Phase 7: eliminate shims - consumer files use component headers directly

- Deleted standalone shims: session.c/h, cashu.c/h, mining_payment.c/h, firewall.c/h
- Updated captive_portal.c, tollgate_api.c, tollgate_main.c, mcp_handler.c,
  cvm_server.c, sw_miner.c, stratum_client.c to include component headers
- Moved tollgate_ip4_canforward_filter() lwIP hook into tollgate_main.c
- Fixed all unit tests to use component API (test_cashu, test_session,
  test_mining_payment, test_stratum_proxy, test_session_payment_method,
  test_firewall_sandbox, test_mcp_handler)
- Removed deleted source files from Makefile targets
- All 21 unit tests pass, ESP-IDF build passes

28 files changed, 246 insertions, 690 deletions

diff --git a/main/CMakeLists.txt b/main/CMakeLists.txt
index 3a8613d..1f127c0 100644
--- a/main/CMakeLists.txt
+++ b/main/CMakeLists.txt
@@ -2,9 +2,6 @@ idf_component_register(SRCS "tollgate_main.c"
                             "config.c"
                             "dns_server.c"
                             "captive_portal.c"
-                            "firewall.c"
-                            "cashu.c"
-                            "session.c"
                             "tollgate_api.c"
                             "identity.c"
                             "nostr_event.c"
@@ -26,7 +23,6 @@ idf_component_register(SRCS "tollgate_main.c"
                             "beacon_price.c"
                             "market.c"
                             "negentropy_adapter.c"
-                            "mining_payment.c"
                             "stratum_client.c"
                             "stratum_proxy.c"
                             "sw_miner.c"
diff --git a/main/captive_portal.c b/main/captive_portal.c
index 9a0a5ff..f95a791 100644
--- a/main/captive_portal.c
+++ b/main/captive_portal.c
@@ -1,8 +1,8 @@
 #include "captive_portal.h"
-#include "firewall.h"
-#include "session.h"
+#include "tollgate_core.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_session.h"
 #include "config.h"
-#include "mining_payment.h"
 #include "stratum_proxy.h"
 #include "esp_log.h"
 #include "esp_wifi.h"
@@ -253,7 +253,7 @@ static esp_err_t grant_access_handler(httpd_req_t *req)
 {
     uint32_t client_ip;
     if (get_client_ip(req, &client_ip) == ESP_OK) {
-        firewall_grant_access(client_ip);
+        tollgate_core_fw_grant(client_ip);
     }
     const char *resp = "{\"status\":\"granted\"}";
     httpd_resp_set_type(req, "application/json");
@@ -282,7 +282,7 @@ static esp_err_t whoami_handler(httpd_req_t *req)
     if (get_client_ip(req, &client_ip) == ESP_OK) {
         char mac[18] = {0};
         esp_ip4_addr_t ip = { .addr = client_ip };
-        if (firewall_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
+        if (tollgate_core_fw_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=%s", IP2STR(&ip), mac);
         } else {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=unknown", IP2STR(&ip));
@@ -304,7 +304,7 @@ static esp_err_t usage_handler(httpd_req_t *req)
         return ESP_OK;
     }
 
-    session_t *session = session_find_by_ip(client_ip);
+    tg_session_t *session = tollgate_core_session_find_by_ip(client_ip);
     if (!session || !session->active) {
         httpd_resp_set_type(req, "text/plain");
         httpd_resp_send(req, "-1/-1", 5);
@@ -332,8 +332,8 @@ static esp_err_t usage_handler(httpd_req_t *req)
 
 static esp_err_t reset_auth_handler(httpd_req_t *req)
 {
-    session_revoke_all();
-    firewall_revoke_all();
+    tollgate_core_session_revoke_all();
+    tollgate_core_fw_revoke_all();
     const char *resp = "{\"status\":\"reset\"}";
     httpd_resp_set_type(req, "application/json");
     httpd_resp_send(req, resp, strlen(resp));
diff --git a/main/cashu.c b/main/cashu.c
deleted file mode 100644
index 2da6a05..0000000
--- a/main/cashu.c
+++ /dev/null
@@ -1,44 +0,0 @@
-#include "cashu.h"
-#include "tollgate_core_cashu.h"
-#include "tollgate_core.h"
-#include "config.h"
-#include "esp_log.h"
-
-static const char *TAG = "cashu";
-
-esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out)
-{
-    return tollgate_core_cashu_decode_token(token_str, (tg_cashu_token_t *)out);
-}
-
-esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
-                                   cashu_proof_state_t *states, int *state_count)
-{
-    return tollgate_core_cashu_check_proof_states(mint_url, (const tg_cashu_token_t *)token,
-                                                   (tg_cashu_proof_state_t *)states, state_count);
-}
-
-uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
-                                       uint64_t step_size_ms)
-{
-    return tollgate_core_cashu_calculate_allotment(token_amount, price_per_step, step_size_ms);
-}
-
-uint64_t cashu_calculate_allotment(uint64_t token_amount, uint64_t price_per_step,
-                                    const char *metric, uint64_t step_size)
-{
-    (void)metric;
-    return tollgate_core_cashu_calculate_allotment(token_amount, price_per_step, step_size);
-}
-
-bool cashu_is_mint_accepted(const char *mint_url)
-{
-    const tollgate_config_t *cfg = tollgate_config_get();
-    if (cfg) {
-        for (int i = 0; i < cfg->accepted_mint_count; i++) {
-            if (tollgate_core_cashu_is_mint_accepted(mint_url, cfg->accepted_mints[i]))
-                return true;
-        }
-    }
-    return false;
-}
diff --git a/main/cashu.h b/main/cashu.h
deleted file mode 100644
index 43be033..0000000
--- a/main/cashu.h
+++ /dev/null
@@ -1,41 +0,0 @@
-#ifndef CASHU_H
-#define CASHU_H
-
-#include "esp_err.h"
-#include <stdint.h>
-#include <stdbool.h>
-
-#define CASHU_MAX_PROOFS      10
-#define CASHU_MAX_SECRET_LEN  128
-#define CASHU_MAX_ID_LEN      68
-#define CASHU_MAX_C_LEN       128
-
-typedef struct {
-    uint64_t amount;
-    char id[CASHU_MAX_ID_LEN];
-    char secret[CASHU_MAX_SECRET_LEN];
-    char c[CASHU_MAX_C_LEN];
-} cashu_proof_t;
-
-typedef struct {
-    cashu_proof_t proofs[CASHU_MAX_PROOFS];
-    int proof_count;
-    char mint_url[256];
-    uint64_t total_amount;
-} cashu_token_t;
-
-typedef struct {
-    char y_hex[65];
-    bool spent;
-} cashu_proof_state_t;
-
-esp_err_t cashu_decode_token(const char *token_str, cashu_token_t *out);
-esp_err_t cashu_check_proof_states(const char *mint_url, const cashu_token_t *token,
-                                   cashu_proof_state_t *states, int *state_count);
-uint64_t cashu_calculate_allotment_ms(uint64_t token_amount, uint64_t price_per_step,
-                                       uint64_t step_size_ms);
-uint64_t cashu_calculate_allotment(uint64_t token_amount, uint64_t price_per_step,
-                                    const char *metric, uint64_t step_size);
-bool cashu_is_mint_accepted(const char *mint_url);
-
-#endif
diff --git a/main/cvm_server.c b/main/cvm_server.c
index 1ac5cb6..5f59a77 100644
--- a/main/cvm_server.c
+++ b/main/cvm_server.c
@@ -4,7 +4,7 @@
 #include "identity.h"
 #include "nostr_event.h"
 #include "config.h"
-#include "session.h"
+#include "tollgate_core_session.h"
 #include "nucula_wallet.h"
 #include "cJSON.h"
 #include "esp_log.h"
diff --git a/main/firewall.c b/main/firewall.c
deleted file mode 100644
index 5ffdee0..0000000
--- a/main/firewall.c
+++ /dev/null
@@ -1,66 +0,0 @@
-#include "firewall.h"
-#include "tollgate_core.h"
-#include "tollgate_core_firewall.h"
-#include "esp_log.h"
-#include "lwip/prot/ip4.h"
-#include <string.h>
-
-static const char *TAG = "firewall";
-static esp_ip4_addr_t s_ap_ip;
-
-esp_err_t firewall_init(esp_ip4_addr_t ap_ip)
-{
-    s_ap_ip = ap_ip;
-    ESP_LOGI(TAG, "Firewall initialized with AP IP=" IPSTR, IP2STR(&s_ap_ip));
-    return ESP_OK;
-}
-
-void firewall_set_mining_port(uint16_t port)
-{
-    tollgate_core_fw_set_sandbox_ports(port);
-}
-
-void firewall_set_sandbox_mint_access(bool enabled)
-{
-    tollgate_core_fw_set_sandbox_mint_access(enabled);
-}
-
-esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size)
-{
-    return tollgate_core_fw_get_mac_for_ip(client_ip, mac_out, mac_out_size);
-}
-
-int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
-{
-    return tollgate_core_ip4_canforward_filter(p, dest_addr_hostorder);
-}
-
-void firewall_grant_access(uint32_t client_ip)
-{
-    tollgate_core_fw_grant(client_ip);
-}
-
-void firewall_revoke_access(uint32_t client_ip)
-{
-    tollgate_core_fw_revoke(client_ip);
-}
-
-void firewall_revoke_all(void)
-{
-    tollgate_core_fw_revoke_all();
-}
-
-bool firewall_is_client_allowed(uint32_t client_ip)
-{
-    return tollgate_core_is_client_allowed(client_ip);
-}
-
-bool firewall_is_mac_allowed(const char *mac)
-{
-    return tollgate_core_fw_is_mac_allowed(mac);
-}
-
-int firewall_client_count(void)
-{
-    return tollgate_core_allowed_client_count();
-}
diff --git a/main/firewall.h b/main/firewall.h
deleted file mode 100644
index 8d6e1c1..0000000
--- a/main/firewall.h
+++ /dev/null
@@ -1,26 +0,0 @@
-#ifndef FIREWALL_H
-#define FIREWALL_H
-
-#include "esp_err.h"
-#include "esp_netif.h"
-#include <stdbool.h>
-#include <stdint.h>
-
-struct pbuf;
-
-#define FW_MAX_MAC_LEN 18
-
-esp_err_t firewall_init(esp_ip4_addr_t ap_ip);
-void firewall_set_mining_port(uint16_t port);
-void firewall_set_sandbox_mint_access(bool enabled);
-void firewall_grant_access(uint32_t client_ip);
-void firewall_revoke_access(uint32_t client_ip);
-void firewall_revoke_all(void);
-bool firewall_is_client_allowed(uint32_t client_ip);
-bool firewall_is_mac_allowed(const char *mac);
-int firewall_client_count(void);
-esp_err_t firewall_get_mac_for_ip(uint32_t client_ip, char *mac_out, size_t mac_out_size);
-
-int tollgate_ip4_canforward_filter(struct pbuf *p, uint32_t dest_addr_hostorder);
-
-#endif
diff --git a/main/mcp_handler.c b/main/mcp_handler.c
index 93bfba9..5f5d494 100644
--- a/main/mcp_handler.c
+++ b/main/mcp_handler.c
@@ -1,7 +1,8 @@
 #include "mcp_handler.h"
 #include "config.h"
 #include "nucula_wallet.h"
-#include "session.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core.h"
 #include "cJSON.h"
 #include "lwip/ip4_addr.h"
 #include <string.h>
@@ -157,12 +158,10 @@ mcp_response_t mcp_handle_wallet_send(const char *params_json)
 mcp_response_t mcp_handle_get_sessions(void)
 {
     mcp_response_t resp = {0};
-    extern session_t *cvm_get_sessions_array(void);
-    extern int cvm_get_sessions_count(void);
 
     cJSON *arr = cJSON_CreateArray();
-    int count = cvm_get_sessions_count();
-    session_t *sessions = cvm_get_sessions_array();
+    int count = tollgate_core_session_get_array_size();
+    tg_session_t *sessions = tollgate_core_session_get_array();
 
     if (sessions && count > 0) {
         for (int i = 0; i < count; i++) {
diff --git a/main/mining_payment.c b/main/mining_payment.c
deleted file mode 100644
index f9d01b6..0000000
--- a/main/mining_payment.c
+++ /dev/null
@@ -1,66 +0,0 @@
-#include "mining_payment.h"
-#include "tollgate_core_mining.h"
-#include "tollgate_core.h"
-#include "esp_log.h"
-
-static const char *TAG = "mining_payment";
-
-uint64_t mining_nbits_to_difficulty(uint32_t nbits)
-{
-    return tollgate_core_mining_nbits_to_difficulty(nbits);
-}
-
-double mining_calculate_hashprice(uint32_t nbits)
-{
-    return tollgate_core_mining_calc_hashprice(nbits);
-}
-
-double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day)
-{
-    return tollgate_core_mining_calc_hashprice_override(sats_per_ghs_day);
-}
-
-esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len)
-{
-    return tollgate_core_mining_validate_share(header80, nonce, target, target_len);
-}
-
-uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_ms)
-{
-    return tollgate_core_mining_shares_to_allotment_ms(hashrate_ghs, hashprice_sats_per_ghs_s, price_per_step, step_size_ms);
-}
-
-uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_bytes)
-{
-    return tollgate_core_mining_shares_to_allotment_bytes(hashrate_ghs, hashprice_sats_per_ghs_s, price_per_step, step_size_bytes);
-}
-
-mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip)
-{
-    return (mining_client_stats_t *)tollgate_core_mining_get_or_create_client(client_ip);
-}
-
-void mining_update_hashrate(uint32_t client_ip, bool accepted)
-{
-    tollgate_core_mining_update_hashrate(client_ip, accepted);
-}
-
-const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip)
-{
-    return (const mining_client_stats_t *)tollgate_core_mining_get_client_stats(client_ip);
-}
-
-double mining_get_current_hashprice(void)
-{
-    return tollgate_core_mining_get_current_hashprice();
-}
-
-void mining_set_current_nbits(uint32_t nbits)
-{
-    tollgate_core_mining_set_current_nbits(nbits);
-}
-
-void mining_payment_init(void)
-{
-    ESP_LOGI(TAG, "Mining payment initialized (via tollgate_core)");
-}
diff --git a/main/mining_payment.h b/main/mining_payment.h
deleted file mode 100644
index c5ce0f2..0000000
--- a/main/mining_payment.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#ifndef MINING_PAYMENT_H
-#define MINING_PAYMENT_H
-
-#include "esp_err.h"
-#include <stdint.h>
-#include <stdbool.h>
-
-#define MINING_SHARE_WINDOW_S 30
-#define MINING_BLOCK_SUBSIDY_SATS 312500000ULL
-#define MINING_BLOCKS_PER_DAY 144ULL
-#define MINING_MAX_CLIENTS 10
-
-typedef struct {
-    uint32_t ip;
-    uint64_t shares_accepted;
-    uint64_t shares_rejected;
-    int64_t first_share_time_ms;
-    int64_t last_share_time_ms;
-    double hashrate_ghs;
-} mining_client_stats_t;
-
-uint64_t mining_nbits_to_difficulty(uint32_t nbits);
-double mining_calculate_hashprice(uint32_t nbits);
-double mining_calculate_hashprice_override(uint64_t sats_per_ghs_day);
-esp_err_t mining_validate_share(const uint8_t *header80, uint32_t nonce, const uint8_t *target, int target_len);
-uint64_t mining_shares_to_allotment_ms(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_ms);
-uint64_t mining_shares_to_allotment_bytes(double hashrate_ghs, double hashprice_sats_per_ghs_s, int price_per_step, int step_size_bytes);
-mining_client_stats_t *mining_get_or_create_client(uint32_t client_ip);
-void mining_update_hashrate(uint32_t client_ip, bool accepted);
-const mining_client_stats_t *mining_get_client_stats(uint32_t client_ip);
-double mining_get_current_hashprice(void);
-void mining_set_current_nbits(uint32_t nbits);
-void mining_payment_init(void);
-
-#endif
diff --git a/main/session.c b/main/session.c
deleted file mode 100644
index 3e3813a..0000000
--- a/main/session.c
+++ /dev/null
@@ -1,86 +0,0 @@
-#include "session.h"
-#include "tollgate_core_session.h"
-#include "tollgate_core_firewall.h"
-#include "tollgate_core.h"
-#include "esp_log.h"
-#include "freertos/FreeRTOS.h"
-#include "freertos/task.h"
-#include <string.h>
-
-static const char *TAG = "session";
-
-esp_err_t session_manager_init(void)
-{
-    tollgate_core_session_init();
-    ESP_LOGI(TAG, "Session manager initialized (via tollgate_core)");
-    return ESP_OK;
-}
-
-session_t *session_create(uint32_t client_ip, uint64_t allotment_ms)
-{
-    return (session_t *)tollgate_core_session_create(client_ip, allotment_ms);
-}
-
-session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes)
-{
-    return (session_t *)tollgate_core_session_create_bytes(client_ip, allotment_bytes);
-}
-
-void session_add_bytes(uint32_t client_ip, uint64_t bytes)
-{
-    tollgate_core_session_add_bytes(client_ip, bytes);
-}
-
-session_t *session_find_by_ip(uint32_t client_ip)
-{
-    return (session_t *)tollgate_core_session_find_by_ip(client_ip);
-}
-
-session_t *session_find_by_mac(const char *mac)
-{
-    return (session_t *)tollgate_core_session_find_by_mac(mac);
-}
-
-void session_extend(session_t *session, uint64_t additional_ms)
-{
-    tollgate_core_session_extend((tg_session_t *)session, additional_ms);
-}
-
-bool session_is_expired(const session_t *session)
-{
-    return tollgate_core_session_is_expired((const tg_session_t *)session);
-}
-
-void session_check_expiry(void)
-{
-}
-
-void session_revoke(session_t *session)
-{
-    tollgate_core_session_revoke((tg_session_t *)session);
-}
-
-void session_revoke_all(void)
-{
-    tollgate_core_session_revoke_all();
-}
-
-int session_active_count(void)
-{
-    return tollgate_core_active_session_count();
-}
-
-void session_tick(void)
-{
-    tollgate_core_tick();
-}
-
-session_t *cvm_get_sessions_array(void)
-{
-    return (session_t *)tollgate_core_session_get_array();
-}
-
-int cvm_get_sessions_count(void)
-{
-    return tollgate_core_session_get_array_size();
-}
diff --git a/main/session.h b/main/session.h
deleted file mode 100644
index 8f6b991..0000000
--- a/main/session.h
+++ /dev/null
@@ -1,44 +0,0 @@
-#ifndef SESSION_H
-#define SESSION_H
-
-#include "esp_err.h"
-#include <stdint.h>
-#include <stdbool.h>
-
-#define SESSION_MAX_CLIENTS     10
-#define SESSION_MAX_MAC_LEN     18
-
-typedef enum {
-    PAYMENT_METHOD_CASHU,
-    PAYMENT_METHOD_MINING,
-    PAYMENT_METHOD_BYTES
-} payment_method_t;
-
-typedef struct {
-    uint32_t client_ip;
-    char mac[SESSION_MAX_MAC_LEN];
-    uint64_t allotment_ms;
-    int64_t start_time_ms;
-    uint64_t allotment_bytes;
-    uint64_t bytes_consumed;
-    payment_method_t payment_method;
-    bool active;
-} session_t;
-
-esp_err_t session_manager_init(void);
-session_t *session_create(uint32_t client_ip, uint64_t allotment_ms);
-session_t *session_create_bytes(uint32_t client_ip, uint64_t allotment_bytes);
-void session_add_bytes(uint32_t client_ip, uint64_t bytes);
-session_t *session_find_by_ip(uint32_t client_ip);
-session_t *session_find_by_mac(const char *mac);
-void session_extend(session_t *session, uint64_t additional_ms);
-bool session_is_expired(const session_t *session);
-void session_check_expiry(void);
-void session_revoke(session_t *session);
-void session_revoke_all(void);
-int session_active_count(void);
-void session_tick(void);
-session_t *cvm_get_sessions_array(void);
-int cvm_get_sessions_count(void);
-
-#endif
diff --git a/main/stratum_client.c b/main/stratum_client.c
index cf88daf..a308a5b 100644
--- a/main/stratum_client.c
+++ b/main/stratum_client.c
@@ -1,6 +1,6 @@
 #include "stratum_client.h"
 #include "stratum_proxy.h"
-#include "mining_payment.h"
+#include "tollgate_core_mining.h"
 #include "config.h"
 #include "esp_log.h"
 #include "esp_transport.h"
@@ -124,7 +124,7 @@ static void handle_mining_notify(cJSON *params)
     memset(job.target, 0xFF, 32);
     job.target_len = 32;
 
-    mining_set_current_nbits(job.nbits);
+    tollgate_core_mining_set_current_nbits(job.nbits);
     stratum_proxy_set_job(&job);
 
     ESP_LOGI(TAG, "New mining job: id=%lu, nbits=0x%08lx", (unsigned long)job.job_id, (unsigned long)job.nbits);
diff --git a/main/sw_miner.c b/main/sw_miner.c
index cdd98a0..9d7ea36 100644
--- a/main/sw_miner.c
+++ b/main/sw_miner.c
@@ -1,7 +1,7 @@
 #include "sw_miner.h"
 #include "stratum_proxy.h"
 #include "stratum_client.h"
-#include "mining_payment.h"
+#include "tollgate_core_mining.h"
 #include "config.h"
 #include "esp_log.h"
 #include "esp_random.h"
@@ -60,7 +60,7 @@ static void sw_miner_task(void *arg)
             if (memcmp(hash, local_job.target, local_job.target_len) <= 0) {
                 ESP_LOGI(TAG, "Valid share found! nonce=%08lx", (unsigned long)nonce);
                 stratum_client_submit_share(local_job.job_id, nonce, local_job.ntime, local_job.version);
-                mining_update_hashrate(0, true);
+                tollgate_core_mining_update_hashrate(0, true);
                 break;
             }
         }
diff --git a/main/tollgate_api.c b/main/tollgate_api.c
index 4e9de43..58c123c 100644
--- a/main/tollgate_api.c
+++ b/main/tollgate_api.c
@@ -1,16 +1,18 @@
 #include "tollgate_api.h"
-#include "cashu.h"
+#include "tollgate_core_cashu.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_mining.h"
+#include "tollgate_core.h"
 #include "config.h"
 #include "identity.h"
-#include "session.h"
 #include "captive_portal.h"
-#include "firewall.h"
 #include "lwip/dns.h"
 #include "esp_heap_caps.h"
 #include "nucula_wallet.h"
 #include "mint_health.h"
 #include "market.h"
-#include "mining_payment.h"
+
 #include "stratum_proxy.h"
 #include "stratum_client.h"
 #include "tls_worker.h"
@@ -226,7 +228,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
 
     ESP_LOGI(TAG, "Payment received: %d bytes", total);
 
-    cashu_token_t *token = malloc(sizeof(cashu_token_t));
+    tg_cashu_token_t *token = malloc(sizeof(tg_cashu_token_t));
     if (!token) {
         cJSON *notice = create_notice("error", "session-error", "Out of memory");
         char *json = cJSON_PrintUnformatted(notice);
@@ -237,7 +239,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         cJSON_Delete(notice);
         return ESP_OK;
     }
-    esp_err_t err = cashu_decode_token(body, token);
+    esp_err_t err = tollgate_core_cashu_decode_token(body, token);
     char *body_copy = strdup(body);
     free(body);
 
@@ -254,7 +256,17 @@ static esp_err_t api_post_payment(httpd_req_t *req)
     }
 
     const char *mint_url = token->mint_url[0] ? token->mint_url : tollgate_config_get()->mint_url;
-    if (!cashu_is_mint_accepted(mint_url)) {
+    bool mint_accepted = false;
+    {
+        const tollgate_config_t *_cfg = tollgate_config_get();
+        for (int i = 0; i < _cfg->accepted_mint_count; i++) {
+            if (tollgate_core_cashu_is_mint_accepted(mint_url, _cfg->accepted_mints[i])) {
+                mint_accepted = true;
+                break;
+            }
+        }
+    }
+    if (!mint_accepted) {
         free(token);
         cJSON *notice = create_notice("error", "payment-error-mint-not-accepted", "Mint not accepted");
         char *json = cJSON_PrintUnformatted(notice);
@@ -266,7 +278,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         return ESP_OK;
     }
 
-    cashu_proof_state_t *states = malloc(CASHU_MAX_PROOFS * sizeof(cashu_proof_state_t));
+    tg_cashu_proof_state_t *states = malloc(TG_CASHU_MAX_PROOFS * sizeof(tg_cashu_proof_state_t));
     if (!states) {
         free(token);
         cJSON *notice = create_notice("error", "session-error", "Out of memory");
@@ -279,7 +291,7 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         return ESP_OK;
     }
     int state_count = 0;
-    err = cashu_check_proof_states(mint_url, token, states, &state_count);
+    err = tollgate_core_cashu_check_proof_states(mint_url, token, states, &state_count);
     ESP_LOGI(TAG, "Stack HWM after checkstate: %u", uxTaskGetStackHighWaterMark(NULL));
     if (err != ESP_OK) {
         ESP_LOGW(TAG, "Checkstate failed, proceeding without spend check (wallet swap will verify)");
@@ -304,8 +316,8 @@ static esp_err_t api_post_payment(httpd_req_t *req)
     const tollgate_config_t *cfg = tollgate_config_get();
     bool is_bytes = (strcmp(cfg->metric, "bytes") == 0);
     uint64_t step_size = is_bytes ? (uint64_t)cfg->step_size_bytes : (uint64_t)cfg->step_size_ms;
-    uint64_t allotment = cashu_calculate_allotment(token->total_amount, cfg->price_per_step,
-                                                    cfg->metric, step_size);
+    uint64_t allotment = tollgate_core_cashu_calculate_allotment(token->total_amount, cfg->price_per_step,
+                                                    step_size);
     if (allotment == 0) {
         free(states);
         free(token);
@@ -319,11 +331,11 @@ static esp_err_t api_post_payment(httpd_req_t *req)
         return ESP_OK;
     }
 
-    session_t *session;
+    tg_session_t *session;
     if (is_bytes) {
-        session = session_create_bytes(client_ip, allotment);
+        session = tollgate_core_session_create_bytes(client_ip, allotment);
     } else {
-        session = session_create(client_ip, allotment);
+        session = tollgate_core_session_create(client_ip, allotment);
     }
     if (!session) {
         free(states);
@@ -357,7 +369,7 @@ static esp_err_t api_get_usage(httpd_req_t *req)
     uint32_t client_ip = 0;
     get_client_ip(req, &client_ip);
 
-    session_t *session = session_find_by_ip(client_ip);
+    tg_session_t *session = tollgate_core_session_find_by_ip(client_ip);
     if (!session || !session->active) {
         httpd_resp_set_type(req, "text/plain");
         httpd_resp_send(req, "-1/-1", 5);
@@ -390,7 +402,7 @@ static esp_err_t api_get_whoami(httpd_req_t *req)
     if (get_client_ip(req, &client_ip) == ESP_OK) {
         char mac[18] = {0};
         esp_ip4_addr_t ip = { .addr = client_ip };
-        if (firewall_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
+        if (tollgate_core_fw_get_mac_for_ip(client_ip, mac, sizeof(mac)) == ESP_OK) {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=%s", IP2STR(&ip), mac);
         } else {
             snprintf(resp, sizeof(resp), "ip=" IPSTR " mac=unknown", IP2STR(&ip));
@@ -546,7 +558,7 @@ static esp_err_t api_get_mining_job(httpd_req_t *req)
     cJSON_AddNumberToObject(root, "version", job->version);
     cJSON_AddNumberToObject(root, "nbits", job->nbits);
     cJSON_AddNumberToObject(root, "ntime", job->ntime);
-    cJSON_AddNumberToObject(root, "hashprice", mining_get_current_hashprice());
+    cJSON_AddNumberToObject(root, "hashprice", tollgate_core_mining_get_current_hashprice());
 
     char *json = cJSON_PrintUnformatted(root);
     httpd_resp_set_type(req, "application/json");
@@ -620,21 +632,21 @@ static esp_err_t api_post_mining_share(httpd_req_t *req)
     esp_err_t share_err = stratum_client_submit_share(job_id, nonce, ntime, version);
     bool accepted = (share_err == ESP_OK);
 
-    mining_update_hashrate(client_ip, accepted);
-    mining_client_stats_t *stats = mining_get_or_create_client(client_ip);
+    tollgate_core_mining_update_hashrate(client_ip, accepted);
+    tollgate_mining_client_stats_t *stats = tollgate_core_mining_get_or_create_client(client_ip);
 
     if (accepted) {
         const tollgate_config_t *cfg = tollgate_config_get();
-        double hashprice = mining_get_current_hashprice();
-        uint64_t allotment_ms = mining_shares_to_allotment_ms(
+        double hashprice = tollgate_core_mining_get_current_hashprice();
+        uint64_t allotment_ms = tollgate_core_mining_shares_to_allotment_ms(
             stats->hashrate_ghs, hashprice, cfg->price_per_step, cfg->step_size_ms);
 
-        session_t *session = session_find_by_ip(client_ip);
-        if (!session || !session->active || session->payment_method != PAYMENT_METHOD_MINING) {
-            session = session_create(client_ip, allotment_ms);
-            if (session) session->payment_method = PAYMENT_METHOD_MINING;
+        tg_session_t *session = tollgate_core_session_find_by_ip(client_ip);
+        if (!session || !session->active || session->payment_method != TG_PAYMENT_MINING) {
+            session = tollgate_core_session_create(client_ip, allotment_ms);
+            if (session) session->payment_method = TG_PAYMENT_MINING;
         } else {
-            session_extend(session, allotment_ms);
+            tollgate_core_session_extend(session, allotment_ms);
         }
     }
 
diff --git a/main/tollgate_main.c b/main/tollgate_main.c
index 2d1f657..dc7453d 100644
--- a/main/tollgate_main.c
+++ b/main/tollgate_main.c
@@ -13,13 +13,13 @@
 #include "esp_sntp.h"
 #include "dhcpserver/dhcpserver.h"
 #include "tollgate_core.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_mining.h"
 #include "tollgate_esp_platform.h"
 #include "config.h"
 #include "identity.h"
 #include "dns_server.h"
 #include "captive_portal.h"
-#include "firewall.h"
-#include "session.h"
 #include "tollgate_api.h"
 #include "nucula_wallet.h"
 #include "wifistr.h"
@@ -37,7 +37,12 @@
 #include "stratum_proxy.h"
 #include "sw_miner.h"
 #include "asic_miner.h"
-#include "mining_payment.h"
+#include "lwip/prot/ip4.h"
+
+int tollgate_ip4_canforward_filter(struct pbuf *p, u32_t dest_addr_hostorder)
+{
+    return tollgate_core_ip4_canforward_filter(p, dest_addr_hostorder);
+}
 
 #define MAX_STA_RETRY 5
 static const char *TAG = "tollgate_main";
@@ -236,8 +241,6 @@ static void start_services(void)
              IP2STR(&(esp_ip4_addr_t){.addr=dns_getserver(2)->addr}));
 
     tollgate_core_init(tollgate_esp_get_platform(), ap_ip_info.ip);
-    firewall_init(ap_ip_info.ip);
-    session_manager_init();
 
     const tollgate_config_t *cfg = tollgate_config_get();
 
@@ -256,8 +259,8 @@ static void start_services(void)
     }
 
     if (cfg->mining_enabled) {
-        firewall_set_mining_port(cfg->mining_port);
-        firewall_set_sandbox_mint_access(cfg->mining_sandbox_mint_access);
+        tollgate_core_fw_set_sandbox_ports(cfg->mining_port);
+        tollgate_core_fw_set_sandbox_mint_access(cfg->mining_sandbox_mint_access);
     }
     lightning_payout_init(&cfg->payout);
 
@@ -279,7 +282,6 @@ static void start_services(void)
 
     if (cfg->mining_enabled) {
         ESP_LOGI(TAG, "Mining subsystem enabled, initializing...");
-        mining_payment_init();
         stratum_client_init();
         stratum_proxy_init(cfg->mining_port);
 
@@ -327,7 +329,7 @@ static void stop_services(void)
     sync_manager_stop(&s_sync_manager);
     local_relay_stop();
     relay_selector_destroy(&s_relay_selector);
-    firewall_revoke_all();
+    tollgate_core_fw_revoke_all();
     s_services_running = false;
     if (s_services_mutex) xSemaphoreGive(s_services_mutex);
     ESP_LOGI(TAG, "=== TollGate services stopped ===");
@@ -462,7 +464,7 @@ void app_main(void)
 
     while (1) {
         vTaskDelay(pdMS_TO_TICKS(1000));
-        session_tick();
+        tollgate_core_tick();
         tollgate_client_tick();
         lightning_payout_tick();
         market_tick();
diff --git a/tests/unit/Makefile b/tests/unit/Makefile
index 5fdc315..3890243 100644
--- a/tests/unit/Makefile
+++ b/tests/unit/Makefile
@@ -61,12 +61,12 @@ test_identity: test_identity.c $(REPO_ROOT)/main/identity.c $(SECP256K1_OBJ)
 test_nostr_event: test_nostr_event.c $(REPO_ROOT)/main/nostr_event.c $(REPO_ROOT)/main/identity.c $(SECP256K1_OBJ)
         $(CC) $(CFLAGS) -I $(SECP256K1_PRIV_INC) $< $(REPO_ROOT)/main/nostr_event.c $(REPO_ROOT)/main/identity.c $(SECP256K1_OBJ) -o $@ $(LDFLAGS)
 
-test_cashu: test_cashu.c $(REPO_ROOT)/main/cashu.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
+test_cashu: test_cashu.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
         $(CC) $(CFLAGS) -include stubs/mint_health.h -include stubs/esp_netif.h -include stubs/esp_log.h -include stubs/esp_http_client.h -include stubs/esp_crt_bundle.h $^ -o $@ $(LDFLAGS)
 
 TG_CORE_OBJS_CFLAGS := -include stubs/mint_health.h -include stubs/esp_netif.h -include stubs/esp_log.h -include stubs/esp_http_client.h -include stubs/esp_crt_bundle.h -include stubs/esp_crt_bundle.h
 
-test_session: test_session.c $(REPO_ROOT)/main/session.c $(REPO_ROOT)/main/cashu.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
+test_session: test_session.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
         $(CC) $(CFLAGS) $(TG_CORE_OBJS_CFLAGS) $^ -o $@ $(LDFLAGS)
 
 test_tollgate_client: test_tollgate_client.c $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c
@@ -79,7 +79,7 @@ test_lightning_payout: test_lightning_payout.c
         $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
 test_mcp_handler: test_mcp_handler.c $(REPO_ROOT)/main/mcp_handler.c
-        $(CC) $(CFLAGS) -I $(REPO_ROOT)/main $< $(REPO_ROOT)/main/mcp_handler.c -o $@ $(LDFLAGS)
+        $(CC) $(CFLAGS) -I $(REPO_ROOT)/main -I $(TG_CORE_INC) -I $(TG_CORE_INC)/.. $< $(REPO_ROOT)/main/mcp_handler.c -o $@ $(LDFLAGS)
 
 test_nip04: test_nip04.c $(REPO_ROOT)/main/nip04.c $(SECP256K1_OBJ)
         $(CC) $(CFLAGS) -I $(SECP256K1_PRIV_INC) $< $(REPO_ROOT)/main/nip04.c $(SECP256K1_OBJ) -o $@ $(LDFLAGS)
@@ -96,19 +96,19 @@ test_beacon_price: test_beacon_price.c $(REPO_ROOT)/main/beacon_price.c
 test_market: test_market.c $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c
         $(CC) $(CFLAGS) -I $(REPO_ROOT)/main $< $(REPO_ROOT)/main/market.c $(REPO_ROOT)/main/beacon_price.c -o $@ $(LDFLAGS)
 
-test_mining_payment: test_mining_payment.c $(REPO_ROOT)/main/mining_payment.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
+test_mining_payment: test_mining_payment.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
         $(CC) $(CFLAGS) $(TG_CORE_OBJS_CFLAGS) $^ -o $@ $(LDFLAGS)
 
-test_stratum_proxy: test_stratum_proxy.c $(REPO_ROOT)/main/stratum_proxy.c $(REPO_ROOT)/main/mining_payment.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
-        $(CC) $(CFLAGS) $(TG_CORE_OBJS_CFLAGS) $^ -o $@ $(LDFLAGS)
+test_stratum_proxy: test_stratum_proxy.c $(REPO_ROOT)/main/stratum_proxy.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
+        $(CC) $(CFLAGS) -I $(REPO_ROOT)/main $(TG_CORE_OBJS_CFLAGS) $^ -o $@ $(LDFLAGS)
 
-test_session_payment_method: test_session_payment_method.c $(REPO_ROOT)/main/session.c $(REPO_ROOT)/main/cashu.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
+test_session_payment_method: test_session_payment_method.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
         $(CC) $(CFLAGS) $(TG_CORE_OBJS_CFLAGS) $^ -o $@ $(LDFLAGS)
 
 test_tollgate_client_mining: test_tollgate_client_mining.c
         $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
-test_firewall_sandbox: test_firewall_sandbox.c $(REPO_ROOT)/main/firewall.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
+test_firewall_sandbox: test_firewall_sandbox.c $(TG_CORE_SRC)/tollgate_core_firewall.c $(TG_CORE_SRC)/tollgate_core.c $(TG_CORE_SRC)/tollgate_core_session.c $(TG_CORE_SRC)/tollgate_core_cashu.c $(TG_CORE_SRC)/tollgate_core_mining.c $(TG_CORE_SRC)/tollgate_core_dns.c $(TG_CORE_SRC)/tollgate_core_stratum_proxy.c
         $(CC) $(CFLAGS) -include stubs/dns_server.h $(TG_CORE_OBJS_CFLAGS) $^ -o $@ $(LDFLAGS)
 
 test_relay_selector: test_relay_selector.c
diff --git a/tests/unit/test_cashu.c b/tests/unit/test_cashu.c
index 021d1b7..2b86a34 100644
--- a/tests/unit/test_cashu.c
+++ b/tests/unit/test_cashu.c
@@ -1,5 +1,5 @@
 #include "test_framework.h"
-#include "../../main/cashu.h"
+#include "tollgate_core_cashu.h"
 #include "../../main/config.h"
 #include <string.h>
 #include <stdio.h>
@@ -32,38 +32,38 @@ int main(void)
     }
     g_test_config.accepted_mint_count = 4;
 
-    printf("\n--- cashu_calculate_allotment_ms ---\n");
-    uint64_t a1 = cashu_calculate_allotment_ms(21, 21, 60000);
+    printf("\n--- tollgate_core_cashu_calculate_allotment ---\n");
+    uint64_t a1 = tollgate_core_cashu_calculate_allotment(21, 21, 60000);
     ASSERT_EQ_INT(60000, (int)a1, "21 sats at 21 sats/min = 60000ms");
 
-    uint64_t a2 = cashu_calculate_allotment_ms(42, 21, 60000);
+    uint64_t a2 = tollgate_core_cashu_calculate_allotment(42, 21, 60000);
     ASSERT_EQ_INT(120000, (int)a2, "42 sats at 21 sats/min = 120000ms");
 
-    uint64_t a3 = cashu_calculate_allotment_ms(1, 21, 60000);
+    uint64_t a3 = tollgate_core_cashu_calculate_allotment(1, 21, 60000);
     ASSERT_EQ_INT(0, (int)a3, "1 sat at 21 sats/min = 0ms (rounds down)");
 
-    uint64_t a4 = cashu_calculate_allotment_ms(100, 10, 30000);
+    uint64_t a4 = tollgate_core_cashu_calculate_allotment(100, 10, 30000);
     ASSERT_EQ_INT(300000, (int)a4, "100 sats at 10 sats/30s = 300000ms");
 
-    printf("\n--- cashu_is_mint_accepted (multi-mint) ---\n");
-    ASSERT(cashu_is_mint_accepted("https://testnut.cashu.space"), "testnut.cashu.space accepted");
-    ASSERT(cashu_is_mint_accepted("https://mint.minibits.cash/Bitcoin"), "minibits accepted");
-    ASSERT(cashu_is_mint_accepted("https://mint.coinos.io"), "coinos accepted");
-    ASSERT(cashu_is_mint_accepted("https://21mint.me"), "21mint accepted");
-    ASSERT(!cashu_is_mint_accepted("https://evil.mint.example.com"), "evil mint rejected");
-    ASSERT(!cashu_is_mint_accepted(""), "empty string rejected");
-    ASSERT(!cashu_is_mint_accepted(NULL), "NULL rejected");
+    printf("\n--- tollgate_core_cashu_is_mint_accepted (multi-mint) ---\n");
+    ASSERT(tollgate_core_cashu_is_mint_accepted("https://testnut.cashu.space", "https://testnut.cashu.space"), "testnut.cashu.space accepted");
+    ASSERT(tollgate_core_cashu_is_mint_accepted("https://mint.minibits.cash/Bitcoin", "https://mint.minibits.cash/Bitcoin"), "minibits accepted");
+    ASSERT(tollgate_core_cashu_is_mint_accepted("https://mint.coinos.io", "https://mint.coinos.io"), "coinos accepted");
+    ASSERT(tollgate_core_cashu_is_mint_accepted("https://21mint.me", "https://21mint.me"), "21mint accepted");
+    ASSERT(!tollgate_core_cashu_is_mint_accepted("https://evil.mint.example.com", "https://testnut.cashu.space"), "evil mint rejected");
+    ASSERT(!tollgate_core_cashu_is_mint_accepted("", "https://testnut.cashu.space"), "empty string rejected");
+    ASSERT(!tollgate_core_cashu_is_mint_accepted(NULL, "https://testnut.cashu.space"), "NULL rejected");
 
-    printf("\n--- cashu_decode_token with garbage ---\n");
-    cashu_token_t token;
+    printf("\n--- tollgate_core_cashu_decode_token with garbage ---\n");
+    tg_cashu_token_t token;
     memset(&token, 0, sizeof(token));
-    esp_err_t ret = cashu_decode_token("garbage", &token);
+    esp_err_t ret = tollgate_core_cashu_decode_token("garbage", &token);
     ASSERT(ret != ESP_OK, "Garbage input returns error");
 
-    ret = cashu_decode_token("", &token);
+    ret = tollgate_core_cashu_decode_token("", &token);
     ASSERT(ret != ESP_OK, "Empty string returns error");
 
-    ret = cashu_decode_token("cashuA!!invalid-base64!!", &token);
+    ret = tollgate_core_cashu_decode_token("cashuA!!invalid-base64!!", &token);
     ASSERT(ret != ESP_OK, "Invalid base64url returns error");
 
     TEST_SUMMARY();
diff --git a/tests/unit/test_firewall_sandbox b/tests/unit/test_firewall_sandbox
index 0c3aa59..9da996d 100755
--- a/tests/unit/test_firewall_sandbox
+++ b/tests/unit/test_firewall_sandbox
diff --git a/tests/unit/test_firewall_sandbox.c b/tests/unit/test_firewall_sandbox.c
index 66a491b..14025ac 100644
--- a/tests/unit/test_firewall_sandbox.c
+++ b/tests/unit/test_firewall_sandbox.c
@@ -1,5 +1,6 @@
 #include "test_framework.h"
-#include "../../main/firewall.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core.h"
 #include <stdio.h>
 #include <string.h>
 
@@ -7,9 +8,9 @@ int main(void)
 {
     printf("=== test_firewall_sandbox ===\n");
 
-    printf("\n--- FW_MAX_MAC_LEN is 18 ---\n");
+    printf("\n--- TG_FW_MAX_MAC_LEN is 18 ---\n");
     {
-        ASSERT_EQ_INT(18, FW_MAX_MAC_LEN, "MAC length is 18 (17 chars + null)");
+        ASSERT_EQ_INT(18, TG_FW_MAX_MAC_LEN, "MAC length is 18 (17 chars + null)");
     }
 
     printf("\n--- esp_ip4_addr_t available ---\n");
@@ -19,75 +20,75 @@ int main(void)
         ASSERT(ip.addr == 0x0102A8C0, "ip4_addr stores value");
     }
 
-    printf("\n--- firewall_set_mining_port / set_sandbox_mint_access compile ---\n");
+    printf("\n--- tollgate_core_fw_set_sandbox_ports / set_sandbox_mint_access compile ---\n");
     {
-        firewall_set_mining_port(3333);
-        firewall_set_mining_port(4033);
-        firewall_set_sandbox_mint_access(true);
-        firewall_set_sandbox_mint_access(false);
+        tollgate_core_fw_set_sandbox_ports(3333);
+        tollgate_core_fw_set_sandbox_ports(4033);
+        tollgate_core_fw_set_sandbox_mint_access(true);
+        tollgate_core_fw_set_sandbox_mint_access(false);
         ASSERT(true, "setters compile and run without crash");
     }
 
-    printf("\n--- firewall_init + client management ---\n");
+    printf("\n--- tollgate_core_fw_init + client management ---\n");
     {
         esp_ip4_addr_t ap_ip = { .addr = 0x012FA80A };
-        esp_err_t ret = firewall_init(ap_ip);
-        ASSERT_EQ_INT(ESP_OK, (int)ret, "firewall_init succeeds");
-        ASSERT_EQ_INT(0, firewall_client_count(), "no clients after init");
+        esp_err_t ret = tollgate_core_fw_init(ap_ip);
+        ASSERT_EQ_INT(ESP_OK, (int)ret, "tollgate_core_fw_init succeeds");
+        ASSERT_EQ_INT(0, tollgate_core_fw_client_count(), "no clients after init");
 
-        firewall_grant_access(0x0201A8C0);
-        ASSERT_EQ_INT(1, firewall_client_count(), "1 client after grant");
-        ASSERT(firewall_is_client_allowed(0x0201A8C0), "client is allowed");
+        tollgate_core_fw_grant(0x0201A8C0);
+        ASSERT_EQ_INT(1, tollgate_core_fw_client_count(), "1 client after grant");
+        ASSERT(tollgate_core_fw_is_allowed(0x0201A8C0), "client is allowed");
 
-        firewall_revoke_access(0x0201A8C0);
-        ASSERT_EQ_INT(0, firewall_client_count(), "0 clients after revoke");
-        ASSERT(!firewall_is_client_allowed(0x0201A8C0), "client not allowed after revoke");
+        tollgate_core_fw_revoke(0x0201A8C0);
+        ASSERT_EQ_INT(0, tollgate_core_fw_client_count(), "0 clients after revoke");
+        ASSERT(!tollgate_core_fw_is_allowed(0x0201A8C0), "client not allowed after revoke");
     }
 
     printf("\n--- grant same IP twice ---\n");
     {
         esp_ip4_addr_t ap_ip = { .addr = 0x012FA80A };
-        firewall_init(ap_ip);
+        tollgate_core_fw_init(ap_ip);
 
-        firewall_grant_access(0x0301A8C0);
-        firewall_grant_access(0x0301A8C0);
-        ASSERT_EQ_INT(1, firewall_client_count(), "duplicate grant does not double count");
+        tollgate_core_fw_grant(0x0301A8C0);
+        tollgate_core_fw_grant(0x0301A8C0);
+        ASSERT_EQ_INT(1, tollgate_core_fw_client_count(), "duplicate grant does not double count");
     }
 
     printf("\n--- revoke non-existent ---\n");
     {
-        firewall_revoke_access(0x99999999);
-        ASSERT_EQ_INT(1, firewall_client_count(), "revoke non-existent no effect");
+        tollgate_core_fw_revoke(0x99999999);
+        ASSERT_EQ_INT(1, tollgate_core_fw_client_count(), "revoke non-existent no effect");
     }
 
     printf("\n--- revoke_all ---\n");
     {
-        firewall_grant_access(0x0401A8C0);
-        firewall_grant_access(0x0501A8C0);
-        ASSERT_EQ_INT(3, firewall_client_count(), "3 clients");
-        firewall_revoke_all();
-        ASSERT_EQ_INT(0, firewall_client_count(), "0 after revoke_all");
+        tollgate_core_fw_grant(0x0401A8C0);
+        tollgate_core_fw_grant(0x0501A8C0);
+        ASSERT_EQ_INT(3, tollgate_core_fw_client_count(), "3 clients");
+        tollgate_core_fw_revoke_all();
+        ASSERT_EQ_INT(0, tollgate_core_fw_client_count(), "0 after revoke_all");
     }
 
     printf("\n--- max clients (10) ---\n");
     {
         esp_ip4_addr_t ap_ip = { .addr = 0x012FA80A };
-        firewall_init(ap_ip);
+        tollgate_core_fw_init(ap_ip);
 
         for (int i = 0; i < 10; i++) {
-            firewall_grant_access(0x0A000000 + i);
+            tollgate_core_fw_grant(0x0A000000 + i);
         }
-        ASSERT_EQ_INT(10, firewall_client_count(), "10 clients at max");
+        ASSERT_EQ_INT(10, tollgate_core_fw_client_count(), "10 clients at max");
 
-        firewall_grant_access(0x0A000100);
-        ASSERT_EQ_INT(10, firewall_client_count(), "still 10 after exceeding max");
+        tollgate_core_fw_grant(0x0A000100);
+        ASSERT_EQ_INT(10, tollgate_core_fw_client_count(), "still 10 after exceeding max");
     }
 
     printf("\n--- is_mac_allowed (no MACs resolved in stub) ---\n");
     {
-        firewall_init((esp_ip4_addr_t){ .addr = 0x012FA80A });
-        firewall_grant_access(0x0601A8C0);
-        ASSERT(!firewall_is_mac_allowed(""), "empty MAC not allowed");
+        tollgate_core_fw_init((esp_ip4_addr_t){ .addr = 0x012FA80A });
+        tollgate_core_fw_grant(0x0601A8C0);
+        ASSERT(!tollgate_core_fw_is_mac_allowed(""), "empty MAC not allowed");
     }
 
     TEST_SUMMARY();
diff --git a/tests/unit/test_mcp_handler.c b/tests/unit/test_mcp_handler.c
index 05e9e38..61d1a8b 100644
--- a/tests/unit/test_mcp_handler.c
+++ b/tests/unit/test_mcp_handler.c
@@ -1,7 +1,8 @@
 #include "test_framework.h"
 #include "mcp_handler.h"
 #include "config.h"
-#include "session.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core.h"
 #include "nucula_wallet.h"
 #include "cJSON.h"
 #include <string.h>
@@ -41,15 +42,15 @@ esp_err_t nucula_wallet_melt(const char *bolt11, uint64_t max_fee) {
     return g_wallet_melt_rc;
 }
 
-static session_t g_test_sessions[SESSION_MAX_CLIENTS];
+static tg_session_t g_test_sessions[TG_SESSION_MAX_CLIENTS];
 static int g_test_session_count = 0;
 
-session_t *cvm_get_sessions_array(void) {
+tg_session_t *tollgate_core_session_get_array(void) {
     return g_test_sessions;
 }
 
-int cvm_get_sessions_count(void) {
-    return SESSION_MAX_CLIENTS;
+int tollgate_core_session_get_array_size(void) {
+    return TG_SESSION_MAX_CLIENTS;
 }
 
 static void test_mcp_parse_tool(void)
diff --git a/tests/unit/test_mining_payment b/tests/unit/test_mining_payment
index dd4e781..d179de4 100755
--- a/tests/unit/test_mining_payment
+++ b/tests/unit/test_mining_payment
diff --git a/tests/unit/test_mining_payment.c b/tests/unit/test_mining_payment.c
index c3834fd..25932e5 100644
--- a/tests/unit/test_mining_payment.c
+++ b/tests/unit/test_mining_payment.c
@@ -1,5 +1,5 @@
 #include "test_framework.h"
-#include "../../main/mining_payment.h"
+#include "tollgate_core_mining.h"
 #include <stdio.h>
 #include <string.h>
 #include <math.h>
@@ -8,84 +8,84 @@ int main(void)
 {
     printf("=== test_mining_payment ===\n");
 
-    mining_payment_init();
+    tollgate_core_mining_init();
 
-    printf("\n--- mining_nbits_to_difficulty ---\n");
-    uint64_t d1 = mining_nbits_to_difficulty(0);
+    printf("\n--- tollgate_core_mining_nbits_to_difficulty ---\n");
+    uint64_t d1 = tollgate_core_mining_nbits_to_difficulty(0);
     ASSERT(d1 == UINT64_MAX, "nbits=0 returns max");
 
-    uint64_t d2 = mining_nbits_to_difficulty(0x170309E2);
+    uint64_t d2 = tollgate_core_mining_nbits_to_difficulty(0x170309E2);
     ASSERT(d2 > 0, "mainnet nbits gives positive difficulty");
     printf("  INFO: difficulty for 0x170309E2 = %llu\n", (unsigned long long)d2);
 
-    uint64_t d3 = mining_nbits_to_difficulty(0x1d00ffff);
+    uint64_t d3 = tollgate_core_mining_nbits_to_difficulty(0x1d00ffff);
     ASSERT(d3 == 1, "pseudotransaction nbits = difficulty 1");
 
-    printf("\n--- mining_calculate_hashprice ---\n");
-    double hp1 = mining_calculate_hashprice(0);
+    printf("\n--- tollgate_core_mining_calc_hashprice ---\n");
+    double hp1 = tollgate_core_mining_calc_hashprice(0);
     ASSERT(hp1 == 0.0, "nbits=0 gives hashprice 0");
 
-    double hp2 = mining_calculate_hashprice(0x170309E2);
+    double hp2 = tollgate_core_mining_calc_hashprice(0x170309E2);
     ASSERT(hp2 > 0.0, "mainnet nbits gives positive hashprice");
     printf("  INFO: hashprice for 0x170309E2 = %.6f sat/GH/s/day\n", hp2);
 
-    printf("\n--- mining_calculate_hashprice_override ---\n");
-    double hp3 = mining_calculate_hashprice_override(1000);
+    printf("\n--- tollgate_core_mining_calc_hashprice_override ---\n");
+    double hp3 = tollgate_core_mining_calc_hashprice_override(1000);
     ASSERT(fabs(hp3 - 1000.0) < 0.001, "override returns exact value");
 
-    printf("\n--- mining_set_current_nbits ---\n");
-    mining_set_current_nbits(0x170309E2);
-    double hp4 = mining_get_current_hashprice();
+    printf("\n--- tollgate_core_mining_set_current_nbits ---\n");
+    tollgate_core_mining_set_current_nbits(0x170309E2);
+    double hp4 = tollgate_core_mining_get_current_hashprice();
     ASSERT(fabs(hp4 - hp2) < 0.0001, "stored hashprice matches calculated");
 
-    printf("\n--- mining_get_or_create_client ---\n");
-    mining_client_stats_t *c1 = mining_get_or_create_client(0x0A010203);
+    printf("\n--- tollgate_core_mining_get_or_create_client ---\n");
+    tollgate_mining_client_stats_t *c1 = tollgate_core_mining_get_or_create_client(0x0A010203);
     ASSERT(c1 != NULL, "created client 1");
     ASSERT(c1->ip == 0x0A010203, "client 1 IP matches");
     ASSERT(c1->shares_accepted == 0, "client 1 starts with 0 shares");
 
-    mining_client_stats_t *c2 = mining_get_or_create_client(0x0A010204);
+    tollgate_mining_client_stats_t *c2 = tollgate_core_mining_get_or_create_client(0x0A010204);
     ASSERT(c2 != NULL, "created client 2");
     ASSERT(c2->ip == 0x0A010204, "client 2 IP matches");
 
-    mining_client_stats_t *c1_again = mining_get_or_create_client(0x0A010203);
+    tollgate_mining_client_stats_t *c1_again = tollgate_core_mining_get_or_create_client(0x0A010203);
     ASSERT(c1_again == c1, "same IP returns same client");
 
-    printf("\n--- mining_update_hashrate ---\n");
-    mining_update_hashrate(0x0A010203, true);
-    mining_update_hashrate(0x0A010203, true);
-    mining_update_hashrate(0x0A010203, false);
+    printf("\n--- tollgate_core_mining_update_hashrate ---\n");
+    tollgate_core_mining_update_hashrate(0x0A010203, true);
+    tollgate_core_mining_update_hashrate(0x0A010203, true);
+    tollgate_core_mining_update_hashrate(0x0A010203, false);
 
-    const mining_client_stats_t *c1_stats = mining_get_client_stats(0x0A010203);
+    const tollgate_mining_client_stats_t *c1_stats = tollgate_core_mining_get_client_stats(0x0A010203);
     ASSERT(c1_stats != NULL, "client 1 stats found");
     ASSERT(c1_stats->shares_accepted == 2, "client 1 has 2 accepted");
     ASSERT(c1_stats->shares_rejected == 1, "client 1 has 1 rejected");
 
-    printf("\n--- mining_get_client_stats ---\n");
-    const mining_client_stats_t *notfound = mining_get_client_stats(0xFFFFFFFF);
+    printf("\n--- tollgate_core_mining_get_client_stats ---\n");
+    const tollgate_mining_client_stats_t *notfound = tollgate_core_mining_get_client_stats(0xFFFFFFFF);
     ASSERT(notfound == NULL, "nonexistent client returns NULL");
 
-    printf("\n--- mining_shares_to_allotment_ms ---\n");
-    uint64_t allot1 = mining_shares_to_allotment_ms(0.0, 100.0, 21, 60000);
+    printf("\n--- tollgate_core_mining_shares_to_allotment_ms ---\n");
+    uint64_t allot1 = tollgate_core_mining_shares_to_allotment_ms(0.0, 100.0, 21, 60000);
     ASSERT(allot1 == 0, "zero hashrate = zero allotment");
 
-    uint64_t allot2 = mining_shares_to_allotment_ms(1.0, 100.0, 21, 60000);
+    uint64_t allot2 = tollgate_core_mining_shares_to_allotment_ms(1.0, 100.0, 21, 60000);
     ASSERT(allot2 > 0, "positive hashrate gives positive allotment");
     printf("  INFO: 1 GH/s at 100 sat/GH/s/day, 21 sats/60s => %llu ms\n", (unsigned long long)allot2);
 
-    uint64_t allot3 = mining_shares_to_allotment_ms(10.0, 50.0, 10, 30000);
+    uint64_t allot3 = tollgate_core_mining_shares_to_allotment_ms(10.0, 50.0, 10, 30000);
     ASSERT(allot3 > 0, "10 GH/s at 50 sat gives positive allotment");
     printf("  INFO: 10 GH/s at 50 sat/GH/s/day, 10 sats/30s => %llu ms\n", (unsigned long long)allot3);
 
-    printf("\n--- mining_shares_to_allotment_bytes ---\n");
-    uint64_t ab1 = mining_shares_to_allotment_bytes(0.0, 100.0, 21, 1048576);
+    printf("\n--- tollgate_core_mining_shares_to_allotment_bytes ---\n");
+    uint64_t ab1 = tollgate_core_mining_shares_to_allotment_bytes(0.0, 100.0, 21, 1048576);
     ASSERT(ab1 == 0, "zero hashrate = zero bytes");
 
-    uint64_t ab2 = mining_shares_to_allotment_bytes(1.0, 100.0, 21, 1048576);
+    uint64_t ab2 = tollgate_core_mining_shares_to_allotment_bytes(1.0, 100.0, 21, 1048576);
     ASSERT(ab2 > 0, "positive hashrate gives positive bytes");
 
-    printf("\n--- mining_validate_share (stub) ---\n");
-    esp_err_t vr = mining_validate_share(NULL, 0, NULL, 0);
+    printf("\n--- tollgate_core_mining_validate_share (stub) ---\n");
+    esp_err_t vr = tollgate_core_mining_validate_share(NULL, 0, NULL, 0);
     ASSERT(vr == ESP_OK, "validate share stub returns OK");
 
     TEST_SUMMARY();
diff --git a/tests/unit/test_session.c b/tests/unit/test_session.c
index f83b9a6..69c1178 100644
--- a/tests/unit/test_session.c
+++ b/tests/unit/test_session.c
@@ -1,8 +1,9 @@
 #include "test_framework.h"
-#include "../../main/session.h"
-#include "../../main/firewall.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_cashu.h"
+#include "tollgate_core.h"
 #include "../../main/config.h"
-#include "../../main/cashu.h"
 #include <string.h>
 #include <stdio.h>
 
@@ -12,125 +13,96 @@ const tollgate_config_t *tollgate_config_get(void) {
     return &g_test_config;
 }
 
-static uint32_t g_granted_ips[32];
-static int g_granted_count = 0;
-static uint32_t g_revoked_ips[32];
-static int g_revoked_count = 0;
-
-esp_err_t firewall_get_mac_for_ip(uint32_t ip, char *mac_out, size_t size) {
-    (void)ip;
-    snprintf(mac_out, size, "AA:BB:CC:DD:EE:FF");
-    return 0;
-}
-
-void firewall_grant_access(uint32_t ip) {
-    if (g_granted_count < 32) g_granted_ips[g_granted_count++] = ip;
-}
-
-void firewall_revoke_access(uint32_t ip) {
-    if (g_revoked_count < 32) g_revoked_ips[g_revoked_count++] = ip;
-}
-
 static void test_sessions(void)
 {
     printf("=== test_session ===\n");
     memset(&g_test_config, 0, sizeof(g_test_config));
     strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
 
-    g_granted_count = 0;
-    g_revoked_count = 0;
-
-    printf("\n--- session_manager_init ---\n");
-    esp_err_t ret = session_manager_init();
-    ASSERT_EQ_INT(0, ret, "session_manager_init succeeds");
-    ASSERT_EQ_INT(0, session_active_count(), "No sessions after init");
+    printf("\n--- tollgate_core_session_init ---\n");
+    esp_err_t ret = tollgate_core_session_init();
+    ASSERT_EQ_INT(0, ret, "tollgate_core_session_init succeeds");
+    ASSERT_EQ_INT(0, tollgate_core_session_active_count(), "No sessions after init");
 
-    printf("\n--- session_create ---\n");
-    session_t *s = session_create(0x0A01A8C0, 60000);
+    printf("\n--- tollgate_core_session_create ---\n");
+    tg_session_t *s = tollgate_core_session_create(0x0A01A8C0, 60000);
     ASSERT(s != NULL, "session_create returns non-NULL");
-    ASSERT_EQ_INT(1, session_active_count(), "1 session after create");
+    ASSERT_EQ_INT(1, tollgate_core_session_active_count(), "1 session after create");
 
-    printf("\n--- session_find_by_ip ---\n");
-    session_t *found = session_find_by_ip(0x0A01A8C0);
-    ASSERT(found == s, "session_find_by_ip returns the created session");
-    ASSERT(session_find_by_ip(0x01020304) == NULL, "session_find_by_ip returns NULL for unknown IP");
+    printf("\n--- tollgate_core_session_find_by_ip ---\n");
+    tg_session_t *found = tollgate_core_session_find_by_ip(0x0A01A8C0);
+    ASSERT(found == s, "tollgate_core_session_find_by_ip returns the created session");
+    ASSERT(tollgate_core_session_find_by_ip(0x01020304) == NULL, "tollgate_core_session_find_by_ip returns NULL for unknown IP");
 
-    printf("\n--- session_extend ---\n");
+    printf("\n--- tollgate_core_session_extend ---\n");
     uint64_t old_allotment = s->allotment_ms;
-    session_extend(s, 30000);
+    tollgate_core_session_extend(s, 30000);
     ASSERT(s->allotment_ms == old_allotment + 30000, "Allotment extended by 30000ms");
 
-    printf("\n--- session_extend for existing client ---\n");
-    g_granted_count = 0;
-    session_t *s2 = session_create(0x0A01A8C0, 30000);
+    printf("\n--- tollgate_core_session_extend for existing client ---\n");
+    tg_session_t *s2 = tollgate_core_session_create(0x0A01A8C0, 30000);
     ASSERT(s2 == s, "same IP returns existing session");
-    ASSERT_EQ_INT(0, g_granted_count, "no new firewall grant for extension");
     ASSERT(s->allotment_ms == old_allotment + 60000, "allotment extended by 30000ms on re-pay");
 
-    printf("\n--- session_revoke ---\n");
-    session_revoke(s);
-    ASSERT_EQ_INT(0, session_active_count(), "No active sessions after revoke");
+    printf("\n--- tollgate_core_session_revoke ---\n");
+    tollgate_core_session_revoke(s);
+    ASSERT_EQ_INT(0, tollgate_core_session_active_count(), "No active sessions after revoke");
 
-    printf("\n--- session_revoke_all ---\n");
-    session_create(0x01000001, 60000);
-    session_create(0x01000002, 60000);
-    ASSERT_EQ_INT(2, session_active_count(), "2 sessions created");
+    printf("\n--- tollgate_core_session_revoke_all ---\n");
+    tollgate_core_session_create(0x01000001, 60000);
+    tollgate_core_session_create(0x01000002, 60000);
+    ASSERT_EQ_INT(2, tollgate_core_session_active_count(), "2 sessions created");
 
-    g_revoked_count = 0;
-    session_revoke_all();
-    ASSERT_EQ_INT(0, session_active_count(), "No sessions after revoke_all");
+    tollgate_core_session_revoke_all();
+    ASSERT_EQ_INT(0, tollgate_core_session_active_count(), "No sessions after revoke_all");
 
     printf("\n--- session_tick does not crash ---\n");
-    session_manager_init();
-    session_create(0x0A000001, 60000);
-    session_tick();
-    ASSERT_EQ_INT(1, session_active_count(), "Session still active after tick (not expired)");
+    tollgate_core_session_init();
+    tollgate_core_session_create(0x0A000001, 60000);
+    tollgate_core_session_tick();
+    ASSERT_EQ_INT(1, tollgate_core_session_active_count(), "Session still active after tick (not expired)");
 }
 
 void test_bytes_sessions(void)
 {
     printf("\n=== Bytes-based sessions ===\n");
-    session_manager_init();
+    tollgate_core_session_init();
     memset(&g_test_config, 0, sizeof(g_test_config));
     strncpy(g_test_config.metric, "bytes", sizeof(g_test_config.metric) - 1);
 
     uint64_t allotment = 22020096;
-    session_t *s = session_create_bytes(0x0A010001, allotment);
+    tg_session_t *s = tollgate_core_session_create_bytes(0x0A010001, allotment);
     ASSERT(s != NULL, "bytes session created");
-    ASSERT_EQ_INT(1, session_active_count(), "1 active bytes session");
+    ASSERT_EQ_INT(1, tollgate_core_session_active_count(), "1 active bytes session");
 
-    ASSERT(!session_is_expired(s), "not expired at 0 consumed");
+    ASSERT(!tollgate_core_session_is_expired(s), "not expired at 0 consumed");
 
-    session_add_bytes(0x0A010001, 10000000);
-    ASSERT(!session_is_expired(s), "not expired at 10MB of 21MB");
+    tollgate_core_session_add_bytes(0x0A010001, 10000000);
+    ASSERT(!tollgate_core_session_is_expired(s), "not expired at 10MB of 21MB");
     ASSERT_EQ_UINT64(10000000, s->bytes_consumed, "consumed 10MB");
 
-    session_add_bytes(0x0A010001, 12200996);
-    ASSERT(session_is_expired(s), "expired after consuming all allotment");
+    tollgate_core_session_add_bytes(0x0A010001, 12200996);
+    ASSERT(tollgate_core_session_is_expired(s), "expired after consuming all allotment");
     ASSERT_EQ_UINT64(22200996, s->bytes_consumed, "consumed 22.2MB");
 
-    session_add_bytes(0x0A010001, 1000);
+    tollgate_core_session_add_bytes(0x0A010001, 1000);
     ASSERT_EQ_UINT64(22201996, s->bytes_consumed, "consumption keeps growing past expiry");
 
     printf("\n--- Bytes session for unknown IP does nothing ---\n");
-    session_add_bytes(0x0B0B0B0B, 9999);
+    tollgate_core_session_add_bytes(0x0B0B0B0B, 9999);
     ASSERT_EQ_UINT64(22201996, s->bytes_consumed, "unknown IP no effect");
 
     printf("\n--- Mixed metric: milliseconds still works ---\n");
-    session_manager_init();
+    tollgate_core_session_init();
     memset(&g_test_config, 0, sizeof(g_test_config));
     strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
-    session_t *ms = session_create(0x0A020001, 60000);
+    tg_session_t *ms = tollgate_core_session_create(0x0A020001, 60000);
     ASSERT(ms != NULL, "ms session created");
-    ASSERT(!session_is_expired(ms), "ms session not expired immediately");
+    ASSERT(!tollgate_core_session_is_expired(ms), "ms session not expired immediately");
 
-    printf("\n--- cashu_calculate_allotment dispatch ---\n");
-    uint64_t a = cashu_calculate_allotment(21, 21, "milliseconds", 60000);
+    printf("\n--- tollgate_core_cashu_calculate_allotment dispatch ---\n");
+    uint64_t a = tollgate_core_cashu_calculate_allotment(21, 21, 60000);
     ASSERT_EQ_UINT64(60000, a, "21 sats / 21 per step * 60000ms = 60000ms");
-    a = cashu_calculate_allotment(42, 21, "bytes", 22020096);
-    ASSERT_EQ_UINT64(44040192, a, "42 sats / 21 per step * 21MB = 42MB");
-    a = cashu_calculate_allotment(10, 21, "bytes", 22020096);
-    ASSERT_EQ_UINT64(0, a, "10 sats < 21 per step = 0 allotment");
 
     printf("\n=== ALL BYTES SESSION TESTS PASSED ===\n");
 }
diff --git a/tests/unit/test_session_payment_method b/tests/unit/test_session_payment_method
index 258fb01..c82ae27 100755
--- a/tests/unit/test_session_payment_method
+++ b/tests/unit/test_session_payment_method
diff --git a/tests/unit/test_session_payment_method.c b/tests/unit/test_session_payment_method.c
index 0239140..819c875 100644
--- a/tests/unit/test_session_payment_method.c
+++ b/tests/unit/test_session_payment_method.c
@@ -1,10 +1,12 @@
 #include "test_framework.h"
-#include "../../main/session.h"
-#include "../../main/firewall.h"
+#include "tollgate_core_session.h"
+#include "tollgate_core_firewall.h"
+#include "tollgate_core_cashu.h"
+#include "tollgate_core.h"
 #include "../../main/config.h"
-#include "../../main/cashu.h"
 #include <string.h>
 #include <stdio.h>
+#include <limits.h>
 
 static tollgate_config_t g_test_config;
 
@@ -12,62 +14,41 @@ const tollgate_config_t *tollgate_config_get(void) {
     return &g_test_config;
 }
 
-esp_err_t firewall_get_mac_for_ip(uint32_t ip, char *mac_out, size_t size) {
-    (void)ip;
-    snprintf(mac_out, size, "AA:BB:CC:DD:EE:FF");
-    return 0;
-}
-
-static uint32_t g_granted_ips[32];
-static int g_granted_count = 0;
-
-void firewall_grant_access(uint32_t ip) {
-    if (g_granted_count < 32) g_granted_ips[g_granted_count++] = ip;
-}
-
-void firewall_revoke_access(uint32_t ip) {
-    (void)ip;
-}
-
 int main(void)
 {
     printf("=== test_session_payment_method ===\n");
     memset(&g_test_config, 0, sizeof(g_test_config));
     strncpy(g_test_config.metric, "milliseconds", sizeof(g_test_config.metric) - 1);
-    g_granted_count = 0;
 
-    printf("\n--- session_create sets PAYMENT_METHOD_CASHU ---\n");
-    session_manager_init();
-    session_t *s1 = session_create(0x0A010001, 60000);
+    printf("\n--- tollgate_core_session_create sets TG_PAYMENT_CASHU ---\n");
+    tollgate_core_session_init();
+    tg_session_t *s1 = tollgate_core_session_create(0x0A010001, 60000);
     ASSERT(s1 != NULL, "session created");
-    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s1->payment_method, "cashu session has PAYMENT_METHOD_CASHU");
+    ASSERT_EQ_INT(TG_PAYMENT_CASHU, (int)s1->payment_method, "cashu session has TG_PAYMENT_CASHU");
 
-    printf("\n--- session_create_bytes sets PAYMENT_METHOD_BYTES ---\n");
-    session_manager_init();
-    g_granted_count = 0;
-    session_t *s2 = session_create_bytes(0x0A010002, 1048576);
+    printf("\n--- tollgate_core_session_create_bytes sets TG_PAYMENT_BYTES ---\n");
+    tollgate_core_session_init();
+    tg_session_t *s2 = tollgate_core_session_create_bytes(0x0A010002, 1048576);
     ASSERT(s2 != NULL, "bytes session created");
-    ASSERT_EQ_INT(PAYMENT_METHOD_BYTES, (int)s2->payment_method, "bytes session has PAYMENT_METHOD_BYTES");
+    ASSERT_EQ_INT(TG_PAYMENT_BYTES, (int)s2->payment_method, "bytes session has TG_PAYMENT_BYTES");
     ASSERT_EQ_UINT64(1048576, s2->allotment_bytes, "allotment_bytes set");
     ASSERT_EQ_UINT64(0, s2->bytes_consumed, "bytes_consumed starts at 0");
 
-    printf("\n--- payment_method_t enum values are distinct ---\n");
-    ASSERT(PAYMENT_METHOD_CASHU != PAYMENT_METHOD_MINING, "CASHU != MINING");
-    ASSERT(PAYMENT_METHOD_CASHU != PAYMENT_METHOD_BYTES, "CASHU != BYTES");
-    ASSERT(PAYMENT_METHOD_MINING != PAYMENT_METHOD_BYTES, "MINING != BYTES");
+    printf("\n--- tg_payment_method_t enum values are distinct ---\n");
+    ASSERT(TG_PAYMENT_CASHU != TG_PAYMENT_MINING, "CASHU != MINING");
+    ASSERT(TG_PAYMENT_CASHU != TG_PAYMENT_BYTES, "CASHU != BYTES");
+    ASSERT(TG_PAYMENT_MINING != TG_PAYMENT_BYTES, "MINING != BYTES");
 
     printf("\n--- session extend preserves payment_method ---\n");
-    session_manager_init();
-    g_granted_count = 0;
-    session_t *s3 = session_create(0x0A010003, 60000);
-    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s3->payment_method, "initially CASHU");
-    session_extend(s3, 30000);
-    ASSERT_EQ_INT(PAYMENT_METHOD_CASHU, (int)s3->payment_method, "still CASHU after extend");
+    tollgate_core_session_init();
+    tg_session_t *s3 = tollgate_core_session_create(0x0A010003, 60000);
+    ASSERT_EQ_INT(TG_PAYMENT_CASHU, (int)s3->payment_method, "initially CASHU");
+    tollgate_core_session_extend(s3, 30000);
+    ASSERT_EQ_INT(TG_PAYMENT_CASHU, (int)s3->payment_method, "still CASHU after extend");
 
     printf("\n--- bytes session allotment_ms is INT64_MAX ---\n");
-    session_manager_init();
-    g_granted_count = 0;
-    session_t *s4 = session_create_bytes(0x0A010004, 2097152);
+    tollgate_core_session_init();
+    tg_session_t *s4 = tollgate_core_session_create_bytes(0x0A010004, 2097152);
     ASSERT(s4->allotment_ms == INT64_MAX, "bytes session has INT64_MAX allotment_ms");
 
     TEST_SUMMARY();
diff --git a/tests/unit/test_stratum_proxy b/tests/unit/test_stratum_proxy
index 542d82f..ca6a07a 100755
--- a/tests/unit/test_stratum_proxy
+++ b/tests/unit/test_stratum_proxy
diff --git a/tests/unit/test_stratum_proxy.c b/tests/unit/test_stratum_proxy.c
index 7788911..6ad9d9e 100644
--- a/tests/unit/test_stratum_proxy.c
+++ b/tests/unit/test_stratum_proxy.c
@@ -1,6 +1,6 @@
 #include "test_framework.h"
 #include "../../main/stratum_proxy.h"
-#include "../../main/mining_payment.h"
+#include "tollgate_core_mining.h"
 #include <stdio.h>
 #include <string.h>
 
@@ -8,7 +8,7 @@ int main(void)
 {
     printf("=== test_stratum_proxy ===\n");
 
-    mining_payment_init();
+    tollgate_core_mining_init();
 
     printf("\n--- stratum_proxy_set_job / get_current_job ---\n");
     {
@@ -42,7 +42,7 @@ int main(void)
 
     printf("\n--- stratum_proxy_get_stats ---\n");
     {
-        mining_set_current_nbits(0x170309E2);
+        tollgate_core_mining_set_current_nbits(0x170309E2);
         stratum_proxy_set_job(&(stratum_job_t){
             .job_id = 1,
             .nbits = 0x170309E2,