Panel runs as betterdesk and cannot rewrite /etc/systemd/system/*.service.
Write ALLOW_SHARED_NAT_INITIATOR and related flags through the fixed root
broker into a service.d drop-in so Settings no longer fails with EACCES.
Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Add opt-in OPERATOR_ONLY_OUTBOUND enforcement for PunchHole and RequestRelay, including live role checks, decision auditing, panel RBAC, settings, documentation, and regression tests.\n\nRefs #425\n\nThanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
Sync all 26 locale files to the EN+PL baseline (3432 keys), add OBSIDIAN tier strings, and ship i18n apply/audit tooling. Improve server attestation UX and convert orphaned node:test scripts to Jest so the full test suite passes.
Expose global connection strategy in the web panel with systemd/Docker persistence, extend server health diagnostics, enforce org network policy in the signal handler, and document when relay fallback is expected vs misconfiguration.