flowchart LR
    SAM["Sam<br/>browser dashboard"]
    ADMIN["Admin app<br/>kotlin_phone_app_admin"]
    HUB["Hub :8788<br/>read-only /ask"]
    CADDY["Caddy on .35<br/>webrestrict.lab.audasmedia.com.au"]
    CS["Control Service<br/>Go + SQLite :8791"]
    APPRISE["Apprise :8210<br/>alerts + tamper reports"]

    subgraph MQ["Mosquitto on .13 - two planes"]
        TLS["8883 TLS<br/>per-device creds + topic ACLs"]
        PLAIN["1883 plain + anonymous"]
    end

    PHONE["Kids' Android client<br/>Kotlin, Accessibility + overlay"]
    OTHER["Other house consumers"]

    SAM -->|HTTPS| CADDY
    CADDY --> CS
    ADMIN -->|"Bearer token /api/v1"| CS
    HUB -->|"Bearer token /ask"| CS
    CS -->|"retained config"| TLS
    TLS -->|"own config topic"| PHONE
    PHONE -->|"status + telemetry"| TLS
    TLS -->|reports| CS
    CS --> APPRISE
    PLAIN -.->|legacy| OTHER

    click CS "https://maps.lab.audasmedia.com.au/internet_use_control/docs/" "View Archify map"
    click TLS "https://maps.lab.audasmedia.com.au/internet_use_control/docs/" "View Archify map"