Qualify firewall layouts and keep device names compatible with JS target

docs/firewall-tunnel-followup-20261008.md

@@ -27,9 +27,29 @@ local JSON. They are not exposed as controls that claim to open or close real po
 The existing OpenWrt management screen remains linked. Actual node firewall rule
 inspection/editing and the complete app exposure workflow are still separate work.
 
-Validation checkpoint: 21 focused UI tests passed before the final background
-resolver and pending-operation display additions. Those additions, the complete
-app typecheck, responsive rendered-route/background checks and production build
-remain queued behind IndeeHub recovery qualification. No live acceptance is claimed.
-The backend peer-safety changes are isolated separately and also require tests and
-paired helper deployment before these new mutation controls can be enabled.
+Validation: current focused tests pass 25/25 (22 component cases plus three
+background resolver cases), and the full app typecheck passes. Typecheck exposed
+an unsupported replaceAll call and a test-wrapper assertion; both were corrected
+and the changed device test file was rerun successfully (16/16).
+
+Source browser fixtures pass at 320, 390, 768 and 1440 pixels: full content width,
+right-aligned values, no horizontal overflow, QR containment and unavailable
+mutation controls against the old-backend fixture. A routed source fixture using
+the same background resolver preserved the rendered Network background when
+entering Firewalls & tunnels. This is not a full production Dashboard acceptance
+or a live-node test. All RPC replies were synthetic; no node mutation occurred.
+
+Local receipts:
+- `/tmp/archy-firewall-focused-current-20261008.log` — three background tests.
+- `/tmp/archy-firewall-focused-components-20261008.log` — 22 component tests.
+- `/tmp/archy-firewall-device-final-20261008.log` — corrected device tests.
+- `/tmp/archy-firewall-typecheck-20261008.log` — successful exit 0, no diagnostics.
+- `/tmp/archy-firewall-responsive-20261008.log` — all four rendered viewport cases.
+- `/tmp/archy-firewall-fixture-server.mjs` and
+  `/tmp/archy-firewall-responsive.cjs` — the source fixture harnesses.
+
+Production build and live acceptance remain pending. The backend peer-safety
+changes are isolated separately; actual ephemeral-kernel helper qualification
+passed, but Rust compilation/tests and paired helper deployment remain required
+before the new mutation controls can be enabled on a node. Task 18 remains open
+for broader host firewall management, persistence and rollback.