diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a89a886..edf36c8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -247,7 +247,18 @@ jobs:
           path: dist
           merge-multiple: true
 
+      - name: Stamp manifest version
+        # pdn-app.yaml's `version:` field is informational (pdn shows it
+        # in its UI) and should track the release tag. Stamp it into the
+        # copy we attach so the asset always matches the release it
+        # ships with; the repo copy stays as-is.
+        run: |
+          sed -i 's/^version: .*/version: "${{ needs.test.outputs.version }}"/' pdn-app.yaml
+          grep '^version:' pdn-app.yaml
+
       - name: Create GitHub Release
+        # pdn-app.yaml rides along as a release asset so the pdn build
+        # can fetch manifest + binary from the same release.
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
@@ -256,4 +267,5 @@ jobs:
             --title "$tag" \
             --target "${{ github.sha }}" \
             --generate-notes \
-            dist/*
+            dist/* \
+            pdn-app.yaml
diff --git a/docs/configure.md b/docs/configure.md
index 24360e4..1f8822a 100644
--- a/docs/configure.md
+++ b/docs/configure.md
@@ -8,6 +8,8 @@ Every operator-tunable setting on a DAPPS node has three configuration surfaces:
 
 For runtime-changeable knobs (probing on/off, fragment threshold, airtime budget, etc.), the dashboard is the right surface - changes pick up without a restart. For startup-only knobs (callsign, packet-node host/port, MQTT port, dashboard URL), the env var is the right surface - they're read once at boot.
 
+> **Deployment-managed mode (`DAPPS_ENV_MANAGED=true`)**: when a supervising deployment (a packet.net node host, say) sets `DAPPS_ENV_MANAGED=true`, every *set* `DAPPS_*` env var becomes deployment-managed config instead - re-applied over the persisted row at **every** start, with the matching dashboard fields badged "managed by environment" and rendered read-only. `DAPPS_ENV_MANAGED` itself is a mode switch read each start, never stored. Leave it unset for the standalone installs documented here: with it unset (or `false`) env vars keep the first-start-only semantics above and the dashboard stays in charge.
+
 ## Show the current persisted config
 
 ```bash
diff --git a/pdn-app.yaml b/pdn-app.yaml
index 8a35fb8..eeab9b9 100644
--- a/pdn-app.yaml
+++ b/pdn-app.yaml
@@ -6,13 +6,13 @@
 # deb from this repo's published release binary) or /var/lib/packetnet/apps/dapps
 # (owner-installed), and the app stays OFF until the node owner enables it.
 #
-# A future dapps release workflow should attach this file as a release asset
-# (next to the dapps-linux-* binaries) so pdn's build can fetch manifest +
-# binary together from one release instead of carrying an interim copy.
+# The release workflow attaches this file as a release asset (next to the
+# dapps-linux-* binaries, with `version:` stamped to the release tag) so pdn's
+# build can fetch manifest + binary together from one release.
 manifest: 1
 id: dapps                     # must equal the package directory name
 name: DAPPS
-version: "0.33.12"            # informational, shown in pdn's UI — should track the release tag
+version: "0.34.0"            # informational, shown in pdn's UI — should track the release tag
 description: Distributed Asynchronous Packet Pub/Sub — store-and-forward messaging over packet radio.
 icon: inbox
 capabilities: [network, web]  # binds its own callsigns over RHPv2; serves its own web UI
@@ -21,26 +21,41 @@ capabilities: [network, web]  # binds its own callsigns over RHPv2; serves its o
 # DAPPS is not a console verb; it speaks RHPv2 to the node and binds its own
 # callsigns.
 #
-# FIRST-START SEEDING — read before enabling: DAPPS seeds its config from
-# DAPPS_* env vars ONLY on first start (a fresh data/dapps.db in the working
-# directory). Once the db exists, env vars stop mattering — later changes go
-# through the DAPPS dashboard's /Setup // /Config pages, or by deleting the db
-# to re-seed. In particular the owner MUST supply their callsign via pdn's
-# `apps:` override environment BEFORE the first start (there is no sensible
-# default — DAPPS boots in setup-required mode with the N0CALL placeholder and
-# refuses to bind bearers until a real callsign is configured):
+# CONFIG SEEDING — how DAPPS_* env vars behave: DAPPS has two modes, switched
+# by DAPPS_ENV_MANAGED (read each start, never stored):
+#
+#   - unset/false (the standalone default): env vars seed missing options on
+#     first start only; thereafter the dashboard owns every value.
+#   - "true" (set below — pdn-supervised deployments opt in): every set
+#     DAPPS_* env var is deployment-managed config — re-applied over whatever
+#     the dashboard stored at EVERY start, and badged read-only in the
+#     dashboard. Unset variables never touch stored config: anything not
+#     pinned below stays editable live through the DAPPS dashboard's
+#     /Setup // /Config pages, exactly as standalone.
+#
+# CALLSIGN — no pre-set needed: pdn injects PDN_NODE_CALLSIGN, and while no
+# real callsign is configured DAPPS derives its own identity as
+# <node-base-callsign>-<DAPPS_SSID> (DAPPS_SSID defaults to 7, so node M0XYZ
+# gets DAPPS at M0XYZ-7). If that SSID is already claimed on the node (pdn
+# refuses the listen with errCode 9 "Duplicate socket"), DAPPS probes the
+# next free SSID over RHPv2 (skipping 0 and the node's own SSID) and keeps
+# the first one that binds — the confirmed identity is then stable across
+# restarts. The owner can still pin a different identity via pdn's `apps:`
+# override environment — an explicit DAPPS_CALLSIGN (or a real callsign saved
+# via the dashboard) always wins over derivation and never probes:
 #
 #   apps:
 #     - id: dapps
 #       enabled: true
 #       environment:
-#         DAPPS_CALLSIGN: M0XYZ-7
+#         DAPPS_CALLSIGN: M0XYZ-9   # optional — omit to accept <nodecall>-7
 #
 # The working directory defaults to the app's state dir, so the database lands
 # in /var/lib/packetnet/apps/dapps (DAPPS resolves it cwd-relative).
 service:
   command: ./dapps            # relative — resolves to the release binary in this package dir
   environment:
+    DAPPS_ENV_MANAGED: "true"             # opt in: env vars below are re-applied at every start
     DAPPS_NODE_BEARER: rhpv2              # speak RHPv2 to pdn (not AGW)
     DAPPS_NODE_HOST: "127.0.0.1"
     DAPPS_RHP_PORT: "9000"                # pdn's RHP server loopback port
diff --git a/src/dapps/Directory.Build.props b/src/dapps/Directory.Build.props
index 2990554..f2c20e6 100644
--- a/src/dapps/Directory.Build.props
+++ b/src/dapps/Directory.Build.props
@@ -8,7 +8,7 @@
       Release already exists for v$(Version). Bump this in the same
       PR as the change you want released.
     -->
-    <Version>0.33.12</Version>
+    <Version>0.34.0</Version>
 
     <!--
       sqlite-net-pcl 1.9.x ships a SQLitePCLRaw.lib.e_sqlite3 that lists
diff --git a/src/dapps/dapps.core.tests/DbStartupTests.cs b/src/dapps/dapps.core.tests/DbStartupTests.cs
index beaafc9..89232d9 100644
--- a/src/dapps/dapps.core.tests/DbStartupTests.cs
+++ b/src/dapps/dapps.core.tests/DbStartupTests.cs
@@ -7,10 +7,14 @@
 namespace dapps.core.tests;
 
 /// <summary>
-/// DbStartup.EnsureSchemaAndSeed is the system's first-run config seam:
-/// it creates schema, seeds defaults from env vars (Plan C2), and
-/// refuses to start on a placeholder callsign. These tests drive each
-/// path against a fresh SQLite file.
+/// DbStartup.EnsureSchemaAndSeed is the system's startup config seam:
+/// it creates schema, seeds defaults from env vars (Plan C2),
+/// re-applies set env vars at every start ONLY under the opt-in
+/// DAPPS_ENV_MANAGED=true mode (deployment-managed config - the pdn
+/// supervised-app case), derives a callsign from a pdn host's
+/// PDN_NODE_CALLSIGN, and warns on a placeholder callsign. These tests
+/// drive each path against a fresh SQLite file - both env-var modes
+/// have their contract pinned here.
 /// </summary>
 [Collection(SqliteOverridePathCollection.Name)]
 public sealed class DbStartupTests : IAsyncLifetime
@@ -25,6 +29,9 @@ public sealed class DbStartupTests : IAsyncLifetime
         "DAPPS_DEFAULT_BEARER_PORT",
         "DAPPS_CALLSIGN",
         "DAPPS_MQTT_PORT",
+        "DAPPS_SSID",
+        "DAPPS_ENV_MANAGED",
+        "PDN_NODE_CALLSIGN",
     ];
 
     public ValueTask InitializeAsync()
@@ -105,6 +112,12 @@ public void EnsureSchemaAndSeed_AllEnvVars_SeedsEachOption()
     [Fact]
     public void EnsureSchemaAndSeed_ExistingRow_NotOverwrittenByEnv()
     {
+        // THE standalone contract: without the DAPPS_ENV_MANAGED=true
+        // opt-in, a set env var seeds first-start values only. The
+        // shipped standalone flow (scripts/dapps.service +
+        // EnvironmentFile=/etc/dapps.env) keeps DAPPS_* set permanently,
+        // so re-applying here would revert every dashboard edit on
+        // every restart for every documented standalone install.
         // Pre-seed a manually-configured callsign as if /Config POST had set it.
         using (var c = DbInfo.GetConnection())
         {
@@ -120,6 +133,317 @@ public void EnsureSchemaAndSeed_ExistingRow_NotOverwrittenByEnv()
             "existing rows MUST NOT be overwritten by env vars on subsequent starts");
     }
 
+    [Fact]
+    public void EnsureSchemaAndSeed_EnvManagedFalse_SameAsUnset()
+    {
+        // An explicit =false is the standalone default, not a third mode.
+        using (var c = DbInfo.GetConnection())
+        {
+            c.CreateTable<DbSystemOption>();
+            c.Insert(new DbSystemOption { Option = "Callsign", Value = "M0LTE-3" });
+        }
+        Environment.SetEnvironmentVariable("DAPPS_ENV_MANAGED", "false");
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", "DIFFERENT-CALL");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M0LTE-3");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_EnvManagedMode_ExistingRow_AppliedAtEveryStart()
+    {
+        // Deployment-managed config (opt-in via DAPPS_ENV_MANAGED=true -
+        // pdn-app.yaml sets it for supervised installs): a SET env var
+        // wins over the stored row at every start, not just the first -
+        // the host's app config is authoritative.
+        using (var c = DbInfo.GetConnection())
+        {
+            c.CreateTable<DbSystemOption>();
+            c.Insert(new DbSystemOption { Option = "Callsign", Value = "M0LTE-3" });
+        }
+        Environment.SetEnvironmentVariable("DAPPS_ENV_MANAGED", "true");
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", "G0TST-7");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("G0TST-7",
+            "under DAPPS_ENV_MANAGED=true a set env var is deployment-managed and re-applied over the stored row at every start");
+    }
+
+    [Fact]
+    public void IsEnvManaged_RequiresTheOptInMode()
+    {
+        // The dashboard's "managed by environment" badges key off
+        // IsEnvManaged / EnvManagedKeys; without the opt-in they must
+        // stay dark even when DAPPS_* vars are set (standalone installs
+        // routinely keep /etc/dapps.env applied).
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", "G0TST-7");
+
+        DbStartup.IsEnvManaged("Callsign").Should().BeFalse("no DAPPS_ENV_MANAGED opt-in");
+        DbStartup.EnvManagedKeys().Should().BeEmpty();
+
+        Environment.SetEnvironmentVariable("DAPPS_ENV_MANAGED", "true");
+
+        DbStartup.IsEnvManaged("Callsign").Should().BeTrue();
+        DbStartup.EnvManagedKeys().Should().Contain("Callsign");
+        DbStartup.IsEnvManaged("NodeHost").Should().BeFalse("DAPPS_NODE_HOST is not set");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_ExistingRow_NoEnv_LeftAlone()
+    {
+        // The standalone flow: no DAPPS_* env set, so the stored
+        // (dashboard-configured) value must survive every restart
+        // byte-for-byte.
+        using (var c = DbInfo.GetConnection())
+        {
+            c.CreateTable<DbSystemOption>();
+            c.Insert(new DbSystemOption { Option = "Callsign", Value = "M0LTE-3" });
+        }
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M0LTE-3",
+            "unset env vars must never touch stored config");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_SeedOnceViaEnvThenUnset_DashboardEditSticks()
+    {
+        // A standalone operator who seeds once via env then unsets it
+        // keeps dashboard control exactly as before this change.
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", "G0TST");
+        DbStartup.EnsureSchemaAndSeed();
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", null);
+
+        // Restart without the env var: seeded value sticks.
+        DbStartup.EnsureSchemaAndSeed();
+        using (var c = DbInfo.GetConnection())
+        {
+            c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("G0TST");
+            // Dashboard edit (as /Config POST would persist it).
+            c.Execute("update systemoptions set value=? where option=?", "M0LTE-3", "Callsign");
+        }
+
+        // Next restart: the edit survives.
+        DbStartup.EnsureSchemaAndSeed();
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M0LTE-3");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_PdnNodeCallsign_DerivesCallsignWithDefaultSsid()
+    {
+        // pdn-hosted fresh install: no DAPPS_CALLSIGN, host injects
+        // PDN_NODE_CALLSIGN -> DAPPS takes up residence at SSID -7 of
+        // the node callsign.
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-7");
+        c.Find<DbSystemOption>("Ssid")!.Value.Should().Be("7", "the SSID knob is seeded alongside");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_PdnNodeCallsignWithSsid_StripsItBeforeComposing()
+    {
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "m9yyy-2");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-7",
+            "the node's own SSID is stripped (and the base upper-cased) before composing");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_DappsSsidEnv_OverridesDerivationSsid()
+    {
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        Environment.SetEnvironmentVariable("DAPPS_SSID", "4");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-4");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_ExplicitDappsCallsign_WinsOverDerivation()
+    {
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", "G0TST-1");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("G0TST-1",
+            "an explicit DAPPS_CALLSIGN always wins over derivation");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_RealStoredCallsign_WinsOverDerivation()
+    {
+        using (var c = DbInfo.GetConnection())
+        {
+            c.CreateTable<DbSystemOption>();
+            c.Insert(new DbSystemOption { Option = "Callsign", Value = "M0LTE-3" });
+        }
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M0LTE-3",
+            "a real stored callsign always wins over derivation");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_StoredPlaceholder_PdnNodeCallsign_Derives()
+    {
+        // A pdn host whose DAPPS db predates a callsign config (or was
+        // reset to the placeholder) picks up the derived identity on
+        // the next start.
+        using (var c = DbInfo.GetConnection())
+        {
+            c.CreateTable<DbSystemOption>();
+            c.Insert(new DbSystemOption { Option = "Callsign", Value = "N0CALL" });
+        }
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-7");
+    }
+
+    [Fact]
+    public void EnsureSchemaAndSeed_NoPdnEnv_PlaceholderUnchanged()
+    {
+        // Standalone install: no PDN_NODE_CALLSIGN, no DAPPS_CALLSIGN -
+        // the placeholder stays and the daemon boots into the existing
+        // setup-required flow (configure via /Setup // /Config).
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("N0CALL");
+        c.Find<DbSystemOption>(DbStartup.DerivedCallsignPendingKey).Should().BeNull(
+            "nothing was derived, so nothing is pending confirmation");
+    }
+
+    [Fact]
+    public void Derivation_MarksCallsignAsPendingConfirmation()
+    {
+        // The derived identity is provisional until the RHPv2 listener
+        // confirms the SSID is free on the node (errCode 9 probe-walk).
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>(DbStartup.DerivedCallsignPendingKey)!.Value.Should().Be("M9YYY-7");
+        DbStartup.ReadPendingDerivedCallsign().Should().Be("M9YYY-7");
+    }
+
+    [Fact]
+    public void PendingMarker_SurvivesRestart_WhileUnconfirmed()
+    {
+        // Daemon restarted before the listener ever confirmed (node was
+        // down, say): the stored callsign is real now, so derivation
+        // skips, but the pending marker must survive so the probe-walk
+        // can still run on this start.
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        DbStartup.EnsureSchemaAndSeed();
+
+        DbStartup.EnsureSchemaAndSeed(); // restart, still unconfirmed
+
+        DbStartup.ReadPendingDerivedCallsign().Should().Be("M9YYY-7");
+    }
+
+    [Fact]
+    public void PendingMarker_ClearedByDashboardConfiguredCallsign()
+    {
+        // Derive, then the operator pins an identity via the dashboard
+        // before the listener confirmed: the explicit identity must
+        // never probe-walk, so the next start drops the stale marker.
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        DbStartup.EnsureSchemaAndSeed();
+        using (var c = DbInfo.GetConnection())
+        {
+            c.Execute("update systemoptions set value=? where option=?", "G0TST-1", "Callsign");
+        }
+
+        DbStartup.EnsureSchemaAndSeed();
+
+        DbStartup.ReadPendingDerivedCallsign().Should().BeNull(
+            "a dashboard-configured callsign is explicit - it never walks");
+        using var conn = DbInfo.GetConnection();
+        conn.Find<DbSystemOption>("Callsign")!.Value.Should().Be("G0TST-1");
+    }
+
+    [Fact]
+    public void PendingMarker_ClearedByExplicitDappsCallsignEnv()
+    {
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        DbStartup.EnsureSchemaAndSeed();
+
+        Environment.SetEnvironmentVariable("DAPPS_CALLSIGN", "G0TST-1");
+        DbStartup.EnsureSchemaAndSeed();
+
+        DbStartup.ReadPendingDerivedCallsign().Should().BeNull(
+            "an explicit DAPPS_CALLSIGN pins the identity - it never walks");
+    }
+
+    [Fact]
+    public void ConfirmDerivedCallsign_PersistsWinnerAndClearsMarker()
+    {
+        // The probe-walk found -7 taken and -8 free: the winner becomes
+        // the stored identity and nothing is pending any more, so every
+        // later start binds M9YYY-8 directly (never walks again).
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        DbStartup.EnsureSchemaAndSeed();
+
+        DbStartup.ConfirmDerivedCallsign("M9YYY-8");
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-8");
+        DbStartup.ReadPendingDerivedCallsign().Should().BeNull();
+
+        // And a restart leaves the confirmed identity alone.
+        DbStartup.EnsureSchemaAndSeed();
+        using var c2 = DbInfo.GetConnection();
+        c2.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-8");
+        DbStartup.ReadPendingDerivedCallsign().Should().BeNull();
+    }
+
+    [Fact]
+    public void AbandonDerivedCallsign_RevertsToSetupRequired()
+    {
+        // Every candidate SSID taken on the node: back to the
+        // placeholder (setup-required mode) so the bearer idles instead
+        // of hammering the node; a restart re-derives and tries again.
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+        DbStartup.EnsureSchemaAndSeed();
+
+        DbStartup.AbandonDerivedCallsign();
+
+        using var c = DbInfo.GetConnection();
+        c.Find<DbSystemOption>("Callsign")!.Value.Should().Be("N0CALL");
+        DbStartup.ReadPendingDerivedCallsign().Should().BeNull();
+
+        // Restart: derivation fires again (placeholder + PDN env).
+        DbStartup.EnsureSchemaAndSeed();
+        using var c2 = DbInfo.GetConnection();
+        c2.Find<DbSystemOption>("Callsign")!.Value.Should().Be("M9YYY-7");
+        DbStartup.ReadPendingDerivedCallsign().Should().Be("M9YYY-7");
+    }
+
     [Fact]
     public void EnsureSchemaAndSeed_ExistingPlaceholderCallsign_StartsWithWarning()
     {
diff --git a/src/dapps/dapps.core.tests/Rhpv2InboundServiceTests.cs b/src/dapps/dapps.core.tests/Rhpv2InboundServiceTests.cs
index b381fd3..ed9179f 100644
--- a/src/dapps/dapps.core.tests/Rhpv2InboundServiceTests.cs
+++ b/src/dapps/dapps.core.tests/Rhpv2InboundServiceTests.cs
@@ -1,3 +1,4 @@
+using System.Collections.Concurrent;
 using AwesomeAssertions;
 using dapps.client.Backhaul;
 using dapps.core.Models;
@@ -16,9 +17,30 @@ namespace dapps.core.tests;
 /// callsign passed through verbatim. End-to-end delivery (ACCEPT →
 /// per-child stream → DAPPSv1 parsing) is covered by the
 /// scripts/sim-mixed-bearer.sh end-to-end run, not here.
+///
+/// In the collection because the service now consults the
+/// DerivedCallsignPending marker through the static
+/// <c>DbInfo.OverridePath</c> seam; isolate from classes that mutate it.
 /// </summary>
-public sealed class Rhpv2InboundServiceTests
+[Collection(SqliteOverridePathCollection.Name)]
+public sealed class Rhpv2InboundServiceTests : IAsyncLifetime
 {
+    private string dbPath = null!;
+
+    public ValueTask InitializeAsync()
+    {
+        dbPath = Path.Combine(Path.GetTempPath(), $"dapps-rhp-inbound-test-{Guid.NewGuid():N}.db");
+        DbInfo.OverridePath = dbPath;
+        return ValueTask.CompletedTask;
+    }
+
+    public ValueTask DisposeAsync()
+    {
+        DbInfo.OverridePath = null;
+        try { File.Delete(dbPath); } catch { /* ignore */ }
+        return ValueTask.CompletedTask;
+    }
+
     [Fact]
     public async Task Startup_BindsLocalCallsign_AndListensPassive()
     {
@@ -143,3 +165,327 @@ private static List<RhpMessage> WaitForFrames(MockRhpServer server, int count, T
             $"Did not observe {count} frames within {timeout}; saw [{string.Join(", ", server.ReceivedFrames.Select(f => f.GetType().Name))}]");
     }
 }
+
+/// <summary>
+/// The derived-callsign SSID probe-walk (Rhpv2InboundService.
+/// BindListenerAsync). pdn answers a listen on an already-claimed
+/// callsign with errCode 9 "Duplicate socket" deterministically
+/// (packet.net docs/rhp2-server.md deviation D5); while the
+/// DerivedCallsignPending marker matches the callsign in use, a 9
+/// walks the SSIDs for a free one and persists the winner. The mock
+/// server plays the pdn role via a Handler that refuses listens on a
+/// "taken" set, keyed off the handle→callsign map built from BINDs.
+///
+/// Uses the real <see cref="SystemOptionsStore"/> (not a fixed
+/// options monitor) so the persist→Reload→OnChange path the walk
+/// drives in production is the one under test. In the collection
+/// because both the store and the marker go through the static
+/// <c>DbInfo.OverridePath</c> seam.
+/// </summary>
+[Collection(SqliteOverridePathCollection.Name)]
+public sealed class Rhpv2SsidProbeWalkTests : IAsyncLifetime
+{
+    private string dbPath = null!;
+    private readonly Dictionary<string, string?> savedEnv = [];
+
+    private static readonly string[] EnvKeys =
+    [
+        "DAPPS_CALLSIGN",
+        "DAPPS_ENV_MANAGED",
+        "PDN_NODE_CALLSIGN",
+    ];
+
+    public ValueTask InitializeAsync()
+    {
+        dbPath = Path.Combine(Path.GetTempPath(), $"dapps-ssid-walk-test-{Guid.NewGuid():N}.db");
+        DbInfo.OverridePath = dbPath;
+        foreach (var k in EnvKeys)
+        {
+            savedEnv[k] = Environment.GetEnvironmentVariable(k);
+            Environment.SetEnvironmentVariable(k, null);
+        }
+        return ValueTask.CompletedTask;
+    }
+
+    public ValueTask DisposeAsync()
+    {
+        foreach (var (k, v) in savedEnv)
+        {
+            Environment.SetEnvironmentVariable(k, v);
+        }
+        DbInfo.OverridePath = null;
+        try { File.Delete(dbPath); } catch { /* ignore */ }
+        return ValueTask.CompletedTask;
+    }
+
+    [Fact]
+    public async Task WalkOn9_PicksNextFreeSsid_PersistsWinner_AndIsStableAcrossRestart()
+    {
+        // The node already has an M9YYY-7 (errCode 9 on listen); the
+        // derivation is still pending confirmation, so the service
+        // walks to -8, wins, and persists the winner as the identity.
+        await using var server = new MockRhpServer { Handler = RefuseListenOn("M9YYY-7") };
+        server.Start();
+        SeedDb(server.Endpoint.Port, callsign: "M9YYY-7", pendingMarker: "M9YYY-7");
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+
+        var store = new SystemOptionsStore(NullLogger<SystemOptionsStore>.Instance);
+        var service = NewService(store);
+        var ct = TestContext.Current.CancellationToken;
+        await service.StartAsync(ct);
+        try
+        {
+            WaitUntil(() => ReadOption("Callsign") == "M9YYY-8", TimeSpan.FromSeconds(5),
+                "the first free SSID must be persisted as the stored callsign");
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken.None);
+        }
+
+        ReadOption(DbStartup.DerivedCallsignPendingKey).Should().BeNull(
+            "a successful listen confirms the derived identity");
+        store.CurrentValue.Callsign.Should().Be("M9YYY-8",
+            "the walk reloads the store so every consumer sees the confirmed identity");
+        var binds = server.ReceivedFrames.OfType<BindMessage>().Select(b => b.Local).ToList();
+        binds.Take(2).Should().Equal("M9YYY-7", "M9YYY-8");
+
+        // Restart: the persisted winner is the identity - binds -8
+        // directly and never walks again, even though -7 is still taken.
+        await using var server2 = new MockRhpServer { Handler = RefuseListenOn("M9YYY-7") };
+        server2.Start();
+        using (var c = DbInfo.GetConnection())
+        {
+            c.Execute("update systemoptions set value=? where option=?", server2.Endpoint.Port.ToString(), "RhpPort");
+        }
+        var store2 = new SystemOptionsStore(NullLogger<SystemOptionsStore>.Instance);
+        var service2 = NewService(store2);
+        await service2.StartAsync(ct);
+        try
+        {
+            var frames = WaitForFrames(server2, count: 3, TimeSpan.FromSeconds(5));
+            frames[0].Should().BeOfType<SocketMessage>();
+            frames[1].Should().BeOfType<BindMessage>().Which.Local.Should().Be("M9YYY-8");
+            frames[2].Should().BeOfType<ListenMessage>();
+        }
+        finally
+        {
+            await service2.StopAsync(CancellationToken.None);
+        }
+        ReadOption("Callsign").Should().Be("M9YYY-8");
+    }
+
+    [Fact]
+    public async Task ExplicitCallsign_On9_LogsAndRetries_NeverWalks()
+    {
+        // No pending-derivation marker = the callsign is explicit
+        // (dashboard / DAPPS_CALLSIGN / already confirmed). A duplicate
+        // refusal must keep the existing retry/reconnect behaviour, not
+        // probe other SSIDs.
+        await using var server = new MockRhpServer { Handler = RefuseListenOn("G0DPB-1") };
+        server.Start();
+        SeedDb(server.Endpoint.Port, callsign: "G0DPB-1", pendingMarker: null);
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY"); // present but irrelevant: not a derivation
+
+        var store = new SystemOptionsStore(NullLogger<SystemOptionsStore>.Instance);
+        var service = NewService(store);
+        var ct = TestContext.Current.CancellationToken;
+        await service.StartAsync(ct);
+        try
+        {
+            // socket → bind → listen(9) → close, then park for the
+            // reconnect backoff. Give it a beat to prove no walk starts.
+            WaitForFrames(server, count: 4, TimeSpan.FromSeconds(5));
+            await Task.Delay(300, ct);
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken.None);
+        }
+
+        server.ReceivedFrames.OfType<BindMessage>().Should()
+            .OnlyContain(b => b.Local == "G0DPB-1", "an explicitly configured callsign never walks");
+        ReadOption("Callsign").Should().Be("G0DPB-1", "the stored identity is untouched");
+    }
+
+    [Fact]
+    public async Task NonDuplicateListenError_DoesNotWalk_EvenWhilePending()
+    {
+        // Only errCode 9 means "callsign taken". Any other refusal
+        // (here 13 "No buffers") keeps the existing reconnect handling:
+        // no probing, identity and pending marker untouched.
+        await using var server = new MockRhpServer
+        {
+            Handler = msg => msg is ListenMessage l
+                ? new ListenReplyMessage { Handle = l.Handle, ErrCode = RhpErrorCode.NoBuffers, ErrText = "No buffers" }
+                : null,
+        };
+        server.Start();
+        SeedDb(server.Endpoint.Port, callsign: "M9YYY-7", pendingMarker: "M9YYY-7");
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY");
+
+        var store = new SystemOptionsStore(NullLogger<SystemOptionsStore>.Instance);
+        var service = NewService(store);
+        var ct = TestContext.Current.CancellationToken;
+        await service.StartAsync(ct);
+        try
+        {
+            WaitForFrames(server, count: 3, TimeSpan.FromSeconds(5)); // socket → bind → listen
+            await Task.Delay(300, ct);
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken.None);
+        }
+
+        server.ReceivedFrames.OfType<BindMessage>().Should()
+            .OnlyContain(b => b.Local == "M9YYY-7", "non-9 errors must not trigger the SSID walk");
+        ReadOption("Callsign").Should().Be("M9YYY-7");
+        ReadOption(DbStartup.DerivedCallsignPendingKey).Should().Be("M9YYY-7",
+            "the derivation stays pending so a later start can still confirm or walk");
+    }
+
+    [Fact]
+    public async Task AllSsidsTaken_WalksInOrder_ThenRevertsToSetupRequired()
+    {
+        // Every listen answers 9. The walk must try start+1 … 15 then
+        // 1 … start−1 - skipping 0 and the node's own SSID (-2 here) -
+        // and then park in setup-required mode (placeholder callsign)
+        // instead of spinning against the node.
+        await using var server = new MockRhpServer { Handler = RefuseListenOn(call => true) };
+        server.Start();
+        SeedDb(server.Endpoint.Port, callsign: "M9YYY-7", pendingMarker: "M9YYY-7");
+        Environment.SetEnvironmentVariable("PDN_NODE_CALLSIGN", "M9YYY-2");
+
+        var store = new SystemOptionsStore(NullLogger<SystemOptionsStore>.Instance);
+        var service = NewService(store);
+        var ct = TestContext.Current.CancellationToken;
+        await service.StartAsync(ct);
+        try
+        {
+            WaitUntil(() => ReadOption("Callsign") == DbStartup.PlaceholderCallsign, TimeSpan.FromSeconds(10),
+                "exhausting every candidate must revert to setup-required mode");
+        }
+        finally
+        {
+            await service.StopAsync(CancellationToken.None);
+        }
+
+        ReadOption(DbStartup.DerivedCallsignPendingKey).Should().BeNull();
+        store.CurrentValue.Callsign.Should().Be(DbStartup.PlaceholderCallsign,
+            "the reload parks every consumer in setup-required mode");
+        var binds = server.ReceivedFrames.OfType<BindMessage>().Select(b => b.Local).ToList();
+        binds.Should().Equal(
+            "M9YYY-7", "M9YYY-8", "M9YYY-9", "M9YYY-10", "M9YYY-11", "M9YYY-12", "M9YYY-13",
+            "M9YYY-14", "M9YYY-15", "M9YYY-1", "M9YYY-3", "M9YYY-4", "M9YYY-5", "M9YYY-6");
+    }
+
+    [Fact]
+    public void SsidProbeCandidates_WalksForwardThenWraps_SkippingZeroAndNodeSsid()
+    {
+        Rhpv2InboundService.SsidProbeCandidates("M9YYY-7", "M9YYY").Should().Equal(
+            "M9YYY-7", "M9YYY-8", "M9YYY-9", "M9YYY-10", "M9YYY-11", "M9YYY-12", "M9YYY-13",
+            "M9YYY-14", "M9YYY-15", "M9YYY-1", "M9YYY-2", "M9YYY-3", "M9YYY-4", "M9YYY-5", "M9YYY-6");
+
+        Rhpv2InboundService.SsidProbeCandidates("M9YYY-7", "M9YYY-2").Should().NotContain("M9YYY-2",
+            "the SSID the node itself uses is skipped");
+
+        Rhpv2InboundService.SsidProbeCandidates("M9YYY-13", null).Should().Equal(
+            "M9YYY-13", "M9YYY-14", "M9YYY-15", "M9YYY-1", "M9YYY-2", "M9YYY-3", "M9YYY-4",
+            "M9YYY-5", "M9YYY-6", "M9YYY-7", "M9YYY-8", "M9YYY-9", "M9YYY-10", "M9YYY-11", "M9YYY-12");
+
+        Rhpv2InboundService.SsidProbeCandidates("M9YYY-7", "M9YYY")
+            .Should().NotContain(c => c.EndsWith("-0"), "SSID 0 is the node's bare callsign");
+    }
+
+    /// <summary>Mock-server handler playing the pdn role for one taken
+    /// callsign: listens on it answer errCode 9 "Duplicate socket"
+    /// (docs/rhp2-server.md D5); everything else gets the defaults.</summary>
+    private static Func<RhpMessage, RhpMessage?> RefuseListenOn(string takenCallsign) =>
+        RefuseListenOn(call => string.Equals(call, takenCallsign, StringComparison.OrdinalIgnoreCase));
+
+    private static Func<RhpMessage, RhpMessage?> RefuseListenOn(Func<string, bool> isTaken)
+    {
+        var handleToCallsign = new ConcurrentDictionary<int, string>();
+        return msg =>
+        {
+            switch (msg)
+            {
+                case BindMessage { Local: { } local } b:
+                    handleToCallsign[b.Handle] = local;
+                    return null; // default Ok reply
+                case ListenMessage l when handleToCallsign.TryGetValue(l.Handle, out var call) && isTaken(call):
+                    return new ListenReplyMessage
+                    {
+                        Handle = l.Handle,
+                        ErrCode = RhpErrorCode.DuplicateSocket,
+                        ErrText = "Duplicate socket",
+                    };
+                default:
+                    return null;
+            }
+        };
+    }
+
+    private static Rhpv2InboundService NewService(SystemOptionsStore store)
+    {
+        var database = new Database(NullLogger<Database>.Instance, store);
+        return new Rhpv2InboundService(
+            store, NullLoggerFactory.Instance, NullLogger<Rhpv2InboundService>.Instance,
+            database, new NoopInbox(), new OperationalMetrics());
+    }
+
+    private static void SeedDb(int rhpPort, string callsign, string? pendingMarker)
+    {
+        using var c = DbInfo.GetConnection();
+        c.CreateTable<DbSystemOption>();
+        c.InsertOrReplace(new DbSystemOption { Option = "Callsign", Value = callsign });
+        c.InsertOrReplace(new DbSystemOption { Option = "NodeBearer", Value = "rhpv2" });
+        c.InsertOrReplace(new DbSystemOption { Option = "NodeHost", Value = "127.0.0.1" });
+        c.InsertOrReplace(new DbSystemOption { Option = "RhpPort", Value = rhpPort.ToString() });
+        if (pendingMarker is not null)
+        {
+            c.InsertOrReplace(new DbSystemOption
+            {
+                Option = DbStartup.DerivedCallsignPendingKey,
+                Value = pendingMarker,
+            });
+        }
+    }
+
+    private static string? ReadOption(string key)
+    {
+        using var c = DbInfo.GetConnection();
+        return c.Query<DbSystemOption>("select * from systemoptions where option = ? collate nocase;", key)
+            .FirstOrDefault()?.Value;
+    }
+
+    private static void WaitUntil(Func<bool> condition, TimeSpan timeout, string because)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (condition()) return;
+            Thread.Sleep(20);
+        }
+        throw new TimeoutException($"Condition not met within {timeout}: {because}");
+    }
+
+    private static List<RhpMessage> WaitForFrames(MockRhpServer server, int count, TimeSpan timeout)
+    {
+        var deadline = DateTime.UtcNow + timeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            if (server.ReceivedFrames.Count >= count) return server.ReceivedFrames.Take(count).ToList();
+            Thread.Sleep(10);
+        }
+        throw new TimeoutException(
+            $"Did not observe {count} frames within {timeout}; saw [{string.Join(", ", server.ReceivedFrames.Select(f => f.GetType().Name))}]");
+    }
+
+    private sealed class NoopInbox : IBackhaulInbox
+    {
+        public Task DeliverAsync(BackhaulMessage message, string sourceCallsign, CancellationToken ct)
+            => Task.CompletedTask;
+    }
+}
diff --git a/src/dapps/dapps.core/Pages/Settings.cshtml b/src/dapps/dapps.core/Pages/Settings.cshtml
index 5ac510a..43ebd35 100644
--- a/src/dapps/dapps.core/Pages/Settings.cshtml
+++ b/src/dapps/dapps.core/Pages/Settings.cshtml
@@ -19,6 +19,18 @@
         font-family: var(--font-mono);
         letter-spacing: 0.18em;
     }
+
+    /* Deployment-managed (env-set) fields: badge next to the label,
+       control rendered read-only. See the env-managed script below. */
+    .env-badge {
+        display: inline-block; margin-left: 0.4rem;
+        padding: 0.05rem 0.4rem; border-radius: 999px;
+        font-size: 0.68rem; font-weight: 600;
+        text-transform: uppercase; letter-spacing: 0.05em;
+        background: color-mix(in srgb, var(--accent, #2563eb) 15%, transparent);
+        color: var(--accent, #2563eb);
+        cursor: help; vertical-align: middle;
+    }
 </style>
 
 <form id="settings-form" onsubmit="dappsSaveConfig(event)" autocomplete="off" data-default-bearer-port="@Model.Options.DefaultBearerPort">
@@ -227,6 +239,36 @@ async function dappsRotatePassword(ev) {
     }
 }
 
+// --- Deployment-managed (env-set) fields ---
+// Under DAPPS_ENV_MANAGED=true (the pdn supervised-app mode), any
+// option whose DAPPS_* env var is set on the daemon's environment is
+// re-applied from the environment at EVERY start, so a dashboard edit
+// would be silently overridden on the next restart. Badge those
+// fields and make them read-only so the operator isn't invited to
+// fight the deployment. In the standalone default mode the list is
+// always empty - env vars only seed first-start values there.
+// The form still serialises their values on save (the JS reads .value
+// // .checked directly, which works on readonly/disabled controls),
+// so saving unrelated fields keeps env-managed ones intact.
+(function () {
+    const managed = @Json.Serialize(Model.EnvManaged.Select(f => new { key = f.Key, env = f.Env }));
+    const form = document.getElementById('settings-form');
+    if (!form) return;
+    for (const m of managed) {
+        const el = form.querySelector(`[name='${m.key}']`);
+        if (!el) continue; // option without a form field (e.g. Ssid, DefaultBearerPort)
+        if (el.tagName === 'SELECT' || el.type === 'checkbox') el.disabled = true;
+        else el.readOnly = true;
+        const badge = document.createElement('span');
+        badge.className = 'env-badge';
+        badge.textContent = 'managed by environment';
+        badge.title = `Set from ${m.env} at every start — dashboard edits will be overridden while the variable remains set.`;
+        const holder = el.closest('.field')?.querySelector('label')
+            ?? el.closest('.field-checkbox')?.querySelector('span');
+        holder?.appendChild(badge);
+    }
+})();
+
 // --- Bearer-conditional fields ---
 // AGW vs RHPv2 are mutually exclusive at runtime; showing all four
 // fields at once is noisy and invites the operator to "fix" the
diff --git a/src/dapps/dapps.core/Pages/Settings.cshtml.cs b/src/dapps/dapps.core/Pages/Settings.cshtml.cs
index d407417..c19fff3 100644
--- a/src/dapps/dapps.core/Pages/Settings.cshtml.cs
+++ b/src/dapps/dapps.core/Pages/Settings.cshtml.cs
@@ -1,4 +1,5 @@
 using dapps.core.Models;
+using dapps.core.Services;
 using Microsoft.AspNetCore.Mvc.RazorPages;
 using Microsoft.Extensions.Options;
 
@@ -10,13 +11,29 @@ namespace dapps.core.Pages;
 /// "Routing &amp; probing", "Polling", "Heartbeat", "Updates", and
 /// "Admin password" panels. Posts JSON to <c>/Config</c>; the daemon
 /// hot-reloads everything except the MQTT and UDP listener ports.
+///
+/// <para>Under <c>DAPPS_ENV_MANAGED=true</c> (the pdn supervised-app
+/// mode), fields whose <c>DAPPS_*</c> env var is set are deployment-
+/// managed: <see cref="DbStartup"/> re-applies the env value at every
+/// start, so dashboard edits would be silently overridden.
+/// <see cref="EnvManaged"/> feeds the page script that badges those
+/// fields and makes them read-only. In the standalone default mode it
+/// is always empty - env vars only seed first-start values there and
+/// the dashboard owns everything.</para>
 /// </summary>
 public sealed class SettingsModel(IOptionsMonitor<SystemOptions> options) : PageModel
 {
+    public sealed record EnvManagedField(string Key, string Env);
+
     public SystemOptions Options { get; private set; } = new();
 
+    public IReadOnlyList<EnvManagedField> EnvManaged { get; private set; } = [];
+
     public void OnGet()
     {
         Options = options.CurrentValue;
+        EnvManaged = DbStartup.EnvManagedKeys()
+            .Select(k => new EnvManagedField(k, DbStartup.EnvVarFor(k)))
+            .ToArray();
     }
 }
diff --git a/src/dapps/dapps.core/Pages/Setup.cshtml b/src/dapps/dapps.core/Pages/Setup.cshtml
index aaeba13..5e19e71 100644
--- a/src/dapps/dapps.core/Pages/Setup.cshtml
+++ b/src/dapps/dapps.core/Pages/Setup.cshtml
@@ -137,6 +137,18 @@
         .detect-result.err { color: var(--err); }
         .bearer-fields { display: none; }
         .bearer-fields.show { display: block; }
+        /* Deployment-managed (env-set) fields: DbStartup re-applies the
+           DAPPS_* env value at every start, so edits here would be
+           overridden on the next restart. */
+        .env-badge {
+            display: inline-block; margin-left: 0.4rem;
+            padding: 0.05rem 0.4rem; border-radius: 999px;
+            font-size: 0.68rem; font-weight: 600;
+            letter-spacing: 0.05em;
+            background: color-mix(in srgb, var(--accent) 15%, transparent);
+            color: var(--accent);
+            cursor: help; vertical-align: middle;
+        }
     </style>
 </head>
 <body>
@@ -185,33 +197,37 @@
                 <code>linbpq</code> or <code>xrouter</code> on this host.
             </p>
             <form method="post" asp-page-handler="Bearer" id="bearerForm">
-                <label for="callsign">DAPPS callsign <span class="normal">with SSID, e.g. M0LTE-7 - the call+SSID DAPPS will use on the air</span></label>
+                <label for="callsign">DAPPS callsign <span class="normal">with SSID, e.g. M0LTE-7 - the call+SSID DAPPS will use on the air</span>@if (SetupModel.IsEnvManaged("Callsign")) {<span class="env-badge" title="Set from DAPPS_CALLSIGN at every start — edits here will be overridden while the variable remains set.">managed by environment</span>}</label>
                 <input id="callsign" name="callsign" type="text" autofocus required
-                    pattern="[A-Za-z0-9\-]{3,15}" value="@Model.Callsign" />
+                    pattern="[A-Za-z0-9\-]{3,15}" value="@Model.Callsign"
+                    readonly="@SetupModel.IsEnvManaged("Callsign")" />
 
-                <label for="nodeHost">Packet-node host <span class="normal">usually localhost</span></label>
-                <input id="nodeHost" name="nodeHost" type="text" required value="@Model.NodeHost" />
+                <label for="nodeHost">Packet-node host <span class="normal">usually localhost</span>@if (SetupModel.IsEnvManaged("NodeHost")) {<span class="env-badge" title="Set from DAPPS_NODE_HOST at every start — edits here will be overridden while the variable remains set.">managed by environment</span>}</label>
+                <input id="nodeHost" name="nodeHost" type="text" required value="@Model.NodeHost"
+                    readonly="@SetupModel.IsEnvManaged("NodeHost")" />
 
                 <div class="detect">
                     <button type="button" id="detectBtn">Detect packet node</button>
                     <span class="detect-result" id="detectResult">not detected yet</span>
                 </div>
 
-                <label for="nodeBearer">Bearer</label>
+                <label for="nodeBearer">Bearer@if (SetupModel.IsEnvManaged("NodeBearer")) {<span class="env-badge" title="Set from DAPPS_NODE_BEARER at every start — edits here will be overridden while the variable remains set.">managed by environment</span>}</label>
                 <select id="nodeBearer" name="nodeBearer">
                     <option value="agw" selected="@(Model.NodeBearer == "agw")">AGW (BPQ)</option>
                     <option value="rhpv2" selected="@(Model.NodeBearer == "rhpv2")">RHPv2 (XRouter)</option>
                 </select>
 
-                <label for="port" id="portLabel">@(Model.NodeBearer == "rhpv2" ? "RHPv2 port" : "AGW port")</label>
+                <label for="port" id="portLabel">@(Model.NodeBearer == "rhpv2" ? "RHPv2 port" : "AGW port")@if (SetupModel.IsEnvManaged(Model.NodeBearer == "rhpv2" ? "RhpPort" : "AgwPort")) {<span class="env-badge" title="Set from the environment at every start — edits here will be overridden while the variable remains set.">managed by environment</span>}</label>
                 <input id="port" name="port" type="number" min="1" max="65535" value="@Model.Port" required />
 
                 <div id="rhpAuthFields" class="bearer-fields @(Model.NodeBearer == "rhpv2" ? "show" : "")">
-                    <label for="rhpUser">RHPv2 user <span class="normal">leave blank if your XRouter doesn't require RHPv2 auth</span></label>
-                    <input id="rhpUser" name="rhpUser" type="text" value="@Model.RhpUser" />
+                    <label for="rhpUser">RHPv2 user <span class="normal">leave blank if your XRouter doesn't require RHPv2 auth</span>@if (SetupModel.IsEnvManaged("RhpUser")) {<span class="env-badge" title="Set from DAPPS_RHP_USER at every start — edits here will be overridden while the variable remains set.">managed by environment</span>}</label>
+                    <input id="rhpUser" name="rhpUser" type="text" value="@Model.RhpUser"
+                        readonly="@SetupModel.IsEnvManaged("RhpUser")" />
 
-                    <label for="rhpPass">RHPv2 password</label>
-                    <input id="rhpPass" name="rhpPass" type="password" value="@Model.RhpPass" />
+                    <label for="rhpPass">RHPv2 password@if (SetupModel.IsEnvManaged("RhpPass")) {<span class="env-badge" title="Set from DAPPS_RHP_PASS at every start — edits here will be overridden while the variable remains set.">managed by environment</span>}</label>
+                    <input id="rhpPass" name="rhpPass" type="password" value="@Model.RhpPass"
+                        readonly="@SetupModel.IsEnvManaged("RhpPass")" />
                 </div>
 
                 <button type="submit">Save &amp; finish &rarr;</button>
diff --git a/src/dapps/dapps.core/Pages/Setup.cshtml.cs b/src/dapps/dapps.core/Pages/Setup.cshtml.cs
index 4227ab4..bf7ccc8 100644
--- a/src/dapps/dapps.core/Pages/Setup.cshtml.cs
+++ b/src/dapps/dapps.core/Pages/Setup.cshtml.cs
@@ -64,6 +64,13 @@ public enum SetupStep { Password, Bearer }
 
     public string? Error { get; private set; }
 
+    /// <summary>True when the daemon runs under
+    /// <c>DAPPS_ENV_MANAGED=true</c> and the option's <c>DAPPS_*</c>
+    /// env var is set: the value is deployment-managed (re-applied at
+    /// every start), so the form badges it. Always false in the
+    /// standalone default mode. See <see cref="DbStartup.IsEnvManaged"/>.</summary>
+    public static bool IsEnvManaged(string key) => DbStartup.IsEnvManaged(key);
+
     public async Task<IActionResult> OnGetAsync()
     {
         if (!await store.IsConfiguredAsync())
@@ -77,9 +84,15 @@ public async Task<IActionResult> OnGetAsync()
         {
             // Operator set the password but hasn't done bearer yet.
             // Pre-fill the form from the persisted defaults so they
-            // only type what they want to change.
+            // only type what they want to change. Under a pdn host
+            // (PDN_NODE_CALLSIGN injected) suggest the conventional
+            // <node-base-call>-<Ssid> identity; normally DbStartup has
+            // already persisted that derivation at boot and this step
+            // is skipped entirely, but if the callsign was reset to the
+            // placeholder mid-run the wizard still offers the right
+            // default.
             Step = SetupStep.Bearer;
-            Callsign = "";
+            Callsign = DbStartup.DeriveCallsignFromHostNode() ?? "";
             NodeHost = string.IsNullOrWhiteSpace(opts.NodeHost) ? "localhost" : opts.NodeHost;
             NodeBearer = string.Equals(opts.NodeBearer, "rhpv2", StringComparison.OrdinalIgnoreCase) ? "rhpv2" : "agw";
             AgwPortDefault = opts.AgwPort > 0 ? opts.AgwPort : 8000;
diff --git a/src/dapps/dapps.core/Program.cs b/src/dapps/dapps.core/Program.cs
index aceae22..55f2b29 100644
--- a/src/dapps/dapps.core/Program.cs
+++ b/src/dapps/dapps.core/Program.cs
@@ -30,7 +30,16 @@
 // which would race a hosted-service seeder and lose, since hosted
 // services are CONSTRUCTED in one pass before any of their StartAsync
 // runs.
-DbStartup.EnsureSchemaAndSeed();
+//
+// A throwaway console logger (the host's logging isn't built yet)
+// makes the seeding decisions visible: which options were seeded from
+// env vars, which stored values an env var re-applied (deployment-
+// managed config), and a callsign derived from a pdn host's
+// PDN_NODE_CALLSIGN.
+using (var seedLoggerFactory = LoggerFactory.Create(b => b.AddSimpleConsole()))
+{
+    DbStartup.EnsureSchemaAndSeed(seedLoggerFactory.CreateLogger(nameof(DbStartup)));
+}
 
 var builder = WebApplication.CreateBuilder(args);
 
diff --git a/src/dapps/dapps.core/Services/DbStartup.cs b/src/dapps/dapps.core/Services/DbStartup.cs
index 1b717d0..56e6bb7 100644
--- a/src/dapps/dapps.core/Services/DbStartup.cs
+++ b/src/dapps/dapps.core/Services/DbStartup.cs
@@ -32,9 +32,107 @@ public static class DbStartup
     /// placeholder never go on the air.</summary>
     public const string PlaceholderCallsign = "N0CALL";
 
+    /// <summary>Mode switch (read from the environment at every start,
+    /// never stored): when set to <c>true</c> the deployment - not the
+    /// dashboard - owns every option whose <c>DAPPS_*</c> env var is
+    /// set. See <see cref="IsEnvManagedMode"/>.</summary>
+    public const string EnvManagedModeVar = "DAPPS_ENV_MANAGED";
+
+    /// <summary>Option key holding a callsign that was derived from the
+    /// host node (<see cref="NodeCallsignEnvVar"/>) but has not yet been
+    /// confirmed free by a successful RHPv2 listen. While this row
+    /// matches the stored callsign, <c>Rhpv2InboundService</c> may
+    /// probe-walk to a free SSID if the node refuses the derived one
+    /// (errCode 9 "Duplicate socket"); once a listen succeeds the row
+    /// is cleared and the confirmed identity is stable on every later
+    /// start. Not a seeded option - no env var, no dashboard field.</summary>
+    public const string DerivedCallsignPendingKey = "DerivedCallsignPending";
+
+    /// <summary>Option key holding the SSID used when deriving this
+    /// instance's callsign from the host node's callsign (see
+    /// <see cref="NodeCallsignEnvVar"/>). Seeded to <see cref="DefaultSsid"/>;
+    /// env-overridable as <c>DAPPS_SSID</c> like every other seeded
+    /// option. Only consulted at derivation time - a stored or
+    /// env-supplied <c>Callsign</c> always wins.</summary>
+    public const string SsidOptionKey = "Ssid";
+
+    /// <summary>Proposed convention: DAPPS lives at SSID -7 of the host
+    /// node's callsign (matches the M0LTE-7 acceptance-test identity).
+    /// There is no packet-wide DAPPS SSID convention yet; this default
+    /// is the proposal.</summary>
+    public const string DefaultSsid = "7";
+
+    /// <summary>Injected by a pdn host into supervised app processes:
+    /// the node's own callsign text, e.g. <c>M9YYY</c> (may carry an
+    /// SSID, which we strip before composing). Absent when DAPPS runs
+    /// standalone alongside BPQ/XRouter.</summary>
+    public const string NodeCallsignEnvVar = "PDN_NODE_CALLSIGN";
+
+    /// <summary>
+    /// Every option key EnsureSchemaAndSeed seeds, with its hardcoded
+    /// fallback default. Single source of truth for seeding, for the
+    /// per-start env application, and for the dashboard's
+    /// "managed by environment" markers.
+    /// </summary>
+    private static readonly (string Key, string Default)[] SeededOptions =
+    [
+        ("NodeHost", "localhost"),
+        ("AgwPort", "8000"),
+        ("DefaultBearerPort", "0"),
+        ("Callsign", PlaceholderCallsign),
+        ("MqttPort", "1883"),
+        ("UdpListenPort", "0"),
+        ("AuthRequired", "false"),
+        ("UpdateCheckEnabled", "true"),
+        ("RoutingAlgorithm", "passive-flood"),
+        ("ProbingEnabled", "false"),
+        ("ProbeIntervalHours", "24"),
+        ("FragmentThresholdBytes", "4096"),
+        ("FragmentReassemblyTimeoutSeconds", "604800"),
+        ("RouteGossipStalenessHours", "6"),
+        ("OpportunisticPollEnabled", "true"),
+        ("ScheduledPollEnabled", "false"),
+        ("PollIntervalHours", "6"),
+        ("DiscoveryAirtimeBudgetSecondsPerHour", "0"),
+        ("ProbeStrategy", nameof(Models.ProbeStrategy.FixedInterval)),
+        ("ProbeOvernightStartHour", "2"),
+        ("ProbeOvernightEndHour", "6"),
+        ("ProbeQuietWindowSeconds", "300"),
+        ("HeartbeatEnabled", "true"),
+        ("HeartbeatIntervalSeconds", "60"),
+        ("AutoDiscoverViaNodeCall", "false"),
+        ("NodePromptApplicationCommand", "DAPPS"),
+        ("NodeBearer", "agw"),
+        ("RhpPort", "9000"),
+        ("RhpUser", ""),
+        ("RhpPass", ""),
+        (SsidOptionKey, DefaultSsid),
+    ];
+
+    /// <summary>True when <see cref="EnvManagedModeVar"/> is set to
+    /// <c>true</c> (or <c>1</c>): the deployment-managed mode, opted
+    /// into by pdn-supervised installs via pdn-app.yaml. In this mode
+    /// every set <c>DAPPS_*</c> env var is re-applied over the stored
+    /// row at every start and the dashboard badges those fields
+    /// read-only. Unset / any other value = the standalone default:
+    /// env vars seed missing rows on first start only and the
+    /// dashboard owns everything thereafter (the shipped
+    /// scripts/dapps.service flow keeps /etc/dapps.env applied
+    /// forever, so re-applying would revert dashboard edits there).</summary>
+    public static bool IsEnvManagedMode
+    {
+        get
+        {
+            var v = Environment.GetEnvironmentVariable(EnvManagedModeVar);
+            return string.Equals(v, "true", StringComparison.OrdinalIgnoreCase) || v == "1";
+        }
+    }
+
     /// <summary>
-    /// Create every table the daemon needs and seed the first-run
-    /// systemoptions defaults (env-var overrides → hardcoded fallback).
+    /// Create every table the daemon needs, seed the first-run
+    /// systemoptions defaults (env-var overrides → hardcoded fallback),
+    /// and - only when <see cref="IsEnvManagedMode"/> - re-apply any
+    /// env-set values to existing rows (deployment-managed config).
     /// Safe to call multiple times - every step is idempotent.
     ///
     /// Called once from Program.cs *before* <c>builder.Build()</c> so
@@ -71,65 +169,264 @@ public static void EnsureSchemaAndSeed(ILogger? logger = null)
         var optionsTable = db.Table<DbSystemOption>().Table.TableName;
         var options = db.Query<DbSystemOption>($"select * from {optionsTable};");
 
-        // Seeded defaults. When an env var DAPPS_<KEY> is set, it wins;
-        // otherwise the hardcoded fallback applies. Either way the value
-        // is only written when no row exists - once configured (here or
-        // via /Config), the row sticks and env vars stop mattering.
-        InsertIfNotPresent(db, options, "NodeHost", "localhost", logger);
-        InsertIfNotPresent(db, options, "AgwPort", "8000", logger);
-        InsertIfNotPresent(db, options, "DefaultBearerPort", "0", logger);
-        InsertIfNotPresent(db, options, "Callsign", PlaceholderCallsign, logger);
-        InsertIfNotPresent(db, options, "MqttPort", "1883", logger);
-        InsertIfNotPresent(db, options, "UdpListenPort", "0", logger);
-        InsertIfNotPresent(db, options, "AuthRequired", "false", logger);
-        InsertIfNotPresent(db, options, "UpdateCheckEnabled", "true", logger);
-        InsertIfNotPresent(db, options, "RoutingAlgorithm", "passive-flood", logger);
-        InsertIfNotPresent(db, options, "ProbingEnabled", "false", logger);
-        InsertIfNotPresent(db, options, "ProbeIntervalHours", "24", logger);
-        InsertIfNotPresent(db, options, "FragmentThresholdBytes", "4096", logger);
-        InsertIfNotPresent(db, options, "FragmentReassemblyTimeoutSeconds", "604800", logger);
-        InsertIfNotPresent(db, options, "RouteGossipStalenessHours", "6", logger);
-        InsertIfNotPresent(db, options, "OpportunisticPollEnabled", "true", logger);
-        InsertIfNotPresent(db, options, "ScheduledPollEnabled", "false", logger);
-        InsertIfNotPresent(db, options, "PollIntervalHours", "6", logger);
-        InsertIfNotPresent(db, options, "DiscoveryAirtimeBudgetSecondsPerHour", "0", logger);
-        InsertIfNotPresent(db, options, "ProbeStrategy", nameof(ProbeStrategy.FixedInterval), logger);
-        InsertIfNotPresent(db, options, "ProbeOvernightStartHour", "2", logger);
-        InsertIfNotPresent(db, options, "ProbeOvernightEndHour", "6", logger);
-        InsertIfNotPresent(db, options, "ProbeQuietWindowSeconds", "300", logger);
-        InsertIfNotPresent(db, options, "HeartbeatEnabled", "true", logger);
-        InsertIfNotPresent(db, options, "HeartbeatIntervalSeconds", "60", logger);
-        InsertIfNotPresent(db, options, "AutoDiscoverViaNodeCall", "false", logger);
-        InsertIfNotPresent(db, options, "NodePromptApplicationCommand", "DAPPS", logger);
-        InsertIfNotPresent(db, options, "NodeBearer", "agw", logger);
-        InsertIfNotPresent(db, options, "RhpPort", "9000", logger);
-        InsertIfNotPresent(db, options, "RhpUser", "", logger);
-        InsertIfNotPresent(db, options, "RhpPass", "", logger);
+        // Seeded defaults. A set env var DAPPS_<KEY> always wins for a
+        // row that doesn't exist yet (first start). What happens to an
+        // EXISTING row depends on the DAPPS_ENV_MANAGED mode switch:
+        //
+        //   unset/false (the standalone default): env vars seed only;
+        //     stored (dashboard-edited) values are never touched on
+        //     later starts. The shipped standalone flow
+        //     (scripts/dapps.service + EnvironmentFile=/etc/dapps.env)
+        //     keeps DAPPS_* set permanently, so re-applying would
+        //     silently revert every dashboard edit - hence opt-in.
+        //
+        //   true (the pdn supervised-app case; set in pdn-app.yaml):
+        //     every set DAPPS_<KEY> is deployment-managed config and is
+        //     re-applied over whatever the row holds at EVERY start,
+        //     and the dashboard badges those fields read-only.
+        foreach (var (key, defaultValue) in SeededOptions)
+        {
+            SeedOrApplyEnv(db, options, key, defaultValue, logger);
+        }
+
+        DeriveCallsignFromHostNodeIfUnset(db, logger);
 
         ValidateRequiredConfig(db, logger);
 
         logger?.LogInformation("DB schema refreshed");
     }
 
-    private static void InsertIfNotPresent(SQLiteConnection db, List<DbSystemOption> options, string key, string defaultValue, ILogger? logger)
+    private static void SeedOrApplyEnv(SQLiteConnection db, List<DbSystemOption> options, string key, string defaultValue, ILogger? logger)
     {
-        if (options.Any(o => string.Equals(o.Option, key, StringComparison.OrdinalIgnoreCase)))
+        var envKey = EnvVarFor(key);
+        var envValue = Environment.GetEnvironmentVariable(envKey);
+
+        var existing = options.FirstOrDefault(o => string.Equals(o.Option, key, StringComparison.OrdinalIgnoreCase));
+        if (existing is null)
         {
+            var value = string.IsNullOrEmpty(envValue) ? defaultValue : envValue;
+            db.Insert(new DbSystemOption { Option = key, Value = value });
+
+            if (!string.IsNullOrEmpty(envValue))
+            {
+                logger?.LogInformation("Seeded {0} from {1}", key, envKey);
+            }
             return;
         }
 
-        var envKey = "DAPPS_" + ToScreamingSnake(key);
-        var envValue = Environment.GetEnvironmentVariable(envKey);
-        var value = string.IsNullOrEmpty(envValue) ? defaultValue : envValue;
+        if (IsEnvManagedMode && !string.IsNullOrEmpty(envValue) && !string.Equals(existing.Value, envValue, StringComparison.Ordinal))
+        {
+            existing.Value = envValue;
+            db.Update(existing);
+            logger?.LogInformation(
+                "SystemOption {Key} applied from environment ({EnvVar}) — this value is deployment-managed; " +
+                "dashboard edits will be overridden while the variable remains set",
+                key, envKey);
+        }
+    }
+
+    /// <summary>
+    /// "DAPPS resides at an SSID of the node callsign": when DAPPS runs
+    /// supervised under a pdn node, the host injects
+    /// <see cref="NodeCallsignEnvVar"/> and we derive
+    /// <c>&lt;base-of-node-call&gt;-&lt;Ssid&gt;</c> as the callsign -
+    /// but only while the stored callsign is absent or still the
+    /// <see cref="PlaceholderCallsign"/> placeholder. An explicit
+    /// <c>DAPPS_CALLSIGN</c> env var or a real stored callsign always
+    /// wins over derivation. Standalone installs (no PDN_NODE_CALLSIGN)
+    /// are untouched.
+    /// </summary>
+    private static void DeriveCallsignFromHostNodeIfUnset(SQLiteConnection db, ILogger? logger)
+    {
+        var options = db.Query<DbSystemOption>("select * from systemoptions;");
+        var callsignRow = options.FirstOrDefault(
+            o => string.Equals(o.Option, "Callsign", StringComparison.OrdinalIgnoreCase));
+        var markerRow = options.FirstOrDefault(
+            o => string.Equals(o.Option, DerivedCallsignPendingKey, StringComparison.OrdinalIgnoreCase));
+        var stored = callsignRow?.Value ?? "";
+
+        // An explicit DAPPS_CALLSIGN wins over derivation. (It was
+        // already applied above; this guard also keeps a pathological
+        // DAPPS_CALLSIGN=N0CALL from being re-derived underneath.)
+        if (!string.IsNullOrEmpty(Environment.GetEnvironmentVariable(EnvVarFor("Callsign"))))
+        {
+            ClearPendingMarker(db, markerRow); // identity explicitly pinned - nothing pending
+            return;
+        }
+
+        var unset = string.IsNullOrWhiteSpace(stored)
+            || string.Equals(stored, PlaceholderCallsign, StringComparison.OrdinalIgnoreCase);
+        if (!unset)
+        {
+            // A real stored callsign always wins. Keep the pending
+            // marker only while it still matches the stored value (=
+            // a derivation from a previous start that the RHPv2
+            // listener hasn't confirmed yet); a dashboard-configured
+            // callsign clears it so an explicit identity never walks.
+            if (markerRow is not null
+                && !string.Equals(markerRow.Value, stored, StringComparison.OrdinalIgnoreCase))
+            {
+                ClearPendingMarker(db, markerRow);
+            }
+            return;
+        }
+
+        var ssidRow = options.FirstOrDefault(
+            o => string.Equals(o.Option, SsidOptionKey, StringComparison.OrdinalIgnoreCase));
+        var ssid = string.IsNullOrWhiteSpace(ssidRow?.Value) ? DefaultSsid : ssidRow!.Value.Trim();
+        var derived = DeriveCallsignFromHostNode(ssid);
+        if (derived is null)
+        {
+            // Not pdn-hosted - standalone setup-required flow as before.
+            // A leftover marker (e.g. the host stopped injecting
+            // PDN_NODE_CALLSIGN) can't match the placeholder; drop it.
+            ClearPendingMarker(db, markerRow);
+            return;
+        }
+
+        if (callsignRow is null)
+        {
+            db.Insert(new DbSystemOption { Option = "Callsign", Value = derived });
+        }
+        else
+        {
+            callsignRow.Value = derived;
+            db.Update(callsignRow);
+        }
+
+        // Mark the derivation as not-yet-confirmed: if the node refuses
+        // the listen with errCode 9 (callsign already claimed there),
+        // Rhpv2InboundService probe-walks the SSIDs for a free one and
+        // persists the winner; the first successful listen clears this.
+        if (markerRow is null)
+        {
+            db.Insert(new DbSystemOption { Option = DerivedCallsignPendingKey, Value = derived });
+        }
+        else if (!string.Equals(markerRow.Value, derived, StringComparison.Ordinal))
+        {
+            markerRow.Value = derived;
+            db.Update(markerRow);
+        }
+
+        logger?.LogInformation(
+            "Callsign {Derived} derived from the host node ({EnvVar}={NodeCall}, SSID {Ssid}). " +
+            "If the node already has a {Derived} the RHPv2 listener will probe for a free SSID and keep it. " +
+            "Set DAPPS_CALLSIGN or configure a callsign via the dashboard to pin a different identity.",
+            derived, NodeCallsignEnvVar, Environment.GetEnvironmentVariable(NodeCallsignEnvVar), ssid);
+    }
+
+    private static void ClearPendingMarker(SQLiteConnection db, DbSystemOption? markerRow)
+    {
+        if (markerRow is not null)
+        {
+            db.Execute("delete from systemoptions where option = ?;", markerRow.Option);
+        }
+    }
 
-        db.Insert(new DbSystemOption { Option = key, Value = value });
+    /// <summary>The derived callsign awaiting its first successful
+    /// listen, or null when none is pending. See
+    /// <see cref="DerivedCallsignPendingKey"/>.</summary>
+    public static string? ReadPendingDerivedCallsign()
+    {
+        using var db = DbInfo.GetConnection();
+        db.CreateTable<DbSystemOption>();
+        var row = db.Query<DbSystemOption>(
+                "select * from systemoptions where option = ? collate nocase;", DerivedCallsignPendingKey)
+            .FirstOrDefault();
+        return string.IsNullOrWhiteSpace(row?.Value) ? null : row!.Value;
+    }
 
-        if (!string.IsNullOrEmpty(envValue))
+    /// <summary>A listen succeeded on <paramref name="confirmed"/>:
+    /// persist it as the stored callsign (it may differ from the
+    /// original derivation after a probe-walk) and clear the pending
+    /// marker so the identity is stable on every later start - a
+    /// persisted, confirmed callsign never walks again.</summary>
+    public static void ConfirmDerivedCallsign(string confirmed)
+    {
+        using var db = DbInfo.GetConnection();
+        var callsignRow = db.Query<DbSystemOption>(
+                "select * from systemoptions where option = ? collate nocase;", "Callsign")
+            .FirstOrDefault();
+        if (callsignRow is null)
+        {
+            db.Insert(new DbSystemOption { Option = "Callsign", Value = confirmed });
+        }
+        else if (!string.Equals(callsignRow.Value, confirmed, StringComparison.Ordinal))
         {
-            logger?.LogInformation("Seeded {0} from {1}", key, envKey);
+            callsignRow.Value = confirmed;
+            db.Update(callsignRow);
         }
+        db.Execute("delete from systemoptions where option = ? collate nocase;", DerivedCallsignPendingKey);
     }
 
+    /// <summary>Every candidate SSID was taken on the node: drop back
+    /// to the placeholder (setup-required mode - the bearer gates idle
+    /// instead of hammering the node) and clear the pending marker.
+    /// The operator pins an identity via the dashboard / DAPPS_CALLSIGN,
+    /// or the next daemon restart re-derives and probes again.</summary>
+    public static void AbandonDerivedCallsign()
+    {
+        using var db = DbInfo.GetConnection();
+        db.Execute("update systemoptions set value = ? where option = ? collate nocase;",
+            PlaceholderCallsign, "Callsign");
+        db.Execute("delete from systemoptions where option = ? collate nocase;", DerivedCallsignPendingKey);
+    }
+
+    /// <summary>Compose the conventional pdn-hosted DAPPS callsign:
+    /// base of the host node's callsign (any SSID stripped, upper-cased)
+    /// + <paramref name="ssid"/>. Null when <see cref="NodeCallsignEnvVar"/>
+    /// is not set or empty (standalone install).</summary>
+    public static string? DeriveCallsignFromHostNode(string ssid)
+    {
+        var nodeCall = Environment.GetEnvironmentVariable(NodeCallsignEnvVar);
+        if (string.IsNullOrWhiteSpace(nodeCall))
+        {
+            return null;
+        }
+
+        var baseCall = nodeCall.Trim().ToUpperInvariant().Split('-')[0].Trim();
+        if (baseCall.Length == 0)
+        {
+            return null;
+        }
+
+        return $"{baseCall}-{ssid}";
+    }
+
+    /// <summary>Overload reading the stored Ssid option (fallback
+    /// <see cref="DefaultSsid"/>). Used by /Setup to prefill the
+    /// callsign field when the daemon is pdn-hosted and still in
+    /// setup-required mode.</summary>
+    public static string? DeriveCallsignFromHostNode()
+    {
+        using var db = DbInfo.GetConnection();
+        db.CreateTable<DbSystemOption>();
+        var ssidRow = db.Query<DbSystemOption>("select * from systemoptions;")
+            .FirstOrDefault(o => string.Equals(o.Option, SsidOptionKey, StringComparison.OrdinalIgnoreCase));
+        var ssid = string.IsNullOrWhiteSpace(ssidRow?.Value) ? DefaultSsid : ssidRow!.Value.Trim();
+        return DeriveCallsignFromHostNode(ssid);
+    }
+
+    /// <summary>The env var that overrides the given seeded option key,
+    /// e.g. <c>NodeHost</c> → <c>DAPPS_NODE_HOST</c>.</summary>
+    public static string EnvVarFor(string key) => "DAPPS_" + ToScreamingSnake(key);
+
+    /// <summary>True when the daemon runs in deployment-managed mode
+    /// (<see cref="IsEnvManagedMode"/>) AND the given option key's
+    /// <c>DAPPS_*</c> env var is currently set (non-empty) - i.e. the
+    /// value is re-applied from the environment at every start. Always
+    /// false in the standalone default mode, where a set env var only
+    /// seeds first-start values and the dashboard stays in charge.</summary>
+    public static bool IsEnvManaged(string key) =>
+        IsEnvManagedMode && !string.IsNullOrEmpty(Environment.GetEnvironmentVariable(EnvVarFor(key)));
+
+    /// <summary>Seeded option keys that are deployment-managed right
+    /// now (<see cref="IsEnvManaged"/>), for the dashboard's "managed
+    /// by environment" field markers. Empty outside
+    /// <see cref="IsEnvManagedMode"/>.</summary>
+    public static IReadOnlyList<string> EnvManagedKeys() =>
+        SeededOptions.Select(s => s.Key).Where(IsEnvManaged).ToArray();
+
     /// <summary>
     /// Warn if the callsign is the seeded placeholder. The daemon starts
     /// either way - inbound bearer services and the outbound forwarder
@@ -161,7 +458,7 @@ private static void ValidateRequiredConfig(SQLiteConnection db, ILogger? logger)
     /// <summary>
     /// Convert a PascalCase or camelCase identifier to SCREAMING_SNAKE_CASE
     /// for use as an environment-variable suffix. <c>NodeHost</c> →
-    /// <c>NODE_HOST</c>; <c>DefaultBearerPort</c> → <c>DEFAULT_BPQ_PORT</c>.
+    /// <c>NODE_HOST</c>; <c>DefaultBearerPort</c> → <c>DEFAULT_BEARER_PORT</c>.
     /// </summary>
     private static string ToScreamingSnake(string identifier)
     {
diff --git a/src/dapps/dapps.core/Services/Rhpv2InboundService.cs b/src/dapps/dapps.core/Services/Rhpv2InboundService.cs
index 1a91470..e49da9c 100644
--- a/src/dapps/dapps.core/Services/Rhpv2InboundService.cs
+++ b/src/dapps/dapps.core/Services/Rhpv2InboundService.cs
@@ -117,10 +117,15 @@ private async Task RunOnce(CancellationToken stoppingToken)
 
         // socket + bind + listen for inbound AX.25 streams to our callsign.
         // Port omitted = listen across all configured XRouter ports.
-        var listenerHandle = await rhp.SocketAsync(ProtocolFamily.Ax25, SocketMode.Stream, stoppingToken);
-        await rhp.BindAsync(listenerHandle, local: opts.Callsign, port: null, stoppingToken);
-        await rhp.ListenAsync(listenerHandle, OpenFlags.Passive, stoppingToken);
-        logger.LogInformation("RHP inbound: listener bound to {call} on handle {h}", opts.Callsign, listenerHandle);
+        // A callsign freshly derived from PDN_NODE_CALLSIGN may probe-
+        // walk to a free SSID here; see BindListenerAsync.
+        var bound = await BindListenerAsync(rhp, opts, stoppingToken);
+        if (bound is null)
+        {
+            return; // logged inside; the ExecuteAsync loop retries after ReconnectBackoff
+        }
+        var (listenerHandle, boundCallsign) = bound.Value;
+        logger.LogInformation("RHP inbound: listener bound to {call} on handle {h}", boundCallsign, listenerHandle);
 
         var sessions = new ConcurrentDictionary<int, MultiplexedAgwSessionStream>();
         var disconnect = new TaskCompletionSource<Exception?>(TaskCreationOptions.RunContinuationsAsynchronously);
@@ -223,4 +228,149 @@ private async Task RunOnce(CancellationToken stoppingToken)
             sessions.Clear();
         }
     }
+
+    /// <summary>
+    /// Bind + listen the daemon's callsign, probing for a free SSID
+    /// when the identity is a not-yet-confirmed derivation.
+    ///
+    /// pdn answers a listen on an already-claimed callsign - including
+    /// the node's own - with errCode 9 "Duplicate socket",
+    /// deterministically (packet.net docs/rhp2-server.md deviation D5).
+    /// That turns the callsign derived from PDN_NODE_CALLSIGN into a
+    /// probe: while <see cref="DbStartup.DerivedCallsignPendingKey"/>
+    /// still matches the callsign in use (placeholder + PDN_NODE_CALLSIGN
+    /// at boot, no explicit DAPPS_CALLSIGN, no successful listen yet), a
+    /// 9 walks the candidate SSIDs - start+1 … 15, then 1 … start−1,
+    /// skipping 0 and the SSID the node itself uses - and the first
+    /// successful listen wins. The winner is persisted as the stored
+    /// callsign, so the identity is stable on every later start: a
+    /// persisted, confirmed callsign never walks again.
+    ///
+    /// An explicitly configured callsign (DAPPS_CALLSIGN, dashboard, or
+    /// an already-confirmed derivation) NEVER walks: a 9 logs the
+    /// refusal and keeps the existing retry/reconnect behaviour.
+    ///
+    /// Against a server that answers duplicate listens Ok (live XRouter
+    /// does - D5 is pdn's deviation from it), the very first listen
+    /// succeeds and the walk simply never triggers. That's fine:
+    /// derivation only ever runs under pdn supervision, because only a
+    /// pdn host injects PDN_NODE_CALLSIGN.
+    /// </summary>
+    /// <returns>The listener handle and the callsign it is bound to, or
+    /// null when no listener could be established (logged; the caller
+    /// returns into the reconnect loop).</returns>
+    private async Task<(int Handle, string Callsign)?> BindListenerAsync(
+        RhpClient rhp, SystemOptions opts, CancellationToken ct)
+    {
+        var pending = DbStartup.ReadPendingDerivedCallsign();
+        var walkEligible =
+            pending is not null
+            && string.Equals(pending, opts.Callsign, StringComparison.OrdinalIgnoreCase)
+            && string.IsNullOrEmpty(Environment.GetEnvironmentVariable(DbStartup.EnvVarFor("Callsign")));
+
+        IReadOnlyList<string> candidates = walkEligible
+            ? SsidProbeCandidates(opts.Callsign, Environment.GetEnvironmentVariable(DbStartup.NodeCallsignEnvVar))
+            : [opts.Callsign];
+        var taken = new List<string>();
+
+        foreach (var candidate in candidates)
+        {
+            var handle = await rhp.SocketAsync(ProtocolFamily.Ax25, SocketMode.Stream, ct);
+            try
+            {
+                await rhp.BindAsync(handle, local: candidate, port: null, ct);
+                await rhp.ListenAsync(handle, OpenFlags.Passive, ct);
+            }
+            catch (RhpServerException ex) when (ex.ErrorCode == RhpErrorCode.DuplicateSocket)
+            {
+                try { await rhp.CloseAsync(handle, ct); }
+                catch (RhpProtocolException) { /* refused handles may already be gone server-side */ }
+
+                if (!walkEligible)
+                {
+                    logger.LogWarning(
+                        "RHP inbound: callsign {call} is already claimed on the node (errCode 9 'Duplicate socket'). " +
+                        "It is explicitly configured, so not probing for a free SSID; retrying in {s}s. " +
+                        "Pick a different callsign via the dashboard or DAPPS_CALLSIGN if this persists.",
+                        candidate, ReconnectBackoff.TotalSeconds);
+                    return null;
+                }
+
+                taken.Add(candidate);
+                continue;
+            }
+
+            if (walkEligible)
+            {
+                // First successful listen confirms the derived identity -
+                // persist it so every later start binds it directly.
+                DbStartup.ConfirmDerivedCallsign(candidate);
+                if (taken.Count > 0)
+                {
+                    logger.LogInformation(
+                        "RHP inbound: derived callsign {winner} — {taken} was taken on the node",
+                        candidate, string.Join(", ", taken.Select(t => $"-{t.Split('-')[^1]}")));
+                    // Reload so every consumer (outbound forwarder,
+                    // beacons, UI) sees the confirmed identity. The
+                    // OnChange this fires cancels the current cycle; the
+                    // reconnect binds the winner via the normal
+                    // non-walking path (the marker is cleared).
+                    ReloadOptionsStore();
+                }
+            }
+
+            return (handle, candidate);
+        }
+
+        // Every candidate SSID is taken on the node. Park in setup-
+        // required mode rather than hammering the node every reconnect;
+        // the operator pins an identity via the dashboard /
+        // DAPPS_CALLSIGN, or the next daemon restart re-derives and
+        // probes again.
+        logger.LogError(
+            "RHP inbound: no free SSID for the derived callsign {call} — every candidate ({candidates}) is taken " +
+            "on the node. Reverting to setup-required mode; configure a callsign via the dashboard or DAPPS_CALLSIGN.",
+            opts.Callsign, string.Join(", ", candidates));
+        DbStartup.AbandonDerivedCallsign();
+        ReloadOptionsStore();
+        return null;
+    }
+
+    /// <summary>
+    /// The SSID probe order for a derived callsign: the derivation
+    /// itself first, then the SSIDs after it in order (start+1 … 15,
+    /// then wrapping to 1 … start−1), skipping 0 (the node's bare
+    /// callsign) and the SSID the node itself uses (parsed off
+    /// PDN_NODE_CALLSIGN).
+    /// </summary>
+    internal static IReadOnlyList<string> SsidProbeCandidates(string derivedCallsign, string? nodeCallsign)
+    {
+        var dash = derivedCallsign.LastIndexOf('-');
+        var baseCall = dash > 0 ? derivedCallsign[..dash] : derivedCallsign;
+        var start = dash > 0 && int.TryParse(derivedCallsign[(dash + 1)..], out var s) ? s : 0;
+
+        var nodeSsid = 0;
+        if (!string.IsNullOrWhiteSpace(nodeCallsign))
+        {
+            var nodeDash = nodeCallsign.LastIndexOf('-');
+            if (nodeDash > 0 && int.TryParse(nodeCallsign[(nodeDash + 1)..], out var ns)) nodeSsid = ns;
+        }
+
+        var candidates = new List<string>(16) { derivedCallsign };
+        for (var offset = 1; offset <= 15; offset++)
+        {
+            var ssid = ((start - 1 + offset) % 15) + 1; // start+1 … 15, then 1 … start−1; never 0
+            if (ssid == start || ssid == nodeSsid) continue;
+            candidates.Add($"{baseCall}-{ssid}");
+        }
+        return candidates;
+    }
+
+    private void ReloadOptionsStore()
+    {
+        // In production IOptionsMonitor<SystemOptions> is the
+        // SystemOptionsStore singleton; re-read it so CurrentValue
+        // reflects what the probe just persisted.
+        (options as SystemOptionsStore)?.Reload();
+    }
 }