diff --git a/.gitignore b/.gitignore
index faaf13e..ddf851d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,7 @@ build/
 build-*/
 **/build/
 **/build-*/
+**/build_*/
 /twister-out*/
 
 # West workspace (recreated by west init/update)
@@ -41,6 +42,7 @@ rtt_*.log
 *.obj
 *.o
 *.a
+*.zip
 
 # OS junk
 .DS_Store
diff --git a/zephcore/adapters/datastore/ZephyrDataStore.cpp b/zephcore/adapters/datastore/ZephyrDataStore.cpp
index 0332812..32900fa 100644
--- a/zephcore/adapters/datastore/ZephyrDataStore.cpp
+++ b/zephcore/adapters/datastore/ZephyrDataStore.cpp
@@ -396,7 +396,8 @@ void ZephyrDataStore::loadPrefs(NodePrefs &prefs)
 	off += 4;
 	prefs.advert_loc_policy = buf[off++];
 	prefs.multi_acks = buf[off++];
-	off += 2;
+	prefs.path_hash_mode = buf[off++];
+	off += 1;
 	memcpy(&prefs.ble_pin, &buf[off], sizeof(uint32_t));
 	off += 4;
 	prefs.buzzer_quiet = buf[off++];
@@ -456,8 +457,8 @@ void ZephyrDataStore::savePrefs(const NodePrefs &prefs)
 	off += 4;
 	buf[off++] = prefs.advert_loc_policy;
 	buf[off++] = prefs.multi_acks;
-	memcpy(&buf[off], pad, 2);
-	off += 2;
+	buf[off++] = prefs.path_hash_mode;
+	buf[off++] = 0;  // pad
 	memcpy(&buf[off], &prefs.ble_pin, sizeof(uint32_t));
 	off += 4;
 	buf[off++] = prefs.buzzer_quiet;
diff --git a/zephcore/app/CompanionMesh.cpp b/zephcore/app/CompanionMesh.cpp
index 370ced8..c520f8f 100644
--- a/zephcore/app/CompanionMesh.cpp
+++ b/zephcore/app/CompanionMesh.cpp
@@ -71,6 +71,7 @@ LOG_MODULE_REGISTER(zephcore_companion, CONFIG_ZEPHCORE_MAIN_LOG_LEVEL);
 #define CMD_SET_AUTOADD_CONFIG   0x3A
 #define CMD_GET_AUTOADD_CONFIG   0x3B
 #define CMD_GET_ALLOWED_REPEAT_FREQ 0x3C
+#define CMD_SET_PATH_HASH_MODE      0x3D
 
 /* Response packet types */
 #define PACKET_OK               0x00
@@ -191,24 +192,24 @@ bool CompanionMesh::allowPacketForward(const mesh::Packet *packet)
 void CompanionMesh::sendFloodScoped(const ContactInfo &recipient, mesh::Packet *pkt, uint32_t delay_millis)
 {
 	if (_send_scope.isNull()) {
-		sendFlood(pkt, delay_millis);
+		sendFlood(pkt, delay_millis, prefs.path_hash_mode + 1);
 	} else {
 		uint16_t codes[2];
 		codes[0] = _send_scope.calcTransportCode(pkt);
 		codes[1] = 0;
-		sendFlood(pkt, codes, delay_millis);
+		sendFlood(pkt, codes, delay_millis, prefs.path_hash_mode + 1);
 	}
 }
 
 void CompanionMesh::sendFloodScoped(const mesh::GroupChannel &channel, mesh::Packet *pkt, uint32_t delay_millis)
 {
 	if (_send_scope.isNull()) {
-		sendFlood(pkt, delay_millis);
+		sendFlood(pkt, delay_millis, prefs.path_hash_mode + 1);
 	} else {
 		uint16_t codes[2];
 		codes[0] = _send_scope.calcTransportCode(pkt);
 		codes[1] = 0;
-		sendFlood(pkt, codes, delay_millis);
+		sendFlood(pkt, codes, delay_millis, prefs.path_hash_mode + 1);
 	}
 }
 
@@ -329,7 +330,7 @@ size_t CompanionMesh::serializeContact(uint8_t *buf, const ContactInfo &c, uint8
 	memcpy(&buf[i], c.id.pub_key, PUB_KEY_SIZE); i += PUB_KEY_SIZE;
 	buf[i++] = c.type;
 	buf[i++] = c.flags;
-	buf[i++] = (c.out_path_len < 0) ? 0xFF : (uint8_t)c.out_path_len;
+	buf[i++] = c.out_path_len;
 	memcpy(&buf[i], c.out_path, MAX_PATH_SIZE); i += MAX_PATH_SIZE;
 	StrHelper::strzcpy((char *)&buf[i], c.name, 32); i += 32;
 	put_le32(&buf[i], c.last_advert_timestamp); i += 4;
@@ -517,15 +518,14 @@ void CompanionMesh::onDiscoveredContact(ContactInfo &contact, bool is_new, uint8
 	markContactsDirty();
 
 	// Update advert path table
-	AdvertPath *ap = &_advert_paths[_next_advert_path_idx];
-	memcpy(ap->pubkey_prefix, contact.id.pub_key, 7);
-	ap->path_len = path_len;
-	if (path_len > 0 && path) {
-		memcpy(ap->path, path, (path_len < MAX_PATH_SIZE) ? path_len : MAX_PATH_SIZE);
+	if (path && mesh::Packet::isValidPathLen(path_len)) {
+		AdvertPath *ap = &_advert_paths[_next_advert_path_idx];
+		memcpy(ap->pubkey_prefix, contact.id.pub_key, 7);
+		memcpy(ap->name, contact.name, sizeof(ap->name));
+		ap->recv_timestamp = (uint32_t)getRTCClock()->getCurrentTime();
+		ap->path_len = mesh::Packet::copyPath(ap->path, path, path_len);
+		_next_advert_path_idx = (_next_advert_path_idx + 1) % ADVERT_PATH_TABLE_SIZE;
 	}
-	memcpy(ap->name, contact.name, sizeof(ap->name));
-	ap->recv_timestamp = (uint32_t)getRTCClock()->getCurrentTime();
-	_next_advert_path_idx = (_next_advert_path_idx + 1) % ADVERT_PATH_TABLE_SIZE;
 
 	// Send push notification
 	if (is_new) {
@@ -1090,13 +1090,13 @@ void CompanionMesh::onRawDataRecv(mesh::Packet *packet)
 /* Dispatcher tuning - hard-coded for companion repeat mode (matches Arduino) */
 uint32_t CompanionMesh::getRetransmitDelay(const mesh::Packet *packet)
 {
-	uint32_t t = (_radio->getEstAirtimeFor(packet->path_len + packet->payload_len + 2) * 0.5f);
+	uint32_t t = (_radio->getEstAirtimeFor(packet->getPathByteLen() + packet->payload_len + 2) * 0.5f);
 	return getRNG()->nextInt(0, 5 * t + 1);
 }
 
 uint32_t CompanionMesh::getDirectRetransmitDelay(const mesh::Packet *packet)
 {
-	uint32_t t = (_radio->getEstAirtimeFor(packet->path_len + packet->payload_len + 2) * 0.2f);
+	uint32_t t = (_radio->getEstAirtimeFor(packet->getPathByteLen() + packet->payload_len + 2) * 0.2f);
 	return getRNG()->nextInt(0, 5 * t + 1);
 }
 
@@ -1296,7 +1296,7 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 			memcpy(c.id.pub_key, &data[i], PUB_KEY_SIZE); i += PUB_KEY_SIZE;
 			c.type = data[i++];
 			c.flags = data[i++];
-			c.out_path_len = (int8_t)data[i++];
+			c.out_path_len = data[i++];
 			memcpy(c.out_path, &data[i], MAX_PATH_SIZE); i += MAX_PATH_SIZE;
 			memcpy(c.name, &data[i], 32); i += 32;
 			c.last_advert_timestamp = get_le32(&data[i]); i += 4;
@@ -1664,7 +1664,7 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 		if (adv) {
 			/* Optional param: data[1] == 1 means flood, else zero-hop */
 			if (len >= 2 && data[1] == 1) {
-				sendFlood(adv);
+				sendFlood(adv, (uint32_t)0, prefs.path_hash_mode + 1);
 			} else {
 				sendZeroHop(adv);
 			}
@@ -1814,9 +1814,9 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 			static const uint8_t fw_build[12] = FIRMWARE_BUILD_DATE;
 			static const uint8_t model[40] = CONFIG_ZEPHCORE_BOARD_NAME;
 			static const uint8_t version[20] = "v1.13.0-zephyr";
-			uint8_t rsp[81];
+			uint8_t rsp[82];
 			rsp[0] = PACKET_DEVICE_INFO;
-			rsp[1] = 9;  // FIRMWARE_VER_CODE - v9 = client_repeat support
+			rsp[1] = 10;  // FIRMWARE_VER_CODE - v10 = path_hash_mode support
 			rsp[2] = (MAX_CONTACTS / 2 > 255) ? 255 : (MAX_CONTACTS / 2);  // protocol byte, app multiplies by 2
 			rsp[3] = MAX_GROUP_CHANNELS;
 			put_le32(&rsp[4], prefs.ble_pin ? prefs.ble_pin : 123456);  // BLE PIN
@@ -1824,6 +1824,7 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 			memcpy(&rsp[20], model, 40);
 			memcpy(&rsp[60], version, 20);
 			rsp[80] = prefs.client_repeat;  // v9+: offgrid mode state
+			rsp[81] = prefs.path_hash_mode;  // v10+: path hash mode
 			writeFrame(rsp, sizeof(rsp));
 			return true;
 		}
@@ -2354,7 +2355,7 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 
 				// Temporarily force flood
 				auto save = contact->out_path_len;
-				contact->out_path_len = -1;
+				contact->out_path_len = OUT_PATH_UNKNOWN;
 				int result = sendRequest(*contact, req_data, sizeof(req_data), tag, est_timeout);
 				contact->out_path_len = save;
 
@@ -2389,8 +2390,7 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 				rsp[i++] = PACKET_ADVERT_PATH;
 				put_le32(&rsp[i], ap->recv_timestamp); i += 4;
 				rsp[i++] = ap->path_len;
-				memcpy(&rsp[i], ap->path, ap->path_len);
-				i += ap->path_len;
+				i += mesh::Packet::writePath(&rsp[i], ap->path, ap->path_len);
 				writeFrame(rsp, i);
 			} else {
 				sendPacketError(ERR_NOT_FOUND);
@@ -2526,6 +2526,20 @@ bool CompanionMesh::handleProtocolFrame(const uint8_t *data, size_t len)
 		return true;
 	}
 
+	case CMD_SET_PATH_HASH_MODE:
+		if (len >= 3 && data[1] == 0) {
+			if (data[2] >= 3) {
+				sendPacketError(ERR_ILLEGAL_ARG);
+			} else {
+				prefs.path_hash_mode = data[2];
+				_store->savePrefs(prefs);
+				sendPacketOk();
+			}
+		} else {
+			sendPacketError(ERR_ILLEGAL_ARG);
+		}
+		return true;
+
 	case CMD_SEND_ANON_REQ:
 		if (len >= 1 + PUB_KEY_SIZE + 1) {
 			ContactInfo *contact = lookupContactByPubKey(&data[1], PUB_KEY_SIZE);
diff --git a/zephcore/app/RepeaterMesh.cpp b/zephcore/app/RepeaterMesh.cpp
index 13a7a87..eee5a88 100644
--- a/zephcore/app/RepeaterMesh.cpp
+++ b/zephcore/app/RepeaterMesh.cpp
@@ -142,7 +142,7 @@ uint8_t RepeaterMesh::handleLoginReq(const mesh::Identity& sender, const uint8_t
     }
 
     if (is_flood) {
-        client->out_path_len = -1;
+        client->out_path_len = OUT_PATH_UNKNOWN;
     }
 
     uint32_t now = getRTCClock()->getCurrentTimeUnique();
@@ -159,8 +159,8 @@ uint8_t RepeaterMesh::handleLoginReq(const mesh::Identity& sender, const uint8_t
 
 uint8_t RepeaterMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
     if (anon_limiter.allow(getRTCClock()->getCurrentTime())) {
-        reply_path_len = *data++ & 0x3F;
-        memcpy(reply_path, data, reply_path_len);
+        reply_path_len = *data++;
+        mesh::Packet::copyPath(reply_path, data, reply_path_len);
 
         memcpy(reply_data, &sender_timestamp, 4);
         uint32_t now = getRTCClock()->getCurrentTime();
@@ -173,8 +173,8 @@ uint8_t RepeaterMesh::handleAnonRegionsReq(const mesh::Identity& sender, uint32_
 
 uint8_t RepeaterMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
     if (anon_limiter.allow(getRTCClock()->getCurrentTime())) {
-        reply_path_len = *data++ & 0x3F;
-        memcpy(reply_path, data, reply_path_len);
+        reply_path_len = *data++;
+        mesh::Packet::copyPath(reply_path, data, reply_path_len);
 
         memcpy(reply_data, &sender_timestamp, 4);
         uint32_t now = getRTCClock()->getCurrentTime();
@@ -188,8 +188,8 @@ uint8_t RepeaterMesh::handleAnonOwnerReq(const mesh::Identity& sender, uint32_t
 
 uint8_t RepeaterMesh::handleAnonClockReq(const mesh::Identity& sender, uint32_t sender_timestamp, const uint8_t* data) {
     if (anon_limiter.allow(getRTCClock()->getCurrentTime())) {
-        reply_path_len = *data++ & 0x3F;
-        memcpy(reply_path, data, reply_path_len);
+        reply_path_len = *data++;
+        mesh::Packet::copyPath(reply_path, data, reply_path_len);
 
         memcpy(reply_data, &sender_timestamp, 4);
         uint32_t now = getRTCClock()->getCurrentTime();
@@ -398,7 +398,7 @@ mesh::Packet* RepeaterMesh::createSelfAdvert() {
 
 bool RepeaterMesh::allowPacketForward(const mesh::Packet* packet) {
     if (_prefs.disable_fwd) return false;
-    if (packet->isRouteFlood() && packet->path_len >= _prefs.flood_max) return false;
+    if (packet->isRouteFlood() && packet->getPathHashCount() >= _prefs.flood_max) return false;
     if (packet->isRouteFlood() && recv_pkt_region == nullptr) return false;
     return true;
 }
@@ -476,12 +476,12 @@ int RepeaterMesh::calcRxDelay(float score, uint32_t air_time) const {
 }
 
 uint32_t RepeaterMesh::getRetransmitDelay(const mesh::Packet* packet) {
-    uint32_t t = (_radio->getEstAirtimeFor(packet->path_len + packet->payload_len + 2) * _prefs.tx_delay_factor);
+    uint32_t t = (_radio->getEstAirtimeFor(packet->getPathByteLen() + packet->payload_len + 2) * _prefs.tx_delay_factor);
     return getRNG()->nextInt(0, 3 * t + 1);
 }
 
 uint32_t RepeaterMesh::getDirectRetransmitDelay(const mesh::Packet* packet) {
-    uint32_t t = (_radio->getEstAirtimeFor(packet->path_len + packet->payload_len + 2) * _prefs.direct_tx_delay_factor);
+    uint32_t t = (_radio->getEstAirtimeFor(packet->getPathByteLen() + packet->payload_len + 2) * _prefs.direct_tx_delay_factor);
     return getRNG()->nextInt(0, 3 * t + 1);
 }
 
@@ -508,7 +508,7 @@ void RepeaterMesh::onAnonDataRecv(mesh::Packet* packet, const uint8_t* secret, c
         data[len] = 0;
         uint8_t reply_len;
 
-        reply_path_len = -1;
+        reply_path_len = OUT_PATH_UNKNOWN;
         if (data[4] == 0 || data[4] >= ' ') {
             reply_len = handleLoginReq(sender, secret, timestamp, &data[4], packet->isRouteFlood());
         } else if (data[4] == ANON_REQ_TYPE_REGIONS && packet->isRouteDirect()) {
@@ -526,10 +526,10 @@ void RepeaterMesh::onAnonDataRecv(mesh::Packet* packet, const uint8_t* secret, c
         if (packet->isRouteFlood()) {
             mesh::Packet* path = createPathReturn(sender, secret, packet->path, packet->path_len,
                                                   PAYLOAD_TYPE_RESPONSE, reply_data, reply_len);
-            if (path) sendFlood(path, SERVER_RESPONSE_DELAY);
-        } else if (reply_path_len < 0) {
+            if (path) sendFlood(path, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
+        } else if (reply_path_len == OUT_PATH_UNKNOWN) {
             mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
-            if (reply) sendFlood(reply, SERVER_RESPONSE_DELAY);
+            if (reply) sendFlood(reply, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
         } else {
             mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, sender, secret, reply_data, reply_len);
             if (reply) sendDirect(reply, reply_path, reply_path_len, SERVER_RESPONSE_DELAY);
@@ -565,7 +565,7 @@ void RepeaterMesh::onAdvertRecv(mesh::Packet* packet, const mesh::Identity& id,
                                 const uint8_t* app_data, size_t app_data_len) {
     mesh::Mesh::onAdvertRecv(packet, id, timestamp, app_data, app_data_len);
 
-    if (packet->path_len == 0 && !isShare(packet)) {
+    if (packet->getPathHashCount() == 0 && !isShare(packet)) {
         AdvertDataParser parser(app_data, app_data_len);
         if (parser.isValid() && parser.getType() == ADV_TYPE_REPEATER) {
             putNeighbour(id, timestamp, packet->getSNR());
@@ -596,14 +596,14 @@ void RepeaterMesh::onPeerDataRecv(mesh::Packet* packet, uint8_t type, int sender
             if (packet->isRouteFlood()) {
                 mesh::Packet* path = createPathReturn(client->id, secret, packet->path, packet->path_len,
                                                       PAYLOAD_TYPE_RESPONSE, reply_data, reply_len);
-                if (path) sendFlood(path, SERVER_RESPONSE_DELAY);
+                if (path) sendFlood(path, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
             } else {
                 mesh::Packet* reply = createDatagram(PAYLOAD_TYPE_RESPONSE, client->id, secret, reply_data, reply_len);
                 if (reply) {
-                    if (client->out_path_len >= 0) {
+                    if (client->out_path_len != OUT_PATH_UNKNOWN) {
                         sendDirect(reply, client->out_path, client->out_path_len, SERVER_RESPONSE_DELAY);
                     } else {
-                        sendFlood(reply, SERVER_RESPONSE_DELAY);
+                        sendFlood(reply, SERVER_RESPONSE_DELAY, packet->getPathHashSize());
                     }
                 }
             }
@@ -630,8 +630,8 @@ void RepeaterMesh::onPeerDataRecv(mesh::Packet* packet, uint8_t type, int sender
                                    client->id.pub_key, PUB_KEY_SIZE);
                 mesh::Packet* ack = createAck(ack_hash);
                 if (ack) {
-                    if (client->out_path_len < 0) {
-                        sendFlood(ack, TXT_ACK_DELAY);
+                    if (client->out_path_len == OUT_PATH_UNKNOWN) {
+                        sendFlood(ack, TXT_ACK_DELAY, packet->getPathHashSize());
                     } else {
                         sendDirect(ack, client->out_path, client->out_path_len, TXT_ACK_DELAY);
                     }
@@ -656,8 +656,8 @@ void RepeaterMesh::onPeerDataRecv(mesh::Packet* packet, uint8_t type, int sender
 
                 auto reply_pkt = createDatagram(PAYLOAD_TYPE_TXT_MSG, client->id, secret, temp, 5 + text_len);
                 if (reply_pkt) {
-                    if (client->out_path_len < 0) {
-                        sendFlood(reply_pkt, CLI_REPLY_DELAY_MILLIS);
+                    if (client->out_path_len == OUT_PATH_UNKNOWN) {
+                        sendFlood(reply_pkt, CLI_REPLY_DELAY_MILLIS, packet->getPathHashSize());
                     } else {
                         sendDirect(reply_pkt, client->out_path, client->out_path_len, CLI_REPLY_DELAY_MILLIS);
                     }
@@ -676,7 +676,7 @@ bool RepeaterMesh::onPeerPathRecv(mesh::Packet* packet, int sender_idx, const ui
     if (i >= 0 && i < acl.getNumClients()) {
         LOG_DBG("PATH to client, path_len=%d", path_len);
         auto client = acl.getClientByIdx(i);
-        memcpy(client->out_path, path, client->out_path_len = path_len);
+        client->out_path_len = mesh::Packet::copyPath(client->out_path, path, path_len);
         client->last_activity = getRTCClock()->getCurrentTime();
     }
     return false;
@@ -829,7 +829,7 @@ void RepeaterMesh::sendSelfAdvertisement(int delay_millis, bool flood) {
     mesh::Packet* pkt = createSelfAdvert();
     if (pkt) {
         if (flood) {
-            sendFlood(pkt, delay_millis);
+            sendFlood(pkt, delay_millis, _prefs.path_hash_mode + 1);
         } else {
             sendZeroHop(pkt, delay_millis);
         }
@@ -1155,7 +1155,7 @@ void RepeaterMesh::loop() {
 
     if (next_flood_advert && millisHasNowPassed(next_flood_advert)) {
         mesh::Packet* pkt = createSelfAdvert();
-        if (pkt) sendFlood(pkt);
+        if (pkt) sendFlood(pkt, (uint32_t)0, _prefs.path_hash_mode + 1);
         updateFloodAdvertTimer();
         updateAdvertTimer();
     } else if (next_local_advert && millisHasNowPassed(next_local_advert)) {
diff --git a/zephcore/app/RepeaterMesh.h b/zephcore/app/RepeaterMesh.h
index c7691a1..6f1a3bb 100644
--- a/zephcore/app/RepeaterMesh.h
+++ b/zephcore/app/RepeaterMesh.h
@@ -86,7 +86,7 @@ class RepeaterMesh : public mesh::Mesh, public CommonCLICallbacks {
     CommonCLI _cli;
     uint8_t reply_data[MAX_PACKET_PAYLOAD];
     uint8_t reply_path[MAX_PATH_SIZE];
-    int8_t reply_path_len;
+    uint8_t reply_path_len;
     TransportKeyStore key_store;
     RegionMap region_map, temp_map;
     RegionEntry* load_stack[8];
diff --git a/zephcore/helpers/BaseChatMesh.cpp b/zephcore/helpers/BaseChatMesh.cpp
index 5e6fc85..b8f8f9b 100644
--- a/zephcore/helpers/BaseChatMesh.cpp
+++ b/zephcore/helpers/BaseChatMesh.cpp
@@ -54,7 +54,7 @@ mesh::Packet *BaseChatMesh::createSelfAdvert(const char *name, double lat, doubl
 
 void BaseChatMesh::sendAckTo(const ContactInfo &dest, uint32_t ack_hash)
 {
-	if (dest.out_path_len < 0) {
+	if (dest.out_path_len == OUT_PATH_UNKNOWN) {
 		mesh::Packet *ack = createAck(ack_hash);
 		if (ack) sendFloodScoped(dest, ack, TXT_ACK_DELAY);
 	} else {
@@ -109,7 +109,7 @@ void BaseChatMesh::populateContactFromAdvert(ContactInfo &ci, const mesh::Identi
 {
 	ci = ContactInfo{};
 	ci.id = id;
-	ci.out_path_len = -1;
+	ci.out_path_len = OUT_PATH_UNKNOWN;
 	StrHelper::strncpy(ci.name, parser.getName(), sizeof(ci.name));
 	ci.type = parser.getType();
 	if (parser.hasLatLon()) {
@@ -294,7 +294,7 @@ void BaseChatMesh::onPeerDataRecv(mesh::Packet *packet, uint8_t type, int sender
 			} else {
 				mesh::Packet *reply = createDatagram(PAYLOAD_TYPE_RESPONSE, from.id, secret, temp_buf, reply_len);
 				if (reply) {
-					if (from.out_path_len >= 0) {
+					if (from.out_path_len != OUT_PATH_UNKNOWN) {
 						sendDirect(reply, from.out_path, from.out_path_len, SERVER_RESPONSE_DELAY);
 					} else {
 						sendFloodScoped(from, reply, SERVER_RESPONSE_DELAY);
@@ -305,7 +305,7 @@ void BaseChatMesh::onPeerDataRecv(mesh::Packet *packet, uint8_t type, int sender
 	} else if (type == PAYLOAD_TYPE_RESPONSE && len > 0) {
 		LOG_INF("onPeerDataRecv: RESPONSE received, len=%d, calling onContactResponse", len);
 		onContactResponse(from, data, len);
-		if (packet->isRouteFlood() && from.out_path_len >= 0) {
+		if (packet->isRouteFlood() && from.out_path_len != OUT_PATH_UNKNOWN) {
 			handleReturnPathRetry(from, packet->path, packet->path_len);
 		}
 	}
@@ -326,7 +326,7 @@ bool BaseChatMesh::onPeerPathRecv(mesh::Packet *packet, int sender_idx, const ui
 bool BaseChatMesh::onContactPathRecv(ContactInfo &from, uint8_t *in_path, uint8_t in_path_len,
 	uint8_t *out_path, uint8_t out_path_len, uint8_t extra_type, uint8_t *extra, uint8_t extra_len)
 {
-	memcpy(from.out_path, out_path, from.out_path_len = out_path_len);
+	from.out_path_len = mesh::Packet::copyPath(from.out_path, out_path, out_path_len);
 	from.lastmod = getRTCClock()->getCurrentTime();
 
 	onContactPathUpdated(from);
@@ -351,7 +351,7 @@ void BaseChatMesh::onAckRecv(mesh::Packet *packet, uint32_t ack_crc)
 		txt_send_timeout = 0;
 		packet->markDoNotRetransmit();
 
-		if (packet->isRouteFlood() && from->out_path_len >= 0) {
+		if (packet->isRouteFlood() && from->out_path_len != OUT_PATH_UNKNOWN) {
 			handleReturnPathRetry(*from, packet->path, packet->path_len);
 		}
 	} else {
@@ -429,7 +429,7 @@ int BaseChatMesh::sendMessage(const ContactInfo &recipient, uint32_t timestamp,
 	uint32_t t = _radio->getEstAirtimeFor(pkt->getRawLength());
 
 	int rc;
-	if (recipient.out_path_len < 0) {
+	if (recipient.out_path_len == OUT_PATH_UNKNOWN) {
 		LOG_INF("sendMessage: sending flood");
 		sendFloodScoped(recipient, pkt);
 		txt_send_timeout = futureMillis(est_timeout = calcFloodTimeoutMillisFor(t));
@@ -461,7 +461,7 @@ int BaseChatMesh::sendCommandData(const ContactInfo &recipient, uint32_t timesta
 
 	uint32_t t = _radio->getEstAirtimeFor(pkt->getRawLength());
 	int rc;
-	if (recipient.out_path_len < 0) {
+	if (recipient.out_path_len == OUT_PATH_UNKNOWN) {
 		sendFloodScoped(recipient, pkt);
 		txt_send_timeout = futureMillis(est_timeout = calcFloodTimeoutMillisFor(t));
 		rc = MSG_SEND_SENT_FLOOD;
@@ -556,7 +556,7 @@ int BaseChatMesh::sendLogin(const ContactInfo &recipient, const char *password,
 	}
 	if (pkt) {
 		uint32_t t = _radio->getEstAirtimeFor(pkt->getRawLength());
-		if (recipient.out_path_len < 0) {
+		if (recipient.out_path_len == OUT_PATH_UNKNOWN) {
 			sendFloodScoped(recipient, pkt);
 			est_timeout = calcFloodTimeoutMillisFor(t);
 			return MSG_SEND_SENT_FLOOD;
@@ -584,7 +584,7 @@ int BaseChatMesh::sendAnonReq(const ContactInfo &recipient, const uint8_t *data,
 	}
 	if (pkt) {
 		uint32_t t = _radio->getEstAirtimeFor(pkt->getRawLength());
-		if (recipient.out_path_len < 0) {
+		if (recipient.out_path_len == OUT_PATH_UNKNOWN) {
 			sendFloodScoped(recipient, pkt);
 			est_timeout = calcFloodTimeoutMillisFor(t);
 			return MSG_SEND_SENT_FLOOD;
@@ -613,7 +613,7 @@ int BaseChatMesh::sendRequest(const ContactInfo &recipient, const uint8_t *req_d
 	}
 	if (pkt) {
 		uint32_t t = _radio->getEstAirtimeFor(pkt->getRawLength());
-		if (recipient.out_path_len < 0) {
+		if (recipient.out_path_len == OUT_PATH_UNKNOWN) {
 			sendFloodScoped(recipient, pkt);
 			est_timeout = calcFloodTimeoutMillisFor(t);
 			return MSG_SEND_SENT_FLOOD;
@@ -641,7 +641,7 @@ int BaseChatMesh::sendRequest(const ContactInfo &recipient, uint8_t req_type, ui
 	}
 	if (pkt) {
 		uint32_t t = _radio->getEstAirtimeFor(pkt->getRawLength());
-		if (recipient.out_path_len < 0) {
+		if (recipient.out_path_len == OUT_PATH_UNKNOWN) {
 			sendFloodScoped(recipient, pkt);
 			est_timeout = calcFloodTimeoutMillisFor(t);
 			return MSG_SEND_SENT_FLOOD;
@@ -656,7 +656,7 @@ int BaseChatMesh::sendRequest(const ContactInfo &recipient, uint8_t req_type, ui
 
 void BaseChatMesh::resetPathTo(ContactInfo &recipient)
 {
-	recipient.out_path_len = -1;
+	recipient.out_path_len = OUT_PATH_UNKNOWN;
 }
 
 static ContactInfo *table_sort;  // pass via global for qsort
@@ -897,7 +897,7 @@ void BaseChatMesh::checkConnections()
 				LOG_WRN("checkConnections: keep_alive contact not found");
 				continue;
 			}
-			if (contact->out_path_len < 0) {
+			if (contact->out_path_len == OUT_PATH_UNKNOWN) {
 				LOG_WRN("checkConnections: keep_alive contact has no out_path");
 				continue;
 			}
diff --git a/zephcore/helpers/ClientACL.cpp b/zephcore/helpers/ClientACL.cpp
index 92c73df..b00eb5c 100644
--- a/zephcore/helpers/ClientACL.cpp
+++ b/zephcore/helpers/ClientACL.cpp
@@ -134,7 +134,7 @@ ClientInfo* ClientACL::putClient(const mesh::Identity& id, uint8_t init_perms) {
     c->clear();
     c->permissions = init_perms;
     c->id = id;
-    c->out_path_len = -1;  // initially out_path is unknown
+    c->out_path_len = OUT_PATH_UNKNOWN;  // initially out_path is unknown
     return c;
 }
 
diff --git a/zephcore/helpers/ClientACL.h b/zephcore/helpers/ClientACL.h
index bcc80c0..f7c83f1 100644
--- a/zephcore/helpers/ClientACL.h
+++ b/zephcore/helpers/ClientACL.h
@@ -14,10 +14,12 @@
 #define PERM_ACL_READ_WRITE    2
 #define PERM_ACL_ADMIN         3
 
+#define OUT_PATH_UNKNOWN  0xFF
+
 struct ClientInfo {
     mesh::Identity id;
     uint8_t permissions;
-    int8_t out_path_len;
+    uint8_t out_path_len;
     uint8_t out_path[MAX_PATH_SIZE];
     uint8_t shared_secret[PUB_KEY_SIZE];
     uint32_t last_timestamp;   // by THEIR clock (transient)
diff --git a/zephcore/helpers/CommonCLI.cpp b/zephcore/helpers/CommonCLI.cpp
index 6a160f8..8bc688a 100644
--- a/zephcore/helpers/CommonCLI.cpp
+++ b/zephcore/helpers/CommonCLI.cpp
@@ -79,7 +79,8 @@ void CommonCLI::loadPrefs(const char* path) {
     fs_read(&file, &_prefs->multi_acks, sizeof(_prefs->multi_acks));           // 115
     fs_read(&file, &_prefs->bw, sizeof(_prefs->bw));                           // 116
     fs_read(&file, &_prefs->agc_reset_interval, sizeof(_prefs->agc_reset_interval)); // 120
-    fs_read(&file, pad, 3);                                                     // 121
+    fs_read(&file, &_prefs->path_hash_mode, sizeof(_prefs->path_hash_mode));    // 121
+    fs_read(&file, pad, 2);                                                     // 122
     fs_read(&file, &_prefs->flood_max, sizeof(_prefs->flood_max));             // 124
     fs_read(&file, &_prefs->flood_advert_interval, sizeof(_prefs->flood_advert_interval)); // 125
     fs_read(&file, &_prefs->interference_threshold, sizeof(_prefs->interference_threshold)); // 126
@@ -123,6 +124,7 @@ void CommonCLI::loadPrefs(const char* path) {
 #endif
     _prefs->multi_acks = constrain(_prefs->multi_acks, (uint8_t)0, (uint8_t)1);
     _prefs->adc_multiplier = constrain(_prefs->adc_multiplier, 0.0f, 10.0f);
+    _prefs->path_hash_mode = constrain(_prefs->path_hash_mode, (uint8_t)0, (uint8_t)2);
     _prefs->powersaving_enabled = constrain(_prefs->powersaving_enabled, (uint8_t)0, (uint8_t)1);
     _prefs->gps_enabled = constrain(_prefs->gps_enabled, (uint8_t)0, (uint8_t)1);
     _prefs->advert_loc_policy = constrain(_prefs->advert_loc_policy, (uint8_t)0, (uint8_t)2);
@@ -169,7 +171,8 @@ void CommonCLI::savePrefs(const char* path) {
     fs_write(&file, &_prefs->multi_acks, sizeof(_prefs->multi_acks));
     fs_write(&file, &_prefs->bw, sizeof(_prefs->bw));
     fs_write(&file, &_prefs->agc_reset_interval, sizeof(_prefs->agc_reset_interval));
-    fs_write(&file, pad, 3);
+    fs_write(&file, &_prefs->path_hash_mode, sizeof(_prefs->path_hash_mode));
+    fs_write(&file, pad, 2);
     fs_write(&file, &_prefs->flood_max, sizeof(_prefs->flood_max));
     fs_write(&file, &_prefs->flood_advert_interval, sizeof(_prefs->flood_advert_interval));
     fs_write(&file, &_prefs->interference_threshold, sizeof(_prefs->interference_threshold));
@@ -403,6 +406,8 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
                 sp++;
             }
             *reply = 0;
+        } else if (memcmp(config, "path.hash.mode", 14) == 0) {
+            snprintf(reply, CLI_REPLY_SIZE, "> %d", (uint32_t)_prefs->path_hash_mode);
         } else if (memcmp(config, "tx", 2) == 0 && (config[2] == 0 || config[2] == ' ')) {
             snprintf(reply, CLI_REPLY_SIZE, "> %d", (int)_prefs->tx_power_dbm);
         } else if (memcmp(config, "freq", 4) == 0) {
@@ -581,6 +586,16 @@ void CommonCLI::handleCommand(uint32_t sender_timestamp, const char* command, ch
             *dp = 0;
             savePrefs();
             strcpy(reply, "OK");
+        } else if (memcmp(config, "path.hash.mode ", 15) == 0) {
+            config += 15;
+            uint8_t mode = atoi(config);
+            if (mode < 3) {
+                _prefs->path_hash_mode = mode;
+                savePrefs();
+                strcpy(reply, "OK");
+            } else {
+                strcpy(reply, "Error, must be 0,1, or 2");
+            }
         } else if (memcmp(config, "tx ", 3) == 0) {
             int val = atoi(&config[3]);
 #ifdef CONFIG_ZEPHCORE_MAX_TX_POWER_DBM
diff --git a/zephcore/helpers/ContactInfo.h b/zephcore/helpers/ContactInfo.h
index 1a86a6c..73d8745 100644
--- a/zephcore/helpers/ContactInfo.h
+++ b/zephcore/helpers/ContactInfo.h
@@ -8,12 +8,14 @@
 #include <mesh/Mesh.h>
 #include <mesh/MeshCore.h>
 
+#define OUT_PATH_UNKNOWN   0xFF
+
 struct ContactInfo {
 	mesh::Identity id;
 	char name[32];
 	uint8_t type;
 	uint8_t flags;
-	int8_t out_path_len;
+	uint8_t out_path_len;
 	mutable bool shared_secret_valid;
 	uint8_t out_path[MAX_PATH_SIZE];
 	uint32_t last_advert_timestamp;
diff --git a/zephcore/helpers/NodePrefs.h b/zephcore/helpers/NodePrefs.h
index 81b2f31..703eda1 100644
--- a/zephcore/helpers/NodePrefs.h
+++ b/zephcore/helpers/NodePrefs.h
@@ -68,6 +68,7 @@ struct NodePrefs {
 	uint8_t buzzer_quiet;
 	uint8_t autoadd_config;
 	uint8_t client_repeat;          // 1 = offgrid mode (forward packets), 0 = companion only
+	uint8_t path_hash_mode;         // which path mode to use when sending (0-2)
 };
 
 /* Default prefs — MUST match LoRaConfig.h defaults for radio interop.
diff --git a/zephcore/include/mesh/Dispatcher.h b/zephcore/include/mesh/Dispatcher.h
index 78107c4..8c88c18 100644
--- a/zephcore/include/mesh/Dispatcher.h
+++ b/zephcore/include/mesh/Dispatcher.h
@@ -144,6 +144,7 @@ public:
 	uint32_t futureMillis(int millis_from_now) const;
 
 private:
+	bool tryParsePacket(Packet *pkt, const uint8_t *raw, int len);
 	void checkRecv();
 	void checkSend();
 };
diff --git a/zephcore/include/mesh/Identity.h b/zephcore/include/mesh/Identity.h
index 9b6c670..79e6e5a 100644
--- a/zephcore/include/mesh/Identity.h
+++ b/zephcore/include/mesh/Identity.h
@@ -25,6 +25,10 @@ public:
 		memcpy(dest, pub_key, PATH_HASH_SIZE);
 		return PATH_HASH_SIZE;
 	}
+	int copyHashTo(uint8_t *dest, uint8_t len) const {
+		memcpy(dest, pub_key, len);
+		return len;
+	}
 	bool isHashMatch(const uint8_t *hash) const {
 		return memcmp(hash, pub_key, PATH_HASH_SIZE) == 0;
 	}
diff --git a/zephcore/include/mesh/Mesh.h b/zephcore/include/mesh/Mesh.h
index e5ab5e0..7a2dbe2 100644
--- a/zephcore/include/mesh/Mesh.h
+++ b/zephcore/include/mesh/Mesh.h
@@ -76,8 +76,8 @@ public:
 	Packet *createRawData(const uint8_t *data, size_t len);
 	Packet *createTrace(uint32_t tag, uint32_t auth_code, uint8_t flags = 0);
 
-	void sendFlood(Packet *packet, uint32_t delay_millis = 0);
-	void sendFlood(Packet *packet, uint16_t *transport_codes, uint32_t delay_millis = 0);
+	void sendFlood(Packet *packet, uint32_t delay_millis = 0, uint8_t path_hash_size = 1);
+	void sendFlood(Packet *packet, uint16_t *transport_codes, uint32_t delay_millis = 0, uint8_t path_hash_size = 1);
 	void sendDirect(Packet *packet, const uint8_t *path, uint8_t path_len, uint32_t delay_millis = 0);
 	void sendZeroHop(Packet *packet, uint32_t delay_millis = 0);
 	void sendZeroHop(Packet *packet, uint16_t *transport_codes, uint32_t delay_millis = 0);
diff --git a/zephcore/include/mesh/Packet.h b/zephcore/include/mesh/Packet.h
index 45f11a7..a9a893d 100644
--- a/zephcore/include/mesh/Packet.h
+++ b/zephcore/include/mesh/Packet.h
@@ -46,7 +46,8 @@ public:
 	Packet();
 
 	uint8_t header;
-	uint16_t payload_len, path_len;
+	uint16_t payload_len;
+	uint8_t path_len;
 	uint16_t transport_codes[2];
 	uint8_t path[MAX_PATH_SIZE];
 	uint8_t payload[MAX_PACKET_PAYLOAD];
@@ -59,6 +60,17 @@ public:
 	bool hasTransportCodes() const { return getRouteType() == ROUTE_TYPE_TRANSPORT_FLOOD || getRouteType() == ROUTE_TYPE_TRANSPORT_DIRECT; }
 	uint8_t getPayloadType() const { return (header >> PH_TYPE_SHIFT) & PH_TYPE_MASK; }
 	uint8_t getPayloadVer() const { return (header >> PH_VER_SHIFT) & PH_VER_MASK; }
+
+	uint8_t getPathHashSize() const { return (path_len >> 6) + 1; }
+	uint8_t getPathHashCount() const { return path_len & 63; }
+	uint8_t getPathByteLen() const { return getPathHashCount() * getPathHashSize(); }
+	void setPathHashCount(uint8_t n) { path_len &= ~63; path_len |= n; }
+	void setPathHashSizeAndCount(uint8_t sz, uint8_t n) { path_len = ((sz - 1) << 6) | (n & 63); }
+
+	static uint8_t copyPath(uint8_t *dest, const uint8_t *src, uint8_t path_len);
+	static size_t writePath(uint8_t *dest, const uint8_t *src, uint8_t path_len);
+	static bool isValidPathLen(uint8_t path_len);
+
 	void markDoNotRetransmit() { header = 0xFF; }
 	bool isMarkedDoNotRetransmit() const { return header == 0xFF; }
 	float getSNR() const { return ((float)_snr) / 4.0f; }
diff --git a/zephcore/src/Dispatcher.cpp b/zephcore/src/Dispatcher.cpp
index dedba45..4f63ec5 100644
--- a/zephcore/src/Dispatcher.cpp
+++ b/zephcore/src/Dispatcher.cpp
@@ -116,7 +116,7 @@ void Dispatcher::loop()
 			total_air_time += t;
 			_duty_cycle.recordTx(t, (uint32_t)_ms->getMillis());
 			_radio->onSendFinished();
-			logTx(outbound, 2 + outbound->path_len + outbound->payload_len);
+			logTx(outbound, 2 + outbound->getPathByteLen() + outbound->payload_len);
 			if (outbound->isRouteFlood()) {
 				n_sent_flood++;
 			} else {
@@ -126,7 +126,7 @@ void Dispatcher::loop()
 			outbound = nullptr;
 		} else if (millisHasNowPassed(outbound_expiry)) {
 			_radio->onSendFinished();
-			logTxFail(outbound, 2 + outbound->path_len + outbound->payload_len);
+			logTxFail(outbound, 2 + outbound->getPathByteLen() + outbound->payload_len);
 			releasePacket(outbound);
 			outbound = nullptr;
 		} else {
@@ -150,6 +150,48 @@ void Dispatcher::loop()
 	checkSend();
 }
 
+bool Dispatcher::tryParsePacket(Packet *pkt, const uint8_t *raw, int len)
+{
+	int i = 0;
+
+	pkt->header = raw[i++];
+	if (pkt->getPayloadVer() > PAYLOAD_VER_1) {
+		LOG_WRN("tryParsePacket: unsupported packet version");
+		return false;
+	}
+
+	if (pkt->hasTransportCodes()) {
+		memcpy(&pkt->transport_codes[0], &raw[i], 2); i += 2;
+		memcpy(&pkt->transport_codes[1], &raw[i], 2); i += 2;
+	} else {
+		pkt->transport_codes[0] = pkt->transport_codes[1] = 0;
+	}
+
+	pkt->path_len = raw[i++];
+	uint8_t path_mode = pkt->path_len >> 6;
+	if (path_mode == 3) {   // Reserved for future
+		LOG_WRN("tryParsePacket: unsupported path mode: 3");
+		return false;
+	}
+
+	uint8_t path_byte_len = (pkt->path_len & 63) * pkt->getPathHashSize();
+	if (path_byte_len > MAX_PATH_SIZE || i + path_byte_len > len) {
+		LOG_WRN("tryParsePacket: partial or corrupt packet, len=%d", len);
+		return false;
+	}
+
+	memcpy(pkt->path, &raw[i], path_byte_len); i += path_byte_len;
+
+	pkt->payload_len = len - i;
+	if (pkt->payload_len > (int)sizeof(pkt->payload)) {
+		LOG_WRN("tryParsePacket: payload too big, payload_len=%d", (uint32_t)pkt->payload_len);
+		return false;
+	}
+
+	memcpy(pkt->payload, &raw[i], pkt->payload_len);
+	return true;
+}
+
 void Dispatcher::checkRecv()
 {
 	/* Drain ALL queued LoRa packets per wake.
@@ -173,37 +215,16 @@ void Dispatcher::checkRecv()
 		float score = 0.0f;
 		uint32_t air_time = 0;
 
-		int i = 0;
-		pkt->header = raw[i++];
-		if (pkt->hasTransportCodes()) {
-			memcpy(&pkt->transport_codes[0], &raw[i], 2); i += 2;
-			memcpy(&pkt->transport_codes[1], &raw[i], 2); i += 2;
+		if (tryParsePacket(pkt, raw, len)) {
+			pkt->_snr = (int8_t)(_radio->getLastSNR() * 4.0f);
+			score = _radio->packetScore(_radio->getLastSNR(), len);
+			air_time = _radio->getEstAirtimeFor(len);
+			rx_air_time += air_time;
 		} else {
-			pkt->transport_codes[0] = pkt->transport_codes[1] = 0;
-		}
-		pkt->path_len = raw[i++];
-
-		if (pkt->path_len > MAX_PATH_SIZE || i + pkt->path_len > len) {
-			LOG_WRN("checkRecv: bad path_len=%d", pkt->path_len);
 			_mgr->free(pkt);
 			continue;
 		}
 
-		memcpy(pkt->path, &raw[i], pkt->path_len);
-		i += pkt->path_len;
-		pkt->payload_len = len - i;
-		if (pkt->payload_len > (int)sizeof(pkt->payload)) {
-			LOG_WRN("checkRecv: payload too large %d", pkt->payload_len);
-			_mgr->free(pkt);
-			continue;
-		}
-
-		memcpy(pkt->payload, &raw[i], pkt->payload_len);
-		pkt->_snr = (int8_t)(_radio->getLastSNR() * 4.0f);
-		score = _radio->packetScore(_radio->getLastSNR(), len);
-		air_time = _radio->getEstAirtimeFor(len);
-		rx_air_time += air_time;
-
 #if IS_ENABLED(CONFIG_ZEPHCORE_PACKET_LOGGING)
 		/* Arduino-compatible packet logging - use printk to bypass log level filtering */
 		{
@@ -318,8 +339,7 @@ void Dispatcher::checkSend()
 			memcpy(&raw[len], &outbound->transport_codes[1], 2); len += 2;
 		}
 		raw[len++] = outbound->path_len;
-		memcpy(&raw[len], outbound->path, outbound->path_len);
-		len += outbound->path_len;
+		len += Packet::writePath(&raw[len], outbound->path, outbound->path_len);
 
 		if (len + outbound->payload_len > MAX_TRANS_UNIT) {
 			LOG_WRN("checkSend: packet too large len=%d+%d > %d", len, outbound->payload_len, MAX_TRANS_UNIT);
@@ -399,8 +419,8 @@ void Dispatcher::releasePacket(Packet *packet)
 
 void Dispatcher::sendPacket(Packet *packet, uint8_t priority, uint32_t delay_millis)
 {
-	if (packet->path_len > MAX_PATH_SIZE || packet->payload_len > MAX_PACKET_PAYLOAD) {
-		LOG_WRN("sendPacket: rejected - path_len=%d or payload_len=%d too large",
+	if (!Packet::isValidPathLen(packet->path_len) || packet->payload_len > MAX_PACKET_PAYLOAD) {
+		LOG_WRN("sendPacket: rejected - path_len=%d or payload_len=%d invalid",
 			packet->path_len, packet->payload_len);
 		_mgr->free(packet);
 	} else {
diff --git a/zephcore/src/Mesh.cpp b/zephcore/src/Mesh.cpp
index fe41748..5cb23ad 100644
--- a/zephcore/src/Mesh.cpp
+++ b/zephcore/src/Mesh.cpp
@@ -46,19 +46,24 @@ uint32_t Mesh::getCADFailRetryDelay() const
 
 void Mesh::removeSelfFromPath(Packet *pkt)
 {
-	pkt->path_len -= PATH_HASH_SIZE;
-	for (int k = 0; k < (int)pkt->path_len; k++) {
-		pkt->path[k] = pkt->path[k + 1];
+	pkt->setPathHashCount(pkt->getPathHashCount() - 1);  // decrement the count
+
+	uint8_t sz = pkt->getPathHashSize();
+	for (int k = 0; k < pkt->getPathHashCount()*sz; k += sz) {  // shuffle path by 1 'entry'
+		memcpy(&pkt->path[k], &pkt->path[k + sz], sz);
 	}
 }
 
 DispatcherAction Mesh::routeRecvPacket(Packet *packet)
 {
+	uint8_t n = packet->getPathHashCount();
 	if (packet->isRouteFlood() && !packet->isMarkedDoNotRetransmit()
-		&& packet->path_len + PATH_HASH_SIZE <= MAX_PATH_SIZE && allowPacketForward(packet)) {
-		packet->path_len += self_id.copyHashTo(&packet->path[packet->path_len]);
+		&& (n + 1)*packet->getPathHashSize() <= MAX_PATH_SIZE && allowPacketForward(packet)) {
+		// append this node's hash to 'path'
+		self_id.copyHashTo(&packet->path[n * packet->getPathHashSize()], packet->getPathHashSize());
+		packet->setPathHashCount(n + 1);
 		uint32_t d = getRetransmitDelay(packet);
-		return ACTION_RETRANSMIT_DELAYED(packet->path_len, d);
+		return ACTION_RETRANSMIT_DELAYED(packet->getPathHashCount(), d);  // give priority to closer sources
 	}
 	return ACTION_RELEASE;
 }
@@ -70,8 +75,7 @@ DispatcherAction Mesh::forwardMultipartDirect(Packet *pkt)
 	if (type == PAYLOAD_TYPE_ACK && pkt->payload_len >= 5) {
 		Packet tmp;
 		tmp.header = pkt->header;
-		tmp.path_len = pkt->path_len;
-		memcpy(tmp.path, pkt->path, pkt->path_len);
+		tmp.path_len = Packet::copyPath(tmp.path, pkt->path, pkt->path_len);
 		tmp.payload_len = pkt->payload_len - 1;
 		memcpy(tmp.payload, &pkt->payload[1], tmp.payload_len);
 		if (!_tables->hasSeen(&tmp)) {
@@ -89,8 +93,7 @@ void Mesh::routeDirectRecvAcks(Packet *packet, uint32_t delay_millis)
 		memcpy(&crc, packet->payload, 4);
 		Packet *a2 = createAck(crc);
 		if (a2) {
-			memcpy(a2->path, packet->path, packet->path_len);
-			a2->path_len = packet->path_len;
+			a2->path_len = Packet::copyPath(a2->path, packet->path, packet->path_len);
 			a2->header &= ~PH_ROUTE_MASK;
 			a2->header |= ROUTE_TYPE_DIRECT;
 			sendPacket(a2, 0, delay_millis);
@@ -100,10 +103,6 @@ void Mesh::routeDirectRecvAcks(Packet *packet, uint32_t delay_millis)
 
 DispatcherAction Mesh::onRecvPacket(Packet *pkt)
 {
-	if (pkt->getPayloadVer() > PAYLOAD_VER_1) {
-		return ACTION_RELEASE;
-	}
-
 	// Handle direct TRACE packets
 	if (pkt->isRouteDirect() && pkt->getPayloadType() == PAYLOAD_TYPE_TRACE) {
 		if (pkt->path_len < MAX_PATH_SIZE) {
@@ -130,27 +129,27 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
 
 	// Handle direct CONTROL packets (zero-hop only)
 	if (pkt->isRouteDirect() && pkt->getPayloadType() == PAYLOAD_TYPE_CONTROL && (pkt->payload[0] & 0x80) != 0) {
-		if (pkt->path_len == 0) {
+		if (pkt->getPathHashCount() == 0) {
 			onControlDataRecv(pkt);
 		}
 		return ACTION_RELEASE;
 	}
 
 	// Handle direct zero-hop ACKs (path_len=0)
-	if (pkt->isRouteDirect() && pkt->path_len == 0 && pkt->getPayloadType() == PAYLOAD_TYPE_ACK) {
+	if (pkt->isRouteDirect() && pkt->getPathHashCount() == 0 && pkt->getPayloadType() == PAYLOAD_TYPE_ACK) {
 		uint32_t ack_crc;
 		memcpy(&ack_crc, pkt->payload, 4);
 		onAckRecv(pkt, ack_crc);
 		return ACTION_RELEASE;
 	}
 
-	if (pkt->isRouteDirect() && pkt->path_len >= PATH_HASH_SIZE) {
+	if (pkt->isRouteDirect() && pkt->getPathHashCount() > 0) {
 		if (pkt->getPayloadType() == PAYLOAD_TYPE_ACK) {
 			uint32_t ack_crc;
 			memcpy(&ack_crc, pkt->payload, 4);
 			onAckRecv(pkt, ack_crc);
 		}
-		if (self_id.isHashMatch(pkt->path) && allowPacketForward(pkt)) {
+		if (self_id.isHashMatch(pkt->path, pkt->getPathHashSize()) && allowPacketForward(pkt)) {
 			if (pkt->getPayloadType() == PAYLOAD_TYPE_MULTIPART) {
 				return forwardMultipartDirect(pkt);
 			}
@@ -208,7 +207,9 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
 						if (pkt->getPayloadType() == PAYLOAD_TYPE_PATH) {
 							int k = 0;
 							uint8_t path_len = data[k++];
-							uint8_t *path = &data[k]; k += path_len;
+							uint8_t hash_size = (path_len >> 6) + 1;
+							uint8_t hash_count = path_len & 63;
+							uint8_t *path = &data[k]; k += hash_size*hash_count;
 							uint8_t extra_type = data[k++] & 0x0F;
 							uint8_t *extra = &data[k];
 							uint8_t extra_len = len - k;
@@ -322,8 +323,7 @@ DispatcherAction Mesh::onRecvPacket(Packet *pkt)
 			if (type == PAYLOAD_TYPE_ACK && pkt->payload_len >= 5) {
 				Packet tmp;
 				tmp.header = pkt->header;
-				tmp.path_len = pkt->path_len;
-				memcpy(tmp.path, pkt->path, pkt->path_len);
+				tmp.path_len = Packet::copyPath(tmp.path, pkt->path, pkt->path_len);
 				tmp.payload_len = pkt->payload_len - 1;
 				memcpy(tmp.payload, &pkt->payload[1], tmp.payload_len);
 
@@ -406,14 +406,18 @@ Packet *Mesh::createControlData(const uint8_t *data, size_t len)
 	return packet;
 }
 
-void Mesh::sendFlood(Packet *packet, uint32_t delay_millis)
+void Mesh::sendFlood(Packet *packet, uint32_t delay_millis, uint8_t path_hash_size)
 {
 	if (packet->getPayloadType() == PAYLOAD_TYPE_TRACE) {
 		return;
 	}
+	if (path_hash_size == 0 || path_hash_size > 3) {
+		LOG_WRN("sendFlood: invalid path_hash_size");
+		return;
+	}
 	packet->header &= ~PH_ROUTE_MASK;
 	packet->header |= ROUTE_TYPE_FLOOD;
-	packet->path_len = 0;
+	packet->setPathHashSizeAndCount(path_hash_size, 0);
 	_tables->hasSeen(packet);
 
 	uint8_t pri;
@@ -427,16 +431,20 @@ void Mesh::sendFlood(Packet *packet, uint32_t delay_millis)
 	sendPacket(packet, pri, delay_millis);
 }
 
-void Mesh::sendFlood(Packet *packet, uint16_t *transport_codes, uint32_t delay_millis)
+void Mesh::sendFlood(Packet *packet, uint16_t *transport_codes, uint32_t delay_millis, uint8_t path_hash_size)
 {
 	if (packet->getPayloadType() == PAYLOAD_TYPE_TRACE) {
 		return;
 	}
+	if (path_hash_size == 0 || path_hash_size > 3) {
+		LOG_WRN("sendFlood: invalid path_hash_size");
+		return;
+	}
 	packet->header &= ~PH_ROUTE_MASK;
 	packet->header |= ROUTE_TYPE_TRANSPORT_FLOOD;
 	packet->transport_codes[0] = transport_codes[0];
 	packet->transport_codes[1] = transport_codes[1];
-	packet->path_len = 0;
+	packet->setPathHashSizeAndCount(path_hash_size, 0);
 	_tables->hasSeen(packet);
 
 	uint8_t pri;
@@ -463,8 +471,7 @@ void Mesh::sendDirect(Packet *packet, const uint8_t *path, uint8_t path_len, uin
 		packet->path_len = 0;
 		pri = 5;
 	} else {
-		memcpy(packet->path, path, path_len);
-		packet->path_len = path_len;
+		packet->path_len = Packet::copyPath(packet->path, path, path_len);
 		if (packet->getPayloadType() == PAYLOAD_TYPE_PATH) {
 			pri = 1;
 		} else {
@@ -509,7 +516,10 @@ Packet *Mesh::createPathReturn(const Identity &dest, const uint8_t *secret, cons
 Packet *Mesh::createPathReturn(const uint8_t *dest_hash, const uint8_t *secret, const uint8_t *path, uint8_t path_len,
 	uint8_t extra_type, const uint8_t *extra, size_t extra_len)
 {
-	if (path_len + extra_len + 5 > MAX_COMBINED_PATH) return nullptr;
+	uint8_t path_hash_size = (path_len >> 6) + 1;
+	uint8_t path_hash_count = path_len & 63;
+
+	if (path_hash_count*path_hash_size + extra_len + 5 > MAX_COMBINED_PATH) return nullptr;
 
 	Packet *packet = obtainNewPacket();
 	if (packet == nullptr) return nullptr;
@@ -525,7 +535,7 @@ Packet *Mesh::createPathReturn(const uint8_t *dest_hash, const uint8_t *secret,
 		uint8_t data[MAX_PACKET_PAYLOAD];
 
 		data[data_len++] = path_len;
-		memcpy(&data[data_len], path, path_len); data_len += path_len;
+		memcpy(&data[data_len], path, path_hash_count*path_hash_size); data_len += path_hash_count*path_hash_size;
 		if (extra_len > 0) {
 			data[data_len++] = extra_type;
 			memcpy(&data[data_len], extra, extra_len); data_len += extra_len;
diff --git a/zephcore/src/Packet.cpp b/zephcore/src/Packet.cpp
index e73e2b7..3ee5e5e 100644
--- a/zephcore/src/Packet.cpp
+++ b/zephcore/src/Packet.cpp
@@ -16,9 +16,35 @@ Packet::Packet()
 	payload_len = 0;
 }
 
+bool Packet::isValidPathLen(uint8_t path_len)
+{
+	uint8_t hash_count = path_len & 63;
+	uint8_t hash_size = (path_len >> 6) + 1;
+	if (hash_size == 4) return false;  // Reserved for future
+	return hash_count * hash_size <= MAX_PATH_SIZE;
+}
+
+size_t Packet::writePath(uint8_t *dest, const uint8_t *src, uint8_t path_len)
+{
+	uint8_t hash_count = path_len & 63;
+	uint8_t hash_size = (path_len >> 6) + 1;
+	size_t len = hash_count * hash_size;
+	if (len > MAX_PATH_SIZE) {
+		return 0;   // Error
+	}
+	memcpy(dest, src, len);
+	return len;
+}
+
+uint8_t Packet::copyPath(uint8_t *dest, const uint8_t *src, uint8_t path_len)
+{
+	writePath(dest, src, path_len);
+	return path_len;
+}
+
 int Packet::getRawLength() const
 {
-	return 2 + path_len + payload_len + (hasTransportCodes() ? 4 : 0);
+	return 2 + getPathByteLen() + payload_len + (hasTransportCodes() ? 4 : 0);
 }
 
 void Packet::calculatePacketHash(uint8_t *hash) const
@@ -47,7 +73,7 @@ uint8_t Packet::writeTo(uint8_t dest[]) const
 		memcpy(&dest[i], &transport_codes[1], 2); i += 2;
 	}
 	dest[i++] = path_len;
-	memcpy(&dest[i], path, path_len); i += path_len;
+	i += writePath(&dest[i], path, path_len);
 	memcpy(&dest[i], payload, payload_len); i += payload_len;
 	return i;
 }
@@ -63,8 +89,10 @@ bool Packet::readFrom(const uint8_t src[], uint8_t len)
 		transport_codes[0] = transport_codes[1] = 0;
 	}
 	path_len = src[i++];
-	if (path_len > sizeof(path)) return false;
-	memcpy(path, &src[i], path_len); i += path_len;
+	if (!isValidPathLen(path_len)) return false;
+
+	uint8_t bl = getPathByteLen();
+	memcpy(path, &src[i], bl); i += bl;
 	if (i >= len) return false;
 	payload_len = len - i;
 	if (payload_len > sizeof(payload)) return false;
diff --git a/zephcore/src/StaticPoolPacketManager.cpp b/zephcore/src/StaticPoolPacketManager.cpp
index 3a60703..287e72a 100644
--- a/zephcore/src/StaticPoolPacketManager.cpp
+++ b/zephcore/src/StaticPoolPacketManager.cpp
@@ -28,7 +28,7 @@ struct PacketQueue {
 	int countBefore(uint32_t now) const {
 		int n = 0;
 		for (int j = 0; j < _num; j++) {
-			if (_schedule_table[j] > now) continue;
+			if ((int32_t)(_schedule_table[j] - now) > 0) continue;
 			n++;
 		}
 		return n;
@@ -38,7 +38,7 @@ struct PacketQueue {
 		uint8_t min_pri = 0xFF;
 		int best_idx = -1;
 		for (int j = 0; j < _num; j++) {
-			if (_schedule_table[j] > now) continue;
+			if ((int32_t)(_schedule_table[j] - now) > 0) continue;
 			if (_pri_table[j] < min_pri) {
 				min_pri = _pri_table[j];
 				best_idx = j;