diff --git a/.gitignore b/.gitignore
index cf986242..1418f625 100644
--- a/.gitignore
+++ b/.gitignore
@@ -43,3 +43,6 @@ dist/
 # Tow-Boot (Nix build artifacts)
 tools/Tow-Boot/result
 tools/Tow-Boot/output/
+
+# Kernel build
+kernel-build/
diff --git a/.vscode/settings.json b/.vscode/settings.json
index a023b03c..b6947f6b 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -110,7 +110,7 @@
 
   // ── Thème ─────────────────────────────────────────────────────────────────────
   "workbench.colorTheme": "One Dark Pro Darker",
-  "workbench.iconTheme": "material-icon-theme",
+  "workbench.iconTheme": "vs-seti",
   "workbench.colorCustomizations": {
     "activityBar.background": "#0a0a0f",
     "sideBar.background": "#0d0d14",
diff --git a/board/mochabin/boot.cmd b/board/mochabin/boot.cmd
index 1190f1a9..7778746c 100644
--- a/board/mochabin/boot.cmd
+++ b/board/mochabin/boot.cmd
@@ -1,70 +1,55 @@
 # SecuBox U-Boot boot script for MOCHAbin
 # Marvell Armada 7040 with Topaz 88E6141/6341 switch
 # Compile with: mkimage -C none -A arm64 -T script -d boot.cmd boot.scr
+#
+# This script provides automatic boot without menu selection.
+# It bypasses extlinux.conf for direct kernel boot.
 
 echo "============================================"
-echo "SecuBox MOCHAbin Boot"
+echo "SecuBox MOCHAbin Boot (auto)"
 echo "============================================"
 
-# Detect boot device
-if test -n "${devtype}" -a -n "${devnum}"; then
-    echo "Boot device from env: ${devtype} ${devnum}"
-    setenv bootdev "${devnum}"
-else
-    echo "Probing boot devices..."
-    # MOCHAbin: eMMC=mmc0, SD=mmc1 (opposite of ESPRESSObin)
-    if test -e mmc 0:1 Image; then
-        setenv bootdev 0
-        echo "Found boot on mmc 0 (eMMC)"
-    elif test -e mmc 1:1 Image; then
-        setenv bootdev 1
-        echo "Found boot on mmc 1 (SD)"
-    else
-        echo "WARN: No Image found, trying mmc 0"
-        setenv bootdev 0
-    fi
-fi
+# MOCHAbin: eMMC=mmc0, SD=mmc1
+setenv bootdev 0
+setenv bootpart "mmc 0:1"
+setenv rootpart "/dev/mmcblk0p2"
 
-setenv bootpart "mmc ${bootdev}:1"
-setenv rootpart "/dev/mmcblk${bootdev}p2"
+echo "Boot: ${bootpart} | Root: ${rootpart}"
 
-echo "Boot partition: ${bootpart}"
-echo "Root partition: ${rootpart}"
-
-# Load kernel
+# Try LED kernel first, fall back to standard
 echo "Loading kernel..."
-if load ${bootpart} ${kernel_addr_r} Image; then
-    echo "Kernel loaded OK"
+if load ${bootpart} ${kernel_addr_r} Image-secubox-led; then
+    echo "LED kernel loaded"
+    setenv initrd_file "initrd.img-6.12.85+deb12-arm64"
+elif load ${bootpart} ${kernel_addr_r} Image; then
+    echo "Standard kernel loaded"
+    setenv initrd_file "initrd.img"
 else
-    echo "ERROR: Failed to load kernel"
-    if test "${bootdev}" = "0"; then
-        setenv bootdev 1
-    else
-        setenv bootdev 0
-    fi
-    setenv bootpart "mmc ${bootdev}:1"
-    setenv rootpart "/dev/mmcblk${bootdev}p2"
-    echo "Retrying with ${bootpart}..."
-    load ${bootpart} ${kernel_addr_r} Image
+    echo "ERROR: No kernel found!"
+    exit
 fi
 
 # Load DTB
-echo "Loading device tree..."
-if load ${bootpart} ${fdt_addr_r} dtbs/marvell/armada-7040-mochabin.dtb; then
-    echo "DTB loaded OK"
-else
-    echo "Trying alternate DTB path..."
+echo "Loading DTB..."
+load ${bootpart} ${fdt_addr_r} dtbs/marvell/armada-7040-mochabin.dtb || \
     load ${bootpart} ${fdt_addr_r} armada-7040-mochabin.dtb
+
+# Load initrd
+echo "Loading initrd..."
+if load ${bootpart} ${ramdisk_addr_r} ${initrd_file}; then
+    setenv ramdisk_arg "${ramdisk_addr_r}:${filesize}"
+    echo "Initrd loaded: ${filesize} bytes"
+else
+    setenv ramdisk_arg "-"
+    echo "No initrd, booting without"
 fi
 
-# Set boot args
-# rootdelay=5: give storage time to settle
-# mv88e6xxx.defer_ms=5000: delay DSA switch probe
-setenv bootargs "root=${rootpart} rootfstype=ext4 rootwait rootdelay=5 console=ttyMV0,115200 net.ifnames=0 mv88e6xxx.defer_ms=5000"
+# Set boot args - console=ttyS0 for MOCHAbin
+setenv bootargs "root=${rootpart} rootfstype=ext4 rw rootwait console=ttyS0,115200 net.ifnames=0"
 
-echo "Boot args: ${bootargs}"
+echo "Args: ${bootargs}"
 echo "============================================"
 echo "Booting SecuBox..."
 echo "============================================"
 
-booti ${kernel_addr_r} - ${fdt_addr_r}
+booti ${kernel_addr_r} ${ramdisk_arg} ${fdt_addr_r}
diff --git a/board/mochabin/boot.scr b/board/mochabin/boot.scr
index 826b3168..14964ea6 100644
Binary files a/board/mochabin/boot.scr and b/board/mochabin/boot.scr differ
diff --git a/board/mochabin/extlinux/extlinux.conf b/board/mochabin/extlinux/extlinux.conf
new file mode 100644
index 00000000..17660f3b
--- /dev/null
+++ b/board/mochabin/extlinux/extlinux.conf
@@ -0,0 +1,39 @@
+# SecuBox MOCHAbin — Distroboot Configuration
+# Marvell Armada 7040 (Cortex-A72 quad-core)
+# U-Boot/Tow-Boot will auto-detect this file
+
+# SecuBox MOCHAbin — Distroboot Menu
+# Press Tab or number key to select entry
+# TIMEOUT in 1/10 seconds (50 = 5 sec)
+
+DEFAULT secubox-led
+TIMEOUT 50
+PROMPT 1
+MENU TITLE SecuBox MOCHAbin Boot Menu
+
+LABEL secubox
+    MENU LABEL 1. SecuBox Standard (Debian kernel)
+    KERNEL /Image
+    INITRD /initrd.img
+    FDT /dtbs/marvell/armada-7040-mochabin.dtb
+    APPEND root=/dev/mmcblk0p2 rootfstype=ext4 rw rootwait console=ttyS0,115200 net.ifnames=0
+
+LABEL secubox-612
+    MENU LABEL 2. SecuBox 6.12.85 (Debian packaged)
+    KERNEL /vmlinuz-6.12.85+deb12-arm64
+    INITRD /initrd.img-6.12.85+deb12-arm64
+    FDT /dtbs/marvell/armada-7040-mochabin.dtb
+    APPEND root=/dev/mmcblk0p2 rootfstype=ext4 rw rootwait console=ttyS0,115200 net.ifnames=0
+
+LABEL secubox-led
+    MENU LABEL 3. SecuBox LED (IS31FL319X driver)
+    KERNEL /Image-secubox-led
+    INITRD /initrd.img-6.12.85+deb12-arm64
+    FDT /dtbs/marvell/armada-7040-mochabin.dtb
+    APPEND root=/dev/mmcblk0p2 rootfstype=ext4 rw rootwait console=ttyS0,115200 net.ifnames=0
+
+LABEL rescue
+    MENU LABEL 4. Rescue Shell (no init)
+    KERNEL /Image
+    FDT /dtbs/marvell/armada-7040-mochabin.dtb
+    APPEND root=/dev/mmcblk0p2 rootfstype=ext4 rw rootwait console=ttyS0,115200 init=/bin/bash
diff --git a/packages/secubox-eye-remote/udev/90-secubox-eye-remote.rules b/packages/secubox-eye-remote/udev/90-secubox-eye-remote.rules
index 332e78a8..2c22d2e6 100644
--- a/packages/secubox-eye-remote/udev/90-secubox-eye-remote.rules
+++ b/packages/secubox-eye-remote/udev/90-secubox-eye-remote.rules
@@ -1,34 +1,46 @@
 # ==============================================================================
-# SecuBox Eye Remote - udev rules for USB OTG gadget
-# Auto-configure network interface when Pi Zero is connected
-#
-# Install: sudo cp 90-secubox-eye-remote.rules /etc/udev/rules.d/
-#          sudo udevadm control --reload-rules
-#
+# SecuBox Eye Remote - USB OTG Gadget Detection
+# Detects Pi Zero W composite gadget (RNDIS + CDC-ECM + ACM + Mass Storage)
 # CyberMind - https://cybermind.fr
 # ==============================================================================
 
-# Pi Zero USB Gadget - CDC Ethernet (ECM)
-# Vendor: 1d6b (Linux Foundation)
-# Product: 0104 (Multifunction Composite Gadget)
+# Pi Zero W Composite Gadget: Linux Foundation Multifunction (1d6b:0104)
+# Creates both RNDIS (usb0) and CDC-ECM (usb1) interfaces
+# We only want IP on RNDIS (usb0), disable CDC-ECM (usb1) to prevent conflicts
 
-# When USB gadget interface appears, configure it and disable rp_filter
-# to prevent "martian source" packet drops
-ACTION=="add", SUBSYSTEM=="net", KERNEL=="usb*", DRIVERS=="rndis_host|cdc_ether", \
-    RUN+="/bin/sh -c 'sysctl -w net.ipv4.conf.%k.rp_filter=0; /usr/local/sbin/secubox-eye-network.sh up'"
+# RNDIS interface (usb0) - Primary network connection
+# Configure IP and bring up
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# When USB composite gadget binds (handles re-plug scenarios)
-ACTION=="bind", SUBSYSTEM=="usb", ATTR{idVendor}=="1d6b", ATTR{idProduct}=="0104", \
-    RUN+="/bin/sh -c 'sleep 2 && /usr/local/sbin/secubox-eye-network.sh up &'"
+# CDC-ECM interface (usb1) - Disable to prevent duplicate IP route
+# Pi Zero creates both RNDIS and ECM; we only use RNDIS
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="cdc_ether", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k down"
 
-# Alternative: match by MAC prefix (02:fb:00:00 - Pi Zero gadget)
-ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="02:fb:*", \
-    RUN+="/bin/sh -c 'sysctl -w net.ipv4.conf.%k.rp_filter=0 2>/dev/null; /usr/local/sbin/secubox-eye-network.sh up'"
+# Legacy: Pi Zero W CDC-ECM only gadget (NetChip signature)
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a2", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# Handle interface state changes (for re-plug detection)
-ACTION=="change", SUBSYSTEM=="net", ATTR{address}=="02:fb:*", \
-    RUN+="/usr/local/sbin/secubox-eye-network.sh up"
+# Legacy: Alternative Raspberry Pi USB gadget signature
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a1", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# Cleanup on removal
-ACTION=="remove", SUBSYSTEM=="net", ENV{ID_VENDOR_ID}=="1d6b", ENV{ID_MODEL_ID}=="0104", \
-    RUN+="/usr/local/sbin/secubox-eye-network.sh down"
+# Serial console symlink (ACM interface)
+ACTION=="add", SUBSYSTEM=="tty", ATTRS{idVendor}=="1d6b", ATTRS{idProduct}=="0104", \
+    SYMLINK+="eye-remote-console", MODE="0666"
+
+# Disconnect handler
+ACTION=="remove", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
+
+ACTION=="remove", SUBSYSTEM=="net", ENV{INTERFACE}=="eye-remote", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
diff --git a/packages/secubox-led-heartbeat/debian/compat b/packages/secubox-led-heartbeat/debian/compat
deleted file mode 100644
index b1bd38b6..00000000
--- a/packages/secubox-led-heartbeat/debian/compat
+++ /dev/null
@@ -1 +0,0 @@
-13
diff --git a/packages/secubox-system/etc/udev/rules.d/90-secubox-eye-remote.rules b/packages/secubox-system/etc/udev/rules.d/90-secubox-eye-remote.rules
index 075c7124..2c22d2e6 100644
--- a/packages/secubox-system/etc/udev/rules.d/90-secubox-eye-remote.rules
+++ b/packages/secubox-system/etc/udev/rules.d/90-secubox-eye-remote.rules
@@ -1,24 +1,46 @@
-# SecuBox Eye Remote OTG Detection
-# Detects Pi Zero W connected via USB OTG (CDC-ECM gadget)
+# ==============================================================================
+# SecuBox Eye Remote - USB OTG Gadget Detection
+# Detects Pi Zero W composite gadget (RNDIS + CDC-ECM + ACM + Mass Storage)
 # CyberMind - https://cybermind.fr
+# ==============================================================================
 
-# Pi Zero W CDC-ECM gadget appears as USB Ethernet
-# idVendor=0525 (NetChip) idProduct=a4a2 (Linux-USB Ethernet/RNDIS Gadget)
+# Pi Zero W Composite Gadget: Linux Foundation Multifunction (1d6b:0104)
+# Creates both RNDIS (usb0) and CDC-ECM (usb1) interfaces
+# We only want IP on RNDIS (usb0), disable CDC-ECM (usb1) to prevent conflicts
+
+# RNDIS interface (usb0) - Primary network connection
+# Configure IP and bring up
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
+
+# CDC-ECM interface (usb1) - Disable to prevent duplicate IP route
+# Pi Zero creates both RNDIS and ECM; we only use RNDIS
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="cdc_ether", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k down"
+
+# Legacy: Pi Zero W CDC-ECM only gadget (NetChip signature)
 ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a2", \
     NAME="eye-remote", \
-    RUN+="/usr/lib/secubox/eye-remote-connected.sh"
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# Alternative: Raspberry Pi USB gadget signature
+# Legacy: Alternative Raspberry Pi USB gadget signature
 ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a1", \
     NAME="eye-remote", \
-    RUN+="/usr/lib/secubox/eye-remote-connected.sh"
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# Generic CDC-ECM gadget fallback (check manufacturer string)
-ACTION=="add", SUBSYSTEM=="net", DRIVERS=="cdc_ether", \
-    ATTR{device/manufacturer}=="*SecuBox*", \
-    NAME="eye-remote", \
-    RUN+="/usr/lib/secubox/eye-remote-connected.sh"
+# Serial console symlink (ACM interface)
+ACTION=="add", SUBSYSTEM=="tty", ATTRS{idVendor}=="1d6b", ATTRS{idProduct}=="0104", \
+    SYMLINK+="eye-remote-console", MODE="0666"
 
 # Disconnect handler
+ACTION=="remove", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
+
 ACTION=="remove", SUBSYSTEM=="net", ENV{INTERFACE}=="eye-remote", \
     RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
diff --git a/remote-ui/round/90-secubox-otg.rules b/remote-ui/round/90-secubox-otg.rules
index 00dd2fe3..2c22d2e6 100644
--- a/remote-ui/round/90-secubox-otg.rules
+++ b/remote-ui/round/90-secubox-otg.rules
@@ -1,72 +1,46 @@
-# ═══════════════════════════════════════════════════════════════════════════════
-# SecuBox Remote UI — 90-secubox-otg.rules
-# Règles udev pour la détection du RPi Zero W connecté en OTG
-#
-# Installe dans : /etc/udev/rules.d/90-secubox-otg.rules
-#
-# CyberMind — https://cybermind.fr
-# Author: Gérald Kerma <gandalf@gk2.net>
-# License: Proprietary / ANSSI CSPN candidate
-# ═══════════════════════════════════════════════════════════════════════════════
+# ==============================================================================
+# SecuBox Eye Remote - USB OTG Gadget Detection
+# Detects Pi Zero W composite gadget (RNDIS + CDC-ECM + ACM + Mass Storage)
+# CyberMind - https://cybermind.fr
+# ==============================================================================
 
-# ──────────────────────────────────────────────────────────────────────────────
-# Interface réseau CDC-ECM (Ethernet over USB)
-# ──────────────────────────────────────────────────────────────────────────────
+# Pi Zero W Composite Gadget: Linux Foundation Multifunction (1d6b:0104)
+# Creates both RNDIS (usb0) and CDC-ECM (usb1) interfaces
+# We only want IP on RNDIS (usb0), disable CDC-ECM (usb1) to prevent conflicts
 
-# Reconnaître le gadget SecuBox par ses IDs USB
-# idVendor=1d6b (Linux Foundation), idProduct=0104 (Multifunction Composite)
-# L'interface réseau est renommée "secubox-round" pour identification facile
+# RNDIS interface (usb0) - Primary network connection
+# Configure IP and bring up
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-SUBSYSTEM=="net", \
-    ATTR{address}=="02:sb:*", \
-    DRIVERS=="cdc_ether", \
-    NAME="secubox-round", \
-    TAG+="systemd", \
-    ENV{SYSTEMD_WANTS}="secubox-otg-host@%k.service", \
-    RUN+="/usr/local/sbin/secubox-otg-host-up.sh up"
+# CDC-ECM interface (usb1) - Disable to prevent duplicate IP route
+# Pi Zero creates both RNDIS and ECM; we only use RNDIS
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="cdc_ether", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k down"
 
-# Alternative: détection par attributs USB parents
-SUBSYSTEM=="net", \
-    ATTRS{idVendor}=="1d6b", \
-    ATTRS{idProduct}=="0104", \
-    DRIVERS=="cdc_ether", \
-    NAME="secubox-round", \
-    TAG+="systemd", \
-    RUN+="/usr/local/sbin/secubox-otg-host-up.sh up"
+# Legacy: Pi Zero W CDC-ECM only gadget (NetChip signature)
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a2", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# Événement de déconnexion
-SUBSYSTEM=="net", \
-    ACTION=="remove", \
-    ENV{ID_NET_NAME}=="secubox-round", \
-    RUN+="/usr/local/sbin/secubox-otg-host-up.sh down"
+# Legacy: Alternative Raspberry Pi USB gadget signature
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a1", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# ──────────────────────────────────────────────────────────────────────────────
-# Console série CDC-ACM (ttyACM)
-# ──────────────────────────────────────────────────────────────────────────────
+# Serial console symlink (ACM interface)
+ACTION=="add", SUBSYSTEM=="tty", ATTRS{idVendor}=="1d6b", ATTRS{idProduct}=="0104", \
+    SYMLINK+="eye-remote-console", MODE="0666"
 
-# Créer un lien symbolique /dev/secubox-console vers le bon ttyACM
-SUBSYSTEM=="tty", \
-    ATTRS{idVendor}=="1d6b", \
-    ATTRS{idProduct}=="0104", \
-    KERNEL=="ttyACM*", \
-    SYMLINK+="secubox-console", \
-    MODE="0660", \
-    GROUP="dialout", \
-    TAG+="systemd"
+# Disconnect handler
+ACTION=="remove", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
 
-# ──────────────────────────────────────────────────────────────────────────────
-# Tags pour intégration systemd
-# ──────────────────────────────────────────────────────────────────────────────
-
-# Permettre à systemd de créer des unités .device
-SUBSYSTEM=="net", \
-    ENV{ID_NET_NAME}=="secubox-round", \
-    TAG+="systemd", \
-    ENV{SYSTEMD_ALIAS}="/sys/subsystem/net/devices/secubox-round"
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Debug (décommenter pour journaliser les événements)
-# ──────────────────────────────────────────────────────────────────────────────
-
-# SUBSYSTEM=="net", ATTRS{idVendor}=="1d6b", RUN+="/bin/sh -c 'echo SecuBox OTG: %k >> /tmp/secubox-udev.log'"
-# SUBSYSTEM=="tty", ATTRS{idVendor}=="1d6b", RUN+="/bin/sh -c 'echo SecuBox ACM: %k >> /tmp/secubox-udev.log'"
+ACTION=="remove", SUBSYSTEM=="net", ENV{INTERFACE}=="eye-remote", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
diff --git a/remote-ui/round/host-config/90-secubox-eye-remote.rules b/remote-ui/round/host-config/90-secubox-eye-remote.rules
index a98310ea..2c22d2e6 100644
--- a/remote-ui/round/host-config/90-secubox-eye-remote.rules
+++ b/remote-ui/round/host-config/90-secubox-eye-remote.rules
@@ -1,24 +1,46 @@
 # ==============================================================================
-# SecuBox Eye Remote - udev rules for USB OTG gadget
-# Auto-configure network interface when Pi Zero is connected
-#
-# Install: sudo cp 90-secubox-eye-remote.rules /etc/udev/rules.d/
-#          sudo udevadm control --reload-rules
-#
+# SecuBox Eye Remote - USB OTG Gadget Detection
+# Detects Pi Zero W composite gadget (RNDIS + CDC-ECM + ACM + Mass Storage)
 # CyberMind - https://cybermind.fr
 # ==============================================================================
 
-# Pi Zero USB Gadget - CDC Ethernet (ECM)
-# Vendor: 1d6b (Linux Foundation)
-# Product: 0104 (Multifunction Composite Gadget)
-ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="1d6b", ATTRS{idProduct}=="0104", \
-    NAME="secubox-eye", \
-    RUN+="/usr/local/sbin/secubox-eye-network.sh up"
+# Pi Zero W Composite Gadget: Linux Foundation Multifunction (1d6b:0104)
+# Creates both RNDIS (usb0) and CDC-ECM (usb1) interfaces
+# We only want IP on RNDIS (usb0), disable CDC-ECM (usb1) to prevent conflicts
 
-ACTION=="remove", SUBSYSTEM=="net", ENV{ID_VENDOR_ID}=="1d6b", ENV{ID_MODEL_ID}=="0104", \
-    RUN+="/usr/local/sbin/secubox-eye-network.sh down"
+# RNDIS interface (usb0) - Primary network connection
+# Configure IP and bring up
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
 
-# Alternative: match by MAC prefix (02:fb:00:00 - Pi Zero gadget)
-ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="02:fb:*", \
-    NAME="secubox-eye", \
-    RUN+="/usr/local/sbin/secubox-eye-network.sh up"
+# CDC-ECM interface (usb1) - Disable to prevent duplicate IP route
+# Pi Zero creates both RNDIS and ECM; we only use RNDIS
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="cdc_ether", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k down"
+
+# Legacy: Pi Zero W CDC-ECM only gadget (NetChip signature)
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a2", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
+
+# Legacy: Alternative Raspberry Pi USB gadget signature
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a1", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
+
+# Serial console symlink (ACM interface)
+ACTION=="add", SUBSYSTEM=="tty", ATTRS{idVendor}=="1d6b", ATTRS{idProduct}=="0104", \
+    SYMLINK+="eye-remote-console", MODE="0666"
+
+# Disconnect handler
+ACTION=="remove", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
+
+ACTION=="remove", SUBSYSTEM=="net", ENV{INTERFACE}=="eye-remote", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
diff --git a/remote-ui/round/host-install/etc/udev/rules.d/90-secubox-otg.rules b/remote-ui/round/host-install/etc/udev/rules.d/90-secubox-otg.rules
index a617f480..2c22d2e6 100644
--- a/remote-ui/round/host-install/etc/udev/rules.d/90-secubox-otg.rules
+++ b/remote-ui/round/host-install/etc/udev/rules.d/90-secubox-otg.rules
@@ -1,6 +1,46 @@
-# SecuBox Eye Remote - USB OTG network auto-configuration
-# Detects Pi Zero gadget and configures host IP
+# ==============================================================================
+# SecuBox Eye Remote - USB OTG Gadget Detection
+# Detects Pi Zero W composite gadget (RNDIS + CDC-ECM + ACM + Mass Storage)
+# CyberMind - https://cybermind.fr
+# ==============================================================================
 
-# Match CDC-ECM gadget by MAC address prefix 02:00:00:00:00:01
-ACTION=="add", SUBSYSTEM=="net", ATTR{address}=="02:00:00:00:00:01", \
-    RUN+="/usr/local/bin/secubox-otg-host-up.sh %k"
+# Pi Zero W Composite Gadget: Linux Foundation Multifunction (1d6b:0104)
+# Creates both RNDIS (usb0) and CDC-ECM (usb1) interfaces
+# We only want IP on RNDIS (usb0), disable CDC-ECM (usb1) to prevent conflicts
+
+# RNDIS interface (usb0) - Primary network connection
+# Configure IP and bring up
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
+
+# CDC-ECM interface (usb1) - Disable to prevent duplicate IP route
+# Pi Zero creates both RNDIS and ECM; we only use RNDIS
+ACTION=="add", SUBSYSTEM=="net", DRIVERS=="cdc_ether", ATTR{address}=="02:fb:*", \
+    RUN+="/sbin/ip link set %k down"
+
+# Legacy: Pi Zero W CDC-ECM only gadget (NetChip signature)
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a2", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
+
+# Legacy: Alternative Raspberry Pi USB gadget signature
+ACTION=="add", SUBSYSTEM=="net", ATTRS{idVendor}=="0525", ATTRS{idProduct}=="a4a1", \
+    NAME="eye-remote", \
+    RUN+="/sbin/ip link set %k up", \
+    RUN+="/sbin/ip addr add 10.55.0.1/24 dev %k 2>/dev/null || true", \
+    RUN+="/usr/lib/secubox/eye-remote-connected.sh %k"
+
+# Serial console symlink (ACM interface)
+ACTION=="add", SUBSYSTEM=="tty", ATTRS{idVendor}=="1d6b", ATTRS{idProduct}=="0104", \
+    SYMLINK+="eye-remote-console", MODE="0666"
+
+# Disconnect handler
+ACTION=="remove", SUBSYSTEM=="net", DRIVERS=="rndis_host", ATTR{address}=="02:fb:*", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"
+
+ACTION=="remove", SUBSYSTEM=="net", ENV{INTERFACE}=="eye-remote", \
+    RUN+="/usr/lib/secubox/eye-remote-disconnected.sh"