feat: Add Plymouth boot splash and fix kiosk mode

- Add Plymouth boot splash theme (VT100/DEC PDP-style green phosphor)
- Boot splash now shows DURING boot, not just at login
- Fix kiosk service: use tty7, proper VT allocation, better env vars
- Add splash parameter to GRUB menu entries
- Add initramfs configuration for Plymouth framebuffer
- RPi build: Plymouth support with ARM64 theme

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

image/build-live-usb.sh

@@ -145,6 +145,7 @@ INCLUDE_PKGS+=",iproute2,iputils-ping,ethtool,net-tools,wireguard-tools"
 INCLUDE_PKGS+=",sudo,less,vim-tiny,logrotate,cron,rsync,jq,dnsmasq"
 INCLUDE_PKGS+=",linux-image-amd64,live-boot,live-boot-initramfs-tools,live-config,live-config-systemd"
 INCLUDE_PKGS+=",grub-efi-amd64,efibootmgr,pciutils,usbutils,lsb-release"
+INCLUDE_PKGS+=",plymouth,plymouth-themes"
 
 debootstrap --arch=amd64 --include="${INCLUDE_PKGS}" \
   "${SUITE}" "${ROOTFS}" "${APT_MIRROR}"
@@ -206,11 +207,13 @@ chroot "${ROOTFS}" systemctl set-default multi-user.target 2>/dev/null || true
 mkdir -p "${ROOTFS}/etc/live/config.conf.d"
 echo 'LIVE_CONFIG_NOAUTOLOGIN=true' > "${ROOTFS}/etc/live/config.conf.d/no-autologin.conf"
 
-# Quiet boot
+# Boot status (show for debugging)
 mkdir -p "${ROOTFS}/etc/systemd/system.conf.d"
-cat > "${ROOTFS}/etc/systemd/system.conf.d/quiet-boot.conf" <<EOF
+cat > "${ROOTFS}/etc/systemd/system.conf.d/boot.conf" <<EOF
 [Manager]
-ShowStatus=no
+ShowStatus=yes
+DefaultTimeoutStartSec=30s
+DefaultTimeoutStopSec=30s
 EOF
 
 # Disable console spam
@@ -234,66 +237,219 @@ log() {
     [ -c "$REPORT_CONSOLE" ] && echo "$*" > "$REPORT_CONSOLE"
 }
 
+cyber_banner() {
+    # VT100 green phosphor style
+    echo -e "\033[32m"
+    cat << 'BANNER'
+
+  ____  _____ ____ _   _ ____   _____  __
+ / ___|| ____/ ___| | | | __ ) / _ \ \/ /
+ \___ \|  _|| |   | | | |  _ \| | | \  /
+  ___) | |__| |___| |_| | |_) | |_| /  \
+ |____/|_____\____|\___/|____/ \___/_/\_\
+
+================================================================
+  DEC PDP-11/70 COMPATIBLE - HARDWARE EVALUATION MODE
+================================================================
+
+BANNER
+}
+
 check_hw() {
-    log "═══════════════════════════════════════════════════════════"
-    log "  SecuBox Hardware Check Report"
-    log "═══════════════════════════════════════════════════════════"
+    clear
+    cyber_banner
+    sleep 1
+
+    log ">>>> SYSTEM HARDWARE SCAN INITIATED <<<<"
+    log "================================================================"
+    echo ""
 
     # CPU
     CPU_MODEL=$(grep -m1 "model name" /proc/cpuinfo | cut -d: -f2 | xargs)
     CPU_CORES=$(grep -c processor /proc/cpuinfo)
-    log "CPU: $CPU_MODEL ($CPU_CORES cores)"
+    log "CPU.......... $CPU_MODEL"
+    log "             ($CPU_CORES PROCESSOR UNITS)"
 
     # Memory
     MEM_TOTAL=$(free -h | awk '/Mem:/ {print $2}')
     MEM_AVAIL=$(free -h | awk '/Mem:/ {print $7}')
-    log "RAM: $MEM_TOTAL total, $MEM_AVAIL available"
+    log "MEMORY....... $MEM_TOTAL TOTAL / $MEM_AVAIL AVAILABLE"
 
     # Storage
-    log "Storage devices:"
+    log "STORAGE DEVICES:"
     lsblk -d -o NAME,SIZE,TYPE,MODEL 2>/dev/null | grep -v "^NAME" | while read line; do
-        log "  $line"
+        log "  * $line"
     done
 
     # Network
-    log "Network interfaces:"
+    log "NETWORK INTERFACES:"
     for iface in /sys/class/net/*; do
         name=$(basename "$iface")
         [ "$name" = "lo" ] && continue
         state=$(cat "$iface/operstate" 2>/dev/null || echo "unknown")
         mac=$(cat "$iface/address" 2>/dev/null || echo "n/a")
-        log "  $name: $state ($mac)"
+        if [ "$state" = "up" ]; then
+            log "  [+] $name: $state ($mac)"
+        else
+            log "  [-] $name: $state ($mac)"
+        fi
     done
 
     # Graphics
-    log "Graphics:"
+    log "GRAPHICS ADAPTER:"
     lspci 2>/dev/null | grep -iE "vga|3d|display" | while read line; do
-        log "  $line"
+        log "  * $line"
     done
 
     # Boot mode
     if [ -d /sys/firmware/efi ]; then
-        log "Boot mode: UEFI"
+        log "BOOT MODE.... UEFI"
     else
-        log "Boot mode: BIOS/Legacy"
+        log "BOOT MODE.... BIOS/LEGACY"
     fi
 
     # Virtualization detection
     VIRT=$(systemd-detect-virt 2>/dev/null || echo "none")
-    log "Virtualization: $VIRT"
+    if [ "$VIRT" = "none" ]; then
+        log "PLATFORM..... BARE METAL"
+    else
+        log "PLATFORM..... VIRTUAL ($VIRT)"
+    fi
 
-    log "═══════════════════════════════════════════════════════════"
-    log "  Hardware check complete - System ready"
-    log "═══════════════════════════════════════════════════════════"
+    echo ""
+    log "================================================================"
+    log ">>>> HARDWARE CHECK COMPLETE - ALL SYSTEMS NOMINAL <<<<"
+    log ">>>> SECUBOX CYBER DEFENSE PLATFORM READY <<<<"
+    log "================================================================"
+    echo ""
+}
+
+# Cyber boot splash with status - VT100 style
+cyber_splash() {
+    clear
+    echo -e "\033[32m"
+    cyber_banner
+
+    local steps=(
+        "INITIALIZING SECURE ENVIRONMENT.......... OK"
+        "LOADING CRYPTOGRAPHIC MODULES............ OK"
+        "CONFIGURING NETWORK STACK................ OK"
+        "ACTIVATING FIREWALL RULES................ OK"
+        "SCANNING FOR THREATS..................... CLEAR"
+        "HARDENING SYSTEM......................... OK"
+        "OPTIMIZING PERFORMANCE................... OK"
+    )
+
+    for step in "${steps[@]}"; do
+        echo -e "  > $step"
+        sleep 0.3
+    done
+
+    echo ""
+    echo "  >>>> SECURE BOOT SEQUENCE COMPLETE <<<<"
+    echo ""
+    sleep 1
 }
 
 # Check if hwcheck requested via kernel cmdline
 if grep -q "secubox.hwcheck=1" /proc/cmdline; then
+    cyber_splash
     check_hw
 fi
 HWCHECK
 chmod +x "${ROOTFS}/usr/local/bin/secubox-hwcheck"
 
+# Create retro CRT VT100 DEC PDP-style boot splash
+cat > "${ROOTFS}/usr/local/bin/secubox-splash" <<'SPLASH'
+#!/bin/bash
+# SecuBox Cyber Boot Splash - VT100/DEC PDP Style
+
+# VT100 escape codes
+ESC="\033"
+GREEN="${ESC}[32m"
+BRIGHT="${ESC}[1m"
+DIM="${ESC}[2m"
+BLINK="${ESC}[5m"
+RESET="${ESC}[0m"
+CLEAR="${ESC}[2J${ESC}[H"
+
+# Clear screen and set green phosphor look
+echo -ne "$CLEAR$GREEN"
+
+# Simulated boot delay
+type_slow() {
+    local text="$1"
+    for ((i=0; i<${#text}; i++)); do
+        echo -n "${text:$i:1}"
+        sleep 0.02
+    done
+    echo ""
+}
+
+cat << 'BANNER'
+
+  ____  _____ ____ _   _ ____   _____  __
+ / ___|| ____/ ___| | | | __ ) / _ \ \/ /
+ \___ \|  _|| |   | | | |  _ \| | | \  /
+  ___) | |__| |___| |_| | |_) | |_| /  \
+ |____/|_____\____|\___/|____/ \___/_/\_\
+
+BANNER
+
+echo ""
+echo -e "${BRIGHT}================================================================${RESET}${GREEN}"
+echo "  DEC PDP-11/70 COMPATIBLE SECURITY TERMINAL"
+echo "  SECUBOX CYBER DEFENSE SYSTEM v1.3"
+echo -e "${BRIGHT}================================================================${RESET}${GREEN}"
+echo ""
+
+type_slow "BOOT SEQUENCE INITIATED..."
+echo ""
+
+# Boot status messages
+steps=(
+    "MEMORY TEST.................... 4096K OK"
+    "LOADING KERNEL................. DONE"
+    "CRYPTOGRAPHIC MODULES.......... LOADED"
+    "NETWORK STACK.................. INITIALIZED"
+    "FIREWALL RULES................. ACTIVE"
+    "INTRUSION DETECTION............ ARMED"
+    "SECURE SHELL................... READY"
+)
+
+for step in "${steps[@]}"; do
+    echo -n "  > "
+    type_slow "$step"
+    sleep 0.1
+done
+
+echo ""
+echo -e "${BRIGHT}================================================================${RESET}${GREEN}"
+echo ""
+echo -e "  ${BLINK}*${RESET}${GREEN} SYSTEM READY"
+echo ""
+echo "  .------------------------------------------------."
+echo "  |  SECUBOX CYBER SECURITY PLATFORM               |"
+echo "  |  TYPE 'help' FOR AVAILABLE COMMANDS            |"
+echo "  |  UNAUTHORIZED ACCESS WILL BE PROSECUTED        |"
+echo "  '------------------------------------------------'"
+echo ""
+echo -e "${DIM}  Press ENTER to continue...${RESET}${GREEN}"
+read -t 5 || true
+echo -ne "$RESET"
+SPLASH
+chmod +x "${ROOTFS}/usr/local/bin/secubox-splash"
+
+# Add splash to root's bashrc for login
+cat >> "${ROOTFS}/root/.bashrc" <<'BASHRC'
+
+# SecuBox Cyber Splash on login
+if [ -t 0 ] && [ -z "$SECUBOX_SPLASH_SHOWN" ]; then
+    export SECUBOX_SPLASH_SHOWN=1
+    /usr/local/bin/secubox-splash 2>/dev/null || true
+fi
+BASHRC
+
 # Systemd service for hardware check
 cat > "${ROOTFS}/etc/systemd/system/secubox-hwcheck.service" <<'HWSVC'
 [Unit]
@@ -392,6 +548,151 @@ chroot "${ROOTFS}" systemctl enable secubox-net-fallback.service 2>/dev/null ||
 chroot "${ROOTFS}" systemctl disable systemd-networkd-wait-online.service 2>/dev/null || true
 chroot "${ROOTFS}" systemctl mask systemd-networkd-wait-online.service 2>/dev/null || true
 
+# ── Plymouth Boot Splash Theme ─────────────────────────────────────
+log "Installing Plymouth boot splash..."
+
+# Create SecuBox Plymouth theme directory
+PLYMOUTH_DIR="${ROOTFS}/usr/share/plymouth/themes/secubox"
+mkdir -p "${PLYMOUTH_DIR}"
+
+# Create theme descriptor
+cat > "${PLYMOUTH_DIR}/secubox.plymouth" <<'PLYTHEME'
+[Plymouth Theme]
+Name=SecuBox Cyber
+Description=SecuBox VT100/DEC PDP-11 style boot splash
+ModuleName=script
+
+[script]
+ImageDir=/usr/share/plymouth/themes/secubox
+ScriptFile=/usr/share/plymouth/themes/secubox/secubox.script
+PLYTHEME
+
+# Create Plymouth script (text-based retro look)
+cat > "${PLYMOUTH_DIR}/secubox.script" <<'PLYSCRIPT'
+# SecuBox Plymouth Theme - VT100/DEC PDP-11 Style
+# Green phosphor terminal aesthetic
+
+# Colors
+Window.SetBackgroundTopColor(0.0, 0.0, 0.0);
+Window.SetBackgroundBottomColor(0.0, 0.05, 0.0);
+
+# Logo and text positioning
+screen_width = Window.GetWidth();
+screen_height = Window.GetHeight();
+center_x = screen_width / 2;
+center_y = screen_height / 2;
+
+# Banner text (ASCII art simulation)
+banner_text = "SECUBOX CYBER DEFENSE SYSTEM";
+banner_sprite = Sprite();
+banner_image = Image.Text(banner_text, 0.0, 1.0, 0.0, "Fixed");
+banner_sprite.SetImage(banner_image);
+banner_sprite.SetPosition(center_x - banner_image.GetWidth() / 2, center_y - 100, 1);
+
+# Version line
+version_text = "DEC PDP-11/70 COMPATIBLE - SECURE BOOT SEQUENCE";
+version_sprite = Sprite();
+version_image = Image.Text(version_text, 0.0, 0.8, 0.0, "Fixed");
+version_sprite.SetImage(version_image);
+version_sprite.SetPosition(center_x - version_image.GetWidth() / 2, center_y - 60, 1);
+
+# Separator line
+sep_text = "================================================================";
+sep_sprite = Sprite();
+sep_image = Image.Text(sep_text, 0.0, 0.6, 0.0, "Fixed");
+sep_sprite.SetImage(sep_image);
+sep_sprite.SetPosition(center_x - sep_image.GetWidth() / 2, center_y - 40, 1);
+
+# Progress indicator
+progress_sprite = Sprite();
+
+fun refresh_callback() {
+    # Blinking cursor effect
+    time = Plymouth.GetTime();
+    if (Math.Int(time * 2) % 2 == 0) {
+        cursor_text = "_";
+    } else {
+        cursor_text = " ";
+    }
+    cursor_image = Image.Text(cursor_text, 0.0, 1.0, 0.0, "Fixed");
+    cursor_sprite = Sprite(cursor_image);
+    cursor_sprite.SetPosition(center_x + 100, center_y + 60, 2);
+}
+
+Plymouth.SetRefreshFunction(refresh_callback);
+
+# Boot progress bar
+progress_box_image = Image.Text("[                              ]", 0.0, 0.8, 0.0, "Fixed");
+progress_box_sprite = Sprite(progress_box_image);
+progress_box_sprite.SetPosition(center_x - progress_box_image.GetWidth() / 2, center_y + 20, 1);
+
+fun boot_progress_callback(duration, progress) {
+    # Update progress bar fill
+    fill_count = Math.Int(progress * 30);
+    fill_text = "";
+    for (i = 0; i < fill_count; i++) {
+        fill_text = fill_text + "#";
+    }
+    for (i = fill_count; i < 30; i++) {
+        fill_text = fill_text + " ";
+    }
+    progress_text = "[" + fill_text + "]";
+    progress_image = Image.Text(progress_text, 0.0, 1.0, 0.0, "Fixed");
+    progress_sprite.SetImage(progress_image);
+    progress_sprite.SetPosition(center_x - progress_image.GetWidth() / 2, center_y + 20, 1);
+}
+
+Plymouth.SetBootProgressFunction(boot_progress_callback);
+
+# Status message display
+message_sprite = Sprite();
+
+fun message_callback(text) {
+    message_image = Image.Text("> " + text, 0.0, 0.7, 0.0, "Fixed");
+    message_sprite.SetImage(message_image);
+    message_sprite.SetPosition(center_x - 200, center_y + 60, 1);
+}
+
+Plymouth.SetMessageFunction(message_callback);
+
+# Display mode change
+fun display_normal_callback() {
+    # Normal boot display
+}
+
+fun display_password_callback(prompt, bullets) {
+    # Password entry (for encrypted disks)
+    password_sprite = Sprite();
+    password_image = Image.Text(prompt + " " + bullets, 0.0, 1.0, 0.0, "Fixed");
+    password_sprite.SetImage(password_image);
+    password_sprite.SetPosition(center_x - password_image.GetWidth() / 2, center_y + 100, 1);
+}
+
+Plymouth.SetDisplayNormalFunction(display_normal_callback);
+Plymouth.SetDisplayPasswordFunction(display_password_callback);
+
+# System update messages
+fun system_update_callback(progress) {
+    update_text = "SYSTEM UPDATE: " + Math.Int(progress * 100) + "%";
+    update_image = Image.Text(update_text, 0.0, 0.8, 0.0, "Fixed");
+    update_sprite = Sprite(update_image);
+    update_sprite.SetPosition(center_x - update_image.GetWidth() / 2, center_y + 80, 1);
+}
+
+Plymouth.SetSystemUpdateFunction(system_update_callback);
+PLYSCRIPT
+
+# Set SecuBox theme as default
+mkdir -p "${ROOTFS}/etc/plymouth"
+echo "[Daemon]" > "${ROOTFS}/etc/plymouth/plymouthd.conf"
+echo "Theme=secubox" >> "${ROOTFS}/etc/plymouth/plymouthd.conf"
+echo "ShowDelay=0" >> "${ROOTFS}/etc/plymouth/plymouthd.conf"
+
+# Update alternatives to use our theme
+chroot "${ROOTFS}" plymouth-set-default-theme secubox 2>/dev/null || true
+
+ok "Plymouth SecuBox theme installed"
+
 ok "Base configuration complete"
 
 # ══════════════════════════════════════════════════════════════════
@@ -656,8 +957,12 @@ echo "squashfs" >> "${ROOTFS}/etc/modules-load.d/live.conf"
 echo "loop" >> "${ROOTFS}/etc/modules-load.d/live.conf"
 echo "overlay" >> "${ROOTFS}/etc/modules-load.d/live.conf"
 
-# Regenerate initramfs with live-boot hooks
-log "Regenerating initramfs..."
+# Ensure Plymouth is in initramfs
+mkdir -p "${ROOTFS}/etc/initramfs-tools/conf.d"
+echo "FRAMEBUFFER=y" > "${ROOTFS}/etc/initramfs-tools/conf.d/plymouth"
+
+# Regenerate initramfs with live-boot and Plymouth hooks
+log "Regenerating initramfs with Plymouth..."
 chroot "${ROOTFS}" update-initramfs -u -k all 2>/dev/null || warn "initramfs update failed"
 
 # Clean APT
@@ -799,7 +1104,7 @@ set menu_color_normal=cyan/black
 set menu_color_highlight=white/blue
 
 menuentry "SecuBox Live" {
-    linux ($live)/live/vmlinuz boot=live live-media-path=live components persistence console=tty0
+    linux ($live)/live/vmlinuz boot=live live-media-path=live components persistence quiet splash
     initrd ($live)/live/initrd.img
 }
 
@@ -809,7 +1114,7 @@ menuentry "SecuBox Live (Kiosk GUI)" {
 }
 
 menuentry "SecuBox Live (Bridge Mode)" {
-    linux ($live)/live/vmlinuz boot=live live-media-path=live components persistence console=tty0 secubox.netmode=bridge
+    linux ($live)/live/vmlinuz boot=live live-media-path=live components persistence quiet splash secubox.netmode=bridge
     initrd ($live)/live/initrd.img
 }
 
@@ -819,7 +1124,7 @@ menuentry "SecuBox Live (Safe Mode)" {
 }
 
 menuentry "SecuBox Live (To RAM)" {
-    linux ($live)/live/vmlinuz boot=live live-media-path=live components toram console=tty0
+    linux ($live)/live/vmlinuz boot=live live-media-path=live components toram quiet splash
     initrd ($live)/live/initrd.img
 }
 
@@ -827,6 +1132,11 @@ menuentry "SecuBox Live (Auto-Check HW)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=live components nomodeset console=tty0 secubox.hwcheck=1
     initrd ($live)/live/initrd.img
 }
+
+menuentry "SecuBox Live (Emergency Shell)" {
+    linux ($live)/live/vmlinuz boot=live live-media-path=live components nomodeset console=tty0 systemd.unit=emergency.target
+    initrd ($live)/live/initrd.img
+}
 GRUBCFG
 
 cp "${MNT}/esp/boot/grub/grub.cfg" "${MNT}/esp/EFI/BOOT/grub.cfg"

image/build-rpi-usb.sh

@@ -109,7 +109,7 @@ INCLUDE_PKGS="systemd,systemd-sysv,dbus,nftables,openssh-server"
 INCLUDE_PKGS+=",python3,python3-pip,nginx,curl,wget,ca-certificates,gnupg"
 INCLUDE_PKGS+=",iproute2,iputils-ping,net-tools,wireguard-tools"
 INCLUDE_PKGS+=",sudo,less,vim-tiny,cron,rsync,jq"
-INCLUDE_PKGS+=",linux-image-arm64,raspi-firmware"
+INCLUDE_PKGS+=",linux-image-arm64,plymouth,plymouth-themes"
 
 debootstrap --arch=arm64 --foreign --include="${INCLUDE_PKGS}" \
   "${SUITE}" "${ROOTFS}" "${APT_MIRROR}"
@@ -171,6 +171,182 @@ EOF
 # Enable serial console
 chroot "${ROOTFS}" systemctl enable serial-getty@ttyAMA0.service 2>/dev/null || true
 
+# Enable getty@tty1 for HDMI console
+mkdir -p "${ROOTFS}/etc/systemd/system/getty@tty1.service.d"
+cat > "${ROOTFS}/etc/systemd/system/getty@tty1.service.d/override.conf" <<EOF
+[Service]
+ExecStart=
+ExecStart=-/sbin/agetty --autologin root --noclear %I \$TERM
+Type=idle
+EOF
+chroot "${ROOTFS}" systemctl enable getty@tty1.service 2>/dev/null || true
+chroot "${ROOTFS}" systemctl set-default multi-user.target 2>/dev/null || true
+
+# ── Cyber Boot Splash (VT100 DEC PDP-style) ─────────────────────────
+cat > "${ROOTFS}/usr/local/bin/secubox-splash" <<'SPLASH'
+#!/bin/bash
+# SecuBox Cyber Boot Splash - VT100/DEC PDP Style
+
+ESC="\033"
+GREEN="${ESC}[32m"
+BRIGHT="${ESC}[1m"
+DIM="${ESC}[2m"
+BLINK="${ESC}[5m"
+RESET="${ESC}[0m"
+CLEAR="${ESC}[2J${ESC}[H"
+
+echo -ne "$CLEAR$GREEN"
+
+type_slow() {
+    local text="$1"
+    for ((i=0; i<${#text}; i++)); do
+        echo -n "${text:$i:1}"
+        sleep 0.02
+    done
+    echo ""
+}
+
+cat << 'BANNER'
+
+  ____  _____ ____ _   _ ____   _____  __
+ / ___|| ____/ ___| | | | __ ) / _ \ \/ /
+ \___ \|  _|| |   | | | |  _ \| | | \  /
+  ___) | |__| |___| |_| | |_) | |_| /  \
+ |____/|_____\____|\___/|____/ \___/_/\_\
+
+BANNER
+
+echo ""
+echo -e "${BRIGHT}================================================================${RESET}${GREEN}"
+echo "  RASPBERRY PI 400 SECURITY TERMINAL"
+echo "  SECUBOX CYBER DEFENSE SYSTEM"
+echo -e "${BRIGHT}================================================================${RESET}${GREEN}"
+echo ""
+
+type_slow "BOOT SEQUENCE INITIATED..."
+echo ""
+
+steps=(
+    "MEMORY TEST.................... OK"
+    "LOADING KERNEL................. DONE"
+    "CRYPTOGRAPHIC MODULES.......... LOADED"
+    "NETWORK STACK.................. INITIALIZED"
+    "FIREWALL RULES................. ACTIVE"
+    "SECURE SHELL................... READY"
+)
+
+for step in "${steps[@]}"; do
+    echo -n "  > "
+    type_slow "$step"
+    sleep 0.1
+done
+
+echo ""
+echo -e "${BRIGHT}================================================================${RESET}${GREEN}"
+echo ""
+echo -e "  ${BLINK}*${RESET}${GREEN} SYSTEM READY"
+echo ""
+echo "  .------------------------------------------------."
+echo "  |  SECUBOX CYBER SECURITY PLATFORM               |"
+echo "  |  TYPE 'help' FOR AVAILABLE COMMANDS            |"
+echo "  |  RASPBERRY PI 400 ARM64 EDITION                |"
+echo "  '------------------------------------------------'"
+echo ""
+echo -e "${DIM}  Press ENTER to continue...${RESET}${GREEN}"
+read -t 5 || true
+echo -ne "$RESET"
+SPLASH
+chmod +x "${ROOTFS}/usr/local/bin/secubox-splash"
+
+# Add splash to root's bashrc
+cat >> "${ROOTFS}/root/.bashrc" <<'BASHRC'
+
+# SecuBox Cyber Splash on login
+if [ -t 0 ] && [ -z "$SECUBOX_SPLASH_SHOWN" ]; then
+    export SECUBOX_SPLASH_SHOWN=1
+    /usr/local/bin/secubox-splash 2>/dev/null || true
+fi
+BASHRC
+
+# ── Plymouth Boot Splash Theme ─────────────────────────────────────
+log "Installing Plymouth boot splash..."
+
+PLYMOUTH_DIR="${ROOTFS}/usr/share/plymouth/themes/secubox"
+mkdir -p "${PLYMOUTH_DIR}"
+
+cat > "${PLYMOUTH_DIR}/secubox.plymouth" <<'PLYTHEME'
+[Plymouth Theme]
+Name=SecuBox Cyber
+Description=SecuBox VT100/DEC PDP-11 style boot splash
+ModuleName=script
+
+[script]
+ImageDir=/usr/share/plymouth/themes/secubox
+ScriptFile=/usr/share/plymouth/themes/secubox/secubox.script
+PLYTHEME
+
+cat > "${PLYMOUTH_DIR}/secubox.script" <<'PLYSCRIPT'
+# SecuBox Plymouth Theme - Raspberry Pi Edition
+Window.SetBackgroundTopColor(0.0, 0.0, 0.0);
+Window.SetBackgroundBottomColor(0.0, 0.05, 0.0);
+
+screen_width = Window.GetWidth();
+screen_height = Window.GetHeight();
+center_x = screen_width / 2;
+center_y = screen_height / 2;
+
+banner_text = "SECUBOX CYBER DEFENSE SYSTEM";
+banner_sprite = Sprite();
+banner_image = Image.Text(banner_text, 0.0, 1.0, 0.0, "Fixed");
+banner_sprite.SetImage(banner_image);
+banner_sprite.SetPosition(center_x - banner_image.GetWidth() / 2, center_y - 100, 1);
+
+version_text = "RASPBERRY PI 400 - SECURE BOOT SEQUENCE";
+version_sprite = Sprite();
+version_image = Image.Text(version_text, 0.0, 0.8, 0.0, "Fixed");
+version_sprite.SetImage(version_image);
+version_sprite.SetPosition(center_x - version_image.GetWidth() / 2, center_y - 60, 1);
+
+progress_sprite = Sprite();
+
+fun boot_progress_callback(duration, progress) {
+    fill_count = Math.Int(progress * 30);
+    fill_text = "";
+    for (i = 0; i < fill_count; i++) { fill_text = fill_text + "#"; }
+    for (i = fill_count; i < 30; i++) { fill_text = fill_text + " "; }
+    progress_text = "[" + fill_text + "]";
+    progress_image = Image.Text(progress_text, 0.0, 1.0, 0.0, "Fixed");
+    progress_sprite.SetImage(progress_image);
+    progress_sprite.SetPosition(center_x - progress_image.GetWidth() / 2, center_y + 20, 1);
+}
+
+Plymouth.SetBootProgressFunction(boot_progress_callback);
+
+message_sprite = Sprite();
+
+fun message_callback(text) {
+    message_image = Image.Text("> " + text, 0.0, 0.7, 0.0, "Fixed");
+    message_sprite.SetImage(message_image);
+    message_sprite.SetPosition(center_x - 200, center_y + 60, 1);
+}
+
+Plymouth.SetMessageFunction(message_callback);
+PLYSCRIPT
+
+mkdir -p "${ROOTFS}/etc/plymouth"
+cat > "${ROOTFS}/etc/plymouth/plymouthd.conf" <<EOF
+[Daemon]
+Theme=secubox
+ShowDelay=0
+EOF
+
+chroot "${ROOTFS}" plymouth-set-default-theme secubox 2>/dev/null || true
+
+mkdir -p "${ROOTFS}/etc/initramfs-tools/conf.d"
+echo "FRAMEBUFFER=y" > "${ROOTFS}/etc/initramfs-tools/conf.d/plymouth"
+
+ok "Plymouth theme installed"
+
 ok "System configured"
 
 # ══════════════════════════════════════════════════════════════════
@@ -221,9 +397,9 @@ EOF
 
 chroot "${ROOTFS}" apt-get update -q
 
-# Install firmware
+# Install firmware and Raspberry Pi boot files
 chroot "${ROOTFS}" apt-get install -y -q --no-install-recommends \
-  firmware-brcm80211 firmware-misc-nonfree \
+  raspi-firmware firmware-brcm80211 firmware-misc-nonfree \
   2>/dev/null || warn "Some firmware unavailable"
 
 # SecuBox packages from local cache
@@ -286,11 +462,15 @@ enable_uart=1
 #arm_freq=2000
 EOF
 
-# cmdline.txt
+# cmdline.txt (with splash for Plymouth)
 cat > "${ROOTFS}/boot/firmware/cmdline.txt" <<EOF
-console=serial0,115200 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait quiet
+console=serial0,115200 console=tty1 root=/dev/mmcblk0p2 rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait quiet splash
 EOF
 
+# Regenerate initramfs with Plymouth
+log "Regenerating initramfs with Plymouth..."
+chroot "${ROOTFS}" update-initramfs -u -k all 2>/dev/null || warn "initramfs update issue"
+
 ok "Pi bootloader configured"
 
 # ══════════════════════════════════════════════════════════════════
@@ -340,9 +520,9 @@ UUID=${BOOT_UUID}  /boot/firmware  vfat    defaults          0       2
 UUID=${ROOT_UUID}  /               ext4    defaults,noatime  0       1
 EOF
 
-# Update cmdline with UUID
+# Update cmdline with UUID (splash for Plymouth boot graphics)
 cat > "${MNT}/boot/firmware/cmdline.txt" <<EOF
-console=serial0,115200 console=tty1 root=UUID=${ROOT_UUID} rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait quiet
+console=serial0,115200 console=tty1 root=UUID=${ROOT_UUID} rootfstype=ext4 elevator=deadline fsck.repair=yes rootwait quiet splash
 EOF
 
 # Sync and unmount

image/sbin/secubox-cmdline-handler

@@ -4,7 +4,7 @@
 #  Parses kernel parameters for SecuBox-specific options
 #  Run early at boot before network configuration
 # ══════════════════════════════════════════════════════════════════
-set -euo pipefail
+set -u  # Exit on undefined variables, but allow command failures
 
 CMDLINE="${1:-/proc/cmdline}"
 MARKER_DIR="/var/lib/secubox"

image/sbin/secubox-net-detect

@@ -4,7 +4,7 @@
 #  Detects board type and configures WAN/LAN interfaces accordingly
 #  Supports: EspressoBin, MochaBin, x64 (VM/Bare-metal)
 # ══════════════════════════════════════════════════════════════════
-set -euo pipefail
+set -u  # Exit on undefined variables, but allow command failures
 
 SECUBOX_CONF="/etc/secubox/secubox.conf"
 NETPLAN_DIR="/etc/netplan"
@@ -339,7 +339,8 @@ main() {
             # Generate and apply netplan configuration
             generate_netplan "$board" "$wan_iface" "$lan_ifaces" "$sfp_ifaces" "$mode"
             log "Applying netplan..."
-            netplan apply 2>/dev/null || warn "netplan apply failed"
+            # Use timeout to prevent hanging
+            timeout 5 netplan apply 2>/dev/null || log "netplan apply skipped or failed"
             ok "Network configuration applied (mode: $mode)"
             ;;
         test)

image/systemd/secubox-cmdline.service

@@ -7,6 +7,7 @@ After=local-fs.target
 [Service]
 Type=oneshot
 RemainAfterExit=yes
+TimeoutStartSec=10s
 ExecStart=/usr/sbin/secubox-cmdline-handler apply
 
 [Install]

image/systemd/secubox-kiosk.service

@@ -1,6 +1,6 @@
 [Unit]
 Description=SecuBox Kiosk Mode (WebUI Display)
-After=network-online.target systemd-user-sessions.service
+After=systemd-user-sessions.service plymouth-quit-wait.service
 Wants=network-online.target
 Conflicts=getty@tty1.service
 
@@ -10,40 +10,49 @@ ConditionPathExists=/var/lib/secubox/.kiosk-enabled
 [Service]
 Type=simple
 
-# Run on tty1
-TTYPath=/dev/tty1
-StandardInput=tty
-StandardOutput=tty
-StandardError=journal
+# Run on tty7 (like normal display managers)
+TTYPath=/dev/tty7
+TTYReset=yes
+TTYVHangup=yes
+TTYVTDisallocate=yes
 
 # Create runtime directory AS ROOT (before switching to User)
 ExecStartPre=+/bin/mkdir -p /run/user/1000
 ExecStartPre=+/bin/chown 1000:1000 /run/user/1000
 ExecStartPre=+/bin/chmod 700 /run/user/1000
 
+# Switch VT to tty7 before starting
+ExecStartPre=+/bin/chvt 7
+
 # Now switch to kiosk user
 User=secubox-kiosk
 Group=secubox-kiosk
 
 # Wayland/DRM access
-SupplementaryGroups=video audio input render
+SupplementaryGroups=video audio input render tty
 
 # Environment for Wayland
 Environment=XDG_RUNTIME_DIR=/run/user/1000
 Environment=XDG_SESSION_TYPE=wayland
 Environment=KIOSK_URL=https://192.168.255.1:9443/
+Environment=WAYLAND_DISPLAY=wayland-0
 
 # wlroots environment (VM compatibility)
 Environment=WLR_LIBINPUT_NO_DEVICES=1
 Environment=WLR_NO_HARDWARE_CURSORS=1
 Environment=WLR_RENDERER_ALLOW_SOFTWARE=1
+Environment=WLR_DRM_NO_ATOMIC=1
 
-# Cage compositor running kiosk script (no -d flag, not supported in 0.1.4)
+# Cage compositor running kiosk script
 ExecStart=/usr/bin/cage -s -- /home/secubox-kiosk/start-kiosk.sh
 
 Restart=on-failure
 RestartSec=5
-TimeoutStartSec=60
+TimeoutStartSec=90
+
+# Resource limits
+MemoryMax=1G
+TasksMax=200
 
 [Install]
 WantedBy=graphical.target