diff --git a/roles/0-init/tasks/first_run.yml b/roles/0-init/tasks/first_run.yml
index 666103396..332da85b7 100644
--- a/roles/0-init/tasks/first_run.yml
+++ b/roles/0-init/tasks/first_run.yml
@@ -1,8 +1,2 @@
-- name: Create symlink /usr/bin/iiab-diagnostics
-  file:
-    src: "{{ iiab_dir }}/scripts/iiab-diagnostics"
-    dest: /usr/bin/iiab-diagnostics
-    state: link
-
 - name: Create {{ iiab_ini_file }}
   include_tasks: iiab_ini.yml
diff --git a/roles/0-init/tasks/main.yml b/roles/0-init/tasks/main.yml
index b6e4ac735..8cfed2864 100644
--- a/roles/0-init/tasks/main.yml
+++ b/roles/0-init/tasks/main.yml
@@ -15,6 +15,20 @@
   include_tasks: first_run.yml
   when: first_run | bool
 
+# Copies the latest/known version of iiab-diagnostics into /usr/bin (so it can
+# be run even if local source tree /opt/iiab/iiab is deleted to conserve disk).
+- name: Copy /opt/iiab/iiab/scripts/iiab-diagnostics to /usr/bin/iiab-diagnostics
+  copy:
+    src: "{{ iiab_dir }}/scripts/iiab-diagnostics"
+    dest: /usr/bin/
+    mode: 0755
+
+- name: Create globally-writable directory /etc/iiab/diag so non-root users can run iiab-diagnostics
+  file:
+    state: directory
+    path: /etc/iiab/diag
+    mode: 0777
+
 - name: Re-read local_facts.facts from /etc/ansible/facts.d
   setup:
     filter: ansible_local
diff --git a/scripts/iiab-diagnostics b/scripts/iiab-diagnostics
index 25d743d46..696bf9432 100755
--- a/scripts/iiab-diagnostics
+++ b/scripts/iiab-diagnostics
@@ -1,7 +1,8 @@
 #!/bin/bash
 
 # Collect IIAB diagnostic info into 1 file for easy online/offline circulation!
-# PLEASE SEE iiab-diagnostics.README.md
+# PLEASE SEE /opt/iiab/iiab/scripts/iiab-diagnostics.README.md OR ONLINE HERE:
+# https://github.com/iiab/iiab/blob/master/scripts/iiab-diagnostics.README.md
 
 IIAB_RELEASE=`cat /etc/iiab/iiab.env | grep IIAB_RELEASE | cut -d'=' -f2`
 OS_VER=`cat /etc/iiab/iiab.env | grep OS_VER | cut -d'=' -f2`
@@ -10,10 +11,13 @@ HASH1=`cd /opt/iiab/iiab; git log --pretty=format:'%H' -n 1`
 HASH2=`cd /opt/iiab/iiab-admin-console; git log --pretty=format:'%H' -n 1`
 YMDT=$(date +%F_%T_%Z)
 
-echo -e "\nAccelerate troubleshooting by collecting your IIAB diagnostics into 1 file:"
-echo -e "\n   sudo iiab-diagnostics"
-echo -e "   sudo iiab-diagnostics PATH/FILE1 PATH/FILE2 ..."
-echo -ne "\nCan you provide a \e[1mshort public nickname:\e[0m (no spaces!) "
+echo -e "\nGathers IIAB diagnostics into 1 file, to accelerate troubleshooting.  USAGE:"
+echo
+echo -e "   iiab-diagnostics"
+echo -e "   sudo iiab-diagnostics                                # USE 'sudo' FOR MORE"
+echo -e "   sudo iiab-diagnostics PATH/FILE1 PATH/FILE2 ...      # COMPLETE RESULTS !!"
+echo
+echo -ne "Can you provide a \e[1mshort public nickname:\e[0m (no spaces!) "
 read nickname < /dev/tty
 if [ -z "$nickname" ]; then
     nickname="NONAME"
@@ -21,8 +25,10 @@ fi
 
 # Build up a meaningful shared filename for DEV / IMPLEM / LEARNING team(s)
 outfile=/etc/iiab/diag/${IIAB_RELEASE}_${OS_VER}_${YMDT}_$nickname
-# System "snapshots" (time-stamped output from this 'iiab-diagnostics' command) will be stored in this directory.  A bit like system logs, but only on request.
-mkdir -p /etc/iiab/diag
+
+# System "snapshots" (time-stamped output from this 'iiab-diagnostics' command)
+# will be stored in globally-writable directory /etc/iiab/diag as created by
+# roles/0-init/tasks/main.yml.  A bit like system logs, but only on request.
 
 function cat_file_raw() {    # $1 = path/filename; $2 = # of lines, for tail
     if [ -f $1 ]; then
@@ -94,24 +100,33 @@ function cat_tail() {     # $1 = path/filename; $2 = # of lines, for tail
 # START BUILDING UP THE FILE THAT'LL CONTAIN THE DIAGNOSTICS!
 echo -e "\nCompiling diagnostics..."
 
-echo -e "\n  0. Header/Hashes/OS"
+echo -e "\n  0. Filename Header + Git Hashes + Raspberry Pi Model + OS"
 echo "This is: $outfile" >> $outfile
 echo >> $outfile
+echo -e "\n\n\n\n0. GIT HASHES + RASPBERRY PI MODEL + OS" >> $outfile
+echo >> $outfile
 echo "iiab commit:               $HASH1" >> $outfile
 echo "iiab-admin-console commit: $HASH2" >> $outfile
 echo >> $outfile
-echo -n "Checking /etc/rpi-issue for Raspbian OS version... " >> $outfile
+cat_file /sys/firmware/devicetree/base/model
+cat_file /etc/rpi-issue
+echo "-IIAB-EXPLANATION-OF-THE-ABOVE-------------------------------------------------" >> $outfile
+echo >> $outfile
 if [ -f /etc/rpi-issue ]; then
+    echo "stage2 = Raspbian Lite" >> $outfile
+    echo "stage4 = Raspbian With Desktop" >> $outfile
+    echo "stage5 = Raspbian With Desktop + Recommended Software" >> $outfile
     echo >> $outfile
-    cat /etc/rpi-issue >> $outfile
-    echo >> $outfile
-    echo "stage2 = lite; stage5 = desktop SEE https://github.com/RPi-Distro/pi-gen#stage-anatomy" >> $outfile
+    echo "SEE https://github.com/RPi-Distro/pi-gen#stage-anatomy" >> $outfile
 else
-    echo "Not a Raspberry Pi!" >> $outfile
+    echo "(This is NOT a Raspberry Pi!)" >> $outfile
 fi
 echo >> $outfile
+cat_file /etc/issue.net
+cat_file /etc/debian_version
 
-echo -e '\n  1. Files specially requested: (for "iiab-diagnostics PATH/FILE1 PATH/FILE2")\n'
+echo -e '\n\n  1. Files Specially Requested: (from "iiab-diagnostics PATH/FILE1 PATH/FILE2")\n'
+echo -e '\n\n\n\n1. FILES SPECIALLY REQUESTED (FROM "iiab-diagnostics PATH/FILE1 PATH/FILE2")\n' >> $outfile
 for f in "$@"; do
     cat_file $f
 done
@@ -121,6 +136,7 @@ if [ $# -eq 0 ]; then
 else
     echo -e "\n  2. Regular Files:\n"
 fi
+echo -e "\n\n\n\n2. REGULAR FILES\n" >> $outfile
 #cat_file /dev/sda                    # Device "file" test
 #cat_file /nonsense                   # Non-existence test
 #cat_file /opt/iiab/iiab              # Directory test
@@ -134,7 +150,6 @@ cat_file /etc/iiab/local_vars.yml
 cat_file /etc/iiab/config_vars.yml
 cat_file /etc/resolv.conf
 cat_file /etc/network/interfaces
-cat_file /usr/bin/iiab-gen-iptables
 
 # Record all Ansible variables: SLOW! OUTPUT TOO LARGE?
 #pushd /opt/iiab/iiab > /dev/null
@@ -142,7 +157,8 @@ cat_file /usr/bin/iiab-gen-iptables
 #popd > /dev/null
 #cat_file /tmp/all-ansible-vars
 
-echo -e "\n  3. Content of Directories, 1-level deep:\n"
+echo -e "\n  3. Content of Directories: (1-level deep)\n"
+echo -e "\n\n\n\n3. CONTENT OF DIRECTORIES (1-LEVEL DEEP)\n" >> $outfile
 cat_dir /etc/network/interfaces.d
 cat_dir /etc/systemd/network
 cat_dir /etc/NetworkManager/system-connections
@@ -151,6 +167,7 @@ cat_dir /etc/netplan
 #cat_dir /etc/network    # Above file /etc/network/interfaces suffices
 
 echo -e "\n  4. Output of Commands:\n"
+echo -e "\n\n\n\n\n4. OUTPUT OF COMMANDS\n" >> $outfile
 cat_cmd 'uname -a' 'Linux kernel'
 cat_cmd 'free' 'RAM memory'
 cat_cmd 'lscpu' 'CPU details'
@@ -161,13 +178,19 @@ cat_cmd 'ip addr' 'Network interfaces'
 cat_cmd 'ifconfig' 'Network interfaces (old view)'
 cat_cmd 'brctl show' 'Bridge for LAN side'
 cat_cmd 'netstat -rn' 'Routing table'
-cat_cmd 'netstat -natp' 'Ports/Services in use'
-cat_cmd 'iptables-save' 'Firewall rules'
+cat_cmd 'sudo netstat -natp' 'Ports/Services in use'
 cat_cmd 'systemctl status dnsmasq' 'Is dnsmasq Ok?'
-cat_cmd 'journalctl -u dnsmasq' 'dnsmasq log'
-#cat_cmd 'ansible localhost -m setup 2>/dev/null' 'All Ansible facts'    # For cleaner scraping of Ansible vars, consider "./runrole all-vars /tmp/all-ansible-vars" 15-19 lines above?
+cat_cmd 'sudo journalctl -u dnsmasq' 'dnsmasq log'
+cat_cmd 'env' 'Environment variables'
+#cat_cmd 'ansible localhost -m setup 2>/dev/null' 'All Ansible facts'    # For cleaner scraping of Ansible vars, consider "./runrole all-vars /tmp/all-ansible-vars" 27-31 lines above?
 
-echo -e "\n  5. Log Files: (last 100 lines of each)\n"
+echo -e "\n  5. Firewall Rules:\n"
+echo -e "\n\n\n\n5. FIREWALL RULES\n" >> $outfile
+cat_file /usr/bin/iiab-gen-iptables
+cat_cmd 'sudo iptables-save' 'Firewall rules'
+
+echo -e "\n  6. Log Files: (last 100 lines of each)\n"
+echo -e "\n\n\n\n6. LOG FILES (LAST 100 LINES OF EACH)\n" >> $outfile
 cat_tail /opt/iiab/iiab/iiab-install.log 100
 cat_tail /opt/iiab/iiab/iiab-network.log 100
 cat_tail /opt/iiab/iiab/iiab-debug.log 100
@@ -175,5 +198,25 @@ cat_tail /opt/iiab/iiab-admin-console/admin-install.log 100
 
 linecount=$(wc -l $outfile | sed 's/\s.*$//')
 sizecount=$(du -h $outfile | sed 's/\s.*$//')
-echo -e "\n\e[32mCOMPLETE! To share this on the web ($sizecount, $linecount lines) run:\e[0m"
-echo -e "\n\e[1mpastebinit < $outfile\e[0m\n"
+echo -e "\n\e[32m\e[1mCOMPLETE! Your diagnostics file ($sizecount, $linecount lines) is:"
+echo
+echo -e "   $outfile\e[0m"
+
+#if [ "$1" == "-y" ]; then
+#    ans="y"    # if user ran "iiab-diganostics -y" to avoid interactive prompt
+#else
+echo
+echo -ne "\e[42;1mPublish it to a web pastebin? [Y/n]\e[0m "
+read ans < /dev/tty
+#fi
+
+echo -e "\e[1m"
+if [ "$ans" == "" ] || [ "$ans" == "y" ] || [ "$ans" == "Y" ]; then
+    echo -ne "PUBLISHING TO URL... "
+    pastebinit < $outfile
+else
+    echo -e "If you later decide to publish it, run:"
+    echo
+    echo -e "   pastebinit < $outfile"
+fi
+echo -e "\e[0m"
diff --git a/scripts/iiab-diagnostics.README.md b/scripts/iiab-diagnostics.README.md
index 133939e43..bd3e4d53a 100644
--- a/scripts/iiab-diagnostics.README.md
+++ b/scripts/iiab-diagnostics.README.md
@@ -2,29 +2,39 @@
 
 To streamline troubleshooting of remote Internet-in-a-Box (IIAB) installations, we bundle up common machine/software diagnostics, all together in 1 human-readable small file, that can be easily circulated online AND offline.
 
-The ``pastebinit`` command can then be used to upload this file, creating a short URL that makes it easier to pass around.
+The ``pastebinit`` command can then be used to auto-upload this file, creating a short URL that makes it easier to pass around.
 
-But first off, the file is compiled by harvesting 5 main kinds of things:
+But first off, the file is compiled by harvesting 1 + 6 kinds of things:
+
+0. Filename Header + Git Hashes + Raspberry Pi Model + OS
 
 1. Files specially requested (if you run ``sudo iiab-diagnostics PATH/FILE1 PATH/FILE2``)
 
 2. Regular Files
 
-3. Content of Directories, 1-level deep
+3. Content of Directories (1-level deep)
 
 4. Output of Commands
 
-5. Log Files: (last 100 lines of each)
+5. Firewall Rules
+
+6. Log Files (last 100 lines of each)
 
 ## Usage 
 
 1. Run it as follows:
 
+   ```
+   iiab-diagnostics
+   ```
+
+   Better yet, for [more complete results](https://github.com/iiab/iiab/pull/2000#issue-327506999), run it as root:
+
    ```
    sudo iiab-diagnostics
    ```
 
-   To bundle in more files, run:
+   To bundle in yet more files, run:
 
    ```
    sudo iiab-diagnostics PATH/FILE1 PATH/FILE2 ...
@@ -32,13 +42,15 @@ But first off, the file is compiled by harvesting 5 main kinds of things:
 
    ( All diagnostics will be bundled up into a single human-readable file, placed in: /etc/iiab/diag/ )
 
-2. Make sure you're online, and upload the new file using the ``pastebinit`` command:
+2. Make sure you're online, as you will be prompted to auto-publish your newly-compiled diagnostics file to a web pastebin.
+
+   Or, you can later/manually upload it using the ``pastebinit`` command:
 
    ```
    pastebinit < /etc/iiab/diag/NEW-FILE-NAME
    ```
-   
-   This will generate an actual web link (URL).
+
+   Either way, this will generate an actual web link (URL).
 
 3. Post this link (URL) to a "New issue" at https://github.com/iiab/iiab/issues
 
@@ -48,4 +60,4 @@ But first off, the file is compiled by harvesting 5 main kinds of things:
 
 ## Source Code
 
-Please look over the bottom of [iiab-diagnostics](iiab-diagnostics) to learn more about which common IIAB files and commands make this rapid troubleshooting possible.
+Please look over the bottom of [iiab-diagnostics](iiab-diagnostics) (lines 100-197 especially) to learn more about which common IIAB files and commands make this rapid troubleshooting possible.