@@ -13,18 +13,36 @@ jobs:
         with:
           persist-credentials: false
       - name: Install test tools
-        run: sudo apt-get update && sudo apt-get install -y shellcheck jq nginx libnginx-mod-stream iptables
+        run: sudo apt-get update && sudo apt-get install -y shellcheck jq nginx libnginx-mod-stream iptables nftables conntrack passwd iproute2 util-linux curl python3 openssl ca-certificates
+      - name: Telemt conntrack dependency and default systemd runtime PATH
+        run: |
+          command -v conntrack
+          systemd-path search-binaries-default
+          env -i PATH="$(systemd-path search-binaries-default)" conntrack --version
+          evidence="$RUNNER_TEMP/telemt-pinned-evidence"
+          mkdir -m 0700 "$evidence"
+          printf 'TELEMT_TEST_EVIDENCE_DIR=%s\n' "$evidence" >> "$GITHUB_ENV"
       - name: Bash syntax
-        run: for file in telemt-web-manager.sh tests/*.sh; do bash -n "$file"; done
+        run: for file in install.sh telemt-web-manager.sh tests/*.sh; do bash -n "$file"; done
       - name: ShellCheck
-        run: shellcheck -x telemt-web-manager.sh tests/*.sh
-      - name: Unit and fixture tests (no root, no production access)
-        run: bash tests/run.sh && bash tests/fresh.sh && bash tests/download.sh
-      - name: Published Telemt configuration contract (SHA256 verified)
-        run: bash tests/upstream.sh
-      - name: Version-independent compatibility, downgrade and rollback regressions
-        run: bash tests/versions.sh && FIXTURE_VERSION=42.7.123 bash tests/fresh.sh && FIXTURE_VERSION=42.7.123 FIXTURE_INCOMPATIBLE=1 bash tests/fresh.sh
-      - name: Actual Ubuntu nf_tables missing-chain diagnostic (isolated namespace)
+        run: shellcheck -x install.sh telemt-web-manager.sh tests/*.sh
+      - name: Parser/unit and fresh transaction fixtures (service/path/journal transport mocked)
+        run: bash tests/run.sh && bash tests/fresh.sh && bash tests/fresh-rollback.sh && bash tests/download.sh && bash tests/bootstrap_versions.sh && bash tests/preflight.sh
+      - name: Real fresh account and owned runtime-state rollback (temporary root-owned fixtures)
+        run: sudo bash tests/fresh-account.sh
+      - name: Pinned Telemt 3.5.11 release provenance and real config healthcheck (no runtime)
+        run: bash tests/pinned.sh && bash tests/upstream.sh
+      - name: Pinned Telemt 3.5.11 staging healthcheck (service/path health mocked)
+        run: bash tests/staging.sh
+      - name: Real Telemt 3.5.11 runtime smoke in isolated network namespace (no systemd)
+        run: sudo env TELEMT_TEST_EVIDENCE_DIR="$TELEMT_TEST_EVIDENCE_DIR" bash tests/runtime.sh
+      - name: Production pin equals real downloaded, staging, runtime and documented version
+        run: bash tests/pinned.sh --versions
+      - name: Manager bootstrap release selection, atomic pair update and rollback (temporary root-owned fixtures)
+        run: sudo bash tests/bootstrap.sh
+      - name: Pinned upgrade/newer-version refusal and rollback fixtures (synthetic binary/lifecycle)
+        run: bash tests/versions.sh
+      - name: Real nf_tables diagnostic in namespace (synthetic log bridge; no Telemt runtime)
         run: bash tests/conntrack.sh
       - name: Writable state and systemd contract
         run: bash tests/contracts.sh
 
@@ -15,44 +15,29 @@ port 443 through Nginx `stream` / `ssl_preread`.
 - Health checks, bounded startup readiness and automatic transaction rollback.
 - Hardened systemd service; existing TOML preserved during updates.
 
-## Installation
+## Quick installation
 
-Run in a **root shell**, initially on a disposable test VPS.
-Prerequisites: Ubuntu 24.04/26.04, systemd, Bash 5+, Python 3.11+, an active
-recognized Nginx router and SSL, HTTP/2, realip, stream/ssl_preread modules.
-Install command dependencies without replacing your working Nginx:
+Run in a **root shell**, initially on a disposable test VPS:
 
 ```bash
-apt-get update
-apt-get install git shellcheck bash python3 curl ca-certificates tar openssl jq \
-  dnsutils util-linux iproute2 coreutils passwd certbot iptables nftables
+bash <(curl -fsSL https://raw.githubusercontent.com/xPROMSx/telemt-web-manager/main/install.sh)
 ```
 
-Obtain and inspect the source, validate it and install both files:
-
-```bash
-git clone https://github.com/xPROMSx/telemt-web-manager.git
-cd telemt-web-manager
+The installer installs the manager and opens its menu when stdin/stdout are a TTY.
+It needs Bash, curl, CA certificates and Python 3.11+; it does not install packages
+or change Telemt, Nginx, Certbot or Xray. Review the script first if preferred.
 
-bash -n telemt-web-manager.sh
-shellcheck telemt-web-manager.sh
-
-install -d -m 0755 /opt/telemt-web-manager/lib
-install -m 0755 telemt-web-manager.sh /opt/telemt-web-manager/
-install -m 0644 lib/safety.py /opt/telemt-web-manager/lib/
-```
-
-Keep `/opt/telemt-web-manager` root-owned and unwritable by others.
-On a clean Nginx package, stream usually requires `libnginx-mod-stream`;
-match modules to your installed Nginx and verify `nginx -t`.
-The manager checks dependencies; it does not install packages or run `curl | bash`.
+Both program files come from one published manager release resolved to a commit.
+The highest stable SemVer is selected; if none exists, the highest prerelease is
+used. Automatic manager downgrades are refused. Testing an unpublished commit
+uses the advanced/manual workflow below. [Release policy and recovery](docs/OPERATIONS.md#manager-bootstrap).
 
 ## First run
 
-Start the interactive menu:
+Open the menu again after installation:
 
 ```bash
-/opt/telemt-web-manager/telemt-web-manager.sh
+telemt-web-manager
 ```
 
 Choose Install and supply your WEB domain, public IPv4 and optional SOCKS5 address.
@@ -71,15 +56,15 @@ Replace the example domain and TEST-NET address with your own values.
 Direct egress:
 
 ```bash
-/opt/telemt-web-manager/telemt-web-manager.sh --install \
+telemt-web-manager --install \
   --domain proxy.example.com \
   --public-ip 203.0.113.10
 ```
 
 SOCKS5 egress:
 
 ```bash
-/opt/telemt-web-manager/telemt-web-manager.sh --install \
+telemt-web-manager --install \
   --domain proxy.example.com \
   --public-ip 203.0.113.10 \
   --socks 127.0.0.1:1080
@@ -92,27 +77,31 @@ agreement. An unrelated existing certificate is not automatically adopted.
 ## Update, check and repair
 
 ```bash
-/opt/telemt-web-manager/telemt-web-manager.sh --update
-/opt/telemt-web-manager/telemt-web-manager.sh --check
-/opt/telemt-web-manager/telemt-web-manager.sh --repair
+telemt-web-manager --update
+telemt-web-manager --check
+telemt-web-manager --repair
 ```
 
-`--update` updates the audited **Telemt binary**, with validation and rollback;
+`--update` updates the **Telemt binary**, with validation and rollback;
 it does not update the manager or rewrite TOML.
 `--check` validates managed files, configuration, renewal state and service health.
 `--repair` restarts/reloads only verified managed services, without reconstructing
-changed files. To update the manager, review a newer checkout and repeat the
-validation/copy steps above.
+changed files. To update the manager itself, rerun the quick installation command.
+This preserves the existing Telemt deployment.
 
-## Intended environment
+## Requirements and supported environment
 
-Ubuntu 24.04/26.04 on x86_64 or aarch64, with one recognized Nginx SNI map/router,
+Ubuntu 24.04/26.04, systemd, Bash 5+, Python 3.11+, active Nginx with SSL, HTTP/2,
+realip and stream/ssl_preread modules. x86_64 or aarch64, one recognized Nginx SNI map/router,
 IPv4 `:443`, optional existing `[::]:443`, outgoing PROXY protocol and an HTTP
 `conf.d/*.conf` include. The manager adds a loopback TLS frontend and an IPv4-only
 Telemt WEB listener. Telegram egress is direct or unauthenticated SOCKS5.
-Source-audited baseline: **3.5.9**; official 3.5.7/3.5.9 configuration tests are retained.
-Stable releases are evaluated against explicit configuration/runtime health contracts;
-incompatible candidates are refused or rolled back, without a version-number gate.
+Supported Telemt: **3.5.11**. Fresh installs and updates use only this reviewed
+release and embedded official SHA256 values. Older managed installs must pass
+compatibility checks; newer installs are never downgraded. Supporting a future
+release requires a new reviewed manager version. `--check` reports installed and
+supported versions locally. WARN is diagnostic; genuine ERROR/FATAL/panic and
+failed objective health checks cause failure. [CI coverage](docs/CI-COVERAGE.md).
 
 HTTP-01 uses standalone on free port 80, or a persistent managed webroot when
 port 80 belongs to the recognized Nginx redirect topology. Nginx is never stopped.
@@ -132,9 +121,49 @@ are not automatically supported. Xray and 3x-ui configuration/database are not m
 CI uses the verified official Telemt binary and real Nginx traffic tests.
 Systemd and Certbot lifecycle operations use mocks. Live VPS acceptance is still required.
 
+The enabled conntrack-control contract requires the Ubuntu `conntrack` package,
+iptables/ip6tables/nft and CAP_NET_ADMIN. Preflight checks `conntrack` on both
+the root shell PATH and systemd's default runtime PATH before installation work;
+the manager does not install missing packages.
+
+## Advanced / manual installation
+
+Review a trusted checkout (or the PR checkout during acceptance) and install both
+files. This path does not install the convenient launcher:
+
+```bash
+git clone https://github.com/xPROMSx/telemt-web-manager.git
+cd telemt-web-manager
+bash -n telemt-web-manager.sh
+shellcheck telemt-web-manager.sh
+install -d -m 0755 /opt/telemt-web-manager/lib
+install -m 0755 telemt-web-manager.sh /opt/telemt-web-manager/
+install -m 0644 lib/safety.py /opt/telemt-web-manager/lib/
+/opt/telemt-web-manager/telemt-web-manager.sh
+```
+
+Keep the installation root-owned and unwritable by others. Install missing
+manager dependencies deliberately, without replacing the working Nginx stack:
+
+```bash
+apt-get update
+apt-get install git shellcheck bash python3 curl ca-certificates tar openssl jq \
+  dnsutils util-linux iproute2 coreutils passwd certbot iptables nftables conntrack
+```
+
+On a clean package Nginx, stream usually needs `libnginx-mod-stream`; match modules
+to the installed Nginx and verify `nginx -t`. The manager checks dependencies.
+Bootstrap options: `--version v0.1.0` selects a published release; `--no-start`
+suppresses the menu. See [operations](docs/OPERATIONS.md#manager-bootstrap).
+
+## Technical documentation
+
+- [Upstream audit and version/configuration contracts](docs/UPSTREAM.md).
+- [Architecture, security, ACME recovery, tests and operations](docs/OPERATIONS.md).
+
 ## Important limitations
 
-- Unknown Nginx topology, changed managed contracts and unaudited versions fail closed.
+- Unknown Nginx topology or incompatible/changed managed runtime contracts fail closed.
 - Unrelated existing Telemt installations and certificates require manual review.
 - No firewall/UFW changes, automatic TOML migrations or automatic uninstall.
 - WEB AAAA, authenticated/IPv6 SOCKS and custom HTTP-80 routing require manual review.
@@ -143,11 +172,6 @@ Systemd and Certbot lifecycle operations use mocks. Live VPS acceptance is still
 - SIGINT/TERM/HUP trigger transactional rollback. Power loss, SIGKILL, disk failure
   and concurrent root edits remain manual recovery boundaries.
 
-## Technical documentation
-
-- [Upstream audit and version/configuration contracts](docs/UPSTREAM.md).
-- [Architecture, security, ACME recovery, tests and operations](docs/OPERATIONS.md).
-
 ## License and independence
 
 [MIT License](LICENSE). Independent project, not affiliated with, endorsed by,