diff --git a/handlers/system.py b/handlers/system.py
index 7cd0942..207c3bf 100644
--- a/handlers/system.py
+++ b/handlers/system.py
@@ -11,6 +11,8 @@ from keyboards import (
     system_logs_audit_kb,
     system_logs_security_kb,
     system_logs_integrations_kb,
+    system_logs_kb,
+    openwrt_kb,
 )
 from system_checks import security, disks, hardware, list_disks, smart_last_test
 from services.http_checks import get_url_checks, check_url
@@ -208,14 +210,14 @@ async def openwrt_status(msg: Message):
     if not is_admin_msg(msg):
         return
 
-    await msg.answer("⏳ Checking OpenWrt…", reply_markup=system_info_kb)
+    await msg.answer("⏳ Checking OpenWrt…", reply_markup=openwrt_kb)
 
     async def worker():
         try:
             text = await get_openwrt_status(cfg)
         except Exception as e:
             text = f"⚠️ OpenWrt error: {e}"
-        await msg.answer(text, reply_markup=system_info_kb)
+        await msg.answer(text, reply_markup=openwrt_kb)
 
     asyncio.create_task(worker())
 
@@ -231,14 +233,14 @@ async def openwrt_cmd(msg: Message):
 async def openwrt_wan(msg: Message):
     if not is_admin_msg(msg):
         return
-    await msg.answer("⏳ Checking OpenWrt WAN…", reply_markup=system_info_kb)
+    await msg.answer("⏳ Checking OpenWrt WAN…", reply_markup=openwrt_kb)
 
     async def worker():
         try:
             text = await get_openwrt_status(cfg, mode="wan")
         except Exception as e:
             text = f"⚠️ OpenWrt error: {e}"
-        await msg.answer(text, reply_markup=system_info_kb)
+        await msg.answer(text, reply_markup=openwrt_kb)
 
     asyncio.create_task(worker())
 
@@ -247,14 +249,14 @@ async def openwrt_wan(msg: Message):
 async def openwrt_clients(msg: Message):
     if not is_admin_msg(msg):
         return
-    await msg.answer("⏳ Checking OpenWrt clients…", reply_markup=system_info_kb)
+    await msg.answer("⏳ Checking OpenWrt clients…", reply_markup=openwrt_kb)
 
     async def worker():
         try:
             text = await get_openwrt_status(cfg, mode="clients")
         except Exception as e:
             text = f"⚠️ OpenWrt error: {e}"
-        await msg.answer(text, reply_markup=system_info_kb)
+        await msg.answer(text, reply_markup=openwrt_kb)
 
     asyncio.create_task(worker())
 
@@ -263,30 +265,31 @@ async def openwrt_clients(msg: Message):
 async def openwrt_leases(msg: Message):
     if not is_admin_msg(msg):
         return
-    await msg.answer("⏳ Checking OpenWrt leases…", reply_markup=system_info_kb)
+    await msg.answer("⏳ Checking OpenWrt leases…", reply_markup=openwrt_kb)
 
     async def worker():
         try:
             text = await get_openwrt_status(cfg, mode="leases")
         except Exception as e:
             text = f"⚠️ OpenWrt error: {e}"
-        await msg.answer(text, reply_markup=system_info_kb)
+        await msg.answer(text, reply_markup=openwrt_kb)
 
     asyncio.create_task(worker())
 
 
 @dp.message(F.text == "/openwrt_fast")
+@dp.message(F.text == "🌐 WAN fast")
 async def openwrt_fast(msg: Message):
     if not is_admin_msg(msg):
         return
-    await msg.answer("⏳ OpenWrt fast…", reply_markup=system_info_kb)
+    await msg.answer("⏳ OpenWrt fast…", reply_markup=openwrt_kb)
 
     async def worker():
         try:
             text = await get_openwrt_status(cfg, mode="wan")
         except Exception as e:
             text = f"⚠️ OpenWrt error: {e}"
-        await msg.answer(text, reply_markup=system_info_kb)
+        await msg.answer(text, reply_markup=openwrt_kb)
 
     asyncio.create_task(worker())
 
@@ -332,6 +335,17 @@ async def incidents(msg: Message):
     await msg.answer(text, reply_markup=system_logs_audit_kb, parse_mode="Markdown")
 
 
+@dp.message(F.text == "🧾 Incidents")
+async def incidents_entry(msg: Message):
+    if not is_admin_msg(msg):
+        return
+    await msg.answer(
+        "📣 Incidents menu:\n"
+        "- Summary\n- Diff\n- Heatmap\n- Export/All\n- Alerts log",
+        reply_markup=system_logs_audit_kb,
+    )
+
+
 @dp.message(F.text == "/incidents_summary")
 async def incidents_summary(msg: Message):
     if not is_admin_msg(msg):
@@ -607,13 +621,13 @@ async def docker_restarts(msg: Message):
 async def openwrt_leases_diff(msg: Message):
     if not is_admin_msg(msg):
         return
-    await msg.answer("⏳ OpenWrt leases diff…", reply_markup=system_info_kb)
+    await msg.answer("⏳ OpenWrt leases diff…", reply_markup=openwrt_kb)
 
     async def worker():
         try:
             leases_now = await fetch_openwrt_leases(cfg)
         except Exception as e:
-            await msg.answer(f"⚠️ OpenWrt error: {e}", reply_markup=system_info_kb)
+            await msg.answer(f"⚠️ OpenWrt error: {e}", reply_markup=openwrt_kb)
             return
         prev = runtime_state.get("openwrt_leases_prev", [])
         if not prev:
@@ -634,12 +648,12 @@ async def openwrt_leases_diff(msg: Message):
         if len(added) > 50 or len(removed) > 50:
             lines.append("… trimmed")
         runtime_state.set_state("openwrt_leases_prev", leases_now)
-        await msg.answer("\n".join(lines), reply_markup=system_info_kb)
+        await msg.answer("\n".join(lines), reply_markup=openwrt_kb)
 
     asyncio.create_task(worker())
 
 
-@dp.message(F.text == "/queue_sla")
+@dp.message(F.text.in_({"/queue_sla", "📊 Queue SLA"}))
 async def queue_sla(msg: Message):
     if not is_admin_msg(msg):
         return
diff --git a/keyboards.py b/keyboards.py
index c199bb1..66e0d9b 100644
--- a/keyboards.py
+++ b/keyboards.py
@@ -10,7 +10,7 @@ menu_kb = ReplyKeyboardMarkup(
     keyboard=[
         [KeyboardButton(text="🩺 Health"), KeyboardButton(text="📊 Статус")],
         [KeyboardButton(text="🐳 Docker"), KeyboardButton(text="📦 Backup")],
-        [KeyboardButton(text="🧉 Artifacts"), KeyboardButton(text="⚙️ System")],
+        [KeyboardButton(text="🧾 Incidents"), KeyboardButton(text="⚙️ System")],
         [KeyboardButton(text="ℹ️ Help")],
     ],
     resize_keyboard=True,
@@ -20,7 +20,8 @@ docker_kb = ReplyKeyboardMarkup(
     keyboard=[
         [KeyboardButton(text="🐳 Status"), KeyboardButton(text="🧰 Arcane")],
         [KeyboardButton(text="🔄 Restart"), KeyboardButton(text="📜 Logs")],
-        [KeyboardButton(text="📈 Stats"), KeyboardButton(text="⬅️ Назад")],
+        [KeyboardButton(text="📈 Stats"), KeyboardButton(text="/docker_restarts")],
+        [KeyboardButton(text="⬅️ Назад")],
     ],
     resize_keyboard=True,
 )
@@ -37,9 +38,8 @@ backup_kb = ReplyKeyboardMarkup(
     keyboard=[
         [KeyboardButton(text="📦 Status"), KeyboardButton(text="📦 Last snapshot")],
         [KeyboardButton(text="📊 Repo stats"), KeyboardButton(text="🧯 Restore help")],
-        [KeyboardButton(text="▶️ Run backup"), KeyboardButton(text="🧾 Queue")],
-        [KeyboardButton(text="🧪 Restic check"), KeyboardButton(text="📬 Weekly report"), KeyboardButton(text="📜 History")],
-        [KeyboardButton(text="⬅️ Назад")],
+        [KeyboardButton(text="▶️ Run backup"), KeyboardButton(text="🧾 Queue"), KeyboardButton(text="/queue_sla")],
+        [KeyboardButton(text="/backup_sla"), KeyboardButton(text="📜 History"), KeyboardButton(text="⬅️ Назад")],
     ],
     resize_keyboard=True,
 )
@@ -84,6 +84,7 @@ system_logs_kb = ReplyKeyboardMarkup(
     keyboard=[
         [KeyboardButton(text="🧾 Audit/Incidents"), KeyboardButton(text="🔒 Security")],
         [KeyboardButton(text="🧩 Integrations"), KeyboardButton(text="🧰 Processes")],
+        [KeyboardButton(text="/incidents_summary"), KeyboardButton(text="/alerts_heatmap")],
         [KeyboardButton(text="⬅️ System")],
     ],
     resize_keyboard=True,
@@ -92,6 +93,8 @@ system_logs_kb = ReplyKeyboardMarkup(
 system_logs_audit_kb = ReplyKeyboardMarkup(
     keyboard=[
         [KeyboardButton(text="🧾 Audit"), KeyboardButton(text="📣 Incidents")],
+        [KeyboardButton(text="/incidents_diff"), KeyboardButton(text="/incidents_export")],
+        [KeyboardButton(text="/export_all"), KeyboardButton(text="/alerts_log")],
         [KeyboardButton(text="⬅️ Logs")],
     ],
     resize_keyboard=True,
@@ -122,6 +125,17 @@ system_logs_tools_kb = ReplyKeyboardMarkup(
     resize_keyboard=True,
 )
 
+# OpenWrt submenu (4 ряда)
+openwrt_kb = ReplyKeyboardMarkup(
+    keyboard=[
+        [KeyboardButton(text="🌐 WAN fast"), KeyboardButton(text="📡 OpenWrt")],
+        [KeyboardButton(text="/openwrt_clients"), KeyboardButton(text="/openwrt_leases")],
+        [KeyboardButton(text="/openwrt_leases_diff")],
+        [KeyboardButton(text="⬅️ System")],
+    ],
+    resize_keyboard=True,
+)
+
 
 def docker_inline_kb(action: str) -> InlineKeyboardMarkup:
     rows = []