
+const { browser, page, runtimeErrors } = await startBrowser(chromium);
+
+try {
+  await page.goto(`${fixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await page.locator("#tab-settings").waitFor({ state: "visible" });
+  await page.locator("#settings-account-tab").waitFor({ state: "visible" });
+  await page.locator("#settings-users-tab").waitFor({ state: "visible" });
+
+  await page.locator("#settings-account-tab").click();
+  assert.equal(await page.locator("#account-password-form").isVisible(), true);
+  assert.equal(await page.locator("#subtab-settings-users").isVisible(), false);
+
+  await page.locator("#settings-users-tab").click();
+  await page.locator("#user-list").getByText("listener (disabled)").waitFor();
+  assert.equal(await page.locator("#user-create-form").isVisible(), true);
+
+  const state = await page.evaluate(() => {
+    const rows = [...document.querySelectorAll("#user-list > .sch-row")];
+    const rowFor = (username) => rows.find((row) => row.querySelector("strong")?.textContent.startsWith(username));
+    const admin = rowFor("admin");
+    const listener = rowFor("listener");
+    const role = (row, value) => row?.querySelector(`input[value="${value}"]`);
+    return {
+      createRoles: [...document.querySelectorAll("#user-create-roles input")].map((input) => input.value),
+      adminEnabledLocked: admin?.querySelector('input[type="checkbox"]')?.disabled,
+      adminRoleLocked: role(admin, "administrator")?.disabled,
+      adminGuestLocked: role(admin, "guest")?.disabled,
+      adminRemoveLocked: admin?.querySelector("button.danger")?.disabled,
+      listenerEnabled: listener?.querySelector('input[type="checkbox"]')?.checked,
+      listenerRead: role(listener, "read")?.checked,
+    };
+  });
+  assert.deepEqual(state.createRoles, ["guest", ...ALL_ROLES]);
+  assert.equal(state.adminEnabledLocked, true);
+  assert.equal(state.adminRoleLocked, true);
+  assert.equal(state.adminGuestLocked, true);
+  assert.equal(state.adminRemoveLocked, true);
+  assert.equal(state.listenerEnabled, false);
+  assert.equal(state.listenerRead, true);
+  assert.deepEqual(runtimeErrors, []);
+} finally {
+  await browser.close();
+  await fixture.close();
+}
+
+const guestFixture = await startWebFixture({
+  authSession: {
+    authenticated: true,
+    username: "guest",
+    roles: ["guest"],
+    auth_disabled: false,
+  },
+});
+const guestBrowser = await startBrowser(chromium);
+try {
+  await guestBrowser.page.goto(`${guestFixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await guestBrowser.page.locator("#tab-settings").waitFor({ state: "visible" });
+  assert.equal(await guestBrowser.page.locator("#settings-account-tab").isVisible(), false);
+  assert.equal(await guestBrowser.page.locator("#settings-users-tab").isVisible(), false);
+  assert.deepEqual(guestBrowser.runtimeErrors, []);
+} finally {
+  await guestBrowser.browser.close();
+  await guestFixture.close();
+}
@@ -0,0 +1,59 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+import assert from "node:assert/strict";
+import test from "node:test";
+import vm from "node:vm";
+import { bundleEntry } from "./bundle-entry.mjs";
+
+const source = await bundleEntry(new URL("../src/api/auth.ts", import.meta.url), "AuthApi");
+
+function loadAuth(fetch) {
+  const context = vm.createContext({ fetch, console });
+  new vm.Script(source).runInContext(context);
+  return context.AuthApi;
+}
+
+test("role policy centralizes Guest and implied read access", () => {
+  const auth = loadAuth(async () => { throw new Error("unused"); });
+  assert.deepEqual(Array.from(auth.AUTH_ROLES), ["guest", "read", "control", "write", "administrator"]);
+  assert.equal(auth.hasAuthRole(["guest"], "read"), true);
+  assert.equal(auth.hasAccountControls(["guest"]), false);
+  assert.equal(auth.hasAccountControls(["read"]), true);
+  assert.equal(auth.hasAuthRole(["control"], "read"), true);
+  assert.equal(auth.hasAuthRole(["control"], "write"), false);
+  assert.equal(auth.hasAuthRole(["administrator"], "write"), true);
+});
+
+test("auth responses normalize roles and require the managed-account lifecycle state", async () => {
+  const replies = new Map([
+    ["/auth/session", { authenticated: true, roles: ["write", "read", "write"], username: "alice" }],
+    ["/auth/users", [{ username: "alice", roles: ["write", "read"], enabled: false }]],
+  ]);
+  const auth = loadAuth(async (url) => ({
+    ok: true,
+    status: 200,
+    json: async () => replies.get(String(url)),
+  }));
+
+  assert.deepEqual(Array.from((await auth.fetchAuthSession()).roles), ["read", "write"]);
+  assert.deepEqual(Array.from((await auth.listUsers())[0].roles), ["read", "write"]);
+  assert.equal((await auth.listUsers())[0].enabled, false);
+});
+
+test("changing a password sends current and replacement credentials", async () => {
+  let request;
+  const auth = loadAuth(async (url, init) => {
+    request = { url, init };
+    return { ok: true, status: 200, json: async () => ({}) };
+  });
+
+  await auth.changeOwnPassword("old-password", "new-password");
+  assert.equal(request.url, "/auth/account/password");
+  assert.equal(request.init.method, "PATCH");
+  assert.deepEqual(JSON.parse(request.init.body), {
+    current_password: "old-password",
+    new_password: "new-password",
+  });
+});
@@ -0,0 +1,138 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+// The background decode panel: one list that both picks the bookmarks and says
+// what each one is doing. It used to be two lists of the same bookmarks — one
+// to choose from, one to read state off — and it filled neither until the
+// operator switched rigs, because it took whatever rig it was handed at load
+// and that was nothing yet.
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+/* global document */
+
+const BOOKMARKS = [
+  { id: "bm-ft8-20", name: "FT8 20 m", freq_hz: 14_074_000, mode: "USB", decoders: ["ft8"] },
+  { id: "bm-ft8-40", name: "FT8 40 m", freq_hz: 7_074_000, mode: "USB", decoders: ["ft8"] },
+  { id: "bm-ft4-20", name: "FT4 20 m", freq_hz: 14_080_000, mode: "USB", decoders: ["ft4"] },
+  { id: "bm-aprs", name: "APRS 2 m", freq_hz: 144_800_000, mode: "PKT", decoders: ["aprs"] },
+  // Nothing that runs in the background can decode CW, so it must not be offered.
+  { id: "bm-cw", name: "CW practice", freq_hz: 7_030_000, mode: "CW", decoders: ["cw"] },
+];
+
+const backgroundDecode = {
+  config: { remote: "rig-a", enabled: true, bookmark_ids: ["bm-ft8-20", "bm-ft8-40", "bm-aprs"] },
+  status: {
+    active_rig: true,
+    center_hz: 14_100_000,
+    sample_rate: 2_400_000,
+    entries: [
+      { bookmark_id: "bm-ft8-20", bookmark_name: "FT8 20 m", freq_hz: 14_074_000, mode: "USB", decoder_kinds: ["ft8"], state: "active" },
+      { bookmark_id: "bm-ft8-40", bookmark_name: "FT8 40 m", freq_hz: 7_074_000, mode: "USB", decoder_kinds: ["ft8"], state: "out_of_span" },
+      { bookmark_id: "bm-aprs", bookmark_name: "APRS 2 m", freq_hz: 144_800_000, mode: "PKT", decoder_kinds: ["aprs"], state: "handled_by_scheduler" },
+    ],
+  },
+};
+
+const readRows = () => page.evaluate(() => {
+  const rows = [...document.querySelectorAll("#bgd-bookmark-checklist .bgd-checklist-row")];
+  return rows.map((row) => ({
+    name: row.querySelector(".bgd-checklist-name")?.textContent ?? "",
+    checked: row.querySelector("input[type=checkbox]")?.checked ?? false,
+    state: row.querySelector(".bgd-state")?.dataset.state ?? null,
+    stateText: row.querySelector(".bgd-state")?.textContent?.trim() ?? "",
+  }));
+});
+
+const openPanel = async () => {
+  await page.goto(`${fixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await page.locator("#tab-settings").waitFor({ state: "visible" });
+  await page.waitForTimeout(2000);
+  await page.locator('.sub-tab[data-subtab="settings-background-decode"]').click();
+  await page.waitForTimeout(1200);
+};
+
+const fixture = await startWebFixture({ spectrum: true, bookmarks: BOOKMARKS, backgroundDecode });
+const { browser, page, runtimeErrors } = await startBrowser(chromium);
+
+try {
+  await page.setViewportSize({ width: 1400, height: 950 });
+  await openPanel();
+
+  // Nothing was switched, clicked or reloaded: the panel asked the host which
+  // rig it is on and filled itself.
+  const rows = await readRows();
+  assert.deepEqual(rows.map((row) => row.name), ["FT8 20 m", "FT8 40 m", "FT4 20 m", "APRS 2 m"],
+    "the list does not hold the bookmarks a background channel can decode");
+  assert.deepEqual(rows.map((row) => row.checked), [true, true, false, true],
+    "the saved selection is not reflected in the list");
+
+  // Each row carries its own state, so there is no second list to consult.
+  assert.deepEqual(rows.map((row) => row.state),
+    ["active", "out_of_span", "unselected", "handled_by_scheduler"],
+    "the rows do not carry the state of the bookmark they name");
+  assert.match(rows[0].stateText, /Decoding/);
+  assert.match(rows[1].stateText, /Out of span/);
+
+  // What the rig can hear, and what the selection adds up to.
+  const context = await page.evaluate(() => ({
+    span: document.getElementById("bgd-span-summary")?.textContent?.trim(),
+    summary: document.getElementById("bgd-selection-summary")?.textContent?.trim(),
+  }));
+  assert.match(context.span, /14\.1 MHz/, `the span reads "${context.span}"`);
+  assert.match(context.summary, /3 bookmarks selected, 1 decoding now\./, `the summary reads "${context.summary}"`);
+
+  // Save has nothing to do until something changes, and says so again once it
+  // has been done.
+  const saveState = () => page.evaluate(() => {
+    const btn = document.getElementById("background-decode-save-btn");
+    return { disabled: btn.disabled, dirty: btn.classList.contains("sch-dirty") };
+  });
+  assert.deepEqual(await saveState(), { disabled: true, dirty: false }, "Save offers itself with nothing to save");
+
+  await page.locator('#bgd-bookmark-checklist .bgd-checklist-row:nth-child(3) input').click();
+  await page.waitForTimeout(300);
+  assert.deepEqual(await saveState(), { disabled: false, dirty: true }, "Save stayed inert after a change");
+
+  await page.locator("#background-decode-save-btn").click();
+  await page.waitForTimeout(1000);
+  assert.deepEqual(await saveState(), { disabled: true, dirty: false }, "Save stayed live after saving");
+
+  // The selection reached the server and comes back on the next load.
+  await openPanel();
+  const saved = await readRows();
+  assert.deepEqual(saved.map((row) => row.checked), [true, true, true, true],
+    "the newly selected bookmark did not survive a reload");
+
+  assert.deepEqual(runtimeErrors, []);
+} finally {
+  await browser.close();
+  await fixture.close();
+}
+
+// With no bookmarks at all the panel says what to do about it rather than
+// showing an empty box.
+const emptyFixture = await startWebFixture({ spectrum: true, bookmarks: [] });
+const empty = await startBrowser(chromium);
+try {
+  await empty.page.setViewportSize({ width: 1400, height: 950 });
+  await empty.page.goto(`${emptyFixture.origin}/settings`, { waitUntil: "domcontentloaded" });
+  await empty.page.locator("#tab-settings").waitFor({ state: "visible" });
+  await empty.page.waitForTimeout(2000);
+  await empty.page.locator('.sub-tab[data-subtab="settings-background-decode"]').click();
+  await empty.page.waitForTimeout(1000);
+  const text = await empty.page.evaluate(() =>
+    document.getElementById("bgd-bookmark-checklist")?.textContent?.trim() ?? "");
+  assert.match(text, /No bookmarks yet/, `the empty list reads "${text}"`);
+  const summary = await empty.page.evaluate(() =>
+    document.getElementById("bgd-selection-summary")?.textContent?.trim() ?? "");
+  assert.match(summary, /Nothing selected/, `the summary reads "${summary}"`);
+} finally {
+  await empty.browser.close();
+  await emptyFixture.close();
+}
+
+console.log("background decode panel tests passed");
@@ -40,7 +40,7 @@ test("background decode loads configuration for the explicitly selected rig", as
  const source = await bundleEntry(new URL("../src/plugins/background-decode.ts", import.meta.url));
  new vm.Script(source).runInContext(context);

-  window.trx.modules.backgroundDecode.initialize("rig/a", "control");
+  window.trx.modules.backgroundDecode.initialize("rig/a", ["administrator"]);
  await new Promise((resolve) => setTimeout(resolve, 0));
  assert.ok(requested.includes("/background-decode/rig%2Fa"));
  assert.ok(requested.includes("/bookmarks"));
@@ -32,7 +32,7 @@ function hostFixture(overrides = {}) {
  const calls = { postPath: [], setRigFrequency: [], armOptimisticFrequency: [], applyLocalTunedFrequency: [], syncBandwidthInput: [], scheduleSpectrumDraw: 0, syncModePicker: 0 };
  const state = {
    authEnabled: false,
-    authRole: "control",
+    authRoles: ["read", "control", "write", "administrator"],
    lastActiveRigId: null,
    lastRigIds: [],
    lastRigDisplayNames: {},
@@ -157,7 +157,7 @@ test("bookmark controls follow the host authentication state", async () => {
    if (!elements.has(id)) elements.set(id, new ElementFixture());
    return elements.get(id);
  };
-  const { window } = hostFixture({ authEnabled: true, authRole: "rx" });
+  const { window } = hostFixture({ authEnabled: true, authRoles: ["read"] });
  const context = vm.createContext({
    window,
    document: documentFixture(element),
@@ -171,7 +171,7 @@ test("bookmark controls follow the host authentication state", async () => {

  assert.equal(element("bm-add-btn").style.display, "none");

-  window.trx.state.authRole = "control";
+  window.trx.state.authRoles = ["read", "write"];
  await window.trx.modules.bookmarks.fetch("");
  assert.equal(element("bm-add-btn").style.display, "");
 });
@@ -25,6 +25,13 @@ const BEACON = {
 // A second rig listening in the background, on its own band. Both pages
 // describe the rig on screen, so its traffic belongs in neither the panel nor
 // the mini view — only on the map, which shows the whole station.
+// HF APRS travels a different band and a different path from the VHF list, so
+// it goes on the map under a source of its own that the filter can hide.
+const HF_BEACON = {
+  type: "hf_aprs", src_call: "SP5HF-7", dest_call: "APRS", path: "WIDE2-2", info: "HF beacon",
+  packet_type: "position", crc_ok: true, lat: 50.06, lon: 19.94,
+  symbol_table: "/", symbol_code: ">", rig_id: "rig-a",
+};
 const OTHER_RIG_VESSEL = {
  ...VESSEL, mmsi: 244660001, vessel_name: "ELDERBERRY", callsign: "PBTY",
  lat: 51.92, lon: 4.48, rig_id: "rig-b",
@@ -32,7 +39,7 @@ const OTHER_RIG_VESSEL = {

 // AIS is what the mini view for vessels is gated on; the rig has to be on it.
 const fixture = await startWebFixture({
-  spectrum: true, decodes: [VESSEL, BEACON, OTHER_RIG_VESSEL], mode: "AIS",
+  spectrum: true, decodes: [VESSEL, BEACON, HF_BEACON, OTHER_RIG_VESSEL], mode: "AIS",
 });
 const { browser, page, runtimeErrors } = await startBrowser(chromium);

@@ -104,6 +111,36 @@ try {
    return { ais: size(map?.aisMarkers), stations: size(map?.stationMarkers) };
  });
  assert.ok(markers.stations > 0, "the APRS station never reached the map");
+  // Both APRS stations are on it, each under its own source: the HF one used
+  // to be dropped entirely, since the HF list never plotted anything.
+  const aprsSources = await page.evaluate(() => {
+    const entries = [...(window.trx.modules.map?.stationMarkers ?? new Map()).entries()];
+    return entries.map(([key, entry]) => `${entry?.type ?? "?"}:${entry?.call ?? key}`).sort();
+  });
+  assert.deepEqual(aprsSources, ["aprs:SP2SJG-9", "hf_aprs:SP5HF-7"],
+    `the map holds ${JSON.stringify(aprsSources)}`);
+  // And the filter offers HF APRS on a chip of its own, next to the VHF one.
+  await page.locator('#map-locator-phase .map-locator-phase-btn[data-phase="type"]').click();
+  await page.waitForTimeout(400);
+  const chips = await page.evaluate(() => [...document.querySelectorAll("#map-locator-choice-filter .map-locator-chip")]
+    .map((chip) => chip.dataset.filterKey));
+  assert.ok(chips.includes("aprs") && chips.includes("hf_aprs"),
+    `the Show chips are ${JSON.stringify(chips)}`);
+
+  // Turning that chip off takes the HF station off the map and leaves the VHF
+  // one on: the two are filtered apart, which is the whole point of the split.
+  await page.locator('#map-locator-choice-filter .map-locator-chip[data-filter-key="hf_aprs"]').click();
+  await page.waitForTimeout(500);
+  const shownAfterFilter = await page.evaluate(() => {
+    const map = window.trx.modules.map;
+    const onMap = [];
+    (map?.stationMarkers ?? new Map()).forEach((entry, key) => {
+      if (entry?.marker && map.aprsMap?.hasLayer(entry.marker)) onMap.push(entry?.call ?? key);
+    });
+    return onMap.sort();
+  });
+  assert.deepEqual(shownAfterFilter, ["SP2SJG-9"],
+    `hiding HF APRS left ${JSON.stringify(shownAfterFilter)} on the map`);
  // The map is the whole station's view — the one place a background rig's
  // traffic belongs — so both vessels are on it even though the panel and the
  // mini view show only the selected rig's.
@@ -120,6 +157,8 @@ try {
 // left the client on its retry path and the history path untested.
 const HISTORY_AIS = 900;
 const HISTORY_APRS = 300;
+const HISTORY_FT8 = 12;
+const HISTORY_WSPR = 8;
 const historyFixture = await startWebFixture({
  spectrum: true,
  mode: "AIS",
@@ -129,6 +168,14 @@ const historyFixture = await startWebFixture({
      vessel_name: `HISTORIC ${index}`, channel: "A", message_type: 1,
      rig_id: "rig-a", ts_ms: Date.now() - (index + 1) * 1000,
    })),
+    ft8: Array.from({ length: HISTORY_FT8 }, (_, index) => ({
+      message: `CQ SP${index}ABC JO${String(index).padStart(2, "0")}`, snr_db: -7, dt_s: 0.2,
+      freq_hz: 1200 + index, rig_id: "rig-a", ts_ms: Date.now() - (index + 1) * 1000,
+    })),
+    wspr: Array.from({ length: HISTORY_WSPR }, (_, index) => ({
+      message: `SP${index}XYZ JN${String(index).padStart(2, "0")} 30`, snr_db: -22, dt_s: 0.5,
+      freq_hz: 1500 + index, rig_id: "rig-a", ts_ms: Date.now() - (index + 1) * 1000,
+    })),
    aprs: Array.from({ length: HISTORY_APRS }, (_, index) => ({
      src_call: `SP2SJG-${index % 15}`, dest_call: "APRS", path: "WIDE1-1",
      info: `history ${index}`, packet_type: "position", crc_ok: true,
@@ -216,6 +263,27 @@ try {
  assert.equal(plotted.ais, HISTORY_AIS, `${plotted.ais} of ${HISTORY_AIS} vessels reached the map`);
  assert.equal(plotted.stations, 15, `${plotted.stations} of 15 stations reached the map`);

+  // The Statistics page counts the same history. Its decode log lives in the
+  // map module, which is lazy, so every decode that arrived before the module
+  // did used to be recorded into nothing at all — the page opened empty and
+  // only filled in from decodes heard afterwards, and it took a reload landing
+  // on the tab (module loaded at startup, before the history) to show the lot.
+  await replay.page.evaluate(() => window.navigateToTab("statistics"));
+  await replay.page.waitForTimeout(1500);
+  // The counters are written with toLocaleString(), so a four-figure count
+  // arrives as "1,220" — whichever separator the runner's locale picks. Read
+  // the digits rather than the formatting.
+  const counted = await replay.page.evaluate(() => {
+    const count = (id) => Number((document.getElementById(id)?.textContent ?? "").replace(/\D/g, ""));
+    return { decodes: count("stats-total-decodes"), grids: count("stats-unique-grids") };
+  });
+  assert.equal(counted.decodes, HISTORY_AIS + HISTORY_APRS + HISTORY_FT8 + HISTORY_WSPR,
+    `the statistics counted ${counted.decodes} decodes`);
+  // Grid squares come from the FT8 and WSPR spots, which had no map replay of
+  // their own: the locators of everything heard before the map loaded were lost.
+  assert.equal(counted.grids, HISTORY_FT8 + HISTORY_WSPR,
+    `the statistics counted ${counted.grids} grid squares`);
+
  assert.deepEqual(replay.runtimeErrors, []);
 } finally {
  await replay.browser.close();
@@ -19,7 +19,7 @@ export function createHost({ state = {}, core = {}, modules = {} } = {}) {
        serverLat: null,
        serverLon: null,
        authEnabled: false,
-        authRole: "control",
+        authRoles: ["read", "control", "write", "administrator"],
        lastActiveRigId: null,
        lastRigIds: [],
        lastRigDisplayNames: {},
@@ -0,0 +1,225 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+// The station log: the panel opens an entry pre-filled from the radio and the
+// server's clock, writes a contact, keeps it, and says whether the station has
+// been worked before. And the ham layout, which is offered only where a rig can
+// transmit -- a log is of contacts made.
+
+import assert from "node:assert/strict";
+import { chromium } from "playwright-core";
+import { startBrowser, startWebFixture } from "./web-fixture.mjs";
+
+/* global document, window, location */
+
+const HELD = [
+  {
+    id: "q1", started_at: "2026-08-06T14:22:00Z", call: "DL3ABC", freq_hz: 14_074_000,
+    band: "20m", mode: "FT8", rst_sent: "-07", rst_rcvd: "-12", gridsquare: "JO31",
+    my_rig: "Primary fixture",
+  },
+  {
+    id: "q2", started_at: "2026-08-06T13:05:00Z", call: "SP9XYZ", freq_hz: 7_120_000,
+    band: "40m", mode: "SSB", submode: "LSB", rst_sent: "59", rst_rcvd: "57",
+    gridsquare: "JO90", my_rig: "Primary fixture",
+  },
+];
+
+const fixture = await startWebFixture({ spectrum: true, tx: true, logbook: [...HELD] });
+const { browser, page, runtimeErrors } = await startBrowser(chromium);
+
+const readPanel = () => page.evaluate(() => ({
+  rows: [...(document.getElementById("log-rows")?.children ?? [])].map((row) => ({
+    call: row.querySelector(".log-cell-call")?.textContent ?? "",
+    cells: [...row.querySelectorAll("td")].map((cell) => cell.textContent),
+  })),
+  summary: document.getElementById("log-summary")?.textContent ?? "",
+  freq: document.getElementById("log-freq")?.value ?? "",
+  mode: document.getElementById("log-mode")?.value ?? "",
+  call: document.getElementById("log-call")?.value ?? "",
+  grid: document.getElementById("log-grid")?.value ?? "",
+  rig: document.getElementById("log-station-rig-name")?.textContent ?? "",
+  clock: document.getElementById("log-clock")?.textContent ?? "",
+  worked: document.getElementById("log-worked-before")?.textContent ?? "",
+}));
+
+try {
+  await page.setViewportSize({ width: 1400, height: 950 });
+  await page.goto(`${fixture.origin}/logbook`, { waitUntil: "domcontentloaded" });
+  await page.locator("#tab-logbook").waitFor({ state: "visible" });
+  await page.waitForTimeout(2500);
+
+  // The log is there, newest first, with the band and mode of each contact.
+  const opened = await readPanel();
+  assert.deepEqual(opened.rows.map((row) => row.call), ["DL3ABC", "SP9XYZ"]);
+  assert.equal(opened.summary, "2 contacts");
+  // A phone contact shows the sideband it was worked on, not just "SSB".
+  assert.ok(opened.rows[1].cells.includes("LSB"), `the row reads ${JSON.stringify(opened.rows[1].cells)}`);
+
+  // The entry opened pre-filled: frequency and mode from the rig, the rig's
+  // name, and the time from the server.
+  assert.equal(opened.freq, "100", `the frequency pre-filled as "${opened.freq}"`);
+  assert.equal(opened.mode, "USB", `the mode pre-filled as "${opened.mode}"`);
+  assert.equal(opened.rig, "Primary fixture");
+  assert.match(opened.clock, /^\d{2}:\d{2}:\d{2}Z$/, `the clock reads "${opened.clock}"`);
+  // ...and nothing else was: a report is the operator's to give.
+  assert.equal(opened.call, "");
+  assert.equal(await page.evaluate(() => document.getElementById("log-rst-sent")?.value), "");
+
+  // Worked-before answers as the callsign is typed.
+  await page.locator("#log-call").fill("DL3ABC");
+  await page.waitForTimeout(600);
+  assert.match((await readPanel()).worked, /Worked before: 20m FT8/);
+  await page.locator("#log-call").fill("OZ1NEW");
+  await page.waitForTimeout(600);
+  assert.match((await readPanel()).worked, /Not worked before/);
+
+  // Logging writes the contact and clears the entry for the next one.
+  await page.locator("#log-rst-sent").fill("59");
+  await page.locator("#log-rst-rcvd").fill("57");
+  await page.locator("#log-save-btn").click();
+  await page.waitForTimeout(900);
+  const afterLogging = await readPanel();
+  assert.deepEqual(afterLogging.rows.map((row) => row.call), ["OZ1NEW", "DL3ABC", "SP9XYZ"]);
+  assert.equal(afterLogging.summary, "3 contacts");
+  assert.equal(afterLogging.call, "", "the entry kept the callsign after logging it");
+  assert.equal(afterLogging.freq, "100", "the entry did not re-open pre-filled");
+
+  // A decode row starts an entry rather than logging one: what was heard goes
+  // into the form, and the operator finishes it.
+  await page.evaluate(() => { window.navigateToTab("digital-modes"); });
+  await page.waitForTimeout(800);
+  await page.locator('#tab-digital-modes .sub-tab[data-subtab="ft8"]').click();
+  await page.waitForTimeout(400);
+  await page.evaluate(() => {
+    window.trxPluginRuntime.dispatch("ft8", {
+      message: "CQ SP2SJG JO94", snr_db: -7, dt_s: 0.2, freq_hz: 1200,
+      ts_ms: Date.now(), rig_id: "rig-a",
+    });
+  });
+  await page.waitForTimeout(600);
+  await page.locator("#ft8-messages .ft8-log-btn").first().click();
+  await page.waitForTimeout(900);
+  const fromDecode = await page.evaluate(() => ({
+    path: location.pathname,
+    call: document.getElementById("log-call")?.value ?? "",
+    grid: document.getElementById("log-grid")?.value ?? "",
+    mode: document.getElementById("log-mode")?.value ?? "",
+    rows: document.getElementById("log-rows")?.children.length ?? 0,
+  }));
+  assert.equal(fromDecode.path, "/logbook", `the Log button landed on ${fromDecode.path}`);
+  assert.equal(fromDecode.call, "SP2SJG", "the heard callsign did not reach the entry");
+  assert.equal(fromDecode.grid, "JO94", "the heard locator did not reach the entry");
+  // The decoder answers for the mode, because a rig in DIG cannot.
+  assert.equal(fromDecode.mode, "FT8", `the mode came through as "${fromDecode.mode}"`);
+  assert.equal(fromDecode.rows, 3, "a decode logged itself instead of opening an entry");
+
+  // The ham layout is on offer, because this rig can transmit.
+  const layouts = await page.evaluate(() =>
+    [...document.querySelectorAll("#operator-layout-select option")].map((option) => option.value));
+  assert.ok(layouts.includes("ham"), `the layouts are ${JSON.stringify(layouts)}`);
+  // Choosing it the way the picker does. The <select> itself measures zero
+  // wide in a headless window, so Playwright will not click it; the change
+  // event is what the picker is wired to either way.
+  await page.evaluate(() => { window.navigateToTab("main"); });
+  await page.waitForTimeout(600);
+  await page.evaluate(() => {
+    const select = document.getElementById("operator-layout-select");
+    select.value = "ham";
+    select.dispatchEvent(new Event("change", { bubbles: true }));
+  });
+  await page.waitForTimeout(900);
+  const inHamLayout = await page.evaluate(() => ({
+    layout: document.body.dataset.operatorLayout,
+    path: location.pathname,
+  }));
+  assert.equal(inHamLayout.layout, "ham");
+  assert.equal(inHamLayout.path, "/logbook", "the ham layout opened somewhere else");
+
+  // ── Contest working ─────────────────────────────────────────────────────
+  // The exchange belongs to the session: the contest and the serial sent stay
+  // between contacts, and the serial counts on by itself.
+  await page.evaluate(() => { window.navigateToTab("logbook"); });
+  await page.waitForTimeout(600);
+  await page.locator("#log-contest-block > summary").click();
+  await page.locator("#log-contest-id").fill("CQ-WW-SSB");
+  await page.locator("#log-stx").fill("1");
+  await page.locator("#log-call").fill("DL9CON");
+  await page.locator("#log-srx").fill("014");
+  await page.locator("#log-rst-sent").fill("59");
+  await page.locator("#log-rst-rcvd").fill("59");
+  await page.locator("#log-save-btn").click();
+  await page.waitForTimeout(900);
+  const afterContest = await page.evaluate(() => ({
+    contest: document.getElementById("log-contest-id")?.value ?? "",
+    stx: document.getElementById("log-stx")?.value ?? "",
+    srx: document.getElementById("log-srx")?.value ?? "",
+    call: document.getElementById("log-call")?.value ?? "",
+  }));
+  assert.equal(afterContest.contest, "CQ-WW-SSB", "the contest was cleared with the contact");
+  assert.equal(afterContest.stx, "2", `the serial sent went to "${afterContest.stx}"`);
+  assert.equal(afterContest.srx, "", "the received exchange was kept for the next station");
+  assert.equal(afterContest.call, "");
+
+  // The Cabrillo link carries the header, and names the contest so that only
+  // its contacts are entered.
+  await page.locator("#log-contest-export-block > summary").click();
+  await page.locator("#log-cbr-contest").fill("CQ-WW-SSB");
+  await page.locator("#log-cbr-score").fill("4242");
+  await page.waitForTimeout(300);
+  const cabrillo = await page.evaluate(() =>
+    document.getElementById("log-cbr-export")?.getAttribute("href") ?? "");
+  assert.match(cabrillo, /contest=CQ-WW-SSB/, `the Cabrillo link reads "${cabrillo}"`);
+  assert.match(cabrillo, /claimed_score=4242/, `the Cabrillo link reads "${cabrillo}"`);
+  const entry = await page.evaluate(async (href) => {
+    const response = await fetch(href);
+    return await response.text();
+  }, cabrillo);
+  assert.match(entry, /^START-OF-LOG: 3\.0/, entry);
+  assert.match(entry, /DL9CON/, "the contest contact is not in the entry");
+  assert.ok(!entry.includes("OZ1NEW"), "a contact outside the contest was entered");
+
+  // ── Confirmations ───────────────────────────────────────────────────────
+  // A card arrives: the contact is marked confirmed, and the per-band report
+  // counts it.
+  const confirmRow = page.locator("#log-rows tr", { hasText: "DL9CON" }).first();
+  await confirmRow.getByRole("button", { name: "Confirm" }).click();
+  await page.waitForTimeout(800);
+  await page.locator("#log-statistics-block > summary").click();
+  await page.waitForTimeout(400);
+  const confirmed = await page.evaluate(() => ({
+    marks: [...document.querySelectorAll("#log-rows tr")]
+      .map((row) => [...row.querySelectorAll("td")].at(-2)?.textContent ?? ""),
+    bands: [...document.querySelectorAll("#log-statistics-rows tr")]
+      .map((row) => [...row.querySelectorAll("td")].map((cell) => cell.textContent)),
+  }));
+  assert.equal(confirmed.marks.filter((mark) => mark === "✓").length, 1,
+    `the QSL column reads ${JSON.stringify(confirmed.marks)}`);
+  const twenty = confirmed.bands.find((band) => band[0] === "20m");
+  assert.ok(twenty, `the bands are ${JSON.stringify(confirmed.bands)}`);
+  assert.equal(twenty[3], "1", `20m shows ${twenty[3]} confirmed`);
+
+  assert.deepEqual(runtimeErrors, []);
+} finally {
+  await browser.close();
+  await fixture.close();
+}
+
+// Without a transmitter there is nothing to log, so the layout is not offered.
+const listenerFixture = await startWebFixture({ spectrum: true, tx: false });
+const listener = await startBrowser(chromium);
+try {
+  await listener.page.setViewportSize({ width: 1400, height: 950 });
+  await listener.page.goto(`${listenerFixture.origin}/`, { waitUntil: "domcontentloaded" });
+  await listener.page.locator("#content").waitFor({ state: "visible" });
+  await listener.page.waitForTimeout(2000);
+  const layouts = await listener.page.evaluate(() =>
+    [...document.querySelectorAll("#operator-layout-select option")].map((option) => option.value));
+  assert.ok(!layouts.includes("ham"), `a receiver was offered the ham layout: ${JSON.stringify(layouts)}`);
+} finally {
+  await listener.browser.close();
+  await listenerFixture.close();
+}
+
+console.log("logbook tests passed");
@@ -11,7 +11,7 @@ import { bundleEntry } from "./bundle-entry.mjs";
 test("scheduler registers a typed module service without lifecycle globals", async () => {
  // No role known yet: the entry registers its service and waits for the
  // application to drive initialization.
-  const window = { ...createHost({ state: { authRole: null } }), trxUi: { confirm: async () => true } };
+  const window = { ...createHost({ state: { authEnabled: true, authRoles: [] } }), trxUi: { confirm: async () => true } };
  const context = vm.createContext({
    window,
    document: {
@@ -76,7 +76,7 @@ test("scheduler self-initializes for the active rig when a role is already known
    return elements.get(id);
  };
  const window = {
-    ...createHost({ state: { authRole: "control", lastActiveRigId: "sdr" } }),
+    ...createHost({ state: { authRoles: ["administrator"], lastActiveRigId: "sdr" } }),
    trxUi: { confirm: async () => true },
  };
  const context = vm.createContext({
@@ -9,6 +9,7 @@ import { readFile } from "node:fs/promises";
 const indexPath = new URL("../../assets/web/index.html", import.meta.url);
 const pluginLoaderPath = new URL("../src/plugin-loader.ts", import.meta.url);
 const mapCorePath = new URL("../src/map-core.ts", import.meta.url);
+const appPath = new URL("../src/app.ts", import.meta.url);

 test("index loads one first-party application bootstrap", async () => {
  const html = await readFile(indexPath, "utf8");
@@ -30,6 +31,30 @@ test("startup has no remote script or stylesheet dependencies", async () => {
  );
 });

+test("administrator user management is a dedicated Settings sub-tab", async () => {
+  const [html, app] = await Promise.all([
+    readFile(indexPath, "utf8"),
+    readFile(appPath, "utf8"),
+  ]);
+  assert.match(html, /data-subtab="settings-users"/);
+  assert.match(html, /id="subtab-settings-users" class="sub-tab-panel"/);
+  assert.match(app, /authEnabled && hasAuthRole\("administrator"\)/);
+  assert.match(app, /settings-users-tab/);
+});
+
+test("account lifecycle controls include self-service passwords and enable state", async () => {
+  const [html, app] = await Promise.all([
+    readFile(indexPath, "utf8"),
+    readFile(appPath, "utf8"),
+  ]);
+  assert.match(html, /data-subtab="settings-account"/);
+  assert.match(html, /id="account-password-form"/);
+  assert.match(html, /id="user-create-enabled"/);
+  assert.match(app, /changeOwnPassword/);
+  assert.match(app, /hasAccountControls\(authRoles\)/);
+  assert.match(app, /enabledAdminCount/);
+});
+
 test("lazy frontend features use modules and local map symbols", async () => {
  const [loader, map] = await Promise.all([
    readFile(pluginLoaderPath, "utf8"),
@@ -34,7 +34,14 @@ const DECODER_REGISTRY = [
  { id: "aprs", label: "APRS", activation: "toggle", active_modes: ["FM"] },
  { id: "hf-aprs", label: "HF APRS", activation: "toggle", active_modes: ["USB"] },
  { id: "vdes", label: "VDES", activation: "toggle", active_modes: ["FM"] },
-].map((decoder) => ({ ...decoder, background_decode: false, bookmark_selectable: true }));
+].map((decoder) => ({
+  ...decoder,
+  // Which decoders a background channel can run, as the server's own registry
+  // has it: the background decode panel offers a bookmark only if one of these
+  // can decode it, so marking them all false left that panel with nothing.
+  background_decode: ["ft8", "ft4", "ft2", "wspr", "ais", "aprs", "hf-aprs"].includes(decoder.id),
+  bookmark_selectable: true,
+}));

 const CONTENT_TYPES = new Map([
  [".css", "text/css; charset=utf-8"],
@@ -132,10 +139,14 @@ export async function startWebFixture({
  mode = "FM",
  history = {},
  bookmarks = [],
+  backgroundDecode = null,
+  logbook = [],
  bandplan = {},
  bandplanEnabled = false,
  bandplanUnauthorizedFirst = false,
  satPasses = null,
+  authSession = { authenticated: true, roles: ["read", "control", "write", "administrator"], auth_disabled: true },
+  users = [],
 } = {}) {
  const rigItems = ["rig-a", "rig-b"].map((remote) => ({
    remote,
@@ -223,7 +234,8 @@ export async function startWebFixture({
  };

  const jsonRoutes = new Map([
-    ["/auth/session", { authenticated: true, role: "control", auth_disabled: true }],
+    ["/auth/session", authSession],
+    ["/auth/users", users],
    ["/decoders", DECODER_REGISTRY],
    ["/rigs", rigsResponse],
    ["/status", status],
@@ -271,6 +283,158 @@ export async function startWebFixture({
      response.writeHead(200).end();
      return;
    }
+    // The logbook: an in-memory station log, enough for the panel to open an
+    // entry, write it, read it back and export it.
+    if (url.pathname.startsWith("/api/logbook")) {
+      const tail = url.pathname.slice("/api/logbook".length);
+      if (tail === "/prefill") {
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({
+          started_at: new Date().toISOString(),
+          epoch_ms: Date.now(),
+          freq_hz: status.status.freq.hz,
+          band: "20m",
+          mode: url.searchParams.get("decoder") === "ft8" ? "FT8" : "SSB",
+          submode: url.searchParams.get("decoder") === "ft8" ? null : "USB",
+          rig_id: url.searchParams.get("remote") ?? "rig-a",
+          my_rig: "Primary fixture",
+          call: url.searchParams.get("call"),
+          gridsquare: url.searchParams.get("gridsquare"),
+        }));
+        return;
+      }
+      if (tail.startsWith("/worked/")) {
+        const call = decodeURIComponent(tail.slice("/worked/".length)).toUpperCase();
+        const worked = logbook
+          .filter((qso) => qso.call === call)
+          .map((qso) => ({ band: qso.band, mode: qso.mode }));
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({ call, worked }));
+        return;
+      }
+      if (tail === "/statistics") {
+        const bands = new Map();
+        for (const qso of logbook) {
+          const entry = bands.get(qso.band) ?? { band: qso.band, contacts: 0, stations: 0, confirmed: 0, calls: new Set() };
+          entry.contacts += 1;
+          entry.calls.add(qso.call);
+          if (qso.confirmed || qso.qsl_rcvd === "Y" || qso.lotw_qsl_rcvd === "Y") entry.confirmed += 1;
+          bands.set(qso.band, entry);
+        }
+        const list = [...bands.values()].map(({ calls, ...rest }) => ({ ...rest, stations: calls.size }));
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({
+          contacts: logbook.length,
+          confirmed: list.reduce((total, band) => total + band.confirmed, 0),
+          bands: list,
+        }));
+        return;
+      }
+      if (tail === "/export.cbr") {
+        const contest = url.searchParams.get("contest");
+        const entered = contest ? logbook.filter((qso) => qso.contest_id === contest) : logbook;
+        response.writeHead(200, { "content-type": "text/plain" });
+        response.end(`START-OF-LOG: 3.0\nCONTEST: ${contest ?? ""}\n`
+          + entered.map((qso) => `QSO: 14200 PH ${qso.call}\n`).join("")
+          + "END-OF-LOG:\n");
+        return;
+      }
+      if (request.method === "PUT") {
+        const raw = await new Promise((resolve) => {
+          let text = "";
+          request.on("data", (chunk) => { text += chunk; });
+          request.on("end", () => resolve(text));
+        });
+        const input = JSON.parse(raw);
+        const id = tail.replace("/", "");
+        const held = logbook.find((qso) => qso.id === id);
+        if (held) {
+          Object.assign(held, input, { id, confirmed: input.qsl_rcvd === "Y" });
+        }
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify(held ?? {}));
+        return;
+      }
+      if (tail === "/export.adi") {
+        const body = logbook
+          .map((qso) => `<CALL:${qso.call.length}>${qso.call}<EOR>\n`)
+          .join("");
+        response.writeHead(200, { "content-type": "text/plain" });
+        response.end(body);
+        return;
+      }
+      if (request.method === "POST" && tail === "") {
+        const raw = await new Promise((resolve) => {
+          let text = "";
+          request.on("data", (chunk) => { text += chunk; });
+          request.on("end", () => resolve(text));
+        });
+        const input = JSON.parse(raw);
+        const qso = {
+          id: `qso-${String(logbook.length + 1)}`,
+          started_at: input.started_at ?? new Date().toISOString(),
+          call: String(input.call).toUpperCase(),
+          freq_hz: input.freq_hz,
+          band: "20m",
+          mode: input.mode,
+          submode: input.submode,
+          rst_sent: input.rst_sent,
+          rst_rcvd: input.rst_rcvd,
+          gridsquare: input.gridsquare ? String(input.gridsquare).toUpperCase() : null,
+          my_rig: input.my_rig,
+          operator: input.operator,
+          contest_id: input.contest_id ?? null,
+          stx: input.stx ?? null,
+          srx: input.srx ?? null,
+          confirmed: input.qsl_rcvd === "Y" || input.lotw_qsl_rcvd === "Y",
+        };
+        logbook.unshift(qso);
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify(qso));
+        return;
+      }
+      if (request.method === "DELETE") {
+        const id = tail.replace("/", "");
+        const index = logbook.findIndex((qso) => qso.id === id);
+        if (index >= 0) logbook.splice(index, 1);
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify({ deleted: index >= 0 }));
+        return;
+      }
+      const wanted = (url.searchParams.get("call") ?? "").toUpperCase();
+      const matching = wanted ? logbook.filter((qso) => qso.call.includes(wanted)) : logbook;
+      response.writeHead(200, { "content-type": "application/json" });
+      response.end(JSON.stringify({ total: logbook.length, qsos: matching }));
+      return;
+    }
+    // Background decode: the panel reads its config, its status, and the
+    // bookmark list, and writes the config back.
+    if (url.pathname.startsWith("/background-decode/")) {
+      const isStatus = url.pathname.endsWith("/status");
+      if (isStatus) {
+        response.writeHead(200, { "content-type": "application/json" });
+        response.end(JSON.stringify(backgroundDecode?.status ?? { entries: [] }));
+        return;
+      }
+      if (request.method === "PUT") {
+        const body = await new Promise((resolve) => {
+          let raw = "";
+          request.on("data", (chunk) => { raw += chunk; });
+          request.on("end", () => resolve(raw));
+        });
+        try {
+          const parsed = JSON.parse(body);
+          if (backgroundDecode) backgroundDecode.config = parsed;
+        } catch { /* leave the config as it was */ }
+      }
+      if (request.method === "DELETE" && backgroundDecode) {
+        backgroundDecode.config = { remote: "rig-a", enabled: false, bookmark_ids: [] };
+      }
+      response.writeHead(200, { "content-type": "application/json" });
+      response.end(JSON.stringify(backgroundDecode?.config
+        ?? { remote: "rig-a", enabled: false, bookmark_ids: [] }));
+      return;
+    }
    if (url.pathname === "/select_rig" && request.method === "POST") {
      const remote = url.searchParams.get("remote");
      if (remote) {
@@ -10,7 +10,9 @@ use actix_web::{get, HttpRequest, HttpResponse, Responder};
 use std::collections::HashMap;
 use std::sync::OnceLock;

-use super::{gz_cache_entry, static_asset_response, GzCacheEntry, FAVICON_BYTES, LOGO_BYTES};
+use super::{
+    gz_cache_entry, static_asset_response, AssetCaching, GzCacheEntry, FAVICON_BYTES, LOGO_BYTES,
+};
 use crate::server::status;

 // ---------------------------------------------------------------------------
@@ -62,55 +64,111 @@ define_gz_cache!(gz_leaflet_css, status::LEAFLET_CSS, "leaflet.css");
 #[get("/")]
 pub(crate) async fn index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/map")]
 pub(crate) async fn map_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/digital-modes")]
 pub(crate) async fn digital_modes_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/recorder")]
 pub(crate) async fn recorder_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/settings")]
 pub(crate) async fn settings_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/about")]
 pub(crate) async fn about_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/statistics")]
 pub(crate) async fn statistics_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
+}
+
+#[get("/logbook")]
+pub(crate) async fn logbook_index(req: HttpRequest) -> impl Responder {
+    let c = gz_index_html();
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/satellites")]
 pub(crate) async fn satellites_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/bookmarks")]
 pub(crate) async fn bookmarks_index(req: HttpRequest) -> impl Responder {
    let c = gz_index_html();
-    static_asset_response(&req, "text/html; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "text/html; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 // ---------------------------------------------------------------------------
@@ -148,13 +206,13 @@ pub(crate) async fn logo() -> impl Responder {
 #[get("/style.css")]
 pub(crate) async fn style_css(req: HttpRequest) -> impl Responder {
    let c = gz_style_css();
-    static_asset_response(&req, "text/css; charset=utf-8", c)
+    static_asset_response(&req, "text/css; charset=utf-8", c, AssetCaching::Revalidate)
 }

 #[get("/themes.css")]
 pub(crate) async fn themes_css(req: HttpRequest) -> impl Responder {
    let c = gz_themes_css();
-    static_asset_response(&req, "text/css; charset=utf-8", c)
+    static_asset_response(&req, "text/css; charset=utf-8", c, AssetCaching::Revalidate)
 }

 // Generated filenames are supplied only by build.rs and resolved through this
@@ -178,7 +236,22 @@ pub(crate) async fn generated_asset(req: HttpRequest, path: web::Path<String>) -
    let Some(entry) = generated_asset_cache().get(filename.as_str()) else {
        return HttpResponse::NotFound().finish();
    };
-    static_asset_response(&req, content_type, entry)
+    static_asset_response(
+        &req,
+        content_type,
+        entry,
+        generated_asset_caching(&filename),
+    )
+}
+
+/// esbuild names shared chunks `chunk-<hash>.js` and leaves the entry points on
+/// a fixed name, so only the chunks are safe to keep forever.
+fn generated_asset_caching(filename: &str) -> AssetCaching {
+    if filename.starts_with("chunk-") {
+        AssetCaching::Immutable
+    } else {
+        AssetCaching::Revalidate
+    }
 }

 /// Serve a received SSTV picture out of the local cache.
@@ -221,7 +294,12 @@ fn cached_png(decoder: &str, filename: &str) -> HttpResponse {
 #[get("/bandplan.json")]
 pub(crate) async fn bandplan_json(req: HttpRequest) -> impl Responder {
    let c = gz_bandplan_json();
-    static_asset_response(&req, "application/json; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "application/json; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 // ---------------------------------------------------------------------------
@@ -239,7 +317,12 @@ pub(crate) async fn dseg14_classic_woff2() -> impl Responder {
 #[get("/vendor/opus-decoder-0.7.11.min.js")]
 pub(crate) async fn opus_decoder_js(req: HttpRequest) -> impl Responder {
    let c = gz_opus_decoder_js();
-    static_asset_response(&req, "application/javascript; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "application/javascript; charset=utf-8",
+        c,
+        AssetCaching::Immutable,
+    )
 }

 // ---------------------------------------------------------------------------
@@ -249,13 +332,18 @@ pub(crate) async fn opus_decoder_js(req: HttpRequest) -> impl Responder {
 #[get("/vendor/leaflet.js")]
 pub(crate) async fn leaflet_js(req: HttpRequest) -> impl Responder {
    let c = gz_leaflet_js();
-    static_asset_response(&req, "application/javascript; charset=utf-8", c)
+    static_asset_response(
+        &req,
+        "application/javascript; charset=utf-8",
+        c,
+        AssetCaching::Revalidate,
+    )
 }

 #[get("/vendor/leaflet.css")]
 pub(crate) async fn leaflet_css(req: HttpRequest) -> impl Responder {
    let c = gz_leaflet_css();
-    static_asset_response(&req, "text/css; charset=utf-8", c)
+    static_asset_response(&req, "text/css; charset=utf-8", c, AssetCaching::Revalidate)
 }

 #[get("/vendor/marker-icon.png")]
@@ -355,6 +443,44 @@ mod tests {
        assert!(!generated_asset_cache().contains_key("../app.js"));
    }

+    /// A browser that visited before an upgrade must not keep the old page.
+    /// index.html, the stylesheets and the entry bundles all keep their URL
+    /// from one build to the next, so an immutable year-long policy on them
+    /// leaves a client running whatever it first downloaded — a fixed layout
+    /// stays broken in the browser that happened to cache it, and no reload
+    /// short of a forced one gets the fix.
+    #[test]
+    fn assets_that_keep_their_url_across_builds_are_revalidated() {
+        for name in ["app.js", "aprs.js", "map-core.js"] {
+            assert_eq!(
+                generated_asset_caching(name),
+                AssetCaching::Revalidate,
+                "{name} is served from the same URL after every build"
+            );
+        }
+        assert_eq!(
+            AssetCaching::Revalidate.header_value(),
+            "no-cache",
+            "revalidating assets must ask before they are reused"
+        );
+    }
+
+    /// Only the chunks carry a hash of their own bytes, so only they can be
+    /// kept forever.
+    #[test]
+    fn content_addressed_chunks_stay_immutable() {
+        let chunk = status::GENERATED_ASSETS
+            .iter()
+            .map(|(name, _)| *name)
+            .find(|name| name.starts_with("chunk-"))
+            .expect("the bundle splits into at least one shared chunk");
+        assert_eq!(generated_asset_caching(chunk), AssetCaching::Immutable);
+        assert!(
+            AssetCaching::Immutable.header_value().contains("immutable"),
+            "a hashed name is safe to keep"
+        );
+    }
+
    #[test]
    fn generated_asset_mime_types_are_restricted() {
        assert_eq!(
@@ -9,7 +9,7 @@ use std::sync::Arc;
 use actix_web::Error;
 use actix_web::{delete, get, post, put, web, HttpRequest, HttpResponse};

-use super::{no_cache_response, request_accepts_html, require_control};
+use super::{no_cache_response, request_accepts_html, require_write};
 use crate::server::status;

 // ============================================================================
@@ -165,7 +165,7 @@ pub async fn create_bookmark(
    body: web::Json<BookmarkInput>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    if store.freq_taken(body.freq_hz, None) {
        return Err(actix_web::error::ErrorConflict(
@@ -201,7 +201,7 @@ pub async fn update_bookmark(
    body: web::Json<BookmarkInput>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let id = path.into_inner();
    if store.freq_taken(body.freq_hz, Some(&id)) {
@@ -235,7 +235,7 @@ pub async fn delete_bookmark(
    query: web::Query<BookmarkScopeQuery>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let id = path.into_inner();
    if store.remove(&id) {
@@ -253,7 +253,7 @@ pub async fn batch_delete_bookmarks(
    query: web::Query<BookmarkScopeQuery>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let mut deleted = 0usize;
    for id in &body.ids {
@@ -272,7 +272,7 @@ pub async fn batch_move_bookmarks(
    query: web::Query<BookmarkScopeQuery>,
    auth_state: web::Data<crate::server::auth::AuthState>,
 ) -> Result<HttpResponse, Error> {
-    require_control(&req, &auth_state)?;
+    require_write(&req, &auth_state)?;
    let from_store = resolve_bookmark_store(query.scope.as_deref(), store_map.get_ref());
    let to_store = resolve_bookmark_store(Some(body.to.as_str()), store_map.get_ref());
    let mut moved = 0usize;
@@ -0,0 +1,456 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! The logbook over HTTP: read, write, import, export, and the clock a contact
+//! is stamped from.
+
+use std::sync::Arc;
+
+use actix_web::http::header;
+use actix_web::{delete, get, post, put, web, HttpRequest, HttpResponse, Responder};
+use chrono::Utc;
+use serde::{Deserialize, Serialize};
+
+use trx_logbook::qso::{adif_mode_for_rig_mode, band_for_hz, mode_for_decoder};
+use trx_logbook::{LogQuery, Logbook, Qso};
+
+use super::{active_rig_id_from_context, require_write};
+use crate::server::auth::AuthState;
+
+/// What a contact looks like on the wire.
+///
+/// The band is sent although it is derived, because every reader of the log
+/// wants it and none of them should have to carry the band plan to get it.
+#[derive(Debug, Serialize)]
+struct QsoView {
+    #[serde(flatten)]
+    qso: Qso,
+    band: Option<&'static str>,
+    /// Whether the other station has confirmed, from whichever bureau answered.
+    confirmed: bool,
+}
+
+impl From<Qso> for QsoView {
+    fn from(qso: Qso) -> Self {
+        Self {
+            band: qso.band(),
+            confirmed: qso.is_confirmed(),
+            qso,
+        }
+    }
+}
+
+/// A contact as the panel sends it.
+///
+/// Times come from the server (`started_at` omitted means "now"), so a browser
+/// with a wrong clock cannot write a wrong time into the log.
+#[derive(Debug, Deserialize)]
+struct QsoInput {
+    #[serde(default)]
+    id: Option<String>,
+    #[serde(default)]
+    started_at: Option<chrono::DateTime<Utc>>,
+    #[serde(default)]
+    ended_at: Option<chrono::DateTime<Utc>>,
+    call: String,
+    freq_hz: u64,
+    mode: String,
+    #[serde(default)]
+    submode: Option<String>,
+    #[serde(default)]
+    rst_sent: Option<String>,
+    #[serde(default)]
+    rst_rcvd: Option<String>,
+    #[serde(default)]
+    gridsquare: Option<String>,
+    #[serde(default)]
+    name: Option<String>,
+    #[serde(default)]
+    qth: Option<String>,
+    #[serde(default)]
+    comment: Option<String>,
+    #[serde(default)]
+    tx_pwr_w: Option<f64>,
+    #[serde(default)]
+    station_callsign: Option<String>,
+    #[serde(default)]
+    operator: Option<String>,
+    #[serde(default)]
+    my_gridsquare: Option<String>,
+    #[serde(default)]
+    my_rig: Option<String>,
+    #[serde(default)]
+    rig_id: Option<String>,
+    #[serde(default)]
+    contest_id: Option<String>,
+    #[serde(default)]
+    stx: Option<u32>,
+    #[serde(default)]
+    stx_string: Option<String>,
+    #[serde(default)]
+    srx: Option<u32>,
+    #[serde(default)]
+    srx_string: Option<String>,
+    #[serde(default)]
+    cqz: Option<u8>,
+    #[serde(default)]
+    ituz: Option<u8>,
+    #[serde(default)]
+    qsl_sent: Option<String>,
+    #[serde(default)]
+    qsl_rcvd: Option<String>,
+    #[serde(default)]
+    lotw_qsl_sent: Option<String>,
+    #[serde(default)]
+    lotw_qsl_rcvd: Option<String>,
+    #[serde(default)]
+    eqsl_qsl_sent: Option<String>,
+    #[serde(default)]
+    eqsl_qsl_rcvd: Option<String>,
+}
+
+/// ADIF's QSL states are single letters. Anything else is refused rather than
+/// written, or a log would grow states no other program can read.
+fn qsl_state(value: Option<String>) -> Option<String> {
+    let state = blank_to_none(value)?.to_uppercase();
+    matches!(state.as_str(), "Y" | "N" | "R" | "I" | "Q" | "V").then_some(state)
+}
+
+fn blank_to_none(value: Option<String>) -> Option<String> {
+    value
+        .map(|text| text.trim().to_string())
+        .filter(|text| !text.is_empty())
+}
+
+impl QsoInput {
+    fn into_qso(self, existing: Option<Qso>) -> Result<Qso, String> {
+        let call = self.call.trim();
+        if call.is_empty() {
+            return Err("a contact needs a callsign".to_string());
+        }
+        if self.mode.trim().is_empty() {
+            return Err("a contact needs a mode".to_string());
+        }
+        let started_at = self
+            .started_at
+            .or(existing.as_ref().map(|q| q.started_at))
+            .unwrap_or_else(Utc::now);
+        let mut qso = Qso::new(
+            self.id
+                .or(existing.as_ref().map(|q| q.id.clone()))
+                .unwrap_or_else(trx_logbook::new_id),
+            started_at,
+            call,
+            self.freq_hz,
+            &self.mode,
+        );
+        qso.ended_at = self.ended_at;
+        qso.submode = blank_to_none(self.submode).map(|s| s.to_uppercase());
+        qso.rst_sent = blank_to_none(self.rst_sent);
+        qso.rst_rcvd = blank_to_none(self.rst_rcvd);
+        qso.gridsquare = blank_to_none(self.gridsquare).map(|g| g.to_uppercase());
+        qso.name = blank_to_none(self.name);
+        qso.qth = blank_to_none(self.qth);
+        qso.comment = blank_to_none(self.comment);
+        qso.tx_pwr_w = self.tx_pwr_w;
+        qso.station_callsign = blank_to_none(self.station_callsign).map(|c| c.to_uppercase());
+        qso.operator = blank_to_none(self.operator).map(|c| c.to_uppercase());
+        qso.my_gridsquare = blank_to_none(self.my_gridsquare).map(|g| g.to_uppercase());
+        qso.my_rig = blank_to_none(self.my_rig);
+        qso.rig_id = blank_to_none(self.rig_id);
+        qso.contest_id = blank_to_none(self.contest_id).map(|c| c.to_uppercase());
+        qso.stx = self.stx;
+        qso.stx_string = blank_to_none(self.stx_string);
+        qso.srx = self.srx;
+        qso.srx_string = blank_to_none(self.srx_string);
+        qso.cqz = self.cqz;
+        qso.ituz = self.ituz;
+        qso.qsl_sent = qsl_state(self.qsl_sent);
+        qso.qsl_rcvd = qsl_state(self.qsl_rcvd);
+        qso.lotw_qsl_sent = qsl_state(self.lotw_qsl_sent);
+        qso.lotw_qsl_rcvd = qsl_state(self.lotw_qsl_rcvd);
+        qso.eqsl_qsl_sent = qsl_state(self.eqsl_qsl_sent);
+        qso.eqsl_qsl_rcvd = qsl_state(self.eqsl_qsl_rcvd);
+        // Whatever an imported contact carried that this application does not
+        // model stays with it through an edit.
+        if let Some(existing) = existing {
+            qso.extra = existing.extra;
+        }
+        Ok(qso)
+    }
+}
+
+fn book(logbook: &web::Data<Arc<Logbook>>) -> Arc<Logbook> {
+    logbook.get_ref().clone()
+}
+
+/// The rig's name as the operator knows it, which is what belongs in the log —
+/// falling back to its id, since a log entry naming nothing is worse.
+fn rig_display_name(context: &trx_frontend::FrontendRuntimeContext, rig_id: &str) -> String {
+    context
+        .routing
+        .remote_rigs
+        .lock()
+        .ok()
+        .and_then(|rigs| {
+            rigs.iter()
+                .find(|rig| rig.rig_id == rig_id)
+                .and_then(|rig| rig.display_name.clone())
+        })
+        .unwrap_or_else(|| rig_id.to_string())
+}
+
+/// `GET /api/logbook` — contacts, newest first, filtered.
+#[get("/api/logbook")]
+pub async fn list_qsos(
+    query: web::Query<LogQuery>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let query = query.into_inner();
+    let total = book(&logbook).count();
+    let qsos: Vec<QsoView> = book(&logbook)
+        .query(&query)
+        .into_iter()
+        .map(QsoView::from)
+        .collect();
+    HttpResponse::Ok().json(serde_json::json!({ "total": total, "qsos": qsos }))
+}
+
+/// `POST /api/logbook` — write a contact.
+#[post("/api/logbook")]
+pub async fn add_qso(
+    req: HttpRequest,
+    input: web::Json<QsoInput>,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    let qso = match input.into_inner().into_qso(None) {
+        Ok(qso) => qso,
+        Err(reason) => {
+            return Ok(HttpResponse::BadRequest().json(serde_json::json!({ "error": reason })))
+        }
+    };
+    match book(&logbook).put(qso) {
+        Ok(saved) => Ok(HttpResponse::Ok().json(QsoView::from(saved))),
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `PUT /api/logbook/{id}` — change a contact.
+#[put("/api/logbook/{id}")]
+pub async fn edit_qso(
+    req: HttpRequest,
+    path: web::Path<String>,
+    input: web::Json<QsoInput>,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    let id = path.into_inner();
+    let Some(existing) = book(&logbook).get(&id) else {
+        return Ok(HttpResponse::NotFound().json(serde_json::json!({ "error": "no such contact" })));
+    };
+    let mut input = input.into_inner();
+    input.id = Some(id);
+    let qso = match input.into_qso(Some(existing)) {
+        Ok(qso) => qso,
+        Err(reason) => {
+            return Ok(HttpResponse::BadRequest().json(serde_json::json!({ "error": reason })))
+        }
+    };
+    match book(&logbook).put(qso) {
+        Ok(saved) => Ok(HttpResponse::Ok().json(QsoView::from(saved))),
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `DELETE /api/logbook/{id}` — forget a contact.
+#[delete("/api/logbook/{id}")]
+pub async fn delete_qso(
+    req: HttpRequest,
+    path: web::Path<String>,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    match book(&logbook).delete(&path.into_inner()) {
+        Ok(true) => Ok(HttpResponse::Ok().json(serde_json::json!({ "deleted": true }))),
+        Ok(false) => {
+            Ok(HttpResponse::NotFound().json(serde_json::json!({ "error": "no such contact" })))
+        }
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `GET /api/logbook/export.adi` — ADIF, honouring the same filters as a read.
+#[get("/api/logbook/export.adi")]
+pub async fn export_adi(
+    query: web::Query<LogQuery>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let text = book(&logbook).export_adi(&query.into_inner(), env!("CARGO_PKG_VERSION"));
+    let filename = format!("trx-rs-log-{}.adi", Utc::now().format("%Y%m%d"));
+    HttpResponse::Ok()
+        .insert_header((header::CONTENT_TYPE, "text/plain; charset=utf-8"))
+        .insert_header((
+            header::CONTENT_DISPOSITION,
+            format!("attachment; filename=\"{filename}\""),
+        ))
+        .body(text)
+}
+
+/// `POST /api/logbook/import` — take an ADIF file, skipping what is already held.
+#[post("/api/logbook/import")]
+pub async fn import_adi(
+    req: HttpRequest,
+    body: web::Bytes,
+    logbook: web::Data<Arc<Logbook>>,
+    auth_state: web::Data<AuthState>,
+) -> Result<HttpResponse, actix_web::Error> {
+    require_write(&req, auth_state.get_ref())?;
+    match book(&logbook).import_adi(&body) {
+        Ok(outcome) => Ok(HttpResponse::Ok().json(outcome)),
+        Err(err) => Ok(HttpResponse::InternalServerError()
+            .json(serde_json::json!({ "error": err.to_string() }))),
+    }
+}
+
+/// `GET /api/logbook/export.cbr` — a contest entry, in the only format sponsors
+/// take.
+///
+/// The header cannot be worked out from the log — how many operators, how much
+/// power — so it comes as query parameters from the operator.
+#[get("/api/logbook/export.cbr")]
+pub async fn export_cabrillo(
+    query: web::Query<LogQuery>,
+    header: web::Query<trx_logbook::CabrilloHeader>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let text = book(&logbook).export_cabrillo(&query.into_inner(), &header.into_inner());
+    let filename = format!("trx-rs-contest-{}.cbr", Utc::now().format("%Y%m%d"));
+    HttpResponse::Ok()
+        .insert_header((header::CONTENT_TYPE, "text/plain; charset=utf-8"))
+        .insert_header((
+            header::CONTENT_DISPOSITION,
+            format!("attachment; filename=\"{filename}\""),
+        ))
+        .body(text)
+}
+
+/// `GET /api/logbook/statistics` — what has been worked and confirmed, per band.
+#[get("/api/logbook/statistics")]
+pub async fn statistics(logbook: web::Data<Arc<Logbook>>) -> impl Responder {
+    let bands = book(&logbook).band_statistics();
+    let contacts: usize = bands.iter().map(|band| band.contacts).sum();
+    let confirmed: usize = bands.iter().map(|band| band.confirmed).sum();
+    HttpResponse::Ok().json(serde_json::json!({
+        "contacts": contacts,
+        "confirmed": confirmed,
+        "bands": bands,
+    }))
+}
+
+/// `GET /api/logbook/worked/{call}` — which bands and modes this station has been
+/// worked on.
+#[get("/api/logbook/worked/{call}")]
+pub async fn worked_before(
+    path: web::Path<String>,
+    logbook: web::Data<Arc<Logbook>>,
+) -> impl Responder {
+    let call = path.into_inner();
+    let worked: Vec<serde_json::Value> = book(&logbook)
+        .worked_before(&call)
+        .into_iter()
+        .map(|(band, mode)| serde_json::json!({ "band": band, "mode": mode }))
+        .collect();
+    HttpResponse::Ok().json(serde_json::json!({
+        "call": trx_logbook::qso::normalize_call(&call),
+        "worked": worked,
+    }))
+}
+
+/// `GET /api/logbook/now` — the clock a contact is stamped from.
+///
+/// The panel shows the operator when their browser disagrees with it, rather
+/// than logging a time nobody expected.
+#[get("/api/logbook/now")]
+pub async fn server_now() -> impl Responder {
+    let now = Utc::now();
+    HttpResponse::Ok().json(serde_json::json!({
+        "utc": now.to_rfc3339(),
+        "epoch_ms": now.timestamp_millis(),
+    }))
+}
+
+/// `GET /api/logbook/prefill` — the six fields an entry opens with.
+///
+/// Worked out on the server because that is where the rig state, the station
+/// identity and the clock all are; the panel would otherwise have to assemble
+/// them from three places and would still not have the clock.
+#[derive(Debug, Deserialize)]
+pub struct PrefillQuery {
+    /// The rig the entry is for.
+    #[serde(default)]
+    pub remote: Option<String>,
+    /// The decoder a decode row came from, which answers for the mode when the
+    /// rig only says `DIG`.
+    #[serde(default)]
+    pub decoder: Option<String>,
+    /// A callsign and locator carried over from a decode row.
+    #[serde(default)]
+    pub call: Option<String>,
+    #[serde(default)]
+    pub gridsquare: Option<String>,
+}
+
+#[get("/api/logbook/prefill")]
+pub async fn prefill(
+    query: web::Query<PrefillQuery>,
+    context: web::Data<Arc<trx_frontend::FrontendRuntimeContext>>,
+    state: web::Data<tokio::sync::watch::Receiver<trx_core::RigState>>,
+) -> impl Responder {
+    let query = query.into_inner();
+    let rig_id = query
+        .remote
+        .clone()
+        .filter(|id| !id.is_empty())
+        .or_else(|| active_rig_id_from_context(context.get_ref()));
+    let rig_state = rig_id
+        .as_deref()
+        .and_then(|id| context.rig_state_rx(id))
+        .unwrap_or_else(|| state.get_ref().clone())
+        .borrow()
+        .clone();
+
+    let freq_hz = rig_state.status.freq.hz;
+    let rig_mode = format!("{:?}", rig_state.status.mode);
+    // The rig cannot answer for DIG: a rig in DIG is in FT8 or FT4 depending on
+    // which decoder is running, so the decoder is asked first when there is one.
+    let (mode, submode) = query
+        .decoder
+        .as_deref()
+        .and_then(mode_for_decoder)
+        .or_else(|| adif_mode_for_rig_mode(&rig_mode))
+        .map_or((String::new(), None), |(mode, submode)| {
+            (mode.to_string(), submode.map(str::to_string))
+        });
+
+    let now = Utc::now();
+    HttpResponse::Ok().json(serde_json::json!({
+        "started_at": now.to_rfc3339(),
+        "epoch_ms": now.timestamp_millis(),
+        "freq_hz": freq_hz,
+        "band": band_for_hz(freq_hz),
+        "mode": mode,
+        "submode": submode,
+        "rig_id": rig_id,
+        "my_rig": rig_id.as_deref().map(|id| rig_display_name(context.get_ref(), id)),
+        "call": query.call.map(|c| trx_logbook::qso::normalize_call(&c)),
+        "gridsquare": query.gridsquare.map(|g| g.trim().to_uppercase()),
+    }))
+}
@@ -7,6 +7,7 @@
 mod assets;
 mod bookmarks;
 mod decoder;
+mod logbook;
 pub mod recorder;
 pub mod rig;
 mod sse;
@@ -307,10 +308,35 @@ where
 }

 /// Pre-compressed (gzip + brotli) + ETag-aware response for immutable embedded assets.
+/// How long a browser may hold an asset before asking about it again.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+pub(crate) enum AssetCaching {
+    /// The name carries a hash of the bytes, so a change is a new URL and the
+    /// old one can be kept forever.
+    Immutable,
+    /// Served from the same URL for the life of the deployment, with different
+    /// bytes after an upgrade: index.html, the stylesheets, the entry bundles.
+    /// These must be revalidated, or a browser that visited before the upgrade
+    /// keeps running the old page — for a year, with the ETag never consulted,
+    /// which is how a fixed layout stays broken in one browser and not another.
+    /// The ETag makes the revalidation a 304 in the usual case.
+    Revalidate,
+}
+
+impl AssetCaching {
+    pub(crate) fn header_value(self) -> &'static str {
+        match self {
+            Self::Immutable => "public, max-age=31536000, immutable",
+            Self::Revalidate => "no-cache",
+        }
+    }
+}
+
 fn static_asset_response(
    req: &HttpRequest,
    content_type: &'static str,
    entry: &GzCacheEntry,
+    caching: AssetCaching,
 ) -> HttpResponse {
    let etag = &entry.etag;
    // Check If-None-Match for conditional GET.
@@ -319,7 +345,7 @@ fn static_asset_response(
            if val == etag || val == "*" {
                return HttpResponse::NotModified()
                    .insert_header((header::ETAG, etag.to_owned()))
-                    .insert_header((header::CACHE_CONTROL, "public, max-age=31536000, immutable"))
+                    .insert_header((header::CACHE_CONTROL, caching.header_value()))
                    .finish();
            }
        }
@@ -339,7 +365,7 @@ fn static_asset_response(
        .insert_header((header::CONTENT_TYPE, content_type))
        .insert_header((header::CONTENT_ENCODING, encoding))
        .insert_header((header::ETAG, etag.to_owned()))
-        .insert_header((header::CACHE_CONTROL, "public, max-age=31536000, immutable"))
+        .insert_header((header::CACHE_CONTROL, caching.header_value()))
        .body(Bytes::copy_from_slice(body))
 }

@@ -365,16 +391,20 @@ fn gz_cache_entry(src: &[u8], name: &str) -> GzCacheEntry {
    GzCacheEntry { gz, br, etag }
 }

-fn require_control(
+fn require_write(
    req: &HttpRequest,
    auth_state: &crate::server::auth::AuthState,
 ) -> Result<(), actix_web::Error> {
-    if !auth_state.config.enabled {
-        return Ok(());
-    }
-    match crate::server::auth::get_session_role(req, auth_state) {
-        Some(crate::server::auth::AuthRole::Control) => Ok(()),
-        _ => Err(actix_web::error::ErrorForbidden("control role required")),
+    if !auth_state.config.enabled
+        || crate::server::auth::session_grants(
+            req,
+            auth_state,
+            crate::server::auth::AuthRole::Write,
+        )
+    {
+        Ok(())
+    } else {
+        Err(actix_web::error::ErrorForbidden("write role required"))
    }
 }

@@ -639,6 +669,7 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
        .service(assets::recorder_index)
        .service(assets::settings_index)
        .service(assets::about_index)
+        .service(assets::logbook_index)
        .service(assets::satellites_index)
        .service(assets::statistics_index)
        .service(assets::bookmarks_index)
@@ -681,7 +712,24 @@ pub fn configure(cfg: &mut web::ServiceConfig) {
        // Auth endpoints
        .service(crate::server::auth::login)
        .service(crate::server::auth::logout)
-        .service(crate::server::auth::session_status);
+        .service(crate::server::auth::session_status)
+        .service(crate::server::auth::change_own_password)
+        .service(crate::server::auth::list_users)
+        .service(crate::server::auth::create_user)
+        .service(crate::server::auth::update_user)
+        .service(crate::server::auth::delete_user)
+        // Logbook
+        .service(logbook::list_qsos)
+        .service(logbook::add_qso)
+        .service(logbook::edit_qso)
+        .service(logbook::delete_qso)
+        .service(logbook::export_adi)
+        .service(logbook::export_cabrillo)
+        .service(logbook::statistics)
+        .service(logbook::import_adi)
+        .service(logbook::worked_before)
+        .service(logbook::server_now)
+        .service(logbook::prefill);
 }

 #[cfg(test)]
@@ -840,6 +888,404 @@ mod tests {
    // Endpoint tests using actix_web::test
    // ======================================================================

+    /// The page and the bundles it pulls in are served from the same URLs after
+    /// every upgrade, so the browser has to ask whether they changed.  Served
+    /// as immutable for a year, a browser that visited once kept the old page
+    /// and never saw a fix again -- which is how a corrected layout stays
+    /// broken in one browser while every other one has it.
+    #[actix_web::test]
+    async fn documents_and_entry_bundles_are_revalidated_not_frozen() {
+        let app = actix_test::init_service(
+            App::new()
+                .service(assets::index)
+                .service(assets::style_css)
+                .service(assets::generated_asset),
+        )
+        .await;
+
+        for path in ["/", "/style.css", "/app.js"] {
+            let req = actix_test::TestRequest::get().uri(path).to_request();
+            let resp = actix_test::call_service(&app, req).await;
+            assert_eq!(resp.status(), 200, "{path} should be served");
+            let cache_control = resp
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok())
+                .unwrap_or_default();
+            assert_eq!(cache_control, "no-cache", "{path} must be revalidated");
+            assert!(
+                resp.headers().contains_key(header::ETAG),
+                "{path} needs an ETag, or revalidating costs a full download"
+            );
+        }
+    }
+
+    /// Revalidation has to stay cheap: an unchanged asset answers 304, and the
+    /// policy on that answer matches the one on the body.
+    #[actix_web::test]
+    async fn an_unchanged_document_answers_not_modified() {
+        let app = actix_test::init_service(App::new().service(assets::style_css)).await;
+
+        let first = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/style.css")
+                .to_request(),
+        )
+        .await;
+        let etag = first
+            .headers()
+            .get(header::ETAG)
+            .and_then(|value| value.to_str().ok())
+            .expect("style.css carries an ETag")
+            .to_owned();
+
+        let conditional = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/style.css")
+                .insert_header((header::IF_NONE_MATCH, etag))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(conditional.status(), 304);
+        assert_eq!(
+            conditional
+                .headers()
+                .get(header::CACHE_CONTROL)
+                .and_then(|value| value.to_str().ok()),
+            Some("no-cache")
+        );
+    }
+
+    /// Auth off: every session may write without an account.
+    fn auth_state_disabled() -> crate::server::auth::AuthState {
+        crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
+            false,
+            std::path::PathBuf::from("unused-users.json"),
+            None,
+            None,
+            std::time::Duration::from_secs(3600),
+            false,
+            crate::server::auth::SameSite::Lax,
+        ))
+        .unwrap()
+    }
+
+    /// Auth on with no session presented, which is what a listener is.
+    fn auth_state_locked() -> crate::server::auth::AuthState {
+        let directory = tempfile::tempdir().unwrap();
+        crate::server::auth::AuthState::new(crate::server::auth::AuthConfig::new(
+            true,
+            directory.path().join("users.json"),
+            Some(crate::server::auth::BootstrapAccount::new(
+                "admin".to_string(),
+                "password123".to_string(),
+            )),
+            None,
+            std::time::Duration::from_secs(3600),
+            false,
+            crate::server::auth::SameSite::Lax,
+        ))
+        .unwrap()
+    }
+
+    /// A contact written over HTTP comes back out of the log, and out of an
+    /// ADIF export that another logger could read.
+    #[actix_web::test]
+    async fn a_contact_written_over_http_is_kept_and_exported() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook.clone()))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso)
+                .service(logbook::list_qsos)
+                .service(logbook::export_adi)
+                .service(logbook::worked_before),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .set_json(serde_json::json!({
+                    "call": "sp2sjg",
+                    "freq_hz": 14_074_000_u64,
+                    "mode": "FT8",
+                    "rst_sent": "-07",
+                    "gridsquare": "jo94",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), 200);
+        let written: serde_json::Value = actix_test::read_body_json(response).await;
+        // Normalised on the way in, and the band worked out from the dial.
+        assert_eq!(written["call"], "SP2SJG");
+        assert_eq!(written["gridsquare"], "JO94");
+        assert_eq!(written["band"], "20m");
+
+        let listed: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook")
+                .to_request(),
+        )
+        .await;
+        assert_eq!(listed["total"], 1);
+        assert_eq!(listed["qsos"][0]["call"], "SP2SJG");
+
+        let worked: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/worked/SP2SJG")
+                .to_request(),
+        )
+        .await;
+        assert_eq!(worked["worked"][0]["band"], "20m");
+
+        let exported = actix_test::call_and_read_body(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/export.adi")
+                .to_request(),
+        )
+        .await;
+        let text = String::from_utf8_lossy(&exported);
+        assert!(text.contains("<CALL:6>SP2SJG"), "{text}");
+        assert!(text.contains("<BAND:3>20m"), "{text}");
+        assert!(text.contains("<EOR>"), "{text}");
+    }
+
+    /// A contest entry comes out in Cabrillo, holding that contest's contacts
+    /// and no others, with the header the operator gave.
+    #[actix_web::test]
+    async fn a_contest_entry_is_exported_as_cabrillo() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook.clone()))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso)
+                .service(logbook::export_cabrillo)
+                .service(logbook::statistics),
+        )
+        .await;
+
+        for (call, contest, serial, confirmed) in [
+            ("DL1AB", Some("CQ-WW-SSB"), 1, true),
+            ("OZ2CD", Some("CQ-WW-SSB"), 2, false),
+            ("SP3EF", None, 0, false),
+        ] {
+            let response = actix_test::call_service(
+                &app,
+                actix_test::TestRequest::post()
+                    .uri("/api/logbook")
+                    .set_json(serde_json::json!({
+                        "call": call,
+                        "freq_hz": 14_200_000_u64,
+                        "mode": "SSB",
+                        "rst_sent": "59",
+                        "rst_rcvd": "59",
+                        "station_callsign": "SP0TRX",
+                        "contest_id": contest,
+                        "stx": serial,
+                        "srx": serial,
+                        "lotw_qsl_rcvd": if confirmed { "Y" } else { "N" },
+                    }))
+                    .to_request(),
+            )
+            .await;
+            assert_eq!(response.status(), 200);
+        }
+
+        let entry = actix_test::call_and_read_body(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/export.cbr?contest=CQ-WW-SSB&callsign=SP0TRX&claimed_score=42")
+                .to_request(),
+        )
+        .await;
+        let text = String::from_utf8_lossy(&entry);
+        assert!(text.starts_with("START-OF-LOG: 3.0"), "{text}");
+        assert!(text.contains("CONTEST: CQ-WW-SSB"), "{text}");
+        assert!(text.contains("CLAIMED-SCORE: 42"), "{text}");
+        assert_eq!(
+            text.lines().filter(|line| line.starts_with("QSO:")).count(),
+            2,
+            "the entry holds contacts from outside the contest: {text}"
+        );
+        assert!(!text.contains("SP3EF"), "{text}");
+
+        // And the statistics count the station once per band, with the
+        // confirmation counted wherever it came from.
+        let stats: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook/statistics")
+                .to_request(),
+        )
+        .await;
+        assert_eq!(stats["contacts"], 3);
+        assert_eq!(stats["confirmed"], 1);
+        assert_eq!(stats["bands"][0]["band"], "20m");
+        assert_eq!(stats["bands"][0]["stations"], 3);
+    }
+
+    /// A QSL state that is not one of ADIF's letters is dropped rather than
+    /// written, or the log grows states nothing else can read.
+    #[actix_web::test]
+    async fn a_qsl_state_outside_the_enumeration_is_not_written() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso),
+        )
+        .await;
+        let written: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .set_json(serde_json::json!({
+                    "call": "SP1AA", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                    "qsl_rcvd": "maybe", "lotw_qsl_rcvd": "y",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert!(written.get("qsl_rcvd").is_none(), "{written}");
+        // ...but a lowercase letter that is in the enumeration is taken.
+        assert_eq!(written["lotw_qsl_rcvd"], "Y");
+        assert_eq!(written["confirmed"], true);
+    }
+
+    /// A read-only session may read the log and may not write to it.
+    #[actix_web::test]
+    async fn a_read_only_session_cannot_write_to_the_log() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let auth_state = auth_state_locked();
+        let session_id = auth_state.store.create(
+            "reader".to_string(),
+            [crate::server::auth::AuthRole::Read].into_iter().collect(),
+            std::time::Duration::from_secs(3600),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state))
+                .service(logbook::add_qso)
+                .service(logbook::list_qsos),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new(
+                    "trx_http_sid",
+                    session_id.clone(),
+                ))
+                .set_json(serde_json::json!({
+                    "call": "SP2SJG", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert!(
+            response.status().is_client_error(),
+            "a listener wrote to the log: {}",
+            response.status()
+        );
+        let listed: serde_json::Value = actix_test::call_and_read_body_json(
+            &app,
+            actix_test::TestRequest::get()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new("trx_http_sid", session_id))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(listed["total"], 0);
+    }
+
+    #[actix_web::test]
+    async fn a_write_session_can_write_to_the_log() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let auth_state = auth_state_locked();
+        let session_id = auth_state.store.create(
+            "writer".to_string(),
+            [crate::server::auth::AuthRole::Write].into_iter().collect(),
+            std::time::Duration::from_secs(3600),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state))
+                .service(logbook::add_qso),
+        )
+        .await;
+
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .cookie(actix_web::cookie::Cookie::new("trx_http_sid", session_id))
+                .set_json(serde_json::json!({
+                    "call": "SP2SJG", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), actix_web::http::StatusCode::OK);
+    }
+
+    /// A contact needs a callsign; the panel is not the only thing that has to
+    /// insist on it.
+    #[actix_web::test]
+    async fn a_contact_without_a_callsign_is_refused() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let logbook = std::sync::Arc::new(
+            trx_logbook::Logbook::open(&dir.path().join("logbook.jsonl")).expect("open"),
+        );
+        let app = actix_test::init_service(
+            App::new()
+                .app_data(web::Data::new(logbook))
+                .app_data(web::Data::new(auth_state_disabled()))
+                .service(logbook::add_qso),
+        )
+        .await;
+        let response = actix_test::call_service(
+            &app,
+            actix_test::TestRequest::post()
+                .uri("/api/logbook")
+                .set_json(serde_json::json!({
+                    "call": "   ", "freq_hz": 14_074_000_u64, "mode": "FT8",
+                }))
+                .to_request(),
+        )
+        .await;
+        assert_eq!(response.status(), 400);
+    }
+
    /// GET /status returns 200 with valid JSON containing rig snapshot fields.
    #[actix_web::test]
    async fn test_status_endpoint_returns_json() {
@@ -106,6 +106,39 @@ async fn serve(
        activity_log_map.clone(),
    );

+    // The log is opened once and shared: it is one station's log, not one per
+    // rig or per session.
+    let logbook_path = context
+        .http_ui
+        .logbook_path
+        .clone()
+        .map(std::path::PathBuf::from)
+        .unwrap_or_else(trx_logbook::default_log_path);
+    let logbook = match trx_logbook::Logbook::open(&logbook_path) {
+        Ok(logbook) => {
+            tracing::info!(
+                "Logbook: {} contact(s) in {}",
+                logbook.count(),
+                logbook_path.display()
+            );
+            Arc::new(logbook)
+        }
+        Err(err) => {
+            // A log that cannot be opened must not stop the radio working, but
+            // it must be said loudly: contacts made now will not be kept.
+            tracing::error!(
+                "Logbook at {} could not be opened ({err}); logging is unavailable",
+                logbook_path.display()
+            );
+            Arc::new(
+                trx_logbook::Logbook::open(std::path::Path::new(
+                    &std::env::temp_dir().join("trx-rs-logbook.jsonl"),
+                ))
+                .unwrap_or_else(|e| panic!("logbook fallback in the temp directory failed: {e}")),
+            )
+        }
+    };
+
    let background_decode_path = BackgroundDecodeStore::default_path();
    let background_decode_store = Arc::new(BackgroundDecodeStore::open(&background_decode_path));
    let vchan_mgr = Arc::new(ClientChannelManager::new(
@@ -164,6 +197,7 @@ async fn serve(
        session_rig_mgr,
        background_decode_mgr,
        recorder_mgr,
+        logbook,
    )?;
    let handle = server.handle();
    tokio::spawn(async move {
@@ -192,6 +226,7 @@ fn build_server(
    session_rig_mgr: Arc<api::SessionRigManager>,
    background_decode_mgr: Arc<BackgroundDecodeManager>,
    recorder_mgr: Arc<RecorderManager>,
+    logbook: Arc<trx_logbook::Logbook>,
 ) -> Result<Server, actix_web::Error> {
    let state_data = web::Data::new(state_rx);
    let rig_tx = web::Data::new(rig_tx);
@@ -209,6 +244,7 @@ fn build_server(
    let session_rig_mgr = web::Data::new(session_rig_mgr);
    let background_decode_mgr = web::Data::new(background_decode_mgr);
    let recorder_mgr = web::Data::new(recorder_mgr);
+    let logbook = web::Data::new(logbook);

    // Extract auth config values before moving context
    let same_site = match context.http_auth.cookie_same_site.as_str() {
@@ -216,11 +252,31 @@ fn build_server(
        "None" => SameSite::None,
        _ => SameSite::Lax, // default
    };
+    let bootstrap_admin = auth::BootstrapAccount::from_parts(
+        context.http_auth.bootstrap_admin_username.clone(),
+        context.http_auth.bootstrap_admin_password.clone(),
+    );
+    let bootstrap_read = context
+        .http_auth
+        .bootstrap_read_enabled
+        .then(|| {
+            context
+                .http_auth
+                .bootstrap_read_password
+                .clone()
+                .map(|password| {
+                    auth::BootstrapAccount::new(
+                        context.http_auth.bootstrap_read_username.clone(),
+                        password,
+                    )
+                })
+        })
+        .flatten();
    let auth_config = AuthConfig::new(
        context.http_auth.enabled,
-        context.http_auth.rx_passphrase.clone(),
-        context.http_auth.control_passphrase.clone(),
-        context.http_auth.tx_access_control_enabled,
+        context.http_auth.users_file.clone().into(),
+        bootstrap_admin,
+        bootstrap_read,
        Duration::from_secs(context.http_auth.session_ttl_secs),
        context.http_auth.cookie_secure,
        same_site,
@@ -237,7 +293,9 @@ fn build_server(
    }

    let context_data = web::Data::new(context);
-    let auth_state = web::Data::new(AuthState::new(auth_config.clone()));
+    let auth_state = web::Data::new(
+        AuthState::new(auth_config.clone()).map_err(actix_web::error::ErrorInternalServerError)?,
+    );

    // Spawn session cleanup task if auth is enabled
    if auth_config.enabled {
@@ -267,6 +325,7 @@ fn build_server(
            .app_data(session_rig_mgr.clone())
            .app_data(background_decode_mgr.clone())
            .app_data(recorder_mgr.clone())
+            .app_data(logbook.clone())
            .wrap(Compress::default())
            .wrap(
                DefaultHeaders::new()
@@ -0,0 +1,19 @@
+# SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+[package]
+name = "trx-logbook"
+version.workspace = true
+edition = "2021"
+
+[dependencies]
+chrono = { version = "0.4", default-features = false, features = ["clock", "serde"] }
+dirs = "6"
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
+tracing = { workspace = true }
+uuid = { workspace = true }
+
+[dev-dependencies]
+tempfile = "3"
@@ -0,0 +1,466 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! ADIF, the format every other logger reads.
+//!
+//! ADI is a tagged text format: `<FIELD:length>value`, where the length counts
+//! the bytes of the value that follows, records end at `<EOR>`, an optional
+//! header ends at `<EOH>`, and anything outside a tag is ignored — which is how
+//! files carry human notes between records.
+//!
+//! The reader is deliberately forgiving. Files in the wild have lowercase tags,
+//! CRLF line endings, no header at all, type indicators on some fields and not
+//! others, and fields this application has never heard of. None of that is a
+//! reason to refuse someone's log. The writer, by contrast, is strict: what
+//! leaves here has to be read by software that is not.
+
+use std::collections::BTreeMap;
+
+use chrono::Utc;
+
+use crate::qso::{
+    adif_date, adif_time, freq_mhz_string, hz_from_mhz_string, normalize_call, parse_adif_datetime,
+    Qso,
+};
+
+/// Fields the [`Qso`] models itself. Everything else an import carries is kept
+/// in `extra` under its own name, so a round trip does not strip it.
+const MODELLED: &[&str] = &[
+    "CALL",
+    "QSO_DATE",
+    "TIME_ON",
+    "QSO_DATE_OFF",
+    "TIME_OFF",
+    "FREQ",
+    "BAND",
+    "MODE",
+    "SUBMODE",
+    "RST_SENT",
+    "RST_RCVD",
+    "GRIDSQUARE",
+    "NAME",
+    "QTH",
+    "COMMENT",
+    "TX_PWR",
+    "STATION_CALLSIGN",
+    "OPERATOR",
+    "MY_GRIDSQUARE",
+    "MY_RIG",
+    "CONTEST_ID",
+    "STX",
+    "STX_STRING",
+    "SRX",
+    "SRX_STRING",
+    "CQZ",
+    "ITUZ",
+    "QSL_SENT",
+    "QSL_RCVD",
+    "LOTW_QSL_SENT",
+    "LOTW_QSL_RCVD",
+    "EQSL_QSL_SENT",
+    "EQSL_QSL_RCVD",
+];
+
+/// ADIF's QSL states are single letters; anything else in that field is a
+/// misunderstanding on the writer's part and is not carried into ours.
+fn qsl_state(value: Option<&str>) -> Option<String> {
+    let state = value?.trim().to_uppercase();
+    matches!(state.as_str(), "Y" | "N" | "R" | "I" | "Q" | "V").then_some(state)
+}
+
+/// What a file gave up, and what it could not.
+#[derive(Debug, Default, Clone)]
+pub struct ParseReport {
+    /// Records that became a QSO.
+    pub qsos: Vec<Qso>,
+    /// Records that did not, and why — one line each, for showing the operator.
+    pub rejected: Vec<String>,
+}
+
+/// One `<NAME:LEN[:TYPE]>value` field.
+struct Field {
+    name: String,
+    value: String,
+}
+
+/// Reads the next tag starting at `from`, returning it and where it ended.
+///
+/// Returns `None` at the end of input or on a tag that never closes, which is
+/// how a truncated file stops rather than looping.
+fn next_field(bytes: &[u8], from: usize) -> Option<(Field, usize)> {
+    let open = bytes[from..].iter().position(|b| *b == b'<')? + from;
+    let close = bytes[open..].iter().position(|b| *b == b'>')? + open;
+    let spec = String::from_utf8_lossy(&bytes[open + 1..close]).to_string();
+    let mut parts = spec.split(':');
+    let name = parts.next().unwrap_or_default().trim().to_uppercase();
+
+    // <EOR> and <EOH> carry no length and no value.
+    let Some(length_text) = parts.next() else {
+        return Some((
+            Field {
+                name,
+                value: String::new(),
+            },
+            close + 1,
+        ));
+    };
+    let length: usize = length_text.trim().parse().unwrap_or(0);
+    let value_start = close + 1;
+    // A length that runs off the end is a truncated file, not a reason to lose
+    // everything before it: take what is there.
+    let value_end = value_start.saturating_add(length).min(bytes.len());
+    let value = String::from_utf8_lossy(&bytes[value_start..value_end]).to_string();
+    Some((Field { name, value }, value_end))
+}
+
+/// Read an ADI file.
+///
+/// Never fails as a whole: a record that cannot be made into a QSO is reported
+/// on [`ParseReport::rejected`] and the rest of the file is still read.
+pub fn parse_adi(input: &[u8]) -> ParseReport {
+    let mut report = ParseReport::default();
+    let mut position = 0usize;
+    let mut fields: Vec<Field> = Vec::new();
+    let mut in_header = looks_like_header(input);
+    let mut record_number = 0usize;
+
+    while let Some((field, next)) = next_field(input, position) {
+        position = next;
+        match field.name.as_str() {
+            "EOH" => {
+                in_header = false;
+                fields.clear();
+            }
+            "EOR" => {
+                record_number += 1;
+                if in_header {
+                    // A file with no <EOH> but an <EOR>: the header guess was
+                    // wrong, so treat what we have as a record.
+                    in_header = false;
+                }
+                match qso_from_fields(&fields) {
+                    Ok(qso) => report.qsos.push(qso),
+                    Err(reason) => report
+                        .rejected
+                        .push(format!("record {record_number}: {reason}")),
+                }
+                fields.clear();
+            }
+            _ => fields.push(field),
+        }
+    }
+
+    // A last record without its <EOR> is still a record someone wrote.
+    if !fields.is_empty() && !in_header {
+        record_number += 1;
+        match qso_from_fields(&fields) {
+            Ok(qso) => report.qsos.push(qso),
+            Err(reason) => report
+                .rejected
+                .push(format!("record {record_number}: {reason}")),
+        }
+    }
+    report
+}
+
+/// Whether the file opens with a header, i.e. anything before the first tag.
+///
+/// ADIF says a file whose first character is not `<` has a header. Plenty of
+/// exporters write no header at all, so the first `<EOR>` un-guesses this.
+fn looks_like_header(input: &[u8]) -> bool {
+    match input.iter().position(|b| !b.is_ascii_whitespace()) {
+        Some(first) => input[first] != b'<',
+        None => false,
+    }
+}
+
+fn find<'a>(fields: &'a [Field], name: &str) -> Option<&'a str> {
+    fields
+        .iter()
+        .find(|f| f.name == name)
+        .map(|f| f.value.trim())
+        .filter(|value| !value.is_empty())
+}
+
+fn qso_from_fields(fields: &[Field]) -> Result<Qso, String> {
+    let call = find(fields, "CALL").ok_or("no CALL")?;
+    let date = find(fields, "QSO_DATE").ok_or("no QSO_DATE")?;
+    let started_at = parse_adif_datetime(date, find(fields, "TIME_ON"))
+        .ok_or("QSO_DATE or TIME_ON unreadable")?;
+
+    // FREQ is authoritative; BAND is the fallback for logs that record only the
+    // band, and its midpoint is the honest answer for "where in the band".
+    let freq_hz = match find(fields, "FREQ").and_then(hz_from_mhz_string) {
+        Some(hz) => hz,
+        None => find(fields, "BAND")
+            .and_then(band_midpoint_hz)
+            .ok_or("neither FREQ nor a known BAND")?,
+    };
+    let mode = find(fields, "MODE").unwrap_or("SSB").to_uppercase();
+
+    let ended_at = find(fields, "TIME_OFF").and_then(|time| {
+        let off_date = find(fields, "QSO_DATE_OFF").unwrap_or(date);
+        parse_adif_datetime(off_date, Some(time))
+    });
+
+    let mut extra = BTreeMap::new();
+    for field in fields {
+        if MODELLED.contains(&field.name.as_str()) {
+            continue;
+        }
+        if field.value.trim().is_empty() {
+            continue;
+        }
+        extra.insert(field.name.clone(), field.value.trim().to_string());
+    }
+
+    Ok(Qso {
+        id: crate::new_id(),
+        started_at,
+        ended_at,
+        call: normalize_call(call),
+        freq_hz,
+        mode,
+        submode: find(fields, "SUBMODE").map(|s| s.to_uppercase()),
+        rst_sent: find(fields, "RST_SENT").map(str::to_string),
+        rst_rcvd: find(fields, "RST_RCVD").map(str::to_string),
+        gridsquare: find(fields, "GRIDSQUARE").map(|g| g.to_uppercase()),
+        name: find(fields, "NAME").map(str::to_string),
+        qth: find(fields, "QTH").map(str::to_string),
+        comment: find(fields, "COMMENT").map(str::to_string),
+        tx_pwr_w: find(fields, "TX_PWR").and_then(|p| p.parse().ok()),
+        station_callsign: find(fields, "STATION_CALLSIGN").map(normalize_call),
+        operator: find(fields, "OPERATOR").map(normalize_call),
+        my_gridsquare: find(fields, "MY_GRIDSQUARE").map(|g| g.to_uppercase()),
+        my_rig: find(fields, "MY_RIG").map(str::to_string),
+        rig_id: None,
+        contest_id: find(fields, "CONTEST_ID").map(|c| c.to_uppercase()),
+        stx: find(fields, "STX").and_then(|value| value.parse().ok()),
+        stx_string: find(fields, "STX_STRING").map(str::to_string),
+        srx: find(fields, "SRX").and_then(|value| value.parse().ok()),
+        srx_string: find(fields, "SRX_STRING").map(str::to_string),
+        cqz: find(fields, "CQZ").and_then(|value| value.parse().ok()),
+        ituz: find(fields, "ITUZ").and_then(|value| value.parse().ok()),
+        qsl_sent: qsl_state(find(fields, "QSL_SENT")),
+        qsl_rcvd: qsl_state(find(fields, "QSL_RCVD")),
+        lotw_qsl_sent: qsl_state(find(fields, "LOTW_QSL_SENT")),
+        lotw_qsl_rcvd: qsl_state(find(fields, "LOTW_QSL_RCVD")),
+        eqsl_qsl_sent: qsl_state(find(fields, "EQSL_QSL_SENT")),
+        eqsl_qsl_rcvd: qsl_state(find(fields, "EQSL_QSL_RCVD")),
+        extra,
+    })
+}
+
+/// The middle of a named band, for logs that recorded a band and no frequency.
+fn band_midpoint_hz(band: &str) -> Option<u64> {
+    crate::qso::band_midpoint_for_name(band)
+}
+
+fn write_field(out: &mut String, name: &str, value: &str) {
+    if value.is_empty() {
+        return;
+    }
+    out.push_str(&format!("<{}:{}>{}", name, value.len(), value));
+}
+
+/// Write QSOs as an ADI file, header and all.
+pub fn write_adi(qsos: &[Qso], program_version: &str) -> String {
+    let mut out = String::with_capacity(qsos.len() * 256 + 256);
+    let now = Utc::now();
+    out.push_str("ADIF export from trx-rs\n");
+    write_field(&mut out, "ADIF_VER", "3.1.4");
+    write_field(&mut out, "PROGRAMID", "trx-rs");
+    write_field(&mut out, "PROGRAMVERSION", program_version);
+    write_field(
+        &mut out,
+        "CREATED_TIMESTAMP",
+        &format!("{} {}", adif_date(&now), adif_time(&now)),
+    );
+    out.push_str("<EOH>\n");
+
+    for qso in qsos {
+        write_field(&mut out, "CALL", &qso.call);
+        write_field(&mut out, "QSO_DATE", &adif_date(&qso.started_at));
+        write_field(&mut out, "TIME_ON", &adif_time(&qso.started_at));
+        if let Some(ended) = qso.ended_at {
+            write_field(&mut out, "QSO_DATE_OFF", &adif_date(&ended));
+            write_field(&mut out, "TIME_OFF", &adif_time(&ended));
+        }
+        write_field(&mut out, "FREQ", &freq_mhz_string(qso.freq_hz));
+        if let Some(band) = qso.band() {
+            write_field(&mut out, "BAND", band);
+        }
+        write_field(&mut out, "MODE", &qso.mode);
+        if let Some(submode) = &qso.submode {
+            write_field(&mut out, "SUBMODE", submode);
+        }
+        for (name, value) in [
+            ("RST_SENT", &qso.rst_sent),
+            ("RST_RCVD", &qso.rst_rcvd),
+            ("GRIDSQUARE", &qso.gridsquare),
+            ("NAME", &qso.name),
+            ("QTH", &qso.qth),
+            ("COMMENT", &qso.comment),
+            ("STATION_CALLSIGN", &qso.station_callsign),
+            ("OPERATOR", &qso.operator),
+            ("MY_GRIDSQUARE", &qso.my_gridsquare),
+            ("MY_RIG", &qso.my_rig),
+            ("CONTEST_ID", &qso.contest_id),
+            ("STX_STRING", &qso.stx_string),
+            ("SRX_STRING", &qso.srx_string),
+            ("QSL_SENT", &qso.qsl_sent),
+            ("QSL_RCVD", &qso.qsl_rcvd),
+            ("LOTW_QSL_SENT", &qso.lotw_qsl_sent),
+            ("LOTW_QSL_RCVD", &qso.lotw_qsl_rcvd),
+            ("EQSL_QSL_SENT", &qso.eqsl_qsl_sent),
+            ("EQSL_QSL_RCVD", &qso.eqsl_qsl_rcvd),
+        ] {
+            if let Some(value) = value {
+                write_field(&mut out, name, value);
+            }
+        }
+        for (name, value) in [
+            ("STX", qso.stx),
+            ("SRX", qso.srx),
+            ("CQZ", qso.cqz.map(u32::from)),
+            ("ITUZ", qso.ituz.map(u32::from)),
+        ] {
+            if let Some(value) = value {
+                write_field(&mut out, name, &value.to_string());
+            }
+        }
+        if let Some(power) = qso.tx_pwr_w {
+            write_field(&mut out, "TX_PWR", &format!("{power}"));
+        }
+        // Whatever another logger wrote and this one does not model leaves as
+        // it arrived.
+        for (name, value) in &qso.extra {
+            write_field(&mut out, name, value);
+        }
+        out.push_str("<EOR>\n");
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn a_written_log_reads_back_the_same() {
+        let mut qso = Qso::new(
+            "id-1".into(),
+            parse_adif_datetime("20260807", Some("121530")).expect("time"),
+            "sp2sjg",
+            14_074_000,
+            "FT8",
+        );
+        qso.rst_sent = Some("-07".into());
+        qso.rst_rcvd = Some("-12".into());
+        qso.gridsquare = Some("JO94".into());
+        qso.station_callsign = Some("SP0TRX".into());
+        qso.operator = Some("SP0TRX".into());
+        qso.my_gridsquare = Some("JO91".into());
+        qso.my_rig = Some("Shack SDR".into());
+
+        let text = write_adi(&[qso.clone()], "0.1.0");
+        let report = parse_adi(text.as_bytes());
+        assert!(report.rejected.is_empty(), "{:?}", report.rejected);
+        assert_eq!(report.qsos.len(), 1);
+        let back = &report.qsos[0];
+
+        assert_eq!(back.call, "SP2SJG");
+        assert_eq!(back.freq_hz, qso.freq_hz);
+        assert_eq!(back.mode, "FT8");
+        assert_eq!(back.started_at, qso.started_at);
+        assert_eq!(back.rst_sent, qso.rst_sent);
+        assert_eq!(back.gridsquare, qso.gridsquare);
+        assert_eq!(back.my_rig, qso.my_rig);
+    }
+
+    /// Files from other loggers are irregular in ways that are not errors.
+    #[test]
+    fn a_file_from_another_logger_is_read_as_it_comes() {
+        let text = concat!(
+            "Generated by SomeLogger 4.2\r\n",
+            "<adif_ver:5>3.1.0<programid:10>SomeLogger<eoh>\r\n",
+            // lowercase tags, CRLF, a type indicator, no seconds on the time
+            "<call:6>W1AW/4<qso_date:8>20260101<time_on:4>1200<band:3>20m",
+            "<mode:3>SSB<rst_sent:2>59<rst_rcvd:2>59<my_antenna:6>Dipole<eor>\r\n",
+            // a record with the fields in another order and a full frequency
+            "<qso_date:8>20260102<time_on:6>235959<call:5>DL1AB<freq:6>7.0301",
+            "<mode:2>CW<eor>\r\n",
+        );
+        let report = parse_adi(text.as_bytes());
+        assert!(report.rejected.is_empty(), "{:?}", report.rejected);
+        assert_eq!(report.qsos.len(), 2);
+
+        let first = &report.qsos[0];
+        assert_eq!(first.call, "W1AW/4");
+        assert_eq!(first.mode, "SSB");
+        // No FREQ, so the band gives the frequency, and the band comes back.
+        assert_eq!(first.band(), Some("20m"));
+        // A field we do not model is kept, and comes back out on export.
+        assert_eq!(
+            first.extra.get("MY_ANTENNA").map(String::as_str),
+            Some("Dipole")
+        );
+        let exported = write_adi(&report.qsos, "0.1.0");
+        assert!(exported.contains("<MY_ANTENNA:6>Dipole"), "{exported}");
+
+        let second = &report.qsos[1];
+        assert_eq!(second.call, "DL1AB");
+        assert_eq!(second.freq_hz, 7_030_100);
+        assert_eq!(adif_time(&second.started_at), "235959");
+    }
+
+    #[test]
+    fn a_record_that_cannot_be_a_qso_is_reported_and_the_rest_still_read() {
+        let text = concat!(
+            "<call:5>NOCAL<eor>",                                  // no date
+            "<qso_date:8>20260101<time_on:4>1200<mode:3>SSB<eor>", // no call
+            "<call:5>SP1AB<qso_date:8>20260101<time_on:4>1200<freq:6>14.074<mode:3>FT8<eor>",
+        );
+        let report = parse_adi(text.as_bytes());
+        assert_eq!(report.qsos.len(), 1);
+        assert_eq!(report.qsos[0].call, "SP1AB");
+        assert_eq!(report.rejected.len(), 2);
+        assert!(
+            report.rejected[0].contains("QSO_DATE"),
+            "{:?}",
+            report.rejected
+        );
+        assert!(report.rejected[1].contains("CALL"), "{:?}", report.rejected);
+    }
+
+    /// The declared length is the length, even when the value looks longer:
+    /// ADIF values may contain `<`, so the count is the only thing that can be
+    /// trusted to end them.
+    #[test]
+    fn the_declared_length_wins_over_what_the_value_looks_like() {
+        let text = "<call:5>SP1AB<qso_date:8>20260101<time_on:4>1200<freq:6>14.074<mode:3>FT8\
+                    <comment:11>see <notes><eor>";
+        let report = parse_adi(text.as_bytes());
+        assert_eq!(report.qsos.len(), 1);
+        assert_eq!(report.qsos[0].comment.as_deref(), Some("see <notes>"));
+    }
+
+    #[test]
+    fn a_truncated_file_gives_up_what_it_has() {
+        // The length says 20 bytes of callsign; the file ends after five.
+        let text = "<call:20>SP1AB";
+        let report = parse_adi(text.as_bytes());
+        // No date, so it is rejected -- but the parser returned rather than
+        // running off the end or looping.
+        assert_eq!(report.qsos.len(), 0);
+        assert_eq!(report.rejected.len(), 1);
+    }
+
+    #[test]
+    fn a_file_with_no_header_is_still_a_file() {
+        let text = "<call:5>SP1AB<qso_date:8>20260101<time_on:4>1200<freq:6>14.074<mode:3>FT8<eor>";
+        let report = parse_adi(text.as_bytes());
+        assert_eq!(report.qsos.len(), 1);
+    }
+}
@@ -0,0 +1,304 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Cabrillo 3.0, the format contest logs are submitted in.
+//!
+//! ADIF cannot do this job: sponsors take Cabrillo and reject everything else.
+//! It is export-only and narrower on purpose — a header naming the entrant and
+//! the category, then one fixed-shape `QSO:` line per contact carrying the
+//! frequency, the mode, the time, and both stations' calls, reports and
+//! exchanges. Everything a log holds beyond that is left behind, which is why
+//! this complements ADIF rather than replacing it.
+
+use serde::Deserialize;
+
+use crate::qso::Qso;
+
+/// The header of a contest entry.
+///
+/// Sponsors want the entrant's own answers here — how many operators, how much
+/// power, which bands — and no log can work them out for itself, so they come
+/// from the operator with sane defaults behind them.
+#[derive(Debug, Clone, Deserialize)]
+pub struct CabrilloHeader {
+    /// The contest's Cabrillo name, e.g. `CQ-WW-SSB`.
+    #[serde(default)]
+    pub contest: Option<String>,
+    /// The callsign the entry is submitted under.
+    #[serde(default)]
+    pub callsign: Option<String>,
+    #[serde(default)]
+    pub category_operator: Option<String>,
+    #[serde(default)]
+    pub category_power: Option<String>,
+    #[serde(default)]
+    pub category_band: Option<String>,
+    #[serde(default)]
+    pub category_mode: Option<String>,
+    #[serde(default)]
+    pub claimed_score: Option<u64>,
+    #[serde(default)]
+    pub operators: Option<String>,
+    #[serde(default)]
+    pub name: Option<String>,
+    #[serde(default)]
+    pub email: Option<String>,
+    #[serde(default)]
+    pub soapbox: Option<String>,
+}
+
+impl Default for CabrilloHeader {
+    fn default() -> Self {
+        Self {
+            contest: None,
+            callsign: None,
+            category_operator: Some("SINGLE-OP".to_string()),
+            category_power: Some("LOW".to_string()),
+            category_band: Some("ALL".to_string()),
+            category_mode: Some("MIXED".to_string()),
+            claimed_score: None,
+            operators: None,
+            name: None,
+            email: None,
+            soapbox: None,
+        }
+    }
+}
+
+/// The mode letters Cabrillo uses, which are not ADIF's names.
+fn cabrillo_mode(qso: &Qso) -> &'static str {
+    match qso.mode.trim().to_uppercase().as_str() {
+        "CW" | "CWR" => "CW",
+        "SSB" | "USB" | "LSB" | "AM" | "FM" | "SAM" | "WFM" | "PHONE" => {
+            // FM has a letter of its own; the rest of phone is PH.
+            if matches!(qso.mode.trim().to_uppercase().as_str(), "FM" | "WFM") {
+                "FM"
+            } else {
+                "PH"
+            }
+        }
+        "RTTY" => "RY",
+        _ => "DG",
+    }
+}
+
+/// Band designators above 30 MHz, where Cabrillo names the band rather than
+/// the frequency.
+const VHF_DESIGNATORS: &[(u64, u64, &str)] = &[
+    (50_000_000, 54_000_000, "50"),
+    (70_000_000, 71_000_000, "70"),
+    (144_000_000, 148_000_000, "144"),
+    (222_000_000, 225_000_000, "222"),
+    (420_000_000, 450_000_000, "432"),
+    (902_000_000, 928_000_000, "902"),
+    (1_240_000_000, 1_300_000_000, "1.2G"),
+    (2_300_000_000, 2_450_000_000, "2.3G"),
+    (3_300_000_000, 3_500_000_000, "3.4G"),
+    (5_650_000_000, 5_925_000_000, "5.7G"),
+    (10_000_000_000, 10_500_000_000, "10G"),
+];
+
+/// The frequency field: kilohertz below 30 MHz, a band designator above it.
+fn cabrillo_frequency(hz: u64) -> String {
+    if hz < 30_000_000 {
+        return (hz / 1000).to_string();
+    }
+    VHF_DESIGNATORS
+        .iter()
+        .find(|(low, high, _)| hz >= *low && hz <= *high)
+        .map_or_else(
+            || (hz / 1000).to_string(),
+            |(_, _, name)| (*name).to_string(),
+        )
+}
+
+fn header_line(out: &mut String, key: &str, value: Option<&str>) {
+    if let Some(value) = value {
+        let value = value.trim();
+        if !value.is_empty() {
+            out.push_str(&format!("{key}: {value}\n"));
+        }
+    }
+}
+
+/// Write a Cabrillo 3.0 entry for `qsos`.
+///
+/// The caller decides which contacts belong to the entry; this writes what it
+/// is given, in the order it is given, oldest first as sponsors expect.
+pub fn write_cabrillo(qsos: &[Qso], header: &CabrilloHeader) -> String {
+    let mut out = String::with_capacity(qsos.len() * 96 + 512);
+    out.push_str("START-OF-LOG: 3.0\n");
+    header_line(&mut out, "CREATED-BY", Some("trx-rs"));
+    header_line(&mut out, "CONTEST", header.contest.as_deref());
+    header_line(&mut out, "CALLSIGN", header.callsign.as_deref());
+    header_line(
+        &mut out,
+        "CATEGORY-OPERATOR",
+        header.category_operator.as_deref(),
+    );
+    header_line(&mut out, "CATEGORY-BAND", header.category_band.as_deref());
+    header_line(&mut out, "CATEGORY-MODE", header.category_mode.as_deref());
+    header_line(&mut out, "CATEGORY-POWER", header.category_power.as_deref());
+    if let Some(score) = header.claimed_score {
+        header_line(&mut out, "CLAIMED-SCORE", Some(&score.to_string()));
+    }
+    header_line(&mut out, "OPERATORS", header.operators.as_deref());
+    header_line(&mut out, "NAME", header.name.as_deref());
+    header_line(&mut out, "EMAIL", header.email.as_deref());
+    header_line(&mut out, "SOAPBOX", header.soapbox.as_deref());
+
+    // Oldest first: a contest log is read as it was worked.
+    let mut ordered: Vec<&Qso> = qsos.iter().collect();
+    ordered.sort_by_key(|qso| qso.started_at);
+
+    let station = header
+        .callsign
+        .clone()
+        .or_else(|| qsos.first().and_then(|qso| qso.station_callsign.clone()))
+        .unwrap_or_else(|| "UNKNOWN".to_string());
+
+    for qso in ordered {
+        let sent = qso.exchange_sent().unwrap_or_default();
+        let received = qso.exchange_received().unwrap_or_default();
+        out.push_str(&format!(
+            "QSO: {freq:>5} {mode:2} {date} {time} {mine:<13} {rst_sent:>3} {exch_sent:<6} {theirs:<13} {rst_rcvd:>3} {exch_rcvd:<6}\n",
+            freq = cabrillo_frequency(qso.freq_hz),
+            mode = cabrillo_mode(qso),
+            date = qso.started_at.format("%Y-%m-%d"),
+            time = qso.started_at.format("%H%M"),
+            mine = qso.station_callsign.as_deref().unwrap_or(&station),
+            rst_sent = qso.rst_sent.as_deref().unwrap_or(""),
+            exch_sent = sent,
+            theirs = qso.call,
+            rst_rcvd = qso.rst_rcvd.as_deref().unwrap_or(""),
+            exch_rcvd = received,
+        ));
+    }
+    out.push_str("END-OF-LOG:\n");
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn contest_qso(call: &str, hz: u64, mode: &str, time: &str, sent: u32, rcvd: u32) -> Qso {
+        let mut qso = Qso::new(
+            format!("{call}-{time}"),
+            parse_adif_datetime("20260807", Some(time)).expect("time"),
+            call,
+            hz,
+            mode,
+        );
+        qso.station_callsign = Some("SP0TRX".into());
+        qso.rst_sent = Some("59".into());
+        qso.rst_rcvd = Some("59".into());
+        qso.stx = Some(sent);
+        qso.srx = Some(rcvd);
+        qso.contest_id = Some("CQ-WW-SSB".into());
+        qso
+    }
+
+    #[test]
+    fn an_entry_has_the_header_a_sponsor_expects() {
+        let header = CabrilloHeader {
+            contest: Some("CQ-WW-SSB".into()),
+            callsign: Some("SP0TRX".into()),
+            claimed_score: Some(1234),
+            ..CabrilloHeader::default()
+        };
+        let text = write_cabrillo(
+            &[contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 42)],
+            &header,
+        );
+        assert!(text.starts_with("START-OF-LOG: 3.0\n"), "{text}");
+        assert!(text.contains("CONTEST: CQ-WW-SSB\n"), "{text}");
+        assert!(text.contains("CALLSIGN: SP0TRX\n"), "{text}");
+        assert!(text.contains("CATEGORY-OPERATOR: SINGLE-OP\n"), "{text}");
+        assert!(text.contains("CLAIMED-SCORE: 1234\n"), "{text}");
+        assert!(text.trim_end().ends_with("END-OF-LOG:"), "{text}");
+        // A header field nobody filled in is left out, not written empty.
+        assert!(!text.contains("SOAPBOX:"), "{text}");
+    }
+
+    #[test]
+    fn a_qso_line_carries_both_sides_of_the_exchange() {
+        let text = write_cabrillo(
+            &[contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 42)],
+            &CabrilloHeader::default(),
+        );
+        let line = text
+            .lines()
+            .find(|line| line.starts_with("QSO:"))
+            .expect("a QSO line");
+        // Frequency in kHz on HF, the phone mode letter, the date and UTC time,
+        // then mine, my report and my serial, then theirs.
+        assert!(line.contains("14200"), "{line}");
+        assert!(line.contains(" PH "), "{line}");
+        assert!(line.contains("2026-08-07 1200"), "{line}");
+        assert!(line.contains("SP0TRX"), "{line}");
+        assert!(line.contains("DL1AB"), "{line}");
+        assert!(line.contains("001"), "{line}");
+        assert!(line.contains("042"), "{line}");
+    }
+
+    /// Above 30 MHz Cabrillo names the band rather than the frequency.
+    #[test]
+    fn vhf_and_up_are_written_as_band_designators() {
+        assert_eq!(cabrillo_frequency(14_200_000), "14200");
+        assert_eq!(cabrillo_frequency(7_030_000), "7030");
+        assert_eq!(cabrillo_frequency(144_300_000), "144");
+        assert_eq!(cabrillo_frequency(432_100_000), "432");
+        assert_eq!(cabrillo_frequency(1_296_000_000), "1.2G");
+        assert_eq!(cabrillo_frequency(50_313_000), "50");
+    }
+
+    #[test]
+    fn the_mode_letters_are_cabrillos_not_adifs() {
+        let cw = contest_qso("DL1AB", 7_030_000, "CW", "120000", 1, 1);
+        let phone = contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 1);
+        let fm = contest_qso("DL1AB", 145_500_000, "FM", "120000", 1, 1);
+        let digital = contest_qso("DL1AB", 14_074_000, "FT8", "120000", 1, 1);
+        assert_eq!(cabrillo_mode(&cw), "CW");
+        assert_eq!(cabrillo_mode(&phone), "PH");
+        assert_eq!(cabrillo_mode(&fm), "FM");
+        assert_eq!(cabrillo_mode(&digital), "DG");
+    }
+
+    #[test]
+    fn contacts_are_written_oldest_first_however_they_arrive() {
+        let text = write_cabrillo(
+            &[
+                contest_qso("LATER", 14_200_000, "SSB", "130000", 2, 2),
+                contest_qso("EARLIER", 14_200_000, "SSB", "120000", 1, 1),
+            ],
+            &CabrilloHeader::default(),
+        );
+        let calls: Vec<&str> = text
+            .lines()
+            .filter(|line| line.starts_with("QSO:"))
+            .map(|line| {
+                if line.contains("EARLIER") {
+                    "EARLIER"
+                } else {
+                    "LATER"
+                }
+            })
+            .collect();
+        assert_eq!(calls, vec!["EARLIER", "LATER"]);
+    }
+
+    /// A word exchange -- a zone, a section, a name -- rather than a serial.
+    #[test]
+    fn an_exchange_that_is_not_a_number_is_written_as_it_was() {
+        let mut qso = contest_qso("DL1AB", 14_200_000, "SSB", "120000", 1, 1);
+        qso.stx_string = Some("14".into());
+        qso.srx_string = Some("BAVARIA".into());
+        let text = write_cabrillo(&[qso], &CabrilloHeader::default());
+        let line = text.lines().find(|l| l.starts_with("QSO:")).expect("line");
+        assert!(line.contains("BAVARIA"), "{line}");
+        assert!(!line.contains("001"), "{line}");
+    }
+}
@@ -0,0 +1,191 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Telling one contact from two.
+//!
+//! Two programs rarely stamp the same QSO to the same minute — one records when
+//! the contact started, another when the operator finished typing — so matching
+//! on an exact time duplicates half of what an import is asked to merge. The
+//! key is therefore the callsign, the band and the mode, with the time compared
+//! as a window.
+//!
+//! Two minutes is the window. It is wide enough for the disagreement between
+//! loggers and narrow enough to keep a legitimate re-work: contest rules forbid
+//! a second contact with the same station on the same band and mode, so a
+//! repeat inside two minutes is the same contact written twice, while the same
+//! station on another band an hour later is a different QSO and keys differently
+//! anyway.
+
+use std::collections::HashMap;
+
+use chrono::Duration;
+
+use crate::qso::Qso;
+
+/// How far apart two records of the same contact may be stamped.
+pub const MATCH_WINDOW_MINUTES: i64 = 2;
+
+/// Modes as they are compared, not as they are written.
+///
+/// A log that stored `USB` and one that stored `SSB` describe the same contact;
+/// without this an import from either would duplicate every phone QSO in the
+/// other.
+fn normalized_mode(qso: &Qso) -> String {
+    match qso.mode.trim().to_uppercase().as_str() {
+        "USB" | "LSB" | "SSB" => "SSB".to_string(),
+        "CWR" => "CW".to_string(),
+        "SAM" => "AM".to_string(),
+        "WFM" => "FM".to_string(),
+        other => other.to_string(),
+    }
+}
+
+fn key(qso: &Qso) -> (String, String, String) {
+    (
+        qso.call.clone(),
+        qso.band().unwrap_or("").to_string(),
+        normalized_mode(qso),
+    )
+}
+
+/// An index over an existing log, for asking whether an incoming record is
+/// already held.
+pub struct DuplicateIndex {
+    by_key: HashMap<(String, String, String), Vec<chrono::DateTime<chrono::Utc>>>,
+}
+
+impl DuplicateIndex {
+    pub fn build(existing: &[Qso]) -> Self {
+        let mut by_key: HashMap<_, Vec<_>> = HashMap::new();
+        for qso in existing {
+            by_key.entry(key(qso)).or_default().push(qso.started_at);
+        }
+        Self { by_key }
+    }
+
+    /// Whether this contact is already in the log.
+    pub fn contains(&self, candidate: &Qso) -> bool {
+        let window = Duration::minutes(MATCH_WINDOW_MINUTES);
+        self.by_key.get(&key(candidate)).is_some_and(|times| {
+            times
+                .iter()
+                // Compared as instants, so a contact either side of
+                // midnight matches rather than falling into two days.
+                .any(|held| (*held - candidate.started_at).abs() <= window)
+        })
+    }
+
+    /// Remember a contact, so a file that repeats itself does not import twice.
+    pub fn insert(&mut self, qso: &Qso) {
+        self.by_key
+            .entry(key(qso))
+            .or_default()
+            .push(qso.started_at);
+    }
+}
+
+/// Which bands and modes a callsign has been worked on.
+pub fn worked_before(existing: &[Qso], call: &str) -> Vec<(String, String)> {
+    let wanted = crate::qso::normalize_call(call);
+    let mut seen: Vec<(String, String)> = existing
+        .iter()
+        .filter(|qso| qso.call == wanted)
+        .map(|qso| (qso.band().unwrap_or("").to_string(), normalized_mode(qso)))
+        .collect();
+    seen.sort();
+    seen.dedup();
+    seen
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn qso(call: &str, hz: u64, mode: &str, time: &str) -> Qso {
+        Qso::new(
+            format!("{call}-{time}"),
+            parse_adif_datetime("20260807", Some(time)).expect("time"),
+            call,
+            hz,
+            mode,
+        )
+    }
+
+    #[test]
+    fn the_same_contact_stamped_a_minute_apart_is_one_contact() {
+        let held = vec![qso("SP1AA", 14_074_000, "FT8", "120000")];
+        let index = DuplicateIndex::build(&held);
+        assert!(index.contains(&qso("SP1AA", 14_074_000, "FT8", "120100")));
+        assert!(index.contains(&qso("SP1AA", 14_074_000, "FT8", "115900")));
+        // Beyond the window it is another contact.
+        assert!(!index.contains(&qso("SP1AA", 14_074_000, "FT8", "120300")));
+    }
+
+    #[test]
+    fn phone_matches_however_the_other_logger_spelled_it() {
+        let held = vec![qso("SP1AA", 14_200_000, "SSB", "120000")];
+        let index = DuplicateIndex::build(&held);
+        assert!(index.contains(&qso("SP1AA", 14_200_000, "USB", "120000")));
+        assert!(index.contains(&qso("SP1AA", 14_200_000, "LSB", "120030")));
+    }
+
+    #[test]
+    fn another_band_or_another_mode_is_another_contact() {
+        let held = vec![qso("SP1AA", 14_074_000, "FT8", "120000")];
+        let index = DuplicateIndex::build(&held);
+        // Same station, same minute, 40 m: a band change during a QSO happens.
+        assert!(!index.contains(&qso("SP1AA", 7_074_000, "FT8", "120000")));
+        assert!(!index.contains(&qso("SP1AA", 14_074_000, "CW", "120000")));
+        assert!(!index.contains(&qso("SP2BB", 14_074_000, "FT8", "120000")));
+    }
+
+    #[test]
+    fn a_contact_either_side_of_midnight_still_matches() {
+        let before = Qso::new(
+            "1".into(),
+            parse_adif_datetime("20260807", Some("235930")).expect("time"),
+            "SP1AA",
+            14_074_000,
+            "FT8",
+        );
+        let after = Qso::new(
+            "2".into(),
+            parse_adif_datetime("20260808", Some("000030")).expect("time"),
+            "SP1AA",
+            14_074_000,
+            "FT8",
+        );
+        let index = DuplicateIndex::build(&[before]);
+        assert!(index.contains(&after));
+    }
+
+    #[test]
+    fn a_file_that_repeats_itself_imports_once() {
+        let mut index = DuplicateIndex::build(&[]);
+        let first = qso("SP1AA", 14_074_000, "FT8", "120000");
+        assert!(!index.contains(&first));
+        index.insert(&first);
+        assert!(index.contains(&qso("SP1AA", 14_074_000, "FT8", "120030")));
+    }
+
+    #[test]
+    fn worked_before_answers_by_band_and_mode() {
+        let held = vec![
+            qso("SP1AA", 14_074_000, "FT8", "120000"),
+            qso("SP1AA", 7_030_000, "CW", "130000"),
+            qso("SP1AA", 14_074_000, "FT8", "140000"),
+            qso("SP2BB", 14_200_000, "USB", "150000"),
+        ];
+        let worked = worked_before(&held, "sp1aa");
+        assert_eq!(
+            worked,
+            vec![
+                ("20m".to_string(), "FT8".to_string()),
+                ("40m".to_string(), "CW".to_string()),
+            ]
+        );
+        assert!(worked_before(&held, "SP9ZZ").is_empty());
+    }
+}
@@ -0,0 +1,510 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! The station logbook: contacts, the file they live in, and ADIF in and out.
+//!
+//! One log per station rather than one per rig. Awards and uploads count the
+//! callsign, not the radio — a station worked on the second rig is still worked
+//! — so the rig is recorded on the contact instead of dividing the log by it.
+//! Where a rig stands does follow the contact, though: `my_gridsquare` comes
+//! from the rig that made it, because rigs can be in different places.
+
+pub mod adif;
+pub mod cabrillo;
+pub mod dedupe;
+pub mod qso;
+pub mod store;
+
+use std::path::PathBuf;
+use std::sync::{Arc, Mutex};
+
+use chrono::{DateTime, Utc};
+use serde::{Deserialize, Serialize};
+
+pub use cabrillo::{write_cabrillo, CabrilloHeader};
+pub use dedupe::{worked_before, DuplicateIndex, MATCH_WINDOW_MINUTES};
+pub use qso::Qso;
+pub use store::LogStore;
+
+/// A fresh contact identity.
+pub fn new_id() -> String {
+    uuid::Uuid::new_v4().to_string()
+}
+
+/// Where the log lives when the configuration does not say.
+///
+/// The data directory, not the config directory the bookmarks use and not the
+/// cache directory the decode logs use: a log is neither a setting nor
+/// disposable, and cache directories get swept by cleaners.
+pub fn default_log_path() -> PathBuf {
+    dirs::data_dir()
+        .map(|dir| dir.join("trx-rs").join("logbook.jsonl"))
+        .unwrap_or_else(|| PathBuf::from("logbook.jsonl"))
+}
+
+/// What a filtered read asks for.
+#[derive(Debug, Default, Clone, Deserialize)]
+pub struct LogQuery {
+    /// Substring of the callsign, case-insensitive.
+    #[serde(default)]
+    pub call: Option<String>,
+    /// Only contacts in this contest.
+    #[serde(default)]
+    pub contest: Option<String>,
+    /// Only contacts the other station has confirmed, or only those they have
+    /// not.
+    #[serde(default)]
+    pub confirmed: Option<bool>,
+    #[serde(default)]
+    pub band: Option<String>,
+    #[serde(default)]
+    pub mode: Option<String>,
+    /// Inclusive bounds on the contact's time.
+    #[serde(default)]
+    pub from: Option<DateTime<Utc>>,
+    #[serde(default)]
+    pub to: Option<DateTime<Utc>>,
+    #[serde(default)]
+    pub limit: Option<usize>,
+    #[serde(default)]
+    pub offset: Option<usize>,
+}
+
+/// One band's worth of the log.
+#[derive(Debug, Clone, Serialize)]
+pub struct BandStatistics {
+    pub band: String,
+    pub contacts: usize,
+    /// Distinct callsigns, which is the number an award counts.
+    pub stations: usize,
+    pub confirmed: usize,
+}
+
+/// What an import did.
+#[derive(Debug, Default, Clone, Serialize)]
+pub struct ImportOutcome {
+    pub added: usize,
+    /// Already held, by callsign, band, mode and the two-minute window.
+    pub duplicate: usize,
+    /// Records that could not be read as contacts, with the reason.
+    pub rejected: Vec<String>,
+}
+
+/// The logbook, shared by whoever serves it.
+#[derive(Clone)]
+pub struct Logbook {
+    store: Arc<Mutex<LogStore>>,
+}
+
+impl Logbook {
+    pub fn open(path: &std::path::Path) -> std::io::Result<Self> {
+        Ok(Self {
+            store: Arc::new(Mutex::new(LogStore::open(path)?)),
+        })
+    }
+
+    fn with_store<T>(&self, f: impl FnOnce(&mut LogStore) -> T) -> T {
+        // A poisoned lock means a panic while holding it, not a corrupt log --
+        // the file is on disk either way -- so carry on with what is there.
+        let mut store = self.store.lock().unwrap_or_else(|e| e.into_inner());
+        f(&mut store)
+    }
+
+    pub fn path(&self) -> PathBuf {
+        self.with_store(|store| store.path().to_path_buf())
+    }
+
+    pub fn count(&self) -> usize {
+        self.with_store(|store| store.len())
+    }
+
+    /// Contacts matching `query`, newest first.
+    pub fn query(&self, query: &LogQuery) -> Vec<Qso> {
+        self.with_store(|store| {
+            let call = query.call.as_deref().map(str::to_uppercase);
+            let band = query.band.as_deref().map(str::to_lowercase);
+            let mode = query.mode.as_deref().map(str::to_uppercase);
+            let contest = query.contest.clone();
+            let matching: Vec<Qso> = store
+                .all()
+                .into_iter()
+                .filter(|qso| {
+                    call.as_ref().is_none_or(|c| qso.call.contains(c.as_str()))
+                        && band
+                            .as_ref()
+                            .is_none_or(|b| qso.band().is_some_and(|found| found == b))
+                        && mode.as_ref().is_none_or(|m| qso.mode == *m)
+                        && query.from.is_none_or(|from| qso.started_at >= from)
+                        && query.to.is_none_or(|to| qso.started_at <= to)
+                        && contest.as_ref().is_none_or(|wanted| {
+                            qso.contest_id
+                                .as_deref()
+                                .is_some_and(|held| held.eq_ignore_ascii_case(wanted))
+                        })
+                        && query
+                            .confirmed
+                            .is_none_or(|wanted| qso.is_confirmed() == wanted)
+                })
+                .collect();
+            let offset = query.offset.unwrap_or(0).min(matching.len());
+            let end = query
+                .limit
+                .map_or(matching.len(), |limit| (offset + limit).min(matching.len()));
+            matching[offset..end].to_vec()
+        })
+    }
+
+    pub fn get(&self, id: &str) -> Option<Qso> {
+        self.with_store(|store| store.get(id).cloned())
+    }
+
+    /// Add a contact, or replace one with the same id.
+    pub fn put(&self, qso: Qso) -> std::io::Result<Qso> {
+        self.with_store(|store| store.put(qso.clone()))?;
+        Ok(qso)
+    }
+
+    pub fn delete(&self, id: &str) -> std::io::Result<bool> {
+        self.with_store(|store| store.delete(id))
+    }
+
+    /// Which bands and modes a callsign has been worked on.
+    pub fn worked_before(&self, call: &str) -> Vec<(String, String)> {
+        self.with_store(|store| dedupe::worked_before(&store.all(), call))
+    }
+
+    /// Export as Cabrillo, for submitting a contest entry.
+    pub fn export_cabrillo(&self, query: &LogQuery, header: &CabrilloHeader) -> String {
+        cabrillo::write_cabrillo(&self.query(query), header)
+    }
+
+    /// What has been worked, and what has been confirmed, band by band.
+    ///
+    /// One confirmation counts wherever it came from: an award wants a card or
+    /// an electronic match, not one of each.
+    pub fn band_statistics(&self) -> Vec<BandStatistics> {
+        self.with_store(|store| {
+            let mut by_band: std::collections::HashMap<String, BandStatistics> =
+                std::collections::HashMap::new();
+            let mut stations: std::collections::HashMap<String, std::collections::HashSet<String>> =
+                std::collections::HashMap::new();
+            for qso in store.all() {
+                let band = qso.band().unwrap_or("other").to_string();
+                let entry = by_band
+                    .entry(band.clone())
+                    .or_insert_with(|| BandStatistics {
+                        band: band.clone(),
+                        contacts: 0,
+                        stations: 0,
+                        confirmed: 0,
+                    });
+                entry.contacts += 1;
+                if qso.is_confirmed() {
+                    entry.confirmed += 1;
+                }
+                stations.entry(band).or_default().insert(qso.call.clone());
+            }
+            let mut all: Vec<BandStatistics> = by_band
+                .into_values()
+                .map(|mut entry| {
+                    entry.stations = stations
+                        .get(&entry.band)
+                        .map_or(0, std::collections::HashSet::len);
+                    entry
+                })
+                .collect();
+            // Ordered by wavelength, longest first, as a band plan reads.
+            all.sort_by_key(|entry| qso::band_order(&entry.band));
+            all
+        })
+    }
+
+    /// Export as ADIF, honouring the same filters as a read.
+    pub fn export_adi(&self, query: &LogQuery, program_version: &str) -> String {
+        adif::write_adi(&self.query(query), program_version)
+    }
+
+    /// Import an ADIF file, skipping contacts already held.
+    pub fn import_adi(&self, input: &[u8]) -> std::io::Result<ImportOutcome> {
+        let report = adif::parse_adi(input);
+        let mut outcome = ImportOutcome {
+            rejected: report.rejected,
+            ..ImportOutcome::default()
+        };
+        self.with_store(|store| {
+            let mut index = DuplicateIndex::build(&store.all());
+            let mut fresh = Vec::new();
+            for qso in report.qsos {
+                if index.contains(&qso) {
+                    outcome.duplicate += 1;
+                    continue;
+                }
+                index.insert(&qso);
+                fresh.push(qso);
+            }
+            outcome.added = fresh.len();
+            store.put_all(fresh)
+        })?;
+        Ok(outcome)
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn new_book() -> (tempfile::TempDir, Logbook) {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let book = Logbook::open(&dir.path().join("logbook.jsonl")).expect("open");
+        (dir, book)
+    }
+
+    fn qso(call: &str, hz: u64, mode: &str, time: &str) -> Qso {
+        Qso::new(
+            new_id(),
+            parse_adif_datetime("20260807", Some(time)).expect("time"),
+            call,
+            hz,
+            mode,
+        )
+    }
+
+    #[test]
+    fn a_log_answers_the_filters_it_is_asked() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+        book.put(qso("SP2BB", 7_030_000, "CW", "130000"))
+            .expect("put");
+        book.put(qso("DL3CC", 14_200_000, "SSB", "140000"))
+            .expect("put");
+
+        assert_eq!(book.count(), 3);
+        assert_eq!(book.query(&LogQuery::default()).len(), 3);
+        // Newest first.
+        assert_eq!(book.query(&LogQuery::default())[0].call, "DL3CC");
+
+        let by_band = LogQuery {
+            band: Some("20m".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&by_band).len(), 2);
+
+        let by_call = LogQuery {
+            call: Some("sp".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&by_call).len(), 2);
+
+        let by_mode = LogQuery {
+            mode: Some("cw".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&by_mode)[0].call, "SP2BB");
+
+        let paged = LogQuery {
+            limit: Some(1),
+            offset: Some(1),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&paged).len(), 1);
+        // Newest first, so offset 1 is the middle contact.
+        assert_eq!(book.query(&paged)[0].call, "SP2BB");
+    }
+
+    #[test]
+    fn an_import_skips_what_is_already_held_and_says_so() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+
+        let file = concat!(
+            // the one already held, a minute out, as another logger stamped it
+            "<call:5>SP1AA<qso_date:8>20260807<time_on:6>120100<freq:6>14.074<mode:3>FT8<eor>\n",
+            // a new one
+            "<call:5>DL2XY<qso_date:8>20260807<time_on:6>121500<freq:6>14.074<mode:3>FT8<eor>\n",
+            // and something that is not a contact
+            "<call:5>NODAT<eor>\n",
+        );
+        let outcome = book.import_adi(file.as_bytes()).expect("import");
+        assert_eq!(outcome.added, 1);
+        assert_eq!(outcome.duplicate, 1);
+        assert_eq!(outcome.rejected.len(), 1);
+        assert_eq!(book.count(), 2);
+
+        // And importing the same file again adds nothing.
+        let again = book.import_adi(file.as_bytes()).expect("import again");
+        assert_eq!(again.added, 0);
+        assert_eq!(again.duplicate, 2);
+        assert_eq!(book.count(), 2);
+    }
+
+    #[test]
+    fn an_export_can_be_imported_into_an_empty_log() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+        book.put(qso("DL3CC", 14_200_000, "SSB", "140000"))
+            .expect("put");
+        let exported = book.export_adi(&LogQuery::default(), "0.1.0");
+
+        let (_other_dir, other) = new_book();
+        let outcome = other.import_adi(exported.as_bytes()).expect("import");
+        assert_eq!(outcome.added, 2);
+        assert_eq!(other.count(), 2);
+        assert_eq!(other.query(&LogQuery::default())[0].call, "DL3CC");
+    }
+
+    #[test]
+    fn worked_before_reads_through_the_log() {
+        let (_dir, book) = new_book();
+        book.put(qso("SP1AA", 14_074_000, "FT8", "120000"))
+            .expect("put");
+        book.put(qso("SP1AA", 7_030_000, "CW", "130000"))
+            .expect("put");
+        assert_eq!(book.worked_before("sp1aa").len(), 2);
+        assert!(book.worked_before("SP9ZZ").is_empty());
+    }
+
+    #[test]
+    fn statistics_count_stations_and_confirmations_band_by_band() {
+        let (_dir, book) = new_book();
+        let mut first = qso("SP1AA", 14_074_000, "FT8", "120000");
+        first.lotw_qsl_rcvd = Some("Y".into());
+        book.put(first).expect("put");
+        // The same station again on the same band: one station, two contacts.
+        book.put(qso("SP1AA", 14_100_000, "SSB", "121000"))
+            .expect("put");
+        let mut third = qso("DL2BB", 7_030_000, "CW", "130000");
+        third.qsl_rcvd = Some("Y".into());
+        book.put(third).expect("put");
+        book.put(qso("OZ3CC", 7_040_000, "CW", "131000"))
+            .expect("put");
+
+        let stats = book.band_statistics();
+        // Longest wavelength first, as a band plan reads.
+        assert_eq!(
+            stats.iter().map(|s| s.band.as_str()).collect::<Vec<_>>(),
+            vec!["40m", "20m"]
+        );
+        let forty = &stats[0];
+        assert_eq!((forty.contacts, forty.stations, forty.confirmed), (2, 2, 1));
+        let twenty = &stats[1];
+        assert_eq!(
+            (twenty.contacts, twenty.stations, twenty.confirmed),
+            (2, 1, 1)
+        );
+    }
+
+    #[test]
+    fn a_contest_entry_holds_only_that_contest() {
+        let (_dir, book) = new_book();
+        for (call, contest, serial) in [
+            ("SP1AA", Some("CQ-WW-SSB"), 1),
+            ("DL2BB", Some("CQ-WW-SSB"), 2),
+            ("OZ3CC", None, 0),
+        ] {
+            let mut entry = qso(call, 14_200_000, "SSB", "120000");
+            entry.contest_id = contest.map(str::to_string);
+            entry.stx = Some(serial);
+            entry.station_callsign = Some("SP0TRX".into());
+            entry.rst_sent = Some("59".into());
+            entry.rst_rcvd = Some("59".into());
+            book.put(entry).expect("put");
+        }
+        let query = LogQuery {
+            contest: Some("cq-ww-ssb".into()),
+            ..LogQuery::default()
+        };
+        assert_eq!(
+            book.query(&query).len(),
+            2,
+            "the contest filter is case-sensitive"
+        );
+
+        let text = book.export_cabrillo(
+            &query,
+            &CabrilloHeader {
+                contest: Some("CQ-WW-SSB".into()),
+                callsign: Some("SP0TRX".into()),
+                ..CabrilloHeader::default()
+            },
+        );
+        let lines: Vec<&str> = text
+            .lines()
+            .filter(|line| line.starts_with("QSO:"))
+            .collect();
+        assert_eq!(lines.len(), 2, "{text}");
+        assert!(
+            !text.contains("OZ3CC"),
+            "a contact outside the contest was submitted"
+        );
+    }
+
+    #[test]
+    fn confirmations_come_from_whichever_bureau_answered() {
+        let (_dir, book) = new_book();
+        let mut card = qso("SP1AA", 14_074_000, "FT8", "120000");
+        card.qsl_rcvd = Some("Y".into());
+        let mut lotw = qso("DL2BB", 14_074_000, "FT8", "121000");
+        lotw.lotw_qsl_rcvd = Some("Y".into());
+        let mut requested = qso("OZ3CC", 14_074_000, "FT8", "122000");
+        requested.qsl_rcvd = Some("R".into());
+        for entry in [card, lotw, requested] {
+            book.put(entry).expect("put");
+        }
+        let confirmed = LogQuery {
+            confirmed: Some(true),
+            ..LogQuery::default()
+        };
+        let calls: Vec<String> = book.query(&confirmed).into_iter().map(|q| q.call).collect();
+        assert_eq!(calls.len(), 2, "{calls:?}");
+        assert!(calls.contains(&"SP1AA".to_string()) && calls.contains(&"DL2BB".to_string()));
+        // Requested is not confirmed.
+        let outstanding = LogQuery {
+            confirmed: Some(false),
+            ..LogQuery::default()
+        };
+        assert_eq!(book.query(&outstanding)[0].call, "OZ3CC");
+    }
+
+    #[test]
+    fn the_contest_and_qsl_fields_survive_a_trip_through_adif() {
+        let (_dir, book) = new_book();
+        let mut entry = qso("SP1AA", 14_200_000, "SSB", "120000");
+        entry.contest_id = Some("CQ-WW-SSB".into());
+        entry.stx = Some(7);
+        entry.srx_string = Some("BAVARIA".into());
+        entry.cqz = Some(15);
+        entry.qsl_sent = Some("Y".into());
+        entry.lotw_qsl_rcvd = Some("Y".into());
+        book.put(entry).expect("put");
+
+        let exported = book.export_adi(&LogQuery::default(), "0.1.0");
+        let (_other_dir, other) = new_book();
+        other.import_adi(exported.as_bytes()).expect("import");
+        let back = &other.query(&LogQuery::default())[0];
+        assert_eq!(back.contest_id.as_deref(), Some("CQ-WW-SSB"));
+        assert_eq!(back.stx, Some(7));
+        assert_eq!(back.srx_string.as_deref(), Some("BAVARIA"));
+        assert_eq!(back.cqz, Some(15));
+        assert_eq!(back.qsl_sent.as_deref(), Some("Y"));
+        assert!(back.is_confirmed());
+    }
+
+    #[test]
+    fn a_contact_can_be_changed_and_forgotten() {
+        let (_dir, book) = new_book();
+        let mut entry = qso("SP1AA", 14_074_000, "FT8", "120000");
+        let id = entry.id.clone();
+        book.put(entry.clone()).expect("put");
+        entry.rst_rcvd = Some("-11".into());
+        book.put(entry).expect("edit");
+        assert_eq!(book.get(&id).and_then(|q| q.rst_rcvd), Some("-11".into()));
+        assert!(book.delete(&id).expect("delete"));
+        assert!(book.get(&id).is_none());
+        assert_eq!(book.count(), 0);
+    }
+}
@@ -0,0 +1,465 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! The record a contact is kept as, and the translations between what the radio
+//! says and what a log file wants.
+
+use std::collections::BTreeMap;
+
+use chrono::{DateTime, Datelike, NaiveDate, NaiveDateTime, NaiveTime, Timelike, Utc};
+use serde::{Deserialize, Serialize};
+
+/// One contact.
+///
+/// The named fields are the ones the application fills, reads or filters on.
+/// Everything else an imported file carried is kept in [`Qso::extra`] under its
+/// ADIF field name, so a log that came from another program leaves with what it
+/// arrived with rather than what this one happens to understand.
+#[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
+pub struct Qso {
+    /// Stable identity, ours, not from the file.
+    pub id: String,
+    /// UTC, always: the log is kept in the radio's time, not a browser's.
+    pub started_at: DateTime<Utc>,
+    /// Present once the operator records the end of a contact.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ended_at: Option<DateTime<Utc>>,
+    /// The station worked.
+    pub call: String,
+    /// Dial frequency in Hz. The band is derived from it rather than stored
+    /// twice and allowed to disagree.
+    pub freq_hz: u64,
+    /// ADIF mode, e.g. `SSB`, `CW`, `FT8`.
+    pub mode: String,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub submode: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rst_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rst_rcvd: Option<String>,
+    /// The worked station's Maidenhead locator.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub gridsquare: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub name: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub qth: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub comment: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub tx_pwr_w: Option<f64>,
+    /// The callsign this station was on the air with.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub station_callsign: Option<String>,
+    /// The person at the key, which is not always the station.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub operator: Option<String>,
+    /// Our locator *for this contact*: rigs can stand in different places.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub my_gridsquare: Option<String>,
+    /// The rig it was worked on, by display name (ADIF `MY_RIG`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub my_rig: Option<String>,
+    /// Which rig of this client, by id — ours, not ADIF's.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub rig_id: Option<String>,
+    /// The contest this contact counts towards, by its Cabrillo name.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub contest_id: Option<String>,
+    /// Serial sent. Kept as text as well as a number, because plenty of
+    /// exchanges are neither — a zone, a section, a name, a power.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stx: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub stx_string: Option<String>,
+    /// Serial received, likewise.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub srx: Option<u32>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub srx_string: Option<String>,
+    /// CQ and ITU zones of the station worked.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub cqz: Option<u8>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub ituz: Option<u8>,
+    /// Paper QSL, and the two card-less bureaux, as ADIF's single letters:
+    /// `Y` yes, `N` no, `R` requested, `I` ignore, `Q` queued, `V` verified.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub qsl_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub qsl_rcvd: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lotw_qsl_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub lotw_qsl_rcvd: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub eqsl_qsl_sent: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub eqsl_qsl_rcvd: Option<String>,
+    /// ADIF fields this application does not model, kept verbatim.
+    #[serde(default, skip_serializing_if = "BTreeMap::is_empty")]
+    pub extra: BTreeMap<String, String>,
+}
+
+impl Qso {
+    /// A contact with only the fields every log needs.
+    pub fn new(
+        id: String,
+        started_at: DateTime<Utc>,
+        call: &str,
+        freq_hz: u64,
+        mode: &str,
+    ) -> Self {
+        Self {
+            id,
+            started_at,
+            ended_at: None,
+            call: normalize_call(call),
+            freq_hz,
+            mode: mode.trim().to_uppercase(),
+            submode: None,
+            rst_sent: None,
+            rst_rcvd: None,
+            gridsquare: None,
+            name: None,
+            qth: None,
+            comment: None,
+            tx_pwr_w: None,
+            station_callsign: None,
+            operator: None,
+            my_gridsquare: None,
+            my_rig: None,
+            rig_id: None,
+            contest_id: None,
+            stx: None,
+            stx_string: None,
+            srx: None,
+            srx_string: None,
+            cqz: None,
+            ituz: None,
+            qsl_sent: None,
+            qsl_rcvd: None,
+            lotw_qsl_sent: None,
+            lotw_qsl_rcvd: None,
+            eqsl_qsl_sent: None,
+            eqsl_qsl_rcvd: None,
+            extra: BTreeMap::new(),
+        }
+    }
+
+    /// The ADIF band name for the frequency, if it falls in an amateur band.
+    pub fn band(&self) -> Option<&'static str> {
+        band_for_hz(self.freq_hz)
+    }
+
+    /// Whether the other station has confirmed this contact, anywhere.
+    ///
+    /// One confirmation is a confirmation: an award needs one card or one
+    /// electronic match, not all three, and a log that counted them separately
+    /// would tell the operator they were three contacts short of what they have.
+    pub fn is_confirmed(&self) -> bool {
+        [&self.qsl_rcvd, &self.lotw_qsl_rcvd, &self.eqsl_qsl_rcvd]
+            .into_iter()
+            .flatten()
+            .any(|state| {
+                let state = state.trim().to_uppercase();
+                state == "Y" || state == "V"
+            })
+    }
+
+    /// The exchange as it goes into a contest log: what was sent, or received.
+    pub fn exchange_sent(&self) -> Option<String> {
+        self.stx_string
+            .clone()
+            .or_else(|| self.stx.map(|serial| format!("{serial:03}")))
+    }
+
+    pub fn exchange_received(&self) -> Option<String> {
+        self.srx_string
+            .clone()
+            .or_else(|| self.srx.map(|serial| format!("{serial:03}")))
+    }
+
+    /// What two logs have to agree on to be describing the same contact.
+    ///
+    /// Not the time: that is compared as a window by [`crate::dedupe`], because
+    /// two programs rarely stamp the same QSO to the same minute.
+    pub fn match_key(&self) -> (String, String, String) {
+        (
+            self.call.clone(),
+            self.band().unwrap_or("").to_string(),
+            self.mode.clone(),
+        )
+    }
+}
+
+/// Callsigns are compared, sorted and deduplicated, so they are held one way:
+/// upper case, without the spaces a hurried operator leaves behind.
+pub fn normalize_call(call: &str) -> String {
+    call.trim().to_uppercase()
+}
+
+/// Amateur bands by their ADIF names, as frequency ranges in Hz.
+///
+/// Ranges are the widest any region allows, since a log records what was heard
+/// rather than what a licence permits, and a QSO on a band edge must not fall
+/// out of the log because one region stops earlier than another.
+const BANDS: &[(&str, u64, u64)] = &[
+    ("2190m", 135_700, 137_800),
+    ("630m", 472_000, 479_000),
+    ("560m", 501_000, 504_000),
+    ("160m", 1_800_000, 2_000_000),
+    ("80m", 3_500_000, 4_000_000),
+    ("60m", 5_060_000, 5_450_000),
+    ("40m", 7_000_000, 7_300_000),
+    ("30m", 10_100_000, 10_150_000),
+    ("20m", 14_000_000, 14_350_000),
+    ("17m", 18_068_000, 18_168_000),
+    ("15m", 21_000_000, 21_450_000),
+    ("12m", 24_890_000, 24_990_000),
+    ("10m", 28_000_000, 29_700_000),
+    ("8m", 40_000_000, 45_000_000),
+    ("6m", 50_000_000, 54_000_000),
+    ("5m", 54_000_001, 69_900_000),
+    ("4m", 70_000_000, 71_000_000),
+    ("2m", 144_000_000, 148_000_000),
+    ("1.25m", 222_000_000, 225_000_000),
+    ("70cm", 420_000_000, 450_000_000),
+    ("33cm", 902_000_000, 928_000_000),
+    ("23cm", 1_240_000_000, 1_300_000_000),
+    ("13cm", 2_300_000_000, 2_450_000_000),
+    ("9cm", 3_300_000_000, 3_500_000_000),
+    ("6cm", 5_650_000_000, 5_925_000_000),
+    ("3cm", 10_000_000_000, 10_500_000_000),
+];
+
+/// The ADIF band a frequency falls in, or `None` outside the amateur bands —
+/// a broadcast or utility frequency has no band name, and inventing one would
+/// put a lie in the log.
+pub fn band_for_hz(hz: u64) -> Option<&'static str> {
+    BANDS
+        .iter()
+        .find(|(_, low, high)| hz >= *low && hz <= *high)
+        .map(|(name, _, _)| *name)
+}
+
+/// The middle of a named band.
+///
+/// A log that recorded `20m` and no frequency knows the band and not the dial;
+/// the midpoint is the honest reading of that, and the band name it exports
+/// comes back the same.
+pub fn band_midpoint_for_name(band: &str) -> Option<u64> {
+    let wanted = band.trim().to_lowercase();
+    BANDS
+        .iter()
+        .find(|(name, _, _)| *name == wanted)
+        .map(|(_, low, high)| low + (high - low) / 2)
+}
+
+/// Where a band sits in the table, for ordering a report by wavelength.
+///
+/// Anything not in the table sorts last, which is where "other" belongs.
+pub fn band_order(band: &str) -> usize {
+    let wanted = band.trim().to_lowercase();
+    BANDS
+        .iter()
+        .position(|(name, _, _)| *name == wanted)
+        .unwrap_or(BANDS.len())
+}
+
+/// The frequency in MHz, as ADIF writes it.
+pub fn freq_mhz_string(hz: u64) -> String {
+    // Six decimals is 1 Hz, which is finer than any dial reports and is what
+    // other loggers write. The zeros are then dropped from the fraction only:
+    // trimming the whole string would turn 20.000000 into 2, since the run of
+    // trailing zeros reaches back through the point into the integer.
+    let text = format!("{:.6}", hz as f64 / 1e6);
+    match text.split_once('.') {
+        Some((whole, fraction)) => {
+            let fraction = fraction.trim_end_matches('0');
+            if fraction.is_empty() {
+                whole.to_string()
+            } else {
+                format!("{whole}.{fraction}")
+            }
+        }
+        None => text,
+    }
+}
+
+/// ADIF's MHz back to Hz.
+pub fn hz_from_mhz_string(text: &str) -> Option<u64> {
+    let mhz: f64 = text.trim().parse().ok()?;
+    if !mhz.is_finite() || mhz < 0.0 {
+        return None;
+    }
+    Some((mhz * 1e6).round() as u64)
+}
+
+/// What a rig mode becomes in a log.
+///
+/// A rig reports what it is demodulating; a log records what the contact was
+/// made on, and the two are not the same word. `DIG` is deliberately absent:
+/// a rig in `DIG` is in FT8 or FT4 or something else depending on which decoder
+/// is running, so the caller has to say which — see [`mode_for_decoder`].
+pub fn adif_mode_for_rig_mode(rig_mode: &str) -> Option<(&'static str, Option<&'static str>)> {
+    match rig_mode.trim().to_uppercase().as_str() {
+        "USB" => Some(("SSB", Some("USB"))),
+        "LSB" => Some(("SSB", Some("LSB"))),
+        "CW" | "CWR" => Some(("CW", None)),
+        "AM" | "SAM" => Some(("AM", None)),
+        "FM" | "WFM" => Some(("FM", None)),
+        "PKT" => Some(("PKT", None)),
+        // AIS and VDES are maritime, not amateur: nothing on them is a QSO.
+        // DIG says nothing on its own, and Other(..) is whatever a backend
+        // called it, which is the operator's to confirm rather than ours to
+        // guess into the log.
+        _ => None,
+    }
+}
+
+/// What a decoder's contacts are logged as.
+///
+/// WSPR is absent on purpose: it is a beacon mode. Hearing a beacon is not a
+/// contact, so a WSPR spot never opens a log entry.
+pub fn mode_for_decoder(decoder_id: &str) -> Option<(&'static str, Option<&'static str>)> {
+    match decoder_id.trim().to_lowercase().as_str() {
+        "ft8" => Some(("FT8", None)),
+        // FT4 is a submode of MFSK in ADIF, which is how WSJT-X logs it.
+        "ft4" => Some(("MFSK", Some("FT4"))),
+        "ft2" => Some(("MFSK", Some("FT2"))),
+        "cw" => Some(("CW", None)),
+        "aprs" | "hf-aprs" | "hf_aprs" => Some(("PKT", None)),
+        _ => None,
+    }
+}
+
+/// ADIF writes dates as `YYYYMMDD`, always UTC.
+pub fn adif_date(at: &DateTime<Utc>) -> String {
+    format!("{:04}{:02}{:02}", at.year(), at.month(), at.day())
+}
+
+/// ADIF writes times as `HHMMSS`, always UTC.
+pub fn adif_time(at: &DateTime<Utc>) -> String {
+    format!("{:02}{:02}{:02}", at.hour(), at.minute(), at.second())
+}
+
+/// ADIF's date and time back to an instant.
+///
+/// Times come as `HHMMSS` or `HHMM`; both are in the wild, and a missing time
+/// is treated as midnight rather than rejecting the record, because a log with
+/// a date and no time is still a log.
+pub fn parse_adif_datetime(date: &str, time: Option<&str>) -> Option<DateTime<Utc>> {
+    let date = date.trim();
+    if date.len() != 8 || !date.bytes().all(|b| b.is_ascii_digit()) {
+        return None;
+    }
+    let year: i32 = date[0..4].parse().ok()?;
+    let month: u32 = date[4..6].parse().ok()?;
+    let day: u32 = date[6..8].parse().ok()?;
+    let date = NaiveDate::from_ymd_opt(year, month, day)?;
+
+    let time = time.map(str::trim).filter(|t| !t.is_empty());
+    let time = match time {
+        None => NaiveTime::from_hms_opt(0, 0, 0)?,
+        Some(text) if text.len() == 6 || text.len() == 4 => {
+            if !text.bytes().all(|b| b.is_ascii_digit()) {
+                return None;
+            }
+            let hour: u32 = text[0..2].parse().ok()?;
+            let minute: u32 = text[2..4].parse().ok()?;
+            let second: u32 = if text.len() == 6 {
+                text[4..6].parse().ok()?
+            } else {
+                0
+            };
+            NaiveTime::from_hms_opt(hour, minute, second)?
+        }
+        Some(_) => return None,
+    };
+    Some(NaiveDateTime::new(date, time).and_utc())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn bands_are_named_from_the_dial() {
+        assert_eq!(band_for_hz(14_074_000), Some("20m"));
+        assert_eq!(band_for_hz(7_030_000), Some("40m"));
+        assert_eq!(band_for_hz(144_300_000), Some("2m"));
+        // A band edge is in the band: a QSO at 14.350 is a 20 m QSO.
+        assert_eq!(band_for_hz(14_350_000), Some("20m"));
+        // Broadcast and utility frequencies have no band, and must not be given
+        // one -- a log that says 49m would be wrong, not merely unhelpful.
+        assert_eq!(band_for_hz(6_075_000), None);
+        assert_eq!(band_for_hz(162_025_000), None);
+    }
+
+    #[test]
+    fn frequencies_survive_the_trip_through_megahertz() {
+        for hz in [
+            14_074_000_u64,
+            7_030_000,
+            1_840_000,
+            432_100_000,
+            10_138_700,
+            20_000_000,
+            100_000_000,
+        ] {
+            let text = freq_mhz_string(hz);
+            assert_eq!(
+                hz_from_mhz_string(&text),
+                Some(hz),
+                "{text} came back wrong"
+            );
+        }
+        assert_eq!(freq_mhz_string(14_074_000), "14.074");
+        assert_eq!(freq_mhz_string(14_000_000), "14");
+        // A whole number of MHz ending in a zero: trimming the string rather
+        // than the fraction turned 20 MHz into 2 MHz, and 100 into 1.
+        assert_eq!(freq_mhz_string(20_000_000), "20");
+        assert_eq!(freq_mhz_string(100_000_000), "100");
+        assert_eq!(freq_mhz_string(10_000_000), "10");
+        assert_eq!(freq_mhz_string(50_313_000), "50.313");
+    }
+
+    #[test]
+    fn a_rig_mode_is_not_an_adif_mode() {
+        assert_eq!(adif_mode_for_rig_mode("USB"), Some(("SSB", Some("USB"))));
+        assert_eq!(adif_mode_for_rig_mode("lsb"), Some(("SSB", Some("LSB"))));
+        assert_eq!(adif_mode_for_rig_mode("CWR"), Some(("CW", None)));
+        assert_eq!(adif_mode_for_rig_mode("SAM"), Some(("AM", None)));
+        // The rig cannot answer for DIG, and must not be allowed to guess.
+        assert_eq!(adif_mode_for_rig_mode("DIG"), None);
+        // Nor are the maritime modes contacts at all.
+        assert_eq!(adif_mode_for_rig_mode("AIS"), None);
+        assert_eq!(adif_mode_for_rig_mode("VDES"), None);
+    }
+
+    #[test]
+    fn a_decoder_answers_for_the_digital_modes() {
+        assert_eq!(mode_for_decoder("ft8"), Some(("FT8", None)));
+        assert_eq!(mode_for_decoder("ft4"), Some(("MFSK", Some("FT4"))));
+        assert_eq!(mode_for_decoder("aprs"), Some(("PKT", None)));
+        // Hearing a beacon is not a contact.
+        assert_eq!(mode_for_decoder("wspr"), None);
+    }
+
+    #[test]
+    fn adif_times_are_read_in_both_widths_and_written_in_one() {
+        let with_seconds = parse_adif_datetime("20260807", Some("121530")).expect("HHMMSS");
+        let without = parse_adif_datetime("20260807", Some("1215")).expect("HHMM");
+        assert_eq!(adif_date(&with_seconds), "20260807");
+        assert_eq!(adif_time(&with_seconds), "121530");
+        assert_eq!(adif_time(&without), "121500");
+        // A date with no time is still a log entry.
+        assert!(parse_adif_datetime("20260807", None).is_some());
+        // Nonsense is not.
+        assert!(parse_adif_datetime("2026080", Some("1215")).is_none());
+        assert!(parse_adif_datetime("20261307", Some("1215")).is_none());
+        assert!(parse_adif_datetime("20260807", Some("12:15")).is_none());
+    }
+}
@@ -0,0 +1,330 @@
+// SPDX-FileCopyrightText: 2026 Stan Grams <sjg@haxx.space>
+//
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Where the log lives.
+//!
+//! One JSON Lines file, appended to and never rewritten in place. A log is the
+//! one thing in this application that cannot be regenerated: a bookmark can be
+//! typed again and a decode will come round again, but a contact happened once.
+//! So every write is an append of a single line — atomic as far as a crash is
+//! concerned, since a torn last line loses only the record being written and is
+//! skipped on the next load — rather than a dump of the whole file, which at
+//! forty thousand QSOs would rewrite megabytes to log one contact and lose all
+//! of them if the power went halfway.
+//!
+//! An edit appends a new revision of the same id and a delete appends a
+//! tombstone; the load keeps the last word on each id. Compaction rewrites the
+//! file, through a temporary and a rename, once the superseded records outnumber
+//! the live ones.
+
+use std::collections::HashMap;
+use std::fs::{create_dir_all, File, OpenOptions};
+use std::io::{BufRead, BufReader, BufWriter, Write};
+use std::path::{Path, PathBuf};
+
+use serde::{Deserialize, Serialize};
+
+use crate::qso::Qso;
+
+/// One line of the file.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(tag = "op", rename_all = "snake_case")]
+enum Entry {
+    /// A contact, as it stands after this line.
+    Qso(Box<Qso>),
+    /// This id is gone.
+    Delete { id: String },
+}
+
+/// Compact once more than this share of the file is superseded.
+const COMPACT_WHEN_STALE_RATIO: f64 = 0.5;
+/// ...but not while the file is still trivially small.
+const COMPACT_MIN_LINES: usize = 256;
+
+pub struct LogStore {
+    path: PathBuf,
+    /// Live records by id. The log is small enough to hold: forty thousand
+    /// QSOs is a few tens of megabytes, and every read wants it in memory.
+    qsos: HashMap<String, Qso>,
+    /// Lines in the file, live or not, for deciding when to compact.
+    lines_written: usize,
+}
+
+impl LogStore {
+    /// Open the log at `path`, creating it and its directory if need be.
+    ///
+    /// A line that cannot be read is skipped and counted rather than failing the
+    /// open: a half-written last line from a crash must not cost the operator
+    /// the rest of the log.
+    pub fn open(path: &Path) -> std::io::Result<Self> {
+        if let Some(parent) = path.parent() {
+            create_dir_all(parent)?;
+        }
+        let mut store = Self {
+            path: path.to_path_buf(),
+            qsos: HashMap::new(),
+            lines_written: 0,
+        };
+        if path.exists() {
+            let file = File::open(path)?;
+            let mut damaged = 0usize;
+            for line in BufReader::new(file).lines() {
+                let line = line?;
+                if line.trim().is_empty() {
+                    continue;
+                }
+                store.lines_written += 1;
+                match serde_json::from_str::<Entry>(&line) {
+                    Ok(Entry::Qso(qso)) => {
+                        store.qsos.insert(qso.id.clone(), *qso);
+                    }
+                    Ok(Entry::Delete { id }) => {
+                        store.qsos.remove(&id);
+                    }
+                    Err(_) => damaged += 1,
+                }
+            }
+            if damaged > 0 {
+                tracing::warn!(
+                    "logbook: skipped {damaged} unreadable line(s) in {}",
+                    path.display()
+                );
+            }
+        }
+        Ok(store)
+    }
+
+    pub fn path(&self) -> &Path {
+        &self.path
+    }
+
+    pub fn len(&self) -> usize {
+        self.qsos.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.qsos.is_empty()
+    }
+
+    /// Every contact, newest first.
+    pub fn all(&self) -> Vec<Qso> {
+        let mut all: Vec<Qso> = self.qsos.values().cloned().collect();
+        all.sort_by(|a, b| b.started_at.cmp(&a.started_at).then(a.id.cmp(&b.id)));
+        all
+    }
+
+    pub fn get(&self, id: &str) -> Option<&Qso> {
+        self.qsos.get(id)
+    }
+
+    /// Write a contact, new or changed.
+    pub fn put(&mut self, qso: Qso) -> std::io::Result<()> {
+        self.append(&Entry::Qso(Box::new(qso.clone())))?;
+        self.qsos.insert(qso.id.clone(), qso);
+        self.compact_if_needed()
+    }
+
+    /// Write several contacts, appending them in one open of the file.
+    pub fn put_all(&mut self, qsos: Vec<Qso>) -> std::io::Result<()> {
+        if qsos.is_empty() {
+            return Ok(());
+        }
+        let mut file = BufWriter::new(
+            OpenOptions::new()
+                .create(true)
+                .append(true)
+                .open(&self.path)?,
+        );
+        for qso in &qsos {
+            let line = serde_json::to_string(&Entry::Qso(Box::new(qso.clone())))
+                .map_err(std::io::Error::other)?;
+            writeln!(file, "{line}")?;
+            self.lines_written += 1;
+        }
+        file.flush()?;
+        for qso in qsos {
+            self.qsos.insert(qso.id.clone(), qso);
+        }
+        self.compact_if_needed()
+    }
+
+    /// Forget a contact. `Ok(false)` if there was nothing to forget.
+    pub fn delete(&mut self, id: &str) -> std::io::Result<bool> {
+        if !self.qsos.contains_key(id) {
+            return Ok(false);
+        }
+        self.append(&Entry::Delete { id: id.to_string() })?;
+        self.qsos.remove(id);
+        self.compact_if_needed()?;
+        Ok(true)
+    }
+
+    fn append(&mut self, entry: &Entry) -> std::io::Result<()> {
+        let line = serde_json::to_string(entry).map_err(std::io::Error::other)?;
+        let mut file = OpenOptions::new()
+            .create(true)
+            .append(true)
+            .open(&self.path)?;
+        writeln!(file, "{line}")?;
+        file.flush()?;
+        self.lines_written += 1;
+        Ok(())
+    }
+
+    fn compact_if_needed(&mut self) -> std::io::Result<()> {
+        if self.lines_written < COMPACT_MIN_LINES {
+            return Ok(());
+        }
+        let live = self.qsos.len();
+        let stale = self.lines_written.saturating_sub(live);
+        if (stale as f64) < (self.lines_written as f64) * COMPACT_WHEN_STALE_RATIO {
+            return Ok(());
+        }
+        self.compact()
+    }
+
+    /// Rewrite the file with one line per live contact.
+    ///
+    /// Through a temporary and a rename, so an interrupted compaction leaves
+    /// the old file whole rather than a half-written new one.
+    pub fn compact(&mut self) -> std::io::Result<()> {
+        let temporary = self.path.with_extension("jsonl.compacting");
+        {
+            let mut file = BufWriter::new(File::create(&temporary)?);
+            for qso in self.all() {
+                let line = serde_json::to_string(&Entry::Qso(Box::new(qso)))
+                    .map_err(std::io::Error::other)?;
+                writeln!(file, "{line}")?;
+            }
+            file.flush()?;
+        }
+        std::fs::rename(&temporary, &self.path)?;
+        self.lines_written = self.qsos.len();
+        Ok(())
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::qso::parse_adif_datetime;
+
+    fn qso(id: &str, call: &str, minute: u32) -> Qso {
+        Qso::new(
+            id.to_string(),
+            parse_adif_datetime("20260807", Some(&format!("12{minute:02}00"))).expect("time"),
+            call,
+            14_074_000,
+            "FT8",
+        )
+    }
+
+    #[test]
+    fn a_log_survives_being_closed_and_opened() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        store.put(qso("a", "SP1AA", 0)).expect("put");
+        store.put(qso("b", "SP2BB", 1)).expect("put");
+        drop(store);
+
+        let store = LogStore::open(&path).expect("reopen");
+        assert_eq!(store.len(), 2);
+        assert_eq!(store.get("a").map(|q| q.call.as_str()), Some("SP1AA"));
+        // Newest first.
+        assert_eq!(store.all()[0].call, "SP2BB");
+    }
+
+    #[test]
+    fn the_last_word_on_an_id_is_the_one_that_counts() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        store.put(qso("a", "SP1AA", 0)).expect("put");
+        let mut edited = qso("a", "SP1AA", 0);
+        edited.rst_sent = Some("-05".into());
+        store.put(edited).expect("edit");
+        store.put(qso("b", "SP2BB", 1)).expect("put");
+        assert!(store.delete("b").expect("delete"));
+        assert!(!store.delete("b").expect("delete again"));
+        drop(store);
+
+        let store = LogStore::open(&path).expect("reopen");
+        assert_eq!(store.len(), 1);
+        assert_eq!(
+            store.get("a").and_then(|q| q.rst_sent.clone()),
+            Some("-05".into())
+        );
+    }
+
+    /// A crash mid-write leaves a torn line. It costs that record and nothing
+    /// else — the point of appending one line at a time.
+    #[test]
+    fn a_torn_last_line_costs_only_itself() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        store.put(qso("a", "SP1AA", 0)).expect("put");
+        store.put(qso("b", "SP2BB", 1)).expect("put");
+        drop(store);
+
+        let mut text = std::fs::read_to_string(&path).expect("read");
+        text.push_str("{\"op\":\"qso\",\"id\":\"c\",\"call\":\"SP3");
+        std::fs::write(&path, text).expect("write");
+
+        let store = LogStore::open(&path).expect("reopen past the tear");
+        assert_eq!(store.len(), 2);
+        assert!(store.get("a").is_some() && store.get("b").is_some());
+    }
+
+    #[test]
+    fn compaction_keeps_the_log_and_shortens_the_file() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+
+        let mut store = LogStore::open(&path).expect("open");
+        // One live record, rewritten until compaction triggers.
+        for index in 0..COMPACT_MIN_LINES + 10 {
+            let mut entry = qso("a", "SP1AA", 0);
+            entry.comment = Some(format!("revision {index}"));
+            store.put(entry).expect("put");
+        }
+        let lines = std::fs::read_to_string(&path)
+            .expect("read")
+            .lines()
+            .count();
+        assert_eq!(store.len(), 1);
+        // Compacted along the way: the file holds the revisions written since,
+        // not the two hundred and sixty-six that were written.
+        assert!(
+            lines < COMPACT_MIN_LINES,
+            "the file kept {lines} lines for one contact"
+        );
+        assert_eq!(
+            store.get("a").and_then(|q| q.comment.clone()),
+            Some(format!("revision {}", COMPACT_MIN_LINES + 9))
+        );
+
+        // And the compacted file still reads.
+        drop(store);
+        let store = LogStore::open(&path).expect("reopen");
+        assert_eq!(store.len(), 1);
+    }
+
+    #[test]
+    fn an_import_appends_in_one_pass() {
+        let dir = tempfile::tempdir().expect("tempdir");
+        let path = dir.path().join("logbook.jsonl");
+        let mut store = LogStore::open(&path).expect("open");
+        store
+            .put_all(vec![qso("a", "SP1AA", 0), qso("b", "SP2BB", 1)])
+            .expect("put_all");
+        assert_eq!(store.len(), 2);
+        drop(store);
+        assert_eq!(LogStore::open(&path).expect("reopen").len(), 2);
+    }
+}
@@ -34,6 +34,23 @@ pub struct ClientConfig {
    pub remotes: Vec<RemoteEntry>,
    /// Frontend configurations
    pub frontends: FrontendsConfig,
+    /// Station logbook
+    pub logbook: LogbookConfig,
+}
+
+/// Station logbook settings.
+#[derive(Debug, Clone, Default, Serialize, Deserialize)]
+#[serde(default)]
+pub struct LogbookConfig {
+    /// Where the log is kept.
+    ///
+    /// Defaults to `logbook.jsonl` in the user's data directory — not the
+    /// config directory the bookmarks use, and not the cache directory the
+    /// decode logs use: a log of contacts is neither a setting nor disposable,
+    /// and cache directories are swept by cleaners. Configurable because a
+    /// station that keeps its log on a synced or backed-up volume has to be
+    /// able to say so.
+    pub path: Option<String>,
 }

 /// General application settings.
@@ -251,18 +268,21 @@ impl AsRef<str> for CookieSameSite {
 pub struct HttpAuthConfig {
    /// Enable HTTP frontend authentication
    pub enabled: bool,
-    /// Passphrase for read-only access (rx role)
-    pub rx_passphrase: Option<String>,
-    /// Read the rx passphrase from this file instead.
+    /// JSON file containing the managed user database.
+    pub users_file: String,
+    /// Username used to create the first administrator when the database is absent.
+    pub bootstrap_admin_username: Option<String>,
+    /// Password used to create the first administrator when the database is absent.
+    pub bootstrap_admin_password: Option<String>,
+    /// Read the bootstrap administrator password from this file instead.
    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub rx_passphrase_file: Option<String>,
-    /// Passphrase for full control access (control role)
-    pub control_passphrase: Option<String>,
-    /// Read the control passphrase from this file instead.
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub control_passphrase_file: Option<String>,
-    /// Enforce TX/PTT access control (hide from unauthenticated/rx users)
-    pub tx_access_control_enabled: bool,
+    pub bootstrap_admin_password_file: Option<String>,
+    /// Create a Guest account when bootstrapping a new database.
+    pub bootstrap_read_enabled: bool,
+    /// Username for the Guest bootstrap account.
+    pub bootstrap_read_username: String,
+    /// Password for the Guest bootstrap account.
+    pub bootstrap_read_password: Option<String>,
    /// Session time-to-live in minutes
    pub session_ttl_min: u64,
    /// Set Secure flag on session cookie (required for HTTPS)
@@ -275,11 +295,13 @@ impl Default for HttpAuthConfig {
    fn default() -> Self {
        Self {
            enabled: false,
-            rx_passphrase: None,
-            rx_passphrase_file: None,
-            control_passphrase: None,
-            control_passphrase_file: None,
-            tx_access_control_enabled: true,
+            users_file: "trx-http-users.json".to_string(),
+            bootstrap_admin_username: None,
+            bootstrap_admin_password: None,
+            bootstrap_admin_password_file: None,
+            bootstrap_read_enabled: true,
+            bootstrap_read_username: "guest".to_string(),
+            bootstrap_read_password: Some("guest".to_string()),
            session_ttl_min: 480,
            cookie_secure: false,
            cookie_same_site: CookieSameSite::Lax,
@@ -785,14 +807,9 @@ impl ClientConfig {
            )?;
        }
        resolve_secret(
-            &mut self.frontends.http.auth.rx_passphrase,
-            &self.frontends.http.auth.rx_passphrase_file,
-            "[frontends.http.auth].rx_passphrase",
-        )?;
-        resolve_secret(
-            &mut self.frontends.http.auth.control_passphrase,
-            &self.frontends.http.auth.control_passphrase_file,
-            "[frontends.http.auth].control_passphrase",
+            &mut self.frontends.http.auth.bootstrap_admin_password,
+            &self.frontends.http.auth.bootstrap_admin_password_file,
+            "[frontends.http.auth].bootstrap_admin_password",
        )?;
        resolve_secret_list(
            &mut self.frontends.http_json.auth.tokens,
@@ -802,7 +819,7 @@ impl ClientConfig {

        if let Some(path) = config_path {
            if self.has_inline_secrets() {
-                crate::secrets::warn_if_group_readable(path, "tokens/passphrases");
+                crate::secrets::warn_if_group_readable(path, "tokens/passwords");
            }
        }
        Ok(())
@@ -815,10 +832,22 @@ impl ClientConfig {
                .remotes
                .iter()
                .any(|r| r.auth.token_file.is_none() && r.auth.token.is_some())
-            || self.frontends.http.auth.rx_passphrase_file.is_none()
-                && self.frontends.http.auth.rx_passphrase.is_some()
-            || self.frontends.http.auth.control_passphrase_file.is_none()
-                && self.frontends.http.auth.control_passphrase.is_some()
+            || self
+                .frontends
+                .http
+                .auth
+                .bootstrap_admin_password_file
+                .is_none()
+                && self.frontends.http.auth.bootstrap_admin_password.is_some()
+            || self.frontends.http.auth.enabled
+                && self.frontends.http.auth.bootstrap_read_enabled
+                && self
+                    .frontends
+                    .http
+                    .auth
+                    .bootstrap_read_password
+                    .as_deref()
+                    .is_some_and(|password| password != "guest")
            || self.frontends.http_json.auth.tokens_file.is_none()
                && !self.frontends.http_json.auth.tokens.is_empty()
    }
@@ -888,11 +917,13 @@ impl ClientConfig {
                    decode_history_retention_min_by_rig: HashMap::new(),
                    auth: HttpAuthConfig {
                        enabled: false,
-                        rx_passphrase: Some("rx-passphrase-example".to_string()),
-                        rx_passphrase_file: None,
-                        control_passphrase: Some("control-passphrase-example".to_string()),
-                        control_passphrase_file: None,
-                        tx_access_control_enabled: true,
+                        users_file: "trx-http-users.json".to_string(),
+                        bootstrap_admin_username: Some("admin".to_string()),
+                        bootstrap_admin_password: Some("change-this-password".to_string()),
+                        bootstrap_admin_password_file: None,
+                        bootstrap_read_enabled: true,
+                        bootstrap_read_username: "guest".to_string(),
+                        bootstrap_read_password: Some("guest".to_string()),
                        session_ttl_min: 480,
                        cookie_secure: false,
                        cookie_same_site: CookieSameSite::Lax,
@@ -907,6 +938,7 @@ impl ClientConfig {
                http_json: HttpJsonFrontendConfig::default(),
                audio: AudioClientConfig::default(),
            },
+            logbook: LogbookConfig { path: None },
        }
    }

@@ -930,27 +962,34 @@ fn validate_http_auth(auth: &HttpAuthConfig) -> Result<(), String> {
        return Ok(());
    }

-    // If enabled, require at least one passphrase
-    if auth.rx_passphrase.is_none() && auth.control_passphrase.is_none() {
+    if auth.users_file.trim().is_empty() {
+        return Err("[frontends.http.auth].users_file must not be empty".to_string());
+    }
+    if auth.bootstrap_admin_username.is_some() != auth.bootstrap_admin_password.is_some() {
+        return Err("[frontends.http.auth] bootstrap_admin_username and bootstrap_admin_password must be set together".to_string());
+    }
+    if auth
+        .bootstrap_admin_username
+        .as_deref()
+        .is_some_and(|v| v.trim().is_empty())
+        || auth
+            .bootstrap_admin_password
+            .as_deref()
+            .is_some_and(|v| v.is_empty())
+    {
        return Err(
-            "[frontends.http.auth] enabled=true requires at least one passphrase \
-             (rx_passphrase and/or control_passphrase)"
+            "[frontends.http.auth] bootstrap administrator credentials must not be empty"
                .to_string(),
        );
    }
-
-    // Validate passphrases are not empty strings
-    if let Some(rx) = &auth.rx_passphrase {
-        if rx.trim().is_empty() {
-            return Err("[frontends.http.auth].rx_passphrase must not be empty if set".to_string());
-        }
-    }
-    if let Some(ctrl) = &auth.control_passphrase {
-        if ctrl.trim().is_empty() {
-            return Err(
-                "[frontends.http.auth].control_passphrase must not be empty if set".to_string(),
-            );
-        }
+    if auth.bootstrap_read_enabled
+        && (auth.bootstrap_read_username.trim().is_empty()
+            || auth
+                .bootstrap_read_password
+                .as_deref()
+                .is_none_or(str::is_empty))
+    {
+        return Err("[frontends.http.auth] enabled bootstrap Guest account requires a non-empty username and password".to_string());
    }

    // Session TTL must be > 0
@@ -1220,42 +1259,34 @@ home-hf = "audio://10.0.0.5:4600"
    }

    #[test]
-    fn test_validate_rejects_http_auth_enabled_without_passphrases() {
+    fn test_validate_accepts_http_auth_with_user_database() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_accepts_bootstrap_admin_pair() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_rejects_incomplete_bootstrap_admin_pair() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
        assert!(config.validate().is_err());
    }

    #[test]
-    fn test_validate_accepts_http_auth_with_rx_passphrase() {
+    fn test_validate_rejects_empty_users_file() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_accepts_http_auth_with_control_passphrase() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_accepts_http_auth_with_both_passphrases() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
-        config.frontends.http.auth.control_passphrase = Some("control-secret".to_string());
-        assert!(config.validate().is_ok());
-    }
-
-    #[test]
-    fn test_validate_rejects_empty_rx_passphrase() {
-        let mut config = ClientConfig::default();
-        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("".to_string());
+        config.frontends.http.auth.users_file.clear();
        assert!(config.validate().is_err());
    }

@@ -1263,16 +1294,27 @@ home-hf = "audio://10.0.0.5:4600"
    fn test_validate_rejects_zero_session_ttl() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.rx_passphrase = Some("rx-secret".to_string());
        config.frontends.http.auth.session_ttl_min = 0;
        assert!(config.validate().is_err());
    }

    #[test]
-    fn test_validate_auth_disabled_ignores_passphrases() {
+    fn test_validate_allows_disabling_read_bootstrap_credentials() {
+        let mut config = ClientConfig::default();
+        config.frontends.http.auth.enabled = true;
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password = Some("secret-password".to_string());
+        config.frontends.http.auth.bootstrap_read_enabled = false;
+        config.frontends.http.auth.bootstrap_read_username.clear();
+        config.frontends.http.auth.bootstrap_read_password = None;
+        assert!(config.validate().is_ok());
+    }
+
+    #[test]
+    fn test_validate_auth_disabled_ignores_user_settings() {
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = false;
-        config.frontends.http.auth.rx_passphrase = Some("".to_string());
+        config.frontends.http.auth.users_file.clear();
        assert!(config.validate().is_ok());
    }

@@ -1280,9 +1322,12 @@ home-hf = "audio://10.0.0.5:4600"
    fn test_http_auth_config_default() {
        let auth = HttpAuthConfig::default();
        assert!(!auth.enabled);
-        assert!(auth.rx_passphrase.is_none());
-        assert!(auth.control_passphrase.is_none());
-        assert!(auth.tx_access_control_enabled);
+        assert_eq!(auth.users_file, "trx-http-users.json");
+        assert!(auth.bootstrap_admin_username.is_none());
+        assert!(auth.bootstrap_admin_password.is_none());
+        assert!(auth.bootstrap_read_enabled);
+        assert_eq!(auth.bootstrap_read_username, "guest");
+        assert_eq!(auth.bootstrap_read_password.as_deref(), Some("guest"));
        assert_eq!(auth.session_ttl_min, 480);
        assert!(!auth.cookie_secure);
        assert!(matches!(auth.cookie_same_site, CookieSameSite::Lax));
@@ -1584,15 +1629,21 @@ spectrum_interval_ms = 0
    }

    #[test]
-    fn test_passphrase_file_fills_passphrase() {
+    fn test_bootstrap_password_file_fills_password() {
        let f = secret_file("hunter2\n");
        let mut config = ClientConfig::default();
        config.frontends.http.auth.enabled = true;
-        config.frontends.http.auth.control_passphrase_file =
+        config.frontends.http.auth.bootstrap_admin_username = Some("admin".to_string());
+        config.frontends.http.auth.bootstrap_admin_password_file =
            Some(f.path().to_str().unwrap().to_string());
        config.resolve_secrets(None).unwrap();
        assert_eq!(
-            config.frontends.http.auth.control_passphrase.as_deref(),
+            config
+                .frontends
+                .http
+                .auth
+                .bootstrap_admin_password
+                .as_deref(),
            Some("hunter2")
        );
        assert!(config.validate().is_ok());
@@ -111,8 +111,8 @@ const SECTION_COMMENTS: &[(&str, &str)] = &[
    ),
    (
        "trx-client.frontends.http.auth",
-        "Passphrase login for the web UI.  rx_passphrase_file and\n\
-         control_passphrase_file keep the secrets out of this file.",
+        "Optional user/password ACL for the web UI. Administrators manage\n\
+         accounts stored in users_file.",
    ),
    (
        "trx-client.frontends.rigctl",
@@ -130,6 +130,10 @@ const SECTION_COMMENTS: &[(&str, &str)] = &[
        "trx-client.frontends.audio.bridge",
        "Play RX audio on a local sound device and capture TX from one.",
    ),
+    (
+        "trx-client.logbook",
+        "Station log of contacts.  path defaults to logbook.jsonl in the user's\n         data directory; set it to keep the log on a backed-up volume.",
+    ),
 ];

 /// Render the combined `trx-rs.toml.example` contents.
@@ -203,13 +203,16 @@ decode_history_retention_min = 1440

 [trx-client.frontends.http.decode_history_retention_min_by_rig]

-# Passphrase login for the web UI.  rx_passphrase_file and
-# control_passphrase_file keep the secrets out of this file.
+# Optional user/password ACL for the web UI. Administrators manage
+# accounts stored in users_file.
 [trx-client.frontends.http.auth]
 enabled = false
-rx_passphrase = "rx-passphrase-example"
-control_passphrase = "control-passphrase-example"
-tx_access_control_enabled = true
+users_file = "trx-http-users.json"
+bootstrap_admin_username = "admin"
+bootstrap_admin_password = "change-this-password"
+bootstrap_read_enabled = true
+bootstrap_read_username = "guest"
+bootstrap_read_password = "guest"
 session_ttl_min = 480
 cookie_secure = false
 cookie_same_site = "Lax"
@@ -246,3 +249,7 @@ enabled = false
 bitrate_bps = 192000
 rx_gain = 1.0
 tx_gain = 1.0
+
+# Station log of contacts.  path defaults to logbook.jsonl in the user's
+# data directory; set it to keep the log on a backed-up volume.
+[trx-client.logbook]