Harden installation and runtime diagnostics

README.md

@@ -32,6 +32,16 @@ sudo ./install.sh
 sudo reboot
 ```
 
+The installer performs preflight checks, backs up managed configuration under
+`/var/backups/pivilion`, validates the deployed services, and restores the
+previous configuration if deployment fails. Additional maintenance modes are:
+
+```sh
+./install.sh --dry-run       # read-only preflight and proposed actions
+sudo ./install.sh --check    # validate an existing installation
+sudo ./install.sh --repair  # repeat deployment without replacing gallery content
+```
+
 The installer defaults to the user that invoked `sudo`, not to a hard-coded
 `pi` account. To customize paths, startup mode, hotspot SSID, or Wi-Fi
 interface, copy `pivilion.conf.example` to `/boot/firmware/pivilion.conf` (or
@@ -44,5 +54,14 @@ through Tor. Use `hotspot` and reboot to run the local captive gallery at
 local captive portal cannot present valid certificates for arbitrary sites.
 
 If a phone joins but does not open its captive-login window, run
-`pivilion-diagnose` on the Pi to verify DHCP/DNS, Apache rewrite handling,
+`pivilion diagnose` on the Pi to verify DHCP/DNS, Apache rewrite handling,
 nftables, and the common Android, Apple, and Microsoft HTTP probes.
+
+`pivilion status` distinguishes the requested next-boot mode from the last
+verified active mode and reports degraded activation. `pivilion diagnose
+--json` provides the same health checks for monitoring. The legacy
+`pivilion-diagnose` command remains an alias.
+
+Diagnostic exit codes are stable: `10` invalid configuration, `11` missing or
+unsupported hardware, `12` service/port conflict, `13` core service failure,
+`14` captive portal failure, `15` Tor/onion failure, and `20` installer failure.