diff --git a/.claude/WIP.md b/.claude/WIP.md
index 645cbe58..b3047853 100644
--- a/.claude/WIP.md
+++ b/.claude/WIP.md
@@ -1,9 +1,72 @@
 # WIP — Work In Progress
-*Mis à jour : 2026-04-04 (Session 38)*
+*Mis à jour : 2026-04-04 (Session 39)*
 
 ---
 
-## ✅ Terminé cette session (Session 38)
+## ✅ Terminé cette session (Session 39)
+
+### Boot Banner Improvements — CRT Style with Colors & Emojis ✅
+- **`/etc/issue`** — Pre-login banner with ANSI colors (gold/cyan)
+  - ASCII art SecuBox logo
+  - Default credentials display
+  - Web UI and SSH info
+- **`/etc/motd`** — Post-login MOTD with colored ASCII art
+  - LIVE USB badge in green
+  - Access info with color highlights
+- **`/usr/bin/secubox-status`** — System status command with CRT colors
+  - System info (hostname, uptime, memory, disk)
+  - Network interfaces with IP addresses
+  - Core services status (nginx, haproxy, crowdsec, etc.)
+  - Display mode indicator (kiosk/TUI/console)
+  - Quick access links
+- **`/usr/sbin/secubox-boot-banner`** — Boot-time banner script
+  - Boot progress indicators with checkmarks
+  - Network/Nginx/API status at boot
+
+### Profile.d Login Status ✅
+- **`/etc/profile.d/secubox-login.sh`** — Login status display
+  - Quick status line showing mode, service count, IP
+  - Only displays on TTY login (not SSH/tmux)
+- **`/usr/bin/secubox-help`** — Quick help command
+  - Lists common secubox-* commands by category
+  - System, Network, Security, Modes sections
+- **`/usr/bin/secubox-logs`** — Live security logs shortcut
+
+### secubox-cmdline-handler Improvements ✅
+- **TUI mode fix** — Now properly starts TUI service, not just enables it
+- **Console mode** — Enables standard getty on tty1
+- **Default mode detection** — Checks for build-time kiosk marker
+- **Better logging** — Mode transitions logged to journal
+
+### secubox-mode CRT Styling ✅
+- Updated with CRT-style colors (gold, cyan, green, red)
+- Emoji status indicators (✓, ✗, ⚠, ●)
+- Improved status display with mode details and help text
+- Better visual formatting for mode selection
+
+### GRUB Menu Improvements ✅
+- **Dynamic default** — Kiosk GUI (entry 1) is default when `--kiosk` flag used
+- **Emoji indicators** — All menu entries have relevant emojis:
+  - ⚡ SecuBox Live (standard)
+  - 🖼️ Kiosk GUI [DEFAULT]
+  - 📟 Console TUI
+  - 🌉 Bridge Mode
+  - 🛡️ Safe Mode
+  - 💾 Install to Disk
+  - 🚀 To RAM
+  - 🔧 HW Check
+  - 🚨 Emergency Shell
+  - 🐛 Debug modes
+- **CRT menu colors** — Cyan on black with yellow highlights
+
+### Files Modified
+- `image/build-live-usb.sh` — Banner, profile.d, GRUB config updates
+- `image/sbin/secubox-cmdline-handler` — Mode switching improvements
+- `image/sbin/secubox-mode` — CRT style colors and emoji status
+
+---
+
+## ✅ Terminé session précédente (Session 38)
 
 ### Wiki Documentation — VirtualBox Quick Start ✅
 - **wiki/Home.md** — Updated with VirtualBox (2 Minutes) quick start section
diff --git a/.github/workflows/build-live-usb.yml b/.github/workflows/build-live-usb.yml
index fb8306c9..41a5d543 100644
--- a/.github/workflows/build-live-usb.yml
+++ b/.github/workflows/build-live-usb.yml
@@ -176,14 +176,17 @@ jobs:
             ```
 
             ### Boot Options
-            - **SecuBox Live** - Normal boot with persistence
-            - **Safe Mode** - Minimal drivers for troubleshooting
-            - **No Persistence** - Fresh start, no saved changes
-            - **To RAM** - Load entire system to memory
+            - ⚡ **SecuBox Live** - Normal boot with persistence
+            - 🖼️ **Kiosk GUI** - Fullscreen browser (default)
+            - 📟 **Console TUI** - Text-based dashboard
+            - 🌉 **Bridge Mode** - Inline transparent bridge
+            - 🛡️ **Safe Mode** - Minimal drivers for troubleshooting
+            - 💾 **Install to Disk** - Install to local storage
+            - 🚀 **To RAM** - Load entire system to memory
 
             ### Credentials
-            - **Web UI:** https://<IP>:8443 (admin / admin)
-            - **SSH:** root / secubox | secubox / secubox
+            - **Web UI:** https://<IP>:9443 (admin / secubox)
+            - **SSH:** root / secubox
 
             ### Verification
             ```bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7adcdc41..a525c9b3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,15 +73,17 @@ jobs:
           cat > release/RELEASE_NOTES.md << EOF
           # SecuBox-DEB ${VERSION}
 
-          ## What's Included
+          ## ⚡ CyberMind Security Platform
 
-          ### Packages (33 total)
-          - **Core:** hub, core, portal, system
-          - **Security:** crowdsec, waf, auth, nac
+          ### What's Included
+
+          **93 Packages** across all security domains:
+          - **Core:** hub, core, portal, system, console
+          - **Security:** crowdsec, waf, auth, nac, threats, ipblock, mac-guard
           - **Networking:** wireguard, haproxy, dpi, qos, netmodes, vhost, cdn
-          - **Applications:** mail, gitea, nextcloud, webmail, dns, users
-          - **Publishing:** droplet, streamlit, streamforge, metablogizer, publish
-          - **Monitoring:** netdata, mediaflow, c3box
+          - **Applications:** mail, gitea, nextcloud, ollama, jellyfin, matrix
+          - **SOC:** soc-agent, soc-gateway, soc-web (hierarchical security operations)
+          - **Intel:** device-intel, vortex-dns, vortex-firewall, ai-insights
 
           ### System Images
           - MOCHAbin (Marvell Armada 7040) - arm64
@@ -89,6 +91,14 @@ jobs:
           - ESPRESSObin Ultra (Marvell Armada 3720) - arm64
           - VM x64 (VirtualBox/QEMU) - amd64
 
+          ### Boot Options
+          - ⚡ **SecuBox Live** - Normal boot with persistence
+          - 🖼️ **Kiosk GUI** - Fullscreen browser (default)
+          - 📟 **Console TUI** - Text-based dashboard
+          - 🌉 **Bridge Mode** - Inline transparent bridge
+          - 💾 **Install to Disk** - Permanent installation
+          - 🚀 **To RAM** - Load entire system to memory
+
           ## Quick Install
 
           ### From APT Repository
@@ -97,16 +107,19 @@ jobs:
           sudo apt install secubox-full
           \`\`\`
 
-          ### From Image
+          ### From Live USB Image
           \`\`\`bash
-          # ARM64 boards
-          gunzip -c secubox-mochabin-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
+          # Flash to USB
+          gunzip -c secubox-live-amd64-bookworm.img.gz | sudo dd of=/dev/sdX bs=4M status=progress
 
-          # VirtualBox
-          gunzip secubox-vm-x64-bookworm.img.gz
-          VBoxManage convertfromraw secubox-vm-x64-bookworm.img secubox.vdi --format VDI
+          # VirtualBox VM
+          bash image/create-vbox-vm.sh --name SecuBox --memory 4096
           \`\`\`
 
+          ### Default Credentials
+          - **Web UI:** https://<IP>:9443 (admin / secubox)
+          - **SSH:** root / secubox
+
           ## Checksums
 
           All files are signed with GPG key \`packages@secubox.in\`.
@@ -118,9 +131,9 @@ jobs:
 
           ## Documentation
 
-          - [Installation Guide](https://github.com/gkerma/secubox-deb/wiki/Installation)
-          - [API Documentation](https://github.com/gkerma/secubox-deb/wiki/API)
-          - [Security Hardening](https://github.com/gkerma/secubox-deb/wiki/Security)
+          - [Wiki Home](https://github.com/CyberMind-FR/secubox-deb/wiki)
+          - [VirtualBox Quick Start](https://github.com/CyberMind-FR/secubox-deb/wiki/VirtualBox)
+          - [API Reference](https://github.com/CyberMind-FR/secubox-deb/wiki/API-Reference)
 
           EOF
 
diff --git a/image/build-live-usb.sh b/image/build-live-usb.sh
index 159367af..3314df99 100755
--- a/image/build-live-usb.sh
+++ b/image/build-live-usb.sh
@@ -452,6 +452,120 @@ if [ -t 0 ] && [ -z "$SECUBOX_SPLASH_SHOWN" ]; then
 fi
 BASHRC
 
+# ── Profile.d script for login status display ──────────────────────────────────
+mkdir -p "${ROOTFS}/etc/profile.d"
+cat > "${ROOTFS}/etc/profile.d/secubox-login.sh" <<'PROFILE'
+#!/bin/bash
+# SecuBox Login Status Display
+# Shows quick system status on interactive shell login
+
+# Only run on interactive terminals
+[[ $- != *i* ]] && return
+[[ -z "$PS1" ]] && return
+
+# Avoid double display with splash
+[[ -n "$SECUBOX_STATUS_SHOWN" ]] && return
+export SECUBOX_STATUS_SHOWN=1
+
+# Colors
+GOLD='\033[38;5;214m'
+CYAN='\033[38;5;45m'
+GREEN='\033[38;5;82m'
+RED='\033[38;5;196m'
+GRAY='\033[38;5;242m'
+WHITE='\033[38;5;250m'
+RESET='\033[0m'
+
+# Quick status line after MOTD
+show_quick_status() {
+    local ip=$(hostname -I 2>/dev/null | awk '{print $1}')
+    local services_ok=0
+    local services_fail=0
+
+    for svc in nginx secubox-api nftables; do
+        if systemctl is-active --quiet "$svc" 2>/dev/null; then
+            ((services_ok++))
+        else
+            ((services_fail++))
+        fi
+    done
+
+    # Mode indicator
+    local mode_icon="🖥️"
+    local mode_text="Console"
+    if [[ -f /var/lib/secubox/.kiosk-enabled ]]; then
+        mode_icon="🖼️"
+        mode_text="Kiosk"
+    elif [[ -f /var/lib/secubox/.tui-enabled ]]; then
+        mode_icon="📟"
+        mode_text="TUI"
+    fi
+
+    echo ""
+    echo -e "${GRAY}────────────────────────────────────────────────────────────${RESET}"
+    echo -e "  ${mode_icon} ${CYAN}${mode_text}${RESET}  │  ${GREEN}●${RESET} ${services_ok} services  │  🌐 ${CYAN}${ip:-no-ip}${RESET}"
+    echo -e "${GRAY}────────────────────────────────────────────────────────────${RESET}"
+    echo -e "  ${GRAY}Type ${WHITE}secubox-status${GRAY} for details  •  ${WHITE}secubox-help${GRAY} for commands${RESET}"
+    echo ""
+}
+
+# Only show on tty login, not in SSH or within screen/tmux
+if [[ -z "$SSH_TTY" ]] && [[ -z "$TMUX" ]] && [[ -z "$STY" ]]; then
+    show_quick_status
+fi
+PROFILE
+chmod +x "${ROOTFS}/etc/profile.d/secubox-login.sh"
+
+# ── SecuBox help command ─────────────────────────────────────────────────────
+cat > "${ROOTFS}/usr/bin/secubox-help" <<'HELP_CMD'
+#!/bin/bash
+# SecuBox Quick Help
+GOLD='\033[38;5;214m'
+CYAN='\033[38;5;45m'
+WHITE='\033[38;5;250m'
+GRAY='\033[38;5;242m'
+RESET='\033[0m'
+
+echo -e "${GOLD}"
+echo '  ╭─────────────────────────────────────────────────────────╮'
+echo '  │             ⚡ SecuBox Quick Commands                   │'
+echo '  ╰─────────────────────────────────────────────────────────╯'
+echo -e "${RESET}"
+
+echo -e "  ${WHITE}System${RESET}"
+echo -e "    ${CYAN}secubox-status${GRAY}        System overview with services${RESET}"
+echo -e "    ${CYAN}secubox-logs${GRAY}          Live security logs${RESET}"
+echo -e "    ${CYAN}secubox-services${GRAY}      Manage services${RESET}"
+echo ""
+echo -e "  ${WHITE}Network${RESET}"
+echo -e "    ${CYAN}secubox-network${GRAY}       Network configuration${RESET}"
+echo -e "    ${CYAN}secubox-firewall${GRAY}      Firewall rules status${RESET}"
+echo ""
+echo -e "  ${WHITE}Security${RESET}"
+echo -e "    ${CYAN}secubox-threats${GRAY}       View blocked threats${RESET}"
+echo -e "    ${CYAN}secubox-waf-status${GRAY}    WAF inspection status${RESET}"
+echo ""
+echo -e "  ${WHITE}Modes${RESET}"
+echo -e "    ${CYAN}secubox-mode kiosk${GRAY}    Switch to Kiosk GUI${RESET}"
+echo -e "    ${CYAN}secubox-mode tui${GRAY}      Switch to TUI dashboard${RESET}"
+echo -e "    ${CYAN}secubox-mode console${GRAY}  Switch to shell console${RESET}"
+echo ""
+echo -e "  ${GRAY}Web UI: https://$(hostname -I 2>/dev/null | awk '{print $1}' || echo 'localhost'):9443${RESET}"
+echo ""
+HELP_CMD
+chmod +x "${ROOTFS}/usr/bin/secubox-help"
+
+# ── SecuBox logs command ─────────────────────────────────────────────────────
+cat > "${ROOTFS}/usr/bin/secubox-logs" <<'LOGS_CMD'
+#!/bin/bash
+# SecuBox Live Security Logs
+echo "📋 SecuBox Security Logs (Ctrl+C to exit)"
+echo "─────────────────────────────────────────"
+journalctl -f -u 'secubox-*' -u crowdsec -u suricata -u nginx --no-pager 2>/dev/null || \
+journalctl -f --no-pager
+LOGS_CMD
+chmod +x "${ROOTFS}/usr/bin/secubox-logs"
+
 # Systemd service for hardware check
 cat > "${ROOTFS}/etc/systemd/system/secubox-hwcheck.service" <<'HWSVC'
 [Unit]
@@ -1615,22 +1729,177 @@ rm -rf "${ROOTFS}/var/lib/apt/lists"/*
 rm -rf "${ROOTFS}/var/cache/apt"/*.bin
 rm -rf "${ROOTFS}/tmp"/*
 
-# Welcome message
-cat > "${ROOTFS}/etc/motd" <<'EOF'
+# ── CRT-Style Boot Banner with Colors and Emojis ──────────────────────────────
+log "Creating colorful boot banners..."
 
+# Pre-login banner (/etc/issue) - shown before login prompt
+cat > "${ROOTFS}/etc/issue" <<'ISSUE'
+[38;5;214m
+   ██████ ███████  ██████ ██    ██ ██████   ██████  ██   ██
+  ██      ██      ██      ██    ██ ██   ██ ██    ██  ██ ██
+  ███████ █████   ██      ██    ██ ██████  ██    ██   ███
+       ██ ██      ██      ██    ██ ██   ██ ██    ██  ██ ██
+  ███████ ███████  ██████  ██████  ██████   ██████  ██   ██
+[0m
+[38;5;45m  ⚡ CyberMind Security Platform[0m         [38;5;242m\l @ \n[0m
+
+[38;5;250m  🔐 Default: [38;5;214mroot[38;5;250m / [38;5;214msecubox[0m
+[38;5;250m  🌐 Web UI: [38;5;45mhttps://<IP>:9443[0m
+[38;5;250m  📡 SSH:    [38;5;45mport 22[0m
+
+[38;5;242m─────────────────────────────────────────────────────────────[0m
+
+ISSUE
+
+# Post-login MOTD with dynamic info (/etc/motd)
+cat > "${ROOTFS}/etc/motd" <<'MOTD'
+[38;5;214m
   ╔═══════════════════════════════════════════════════════════════╗
-  ║   ███████╗███████╗ ██████╗██╗   ██╗██████╗  ██████╗ ██╗  ██╗  ║
-  ║   ██╔════╝██╔════╝██╔════╝██║   ██║██╔══██╗██╔═══██╗╚██╗██╔╝  ║
-  ║   ███████╗█████╗  ██║     ██║   ██║██████╔╝██║   ██║ ╚███╔╝   ║
-  ║   ╚════██║██╔══╝  ██║     ██║   ██║██╔══██╗██║   ██║ ██╔██╗   ║
-  ║   ███████║███████╗╚██████╗╚██████╔╝██████╔╝╚██████╔╝██╔╝ ██╗  ║
-  ║   ╚══════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝  ║
-  ║                       LIVE USB                                ║
-  ╚═══════════════════════════════════════════════════════════════╝
+  ║[38;5;45m   ███████╗███████╗ ██████╗██╗   ██╗██████╗  ██████╗ ██╗  ██╗  [38;5;214m║
+  ║[38;5;45m   ██╔════╝██╔════╝██╔════╝██║   ██║██╔══██╗██╔═══██╗╚██╗██╔╝  [38;5;214m║
+  ║[38;5;45m   ███████╗█████╗  ██║     ██║   ██║██████╔╝██║   ██║ ╚███╔╝   [38;5;214m║
+  ║[38;5;45m   ╚════██║██╔══╝  ██║     ██║   ██║██╔══██╗██║   ██║ ██╔██╗   [38;5;214m║
+  ║[38;5;45m   ███████║███████╗╚██████╗╚██████╔╝██████╔╝╚██████╔╝██╔╝ ██╗  [38;5;214m║
+  ║[38;5;45m   ╚══════╝╚══════╝ ╚═════╝ ╚═════╝ ╚═════╝  ╚═════╝ ╚═╝  ╚═╝  [38;5;214m║
+  ║[38;5;82m                    ⚡ LIVE USB MODE ⚡                       [38;5;214m║
+  ╚═══════════════════════════════════════════════════════════════╝[0m
 
-  Web UI:  https://<IP>:9443    SSH: root / secubox
+[38;5;250m  🌐 Web UI:     [38;5;45mhttps://<IP>:9443[0m
+[38;5;250m  🔐 Credentials: [38;5;214mroot[38;5;250m / [38;5;214msecubox[0m
+[38;5;250m  📖 Docs:       [38;5;45mhttps://secubox.in/docs[0m
 
-EOF
+[38;5;242m  Type [38;5;82msecubox-status[38;5;242m for system overview[0m
+
+MOTD
+
+# Dynamic status script for interactive use
+cat > "${ROOTFS}/usr/bin/secubox-status" <<'STATUS_SCRIPT'
+#!/bin/bash
+# SecuBox Status - CRT-style system overview
+# CyberMind — https://cybermind.fr
+
+# Colors
+GOLD='\033[38;5;214m'
+CYAN='\033[38;5;45m'
+GREEN='\033[38;5;82m'
+RED='\033[38;5;196m'
+GRAY='\033[38;5;242m'
+WHITE='\033[38;5;250m'
+RESET='\033[0m'
+
+# Status indicators
+ok="${GREEN}●${RESET}"
+fail="${RED}●${RESET}"
+warn="${GOLD}●${RESET}"
+
+# Header
+echo -e "${CYAN}"
+echo '  ╭──────────────────────────────────────────────────────────╮'
+echo '  │           ⚡ SecuBox System Status ⚡                   │'
+echo '  ╰──────────────────────────────────────────────────────────╯'
+echo -e "${RESET}"
+
+# System info
+echo -e "${WHITE}  📊 System Info${RESET}"
+echo -e "     ${GRAY}Hostname:${RESET}  $(hostname)"
+echo -e "     ${GRAY}Uptime:${RESET}    $(uptime -p 2>/dev/null || echo 'N/A')"
+echo -e "     ${GRAY}Memory:${RESET}    $(free -h | awk '/^Mem:/{printf "%s / %s (%.1f%%)", $3, $2, $3/$2*100}')"
+echo -e "     ${GRAY}Disk:${RESET}      $(df -h / | awk 'NR==2{printf "%s / %s (%s)", $3, $2, $5}')"
+echo ""
+
+# Network info
+echo -e "${WHITE}  🌐 Network${RESET}"
+for iface in $(ip -o link show | awk -F': ' '{print $2}' | grep -v '^lo$'); do
+    ip_addr=$(ip -4 addr show "$iface" 2>/dev/null | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | head -1)
+    if [[ -n "$ip_addr" ]]; then
+        echo -e "     ${GREEN}●${RESET} ${GRAY}${iface}:${RESET}  ${CYAN}${ip_addr}${RESET}"
+    fi
+done
+echo ""
+
+# Core services
+echo -e "${WHITE}  🔧 Core Services${RESET}"
+services=(nginx haproxy secubox-api secubox-hub crowdsec suricata)
+for svc in "${services[@]}"; do
+    if systemctl is-active --quiet "$svc" 2>/dev/null; then
+        echo -e "     ${ok} ${GRAY}${svc}${RESET}"
+    elif systemctl list-unit-files "${svc}.service" 2>/dev/null | grep -q "$svc"; then
+        echo -e "     ${fail} ${GRAY}${svc}${RESET} (stopped)"
+    fi
+done
+echo ""
+
+# Mode detection
+echo -e "${WHITE}  🎮 Display Mode${RESET}"
+if [[ -f /var/lib/secubox/.kiosk-enabled ]]; then
+    echo -e "     ${ok} ${CYAN}Kiosk GUI${RESET} (Web browser on tty7)"
+elif [[ -f /var/lib/secubox/.tui-enabled ]]; then
+    echo -e "     ${ok} ${CYAN}Console TUI${RESET} (Text dashboard on tty1)"
+else
+    echo -e "     ${warn} ${CYAN}Console Shell${RESET} (Standard login)"
+fi
+echo ""
+
+# Quick links
+echo -e "${GOLD}  ────────────────────────────────────────────────────────────${RESET}"
+echo -e "${WHITE}  🔗 Quick Access${RESET}"
+IP=$(hostname -I | awk '{print $1}')
+echo -e "     ${GRAY}Dashboard:${RESET}  ${CYAN}https://${IP:-localhost}:9443${RESET}"
+echo -e "     ${GRAY}Admin API:${RESET}  ${CYAN}https://${IP:-localhost}:9443/api/v1/${RESET}"
+echo ""
+STATUS_SCRIPT
+chmod +x "${ROOTFS}/usr/bin/secubox-status"
+
+# Also add a boot-time banner display script
+cat > "${ROOTFS}/usr/sbin/secubox-boot-banner" <<'BOOT_BANNER'
+#!/bin/bash
+# SecuBox Boot Banner - Displayed during boot
+# CyberMind — https://cybermind.fr
+
+GOLD='\033[38;5;214m'
+CYAN='\033[38;5;45m'
+GREEN='\033[38;5;82m'
+GRAY='\033[38;5;242m'
+RESET='\033[0m'
+
+clear
+echo -e "${GOLD}"
+cat << 'LOGO'
+
+   ██████ ███████  ██████ ██    ██ ██████   ██████  ██   ██
+  ██      ██      ██      ██    ██ ██   ██ ██    ██  ██ ██
+  ███████ █████   ██      ██    ██ ██████  ██    ██   ███
+       ██ ██      ██      ██    ██ ██   ██ ██    ██  ██ ██
+  ███████ ███████  ██████  ██████  ██████   ██████  ██   ██
+
+LOGO
+echo -e "${RESET}"
+echo -e "${CYAN}  ⚡ CyberMind Security Platform${RESET}"
+echo -e "${GRAY}     Booting...${RESET}"
+echo ""
+
+# Show boot progress
+show_status() {
+    local name="$1"
+    local check="$2"
+    if eval "$check" 2>/dev/null; then
+        echo -e "  ${GREEN}✓${RESET} ${name}"
+    else
+        echo -e "  ${GRAY}○${RESET} ${name} (waiting...)"
+    fi
+}
+
+show_status "Network" "ip route | grep -q default"
+show_status "Nginx" "systemctl is-active --quiet nginx"
+show_status "SecuBox API" "systemctl is-active --quiet secubox-api"
+
+echo ""
+echo -e "${GRAY}  Dashboard: https://$(hostname -I | awk '{print $1}' || echo 'localhost'):9443${RESET}"
+echo ""
+BOOT_BANNER
+chmod +x "${ROOTFS}/usr/sbin/secubox-boot-banner"
+
+ok "Boot banners created with CRT colors and emojis"
 
 # Unmount
 umount -lf "${ROOTFS}/proc" 2>/dev/null || true
@@ -1878,9 +2147,18 @@ mkdir -p "${MNT}/esp/live"
 cp "${LIVE_DIR}/live/vmlinuz" "${MNT}/esp/live/"
 cp "${LIVE_DIR}/live/initrd.img" "${MNT}/esp/live/"
 
-# GRUB config
-cat > "${MNT}/esp/boot/grub/grub.cfg" <<'GRUBCFG'
-set default=0
+# GRUB config - Dynamic based on build options
+# When kiosk is enabled, default to Kiosk GUI (entry 1), otherwise standard boot (entry 0)
+if [[ "${INCLUDE_KIOSK:-1}" == "1" ]]; then
+    GRUB_DEFAULT=1  # Kiosk GUI is second entry
+    log "GRUB default: Kiosk GUI mode"
+else
+    GRUB_DEFAULT=0  # Standard boot
+    log "GRUB default: Standard boot"
+fi
+
+cat > "${MNT}/esp/boot/grub/grub.cfg" <<GRUBCFG
+set default=${GRUB_DEFAULT}
 set timeout=5
 
 insmod part_gpt
@@ -1890,30 +2168,35 @@ insmod all_video
 
 search --no-floppy --label LIVE --set=live
 
+# CRT-style menu colors (cyan on black, gold highlights)
 set menu_color_normal=cyan/black
-set menu_color_highlight=white/blue
+set menu_color_highlight=yellow/blue
 
-menuentry "SecuBox Live" {
-    linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash
-    initrd ($live)/live/initrd.img
+menuentry "⚡ SecuBox Live" {
+    linux (\$live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash
+    initrd (\$live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Kiosk GUI)" {
-    linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash secubox.kiosk=1 systemd.unit=graphical.target
-    initrd ($live)/live/initrd.img
+menuentry "🖼️ SecuBox Live (Kiosk GUI) [DEFAULT]" {
+    linux (\$live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash secubox.kiosk=1 systemd.unit=graphical.target
+    initrd (\$live)/live/initrd.img
 }
+GRUBCFG
 
-menuentry "SecuBox Live (Console TUI)" {
+# Append the rest of the menu entries with emoji indicators
+cat >> "${MNT}/esp/boot/grub/grub.cfg" <<'GRUBCFG'
+
+menuentry "📟 SecuBox Live (Console TUI)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash secubox.mode=tui
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Bridge Mode)" {
+menuentry "🌉 SecuBox Live (Bridge Mode)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash secubox.netmode=bridge
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Safe Mode)" {
+menuentry "🛡️ SecuBox Live (Safe Mode)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components nomodeset console=tty0
     initrd ($live)/live/initrd.img
 }
@@ -1923,32 +2206,32 @@ menuentry "💾 Install SecuBox to Disk" {
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (To RAM)" {
+menuentry "🚀 SecuBox Live (To RAM)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components toram quiet splash
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Auto-Check HW)" {
+menuentry "🔧 SecuBox Live (HW Check)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence quiet splash secubox.hwcheck=1
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Auto-Check HW - Text Mode)" {
+menuentry "🔧 SecuBox Live (HW Check - Text)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components persistence nomodeset console=tty0 secubox.hwcheck=1
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Emergency Shell)" {
+menuentry "🚨 Emergency Shell" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components nomodeset console=tty0 systemd.unit=emergency.target
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Debug - Verbose Boot)" {
+menuentry "🐛 Debug (Verbose Boot)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components nomodeset console=tty0 debug=1 break=init
     initrd ($live)/live/initrd.img
 }
 
-menuentry "SecuBox Live (Debug - Break at Premount)" {
+menuentry "🐛 Debug (Break at Premount)" {
     linux ($live)/live/vmlinuz boot=live live-media-path=/live rootdelay=10 components nomodeset console=tty0 debug=1 break=premount
     initrd ($live)/live/initrd.img
 }
diff --git a/image/sbin/secubox-cmdline-handler b/image/sbin/secubox-cmdline-handler
index 06f98131..8ee6e04b 100755
--- a/image/sbin/secubox-cmdline-handler
+++ b/image/sbin/secubox-cmdline-handler
@@ -67,18 +67,45 @@ apply_settings() {
             log "TUI mode requested via cmdline"
             rm -f "${MARKER_DIR}/.kiosk-enabled"
             touch "${MARKER_DIR}/.tui-enabled"
+
+            # Disable kiosk, enable TUI
             systemctl disable secubox-kiosk.service 2>/dev/null || true
+            systemctl stop secubox-kiosk.service 2>/dev/null || true
             systemctl enable secubox-console-tui.service 2>/dev/null || true
+
+            # Set multi-user target (no graphical)
+            systemctl set-default multi-user.target 2>/dev/null || true
+
+            # Start TUI service (will run on tty1)
+            log "Starting console TUI service..."
+            systemctl start secubox-console-tui.service 2>/dev/null &
             ;;
         console)
-            log "Console mode requested via cmdline"
+            log "Console mode requested via cmdline (standard shell)"
             rm -f "${MARKER_DIR}/.kiosk-enabled"
             rm -f "${MARKER_DIR}/.tui-enabled"
+
+            # Disable both kiosk and TUI
             systemctl disable secubox-kiosk.service 2>/dev/null || true
             systemctl disable secubox-console-tui.service 2>/dev/null || true
+            systemctl stop secubox-kiosk.service 2>/dev/null || true
+            systemctl stop secubox-console-tui.service 2>/dev/null || true
+
+            # Set multi-user target with standard getty
+            systemctl set-default multi-user.target 2>/dev/null || true
+            systemctl enable getty@tty1.service 2>/dev/null || true
             ;;
-        kiosk|*)
-            # Default: kiosk mode (handled below)
+        kiosk)
+            log "Kiosk mode explicitly requested"
+            # Will be handled below with secubox.kiosk=1 logic
+            ;;
+        *)
+            # Default: check if kiosk marker exists from build time
+            if [[ -f "${MARKER_DIR}/.kiosk-enabled" ]]; then
+                log "Default mode: Kiosk (marker present from build)"
+            else
+                log "Default mode: Console shell"
+            fi
             ;;
     esac
 
diff --git a/image/sbin/secubox-mode b/image/sbin/secubox-mode
index f49574c1..505a66f3 100755
--- a/image/sbin/secubox-mode
+++ b/image/sbin/secubox-mode
@@ -1,18 +1,23 @@
 #!/bin/bash
 # ══════════════════════════════════════════════════════════════════
 #  SecuBox Mode Switcher — Switch between Kiosk (GUI) and TUI modes
+#  CRT-style output with emoji status indicators
 # ══════════════════════════════════════════════════════════════════
 set -u
 
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[0;33m'
-CYAN='\033[0;36m'
+# CRT-style colors
+GOLD='\033[38;5;214m'
+CYAN='\033[38;5;45m'
+GREEN='\033[38;5;82m'
+RED='\033[38;5;196m'
+GRAY='\033[38;5;242m'
+WHITE='\033[38;5;250m'
 NC='\033[0m'
 
-log() { echo -e "${CYAN}[secubox]${NC} $*"; }
-ok()  { echo -e "${GREEN}[  OK  ]${NC} $*"; }
-err() { echo -e "${RED}[ERROR]${NC} $*" >&2; }
+log() { echo -e "${CYAN}⚡${NC} $*"; }
+ok()  { echo -e "${GREEN}✓${NC} $*"; }
+err() { echo -e "${RED}✗${NC} $*" >&2; }
+warn() { echo -e "${GOLD}⚠${NC} $*"; }
 
 usage() {
     cat <<EOF
@@ -120,27 +125,40 @@ show_status() {
     local mode=$(current_mode)
 
     echo
-    echo "SecuBox Display Mode"
-    echo "===================="
-    echo
-    echo -e "Current mode: ${CYAN}${mode}${NC}"
+    echo -e "${GOLD}╭─────────────────────────────────────────────────────────╮${NC}"
+    echo -e "${GOLD}│${NC}           ${WHITE}⚡ SecuBox Display Mode${NC}                     ${GOLD}│${NC}"
+    echo -e "${GOLD}╰─────────────────────────────────────────────────────────╯${NC}"
     echo
 
     case "$mode" in
         kiosk)
-            echo "  Kiosk mode: Chromium browser in fullscreen"
-            echo "  Press Ctrl+Alt+F2 to access console"
-            echo "  Use 'secubox-mode tui' to switch to TUI"
+            echo -e "  ${GREEN}●${NC} Current: ${CYAN}Kiosk GUI${NC} 🖼️"
+            echo
+            echo -e "  ${GRAY}Chromium browser in fullscreen on tty7${NC}"
+            echo -e "  ${GRAY}Press ${WHITE}Ctrl+Alt+F2${GRAY} to access console${NC}"
+            echo -e "  ${GRAY}Use ${WHITE}secubox-mode tui${GRAY} to switch to TUI${NC}"
             ;;
         tui)
-            echo "  TUI mode: Console-based dashboard"
-            echo "  Press 'q' to exit TUI, then 'secubox-mode kiosk' to switch"
+            echo -e "  ${GREEN}●${NC} Current: ${CYAN}Console TUI${NC} 📟"
+            echo
+            echo -e "  ${GRAY}Text-based dashboard on tty1${NC}"
+            echo -e "  ${GRAY}Press ${WHITE}q${GRAY} to exit TUI${NC}"
+            echo -e "  ${GRAY}Use ${WHITE}secubox-mode kiosk${GRAY} for GUI mode${NC}"
             ;;
         console)
-            echo "  Console mode: Standard login shell"
-            echo "  Use 'secubox-mode kiosk' or 'secubox-mode tui' to switch"
+            echo -e "  ${GREEN}●${NC} Current: ${CYAN}Console Shell${NC} 🖥️"
+            echo
+            echo -e "  ${GRAY}Standard login shell${NC}"
+            echo -e "  ${GRAY}Use ${WHITE}secubox-mode kiosk${GRAY} or ${WHITE}tui${GRAY} to switch${NC}"
             ;;
     esac
+
+    echo
+    echo -e "  ${GRAY}────────────────────────────────────────────────────${NC}"
+    echo -e "  ${WHITE}Modes:${NC}"
+    echo -e "    ${CYAN}kiosk${NC}   🖼️  Full-screen browser GUI"
+    echo -e "    ${CYAN}tui${NC}     📟  Console text dashboard"
+    echo -e "    ${CYAN}console${NC} 🖥️  Standard shell login"
     echo
 }