diff --git a/src/main.c b/src/main.c
index cba576e..2a63e83 100644
--- a/src/main.c
+++ b/src/main.c
@@ -27,6 +27,7 @@
 #include "freertos/FreeRTOS.h"
 #include "freertos/idf_additions.h"
 #include "freertos/queue.h"
+#include "freertos/semphr.h"
 #include "freertos/task.h"
 #include "portal_page.h"
 #include "router_config.h"
@@ -63,6 +64,13 @@
 #define SINGMUX_CONTROL_BATCH_MAX 8
 #define SINGMUX_TCP_RX_QUEUE_DEPTH 24
 #define SINGMUX_TCP_DATA_MAX 2048
+/* A single forwarded stream may process this much before yielding.  The
+ * shared throttle below
+ * holds all streams that reach the boundary while the
+ * current owner sleeps, so many active
+ * browser connections cannot round-robin
+ * forever and starve both FreeRTOS idle tasks. */
+#define SINGMUX_RELAY_YIELD_BYTES (8 * 1024)
 #define UDP_MANAGER_BATCH_MAX 8
 #define OTA_UPLOAD_BUFFER_SIZE 1024
 #define BANDWIDTH_HISTORY_SECONDS 30
@@ -220,6 +228,7 @@ static bool    s_singmux_vless_response_pending;
  * for the owning relay to dequeue an item before retrying. */
 static bool                 s_singmux_rx_blocked;
 static TaskHandle_t         s_singmux_manager_task;
+static SemaphoreHandle_t    s_singmux_relay_throttle;
 static singmux_tcp_stream_t s_singmux_tcp_streams[SINGMUX_TCP_STREAM_MAX];
 static singmux_stats_t      s_singmux_stats;
 static uint32_t             s_upload_bps;
@@ -1895,6 +1904,30 @@ static bool singmux_tcp_close(int slot, uint32_t stream_id)
     return xTaskNotifyWait(0, UINT32_MAX, &answer, pdMS_TO_TICKS(1000)) == pdTRUE && answer;
 }
 
+/* Do not use taskYIELD() here: another ready priority-5 relay would simply
+ * run next and can
+ * still keep the idle task from feeding its watchdog.  By
+ * retaining this mutex for one tick,
+ * every relay that has exhausted its
+ * bounded batch is blocked together, leaving an actual idle
+ * opportunity. */
+static void singmux_relay_scheduler_pause(void)
+{
+    if (s_singmux_relay_throttle &&
+        xSemaphoreTake(s_singmux_relay_throttle, portMAX_DELAY) == pdTRUE)
+    {
+        s_singmux_stats.scheduler_yields++;
+        vTaskDelay(1);
+        xSemaphoreGive(s_singmux_relay_throttle);
+        return;
+    }
+    /* The TCP listener can accept a connection just before the persistent
+     * manager creates
+     * the throttle.  It must still yield in that small
+     * startup window. */
+    vTaskDelay(1);
+}
+
 static void relay_singmux_tcp_stream(int client, int slot)
 {
     if (slot < 0 || slot >= SINGMUX_TCP_STREAM_MAX)
@@ -1909,7 +1942,8 @@ static void relay_singmux_tcp_stream(int client, int slot)
     {
         return;
     }
-    bool detached = false;
+    bool   detached              = false;
+    size_t forwarded_since_yield = 0;
     for (;;)
     {
         fd_set reads;
@@ -1931,6 +1965,7 @@ static void relay_singmux_tcp_stream(int client, int slot)
             {
                 break;
             }
+            forwarded_since_yield += (size_t)count;
         }
         singmux_tcp_data_t *item = NULL;
         while (xQueueReceive(receive_queue, &item, 0) == pdTRUE)
@@ -1945,15 +1980,27 @@ static void relay_singmux_tcp_stream(int client, int slot)
                 goto done;
             }
             bool ok = socket_send_all(client, item->data, item->length);
+            forwarded_since_yield += item->length;
             free(item);
             if (!ok)
             {
                 goto close_stream;
             }
+            if (forwarded_since_yield >= SINGMUX_RELAY_YIELD_BYTES)
+            {
+                forwarded_since_yield = 0;
+                singmux_relay_scheduler_pause();
+            }
+        }
+        if (forwarded_since_yield >= SINGMUX_RELAY_YIELD_BYTES)
+        {
+            forwarded_since_yield = 0;
+            singmux_relay_scheduler_pause();
         }
         /* A full queue can happen when this AP client cannot accept data
-         * quickly enough.  It must close only this stream, never the shared
-         * session carrying unrelated browser connections. */
+         * quickly enough.
+         * It must close only this stream, never the shared session carrying unrelated browser
+         * connections. */
         if (s_singmux_tcp_streams[slot].peer_closed && uxQueueMessagesWaiting(receive_queue) == 0)
         {
             detached = singmux_tcp_close(slot, stream_id);
@@ -2853,14 +2900,17 @@ static void transparent_udp_manager_task(void *arg)
              * stopped accepting data. */
             smux_receive_burst = 0;
             ulTaskNotifyTake(pdTRUE, pdMS_TO_TICKS(20));
+            /* Keep a busy downstream relay from waking this same-priority
+             * manager
+             * repeatedly without giving either idle task a turn. */
+            singmux_relay_scheduler_pause();
         }
         else if (smux_receive_pending)
         {
             if (++smux_receive_burst >= 4)
             {
                 smux_receive_burst = 0;
-                s_singmux_stats.scheduler_yields++;
-                vTaskDelay(1);
+                singmux_relay_scheduler_pause();
             }
         }
         else
@@ -2883,9 +2933,10 @@ static void transparent_udp_server_task(void *arg)
         ESP_LOGE(TAG, "transparent UDP relay listener failed");
         vTaskDelete(NULL);
     }
-    s_udp_manager_queue     = xQueueCreate(UDP_MANAGER_QUEUE_DEPTH, sizeof(udp_ingress_t));
-    s_singmux_control_queue = xQueueCreate(SINGMUX_CONTROL_QUEUE_DEPTH, sizeof(singmux_control_t));
-    if (!s_udp_manager_queue || !s_singmux_control_queue)
+    s_udp_manager_queue      = xQueueCreate(UDP_MANAGER_QUEUE_DEPTH, sizeof(udp_ingress_t));
+    s_singmux_control_queue  = xQueueCreate(SINGMUX_CONTROL_QUEUE_DEPTH, sizeof(singmux_control_t));
+    s_singmux_relay_throttle = xSemaphoreCreateMutex();
+    if (!s_udp_manager_queue || !s_singmux_control_queue || !s_singmux_relay_throttle)
     {
         ESP_LOGE(TAG, "persistent XUDP/smux manager queue allocation failed");
         vTaskDelete(NULL);
diff --git a/src/portal_page.c b/src/portal_page.c
index 61a5fc2..c10c347 100644
--- a/src/portal_page.c
+++ b/src/portal_page.c
@@ -9,13 +9,18 @@ const char *portal_page_html(void)
         "1rem;color:#17212b}h1{color:#0b6e4f}fieldset{border:1px solid "
         "#ccd5df;border-radius:8px;margin:1rem 0;padding:1rem}label{display:block;margin:.65rem "
         "0}.hint{color:#59636e;font-size:.9rem}input,select{box-sizing:border-box;width:100%;"
-        "padding:.6rem;margin-top:.2rem}.check{display:flex;align-items:center;gap:.4rem}.check input{width:auto;"
+        "padding:.6rem;margin-top:.2rem}.check{display:flex;align-items:center;gap:.4rem}.check "
+        "input{width:auto;"
         "padding:0;margin:0}button{padding:.65rem "
         "1rem;background:#0b6e4f;color:white;border:0;border-radius:5px;font-weight:600}#status{"
-        "margin-top:1rem}.dashboard{display:grid;grid-template-columns:repeat(auto-fit,minmax(200px,"
+        "margin-top:1rem}.dashboard{display:grid;grid-template-columns:repeat(auto-fit,minmax("
+        "200px,"
         "1fr));gap:.7rem;margin:1rem 0}.status-card{border:1px solid #ccd5df;border-radius:8px;"
-        "padding:.8rem;background:#f8fafc}.status-card h2{font-size:.9rem;margin:0 0 .45rem;color:#0b6e4f}.status-card "
-        "b,.status-card span{display:block;line-height:1.5}.status-card span{color:#59636e;font-size:.88rem}.metrics{display:grid;grid-template-columns:repeat(auto-fit,minmax(220px,"
+        "padding:.8rem;background:#f8fafc}.status-card h2{font-size:.9rem;margin:0 0 "
+        ".45rem;color:#0b6e4f}.status-card "
+        "b,.status-card span{display:block;line-height:1.5}.status-card "
+        "span{color:#59636e;font-size:.88rem}.metrics{display:grid;grid-template-columns:repeat("
+        "auto-fit,minmax(220px,"
         "1fr));"
         "gap:1rem}.chart{border:1px solid #ccd5df;border-radius:8px;padding:.65rem}.chart h3{"
         "margin:0 0 .4rem;font-size:1rem}.chart "
@@ -39,14 +44,19 @@ const char *portal_page_html(void)
         "type=password autocomplete=new-password minlength=12 maxlength=64 required></label>"
         "<button type=button id=save_admin_password>Change portal password</button></fieldset>"
         "<fieldset><legend>Upstream Wi-Fi</legend><label>Saved upstreams<select "
-        "id=saved_upstreams><option value=''>No saved upstreams</option></select></label><label>Network<select "
+        "id=saved_upstreams><option value=''>No saved "
+        "upstreams</option></select></label><label>Network<select "
         "id=net><option value=''>Scan networks...</option></select></label><label>SSID<input "
         "required name=ssid id=ssid maxlength=32></label><label>Password<input name=password "
-        "id=password type=password maxlength=64 placeholder='Leave blank to keep the saved password for this SSID'></label>"
-        "<label class=check><input name=open_network id=open_network type=checkbox>Open/public network (no password)</label>"
-        "<p class=hint>Saving the same SSID again moves it to the top of the saved upstream list. The latest 10 upstream profiles are kept.</p>"
+        "id=password type=password maxlength=64 placeholder='Leave blank to keep the saved "
+        "password for this SSID'></label>"
+        "<label class=check><input name=open_network id=open_network type=checkbox>Open/public "
+        "network (no password)</label>"
+        "<p class=hint>Saving the same SSID again moves it to the top of the saved upstream list. "
+        "The latest 10 upstream profiles are kept.</p>"
         "<button type=button id=scan>Scan Wi-Fi</button> <button type=button "
-        "id=save_upstream>Save upstream Wi-Fi</button> <button type=button id=delete_upstream>Delete selected upstream</button></fieldset><fieldset><legend>VLESS "
+        "id=save_upstream>Save upstream Wi-Fi</button> <button type=button "
+        "id=delete_upstream>Delete selected upstream</button></fieldset><fieldset><legend>VLESS "
         "(TCP)</legend><label>VLESS URI<input name=vless_uri id=vless_uri maxlength=255 "
         "placeholder='vless://UUID@host:port?encryption=none&type=tcp'></label><p class=hint>Paste "
         "a plain VLESS TCP URI, or fill in the fields below.</p><label>Server host/IP<input "
@@ -55,7 +65,8 @@ const char *portal_page_html(void)
         "name=uuid id=uuid type=password autocomplete=off maxlength=47 placeholder='Saved UUID is "
         "hidden; leave blank to keep it'></label><label>DNS resolver hostname<input "
         "name=dns_resolver id=dns_resolver maxlength=253 placeholder='one.one.one.one (factory "
-        "default)'></label><label class=check><input name=singmux_enabled id=singmux_enabled type=checkbox>"
+        "default)'></label><label class=check><input name=singmux_enabled id=singmux_enabled "
+        "type=checkbox>"
         "Enable sing-box smux multiplex transport</label><p class=hint>Enable only when the VLESS "
         "server has sing-box multiplexing enabled. It shares one VLESS TCP session for transparent "
         "TCP streams and persistent UDP associations; disable it for servers without sing-box "
@@ -66,62 +77,159 @@ const char *portal_page_html(void)
         "the ESP image, switches to it, then reboots. Do not upload the full <code>0x0</code> web-"
         "flash image here.</p><label>OTA firmware<input id=ota_file type=file accept=.bin "
         "required></label><button type=button id=install_ota>Install update and reboot</button>"
-        "</fieldset><section class=metrics><div class=chart><h3 id=bandwidth_title>Routed payload bandwidth</h3>"
+        "</fieldset><section class=metrics><div class=chart><h3 id=bandwidth_title>Routed payload "
+        "bandwidth</h3>"
         "<canvas id=bandwidth_chart aria-label='Recent upload and download bandwidth'></canvas>"
         "<p class=hint id=bandwidth_summary>Collecting samples...</p></div><div class=chart><h3>"
         "Tunnel pressure</h3><canvas id=pressure_chart aria-label='Recent XUDP and smux pressure'>"
-        "</canvas><p class=hint id=pressure_summary>Collecting samples...</p></div><div class=chart><h3>Chip temperature</h3><canvas id=temperature_chart aria-label='Recent chip temperature'></canvas><p class=hint id=temperature_summary>Collecting samples...</p></div><div class=chart><h3>CPU load by core</h3><canvas id=cpu_chart aria-label='Recent CPU load by core'></canvas><p class=hint id=cpu_summary>Collecting samples...</p></div></section><p "
+        "</canvas><p class=hint id=pressure_summary>Collecting samples...</p></div><div "
+        "class=chart><h3>Chip temperature</h3><canvas id=temperature_chart aria-label='Recent chip "
+        "temperature'></canvas><p class=hint id=temperature_summary>Collecting "
+        "samples...</p></div><div class=chart><h3>CPU load by core</h3><canvas id=cpu_chart "
+        "aria-label='Recent CPU load by core'></canvas><p class=hint id=cpu_summary>Collecting "
+        "samples...</p></div></section><p "
         "class=hint "
         "id=version>Firmware: loading...</p>"
         "<script>const "
-        "q=s=>document.querySelector(s),st=q('#status'),histories={vless:[],direct:[]},deviceHistory=[],historyLimit=60,rate=n=>(n/"
+        "q=s=>document.querySelector(s),st=q('#status'),histories={vless:[],direct:[]},"
+        "deviceHistory=[],historyLimit=60,rate=n=>(n/"
         "1024).toFixed(1)+' "
-        "KiB/s',size=n=>(n/1024).toFixed(1)+' KiB';let currentConfig=null,scanInProgress=false,refreshInProgress=false;function syncOpenNetwork(){let open=q('#open_network').checked,p=q('#password');if(open){p.value='';p.disabled=true}else p.disabled=false}function renderSavedUpstreams(c){let s=q('#saved_upstreams'),n=c.upstream_networks||[],signature=JSON.stringify(n);if(s.dataset.upstreams===signature)return;let selected=s.value;s.options.length=0;s.add(new Option('Saved upstream profiles',''));n.forEach(x=>s.add(new Option(x.ssid+(x.open?' (open)':''),x.ssid)));s.value=n.some(x=>x.ssid===selected)?selected:(c.ssid||'');s.dataset.upstreams=signature}const render=c=>{currentConfig=c;renderSavedUpstreams(c);syncOpenNetwork();q('#network')."
-        "innerHTML='<article class=status-card><h2>Upstream</h2><b>'+(c.connected?'Connected':'Not connected')+'</b><span>IP: '+(c.ip||'—')+'</span><span>Gateway: '+(c.gateway||'—')+'</span><span>DNS: '+(c.dns||'—')+'</span></article><article class=status-card><h2>Routing</h2><span>Mode: '+c.mode+'</span><span>Upload: '+rate(c.up_bps)+'</span><span>Download: '+rate(c.down_bps)+'</span><span>Rolling 10s up/down: '+rate(c.up_bps_10s)+' / '+rate(c.down_bps_10s)+'</span><span>Rolling 30s up/down: '+rate(c.up_bps_30s)+' / '+rate(c.down_bps_30s)+'</span></article><article class=status-card><h2>Tunnel</h2><span>XUDP: '+c.xudp_active+'/56</span><span>Queue: '+c.xudp_queued+'/160, drops: '+c.xudp_dropped+'</span><span>Mux: '+(c.singmux_enabled?(c.singmux_connected?'connected':'waiting'):'off')+'</span><span>TCP streams: '+c.singmux_tcp_active+'/'+c.transparent_tcp_max+'</span><span>Sessions open/closed: '+c.singmux_sessions_opened+'/'+c.singmux_sessions_closed+' (EOF '+c.singmux_close_eof+', protocol '+c.singmux_close_protocol_error+')</span><span>TCP RX queue: high '+c.singmux_tcp_rx_queue_high_water+'/24, full '+c.singmux_tcp_rx_queue_full+'</span></article><article class=status-card><h2>Device</h2><span>CPU clock: '+c.cpu_frequency_mhz+' MHz</span><span>Chip: '+c.chip_temperature_c.toFixed(1)+' °C</span><span>CPU core 0: '+c.cpu_load_core0+'%</span><span>CPU core 1: '+c.cpu_load_core1+'%</span></article><article class=status-card><h2>Memory</h2><span>Internal free: '+size(c.free_internal)+'</span><span>Largest internal block: '+size(c.largest_internal_block)+'</span><span>PSRAM free: '+size(c.free_psram)+'</span><span>Total free: '+size(c.free_total)+'</span></article>';let route=c.mode==='transparent-upstream'?'direct':'vless',history=histories[route],label=route==='direct'?'Direct':'VLESS';q('#bandwidth_title').textContent=label+' payload bandwidth';history.push({up:c.up_bps,down:c.down_bps,xudp:"
+        "KiB/s',size=n=>(n/1024).toFixed(1)+' KiB';let "
+        "currentConfig=null,scanInProgress=false,refreshInProgress=false;function "
+        "syncOpenNetwork(){let "
+        "open=q('#open_network').checked,p=q('#password');if(open){p.value='';p.disabled=true}else "
+        "p.disabled=false}function renderSavedUpstreams(c){let "
+        "s=q('#saved_upstreams'),n=c.upstream_networks||[],signature=JSON.stringify(n);if(s."
+        "dataset.upstreams===signature)return;let selected=s.value;s.options.length=0;s.add(new "
+        "Option('Saved upstream profiles',''));n.forEach(x=>s.add(new Option(x.ssid+(x.open?' "
+        "(open)':''),x.ssid)));s.value=n.some(x=>x.ssid===selected)?selected:(c.ssid||'');s."
+        "dataset.upstreams=signature}const "
+        "render=c=>{currentConfig=c;renderSavedUpstreams(c);syncOpenNetwork();q('#network')."
+        "innerHTML='<article class=status-card><h2>Upstream</h2><b>'+(c.connected?'Connected':'Not "
+        "connected')+'</b><span>IP: '+(c.ip||'—')+'</span><span>Gateway: "
+        "'+(c.gateway||'—')+'</span><span>DNS: '+(c.dns||'—')+'</span></article><article "
+        "class=status-card><h2>Routing</h2><span>Mode: '+c.mode+'</span><span>Upload: "
+        "'+rate(c.up_bps)+'</span><span>Download: '+rate(c.down_bps)+'</span><span>Rolling 10s "
+        "up/down: '+rate(c.up_bps_10s)+' / '+rate(c.down_bps_10s)+'</span><span>Rolling 30s "
+        "up/down: '+rate(c.up_bps_30s)+' / '+rate(c.down_bps_30s)+'</span></article><article "
+        "class=status-card><h2>Tunnel</h2><span>XUDP: '+c.xudp_active+'/56</span><span>Queue: "
+        "'+c.xudp_queued+'/160, drops: '+c.xudp_dropped+'</span><span>Mux: "
+        "'+(c.singmux_enabled?(c.singmux_connected?'connected':'waiting'):'off')+'</span><span>TCP "
+        "streams: '+c.singmux_tcp_active+'/'+c.transparent_tcp_max+'</span><span>Sessions "
+        "open/closed: '+c.singmux_sessions_opened+'/'+c.singmux_sessions_closed+' (EOF "
+        "'+c.singmux_close_eof+', protocol '+c.singmux_close_protocol_error+')</span><span>TCP RX "
+        "queue: high '+c.singmux_tcp_rx_queue_high_water+'/24, full "
+        "'+c.singmux_tcp_rx_queue_full+'</span></article><article "
+        "class=status-card><h2>Device</h2><span>CPU clock: '+c.cpu_frequency_mhz+' "
+        "MHz</span><span>Chip: '+c.chip_temperature_c.toFixed(1)+' °C</span><span>CPU core 0: "
+        "'+c.cpu_load_core0+'%</span><span>CPU core 1: "
+        "'+c.cpu_load_core1+'%</span></article><article "
+        "class=status-card><h2>Memory</h2><span>Internal free: "
+        "'+size(c.free_internal)+'</span><span>Largest internal block: "
+        "'+size(c.largest_internal_block)+'</span><span>PSRAM free: "
+        "'+size(c.free_psram)+'</span><span>Total free: "
+        "'+size(c.free_total)+'</span></article>';let "
+        "route=c.mode==='transparent-upstream'?'direct':'vless',history=histories[route],label="
+        "route==='direct'?'Direct':'VLESS';q('#bandwidth_title').textContent=label+' payload "
+        "bandwidth';history.push({up:c.up_bps,down:c.down_bps,xudp:"
         "c.xudp_active,queue:c.xudp_queued,mux:c.singmux_tcp_active});if(history.length>"
         "historyLimit)"
-        "history.shift();deviceHistory.push({temperature:c.chip_temperature_c,cpu0:c.cpu_load_core0,cpu1:c.cpu_load_core1});if(deviceHistory.length>historyLimit)deviceHistory.shift();chart('temperature_chart',['Chip °C'],['#dc2626'],deviceHistory.map(x=>x.temperature));chart('cpu_chart',['Core 0','Core 1'],['#2563eb','#7c3aed'],deviceHistory.map(x=>x.cpu0),deviceHistory.map(x=>x.cpu1));chart('bandwidth_chart',['Upload','Download'],['#d97706','#0b6e4f'],"
+        "history.shift();deviceHistory.push({temperature:c.chip_temperature_c,cpu0:c.cpu_load_"
+        "core0,cpu1:c.cpu_load_core1});if(deviceHistory.length>historyLimit)deviceHistory.shift();"
+        "chart('temperature_chart',['Chip "
+        "°C'],['#dc2626'],deviceHistory.map(x=>x.temperature));chart('cpu_chart',['Core 0','Core "
+        "1'],['#2563eb','#7c3aed'],deviceHistory.map(x=>x.cpu0),deviceHistory.map(x=>x.cpu1));"
+        "chart('bandwidth_chart',['Upload','Download'],['#d97706','#0b6e4f'],"
         "history.map(x=>x.up),history.map(x=>x.down));chart('pressure_chart',['XUDP associations',"
         "'Ingress queue','Mux TCP streams'],['#2563eb','#d97706','#7c3aed'],history.map(x=>x.xudp),"
         "history.map(x=>x.queue),history.map(x=>x.mux));q('#bandwidth_summary').textContent='Last "
-        "'+history.length+' seconds ('+label+'): upload '+rate(c.up_bps)+', download '+rate(c.down_bps)+'.';"
-        "q('#temperature_summary').textContent='Current chip temperature: '+c.chip_temperature_c.toFixed(1)+' °C.';q('#cpu_summary').textContent='Current CPU: core 0 '+c.cpu_load_core0+'%, core 1 '+c.cpu_load_core1+'%.';"
+        "'+history.length+' seconds ('+label+'): upload '+rate(c.up_bps)+', download "
+        "'+rate(c.down_bps)+'.';"
+        "q('#temperature_summary').textContent='Current chip temperature: "
+        "'+c.chip_temperature_c.toFixed(1)+' °C.';q('#cpu_summary').textContent='Current CPU: core "
+        "0 '+c.cpu_load_core0+'%, core 1 '+c.cpu_load_core1+'%.';"
         "q('#pressure_summary').textContent='Current: '+c.xudp_active+' XUDP associations, '+"
         "c.xudp_queued+' queued datagrams, '+c.singmux_tcp_active+' mux TCP streams.';"
         "q('#version').textContent='Firmware: '+c.firmware_version};function "
+        "niceCeil(v){let p=Math.pow(10,Math.floor(Math.log10(v))),n=v/p,"
+        "steps=[1,1.25,1.5,2,2.5,3,4,5,6,8,10],m=steps.find(x=>x>=n);return (m||10)*p}function "
+        "niceStep(v){let "
+        "p=Math.pow(10,Math.floor(Math.log10(v))),n=v/p,m=n>=5?5:n>=2.5?2.5:n>=2?2:1;return "
+        "m*p}function "
+        "axisLabel(v){if(v<1024)return String(Math.round(v));let k=v/1024;return "
+        "(Number.isInteger(k)?k:k.toFixed(1))+'K'}function "
         "chart(id,names,colors,..."
         "sets){let "
         "e=q('#'+id),d=devicePixelRatio||1,w=e.clientWidth||300,h=e.clientHeight||145;if(e.width"
         "!=w*d||e.height!=h*d){e.width=w*d;e.height=h*d}let "
         "x=e.getContext('2d');x.setTransform(d,0,0,d,0,0);"
         "x.clearRect(0,0,w,h);let "
-        "all=sets.flat(),top=Math.max(1,...all),pad=24;x.strokeStyle='#d8dee6';"
-        "x.lineWidth=1;for(let i=0;i<4;i++){let "
-        "y=pad+i*(h-pad-30)/3;x.beginPath();x.moveTo(pad,y);x.lineTo(w,y);"
-        "x.stroke()}x.fillStyle='#59636e';x.font='11px "
-        "system-ui';x.fillText(top>=1024?(top/1024).toFixed(1)+'K':top,"
-        "0,pad+4);x.fillText('0',8,h-18);sets.forEach((set,j)=>{if(!set.length)return;x."
+        "all=sets.flat(),bandwidth=id==='bandwidth_chart',axis=bandwidth?all.map(v=>v/"
+        "1024):all,bottom=0,top=niceCeil(Math.max(1,...axis)),step=niceStep(top/"
+        "4),lines=Math.round(top/"
+        "step),pad=38,temperature=id==='temperature_chart';if(bandwidth){step=niceCeil(Math.max(1,."
+        "..axis)/4);top=step*4;lines=4}if(temperature){let "
+        "lo=Math.min(...axis),hi=Math.max(...axis);bottom=Math.max(0,Math.floor((lo-2)/"
+        "5)*5);top=Math.ceil((hi+2)/5)*5;if(top-bottom<10){if(bottom>=5)bottom=top-10;else "
+        "top=10}step=5;lines=Math.round((top-bottom)/step)}let "
+        "gridLines=lines+1;x.strokeStyle='#d8dee6';"
+        "x.lineWidth=1;x.fillStyle='#59636e';x.font='11px system-ui';for(let "
+        "i=0;i<gridLines;i++){let "
+        "value=top-i*step,y=pad+i*(h-pad-30)/"
+        "(gridLines-1);x.beginPath();x.moveTo(pad,y);x.lineTo(w,y);"
+        "x.stroke();x.fillText(bandwidth?(Number.isInteger("
+        "value)?value:value.toFixed(1))+'K':axisLabel(value)+(temperature?'°C':''),2,y+4)}sets."
+        "forEach((set,j)=>"
+        "{if(!set.length)"
+        "return;x."
         "strokeStyle=colors[j];"
         "x.lineWidth=2;x.beginPath();set.forEach((v,i)=>{let "
         "px=pad+(w-pad-4)*(i/Math.max(1,historyLimit-1)),"
-        "py=pad+(h-pad-30)*(1-v/top);i?x.lineTo(px,py):x.moveTo(px,py)});x.stroke()});let lx=pad;"
+        "py=pad+(h-pad-30)*(top-(bandwidth?v/1024:v))/"
+        "(top-bottom);i?x.lineTo(px,py):x.moveTo(px,py)});x.stroke()});let lx=pad;"
         "names.forEach((name,i)=>{x.fillStyle=colors[i];x.fillRect(lx,4,9,9);x.fillStyle='#59636e';"
         "x.fillText(name,lx+13,"
         "13);lx+=x.measureText(name).width+30})}async function load(){let c=await(await "
         "fetch('/api/config',{cache:'no-store'})).json();for(let k in c){let "
         "e=q('#'+k);if(e){if(e.type==='checkbox')e.checked=!!c[k];else "
-        "e.value=c[k]||''}}render(c);if(Array.isArray(c.scan_results))showNetworks(q('#net'),c.scan_results)}function showNetworks(s,n){if(!Array.isArray(n))throw Error('Invalid scan response');s.options.length=0;if(n.length){s.add(new Option('Select a network',''));n.forEach(x=>{s.add(new Option(x.ssid+' ('+x.rssi+' dBm)',x.ssid))})}else s.add(new Option('No networks found',''));st.textContent='Found '+n.length+' network(s).'}async function scan(){let s=q('#net');scanInProgress=true;s.options.length=0;"
-        "s.add(new Option('Scanning networks...',''));s.disabled=true;st.textContent='Scanning...';try{let "
-        "r=await fetch('/api/scan',{cache:'no-store'});if(!r.ok)throw Error(await r.text());showNetworks(s,await r.json())}catch(e){st.textContent='Scan completed; reloading saved results...';setTimeout(()=>location.reload(),2500)}finally{s.disabled=false;scanInProgress=false}}async function "
+        "e.value=c[k]||''}}render(c);if(Array.isArray(c.scan_results))showNetworks(q('#net'),c."
+        "scan_results)}function showNetworks(s,n){if(!Array.isArray(n))throw Error('Invalid scan "
+        "response');s.options.length=0;if(n.length){s.add(new Option('Select a "
+        "network',''));n.forEach(x=>{s.add(new Option(x.ssid+' ('+x.rssi+' dBm)',x.ssid))})}else "
+        "s.add(new Option('No networks found',''));st.textContent='Found '+n.length+' "
+        "network(s).'}async function scan(){let s=q('#net');scanInProgress=true;s.options.length=0;"
+        "s.add(new Option('Scanning "
+        "networks...',''));s.disabled=true;st.textContent='Scanning...';try{let "
+        "r=await fetch('/api/scan',{cache:'no-store'});if(!r.ok)throw Error(await "
+        "r.text());showNetworks(s,await r.json())}catch(e){st.textContent='Scan completed; "
+        "reloading saved "
+        "results...';setTimeout(()=>location.reload(),2500)}finally{s.disabled=false;"
+        "scanInProgress=false}}async function "
         "save(url,names){try{let d=new URLSearchParams;names.forEach(n=>{let "
         "e=q('#'+n);d.append(n,e.type==='checkbox'?(e.checked?'1':'0'):e.value)});let r=await "
         "fetch(url,{method:'POST',headers:{'Content-Type':'application/"
         "x-www-form-urlencoded'},body:d});if(!r.ok)throw Error(await "
         "r.text());st.textContent=(await "
         "r.json()).message;setTimeout(load,1000)}catch(e){st.textContent='Save failed: "
-        "'+e.message}}async function delUpstream(){let ssid=q('#saved_upstreams').value||q('#ssid').value;if(!ssid){st.textContent='Select a saved upstream to delete.';return}if(!confirm('Delete saved upstream '+ssid+'?'))return;try{let d=new URLSearchParams;d.append('ssid',ssid);let r=await fetch('/api/upstream-delete',{method:'POST',headers:{'Content-Type':'application/x-www-form-urlencoded'},body:d});if(!r.ok)throw Error(await r.text());st.textContent=(await r.json()).message;setTimeout(load,1000)}catch(e){st.textContent='Delete failed: '+e.message}}q('#scan').onclick=scan;q('#open_network').onchange=syncOpenNetwork;q('#saved_upstreams').onchange=e=>{let v=e.target.value,x=(currentConfig&&currentConfig.upstream_networks||[]).find(n=>n.ssid===v);if(!x)return;q('#ssid').value=x.ssid;q('#open_network').checked=!!x.open;syncOpenNetwork();q('#password').value=''};q('#net').onchange=e=>{q('#ssid').value=e.target.value;q('#open_network').checked=false;syncOpenNetwork()};q('#save_ap').onclick=()=>save('/api/"
-        "access-point',['ap_ssid','ap_password','ap_ip']);q('#save_upstream').onclick=()=>save('/api/"
-        "upstream',['ssid','password','open_network']);q('#delete_upstream').onclick=delUpstream;q('#save_admin_password').onclick=()=>save('/api/"
+        "'+e.message}}async function delUpstream(){let "
+        "ssid=q('#saved_upstreams').value||q('#ssid').value;if(!ssid){st.textContent='Select a "
+        "saved upstream to delete.';return}if(!confirm('Delete saved upstream "
+        "'+ssid+'?'))return;try{let d=new URLSearchParams;d.append('ssid',ssid);let r=await "
+        "fetch('/api/upstream-delete',{method:'POST',headers:{'Content-Type':'application/"
+        "x-www-form-urlencoded'},body:d});if(!r.ok)throw Error(await "
+        "r.text());st.textContent=(await "
+        "r.json()).message;setTimeout(load,1000)}catch(e){st.textContent='Delete failed: "
+        "'+e.message}}q('#scan').onclick=scan;q('#open_network').onchange=syncOpenNetwork;q('#"
+        "saved_upstreams').onchange=e=>{let "
+        "v=e.target.value,x=(currentConfig&&currentConfig.upstream_networks||[]).find(n=>n.ssid==="
+        "v);if(!x)return;q('#ssid').value=x.ssid;q('#open_network').checked=!!x.open;"
+        "syncOpenNetwork();q('#password').value=''};q('#net').onchange=e=>{q('#ssid').value=e."
+        "target.value;q('#open_network').checked=false;syncOpenNetwork()};q('#save_ap').onclick=()="
+        ">save('/api/"
+        "access-point',['ap_ssid','ap_password','ap_ip']);q('#save_upstream').onclick=()=>save('/"
+        "api/"
+        "upstream',['ssid','password','open_network']);q('#delete_upstream').onclick=delUpstream;q("
+        "'#save_admin_password').onclick=()=>save('/api/"
         "admin-password',"
         "['current_admin_password','new_admin_password']);q('#save_vless').onclick=()=>save('/api/"
         "vless',['vless_uri','host','port','uuid','dns_resolver','singmux_enabled']);q('#install_"
@@ -135,8 +243,10 @@ const char *portal_page_html(void)
         "Error(await r.text());st.textContent=(await "
         "r.json()).message}catch(e){st.textContent='OTA "
         "update failed: '+e.message}};load();"
-        "setInterval(()=>{if(scanInProgress||refreshInProgress)return;refreshInProgress=true;fetch('/api/"
+        "setInterval(()=>{if(scanInProgress||refreshInProgress)return;refreshInProgress=true;fetch("
+        "'/api/"
         "config',{cache:'no-store'}).then(r=>r.json()).then(render).catch(()=>q('#network')."
-        "textContent='Router status refresh failed').finally(()=>refreshInProgress=false)},1000);</script></body></html>";
+        "textContent='Router status refresh "
+        "failed').finally(()=>refreshInProgress=false)},1000);</script></body></html>";
     return page;
 }