diff --git a/demos/moveit_pick_place/README.md b/demos/moveit_pick_place/README.md
index 11fe34e..eeb7cd6 100644
--- a/demos/moveit_pick_place/README.md
+++ b/demos/moveit_pick_place/README.md
@@ -73,7 +73,27 @@ Use the interactive arm controller to send joint trajectories:
 ```
 
 The script sends goals directly to the `panda_arm_controller/follow_joint_trajectory` action.
-It works both from outside (via `docker exec`) and from inside the container.
+It works both from outside (via `docker exec`, no TTY required) and from inside the container.
+Where there is no `docker` CLI (inside the container), it uses the local `ros2`. Where there
+is one, it uses a local `ros2` only if `ros2 action list` shows the arm action; it asks twice,
+because a first listing without a running `ros2` daemon can miss it. Otherwise it runs the
+goal through `docker exec` in the demo container.
+
+`pick_place_loop.py` keeps sending its own goals to the same controller, so a manual move
+can be preempted mid-motion by the demo's own workload. `move-arm.sh` reports the goal's
+real final status: if the controller aborts it (`error_string: Current goal preempted by
+new incoming action`), the script prints `Failed: <pose> (status: ABORTED)` and exits
+non-zero instead of claiming success. `./move-arm.sh demo` runs all three steps regardless
+of earlier failures and reports each one; the command exits non-zero if any step failed.
+
+Each `ros2 action send_goal` run is limited to 30 seconds. The controller can fail to
+deliver the goal response to a freshly started CLI (the container log shows `Failed to send
+goal response`); it then never runs that goal. When the CLI printed `Sending goal:` and no
+goal response arrived, the script sends the goal again, up to three times. A goal that was
+accepted is never sent twice: if its result does not arrive in time, the script prints
+`Failed: <pose> (status: UNKNOWN)`. A goal that was never sent (no demo container, no action
+server within 30 seconds, a `ros2` error) is not sent again: the script prints the command's
+output and `Failed: <pose> (goal not sent: ...)`, and exits non-zero.
 
 ### 4. Viewing Logs
 
@@ -209,6 +229,10 @@ curl http://localhost:8080/api/v1/apps/move-group/operations | jq
 curl http://localhost:8080/api/v1/faults | jq
 ```
 
+While the fault manager is not available (for example right after startup), `GET /faults`
+answers `503`. `./check-faults.sh` then prints `Could not read faults (HTTP 503)` and exits
+non-zero; it reports "No active faults" only after a successful read of an empty list.
+
 ### Clear All Faults
 
 ```bash
@@ -308,8 +332,8 @@ The gateway supports condition-based triggers that fire when specific events occ
 
 ### How It Works
 
-1. `setup-triggers.sh` creates a trigger via `POST /api/v1/apps/manipulation_monitor/triggers`:
-   - **Resource:** `/api/v1/apps/manipulation_monitor/faults` (watches fault collection)
+1. `setup-triggers.sh` creates a trigger via `POST /api/v1/apps/manipulation-monitor/triggers`:
+   - **Resource:** `/api/v1/apps/manipulation-monitor/faults` (watches fault collection)
    - **Condition:** `OnChange` (fires on any new or updated fault)
    - **Multishot:** `true` (fires repeatedly, not just once)
    - **Lifetime:** 3600 seconds (auto-expires after 1 hour)
@@ -320,23 +344,23 @@ The gateway supports condition-based triggers that fire when specific events occ
 
 ```bash
 # Create a trigger
-curl -X POST http://localhost:8080/api/v1/apps/manipulation_monitor/triggers \
+curl -X POST http://localhost:8080/api/v1/apps/manipulation-monitor/triggers \
   -H "Content-Type: application/json" \
   -d '{
-    "resource": "/api/v1/apps/manipulation_monitor/faults",
+    "resource": "/api/v1/apps/manipulation-monitor/faults",
     "trigger_condition": {"condition_type": "OnChange"},
     "multishot": true,
     "lifetime": 3600
   }' | jq
 
 # List triggers
-curl http://localhost:8080/api/v1/apps/manipulation_monitor/triggers | jq
+curl http://localhost:8080/api/v1/apps/manipulation-monitor/triggers | jq
 
 # Watch events (replace TRIGGER_ID)
-curl -N http://localhost:8080/api/v1/apps/manipulation_monitor/triggers/TRIGGER_ID/events
+curl -N http://localhost:8080/api/v1/apps/manipulation-monitor/triggers/TRIGGER_ID/events
 
 # Delete a trigger
-curl -X DELETE http://localhost:8080/api/v1/apps/manipulation_monitor/triggers/TRIGGER_ID
+curl -X DELETE http://localhost:8080/api/v1/apps/manipulation-monitor/triggers/TRIGGER_ID
 ```
 
 ## Fault Injection Scenarios
@@ -445,7 +469,7 @@ Container scripts are stored under `/var/lib/ros2_medkit/scripts/moveit-planning
 | Docker build fails | Apt package missing | Check if MoveIt 2 Jazzy packages are available |
 | "MoveGroup not available" | Slow startup | Wait 60-90 seconds after container starts |
 | Controller not loading | Missing config | Verify `moveit_controllers.yaml` is correct |
-| Joint states empty | Controllers not loaded | Check `ros2 control list_controllers` inside container |
+| Joint states empty (`check-entities.sh` prints "Joint state data not available") | Controllers not loaded | Check `ros2 control list_controllers` inside container |
 | `ros2` CLI hangs in `docker exec` | DDS discovery across container boundaries | Use gateway REST API instead of `ros2` CLI for parameter/service operations |
 
 ## Comparison with Other Demos
diff --git a/demos/moveit_pick_place/check-entities.sh b/demos/moveit_pick_place/check-entities.sh
index 3a32ef0..70412a6 100755
--- a/demos/moveit_pick_place/check-entities.sh
+++ b/demos/moveit_pick_place/check-entities.sh
@@ -40,24 +40,31 @@ echo_step "1. Areas (Functional Groupings)"
 curl -s "${API_BASE}/areas" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "2. Components (Hardware/Logical Units)"
-curl -s "${API_BASE}/components" | jq '.items[] | {id: .id, name: .name, type: .type, area: .area}'
+curl -s "${API_BASE}/components" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "3. Apps (ROS 2 Nodes)"
-curl -s "${API_BASE}/apps" | jq '.items[] | {id: .id, name: .name, category: .category, component: .is_located_on}'
+curl -s "${API_BASE}/apps" | jq '.items[] | {id: .id, name: .name, description: .description, component: .["x-medkit"].component_id}'
 
 echo_step "4. Functions (High-level Capabilities)"
-curl -s "${API_BASE}/functions" | jq '.items[] | {id: .id, name: .name, category: .category, hosted_by: .hosted_by}'
+curl -s "${API_BASE}/functions" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "5. Sample Data (Joint States)"
 echo "Getting latest joint states from Panda arm..."
-curl -s "${API_BASE}/apps/joint-state-broadcaster/data/joint_states" 2>/dev/null | jq '{
-    joint_names: .data.name,
-    positions: .data.position,
-    velocities: .data.velocity
-}' || echo "   (Joint state data not available — robot may still be starting)"
+# An error body or a reply without data (no /joint_states publisher) has no
+# joint names, and jq still exits 0 on it.
+JOINT_STATES=$(curl -s "${API_BASE}/apps/joint-state-broadcaster/data/joint_states" 2>/dev/null) || JOINT_STATES=""
+if jq -e '.data.name | arrays | length > 0' <<< "${JOINT_STATES}" > /dev/null 2>&1; then
+    jq '{
+        joint_names: .data.name,
+        positions: .data.position,
+        velocities: .data.velocity
+    }' <<< "${JOINT_STATES}"
+else
+    echo "   (Joint state data not available - the robot may still be starting, or joint_state_broadcaster is not running)"
+fi
 
 echo_step "6. Faults"
-curl -s "${API_BASE}/faults" | jq '.items[] | {code: .code, severity: .severity, reporter: .reporter_id}'
+curl -s "${API_BASE}/faults" | jq '.items[] | {code: .fault_code, severity: .severity_label, status: .status, sources: .reporting_sources}'
 
 echo ""
 echo -e "${GREEN}✓ Entity hierarchy exploration complete!${NC}"
diff --git a/demos/moveit_pick_place/check-faults.sh b/demos/moveit_pick_place/check-faults.sh
index 51ac30b..72273c4 100755
--- a/demos/moveit_pick_place/check-faults.sh
+++ b/demos/moveit_pick_place/check-faults.sh
@@ -25,12 +25,19 @@ fi
 echo "✓ Gateway is healthy"
 echo ""
 
-# Get all faults
+# Get all faults. A failed read is not "no faults": the gateway answers 503
+# while the fault manager is unavailable (for example during startup).
 echo "📋 Active Faults:"
-FAULTS=$(curl -s "${API_BASE}/faults")
+RESPONSE=$(curl -s -m 30 -w '\n%{http_code}' "${API_BASE}/faults") || true
+HTTP_CODE="${RESPONSE##*$'\n'}"
+FAULTS="${RESPONSE%$'\n'*}"
 
-# Check if there are any faults
-FAULT_COUNT=$(echo "$FAULTS" | jq '.items | length')
+if [ "$HTTP_CODE" != "200" ] || ! FAULT_COUNT=$(echo "$FAULTS" | jq -e '.items | arrays | length' 2>/dev/null); then
+    DETAIL=$(echo "$FAULTS" | jq -r '[.message, .parameters.details] | map(select(. != null)) | join(": ")' 2>/dev/null)
+    echo "❌ Could not read faults (HTTP ${HTTP_CODE:-000})${DETAIL:+: ${DETAIL}}"
+    echo "   The fault list is unknown, not empty. Retry in a few seconds."
+    exit 1
+fi
 
 if [ "$FAULT_COUNT" = "0" ]; then
     echo "   No active faults — system is healthy! ✅"
diff --git a/demos/moveit_pick_place/move-arm.sh b/demos/moveit_pick_place/move-arm.sh
index 91af056..7d5593a 100755
--- a/demos/moveit_pick_place/move-arm.sh
+++ b/demos/moveit_pick_place/move-arm.sh
@@ -12,13 +12,19 @@
 
 set -eu
 
-CONTAINER="${CONTAINER_NAME:-$(docker ps --format '{{.Names}}' | grep -E '^moveit_medkit_demo(_nvidia)?(_local)?$' | head -n1)}"
 ACTION="/panda_arm_controller/follow_joint_trajectory"
 JOINT_NAMES='["panda_joint1","panda_joint2","panda_joint3","panda_joint4","panda_joint5","panda_joint6","panda_joint7"]'
 
 # Duration in seconds for trajectory execution
 DURATION_SEC=3
 
+# Time limit for one `ros2 action send_goal` run, and how many runs per goal.
+# The controller can fail to deliver the goal response to a new CLI
+# ("Failed to send goal response"). It then never runs the goal and the CLI
+# waits forever, so a goal with no response is sent again.
+SEND_TIMEOUT_SEC=30
+SEND_ATTEMPTS=3
+
 # --- Preset joint positions (radians) ---
 # Ready: default MoveIt pose (from SRDF)
 READY="[0.0, -0.785, 0.0, -2.356, 0.0, 1.571, 0.785]"
@@ -45,6 +51,51 @@ RIGHT="[1.5, -0.785, 0.0, -2.356, 0.0, 1.571, 0.785]"
 WAVE="[0.0, -1.0, 0.0, -0.5, 0.0, 2.5, 0.785]"
 
 
+have() {
+    command -v "$1" &> /dev/null
+}
+
+# True only if a LOCAL ros2 can actually reach the target action server.
+# `ros2 node list` exits 0 even on an empty graph (wrong ROS_DOMAIN_ID, no
+# multicast route), so a host with ROS 2 sourced but not connected to the
+# demo looks identical to being inside the container. Checking that the
+# action itself is listed avoids that false positive. A cold listing (no
+# ros2 daemon yet) can miss a running server, so a miss is listed once more.
+can_reach_action_locally() {
+    have ros2 || return 1
+    ros2 action list 2> /dev/null | grep -qFx "${ACTION}" \
+        || ros2 action list 2> /dev/null | grep -qFx "${ACTION}"
+}
+
+# Picks how goals are sent: USE_LOCAL=true for the local ros2, else
+# `docker exec` into CONTAINER. Without a docker CLI the script runs inside
+# the container or on a ROS host, so the local ros2 is the only way.
+# On failure sets NOT_SENT_REASON and returns 1.
+USE_LOCAL=""
+CONTAINER=""
+NOT_SENT_REASON=""
+choose_transport() {
+    [[ -z "${USE_LOCAL}" ]] || return 0
+    if ! have docker; then
+        if ! have ros2; then
+            NOT_SENT_REASON="needs the docker CLI or a sourced ROS 2 (ros2 CLI), found neither"
+            return 1
+        fi
+        USE_LOCAL=true
+        return 0
+    fi
+    if can_reach_action_locally; then
+        USE_LOCAL=true
+        return 0
+    fi
+    CONTAINER="${CONTAINER_NAME:-$(docker ps --format '{{.Names}}' | grep -E '^moveit_medkit_demo(_nvidia)?(_local)?$' | head -n1)}"
+    if [[ -z "${CONTAINER}" ]]; then
+        NOT_SENT_REASON="no running moveit_medkit_demo container, start it with ./run-demo.sh or set CONTAINER_NAME"
+        return 1
+    fi
+    USE_LOCAL=false
+}
+
 send_trajectory() {
     local positions="$1"
     local label="$2"
@@ -64,27 +115,76 @@ send_trajectory() {
         }
     }"
 
-    # Check if we're inside the container or outside
-    if command -v ros2 &> /dev/null && ros2 node list &> /dev/null 2>&1; then
-        # Inside the container (or ROS 2 env is set up)
-        ros2 action send_goal "${ACTION}" \
-            control_msgs/action/FollowJointTrajectory \
-            "${goal_msg}" \
-            --feedback
-    else
-        # Outside — exec into container
-        docker exec -it "${CONTAINER}" bash -c "
-            source /opt/ros/jazzy/setup.bash && \
-            source /root/demo_ws/install/setup.bash && \
-            ros2 action send_goal ${ACTION} \
-                control_msgs/action/FollowJointTrajectory \
-                \"${goal_msg}\" \
-                --feedback
-        "
+    if ! choose_transport; then
+        echo "Failed: ${label} (goal not sent: ${NOT_SENT_REASON})" >&2
+        return 1
     fi
 
+    # `ros2 action send_goal` always exits 0, whatever the goal's outcome -
+    # the real result is in its own printed "Goal finished with status:"
+    # line, so capture output and parse that instead of the exit code.
+    # PYTHONUNBUFFERED keeps the lines printed before a timeout kills the CLI.
+    local attempt output rc
+    for ((attempt = 1; attempt <= SEND_ATTEMPTS; attempt++)); do
+        rc=0
+        if [[ "${USE_LOCAL}" == true ]]; then
+            output=$(PYTHONUNBUFFERED=1 timeout "${SEND_TIMEOUT_SEC}" \
+                ros2 action send_goal "${ACTION}" \
+                control_msgs/action/FollowJointTrajectory \
+                "${goal_msg}" \
+                --feedback 2>&1) || rc=$?
+        else
+            # Outside the container: exec into it. No -it: this must also
+            # work without a TTY (CI, a pipe), and the command needs no stdin.
+            # timeout runs in the container: killing `docker exec` would
+            # leave the CLI running there.
+            output=$(docker exec "${CONTAINER}" bash -c "
+                source /opt/ros/jazzy/setup.bash && \
+                source /root/demo_ws/install/setup.bash && \
+                PYTHONUNBUFFERED=1 timeout ${SEND_TIMEOUT_SEC} \
+                ros2 action send_goal ${ACTION} \
+                    control_msgs/action/FollowJointTrajectory \
+                    \"${goal_msg}\" \
+                    --feedback
+            " 2>&1) || rc=$?
+        fi
+        printf '%s\n' "${output}"
+        # An accepted or rejected goal has its answer.
+        if grep -qE '^(Goal accepted with ID|Goal was rejected)' <<< "${output}"; then
+            break
+        fi
+        # Never sent (no container, no action server, a CLI error): sending
+        # again changes nothing. rc 124 is the timeout.
+        if ! grep -q '^Sending goal:' <<< "${output}"; then
+            if ((rc == 124)) && grep -q '^Waiting for an action server' <<< "${output}"; then
+                echo "Failed: ${label} (goal not sent: no action server ${ACTION} within ${SEND_TIMEOUT_SEC} s)" >&2
+            elif ((rc == 124)); then
+                echo "Failed: ${label} (goal not sent: timed out after ${SEND_TIMEOUT_SEC} s)" >&2
+            else
+                echo "Failed: ${label} (goal not sent: exit status ${rc})" >&2
+            fi
+            return 1
+        fi
+        # Sent with no response: the controller never runs it, so send again.
+        if ((attempt < SEND_ATTEMPTS)); then
+            if ((rc == 124)); then
+                echo "No goal response within ${SEND_TIMEOUT_SEC} s, sending the goal again"
+            else
+                echo "No goal response (exit status ${rc}), sending the goal again"
+            fi
+        fi
+    done
+
+    local status
+    status=$(printf '%s\n' "${output}" | grep -F 'Goal finished with status:' | tail -n1 | sed -E 's/.*status: *//')
+
     echo ""
-    echo "✅ Done: ${label}"
+    if [[ "${status}" == "SUCCEEDED" ]]; then
+        echo "✅ Done: ${label}"
+        return 0
+    fi
+    echo "Failed: ${label} (status: ${status:-UNKNOWN})" >&2
+    return 1
 }
 
 show_menu() {
@@ -110,13 +210,19 @@ show_menu() {
 run_demo_cycle() {
     echo "🔄 Running pick → place → home cycle..."
     echo ""
-    send_trajectory "${PICK}" "pick"
+    local failed=0
+    send_trajectory "${PICK}" "pick" || failed=1
     sleep 2
-    send_trajectory "${PLACE}" "place"
+    send_trajectory "${PLACE}" "place" || failed=1
     sleep 2
-    send_trajectory "${READY}" "ready (home)"
+    send_trajectory "${READY}" "ready (home)" || failed=1
     echo ""
-    echo "🔄 Cycle complete!"
+    if [[ "${failed}" -eq 0 ]]; then
+        echo "🔄 Cycle complete!"
+    else
+        echo "🔄 Cycle complete with failures" >&2
+    fi
+    return "${failed}"
 }
 
 handle_choice() {
@@ -138,15 +244,20 @@ handle_choice() {
 
 # --- Main ---
 
-# If argument provided, run directly
+# If argument provided, run directly. Reflect the goal's real result in the
+# exit code instead of always exiting 0.
 if [[ $# -gt 0 ]]; then
-    handle_choice "$1"
-    exit 0
+    if handle_choice "$1"; then
+        exit 0
+    else
+        exit 1
+    fi
 fi
 
-# Interactive mode
+# Interactive mode. A failed goal reports failure and the menu continues -
+# it must not kill the session (set -e would, without this guard).
 while true; do
     show_menu
     read -rp "Choose position (1-8, d, q): " choice
-    handle_choice "${choice}"
+    handle_choice "${choice}" || true
 done
diff --git a/demos/multi_ecu_aggregation/Dockerfile b/demos/multi_ecu_aggregation/Dockerfile
index 4f1363f..a446e4e 100644
--- a/demos/multi_ecu_aggregation/Dockerfile
+++ b/demos/multi_ecu_aggregation/Dockerfile
@@ -49,10 +49,6 @@ COPY src/ ${COLCON_WS}/src/multi_ecu_demo/src/
 COPY config/ ${COLCON_WS}/src/multi_ecu_demo/config/
 COPY launch/ ${COLCON_WS}/src/multi_ecu_demo/launch/
 
-# Copy container scripts
-COPY container_scripts/ /var/lib/ros2_medkit/scripts/
-RUN find /var/lib/ros2_medkit/scripts -name "*.bash" -exec chmod +x {} \;
-
 # Build all packages (skip test dependencies that aren't in ros-base)
 WORKDIR ${COLCON_WS}
 RUN bash -c "source /opt/ros/jazzy/setup.bash && \
@@ -61,6 +57,11 @@ RUN bash -c "source /opt/ros/jazzy/setup.bash && \
       --skip-keys='ament_cmake_clang_format ament_cmake_clang_tidy test_msgs example_interfaces sqlite3' && \
     MAKEFLAGS='-j 2' colcon build --executor sequential --symlink-install --cmake-args -DBUILD_TESTING=OFF"
 
+# Copy container scripts. Not a build input: kept after colcon build so a
+# script-only change does not invalidate the compile cache.
+COPY container_scripts/ /var/lib/ros2_medkit/scripts/
+RUN find /var/lib/ros2_medkit/scripts -name "*.bash" -exec chmod +x {} \;
+
 # Setup environment
 RUN echo "source /opt/ros/jazzy/setup.bash" >> ~/.bashrc && \
     echo "source ${COLCON_WS}/install/setup.bash" >> ~/.bashrc
diff --git a/demos/multi_ecu_aggregation/README.md b/demos/multi_ecu_aggregation/README.md
index 6e052a1..4cc0803 100644
--- a/demos/multi_ecu_aggregation/README.md
+++ b/demos/multi_ecu_aggregation/README.md
@@ -337,6 +337,31 @@ curl -X POST http://localhost:8080/api/v1/components/actuation-ecu/scripts/injec
   -d '{"execution_type":"now"}' | jq
 ```
 
+### How the Scripts Change Parameters
+
+Each script sets node parameters through its own ECU's gateway, with the
+configuration API. The same call works from the host through the perception
+gateway:
+
+```bash
+curl -X PUT http://localhost:8080/api/v1/apps/path-planner/configurations/planning_delay_ms \
+  -H "Content-Type: application/json" -d '{"value": 5000}'
+```
+
+A script whose write is refused exits non-zero, and the execution's error
+message names each failed write, for example
+`FAIL: gripper-controller/inject_jam (HTTP 409)`. `restore-normal` clears the
+ECU's faults only after all its writes succeeded. It clears twice, 2 s apart,
+and the second clear decides the result. If that clear fails, the script exits
+non-zero and the error names the status it got, for example
+`FAIL: clear faults (HTTP 503)` while the ECU's fault manager does not answer.
+The ECU may then still hold faults.
+
+`path-planner` runs its planning timer in its own callback group, so its
+parameters stay writable while `inject-planning-delay` is active, and a new
+`planning_delay_ms` also shortens the cycle already in progress.
+`restore-normal` right after `inject-planning-delay` takes a few seconds.
+
 ### Available Scripts per ECU
 
 | ECU | Script | Description |
diff --git a/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/inject-gripper-jam/script.bash b/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/inject-gripper-jam/script.bash
index 6913093..7f05905 100644
--- a/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/inject-gripper-jam/script.bash
+++ b/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/inject-gripper-jam/script.bash
@@ -2,14 +2,32 @@
 # Inject gripper jam - gripper controller stuck
 set -eu
 
-# ROS setup.bash dereferences AMENT_TRACE_SETUP_FILES; relax nounset around it.
-set +u
-# shellcheck source=/dev/null
-source /opt/ros/jazzy/setup.bash
-# shellcheck source=/dev/null
-source /root/demo_ws/install/setup.bash
-set -u
-
-ros2 param set /actuation/gripper_controller inject_jam true
+GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
+API_BASE="${GATEWAY_URL}/api/v1"
+
+ERRORS=0
+
+# Sets one parameter through this ECU's gateway. A refused write is named on
+# stderr, which the Scripts API returns as the error message.
+put_config() {
+    local app="$1" param="$2" value="$3" code
+    code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}") || true
+    case "$code" in
+        2??) echo "${app}: ${param}=${value}" ;;
+        *)
+            echo "FAIL: ${app}/${param} (HTTP ${code})" >&2
+            ERRORS=$((ERRORS + 1))
+            ;;
+    esac
+}
+
+put_config gripper-controller inject_jam true
+
+if [ "$ERRORS" -gt 0 ]; then
+    echo "${ERRORS} parameter write(s) failed" >&2
+    exit 1
+fi
 
 echo '{"status": "injected", "parameter": "inject_jam", "value": true}'
diff --git a/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/restore-normal/script.bash b/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/restore-normal/script.bash
index a7d6e72..02005f6 100644
--- a/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/restore-normal/script.bash
+++ b/demos/multi_ecu_aggregation/container_scripts/actuation-ecu/restore-normal/script.bash
@@ -1,41 +1,62 @@
 #!/bin/bash
-# Reset all actuation node parameters to defaults
+# Reset all actuation node parameters to defaults and clear faults
 set -eu
 
-# ROS setup.bash dereferences AMENT_TRACE_SETUP_FILES; relax nounset around it.
-set +u
-# shellcheck source=/dev/null
-source /opt/ros/jazzy/setup.bash
-# shellcheck source=/dev/null
-source /root/demo_ws/install/setup.bash
-set -u
+GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
+API_BASE="${GATEWAY_URL}/api/v1"
 
 ERRORS=0
 
+# Sets one parameter through this ECU's gateway. A refused write is named on
+# stderr, which the Scripts API returns as the error message.
+put_config() {
+    local app="$1" param="$2" value="$3" code
+    code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}") || true
+    case "$code" in
+        2??) echo "${app}: ${param}=${value}" ;;
+        *)
+            echo "FAIL: ${app}/${param} (HTTP ${code})" >&2
+            ERRORS=$((ERRORS + 1))
+            ;;
+    esac
+}
+
 # Motor controller
-ros2 param set /actuation/motor_controller torque_noise 0.01 || ERRORS=$((ERRORS + 1))
-ros2 param set /actuation/motor_controller failure_probability 0.0 || ERRORS=$((ERRORS + 1))
+put_config motor-controller torque_noise 0.01
+put_config motor-controller failure_probability 0.0
 
 # Joint driver
-ros2 param set /actuation/joint_driver inject_overheat false || ERRORS=$((ERRORS + 1))
-ros2 param set /actuation/joint_driver drift_rate 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /actuation/joint_driver failure_probability 0.0 || ERRORS=$((ERRORS + 1))
+put_config joint-driver inject_overheat false
+put_config joint-driver drift_rate 0.0
+put_config joint-driver failure_probability 0.0
 
 # Gripper controller
-ros2 param set /actuation/gripper_controller inject_jam false || ERRORS=$((ERRORS + 1))
-ros2 param set /actuation/gripper_controller failure_probability 0.0 || ERRORS=$((ERRORS + 1))
+put_config gripper-controller inject_jam false
+put_config gripper-controller failure_probability 0.0
 
-if [ $ERRORS -gt 0 ]; then
-    echo "{\"status\": \"partial\", \"errors\": $ERRORS}"
+if [ "$ERRORS" -gt 0 ]; then
+    echo "${ERRORS} parameter write(s) failed" >&2
     exit 1
 fi
 
-# Clear faults
-GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
-API_BASE="${GATEWAY_URL}/api/v1"
+# Clears the faults of this ECU's fault manager. Prints the HTTP status.
+clear_faults() {
+    curl -s -m 30 -o /dev/null -w '%{http_code}' -X DELETE "${API_BASE}/faults" || true
+}
+
+# The second clear decides the result.
 echo "Clearing faults..."
-curl -sf -X DELETE "${API_BASE}/faults" > /dev/null 2>&1 || true
+clear_faults > /dev/null
 sleep 2
-curl -sf -X DELETE "${API_BASE}/faults" > /dev/null 2>&1 || true
+code=$(clear_faults)
+case "$code" in
+    2??) ;;
+    *)
+        echo "FAIL: clear faults (HTTP ${code})" >&2
+        exit 1
+        ;;
+esac
 
 echo '{"status": "restored", "ecu": "actuation"}'
diff --git a/demos/multi_ecu_aggregation/container_scripts/perception-ecu/inject-sensor-failure/script.bash b/demos/multi_ecu_aggregation/container_scripts/perception-ecu/inject-sensor-failure/script.bash
index 4d784ce..8e4edc6 100644
--- a/demos/multi_ecu_aggregation/container_scripts/perception-ecu/inject-sensor-failure/script.bash
+++ b/demos/multi_ecu_aggregation/container_scripts/perception-ecu/inject-sensor-failure/script.bash
@@ -2,14 +2,32 @@
 # Inject LiDAR sensor failure - high failure probability
 set -eu
 
-# ROS setup.bash dereferences AMENT_TRACE_SETUP_FILES; relax nounset around it.
-set +u
-# shellcheck source=/dev/null
-source /opt/ros/jazzy/setup.bash
-# shellcheck source=/dev/null
-source /root/demo_ws/install/setup.bash
-set -u
-
-ros2 param set /perception/lidar_driver failure_probability 0.8
+GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
+API_BASE="${GATEWAY_URL}/api/v1"
+
+ERRORS=0
+
+# Sets one parameter through this ECU's gateway. A refused write is named on
+# stderr, which the Scripts API returns as the error message.
+put_config() {
+    local app="$1" param="$2" value="$3" code
+    code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}") || true
+    case "$code" in
+        2??) echo "${app}: ${param}=${value}" ;;
+        *)
+            echo "FAIL: ${app}/${param} (HTTP ${code})" >&2
+            ERRORS=$((ERRORS + 1))
+            ;;
+    esac
+}
+
+put_config lidar-driver failure_probability 0.8
+
+if [ "$ERRORS" -gt 0 ]; then
+    echo "${ERRORS} parameter write(s) failed" >&2
+    exit 1
+fi
 
 echo '{"status": "injected", "parameter": "failure_probability", "value": 0.8}'
diff --git a/demos/multi_ecu_aggregation/container_scripts/perception-ecu/restore-normal/script.bash b/demos/multi_ecu_aggregation/container_scripts/perception-ecu/restore-normal/script.bash
index 23d7e73..f9c5a5b 100644
--- a/demos/multi_ecu_aggregation/container_scripts/perception-ecu/restore-normal/script.bash
+++ b/demos/multi_ecu_aggregation/container_scripts/perception-ecu/restore-normal/script.bash
@@ -1,49 +1,70 @@
 #!/bin/bash
-# Reset all perception node parameters to defaults
+# Reset all perception node parameters to defaults and clear faults
 set -eu
 
-# ROS setup.bash dereferences AMENT_TRACE_SETUP_FILES; relax nounset around it.
-set +u
-# shellcheck source=/dev/null
-source /opt/ros/jazzy/setup.bash
-# shellcheck source=/dev/null
-source /root/demo_ws/install/setup.bash
-set -u
+GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
+API_BASE="${GATEWAY_URL}/api/v1"
 
 ERRORS=0
 
+# Sets one parameter through this ECU's gateway. A refused write is named on
+# stderr, which the Scripts API returns as the error message.
+put_config() {
+    local app="$1" param="$2" value="$3" code
+    code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}") || true
+    case "$code" in
+        2??) echo "${app}: ${param}=${value}" ;;
+        *)
+            echo "FAIL: ${app}/${param} (HTTP ${code})" >&2
+            ERRORS=$((ERRORS + 1))
+            ;;
+    esac
+}
+
 # LiDAR driver
-ros2 param set /perception/lidar_driver failure_probability 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/lidar_driver inject_nan false || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/lidar_driver noise_stddev 0.01 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/lidar_driver drift_rate 0.0 || ERRORS=$((ERRORS + 1))
+put_config lidar-driver failure_probability 0.0
+put_config lidar-driver inject_nan false
+put_config lidar-driver noise_stddev 0.01
+put_config lidar-driver drift_rate 0.0
 
 # Camera driver
-ros2 param set /perception/camera_driver failure_probability 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/camera_driver noise_level 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/camera_driver inject_black_frames false || ERRORS=$((ERRORS + 1))
+put_config camera-driver failure_probability 0.0
+put_config camera-driver noise_level 0.0
+put_config camera-driver inject_black_frames false
 
 # Point cloud filter
-ros2 param set /perception/point_cloud_filter failure_probability 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/point_cloud_filter drop_rate 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/point_cloud_filter delay_ms 0 || ERRORS=$((ERRORS + 1))
+put_config point-cloud-filter failure_probability 0.0
+put_config point-cloud-filter drop_rate 0.0
+put_config point-cloud-filter delay_ms 0
 
 # Object detector
-ros2 param set /perception/object_detector failure_probability 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/object_detector false_positive_rate 0.0 || ERRORS=$((ERRORS + 1))
-ros2 param set /perception/object_detector miss_rate 0.0 || ERRORS=$((ERRORS + 1))
+put_config object-detector failure_probability 0.0
+put_config object-detector false_positive_rate 0.0
+put_config object-detector miss_rate 0.0
 
-if [ $ERRORS -gt 0 ]; then
-    echo "{\"status\": \"partial\", \"errors\": $ERRORS}"
+if [ "$ERRORS" -gt 0 ]; then
+    echo "${ERRORS} parameter write(s) failed" >&2
     exit 1
 fi
 
-# Clear faults
-GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
-API_BASE="${GATEWAY_URL}/api/v1"
+# Clears the faults of this ECU's fault manager. Prints the HTTP status.
+clear_faults() {
+    curl -s -m 30 -o /dev/null -w '%{http_code}' -X DELETE "${API_BASE}/faults" || true
+}
+
+# The second clear decides the result.
 echo "Clearing faults..."
-curl -sf -X DELETE "${API_BASE}/faults" > /dev/null 2>&1 || true
+clear_faults > /dev/null
 sleep 2
-curl -sf -X DELETE "${API_BASE}/faults" > /dev/null 2>&1 || true
+code=$(clear_faults)
+case "$code" in
+    2??) ;;
+    *)
+        echo "FAIL: clear faults (HTTP ${code})" >&2
+        exit 1
+        ;;
+esac
 
 echo '{"status": "restored", "ecu": "perception"}'
diff --git a/demos/multi_ecu_aggregation/container_scripts/planning-ecu/inject-planning-delay/script.bash b/demos/multi_ecu_aggregation/container_scripts/planning-ecu/inject-planning-delay/script.bash
index d186826..cbc93d7 100644
--- a/demos/multi_ecu_aggregation/container_scripts/planning-ecu/inject-planning-delay/script.bash
+++ b/demos/multi_ecu_aggregation/container_scripts/planning-ecu/inject-planning-delay/script.bash
@@ -2,14 +2,32 @@
 # Inject path planning delay - 5000ms processing time
 set -eu
 
-# ROS setup.bash dereferences AMENT_TRACE_SETUP_FILES; relax nounset around it.
-set +u
-# shellcheck source=/dev/null
-source /opt/ros/jazzy/setup.bash
-# shellcheck source=/dev/null
-source /root/demo_ws/install/setup.bash
-set -u
-
-ros2 param set /planning/path_planner planning_delay_ms 5000
+GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
+API_BASE="${GATEWAY_URL}/api/v1"
+
+ERRORS=0
+
+# Sets one parameter through this ECU's gateway. A refused write is named on
+# stderr, which the Scripts API returns as the error message.
+put_config() {
+    local app="$1" param="$2" value="$3" code
+    code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}") || true
+    case "$code" in
+        2??) echo "${app}: ${param}=${value}" ;;
+        *)
+            echo "FAIL: ${app}/${param} (HTTP ${code})" >&2
+            ERRORS=$((ERRORS + 1))
+            ;;
+    esac
+}
+
+put_config path-planner planning_delay_ms 5000
+
+if [ "$ERRORS" -gt 0 ]; then
+    echo "${ERRORS} parameter write(s) failed" >&2
+    exit 1
+fi
 
 echo '{"status": "injected", "parameter": "planning_delay_ms", "value": 5000}'
diff --git a/demos/multi_ecu_aggregation/container_scripts/planning-ecu/restore-normal/script.bash b/demos/multi_ecu_aggregation/container_scripts/planning-ecu/restore-normal/script.bash
index 4ff9ced..e7cf83d 100644
--- a/demos/multi_ecu_aggregation/container_scripts/planning-ecu/restore-normal/script.bash
+++ b/demos/multi_ecu_aggregation/container_scripts/planning-ecu/restore-normal/script.bash
@@ -1,40 +1,61 @@
 #!/bin/bash
-# Reset all planning node parameters to defaults
+# Reset all planning node parameters to defaults and clear faults
 set -eu
 
-# ROS setup.bash dereferences AMENT_TRACE_SETUP_FILES; relax nounset around it.
-set +u
-# shellcheck source=/dev/null
-source /opt/ros/jazzy/setup.bash
-# shellcheck source=/dev/null
-source /root/demo_ws/install/setup.bash
-set -u
+GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
+API_BASE="${GATEWAY_URL}/api/v1"
 
 ERRORS=0
 
+# Sets one parameter through this ECU's gateway. A refused write is named on
+# stderr, which the Scripts API returns as the error message.
+put_config() {
+    local app="$1" param="$2" value="$3" code
+    code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}") || true
+    case "$code" in
+        2??) echo "${app}: ${param}=${value}" ;;
+        *)
+            echo "FAIL: ${app}/${param} (HTTP ${code})" >&2
+            ERRORS=$((ERRORS + 1))
+            ;;
+    esac
+}
+
 # Path planner
-ros2 param set /planning/path_planner planning_delay_ms 0 || ERRORS=$((ERRORS + 1))
-ros2 param set /planning/path_planner failure_probability 0.0 || ERRORS=$((ERRORS + 1))
+put_config path-planner planning_delay_ms 0
+put_config path-planner failure_probability 0.0
 
 # Behavior planner
-ros2 param set /planning/behavior_planner inject_wrong_direction false || ERRORS=$((ERRORS + 1))
-ros2 param set /planning/behavior_planner failure_probability 0.0 || ERRORS=$((ERRORS + 1))
+put_config behavior-planner inject_wrong_direction false
+put_config behavior-planner failure_probability 0.0
 
 # Task scheduler
-ros2 param set /planning/task_scheduler inject_stuck false || ERRORS=$((ERRORS + 1))
-ros2 param set /planning/task_scheduler failure_probability 0.0 || ERRORS=$((ERRORS + 1))
+put_config task-scheduler inject_stuck false
+put_config task-scheduler failure_probability 0.0
 
-if [ $ERRORS -gt 0 ]; then
-    echo "{\"status\": \"partial\", \"errors\": $ERRORS}"
+if [ "$ERRORS" -gt 0 ]; then
+    echo "${ERRORS} parameter write(s) failed" >&2
     exit 1
 fi
 
-# Clear faults
-GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
-API_BASE="${GATEWAY_URL}/api/v1"
+# Clears the faults of this ECU's fault manager. Prints the HTTP status.
+clear_faults() {
+    curl -s -m 30 -o /dev/null -w '%{http_code}' -X DELETE "${API_BASE}/faults" || true
+}
+
+# The second clear decides the result.
 echo "Clearing faults..."
-curl -sf -X DELETE "${API_BASE}/faults" > /dev/null 2>&1 || true
+clear_faults > /dev/null
 sleep 2
-curl -sf -X DELETE "${API_BASE}/faults" > /dev/null 2>&1 || true
+code=$(clear_faults)
+case "$code" in
+    2??) ;;
+    *)
+        echo "FAIL: clear faults (HTTP ${code})" >&2
+        exit 1
+        ;;
+esac
 
 echo '{"status": "restored", "ecu": "planning"}'
diff --git a/demos/multi_ecu_aggregation/src/planning/path_planner.cpp b/demos/multi_ecu_aggregation/src/planning/path_planner.cpp
index d07c724..7d54558 100644
--- a/demos/multi_ecu_aggregation/src/planning/path_planner.cpp
+++ b/demos/multi_ecu_aggregation/src/planning/path_planner.cpp
@@ -8,13 +8,19 @@
 /// 10-waypoint path in the "map" frame. Offsets the path when detections are
 /// present to simulate obstacle avoidance. Supports artificial planning delay
 /// and failure probability for fault injection.
+///
+/// The planning timer runs in its own callback group on a multi-threaded
+/// executor, so parameter services answer while a planning cycle waits out
+/// the injected delay.
 
+#include <atomic>
 #include <chrono>
 #include <cmath>
+#include <condition_variable>
 #include <memory>
+#include <mutex>
 #include <random>
 #include <string>
-#include <thread>
 #include <vector>
 
 #include "diagnostic_msgs/msg/diagnostic_array.hpp"
@@ -53,6 +59,8 @@ class PathPlanner : public rclcpp::Node
       "/perception/detections", 10,
       std::bind(&PathPlanner::on_detections, this, std::placeholders::_1));
 
+    planning_group_ = this->create_callback_group(rclcpp::CallbackGroupType::MutuallyExclusive);
+
     // Create timer (with rate validation)
     double rate = planning_rate_;
     if (rate <= 0.0) {
@@ -66,7 +74,7 @@ class PathPlanner : public rclcpp::Node
     auto period = std::chrono::duration<double>(1.0 / rate);
     timer_ = this->create_wall_timer(
       std::chrono::duration_cast<std::chrono::nanoseconds>(period),
-      std::bind(&PathPlanner::plan_path, this));
+      std::bind(&PathPlanner::plan_path, this), planning_group_);
 
     // Register parameter callback
     param_callback_handle_ = this->add_on_set_parameters_callback(
@@ -91,12 +99,17 @@ class PathPlanner : public rclcpp::Node
 
     for (const auto & param : parameters) {
       if (param.get_name() == "planning_delay_ms") {
-        planning_delay_ms_ = param.as_int();
-        RCLCPP_INFO(this->get_logger(), "Planning delay changed to %ld ms", planning_delay_ms_);
+        {
+          std::lock_guard<std::mutex> lock(delay_mutex_);
+          planning_delay_ms_ = param.as_int();
+        }
+        delay_changed_.notify_all();
+        RCLCPP_INFO(
+          this->get_logger(), "Planning delay changed to %ld ms", planning_delay_ms_.load());
       } else if (param.get_name() == "failure_probability") {
         failure_probability_ = param.as_double();
         RCLCPP_INFO(
-          this->get_logger(), "Failure probability changed to %.2f", failure_probability_);
+          this->get_logger(), "Failure probability changed to %.2f", failure_probability_.load());
       } else if (param.get_name() == "planning_rate") {
         double rate = param.as_double();
         if (rate <= 0.0) {
@@ -108,7 +121,7 @@ class PathPlanner : public rclcpp::Node
         auto period = std::chrono::duration<double>(1.0 / rate);
         timer_ = this->create_wall_timer(
           std::chrono::duration_cast<std::chrono::nanoseconds>(period),
-          std::bind(&PathPlanner::plan_path, this));
+          std::bind(&PathPlanner::plan_path, this), planning_group_);
         RCLCPP_INFO(this->get_logger(), "Planning rate changed to %.1f Hz", planning_rate_);
       }
     }
@@ -125,11 +138,18 @@ class PathPlanner : public rclcpp::Node
   {
     plan_count_++;
 
-    // Intentional blocking sleep to simulate slow computation pipeline.
-    // This blocks the single-threaded executor, preventing parameter changes
-    // and other callbacks from being processed during the delay.
-    if (planning_delay_ms_ > 0) {
-      std::this_thread::sleep_for(std::chrono::milliseconds(planning_delay_ms_));
+    // Simulated slow computation: the cycle waits planning_delay_ms before it
+    // publishes. A new planning_delay_ms applies to the cycle in progress.
+    {
+      const auto start = std::chrono::steady_clock::now();
+      std::unique_lock<std::mutex> lock(delay_mutex_);
+      while (true) {
+        const auto deadline = start + std::chrono::milliseconds(planning_delay_ms_.load());
+        if (std::chrono::steady_clock::now() >= deadline) {
+          break;
+        }
+        delay_changed_.wait_until(lock, deadline);
+      }
     }
 
     // Check for failure injection
@@ -175,11 +195,11 @@ class PathPlanner : public rclcpp::Node
     if (planning_delay_ms_ > 100) {
       publish_diagnostics(
         "SLOW_PLANNING",
-        "Planning delay: " + std::to_string(planning_delay_ms_) + " ms");
+        "Planning delay: " + std::to_string(planning_delay_ms_.load()) + " ms");
     } else if (last_detection_count_ > 5) {
       publish_diagnostics(
         "HIGH_OBSTACLE_COUNT",
-        "Avoiding " + std::to_string(last_detection_count_) + " detections");
+        "Avoiding " + std::to_string(last_detection_count_.load()) + " detections");
     } else {
       publish_diagnostics("OK", "Operating normally");
     }
@@ -212,11 +232,11 @@ class PathPlanner : public rclcpp::Node
     diag.values.push_back(kv);
 
     kv.key = "detection_count";
-    kv.value = std::to_string(last_detection_count_);
+    kv.value = std::to_string(last_detection_count_.load());
     diag.values.push_back(kv);
 
     kv.key = "planning_delay_ms";
-    kv.value = std::to_string(planning_delay_ms_);
+    kv.value = std::to_string(planning_delay_ms_.load());
     diag.values.push_back(kv);
 
     diag_array.status.push_back(diag);
@@ -230,7 +250,8 @@ class PathPlanner : public rclcpp::Node
   // Subscription
   rclcpp::Subscription<vision_msgs::msg::Detection2DArray>::SharedPtr detection_sub_;
 
-  // Timer
+  // Timer, in its own callback group so it never blocks parameter services
+  rclcpp::CallbackGroup::SharedPtr planning_group_;
   rclcpp::TimerBase::SharedPtr timer_;
 
   // Parameter callback
@@ -240,13 +261,17 @@ class PathPlanner : public rclcpp::Node
   std::mt19937 rng_;
   std::uniform_real_distribution<double> uniform_dist_;
 
-  // Parameters
-  int64_t planning_delay_ms_;
-  double failure_probability_;
+  // Parameters. The planning cycle reads them on another executor thread.
+  std::atomic<int64_t> planning_delay_ms_{0};
+  std::atomic<double> failure_probability_{0.0};
   double planning_rate_;
 
+  // Wakes a waiting planning cycle when planning_delay_ms changes
+  std::mutex delay_mutex_;
+  std::condition_variable delay_changed_;
+
   // State
-  int last_detection_count_{0};
+  std::atomic<int> last_detection_count_{0};
   uint64_t plan_count_{0};
 };
 
@@ -255,7 +280,11 @@ class PathPlanner : public rclcpp::Node
 int main(int argc, char ** argv)
 {
   rclcpp::init(argc, argv);
-  rclcpp::spin(std::make_shared<multi_ecu_demo::PathPlanner>());
+  auto node = std::make_shared<multi_ecu_demo::PathPlanner>();
+  // One thread for the planning group, one for everything else.
+  rclcpp::executors::MultiThreadedExecutor executor(rclcpp::ExecutorOptions(), 2);
+  executor.add_node(node);
+  executor.spin();
   rclcpp::shutdown();
   return 0;
 }
diff --git a/demos/ota_nav2_sensor_fix/run-demo.sh b/demos/ota_nav2_sensor_fix/run-demo.sh
index 7781801..dc18069 100755
--- a/demos/ota_nav2_sensor_fix/run-demo.sh
+++ b/demos/ota_nav2_sensor_fix/run-demo.sh
@@ -1,11 +1,11 @@
 #!/bin/bash
 # OTA over SOVD - nav2 sensor-fix demo runner.
 # Brings up the gateway (with the dev-grade ota_update_plugin baked in) and
-# the FastAPI artifact server. The gateway image bundles a full TurtleBot3 +
-# Nav2 + headless Gazebo stack and runs foxglove_bridge on :8765, so the
-# demo is self-contained: broken_lidar publishes /scan with a phantom
-# obstacle that nav2 + a Foxglove 3D panel both react to. The OTA flow
-# swaps broken_lidar -> fixed_lidar and the phantom disappears.
+# the FastAPI artifact server. The gateway image bundles a full Robotnik
+# RB-Theron AMR + Nav2 + headless Gazebo stack and runs foxglove_bridge on
+# :8765, so the demo is self-contained: broken_lidar publishes /scan with a
+# phantom obstacle that nav2 + a Foxglove 3D panel both react to. The OTA
+# flow swaps broken_lidar -> fixed_lidar and the phantom disappears.
 
 set -eu
 
@@ -203,6 +203,6 @@ echo "    open http://localhost:5173 -> Connect -> ${GATEWAY_URL}"
 echo ""
 echo "  Foxglove (recommended for the 3D narrative):"
 echo "    Open connection -> Foxglove WebSocket -> ws://localhost:${OTA_FOXGLOVE_BRIDGE_PORT:-8765}"
-echo "    Add a 3D panel: TurtleBot3 in the world, /scan cone shows the phantom"
+echo "    Add a 3D panel: RB-Theron in the world, /scan cone shows the phantom"
 echo "    Install ros2_medkit_foxglove_extension (npm run local-install) for the"
 echo "    'ros2_medkit Updates' panel; set baseUrl to ${GATEWAY_URL}/api/v1"
diff --git a/demos/sensor_diagnostics/README.md b/demos/sensor_diagnostics/README.md
index d89a033..4c994dd 100644
--- a/demos/sensor_diagnostics/README.md
+++ b/demos/sensor_diagnostics/README.md
@@ -206,8 +206,8 @@ The gateway supports condition-based triggers that fire when specific events occ
 
 ### How It Works
 
-1. `setup-triggers.sh` creates a trigger via `POST /api/v1/apps/diagnostic_bridge/triggers`:
-   - **Resource:** `/api/v1/apps/diagnostic_bridge/faults` (watches fault collection)
+1. `setup-triggers.sh` creates a trigger via `POST /api/v1/apps/diagnostic-bridge/triggers`:
+   - **Resource:** `/api/v1/apps/diagnostic-bridge/faults` (watches fault collection)
    - **Condition:** `OnChange` (fires on any new or updated fault)
    - **Multishot:** `true` (fires repeatedly, not just once)
    - **Lifetime:** 3600 seconds (auto-expires after 1 hour)
@@ -218,23 +218,23 @@ The gateway supports condition-based triggers that fire when specific events occ
 
 ```bash
 # Create a trigger
-curl -X POST http://localhost:8080/api/v1/apps/diagnostic_bridge/triggers \
+curl -X POST http://localhost:8080/api/v1/apps/diagnostic-bridge/triggers \
   -H "Content-Type: application/json" \
   -d '{
-    "resource": "/api/v1/apps/diagnostic_bridge/faults",
+    "resource": "/api/v1/apps/diagnostic-bridge/faults",
     "trigger_condition": {"condition_type": "OnChange"},
     "multishot": true,
     "lifetime": 3600
   }' | jq
 
 # List triggers
-curl http://localhost:8080/api/v1/apps/diagnostic_bridge/triggers | jq
+curl http://localhost:8080/api/v1/apps/diagnostic-bridge/triggers | jq
 
 # Watch events (replace TRIGGER_ID)
-curl -N http://localhost:8080/api/v1/apps/diagnostic_bridge/triggers/TRIGGER_ID/events
+curl -N http://localhost:8080/api/v1/apps/diagnostic-bridge/triggers/TRIGGER_ID/events
 
 # Delete a trigger
-curl -X DELETE http://localhost:8080/api/v1/apps/diagnostic_bridge/triggers/TRIGGER_ID
+curl -X DELETE http://localhost:8080/api/v1/apps/diagnostic-bridge/triggers/TRIGGER_ID
 ```
 
 ## API Examples
@@ -242,14 +242,14 @@ curl -X DELETE http://localhost:8080/api/v1/apps/diagnostic_bridge/triggers/TRIG
 ### Read Sensor Data
 
 ```bash
-# Get LiDAR scan
-curl http://localhost:8080/api/v1/apps/lidar-sim/data/scan | jq '.ranges[:5]'
+# Get LiDAR scan (topic id is /sensors/scan, percent-encoded in the URL)
+curl http://localhost:8080/api/v1/apps/lidar-sim/data/sensors%2Fscan | jq '.data.ranges[:5]'
 
-# Get IMU data
-curl http://localhost:8080/api/v1/apps/imu-sim/data/imu | jq '.linear_acceleration'
+# Get IMU data (topic id is /sensors/imu)
+curl http://localhost:8080/api/v1/apps/imu-sim/data/sensors%2Fimu | jq '.data.linear_acceleration'
 
-# Get GPS fix
-curl http://localhost:8080/api/v1/apps/gps-sim/data/fix | jq '{lat: .latitude, lon: .longitude}'
+# Get GPS fix (topic id is /sensors/fix)
+curl http://localhost:8080/api/v1/apps/gps-sim/data/sensors%2Ffix | jq '{lat: .data.latitude, lon: .data.longitude}'
 ```
 
 ### View Configurations
@@ -304,7 +304,7 @@ curl http://localhost:8080/api/v1/faults | jq
 |--------|-------------|
 | `run-demo.sh` | Start Docker services (daemon mode) |
 | `stop-demo.sh` | Stop Docker services |
-| `check-demo.sh` | Interactive API demonstration and exploration |
+| `check-demo.sh` | Interactive API demonstration and exploration; waits for the sensor data after the demo starts (see below), exits 1 when the fault list cannot be read |
 | `run-diagnostics.sh` | Check health of all sensors |
 | `inject-fault-scenario.sh` | Composite fault injection across all sensors |
 | `inject-noise.sh` | Inject high noise fault |
@@ -317,6 +317,16 @@ curl http://localhost:8080/api/v1/faults | jq
 
 > **Note:** All diagnostic scripts (`inject-*.sh`, `restore-normal.sh`, `run-diagnostics.sh`, `inject-fault-scenario.sh`) are also available via the [Scripts API](#scripts-api) - callable as REST endpoints without requiring the host-side scripts.
 
+`check-demo.sh` waits up to 30 s for the gateway to link the sensor nodes, and up to 5 s for a first
+message from each linked sensor. A sensor past its 5 s is still read while the wait goes on for others.
+Set `DATA_WAIT_SEC=<seconds>` to change the 30 s. A sensor that sends nothing, such as the IMU after
+`inject-failure.sh`, is named in the output with the time it was waited for. Its data section reads it
+again and says it has no data, and the fault sections still run.
+
+The fault sections show the first listed fault on the App whose node reported it. This includes faults
+the anomaly detector reports as `/processing/anomaly_detector/<sensor>`. For those faults the rosbag list
+of `apps/anomaly-detector` can be empty.
+
 ## Sensor Parameters
 
 ### LiDAR (`/sensors/lidar_sim`)
diff --git a/demos/sensor_diagnostics/check-demo.sh b/demos/sensor_diagnostics/check-demo.sh
index 48cec64..2cdf20b 100755
--- a/demos/sensor_diagnostics/check-demo.sh
+++ b/demos/sensor_diagnostics/check-demo.sh
@@ -45,6 +45,102 @@ if ! curl -sf "${API_BASE}/health" > /dev/null 2>&1; then
 fi
 echo_success "Gateway is healthy!"
 
+# /health answers before the gateway links the sensor nodes, and a node's
+# topic reads come back empty until then. A linked sensor that publishes
+# nothing (inject-failure.sh) never gets a message, so it holds the wait for
+# SAMPLE_WAIT_SEC at most; it is still read while the wait goes on for others.
+# The whole wait ends within DATA_WAIT_SEC plus one request.
+DATA_WAIT_SEC="${DATA_WAIT_SEC:-30}"
+SAMPLE_WAIT_SEC=5
+REQUEST_TIMEOUT_SEC=3
+SENSOR_APPS=(lidar-sim imu-sim gps-sim)
+SENSOR_TOPICS=(sensors/scan sensors/imu sensors/fix)
+
+case "$DATA_WAIT_SEC" in
+    '' | *[!0-9]*)
+        echo_error "DATA_WAIT_SEC must be a whole number of seconds, got '${DATA_WAIT_SEC}'."
+        exit 1
+        ;;
+esac
+# Base 10: bash reads a number with a leading zero as octal.
+DATA_WAIT_SEC=$((10#$DATA_WAIT_SEC))
+
+# True when the gateway has linked APP to its node: its data list is not empty.
+sensor_linked() {
+    curl -sf -m "$REQUEST_TIMEOUT_SEC" "${API_BASE}/apps/$1/data" \
+        | jq -e '.items | length > 0' > /dev/null 2>&1
+}
+
+# True when the gateway has a message on APP's TOPIC.
+sensor_has_data() {
+    curl -sf -m "$REQUEST_TIMEOUT_SEC" "${API_BASE}/apps/$1/data/${2//\//%2F}" \
+        | jq -e '.data | type == "object" and length > 0' > /dev/null 2>&1
+}
+
+wait_start=$(date +%s)
+deadline=$((wait_start + DATA_WAIT_SEC))
+# Per sensor: when the link was seen, when it was last read, whether a
+# message was read, and which waiting line was printed.
+linked_at=()
+polled_at=()
+has_data=()
+announced=()
+while :; do
+    pending=false
+    for i in "${!SENSOR_APPS[@]}"; do
+        [ -n "${has_data[$i]:-}" ] && continue
+        app=${SENSOR_APPS[$i]}
+        [ "$(date +%s)" -lt "$deadline" ] || break 2
+        if [ -z "${linked_at[$i]:-}" ]; then
+            sensor_linked "$app" && linked_at[i]=$(date +%s)
+            polled_at[i]=$(date +%s)
+            if [ -z "${linked_at[$i]:-}" ]; then
+                if [ -z "${announced[$i]:-}" ]; then
+                    echo "Waiting for the gateway to link ${app} (max ${DATA_WAIT_SEC}s)..."
+                    announced[i]="link"
+                fi
+                pending=true
+                continue
+            fi
+            [ "$(date +%s)" -lt "$deadline" ] || break 2
+        fi
+        if sensor_has_data "$app" "${SENSOR_TOPICS[$i]}"; then
+            has_data[i]=1
+            continue
+        fi
+        polled_at[i]=$(date +%s)
+        # Past its first-message window a sensor no longer holds the wait.
+        [ "$(date +%s)" -lt "$((linked_at[i] + SAMPLE_WAIT_SEC))" ] || continue
+        if [ "${announced[$i]:-}" != sample ]; then
+            echo "Waiting for a first message from ${app} on /${SENSOR_TOPICS[$i]} (max ${SAMPLE_WAIT_SEC}s)..."
+            announced[i]="sample"
+        fi
+        pending=true
+    done
+    "$pending" || break
+    [ "$(date +%s)" -lt "$deadline" ] || break
+    sleep 1
+done
+
+# The time reported is how long each sensor was read for. The data sections
+# below read every sensor again.
+missing=false
+for i in "${!SENSOR_APPS[@]}"; do
+    [ -n "${has_data[$i]:-}" ] && continue
+    missing=true
+    app=${SENSOR_APPS[$i]}
+    if [ -z "${polled_at[$i]:-}" ]; then
+        echo "   ${app} was not waited for."
+    elif [ -n "${linked_at[$i]:-}" ]; then
+        echo "   No message from ${app} on /${SENSOR_TOPICS[$i]} in the $((polled_at[i] - wait_start))s it was waited for; the sensor may have failed."
+    else
+        echo "   The gateway did not link ${app} in the $((polled_at[i] - wait_start))s it was waited for."
+    fi
+done
+if "$missing"; then
+    echo "   Sections 5-7 read each sensor again."
+fi
+
 echo_step "1. Checking Gateway Health"
 curl -s "${API_BASE}/health" | jq '.'
 
@@ -52,70 +148,100 @@ echo_step "2. Listing All Areas (Namespaces)"
 curl -s "${API_BASE}/areas" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "3. Listing All Components"
-curl -s "${API_BASE}/components" | jq '.items[] | {id: .id, name: .name, area: .area}'
+curl -s "${API_BASE}/components" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "4. Listing All Apps (ROS 2 Nodes)"
-curl -s "${API_BASE}/apps" | jq '.items[] | {id: .id, name: .name, namespace: .namespace}'
+curl -s "${API_BASE}/apps" | jq '.items[] | {id: .id, name: .name, component: .["x-medkit"].component_id}'
+
+# Prints FILTER applied to the latest message on APP's TOPIC, or says that
+# the gateway has none.
+# Usage: show_sensor_data LABEL APP TOPIC FILTER
+show_sensor_data() {
+    local body
+    body=$(curl -s -m 10 "${API_BASE}/apps/$2/data/${3//\//%2F}")
+    if echo "$body" | jq -e '.data | type == "object" and length > 0' > /dev/null 2>&1; then
+        echo "$body" | jq "$4"
+    else
+        echo "   No $1 data: the gateway has no message from $2 on /$3."
+    fi
+}
 
 echo_step "5. Reading LiDAR Data"
 echo "Getting latest scan from LiDAR simulator..."
-curl -s "${API_BASE}/apps/lidar-sim/data/scan" | jq '{
-  angle_min: .angle_min,
-  angle_max: .angle_max,
-  range_min: .range_min,
-  range_max: .range_max,
-  sample_ranges: .ranges[:5]
+show_sensor_data "LiDAR" lidar-sim sensors/scan '{
+  angle_min: .data.angle_min,
+  angle_max: .data.angle_max,
+  range_min: .data.range_min,
+  range_max: .data.range_max,
+  sample_ranges: .data.ranges[:5]
 }'
 
 echo_step "6. Reading IMU Data"
 echo "Getting latest IMU reading..."
-curl -s "${API_BASE}/apps/imu-sim/data/imu" | jq '{
-  linear_acceleration: .linear_acceleration,
-  angular_velocity: .angular_velocity
+show_sensor_data "IMU" imu-sim sensors/imu '{
+  linear_acceleration: .data.linear_acceleration,
+  angular_velocity: .data.angular_velocity
 }'
 
 echo_step "7. Reading GPS Fix"
 echo "Getting current GPS position..."
-curl -s "${API_BASE}/apps/gps-sim/data/fix" | jq '{
-  latitude: .latitude,
-  longitude: .longitude,
-  altitude: .altitude,
-  status: .status
+show_sensor_data "GPS" gps-sim sensors/fix '{
+  latitude: .data.latitude,
+  longitude: .data.longitude,
+  altitude: .data.altitude,
+  status: .data.status
 }'
 
 echo_step "8. Listing LiDAR Configurations"
 echo "These parameters can be modified at runtime to inject faults..."
-curl -s "${API_BASE}/apps/lidar-sim/configurations" | jq '.items[] | {name: .name, value: .value, type: .type}'
+# The list endpoint carries id/name/type only; the value and the ROS type are
+# on each parameter's own detail endpoint.
+LIDAR_CONFIG_IDS=$(curl -s "${API_BASE}/apps/lidar-sim/configurations" | jq -r '.items[]?.id' 2>/dev/null)
+if [ -z "$LIDAR_CONFIG_IDS" ]; then
+    echo "   No LiDAR configurations available."
+fi
+while IFS= read -r cfg_id; do
+    [ -n "$cfg_id" ] || continue
+    curl -s "${API_BASE}/apps/lidar-sim/configurations/${cfg_id}" \
+        | jq '{name: .id, value: .data, type: .["x-medkit"].parameter.type}'
+done <<< "$LIDAR_CONFIG_IDS"
 
 echo_step "9. Checking Current Faults"
-FAULTS_JSON=$(curl -s "${API_BASE}/faults")
+# A failed read leaves the fault list unknown, not empty.
+FAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" "${API_BASE}/faults")
+FAULTS_CODE=$(tail -n 1 <<< "$FAULTS_RESPONSE")
+FAULTS_JSON=$(sed '$d' <<< "$FAULTS_RESPONSE")
+if [ "$FAULTS_CODE" != "200" ] || ! echo "$FAULTS_JSON" | jq -e '.items | type == "array"' > /dev/null 2>&1; then
+    echo_error "Could not read faults (HTTP ${FAULTS_CODE}): $(echo "$FAULTS_JSON" | jq -r '.message // empty' 2>/dev/null)"
+    echo "   The fault list is unknown. Check that the fault manager is running, then retry."
+    exit 1
+fi
 echo "$FAULTS_JSON" | jq '.'
 
 # If there are faults, demonstrate snapshot / bulk-data endpoints
 FAULT_COUNT=$(echo "$FAULTS_JSON" | jq '.items | length')
 if [ "$FAULT_COUNT" -gt 0 ]; then
-    # Find the first fault that has both a non-null entity_id and code
-    FIRST_FAULT_ENTRY=$(echo "$FAULTS_JSON" | jq -r '.items[] | select(.entity_id != null and .code != null) | "\(.entity_type) \(.entity_id) \(.code)"' | head -n 1)
+    # The fault collection carries fault_code and reporting_sources (ROS node
+    # paths), not an entity id. The owning App is the one whose ROS node is the
+    # first reporting source or a path above it, whole segments only: the
+    # anomaly detector reports as /processing/anomaly_detector/<sensor>.
+    FIRST_FAULT=$(echo "$FAULTS_JSON" | jq -r '.items[0].fault_code')
+    REPORTING_SOURCE=$(echo "$FAULTS_JSON" | jq -r '.items[0].reporting_sources[0] // empty')
+    FIRST_ENTITY=$(curl -s "${API_BASE}/apps" | jq -r --arg src "$REPORTING_SOURCE" '
+        [.items[] | .["x-medkit"].ros2.node as $node
+         | select(($node | type) == "string"
+                  and ($src == $node or ($src | startswith($node + "/"))))
+         | {id, depth: ($node | length)}]
+        | max_by(.depth) | .id // empty' 2>/dev/null)
 
-    if [ -z "$FIRST_FAULT_ENTRY" ]; then
+    if [ -z "$FIRST_ENTITY" ]; then
         echo ""
-        echo "   Faults exist but none provide both 'entity_id' and 'code'."
+        echo "   Could not map fault ${FIRST_FAULT} to a reporting App (source: ${REPORTING_SOURCE:-none})."
         echo "   Skipping snapshot and bulk-data demonstration."
     else
-        FIRST_ENTITY_TYPE=$(echo "$FIRST_FAULT_ENTRY" | awk '{print $1}')
-        FIRST_ENTITY=$(echo "$FIRST_FAULT_ENTRY" | awk '{print $2}')
-        FIRST_FAULT=$(echo "$FIRST_FAULT_ENTRY" | awk '{print $3}')
-        # Map entity_type to plural resource path (e.g., "app" -> "apps")
-        case "$FIRST_ENTITY_TYPE" in
-            app|apps) ENTITY_PATH="apps" ;;
-            component|components) ENTITY_PATH="components" ;;
-            area|areas) ENTITY_PATH="areas" ;;
-            *) ENTITY_PATH="apps" ;;
-        esac
-
         echo_step "10. Fault Detail with Environment Data (Snapshots)"
-        echo "Fetching fault ${FIRST_FAULT} on ${ENTITY_PATH}/${FIRST_ENTITY}..."
-        curl -s "${API_BASE}/${ENTITY_PATH}/${FIRST_ENTITY}/faults/${FIRST_FAULT}" | jq '{
+        echo "Fetching fault ${FIRST_FAULT} on apps/${FIRST_ENTITY}..."
+        curl -s "${API_BASE}/apps/${FIRST_ENTITY}/faults/${FIRST_FAULT}" | jq '{
           code: .item.code,
           status: .item.status,
           environment_data: {
@@ -126,17 +252,22 @@ if [ "$FAULT_COUNT" -gt 0 ]; then
 
         echo_step "11. Bulk-Data Categories (Rosbag Recordings)"
         echo "Checking available bulk-data categories..."
-        curl -s "${API_BASE}/${ENTITY_PATH}/${FIRST_ENTITY}/bulk-data" | jq '.'
+        curl -s "${API_BASE}/apps/${FIRST_ENTITY}/bulk-data" | jq '.'
 
         echo_step "12. Bulk-Data Descriptors (Rosbag Files)"
         echo "Listing available rosbag recordings..."
-        curl -s "${API_BASE}/${ENTITY_PATH}/${FIRST_ENTITY}/bulk-data/rosbags" | jq '.items[] | {
-          id: .id,
-          name: .name,
-          size: .size,
-          mimetype: .mimetype,
-          "x-medkit": ."x-medkit"
-        }'
+        ROSBAGS_JSON=$(curl -s "${API_BASE}/apps/${FIRST_ENTITY}/bulk-data/rosbags")
+        if echo "$ROSBAGS_JSON" | jq -e '.items | length > 0' > /dev/null 2>&1; then
+            echo "$ROSBAGS_JSON" | jq '.items[] | {
+              id: .id,
+              name: .name,
+              size: .size,
+              mimetype: .mimetype,
+              "x-medkit": ."x-medkit"
+            }'
+        else
+            echo "   No rosbag recordings listed for apps/${FIRST_ENTITY}."
+        fi
     fi
 else
     echo ""
@@ -155,9 +286,9 @@ echo "   ./inject-drift.sh        # Inject sensor drift"
 echo "   ./restore-normal.sh      # Restore normal operation"
 echo ""
 echo "📸 After injecting a fault, check snapshots and rosbags:"
-echo "   curl ${API_BASE}/faults | jq                                    # List faults"
-echo "   curl ${API_BASE}/components/lidar-unit/faults/<CODE> | jq       # Fault detail + snapshots"
-echo "   curl ${API_BASE}/components/lidar-unit/bulk-data/rosbags | jq   # List rosbag recordings"
+echo "   curl ${API_BASE}/faults | jq                                      # List faults"
+echo "   curl ${API_BASE}/apps/diagnostic-bridge/faults/<CODE> | jq        # Fault detail + snapshots"
+echo "   curl ${API_BASE}/apps/diagnostic-bridge/bulk-data/rosbags | jq    # List rosbag recordings"
 echo ""
 echo "🌐 Web UI: http://localhost:3000"
 echo "🌐 REST API: http://localhost:8080/api/v1/"
diff --git a/demos/turtlebot3_integration/Dockerfile b/demos/turtlebot3_integration/Dockerfile
index f92fd61..4c99dd9 100644
--- a/demos/turtlebot3_integration/Dockerfile
+++ b/demos/turtlebot3_integration/Dockerfile
@@ -72,10 +72,6 @@ COPY config/ ${COLCON_WS}/src/turtlebot3_medkit_demo/config/
 COPY launch/ ${COLCON_WS}/src/turtlebot3_medkit_demo/launch/
 COPY scripts/ ${COLCON_WS}/src/turtlebot3_medkit_demo/scripts/
 
-# TODO(#49): Move to manifest-defined scripts once ros2_medkit#303 lands
-COPY container_scripts/ /var/lib/ros2_medkit/scripts/
-RUN find /var/lib/ros2_medkit/scripts -name "*.bash" -exec chmod +x {} \;
-
 # Build ros2_medkit and demo package
 WORKDIR ${COLCON_WS}
 RUN bash -c "source /opt/ros/jazzy/setup.bash && \
@@ -83,6 +79,11 @@ RUN bash -c "source /opt/ros/jazzy/setup.bash && \
     rosdep install --from-paths src --ignore-src -r -y && \
     MAKEFLAGS='-j 2' colcon build --executor sequential --symlink-install --cmake-args -DBUILD_TESTING=OFF"
 
+# Scripts are not build inputs, so a script change does not rebuild the workspace.
+# TODO(#49): Move to manifest-defined scripts once ros2_medkit#303 lands
+COPY container_scripts/ /var/lib/ros2_medkit/scripts/
+RUN find /var/lib/ros2_medkit/scripts -name "*.bash" -exec chmod +x {} \;
+
 # Setup environment
 RUN echo "source /opt/ros/jazzy/setup.bash" >> ~/.bashrc && \
     echo "source ${COLCON_WS}/install/setup.bash" >> ~/.bashrc && \
diff --git a/demos/turtlebot3_integration/README.md b/demos/turtlebot3_integration/README.md
index a2c0566..1d385dd 100644
--- a/demos/turtlebot3_integration/README.md
+++ b/demos/turtlebot3_integration/README.md
@@ -179,10 +179,10 @@ curl http://localhost:8080/api/v1/health
 curl http://localhost:8080/api/v1/areas | jq '.items[] | {id, name}'
 
 # List all components (hardware/logical units)
-curl http://localhost:8080/api/v1/components | jq '.items[] | {id, name, area}'
+curl http://localhost:8080/api/v1/components | jq '.items[] | {id, name, description}'
 
 # List all apps (ROS 2 nodes)
-curl http://localhost:8080/api/v1/apps | jq '.items[] | {id, name, namespace}'
+curl http://localhost:8080/api/v1/apps | jq '.items[] | {id, name, component: .["x-medkit"].component_id, online: .["x-medkit"].is_online}'
 
 # Get specific app details
 curl http://localhost:8080/api/v1/apps/amcl | jq
@@ -193,19 +193,19 @@ curl http://localhost:8080/api/v1/apps/amcl | jq
 ```bash
 # Get LiDAR scan data
 curl http://localhost:8080/api/v1/apps/turtlebot3-node/data/scan | jq '{
-  angle_min: .angle_min,
-  angle_max: .angle_max,
-  sample_ranges: .ranges[:5]
+  angle_min: .data.angle_min,
+  angle_max: .data.angle_max,
+  sample_ranges: .data.ranges[:5]
 }'
 
 # Get odometry data
 curl http://localhost:8080/api/v1/apps/turtlebot3-node/data/odom | jq '{
-  position: .pose.pose.position,
-  orientation: .pose.pose.orientation
+  position: .data.pose.pose.position,
+  orientation: .data.pose.pose.orientation
 }'
 
 # List all data topics for an app
-curl http://localhost:8080/api/v1/apps/turtlebot3-node/data | jq
+curl http://localhost:8080/api/v1/apps/anomaly-detector/data | jq
 ```
 
 ### Fault Management
@@ -218,10 +218,10 @@ curl http://localhost:8080/api/v1/faults | jq
 curl http://localhost:8080/api/v1/areas/robot/faults | jq
 
 # Get fault details with environment data (includes snapshots)
-curl http://localhost:8080/api/v1/faults/NAVIGATION_GOAL_ABORTED | jq
+curl http://localhost:8080/api/v1/apps/anomaly-detector/faults/NAVIGATION_GOAL_ABORTED | jq
 
 # Clear a specific fault
-curl -X DELETE http://localhost:8080/api/v1/apps/diagnostic-bridge/faults/TURTLEBOT3_NODE
+curl -X DELETE http://localhost:8080/api/v1/apps/anomaly-detector/faults/NAVIGATION_GOAL_ABORTED
 ```
 
 ### Rosbag Snapshots (Bulk Data)
@@ -400,11 +400,13 @@ GATEWAY_URL=http://192.168.1.10:8080 ./inject-nav-failure.sh
 | `reset-navigation` | Cancel goals and reset AMCL |
 | `inject-localization-failure` | Inject AMCL localization failure |
 | `inject-nav-failure` | Inject navigation failure (unreachable goal) |
-| `restore-normal` | Reset parameters and clear faults |
+| `restore-normal` | Cancel goals, reset parameters, re-localize AMCL and clear faults |
 
 ## Triggers (Condition-Based Alerts)
 
-The gateway supports condition-based triggers that fire when specific events occur, delivering notifications via Server-Sent Events (SSE). This demo creates a fault-monitoring trigger that alerts on any new or updated faults reported by the anomaly detector (including navigation failures).
+The gateway supports condition-based triggers that fire when specific events occur, delivering notifications via Server-Sent Events (SSE). This demo creates a fault-monitoring trigger on the anomaly detector. It fires for the localization fault that `./inject-localization-failure.sh` causes (`LOCALIZATION_UNCERTAINTY`).
+
+Navigation goal faults (`NAVIGATION_GOAL_ABORTED`, `NAVIGATION_GOAL_CANCELED`), such as the one `./inject-nav-failure.sh` causes, do not fire this trigger. They still appear in `GET /api/v1/faults` and in `./check-faults.sh`.
 
 ### Setup
 
@@ -419,40 +421,40 @@ The gateway supports condition-based triggers that fire when specific events occ
 ./watch-triggers.sh
 
 # Terminal 2: Inject a fault - the trigger fires in Terminal 3!
-./inject-nav-failure.sh
+./inject-localization-failure.sh
 ```
 
 ### How It Works
 
-1. `setup-triggers.sh` creates a trigger via `POST /api/v1/apps/anomaly_detector/triggers`:
-   - **Resource:** `/api/v1/apps/anomaly_detector/faults` (watches fault collection)
-   - **Condition:** `OnChange` (fires on any new or updated fault)
+1. `setup-triggers.sh` creates a trigger via `POST /api/v1/apps/anomaly-detector/triggers`:
+   - **Resource:** `/api/v1/apps/anomaly-detector/faults` (watches fault collection)
+   - **Condition:** `OnChange` (fires when the localization fault is reported or updated; navigation goal faults do not fire it)
    - **Multishot:** `true` (fires repeatedly, not just once)
    - **Lifetime:** 3600 seconds (auto-expires after 1 hour)
 2. `watch-triggers.sh` connects to the SSE event stream at the trigger's `event_source` URL
-3. When a fault is injected and detected by the gateway, the trigger fires and an SSE event is delivered
+3. When `./inject-localization-failure.sh` makes the anomaly detector report the localization fault, the trigger fires and an SSE event is delivered
 
 ### Manual API Usage
 
 ```bash
 # Create a trigger
-curl -X POST http://localhost:8080/api/v1/apps/anomaly_detector/triggers \
+curl -X POST http://localhost:8080/api/v1/apps/anomaly-detector/triggers \
   -H "Content-Type: application/json" \
   -d '{
-    "resource": "/api/v1/apps/anomaly_detector/faults",
+    "resource": "/api/v1/apps/anomaly-detector/faults",
     "trigger_condition": {"condition_type": "OnChange"},
     "multishot": true,
     "lifetime": 3600
   }' | jq
 
 # List triggers
-curl http://localhost:8080/api/v1/apps/anomaly_detector/triggers | jq
+curl http://localhost:8080/api/v1/apps/anomaly-detector/triggers | jq
 
 # Watch events (replace TRIGGER_ID)
-curl -N http://localhost:8080/api/v1/apps/anomaly_detector/triggers/TRIGGER_ID/events
+curl -N http://localhost:8080/api/v1/apps/anomaly-detector/triggers/TRIGGER_ID/events
 
 # Delete a trigger
-curl -X DELETE http://localhost:8080/api/v1/apps/anomaly_detector/triggers/TRIGGER_ID
+curl -X DELETE http://localhost:8080/api/v1/apps/anomaly-detector/triggers/TRIGGER_ID
 ```
 
 ## Fault Injection Scenarios
@@ -466,7 +468,7 @@ Faults are detected by `anomaly_detector` and reported directly to FaultManager.
 |--------|-----------|-------------|-----------------|
 | `inject-nav-failure.sh` | Navigation | Send goal to unreachable location | `NAVIGATION_GOAL_ABORTED` |
 | `inject-localization-failure.sh` | Localization | Reset AMCL with high uncertainty | `LOCALIZATION_UNCERTAINTY` |
-| `restore-normal.sh` | Recovery | Restore defaults and clear faults | - |
+| `restore-normal.sh` | Recovery | Restore defaults, re-localize AMCL and clear faults | - |
 
 ### Fault Injection Examples
 
@@ -493,10 +495,17 @@ curl http://localhost:8080/api/v1/faults | jq
 #### Restore Normal Operation
 
 ```bash
-# Clear all faults and restore default parameters
+# Cancel goals, restore default parameters, re-localize AMCL and clear all faults
 ./restore-normal.sh
 ```
 
+`restore-normal.sh` also recovers from `inject-localization-failure.sh`: it reads the
+robot's pose from the running Gazebo simulation and sets it on AMCL through
+`POST /api/v1/apps/amcl/operations/set_initial_pose/executions`, so the robot need not be
+at its spawn point. When the gateway refuses one of its writes, for example with 409 while
+another client holds a lock on the app, the script still runs its other steps, then fails
+and names the refused write.
+
 ### Fault Monitoring via API
 
 ```bash
@@ -591,13 +600,13 @@ demos/turtlebot3_integration/
 | `run-demo.sh` | Start the full demo (Docker) |
 | `stop-demo.sh` | Stop containers and cleanup |
 | `send-nav-goal.sh [x] [y] [yaw]` | Send navigation goal via SOVD API |
-| `check-entities.sh` | Explore SOVD entity hierarchy |
-| `check-faults.sh` | View active faults from gateway |
+| `check-entities.sh` | Explore SOVD entity hierarchy; prints a hint instead of scan values when the LiDAR has no data |
+| `check-faults.sh` | View active faults from gateway; exits 1 when the fault list cannot be read |
 | `nav-health-check.sh` | Check Nav2 stack health |
 | `reset-navigation.sh` | Cancel goals and reset AMCL |
 | `inject-nav-failure.sh` | Inject navigation failure (unreachable goal) |
 | `inject-localization-failure.sh` | Inject localization failure (AMCL reset) |
-| `restore-normal.sh` | Restore normal operation and clear faults |
+| `restore-normal.sh` | Restore normal operation, re-localize AMCL and clear faults |
 | `setup-triggers.sh` | Create OnChange fault trigger |
 | `watch-triggers.sh` | Watch trigger events via SSE stream |
 
diff --git a/demos/turtlebot3_integration/check-entities.sh b/demos/turtlebot3_integration/check-entities.sh
index 5b04968..84ee44f 100755
--- a/demos/turtlebot3_integration/check-entities.sh
+++ b/demos/turtlebot3_integration/check-entities.sh
@@ -40,26 +40,32 @@ echo_step "1. Areas (Namespace Groupings)"
 curl -s "${API_BASE}/areas" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "2. Components (Hardware/Logical Units)"
-curl -s "${API_BASE}/components" | jq '.items[] | {id: .id, name: .name, type: .type, area: .area}'
+curl -s "${API_BASE}/components" | jq '.items[] | {id: .id, name: .name, type: .type, description: .description}'
 
 echo_step "3. Apps (ROS 2 Nodes)"
-curl -s "${API_BASE}/apps" | jq '.items[] | {id: .id, name: .name, category: .category, component: .is_located_on}'
+curl -s "${API_BASE}/apps" | jq '.items[] | {id: .id, name: .name, component: .["x-medkit"].component_id}'
 
 echo_step "4. Functions (High-level Capabilities)"
-curl -s "${API_BASE}/functions" | jq '.items[] | {id: .id, name: .name, category: .category, hosted_by: .hosted_by}'
+curl -s "${API_BASE}/functions" | jq '.items[] | {id: .id, name: .name, description: .description}'
 
 echo_step "5. Sample Data (LiDAR Scan)"
 echo "Getting latest LiDAR scan from TurtleBot3..."
-curl -s "${API_BASE}/apps/turtlebot3-node/data/scan" 2>/dev/null | jq '{
-    angle_min: .angle_min,
-    angle_max: .angle_max,
-    range_min: .range_min,
-    range_max: .range_max,
-    sample_ranges: .ranges[:5]
-}' || echo "   (LiDAR data not available - Gazebo may still be starting)"
+# A failed read or a scan topic without a message leaves .data empty.
+SCAN_JSON=$(curl -s "${API_BASE}/apps/turtlebot3-node/data/scan" 2>/dev/null)
+if echo "$SCAN_JSON" | jq -e '.data | type == "object" and length > 0' > /dev/null 2>&1; then
+    echo "$SCAN_JSON" | jq '{
+        angle_min: .data.angle_min,
+        angle_max: .data.angle_max,
+        range_min: .data.range_min,
+        range_max: .data.range_max,
+        sample_ranges: .data.ranges[:5]
+    }'
+else
+    echo "   (LiDAR data not available - Gazebo may still be starting)"
+fi
 
 echo_step "6. Faults"
-curl -s "${API_BASE}/faults" | jq '.items[] | {code: .code, severity: .severity, reporter: .reporter_id}'
+curl -s "${API_BASE}/faults" | jq '.items[] | {code: .fault_code, severity: .severity_label, sources: .reporting_sources}'
 
 echo ""
 echo -e "${GREEN}✓ Entity hierarchy exploration complete!${NC}"
diff --git a/demos/turtlebot3_integration/check-faults.sh b/demos/turtlebot3_integration/check-faults.sh
index 944ed6d..1990d36 100755
--- a/demos/turtlebot3_integration/check-faults.sh
+++ b/demos/turtlebot3_integration/check-faults.sh
@@ -1,6 +1,7 @@
 #!/bin/bash
 # Check current faults from ros2_medkit gateway
-# Faults are collected from Nav2/TurtleBot3 via diagnostic_bridge
+# Faults are collected from Nav2/TurtleBot3 via anomaly_detector (direct) and
+# diagnostic_bridge (legacy /diagnostics path)
 
 GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
 API_BASE="${GATEWAY_URL}/api/v1"
@@ -25,9 +26,17 @@ fi
 echo "✓ Gateway is healthy"
 echo ""
 
-# Get all faults
+# Get all faults. A failed read leaves the fault list unknown, not empty.
+FAULTS_RESPONSE=$(curl -s -w "\n%{http_code}" "${API_BASE}/faults")
+FAULTS_CODE=$(tail -n 1 <<< "$FAULTS_RESPONSE")
+FAULTS=$(sed '$d' <<< "$FAULTS_RESPONSE")
+if [ "$FAULTS_CODE" != "200" ] || ! echo "$FAULTS" | jq -e '.items | type == "array"' > /dev/null 2>&1; then
+    echo "❌ Could not read faults from ${GATEWAY_URL} (HTTP ${FAULTS_CODE}): $(echo "$FAULTS" | jq -r '.message // empty' 2>/dev/null)"
+    echo "   The fault list is unknown. Check that the fault manager is running, then retry."
+    exit 1
+fi
+
 echo "📋 Active Faults:"
-FAULTS=$(curl -s "${API_BASE}/faults")
 
 # Check if there are any faults
 FAULT_COUNT=$(echo "$FAULTS" | jq '.items | length')
@@ -36,18 +45,30 @@ if [ "$FAULT_COUNT" = "0" ]; then
     echo "   No active faults - system is healthy!"
 else
     echo "$FAULTS" | jq '.items[] | {
-        code: .code,
-        severity: .severity,
-        reporter: .reporter_id,
-        message: .message,
-        timestamp: .timestamp
+        code: .fault_code,
+        severity: .severity_label,
+        status: .status,
+        description: .description,
+        sources: .reporting_sources,
+        occurrences: .occurrence_count,
+        first_occurred: .first_occurred,
+        last_occurred: .last_occurred
     }'
 fi
 
 echo ""
 echo "📊 Fault Summary:"
 echo "   Total active faults: $FAULT_COUNT"
+
+# Show fault counts by severity if any exist
+if [ "$FAULT_COUNT" != "0" ]; then
+    echo ""
+    echo "   By severity:"
+    echo "$FAULTS" | jq -r '.items | group_by(.severity_label) | .[] | "     \(.[0].severity_label): \(length)"'
+fi
+
 echo ""
 echo "Commands:"
 echo "   Clear all faults: curl -X DELETE ${API_BASE}/faults"
-echo "   Check specific area: curl ${API_BASE}/areas/robot/faults | jq"
+echo "   Check area faults: curl ${API_BASE}/areas/navigation/faults | jq"
+echo "   Check component faults: curl ${API_BASE}/components/nav2-stack/faults | jq"
diff --git a/demos/turtlebot3_integration/container_scripts/nav2-stack/inject-localization-failure/script.bash b/demos/turtlebot3_integration/container_scripts/nav2-stack/inject-localization-failure/script.bash
index 64a3f57..27b5041 100755
--- a/demos/turtlebot3_integration/container_scripts/nav2-stack/inject-localization-failure/script.bash
+++ b/demos/turtlebot3_integration/container_scripts/nav2-stack/inject-localization-failure/script.bash
@@ -15,8 +15,8 @@ echo "Waiting for particles to scatter..."
 sleep 2
 
 echo "Sending navigation goal with high localization uncertainty..."
-# Drop -f: action server typically rejects the goal under scattered particles,
-# which is the demo's intended failure mode - treat HTTP 400 as expected.
+# Drop -f so an error body is still printed. Nav2 accepts the goal and drives from
+# the scattered pose estimate.
 RESPONSE=$(curl -s -X POST "${API_BASE}/apps/bt-navigator/operations/navigate_to_pose/executions" \
     -H "Content-Type: application/json" \
     -d '{
diff --git a/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/metadata.json b/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/metadata.json
index c7bcd64..099f93d 100644
--- a/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/metadata.json
+++ b/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/metadata.json
@@ -1,5 +1,5 @@
 {
   "name": "Restore Normal Operation",
-  "description": "Cancel active navigation goals, restore velocity parameters to defaults, and clear all faults",
+  "description": "Cancel active navigation goals, restore velocity parameters to defaults, re-localize AMCL at the robot's pose in the simulation, and clear all faults",
   "format": "bash"
 }
diff --git a/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/script.bash b/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/script.bash
index d55c7af..46e8aa4 100755
--- a/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/script.bash
+++ b/demos/turtlebot3_integration/container_scripts/nav2-stack/restore-normal/script.bash
@@ -1,10 +1,33 @@
 #!/bin/bash
-# Restore normal operation: cancel goals, restore velocity params, clear all faults
+# Restore normal operation: cancel goals, restore velocity params, put AMCL back on
+# the robot's pose in the simulation, clear all faults
 set -eu
 
 GATEWAY_URL="${GATEWAY_URL:-http://localhost:8080}"
 API_BASE="${GATEWAY_URL}/api/v1"
 
+# A failed step is named on stderr, which the Scripts API returns as the error
+# message. The remaining steps still run; the script fails at the end.
+FAILURES=0
+report_failure() {
+    echo "FAIL: $1" >&2
+    FAILURES=$((FAILURES + 1))
+}
+
+# Sets one parameter and reports a refused or failed write.
+# Usage: put_config APP PARAM JSON_VALUE
+put_config() {
+    local app="$1" param="$2" value="$3" response code
+    response=$(curl -s -m 30 -w "\n%{http_code}" -X PUT \
+        "${API_BASE}/apps/${app}/configurations/${param}" \
+        -H "Content-Type: application/json" -d "{\"value\": ${value}}" 2>/dev/null) || response=$'\nnone'
+    code=$(tail -n 1 <<< "${response}")
+    case "${code}" in
+        2??) echo "  ${app}/${param} = ${value}" ;;
+        *) report_failure "${app}/${param} (HTTP ${code}: $(sed '$d' <<< "${response}" | jq -r '.message // empty' 2>/dev/null))" ;;
+    esac
+}
+
 echo "Canceling active navigation goals..."
 EXECUTIONS=$(curl -s "${API_BASE}/apps/bt-navigator/operations/navigate_to_pose/executions" 2>/dev/null || echo '{"items":[]}')
 if echo "${EXECUTIONS}" | jq -e '.items[]' > /dev/null 2>&1; then
@@ -20,19 +43,63 @@ fi
 
 echo ""
 echo "Restoring velocity parameters to defaults..."
-curl -s -X PUT "${API_BASE}/apps/velocity-smoother/configurations/max_velocity" \
-    -H "Content-Type: application/json" \
-    -d '{"value": [0.26, 0.0, 1.0]}' > /dev/null 2>&1 || true
+put_config velocity-smoother max_velocity "[0.26, 0.0, 1.0]"
+put_config controller-server FollowPath.max_vel_x 0.26
+
+# The map frame of this demo is the Gazebo world frame, so the robot's world pose
+# is the pose AMCL must hold. It is read from the running simulation after the
+# robot has stopped, never assumed.
+echo ""
+echo "Re-localizing AMCL at the robot's pose in the simulation..."
+sleep 1
+MODEL="${TURTLEBOT3_MODEL:-burger}"
+WORLD=$(timeout 10 gz topic -l 2>/dev/null | sed -n 's|^/world/\([^/]*\)/dynamic_pose/info$|\1|p' | head -n 1) || WORLD=""
+POSE_REQUEST=""
+if [ -n "${WORLD}" ]; then
+    # A single read has returned the model twice, so only the first match is used.
+    POSE_REQUEST=$(timeout 10 gz topic -e -n 1 -t "/world/${WORLD}/dynamic_pose/info" --json-output 2>/dev/null \
+        | jq -c -n --arg m "${MODEL}" '
+            first(inputs | .pose[] | select(.name == $m))
+            | (.orientation | [(.w // 0), (.x // 0), (.y // 0), (.z // 0)] as [$w, $x, $y, $z]
+               | atan2(2 * ($w * $z + $x * $y); 1 - 2 * ($y * $y + $z * $z))) as $yaw
+            | {parameters: {pose: {header: {frame_id: "map"},
+                pose: {pose: {position: {x: (.position.x // 0), y: (.position.y // 0), z: 0.0},
+                              orientation: {x: 0.0, y: 0.0, z: ($yaw / 2 | sin), w: ($yaw / 2 | cos)}},
+                       covariance: [range(36) | if . == 0 or . == 7 or . == 35 then 0.01 else 0.0 end]}}}}' \
+        2>/dev/null) || POSE_REQUEST=""
+fi
 
-curl -s -X PUT "${API_BASE}/apps/controller-server/configurations/FollowPath.max_vel_x" \
-    -H "Content-Type: application/json" \
-    -d '{"value": 0.26}' > /dev/null 2>&1 || true
+if [ -z "${POSE_REQUEST}" ]; then
+    report_failure "amcl/set_initial_pose (no pose for '${MODEL}' in the simulation)"
+else
+    echo "  Robot pose: $(echo "${POSE_REQUEST}" | jq -c '.parameters.pose.pose.pose.position | {x, y}')"
+    HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
+        "${API_BASE}/apps/amcl/operations/set_initial_pose/executions" \
+        -H "Content-Type: application/json" -d "${POSE_REQUEST}" 2>/dev/null) || HTTP_CODE="none"
+    if [ "${HTTP_CODE}" != "200" ]; then
+        report_failure "amcl/set_initial_pose (HTTP ${HTTP_CODE})"
+    fi
+fi
 
+# Faults are cleared after the re-localization, so no pose from the scattered
+# particle cloud is reported after the clear.
+echo ""
 echo "Clearing all faults..."
-curl -s -X DELETE "${API_BASE}/faults" > /dev/null || true
+CLEAR_CODE=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE "${API_BASE}/faults" 2>/dev/null) || CLEAR_CODE="none"
+case "${CLEAR_CODE}" in
+    2??) ;;
+    *) report_failure "faults clear (HTTP ${CLEAR_CODE})" ;;
+esac
+
+FAULT_COUNT=$(curl -sf "${API_BASE}/faults" | jq '.items | length' 2>/dev/null || echo "?")
+if [ "${FAILURES}" -gt 0 ]; then
+    echo ""
+    echo "Normal operation is not restored: ${FAILURES} step(s) failed. Active faults: ${FAULT_COUNT}"
+    echo "${FAILURES} restore step(s) failed" >&2
+    exit 1
+fi
 
 echo ""
 echo "Normal operation restored."
-FAULT_COUNT=$(curl -sf "${API_BASE}/faults" | jq '.items | length' 2>/dev/null || echo "?")
 echo "Active faults: ${FAULT_COUNT}"
 exit 0
diff --git a/demos/turtlebot3_integration/setup-triggers.sh b/demos/turtlebot3_integration/setup-triggers.sh
index b9390f6..f10974a 100755
--- a/demos/turtlebot3_integration/setup-triggers.sh
+++ b/demos/turtlebot3_integration/setup-triggers.sh
@@ -1,10 +1,10 @@
 #!/bin/bash
 # Create fault-monitoring trigger for turtlebot3 integration demo
-# Alerts on any fault change reported via the diagnostic bridge - the
-# anomaly-detector app has no faults of its own, faults arrive from
-# /diagnostics through the bridge.
+# Alerts on any fault change reported by the anomaly detector - navigation
+# and localization faults are reported directly, not via the diagnostic
+# bridge.
 export ENTITY_TYPE="apps"
-export ENTITY_ID="diagnostic-bridge"
-export INJECT_HINT="./inject-nav-failure.sh"
+export ENTITY_ID="anomaly-detector"
+export INJECT_HINT="./inject-localization-failure.sh"
 # shellcheck disable=SC1091
 source "$(cd "$(dirname "$0")" && pwd)/../../lib/setup-trigger.sh"
diff --git a/demos/turtlebot3_integration/watch-triggers.sh b/demos/turtlebot3_integration/watch-triggers.sh
index d6d9b6c..aa0746f 100755
--- a/demos/turtlebot3_integration/watch-triggers.sh
+++ b/demos/turtlebot3_integration/watch-triggers.sh
@@ -2,6 +2,6 @@
 # Watch trigger events for turtlebot3 integration demo
 # Connects to SSE stream and prints fault events in real time
 export ENTITY_TYPE="apps"
-export ENTITY_ID="diagnostic-bridge"
+export ENTITY_ID="anomaly-detector"
 # shellcheck disable=SC1091
 source "$(cd "$(dirname "$0")" && pwd)/../../lib/watch-trigger.sh" "$@"
diff --git a/tests/smoke_test.sh b/tests/smoke_test.sh
index cb03779..bb55b20 100755
--- a/tests/smoke_test.sh
+++ b/tests/smoke_test.sh
@@ -1,6 +1,8 @@
 #!/bin/bash
 # Smoke tests for sensor_diagnostics demo
-# Runs from the host against the containerized gateway on localhost:8080
+# Runs from the host against the containerized gateway on localhost:8080. Needs
+# docker access to the demo container (DEMO_CONTAINER) to pause its fault
+# manager and to restart it.
 #
 # Usage: ./tests/smoke_test.sh [GATEWAY_URL]
 # Default GATEWAY_URL: http://localhost:8080
@@ -12,12 +14,204 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=tests/smoke_lib.sh
 source "${SCRIPT_DIR}/smoke_lib.sh"
 
-trap print_summary EXIT
+DEMO_CONTAINER="${DEMO_CONTAINER:-sensor_diagnostics_demo_ci}"
+# Anchored so it does not match the bash -c wrapper that runs pgrep.
+FAULT_MANAGER_PATTERN='^/root/demo_ws/install/ros2_medkit_fault_manager/lib/ros2_medkit_fault_manager/fault_manager_node '
+
+# SIGSTOP on the fault manager makes the gateway's ListFaults call time out,
+# so GET /faults answers 503 as it does before the fault manager is up.
+stop_fault_manager() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 1
+        kill -STOP \"\${pid}\"
+    " > /dev/null 2>&1
+}
+
+resume_fault_manager() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 0
+        kill -CONT \"\${pid}\"
+    " > /dev/null 2>&1 || true
+}
+
+SENSOR_BIN_DIR=/root/demo_ws/install/sensor_diagnostics_demo/lib/sensor_diagnostics_demo
+
+# Sends SIGNAL to the demo's NODE executable; fails when it is not running.
+# SIGSTOP keeps a sensor node in the ROS graph but stops its messages.
+# Usage: signal_sensor NODE SIGNAL
+signal_sensor() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '^${SENSOR_BIN_DIR}/$1 ') || exit 1
+        kill -$2 \"\${pid}\"
+    " > /dev/null 2>&1
+}
+
+# Takes lidar_sim off the ROS graph. Its command line, which carries the
+# launch's parameter files, is kept for restore_lidar.
+remove_lidar() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '^${SENSOR_BIN_DIR}/lidar_sim_node ') || exit 1
+        tr '\\0' '\\n' < /proc/\${pid}/cmdline > /tmp/lidar_sim.cmdline
+        kill -TERM \"\${pid}\"
+        for _ in \$(seq 1 50); do kill -0 \"\${pid}\" 2> /dev/null || exit 0; sleep 0.1; done
+        exit 1
+    " > /dev/null 2>&1
+}
+
+# Starts lidar_sim from the kept command line unless it is running.
+restore_lidar() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        ! pgrep -f '^${SENSOR_BIN_DIR}/lidar_sim_node ' && test -s /tmp/lidar_sim.cmdline
+    " > /dev/null 2>&1 || return 0
+    # shellcheck disable=SC2016  # expanded by the container's bash
+    docker exec -d "${DEMO_CONTAINER}" bash -c 'source /opt/ros/jazzy/setup.bash \
+        && source /root/demo_ws/install/setup.bash \
+        && mapfile -t args < /tmp/lidar_sim.cmdline && exec "${args[@]}"' > /dev/null 2>&1 || true
+}
+
+# print_summary reads the script's exit status from $?, so hand it the status
+# saved on entry. set +e: under errexit `(exit rc)` would end the trap before
+# print_summary runs.
+cleanup_on_exit() {
+    local rc=$?
+    set +e
+    resume_fault_manager
+    signal_sensor lidar_sim_node CONT
+    signal_sensor imu_sim_node CONT
+    restore_lidar
+    (exit "${rc}")
+    print_summary
+}
+trap cleanup_on_exit EXIT
+
+CHECK_DEMO_SCRIPT="${SCRIPT_DIR}/../demos/sensor_diagnostics/check-demo.sh"
+
+# Runs check-demo.sh and prints its output without ANSI colours.
+run_check_demo() {
+    GATEWAY_URL="$GATEWAY_URL" bash "$CHECK_DEMO_SCRIPT" 2>&1 | sed 's/\x1b\[[0-9;]*m//g'
+}
+
+# Runs check-demo.sh with DATA_WAIT_SEC=$1 (empty: the script's default) and
+# prints each output line without ANSI colours, prefixed with the
+# milliseconds since the run started.
+run_check_demo_timed() {
+    local start=${EPOCHREALTIME//[!0-9]/} line
+    env ${1:+"DATA_WAIT_SEC=$1"} GATEWAY_URL="$GATEWAY_URL" timeout 180 bash "$CHECK_DEMO_SCRIPT" < /dev/null 2>&1 \
+        | while IFS= read -r line; do
+            printf '%d %s\n' $(( (${EPOCHREALTIME//[!0-9]/} - start) / 1000 )) "$line"
+        done | sed 's/\x1b\[[0-9;]*m//g'
+}
+
+# Prints the milliseconds check-demo.sh spent between the health check and
+# section 1, from a run_check_demo_timed output. Without section 1, the time
+# of the last line.
+readiness_wait_ms() {
+    awk '/^[0-9]+ .*Gateway is healthy/ { s = $1 }
+         /^[0-9]+ === 1\. / { e = $1; exit }
+         { last = $1 }
+         END { if (e == "") e = last; print e - s }' <<< "$1"
+}
+
+# Drops the time prefix of a run_check_demo_timed output.
+untimed() {
+    awk '{ sub(/^[0-9]+ /, ""); print }' <<< "$1"
+}
+
+# Prints what check-demo.sh printed between the health check and section 1.
+# One awk reads the output: an early exit behind a pipe would SIGPIPE the
+# writer, and pipefail would fail the caller.
+readiness_wait_output() {
+    awk '{ sub(/^[0-9]+ /, "") } /Gateway is healthy/ { on = 1; next } /^=== 1\. / { exit } on' <<< "$1"
+}
+
+# Prints the text lines of section N of a check-demo.sh output.
+check_demo_section_text() {
+    awk -v hdr="^=== $2\\\\. " '
+        $0 ~ hdr { on = 1; next }
+        on && /^=== [0-9]+\. / { exit }
+        on' <<< "$1"
+}
+
+# Prints the JSON values printed in section N of a check-demo.sh output as
+# one array: [] when the section is missing, nothing when it is not JSON.
+# Usage: check_demo_section OUTPUT N
+check_demo_section() {
+    check_demo_section_text "$1" "$2" | sed -n '/^[[{]/,$p' | jq -s '.' 2>/dev/null || true
+}
+
+# Prints the value of a configuration, or nothing when it cannot be read.
+# Usage: config_value APP PARAM
+config_value() {
+    curl -s -m 10 "${API_BASE}/apps/$1/configurations/$2" | jq -c '.data' 2>/dev/null || true
+}
+
+# True when section N (5 LiDAR, 6 IMU, 7 GPS, 8 configurations) of a
+# check-demo.sh output carries values of the right type.
+# Usage: section_values_printed OUTPUT N
+section_values_printed() {
+    local filter
+    case "$2" in
+        5) filter='length == 1 and ([.[0] | .angle_min, .angle_max, .range_min, .range_max, .sample_ranges[]]
+               | length == 9 and all(type == "number"))' ;;
+        6) filter='length == 1 and ([.[0] | .linear_acceleration[], .angular_velocity[]]
+               | length == 6 and all(type == "number"))' ;;
+        7) filter='length == 1 and ([.[0] | .latitude, .longitude, .altitude] | all(type == "number"))' ;;
+        8) filter='length > 0' ;;
+    esac
+    check_demo_section "$1" "$2" | jq -e "$filter" > /dev/null 2>&1
+}
+
+# Reports a FAILED fault through the fault manager's report_fault service.
+# Usage: report_fault CODE SOURCE_ID
+report_fault() {
+    curl -s -m 20 -X POST "${API_BASE}/apps/medkit-fault-manager/operations/report_fault/executions" \
+        -H "Content-Type: application/json" \
+        -d "$(jq -nc --arg code "$1" --arg src "$2" '{parameters: {fault_code: $code, event_type: 0,
+            severity: 2, description: "smoke test", source_id: $src}}')" \
+        | jq -e '.parameters.accepted == true' > /dev/null 2>&1
+}
 
 # --- Wait for gateway startup ---
 
+# /health answers about a second before the gateway links the sensor nodes, and
+# wait_for_gateway polls only every 2 s. The tighter poll lets the first
+# check-demo.sh run below start inside that window on a demo that has just started.
+for _ in $(seq 1 450); do
+    curl -sf -m 2 "${API_BASE}/health" > /dev/null 2>&1 && break
+    sleep 0.2
+done
 wait_for_gateway 90
 
+section "Check-Demo Before Linking"
+
+# Until the sensor nodes are linked, their data reads come back empty.
+# check-demo.sh must wait for the links and then print real values.
+EARLY_LIDAR_ITEMS=$(curl -s -m 5 "${API_BASE}/apps/lidar-sim/data" | jq '.items | length' 2>/dev/null) || true
+EARLY_RC=0
+EARLY_TIMED=$(run_check_demo_timed "") || EARLY_RC=$?
+EARLY_PLAIN=$(untimed "$EARLY_TIMED")
+echo "  LiDAR data items when check-demo.sh started: ${EARLY_LIDAR_ITEMS:-unreadable}; exit code ${EARLY_RC}"
+echo "  readiness wait $(readiness_wait_ms "$EARLY_TIMED") ms:" \
+    "$(readiness_wait_output "$EARLY_TIMED" | grep -vE '^ *$' | tr '\n' ';' | head -c 300)"
+
+if grep -q ': null' <<< "$EARLY_PLAIN"; then
+    fail "check-demo.sh started right after /health prints no null fields" \
+         "$(grep -B1 ': null' <<< "$EARLY_PLAIN" | head -10)"
+else
+    pass "check-demo.sh started right after /health prints no null fields"
+fi
+
+EARLY_MISSING=""
+for n in 5 6 7 8; do
+    section_values_printed "$EARLY_PLAIN" "$n" || EARLY_MISSING="${EARLY_MISSING} ${n}"
+done
+if [ "$EARLY_RC" -eq 0 ] && [ -z "$EARLY_MISSING" ]; then
+    pass "check-demo.sh started right after /health exits 0 and prints values in sections 5-8"
+else
+    fail "check-demo.sh started right after /health exits 0 and prints values in sections 5-8" \
+         "exit code ${EARLY_RC}; sections without values:${EARLY_MISSING:- none}; last lines: $(grep -vE '^ *$' <<< "$EARLY_PLAIN" | tail -n 3 | tr '\n' ';')"
+fi
+
 # Wait for entity discovery + runtime linking (nodes need to be linked to manifest apps)
 # In hybrid mode, manifest entities appear instantly but data/configurations require
 # the runtime refresh cycle to link ROS 2 nodes to manifest apps.
@@ -96,6 +290,93 @@ section "Logs"
 
 assert_non_empty_items "/apps/medkit-gateway/logs"
 
+section "Check-Demo Sensor Values"
+
+# Runs before the fault injection below, while the noise is at its default: at
+# the injected 0.5 m, 8 sigma spans the whole LiDAR range.
+
+# Checks section N of the first run against a direct read of ENDPOINT, and
+# that the second run printed a different sample. FILTER sees the printed
+# values as input, the direct read's .data as $g and SIGMA as $sigma.
+# Usage: assert_section_live N DESCRIPTION ENDPOINT SIGMA FILTER
+assert_section_live() {
+    local n="$1" description="$2" endpoint="$3" sigma="$4" filter="$5"
+    local printed printed_again direct
+    printed=$(check_demo_section "$SENSOR_RUN_1" "$n")
+    printed_again=$(check_demo_section "$SENSOR_RUN_2" "$n")
+    if ! api_get "$endpoint"; then
+        fail "$description" "direct read of ${endpoint} failed"
+        return
+    fi
+    direct=$(jq -c '.data' <<< "$RESPONSE" 2>/dev/null) || true
+    if ! jq -e --argjson g "${direct:-null}" --argjson sigma "${sigma:-null}" "$filter" \
+            <<< "$printed" > /dev/null 2>&1; then
+        fail "$description" "printed $(jq -c '.' <<< "$printed" 2>/dev/null || echo "no JSON"); sigma ${sigma}; direct read ${direct:0:300}"
+    elif [ "$printed" = "$printed_again" ]; then
+        fail "$description" "two runs printed the same values: $(jq -c '.' <<< "$printed")"
+    else
+        pass "$description"
+    fi
+}
+
+SENSOR_RUN_1=$(run_check_demo) || true
+# Every sensor publishes at 1 Hz or faster, so a run a second later reads new samples.
+sleep 1
+SENSOR_RUN_2=$(run_check_demo) || true
+
+if grep -q ': null' <<< "$SENSOR_RUN_1"; then
+    fail "check-demo.sh prints no null fields" "$(grep -B1 ': null' <<< "$SENSOR_RUN_1" | head -10)"
+else
+    pass "check-demo.sh prints no null fields"
+fi
+
+# Tolerances are 8 sigma of the live noise configuration: two independent
+# samples differ by more than that with a probability below 1e-7. The LiDAR
+# check also requires 8 sigma below a tenth of the scan's range span, or it
+# could not tell a real range from an invented one.
+LIDAR_FILTER=$(cat <<'JQ'
+8 * $sigma < ($g.range_max - $g.range_min) / 10
+and length == 1 and (.[0] as $p
+  | $p.angle_min == $g.angle_min and $p.angle_max == $g.angle_max
+    and $p.range_min == $g.range_min and $p.range_max == $g.range_max
+    and ($p.sample_ranges | type == "array" and length == 5)
+    and ([range(5)] | all(. as $i | $p.sample_ranges[$i] as $r
+          | ($r | type) == "number"
+            and $r >= $g.range_min and $r <= $g.range_max
+            and (($r - $g.ranges[$i]) | fabs) <= 8 * $sigma)))
+JQ
+)
+IMU_FILTER=$(cat <<'JQ'
+length == 1 and (.[0] as $p
+  | [["linear_acceleration", $sigma.accel], ["angular_velocity", $sigma.gyro]]
+  | all(.[0] as $k | .[1] as $s | ["x", "y", "z"]
+        | all(. as $a | ($p[$k][$a] | type) == "number"
+              and (($p[$k][$a] - $g[$k][$a]) | fabs) <= 8 * $s)))
+JQ
+)
+# 111 km per degree of latitude; a degree of longitude shrinks with cos(latitude).
+GPS_FILTER=$(cat <<'JQ'
+length == 1 and (.[0] as $p
+  | ([$p.latitude, $p.longitude, $p.altitude] | all(type == "number"))
+    and (($p.latitude - $g.latitude) | fabs) <= 8 * $sigma.pos / 111000
+    and (($p.longitude - $g.longitude) | fabs)
+        <= 8 * $sigma.pos / (111000 * (($g.latitude * 3.141592653589793 / 180) | cos))
+    and (($p.altitude - $g.altitude) | fabs) <= 8 * $sigma.alt
+    and $p.status == $g.status)
+JQ
+)
+
+assert_section_live 5 "check-demo.sh section 5 shows live LiDAR values matching a direct read" \
+    "/apps/lidar-sim/data/sensors%2Fscan" "$(config_value lidar-sim noise_stddev)" "$LIDAR_FILTER"
+assert_section_live 6 "check-demo.sh section 6 shows live IMU values matching a direct read" \
+    "/apps/imu-sim/data/sensors%2Fimu" \
+    "{\"accel\": $(config_value imu-sim accel_noise_stddev), \"gyro\": $(config_value imu-sim gyro_noise_stddev)}" \
+    "$IMU_FILTER"
+assert_section_live 7 "check-demo.sh section 7 shows live GPS values matching a direct read" \
+    "/apps/gps-sim/data/sensors%2Ffix" \
+    "{\"pos\": $(config_value gps-sim position_noise_stddev), \"alt\": $(config_value gps-sim altitude_noise_stddev)}" \
+    "$GPS_FILTER"
+
 section "Fault Injection"
 
 # Inject noise fault via configuration API
@@ -133,6 +414,75 @@ else
     fail "GET fault detail returns 200" "unexpected status code"
 fi
 
+section "Check-Demo Script"
+
+# The rosbag recording finalizes duration_after_sec after confirmation, so
+# poll for it rather than racing check-demo.sh against the write.
+echo "  Waiting for rosbag recording to finish (max 15s)..."
+if poll_until "/apps/diagnostic-bridge/bulk-data/rosbags" '.items | length > 0' 15; then
+    pass "rosbag recording available before running check-demo.sh"
+else
+    fail "rosbag recording available before running check-demo.sh" "no rosbag after 15s"
+fi
+
+# Run check-demo.sh again while the LIDAR_SIM fault above is active: section 8
+# must show the injected noise, and sections 10-12 need an active fault.
+CHECK_DEMO_PLAIN=$(run_check_demo) || true
+
+if grep -q ': null' <<< "$CHECK_DEMO_PLAIN"; then
+    fail "check-demo.sh prints no null fields with a fault active" \
+         "$(grep -B1 ': null' <<< "$CHECK_DEMO_PLAIN" | head -10)"
+else
+    pass "check-demo.sh prints no null fields with a fault active"
+fi
+
+# Section 8: exactly the parameters the list endpoint lists, each with the
+# value and ROS type its own detail endpoint returns.
+CONFIG_EXPECTED=""
+if api_get "/apps/lidar-sim/configurations"; then
+    CONFIG_EXPECTED="[]"
+    while IFS= read -r cfg_id; do
+        if ! api_get "/apps/lidar-sim/configurations/${cfg_id//\//%2F}"; then
+            CONFIG_EXPECTED=""
+            break
+        fi
+        CONFIG_EXPECTED=$(jq -c --argjson d "$RESPONSE" \
+            '. + [{name: $d.id, value: $d.data, type: $d["x-medkit"].parameter.type}]' <<< "$CONFIG_EXPECTED")
+    done < <(jq -r '.items[].id' <<< "$RESPONSE")
+fi
+CONFIG_PRINTED=$(check_demo_section "$CHECK_DEMO_PLAIN" 8)
+if [ -z "$CONFIG_EXPECTED" ]; then
+    fail "check-demo.sh section 8 lists every LiDAR configuration with its value and type" \
+         "direct read of /apps/lidar-sim/configurations failed"
+elif [ "$(jq -cS 'sort_by(.name)' <<< "$CONFIG_PRINTED" 2>/dev/null)" = "$(jq -cS 'sort_by(.name)' <<< "$CONFIG_EXPECTED")" ]; then
+    pass "check-demo.sh section 8 lists every LiDAR configuration with its value and type"
+else
+    fail "check-demo.sh section 8 lists every LiDAR configuration with its value and type" \
+         "$(jq -nc --argjson p "${CONFIG_PRINTED:-[]}" --argjson e "$CONFIG_EXPECTED" \
+             '{missing: ($e - $p), unexpected: ($p - $e)}' 2>/dev/null || echo "section 8 is not JSON")"
+fi
+
+if grep -q "10\. Fault Detail with Environment Data" <<< "$CHECK_DEMO_PLAIN"; then
+    pass "check-demo.sh runs the fault detail section for the active fault"
+else
+    fail "check-demo.sh runs the fault detail section for the active fault" \
+         "section 10 did not run: the owning App was not resolved"
+fi
+
+if grep -q '"snapshot_count": 0' <<< "$CHECK_DEMO_PLAIN"; then
+    fail "check-demo.sh fault detail shows real snapshot data" "snapshot_count is 0"
+elif grep -q '"snapshot_count":' <<< "$CHECK_DEMO_PLAIN"; then
+    pass "check-demo.sh fault detail shows real snapshot data"
+else
+    fail "check-demo.sh fault detail shows real snapshot data" "snapshot_count field missing"
+fi
+
+if grep -q '"id": "fault_LIDAR_SIM' <<< "$CHECK_DEMO_PLAIN"; then
+    pass "check-demo.sh bulk-data section lists a real rosbag recording"
+else
+    fail "check-demo.sh bulk-data section lists a real rosbag recording" "no fault_LIDAR_SIM rosbag id found"
+fi
+
 # Cleanup: restore config + delete fault
 echo "  Cleaning up: restoring config and clearing fault..."
 curl -s -X PUT "${API_BASE}/apps/lidar-sim/configurations/noise_stddev" \
@@ -190,6 +540,338 @@ if [ "$beacon_found" = false ]; then
     echo -e "  ${BLUE}SKIP${NC} beacon not active (BEACON_MODE=none or plugin not loaded)"
 fi
 
+section "check-demo.sh: a failed fault read is not reported as no faults"
+
+FAILED_READ_LOG=$(mktemp)
+if stop_fault_manager; then
+    if api_get "/faults" 503; then
+        pass "setup: GET /faults answers 503 while the fault manager is stopped"
+    else
+        fail "setup: GET /faults answers 503 while the fault manager is stopped" "got: $(head -c 200 <<< "${RESPONSE}")"
+    fi
+    if GATEWAY_URL="$GATEWAY_URL" timeout 120 bash "$CHECK_DEMO_SCRIPT" < /dev/null > "$FAILED_READ_LOG" 2>&1; then
+        FAILED_READ_RC=0
+    else
+        FAILED_READ_RC=$?
+    fi
+    resume_fault_manager
+    if [ "$FAILED_READ_RC" -ne 0 ] && grep -q 'Could not read faults .*(HTTP 503)' "$FAILED_READ_LOG" \
+        && ! grep -q 'No active faults' "$FAILED_READ_LOG"; then
+        pass "check-demo.sh exits non-zero on HTTP 503 and does not claim there are no faults"
+    else
+        fail "check-demo.sh exits non-zero on HTTP 503 and does not claim there are no faults" \
+            "rc=${FAILED_READ_RC}; output: $(sed 's/\x1b\[[0-9;]*m//g' "$FAILED_READ_LOG" | grep -vE '^ *$' | tail -n 6 | tr '\n' ';')"
+    fi
+    if poll_until "/faults" '.items | arrays' 30; then
+        pass "setup: GET /faults answers again after the fault manager resumes"
+    else
+        fail "setup: GET /faults answers again after the fault manager resumes" "still failing after 30 s"
+    fi
+else
+    fail "setup: fault manager stopped" "no fault_manager_node process in ${DEMO_CONTAINER}"
+fi
+rm -f "$FAILED_READ_LOG"
+
+section "check-demo.sh: a fault reported from a sub-path of an App's node"
+
+# The anomaly detector reports as /processing/anomaly_detector/<sensor>, a
+# sub-path of its node. Sections 10-12 use the first listed fault, so the
+# other faults are cleared before each report.
+SUBPATH_CODE="SMOKE_SUBPATH_SOURCE"
+SIBLING_CODE="SMOKE_SIBLING_SOURCE"
+curl -s -m 20 -X DELETE "${API_BASE}/faults" > /dev/null || true
+if report_fault "$SUBPATH_CODE" "/processing/anomaly_detector/imu_sim" \
+    && poll_until "/faults" ".items[0].fault_code == \"${SUBPATH_CODE}\"" 15; then
+    pass "setup: ${SUBPATH_CODE} from /processing/anomaly_detector/imu_sim is the first listed fault"
+    SUBPATH_PLAIN=$(run_check_demo) || true
+    SUBPATH_SHOWN=$(check_demo_section "$SUBPATH_PLAIN" 10 | jq -r '.[0].code // empty' 2>/dev/null) || true
+    if [ "$SUBPATH_SHOWN" = "$SUBPATH_CODE" ] \
+        && grep -q "Fetching fault ${SUBPATH_CODE} on apps/anomaly-detector\.\.\." <<< "$SUBPATH_PLAIN"; then
+        pass "check-demo.sh section 10 shows a sub-path fault on the App that owns the node"
+    else
+        fail "check-demo.sh section 10 shows a sub-path fault on the App that owns the node" \
+            "section 10 code: ${SUBPATH_SHOWN:-none}; $(grep -m1 -E 'Could not map|Fetching fault' <<< "$SUBPATH_PLAIN")"
+    fi
+    if grep -q "=== 11\. " <<< "$SUBPATH_PLAIN" && grep -q "=== 12\. " <<< "$SUBPATH_PLAIN"; then
+        pass "check-demo.sh runs sections 11 and 12 for a sub-path fault"
+    else
+        fail "check-demo.sh runs sections 11 and 12 for a sub-path fault" "section 11 or 12 missing"
+    fi
+    if grep -q ': null' <<< "$SUBPATH_PLAIN"; then
+        fail "check-demo.sh prints no null fields for a sub-path fault" \
+            "$(grep -B1 ': null' <<< "$SUBPATH_PLAIN" | head -10)"
+    else
+        pass "check-demo.sh prints no null fields for a sub-path fault"
+    fi
+    # The gateway lists a node's rosbags only for faults reported under the
+    # exact node path, so this section may have no recording to list.
+    SUBPATH_ROSBAGS_TEXT=$(check_demo_section_text "$SUBPATH_PLAIN" 12)
+    if check_demo_section "$SUBPATH_PLAIN" 12 | jq -e 'length > 0' > /dev/null 2>&1 \
+        || grep -q "No rosbag recordings" <<< "$SUBPATH_ROSBAGS_TEXT"; then
+        pass "check-demo.sh section 12 lists rosbags or says there are none"
+    else
+        fail "check-demo.sh section 12 lists rosbags or says there are none" \
+            "section 12: $(tr '\n' ';' <<< "$SUBPATH_ROSBAGS_TEXT" | head -c 300)"
+    fi
+else
+    fail "setup: ${SUBPATH_CODE} from /processing/anomaly_detector/imu_sim is the first listed fault" \
+        "first listed: $(curl -s -m 10 "${API_BASE}/faults" | jq -c '.items[0] | {fault_code, reporting_sources}' 2>/dev/null)"
+fi
+
+# A source that only shares a name prefix with a node is not under it.
+curl -s -m 20 -X DELETE "${API_BASE}/faults" > /dev/null || true
+if report_fault "$SIBLING_CODE" "/processing/anomaly_detector_extra" \
+    && poll_until "/faults" ".items[0].fault_code == \"${SIBLING_CODE}\"" 15; then
+    pass "setup: ${SIBLING_CODE} from /processing/anomaly_detector_extra is the first listed fault"
+    SIBLING_PLAIN=$(run_check_demo) || true
+    if grep -q "Could not map fault ${SIBLING_CODE} to a reporting App" <<< "$SIBLING_PLAIN" \
+        && ! grep -q "=== 10\. " <<< "$SIBLING_PLAIN"; then
+        pass "check-demo.sh maps no App to a source that only shares a name prefix with its node"
+    else
+        fail "check-demo.sh maps no App to a source that only shares a name prefix with its node" \
+            "$(grep -m1 -E 'Could not map|Fetching fault' <<< "$SIBLING_PLAIN")"
+    fi
+else
+    fail "setup: ${SIBLING_CODE} from /processing/anomaly_detector_extra is the first listed fault" \
+        "first listed: $(curl -s -m 10 "${API_BASE}/faults" | jq -c '.items[0] | {fault_code, reporting_sources}' 2>/dev/null)"
+fi
+curl -s -m 20 -X DELETE "${API_BASE}/faults" > /dev/null || true
+
+section "check-demo.sh waits for a sensor without a first message"
+
+# The first run above races the linking and often starts after it. Here the
+# wait is needed on every run: on a fresh gateway the LiDAR is held before
+# anything reads it and resumed 2 s into the run, well inside both the
+# 30 s link wait and the 5 s first-message wait.
+if docker restart "${DEMO_CONTAINER}" > /dev/null 2>&1; then
+    pass "setup: ${DEMO_CONTAINER} restarted"
+else
+    fail "setup: ${DEMO_CONTAINER} restarted" "docker restart failed"
+fi
+wait_for_gateway 90
+if signal_sensor lidar_sim_node STOP; then
+    pass "setup: lidar_sim held right after /health"
+    ( sleep 2; signal_sensor lidar_sim_node CONT || true ) &
+    HOLD_PID=$!
+    HELD_RC=0
+    HELD_TIMED=$(run_check_demo_timed "") || HELD_RC=$?
+    wait "$HOLD_PID" 2>/dev/null || true
+    signal_sensor lidar_sim_node CONT || true
+    HELD_PLAIN=$(untimed "$HELD_TIMED")
+    HELD_WAIT_TEXT=$(readiness_wait_output "$HELD_TIMED")
+    echo "  readiness wait $(readiness_wait_ms "$HELD_TIMED") ms:" \
+        "$(grep -vE '^ *$' <<< "$HELD_WAIT_TEXT" | tr '\n' ';' | head -c 300)"
+    HELD_MISSING=""
+    for n in 5 6 7 8; do
+        section_values_printed "$HELD_PLAIN" "$n" || HELD_MISSING="${HELD_MISSING} ${n}"
+    done
+    if [ "$HELD_RC" -eq 0 ] && [ -z "$HELD_MISSING" ] && ! grep -q ': null' <<< "$HELD_PLAIN"; then
+        pass "check-demo.sh with the LiDAR held exits 0 and prints values in sections 5-8"
+    else
+        fail "check-demo.sh with the LiDAR held exits 0 and prints values in sections 5-8" \
+            "exit code ${HELD_RC}; sections without values:${HELD_MISSING:- none}; last lines: $(grep -vE '^ *$' <<< "$HELD_PLAIN" | tail -n 3 | tr '\n' ';')"
+    fi
+    if grep -q "^Waiting for .*lidar-sim" <<< "$HELD_WAIT_TEXT"; then
+        pass "check-demo.sh says it waits for the held LiDAR"
+    else
+        fail "check-demo.sh says it waits for the held LiDAR" \
+            "wait printed: $(grep -vE '^ *$' <<< "$HELD_WAIT_TEXT" | tr '\n' ';' | head -c 300)"
+    fi
+else
+    fail "setup: lidar_sim held right after /health" "no lidar_sim_node process in ${DEMO_CONTAINER}"
+fi
+
+section "check-demo.sh with a late link and a sensor that resumes while it waits"
+
+# lidar_sim leaves the ROS graph and comes back 9 s into the run, past the 5 s
+# first-message window, so only the link wait brings its values. The IMU is
+# linked but held until 7 s, past its own window while the wait goes on for
+# the LiDAR: the wait must still notice its messages and must not report it
+# silent.
+if docker restart "${DEMO_CONTAINER}" > /dev/null 2>&1; then
+    pass "setup: ${DEMO_CONTAINER} restarted"
+else
+    fail "setup: ${DEMO_CONTAINER} restarted" "docker restart failed"
+fi
+wait_for_gateway 90
+wait_for_runtime_linking "/apps/imu-sim/data" 60
+if signal_sensor imu_sim_node STOP && remove_lidar; then
+    pass "setup: imu_sim held and lidar_sim off the ROS graph"
+    if poll_until "/apps/lidar-sim/data" '.items | length == 0' 30; then
+        pass "setup: the gateway has unlinked lidar-sim before the run"
+    else
+        fail "setup: the gateway has unlinked lidar-sim before the run" "lidar-sim data still listed after 30 s"
+    fi
+    ( sleep 7; signal_sensor imu_sim_node CONT || true ) &
+    IMU_TIMER_PID=$!
+    ( sleep 9; restore_lidar ) &
+    LIDAR_TIMER_PID=$!
+    LATE_RC=0
+    LATE_TIMED=$(run_check_demo_timed "") || LATE_RC=$?
+    wait "$IMU_TIMER_PID" "$LIDAR_TIMER_PID" 2>/dev/null || true
+    signal_sensor imu_sim_node CONT || true
+    restore_lidar
+    LATE_PLAIN=$(untimed "$LATE_TIMED")
+    LATE_WAIT_TEXT=$(readiness_wait_output "$LATE_TIMED")
+    LATE_WAIT_MS=$(readiness_wait_ms "$LATE_TIMED")
+    echo "  readiness wait ${LATE_WAIT_MS} ms:" \
+        "$(grep -vE '^ *$' <<< "$LATE_WAIT_TEXT" | tr '\n' ';' | head -c 400)"
+
+    LATE_MISSING=""
+    for n in 5 6 7 8; do
+        section_values_printed "$LATE_PLAIN" "$n" || LATE_MISSING="${LATE_MISSING} ${n}"
+    done
+    if [ "$LATE_RC" -eq 0 ] && [ -z "$LATE_MISSING" ] && ! grep -q ': null' <<< "$LATE_PLAIN" \
+        && grep -q "^Waiting for the gateway to link lidar-sim" <<< "$LATE_WAIT_TEXT"; then
+        pass "check-demo.sh waits for a link that comes after the 5 s window, exits 0 and prints values in sections 5-8"
+    else
+        fail "check-demo.sh waits for a link that comes after the 5 s window, exits 0 and prints values in sections 5-8" \
+            "exit code ${LATE_RC}; sections without values:${LATE_MISSING:- none}; waited ${LATE_WAIT_MS} ms"
+    fi
+
+    if grep -q "^Waiting for a first message from imu-sim" <<< "$LATE_WAIT_TEXT" && [ "$LATE_WAIT_MS" -ge 8000 ]; then
+        pass "setup: the wait held the IMU past its 5 s window and went on past 8 s"
+    else
+        fail "setup: the wait held the IMU past its 5 s window and went on past 8 s" \
+            "waited ${LATE_WAIT_MS} ms"
+    fi
+    if section_values_printed "$LATE_PLAIN" 6 && ! grep -q "No message from imu-sim" <<< "$LATE_WAIT_TEXT"; then
+        pass "check-demo.sh does not report the IMU silent after it sent data during the wait"
+    else
+        fail "check-demo.sh does not report the IMU silent after it sent data during the wait" \
+            "wait printed: $(grep -vE '^ *$' <<< "$LATE_WAIT_TEXT" | grep -v '^Waiting' | tr '\n' ';' | head -c 300); section 6: $(check_demo_section "$LATE_PLAIN" 6 | jq -c . 2>/dev/null | head -c 120)"
+    fi
+    curl -s -m 20 -X DELETE "${API_BASE}/faults" > /dev/null || true
+else
+    fail "setup: imu_sim held and lidar_sim off the ROS graph" "sensor nodes not found in ${DEMO_CONTAINER}"
+    signal_sensor imu_sim_node CONT || true
+    restore_lidar
+fi
+
+section "check-demo.sh with a failed IMU on a fresh gateway"
+
+# The gateway keeps the last message of a topic it has read. A sensor that
+# stops before its first read has no message at all, so the demo restarts
+# and the IMU fails before anything reads it.
+if docker restart "${DEMO_CONTAINER}" > /dev/null 2>&1; then
+    pass "setup: ${DEMO_CONTAINER} restarted"
+else
+    fail "setup: ${DEMO_CONTAINER} restarted" "docker restart failed"
+fi
+wait_for_gateway 90
+wait_for_runtime_linking "/apps/imu-sim/data" 60
+assert_script_execution "compute-unit" "inject-failure" 30
+if poll_until "/faults" '.items | length > 0' 30; then
+    pass "setup: a fault is listed after the IMU failure"
+else
+    fail "setup: a fault is listed after the IMU failure" "no fault after 30 s"
+fi
+if api_get "/health" && jq -e '."x-medkit-data-provider".pool_size == 0' <<< "$RESPONSE" > /dev/null 2>&1; then
+    pass "setup: the gateway has read no topic before check-demo.sh runs"
+else
+    fail "setup: the gateway has read no topic before check-demo.sh runs" \
+        "$(jq -c '."x-medkit-data-provider"' <<< "$RESPONSE" 2>/dev/null)"
+fi
+
+# check-demo.sh bounds each request of its readiness wait to this many seconds.
+CHECK_DEMO_REQUEST_TIMEOUT_SEC=3
+
+FAILED_IMU_RC=0
+FAILED_IMU_TIMED=$(run_check_demo_timed "") || FAILED_IMU_RC=$?
+FAILED_IMU_PLAIN=$(untimed "$FAILED_IMU_TIMED")
+FAILED_IMU_WAIT_MS=$(readiness_wait_ms "$FAILED_IMU_TIMED")
+echo "  readiness wait ${FAILED_IMU_WAIT_MS} ms, exit code ${FAILED_IMU_RC}"
+
+if [ "$FAILED_IMU_RC" -eq 0 ]; then
+    pass "check-demo.sh exits 0 with the IMU failed"
+else
+    fail "check-demo.sh exits 0 with the IMU failed" \
+        "exit code ${FAILED_IMU_RC}: $(grep -vE '^ *$' <<< "$FAILED_IMU_PLAIN" | tail -n 3 | tr '\n' ';')"
+fi
+if grep -q ': null' <<< "$FAILED_IMU_PLAIN"; then
+    fail "check-demo.sh prints no null fields with the IMU failed" \
+        "$(grep -B1 ': null' <<< "$FAILED_IMU_PLAIN" | head -10)"
+else
+    pass "check-demo.sh prints no null fields with the IMU failed"
+fi
+FAILED_IMU_SECTION_6=$(check_demo_section_text "$FAILED_IMU_PLAIN" 6)
+if grep -q "=== 6\. " <<< "$FAILED_IMU_PLAIN" \
+    && check_demo_section "$FAILED_IMU_PLAIN" 6 | jq -e 'length == 0' > /dev/null 2>&1 \
+    && grep -qi "no IMU data" <<< "$FAILED_IMU_SECTION_6"; then
+    pass "check-demo.sh section 6 says the IMU has no data"
+else
+    fail "check-demo.sh section 6 says the IMU has no data" \
+        "section 6: $(tr '\n' ';' <<< "$FAILED_IMU_SECTION_6" | head -c 300)"
+fi
+if section_values_printed "$FAILED_IMU_PLAIN" 5 && section_values_printed "$FAILED_IMU_PLAIN" 7; then
+    pass "check-demo.sh prints LiDAR and GPS values with the IMU failed"
+else
+    fail "check-demo.sh prints LiDAR and GPS values with the IMU failed" \
+        "section 5: $(check_demo_section "$FAILED_IMU_PLAIN" 5 | jq -c . 2>/dev/null | head -c 150); section 7: $(check_demo_section "$FAILED_IMU_PLAIN" 7 | jq -c . 2>/dev/null | head -c 150)"
+fi
+FAILED_IMU_MISSING=""
+for n in 9 10 11 12; do
+    grep -q "=== ${n}\. " <<< "$FAILED_IMU_PLAIN" || FAILED_IMU_MISSING="${FAILED_IMU_MISSING} ${n}"
+done
+if [ -z "$FAILED_IMU_MISSING" ]; then
+    pass "check-demo.sh runs sections 9-12 with the IMU failed"
+else
+    fail "check-demo.sh runs sections 9-12 with the IMU failed" "missing sections:${FAILED_IMU_MISSING}"
+fi
+
+# The wait names only the sensor it waited for; LiDAR and GPS had data.
+FAILED_IMU_WAIT_TEXT=$(readiness_wait_output "$FAILED_IMU_TIMED")
+if grep -q "imu-sim" <<< "$FAILED_IMU_WAIT_TEXT" && ! grep -qE "lidar-sim|gps-sim" <<< "$FAILED_IMU_WAIT_TEXT"; then
+    pass "check-demo.sh's wait names the sensor it waited for"
+else
+    fail "check-demo.sh's wait names the sensor it waited for" \
+        "wait printed: $(grep -vE '^ *$' <<< "$FAILED_IMU_WAIT_TEXT" | tr '\n' ';' | head -c 300)"
+fi
+
+# The IMU line reports how long the wait went on for it, which here is the
+# whole wait.
+FAILED_IMU_REPORTED_S=$(awk '/imu-sim/ && !/^Waiting/ && match($0, /[0-9]+s/) {
+    print substr($0, RSTART, RLENGTH - 1); exit }' <<< "$FAILED_IMU_WAIT_TEXT")
+if [ -n "$FAILED_IMU_REPORTED_S" ] \
+    && [ "$(( FAILED_IMU_REPORTED_S * 1000 - FAILED_IMU_WAIT_MS ))" -le 2000 ] \
+    && [ "$(( FAILED_IMU_WAIT_MS - FAILED_IMU_REPORTED_S * 1000 ))" -le 2000 ]; then
+    pass "check-demo.sh reports the time it waited for the IMU"
+else
+    fail "check-demo.sh reports the time it waited for the IMU" \
+        "reported ${FAILED_IMU_REPORTED_S:-nothing} s; waited ${FAILED_IMU_WAIT_MS} ms"
+fi
+
+# The wait is bounded by wall-clock time: DATA_WAIT_SEC plus one request.
+# A cold IMU read blocks for the gateway's sample timeout, so a wait that
+# counts passes instead of seconds overruns here.
+if [ "$FAILED_IMU_WAIT_MS" -le $(( (30 + CHECK_DEMO_REQUEST_TIMEOUT_SEC) * 1000 )) ]; then
+    pass "check-demo.sh's readiness wait ends within the default 30 s plus one request"
+else
+    fail "check-demo.sh's readiness wait ends within the default 30 s plus one request" \
+        "waited ${FAILED_IMU_WAIT_MS} ms"
+fi
+# 08 is a whole number of seconds with a leading zero, not an octal number.
+# Here the IMU's 5 s first-message window ends the wait before 8 s, so the
+# wait must last at least 3 s: a value read as 0 or refused ends it at once.
+for wait_sec in 0 2 08; do
+    WAIT_RC=0
+    WAIT_TIMED=$(run_check_demo_timed "$wait_sec") || WAIT_RC=$?
+    WAIT_MS=$(readiness_wait_ms "$WAIT_TIMED")
+    WAIT_MIN_MS=0
+    [ "$wait_sec" = 08 ] && WAIT_MIN_MS=3000
+    echo "  DATA_WAIT_SEC=${wait_sec}: readiness wait ${WAIT_MS} ms, exit code ${WAIT_RC}"
+    if [ "$WAIT_RC" -eq 0 ] && [ "$WAIT_MS" -ge "$WAIT_MIN_MS" ] \
+        && [ "$WAIT_MS" -le $(( (10#$wait_sec + CHECK_DEMO_REQUEST_TIMEOUT_SEC) * 1000 )) ] \
+        && grep -q "=== 12\. " <<< "$WAIT_TIMED"; then
+        pass "check-demo.sh with DATA_WAIT_SEC=${wait_sec} waits at most ${wait_sec} s plus one request and runs to section 12"
+    else
+        fail "check-demo.sh with DATA_WAIT_SEC=${wait_sec} waits at most ${wait_sec} s plus one request and runs to section 12" \
+            "exit code ${WAIT_RC}, waited ${WAIT_MS} ms: $(grep -vE '^[0-9]+ *$' <<< "$WAIT_TIMED" | tail -n 2 | tr '\n' ';')"
+    fi
+done
+
+assert_script_execution "compute-unit" "restore-normal" 30
+
 # --- Summary ---
 
 # print_summary runs via EXIT trap; exit code reflects test results
diff --git a/tests/smoke_test_debounce.sh b/tests/smoke_test_debounce.sh
index 39505bc..0087d6a 100755
--- a/tests/smoke_test_debounce.sh
+++ b/tests/smoke_test_debounce.sh
@@ -24,11 +24,12 @@
 #      burst and why healing_threshold is 0.
 #
 # Faults are injected through the gateway's own SOVD operation endpoint for
-# /fault_manager/report_fault rather than by driving Gazebo. Navigation-driven
-# injection is too timing-dependent for CI (see the header of
-# smoke_test_turtlebot3.sh), and the contract under test is how the fault
-# manager resolves thresholds per source, which a report exercises exactly as
-# the detector does.
+# /fault_manager/report_fault rather than by driving Gazebo. The thresholds are
+# counts of FAILED and PASSED events per source, and only a direct report sends
+# an exact number of them; a navigation goal makes the detector report as often
+# as its state changes. The contract under test is how the fault manager
+# resolves thresholds per source, which a report exercises exactly as the
+# detector does.
 
 GATEWAY_URL="${1:-http://localhost:8080}"
 API_BASE="${GATEWAY_URL}/api/v1"
diff --git a/tests/smoke_test_moveit.sh b/tests/smoke_test_moveit.sh
index 30533e4..67b7208 100755
--- a/tests/smoke_test_moveit.sh
+++ b/tests/smoke_test_moveit.sh
@@ -18,7 +18,408 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=tests/smoke_lib.sh
 source "${SCRIPT_DIR}/smoke_lib.sh"
 
-trap print_summary EXIT
+DEMO_DIR="$(cd "${SCRIPT_DIR}/../demos/moveit_pick_place" && pwd)"
+DEMO_CONTAINER="${MOVEIT_DEMO_CONTAINER:-moveit_medkit_demo_ci}"
+ACTION="/panda_arm_controller/follow_joint_trajectory"
+PICK_PLACE_PATTERN='^python3 /root/demo_ws/install/moveit_medkit_demo/lib/moveit_medkit_demo/pick_place_loop\.py'
+FAULT_MANAGER_PATTERN='^/root/demo_ws/install/ros2_medkit_fault_manager/lib/ros2_medkit_fault_manager/fault_manager_node '
+
+# container_python <args...>: run the Python script on stdin inside the demo
+# container, with the ROS 2 environment sourced. The process is killed after
+# 240 s, which is longer than every wait inside CONTROLLER_PROBE_PY together.
+container_python() {
+    docker exec -i "${DEMO_CONTAINER}" bash -c '
+        set +u
+        source /opt/ros/jazzy/setup.bash
+        source /root/demo_ws/install/setup.bash
+        exec timeout 240 python3 - "$@"
+    ' container_python "$@"
+}
+
+# Arm controller probe, run with container_python. Every mode first waits up
+# to 30 s for the action server, then up to 60 s until neither the arm
+# controller nor MoveGroup has an active goal for 1 s. Exits non-zero when a
+# wait runs out.
+#   idle <action>:    only these waits.
+#   fault <action>:   send two goals back to back. The second preempts the
+#                     first, which manipulation_monitor reports as a fault.
+#   preempt <action>: print ARMED, then preempt the next goal the arm
+#                     controller starts, and print that goal's final status.
+CONTROLLER_PROBE_PY=$(cat <<'PY'
+import sys
+import time
+
+import rclpy
+from action_msgs.msg import GoalStatus, GoalStatusArray
+from builtin_interfaces.msg import Duration
+from control_msgs.action import FollowJointTrajectory
+from rclpy.action import ActionClient
+from rclpy.node import Node
+from rclpy.qos import qos_profile_action_status_default
+from trajectory_msgs.msg import JointTrajectoryPoint
+
+mode, arm_action = sys.argv[1], sys.argv[2]
+ACTIVE = (GoalStatus.STATUS_ACCEPTED, GoalStatus.STATUS_EXECUTING, GoalStatus.STATUS_CANCELING)
+TERMINAL = {GoalStatus.STATUS_SUCCEEDED: "SUCCEEDED", GoalStatus.STATUS_CANCELED: "CANCELED",
+            GoalStatus.STATUS_ABORTED: "ABORTED"}
+READY = [0.0, -0.785, 0.0, -2.356, 0.0, 1.571, 0.785]
+
+rclpy.init()
+node = Node("smoke_controller_probe")
+goals = {}
+subscriptions = []
+for action in (arm_action, "/move_action"):
+    goals[action] = []
+    subscriptions.append(node.create_subscription(
+        GoalStatusArray, action + "/_action/status",
+        lambda msg, action=action: goals.__setitem__(action, list(msg.status_list)),
+        qos_profile_action_status_default))
+client = ActionClient(node, FollowJointTrajectory, arm_action)
+
+
+def spin_until(condition, timeout):
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        rclpy.spin_once(node, timeout_sec=0.05)
+        if condition():
+            return True
+    return False
+
+
+def wait_future(future, timeout, what):
+    if not spin_until(future.done, timeout):
+        sys.exit(f"no {what} within {timeout} s")
+    return future.result()
+
+
+def send_ready_goal(sec):
+    goal = FollowJointTrajectory.Goal()
+    goal.trajectory.joint_names = [f"panda_joint{i}" for i in range(1, 8)]
+    goal.trajectory.points = [JointTrajectoryPoint(positions=READY, time_from_start=Duration(sec=sec))]
+    handle = wait_future(client.send_goal_async(goal), 10, "goal response")
+    if not handle.accepted:
+        sys.exit("arm controller rejected the goal")
+    return handle
+
+
+def final_status(handle):
+    return TERMINAL.get(wait_future(handle.get_result_async(), 10, "goal result").status, "UNKNOWN")
+
+
+quiet_since = None
+
+
+def idle():
+    global quiet_since
+    busy = any(s.status in ACTIVE for status_list in goals.values() for s in status_list)
+    matched = all(sub.get_publisher_count() > 0 for sub in subscriptions)
+    if busy or not matched:
+        quiet_since = None
+        return False
+    quiet_since = quiet_since or time.monotonic()
+    return time.monotonic() - quiet_since >= 1.0
+
+
+if not client.wait_for_server(timeout_sec=30):
+    sys.exit("arm controller action server not available within 30 s")
+if not spin_until(idle, 60):
+    sys.exit("arm controller or MoveGroup still busy after 60 s")
+
+if mode == "fault":
+    first = send_ready_goal(3)
+    second = send_ready_goal(1)
+    first_status, second_status = final_status(first), final_status(second)
+    print(f"first goal {first_status}, second goal {second_status}", flush=True)
+    if first_status == "SUCCEEDED":
+        sys.exit("the second goal did not preempt the first")
+
+if mode == "preempt":
+    seen = {bytes(s.goal_info.goal_id.uuid) for s in goals[arm_action]}
+    print("ARMED", flush=True)
+    target = []
+
+    def new_goal_executing():
+        target[:] = [bytes(s.goal_info.goal_id.uuid) for s in goals[arm_action]
+                     if s.status == GoalStatus.STATUS_EXECUTING
+                     and bytes(s.goal_info.goal_id.uuid) not in seen][:1]
+        return bool(target)
+
+    if not spin_until(new_goal_executing, 90):
+        sys.exit("no new arm goal started within 90 s")
+    competing = send_ready_goal(1)
+    target_status = []
+
+    def target_finished():
+        target_status[:] = [TERMINAL[s.status] for s in goals[arm_action]
+                            if bytes(s.goal_info.goal_id.uuid) == target[0] and s.status in TERMINAL]
+        return bool(target_status)
+
+    if not spin_until(target_finished, 10):
+        sys.exit("the goal to preempt did not finish within 10 s")
+    print(f"PREEMPTED goal {target_status[0]}, competing goal {final_status(competing)}", flush=True)
+    if target_status[0] == "SUCCEEDED":
+        sys.exit("the competing goal did not preempt the running goal")
+
+node.destroy_node()
+rclpy.shutdown()
+PY
+)
+
+# pick_place_loop sends MoveGroup goals to the arm controller that move-arm.sh
+# drives. SIGSTOP pauses it without changing the demo. A MoveGroup goal it
+# already sent still runs to its end, so wait until the arm is idle.
+stop_pick_place_loop() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${PICK_PLACE_PATTERN}') || exit 0
+        kill -STOP \"\${pid}\"
+    " > /dev/null 2>&1 || true
+    if ! container_python idle "${ACTION}" <<< "${CONTROLLER_PROBE_PY}" \
+        > /tmp/moveit_smoke_idle.log 2>&1; then
+        fail "setup: arm idle after pausing pick_place_loop" "$(tail -n 3 /tmp/moveit_smoke_idle.log)"
+    fi
+}
+
+resume_pick_place_loop() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${PICK_PLACE_PATTERN}') || exit 0
+        kill -CONT \"\${pid}\"
+    " > /dev/null 2>&1 || true
+}
+
+# SIGSTOP on the fault manager makes the gateway's ListFaults call time out,
+# so GET /faults answers 503 as it does before the fault manager is up.
+stop_fault_manager() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 1
+        kill -STOP \"\${pid}\"
+    " > /dev/null 2>&1
+}
+
+resume_fault_manager() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 0
+        kill -CONT \"\${pid}\"
+    " > /dev/null 2>&1 || true
+}
+
+# start_preemptor <log>: start the preempt probe in the background and return
+# once it listens. Sets PREEMPTOR_PID.
+start_preemptor() {
+    local log="$1" waited=0
+    # Empty the log first: an ARMED line left by an earlier run must not count.
+    : > "${log}"
+    container_python preempt "${ACTION}" <<< "${CONTROLLER_PROBE_PY}" >> "${log}" 2>&1 &
+    PREEMPTOR_PID=$!
+    until grep -q '^ARMED' "${log}"; do
+        if ! kill -0 "${PREEMPTOR_PID}" 2> /dev/null || [ "${waited}" -ge 900 ]; then
+            return 1
+        fi
+        sleep 0.1
+        waited=$((waited + 1))
+    done
+}
+
+# finish_preemptor <log>: wait for the preempt probe. It must have preempted a
+# running goal. Sets PREEMPTED_GOAL_STATUS to that goal's final status.
+finish_preemptor() {
+    local log="$1" rc=0
+    wait "${PREEMPTOR_PID}" || rc=$?
+    PREEMPTED_GOAL_STATUS=$(sed -nE 's/^PREEMPTED goal ([A-Z]+),.*/\1/p' "${log}")
+    if [ "${rc}" -eq 0 ] && [ -n "${PREEMPTED_GOAL_STATUS}" ] && [ "${PREEMPTED_GOAL_STATUS}" != "SUCCEEDED" ]; then
+        pass "setup: the competing goal preempted a running goal (${PREEMPTED_GOAL_STATUS})"
+    else
+        fail "setup: the competing goal preempted a running goal" \
+            "probe rc=${rc}: $(tail -n 2 "${log}" | tr '\n' ';')"
+    fi
+}
+
+# Upper bound for one move-arm.sh run. The script itself allows 3 x 30 s per
+# goal, and the demo cycle runs three goals.
+MOVE_ARM_LIMIT_SEC=400
+
+# run_move_arm <log> <args...>: move-arm.sh without a TTY. Sets MOVE_ARM_RC.
+run_move_arm() {
+    local log="$1"
+    shift
+    if CONTAINER_NAME="${DEMO_CONTAINER}" timeout "${MOVE_ARM_LIMIT_SEC}" \
+        "${DEMO_DIR}/move-arm.sh" "$@" < /dev/null > "${log}" 2>&1; then
+        MOVE_ARM_RC=0
+    else
+        MOVE_ARM_RC=$?
+    fi
+    if [ "${MOVE_ARM_RC}" -eq 124 ]; then
+        fail "move-arm.sh $* finishes within ${MOVE_ARM_LIMIT_SEC} s" "killed by timeout"
+    fi
+}
+
+# Log of every run_move_arm_inside run, for checks across all of them.
+INSIDE_ALL_LOG=/tmp/moveit_smoke_inside_all.log
+: > "${INSIDE_ALL_LOG}"
+
+# Sources the ROS environment, as a shell in the container does.
+ROS_ENV='source /opt/ros/jazzy/setup.bash && source /root/demo_ws/install/setup.bash'
+
+# run_move_arm_inside <log> <setup> <args...>: run the copy of move-arm.sh at
+# /tmp/move-arm.sh in the demo container. Bash code <setup> runs first; the
+# ROS environment is there only if <setup> sources it. move-arm.sh runs only
+# if <setup> succeeds, else MOVE_ARM_RC is 255 and the log is empty. Output
+# goes to a file in the container: docker exec can drop the end of a ros2
+# CLI's stdout. Sets MOVE_ARM_RC.
+run_move_arm_inside() {
+    local log="$1" setup="$2"
+    shift 2
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        rm -f /tmp/moveit_smoke_inside.log /tmp/moveit_smoke_inside.rc
+        { ${setup}; } || exit 0
+        timeout ${MOVE_ARM_LIMIT_SEC} bash /tmp/move-arm.sh $* < /dev/null > /tmp/moveit_smoke_inside.log 2>&1
+        echo \$? > /tmp/moveit_smoke_inside.rc
+    " > /dev/null 2>&1 || true
+    docker exec "${DEMO_CONTAINER}" cat /tmp/moveit_smoke_inside.log > "${log}" 2> /dev/null || : > "${log}"
+    MOVE_ARM_RC=$(docker exec "${DEMO_CONTAINER}" cat /tmp/moveit_smoke_inside.rc 2> /dev/null) || MOVE_ARM_RC=255
+    cat "${log}" >> "${INSIDE_ALL_LOG}"
+    if [ "${MOVE_ARM_RC}" = 124 ]; then
+        fail "move-arm.sh $* in the container finishes within ${MOVE_ARM_LIMIT_SEC} s" "killed by timeout"
+    fi
+}
+
+# write_fake_ros2 <dir>: a ros2 CLI at <dir>/ros2 that counts its calls in
+# <dir>/lists and <dir>/calls. `action list` shows the arm action from call
+# FAKE_LIST_MISSES + 1 on (default 0). `action send_goal` hands the goal to
+# the real CLI in CONTAINER_NAME, except the first goal when FAKE_LOST_GOAL is
+# set: it prints "Sending goal:" and then hangs ("hang"), exits 1 ("exit"),
+# or prints "Goal accepted with ID" and hangs without a result ("accepted").
+write_fake_ros2() {
+    cat > "$1/ros2" <<'FAKE'
+#!/bin/sh
+count() {
+    n=$(($(cat "${FAKE_ROS2_DIR}/$1" 2> /dev/null || echo 0) + 1))
+    echo "${n}" > "${FAKE_ROS2_DIR}/$1"
+}
+if [ "$1 $2" = "action list" ]; then
+    count lists
+    if [ "${n}" -gt "${FAKE_LIST_MISSES:-0}" ]; then
+        echo /panda_arm_controller/follow_joint_trajectory
+    fi
+    exit 0
+fi
+[ "$1 $2" = "action send_goal" ] || exit 1
+shift 2
+count calls
+if [ "${n}" -eq 1 ] && [ -n "${FAKE_LOST_GOAL:-}" ]; then
+    echo "Waiting for an action server to become available..."
+    echo "Sending goal:"
+    [ "${FAKE_LOST_GOAL}" != exit ] || exit 1
+    if [ "${FAKE_LOST_GOAL}" = accepted ]; then
+        echo "Goal accepted with ID: 0123456789abcdef0123456789abcdef"
+    fi
+    echo "$$" > "${FAKE_ROS2_DIR}/hung.pid"
+    exec sleep 3600
+fi
+exec docker exec -i "${CONTAINER_NAME}" bash -s -- "$@" <<'REMOTE'
+set +u
+source /opt/ros/jazzy/setup.bash
+source /root/demo_ws/install/setup.bash
+exec timeout 60 ros2 action send_goal "$@"
+REMOTE
+FAKE
+    chmod +x "$1/ros2"
+}
+
+# check_not_sent <name> <log> <rc> <pattern>: a goal that was never sent. The
+# run exits non-zero on its own, prints a line matching <pattern> (the
+# failure's own output) exactly once, one failure line, and no resend line.
+check_not_sent() {
+    local name="$1" log="$2" rc="$3" pattern="$4" matches failures
+    matches=$(grep -cE -- "${pattern}" "${log}" || true)
+    failures=$(grep -c '^Failed: ' "${log}" || true)
+    if [ "${rc}" -ne 0 ] && [ "${rc}" -ne 124 ] && [ "${matches}" -eq 1 ] && [ "${failures}" -eq 1 ] \
+        && ! grep -q 'sending the goal again' "${log}"; then
+        pass "move-arm.sh ${name}: reported once, exit ${rc}, not sent again"
+    else
+        fail "move-arm.sh ${name}: reported once, non-zero exit, not sent again" \
+            "rc=${rc}; lines matching '${pattern}': ${matches}; failure lines: ${failures}; tail: $(tail -n 4 "${log}" | tr '\n' ';')"
+    fi
+}
+
+# ros2_control <args...>: `ros2 control <args>` in the demo container. Output
+# goes to /tmp/moveit_smoke_ros2_control.log there.
+ros2_control() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        ${ROS_ENV} && timeout 60 ros2 control \"\$@\" > /tmp/moveit_smoke_ros2_control.log 2>&1
+    " ros2_control "$@"
+}
+
+# True while a test has joint_state_broadcaster inactive or unloaded.
+JSB_DOWN=false
+
+reload_joint_state_broadcaster() {
+    { ros2_control load_controller --set-state active joint_state_broadcaster \
+        || ros2_control set_controller_state joint_state_broadcaster active; } && JSB_DOWN=false
+}
+
+# real_status <log>: the final status the action client printed itself, read
+# without move-arm.sh's own verdict. Empty when no goal finished.
+real_status() {
+    { grep -F 'Goal finished with status:' "$1" || true; } | tail -n 1 | sed -E 's/.*status: *//'
+}
+
+# reports_status <file> <label> <status>: the file holds exactly one result
+# line. It is the success line for <label> when <status> is SUCCEEDED, else a
+# failure line for <label> that names <status>. An empty <status> never
+# matches: every goal the tests send must reach a final status.
+reports_status() {
+    local file="$1" label="$2" status="$3" results
+    [ -n "${status}" ] || return 1
+    results=$(grep -cE '^(✅ Done|Failed):' "${file}" || true)
+    [ "${results}" -eq 1 ] || return 1
+    if [ "${status}" = "SUCCEEDED" ]; then
+        grep -qFx "✅ Done: ${label}" "${file}"
+    else
+        grep -qFx "Failed: ${label} (status: ${status})" "${file}"
+    fi
+}
+
+# check_goal_report <log> <rc> <label>: the goal reached a final status. A real
+# SUCCEEDED exits 0 with the success line; any other real status exits
+# non-zero with a failure line.
+check_goal_report() {
+    local log="$1" rc="$2" label="$3" status
+    status=$(real_status "${log}")
+    if [ -z "${status}" ]; then
+        fail "move-arm.sh ${label}: the action reports a final status" \
+            "no 'Goal finished with status' line; rc=${rc}; tail: $(tail -n 3 "${log}" | tr '\n' ';')"
+    elif [ "${status}" = "SUCCEEDED" ]; then
+        if [ "${rc}" -eq 0 ] && reports_status "${log}" "${label}" "${status}"; then
+            pass "move-arm.sh ${label}: real SUCCEEDED exits 0 with a success line"
+        else
+            fail "move-arm.sh ${label}: real SUCCEEDED exits 0 with a success line" \
+                "rc=${rc}; result lines: $(grep -E '^(✅ Done|Failed):' "${log}" | tr '\n' ';')"
+        fi
+    else
+        if [ "${rc}" -ne 0 ] && reports_status "${log}" "${label}" "${status}"; then
+            pass "move-arm.sh ${label}: real ${status} exits non-zero with a failure line"
+        else
+            fail "move-arm.sh ${label}: real ${status} exits non-zero with a failure line" \
+                "rc=${rc}; result lines: $(grep -E '^(✅ Done|Failed):' "${log}" | tr '\n' ';')"
+        fi
+    fi
+}
+
+# print_summary reads the script's exit status from $?, so hand it the
+# status saved on entry. set +e: under errexit `(exit rc)` would end the
+# trap before print_summary runs.
+cleanup_on_exit() {
+    local rc=$?
+    set +e
+    if [ "${JSB_DOWN}" = true ]; then
+        reload_joint_state_broadcaster
+    fi
+    resume_pick_place_loop
+    resume_fault_manager
+    (exit "${rc}")
+    print_summary
+}
+trap cleanup_on_exit EXIT
 
 # --- Wait for gateway startup ---
 
@@ -97,6 +498,598 @@ section "Triggers"
 
 assert_triggers_crud "apps" "diagnostic-bridge-app" "/api/v1/apps/diagnostic-bridge-app/faults"
 
+section "check-entities.sh: real values, including under an active fault"
+
+# Force a real fault: two goals back to back on the arm controller. The second
+# preempts the first, a real ABORTED goal that manipulation_monitor reports as
+# TRAJECTORY_EXECUTION_FAILED / CONTROLLER_TIMEOUT.
+echo "  Forcing a real active fault via controller goal preemption..."
+stop_pick_place_loop
+if container_python fault "${ACTION}" <<< "${CONTROLLER_PROBE_PY}" > /tmp/moveit_smoke_fault_setup.log 2>&1; then
+    pass "setup: a second goal preempted the first ($(tail -n 1 /tmp/moveit_smoke_fault_setup.log))"
+else
+    fail "setup: a second goal preempted the first" "$(tail -n 2 /tmp/moveit_smoke_fault_setup.log | tr '\n' ';')"
+fi
+resume_pick_place_loop
+
+echo "  Waiting for the fault to appear (max 20s)..."
+if poll_until "/faults" '[.items[] | select(.reporting_sources | index("/bridge/manipulation_monitor"))] | length > 0' 20; then
+    pass "setup: manipulation_monitor reports a real active fault"
+else
+    fail "setup: manipulation_monitor reports a real active fault" "no such fault after forced controller preemption"
+fi
+
+ENTITIES_LOG=/tmp/moveit_smoke_entities.log
+FAULT_FIELDS='[.items[] | {fault_code, severity_label, status, reporting_sources}] | sort_by(.fault_code)'
+
+# Faults can change state while the script runs. Read them on both sides of
+# the run and retry until both reads agree.
+for attempt in 1 2 3; do
+    API_FAULTS=$(curl -s -m 30 "${API_BASE}/faults")
+    GATEWAY_URL="${GATEWAY_URL}" timeout 120 "${DEMO_DIR}/check-entities.sh" < /dev/null 2>&1 \
+        | sed 's/\x1b\[[0-9;]*m//g' > "${ENTITIES_LOG}" || true
+    API_FAULTS_AFTER=$(curl -s -m 30 "${API_BASE}/faults")
+    if [ "$(jq -c "${FAULT_FIELDS}" <<< "${API_FAULTS}")" = "$(jq -c "${FAULT_FIELDS}" <<< "${API_FAULTS_AFTER}")" ]; then
+        break
+    fi
+    echo "  Faults changed during attempt ${attempt}/3, running again..."
+done
+
+if ! grep -q 'exploration complete' "${ENTITIES_LOG}"; then
+    fail "check-entities.sh runs to completion" "$(tail -n 5 "${ENTITIES_LOG}")"
+elif grep -q '": null' "${ENTITIES_LOG}"; then
+    fail "check-entities.sh prints no null fields" \
+        "$(grep '": null' "${ENTITIES_LOG}" | sort -u | tr '\n' ';')"
+else
+    pass "check-entities.sh prints no null fields"
+fi
+
+# section_text <n> [log]: the lines check-entities.sh printed under its
+# "=== <n>. ..." heading.
+section_text() {
+    awk -v heading="=== $1. " '
+        index($0, "=== ") == 1 { on = (index($0, heading) == 1); next }
+        index($0, "Entity hierarchy exploration complete") { on = 0 }
+        on
+    ' "${2:-${ENTITIES_LOG}}"
+}
+
+# shown_items <n>: the JSON objects printed under heading <n>, as one array.
+shown_items() {
+    section_text "$1" | jq -s -c '.'
+}
+
+SHOWN_COMPONENTS=$(shown_items 2) || SHOWN_COMPONENTS='[]'
+SHOWN_APPS=$(shown_items 3) || SHOWN_APPS='[]'
+SHOWN_FAULTS=$(shown_items 6) || SHOWN_FAULTS='[]'
+
+# Section 5 holds one text line and then the joint state object. Values move
+# with the arm, so they are checked by type and count, not compared.
+SHOWN_JOINT_STATE=$(section_text 5 | sed -n '/^{/,/^}/p' | jq -c '.') || SHOWN_JOINT_STATE=""
+API_JOINTS=$(curl -s -m 30 "${API_BASE}/apps/joint-state-broadcaster/data/joint_states" \
+    | jq -c '.data.name // empty') || API_JOINTS=""
+if [ -n "${API_JOINTS}" ] && [ "${API_JOINTS}" != "[]" ] \
+    && jq -e --argjson names "${API_JOINTS}" '
+        .joint_names == $names
+        and ([.positions, .velocities]
+            | all(type == "array" and length == ($names | length) and all(.[]; type == "number")))
+    ' <<< "${SHOWN_JOINT_STATE}" > /dev/null 2>&1; then
+    pass "check-entities.sh shows the API's joint names with one numeric position and velocity each"
+else
+    fail "check-entities.sh shows the API's joint names with one numeric position and velocity each" \
+        "api names=${API_JOINTS:-none} shown=${SHOWN_JOINT_STATE:-none}"
+fi
+
+API_COMPONENTS=$(curl -s -m 30 "${API_BASE}/components")
+for id in panda-arm panda-gripper moveit-planning pick-place-loop gateway fault-manager diagnostic-bridge; do
+    expected=$(jq -c --arg id "${id}" '.items[] | select(.id == $id) | {id, name, description}' \
+        <<< "${API_COMPONENTS}") || expected=""
+    shown=$(jq -c --arg id "${id}" '.[] | select(.id == $id) | {id, name, description}' \
+        <<< "${SHOWN_COMPONENTS}") || shown=""
+    if [ -n "${expected}" ] && [ "${shown}" = "${expected}" ]; then
+        pass "check-entities.sh shows component ${id} as the API does"
+    else
+        fail "check-entities.sh shows component ${id} as the API does" \
+            "api=${expected:-none} shown=${shown:-none}"
+    fi
+done
+
+API_APPS=$(curl -s -m 30 "${API_BASE}/apps")
+API_APP_IDS=$(jq -c '[.items[].id] | sort' <<< "${API_APPS}") || API_APP_IDS=""
+SHOWN_APP_IDS=$(jq -c '[.[].id] | sort' <<< "${SHOWN_APPS}") || SHOWN_APP_IDS=""
+if [ -n "${API_APP_IDS}" ] && [ "${API_APP_IDS}" != "[]" ] && [ "${SHOWN_APP_IDS}" = "${API_APP_IDS}" ]; then
+    pass "check-entities.sh lists every app the API lists"
+else
+    fail "check-entities.sh lists every app the API lists" "api=${API_APP_IDS:-none} shown=${SHOWN_APP_IDS:-none}"
+fi
+for id in joint-state-broadcaster panda-arm-controller panda-hand-controller robot-state-publisher move-group \
+    pick-place-node medkit-gateway medkit-fault-manager diagnostic-bridge-app manipulation-monitor; do
+    expected=$(jq -r --arg id "${id}" '.items[] | select(.id == $id) | .["x-medkit"].component_id // empty' \
+        <<< "${API_APPS}") || expected=""
+    shown=$(jq -r --arg id "${id}" '.[] | select(.id == $id) | .component' <<< "${SHOWN_APPS}") || shown=""
+    if [ -n "${expected}" ] && [ "${shown}" = "${expected}" ]; then
+        pass "check-entities.sh shows app ${id} on component ${expected}"
+    else
+        fail "check-entities.sh shows app ${id} on component ${expected:-none}" "shown=${shown:-none}"
+    fi
+done
+
+FAULT_CODES=$(jq -r '.items[].fault_code' <<< "${API_FAULTS_AFTER}") || FAULT_CODES=""
+API_FAULT_COUNT=$(jq '.items | length' <<< "${API_FAULTS_AFTER}") || API_FAULT_COUNT=0
+SHOWN_FAULT_COUNT=$(jq 'length' <<< "${SHOWN_FAULTS}") || SHOWN_FAULT_COUNT=0
+if [ "${API_FAULT_COUNT:-0}" -gt 0 ] && [ "${SHOWN_FAULT_COUNT:-0}" -eq "${API_FAULT_COUNT}" ]; then
+    pass "check-entities.sh lists all ${API_FAULT_COUNT} active faults"
+else
+    fail "check-entities.sh lists all active faults" "api=${API_FAULT_COUNT} shown=${SHOWN_FAULT_COUNT}"
+fi
+while IFS= read -r code; do
+    [ -n "${code}" ] || continue
+    expected=$(jq -c --arg code "${code}" '.items[] | select(.fault_code == $code)
+        | [.fault_code, .severity_label, .status, .reporting_sources]' <<< "${API_FAULTS_AFTER}") || expected=""
+    shown=$(jq -c --arg code "${code}" '.[] | select(.code == $code) | [.code, .severity, .status, .sources]' \
+        <<< "${SHOWN_FAULTS}") || shown=""
+    if [ -n "${expected}" ] && [ "${shown}" = "${expected}" ]; then
+        pass "check-entities.sh shows fault ${code} with the API's code, severity, status and sources"
+    else
+        fail "check-entities.sh shows fault ${code} with the API's code, severity, status and sources" \
+            "api=${expected:-none} shown=${shown:-none}"
+    fi
+done <<< "${FAULT_CODES}"
+
+section "check-faults.sh: lists the active faults"
+
+CHECK_FAULTS_LOG=/tmp/moveit_smoke_check_faults.log
+if GATEWAY_URL="${GATEWAY_URL}" timeout 120 "${DEMO_DIR}/check-faults.sh" < /dev/null > "${CHECK_FAULTS_LOG}" 2>&1; then
+    CHECK_FAULTS_RC=0
+else
+    CHECK_FAULTS_RC=$?
+fi
+API_FAULTS_NOW=$(curl -s -m 30 "${API_BASE}/faults")
+API_FAULT_CODES=$(jq -r '.items[].fault_code' <<< "${API_FAULTS_NOW}" | sort) || API_FAULT_CODES=""
+SHOWN_FAULT_CODES=$(sed -nE 's/^ *"code": "([^"]+)",?$/\1/p' "${CHECK_FAULTS_LOG}" | sort)
+API_FAULT_TOTAL=$(jq '.items | length' <<< "${API_FAULTS_NOW}") || API_FAULT_TOTAL=0
+if [ "${CHECK_FAULTS_RC}" -eq 0 ] && [ -n "${API_FAULT_CODES}" ] && [ "${SHOWN_FAULT_CODES}" = "${API_FAULT_CODES}" ] \
+    && grep -qFx "   Total active faults: ${API_FAULT_TOTAL}" "${CHECK_FAULTS_LOG}"; then
+    pass "check-faults.sh exits 0 and lists the ${API_FAULT_TOTAL} faults the API lists"
+else
+    fail "check-faults.sh exits 0 and lists the faults the API lists" \
+        "rc=${CHECK_FAULTS_RC}; api=$(tr '\n' ' ' <<< "${API_FAULT_CODES}") shown=$(tr '\n' ' ' <<< "${SHOWN_FAULT_CODES}"); tail: $(tail -n 3 "${CHECK_FAULTS_LOG}" | tr '\n' ';')"
+fi
+
+section "move-arm.sh: a local ros2 that cannot reach the demo still moves the arm"
+
+# CI runners (and this dev container) have no ROS 2 wired to the demo's
+# graph, but `ros2 node list` still exits 0 on an empty graph. A fake ros2
+# that only answers `node list` reproduces that false positive without
+# needing a real, disconnected ROS 2 install.
+FAKE_ROS2_DIR=$(mktemp -d)
+cat > "${FAKE_ROS2_DIR}/ros2" <<'FAKE'
+#!/bin/sh
+if [ "$1" = "node" ] && [ "$2" = "list" ]; then
+    exit 0
+fi
+exit 1
+FAKE
+chmod +x "${FAKE_ROS2_DIR}/ros2"
+
+UNREACHABLE_LOG=/tmp/moveit_smoke_unreachable_ros2.log
+stop_pick_place_loop
+PATH="${FAKE_ROS2_DIR}:${PATH}" run_move_arm "${UNREACHABLE_LOG}" extended
+resume_pick_place_loop
+rm -rf "${FAKE_ROS2_DIR}"
+
+if [ "${MOVE_ARM_RC}" -eq 0 ] && [ "$(real_status "${UNREACHABLE_LOG}")" = "SUCCEEDED" ]; then
+    pass "move-arm.sh moves the container's arm despite a local unreachable ros2"
+else
+    fail "move-arm.sh moves the container's arm despite a local unreachable ros2" \
+        "rc=${MOVE_ARM_RC}; tail: $(tail -n 5 "${UNREACHABLE_LOG}")"
+fi
+
+if grep -q 'cannot attach stdin' "${UNREACHABLE_LOG}"; then
+    fail "move-arm.sh works without a TTY" "docker exec still requires a TTY"
+else
+    pass "move-arm.sh works without a TTY"
+fi
+
+section "move-arm.sh: a goal the controller never answered is sent again"
+
+# The controller can fail to deliver a goal response to a new ros2 CLI whose
+# endpoints are not yet discovered ("Failed to send goal response"). It then
+# never runs the goal, and the CLI waits forever. This fake ros2 loses the
+# first goal that way and hands the next one to the real CLI in the container.
+FAKE_ROS2_DIR=$(mktemp -d)
+write_fake_ros2 "${FAKE_ROS2_DIR}"
+
+LOST_LOG=/tmp/moveit_smoke_goal_lost.log
+stop_pick_place_loop
+export FAKE_ROS2_DIR
+if FAKE_LOST_GOAL=hang PATH="${FAKE_ROS2_DIR}:${PATH}" CONTAINER_NAME="${DEMO_CONTAINER}" \
+    timeout 120 "${DEMO_DIR}/move-arm.sh" wave < /dev/null > "${LOST_LOG}" 2>&1; then
+    LOST_RC=0
+else
+    LOST_RC=$?
+fi
+resume_pick_place_loop
+if [ -f "${FAKE_ROS2_DIR}/hung.pid" ]; then
+    kill "$(cat "${FAKE_ROS2_DIR}/hung.pid")" 2> /dev/null || true
+fi
+LOST_CALLS=$(cat "${FAKE_ROS2_DIR}/calls" 2> /dev/null || echo 0)
+rm -rf "${FAKE_ROS2_DIR}"
+unset FAKE_ROS2_DIR
+
+if [ "${LOST_RC}" -ne 124 ] && [ "${LOST_CALLS}" -eq 2 ]; then
+    pass "move-arm.sh sends the goal again when no goal response arrives"
+else
+    fail "move-arm.sh sends the goal again when no goal response arrives" \
+        "rc=${LOST_RC} (124: still waiting after 120 s), goals sent: ${LOST_CALLS}"
+fi
+if [ "$(real_status "${LOST_LOG}")" = "SUCCEEDED" ]; then
+    pass "setup: the goal sent again really succeeded"
+else
+    fail "setup: the goal sent again really succeeded" "real status: $(real_status "${LOST_LOG}")"
+fi
+check_goal_report "${LOST_LOG}" "${LOST_RC}" "wave"
+if grep -q "within 30 s.*sending the goal again" "${LOST_LOG}"; then
+    pass "move-arm.sh names the 30 s it waited before sending again"
+else
+    fail "move-arm.sh names the 30 s it waited before sending again" \
+        "resend lines: $(grep 'sending the goal again' "${LOST_LOG}" | tr '\n' ';')"
+fi
+
+section "move-arm.sh: a goal the CLI dropped at once is sent again, without a claimed wait"
+
+# The CLI printed "Sending goal:" and exited 1 at once, with no goal response.
+FAKE_ROS2_DIR=$(mktemp -d)
+write_fake_ros2 "${FAKE_ROS2_DIR}"
+DROPPED_LOG=/tmp/moveit_smoke_goal_dropped.log
+stop_pick_place_loop
+export FAKE_ROS2_DIR
+if FAKE_LOST_GOAL=exit PATH="${FAKE_ROS2_DIR}:${PATH}" CONTAINER_NAME="${DEMO_CONTAINER}" \
+    timeout 120 "${DEMO_DIR}/move-arm.sh" pick < /dev/null > "${DROPPED_LOG}" 2>&1; then
+    DROPPED_RC=0
+else
+    DROPPED_RC=$?
+fi
+resume_pick_place_loop
+DROPPED_CALLS=$(cat "${FAKE_ROS2_DIR}/calls" 2> /dev/null || echo 0)
+rm -rf "${FAKE_ROS2_DIR}"
+unset FAKE_ROS2_DIR
+
+DROPPED_RESEND=$(grep 'sending the goal again' "${DROPPED_LOG}" || true)
+if [ "${DROPPED_CALLS}" -eq 2 ] && [ -n "${DROPPED_RESEND}" ] && ! grep -qE '[0-9]+ s\b' <<< "${DROPPED_RESEND}"; then
+    pass "move-arm.sh sends a dropped goal again and claims no wait"
+else
+    fail "move-arm.sh sends a dropped goal again and claims no wait" \
+        "goals sent: ${DROPPED_CALLS}; resend lines: ${DROPPED_RESEND:-none}"
+fi
+check_goal_report "${DROPPED_LOG}" "${DROPPED_RC}" "pick"
+
+section "move-arm.sh: an accepted goal without a result is not sent again"
+
+# The CLI printed "Goal accepted with ID" and no result before the timeout.
+# The controller may still run that goal, so it must not be sent twice.
+FAKE_ROS2_DIR=$(mktemp -d)
+write_fake_ros2 "${FAKE_ROS2_DIR}"
+NO_RESULT_LOG=/tmp/moveit_smoke_goal_no_result.log
+export FAKE_ROS2_DIR
+if FAKE_LOST_GOAL=accepted PATH="${FAKE_ROS2_DIR}:${PATH}" CONTAINER_NAME="${DEMO_CONTAINER}" \
+    timeout 120 "${DEMO_DIR}/move-arm.sh" home < /dev/null > "${NO_RESULT_LOG}" 2>&1; then
+    NO_RESULT_RC=0
+else
+    NO_RESULT_RC=$?
+fi
+if [ -f "${FAKE_ROS2_DIR}/hung.pid" ]; then
+    kill "$(cat "${FAKE_ROS2_DIR}/hung.pid")" 2> /dev/null || true
+fi
+NO_RESULT_CALLS=$(cat "${FAKE_ROS2_DIR}/calls" 2> /dev/null || echo 0)
+rm -rf "${FAKE_ROS2_DIR}"
+unset FAKE_ROS2_DIR
+
+if [ "${NO_RESULT_CALLS}" -eq 1 ] && [ "${NO_RESULT_RC}" -ne 0 ] && [ "${NO_RESULT_RC}" -ne 124 ] \
+    && ! grep -q 'sending the goal again' "${NO_RESULT_LOG}" \
+    && reports_status "${NO_RESULT_LOG}" "home" "UNKNOWN"; then
+    pass "move-arm.sh sends an accepted goal once and reports UNKNOWN when no result arrives"
+else
+    fail "move-arm.sh sends an accepted goal once and reports UNKNOWN when no result arrives" \
+        "rc=${NO_RESULT_RC}; goals sent: ${NO_RESULT_CALLS}; resend lines: $(grep -c 'sending the goal again' "${NO_RESULT_LOG}" || true); result lines: $(grep -E '^(✅ Done|Failed):' "${NO_RESULT_LOG}" | tr '\n' ';')"
+fi
+
+section "move-arm.sh: a goal that was never sent is reported once, not sent again"
+
+NOT_SENT_LOG=/tmp/moveit_smoke_not_sent.log
+
+# No such container, from the host.
+if CONTAINER_NAME=moveit_smoke_no_such_container timeout 120 "${DEMO_DIR}/move-arm.sh" ready \
+    < /dev/null > "${NOT_SENT_LOG}" 2>&1; then
+    NOT_SENT_RC=0
+else
+    NOT_SENT_RC=$?
+fi
+check_not_sent "with no such container" "${NOT_SENT_LOG}" "${NOT_SENT_RC}" 'No such container'
+
+# The remaining cases run in the container: no docker CLI there.
+if docker cp "${DEMO_DIR}/move-arm.sh" "${DEMO_CONTAINER}:/tmp/move-arm.sh" > /dev/null; then
+    pass "setup: move-arm.sh copied into the container"
+else
+    fail "setup: move-arm.sh copied into the container" "docker cp failed"
+fi
+
+stop_pick_place_loop
+
+# Neither docker nor ros2: ROS not sourced.
+run_move_arm_inside "${NOT_SENT_LOG}" ":" ready
+check_not_sent "without docker and ros2" "${NOT_SENT_LOG}" "${MOVE_ARM_RC}" 'docker.*ros2|ros2.*docker'
+
+# No action server: a ROS domain nobody uses.
+run_move_arm_inside "${NOT_SENT_LOG}" "${ROS_ENV} && export ROS_DOMAIN_ID=99" ready
+check_not_sent "with no action server" "${NOT_SENT_LOG}" "${MOVE_ARM_RC}" \
+    'Waiting for an action server to become available'
+
+# Invalid action type: a control_msgs without the action module shadows the real one.
+run_move_arm_inside "${NOT_SENT_LOG}" "${ROS_ENV} && mkdir -p /tmp/moveit_smoke_shadow/control_msgs \
+    && : > /tmp/moveit_smoke_shadow/control_msgs/__init__.py \
+    && export PYTHONPATH=/tmp/moveit_smoke_shadow:\${PYTHONPATH}" ready
+check_not_sent "with an invalid action type" "${NOT_SENT_LOG}" "${MOVE_ARM_RC}" \
+    'The passed action type is invalid'
+
+section "move-arm.sh inside the container: the local ros2 sends every goal"
+
+# A cold `ros2 action list` (no daemon) can miss the arm action, so every run
+# starts with the daemon stopped. `ros2 daemon status` goes to a file in the
+# container; move-arm.sh runs only if it says the daemon is not running, and
+# a run without that proof counts as a failure.
+DAEMON_STATUS_FILE=/tmp/moveit_smoke_daemon_status.log
+DAEMON_STOPPED='The daemon is not running'
+COLD_SETUP="rm -f ${DAEMON_STATUS_FILE}; ${ROS_ENV} && ros2 daemon stop > /dev/null 2>&1; \
+    ros2 daemon status > ${DAEMON_STATUS_FILE} 2>&1; grep -qFx '${DAEMON_STOPPED}' ${DAEMON_STATUS_FILE}"
+INSIDE_RUNS=8
+INSIDE_ACCEPTED=0
+INSIDE_MISSED=""
+INSIDE_LOG=/tmp/moveit_smoke_inside.log
+for run in $(seq 1 "${INSIDE_RUNS}"); do
+    pose=ready
+    [ $((run % 2)) -eq 0 ] && pose=extended
+    run_move_arm_inside "${INSIDE_LOG}" "${COLD_SETUP}" "${pose}"
+    daemon_status=$(docker exec "${DEMO_CONTAINER}" cat "${DAEMON_STATUS_FILE}" 2> /dev/null) || daemon_status=""
+    if [ "${daemon_status}" != "${DAEMON_STOPPED}" ]; then
+        INSIDE_MISSED="${INSIDE_MISSED} run ${run}: daemon not proven stopped (status: ${daemon_status:-none});"
+    elif grep -q '^Goal accepted with ID' "${INSIDE_LOG}"; then
+        INSIDE_ACCEPTED=$((INSIDE_ACCEPTED + 1))
+    else
+        INSIDE_MISSED="${INSIDE_MISSED} run ${run} (rc=${MOVE_ARM_RC}): $(tail -n 2 "${INSIDE_LOG}" | tr '\n' ';')"
+    fi
+done
+resume_pick_place_loop
+docker exec "${DEMO_CONTAINER}" rm -rf /tmp/move-arm.sh /tmp/moveit_smoke_shadow > /dev/null 2>&1 || true
+
+if [ "${INSIDE_ACCEPTED}" -eq "${INSIDE_RUNS}" ]; then
+    pass "move-arm.sh in the container: the controller accepted the goal in ${INSIDE_RUNS}/${INSIDE_RUNS} cold runs"
+else
+    fail "move-arm.sh in the container: the controller accepted the goal in every cold run" \
+        "accepted ${INSIDE_ACCEPTED}/${INSIDE_RUNS};${INSIDE_MISSED}"
+fi
+if grep -q 'command not found' "${INSIDE_ALL_LOG}"; then
+    fail "move-arm.sh in the container prints no 'command not found'" \
+        "$(grep 'command not found' "${INSIDE_ALL_LOG}" | sort | uniq -c | tr '\n' ';')"
+else
+    pass "move-arm.sh in the container prints no 'command not found'"
+fi
+
+section "move-arm.sh: a cold local ros2 is asked twice before docker exec"
+
+# The first `action list` misses the arm action, as a cold one can. The goal
+# must still go through the local ros2.
+FAKE_ROS2_DIR=$(mktemp -d)
+write_fake_ros2 "${FAKE_ROS2_DIR}"
+COLD_LOG=/tmp/moveit_smoke_cold_list.log
+stop_pick_place_loop
+export FAKE_ROS2_DIR
+if FAKE_LIST_MISSES=1 PATH="${FAKE_ROS2_DIR}:${PATH}" CONTAINER_NAME="${DEMO_CONTAINER}" \
+    timeout 120 "${DEMO_DIR}/move-arm.sh" ready < /dev/null > "${COLD_LOG}" 2>&1; then
+    COLD_RC=0
+else
+    COLD_RC=$?
+fi
+resume_pick_place_loop
+COLD_LISTS=$(cat "${FAKE_ROS2_DIR}/lists" 2> /dev/null || echo 0)
+COLD_CALLS=$(cat "${FAKE_ROS2_DIR}/calls" 2> /dev/null || echo 0)
+rm -rf "${FAKE_ROS2_DIR}"
+unset FAKE_ROS2_DIR
+
+if [ "${COLD_LISTS}" -eq 2 ] && [ "${COLD_CALLS}" -eq 1 ]; then
+    pass "move-arm.sh lists actions again after a miss and sends through the local ros2"
+else
+    fail "move-arm.sh lists actions again after a miss and sends through the local ros2" \
+        "action lists: ${COLD_LISTS}; goals through the local ros2: ${COLD_CALLS}"
+fi
+check_goal_report "${COLD_LOG}" "${COLD_RC}" "ready"
+
+section "move-arm.sh: reports the goal's real final status"
+
+PREEMPTOR_LOG=/tmp/moveit_smoke_preemptor.log
+PREEMPTED_LOG=/tmp/moveit_smoke_goal_preempted.log
+FREE_LOG=/tmp/moveit_smoke_goal_free.log
+
+# The preempt probe aborts the first goal move-arm.sh starts. The second goal
+# runs on an idle arm.
+stop_pick_place_loop
+start_preemptor "${PREEMPTOR_LOG}" || fail "setup: competing goal ready" "$(tail -n 3 "${PREEMPTOR_LOG}")"
+run_move_arm "${PREEMPTED_LOG}" ready
+PREEMPTED_RC=${MOVE_ARM_RC}
+finish_preemptor "${PREEMPTOR_LOG}"
+run_move_arm "${FREE_LOG}" place
+FREE_RC=${MOVE_ARM_RC}
+resume_pick_place_loop
+
+PREEMPTED_STATUS=$(real_status "${PREEMPTED_LOG}")
+if [ -n "${PREEMPTED_STATUS}" ] && [ "${PREEMPTED_STATUS}" = "${PREEMPTED_GOAL_STATUS}" ]; then
+    pass "setup: move-arm.sh's goal is the one the probe preempted (${PREEMPTED_STATUS})"
+else
+    fail "setup: move-arm.sh's goal is the one the probe preempted" \
+        "move-arm.sh real status: ${PREEMPTED_STATUS:-none}; preempted goal: ${PREEMPTED_GOAL_STATUS:-none}"
+fi
+if [ "$(real_status "${FREE_LOG}")" = "SUCCEEDED" ]; then
+    pass "setup: a goal on an idle arm really succeeded"
+else
+    fail "setup: a goal on an idle arm really succeeded" "real status: $(real_status "${FREE_LOG}")"
+fi
+
+check_goal_report "${PREEMPTED_LOG}" "${PREEMPTED_RC}" "ready"
+check_goal_report "${FREE_LOG}" "${FREE_RC}" "place"
+
+section "move-arm.sh demo: per-step reporting and overall exit code"
+
+DEMO_LOG=/tmp/moveit_smoke_demo.log
+
+# The preempt probe aborts the cycle's first step. The later steps run on an
+# idle arm.
+stop_pick_place_loop
+start_preemptor "${PREEMPTOR_LOG}" || fail "setup: competing goal ready" "$(tail -n 3 "${PREEMPTOR_LOG}")"
+run_move_arm "${DEMO_LOG}" demo
+DEMO_RC=${MOVE_ARM_RC}
+finish_preemptor "${PREEMPTOR_LOG}"
+resume_pick_place_loop
+
+DEMO_STEPS=$(grep -c '^🤖 Moving to:' "${DEMO_LOG}" || true)
+if [ "${DEMO_STEPS}" -eq 3 ]; then
+    pass "move-arm.sh demo runs three steps"
+else
+    fail "move-arm.sh demo runs three steps" "steps started: ${DEMO_STEPS}"
+fi
+
+# Each step block runs from its "Moving to" line to the next one. Its action
+# must reach a final status, its result line must match that status, and each
+# label must have exactly one result line in the whole output.
+DEMO_FAILED_STEPS=0
+DEMO_FIRST_STATUS=""
+step=0
+for label in "pick" "place" "ready (home)"; do
+    step=$((step + 1))
+    step_log="/tmp/moveit_smoke_demo_step${step}.log"
+    awk -v n="${step}" 'index($0, "🤖 Moving to:") == 1 { count++ } count == n' "${DEMO_LOG}" > "${step_log}"
+    status=$(real_status "${step_log}")
+    [ "${step}" -eq 1 ] && DEMO_FIRST_STATUS="${status}"
+    if [ -z "${status}" ]; then
+        fail "move-arm.sh demo step ${step} (${label}): the action reports a final status" \
+            "no 'Goal finished with status' line; step tail: $(tail -n 3 "${step_log}" | tr '\n' ';')"
+        continue
+    fi
+    if [ "${status}" != "SUCCEEDED" ]; then
+        DEMO_FAILED_STEPS=$((DEMO_FAILED_STEPS + 1))
+    fi
+    first_line=$(head -n 1 "${step_log}")
+    label_results=$(( $(grep -cFx "✅ Done: ${label}" "${DEMO_LOG}" || true) \
+        + $(grep -cF "Failed: ${label} (" "${DEMO_LOG}" || true) ))
+    if [ "${first_line}" = "🤖 Moving to: ${label}" ] && [ "${label_results}" -eq 1 ] \
+        && reports_status "${step_log}" "${label}" "${status}"; then
+        pass "move-arm.sh demo step ${step} (${label}): one result line, matching real ${status}"
+    else
+        fail "move-arm.sh demo step ${step} (${label}): one result line, matching real ${status}" \
+            "first line: ${first_line}; results for label: ${label_results}; in step: $(grep -E '^(✅ Done|Failed):' "${step_log}" | tr '\n' ';')"
+    fi
+done
+
+if [ -n "${DEMO_FIRST_STATUS}" ] && [ "${DEMO_FIRST_STATUS}" = "${PREEMPTED_GOAL_STATUS}" ]; then
+    pass "setup: the demo's pick step is the goal the probe preempted (${DEMO_FIRST_STATUS})"
+else
+    fail "setup: the demo's pick step is the goal the probe preempted" \
+        "pick real status: ${DEMO_FIRST_STATUS:-none}; preempted goal: ${PREEMPTED_GOAL_STATUS:-none}"
+fi
+if [ "${DEMO_FAILED_STEPS}" -gt 0 ]; then
+    if [ "${DEMO_RC}" -ne 0 ]; then
+        pass "move-arm.sh demo exits non-zero when a step really failed"
+    else
+        fail "move-arm.sh demo exits non-zero when a step really failed" "rc=0"
+    fi
+else
+    fail "setup: a demo step really failed" "no step reached a non-SUCCEEDED final status"
+fi
+
+section "check-faults.sh: a failed fault read is not reported as no faults"
+
+FAILED_READ_LOG=/tmp/moveit_smoke_check_faults_503.log
+if stop_fault_manager; then
+    if api_get "/faults" 503; then
+        pass "setup: GET /faults answers 503 while the fault manager is stopped"
+    else
+        fail "setup: GET /faults answers 503 while the fault manager is stopped" "got: $(head -c 200 <<< "${RESPONSE}")"
+    fi
+    if GATEWAY_URL="${GATEWAY_URL}" timeout 120 "${DEMO_DIR}/check-faults.sh" < /dev/null > "${FAILED_READ_LOG}" 2>&1; then
+        FAILED_READ_RC=0
+    else
+        FAILED_READ_RC=$?
+    fi
+    resume_fault_manager
+    if [ "${FAILED_READ_RC}" -ne 0 ] && grep -q 'Could not read faults (HTTP 503)' "${FAILED_READ_LOG}" \
+        && ! grep -qE 'No active faults|Total active faults' "${FAILED_READ_LOG}"; then
+        pass "check-faults.sh exits non-zero on HTTP 503 and does not claim a fault count"
+    else
+        fail "check-faults.sh exits non-zero on HTTP 503 and does not claim a fault count" \
+            "rc=${FAILED_READ_RC}; output: $(grep -vE '^ *$' "${FAILED_READ_LOG}" | tail -n 6 | tr '\n' ';')"
+    fi
+    if poll_until "/faults" '.items | arrays' 30; then
+        pass "setup: GET /faults answers again after the fault manager resumes"
+    else
+        fail "setup: GET /faults answers again after the fault manager resumes" "still failing after 30 s"
+    fi
+else
+    fail "setup: fault manager stopped" "no fault_manager_node process in ${DEMO_CONTAINER}"
+fi
+
+section "check-entities.sh: joint states without data print a hint, not nulls"
+
+# joint_states_empty: GET joint_states succeeds with HTTP 200 and an empty
+# data object, the gateway's reply for a topic with no publisher. Sets
+# JOINT_HTTP and JOINT_BODY.
+joint_states_empty() {
+    local out
+    out=$(curl -s -m 30 -w '\n%{http_code}' \
+        "${API_BASE}/apps/joint-state-broadcaster/data/joint_states" 2> /dev/null) || true
+    JOINT_HTTP=$(tail -n 1 <<< "${out}")
+    JOINT_BODY=$(sed '$d' <<< "${out}")
+    [ "${JOINT_HTTP}" = 200 ] && jq -e '.data | type == "object" and length == 0' <<< "${JOINT_BODY}" > /dev/null 2>&1
+}
+
+# Unloading joint_state_broadcaster removes the only /joint_states publisher.
+NO_JOINTS_LOG=/tmp/moveit_smoke_entities_no_joints.log
+JOINT_HTTP=""
+JOINT_BODY=""
+stop_pick_place_loop
+if ros2_control set_controller_state joint_state_broadcaster inactive \
+    && JSB_DOWN=true && ros2_control unload_controller joint_state_broadcaster; then
+    waited=0
+    until joint_states_empty || [ "${waited}" -ge 30 ]; do
+        sleep 1
+        waited=$((waited + 1))
+    done
+fi
+if [ "${JSB_DOWN}" = true ] && joint_states_empty; then
+    pass "setup: joint_states answers 200 with empty data with joint_state_broadcaster unloaded"
+    GATEWAY_URL="${GATEWAY_URL}" timeout 120 "${DEMO_DIR}/check-entities.sh" < /dev/null 2>&1 \
+        | sed 's/\x1b\[[0-9;]*m//g' > "${NO_JOINTS_LOG}" || true
+    NO_JOINTS_SECTION=$(section_text 5 "${NO_JOINTS_LOG}")
+    if ! grep -q 'exploration complete' "${NO_JOINTS_LOG}"; then
+        fail "check-entities.sh without joint data runs to completion" "$(tail -n 5 "${NO_JOINTS_LOG}")"
+    elif grep -q 'Joint state data not available' <<< "${NO_JOINTS_SECTION}" \
+        && ! grep -q '^{' <<< "${NO_JOINTS_SECTION}" && ! grep -qw 'null' "${NO_JOINTS_LOG}"; then
+        pass "check-entities.sh without joint data prints the hint and no null"
+    else
+        fail "check-entities.sh without joint data prints the hint and no null" \
+            "section 5: $(tr '\n' ';' <<< "${NO_JOINTS_SECTION}"); null lines: $(grep -cw 'null' "${NO_JOINTS_LOG}" || true)"
+    fi
+else
+    fail "setup: joint_states answers 200 with empty data with joint_state_broadcaster unloaded" \
+        "HTTP ${JOINT_HTTP:-none}: $(head -c 200 <<< "${JOINT_BODY}" | tr '\n' ' '); ros2 control: $(docker exec "${DEMO_CONTAINER}" cat /tmp/moveit_smoke_ros2_control.log 2> /dev/null | tail -n 3 | tr '\n' ';')"
+fi
+if reload_joint_state_broadcaster && poll_until "/apps/joint-state-broadcaster/data/joint_states" \
+    '.data.name | arrays | length > 0' 30; then
+    pass "setup: joint states return after joint_state_broadcaster is loaded again"
+else
+    fail "setup: joint states return after joint_state_broadcaster is loaded again" \
+        "$(docker exec "${DEMO_CONTAINER}" cat /tmp/moveit_smoke_ros2_control.log 2> /dev/null | tail -n 3 | tr '\n' ';')"
+fi
+resume_pick_place_loop
+
 # --- Summary ---
 
 # print_summary runs via EXIT trap; exit code reflects test results
diff --git a/tests/smoke_test_multi_ecu.sh b/tests/smoke_test_multi_ecu.sh
index 8fec105..7ccc590 100755
--- a/tests/smoke_test_multi_ecu.sh
+++ b/tests/smoke_test_multi_ecu.sh
@@ -3,6 +3,11 @@
 # Runs from the host against the perception ECU gateway on localhost:8080
 # The perception ECU is the primary aggregator - it should expose local entities
 # plus aggregated entities from planning and actuation ECUs.
+# Reads the demo's container scripts and config from this checkout and runs its
+# host-side wrapper scripts.
+# Stops an ECU's fault manager with docker exec, so it needs access to the ECU
+# containers (names from PERCEPTION_CONTAINER, PLANNING_CONTAINER and
+# ACTUATION_CONTAINER, CI names by default).
 #
 # Usage: ./tests/smoke_test_multi_ecu.sh [GATEWAY_URL]
 # Default GATEWAY_URL: http://localhost:8080
@@ -15,7 +20,49 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=tests/smoke_lib.sh
 source "${SCRIPT_DIR}/smoke_lib.sh"
 
-trap print_summary EXIT
+ecu_container() {
+    case "$1" in
+        perception-ecu) echo "${PERCEPTION_CONTAINER:-perception_ecu_ci}" ;;
+        planning-ecu) echo "${PLANNING_CONTAINER:-planning_ecu_ci}" ;;
+        actuation-ecu) echo "${ACTUATION_CONTAINER:-actuation_ecu_ci}" ;;
+    esac
+}
+
+# Anchored so it does not match the bash -c wrapper that runs pgrep.
+FAULT_MANAGER_PATTERN='^/root/demo_ws/install/ros2_medkit_fault_manager/lib/ros2_medkit_fault_manager/fault_manager_node '
+# Container whose fault manager is stopped, resumed on exit.
+STOPPED_FM_CONTAINER=""
+
+# SIGSTOP on the fault manager makes the ECU gateway's fault service calls time
+# out, so its fault reads and clears answer 503.
+stop_fault_manager() {
+    docker exec "$1" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 1
+        kill -STOP \"\${pid}\"
+    " > /dev/null 2>&1 || return 1
+    STOPPED_FM_CONTAINER="$1"
+}
+
+resume_fault_manager() {
+    docker exec "$1" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 0
+        kill -CONT \"\${pid}\"
+    " > /dev/null 2>&1 || true
+    STOPPED_FM_CONTAINER=""
+}
+
+# print_summary reads the script's exit status from $?, so hand it the status
+# saved on entry.
+cleanup_on_exit() {
+    local rc=$?
+    set +e
+    if [ -n "$STOPPED_FM_CONTAINER" ]; then
+        resume_fault_manager "$STOPPED_FM_CONTAINER"
+    fi
+    (exit "$rc")
+    print_summary
+}
+trap cleanup_on_exit EXIT
 
 # --- Wait for gateway startup ---
 
@@ -149,6 +196,612 @@ section "Scripts"
 # Perception ECU scripts should include inject-sensor-failure
 assert_scripts_list "perception-ecu" "inject-sensor-failure"
 
+section "Container Script Parameter Writes"
+
+# The checks below read what each container script writes from the scripts
+# themselves and the launch values from the demo config and node sources.
+DEMO_DIR="$(cd "${SCRIPT_DIR}/../demos/multi_ecu_aggregation" && pwd)"
+CONTAINER_SCRIPTS="${DEMO_DIR}/container_scripts"
+
+# Container scripts this test executes. Must match container_scripts/.
+EXERCISED_SCRIPTS="actuation-ecu/inject-gripper-jam actuation-ecu/restore-normal \
+perception-ecu/inject-sensor-failure perception-ecu/restore-normal \
+planning-ecu/inject-planning-delay planning-ecu/restore-normal"
+
+# Parameter writes of a container script, one "app param value" line each,
+# read from its top-level put_config calls.
+script_writes() {
+    sed -n -E 's/^put_config ([a-z-]+) ([a-z_]+) ([^ ]+)$/\1 \2 \3/p' \
+        "${CONTAINER_SCRIPTS}/$1/$2/script.bash"
+}
+
+# Value a parameter has after launch: set in the ECU params file, else the
+# node's declared default. An app id is its node name with dashes.
+launch_value() {
+    local ecu="$1" app="$2" param="$3" node value
+    node="${app//-/_}"
+    value=$(awk -v node="${node}:" -v key="${param}:" '
+        /^[^ #]/ { in_node = 0 }
+        /^  [^ #]/ { in_node = ($1 == node) }
+        in_node && $1 == key { print $2; exit }
+    ' "${DEMO_DIR}/config/${ecu%-ecu}_params.yaml" 2>/dev/null) || value=""
+    if [ -z "$value" ]; then
+        value=$(sed -n -E "s/.*declare_parameter\(\"${param}\", ([^)]+)\).*/\1/p" \
+            "${DEMO_DIR}"/src/*/"${node}.cpp" 2>/dev/null | head -1) || value=""
+    fi
+    echo "$value"
+}
+
+# Every parameter a script writes holds the expected value, read back with a
+# plain GET. $3 is "written" (the value the script writes) or "launch".
+assert_script_params() {
+    local ecu="$1" script="$2" expect="$3" writes app param value want
+    writes=$(script_writes "$ecu" "$script") || writes=""
+    if [ -z "$writes" ]; then
+        fail "${ecu}/${script} writes parameters the test can read" "no put_config calls found"
+        return
+    fi
+    while read -r app param value; do
+        want="$value"
+        if [ "$expect" = "launch" ]; then
+            want=$(launch_value "$ecu" "$app" "$param")
+        fi
+        local label="after ${script} on ${ecu}: ${app}/${param} is ${want:-<unknown>}"
+        if [ -z "$want" ]; then
+            fail "$label" "no launch value found in the params file or the node source"
+        elif api_get "/apps/${app}/configurations/${param}" \
+            && echo "$RESPONSE" | jq -e --argjson want "$want" '.data == $want' > /dev/null 2>&1; then
+            pass "$label"
+        else
+            fail "$label" "got: $(echo "$RESPONSE" | jq -c 'if has("data") then .data else . end' 2>/dev/null \
+                || echo "$RESPONSE")"
+        fi
+    done <<< "$writes"
+}
+
+# A valid value other than the launch value: a bool flips, a double moves by
+# 0.001, an integer by 1. Small steps keep drift and failure effects far from
+# the nodes' fault thresholds.
+away_value() {
+    case "$1" in
+        true) echo false ;;
+        false) echo true ;;
+        *[.eE]*) jq -n --argjson v "$1" '($v + 0.001) * 1000000 | round / 1000000' ;;
+        *) echo $(($1 + 1)) ;;
+    esac
+}
+
+# Moves every parameter a script writes away from its launch value through the
+# gateway, so a later check at the launch value proves the script wrote it.
+# A parameter already away from its launch value, such as an injected one,
+# keeps its value.
+move_params_away() {
+    local ecu="$1" script="$2" writes app param value launch away code
+    writes=$(script_writes "$ecu" "$script") || writes=""
+    while read -r app param value; do
+        [ -n "$app" ] || continue
+        launch=$(launch_value "$ecu" "$app" "$param")
+        if [ -z "$launch" ]; then
+            fail "before ${script} on ${ecu}: ${app}/${param} is away from its launch value" "no launch value found"
+            continue
+        fi
+        if api_get "/apps/${app}/configurations/${param}" \
+            && echo "$RESPONSE" | jq -e --argjson l "$launch" '.data != $l' > /dev/null 2>&1; then
+            pass "before ${script} on ${ecu}: ${app}/${param} is $(echo "$RESPONSE" | jq -c '.data'), \
+not its launch value ${launch}"
+            continue
+        fi
+        away=$(away_value "$launch")
+        code=$(curl -s -m 30 -o /dev/null -w '%{http_code}' -X PUT "${API_BASE}/apps/${app}/configurations/${param}" \
+            -H "Content-Type: application/json" -d "{\"value\": ${away}}") || true
+        if [[ "$code" == 2?? ]] && api_get "/apps/${app}/configurations/${param}" \
+            && echo "$RESPONSE" | jq -e --argjson a "$away" '.data == $a' > /dev/null 2>&1; then
+            pass "before ${script} on ${ecu}: ${app}/${param} is ${away}, not its launch value ${launch}"
+        else
+            fail "before ${script} on ${ecu}: ${app}/${param} is ${away}, not its launch value ${launch}" \
+                "PUT returned HTTP ${code}, read back: $(echo "$RESPONSE" | jq -c '.data // .' 2>/dev/null)"
+        fi
+    done <<< "$writes"
+}
+
+listed_scripts=$(cd "$CONTAINER_SCRIPTS" && find . -name script.bash | sed -e 's:^\./::' -e 's:/script\.bash$::' \
+    | sort | tr '\n' ' ')
+exercised_scripts=$(echo "$EXERCISED_SCRIPTS" | tr ' ' '\n' | sed '/^$/d' | sort | tr '\n' ' ')
+if [ "$listed_scripts" = "$exercised_scripts" ]; then
+    pass "this test executes every container script"
+else
+    fail "this test executes every container script" "container_scripts: ${listed_scripts}"
+fi
+
+# script_writes reads only top-level put_config calls. A parameter write in any
+# other form fails here instead of going unchecked.
+for script_file in "${CONTAINER_SCRIPTS}"/*/*/script.bash; do
+    script_name="${script_file#"${CONTAINER_SCRIPTS}"/}"
+    script_name="${script_name%/script.bash}"
+    read_calls=$(grep -cE '^put_config [a-z-]+ [a-z_]+ [^ ]+$' "$script_file" || true)
+    all_calls=$(grep -cE '(^|[^[:alnum:]_])put_config[[:space:]]' "$script_file" || true)
+    config_urls=$(grep -c '/configurations/' "$script_file" || true)
+    if [ "$read_calls" -gt 0 ] && [ "$read_calls" -eq "$all_calls" ] && [ "$config_urls" -eq 1 ]; then
+        pass "${script_name} writes parameters only through put_config calls"
+    else
+        fail "${script_name} writes parameters only through put_config calls" \
+            "top-level put_config: ${read_calls}, all put_config calls: ${all_calls}, configuration URLs: ${config_urls}"
+    fi
+done
+
+# Lines of a script from the line equal to $2 to the next line equal to $3.
+script_block() {
+    awk -v first="$2" -v last="$3" '$0 == first { on = 1 } on { print } on && $0 == last { exit }' "$1"
+}
+
+# The write-failure test below runs one script. Every other script must carry
+# the same put_config and exit check, and must make all its writes before that
+# check.
+REFERENCE_SCRIPT="actuation-ecu/restore-normal"
+PUT_CONFIG_FIRST='put_config() {'
+EXIT_CHECK_FIRST="if [ \"\$ERRORS\" -gt 0 ]; then"
+ref_put=$(script_block "${CONTAINER_SCRIPTS}/${REFERENCE_SCRIPT}/script.bash" "$PUT_CONFIG_FIRST" "}")
+ref_exit=$(script_block "${CONTAINER_SCRIPTS}/${REFERENCE_SCRIPT}/script.bash" "$EXIT_CHECK_FIRST" "fi")
+for script_file in "${CONTAINER_SCRIPTS}"/*/*/script.bash; do
+    script_name="${script_file#"${CONTAINER_SCRIPTS}"/}"
+    script_name="${script_name%/script.bash}"
+    put_block=$(script_block "$script_file" "$PUT_CONFIG_FIRST" "}")
+    exit_block=$(script_block "$script_file" "$EXIT_CHECK_FIRST" "fi")
+    if [ -n "$ref_put" ] && [ "$put_block" = "$ref_put" ]; then
+        pass "${script_name} put_config is the same as in ${REFERENCE_SCRIPT}"
+    else
+        fail "${script_name} put_config is the same as in ${REFERENCE_SCRIPT}" \
+            "$(diff <(echo "$ref_put") <(echo "$put_block") | head -6)"
+    fi
+    if [ -n "$ref_exit" ] && [ "$exit_block" = "$ref_exit" ]; then
+        pass "${script_name} exit check is the same as in ${REFERENCE_SCRIPT}"
+    else
+        fail "${script_name} exit check is the same as in ${REFERENCE_SCRIPT}" \
+            "$(diff <(echo "$ref_exit") <(echo "$exit_block") | head -6)"
+    fi
+    error_inits=$(grep -c '^ERRORS=0$' "$script_file" || true)
+    last_write=$(grep -n '^put_config ' "$script_file" | tail -1 | cut -d: -f1)
+    exit_line=$(grep -n -F -x "$EXIT_CHECK_FIRST" "$script_file" | head -1 | cut -d: -f1)
+    if [ "$error_inits" -eq 1 ] && [ -n "$last_write" ] && [ -n "$exit_line" ] && [ "$last_write" -lt "$exit_line" ]; then
+        pass "${script_name} makes every write before its exit check"
+    else
+        fail "${script_name} makes every write before its exit check" \
+            "ERRORS=0 lines: ${error_inits}, last put_config line: ${last_write:-none}, exit check line: ${exit_line:-none}"
+    fi
+done
+
+# An inject must change what it writes, and the ECU's restore-normal must
+# write it back.
+for inject_dir in "${CONTAINER_SCRIPTS}"/*/inject-*/; do
+    ecu=$(basename "$(dirname "$inject_dir")")
+    inject=$(basename "$inject_dir")
+    restore_writes=$(script_writes "$ecu" "restore-normal") || restore_writes=""
+    while read -r app param value; do
+        [ -n "$app" ] || continue
+        launch=$(launch_value "$ecu" "$app" "$param")
+        if [ -n "$launch" ] && jq -n -e --argjson a "$value" --argjson b "$launch" '$a != $b' > /dev/null 2>&1; then
+            pass "${ecu}/${inject} changes ${app}/${param} from its launch value ${launch}"
+        else
+            fail "${ecu}/${inject} changes ${app}/${param} from its launch value" \
+                "writes ${value}, launch value ${launch:-<unknown>}"
+        fi
+        if echo "$restore_writes" | grep -qE "^${app} ${param} "; then
+            pass "${ecu}/restore-normal writes ${app}/${param} back"
+        else
+            fail "${ecu}/restore-normal writes ${app}/${param} back" "not among its put_config calls"
+        fi
+    done <<< "$(script_writes "$ecu" "$inject")"
+done
+
+section "Restore Before Any Inject"
+
+# Runs a container script through the Scripts API and prints its execution
+# once it has ended. Returns 1 if it does not end within $3 seconds.
+run_script() {
+    local endpoint="/components/$1/scripts/$2/executions" deadline exec_id
+    exec_id=$(curl -s -m 30 -X POST "${API_BASE}${endpoint}" -H "Content-Type: application/json" \
+        -d '{"execution_type": "now"}' | jq -r '.id // empty') || exec_id=""
+    [ -n "$exec_id" ] || return 1
+    deadline=$((SECONDS + $3))
+    while [ "$SECONDS" -lt "$deadline" ]; do
+        if api_get "${endpoint}/${exec_id}" \
+            && echo "$RESPONSE" | jq -e '.status | IN("completed", "failed", "terminated")' > /dev/null 2>&1; then
+            echo "$RESPONSE"
+            return 0
+        fi
+        sleep 1
+    done
+    return 1
+}
+
+# restore-normal is the first script on every ECU, with no earlier script or
+# ros2 CLI call in that container, on parameters as launched.
+for ecu in perception-ecu planning-ecu actuation-ecu; do
+    exec_json=$(run_script "$ecu" "restore-normal" 30) || exec_json=""
+    first_status=$(echo "$exec_json" | jq -r '.status // empty' 2>/dev/null) || first_status=""
+    if [ "$first_status" = "completed" ]; then
+        pass "restore-normal on ${ecu} completes as the first script after start"
+    else
+        fail "restore-normal on ${ecu} completes as the first script after start" \
+            "status: ${first_status:-no end state within 30s} $(echo "$exec_json" | jq -c '.error // empty' 2>/dev/null)"
+    fi
+    assert_script_params "$ecu" "restore-normal" launch
+done
+
+section "Script Injection and Restore"
+
+# Latest path path-planner published. Its header stamp is taken at the end of
+# the planning cycle, after the injected delay.
+PATH_DATA="/apps/path-planner/data/%2Fplanning%2Fpath"
+
+# Seconds between two consecutive paths from path-planner, waiting at most $1 s.
+path_period() {
+    local deadline=$((SECONDS + $1)) first="" stamp
+    while [ "$SECONDS" -lt "$deadline" ]; do
+        if api_get "$PATH_DATA"; then
+            stamp=$(echo "$RESPONSE" | jq -r '.data.header.stamp | .sec + .nanosec / 1e9' 2>/dev/null) || stamp=""
+            if [ -z "$first" ]; then
+                first="$stamp"
+            elif [ -n "$stamp" ] && [ "$stamp" != "$first" ]; then
+                jq -n --argjson a "$first" --argjson b "$stamp" '$b - $a'
+                return 0
+            fi
+        fi
+        sleep 0.2
+    done
+    return 1
+}
+
+# Perception ECU
+assert_script_execution "perception-ecu" "inject-sensor-failure"
+assert_script_params "perception-ecu" "inject-sensor-failure" written
+move_params_away "perception-ecu" "restore-normal"
+assert_script_execution "perception-ecu" "restore-normal"
+assert_script_params "perception-ecu" "restore-normal" launch
+
+# Planning ECU
+DELAY_MS=$(script_writes "planning-ecu" "inject-planning-delay" \
+    | awk '$1 == "path-planner" && $2 == "planning_delay_ms" { print $3 }') || DELAY_MS=""
+DELAY_MS="${DELAY_MS:-0}"
+
+assert_script_execution "planning-ecu" "inject-planning-delay"
+assert_script_params "planning-ecu" "inject-planning-delay" written
+
+if poll_until "/faults" '.items[] | select(.fault_code == "PATH_PLANNER")' 30; then
+    pass "PATH_PLANNER fault is reported after inject-planning-delay"
+else
+    fail "PATH_PLANNER fault is reported after inject-planning-delay" "not reported within 30s"
+fi
+
+if period=$(path_period 20) \
+    && jq -n -e --argjson p "$period" --argjson d "$DELAY_MS" '$d > 0 and $p >= $d / 1000 * 0.8' > /dev/null; then
+    pass "path-planner publishes one path per ${DELAY_MS} ms or slower while the delay is injected (${period}s)"
+else
+    fail "path-planner publishes one path per ${DELAY_MS} ms or slower while the delay is injected" \
+        "period: ${period:-no second path within 20s}"
+fi
+
+move_params_away "planning-ecu" "restore-normal"
+
+# The planning cycle is still waiting out the delay here, and restore-normal
+# must not wait with it. Timed from before the POST until the completed status
+# is read; the wait runs past the bound so a slow restore reports its time.
+RESTORE_BOUND_MS=15000
+restore_start_ns=$(date +%s%N)
+exec_json=$(run_script "planning-ecu" "restore-normal" $((RESTORE_BOUND_MS * 4 / 1000))) || exec_json=""
+restore_ms=$((($(date +%s%N) - restore_start_ns) / 1000000))
+restore_status=$(echo "$exec_json" | jq -r '.status // empty' 2>/dev/null) || restore_status=""
+if [ "$restore_status" = "completed" ] && [ "$restore_ms" -le "$RESTORE_BOUND_MS" ]; then
+    pass "planning restore-normal after inject-planning-delay completes within ${RESTORE_BOUND_MS} ms (${restore_ms} ms)"
+else
+    fail "planning restore-normal after inject-planning-delay completes within ${RESTORE_BOUND_MS} ms" \
+        "status ${restore_status:-still running} after ${restore_ms} ms $(echo "$exec_json" \
+        | jq -c '.error // empty' 2>/dev/null)"
+fi
+assert_script_params "planning-ecu" "restore-normal" launch
+
+if period=$(path_period 10) \
+    && jq -n -e --argjson p "$period" --argjson d "$DELAY_MS" '$p < $d / 1000 / 2' > /dev/null; then
+    pass "path-planner is back to its planning rate after restore-normal (${period}s)"
+else
+    fail "path-planner is back to its planning rate after restore-normal" "period: ${period:-no second path within 10s}"
+fi
+
+# Actuation ECU
+assert_script_execution "actuation-ecu" "inject-gripper-jam"
+assert_script_params "actuation-ecu" "inject-gripper-jam" written
+move_params_away "actuation-ecu" "restore-normal"
+assert_script_execution "actuation-ecu" "restore-normal"
+assert_script_params "actuation-ecu" "restore-normal" launch
+
+# The perception ECU aggregates the fault lists of all three ECUs.
+if poll_until "/faults" '.items | length == 0' 15; then
+    pass "no faults remain after restore-normal on all three ECUs"
+else
+    fail "no faults remain after restore-normal on all three ECUs" "found: $(echo "$RESPONSE" | jq -c '.items')"
+fi
+
+section "Host Inject and Restore Wrappers"
+
+if host_out=$(GATEWAY_URL="$GATEWAY_URL" "${DEMO_DIR}/inject-cascade-failure.sh" 2>&1); then
+    pass "inject-cascade-failure.sh exits 0"
+else
+    fail "inject-cascade-failure.sh exits 0" "$(echo "$host_out" | tail -5)"
+fi
+assert_script_params "perception-ecu" "inject-sensor-failure" written
+assert_script_params "planning-ecu" "inject-planning-delay" written
+assert_script_params "actuation-ecu" "inject-gripper-jam" written
+
+if poll_until "/faults" '.items[] | select(.fault_code == "PATH_PLANNER")' 30; then
+    pass "PATH_PLANNER fault is reported after inject-cascade-failure.sh"
+else
+    fail "PATH_PLANNER fault is reported after inject-cascade-failure.sh" "not reported within 30s"
+fi
+
+move_params_away "perception-ecu" "restore-normal"
+move_params_away "planning-ecu" "restore-normal"
+move_params_away "actuation-ecu" "restore-normal"
+
+# restore-normal.sh waits up to 120s for each ECU; with the delay injected it
+# must still finish far inside that.
+HOST_RESTORE_BOUND_MS=30000
+host_start_ns=$(date +%s%N)
+if host_out=$(GATEWAY_URL="$GATEWAY_URL" "${DEMO_DIR}/restore-normal.sh" 2>&1); then
+    host_rc=0
+else
+    host_rc=$?
+fi
+host_ms=$((($(date +%s%N) - host_start_ns) / 1000000))
+if [ "$host_rc" -eq 0 ] && [ "$host_ms" -le "$HOST_RESTORE_BOUND_MS" ]; then
+    pass "restore-normal.sh exits 0 within ${HOST_RESTORE_BOUND_MS} ms with a planning delay injected (${host_ms} ms)"
+else
+    fail "restore-normal.sh exits 0 within ${HOST_RESTORE_BOUND_MS} ms with a planning delay injected" \
+        "exit ${host_rc} after ${host_ms} ms: $(echo "$host_out" | tail -5)"
+fi
+assert_script_params "perception-ecu" "restore-normal" launch
+assert_script_params "planning-ecu" "restore-normal" launch
+assert_script_params "actuation-ecu" "restore-normal" launch
+
+if poll_until "/faults" '.items | length == 0' 15; then
+    pass "no faults remain after restore-normal.sh"
+else
+    fail "no faults remain after restore-normal.sh" "found: $(echo "$RESPONSE" | jq -c '.items')"
+fi
+
+section "Parameter Write Failure Reporting"
+
+# A lock on gripper-controller's configurations held by another client makes
+# the gateway refuse those writes from the script, while the other actuation
+# writes still land.
+move_params_away "actuation-ecu" "restore-normal"
+LOCK_CLIENT="smoke-test-write-failure"
+lock_id=$(curl -s -m 30 -X POST "${API_BASE}/apps/gripper-controller/locks" \
+    -H "X-Client-Id: ${LOCK_CLIENT}" -H "Content-Type: application/json" \
+    -d '{"lock_expiration": 60, "scopes": ["configurations"]}' | jq -r '.id // empty') || lock_id=""
+if [ -n "$lock_id" ]; then
+    pass "another client locks gripper-controller configurations"
+else
+    fail "another client locks gripper-controller configurations" "no lock id returned"
+fi
+
+if exec_json=$(run_script "actuation-ecu" "restore-normal" 60); then
+    exec_status=$(echo "$exec_json" | jq -r '.status')
+    exec_message=$(echo "$exec_json" | jq -r '.error.message // ""')
+    if [ "$exec_status" = "failed" ]; then
+        pass "actuation restore-normal fails while gripper-controller writes are refused"
+    else
+        fail "actuation restore-normal fails while gripper-controller writes are refused" "status: ${exec_status}"
+    fi
+    while read -r app param value; do
+        if [ "$app" = "gripper-controller" ]; then
+            if api_get "/apps/${app}/configurations/${param}" \
+                && echo "$RESPONSE" | jq -e --argjson v "$value" '.data != $v' > /dev/null 2>&1; then
+                pass "refused write ${app}/${param} did not change the parameter"
+            else
+                fail "refused write ${app}/${param} did not change the parameter" \
+                    "read back: $(echo "$RESPONSE" | jq -c '.data // .' 2>/dev/null)"
+            fi
+            if echo "$exec_message" | grep -qF "FAIL: ${app}/${param}"; then
+                pass "failure message names the refused write ${app}/${param}"
+            else
+                fail "failure message names the refused write ${app}/${param}" "message: ${exec_message}"
+            fi
+        else
+            if api_get "/apps/${app}/configurations/${param}" \
+                && echo "$RESPONSE" | jq -e --argjson v "$value" '.data == $v' > /dev/null 2>&1; then
+                pass "write ${app}/${param} landed while gripper-controller was locked"
+            else
+                fail "write ${app}/${param} landed while gripper-controller was locked" \
+                    "read back: $(echo "$RESPONSE" | jq -c '.data // .' 2>/dev/null)"
+            fi
+            if echo "$exec_message" | grep -qF "FAIL: ${app}/${param}"; then
+                fail "failure message does not name ${app}/${param}, which succeeded" "message: ${exec_message}"
+            else
+                pass "failure message does not name ${app}/${param}, which succeeded"
+            fi
+        fi
+    done <<< "$(script_writes "actuation-ecu" "restore-normal")"
+else
+    fail "actuation restore-normal ends while gripper-controller writes are refused" "no end state within 60s"
+fi
+
+if [ -n "$lock_id" ]; then
+    unlock_status=$(curl -s -m 30 -o /dev/null -w "%{http_code}" -X DELETE \
+        "${API_BASE}/apps/gripper-controller/locks/${lock_id}" -H "X-Client-Id: ${LOCK_CLIENT}") || true
+    if [ "$unlock_status" = "204" ]; then
+        pass "gripper-controller lock is released"
+    else
+        fail "gripper-controller lock is released" "got HTTP ${unlock_status}"
+    fi
+fi
+
+section "Fault Clear Failure Reporting"
+
+# HTTP status of a request $2 $3 on an ECU's own gateway, the one its scripts
+# call.
+ecu_http_code() {
+    docker exec "$1" curl -s -m 30 -o /dev/null -w '%{http_code}' -X "$2" "http://localhost:8080/api/v1$3" \
+        2>/dev/null || true
+}
+
+# Resumes the fault manager in container $1 and waits until its gateway reads
+# faults again.
+resume_and_wait_fault_manager() {
+    local deadline=$((SECONDS + 30))
+    resume_fault_manager "$1"
+    until [ "$(ecu_http_code "$1" GET /faults)" = "200" ]; do
+        [ "$SECONDS" -lt "$deadline" ] || return 1
+        sleep 1
+    done
+}
+
+# Sets CLEAR_CODE to the status a fault clear gets from the gateway of ECU $1
+# in container $2 and passes when it is not 2xx. Call only while that ECU's
+# fault manager is stopped: a working clear removes faults.
+measure_failed_clear() {
+    CLEAR_CODE=$(ecu_http_code "$2" DELETE /faults)
+    if [[ "$CLEAR_CODE" =~ ^[0-9]{3}$ && "$CLEAR_CODE" != 2?? ]]; then
+        pass "setup: a fault clear on the $1 gateway fails $3 (HTTP ${CLEAR_CODE})"
+    else
+        fail "setup: a fault clear on the $1 gateway fails $3" "DELETE /faults: HTTP ${CLEAR_CODE}"
+        return 1
+    fi
+}
+
+# Watches restore-normal on ECU $2 in container $1 and stops the fault manager
+# while the script sleeps between its two clears, so the first clear succeeds
+# and the final one fails. Prints "armed" when it starts polling and "stopped"
+# once the fault manager is stopped. Exits 1 when the script ends without that
+# pause or does not run within 60 s.
+# shellcheck disable=SC2016  # Expanded by bash in the container.
+watch_between_clears() {
+    docker exec -e SCRIPT_RE="^bash /var/lib/ros2_medkit/scripts/$2/restore-normal/script\.bash$" \
+        -e FM_RE="$FAULT_MANAGER_PATTERN" "$1" bash -c '
+        end=$((SECONDS + 60)) seen=""
+        echo armed
+        while [ "$SECONDS" -lt "$end" ]; do
+            if pid=$(pgrep -f "$SCRIPT_RE"); then
+                seen=1
+                if pgrep -P "$pid" -x sleep > /dev/null; then
+                    kill -STOP "$(pgrep -f "$FM_RE")" && echo stopped
+                    exit
+                fi
+            elif [ -n "$seen" ]; then
+                exit 1
+            fi
+            sleep 0.05
+        done
+        exit 1
+    ' 2> /dev/null
+}
+
+# An execution of restore-normal on ECU $1 failed and its error names the
+# fault clear with status $3. $4 says in which case.
+assert_clear_failure_reported() {
+    local ecu="$1" exec_json="$2" code="$3" when="$4" status message
+    status=$(echo "$exec_json" | jq -r '.status // empty' 2>/dev/null) || status=""
+    message=$(echo "$exec_json" | jq -r '.error.message // empty' 2>/dev/null) || message=""
+    if [ "$status" = "failed" ]; then
+        pass "restore-normal on ${ecu} fails ${when}"
+    else
+        fail "restore-normal on ${ecu} fails ${when}" \
+            "status: ${status:-no end state within 60s} $(echo "$exec_json" | jq -c '.parameters // empty' 2>/dev/null)"
+    fi
+    if echo "$message" | grep -qF "FAIL: clear faults (HTTP ${code})"; then
+        pass "restore-normal error on ${ecu} names the failed fault clear with HTTP ${code} ${when}"
+    else
+        fail "restore-normal error on ${ecu} names the failed fault clear with HTTP ${code} ${when}" "message: ${message}"
+    fi
+}
+
+FM_TMP=$(mktemp -d)
+for ecu in perception-ecu planning-ecu actuation-ecu; do
+    container=$(ecu_container "$ecu")
+
+    # Fault manager stopped for both clears.
+    if ! stop_fault_manager "$container"; then
+        fail "setup: fault manager of ${ecu} is stopped" "no fault_manager_node process in ${container}"
+        continue
+    fi
+    if measure_failed_clear "$ecu" "$container" "while its fault manager is stopped"; then
+        exec_json=$(run_script "$ecu" "restore-normal" 60) || exec_json=""
+        assert_clear_failure_reported "$ecu" "$exec_json" "$CLEAR_CODE" "while its fault manager is stopped"
+
+        # The Scripts API drops the stdout of a failed script, so run it directly.
+        if direct_out=$(docker exec "$container" bash "/var/lib/ros2_medkit/scripts/${ecu}/restore-normal/script.bash" \
+            2> "${FM_TMP}/stderr"); then
+            direct_rc=0
+        else
+            direct_rc=$?
+        fi
+        if [ "$direct_rc" -ne 0 ] && ! echo "$direct_out" | grep -q 'restored'; then
+            pass "restore-normal run directly on ${ecu} exits non-zero and does not print restored"
+        else
+            fail "restore-normal run directly on ${ecu} exits non-zero and does not print restored" \
+                "exit ${direct_rc}, stdout: $(echo "$direct_out" | tail -2 | tr '\n' ';')"
+        fi
+        if grep -qF "FAIL: clear faults (HTTP ${CLEAR_CODE})" "${FM_TMP}/stderr"; then
+            pass "restore-normal run directly on ${ecu} names the failed fault clear with HTTP ${CLEAR_CODE} on stderr"
+        else
+            fail "restore-normal run directly on ${ecu} names the failed fault clear with HTTP ${CLEAR_CODE} on stderr" \
+                "stderr: $(tail -2 "${FM_TMP}/stderr" | tr '\n' ';')"
+        fi
+    fi
+    if ! resume_and_wait_fault_manager "$container"; then
+        fail "setup: the ${ecu} gateway reads faults again after its fault manager resumes" "not within 30s"
+        continue
+    fi
+
+    # Fault manager answers the first clear and stops before the final one. The
+    # script starts only once the watcher polls.
+    STOPPED_FM_CONTAINER="$container"
+    : > "${FM_TMP}/watch"
+    watch_between_clears "$container" "$ecu" > "${FM_TMP}/watch" &
+    watch_pid=$!
+    armed_deadline=$((SECONDS + 15))
+    until grep -qx 'armed' "${FM_TMP}/watch" || [ "$SECONDS" -ge "$armed_deadline" ]; do
+        sleep 0.1
+    done
+    exec_json=""
+    if grep -qx 'armed' "${FM_TMP}/watch"; then
+        exec_json=$(run_script "$ecu" "restore-normal" 60) || exec_json=""
+    fi
+    watch_rc=0
+    wait "$watch_pid" || watch_rc=$?
+    if grep -qx 'stopped' "${FM_TMP}/watch"; then
+        pass "setup: fault manager of ${ecu} stops between the first and the final clear"
+        if measure_failed_clear "$ecu" "$container" "after that stop"; then
+            assert_clear_failure_reported "$ecu" "$exec_json" "$CLEAR_CODE" "when only its final fault clear fails"
+        fi
+    else
+        fail "setup: fault manager of ${ecu} stops between the first and the final clear" \
+            "the watcher saw no pause between the clears (exit ${watch_rc}, output: $(tr '\n' ' ' < "${FM_TMP}/watch"))"
+    fi
+    if ! resume_and_wait_fault_manager "$container"; then
+        fail "setup: the ${ecu} gateway reads faults again after its fault manager resumes" "not within 30s"
+        continue
+    fi
+
+    exec_json=$(run_script "$ecu" "restore-normal" 60) || exec_json=""
+    if echo "$exec_json" | jq -e '.status == "completed" and (.parameters.stdout | test("restored"))' > /dev/null 2>&1; then
+        pass "restore-normal on ${ecu} completes and reports restored once its fault manager answers"
+    else
+        fail "restore-normal on ${ecu} completes and reports restored once its fault manager answers" \
+            "$(echo "$exec_json" | jq -c '{status, error}' 2>/dev/null)"
+    fi
+done
+rm -rf "$FM_TMP"
+
+# Leave the demo restored.
+move_params_away "actuation-ecu" "restore-normal"
+assert_script_execution "actuation-ecu" "restore-normal"
+assert_script_params "actuation-ecu" "restore-normal" launch
+if poll_until "/faults" '.items | length == 0' 15; then
+    pass "no faults remain at the end of the test"
+else
+    fail "no faults remain at the end of the test" "found: $(echo "$RESPONSE" | jq -c '.items')"
+fi
+
 # --- Summary ---
 
 # print_summary runs via EXIT trap; exit code reflects test results
diff --git a/tests/smoke_test_navigation.sh b/tests/smoke_test_navigation.sh
index 18b3d90..b1e3a7b 100755
--- a/tests/smoke_test_navigation.sh
+++ b/tests/smoke_test_navigation.sh
@@ -20,9 +20,17 @@
 #      pose that does not match the spawn point is caught by the goals above,
 #      which stop completing. Measured with the pose deliberately put back to
 #      (0, 0), the goals fail while this check still passes.
+#   4. The inject command setup-triggers.sh hints delivers its fault to the
+#      event stream watch-triggers.sh reads.
+#   5. After that inject, started with the robot parked away from spawn,
+#      restore-normal.sh alone restores the demo: AMCL agrees with the
+#      simulated pose, localization is not reported again under forced AMCL
+#      updates and goals complete, so the script can run again on the same stack.
+#   6. restore-normal fails and names a velocity write another client's lock
+#      refuses, still re-localizes AMCL, and completes once the lock is released.
 #
 # The existing turtlebot3 smoke test deliberately does not navigate, which is
-# why all three could ship together unnoticed.
+# why the first three could ship together unnoticed.
 
 GATEWAY_URL="${1:-http://localhost:8080}"
 API_BASE="${GATEWAY_URL}/api/v1"
@@ -54,10 +62,12 @@ FAULT_SETTLE=5
 # because a single goal leaves the robot standing on it: the goal checker's
 # xy_goal_tolerance is 0.25 m, so a second run against the same container would
 # report success without the robot moving at all.
+SPAWN_X=-2.0
+SPAWN_Y=-0.5
 GOAL_A_X=-1.5
 GOAL_A_Y=-0.5
-GOAL_B_X=-2.0
-GOAL_B_Y=-0.5
+GOAL_B_X="$SPAWN_X"
+GOAL_B_Y="$SPAWN_Y"
 
 # The detector that reports localization quality, and the node name it must
 # register under for its reports to mean anything.
@@ -125,8 +135,9 @@ refute_in_container_log() {
     fi
 }
 
-# Report whether localization is badly wrong: a confirmed LOCALIZATION_UNCERTAINTY
-# at ERROR severity, which the detector raises above a covariance of 1.0.
+# Report whether localization is badly wrong: AMCL's position spread above the
+# detector's ERROR threshold, the level at which it raises LOCALIZATION_UNCERTAINTY
+# at ERROR severity.
 #
 # The WARN level is deliberately not enough. AMCL's particle spread widens while
 # the robot drives and settles again afterwards, and on a healthy run of this
@@ -135,48 +146,42 @@ refute_in_container_log() {
 # while a real pose error, the kind this test exists to catch, is metres wide and
 # clears the error threshold by a wide margin.
 #
+# The spread is read from AMCL, not from the fault list: a fault keeps the
+# highest severity it ever had, even across a clear, so after one ERROR every
+# later WARN reads ERROR.
+#
 # Echoes "yes", "no", or "error". The error case matters: a failed or malformed
 # read must not read as "no fault", or this passes whenever the gateway is
 # unreachable.
-localization_confirmed() {
-    if ! api_get "/faults?status=all"; then
-        echo error
-        return
-    fi
-    if ! jq -e '.items' <<< "$RESPONSE" > /dev/null 2>&1; then
+localization_badly_wrong() {
+    local threshold spread
+    threshold=$(curl -s -m 20 \
+        "${API_BASE}/apps/${DETECTOR_APP}/configurations/covariance_error_threshold" \
+        | jq -e '.data | numbers' 2>/dev/null) || threshold=""
+    spread=$(curl -s -m 20 "${API_BASE}/apps/amcl/data/amcl_pose" \
+        | jq -e '.data.pose.covariance | (.[0] + .[7]) | sqrt' 2>/dev/null) || spread=""
+    if [ -z "$threshold" ] || [ -z "$spread" ]; then
         echo error
         return
     fi
-    # jq -e exits 0 when the select produced an item, 1 or 4 when it produced
-    # nothing, and 5 when the list could not be read at all. Only the last one
-    # is an error; an unreadable list must not pass as a clean one.
-    local rc=0
-    jq -e '.items[] | select(.fault_code == "LOCALIZATION_UNCERTAINTY"
-                              and .status == "CONFIRMED"
-                              and .severity_label == "ERROR")' \
-        <<< "$RESPONSE" > /dev/null 2>&1 || rc=$?
-    case "$rc" in
-        0)   echo yes ;;
-        1|4) echo no ;;
-        *)   echo error ;;
-    esac
+    jq -nr --argjson s "$spread" --argjson t "$threshold" 'if $s > $t then "yes" else "no" end'
 }
 
 # Usage: assert_localization_certain WHEN
 assert_localization_certain() {
     local when="$1" state
-    state=$(localization_confirmed)
+    state=$(localization_badly_wrong)
     case "$state" in
         no)  pass "localization is not badly wrong ${when}" ;;
-        yes) fail "localization is not badly wrong ${when}" "LOCALIZATION_UNCERTAINTY is CONFIRMED at ERROR severity" ;;
-        *)   fail "localization is not badly wrong ${when}" "could not read the fault list" ;;
+        yes) fail "localization is not badly wrong ${when}" "AMCL position spread is above the detector's ERROR threshold" ;;
+        *)   fail "localization is not badly wrong ${when}" "could not read the AMCL pose or the threshold" ;;
     esac
 }
 
 # Drive to a pose and require the goal to be accepted and to finish.
-# Usage: drive_to X Y
+# Usage: drive_to X Y [WHEN]
 drive_to() {
-    local goal_x="$1" goal_y="$2" body http_code payload execution_id status elapsed poll_body
+    local goal_x="$1" goal_y="$2" when="${3:+ $3}" body http_code payload execution_id status elapsed poll_body
     payload=$(jq -nc --argjson x "$goal_x" --argjson y "$goal_y" \
         '{parameters: {pose: {header: {frame_id: "map"},
           pose: {position: {x: $x, y: $y, z: 0.0},
@@ -189,16 +194,16 @@ drive_to() {
     body=$(sed '$d' <<< "$body")
 
     if [ "$http_code" = "202" ]; then
-        pass "goal (${goal_x}, ${goal_y}) is accepted"
+        pass "goal (${goal_x}, ${goal_y}) is accepted${when}"
     else
-        fail "goal (${goal_x}, ${goal_y}) is accepted" \
+        fail "goal (${goal_x}, ${goal_y}) is accepted${when}" \
              "HTTP ${http_code}: $(head -c 200 <<< "$body")"
         return
     fi
 
     execution_id=$(jq -r '.id // empty' <<< "$body" 2>/dev/null) || true
     if [ -z "$execution_id" ]; then
-        fail "goal (${goal_x}, ${goal_y}) completes" "no execution id in the accept response"
+        fail "goal (${goal_x}, ${goal_y}) completes${when}" "no execution id in the accept response"
         return
     fi
 
@@ -221,11 +226,66 @@ drive_to() {
     done
 
     case "$status" in
-        completed|succeeded) pass "goal (${goal_x}, ${goal_y}) completes" ;;
-        *) fail "goal (${goal_x}, ${goal_y}) completes" "status is '${status}' after ${elapsed}s" ;;
+        completed|succeeded) pass "goal (${goal_x}, ${goal_y}) completes${when}" ;;
+        *) fail "goal (${goal_x}, ${goal_y}) completes${when}" "status is '${status}' after ${elapsed}s" ;;
     esac
 }
 
+# Echoes {x, y, yaw} of a pose object with position and orientation. Protobuf
+# JSON from Gazebo leaves zero fields out, hence the defaults.
+POSE_TO_XY_YAW=$(cat <<'JQ'
+{x: (.position.x // 0), y: (.position.y // 0),
+ yaw: (.orientation | [(.w // 0), (.x // 0), (.y // 0), (.z // 0)] as [$w, $x, $y, $z]
+       | atan2(2 * ($w * $z + $x * $y); 1 - 2 * ($y * $y + $z * $z)))}
+JQ
+)
+
+# Echoes the robot's pose in the simulation as {x, y, yaw}, or nothing. The map
+# frame of this demo is the Gazebo world frame. A single read has returned the
+# model twice, so only the first match is used.
+sim_pose() {
+    docker exec "$DEMO_CONTAINER" bash -c \
+        'source /opt/ros/jazzy/setup.bash > /dev/null 2>&1
+         timeout 10 gz topic -e -n 1 -t /world/default/dynamic_pose/info --json-output 2> /dev/null \
+             | jq -c -n --arg m "$TURTLEBOT3_MODEL" "first(inputs | .pose[] | select(.name == \$m))"' 2> /dev/null \
+        | jq -c "$POSE_TO_XY_YAW" 2> /dev/null || true
+}
+
+# Echoes AMCL's last published pose as {x, y, yaw}, or nothing.
+amcl_pose() {
+    curl -s -m 20 "${API_BASE}/apps/amcl/data/amcl_pose" \
+        | jq -c ".data.pose.pose | $POSE_TO_XY_YAW" 2> /dev/null || true
+}
+
+# Echoes the header stamp of AMCL's last published pose in nanoseconds, or nothing.
+amcl_stamp() {
+    curl -s -m 20 "${API_BASE}/apps/amcl/data/amcl_pose" \
+        | jq -e '.data.header.stamp | .sec * 1000000000 + .nanosec' 2> /dev/null || true
+}
+
+# How far AMCL may sit from the simulated pose after restore-normal.sh.
+POSE_TOLERANCE_M=0.2
+POSE_TOLERANCE_RAD=0.2
+
+# Passes when AMCL's last published pose is within the tolerance of the robot's
+# pose in the simulation.
+# Usage: assert_amcl_matches_simulation DESCRIPTION
+assert_amcl_matches_simulation() {
+    local description="$1" sim amcl
+    sim=$(sim_pose)
+    amcl=$(amcl_pose)
+    if [ -z "$sim" ] || [ -z "$amcl" ]; then
+        fail "$description" "could not read a pose: simulation '${sim}', AMCL '${amcl}'"
+    elif jq -e -n --argjson s "$sim" --argjson a "$amcl" \
+            --argjson tm "$POSE_TOLERANCE_M" --argjson tr "$POSE_TOLERANCE_RAD" '
+            (($s.x - $a.x) * ($s.x - $a.x) + ($s.y - $a.y) * ($s.y - $a.y) | sqrt) <= $tm
+            and ((($s.yaw - $a.yaw) | atan2(sin; cos)) | fabs) <= $tr' > /dev/null 2>&1; then
+        pass "$description"
+    else
+        fail "$description" "simulation ${sim}, AMCL ${amcl}, tolerance ${POSE_TOLERANCE_M} m and ${POSE_TOLERANCE_RAD} rad"
+    fi
+}
+
 # --- Preconditions ---
 
 wait_for_gateway 240
@@ -233,8 +293,8 @@ wait_for_gateway 240
 section "Fault reporting is alive"
 
 # Without this, an empty fault list below would be indistinguishable from a
-# detector that never started, and the localization checks would pass by saying
-# nothing.
+# detector that never started, and the check that LOCALIZATION_UNCERTAINTY
+# stays absent would pass by saying nothing.
 if poll_until "/apps/${DETECTOR_APP}" \
     ".[\"x-medkit\"].ros2.node == \"${DETECTOR_NODE}\"" 120; then
     pass "detector app reports ROS node ${DETECTOR_NODE}"
@@ -274,6 +334,249 @@ section "Localization held while driving"
 sleep "$FAULT_SETTLE"
 assert_localization_certain "after the drive"
 
+section "Robot parked away from spawn"
+
+# restore-normal.sh must take the robot's pose from the simulation, not assume
+# the spawn point. The inject starts from a parked pose farther from spawn than
+# the agreement tolerance, so a restore that set the spawn pose fails below.
+PARK_X=-0.5
+PARK_Y=-0.5
+drive_to "$PARK_X" "$PARK_Y" "to park away from spawn"
+PARKED_POSE=$(sim_pose)
+if jq -e -n --argjson p "${PARKED_POSE:-null}" --argjson sx "$SPAWN_X" --argjson sy "$SPAWN_Y" \
+        --argjson tm "$POSE_TOLERANCE_M" \
+        '$p != null and (($p.x - $sx) * ($p.x - $sx) + ($p.y - $sy) * ($p.y - $sy) | sqrt) > $tm' \
+        > /dev/null 2>&1; then
+    pass "parked pose in the simulation is farther than ${POSE_TOLERANCE_M} m from spawn"
+else
+    fail "parked pose in the simulation is farther than ${POSE_TOLERANCE_M} m from spawn" \
+         "simulation '${PARKED_POSE}', spawn (${SPAWN_X}, ${SPAWN_Y})"
+fi
+
+section "Trigger delivers fault events"
+
+# Drive setup-triggers.sh and watch-triggers.sh exactly as a user would, and run
+# the inject command setup-triggers.sh prints, so a hint that stops producing a
+# delivered event fails here.
+TB3_DIR="${SCRIPT_DIR}/../demos/turtlebot3_integration"
+INJECTED_CODE="LOCALIZATION_UNCERTAINTY"
+
+SETUP_OUTPUT=$(cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" bash ./setup-triggers.sh 2>&1) || true
+TRIGGER_ID=$(sed -n 's/^  ID:[[:space:]]*//p' <<< "$SETUP_OUTPUT" | head -1)
+INJECT_CMD=$(sed -n '/^Then inject a fault in another terminal:$/{n;s/^  //p;}' <<< "$SETUP_OUTPUT")
+
+if [ -n "$TRIGGER_ID" ]; then
+    pass "setup-triggers.sh creates a trigger on apps/${DETECTOR_APP}"
+else
+    fail "setup-triggers.sh creates a trigger on apps/${DETECTOR_APP}" "$(tail -5 <<< "$SETUP_OUTPUT")"
+fi
+
+# Prints the fault code of every complete event watch-triggers.sh has logged.
+# Usage: event_fault_codes LOG
+event_fault_codes() {
+    awk '/Event received:$/ { on = 1; buf = ""; next }
+         on && /^---$/ { printf "%s", buf; on = 0; next }
+         on { buf = buf $0 "\n" }' "$1" \
+        | jq -rs '.[].payload.fault_code // empty' 2>/dev/null || true
+}
+
+if [ -n "$TRIGGER_ID" ] && [ -z "$INJECT_CMD" ]; then
+    fail "the hinted inject delivers a ${INJECTED_CODE} event to watch-triggers.sh" \
+         "setup-triggers.sh printed no inject hint"
+elif [ -n "$TRIGGER_ID" ]; then
+    WATCH_LOG=$(mktemp)
+    # exec makes the PID timeout's own; timeout passes a kill on to the whole stream.
+    (cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" exec timeout 60 bash ./watch-triggers.sh "$TRIGGER_ID") \
+        > "$WATCH_LOG" 2>&1 &
+    WATCH_PID=$!
+    sleep 2
+
+    (cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" bash -c "$INJECT_CMD") > /dev/null 2>&1 || true
+
+    elapsed=0
+    while [ "$elapsed" -lt 20 ] && ! grep -qx "$INJECTED_CODE" <<< "$(event_fault_codes "$WATCH_LOG")"; do
+        sleep 1
+        elapsed=$((elapsed + 1))
+    done
+    kill "$WATCH_PID" 2>/dev/null || true
+    wait "$WATCH_PID" 2>/dev/null || true
+
+    EVENT_CODES=$(event_fault_codes "$WATCH_LOG" | sort -u | paste -sd, -)
+    if grep -qx "$INJECTED_CODE" <<< "$(event_fault_codes "$WATCH_LOG")"; then
+        pass "the hinted inject delivers a ${INJECTED_CODE} event to watch-triggers.sh"
+    else
+        fail "the hinted inject delivers a ${INJECTED_CODE} event to watch-triggers.sh" \
+             "ran '${INJECT_CMD}', events carried: ${EVENT_CODES:-none}"
+    fi
+    rm -f "$WATCH_LOG"
+
+    curl -s -o /dev/null -X DELETE "${API_BASE}/apps/${DETECTOR_APP}/triggers/${TRIGGER_ID}" || true
+fi
+
+section "Demo restored after the injected fault"
+
+# Echoes "yes" when LOCALIZATION_UNCERTAINTY is reported as failing at any
+# severity, "no" when it is not, and "error" when the list cannot be read.
+localization_reported() {
+    if ! api_get "/faults?status=all" || ! jq -e '.items' <<< "$RESPONSE" > /dev/null 2>&1; then
+        echo error
+        return
+    fi
+    if jq -e '.items[] | select(.fault_code == "LOCALIZATION_UNCERTAINTY"
+                                and (.status == "CONFIRMED" or .status == "PREFAILED"))' \
+            <<< "$RESPONSE" > /dev/null 2>&1; then
+        echo yes
+    else
+        echo no
+    fi
+}
+
+# The inject leaves AMCL with a uniform particle cloud. restore-normal.sh alone
+# must bring it back to the robot's real pose.
+RESTORE_OUTPUT=$(cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" bash ./restore-normal.sh 2>&1) || true
+if grep -q "^Done\.$" <<< "$RESTORE_OUTPUT"; then
+    pass "restore-normal.sh completes"
+else
+    fail "restore-normal.sh completes" "$(tail -5 <<< "$RESTORE_OUTPUT")"
+fi
+
+# AMCL publishes a pose only when it updates, and the detector judges a
+# published pose at most once every 5 s. An update forced every second for two
+# such intervals makes the detector judge the restored localization. Each
+# update must succeed and publish a pose with a newer stamp, or the window
+# measured nothing.
+DETECTOR_INTERVAL=5
+FORCED_UPDATES=$((2 * DETECTOR_INTERVAL))
+restored_state="no"
+failed_updates=0
+new_poses=0
+last_stamp=$(amcl_stamp)
+for _ in $(seq 1 "$FORCED_UPDATES"); do
+    update_status=$(curl -s -m 10 -o /dev/null -w "%{http_code}" -X POST \
+        "${API_BASE}/apps/amcl/operations/request_nomotion_update/executions" \
+        -H 'Content-Type: application/json' -d '{"parameters":{}}' 2>/dev/null) || update_status="none"
+    [ "$update_status" = "200" ] || failed_updates=$((failed_updates + 1))
+    sleep 1
+    stamp=$(amcl_stamp)
+    if [ -n "$stamp" ] && [ -n "$last_stamp" ] && [ "$stamp" -gt "$last_stamp" ]; then
+        new_poses=$((new_poses + 1))
+    fi
+    [ -z "$stamp" ] || last_stamp="$stamp"
+    restored_state=$(localization_reported)
+    [ "$restored_state" = "no" ] || break
+done
+ABSENT_CHECK="LOCALIZATION_UNCERTAINTY stays absent for ${FORCED_UPDATES}s of forced AMCL updates"
+if [ "$restored_state" = "yes" ]; then
+    fail "$ABSENT_CHECK" "the detector reported it again"
+elif [ "$restored_state" != "no" ]; then
+    fail "$ABSENT_CHECK" "could not read the fault list"
+elif [ "$failed_updates" -ne 0 ]; then
+    fail "$ABSENT_CHECK" "${failed_updates} of ${FORCED_UPDATES} forced updates failed (last status ${update_status})"
+elif [ "$new_poses" -ne "$FORCED_UPDATES" ]; then
+    fail "$ABSENT_CHECK" "AMCL published a new pose after ${new_poses} of ${FORCED_UPDATES} forced updates"
+else
+    pass "$ABSENT_CHECK"
+fi
+
+# A cloud that converged on the wrong place also stops being reported, so compare
+# AMCL's estimate with the robot's pose in the simulation.
+assert_amcl_matches_simulation "AMCL agrees with the simulated pose after restore-normal.sh"
+
+section "Restore-normal reports a refused write"
+
+# Another client's lock on velocity-smoother's configurations makes the gateway
+# refuse restore-normal's max_velocity write with 409. AMCL is scattered again
+# first, so an agreement with the simulation afterwards shows the script still
+# re-localized.
+RESTORE_ENDPOINT="/components/nav2-stack/scripts/restore-normal/executions"
+
+# Runs restore-normal through the Scripts API and prints the execution once it
+# has ended. Returns 1 when it does not end within MAX_WAIT seconds.
+# Usage: run_restore_normal MAX_WAIT
+run_restore_normal() {
+    local exec_id deadline
+    exec_id=$(curl -s -m 30 -X POST "${API_BASE}${RESTORE_ENDPOINT}" \
+        -H "Content-Type: application/json" -d '{"execution_type": "now"}' | jq -r '.id // empty') || exec_id=""
+    [ -n "$exec_id" ] || return 1
+    deadline=$((SECONDS + $1))
+    while [ "$SECONDS" -lt "$deadline" ]; do
+        if api_get "${RESTORE_ENDPOINT}/${exec_id}" \
+            && jq -e '.status | IN("completed", "failed", "terminated")' <<< "$RESPONSE" > /dev/null 2>&1; then
+            echo "$RESPONSE"
+            return 0
+        fi
+        sleep 1
+    done
+    return 1
+}
+
+curl -s -m 20 -o /dev/null -X POST \
+    "${API_BASE}/apps/amcl/operations/reinitialize_global_localization/executions" \
+    -H 'Content-Type: application/json' -d '{"parameters":{}}' || true
+
+LOCK_CLIENT="smoke-test-restore-refused"
+lock_id=$(curl -s -m 30 -X POST "${API_BASE}/apps/velocity-smoother/locks" \
+    -H "X-Client-Id: ${LOCK_CLIENT}" -H "Content-Type: application/json" \
+    -d '{"lock_expiration": 120, "scopes": ["configurations"]}' | jq -r '.id // empty') || lock_id=""
+if [ -n "$lock_id" ]; then
+    pass "another client locks velocity-smoother configurations"
+else
+    fail "another client locks velocity-smoother configurations" "no lock id returned"
+fi
+
+if exec_json=$(run_restore_normal 90); then
+    exec_status=$(jq -r '.status' <<< "$exec_json")
+    exec_message=$(jq -r '.error.message // ""' <<< "$exec_json")
+    if [ "$exec_status" = "failed" ]; then
+        pass "restore-normal fails while its max_velocity write is refused"
+    else
+        fail "restore-normal fails while its max_velocity write is refused" "status: ${exec_status}"
+    fi
+    if grep -qF "FAIL: velocity-smoother/max_velocity" <<< "$exec_message"; then
+        pass "failure message names the refused write velocity-smoother/max_velocity"
+    else
+        fail "failure message names the refused write velocity-smoother/max_velocity" "message: ${exec_message}"
+    fi
+    if grep -qF "controller-server/FollowPath.max_vel_x" <<< "$exec_message"; then
+        fail "failure message does not name controller-server/FollowPath.max_vel_x, which succeeded" \
+             "message: ${exec_message}"
+    else
+        pass "failure message does not name controller-server/FollowPath.max_vel_x, which succeeded"
+    fi
+else
+    fail "restore-normal ends while its max_velocity write is refused" "no end state within 90s"
+fi
+assert_amcl_matches_simulation "AMCL agrees with the simulated pose after a restore with a refused write"
+
+if [ -n "$lock_id" ]; then
+    unlock_status=$(curl -s -m 30 -o /dev/null -w "%{http_code}" -X DELETE \
+        "${API_BASE}/apps/velocity-smoother/locks/${lock_id}" -H "X-Client-Id: ${LOCK_CLIENT}") || true
+    if [ "$unlock_status" = "204" ]; then
+        pass "velocity-smoother lock is released"
+    else
+        fail "velocity-smoother lock is released" "got HTTP ${unlock_status}"
+    fi
+fi
+
+if exec_json=$(run_restore_normal 90) && [ "$(jq -r '.status' <<< "$exec_json")" = "completed" ]; then
+    pass "restore-normal completes once the lock is released"
+else
+    fail "restore-normal completes once the lock is released" \
+         "execution: $(jq -c '{status, error}' <<< "${exec_json:-null}" 2>/dev/null)"
+fi
+
+section "Driving after the restore"
+
+# The second goal returns the robot to the spawn point, where the next run
+# of this script expects it.
+drive_to "$GOAL_A_X" "$GOAL_A_Y" "after the restore"
+drive_to "$GOAL_B_X" "$GOAL_B_Y" "after the restore"
+sleep "$FAULT_SETTLE"
+assert_localization_certain "after the restored drive"
+
+# Clear what the goals above reported, so the next run starts from an empty list.
+curl -s -X DELETE "${API_BASE}/faults" > /dev/null || true
+
 # --- Summary ---
 
 # print_summary runs via EXIT trap; exit code reflects test results
diff --git a/tests/smoke_test_turtlebot3.sh b/tests/smoke_test_turtlebot3.sh
index 54a1fcd..45ad2e0 100755
--- a/tests/smoke_test_turtlebot3.sh
+++ b/tests/smoke_test_turtlebot3.sh
@@ -5,8 +5,10 @@
 # Tests: health, entity discovery (areas/components/apps/functions),
 #   discovery relationships, Linux introspection, data access, operations,
 #   configurations, scripts (list + execution), bulk data, faults, logs,
-#   trigger CRUD lifecycle
-# No fault injection - Gazebo-based demo is too complex for reliable CI fault testing
+#   trigger CRUD lifecycle, check-entities.sh and check-faults.sh with one
+#   injected navigation failure, check-entities.sh with the simulator stopped,
+#   the fault trigger across the navigation failure, check-faults.sh while
+#   /faults answers 503
 #
 # Usage: ./tests/smoke_test_turtlebot3.sh [GATEWAY_URL]
 # Default GATEWAY_URL: http://localhost:8080
@@ -18,7 +20,56 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 # shellcheck source=tests/smoke_lib.sh
 source "${SCRIPT_DIR}/smoke_lib.sh"
 
-trap print_summary EXIT
+DEMO_CONTAINER="${DEMO_CONTAINER:-turtlebot3_medkit_demo_ci}"
+# Anchored so it does not match the bash -c wrapper that runs pgrep.
+FAULT_MANAGER_PATTERN='^/root/demo_ws/install/ros2_medkit_fault_manager/lib/ros2_medkit_fault_manager/fault_manager_node '
+
+# SIGSTOP on the fault manager makes the gateway's ListFaults call time out,
+# so GET /faults answers 503 as it does before the fault manager is up.
+stop_fault_manager() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 1
+        kill -STOP \"\${pid}\"
+    " > /dev/null 2>&1
+}
+
+resume_fault_manager() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pid=\$(pgrep -f '${FAULT_MANAGER_PATTERN}') || exit 0
+        kill -CONT \"\${pid}\"
+    " > /dev/null 2>&1 || true
+}
+
+# The Gazebo server steps the simulation. Stopped, it publishes no sensor data
+# while the ROS bridge and its /scan publisher stay up.
+SIMULATOR_PATTERN='^gz sim '
+
+stop_simulator() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pids=\$(pgrep -f '${SIMULATOR_PATTERN}') || exit 1
+        kill -STOP \${pids}
+    " > /dev/null 2>&1
+}
+
+resume_simulator() {
+    docker exec "${DEMO_CONTAINER}" bash -c "
+        pids=\$(pgrep -f '${SIMULATOR_PATTERN}') || exit 0
+        kill -CONT \${pids}
+    " > /dev/null 2>&1 || true
+}
+
+# print_summary reads the script's exit status from $?, so hand it the status
+# saved on entry. set +e: under errexit `(exit rc)` would end the trap before
+# print_summary runs.
+cleanup_on_exit() {
+    local rc=$?
+    set +e
+    resume_fault_manager
+    resume_simulator
+    (exit "${rc}")
+    print_summary
+}
+trap cleanup_on_exit EXIT
 
 # --- Wait for gateway startup ---
 
@@ -94,10 +145,340 @@ section "Logs"
 
 assert_non_empty_items "/apps/medkit-gateway/logs"
 
+section "Check-Entities and Check-Faults Scripts"
+
+TB3_DIR="${SCRIPT_DIR}/../demos/turtlebot3_integration"
+
+# Echoes a Nav2 node's lifecycle state label, or "unavailable".
+# Usage: lifecycle_label APP
+lifecycle_label() {
+    curl -s -m 20 -X POST "${API_BASE}/apps/$1/operations/get_state/executions" \
+        -H 'Content-Type: application/json' -d '{"parameters":{}}' 2>/dev/null \
+        | jq -r '.parameters.current_state.label // "unavailable"' 2>/dev/null || echo unavailable
+}
+
+# Reports a FAILED fault through the fault manager's report_fault service.
+# Usage: report_fault CODE SOURCE_ID
+report_fault() {
+    curl -s -m 20 -X POST "${API_BASE}/apps/medkit-fault-manager/operations/report_fault/executions" \
+        -H "Content-Type: application/json" \
+        -d "$(jq -nc --arg code "$1" --arg src "$2" '{parameters: {fault_code: $code, event_type: 0,
+            severity: 2, description: "smoke test", source_id: $src}}')" \
+        | jq -e '.parameters.accepted == true' > /dev/null 2>&1
+}
+
+# Prints the fault code of every complete event watch-triggers.sh has logged.
+# Usage: event_fault_codes LOG
+event_fault_codes() {
+    awk '/Event received:$/ { on = 1; buf = ""; next }
+         on && /^---$/ { printf "%s", buf; on = 0; next }
+         on { buf = buf $0 "\n" }' "$1" \
+        | jq -rs '.[].payload.fault_code // empty' 2>/dev/null || true
+}
+
+# Proves watch-triggers.sh live: reports a fault from the anomaly detector's
+# own node path, which fires the trigger, every 2 s until the watcher logs
+# its event (max 20 s). Adds each reported code to PROBE_CODES.
+# Usage: watcher_live PREFIX
+PROBE_CODES=""
+watcher_live() {
+    local n=0 code
+    while [ "$n" -lt 10 ]; do
+        n=$((n + 1))
+        code="${1}_${n}"
+        PROBE_CODES="${PROBE_CODES} ${code}"
+        report_fault "$code" "/bridge/anomaly_detector" || true
+        sleep 2
+        if grep -q "^${1}_" <<< "$(event_fault_codes "$WATCH_LOG")"; then
+            return 0
+        fi
+    done
+    return 1
+}
+
+# The inject needs a goal that Nav2 accepts and then aborts. An inactive
+# navigator rejects the goal and no fault follows. Nav2 activates well after
+# the gateway answers, so wait for the navigator and the planner.
+echo "  Waiting for bt-navigator and planner-server to be active (max 180s)..."
+nav2_state=""
+elapsed=0
+while [ "$elapsed" -lt 180 ]; do
+    nav2_state="$(lifecycle_label bt-navigator)/$(lifecycle_label planner-server)"
+    [ "$nav2_state" = "active/active" ] && break
+    sleep 5
+    elapsed=$((elapsed + 5))
+done
+if [ "$nav2_state" = "active/active" ]; then
+    pass "bt-navigator and planner-server are active before the inject"
+else
+    fail "bt-navigator and planner-server are active before the inject" "states: ${nav2_state}"
+fi
+
+# The README says the trigger setup-triggers.sh creates does not fire for
+# navigation goal faults. Watch it across the inject below as a user would.
+TRIGGER_SETUP_OUTPUT=$(cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" bash ./setup-triggers.sh 2>&1) || true
+TRIGGER_ID=$(awk '/^  ID:/ { sub(/^  ID:[ \t]*/, ""); print; exit }' <<< "$TRIGGER_SETUP_OUTPUT")
+WATCH_LOG=$(mktemp)
+WATCH_PID=""
+WATCH_LIVE_BEFORE=false
+if [ -n "$TRIGGER_ID" ]; then
+    pass "setup: setup-triggers.sh creates a trigger on apps/anomaly-detector"
+    # exec makes the PID timeout's own; timeout passes a kill on to the whole stream.
+    (cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" exec timeout 180 bash ./watch-triggers.sh "$TRIGGER_ID") \
+        > "$WATCH_LOG" 2>&1 &
+    WATCH_PID=$!
+    if watcher_live "SMOKE_TRIGGER_BEFORE"; then
+        WATCH_LIVE_BEFORE=true
+        pass "setup: watch-triggers.sh is live before the navigation inject"
+    else
+        fail "setup: watch-triggers.sh is live before the navigation inject" "no probe event within 20 s"
+    fi
+else
+    fail "setup: setup-triggers.sh creates a trigger on apps/anomaly-detector" \
+        "$(tail -5 <<< "$TRIGGER_SETUP_OUTPUT")"
+fi
+
+# Inject a real fault via the Scripts API so check-entities.sh (section 6)
+# and check-faults.sh exercise the fault-carrying fields, not just the
+# empty case.
+echo "  Injecting navigation failure via Scripts API..."
+INJECT_RESPONSE=$(curl -s -m 30 -X POST "${API_BASE}/components/nav2-stack/scripts/inject-nav-failure/executions" \
+    -H "Content-Type: application/json" -d '{"execution_type": "now"}') || true
+INJECT_EXEC_ID=$(echo "$INJECT_RESPONSE" | jq -r '.id // empty')
+if [ -n "$INJECT_EXEC_ID" ]; then
+    elapsed=0
+    while [ $elapsed -lt 30 ]; do
+        st=$(curl -s "${API_BASE}/components/nav2-stack/scripts/inject-nav-failure/executions/${INJECT_EXEC_ID}" | jq -r '.status')
+        if [ "$st" = "completed" ] || [ "$st" = "failed" ]; then
+            break
+        fi
+        sleep 1
+        elapsed=$((elapsed + 1))
+    done
+fi
+
+echo "  Waiting for NAVIGATION_GOAL_ABORTED fault to appear (max 15s)..."
+if poll_until "/faults" '.items[] | select(.fault_code == "NAVIGATION_GOAL_ABORTED")' 15; then
+    pass "NAVIGATION_GOAL_ABORTED fault appeared in /faults"
+else
+    fail "NAVIGATION_GOAL_ABORTED fault appeared in /faults" "fault not found after 15s"
+fi
+
+# Only a watcher proven live before and after the navigation goal fault can
+# show that the fault fired no event.
+if [ -n "$WATCH_PID" ]; then
+    WATCH_LIVE_AFTER=false
+    if watcher_live "SMOKE_TRIGGER_AFTER"; then
+        WATCH_LIVE_AFTER=true
+        pass "setup: watch-triggers.sh is live after the navigation inject"
+    else
+        fail "setup: watch-triggers.sh is live after the navigation inject" "no probe event within 20 s"
+    fi
+    kill "$WATCH_PID" 2>/dev/null || true
+    wait "$WATCH_PID" 2>/dev/null || true
+    EVENT_CODES=$(event_fault_codes "$WATCH_LOG" | sort -u | paste -sd, -)
+    if [ "$WATCH_LIVE_BEFORE" = true ] && [ "$WATCH_LIVE_AFTER" = true ]; then
+        if grep -qE '^NAVIGATION_GOAL_' <<< "$(event_fault_codes "$WATCH_LOG")"; then
+            fail "watch-triggers.sh gets no event for a navigation goal fault, as the README says" \
+                "events carried: ${EVENT_CODES}"
+        else
+            pass "watch-triggers.sh gets no event for a navigation goal fault, as the README says"
+        fi
+    else
+        fail "watch-triggers.sh gets no event for a navigation goal fault, as the README says" \
+            "not checked: the watcher was not live before and after the inject; events carried: ${EVENT_CODES:-none}"
+    fi
+    curl -s -m 20 -o /dev/null -X DELETE "${API_BASE}/apps/anomaly-detector/triggers/${TRIGGER_ID}" || true
+    for code in $PROBE_CODES; do
+        curl -s -m 20 -o /dev/null -X DELETE "${API_BASE}/apps/anomaly-detector/faults/${code}" || true
+    done
+fi
+rm -f "$WATCH_LOG"
+
+# Prints the JSON values printed in section N of a script output as one array:
+# [] when the section is missing, nothing when it is not JSON. Text after the
+# section's last closing bracket, such as a script's closing lines, is dropped.
+# Usage: script_section OUTPUT N
+script_section() {
+    awk -v hdr="^=== $2\\\\. " '
+        $0 ~ hdr { on = 1; next }
+        on && /^=== [0-9]+\. / { exit }
+        on { lines[++n] = $0; if ($0 ~ /^[]}]/) last = n }
+        END { for (i = 1; i <= last; i++) print lines[i] }' <<< "$1" \
+        | sed -n '/^[[{]/,$p' | jq -s '.' 2>/dev/null || true
+}
+
+# Prints the fault list as the scripts show it, normalised by FILTER.
+# Usage: api_faults FILTER
+api_faults() {
+    curl -s -m 20 "${API_BASE}/faults" | jq -c "[.items[] | $1] | sort_by(.code)" 2>/dev/null || true
+}
+
+# Passes when PRINTED is non-empty and equals EXPECTED or ALTERNATIVE.
+# Usage: assert_printed_matches DESCRIPTION PRINTED EXPECTED [ALTERNATIVE]
+assert_printed_matches() {
+    local description="$1" printed="$2" expected="$3" alternative="${4:-}"
+    if [ -n "$printed" ] && { [ "$printed" = "$expected" ] || [ "$printed" = "$alternative" ]; }; then
+        pass "$description"
+    else
+        fail "$description" "printed ${printed:-nothing}; API ${expected:-unreadable}"
+    fi
+}
+
+# The fault list can change while a script runs, so it is read before and
+# after; the printed faults must equal one of the two reads.
+ENTITY_FAULT_FIELDS='{code: .fault_code, severity: .severity_label, sources: .reporting_sources}'
+FAULT_FIELDS='{code: .fault_code, severity: .severity_label, status: .status,
+    sources: .reporting_sources, occurrences: .occurrence_count}'
+
+# check-entities.sh without LiDAR data. The gateway keeps the last message of
+# a topic it has read, and nothing above reads /scan, so with the simulator
+# stopped the scan read has no message.
+if stop_simulator; then
+    # An error body also lacks .data, so only a successful read counts.
+    if api_get "/apps/turtlebot3-node/data/scan" \
+        && jq -e '.data | type == "object" and length == 0' <<< "$RESPONSE" > /dev/null 2>&1; then
+        pass "setup: the /scan read succeeds and has no message while the simulator is stopped"
+    else
+        fail "setup: the /scan read succeeds and has no message while the simulator is stopped" \
+            "$(head -c 200 <<< "$RESPONSE")"
+    fi
+    NO_SCAN_PLAIN=$(cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" timeout 120 bash ./check-entities.sh < /dev/null 2>&1 \
+        | sed 's/\x1b\[[0-9;]*m//g') || true
+    resume_simulator
+    if grep -q ': null' <<< "$NO_SCAN_PLAIN"; then
+        fail "check-entities.sh prints no null fields without LiDAR data" \
+            "$(grep -B1 ': null' <<< "$NO_SCAN_PLAIN" | head -10)"
+    else
+        pass "check-entities.sh prints no null fields without LiDAR data"
+    fi
+    if [ "$(script_section "$NO_SCAN_PLAIN" 5 | jq -c '.' 2>/dev/null)" = "[]" ] \
+        && grep -q "LiDAR data not available" <<< "$NO_SCAN_PLAIN"; then
+        pass "check-entities.sh prints the LiDAR hint without LiDAR data"
+    else
+        fail "check-entities.sh prints the LiDAR hint without LiDAR data" \
+            "section 5: $(awk '/^=== 5\. /{on=1;next} /^=== 6\. /{exit} on' <<< "$NO_SCAN_PLAIN" | tr '\n' ';' | head -c 300)"
+    fi
+    if poll_until "/apps/turtlebot3-node/data/scan" '.data | length > 0' 30; then
+        pass "setup: /scan has data again after the simulator resumes"
+    else
+        fail "setup: /scan has data again after the simulator resumes" "no scan data after 30 s"
+    fi
+else
+    fail "setup: simulator stopped" "no gz sim process in ${DEMO_CONTAINER}"
+fi
+
+ENTITY_FAULTS_BEFORE=$(api_faults "$ENTITY_FAULT_FIELDS")
+CHECK_ENTITIES_PLAIN=$(cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" bash ./check-entities.sh 2>&1 \
+    | sed 's/\x1b\[[0-9;]*m//g') || true
+ENTITY_FAULTS_AFTER=$(api_faults "$ENTITY_FAULT_FIELDS")
+
+if grep -q ': null' <<< "$CHECK_ENTITIES_PLAIN"; then
+    fail "check-entities.sh prints no null fields" "$(grep -B1 ': null' <<< "$CHECK_ENTITIES_PLAIN" | head -10)"
+else
+    pass "check-entities.sh prints no null fields"
+fi
+
+# The scan's angle and range limits are fixed by the LiDAR model, so the
+# printed ones must equal a direct read. Ranges past range_max are inf, which
+# JSON carries as null, so only the count of sample ranges is checked.
+SCAN_DIRECT=$(curl -s -m 20 "${API_BASE}/apps/turtlebot3-node/data/scan" | jq -c '.data' 2>/dev/null) || true
+if script_section "$CHECK_ENTITIES_PLAIN" 5 | jq -e --argjson g "${SCAN_DIRECT:-null}" 'length == 1 and (.[0] as $p
+        | ([$p.angle_min, $p.angle_max, $p.range_min, $p.range_max] | all(type == "number"))
+        and $p.angle_min == $g.angle_min and $p.angle_max == $g.angle_max
+        and $p.range_min == $g.range_min and $p.range_max == $g.range_max
+        and ($p.sample_ranges | type == "array" and length == 5))' > /dev/null 2>&1; then
+    pass "check-entities.sh section 5 shows the scan's values"
+else
+    fail "check-entities.sh section 5 shows the scan's values" \
+        "printed $(script_section "$CHECK_ENTITIES_PLAIN" 5 | jq -c '.' 2>/dev/null | head -c 200); direct ${SCAN_DIRECT:0:200}"
+fi
+
+if grep -q "NAVIGATION_GOAL_ABORTED" <<< "$CHECK_ENTITIES_PLAIN"; then
+    pass "check-entities.sh faults section shows the active fault code"
+else
+    fail "check-entities.sh faults section shows the active fault code" "NAVIGATION_GOAL_ABORTED not in output"
+fi
+
+assert_printed_matches "check-entities.sh lists every component id" \
+    "$(script_section "$CHECK_ENTITIES_PLAIN" 2 | jq -c '[.[].id] | sort' 2>/dev/null)" \
+    "$(curl -s -m 20 "${API_BASE}/components" | jq -c '[.items[].id] | sort' 2>/dev/null)"
+
+assert_printed_matches "check-entities.sh shows each app with its component" \
+    "$(script_section "$CHECK_ENTITIES_PLAIN" 3 | jq -c 'map({id, component}) | sort_by(.id)' 2>/dev/null)" \
+    "$(curl -s -m 20 "${API_BASE}/apps" \
+        | jq -c '[.items[] | {id, component: .["x-medkit"].component_id}] | sort_by(.id)' 2>/dev/null)"
+
+assert_printed_matches "check-entities.sh shows every active fault with its severity and sources" \
+    "$(script_section "$CHECK_ENTITIES_PLAIN" 6 | jq -c 'map({code, severity, sources}) | sort_by(.code)' 2>/dev/null)" \
+    "$ENTITY_FAULTS_BEFORE" "$ENTITY_FAULTS_AFTER"
+
+FAULTS_BEFORE=$(api_faults "$FAULT_FIELDS")
+CHECK_FAULTS_PLAIN=$(cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" bash ./check-faults.sh 2>&1 \
+    | sed 's/\x1b\[[0-9;]*m//g') || true
+FAULTS_AFTER=$(api_faults "$FAULT_FIELDS")
+
+if grep -q ': null' <<< "$CHECK_FAULTS_PLAIN"; then
+    fail "check-faults.sh prints no null fields" "$(grep -B1 ': null' <<< "$CHECK_FAULTS_PLAIN" | head -10)"
+else
+    pass "check-faults.sh prints no null fields"
+fi
+
+if grep -q "NAVIGATION_GOAL_ABORTED" <<< "$CHECK_FAULTS_PLAIN"; then
+    pass "check-faults.sh shows the active fault code"
+else
+    fail "check-faults.sh shows the active fault code" "NAVIGATION_GOAL_ABORTED not in output"
+fi
+
+# check-faults.sh prints the faults between its "Active Faults:" and
+# "Fault Summary:" lines.
+assert_printed_matches "check-faults.sh shows every active fault with its severity, status, sources and count" \
+    "$(awk '/Active Faults:$/ { on = 1; next } /Fault Summary:$/ { exit } on' <<< "$CHECK_FAULTS_PLAIN" \
+        | sed -n '/^[[{]/,$p' | jq -cs 'map({code, severity, status, sources, occurrences}) | sort_by(.code)' 2>/dev/null)" \
+    "$FAULTS_BEFORE" "$FAULTS_AFTER"
+
+# Cleanup: clear all faults so smoke_test_navigation.sh (run next on this
+# stack) does not inherit a latched fault confirmation.
+echo "  Cleaning up: clearing faults..."
+curl -s -X DELETE "${API_BASE}/faults" > /dev/null || true
+
 section "Triggers"
 
 assert_triggers_crud "apps" "diagnostic-bridge" "/api/v1/apps/diagnostic-bridge/faults"
 
+section "check-faults.sh: a failed fault read is not reported as no faults"
+
+FAILED_READ_LOG=$(mktemp)
+if stop_fault_manager; then
+    if api_get "/faults" 503; then
+        pass "setup: GET /faults answers 503 while the fault manager is stopped"
+    else
+        fail "setup: GET /faults answers 503 while the fault manager is stopped" "got: $(head -c 200 <<< "${RESPONSE}")"
+    fi
+    if (cd "$TB3_DIR" && GATEWAY_URL="$GATEWAY_URL" timeout 120 bash ./check-faults.sh) < /dev/null \
+            > "$FAILED_READ_LOG" 2>&1; then
+        FAILED_READ_RC=0
+    else
+        FAILED_READ_RC=$?
+    fi
+    resume_fault_manager
+    if [ "$FAILED_READ_RC" -ne 0 ] && grep -q 'Could not read faults .*(HTTP 503)' "$FAILED_READ_LOG" \
+        && ! grep -qE 'No active faults|Total active faults' "$FAILED_READ_LOG"; then
+        pass "check-faults.sh exits non-zero on HTTP 503 and does not claim a fault count"
+    else
+        fail "check-faults.sh exits non-zero on HTTP 503 and does not claim a fault count" \
+            "rc=${FAILED_READ_RC}; output: $(grep -vE '^ *$' "$FAILED_READ_LOG" | tail -n 6 | tr '\n' ';')"
+    fi
+    if poll_until "/faults" '.items | arrays' 30; then
+        pass "setup: GET /faults answers again after the fault manager resumes"
+    else
+        fail "setup: GET /faults answers again after the fault manager resumes" "still failing after 30 s"
+    fi
+else
+    fail "setup: fault manager stopped" "no fault_manager_node process in ${DEMO_CONTAINER}"
+fi
+rm -f "$FAILED_READ_LOG"
+
 # --- Summary ---
 
 # print_summary runs via EXIT trap; exit code reflects test results