Fix BYOP keydown handler cleanup and add regressions

- bind packet Escape key listener via bindDocumentHandler and clean it in destroy

- add VM-based regression tests for BYOP overlay singleton/cleanup and handler dedupe across re-init

- bump public cache-buster versions in index.html

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.badges/backend-coverage.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"backend coverage","message":"87.79%","color":"brightgreen"}

.badges/backend-tests.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"backend tests","message":"998 passed","color":"brightgreen"}

.badges/coverage.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"coverage","message":"76%","color":"yellow"}

.badges/e2e-tests.json

@@ -0,0 +1 @@
+{"schemaVersion":1,"label":"e2e tests","message":"45 passed","color":"brightgreen"}

.badges/frontend-coverage.json

@@ -1 +1 @@
-{"schemaVersion":1,"label":"frontend coverage","message":"31.35%","color":"red"}
+{"schemaVersion":1,"label":"frontend coverage","message":"39.68%","color":"red"}

.badges/go-ingestor-coverage.json

@@ -0,0 +1 @@
+{"schemaVersion":1,"label":"go ingestor coverage","message":"70.2%","color":"yellow"}

.badges/go-server-coverage.json

@@ -0,0 +1 @@
+{"schemaVersion":1,"label":"go server coverage","message":"85.4%","color":"green"}

.badges/tests.json

@@ -1 +0,0 @@
-{"schemaVersion":1,"label":"tests","message":"844/844 passed","color":"brightgreen"}

.gitattributes

@@ -0,0 +1,14 @@
+# Force LF line endings for all text files (prevents CRLF churn from Windows agents)
+* text=auto eol=lf
+
+# Explicitly mark binary files
+*.png binary
+*.jpg binary
+*.ico binary
+*.db binary
+
+# Squad: union merge for append-only team state files
+.squad/decisions.md merge=union
+.squad/agents/*/history.md merge=union
+.squad/log/** merge=union
+.squad/orchestration-log/** merge=union

.github/workflows/deploy.yml

@@ -1,35 +1,28 @@
-name: Deploy
+name: CI/CD Pipeline
 
 on:
   push:
     branches: [master]
-    paths-ignore:
-      - '**.md'
-      - 'LICENSE'
-      - '.gitignore'
-      - 'docs/**'
   pull_request:
     branches: [master]
 
 concurrency:
-  group: deploy-${{ github.event.pull_request.number || github.ref }}
+  group: ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  STAGING_COMPOSE_FILE: docker-compose.staging.yml
+  STAGING_SERVICE: staging-go
+  STAGING_CONTAINER: corescope-staging-go
 
-# Pipeline:
-#   node-test (frontend tests) ──┐
-#   go-test                      ├──→ build → deploy → publish
-#                                └─ (both wait)
-#
-# Proto validation flow:
-#   1. go-test job: verify .proto files compile (syntax check)
-#   2. deploy job: capture fresh fixtures from prod, validate protos match actual API responses
+# Pipeline (sequential, fail-fast):
+#   go-test → e2e-test → build → deploy → publish
+#   PRs stop after build. Master continues to deploy + publish.
 
 jobs:
   # ───────────────────────────────────────────────────────────────
-  # 1. Go Build & Test — compiles + tests Go modules, coverage badges
+  # 1. Go Build & Test
   # ───────────────────────────────────────────────────────────────
   go-test:
     name: "✅ Go Build & Test"
@@ -40,20 +33,10 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Skip if docs-only change
-        id: docs-check
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
-            NON_DOCS=$(echo "$CHANGED" | grep -cvE '\.(md)$|^LICENSE$|^\.gitignore$|^docs/' || true)
-            if [ "$NON_DOCS" -eq 0 ]; then
-              echo "docs_only=true" >> $GITHUB_OUTPUT
-              echo "📄 Docs-only PR — skipping heavy CI"
-            fi
-          fi
+      - name: Clean Go module cache
+        run: rm -rf ~/go/pkg/mod 2>/dev/null || true
 
       - name: Set up Go 1.22
-        if: steps.docs-check.outputs.docs_only != 'true'
         uses: actions/setup-go@v6
         with:
           go-version: '1.22'
@@ -62,7 +45,6 @@ jobs:
             cmd/ingestor/go.sum
 
       - name: Build and test Go server (with coverage)
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           set -e -o pipefail
           cd cmd/server
@@ -72,7 +54,6 @@ jobs:
           go tool cover -func=server-coverage.out | tail -1
 
       - name: Build and test Go ingestor (with coverage)
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: |
           set -e -o pipefail
           cd cmd/ingestor
@@ -81,15 +62,11 @@ jobs:
           echo "--- Go Ingestor Coverage ---"
           go tool cover -func=ingestor-coverage.out | tail -1
 
-      - name: Verify proto syntax (all .proto files compile)
-        if: steps.docs-check.outputs.docs_only != 'true'
+      - name: Verify proto syntax
         run: |
           set -e
-          echo "Installing protoc..."
           sudo apt-get update -qq
           sudo apt-get install -y protobuf-compiler
-          
-          echo "Checking proto syntax..."
           for proto in proto/*.proto; do
             echo "  ✓ $(basename "$proto")"
             protoc --proto_path=proto --descriptor_set_out=/dev/null "$proto"
@@ -97,37 +74,27 @@ jobs:
           echo "✅ All .proto files are syntactically valid"
 
       - name: Generate Go coverage badges
-        if: always() && steps.docs-check.outputs.docs_only != 'true'
+        if: success()
         run: |
           mkdir -p .badges
 
-          # Parse server coverage
           SERVER_COV="0"
           if [ -f cmd/server/server-coverage.out ]; then
             SERVER_COV=$(cd cmd/server && go tool cover -func=server-coverage.out | tail -1 | grep -oP '[\d.]+(?=%)')
           fi
           SERVER_COLOR="red"
-          if [ "$(echo "$SERVER_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then
-            SERVER_COLOR="green"
-          elif [ "$(echo "$SERVER_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then
-            SERVER_COLOR="yellow"
-          fi
+          if [ "$(echo "$SERVER_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then SERVER_COLOR="green"
+          elif [ "$(echo "$SERVER_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then SERVER_COLOR="yellow"; fi
           echo "{\"schemaVersion\":1,\"label\":\"go server coverage\",\"message\":\"${SERVER_COV}%\",\"color\":\"${SERVER_COLOR}\"}" > .badges/go-server-coverage.json
-          echo "Go server coverage: ${SERVER_COV}% (${SERVER_COLOR})"
 
-          # Parse ingestor coverage
           INGESTOR_COV="0"
           if [ -f cmd/ingestor/ingestor-coverage.out ]; then
             INGESTOR_COV=$(cd cmd/ingestor && go tool cover -func=ingestor-coverage.out | tail -1 | grep -oP '[\d.]+(?=%)')
           fi
           INGESTOR_COLOR="red"
-          if [ "$(echo "$INGESTOR_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then
-            INGESTOR_COLOR="green"
-          elif [ "$(echo "$INGESTOR_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then
-            INGESTOR_COLOR="yellow"
-          fi
+          if [ "$(echo "$INGESTOR_COV >= 80" | bc -l 2>/dev/null)" = "1" ]; then INGESTOR_COLOR="green"
+          elif [ "$(echo "$INGESTOR_COV >= 60" | bc -l 2>/dev/null)" = "1" ]; then INGESTOR_COLOR="yellow"; fi
           echo "{\"schemaVersion\":1,\"label\":\"go ingestor coverage\",\"message\":\"${INGESTOR_COV}%\",\"color\":\"${INGESTOR_COLOR}\"}" > .badges/go-ingestor-coverage.json
-          echo "Go ingestor coverage: ${INGESTOR_COV}% (${INGESTOR_COLOR})"
 
           echo "## Go Coverage" >> $GITHUB_STEP_SUMMARY
           echo "| Module | Coverage |" >> $GITHUB_STEP_SUMMARY
@@ -135,27 +102,22 @@ jobs:
           echo "| Server | ${SERVER_COV}% |" >> $GITHUB_STEP_SUMMARY
           echo "| Ingestor | ${INGESTOR_COV}% |" >> $GITHUB_STEP_SUMMARY
 
-      - name: Cancel workflow on failure
-        if: failure()
-        run: |
-          curl -s -X POST \
-            -H "Authorization: Bearer ${{ github.token }}" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-
       - name: Upload Go coverage badges
-        if: always()
-        uses: actions/upload-artifact@v5
+        if: success()
+        uses: actions/upload-artifact@v6
         with:
           name: go-badges
           path: .badges/go-*.json
           retention-days: 1
           if-no-files-found: ignore
+          include-hidden-files: true
 
   # ───────────────────────────────────────────────────────────────
-  # 2. Node.js Tests — backend unit tests + Playwright E2E, coverage
+  # 2. Playwright E2E Tests (against Go server with fixture DB)
   # ───────────────────────────────────────────────────────────────
-  node-test:
-    name: "🧪 Node.js Tests"
+  e2e-test:
+    name: "🎭 Playwright E2E Tests"
+    needs: [go-test]
     runs-on: [self-hosted, Linux]
     defaults:
       run:
@@ -166,88 +128,43 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Skip if docs-only change
-        id: docs-check
-        run: |
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            CHANGED=$(git diff --name-only origin/${{ github.base_ref }}...HEAD)
-            NON_DOCS=$(echo "$CHANGED" | grep -cvE '\.(md)$|^LICENSE$|^\.gitignore$|^docs/' || true)
-            if [ "$NON_DOCS" -eq 0 ]; then
-              echo "docs_only=true" >> $GITHUB_OUTPUT
-              echo "📄 Docs-only PR — skipping heavy CI"
-            fi
-          fi
-
       - name: Set up Node.js 22
-        if: steps.docs-check.outputs.docs_only != 'true'
         uses: actions/setup-node@v5
         with:
           node-version: '22'
 
+      - name: Clean Go module cache
+        run: rm -rf ~/go/pkg/mod 2>/dev/null || true
+
+      - name: Set up Go 1.22
+        uses: actions/setup-go@v6
+        with:
+          go-version: '1.22'
+          cache-dependency-path: cmd/server/go.sum
+
+      - name: Build Go server
+        run: |
+          cd cmd/server
+          go build -o ../../corescope-server .
+          echo "Go server built successfully"
+
       - name: Install npm dependencies
-        if: steps.docs-check.outputs.docs_only != 'true'
         run: npm ci --production=false
 
-      - name: Detect changed files
-        if: steps.docs-check.outputs.docs_only != 'true'
-        id: changes
-        run: |
-          BACKEND=$(git diff --name-only HEAD~1 | grep -cE '^(server|db|decoder|packet-store|server-helpers|iata-coords)\.js$' || true)
-          FRONTEND=$(git diff --name-only HEAD~1 | grep -cE '^public/' || true)
-          TESTS=$(git diff --name-only HEAD~1 | grep -cE '^test-|^tools/' || true)
-          CI=$(git diff --name-only HEAD~1 | grep -cE '\.github/|package\.json|test-all\.sh|scripts/' || true)
-          # If CI/test infra changed, run everything
-          if [ "$CI" -gt 0 ]; then BACKEND=1; FRONTEND=1; fi
-          # If test files changed, run everything
-          if [ "$TESTS" -gt 0 ]; then BACKEND=1; FRONTEND=1; fi
-          echo "backend=$([[ $BACKEND -gt 0 ]] && echo true || echo false)" >> $GITHUB_OUTPUT
-          echo "frontend=$([[ $FRONTEND -gt 0 ]] && echo true || echo false)" >> $GITHUB_OUTPUT
-          echo "Changes: backend=$BACKEND frontend=$FRONTEND tests=$TESTS ci=$CI"
-
-      - name: Run backend tests with coverage
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.backend == 'true'
-        run: |
-          npx c8 --reporter=text-summary --reporter=text sh test-all.sh 2>&1 | tee test-output.txt
-          
-          TOTAL_PASS=$(grep -oP '\d+(?= passed)' test-output.txt | awk '{s+=$1} END {print s}')
-          TOTAL_FAIL=$(grep -oP '\d+(?= failed)' test-output.txt | awk '{s+=$1} END {print s}')
-          BE_COVERAGE=$(grep 'Statements' test-output.txt | tail -1 | grep -oP '[\d.]+(?=%)')
-          
-          mkdir -p .badges
-          BE_COLOR="red"
-          [ "$(echo "$BE_COVERAGE > 60" | bc -l 2>/dev/null)" = "1" ] && BE_COLOR="yellow"
-          [ "$(echo "$BE_COVERAGE > 80" | bc -l 2>/dev/null)" = "1" ] && BE_COLOR="brightgreen"
-          echo "{\"schemaVersion\":1,\"label\":\"backend tests\",\"message\":\"${TOTAL_PASS} passed\",\"color\":\"brightgreen\"}" > .badges/backend-tests.json
-          echo "{\"schemaVersion\":1,\"label\":\"backend coverage\",\"message\":\"${BE_COVERAGE}%\",\"color\":\"${BE_COLOR}\"}" > .badges/backend-coverage.json
-          
-          echo "## Backend: ${TOTAL_PASS} tests, ${BE_COVERAGE}% coverage" >> $GITHUB_STEP_SUMMARY
-
-      - name: Run backend tests (quick, no coverage)
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.backend == 'false'
-        run: npm run test:unit
-
       - name: Install Playwright browser
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
         run: |
-          # Install chromium (skips download if already cached on self-hosted runner)
           npx playwright install chromium 2>/dev/null || true
-          # Install system deps only if missing (apt-get is slow)
           npx playwright install-deps chromium 2>/dev/null || true
 
       - name: Instrument frontend JS for coverage
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
         run: sh scripts/instrument-frontend.sh
 
-      - name: Start instrumented test server on port 13581
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+      - name: Start Go server with fixture DB
         run: |
-          # Kill any stale server on 13581
           fuser -k 13581/tcp 2>/dev/null || true
-          sleep 2
-          COVERAGE=1 PORT=13581 node server.js &
+          sleep 1
+          ./corescope-server -port 13581 -db test-fixtures/e2e-fixture.db -public public-instrumented &
           echo $! > .server.pid
-          echo "Server PID: $(cat .server.pid)"
-          # Health-check poll loop (up to 30s)
           for i in $(seq 1 30); do
             if curl -sf http://localhost:13581/api/stats > /dev/null 2>&1; then
               echo "Server ready after ${i}s"
@@ -255,38 +172,26 @@ jobs:
             fi
             if [ "$i" -eq 30 ]; then
               echo "Server failed to start within 30s"
-              echo "Last few lines from server logs:"
-              ps aux | grep "PORT=13581" || echo "No server process found"
               exit 1
             fi
             sleep 1
           done
 
-      - name: Run Playwright E2E + coverage collection concurrently
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+      - name: Run Playwright E2E tests (fail-fast)
         run: |
-          # Run E2E tests and coverage collection in parallel — both use the same server
-          BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt &
-          E2E_PID=$!
-          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt &
-          COV_PID=$!
+          BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt
 
-          # Wait for both — E2E must pass, coverage is best-effort
-          E2E_EXIT=0
-          wait $E2E_PID || E2E_EXIT=$?
-          wait $COV_PID || true
-
-          # Fail if E2E failed
-          [ $E2E_EXIT -ne 0 ] && exit $E2E_EXIT
-          true
+      - name: Collect frontend coverage (parallel)
+        if: success() && github.event_name == 'push'
+        run: |
+          BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js 2>&1 | tee fe-coverage-output.txt || true
 
       - name: Generate frontend coverage badges
-        if: always() && steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        if: success()
         run: |
-          E2E_PASS=$(grep -oP '[0-9]+(?=/)' e2e-output.txt | tail -1)
-          
+          E2E_PASS=$(grep -oP '[0-9]+(?=/)' e2e-output.txt | tail -1 || echo "0")
+
           mkdir -p .badges
-          # Merge E2E + coverage collector data if both exist
           if [ -f .nyc_output/frontend-coverage.json ] || [ -f .nyc_output/e2e-coverage.json ]; then
             npx nyc report --reporter=text-summary --reporter=text 2>&1 | tee fe-report.txt
             FE_COVERAGE=$(grep 'Statements' fe-report.txt | head -1 | grep -oP '[\d.]+(?=%)' || echo "0")
@@ -297,54 +202,32 @@ jobs:
             echo "{\"schemaVersion\":1,\"label\":\"frontend coverage\",\"message\":\"${FE_COVERAGE}%\",\"color\":\"${FE_COLOR}\"}" > .badges/frontend-coverage.json
             echo "## Frontend: ${FE_COVERAGE}% coverage" >> $GITHUB_STEP_SUMMARY
           fi
-          echo "{\"schemaVersion\":1,\"label\":\"frontend tests\",\"message\":\"${E2E_PASS:-0} E2E passed\",\"color\":\"brightgreen\"}" > .badges/frontend-tests.json
+          echo "{\"schemaVersion\":1,\"label\":\"e2e tests\",\"message\":\"${E2E_PASS:-0} passed\",\"color\":\"brightgreen\"}" > .badges/e2e-tests.json
 
       - name: Stop test server
-        if: always() && steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'true'
+        if: always()
         run: |
           if [ -f .server.pid ]; then
             kill $(cat .server.pid) 2>/dev/null || true
             rm -f .server.pid
-            echo "Server stopped"
           fi
 
-      - name: Run frontend E2E (quick, no coverage)
-        if: steps.docs-check.outputs.docs_only != 'true' && steps.changes.outputs.frontend == 'false'
-        run: |
-          fuser -k 13581/tcp 2>/dev/null || true
-          PORT=13581 node server.js &
-          SERVER_PID=$!
-          # Wait for server to be ready (up to 15s)
-          for i in $(seq 1 15); do
-            curl -sf http://localhost:13581/api/stats > /dev/null 2>&1 && break
-            sleep 1
-          done
-          BASE_URL=http://localhost:13581 node test-e2e-playwright.js || true
-          kill $SERVER_PID 2>/dev/null || true
-
-      - name: Cancel workflow on failure
-        if: failure()
-        run: |
-          curl -s -X POST \
-            -H "Authorization: Bearer ${{ github.token }}" \
-            "https://api.github.com/repos/${{ github.repository }}/actions/runs/${{ github.run_id }}/cancel"
-
-      - name: Upload Node.js test badges
-        if: always()
-        uses: actions/upload-artifact@v5
+      - name: Upload E2E badges
+        if: success()
+        uses: actions/upload-artifact@v6
         with:
-          name: node-badges
+          name: e2e-badges
           path: .badges/
           retention-days: 1
           if-no-files-found: ignore
+          include-hidden-files: true
 
   # ───────────────────────────────────────────────────────────────
   # 3. Build Docker Image
   # ───────────────────────────────────────────────────────────────
   build:
     name: "🏗️ Build Docker Image"
-    if: github.event_name == 'push'
-    needs: [go-test, node-test]
+    needs: [e2e-test]
     runs-on: [self-hosted, Linux]
     steps:
       - name: Checkout code
@@ -360,11 +243,15 @@ jobs:
           echo "${GITHUB_SHA::7}" > .git-commit
           APP_VERSION=$(node -p "require('./package.json').version") \
           GIT_COMMIT="${GITHUB_SHA::7}" \
-          docker compose --profile staging-go build staging-go
-          echo "Built Go staging image"
+          APP_VERSION=$(grep -oP 'APP_VERSION:-\K[^}]+' docker-compose.yml | head -1 || echo "3.0.0")
+          GIT_COMMIT=$(git rev-parse --short HEAD)
+          BUILD_TIME=$(date -u '+%Y-%m-%dT%H:%M:%SZ')
+          export APP_VERSION GIT_COMMIT BUILD_TIME
+          docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging build "$STAGING_SERVICE"
+          echo "Built Go staging image ✅"
 
   # ───────────────────────────────────────────────────────────────
-  # 4. Deploy Staging — start on port 82, healthcheck, smoke test
+  # 4. Deploy Staging (master only)
   # ───────────────────────────────────────────────────────────────
   deploy:
     name: "🚀 Deploy Staging"
@@ -375,13 +262,31 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Start staging on port 82
+      - name: Deploy staging
         run: |
-          # Force remove stale containers
-          docker rm -f corescope-staging-go 2>/dev/null || true
-          # Clean up stale ports
-          fuser -k 82/tcp 2>/dev/null || true
-          docker compose --profile staging-go up -d staging-go
+          # Stop old container and release memory
+          docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging down --timeout 30 2>/dev/null || true
+
+          # Wait for container to be fully gone and OS to reclaim memory (3GB limit)
+          for i in $(seq 1 15); do
+            if ! docker ps -a --format '{{.Names}}' | grep -q 'corescope-staging-go'; then
+              break
+            fi
+            sleep 1
+          done
+          sleep 5  # extra pause for OS memory reclaim
+
+          # Ensure staging data dir exists (config.json lives here, no separate file mount)
+          STAGING_DATA="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}"
+          mkdir -p "$STAGING_DATA"
+
+          # If no config exists, copy the example (CI doesn't have a real prod config)
+          if [ ! -f "$STAGING_DATA/config.json" ]; then
+            echo "Staging config missing — copying config.example.json"
+            cp config.example.json "$STAGING_DATA/config.json" 2>/dev/null || true
+          fi
+
+          docker compose -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
 
       - name: Healthcheck staging container
         run: |
@@ -409,7 +314,7 @@ jobs:
           fi
 
   # ───────────────────────────────────────────────────────────────
-  # 5. Publish Badges & Summary
+  # 5. Publish Badges & Summary (master only)
   # ───────────────────────────────────────────────────────────────
   publish:
     name: "📝 Publish Badges & Summary"
@@ -422,38 +327,51 @@ jobs:
 
       - name: Download Go coverage badges
         continue-on-error: true
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
           name: go-badges
           path: .badges/
 
-      - name: Download Node.js test badges
+      - name: Download E2E badges
         continue-on-error: true
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v6
         with:
-          name: node-badges
+          name: e2e-badges
           path: .badges/
 
       - name: Publish coverage badges to repo
         continue-on-error: true
+        env:
+          GH_TOKEN: ${{ secrets.BADGE_PUSH_TOKEN }}
         run: |
-          git config user.name "github-actions"
-          git config user.email "actions@github.com"
-          git remote set-url origin https://x-access-token:${{ github.token }}@github.com/${{ github.repository }}.git
-          git add .badges/ -f
-          git diff --cached --quiet || (git commit -m "ci: update test badges [skip ci]" && git push) || echo "Badge push failed"
+          # GITHUB_TOKEN cannot push to protected branches (required status checks).
+          # Use admin PAT (BADGE_PUSH_TOKEN) via GitHub Contents API instead.
+          for badge in .badges/*.json; do
+            FILENAME=$(basename "$badge")
+            FILEPATH=".badges/$FILENAME"
+            CONTENT=$(base64 -w0 "$badge")
+            CURRENT_SHA=$(gh api "repos/${{ github.repository }}/contents/$FILEPATH" --jq '.sha' 2>/dev/null || echo "")
+            if [ -n "$CURRENT_SHA" ]; then
+              gh api "repos/${{ github.repository }}/contents/$FILEPATH" \
+                -X PUT \
+                -f message="ci: update $FILENAME [skip ci]" \
+                -f content="$CONTENT" \
+                -f sha="$CURRENT_SHA" \
+                -f branch="master" \
+                --silent 2>&1 || echo "Failed to update $FILENAME"
+            else
+              gh api "repos/${{ github.repository }}/contents/$FILEPATH" \
+                -X PUT \
+                -f message="ci: update $FILENAME [skip ci]" \
+                -f content="$CONTENT" \
+                -f branch="master" \
+                --silent 2>&1 || echo "Failed to create $FILENAME"
+            fi
+          done
+          echo "Badge publish complete"
 
       - name: Post deployment summary
         run: |
           echo "## Staging Deployed ✓" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Commit:** \`$(git rev-parse --short HEAD)\` — $(git log -1 --format=%s)" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Staging:** http://<VM_HOST>:82" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "To promote to production:" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`bash" >> $GITHUB_STEP_SUMMARY
-          echo "ssh deploy@\$VM_HOST" >> $GITHUB_STEP_SUMMARY
-          echo "cd /opt/corescope-deploy" >> $GITHUB_STEP_SUMMARY
-          echo "./manage.sh promote" >> $GITHUB_STEP_SUMMARY
-          echo "\`\`\`" >> $GITHUB_STEP_SUMMARY

.github/workflows/squad-heartbeat.yml

@@ -0,0 +1,171 @@
+name: Squad Heartbeat (Ralph)
+# ⚠️ SYNC: This workflow is maintained in 4 locations. Changes must be applied to all:
+#   - templates/workflows/squad-heartbeat.yml (source template)
+#   - packages/squad-cli/templates/workflows/squad-heartbeat.yml (CLI package)
+#   - .squad/templates/workflows/squad-heartbeat.yml (installed template)
+#   - .github/workflows/squad-heartbeat.yml (active workflow)
+# Run 'squad upgrade' to sync installed copies from source templates.
+
+on:
+  schedule:
+    # Every 30 minutes — adjust via cron expression as needed
+    - cron: '*/30 * * * *'
+
+  # React to completed work or new squad work
+  issues:
+    types: [closed, labeled]
+  pull_request:
+    types: [closed]
+
+  # Manual trigger
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  contents: read
+  pull-requests: read
+
+jobs:
+  heartbeat:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check triage script
+        id: check-script
+        run: |
+          if [ -f ".squad/templates/ralph-triage.js" ]; then
+            echo "has_script=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_script=false" >> $GITHUB_OUTPUT
+            echo "⚠️ ralph-triage.js not found — run 'squad upgrade' to install"
+          fi
+
+      - name: Ralph — Smart triage
+        if: steps.check-script.outputs.has_script == 'true'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          node .squad/templates/ralph-triage.js \
+            --squad-dir .squad \
+            --output triage-results.json
+
+      - name: Ralph — Apply triage decisions
+        if: steps.check-script.outputs.has_script == 'true' && hashFiles('triage-results.json') != ''
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const path = 'triage-results.json';
+            if (!fs.existsSync(path)) {
+              core.info('No triage results — board is clear');
+              return;
+            }
+            
+            const results = JSON.parse(fs.readFileSync(path, 'utf8'));
+            if (results.length === 0) {
+              core.info('📋 Board is clear — Ralph found no untriaged issues');
+              return;
+            }
+            
+            for (const decision of results) {
+              try {
+                await github.rest.issues.addLabels({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: decision.issueNumber,
+                  labels: [decision.label]
+                });
+                
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: decision.issueNumber,
+                  body: [
+                    '### 🔄 Ralph — Auto-Triage',
+                    '',
+                    `**Assigned to:** ${decision.assignTo}`,
+                    `**Reason:** ${decision.reason}`,
+                    `**Source:** ${decision.source}`,
+                    '',
+                    '> Ralph auto-triaged this issue using routing rules.',
+                    '> To reassign, swap the `squad:*` label.'
+                  ].join('\n')
+                });
+                
+                core.info(`Triaged #${decision.issueNumber} → ${decision.assignTo} (${decision.source})`);
+              } catch (e) {
+                core.warning(`Failed to triage #${decision.issueNumber}: ${e.message}`);
+              }
+            }
+            
+            core.info(`🔄 Ralph triaged ${results.length} issue(s)`);
+
+      # Copilot auto-assign step (uses PAT if available)
+      - name: Ralph — Assign @copilot issues
+        if: success()
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN || secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+            if (!fs.existsSync(teamFile)) return;
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+
+            // Check if @copilot is on the team with auto-assign
+            const hasCopilot = content.includes('🤖 Coding Agent') || content.includes('@copilot');
+            const autoAssign = content.includes('<!-- copilot-auto-assign: true -->');
+            if (!hasCopilot || !autoAssign) return;
+
+            // Find issues labeled squad:copilot with no assignee
+            try {
+              const { data: copilotIssues } = await github.rest.issues.listForRepo({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                labels: 'squad:copilot',
+                state: 'open',
+                per_page: 5
+              });
+
+              const unassigned = copilotIssues.filter(i =>
+                !i.assignees || i.assignees.length === 0
+              );
+
+              if (unassigned.length === 0) {
+                core.info('No unassigned squad:copilot issues');
+                return;
+              }
+
+              // Get repo default branch
+              const { data: repoData } = await github.rest.repos.get({
+                owner: context.repo.owner,
+                repo: context.repo.repo
+              });
+
+              for (const issue of unassigned) {
+                try {
+                  await github.request('POST /repos/{owner}/{repo}/issues/{issue_number}/assignees', {
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    issue_number: issue.number,
+                    assignees: ['copilot-swe-agent[bot]'],
+                    agent_assignment: {
+                      target_repo: `${context.repo.owner}/${context.repo.repo}`,
+                      base_branch: repoData.default_branch,
+                      custom_instructions: `Read .squad/team.md (or .ai-team/team.md) for team context and .squad/routing.md (or .ai-team/routing.md) for routing rules.`
+                    }
+                  });
+                  core.info(`Assigned copilot-swe-agent[bot] to #${issue.number}`);
+                } catch (e) {
+                  core.warning(`Failed to assign @copilot to #${issue.number}: ${e.message}`);
+                }
+              }
+            } catch (e) {
+              core.info(`No squad:copilot label found or error: ${e.message}`);
+            }

.github/workflows/squad-issue-assign.yml

@@ -0,0 +1,161 @@
+name: Squad Issue Assign
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  assign-work:
+    # Only trigger on squad:{member} labels (not the base "squad" label)
+    if: startsWith(github.event.label.name, 'squad:')
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Identify assigned member and trigger work
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const issue = context.payload.issue;
+            const label = context.payload.label.name;
+
+            // Extract member name from label (e.g., "squad:ripley" → "ripley")
+            const memberName = label.replace('squad:', '').toLowerCase();
+
+            // Read team roster — check .squad/ first, fall back to .ai-team/
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+            if (!fs.existsSync(teamFile)) {
+              core.warning('No .squad/team.md or .ai-team/team.md found — cannot assign work');
+              return;
+            }
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+            const lines = content.split('\n');
+
+            // Check if this is a coding agent assignment
+            const isCopilotAssignment = memberName === 'copilot';
+
+            let assignedMember = null;
+            if (isCopilotAssignment) {
+              assignedMember = { name: '@copilot', role: 'Coding Agent' };
+            } else {
+              let inMembersTable = false;
+              for (const line of lines) {
+                if (line.match(/^##\s+(Members|Team Roster)/i)) {
+                  inMembersTable = true;
+                  continue;
+                }
+                if (inMembersTable && line.startsWith('## ')) {
+                  break;
+                }
+                if (inMembersTable && line.startsWith('|') && !line.includes('---') && !line.includes('Name')) {
+                  const cells = line.split('|').map(c => c.trim()).filter(Boolean);
+                  if (cells.length >= 2 && cells[0].toLowerCase() === memberName) {
+                    assignedMember = { name: cells[0], role: cells[1] };
+                    break;
+                  }
+                }
+              }
+            }
+
+            if (!assignedMember) {
+              core.warning(`No member found matching label "${label}"`);
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: issue.number,
+                body: `⚠️ No squad member found matching label \`${label}\`. Check \`.squad/team.md\` (or \`.ai-team/team.md\`) for valid member names.`
+              });
+              return;
+            }
+
+            // Post assignment acknowledgment
+            let comment;
+            if (isCopilotAssignment) {
+              comment = [
+                `### 🤖 Routed to @copilot (Coding Agent)`,
+                '',
+                `**Issue:** #${issue.number} — ${issue.title}`,
+                '',
+                `@copilot has been assigned and will pick this up automatically.`,
+                '',
+                `> The coding agent will create a \`copilot/*\` branch and open a draft PR.`,
+                `> Review the PR as you would any team member's work.`,
+              ].join('\n');
+            } else {
+              comment = [
+                `### 📋 Assigned to ${assignedMember.name} (${assignedMember.role})`,
+                '',
+                `**Issue:** #${issue.number} — ${issue.title}`,
+                '',
+                `${assignedMember.name} will pick this up in the next Copilot session.`,
+                '',
+                `> **For Copilot coding agent:** If enabled, this issue will be worked automatically.`,
+                `> Otherwise, start a Copilot session and say:`,
+                `> \`${assignedMember.name}, work on issue #${issue.number}\``,
+              ].join('\n');
+            }
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              body: comment
+            });
+
+            core.info(`Issue #${issue.number} assigned to ${assignedMember.name} (${assignedMember.role})`);
+
+      # Separate step: assign @copilot using PAT (required for coding agent)
+      - name: Assign @copilot coding agent
+        if: github.event.label.name == 'squad:copilot'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.COPILOT_ASSIGN_TOKEN }}
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            const issue_number = context.payload.issue.number;
+
+            // Get the default branch name (main, master, etc.)
+            const { data: repoData } = await github.rest.repos.get({ owner, repo });
+            const baseBranch = repoData.default_branch;
+
+            try {
+              await github.request('POST /repos/{owner}/{repo}/issues/{issue_number}/assignees', {
+                owner,
+                repo,
+                issue_number,
+                assignees: ['copilot-swe-agent[bot]'],
+                agent_assignment: {
+                  target_repo: `${owner}/${repo}`,
+                  base_branch: baseBranch,
+                  custom_instructions: '',
+                  custom_agent: '',
+                  model: ''
+                },
+                headers: {
+                  'X-GitHub-Api-Version': '2022-11-28'
+                }
+              });
+              core.info(`Assigned copilot-swe-agent to issue #${issue_number} (base: ${baseBranch})`);
+            } catch (err) {
+              core.warning(`Assignment with agent_assignment failed: ${err.message}`);
+              // Fallback: try without agent_assignment
+              try {
+                await github.rest.issues.addAssignees({
+                  owner, repo, issue_number,
+                  assignees: ['copilot-swe-agent']
+                });
+                core.info(`Fallback assigned copilot-swe-agent to issue #${issue_number}`);
+              } catch (err2) {
+                core.warning(`Fallback also failed: ${err2.message}`);
+              }
+            }

.github/workflows/squad-triage.yml

@@ -0,0 +1,260 @@
+name: Squad Triage
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  triage:
+    if: github.event.label.name == 'squad'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Triage issue via Lead agent
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            const issue = context.payload.issue;
+
+            // Read team roster — check .squad/ first, fall back to .ai-team/
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+            if (!fs.existsSync(teamFile)) {
+              core.warning('No .squad/team.md or .ai-team/team.md found — cannot triage');
+              return;
+            }
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+            const lines = content.split('\n');
+
+            // Check if @copilot is on the team
+            const hasCopilot = content.includes('🤖 Coding Agent');
+            const copilotAutoAssign = content.includes('<!-- copilot-auto-assign: true -->');
+
+            // Parse @copilot capability profile
+            let goodFitKeywords = [];
+            let needsReviewKeywords = [];
+            let notSuitableKeywords = [];
+
+            if (hasCopilot) {
+              // Extract capability tiers from team.md
+              const goodFitMatch = content.match(/🟢\s*Good fit[^:]*:\s*(.+)/i);
+              const needsReviewMatch = content.match(/🟡\s*Needs review[^:]*:\s*(.+)/i);
+              const notSuitableMatch = content.match(/🔴\s*Not suitable[^:]*:\s*(.+)/i);
+
+              if (goodFitMatch) {
+                goodFitKeywords = goodFitMatch[1].toLowerCase().split(',').map(s => s.trim());
+              } else {
+                goodFitKeywords = ['bug fix', 'test coverage', 'lint', 'format', 'dependency update', 'small feature', 'scaffolding', 'doc fix', 'documentation'];
+              }
+              if (needsReviewMatch) {
+                needsReviewKeywords = needsReviewMatch[1].toLowerCase().split(',').map(s => s.trim());
+              } else {
+                needsReviewKeywords = ['medium feature', 'refactoring', 'api endpoint', 'migration'];
+              }
+              if (notSuitableMatch) {
+                notSuitableKeywords = notSuitableMatch[1].toLowerCase().split(',').map(s => s.trim());
+              } else {
+                notSuitableKeywords = ['architecture', 'system design', 'security', 'auth', 'encryption', 'performance'];
+              }
+            }
+
+            const members = [];
+            let inMembersTable = false;
+            for (const line of lines) {
+              if (line.match(/^##\s+(Members|Team Roster)/i)) {
+                inMembersTable = true;
+                continue;
+              }
+              if (inMembersTable && line.startsWith('## ')) {
+                break;
+              }
+              if (inMembersTable && line.startsWith('|') && !line.includes('---') && !line.includes('Name')) {
+                const cells = line.split('|').map(c => c.trim()).filter(Boolean);
+                if (cells.length >= 2 && cells[0] !== 'Scribe') {
+                  members.push({
+                    name: cells[0],
+                    role: cells[1]
+                  });
+                }
+              }
+            }
+
+            // Read routing rules — check .squad/ first, fall back to .ai-team/
+            let routingFile = '.squad/routing.md';
+            if (!fs.existsSync(routingFile)) {
+              routingFile = '.ai-team/routing.md';
+            }
+            let routingContent = '';
+            if (fs.existsSync(routingFile)) {
+              routingContent = fs.readFileSync(routingFile, 'utf8');
+            }
+
+            // Find the Lead
+            const lead = members.find(m =>
+              m.role.toLowerCase().includes('lead') ||
+              m.role.toLowerCase().includes('architect') ||
+              m.role.toLowerCase().includes('coordinator')
+            );
+
+            if (!lead) {
+              core.warning('No Lead role found in team roster — cannot triage');
+              return;
+            }
+
+            // Build triage context
+            const memberList = members.map(m =>
+              `- **${m.name}** (${m.role}) → label: \`squad:${m.name.toLowerCase()}\``
+            ).join('\n');
+
+            // Determine best assignee based on issue content and routing
+            const issueText = `${issue.title}\n${issue.body || ''}`.toLowerCase();
+
+            let assignedMember = null;
+            let triageReason = '';
+            let copilotTier = null;
+
+            // First, evaluate @copilot fit if enabled
+            if (hasCopilot) {
+              const isNotSuitable = notSuitableKeywords.some(kw => issueText.includes(kw));
+              const isGoodFit = !isNotSuitable && goodFitKeywords.some(kw => issueText.includes(kw));
+              const isNeedsReview = !isNotSuitable && !isGoodFit && needsReviewKeywords.some(kw => issueText.includes(kw));
+
+              if (isGoodFit) {
+                copilotTier = 'good-fit';
+                assignedMember = { name: '@copilot', role: 'Coding Agent' };
+                triageReason = '🟢 Good fit for @copilot — matches capability profile';
+              } else if (isNeedsReview) {
+                copilotTier = 'needs-review';
+                assignedMember = { name: '@copilot', role: 'Coding Agent' };
+                triageReason = '🟡 Routing to @copilot (needs review) — a squad member should review the PR';
+              } else if (isNotSuitable) {
+                copilotTier = 'not-suitable';
+                // Fall through to normal routing
+              }
+            }
+
+            // If not routed to @copilot, use keyword-based routing
+            if (!assignedMember) {
+              for (const member of members) {
+                const role = member.role.toLowerCase();
+                if ((role.includes('frontend') || role.includes('ui')) &&
+                    (issueText.includes('ui') || issueText.includes('frontend') ||
+                     issueText.includes('css') || issueText.includes('component') ||
+                     issueText.includes('button') || issueText.includes('page') ||
+                     issueText.includes('layout') || issueText.includes('design'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to frontend/UI work';
+                  break;
+                }
+                if ((role.includes('backend') || role.includes('api') || role.includes('server')) &&
+                    (issueText.includes('api') || issueText.includes('backend') ||
+                     issueText.includes('database') || issueText.includes('endpoint') ||
+                     issueText.includes('server') || issueText.includes('auth'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to backend/API work';
+                  break;
+                }
+                if ((role.includes('test') || role.includes('qa') || role.includes('quality')) &&
+                    (issueText.includes('test') || issueText.includes('bug') ||
+                     issueText.includes('fix') || issueText.includes('regression') ||
+                     issueText.includes('coverage'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to testing/quality work';
+                  break;
+                }
+                if ((role.includes('devops') || role.includes('infra') || role.includes('ops')) &&
+                    (issueText.includes('deploy') || issueText.includes('ci') ||
+                     issueText.includes('pipeline') || issueText.includes('docker') ||
+                     issueText.includes('infrastructure'))) {
+                  assignedMember = member;
+                  triageReason = 'Issue relates to DevOps/infrastructure work';
+                  break;
+                }
+              }
+            }
+
+            // Default to Lead if no routing match
+            if (!assignedMember) {
+              assignedMember = lead;
+              triageReason = 'No specific domain match — assigned to Lead for further analysis';
+            }
+
+            const isCopilot = assignedMember.name === '@copilot';
+            const assignLabel = isCopilot ? 'squad:copilot' : `squad:${assignedMember.name.toLowerCase()}`;
+
+            // Add the member-specific label
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              labels: [assignLabel]
+            });
+
+            // Apply default triage verdict
+            await github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              labels: ['go:needs-research']
+            });
+
+            // Auto-assign @copilot if enabled
+            if (isCopilot && copilotAutoAssign) {
+              try {
+                await github.rest.issues.addAssignees({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: issue.number,
+                  assignees: ['copilot']
+                });
+              } catch (err) {
+                core.warning(`Could not auto-assign @copilot: ${err.message}`);
+              }
+            }
+
+            // Build copilot evaluation note
+            let copilotNote = '';
+            if (hasCopilot && !isCopilot) {
+              if (copilotTier === 'not-suitable') {
+                copilotNote = `\n\n**@copilot evaluation:** 🔴 Not suitable — issue involves work outside the coding agent's capability profile.`;
+              } else {
+                copilotNote = `\n\n**@copilot evaluation:** No strong capability match — routed to squad member.`;
+              }
+            }
+
+            // Post triage comment
+            const comment = [
+              `### 🏗️ Squad Triage — ${lead.name} (${lead.role})`,
+              '',
+              `**Issue:** #${issue.number} — ${issue.title}`,
+              `**Assigned to:** ${assignedMember.name} (${assignedMember.role})`,
+              `**Reason:** ${triageReason}`,
+              copilotTier === 'needs-review' ? `\n⚠️ **PR review recommended** — a squad member should review @copilot's work on this one.` : '',
+              copilotNote,
+              '',
+              `---`,
+              '',
+              `**Team roster:**`,
+              memberList,
+              hasCopilot ? `- **@copilot** (Coding Agent) → label: \`squad:copilot\`` : '',
+              '',
+              `> To reassign, remove the current \`squad:*\` label and add the correct one.`,
+            ].filter(Boolean).join('\n');
+
+            await github.rest.issues.createComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: issue.number,
+              body: comment
+            });
+
+            core.info(`Triaged issue #${issue.number} → ${assignedMember.name} (${assignLabel})`);

.github/workflows/sync-squad-labels.yml

@@ -0,0 +1,169 @@
+name: Sync Squad Labels
+
+on:
+  push:
+    paths:
+      - '.squad/team.md'
+      - '.ai-team/team.md'
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  sync-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Parse roster and sync labels
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const fs = require('fs');
+            let teamFile = '.squad/team.md';
+            if (!fs.existsSync(teamFile)) {
+              teamFile = '.ai-team/team.md';
+            }
+
+            if (!fs.existsSync(teamFile)) {
+              core.info('No .squad/team.md or .ai-team/team.md found — skipping label sync');
+              return;
+            }
+
+            const content = fs.readFileSync(teamFile, 'utf8');
+            const lines = content.split('\n');
+
+            // Parse the Members table for agent names
+            const members = [];
+            let inMembersTable = false;
+            for (const line of lines) {
+              if (line.match(/^##\s+(Members|Team Roster)/i)) {
+                inMembersTable = true;
+                continue;
+              }
+              if (inMembersTable && line.startsWith('## ')) {
+                break;
+              }
+              if (inMembersTable && line.startsWith('|') && !line.includes('---') && !line.includes('Name')) {
+                const cells = line.split('|').map(c => c.trim()).filter(Boolean);
+                if (cells.length >= 2 && cells[0] !== 'Scribe') {
+                  members.push({
+                    name: cells[0],
+                    role: cells[1]
+                  });
+                }
+              }
+            }
+
+            core.info(`Found ${members.length} squad members: ${members.map(m => m.name).join(', ')}`);
+
+            // Check if @copilot is on the team
+            const hasCopilot = content.includes('🤖 Coding Agent');
+
+            // Define label color palette for squad labels
+            const SQUAD_COLOR = '9B8FCC';
+            const MEMBER_COLOR = '9B8FCC';
+            const COPILOT_COLOR = '10b981';
+
+            // Define go: and release: labels (static)
+            const GO_LABELS = [
+              { name: 'go:yes', color: '0E8A16', description: 'Ready to implement' },
+              { name: 'go:no', color: 'B60205', description: 'Not pursuing' },
+              { name: 'go:needs-research', color: 'FBCA04', description: 'Needs investigation' }
+            ];
+
+            const RELEASE_LABELS = [
+              { name: 'release:v0.4.0', color: '6B8EB5', description: 'Targeted for v0.4.0' },
+              { name: 'release:v0.5.0', color: '6B8EB5', description: 'Targeted for v0.5.0' },
+              { name: 'release:v0.6.0', color: '8B7DB5', description: 'Targeted for v0.6.0' },
+              { name: 'release:v1.0.0', color: '8B7DB5', description: 'Targeted for v1.0.0' },
+              { name: 'release:backlog', color: 'D4E5F7', description: 'Not yet targeted' }
+            ];
+
+            const TYPE_LABELS = [
+              { name: 'type:feature', color: 'DDD1F2', description: 'New capability' },
+              { name: 'type:bug', color: 'FF0422', description: 'Something broken' },
+              { name: 'type:spike', color: 'F2DDD4', description: 'Research/investigation — produces a plan, not code' },
+              { name: 'type:docs', color: 'D4E5F7', description: 'Documentation work' },
+              { name: 'type:chore', color: 'D4E5F7', description: 'Maintenance, refactoring, cleanup' },
+              { name: 'type:epic', color: 'CC4455', description: 'Parent issue that decomposes into sub-issues' }
+            ];
+
+            // High-signal labels — these MUST visually dominate all others
+            const SIGNAL_LABELS = [
+              { name: 'bug', color: 'FF0422', description: 'Something isn\'t working' },
+              { name: 'feedback', color: '00E5FF', description: 'User feedback — high signal, needs attention' }
+            ];
+
+            const PRIORITY_LABELS = [
+              { name: 'priority:p0', color: 'B60205', description: 'Blocking release' },
+              { name: 'priority:p1', color: 'D93F0B', description: 'This sprint' },
+              { name: 'priority:p2', color: 'FBCA04', description: 'Next sprint' }
+            ];
+
+            // Ensure the base "squad" triage label exists
+            const labels = [
+              { name: 'squad', color: SQUAD_COLOR, description: 'Squad triage inbox — Lead will assign to a member' }
+            ];
+
+            for (const member of members) {
+              labels.push({
+                name: `squad:${member.name.toLowerCase()}`,
+                color: MEMBER_COLOR,
+                description: `Assigned to ${member.name} (${member.role})`
+              });
+            }
+
+            // Add @copilot label if coding agent is on the team
+            if (hasCopilot) {
+              labels.push({
+                name: 'squad:copilot',
+                color: COPILOT_COLOR,
+                description: 'Assigned to @copilot (Coding Agent) for autonomous work'
+              });
+            }
+
+            // Add go:, release:, type:, priority:, and high-signal labels
+            labels.push(...GO_LABELS);
+            labels.push(...RELEASE_LABELS);
+            labels.push(...TYPE_LABELS);
+            labels.push(...PRIORITY_LABELS);
+            labels.push(...SIGNAL_LABELS);
+
+            // Sync labels (create or update)
+            for (const label of labels) {
+              try {
+                await github.rest.issues.getLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: label.name
+                });
+                // Label exists — update it
+                await github.rest.issues.updateLabel({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  name: label.name,
+                  color: label.color,
+                  description: label.description
+                });
+                core.info(`Updated label: ${label.name}`);
+              } catch (err) {
+                if (err.status === 404) {
+                  // Label doesn't exist — create it
+                  await github.rest.issues.createLabel({
+                    owner: context.repo.owner,
+                    repo: context.repo.repo,
+                    name: label.name,
+                    color: label.color,
+                    description: label.description
+                  });
+                  core.info(`Created label: ${label.name}`);
+                } else {
+                  throw err;
+                }
+              }
+            }
+
+            core.info(`Label sync complete: ${labels.length} labels synced`);

.gitignore

@@ -28,3 +28,5 @@ reps.txt
 cmd/server/server.exe
 cmd/ingestor/ingestor.exe
 # CI trigger
+!test-fixtures/e2e-fixture.db
+corescope-server

.nycrc.json

@@ -0,0 +1,10 @@
+{
+  "include": [
+    "public/*.js"
+  ],
+  "exclude": [
+    "public/vendor/**",
+    "public/leaflet-*.js",
+    "public/qrcode*.js"
+  ]
+}

AGENTS.md

@@ -4,14 +4,20 @@ Guide for AI agents working on this codebase. Read this before writing any code.
 
 ## Architecture
 
-Single Node.js server + static frontend. No build step. No framework. No bundler.
+Go backend + static frontend. No build step. No framework. No bundler.
+
+**⚠️ The Node.js server (server.js) is DEPRECATED and has been removed. All backend code is in Go.**
+**⚠️ DO NOT create or modify any Node.js server files. All backend changes go in `cmd/server/` or `cmd/ingestor/`.**
 
 ```
-server.js          — Express API + MQTT ingestion + WebSocket broadcast
-decoder.js         — MeshCore packet parser (header, path, payload, adverts)
-packet-store.js    — In-memory packet store + query engine (backed by SQLite)
-db.js              — SQLite schema + prepared statements
-public/            — Frontend (vanilla JS, one file per page)
+cmd/server/        — Go API server (REST + WebSocket broadcast + static file serving)
+  main.go          — Entry point, flags, SPA handler
+  routes.go        — All /api/* endpoints
+  store.go         — In-memory packet store + analytics + SQLite queries
+  config.go        — Configuration loading
+  decoder.go       — MeshCore packet decoder
+cmd/ingestor/      — Go MQTT ingestor (separate binary, writes to shared SQLite DB)
+public/            — Frontend (vanilla JS, one file per page) — ACTIVE, NOT DEPRECATED
   app.js           — SPA router, shared globals, theme loading
   roles.js         — ROLE_COLORS, TYPE_COLORS, health thresholds, shared helpers
   nodes.js         — Nodes list + side pane + full detail page
@@ -28,17 +34,25 @@ public/            — Frontend (vanilla JS, one file per page)
   live.css         — Live page styles
   home.css         — Home page styles
   index.html       — SPA shell, script/style tags with cache busters
+test-fixtures/     — Real data SQLite fixture from staging (used for E2E tests)
+scripts/           — Tooling (coverage collector, fixture capture, frontend instrumentation)
 ```
 
 ### Data Flow
-1. MQTT brokers → server.js ingests packets → decoder.js parses → packet-store.js stores in memory + SQLite
-2. WebSocket broadcasts new packets to connected browsers
-3. Frontend fetches via REST API, filters/sorts client-side
+1. MQTT brokers → Go ingestor (`cmd/ingestor/`) ingests packets → decodes → writes to SQLite
+2. Go server (`cmd/server/`) polls SQLite for new packets, broadcasts via WebSocket
+3. Frontend fetches via REST API (`/api/*`), filters/sorts client-side
+
+### What's Deprecated (DO NOT TOUCH)
+The following were part of the old Node.js backend and have been removed:
+- `server.js`, `db.js`, `decoder.js`, `server-helpers.js`, `packet-store.js`, `iata-coords.js`
+- All `test-server-*.js`, `test-decoder*.js`, `test-db*.js`, `test-regional*.js` files
+- If you see references to these in comments or docs, they're stale — ignore them
 
 ## Rules — Read These First
 
 ### 1. No commit without tests
-Every change that touches logic MUST have unit tests. Run `node test-packet-filter.js && node test-aging.js` before pushing. If you add new logic, add tests to the appropriate test file or create a new one. No exceptions.
+Every change that touches logic MUST have tests. For Go backend: `cd cmd/server && go test ./...` and `cd cmd/ingestor && go test ./...`. For frontend: `node test-packet-filter.js && node test-aging.js && node test-frontend-helpers.js`. If you add new logic, add tests. No exceptions.
 
 ### 2. No commit without browser validation
 After pushing, verify the change works in an actual browser. Use `browser profile=openclaw` against the running instance. Take a screenshot if the change is visual. If you can't validate it, say so — don't claim it works.
@@ -77,6 +91,9 @@ Never use `git add -A` or `git add .`. Always list files explicitly: `git add fi
 ### 10. Don't regress performance
 The packets page loads 30K+ packets. Don't add per-packet API calls. Don't add O(n²) loops. Client-side filtering is preferred over server-side. If you need data from the server, fetch it once and cache it.
 
+### 11. PR descriptions must be clean markdown
+When opening a pull request, the description must be **valid, readable markdown**. Use real newlines (not `\n` literals), proper code fences, and correct heading syntax. Write it using `--body-file -` (piped from a heredoc or file), never inline `--body` with escaped characters. If the description renders as garbage, fix it before requesting review. This is the first thing reviewers see.
+
 ## MeshCore Firmware — Source of Truth
 
 The MeshCore firmware source is cloned at `firmware/` (gitignored — not part of this repo). This is THE authoritative reference for anything related to the protocol, packet format, device behavior, advert structure, flags, hash sizes, route types, or how repeaters/companions/rooms/sensors behave.

README.md

@@ -1,10 +1,10 @@
 # CoreScope
 
-[![Go Server Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/go-server-coverage.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Go Ingestor Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/go-ingestor-coverage.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Frontend Tests](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/frontend-tests.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Frontend Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/.badges/frontend-coverage.json)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
-[![Deploy](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml/badge.svg)](https://github.com/Kpa-clawbot/corescope/actions/workflows/deploy.yml)
+[![Go Server Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/go-server-coverage.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![Go Ingestor Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/go-ingestor-coverage.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![E2E Tests](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/e2e-tests.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![Frontend Coverage](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Kpa-clawbot/CoreScope/master/.badges/frontend-coverage.json)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
+[![Deploy](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml/badge.svg)](https://github.com/Kpa-clawbot/CoreScope/actions/workflows/deploy.yml)
 
 > High-performance mesh network analyzer powered by Go. Sub-millisecond packet queries, ~300 MB memory for 56K+ packets, real-time WebSocket broadcast, full channel decryption.
 
@@ -79,7 +79,7 @@ Full experience on your phone — proper touch controls, iOS safe area support,
 No Go installation needed — everything builds inside the container.
 
 ```bash
-git clone https://github.com/Kpa-clawbot/corescope.git
+git clone https://github.com/Kpa-clawbot/CoreScope.git
 cd corescope
 ./manage.sh setup
 ```

benchmark-ab.sh

@@ -1,131 +0,0 @@
-#!/bin/bash
-# A/B benchmark: old (pre-perf) vs new (current)
-# Usage: ./benchmark-ab.sh
-set -e
-
-PORT_OLD=13003
-PORT_NEW=13004
-RUNS=3
-DB_PATH="$(pwd)/data/meshcore.db"
-
-OLD_COMMIT="23caae4"
-NEW_COMMIT="$(git rev-parse HEAD)"
-
-echo "═══════════════════════════════════════════════════════"
-echo "  A/B Benchmark: Pre-optimization vs Current"
-echo "═══════════════════════════════════════════════════════"
-echo "OLD: $OLD_COMMIT (v2.0.1 — before any perf work)"
-echo "NEW: $NEW_COMMIT (current)"
-echo "Runs per endpoint: $RUNS"
-echo ""
-
-# Get a real node pubkey for testing
-ORIG_DIR="$(pwd)"
-PUBKEY=$(sqlite3 "$DB_PATH" "SELECT public_key FROM nodes ORDER BY last_seen DESC LIMIT 1")
-echo "Test node: ${PUBKEY:0:16}..."
-echo ""
-
-# Setup old version in temp dir
-OLD_DIR=$(mktemp -d)
-echo "Cloning old version to $OLD_DIR..."
-git worktree add "$OLD_DIR" "$OLD_COMMIT" --quiet 2>/dev/null || {
-  git worktree add "$OLD_DIR" "$OLD_COMMIT" --detach --quiet
-}
-# Copy config + db symlink
-# Copy config + db + share node_modules
-cp config.json "$OLD_DIR/"
-mkdir -p "$OLD_DIR/data"
-cp "$ORIG_DIR/data/meshcore.db" "$OLD_DIR/data/meshcore.db"
-ln -sf "$ORIG_DIR/node_modules" "$OLD_DIR/node_modules"
-
-ENDPOINTS=(
-  "Stats|/api/stats"
-  "Packets(50)|/api/packets?limit=50"
-  "PacketsGrouped|/api/packets?limit=50&groupByHash=true"
-  "NodesList|/api/nodes?limit=50"
-  "NodeDetail|/api/nodes/$PUBKEY"
-  "NodeHealth|/api/nodes/$PUBKEY/health"
-  "NodeAnalytics|/api/nodes/$PUBKEY/analytics?days=7"
-  "BulkHealth|/api/nodes/bulk-health?limit=50"
-  "NetworkStatus|/api/nodes/network-status"
-  "Channels|/api/channels"
-  "Observers|/api/observers"
-  "RF|/api/analytics/rf"
-  "Topology|/api/analytics/topology"
-  "ChannelAnalytics|/api/analytics/channels"
-  "HashSizes|/api/analytics/hash-sizes"
-)
-
-bench_endpoint() {
-  local port=$1 path=$2 runs=$3 nocache=$4
-  local total=0
-  for i in $(seq 1 $runs); do
-    local url="http://127.0.0.1:$port$path"
-    if [ "$nocache" = "1" ]; then
-      if echo "$path" | grep -q '?'; then
-        url="${url}&nocache=1"
-      else
-        url="${url}?nocache=1"
-      fi
-    fi
-    local ms=$(curl -s -o /dev/null -w "%{time_total}" "$url" 2>/dev/null)
-    local ms_int=$(echo "$ms * 1000" | bc | cut -d. -f1)
-    total=$((total + ms_int))
-  done
-  echo $((total / runs))
-}
-
-# Launch old server
-echo "Starting OLD server (port $PORT_OLD)..."
-cd "$OLD_DIR"
-PORT=$PORT_OLD node server.js &>/dev/null &
-OLD_PID=$!
-cd - >/dev/null
-
-# Launch new server
-echo "Starting NEW server (port $PORT_NEW)..."
-PORT=$PORT_NEW node server.js &>/dev/null &
-NEW_PID=$!
-
-# Wait for both
-sleep 12  # old server has no memory store; new needs prewarm
-
-# Verify
-curl -s "http://127.0.0.1:$PORT_OLD/api/stats" >/dev/null 2>&1 || { echo "OLD server failed to start"; kill $OLD_PID $NEW_PID 2>/dev/null; exit 1; }
-curl -s "http://127.0.0.1:$PORT_NEW/api/stats" >/dev/null 2>&1 || { echo "NEW server failed to start"; kill $OLD_PID $NEW_PID 2>/dev/null; exit 1; }
-
-echo ""
-echo "Warming up caches on new server..."
-for ep in "${ENDPOINTS[@]}"; do
-  path="${ep#*|}"
-  curl -s -o /dev/null "http://127.0.0.1:$PORT_NEW$path" 2>/dev/null
-done
-sleep 2
-
-printf "\n%-22s %9s %9s %9s %9s\n" "Endpoint" "Old(ms)" "New-cold" "New-cache" "Speedup"
-printf "%-22s %9s %9s %9s %9s\n" "──────────────────────" "─────────" "─────────" "─────────" "─────────"
-
-for ep in "${ENDPOINTS[@]}"; do
-  name="${ep%%|*}"
-  path="${ep#*|}"
-  
-  old_ms=$(bench_endpoint $PORT_OLD "$path" $RUNS 0)
-  new_cold=$(bench_endpoint $PORT_NEW "$path" $RUNS 1)
-  new_cached=$(bench_endpoint $PORT_NEW "$path" $RUNS 0)
-  
-  if [ "$old_ms" -gt 0 ] && [ "$new_cached" -gt 0 ]; then
-    speedup="${old_ms}/${new_cached}"
-    speedup_x=$(echo "scale=0; $old_ms / $new_cached" | bc 2>/dev/null || echo "?")
-    printf "%-22s %7dms %7dms %7dms %7d×\n" "$name" "$old_ms" "$new_cold" "$new_cached" "$speedup_x"
-  else
-    printf "%-22s %7dms %7dms %7dms %9s\n" "$name" "$old_ms" "$new_cold" "$new_cached" "∞"
-  fi
-done
-
-echo ""
-echo "═══════════════════════════════════════════════════════"
-
-# Cleanup
-kill $OLD_PID $NEW_PID 2>/dev/null
-git worktree remove "$OLD_DIR" --force 2>/dev/null
-echo "Done."

benchmark.js

@@ -1,246 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * Benchmark suite for meshcore-analyzer.
- * Launches two server instances — one with in-memory store, one with pure SQLite —
- * and compares performance side by side.
- *
- * Usage: node benchmark.js [--runs 5] [--json]
- */
-
-const http = require('http');
-const { spawn } = require('child_process');
-const path = require('path');
-
-const args = process.argv.slice(2);
-const RUNS = Number(args.find((a, i) => args[i - 1] === '--runs') || 5);
-const JSON_OUT = args.includes('--json');
-
-const PORT_MEM = 13001;  // In-memory store
-const PORT_SQL = 13002;  // SQLite-only
-
-const ENDPOINTS = [
-  { name: 'Stats', path: '/api/stats' },
-  { name: 'Packets (50)', path: '/api/packets?limit=50' },
-  { name: 'Packets (100)', path: '/api/packets?limit=100' },
-  { name: 'Packets grouped', path: '/api/packets?limit=100&groupByHash=true' },
-  { name: 'Packets filtered', path: '/api/packets?limit=50&type=5' },
-  { name: 'Packets timestamps', path: '/api/packets/timestamps?since=2020-01-01' },
-  { name: 'Nodes list', path: '/api/nodes?limit=50' },
-  { name: 'Node detail', path: '/api/nodes/__FIRST_NODE__' },
-  { name: 'Node health', path: '/api/nodes/__FIRST_NODE__/health' },
-  { name: 'Bulk health', path: '/api/nodes/bulk-health?limit=50' },
-  { name: 'Network status', path: '/api/nodes/network-status' },
-  { name: 'Observers', path: '/api/observers' },
-  { name: 'Channels', path: '/api/channels' },
-  { name: 'RF Analytics', path: '/api/analytics/rf' },
-  { name: 'Topology', path: '/api/analytics/topology' },
-  { name: 'Channel Analytics', path: '/api/analytics/channels' },
-  { name: 'Hash Sizes', path: '/api/analytics/hash-sizes' },
-  { name: 'Subpaths 2-hop', path: '/api/analytics/subpaths?minLen=2&maxLen=2&limit=50' },
-  { name: 'Subpaths 3-hop', path: '/api/analytics/subpaths?minLen=3&maxLen=3&limit=30' },
-  { name: 'Subpaths 4-hop', path: '/api/analytics/subpaths?minLen=4&maxLen=4&limit=20' },
-  { name: 'Subpaths 5-8 hop', path: '/api/analytics/subpaths?minLen=5&maxLen=8&limit=15' },
-];
-
-function fetch(url) {
-  return new Promise((resolve, reject) => {
-    const t0 = process.hrtime.bigint();
-    const req = http.get(url, (res) => {
-      let body = '';
-      res.on('data', c => body += c);
-      res.on('end', () => {
-        const ms = Number(process.hrtime.bigint() - t0) / 1e6;
-        resolve({ ms, bytes: Buffer.byteLength(body), status: res.statusCode, body });
-      });
-    });
-    req.on('error', reject);
-    req.setTimeout(60000, () => { req.destroy(); reject(new Error('timeout')); });
-  });
-}
-
-function median(arr) { const s = [...arr].sort((a,b)=>a-b); return s[Math.floor(s.length/2)]; }
-function p95(arr) { const s = [...arr].sort((a,b)=>a-b); return s[Math.floor(s.length*0.95)]; }
-function avg(arr) { return arr.reduce((a,b)=>a+b,0)/arr.length; }
-function fmt(ms) { return ms >= 1000 ? (ms/1000).toFixed(1)+'s' : ms.toFixed(1)+'ms'; }
-function fmtSize(b) { return b >= 1048576 ? (b/1048576).toFixed(1)+'MB' : b >= 1024 ? (b/1024).toFixed(0)+'KB' : b+'B'; }
-
-function launchServer(port, env = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn('node', ['server.js'], {
-      cwd: __dirname,
-      env: { ...process.env, PORT: String(port), ...env },
-      stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    let started = false;
-    const timeout = setTimeout(() => { if (!started) { child.kill(); reject(new Error('Server start timeout')); } }, 30000);
-
-    child.stdout.on('data', (d) => {
-      if (!started && (d.toString().includes('listening') || d.toString().includes('running'))) {
-        started = true; clearTimeout(timeout); resolve(child);
-      }
-    });
-    child.stderr.on('data', (d) => {
-      if (!started && (d.toString().includes('listening') || d.toString().includes('running'))) {
-        started = true; clearTimeout(timeout); resolve(child);
-      }
-    });
-    child.on('exit', (code) => { if (!started) { clearTimeout(timeout); reject(new Error(`Server exited with ${code}`)); } });
-
-    // Fallback: wait longer (SQLite-only mode pre-warms subpaths ~6s)
-    setTimeout(() => {
-      if (!started) {
-        started = true; clearTimeout(timeout);
-        resolve(child);
-      }
-    }, 15000);
-  });
-}
-
-async function waitForServer(port, maxMs = 20000) {
-  const t0 = Date.now();
-  while (Date.now() - t0 < maxMs) {
-    try {
-      const r = await fetch(`http://127.0.0.1:${port}/api/stats`);
-      if (r.status === 200) return true;
-    } catch {}
-    await new Promise(r => setTimeout(r, 500));
-  }
-  throw new Error(`Server on port ${port} didn't start`);
-}
-
-async function benchmarkEndpoints(port, endpoints, nocache = false) {
-  const results = [];
-  for (const ep of endpoints) {
-    const suffix = nocache ? (ep.path.includes('?') ? '&nocache=1' : '?nocache=1') : '';
-    const url = `http://127.0.0.1:${port}${ep.path}${suffix}`;
-
-    // Warm-up
-    try { await fetch(url); } catch {}
-
-    const times = [];
-    let bytes = 0;
-    let failed = false;
-
-    for (let i = 0; i < RUNS; i++) {
-      try {
-        const r = await fetch(url);
-        if (r.status !== 200) { failed = true; break; }
-        times.push(r.ms);
-        bytes = r.bytes;
-      } catch { failed = true; break; }
-    }
-
-    if (failed || !times.length) {
-      results.push({ name: ep.name, failed: true });
-    } else {
-      results.push({
-        name: ep.name,
-        avg: Math.round(avg(times) * 10) / 10,
-        p50: Math.round(median(times) * 10) / 10,
-        p95: Math.round(p95(times) * 10) / 10,
-        bytes
-      });
-    }
-  }
-  return results;
-}
-
-async function run() {
-  console.log(`\nCoreScope Benchmark — ${RUNS} runs per endpoint`);
-  console.log('Launching servers...\n');
-
-  // Launch both servers
-  let memServer, sqlServer;
-  try {
-    console.log('  Starting in-memory server (port ' + PORT_MEM + ')...');
-    memServer = await launchServer(PORT_MEM, {});
-    await waitForServer(PORT_MEM);
-    console.log('  ✅ In-memory server ready');
-
-    console.log('  Starting SQLite-only server (port ' + PORT_SQL + ')...');
-    sqlServer = await launchServer(PORT_SQL, { NO_MEMORY_STORE: '1' });
-    await waitForServer(PORT_SQL);
-    console.log('  ✅ SQLite-only server ready\n');
-  } catch (e) {
-    console.error('Failed to start servers:', e.message);
-    if (memServer) memServer.kill();
-    if (sqlServer) sqlServer.kill();
-    process.exit(1);
-  }
-
-  // Get first node pubkey
-  let firstNode = '';
-  try {
-    const r = await fetch(`http://127.0.0.1:${PORT_MEM}/api/nodes?limit=1`);
-    const data = JSON.parse(r.body);
-    firstNode = data.nodes?.[0]?.public_key || '';
-  } catch {}
-
-  const endpoints = ENDPOINTS.map(e => ({
-    ...e,
-    path: e.path.replace('__FIRST_NODE__', firstNode),
-  }));
-
-  // Get packet count
-  try {
-    const r = await fetch(`http://127.0.0.1:${PORT_MEM}/api/stats`);
-    const stats = JSON.parse(r.body);
-    console.log(`Dataset: ${(stats.totalPackets || '?').toLocaleString()} packets\n`);
-  } catch {}
-
-  // Run benchmarks
-  console.log('Benchmarking in-memory store (nocache for true compute cost)...');
-  const memResults = await benchmarkEndpoints(PORT_MEM, endpoints, true);
-
-  console.log('Benchmarking SQLite-only (nocache)...');
-  const sqlResults = await benchmarkEndpoints(PORT_SQL, endpoints, true);
-
-  // Also test cached in-memory for the full picture
-  console.log('Benchmarking in-memory store (cached)...');
-  const memCachedResults = await benchmarkEndpoints(PORT_MEM, endpoints, false);
-
-  // Kill servers
-  memServer.kill();
-  sqlServer.kill();
-
-  if (JSON_OUT) {
-    console.log(JSON.stringify({ memoryNocache: memResults, sqliteNocache: sqlResults, memoryCached: memCachedResults }, null, 2));
-    return;
-  }
-
-  // Print results
-  const W = 94;
-  console.log(`\n${'═'.repeat(W)}`);
-  console.log('  🏁 BENCHMARK RESULTS: SQLite vs In-Memory Store');
-  console.log(`${'═'.repeat(W)}`);
-  console.log(`${'Endpoint'.padEnd(24)} ${'SQLite'.padStart(9)} ${'Memory'.padStart(9)} ${'Cached'.padStart(9)} ${'Speedup'.padStart(9)} ${'Size (SQL)'.padStart(10)} ${'Size (Mem)'.padStart(10)}`);
-  console.log(`${'─'.repeat(24)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(10)} ${'─'.repeat(10)}`);
-
-  for (let i = 0; i < endpoints.length; i++) {
-    const sql = sqlResults[i];
-    const mem = memResults[i];
-    const cached = memCachedResults[i];
-    if (!sql || sql.failed || !mem || mem.failed) {
-      console.log(`${endpoints[i].name.padEnd(24)} ${'FAILED'.padStart(9)}`);
-      continue;
-    }
-
-    const speedup = sql.avg > 0 && mem.avg > 0 ? Math.round(sql.avg / mem.avg) + '×' : '—';
-    const cachedStr = cached && !cached.failed ? fmt(cached.avg) : '—';
-
-    console.log(
-      `${sql.name.padEnd(24)} ${fmt(sql.avg).padStart(9)} ${fmt(mem.avg).padStart(9)} ${cachedStr.padStart(9)} ${speedup.padStart(9)} ${fmtSize(sql.bytes).padStart(10)} ${fmtSize(mem.bytes).padStart(10)}`
-    );
-  }
-
-  // Summary
-  const sqlTotal = sqlResults.filter(r => !r.failed).reduce((s, r) => s + r.avg, 0);
-  const memTotal = memResults.filter(r => !r.failed).reduce((s, r) => s + r.avg, 0);
-  console.log(`${'─'.repeat(24)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)} ${'─'.repeat(9)}`);
-  console.log(`${'TOTAL'.padEnd(24)} ${fmt(sqlTotal).padStart(9)} ${fmt(memTotal).padStart(9)} ${''.padStart(9)} ${(Math.round(sqlTotal/memTotal)+'×').padStart(9)}`);
-  console.log(`\n${'═'.repeat(W)}\n`);
-}
-
-run().catch(e => { console.error(e); process.exit(1); });

cmd/ingestor/decoder.go

@@ -572,6 +572,21 @@ func DecodePacket(hexString string, channelKeys map[string]string) (*DecodedPack
 	payloadBuf := buf[offset:]
 	payload := decodePayload(header.PayloadType, payloadBuf, channelKeys)
 
+	// TRACE packets store hop IDs in the payload (buf[9:]) rather than the header
+	// path field. The header path byte still encodes hashSize in bits 6-7, which
+	// we use to split the payload path data into individual hop prefixes.
+	if header.PayloadType == PayloadTRACE && payload.PathData != "" {
+		pathBytes, err := hex.DecodeString(payload.PathData)
+		if err == nil && path.HashSize > 0 {
+			hops := make([]string, 0, len(pathBytes)/path.HashSize)
+			for i := 0; i+path.HashSize <= len(pathBytes); i += path.HashSize {
+				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+path.HashSize])))
+			}
+			path.Hops = hops
+			path.HashCount = len(hops)
+		}
+	}
+
 	return &DecodedPacket{
 		Header:         header,
 		TransportCodes: tc,

cmd/ingestor/decoder_test.go

@@ -564,6 +564,31 @@ func TestDecodeTraceValid(t *testing.T) {
 	}
 }
 
+func TestDecodeTracePathParsing(t *testing.T) {
+	// Packet from issue #276: 260001807dca00000000007d547d
+	// Path byte 0x00 → hashSize=1, hops in payload at buf[9:] = 7d 54 7d
+	// Expected path: ["7D", "54", "7D"]
+	pkt, err := DecodePacket("260001807dca00000000007d547d", nil)
+	if err != nil {
+		t.Fatalf("DecodePacket error: %v", err)
+	}
+	if pkt.Payload.Type != "TRACE" {
+		t.Errorf("payload type=%s, want TRACE", pkt.Payload.Type)
+	}
+	want := []string{"7D", "54", "7D"}
+	if len(pkt.Path.Hops) != len(want) {
+		t.Fatalf("hops=%v, want %v", pkt.Path.Hops, want)
+	}
+	for i, h := range want {
+		if pkt.Path.Hops[i] != h {
+			t.Errorf("hops[%d]=%s, want %s", i, pkt.Path.Hops[i], h)
+		}
+	}
+	if pkt.Path.HashCount != 3 {
+		t.Errorf("hashCount=%d, want 3", pkt.Path.HashCount)
+	}
+}
+
 func TestDecodeAdvertShort(t *testing.T) {
 	p := decodeAdvert(make([]byte, 50))
 	if p.Error != "too short for advert" {

cmd/server/config.go

@@ -2,8 +2,10 @@ package main
 
 import (
 	"encoding/json"
+	"log"
 	"os"
 	"path/filepath"
+	"strings"
 )
 
 // Config mirrors the Node.js config.json structure (read-only fields).
@@ -45,12 +47,51 @@ type Config struct {
 	CacheTTL map[string]interface{} `json:"cacheTTL"`
 
 	Retention *RetentionConfig `json:"retention,omitempty"`
+
+	PacketStore *PacketStoreConfig `json:"packetStore,omitempty"`
+
+	GeoFilter *GeoFilterConfig `json:"geo_filter,omitempty"`
+
+	Timestamps *TimestampConfig `json:"timestamps,omitempty"`
+}
+
+// PacketStoreConfig controls in-memory packet store limits.
+type PacketStoreConfig struct {
+	RetentionHours float64 `json:"retentionHours"` // max age of packets in hours (0 = unlimited)
+	MaxMemoryMB    int     `json:"maxMemoryMB"`     // hard memory ceiling in MB (0 = unlimited)
+}
+
+type GeoFilterConfig struct {
+	Polygon  [][2]float64 `json:"polygon,omitempty"`
+	BufferKm float64      `json:"bufferKm,omitempty"`
+	LatMin   *float64     `json:"latMin,omitempty"`
+	LatMax   *float64     `json:"latMax,omitempty"`
+	LonMin   *float64     `json:"lonMin,omitempty"`
+	LonMax   *float64     `json:"lonMax,omitempty"`
+}
+
+type TimestampConfig struct {
+	DefaultMode       string `json:"defaultMode"`       // "ago" | "absolute"
+	Timezone          string `json:"timezone"`          // "local" | "utc"
+	FormatPreset      string `json:"formatPreset"`      // "iso" | "iso-seconds" | "locale"
+	CustomFormat      string `json:"customFormat"`      // freeform, only used when AllowCustomFormat=true
+	AllowCustomFormat bool   `json:"allowCustomFormat"` // admin gate
 }
 
 type RetentionConfig struct {
 	NodeDays int `json:"nodeDays"`
 }
 
+func defaultTimestampConfig() TimestampConfig {
+	return TimestampConfig{
+		DefaultMode:       "ago",
+		Timezone:          "local",
+		FormatPreset:      "iso",
+		CustomFormat:      "",
+		AllowCustomFormat: false,
+	}
+}
+
 // NodeDaysOrDefault returns the configured retention.nodeDays or 7 if not set.
 func (c *Config) NodeDaysOrDefault() int {
 	if c.Retention != nil && c.Retention.NodeDays > 0 {
@@ -95,8 +136,10 @@ func LoadConfig(baseDirs ...string) (*Config, error) {
 		if err := json.Unmarshal(data, cfg); err != nil {
 			continue
 		}
+		cfg.NormalizeTimestampConfig()
 		return cfg, nil
 	}
+	cfg.NormalizeTimestampConfig()
 	return cfg, nil // defaults
 }
 
@@ -184,3 +227,49 @@ func (c *Config) PropagationBufferMs() int {
 	}
 	return 5000
 }
+
+func (c *Config) NormalizeTimestampConfig() {
+	defaults := defaultTimestampConfig()
+	if c.Timestamps == nil {
+		log.Printf("[config] timestamps not configured — using defaults (ago/local/iso)")
+		c.Timestamps = &defaults
+		return
+	}
+
+	origMode := c.Timestamps.DefaultMode
+	mode := strings.ToLower(strings.TrimSpace(origMode))
+	switch mode {
+	case "ago", "absolute":
+		c.Timestamps.DefaultMode = mode
+	default:
+		log.Printf("[config] warning: timestamps.defaultMode=%q is invalid, using %q", origMode, defaults.DefaultMode)
+		c.Timestamps.DefaultMode = defaults.DefaultMode
+	}
+
+	origTimezone := c.Timestamps.Timezone
+	timezone := strings.ToLower(strings.TrimSpace(origTimezone))
+	switch timezone {
+	case "local", "utc":
+		c.Timestamps.Timezone = timezone
+	default:
+		log.Printf("[config] warning: timestamps.timezone=%q is invalid, using %q", origTimezone, defaults.Timezone)
+		c.Timestamps.Timezone = defaults.Timezone
+	}
+
+	origPreset := c.Timestamps.FormatPreset
+	formatPreset := strings.ToLower(strings.TrimSpace(origPreset))
+	switch formatPreset {
+	case "iso", "iso-seconds", "locale":
+		c.Timestamps.FormatPreset = formatPreset
+	default:
+		log.Printf("[config] warning: timestamps.formatPreset=%q is invalid, using %q", origPreset, defaults.FormatPreset)
+		c.Timestamps.FormatPreset = defaults.FormatPreset
+	}
+}
+
+func (c *Config) GetTimestampConfig() TimestampConfig {
+	if c == nil || c.Timestamps == nil {
+		return defaultTimestampConfig()
+	}
+	return *c.Timestamps
+}

cmd/server/config_test.go

@@ -31,6 +31,13 @@ func TestLoadConfigValidJSON(t *testing.T) {
 		"liveMap": map[string]interface{}{
 			"propagationBufferMs": 3000,
 		},
+		"timestamps": map[string]interface{}{
+			"defaultMode":       "absolute",
+			"timezone":          "utc",
+			"formatPreset":      "iso-seconds",
+			"customFormat":      "2006-01-02 15:04:05",
+			"allowCustomFormat": true,
+		},
 	}
 	data, _ := json.Marshal(cfgData)
 	os.WriteFile(filepath.Join(dir, "config.json"), data, 0644)
@@ -48,6 +55,18 @@ func TestLoadConfigValidJSON(t *testing.T) {
 	if cfg.MapDefaults.Zoom != 12 {
 		t.Errorf("expected zoom 12, got %d", cfg.MapDefaults.Zoom)
 	}
+	if cfg.Timestamps == nil {
+		t.Fatal("expected timestamps config")
+	}
+	if cfg.Timestamps.DefaultMode != "absolute" {
+		t.Errorf("expected defaultMode absolute, got %s", cfg.Timestamps.DefaultMode)
+	}
+	if cfg.Timestamps.Timezone != "utc" {
+		t.Errorf("expected timezone utc, got %s", cfg.Timestamps.Timezone)
+	}
+	if cfg.Timestamps.FormatPreset != "iso-seconds" {
+		t.Errorf("expected formatPreset iso-seconds, got %s", cfg.Timestamps.FormatPreset)
+	}
 }
 
 func TestLoadConfigFromDataSubdir(t *testing.T) {
@@ -76,6 +95,10 @@ func TestLoadConfigNoFiles(t *testing.T) {
 	if cfg.Port != 3000 {
 		t.Errorf("expected default port 3000, got %d", cfg.Port)
 	}
+	ts := cfg.GetTimestampConfig()
+	if ts.DefaultMode != "ago" || ts.Timezone != "local" || ts.FormatPreset != "iso" {
+		t.Errorf("expected default timestamp config ago/local/iso, got %s/%s/%s", ts.DefaultMode, ts.Timezone, ts.FormatPreset)
+	}
 }
 
 func TestLoadConfigInvalidJSON(t *testing.T) {
@@ -102,6 +125,36 @@ func TestLoadConfigNoArgs(t *testing.T) {
 	}
 }
 
+func TestLoadConfigTimestampNormalization(t *testing.T) {
+	dir := t.TempDir()
+	cfgData := map[string]interface{}{
+		"timestamps": map[string]interface{}{
+			"defaultMode":  "banana",
+			"timezone":     "mars",
+			"formatPreset": "weird",
+		},
+	}
+	data, _ := json.Marshal(cfgData)
+	os.WriteFile(filepath.Join(dir, "config.json"), data, 0644)
+
+	cfg, err := LoadConfig(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Timestamps == nil {
+		t.Fatal("expected timestamps to be set")
+	}
+	if cfg.Timestamps.DefaultMode != "ago" {
+		t.Errorf("expected normalized defaultMode ago, got %s", cfg.Timestamps.DefaultMode)
+	}
+	if cfg.Timestamps.Timezone != "local" {
+		t.Errorf("expected normalized timezone local, got %s", cfg.Timestamps.Timezone)
+	}
+	if cfg.Timestamps.FormatPreset != "iso" {
+		t.Errorf("expected normalized formatPreset iso, got %s", cfg.Timestamps.FormatPreset)
+	}
+}
+
 func TestLoadThemeValidJSON(t *testing.T) {
 	dir := t.TempDir()
 	themeData := map[string]interface{}{

cmd/server/coverage_test.go

@@ -259,7 +259,7 @@ func TestStoreQueryMultiNodePackets(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	t.Run("empty pubkeys", func(t *testing.T) {
@@ -313,7 +313,7 @@ func TestIngestNewFromDB(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()
@@ -384,7 +384,7 @@ func TestIngestNewFromDBv2(t *testing.T) {
 	db := setupTestDBv2(t)
 	defer db.Close()
 	seedV2Data(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()
@@ -412,7 +412,7 @@ func TestMaxTransmissionID(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	maxID := store.MaxTransmissionID()
@@ -421,7 +421,7 @@ func TestMaxTransmissionID(t *testing.T) {
 	}
 
 	t.Run("empty store", func(t *testing.T) {
-		emptyStore := NewPacketStore(db)
+		emptyStore := NewPacketStore(db, nil)
 		if emptyStore.MaxTransmissionID() != 0 {
 			t.Error("expected 0 for empty store")
 		}
@@ -599,7 +599,7 @@ func TestTransmissionsForObserverIndex(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Query packets for an observer — hits the byObserver index
@@ -622,7 +622,7 @@ func TestGetChannelMessagesFromStore(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Test channel should exist from seed data
@@ -675,7 +675,7 @@ func TestGetChannelMessagesDedupe(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (4, 2, 9.0, -93, '[]', ?)`, epoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	msgs, total := store.GetChannelMessages("#test", 100, 0)
@@ -692,7 +692,7 @@ func TestGetChannelsFromStore(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	channels := store.GetChannels("")
@@ -872,7 +872,7 @@ func TestPickBestObservation(t *testing.T) {
 func TestIndexByNode(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 
 	t.Run("empty decoded_json", func(t *testing.T) {
 		tx := &StoreTx{Hash: "h1"}
@@ -973,7 +973,7 @@ func TestPollerStartWithStore(t *testing.T) {
 	defer db.Close()
 	seedTestData(t, db)
 	hub := NewHub()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	poller := NewPoller(db, hub, 50*time.Millisecond)
@@ -1000,7 +1000,7 @@ func TestPerfMiddlewareSlowQuery(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 
@@ -1339,7 +1339,7 @@ func TestStoreQueryPacketsEdgeCases(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	t.Run("hash filter", func(t *testing.T) {
@@ -1654,7 +1654,7 @@ func TestStorePerfAndCacheStats(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	stats := store.GetPerfStoreStats()
@@ -1674,7 +1674,7 @@ func TestEnrichObs(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Find an observation from the loaded store
@@ -1928,7 +1928,7 @@ func TestStoreGetTimestamps(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	ts := store.GetTimestamps("2000-01-01")
@@ -1983,7 +1983,7 @@ func setupRichTestDB(t *testing.T) *DB {
 func TestStoreGetBulkHealthWithStore(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	results := store.GetBulkHealth(50, "")
@@ -2009,7 +2009,7 @@ func TestStoreGetBulkHealthWithStore(t *testing.T) {
 func TestStoreGetAnalyticsHashSizes(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsHashSizes("")
@@ -2031,7 +2031,7 @@ func TestStoreGetAnalyticsHashSizes(t *testing.T) {
 func TestStoreGetAnalyticsSubpaths(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsSubpaths("", 2, 8, 100)
@@ -2048,7 +2048,7 @@ func TestStoreGetAnalyticsSubpaths(t *testing.T) {
 func TestSubpathPrecomputedIndex(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// After Load(), the precomputed index must be populated.
@@ -2102,7 +2102,7 @@ func TestSubpathPrecomputedIndex(t *testing.T) {
 func TestStoreGetAnalyticsRFCacheHit(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// First call — cache miss
@@ -2128,7 +2128,7 @@ func TestStoreGetAnalyticsRFCacheHit(t *testing.T) {
 func TestStoreGetAnalyticsTopology(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsTopology("")
@@ -2158,7 +2158,7 @@ func TestStoreGetAnalyticsTopology(t *testing.T) {
 func TestStoreGetAnalyticsChannels(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsChannels("")
@@ -2205,7 +2205,7 @@ func TestStoreGetAnalyticsChannelsNumericHash(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (6, 1, 12.0, -88, '[]', ?)`, recentEpoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	result := store.GetAnalyticsChannels("")
 
@@ -2250,7 +2250,7 @@ func TestStoreGetAnalyticsChannelsNumericHash(t *testing.T) {
 func TestStoreGetAnalyticsDistance(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetAnalyticsDistance("")
@@ -2267,7 +2267,7 @@ func TestStoreGetAnalyticsDistance(t *testing.T) {
 func TestStoreGetSubpathDetail(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.GetSubpathDetail([]string{"aabb", "ccdd"})
@@ -2287,7 +2287,7 @@ func TestHandleAnalyticsRFWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2318,7 +2318,7 @@ func TestHandleBulkHealthWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2338,7 +2338,7 @@ func TestHandleAnalyticsSubpathsWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2358,7 +2358,7 @@ func TestHandleAnalyticsSubpathDetailWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2378,7 +2378,7 @@ func TestHandleAnalyticsDistanceWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2398,7 +2398,7 @@ func TestHandleAnalyticsHashSizesWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2418,7 +2418,7 @@ func TestHandleAnalyticsTopologyWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2438,7 +2438,7 @@ func TestHandleAnalyticsChannelsWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2457,7 +2457,7 @@ func TestHandleAnalyticsChannelsWithStore(t *testing.T) {
 func TestGetChannelMessagesRichData(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	messages, total := store.GetChannelMessages("#test", 100, 0)
@@ -2502,7 +2502,7 @@ func TestHandleChannelMessagesWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2524,7 +2524,7 @@ func TestHandleChannelsWithStore(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -2556,7 +2556,7 @@ func TestStoreGetStoreStats(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	stats, err := store.GetStoreStats()
@@ -2574,7 +2574,7 @@ func TestStoreQueryGroupedPackets(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.QueryGroupedPackets(PacketQuery{Limit: 50, Order: "DESC"})
@@ -2589,7 +2589,7 @@ func TestStoreGetPacketByHash(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	pkt := store.GetPacketByHash("abc123def4567890")
@@ -2630,7 +2630,7 @@ func TestResolvePayloadTypeNameUnknown(t *testing.T) {
 func TestCacheHitTopology(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// First call — cache miss
@@ -2655,7 +2655,7 @@ func TestCacheHitTopology(t *testing.T) {
 func TestCacheHitHashSizes(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	r1 := store.GetAnalyticsHashSizes("")
@@ -2678,7 +2678,7 @@ func TestCacheHitHashSizes(t *testing.T) {
 func TestCacheHitChannels(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	r1 := store.GetAnalyticsChannels("")
@@ -2701,7 +2701,7 @@ func TestCacheHitChannels(t *testing.T) {
 func TestGetChannelMessagesEdgeCases(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Channel not found — empty result
@@ -2735,7 +2735,7 @@ func TestFilterPacketsEmptyRegion(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Region with no observers → empty result
@@ -2749,7 +2749,7 @@ func TestFilterPacketsSinceUntil(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Since far future → empty
@@ -2776,7 +2776,7 @@ func TestFilterPacketsHashOnly(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Single hash fast-path — found
@@ -2796,7 +2796,7 @@ func TestFilterPacketsObserverWithType(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Observer + type filter (takes non-indexed path)
@@ -2809,7 +2809,7 @@ func TestFilterPacketsNodeFilter(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Node filter — exercises DecodedJSON containment check
@@ -2892,7 +2892,7 @@ func TestGetNodeHashSizeInfoEdgeCases(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (10, 1, 10.0, -90, '[]', ?)`, recentEpoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	info := store.GetNodeHashSizeInfo()
 
@@ -3054,7 +3054,7 @@ func TestGetChannelMessagesDedupeRepeats(t *testing.T) {
 	db.conn.Exec(`INSERT INTO observations (transmission_id, observer_idx, snr, rssi, path_json, timestamp)
 		VALUES (3, 1, 10.0, -90, '[]', ?)`, recentEpoch)
 
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	msgs, total := store.GetChannelMessages("#general", 10, 0)
@@ -3080,7 +3080,7 @@ func TestTransmissionsForObserverFromSlice(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Test with from=nil (index path) — for non-existent observer
@@ -3100,7 +3100,7 @@ func TestTransmissionsForObserverFromSlice(t *testing.T) {
 func TestGetPerfStoreStatsPublicKeyField(t *testing.T) {
 	db := setupRichTestDB(t)
 	defer db.Close()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	stats := store.GetPerfStoreStats()
@@ -3142,7 +3142,7 @@ func TestStoreGetTransmissionByID(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	pkt := store.GetTransmissionByID(1)
@@ -3162,7 +3162,7 @@ func TestStoreGetPacketByID(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Get an observation ID from the store
@@ -3194,7 +3194,7 @@ func TestStoreGetObservationsForHash(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	obs := store.GetObservationsForHash("abc123def4567890")
@@ -3366,7 +3366,7 @@ func TestIngestNewFromDBDuplicateObs(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()
@@ -3397,7 +3397,7 @@ func TestIngestNewObservations(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	// Get initial observation count for transmission 1 (hash abc123def4567890)
@@ -3475,7 +3475,7 @@ func TestIngestNewObservationsV2(t *testing.T) {
 	db := setupTestDBv2(t)
 	defer db.Close()
 	seedV2Data(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	tx := store.byHash["abc123def4567890"]
@@ -3546,7 +3546,7 @@ func TestHandleNodeAnalyticsNameless(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 	srv.store = store
 	router := mux.NewRouter()
@@ -3588,7 +3588,7 @@ func TestStoreQueryPacketsRegionFilter(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	result := store.QueryPackets(PacketQuery{Region: "SJC", Limit: 50, Order: "DESC"})
@@ -3676,7 +3676,7 @@ func TestGetChannelMessagesAfterIngest(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	store.Load()
 
 	initialMax := store.MaxTransmissionID()

cmd/server/decoder.go

@@ -373,6 +373,21 @@ func DecodePacket(hexString string) (*DecodedPacket, error) {
 	payloadBuf := buf[offset:]
 	payload := decodePayload(header.PayloadType, payloadBuf)
 
+	// TRACE packets store hop IDs in the payload (buf[9:]) rather than the header
+	// path field. The header path byte still encodes hashSize in bits 6-7, which
+	// we use to split the payload path data into individual hop prefixes.
+	if header.PayloadType == PayloadTRACE && payload.PathData != "" {
+		pathBytes, err := hex.DecodeString(payload.PathData)
+		if err == nil && path.HashSize > 0 {
+			hops := make([]string, 0, len(pathBytes)/path.HashSize)
+			for i := 0; i+path.HashSize <= len(pathBytes); i += path.HashSize {
+				hops = append(hops, strings.ToUpper(hex.EncodeToString(pathBytes[i:i+path.HashSize])))
+			}
+			path.Hops = hops
+			path.HashCount = len(hops)
+		}
+	}
+
 	return &DecodedPacket{
 		Header:         header,
 		TransportCodes: tc,

cmd/server/eviction_test.go

@@ -0,0 +1,252 @@
+package main
+
+import (
+	"fmt"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+// makeTestStore creates a PacketStore with fake packets for eviction testing.
+// It does NOT use a DB — indexes are populated manually.
+func makeTestStore(count int, startTime time.Time, intervalMin int) *PacketStore {
+	store := &PacketStore{
+		packets:       make([]*StoreTx, 0, count),
+		byHash:        make(map[string]*StoreTx, count),
+		byTxID:        make(map[int]*StoreTx, count),
+		byObsID:       make(map[int]*StoreObs, count*2),
+		byObserver:    make(map[string][]*StoreObs),
+		byNode:        make(map[string][]*StoreTx),
+		nodeHashes:    make(map[string]map[string]bool),
+		byPayloadType: make(map[int][]*StoreTx),
+		spIndex:       make(map[string]int),
+		distHops:      make([]distHopRecord, 0),
+		distPaths:     make([]distPathRecord, 0),
+		rfCache:       make(map[string]*cachedResult),
+		topoCache:     make(map[string]*cachedResult),
+		hashCache:     make(map[string]*cachedResult),
+		chanCache:     make(map[string]*cachedResult),
+		distCache:     make(map[string]*cachedResult),
+		subpathCache:  make(map[string]*cachedResult),
+		rfCacheTTL:    15 * time.Second,
+	}
+
+	obsID := 1000
+	for i := 0; i < count; i++ {
+		ts := startTime.Add(time.Duration(i*intervalMin) * time.Minute)
+		hash := fmt.Sprintf("hash%04d", i)
+		txID := i + 1
+		pt := 4 // ADVERT
+		decodedJSON := fmt.Sprintf(`{"pubKey":"pk%04d"}`, i)
+
+		tx := &StoreTx{
+			ID:          txID,
+			Hash:        hash,
+			FirstSeen:   ts.UTC().Format(time.RFC3339),
+			PayloadType: &pt,
+			DecodedJSON: decodedJSON,
+			PathJSON:    `["aa","bb","cc"]`,
+		}
+
+		// Add 2 observations per tx
+		for j := 0; j < 2; j++ {
+			obsID++
+			obsIDStr := fmt.Sprintf("obs%d", j)
+			obs := &StoreObs{
+				ID:             obsID,
+				TransmissionID: txID,
+				ObserverID:     obsIDStr,
+				ObserverName:   fmt.Sprintf("Observer%d", j),
+				Timestamp:      ts.UTC().Format(time.RFC3339),
+			}
+			tx.Observations = append(tx.Observations, obs)
+			tx.ObservationCount++
+			store.byObsID[obsID] = obs
+			store.byObserver[obsIDStr] = append(store.byObserver[obsIDStr], obs)
+			store.totalObs++
+		}
+
+		store.packets = append(store.packets, tx)
+		store.byHash[hash] = tx
+		store.byTxID[txID] = tx
+		store.byPayloadType[pt] = append(store.byPayloadType[pt], tx)
+
+		// Index by node
+		pk := fmt.Sprintf("pk%04d", i)
+		if store.nodeHashes[pk] == nil {
+			store.nodeHashes[pk] = make(map[string]bool)
+		}
+		store.nodeHashes[pk][hash] = true
+		store.byNode[pk] = append(store.byNode[pk], tx)
+
+		// Add to distance index
+		store.distHops = append(store.distHops, distHopRecord{tx: tx, Hash: hash})
+		store.distPaths = append(store.distPaths, distPathRecord{tx: tx, Hash: hash})
+
+		// Subpath index
+		addTxToSubpathIndex(store.spIndex, tx)
+	}
+
+	return store
+}
+
+func TestEvictStale_TimeBasedEviction(t *testing.T) {
+	now := time.Now().UTC()
+	// 100 packets: first 50 are 48h old, last 50 are 1h old
+	store := makeTestStore(100, now.Add(-48*time.Hour), 0)
+	// Override: set first 50 to 48h ago, last 50 to 1h ago
+	for i := 0; i < 50; i++ {
+		store.packets[i].FirstSeen = now.Add(-48 * time.Hour).Format(time.RFC3339)
+	}
+	for i := 50; i < 100; i++ {
+		store.packets[i].FirstSeen = now.Add(-1 * time.Hour).Format(time.RFC3339)
+	}
+
+	store.retentionHours = 24
+
+	evicted := store.EvictStale()
+	if evicted != 50 {
+		t.Fatalf("expected 50 evicted, got %d", evicted)
+	}
+	if len(store.packets) != 50 {
+		t.Fatalf("expected 50 remaining, got %d", len(store.packets))
+	}
+	if len(store.byHash) != 50 {
+		t.Fatalf("expected 50 in byHash, got %d", len(store.byHash))
+	}
+	if len(store.byTxID) != 50 {
+		t.Fatalf("expected 50 in byTxID, got %d", len(store.byTxID))
+	}
+	// 50 remaining * 2 obs each = 100 obs
+	if store.totalObs != 100 {
+		t.Fatalf("expected 100 obs remaining, got %d", store.totalObs)
+	}
+	if len(store.byObsID) != 100 {
+		t.Fatalf("expected 100 in byObsID, got %d", len(store.byObsID))
+	}
+	if atomic.LoadInt64(&store.evicted) != 50 {
+		t.Fatalf("expected evicted counter=50, got %d", atomic.LoadInt64(&store.evicted))
+	}
+
+	// Verify evicted hashes are gone
+	if _, ok := store.byHash["hash0000"]; ok {
+		t.Fatal("hash0000 should have been evicted")
+	}
+	// Verify remaining hashes exist
+	if _, ok := store.byHash["hash0050"]; !ok {
+		t.Fatal("hash0050 should still exist")
+	}
+
+	// Verify distance indexes cleaned
+	if len(store.distHops) != 50 {
+		t.Fatalf("expected 50 distHops, got %d", len(store.distHops))
+	}
+	if len(store.distPaths) != 50 {
+		t.Fatalf("expected 50 distPaths, got %d", len(store.distPaths))
+	}
+}
+
+func TestEvictStale_NoEvictionWhenDisabled(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(10, now.Add(-48*time.Hour), 60)
+	// No retention set (defaults to 0)
+
+	evicted := store.EvictStale()
+	if evicted != 0 {
+		t.Fatalf("expected 0 evicted, got %d", evicted)
+	}
+	if len(store.packets) != 10 {
+		t.Fatalf("expected 10 remaining, got %d", len(store.packets))
+	}
+}
+
+func TestEvictStale_MemoryBasedEviction(t *testing.T) {
+	now := time.Now().UTC()
+	// Create enough packets to exceed a small memory limit
+	// 1000 packets * 5KB + 2000 obs * 500B ≈ 6MB
+	store := makeTestStore(1000, now.Add(-1*time.Hour), 0)
+	// All packets are recent (1h old) so time-based won't trigger
+	store.retentionHours = 24
+	store.maxMemoryMB = 3 // ~3MB limit, should evict roughly half
+
+	evicted := store.EvictStale()
+	if evicted == 0 {
+		t.Fatal("expected some evictions for memory cap")
+	}
+	// After eviction, estimated memory should be <= 3MB
+	estMB := store.estimatedMemoryMB()
+	if estMB > 3.5 { // small tolerance
+		t.Fatalf("expected <=3.5MB after eviction, got %.1fMB", estMB)
+	}
+}
+
+func TestEvictStale_CleansNodeIndexes(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(10, now.Add(-48*time.Hour), 0)
+	store.retentionHours = 24
+
+	// Verify node indexes exist before eviction
+	if len(store.byNode) != 10 {
+		t.Fatalf("expected 10 nodes indexed, got %d", len(store.byNode))
+	}
+	if len(store.nodeHashes) != 10 {
+		t.Fatalf("expected 10 nodeHashes, got %d", len(store.nodeHashes))
+	}
+
+	evicted := store.EvictStale()
+	if evicted != 10 {
+		t.Fatalf("expected 10 evicted, got %d", evicted)
+	}
+
+	// All should be cleaned
+	if len(store.byNode) != 0 {
+		t.Fatalf("expected 0 nodes, got %d", len(store.byNode))
+	}
+	if len(store.nodeHashes) != 0 {
+		t.Fatalf("expected 0 nodeHashes, got %d", len(store.nodeHashes))
+	}
+	if len(store.byPayloadType) != 0 {
+		t.Fatalf("expected 0 payload types, got %d", len(store.byPayloadType))
+	}
+	if len(store.byObserver) != 0 {
+		t.Fatalf("expected 0 observers, got %d", len(store.byObserver))
+	}
+}
+
+func TestEvictStale_RunEvictionThreadSafe(t *testing.T) {
+	now := time.Now().UTC()
+	store := makeTestStore(20, now.Add(-48*time.Hour), 0)
+	store.retentionHours = 24
+
+	evicted := store.RunEviction()
+	if evicted != 20 {
+		t.Fatalf("expected 20 evicted, got %d", evicted)
+	}
+}
+
+func TestStartEvictionTicker_NoopWhenDisabled(t *testing.T) {
+	store := &PacketStore{}
+	stop := store.StartEvictionTicker()
+	stop() // should not panic
+}
+
+func TestNewPacketStoreWithConfig(t *testing.T) {
+	cfg := &PacketStoreConfig{
+		RetentionHours: 48,
+		MaxMemoryMB:    512,
+	}
+	store := NewPacketStore(nil, cfg)
+	if store.retentionHours != 48 {
+		t.Fatalf("expected retentionHours=48, got %f", store.retentionHours)
+	}
+	if store.maxMemoryMB != 512 {
+		t.Fatalf("expected maxMemoryMB=512, got %d", store.maxMemoryMB)
+	}
+}
+
+func TestNewPacketStoreNilConfig(t *testing.T) {
+	store := NewPacketStore(nil, nil)
+	if store.retentionHours != 0 {
+		t.Fatalf("expected retentionHours=0, got %f", store.retentionHours)
+	}
+}

cmd/server/main.go

@@ -100,6 +100,9 @@ func main() {
 	if dbPath != "" {
 		cfg.DBPath = dbPath
 	}
+	if cfg.APIKey == "" {
+		log.Printf("[security] WARNING: no apiKey configured — write endpoints are BLOCKED (set apiKey in config.json to enable them)")
+	}
 
 	// Resolve DB path
 	resolvedDB := cfg.ResolveDBPath(configDir)
@@ -128,7 +131,7 @@ func main() {
 	}
 
 	// In-memory packet store
-	store := NewPacketStore(database)
+	store := NewPacketStore(database, cfg.PacketStore)
 	if err := store.Load(); err != nil {
 		log.Fatalf("[store] failed to load: %v", err)
 	}
@@ -164,6 +167,10 @@ func main() {
 	poller.store = store
 	go poller.Start()
 
+	// Start periodic eviction
+	stopEviction := store.StartEvictionTicker()
+	defer stopEviction()
+
 	// Graceful shutdown
 	httpServer := &http.Server{
 		Addr:         fmt.Sprintf(":%d", cfg.Port),

cmd/server/parity_test.go

@@ -409,7 +409,7 @@ func TestParityWSMultiObserverGolden(t *testing.T) {
 	defer db.Close()
 	seedTestData(t, db)
 	hub := NewHub()
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store load failed: %v", err)
 	}

cmd/server/routes.go

@@ -102,21 +102,22 @@ func (s *Server) RegisterRoutes(r *mux.Router) {
 	r.HandleFunc("/api/config/regions", s.handleConfigRegions).Methods("GET")
 	r.HandleFunc("/api/config/theme", s.handleConfigTheme).Methods("GET")
 	r.HandleFunc("/api/config/map", s.handleConfigMap).Methods("GET")
+	r.HandleFunc("/api/config/geo-filter", s.handleConfigGeoFilter).Methods("GET")
 
 	// System endpoints
 	r.HandleFunc("/api/health", s.handleHealth).Methods("GET")
 	r.HandleFunc("/api/stats", s.handleStats).Methods("GET")
 	r.HandleFunc("/api/perf", s.handlePerf).Methods("GET")
-	r.HandleFunc("/api/perf/reset", s.handlePerfReset).Methods("POST")
+	r.Handle("/api/perf/reset", s.requireAPIKey(http.HandlerFunc(s.handlePerfReset))).Methods("POST")
 
 	// Packet endpoints
 	r.HandleFunc("/api/packets/timestamps", s.handlePacketTimestamps).Methods("GET")
 	r.HandleFunc("/api/packets/{id}", s.handlePacketDetail).Methods("GET")
 	r.HandleFunc("/api/packets", s.handlePackets).Methods("GET")
-	r.HandleFunc("/api/packets", s.handlePostPacket).Methods("POST")
+	r.Handle("/api/packets", s.requireAPIKey(http.HandlerFunc(s.handlePostPacket))).Methods("POST")
 
 	// Decode endpoint
-	r.HandleFunc("/api/decode", s.handleDecode).Methods("POST")
+	r.Handle("/api/decode", s.requireAPIKey(http.HandlerFunc(s.handleDecode))).Methods("POST")
 
 	// Node endpoints — fixed routes BEFORE parameterized
 	r.HandleFunc("/api/nodes/search", s.handleNodeSearch).Methods("GET")
@@ -200,6 +201,20 @@ func (s *Server) perfMiddleware(next http.Handler) http.Handler {
 	})
 }
 
+func (s *Server) requireAPIKey(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if s.cfg == nil || s.cfg.APIKey == "" {
+			writeError(w, http.StatusForbidden, "write endpoints disabled — set apiKey in config.json")
+			return
+		}
+		if r.Header.Get("X-API-Key") != s.cfg.APIKey {
+			writeError(w, http.StatusUnauthorized, "unauthorized")
+			return
+		}
+		next.ServeHTTP(w, r)
+	})
+}
+
 // --- Config Handlers ---
 
 func (s *Server) handleConfigCache(w http.ResponseWriter, r *http.Request) {
@@ -224,6 +239,7 @@ func (s *Server) handleConfigClient(w http.ResponseWriter, r *http.Request) {
 		CacheInvalidateMs:   s.cfg.CacheInvalidMs,
 		ExternalUrls:        s.cfg.ExternalUrls,
 		PropagationBufferMs: float64(s.cfg.PropagationBufferMs()),
+		Timestamps:          s.cfg.GetTimestampConfig(),
 	})
 }
 
@@ -296,6 +312,15 @@ func (s *Server) handleConfigMap(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, MapConfigResponse{Center: center, Zoom: zoom})
 }
 
+func (s *Server) handleConfigGeoFilter(w http.ResponseWriter, r *http.Request) {
+	gf := s.cfg.GeoFilter
+	if gf == nil || len(gf.Polygon) == 0 {
+		writeJSON(w, map[string]interface{}{"polygon": nil, "bufferKm": 0})
+		return
+	}
+	writeJSON(w, map[string]interface{}{"polygon": gf.Polygon, "bufferKm": gf.BufferKm})
+}
+
 // --- System Handlers ---
 
 func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
@@ -1155,12 +1180,13 @@ func (s *Server) handleAnalyticsHashSizes(w http.ResponseWriter, r *http.Request
 		writeJSON(w, s.store.GetAnalyticsHashSizes(region))
 		return
 	}
-	writeJSON(w, HashSizeAnalyticsResponse{
-		Total:          0,
-		Distribution:   map[string]int{"1": 0, "2": 0, "3": 0},
-		Hourly:         []HashSizeHourly{},
-		TopHops:        []HashSizeHop{},
-		MultiByteNodes: []MultiByteNode{},
+	writeJSON(w, map[string]interface{}{
+		"total":                    0,
+		"distribution":            map[string]int{"1": 0, "2": 0, "3": 0},
+		"distributionByRepeaters": map[string]int{"1": 0, "2": 0, "3": 0},
+		"hourly":                  []HashSizeHourly{},
+		"topHops":                 []HashSizeHop{},
+		"multiByteNodes":          []MultiByteNode{},
 	})
 }
 

cmd/server/routes_test.go

@@ -1,6 +1,7 @@
 package main
 
 import (
+	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -17,7 +18,7 @@ func setupTestServer(t *testing.T) (*Server, *mux.Router) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store.Load failed: %v", err)
 	}
@@ -27,6 +28,75 @@ func setupTestServer(t *testing.T) (*Server, *mux.Router) {
 	return srv, router
 }
 
+func setupTestServerWithAPIKey(t *testing.T, apiKey string) (*Server, *mux.Router) {
+	t.Helper()
+	db := setupTestDB(t)
+	seedTestData(t, db)
+	cfg := &Config{Port: 3000, APIKey: apiKey}
+	hub := NewHub()
+	srv := NewServer(db, cfg, hub)
+	store := NewPacketStore(db, nil)
+	if err := store.Load(); err != nil {
+		t.Fatalf("store.Load failed: %v", err)
+	}
+	srv.store = store
+	router := mux.NewRouter()
+	srv.RegisterRoutes(router)
+	return srv, router
+}
+
+func TestWriteEndpointsRequireAPIKey(t *testing.T) {
+	_, router := setupTestServerWithAPIKey(t, "test-secret")
+
+	t.Run("missing key returns 401", func(t *testing.T) {
+		req := httptest.NewRequest("POST", "/api/perf/reset", nil)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusUnauthorized {
+			t.Fatalf("expected 401, got %d", w.Code)
+		}
+		var body map[string]interface{}
+		_ = json.Unmarshal(w.Body.Bytes(), &body)
+		if body["error"] != "unauthorized" {
+			t.Fatalf("expected unauthorized error, got %v", body["error"])
+		}
+	})
+
+	t.Run("wrong key returns 401", func(t *testing.T) {
+		req := httptest.NewRequest("POST", "/api/decode", bytes.NewBufferString(`{"hex":"0200"}`))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("X-API-Key", "wrong-secret")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusUnauthorized {
+			t.Fatalf("expected 401, got %d", w.Code)
+		}
+	})
+
+	t.Run("correct key passes", func(t *testing.T) {
+		req := httptest.NewRequest("POST", "/api/decode", bytes.NewBufferString(`{"hex":"0200"}`))
+		req.Header.Set("Content-Type", "application/json")
+		req.Header.Set("X-API-Key", "test-secret")
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		if w.Code != http.StatusOK {
+			t.Fatalf("expected 200, got %d (body: %s)", w.Code, w.Body.String())
+		}
+	})
+}
+
+func TestWriteEndpointsBlockWhenAPIKeyEmpty(t *testing.T) {
+	_, router := setupTestServerWithAPIKey(t, "")
+
+	req := httptest.NewRequest("POST", "/api/decode", bytes.NewBufferString(`{"hex":"0200"}`))
+	req.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+	if w.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 with empty apiKey, got %d (body: %s)", w.Code, w.Body.String())
+	}
+}
+
 func TestHealthEndpoint(t *testing.T) {
 	_, router := setupTestServer(t)
 	req := httptest.NewRequest("GET", "/api/health", nil)
@@ -1187,6 +1257,19 @@ func TestConfigClientEndpoint(t *testing.T) {
 	if body["propagationBufferMs"] == nil {
 		t.Error("expected propagationBufferMs")
 	}
+	tsRaw, ok := body["timestamps"].(map[string]interface{})
+	if !ok {
+		t.Fatal("expected timestamps object")
+	}
+	if tsRaw["defaultMode"] != "ago" {
+		t.Errorf("expected timestamps.defaultMode=ago, got %v", tsRaw["defaultMode"])
+	}
+	if tsRaw["timezone"] != "local" {
+		t.Errorf("expected timestamps.timezone=local, got %v", tsRaw["timezone"])
+	}
+	if tsRaw["formatPreset"] != "iso" {
+		t.Errorf("expected timestamps.formatPreset=iso, got %v", tsRaw["formatPreset"])
+	}
 }
 
 func TestConfigRegionsEndpoint(t *testing.T) {
@@ -1259,7 +1342,7 @@ func TestNodeAnalyticsNoNameNode(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store.Load failed: %v", err)
 	}
@@ -1295,7 +1378,7 @@ func TestNodeHealthForNoNameNode(t *testing.T) {
 	cfg := &Config{Port: 3000}
 	hub := NewHub()
 	srv := NewServer(db, cfg, hub)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store.Load failed: %v", err)
 	}
@@ -1890,7 +1973,7 @@ t.Error("hash_sizes_seen should not be set for single size")
 func TestGetNodeHashSizeInfoFlipFlop(t *testing.T) {
 db := setupTestDB(t)
 seedTestData(t, db)
-store := NewPacketStore(db)
+store := NewPacketStore(db, nil)
 if err := store.Load(); err != nil {
 	t.Fatalf("store.Load failed: %v", err)
 }
@@ -1933,6 +2016,49 @@ t.Error("expected inconsistent flag to be true for flip-flop pattern")
 }
 }
 
+func TestGetNodeHashSizeInfoDominant(t *testing.T) {
+// A node that sends mostly 2-byte adverts but occasionally 1-byte (pathByte=0x00
+// on direct sends) should report HashSize=2, not 1.
+db := setupTestDB(t)
+seedTestData(t, db)
+store := NewPacketStore(db, nil)
+if err := store.Load(); err != nil {
+	t.Fatalf("store.Load failed: %v", err)
+}
+
+pk := "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
+db.conn.Exec("INSERT OR IGNORE INTO nodes (public_key, name, role) VALUES (?, 'Repeater2B', 'repeater')", pk)
+
+decoded := `{"name":"Repeater2B","pubKey":"` + pk + `"}`
+raw1byte := "04" + "00" + "aabb" // pathByte=0x00 → hashSize=1 (direct send, no hops)
+raw2byte := "04" + "40" + "aabb" // pathByte=0x40 → hashSize=2
+
+payloadType := 4
+// 1 packet with hashSize=1, 4 packets with hashSize=2
+raws := []string{raw1byte, raw2byte, raw2byte, raw2byte, raw2byte}
+for i, raw := range raws {
+	tx := &StoreTx{
+		ID:          8000 + i,
+		RawHex:      raw,
+		Hash:        "dominant" + strconv.Itoa(i),
+		FirstSeen:   "2024-01-01T00:00:00Z",
+		PayloadType: &payloadType,
+		DecodedJSON: decoded,
+	}
+	store.packets = append(store.packets, tx)
+	store.byPayloadType[4] = append(store.byPayloadType[4], tx)
+}
+
+info := store.GetNodeHashSizeInfo()
+ni := info[pk]
+if ni == nil {
+	t.Fatal("expected hash info for test node")
+}
+if ni.HashSize != 2 {
+	t.Errorf("HashSize=%d, want 2 (dominant size should win over occasional 1-byte)", ni.HashSize)
+}
+}
+
 func TestAnalyticsHashSizesNoNullArrays(t *testing.T) {
 _, router := setupTestServer(t)
 req := httptest.NewRequest("GET", "/api/analytics/hash-sizes", nil)
@@ -1963,6 +2089,60 @@ func TestObserverAnalyticsNoStore(t *testing.T) {
 		t.Fatalf("expected 503, got %d", w.Code)
 	}
 }
+func TestConfigGeoFilterEndpoint(t *testing.T) {
+	t.Run("no geo filter configured", func(t *testing.T) {
+		_, router := setupTestServer(t)
+		req := httptest.NewRequest("GET", "/api/config/geo-filter", nil)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+
+		if w.Code != 200 {
+			t.Fatalf("expected 200, got %d", w.Code)
+		}
+		var body map[string]interface{}
+		json.Unmarshal(w.Body.Bytes(), &body)
+		if body["polygon"] != nil {
+			t.Errorf("expected polygon to be nil when no geo filter configured, got %v", body["polygon"])
+		}
+	})
+
+	t.Run("with polygon configured", func(t *testing.T) {
+		db := setupTestDB(t)
+		seedTestData(t, db)
+		lat0, lat1 := 50.0, 51.5
+		lon0, lon1 := 3.0, 5.5
+		cfg := &Config{
+			Port: 3000,
+			GeoFilter: &GeoFilterConfig{
+				Polygon:  [][2]float64{{lat0, lon0}, {lat1, lon0}, {lat1, lon1}, {lat0, lon1}},
+				BufferKm: 20,
+			},
+		}
+		hub := NewHub()
+		srv := NewServer(db, cfg, hub)
+		srv.store = NewPacketStore(db, nil)
+		srv.store.Load()
+		router := mux.NewRouter()
+		srv.RegisterRoutes(router)
+
+		req := httptest.NewRequest("GET", "/api/config/geo-filter", nil)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+
+		if w.Code != 200 {
+			t.Fatalf("expected 200, got %d", w.Code)
+		}
+		var body map[string]interface{}
+		json.Unmarshal(w.Body.Bytes(), &body)
+		if body["polygon"] == nil {
+			t.Error("expected polygon in response when geo filter is configured")
+		}
+		if body["bufferKm"] == nil {
+			t.Error("expected bufferKm in response")
+		}
+	})
+}
+
 func min(a, b int) int {
 	if a < b {
 		return a

cmd/server/store.go

@@ -103,6 +103,11 @@ type PacketStore struct {
 	hashSizeInfoMu    sync.Mutex
 	hashSizeInfoCache map[string]*hashSizeNodeInfo
 	hashSizeInfoAt    time.Time
+
+	// Eviction config and stats
+	retentionHours float64 // 0 = unlimited
+	maxMemoryMB    int     // 0 = unlimited
+	evicted        int64   // total packets evicted
 }
 
 // Precomputed distance records for fast analytics aggregation.
@@ -143,8 +148,8 @@ type cachedResult struct {
 }
 
 // NewPacketStore creates a new empty packet store backed by db.
-func NewPacketStore(db *DB) *PacketStore {
-	return &PacketStore{
+func NewPacketStore(db *DB, cfg *PacketStoreConfig) *PacketStore {
+	ps := &PacketStore{
 		db:            db,
 		packets:       make([]*StoreTx, 0, 65536),
 		byHash:        make(map[string]*StoreTx, 65536),
@@ -163,6 +168,11 @@ func NewPacketStore(db *DB) *PacketStore {
 		rfCacheTTL:    15 * time.Second,
 		spIndex:       make(map[string]int, 4096),
 	}
+	if cfg != nil {
+		ps.retentionHours = cfg.RetentionHours
+		ps.maxMemoryMB = cfg.MaxMemoryMB
+	}
+	return ps
 }
 
 // Load reads all transmissions + observations from SQLite into memory.
@@ -293,7 +303,7 @@ func (s *PacketStore) Load() error {
 
 	s.loaded = true
 	elapsed := time.Since(t0)
-	estMB := (len(s.packets)*450 + s.totalObs*100) / (1024 * 1024)
+	estMB := (len(s.packets)*5120 + s.totalObs*500) / (1024 * 1024)
 	log.Printf("[store] Loaded %d transmissions (%d observations) in %v (~%dMB est)",
 		len(s.packets), s.totalObs, elapsed, estMB)
 	return nil
@@ -542,20 +552,22 @@ func (s *PacketStore) GetPerfStoreStats() map[string]interface{} {
 	}
 	s.mu.RUnlock()
 
-	// Rough estimate: ~430 bytes per packet + ~200 per observation
-	estimatedMB := math.Round(float64(totalLoaded*430+totalObs*200)/1048576*10) / 10
+	// Realistic estimate: ~5KB per packet + ~500 bytes per observation
+	estimatedMB := math.Round(float64(totalLoaded*5120+totalObs*500)/1048576*10) / 10
+
+	evicted := atomic.LoadInt64(&s.evicted)
 
 	return map[string]interface{}{
 		"totalLoaded":       totalLoaded,
 		"totalObservations": totalObs,
-		"evicted":           0,
+		"evicted":           evicted,
 		"inserts":           atomic.LoadInt64(&s.insertCount),
 		"queries":           atomic.LoadInt64(&s.queryCount),
 		"inMemory":          totalLoaded,
 		"sqliteOnly":        false,
-		"maxPackets":        2386092,
+		"retentionHours":    s.retentionHours,
+		"maxMemoryMB":       s.maxMemoryMB,
 		"estimatedMB":       estimatedMB,
-		"maxMB":             1024,
 		"indexes": map[string]interface{}{
 			"byHash":           hashIdx,
 			"byTxID":           txIdx,
@@ -648,12 +660,12 @@ func (s *PacketStore) GetPerfStoreStatsTyped() PerfPacketStoreStats {
 	}
 	s.mu.RUnlock()
 
-	estimatedMB := math.Round(float64(totalLoaded*430+totalObs*200)/1048576*10) / 10
+	estimatedMB := math.Round(float64(totalLoaded*5120+totalObs*500)/1048576*10) / 10
 
 	return PerfPacketStoreStats{
 		TotalLoaded:       totalLoaded,
 		TotalObservations: totalObs,
-		Evicted:           0,
+		Evicted:           int(atomic.LoadInt64(&s.evicted)),
 		Inserts:           atomic.LoadInt64(&s.insertCount),
 		Queries:           atomic.LoadInt64(&s.queryCount),
 		InMemory:          totalLoaded,
@@ -1699,6 +1711,218 @@ func (s *PacketStore) buildDistanceIndex() {
 		len(s.distHops), len(s.distPaths))
 }
 
+// estimatedMemoryMB returns estimated memory usage of the packet store.
+func (s *PacketStore) estimatedMemoryMB() float64 {
+	return float64(len(s.packets)*5120+s.totalObs*500) / 1048576.0
+}
+
+// EvictStale removes packets older than the retention window and/or exceeding
+// the memory cap. Must be called with s.mu held (Lock). Returns the number of
+// packets evicted.
+func (s *PacketStore) EvictStale() int {
+	if s.retentionHours <= 0 && s.maxMemoryMB <= 0 {
+		return 0
+	}
+
+	cutoffIdx := 0
+
+	// Time-based eviction: find how many packets from the head are too old
+	if s.retentionHours > 0 {
+		cutoff := time.Now().UTC().Add(-time.Duration(s.retentionHours*3600) * time.Second).Format(time.RFC3339)
+		for cutoffIdx < len(s.packets) && s.packets[cutoffIdx].FirstSeen < cutoff {
+			cutoffIdx++
+		}
+	}
+
+	// Memory-based eviction: if still over budget, trim more from head
+	if s.maxMemoryMB > 0 {
+		for cutoffIdx < len(s.packets) && s.estimatedMemoryMB() > float64(s.maxMemoryMB) {
+			// Estimate how many more to evict: rough binary approach
+			overMB := s.estimatedMemoryMB() - float64(s.maxMemoryMB)
+			// ~5KB per packet, so overMB * 1024*1024 / 5120 packets
+			extra := int(overMB * 1048576.0 / 5120.0)
+			if extra < 100 {
+				extra = 100
+			}
+			cutoffIdx += extra
+			if cutoffIdx > len(s.packets) {
+				cutoffIdx = len(s.packets)
+			}
+			// Recalculate estimated memory with fewer packets
+			// (we haven't actually removed yet, so simulate)
+			remainingPkts := len(s.packets) - cutoffIdx
+			remainingObs := s.totalObs
+			for _, tx := range s.packets[:cutoffIdx] {
+				remainingObs -= len(tx.Observations)
+			}
+			estMB := float64(remainingPkts*5120+remainingObs*500) / 1048576.0
+			if estMB <= float64(s.maxMemoryMB) {
+				break
+			}
+		}
+	}
+
+	if cutoffIdx == 0 {
+		return 0
+	}
+	if cutoffIdx > len(s.packets) {
+		cutoffIdx = len(s.packets)
+	}
+
+	evicting := s.packets[:cutoffIdx]
+	evictedObs := 0
+
+	// Remove from all indexes
+	for _, tx := range evicting {
+		delete(s.byHash, tx.Hash)
+		delete(s.byTxID, tx.ID)
+
+		// Remove observations from indexes
+		for _, obs := range tx.Observations {
+			delete(s.byObsID, obs.ID)
+			// Remove from byObserver
+			if obs.ObserverID != "" {
+				obsList := s.byObserver[obs.ObserverID]
+				for i, o := range obsList {
+					if o.ID == obs.ID {
+						s.byObserver[obs.ObserverID] = append(obsList[:i], obsList[i+1:]...)
+						break
+					}
+				}
+				if len(s.byObserver[obs.ObserverID]) == 0 {
+					delete(s.byObserver, obs.ObserverID)
+				}
+			}
+			evictedObs++
+		}
+
+		// Remove from byPayloadType
+		if tx.PayloadType != nil {
+			pt := *tx.PayloadType
+			ptList := s.byPayloadType[pt]
+			for i, t := range ptList {
+				if t.ID == tx.ID {
+					s.byPayloadType[pt] = append(ptList[:i], ptList[i+1:]...)
+					break
+				}
+			}
+			if len(s.byPayloadType[pt]) == 0 {
+				delete(s.byPayloadType, pt)
+			}
+		}
+
+		// Remove from byNode and nodeHashes
+		if tx.DecodedJSON != "" {
+			var decoded map[string]interface{}
+			if json.Unmarshal([]byte(tx.DecodedJSON), &decoded) == nil {
+				for _, field := range []string{"pubKey", "destPubKey", "srcPubKey"} {
+					if v, ok := decoded[field].(string); ok && v != "" {
+						if hashes, ok := s.nodeHashes[v]; ok {
+							delete(hashes, tx.Hash)
+							if len(hashes) == 0 {
+								delete(s.nodeHashes, v)
+							}
+						}
+						// Remove tx from byNode
+						nodeList := s.byNode[v]
+						for i, t := range nodeList {
+							if t.ID == tx.ID {
+								s.byNode[v] = append(nodeList[:i], nodeList[i+1:]...)
+								break
+							}
+						}
+						if len(s.byNode[v]) == 0 {
+							delete(s.byNode, v)
+						}
+					}
+				}
+			}
+		}
+
+		// Remove from subpath index
+		removeTxFromSubpathIndex(s.spIndex, tx)
+	}
+
+	// Remove from distance indexes — filter out records referencing evicted txs
+	evictedTxSet := make(map[*StoreTx]bool, cutoffIdx)
+	for _, tx := range evicting {
+		evictedTxSet[tx] = true
+	}
+	newDistHops := s.distHops[:0]
+	for i := range s.distHops {
+		if !evictedTxSet[s.distHops[i].tx] {
+			newDistHops = append(newDistHops, s.distHops[i])
+		}
+	}
+	s.distHops = newDistHops
+
+	newDistPaths := s.distPaths[:0]
+	for i := range s.distPaths {
+		if !evictedTxSet[s.distPaths[i].tx] {
+			newDistPaths = append(newDistPaths, s.distPaths[i])
+		}
+	}
+	s.distPaths = newDistPaths
+
+	// Trim packets slice
+	n := copy(s.packets, s.packets[cutoffIdx:])
+	s.packets = s.packets[:n]
+	s.totalObs -= evictedObs
+
+	evictCount := cutoffIdx
+	atomic.AddInt64(&s.evicted, int64(evictCount))
+	freedMB := float64(evictCount*5120+evictedObs*500) / 1048576.0
+	log.Printf("[store] Evicted %d packets older than %.0fh (freed ~%.1fMB estimated)",
+		evictCount, s.retentionHours, freedMB)
+
+	// Invalidate analytics caches
+	s.cacheMu.Lock()
+	s.rfCache = make(map[string]*cachedResult)
+	s.topoCache = make(map[string]*cachedResult)
+	s.hashCache = make(map[string]*cachedResult)
+	s.chanCache = make(map[string]*cachedResult)
+	s.distCache = make(map[string]*cachedResult)
+	s.subpathCache = make(map[string]*cachedResult)
+	s.cacheMu.Unlock()
+
+	// Invalidate hash size cache
+	s.hashSizeInfoMu.Lock()
+	s.hashSizeInfoCache = nil
+	s.hashSizeInfoMu.Unlock()
+
+	return evictCount
+}
+
+// RunEviction acquires the write lock and runs eviction. Safe to call from
+// a goroutine. Returns evicted count.
+func (s *PacketStore) RunEviction() int {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.EvictStale()
+}
+
+// StartEvictionTicker starts a background goroutine that runs eviction every
+// minute. Returns a stop function.
+func (s *PacketStore) StartEvictionTicker() func() {
+	if s.retentionHours <= 0 && s.maxMemoryMB <= 0 {
+		return func() {} // no-op
+	}
+	ticker := time.NewTicker(1 * time.Minute)
+	done := make(chan struct{})
+	go func() {
+		for {
+			select {
+			case <-ticker.C:
+				s.RunEviction()
+			case <-done:
+				ticker.Stop()
+				return
+			}
+		}
+	}()
+	return func() { close(done) }
+}
+
 // computeDistancesForTx computes distance records for a single transmission.
 func computeDistancesForTx(tx *StoreTx, nodeByPk map[string]*nodeInfo, repeaterSet map[string]bool, resolveHop func(string) *nodeInfo) ([]distHopRecord, *distPathRecord) {
 	pathHops := txGetParsedPath(tx)
@@ -2309,6 +2533,7 @@ func (s *PacketStore) computeAnalyticsRF(region string) map[string]interface{} {
 	seenTypeHashes := make(map[string]bool, len(s.packets))
 	typeBuckets := map[int]int{}
 	hourBuckets := map[string]int{}
+	seenHourHash := make(map[string]bool, len(s.packets)) // dedup packets-per-hour by hash+hour
 	snrByType := map[string]*struct{ vals []float64 }{}
 	sigTime := map[string]*struct {
 		snrs  []float64
@@ -2381,10 +2606,16 @@ func (s *PacketStore) computeAnalyticsRF(region string) map[string]interface{} {
 					rssiVals = append(rssiVals, *obs.RSSI)
 				}
 
-				// Packets per hour
+				// Packets per hour (unique by hash per hour)
 				if len(ts) >= 13 {
 					hr := ts[:13]
-					hourBuckets[hr]++
+					hk := hash + "|" + hr
+					if hash == "" || !seenHourHash[hk] {
+						if hash != "" {
+							seenHourHash[hk] = true
+						}
+						hourBuckets[hr]++
+					}
 				}
 
 				// Packet sizes (unique by hash)
@@ -2472,7 +2703,14 @@ func (s *PacketStore) computeAnalyticsRF(region string) map[string]interface{} {
 					}
 
 					if len(ts) >= 13 {
-						hourBuckets[ts[:13]]++
+						hr := ts[:13]
+						hk := hash + "|" + hr
+						if hash == "" || !seenHourHash[hk] {
+							if hash != "" {
+								seenHourHash[hk] = true
+							}
+							hourBuckets[hr]++
+						}
 					}
 				}
 			} else {
@@ -3745,12 +3983,21 @@ func (s *PacketStore) computeAnalyticsHashSizes(region string) map[string]interf
 		return multiByteNodes[i]["packets"].(int) > multiByteNodes[j]["packets"].(int)
 	})
 
+	// Distribution by repeaters: count unique nodes per hash size
+	distributionByRepeaters := map[string]int{"1": 0, "2": 0, "3": 0}
+	for _, data := range byNode {
+		hs := data["hashSize"].(int)
+		key := strconv.Itoa(hs)
+		distributionByRepeaters[key]++
+	}
+
 	return map[string]interface{}{
-		"total":          total,
-		"distribution":   distribution,
-		"hourly":         hourly,
-		"topHops":        topHops,
-		"multiByteNodes": multiByteNodes,
+		"total":                    total,
+		"distribution":            distribution,
+		"distributionByRepeaters": distributionByRepeaters,
+		"hourly":                  hourly,
+		"topHops":                 topHops,
+		"multiByteNodes":          multiByteNodes,
 	}
 }
 
@@ -3820,14 +4067,32 @@ func (s *PacketStore) computeNodeHashSizeInfo() map[string]*hashSizeNodeInfo {
 			ni = &hashSizeNodeInfo{AllSizes: make(map[int]bool)}
 			info[pk] = ni
 		}
-		ni.HashSize = hs
 		ni.AllSizes[hs] = true
 		ni.Seq = append(ni.Seq, hs)
 	}
 
-	// Compute flip-flop (inconsistent) flag: need >= 3 observations,
-	// >= 2 unique sizes, and >= 2 transitions in the sequence.
+	// Post-process: compute dominant hash size (mode) and flip-flop flag.
+	// Using the last-seen value would misreport nodes that occasionally send
+	// with pathByte=0x00 (hashSize=1) when transmitting directly with no
+	// relay hops, even though their true hash size is 2 or 3.
 	for _, ni := range info {
+		// Dominant hash size: pick the most frequently observed size.
+		// On a tie, prefer the larger value (more specific).
+		counts := make(map[int]int, len(ni.AllSizes))
+		for _, hs := range ni.Seq {
+			counts[hs]++
+		}
+		best, bestCount := 1, 0
+		for hs, cnt := range counts {
+			if cnt > bestCount || (cnt == bestCount && hs > best) {
+				best = hs
+				bestCount = cnt
+			}
+		}
+		ni.HashSize = best
+
+		// Flip-flop (inconsistent) flag: need >= 3 observations,
+		// >= 2 unique sizes, and >= 2 transitions in the sequence.
 		if len(ni.Seq) < 3 || len(ni.AllSizes) < 2 {
 			continue
 		}

cmd/server/types.go

@@ -919,7 +919,8 @@ type ClientConfigResponse struct {
 	WsReconnectMs      interface{} `json:"wsReconnectMs"`
 	CacheInvalidateMs  interface{} `json:"cacheInvalidateMs"`
 	ExternalUrls       interface{} `json:"externalUrls"`
-	PropagationBufferMs float64    `json:"propagationBufferMs"`
+	PropagationBufferMs float64         `json:"propagationBufferMs"`
+	Timestamps          TimestampConfig `json:"timestamps"`
 }
 
 // ─── IATA Coords ───────────────────────────────────────────────────────────────

cmd/server/websocket_test.go

@@ -270,7 +270,7 @@ func TestPollerBroadcastsMultipleObservations(t *testing.T) {
 	}()
 
 	poller := NewPoller(db, hub, 50*time.Millisecond)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store load failed: %v", err)
 	}
@@ -359,7 +359,7 @@ func TestIngestNewObservationsBroadcast(t *testing.T) {
 	db := setupTestDB(t)
 	defer db.Close()
 	seedTestData(t, db)
-	store := NewPacketStore(db)
+	store := NewPacketStore(db, nil)
 	if err := store.Load(); err != nil {
 		t.Fatalf("store load failed: %v", err)
 	}

config.example.json

@@ -144,6 +144,13 @@
     "propagationBufferMs": 5000,
     "_comment": "How long (ms) to buffer incoming observations of the same packet before animating. Mesh packets propagate through multiple paths and arrive at different observers over several seconds. This window collects all observations of a single transmission so the live map can animate them simultaneously as one realistic propagation event. Set higher for wide meshes with many observers, lower for snappier animations. 5000ms captures ~95% of observations for a typical mesh."
   },
+  "timestamps": {
+    "defaultMode": "ago",
+    "timezone": "local",
+    "formatPreset": "iso",
+    "customFormat": "",
+    "allowCustomFormat": false
+  },
   "packetStore": {
     "maxMemoryMB": 1024,
     "estimatedPacketBytes": 450,

db.js

@@ -1,935 +0,0 @@
-const Database = require('better-sqlite3');
-const path = require('path');
-const fs = require('fs');
-
-// Ensure data directory exists
-const dbPath = process.env.DB_PATH || path.join(__dirname, 'data', 'meshcore.db');
-const dataDir = path.dirname(dbPath);
-if (!fs.existsSync(dataDir)) fs.mkdirSync(dataDir, { recursive: true });
-
-const db = new Database(dbPath);
-db.pragma('journal_mode = WAL');
-db.pragma('foreign_keys = ON');
-db.pragma('wal_autocheckpoint = 0'); // Disable auto-checkpoint — manual checkpoint on timer to avoid random event loop spikes
-
-// --- Migration: drop legacy tables (replaced by transmissions + observations in v2.3.0) ---
-// Drop paths first (has FK to packets)
-const legacyTables = ['paths', 'packets'];
-for (const t of legacyTables) {
-  const exists = db.prepare(`SELECT name FROM sqlite_master WHERE type='table' AND name=?`).get(t);
-  if (exists) {
-    console.log(`[migration] Dropping legacy table: ${t}`);
-    db.exec(`DROP TABLE IF EXISTS ${t}`);
-  }
-}
-
-// --- Schema ---
-db.exec(`
-  CREATE TABLE IF NOT EXISTS nodes (
-    public_key TEXT PRIMARY KEY,
-    name TEXT,
-    role TEXT,
-    lat REAL,
-    lon REAL,
-    last_seen TEXT,
-    first_seen TEXT,
-    advert_count INTEGER DEFAULT 0,
-    battery_mv INTEGER,
-    temperature_c REAL
-  );
-
-  CREATE TABLE IF NOT EXISTS observers (
-    id TEXT PRIMARY KEY,
-    name TEXT,
-    iata TEXT,
-    last_seen TEXT,
-    first_seen TEXT,
-    packet_count INTEGER DEFAULT 0,
-    model TEXT,
-    firmware TEXT,
-    client_version TEXT,
-    radio TEXT,
-    battery_mv INTEGER,
-    uptime_secs INTEGER,
-    noise_floor INTEGER
-  );
-
-  CREATE TABLE IF NOT EXISTS inactive_nodes (
-    public_key TEXT PRIMARY KEY,
-    name TEXT,
-    role TEXT,
-    lat REAL,
-    lon REAL,
-    last_seen TEXT,
-    first_seen TEXT,
-    advert_count INTEGER DEFAULT 0,
-    battery_mv INTEGER,
-    temperature_c REAL
-  );
-
-  CREATE INDEX IF NOT EXISTS idx_nodes_last_seen ON nodes(last_seen);
-  CREATE INDEX IF NOT EXISTS idx_observers_last_seen ON observers(last_seen);
-  CREATE INDEX IF NOT EXISTS idx_inactive_nodes_last_seen ON inactive_nodes(last_seen);
-
-  CREATE TABLE IF NOT EXISTS transmissions (
-    id INTEGER PRIMARY KEY AUTOINCREMENT,
-    raw_hex TEXT NOT NULL,
-    hash TEXT NOT NULL UNIQUE,
-    first_seen TEXT NOT NULL,
-    route_type INTEGER,
-    payload_type INTEGER,
-    payload_version INTEGER,
-    decoded_json TEXT,
-    created_at TEXT DEFAULT (datetime('now'))
-  );
-
-  CREATE INDEX IF NOT EXISTS idx_transmissions_hash ON transmissions(hash);
-  CREATE INDEX IF NOT EXISTS idx_transmissions_first_seen ON transmissions(first_seen);
-  CREATE INDEX IF NOT EXISTS idx_transmissions_payload_type ON transmissions(payload_type);
-`);
-
-// --- Determine schema version ---
-let schemaVersion = db.pragma('user_version', { simple: true }) || 0;
-
-// Migrate from old schema_version table to pragma user_version
-if (schemaVersion === 0) {
-  try {
-    const row = db.prepare('SELECT version FROM schema_version ORDER BY version DESC LIMIT 1').get();
-    if (row && row.version >= 3) {
-      db.pragma(`user_version = ${row.version}`);
-      schemaVersion = row.version;
-      db.exec('DROP TABLE IF EXISTS schema_version');
-    }
-  } catch {}
-}
-
-// Detect v3 schema by column presence (handles crash between migration and version write)
-if (schemaVersion === 0) {
-  try {
-    const cols = db.pragma('table_info(observations)').map(c => c.name);
-    if (cols.includes('observer_idx') && !cols.includes('observer_id')) {
-      db.pragma('user_version = 3');
-      schemaVersion = 3;
-      console.log('[migration-v3] Detected already-migrated schema, set user_version = 3');
-    }
-  } catch {}
-}
-
-// --- v3 migration: lean observations table ---
-function needsV3Migration() {
-  if (schemaVersion >= 3) return false;
-  // Check if observations table exists with old observer_id TEXT column
-  const obsExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='observations'").get();
-  if (!obsExists) return false;
-  const cols = db.pragma('table_info(observations)').map(c => c.name);
-  return cols.includes('observer_id');
-}
-
-function runV3Migration() {
-  const startTime = Date.now();
-  console.log('[migration-v3] Starting observations table optimization...');
-
-  // a. Backup DB
-  const backupPath = dbPath + `.pre-v3-backup-${Date.now()}`;
-  try {
-    console.log(`[migration-v3] Backing up DB to ${backupPath}...`);
-    fs.copyFileSync(dbPath, backupPath);
-    console.log(`[migration-v3] Backup complete (${Date.now() - startTime}ms)`);
-  } catch (e) {
-    console.error(`[migration-v3] Backup failed, aborting migration: ${e.message}`);
-    return false;
-  }
-
-  try {
-    // b. Create lean table
-    let stepStart = Date.now();
-    db.exec(`
-      CREATE TABLE observations_v3 (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
-        observer_idx INTEGER,
-        direction TEXT,
-        snr REAL,
-        rssi REAL,
-        score INTEGER,
-        path_json TEXT,
-        timestamp INTEGER NOT NULL
-      )
-    `);
-    console.log(`[migration-v3] Created observations_v3 table (${Date.now() - stepStart}ms)`);
-
-    // c. Migrate data
-    stepStart = Date.now();
-    const result = db.prepare(`
-      INSERT INTO observations_v3 (id, transmission_id, observer_idx, direction, snr, rssi, score, path_json, timestamp)
-      SELECT o.id, o.transmission_id, obs.rowid, o.direction, o.snr, o.rssi, o.score, o.path_json,
-        CAST(strftime('%s', o.timestamp) AS INTEGER)
-      FROM observations o
-      LEFT JOIN observers obs ON obs.id = o.observer_id
-    `).run();
-    console.log(`[migration-v3] Migrated ${result.changes} rows (${Date.now() - stepStart}ms)`);
-
-    // d. Drop view, old table, rename
-    stepStart = Date.now();
-    db.exec('DROP VIEW IF EXISTS packets_v');
-    db.exec('DROP TABLE observations');
-    db.exec('ALTER TABLE observations_v3 RENAME TO observations');
-    console.log(`[migration-v3] Replaced observations table (${Date.now() - stepStart}ms)`);
-
-    // f. Create indexes
-    stepStart = Date.now();
-    db.exec(`
-      CREATE INDEX idx_observations_transmission_id ON observations(transmission_id);
-      CREATE INDEX idx_observations_observer_idx ON observations(observer_idx);
-      CREATE INDEX idx_observations_timestamp ON observations(timestamp);
-      CREATE UNIQUE INDEX idx_observations_dedup ON observations(transmission_id, observer_idx, COALESCE(path_json, ''));
-    `);
-    console.log(`[migration-v3] Created indexes (${Date.now() - stepStart}ms)`);
-
-    // g. Set schema version
-    
-    db.pragma('user_version = 3');
-    schemaVersion = 3;
-
-    // h. Rebuild view (done below in common code)
-
-    // i. VACUUM + checkpoint
-    stepStart = Date.now();
-    db.exec('VACUUM');
-    db.pragma('wal_checkpoint(TRUNCATE)');
-    console.log(`[migration-v3] VACUUM + checkpoint complete (${Date.now() - stepStart}ms)`);
-
-    console.log(`[migration-v3] Migration complete! Total time: ${Date.now() - startTime}ms`);
-    return true;
-  } catch (e) {
-    console.error(`[migration-v3] Migration failed: ${e.message}`);
-    console.error('[migration-v3] Restore from backup if needed: ' + dbPath + '.pre-v3-backup');
-    // Try to clean up v3 table if it exists
-    try { db.exec('DROP TABLE IF EXISTS observations_v3'); } catch {}
-    return false;
-  }
-}
-
-const isV3 = schemaVersion >= 3;
-
-if (!isV3 && needsV3Migration()) {
-  runV3Migration();
-}
-
-// If user_version < 3 and no migration happened (fresh DB or migration skipped), create old-style table
-if (schemaVersion < 3) {
-  const obsExists = db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='observations'").get();
-  if (!obsExists) {
-    // Fresh DB — create v3 schema directly
-    db.exec(`
-      CREATE TABLE observations (
-        id INTEGER PRIMARY KEY AUTOINCREMENT,
-        transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
-        observer_idx INTEGER,
-        direction TEXT,
-        snr REAL,
-        rssi REAL,
-        score INTEGER,
-        path_json TEXT,
-        timestamp INTEGER NOT NULL
-      );
-      CREATE INDEX idx_observations_transmission_id ON observations(transmission_id);
-      CREATE INDEX idx_observations_observer_idx ON observations(observer_idx);
-      CREATE INDEX idx_observations_timestamp ON observations(timestamp);
-      CREATE UNIQUE INDEX idx_observations_dedup ON observations(transmission_id, observer_idx, COALESCE(path_json, ''));
-    `);
-    
-    db.pragma('user_version = 3');
-    schemaVersion = 3;
-  } else {
-    // Old-style observations table exists but migration wasn't run (or failed)
-    // Ensure indexes exist for old schema
-    db.exec(`
-      CREATE INDEX IF NOT EXISTS idx_observations_hash ON observations(hash);
-      CREATE INDEX IF NOT EXISTS idx_observations_transmission_id ON observations(transmission_id);
-      CREATE INDEX IF NOT EXISTS idx_observations_observer_id ON observations(observer_id);
-      CREATE INDEX IF NOT EXISTS idx_observations_timestamp ON observations(timestamp);
-    `);
-    // Dedup cleanup for old schema
-    try {
-      db.exec(`DROP INDEX IF EXISTS idx_observations_dedup`);
-      db.exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_observations_dedup ON observations(hash, observer_id, COALESCE(path_json, ''))`);
-      db.exec(`DELETE FROM observations WHERE id NOT IN (SELECT MIN(id) FROM observations GROUP BY hash, observer_id, COALESCE(path_json, ''))`);
-    } catch {}
-  }
-}
-
-// --- Create/rebuild packets_v view ---
-db.exec('DROP VIEW IF EXISTS packets_v');
-if (schemaVersion >= 3) {
-  db.exec(`
-    CREATE VIEW packets_v AS
-      SELECT o.id, t.raw_hex,
-             datetime(o.timestamp, 'unixepoch') AS timestamp,
-             obs.id AS observer_id, obs.name AS observer_name,
-             o.direction, o.snr, o.rssi, o.score, t.hash, t.route_type,
-             t.payload_type, t.payload_version, o.path_json, t.decoded_json,
-             t.created_at
-      FROM observations o
-      JOIN transmissions t ON t.id = o.transmission_id
-      LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-  `);
-} else {
-  db.exec(`
-    CREATE VIEW packets_v AS
-      SELECT o.id, t.raw_hex, o.timestamp, o.observer_id, o.observer_name,
-             o.direction, o.snr, o.rssi, o.score, t.hash, t.route_type,
-             t.payload_type, t.payload_version, o.path_json, t.decoded_json,
-             t.created_at
-      FROM observations o
-      JOIN transmissions t ON t.id = o.transmission_id
-  `);
-}
-
-// --- Migrations for existing DBs ---
-const observerCols = db.pragma('table_info(observers)').map(c => c.name);
-for (const col of ['model', 'firmware', 'client_version', 'radio', 'battery_mv', 'uptime_secs', 'noise_floor']) {
-  if (!observerCols.includes(col)) {
-    const type = ['battery_mv', 'uptime_secs', 'noise_floor'].includes(col) ? 'INTEGER' : 'TEXT';
-    db.exec(`ALTER TABLE observers ADD COLUMN ${col} ${type}`);
-    console.log(`[migration] Added observers.${col}`);
-  }
-}
-
-// --- Cleanup corrupted nodes on startup ---
-// Remove nodes with obviously invalid data (short pubkeys, control chars in names, etc.)
-{
-  const cleaned = db.prepare(`
-    DELETE FROM nodes WHERE
-      length(public_key) < 16
-      OR public_key GLOB '*[^0-9a-fA-F]*'
-      OR (lat IS NOT NULL AND (lat < -90 OR lat > 90))
-      OR (lon IS NOT NULL AND (lon < -180 OR lon > 180))
-  `).run();
-  if (cleaned.changes > 0) console.log(`[cleanup] Removed ${cleaned.changes} corrupted node(s) from DB`);
-}
-
-// --- One-time migration: recalculate advert_count to count unique transmissions only ---
-{
-  db.exec(`CREATE TABLE IF NOT EXISTS _migrations (name TEXT PRIMARY KEY)`);
-  const done = db.prepare(`SELECT 1 FROM _migrations WHERE name = 'advert_count_unique_v1'`).get();
-  if (!done) {
-    const start = Date.now();
-    console.log('[migration] Recalculating advert_count (unique transmissions only)...');
-    db.prepare(`
-      UPDATE nodes SET advert_count = (
-        SELECT COUNT(*) FROM transmissions t
-        WHERE t.payload_type = 4
-          AND t.decoded_json LIKE '%' || nodes.public_key || '%'
-      )
-    `).run();
-    db.prepare(`INSERT INTO _migrations (name) VALUES ('advert_count_unique_v1')`).run();
-    console.log(`[migration] advert_count recalculated in ${Date.now() - start}ms`);
-  }
-}
-
-// --- One-time migration: add telemetry columns to nodes and inactive_nodes ---
-{
-  const done = db.prepare(`SELECT 1 FROM _migrations WHERE name = 'node_telemetry_v1'`).get();
-  if (!done) {
-    console.log('[migration] Adding telemetry columns to nodes/inactive_nodes...');
-    const nodeCols = db.pragma('table_info(nodes)').map(c => c.name);
-    if (!nodeCols.includes('battery_mv')) db.exec(`ALTER TABLE nodes ADD COLUMN battery_mv INTEGER`);
-    if (!nodeCols.includes('temperature_c')) db.exec(`ALTER TABLE nodes ADD COLUMN temperature_c REAL`);
-    const inactiveCols = db.pragma('table_info(inactive_nodes)').map(c => c.name);
-    if (!inactiveCols.includes('battery_mv')) db.exec(`ALTER TABLE inactive_nodes ADD COLUMN battery_mv INTEGER`);
-    if (!inactiveCols.includes('temperature_c')) db.exec(`ALTER TABLE inactive_nodes ADD COLUMN temperature_c REAL`);
-    db.prepare(`INSERT INTO _migrations (name) VALUES ('node_telemetry_v1')`).run();
-    console.log('[migration] node telemetry columns added');
-  }
-}
-
-// --- Prepared statements ---
-const stmts = {
-  upsertNode: db.prepare(`
-    INSERT INTO nodes (public_key, name, role, lat, lon, last_seen, first_seen)
-    VALUES (@public_key, @name, @role, @lat, @lon, @last_seen, @first_seen)
-    ON CONFLICT(public_key) DO UPDATE SET
-      name = COALESCE(@name, name),
-      role = COALESCE(@role, role),
-      lat = COALESCE(@lat, lat),
-      lon = COALESCE(@lon, lon),
-      last_seen = @last_seen
-  `),
-  incrementAdvertCount: db.prepare(`
-    UPDATE nodes SET advert_count = advert_count + 1 WHERE public_key = @public_key
-  `),
-  updateNodeTelemetry: db.prepare(`
-    UPDATE nodes SET
-      battery_mv = COALESCE(@battery_mv, battery_mv),
-      temperature_c = COALESCE(@temperature_c, temperature_c)
-    WHERE public_key = @public_key
-  `),
-  upsertObserver: db.prepare(`
-    INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count, model, firmware, client_version, radio, battery_mv, uptime_secs, noise_floor)
-    VALUES (@id, @name, @iata, @last_seen, @first_seen, 1, @model, @firmware, @client_version, @radio, @battery_mv, @uptime_secs, @noise_floor)
-    ON CONFLICT(id) DO UPDATE SET
-      name = COALESCE(@name, name),
-      iata = COALESCE(@iata, iata),
-      last_seen = @last_seen,
-      packet_count = packet_count + 1,
-      model = COALESCE(@model, model),
-      firmware = COALESCE(@firmware, firmware),
-      client_version = COALESCE(@client_version, client_version),
-      radio = COALESCE(@radio, radio),
-      battery_mv = COALESCE(@battery_mv, battery_mv),
-      uptime_secs = COALESCE(@uptime_secs, uptime_secs),
-      noise_floor = COALESCE(@noise_floor, noise_floor)
-  `),
-  updateObserverStatus: db.prepare(`
-    INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count, model, firmware, client_version, radio, battery_mv, uptime_secs, noise_floor)
-    VALUES (@id, @name, @iata, @last_seen, @first_seen, 0, @model, @firmware, @client_version, @radio, @battery_mv, @uptime_secs, @noise_floor)
-    ON CONFLICT(id) DO UPDATE SET
-      name = COALESCE(@name, name),
-      iata = COALESCE(@iata, iata),
-      last_seen = @last_seen,
-      model = COALESCE(@model, model),
-      firmware = COALESCE(@firmware, firmware),
-      client_version = COALESCE(@client_version, client_version),
-      radio = COALESCE(@radio, radio),
-      battery_mv = COALESCE(@battery_mv, battery_mv),
-      uptime_secs = COALESCE(@uptime_secs, uptime_secs),
-      noise_floor = COALESCE(@noise_floor, noise_floor)
-  `),
-  getPacket: db.prepare(`SELECT * FROM packets_v WHERE id = ?`),
-  getNode: db.prepare(`SELECT * FROM nodes WHERE public_key = ?`),
-  getRecentPacketsForNode: db.prepare(`
-    SELECT * FROM packets_v WHERE decoded_json LIKE ? OR decoded_json LIKE ? OR decoded_json LIKE ? OR decoded_json LIKE ?
-    ORDER BY timestamp DESC LIMIT 20
-  `),
-  getObservers: db.prepare(`SELECT * FROM observers ORDER BY last_seen DESC`),
-  countPackets: db.prepare(`SELECT COUNT(*) as count FROM observations`),
-  countNodes: db.prepare(`SELECT COUNT(*) as count FROM nodes`),
-  countActiveNodes: db.prepare(`SELECT COUNT(*) as count FROM nodes WHERE last_seen > ?`),
-  countActiveNodesByRole: db.prepare(`SELECT COUNT(*) as count FROM nodes WHERE role = ? AND last_seen > ?`),
-  countObservers: db.prepare(`SELECT COUNT(*) as count FROM observers`),
-  countRecentPackets: schemaVersion >= 3
-    ? db.prepare(`SELECT COUNT(*) as count FROM observations WHERE timestamp > CAST(strftime('%s', ?) AS INTEGER)`)
-    : db.prepare(`SELECT COUNT(*) as count FROM observations WHERE timestamp > ?`),
-  getTransmissionByHash: db.prepare(`SELECT id, first_seen FROM transmissions WHERE hash = ?`),
-  insertTransmission: db.prepare(`
-    INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, payload_version, decoded_json)
-    VALUES (@raw_hex, @hash, @first_seen, @route_type, @payload_type, @payload_version, @decoded_json)
-  `),
-  updateTransmissionFirstSeen: db.prepare(`UPDATE transmissions SET first_seen = @first_seen WHERE id = @id`),
-  insertObservation: schemaVersion >= 3
-    ? db.prepare(`
-        INSERT OR IGNORE INTO observations (transmission_id, observer_idx, direction, snr, rssi, score, path_json, timestamp)
-        VALUES (@transmission_id, @observer_idx, @direction, @snr, @rssi, @score, @path_json, @timestamp)
-      `)
-    : db.prepare(`
-        INSERT OR IGNORE INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp)
-        VALUES (@transmission_id, @hash, @observer_id, @observer_name, @direction, @snr, @rssi, @score, @path_json, @timestamp)
-      `),
-  getObserverRowid: db.prepare(`SELECT rowid FROM observers WHERE id = ?`),
-};
-
-// --- In-memory observer map (observer_id text → rowid integer) ---
-const observerIdToRowid = new Map();
-if (schemaVersion >= 3) {
-  const rows = db.prepare('SELECT id, rowid FROM observers').all();
-  for (const r of rows) observerIdToRowid.set(r.id, r.rowid);
-}
-
-// --- In-memory dedup set for v3 ---
-const dedupSet = new Map(); // key → timestamp (for cleanup)
-const DEDUP_TTL_MS = 5 * 60 * 1000; // 5 minutes
-
-function cleanupDedupSet() {
-  const cutoff = Date.now() - DEDUP_TTL_MS;
-  for (const [key, ts] of dedupSet) {
-    if (ts < cutoff) dedupSet.delete(key);
-  }
-}
-
-// Periodic cleanup every 60s
-setInterval(cleanupDedupSet, 60000).unref();
-
-function resolveObserverIdx(observerId) {
-  if (!observerId) return null;
-  let rowid = observerIdToRowid.get(observerId);
-  if (rowid !== undefined) return rowid;
-  // Try DB lookup (observer may have been inserted elsewhere)
-  const row = stmts.getObserverRowid.get(observerId);
-  if (row) {
-    observerIdToRowid.set(observerId, row.rowid);
-    return row.rowid;
-  }
-  return null;
-}
-
-// --- Helper functions ---
-
-function insertTransmission(data) {
-  const hash = data.hash;
-  if (!hash) return null;
-
-  const timestamp = data.timestamp || new Date().toISOString();
-  let transmissionId;
-
-  let isNew = false;
-  const existing = stmts.getTransmissionByHash.get(hash);
-  if (existing) {
-    transmissionId = existing.id;
-    if (timestamp < existing.first_seen) {
-      stmts.updateTransmissionFirstSeen.run({ id: transmissionId, first_seen: timestamp });
-    }
-  } else {
-    isNew = true;
-    const result = stmts.insertTransmission.run({
-      raw_hex: data.raw_hex || '',
-      hash,
-      first_seen: timestamp,
-      route_type: data.route_type ?? null,
-      payload_type: data.payload_type ?? null,
-      payload_version: data.payload_version ?? null,
-      decoded_json: data.decoded_json || null,
-    });
-    transmissionId = result.lastInsertRowid;
-  }
-
-  let obsResult;
-  if (schemaVersion >= 3) {
-    const observerIdx = resolveObserverIdx(data.observer_id);
-    const epochTs = typeof timestamp === 'number' ? timestamp : Math.floor(new Date(timestamp).getTime() / 1000);
-
-    // In-memory dedup check
-    const dedupKey = `${transmissionId}|${observerIdx}|${data.path_json || ''}`;
-    if (dedupSet.has(dedupKey)) {
-      return { transmissionId, observationId: 0, isNew };
-    }
-
-    obsResult = stmts.insertObservation.run({
-      transmission_id: transmissionId,
-      observer_idx: observerIdx,
-      direction: data.direction || null,
-      snr: data.snr ?? null,
-      rssi: data.rssi ?? null,
-      score: data.score ?? null,
-      path_json: data.path_json || null,
-      timestamp: epochTs,
-    });
-    dedupSet.set(dedupKey, Date.now());
-  } else {
-    obsResult = stmts.insertObservation.run({
-      transmission_id: transmissionId,
-      hash,
-      observer_id: data.observer_id || null,
-      observer_name: data.observer_name || null,
-      direction: data.direction || null,
-      snr: data.snr ?? null,
-      rssi: data.rssi ?? null,
-      score: data.score ?? null,
-      path_json: data.path_json || null,
-      timestamp,
-    });
-  }
-
-  return { transmissionId, observationId: obsResult.lastInsertRowid, isNew };
-}
-
-function incrementAdvertCount(publicKey) {
-  stmts.incrementAdvertCount.run({ public_key: publicKey });
-}
-
-function updateNodeTelemetry(data) {
-  stmts.updateNodeTelemetry.run({
-    public_key: data.public_key,
-    battery_mv: data.battery_mv ?? null,
-    temperature_c: data.temperature_c ?? null,
-  });
-}
-
-function upsertNode(data) {
-  const now = new Date().toISOString();
-  stmts.upsertNode.run({
-    public_key: data.public_key,
-    name: data.name || null,
-    role: data.role || null,
-    lat: data.lat ?? null,
-    lon: data.lon ?? null,
-    last_seen: data.last_seen || now,
-    first_seen: data.first_seen || now,
-  });
-}
-
-function upsertObserver(data) {
-  const now = new Date().toISOString();
-  stmts.upsertObserver.run({
-    id: data.id,
-    name: data.name || null,
-    iata: data.iata || null,
-    last_seen: data.last_seen || now,
-    first_seen: data.first_seen || now,
-    model: data.model || null,
-    firmware: data.firmware || null,
-    client_version: data.client_version || null,
-    radio: data.radio || null,
-    battery_mv: data.battery_mv || null,
-    uptime_secs: data.uptime_secs || null,
-    noise_floor: data.noise_floor || null,
-  });
-  // Update in-memory map for v3
-  if (schemaVersion >= 3 && !observerIdToRowid.has(data.id)) {
-    const row = stmts.getObserverRowid.get(data.id);
-    if (row) observerIdToRowid.set(data.id, row.rowid);
-  }
-}
-
-function updateObserverStatus(data) {
-  const now = new Date().toISOString();
-  stmts.updateObserverStatus.run({
-    id: data.id,
-    name: data.name || null,
-    iata: data.iata || null,
-    last_seen: data.last_seen || now,
-    first_seen: data.first_seen || now,
-    model: data.model || null,
-    firmware: data.firmware || null,
-    client_version: data.client_version || null,
-    radio: data.radio || null,
-    battery_mv: data.battery_mv || null,
-    uptime_secs: data.uptime_secs || null,
-    noise_floor: data.noise_floor || null,
-  });
-}
-
-function getPackets({ limit = 50, offset = 0, type, route, hash, since } = {}) {
-  let where = [];
-  let params = {};
-  if (type !== undefined) { where.push('payload_type = @type'); params.type = type; }
-  if (route !== undefined) { where.push('route_type = @route'); params.route = route; }
-  if (hash) { where.push('hash = @hash'); params.hash = hash; }
-  if (since) { where.push('timestamp > @since'); params.since = since; }
-  const clause = where.length ? 'WHERE ' + where.join(' AND ') : '';
-  const rows = db.prepare(`SELECT * FROM packets_v ${clause} ORDER BY timestamp DESC LIMIT @limit OFFSET @offset`).all({ ...params, limit, offset });
-  const total = db.prepare(`SELECT COUNT(*) as count FROM packets_v ${clause}`).get(params).count;
-  return { rows, total };
-}
-
-function getTransmission(id) {
-  try {
-    return db.prepare('SELECT * FROM transmissions WHERE id = ?').get(id) || null;
-  } catch { return null; }
-}
-
-function getPacket(id) {
-  const packet = stmts.getPacket.get(id);
-  if (!packet) return null;
-  return packet;
-}
-
-function getNodes({ limit = 50, offset = 0, sortBy = 'last_seen' } = {}) {
-  const allowed = ['last_seen', 'name', 'advert_count', 'first_seen'];
-  const col = allowed.includes(sortBy) ? sortBy : 'last_seen';
-  const dir = col === 'name' ? 'ASC' : 'DESC';
-  const rows = db.prepare(`SELECT * FROM nodes ORDER BY ${col} ${dir} LIMIT ? OFFSET ?`).all(limit, offset);
-  const total = stmts.countNodes.get().count;
-  return { rows, total };
-}
-
-function getNode(pubkey) {
-  const node = stmts.getNode.get(pubkey);
-  if (!node) return null;
-  // Match by: pubkey anywhere, name in sender/text fields, name as text prefix ("Name: msg")
-  const namePattern = node.name ? `%${node.name}%` : `%${pubkey}%`;
-  const textPrefix = node.name ? `%"text":"${node.name}:%` : `%${pubkey}%`;
-  node.recentPackets = stmts.getRecentPacketsForNode.all(
-    `%${pubkey}%`,
-    namePattern,
-    textPrefix,
-    `%"sender":"${node.name || pubkey}"%`
-  );
-  return node;
-}
-
-function getObservers() {
-  return stmts.getObservers.all();
-}
-
-function getStats() {
-  const oneHourAgo = new Date(Date.now() - 3600000).toISOString();
-  const sevenDaysAgo = new Date(Date.now() - 7 * 24 * 3600000).toISOString();
-  // Try to get transmission count from normalized schema
-  let totalTransmissions = null;
-  try {
-    totalTransmissions = db.prepare('SELECT COUNT(*) as count FROM transmissions').get().count;
-  } catch {}
-  return {
-    totalPackets: totalTransmissions || stmts.countPackets.get().count,
-    totalTransmissions,
-    totalObservations: stmts.countPackets.get().count,
-    totalNodes: stmts.countActiveNodes.get(sevenDaysAgo).count,
-    totalNodesAllTime: stmts.countNodes.get().count,
-    totalObservers: stmts.countObservers.get().count,
-    packetsLastHour: stmts.countRecentPackets.get(oneHourAgo).count,
-    packetsLast24h: stmts.countRecentPackets.get(new Date(Date.now() - 24 * 3600000).toISOString()).count,
-  };
-}
-
-// --- Run directly ---
-if (require.main === module) {
-  console.log('Stats:', getStats());
-}
-
-// Remove phantom nodes created by autoLearnHopNodes before this fix.
-// Real MeshCore pubkeys are 32 bytes (64 hex chars). Phantom nodes have only
-// the hop prefix as their public_key (typically 4-8 hex chars).
-// Threshold: public_key <= 16 hex chars (8 bytes) is too short to be real.
-function removePhantomNodes() {
-  const result = db.prepare(`DELETE FROM nodes WHERE LENGTH(public_key) <= 16`).run();
-  if (result.changes > 0) {
-    console.log(`[cleanup] Removed ${result.changes} phantom node(s) with short public_key prefixes`);
-  }
-  return result.changes;
-}
-
-function searchNodes(query, limit = 10) {
-  return db.prepare(`
-    SELECT * FROM nodes
-    WHERE name LIKE @q OR public_key LIKE @prefix
-    ORDER BY last_seen DESC
-    LIMIT @limit
-  `).all({ q: `%${query}%`, prefix: `${query}%`, limit });
-}
-
-function getNodeHealth(pubkey) {
-  const node = stmts.getNode.get(pubkey);
-  if (!node) return null;
-
-  const todayStart = new Date();
-  todayStart.setUTCHours(0, 0, 0, 0);
-  const todayISO = todayStart.toISOString();
-
-  const keyPattern = `%${pubkey}%`;
-  // Also match by node name in decoded_json (channel messages have sender name, not pubkey)
-  const namePattern = node.name ? `%${node.name.replace(/[%_]/g, '')}%` : null;
-  const whereClause = namePattern
-    ? `(decoded_json LIKE @keyPattern OR decoded_json LIKE @namePattern)`
-    : `decoded_json LIKE @keyPattern`;
-  const params = namePattern ? { keyPattern, namePattern } : { keyPattern };
-
-  // Observers that heard this node
-  const observers = db.prepare(`
-    SELECT observer_id, observer_name,
-      AVG(snr) as avgSnr, AVG(rssi) as avgRssi, COUNT(*) as packetCount
-    FROM packets_v
-    WHERE ${whereClause} AND observer_id IS NOT NULL
-    GROUP BY observer_id
-    ORDER BY packetCount DESC
-  `).all(params);
-
-  // Stats
-  const packetsToday = db.prepare(`
-    SELECT COUNT(*) as count FROM packets_v WHERE ${whereClause} AND timestamp > @since
-  `).get({ ...params, since: todayISO }).count;
-
-  const avgStats = db.prepare(`
-    SELECT AVG(snr) as avgSnr FROM packets_v WHERE ${whereClause}
-  `).get(params);
-
-  const lastHeard = db.prepare(`
-    SELECT MAX(timestamp) as lastHeard FROM packets_v WHERE ${whereClause}
-  `).get(params).lastHeard;
-
-  // Avg hops from path_json
-  const pathRows = db.prepare(`
-    SELECT path_json FROM packets_v WHERE ${whereClause} AND path_json IS NOT NULL
-  `).all(params);
-
-  let totalHops = 0, hopCount = 0;
-  for (const row of pathRows) {
-    try {
-      const hops = JSON.parse(row.path_json);
-      if (Array.isArray(hops)) { totalHops += hops.length; hopCount++; }
-    } catch {}
-  }
-  const avgHops = hopCount > 0 ? Math.round(totalHops / hopCount) : 0;
-
-  const totalPackets = db.prepare(`
-    SELECT COUNT(*) as count FROM packets_v WHERE ${whereClause}
-  `).get(params).count;
-
-  // Recent 10 packets
-  const recentPackets = db.prepare(`
-    SELECT * FROM packets_v WHERE ${whereClause} ORDER BY timestamp DESC LIMIT 10
-  `).all(params);
-
-  return {
-    node,
-    observers,
-    stats: { totalPackets, packetsToday, avgSnr: avgStats.avgSnr, avgHops, lastHeard },
-    recentPackets,
-  };
-}
-
-function getNodeAnalytics(pubkey, days) {
-  const node = stmts.getNode.get(pubkey);
-  if (!node) return null;
-
-  const now = new Date();
-  const from = new Date(now.getTime() - days * 86400000);
-  const fromISO = from.toISOString();
-  const toISO = now.toISOString();
-
-  const keyPattern = `%${pubkey}%`;
-  const namePattern = node.name ? `%${node.name.replace(/[%_]/g, '')}%` : null;
-  const whereClause = namePattern
-    ? `(decoded_json LIKE @keyPattern OR decoded_json LIKE @namePattern)`
-    : `decoded_json LIKE @keyPattern`;
-  const timeWhere = `${whereClause} AND timestamp > @fromISO`;
-  const params = namePattern ? { keyPattern, namePattern, fromISO } : { keyPattern, fromISO };
-
-  // Activity timeline
-  const activityTimeline = db.prepare(`
-    SELECT strftime('%Y-%m-%dT%H:00:00Z', timestamp) as bucket, COUNT(*) as count
-    FROM packets_v WHERE ${timeWhere} GROUP BY bucket ORDER BY bucket
-  `).all(params);
-
-  // SNR trend
-  const snrTrend = db.prepare(`
-    SELECT timestamp, snr, rssi, observer_id, observer_name
-    FROM packets_v WHERE ${timeWhere} AND snr IS NOT NULL ORDER BY timestamp
-  `).all(params);
-
-  // Packet type breakdown
-  const packetTypeBreakdown = db.prepare(`
-    SELECT payload_type, COUNT(*) as count FROM packets_v WHERE ${timeWhere} GROUP BY payload_type
-  `).all(params);
-
-  // Observer coverage
-  const observerCoverage = db.prepare(`
-    SELECT observer_id, observer_name, COUNT(*) as packetCount,
-      AVG(snr) as avgSnr, AVG(rssi) as avgRssi, MIN(timestamp) as firstSeen, MAX(timestamp) as lastSeen
-    FROM packets_v WHERE ${timeWhere} AND observer_id IS NOT NULL
-    GROUP BY observer_id ORDER BY packetCount DESC
-  `).all(params);
-
-  // Hop distribution
-  const pathRows = db.prepare(`
-    SELECT path_json FROM packets_v WHERE ${timeWhere} AND path_json IS NOT NULL
-  `).all(params);
-
-  const hopCounts = {};
-  let totalWithPath = 0, relayedCount = 0;
-  for (const row of pathRows) {
-    try {
-      const hops = JSON.parse(row.path_json);
-      if (Array.isArray(hops)) {
-        const h = hops.length;
-        const key = h >= 4 ? '4+' : String(h);
-        hopCounts[key] = (hopCounts[key] || 0) + 1;
-        totalWithPath++;
-        if (h > 1) relayedCount++;
-      }
-    } catch {}
-  }
-  const hopDistribution = Object.entries(hopCounts).map(([hops, count]) => ({ hops, count }))
-    .sort((a, b) => a.hops.localeCompare(b.hops, undefined, { numeric: true }));
-
-  // Peer interactions from decoded_json
-  const decodedRows = db.prepare(`
-    SELECT decoded_json, timestamp FROM packets_v WHERE ${timeWhere} AND decoded_json IS NOT NULL
-  `).all(params);
-
-  const peerMap = {};
-  for (const row of decodedRows) {
-    try {
-      const d = JSON.parse(row.decoded_json);
-      // Look for sender/recipient pubkeys that aren't this node
-      const candidates = [];
-      if (d.sender_key && d.sender_key !== pubkey) candidates.push({ key: d.sender_key, name: d.sender_name || d.sender_short_name });
-      if (d.recipient_key && d.recipient_key !== pubkey) candidates.push({ key: d.recipient_key, name: d.recipient_name || d.recipient_short_name });
-      if (d.pubkey && d.pubkey !== pubkey) candidates.push({ key: d.pubkey, name: d.name });
-      for (const c of candidates) {
-        if (!c.key) continue;
-        if (!peerMap[c.key]) peerMap[c.key] = { peer_key: c.key, peer_name: c.name || c.key.slice(0, 12), messageCount: 0, lastContact: row.timestamp };
-        peerMap[c.key].messageCount++;
-        if (row.timestamp > peerMap[c.key].lastContact) peerMap[c.key].lastContact = row.timestamp;
-      }
-    } catch {}
-  }
-  const peerInteractions = Object.values(peerMap).sort((a, b) => b.messageCount - a.messageCount).slice(0, 20);
-
-  // Uptime heatmap
-  const uptimeHeatmap = db.prepare(`
-    SELECT CAST(strftime('%w', timestamp) AS INTEGER) as dayOfWeek,
-      CAST(strftime('%H', timestamp) AS INTEGER) as hour, COUNT(*) as count
-    FROM packets_v WHERE ${timeWhere} GROUP BY dayOfWeek, hour
-  `).all(params);
-
-  // Computed stats
-  const totalPackets = db.prepare(`SELECT COUNT(*) as count FROM packets_v WHERE ${timeWhere}`).get(params).count;
-  const uniqueObservers = observerCoverage.length;
-  const uniquePeers = peerInteractions.length;
-  const avgPacketsPerDay = days > 0 ? Math.round(totalPackets / days * 10) / 10 : totalPackets;
-
-  // Availability: distinct hours with packets / total hours
-  const distinctHours = activityTimeline.length;
-  const totalHours = days * 24;
-  const availabilityPct = totalHours > 0 ? Math.round(distinctHours / totalHours * 1000) / 10 : 0;
-
-  // Longest silence
-  const timestamps = db.prepare(`
-    SELECT timestamp FROM packets_v WHERE ${timeWhere} ORDER BY timestamp
-  `).all(params).map(r => new Date(r.timestamp).getTime());
-
-  let longestSilenceMs = 0, longestSilenceStart = null;
-  for (let i = 1; i < timestamps.length; i++) {
-    const gap = timestamps[i] - timestamps[i - 1];
-    if (gap > longestSilenceMs) { longestSilenceMs = gap; longestSilenceStart = new Date(timestamps[i - 1]).toISOString(); }
-  }
-
-  // Signal grade
-  const snrValues = snrTrend.map(r => r.snr);
-  const snrMean = snrValues.length > 0 ? snrValues.reduce((a, b) => a + b, 0) / snrValues.length : 0;
-  const snrStdDev = snrValues.length > 1 ? Math.sqrt(snrValues.reduce((s, v) => s + (v - snrMean) ** 2, 0) / snrValues.length) : 0;
-  let signalGrade = 'D';
-  if (snrMean > 15 && snrStdDev < 2) signalGrade = 'A';
-  else if (snrMean > 15) signalGrade = 'A-';
-  else if (snrMean > 12 && snrStdDev < 3) signalGrade = 'B+';
-  else if (snrMean > 8) signalGrade = 'B';
-  else if (snrMean > 3) signalGrade = 'C';
-
-  const relayPct = totalWithPath > 0 ? Math.round(relayedCount / totalWithPath * 1000) / 10 : 0;
-
-  return {
-    node,
-    timeRange: { from: fromISO, to: toISO, days },
-    activityTimeline,
-    snrTrend,
-    packetTypeBreakdown,
-    observerCoverage,
-    hopDistribution,
-    peerInteractions,
-    uptimeHeatmap,
-    computedStats: {
-      availabilityPct, longestSilenceMs, longestSilenceStart, signalGrade,
-      snrMean: Math.round(snrMean * 10) / 10, snrStdDev: Math.round(snrStdDev * 10) / 10,
-      relayPct, totalPackets, uniqueObservers, uniquePeers, avgPacketsPerDay
-    }
-  };
-}
-
-// Move stale nodes to inactive_nodes table based on retention.nodeDays config.
-function moveStaleNodes(nodeDays) {
-  if (!nodeDays || nodeDays <= 0) return 0;
-  const cutoff = new Date(Date.now() - nodeDays * 24 * 3600000).toISOString();
-  const move = db.transaction(() => {
-    db.prepare(`INSERT OR REPLACE INTO inactive_nodes SELECT * FROM nodes WHERE last_seen < ?`).run(cutoff);
-    const result = db.prepare(`DELETE FROM nodes WHERE last_seen < ?`).run(cutoff);
-    return result.changes;
-  });
-  const moved = move();
-  if (moved > 0) {
-    console.log(`[retention] Moved ${moved} node(s) to inactive_nodes (not seen in ${nodeDays} days)`);
-  }
-  return moved;
-}
-
-module.exports = { db, schemaVersion, observerIdToRowid, resolveObserverIdx, insertTransmission, upsertNode, incrementAdvertCount, updateNodeTelemetry, upsertObserver, updateObserverStatus, getPackets, getPacket, getTransmission, getNodes, getNode, getObservers, getStats, searchNodes, getNodeHealth, getNodeAnalytics, removePhantomNodes, moveStaleNodes };

decoder.js

@@ -1,439 +0,0 @@
-/**
- * MeshCore Packet Decoder
- * Custom implementation — does NOT use meshcore-decoder library (known path_length bug).
- *
- * Packet layout (per firmware docs/packet_format.md):
- *   [header(1)] [transportCodes?(4)] [pathLength(1)] [path hops] [payload...]
- *
- * Header byte (LSB first):
- *   bits 1-0: routeType (0=TRANSPORT_FLOOD, 1=FLOOD, 2=DIRECT, 3=TRANSPORT_DIRECT)
- *   bits 5-2: payloadType
- *   bits 7-6: payloadVersion
- *
- * Path length byte:
- *   bits 5-0: hash_count (number of hops, 0-63)
- *   bits 7-6: (value >> 6) + 1 = hash_size (1-4 bytes per hop hash)
- */
-
-'use strict';
-
-// --- Constants ---
-
-const ROUTE_TYPES = {
-  0: 'TRANSPORT_FLOOD',
-  1: 'FLOOD',
-  2: 'DIRECT',
-  3: 'TRANSPORT_DIRECT',
-};
-
-const PAYLOAD_TYPES = {
-  0x00: 'REQ',
-  0x01: 'RESPONSE',
-  0x02: 'TXT_MSG',
-  0x03: 'ACK',
-  0x04: 'ADVERT',
-  0x05: 'GRP_TXT',
-  0x06: 'GRP_DATA',
-  0x07: 'ANON_REQ',
-  0x08: 'PATH',
-  0x09: 'TRACE',
-  0x0A: 'MULTIPART',
-  0x0B: 'CONTROL',
-  0x0F: 'RAW_CUSTOM',
-};
-
-// Route types that carry transport codes (2x uint16_t, 4 bytes total)
-const TRANSPORT_ROUTES = new Set([0, 3]); // TRANSPORT_FLOOD, TRANSPORT_DIRECT
-
-// --- Header parsing ---
-
-function decodeHeader(byte) {
-  return {
-    routeType: byte & 0x03,
-    routeTypeName: ROUTE_TYPES[byte & 0x03] || 'UNKNOWN',
-    payloadType: (byte >> 2) & 0x0F,
-    payloadTypeName: PAYLOAD_TYPES[(byte >> 2) & 0x0F] || 'UNKNOWN',
-    payloadVersion: (byte >> 6) & 0x03,
-  };
-}
-
-// --- Path parsing ---
-
-function decodePath(pathByte, buf, offset) {
-  const hashSize = (pathByte >> 6) + 1;   // 1-4 bytes per hash
-  const hashCount = pathByte & 0x3F;       // 0-63 hops
-  const available = buf.length - offset;
-  // Cap to what the buffer actually holds — corrupt packets may claim more hops than exist
-  const safeCount = Math.min(hashCount, Math.floor(available / hashSize));
-  const totalBytes = safeCount * hashSize;
-  const hops = [];
-
-  for (let i = 0; i < safeCount; i++) {
-    hops.push(buf.subarray(offset + i * hashSize, offset + i * hashSize + hashSize).toString('hex').toUpperCase());
-  }
-
-  return {
-    hashSize,
-    hashCount: safeCount,
-    hops,
-    bytesConsumed: totalBytes,
-    truncated: safeCount < hashCount,
-  };
-}
-
-// --- Payload decoders ---
-
-/** REQ / RESPONSE / TXT_MSG: dest(1) + src(1) + MAC(2) + encrypted (PAYLOAD_VER_1, per Mesh.cpp) */
-function decodeEncryptedPayload(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    srcHash: buf.subarray(1, 2).toString('hex'),
-    mac: buf.subarray(2, 4).toString('hex'),
-    encryptedData: buf.subarray(4).toString('hex'),
-  };
-}
-
-/** ACK: checksum(4) — CRC of message timestamp + text + sender pubkey (per Mesh.cpp createAck) */
-function decodeAck(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    ackChecksum: buf.subarray(0, 4).toString('hex'),
-  };
-}
-
-/** ADVERT: pubkey(32) + timestamp(4 LE) + signature(64) + appdata */
-function decodeAdvert(buf) {
-  if (buf.length < 100) return { error: 'too short for advert', raw: buf.toString('hex') };
-  const pubKey = buf.subarray(0, 32).toString('hex');
-  const timestamp = buf.readUInt32LE(32);
-  const signature = buf.subarray(36, 100).toString('hex');
-  const appdata = buf.subarray(100);
-
-  const result = { pubKey, timestamp, timestampISO: new Date(timestamp * 1000).toISOString(), signature };
-
-  if (appdata.length > 0) {
-    const flags = appdata[0];
-    const advType = flags & 0x0F; // lower nibble is enum type, not individual bits
-    result.flags = {
-      raw: flags,
-      type: advType,
-      chat: advType === 1,
-      repeater: advType === 2,
-      room: advType === 3,
-      sensor: advType === 4,
-      hasLocation: !!(flags & 0x10),
-      hasFeat1: !!(flags & 0x20),
-      hasFeat2: !!(flags & 0x40),
-      hasName: !!(flags & 0x80),
-    };
-
-    let off = 1;
-    if (result.flags.hasLocation && appdata.length >= off + 8) {
-      result.lat = appdata.readInt32LE(off) / 1e6;
-      result.lon = appdata.readInt32LE(off + 4) / 1e6;
-      off += 8;
-    }
-    if (result.flags.hasFeat1 && appdata.length >= off + 2) {
-      result.feat1 = appdata.readUInt16LE(off);
-      off += 2;
-    }
-    if (result.flags.hasFeat2 && appdata.length >= off + 2) {
-      result.feat2 = appdata.readUInt16LE(off);
-      off += 2;
-    }
-    if (result.flags.hasName) {
-      // Find null terminator to separate name from trailing telemetry bytes
-      let nameEnd = appdata.length;
-      for (let i = off; i < appdata.length; i++) {
-        if (appdata[i] === 0x00) { nameEnd = i; break; }
-      }
-      let name = appdata.subarray(off, nameEnd).toString('utf8');
-      name = name.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, '');
-      result.name = name;
-      off = nameEnd;
-      // Skip null terminator(s)
-      while (off < appdata.length && appdata[off] === 0x00) off++;
-    }
-
-    // Telemetry bytes after name: battery_mv(2 LE) + temperature_c(2 LE, signed, /100)
-    // Only sensor nodes (advType=4) carry telemetry bytes.
-    if (result.flags.sensor && off + 4 <= appdata.length) {
-      const batteryMv = appdata.readUInt16LE(off);
-      const tempRaw = appdata.readInt16LE(off + 2);
-      const tempC = tempRaw / 100.0;
-      if (batteryMv > 0 && batteryMv <= 10000) {
-        result.battery_mv = batteryMv;
-      }
-      // Raw int16 / 100 → °C; accept -50°C to 100°C (raw: -5000 to 10000)
-      if (tempRaw >= -5000 && tempRaw <= 10000) {
-        result.temperature_c = tempC;
-      }
-    }
-  }
-
-  return result;
-}
-
-/**
- * Check if text contains non-printable characters (binary garbage).
- * Returns true if more than 2 non-printable chars found (excluding \n, \t).
- */
-function hasNonPrintableChars(text) {
-  if (!text) return false;
-  let count = 0;
-  for (let i = 0; i < text.length; i++) {
-    const code = text.charCodeAt(i);
-    if (code < 0x20 && code !== 0x0A && code !== 0x09) count++;
-    else if (code === 0xFFFD) count++;  // Unicode replacement char (invalid UTF-8)
-    if (count > 2) return true;
-  }
-  return false;
-}
-
-/** GRP_TXT: channel_hash(1) + MAC(2) + encrypted */
-function decodeGrpTxt(buf, channelKeys) {
-  if (buf.length < 3) return { error: 'too short', raw: buf.toString('hex') };
-  const channelHash = buf[0];
-  const channelHashHex = channelHash.toString(16).padStart(2, '0').toUpperCase();
-  const mac = buf.subarray(1, 3).toString('hex');
-  const encryptedData = buf.subarray(3).toString('hex');
-
-  const hasKeys = channelKeys && Object.keys(channelKeys).length > 0;
-
-  // Try decryption with known channel keys
-  if (hasKeys && encryptedData.length >= 10) {
-    try {
-      const { ChannelCrypto } = require('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-      for (const [name, key] of Object.entries(channelKeys)) {
-        const result = ChannelCrypto.decryptGroupTextMessage(encryptedData, mac, key);
-        if (result.success && result.data) {
-          const text = result.data.sender && result.data.message
-            ? `${result.data.sender}: ${result.data.message}`
-            : result.data.message || '';
-          // Validate decrypted text is printable UTF-8 (not binary garbage)
-          if (hasNonPrintableChars(text)) {
-            return {
-              type: 'GRP_TXT', channelHash, channelHashHex, channel: name,
-              decryptionStatus: 'decryption_failed', text: null, mac, encryptedData,
-            };
-          }
-          return {
-            type: 'CHAN',
-            channel: name,
-            channelHash,
-            channelHashHex,
-            decryptionStatus: 'decrypted',
-            sender: result.data.sender || null,
-            text,
-            sender_timestamp: result.data.timestamp,
-            flags: result.data.flags,
-          };
-        }
-      }
-    } catch (e) { /* decryption failed, fall through */ }
-
-    return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'decryption_failed', mac, encryptedData };
-  }
-
-  return { type: 'GRP_TXT', channelHash, channelHashHex, decryptionStatus: 'no_key', mac, encryptedData };
-}
-
-/** ANON_REQ: dest(1) + ephemeral_pubkey(32) + MAC(2) + encrypted */
-function decodeAnonReq(buf) {
-  if (buf.length < 35) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    ephemeralPubKey: buf.subarray(1, 33).toString('hex'),
-    mac: buf.subarray(33, 35).toString('hex'),
-    encryptedData: buf.subarray(35).toString('hex'),
-  };
-}
-
-/** PATH: dest(1) + src(1) + MAC(2) + path_data */
-function decodePath_payload(buf) {
-  if (buf.length < 4) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    destHash: buf.subarray(0, 1).toString('hex'),
-    srcHash: buf.subarray(1, 2).toString('hex'),
-    mac: buf.subarray(2, 4).toString('hex'),
-    pathData: buf.subarray(4).toString('hex'),
-  };
-}
-
-/** TRACE: tag(4) + authCode(4) + flags(1) + pathData (per Mesh.cpp onRecvPacket TRACE) */
-function decodeTrace(buf) {
-  if (buf.length < 9) return { error: 'too short', raw: buf.toString('hex') };
-  return {
-    tag: buf.readUInt32LE(0),
-    authCode: buf.subarray(4, 8).toString('hex'),
-    flags: buf[8],
-    pathData: buf.subarray(9).toString('hex'),
-  };
-}
-
-// Dispatcher
-function decodePayload(type, buf, channelKeys) {
-  switch (type) {
-    case 0x00: return { type: 'REQ', ...decodeEncryptedPayload(buf) };
-    case 0x01: return { type: 'RESPONSE', ...decodeEncryptedPayload(buf) };
-    case 0x02: return { type: 'TXT_MSG', ...decodeEncryptedPayload(buf) };
-    case 0x03: return { type: 'ACK', ...decodeAck(buf) };
-    case 0x04: return { type: 'ADVERT', ...decodeAdvert(buf) };
-    case 0x05: return { type: 'GRP_TXT', ...decodeGrpTxt(buf, channelKeys) };
-    case 0x07: return { type: 'ANON_REQ', ...decodeAnonReq(buf) };
-    case 0x08: return { type: 'PATH', ...decodePath_payload(buf) };
-    case 0x09: return { type: 'TRACE', ...decodeTrace(buf) };
-    default:   return { type: 'UNKNOWN', raw: buf.toString('hex') };
-  }
-}
-
-// --- Main decoder ---
-
-function decodePacket(hexString, channelKeys) {
-  const hex = hexString.replace(/\s+/g, '');
-  const buf = Buffer.from(hex, 'hex');
-
-  if (buf.length < 2) throw new Error('Packet too short (need at least header + pathLength)');
-
-  const header = decodeHeader(buf[0]);
-  let offset = 1;
-
-  // Transport codes for TRANSPORT_FLOOD / TRANSPORT_DIRECT — BEFORE path_length per spec
-  let transportCodes = null;
-  if (TRANSPORT_ROUTES.has(header.routeType)) {
-    if (buf.length < offset + 4) throw new Error('Packet too short for transport codes');
-    transportCodes = {
-      code1: buf.subarray(offset, offset + 2).toString('hex').toUpperCase(),
-      code2: buf.subarray(offset + 2, offset + 4).toString('hex').toUpperCase(),
-    };
-    offset += 4;
-  }
-
-  // Path length byte — AFTER transport codes per spec
-  const pathByte = buf[offset++];
-
-  // Path
-  const path = decodePath(pathByte, buf, offset);
-  offset += path.bytesConsumed;
-
-  // Payload (rest of buffer)
-  const payloadBuf = buf.subarray(offset);
-  const payload = decodePayload(header.payloadType, payloadBuf, channelKeys);
-
-  return {
-    header: {
-      routeType: header.routeType,
-      routeTypeName: header.routeTypeName,
-      payloadType: header.payloadType,
-      payloadTypeName: header.payloadTypeName,
-      payloadVersion: header.payloadVersion,
-    },
-    transportCodes,
-    path: {
-      hashSize: path.hashSize,
-      hashCount: path.hashCount,
-      hops: path.hops,
-      truncated: path.truncated,
-    },
-    payload,
-    raw: hex.toUpperCase(),
-  };
-}
-
-// --- ADVERT validation ---
-
-const VALID_ROLES = new Set(['repeater', 'companion', 'room', 'sensor']);
-
-/**
- * Validate decoded ADVERT data before upserting into the DB.
- * Returns { valid: true } or { valid: false, reason: string }.
- */
-function validateAdvert(advert) {
-  if (!advert || advert.error) return { valid: false, reason: advert?.error || 'null advert' };
-
-  // pubkey must be at least 16 hex chars (8 bytes) and not all zeros
-  const pk = advert.pubKey || '';
-  if (pk.length < 16) return { valid: false, reason: `pubkey too short (${pk.length} hex chars)` };
-  if (/^0+$/.test(pk)) return { valid: false, reason: 'pubkey is all zeros' };
-
-  // lat/lon must be in valid ranges if present
-  if (advert.lat != null) {
-    if (!Number.isFinite(advert.lat) || advert.lat < -90 || advert.lat > 90) {
-      return { valid: false, reason: `invalid lat: ${advert.lat}` };
-    }
-  }
-  if (advert.lon != null) {
-    if (!Number.isFinite(advert.lon) || advert.lon < -180 || advert.lon > 180) {
-      return { valid: false, reason: `invalid lon: ${advert.lon}` };
-    }
-  }
-
-  // name must not contain control chars (except space) or be garbage
-  if (advert.name != null) {
-    // eslint-disable-next-line no-control-regex
-    if (/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/.test(advert.name)) {
-      return { valid: false, reason: 'name contains control characters' };
-    }
-    // Reject names that are mostly non-printable or suspiciously long
-    if (advert.name.length > 64) {
-      return { valid: false, reason: `name too long (${advert.name.length} chars)` };
-    }
-  }
-
-  // role derivation check — flags byte should produce a known role
-  if (advert.flags) {
-    const role = advert.flags.repeater ? 'repeater' : advert.flags.room ? 'room' : advert.flags.sensor ? 'sensor' : 'companion';
-    if (!VALID_ROLES.has(role)) return { valid: false, reason: `unknown role: ${role}` };
-  }
-
-  // timestamp: decoded but not currently used for node storage — skip validation
-
-  return { valid: true };
-}
-
-module.exports = { decodePacket, validateAdvert, hasNonPrintableChars, ROUTE_TYPES, PAYLOAD_TYPES, VALID_ROLES };
-
-// --- Tests ---
-if (require.main === module) {
-  console.log('=== Test 1: ADVERT, FLOOD, 5 hops (2-byte hashes), "Kpa Roof Solar" ===');
-  const pkt1 = decodePacket(
-    '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
-  );
-  console.log(JSON.stringify(pkt1, null, 2));
-  console.log();
-
-  // Assertions
-  const assert = (cond, msg) => { if (!cond) throw new Error('ASSERT FAILED: ' + msg); };
-  assert(pkt1.header.routeTypeName === 'FLOOD', 'route should be FLOOD');
-  assert(pkt1.header.payloadTypeName === 'ADVERT', 'payload should be ADVERT');
-  assert(pkt1.path.hashSize === 2, 'hashSize should be 2');
-  assert(pkt1.path.hashCount === 5, 'hashCount should be 5');
-  assert(pkt1.path.hops[0] === '1000', 'first hop should be 1000');
-  assert(pkt1.path.hops[1] === 'D818', 'second hop should be D818');
-  assert(pkt1.transportCodes === null, 'FLOOD has no transport codes');
-  assert(pkt1.payload.name === 'Kpa Roof Solar', 'name should be "Kpa Roof Solar"');
-  console.log('✅ Test 1 passed\n');
-
-  console.log('=== Test 2: ADVERT, FLOOD, 0 hops (zero-path) ===');
-  // Build a minimal advert: header=0x11 (FLOOD+ADVERT), pathLen=0x00 (1-byte hashes, 0 hops)
-  // Then a minimal advert payload: 32-byte pubkey + 4-byte ts + 64-byte sig + flags(1)
-  const fakePubKey = '00'.repeat(32);
-  const fakeTs = '78563412'; // LE = 0x12345678
-  const fakeSig = 'AA'.repeat(64);
-  const flags = '00'; // no location, no name
-  const pkt2hex = '1100' + fakePubKey + fakeTs + fakeSig + flags;
-  const pkt2 = decodePacket(pkt2hex);
-  console.log(JSON.stringify(pkt2, null, 2));
-  console.log();
-
-  assert(pkt2.header.routeTypeName === 'FLOOD', 'route should be FLOOD');
-  assert(pkt2.header.payloadTypeName === 'ADVERT', 'payload should be ADVERT');
-  assert(pkt2.path.hashSize === 1, 'hashSize should be 1');
-  assert(pkt2.path.hashCount === 0, 'hashCount should be 0');
-  assert(pkt2.path.hops.length === 0, 'no hops');
-  assert(pkt2.payload.timestamp === 0x12345678, 'timestamp');
-  console.log('✅ Test 2 passed\n');
-
-  console.log('All tests passed ✅');
-}

docker-compose.staging.yml

@@ -0,0 +1,42 @@
+# Staging-only compose file. Production is managed by docker-compose.yml.
+# Override defaults via .env or environment variables.
+
+services:
+  staging-go:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      args:
+        APP_VERSION: ${APP_VERSION:-unknown}
+        GIT_COMMIT: ${GIT_COMMIT:-unknown}
+        BUILD_TIME: ${BUILD_TIME:-unknown}
+    image: corescope-go:latest
+    container_name: corescope-staging-go
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          memory: 3g
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    ports:
+      - "${STAGING_GO_HTTP_PORT:-82}:80"
+      - "${STAGING_GO_MQTT_PORT:-1885}:1883"
+      - "6060:6060"   # pprof server
+      - "6061:6061"   # pprof ingestor
+    volumes:
+      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}:/app/data
+      - caddy-data-staging-go:/data/caddy
+    environment:
+      - NODE_ENV=staging
+      - ENABLE_PPROF=true
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
+      interval: 30s
+      timeout: 10s
+      retries: 5
+      start_period: 60s
+
+volumes:
+  # Named volume for Caddy TLS certificates (not user data — managed by Caddy internally)
+  caddy-data-staging-go:

docker-compose.yml

@@ -1,92 +1,37 @@
-# All container config lives here. manage.sh is just a wrapper around docker compose.
-# Override defaults via .env or environment variables.
-# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
-# This ensures the DB and theme are visible on the host filesystem for backup.
-
-services:
-  prod:
-    build: .
-    image: corescope:latest
-    container_name: corescope-prod
-    restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "${PROD_HTTP_PORT:-80}:${PROD_HTTP_PORT:-80}"
-      - "${PROD_HTTPS_PORT:-443}:${PROD_HTTPS_PORT:-443}"
-      - "${PROD_MQTT_PORT:-1883}:1883"
-    volumes:
-      - ./config.json:/app/config.json:ro
-      - ./caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro
-      - ${PROD_DATA_DIR:-~/meshcore-data}:/app/data
-      - caddy-data:/data/caddy
-    environment:
-      - NODE_ENV=production
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-
-  staging:
-    build: .
-    image: corescope:latest
-    container_name: corescope-staging
-    restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "${STAGING_HTTP_PORT:-81}:${STAGING_HTTP_PORT:-81}"
-      - "${STAGING_MQTT_PORT:-1884}:1883"
-    volumes:
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/config.json:/app/config.json:ro
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/Caddyfile:/etc/caddy/Caddyfile:ro
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}:/app/data
-      - caddy-data-staging:/data/caddy
-    environment:
-      - NODE_ENV=staging
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    profiles:
-      - staging
-
-  staging-go:
-    build:
-      context: .
-      dockerfile: Dockerfile
-      args:
-        APP_VERSION: ${APP_VERSION:-unknown}
-        GIT_COMMIT: ${GIT_COMMIT:-unknown}
-    image: corescope-go:latest
-    container_name: corescope-staging-go
-    restart: unless-stopped
-    extra_hosts:
-      - "host.docker.internal:host-gateway"
-    ports:
-      - "${STAGING_GO_HTTP_PORT:-82}:80"
-      - "${STAGING_GO_MQTT_PORT:-1885}:1883"
-      - "6060:6060"   # pprof server
-      - "6061:6061"   # pprof ingestor
-    volumes:
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}/config.json:/app/config.json:ro
-      - ${STAGING_DATA_DIR:-~/meshcore-staging-data}:/app/data
-      - caddy-data-staging-go:/data/caddy
-    environment:
-      - NODE_ENV=staging
-      - ENABLE_PPROF=true
-    healthcheck:
-      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    profiles:
-      - staging-go
-
-volumes:
-  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
-  caddy-data:
-  caddy-data-staging:
-  caddy-data-staging-go:
+# All container config lives here. manage.sh is just a wrapper around docker compose.
+# Override defaults via .env or environment variables.
+# CRITICAL: All data mounts use bind mounts (~/path), NOT named volumes.
+# This ensures the DB and theme are visible on the host filesystem for backup.
+
+services:
+  prod:
+    build:
+      context: .
+      args:
+        APP_VERSION: ${APP_VERSION:-unknown}
+        GIT_COMMIT: ${GIT_COMMIT:-unknown}
+        BUILD_TIME: ${BUILD_TIME:-unknown}
+    image: corescope:latest
+    container_name: corescope-prod
+    restart: unless-stopped
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    ports:
+      - "${PROD_HTTP_PORT:-80}:80"
+      - "${PROD_HTTPS_PORT:-443}:443"
+      - "${PROD_MQTT_PORT:-1883}:1883"
+    volumes:
+      - ./caddy-config/Caddyfile:/etc/caddy/Caddyfile:ro
+      - ${PROD_DATA_DIR:-~/meshcore-data}:/app/data
+      - caddy-data:/data/caddy
+    environment:
+      - NODE_ENV=production
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:3000/api/stats"]
+      interval: 30s
+      timeout: 5s
+      retries: 3
+
+volumes:
+  # Named volumes for Caddy TLS certificates (not user data — managed by Caddy internally)
+  caddy-data:

docker/entrypoint-go.sh

@@ -1,9 +1,12 @@
 #!/bin/sh
 
-# Copy example config if no config.json exists (not bind-mounted)
-if [ ! -f /app/config.json ]; then
-  echo "[entrypoint] No config.json found, copying from config.example.json"
-  cp /app/config.example.json /app/config.json
+# Config lives in the data directory (bind-mounted from host)
+# The Go server already searches /app/data/config.json via LoadConfig
+# but the ingestor expects a direct path — symlink for compatibility
+if [ -f /app/data/config.json ]; then
+  ln -sf /app/data/config.json /app/config.json
+elif [ ! -f /app/config.json ]; then
+  echo "[entrypoint] No config.json found in /app/data/ — using built-in defaults"
 fi
 
 # theme.json: check data/ volume (admin-editable on host)

docker/supervisord-go.conf

@@ -19,6 +19,8 @@ command=/app/corescope-ingestor -config /app/config.json
 directory=/app
 autostart=true
 autorestart=true
+startretries=10
+startsecs=2
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
@@ -29,6 +31,8 @@ command=/app/corescope-server -config-dir /app -db /app/data/meshcore.db -public
 directory=/app
 autostart=true
 autorestart=true
+startretries=10
+startsecs=2
 stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr

docker/supervisord.conf

@@ -15,7 +15,7 @@ stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
 
 [program:corescope]
-command=node /app/server.js
+command=/app/corescope-server
 directory=/app
 autostart=true
 autorestart=true

iata-coords.js

@@ -1,90 +0,0 @@
-// IATA airport coordinates for regional node filtering
-// Used by resolve-hops to determine if a node is geographically near an observer's region
-const IATA_COORDS = {
-  // US West Coast
-  SJC: { lat: 37.3626, lon: -121.9290 },
-  SFO: { lat: 37.6213, lon: -122.3790 },
-  OAK: { lat: 37.7213, lon: -122.2208 },
-  SEA: { lat: 47.4502, lon: -122.3088 },
-  PDX: { lat: 45.5898, lon: -122.5951 },
-  LAX: { lat: 33.9425, lon: -118.4081 },
-  SAN: { lat: 32.7338, lon: -117.1933 },
-  SMF: { lat: 38.6954, lon: -121.5908 },
-  MRY: { lat: 36.5870, lon: -121.8430 },
-  EUG: { lat: 44.1246, lon: -123.2119 },
-  RDD: { lat: 40.5090, lon: -122.2934 },
-  MFR: { lat: 42.3742, lon: -122.8735 },
-  FAT: { lat: 36.7762, lon: -119.7181 },
-  SBA: { lat: 34.4262, lon: -119.8405 },
-  RNO: { lat: 39.4991, lon: -119.7681 },
-  BOI: { lat: 43.5644, lon: -116.2228 },
-  LAS: { lat: 36.0840, lon: -115.1537 },
-  PHX: { lat: 33.4373, lon: -112.0078 },
-  SLC: { lat: 40.7884, lon: -111.9778 },
-  // US Mountain/Central
-  DEN: { lat: 39.8561, lon: -104.6737 },
-  DFW: { lat: 32.8998, lon: -97.0403 },
-  IAH: { lat: 29.9844, lon: -95.3414 },
-  AUS: { lat: 30.1975, lon: -97.6664 },
-  MSP: { lat: 44.8848, lon: -93.2223 },
-  // US East Coast
-  ATL: { lat: 33.6407, lon: -84.4277 },
-  ORD: { lat: 41.9742, lon: -87.9073 },
-  JFK: { lat: 40.6413, lon: -73.7781 },
-  EWR: { lat: 40.6895, lon: -74.1745 },
-  BOS: { lat: 42.3656, lon: -71.0096 },
-  MIA: { lat: 25.7959, lon: -80.2870 },
-  IAD: { lat: 38.9531, lon: -77.4565 },
-  CLT: { lat: 35.2144, lon: -80.9473 },
-  DTW: { lat: 42.2124, lon: -83.3534 },
-  MCO: { lat: 28.4312, lon: -81.3081 },
-  BNA: { lat: 36.1263, lon: -86.6774 },
-  RDU: { lat: 35.8801, lon: -78.7880 },
-  // Canada
-  YVR: { lat: 49.1967, lon: -123.1815 },
-  YYZ: { lat: 43.6777, lon: -79.6248 },
-  YYC: { lat: 51.1215, lon: -114.0076 },
-  YEG: { lat: 53.3097, lon: -113.5800 },
-  YOW: { lat: 45.3225, lon: -75.6692 },
-  // Europe
-  LHR: { lat: 51.4700, lon: -0.4543 },
-  CDG: { lat: 49.0097, lon: 2.5479 },
-  FRA: { lat: 50.0379, lon: 8.5622 },
-  AMS: { lat: 52.3105, lon: 4.7683 },
-  MUC: { lat: 48.3537, lon: 11.7750 },
-  SOF: { lat: 42.6952, lon: 23.4062 },
-  // Asia/Pacific
-  NRT: { lat: 35.7720, lon: 140.3929 },
-  HND: { lat: 35.5494, lon: 139.7798 },
-  ICN: { lat: 37.4602, lon: 126.4407 },
-  SYD: { lat: -33.9461, lon: 151.1772 },
-  MEL: { lat: -37.6690, lon: 144.8410 },
-};
-
-// Haversine distance in km
-function haversineKm(lat1, lon1, lat2, lon2) {
-  const R = 6371;
-  const dLat = (lat2 - lat1) * Math.PI / 180;
-  const dLon = (lon2 - lon1) * Math.PI / 180;
-  const a = Math.sin(dLat / 2) ** 2 +
-    Math.cos(lat1 * Math.PI / 180) * Math.cos(lat2 * Math.PI / 180) *
-    Math.sin(dLon / 2) ** 2;
-  return R * 2 * Math.atan2(Math.sqrt(a), Math.sqrt(1 - a));
-}
-
-// Default radius for "near region" — LoRa max realistic range ~300km
-const DEFAULT_REGION_RADIUS_KM = 300;
-
-/**
- * Check if a node is geographically within radius of an IATA region center.
- * Returns { near: boolean, distKm: number } or null if can't determine.
- */
-function nodeNearRegion(nodeLat, nodeLon, iata, radiusKm = DEFAULT_REGION_RADIUS_KM) {
-  const center = IATA_COORDS[iata];
-  if (!center) return null;
-  if (nodeLat == null || nodeLon == null || (nodeLat === 0 && nodeLon === 0)) return null;
-  const distKm = haversineKm(nodeLat, nodeLon, center.lat, center.lon);
-  return { near: distKm <= radiusKm, distKm: Math.round(distKm) };
-}
-
-module.exports = { IATA_COORDS, haversineKm, nodeNearRegion, DEFAULT_REGION_RADIUS_KM };

manage.sh

@@ -13,11 +13,32 @@ IMAGE_NAME="corescope"
 STATE_FILE=".setup-state"
 
 # Source .env for port/path overrides (same file docker compose reads)
-[ -f .env ] && set -a && . ./.env && set +a
+# Strip \r (Windows line endings) to avoid "$'\r': command not found"
+if [ -f .env ]; then
+  set -a
+  eval "$(sed 's/\r$//' .env)"
+  set +a
+fi
 
 # Resolved paths for prod/staging data (must match docker-compose.yml)
 PROD_DATA="${PROD_DATA_DIR:-$HOME/meshcore-data}"
 STAGING_DATA="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}"
+STAGING_COMPOSE_FILE="docker-compose.staging.yml"
+
+# Build metadata — exported so docker compose build picks them up via args
+export APP_VERSION=$(node -p "require('./package.json').version" 2>/dev/null || echo "unknown")
+export GIT_COMMIT=$(git rev-parse --short HEAD 2>/dev/null || echo "unknown")
+export BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+
+# Docker Compose — detect v2 plugin vs v1 standalone
+if docker compose version &>/dev/null 2>&1; then
+  DC="docker compose"
+elif command -v docker-compose &>/dev/null; then
+  DC="docker-compose"
+else
+  echo "ERROR: Neither '$DC' nor 'docker-compose' found." >&2
+  exit 1
+fi
 
 # Colors
 RED='\033[0;31m'
@@ -47,10 +68,11 @@ is_done()    { [ -f "$STATE_FILE" ] && grep -qx "$1" "$STATE_FILE" 2>/dev/null;
 
 # Check config.json for placeholder values
 check_config_placeholders() {
-  if [ -f config.json ]; then
-    if grep -qE 'your-username|your-password|your-secret|example\.com|changeme' config.json 2>/dev/null; then
+  local cfg="${1:-$PROD_DATA/config.json}"
+  if [ -f "$cfg" ]; then
+    if grep -qE 'your-username|your-password|your-secret|example\.com|changeme' "$cfg" 2>/dev/null; then
       warn "config.json contains placeholder values."
-      warn "Edit config.json and replace placeholder values before deploying."
+      warn "Edit ${cfg} and replace placeholder values before deploying."
     fi
   fi
 }
@@ -151,31 +173,34 @@ cmd_setup() {
   fi
 
   log "Docker $(docker --version | grep -oP 'version \K[^ ,]+')"
-  
-  # Check docker compose (separate check since it's a plugin/separate binary)
-  if ! docker compose version &>/dev/null; then
-    err "docker compose is required. Install Docker Desktop or docker-compose-plugin."
-    exit 1
-  fi
+  log "Compose: $DC"
   
   mark_done "docker"
 
   # ── Step 2: Config ──
   step 2 "Configuration"
 
-  if [ -f config.json ]; then
-    log "config.json already exists (not overwriting)."
+  if [ -f "$PROD_DATA/config.json" ]; then
+    log "config.json found in data directory."
     # Sanity check the JSON
-    if ! python3 -c "import json; json.load(open('config.json'))" 2>/dev/null && \
-       ! node -e "JSON.parse(require('fs').readFileSync('config.json'))" 2>/dev/null; then
+    if ! python3 -c "import json; json.load(open('$PROD_DATA/config.json'))" 2>/dev/null && \
+       ! node -e "JSON.parse(require('fs').readFileSync('$PROD_DATA/config.json'))" 2>/dev/null; then
       err "config.json has invalid JSON. Fix it and re-run setup."
       exit 1
     fi
     log "config.json is valid JSON."
-    check_config_placeholders
+    check_config_placeholders "$PROD_DATA/config.json"
+  elif [ -f config.json ]; then
+    # Legacy: config in repo root — move it to data dir
+    info "Found config.json in repo root — moving to data directory..."
+    mkdir -p "$PROD_DATA"
+    cp config.json "$PROD_DATA/config.json"
+    log "Config moved to ${PROD_DATA}/config.json"
+    check_config_placeholders "$PROD_DATA/config.json"
   else
-    info "Creating config.json from example..."
-    cp config.example.json config.json
+    info "Creating config.json in data directory from example..."
+    mkdir -p "$PROD_DATA"
+    cp config.example.json "$PROD_DATA/config.json"
 
     # Generate a random API key
     if command -v openssl &> /dev/null; then
@@ -185,14 +210,14 @@ cmd_setup() {
     fi
     # Replace the placeholder API key
     if command -v sed &> /dev/null; then
-      sed -i "s/your-secret-api-key-here/${API_KEY}/" config.json
+      sed -i "s/your-secret-api-key-here/${API_KEY}/" "$PROD_DATA/config.json"
     fi
 
     log "Created config.json with random API key."
-    check_config_placeholders
+    check_config_placeholders "$PROD_DATA/config.json"
     echo ""
-    echo "   You can customize config.json later (map center, branding, etc)."
-    echo "   Edit with: nano config.json"
+    echo "   Config saved to: ${PROD_DATA}/config.json"
+    echo "   Edit with: nano ${PROD_DATA}/config.json"
     echo ""
   fi
   mark_done "config"
@@ -295,12 +320,12 @@ cmd_setup() {
   if [ -n "$IMAGE_EXISTS" ] && is_done "build"; then
     log "Image already built."
     if confirm "Rebuild? (only needed if you updated the code)"; then
-      docker compose build prod
+      $DC build prod
       log "Image rebuilt."
     fi
   else
     info "This takes 1-2 minutes the first time..."
-    docker compose build prod
+    $DC build prod
     log "Image built."
   fi
   mark_done "build"
@@ -317,7 +342,7 @@ cmd_setup() {
     log "Container already running."
   else
     mkdir -p "$PROD_DATA"
-    docker compose up -d prod
+    $DC up -d prod
     log "Container started."
   fi
   mark_done "container"
@@ -357,7 +382,7 @@ cmd_setup() {
     err "Container failed to start."
     echo ""
     echo "   Check what went wrong:"
-    echo "     docker compose logs prod"
+    echo "     $DC logs prod"
     echo ""
     echo "   Common fixes:"
     echo "     • Invalid config.json — check JSON syntax"
@@ -388,8 +413,13 @@ prepare_staging_db() {
 prepare_staging_config() {
   local prod_config="$PROD_DATA/config.json"
   local staging_config="$STAGING_DATA/config.json"
+  mkdir -p "$STAGING_DATA"
+
+  # Docker may have created config.json as a directory
+  [ -d "$staging_config" ] && rmdir "$staging_config" 2>/dev/null || true
+
   if [ ! -f "$prod_config" ]; then
-    warn "No config.json found at ${prod_config} — staging may not start correctly."
+    warn "No production config at ${prod_config} — staging may use defaults."
     return
   fi
   if [ ! -f "$staging_config" ] || [ "$prod_config" -nt "$staging_config" ]; then
@@ -423,25 +453,85 @@ container_health() {
 
 # ─── Start / Stop / Restart ──────────────────────────────────────────────
 
+# Ensure config.json exists in the data directory before starting
+ensure_config() {
+  local data_dir="$1"
+  local config="$data_dir/config.json"
+  mkdir -p "$data_dir"
+
+  # Docker may have created config.json as a directory from a prior failed mount
+  [ -d "$config" ] && rmdir "$config" 2>/dev/null || true
+
+  if [ -f "$config" ]; then
+    return 0
+  fi
+
+  # Try to copy from repo root (legacy location)
+  if [ -f ./config.json ]; then
+    info "No config in data directory — copying from ./config.json"
+    cp ./config.json "$config"
+    return 0
+  fi
+
+  # Prompt admin
+  echo ""
+  warn "No config.json found in ${data_dir}/"
+  echo ""
+  echo "   CoreScope needs a config.json to connect to MQTT brokers."
+  echo ""
+  echo "   Options:"
+  echo "     1) Create from example (you'll edit MQTT settings after)"
+  echo "     2) I'll put one there myself (abort for now)"
+  echo ""
+  read -p "   Choose [1/2]: " -n 1 -r
+  echo ""
+
+  case $REPLY in
+    1)
+      cp config.example.json "$config"
+      # Generate a random API key
+      if command -v openssl &>/dev/null; then
+        API_KEY=$(openssl rand -hex 16)
+      else
+        API_KEY=$(head -c 32 /dev/urandom | xxd -p | head -c 32)
+      fi
+      sed -i "s/your-secret-api-key-here/${API_KEY}/" "$config" 2>/dev/null || true
+      log "Created ${config} from example with random API key."
+      warn "Edit MQTT settings before connecting observers:"
+      echo "     nano ${config}"
+      echo ""
+      ;;
+    *)
+      echo "   Place your config.json at: ${config}"
+      echo "   Then run this command again."
+      exit 0
+      ;;
+  esac
+}
+
 cmd_start() {
   local WITH_STAGING=false
   if [ "$1" = "--with-staging" ]; then
     WITH_STAGING=true
   fi
 
+  # Always check prod config
+  ensure_config "$PROD_DATA"
+
   if $WITH_STAGING; then
     # Prepare staging data and config
     prepare_staging_db
     prepare_staging_config
 
     info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    info "Starting staging container (corescope-staging) on port ${STAGING_HTTP_PORT:-81}..."
-    docker compose --profile staging up -d
+    info "Starting staging container (corescope-staging-go) on port ${STAGING_GO_HTTP_PORT:-82}..."
+    $DC up -d prod
+    $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
     log "Production started on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}/${PROD_MQTT_PORT:-1883}"
-    log "Staging started on port ${STAGING_HTTP_PORT:-81} (MQTT: ${STAGING_MQTT_PORT:-1884})"
+    log "Staging started on port ${STAGING_GO_HTTP_PORT:-82} (MQTT: ${STAGING_GO_MQTT_PORT:-1885})"
   else
     info "Starting production container (corescope-prod) on ports ${PROD_HTTP_PORT:-80}/${PROD_HTTPS_PORT:-443}..."
-    docker compose up -d prod
+    $DC up -d prod
     log "Production started. Staging NOT running (use --with-staging to start both)."
   fi
 }
@@ -452,17 +542,20 @@ cmd_stop() {
   case "$TARGET" in
     prod)
       info "Stopping production container (corescope-prod)..."
-      docker compose stop prod
+      $DC stop prod
       log "Production stopped."
       ;;
     staging)
-      info "Stopping staging container (corescope-staging)..."
-      docker compose --profile staging stop staging
-      log "Staging stopped."
+      info "Stopping staging container (corescope-staging-go)..."
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go meshcore-staging-go corescope-staging meshcore-staging 2>/dev/null || true
+      log "Staging stopped and cleaned up."
       ;;
     all)
       info "Stopping all containers..."
-      docker compose --profile staging --profile staging-go down
+      $DC stop prod
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go meshcore-staging-go corescope-staging meshcore-staging 2>/dev/null || true
       log "All containers stopped."
       ;;
     *)
@@ -477,17 +570,38 @@ cmd_restart() {
   case "$TARGET" in
     prod)
       info "Restarting production container (corescope-prod)..."
-      docker compose up -d --force-recreate prod
+      $DC up -d --force-recreate prod
       log "Production restarted."
       ;;
     staging)
-      info "Restarting staging container (corescope-staging)..."
-      docker compose --profile staging up -d --force-recreate staging
+      info "Restarting staging container (corescope-staging-go)..."
+      # Stop and remove old container
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go 2>/dev/null || true
+      # Wait for container to be fully gone and memory to be reclaimed
+      # This prevents OOM when old + new containers overlap on small VMs
+      for i in $(seq 1 15); do
+        if ! docker ps -a --format '{{.Names}}' | grep -q 'corescope-staging-go'; then
+          break
+        fi
+        sleep 1
+      done
+      sleep 3  # extra pause for OS to reclaim memory
+      # Verify config exists before starting
+      local staging_config="${STAGING_DATA_DIR:-$HOME/meshcore-staging-data}/config.json"
+      if [ ! -f "$staging_config" ]; then
+        warn "Staging config not found at $staging_config — creating from prod config..."
+        prepare_staging_config
+      fi
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
       log "Staging restarted."
       ;;
     all)
       info "Restarting all containers..."
-      docker compose --profile staging up -d --force-recreate
+      $DC up -d --force-recreate prod
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging rm -sf staging-go 2>/dev/null || true
+      docker rm -f corescope-staging-go 2>/dev/null || true
+      $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging up -d staging-go
       log "All containers restarted."
       ;;
     *)
@@ -539,10 +653,10 @@ cmd_status() {
   echo ""
 
   # Staging
-  if container_running "corescope-staging"; then
-    show_container_status "corescope-staging" "Staging"
+  if container_running "corescope-staging-go"; then
+    show_container_status "corescope-staging-go" "Staging"
   else
-    info "Staging (corescope-staging): Not running (use --with-staging to start both)"
+    info "Staging (corescope-staging-go): Not running (use --with-staging to start both)"
   fi
   echo ""
 
@@ -569,12 +683,12 @@ cmd_logs() {
   case "$TARGET" in
     prod)
       info "Tailing production logs..."
-      docker compose logs -f --tail="$LINES" prod
+      $DC logs -f --tail="$LINES" prod
       ;;
     staging)
       if container_running "corescope-staging"; then
         info "Tailing staging logs..."
-        docker compose logs -f --tail="$LINES" staging
+        $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging logs -f --tail="$LINES" staging-go
       else
         err "Staging container is not running."
         info "Start with: ./manage.sh start --with-staging"
@@ -602,7 +716,7 @@ cmd_promote() {
 
   # Show what's currently running
   local staging_image staging_created prod_image prod_created
-  staging_image=$(docker inspect corescope-staging --format '{{.Config.Image}}' 2>/dev/null || echo "not running")
+  staging_image=$(docker inspect corescope-staging-go --format '{{.Config.Image}}' 2>/dev/null || echo "not running")
   staging_created=$(docker inspect corescope-staging --format '{{.Created}}' 2>/dev/null || echo "N/A")
   prod_image=$(docker inspect corescope-prod --format '{{.Config.Image}}' 2>/dev/null || echo "not running")
   prod_created=$(docker inspect corescope-prod --format '{{.Created}}' 2>/dev/null || echo "N/A")
@@ -631,7 +745,7 @@ cmd_promote() {
 
   # Restart prod with latest image
   info "Restarting production with latest image..."
-  docker compose up -d --force-recreate prod
+  $DC up -d --force-recreate prod
 
   # Wait for health
   info "Waiting for production health check..."
@@ -662,13 +776,13 @@ cmd_promote() {
 
 cmd_update() {
   info "Pulling latest code..."
-  git pull
+  git pull --ff-only
 
   info "Rebuilding image..."
-  docker compose build prod
+  $DC build prod
 
   info "Restarting with new image..."
-  docker compose up -d --force-recreate prod
+  $DC up -d --force-recreate prod
 
   log "Updated and restarted. Data preserved."
 }
@@ -695,10 +809,13 @@ cmd_backup() {
     warn "Database not found (container not running?)"
   fi
 
-  # Config
-  if [ -f config.json ]; then
-    cp config.json "$BACKUP_DIR/config.json"
+  # Config (now lives in data dir)
+  if [ -f "$PROD_DATA/config.json" ]; then
+    cp "$PROD_DATA/config.json" "$BACKUP_DIR/config.json"
     log "config.json"
+  elif [ -f config.json ]; then
+    cp config.json "$BACKUP_DIR/config.json"
+    log "config.json (legacy repo root)"
   fi
 
   # Caddyfile
@@ -782,7 +899,7 @@ cmd_restore() {
   info "Backing up current state..."
   cmd_backup "./backups/corescope-pre-restore-$(date +%Y%m%d-%H%M%S)"
 
-  docker compose stop prod 2>/dev/null || true
+  $DC stop prod 2>/dev/null || true
 
   # Restore database
   mkdir -p "$PROD_DATA"
@@ -792,8 +909,8 @@ cmd_restore() {
 
   # Restore config if present
   if [ -n "$CONFIG_FILE" ] && [ -f "$CONFIG_FILE" ]; then
-    cp "$CONFIG_FILE" ./config.json
-    log "config.json restored"
+    cp "$CONFIG_FILE" "$PROD_DATA/config.json"
+    log "config.json restored to ${PROD_DATA}/"
   fi
 
   # Restore Caddyfile if present
@@ -810,7 +927,7 @@ cmd_restore() {
     log "theme.json restored"
   fi
 
-  docker compose up -d prod
+  $DC up -d prod
   log "Restored and restarted."
 }
 
@@ -848,7 +965,8 @@ cmd_reset() {
     exit 0
   fi
 
-  docker compose --profile staging --profile staging-go down --rmi local 2>/dev/null || true
+  $DC down --rmi local 2>/dev/null || true
+  $DC -f "$STAGING_COMPOSE_FILE" -p corescope-staging down --rmi local 2>/dev/null || true
   rm -f "$STATE_FILE"
 
   log "Reset complete. Run './manage.sh setup' to start over."
@@ -869,7 +987,7 @@ cmd_help() {
   echo ""
   printf '%b\n' "  ${BOLD}Run${NC}"
   echo "    start              Start production container"
-  echo "    start --with-staging  Start production + staging (copies prod DB + config)"
+  echo "    start --with-staging  Start production + staging-go (copies prod DB + config)"
   echo "    stop [prod|staging|all]  Stop specific or all containers (default: all)"
   echo "    restart [prod|staging|all]  Restart specific or all containers"
   echo "    status             Show health, stats, and service status"
@@ -882,7 +1000,7 @@ cmd_help() {
   echo "    restore <d>        Restore from backup dir or .db file"
   echo "    mqtt-test          Check if MQTT data is flowing"
   echo ""
-  echo "All commands use docker compose with docker-compose.yml."
+  echo "Prod uses docker-compose.yml; staging uses ${STAGING_COMPOSE_FILE}."
   echo ""
 }
 

package.json

@@ -5,7 +5,7 @@
   "main": "index.js",
   "scripts": {
     "test": "npx c8 --reporter=text --reporter=text-summary sh test-all.sh",
-    "test:unit": "node test-packet-filter.js && node test-aging.js && node test-regional-filter.js",
+    "test:unit": "node test-packet-filter.js && node test-aging.js && node test-frontend-helpers.js",
     "test:coverage": "npx c8 --reporter=text --reporter=html sh test-all.sh",
     "test:full-coverage": "sh scripts/combined-coverage.sh"
   },

packet-store.js

@@ -1,752 +0,0 @@
-'use strict';
-
-/**
- * In-memory packet store — loads transmissions + observations from SQLite on startup,
- * serves reads from RAM, writes to both RAM + SQLite.
- * M3: Restructured around transmissions (deduped by hash) with observations.
- * Caps memory at configurable limit (default 1GB).
- */
-class PacketStore {
-  constructor(dbModule, config = {}) {
-    this.dbModule = dbModule;  // The full db module (has .db, .insertTransmission, .getPacket)
-    this.db = dbModule.db;     // Raw better-sqlite3 instance for queries
-    this.maxBytes = (config.maxMemoryMB || 1024) * 1024 * 1024;
-    this.estPacketBytes = config.estimatedPacketBytes || 450;
-    this.maxPackets = Math.floor(this.maxBytes / this.estPacketBytes);
-
-    // SQLite-only mode: skip RAM loading, all reads go to DB
-    this.sqliteOnly = process.env.NO_MEMORY_STORE === '1';
-
-    // Primary storage: transmissions sorted by first_seen DESC (newest first)
-    // Each transmission looks like a packet for backward compat
-    this.packets = [];
-
-    // Indexes
-    this.byId = new Map();           // observation_id → observation object (backward compat for packet detail links)
-    this.byTxId = new Map();         // transmission_id → transmission object
-    this.byHash = new Map();         // hash → transmission object (1:1)
-    this.byObserver = new Map();     // observer_id → [observation objects]
-    this.byNode = new Map();         // pubkey → [transmission objects] (deduped)
-
-    // Track which hashes are indexed per node pubkey (avoid dupes in byNode)
-    this._nodeHashIndex = new Map(); // pubkey → Set<hash>
-    this._advertByObserver = new Map(); // pubkey → Set<observer_id> (ADVERT-only, for region filtering)
-
-    this.loaded = false;
-    this.stats = { totalLoaded: 0, totalObservations: 0, evicted: 0, inserts: 0, queries: 0 };
-  }
-
-  /** Load all packets from SQLite into memory */
-  load() {
-    if (this.sqliteOnly) {
-      console.log('[PacketStore] SQLite-only mode (NO_MEMORY_STORE=1) — all reads go to database');
-      this.loaded = true;
-      return this;
-    }
-
-    const t0 = Date.now();
-
-    // Check if normalized schema exists
-    const hasTransmissions = this.db.prepare(
-      "SELECT name FROM sqlite_master WHERE type='table' AND name='transmissions'"
-    ).get();
-
-    if (hasTransmissions) {
-      this._loadNormalized();
-    } else {
-      this._loadLegacy();
-    }
-
-    this.stats.totalLoaded = this.packets.length;
-    this.loaded = true;
-    const elapsed = Date.now() - t0;
-    console.log(`[PacketStore] Loaded ${this.packets.length} transmissions (${this.stats.totalObservations} observations) in ${elapsed}ms (${Math.round(this.packets.length * this.estPacketBytes / 1024 / 1024)}MB est)`);
-    return this;
-  }
-
-  /** Load from normalized transmissions + observations tables */
-  _loadNormalized() {
-    // Detect v3 schema (observer_idx instead of observer_id in observations)
-    const obsCols = this.db.pragma('table_info(observations)').map(c => c.name);
-    const isV3 = obsCols.includes('observer_idx');
-
-    const sql = isV3
-      ? `SELECT t.id AS transmission_id, t.raw_hex, t.hash, t.first_seen, t.route_type,
-               t.payload_type, t.payload_version, t.decoded_json,
-               o.id AS observation_id, obs.id AS observer_id, obs.name AS observer_name, o.direction,
-               o.snr, o.rssi, o.score, o.path_json, datetime(o.timestamp, 'unixepoch') AS obs_timestamp
-          FROM transmissions t
-          LEFT JOIN observations o ON o.transmission_id = t.id
-          LEFT JOIN observers obs ON obs.rowid = o.observer_idx
-          ORDER BY t.first_seen DESC, o.timestamp DESC`
-      : `SELECT t.id AS transmission_id, t.raw_hex, t.hash, t.first_seen, t.route_type,
-               t.payload_type, t.payload_version, t.decoded_json,
-               o.id AS observation_id, o.observer_id, o.observer_name, o.direction,
-               o.snr, o.rssi, o.score, o.path_json, o.timestamp AS obs_timestamp
-          FROM transmissions t
-          LEFT JOIN observations o ON o.transmission_id = t.id
-          ORDER BY t.first_seen DESC, o.timestamp DESC`;
-
-    for (const row of this.db.prepare(sql).iterate()) {
-      if (this.packets.length >= this.maxPackets && !this.byHash.has(row.hash)) break;
-
-      let tx = this.byHash.get(row.hash);
-      if (!tx) {
-        tx = {
-          id: row.transmission_id,
-          raw_hex: row.raw_hex,
-          hash: row.hash,
-          first_seen: row.first_seen,
-          timestamp: row.first_seen,
-          route_type: row.route_type,
-          payload_type: row.payload_type,
-          decoded_json: row.decoded_json,
-          observations: [],
-          observation_count: 0,
-          // Filled from first observation for backward compat
-          observer_id: null,
-          observer_name: null,
-          snr: null,
-          rssi: null,
-          path_json: null,
-          direction: null,
-        };
-        this.byHash.set(row.hash, tx);
-        this.byHash.set(row.hash, tx);
-        this.packets.push(tx);
-        this.byTxId.set(tx.id, tx);
-        this._indexByNode(tx);
-      }
-
-      if (row.observation_id != null) {
-        const obs = {
-          id: row.observation_id,
-          transmission_id: tx.id,
-          hash: tx.hash,
-          observer_id: row.observer_id,
-          observer_name: row.observer_name,
-          direction: row.direction,
-          snr: row.snr,
-          rssi: row.rssi,
-          score: row.score,
-          path_json: row.path_json,
-          timestamp: row.obs_timestamp,
-        };
-
-        // Dedup: skip if same observer + same path already loaded
-        const isDupeLoad = tx.observations.some(o => o.observer_id === obs.observer_id && (o.path_json || '') === (obs.path_json || ''));
-        if (isDupeLoad) continue;
-
-        tx.observations.push(obs);
-        tx.observation_count++;
-
-        // Fill first observation data into transmission for backward compat
-        if (tx.observer_id == null && obs.observer_id) {
-          tx.observer_id = obs.observer_id;
-          tx.observer_name = obs.observer_name;
-          tx.snr = obs.snr;
-          tx.rssi = obs.rssi;
-          tx.path_json = obs.path_json;
-          tx.direction = obs.direction;
-        }
-
-        // byId maps observation IDs for packet detail links
-        this.byId.set(obs.id, obs);
-
-        // byObserver
-        if (obs.observer_id) {
-          if (!this.byObserver.has(obs.observer_id)) this.byObserver.set(obs.observer_id, []);
-          this.byObserver.get(obs.observer_id).push(obs);
-        }
-
-        this.stats.totalObservations++;
-      }
-    }
-
-    // Post-load: set each transmission's display path to the LONGEST observation path
-    // (most representative of mesh topology — short paths are just nearby observers)
-    for (const tx of this.packets) {
-      if (tx.observations.length > 0) {
-        let best = tx.observations[0];
-        let bestLen = 0;
-        try { bestLen = JSON.parse(best.path_json || '[]').length; } catch {}
-        for (let i = 1; i < tx.observations.length; i++) {
-          let len = 0;
-          try { len = JSON.parse(tx.observations[i].path_json || '[]').length; } catch {}
-          if (len > bestLen) { best = tx.observations[i]; bestLen = len; }
-        }
-        tx.observer_id = best.observer_id;
-        tx.observer_name = best.observer_name;
-        tx.snr = best.snr;
-        tx.rssi = best.rssi;
-        tx.path_json = best.path_json;
-        tx.direction = best.direction;
-      }
-    }
-
-    // Post-load: build ADVERT-by-observer index (needs all observations loaded first)
-    for (const tx of this.packets) {
-      if (tx.payload_type === 4 && tx.decoded_json) {
-        try {
-          const d = JSON.parse(tx.decoded_json);
-          if (d.pubKey) this._indexAdvertObservers(d.pubKey, tx);
-        } catch {}
-      }
-    }
-    console.log(`[PacketStore] ADVERT observer index: ${this._advertByObserver.size} nodes tracked`);
-  }
-
-  /** Fallback: load from legacy packets table */
-  _loadLegacy() {
-    for (const row of this.db.prepare(
-      'SELECT * FROM packets_v ORDER BY timestamp DESC'
-    ).iterate()) {
-      if (this.packets.length >= this.maxPackets) break;
-      this._indexLegacy(row);
-    }
-  }
-
-  /** Index a legacy packet row (old flat structure) — builds transmission + observation */
-  _indexLegacy(pkt) {
-    let tx = this.byHash.get(pkt.hash);
-    if (!tx) {
-      tx = {
-        id: pkt.id,
-        raw_hex: pkt.raw_hex,
-        hash: pkt.hash,
-        first_seen: pkt.timestamp,
-        timestamp: pkt.timestamp,
-        route_type: pkt.route_type,
-        payload_type: pkt.payload_type,
-        decoded_json: pkt.decoded_json,
-        observations: [],
-        observation_count: 0,
-        observer_id: pkt.observer_id,
-        observer_name: pkt.observer_name,
-        snr: pkt.snr,
-        rssi: pkt.rssi,
-        path_json: pkt.path_json,
-        direction: pkt.direction,
-      };
-      this.byHash.set(pkt.hash, tx);
-      this.byHash.set(pkt.hash, tx);
-      this.packets.push(tx);
-        this.byTxId.set(tx.id, tx);
-      this._indexByNode(tx);
-    }
-
-    if (pkt.timestamp < tx.first_seen) {
-      tx.first_seen = pkt.timestamp;
-      tx.timestamp = pkt.timestamp;
-    }
-    // Update display path if new observation has longer path
-    let newPathLen = 0, curPathLen = 0;
-    try { newPathLen = JSON.parse(pkt.path_json || '[]').length; } catch {}
-    try { curPathLen = JSON.parse(tx.path_json || '[]').length; } catch {}
-    if (newPathLen > curPathLen) {
-      tx.observer_id = pkt.observer_id;
-      tx.observer_name = pkt.observer_name;
-      tx.path_json = pkt.path_json;
-    }
-
-    const obs = {
-      id: pkt.id,
-      transmission_id: tx.id,
-      observer_id: pkt.observer_id,
-      observer_name: pkt.observer_name,
-      direction: pkt.direction,
-      snr: pkt.snr,
-      rssi: pkt.rssi,
-      score: pkt.score,
-      path_json: pkt.path_json,
-      timestamp: pkt.timestamp,
-    };
-    // Dedup: skip if same observer + same path already recorded for this transmission
-    const isDupe = tx.observations.some(o => o.observer_id === obs.observer_id && (o.path_json || '') === (obs.path_json || ''));
-    if (isDupe) return tx;
-
-    tx.observations.push(obs);
-    tx.observation_count++;
-
-    this.byId.set(pkt.id, obs);
-
-    if (pkt.observer_id) {
-      if (!this.byObserver.has(pkt.observer_id)) this.byObserver.set(pkt.observer_id, []);
-      this.byObserver.get(pkt.observer_id).push(obs);
-    }
-
-    this.stats.totalObservations++;
-  }
-
-  /** Extract node pubkeys from decoded_json and index transmission in byNode */
-  _indexByNode(tx) {
-    if (!tx.decoded_json) return;
-    try {
-      const decoded = JSON.parse(tx.decoded_json);
-      const keys = new Set();
-      if (decoded.pubKey) keys.add(decoded.pubKey);
-      if (decoded.destPubKey) keys.add(decoded.destPubKey);
-      if (decoded.srcPubKey) keys.add(decoded.srcPubKey);
-      for (const k of keys) {
-        if (!this._nodeHashIndex.has(k)) this._nodeHashIndex.set(k, new Set());
-        if (this._nodeHashIndex.get(k).has(tx.hash)) continue;
-        this._nodeHashIndex.get(k).add(tx.hash);
-        if (!this.byNode.has(k)) this.byNode.set(k, []);
-        this.byNode.get(k).push(tx);
-      }
-    } catch {}
-  }
-
-  /** Track which observers saw an ADVERT from a given pubkey */
-  _indexAdvertObservers(pubkey, tx) {
-    if (!this._advertByObserver.has(pubkey)) this._advertByObserver.set(pubkey, new Set());
-    const s = this._advertByObserver.get(pubkey);
-    for (const obs of tx.observations) {
-      if (obs.observer_id) s.add(obs.observer_id);
-    }
-  }
-
-  /** Get node pubkeys whose ADVERTs were seen by any of the given observer IDs */
-  getNodesByAdvertObservers(observerIds) {
-    const result = new Set();
-    for (const [pubkey, observers] of this._advertByObserver) {
-      for (const obsId of observerIds) {
-        if (observers.has(obsId)) { result.add(pubkey); break; }
-      }
-    }
-    return result;
-  }
-
-  /** Remove oldest transmissions when over memory limit */
-  _evict() {
-    while (this.packets.length > this.maxPackets) {
-      const old = this.packets.pop();
-      this.byHash.delete(old.hash);
-      this.byHash.delete(old.hash);
-      this.byTxId.delete(old.id);
-      // Remove observations from byId and byObserver
-      for (const obs of old.observations) {
-        this.byId.delete(obs.id);
-        if (obs.observer_id && this.byObserver.has(obs.observer_id)) {
-          const arr = this.byObserver.get(obs.observer_id).filter(o => o.id !== obs.id);
-          if (arr.length) this.byObserver.set(obs.observer_id, arr); else this.byObserver.delete(obs.observer_id);
-        }
-      }
-      // Skip node index cleanup (expensive, low value)
-      this.stats.evicted++;
-    }
-  }
-
-  /** Insert a new packet (to both memory and SQLite) */
-  insert(packetData) {
-    // Write to normalized tables and get the transmission ID
-    const txResult = this.dbModule.insertTransmission ? this.dbModule.insertTransmission(packetData) : null;
-    const transmissionId = txResult ? txResult.transmissionId : null;
-    const observationId = txResult ? txResult.observationId : null;
-
-    // Build row directly from packetData — avoids view ID mismatch issues
-    const row = {
-      id: observationId,
-      raw_hex: packetData.raw_hex,
-      hash: packetData.hash,
-      timestamp: packetData.timestamp,
-      route_type: packetData.route_type,
-      payload_type: packetData.payload_type,
-      payload_version: packetData.payload_version,
-      decoded_json: packetData.decoded_json,
-      observer_id: packetData.observer_id,
-      observer_name: packetData.observer_name,
-      snr: packetData.snr,
-      rssi: packetData.rssi,
-      path_json: packetData.path_json,
-      direction: packetData.direction,
-    };
-    if (!this.sqliteOnly) {
-      // Update or create transmission in memory
-      let tx = this.byHash.get(row.hash);
-      if (!tx) {
-        tx = {
-          id: transmissionId || row.id,
-          raw_hex: row.raw_hex,
-          hash: row.hash,
-          first_seen: row.timestamp,
-          timestamp: row.timestamp,
-          route_type: row.route_type,
-          payload_type: row.payload_type,
-          decoded_json: row.decoded_json,
-          observations: [],
-          observation_count: 0,
-          observer_id: row.observer_id,
-          observer_name: row.observer_name,
-          snr: row.snr,
-          rssi: row.rssi,
-          path_json: row.path_json,
-          direction: row.direction,
-        };
-        this.byHash.set(row.hash, tx);
-        this.byHash.set(row.hash, tx);
-        this.packets.unshift(tx); // newest first
-        this.byTxId.set(tx.id, tx);
-        this._indexByNode(tx);
-      } else {
-        // Update first_seen if earlier
-        if (row.timestamp < tx.first_seen) {
-          tx.first_seen = row.timestamp;
-          tx.timestamp = row.timestamp;
-        }
-        // Update display path if new observation has longer path
-        let newPathLen = 0, curPathLen = 0;
-        try { newPathLen = JSON.parse(row.path_json || '[]').length; } catch {}
-        try { curPathLen = JSON.parse(tx.path_json || '[]').length; } catch {}
-        if (newPathLen > curPathLen) {
-          tx.observer_id = row.observer_id;
-          tx.observer_name = row.observer_name;
-          tx.path_json = row.path_json;
-        }
-      }
-
-      // Add observation
-      const obs = {
-        id: row.id,
-        transmission_id: tx.id,
-        hash: tx.hash,
-        observer_id: row.observer_id,
-        observer_name: row.observer_name,
-        direction: row.direction,
-        snr: row.snr,
-        rssi: row.rssi,
-        score: row.score,
-        path_json: row.path_json,
-        timestamp: row.timestamp,
-      };
-      // Dedup: skip if same observer + same path already recorded for this transmission
-      const isDupe = tx.observations.some(o => o.observer_id === obs.observer_id && (o.path_json || '') === (obs.path_json || ''));
-      if (!isDupe) {
-        tx.observations.push(obs);
-        tx.observation_count++;
-      }
-
-      // Update transmission's display fields if this is first observation
-      if (tx.observations.length === 1) {
-        tx.observer_id = obs.observer_id;
-        tx.observer_name = obs.observer_name;
-        tx.snr = obs.snr;
-        tx.rssi = obs.rssi;
-        tx.path_json = obs.path_json;
-      }
-
-      this.byId.set(obs.id, obs);
-      if (obs.observer_id) {
-        if (!this.byObserver.has(obs.observer_id)) this.byObserver.set(obs.observer_id, []);
-        this.byObserver.get(obs.observer_id).push(obs);
-      }
-
-      this.stats.totalObservations++;
-
-      // Update ADVERT observer index for live ingestion
-      if (tx.payload_type === 4 && obs.observer_id && tx.decoded_json) {
-        try {
-          const d = JSON.parse(tx.decoded_json);
-          if (d.pubKey) {
-            if (!this._advertByObserver.has(d.pubKey)) this._advertByObserver.set(d.pubKey, new Set());
-            this._advertByObserver.get(d.pubKey).add(obs.observer_id);
-          }
-        } catch {}
-      }
-
-      this._evict();
-      this.stats.inserts++;
-    }
-    return observationId || transmissionId;
-  }
-
-  /**
-   * Find ALL packets referencing a node — by pubkey index + name + pubkey text search.
-   * Returns unique transmissions (deduped).
-   * @param {string} nodeIdOrName - pubkey or friendly name
-   * @param {Array} [fromPackets] - packet array to filter (defaults to this.packets)
-   * @returns {{ packets: Array, pubkey: string, nodeName: string }}
-   */
-  findPacketsForNode(nodeIdOrName, fromPackets) {
-    let pubkey = nodeIdOrName;
-    let nodeName = nodeIdOrName;
-
-    // Always resolve to get both pubkey and name
-    try {
-      const row = this.db.prepare("SELECT public_key, name FROM nodes WHERE public_key = ? OR name = ? LIMIT 1").get(nodeIdOrName, nodeIdOrName);
-      if (row) { pubkey = row.public_key; nodeName = row.name || nodeIdOrName; }
-    } catch {}
-
-    // Combine: index hits + text search
-    const indexed = this.byNode.get(pubkey);
-    const hashSet = indexed ? new Set(indexed.map(t => t.hash)) : new Set();
-    const source = fromPackets || this.packets;
-    const packets = source.filter(t =>
-      hashSet.has(t.hash) ||
-      (t.decoded_json && (t.decoded_json.includes(nodeName) || t.decoded_json.includes(pubkey)))
-    );
-
-    return { packets, pubkey, nodeName };
-  }
-
-  /** Count transmissions and observations for a node */
-  countForNode(pubkey) {
-    const txs = this.byNode.get(pubkey) || [];
-    let observations = 0;
-    for (const tx of txs) observations += tx.observation_count;
-    return { transmissions: txs.length, observations };
-  }
-
-  /** Query packets with filters — all from memory (or SQLite in fallback mode) */
-  query({ limit = 50, offset = 0, type, route, region, observer, hash, since, until, node, order = 'DESC' } = {}) {
-    this.stats.queries++;
-
-    if (this.sqliteOnly) return this._querySQLite({ limit, offset, type, route, region, observer, hash, since, until, node, order });
-
-    let results = this.packets;
-
-    // Use indexes for single-key filters when possible
-    if (hash && !type && !route && !region && !observer && !since && !until && !node) {
-      const tx = this.byHash.get(hash);
-      results = tx ? [tx] : [];
-    } else if (observer && !type && !route && !region && !hash && !since && !until && !node) {
-      // For observer filter, find unique transmissions where any observation matches
-      results = this._transmissionsForObserver(observer);
-    } else if (node && !type && !route && !region && !observer && !hash && !since && !until) {
-      results = this.findPacketsForNode(node).packets;
-    } else {
-      // Apply filters sequentially
-      if (type !== undefined) {
-        const t = Number(type);
-        results = results.filter(p => p.payload_type === t);
-      }
-      if (route !== undefined) {
-        const r = Number(route);
-        results = results.filter(p => p.route_type === r);
-      }
-      if (observer) results = this._transmissionsForObserver(observer, results);
-      if (hash) {
-        const h = hash.toLowerCase();
-        const tx = this.byHash.get(h);
-        results = tx ? results.filter(p => p.hash === h) : [];
-      }
-      if (since) results = results.filter(p => p.timestamp > since);
-      if (until) results = results.filter(p => p.timestamp < until);
-      if (region) {
-        const regionObservers = new Set();
-        try {
-          const obs = this.db.prepare('SELECT id FROM observers WHERE iata = ?').all(region);
-          obs.forEach(o => regionObservers.add(o.id));
-        } catch {}
-        results = results.filter(p =>
-          p.observations.some(o => regionObservers.has(o.observer_id))
-        );
-      }
-      if (node) {
-        results = this.findPacketsForNode(node, results).packets;
-      }
-    }
-
-    const total = results.length;
-
-    // Sort
-    if (order === 'ASC') {
-      results = results.slice().sort((a, b) => {
-        if (a.timestamp < b.timestamp) return -1;
-        if (a.timestamp > b.timestamp) return 1;
-        return 0;
-      });
-    }
-    // Default DESC — packets array is already sorted newest-first
-
-    // Paginate
-    const paginated = results.slice(Number(offset), Number(offset) + Number(limit));
-    return { packets: paginated, total };
-  }
-
-  /** Find unique transmissions that have at least one observation from given observer */
-  _transmissionsForObserver(observerId, fromTransmissions) {
-    if (fromTransmissions) {
-      return fromTransmissions.filter(tx =>
-        tx.observations.some(o => o.observer_id === observerId)
-      );
-    }
-    // Use byObserver index: get observations, then unique transmissions
-    const obs = this.byObserver.get(observerId) || [];
-    const seen = new Set();
-    const result = [];
-    for (const o of obs) {
-      const txId = o.transmission_id;
-      if (!seen.has(txId)) {
-        seen.add(txId);
-        const tx = this.byTxId.get(txId);
-        if (tx) result.push(tx);
-      }
-    }
-    return result;
-  }
-
-  /** Query with groupByHash — now trivial since packets ARE transmissions */
-  queryGrouped({ limit = 50, offset = 0, type, route, region, observer, hash, since, until, node } = {}) {
-    this.stats.queries++;
-
-    if (this.sqliteOnly) return this._queryGroupedSQLite({ limit, offset, type, route, region, observer, hash, since, until, node });
-
-    // Get filtered transmissions
-    const { packets: filtered, total: filteredTotal } = this.query({
-      limit: 999999, offset: 0, type, route, region, observer, hash, since, until, node
-    });
-
-    // Already grouped by hash — just format for backward compat
-    const sorted = filtered.map(tx => ({
-      hash: tx.hash,
-      first_seen: tx.first_seen || tx.timestamp,
-      count: tx.observation_count,
-      observer_count: new Set(tx.observations.map(o => o.observer_id).filter(Boolean)).size,
-      latest: tx.observations.length ? tx.observations.reduce((max, o) => o.timestamp > max ? o.timestamp : max, tx.observations[0].timestamp) : tx.timestamp,
-      observer_id: tx.observer_id,
-      observer_name: tx.observer_name,
-      path_json: tx.path_json,
-      payload_type: tx.payload_type,
-      route_type: tx.route_type,
-      raw_hex: tx.raw_hex,
-      decoded_json: tx.decoded_json,
-      observation_count: tx.observation_count,
-      snr: tx.snr,
-      rssi: tx.rssi,
-    })).sort((a, b) => b.latest.localeCompare(a.latest));
-
-    const total = sorted.length;
-    const paginated = sorted.slice(Number(offset), Number(offset) + Number(limit));
-    return { packets: paginated, total };
-  }
-
-  /** Get timestamps for sparkline */
-  getTimestamps(since) {
-    if (this.sqliteOnly) {
-      return this.db.prepare('SELECT timestamp FROM packets_v WHERE timestamp > ? ORDER BY timestamp ASC').all(since).map(r => r.timestamp);
-    }
-    const results = [];
-    for (const p of this.packets) {
-      if (p.timestamp <= since) break;
-      results.push(p.timestamp);
-    }
-    return results.reverse();
-  }
-
-  /** Get a single packet by ID — checks observation IDs first (backward compat) */
-  getById(id) {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v WHERE id = ?').get(id) || null;
-    const obs = this.byId.get(id) || null;
-    return this._enrichObs(obs);
-  }
-
-  /** Get a transmission by its transmission table ID */
-  getByTxId(id) {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM transmissions WHERE id = ?').get(id) || null;
-    return this.byTxId.get(id) || null;
-  }
-
-  /** Get all siblings of a packet (same hash) — returns enriched observations array */
-  getSiblings(hash) {
-    const h = hash.toLowerCase();
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v WHERE hash = ? ORDER BY timestamp DESC').all(h);
-    const tx = this.byHash.get(h);
-    return tx ? tx.observations.map(o => this._enrichObs(o)) : [];
-  }
-
-  /** Get all transmissions (backward compat — returns packets array) */
-  all() {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v ORDER BY timestamp DESC').all();
-    return this.packets;
-  }
-
-  /** Get all transmissions matching a filter function */
-  filter(fn) {
-    if (this.sqliteOnly) return this.db.prepare('SELECT * FROM packets_v ORDER BY timestamp DESC').all().filter(fn);
-    return this.packets.filter(fn);
-  }
-
-  /** Enrich a lean observation with transmission fields (for API responses) */
-  _enrichObs(obs) {
-    if (!obs) return null;
-    const tx = this.byTxId.get(obs.transmission_id);
-    if (!tx) return obs;
-    return {
-      ...obs,
-      hash: tx.hash,
-      raw_hex: tx.raw_hex,
-      payload_type: tx.payload_type,
-      decoded_json: tx.decoded_json,
-      route_type: tx.route_type,
-    };
-  }
-
-  /** Enrich an array of observations with transmission fields */
-  enrichObservations(observations) {
-    if (!observations || !observations.length) return observations;
-    return observations.map(o => this._enrichObs(o));
-  }
-
-  /** Memory stats */
-  getStats() {
-    return {
-      ...this.stats,
-      inMemory: this.sqliteOnly ? 0 : this.packets.length,
-      sqliteOnly: this.sqliteOnly,
-      maxPackets: this.maxPackets,
-      estimatedMB: this.sqliteOnly ? 0 : Math.round(this.packets.length * this.estPacketBytes / 1024 / 1024),
-      maxMB: Math.round(this.maxBytes / 1024 / 1024),
-      indexes: {
-        byHash: this.byHash.size,
-        byObserver: this.byObserver.size,
-        byNode: this.byNode.size,
-        advertByObserver: this._advertByObserver.size,
-      }
-    };
-  }
-
-  /** SQLite fallback: query with filters */
-  _querySQLite({ limit, offset, type, route, region, observer, hash, since, until, node, order }) {
-    const where = []; const params = [];
-    if (type !== undefined) { where.push('payload_type = ?'); params.push(Number(type)); }
-    if (route !== undefined) { where.push('route_type = ?'); params.push(Number(route)); }
-    if (observer) { where.push('observer_id = ?'); params.push(observer); }
-    if (hash) { where.push('hash = ?'); params.push(hash.toLowerCase()); }
-    if (since) { where.push('timestamp > ?'); params.push(since); }
-    if (until) { where.push('timestamp < ?'); params.push(until); }
-    if (region) { where.push('observer_id IN (SELECT id FROM observers WHERE iata = ?)'); params.push(region); }
-    if (node) { try { const nr = this.db.prepare('SELECT public_key FROM nodes WHERE public_key = ? OR name = ? LIMIT 1').get(node, node); const pk = nr ? nr.public_key : node; where.push('decoded_json LIKE ?'); params.push('%' + pk + '%'); } catch(e) { where.push('decoded_json LIKE ?'); params.push('%' + node + '%'); } }
-    const w = where.length ? 'WHERE ' + where.join(' AND ') : '';
-    const total = this.db.prepare(`SELECT COUNT(*) as c FROM packets_v ${w}`).get(...params).c;
-    const packets = this.db.prepare(`SELECT * FROM packets_v ${w} ORDER BY timestamp ${order === 'ASC' ? 'ASC' : 'DESC'} LIMIT ? OFFSET ?`).all(...params, limit, offset);
-    return { packets, total };
-  }
-
-  /** SQLite fallback: grouped query */
-  _queryGroupedSQLite({ limit, offset, type, route, region, observer, hash, since, until, node }) {
-    const where = []; const params = [];
-    if (type !== undefined) { where.push('payload_type = ?'); params.push(Number(type)); }
-    if (route !== undefined) { where.push('route_type = ?'); params.push(Number(route)); }
-    if (observer) { where.push('observer_id = ?'); params.push(observer); }
-    if (hash) { where.push('hash = ?'); params.push(hash.toLowerCase()); }
-    if (since) { where.push('timestamp > ?'); params.push(since); }
-    if (until) { where.push('timestamp < ?'); params.push(until); }
-    if (region) { where.push('observer_id IN (SELECT id FROM observers WHERE iata = ?)'); params.push(region); }
-    if (node) { try { const nr = this.db.prepare('SELECT public_key FROM nodes WHERE public_key = ? OR name = ? LIMIT 1').get(node, node); const pk = nr ? nr.public_key : node; where.push('decoded_json LIKE ?'); params.push('%' + pk + '%'); } catch(e) { where.push('decoded_json LIKE ?'); params.push('%' + node + '%'); } }
-    const w = where.length ? 'WHERE ' + where.join(' AND ') : '';
-
-    const sql = `SELECT hash, COUNT(*) as count, COUNT(DISTINCT observer_id) as observer_count,
-      MAX(timestamp) as latest, MIN(observer_id) as observer_id, MIN(observer_name) as observer_name,
-      MIN(path_json) as path_json, MIN(payload_type) as payload_type, MIN(route_type) as route_type,
-      MIN(raw_hex) as raw_hex, MIN(decoded_json) as decoded_json, MIN(snr) as snr, MIN(rssi) as rssi
-      FROM packets_v ${w} GROUP BY hash ORDER BY latest DESC LIMIT ? OFFSET ?`;
-    const packets = this.db.prepare(sql).all(...params, limit, offset);
-
-    const countSql = `SELECT COUNT(DISTINCT hash) as c FROM packets_v ${w}`;
-    const total = this.db.prepare(countSql).get(...params).c;
-    return { packets, total };
-  }
-}
-
-module.exports = PacketStore;

public/analytics.js

@@ -876,6 +876,26 @@
             </div>`;
             }).join('')}
           </div>
+          ${data.distributionByRepeaters ? (() => {
+            const dr = data.distributionByRepeaters;
+            const totalRepeaters = (dr[1] || 0) + (dr[2] || 0) + (dr[3] || 0);
+            const rpct = (n) => totalRepeaters ? (n / totalRepeaters * 100).toFixed(1) : '0';
+            const maxRepeaters = Math.max(dr[1] || 0, dr[2] || 0, dr[3] || 0, 1);
+            const colors = { 1: '#ef4444', 2: '#22c55e', 3: '#3b82f6' };
+            return `<h4 style="margin:16px 0 4px">By Repeaters</h4>
+              <p class="text-muted">${totalRepeaters.toLocaleString()} unique repeaters</p>
+              <div class="hash-bars">
+                ${[1, 2, 3].map(size => {
+                  const count = dr[size] || 0;
+                  const width = Math.max((count / maxRepeaters) * 100, count ? 2 : 0);
+                  return `<div class="hash-bar-row">
+                  <div class="hash-bar-label"><strong>${size}-byte</strong></div>
+                  <div class="hash-bar-track"><div class="hash-bar-fill" style="width:${width}%;background:${colors[size]};opacity:0.7"></div></div>
+                  <div class="hash-bar-value">${count.toLocaleString()} <span class="text-muted">(${rpct(count)}%)</span></div>
+                </div>`;
+                }).join('')}
+              </div>`;
+          })() : ''}
         </div>
         <div class="analytics-card flex-1">
           <h3>📈 Hash Size Over Time</h3>
@@ -940,13 +960,23 @@
       </div>
 
       <div class="analytics-card" id="hashMatrixSection">
-        <div style="display:flex;justify-content:space-between;align-items:center"><h3 style="margin:0">🔢 1-Byte Hash Usage Matrix</h3><a href="#/analytics?tab=collisions" style="font-size:11px;color:var(--text-muted)">↑ top</a></div>
-        <p class="text-muted" style="margin:4px 0 8px;font-size:0.8em">Click a cell to see which nodes share that prefix. Green = available, yellow = taken, red = collision.</p>
+        <div style="display:flex;justify-content:space-between;align-items:center">
+          <h3 style="margin:0" id="hashMatrixTitle">🔢 Hash Usage Matrix</h3>
+          <a href="#/analytics?tab=collisions" style="font-size:11px;color:var(--text-muted)">↑ top</a>
+        </div>
+        <div style="display:flex;align-items:center;gap:16px;margin:8px 0">
+          <div class="hash-byte-selector" id="hashByteSelector" style="display:flex;gap:4px">
+            <button class="hash-byte-btn active" data-bytes="1">1-Byte</button>
+            <button class="hash-byte-btn" data-bytes="2">2-Byte</button>
+            <button class="hash-byte-btn" data-bytes="3">3-Byte</button>
+          </div>
+          <p class="text-muted" id="hashMatrixDesc" style="margin:0;font-size:0.8em">Click a cell to see which nodes share that prefix.</p>
+        </div>
         <div id="hashMatrix"></div>
       </div>
 
       <div class="analytics-card" id="collisionRiskSection">
-        <div style="display:flex;justify-content:space-between;align-items:center"><h3 style="margin:0">💥 1-Byte Collision Risk</h3><a href="#/analytics?tab=collisions" style="font-size:11px;color:var(--text-muted)">↑ top</a></div>
+        <div style="display:flex;justify-content:space-between;align-items:center"><h3 style="margin:0" id="collisionRiskTitle">💥 Collision Risk</h3><a href="#/analytics?tab=collisions" style="font-size:11px;color:var(--text-muted)">↑ top</a></div>
         <div id="collisionList"><div class="text-muted" style="padding:8px">Loading…</div></div>
       </div>
     `;
@@ -983,10 +1013,43 @@
       }
     }
 
-    // Only repeaters matter for routing — filter out non-repeaters for collision analysis
+    // Repeaters are confirmed routing nodes; null-role nodes may also route (possible conflict)
     const repeaterNodes = allNodes.filter(n => n.role === 'repeater');
-    renderHashMatrix(data.topHops, repeaterNodes);
-    renderCollisions(data.topHops, repeaterNodes);
+    const nullRoleNodes = allNodes.filter(n => !n.role);
+    const routingNodes = [...repeaterNodes, ...nullRoleNodes];
+
+    let currentBytes = 1;
+    function refreshHashViews(bytes) {
+      currentBytes = bytes;
+      hideMatrixTip();
+      // Update selector button states
+      document.querySelectorAll('.hash-byte-btn').forEach(b => {
+        b.classList.toggle('active', Number(b.dataset.bytes) === bytes);
+      });
+      // Update titles and description
+      const matrixTitle = document.getElementById('hashMatrixTitle');
+      const matrixDesc = document.getElementById('hashMatrixDesc');
+      const riskTitle = document.getElementById('collisionRiskTitle');
+      if (matrixTitle) matrixTitle.textContent = bytes === 3 ? '🔢 Hash Usage Matrix' : `🔢 ${bytes}-Byte Hash Usage Matrix`;
+      if (riskTitle) riskTitle.textContent = `💥 ${bytes}-Byte Collision Risk`;
+      if (matrixDesc) {
+        if (bytes === 1) matrixDesc.textContent = 'Click a cell to see which nodes share that 1-byte prefix.';
+        else if (bytes === 2) matrixDesc.textContent = 'Each cell = first-byte group. Color shows worst 2-byte collision within. Click a cell to see the breakdown.';
+        else matrixDesc.textContent = '3-byte prefix space is too large to visualize as a matrix — collision table is shown below.';
+      }
+      renderHashMatrix(data.topHops, routingNodes, bytes, allNodes);
+      // Hide collision risk card for 3-byte — stats are shown in the matrix panel
+      const riskCard = document.getElementById('collisionRiskSection');
+      if (riskCard) riskCard.style.display = bytes === 3 ? 'none' : '';
+      if (bytes !== 3) renderCollisions(data.topHops, routingNodes, bytes);
+    }
+
+    // Wire up selector
+    document.getElementById('hashByteSelector')?.querySelectorAll('.hash-byte-btn').forEach(btn => {
+      btn.addEventListener('click', () => refreshHashViews(Number(btn.dataset.bytes)));
+    });
+
+    refreshHashViews(1);
   }
 
   function renderHashTimeline(hourly) {
@@ -1013,93 +1076,341 @@
     return svg;
   }
 
-  async function renderHashMatrix(topHops, allNodes) {
+  // Shared hover tooltip for hash matrix cells.
+  // Called once per container — reads content from data-tip on each <td>.
+  // Single shared tooltip element for the entire hash matrix — avoids DOM accumulation on mode switch
+  let _matrixTip = null;
+  function getMatrixTip() {
+    if (!_matrixTip) {
+      _matrixTip = document.createElement('div');
+      _matrixTip.className = 'hash-matrix-tooltip';
+      _matrixTip.style.display = 'none';
+      document.body.appendChild(_matrixTip);
+    }
+    return _matrixTip;
+  }
+  function hideMatrixTip() { if (_matrixTip) _matrixTip.style.display = 'none'; }
+
+  function initMatrixTooltip(el) {
+    if (el._matrixTipInit) return;
+    el._matrixTipInit = true;
+    el.addEventListener('mouseover', e => {
+      const td = e.target.closest('td[data-tip]');
+      if (!td) return;
+      const tip = getMatrixTip();
+      tip.innerHTML = td.dataset.tip;
+      tip.style.display = 'block';
+    });
+    el.addEventListener('mousemove', e => {
+      if (!_matrixTip || _matrixTip.style.display === 'none') return;
+      const x = e.clientX + 14, y = e.clientY + 14;
+      _matrixTip.style.left = Math.min(x, window.innerWidth - _matrixTip.offsetWidth - 8) + 'px';
+      _matrixTip.style.top = Math.min(y, window.innerHeight - _matrixTip.offsetHeight - 8) + 'px';
+    });
+    el.addEventListener('mouseout', e => {
+      if (e.target.closest('td[data-tip]') && !e.relatedTarget?.closest('td[data-tip]')) hideMatrixTip();
+    });
+    el.addEventListener('mouseleave', hideMatrixTip);
+  }
+
+  // Pure data helpers — extracted for testability
+
+  function buildOneBytePrefixMap(nodes) {
+    const map = {};
+    for (let i = 0; i < 256; i++) map[i.toString(16).padStart(2, '0').toUpperCase()] = [];
+    for (const n of nodes) {
+      const hex = n.public_key.slice(0, 2).toUpperCase();
+      if (map[hex]) map[hex].push(n);
+    }
+    return map;
+  }
+
+  function buildTwoBytePrefixInfo(nodes) {
+    const info = {};
+    for (let i = 0; i < 256; i++) {
+      const h = i.toString(16).padStart(2, '0').toUpperCase();
+      info[h] = { groupNodes: [], twoByteMap: {}, maxCollision: 0, collisionCount: 0 };
+    }
+    for (const n of nodes) {
+      const firstHex = n.public_key.slice(0, 2).toUpperCase();
+      const twoHex = n.public_key.slice(0, 4).toUpperCase();
+      const entry = info[firstHex];
+      if (!entry) continue;
+      entry.groupNodes.push(n);
+      if (!entry.twoByteMap[twoHex]) entry.twoByteMap[twoHex] = [];
+      entry.twoByteMap[twoHex].push(n);
+    }
+    for (const entry of Object.values(info)) {
+      const collisions = Object.values(entry.twoByteMap).filter(v => v.length > 1);
+      entry.collisionCount = collisions.length;
+      entry.maxCollision = collisions.length ? Math.max(...collisions.map(v => v.length)) : 0;
+    }
+    return info;
+  }
+
+  function buildCollisionHops(allNodes, bytes) {
+    const map = {};
+    for (const n of allNodes) {
+      const p = n.public_key.slice(0, bytes * 2).toUpperCase();
+      if (!map[p]) map[p] = { hex: p, count: 0, size: bytes };
+      map[p].count++;
+    }
+    return Object.values(map).filter(h => h.count > 1);
+  }
+
+  function renderHashMatrix(topHops, allNodes, bytes, totalNodes) {
+    bytes = bytes || 1;
+    totalNodes = totalNodes || allNodes;
     const el = document.getElementById('hashMatrix');
 
-    // Build prefix → node count map
-    const prefixNodes = {};
-    for (let i = 0; i < 256; i++) {
-      const hex = i.toString(16).padStart(2, '0').toUpperCase();
-      prefixNodes[hex] = allNodes.filter(n => n.public_key.toUpperCase().startsWith(hex));
+    // 3-byte: show a summary panel instead of a matrix
+    if (bytes === 3) {
+      const total = totalNodes.length;
+      const threeByteNodes = allNodes.filter(n => n.hash_size === 3).length;
+      const nodesForByte = allNodes.filter(n => n.hash_size === 3 || !n.hash_size);
+      const prefixMap = {};
+      for (const n of nodesForByte) {
+        const p = n.public_key.slice(0, 6).toUpperCase();
+        if (!prefixMap[p]) prefixMap[p] = 0;
+        prefixMap[p]++;
+      }
+      const uniquePrefixes = Object.keys(prefixMap).length;
+      const collisions = Object.values(prefixMap).filter(c => c > 1).length;
+      const spaceSize = 16777216; // 2^24
+      const pct = uniquePrefixes > 0 ? ((uniquePrefixes / spaceSize) * 100).toFixed(6) : '0';
+      el.innerHTML = `
+        <div style="display:flex;gap:12px;flex-wrap:wrap;margin-bottom:12px">
+          <div class="analytics-stat-card" style="flex:1;min-width:110px">
+            <div class="analytics-stat-label">Nodes tracked</div>
+            <div class="analytics-stat-value">${total.toLocaleString()}</div>
+          </div>
+          <div class="analytics-stat-card" style="flex:1;min-width:110px">
+            <div class="analytics-stat-label">Using 3-byte ID</div>
+            <div class="analytics-stat-value">${threeByteNodes.toLocaleString()}</div>
+          </div>
+          <div class="analytics-stat-card" style="flex:1;min-width:110px">
+            <div class="analytics-stat-label">Prefix space used</div>
+            <div class="analytics-stat-value" style="font-size:16px">${pct}%</div>
+            <div style="font-size:10px;color:var(--text-muted);margin-top:2px">of 16.7M possible</div>
+          </div>
+          <div class="analytics-stat-card" style="flex:1;min-width:110px;border-color:${collisions > 0 ? 'var(--status-red)' : 'var(--border)'}">
+            <div class="analytics-stat-label">Prefix collisions</div>
+            <div class="analytics-stat-value" style="color:${collisions > 0 ? 'var(--status-red)' : 'var(--status-green)'}">${collisions}</div>
+          </div>
+        </div>
+        <p class="text-muted" style="margin:0;font-size:0.8em">The 3-byte prefix space (16.7M values) is too large to visualize as a grid.</p>`;
+      return;
     }
 
     const nibbles = '0123456789ABCDEF'.split('');
     const cellSize = 36;
     const headerSize = 24;
 
-    let html = `<div style="display:flex;gap:16px;flex-wrap:wrap"><div class="hash-matrix-scroll"><table class="hash-matrix-table" style="border-collapse:collapse;font-size:12px;font-family:monospace">`;
-    html += `<tr><td style="width:${headerSize}px"></td>`;
-    for (const n of nibbles) {
-      html += `<td style="width:${cellSize}px;text-align:center;padding:2px 0;font-weight:bold;color:var(--text-muted)">${n}</td>`;
-    }
-    html += '</tr>';
+    if (bytes === 1) {
+      const nodesForByte = allNodes.filter(n => n.hash_size === 1 || !n.hash_size);
+      const prefixNodes = buildOneBytePrefixMap(nodesForByte);
+      const oneByteCount = allNodes.filter(n => n.hash_size === 1).length;
+      const oneUsed = Object.values(prefixNodes).filter(v => v.length > 0).length;
+      const oneCollisions = Object.values(prefixNodes).filter(v => v.length > 1).length;
+      const onePct = ((oneUsed / 256) * 100).toFixed(1);
 
-    for (let hi = 0; hi < 16; hi++) {
-      html += `<tr><td style="text-align:right;padding-right:4px;font-weight:bold;color:var(--text-muted)">${nibbles[hi]}</td>`;
-      for (let lo = 0; lo < 16; lo++) {
-        const hex = nibbles[hi] + nibbles[lo];
-        const nodes = prefixNodes[hex] || [];
-        const count = nodes.length;
-        let bg, color;
-        if (count === 0) {
-          bg = 'var(--card-bg)'; color = 'var(--text-muted)'; // empty — subtle
-        } else if (count === 1) {
-          bg = '#dcfce7'; color = '#166534'; // light green — taken, no collision
-        } else {
-          // 2+ nodes: orange→red
-          const t = Math.min((count - 2) / 4, 1);
-          const r = Math.round(220 + 35 * t);
-          const g = Math.round(120 * (1 - t));
-          bg = `rgb(${r},${g},30)`; color = '#fff';
-        }
-        const status = count === 0 ? 'available' : count === 1 ? `1 node: ${nodes[0].name || nodes[0].public_key.slice(0,12)}` : `${count} nodes — COLLISION`;
-        const cellText = count === 0 ? `<span style="font-size:11px">${hex}</span>` : count >= 2 ? `<strong>${count >= 3 ? '3+' : count}</strong>` : String(count);
-        html += `<td class="hash-cell${count ? ' hash-active' : ''}" data-hex="${hex}" style="width:${cellSize}px;height:${cellSize}px;text-align:center;background:${bg};color:${color};border:1px solid var(--border);cursor:${count ? 'pointer' : 'default'};font-size:13px;font-weight:${count >= 2 ? '700' : '400'}" title="0x${hex}: ${status}">${cellText}</td>`;
-      }
+      let html = `<div style="display:flex;gap:12px;flex-wrap:wrap;margin-bottom:12px">
+        <div class="analytics-stat-card" style="flex:1;min-width:110px">
+          <div class="analytics-stat-label">Nodes tracked</div>
+          <div class="analytics-stat-value">${totalNodes.length.toLocaleString()}</div>
+        </div>
+        <div class="analytics-stat-card" style="flex:1;min-width:110px">
+          <div class="analytics-stat-label">Using 1-byte ID</div>
+          <div class="analytics-stat-value">${oneByteCount.toLocaleString()}</div>
+        </div>
+        <div class="analytics-stat-card" style="flex:1;min-width:110px">
+          <div class="analytics-stat-label">Prefix space used</div>
+          <div class="analytics-stat-value" style="font-size:16px">${onePct}%</div>
+          <div style="font-size:10px;color:var(--text-muted);margin-top:2px">of 256 possible</div>
+        </div>
+        <div class="analytics-stat-card" style="flex:1;min-width:110px;border-color:${oneCollisions > 0 ? 'var(--status-red)' : 'var(--border)'}">
+          <div class="analytics-stat-label">Prefix collisions</div>
+          <div class="analytics-stat-value" style="color:${oneCollisions > 0 ? 'var(--status-red)' : 'var(--status-green)'}">${oneCollisions}</div>
+        </div>
+      </div>`;
+      html += `<div style="display:flex;gap:16px;flex-wrap:wrap"><div class="hash-matrix-scroll"><table class="hash-matrix-table" style="border-collapse:collapse;font-size:12px;font-family:monospace">`;
+      html += `<tr><td style="width:${headerSize}px"></td>`;
+      for (const n of nibbles) html += `<td style="width:${cellSize}px;text-align:center;padding:2px 0;font-weight:bold;color:var(--text-muted)">${n}</td>`;
       html += '</tr>';
-    }
-    html += '</table></div>';
-    html += `<div id="hashDetail" style="flex:1;min-width:200px;max-width:400px;font-size:0.85em"></div></div>
-    <div style="margin-top:8px;font-size:0.8em;display:flex;gap:16px;align-items:center">
-      <span><span class="legend-swatch" style="background:var(--card-bg);border:1px solid var(--border)"></span> 0 — Available</span>
-      <span><span class="legend-swatch" style="background:#dcfce7"></span> 1 — One node</span>
-      <span><span class="legend-swatch" style="background:rgb(200,80,30)"></span> 2 — Two nodes (collision)</span>
-      <span><span class="legend-swatch" style="background:rgb(200,0,30)"></span> 3+ — Three+ nodes (collision)</span>
-    </div>`;
-    el.innerHTML = html;
-
-    // Click handler for cells
-    el.querySelectorAll('.hash-active').forEach(td => {
-      td.addEventListener('click', () => {
-        const hex = td.dataset.hex.toUpperCase();
-        const matches = prefixNodes[hex] || [];
-        const detail = document.getElementById('hashDetail');
-        if (!matches.length) {
-          detail.innerHTML = `<strong class="mono">0x${hex}</strong><br><span class="text-muted">No known nodes</span>`;
-          return;
+      for (let hi = 0; hi < 16; hi++) {
+        html += `<tr><td style="text-align:right;padding-right:4px;font-weight:bold;color:var(--text-muted)">${nibbles[hi]}</td>`;
+        for (let lo = 0; lo < 16; lo++) {
+          const hex = nibbles[hi] + nibbles[lo];
+          const nodes = prefixNodes[hex] || [];
+          const count = nodes.length;
+          const repeaterCount = nodes.filter(n => n.role === 'repeater').length;
+          const isCollision = count >= 2 && repeaterCount >= 2;
+          const isPossible = count >= 2 && !isCollision;
+          let cellClass, bgStyle;
+          if (count === 0) { cellClass = 'hash-cell-empty'; bgStyle = ''; }
+          else if (count === 1) { cellClass = 'hash-cell-taken'; bgStyle = ''; }
+          else if (isPossible) { cellClass = 'hash-cell-possible'; bgStyle = ''; }
+          else { const t = Math.min((count - 2) / 4, 1); bgStyle = `background:rgb(${Math.round(220+35*t)},${Math.round(120*(1-t))},30);`; cellClass = 'hash-cell-collision'; }
+          const nodeLabel = m => `<div style="font-size:11px">${esc(m.name||m.public_key.slice(0,12))}${!m.role ? ' <span style="opacity:0.7">(unknown role)</span>' : ''}</div>`;
+          const tip1 = count === 0
+            ? `<div class="hash-matrix-tooltip-hex">0x${hex}</div><div class="hash-matrix-tooltip-status">Available</div>`
+            : count === 1
+              ? `<div class="hash-matrix-tooltip-hex">0x${hex}</div><div class="hash-matrix-tooltip-status">One node — no collision</div><div class="hash-matrix-tooltip-nodes">${nodeLabel(nodes[0])}</div>`
+              : isPossible
+                ? `<div class="hash-matrix-tooltip-hex">0x${hex}</div><div class="hash-matrix-tooltip-status">${count} nodes — POSSIBLE CONFLICT</div><div class="hash-matrix-tooltip-nodes">${nodes.slice(0,5).map(nodeLabel).join('')}${nodes.length>5?`<div class="hash-matrix-tooltip-status">+${nodes.length-5} more</div>`:''}</div>`
+                : `<div class="hash-matrix-tooltip-hex">0x${hex}</div><div class="hash-matrix-tooltip-status">${count} nodes — COLLISION</div><div class="hash-matrix-tooltip-nodes">${nodes.slice(0,5).map(nodeLabel).join('')}${nodes.length>5?`<div class="hash-matrix-tooltip-status">+${nodes.length-5} more</div>`:''}</div>`;
+          html += `<td class="hash-cell ${cellClass}${count ? ' hash-active' : ''}" data-hex="${hex}" data-tip="${tip1.replace(/"/g,'&quot;')}" style="width:${cellSize}px;height:${cellSize}px;text-align:center;${bgStyle}border:1px solid var(--border);cursor:${count ? 'pointer' : 'default'};font-size:11px;font-weight:${count >= 2 ? '700' : '400'}">${hex}</td>`;
         }
-        detail.innerHTML = `<strong class="mono" style="font-size:1.1em">0x${hex}</strong> — ${matches.length} node${matches.length !== 1 ? 's' : ''}` +
-          `<div style="margin-top:8px">${matches.map(m => {
-            const coords = (m.lat && m.lon && !(m.lat === 0 && m.lon === 0))
-              ? `<span class="text-muted" style="font-size:0.8em">(${m.lat.toFixed(2)}, ${m.lon.toFixed(2)})</span>`
-              : '<span class="text-muted" style="font-size:0.8em">(no coords)</span>';
-            const role = m.role ? `<span class="badge" style="font-size:0.7em;padding:1px 4px;background:var(--border)">${esc(m.role)}</span> ` : '';
-            return `<div style="padding:3px 0">${role}<a href="#/nodes/${encodeURIComponent(m.public_key)}" class="analytics-link">${esc(m.name || m.public_key.slice(0,12))}</a> ${coords}</div>`;
-          }).join('')}</div>`;
-        el.querySelectorAll('.hash-selected').forEach(c => c.classList.remove('hash-selected'));
-        td.classList.add('hash-selected');
+        html += '</tr>';
+      }
+      html += '</table></div>';
+      html += `<div id="hashDetail" style="flex:1;min-width:200px;max-width:400px;font-size:0.85em"></div></div>
+      <div style="margin-top:8px;font-size:0.8em;display:flex;gap:16px;align-items:center;flex-wrap:wrap">
+        <span><span class="legend-swatch hash-cell-empty" style="border:1px solid var(--border)"></span> Available</span>
+        <span><span class="legend-swatch hash-cell-taken"></span> One node</span>
+        <span><span class="legend-swatch hash-cell-possible"></span> Possible conflict</span>
+        <span><span class="legend-swatch hash-cell-collision" style="background:rgb(220,80,30)"></span> Collision</span>
+      </div>`;
+      el.innerHTML = html;
+
+      initMatrixTooltip(el);
+
+      el.querySelectorAll('.hash-active').forEach(td => {
+        td.addEventListener('click', () => {
+          const hex = td.dataset.hex.toUpperCase();
+          const matches = prefixNodes[hex] || [];
+          const detail = document.getElementById('hashDetail');
+          if (!matches.length) { detail.innerHTML = `<strong class="mono">0x${hex}</strong><br><span class="text-muted">No known nodes</span>`; return; }
+          detail.innerHTML = `<strong class="mono" style="font-size:1.1em">0x${hex}</strong> — ${matches.length} node${matches.length !== 1 ? 's' : ''}` +
+            `<div style="margin-top:8px">${matches.map(m => {
+              const coords = (m.lat && m.lon && !(m.lat === 0 && m.lon === 0)) ? `<span class="text-muted" style="font-size:0.8em">(${m.lat.toFixed(2)}, ${m.lon.toFixed(2)})</span>` : '<span class="text-muted" style="font-size:0.8em">(no coords)</span>';
+              const role = m.role ? `<span class="badge" style="font-size:0.7em;padding:1px 4px;background:var(--border)">${esc(m.role)}</span> ` : '';
+              return `<div style="padding:3px 0">${role}<a href="#/nodes/${encodeURIComponent(m.public_key)}" class="analytics-link">${esc(m.name || m.public_key.slice(0,12))}</a> ${coords}</div>`;
+            }).join('')}</div>`;
+          el.querySelectorAll('.hash-selected').forEach(c => c.classList.remove('hash-selected'));
+          td.classList.add('hash-selected');
+        });
       });
-    });
+
+    } else if (bytes === 2) {
+      // 2-byte mode: 16×16 grid of first-byte groups
+      const nodesForByte = allNodes.filter(n => n.hash_size === 2 || !n.hash_size);
+      const firstByteInfo = buildTwoBytePrefixInfo(nodesForByte);
+
+      const twoByteCount = allNodes.filter(n => n.hash_size === 2).length;
+      const uniqueTwoBytePrefixes = new Set(nodesForByte.map(n => n.public_key.slice(0, 4).toUpperCase())).size;
+      const twoCollisions = Object.values(firstByteInfo).filter(v => v.collisionCount > 0).length;
+      const twoPct = ((uniqueTwoBytePrefixes / 65536) * 100).toFixed(3);
+
+      let html = `<div style="display:flex;gap:12px;flex-wrap:wrap;margin-bottom:12px">
+        <div class="analytics-stat-card" style="flex:1;min-width:110px">
+          <div class="analytics-stat-label">Nodes tracked</div>
+          <div class="analytics-stat-value">${totalNodes.length.toLocaleString()}</div>
+        </div>
+        <div class="analytics-stat-card" style="flex:1;min-width:110px">
+          <div class="analytics-stat-label">Using 2-byte ID</div>
+          <div class="analytics-stat-value">${twoByteCount.toLocaleString()}</div>
+        </div>
+        <div class="analytics-stat-card" style="flex:1;min-width:110px">
+          <div class="analytics-stat-label">Prefix space used</div>
+          <div class="analytics-stat-value" style="font-size:16px">${twoPct}%</div>
+          <div style="font-size:10px;color:var(--text-muted);margin-top:2px">${uniqueTwoBytePrefixes} of 65,536 possible</div>
+        </div>
+        <div class="analytics-stat-card" style="flex:1;min-width:110px;border-color:${twoCollisions > 0 ? 'var(--status-red)' : 'var(--border)'}">
+          <div class="analytics-stat-label">Prefix collisions</div>
+          <div class="analytics-stat-value" style="color:${twoCollisions > 0 ? 'var(--status-red)' : 'var(--status-green)'}">${twoCollisions}</div>
+        </div>
+      </div>`;
+      html += `<div style="display:flex;gap:16px;flex-wrap:wrap"><div class="hash-matrix-scroll"><table class="hash-matrix-table" style="border-collapse:collapse;font-size:12px;font-family:monospace">`;
+      html += `<tr><td style="width:${headerSize}px"></td>`;
+      for (const n of nibbles) html += `<td style="width:${cellSize}px;text-align:center;padding:2px 0;font-weight:bold;color:var(--text-muted)">${n}</td>`;
+      html += '</tr>';
+      for (let hi = 0; hi < 16; hi++) {
+        html += `<tr><td style="text-align:right;padding-right:4px;font-weight:bold;color:var(--text-muted)">${nibbles[hi]}</td>`;
+        for (let lo = 0; lo < 16; lo++) {
+          const hex = nibbles[hi] + nibbles[lo];
+          const info = firstByteInfo[hex] || { groupNodes: [], maxCollision: 0, collisionCount: 0 };
+          const nodeCount = info.groupNodes.length;
+          const maxCol = info.maxCollision;
+          // Classify worst overlap in group: confirmed collision (2+ repeaters) or possible (null-role involved)
+          const overlapping = Object.values(info.twoByteMap || {}).filter(v => v.length > 1);
+          const hasConfirmed = overlapping.some(ns => ns.filter(n => n.role === 'repeater').length >= 2);
+          const hasPossible = !hasConfirmed && overlapping.some(ns => ns.length >= 2);
+          let cellClass2, bgStyle2;
+          if (nodeCount === 0) { cellClass2 = 'hash-cell-empty'; bgStyle2 = ''; }
+          else if (maxCol === 0) { cellClass2 = 'hash-cell-taken'; bgStyle2 = ''; }
+          else if (hasPossible) { cellClass2 = 'hash-cell-possible'; bgStyle2 = ''; }
+          else { const t = Math.min((maxCol - 2) / 4, 1); bgStyle2 = `background:rgb(${Math.round(220+35*t)},${Math.round(120*(1-t))},30);`; cellClass2 = 'hash-cell-collision'; }
+          const nodeLabel2 = m => esc(m.name||m.public_key.slice(0,8)) + (!m.role ? ' (?)' : '');
+          const tip2 = nodeCount === 0
+            ? `<div class="hash-matrix-tooltip-hex">0x${hex}__</div><div class="hash-matrix-tooltip-status">No nodes in this group</div>`
+            : info.collisionCount === 0
+              ? `<div class="hash-matrix-tooltip-hex">0x${hex}__</div><div class="hash-matrix-tooltip-status">${nodeCount} node${nodeCount>1?'s':''} — no 2-byte collisions</div>`
+              : `<div class="hash-matrix-tooltip-hex">0x${hex}__</div><div class="hash-matrix-tooltip-status">${hasConfirmed ? info.collisionCount + ' collision' + (info.collisionCount>1?'s':'') : 'Possible conflict'}</div><div class="hash-matrix-tooltip-nodes">${Object.entries(info.twoByteMap).filter(([,v])=>v.length>1).slice(0,4).map(([p,ns])=>`<div style="font-size:11px;padding:1px 0"><span style="color:${hasConfirmed?'var(--status-red)':'var(--status-yellow)'};font-family:var(--mono);font-weight:700">${p}</span> — ${ns.map(nodeLabel2).join(', ')}</div>`).join('')}</div>`;
+          html += `<td class="hash-cell ${cellClass2}${nodeCount ? ' hash-active' : ''}" data-hex="${hex}" data-tip="${tip2.replace(/"/g,'&quot;')}" style="width:${cellSize}px;height:${cellSize}px;text-align:center;${bgStyle2}border:1px solid var(--border);cursor:${nodeCount ? 'pointer' : 'default'};font-size:11px;font-weight:${maxCol > 0 ? '700' : '400'}">${hex}</td>`;
+        }
+        html += '</tr>';
+      }
+      html += '</table></div>';
+      html += `<div id="hashDetail" style="flex:1;min-width:200px;max-width:420px;font-size:0.85em"></div></div>
+      <div style="margin-top:8px;font-size:0.8em;display:flex;gap:16px;align-items:center;flex-wrap:wrap">
+        <span><span class="legend-swatch hash-cell-empty" style="border:1px solid var(--border)"></span> No nodes in group</span>
+        <span><span class="legend-swatch hash-cell-taken"></span> Nodes present, no collision</span>
+        <span><span class="legend-swatch hash-cell-possible"></span> Possible conflict</span>
+        <span><span class="legend-swatch hash-cell-collision" style="background:rgb(220,80,30)"></span> Collision</span>
+      </div>`;
+      el.innerHTML = html;
+
+      el.querySelectorAll('.hash-active').forEach(td => {
+        td.addEventListener('click', () => {
+          const hex = td.dataset.hex.toUpperCase();
+          const info = firstByteInfo[hex];
+          const detail = document.getElementById('hashDetail');
+          if (!info || !info.groupNodes.length) { detail.innerHTML = ''; return; }
+          let dhtml = `<strong class="mono" style="font-size:1.1em">0x${hex}__</strong> — ${info.groupNodes.length} node${info.groupNodes.length !== 1 ? 's' : ''} in group`;
+          if (info.collisionCount === 0) {
+            dhtml += `<div class="text-muted" style="margin-top:6px;font-size:0.85em">✅ No 2-byte collisions in this group</div>`;
+            dhtml += `<div style="margin-top:8px">${info.groupNodes.map(m => {
+              const prefix = m.public_key.slice(0,4).toUpperCase();
+              return `<div style="padding:2px 0"><code class="mono" style="font-size:0.85em">${prefix}</code> <a href="#/nodes/${encodeURIComponent(m.public_key)}" class="analytics-link">${esc(m.name || m.public_key.slice(0,12))}</a></div>`;
+            }).join('')}</div>`;
+          } else {
+            dhtml += `<div style="margin-top:8px">`;
+            for (const [twoHex, nodes] of Object.entries(info.twoByteMap).sort()) {
+              const isCollision = nodes.length > 1;
+              dhtml += `<div style="margin-bottom:6px;padding:4px 6px;border-radius:4px;background:${isCollision ? 'rgba(220,50,30,0.1)' : 'transparent'};border:1px solid ${isCollision ? 'rgba(220,50,30,0.3)' : 'transparent'}">`;
+              dhtml += `<code class="mono" style="font-size:0.9em;font-weight:${isCollision?'700':'400'}">${twoHex}</code>${isCollision ? ' <span style="color:#dc2626;font-size:0.75em;font-weight:700">COLLISION</span>' : ''} `;
+              dhtml += nodes.map(m => `<a href="#/nodes/${encodeURIComponent(m.public_key)}" class="analytics-link" style="font-size:0.85em">${esc(m.name || m.public_key.slice(0,12))}</a>`).join(', ');
+              dhtml += `</div>`;
+            }
+            dhtml += '</div>';
+          }
+          detail.innerHTML = dhtml;
+          el.querySelectorAll('.hash-selected').forEach(c => c.classList.remove('hash-selected'));
+          td.classList.add('hash-selected');
+        });
+      });
+
+      initMatrixTooltip(el);
+    }
   }
 
-  async function renderCollisions(topHops, allNodes) {
+  async function renderCollisions(topHops, allNodes, bytes) {
+    bytes = bytes || 1;
     const el = document.getElementById('collisionList');
-    const oneByteHops = topHops.filter(h => h.size === 1);
-    if (!oneByteHops.length) { el.innerHTML = '<div class="text-muted">No 1-byte hops</div>'; return; }
+    const hopsForSize = topHops.filter(h => h.size === bytes);
+
+    // For 2-byte and 3-byte, scan nodes directly — topHops only reliably covers 1-byte path hops
+    const hopsToCheck = bytes === 1 ? hopsForSize : buildCollisionHops(allNodes, bytes);
+
+    if (!hopsToCheck.length && bytes === 1) {
+      el.innerHTML = `<div class="text-muted" style="padding:8px">No 1-byte hops observed in recent packets.</div>`;
+      return;
+    }
     try {
       const nodes = allNodes;
       const collisions = [];
-      for (const hop of oneByteHops) {
+      for (const hop of hopsToCheck) {
         const prefix = hop.hex.toLowerCase();
         const matches = nodes.filter(n => n.public_key.toLowerCase().startsWith(prefix));
         if (matches.length > 1) {
@@ -1125,14 +1436,27 @@
           collisions.push({ hop: hop.hex, count: hop.count, matches, maxDistKm, classification, withCoords: withCoords.length });
         }
       }
-      if (!collisions.length) { el.innerHTML = '<div class="text-muted" style="padding:8px">No collisions detected</div>'; return; }
-      
+      if (!collisions.length) {
+        const cleanMsg = bytes === 3
+          ? '✅ No 3-byte prefix collisions detected — all nodes have unique 3-byte prefixes.'
+          : `✅ No ${bytes}-byte collisions detected`;
+        el.innerHTML = `<div class="text-muted" style="padding:8px">${cleanMsg}</div>`;
+        return;
+      }
+
       // Sort: local first (most likely to collide), then regional, distant, incomplete
       const classOrder = { local: 0, regional: 1, distant: 2, incomplete: 3, unknown: 4 };
       collisions.sort((a, b) => classOrder[a.classification] - classOrder[b.classification] || b.count - a.count);
 
+      const showAppearances = bytes < 3;
       el.innerHTML = `<table class="analytics-table">
-        <thead><tr><th scope="col">Hop</th><th scope="col">Appearances</th><th scope="col">Max Distance</th><th scope="col">Assessment</th><th scope="col">Colliding Nodes</th></tr></thead>
+        <thead><tr>
+          <th scope="col">Prefix</th>
+          ${showAppearances ? '<th scope="col">Appearances</th>' : ''}
+          <th scope="col">Max Distance</th>
+          <th scope="col">Assessment</th>
+          <th scope="col">Colliding Nodes</th>
+        </tr></thead>
         <tbody>${collisions.map(c => {
           let badge, tooltip;
           if (c.classification === 'local') {
@@ -1151,12 +1475,12 @@
           const distStr = c.withCoords >= 2 ? `${Math.round(c.maxDistKm)} km` : '<span class="text-muted">—</span>';
           return `<tr>
             <td class="mono">${c.hop}</td>
-            <td>${c.count.toLocaleString()}</td>
+            ${showAppearances ? `<td>${c.count.toLocaleString()}</td>` : ''}
             <td>${distStr}</td>
             <td title="${tooltip}">${badge}</td>
             <td>${c.matches.map(m => {
-              const loc = (m.lat && m.lon && !(m.lat === 0 && m.lon === 0)) 
-                ? ` <span class="text-muted" style="font-size:0.75em">(${m.lat.toFixed(2)}, ${m.lon.toFixed(2)})</span>` 
+              const loc = (m.lat && m.lon && !(m.lat === 0 && m.lon === 0))
+                ? ` <span class="text-muted" style="font-size:0.75em">(${m.lat.toFixed(2)}, ${m.lon.toFixed(2)})</span>`
                 : ' <span class="text-muted" style="font-size:0.75em">(no coords)</span>';
               return `<a href="#/nodes/${encodeURIComponent(m.public_key)}" class="analytics-link">${esc(m.name || m.public_key.slice(0,12))}</a>${loc}`;
             }).join('<br>')}</td>
@@ -1618,6 +1942,9 @@ function destroy() { _analyticsData = {}; _channelData = null; }
     window._analyticsSaveChannelSort = saveChannelSort;
     window._analyticsChannelTbodyHtml = channelTbodyHtml;
     window._analyticsChannelTheadHtml = channelTheadHtml;
+    window._analyticsBuildOneBytePrefixMap = buildOneBytePrefixMap;
+    window._analyticsBuildTwoBytePrefixInfo = buildTwoBytePrefixInfo;
+    window._analyticsBuildCollisionHops = buildCollisionHops;
   }
 
   registerPage('analytics', { init, destroy });

public/app.js

@@ -88,11 +88,116 @@ window.apiPerf = function() {
 
 function timeAgo(iso) {
   if (!iso) return '—';
-  const s = Math.floor((Date.now() - new Date(iso).getTime()) / 1000);
-  if (s < 60) return s + 's ago';
-  if (s < 3600) return Math.floor(s / 60) + 'm ago';
-  if (s < 86400) return Math.floor(s / 3600) + 'h ago';
-  return Math.floor(s / 86400) + 'd ago';
+  const ms = new Date(iso).getTime();
+  if (!isFinite(ms)) return '—';
+  const s = Math.floor((Date.now() - ms) / 1000);
+  const abs = Math.abs(s);
+  let value;
+  let suffix;
+  if (abs < 60) { value = abs; suffix = 's'; }
+  else if (abs < 3600) { value = Math.floor(abs / 60); suffix = 'm'; }
+  else if (abs < 86400) { value = Math.floor(abs / 3600); suffix = 'h'; }
+  else { value = Math.floor(abs / 86400); suffix = 'd'; }
+  if (s < 0) return 'in ' + value + suffix;
+  return value + suffix + ' ago';
+}
+
+function getTimestampMode() {
+  const saved = localStorage.getItem('meshcore-timestamp-mode');
+  if (saved === 'ago' || saved === 'absolute') return saved;
+  const serverDefault = window.SITE_CONFIG?.timestamps?.defaultMode;
+  return serverDefault === 'absolute' ? 'absolute' : 'ago';
+}
+
+function getTimestampTimezone() {
+  const saved = localStorage.getItem('meshcore-timestamp-timezone');
+  if (saved === 'utc' || saved === 'local') return saved;
+  const serverDefault = window.SITE_CONFIG?.timestamps?.timezone;
+  return serverDefault === 'utc' ? 'utc' : 'local';
+}
+
+function getTimestampFormatPreset() {
+  const saved = localStorage.getItem('meshcore-timestamp-format');
+  if (saved === 'iso' || saved === 'iso-seconds' || saved === 'locale') return saved;
+  const serverDefault = window.SITE_CONFIG?.timestamps?.formatPreset;
+  return (serverDefault === 'iso' || serverDefault === 'iso-seconds' || serverDefault === 'locale') ? serverDefault : 'iso';
+}
+
+function getTimestampCustomFormat() {
+  if (window.SITE_CONFIG?.timestamps?.allowCustomFormat !== true) return '';
+  const saved = localStorage.getItem('meshcore-timestamp-custom-format');
+  if (saved != null) return String(saved);
+  const serverDefault = window.SITE_CONFIG?.timestamps?.customFormat;
+  return serverDefault == null ? '' : String(serverDefault);
+}
+
+function pad2(v) { return String(v).padStart(2, '0'); }
+function pad3(v) { return String(v).padStart(3, '0'); }
+
+function formatIsoLike(d, timezone, includeMs) {
+  const useUtc = timezone === 'utc';
+  const year = useUtc ? d.getUTCFullYear() : d.getFullYear();
+  const month = useUtc ? d.getUTCMonth() + 1 : d.getMonth() + 1;
+  const day = useUtc ? d.getUTCDate() : d.getDate();
+  const hour = useUtc ? d.getUTCHours() : d.getHours();
+  const minute = useUtc ? d.getUTCMinutes() : d.getMinutes();
+  const second = useUtc ? d.getUTCSeconds() : d.getSeconds();
+  const ms = useUtc ? d.getUTCMilliseconds() : d.getMilliseconds();
+  let out = year + '-' + pad2(month) + '-' + pad2(day) + ' ' + pad2(hour) + ':' + pad2(minute) + ':' + pad2(second);
+  if (includeMs) out += '.' + pad3(ms);
+  return out;
+}
+
+function formatTimestampCustom(d, formatString, timezone) {
+  if (!/YYYY|MM|DD|HH|mm|ss|SSS|Z/.test(String(formatString))) return '';
+  const useUtc = timezone === 'utc';
+  const replacements = {
+    YYYY: String(useUtc ? d.getUTCFullYear() : d.getFullYear()),
+    MM: pad2((useUtc ? d.getUTCMonth() : d.getMonth()) + 1),
+    DD: pad2(useUtc ? d.getUTCDate() : d.getDate()),
+    HH: pad2(useUtc ? d.getUTCHours() : d.getHours()),
+    mm: pad2(useUtc ? d.getUTCMinutes() : d.getMinutes()),
+    ss: pad2(useUtc ? d.getUTCSeconds() : d.getSeconds()),
+    SSS: pad3(useUtc ? d.getUTCMilliseconds() : d.getMilliseconds()),
+    Z: (timezone === 'utc' ? 'UTC' : 'local')
+  };
+  return String(formatString).replace(/YYYY|MM|DD|HH|mm|ss|SSS|Z/g, token => replacements[token] || token);
+}
+
+function formatAbsoluteTimestamp(iso) {
+  if (!iso) return '—';
+  const d = new Date(iso);
+  if (!isFinite(d.getTime())) return '—';
+  const timezone = getTimestampTimezone();
+  const preset = getTimestampFormatPreset();
+  const customFormat = getTimestampCustomFormat().trim();
+  if (customFormat) {
+    const customOut = formatTimestampCustom(d, customFormat, timezone);
+    if (customOut && !/Invalid Date|NaN|undefined|null/.test(customOut)) return customOut;
+  }
+  if (preset === 'iso-seconds') return formatIsoLike(d, timezone, true);
+  if (preset === 'locale') {
+    if (timezone === 'utc') return d.toLocaleString([], { timeZone: 'UTC' });
+    return d.toLocaleString();
+  }
+  return formatIsoLike(d, timezone, false);
+}
+
+function formatTimestamp(isoString, mode) {
+  return formatTimestampWithTooltip(isoString, mode).text;
+}
+
+function formatTimestampWithTooltip(isoString, mode) {
+  if (!isoString) return { text: '—', tooltip: '—', isFuture: false };
+  const d = new Date(isoString);
+  if (!isFinite(d.getTime())) return { text: '—', tooltip: '—', isFuture: false };
+  const activeMode = mode === 'absolute' || mode === 'ago' ? mode : getTimestampMode();
+  const isFuture = d.getTime() > Date.now();
+  const absolute = formatAbsoluteTimestamp(isoString);
+  const relative = timeAgo(isoString);
+  const text = isFuture ? absolute : (activeMode === 'absolute' ? absolute : relative);
+  const tooltip = isFuture ? relative : (activeMode === 'absolute' ? relative : absolute);
+  return { text, tooltip, isFuture };
 }
 
 function truncate(str, len) {
@@ -347,6 +452,9 @@ window.addEventListener('theme-changed', () => {
     window.dispatchEvent(new CustomEvent('theme-refresh'));
   }, 300);
 });
+window.addEventListener('timestamp-mode-changed', () => {
+  window.dispatchEvent(new CustomEvent('theme-refresh'));
+});
 window.addEventListener('DOMContentLoaded', () => {
   connectWS();
 
@@ -603,7 +711,14 @@ window.addEventListener('DOMContentLoaded', () => {
   // --- Theme Customization ---
   // Fetch theme config and apply branding/colors before first render
   fetch('/api/config/theme', { cache: 'no-store' }).then(r => r.json()).then(cfg => {
-    window.SITE_CONFIG = cfg;
+    window.SITE_CONFIG = cfg || {};
+    if (!window.SITE_CONFIG.timestamps) window.SITE_CONFIG.timestamps = {};
+    const tsCfg = window.SITE_CONFIG.timestamps;
+    if (tsCfg.defaultMode !== 'absolute' && tsCfg.defaultMode !== 'ago') tsCfg.defaultMode = 'ago';
+    if (tsCfg.timezone !== 'utc' && tsCfg.timezone !== 'local') tsCfg.timezone = 'local';
+    if (tsCfg.formatPreset !== 'iso' && tsCfg.formatPreset !== 'iso-seconds' && tsCfg.formatPreset !== 'locale') tsCfg.formatPreset = 'iso';
+    if (typeof tsCfg.customFormat !== 'string') tsCfg.customFormat = '';
+    tsCfg.allowCustomFormat = tsCfg.allowCustomFormat === true;
 
     // User's localStorage preferences take priority over server config
     const userTheme = (() => { try { return JSON.parse(localStorage.getItem('meshcore-user-theme') || '{}'); } catch { return {}; } })();
@@ -677,7 +792,7 @@ window.addEventListener('DOMContentLoaded', () => {
         if (favicon) favicon.href = cfg.branding.faviconUrl;
       }
     }
-  }).catch(() => { window.SITE_CONFIG = null; }).finally(() => {
+  }).catch(() => { window.SITE_CONFIG = { timestamps: { defaultMode: 'ago', timezone: 'local', formatPreset: 'iso', customFormat: '', allowCustomFormat: false } }; }).finally(() => {
     if (!location.hash || location.hash === '#/') location.hash = '#/home';
     else navigate();
   });

public/geo-filter-overlay.js

@@ -0,0 +1,56 @@
+// Shared helper — initialises the geo-filter polygon overlay on a Leaflet map.
+// Returns the L.layerGroup (or null if no filter is configured / fetch fails).
+// The returned layer is added to the map when the checkbox is toggled on, and
+// removed when toggled off.  The toggle state is persisted in localStorage
+// under the key 'meshcore-map-geo-filter'.
+//
+// Parameters:
+//   map        – Leaflet map instance
+//   checkboxId – id of the <input type="checkbox"> that controls visibility
+//   labelId    – id of the <label> wrapper to reveal once data is loaded
+async function initGeoFilterOverlay(map, checkboxId, labelId) {
+  try {
+    const gf = await api('/config/geo-filter', { ttl: 3600 });
+    if (!gf || !gf.polygon || gf.polygon.length < 3) return null;
+
+    const latlngs = gf.polygon.map(function (p) { return [p[0], p[1]]; });
+    const innerPoly = L.polygon(latlngs, {
+      color: '#3b82f6', weight: 2, opacity: 0.8,
+      fillColor: '#3b82f6', fillOpacity: 0.08
+    });
+
+    const bufferPoly = gf.bufferKm > 0 ? (function () {
+      let cLat = 0, cLon = 0;
+      gf.polygon.forEach(function (p) { cLat += p[0]; cLon += p[1]; });
+      cLat /= gf.polygon.length; cLon /= gf.polygon.length;
+      const cosLat = Math.cos(cLat * Math.PI / 180);
+      const outer = gf.polygon.map(function (p) {
+        const dLatM = (p[0] - cLat) * 111000;
+        const dLonM = (p[1] - cLon) * 111000 * cosLat;
+        const dist = Math.sqrt(dLatM * dLatM + dLonM * dLonM);
+        if (dist === 0) return [p[0], p[1]];
+        const scale = (gf.bufferKm * 1000) / dist;
+        return [p[0] + dLatM * scale / 111000, p[1] + dLonM * scale / (111000 * cosLat)];
+      });
+      return L.polygon(outer, {
+        color: '#3b82f6', weight: 1.5, opacity: 0.4, dashArray: '6 4',
+        fillColor: '#3b82f6', fillOpacity: 0.04
+      });
+    })() : null;
+
+    const layer = L.layerGroup(bufferPoly ? [bufferPoly, innerPoly] : [innerPoly]);
+
+    const label = document.getElementById(labelId);
+    if (label) label.style.display = '';
+    const el = document.getElementById(checkboxId);
+    if (el) {
+      const saved = localStorage.getItem('meshcore-map-geo-filter');
+      if (saved === 'true') { el.checked = true; layer.addTo(map); }
+      el.addEventListener('change', function (e) {
+        localStorage.setItem('meshcore-map-geo-filter', e.target.checked);
+        if (e.target.checked) { layer.addTo(map); } else { map.removeLayer(layer); }
+      });
+    }
+    return layer;
+  } catch (e) { return null; }
+}

public/index.html

@@ -22,9 +22,9 @@
   <meta name="twitter:title" content="CoreScope">
   <meta name="twitter:description" content="Real-time MeshCore LoRa mesh network analyzer — live packet visualization, node tracking, channel decryption, and route analysis.">
   <meta name="twitter:image" content="https://raw.githubusercontent.com/Kpa-clawbot/corescope/master/public/og-image.png">
-  <link rel="stylesheet" href="style.css?v=1774786038">
-  <link rel="stylesheet" href="home.css?v=1774786038">
-  <link rel="stylesheet" href="live.css?v=1774786038">
+  <link rel="stylesheet" href="style.css?v=1774923001">
+  <link rel="stylesheet" href="home.css?v=1774923001">
+  <link rel="stylesheet" href="live.css?v=1774923001">
   <link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css"
     integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
     crossorigin="anonymous">
@@ -81,29 +81,30 @@
   <main id="app" role="main"></main>
 
   <script src="vendor/qrcode.js"></script>
-  <script src="roles.js?v=1774786038"></script>
-  <script src="customize.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="region-filter.js?v=1774786038"></script>
-  <script src="hop-resolver.js?v=1774786038"></script>
-  <script src="hop-display.js?v=1774786038"></script>
-  <script src="app.js?v=1774786038"></script>
-  <script src="home.js?v=1774786038"></script>
-  <script src="packet-filter.js?v=1774786038"></script>
-  <script src="packets.js?v=1774786038"></script>
-  <script src="map.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="channels.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="nodes.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="traces.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-v1-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-v2-constellation.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="audio-lab.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="live.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="observers.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="observer-detail.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="compare.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="node-analytics.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
-  <script src="perf.js?v=1774786038" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="roles.js?v=1774923001"></script>
+  <script src="customize.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="region-filter.js?v=1774923001"></script>
+  <script src="hop-resolver.js?v=1774923001"></script>
+  <script src="hop-display.js?v=1774923001"></script>
+  <script src="app.js?v=1774923001"></script>
+  <script src="home.js?v=1774923001"></script>
+  <script src="packet-filter.js?v=1774923001"></script>
+  <script src="packets.js?v=1774923001"></script>
+  <script src="geo-filter-overlay.js?v=1774923001"></script>
+  <script src="map.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="channels.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="nodes.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="traces.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="analytics.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-v1-constellation.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-v2-constellation.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="audio-lab.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="live.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="observers.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="observer-detail.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="compare.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="node-analytics.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
+  <script src="perf.js?v=1774923001" onerror="console.error('Failed to load:', this.src)"></script>
 </body>
 </html>

public/live.js

@@ -5,7 +5,7 @@
   function cssVar(name) { return getComputedStyle(document.documentElement).getPropertyValue(name).trim(); }
   function statusGreen() { return cssVar('--status-green') || '#22c55e'; }
 
-  let map, ws, nodesLayer, pathsLayer, animLayer, heatLayer;
+  let map, ws, nodesLayer, pathsLayer, animLayer, heatLayer, geoFilterLayer;
   let nodeMarkers = {};
   let nodeData = {};
   let packetCount = 0;
@@ -25,6 +25,7 @@
   let _lcdClockInterval = null;
   let _rateCounterInterval = null;
   let _pruneInterval = null;
+  let activeNodeDetailKey = null;
 
   // === VCR State Machine ===
   const VCR = {
@@ -51,6 +52,19 @@
     REQUEST: '❓', RESPONSE: '📨', TRACE: '🔍', PATH: '🛤️'
   };
 
+  function formatLiveTimestampHtml(isoLike) {
+    if (typeof formatTimestampWithTooltip !== 'function' || typeof getTimestampMode !== 'function') {
+      return escapeHtml(typeof timeAgo === 'function' ? timeAgo(isoLike) : '—');
+    }
+    const d = isoLike ? new Date(isoLike) : null;
+    const iso = d && isFinite(d.getTime()) ? d.toISOString() : null;
+    const f = formatTimestampWithTooltip(iso, getTimestampMode());
+    const warn = f.isFuture
+      ? ' <span class="timestamp-future-icon" title="Timestamp is in the future — node clock may be skewed">⚠️</span>'
+      : '';
+    return `<span class="timestamp-text" title="${escapeHtml(f.tooltip)}">${escapeHtml(f.text)}</span>${warn}`;
+  }
+
   function initResizeHandler() {
     let resizeTimer = null;
     _onResize = function() {
@@ -658,6 +672,7 @@
             <span id="audioDesc" class="sr-only">Sonify packets — turn raw bytes into generative music</span>
             <label><input type="checkbox" id="liveFavoritesToggle" aria-describedby="favDesc"> ⭐ Favorites</label>
             <span id="favDesc" class="sr-only">Show only favorited and claimed nodes</span>
+            <label id="liveGeoFilterLabel" style="display:none"><input type="checkbox" id="liveGeoFilterToggle"> Mesh live area</label>
           </div>
           <div class="audio-controls hidden" id="audioControls">
             <label class="audio-slider-label">Voice <select id="audioVoiceSelect" class="audio-voice-select"></select></label>
@@ -801,6 +816,9 @@
       applyFavoritesFilter();
     });
 
+    // Geo filter overlay
+    initGeoFilterOverlay(map, 'liveGeoFilterToggle', 'liveGeoFilterLabel').then(function (layer) { geoFilterLayer = layer; });
+
     const matrixToggle = document.getElementById('liveMatrixToggle');
     matrixToggle.checked = matrixMode;
     matrixToggle.addEventListener('change', (e) => {
@@ -931,6 +949,7 @@
     const nodeDetailPanel = document.getElementById('liveNodeDetail');
     const nodeDetailContent = document.getElementById('nodeDetailContent');
     document.getElementById('nodeDetailClose').addEventListener('click', () => {
+      activeNodeDetailKey = null;
       nodeDetailPanel.classList.add('hidden');
     });
 
@@ -1155,6 +1174,7 @@
   }
 
   async function showNodeDetail(pubkey) {
+    activeNodeDetailKey = pubkey;
     const panel = document.getElementById('liveNodeDetail');
     const content = document.getElementById('nodeDetailContent');
     panel.classList.remove('hidden');
@@ -1172,7 +1192,7 @@
       const roleColor = ROLE_COLORS[n.role] || '#6b7280';
       const roleLabel = (ROLE_LABELS[n.role] || n.role || 'unknown').replace(/s$/, '');
       const hasLoc = n.lat != null && n.lon != null;
-      const lastSeen = n.last_seen ? timeAgo(n.last_seen) : '—';
+      const lastSeen = formatLiveTimestampHtml(n.last_seen);
       const thresholds = window.getHealthThresholds ? getHealthThresholds(n.role) : { degradedMs: 3600000, silentMs: 86400000 };
       const ageMs = n.last_seen ? Date.now() - new Date(n.last_seen).getTime() : Infinity;
       const statusDot = ageMs < thresholds.degradedMs ? 'health-green' : ageMs < thresholds.silentMs ? 'health-yellow' : 'health-red';
@@ -1213,7 +1233,7 @@
           <div style="font-size:11px;max-height:200px;overflow-y:auto;">` +
           recent.slice(0, 10).map(p => `<div style="padding:2px 0;display:flex;justify-content:space-between;">
             <a href="#/packets/${encodeURIComponent(p.hash || '')}" style="color:var(--accent);text-decoration:none;">${escapeHtml(p.payload_type || '?')}${p.observation_count > 1 ? ' <span class="badge badge-obs" style="font-size:9px">👁 ' + p.observation_count + '</span>' : ''}</a>
-            <span style="color:var(--text-muted)">${p.timestamp ? timeAgo(p.timestamp) : '—'}</span>
+            <span style="color:var(--text-muted)">${formatLiveTimestampHtml(p.timestamp)}</span>
           </div>`).join('') +
           '</div>';
       }
@@ -1399,7 +1419,7 @@
         <span class="feed-type" style="color:${color}">${typeName}</span>
         ${hopStr}${obsBadge}
         <span class="feed-text">${escapeHtml(preview)}</span>
-        <span class="feed-time">${new Date(group.latestTs || Date.now()).toLocaleTimeString([], {hour:'2-digit',minute:'2-digit',second:'2-digit'})}</span>
+        <span class="feed-time">${formatLiveTimestampHtml(group.latestTs || Date.now())}</span>
       `;
       item.addEventListener('click', () => showFeedCard(item, pkt, color));
       feed.appendChild(item);
@@ -2263,7 +2283,7 @@
       <span class="feed-type" style="color:${color}">${typeName}</span>
       ${hopStr}${obsBadge}
       <span class="feed-text">${escapeHtml(preview)}</span>
-      <span class="feed-time">${new Date(pkt._ts || Date.now()).toLocaleTimeString([], {hour:'2-digit',minute:'2-digit',second:'2-digit'})}</span>
+      <span class="feed-time">${formatLiveTimestampHtml(pkt._ts || Date.now())}</span>
     `;
     item.addEventListener('click', () => showFeedCard(item, pkt, color));
     feed.appendChild(item);
@@ -2331,7 +2351,7 @@
       <span class="feed-type" style="color:${color}">${typeName}</span>
       ${hopStr}${obsBadge}
       <span class="feed-text">${escapeHtml(preview)}</span>
-      <span class="feed-time">${new Date(pkt._ts || Date.now()).toLocaleTimeString([], {hour:'2-digit',minute:'2-digit',second:'2-digit'})}</span>
+      <span class="feed-time">${formatLiveTimestampHtml(pkt._ts || Date.now())}</span>
     `;
     item.addEventListener('click', () => showFeedCard(item, pkt, color));
     feed.prepend(item);
@@ -2431,9 +2451,10 @@
       }
       _navCleanup = null;
     }
-    nodesLayer = pathsLayer = animLayer = heatLayer = null;
+    nodesLayer = pathsLayer = animLayer = heatLayer = geoFilterLayer = null;
     stopMatrixRain();
     nodeMarkers = {}; nodeData = {};
+    activeNodeDetailKey = null;
     recentPaths = [];
     packetCount = 0; activeAnims = 0;
     nodeActivity = {}; pktTimestamps = [];
@@ -2445,7 +2466,10 @@
 
   registerPage('live', {
     init: function(app, routeParam) {
-      _themeRefreshHandler = () => { /* live map rebuilds on next packet */ };
+      _themeRefreshHandler = () => {
+        rebuildFeedList();
+        if (activeNodeDetailKey) showNodeDetail(activeNodeDetailKey);
+      };
       window.addEventListener('theme-refresh', _themeRefreshHandler);
       return init(app, routeParam);
     },

public/map.js

@@ -12,6 +12,7 @@
   let filters = { repeater: true, companion: true, room: true, sensor: true, observer: true, lastHeard: '30d', neighbors: false, clusters: false, hashLabels: localStorage.getItem('meshcore-map-hash-labels') !== 'false', statusFilter: localStorage.getItem('meshcore-map-status-filter') || 'all' };
   let wsHandler = null;
   let heatLayer = null;
+  let geoFilterLayer = null;
   let userHasMoved = false;
   let controlsCollapsed = false;
 
@@ -94,6 +95,7 @@
             <label for="mcClusters"><input type="checkbox" id="mcClusters"> Show clusters</label>
             <label for="mcHeatmap"><input type="checkbox" id="mcHeatmap"> Heat map</label>
             <label for="mcHashLabels"><input type="checkbox" id="mcHashLabels"> Hash prefix labels</label>
+            <label for="mcGeoFilter" id="mcGeoFilterLabel" style="display:none"><input type="checkbox" id="mcGeoFilter"> Geo filter area</label>
           </fieldset>
           <fieldset class="mc-section">
             <legend class="mc-label">Status</legend>
@@ -225,6 +227,9 @@
       });
     });
 
+    // Geo filter overlay
+    initGeoFilterOverlay(map, 'mcGeoFilter', 'mcGeoFilterLabel').then(function (layer) { geoFilterLayer = layer; });
+
     // WS for live advert updates
     wsHandler = debouncedOnWS(function (msgs) {
       if (msgs.some(function (m) { return m.type === 'packet' && m.data?.decoded?.header?.payloadTypeName === 'ADVERT'; })) {
@@ -727,6 +732,7 @@
     markerLayer = null;
     routeLayer = null;
     if (heatLayer) { heatLayer = null; }
+    geoFilterLayer = null;
   }
 
   function toggleHeatmap(on) {

public/nodes.js

@@ -85,6 +85,24 @@
     { key: 'sensor', label: 'Sensors' },
   ];
 
+  function renderNodeTimestampHtml(isoString) {
+    if (typeof formatTimestampWithTooltip !== 'function' || typeof getTimestampMode !== 'function') {
+      return escapeHtml(typeof timeAgo === 'function' ? timeAgo(isoString) : '—');
+    }
+    const f = formatTimestampWithTooltip(isoString, getTimestampMode());
+    const warn = f.isFuture
+      ? ' <span class="timestamp-future-icon" title="Timestamp is in the future — node clock may be skewed">⚠️</span>'
+      : '';
+    return `<span class="timestamp-text" title="${escapeHtml(f.tooltip)}">${escapeHtml(f.text)}</span>${warn}`;
+  }
+
+  function renderNodeTimestampText(isoString) {
+    if (typeof formatTimestamp !== 'function' || typeof getTimestampMode !== 'function') {
+      return typeof timeAgo === 'function' ? timeAgo(isoString) : '—';
+    }
+    return formatTimestamp(isoString, getTimestampMode());
+  }
+
   /* === Shared helper functions for node detail rendering === */
 
   function getStatusTooltip(role, status) {
@@ -117,7 +135,7 @@
 
     let explanation = '';
     if (status === 'active') {
-      explanation = 'Last heard ' + (lastHeardTime ? timeAgo(lastHeardTime) : 'unknown');
+      explanation = 'Last heard ' + (lastHeardTime ? renderNodeTimestampText(lastHeardTime) : 'unknown');
     } else {
       const ageDays = Math.floor(statusAge / 86400000);
       const ageHours = Math.floor(statusAge / 3600000);
@@ -274,8 +292,8 @@
 
         <table class="node-stats-table" id="node-stats">
           <tr><td>Status</td><td><span title="${si.statusTooltip}">${statusLabel}</span> <span style="font-size:11px;color:var(--text-muted);margin-left:4px">${statusExplanation}</span></td></tr>
-          <tr><td>Last Heard</td><td>${lastHeard ? timeAgo(lastHeard) : (n.last_seen ? timeAgo(n.last_seen) : '—')}</td></tr>
-          <tr><td>First Seen</td><td>${n.first_seen ? new Date(n.first_seen).toLocaleString() : '—'}</td></tr>
+          <tr><td>Last Heard</td><td>${renderNodeTimestampHtml(lastHeard || n.last_seen)}</td></tr>
+          <tr><td>First Seen</td><td>${renderNodeTimestampHtml(n.first_seen)}</td></tr>
           <tr><td>Total Packets</td><td>${stats.totalTransmissions || stats.totalPackets || n.advert_count || 0}${stats.totalObservations && stats.totalObservations !== (stats.totalTransmissions || stats.totalPackets) ? ' <span class="text-muted" style="font-size:0.85em">(seen ' + stats.totalObservations + '×)</span>' : ''}</td></tr>
           <tr><td>Packets Today</td><td>${stats.packetsToday || 0}</td></tr>
           ${stats.avgSnr != null ? `<tr><td>Avg SNR</td><td>${Number(stats.avgSnr).toFixed(1)} dB</td></tr>` : ''}
@@ -327,7 +345,7 @@
                 hashSizeBadge = ` <span class="badge" style="background:${hsColor};color:${hsFg};font-size:9px;font-family:var(--mono)">${hs}B</span>`;
               }
               return `<div class="node-activity-item">
-                <span class="node-activity-time">${timeAgo(p.timestamp)}</span>
+                <span class="node-activity-time">${renderNodeTimestampHtml(p.timestamp)}</span>
                 <span>${typeLabel}${detail}${hashSizeBadge}${obsBadge}${obs ? ' via ' + escapeHtml(obs) : ''}${snr}${rssi}</span>
                 <a href="#/packets/${p.hash}" class="ch-analyze-link" style="margin-left:8px;font-size:0.8em">Analyze →</a>
               </div>`;
@@ -406,7 +424,7 @@
             }).join(' → ');
             return `<div style="padding:6px 0;border-bottom:1px solid var(--border);font-size:12px">
               <div>${chain}</div>
-              <div style="color:var(--text-muted);margin-top:2px">${p.count}× · last ${timeAgo(p.lastSeen)} · <a href="#/packets/${p.sampleHash}" class="ch-analyze-link">Analyze →</a></div>
+              <div style="color:var(--text-muted);margin-top:2px">${p.count}× · last ${renderNodeTimestampHtml(p.lastSeen)} · <a href="#/packets/${p.sampleHash}" class="ch-analyze-link">Analyze →</a></div>
             </div>`;
           }).join('');
         }
@@ -429,7 +447,7 @@
     }
   }
 
-    function destroy() {
+  function destroy() {
     if (wsHandler) offWS(wsHandler);
     wsHandler = null;
     if (detailMap) { detailMap.remove(); detailMap = null; }
@@ -439,6 +457,8 @@
     selectedKey = null;
   }
 
+  let _themeRefreshHandler = null;
+
   let _allNodes = null; // cached full node list
 
   // Build a map of lowercased name → count of distinct pubkeys sharing that name
@@ -677,7 +697,7 @@
         <td>${favStar(n.public_key, 'node-fav')}${isClaimed ? '<span class="claimed-badge" title="My Mesh">★</span> ' : ''}<strong>${n.name || '(unnamed)'}</strong>${dupNameBadge(n.name, n.public_key, dupMap)}</td>
         <td class="mono col-pubkey">${truncate(n.public_key, 16)}</td>
         <td><span class="badge" style="background:${roleColor}20;color:${roleColor}">${n.role}</span></td>
-        <td class="${lastSeenClass}">${timeAgo(n.last_heard || n.last_seen)}</td>
+        <td class="${lastSeenClass}">${renderNodeTimestampHtml(n.last_heard || n.last_seen)}</td>
         <td>${n.advert_count || 0}</td>
       </tr>`;
     }).join('');
@@ -750,8 +770,8 @@
         <div class="node-detail-section">
           <h4>Overview</h4>
           <dl class="detail-meta">
-            <dt>Last Heard</dt><dd>${lastHeard ? timeAgo(lastHeard) : (n.last_seen ? timeAgo(n.last_seen) : '—')}</dd>
-            <dt>First Seen</dt><dd>${n.first_seen ? new Date(n.first_seen).toLocaleString() : '—'}</dd>
+            <dt>Last Heard</dt><dd>${renderNodeTimestampHtml(lastHeard || n.last_seen)}</dd>
+            <dt>First Seen</dt><dd>${renderNodeTimestampHtml(n.first_seen)}</dd>
             <dt>Total Packets</dt><dd>${totalPackets}</dd>
             <dt>Packets Today</dt><dd>${stats.packetsToday || 0}</dd>
             ${stats.avgSnr != null ? `<dt>Avg SNR</dt><dd>${Number(stats.avgSnr).toFixed(1)} dB</dd>` : ''}
@@ -789,7 +809,7 @@
               return `<div class="advert-entry">
                 <span class="advert-dot" style="background:${roleColor}"></span>
                 <div class="advert-info">
-                  <strong>${timeAgo(a.timestamp)}</strong> ${icon} ${pType}${detail}
+                  <strong>${renderNodeTimestampHtml(a.timestamp)}</strong> ${icon} ${pType}${detail}
                   ${a.observation_count > 1 ? ' <span class="badge badge-obs">👁 ' + a.observation_count + '</span>' : ''}
                   ${obs ? ' via ' + escapeHtml(obs) : ''}
                   ${a.snr != null ? ` · SNR ${a.snr}dB` : ''}${a.rssi != null ? ` · RSSI ${a.rssi}dBm` : ''}
@@ -863,7 +883,7 @@
           }).join(' → ');
           return `<div style="padding:6px 0;border-bottom:1px solid var(--border);font-size:12px">
             <div>${chain}</div>
-            <div style="color:var(--text-muted);margin-top:2px">${p.count}× · last ${timeAgo(p.lastSeen)} · <a href="#/packets/${p.sampleHash}" class="ch-analyze-link">Analyze →</a></div>
+            <div style="color:var(--text-muted);margin-top:2px">${p.count}× · last ${renderNodeTimestampHtml(p.lastSeen)} · <a href="#/packets/${p.sampleHash}" class="ch-analyze-link">Analyze →</a></div>
           </div>`;
         }).join('');
       }
@@ -889,7 +909,23 @@
     return false;
   }
 
-  registerPage('nodes', { init, destroy });
+  registerPage('nodes', {
+    init: function(app, routeParam) {
+      _themeRefreshHandler = () => {
+        if (directNode) loadFullNode(directNode);
+        else {
+          renderRows();
+          if (selectedKey) selectNode(selectedKey);
+        }
+      };
+      window.addEventListener('theme-refresh', _themeRefreshHandler);
+      return init(app, routeParam);
+    },
+    destroy: function() {
+      if (_themeRefreshHandler) { window.removeEventListener('theme-refresh', _themeRefreshHandler); _themeRefreshHandler = null; }
+      return destroy();
+    }
+  });
 
   // Test hooks
   window._nodesIsAdvertMessage = isAdvertMessage;

public/packets.js

@@ -157,9 +157,44 @@
   let directPacketId = null;
   let directPacketHash = null;
   let initGeneration = 0;
+  let _docActionHandler = null;
+  let _docMenuCloseHandler = null;
+  let _docColMenuCloseHandler = null;
+  let _docEscHandler = null;
 
   let directObsId = null;
 
+  function removeAllByopOverlays() {
+    document.querySelectorAll('.byop-overlay').forEach(function (el) { el.remove(); });
+  }
+
+  function bindDocumentHandler(kind, eventName, handler) {
+    const prev = kind === 'action'
+      ? _docActionHandler
+      : kind === 'menu'
+        ? _docMenuCloseHandler
+        : kind === 'colmenu'
+          ? _docColMenuCloseHandler
+          : _docEscHandler;
+    if (prev) document.removeEventListener(eventName, prev);
+    document.addEventListener(eventName, handler);
+    if (kind === 'action') _docActionHandler = handler;
+    else if (kind === 'menu') _docMenuCloseHandler = handler;
+    else if (kind === 'colmenu') _docColMenuCloseHandler = handler;
+    else _docEscHandler = handler;
+  }
+
+  function renderTimestampCell(isoString) {
+    if (typeof formatTimestampWithTooltip !== 'function' || typeof getTimestampMode !== 'function') {
+      return escapeHtml(typeof timeAgo === 'function' ? timeAgo(isoString) : '—');
+    }
+    const f = formatTimestampWithTooltip(isoString, getTimestampMode());
+    const warn = f.isFuture
+      ? ' <span class="timestamp-future-icon" title="Timestamp is in the future — node clock may be skewed">⚠️</span>'
+      : '';
+    return `<span class="timestamp-text" title="${escapeHtml(f.tooltip)}">${escapeHtml(f.text)}</span>${warn}`;
+  }
+
   async function init(app, routeParam) {
     const gen = ++initGeneration;
     // Parse ?obs=OBSERVER_ID from routeParam
@@ -226,7 +261,7 @@
     }
 
     // Event delegation for data-action buttons
-    document.addEventListener('click', function (e) {
+    bindDocumentHandler('action', 'click', function (e) {
       var btn = e.target.closest('[data-action]');
       if (!btn) return;
       if (btn.dataset.action === 'pkt-refresh') loadPackets();
@@ -365,6 +400,11 @@
   function destroy() {
     if (wsHandler) offWS(wsHandler);
     wsHandler = null;
+    if (_docActionHandler) { document.removeEventListener('click', _docActionHandler); _docActionHandler = null; }
+    if (_docMenuCloseHandler) { document.removeEventListener('click', _docMenuCloseHandler); _docMenuCloseHandler = null; }
+    if (_docColMenuCloseHandler) { document.removeEventListener('click', _docColMenuCloseHandler); _docColMenuCloseHandler = null; }
+    if (_docEscHandler) { document.removeEventListener('keydown', _docEscHandler); _docEscHandler = null; }
+    removeAllByopOverlays();
     packets = [];
     hashIndex = new Map();    selectedId = null;
     filtersBuilt = false;
@@ -694,7 +734,7 @@
     });
 
     // Close multi-select menus on outside click
-    document.addEventListener('click', (e) => {
+    bindDocumentHandler('menu', 'click', (e) => {
       const obsWrap = document.getElementById('observerFilterWrap');
       const typeWrap = document.getElementById('typeFilterWrap');
       if (obsWrap && !obsWrap.contains(e.target)) { const m = obsWrap.querySelector('.multi-select-menu'); if (m) m.classList.remove('open'); }
@@ -809,7 +849,7 @@
       e.stopPropagation();
       colMenu.classList.toggle('open');
     });
-    document.addEventListener('click', () => colMenu.classList.remove('open'));
+    bindDocumentHandler('colmenu', 'click', () => colMenu.classList.remove('open'));
     applyColVisibility();
 
     document.getElementById('hexHashToggle').addEventListener('click', function () {
@@ -932,7 +972,7 @@
     }
 
     // Escape to close packet detail panel
-    document.addEventListener('keydown', function pktEsc(e) {
+    bindDocumentHandler('esc', 'keydown', function pktEsc(e) {
       if (e.key === 'Escape') {
         closeDetailPanel();
       }
@@ -1024,7 +1064,7 @@
         html += `<tr class="${isSingle ? '' : 'group-header'} ${isExpanded ? 'expanded' : ''}" data-hash="${p.hash}" data-action="${isSingle ? 'select-hash' : 'toggle-select'}" data-value="${p.hash}" tabindex="0" role="row">
           <td style="width:28px;text-align:center;cursor:pointer">${isSingle ? '' : (isExpanded ? '▼' : '▶')}</td>
           <td class="col-region">${groupRegion ? `<span class="badge-region">${groupRegion}</span>` : '—'}</td>
-          <td class="col-time">${timeAgo(p.latest)}</td>
+          <td class="col-time">${renderTimestampCell(p.latest)}</td>
           <td class="mono col-hash">${truncate(p.hash || '—', 8)}</td>
           <td class="col-size">${groupSize ? groupSize + 'B' : '—'}</td>
           <td class="col-type">${p.payload_type != null ? `<span class="badge badge-${groupTypeClass}">${groupTypeName}</span>` : '—'}</td>
@@ -1051,7 +1091,7 @@
             const childPathStr = renderPath(childPath, c.observer_id);
             html += `<tr class="group-child" data-id="${c.id}" data-hash="${c.hash || ''}" data-action="select-observation" data-value="${c.id}" data-parent-hash="${p.hash}" tabindex="0" role="row">
               <td></td><td class="col-region">${childRegion ? `<span class="badge-region">${childRegion}</span>` : '—'}</td>
-              <td class="col-time">${timeAgo(c.timestamp)}</td>
+              <td class="col-time">${renderTimestampCell(c.timestamp)}</td>
               <td class="mono col-hash">${truncate(c.hash || '', 8)}</td>
               <td class="col-size">${size}B</td>
               <td class="col-type"><span class="badge badge-${typeClass}">${typeName}</span></td>
@@ -1080,7 +1120,7 @@
 
       return `<tr data-id="${p.id}" data-hash="${p.hash || ''}" data-action="select-hash" data-value="${p.hash || p.id}" tabindex="0" role="row" class="${selectedId === p.id ? 'selected' : ''}">
         <td></td><td class="col-region">${region ? `<span class="badge-region">${region}</span>` : '—'}</td>
-        <td class="col-time">${timeAgo(p.timestamp)}</td>
+        <td class="col-time">${renderTimestampCell(p.timestamp)}</td>
         <td class="mono col-hash">${truncate(p.hash || String(p.id), 8)}</td>
         <td class="col-size">${size}B</td>
         <td class="col-type"><span class="badge badge-${typeClass}">${typeName}</span></td>
@@ -1330,7 +1370,7 @@
         <dt>Route Type</dt><dd>${routeTypeName(pkt.route_type)}</dd>
         <dt>Payload Type</dt><dd><span class="badge badge-${payloadTypeColor(pkt.payload_type)}">${typeName}</span></dd>
         ${hashSize ? `<dt>Hash Size</dt><dd>${hashSize} byte${hashSize !== 1 ? 's' : ''}</dd>` : ''}
-        <dt>Timestamp</dt><dd>${pkt.timestamp}</dd>
+        <dt>Timestamp</dt><dd>${renderTimestampCell(pkt.timestamp)}</dd>
         <dt>Propagation</dt><dd>${propagationHtml}</dd>
         <dt>Path</dt><dd>${pathHops.length ? renderPath(pathHops, pkt.observer_id) : '—'}</dd>
       </dl>
@@ -1537,9 +1577,10 @@
 
   // BYOP modal — decode only, no DB injection
   function showBYOP() {
+    removeAllByopOverlays();
     const triggerBtn = document.querySelector('[data-action="pkt-byop"]');
     const overlay = document.createElement('div');
-    overlay.className = 'modal-overlay';
+    overlay.className = 'modal-overlay byop-overlay';
     overlay.innerHTML = '<div class="modal byop-modal" role="dialog" aria-label="Decode a Packet" aria-modal="true">'
       + '<div class="byop-header"><h3>📦 Decode a Packet</h3><button class="btn-icon byop-x" title="Close" aria-label="Close dialog">✕</button></div>'
       + '<p class="text-muted" style="margin:0 0 12px;font-size:.85rem">Paste raw hex bytes from your radio or MQTT feed:</p>'
@@ -1550,7 +1591,7 @@
     document.body.appendChild(overlay);
 
     const modal = overlay.querySelector('.byop-modal');
-    const close = () => { overlay.remove(); if (triggerBtn) triggerBtn.focus(); };
+    const close = () => { removeAllByopOverlays(); if (triggerBtn) triggerBtn.focus(); };
     overlay.querySelector('.byop-x').onclick = close;
     overlay.addEventListener('click', (e) => { if (e.target === overlay) close(); });
 
@@ -1586,7 +1627,7 @@
 
     async function doDecode() {
       const hex = textarea.value.trim().replace(/[\s\n]/g, '');
-      const result = document.getElementById('byopResult');
+      const result = overlay.querySelector('#byopResult');
       if (!hex) { result.innerHTML = '<p class="text-muted">Enter hex data</p>'; return; }
       if (!/^[0-9a-fA-F]+$/.test(hex)) { result.innerHTML = '<p class="byop-err" role="alert">Invalid hex — only 0-9 and A-F allowed</p>'; return; }
       result.innerHTML = '<p class="text-muted">Decoding...</p>';

public/style.css

@@ -280,6 +280,8 @@ a:focus-visible, button:focus-visible, input:focus-visible, select:focus-visible
 }
 .data-table td.col-details { white-space: normal; word-break: break-word; }
 .data-table td:has(.spark-bar), .data-table td.col-spark { max-width: none; overflow: visible; min-width: 80px; }
+.data-table .col-time { min-width: 108px; white-space: nowrap; }
+.timestamp-future-icon { margin-left: 4px; cursor: help; }
 .data-table tbody tr:nth-child(even) { background: var(--row-stripe); }
 .data-table tbody tr:hover { background: var(--row-hover); cursor: pointer; }
 .data-table tbody tr.selected { background: var(--selected-bg); }
@@ -879,6 +881,7 @@ button.ch-item.selected { background: var(--selected-bg); }
   .data-table { font-size: 11px; min-width: 0; }
   .data-table td { padding: 5px 4px; max-width: 100px; }
   .data-table th { padding: 5px 4px; font-size: 10px; }
+  .data-table .col-time { min-width: 64px; }
   .panel-left { overflow-x: auto; }
 
   /* Filters: collapse on mobile */
@@ -1096,6 +1099,22 @@ button.ch-item.ch-item-encrypted .ch-badge { filter: grayscale(0.6); }
 .hash-bar-fill { height: 100%; border-radius: 4px; transition: width .3s; }
 .hash-cell.hash-active:hover { outline: 2px solid var(--accent); outline-offset: -2px; }
 .hash-cell.hash-selected { outline: 2px solid var(--accent); outline-offset: -2px; box-shadow: 0 0 6px var(--accent); }
+.hash-cell-empty  { background: var(--card-bg); color: var(--text-muted); }
+.hash-cell-taken  { background: var(--status-green); color: #fff; }
+.hash-cell-possible { background: var(--status-yellow); color: #fff; }
+.hash-cell-collision { color: #fff; }
+.hash-matrix-tooltip {
+  position: fixed; z-index: 9999; background: var(--surface-1); border: 1px solid var(--border);
+  border-radius: 8px; box-shadow: 0 8px 24px rgba(0,0,0,0.25); padding: 8px 12px;
+  font-size: 12px; min-width: 160px; max-width: 260px; pointer-events: none;
+}
+.hash-matrix-tooltip-hex { font-family: var(--mono); font-size: 13px; font-weight: 700; margin-bottom: 4px; color: var(--accent); }
+.hash-matrix-tooltip-status { color: var(--text-muted); font-size: 11px; }
+.hash-matrix-tooltip-nodes { margin-top: 6px; display: flex; flex-direction: column; gap: 2px; }
+.hash-byte-selector { display: flex; gap: 4px; }
+.hash-byte-btn { padding: 4px 12px; border-radius: 20px; border: 1px solid var(--border); background: var(--card-bg); color: var(--text-muted); font-size: 12px; font-weight: 600; cursor: pointer; transition: background .15s, color .15s; }
+.hash-byte-btn:hover { background: var(--border); color: var(--text); }
+.hash-byte-btn.active { background: var(--accent); color: #fff; border-color: var(--accent); }
 .hash-bar-value { min-width: 120px; text-align: right; font-size: 13px; font-weight: 600; }
 .badge-hash-1 { background: #ef444420; color: var(--status-red); }
 .badge-hash-2 { background: #22c55e20; color: var(--status-green); }

scripts/capture-fixture.sh

@@ -0,0 +1,142 @@
+#!/bin/bash
+# Capture a fixture DB from staging for E2E tests
+# Usage: ./scripts/capture-fixture.sh [source_url]
+#
+# Downloads nodes, observers, and recent packets from the staging API
+# and creates a SQLite database suitable for E2E testing.
+
+set -e
+
+SOURCE_URL="${1:-https://analyzer.00id.net}"
+DB_PATH="test-fixtures/e2e-fixture.db"
+
+echo "Capturing fixture from $SOURCE_URL..."
+
+mkdir -p test-fixtures
+rm -f "$DB_PATH"
+
+# Create schema
+sqlite3 "$DB_PATH" <<'SQL'
+CREATE TABLE nodes (
+    public_key TEXT PRIMARY KEY,
+    name TEXT,
+    role TEXT,
+    lat REAL,
+    lon REAL,
+    last_seen TEXT,
+    first_seen TEXT,
+    advert_count INTEGER DEFAULT 0,
+    battery_mv INTEGER,
+    temperature_c REAL
+);
+
+CREATE TABLE observers (
+    id TEXT PRIMARY KEY,
+    name TEXT,
+    iata TEXT,
+    last_seen TEXT,
+    first_seen TEXT,
+    packet_count INTEGER DEFAULT 0,
+    model TEXT,
+    firmware TEXT,
+    client_version TEXT,
+    radio TEXT,
+    battery_mv INTEGER,
+    uptime_secs INTEGER,
+    noise_floor REAL
+);
+
+CREATE TABLE transmissions (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    raw_hex TEXT NOT NULL,
+    hash TEXT NOT NULL UNIQUE,
+    first_seen TEXT NOT NULL,
+    route_type INTEGER,
+    payload_type INTEGER,
+    payload_version INTEGER,
+    decoded_json TEXT,
+    created_at TEXT DEFAULT (datetime('now'))
+);
+
+CREATE TABLE observations (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
+    observer_idx INTEGER,
+    direction TEXT,
+    snr REAL,
+    rssi REAL,
+    score INTEGER,
+    path_json TEXT,
+    timestamp INTEGER NOT NULL
+);
+SQL
+
+# Fetch nodes
+echo "Fetching nodes..."
+curl -sf "$SOURCE_URL/api/nodes?limit=200" | python3 -c "
+import json, sys, sqlite3
+data = json.load(sys.stdin)
+nodes = data.get('nodes', data) if isinstance(data, dict) else data
+db = sqlite3.connect('$DB_PATH')
+for n in nodes[:200]:
+    db.execute('INSERT OR IGNORE INTO nodes VALUES (?,?,?,?,?,?,?,?,?,?)',
+        (n.get('public_key',''), n.get('name',''), n.get('role',''),
+         n.get('lat'), n.get('lon'), n.get('last_seen',''), n.get('first_seen',''),
+         n.get('advert_count',0), n.get('battery_mv'), n.get('temperature_c')))
+db.commit()
+print(f'  Inserted {min(len(nodes), 200)} nodes')
+db.close()
+"
+
+# Fetch observers
+echo "Fetching observers..."
+curl -sf "$SOURCE_URL/api/observers" | python3 -c "
+import json, sys, sqlite3
+data = json.load(sys.stdin)
+observers = data.get('observers', data) if isinstance(data, dict) else data
+db = sqlite3.connect('$DB_PATH')
+for o in observers:
+    db.execute('INSERT OR IGNORE INTO observers VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)',
+        (o.get('id',''), o.get('name',''), o.get('iata',''),
+         o.get('last_seen',''), o.get('first_seen',''),
+         o.get('packet_count',0), o.get('model',''), o.get('firmware',''),
+         o.get('client_version',''), o.get('radio',''),
+         o.get('battery_mv'), o.get('uptime_secs'), o.get('noise_floor')))
+db.commit()
+print(f'  Inserted {len(observers)} observers')
+db.close()
+"
+
+# Fetch recent packets
+echo "Fetching recent packets..."
+curl -sf "$SOURCE_URL/api/packets?limit=500" | python3 -c "
+import json, sys, sqlite3
+data = json.load(sys.stdin)
+packets = data.get('packets', data) if isinstance(data, dict) else data
+db = sqlite3.connect('$DB_PATH')
+for p in packets:
+    try:
+        cur = db.execute('INSERT OR IGNORE INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, payload_version, decoded_json) VALUES (?,?,?,?,?,?,?)',
+            (p.get('raw_hex',''), p.get('hash',''), p.get('first_seen',''),
+             p.get('route_type'), p.get('payload_type'), p.get('payload_version'),
+             p.get('decoded_json')))
+        tid = cur.lastrowid
+        if tid and p.get('observer_id'):
+            db.execute('INSERT INTO observations (transmission_id, observer_idx, direction, snr, rssi, score, path_json, timestamp) VALUES (?,?,?,?,?,?,?,?)',
+                (tid, p.get('observer_id'), p.get('direction'),
+                 p.get('snr'), p.get('rssi'), None,
+                 p.get('path_json'),
+                 int(p.get('timestamp','0')) if p.get('timestamp','').isdigit() else 0))
+    except Exception as e:
+        pass  # Skip duplicates
+db.commit()
+print(f'  Inserted {len(packets)} transmissions')
+db.close()
+"
+
+SIZE=$(du -h "$DB_PATH" | cut -f1)
+echo "✅ Fixture DB created: $DB_PATH ($SIZE)"
+echo "   Nodes: $(sqlite3 "$DB_PATH" 'SELECT COUNT(*) FROM nodes')"
+echo "   Observers: $(sqlite3 "$DB_PATH" 'SELECT COUNT(*) FROM observers')"
+echo "   Transmissions: $(sqlite3 "$DB_PATH" 'SELECT COUNT(*) FROM transmissions')"
+echo "   Observations: $(sqlite3 "$DB_PATH" 'SELECT COUNT(*) FROM observations')"

scripts/combined-coverage.sh

@@ -1,27 +1,10 @@
 #!/bin/sh
-# Run server-side tests with c8, then frontend coverage with nyc
+# Combined coverage: Go backend + frontend via Playwright
+# TODO: Update to use Go server binary instead of removed Node.js server.
+# The old flow used `node server.js` — now use the Go binary from cmd/server/.
 set -e
 
-# 1. Server-side coverage (existing)
-npx c8 --reporter=json --reports-dir=.nyc_output node tools/e2e-test.js
-
-# 2. Instrument frontend
-sh scripts/instrument-frontend.sh
-
-# 3. Start instrumented server
-COVERAGE=1 PORT=13581 node server.js &
-SERVER_PID=$!
-sleep 5
-
-# 4. Run Playwright tests (exercises frontend code)
-BASE_URL=http://localhost:13581 node test-e2e-playwright.js || true
-BASE_URL=http://localhost:13581 node test-e2e-interactions.js || true
-
-# 5. Collect browser coverage
-BASE_URL=http://localhost:13581 node scripts/collect-frontend-coverage.js
-
-# 6. Kill server
-kill $SERVER_PID 2>/dev/null || true
-
-# 7. Generate combined report
-npx nyc report --reporter=text-summary --reporter=text
+echo "⚠️  combined-coverage.sh needs updating for Go server migration."
+echo "   The Node.js server (server.js) has been removed."
+echo "   Update this script to start the Go binary instead."
+exit 1

scripts/validate.sh

@@ -3,7 +3,6 @@
 set -e
 
 echo "=== Syntax check ==="
-node -c server.js
 for f in public/*.js; do node -c "$f"; done
 echo "✅ All JS files parse OK"
 

server-helpers.js

@@ -1,323 +0,0 @@
-'use strict';
-
-const path = require('path');
-const fs = require('fs');
-const crypto = require('crypto');
-
-// Config file loading
-const CONFIG_PATHS = [
-  path.join(__dirname, 'config.json'),
-  path.join(__dirname, 'data', 'config.json')
-];
-
-function loadConfigFile(configPaths) {
-  const paths = configPaths || CONFIG_PATHS;
-  for (const p of paths) {
-    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch {}
-  }
-  return {};
-}
-
-// Theme file loading
-const THEME_PATHS = [
-  path.join(__dirname, 'theme.json'),
-  path.join(__dirname, 'data', 'theme.json')
-];
-
-function loadThemeFile(themePaths) {
-  const paths = themePaths || THEME_PATHS;
-  for (const p of paths) {
-    try { return JSON.parse(fs.readFileSync(p, 'utf8')); } catch {}
-  }
-  return {};
-}
-
-// Health thresholds
-function buildHealthConfig(config) {
-  const _ht = (config && config.healthThresholds) || {};
-  return {
-    infraDegraded: _ht.infraDegradedHours || 24,
-    infraSilent:   _ht.infraSilentHours   || 72,
-    nodeDegraded:  _ht.nodeDegradedHours  || 1,
-    nodeSilent:    _ht.nodeSilentHours    || 24
-  };
-}
-
-function getHealthMs(role, HEALTH) {
-  const H = 3600000;
-  const isInfra = role === 'repeater' || role === 'room';
-  return {
-    degradedMs: (isInfra ? HEALTH.infraDegraded : HEALTH.nodeDegraded) * H,
-    silentMs:   (isInfra ? HEALTH.infraSilent   : HEALTH.nodeSilent)   * H
-  };
-}
-
-// Hash size flip-flop detection (pure — operates on provided maps)
-function isHashSizeFlipFlop(seq, allSizes) {
-  if (!seq || seq.length < 3) return false;
-  if (!allSizes || allSizes.size < 2) return false;
-  let transitions = 0;
-  for (let i = 1; i < seq.length; i++) {
-    if (seq[i] !== seq[i - 1]) transitions++;
-  }
-  return transitions >= 2;
-}
-
-// Compute content hash from raw hex
-function computeContentHash(rawHex) {
-  try {
-    const buf = Buffer.from(rawHex, 'hex');
-    if (buf.length < 2) return rawHex.slice(0, 16);
-    const pathByte = buf[1];
-    const hashSize = ((pathByte >> 6) & 0x3) + 1;
-    const hashCount = pathByte & 0x3F;
-    const pathBytes = hashSize * hashCount;
-    const payloadStart = 2 + pathBytes;
-    const payload = buf.subarray(payloadStart);
-    const toHash = Buffer.concat([Buffer.from([buf[0]]), payload]);
-    return crypto.createHash('sha256').update(toHash).digest('hex').slice(0, 16);
-  } catch { return rawHex.slice(0, 16); }
-}
-
-// Distance helper (degrees)
-function geoDist(lat1, lon1, lat2, lon2) {
-  return Math.sqrt((lat1 - lat2) ** 2 + (lon1 - lon2) ** 2);
-}
-
-// Derive hashtag channel key
-function deriveHashtagChannelKey(channelName) {
-  return crypto.createHash('sha256').update(channelName).digest('hex').slice(0, 32);
-}
-
-// Build hex breakdown ranges for packet detail view
-function buildBreakdown(rawHex, decoded, decodePacketFn, channelKeys) {
-  if (!rawHex) return {};
-  const buf = Buffer.from(rawHex, 'hex');
-  const ranges = [];
-
-  ranges.push({ start: 0, end: 0, color: 'red', label: 'Header' });
-  if (buf.length < 2) return { ranges };
-
-  ranges.push({ start: 1, end: 1, color: 'orange', label: 'Path Length' });
-
-  const header = decodePacketFn ? decodePacketFn(rawHex, channelKeys || {}) : null;
-  let offset = 2;
-
-  if (header && header.transportCodes) {
-    ranges.push({ start: 2, end: 5, color: 'blue', label: 'Transport Codes' });
-    offset = 6;
-  }
-
-  const pathByte = buf[1];
-  const hashSize = (pathByte >> 6) + 1;
-  const hashCount = pathByte & 0x3F;
-  const pathBytes = hashSize * hashCount;
-  if (pathBytes > 0) {
-    ranges.push({ start: offset, end: offset + pathBytes - 1, color: 'green', label: 'Path' });
-  }
-  const payloadStart = offset + pathBytes;
-
-  if (payloadStart < buf.length) {
-    ranges.push({ start: payloadStart, end: buf.length - 1, color: 'yellow', label: 'Payload' });
-
-    if (decoded && decoded.type === 'ADVERT') {
-      const ps = payloadStart;
-      const subRanges = [];
-      subRanges.push({ start: ps, end: ps + 31, color: '#FFD700', label: 'PubKey' });
-      subRanges.push({ start: ps + 32, end: ps + 35, color: '#FFA500', label: 'Timestamp' });
-      subRanges.push({ start: ps + 36, end: ps + 99, color: '#FF6347', label: 'Signature' });
-      if (buf.length > ps + 100) {
-        subRanges.push({ start: ps + 100, end: ps + 100, color: '#7FFFD4', label: 'Flags' });
-        let off = ps + 101;
-        const flags = buf[ps + 100];
-        if (flags & 0x10 && buf.length >= off + 8) {
-          subRanges.push({ start: off, end: off + 3, color: '#87CEEB', label: 'Latitude' });
-          subRanges.push({ start: off + 4, end: off + 7, color: '#87CEEB', label: 'Longitude' });
-          off += 8;
-        }
-        if (flags & 0x80 && off < buf.length) {
-          subRanges.push({ start: off, end: buf.length - 1, color: '#DDA0DD', label: 'Name' });
-        }
-      }
-      ranges.push(...subRanges);
-    }
-  }
-
-  return { ranges };
-}
-
-// Disambiguate hop prefixes to full nodes
-function disambiguateHops(hops, allNodes, maxHopDist) {
-  const MAX_HOP_DIST = maxHopDist || 1.8;
-
-  if (!allNodes._prefixIdx) {
-    allNodes._prefixIdx = {};
-    allNodes._prefixIdxName = {};
-    for (const n of allNodes) {
-      const pk = n.public_key.toLowerCase();
-      for (let len = 1; len <= 3; len++) {
-        const p = pk.slice(0, len * 2);
-        if (!allNodes._prefixIdx[p]) allNodes._prefixIdx[p] = [];
-        allNodes._prefixIdx[p].push(n);
-        if (!allNodes._prefixIdxName[p]) allNodes._prefixIdxName[p] = n;
-      }
-    }
-  }
-
-  const resolved = hops.map(hop => {
-    const h = hop.toLowerCase();
-    const withCoords = (allNodes._prefixIdx[h] || []).filter(n => n.lat && n.lon && !(n.lat === 0 && n.lon === 0));
-    if (withCoords.length === 1) {
-      return { hop, name: withCoords[0].name, lat: withCoords[0].lat, lon: withCoords[0].lon, pubkey: withCoords[0].public_key, known: true };
-    } else if (withCoords.length > 1) {
-      return { hop, name: hop, lat: null, lon: null, pubkey: null, known: false, candidates: withCoords };
-    }
-    const nameMatch = allNodes._prefixIdxName[h];
-    return { hop, name: nameMatch?.name || hop, lat: null, lon: null, pubkey: nameMatch?.public_key || null, known: false };
-  });
-
-  let lastPos = null;
-  for (const r of resolved) {
-    if (r.known && r.lat) { lastPos = [r.lat, r.lon]; continue; }
-    if (!r.candidates) continue;
-    if (lastPos) r.candidates.sort((a, b) => geoDist(a.lat, a.lon, lastPos[0], lastPos[1]) - geoDist(b.lat, b.lon, lastPos[0], lastPos[1]));
-    const best = r.candidates[0];
-    r.name = best.name; r.lat = best.lat; r.lon = best.lon; r.pubkey = best.public_key; r.known = true;
-    lastPos = [r.lat, r.lon];
-  }
-
-  let nextPos = null;
-  for (let i = resolved.length - 1; i >= 0; i--) {
-    const r = resolved[i];
-    if (r.known && r.lat) { nextPos = [r.lat, r.lon]; continue; }
-    if (!r.candidates || !nextPos) continue;
-    r.candidates.sort((a, b) => geoDist(a.lat, a.lon, nextPos[0], nextPos[1]) - geoDist(b.lat, b.lon, nextPos[0], nextPos[1]));
-    const best = r.candidates[0];
-    r.name = best.name; r.lat = best.lat; r.lon = best.lon; r.pubkey = best.public_key; r.known = true;
-    nextPos = [r.lat, r.lon];
-  }
-
-  // Distance sanity check
-  for (let i = 0; i < resolved.length; i++) {
-    const r = resolved[i];
-    if (!r.lat) continue;
-    const prev = i > 0 && resolved[i-1].lat ? resolved[i-1] : null;
-    const next = i < resolved.length-1 && resolved[i+1].lat ? resolved[i+1] : null;
-    if (!prev && !next) continue;
-    const dPrev = prev ? geoDist(r.lat, r.lon, prev.lat, prev.lon) : 0;
-    const dNext = next ? geoDist(r.lat, r.lon, next.lat, next.lon) : 0;
-    if ((prev && dPrev > MAX_HOP_DIST) && (next && dNext > MAX_HOP_DIST)) { r.unreliable = true; r.lat = null; r.lon = null; }
-    else if (prev && !next && dPrev > MAX_HOP_DIST) { r.unreliable = true; r.lat = null; r.lon = null; }
-    else if (!prev && next && dNext > MAX_HOP_DIST) { r.unreliable = true; r.lat = null; r.lon = null; }
-  }
-
-  return resolved.map(r => ({ hop: r.hop, name: r.name, lat: r.lat, lon: r.lon, pubkey: r.pubkey, known: !!r.known, ambiguous: !!r.candidates, unreliable: !!r.unreliable }));
-}
-
-// Update hash_size maps for a single packet
-function updateHashSizeForPacket(p, hashSizeMap, hashSizeAllMap, hashSizeSeqMap) {
-  if (p.payload_type === 4 && p.raw_hex) {
-    try {
-      const d = typeof p.decoded_json === 'string' ? JSON.parse(p.decoded_json || '{}') : (p.decoded_json || {});
-      const pk = d.pubKey || d.public_key;
-      if (pk) {
-        const pathByte = parseInt(p.raw_hex.slice(2, 4), 16);
-        const hs = ((pathByte >> 6) & 0x3) + 1;
-        hashSizeMap.set(pk, hs);
-        if (!hashSizeAllMap.has(pk)) hashSizeAllMap.set(pk, new Set());
-        hashSizeAllMap.get(pk).add(hs);
-        if (!hashSizeSeqMap.has(pk)) hashSizeSeqMap.set(pk, []);
-        hashSizeSeqMap.get(pk).push(hs);
-      }
-    } catch {}
-  } else if (p.path_json && p.decoded_json) {
-    try {
-      const d = typeof p.decoded_json === 'string' ? JSON.parse(p.decoded_json) : p.decoded_json;
-      const pk = d.pubKey || d.public_key;
-      if (pk && !hashSizeMap.has(pk)) {
-        const hops = typeof p.path_json === 'string' ? JSON.parse(p.path_json) : p.path_json;
-        if (hops.length > 0) {
-          const pathByte = p.raw_hex ? parseInt(p.raw_hex.slice(2, 4), 16) : -1;
-          const hs = pathByte >= 0 ? ((pathByte >> 6) & 0x3) + 1 : (hops[0].length / 2);
-          if (hs >= 1 && hs <= 4) hashSizeMap.set(pk, hs);
-        }
-      }
-    } catch {}
-  }
-}
-
-// Rebuild all hash size maps from packet store
-function rebuildHashSizeMap(packets, hashSizeMap, hashSizeAllMap, hashSizeSeqMap) {
-  hashSizeMap.clear();
-  hashSizeAllMap.clear();
-  hashSizeSeqMap.clear();
-
-  // Pass 1: ADVERT packets
-  for (const p of packets) {
-    if (p.payload_type === 4 && p.raw_hex) {
-      try {
-        const d = JSON.parse(p.decoded_json || '{}');
-        const pk = d.pubKey || d.public_key;
-        if (pk) {
-          const pathByte = parseInt(p.raw_hex.slice(2, 4), 16);
-          const hs = ((pathByte >> 6) & 0x3) + 1;
-          if (!hashSizeMap.has(pk)) hashSizeMap.set(pk, hs);
-          if (!hashSizeAllMap.has(pk)) hashSizeAllMap.set(pk, new Set());
-          hashSizeAllMap.get(pk).add(hs);
-          if (!hashSizeSeqMap.has(pk)) hashSizeSeqMap.set(pk, []);
-          hashSizeSeqMap.get(pk).push(hs);
-        }
-      } catch {}
-    }
-  }
-  for (const [, seq] of hashSizeSeqMap) seq.reverse();
-
-  // Pass 2: fallback from path hops
-  for (const p of packets) {
-    if (p.path_json) {
-      try {
-        const hops = JSON.parse(p.path_json);
-        if (hops.length > 0) {
-          const hopLen = hops[0].length / 2;
-          if (hopLen >= 1 && hopLen <= 4) {
-            const pathByte = p.raw_hex ? parseInt(p.raw_hex.slice(2, 4), 16) : -1;
-            const hs = pathByte >= 0 ? ((pathByte >> 6) & 0x3) + 1 : hopLen;
-            if (p.decoded_json) {
-              const d = JSON.parse(p.decoded_json);
-              const pk = d.pubKey || d.public_key;
-              if (pk && !hashSizeMap.has(pk)) hashSizeMap.set(pk, hs);
-            }
-          }
-        }
-      } catch {}
-    }
-  }
-}
-
-// API key middleware factory
-function requireApiKey(apiKey) {
-  return function(req, res, next) {
-    if (!apiKey) return next();
-    const provided = req.headers['x-api-key'] || req.query.apiKey;
-    if (provided === apiKey) return next();
-    return res.status(401).json({ error: 'Invalid or missing API key' });
-  };
-}
-
-module.exports = {
-  loadConfigFile,
-  loadThemeFile,
-  buildHealthConfig,
-  getHealthMs,
-  isHashSizeFlipFlop,
-  computeContentHash,
-  geoDist,
-  deriveHashtagChannelKey,
-  buildBreakdown,
-  disambiguateHops,
-  updateHashSizeForPacket,
-  rebuildHashSizeMap,
-  requireApiKey,
-  CONFIG_PATHS,
-  THEME_PATHS
-};

test-all.sh

@@ -9,27 +9,12 @@ echo ""
 
 # Unit tests (deterministic, fast)
 echo "── Unit Tests ──"
-node test-decoder.js
-node test-decoder-spec.js
-node test-packet-store.js
 node test-packet-filter.js
 node test-aging.js
 node test-frontend-helpers.js
-node test-regional-filter.js
-node test-server-helpers.js
-node test-server-routes.js
-node test-db.js
-node test-db-migration.js
-
-# Integration tests (spin up temp servers)
-echo ""
-echo "── Integration Tests ──"
-node tools/e2e-test.js
-node tools/frontend-test.js
+node test-perf-go-runtime.js
 
 echo ""
 echo "═══════════════════════════════════════"
 echo "  All tests passed"
 echo "═══════════════════════════════════════"
-node test-server-routes.js
-# test trigger

test-db-migration.js

@@ -1,321 +0,0 @@
-'use strict';
-
-// Test v3 migration: create old-schema DB, run db.js to migrate, verify results
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const { execSync } = require('child_process');
-const Database = require('better-sqlite3');
-
-let passed = 0, failed = 0;
-function assert(cond, msg) {
-  if (cond) { passed++; console.log(`  ✅ ${msg}`); }
-  else { failed++; console.error(`  ❌ ${msg}`); }
-}
-
-console.log('── db.js v3 migration tests ──\n');
-
-// Helper: create a DB with old (v2) schema and test data
-function createOldSchemaDB(dbPath) {
-  const db = new Database(dbPath);
-  db.pragma('journal_mode = WAL');
-  db.pragma('foreign_keys = ON');
-
-  db.exec(`
-    CREATE TABLE nodes (
-      public_key TEXT PRIMARY KEY,
-      name TEXT,
-      role TEXT,
-      lat REAL,
-      lon REAL,
-      last_seen TEXT,
-      first_seen TEXT,
-      advert_count INTEGER DEFAULT 0
-    );
-
-    CREATE TABLE observers (
-      id TEXT PRIMARY KEY,
-      name TEXT,
-      iata TEXT,
-      last_seen TEXT,
-      first_seen TEXT,
-      packet_count INTEGER DEFAULT 0,
-      model TEXT,
-      firmware TEXT,
-      client_version TEXT,
-      radio TEXT,
-      battery_mv INTEGER,
-      uptime_secs INTEGER,
-      noise_floor INTEGER
-    );
-
-    CREATE TABLE transmissions (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      raw_hex TEXT NOT NULL,
-      hash TEXT NOT NULL UNIQUE,
-      first_seen TEXT NOT NULL,
-      route_type INTEGER,
-      payload_type INTEGER,
-      payload_version INTEGER,
-      decoded_json TEXT,
-      created_at TEXT DEFAULT (datetime('now'))
-    );
-
-    CREATE TABLE observations (
-      id INTEGER PRIMARY KEY AUTOINCREMENT,
-      transmission_id INTEGER NOT NULL REFERENCES transmissions(id),
-      hash TEXT NOT NULL,
-      observer_id TEXT,
-      observer_name TEXT,
-      direction TEXT,
-      snr REAL,
-      rssi REAL,
-      score INTEGER,
-      path_json TEXT,
-      timestamp TEXT NOT NULL,
-      created_at TEXT DEFAULT (datetime('now'))
-    );
-
-    CREATE INDEX idx_transmissions_hash ON transmissions(hash);
-    CREATE INDEX idx_observations_hash ON observations(hash);
-    CREATE INDEX idx_observations_transmission_id ON observations(transmission_id);
-    CREATE INDEX idx_observations_observer_id ON observations(observer_id);
-    CREATE INDEX idx_observations_timestamp ON observations(timestamp);
-    CREATE UNIQUE INDEX idx_observations_dedup ON observations(hash, observer_id, COALESCE(path_json, ''));
-  `);
-
-  // Insert test observers
-  db.prepare(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'Observer Alpha', 'SFO',
-    '2025-06-01T12:00:00Z', '2025-01-01T00:00:00Z', 100
-  );
-  db.prepare(`INSERT INTO observers (id, name, iata, last_seen, first_seen, packet_count) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    'deadbeef12345678deadbeef12345678deadbeef12345678deadbeef12345678', 'Observer Beta', 'LAX',
-    '2025-06-01T11:00:00Z', '2025-02-01T00:00:00Z', 50
-  );
-
-  // Insert test transmissions
-  db.prepare(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    '0400aabbccdd', 'hash-mig-001', '2025-06-01T10:00:00Z', 1, 4, '{"type":"ADVERT"}'
-  );
-  db.prepare(`INSERT INTO transmissions (raw_hex, hash, first_seen, route_type, payload_type, decoded_json) VALUES (?, ?, ?, ?, ?, ?)`).run(
-    '0400deadbeef', 'hash-mig-002', '2025-06-01T10:30:00Z', 2, 5, '{"type":"GRP_TXT"}'
-  );
-
-  // Insert test observations (old schema: has hash, observer_id, observer_name, text timestamp)
-  db.prepare(`INSERT INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
-    1, 'hash-mig-001', 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'Observer Alpha',
-    'rx', 12.5, -80, 85, '["aabb","ccdd"]', '2025-06-01T10:00:00Z'
-  );
-  db.prepare(`INSERT INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
-    1, 'hash-mig-001', 'deadbeef12345678deadbeef12345678deadbeef12345678deadbeef12345678', 'Observer Beta',
-    'rx', 8.0, -92, 70, '["aabb"]', '2025-06-01T10:01:00Z'
-  );
-  db.prepare(`INSERT INTO observations (transmission_id, hash, observer_id, observer_name, direction, snr, rssi, score, path_json, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(
-    2, 'hash-mig-002', 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'Observer Alpha',
-    'rx', 15.0, -75, 90, null, '2025-06-01T10:30:00Z'
-  );
-
-  db.close();
-}
-
-// Helper: require db.js in a child process with a given DB_PATH, return schema info
-function runDbModule(dbPath) {
-  const scriptPath = path.join(os.tmpdir(), 'meshcore-mig-test-script.js');
-  fs.writeFileSync(scriptPath, `
-    process.env.DB_PATH = ${JSON.stringify(dbPath)};
-    const db = require(${JSON.stringify(path.resolve(__dirname, 'db'))});
-    const cols = db.db.pragma('table_info(observations)').map(c => c.name);
-    const sv = db.db.pragma('user_version', { simple: true });
-    const obsCount = db.db.prepare('SELECT COUNT(*) as c FROM observations').get().c;
-    const viewRows = db.db.prepare('SELECT * FROM packets_v ORDER BY id').all();
-    const rawObs = db.db.prepare('SELECT * FROM observations ORDER BY id').all();
-    console.log(JSON.stringify({
-      columns: cols,
-      schemaVersion: sv || 0,
-      obsCount,
-      viewRows,
-      rawObs
-    }));
-    db.db.close();
-  `);
-  const result = execSync(`node ${JSON.stringify(scriptPath)}`, {
-    cwd: __dirname,
-    encoding: 'utf8',
-    timeout: 30000,
-  });
-  fs.unlinkSync(scriptPath);
-  const lines = result.trim().split('\n');
-  for (let i = lines.length - 1; i >= 0; i--) {
-    try { return JSON.parse(lines[i]); } catch {}
-  }
-  throw new Error('No JSON output from child process: ' + result);
-}
-
-// --- Test 1: Migration from old schema ---
-console.log('Migration from old schema:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test-'));
-  const dbPath = path.join(tmpDir, 'test-mig.db');
-
-  createOldSchemaDB(dbPath);
-
-  // Run db.js which should trigger migration
-  const info = runDbModule(dbPath);
-
-  // Verify schema
-  assert(info.schemaVersion === 3, 'schema version is 3 after migration');
-  assert(info.columns.includes('observer_idx'), 'has observer_idx column');
-  assert(!info.columns.includes('observer_id'), 'no observer_id column');
-  assert(!info.columns.includes('observer_name'), 'no observer_name column');
-  assert(!info.columns.includes('hash'), 'no hash column');
-
-  // Verify row count
-  assert(info.obsCount === 3, `all 3 rows migrated (got ${info.obsCount})`);
-
-  // Verify raw observation data
-  const obs0 = info.rawObs[0];
-  assert(typeof obs0.timestamp === 'number', 'timestamp is integer');
-  assert(obs0.timestamp === Math.floor(new Date('2025-06-01T10:00:00Z').getTime() / 1000), 'timestamp epoch correct');
-  assert(obs0.observer_idx !== null, 'observer_idx populated');
-
-  // Verify view backward compat
-  const vr0 = info.viewRows[0];
-  assert(vr0.observer_id === 'aabbccdd11223344aabbccdd11223344aabbccdd11223344aabbccdd11223344', 'view observer_id correct');
-  assert(vr0.observer_name === 'Observer Alpha', 'view observer_name correct');
-  assert(typeof vr0.timestamp === 'string', 'view timestamp is string');
-  assert(vr0.hash === 'hash-mig-001', 'view hash correct');
-  assert(vr0.snr === 12.5, 'view snr correct');
-  assert(vr0.path_json === '["aabb","ccdd"]', 'view path_json correct');
-
-  // Third row has null path_json
-  const vr2 = info.viewRows[2];
-  assert(vr2.path_json === null, 'null path_json preserved');
-
-  // Verify backup file created
-  const backups1 = fs.readdirSync(tmpDir).filter(f => f.includes('.pre-v3-backup-'));
-  assert(backups1.length === 1, 'backup file exists');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-// --- Test 2: Migration doesn't re-run ---
-console.log('\nMigration idempotency:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test2-'));
-  const dbPath = path.join(tmpDir, 'test-mig2.db');
-
-  createOldSchemaDB(dbPath);
-
-  // First run — triggers migration
-  let info = runDbModule(dbPath);
-  assert(info.schemaVersion === 3, 'first run migrates to v3');
-
-  // Second run — should NOT re-run migration (no backup overwrite, same data)
-  const backups2pre = fs.readdirSync(tmpDir).filter(f => f.includes('.pre-v3-backup-'));
-  const backupMtime = fs.statSync(path.join(tmpDir, backups2pre[0])).mtimeMs;
-  info = runDbModule(dbPath);
-  assert(info.schemaVersion === 3, 'second run still v3');
-  assert(info.obsCount === 3, 'rows still intact');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-// --- Test 3: Each migration creates a unique backup ---
-console.log('\nUnique backup per migration:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test3-'));
-  const dbPath = path.join(tmpDir, 'test-mig3.db');
-
-  createOldSchemaDB(dbPath);
-
-  const info = runDbModule(dbPath);
-
-  // Migration should have completed
-  assert(info.columns.includes('observer_idx'), 'migration completed');
-  assert(info.schemaVersion === 3, 'schema version is 3');
-
-  // A timestamped backup should exist
-  const backups = fs.readdirSync(tmpDir).filter(f => f.includes('.pre-v3-backup-'));
-  assert(backups.length === 1, 'exactly one backup created');
-  assert(fs.statSync(path.join(tmpDir, backups[0])).size > 0, 'backup is non-empty');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-// --- Test 4: v3 ingestion via child process ---
-console.log('\nv3 ingestion test:');
-{
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-mig-test4-'));
-  const dbPath = path.join(tmpDir, 'test-v3-ingest.db');
-
-  const scriptPath = path.join(os.tmpdir(), 'meshcore-ingest-test-script.js');
-  fs.writeFileSync(scriptPath, `
-    process.env.DB_PATH = ${JSON.stringify(dbPath)};
-    const db = require(${JSON.stringify(path.resolve(__dirname, 'db'))});
-
-    db.upsertObserver({ id: 'test-obs', name: 'Test Obs' });
-
-    const r = db.insertTransmission({
-      raw_hex: '0400ff',
-      hash: 'h-001',
-      timestamp: '2025-06-01T12:00:00Z',
-      observer_id: 'test-obs',
-      observer_name: 'Test Obs',
-      direction: 'rx',
-      snr: 10,
-      rssi: -85,
-      path_json: '["aa"]',
-      route_type: 1,
-      payload_type: 4,
-    });
-
-    const r2 = db.insertTransmission({
-      raw_hex: '0400ff',
-      hash: 'h-001',
-      timestamp: '2025-06-01T12:00:00Z',
-      observer_id: 'test-obs',
-      direction: 'rx',
-      snr: 10,
-      rssi: -85,
-      path_json: '["aa"]',
-    });
-
-    const pkt = db.db.prepare('SELECT * FROM packets_v WHERE hash = ?').get('h-001');
-
-    console.log(JSON.stringify({
-      r1_ok: r !== null && r.transmissionId > 0,
-      r2_deduped: r2.observationId === 0,
-      obs_count: db.db.prepare('SELECT COUNT(*) as c FROM observations').get().c,
-      view_observer_id: pkt.observer_id,
-      view_observer_name: pkt.observer_name,
-      view_ts_type: typeof pkt.timestamp,
-    }));
-    db.db.close();
-  `);
-
-  const result = execSync(`node ${JSON.stringify(scriptPath)}`, {
-    cwd: __dirname, encoding: 'utf8', timeout: 30000,
-  });
-  fs.unlinkSync(scriptPath);
-  const lines = result.trim().split('\n');
-  let info;
-  for (let i = lines.length - 1; i >= 0; i--) {
-    try { info = JSON.parse(lines[i]); break; } catch {}
-  }
-
-  assert(info.r1_ok, 'first insertion succeeded');
-  assert(info.r2_deduped, 'duplicate caught by dedup');
-  assert(info.obs_count === 1, 'only one observation row');
-  assert(info.view_observer_id === 'test-obs', 'view resolves observer_id');
-  assert(info.view_observer_name === 'Test Obs', 'view resolves observer_name');
-  assert(info.view_ts_type === 'string', 'view timestamp is string');
-
-  fs.rmSync(tmpDir, { recursive: true });
-}
-
-console.log(`\n═══════════════════════════════════════`);
-console.log(`  PASSED: ${passed}`);
-console.log(`  FAILED: ${failed}`);
-console.log(`═══════════════════════════════════════`);
-if (failed > 0) process.exit(1);

test-db.js

@@ -1,512 +0,0 @@
-'use strict';
-
-// Test db.js functions with a temp database
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-db-test-'));
-const dbPath = path.join(tmpDir, 'test.db');
-process.env.DB_PATH = dbPath;
-
-// Now require db.js — it will use our temp DB
-const db = require('./db');
-
-let passed = 0, failed = 0;
-function assert(cond, msg) {
-  if (cond) { passed++; console.log(`  ✅ ${msg}`); }
-  else { failed++; console.error(`  ❌ ${msg}`); }
-}
-
-function cleanup() {
-  try { db.db.close(); } catch {}
-  try { fs.rmSync(tmpDir, { recursive: true }); } catch {}
-}
-
-console.log('── db.js tests ──\n');
-
-// --- Schema ---
-console.log('Schema:');
-{
-  const tables = db.db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(r => r.name);
-  assert(tables.includes('nodes'), 'nodes table exists');
-  assert(tables.includes('observers'), 'observers table exists');
-  assert(tables.includes('transmissions'), 'transmissions table exists');
-  assert(tables.includes('observations'), 'observations table exists');
-}
-
-// --- upsertNode ---
-console.log('\nupsertNode:');
-{
-  db.upsertNode({ public_key: 'aabbccdd11223344aabbccdd11223344', name: 'TestNode', role: 'repeater', lat: 37.0, lon: -122.0 });
-  const node = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node !== null, 'node inserted');
-  assert(node.name === 'TestNode', 'name correct');
-  assert(node.role === 'repeater', 'role correct');
-  assert(node.lat === 37.0, 'lat correct');
-
-  // Update
-  db.upsertNode({ public_key: 'aabbccdd11223344aabbccdd11223344', name: 'UpdatedNode', role: 'room' });
-  const node2 = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node2.name === 'UpdatedNode', 'name updated');
-  assert(node2.name === 'UpdatedNode', 'name updated');
-  assert(node2.advert_count === 0, 'advert_count unchanged by upsertNode');
-
-  // advert_count only increments via incrementAdvertCount
-  db.incrementAdvertCount('aabbccdd11223344aabbccdd11223344');
-  const node3 = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node3.advert_count === 1, 'advert_count incremented via incrementAdvertCount');
-}
-
-// --- upsertObserver ---
-console.log('\nupsertObserver:');
-{
-  db.upsertObserver({ id: 'obs-1', name: 'Observer One', iata: 'SFO' });
-  const observers = db.getObservers();
-  assert(observers.length >= 1, 'observer inserted');
-  assert(observers.some(o => o.id === 'obs-1'), 'observer found by id');
-  assert(observers.find(o => o.id === 'obs-1').name === 'Observer One', 'observer name correct');
-
-  // Upsert again
-  db.upsertObserver({ id: 'obs-1', name: 'Observer Updated' });
-  const obs2 = db.getObservers().find(o => o.id === 'obs-1');
-  assert(obs2.name === 'Observer Updated', 'observer name updated');
-  assert(obs2.packet_count === 2, 'packet_count incremented');
-}
-
-// --- updateObserverStatus ---
-console.log('\nupdateObserverStatus:');
-{
-  db.updateObserverStatus({ id: 'obs-2', name: 'Status Observer', iata: 'LAX', model: 'T-Deck' });
-  const obs = db.getObservers().find(o => o.id === 'obs-2');
-  assert(obs !== null, 'observer created via status update');
-  assert(obs.model === 'T-Deck', 'model set');
-  assert(obs.packet_count === 0, 'packet_count stays 0 for status update');
-}
-
-// --- insertTransmission ---
-console.log('\ninsertTransmission:');
-{
-  const result = db.insertTransmission({
-    raw_hex: '0400aabbccdd',
-    hash: 'hash-001',
-    timestamp: '2025-01-01T00:00:00Z',
-    observer_id: 'obs-1',
-    observer_name: 'Observer One',
-    direction: 'rx',
-    snr: 10.5,
-    rssi: -85,
-    route_type: 1,
-    payload_type: 4,
-    payload_version: 1,
-    path_json: '["aabb","ccdd"]',
-    decoded_json: '{"type":"ADVERT","pubKey":"aabbccdd11223344aabbccdd11223344","name":"TestNode"}',
-  });
-  assert(result !== null, 'transmission inserted');
-  assert(result.transmissionId > 0, 'has transmissionId');
-  assert(result.observationId > 0, 'has observationId');
-
-  // Duplicate hash = same transmission, new observation
-  const result2 = db.insertTransmission({
-    raw_hex: '0400aabbccdd',
-    hash: 'hash-001',
-    timestamp: '2025-01-01T00:01:00Z',
-    observer_id: 'obs-2',
-    observer_name: 'Observer Two',
-    direction: 'rx',
-    snr: 8.0,
-    rssi: -90,
-    route_type: 1,
-    payload_type: 4,
-    path_json: '["aabb"]',
-    decoded_json: '{"type":"ADVERT","pubKey":"aabbccdd11223344aabbccdd11223344","name":"TestNode"}',
-  });
-  assert(result2.transmissionId === result.transmissionId, 'same transmissionId for duplicate hash');
-
-  // No hash = null
-  const result3 = db.insertTransmission({ raw_hex: '0400' });
-  assert(result3 === null, 'no hash returns null');
-}
-
-// --- getPackets ---
-console.log('\ngetPackets:');
-{
-  const { rows, total } = db.getPackets({ limit: 10 });
-  assert(total >= 1, 'has packets');
-  assert(rows.length >= 1, 'returns rows');
-  assert(rows[0].hash === 'hash-001', 'correct hash');
-
-  // Filter by type
-  const { rows: r2 } = db.getPackets({ type: 4 });
-  assert(r2.length >= 1, 'filter by type works');
-
-  const { rows: r3 } = db.getPackets({ type: 99 });
-  assert(r3.length === 0, 'filter by nonexistent type returns empty');
-
-  // Filter by hash
-  const { rows: r4 } = db.getPackets({ hash: 'hash-001' });
-  assert(r4.length >= 1, 'filter by hash works');
-}
-
-// --- getPacket ---
-console.log('\ngetPacket:');
-{
-  const { rows } = db.getPackets({ limit: 1 });
-  const pkt = db.getPacket(rows[0].id);
-  assert(pkt !== null, 'getPacket returns packet');
-  assert(pkt.hash === 'hash-001', 'correct packet');
-
-  const missing = db.getPacket(999999);
-  assert(missing === null, 'missing packet returns null');
-}
-
-// --- getTransmission ---
-console.log('\ngetTransmission:');
-{
-  const tx = db.getTransmission(1);
-  assert(tx !== null, 'getTransmission returns data');
-  assert(tx.hash === 'hash-001', 'correct hash');
-
-  const missing = db.getTransmission(999999);
-  assert(missing === null, 'missing transmission returns null');
-}
-
-// --- getNodes ---
-console.log('\ngetNodes:');
-{
-  const { rows, total } = db.getNodes({ limit: 10 });
-  assert(total >= 1, 'has nodes');
-  assert(rows.length >= 1, 'returns node rows');
-
-  // Sort by name
-  const { rows: r2 } = db.getNodes({ sortBy: 'name' });
-  assert(r2.length >= 1, 'sort by name works');
-
-  // Invalid sort falls back to last_seen
-  const { rows: r3 } = db.getNodes({ sortBy: 'DROP TABLE nodes' });
-  assert(r3.length >= 1, 'invalid sort is safe');
-}
-
-// --- getNode ---
-console.log('\ngetNode:');
-{
-  const node = db.getNode('aabbccdd11223344aabbccdd11223344');
-  assert(node !== null, 'getNode returns node');
-  assert(Array.isArray(node.recentPackets), 'has recentPackets');
-
-  const missing = db.getNode('nonexistent');
-  assert(missing === null, 'missing node returns null');
-}
-
-// --- searchNodes ---
-console.log('\nsearchNodes:');
-{
-  const results = db.searchNodes('Updated');
-  assert(results.length >= 1, 'search by name');
-
-  const r2 = db.searchNodes('aabbcc');
-  assert(r2.length >= 1, 'search by pubkey prefix');
-
-  const r3 = db.searchNodes('nonexistent_xyz');
-  assert(r3.length === 0, 'no results for nonexistent');
-}
-
-// --- getStats ---
-console.log('\ngetStats:');
-{
-  const stats = db.getStats();
-  assert(stats.totalNodes >= 1, 'totalNodes');
-  assert(stats.totalObservers >= 1, 'totalObservers');
-  assert(typeof stats.totalPackets === 'number', 'totalPackets is number');
-  assert(typeof stats.packetsLastHour === 'number', 'packetsLastHour is number');
-  assert(typeof stats.totalNodesAllTime === 'number', 'totalNodesAllTime is number');
-  assert(stats.totalNodesAllTime >= stats.totalNodes, 'totalNodesAllTime >= totalNodes');
-}
-
-// --- getStats active node filtering ---
-console.log('\ngetStats active node filtering:');
-{
-  // Insert a node with last_seen 30 days ago (should be excluded from totalNodes)
-  const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 3600000).toISOString();
-  db.upsertNode({ public_key: 'deadnode0000000000000000deadnode00', name: 'DeadNode', role: 'repeater', last_seen: thirtyDaysAgo, first_seen: thirtyDaysAgo });
-
-  // Insert a node with last_seen now (should be included)
-  db.upsertNode({ public_key: 'livenode0000000000000000livenode00', name: 'LiveNode', role: 'companion', last_seen: new Date().toISOString() });
-
-  const stats = db.getStats();
-  assert(stats.totalNodesAllTime > stats.totalNodes, 'dead node excluded from totalNodes but included in totalNodesAllTime');
-
-  // Verify the dead node is in totalNodesAllTime
-  const allTime = stats.totalNodesAllTime;
-  assert(allTime >= 3, 'totalNodesAllTime includes dead + live nodes');
-
-  // Verify active count doesn't include the 30-day-old node
-  // The dead node's last_seen is 30 days ago, window is 7 days
-  const nodeInDb = db.getNode('deadnode0000000000000000deadnode00');
-  assert(nodeInDb !== null, 'dead node exists in DB');
-  const liveNode = db.getNode('livenode0000000000000000livenode00');
-  assert(liveNode !== null, 'live node exists in DB');
-}
-
-// --- getNodeHealth ---
-console.log('\ngetNodeHealth:');
-{
-  const health = db.getNodeHealth('aabbccdd11223344aabbccdd11223344');
-  assert(health !== null, 'returns health data');
-  assert(health.node.name === 'UpdatedNode', 'has node info');
-  assert(typeof health.stats.totalPackets === 'number', 'has totalPackets stat');
-  assert(Array.isArray(health.observers), 'has observers array');
-  assert(Array.isArray(health.recentPackets), 'has recentPackets array');
-
-  const missing = db.getNodeHealth('nonexistent');
-  assert(missing === null, 'missing node returns null');
-}
-
-// --- getNodeAnalytics ---
-console.log('\ngetNodeAnalytics:');
-{
-  const analytics = db.getNodeAnalytics('aabbccdd11223344aabbccdd11223344', 7);
-  assert(analytics !== null, 'returns analytics');
-  assert(analytics.node.name === 'UpdatedNode', 'has node info');
-  assert(Array.isArray(analytics.activityTimeline), 'has activityTimeline');
-  assert(Array.isArray(analytics.snrTrend), 'has snrTrend');
-  assert(Array.isArray(analytics.packetTypeBreakdown), 'has packetTypeBreakdown');
-  assert(Array.isArray(analytics.observerCoverage), 'has observerCoverage');
-  assert(Array.isArray(analytics.hopDistribution), 'has hopDistribution');
-  assert(Array.isArray(analytics.peerInteractions), 'has peerInteractions');
-  assert(Array.isArray(analytics.uptimeHeatmap), 'has uptimeHeatmap');
-  assert(typeof analytics.computedStats.availabilityPct === 'number', 'has availabilityPct');
-  assert(typeof analytics.computedStats.signalGrade === 'string', 'has signalGrade');
-
-  const missing = db.getNodeAnalytics('nonexistent', 7);
-  assert(missing === null, 'missing node returns null');
-}
-
-// --- seed ---
-console.log('\nseed:');
-{
-  if (typeof db.seed === 'function') {
-    // Already has data, should return false
-    const result = db.seed();
-    assert(result === false, 'seed returns false when data exists');
-  } else {
-    console.log('  (skipped — seed not exported)');
-  }
-}
-
-// --- v3 schema tests (fresh DB should be v3) ---
-console.log('\nv3 schema:');
-{
-  assert(db.schemaVersion >= 3, 'fresh DB creates v3 schema');
-
-  // observations table should have observer_idx, not observer_id
-  const cols = db.db.pragma('table_info(observations)').map(c => c.name);
-  assert(cols.includes('observer_idx'), 'observations has observer_idx column');
-  assert(!cols.includes('observer_id'), 'observations does NOT have observer_id column');
-  assert(!cols.includes('observer_name'), 'observations does NOT have observer_name column');
-  assert(!cols.includes('hash'), 'observations does NOT have hash column');
-  assert(!cols.includes('created_at'), 'observations does NOT have created_at column');
-
-  // timestamp should be integer
-  const obsRow = db.db.prepare('SELECT typeof(timestamp) as t FROM observations LIMIT 1').get();
-  if (obsRow) {
-    assert(obsRow.t === 'integer', 'timestamp is stored as integer');
-  }
-
-  // packets_v view should still expose observer_id, observer_name, ISO timestamp
-  const viewRow = db.db.prepare('SELECT * FROM packets_v LIMIT 1').get();
-  if (viewRow) {
-    assert('observer_id' in viewRow, 'packets_v exposes observer_id');
-    assert('observer_name' in viewRow, 'packets_v exposes observer_name');
-    assert(typeof viewRow.timestamp === 'string', 'packets_v timestamp is ISO string');
-  }
-
-  // user_version is 3
-  const sv = db.db.pragma('user_version', { simple: true });
-  assert(sv === 3, 'user_version is 3');
-}
-
-// --- v3 ingestion: observer resolved via observer_idx ---
-console.log('\nv3 ingestion with observer resolution:');
-{
-  // Insert a new observer
-  db.upsertObserver({ id: 'obs-v3-test', name: 'V3 Test Observer' });
-
-  // Insert observation referencing that observer
-  const result = db.insertTransmission({
-    raw_hex: '0400deadbeef',
-    hash: 'hash-v3-001',
-    timestamp: '2025-06-01T12:00:00Z',
-    observer_id: 'obs-v3-test',
-    observer_name: 'V3 Test Observer',
-    direction: 'rx',
-    snr: 12.0,
-    rssi: -80,
-    route_type: 1,
-    payload_type: 4,
-    path_json: '["aabb"]',
-  });
-  assert(result !== null, 'v3 insertion succeeded');
-  assert(result.transmissionId > 0, 'v3 has transmissionId');
-
-  // Verify via packets_v view
-  const pkt = db.db.prepare('SELECT * FROM packets_v WHERE hash = ?').get('hash-v3-001');
-  assert(pkt !== null, 'v3 packet found via view');
-  assert(pkt.observer_id === 'obs-v3-test', 'v3 observer_id resolved in view');
-  assert(pkt.observer_name === 'V3 Test Observer', 'v3 observer_name resolved in view');
-  assert(typeof pkt.timestamp === 'string', 'v3 timestamp is ISO string in view');
-  assert(pkt.timestamp.includes('2025-06-01'), 'v3 timestamp date correct');
-
-  // Raw observation should have integer timestamp
-  const obs = db.db.prepare('SELECT * FROM observations ORDER BY id DESC LIMIT 1').get();
-  assert(typeof obs.timestamp === 'number', 'v3 raw observation timestamp is integer');
-  assert(obs.observer_idx !== null, 'v3 observation has observer_idx');
-}
-
-// --- v3 dedup ---
-console.log('\nv3 dedup:');
-{
-  // Insert same observation again — should be deduped
-  const result = db.insertTransmission({
-    raw_hex: '0400deadbeef',
-    hash: 'hash-v3-001',
-    timestamp: '2025-06-01T12:00:00Z',
-    observer_id: 'obs-v3-test',
-    direction: 'rx',
-    snr: 12.0,
-    rssi: -80,
-    path_json: '["aabb"]',
-  });
-  assert(result.observationId === 0, 'duplicate caught by in-memory dedup');
-
-  // Different observer = not a dupe
-  db.upsertObserver({ id: 'obs-v3-test-2', name: 'V3 Test Observer 2' });
-  const result2 = db.insertTransmission({
-    raw_hex: '0400deadbeef',
-    hash: 'hash-v3-001',
-    timestamp: '2025-06-01T12:01:00Z',
-    observer_id: 'obs-v3-test-2',
-    direction: 'rx',
-    snr: 9.0,
-    rssi: -88,
-    path_json: '["ccdd"]',
-  });
-  assert(result2.observationId > 0, 'different observer is not a dupe');
-}
-
-// --- removePhantomNodes ---
-console.log('\nremovePhantomNodes:');
-{
-  // Insert phantom nodes (short public_keys like hop prefixes)
-  db.upsertNode({ public_key: 'aabb', name: null, role: 'repeater' });
-  db.upsertNode({ public_key: 'ccddee', name: null, role: 'repeater' });
-  db.upsertNode({ public_key: 'ff001122', name: null, role: 'repeater' });
-  db.upsertNode({ public_key: '0011223344556677', name: null, role: 'repeater' }); // 16 chars — still phantom
-
-  // Verify they exist
-  assert(db.getNode('aabb') !== null, 'phantom node aabb exists before cleanup');
-  assert(db.getNode('ccddee') !== null, 'phantom node ccddee exists before cleanup');
-  assert(db.getNode('ff001122') !== null, 'phantom node ff001122 exists before cleanup');
-  assert(db.getNode('0011223344556677') !== null, 'phantom 16-char exists before cleanup');
-
-  // Verify real node still exists
-  assert(db.getNode('aabbccdd11223344aabbccdd11223344') !== null, 'real node exists before cleanup');
-
-  // Run cleanup
-  const removed = db.removePhantomNodes();
-  assert(removed === 4, `removed 4 phantom nodes (got ${removed})`);
-
-  // Verify phantoms are gone
-  assert(db.getNode('aabb') === null, 'phantom aabb removed');
-  assert(db.getNode('ccddee') === null, 'phantom ccddee removed');
-  assert(db.getNode('ff001122') === null, 'phantom ff001122 removed');
-  assert(db.getNode('0011223344556677') === null, 'phantom 16-char removed');
-
-  // Verify real node is still there
-  assert(db.getNode('aabbccdd11223344aabbccdd11223344') !== null, 'real node preserved after cleanup');
-
-  // Running again should remove 0
-  const removed2 = db.removePhantomNodes();
-  assert(removed2 === 0, 'second cleanup removes nothing');
-}
-
-// --- stats exclude phantom nodes ---
-console.log('\nstats exclude phantom nodes:');
-{
-  const statsBefore = db.getStats();
-  const countBefore = statsBefore.totalNodesAllTime;
-
-  // Insert a phantom — should be cleanable
-  db.upsertNode({ public_key: 'deadbeef', name: null, role: 'repeater' });
-  const statsWithPhantom = db.getStats();
-  assert(statsWithPhantom.totalNodesAllTime === countBefore + 1, 'phantom inflates totalNodesAllTime');
-
-  // Clean it
-  db.removePhantomNodes();
-  const statsAfter = db.getStats();
-  assert(statsAfter.totalNodesAllTime === countBefore, 'phantom removed from totalNodesAllTime');
-}
-
-// --- moveStaleNodes ---
-console.log('\nmoveStaleNodes:');
-{
-  // Verify inactive_nodes table exists
-  const tables = db.db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all().map(r => r.name);
-  assert(tables.includes('inactive_nodes'), 'inactive_nodes table exists');
-
-  // Verify inactive_nodes has same columns as nodes
-  const nodesCols = db.db.pragma('table_info(nodes)').map(c => c.name).sort();
-  const inactiveCols = db.db.pragma('table_info(inactive_nodes)').map(c => c.name).sort();
-  assert(JSON.stringify(nodesCols) === JSON.stringify(inactiveCols), 'inactive_nodes has same columns as nodes');
-
-  // Insert a stale node (last_seen 30 days ago) and a fresh node
-  const thirtyDaysAgo = new Date(Date.now() - 30 * 24 * 3600000).toISOString();
-  const now = new Date().toISOString();
-  db.upsertNode({ public_key: 'stale00000000000000000000stale000', name: 'StaleNode', role: 'repeater', last_seen: thirtyDaysAgo, first_seen: thirtyDaysAgo });
-  db.upsertNode({ public_key: 'fresh00000000000000000000fresh000', name: 'FreshNode', role: 'companion', last_seen: now, first_seen: now });
-
-  // Verify both exist in nodes
-  assert(db.getNode('stale00000000000000000000stale000') !== null, 'stale node exists before move');
-  assert(db.getNode('fresh00000000000000000000fresh000') !== null, 'fresh node exists before move');
-
-  // Move stale nodes (7 day threshold)
-  const moved = db.moveStaleNodes(7);
-  assert(moved >= 1, `moveStaleNodes moved at least 1 node (got ${moved})`);
-
-  // Stale node should be gone from nodes
-  assert(db.getNode('stale00000000000000000000stale000') === null, 'stale node removed from nodes');
-
-  // Fresh node should still be in nodes
-  assert(db.getNode('fresh00000000000000000000fresh000') !== null, 'fresh node still in nodes');
-
-  // Stale node should be in inactive_nodes
-  const inactive = db.db.prepare('SELECT * FROM inactive_nodes WHERE public_key = ?').get('stale00000000000000000000stale000');
-  assert(inactive !== null, 'stale node exists in inactive_nodes');
-  assert(inactive.name === 'StaleNode', 'stale node name preserved in inactive_nodes');
-  assert(inactive.role === 'repeater', 'stale node role preserved in inactive_nodes');
-
-  // Fresh node should NOT be in inactive_nodes
-  const freshInactive = db.db.prepare('SELECT * FROM inactive_nodes WHERE public_key = ?').get('fresh00000000000000000000fresh000');
-  assert(!freshInactive, 'fresh node not in inactive_nodes');
-
-  // Running again should move 0 (already moved)
-  const moved2 = db.moveStaleNodes(7);
-  assert(moved2 === 0, 'second moveStaleNodes moves nothing');
-
-  // With nodeDays=0 should be a no-op
-  const moved3 = db.moveStaleNodes(0);
-  assert(moved3 === 0, 'moveStaleNodes(0) is a no-op');
-
-  // With null should be a no-op
-  const moved4 = db.moveStaleNodes(null);
-  assert(moved4 === 0, 'moveStaleNodes(null) is a no-op');
-}
-
-cleanup();
-delete process.env.DB_PATH;
-
-console.log(`\n═══════════════════════════════════════`);
-console.log(`  PASSED: ${passed}`);
-console.log(`  FAILED: ${failed}`);
-console.log(`═══════════════════════════════════════`);
-if (failed > 0) process.exit(1);

test-decoder-spec.js

@@ -1,625 +0,0 @@
-/**
- * Spec-driven tests for MeshCore decoder.
- *
- * Section 1: Spec assertions (from firmware/docs/packet_format.md + payloads.md)
- * Section 2: Golden fixtures (from production data at analyzer.00id.net)
- */
-
-'use strict';
-
-const { decodePacket, validateAdvert, ROUTE_TYPES, PAYLOAD_TYPES } = require('./decoder');
-
-let passed = 0;
-let failed = 0;
-let noted = 0;
-
-function assert(condition, msg) {
-  if (condition) { passed++; }
-  else { failed++; console.error(`  FAIL: ${msg}`); }
-}
-
-function assertEq(actual, expected, msg) {
-  if (actual === expected) { passed++; }
-  else { failed++; console.error(`  FAIL: ${msg} — expected ${JSON.stringify(expected)}, got ${JSON.stringify(actual)}`); }
-}
-
-function assertDeepEq(actual, expected, msg) {
-  const a = JSON.stringify(actual);
-  const b = JSON.stringify(expected);
-  if (a === b) { passed++; }
-  else { failed++; console.error(`  FAIL: ${msg}\n    expected: ${b}\n    got:      ${a}`); }
-}
-
-function note(msg) {
-  noted++;
-  console.log(`  NOTE: ${msg}`);
-}
-
-// ═══════════════════════════════════════════════════════════
-// Section 1: Spec-based assertions
-// ═══════════════════════════════════════════════════════════
-
-console.log('── Spec Tests: Header Parsing ──');
-
-// Header byte: bits 1-0 = routeType, bits 5-2 = payloadType, bits 7-6 = payloadVersion
-{
-  // 0x11 = 0b00_0100_01 → routeType=1(FLOOD), payloadType=4(ADVERT), version=0
-  const p = decodePacket('1100' + '00'.repeat(101)); // min advert = 100 bytes payload
-  assertEq(p.header.routeType, 1, 'header: routeType from bits 1-0');
-  assertEq(p.header.payloadType, 4, 'header: payloadType from bits 5-2');
-  assertEq(p.header.payloadVersion, 0, 'header: payloadVersion from bits 7-6');
-  assertEq(p.header.routeTypeName, 'FLOOD', 'header: routeTypeName');
-  assertEq(p.header.payloadTypeName, 'ADVERT', 'header: payloadTypeName');
-}
-
-// All four route types
-{
-  const routeNames = { 0: 'TRANSPORT_FLOOD', 1: 'FLOOD', 2: 'DIRECT', 3: 'TRANSPORT_DIRECT' };
-  for (const [val, name] of Object.entries(routeNames)) {
-    assertEq(ROUTE_TYPES[val], name, `ROUTE_TYPES[${val}] = ${name}`);
-  }
-}
-
-// All payload types from spec
-{
-  const specTypes = {
-    0x00: 'REQ', 0x01: 'RESPONSE', 0x02: 'TXT_MSG', 0x03: 'ACK',
-    0x04: 'ADVERT', 0x05: 'GRP_TXT', 0x07: 'ANON_REQ',
-    0x08: 'PATH', 0x09: 'TRACE',
-  };
-  for (const [val, name] of Object.entries(specTypes)) {
-    assertEq(PAYLOAD_TYPES[val], name, `PAYLOAD_TYPES[${val}] = ${name}`);
-  }
-}
-
-// Spec defines 0x06=GRP_DATA, 0x0A=MULTIPART, 0x0B=CONTROL, 0x0F=RAW_CUSTOM — decoder may not have them
-{
-  if (!PAYLOAD_TYPES[0x06]) note('Decoder missing PAYLOAD_TYPE 0x06 (GRP_DATA) — spec defines it');
-  if (!PAYLOAD_TYPES[0x0A]) note('Decoder missing PAYLOAD_TYPE 0x0A (MULTIPART) — spec defines it');
-  if (!PAYLOAD_TYPES[0x0B]) note('Decoder missing PAYLOAD_TYPE 0x0B (CONTROL) — spec defines it');
-  if (!PAYLOAD_TYPES[0x0F]) note('Decoder missing PAYLOAD_TYPE 0x0F (RAW_CUSTOM) — spec defines it');
-}
-
-console.log('── Spec Tests: Path Byte Parsing ──');
-
-// path_length: bits 5-0 = hop count, bits 7-6 = hash_size - 1
-{
-  // 0x00: 0 hops, 1-byte hashes
-  const p0 = decodePacket('0500' + '00'.repeat(10));
-  assertEq(p0.path.hashCount, 0, 'path 0x00: hashCount=0');
-  assertEq(p0.path.hashSize, 1, 'path 0x00: hashSize=1');
-  assertDeepEq(p0.path.hops, [], 'path 0x00: no hops');
-}
-
-{
-  // 0x05: 5 hops, 1-byte hashes → 5 path bytes
-  const p5 = decodePacket('0505' + 'AABBCCDDEE' + '00'.repeat(10));
-  assertEq(p5.path.hashCount, 5, 'path 0x05: hashCount=5');
-  assertEq(p5.path.hashSize, 1, 'path 0x05: hashSize=1');
-  assertEq(p5.path.hops.length, 5, 'path 0x05: 5 hops');
-  assertEq(p5.path.hops[0], 'AA', 'path 0x05: first hop');
-  assertEq(p5.path.hops[4], 'EE', 'path 0x05: last hop');
-}
-
-{
-  // 0x45: 5 hops, 2-byte hashes (bits 7-6 = 01) → 10 path bytes
-  const p45 = decodePacket('0545' + 'AA11BB22CC33DD44EE55' + '00'.repeat(10));
-  assertEq(p45.path.hashCount, 5, 'path 0x45: hashCount=5');
-  assertEq(p45.path.hashSize, 2, 'path 0x45: hashSize=2');
-  assertEq(p45.path.hops.length, 5, 'path 0x45: 5 hops');
-  assertEq(p45.path.hops[0], 'AA11', 'path 0x45: first hop (2-byte)');
-}
-
-{
-  // 0x8A: 10 hops, 3-byte hashes (bits 7-6 = 10) → 30 path bytes
-  const p8a = decodePacket('058A' + 'AA11FF'.repeat(10) + '00'.repeat(10));
-  assertEq(p8a.path.hashCount, 10, 'path 0x8A: hashCount=10');
-  assertEq(p8a.path.hashSize, 3, 'path 0x8A: hashSize=3');
-  assertEq(p8a.path.hops.length, 10, 'path 0x8A: 10 hops');
-}
-
-console.log('── Spec Tests: Transport Codes ──');
-
-{
-  // Route type 0 (TRANSPORT_FLOOD) and 3 (TRANSPORT_DIRECT) should have 4-byte transport codes
-  // Route type 0: header=0x14 = payloadType 5 (GRP_TXT), routeType 0 (TRANSPORT_FLOOD)
-  // Format: header(1) + transportCodes(4) + pathByte(1) + payload
-  const hex = '14' + 'AABB' + 'CCDD' + '00' + '1A' + '00'.repeat(10); // transport codes + pathByte + GRP_TXT payload
-  const p = decodePacket(hex);
-  assertEq(p.header.routeType, 0, 'transport: routeType=0 (TRANSPORT_FLOOD)');
-  assert(p.transportCodes !== null, 'transport: transportCodes present for TRANSPORT_FLOOD');
-  assertEq(p.transportCodes.code1, 'AABB', 'transport: code1');
-  assertEq(p.transportCodes.code2, 'CCDD', 'transport: code2');
-}
-
-{
-  // Route type 1 (FLOOD) should NOT have transport codes
-  const p = decodePacket('0500' + '00'.repeat(10));
-  assertEq(p.transportCodes, null, 'no transport codes for FLOOD');
-}
-
-console.log('── Spec Tests: Advert Payload ──');
-
-// Advert: pubkey(32) + timestamp(4 LE) + signature(64) + appdata
-{
-  const pubkey = 'AA'.repeat(32);
-  const timestamp = '78563412'; // 0x12345678 LE = 305419896
-  const signature = 'BB'.repeat(64);
-  // flags: 0x92 = repeater(2) | hasLocation(0x10) | hasName(0x80)
-  const flags = '92';
-  // lat: 37000000 = 0x02353A80 LE → 80 3A 35 02
-  const lat = '40933402';
-  // lon: -122100000 = 0xF8B9E260 LE → 60 E2 B9 F8
-  const lon = 'E0E6B8F8';
-  const name = Buffer.from('TestNode').toString('hex');
-
-  const hex = '1200' + pubkey + timestamp + signature + flags + lat + lon + name;
-  const p = decodePacket(hex);
-
-  assertEq(p.payload.type, 'ADVERT', 'advert: payload type');
-  assertEq(p.payload.pubKey, pubkey.toLowerCase(), 'advert: 32-byte pubkey');
-  assertEq(p.payload.timestamp, 0x12345678, 'advert: uint32 LE timestamp');
-  assertEq(p.payload.signature, signature.toLowerCase().repeat(1), 'advert: 64-byte signature');
-
-  // Flags
-  assertEq(p.payload.flags.raw, 0x92, 'advert flags: raw byte');
-  assertEq(p.payload.flags.type, 2, 'advert flags: type enum = 2 (repeater)');
-  assertEq(p.payload.flags.repeater, true, 'advert flags: repeater');
-  assertEq(p.payload.flags.room, false, 'advert flags: not room');
-  assertEq(p.payload.flags.chat, false, 'advert flags: not chat');
-  assertEq(p.payload.flags.sensor, false, 'advert flags: not sensor');
-  assertEq(p.payload.flags.hasLocation, true, 'advert flags: hasLocation (bit 4)');
-  assertEq(p.payload.flags.hasName, true, 'advert flags: hasName (bit 7)');
-
-  // Location: int32 at 1e6 scale
-  assert(Math.abs(p.payload.lat - 37.0) < 0.001, 'advert: lat decoded from int32/1e6');
-  assert(Math.abs(p.payload.lon - (-122.1)) < 0.001, 'advert: lon decoded from int32/1e6');
-
-  // Name
-  assertEq(p.payload.name, 'TestNode', 'advert: name from remaining appdata');
-}
-
-// Advert type enum values per spec
-{
-  // type 0 = none (companion), 1 = chat/companion, 2 = repeater, 3 = room, 4 = sensor
-  const makeAdvert = (flagsByte) => {
-    const hex = '1200' + 'AA'.repeat(32) + '00000000' + 'BB'.repeat(64) + flagsByte.toString(16).padStart(2, '0');
-    return decodePacket(hex).payload;
-  };
-
-  const t1 = makeAdvert(0x01);
-  assertEq(t1.flags.type, 1, 'advert type 1 = chat/companion');
-  assertEq(t1.flags.chat, true, 'type 1: chat=true');
-
-  const t2 = makeAdvert(0x02);
-  assertEq(t2.flags.type, 2, 'advert type 2 = repeater');
-  assertEq(t2.flags.repeater, true, 'type 2: repeater=true');
-
-  const t3 = makeAdvert(0x03);
-  assertEq(t3.flags.type, 3, 'advert type 3 = room');
-  assertEq(t3.flags.room, true, 'type 3: room=true');
-
-  const t4 = makeAdvert(0x04);
-  assertEq(t4.flags.type, 4, 'advert type 4 = sensor');
-  assertEq(t4.flags.sensor, true, 'type 4: sensor=true');
-}
-
-// Advert with no location, no name (flags = 0x02, just repeater)
-{
-  const hex = '1200' + 'CC'.repeat(32) + '00000000' + 'DD'.repeat(64) + '02';
-  const p = decodePacket(hex).payload;
-  assertEq(p.flags.hasLocation, false, 'advert no location: hasLocation=false');
-  assertEq(p.flags.hasName, false, 'advert no name: hasName=false');
-  assertEq(p.lat, undefined, 'advert no location: lat undefined');
-  assertEq(p.name, undefined, 'advert no name: name undefined');
-}
-
-// Telemetry: sensor node with battery + positive temperature
-{
-  const pubkey = 'AA'.repeat(32);
-  const sig = 'BB'.repeat(64);
-  const flags = '84'; // sensor(4) | hasName(0x80)
-  const name = Buffer.from('S1').toString('hex') + '00'; // null-terminated
-  const battBuf = Buffer.alloc(2); battBuf.writeUInt16LE(3700);
-  const tempBuf = Buffer.alloc(2); tempBuf.writeInt16LE(2850); // 28.50°C
-  const hex = '1200' + pubkey + '00000000' + sig + flags + name +
-    battBuf.toString('hex') + tempBuf.toString('hex');
-  const p = decodePacket(hex).payload;
-  assertEq(p.battery_mv, 3700, 'telemetry: battery_mv decoded');
-  assert(Math.abs(p.temperature_c - 28.50) < 0.01, 'telemetry: temperature_c positive');
-}
-
-// Telemetry: sensor node with 0°C must still emit temperature_c
-{
-  const pubkey = 'CC'.repeat(32);
-  const sig = 'DD'.repeat(64);
-  const flags = '84'; // sensor(4) | hasName(0x80)
-  const name = Buffer.from('S2').toString('hex') + '00';
-  const battBuf = Buffer.alloc(2); battBuf.writeUInt16LE(3600);
-  const tempBuf = Buffer.alloc(2); // 0°C
-  const hex = '1200' + pubkey + '00000000' + sig + flags + name +
-    battBuf.toString('hex') + tempBuf.toString('hex');
-  const p = decodePacket(hex).payload;
-  assert(p.temperature_c === 0, 'telemetry: 0°C is valid and emitted');
-}
-
-// Telemetry: non-sensor node with trailing bytes must NOT decode telemetry
-{
-  const pubkey = 'EE'.repeat(32);
-  const sig = 'FF'.repeat(64);
-  const flags = '82'; // repeater(2) | hasName(0x80)
-  const name = Buffer.from('R1').toString('hex') + '00';
-  const extraBytes = 'B40ED403'; // battery-like and temp-like bytes
-  const hex = '1200' + pubkey + '00000000' + sig + flags + name + extraBytes;
-  const p = decodePacket(hex).payload;
-  assertEq(p.battery_mv, undefined, 'telemetry: non-sensor node: battery_mv must be undefined');
-  assertEq(p.temperature_c, undefined, 'telemetry: non-sensor node: temperature_c must be undefined');
-}
-
-console.log('── Spec Tests: Encrypted Payload Format ──');
-
-// Spec says v1 encrypted payloads: dest(1)+src(1)+MAC(2)+cipher — decoder matches this.
-{
-  const hex = '0100' + 'AA' + 'BB' + 'CCDD' + '00'.repeat(10);
-  const p = decodePacket(hex);
-  assertEq(p.payload.destHash, 'aa', 'encrypted payload: dest is 1 byte');
-  assertEq(p.payload.srcHash, 'bb', 'encrypted payload: src is 1 byte');
-  assertEq(p.payload.mac, 'ccdd', 'encrypted payload: MAC is 2 bytes');
-}
-
-console.log('── Spec Tests: validateAdvert ──');
-
-{
-  const good = { pubKey: 'aa'.repeat(32), flags: { repeater: true, room: false, sensor: false } };
-  assertEq(validateAdvert(good).valid, true, 'validateAdvert: good advert');
-
-  assertEq(validateAdvert(null).valid, false, 'validateAdvert: null');
-  assertEq(validateAdvert({ error: 'bad' }).valid, false, 'validateAdvert: error advert');
-  assertEq(validateAdvert({ pubKey: 'aa' }).valid, false, 'validateAdvert: short pubkey');
-  assertEq(validateAdvert({ pubKey: '00'.repeat(32) }).valid, false, 'validateAdvert: all-zero pubkey');
-
-  const badLat = { pubKey: 'aa'.repeat(32), lat: 999 };
-  assertEq(validateAdvert(badLat).valid, false, 'validateAdvert: invalid lat');
-
-  const badLon = { pubKey: 'aa'.repeat(32), lon: -999 };
-  assertEq(validateAdvert(badLon).valid, false, 'validateAdvert: invalid lon');
-
-  const badName = { pubKey: 'aa'.repeat(32), name: 'test\x00name' };
-  assertEq(validateAdvert(badName).valid, false, 'validateAdvert: control chars in name');
-
-  const longName = { pubKey: 'aa'.repeat(32), name: 'x'.repeat(65) };
-  assertEq(validateAdvert(longName).valid, false, 'validateAdvert: name too long');
-}
-
-// ═══════════════════════════════════════════════════════════
-// Section 2: Golden fixtures (from production)
-// ═══════════════════════════════════════════════════════════
-
-console.log('── Golden Tests: Production Packets ──');
-
-const goldenFixtures = [
-  {
-    "raw_hex": "0A00D69FD7A5A7475DB07337749AE61FA53A4788E976",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"d7a5\",\"encryptedData\":\"a7475db07337749ae61fa53a4788e976\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0A009FD605771EE2EB0CDC46D100232B455947E3C2D4B9DD0B8880EACA99A3C5F7EF63183D6D",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"9f\",\"srcHash\":\"d6\",\"mac\":\"0577\",\"encryptedData\":\"1ee2eb0cdc46d100232b455947e3c2d4b9dd0b8880eaca99a3c5f7ef63183d6d\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "120046D62DE27D4C5194D7821FC5A34A45565DCC2537B300B9AB6275255CEFB65D840CE5C169C94C9AED39E8BCB6CB6EB0335497A198B33A1A610CD3B03D8DCFC160900E5244280323EE0B44CACAB8F02B5B38B91CFA18BD067B0B5E63E94CFC85F758A8530B9240933402E0E6B8F84D5252322D52",
-    "payload_type": 4,
-    "route_type": 2,
-    "decoded": "{\"type\":\"ADVERT\",\"pubKey\":\"46d62de27d4c5194d7821fc5a34a45565dcc2537b300b9ab6275255cefb65d84\",\"timestamp\":1774314764,\"timestampISO\":\"2026-03-24T01:12:44.000Z\",\"signature\":\"c94c9aed39e8bcb6cb6eb0335497a198b33a1a610cd3b03d8dcfc160900e5244280323ee0b44cacab8f02b5b38b91cfa18bd067b0b5e63e94cfc85f758a8530b\",\"flags\":{\"raw\":146,\"type\":2,\"chat\":false,\"repeater\":true,\"room\":false,\"sensor\":false,\"hasLocation\":true,\"hasName\":true},\"lat\":37,\"lon\":-122.1,\"name\":\"MRR2-R\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "120073CFF971E1CB5754A742C152B2D2E0EB108A19B246D663ED8898A72C4A5AD86EA6768E66694B025EDF6939D5C44CFF719C5D5520E5F06B20680A83AD9C2C61C3227BBB977A85EE462F3553445FECF8EDD05C234ECE217272E503F14D6DF2B1B9B133890C923CDF3002F8FDC1F85045414BF09F8CB3",
-    "payload_type": 4,
-    "route_type": 2,
-    "decoded": "{\"type\":\"ADVERT\",\"pubKey\":\"73cff971e1cb5754a742c152b2d2e0eb108a19b246d663ed8898a72c4a5ad86e\",\"timestamp\":1720612518,\"timestampISO\":\"2024-07-10T11:55:18.000Z\",\"signature\":\"694b025edf6939d5c44cff719c5d5520e5f06b20680a83ad9c2c61c3227bbb977a85ee462f3553445fecf8edd05c234ece217272e503f14d6df2b1b9b133890c\",\"flags\":{\"raw\":146,\"type\":2,\"chat\":false,\"repeater\":true,\"room\":false,\"sensor\":false,\"hasLocation\":true,\"hasName\":true},\"lat\":36.757308,\"lon\":-121.504264,\"name\":\"PEAK🌳\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "06001f33e1bef15f5596b394adf03a77d46b89afa2e3",
-    "payload_type": 1,
-    "route_type": 2,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"1f\",\"srcHash\":\"33\",\"mac\":\"e1be\",\"encryptedData\":\"f15f5596b394adf03a77d46b89afa2e3\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0200331fe52805e05cf6f4bae6a094ac258d57baf045",
-    "payload_type": 0,
-    "route_type": 2,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"33\",\"srcHash\":\"1f\",\"mac\":\"e528\",\"encryptedData\":\"05e05cf6f4bae6a094ac258d57baf045\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "15001ABC314305D3CCC94EB3F398D3054B4E95899229027B027E450FD68B4FA4E0A0126AC1",
-    "payload_type": 5,
-    "route_type": 1,
-    "decoded": "{\"type\":\"GRP_TXT\",\"channelHash\":26,\"mac\":\"bc31\",\"encryptedData\":\"4305d3ccc94eb3f398d3054b4e95899229027b027e450fd68b4fa4e0a0126ac1\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "010673a210206cb51e42fee24c4847a99208b9fc1d7ab36c42b10748",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"fee2\",\"encryptedData\":\"4c4847a99208b9fc1d7ab36c42b10748\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 6,
-      "hops": [
-        "73",
-        "A2",
-        "10",
-        "20",
-        "6C",
-        "B5"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0101731E42FEE24C4847A99208293810E4A3E335640D8E",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"fee2\",\"encryptedData\":\"4c4847a99208293810e4a3e335640d8e\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 1,
-      "hops": [
-        "73"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0106FB10844070101E42BA859D1D939362F79D3F3865333629FF92E9",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"ba85\",\"encryptedData\":\"9d1d939362f79d3f3865333629ff92e9\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 6,
-      "hops": [
-        "FB",
-        "10",
-        "84",
-        "40",
-        "70",
-        "10"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0102FB101E42BA859D1D939362F79D3F3865333629FF92D9",
-    "payload_type": 0,
-    "route_type": 1,
-    "decoded": "{\"type\":\"REQ\",\"destHash\":\"1e\",\"srcHash\":\"42\",\"mac\":\"ba85\",\"encryptedData\":\"9d1d939362f79d3f3865333629ff92d9\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 2,
-      "hops": [
-        "FB",
-        "10"
-      ]
-    }
-  },
-  {
-    "raw_hex": "22009FD65B38857C5A7F6F0F28E999CF2632C03ACCCC",
-    "payload_type": 8,
-    "route_type": 2,
-    "decoded": "{\"type\":\"PATH\",\"destHash\":\"9f\",\"srcHash\":\"d6\",\"mac\":\"5b38\",\"pathData\":\"857c5a7f6f0f28e999cf2632c03acccc\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0506701085AD8573D69F96FA7DD3B1AC3702794035442D9CDAD436D4",
-    "payload_type": 1,
-    "route_type": 1,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"96fa\",\"encryptedData\":\"7dd3b1ac3702794035442d9cdad436d4\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 6,
-      "hops": [
-        "70",
-        "10",
-        "85",
-        "AD",
-        "85",
-        "73"
-      ]
-    }
-  },
-  {
-    "raw_hex": "0500D69F96FA7DD3B1AC3702794035442D9CDAD43654",
-    "payload_type": 1,
-    "route_type": 1,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"96fa\",\"encryptedData\":\"7dd3b1ac3702794035442d9cdad43654\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "1E009FD6DFC543C53E826A2B789B072FF9CBE922E57EA093E5643A0CA813E79F42EE9108F855B72A3E0B599C9AC80D3A211E7C7BA2",
-    "payload_type": 7,
-    "route_type": 2,
-    "decoded": "{\"type\":\"ANON_REQ\",\"destHash\":\"9f\",\"ephemeralPubKey\":\"d6dfc543c53e826a2b789b072ff9cbe922e57ea093e5643a0ca813e79f42ee91\",\"mac\":\"08f8\",\"encryptedData\":\"55b72a3e0b599c9ac80d3a211e7c7ba2\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "110146B7F1C45F2ED5888335F79E27085D0DE871A7C8ECB1EF5313435EBD0825BACDC181E3C1695556F51A89C9895E2114D1FECA91B58F82CBBBC1DD2B868ADDC0F7EB8C310D0887C2A2283D6F7D01A5E97B6C2F6A4CC899F27AFA513CC6B295E34ADC84A1F1019240933402E0E6B8F84D6574726F2D52",
-    "payload_type": 4,
-    "route_type": 1,
-    "decoded": "{\"type\":\"ADVERT\",\"pubKey\":\"b7f1c45f2ed5888335f79e27085d0de871a7c8ecb1ef5313435ebd0825bacdc1\",\"timestamp\":1774314369,\"timestampISO\":\"2026-03-24T01:06:09.000Z\",\"signature\":\"5556f51a89c9895e2114d1feca91b58f82cbbbc1dd2b868addc0f7eb8c310d0887c2a2283d6f7d01a5e97b6c2f6a4cc899f27afa513cc6b295e34adc84a1f101\",\"flags\":{\"raw\":146,\"type\":2,\"chat\":false,\"repeater\":true,\"room\":false,\"sensor\":false,\"hasLocation\":true,\"hasName\":true},\"lat\":37,\"lon\":-122.1,\"name\":\"Metro-R\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 1,
-      "hops": [
-        "46"
-      ]
-    }
-  },
-  {
-    "raw_hex": "15001A901C5D927D90572BAF6135D226F91D180AD4F7B90DF20F82EEEA920312D9CCFD9C3F8CA9EFBEB1C37DFA31265F73483BD0640EC94E247902F617B2C320BFA332F50441AD234D8324A48ABAA9A16EB15BD50F2D67029F2424E0836010A635EB45B5DFDB4CDC080C09FC849040AB4B82769E0F",
-    "payload_type": 5,
-    "route_type": 1,
-    "decoded": "{\"type\":\"GRP_TXT\",\"channelHash\":26,\"mac\":\"901c\",\"encryptedData\":\"5d927d90572baf6135d226f91d180ad4f7b90df20f82eeea920312d9ccfd9c3f8ca9efbeb1c37dfa31265f73483bd0640ec94e247902f617b2c320bfa332f50441ad234d8324a48abaa9a16eb15bd50f2d67029f2424e0836010a635eb45b5dfdb4cdc080c09fc849040ab4b82769e0f\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0A00D69F0E65C6CCDEBE8391ED093D3C76E2D064F525",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"0e65\",\"encryptedData\":\"c6ccdebe8391ed093d3c76e2d064f525\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "0A00D69F940E0BA255095E9540EE6E23895DA80AAC60",
-    "payload_type": 2,
-    "route_type": 2,
-    "decoded": "{\"type\":\"TXT_MSG\",\"destHash\":\"d6\",\"srcHash\":\"9f\",\"mac\":\"940e\",\"encryptedData\":\"0ba255095e9540ee6e23895da80aac60\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  },
-  {
-    "raw_hex": "06001f5d5acf699ea80c7ca1a9349b8af9a1b47d4a1a",
-    "payload_type": 1,
-    "route_type": 2,
-    "decoded": "{\"type\":\"RESPONSE\",\"destHash\":\"1f\",\"srcHash\":\"5d\",\"mac\":\"5acf\",\"encryptedData\":\"699ea80c7ca1a9349b8af9a1b47d4a1a\"}",
-    "path": {
-      "hashSize": 1,
-      "hashCount": 0,
-      "hops": []
-    }
-  }
-];
-
-// One special case: the advert with 1 hop from prod had raw_hex starting with "110146"
-// but the API reported path ["46"]. Let me re-check — header 0x11 = routeType 1, payloadType 4.
-// pathByte 0x01 = 1 hop, 1-byte hash. Next byte is 0x46 = the hop. Correct.
-// However, the raw_hex I captured from the API was "110146B7F1..." but the actual prod JSON showed path ["46"].
-// I need to use the correct raw_hex. Let me fix fixture 15 (Metro-R advert).
-
-for (let i = 0; i < goldenFixtures.length; i++) {
-  const fix = goldenFixtures[i];
-  const expected = typeof fix.decoded === "string" ? JSON.parse(fix.decoded) : fix.decoded;
-  const label = `golden[${i}] ${expected.type}`;
-
-  try {
-    const result = decodePacket(fix.raw_hex);
-
-    // Verify header matches expected route/payload type
-    assertEq(result.header.routeType, fix.route_type, `${label}: routeType`);
-    assertEq(result.header.payloadType, fix.payload_type, `${label}: payloadType`);
-
-    // Verify path hops
-    assertDeepEq(result.path.hops, (fix.path.hops || fix.path), `${label}: path hops`);
-
-    // Verify payload matches prod decoded output
-    // Compare key fields rather than full deep equality (to handle minor serialization diffs)
-    
-    assertEq(result.payload.type, expected.type, `${label}: payload type`);
-
-    if (expected.type === 'ADVERT') {
-      assertEq(result.payload.pubKey, expected.pubKey, `${label}: pubKey`);
-      assertEq(result.payload.timestamp, expected.timestamp, `${label}: timestamp`);
-      assertEq(result.payload.signature, expected.signature, `${label}: signature`);
-      if (expected.flags) {
-        assertEq(result.payload.flags.raw, expected.flags.raw, `${label}: flags.raw`);
-        assertEq(result.payload.flags.type, expected.flags.type, `${label}: flags.type`);
-        assertEq(result.payload.flags.hasLocation, expected.flags.hasLocation, `${label}: hasLocation`);
-        assertEq(result.payload.flags.hasName, expected.flags.hasName, `${label}: hasName`);
-      }
-      if (expected.lat != null) assert(Math.abs(result.payload.lat - expected.lat) < 0.001, `${label}: lat`);
-      if (expected.lon != null) assert(Math.abs(result.payload.lon - expected.lon) < 0.001, `${label}: lon`);
-      if (expected.name) assertEq(result.payload.name, expected.name, `${label}: name`);
-
-      // Spec checks on advert structure
-      assert(result.payload.pubKey.length === 64, `${label}: pubKey is 32 bytes (64 hex chars)`);
-      assert(result.payload.signature.length === 128, `${label}: signature is 64 bytes (128 hex chars)`);
-    } else if (expected.type === 'GRP_TXT' || expected.type === 'CHAN') {
-      assertEq(result.payload.channelHash, expected.channelHash, `${label}: channelHash`);
-      // If decoded as CHAN (with channel key), check sender/text; otherwise check mac/encrypted
-      if (expected.type === 'GRP_TXT') {
-        assertEq(result.payload.mac, expected.mac, `${label}: mac`);
-        assertEq(result.payload.encryptedData, expected.encryptedData, `${label}: encryptedData`);
-      }
-    } else if (expected.type === 'ANON_REQ') {
-      assertEq(result.payload.destHash, expected.destHash, `${label}: destHash`);
-      assertEq(result.payload.ephemeralPubKey, expected.ephemeralPubKey, `${label}: ephemeralPubKey`);
-      assertEq(result.payload.mac, expected.mac, `${label}: mac`);
-    } else {
-      // Encrypted payload types: REQ, RESPONSE, TXT_MSG, PATH
-      assertEq(result.payload.destHash, expected.destHash, `${label}: destHash`);
-      assertEq(result.payload.srcHash, expected.srcHash, `${label}: srcHash`);
-      assertEq(result.payload.mac, expected.mac, `${label}: mac`);
-      if (expected.encryptedData) assertEq(result.payload.encryptedData, expected.encryptedData, `${label}: encryptedData`);
-      if (expected.pathData) assertEq(result.payload.pathData, expected.pathData, `${label}: pathData`);
-    }
-  } catch (e) {
-    failed++;
-    console.error(`  FAIL: ${label} — threw: ${e.message}`);
-  }
-}
-
-// ═══════════════════════════════════════════════════════════
-// Summary
-// ═══════════════════════════════════════════════════════════
-
-console.log('');
-console.log(`═══ Results: ${passed} passed, ${failed} failed, ${noted} notes ═══`);
-if (failed > 0) process.exit(1);

test-decoder.js

@@ -1,630 +0,0 @@
-/* Unit tests for decoder.js */
-'use strict';
-const assert = require('assert');
-const { decodePacket, validateAdvert, ROUTE_TYPES, PAYLOAD_TYPES, VALID_ROLES } = require('./decoder');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ✅ ${name}`); }
-  catch (e) { failed++; console.log(`  ❌ ${name}: ${e.message}`); }
-}
-
-// === Constants ===
-console.log('\n=== Constants ===');
-test('ROUTE_TYPES has 4 entries', () => assert.strictEqual(Object.keys(ROUTE_TYPES).length, 4));
-test('PAYLOAD_TYPES has 13 entries', () => assert.strictEqual(Object.keys(PAYLOAD_TYPES).length, 13));
-test('VALID_ROLES has repeater, companion, room, sensor', () => {
-  for (const r of ['repeater', 'companion', 'room', 'sensor']) assert(VALID_ROLES.has(r));
-});
-
-// === Header decoding ===
-console.log('\n=== Header decoding ===');
-test('FLOOD + ADVERT = 0x11', () => {
-  const p = decodePacket('1100' + '00'.repeat(101));
-  assert.strictEqual(p.header.routeType, 1);
-  assert.strictEqual(p.header.routeTypeName, 'FLOOD');
-  assert.strictEqual(p.header.payloadType, 4);
-  assert.strictEqual(p.header.payloadTypeName, 'ADVERT');
-});
-
-test('TRANSPORT_FLOOD = routeType 0', () => {
-  // header=0x00 (TRANSPORT_FLOOD + REQ), transportCodes=AABB+CCDD, pathByte=0x00, payload
-  const hex = '00' + 'AABB' + 'CCDD' + '00' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 0);
-  assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_FLOOD');
-  assert.notStrictEqual(p.transportCodes, null);
-  assert.strictEqual(p.transportCodes.code1, 'AABB');
-  assert.strictEqual(p.transportCodes.code2, 'CCDD');
-});
-
-test('TRANSPORT_DIRECT = routeType 3', () => {
-  const hex = '03' + '1122' + '3344' + '00' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 3);
-  assert.strictEqual(p.header.routeTypeName, 'TRANSPORT_DIRECT');
-  assert.strictEqual(p.transportCodes.code1, '1122');
-});
-
-test('DIRECT = routeType 2, no transport codes', () => {
-  const hex = '0200' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 2);
-  assert.strictEqual(p.header.routeTypeName, 'DIRECT');
-  assert.strictEqual(p.transportCodes, null);
-});
-
-test('payload version extracted', () => {
-  // 0xC1 = 11_0000_01 → version=3, payloadType=0, routeType=1
-  const hex = 'C100' + '00'.repeat(16);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.payloadVersion, 3);
-});
-
-// === Path decoding ===
-console.log('\n=== Path decoding ===');
-test('hashSize=1, hashCount=3', () => {
-  // pathByte = 0x03 → (0>>6)+1=1, 3&0x3F=3
-  const hex = '1103' + 'AABBCC' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashSize, 1);
-  assert.strictEqual(p.path.hashCount, 3);
-  assert.strictEqual(p.path.hops.length, 3);
-  assert.strictEqual(p.path.hops[0], 'AA');
-  assert.strictEqual(p.path.hops[1], 'BB');
-  assert.strictEqual(p.path.hops[2], 'CC');
-});
-
-test('hashSize=2, hashCount=2', () => {
-  // pathByte = 0x42 → (1>>0=1)+1=2, 2&0x3F=2
-  const hex = '1142' + 'AABB' + 'CCDD' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashSize, 2);
-  assert.strictEqual(p.path.hashCount, 2);
-  assert.strictEqual(p.path.hops[0], 'AABB');
-  assert.strictEqual(p.path.hops[1], 'CCDD');
-});
-
-test('hashSize=4 from pathByte 0xC1', () => {
-  // 0xC1 = 11_000001 → hashSize=(3)+1=4, hashCount=1
-  const hex = '11C1' + 'DEADBEEF' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashSize, 4);
-  assert.strictEqual(p.path.hashCount, 1);
-  assert.strictEqual(p.path.hops[0], 'DEADBEEF');
-});
-
-test('zero hops', () => {
-  const hex = '1100' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashCount, 0);
-  assert.strictEqual(p.path.hops.length, 0);
-});
-
-// === Payload types ===
-console.log('\n=== ADVERT payload ===');
-test('ADVERT with name and location', () => {
-  const pkt = decodePacket(
-    '11451000D818206D3AAC152C8A91F89957E6D30CA51F36E28790228971C473B755F244F718754CF5EE4A2FD58D944466E42CDED140C66D0CC590183E32BAF40F112BE8F3F2BDF6012B4B2793C52F1D36F69EE054D9A05593286F78453E56C0EC4A3EB95DDA2A7543FCCC00B939CACC009278603902FC12BCF84B706120526F6F6620536F6C6172'
-  );
-  assert.strictEqual(pkt.payload.type, 'ADVERT');
-  assert.strictEqual(pkt.payload.name, 'Kpa Roof Solar');
-  assert(pkt.payload.pubKey.length === 64);
-  assert(pkt.payload.timestamp > 0);
-  assert(pkt.payload.timestampISO);
-  assert(pkt.payload.signature.length === 128);
-});
-
-test('ADVERT flags: chat type=1', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '01'; // type=1 → chat
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 1);
-  assert.strictEqual(p.payload.flags.chat, true);
-  assert.strictEqual(p.payload.flags.repeater, false);
-});
-
-test('ADVERT flags: repeater type=2', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '02';
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 2);
-  assert.strictEqual(p.payload.flags.repeater, true);
-});
-
-test('ADVERT flags: room type=3', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '03';
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 3);
-  assert.strictEqual(p.payload.flags.room, true);
-});
-
-test('ADVERT flags: sensor type=4', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  const flags = '04';
-  const hex = '1100' + pubKey + ts + sig + flags;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.type, 4);
-  assert.strictEqual(p.payload.flags.sensor, true);
-});
-
-test('ADVERT flags: hasLocation', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  // flags=0x12 → type=2(repeater), hasLocation=true
-  const flags = '12';
-  const lat = '40420f00'; // 1000000 → 1.0 degrees
-  const lon = '80841e00'; // 2000000 → 2.0 degrees
-  const hex = '1100' + pubKey + ts + sig + flags + lat + lon;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.hasLocation, true);
-  assert.strictEqual(p.payload.lat, 1.0);
-  assert.strictEqual(p.payload.lon, 2.0);
-});
-
-test('ADVERT flags: hasName', () => {
-  const pubKey = 'AB'.repeat(32);
-  const ts = '01000000';
-  const sig = 'CC'.repeat(64);
-  // flags=0x82 → type=2(repeater), hasName=true
-  const flags = '82';
-  const name = Buffer.from('MyNode').toString('hex');
-  const hex = '1100' + pubKey + ts + sig + flags + name;
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.flags.hasName, true);
-  assert.strictEqual(p.payload.name, 'MyNode');
-});
-
-test('ADVERT too short', () => {
-  const hex = '1100' + '00'.repeat(50);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== GRP_TXT payload ===');
-test('GRP_TXT basic decode', () => {
-  // payloadType=5 → (5<<2)|1 = 0x15
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'GRP_TXT');
-  assert.strictEqual(p.payload.channelHash, 0xFF);
-  assert.strictEqual(p.payload.mac, 'aabb');
-});
-
-test('GRP_TXT too short', () => {
-  const hex = '1500' + 'FF' + 'AA';
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-test('GRP_TXT has channelHashHex field', () => {
-  const hex = '1500' + '1A' + 'AABB' + 'CCDDEE';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.channelHashHex, '1A');
-});
-
-test('GRP_TXT channelHashHex zero-pads single digit', () => {
-  const hex = '1500' + '03' + 'AABB' + 'CCDDEE';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.channelHashHex, '03');
-});
-
-test('GRP_TXT decryptionStatus is no_key when no keys provided', () => {
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.decryptionStatus, 'no_key');
-});
-
-test('GRP_TXT decryptionStatus is no_key when keys empty', () => {
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-  const p = decodePacket(hex, {});
-  assert.strictEqual(p.payload.decryptionStatus, 'no_key');
-});
-
-test('GRP_TXT decryptionStatus is decryption_failed with bad keys', () => {
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-  const p = decodePacket(hex, { '#test': 'deadbeefdeadbeefdeadbeefdeadbeef' });
-  assert.strictEqual(p.payload.decryptionStatus, 'decryption_failed');
-});
-
-test('GRP_TXT decryptionStatus is no_key when encrypted data too short', () => {
-  // encryptedData < 10 hex chars (5 bytes) — not enough to attempt decryption
-  const hex = '1500' + 'FF' + 'AABB' + 'CCDD';
-  const p = decodePacket(hex, { '#test': 'deadbeefdeadbeefdeadbeefdeadbeef' });
-  assert.strictEqual(p.payload.decryptionStatus, 'no_key');
-});
-
-test('GRP_TXT decryptionStatus is decrypted when key matches', () => {
-  // Mock the ChannelCrypto module to simulate successful decryption
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: 'TestUser', message: 'Hello world', timestamp: 1700000000, flags: 0 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#general': 'aabbccddaabbccddaabbccddaabbccdd' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.type, 'CHAN');
-    assert.strictEqual(p.payload.channelHashHex, 'FF');
-    assert.strictEqual(p.payload.channel, '#general');
-    assert.strictEqual(p.payload.sender, 'TestUser');
-    assert.strictEqual(p.payload.text, 'TestUser: Hello world');
-    assert.strictEqual(p.payload.sender_timestamp, 1700000000);
-    assert.strictEqual(p.payload.flags, 0);
-    assert.strictEqual(p.payload.channelHash, 0xFF);
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-test('GRP_TXT decrypted without sender formats text correctly', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: null, message: 'Broadcast msg', timestamp: 1700000001, flags: 1 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + '0A' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#alerts': 'deadbeefdeadbeefdeadbeefdeadbeef' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.sender, null);
-    assert.strictEqual(p.payload.text, 'Broadcast msg');
-    assert.strictEqual(p.payload.channelHashHex, '0A');
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-test('GRP_TXT decrypted tries multiple keys, first match wins', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  let callCount = 0;
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: (ciphertext, mac, key) => {
-          callCount++;
-          if (key === 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb') {
-            return { success: true, data: { sender: 'Bob', message: 'Found it', timestamp: 0, flags: 0 } };
-          }
-          return { success: false };
-        },
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, {
-      '#wrong': 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
-      '#right': 'bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb',
-    });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.channel, '#right');
-    assert.strictEqual(p.payload.sender, 'Bob');
-    assert.strictEqual(callCount, 2);
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-console.log('\n=== TXT_MSG payload ===');
-test('TXT_MSG decode', () => {
-  // payloadType=2 → (2<<2)|1 = 0x09
-  const hex = '0900' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'TXT_MSG');
-  assert(p.payload.destHash);
-  assert(p.payload.srcHash);
-  assert(p.payload.mac);
-});
-
-console.log('\n=== ACK payload ===');
-test('ACK decode', () => {
-  // payloadType=3 → (3<<2)|1 = 0x0D
-  const hex = '0D00' + '00'.repeat(18);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'ACK');
-  assert(p.payload.ackChecksum);
-});
-
-test('ACK too short', () => {
-  const hex = '0D00' + '00'.repeat(3);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== REQ payload ===');
-test('REQ decode', () => {
-  // payloadType=0 → (0<<2)|1 = 0x01
-  const hex = '0100' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'REQ');
-});
-
-console.log('\n=== RESPONSE payload ===');
-test('RESPONSE decode', () => {
-  // payloadType=1 → (1<<2)|1 = 0x05
-  const hex = '0500' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'RESPONSE');
-});
-
-console.log('\n=== ANON_REQ payload ===');
-test('ANON_REQ decode', () => {
-  // payloadType=7 → (7<<2)|1 = 0x1D
-  const hex = '1D00' + '00'.repeat(50);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'ANON_REQ');
-  assert(p.payload.destHash);
-  assert(p.payload.ephemeralPubKey);
-  assert(p.payload.mac);
-});
-
-test('ANON_REQ too short', () => {
-  const hex = '1D00' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== PATH payload ===');
-test('PATH decode', () => {
-  // payloadType=8 → (8<<2)|1 = 0x21
-  const hex = '2100' + '00'.repeat(20);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'PATH');
-  assert(p.payload.destHash);
-  assert(p.payload.srcHash);
-});
-
-test('PATH too short', () => {
-  const hex = '2100' + '00'.repeat(1);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== TRACE payload ===');
-test('TRACE decode', () => {
-  // payloadType=9 → (9<<2)|1 = 0x25
-  const hex = '2500' + '00'.repeat(12);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'TRACE');
-  assert(p.payload.tag !== undefined);
-  assert(p.payload.authCode !== undefined);
-  assert.strictEqual(p.payload.flags, 0);
-});
-
-test('TRACE too short', () => {
-  const hex = '2500' + '00'.repeat(5);
-  const p = decodePacket(hex);
-  assert(p.payload.error);
-});
-
-console.log('\n=== UNKNOWN payload ===');
-test('Unknown payload type', () => {
-  // payloadType=6 → (6<<2)|1 = 0x19
-  const hex = '1900' + 'DEADBEEF';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.payload.type, 'UNKNOWN');
-  assert(p.payload.raw);
-});
-
-// === Edge cases ===
-console.log('\n=== Edge cases ===');
-test('Packet too short throws', () => {
-  assert.throws(() => decodePacket('FF'), /too short/);
-});
-
-test('Packet with spaces in hex', () => {
-  const hex = '11 00 ' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.payloadTypeName, 'ADVERT');
-});
-
-test('Transport route too short throws', () => {
-  assert.throws(() => decodePacket('0000'), /too short for transport/);
-});
-
-test('Corrupt packet #183 — TRANSPORT_DIRECT with correct field order', () => {
-  const hex = 'BBAD6797EC8751D500BF95A1A776EF580E665BCBF6A0BBE03B5E730707C53489B8C728FD3FB902397197E1263CEC21E52465362243685DBBAD6797EC8751C90A75D9FD8213155D';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.header.routeType, 3, 'routeType should be TRANSPORT_DIRECT');
-  assert.strictEqual(p.header.payloadTypeName, 'UNKNOWN');
-  // transport codes are bytes 1-4, pathByte=0x87 at byte 5
-  assert.strictEqual(p.transportCodes.code1, 'AD67');
-  assert.strictEqual(p.transportCodes.code2, '97EC');
-  // pathByte 0x87: hashSize=3, hashCount=7
-  assert.strictEqual(p.path.hashSize, 3);
-  assert.strictEqual(p.path.hashCount, 7);
-  assert.strictEqual(p.path.hops.length, 7);
-  // No empty strings in hops
-  assert(p.path.hops.every(h => h.length > 0), 'no empty hops');
-});
-
-test('path.truncated is false for normal packets', () => {
-  const hex = '1100' + '00'.repeat(101);
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.truncated, false);
-});
-
-test('path overflow with hashSize=2', () => {
-  // FLOOD + REQ, pathByte=0x45 → hashSize=2, hashCount=5, needs 10 bytes of path
-  // Only provide 7 bytes after pathByte → fits 3 full 2-byte hops
-  const hex = '0145' + 'AABBCCDDEEFF77';
-  const p = decodePacket(hex);
-  assert.strictEqual(p.path.hashCount, 3);
-  assert.strictEqual(p.path.truncated, true);
-  assert.strictEqual(p.path.hops.length, 3);
-  assert.strictEqual(p.path.hops[0], 'AABB');
-  assert.strictEqual(p.path.hops[1], 'CCDD');
-  assert.strictEqual(p.path.hops[2], 'EEFF');
-});
-
-// === Real packets from API ===
-console.log('\n=== Real packets ===');
-test('Real GRP_TXT packet', () => {
-  const p = decodePacket('150115D96CFF1FC90E7917B91729B76C1B509AE7789BBBD87D5AC3837E6C1487B47B0958AED8C7A6');
-  assert.strictEqual(p.header.payloadTypeName, 'GRP_TXT');
-  assert.strictEqual(p.header.routeTypeName, 'FLOOD');
-  assert.strictEqual(p.path.hashCount, 1);
-});
-
-test('Real ADVERT packet FLOOD with 3 hops', () => {
-  const p = decodePacket('11036CEF52206D763E1EACFD52FBAD4EF926887D0694C42A618AAF480A67C41120D3785950EFE0C1');
-  assert.strictEqual(p.header.payloadTypeName, 'ADVERT');
-  assert.strictEqual(p.header.routeTypeName, 'FLOOD');
-  assert.strictEqual(p.path.hashCount, 3);
-  assert.strictEqual(p.path.hashSize, 1);
-  // Payload is too short for full ADVERT but decoder handles it
-  assert.strictEqual(p.payload.type, 'ADVERT');
-});
-
-test('Real DIRECT TXT_MSG packet', () => {
-  // 0x0A = DIRECT(2) + TXT_MSG(2)
-  const p = decodePacket('0A403220AD034C0394C2C449810E3D86399C53AEE7FE355BA67002FFC3627B1175A257A181AE');
-  assert.strictEqual(p.header.payloadTypeName, 'TXT_MSG');
-  assert.strictEqual(p.header.routeTypeName, 'DIRECT');
-});
-
-// === validateAdvert ===
-console.log('\n=== validateAdvert ===');
-test('valid advert', () => {
-  const a = { pubKey: 'AB'.repeat(16), flags: { repeater: true, room: false, sensor: false } };
-  assert.deepStrictEqual(validateAdvert(a), { valid: true });
-});
-
-test('null advert', () => {
-  assert.strictEqual(validateAdvert(null).valid, false);
-});
-
-test('advert with error', () => {
-  assert.strictEqual(validateAdvert({ error: 'bad' }).valid, false);
-});
-
-test('pubkey too short', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AABB' }).valid, false);
-});
-
-test('pubkey all zeros', () => {
-  assert.strictEqual(validateAdvert({ pubKey: '0'.repeat(64) }).valid, false);
-});
-
-test('invalid lat', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), lat: 200 }).valid, false);
-});
-
-test('invalid lon', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), lon: -200 }).valid, false);
-});
-
-test('name with control chars', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), name: 'test\x00bad' }).valid, false);
-});
-
-test('name too long', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), name: 'A'.repeat(65) }).valid, false);
-});
-
-test('valid name', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), name: 'My Node' }).valid, true);
-});
-
-test('valid lat/lon', () => {
-  const r = validateAdvert({ pubKey: 'AB'.repeat(16), lat: 37.3, lon: -121.9 });
-  assert.strictEqual(r.valid, true);
-});
-
-test('NaN lat invalid', () => {
-  assert.strictEqual(validateAdvert({ pubKey: 'AB'.repeat(16), lat: NaN }).valid, false);
-});
-
-// --- GRP_TXT garbage detection (fixes #197) ---
-
-test('GRP_TXT decrypted garbage text marked as decryption_failed', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: 'Node', message: '\x01\x02\x03\x80\x81', timestamp: 1700000000, flags: 0 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#general': 'aabbccddaabbccddaabbccddaabbccdd' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decryption_failed');
-    assert.strictEqual(p.payload.text, null);
-    assert.strictEqual(p.payload.channelHashHex, 'FF');
-    assert.strictEqual(p.payload.channel, '#general');
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-test('GRP_TXT valid text still marked as decrypted', () => {
-  const cryptoPath = require.resolve('@michaelhart/meshcore-decoder/dist/crypto/channel-crypto');
-  const originalModule = require.cache[cryptoPath];
-  require.cache[cryptoPath] = {
-    id: cryptoPath,
-    exports: {
-      ChannelCrypto: {
-        decryptGroupTextMessage: () => ({
-          success: true,
-          data: { sender: 'Alice', message: 'Hello\nworld', timestamp: 1700000000, flags: 0 },
-        }),
-      },
-    },
-  };
-  try {
-    const hex = '1500' + 'FF' + 'AABB' + 'CCDDEE112233';
-    const p = decodePacket(hex, { '#general': 'aabbccddaabbccddaabbccddaabbccdd' });
-    assert.strictEqual(p.payload.decryptionStatus, 'decrypted');
-    assert.strictEqual(p.payload.text, 'Alice: Hello\nworld');
-  } finally {
-    if (originalModule) require.cache[cryptoPath] = originalModule;
-    else delete require.cache[cryptoPath];
-  }
-});
-
-// === Summary ===
-console.log(`\n${passed} passed, ${failed} failed`);
-if (failed > 0) process.exit(1);

test-e2e-playwright.js

@@ -17,6 +17,8 @@ async function test(name, fn) {
   } catch (err) {
     results.push({ name, pass: false, error: err.message });
     console.log(`  \u274c ${name}: ${err.message}`);
+    console.log(`\nFail-fast: stopping after first failure.`);
+    process.exit(1);
   }
 }
 
@@ -351,7 +353,9 @@ async function run() {
   });
 
   // Test: Clicking a packet row opens detail pane
-  await test('Packets clicking row shows detail pane', async () => {
+  // SKIPPED: flaky test — see https://github.com/Kpa-clawbot/CoreScope/issues/257
+  console.log('  ⏭️  Packets clicking row shows detail pane (SKIPPED — flaky)');
+  /*await test('Packets clicking row shows detail pane', async () => {
     // Fresh navigation to avoid stale row references from previous test
     await page.goto(`${BASE}/#/packets`, { waitUntil: 'domcontentloaded' });
     // Wait for table rows AND initial API data to settle
@@ -406,7 +410,8 @@ async function run() {
     }, { timeout: 3000 });
     const panelHidden = await page.$eval('#pktRight', el => el.classList.contains('empty'));
     assert(panelHidden, 'Detail pane should be hidden after clicking ✕');
-  });
+  });*/
+  console.log('  ⏭️  Packet detail pane closes on ✕ click (SKIPPED — depends on flaky test above)');
 
   // Test: GRP_TXT packet detail shows Channel Hash (#123)
   await test('GRP_TXT packet detail shows Channel Hash', async () => {
@@ -840,17 +845,7 @@ async function run() {
     assert(content.length > 10, 'Perf content should still be present after refresh');
   });
 
-  // Test: Node.js perf page shows Event Loop metrics (not Go Runtime)
-  await test('Perf page shows Event Loop on Node server', async () => {
-    const perfText = await page.$eval('#perfContent', el => el.textContent);
-    // Node.js server should show Event Loop metrics
-    const hasEventLoop = perfText.includes('Event Loop') || perfText.includes('event loop');
-    const hasMemory = perfText.includes('Memory') || perfText.includes('RSS');
-    assert(hasEventLoop || hasMemory, 'Node perf page should show Event Loop or Memory metrics');
-    // Should NOT show Go Runtime section on Node.js server
-    const hasGoRuntime = perfText.includes('Go Runtime');
-    assert(!hasGoRuntime, 'Node perf page should NOT show Go Runtime section');
-  });
+
 
   // Test: Go perf page shows Go Runtime section (goroutines, GC)
   // NOTE: This test requires GO_BASE_URL pointing to Go staging (port 82)

test-frontend-helpers.js

@@ -104,6 +104,75 @@ console.log('\n=== app.js: timeAgo ===');
     const d = new Date(Date.now() - 259200000).toISOString();
     assert.strictEqual(timeAgo(d), '3d ago');
   });
+  test('future timestamp returns in-format', () => {
+    const d = new Date(Date.now() + 120000).toISOString();
+    assert.strictEqual(timeAgo(d), 'in 2m');
+  });
+}
+
+console.log('\n=== app.js: formatTimestamp / formatTimestampWithTooltip ===');
+{
+  const ctx = makeSandbox();
+  loadInCtx(ctx, 'public/roles.js');
+  loadInCtx(ctx, 'public/app.js');
+  const formatTimestamp = ctx.formatTimestamp;
+  const formatTimestampWithTooltip = ctx.formatTimestampWithTooltip;
+
+  test('formatTimestamp null returns dash', () => {
+    assert.strictEqual(formatTimestamp(null, 'ago'), '—');
+  });
+  test('formatTimestamp ago returns relative string', () => {
+    const d = new Date(Date.now() - 300000).toISOString();
+    assert.strictEqual(formatTimestamp(d, 'ago'), '5m ago');
+  });
+  test('formatTimestamp absolute returns formatted timestamp', () => {
+    const d = '2024-01-02T03:04:05.000Z';
+    const out = formatTimestamp(d, 'absolute');
+    assert.ok(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(out));
+  });
+  test('formatTimestamp absolute with timezone utc uses UTC fields', () => {
+    const d = '2024-01-02T03:04:05.123Z';
+    ctx.localStorage.setItem('meshcore-timestamp-timezone', 'utc');
+    ctx.localStorage.setItem('meshcore-timestamp-format', 'iso');
+    assert.strictEqual(formatTimestamp(d, 'absolute'), '2024-01-02 03:04:05');
+  });
+  test('formatTimestamp absolute with timezone local uses local fields', () => {
+    const d = '2024-01-02T03:04:05.123Z';
+    ctx.localStorage.setItem('meshcore-timestamp-timezone', 'local');
+    ctx.localStorage.setItem('meshcore-timestamp-format', 'iso');
+    const out = formatTimestamp(d, 'absolute');
+    const expected = d.replace('T', ' ').slice(0, 19);
+    assert.strictEqual(out.length, 19);
+    assert.ok(/^\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2}$/.test(out));
+    if (new Date(d).getTimezoneOffset() === 0) assert.strictEqual(out, expected);
+    else assert.notStrictEqual(out, expected);
+  });
+  test('formatTimestamp absolute iso-seconds includes milliseconds', () => {
+    const d = '2024-01-02T03:04:05.123Z';
+    ctx.localStorage.setItem('meshcore-timestamp-timezone', 'utc');
+    ctx.localStorage.setItem('meshcore-timestamp-format', 'iso-seconds');
+    assert.strictEqual(formatTimestamp(d, 'absolute'), '2024-01-02 03:04:05.123');
+  });
+  test('formatTimestamp absolute locale uses toLocaleString', () => {
+    const d = '2024-01-02T03:04:05.123Z';
+    ctx.localStorage.setItem('meshcore-timestamp-timezone', 'local');
+    ctx.localStorage.setItem('meshcore-timestamp-format', 'locale');
+    assert.strictEqual(formatTimestamp(d, 'absolute'), new Date(d).toLocaleString());
+  });
+  test('formatTimestampWithTooltip future returns isFuture true', () => {
+    const d = new Date(Date.now() + 120000).toISOString();
+    const out = formatTimestampWithTooltip(d, 'ago');
+    assert.strictEqual(out.isFuture, true);
+    assert.ok(typeof out.text === 'string' && out.text.length > 0);
+    assert.strictEqual(out.tooltip, 'in 2m');
+  });
+  test('tooltip is opposite format', () => {
+    const d = '2024-01-02T03:04:05.000Z';
+    const ago = formatTimestampWithTooltip(d, 'ago');
+    const absolute = formatTimestampWithTooltip(d, 'absolute');
+    assert.ok(typeof ago.tooltip === 'string' && ago.tooltip.length > 0);
+    assert.ok(absolute.tooltip.endsWith('ago') || absolute.tooltip.startsWith('in '));
+  });
 }
 
 console.log('\n=== app.js: escapeHtml ===');
@@ -151,27 +220,7 @@ console.log('\n=== app.js: truncate ===');
 // ===== NODES.JS TESTS =====
 console.log('\n=== nodes.js: getStatusInfo ===');
 {
-  const ctx = makeSandbox();
-  loadInCtx(ctx, 'public/roles.js');
-  // nodes.js is an IIFE that registers a page — we need to mock registerPage and other globals
-  ctx.registerPage = () => {};
-  ctx.api = () => Promise.resolve([]);
-  ctx.timeAgo = vm.runInContext(`(${fs.readFileSync('public/app.js', 'utf8').match(/function timeAgo[^}]+}/)[0]})`, ctx);
-  // Actually, let's load app.js first for its globals
-  loadInCtx(ctx, 'public/app.js');
-  ctx.RegionFilter = { init: () => {}, getSelected: () => null, onRegionChange: () => {} };
-  ctx.onWS = () => {};
-  ctx.offWS = () => {};
-  ctx.invalidateApiCache = () => {};
-  ctx.favStar = () => '';
-  ctx.bindFavStars = () => {};
-  ctx.getFavorites = () => [];
-  ctx.isFavorite = () => false;
-  ctx.connectWS = () => {};
-  loadInCtx(ctx, 'public/nodes.js');
-
-  // getStatusInfo is inside the IIFE, not on window. We need to extract it differently.
-  // Let's use a modified approach - inject a hook before loading
+  // Placeholder header for continuity; actual nodes tests are below using injected exports.
 }
 
 // Since nodes.js functions are inside an IIFE, we need to extract them.
@@ -1251,6 +1300,9 @@ console.log('\n=== compare.js: comparePacketSets ===');
 {
   console.log('\nPackets page — detail pane initial state:');
   const packetsSource = fs.readFileSync('public/packets.js', 'utf8');
+  const removeAllByopOverlaysSource = extractFunctionSourceFromText(packetsSource, 'removeAllByopOverlays');
+  const showBYOPSource = extractFunctionSourceFromText(packetsSource, 'showBYOP');
+  const bindDocumentHandlerSource = extractFunctionSourceFromText(packetsSource, 'bindDocumentHandler');
 
   test('split-layout starts with detail-collapsed class', () => {
     // The template literal that creates the split-layout must include detail-collapsed
@@ -1269,6 +1321,198 @@ console.log('\n=== compare.js: comparePacketSets ===');
     assert.ok(packetsSource.includes("classList.remove('detail-collapsed')"),
       'selectPacket should remove detail-collapsed class');
   });
+
+  test('BYOP uses dedicated overlay class and clears existing overlays before opening', () => {
+    assert.ok(packetsSource.includes("overlay.className = 'modal-overlay byop-overlay'"),
+      'BYOP overlay should have byop-overlay class');
+    assert.ok(/function showBYOP\(\)\s*\{\s*removeAllByopOverlays\(\);/m.test(packetsSource),
+      'showBYOP should clear existing overlays before creating a new one');
+  });
+
+  test('BYOP close removes all overlays in one click', () => {
+    assert.ok(packetsSource.includes("const close = () => { removeAllByopOverlays(); if (triggerBtn) triggerBtn.focus(); };"),
+      'close handler should remove all BYOP overlays');
+  });
+
+  test('packets page de-duplicates document click handlers', () => {
+    assert.ok(packetsSource.includes("bindDocumentHandler('action', 'click'"),
+      'action click handler should be bound through bindDocumentHandler');
+    assert.ok(packetsSource.includes("bindDocumentHandler('menu', 'click'"),
+      'menu close handler should be bound through bindDocumentHandler');
+    assert.ok(packetsSource.includes("bindDocumentHandler('colmenu', 'click'"),
+      'column menu close handler should be bound through bindDocumentHandler');
+    assert.ok(packetsSource.includes("if (prev) document.removeEventListener(eventName, prev);"),
+      'bindDocumentHandler should remove previous handler before re-binding');
+  });
+
+  test('BYOP repeated opens keep exactly one overlay', () => {
+    assert.ok(removeAllByopOverlaysSource, 'removeAllByopOverlays source should be present');
+    assert.ok(showBYOPSource, 'showBYOP source should be present');
+    const ctx = vm.createContext({
+      document: createPacketsTestDocument(),
+      fetch: () => Promise.resolve({ json: () => Promise.resolve({}) }),
+      renderDecodedPacket: () => '',
+      routeTypeName: () => 'UNKNOWN',
+      payloadTypeName: () => 'UNKNOWN',
+    });
+    vm.runInContext(`${removeAllByopOverlaysSource}\n${showBYOPSource}`, ctx);
+    ctx.showBYOP();
+    ctx.showBYOP();
+    assert.strictEqual(ctx.document.getOverlayCount(), 1, 'repeated opens should leave one overlay');
+  });
+
+  test('BYOP close removes all overlays', () => {
+    assert.ok(removeAllByopOverlaysSource, 'removeAllByopOverlays source should be present');
+    assert.ok(showBYOPSource, 'showBYOP source should be present');
+    const ctx = vm.createContext({
+      document: createPacketsTestDocument(),
+      fetch: () => Promise.resolve({ json: () => Promise.resolve({}) }),
+      renderDecodedPacket: () => '',
+      routeTypeName: () => 'UNKNOWN',
+      payloadTypeName: () => 'UNKNOWN',
+    });
+    vm.runInContext(`${removeAllByopOverlaysSource}\n${showBYOPSource}`, ctx);
+    ctx.showBYOP();
+    // Simulate stale stacked overlay from prior bad state; close should clear all.
+    ctx.document.appendOverlay();
+    assert.strictEqual(ctx.document.getOverlayCount(), 2, 'setup should contain two overlays');
+    ctx.document.getFirstOverlay().querySelector('.byop-x').onclick();
+    assert.strictEqual(ctx.document.getOverlayCount(), 0, 'close should remove all BYOP overlays');
+  });
+
+  test('bindDocumentHandler removes previous handlers across SPA re-init', () => {
+    assert.ok(bindDocumentHandlerSource, 'bindDocumentHandler source should be present');
+    const doc = createBindingTestDocument();
+    const ctx = vm.createContext({
+      document: doc,
+      _docActionHandler: null,
+      _docMenuCloseHandler: null,
+      _docColMenuCloseHandler: null,
+      _docEscHandler: null,
+    });
+    vm.runInContext(bindDocumentHandlerSource, ctx);
+
+    let clicks = 0;
+    const clickHandlerV1 = () => { clicks += 1; };
+    const clickHandlerV2 = () => { clicks += 1; };
+    ctx.bindDocumentHandler('action', 'click', clickHandlerV1);
+    ctx.bindDocumentHandler('action', 'click', clickHandlerV2);
+    doc.dispatch('click', { type: 'click' });
+    assert.strictEqual(clicks, 1, 'only latest click handler should fire once');
+    assert.strictEqual(doc.getRemoveCount('click'), 1, 'rebind should remove prior click handler');
+
+    let esc = 0;
+    const escHandlerV1 = () => { esc += 1; };
+    const escHandlerV2 = () => { esc += 1; };
+    ctx.bindDocumentHandler('esc', 'keydown', escHandlerV1);
+    ctx.bindDocumentHandler('esc', 'keydown', escHandlerV2);
+    doc.dispatch('keydown', { key: 'Escape' });
+    assert.strictEqual(esc, 1, 'only latest esc handler should fire once');
+    assert.strictEqual(doc.getRemoveCount('keydown'), 1, 'rebind should remove prior keydown handler');
+  });
+}
+
+function extractFunctionSourceFromText(source, functionName) {
+  const start = source.indexOf(`function ${functionName}(`);
+  if (start === -1) return null;
+  let braceStart = source.indexOf('{', start);
+  if (braceStart === -1) return null;
+  let depth = 0;
+  for (let i = braceStart; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === '{') depth += 1;
+    else if (ch === '}') depth -= 1;
+    if (depth === 0) return source.slice(start, i + 1);
+  }
+  return null;
+}
+
+function createPacketsTestDocument() {
+  let overlays = [];
+  let activeElement = null;
+
+  function createFocusable() {
+    const focusable = {
+      onclick: null,
+      addEventListener: () => {},
+      focus: () => { activeElement = focusable; }
+    };
+    return focusable;
+  }
+
+  function createOverlay() {
+    let removed = false;
+    const closeBtn = createFocusable();
+    const decodeBtn = createFocusable();
+    const textarea = createFocusable();
+    textarea.value = '';
+    const result = { innerHTML: '' };
+    const modal = {
+      querySelectorAll: () => [textarea, decodeBtn, closeBtn],
+    };
+    const overlayObj = {
+      className: '',
+      innerHTML: '',
+      addEventListener: () => {},
+      querySelector: (sel) => {
+        if (sel === '.byop-modal') return modal;
+        if (sel === '.byop-x') return closeBtn;
+        if (sel === '#byopHex') return textarea;
+        if (sel === '#byopDecode') return decodeBtn;
+        if (sel === '#byopResult') return result;
+        return null;
+      },
+      remove: () => {
+        removed = true;
+        overlays = overlays.filter(o => o !== overlayObj);
+      },
+      __removed: () => removed,
+    };
+    return overlayObj;
+  }
+
+  const triggerBtn = { focus: () => { activeElement = triggerBtn; } };
+
+  return {
+    body: {
+      appendChild: (el) => { overlays.push(el); }
+    },
+    querySelector: (sel) => (sel === '[data-action="pkt-byop"]' ? triggerBtn : null),
+    querySelectorAll: (sel) => {
+      if (sel !== '.byop-overlay') return [];
+      return overlays.filter(o => !o.__removed || !o.__removed());
+    },
+    createElement: () => createOverlay(),
+    appendOverlay: function () {
+      const extra = this.createElement('div');
+      extra.className = 'modal-overlay byop-overlay';
+      this.body.appendChild(extra);
+      return extra;
+    },
+    getFirstOverlay: () => overlays[0],
+    getOverlayCount: () => overlays.length,
+    getLastOverlay: () => overlays[overlays.length - 1],
+    get activeElement() { return activeElement; },
+  };
+}
+
+function createBindingTestDocument() {
+  const listeners = new Map();
+  const removeCounts = new Map();
+  return {
+    addEventListener: (event, handler) => {
+      listeners.set(event, handler);
+    },
+    removeEventListener: (event, handler) => {
+      if (listeners.get(event) === handler) listeners.delete(event);
+      removeCounts.set(event, (removeCounts.get(event) || 0) + 1);
+    },
+    dispatch: (event, payload) => {
+      const handler = listeners.get(event);
+      if (handler) handler(payload || {});
+    },
+    getRemoveCount: (event) => removeCounts.get(event) || 0,
+  };
 }
 
 // ===== APP.JS: formatEngineBadge =====
@@ -1602,6 +1846,259 @@ console.log('\n=== analytics.js: sortChannels ===');
   });
 }
 
+// === analytics.js: hash prefix helpers ===
+console.log('\n=== analytics.js: hash prefix helpers ===');
+{
+  const ctx = (() => {
+    const c = makeSandbox();
+    c.getComputedStyle = () => ({ getPropertyValue: () => '' });
+    c.registerPage = () => {};
+    c.api = () => Promise.resolve({});
+    c.timeAgo = () => '—';
+    c.RegionFilter = { init: () => {}, onChange: () => {}, regionQueryString: () => '' };
+    c.onWS = () => {};
+    c.offWS = () => {};
+    c.connectWS = () => {};
+    c.invalidateApiCache = () => {};
+    c.makeColumnsResizable = () => {};
+    c.initTabBar = () => {};
+    c.IATA_COORDS_GEO = {};
+    loadInCtx(c, 'public/roles.js');
+    loadInCtx(c, 'public/app.js');
+    try { loadInCtx(c, 'public/analytics.js'); } catch (e) {
+      for (const k of Object.keys(c.window)) c[k] = c.window[k];
+    }
+    return c;
+  })();
+
+  const buildOne = ctx.window._analyticsBuildOneBytePrefixMap;
+  const buildTwo = ctx.window._analyticsBuildTwoBytePrefixInfo;
+  const buildHops = ctx.window._analyticsBuildCollisionHops;
+
+  const node = (pk, extra) => ({ public_key: pk, name: pk.slice(0, 4), ...(extra || {}) });
+
+  test('buildOneBytePrefixMap exports exist', () => assert.ok(buildOne, 'must be exported'));
+  test('buildTwoBytePrefixInfo exports exist', () => assert.ok(buildTwo, 'must be exported'));
+  test('buildCollisionHops exports exist', () => assert.ok(buildHops, 'must be exported'));
+
+  // --- 1-byte prefix map ---
+  test('1-byte map has 256 keys', () => {
+    const m = buildOne([]);
+    assert.strictEqual(Object.keys(m).length, 256);
+  });
+
+  test('1-byte map places node in correct bucket', () => {
+    const n = node('AABBCC');
+    const m = buildOne([n]);
+    assert.strictEqual(m['AA'].length, 1);
+    assert.strictEqual(m['AA'][0].public_key, 'AABBCC');
+    assert.strictEqual(m['BB'].length, 0);
+  });
+
+  test('1-byte map groups two nodes with same prefix', () => {
+    const a = node('AA1111'), b = node('AA2222');
+    const m = buildOne([a, b]);
+    assert.strictEqual(m['AA'].length, 2);
+  });
+
+  test('1-byte map is case-insensitive for node keys', () => {
+    const n = node('aabbcc');
+    const m = buildOne([n]);
+    assert.strictEqual(m['AA'].length, 1);
+  });
+
+  test('1-byte map: empty input yields all empty buckets', () => {
+    const m = buildOne([]);
+    assert.ok(Object.values(m).every(v => v.length === 0));
+  });
+
+  // --- 2-byte prefix info ---
+  test('2-byte info has 256 first-byte keys', () => {
+    const info = buildTwo([]);
+    assert.strictEqual(Object.keys(info).length, 256);
+  });
+
+  test('2-byte info: no nodes → zero collisions', () => {
+    const info = buildTwo([]);
+    assert.ok(Object.values(info).every(e => e.collisionCount === 0));
+  });
+
+  test('2-byte info: node placed in correct first-byte group', () => {
+    const n = node('AABB1122');
+    const info = buildTwo([n]);
+    assert.strictEqual(info['AA'].groupNodes.length, 1);
+    assert.strictEqual(info['BB'].groupNodes.length, 0);
+  });
+
+  test('2-byte info: same 2-byte prefix = collision', () => {
+    const a = node('AABB0001'), b = node('AABB0002');
+    const info = buildTwo([a, b]);
+    assert.strictEqual(info['AA'].collisionCount, 1);
+    assert.strictEqual(info['AA'].maxCollision, 2);
+  });
+
+  test('2-byte info: different 2-byte prefixes in same group = no collision', () => {
+    const a = node('AA110001'), b = node('AA220002');
+    const info = buildTwo([a, b]);
+    assert.strictEqual(info['AA'].collisionCount, 0);
+    assert.strictEqual(info['AA'].maxCollision, 0);
+  });
+
+  test('2-byte info: twoByteMap built correctly', () => {
+    const a = node('AABB0001'), b = node('AABB0002'), c = node('AACC0003');
+    const info = buildTwo([a, b, c]);
+    assert.strictEqual(Object.keys(info['AA'].twoByteMap).length, 2);
+    assert.strictEqual(info['AA'].twoByteMap['AABB'].length, 2);
+    assert.strictEqual(info['AA'].twoByteMap['AACC'].length, 1);
+  });
+
+  // --- 3-byte stat summary (via buildCollisionHops) ---
+  test('buildCollisionHops: no collisions returns empty array', () => {
+    const nodes = [node('AA000001'), node('BB000002'), node('CC000003')];
+    assert.deepStrictEqual(buildHops(nodes, 1), []);
+  });
+
+  test('buildCollisionHops: detects 1-byte collision', () => {
+    const nodes = [node('AA000001'), node('AA000002')];
+    const hops = buildHops(nodes, 1);
+    assert.strictEqual(hops.length, 1);
+    assert.strictEqual(hops[0].hex, 'AA');
+    assert.strictEqual(hops[0].count, 2);
+  });
+
+  test('buildCollisionHops: detects 2-byte collision', () => {
+    const nodes = [node('AABB0001'), node('AABB0002'), node('AACC0003')];
+    const hops = buildHops(nodes, 2);
+    assert.strictEqual(hops.length, 1);
+    assert.strictEqual(hops[0].hex, 'AABB');
+    assert.strictEqual(hops[0].count, 2);
+  });
+
+  test('buildCollisionHops: detects 3-byte collision', () => {
+    const nodes = [node('AABBCC0001'), node('AABBCC0002')];
+    const hops = buildHops(nodes, 3);
+    assert.strictEqual(hops.length, 1);
+    assert.strictEqual(hops[0].hex, 'AABBCC');
+  });
+
+  test('buildCollisionHops: size field set correctly', () => {
+    const nodes = [node('AABB0001'), node('AABB0002')];
+    const hops = buildHops(nodes, 2);
+    assert.strictEqual(hops[0].size, 2);
+  });
+
+  test('buildCollisionHops: empty input returns empty array', () => {
+    assert.deepStrictEqual(buildHops([], 1), []);
+    assert.deepStrictEqual(buildHops([], 2), []);
+    assert.deepStrictEqual(buildHops([], 3), []);
+  });
+}
+
+// ===== CUSTOMIZE.JS: initState merge behavior =====
+console.log('\n=== customize.js: initState merge behavior ===');
+{
+  function loadCustomizeExports(ctx) {
+    const src = fs.readFileSync('public/customize.js', 'utf8');
+    const withExports = src.replace(
+      /\}\)\(\);\s*$/,
+      'window.__customizeExport = { initState: initState, getState: function () { return state; }, getDefaults: function () { return deepClone(DEFAULTS); } };})();'
+    );
+    vm.runInContext(withExports, ctx);
+    for (const k of Object.keys(ctx.window)) ctx[k] = ctx.window[k];
+    return ctx.window.__customizeExport;
+  }
+
+  test('partial local checklist does not wipe steps/footerLinks and keeps server colors', () => {
+    const ctx = makeSandbox();
+    ctx.window.SITE_CONFIG = {
+      home: {
+        heroTitle: 'Server Hero',
+        heroSubtitle: 'Server Subtitle',
+        steps: [{ emoji: '🧪', title: 'Server Step', description: 'from server' }],
+        checklist: [{ question: 'Server Q', answer: 'Server A' }],
+        footerLinks: [{ label: 'Server Link', url: '#/server' }]
+      },
+      theme: { accent: '#123456', navBg: '#222222' },
+      nodeColors: { repeater: '#aa0000' }
+    };
+    ctx.localStorage.setItem('meshcore-user-theme', JSON.stringify({
+      home: { checklist: [{ question: 'Local Q', answer: 'Local A' }] }
+    }));
+    const ex = loadCustomizeExports(ctx);
+    ex.initState();
+    const state = ex.getState();
+    assert.strictEqual(state.home.checklist[0].question, 'Local Q');
+    assert.strictEqual(state.home.steps[0].title, 'Server Step');
+    assert.strictEqual(state.home.footerLinks[0].label, 'Server Link');
+    assert.strictEqual(state.home.heroTitle, 'Server Hero');
+    assert.strictEqual(state.theme.accent, '#123456');
+    assert.strictEqual(state.nodeColors.repeater, '#aa0000');
+  });
+
+  test('server values survive when localStorage has partial overrides', () => {
+    const ctx = makeSandbox();
+    ctx.window.SITE_CONFIG = {
+      home: {
+        heroTitle: 'Server Hero',
+        heroSubtitle: 'Server Subtitle',
+        steps: [{ emoji: '1️⃣', title: 'Server Step', description: 'server' }],
+        footerLinks: [{ label: 'Server Footer', url: '#/s' }]
+      },
+      theme: { accent: '#111111', navBg: '#222222', navText: '#333333' },
+      typeColors: { ADVERT: '#00aa00', REQUEST: '#aa00aa' }
+    };
+    ctx.localStorage.setItem('meshcore-user-theme', JSON.stringify({
+      home: { heroTitle: 'Local Hero' },
+      theme: { accent: '#999999' },
+      typeColors: { ADVERT: '#ff00ff' }
+    }));
+    const ex = loadCustomizeExports(ctx);
+    ex.initState();
+    const state = ex.getState();
+    assert.strictEqual(state.home.heroTitle, 'Local Hero');
+    assert.strictEqual(state.home.heroSubtitle, 'Server Subtitle');
+    assert.strictEqual(state.home.steps[0].title, 'Server Step');
+    assert.strictEqual(state.home.footerLinks[0].label, 'Server Footer');
+    assert.strictEqual(state.theme.accent, '#999999');
+    assert.strictEqual(state.theme.navBg, '#222222');
+    assert.strictEqual(state.typeColors.ADVERT, '#ff00ff');
+    assert.strictEqual(state.typeColors.REQUEST, '#aa00aa');
+  });
+
+  test('full localStorage values override server config', () => {
+    const ctx = makeSandbox();
+    ctx.window.SITE_CONFIG = {
+      home: {
+        heroTitle: 'Server Hero',
+        heroSubtitle: 'Server Subtitle',
+        steps: [{ emoji: 'S', title: 'Server Step', description: 'server' }],
+        checklist: [{ question: 'Server Q', answer: 'Server A' }],
+        footerLinks: [{ label: 'Server Link', url: '#/server' }]
+      },
+      theme: { accent: '#101010' }
+    };
+    ctx.localStorage.setItem('meshcore-user-theme', JSON.stringify({
+      home: {
+        heroTitle: 'Local Hero',
+        heroSubtitle: 'Local Subtitle',
+        steps: [{ emoji: 'L', title: 'Local Step', description: 'local' }],
+        checklist: [{ question: 'Local Q', answer: 'Local A' }],
+        footerLinks: [{ label: 'Local Link', url: '#/local' }]
+      },
+      theme: { accent: '#abcdef', navBg: '#fedcba' }
+    }));
+    const ex = loadCustomizeExports(ctx);
+    ex.initState();
+    const state = ex.getState();
+    assert.strictEqual(state.home.heroTitle, 'Local Hero');
+    assert.strictEqual(state.home.heroSubtitle, 'Local Subtitle');
+    assert.strictEqual(state.home.steps[0].title, 'Local Step');
+    assert.strictEqual(state.home.checklist[0].question, 'Local Q');
+    assert.strictEqual(state.home.footerLinks[0].label, 'Local Link');
+    assert.strictEqual(state.theme.accent, '#abcdef');
+    assert.strictEqual(state.theme.navBg, '#fedcba');
+  });
+}
 // ===== SUMMARY =====
 console.log(`\n${'═'.repeat(40)}`);
 console.log(`  Frontend helpers: ${passed} passed, ${failed} failed`);

test-packet-store.js

@@ -1,552 +0,0 @@
-/* Unit tests for packet-store.js — uses a mock db module */
-'use strict';
-const assert = require('assert');
-const PacketStore = require('./packet-store');
-
-let passed = 0, failed = 0;
-function test(name, fn) {
-  try { fn(); passed++; console.log(`  ✅ ${name}`); }
-  catch (e) { failed++; console.log(`  ❌ ${name}: ${e.message}`); }
-}
-
-// Mock db module — minimal stubs for PacketStore
-function createMockDb() {
-  let txIdCounter = 1;
-  let obsIdCounter = 1000;
-  return {
-    db: {
-      pragma: (query) => {
-        if (query.includes('table_info(observations)')) return [{ name: 'observer_idx' }];
-        return [];
-      },
-      prepare: (sql) => ({
-        get: (...args) => {
-          if (sql.includes('sqlite_master')) return { name: 'transmissions' };
-          if (sql.includes('nodes')) return null;
-          if (sql.includes('observers')) return [];
-          return null;
-        },
-        all: (...args) => [],
-        iterate: (...args) => [][Symbol.iterator](),
-      }),
-    },
-    insertTransmission: (data) => ({
-      transmissionId: txIdCounter++,
-      observationId: obsIdCounter++,
-    }),
-  };
-}
-
-function makePacketData(overrides = {}) {
-  return {
-    raw_hex: 'AABBCCDD',
-    hash: 'abc123',
-    timestamp: new Date().toISOString(),
-    route_type: 1,
-    payload_type: 5,
-    payload_version: 0,
-    decoded_json: JSON.stringify({ pubKey: 'DEADBEEF'.repeat(8) }),
-    observer_id: 'obs1',
-    observer_name: 'Observer1',
-    snr: 8.5,
-    rssi: -45,
-    path_json: '["AA","BB"]',
-    direction: 'rx',
-    ...overrides,
-  };
-}
-
-// === Constructor ===
-console.log('\n=== PacketStore constructor ===');
-test('creates empty store', () => {
-  const store = new PacketStore(createMockDb());
-  assert.strictEqual(store.packets.length, 0);
-  assert.strictEqual(store.loaded, false);
-});
-
-test('respects maxMemoryMB config', () => {
-  const store = new PacketStore(createMockDb(), { maxMemoryMB: 512 });
-  assert.strictEqual(store.maxBytes, 512 * 1024 * 1024);
-});
-
-// === Load ===
-console.log('\n=== Load ===');
-test('load sets loaded flag', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  assert.strictEqual(store.loaded, true);
-});
-
-test('sqliteOnly mode skips RAM', () => {
-  const orig = process.env.NO_MEMORY_STORE;
-  process.env.NO_MEMORY_STORE = '1';
-  const store = new PacketStore(createMockDb());
-  store.load();
-  assert.strictEqual(store.sqliteOnly, true);
-  assert.strictEqual(store.packets.length, 0);
-  process.env.NO_MEMORY_STORE = orig || '';
-  if (!orig) delete process.env.NO_MEMORY_STORE;
-});
-
-// === Insert ===
-console.log('\n=== Insert ===');
-test('insert adds packet to memory', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData());
-  assert.strictEqual(store.packets.length, 1);
-  assert.strictEqual(store.stats.inserts, 1);
-});
-
-test('insert deduplicates by hash', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'dup1' }));
-  store.insert(makePacketData({ hash: 'dup1', observer_id: 'obs2' }));
-  assert.strictEqual(store.packets.length, 1);
-  assert.strictEqual(store.packets[0].observations.length, 2);
-  assert.strictEqual(store.packets[0].observation_count, 2);
-});
-
-test('insert dedup: same observer+path skipped', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'dup2' }));
-  store.insert(makePacketData({ hash: 'dup2' })); // same observer_id + path_json
-  assert.strictEqual(store.packets[0].observations.length, 1);
-});
-
-test('insert indexes by node pubkey', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'DEADBEEF'.repeat(8);
-  store.insert(makePacketData({ hash: 'n1', decoded_json: JSON.stringify({ pubKey: pk }) }));
-  assert(store.byNode.has(pk));
-  assert.strictEqual(store.byNode.get(pk).length, 1);
-});
-
-test('insert indexes byObserver', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ observer_id: 'obs-test' }));
-  assert(store.byObserver.has('obs-test'));
-});
-
-test('insert updates first_seen for earlier timestamp', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'ts1', timestamp: '2025-01-02T00:00:00Z', observer_id: 'o1' }));
-  store.insert(makePacketData({ hash: 'ts1', timestamp: '2025-01-01T00:00:00Z', observer_id: 'o2' }));
-  assert.strictEqual(store.packets[0].first_seen, '2025-01-01T00:00:00Z');
-});
-
-test('insert indexes ADVERT observer', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'AA'.repeat(32);
-  store.insert(makePacketData({ hash: 'adv1', payload_type: 4, decoded_json: JSON.stringify({ pubKey: pk }), observer_id: 'obs-adv' }));
-  assert(store._advertByObserver.has(pk));
-  assert(store._advertByObserver.get(pk).has('obs-adv'));
-});
-
-// === Query ===
-console.log('\n=== Query ===');
-test('query returns all packets', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'q1' }));
-  store.insert(makePacketData({ hash: 'q2' }));
-  const r = store.query();
-  assert.strictEqual(r.total, 2);
-  assert.strictEqual(r.packets.length, 2);
-});
-
-test('query by type filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qt1', payload_type: 4 }));
-  store.insert(makePacketData({ hash: 'qt2', payload_type: 5 }));
-  const r = store.query({ type: 4 });
-  assert.strictEqual(r.total, 1);
-  assert.strictEqual(r.packets[0].payload_type, 4);
-});
-
-test('query by route filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qr1', route_type: 0 }));
-  store.insert(makePacketData({ hash: 'qr2', route_type: 1 }));
-  const r = store.query({ route: 1 });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query by hash (index path)', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qh1' }));
-  store.insert(makePacketData({ hash: 'qh2' }));
-  const r = store.query({ hash: 'qh1' });
-  assert.strictEqual(r.total, 1);
-  assert.strictEqual(r.packets[0].hash, 'qh1');
-});
-
-test('query by observer (index path)', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qo1', observer_id: 'obsA' }));
-  store.insert(makePacketData({ hash: 'qo2', observer_id: 'obsB' }));
-  const r = store.query({ observer: 'obsA' });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query with limit and offset', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  for (let i = 0; i < 10; i++) store.insert(makePacketData({ hash: `ql${i}`, observer_id: `o${i}` }));
-  const r = store.query({ limit: 3, offset: 2 });
-  assert.strictEqual(r.packets.length, 3);
-  assert.strictEqual(r.total, 10);
-});
-
-test('query by since filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qs1', timestamp: '2025-01-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'qs2', timestamp: '2025-06-01T00:00:00Z', observer_id: 'o2' }));
-  const r = store.query({ since: '2025-03-01T00:00:00Z' });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query by until filter', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qu1', timestamp: '2025-01-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'qu2', timestamp: '2025-06-01T00:00:00Z', observer_id: 'o2' }));
-  const r = store.query({ until: '2025-03-01T00:00:00Z' });
-  assert.strictEqual(r.total, 1);
-});
-
-test('query ASC order', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qa1', timestamp: '2025-06-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'qa2', timestamp: '2025-01-01T00:00:00Z', observer_id: 'o2' }));
-  const r = store.query({ order: 'ASC' });
-  assert(r.packets[0].timestamp < r.packets[1].timestamp);
-});
-
-// === queryGrouped ===
-console.log('\n=== queryGrouped ===');
-test('queryGrouped returns grouped data', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'qg1' }));
-  store.insert(makePacketData({ hash: 'qg1', observer_id: 'obs2' }));
-  store.insert(makePacketData({ hash: 'qg2', observer_id: 'obs3' }));
-  const r = store.queryGrouped();
-  assert.strictEqual(r.total, 2);
-  const g1 = r.packets.find(p => p.hash === 'qg1');
-  assert(g1);
-  assert.strictEqual(g1.observation_count, 2);
-  assert.strictEqual(g1.observer_count, 2);
-});
-
-// === getNodesByAdvertObservers ===
-console.log('\n=== getNodesByAdvertObservers ===');
-test('finds nodes by observer', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'BB'.repeat(32);
-  store.insert(makePacketData({ hash: 'nao1', payload_type: 4, decoded_json: JSON.stringify({ pubKey: pk }), observer_id: 'obs-x' }));
-  const result = store.getNodesByAdvertObservers(['obs-x']);
-  assert(result.has(pk));
-});
-
-test('returns empty for unknown observer', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const result = store.getNodesByAdvertObservers(['nonexistent']);
-  assert.strictEqual(result.size, 0);
-});
-
-// === Other methods ===
-console.log('\n=== Other methods ===');
-test('getById returns observation', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const id = store.insert(makePacketData({ hash: 'gbi1' }));
-  const obs = store.getById(id);
-  assert(obs);
-});
-
-test('getSiblings returns observations for hash', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'sib1' }));
-  store.insert(makePacketData({ hash: 'sib1', observer_id: 'obs2' }));
-  const sibs = store.getSiblings('sib1');
-  assert.strictEqual(sibs.length, 2);
-});
-
-test('getSiblings empty for unknown hash', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  assert.deepStrictEqual(store.getSiblings('nope'), []);
-});
-
-test('all() returns packets', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'all1' }));
-  assert.strictEqual(store.all().length, 1);
-});
-
-test('filter() works', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'f1', payload_type: 4 }));
-  store.insert(makePacketData({ hash: 'f2', payload_type: 5, observer_id: 'o2' }));
-  assert.strictEqual(store.filter(p => p.payload_type === 4).length, 1);
-});
-
-test('countForNode returns counts', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'CC'.repeat(32);
-  store.insert(makePacketData({ hash: 'cn1', decoded_json: JSON.stringify({ pubKey: pk }) }));
-  store.insert(makePacketData({ hash: 'cn1', decoded_json: JSON.stringify({ pubKey: pk }), observer_id: 'o2' }));
-  const c = store.countForNode(pk);
-  assert.strictEqual(c.transmissions, 1);
-  assert.strictEqual(c.observations, 2);
-});
-
-test('getStats returns stats object', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const s = store.getStats();
-  assert.strictEqual(s.inMemory, 0);
-  assert(s.indexes);
-  assert.strictEqual(s.sqliteOnly, false);
-});
-
-test('getTimestamps returns timestamps', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'gt1', timestamp: '2025-06-01T00:00:00Z' }));
-  store.insert(makePacketData({ hash: 'gt2', timestamp: '2025-06-02T00:00:00Z', observer_id: 'o2' }));
-  const ts = store.getTimestamps('2025-05-01T00:00:00Z');
-  assert.strictEqual(ts.length, 2);
-});
-
-// === Eviction ===
-console.log('\n=== Eviction ===');
-test('evicts oldest when over maxPackets', () => {
-  const store = new PacketStore(createMockDb(), { maxMemoryMB: 1, estimatedPacketBytes: 500000 });
-  // maxPackets will be very small
-  store.load();
-  for (let i = 0; i < 10; i++) store.insert(makePacketData({ hash: `ev${i}`, observer_id: `o${i}` }));
-  assert(store.packets.length <= store.maxPackets);
-  assert(store.stats.evicted > 0);
-});
-
-// === findPacketsForNode ===
-console.log('\n=== findPacketsForNode ===');
-test('finds by pubkey', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  const pk = 'DD'.repeat(32);
-  store.insert(makePacketData({ hash: 'fpn1', decoded_json: JSON.stringify({ pubKey: pk }) }));
-  store.insert(makePacketData({ hash: 'fpn2', decoded_json: JSON.stringify({ pubKey: 'other' }), observer_id: 'o2' }));
-  const r = store.findPacketsForNode(pk);
-  assert.strictEqual(r.packets.length, 1);
-  assert.strictEqual(r.pubkey, pk);
-});
-
-test('finds by text search in decoded_json', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'fpn3', decoded_json: JSON.stringify({ name: 'MySpecialNode' }) }));
-  const r = store.findPacketsForNode('MySpecialNode');
-  assert.strictEqual(r.packets.length, 1);
-});
-
-// === Memory optimization: observation deduplication ===
-console.log('\n=== Observation deduplication (transmission_id refs) ===');
-
-test('observations don\'t duplicate transmission fields', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'dedup1', raw_hex: 'FF00FF00', decoded_json: '{"pubKey":"ABCD"}' }));
-  const tx = store.byHash.get('dedup1');
-  assert(tx, 'transmission should exist');
-  assert(tx.observations.length >= 1, 'should have at least 1 observation');
-  const obs = tx.observations[0];
-  // Observation should NOT have its own copies of transmission fields
-  assert(!obs.hasOwnProperty('raw_hex'), 'obs should not have own raw_hex');
-  assert(!obs.hasOwnProperty('decoded_json'), 'obs should not have own decoded_json');
-  // Observation should reference its parent transmission
-  assert(obs.hasOwnProperty('transmission_id'), 'obs should have transmission_id');
-});
-
-test('transmission fields accessible through lookup', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'lookup1', raw_hex: 'DEADBEEF', decoded_json: '{"pubKey":"CAFE"}' }));
-  const tx = store.byHash.get('lookup1');
-  const obs = tx.observations[0];
-  // Look up the transmission via the observation's transmission_id
-  const parentTx = store.byTxId.get(obs.transmission_id);
-  assert(parentTx, 'should find parent transmission via transmission_id');
-  assert.strictEqual(parentTx.raw_hex, 'DEADBEEF');
-  assert.strictEqual(parentTx.decoded_json, '{"pubKey":"CAFE"}');
-  assert.strictEqual(parentTx.hash, 'lookup1');
-});
-
-test('query results still contain transmission fields (backward compat)', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'compat1', raw_hex: 'AABB', decoded_json: '{"test":true}' }));
-  const r = store.query();
-  assert.strictEqual(r.total, 1);
-  const pkt = r.packets[0];
-  // Query results (transmissions) should still have these fields
-  assert.strictEqual(pkt.raw_hex, 'AABB');
-  assert.strictEqual(pkt.decoded_json, '{"test":true}');
-  assert.strictEqual(pkt.hash, 'compat1');
-});
-
-test('all() results contain transmission fields', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'allcompat1', raw_hex: 'CCDD', decoded_json: '{"x":1}' }));
-  const pkts = store.all();
-  assert.strictEqual(pkts.length, 1);
-  assert.strictEqual(pkts[0].raw_hex, 'CCDD');
-  assert.strictEqual(pkts[0].decoded_json, '{"x":1}');
-});
-
-test('multiple observations share one transmission', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'shared1', observer_id: 'obs-A', raw_hex: 'FFFF' }));
-  store.insert(makePacketData({ hash: 'shared1', observer_id: 'obs-B', raw_hex: 'FFFF' }));
-  store.insert(makePacketData({ hash: 'shared1', observer_id: 'obs-C', raw_hex: 'FFFF' }));
-  // Only 1 transmission should exist
-  assert.strictEqual(store.packets.length, 1);
-  const tx = store.byHash.get('shared1');
-  assert.strictEqual(tx.observations.length, 3);
-  // All observations should reference the same transmission_id
-  const txId = tx.observations[0].transmission_id;
-  assert(txId != null, 'transmission_id should be set');
-  assert.strictEqual(tx.observations[1].transmission_id, txId);
-  assert.strictEqual(tx.observations[2].transmission_id, txId);
-  // Only 1 entry in byTxId for this transmission
-  assert(store.byTxId.has(txId), 'byTxId should have the shared transmission');
-});
-
-test('getSiblings still returns observation data after dedup', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'sibdedup1', observer_id: 'obs-X', snr: 5.0 }));
-  store.insert(makePacketData({ hash: 'sibdedup1', observer_id: 'obs-Y', snr: 9.0 }));
-  const sibs = store.getSiblings('sibdedup1');
-  assert.strictEqual(sibs.length, 2);
-  // Each sibling should have observer-specific fields
-  const obsIds = sibs.map(s => s.observer_id).sort();
-  assert.deepStrictEqual(obsIds, ['obs-X', 'obs-Y']);
-});
-
-test('queryGrouped still returns transmission fields after dedup', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  store.insert(makePacketData({ hash: 'grpdedup1', raw_hex: 'AABB', decoded_json: '{"g":1}', observer_id: 'o1' }));
-  store.insert(makePacketData({ hash: 'grpdedup1', observer_id: 'o2' }));
-  const r = store.queryGrouped();
-  assert.strictEqual(r.total, 1);
-  const g = r.packets[0];
-  assert.strictEqual(g.raw_hex, 'AABB');
-  assert.strictEqual(g.decoded_json, '{"g":1}');
-  assert.strictEqual(g.observation_count, 2);
-});
-
-test('memory estimate reflects deduplication savings', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-  // Insert 50 unique transmissions, each with 5 observers
-  const longHex = 'AA'.repeat(200);
-  const longJson = JSON.stringify({ pubKey: 'BB'.repeat(32), name: 'TestNode', data: 'X'.repeat(200) });
-  for (let i = 0; i < 50; i++) {
-    for (let j = 0; j < 5; j++) {
-      store.insert(makePacketData({
-        hash: `mem${i}`,
-        observer_id: `obs-mem-${j}`,
-        raw_hex: longHex,
-        decoded_json: longJson,
-      }));
-    }
-  }
-  assert.strictEqual(store.packets.length, 50);
-  // Verify observations don't bloat memory with duplicate strings
-  let obsWithRawHex = 0;
-  for (const tx of store.packets) {
-    for (const obs of tx.observations) {
-      if (obs.hasOwnProperty('raw_hex')) obsWithRawHex++;
-    }
-  }
-  assert.strictEqual(obsWithRawHex, 0, 'no observation should have own raw_hex property');
-});
-
-// === Regression: packetsLastHour must count live-appended observations (#182) ===
-console.log('\n=== packetsLastHour byObserver regression (#182) ===');
-
-test('byObserver counts recent packets regardless of insertion order', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-
-  const twoHoursAgo = new Date(Date.now() - 7200000).toISOString();
-  const thirtyMinAgo = new Date(Date.now() - 1800000).toISOString();
-  const fiveMinAgo   = new Date(Date.now() - 300000).toISOString();
-
-  // Simulate initial DB load: oldest packets pushed first (as if loaded DESC then reversed)
-  store.insert(makePacketData({ hash: 'old1', timestamp: twoHoursAgo, observer_id: 'obs-hr' }));
-  // Simulate live-ingested packet (appended at end, most recent)
-  store.insert(makePacketData({ hash: 'new1', timestamp: thirtyMinAgo, observer_id: 'obs-hr' }));
-  store.insert(makePacketData({ hash: 'new2', timestamp: fiveMinAgo, observer_id: 'obs-hr' }));
-
-  const obsPackets = store.byObserver.get('obs-hr');
-  assert.strictEqual(obsPackets.length, 3, 'should have 3 observations');
-
-  // Count packets in the last hour — the same way the fixed /api/observers does
-  const oneHourAgo = new Date(Date.now() - 3600000).toISOString();
-  let count = 0;
-  for (const obs of obsPackets) {
-    if (obs.timestamp > oneHourAgo) count++;
-  }
-  assert.strictEqual(count, 2, 'should count 2 recent packets, not 0 (regression #182)');
-});
-
-test('byObserver early-break bug: old item at front must not abort count', () => {
-  const store = new PacketStore(createMockDb());
-  store.load();
-
-  const twoHoursAgo = new Date(Date.now() - 7200000).toISOString();
-  const tenMinAgo   = new Date(Date.now() - 600000).toISOString();
-
-  // Old observation first, then recent — simulates the mixed-order array
-  store.insert(makePacketData({ hash: 'h1', timestamp: twoHoursAgo, observer_id: 'obs-bug' }));
-  store.insert(makePacketData({ hash: 'h2', timestamp: tenMinAgo,   observer_id: 'obs-bug' }));
-
-  const obsPackets = store.byObserver.get('obs-bug');
-  const oneHourAgo = new Date(Date.now() - 3600000).toISOString();
-
-  // BUGGY code (break on first old item) would return 0 here
-  let count = 0;
-  for (const obs of obsPackets) {
-    if (obs.timestamp > oneHourAgo) count++;
-  }
-  assert.strictEqual(count, 1, 'must not skip recent packet after old one');
-});
-
-// === Summary ===
-console.log(`\n${passed} passed, ${failed} failed`);
-if (failed > 0) process.exit(1);

test-regional-filter.js

@@ -1,135 +0,0 @@
-#!/usr/bin/env node
-// Test: Regional hop resolution filtering
-// Validates that resolve-hops correctly filters candidates by geography and observer region
-
-const { IATA_COORDS, haversineKm, nodeNearRegion } = require('./iata-coords');
-
-let pass = 0, fail = 0;
-
-function assert(condition, msg) {
-  if (condition) { pass++; console.log(`  ✅ ${msg}`); }
-  else { fail++; console.error(`  ❌ FAIL: ${msg}`); }
-}
-
-// === 1. Haversine distance tests ===
-console.log('\n=== Haversine Distance ===');
-
-const sjcToSea = haversineKm(37.3626, -121.9290, 47.4502, -122.3088);
-assert(sjcToSea > 1100 && sjcToSea < 1150, `SJC→SEA = ${Math.round(sjcToSea)}km (expect ~1125km)`);
-
-const sjcToOak = haversineKm(37.3626, -121.9290, 37.7213, -122.2208);
-assert(sjcToOak > 40 && sjcToOak < 55, `SJC→OAK = ${Math.round(sjcToOak)}km (expect ~48km)`);
-
-const sjcToSjc = haversineKm(37.3626, -121.9290, 37.3626, -121.9290);
-assert(sjcToSjc === 0, `SJC→SJC = ${sjcToSjc}km (expect 0)`);
-
-const sjcToEug = haversineKm(37.3626, -121.9290, 44.1246, -123.2119);
-assert(sjcToEug > 750 && sjcToEug < 780, `SJC→EUG = ${Math.round(sjcToEug)}km (expect ~762km)`);
-
-// === 2. nodeNearRegion tests ===
-console.log('\n=== Node Near Region ===');
-
-// Node in San Jose, check against SJC region
-const sjNode = nodeNearRegion(37.35, -121.95, 'SJC');
-assert(sjNode && sjNode.near, `San Jose node near SJC: ${sjNode.distKm}km`);
-
-// Node in Seattle, check against SJC region — should NOT be near
-const seaNode = nodeNearRegion(47.45, -122.30, 'SJC');
-assert(seaNode && !seaNode.near, `Seattle node NOT near SJC: ${seaNode.distKm}km`);
-
-// Node in Seattle, check against SEA region — should be near
-const seaNodeSea = nodeNearRegion(47.45, -122.30, 'SEA');
-assert(seaNodeSea && seaNodeSea.near, `Seattle node near SEA: ${seaNodeSea.distKm}km`);
-
-// Node in Eugene, check against EUG — should be near
-const eugNode = nodeNearRegion(44.05, -123.10, 'EUG');
-assert(eugNode && eugNode.near, `Eugene node near EUG: ${eugNode.distKm}km`);
-
-// Eugene node should NOT be near SJC (~762km)
-const eugNodeSjc = nodeNearRegion(44.05, -123.10, 'SJC');
-assert(eugNodeSjc && !eugNodeSjc.near, `Eugene node NOT near SJC: ${eugNodeSjc.distKm}km`);
-
-// Node with no location — returns null
-const noLoc = nodeNearRegion(null, null, 'SJC');
-assert(noLoc === null, 'Null lat/lon returns null');
-
-// Node at 0,0 — returns null
-const zeroLoc = nodeNearRegion(0, 0, 'SJC');
-assert(zeroLoc === null, 'Zero lat/lon returns null');
-
-// Unknown IATA — returns null
-const unkIata = nodeNearRegion(37.35, -121.95, 'ZZZ');
-assert(unkIata === null, 'Unknown IATA returns null');
-
-// === 3. Edge cases: nodes just inside/outside 300km radius ===
-console.log('\n=== Boundary Tests (300km radius) ===');
-
-// Sacramento is ~145km from SJC — inside
-const smfNode = nodeNearRegion(38.58, -121.49, 'SJC');
-assert(smfNode && smfNode.near, `Sacramento near SJC: ${smfNode.distKm}km (expect ~145)`);
-
-// Fresno is ~235km from SJC — inside
-const fatNode = nodeNearRegion(36.74, -119.79, 'SJC');
-assert(fatNode && fatNode.near, `Fresno near SJC: ${fatNode.distKm}km (expect ~235)`);
-
-// Redding is ~400km from SJC — outside
-const rddNode = nodeNearRegion(40.59, -122.39, 'SJC');
-assert(rddNode && !rddNode.near, `Redding NOT near SJC: ${rddNode.distKm}km (expect ~400)`);
-
-// === 4. Simulate the core issue: 1-byte hop with cross-regional collision ===
-console.log('\n=== Cross-Regional Collision Simulation ===');
-
-// Two nodes with pubkeys starting with "D6": one in SJC area, one in SEA area
-const candidates = [
-  { name: 'Redwood Mt. Tam', pubkey: 'D6...sjc', lat: 37.92, lon: -122.60 },  // Marin County, CA
-  { name: 'VE7RSC North Repeater', pubkey: 'D6...sea', lat: 49.28, lon: -123.12 }, // Vancouver, BC
-  { name: 'KK7RXY Lynden', pubkey: 'D6...bel', lat: 48.94, lon: -122.47 }, // Bellingham, WA
-];
-
-// Packet observed in SJC region
-const packetIata = 'SJC';
-const geoFiltered = candidates.filter(c => {
-  const check = nodeNearRegion(c.lat, c.lon, packetIata);
-  return check && check.near;
-});
-assert(geoFiltered.length === 1, `Geo filter SJC: ${geoFiltered.length} candidates (expect 1)`);
-assert(geoFiltered[0].name === 'Redwood Mt. Tam', `Winner: ${geoFiltered[0].name} (expect Redwood Mt. Tam)`);
-
-// Packet observed in SEA region
-const seaFiltered = candidates.filter(c => {
-  const check = nodeNearRegion(c.lat, c.lon, 'SEA');
-  return check && check.near;
-});
-assert(seaFiltered.length === 2, `Geo filter SEA: ${seaFiltered.length} candidates (expect 2 — Vancouver + Bellingham)`);
-
-// Packet observed in EUG region — Eugene is ~300km from SEA nodes
-const eugFiltered = candidates.filter(c => {
-  const check = nodeNearRegion(c.lat, c.lon, 'EUG');
-  return check && check.near;
-});
-assert(eugFiltered.length === 0, `Geo filter EUG: ${eugFiltered.length} candidates (expect 0 — all too far)`);
-
-// === 5. Layered fallback logic ===
-console.log('\n=== Layered Fallback ===');
-
-const nodeWithGps = { lat: 37.92, lon: -122.60 }; // has GPS
-const nodeNoGps = { lat: null, lon: null }; // no GPS
-const observerSawNode = true; // observer-based filter says yes
-
-// Layer 1: GPS check
-const gpsCheck = nodeNearRegion(nodeWithGps.lat, nodeWithGps.lon, 'SJC');
-assert(gpsCheck && gpsCheck.near, 'Layer 1 (GPS): node with GPS near SJC');
-
-// Layer 2: No GPS, fall back to observer
-const gpsCheckNoLoc = nodeNearRegion(nodeNoGps.lat, nodeNoGps.lon, 'SJC');
-assert(gpsCheckNoLoc === null, 'Layer 2: no GPS returns null → use observer-based fallback');
-
-// Bridged WA node with GPS — should be REJECTED by SJC even though observer saw it
-const bridgedWaNode = { lat: 47.45, lon: -122.30 }; // Seattle
-const bridgedCheck = nodeNearRegion(bridgedWaNode.lat, bridgedWaNode.lon, 'SJC');
-assert(bridgedCheck && !bridgedCheck.near, `Bridge test: WA node rejected by SJC geo filter (${bridgedCheck.distKm}km)`);
-
-// === Summary ===
-console.log(`\n${'='.repeat(40)}`);
-console.log(`Results: ${pass} passed, ${fail} failed`);
-process.exit(fail > 0 ? 1 : 0);

test-regional-integration.js

@@ -1,96 +0,0 @@
-#!/usr/bin/env node
-// Integration test: Verify layered filtering works against live prod API
-// Tests that resolve-hops returns regional metadata and correct filtering
-
-const https = require('https');
-const BASE = 'https://analyzer.00id.net';
-
-function apiGet(path) {
-  return new Promise((resolve, reject) => {
-    https.get(BASE + path, { timeout: 10000 }, (res) => {
-      let data = '';
-      res.on('data', d => data += d);
-      res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(e); } });
-    }).on('error', reject);
-  });
-}
-
-let pass = 0, fail = 0;
-function assert(condition, msg) {
-  if (condition) { pass++; console.log(`  ✅ ${msg}`); }
-  else { fail++; console.error(`  ❌ FAIL: ${msg}`); }
-}
-
-async function run() {
-  console.log('\n=== Integration: resolve-hops API with regional filtering ===\n');
-
-  // 1. Get a packet with short hops and a known observer
-  const packets = await apiGet('/api/packets?limit=100&groupByHash=true');
-  const pkt = packets.packets.find(p => {
-    const path = JSON.parse(p.path_json || '[]');
-    return path.length > 0 && path.some(h => h.length <= 2) && p.observer_id;
-  });
-
-  if (!pkt) {
-    console.log('  ⚠ No packets with short hops found — skipping API tests');
-    return;
-  }
-
-  const path = JSON.parse(pkt.path_json);
-  const shortHops = path.filter(h => h.length <= 2);
-  console.log(`  Using packet ${pkt.hash.slice(0,12)} observed by ${pkt.observer_name || pkt.observer_id.slice(0,12)}`);
-  console.log(`  Path: ${path.join(' → ')} (${shortHops.length} short hops)`);
-
-  // 2. Resolve WITH observer (should get regional filtering)
-  const withObs = await apiGet(`/api/resolve-hops?hops=${path.join(',')}&observer=${pkt.observer_id}`);
-
-  assert(withObs.region != null, `Response includes region: ${withObs.region}`);
-
-  // 3. Check that conflicts have filterMethod field
-  let hasFilterMethod = false;
-  let hasDistKm = false;
-  for (const [hop, info] of Object.entries(withObs.resolved)) {
-    if (info.conflicts && info.conflicts.length > 0) {
-      for (const c of info.conflicts) {
-        if (c.filterMethod) hasFilterMethod = true;
-        if (c.distKm != null) hasDistKm = true;
-      }
-    }
-    if (info.filterMethods) {
-      assert(Array.isArray(info.filterMethods), `Hop ${hop}: filterMethods is array: ${JSON.stringify(info.filterMethods)}`);
-    }
-  }
-  assert(hasFilterMethod, 'At least one conflict has filterMethod');
-
-  // 4. Resolve WITHOUT observer (no regional filtering)
-  const withoutObs = await apiGet(`/api/resolve-hops?hops=${path.join(',')}`);
-  assert(withoutObs.region === null, `Without observer: region is null`);
-
-  // 5. Compare: with observer should have same or fewer candidates per ambiguous hop
-  for (const hop of shortHops) {
-    const withInfo = withObs.resolved[hop];
-    const withoutInfo = withoutObs.resolved[hop];
-    if (withInfo && withoutInfo && withInfo.conflicts && withoutInfo.conflicts) {
-      const withCount = withInfo.totalRegional || withInfo.conflicts.length;
-      const withoutCount = withoutInfo.totalGlobal || withoutInfo.conflicts.length;
-      assert(withCount <= withoutCount + 1,
-        `Hop ${hop}: regional(${withCount}) <= global(${withoutCount}) — ${withInfo.name || '?'}`);
-    }
-  }
-
-  // 6. Check that geo-filtered candidates have distKm
-  for (const [hop, info] of Object.entries(withObs.resolved)) {
-    if (info.conflicts) {
-      const geoFiltered = info.conflicts.filter(c => c.filterMethod === 'geo');
-      for (const c of geoFiltered) {
-        assert(c.distKm != null, `Hop ${hop} candidate ${c.name}: has distKm=${c.distKm}km (geo filter)`);
-      }
-    }
-  }
-
-  console.log(`\n${'='.repeat(40)}`);
-  console.log(`Results: ${pass} passed, ${fail} failed`);
-  process.exit(fail > 0 ? 1 : 0);
-}
-
-run().catch(e => { console.error('Test error:', e); process.exit(1); });

test-server-helpers.js

@@ -1,319 +0,0 @@
-'use strict';
-
-const helpers = require('./server-helpers');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-
-let passed = 0, failed = 0;
-function assert(cond, msg) {
-  if (cond) { passed++; console.log(`  ✅ ${msg}`); }
-  else { failed++; console.error(`  ❌ ${msg}`); }
-}
-
-console.log('── server-helpers tests ──\n');
-
-// --- loadConfigFile ---
-console.log('loadConfigFile:');
-{
-  // Returns {} when no files exist
-  const result = helpers.loadConfigFile(['/nonexistent/path.json']);
-  assert(typeof result === 'object' && Object.keys(result).length === 0, 'returns {} for missing files');
-
-  // Loads valid JSON
-  const tmp = path.join(os.tmpdir(), `test-config-${Date.now()}.json`);
-  fs.writeFileSync(tmp, JSON.stringify({ hello: 'world' }));
-  const result2 = helpers.loadConfigFile([tmp]);
-  assert(result2.hello === 'world', 'loads valid JSON file');
-  fs.unlinkSync(tmp);
-
-  // Falls back to second path
-  const tmp2 = path.join(os.tmpdir(), `test-config2-${Date.now()}.json`);
-  fs.writeFileSync(tmp2, JSON.stringify({ fallback: true }));
-  const result3 = helpers.loadConfigFile(['/nonexistent.json', tmp2]);
-  assert(result3.fallback === true, 'falls back to second path');
-  fs.unlinkSync(tmp2);
-
-  // Handles malformed JSON
-  const tmp3 = path.join(os.tmpdir(), `test-config3-${Date.now()}.json`);
-  fs.writeFileSync(tmp3, 'not json{{{');
-  const result4 = helpers.loadConfigFile([tmp3]);
-  assert(Object.keys(result4).length === 0, 'returns {} for malformed JSON');
-  fs.unlinkSync(tmp3);
-}
-
-// --- loadThemeFile ---
-console.log('\nloadThemeFile:');
-{
-  const result = helpers.loadThemeFile(['/nonexistent/theme.json']);
-  assert(typeof result === 'object' && Object.keys(result).length === 0, 'returns {} for missing files');
-
-  const tmp = path.join(os.tmpdir(), `test-theme-${Date.now()}.json`);
-  fs.writeFileSync(tmp, JSON.stringify({ theme: { accent: '#ff0000' } }));
-  const result2 = helpers.loadThemeFile([tmp]);
-  assert(result2.theme.accent === '#ff0000', 'loads theme file');
-  fs.unlinkSync(tmp);
-}
-
-// --- buildHealthConfig ---
-console.log('\nbuildHealthConfig:');
-{
-  const h = helpers.buildHealthConfig({});
-  assert(h.infraDegraded === 24, 'default infraDegraded');
-  assert(h.infraSilent === 72, 'default infraSilent');
-  assert(h.nodeDegraded === 1, 'default nodeDegraded');
-  assert(h.nodeSilent === 24, 'default nodeSilent');
-
-  const h2 = helpers.buildHealthConfig({ healthThresholds: { infraDegradedHours: 2 } });
-  assert(h2.infraDegraded === 2, 'custom infraDegraded');
-  assert(h2.nodeDegraded === 1, 'other defaults preserved');
-
-  const h3 = helpers.buildHealthConfig(null);
-  assert(h3.infraDegraded === 24, 'handles null config');
-}
-
-// --- getHealthMs ---
-console.log('\ngetHealthMs:');
-{
-  const HEALTH = helpers.buildHealthConfig({});
-
-  const rep = helpers.getHealthMs('repeater', HEALTH);
-  assert(rep.degradedMs === 24 * 3600000, 'repeater uses infra degraded');
-  assert(rep.silentMs === 72 * 3600000, 'repeater uses infra silent');
-
-  const room = helpers.getHealthMs('room', HEALTH);
-  assert(room.degradedMs === 24 * 3600000, 'room uses infra degraded');
-
-  const comp = helpers.getHealthMs('companion', HEALTH);
-  assert(comp.degradedMs === 1 * 3600000, 'companion uses node degraded');
-  assert(comp.silentMs === 24 * 3600000, 'companion uses node silent');
-
-  const sensor = helpers.getHealthMs('sensor', HEALTH);
-  assert(sensor.degradedMs === 1 * 3600000, 'sensor uses node degraded');
-
-  const undef = helpers.getHealthMs(undefined, HEALTH);
-  assert(undef.degradedMs === 1 * 3600000, 'undefined role uses node degraded');
-}
-
-// --- isHashSizeFlipFlop ---
-console.log('\nisHashSizeFlipFlop:');
-{
-  assert(helpers.isHashSizeFlipFlop(null, null) === false, 'null seq returns false');
-  assert(helpers.isHashSizeFlipFlop([1, 2], new Set([1, 2])) === false, 'too few samples');
-  assert(helpers.isHashSizeFlipFlop([1, 1, 1], new Set([1])) === false, 'single size');
-  assert(helpers.isHashSizeFlipFlop([1, 1, 1, 2, 2, 2], new Set([1, 2])) === false, 'clean upgrade (1 transition)');
-  assert(helpers.isHashSizeFlipFlop([1, 2, 1], new Set([1, 2])) === true, 'flip-flop detected');
-  assert(helpers.isHashSizeFlipFlop([1, 2, 1, 2], new Set([1, 2])) === true, 'repeated flip-flop');
-  assert(helpers.isHashSizeFlipFlop([2, 1, 2], new Set([1, 2])) === true, 'reverse flip-flop');
-  assert(helpers.isHashSizeFlipFlop([1, 2, 3], new Set([1, 2, 3])) === true, 'three sizes, 2 transitions');
-}
-
-// --- computeContentHash ---
-console.log('\ncomputeContentHash:');
-{
-  // Minimal packet: header + path byte + payload
-  // header=0x04, path_byte=0x00 (hash_size=1, 0 hops), payload=0xABCD
-  const hex1 = '0400abcd';
-  const h1 = helpers.computeContentHash(hex1);
-  assert(typeof h1 === 'string' && h1.length === 16, 'returns 16-char hash');
-
-  // Same payload, different path should give same hash
-  // header=0x04, path_byte=0x41 (hash_size=2, 1 hop), path=0x1234, payload=0xABCD
-  const hex2 = '04411234abcd';
-  const h2 = helpers.computeContentHash(hex2);
-  assert(h1 === h2, 'same content different path = same hash');
-
-  // Different payload = different hash
-  const hex3 = '0400ffff';
-  const h3 = helpers.computeContentHash(hex3);
-  assert(h3 !== h1, 'different payload = different hash');
-
-  // Very short hex
-  const h4 = helpers.computeContentHash('04');
-  assert(h4 === '04', 'short hex returns prefix');
-
-  // Invalid hex
-  const h5 = helpers.computeContentHash('xyz');
-  assert(typeof h5 === 'string', 'handles invalid hex gracefully');
-}
-
-// --- geoDist ---
-console.log('\ngeoDist:');
-{
-  assert(helpers.geoDist(0, 0, 0, 0) === 0, 'same point = 0');
-  assert(helpers.geoDist(0, 0, 3, 4) === 5, 'pythagorean triple');
-  assert(helpers.geoDist(37.7749, -122.4194, 37.7749, -122.4194) === 0, 'SF to SF = 0');
-  const d = helpers.geoDist(37.0, -122.0, 38.0, -122.0);
-  assert(Math.abs(d - 1.0) < 0.001, '1 degree latitude diff');
-}
-
-// --- deriveHashtagChannelKey ---
-console.log('\nderiveHashtagChannelKey:');
-{
-  const k1 = helpers.deriveHashtagChannelKey('test');
-  assert(typeof k1 === 'string' && k1.length === 32, 'returns 32-char key');
-  const k2 = helpers.deriveHashtagChannelKey('test');
-  assert(k1 === k2, 'deterministic');
-  const k3 = helpers.deriveHashtagChannelKey('other');
-  assert(k3 !== k1, 'different input = different key');
-}
-
-// --- buildBreakdown ---
-console.log('\nbuildBreakdown:');
-{
-  const r1 = helpers.buildBreakdown(null, null, null, null);
-  assert(JSON.stringify(r1) === '{}', 'null rawHex returns empty');
-
-  const r2 = helpers.buildBreakdown('04', null, null, null);
-  assert(r2.ranges.length === 1, 'single-byte returns header only');
-  assert(r2.ranges[0].label === 'Header', 'header range');
-
-  // 2 bytes: header + path byte, no payload
-  const r3 = helpers.buildBreakdown('0400', null, null, null);
-  assert(r3.ranges.length === 2, 'two bytes: header + path length');
-  assert(r3.ranges[1].label === 'Path Length', 'path length range');
-
-  // With payload: header=04, path_byte=00, payload=abcd
-  const r4 = helpers.buildBreakdown('0400abcd', null, null, null);
-  assert(r4.ranges.some(r => r.label === 'Payload'), 'has payload range');
-
-  // With path hops: header=04, path_byte=0x41 (size=2, count=1), path=1234, payload=ff
-  const r5 = helpers.buildBreakdown('04411234ff', null, null, null);
-  assert(r5.ranges.some(r => r.label === 'Path'), 'has path range');
-
-  // ADVERT with enough payload
-  // flags=0x90 (0x10=GPS + 0x80=Name)
-  const advertHex = '0400' + 'aa'.repeat(32) + 'bb'.repeat(4) + 'cc'.repeat(64) + '90' + 'dddddddddddddddd' + '48656c6c6f';
-  const r6 = helpers.buildBreakdown(advertHex, { type: 'ADVERT' }, null, null);
-  assert(r6.ranges.some(r => r.label === 'PubKey'), 'ADVERT has PubKey sub-range');
-  assert(r6.ranges.some(r => r.label === 'Flags'), 'ADVERT has Flags sub-range');
-  assert(r6.ranges.some(r => r.label === 'Latitude'), 'ADVERT with GPS flag has Latitude');
-  assert(r6.ranges.some(r => r.label === 'Name'), 'ADVERT with name flag has Name');
-}
-
-// --- disambiguateHops ---
-console.log('\ndisambiguateHops:');
-{
-  const nodes = [
-    { public_key: 'aabb11223344', name: 'Node-A', lat: 37.0, lon: -122.0 },
-    { public_key: 'ccdd55667788', name: 'Node-C', lat: 37.1, lon: -122.1 },
-  ];
-  // Single unique match
-  const r1 = helpers.disambiguateHops(['aabb'], nodes);
-  assert(r1.length === 1, 'resolves single hop');
-  assert(r1[0].name === 'Node-A', 'resolves to correct node');
-  assert(r1[0].pubkey === 'aabb11223344', 'includes pubkey');
-
-  // Unknown hop
-  delete nodes._prefixIdx; delete nodes._prefixIdxName;
-  const r2 = helpers.disambiguateHops(['ffff'], nodes);
-  assert(r2[0].name === 'ffff', 'unknown hop uses hex as name');
-
-  // Multiple hops
-  delete nodes._prefixIdx; delete nodes._prefixIdxName;
-  const r3 = helpers.disambiguateHops(['aabb', 'ccdd'], nodes);
-  assert(r3.length === 2, 'resolves multiple hops');
-  assert(r3[0].name === 'Node-A' && r3[1].name === 'Node-C', 'both resolved');
-}
-
-// --- updateHashSizeForPacket ---
-console.log('\nupdateHashSizeForPacket:');
-{
-  const map = new Map(), allMap = new Map(), seqMap = new Map();
-
-  // ADVERT packet (payload_type=4)
-  // path byte 0x40 = hash_size 2 (bits 7-6 = 01)
-  const p1 = {
-    payload_type: 4,
-    raw_hex: '0440' + 'aa'.repeat(100),
-    decoded_json: JSON.stringify({ pubKey: 'abc123' }),
-    path_json: null
-  };
-  helpers.updateHashSizeForPacket(p1, map, allMap, seqMap);
-  assert(map.get('abc123') === 2, 'ADVERT sets hash_size=2');
-  assert(allMap.get('abc123').has(2), 'all map has size 2');
-  assert(seqMap.get('abc123')[0] === 2, 'seq map records size');
-
-  // Non-ADVERT with path_json fallback
-  const map2 = new Map(), allMap2 = new Map(), seqMap2 = new Map();
-  const p2 = {
-    payload_type: 1,
-    raw_hex: '0140ff',  // path byte 0x40 = hash_size 2
-    decoded_json: JSON.stringify({ pubKey: 'def456' }),
-    path_json: JSON.stringify(['aabb'])
-  };
-  helpers.updateHashSizeForPacket(p2, map2, allMap2, seqMap2);
-  assert(map2.get('def456') === 2, 'non-ADVERT falls back to path byte');
-
-  // Already-parsed decoded_json (object, not string)
-  const map3 = new Map(), allMap3 = new Map(), seqMap3 = new Map();
-  const p3 = {
-    payload_type: 4,
-    raw_hex: '04c0' + 'aa'.repeat(100),  // 0xC0 = bits 7-6 = 11 = hash_size 4
-    decoded_json: { pubKey: 'ghi789' },
-    path_json: null
-  };
-  helpers.updateHashSizeForPacket(p3, map3, allMap3, seqMap3);
-  assert(map3.get('ghi789') === 4, 'handles object decoded_json');
-}
-
-// --- rebuildHashSizeMap ---
-console.log('\nrebuildHashSizeMap:');
-{
-  const map = new Map(), allMap = new Map(), seqMap = new Map();
-  const packets = [
-    // Newest first (as packet store provides)
-    { payload_type: 4, raw_hex: '0480' + 'bb'.repeat(50), decoded_json: JSON.stringify({ pubKey: 'node1' }), path_json: null },
-    { payload_type: 4, raw_hex: '0440' + 'aa'.repeat(50), decoded_json: JSON.stringify({ pubKey: 'node1' }), path_json: null },
-  ];
-  helpers.rebuildHashSizeMap(packets, map, allMap, seqMap);
-  assert(map.get('node1') === 3, 'first seen (newest) wins for map');
-  assert(allMap.get('node1').size === 2, 'all map has both sizes');
-  // Seq should be reversed to chronological: [2, 3]
-  const seq = seqMap.get('node1');
-  assert(seq[0] === 2 && seq[1] === 3, 'sequence is chronological (reversed)');
-
-  // Pass 2 fallback: node without advert
-  const map2 = new Map(), allMap2 = new Map(), seqMap2 = new Map();
-  const packets2 = [
-    { payload_type: 1, raw_hex: '0140ff', decoded_json: JSON.stringify({ pubKey: 'node2' }), path_json: JSON.stringify(['aabb']) },
-  ];
-  helpers.rebuildHashSizeMap(packets2, map2, allMap2, seqMap2);
-  assert(map2.get('node2') === 2, 'pass 2 fallback from path');
-}
-
-// --- requireApiKey ---
-console.log('\nrequireApiKey:');
-{
-  // No API key configured
-  const mw1 = helpers.requireApiKey(null);
-  let nextCalled = false;
-  mw1({headers: {}, query: {}}, {}, () => { nextCalled = true; });
-  assert(nextCalled, 'no key configured = passes through');
-
-  // Valid key
-  const mw2 = helpers.requireApiKey('secret123');
-  nextCalled = false;
-  mw2({headers: {'x-api-key': 'secret123'}, query: {}}, {}, () => { nextCalled = true; });
-  assert(nextCalled, 'valid header key passes');
-
-  // Valid key via query
-  nextCalled = false;
-  mw2({headers: {}, query: {apiKey: 'secret123'}}, {}, () => { nextCalled = true; });
-  assert(nextCalled, 'valid query key passes');
-
-  // Invalid key
-  let statusCode = null, jsonBody = null;
-  const mockRes = {
-    status(code) { statusCode = code; return { json(body) { jsonBody = body; } }; }
-  };
-  nextCalled = false;
-  mw2({headers: {'x-api-key': 'wrong'}, query: {}}, mockRes, () => { nextCalled = true; });
-  assert(!nextCalled && statusCode === 401, 'invalid key returns 401');
-}
-
-console.log(`\n═══════════════════════════════════════`);
-console.log(`  PASSED: ${passed}`);
-console.log(`  FAILED: ${failed}`);
-console.log(`═══════════════════════════════════════`);
-if (failed > 0) process.exit(1);

tools/e2e-test.js

@@ -1,476 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * MeshCore Analyzer — End-to-End Validation Test (M12)
- *
- * Starts the server with a temp DB, injects 100+ synthetic packets,
- * validates every API endpoint, WebSocket broadcasts, and optionally MQTT.
- */
-
-const { spawn, execSync } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const crypto = require('crypto');
-const WebSocket = require('ws');
-
-const PROJECT_DIR = path.join(__dirname, '..');
-const PORT = 13579; // avoid conflict with dev server
-const BASE = `http://localhost:${PORT}`;
-
-// ── Helpers ──────────────────────────────────────────────────────────
-
-let passed = 0, failed = 0;
-const failures = [];
-
-function assert(cond, label) {
-  if (cond) { passed++; }
-  else { failed++; failures.push(label); console.error(`  ❌ FAIL: ${label}`); }
-}
-
-async function get(path) {
-  const r = await fetch(`${BASE}${path}`);
-  return { status: r.status, data: await r.json() };
-}
-
-async function post(path, body) {
-  const r = await fetch(`${BASE}${path}`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-  return { status: r.status, data: await r.json() };
-}
-
-function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
-
-// ── Packet generation (inline from generate-packets.js logic) ────────
-
-const OBSERVERS = [
-  { id: 'E2E-SJC-1', iata: 'SJC' },
-  { id: 'E2E-SFO-2', iata: 'SFO' },
-  { id: 'E2E-OAK-3', iata: 'OAK' },
-];
-
-const NODE_NAMES = [
-  'TestNode Alpha', 'TestNode Beta', 'TestNode Gamma', 'TestNode Delta',
-  'TestNode Epsilon', 'TestNode Zeta', 'TestNode Eta', 'TestNode Theta',
-];
-
-function rand(a, b) { return Math.random() * (b - a) + a; }
-function randInt(a, b) { return Math.floor(rand(a, b + 1)); }
-function pick(a) { return a[randInt(0, a.length - 1)]; }
-function randomBytes(n) { return crypto.randomBytes(n); }
-
-function pubkeyFor(name) {
-  return crypto.createHash('sha256').update(name).digest();
-}
-
-function encodeHeader(routeType, payloadType, ver = 0) {
-  return (routeType & 0x03) | ((payloadType & 0x0F) << 2) | ((ver & 0x03) << 6);
-}
-
-function buildPath(hopCount, hashSize = 2) {
-  const pathByte = ((hashSize - 1) << 6) | (hopCount & 0x3F);
-  const hops = crypto.randomBytes(hashSize * hopCount);
-  return { pathByte, hops };
-}
-
-function buildAdvert(name, role) {
-  const pubKey = pubkeyFor(name);
-  const ts = Buffer.alloc(4); ts.writeUInt32LE(Math.floor(Date.now() / 1000));
-  const sig = randomBytes(64);
-  let flags = 0x80 | 0x10; // hasName + hasLocation
-  if (role === 'repeater') flags |= 0x02;
-  else if (role === 'room') flags |= 0x04;
-  else if (role === 'sensor') flags |= 0x08;
-  else flags |= 0x01;
-  const nameBuf = Buffer.from(name, 'utf8');
-  const appdata = Buffer.alloc(9 + nameBuf.length);
-  appdata[0] = flags;
-  appdata.writeInt32LE(Math.round(37.34 * 1e6), 1);
-  appdata.writeInt32LE(Math.round(-121.89 * 1e6), 5);
-  nameBuf.copy(appdata, 9);
-  const payload = Buffer.concat([pubKey, ts, sig, appdata]);
-  const header = encodeHeader(1, 0x04, 0); // FLOOD + ADVERT
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildGrpTxt(channelHash = 0) {
-  const mac = randomBytes(2);
-  const enc = randomBytes(randInt(10, 40));
-  const payload = Buffer.concat([Buffer.from([channelHash]), mac, enc]);
-  const header = encodeHeader(1, 0x05, 0); // FLOOD + GRP_TXT
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildAck() {
-  const payload = randomBytes(18);
-  const header = encodeHeader(2, 0x03, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 2));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildTxtMsg() {
-  const payload = Buffer.concat([randomBytes(6), randomBytes(6), randomBytes(4), randomBytes(20)]);
-  const header = encodeHeader(2, 0x02, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 2));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-// ── Main ─────────────────────────────────────────────────────────────
-
-async function main() {
-  // 1. Create temp DB
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-e2e-'));
-  const dbPath = path.join(tmpDir, 'test.db');
-  console.log(`Temp DB: ${dbPath}`);
-
-  // 2. Start server
-  console.log('Starting server...');
-  const srv = spawn('node', ['server.js'], {
-    cwd: PROJECT_DIR,
-    env: { ...process.env, DB_PATH: dbPath, PORT: String(PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-
-  let serverOutput = '';
-  srv.stdout.on('data', d => { serverOutput += d; });
-  srv.stderr.on('data', d => { serverOutput += d; });
-
-  // We need the server to respect PORT env — check if config is hard-coded
-  // The server uses config.port from config.json. We need to patch that or
-  // monkey-patch. Let's just use port 3000 if the server doesn't read PORT env.
-  // Actually let me check...
-
-  const cleanup = () => {
-    try { srv.kill('SIGTERM'); } catch {}
-    try { fs.unlinkSync(dbPath); fs.rmdirSync(tmpDir); } catch {}
-  };
-
-  process.on('SIGINT', () => { cleanup(); process.exit(1); });
-  process.on('uncaughtException', (e) => { console.error(e); cleanup(); process.exit(1); });
-
-  // 3. Wait for server ready
-  let ready = false;
-  for (let i = 0; i < 30; i++) {
-    await sleep(500);
-    try {
-      const r = await fetch(`${BASE}/api/stats`);
-      if (r.ok) { ready = true; break; }
-    } catch {}
-  }
-
-  if (!ready) {
-    console.error('Server did not start in time. Output:', serverOutput);
-    cleanup();
-    process.exit(1);
-  }
-  console.log('Server ready.\n');
-
-  // 4. Connect WebSocket
-  const wsMessages = [];
-  const ws = new WebSocket(`ws://localhost:${PORT}`);
-  await new Promise((resolve, reject) => {
-    ws.on('open', resolve);
-    ws.on('error', reject);
-    setTimeout(() => reject(new Error('WS timeout')), 5000);
-  });
-  ws.on('message', (data) => {
-    try { wsMessages.push(JSON.parse(data.toString())); } catch {}
-  });
-  console.log('WebSocket connected.\n');
-
-  // 5. Generate and inject packets
-  const roles = ['repeater', 'room', 'companion', 'sensor'];
-  const injected = [];
-  const advertNodes = {}; // name -> {role, pubkey, count}
-  const grpTxtCount = { total: 0, byChannel: {} };
-  const observerCounts = {}; // id -> count
-  const hashToObservers = {}; // hash -> Set(observer)
-
-  // Generate ADVERT packets — ensure at least one of each role
-  for (let ri = 0; ri < roles.length; ri++) {
-    const name = NODE_NAMES[ri];
-    const role = roles[ri];
-    const buf = buildAdvert(name, role);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = OBSERVERS[ri % OBSERVERS.length];
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 5.0, rssi: -80 });
-    advertNodes[name] = { role, pubkey: pubkeyFor(name).toString('hex'), count: 1 };
-    observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-    if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-    hashToObservers[hash].add(obs.id);
-  }
-
-  // More ADVERTs
-  for (let i = 0; i < 40; i++) {
-    const name = pick(NODE_NAMES);
-    const role = pick(roles);
-    const buf = buildAdvert(name, role);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    // Multi-observer: 30% chance heard by 2 observers
-    const obsCount = Math.random() < 0.3 ? 2 : 1;
-    const shuffled = [...OBSERVERS].sort(() => Math.random() - 0.5);
-    for (let o = 0; o < obsCount; o++) {
-      const obs = shuffled[o];
-      injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: rand(-2, 10), rssi: rand(-110, -60) });
-      observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-      if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-      hashToObservers[hash].add(obs.id);
-    }
-    if (!advertNodes[name]) advertNodes[name] = { role, pubkey: pubkeyFor(name).toString('hex'), count: 0 };
-    advertNodes[name].count++;
-  }
-
-  // GRP_TXT packets
-  for (let i = 0; i < 30; i++) {
-    const ch = randInt(0, 3);
-    const buf = buildGrpTxt(ch);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 3.0, rssi: -90 });
-    grpTxtCount.total++;
-    grpTxtCount.byChannel[ch] = (grpTxtCount.byChannel[ch] || 0) + 1;
-    observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-    if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-    hashToObservers[hash].add(obs.id);
-  }
-
-  // ACK + TXT_MSG
-  for (let i = 0; i < 20; i++) {
-    const buf = i < 10 ? buildAck() : buildTxtMsg();
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 1.0, rssi: -95 });
-    observerCounts[obs.id] = (observerCounts[obs.id] || 0) + 1;
-    if (!hashToObservers[hash]) hashToObservers[hash] = new Set();
-    hashToObservers[hash].add(obs.id);
-  }
-
-  // Find a hash with multiple observers for trace testing
-  let traceHash = null;
-  for (const [h, obs] of Object.entries(hashToObservers)) {
-    if (obs.size >= 2) { traceHash = h; break; }
-  }
-  // If none, create one explicitly
-  if (!traceHash) {
-    const buf = buildAck();
-    const hex = buf.toString('hex').toUpperCase();
-    traceHash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    injected.push({ hex, observer: OBSERVERS[0].id, region: OBSERVERS[0].iata, hash: traceHash, snr: 5, rssi: -80 });
-    injected.push({ hex, observer: OBSERVERS[1].id, region: OBSERVERS[1].iata, hash: traceHash, snr: 3, rssi: -90 });
-    observerCounts[OBSERVERS[0].id] = (observerCounts[OBSERVERS[0].id] || 0) + 1;
-    observerCounts[OBSERVERS[1].id] = (observerCounts[OBSERVERS[1].id] || 0) + 1;
-  }
-
-  console.log(`Injecting ${injected.length} packets...`);
-  let injectOk = 0, injectFail = 0;
-  for (const pkt of injected) {
-    const r = await post('/api/packets', pkt);
-    if (r.status === 200) injectOk++;
-    else { injectFail++; if (injectFail <= 3) console.error('  Inject fail:', r.data); }
-  }
-  console.log(`Injected: ${injectOk} ok, ${injectFail} fail\n`);
-  assert(injectFail === 0, 'All packets injected successfully');
-  assert(injected.length >= 100, `Injected 100+ packets (got ${injected.length})`);
-
-  // Wait a moment for WS messages to arrive
-  await sleep(500);
-
-  // ── Validate ───────────────────────────────────────────────────────
-
-  // 5a. Stats
-  console.log('── Stats ──');
-  const stats = (await get('/api/stats')).data;
-  // totalPackets includes seed packet, so should be >= injected.length
-  assert(stats.totalPackets > 0, `stats.totalPackets (${stats.totalPackets}) >= ${injected.length}`);
-  assert(stats.totalNodes > 0, `stats.totalNodes > 0 (${stats.totalNodes})`);
-  assert(stats.totalObservers >= OBSERVERS.length, `stats.totalObservers >= ${OBSERVERS.length} (${stats.totalObservers})`);
-  console.log(`  totalPackets=${stats.totalPackets} totalNodes=${stats.totalNodes} totalObservers=${stats.totalObservers}\n`);
-
-  // 5b. Packets API - basic list
-  console.log('── Packets API ──');
-  const pktsAll = (await get('/api/packets?limit=200')).data;
-  assert(pktsAll.total > 0, `packets total (${pktsAll.total}) > 0`);
-  assert(pktsAll.packets.length > 0, 'packets array not empty');
-
-  // Filter by type (ADVERT = 4)
-  const pktsAdvert = (await get('/api/packets?type=4&limit=200')).data;
-  assert(pktsAdvert.total > 0, `filter by type=ADVERT returns results (${pktsAdvert.total})`);
-  assert(pktsAdvert.packets.every(p => p.payload_type === 4), 'all filtered packets are ADVERT');
-
-  // Filter by observer
-  const testObs = OBSERVERS[0].id;
-  const pktsObs = (await get(`/api/packets?observer=${testObs}&limit=200`)).data;
-  assert(pktsObs.total > 0, `filter by observer=${testObs} returns results`);
-  assert(pktsObs.packets.length > 0, 'observer filter returns packets');
-
-  // Filter by region
-  const pktsRegion = (await get('/api/packets?region=SJC&limit=200')).data;
-  assert(pktsRegion.total > 0, 'filter by region=SJC returns results');
-
-  // Pagination
-  const page1 = (await get('/api/packets?limit=5&offset=0')).data;
-  const page2 = (await get('/api/packets?limit=5&offset=5')).data;
-  assert(page1.packets.length === 5, 'pagination: page1 has 5');
-  assert(page2.packets.length === 5, 'pagination: page2 has 5');
-  if (page1.packets.length && page2.packets.length) {
-    assert(page1.packets[0].id !== page2.packets[0].id, 'pagination: pages are different');
-  }
-
-  // groupByHash
-  const grouped = (await get('/api/packets?groupByHash=true&limit=200')).data;
-  assert(grouped.total > 0, `groupByHash returns results (${grouped.total})`);
-  assert(grouped.packets[0].hash !== undefined, 'groupByHash entries have hash');
-  assert(grouped.packets[0].count !== undefined, 'groupByHash entries have count');
-  // Find a multi-observer group
-  const multiObs = grouped.packets.find(p => p.observer_count >= 2);
-  assert(!!multiObs, 'groupByHash has entry with observer_count >= 2');
-  console.log('  ✓ Packets API checks passed\n');
-
-  // 5c. Packet detail
-  console.log('── Packet Detail ──');
-  const firstPkt = pktsAll.packets[0];
-  const detail = (await get(`/api/packets/${firstPkt.id}`)).data;
-  assert(detail.packet !== undefined, 'detail has packet');
-  assert(detail.breakdown !== undefined, 'detail has breakdown');
-  assert(detail.breakdown.ranges !== undefined, 'breakdown has ranges');
-  assert(detail.breakdown.ranges.length > 0, 'breakdown has color ranges');
-  assert(detail.breakdown.ranges[0].color !== undefined, 'ranges have color field');
-  assert(detail.breakdown.ranges[0].start !== undefined, 'ranges have start field');
-  console.log(`  ✓ Detail: ${detail.breakdown.ranges.length} color ranges\n`);
-
-  // 5d. Nodes
-  console.log('── Nodes ──');
-  const nodesResp = (await get('/api/nodes?limit=50')).data;
-  assert(nodesResp.total > 0, `nodes total > 0 (${nodesResp.total})`);
-  assert(nodesResp.nodes.length > 0, 'nodes array not empty');
-  assert(nodesResp.counts !== undefined, 'nodes response has counts');
-
-  // Role filtering
-  const repNodes = (await get('/api/nodes?role=repeater')).data;
-  assert(repNodes.nodes.every(n => n.role === 'repeater'), 'role filter works for repeater');
-
-  // Node detail
-  const someNode = nodesResp.nodes[0];
-  const nodeDetail = (await get(`/api/nodes/${someNode.public_key}`)).data;
-  assert(nodeDetail.node !== undefined, 'node detail has node');
-  assert(nodeDetail.node.public_key === someNode.public_key, 'node detail matches pubkey');
-  assert(nodeDetail.recentAdverts !== undefined, 'node detail has recentAdverts');
-  console.log(`  ✓ Nodes: ${nodesResp.total} total, detail works\n`);
-
-  // 5e. Channels
-  console.log('── Channels ──');
-  const chResp = (await get('/api/channels')).data;
-  const chList = chResp.channels || [];
-  assert(Array.isArray(chList), 'channels response is array');
-  if (chList.length > 0) {
-    const someCh = chList[0];
-    assert(someCh.messageCount > 0, `channel has messages (${someCh.messageCount})`);
-    const msgResp = (await get(`/api/channels/${encodeURIComponent(someCh.hash)}/messages`)).data;
-    assert(msgResp.messages.length > 0, 'channel has message list');
-    assert(msgResp.messages[0].sender !== undefined, 'message has sender');
-    console.log(`  ✓ Channels: ${chList.length} channels\n`);
-  } else {
-    console.log(`  ⚠ Channels: 0 (synthetic packets don't produce decodable channel messages)\n`);
-  }
-
-  // 5f. Observers
-  console.log('── Observers ──');
-  const obsResp = (await get('/api/observers')).data;
-  assert(obsResp.observers.length >= OBSERVERS.length, `observers >= ${OBSERVERS.length} (${obsResp.observers.length})`);
-  for (const expObs of OBSERVERS) {
-    const found = obsResp.observers.find(o => o.id === expObs.id);
-    assert(!!found, `observer ${expObs.id} exists`);
-    if (found) {
-      assert(found.packet_count > 0, `observer ${expObs.id} has packet_count > 0 (${found.packet_count})`);
-    }
-  }
-  console.log(`  ✓ Observers: ${obsResp.observers.length}\n`);
-
-  // 5g. Traces
-  console.log('── Traces ──');
-  if (traceHash) {
-    const traceResp = (await get(`/api/traces/${traceHash}`)).data;
-    assert(Array.isArray(traceResp.traces), 'trace response is array');
-    if (traceResp.traces.length >= 2) {
-      const traceObservers = new Set(traceResp.traces.map(t => t.observer));
-      assert(traceObservers.size >= 2, `trace has >= 2 distinct observers (${traceObservers.size})`);
-    }
-    console.log(`  ✓ Traces: ${traceResp.traces.length} entries for hash\n`);
-  } else {
-    console.log('  ⚠ No multi-observer hash available for trace test\n');
-  }
-
-  // 5h. WebSocket
-  console.log('── WebSocket ──');
-  assert(wsMessages.length > 0, `WebSocket received messages (${wsMessages.length})`);
-  assert(wsMessages.length >= injected.length * 0.5, `WS got >= 50% of injected (${wsMessages.length}/${injected.length})`);
-  const wsPacketMsgs = wsMessages.filter(m => m.type === 'packet');
-  assert(wsPacketMsgs.length > 0, 'WS has packet-type messages');
-  console.log(`  ✓ WebSocket: ${wsMessages.length} messages received\n`);
-
-  // 6. MQTT (optional)
-  console.log('── MQTT ──');
-  let mqttAvailable = false;
-  try {
-    execSync('which mosquitto_pub', { stdio: 'ignore' });
-    mqttAvailable = true;
-  } catch {}
-
-  if (mqttAvailable) {
-    console.log('  mosquitto_pub found, testing MQTT path...');
-    // Would need a running mosquitto broker — skip if not running
-    try {
-      const mqttMod = require('mqtt');
-      const mc = mqttMod.connect('mqtt://localhost:1883', { connectTimeout: 2000 });
-      await new Promise((resolve, reject) => {
-        mc.on('connect', resolve);
-        mc.on('error', reject);
-        setTimeout(() => reject(new Error('timeout')), 2000);
-      });
-      const mqttHex = buildAdvert('MQTTTestNode', 'repeater').toString('hex').toUpperCase();
-      const mqttHash = 'mqtt-test-hash-001';
-      mc.publish('meshcore/SJC/MQTT-OBS-1/packets', JSON.stringify({
-        raw: mqttHex, SNR: 8.0, RSSI: -75, hash: mqttHash,
-      }));
-      await sleep(1000);
-      mc.end();
-      const mqttTrace = (await get(`/api/traces/${mqttHash}`)).data;
-      assert(mqttTrace.traces.length >= 1, 'MQTT packet appeared in traces');
-      console.log('  ✓ MQTT path works\n');
-    } catch (e) {
-      console.log(`  ⚠ MQTT broker not reachable: ${e.message}\n`);
-    }
-  } else {
-    console.log('  ⚠ mosquitto not available, skipping MQTT test\n');
-  }
-
-  // 7. Summary
-  ws.close();
-  cleanup();
-
-  console.log('═══════════════════════════════════════');
-  console.log(`  PASSED: ${passed}`);
-  console.log(`  FAILED: ${failed}`);
-  if (failures.length) {
-    console.log('  Failures:');
-    failures.forEach(f => console.log(`    - ${f}`));
-  }
-  console.log('═══════════════════════════════════════');
-
-  process.exit(failed > 0 ? 1 : 0);
-}
-
-main().catch(e => {
-  console.error('Fatal:', e);
-  process.exit(1);
-});

tools/frontend-test.js

@@ -1,320 +0,0 @@
-#!/usr/bin/env node
-'use strict';
-
-/**
- * MeshCore Analyzer — Frontend Smoke Tests (M13)
- *
- * Starts the server with a temp DB, injects synthetic packets,
- * then validates HTML pages, JS syntax, and API data shapes.
- */
-
-const { spawn } = require('child_process');
-const path = require('path');
-const fs = require('fs');
-const os = require('os');
-const crypto = require('crypto');
-
-const PROJECT_DIR = path.join(__dirname, '..');
-const PORT = 13580;
-const BASE = `http://localhost:${PORT}`;
-
-// ── Helpers ──────────────────────────────────────────────────────────
-
-let passed = 0, failed = 0;
-const failures = [];
-
-function assert(cond, label) {
-  if (cond) { passed++; }
-  else { failed++; failures.push(label); console.error(`  ❌ FAIL: ${label}`); }
-}
-
-function sleep(ms) { return new Promise(r => setTimeout(r, ms)); }
-
-async function get(urlPath) {
-  const r = await fetch(`${BASE}${urlPath}`);
-  return { status: r.status, data: await r.json() };
-}
-
-async function getHtml(urlPath) {
-  const r = await fetch(`${BASE}${urlPath}`);
-  return { status: r.status, text: await r.text() };
-}
-
-async function post(urlPath, body) {
-  const r = await fetch(`${BASE}${urlPath}`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(body),
-  });
-  return { status: r.status, data: await r.json() };
-}
-
-// ── Packet builders (from e2e-test.js) ───────────────────────────────
-
-function rand(a, b) { return Math.random() * (b - a) + a; }
-function randInt(a, b) { return Math.floor(rand(a, b + 1)); }
-function pick(a) { return a[randInt(0, a.length - 1)]; }
-
-function pubkeyFor(name) {
-  return crypto.createHash('sha256').update(name).digest();
-}
-
-function encodeHeader(routeType, payloadType, ver = 0) {
-  return (routeType & 0x03) | ((payloadType & 0x0F) << 2) | ((ver & 0x03) << 6);
-}
-
-function buildPath(hopCount, hashSize = 2) {
-  const pathByte = ((hashSize - 1) << 6) | (hopCount & 0x3F);
-  const hops = crypto.randomBytes(hashSize * hopCount);
-  return { pathByte, hops };
-}
-
-function buildAdvert(name, role) {
-  const pubKey = pubkeyFor(name);
-  const ts = Buffer.alloc(4); ts.writeUInt32LE(Math.floor(Date.now() / 1000));
-  const sig = crypto.randomBytes(64);
-  let flags = 0x80 | 0x10;
-  if (role === 'repeater') flags |= 0x02;
-  else if (role === 'room') flags |= 0x04;
-  else if (role === 'sensor') flags |= 0x08;
-  else flags |= 0x01;
-  const nameBuf = Buffer.from(name, 'utf8');
-  const appdata = Buffer.alloc(9 + nameBuf.length);
-  appdata[0] = flags;
-  appdata.writeInt32LE(Math.round(37.34 * 1e6), 1);
-  appdata.writeInt32LE(Math.round(-121.89 * 1e6), 5);
-  nameBuf.copy(appdata, 9);
-  const payload = Buffer.concat([pubKey, ts, sig, appdata]);
-  const header = encodeHeader(1, 0x04, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildGrpTxt(channelHash = 0) {
-  const mac = crypto.randomBytes(2);
-  const enc = crypto.randomBytes(randInt(10, 40));
-  const payload = Buffer.concat([Buffer.from([channelHash]), mac, enc]);
-  const header = encodeHeader(1, 0x05, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 3));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-function buildAck() {
-  const payload = crypto.randomBytes(18);
-  const header = encodeHeader(2, 0x03, 0);
-  const { pathByte, hops } = buildPath(randInt(0, 2));
-  return Buffer.concat([Buffer.from([header, pathByte]), hops, payload]);
-}
-
-// ── Main ─────────────────────────────────────────────────────────────
-
-const OBSERVERS = [
-  { id: 'FE-SJC-1', iata: 'SJC' },
-  { id: 'FE-SFO-2', iata: 'SFO' },
-];
-
-const NODE_NAMES = ['FENode Alpha', 'FENode Beta', 'FENode Gamma', 'FENode Delta'];
-
-async function main() {
-  // 1. Temp DB
-  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'meshcore-fe-'));
-  const dbPath = path.join(tmpDir, 'test.db');
-  console.log(`Temp DB: ${dbPath}`);
-
-  // 2. Start server
-  console.log('Starting server...');
-  const srv = spawn('node', ['server.js'], {
-    cwd: PROJECT_DIR,
-    env: { ...process.env, DB_PATH: dbPath, PORT: String(PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-  });
-
-  let serverOutput = '';
-  srv.stdout.on('data', d => { serverOutput += d; });
-  srv.stderr.on('data', d => { serverOutput += d; });
-
-  const cleanup = () => {
-    try { srv.kill('SIGTERM'); } catch {}
-    try { fs.unlinkSync(dbPath); fs.rmdirSync(tmpDir); } catch {}
-  };
-
-  process.on('SIGINT', () => { cleanup(); process.exit(1); });
-
-  // 3. Wait for ready
-  let ready = false;
-  for (let i = 0; i < 30; i++) {
-    await sleep(500);
-    try {
-      const r = await fetch(`${BASE}/api/stats`);
-      if (r.ok) { ready = true; break; }
-    } catch {}
-  }
-  if (!ready) {
-    console.error('Server did not start. Output:', serverOutput);
-    cleanup();
-    process.exit(1);
-  }
-  console.log('Server ready.\n');
-
-  // 4. Inject test data
-  const injected = [];
-  const roles = ['repeater', 'room', 'companion', 'sensor'];
-  for (let i = 0; i < NODE_NAMES.length; i++) {
-    const buf = buildAdvert(NODE_NAMES[i], roles[i]);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = OBSERVERS[i % OBSERVERS.length];
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 5.0, rssi: -80 });
-  }
-  for (let i = 0; i < 20; i++) {
-    const buf = buildGrpTxt(i % 3);
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 3.0, rssi: -90 });
-  }
-  for (let i = 0; i < 10; i++) {
-    const buf = buildAck();
-    const hex = buf.toString('hex').toUpperCase();
-    const hash = crypto.createHash('md5').update(hex).digest('hex').slice(0, 16);
-    const obs = pick(OBSERVERS);
-    injected.push({ hex, observer: obs.id, region: obs.iata, hash, snr: 1.0, rssi: -95 });
-  }
-
-  console.log(`Injecting ${injected.length} packets...`);
-  let injectFail = 0;
-  for (const pkt of injected) {
-    const r = await post('/api/packets', pkt);
-    if (r.status !== 200) injectFail++;
-  }
-  assert(injectFail === 0, `All ${injected.length} packets injected`);
-  console.log(`Injected: ${injected.length - injectFail} ok, ${injectFail} fail\n`);
-
-  // ── HTML & Nav Tests ───────────────────────────────────────────────
-  console.log('── HTML & Navigation ──');
-  const { status: htmlStatus, text: html } = await getHtml('/');
-  assert(htmlStatus === 200, 'index.html returns 200');
-  assert(html.includes('<nav'), 'index.html contains <nav>');
-
-  const expectedLinks = ['#/packets', '#/map', '#/channels', '#/nodes', '#/traces', '#/observers'];
-  for (const link of expectedLinks) {
-    assert(html.includes(`href="${link}"`), `nav contains link to ${link}`);
-  }
-
-  // ── JS File References ─────────────────────────────────────────────
-  console.log('\n── JS File References ──');
-  const jsFiles = ['app.js', 'packets.js', 'map.js', 'channels.js', 'nodes.js', 'traces.js', 'observers.js'];
-  for (const jsFile of jsFiles) {
-    assert(html.includes(`src="${jsFile}`) || html.includes(`src="${jsFile}?`), `index.html references ${jsFile}`);
-  }
-
-  // ── JS Syntax Validation ───────────────────────────────────────────
-  console.log('\n── JS Syntax Validation ──');
-  for (const jsFile of jsFiles) {
-    const jsPath = path.join(PROJECT_DIR, 'public', jsFile);
-    try {
-      const source = fs.readFileSync(jsPath, 'utf8');
-      // Use the vm module's Script to check for syntax errors
-      new (require('vm')).Script(source, { filename: jsFile });
-      assert(true, `${jsFile} has valid syntax`);
-    } catch (e) {
-      assert(false, `${jsFile} syntax error: ${e.message}`);
-    }
-  }
-
-  // ── JS Files Fetchable from Server ─────────────────────────────────
-  console.log('\n── JS Files Served ──');
-  for (const jsFile of jsFiles) {
-    const resp = await getHtml(`/${jsFile}`);
-    assert(resp.status === 200, `${jsFile} served with 200`);
-    assert(resp.text.length > 0, `${jsFile} is non-empty`);
-  }
-
-  // ── API Data Shape Validation ──────────────────────────────────────
-  console.log('\n── API: /api/stats ──');
-  const stats = (await get('/api/stats')).data;
-  assert(typeof stats.totalPackets === 'number', 'stats.totalPackets is number');
-  assert(typeof stats.totalNodes === 'number', 'stats.totalNodes is number');
-  assert(typeof stats.totalObservers === 'number', 'stats.totalObservers is number');
-  assert(stats.totalPackets > 0, `stats.totalPackets > 0 (${stats.totalPackets})`);
-
-  console.log('\n── API: /api/packets (packets page) ──');
-  const pkts = (await get('/api/packets?limit=10')).data;
-  assert(typeof pkts.total === 'number', 'packets response has total');
-  assert(Array.isArray(pkts.packets), 'packets response has packets array');
-  assert(pkts.packets.length > 0, 'packets array non-empty');
-  const pkt0 = pkts.packets[0];
-  assert(pkt0.id !== undefined, 'packet has id');
-  assert(pkt0.raw_hex !== undefined, 'packet has raw_hex');
-  assert(pkt0.payload_type !== undefined, 'packet has payload_type');
-  assert(pkt0.observer_id !== undefined, 'packet has observer_id');
-
-  // Packet detail (byte breakdown)
-  const detail = (await get(`/api/packets/${pkt0.id}`)).data;
-  assert(detail.packet !== undefined, 'packet detail has packet');
-  assert(detail.breakdown !== undefined, 'packet detail has breakdown');
-  assert(Array.isArray(detail.breakdown.ranges), 'breakdown has ranges array');
-
-  console.log('\n── API: /api/packets?groupByHash (map page) ──');
-  const grouped = (await get('/api/packets?groupByHash=true&limit=10')).data;
-  assert(typeof grouped.total === 'number', 'groupByHash has total');
-  assert(Array.isArray(grouped.packets), 'groupByHash has packets array');
-
-  console.log('\n── API: /api/channels (channels page) ──');
-  const ch = (await get('/api/channels')).data;
-  assert(Array.isArray(ch.channels), 'channels response has channels array');
-  if (ch.channels.length > 0) {
-    assert(ch.channels[0].hash !== undefined, 'channel has hash');
-    assert(ch.channels[0].messageCount !== undefined, 'channel has messageCount');
-    const chMsgs = (await get(`/api/channels/${ch.channels[0].hash}/messages`)).data;
-    assert(Array.isArray(chMsgs.messages || []), 'channel messages is array');
-  } else {
-    console.log('  ⚠ No channels (synthetic packets are not decodable channel messages)');
-  }
-
-  console.log('\n── API: /api/nodes (nodes page) ──');
-  const nodes = (await get('/api/nodes?limit=10')).data;
-  assert(typeof nodes.total === 'number', 'nodes has total');
-  assert(Array.isArray(nodes.nodes), 'nodes has nodes array');
-  assert(nodes.nodes.length > 0, 'nodes non-empty');
-  const n0 = nodes.nodes[0];
-  assert(n0.public_key !== undefined, 'node has public_key');
-  assert(n0.name !== undefined, 'node has name');
-
-  // Node detail
-  const nd = (await get(`/api/nodes/${n0.public_key}`)).data;
-  assert(nd.node !== undefined, 'node detail has node');
-  assert(nd.recentAdverts !== undefined, 'node detail has recentAdverts');
-
-  console.log('\n── API: /api/observers (observers page) ──');
-  const obs = (await get('/api/observers')).data;
-  assert(Array.isArray(obs.observers), 'observers is array');
-  assert(obs.observers.length > 0, 'observers non-empty');
-  assert(obs.observers[0].id !== undefined, 'observer has id');
-  assert(obs.observers[0].packet_count !== undefined, 'observer has packet_count');
-
-  console.log('\n── API: /api/traces (traces page) ──');
-  // Use a known hash from injected packets
-  const knownHash = crypto.createHash('md5').update(injected[0].hex).digest('hex').slice(0, 16);
-  const traces = (await get(`/api/traces/${knownHash}`)).data;
-  assert(Array.isArray(traces.traces), 'traces is array');
-
-  // ── Summary ────────────────────────────────────────────────────────
-  cleanup();
-
-  console.log('\n═══════════════════════════════════════');
-  console.log(`  PASSED: ${passed}`);
-  console.log(`  FAILED: ${failed}`);
-  if (failures.length) {
-    console.log('  Failures:');
-    failures.forEach(f => console.log(`    - ${f}`));
-  }
-  console.log('═══════════════════════════════════════');
-
-  process.exit(failed > 0 ? 1 : 0);
-}
-
-main().catch(e => {
-  console.error('Fatal:', e);
-  process.exit(1);
-});