diff --git a/.gitignore b/.gitignore
index 571cdcf..4b5c56d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -10,6 +10,7 @@ __pycache__/
 *.env
 !*.example.env
 *.secret
+*.env.before-fix-*
 *.sqlite
 *.sqlite3
 *.sqlite-wal
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ad6024..6016e38 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,31 @@
 All notable changes to VesselStack are documented here. The project follows
 Semantic Versioning.
 
+## 0.6.1 - 2026-11-02
+
+### Highlights
+
+- Upgrades and installs now offer to fix an unsupported units setting or an unsafe saved value at the prompt, instead of stopping; unattended runs still stop safely and print the exact fix. Each fix keeps a root-only `*.before-fix-*` copy of the previous settings file, which you can delete once the install works.
+- The Control Panel shows the exact fix when an update or backup stops for something you can fix (for example an unmounted backup drive).
+- When the backup drive isn't mounted, updates and backups offer to mount it, pick a connected USB drive, check again, or back up to the system disk once, instead of stopping.
+
+### Fixes
+
+- The backup-drive menu now lists a USB drive that has no label (its columns were shifted, so the wrong value reached `mount`), accepts only exactly one listed answer (`1 2` is asked again, never guessed), and is not offered drives that `/etc/fstab` assigns to another mount point. An empty list says how to unmount a drive your desktop already mounted.
+- Fresh installs started with `--yes`, `--defaults` or scripted answers no longer let the installer ask questions.
+- A drive mounted from the menu is checked before anything is written: its top folder must be owned by root and not writable by others, and no folder on the way to the backup folder may be a symbolic link or belong to another user.
+- The prompt library, its parent folders and the folder of a settings file being fixed must be root-controlled; the scripted-answers test hook (`VESSELSTACK_PROMPT_ANSWERS`) is read only from a private file you own. `vesselstackctl uninstall` also removes the prompt library.
+
+- Upgrading a boat whose settings say `BOAT_UNITS=nautical` (offered by older setup wizards) no
+  longer stops the update; it is read as metric, and knots and nautical miles are kept.
+- A clearer message, naming the file and the fix, for any other unsupported `BOAT_UNITS` value.
+
+### Release status
+
+`v0.6.1` is an SSH-signed tag verified by the release workflow against `.github/allowed_signers`.
+It is published first as a pre-release and marked Latest after the maintainer's physical
+Raspberry Pi install passes.
+
 ## 0.6.0 - 2026-11-02
 
 ### Highlights
diff --git a/README.md b/README.md
index bf7d293..a6bba0a 100644
--- a/README.md
+++ b/README.md
@@ -157,18 +157,18 @@ session), run the pinned release installer and answer the questions in the same
 
 ```bash
 ssh -t YOUR_USER@raspberrypi.local
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
 ```
 
-The same release is also selected by `VESSELSTACK_VERSION=0.6.0` or `--version 0.6.0`:
+The same release is also selected by `VESSELSTACK_VERSION=0.6.1` or `--version 0.6.1`:
 
 ```bash
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo VESSELSTACK_VERSION=0.6.0 bash
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash -s -- --version 0.6.0
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo VESSELSTACK_VERSION=0.6.1 bash
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash -s -- --version 0.6.1
 ```
 
 > [!NOTE]
-> The pinned URL names the release explicitly, so it installs exactly 0.6.0 whatever
+> The pinned URL names the release explicitly, so it installs exactly 0.6.1 whatever
 > GitHub marks as Latest. The form `https://github.com/jclima/VesselStack/releases/latest/download/get-vesselstack.sh`
 > points to whichever release GitHub marks Latest, which is not necessarily the newest
 > one (every 0.5.x release was published as a prerelease, so that URL kept serving
@@ -215,10 +215,10 @@ that does not point at the exact commit being built, before building anything. T
 
 ```bash
 # defaults, plus the settings you name (repeat --set; names as in vesselstack.example.env)
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh \
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh \
   | sudo bash -s -- --yes --set BOAT_NAME=Foo --set SOCKETCAN_ENABLE=true
 # every question's own default answer, nothing asked
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash -s -- --defaults
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash -s -- --defaults
 # a ready-made vesselstack.env (optionally with --set overrides)
 sudo bash get-vesselstack.sh --yes --config ./vesselstack.env --set BOAT_NAME=Foo
 ```
@@ -357,8 +357,8 @@ script is wrapped in functions and ends with a single `main "$@"` call, so a
 truncated download cannot half-run. If you prefer to read it first (recommended):
 
 ```bash
-curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh
-curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh.sha256
+curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh
+curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh.sha256
 sha256sum -c get-vesselstack.sh.sha256
 less get-vesselstack.sh
 sudo bash get-vesselstack.sh
@@ -380,7 +380,7 @@ from the end-to-end guide:
 ```bash
 git clone https://github.com/jclima/VesselStack.git
 cd VesselStack
-git checkout v0.6.0
+git checkout v0.6.1
 python3 vesselstack-wizard.py --cli     # terminal questions (no browser)
 # python3 vesselstack-wizard.py        # or the optional browser wizard
 ```
@@ -427,7 +427,66 @@ before carrying an update to a boat without internet access.
 ## Upgrading to 0.6.0
 
 Read this before updating an installed system. Update from [Updating](#updating) with a backup
-on a mounted external drive, not while underway.
+on a mounted external drive, not while underway. This section applies to 0.6.0 and 0.6.1.
+
+**Settings that say `BOAT_UNITS=nautical` (fixed in 0.6.1).** Older setup wizards offered
+"nautical" as a units choice, and installers before 0.5.7 did not check it, so such a
+`vesselstack.env` may exist. 0.6.0 refused it with `BOAT_UNITS must be us_customary or metric`
+and stopped the update before changing anything. From 0.6.1 the installer reads `nautical` as
+`metric` (metres for depth; knots and nautical miles are kept in both systems), prints one
+`Note:` line, and a real install or update rewrites `vesselstack.env` with `BOAT_UNITS=metric`
+(a dry run only prints the note). The setup wizard and the Control Panel also show it as Metric
+without changing it. Any other unsupported value is still refused before anything is changed,
+now with a message naming the file and the fix. If you are stuck on 0.6.0, change the value
+by hand and run the update again:
+
+```bash
+sudo sed -i 's/^BOAT_UNITS=.*/BOAT_UNITS=metric/' /opt/vesselstack/config/vesselstack.env
+```
+
+**Backup drive not mounted (0.6.1).** When the backup folder is under `/media` or `/mnt` and the
+drive is not mounted, `get-vesselstack.sh` and (from an installed 0.6.1) `vesselstackctl update` and
+`vesselstackctl backup` no longer just stop: before anything is stopped or changed they ask
+whether to mount the drive from `/etc/fstab`, pick a connected USB drive, check again, or back up
+to the system disk once. See [Backups](#backups). A direct `sudo vesselstackctl update <dir>` run
+from an installed 0.6.0 or earlier controller does not show this menu (that controller is older
+than the fix); use `get-vesselstack.sh`, or mount the drive first, or run
+`sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update <dir>` to back up to
+the system disk once.
+
+Rollback: set `BOAT_UNITS` back to `us_customary` (or `metric`) in the same file. 0.6.1
+needs no other manual step.
+
+**Fix it at the prompt (0.6.1).** When you run the installer, an update or the pinned
+`get-vesselstack.sh` from a terminal (for example over `ssh -t`), an unsupported `BOAT_UNITS`
+value, or a setting in `vesselstack.env` that cannot be written safely (see below), no longer
+just stops the run. The installer asks what to do before changing anything else:
+
+```text
+BOAT_UNITS in /opt/vesselstack/config/vesselstack.env is "imperial", which is not supported.
+  [1] US customary (feet, °F, psi, US gallons)
+  [2] Metric (metres, °C, kPa, litres)
+  [c] Cancel (nothing is changed)
+Choice:
+```
+
+An unsafe value (a token or other setting with an apostrophe plus a backslash, double quote,
+dollar sign or backtick, a line break, or a control character) is offered as
+`[1] Enter a new value for <KEY>`; what you type for a token, password or key is hidden and is
+never printed or logged, and a replacement that is still unsafe is refused. Your answer is saved
+in the settings file, the installer prints `Changed <KEY> in <file> (previous copy: <file>.before-fix-<time>)`
+and starts over with the same options. The previous copy is root-only; delete the
+`*.before-fix-*` copies once the install works. `c`, an empty answer at the end of input or
+five minutes without an answer prints `Cancelled. Nothing was changed.` and leaves the file as
+it was. Limits: only settings written in the file you pass with `--config` are offered (a value
+that comes from the environment is not), generated or preserved passwords and tokens (InfluxDB,
+Grafana, MQTT, Boat Chat, Control Panel) are never offered because the running services still hold the
+old value (change it in the service first, then edit the file), and a symbolic link, a file not
+owned by root, a file in a folder (or under a parent folder) that other users can change, or a
+file whose edit cannot be verified is left untouched. For an unsupported units value the manual
+`sed` command is printed; for an unsafe value you are told to edit the setting by hand. Runs without a terminal (cron, a service, the Control Panel, `--yes`,
+`VESSELSTACK_NONINTERACTIVE=true`) never ask: they stop before changing anything and print the
+exact fix, as in 0.6.0. A dry run that you answer does save the fix you chose.
 
 **What changes for an existing boat**
 
@@ -494,14 +553,14 @@ command under Rollback below, fix the value, and update again.
 **Verify after updating**
 
 ```bash
-cat /opt/vesselstack/config/installed-version     # 0.6.0
+cat /opt/vesselstack/config/installed-version     # 0.6.1
 sudo vesselstackctl doctor                        # RESULT healthy
 sudo vesselstackctl status
 ```
 
 Open Boat Chat and the Control Panel, and confirm the dashboards show live values.
 
-**Rollback.** Downgrades are refused (`Downgrade from 0.6.0 to ... is not supported`). Restore the
+**Rollback.** Downgrades are refused (`Downgrade from 0.6.1 to ... is not supported`). Restore the
 verified pre-update backup instead:
 
 ```bash
@@ -614,26 +673,26 @@ git clone https://github.com/jclima/VesselStack.git
 cd VesselStack
 ```
 
-To work from the 0.6.0 release, check out its tag:
+To work from the 0.6.1 release, check out its tag:
 
 ```bash
 git fetch --tags
-git checkout v0.6.0
+git checkout v0.6.1
 ```
 
-`v0.6.0` is an SSH-signed tag (Ed25519 release key, verified by the release workflow against
+`v0.6.1` is an SSH-signed tag (Ed25519 release key, verified by the release workflow against
 `.github/allowed_signers`). It is published first as a pre-release and marked Latest after the
 maintainer's physical Raspberry Pi install passes; see the [CHANGELOG](CHANGELOG.md). Verify the
 tag yourself (needs `ssh-keygen`, which ships with OpenSSH):
 
 ```bash
 git fetch --tags
-scripts/verify-release-tag.sh v0.6.0
+scripts/verify-release-tag.sh v0.6.1
 # maintainers and owners: also bind the tag to the commit you recorded when it was built
 # (the full 40-character SHA from your release notes, not one read back from the tag itself)
-scripts/verify-release-tag.sh v0.6.0 .github/allowed_signers "$RECORDED_COMMIT"
+scripts/verify-release-tag.sh v0.6.1 .github/allowed_signers "$RECORDED_COMMIT"
 # equivalent plain git command:
-git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile=.github/allowed_signers verify-tag v0.6.0
+git -c gpg.format=ssh -c gpg.ssh.allowedSignersFile=.github/allowed_signers verify-tag v0.6.1
 ```
 
 The script prints the signer and key fingerprint, and exits non-zero for an unsigned,
@@ -661,7 +720,7 @@ nano vesselstack.env
 | `BOAT_CHAT_ACCESS_TOKEN` | `GENERATE` (default) creates a random token, preserved on re-install; required for chat, status and data APIs |
 | `INFLUXDB_CONTAINER_NAME` | Advanced override for existing/custom Compose deployments |
 | `BOAT_TIMEZONE` | IANA timezone, such as `America/Los_Angeles` |
-| `BOAT_UNITS` | `us_customary` or `metric` |
+| `BOAT_UNITS` | `us_customary` or `metric` (the legacy value `nautical` is read as `metric`; case and surrounding spaces are ignored) |
 | `VESSELSTACK_USER` | Existing non-root service account |
 | `VESSELSTACK_UID`, `VESSELSTACK_GID` | Derived from the service account by the installer |
 | `VESSELSTACK_ROOT` | Application path; default `/opt/vesselstack` |
@@ -1067,7 +1126,55 @@ USB drive cannot silently fill the SD card; pass
 `vesselstackctl backup --allow-unmounted DIR` (or set
 `VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true`, which also applies to
 `vesselstackctl update`) to override. A warning is printed when the destination
-is on the same filesystem as the data. Besides the application and data trees the
+is on the same filesystem as the data.
+
+When the drive is not mounted and you run the command from a terminal, the update or backup
+shows a menu instead of stopping. Nothing has been changed or stopped at that point:
+
+```text
+The backup folder <DEST> is on <MOUNT_DIR>, which is not mounted.
+Backing up now would put the archive on the system disk (SD card).
+Nothing has been changed yet.
+  [1] Mount <MOUNT_DIR> now (it is listed in /etc/fstab)
+  [2] Choose a connected drive to mount at <MOUNT_DIR>
+  [3] I have plugged the drive in; check again
+  [4] Back up to the system disk this once (not recommended)
+  [c] Cancel the update
+```
+
+- **[1]** appears only when `/etc/fstab` has an entry for that folder; it runs `mount`.
+- **[2]** lists connected USB drives that are not mounted and not part of the system disk
+  (the disk holding `/`, `/boot/firmware` or the VesselStack data is never offered). Only
+  **ext4** (recommended) and **exFAT** are accepted; vfat/FAT32 is refused because of its 4 GiB
+  file limit, and other filesystems are listed with the reason. A drive that `/etc/fstab` assigns
+  to a different mount point (for example a data SSD that failed to mount) is listed with that
+  reason and cannot be picked. If no unmounted drive is found, the menu says so and names a
+  removable ext4 or exFAT drive that is already mounted elsewhere (for example by the desktop
+  under `/media/<user>/...`); unmount it with `sudo umount <path>` and choose [3]. The mount point
+  must be empty. Before anything is written, the new mount's top folder must be owned by root and
+  not writable by others, and no folder from there to the backup folder may be a symbolic link or
+  owned by another user; otherwise the backup is refused.
+  The drive is mounted with `nodev,nosuid,noexec` (exFAT also `uid=0,gid=0,umask=0077`) and stays
+  mounted until reboot; the menu prints the `/etc/fstab` line to add to mount it at boot.
+  VesselStack never edits `/etc/fstab` or formats a drive.
+- **[3]** checks the mount again after you plug the drive in.
+- **[4]** writes this one backup to the system disk after a warning. It is not offered when
+  the free space is smaller than the data (`du -skx`, 60 s limit) or when `vesselstack.env` sets
+  `VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=false`. Nothing is saved: the next backup asks again.
+- **[c]**, end of input or no answer within 5 minutes cancels without changing anything (in
+  the pinned installer it prints `Cancelled. The update was not started; your installed VesselStack
+  was not changed.`; the packages and the release folder may already be in place). An answer must
+  be exactly one listed token: `1 2` is asked again.
+  `vesselstackctl backup --require-mounted` (used by the Control Panel) offers only [1] to [3].
+
+Without a terminal (cron, systemd, the Control Panel, `--yes`, `VESSELSTACK_NONINTERACTIVE=true`) it
+still stops with `Refusing to back up: ... is not mounted ...` and a `To fix:` line. A direct
+`sudo vesselstackctl update` from an installed 0.6.0 or earlier controller does not show the
+menu; use `get-vesselstack.sh` (it asks before calling the controller) or
+`sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update <dir>`.
+Rollback: unmount the drive with `umount`; remove the added `/etc/fstab` line if you do not want it.
+
+Besides the application and data trees the
 archive includes `/etc/systemd/system/vesselstack-*`,
 `/usr/local/sbin/vesselstack{ctl,-firewall}` and `/etc/vesselstack/update.env`
 when they exist, so a restore across versions is complete.
@@ -1128,6 +1235,9 @@ live database files is insufficient.
 ## Updating
 
 This is the one place in the README that describes updating and rolling back.
+Updates and backups started from the Control Panel never prompt; when one stops
+for something you can fix, the result banner shows a **To fix:** line with the
+exact step.
 
 1. **Back up first** to a mounted external drive (see [Backups](#backups)):
 
@@ -1138,7 +1248,7 @@ This is the one place in the README that describes updating and rolling back.
 2. **Re-run the pinned release installer.** On the Pi, over `ssh -t`:
 
    ```bash
-   curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+   curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
    ```
 
    The installer finds the installed system, never overwrites it silently, and offers
@@ -1147,8 +1257,11 @@ This is the one place in the README that describes updating and rolling back.
    release's `install.sh --dry-run` preflight, makes and verifies a full backup, then runs
    `install.sh --start`. Answer **n** to leave the system untouched; the installer prints
    the exact command to run later. Services restart briefly, so do not update while underway.
-   Plain `sudo vesselstackctl update` with no argument fails: the command needs the release
-   directory, for example `sudo vesselstackctl update /opt/vesselstack-release/0.6.0`.
+   If the backup drive is not mounted, the installer asks, before calling the controller and
+   before anything is stopped, whether to mount it, pick a USB drive, check again, or back up
+   to the system disk once (see [Backups](#backups)); `--yes` and `--defaults` never choose and
+   the update stops with the reason. Plain `sudo vesselstackctl update` with no argument fails: the command needs the release
+   directory, for example `sudo vesselstackctl update /opt/vesselstack-release/0.6.1`.
    Without internet, use `--offline --bundle ...` as described under
    [Offline install](#offline-install-no-internet-on-the-boat).
 
@@ -1165,13 +1278,13 @@ This is the one place in the README that describes updating and rolling back.
    commands at the same time. Transient updater files under `/var/lib/vesselstack` are not
    backed up; configuration and data are.
 
-| Installed version | Update to 0.6.0 |
+| Installed version | Update to 0.6.1 |
 |---|---|
-| 0.5.7 | Control Panel or the pinned installer. 0.6.0 is published first as a pre-release (in the 0.5.x panel, enable **Include lab prereleases** on the update card to see it; the 0.6.0 panel calls it **Include early test releases**) and is marked Latest after the maintainer's physical Raspberry Pi install passes |
+| 0.5.7 | Control Panel or the pinned installer. 0.6.1 is published first as a pre-release (in the 0.5.x panel, enable **Include lab prereleases** on the update card to see it; the 0.6.1 panel calls it **Include early test releases**) and is marked Latest after the maintainer's physical Raspberry Pi install passes |
 | 0.5.5, 0.5.6 | Same as 0.5.7: the browser updater was introduced in 0.5.5 |
 | 0.5.4 or earlier, including 0.4.x | Run the pinned installer from the CLI once (these versions cannot update from the browser); read [Upgrading to 0.6.0](#upgrading-to-060) first |
 
-A checksum shows a download is intact; it is not signed provenance. The signature on the `v0.6.0` tag (see [Download VesselStack](#3-download-vesselstack)) is the provenance check, and the installer does not perform it for you.
+A checksum shows a download is intact; it is not signed provenance. The signature on the `v0.6.1` tag (see [Download VesselStack](#3-download-vesselstack)) is the provenance check, and the installer does not perform it for you.
 
 **Rollback.** Downgrades are refused. If an update fails, the verified pre-update backup is
 kept. Check it and restore it during a maintenance window:
@@ -1187,7 +1300,7 @@ There is no automatic rollback. To update from a reviewed source checkout with
 ### Offline install (no internet on the boat)
 
 Prepare a bundle on a connected machine, carry it to the boat, and install with
-`sudo bash get-vesselstack.sh --offline --bundle /path/to/offline-bundle --tarball /path/to/vesselstack-0.6.0.tar.gz`.
+`sudo bash get-vesselstack.sh --offline --bundle /path/to/offline-bundle --tarball /path/to/vesselstack-0.6.1.tar.gz`.
 The bundle must be root-owned and not group/world-writable. Steps: [Updating and offline install](docs/UPDATING.md#offline-install-no-internet-on-the-boat).
 
 ## Stopping or removing services
@@ -1232,6 +1345,24 @@ prints how to remove it (`docker volume rm vesselstack-esphome-cache`);
 Install the reported command and rerun `--dry-run`. Confirm `docker compose`
 works; the deprecated standalone `docker-compose` command is insufficient.
 
+### "Refusing to back up: ... is not mounted"
+
+The backup folder is under `/media` or `/mnt` and the drive is not mounted. From a terminal
+(`ssh -t`) the update or backup now asks what to do: mount it, pick a connected ext4 or exFAT
+USB drive, check again, or back up to the system disk once (see [Backups](#backups)). Without
+a terminal, or from an installed 0.6.0 or earlier controller, mount the drive and run again, or
+use `sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update <dir>` for one
+backup on the system disk. A FAT32 (vfat) drive is refused; use ext4 or exFAT.
+
+### The installer stops on `BOAT_UNITS` or "cannot be written safely"
+
+Run it from a terminal (`ssh -t`) and answer the prompt: it offers to set the units or to
+enter a replacement value, keeps a root-only copy of the previous file as
+`<file>.before-fix-<time>` (safe to delete once the install works), and then continues. If it
+only prints the message, the run had no terminal, `--yes` or `VESSELSTACK_NONINTERACTIVE=true`
+was set, or the value is a generated password or token or comes from the environment: edit the
+named setting in the file as printed, then run again. See [Upgrading to 0.6.0](#upgrading-to-060).
+
 ### A port is already allocated
 
 ```bash
diff --git a/VERSION b/VERSION
index a918a2a..ee6cdce 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-0.6.0
+0.6.1
diff --git a/boat-chat/display_units.py b/boat-chat/display_units.py
index 2500eaf..297c99b 100644
--- a/boat-chat/display_units.py
+++ b/boat-chat/display_units.py
@@ -34,7 +34,7 @@
 
 
 def normalize_preference(value: str | None) -> str:
-    return "metric" if str(value or "").strip().lower() in {"metric", "si", "metre", "meters"} else "us_customary"
+    return "metric" if str(value or "").strip().lower() in {"metric", "si", "metre", "meters", "nautical"} else "us_customary"
 
 
 def preference(setting_getter: Callable[[str, str], str] | None = None) -> str:
diff --git a/control-panel/app.py b/control-panel/app.py
index 327b5c0..9dca9b7 100644
--- a/control-panel/app.py
+++ b/control-panel/app.py
@@ -521,6 +521,8 @@ def public_configuration() -> dict[str, Any]:
     for spec in FIELDS:
         source = chat if spec["source"] == "chat" else vessel
         value = source.get(spec["key"], "")
+        if spec["key"] == "BOAT_UNITS" and value.strip().lower() == "nautical":
+            value = "metric"  # legacy value from older setup wizards: show Metric, not an unknown choice
         if spec["key"] in {"CONTROL_PANEL_HOST", "CONTROL_PANEL_PORT"}:
             value = panel.get(spec["key"], value)
         result[spec["key"]] = {"configured": bool(value)} if spec["kind"] == "secret" else value
@@ -882,6 +884,9 @@ def backup_status(vessel: dict[str, str] | None = None) -> dict[str, Any]:
 ERROR_LINE = re.compile(r"^(?:\[[^\]]*\]\s*)?(?:ERROR|Error|error|FATAL|Refusing[^:]*|Backup[^:]*failed)[:\s]+(.*)$")
 
 
+FIX_PREFIX = "To fix:"
+
+
 def summarize_operation(operation: dict[str, Any]) -> dict[str, Any]:
     """Plain facts about a finished operation, read from its output only."""
     lines = [str(line).strip() for line in operation.get("output") or [] if str(line).strip()]
@@ -893,12 +898,21 @@ def summarize_operation(operation: dict[str, Any]) -> dict[str, Any]:
                 break
     if operation.get("state") == "failed" and lines:
         reason = lines[-1]
-        for line in reversed(lines):
-            found = ERROR_LINE.match(line)
+        matched = None
+        for index in range(len(lines) - 1, -1, -1):
+            found = ERROR_LINE.match(lines[index])
             if found:
-                reason = found.group(1).strip() or line
+                reason = found.group(1).strip() or lines[index]
+                matched = index
                 break
         summary["reason"] = reason[:400]
+        # The scripts print the exact remedy as "To fix: ..." right after a refusal; these lines never carry secrets.
+        for line in lines[(matched + 1 if matched is not None else 0):]:
+            if line.startswith(FIX_PREFIX):
+                fix = line[len(FIX_PREFIX):].strip()
+                if fix:
+                    summary["fix"] = fix[:600]
+                    break
     return summary
 
 
@@ -955,6 +969,7 @@ def start(self, label: str, command_or_factory: list[str] | Any) -> dict[str, An
     def _run(self, operation: dict[str, Any], command: list[str], slot_fd) -> None:
         environment = os.environ.copy()
         environment["VESSELSTACK_SKIP_PANEL_RESTART"] = "true"
+        environment["VESSELSTACK_NONINTERACTIVE"] = "true"  # the panel cannot answer prompts; scripts print "To fix:" guidance instead
         exit_code = 1
         succeeded = False
         try:
diff --git a/control-panel/browser_updates.py b/control-panel/browser_updates.py
index b07ef22..1fbb331 100644
--- a/control-panel/browser_updates.py
+++ b/control-panel/browser_updates.py
@@ -650,7 +650,7 @@ def run_update(request: dict[str, Any], operation: dict[str, Any], root: Path) -
         if not installer.is_file():
             raise ValueError("release installer missing")
 
-        child_env = dict(os.environ, VESSELSTACK_ROOT=str(root), VESSELSTACK_ENV=config)
+        child_env = dict(os.environ, VESSELSTACK_ROOT=str(root), VESSELSTACK_ENV=config, VESSELSTACK_NONINTERACTIVE="true")
         _validate_fixed_ctl()
         operation.update(phase="preflight"); write_operation(root, operation)
         run_command([str(installer), "--config", config, "--dry-run"], root, operation, 1800, child_env)
diff --git a/control-panel/static/app.js b/control-panel/static/app.js
index 03589bb..26cfb08 100644
--- a/control-panel/static/app.js
+++ b/control-panel/static/app.js
@@ -470,8 +470,12 @@ function renderBanner(operation, context) {
         html = `<div class="banner ok" role="status"><span class="icon" aria-hidden="true">&#10003;</span><div class="msg"><strong>${escapeHtml(text.done)}${escapeHtml(when)}</strong>${tail}${log("Details")}</div><button type="button" class="x" id="banner-x" aria-label="Dismiss message">&#10005;</button></div>`;
       } else {
         const reason = String(summary.reason || "see the details below").replace(/[.\s]+$/, "");
-        const next = /mount/i.test(reason) && operation.label === "backup" ? "Plug in or mount the backup drive and try again." : text.next;
-        html = `<div class="banner fail" role="alert"><span class="icon" aria-hidden="true">!</span><div class="msg"><strong>${escapeHtml(text.failed)}</strong> — ${escapeHtml(reason)}. ${escapeHtml(next)}${log("Show details")}</div><button type="button" class="x" id="banner-x" aria-label="Dismiss message">&#10005;</button></div>`;
+        const fix = String(summary.fix || "").trim();
+        const next = fix ? "" : /mount/i.test(reason) && operation.label === "backup" ? "Plug in or mount the backup drive and try again." : text.next;
+        // The exact remedy the script printed; a trailing "sudo ..." command is set in monospace. Everything is escaped.
+        const split = fix.match(/^(.*?)(\bsudo\s.*)$/s);
+        const fixHtml = fix ? `<div class="fix"><strong>To fix:</strong> ${split ? `${escapeHtml(split[1])}<span class="mono">${escapeHtml(split[2])}</span>` : escapeHtml(fix)}</div>` : "";
+        html = `<div class="banner fail" role="alert"><span class="icon" aria-hidden="true">!</span><div class="msg"><strong>${escapeHtml(text.failed)}</strong> — ${escapeHtml(reason)}.${next ? ` ${escapeHtml(next)}` : ""}${fixHtml}${log("Show details")}</div><button type="button" class="x" id="banner-x" aria-label="Dismiss message">&#10005;</button></div>`;
       }
     }
   }
diff --git a/control-panel/static/styles.css b/control-panel/static/styles.css
index d7b4283..4232778 100644
--- a/control-panel/static/styles.css
+++ b/control-panel/static/styles.css
@@ -82,6 +82,8 @@ main{width:min(1180px,calc(100% - 2rem));margin:0 auto;padding:0 0 6rem}
 .banner.info{color:var(--sea);background:var(--sea-soft);border-color:var(--sea)}
 .banner .msg{flex:1;min-width:0;color:var(--ink)}
 .banner .msg strong{color:inherit}
+.banner .fix{margin-top:.5rem;overflow-wrap:anywhere}
+.banner .fix .mono{font-size:.88rem}
 .banner .icon{font-weight:800;font-size:1.1rem;line-height:1.5}
 .banner details{margin-top:.5rem}
 .banner summary,details.disc>summary{cursor:pointer;min-height:44px;display:flex;align-items:center;font-weight:600;color:var(--sea)}
diff --git a/docs/CONTROL_PANEL.md b/docs/CONTROL_PANEL.md
index b25cce6..936ce15 100644
--- a/docs/CONTROL_PANEL.md
+++ b/docs/CONTROL_PANEL.md
@@ -214,8 +214,13 @@ disabled so lifecycle changes cannot overlap.
 
 The result of the latest operation stays in a banner under the tabs until you
 dismiss it. Success shows the time and, for a backup, where the file was saved;
-failure shows the reason and what to try next. **Details** opens the command
-output.
+failure shows the reason and what to try next. When an update or backup stops
+for something you can fix (for example an unmounted backup drive, an unsupported
+`BOAT_UNITS` value, or a saved value that cannot be written safely), the banner
+adds a **To fix:** line with the exact step, and any command to run over SSH is
+shown in monospace. The Control Panel never asks questions or changes your
+settings itself; run the fix, then start the operation again. **Details** opens
+the command output.
 
 ![Control Panel Home with a green banner reporting that a backup finished and where it was saved](images/control-panel-backup-result.png)
 
diff --git a/docs/CONTROL_PANEL_TESTING.md b/docs/CONTROL_PANEL_TESTING.md
index 08b1633..f321024 100644
--- a/docs/CONTROL_PANEL_TESTING.md
+++ b/docs/CONTROL_PANEL_TESTING.md
@@ -1,6 +1,6 @@
 # Control Panel component lifecycle lab test
 
-This is the release 0.6.0 lab recipe. It is a bounded acceptance test, not
+This is the release 0.6.1 lab recipe. It is a bounded acceptance test, not
 evidence of a boat or physical Raspberry Pi test. Use a scratch lab Pi or an
 isolated VM with Docker and a mounted data disk. Keep real vessel identity,
 positions, MMSIs, tokens, logs, and backups out of this repository.
@@ -8,19 +8,19 @@ positions, MMSIs, tokens, logs, and backups out of this repository.
 ## Fetch and verify the pinned prerelease
 
 Download the pinned bootstrap and the CI-generated checksum from the same
-`v0.6.0` GitHub release. Verify before reading or running it:
+`v0.6.1` GitHub release. Verify before reading or running it:
 
 ```bash
-curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh
-curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh.sha256
+curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh
+curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh.sha256
 sha256sum -c get-vesselstack.sh.sha256
 less get-vesselstack.sh
 sudo bash get-vesselstack.sh --help
 ```
 
-0.6.0 release status: `v0.6.0` is an SSH-signed tag, published first as a pre-release and
+0.6.1 release status: `v0.6.1` is an SSH-signed tag, published first as a pre-release and
 marked Latest after the maintainer's physical Raspberry Pi install passes (see the CHANGELOG).
-Check the tag with `scripts/verify-release-tag.sh v0.6.0`. The checksum catches a corrupt or
+Check the tag with `scripts/verify-release-tag.sh v0.6.1`. The checksum catches a corrupt or
 truncated asset; it does not replace that signature check.
 
 ## Exercise the browser updater
@@ -28,13 +28,13 @@ truncated asset; it does not replace that signature check.
 Open the authenticated panel's **Updates** tab and press **Check for updates**. Before
 you press it, confirm the tab says nothing has been contacted. Confirm the catalog
 is `jclima/VesselStack`, stable releases are the default, and **Include early test
-releases** is opt-in. When the installed `0.6.0` release is current, the panel
+releases** is opt-in. When the installed `0.6.1` release is current, the panel
 correctly reports "You're up to date"; do not downgrade, retag, or force the
 same version. Exercise **Back up & install** only when a newer public release
-is available. A fresh `0.6.0` install is a CLI install; an existing `0.5.5`,
+is available. A fresh `0.6.1` install is a CLI install; an existing `0.5.5`,
 `0.5.6` or `0.5.7` install may use the panel upgrade path, after enabling
 **Include early test releases** (named **Include lab prereleases** in the 0.5.x panel) if
-0.6.0 is published as a prerelease. CI-controlled fixtures exercise the install
+0.6.1 is published as a prerelease. CI-controlled fixtures exercise the install
 orchestration, and the actual systemd restart is covered by the backend
 verifier. Full physical-Pi upgrade proof remains pending physical testing.
 Mount the configured external backup device first. Confirm the dialog and the Home tab
@@ -82,6 +82,17 @@ Use the real backup mount path in place of `/media/vesselstack-backup`. A
 backup directory on the same system disk does not protect against disk failure;
 check available capacity manually before proceeding.
 
+To see the **To fix:** guidance in the Control Panel, unmount the backup
+target (or use a path that is not a mountpoint), then choose **Back up now** on
+Home and, separately, run an update from the Maintenance tab. Each stops with a
+red result banner that gives the reason, then a **To fix:** line naming the mount
+point (the update version also shows the one-off
+`VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true` command in monospace). Confirm
+nothing was stopped or changed, that no prompt waited in the Details log, mount
+the drive, and run the operation again to see it succeed. Setting an unsupported
+value such as `BOAT_UNITS=imperial` in the settings file and starting an update
+shows the same kind of line with the exact `sed` command.
+
 If the backup media is intentionally unavailable in this disposable lab, the
 one-shot exception is explicit and temporary:
 
diff --git a/docs/DEPLOYMENT.md b/docs/DEPLOYMENT.md
index 8b22993..6a2c8a9 100644
--- a/docs/DEPLOYMENT.md
+++ b/docs/DEPLOYMENT.md
@@ -1,6 +1,6 @@
-# Deployment runbook: VesselStack 0.6.0 to a home-lab Pi and the boat Pi
+# Deployment runbook: VesselStack 0.6.1 to a home-lab Pi and the boat Pi
 
-This is an operator runbook for taking release 0.6.0 through two targets:
+This is an operator runbook for taking release 0.6.1 through two targets:
 
 1. **Home lab**: Raspberry Pi 4B, internet-connected, used for staging, a 48 h+
    soak and rehearsals (CAN replay through `vcan0`).
@@ -23,7 +23,7 @@ the scripts in this repository; where a thing does not exist the text says so.
 Related: [INSTALLATION.md](INSTALLATION.md) (hardware and first install),
 [README.md](../README.md) (reference for every variable and command).
 
-0.6.0 release status: `v0.6.0` is an SSH-signed tag (verified by the release workflow against
+0.6.1 release status: `v0.6.1` is an SSH-signed tag (verified by the release workflow against
 `.github/allowed_signers`), published first as a pre-release and marked Latest after the
 maintainer's physical Raspberry Pi install passes (recorded in the CHANGELOG). Physical
 Raspberry Pi acceptance is a separate gate (section 7).
@@ -42,10 +42,10 @@ carrying bundles, rollback and the acceptance checklist.
 **Home lab (internet-connected Pi).** On the Pi:
 
 ```bash
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
 ```
 
-(`.../releases/latest/download/get-vesselstack.sh` points to whichever release GitHub marks Latest, which may not be 0.6.0; use the pinned URL above.)
+(`.../releases/latest/download/get-vesselstack.sh` points to whichever release GitHub marks Latest, which may not be 0.6.1; use the pinned URL above.)
 Do it over plain SSH (`ssh -t YOUR_USER@LAB_PI`): no screen, browser or tunnel is needed.
 It installs prerequisites, asks before installing Docker, verifies the release
 sha256 (compare it with the value recorded in section 2), asks the configuration
@@ -61,7 +61,7 @@ read it, then `sudo bash get-vesselstack.sh`. Without questions (scripts, no ter
 browser wizard instead of the terminal questions.
 
 **Boat (offline Pi).** The boat has no internet, so carry the files in (section 4):
-`get-vesselstack.sh`, `vesselstack-0.6.0.tar.gz` with its `.sha256`, and the
+`get-vesselstack.sh`, `vesselstack-0.6.1.tar.gz` with its `.sha256`, and the
 offline bundle (copy the bundle root-owned, `chmod -R go-w`). Install Docker and
 the apt prerequisites while the Pi still has internet (the script cannot install
 packages offline and tells you what is missing), then:
@@ -72,7 +72,7 @@ offline plugin or bridge-virtualenv installation.
 
 ```bash
 sudo bash get-vesselstack.sh --offline --bundle /path/to/offline-bundle \
-  --tarball /path/to/vesselstack-0.6.0.tar.gz
+  --tarball /path/to/vesselstack-0.6.1.tar.gz
 ```
 
 It verifies the tarball checksum and the bundle (`prepare-offline-bundle.sh
@@ -234,22 +234,22 @@ hatch; never set it on the boat. The boat has no route to `origin`, so
 `vesselstack-update` is not the boat's update path; leave it unconfigured there
 unless you later add a connection you trust.
 
-Once `v0.6.0` is published, do not recreate or move the tag. On the maintainer
+Once `v0.6.1` is published, do not recreate or move the tag. On the maintainer
 machine, verify that the published tag points at the intended merged commit;
 do not force-fetch or overwrite a published tag:
 
 ```bash
 git fetch origin main --tags
-git show --no-patch --decorate v0.6.0
-git rev-parse v0.6.0^{commit}
-git merge-base --is-ancestor v0.6.0^{commit} origin/main
+git show --no-patch --decorate v0.6.1
+git rev-parse v0.6.1^{commit}
+git merge-base --is-ancestor v0.6.1^{commit} origin/main
 ```
 
-Then verify the signature with `scripts/verify-release-tag.sh v0.6.0` and claim success only
+Then verify the signature with `scripts/verify-release-tag.sh v0.6.1` and claim success only
 for a tag that passes it. When you have the commit recorded from the build output in section 2
 (`commit <sha>`, kept in your notes), bind the tag to it:
-`scripts/verify-release-tag.sh v0.6.0 .github/allowed_signers "$RECORDED_COMMIT"` (full SHA;
-abbreviations are refused). Do not take the value from `git rev-parse v0.6.0^{commit}`, which
+`scripts/verify-release-tag.sh v0.6.1 .github/allowed_signers "$RECORDED_COMMIT"` (full SHA;
+abbreviations are refused). Do not take the value from `git rev-parse v0.6.1^{commit}`, which
 would only compare the tag with itself. Follow the tag-creation and signing gates in
 [DEVELOPMENT.md](DEVELOPMENT.md#release-checklist).
 
@@ -266,29 +266,29 @@ From a clean clone, so no stray files can matter (`build-package.sh` packages
 
 ```bash
 git clone https://github.com/jclima/VesselStack.git vs-release && cd vs-release
-git checkout v0.6.0
-cat VERSION                                  # 0.6.0
+git checkout v0.6.1
+cat VERSION                                  # 0.6.1
 VESSELSTACK_BUILD_REQUIRE_CLEAN=true ./build-package.sh
 ```
 
-It writes `generated/vesselstack-0.6.0.tar.gz` and
-`generated/vesselstack-0.6.0.tar.gz.sha256`, and prints the sha256 and
+It writes `generated/vesselstack-0.6.1.tar.gz` and
+`generated/vesselstack-0.6.1.tar.gz.sha256`, and prints the sha256 and
 `commit <sha>`. **Record both values** in your release notes (out of band from
 the tarball): they are the boat's acceptance check.
 
 ```bash
-git rev-parse v0.6.0^{commit}                # must equal the printed commit
-tar -tzf generated/vesselstack-0.6.0.tar.gz | head -20
-tar -xzOf generated/vesselstack-0.6.0.tar.gz vesselstack-0.6.0/COMMIT
-tar -xzOf generated/vesselstack-0.6.0.tar.gz vesselstack-0.6.0/BUILD_INFO
-tar -tzf generated/vesselstack-0.6.0.tar.gz | grep -E '\.env$|boat_facts|\.venv|memory/|data/' \
+git rev-parse v0.6.1^{commit}                # must equal the printed commit
+tar -tzf generated/vesselstack-0.6.1.tar.gz | head -20
+tar -xzOf generated/vesselstack-0.6.1.tar.gz vesselstack-0.6.1/COMMIT
+tar -xzOf generated/vesselstack-0.6.1.tar.gz vesselstack-0.6.1/BUILD_INFO
+tar -tzf generated/vesselstack-0.6.1.tar.gz | grep -E '\.env$|boat_facts|\.venv|memory/|data/' \
   || echo "no private artifacts"
 python3 scripts/check-public-tree.py
 ```
 
 (`vesselstack.example.env` is expected in the listing; a real `*.env` is not.)
 `scripts/update-requirements-lock.sh` is for maintainers when
-`boat-chat/requirements.txt` changes; for an unchanged 0.6.0 the lock ships in
+`boat-chat/requirements.txt` changes; for an unchanged 0.6.1 the lock ships in
 the tarball and you do not run it.
 
 ## 3. Home lab (Pi 4B, connected)
@@ -298,14 +298,14 @@ the tarball and you do not run it.
 Copy the tarball to the lab Pi, check it, unpack it root-owned:
 
 ```bash
-scp generated/vesselstack-0.6.0.tar.gz* YOUR_USER@LAB_PI:~/
+scp generated/vesselstack-0.6.1.tar.gz* YOUR_USER@LAB_PI:~/
 # on LAB_PI:
-sha256sum -c vesselstack-0.6.0.tar.gz.sha256        # [read-only]
+sha256sum -c vesselstack-0.6.1.tar.gz.sha256        # [read-only]
 sudo install -d -m 0755 /var/lib/vesselstack/releases       # [MUTATES HOST]
-sudo tar -xzf vesselstack-0.6.0.tar.gz -C /var/lib/vesselstack/releases --no-same-owner
-sudo chown -R root:root /var/lib/vesselstack/releases/vesselstack-0.6.0
-sudo chmod -R go-w /var/lib/vesselstack/releases/vesselstack-0.6.0
-cd /var/lib/vesselstack/releases/vesselstack-0.6.0
+sudo tar -xzf vesselstack-0.6.1.tar.gz -C /var/lib/vesselstack/releases --no-same-owner
+sudo chown -R root:root /var/lib/vesselstack/releases/vesselstack-0.6.1
+sudo chmod -R go-w /var/lib/vesselstack/releases/vesselstack-0.6.1
+cd /var/lib/vesselstack/releases/vesselstack-0.6.1
 ```
 
 Configuration: either the terminal wizard (`python3 vesselstack-wizard.py --cli --output ~/vesselstack-lab.env`, over plain
@@ -343,7 +343,7 @@ sudo ./install.sh --config ~/vesselstack-lab.env             # [MUTATES HOST] re
 sudo ./install.sh --config ~/vesselstack-lab.env --start     # [MUTATES HOST] pulls images, starts stack
 sudo vesselstackctl doctor
 sudo vesselstackctl urls
-cat /opt/vesselstack/config/installed-version                # 0.6.0
+cat /opt/vesselstack/config/installed-version                # 0.6.1
 ```
 
 ### 3.2 Replay a private CAN log
@@ -401,11 +401,11 @@ values, and record the `doctor` result and data-directory size each day.
 
 1. **Update from the previous version.** On a spare lab install (or before the
    soak), install the prior tag the normal way (`git checkout v0.3.0` in a clean
-   clone, `sudo ./install.sh --config ... --start`), then update with 0.6.0 from
+   clone, `sudo ./install.sh --config ... --start`), then update with 0.6.1 from
    the unpacked release directory:
 
    ```bash
-   sudo vesselstackctl update /var/lib/vesselstack/releases/vesselstack-0.6.0   # [MUTATES HOST]
+   sudo vesselstackctl update /var/lib/vesselstack/releases/vesselstack-0.6.1   # [MUTATES HOST]
    ```
 
    It runs `install.sh --dry-run`, takes a verified backup into
@@ -443,7 +443,7 @@ values, and record the `doctor` result and data-directory size each day.
    sudo chown -R root:root offline-bundle && sudo chmod -R go-w offline-bundle
    sudo scripts/prepare-offline-bundle.sh --load /path/to/offline-bundle   # docker load
    sudo VESSELSTACK_OFFLINE=true VESSELSTACK_WHEELHOUSE=/path/to/offline-bundle/wheelhouse \
-     vesselstackctl update /var/lib/vesselstack/releases/vesselstack-0.6.0
+     vesselstackctl update /var/lib/vesselstack/releases/vesselstack-0.6.1
    ```
 
    The bundle path and **every parent** must be root-owned and not
@@ -471,8 +471,8 @@ Assemble one directory on the connected machine; transfer it as a unit:
 
 | File | Source |
 | --- | --- |
-| `vesselstack-0.6.0.tar.gz` | `./build-package.sh` |
-| `vesselstack-0.6.0.tar.gz.sha256` | same run |
+| `vesselstack-0.6.1.tar.gz` | `./build-package.sh` |
+| `vesselstack-0.6.1.tar.gz.sha256` | same run |
 | `offline-bundle/` (`wheelhouse/`, `images/`, `BUNDLE_INFO`, `MANIFEST.sha256`) | `scripts/prepare-offline-bundle.sh --output ./offline-bundle` |
 | Release notes with the recorded sha256 + commit | your notes, **kept separately** |
 
@@ -519,19 +519,19 @@ backup, the recorded sha256 and a console/Ethernet path ready.
    your notes, not with the `.sha256` file that travelled with it):
 
    ```bash
-   sha256sum ~/carry/vesselstack-0.6.0.tar.gz     # must equal the recorded value
+   sha256sum ~/carry/vesselstack-0.6.1.tar.gz     # must equal the recorded value
    ```
 
 3. **Stage root-owned [MUTATES HOST].**
 
    ```bash
    sudo install -d -m 0755 /var/lib/vesselstack/releases
-   sudo tar -xzf ~/carry/vesselstack-0.6.0.tar.gz -C /var/lib/vesselstack/releases --no-same-owner
+   sudo tar -xzf ~/carry/vesselstack-0.6.1.tar.gz -C /var/lib/vesselstack/releases --no-same-owner
    sudo cp -a ~/carry/offline-bundle /var/lib/vesselstack/releases/
-   sudo chown -R root:root /var/lib/vesselstack/releases/vesselstack-0.6.0 /var/lib/vesselstack/releases/offline-bundle
-   sudo chmod -R go-w /var/lib/vesselstack/releases/vesselstack-0.6.0 /var/lib/vesselstack/releases/offline-bundle
-   cat /var/lib/vesselstack/releases/vesselstack-0.6.0/COMMIT       # matches recorded commit
-   sudo /var/lib/vesselstack/releases/vesselstack-0.6.0/scripts/prepare-offline-bundle.sh \
+   sudo chown -R root:root /var/lib/vesselstack/releases/vesselstack-0.6.1 /var/lib/vesselstack/releases/offline-bundle
+   sudo chmod -R go-w /var/lib/vesselstack/releases/vesselstack-0.6.1 /var/lib/vesselstack/releases/offline-bundle
+   cat /var/lib/vesselstack/releases/vesselstack-0.6.1/COMMIT       # matches recorded commit
+   sudo /var/lib/vesselstack/releases/vesselstack-0.6.1/scripts/prepare-offline-bundle.sh \
      --verify /var/lib/vesselstack/releases/offline-bundle           # [read-only]
    ```
 
@@ -540,16 +540,16 @@ backup, the recorded sha256 and a console/Ethernet path ready.
    boat uses:
 
    ```bash
-   sudo /var/lib/vesselstack/releases/vesselstack-0.6.0/scripts/prepare-offline-bundle.sh \
+   sudo /var/lib/vesselstack/releases/vesselstack-0.6.1/scripts/prepare-offline-bundle.sh \
      --load /var/lib/vesselstack/releases/offline-bundle      # verifies, then docker load
    sudo VESSELSTACK_OFFLINE=true VESSELSTACK_WHEELHOUSE=/var/lib/vesselstack/releases/offline-bundle/wheelhouse \
-     vesselstackctl update /var/lib/vesselstack/releases/vesselstack-0.6.0
+     vesselstackctl update /var/lib/vesselstack/releases/vesselstack-0.6.1
    ```
 
 5. **Verify.**
 
    ```bash
-   cat /opt/vesselstack/config/installed-version     # 0.6.0
+   cat /opt/vesselstack/config/installed-version     # 0.6.1
    sudo vesselstackctl doctor                        # RESULT healthy
    sudo reboot
    # after reconnecting:
@@ -618,12 +618,12 @@ secrets. `vesselstack-update --rollback BACKUP_DIRECTORY` is only for code-only
 
 ## 7. Acceptance checklist
 
-- [ ] Release `v0.6.0`: tag signature verified (`scripts/verify-release-tag.sh v0.6.0 .github/allowed_signers "$RECORDED_COMMIT"`) and Latest status recorded in the CHANGELOG; CI asset sha256 and commit recorded.
+- [ ] Release `v0.6.1`: tag signature verified (`scripts/verify-release-tag.sh v0.6.1 .github/allowed_signers "$RECORDED_COMMIT"`) and Latest status recorded in the CHANGELOG; CI asset sha256 and commit recorded.
 - [ ] Lab: 48 h+ soak with daily `doctor` healthy; replay data visible in Grafana.
 - [ ] Lab: update from 0.3.0, backup/verify/restore, and offline install rehearsed.
 - [ ] Boat: sha256 of the carried tarball equals the recorded value.
 - [ ] Boat: verified backup exists on separate media and a copy is off the Pi.
-- [ ] Boat: `installed-version` is `0.6.0`; `doctor` healthy before and after reboot.
+- [ ] Boat: `installed-version` is `0.6.1`; `doctor` healthy before and after reboot.
 - [ ] Boat: `can0` RX counter increases, error/dropped counters flat.
 - [ ] Boat: tokens are per-host; no lab secrets copied; control panel reached by tunnel only.
 
@@ -660,12 +660,12 @@ machine only.
 - **Real SSH signature verification** on the Pi (`vesselstack-update` against its
   allowed-signers file) has only been tested with fixtures; do the first real run on the lab
   Pi. The release workflow's tag check (`scripts/verify-release-tag.sh`) is covered by
-  `tests/test-verify-release-tag.sh` with throwaway keys; its first real run is the `v0.6.0`
+  `tests/test-verify-release-tag.sh` with throwaway keys; its first real run is the `v0.6.1`
   tag push.
 - The **arm64 offline bundle** (wheels for `manylinux*_aarch64`, `linux/arm64`
   images) has not been built and installed on a real Pi; section 3.5.3 is that
   rehearsal. Image tarballs are manifest-checked but not digest-pinned.
 - Scoped read-only InfluxDB tokens for Boat Chat and Grafana are **deferred**
-  (see README and CHANGELOG); they are not part of 0.6.0.
+  (see README and CHANGELOG); they are not part of 0.6.1.
 - The tarball is integrity-checked by sha256 only on the boat (no signature
   check in `install.sh`/`vesselstackctl update`).
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index fb9e3d4..f302a3a 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -60,7 +60,7 @@ Do not build and upload files by hand.
    the workflow reads the copy at the tagged commit. The `v0.5.7` lab prerelease was an
    annotated unsigned tag because no SSH/GPG key was available; it is not signed and would now
    be refused. The `v0.5.1` tag is untouched and was not published because its release pipeline
-   caught the bridge startup-status race. `v0.6.0` is an SSH-signed tag, published first as a
+   caught the bridge startup-status race. `v0.6.1` is an SSH-signed tag, published first as a
    pre-release and marked Latest after the maintainer's physical Raspberry Pi install passes
    (see the CHANGELOG).
 4. `.github/workflows/release.yml` then (a) reruns the whole CI workflow on the
diff --git a/docs/GETTING_STARTED.md b/docs/GETTING_STARTED.md
index 6b25338..17b02fd 100644
--- a/docs/GETTING_STARTED.md
+++ b/docs/GETTING_STARTED.md
@@ -41,11 +41,11 @@ installer. `-t` gives the session a terminal so the installer can ask questions:
 
 ```bash
 ssh -t YOUR_USER@raspberrypi.local
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
 ```
 
-The URL pins release `v0.6.0`, so it installs that release whatever GitHub marks as Latest
-(`--version 0.6.0` selects the same release). The form `.../releases/latest/download/get-vesselstack.sh`
+The URL pins release `v0.6.1`, so it installs that release whatever GitHub marks as Latest
+(`--version 0.6.1` selects the same release). The form `.../releases/latest/download/get-vesselstack.sh`
 points to whichever release GitHub marks Latest, which is not necessarily the newest one. For a
 lab Pi and an offline boat, follow [DEPLOYMENT.md](DEPLOYMENT.md).
 
diff --git a/docs/INSTALLATION.md b/docs/INSTALLATION.md
index 4e3365c..4310afe 100644
--- a/docs/INSTALLATION.md
+++ b/docs/INSTALLATION.md
@@ -63,7 +63,7 @@ terminal. The Pi needs no screen, keyboard, or browser, and nothing has to be
 opened or tunnelled:
 
 ```bash
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
 ```
 
 The terminal questions come in short sections (boat, Signal K, NMEA 2000 / CAN,
@@ -110,7 +110,7 @@ changed the panel port in Settings, use that number. See the
 **Without questions** (scripts, repeatable installs, or when no terminal is available):
 
 ```bash
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh \
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh \
   | sudo bash -s -- --yes --set BOAT_NAME=Foo --set SOCKETCAN_ENABLE=true
 ```
 
@@ -123,7 +123,7 @@ installer stops before changing anything and lists these options. `--web-wizard`
 optional browser wizard (loopback only; needs a browser on the Pi or an `ssh -L` tunnel).
 
 The pinned URL above works for any published release, including a prerelease; add
-`--version 0.6.0` (`| sudo bash -s -- --version 0.6.0`) or set `VESSELSTACK_VERSION=0.6.0` for
+`--version 0.6.1` (`| sudo bash -s -- --version 0.6.1`) or set `VESSELSTACK_VERSION=0.6.1` for
 the same effect. The form `https://github.com/jclima/VesselStack/releases/latest/download/get-vesselstack.sh`
 points to whichever release GitHub marks Latest, which is not necessarily the newest release
 (every 0.5.x release was a prerelease), so it is a secondary option. The script installs the Debian
@@ -142,8 +142,8 @@ page, or pass `--sha256 HASH`. To read the script first (recommended for the fir
 install):
 
 ```bash
-curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh
-curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh.sha256
+curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh
+curl -fsSLO https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh.sha256
 sha256sum -c get-vesselstack.sh.sha256
 less get-vesselstack.sh
 sudo bash get-vesselstack.sh
@@ -251,7 +251,7 @@ Skip sections 5 and 6 if you used the one-line installer.
 ```bash
 git clone https://github.com/jclima/VesselStack.git
 cd VesselStack
-git checkout v0.6.0
+git checkout v0.6.1
 python3 vesselstack-wizard.py --cli     # questions in the terminal, works over plain SSH
 # python3 vesselstack-wizard.py         # the optional browser wizard (below)
 ```
diff --git a/docs/UPDATING.md b/docs/UPDATING.md
index 05cc981..385e5bd 100644
--- a/docs/UPDATING.md
+++ b/docs/UPDATING.md
@@ -15,7 +15,7 @@ Re-run the pinned release installer over `ssh -t`. It finds the installed system
 installs and starts the release:
 
 ```bash
-curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
 ```
 
 The command itself needs the unpacked release directory, so plain `vesselstackctl update`
@@ -23,9 +23,16 @@ with no argument fails. To run it by hand once a release is unpacked (the instal
 `/opt/vesselstack-release/<version>`):
 
 ```bash
-sudo vesselstackctl update /opt/vesselstack-release/0.6.0
+sudo vesselstackctl update /opt/vesselstack-release/0.6.1
 ```
 
+From a terminal (`ssh -t`) the installer now offers to fix an unsupported `BOAT_UNITS` value or
+a setting that cannot be written safely at a prompt instead of stopping (choose, or `c` to
+cancel with nothing changed). A root-only copy of the previous settings file is kept as
+`vesselstack.env.before-fix-<time>` next to it; delete these copies once the update works. Runs
+without a terminal (the Control Panel, `--yes`, `VESSELSTACK_NONINTERACTIVE=true`) still stop
+before changing anything and print the exact fix. Details: [Upgrading to 0.6.0](../README.md#upgrading-to-060).
+
 ## From the Control Panel
 
 Open the **Updates** tab and press **Check for updates**. This is the only thing that
@@ -41,6 +48,21 @@ for it to report the new version. The page reconnects by itself. See
 
 If the Control Panel is unavailable, use the pinned installer above.
 
+## When the backup drive is not mounted
+
+The pinned installer and (from an installed 0.6.1) `vesselstackctl update` and
+`vesselstackctl backup` ask, before anything is stopped, whether to mount the drive from
+`/etc/fstab`, pick a connected USB drive (ext4 recommended, exFAT allowed, vfat refused), check
+again, or back up to the system disk once. Cancelling in the pinned installer prints
+`Cancelled. The update was not started; your installed VesselStack was not changed.` (the packages
+and the release folder may already be in place). A drive mounted from the menu must have a
+root-owned top folder that others cannot write to, with no symbolic link or foreign-owned
+folder on the way to the backup folder; otherwise the backup is refused. Without a terminal, with `--yes`, or in the Control
+Panel they stop and print a `To fix:` line instead. A direct `sudo vesselstackctl update <dir>` from
+an installed 0.6.0 or earlier controller has no menu: use the pinned installer, mount the drive
+first, or run `sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update <dir>`.
+See [Backups](../README.md#backups).
+
 ## From a source checkout
 
 Use a reviewed tag from a git clone, with the dry run first:
@@ -100,7 +122,7 @@ sudo vesselstackctl restore /path/to/vesselstack-TIMESTAMP.tar.gz --yes
 Prepare a bundle on the home lab or any connected machine, carry it to the
 boat, then install without any network access. The guided installer does the
 checks, `--verify`, `--load` and install for you:
-`sudo bash get-vesselstack.sh --offline --bundle /path/to/offline-bundle --tarball /path/to/vesselstack-0.6.0.tar.gz`
+`sudo bash get-vesselstack.sh --offline --bundle /path/to/offline-bundle --tarball /path/to/vesselstack-0.6.1.tar.gz`
 (copy `get-vesselstack.sh`, the tarball with its `.sha256` and the bundle on the
 carry media; the bundle must be root-owned and not group/world-writable, and
 packages and Docker must already be installed). The manual steps follow:
@@ -188,7 +210,7 @@ and `ssh-keygen` (part of OpenSSH):
 
 ```bash
 git fetch --tags
-scripts/verify-release-tag.sh v0.6.0
+scripts/verify-release-tag.sh v0.6.1
 ```
 
 The script takes `TAG [ALLOWED_SIGNERS_FILE [EXPECTED_COMMIT]]`. It checks that the tag is
diff --git a/install.sh b/install.sh
index b4c74be..daba14b 100755
--- a/install.sh
+++ b/install.sh
@@ -23,6 +23,8 @@ usage() {
     echo "             require container images to be loaded already (see README, Offline install)"
 }
 
+# The arguments as given, so a fix made at a prompt can restart this installer unchanged.
+ORIGINAL_ARGS=("$@")
 while [ $# -gt 0 ]; do
     case "$1" in
         --config) CONFIG_FILE=$2; shift 2 ;;
@@ -35,6 +37,17 @@ while [ $# -gt 0 ]; do
 done
 
 [ -f "$CONFIG_FILE" ] || { echo "Missing config: $CONFIG_FILE" >&2; exit 1; }
+# Prompt helpers for the fixes offered below (see scripts/lib/remediate.sh).
+# shellcheck source=scripts/lib/remediate.sh
+source "$SCRIPT_DIR/scripts/lib/remediate.sh"
+# After a fix this installer restarts itself with the answers descriptor still open; this process
+# owns it now, so vs_prompt_close closes it before anything is installed or started.
+if [ "${VESSELSTACK_REMEDIATION_ROUND:-0}" != 0 ] && [ -n "$VS_PROMPT_FD" ]; then VS_PROMPT_OWNED=1; fi
+# config_key_assigned KEY: true when CONFIG_FILE itself assigns KEY (so editing it can fix it).
+config_key_assigned() { grep -Eq "^(export )?$1=" "$CONFIG_FILE"; }
+# Set below when an interactive run may offer to fix the value instead of stopping.
+FIX_BOAT_UNITS=0
+FIX_TOKEN_KEY=
 # shellcheck disable=SC1090
 source "$CONFIG_FILE"
 
@@ -82,6 +95,18 @@ BOAT_CHAT_HOST_FROM_CONFIG=${BOAT_CHAT_HOST+x}
 : "${TELEGRAM_ENABLE:=false}"
 : "${TELEMETRY_INDEXER_ENABLE:=true}"
 : "${BOAT_UNITS:=us_customary}"
+# Older setup wizards offered "nautical" and installers before 0.5.7 did not check it, so
+# such configs exist. It is read as metric (knots and nautical miles are kept in both
+# systems), and the rewritten vesselstack.env persists "metric". Surrounding whitespace and
+# letter case are tolerated for the two supported values.
+BOAT_UNITS_INPUT=$BOAT_UNITS
+BOAT_UNITS=${BOAT_UNITS#"${BOAT_UNITS%%[![:space:]]*}"}
+BOAT_UNITS=${BOAT_UNITS%"${BOAT_UNITS##*[![:space:]]}"}
+BOAT_UNITS=${BOAT_UNITS,,}
+if [ "$BOAT_UNITS" = nautical ]; then
+    echo "Note: BOAT_UNITS=nautical is no longer a separate option; using metric (knots and nautical miles are kept)." >&2
+    BOAT_UNITS=metric
+fi
 : "${NODE_EXPORTER_ENABLE:=false}"
 : "${DISPLAYS_ENABLE:=false}"
 : "${DISPLAYS_BRIDGE_MQTT_USERNAME:=vesselstack-bridge}"
@@ -160,7 +185,18 @@ for key in SOCKETCAN_ENABLE VESSELSTACK_CAN_CREATE_VCAN AIS_ENABLE VESSELSTACK_F
         *) echo "$key must be true or false" >&2; exit 1 ;;
     esac
 done
-case "$BOAT_UNITS" in us_customary|metric) ;; *) echo "BOAT_UNITS must be us_customary or metric" >&2; exit 1 ;; esac
+case "$BOAT_UNITS" in
+    us_customary|metric) ;;
+    *)
+        if config_key_assigned BOAT_UNITS && vs_prompt_open; then
+            FIX_BOAT_UNITS=1
+        else
+            echo "Refusing to continue: BOAT_UNITS=$(vs_printable "$BOAT_UNITS_INPUT") in $CONFIG_FILE is not supported." >&2
+            echo "To fix: set it to us_customary or metric, for example: sudo sed -i 's/^BOAT_UNITS=.*/BOAT_UNITS=metric/' $CONFIG_FILE" >&2
+            exit 1
+        fi
+        ;;
+esac
 # MQTT account names are written into the Mosquitto password and ACL files.
 for key in MQTT_USERNAME DISPLAYS_BRIDGE_MQTT_USERNAME; do
     if ! [[ "${!key}" =~ ^[A-Za-z0-9_.-]{1,64}$ ]]; then
@@ -171,6 +207,10 @@ done
 # The optional SignalK and Home Assistant tokens go into a systemd EnvironmentFile line.
 for key in DISPLAYS_SIGNALK_TOKEN DISPLAYS_HA_TOKEN; do
     if [[ "${!key}" =~ [[:cntrl:]] ]]; then
+        if config_key_assigned "$key" && vs_prompt_open; then
+            [ -n "$FIX_TOKEN_KEY" ] || FIX_TOKEN_KEY=$key
+            continue
+        fi
         echo "$key must not contain line breaks or control characters" >&2
         exit 1
     fi
@@ -496,6 +536,185 @@ env_line() {
 }
 # env-line-end
 
+# --- Interactive fixes -------------------------------------------------------
+# These run in the validation block, before the root check, the plugin staging and any
+# trap, so a Cancel (or a fix that cannot be applied safely) changes nothing else.
+
+# config_key_is_secret KEY: generated or preserved secrets. Replacing one here would
+# desynchronise a running service (see preserve_secret), so it is never offered.
+config_key_is_secret() {
+    case $1 in
+        INFLUXDB_PASSWORD|INFLUXDB_TOKEN|GRAFANA_ADMIN_PASSWORD|MQTT_PASSWORD|\
+        BOAT_CHAT_SETTINGS_TOKEN|BOAT_CHAT_ACCESS_TOKEN|CONTROL_PANEL_TOKEN) return 0 ;;
+    esac
+    return 1
+}
+
+# config_env_snapshot FILE KEY: in a clean subshell, sources FILE and prints the declared
+# state of every known setting except KEY (so a fix is checked against all the others).
+config_env_snapshot() {
+    local file=$1 skip=$2 key
+    (
+        set +eu
+        while IFS= read -r key; do unset "$key"; done < <(vesselstack_env_keys; extra_env_keys)
+        # shellcheck disable=SC1090
+        source "$file" >/dev/null 2>&1 || exit 3
+        while IFS= read -r key; do
+            [ "$key" = "$skip" ] && continue
+            declare -p "$key" 2>/dev/null || echo "unset $key"
+        done < <(vesselstack_env_keys; extra_env_keys)
+    )
+}
+
+# root_controlled_chain PATH: every existing component from PATH up to / is root-owned and not
+# group- or world-writable, so no other user can swap the file this installer is about to edit.
+root_controlled_chain() {
+    local resolved uid mode
+    resolved=$(realpath -m -- "$1") || return 1
+    while :; do
+        if [ -e "$resolved" ]; then
+            read -r uid mode < <(stat -c '%u %a' -- "$resolved") || return 1
+            if [ "$uid" != 0 ] || [ $((0$mode & 0022)) -ne 0 ]; then return 1; fi
+        fi
+        [ "$resolved" != / ] || return 0
+        resolved=$(dirname -- "$resolved")
+    done
+}
+
+# config_fix_key FILE KEY VALUE: sets KEY=VALUE in FILE (an env file this installer reads),
+# keeping a root-only copy, and restarts this installer with the original arguments.
+# Refuses (returns 1, FILE untouched) unless the result provably reads back the same for
+# every other setting and gives KEY exactly VALUE.
+config_fix_key() {
+    local file=$1 key=$2 value=$3 line stamp copy tmp n=1 got round restart_env
+    round=${VESSELSTACK_REMEDIATION_ROUND:-0}
+    [[ $round =~ ^[0-9]+$ ]] || round=0
+    if [ "$round" -ge 3 ]; then
+        echo "Too many fixes in one run. Nothing more was changed; run the installer again." >&2
+        return 1
+    fi
+    if [ -L "$file" ] || [ ! -f "$file" ]; then
+        echo "Not changing $file: it is not a regular file (or is a symbolic link)." >&2
+        return 1
+    fi
+    if [ "$(id -u)" -eq 0 ] && [ "$(stat -c '%u' "$file")" != 0 ]; then
+        echo "Not changing $file: it is not owned by root." >&2
+        return 1
+    fi
+    if [ "$(id -u)" -eq 0 ] && ! root_controlled_chain "$(dirname -- "$file")"; then
+        echo "Not changing $file: its folder (or a parent folder) is not root-owned, or can be changed by other users." >&2
+        return 1
+    fi
+    if env_value_problem "$value" >/dev/null || [[ $value =~ [[:cntrl:]] ]]; then
+        echo "Not changing $file: that value cannot be written safely." >&2
+        return 1
+    fi
+    line=$(env_line "$key" "$value")
+    stamp=$(date -u +%Y%m%dT%H%M%SZ)
+    copy="$file.before-fix-$stamp"
+    while [ -e "$copy" ]; do n=$((n + 1)); copy="$file.before-fix-$stamp.$n"; done
+    tmp=$(mktemp "$(dirname "$file")/.$(basename "$file").fix.XXXXXX") || {
+        echo "Not changing $file: its folder is not writable." >&2
+        return 1
+    }
+    if ! FIX_KEY=$key FIX_LINE=$line awk '
+        BEGIN { key = ENVIRON["FIX_KEY"]; line = ENVIRON["FIX_LINE"]; done = 0 }
+        index($0, key "=") == 1 || index($0, "export " key "=") == 1 {
+            if (!done) { print line; done = 1 }
+            next
+        }
+        { print }
+        END { if (!done) print line }' "$file" > "$tmp" \
+        || ! bash -n "$tmp" 2>/dev/null \
+        || [ "$(config_env_snapshot "$file" "$key"; echo x)" != "$(config_env_snapshot "$tmp" "$key"; echo x)" ]; then
+        rm -f -- "$tmp"
+        echo "Not changing $file: the edit could not be verified. Edit $key in it by hand." >&2
+        return 1
+    fi
+    got=$(
+        set +eu
+        # shellcheck disable=SC1090
+        source "$tmp" >/dev/null 2>&1 || exit 3
+        printf '%s' "${!key}"
+        echo x
+    ) || got=
+    if [ "$got" != "${value}x" ]; then
+        rm -f -- "$tmp"
+        echo "Not changing $file: the edit could not be verified. Edit $key in it by hand." >&2
+        return 1
+    fi
+    if [ "$(id -u)" -eq 0 ]; then
+        if ! install -m 0600 -o 0 -g 0 "$file" "$copy" || ! chown --reference="$file" "$tmp"; then
+            rm -f -- "$tmp" "$copy"
+            echo "Not changing $file: could not keep a copy." >&2
+            return 1
+        fi
+    else
+        install -m 0600 "$file" "$copy" \
+            || { rm -f -- "$tmp"; echo "Not changing $file: could not keep a copy." >&2; return 1; }
+    fi
+    chmod --reference="$file" "$tmp"
+    mv -f -- "$tmp" "$file"
+    echo "Changed $key in $file (previous copy: $copy). The copy is safe to delete once the install works." >&2
+    # The answers descriptor (if any) is handed on so scripted answers continue where they were.
+    restart_env=(VESSELSTACK_REMEDIATION_ROUND=$((round + 1)))
+    if [ -n "$VS_PROMPT_FD" ]; then restart_env+=(VS_PROMPT_FD="$VS_PROMPT_FD"); fi
+    exec env "${restart_env[@]}" "${BASH:-bash}" "$SCRIPT_DIR/install.sh" ${ORIGINAL_ARGS[@]+"${ORIGINAL_ARGS[@]}"}
+}
+
+# BOAT_UNITS other than us_customary, metric or the nautical mapping (flagged above).
+fix_boat_units() {
+    local choice new
+    {
+        echo "BOAT_UNITS in $CONFIG_FILE is \"$(vs_printable "$BOAT_UNITS_INPUT")\", which is not supported."
+        echo "  [1] US customary (feet, °F, psi, US gallons)"
+        echo "  [2] Metric (metres, °C, kPa, litres)"
+        echo "  [c] Cancel (nothing is changed)"
+    } >&2
+    vs_prompt_choice choice "1 2"
+    case $choice in
+        1) new=us_customary ;;
+        2) new=metric ;;
+        *) echo "Unexpected answer; nothing was changed." >&2; exit 1 ;;
+    esac
+    config_fix_key "$CONFIG_FILE" BOAT_UNITS "$new" || {
+        echo "Edit it by hand instead: sudo sed -i 's/^BOAT_UNITS=.*/BOAT_UNITS=$new/' $CONFIG_FILE" >&2
+        exit 1
+    }
+}
+
+# fix_unsafe_value KEY REASON: asks for a replacement for a setting that cannot be written
+# safely. Values typed for secrets are hidden and never echoed or logged.
+fix_unsafe_value() {
+    local key=$1 reason=$2 choice new mode=
+    {
+        echo "$key in $CONFIG_FILE cannot be written safely ($reason)."
+        echo "  [1] Enter a new value for $key"
+        echo "  [c] Cancel (nothing is changed)"
+    } >&2
+    vs_prompt_choice choice "1"
+    if vs_is_secret_key "$key"; then mode=secret; fi
+    while :; do
+        vs_prompt_input new "$mode"
+        if reason=$(env_value_problem "$new"); then
+            echo "That value still cannot be written safely ($reason). Try another." >&2
+        elif [[ $new =~ [[:cntrl:]] ]]; then
+            echo "That value still cannot be written safely (control characters). Try another." >&2
+        else
+            break
+        fi
+    done
+    config_fix_key "$CONFIG_FILE" "$key" "$new" || {
+        echo "Edit $key in $CONFIG_FILE by hand, then run again. Nothing was changed." >&2
+        exit 1
+    }
+}
+
+if [ "$FIX_BOAT_UNITS" -eq 1 ]; then fix_boat_units; fi
+if [ -n "$FIX_TOKEN_KEY" ]; then
+    fix_unsafe_value "$FIX_TOKEN_KEY" "line breaks or control characters"
+fi
+
 # Env files are written to a 0600 temp file beside the target and renamed into
 # place only when every line was written, so a failure never leaves a truncated file.
 ENV_TEMPS=()
@@ -512,20 +731,36 @@ cleanup_env_temps() {
 # and control-panel.env, run before anything is changed and before the dry run
 # exits. Reports KEY names and reasons only, never values.
 env_values_preflight() {
-    local key bad=0 reason
+    local key bad=0 hard=0 fixable='' fix_reason='' reason secrets=0 report=''
     while IFS= read -r key; do
         if reason=$(env_value_problem "${!key:-}"); then
-            echo "  $key: $reason" >&2
+            report+="  $key: $reason"$'\n'
             bad=1
+            if config_key_is_secret "$key"; then
+                secrets=1; hard=1
+            elif config_key_assigned "$key"; then
+                if [ -z "$fixable" ]; then fixable=$key; fix_reason=$reason; fi
+            else
+                hard=1
+            fi
         fi
     done < <(vesselstack_env_keys; extra_env_keys)
     if reason=$(env_value_problem "$(<"$SCRIPT_DIR/VERSION")"); then
-        echo "  VERSION: $reason" >&2
-        bad=1
+        report+="  VERSION: $reason"$'\n'
+        bad=1; hard=1
     fi
     if [ "$bad" -ne 0 ]; then
+        # Only settings this file itself assigns, and that are not generated or preserved
+        # secrets, can be fixed here; one per round (the installer restarts after each fix).
+        if [ "$hard" -eq 0 ] && [ -n "$fixable" ] && vs_prompt_open; then
+            fix_unsafe_value "$fixable" "$fix_reason"
+        fi
+        printf '%s' "$report" >&2
         echo "Refusing to continue: the settings above cannot be written safely to the environment files." >&2
-        echo "Edit them in $CONFIG_FILE (values cannot combine a single quote with a backslash, double quote, dollar sign or backtick, and cannot span lines), then run again. Nothing was changed. See README.md, \"Upgrading to 0.6.0\"." >&2
+        if [ "$secrets" -eq 1 ]; then
+            echo "A password or token that a running service already uses must be changed in that service first (replacing it here alone would lock the service out); then edit it in $CONFIG_FILE." >&2
+        fi
+        echo "To fix: edit them in $CONFIG_FILE (values cannot combine a single quote with a backslash, double quote, dollar sign or backtick, and cannot span lines), then run again. Nothing was changed. See README.md, \"Upgrading to 0.6.0\"." >&2
         exit 1
     fi
 }
@@ -595,6 +830,7 @@ MQTT_PASSWORD=$(generate_secret "${MQTT_PASSWORD:-GENERATE}")
 # check covers the values that will actually be written; read-only, so it is
 # also safe ahead of the dry run.
 env_values_preflight
+vs_prompt_close
 
 PLUGIN_STAGE=
 if [ "$SIGNALK_VESSELTWIN_PRELOAD" = true ] && [ "$SIGNALK_MODE" != existing ] && [ "$OFFLINE" = false ] && [ "$DRY_RUN" -eq 0 ]; then
@@ -1063,6 +1299,7 @@ install -m 0755 "$SCRIPT_DIR/scripts/vesselstack-firewall" "$SBIN_DIR/vesselstac
 install -d -m 0755 -o root -g root "$LIBEXEC_PARENT" "$LIBEXEC_DIR"
 install -m 0755 -o root -g root "$SCRIPT_DIR/scripts/vesselstack-update" "$SBIN_DIR/vesselstack-update"
 install -m 0755 -o root -g root "$SCRIPT_DIR/scripts/deploy-chat.py" "$LIBEXEC_DIR/deploy-chat.py"
+install -m 0644 -o root -g root "$SCRIPT_DIR/scripts/lib/remediate.sh" "$LIBEXEC_DIR/remediate.sh"
 sed "s|@VESSELSTACK_ROOT@|$VESSELSTACK_ROOT|g" \
     "$SCRIPT_DIR/systemd/vesselstack-firewall.service.in" \
     > "$SYSTEMD_DIR/vesselstack-firewall.service"
diff --git a/scripts/get-vesselstack.sh b/scripts/get-vesselstack.sh
index b9aca42..12d7bd8 100755
--- a/scripts/get-vesselstack.sh
+++ b/scripts/get-vesselstack.sh
@@ -2,7 +2,7 @@
 # VesselStack guided installer (bootstrap).
 #
 #   curl -fsSL https://github.com/jclima/VesselStack/releases/latest/download/get-vesselstack.sh | sudo bash
-#   curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.0/get-vesselstack.sh | sudo bash
+#   curl -fsSL https://github.com/jclima/VesselStack/releases/download/v0.6.1/get-vesselstack.sh | sudo bash
 #
 # Cautious alternative: download it, read it, then run it.
 #   curl -fsSLO https://github.com/jclima/VesselStack/releases/latest/download/get-vesselstack.sh
@@ -24,7 +24,7 @@ set -euo pipefail
 umask 022
 
 # Baked from VERSION by build-package.sh (and checked by tests/test-distribution.sh).
-DEFAULT_VERSION="0.6.0"
+DEFAULT_VERSION="0.6.1"
 GITHUB_RELEASES="https://github.com/jclima/VesselStack/releases/download"
 APT_PACKAGES=(ca-certificates curl jq openssl python3 python3-venv rsync tar gzip)
 
@@ -1240,6 +1240,47 @@ ensure_service_account() {
     changed "created the service account '$user' (system user, no login shell)"
 }
 
+# Before an upgrade, settles an unmounted backup drive with the owner. The installed vesselstackctl
+# may be an older release that only stops, so the question is asked here, using the release's own
+# library (trusted only after the archive was verified and its folder is root-controlled).
+# Sets BACKUP_ALLOW_ONCE=1 when the owner chose to back up to the system disk this once.
+BACKUP_ALLOW_ONCE=0
+settle_backup_destination() {
+    local env_file=$INSTALL_ROOT/config/vesselstack.env dest allow mount_dir lib=$RELEASE_DIR/scripts/lib/remediate.sh
+    local data_root app_root
+    [ "$ASSUME_YES" -eq 0 ] && [ "$DEFAULTS_ONLY" -eq 0 ] || return 0
+    [ -f "$env_file" ] && [ ! -L "$env_file" ] || return 0
+    dest=$(env_get "$env_file" VESSELSTACK_BACKUP 2>/dev/null) || dest=
+    allow=$(env_get "$env_file" VESSELSTACK_BACKUP_ALLOW_UNMOUNTED 2>/dev/null) || allow=
+    app_root=$(env_get "$env_file" VESSELSTACK_ROOT 2>/dev/null) || app_root=
+    data_root=$(env_get "$env_file" VESSELSTACK_DATA 2>/dev/null) || data_root=
+    dest=${dest:-${VESSELSTACK_BACKUP:-/var/backups/vesselstack}}
+    allow=${allow:-${VESSELSTACK_BACKUP_ALLOW_UNMOUNTED:-false}}
+    dest=$(realpath -m -- "$dest")
+    case $dest in
+        /media/*|/mnt/*) ;;
+        *) return 0 ;;
+    esac
+    [ "$allow" != true ] || return 0
+    mount_dir=$(printf '%s' "$dest" | cut -d/ -f1-3)
+    ! mountpoint -q "$mount_dir" || return 0
+    if [ ! -f "$lib" ] || [ -L "$lib" ] || ! require_root_controlled "$lib"; then
+        warn "Cannot ask about the unmounted backup drive: $lib is missing or not root-controlled. The update will stop if the drive stays unmounted."
+        return 0
+    fi
+    open_prompt || return 0
+    # shellcheck source=scripts/lib/remediate.sh
+    source "$lib"
+    say ""
+    VS_CANCEL_MESSAGE="Cancelled. The update was not started; your installed VesselStack was not changed." \
+        VS_PROMPT_FD=3 VS_BACKUP_ROOT=${app_root:-$INSTALL_ROOT} VS_BACKUP_DATA=${data_root:-/opt/vesselstack-data} \
+        VS_BACKUP_ENV_FILE=$env_file VS_BACKUP_UPDATE_DIR=$RELEASE_DIR \
+        vs_backup_destination_fix "$dest" bootstrap \
+        || die "The backup drive is not mounted, so the update did not start. Nothing was changed on the installed system." \
+               "Mount the drive at $mount_dir and run this installer again."
+    if [ "$VS_BACKUP_ALLOW_ONCE" = 1 ]; then BACKUP_ALLOW_ONCE=1; fi
+}
+
 step_install() {
     step 6 "Install and check"
     local install_args=(--config "$ENV_FILE") bundle_wheels='' offline_env=''
@@ -1296,19 +1337,27 @@ step_install() {
     fi
 
     local ctl
+    # --yes, --defaults and scripted answers never pick a fix, so neither ctl nor install.sh may ask.
+    local -a ctl_env=()
+    if [ "$ASSUME_YES" -eq 1 ] || [ "$DEFAULTS_ONLY" -eq 1 ] || [ -n "${VESSELSTACK_BOOTSTRAP_ANSWERS:-}" ]; then
+        ctl_env+=(VESSELSTACK_NONINTERACTIVE=true)
+    fi
     if [ "$UPGRADE" -eq 1 ]; then
         ctl=$(find_ctl) || die "vesselstackctl was not found, although VesselStack $INSTALLED_VERSION is installed." \
             "Run the installer directly: sudo $RELEASE_DIR/install.sh --config $INSTALL_ROOT/config/vesselstack.env --dry-run"
         # The installed ctl may be an old release whose "update" only reads $1 as the
         # directory, so the directory goes first and the mode travels in the environment
         # (read by old ctls' child install.sh and by the new ctl alike).
+        settle_backup_destination
+        # --yes, --defaults and scripted answers never pick a fix, so the ctl must not ask either.
+        if [ "$BACKUP_ALLOW_ONCE" -eq 1 ]; then ctl_env+=(VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true); fi
         say "  Running: ${offline_env}vesselstackctl update $RELEASE_DIR"
         if [ "$OFFLINE" -eq 1 ]; then
-            VESSELSTACK_OFFLINE=true VESSELSTACK_WHEELHOUSE=$bundle_wheels "$ctl" update "$RELEASE_DIR" </dev/null \
+            env "${ctl_env[@]}" VESSELSTACK_OFFLINE=true VESSELSTACK_WHEELHOUSE="$bundle_wheels" "$ctl" update "$RELEASE_DIR" </dev/null \
                 || die "The update failed (see above). Your data and the pre-update backup are untouched." \
                        "See the README sections on updating and restoring."
         else
-            "$ctl" update "$RELEASE_DIR" </dev/null \
+            env "${ctl_env[@]}" "$ctl" update "$RELEASE_DIR" </dev/null \
                 || die "The update failed (see above). Your data and the pre-update backup are untouched." \
                        "See the README sections on updating and restoring."
         fi
@@ -1316,19 +1365,19 @@ step_install() {
     else
         say "  Preflight (changes nothing): install.sh ${install_args[*]} --dry-run"
         if [ -n "$bundle_wheels" ]; then
-            VESSELSTACK_WHEELHOUSE=$bundle_wheels "$RELEASE_DIR/install.sh" "${install_args[@]}" --dry-run </dev/null \
+            env ${ctl_env[@]+"${ctl_env[@]}"} VESSELSTACK_WHEELHOUSE="$bundle_wheels" "$RELEASE_DIR/install.sh" "${install_args[@]}" --dry-run </dev/null \
                 || die "The installer's preflight failed (see above). Nothing was installed." \
                        "Fix the problem, then re-run: $(rerun_cmd --no-wizard --config "$ENV_FILE")"
             say "  Installing and starting..."
-            VESSELSTACK_WHEELHOUSE=$bundle_wheels "$RELEASE_DIR/install.sh" "${install_args[@]}" --start </dev/null \
+            env ${ctl_env[@]+"${ctl_env[@]}"} VESSELSTACK_WHEELHOUSE="$bundle_wheels" "$RELEASE_DIR/install.sh" "${install_args[@]}" --start </dev/null \
                 || die "The installation failed (see above). The installer is transactional: it makes no changes if the Python environment cannot be built." \
                        "After fixing the problem, re-run: $(rerun_cmd --no-wizard --config "$ENV_FILE")"
         else
-            "$RELEASE_DIR/install.sh" "${install_args[@]}" --dry-run </dev/null \
+            env ${ctl_env[@]+"${ctl_env[@]}"} "$RELEASE_DIR/install.sh" "${install_args[@]}" --dry-run </dev/null \
                 || die "The installer's preflight failed (see above). Nothing was installed." \
                        "Fix the problem, then re-run: $(rerun_cmd --no-wizard --config "$ENV_FILE")"
             say "  Installing and starting..."
-            "$RELEASE_DIR/install.sh" "${install_args[@]}" --start </dev/null \
+            env ${ctl_env[@]+"${ctl_env[@]}"} "$RELEASE_DIR/install.sh" "${install_args[@]}" --start </dev/null \
                 || die "The installation failed (see above). The installer is transactional: it makes no changes if the Python environment cannot be built." \
                        "After fixing the problem, re-run: $(rerun_cmd --no-wizard --config "$ENV_FILE")"
         fi
diff --git a/scripts/lib/remediate.sh b/scripts/lib/remediate.sh
new file mode 100644
index 0000000..b821329
--- /dev/null
+++ b/scripts/lib/remediate.sh
@@ -0,0 +1,455 @@
+# shellcheck shell=bash
+# Interactive remediation primitives for VesselStack scripts. SOURCED, never executed.
+#
+# Offers the owner a choice at the prompt instead of stopping on a problem the owner can fix,
+# while unattended runs (no terminal, VESSELSTACK_NONINTERACTIVE, --yes) still stop safely.
+# Everything is vs_-prefixed and safe under `set -euo pipefail`. Prompts go to stderr, the
+# answers are read from a dedicated file descriptor (never from stdin, which a pipe may own).
+#
+# vs_prompt_open               0 when answers can be read; 1 when the run is non-interactive.
+#                              Order: VESSELSTACK_NONINTERACTIVE=1|true -> 1; VS_PROMPT_FD already
+#                              open -> 0; VESSELSTACK_PROMPT_ANSWERS (regular file, test hook) ->
+#                              open it; else /dev/tty; no terminal -> 1.
+# vs_prompt_choice VAR VALID   Reads a menu answer into VAR (lower-cased) from the words in VALID
+#                              (for example "1 2"). "c" always cancels.
+# vs_prompt_input VAR [secret] Reads a value into VAR. "secret" turns the echo off. Empty input is
+#                              refused. Values are never printed.
+# vs_prompt_close              Closes the prompt descriptor again (call it when the questions are done).
+# vs_prompt_cancel             Prints "Cancelled. Nothing was changed." and exits 1.
+# vs_is_secret_key KEY         0 for names ending _TOKEN, _PASSWORD, _SECRET or _KEY.
+# vs_printable VALUE           Prints VALUE with control characters replaced by "?".
+# EOF, a timeout (VESSELSTACK_PROMPT_TIMEOUT seconds, default 300) and "c" all cancel.
+
+# vs_backup_destination_fix DEST CONTEXT [require-mounted]
+#                              Offered when DEST is under /media or /mnt and that mount point is not
+#                              mounted. CONTEXT is update, backup or bootstrap. Returns 0 when the
+#                              drive is now mounted, or when the owner chose to back up to the system
+#                              disk once (VS_BACKUP_ALLOW_ONCE=1). Returns 1 when non-interactive (after
+#                              printing the refusal and the fix). Cancelling exits 1. Inputs, all optional:
+#                              VS_BACKUP_ROOT, VS_BACKUP_DATA (sizes the backup), VS_BACKUP_ENV_FILE (the
+#                              installed env file; VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=false there hides
+#                              the system-disk choice), VS_BACKUP_UPDATE_DIR (shown in the update hint).
+#                              The third argument offers only choices 1 to 3. fstab is never written.
+
+VS_PROMPT_FD=${VS_PROMPT_FD:-}
+VS_PROMPT_OWNED=${VS_PROMPT_OWNED:-0}
+VS_BACKUP_ALLOW_ONCE=${VS_BACKUP_ALLOW_ONCE:-0}
+
+vs_prompt_cancel() {
+    echo "${VS_CANCEL_MESSAGE:-Cancelled. Nothing was changed.}" >&2
+    exit 1
+}
+
+vs_prompt_open() {
+    case "${VESSELSTACK_NONINTERACTIVE:-}" in
+        1|true) return 1 ;;
+    esac
+    if [ -n "$VS_PROMPT_FD" ]; then
+        if [[ $VS_PROMPT_FD =~ ^[0-9]+$ ]] && { : <&"$VS_PROMPT_FD"; } 2>/dev/null; then
+            return 0
+        fi
+        VS_PROMPT_FD=
+    fi
+    if [ -n "${VESSELSTACK_PROMPT_ANSWERS:-}" ]; then
+        # Honoured only for a regular file owned by this user that nobody else can write.
+        if [ -f "$VESSELSTACK_PROMPT_ANSWERS" ] && [ ! -L "$VESSELSTACK_PROMPT_ANSWERS" ] \
+            && [ "$(stat -c '%u' -- "$VESSELSTACK_PROMPT_ANSWERS" 2>/dev/null)" = "$(id -u)" ] \
+            && [[ $(stat -c '%a' -- "$VESSELSTACK_PROMPT_ANSWERS" 2>/dev/null) =~ ^[0-7]*[0145][0145]$ ]] \
+            && { : <"$VESSELSTACK_PROMPT_ANSWERS"; } 2>/dev/null; then
+            exec {VS_PROMPT_FD}<"$VESSELSTACK_PROMPT_ANSWERS"
+            VS_PROMPT_OWNED=1
+            return 0
+        fi
+        return 1
+    fi
+    # Without a controlling terminal (cron, systemd, the Control Panel) the open fails.
+    if { : </dev/tty; } 2>/dev/null; then
+        exec {VS_PROMPT_FD}</dev/tty
+        VS_PROMPT_OWNED=1
+        return 0
+    fi
+    return 1
+}
+
+vs_prompt_close() {
+    # A descriptor the caller supplied (VS_PROMPT_FD) stays open; only our own is closed.
+    if [ -n "$VS_PROMPT_FD" ] && [ "$VS_PROMPT_OWNED" -eq 1 ]; then
+        exec {VS_PROMPT_FD}<&-
+    fi
+    VS_PROMPT_FD=
+    VS_PROMPT_OWNED=0
+    return 0
+}
+
+vs_printable() {
+    local value=$1
+    printf '%s' "${value//[![:print:]]/?}"
+}
+
+vs_is_secret_key() {
+    case $1 in
+        *_TOKEN|*_PASSWORD|*_SECRET|*_KEY) return 0 ;;
+    esac
+    return 1
+}
+
+# vs_read_answer VAR [secret]: one line from the prompt descriptor. EOF with no data and a
+# timeout cancel; a final line without a newline is accepted.
+vs_read_answer() {
+    local __var=$1 __answer='' __status=0
+    if [ "${2:-}" = secret ]; then
+        IFS= read -r -s -t "${VESSELSTACK_PROMPT_TIMEOUT:-300}" -u "$VS_PROMPT_FD" __answer || __status=$?
+        echo >&2
+    else
+        IFS= read -r -t "${VESSELSTACK_PROMPT_TIMEOUT:-300}" -u "$VS_PROMPT_FD" __answer || __status=$?
+        # A terminal echoes the typed line and its Enter; scripted answers do not.
+        if [ ! -t "$VS_PROMPT_FD" ]; then echo >&2; fi
+    fi
+    if [ "$__status" -gt 128 ] || { [ "$__status" -ne 0 ] && [ -z "$__answer" ]; }; then
+        echo >&2
+        vs_prompt_cancel
+    fi
+    printf -v "$__var" '%s' "${__answer%$'\r'}"
+}
+
+vs_prompt_choice() {
+    local __var=$1 __valid=" $2 " __reply='' __tries=0 __ok
+    while :; do
+        printf 'Choice: ' >&2
+        vs_read_answer __reply
+        __reply=${__reply#"${__reply%%[![:space:]]*}"}
+        __reply=${__reply%"${__reply##*[![:space:]]}"}
+        __reply=${__reply,,}
+        [ "$__reply" != c ] || vs_prompt_cancel
+        # Exactly one listed token: "1 2" or "1 b" is a bad answer, never a guess.
+        __ok=0
+        if [ -n "$__reply" ] && [[ $__reply != *[[:space:]]* ]]; then
+            case $__valid in
+                *" $__reply "*) __ok=1 ;;
+            esac
+        fi
+        [ "$__ok" -eq 0 ] || break
+        __tries=$((__tries + 1))
+        [ "$__tries" -lt 10 ] || vs_prompt_cancel
+        echo "Please enter one of: ${2// /, }, or c to cancel." >&2
+    done
+    printf -v "$__var" '%s' "$__reply"
+}
+
+vs_prompt_input() {
+    local __var=$1 __mode=${2:-} __reply=''
+    while :; do
+        if [ "$__mode" = secret ]; then
+            printf 'New value (typing is hidden; Ctrl-D cancels): ' >&2
+        else
+            printf 'New value (Ctrl-D cancels): ' >&2
+        fi
+        vs_read_answer __reply "$__mode"
+        [ -n "$__reply" ] && break
+        echo "The value cannot be empty." >&2
+    done
+    printf -v "$__var" '%s' "$__reply"
+}
+
+# ---------------------------------------------------------------- backup drive
+
+# Reads lsblk JSON on stdin; argument 1 lists device paths that hold the system (one per line).
+# Argument 2 lists fstab entries as "source<TAB>mountpoint" lines (other mount points only).
+# Prints "OK<US>path<US>size<US>label<US>fstype<US>uuid" (US = byte 0x1f, so an empty label keeps its
+# column) for a drive that can be offered, "NO<US>...<US>reason" for a removable drive that is refused
+# and "MOUNTED<US>path<US>size<US>label<US>fstype<US>mountpoint" for a removable ext4/exFAT partition
+# that is already mounted elsewhere. Missing fields mean "not removable".
+VS_LSBLK_PY='
+import json, sys
+
+def flag(v):
+    return v is True or str(v).lower() in ("1", "true")
+
+def clean(v):
+    s = "" if v is None else str(v)
+    return "".join(c if c.isprintable() else "?" for c in s)
+
+try:
+    data = json.load(sys.stdin)
+except ValueError:
+    sys.exit(1)
+system_paths = {l for l in sys.argv[1].split("\n") if l}
+system_mounts = {"/", "/boot", "/boot/firmware"}
+fstab = {}
+for l in (sys.argv[2] if len(sys.argv) > 2 else "").split("\n"):
+    src, _, mp = l.partition("\t")
+    if src and mp:
+        fstab[src] = mp
+rows = []
+mounted = []
+
+def fstab_mount(node):
+    for key in (node.get("path"), "UUID=" + str(node.get("uuid") or ""), "LABEL=" + str(node.get("label") or ""),
+                "/dev/disk/by-uuid/" + str(node.get("uuid") or ""), "/dev/disk/by-label/" + str(node.get("label") or "")):
+        if key in fstab:
+            return fstab[key]
+    return None
+
+def subtree(node):
+    yield node
+    for child in node.get("children") or []:
+        yield from subtree(child)
+
+def walk(node, removable, system):
+    removable = removable or flag(node.get("rm")) or flag(node.get("hotplug")) or node.get("tran") == "usb"
+    children = node.get("children") or []
+    kind = node.get("type")
+    if (kind == "part" or (kind == "disk" and not children)) and node.get("fstype") and not node.get("mountpoint"):
+        rows.append((node, removable, system))
+    elif (kind == "part" or (kind == "disk" and not children)) and node.get("mountpoint") and node.get("fstype") in ("ext4", "exfat"):
+        mounted.append((node, removable, system))
+    for child in children:
+        walk(child, removable, system)
+
+for top in data.get("blockdevices") or []:
+    system = any(n.get("path") in system_paths or n.get("mountpoint") in system_mounts for n in subtree(top))
+    walk(top, False, system)
+
+for node, removable, system in sorted(rows, key=lambda r: str(r[0].get("path"))):
+    if system or not removable:
+        continue
+    fs = clean(node.get("fstype"))
+    fields = [clean(node.get("path")), clean(node.get("size")), clean(node.get("label")), fs]
+    elsewhere = fstab_mount(node)
+    if elsewhere:
+        print("\x1f".join(["NO"] + fields + ["listed in /etc/fstab for " + clean(elsewhere) + "; not offered here"]))
+    elif fs in ("ext4", "exfat"):
+        print("\x1f".join(["OK"] + fields + [clean(node.get("uuid"))]))
+    else:
+        print("\x1f".join(["NO"] + fields + [fs + " is not supported for backups; use ext4 (recommended) or exFAT"]))
+
+for node, removable, system in sorted(mounted, key=lambda r: str(r[0].get("path"))):
+    if system or not removable:
+        continue
+    print("\x1f".join(["MOUNTED", clean(node.get("path")), clean(node.get("size")), clean(node.get("label")),
+                       clean(node.get("fstype")), clean(node.get("mountpoint"))]))
+'
+
+# vs_mib KIB: whole MiB with a thousands-free digit string.
+vs_mib() {
+    printf '%s' "$(($1 / 1024))"
+}
+
+# Sets VS_BACKUP_OFFER_SYSTEM=1 when a backup to the system disk is allowed and fits, and prints why not.
+vs_backup_system_disk_check() {
+    local dest=$1 ancestor free_kib used_kib=0 size_kib du_status=0 du_out
+    VS_BACKUP_OFFER_SYSTEM=0
+    if [ -n "${VS_BACKUP_ENV_FILE:-}" ] && [ -r "$VS_BACKUP_ENV_FILE" ] \
+        && grep -Eq '^(export[[:space:]]+)?VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=["'"'"']?false' "$VS_BACKUP_ENV_FILE"; then
+        return 0
+    fi
+    ancestor=$dest
+    while [ ! -e "$ancestor" ] && [ "$ancestor" != / ]; do ancestor=$(dirname -- "$ancestor"); done
+    free_kib=$(df -Pk -- "$ancestor" 2>/dev/null | awk 'NR == 2 {print $4}')
+    case $free_kib in ''|*[!0-9]*) free_kib=0 ;; esac
+    du_out=$(timeout 60 du -skx -- "${VS_BACKUP_ROOT:-/opt/vesselstack}" "${VS_BACKUP_DATA:-/opt/vesselstack-data}" 2>/dev/null) || du_status=$?
+    if [ "$du_status" -eq 124 ]; then
+        echo "  The size of the VesselStack data could not be measured in 60 seconds (size unknown)." >&2
+        VS_BACKUP_OFFER_SYSTEM=1
+        return 0
+    fi
+    while read -r size_kib _; do
+        case $size_kib in ''|*[!0-9]*) continue ;; esac
+        used_kib=$((used_kib + size_kib))
+    done <<<"$du_out"
+    if [ "$free_kib" -lt "$used_kib" ]; then
+        echo "  The system disk has $(vs_mib "$free_kib") MiB free but the backup needs about $(vs_mib "$used_kib") MiB," >&2
+        echo "  so a backup to the system disk is not offered." >&2
+        return 0
+    fi
+    VS_BACKUP_OFFER_SYSTEM=1
+}
+
+# vs_backup_mount_device MOUNT_DIR DEVICE FSTYPE UUID: mounts the chosen drive. 0 mounted, 1 failed.
+vs_backup_mount_device() {
+    local mount_dir=$1 device=$2 fs=$3 uuid=$4 created=0 options fstab_options pass=2
+    if [[ ! $device =~ ^/dev/[A-Za-z0-9._/+-]+$ ]]; then
+        echo "Refusing to mount an unexpected device name." >&2
+        return 1
+    fi
+    if [ -L "$mount_dir" ] || { [ -e "$mount_dir" ] && [ ! -d "$mount_dir" ]; }; then
+        echo "$(vs_printable "$mount_dir") exists but is not a plain folder; move it away first." >&2
+        return 1
+    fi
+    if [ -d "$mount_dir" ] && [ -n "$(ls -A -- "$mount_dir" 2>/dev/null)" ]; then
+        echo "$(vs_printable "$mount_dir") is not empty (files hidden under a mount would be unreachable); move its contents first." >&2
+        return 1
+    fi
+    if [ ! -d "$mount_dir" ]; then
+        install -d -m 0700 -o root -g root -- "$mount_dir" || return 1
+        created=1
+    fi
+    case $fs in
+        ext4)
+            options=nodev,nosuid,noexec
+            fstab_options=nofail,noatime,nodev,nosuid,noexec
+            ;;
+        *)
+            options=nodev,nosuid,noexec,uid=0,gid=0,umask=0077
+            fstab_options=nofail,noatime,nodev,nosuid,noexec,uid=0,gid=0,umask=0077
+            pass=0
+            ;;
+    esac
+    if ! mount -t "$fs" -o "$options" "$device" "$mount_dir" || ! mountpoint -q "$mount_dir"; then
+        echo "Could not mount $device at $(vs_printable "$mount_dir")." >&2
+        if [ "$created" -eq 1 ]; then rmdir -- "$mount_dir" 2>/dev/null || true; fi
+        return 1
+    fi
+    echo "Mounted $device at $(vs_printable "$mount_dir")." >&2
+    if [[ $uuid =~ ^[A-Za-z0-9-]+$ ]]; then
+        echo "It stays mounted until reboot. To mount it at boot, add this line to /etc/fstab:" >&2
+        echo "UUID=$uuid $(vs_printable "$mount_dir") $fs $fstab_options 0 $pass" >&2
+    fi
+    return 0
+}
+
+# vs_backup_pick_drive MOUNT_DIR: lists connected USB drives and mounts the chosen one.
+# 0 mounted, 1 nothing mounted (the caller shows the menu again).
+vs_backup_pick_drive() {
+    local mount_dir=$1 json='' sources='' target src listing kind path size label fs uuid reason shown label_text pick
+    local fstab_file=${VS_FSTAB_FILE:-/etc/fstab} fstab_src fstab_mp fstab_lines='' elsewhere=''
+    local -a paths=() fss=() uuids=()
+    if ! command -v lsblk >/dev/null 2>&1 || ! command -v python3 >/dev/null 2>&1; then
+        echo "Listing drives needs lsblk and python3." >&2
+        return 1
+    fi
+    json=$(lsblk -J -p -o PATH,TYPE,SIZE,LABEL,FSTYPE,UUID,MOUNTPOINT,RM,HOTPLUG,TRAN,PKNAME 2>/dev/null) || json=
+    if [ -z "$json" ]; then
+        echo "Could not list the connected drives." >&2
+        return 1
+    fi
+    for target in / /boot/firmware "${VS_BACKUP_DATA:-}"; do
+        [ -n "$target" ] || continue
+        src=$(findmnt -n -o SOURCE --target "$target" 2>/dev/null | head -n 1) || src=
+        src=${src%%\[*}
+        case $src in /dev/*) sources+="$src"$'\n' ;; esac
+    done
+    # Drives that /etc/fstab assigns to another mount point (a data SSD that failed to mount) are not offered.
+    if [ -r "$fstab_file" ]; then
+        while read -r fstab_src fstab_mp _; do
+            case $fstab_src in ''|'#'*) continue ;; esac
+            [ "$fstab_mp" != "$mount_dir" ] || continue
+            fstab_lines+="$fstab_src"$'\t'"$fstab_mp"$'\n'
+        done <"$fstab_file"
+    fi
+    listing=$(printf '%s' "$json" | python3 -I -c "$VS_LSBLK_PY" "$sources" "$fstab_lines") || listing=
+    echo "Connected USB drives that are not mounted:" >&2
+    shown=0
+    while IFS=$'\x1f' read -r kind path size label fs uuid; do
+        [ -n "$kind" ] || continue
+        label_text='(no label)'
+        [ -z "$label" ] || label_text="\"$label\""
+        if [ "$kind" = MOUNTED ]; then
+            elsewhere+="  $path  $size  $label_text  $fs, mounted at $uuid"$'\n'
+            continue
+        elif [ "$kind" = OK ]; then
+            paths+=("$path"); fss+=("$fs"); uuids+=("$uuid")
+            echo "  [${#paths[@]}] $path  $size  $label_text  $fs" >&2
+        else
+            reason=$uuid
+            echo "      $path  $size  $label_text  $fs -- $reason" >&2
+        fi
+        shown=1
+    done <<<"$listing"
+    if [ "$shown" -eq 0 ]; then
+        echo "  (none found)" >&2
+    fi
+    if [ "${#paths[@]}" -eq 0 ]; then
+        echo "No unmounted USB drive was found. If your desktop already mounted the drive (for example under /media/<user>/...), unmount it first: sudo umount <path>." >&2
+        if [ -n "$elsewhere" ]; then
+            echo "Already mounted elsewhere:" >&2
+            printf '%s' "$elsewhere" >&2
+        fi
+        echo "Plug in a drive formatted as ext4 (recommended) or exFAT, then choose [3] to check again." >&2
+        return 1
+    fi
+    echo "  [b] Back" >&2
+    pick=
+    vs_prompt_choice pick "$(seq -s ' ' 1 "${#paths[@]}") b"
+    [ "$pick" != b ] || return 1
+    vs_backup_mount_device "$mount_dir" "${paths[pick - 1]}" "${fss[pick - 1]}" "${uuids[pick - 1]}"
+}
+
+vs_backup_menu() {
+    local dest=$1 context=$2 strict=$3 mount_dir=$4 cancel_what=the\ update choice valid
+    local has_fstab=0
+    [ "$context" != backup ] || cancel_what='the backup'
+    if command -v findmnt >/dev/null 2>&1 && findmnt --fstab -n --mountpoint "$mount_dir" >/dev/null 2>&1; then
+        has_fstab=1
+    fi
+    VS_BACKUP_OFFER_SYSTEM=0
+    [ -n "$strict" ] || vs_backup_system_disk_check "$dest"
+    while :; do
+        {
+            echo
+            echo "The backup folder $(vs_printable "$dest") is on $mount_dir, which is not mounted."
+            echo "Backing up now would put the archive on the system disk (SD card)."
+            echo "Nothing has been changed yet."
+        } >&2
+        valid="2 3"
+        if [ "$has_fstab" -eq 1 ]; then
+            echo "  [1] Mount $(vs_printable "$mount_dir") now (it is listed in /etc/fstab)" >&2
+            valid="1 $valid"
+        fi
+        echo "  [2] Choose a connected drive to mount at $(vs_printable "$mount_dir")" >&2
+        echo "  [3] I have plugged the drive in; check again" >&2
+        if [ "$VS_BACKUP_OFFER_SYSTEM" -eq 1 ]; then
+            echo "  [4] Back up to the system disk this once (not recommended)" >&2
+            valid="$valid 4"
+        fi
+        echo "  [c] Cancel $cancel_what" >&2
+        choice=
+        vs_prompt_choice choice "$valid"
+        case $choice in
+            1)
+                if mount -- "$mount_dir" && mountpoint -q "$mount_dir"; then
+                    echo "Mounted $(vs_printable "$mount_dir")." >&2
+                    return 0
+                fi
+                echo "Could not mount $(vs_printable "$mount_dir") from /etc/fstab." >&2
+                ;;
+            2)
+                if vs_backup_pick_drive "$mount_dir"; then return 0; fi
+                ;;
+            3)
+                if mountpoint -q "$mount_dir"; then
+                    echo "$(vs_printable "$mount_dir") is mounted." >&2
+                    return 0
+                fi
+                echo "$(vs_printable "$mount_dir") is still not mounted." >&2
+                ;;
+            4)
+                echo "WARNING: the backup will be written to the system disk (SD card) this once. It will not survive loss of that disk, and the next backup asks again." >&2
+                VS_BACKUP_ALLOW_ONCE=1
+                return 0
+                ;;
+        esac
+    done
+}
+
+vs_backup_destination_fix() {
+    local dest=$1 context=${2:-update} strict=${3:-} mount_dir rc=0 update_dir=${VS_BACKUP_UPDATE_DIR:-<DIR>}
+    mount_dir=$(printf '%s' "$dest" | cut -d/ -f1-3)
+    VS_BACKUP_ALLOW_ONCE=0
+    if ! vs_prompt_open; then
+        {
+            echo "Refusing to back up: $(vs_printable "$mount_dir") is not mounted, so the archive would land on the system disk (SD card). Nothing was changed."
+            if [ "$context" = backup ] && [ -n "$strict" ]; then
+                echo "To fix: mount the backup drive at $(vs_printable "$mount_dir") and run again."
+            elif [ "$context" = backup ]; then
+                echo "To fix: mount the backup drive at $(vs_printable "$mount_dir") and run again, or pass --allow-unmounted."
+            else
+                echo "To fix: mount the backup drive at $(vs_printable "$mount_dir") and run again, or back up to the system disk this once: sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update $update_dir"
+            fi
+        } >&2
+        return 1
+    fi
+    vs_backup_menu "$dest" "$context" "$strict" "$mount_dir" || rc=$?
+    vs_prompt_close
+    return "$rc"
+}
diff --git a/scripts/vesselstackctl b/scripts/vesselstackctl
index 1f7ffca..1604cbb 100755
--- a/scripts/vesselstackctl
+++ b/scripts/vesselstackctl
@@ -1478,6 +1478,82 @@ existing_ancestor() {
     printf '%s' "$path"
 }
 
+# The prompt helpers live in the installed, root-owned library. A copy that another user could
+# have changed is never sourced (it would run as root).
+load_remediation_lib() {
+    local lib=$LIBEXEC_DIR/remediate.sh uid mode top dir
+    [ -f "$lib" ] && [ ! -L "$lib" ] || return 1
+    read -r uid mode < <(stat -c '%u %a' -- "$lib") || return 1
+    [ "$uid" = 0 ] && [ $((0$mode & 0022)) -eq 0 ] || return 1
+    # Every folder above it, up to / (or the test root), must be root-controlled too.
+    top=/
+    [ -z "$SYSTEM_ROOT" ] || top=$(realpath -m -- "$SYSTEM_ROOT")
+    dir=$(realpath -m -- "$LIBEXEC_DIR") || return 1
+    while :; do
+        read -r uid mode < <(stat -c '%u %a' -- "$dir") || return 1
+        [ "$uid" = 0 ] && [ $((0$mode & 0022)) -eq 0 ] || return 1
+        { [ "$dir" = "$top" ] || [ "$dir" = / ]; } && break
+        dir=$(dirname -- "$dir")
+    done
+    # shellcheck source=scripts/lib/remediate.sh
+    source "$lib"
+}
+
+# Offers the owner a way out when the backup drive is not mounted. Returns 0 when the drive is
+# mounted now or the owner chose to back up to the system disk once (sets VS_BACKUP_ALLOW_ONCE=1),
+# 1 when the run cannot ask. Cancelling exits. Nothing has been stopped yet.
+fix_unmounted_backup() {
+    local destination=$1 mount_dir=$2 strict=${3:-} context=${VS_BACKUP_CONTEXT:-backup} update_dir=${VS_BACKUP_UPDATE_DIR:-<DIR>}
+    if load_remediation_lib; then
+        VS_BACKUP_ROOT=$VESSELSTACK_ROOT VS_BACKUP_DATA=$VESSELSTACK_DATA VS_BACKUP_ENV_FILE=$ENV_FILE \
+            vs_backup_destination_fix "$destination" "$context" "$strict"
+        return
+    fi
+    echo "Refusing to back up: $mount_dir is not mounted, so the archive would land on the system disk (SD card). Nothing was changed." >&2
+    if [ "$context" = backup ] && [ -n "$strict" ]; then
+        echo "To fix: mount the backup drive at $mount_dir and run again." >&2
+    elif [ "$context" = backup ]; then
+        echo "To fix: mount the backup drive at $mount_dir and run again, or pass --allow-unmounted." >&2
+    else
+        echo "To fix: mount the backup drive at $mount_dir and run again, or back up to the system disk this once: sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update $update_dir" >&2
+    fi
+    return 1
+}
+
+# verify_mounted_destination DESTINATION MOUNT_DIR: a drive mounted just now may carry anything.
+# The mount root must be root-owned and not group- or world-writable, and no folder under it on the
+# way to DESTINATION may be a symbolic link or belong to another user. Refuses before anything is written.
+verify_mounted_destination() {
+    local destination=$1 mount_dir=$2 resolved cur rel part uid mode shown
+    local -a parts=()
+    [ -d "$mount_dir" ] || return 0
+    shown=${destination//[![:print:]]/?}
+    resolved=$(realpath -m -- "$destination") || resolved=
+    if [ "$resolved" != "$destination" ]; then
+        echo "Refusing to back up: a folder of $shown on the newly mounted drive is a symbolic link. Nothing was written." >&2
+        return 1
+    fi
+    read -r uid mode < <(stat -c '%u %a' -- "$mount_dir") || return 1
+    if [ "$uid" != 0 ] || [ $((0$mode & 0022)) -ne 0 ]; then
+        echo "Refusing to back up: the top folder of the newly mounted drive is not owned by root or can be changed by other users. Nothing was written." >&2
+        echo "To fix: sudo chown root:root ${mount_dir//[![:print:]]/?} && sudo chmod 755 ${mount_dir//[![:print:]]/?}" >&2
+        return 1
+    fi
+    cur=$mount_dir
+    rel=${destination#"$mount_dir"}
+    IFS=/ read -r -a parts <<<"${rel#/}"
+    for part in ${parts[@]+"${parts[@]}"}; do
+        [ -n "$part" ] || continue
+        cur="$cur/$part"
+        [ -e "$cur" ] || [ -L "$cur" ] || break
+        read -r uid mode < <(stat -c '%u %a' -- "$cur") || return 1
+        if [ -L "$cur" ] || [ "$uid" != 0 ] || [ $((0$mode & 0022)) -ne 0 ]; then
+            echo "Refusing to back up: ${cur//[![:print:]]/?} on the newly mounted drive is a symbolic link, belongs to another user or can be changed by other users. Nothing was written." >&2
+            return 1
+        fi
+    done
+}
+
 check_backup_destination() {
     local destination=$1 allow_unmounted=$2 mount_dir ancestor
     case "$destination" in
@@ -1487,8 +1563,11 @@ check_backup_destination() {
                 if [ "$allow_unmounted" -eq 1 ] || [ "${VESSELSTACK_BACKUP_ALLOW_UNMOUNTED:-false}" = true ]; then
                     echo "WARNING: $mount_dir is not a mounted filesystem; the backup will be written to the system disk" >&2
                 else
-                    echo "Refusing to back up: $mount_dir is not mounted, so the archive would silently land on the system disk (SD card). Mount the backup device or pass --allow-unmounted." >&2
-                    return 1
+                    VS_BACKUP_ALLOW_ONCE=0
+                    fix_unmounted_backup "$destination" "$mount_dir" || return 1
+                    if [ "${VS_BACKUP_ALLOW_ONCE:-0}" != 1 ] && mountpoint -q "$mount_dir"; then
+                        verify_mounted_destination "$destination" "$mount_dir" || return 1
+                    fi
                 fi
             fi
             ;;
@@ -1523,7 +1602,10 @@ PY
         case "$destination" in
             /media/*|/mnt/*)
                 mount_dir=$(printf '%s' "$destination" | cut -d/ -f1-3)
-                mountpoint -q "$mount_dir" || { echo "Refusing backup: destination is not mounted: $mount_dir" >&2; exit 1; }
+                if ! mountpoint -q "$mount_dir"; then
+                    fix_unmounted_backup "$destination" "$mount_dir" require-mounted || exit 1
+                    verify_mounted_destination "$destination" "$mount_dir" || exit 1
+                fi
                 ;;
             *) echo "Refusing backup: --require-mounted requires a /media or /mnt destination" >&2; exit 1 ;;
         esac
@@ -1814,7 +1896,8 @@ update_stack() {
     [ "$offline" != true ] || install_args+=(--offline)
     [ -x "$source/install.sh" ] || { echo "Not a VesselStack release directory: $source" >&2; exit 1; }
     "$source/install.sh" "${install_args[@]}" --dry-run
-    backup_stack "${VESSELSTACK_BACKUP:-/var/backups/vesselstack}"
+    # The backup check runs before anything is stopped; it may ask where to back up.
+    VS_BACKUP_CONTEXT=update VS_BACKUP_UPDATE_DIR=$source backup_stack "${VESSELSTACK_BACKUP:-/var/backups/vesselstack}"
     "$source/install.sh" "${install_args[@]}" --start
 }
 
@@ -1857,7 +1940,7 @@ uninstall_stack() {
         "$SYSTEMD_DIR/vesselstack-displays-bridge.service" \
         "$SYSTEMD_DIR/vesselstack-control-panel.service" "$SBIN_DIR/vesselstackctl"
     rm -f -- "$SYSTEMD_DIR/vesselstack-firewall.service" "$SBIN_DIR/vesselstack-firewall" \
-        "$SBIN_DIR/vesselstack-update" "$LIBEXEC_DIR/deploy-chat.py"
+        "$SBIN_DIR/vesselstack-update" "$LIBEXEC_DIR/deploy-chat.py" "$LIBEXEC_DIR/remediate.sh"
     rmdir -- "$LIBEXEC_DIR" 2>/dev/null || true
     systemctl daemon-reload
     if [ "$purge" -eq 1 ]; then
diff --git a/tests/test-clean-install.sh b/tests/test-clean-install.sh
index ac3d897..49b0224 100755
--- a/tests/test-clean-install.sh
+++ b/tests/test-clean-install.sh
@@ -2,8 +2,18 @@
 
 set -euo pipefail
 
+# Unattended by default: nothing in this file may block on a prompt. The interactive
+# cases below unset it for their own runs and feed answers from a file.
+export VESSELSTACK_NONINTERACTIVE=true
 REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
-TEST_ROOT=$(mktemp -d)
+# The installer edits a config file only inside root-controlled folders, so a root run keeps its
+# scratch space under /usr/local/share rather than the sticky, world-writable /tmp.
+if [ "$(id -u)" -eq 0 ]; then
+    mkdir -p /usr/local/share/vs-test
+    TEST_ROOT=$(mktemp -d /usr/local/share/vs-test/vs-ci.XXXXXX)
+else
+    TEST_ROOT=$(mktemp -d)
+fi
 trap 'rm -rf -- "$TEST_ROOT"' EXIT
 FAKE_BIN="$TEST_ROOT/bin"
 APP_ROOT="$TEST_ROOT/opt/vesselstack"
@@ -260,17 +270,17 @@ test "$(sed -n 's/^BOAT_CHAT_ACCESS_TOKEN=//p' "$APP_ROOT/config/boat-chat.env")
 # config (which still says GENERATE): InfluxDB/Grafana/MQTT ignore changed
 # credentials after first start, so regenerating would desynchronise them.
 secret_keys=(INFLUXDB_PASSWORD INFLUXDB_TOKEN GRAFANA_ADMIN_PASSWORD MQTT_PASSWORD)
-declare -A secret_before=()
+declare -A pw_before=()
 for key in "${secret_keys[@]}"; do
-    secret_before[$key]=$(sed -n "s/^${key}=//p" "$APP_ROOT/config/vesselstack.env")
-    [[ "${secret_before[$key]}" =~ ^[a-f0-9]{64}$ ]] || { echo "$key was not generated" >&2; exit 1; }
+    pw_before[$key]=$(sed -n "s/^${key}=//p" "$APP_ROOT/config/vesselstack.env")
+    [[ "${pw_before[$key]}" =~ ^[a-f0-9]{64}$ ]] || { echo "$key was not generated" >&2; exit 1; }
 done
 influx_token_chat_before=$(sed -n 's/^INFLUXDB_TOKEN=//p' "$APP_ROOT/config/boat-chat.env")
 settings_token_before=$(sed -n 's/^BOAT_CHAT_SETTINGS_TOKEN=//p' "$APP_ROOT/config/boat-chat.env")
 env PATH="$FAKE_BIN:$PATH" VESSELSTACK_SYSTEM_ROOT="$SYSTEM_ROOT" \
     "$REPO_ROOT/install.sh" --config "$CONFIG" >/dev/null
 for key in "${secret_keys[@]}"; do
-    test "$(sed -n "s/^${key}=//p" "$APP_ROOT/config/vesselstack.env")" = "${secret_before[$key]}"
+    test "$(sed -n "s/^${key}=//p" "$APP_ROOT/config/vesselstack.env")" = "${pw_before[$key]}"
 done
 # A configuration that really sets BOAT_CHAT_HOST (here the wizard-style original) does apply it.
 grep -qx 'BOAT_CHAT_HOST=0.0.0.0' "$APP_ROOT/config/boat-chat.env"
@@ -725,6 +735,258 @@ HOME_ASSISTANT_TOKEN="it's fine"
 CFG
 xinstall "$X_APP/installer/install.sh" --config "$GOODVAL" --dry-run | grep -q 'Preflight passed'
 
+# 1b-bis. Legacy BOAT_UNITS=nautical (offered by older wizards, unchecked before 0.5.7) is read as
+# metric: the dry run prints one note and changes nothing; a real run persists metric. Any other
+# unsupported value is refused before anything changes, with a message naming the file and fix.
+NAUTICAL="$TEST_ROOT/nautical.env"
+grep -v '^BOAT_UNITS=' "$XENV" > "$NAUTICAL"
+printf 'BOAT_UNITS=nautical\n' >> "$NAUTICAL"
+env_before=$(sha256sum "$XENV")
+xinstall "$X_APP/installer/install.sh" --config "$NAUTICAL" --dry-run >"$TEST_ROOT/nautical.out" 2>&1
+grep -q 'Preflight passed' "$TEST_ROOT/nautical.out"
+test "$(grep -c 'BOAT_UNITS=nautical is no longer a separate option; using metric (knots and nautical miles are kept)' "$TEST_ROOT/nautical.out")" -eq 1
+test "$env_before" = "$(sha256sum "$XENV")"
+IMPERIAL="$TEST_ROOT/imperial.env"
+grep -v '^BOAT_UNITS=' "$XENV" > "$IMPERIAL"
+printf 'BOAT_UNITS=imperial\n' >> "$IMPERIAL"
+expect_unchanged_failure "dry-run with unsupported units" xinstall "$X_APP/installer/install.sh" --config "$IMPERIAL" --dry-run
+grep -qF "Refusing to continue: BOAT_UNITS=imperial in $IMPERIAL is not supported." "$TEST_ROOT/failure.out"
+grep -qF "To fix: set it to us_customary or metric, for example: sudo sed -i 's/^BOAT_UNITS=.*/BOAT_UNITS=metric/' $IMPERIAL" "$TEST_ROOT/failure.out"
+expect_unchanged_failure "real run with unsupported units" xinstall "$X_APP/installer/install.sh" --config "$IMPERIAL"
+grep -q 'BOAT_UNITS=imperial' "$TEST_ROOT/failure.out"
+xinstall "$X_APP/installer/install.sh" --config "$NAUTICAL" >/dev/null 2>&1
+grep -q "^BOAT_UNITS=metric$" "$XENV"
+if grep -q nautical "$XENV"; then echo "the installed config still says nautical" >&2; exit 1; fi
+
+# 1b-ter. Interactive fixes (VESSELSTACK_PROMPT_ANSWERS is the test hook for the terminal):
+# an unsupported units value or an unsafe saved value is fixed at the prompt, a copy of the
+# previous file is kept (root-only), and the installer restarts with the same arguments.
+# Cancel, end of input and unattended runs change nothing; generated secrets are never offered.
+ANS="$TEST_ROOT/answers"
+xask() { # ANSWERS_FILE COMMAND... : run with the terminal replaced by the answers file
+    local answers=$1
+    shift
+    env -u VESSELSTACK_NONINTERACTIVE VESSELSTACK_PROMPT_ANSWERS="$answers" PATH="$FAKE_BIN:$PATH" VESSELSTACK_SYSTEM_ROOT="$SYSTEM_ROOT" "$@"
+}
+fresh_config() { # NAME : a copy of the installed config; sets FRESH
+    FRESH="$TEST_ROOT/$1.env"
+    cp "$XENV" "$FRESH"
+}
+copies_of() { compgen -G "$1.before-fix-*" || true; }
+inst="$X_APP/installer/install.sh"
+
+# Units: [2] metric.
+fresh_config fix-units
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+printf '2\n' > "$ANS"
+xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1
+grep -q 'Preflight passed' "$TEST_ROOT/fix.out"
+grep -qF "BOAT_UNITS in $FRESH is \"imperial\", which is not supported." "$TEST_ROOT/fix.out"
+grep -qF '[1] US customary (feet, °F, psi, US gallons)' "$TEST_ROOT/fix.out"
+grep -qF '[2] Metric (metres, °C, kPa, litres)' "$TEST_ROOT/fix.out"
+grep -qF '[c] Cancel (nothing is changed)' "$TEST_ROOT/fix.out"
+grep -q "^Changed BOAT_UNITS in $FRESH (previous copy: $FRESH.before-fix-" "$TEST_ROOT/fix.out"
+grep -qx 'BOAT_UNITS=metric' "$FRESH"
+test "$(grep -c '^BOAT_UNITS=' "$FRESH")" -eq 1
+test "$(copies_of "$FRESH" | wc -l)" -eq 1
+fix_copy=$(copies_of "$FRESH")
+test "$(stat -c '%a %u:%g' "$fix_copy")" = "600 0:0"
+grep -qx 'BOAT_UNITS=imperial' "$fix_copy"
+test "$(stat -c '%a' "$FRESH")" = "$(stat -c '%a' "$XENV")"
+test -z "$(find "$TEST_ROOT" -maxdepth 1 -name '.*.fix.*' -print -quit)"
+# A bad choice is asked again; [1] is US customary; the dry run changed nothing installed.
+fresh_config fix-units1
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+printf 'x\n1\n' > "$ANS"
+xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1
+grep -q 'Please enter one of: 1, 2, or c to cancel.' "$TEST_ROOT/fix.out"
+grep -qx 'BOAT_UNITS=us_customary' "$FRESH"
+# Anything but exactly one listed token is a bad answer: "1 2" and "1 b" are asked again and
+# never guess (a bad answer must not fall through to metric).
+fresh_config fix-units-multi
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+printf '1 2\n1 b\n 2 1 \n1\n' > "$ANS"
+xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1
+test "$(grep -c 'Please enter one of: 1, 2, or c to cancel.' "$TEST_ROOT/fix.out")" -eq 3
+grep -qx 'BOAT_UNITS=us_customary' "$FRESH"
+fresh_config fix-units-multi-cancel
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+multi_before=$(sha256sum "$FRESH")
+printf '1 2\nc\n' > "$ANS"
+if xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "a multi-token answer was accepted" >&2
+    exit 1
+fi
+test "$multi_before" = "$(sha256sum "$FRESH")"
+test -z "$(copies_of "$FRESH")"
+
+# A config in a folder other users can change is never edited, even when the answer is valid.
+if [ "$(id -u)" -eq 0 ]; then
+    open_dir="$TEST_ROOT/open-dir"
+    mkdir -p "$open_dir"
+    chmod 0777 "$open_dir"
+    grep -v '^BOAT_UNITS=' "$XENV" > "$open_dir/vs.env"
+    printf 'BOAT_UNITS=imperial\n' >> "$open_dir/vs.env"
+    open_before=$(sha256sum "$open_dir/vs.env")
+    printf '2\n' > "$ANS"
+    if xask "$ANS" "$inst" --config "$open_dir/vs.env" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+        echo "a config in a world-writable folder was edited" >&2
+        exit 1
+    fi
+    grep -qF "its folder (or a parent folder) is not root-owned, or can be changed by other users" "$TEST_ROOT/fix.out"
+    grep -qF "Edit it by hand instead:" "$TEST_ROOT/fix.out"
+    test "$open_before" = "$(sha256sum "$open_dir/vs.env")"
+    test -z "$(copies_of "$open_dir/vs.env")"
+fi
+
+# Cancel and end of input leave the file byte-identical and print one clear line.
+fresh_config fix-cancel
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+cancel_before=$(sha256sum "$FRESH")
+for answers in 'c\n' 'C\n' ''; do
+    # shellcheck disable=SC2059
+    printf "$answers" > "$ANS"
+    if xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+        echo "a cancelled prompt succeeded" >&2
+        exit 1
+    fi
+    grep -qx 'Cancelled. Nothing was changed.' "$TEST_ROOT/fix.out"
+    test "$cancel_before" = "$(sha256sum "$FRESH")"
+    test -z "$(copies_of "$FRESH")"
+done
+
+# Unsafe saved value: hidden re-entry, nothing printed, an unsafe replacement is refused.
+fresh_config fix-token
+# shellcheck disable=SC2016  # literal $ in the fixture
+printf 'HOME_ASSISTANT_TOKEN="it'"'"'s \\$SECRET"\n' >> "$FRESH"
+# shellcheck disable=SC2016  # literal $ in the fixture
+printf '1\nzqbad'"'"'\\$x\nnew-token-value\n' > "$ANS"
+xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1
+grep -q 'Preflight passed' "$TEST_ROOT/fix.out"
+grep -qF 'HOME_ASSISTANT_TOKEN in' "$TEST_ROOT/fix.out"
+grep -qF '[1] Enter a new value for HOME_ASSISTANT_TOKEN' "$TEST_ROOT/fix.out"
+grep -q 'That value still cannot be written safely' "$TEST_ROOT/fix.out"
+for secret in SECRET zqbad 'new-token-value'; do
+    if grep -q "$secret" "$TEST_ROOT/fix.out"; then echo "the prompt printed a typed or saved value" >&2; exit 1; fi
+done
+grep -qx 'HOME_ASSISTANT_TOKEN=new-token-value' "$FRESH"
+test "$(grep -c '^HOME_ASSISTANT_TOKEN=' "$FRESH")" -eq 1
+test "$(copies_of "$FRESH" | wc -l)" -eq 1
+grep -q 'SECRET' "$(copies_of "$FRESH")"
+# A control character in a display token is fixed the same way, after a units fix in the same
+# run (two restarts; the answers carry over).
+fresh_config fix-two
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\nDISPLAYS_SIGNALK_TOKEN="a\tb"\n' >> "$FRESH"
+printf '2\n1\nclean-token\n' > "$ANS"
+xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1
+grep -q 'Preflight passed' "$TEST_ROOT/fix.out"
+grep -qx 'BOAT_UNITS=metric' "$FRESH"
+grep -qx 'DISPLAYS_SIGNALK_TOKEN=clean-token' "$FRESH"
+test "$(copies_of "$FRESH" | wc -l)" -eq 2
+
+# Generated or preserved secrets are never offered for replacement (the service still
+# holds the old one); the hard stop explains. Unattended runs behave exactly as before.
+fresh_config fix-secret
+# shellcheck disable=SC2016  # literal $ in the fixture
+printf 'INFLUXDB_PASSWORD="it'"'"'s \\$x"\n' >> "$FRESH"
+hardstop_before=$(sha256sum "$FRESH")
+printf '1\nreplacement\n' > "$ANS"
+if xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "a bad secret was accepted" >&2
+    exit 1
+fi
+grep -q 'INFLUXDB_PASSWORD' "$TEST_ROOT/fix.out"
+grep -q 'must be changed in that service first' "$TEST_ROOT/fix.out"
+grep -q 'Nothing was changed' "$TEST_ROOT/fix.out"
+if grep -q 'Enter a new value' "$TEST_ROOT/fix.out"; then echo "a secret was offered for replacement" >&2; exit 1; fi
+test "$hardstop_before" = "$(sha256sum "$FRESH")"
+test -z "$(copies_of "$FRESH")"
+
+# A value that does not come from the file cannot be fixed by editing it: hard stop.
+fresh_config fix-env
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf '2\n' > "$ANS"
+if BOAT_UNITS=imperial xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "an unsupported environment value was accepted" >&2
+    exit 1
+fi
+grep -qF "BOAT_UNITS=imperial in $FRESH is not supported." "$TEST_ROOT/fix.out"
+test -z "$(copies_of "$FRESH")"
+
+# A symbolic link is never rewritten; the round cap stops a restart loop.
+fresh_config fix-link-target
+grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+ln -s "$FRESH" "$TEST_ROOT/fix-link.env"
+link_before=$(sha256sum "$FRESH")
+printf '2\n' > "$ANS"
+if xask "$ANS" "$inst" --config "$TEST_ROOT/fix-link.env" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "a symbolic-link config was rewritten" >&2
+    exit 1
+fi
+grep -q 'it is not a regular file' "$TEST_ROOT/fix.out"
+grep -q 'Edit it by hand instead' "$TEST_ROOT/fix.out"
+test "$link_before" = "$(sha256sum "$FRESH")"
+printf '2\n' > "$ANS"
+if VESSELSTACK_REMEDIATION_ROUND=3 xask "$ANS" "$inst" --config "$FRESH" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "the restart cap did not stop the run" >&2
+    exit 1
+fi
+grep -q 'Too many fixes in one run' "$TEST_ROOT/fix.out"
+test "$link_before" = "$(sha256sum "$FRESH")"
+test -z "$(copies_of "$FRESH")"
+
+# Unattended, with and without a terminal that is not available: the old message, nothing asked.
+printf '2\n' > "$ANS"
+# The answers hook is ignored unless the file is private to this user: a group- or world-writable
+# file or a symbolic link is never read.
+chmod 0666 "$ANS"
+if env PATH="$FAKE_BIN:$PATH" VESSELSTACK_SYSTEM_ROOT="$SYSTEM_ROOT" VESSELSTACK_PROMPT_ANSWERS="$ANS" \
+    "$inst" --config "$IMPERIAL" --dry-run >"$TEST_ROOT/fix.out" 2>&1 </dev/null; then
+    echo "a world-writable answers file was honoured" >&2
+    exit 1
+fi
+if grep -q 'Choice:' "$TEST_ROOT/fix.out"; then echo "a world-writable answers file was read" >&2; exit 1; fi
+chmod 0600 "$ANS"
+if env PATH="$FAKE_BIN:$PATH" VESSELSTACK_SYSTEM_ROOT="$SYSTEM_ROOT" VESSELSTACK_PROMPT_ANSWERS="$ANS" \
+    "$inst" --config "$IMPERIAL" --dry-run >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "an unattended run accepted an unsupported value" >&2
+    exit 1
+fi
+grep -qF "BOAT_UNITS=imperial in $IMPERIAL is not supported." "$TEST_ROOT/fix.out"
+grep -qF "To fix: set it to us_customary or metric" "$TEST_ROOT/fix.out"
+if grep -q 'Choice:' "$TEST_ROOT/fix.out"; then echo "an unattended run asked a question" >&2; exit 1; fi
+if env -u VESSELSTACK_NONINTERACTIVE PATH="$FAKE_BIN:$PATH" VESSELSTACK_SYSTEM_ROOT="$SYSTEM_ROOT" \
+    setsid "$inst" --config "$IMPERIAL" --dry-run </dev/null >"$TEST_ROOT/fix.out" 2>&1; then
+    echo "a run without a terminal accepted an unsupported value" >&2
+    exit 1
+fi
+grep -qF "BOAT_UNITS=imperial in $IMPERIAL is not supported." "$TEST_ROOT/fix.out"
+test -z "$(copies_of "$IMPERIAL")"
+
+# The real thing: a pseudo-terminal, answers typed on stdin of `script`.
+if command -v script >/dev/null 2>&1 && command -v setsid >/dev/null 2>&1; then
+    fresh_config fix-pty
+    grep -v '^BOAT_UNITS=' "$XENV" > "$FRESH"
+    printf 'BOAT_UNITS=imperial\n' >> "$FRESH"
+    pty_cmd="env -u VESSELSTACK_NONINTERACTIVE PATH=$FAKE_BIN:$PATH VESSELSTACK_SYSTEM_ROOT=$SYSTEM_ROOT $inst --config $FRESH --dry-run"
+    # Give the installer a moment to reach the prompt; the pty keeps early input queued anyway.
+    { sleep 2; printf '2\n'; sleep 3; } | timeout 120 setsid script -qec "$pty_cmd" /dev/null >"$TEST_ROOT/pty.out" 2>&1 || true
+    grep -q 'Preflight passed' "$TEST_ROOT/pty.out"
+    grep -qx 'BOAT_UNITS=metric' "$FRESH"
+    test "$(copies_of "$FRESH" | wc -l)" -eq 1
+else
+    echo "SKIP: pty smoke test (script or setsid not installed)"
+fi
+# Nothing above touched the installed tree or left temp files beside the configs.
+test -z "$(find "$TEST_ROOT" -maxdepth 1 -name '.*.fix.*' -print -quit)"
+
 # 1c. Stale env temp files (exact mktemp names) are removed by a real run; a dry run
 # leaves them, and similarly named files are never touched.
 for stale in .vesselstack.env.AbC123 .boat-chat.env.xYz789 .control-panel.env.000000; do : > "$X_APP/config/$stale"; done
diff --git a/tests/test-distribution.sh b/tests/test-distribution.sh
index 904c9ec..661f09b 100755
--- a/tests/test-distribution.sh
+++ b/tests/test-distribution.sh
@@ -15,7 +15,8 @@ bash -n "$ROOT/install.sh" "$ROOT/build-package.sh" "$ROOT/scripts/bootstrap-inf
     "$ROOT/scripts/prepare-offline-bundle.sh" \
     "$ROOT/tests/test-build-package.sh" "$ROOT/tests/test-socketcan.sh" "$ROOT/tests/test-offline-install.sh" "$ROOT/tests/test-update-launcher.sh" \
     "$ROOT/scripts/update-requirements-lock.sh" "$ROOT/scripts/get-vesselstack.sh" "$ROOT/tests/test-get-vesselstack.sh" \
-    "$ROOT/scripts/verify-release-tag.sh" "$ROOT/tests/test-verify-release-tag.sh"
+    "$ROOT/scripts/verify-release-tag.sh" "$ROOT/tests/test-verify-release-tag.sh" \
+    "$ROOT/scripts/lib/remediate.sh"
 python3 -m py_compile "$ROOT/scripts/pin-displays-requirements.py"
 python3 -m py_compile "$ROOT/control-panel/app.py"
 python3 -m py_compile "$ROOT/vesselstack-wizard.py"
@@ -40,7 +41,8 @@ shellcheck "$ROOT/install.sh" "$ROOT/build-package.sh" "$ROOT/scripts/bootstrap-
     "$ROOT/scripts/prepare-offline-bundle.sh" \
     "$ROOT/tests/test-build-package.sh" "$ROOT/tests/test-socketcan.sh" "$ROOT/tests/test-offline-install.sh" "$ROOT/tests/test-update-launcher.sh" \
     "$ROOT/scripts/update-requirements-lock.sh" "$ROOT/scripts/get-vesselstack.sh" "$ROOT/tests/test-get-vesselstack.sh" \
-    "$ROOT/scripts/verify-release-tag.sh" "$ROOT/tests/test-verify-release-tag.sh"
+    "$ROOT/scripts/verify-release-tag.sh" "$ROOT/tests/test-verify-release-tag.sh" \
+    "$ROOT/scripts/lib/remediate.sh"
 if grep -nE 'mosquitto_passwd -b' "$ROOT/install.sh" "$ROOT/scripts/vesselstackctl" "$ROOT"/scripts/*.sh "$ROOT"/displays/*.py; then
     echo "MQTT passwords must not be passed on a command line" >&2
     exit 1
diff --git a/tests/test-get-vesselstack.sh b/tests/test-get-vesselstack.sh
index 227b498..967a1eb 100755
--- a/tests/test-get-vesselstack.sh
+++ b/tests/test-get-vesselstack.sh
@@ -163,6 +163,7 @@ EOF2
 cat > "$FAKE_BIN/vesselstackctl" <<'EOF2'
 #!/bin/bash
 echo "ctl $* WHEELHOUSE=${VESSELSTACK_WHEELHOUSE:-} OFFLINE=${VESSELSTACK_OFFLINE:-}" >> "$LOG"
+echo "ctlenv $1 NONINTERACTIVE=${VESSELSTACK_NONINTERACTIVE:-} ALLOW=${VESSELSTACK_BACKUP_ALLOW_UNMOUNTED:-}" >> "$LOG"
 # Behave like the released v0.2.0/v0.3.0 controllers: "update" reads ONLY $1, as the
 # release directory, and fails on anything else (for example a leading --offline).
 if [ "$1" = update ]; then
@@ -182,6 +183,7 @@ printf 'deadbeef\n' > "$SRC/COMMIT"
 cat > "$SRC/install.sh" <<'EOF2'
 #!/bin/bash
 echo "install $* WHEELHOUSE=${VESSELSTACK_WHEELHOUSE:-}" >> "$LOG"
+echo "installenv $* NONINTERACTIVE=${VESSELSTACK_NONINTERACTIVE:-}" >> "$LOG"
 case " $* " in
     *" --dry-run "*) [ -z "${FAKE_FAIL_DRY:-}" ] || exit 1; exit 0 ;;
 esac
@@ -250,6 +252,9 @@ with open(out, "w") as handle:
 EOF2
 sed -i "s|@TEST_ROOT@|$TEST_ROOT|g; s|@REPO_ROOT@|$REPO_ROOT|g" "$SRC/vesselstack-wizard.py"
 chmod 0755 "$SRC/install.sh" "$SRC/scripts/prepare-offline-bundle.sh"
+# The release ships the prompt library the bootstrap uses for the unmounted-backup question.
+install -d "$SRC/scripts/lib"
+install -m 0644 "$REPO_ROOT/scripts/lib/remediate.sh" "$SRC/scripts/lib/remediate.sh"
 GOOD="$TEST_ROOT/good.tar.gz"
 tar -C "$TEST_ROOT/src" -czf "$GOOD" "vesselstack-$VER"
 GOOD_SHA=$(sha256sum "$GOOD" | cut -d' ' -f1)
@@ -465,6 +470,9 @@ if ! { [ -n "$dry" ] && [ -n "$real" ] && [ "$dry" -lt "$real" ]; }; then fail_t
 expect_log "^install --config $RELEASE_BASE/vesselstack.env --dry-run"
 expect_log "^install --config $RELEASE_BASE/vesselstack.env --start"
 expect_log "^ctl doctor"
+# --yes: the fresh-install installer calls must not ask either.
+expect_log "^installenv --config $RELEASE_BASE/vesselstack.env --dry-run NONINTERACTIVE=true$"
+expect_log "^installenv --config $RELEASE_BASE/vesselstack.env --start NONINTERACTIVE=true$"
 expect_log "^ctl urls"
 refuse_log "^wizard "
 refuse_log "^useradd"
@@ -1533,6 +1541,80 @@ expect_log "^ctl update $RELEASE_BASE/$VER WHEELHOUSE=$TEST_ROOT/bundle/wheelhou
 refuse_log "^ctl update --offline"
 expect_out "VESSELSTACK_OFFLINE=true VESSELSTACK_WHEELHOUSE=$TEST_ROOT/bundle/wheelhouse vesselstackctl update"
 
+# --defaults: same for the fresh install (no prompt may open inside install.sh).
+reset_state
+run --defaults --no-wizard --config "$TEST_ROOT/in.env"
+expect_rc 0 "fresh install with --defaults"
+expect_log "^installenv --config $RELEASE_BASE/vesselstack.env --dry-run NONINTERACTIVE=true$"
+expect_log "^installenv --config $RELEASE_BASE/vesselstack.env --start NONINTERACTIVE=true$"
+
+# ---- 9b. unmounted backup drive, asked before the installed ctl runs ----------------------
+BACKUP_MNT=/mnt/vs-get-backup-test
+trap 'rm -rf -- "$TEST_ROOT" "$BACKUP_MNT"; userdel vesselstack-wizard >/dev/null 2>&1 || true' EXIT
+backup_upgrade() {  # [extra env line for the installed vesselstack.env]
+    reset_state
+    rm -rf -- "$BACKUP_MNT"
+    install -d "$APP_ROOT/config" "$TEST_ROOT/opt/vesselstack-data"
+    echo 0.0.1 > "$APP_ROOT/config/installed-version"
+    printf 'VESSELSTACK_ROOT=%s\nVESSELSTACK_DATA=%s\nVESSELSTACK_BACKUP=%s/backups\n%s\n' \
+        "$APP_ROOT" "$TEST_ROOT/opt/vesselstack-data" "$BACKUP_MNT" "${1:-}" > "$APP_ROOT/config/vesselstack.env"
+}
+backup_upgrade
+printf 'y\ny\n4\n' > "$TEST_ROOT/answers"
+EXTRA_ENV=VESSELSTACK_BOOTSTRAP_ANSWERS="$TEST_ROOT/answers" run
+EXTRA_ENV=
+expect_rc 0 "backup drive: system disk once"
+expect_out "The backup folder $BACKUP_MNT/backups is on $BACKUP_MNT, which is not mounted"
+expect_out "\\[4\\] Back up to the system disk this once"
+expect_out "WARNING: the backup will be written to the system disk"
+expect_log "^ctl update $RELEASE_BASE/$VER "
+expect_log "^ctlenv update NONINTERACTIVE=true ALLOW=true$"
+test ! -e "$BACKUP_MNT"
+
+backup_upgrade
+printf 'y\ny\nc\n' > "$TEST_ROOT/answers"
+EXTRA_ENV=VESSELSTACK_BOOTSTRAP_ANSWERS="$TEST_ROOT/answers" run
+EXTRA_ENV=
+expect_rc 1 "backup drive: cancel"
+expect_out "Cancelled. The update was not started; your installed VesselStack was not changed."
+refuse_log "^ctl update"
+
+backup_upgrade
+printf 'y\ny\n' > "$TEST_ROOT/answers"
+EXTRA_ENV=VESSELSTACK_BOOTSTRAP_ANSWERS="$TEST_ROOT/answers" run
+EXTRA_ENV=
+expect_rc 1 "backup drive: input ends"
+expect_out "Cancelled. The update was not started; your installed VesselStack was not changed."
+refuse_log "^ctl update"
+
+# The env file pins false: the system-disk choice is not offered.
+backup_upgrade 'VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=false'
+printf 'y\ny\n4\nc\n' > "$TEST_ROOT/answers"
+EXTRA_ENV=VESSELSTACK_BOOTSTRAP_ANSWERS="$TEST_ROOT/answers" run
+EXTRA_ENV=
+expect_rc 1 "backup drive: allow pinned to false"
+refuse_out "Back up to the system disk this once"
+refuse_log "^ctl update"
+
+# An already allowed or mounted destination asks nothing; --yes and --defaults never pick a fix.
+backup_upgrade 'VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true'
+printf 'y\ny\n' > "$TEST_ROOT/answers"
+EXTRA_ENV=VESSELSTACK_BOOTSTRAP_ANSWERS="$TEST_ROOT/answers" run
+EXTRA_ENV=
+expect_rc 0 "backup drive: unmounted allowed by configuration"
+refuse_out "which is not mounted"
+backup_upgrade
+run --yes
+expect_rc 0 "backup drive: --yes asks nothing"
+refuse_out "which is not mounted"
+expect_log "^ctlenv update NONINTERACTIVE=true ALLOW=$"
+backup_upgrade
+run --defaults
+expect_rc 0 "backup drive: --defaults asks nothing"
+refuse_out "which is not mounted"
+refuse_log "^ctl update"
+rm -rf -- "$BACKUP_MNT"
+
 # ---- 10. root-controlled release directory ------------------------------------------------
 reset_state
 install -d -m 0777 "$RELEASE_BASE"
diff --git a/tests/test-lifecycle.sh b/tests/test-lifecycle.sh
index 3be950a..14a8bbf 100755
--- a/tests/test-lifecycle.sh
+++ b/tests/test-lifecycle.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 
 set -euo pipefail
+# Nothing may wait at a terminal; interactive cases unset it and use VESSELSTACK_PROMPT_ANSWERS.
+export VESSELSTACK_NONINTERACTIVE=true
 
 REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 TEST_ROOT=$(mktemp -d)
@@ -165,13 +167,58 @@ write_ss() {
 export FAKE_SS_FILE="$TEST_ROOT/ss.txt"
 write_ss '*:9876' '[::]:9877' 0.0.0.0:9878 127.0.0.1:8086 127.0.0.1:9090 127.0.0.1:1883 127.0.0.1:8780
 
-# Fake mountpoint: only paths listed (one per line) in $FAKE_MOUNTS are mounted.
+# Fake mountpoint: only paths listed (one per line) in $FAKE_MOUNTS are mounted. With
+# FAKE_MOUNT_AFTER=N the path FAKE_MOUNT_PATH reports "mounted" from its (N+1)th check on.
 cat > "$FAKE_BIN/mountpoint" <<'EOF'
 #!/bin/bash
 path=${2:-$1}
+if [ -n "${FAKE_MOUNT_AFTER:-}" ] && [ "$path" = "${FAKE_MOUNT_PATH:-}" ]; then
+    count=$(cat "$FAKE_MOUNT_COUNT" 2>/dev/null || echo 0)
+    count=$((count + 1))
+    echo "$count" > "$FAKE_MOUNT_COUNT"
+    [ "$count" -le "$FAKE_MOUNT_AFTER" ] || exit 0
+fi
 [ -n "${FAKE_MOUNTS:-}" ] && grep -Fxq -- "$path" "$FAKE_MOUNTS"
 EOF
-chmod +x "$FAKE_BIN/mountpoint"
+# Fake mount, findmnt and lsblk log their arguments; mount marks the last argument as mounted.
+cat > "$FAKE_BIN/mount" <<EOF
+#!/bin/bash
+echo "mount \$*" >> "$TEST_ROOT/mount.log"
+[ -z "\${FAKE_MOUNT_FAIL:-}" ] || { echo "mount: fake failure" >&2; exit 32; }
+echo "\${*: -1}" >> "\$FAKE_MOUNTS"
+# FAKE_MOUNT_CHOWN=uid hands the new mount root to that user; FAKE_MOUNT_LINK=1 puts a symbolic link in it.
+[ -z "\${FAKE_MOUNT_CHOWN:-}" ] || chown "\$FAKE_MOUNT_CHOWN" "\${*: -1}"
+if [ -n "\${FAKE_MOUNT_LINK:-}" ]; then ln -s /tmp "\${*: -1}/backups"; fi
+EOF
+cat > "$FAKE_BIN/findmnt" <<EOF
+#!/bin/bash
+echo "findmnt \$*" >> "$TEST_ROOT/findmnt.log"
+case " \$* " in
+    *" --fstab "*) grep -Fxq -- "\${*: -1}" "\${FAKE_FSTAB:-/dev/null}" ;;
+    *" --target "*) awk -v t="\${*: -1}" '\$1 == t {print \$2}' "\${FAKE_FINDMNT_SOURCES:-/dev/null}" ;;
+esac
+EOF
+cat > "$FAKE_BIN/lsblk" <<EOF
+#!/bin/bash
+echo "lsblk \$*" >> "$TEST_ROOT/lsblk.log"
+cat "\${FAKE_LSBLK:-/dev/null}"
+EOF
+# Fake df reports FAKE_DF_FREE KiB free when set.
+cat > "$FAKE_BIN/df" <<EOF
+#!/bin/bash
+if [ -n "\${FAKE_DF_FREE:-}" ]; then
+    printf 'Filesystem 1024-blocks Used Available Capacity Mounted on\nfake 1000 0 %s 0%% /\n' "\$FAKE_DF_FREE"
+    exit 0
+fi
+PATH=\$(printf '%s' "\$PATH" | tr ':' '\n' | grep -vxF "$FAKE_BIN" | paste -sd:)
+exec df "\$@"
+EOF
+chmod +x "$FAKE_BIN/mountpoint" "$FAKE_BIN/mount" "$FAKE_BIN/findmnt" "$FAKE_BIN/lsblk" "$FAKE_BIN/df"
+# The installed, root-owned prompt library the controller sources.
+LIBEXEC_TEST="$SYSTEM_ROOT/usr/local/libexec/vesselstack"
+install -d -m 0755 "$LIBEXEC_TEST"
+install -m 0644 "$REPO_ROOT/scripts/lib/remediate.sh" "$LIBEXEC_TEST/remediate.sh"
+export FAKE_MOUNT_COUNT="$TEST_ROOT/mount-count"
 : > "$TEST_ROOT/mounts"
 printf 'unit one\n' > "$SYSTEM_ROOT/etc/systemd/system/vesselstack-chat.service"
 printf '#!/bin/sh\necho ctl-one\n' > "$SYSTEM_ROOT/usr/local/sbin/vesselstackctl"
@@ -429,6 +476,293 @@ override_archive=$(run_ctl backup --allow-unmounted "$unmounted/backups" 2>/dev/
 test -s "$override_archive"
 rm -rf -- "$unmounted"
 
+# ---- Unmounted backup drive: the interactive menu (needs root: the controller only sources a
+# root-owned library). Answers come from VESSELSTACK_PROMPT_ANSWERS; nothing is stopped first.
+if [ "$(id -u)" -eq 0 ]; then
+    : > "$TEST_ROOT/mounts"
+    LSBLK_JSON="$TEST_ROOT/lsblk.json"
+    cat > "$LSBLK_JSON" <<EOF
+{"blockdevices":[
+ {"path":"/dev/mmcblk0","type":"disk","size":"58G","rm":false,"hotplug":false,"tran":null,"children":[
+  {"path":"/dev/mmcblk0p1","type":"part","size":"512M","fstype":"vfat","uuid":"AAAA-0001","mountpoint":"/boot/firmware","rm":false},
+  {"path":"/dev/mmcblk0p2","type":"part","size":"57G","fstype":"ext4","uuid":"sysroot","mountpoint":"/","rm":false}]},
+ {"path":"/dev/nvme0n1","type":"disk","size":"500G","rm":false,"hotplug":false,"tran":"nvme","children":[
+  {"path":"/dev/nvme0n1p1","type":"part","size":"500G","fstype":"ext4","uuid":"internal","mountpoint":null,"rm":false}]},
+ {"path":"/dev/sda","type":"disk","size":"58G","rm":true,"hotplug":true,"tran":"usb","children":[
+  {"path":"/dev/sda1","type":"part","size":"58G","label":"BACKUP","fstype":"ext4","uuid":"1111-aaaa","mountpoint":null,"rm":true}]},
+ {"path":"/dev/sdb","type":"disk","size":"29G","rm":true,"hotplug":true,"tran":"usb","children":[
+  {"path":"/dev/sdb1","type":"part","size":"29G","label":"CAMERA","fstype":"vfat","uuid":"2222-BBBB","mountpoint":null,"rm":true}]},
+ {"path":"/dev/sdc","type":"disk","size":"100G","rm":true,"hotplug":true,"tran":"usb","children":[
+  {"path":"/dev/sdc1","type":"part","size":"90G","label":"SSD-SPARE","fstype":"ext4","uuid":"3333-cccc","mountpoint":null,"rm":true},
+  {"path":"/dev/sdc2","type":"part","size":"10G","fstype":"ext4","uuid":"4444-dddd","mountpoint":null,"rm":true}]}
+]}
+EOF
+    printf '/ /dev/mmcblk0p2\n%s /dev/sdc2\n' "$DATA_ROOT" > "$TEST_ROOT/findmnt-sources"
+    : > "$TEST_ROOT/fstab"
+    export FAKE_LSBLK="$LSBLK_JSON" FAKE_FSTAB="$TEST_ROOT/fstab" FAKE_FINDMNT_SOURCES="$TEST_ROOT/findmnt-sources" \
+        FAKE_MOUNT_PATH="$unmounted"
+    ask_ctl() {  # answers-file args...: the controller with a (scripted) terminal
+        local answers=$1
+        shift
+        ( unset VESSELSTACK_NONINTERACTIVE; VESSELSTACK_PROMPT_ANSWERS=$answers run_ctl "$@" )
+    }
+    menu_run() {  # answers-text args...: sets MENU_RC, MENU_OUT (stdout) and MENU_ERR (stderr)
+        local text=$1
+        shift
+        printf '%s' "$text" > "$TEST_ROOT/answers"
+        : > "$TEST_ROOT/mount.log"
+        : > "$TEST_ROOT/mounts"
+        rm -f -- "$TEST_ROOT/mount-count"
+        MENU_RC=0
+        ask_ctl "$TEST_ROOT/answers" "$@" >"$TEST_ROOT/menu.out" 2>"$TEST_ROOT/menu.err" || MENU_RC=$?
+        MENU_OUT=$(<"$TEST_ROOT/menu.out")
+        MENU_ERR=$(<"$TEST_ROOT/menu.err")
+    }
+    want() {  # text: must appear on stderr
+        grep -qF -- "$1" <<<"$MENU_ERR" || { echo "menu output lacks: $1" >&2; echo "$MENU_ERR" >&2; exit 1; }
+    }
+    refuse_text() {
+        if grep -qF -- "$1" <<<"$MENU_ERR"; then echo "menu output must not contain: $1" >&2; echo "$MENU_ERR" >&2; exit 1; fi
+    }
+    rm -rf -- "$unmounted"
+    menu_calls="$TEST_ROOT/menu-calls.log"
+    export FAKE_CALL_LOG="$menu_calls"
+    env_backup="$TEST_ROOT/vesselstack.env.before-menu"
+    cp -p "$APP_ROOT/config/vesselstack.env" "$env_backup"
+    env_hash=$(sha256sum "$APP_ROOT/config/vesselstack.env")
+
+    # The menu text, and cancel / end of input change and stop nothing.
+    : > "$menu_calls"
+    menu_run $'c\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "The backup folder $unmounted/backups is on $unmounted, which is not mounted."
+    want "Backing up now would put the archive on the system disk (SD card)."
+    want "Nothing has been changed yet."
+    want "[2] Choose a connected drive to mount at $unmounted"
+    want "[3] I have plugged the drive in; check again"
+    want "[4] Back up to the system disk this once (not recommended)"
+    want "[c] Cancel the backup"
+    refuse_text "[1] Mount"
+    want "Cancelled. Nothing was changed."
+    menu_run '' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "Cancelled. Nothing was changed."
+    test ! -s "$menu_calls"
+    test ! -s "$TEST_ROOT/mount.log"
+    test ! -e "$unmounted"
+    test "$(sha256sum "$APP_ROOT/config/vesselstack.env")" = "$env_hash"
+
+    # [1] only with an /etc/fstab entry, and then a plain "mount -- DIR".
+    menu_run $'1\nc\n' backup "$unmounted/backups"
+    want "Please enter one of: 2, 3, 4, or c"
+    test ! -s "$TEST_ROOT/mount.log"
+    printf '%s\n' "$unmounted" > "$TEST_ROOT/fstab"
+    : > "$menu_calls"
+    menu_run $'1\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 0
+    want "[1] Mount $unmounted now (it is listed in /etc/fstab)"
+    grep -qx -- "mount -- $unmounted" "$TEST_ROOT/mount.log"
+    grep -qx -- "findmnt --fstab -n --mountpoint $unmounted" "$TEST_ROOT/findmnt.log"
+    test -s "$MENU_OUT"
+    : > "$TEST_ROOT/fstab"
+    rm -rf -- "$unmounted"
+
+    # A mount that fails shows the error and the menu again.
+    printf '%s\n' "$unmounted" > "$TEST_ROOT/fstab"
+    FAKE_MOUNT_FAIL=1 menu_run $'1\nc\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "Could not mount $unmounted from /etc/fstab."
+    : > "$TEST_ROOT/fstab"
+
+    # [2]: only unmounted, removable, non-system ext4/exFAT drives; vfat is refused, never offered.
+    : > "$menu_calls"
+    menu_run $'2\n1\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 0
+    want '[1] /dev/sda1  58G  "BACKUP"  ext4'
+    want "/dev/sdb1  29G  \"CAMERA\"  vfat -- vfat is not supported for backups; use ext4 (recommended) or exFAT"
+    refuse_text "[2] /dev/sdb1"
+    refuse_text "/dev/sdc1"
+    refuse_text "/dev/sdc2"
+    refuse_text "/dev/nvme0n1p1"
+    refuse_text "/dev/mmcblk0"
+    grep -qx -- "mount -t ext4 -o nodev,nosuid,noexec /dev/sda1 $unmounted" "$TEST_ROOT/mount.log"
+    [ "$(wc -l < "$TEST_ROOT/mount.log")" -eq 1 ]
+    want "It stays mounted until reboot. To mount it at boot, add this line to /etc/fstab:"
+    want "UUID=1111-aaaa $unmounted ext4 nofail,noatime,nodev,nosuid,noexec 0 2"
+    grep -q -- '-J -p -o PATH,TYPE,SIZE,LABEL,FSTYPE,UUID,MOUNTPOINT,RM,HOTPLUG,TRAN,PKNAME' "$TEST_ROOT/lsblk.log"
+    test "$(stat -c %a "$unmounted")" = 700
+    test -s "$MENU_OUT"
+    grep -qx -- "$unmounted" "$TEST_ROOT/mounts"
+    rm -rf -- "$unmounted"
+    # Choosing the refused drive's number is not possible; "b" goes back to the menu.
+    menu_run $'2\nb\nc\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    test ! -s "$TEST_ROOT/mount.log"
+    # No usable drive at all.
+    printf '{"blockdevices":[]}\n' > "$TEST_ROOT/lsblk-empty.json"
+    FAKE_LSBLK="$TEST_ROOT/lsblk-empty.json" menu_run $'2\nc\n' backup "$unmounted/backups"
+    want "(none found)"
+    want "Plug in a drive formatted as ext4"
+    want "No unmounted USB drive was found. If your desktop already mounted the drive (for example under /media/<user>/...), unmount it first: sudo umount <path>."
+    refuse_text "Already mounted elsewhere:"
+    # A removable ext4 partition the desktop mounted elsewhere is named in the hint.
+    cat > "$TEST_ROOT/lsblk-mounted.json" <<EOF
+{"blockdevices":[
+ {"path":"/dev/sde","type":"disk","size":"16G","rm":true,"hotplug":true,"tran":"usb","children":[
+  {"path":"/dev/sde1","type":"part","size":"16G","label":"USBSTICK","fstype":"ext4","uuid":"6666-ffff","mountpoint":"/media/pi/USBSTICK","rm":true}]}
+]}
+EOF
+    FAKE_LSBLK="$TEST_ROOT/lsblk-mounted.json" menu_run $'2\nc\n' backup "$unmounted/backups"
+    want "(none found)"
+    want "Already mounted elsewhere:"
+    want '/dev/sde1  16G  "USBSTICK"  ext4, mounted at /media/pi/USBSTICK'
+    # A drive that /etc/fstab assigns to another mount point (a data SSD that failed to mount) is
+    # not offered; one assigned to the backup folder's own mount point still is.
+    printf 'UUID=1111-aaaa /srv/data ext4 defaults,nofail 0 2\n' > "$TEST_ROOT/fstab-other"
+    VS_FSTAB_FILE="$TEST_ROOT/fstab-other" menu_run $'2\nc\n' backup "$unmounted/backups"
+    want "/dev/sda1  58G  \"BACKUP\"  ext4 -- listed in /etc/fstab for /srv/data; not offered here"
+    refuse_text "[1] /dev/sda1"
+    printf 'LABEL=BACKUP /srv/data ext4 defaults 0 2\n' > "$TEST_ROOT/fstab-other"
+    VS_FSTAB_FILE="$TEST_ROOT/fstab-other" menu_run $'2\nc\n' backup "$unmounted/backups"
+    refuse_text "[1] /dev/sda1"
+    printf 'UUID=1111-aaaa %s ext4 nofail 0 2\n' "$unmounted" > "$TEST_ROOT/fstab-other"
+    VS_FSTAB_FILE="$TEST_ROOT/fstab-other" menu_run $'2\n1\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 0
+    want '[1] /dev/sda1  58G  "BACKUP"  ext4'
+    rm -rf -- "$unmounted"
+
+    # A drive mounted just now is checked before anything is written: a mount root owned by
+    # another user, or a symbolic link on the drive, is refused (nothing created, no archive).
+    FAKE_MOUNT_CHOWN=1234 menu_run $'2\n1\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "the top folder of the newly mounted drive is not owned by root or can be changed by other users"
+    test ! -e "$unmounted/backups"
+    rm -rf -- "$unmounted"
+    FAKE_MOUNT_LINK=1 menu_run $'2\n1\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "on the newly mounted drive is a symbolic link"
+    rm -rf -- "$unmounted"
+
+    # An unlabeled partition keeps its columns (an empty LABEL must not shift the fields) and is
+    # mounted with the right filesystem type and device.
+    cat > "$TEST_ROOT/lsblk-nolabel.json" <<EOF
+{"blockdevices":[
+ {"path":"/dev/sdd","type":"disk","size":"8G","rm":true,"hotplug":true,"tran":"usb","children":[
+  {"path":"/dev/sdd1","type":"part","size":"8G","label":null,"fstype":"ext4","uuid":"5555-eeee","mountpoint":null,"rm":true}]}
+]}
+EOF
+    FAKE_LSBLK="$TEST_ROOT/lsblk-nolabel.json" menu_run $'2\n1\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 0
+    want '[1] /dev/sdd1  8G  (no label)  ext4'
+    grep -qx -- "mount -t ext4 -o nodev,nosuid,noexec /dev/sdd1 $unmounted" "$TEST_ROOT/mount.log"
+    want "UUID=5555-eeee $unmounted ext4 nofail,noatime,nodev,nosuid,noexec 0 2"
+    rm -rf -- "$unmounted"
+    # Only one listed token is an answer: "1 2" and "1 b" are asked again and mount nothing.
+    menu_run $'2\n1 2\n1 b\n c\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    test "$(grep -cF 'Please enter one of: 1, b, or c' <<<"$MENU_ERR")" -eq 2
+    test ! -s "$TEST_ROOT/mount.log"
+    rm -rf -- "$unmounted"
+    menu_run $'1 2\nc\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "Please enter one of: 2, 3, 4, or c"
+    test ! -s "$TEST_ROOT/mount.log"
+
+    # A mount point that holds files is refused: they would be hidden by the mount.
+    install -d "$unmounted"
+    printf 'keep\n' > "$unmounted/precious.txt"
+    menu_run $'2\n1\nc\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "$unmounted is not empty"
+    test ! -s "$TEST_ROOT/mount.log"
+    test -f "$unmounted/precious.txt"
+    rm -rf -- "$unmounted"
+
+    # [3]: checks again; the second check finds the drive.
+    FAKE_MOUNT_AFTER=2 menu_run $'3\n3\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 0
+    want "$unmounted is still not mounted."
+    want "$unmounted is mounted."
+    test ! -s "$TEST_ROOT/mount.log"
+    rm -rf -- "$unmounted"
+
+    # [4]: one backup to the system disk, with a warning; nothing is saved for later.
+    menu_run $'4\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 0
+    want "WARNING: the backup will be written to the system disk (SD card) this once."
+    test -s "$MENU_OUT"
+    test "$(sha256sum "$APP_ROOT/config/vesselstack.env")" = "$env_hash"
+    rm -rf -- "$unmounted"
+    # Hidden when the system disk is too small for the backup ...
+    FAKE_DF_FREE=1 menu_run $'4\nc\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    want "so a backup to the system disk is not offered."
+    refuse_text "[4] Back up"
+    # ... and when the environment file pins false.
+    printf 'VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=false\n' >> "$APP_ROOT/config/vesselstack.env"
+    menu_run $'4\nc\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    refuse_text "[4] Back up"
+    want "Please enter one of: 2, 3, or c"
+    cp -p "$env_backup" "$APP_ROOT/config/vesselstack.env"
+
+    # --require-mounted offers [1]-[3] only, even with the override in the file.
+    printf 'VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true\n' >> "$APP_ROOT/config/vesselstack.env"
+    menu_run $'4\nc\n' backup --require-mounted "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    refuse_text "[4] Back up"
+    want "[3] I have plugged the drive in; check again"
+    cp -p "$env_backup" "$APP_ROOT/config/vesselstack.env"
+    rm -rf -- "$unmounted"
+
+    # Update: the question comes after the dry run and before anything is stopped.
+    sed -i "s|^VESSELSTACK_BACKUP=.*|VESSELSTACK_BACKUP=$unmounted/backups|" "$APP_ROOT/config/vesselstack.env"
+    : > "$TEST_ROOT/update-args"
+    : > "$menu_calls"
+    menu_run $'c\n' update "$UPDATE_SOURCE"
+    test "$MENU_RC" -eq 1
+    want "[c] Cancel the update"
+    test "$(cat "$TEST_ROOT/update-args")" = "--config $APP_ROOT/config/vesselstack.env --dry-run"
+    test ! -s "$menu_calls"
+    menu_run $'4\n' update "$UPDATE_SOURCE"
+    test "$MENU_RC" -eq 0
+    test "$(wc -l < "$TEST_ROOT/update-args")" -eq 3
+    tail -n 1 "$TEST_ROOT/update-args" | grep -q -- '--start'
+    : > "$TEST_ROOT/update-args"
+    rm -rf -- "$unmounted"
+
+    # Without a terminal the same refusal and fix are printed, per context.
+    : > "$menu_calls"
+    VESSELSTACK_NONINTERACTIVE=true run_ctl update "$UPDATE_SOURCE" >/dev/null 2>"$TEST_ROOT/menu.err" && exit 1
+    test "$(sed -n 1p "$TEST_ROOT/menu.err")" = "Refusing to back up: $unmounted is not mounted, so the archive would land on the system disk (SD card). Nothing was changed."
+    test "$(sed -n 2p "$TEST_ROOT/menu.err")" = "To fix: mount the backup drive at $unmounted and run again, or back up to the system disk this once: sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update $UPDATE_SOURCE"
+    test "$(wc -l < "$TEST_ROOT/menu.err")" -eq 2
+    test ! -s "$menu_calls"
+    run_ctl backup "$unmounted/backups" >/dev/null 2>"$TEST_ROOT/menu.err" && exit 1
+    test "$(sed -n 1p "$TEST_ROOT/menu.err")" = "Refusing to back up: $unmounted is not mounted, so the archive would land on the system disk (SD card). Nothing was changed."
+    test "$(sed -n 2p "$TEST_ROOT/menu.err")" = "To fix: mount the backup drive at $unmounted and run again, or pass --allow-unmounted."
+    run_ctl backup --require-mounted "$unmounted/backups" >/dev/null 2>"$TEST_ROOT/menu.err" && exit 1
+    test "$(sed -n 2p "$TEST_ROOT/menu.err")" = "To fix: mount the backup drive at $unmounted and run again."
+    # A library another user could change is never sourced; the same copy is printed instead.
+    chmod 0666 "$LIBEXEC_TEST/remediate.sh"
+    menu_run $'4\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    refuse_text "Choice:"
+    want "To fix: mount the backup drive at $unmounted and run again, or pass --allow-unmounted."
+    chmod 0644 "$LIBEXEC_TEST/remediate.sh"
+    # The folders above the library must be root-controlled too.
+    chmod 0777 "$SYSTEM_ROOT/usr/local/libexec"
+    menu_run $'4\n' backup "$unmounted/backups"
+    test "$MENU_RC" -eq 1
+    refuse_text "Choice:"
+    want "To fix: mount the backup drive at $unmounted and run again, or pass --allow-unmounted."
+    chmod 0755 "$SYSTEM_ROOT/usr/local/libexec"
+    test ! -e "$unmounted"
+    cp -p "$env_backup" "$APP_ROOT/config/vesselstack.env"
+    unset FAKE_CALL_LOG FAKE_MOUNT_PATH
+    : > "$TEST_ROOT/mounts"
+fi
+
 # Boat Chat memory index: `reindex` builds it as the service user, the helper is idempotent
 # and a damaged environment is reported with the one-line fix. Done before the first doctor
 # run because an empty index is a doctor failure.
diff --git a/tests/test-offline-install.sh b/tests/test-offline-install.sh
index a4210b9..305dfe3 100755
--- a/tests/test-offline-install.sh
+++ b/tests/test-offline-install.sh
@@ -6,6 +6,9 @@
 
 set -euo pipefail
 
+# Unattended: no run in this file may wait on a prompt.
+export VESSELSTACK_NONINTERACTIVE=true
+
 REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 [ "$(id -u)" -eq 0 ] || { echo "run as root" >&2; exit 1; }
 # /tmp and (on GitHub runners) /opt are world-writable, so root-controlled
diff --git a/tests/test-update-launcher.sh b/tests/test-update-launcher.sh
index 8bbf0a6..b119a14 100755
--- a/tests/test-update-launcher.sh
+++ b/tests/test-update-launcher.sh
@@ -4,6 +4,8 @@
 # Needs root and Linux (stat -c); a fake python3 records what would have been executed.
 
 set -euo pipefail
+# Nothing here may wait for an answer at a terminal.
+export VESSELSTACK_NONINTERACTIVE=true
 
 REPO_ROOT=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 [ "$(id -u)" -eq 0 ] || { echo "run as root" >&2; exit 1; }
diff --git a/tests/test_browser_update_process.py b/tests/test_browser_update_process.py
index 3d80af4..5f84b03 100644
--- a/tests/test_browser_update_process.py
+++ b/tests/test_browser_update_process.py
@@ -51,6 +51,12 @@ def test_high_volume_output_is_bounded_and_keeps_tail(self) -> None:
         self.assertLessEqual(len(result.stdout.encode()), self.updates.MAX_OUTPUT)
         self.assertIn(marker, operation["output"][-1])
 
+    def test_update_children_never_wait_for_a_terminal(self) -> None:
+        # The panel cannot answer prompts, so every child it launches runs non-interactively.
+        source = (ROOT / "control-panel" / "browser_updates.py").read_text()
+        self.assertRegex(source, r'child_env = dict\(os\.environ,[^\n]*VESSELSTACK_NONINTERACTIVE="true"')
+        self.assertIn("install_env = dict(child_env)", source)
+
     def test_nonzero_child_preserves_actionable_tail_and_never_completes(self) -> None:
         code = "import sys; print('backup mount is required before preflight'); print('actionable failure'); sys.exit(7)"
         operation = self.operation()
diff --git a/tests/test_control_panel.py b/tests/test_control_panel.py
index c815e89..14f85ca 100644
--- a/tests/test_control_panel.py
+++ b/tests/test_control_panel.py
@@ -32,6 +32,20 @@ def test_round_trip_supports_spaces_and_empty_values(self) -> None:
             )
             self.assertEqual(path.stat().st_mode & 0o777, 0o600)
 
+    def test_legacy_nautical_units_display_as_metric_without_rewriting_the_file(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            root = Path(directory)
+            vessel = root / "vessel.env"
+            vessel.write_text("BOAT_NAME=Old Boat\nBOAT_UNITS=nautical\n")
+            before = vessel.read_bytes()
+            with mock.patch.multiple(panel, VESSEL_ENV=vessel, CHAT_ENV=root / "chat.env", PANEL_ENV=root / "control.env"):
+                values = panel.public_configuration()["values"]
+            self.assertEqual(values["BOAT_UNITS"], "metric")
+            self.assertEqual(vessel.read_bytes(), before)
+            self.assertIn(values["BOAT_UNITS"], panel.FIELD_BY_KEY["BOAT_UNITS"]["choices"])
+        with self.assertRaises(ValueError):
+            panel.validate_value(panel.FIELD_BY_KEY["BOAT_UNITS"], "imperial")
+
     def test_public_configuration_redacts_secrets(self) -> None:
         with tempfile.TemporaryDirectory() as directory:
             root = Path(directory)
@@ -655,6 +669,57 @@ def test_operation_summary_names_the_saved_file_or_the_reason(self) -> None:
         self.assertEqual(bad["reason"], "backup mount /media/backup is not mounted")
         self.assertEqual(panel.with_summary({"state": "running"}), {"state": "running"})
 
+    def test_operations_run_non_interactively(self) -> None:
+        seen: dict = {}
+
+        class FakeProcess:
+            stdout = iter(["done\n"])
+
+            def wait(self) -> int:
+                return 0
+
+        def fake_popen(command, **kwargs):
+            seen.update(kwargs["env"])
+            return FakeProcess()
+
+        local_store = panel.OperationStore()
+        operation = {"label": "backup", "state": "running", "output": panel.deque(maxlen=10), "exit_code": None, "finished_at": None}
+        with mock.patch.object(panel.subprocess, "Popen", side_effect=fake_popen), mock.patch.object(panel, "release_lifecycle_slot"):
+            local_store._run(operation, ["true"], None)
+        self.assertEqual(seen.get("VESSELSTACK_NONINTERACTIVE"), "true")
+
+    def test_operation_summary_carries_the_to_fix_line(self) -> None:
+        def failed(*lines: str) -> dict:
+            return panel.summarize_operation({"label": "update", "state": "failed", "output": list(lines)})
+
+        update = failed(
+            "Refusing to back up: /media/backup is not mounted, so the archive would land on the system disk (SD card). Nothing was changed.",
+            "To fix: mount the backup drive at /media/backup and run again, or back up to the system disk this once: sudo env VESSELSTACK_BACKUP_ALLOW_UNMOUNTED=true vesselstackctl update /opt/vesselstack-0.6.1",
+        )
+        self.assertTrue(update["reason"].startswith("/media/backup is not mounted"))
+        self.assertTrue(update["fix"].startswith("mount the backup drive at /media/backup and run again, or back up to the system disk this once: sudo env "))
+        backup = failed(
+            "Refusing to back up: /media/backup is not mounted, so the archive would land on the system disk (SD card). Nothing was changed.",
+            "To fix: mount the backup drive at /media/backup and run again, or pass --allow-unmounted.",
+        )
+        self.assertEqual(backup["fix"], "mount the backup drive at /media/backup and run again, or pass --allow-unmounted.")
+        units = failed(
+            "Refusing to continue: BOAT_UNITS=imperial in /etc/vesselstack/vesselstack.env is not supported.",
+            "To fix: set it to us_customary or metric, for example: sudo sed -i 's/^BOAT_UNITS=.*/BOAT_UNITS=metric/' /etc/vesselstack/vesselstack.env",
+        )
+        self.assertEqual(units["reason"], "BOAT_UNITS=imperial in /etc/vesselstack/vesselstack.env is not supported.")
+        self.assertTrue(units["fix"].startswith("set it to us_customary or metric, for example: sudo sed -i "))
+        unsafe = failed(
+            "  MQTT_PASSWORD: a multi-line value",
+            "Refusing to continue: the settings above cannot be written safely to the environment files.",
+            "To fix: edit them in /etc/vesselstack/vesselstack.env (values cannot span lines), then run again. Nothing was changed.",
+        )
+        self.assertEqual(unsafe["reason"], "the settings above cannot be written safely to the environment files.")
+        self.assertTrue(unsafe["fix"].startswith("edit them in /etc/vesselstack/vesselstack.env"))
+        self.assertNotIn("fix", failed("ERROR: boom"))
+        # A To fix line printed before the refusal belongs to something else.
+        self.assertNotIn("fix", failed("To fix: earlier", "ERROR: boom"))
+
     def test_restart_note_only_when_a_newer_panel_is_installed(self) -> None:
         with mock.patch.object(panel, "installed_version", return_value="0.6.1"), mock.patch.object(panel, "RUNNING_IDENTITY", {"running_version": "0.6.0"}):
             self.assertTrue(panel.restart_needed())
diff --git a/tests/test_control_panel_ui.cjs b/tests/test_control_panel_ui.cjs
index ecc33c0..c405408 100644
--- a/tests/test_control_panel_ui.cjs
+++ b/tests/test_control_panel_ui.cjs
@@ -209,6 +209,9 @@ assert.equal(node('#sb-apply').disabled, false, 'Apply is available once nothing
   assert.match(node('#banner').innerHTML, /<details class="disc"><summary>Show details<\/summary><pre class="log"[^>]*>ctl: running backup\nERROR/, 'details hold the operation log');
   assert.doesNotMatch(node('#banner').innerHTML, /Update failed/, 'no update wording for a backup');
   assert.match(node('#banner').innerHTML, /aria-label="Dismiss message"/);
+  ui.renderOperation({ id: 5, label: 'backup', state: 'failed', started_at: now - 5, finished_at: now, output: ['x'], summary: { reason: 'backup mount /media/backup is not mounted', fix: 'mount the backup drive at /media/backup and run again, or pass <b>--allow-unmounted</b>. sudo env X=1 vesselstackctl update <i>' } });
+  assert.match(node('#banner').innerHTML, /<div class="fix"><strong>To fix:<\/strong> mount the backup drive at \/media\/backup and run again, or pass &lt;b&gt;--allow-unmounted&lt;\/b&gt;\. <span class="mono">sudo env X=1 vesselstackctl update &lt;i&gt;<\/span><\/div>/, 'the fix is shown escaped with the command in monospace');
+  assert.doesNotMatch(node('#banner').innerHTML, /<b>|<i>/, 'no injected markup');
   ui.renderOperation({ id: 4, label: 'backup', state: 'succeeded', started_at: now, finished_at: now, output: ['x'], summary: { saved_path: '/media/backup/vesselstack-1.tar.gz' } });
   assert.match(node('#banner').innerHTML, /Backup finished [^<]*<\/strong> — saved to <span class="mono">\/media\/backup\/vesselstack-1\.tar\.gz<\/span>/);
   assert.doesNotMatch(node('#banner').innerHTML, /restart vesselstack-control-panel/, 'no routine restart advice on success');
diff --git a/tests/test_display_units.py b/tests/test_display_units.py
index fcddc4e..30c9fd2 100644
--- a/tests/test_display_units.py
+++ b/tests/test_display_units.py
@@ -18,6 +18,14 @@ class DisplayUnitsTests(unittest.TestCase):
     def setUpClass(cls):
         cls.units = load_units()
 
+    def test_legacy_nautical_preference_is_metric(self):
+        u = self.units
+        self.assertEqual(u.normalize_preference("nautical"), "metric")
+        self.assertEqual(u.normalize_preference(" Nautical "), "metric")
+        self.assertEqual(u.preference(lambda key, default: "nautical"), "metric")
+        self.assertEqual(u.normalize_preference("us_customary"), "us_customary")
+        self.assertEqual(u.unit_for_measurement("depth", "nautical", "ft"), "m")
+
     def test_known_conversions(self):
         u = self.units
         self.assertAlmostEqual(u.convert(32, "F", "C"), 0.0, places=6)
diff --git a/tests/test_wizard.py b/tests/test_wizard.py
index 5f0055b..7293eb0 100644
--- a/tests/test_wizard.py
+++ b/tests/test_wizard.py
@@ -28,11 +28,15 @@ def test_units_are_us_customary_or_metric_only_and_default_matches_the_installer
         self.assertIn(': "${BOAT_UNITS:=us_customary}"', installer)
         for good in ("us_customary", "metric"):
             self.assertEqual(wizard.validate({"BOAT_UNITS": good})["BOAT_UNITS"], good)
-        for bad in ("nautical", "imperial", "", "Metric"):
+        for bad in ("imperial", "", "metrics"):
             with self.subTest(bad=bad), self.assertRaisesRegex(ValueError, "BOAT_UNITS"):
                 wizard.validate({"BOAT_UNITS": bad})
+        # Legacy "nautical" (offered by older wizards) is read as metric, with a note; case and spaces are tolerated.
+        for legacy, expected in (("nautical", "metric"), ("Nautical", "metric"), (" metric", "metric"), ("Metric", "metric"), ("US_Customary", "us_customary")):
+            with self.subTest(legacy=legacy):
+                self.assertEqual(wizard.validate({"BOAT_UNITS": legacy})["BOAT_UNITS"], expected)
         self.assertEqual([name for name, _ in wizard.FIELD_INDEX["BOAT_UNITS"]["choices"]], ["us_customary", "metric"])
-        with self.assertRaises(ValueError): wizard.apply_settings(wizard.DEFAULTS.copy(), ["BOAT_UNITS=nautical"])
+        with self.assertRaises(ValueError): wizard.apply_settings(wizard.DEFAULTS.copy(), ["BOAT_UNITS=imperial"])
         app = (ROOT / "wizard" / "app.js").read_text()
         self.assertNotIn("nautical'", app.lower().replace("nautical miles", ""))
         self.assertNotIn("value=\"nautical", app)
@@ -195,12 +199,28 @@ def test_invalid_lan_access_is_rejected_without_writing(self):
                 self.assertEqual(status, 400)
                 self.assertFalse(self.output.exists())
 
-    def test_web_save_rejects_nautical_units_without_writing(self):
-        status, body = self.request("POST", "/api/save", {"values": {"BOAT_UNITS": "nautical"}}, self.good())
+    def test_web_save_rejects_unknown_units_without_writing(self):
+        status, body = self.request("POST", "/api/save", {"values": {"BOAT_UNITS": "imperial"}}, self.good())
         self.assertEqual(status, 400)
         self.assertIn(b"BOAT_UNITS", body)
         self.assertFalse(self.output.exists())
 
+    def test_legacy_nautical_units_in_an_existing_config_load_as_metric_with_a_note(self):
+        import contextlib, io
+        with tempfile.TemporaryDirectory() as directory:
+            base = Path(directory) / "vesselstack.env"
+            base.write_text('BOAT_NAME="Old Boat"\nBOAT_UNITS=nautical\n')
+            err = io.StringIO()
+            with contextlib.redirect_stderr(err):
+                values = wizard.validate({**wizard.DEFAULTS, **wizard.load_env(base)})
+                self.assertEqual(wizard.validate(wizard.load_env(base))["BOAT_UNITS"], "metric")
+            self.assertEqual((values["BOAT_NAME"], values["BOAT_UNITS"]), ("Old Boat", "metric"))
+            self.assertIn("BOAT_UNITS=nautical is no longer a separate option; using metric", err.getvalue())
+            result = subprocess.run([sys.executable, str(ROOT / "vesselstack-wizard.py"), "--validate", str(base)], capture_output=True, text=True)
+            self.assertEqual(result.returncode, 0, result.stderr)
+            self.assertIn("valid", result.stdout)
+            self.assertIn("using metric", result.stderr)
+
     def test_wizard_page_asks_the_lan_question_with_the_all_warning(self):
         source = (ROOT / "wizard" / "app.js").read_text()
         self.assertIn("Who should be able to reach the dashboards?", source)
diff --git a/vesselstack-wizard.py b/vesselstack-wizard.py
index 1840e07..bce6119 100755
--- a/vesselstack-wizard.py
+++ b/vesselstack-wizard.py
@@ -44,6 +44,14 @@ def system_report():
     interfaces=sorted(p.name for p in Path("/sys/class/net").glob("*") if p.name.startswith(("eth","en","wlan","wl","can")))
     return {"architecture":platform.machine(),"os":platform.platform(),"docker":bool(shutil.which("docker")),"compose":compose_available(),"interfaces":interfaces,"can0":"can0" in interfaces,"memory_gib":round(os.sysconf("SC_PAGE_SIZE")*os.sysconf("SC_PHYS_PAGES")/2**30,1),"output":str(OUTPUT)}
 
+def normalize_units(value):
+    """Older wizards offered "nautical"; it is read as metric (knots and nautical miles are kept anyway)."""
+    text=value.strip().lower() if isinstance(value,str) else value
+    if text=="nautical":
+        print("Note: BOAT_UNITS=nautical is no longer a separate option; using metric (knots and nautical miles are kept).",file=sys.stderr)
+        return "metric"
+    return text if text in {"us_customary","metric"} else value
+
 def validate(values):
     unknown=set(values)-set(DEFAULTS)
     if unknown: raise ValueError("Unknown settings: "+", ".join(sorted(unknown)))
@@ -53,6 +61,7 @@ def validate(values):
         result[key]=value
     result["VESSELSTACK_DISABLED_COMPONENTS"] = normalize_disabled_components(result["VESSELSTACK_DISABLED_COMPONENTS"])
     if result["SIGNALK_MODE"] not in {"existing","docker","native"}: raise ValueError("Invalid SignalK mode")
+    result["BOAT_UNITS"]=normalize_units(result["BOAT_UNITS"])
     if result["BOAT_UNITS"] not in {"us_customary","metric"}: raise ValueError("Invalid BOAT_UNITS: use us_customary or metric")
     if _any_ip(result["CONTROL_PANEL_HOST"]): raise ValueError("Invalid CONTROL_PANEL_HOST: enter an IP address")
     for key in ("SIGNALK_VESSELTWIN_PRELOAD","SOCKETCAN_ENABLE","VESSELSTACK_CAN_CREATE_VCAN","AIS_ENABLE","TELEGRAM_ENABLE","TELEMETRY_INDEXER_ENABLE","NODE_EXPORTER_ENABLE","DISPLAYS_ENABLE","VESSELSTACK_FIREWALL_ENABLE","VESSELSTACK_FIREWALL_STRICT"):